@tangle-network/agent-app 0.28.0 → 0.29.0

package/dist/chunk-3G334FVA.js

@@ -0,0 +1,162 @@
+import {
+  hasWorkspaceRole
+} from "./chunk-63CE7FEZ.js";
+
+// src/teams-react/components/MembersPanel.tsx
+import { useState } from "react";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+var ASSIGNABLE = [
+  { value: "viewer", label: "Viewer" },
+  { value: "editor", label: "Editor" },
+  { value: "admin", label: "Admin" }
+];
+function MembersPanel({
+  members,
+  currentRole,
+  onInvite,
+  onChangeRole,
+  onRemove,
+  onNotice
+}) {
+  const [inviteEmail, setInviteEmail] = useState("");
+  const [inviteRole, setInviteRole] = useState("editor");
+  const [inviting, setInviting] = useState(false);
+  const canManage = hasWorkspaceRole(currentRole, "admin");
+  function notify(kind, message) {
+    onNotice?.({ kind, message });
+  }
+  async function submitInvite() {
+    const email = inviteEmail.trim();
+    if (!email || inviting) return;
+    setInviting(true);
+    try {
+      const result = await onInvite({ email, role: inviteRole });
+      if (result && "inviteUrl" in result && result.inviteUrl) {
+        notify("success", `Invite link ready for ${email}`);
+      } else {
+        notify("success", `Invited ${email}`);
+      }
+      setInviteEmail("");
+    } catch (err) {
+      notify("error", err instanceof Error ? err.message : "Failed to invite");
+    } finally {
+      setInviting(false);
+    }
+  }
+  async function changeRole(memberId, role) {
+    try {
+      await onChangeRole({ memberId, role });
+      notify("success", "Role updated");
+    } catch (err) {
+      notify("error", err instanceof Error ? err.message : "Failed to update role");
+    }
+  }
+  async function remove(memberId) {
+    try {
+      await onRemove({ memberId });
+      notify("success", "Member removed");
+    } catch (err) {
+      notify("error", err instanceof Error ? err.message : "Failed to remove member");
+    }
+  }
+  return /* @__PURE__ */ jsxs("section", { className: "flex flex-col gap-4", children: [
+    /* @__PURE__ */ jsxs("div", { className: "flex flex-col gap-2", children: [
+      members.map((member) => /* @__PURE__ */ jsx(
+        MemberRow,
+        {
+          member,
+          canManage,
+          onChangeRole: changeRole,
+          onRemove: remove
+        },
+        member.id
+      )),
+      members.length === 0 && /* @__PURE__ */ jsx("p", { className: "text-sm text-[var(--text-muted)]", children: "No team members yet." })
+    ] }),
+    canManage && /* @__PURE__ */ jsxs("div", { className: "flex flex-col gap-1.5 border-t border-[var(--border-default)] pt-3", children: [
+      /* @__PURE__ */ jsx("label", { className: "text-xs font-medium text-[var(--text-muted)]", children: "Invite member" }),
+      /* @__PURE__ */ jsxs("div", { className: "flex gap-2", children: [
+        /* @__PURE__ */ jsx(
+          "input",
+          {
+            type: "email",
+            placeholder: "Email address",
+            value: inviteEmail,
+            "aria-label": "Invite email address",
+            onChange: (event) => setInviteEmail(event.target.value),
+            onKeyDown: (event) => {
+              if (event.key === "Enter") void submitInvite();
+            },
+            className: "flex-1 rounded border border-[var(--border-default)] bg-[var(--bg-input)] px-3 py-1.5 text-sm text-[var(--text-primary)] placeholder:text-[var(--text-muted)]"
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          "select",
+          {
+            value: inviteRole,
+            "aria-label": "Invite role",
+            onChange: (event) => setInviteRole(event.target.value),
+            className: "rounded border border-[var(--border-default)] bg-[var(--bg-input)] px-2 py-1.5 text-xs text-[var(--text-secondary)]",
+            children: ASSIGNABLE.map((option) => /* @__PURE__ */ jsx("option", { value: option.value, children: option.label }, option.value))
+          }
+        ),
+        /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => void submitInvite(),
+            disabled: inviting || !inviteEmail.trim(),
+            className: "rounded bg-[var(--brand-primary)] px-3 py-1.5 text-sm text-white disabled:opacity-50",
+            children: inviting ? "Inviting\u2026" : "Invite"
+          }
+        )
+      ] })
+    ] })
+  ] });
+}
+function MemberRow({ member, canManage, onChangeRole, onRemove }) {
+  const pending = member.acceptedAt == null;
+  const label = member.name ?? member.email ?? "Unknown";
+  const initial = (member.name?.[0] ?? member.email?.[0] ?? "?").toUpperCase();
+  const isOwner = member.role === "owner";
+  const editable = canManage && !isOwner && !member.inherited;
+  return /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-between border-b border-[var(--border-default)] py-2 last:border-0", children: [
+    /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-3", children: [
+      /* @__PURE__ */ jsx("div", { className: "flex h-8 w-8 items-center justify-center rounded-full bg-[var(--bg-input)] text-xs font-bold text-[var(--text-secondary)]", children: initial }),
+      /* @__PURE__ */ jsxs("div", { children: [
+        /* @__PURE__ */ jsxs("p", { className: "flex items-center gap-2 text-sm font-medium text-[var(--text-primary)]", children: [
+          label,
+          pending && /* @__PURE__ */ jsx("span", { className: "rounded border border-[var(--border-default)] px-1.5 py-0.5 text-[10px] uppercase text-[var(--text-muted)]", children: "Pending" })
+        ] }),
+        member.name && member.email && /* @__PURE__ */ jsx("p", { className: "text-xs text-[var(--text-muted)]", children: member.email })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsx("div", { className: "flex items-center gap-2", children: isOwner ? /* @__PURE__ */ jsx("span", { className: "rounded border border-[var(--border-default)] px-2 py-0.5 text-xs text-[var(--text-secondary)]", children: member.inherited ? "Org Admin" : "Owner" }) : editable ? /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx(
+        "select",
+        {
+          value: member.role,
+          "aria-label": `Role for ${label}`,
+          onChange: (event) => onChangeRole(member.id, event.target.value),
+          className: "rounded border border-[var(--border-default)] bg-[var(--bg-input)] px-2 py-1 text-xs text-[var(--text-secondary)]",
+          children: ASSIGNABLE.map((option) => /* @__PURE__ */ jsx("option", { value: option.value, children: option.label }, option.value))
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          "aria-label": `Remove ${label}`,
+          onClick: () => onRemove(member.id),
+          className: "rounded px-2 py-1 text-xs text-[var(--text-danger)] hover:bg-[var(--border-default)]",
+          children: "Remove"
+        }
+      )
+    ] }) : /* @__PURE__ */ jsx("span", { className: "rounded border border-[var(--border-default)] px-2 py-0.5 text-xs capitalize text-[var(--text-secondary)]", children: member.role }) })
+  ] });
+}
+
+export {
+  MembersPanel
+};
+//# sourceMappingURL=chunk-3G334FVA.js.map

package/dist/chunk-3G334FVA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/teams-react/components/MembersPanel.tsx"],"sourcesContent":["/**\n * Workspace members panel: list members, invite by email + role, change a\n * member's role, remove a member. Fully callback-driven — the host supplies the\n * data and the async `onInvite`/`onChangeRole`/`onRemove` callbacks (backed by\n * `./teams/members-api`), so this imports no app router, fetch client, or toast.\n * Styled with the shipped Tangle Quiet tokens (`var(--*)`).\n *\n * Role gating mirrors the API: only admins/owners see role selects and the\n * remove control; inherited org owners and explicit owners are not editable\n * here (org-level concern). The invite role select offers `admin` only to\n * admins/owners.\n */\n\nimport { useState } from 'react'\nimport type { WorkspaceRole } from '../../teams/roles'\nimport { hasWorkspaceRole } from '../../teams/roles'\nimport type { MemberView, MembersPanelProps } from '../contracts'\n\nconst ASSIGNABLE: { value: WorkspaceRole; label: string }[] = [\n  { value: 'viewer', label: 'Viewer' },\n  { value: 'editor', label: 'Editor' },\n  { value: 'admin', label: 'Admin' },\n]\n\nexport function MembersPanel({\n  members,\n  currentRole,\n  onInvite,\n  onChangeRole,\n  onRemove,\n  onNotice,\n}: MembersPanelProps) {\n  const [inviteEmail, setInviteEmail] = useState('')\n  const [inviteRole, setInviteRole] = useState<WorkspaceRole>('editor')\n  const [inviting, setInviting] = useState(false)\n\n  const canManage = hasWorkspaceRole(currentRole, 'admin')\n\n  function notify(kind: 'success' | 'error', message: string) {\n    onNotice?.({ kind, message })\n  }\n\n  async function submitInvite() {\n    const email = inviteEmail.trim()\n    if (!email || inviting) return\n    setInviting(true)\n    try {\n      const result = await onInvite({ email, role: inviteRole })\n      if (result && 'inviteUrl' in result && result.inviteUrl) {\n        notify('success', `Invite link ready for ${email}`)\n      } else {\n        notify('success', `Invited ${email}`)\n      }\n      setInviteEmail('')\n    } catch (err) {\n      notify('error', err instanceof Error ? err.message : 'Failed to invite')\n    } finally {\n      setInviting(false)\n    }\n  }\n\n  async function changeRole(memberId: string, role: WorkspaceRole) {\n    try {\n      await onChangeRole({ memberId, role })\n      notify('success', 'Role updated')\n    } catch (err) {\n      notify('error', err instanceof Error ? err.message : 'Failed to update role')\n    }\n  }\n\n  async function remove(memberId: string) {\n    try {\n      await onRemove({ memberId })\n      notify('success', 'Member removed')\n    } catch (err) {\n      notify('error', err instanceof Error ? err.message : 'Failed to remove member')\n    }\n  }\n\n  return (\n    <section className=\"flex flex-col gap-4\">\n      <div className=\"flex flex-col gap-2\">\n        {members.map((member) => (\n          <MemberRow\n            key={member.id}\n            member={member}\n            canManage={canManage}\n            onChangeRole={changeRole}\n            onRemove={remove}\n          />\n        ))}\n        {members.length === 0 && (\n          <p className=\"text-sm text-[var(--text-muted)]\">No team members yet.</p>\n        )}\n      </div>\n\n      {canManage && (\n        <div className=\"flex flex-col gap-1.5 border-t border-[var(--border-default)] pt-3\">\n          <label className=\"text-xs font-medium text-[var(--text-muted)]\">Invite member</label>\n          <div className=\"flex gap-2\">\n            <input\n              type=\"email\"\n              placeholder=\"Email address\"\n              value={inviteEmail}\n              aria-label=\"Invite email address\"\n              onChange={(event) => setInviteEmail(event.target.value)}\n              onKeyDown={(event) => { if (event.key === 'Enter') void submitInvite() }}\n              className=\"flex-1 rounded border border-[var(--border-default)] bg-[var(--bg-input)] px-3 py-1.5 text-sm text-[var(--text-primary)] placeholder:text-[var(--text-muted)]\"\n            />\n            <select\n              value={inviteRole}\n              aria-label=\"Invite role\"\n              onChange={(event) => setInviteRole(event.target.value as WorkspaceRole)}\n              className=\"rounded border border-[var(--border-default)] bg-[var(--bg-input)] px-2 py-1.5 text-xs text-[var(--text-secondary)]\"\n            >\n              {ASSIGNABLE.map((option) => (\n                <option key={option.value} value={option.value}>{option.label}</option>\n              ))}\n            </select>\n            <button\n              type=\"button\"\n              onClick={() => void submitInvite()}\n              disabled={inviting || !inviteEmail.trim()}\n              className=\"rounded bg-[var(--brand-primary)] px-3 py-1.5 text-sm text-white disabled:opacity-50\"\n            >\n              {inviting ? 'Inviting…' : 'Invite'}\n            </button>\n          </div>\n        </div>\n      )}\n    </section>\n  )\n}\n\ninterface MemberRowProps {\n  member: MemberView\n  canManage: boolean\n  onChangeRole(memberId: string, role: WorkspaceRole): void\n  onRemove(memberId: string): void\n}\n\nfunction MemberRow({ member, canManage, onChangeRole, onRemove }: MemberRowProps) {\n  const pending = member.acceptedAt == null\n  const label = member.name ?? member.email ?? 'Unknown'\n  const initial = (member.name?.[0] ?? member.email?.[0] ?? '?').toUpperCase()\n  const isOwner = member.role === 'owner'\n  const editable = canManage && !isOwner && !member.inherited\n\n  return (\n    <div className=\"flex items-center justify-between border-b border-[var(--border-default)] py-2 last:border-0\">\n      <div className=\"flex items-center gap-3\">\n        <div className=\"flex h-8 w-8 items-center justify-center rounded-full bg-[var(--bg-input)] text-xs font-bold text-[var(--text-secondary)]\">\n          {initial}\n        </div>\n        <div>\n          <p className=\"flex items-center gap-2 text-sm font-medium text-[var(--text-primary)]\">\n            {label}\n            {pending && (\n              <span className=\"rounded border border-[var(--border-default)] px-1.5 py-0.5 text-[10px] uppercase text-[var(--text-muted)]\">\n                Pending\n              </span>\n            )}\n          </p>\n          {member.name && member.email && (\n            <p className=\"text-xs text-[var(--text-muted)]\">{member.email}</p>\n          )}\n        </div>\n      </div>\n\n      <div className=\"flex items-center gap-2\">\n        {isOwner ? (\n          <span className=\"rounded border border-[var(--border-default)] px-2 py-0.5 text-xs text-[var(--text-secondary)]\">\n            {member.inherited ? 'Org Admin' : 'Owner'}\n          </span>\n        ) : editable ? (\n          <>\n            <select\n              value={member.role}\n              aria-label={`Role for ${label}`}\n              onChange={(event) => onChangeRole(member.id, event.target.value as WorkspaceRole)}\n              className=\"rounded border border-[var(--border-default)] bg-[var(--bg-input)] px-2 py-1 text-xs text-[var(--text-secondary)]\"\n            >\n              {ASSIGNABLE.map((option) => (\n                <option key={option.value} value={option.value}>{option.label}</option>\n              ))}\n            </select>\n            <button\n              type=\"button\"\n              aria-label={`Remove ${label}`}\n              onClick={() => onRemove(member.id)}\n              className=\"rounded px-2 py-1 text-xs text-[var(--text-danger)] hover:bg-[var(--border-default)]\"\n            >\n              Remove\n            </button>\n          </>\n        ) : (\n          <span className=\"rounded border border-[var(--border-default)] px-2 py-0.5 text-xs capitalize text-[var(--text-secondary)]\">\n            {member.role}\n          </span>\n        )}\n      </div>\n    </div>\n  )\n}\n"],"mappings":";;;;;AAaA,SAAS,gBAAgB;AAoEnB,SA8FI,UA5FA,KAFJ;AA/DN,IAAM,aAAwD;AAAA,EAC5D,EAAE,OAAO,UAAU,OAAO,SAAS;AAAA,EACnC,EAAE,OAAO,UAAU,OAAO,SAAS;AAAA,EACnC,EAAE,OAAO,SAAS,OAAO,QAAQ;AACnC;AAEO,SAAS,aAAa;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAsB;AACpB,QAAM,CAAC,aAAa,cAAc,IAAI,SAAS,EAAE;AACjD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAwB,QAAQ;AACpE,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,KAAK;AAE9C,QAAM,YAAY,iBAAiB,aAAa,OAAO;AAEvD,WAAS,OAAO,MAA2B,SAAiB;AAC1D,eAAW,EAAE,MAAM,QAAQ,CAAC;AAAA,EAC9B;AAEA,iBAAe,eAAe;AAC5B,UAAM,QAAQ,YAAY,KAAK;AAC/B,QAAI,CAAC,SAAS,SAAU;AACxB,gBAAY,IAAI;AAChB,QAAI;AACF,YAAM,SAAS,MAAM,SAAS,EAAE,OAAO,MAAM,WAAW,CAAC;AACzD,UAAI,UAAU,eAAe,UAAU,OAAO,WAAW;AACvD,eAAO,WAAW,yBAAyB,KAAK,EAAE;AAAA,MACpD,OAAO;AACL,eAAO,WAAW,WAAW,KAAK,EAAE;AAAA,MACtC;AACA,qBAAe,EAAE;AAAA,IACnB,SAAS,KAAK;AACZ,aAAO,SAAS,eAAe,QAAQ,IAAI,UAAU,kBAAkB;AAAA,IACzE,UAAE;AACA,kBAAY,KAAK;AAAA,IACnB;AAAA,EACF;AAEA,iBAAe,WAAW,UAAkB,MAAqB;AAC/D,QAAI;AACF,YAAM,aAAa,EAAE,UAAU,KAAK,CAAC;AACrC,aAAO,WAAW,cAAc;AAAA,IAClC,SAAS,KAAK;AACZ,aAAO,SAAS,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,IAC9E;AAAA,EACF;AAEA,iBAAe,OAAO,UAAkB;AACtC,QAAI;AACF,YAAM,SAAS,EAAE,SAAS,CAAC;AAC3B,aAAO,WAAW,gBAAgB;AAAA,IACpC,SAAS,KAAK;AACZ,aAAO,SAAS,eAAe,QAAQ,IAAI,UAAU,yBAAyB;AAAA,IAChF;AAAA,EACF;AAEA,SACE,qBAAC,aAAQ,WAAU,uBACjB;AAAA,yBAAC,SAAI,WAAU,uBACZ;AAAA,cAAQ,IAAI,CAAC,WACZ;AAAA,QAAC;AAAA;AAAA,UAEC;AAAA,UACA;AAAA,UACA,cAAc;AAAA,UACd,UAAU;AAAA;AAAA,QAJL,OAAO;AAAA,MAKd,CACD;AAAA,MACA,QAAQ,WAAW,KAClB,oBAAC,OAAE,WAAU,oCAAmC,kCAAoB;AAAA,OAExE;AAAA,IAEC,aACC,qBAAC,SAAI,WAAU,sEACb;AAAA,0BAAC,WAAM,WAAU,gDAA+C,2BAAa;AAAA,MAC7E,qBAAC,SAAI,WAAU,cACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,aAAY;AAAA,YACZ,OAAO;AAAA,YACP,cAAW;AAAA,YACX,UAAU,CAAC,UAAU,eAAe,MAAM,OAAO,KAAK;AAAA,YACtD,WAAW,CAAC,UAAU;AAAE,kBAAI,MAAM,QAAQ,QAAS,MAAK,aAAa;AAAA,YAAE;AAAA,YACvE,WAAU;AAAA;AAAA,QACZ;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,OAAO;AAAA,YACP,cAAW;AAAA,YACX,UAAU,CAAC,UAAU,cAAc,MAAM,OAAO,KAAsB;AAAA,YACtE,WAAU;AAAA,YAET,qBAAW,IAAI,CAAC,WACf,oBAAC,YAA0B,OAAO,OAAO,OAAQ,iBAAO,SAA3C,OAAO,KAA0C,CAC/D;AAAA;AAAA,QACH;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAS,MAAM,KAAK,aAAa;AAAA,YACjC,UAAU,YAAY,CAAC,YAAY,KAAK;AAAA,YACxC,WAAU;AAAA,YAET,qBAAW,mBAAc;AAAA;AAAA,QAC5B;AAAA,SACF;AAAA,OACF;AAAA,KAEJ;AAEJ;AASA,SAAS,UAAU,EAAE,QAAQ,WAAW,cAAc,SAAS,GAAmB;AAChF,QAAM,UAAU,OAAO,cAAc;AACrC,QAAM,QAAQ,OAAO,QAAQ,OAAO,SAAS;AAC7C,QAAM,WAAW,OAAO,OAAO,CAAC,KAAK,OAAO,QAAQ,CAAC,KAAK,KAAK,YAAY;AAC3E,QAAM,UAAU,OAAO,SAAS;AAChC,QAAM,WAAW,aAAa,CAAC,WAAW,CAAC,OAAO;AAElD,SACE,qBAAC,SAAI,WAAU,gGACb;AAAA,yBAAC,SAAI,WAAU,2BACb;AAAA,0BAAC,SAAI,WAAU,6HACZ,mBACH;AAAA,MACA,qBAAC,SACC;AAAA,6BAAC,OAAE,WAAU,0EACV;AAAA;AAAA,UACA,WACC,oBAAC,UAAK,WAAU,8GAA6G,qBAE7H;AAAA,WAEJ;AAAA,QACC,OAAO,QAAQ,OAAO,SACrB,oBAAC,OAAE,WAAU,oCAAoC,iBAAO,OAAM;AAAA,SAElE;AAAA,OACF;AAAA,IAEA,oBAAC,SAAI,WAAU,2BACZ,oBACC,oBAAC,UAAK,WAAU,kGACb,iBAAO,YAAY,cAAc,SACpC,IACE,WACF,iCACE;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,OAAO;AAAA,UACd,cAAY,YAAY,KAAK;AAAA,UAC7B,UAAU,CAAC,UAAU,aAAa,OAAO,IAAI,MAAM,OAAO,KAAsB;AAAA,UAChF,WAAU;AAAA,UAET,qBAAW,IAAI,CAAC,WACf,oBAAC,YAA0B,OAAO,OAAO,OAAQ,iBAAO,SAA3C,OAAO,KAA0C,CAC/D;AAAA;AAAA,MACH;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,cAAY,UAAU,KAAK;AAAA,UAC3B,SAAS,MAAM,SAAS,OAAO,EAAE;AAAA,UACjC,WAAU;AAAA,UACX;AAAA;AAAA,MAED;AAAA,OACF,IAEA,oBAAC,UAAK,WAAU,6GACb,iBAAO,MACV,GAEJ;AAAA,KACF;AAEJ;","names":[]}

package/dist/chunk-3SVAA3MA.js

@@ -0,0 +1,41 @@
+// src/teams/invite.ts
+var INVITE_TOKEN_BYTES = 24;
+var INVITE_TOKEN_PATTERN = /^[A-Za-z0-9_-]{16,}$/;
+function generateInviteToken() {
+  const bytes = new Uint8Array(INVITE_TOKEN_BYTES);
+  crypto.getRandomValues(bytes);
+  return base64UrlEncode(bytes);
+}
+function isInviteTokenShape(value) {
+  return typeof value === "string" && INVITE_TOKEN_PATTERN.test(value);
+}
+function validateInviteToken(invite, opts = {}) {
+  if (invite.acceptedAt != null) return { ok: false, reason: "already-accepted" };
+  if (invite.expiresAt != null) {
+    const now = (opts.now ?? /* @__PURE__ */ new Date()).getTime();
+    const expires = invite.expiresAt instanceof Date ? invite.expiresAt.getTime() : Number(invite.expiresAt);
+    if (Number.isFinite(expires) && now >= expires) return { ok: false, reason: "expired" };
+  }
+  if (invite.inviteEmail && opts.acceptingEmail) {
+    if (invite.inviteEmail.trim().toLowerCase() !== opts.acceptingEmail.trim().toLowerCase()) {
+      return { ok: false, reason: "email-mismatch" };
+    }
+  }
+  return { ok: true };
+}
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  const base64 = typeof btoa === "function" ? btoa(binary) : bufferToBase64(binary);
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function bufferToBase64(binary) {
+  return Buffer.from(binary, "binary").toString("base64");
+}
+
+export {
+  generateInviteToken,
+  isInviteTokenShape,
+  validateInviteToken
+};
+//# sourceMappingURL=chunk-3SVAA3MA.js.map

package/dist/chunk-3SVAA3MA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/teams/invite.ts"],"sourcesContent":["/**\n * Pure invite-token helpers — generation, shape validation, and expiry math.\n * No I/O: the members API persists/looks up tokens; these functions only\n * produce well-formed tokens and decide, given values the caller already\n * loaded, whether an invite is usable.\n *\n * A token is an opaque high-entropy URL-safe string. It is the bearer secret\n * in `/invite/:token`, so it must be unguessable and never derived from the\n * email or workspace. `generateInviteToken` uses Web Crypto (`crypto`), which\n * is present in Workers, Node 18+, Deno, and browsers — no Node-only import,\n * so this stays a pure leaf.\n */\n\nconst INVITE_TOKEN_BYTES = 24\nconst INVITE_TOKEN_PATTERN = /^[A-Za-z0-9_-]{16,}$/\n\n/** Cryptographically-random, URL-safe (base64url) invite token. */\nexport function generateInviteToken(): string {\n  const bytes = new Uint8Array(INVITE_TOKEN_BYTES)\n  crypto.getRandomValues(bytes)\n  return base64UrlEncode(bytes)\n}\n\n/** True when `value` has the shape of an invite token (not whether it exists). */\nexport function isInviteTokenShape(value: unknown): value is string {\n  return typeof value === 'string' && INVITE_TOKEN_PATTERN.test(value)\n}\n\n/** A pending invite row, narrowed to the fields invite acceptance reasons over. */\nexport interface InviteTokenState {\n  /** null until accepted — a non-null value means the invite was already used. */\n  acceptedAt: Date | number | null | undefined\n  /** Email the invite was addressed to, if any. */\n  inviteEmail?: string | null\n  /** Optional hard expiry; omit/undefined for invites that never expire. */\n  expiresAt?: Date | number | null\n}\n\nexport type InviteRejectionReason = 'already-accepted' | 'expired' | 'email-mismatch'\n\nexport interface InviteValidationResult {\n  ok: boolean\n  reason?: InviteRejectionReason\n}\n\n/**\n * Decide whether a loaded invite can be accepted by `acceptingEmail` at `now`.\n * Pure: the caller has already fetched the row by token; this only judges it.\n * Email match is case-insensitive and only enforced when the invite was\n * addressed to a specific email (an open invite has no `inviteEmail`).\n */\nexport function validateInviteToken(\n  invite: InviteTokenState,\n  opts: { acceptingEmail?: string | null; now?: Date } = {},\n): InviteValidationResult {\n  if (invite.acceptedAt != null) return { ok: false, reason: 'already-accepted' }\n\n  if (invite.expiresAt != null) {\n    const now = (opts.now ?? new Date()).getTime()\n    const expires = invite.expiresAt instanceof Date ? invite.expiresAt.getTime() : Number(invite.expiresAt)\n    if (Number.isFinite(expires) && now >= expires) return { ok: false, reason: 'expired' }\n  }\n\n  if (invite.inviteEmail && opts.acceptingEmail) {\n    if (invite.inviteEmail.trim().toLowerCase() !== opts.acceptingEmail.trim().toLowerCase()) {\n      return { ok: false, reason: 'email-mismatch' }\n    }\n  }\n\n  return { ok: true }\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  let binary = ''\n  for (const byte of bytes) binary += String.fromCharCode(byte)\n  const base64 = typeof btoa === 'function' ? btoa(binary) : bufferToBase64(binary)\n  return base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\nfunction bufferToBase64(binary: string): string {\n  // Node without a global `btoa` (older runtimes); Buffer is always present there.\n  return Buffer.from(binary, 'binary').toString('base64')\n}\n"],"mappings":";AAaA,IAAM,qBAAqB;AAC3B,IAAM,uBAAuB;AAGtB,SAAS,sBAA8B;AAC5C,QAAM,QAAQ,IAAI,WAAW,kBAAkB;AAC/C,SAAO,gBAAgB,KAAK;AAC5B,SAAO,gBAAgB,KAAK;AAC9B;AAGO,SAAS,mBAAmB,OAAiC;AAClE,SAAO,OAAO,UAAU,YAAY,qBAAqB,KAAK,KAAK;AACrE;AAyBO,SAAS,oBACd,QACA,OAAuD,CAAC,GAChC;AACxB,MAAI,OAAO,cAAc,KAAM,QAAO,EAAE,IAAI,OAAO,QAAQ,mBAAmB;AAE9E,MAAI,OAAO,aAAa,MAAM;AAC5B,UAAM,OAAO,KAAK,OAAO,oBAAI,KAAK,GAAG,QAAQ;AAC7C,UAAM,UAAU,OAAO,qBAAqB,OAAO,OAAO,UAAU,QAAQ,IAAI,OAAO,OAAO,SAAS;AACvG,QAAI,OAAO,SAAS,OAAO,KAAK,OAAO,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,UAAU;AAAA,EACxF;AAEA,MAAI,OAAO,eAAe,KAAK,gBAAgB;AAC7C,QAAI,OAAO,YAAY,KAAK,EAAE,YAAY,MAAM,KAAK,eAAe,KAAK,EAAE,YAAY,GAAG;AACxF,aAAO,EAAE,IAAI,OAAO,QAAQ,iBAAiB;AAAA,IAC/C;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,KAAK;AACpB;AAEA,SAAS,gBAAgB,OAA2B;AAClD,MAAI,SAAS;AACb,aAAW,QAAQ,MAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,QAAM,SAAS,OAAO,SAAS,aAAa,KAAK,MAAM,IAAI,eAAe,MAAM;AAChF,SAAO,OAAO,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACzE;AAEA,SAAS,eAAe,QAAwB;AAE9C,SAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,QAAQ;AACxD;","names":[]}

package/dist/chunk-535V6BH6.js

@@ -0,0 +1,128 @@
+// src/teams-react/components/InviteAcceptPage.tsx
+import { useState } from "react";
+import { jsx, jsxs } from "react/jsx-runtime";
+function InviteAcceptPage({ details, onAccept, onNavigate }) {
+  const [accepting, setAccepting] = useState(false);
+  const [acceptError, setAcceptError] = useState(null);
+  const [accepted, setAccepted] = useState(false);
+  if (details.status === "invalid") {
+    return /* @__PURE__ */ jsx(Shell, { title: "Invalid invite", body: "This invite link is invalid or has expired.", children: /* @__PURE__ */ jsx(PrimaryButton, { onClick: () => onNavigate({ kind: "sign-in" }), children: "Go to sign in" }) });
+  }
+  if (details.status === "already-accepted") {
+    return /* @__PURE__ */ jsx(Shell, { title: "Already accepted", body: "This invite has already been accepted.", children: /* @__PURE__ */ jsx(PrimaryButton, { onClick: () => onNavigate({ kind: "open-app" }), children: "Open workspace" }) });
+  }
+  const workspaceName = details.workspaceName ?? "a workspace";
+  const inviterPrefix = details.inviterName ? `${details.inviterName} invited you` : "You've been invited";
+  const roleSuffix = details.role ? ` as ${details.role}` : "";
+  if (!details.currentUserEmail) {
+    return /* @__PURE__ */ jsxs(Shell, { title: "You've been invited", children: [
+      /* @__PURE__ */ jsxs("p", { className: "mb-4 text-sm text-[var(--text-secondary)]", children: [
+        inviterPrefix,
+        " to join ",
+        /* @__PURE__ */ jsx("span", { className: "font-medium text-[var(--text-primary)]", children: workspaceName }),
+        roleSuffix,
+        "."
+      ] }),
+      details.inviteEmail && /* @__PURE__ */ jsxs("p", { className: "mb-6 text-sm text-[var(--text-secondary)]", children: [
+        "Sign in or create an account with",
+        " ",
+        /* @__PURE__ */ jsx("span", { className: "font-medium text-[var(--text-primary)]", children: details.inviteEmail }),
+        " to accept."
+      ] }),
+      /* @__PURE__ */ jsxs("div", { className: "flex gap-2", children: [
+        /* @__PURE__ */ jsx(PrimaryButton, { onClick: () => onNavigate({ kind: "sign-in" }), children: "Sign in" }),
+        /* @__PURE__ */ jsx(SecondaryButton, { onClick: () => onNavigate({ kind: "sign-up" }), children: "Create account" })
+      ] })
+    ] });
+  }
+  if (accepted) {
+    return /* @__PURE__ */ jsx(Shell, { title: "Welcome!", children: /* @__PURE__ */ jsxs("p", { className: "text-sm text-[var(--text-secondary)]", children: [
+      "You've joined ",
+      /* @__PURE__ */ jsx("span", { className: "font-medium text-[var(--text-primary)]", children: workspaceName }),
+      "."
+    ] }) });
+  }
+  const emailMismatch = Boolean(
+    details.inviteEmail && details.inviteEmail.toLowerCase() !== details.currentUserEmail.toLowerCase()
+  );
+  async function handleAccept() {
+    setAccepting(true);
+    setAcceptError(null);
+    try {
+      const result = await onAccept();
+      setAccepted(true);
+      if (result && "workspaceId" in result && result.workspaceId) {
+        onNavigate({ kind: "open-app", workspaceId: result.workspaceId });
+      }
+    } catch (err) {
+      setAcceptError(err instanceof Error ? err.message : "Failed to accept invite");
+    } finally {
+      setAccepting(false);
+    }
+  }
+  return /* @__PURE__ */ jsxs(Shell, { title: "Join workspace", children: [
+    /* @__PURE__ */ jsxs("p", { className: "mb-4 text-sm text-[var(--text-secondary)]", children: [
+      inviterPrefix,
+      " to join ",
+      /* @__PURE__ */ jsx("span", { className: "font-medium text-[var(--text-primary)]", children: workspaceName }),
+      roleSuffix,
+      "."
+    ] }),
+    /* @__PURE__ */ jsxs("p", { className: "mb-4 text-sm text-[var(--text-secondary)]", children: [
+      "Signed in as ",
+      /* @__PURE__ */ jsx("span", { className: "font-medium text-[var(--text-primary)]", children: details.currentUserEmail })
+    ] }),
+    emailMismatch && /* @__PURE__ */ jsxs(
+      "div",
+      {
+        role: "alert",
+        className: "mb-4 rounded-md border border-[var(--border-default)] px-4 py-2 text-sm text-[var(--text-warning)]",
+        children: [
+          "This invite was sent to ",
+          /* @__PURE__ */ jsx("span", { className: "font-medium", children: details.inviteEmail }),
+          ". Switch to that account to accept it."
+        ]
+      }
+    ),
+    acceptError && /* @__PURE__ */ jsx("p", { role: "alert", className: "mb-4 text-sm text-[var(--text-danger)]", children: acceptError }),
+    /* @__PURE__ */ jsxs("div", { className: "flex gap-2", children: [
+      emailMismatch ? /* @__PURE__ */ jsx(PrimaryButton, { onClick: () => onNavigate({ kind: "switch-account" }), children: "Switch account" }) : /* @__PURE__ */ jsx(PrimaryButton, { onClick: () => void handleAccept(), disabled: accepting, children: accepting ? "Accepting\u2026" : "Accept invite" }),
+      /* @__PURE__ */ jsx(SecondaryButton, { onClick: () => onNavigate({ kind: "open-app" }), children: "Not now" })
+    ] })
+  ] });
+}
+function Shell({ title, body, children }) {
+  return /* @__PURE__ */ jsxs("div", { className: "mx-auto flex w-full max-w-sm flex-col", children: [
+    /* @__PURE__ */ jsx("h1", { className: "mb-1 text-xl font-semibold tracking-tight text-[var(--text-primary)]", children: title }),
+    body && /* @__PURE__ */ jsx("p", { className: "mb-6 text-sm text-[var(--text-secondary)]", children: body }),
+    children
+  ] });
+}
+function PrimaryButton({ children, onClick, disabled }) {
+  return /* @__PURE__ */ jsx(
+    "button",
+    {
+      type: "button",
+      onClick,
+      disabled,
+      className: "flex-1 rounded bg-[var(--brand-primary)] px-4 py-2 text-sm text-white disabled:opacity-50",
+      children
+    }
+  );
+}
+function SecondaryButton({ children, onClick }) {
+  return /* @__PURE__ */ jsx(
+    "button",
+    {
+      type: "button",
+      onClick,
+      className: "flex-1 rounded border border-[var(--border-default)] px-4 py-2 text-sm text-[var(--text-secondary)] hover:text-[var(--text-primary)]",
+      children
+    }
+  );
+}
+
+export {
+  InviteAcceptPage
+};
+//# sourceMappingURL=chunk-535V6BH6.js.map

package/dist/chunk-535V6BH6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/teams-react/components/InviteAcceptPage.tsx"],"sourcesContent":["/**\n * Invite-accept surface for `/invite/:token`. Renders the invite state (valid /\n * invalid / already-accepted), handles the signed-out path (sign in or create\n * an account with the invited email), the email-mismatch path (switch account),\n * and the accept action. Callback-driven: the host supplies the resolved\n * `details` and `onAccept` / `onNavigate`, so this imports no app router or\n * fetch client. Styled with the shipped Tangle Quiet tokens (`var(--*)`).\n */\n\nimport { useState } from 'react'\nimport type { InviteAcceptPageProps } from '../contracts'\n\nexport function InviteAcceptPage({ details, onAccept, onNavigate }: InviteAcceptPageProps) {\n  const [accepting, setAccepting] = useState(false)\n  const [acceptError, setAcceptError] = useState<string | null>(null)\n  const [accepted, setAccepted] = useState(false)\n\n  if (details.status === 'invalid') {\n    return (\n      <Shell title=\"Invalid invite\" body=\"This invite link is invalid or has expired.\">\n        <PrimaryButton onClick={() => onNavigate({ kind: 'sign-in' })}>Go to sign in</PrimaryButton>\n      </Shell>\n    )\n  }\n\n  if (details.status === 'already-accepted') {\n    return (\n      <Shell title=\"Already accepted\" body=\"This invite has already been accepted.\">\n        <PrimaryButton onClick={() => onNavigate({ kind: 'open-app' })}>Open workspace</PrimaryButton>\n      </Shell>\n    )\n  }\n\n  const workspaceName = details.workspaceName ?? 'a workspace'\n  const inviterPrefix = details.inviterName ? `${details.inviterName} invited you` : \"You've been invited\"\n  const roleSuffix = details.role ? ` as ${details.role}` : ''\n\n  if (!details.currentUserEmail) {\n    return (\n      <Shell title=\"You've been invited\">\n        <p className=\"mb-4 text-sm text-[var(--text-secondary)]\">\n          {inviterPrefix} to join <span className=\"font-medium text-[var(--text-primary)]\">{workspaceName}</span>{roleSuffix}.\n        </p>\n        {details.inviteEmail && (\n          <p className=\"mb-6 text-sm text-[var(--text-secondary)]\">\n            Sign in or create an account with{' '}\n            <span className=\"font-medium text-[var(--text-primary)]\">{details.inviteEmail}</span> to accept.\n          </p>\n        )}\n        <div className=\"flex gap-2\">\n          <PrimaryButton onClick={() => onNavigate({ kind: 'sign-in' })}>Sign in</PrimaryButton>\n          <SecondaryButton onClick={() => onNavigate({ kind: 'sign-up' })}>Create account</SecondaryButton>\n        </div>\n      </Shell>\n    )\n  }\n\n  if (accepted) {\n    return (\n      <Shell title=\"Welcome!\">\n        <p className=\"text-sm text-[var(--text-secondary)]\">\n          You've joined <span className=\"font-medium text-[var(--text-primary)]\">{workspaceName}</span>.\n        </p>\n      </Shell>\n    )\n  }\n\n  const emailMismatch = Boolean(\n    details.inviteEmail &&\n    details.inviteEmail.toLowerCase() !== details.currentUserEmail.toLowerCase(),\n  )\n\n  async function handleAccept() {\n    setAccepting(true)\n    setAcceptError(null)\n    try {\n      const result = await onAccept()\n      setAccepted(true)\n      if (result && 'workspaceId' in result && result.workspaceId) {\n        onNavigate({ kind: 'open-app', workspaceId: result.workspaceId })\n      }\n    } catch (err) {\n      setAcceptError(err instanceof Error ? err.message : 'Failed to accept invite')\n    } finally {\n      setAccepting(false)\n    }\n  }\n\n  return (\n    <Shell title=\"Join workspace\">\n      <p className=\"mb-4 text-sm text-[var(--text-secondary)]\">\n        {inviterPrefix} to join <span className=\"font-medium text-[var(--text-primary)]\">{workspaceName}</span>{roleSuffix}.\n      </p>\n      <p className=\"mb-4 text-sm text-[var(--text-secondary)]\">\n        Signed in as <span className=\"font-medium text-[var(--text-primary)]\">{details.currentUserEmail}</span>\n      </p>\n      {emailMismatch && (\n        <div\n          role=\"alert\"\n          className=\"mb-4 rounded-md border border-[var(--border-default)] px-4 py-2 text-sm text-[var(--text-warning)]\"\n        >\n          This invite was sent to <span className=\"font-medium\">{details.inviteEmail}</span>. Switch to that account to accept it.\n        </div>\n      )}\n      {acceptError && (\n        <p role=\"alert\" className=\"mb-4 text-sm text-[var(--text-danger)]\">{acceptError}</p>\n      )}\n      <div className=\"flex gap-2\">\n        {emailMismatch ? (\n          <PrimaryButton onClick={() => onNavigate({ kind: 'switch-account' })}>Switch account</PrimaryButton>\n        ) : (\n          <PrimaryButton onClick={() => void handleAccept()} disabled={accepting}>\n            {accepting ? 'Accepting…' : 'Accept invite'}\n          </PrimaryButton>\n        )}\n        <SecondaryButton onClick={() => onNavigate({ kind: 'open-app' })}>Not now</SecondaryButton>\n      </div>\n    </Shell>\n  )\n}\n\nfunction Shell({ title, body, children }: { title: string; body?: string; children: React.ReactNode }) {\n  return (\n    <div className=\"mx-auto flex w-full max-w-sm flex-col\">\n      <h1 className=\"mb-1 text-xl font-semibold tracking-tight text-[var(--text-primary)]\">{title}</h1>\n      {body && <p className=\"mb-6 text-sm text-[var(--text-secondary)]\">{body}</p>}\n      {children}\n    </div>\n  )\n}\n\nfunction PrimaryButton({ children, onClick, disabled }: { children: React.ReactNode; onClick(): void; disabled?: boolean }) {\n  return (\n    <button\n      type=\"button\"\n      onClick={onClick}\n      disabled={disabled}\n      className=\"flex-1 rounded bg-[var(--brand-primary)] px-4 py-2 text-sm text-white disabled:opacity-50\"\n    >\n      {children}\n    </button>\n  )\n}\n\nfunction SecondaryButton({ children, onClick }: { children: React.ReactNode; onClick(): void }) {\n  return (\n    <button\n      type=\"button\"\n      onClick={onClick}\n      className=\"flex-1 rounded border border-[var(--border-default)] px-4 py-2 text-sm text-[var(--text-secondary)] hover:text-[var(--text-primary)]\"\n    >\n      {children}\n    </button>\n  )\n}\n"],"mappings":";AASA,SAAS,gBAAgB;AAWjB,cAoBA,YApBA;AARD,SAAS,iBAAiB,EAAE,SAAS,UAAU,WAAW,GAA0B;AACzF,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,KAAK;AAChD,QAAM,CAAC,aAAa,cAAc,IAAI,SAAwB,IAAI;AAClE,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,KAAK;AAE9C,MAAI,QAAQ,WAAW,WAAW;AAChC,WACE,oBAAC,SAAM,OAAM,kBAAiB,MAAK,+CACjC,8BAAC,iBAAc,SAAS,MAAM,WAAW,EAAE,MAAM,UAAU,CAAC,GAAG,2BAAa,GAC9E;AAAA,EAEJ;AAEA,MAAI,QAAQ,WAAW,oBAAoB;AACzC,WACE,oBAAC,SAAM,OAAM,oBAAmB,MAAK,0CACnC,8BAAC,iBAAc,SAAS,MAAM,WAAW,EAAE,MAAM,WAAW,CAAC,GAAG,4BAAc,GAChF;AAAA,EAEJ;AAEA,QAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,QAAM,gBAAgB,QAAQ,cAAc,GAAG,QAAQ,WAAW,iBAAiB;AACnF,QAAM,aAAa,QAAQ,OAAO,OAAO,QAAQ,IAAI,KAAK;AAE1D,MAAI,CAAC,QAAQ,kBAAkB;AAC7B,WACE,qBAAC,SAAM,OAAM,uBACX;AAAA,2BAAC,OAAE,WAAU,6CACV;AAAA;AAAA,QAAc;AAAA,QAAS,oBAAC,UAAK,WAAU,0CAA0C,yBAAc;AAAA,QAAQ;AAAA,QAAW;AAAA,SACrH;AAAA,MACC,QAAQ,eACP,qBAAC,OAAE,WAAU,6CAA4C;AAAA;AAAA,QACrB;AAAA,QAClC,oBAAC,UAAK,WAAU,0CAA0C,kBAAQ,aAAY;AAAA,QAAO;AAAA,SACvF;AAAA,MAEF,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,iBAAc,SAAS,MAAM,WAAW,EAAE,MAAM,UAAU,CAAC,GAAG,qBAAO;AAAA,QACtE,oBAAC,mBAAgB,SAAS,MAAM,WAAW,EAAE,MAAM,UAAU,CAAC,GAAG,4BAAc;AAAA,SACjF;AAAA,OACF;AAAA,EAEJ;AAEA,MAAI,UAAU;AACZ,WACE,oBAAC,SAAM,OAAM,YACX,+BAAC,OAAE,WAAU,wCAAuC;AAAA;AAAA,MACpC,oBAAC,UAAK,WAAU,0CAA0C,yBAAc;AAAA,MAAO;AAAA,OAC/F,GACF;AAAA,EAEJ;AAEA,QAAM,gBAAgB;AAAA,IACpB,QAAQ,eACR,QAAQ,YAAY,YAAY,MAAM,QAAQ,iBAAiB,YAAY;AAAA,EAC7E;AAEA,iBAAe,eAAe;AAC5B,iBAAa,IAAI;AACjB,mBAAe,IAAI;AACnB,QAAI;AACF,YAAM,SAAS,MAAM,SAAS;AAC9B,kBAAY,IAAI;AAChB,UAAI,UAAU,iBAAiB,UAAU,OAAO,aAAa;AAC3D,mBAAW,EAAE,MAAM,YAAY,aAAa,OAAO,YAAY,CAAC;AAAA,MAClE;AAAA,IACF,SAAS,KAAK;AACZ,qBAAe,eAAe,QAAQ,IAAI,UAAU,yBAAyB;AAAA,IAC/E,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SACE,qBAAC,SAAM,OAAM,kBACX;AAAA,yBAAC,OAAE,WAAU,6CACV;AAAA;AAAA,MAAc;AAAA,MAAS,oBAAC,UAAK,WAAU,0CAA0C,yBAAc;AAAA,MAAQ;AAAA,MAAW;AAAA,OACrH;AAAA,IACA,qBAAC,OAAE,WAAU,6CAA4C;AAAA;AAAA,MAC1C,oBAAC,UAAK,WAAU,0CAA0C,kBAAQ,kBAAiB;AAAA,OAClG;AAAA,IACC,iBACC;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,WAAU;AAAA,QACX;AAAA;AAAA,UACyB,oBAAC,UAAK,WAAU,eAAe,kBAAQ,aAAY;AAAA,UAAO;AAAA;AAAA;AAAA,IACpF;AAAA,IAED,eACC,oBAAC,OAAE,MAAK,SAAQ,WAAU,0CAA0C,uBAAY;AAAA,IAElF,qBAAC,SAAI,WAAU,cACZ;AAAA,sBACC,oBAAC,iBAAc,SAAS,MAAM,WAAW,EAAE,MAAM,iBAAiB,CAAC,GAAG,4BAAc,IAEpF,oBAAC,iBAAc,SAAS,MAAM,KAAK,aAAa,GAAG,UAAU,WAC1D,sBAAY,oBAAe,iBAC9B;AAAA,MAEF,oBAAC,mBAAgB,SAAS,MAAM,WAAW,EAAE,MAAM,WAAW,CAAC,GAAG,qBAAO;AAAA,OAC3E;AAAA,KACF;AAEJ;AAEA,SAAS,MAAM,EAAE,OAAO,MAAM,SAAS,GAAgE;AACrG,SACE,qBAAC,SAAI,WAAU,yCACb;AAAA,wBAAC,QAAG,WAAU,wEAAwE,iBAAM;AAAA,IAC3F,QAAQ,oBAAC,OAAE,WAAU,6CAA6C,gBAAK;AAAA,IACvE;AAAA,KACH;AAEJ;AAEA,SAAS,cAAc,EAAE,UAAU,SAAS,SAAS,GAAuE;AAC1H,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,WAAU;AAAA,MAET;AAAA;AAAA,EACH;AAEJ;AAEA,SAAS,gBAAgB,EAAE,UAAU,QAAQ,GAAmD;AAC9F,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL;AAAA,MACA,WAAU;AAAA,MAET;AAAA;AAAA,EACH;AAEJ;","names":[]}

package/dist/chunk-63CE7FEZ.js

@@ -0,0 +1,63 @@
+// src/teams/roles.ts
+var WORKSPACE_ROLES = ["viewer", "editor", "admin", "owner"];
+var ASSIGNABLE_WORKSPACE_ROLES = ["viewer", "editor", "admin"];
+var ORGANIZATION_ROLES = ["owner", "admin", "member", "billing"];
+var WORKSPACE_ROLE_RANK = {
+  viewer: 0,
+  editor: 1,
+  admin: 2,
+  owner: 3
+};
+var ORGANIZATION_ROLE_RANK = {
+  member: 0,
+  billing: 1,
+  admin: 2,
+  owner: 3
+};
+function hasWorkspaceRole(actual, minimum) {
+  return WORKSPACE_ROLE_RANK[actual] >= WORKSPACE_ROLE_RANK[minimum];
+}
+function hasOrganizationRole(actual, minimum) {
+  return ORGANIZATION_ROLE_RANK[actual] >= ORGANIZATION_ROLE_RANK[minimum];
+}
+function isAssignableWorkspaceRole(value) {
+  return typeof value === "string" && ASSIGNABLE_WORKSPACE_ROLES.includes(value);
+}
+function organizationRoleGrantsWorkspaceOwner(role) {
+  return role === "owner" || role === "admin";
+}
+function resolveWorkspaceRole(organizationRole, workspaceRole) {
+  return organizationRoleGrantsWorkspaceOwner(organizationRole) ? "owner" : workspaceRole ?? null;
+}
+function canManageWorkspaceMemberRole(actorRole, targetRole) {
+  return actorRole === "owner" || !hasWorkspaceRole(targetRole, actorRole);
+}
+function workspaceRoleToCollaborationAccess(role) {
+  return role === "viewer" ? "read" : "write";
+}
+function workspaceRoleToSandboxRole(role) {
+  const mapping = {
+    owner: "owner",
+    admin: "admin",
+    editor: "developer",
+    viewer: "viewer"
+  };
+  return mapping[role];
+}
+
+export {
+  WORKSPACE_ROLES,
+  ASSIGNABLE_WORKSPACE_ROLES,
+  ORGANIZATION_ROLES,
+  WORKSPACE_ROLE_RANK,
+  ORGANIZATION_ROLE_RANK,
+  hasWorkspaceRole,
+  hasOrganizationRole,
+  isAssignableWorkspaceRole,
+  organizationRoleGrantsWorkspaceOwner,
+  resolveWorkspaceRole,
+  canManageWorkspaceMemberRole,
+  workspaceRoleToCollaborationAccess,
+  workspaceRoleToSandboxRole
+};
+//# sourceMappingURL=chunk-63CE7FEZ.js.map

package/dist/chunk-63CE7FEZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/teams/roles.ts"],"sourcesContent":["/**\n * Pure role algebra for the teams capability — the tenancy/membership model\n * shared across the fleet. Zero dependencies: no drizzle, no env, no react, no\n * I/O. The DB layer (`./teams/drizzle`), the members API (`./teams/members-api`)\n * and the React surface (`./teams-react`) all build on these functions; this\n * leaf imports nothing back, so a consumer can pull just the role math.\n *\n * Two role ladders, deliberately distinct:\n *   - Organization roles rank the tenant (who owns/administers the org and its\n *     billing). An org owner/admin is an owner of every workspace under it.\n *   - Workspace roles rank a single workspace. They are the access primitive\n *     every route checks via `hasWorkspaceRole(actual, minimum)`.\n *\n * `resolveWorkspaceRole` is the bridge: it folds the org role and the\n * per-workspace role into the one effective workspace role a request runs at.\n */\n\nexport const WORKSPACE_ROLES = ['viewer', 'editor', 'admin', 'owner'] as const\nexport type WorkspaceRole = typeof WORKSPACE_ROLES[number]\n\nexport const ASSIGNABLE_WORKSPACE_ROLES = ['viewer', 'editor', 'admin'] as const\nexport type AssignableWorkspaceRole = typeof ASSIGNABLE_WORKSPACE_ROLES[number]\n\nexport const ORGANIZATION_ROLES = ['owner', 'admin', 'member', 'billing'] as const\nexport type OrganizationRole = typeof ORGANIZATION_ROLES[number]\n\nexport type WorkspaceCollaborationAccess = 'read' | 'write'\nexport type SandboxWorkspaceRole = 'owner' | 'admin' | 'developer' | 'viewer'\n\nexport const WORKSPACE_ROLE_RANK: Record<WorkspaceRole, number> = {\n  viewer: 0,\n  editor: 1,\n  admin: 2,\n  owner: 3,\n}\n\nexport const ORGANIZATION_ROLE_RANK: Record<OrganizationRole, number> = {\n  member: 0,\n  billing: 1,\n  admin: 2,\n  owner: 3,\n}\n\n/** True when `actual` is at least `minimum` on the workspace ladder. */\nexport function hasWorkspaceRole(actual: WorkspaceRole, minimum: WorkspaceRole): boolean {\n  return WORKSPACE_ROLE_RANK[actual] >= WORKSPACE_ROLE_RANK[minimum]\n}\n\n/** True when `actual` is at least `minimum` on the organization ladder. */\nexport function hasOrganizationRole(actual: OrganizationRole, minimum: OrganizationRole): boolean {\n  return ORGANIZATION_ROLE_RANK[actual] >= ORGANIZATION_ROLE_RANK[minimum]\n}\n\nexport function isAssignableWorkspaceRole(value: unknown): value is AssignableWorkspaceRole {\n  return typeof value === 'string' && ASSIGNABLE_WORKSPACE_ROLES.includes(value as AssignableWorkspaceRole)\n}\n\n/** Org owners and admins are workspace owners across the whole org. */\nexport function organizationRoleGrantsWorkspaceOwner(role: OrganizationRole | string | null | undefined): boolean {\n  return role === 'owner' || role === 'admin'\n}\n\n/**\n * The effective workspace role a request runs at: org owner/admin → owner of\n * every workspace; otherwise the explicit per-workspace role (or null = no\n * access). This is the single fold every access check goes through.\n */\nexport function resolveWorkspaceRole(\n  organizationRole: OrganizationRole | string | null | undefined,\n  workspaceRole: WorkspaceRole | null | undefined,\n): WorkspaceRole | null {\n  return organizationRoleGrantsWorkspaceOwner(organizationRole) ? 'owner' : workspaceRole ?? null\n}\n\n/**\n * Whether `actorRole` may set/clear a member currently at `targetRole`. Owners\n * can manage anyone; everyone else can only manage members strictly below\n * their own rank (an admin cannot demote another admin or an owner).\n */\nexport function canManageWorkspaceMemberRole(actorRole: WorkspaceRole, targetRole: WorkspaceRole): boolean {\n  return actorRole === 'owner' || !hasWorkspaceRole(targetRole, actorRole)\n}\n\nexport function workspaceRoleToCollaborationAccess(role: WorkspaceRole): WorkspaceCollaborationAccess {\n  return role === 'viewer' ? 'read' : 'write'\n}\n\nexport function workspaceRoleToSandboxRole(role: WorkspaceRole): SandboxWorkspaceRole {\n  const mapping: Record<WorkspaceRole, SandboxWorkspaceRole> = {\n    owner: 'owner',\n    admin: 'admin',\n    editor: 'developer',\n    viewer: 'viewer',\n  }\n  return mapping[role]\n}\n"],"mappings":";AAiBO,IAAM,kBAAkB,CAAC,UAAU,UAAU,SAAS,OAAO;AAG7D,IAAM,6BAA6B,CAAC,UAAU,UAAU,OAAO;AAG/D,IAAM,qBAAqB,CAAC,SAAS,SAAS,UAAU,SAAS;AAMjE,IAAM,sBAAqD;AAAA,EAChE,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AACT;AAEO,IAAM,yBAA2D;AAAA,EACtE,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,OAAO;AAAA,EACP,OAAO;AACT;AAGO,SAAS,iBAAiB,QAAuB,SAAiC;AACvF,SAAO,oBAAoB,MAAM,KAAK,oBAAoB,OAAO;AACnE;AAGO,SAAS,oBAAoB,QAA0B,SAAoC;AAChG,SAAO,uBAAuB,MAAM,KAAK,uBAAuB,OAAO;AACzE;AAEO,SAAS,0BAA0B,OAAkD;AAC1F,SAAO,OAAO,UAAU,YAAY,2BAA2B,SAAS,KAAgC;AAC1G;AAGO,SAAS,qCAAqC,MAA6D;AAChH,SAAO,SAAS,WAAW,SAAS;AACtC;AAOO,SAAS,qBACd,kBACA,eACsB;AACtB,SAAO,qCAAqC,gBAAgB,IAAI,UAAU,iBAAiB;AAC7F;AAOO,SAAS,6BAA6B,WAA0B,YAAoC;AACzG,SAAO,cAAc,WAAW,CAAC,iBAAiB,YAAY,SAAS;AACzE;AAEO,SAAS,mCAAmC,MAAmD;AACpG,SAAO,SAAS,WAAW,SAAS;AACtC;AAEO,SAAS,2BAA2B,MAA2C;AACpF,QAAM,UAAuD;AAAA,IAC3D,OAAO;AAAA,IACP,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACA,SAAO,QAAQ,IAAI;AACrB;","names":[]}

package/dist/{chunk-7I37CO5D.js → chunk-N4ZFKQ5C.js}

@@ -22,15 +22,15 @@ import {
   setAttrsCommand,
   ungroupElementCommand
 } from "./chunk-XWJXZ6WE.js";
+import {
+  lightTheme
+} from "./chunk-Y2SZVW35.js";
 import {
   SCENE_SCHEMA_VERSION,
   boundsIntersect,
   elementAabb,
   findElement
 } from "./chunk-M2EBUDZ7.js";
-import {
-  lightTheme
-} from "./chunk-Y2SZVW35.js";
 
 // src/design-canvas-react/components/Workspace.tsx
 import {
@@ -1772,4 +1772,4 @@ export {
   Workspace,
   DesignCanvasEditor
 };
-//# sourceMappingURL=chunk-7I37CO5D.js.map
+//# sourceMappingURL=chunk-N4ZFKQ5C.js.map

package/dist/{chunk-J7JNV5BH.js → chunk-S5CAJX6O.js}

@@ -1,7 +1,7 @@
 // src/design-canvas-react/lazy.tsx
 import { lazy } from "react";
 var DesignCanvasLazy = lazy(
-  () => import("./DesignCanvasEditor-TN7CWUJW.js").then((m) => ({ default: m.DesignCanvasEditor }))
+  () => import("./DesignCanvasEditor-IB2FMBBD.js").then((m) => ({ default: m.DesignCanvasEditor }))
 );
 var DesignCanvasChromeLazy = lazy(
   () => import("./DesignCanvas-AOIVN3SJ.js").then((m) => ({ default: m.DesignCanvas }))
@@ -11,4 +11,4 @@ export {
   DesignCanvasLazy,
   DesignCanvasChromeLazy
 };
-//# sourceMappingURL=chunk-J7JNV5BH.js.map
+//# sourceMappingURL=chunk-S5CAJX6O.js.map

package/dist/design-canvas-react/index.js

@@ -11,7 +11,7 @@ import {
   downloadDataUrl,
   exportDocumentJson,
   exportPageDataUrl
-} from "../chunk-7I37CO5D.js";
+} from "../chunk-N4ZFKQ5C.js";
 import {
   BTN,
   BTN_ACTIVE,
@@ -85,13 +85,13 @@ import {
 import {
   DesignCanvasChromeLazy,
   DesignCanvasLazy
-} from "../chunk-J7JNV5BH.js";
+} from "../chunk-S5CAJX6O.js";
+import "../chunk-Y2SZVW35.js";
 import {
   assertSceneMediaSrc,
   bleedAwareExportBounds,
   scaleForPreset
 } from "../chunk-M2EBUDZ7.js";
-import "../chunk-Y2SZVW35.js";
 import "../chunk-HFC4BTWJ.js";
 
 // src/design-canvas-react/components/CanvasInsertPanel.tsx

package/dist/design-canvas-react/lazy.js

@@ -1,7 +1,7 @@
 import {
   DesignCanvasChromeLazy,
   DesignCanvasLazy
-} from "../chunk-J7JNV5BH.js";
+} from "../chunk-S5CAJX6O.js";
 export {
   DesignCanvasChromeLazy,
   DesignCanvasLazy

package/dist/index.js

@@ -1,3 +1,4 @@
+import "./chunk-UAKFCMWK.js";
 import {
   CANVAS_ELEMENT_KINDS,
   CANVAS_MCP_TOOLS,
@@ -12,6 +13,12 @@ import {
   listTemplateSlots,
   validateBindings
 } from "./chunk-IOREXWLM.js";
+import {
+  darkTheme,
+  lightTheme,
+  themeColor,
+  themeToCssVars
+} from "./chunk-Y2SZVW35.js";
 import {
   CHANNEL_PRESETS,
   EXPORT_PRESETS,
@@ -46,13 +53,6 @@ import {
   validateSceneOperations,
   validateSlotValue
 } from "./chunk-M2EBUDZ7.js";
-import "./chunk-UAKFCMWK.js";
-import {
-  darkTheme,
-  lightTheme,
-  themeColor,
-  themeToCssVars
-} from "./chunk-Y2SZVW35.js";
 import {
   DEFAULT_REDACTION_PATTERNS,
   buildRedactedDocument,

package/dist/roles-CLtYKHHl.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Pure role algebra for the teams capability — the tenancy/membership model
+ * shared across the fleet. Zero dependencies: no drizzle, no env, no react, no
+ * I/O. The DB layer (`./teams/drizzle`), the members API (`./teams/members-api`)
+ * and the React surface (`./teams-react`) all build on these functions; this
+ * leaf imports nothing back, so a consumer can pull just the role math.
+ *
+ * Two role ladders, deliberately distinct:
+ *   - Organization roles rank the tenant (who owns/administers the org and its
+ *     billing). An org owner/admin is an owner of every workspace under it.
+ *   - Workspace roles rank a single workspace. They are the access primitive
+ *     every route checks via `hasWorkspaceRole(actual, minimum)`.
+ *
+ * `resolveWorkspaceRole` is the bridge: it folds the org role and the
+ * per-workspace role into the one effective workspace role a request runs at.
+ */
+declare const WORKSPACE_ROLES: readonly ["viewer", "editor", "admin", "owner"];
+type WorkspaceRole = typeof WORKSPACE_ROLES[number];
+declare const ASSIGNABLE_WORKSPACE_ROLES: readonly ["viewer", "editor", "admin"];
+type AssignableWorkspaceRole = typeof ASSIGNABLE_WORKSPACE_ROLES[number];
+declare const ORGANIZATION_ROLES: readonly ["owner", "admin", "member", "billing"];
+type OrganizationRole = typeof ORGANIZATION_ROLES[number];
+type WorkspaceCollaborationAccess = 'read' | 'write';
+type SandboxWorkspaceRole = 'owner' | 'admin' | 'developer' | 'viewer';
+declare const WORKSPACE_ROLE_RANK: Record<WorkspaceRole, number>;
+declare const ORGANIZATION_ROLE_RANK: Record<OrganizationRole, number>;
+/** True when `actual` is at least `minimum` on the workspace ladder. */
+declare function hasWorkspaceRole(actual: WorkspaceRole, minimum: WorkspaceRole): boolean;
+/** True when `actual` is at least `minimum` on the organization ladder. */
+declare function hasOrganizationRole(actual: OrganizationRole, minimum: OrganizationRole): boolean;
+declare function isAssignableWorkspaceRole(value: unknown): value is AssignableWorkspaceRole;
+/** Org owners and admins are workspace owners across the whole org. */
+declare function organizationRoleGrantsWorkspaceOwner(role: OrganizationRole | string | null | undefined): boolean;
+/**
+ * The effective workspace role a request runs at: org owner/admin → owner of
+ * every workspace; otherwise the explicit per-workspace role (or null = no
+ * access). This is the single fold every access check goes through.
+ */
+declare function resolveWorkspaceRole(organizationRole: OrganizationRole | string | null | undefined, workspaceRole: WorkspaceRole | null | undefined): WorkspaceRole | null;
+/**
+ * Whether `actorRole` may set/clear a member currently at `targetRole`. Owners
+ * can manage anyone; everyone else can only manage members strictly below
+ * their own rank (an admin cannot demote another admin or an owner).
+ */
+declare function canManageWorkspaceMemberRole(actorRole: WorkspaceRole, targetRole: WorkspaceRole): boolean;
+declare function workspaceRoleToCollaborationAccess(role: WorkspaceRole): WorkspaceCollaborationAccess;
+declare function workspaceRoleToSandboxRole(role: WorkspaceRole): SandboxWorkspaceRole;
+
+export { ASSIGNABLE_WORKSPACE_ROLES as A, type OrganizationRole as O, type SandboxWorkspaceRole as S, WORKSPACE_ROLES as W, type AssignableWorkspaceRole as a, ORGANIZATION_ROLES as b, ORGANIZATION_ROLE_RANK as c, WORKSPACE_ROLE_RANK as d, type WorkspaceCollaborationAccess as e, type WorkspaceRole as f, canManageWorkspaceMemberRole as g, hasOrganizationRole as h, hasWorkspaceRole as i, isAssignableWorkspaceRole as j, workspaceRoleToSandboxRole as k, organizationRoleGrantsWorkspaceOwner as o, resolveWorkspaceRole as r, workspaceRoleToCollaborationAccess as w };