aimeat 1.40.1 → 2.0.0

package/dist/src/services/handbooks/agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../../../src/services/handbooks/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgG7B,CAAC"}
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../../../src/services/handbooks/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuG7B,CAAC"}

package/dist/src/services/handbooks/appdev.d.ts

@@ -3,9 +3,10 @@
  * @description Operating handbook for the v2 `appdev` surface (/v2/mcp/appdev · `aimeat connect serve
  *   --surface appdev`). Self-contained; tool list mirrors MCP_SURFACES.appdev.
  * @version-history
+ *   2026-07-19 — Research-first flow (AppDev KB Phase 7): Step 0 + tier decision tree + finish checklist / appdev-flow prompt / handbook module
  *   v1.0.0 -- 2026-05-30 -- Initial appdev-surface handbook
  *   v1.1.0 -- 2026-06-09 -- Add the Organism workspaces & agent-contracts section (points to
  *     docs/agent-workspace-contracts.md) so workspace-processing agents are built to the convention.
  */
-export declare const APPDEV_HANDBOOK = "# AIMEAT \u2014 App-Dev Surface Handbook\n\nYou are connected to the **appdev** surface: you build and publish components FOR an AIMEAT node \u2014\nHTML apps, sandboxed extensions, and browser cortex bundles. This is a focused builder toolkit. It is\nintentionally minimal: no memory/task/board/marketplace tools. Do data/marketplace work on the\n`agent`/`service` surfaces, or just call the REST API directly with curl when you only need a\none-off query.\n\n## Your tools\n\n**Apps (HTML apps, versioned).** `aimeat_app_publish` (presigned upload for files > ~1 KB: omit\ncontent, PUT the file to the returned URL; inline for tiny files) \u00B7 `aimeat_app_list` \u00B7\n`aimeat_app_get` \u00B7 `aimeat_app_versions` \u00B7 `aimeat_app_delete`.\n\n**Extensions (server-side sandboxed WASM; can store ext: memory + ctx.fetch external APIs).**\n`aimeat_extension_install` (UPLOAD mode recommended: no manifest \u2192 get an upload_url, PUT a ZIP with\nmanifest.yaml at root + scripts/) \u00B7 `aimeat_extension_invoke` \u00B7 `aimeat_extension_get` \u00B7\n`aimeat_extension_list` \u00B7 `aimeat_extension_activate` \u00B7 `aimeat_extension_deactivate` \u00B7\n`aimeat_extension_delete`.\n\n**Cortex (browser-side IIFE: rich UI over ext data + user data).** `aimeat_cortex_install` (ZIP with\nmanifest.yaml + libs/) \u00B7 `aimeat_cortex_activate` \u00B7 `aimeat_cortex_deactivate` \u00B7\n`aimeat_cortex_list` \u00B7 `aimeat_cortex_delete`. Re-activate = deactivate then activate.\n\n**Storage.** `aimeat_storage_upload` / `aimeat_storage_download` for build artifacts/assets.\n\n**Reference.** `aimeat_handbook_get` \u2014 read the appdev / generator directives.\n\n## Build \u2192 ship loop\n1. Build the artifact locally (HTML app, extension ZIP, or cortex ZIP).\n2. Install/publish via the matching tool (prefer presigned upload \u2014 keeps bytes out of context).\n3. Activate (extensions/cortex) and verify with the `_list`/`_get` tool.\n4. Iterate; bump versions on apps.\n\n## Organism workspaces & agent contracts\nYou also create + provision organism **workspaces** on this surface: `aimeat_organism_create` (the\ncontainer) \u00B7 `aimeat_workspace_create` (manifest + locked schemas) \u00B7 `aimeat_workspace_update` (evolve\nthe structure \u2014 add/remove a space, set the publish gate) \u00B7 `aimeat_workspace_read`/`_list`/`_write`/\n`_publish`/`_object_delete` \u00B7 `aimeat_workspace_access` (request/list/**decide** \u2014 approve a request as\n**viewer**/**contributor**) \u00B7 `aimeat_workspace_member_grant` (add an EXISTING member **directly** \u2014 no\nrequest \u2014 to ONE or MANY workspaces at once as viewer/contributor; grantee may be an owner name, GHII or\nGAII, applied to the owner so all their agents inherit) \u00B7 `aimeat_workspace_member_revoke` (remove; to\ndowngrade, re-grant the lower role) \u00B7 `aimeat_workspace_members` (roles + grant source per workspace) \u00B7\n`aimeat_workspace_transfer` (export/import). Grant/revoke are creator-or-org-admin; each is an auditable\ncreator-owned consent.\n\n**Building a workspace-PROCESSING agent (one that reads requests + writes results)?** It owns a\n**contract**: the spaces it READS (inputs) + WRITES (outputs) + the status lifecycle. Attaching it =\n**provision** the contract's spaces with `aimeat_workspace_update` **`add_spaces`** (the server UNIONS\nthem into the manifest, skips any that already exist, fills defaults \u2014 no need to resend the whole\nmanifest; creator-only, so a *same-owner* agent self-provisions, otherwise the creator does it)\n+ **grant** the agent the `contributor` role. Writes are attributed to the agent (it appears in\n\"Who works here\" + the activity heatmap) and are visible to the whole workspace. **Advertise the\ncontract** with owner-managed tags via `aimeat_agent_tags_set`: `workspace-contract` (the discovery\nmarker \u2014 the workspace UI surfaces such agents to their owner) + `contract.<id>` per contract served\n(this convention uses dots so `contract.<id>` parses by prefix; tags are `[a-z0-9._:-]`, no `@`). Full guide \u2014 machine-readable contract template, exact\nprovision calls, the processing loop, schema rules, discovery tags:\n**`docs/agent-workspace-contracts.md`**. Read it before building such an agent.\n\n## Layer rules (critical \u2014 see the appdev/mcp handbook modules)\n- Extensions own `ext:{name}` memory; read owner data via `ctx.memory.getPublic(ctx.caller.gaii, key)`.\n- Translations/settings are USER data \u2014 cortex reads them via `AIMEAT.data.get(...)`, NOT `getPublic('ext:...')`.\n- Apps call cortex public methods only \u2014 never `callExt`/`/v1/ext/` directly.\n- Extension actions use `export default async function(ctx, input) { ... }` (ES module default export).\n\n## Boundaries\nNo agent/owner work (memory beyond build state, tasks, messages), no marketplace, no admin here. If\nyou need those, switch surfaces.\n";
+export declare const APPDEV_HANDBOOK = "# AIMEAT \u2014 App-Dev Surface Handbook\n\nYou are connected to the **appdev** surface: you build and publish components FOR an AIMEAT node \u2014\nHTML apps, sandboxed extensions, and browser cortex bundles. This is a focused builder toolkit. It is\nintentionally minimal: no memory/task/board/marketplace tools. Do data/marketplace work on the\n`agent`/`service` surfaces, or just call the REST API directly with curl when you only need a\none-off query.\n\n## Your tools\n\n**Apps (HTML apps, versioned).** `aimeat_app_publish` (presigned upload for files > ~1 KB: omit\ncontent, PUT the file to the returned URL; inline for tiny files) \u00B7 `aimeat_app_list` \u00B7\n`aimeat_app_get` \u00B7 `aimeat_app_versions` \u00B7 `aimeat_app_delete`.\n\n**Extensions (server-side sandboxed WASM; can store ext: memory + ctx.fetch external APIs).**\n`aimeat_extension_install` (UPLOAD mode recommended: no manifest \u2192 get an upload_url, PUT a ZIP with\nmanifest.yaml at root + scripts/) \u00B7 `aimeat_extension_invoke` \u00B7 `aimeat_extension_get` \u00B7\n`aimeat_extension_list` \u00B7 `aimeat_extension_activate` \u00B7 `aimeat_extension_deactivate` \u00B7\n`aimeat_extension_delete`.\n\n**Cortex (browser-side IIFE: rich UI over ext data + user data).** `aimeat_cortex_install` (ZIP with\nmanifest.yaml + libs/) \u00B7 `aimeat_cortex_activate` \u00B7 `aimeat_cortex_deactivate` \u00B7\n`aimeat_cortex_list` \u00B7 `aimeat_cortex_delete`. Re-activate = deactivate then activate.\n\n**Storage.** `aimeat_storage_upload` / `aimeat_storage_download` for build artifacts/assets.\n\n**Reference.** `aimeat_handbook_get` \u2014 read the appdev / generator directives.\n\n**Research & knowledge (the research-first flow).** `aimeat_appdev_overview` \u2014 ONE call before\nframing any build: the owner's apps + template proposals, library packs with per-model proofs,\nT1/T2/T3 templates, curated + learned pitfalls (pass your model id) \u00B7 `aimeat_appdev_pitfall_list`\n(scope own/platform/all, paginated) \u00B7 `aimeat_appdev_pitfall_report` (record what bit you \u2014 model\nrequired, upserts by slug, share:true publishes platform-wide) \u00B7 `aimeat_app_template_propose`/\n`_list`/`_get` (distill a reusable template after a publish; the next build starts from it).\n\n## Research-first build flow (research \u2192 frame \u2192 propose \u2192 build \u2192 finish)\n1. RESEARCH: load the `node:aimeat-app-builder` skill (`aimeat_skill_get`), call\n   `aimeat_appdev_overview`, and fetch the canonical spec `GET /v1/prompts/build-app` (it is law).\n2. FRAME: tier (T1 pure client / T2 +cortex / T3 +extension), packs, start point (fork a prior\n   app / template proposal / shell), own-users \u2192 aimeat-iam decided NOW.\n3. PROPOSE the frame to the user in 3-5 lines; adjust.\n4. BUILD flexibly within the frame; verify locally; publish (presigned upload > ~1 KB).\n5. FINISH: agent face + bound skill (`metadata.binding`), `aimeat_app_template_propose`,\n   `aimeat_appdev_pitfall_report` \u2014 the publish response's `next_steps` shows what is missing.\nThe user can always say \"just build it the usual way\" \u2014 then skip 1-3.\n\n## Build \u2192 ship loop\n1. Build the artifact locally (HTML app, extension ZIP, or cortex ZIP).\n2. Install/publish via the matching tool (prefer presigned upload \u2014 keeps bytes out of context).\n3. Activate (extensions/cortex) and verify with the `_list`/`_get` tool.\n4. Iterate; bump versions on apps.\n\n## Organism workspaces & agent contracts\nYou also create + provision organism **workspaces** on this surface: `aimeat_organism_create` (the\ncontainer) \u00B7 `aimeat_workspace_create` (manifest + locked schemas) \u00B7 `aimeat_workspace_update` (evolve\nthe structure \u2014 add/remove a space, set the publish gate) \u00B7 `aimeat_workspace_read`/`_list`/`_write`/\n`_publish`/`_object_delete` \u00B7 `aimeat_workspace_access` (request/list/**decide** \u2014 approve a request as\n**viewer**/**contributor**) \u00B7 `aimeat_workspace_member_grant` (add an EXISTING member **directly** \u2014 no\nrequest \u2014 to ONE or MANY workspaces at once as viewer/contributor; grantee may be an owner name, GHII or\nGAII, applied to the owner so all their agents inherit) \u00B7 `aimeat_workspace_member_revoke` (remove; to\ndowngrade, re-grant the lower role) \u00B7 `aimeat_workspace_members` (roles + grant source per workspace) \u00B7\n`aimeat_workspace_transfer` (export/import). Grant/revoke are creator-or-org-admin; each is an auditable\ncreator-owned consent.\n\n**Building a workspace-PROCESSING agent (one that reads requests + writes results)?** It owns a\n**contract**: the spaces it READS (inputs) + WRITES (outputs) + the status lifecycle. Attaching it =\n**provision** the contract's spaces with `aimeat_workspace_update` **`add_spaces`** (the server UNIONS\nthem into the manifest, skips any that already exist, fills defaults \u2014 no need to resend the whole\nmanifest; creator-only, so a *same-owner* agent self-provisions, otherwise the creator does it)\n+ **grant** the agent the `contributor` role. Writes are attributed to the agent (it appears in\n\"Who works here\" + the activity heatmap) and are visible to the whole workspace. **Advertise the\ncontract** with owner-managed tags via `aimeat_agent_tags_set`: `workspace-contract` (the discovery\nmarker \u2014 the workspace UI surfaces such agents to their owner) + `contract.<id>` per contract served\n(this convention uses dots so `contract.<id>` parses by prefix; tags are `[a-z0-9._:-]`, no `@`). Full guide \u2014 machine-readable contract template, exact\nprovision calls, the processing loop, schema rules, discovery tags:\n**`docs/agent-workspace-contracts.md`**. Read it before building such an agent.\n\n## Layer rules (critical \u2014 see the appdev/mcp handbook modules)\n- Extensions own `ext:{name}` memory; read owner data via `ctx.memory.getPublic(ctx.caller.gaii, key)`.\n- Translations/settings are USER data \u2014 cortex reads them via `AIMEAT.data.get(...)`, NOT `getPublic('ext:...')`.\n- Apps call cortex public methods only \u2014 never `callExt`/`/v1/ext/` directly.\n- Extension actions use `export default async function(ctx, input) { ... }` (ES module default export).\n\n## Boundaries\nNo agent/owner work (memory beyond build state, tasks, messages), no marketplace, no admin here. If\nyou need those, switch surfaces.\n";
 //# sourceMappingURL=appdev.d.ts.map

package/dist/src/services/handbooks/appdev.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"appdev.d.ts","sourceRoot":"","sources":["../../../../src/services/handbooks/appdev.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,eAAe,gzJAoE3B,CAAC"}
+{"version":3,"file":"appdev.d.ts","sourceRoot":"","sources":["../../../../src/services/handbooks/appdev.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,eAAO,MAAM,eAAe,uvMAsF3B,CAAC"}

package/dist/src/services/handbooks/appdev.js

@@ -3,6 +3,7 @@
  * @description Operating handbook for the v2 `appdev` surface (/v2/mcp/appdev · `aimeat connect serve
  *   --surface appdev`). Self-contained; tool list mirrors MCP_SURFACES.appdev.
  * @version-history
+ *   2026-07-19 — Research-first flow (AppDev KB Phase 7): Step 0 + tier decision tree + finish checklist / appdev-flow prompt / handbook module
  *   v1.0.0 -- 2026-05-30 -- Initial appdev-surface handbook
  *   v1.1.0 -- 2026-06-09 -- Add the Organism workspaces & agent-contracts section (points to
  *     docs/agent-workspace-contracts.md) so workspace-processing agents are built to the convention.
@@ -35,6 +36,24 @@ manifest.yaml + libs/) · \`aimeat_cortex_activate\` · \`aimeat_cortex_deactiva
 
 **Reference.** \`aimeat_handbook_get\` — read the appdev / generator directives.
 
+**Research & knowledge (the research-first flow).** \`aimeat_appdev_overview\` — ONE call before
+framing any build: the owner's apps + template proposals, library packs with per-model proofs,
+T1/T2/T3 templates, curated + learned pitfalls (pass your model id) · \`aimeat_appdev_pitfall_list\`
+(scope own/platform/all, paginated) · \`aimeat_appdev_pitfall_report\` (record what bit you — model
+required, upserts by slug, share:true publishes platform-wide) · \`aimeat_app_template_propose\`/
+\`_list\`/\`_get\` (distill a reusable template after a publish; the next build starts from it).
+
+## Research-first build flow (research → frame → propose → build → finish)
+1. RESEARCH: load the \`node:aimeat-app-builder\` skill (\`aimeat_skill_get\`), call
+   \`aimeat_appdev_overview\`, and fetch the canonical spec \`GET /v1/prompts/build-app\` (it is law).
+2. FRAME: tier (T1 pure client / T2 +cortex / T3 +extension), packs, start point (fork a prior
+   app / template proposal / shell), own-users → aimeat-iam decided NOW.
+3. PROPOSE the frame to the user in 3-5 lines; adjust.
+4. BUILD flexibly within the frame; verify locally; publish (presigned upload > ~1 KB).
+5. FINISH: agent face + bound skill (\`metadata.binding\`), \`aimeat_app_template_propose\`,
+   \`aimeat_appdev_pitfall_report\` — the publish response's \`next_steps\` shows what is missing.
+The user can always say "just build it the usual way" — then skip 1-3.
+
 ## Build → ship loop
 1. Build the artifact locally (HTML app, extension ZIP, or cortex ZIP).
 2. Install/publish via the matching tool (prefer presigned upload — keeps bytes out of context).

package/dist/src/services/handbooks/appdev.js.map

@@ -1 +1 @@
-{"version":3,"file":"appdev.js","sourceRoot":"","sources":["../../../../src/services/handbooks/appdev.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoE9B,CAAC"}
+{"version":3,"file":"appdev.js","sourceRoot":"","sources":["../../../../src/services/handbooks/appdev.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsF9B,CAAC"}

package/dist/src/services/invitations.d.ts

@@ -1,5 +1,5 @@
 import type { AimeatConfig } from '../config.js';
-import type { Storage, OrganismRecord } from '../storage/interface.js';
+import type { Storage, OrganismRecord, OrganismMembershipRecord } from '../storage/interface.js';
 import type { InvitationRecord, InvitationWorkspaceGrant } from '../storage/repositories/invitation.repository.js';
 export declare const INVITE_DEFAULT_EXPIRY_DAYS = 7;
 export declare const INVITE_MAX_EXPIRY_DAYS = 30;
@@ -9,6 +9,17 @@ export declare const INVITE_CODE_QUOTA_PER_MEMBER = 3;
 export declare function hashInviteToken(raw: string): string;
 /** SHA-256 of a normalized email — matches GHII.emailHash hashing (existing-user detection). */
 export declare function inviteEmailHash(email: string): string;
+/**
+ * Resolve + ALLOWLIST an inviter-supplied return target for the post-accept redirect. Accepts either
+ * a full URL or a bare app slug ("experience-center" → https://experience-center.<appHost>). Returns
+ * the normalized absolute URL ONLY when its host is the node's own origin or an app-origin host/
+ * subdomain (`apps.<apex>` / `*.apps.<apex>`, plus `*.apps.localhost` on a localhost node). Returns
+ * null for anything else. This is the open-redirect guard: an accept page is auth-adjacent (it sets a
+ * session cookie), so an arbitrary attacker URL must never be reflected. Enforced at BOTH mint time
+ * (store only a safe value) and redirect time (re-validate the stored value — the security-critical
+ * check, in case the allowlist changed after mint). Plaintext http is rejected off-localhost.
+ */
+export declare function resolveInvitationReturnTarget(raw: unknown, config: AimeatConfig): string | null;
 /** A validation/precondition failure the caller maps to its own error shape (HTTP envelope / MCP text). */
 export declare class InvitationError extends Error {
     status: number;
@@ -51,6 +62,7 @@ export interface CreateEmailInvitationInput {
     workspaces: InvitationWorkspaceGrant[];
     message?: string | null;
     expiresInDays?: number;
+    returnUrl?: string | null;
 }
 export interface CreateEmailInvitationResult {
     invitation: InvitationRecord;
@@ -64,4 +76,67 @@ export interface CreateEmailInvitationResult {
  * invitation email (best-effort). Throws InvitationError on bad email / dedupe / cap violations.
  */
 export declare function createEmailInvitation(storage: Storage, config: AimeatConfig, input: CreateEmailInvitationInput): Promise<CreateEmailInvitationResult>;
+/** Find a workspace's registry entry across every member's registry copy (one key per creator).
+ *  Standalone twin of routes/organisms/shared.ts findWsEntry so the service layer needs no route
+ *  helper bag. */
+export declare function findWorkspaceEntry(storage: Storage, orgId: string, ws: string): Promise<{
+    id: string;
+    name?: string;
+    createdBy?: string;
+    ownerGaii: string;
+} | null>;
+/**
+ * Apply a set of invite-time workspace grants to a grantee: resolve each workspace's creator (= the
+ * consent owner) and grant the role with source 'invite'. Skips a deleted workspace and the case
+ * where the grantee IS the creator. The ONE code path behind email-invite accept, code-invite mint,
+ * name-invite accept, and direct add. Returns the workspace ids actually granted.
+ */
+export declare function applyInvitationWorkspaceGrants(storage: Storage, config: AimeatConfig, args: {
+    orgId: string;
+    grants: InvitationWorkspaceGrant[];
+    grantee: string;
+    invitedBy: string;
+}): Promise<string[]>;
+export interface NameInviteInput {
+    organism: OrganismRecord;
+    inviterGhii: string;
+    inviteeRaw: string;
+    role?: unknown;
+    workspaces?: unknown;
+}
+/** Create a name invitation carrying role + workspace grants. Throws InvitationError. */
+export declare function createNameInvitation(storage: Storage, config: AimeatConfig, input: NameInviteInput): Promise<OrganismMembershipRecord>;
+/** Edit a PENDING name invitation's role and/or workspace grants (rights stay editable before the
+ *  invitee accepts — product decision 2026-07-16). Throws InvitationError. */
+export declare function updateNameInvitation(storage: Storage, config: AimeatConfig, input: {
+    organism: OrganismRecord;
+    inviteeRaw: string;
+    role?: unknown;
+    workspaces?: unknown;
+}): Promise<OrganismMembershipRecord>;
+/** Cancel a PENDING name invitation (creator/admin). Throws InvitationError when none exists. */
+export declare function cancelNameInvitation(storage: Storage, config: AimeatConfig, input: {
+    organism: OrganismRecord;
+    cancellerGhii: string;
+    inviteeRaw: string;
+}): Promise<void>;
+/**
+ * The invitee accepts: activate the membership, sync the organism roster arrays (admins too when the
+ * invite carried role 'admin'), apply the invite-time workspace grants, clear them off the row, and
+ * tell the inviter. The ONE accept path shared by REST and MCP. Returns the granted workspace ids.
+ */
+export declare function acceptNameInvitation(storage: Storage, config: AimeatConfig, input: {
+    organism: OrganismRecord;
+    membership: OrganismMembershipRecord;
+}): Promise<string[]>;
+/**
+ * DIRECT ADD — a creator/admin adds an existing local owner as an ACTIVE member with role +
+ * workspace grants applied immediately, no accept round-trip (product decision 2026-07-16: the
+ * notification + the ability to leave replace the consent step). A pending name-invite for the same
+ * owner is upgraded in place. Throws InvitationError. Returns the membership + granted workspaces.
+ */
+export declare function addOrganismMember(storage: Storage, config: AimeatConfig, input: NameInviteInput): Promise<{
+    membership: OrganismMembershipRecord;
+    grantedWorkspaces: string[];
+}>;
 //# sourceMappingURL=invitations.d.ts.map

package/dist/src/services/invitations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invitations.d.ts","sourceRoot":"","sources":["../../../src/services/invitations.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAKnH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAC5C,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAI9C,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AACD,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,2GAA2G;AAC3G,qBAAa,eAAgB,SAAQ,KAAK;IACrB,MAAM,EAAE,MAAM;IAAS,IAAI,EAAE,MAAM;gBAAnC,MAAM,EAAE,MAAM,EAAS,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAIxE;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,GAAG,EAAE,gBAAgB;;;;;;;;;;;;;;EAgBjD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ/E;AAED,+EAA+E;AAC/E,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,wBAAwB,EAAE,CAYjF;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC5B,UAAU,EAAE,wBAAwB,EAAE,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,2BAA2B,CAAC,CAuEtC"}
+{"version":3,"file":"invitations.d.ts","sourceRoot":"","sources":["../../../src/services/invitations.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACjG,OAAO,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAMnH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAC5C,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAI9C,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AACD,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAqC/F;AAED,2GAA2G;AAC3G,qBAAa,eAAgB,SAAQ,KAAK;IACrB,MAAM,EAAE,MAAM;IAAS,IAAI,EAAE,MAAM;gBAAnC,MAAM,EAAE,MAAM,EAAS,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAIxE;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,GAAG,EAAE,gBAAgB;;;;;;;;;;;;;;EAgBjD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ/E;AAED,+EAA+E;AAC/E,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,wBAAwB,EAAE,CAYjF;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC5B,UAAU,EAAE,wBAAwB,EAAE,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,gBAAgB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,2BAA2B,CAAC,CA0EtC;AAQD;;kBAEkB;AAClB,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAC1C,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAUtF;AAOD;;;;;GAKG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC9F,OAAO,CAAC,MAAM,EAAE,CAAC,CAcnB;AAgCD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,yFAAyF;AACzF,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,GAC7D,OAAO,CAAC,wBAAwB,CAAC,CA0BnC;AAED;8EAC8E;AAC9E,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EACtC,KAAK,EAAE;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5F,OAAO,CAAC,wBAAwB,CAAC,CAgBnC;AAED,iGAAiG;AACjG,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EACtC,KAAK,EAAE;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EACtC,KAAK,EAAE;IAAE,QAAQ,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,wBAAwB,CAAA;CAAE,GACxE,OAAO,CAAC,MAAM,EAAE,CAAC,CAwBnB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,GAC7D,OAAO,CAAC;IAAE,UAAU,EAAE,wBAAwB,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAiChF"}

package/dist/src/services/invitations.js

@@ -1,25 +1,38 @@
 /**
  * @file invitations.ts
- * @description Framework-agnostic core for EMAIL invitations to people not yet on the node: mint a
- *   single-use, time-limited token, persist the invitation (hash only), notify an already-registered
- *   invitee in-app, and send the invitation email. Shared by the REST routes (src/routes/organisms.ts)
- *   and the MCP tools (src/mcp/organisms.ts) so both entry points create invites identically. The
- *   ACCEPT side (register + join + workspace grants) stays in the route — it is HTTP/session-bound and
- *   not exposed via MCP.
+ * @description Framework-agnostic core for organism invitations, shared by the REST routes
+ *   (src/routes/organisms/*) and the MCP tools (src/mcp/organisms.ts) so both entry points behave
+ *   identically. Covers BOTH invitation kinds: (1) EMAIL invitations to people not yet on the node —
+ *   mint a single-use, time-limited token, persist the invitation (hash only), notify an already-
+ *   registered invitee in-app, send the email; the accept side (register + session) stays in the
+ *   route. (2) NAME invitations + DIRECT ADDS of already-registered local owners — carry an org role
+ *   and per-workspace grants chosen at invite time (membership row `role` + `invitedWorkspaces`),
+ *   editable while pending, applied via applyInvitationWorkspaceGrants on accept (or immediately on
+ *   a direct add).
  * @structure constants (expiry/cap); hashInviteToken/inviteEmailHash; InvitationError; invitePublic;
- *   normalizeOrgRole/normalizeWorkspaceGrants; createEmailInvitation().
+ *   normalizeOrgRole/normalizeInviteeName/normalizeWorkspaceGrants; findWorkspaceEntry;
+ *   applyInvitationWorkspaceGrants; createNameInvitation/updateNameInvitation/cancelNameInvitation/
+ *   acceptNameInvitation/addOrganismMember; createEmailInvitation().
  * @usage const { invitation, acceptUrl, emailSent } = await createEmailInvitation(storage, config, input);
+ *   const membership = await createNameInvitation(storage, config, { organism, inviterGhii, inviteeRaw, role, workspaces });
  * @version-history
- *   v1.0.0 — 2026-07-04 — Initial (email invitations for unregistered users).
- *   v1.1.0 — 2026-07-05 — Add INVITE_CODE_QUOTA_PER_MEMBER + type/provisionedOwner on the record (provisioned-code keys live in routes/organisms.ts).
+ *   v1.4.0 — 2026-07-18 — resolveInvitationReturnTarget(): allowlist an inviter-pinned post-accept
+ *     redirect (node origin + app-origin subdomains only — open-redirect guard); createEmailInvitation
+ *     stores the validated returnUrl so a link invitee can land back in the inviting app after accept.
+ *   v1.3.0 — 2026-07-16 — Name-invite core: role + invitedWorkspaces at invite time, direct add
+ *     (addOrganismMember), pending-invite update/cancel, shared grant application
+ *     (applyInvitationWorkspaceGrants extracted from the email-accept + code-mint loops).
  *   v1.2.0 — 2026-07-10 — Add normalizeInviteeName(): shared trim/lowercase/@node-strip for name-invites
  *     (REST + MCP) so memberships + notifications land on the identity the invitee actually signs in as.
+ *   v1.1.0 — 2026-07-05 — Add INVITE_CODE_QUOTA_PER_MEMBER + type/provisionedOwner on the record (provisioned-code keys live in routes/organisms.ts).
+ *   v1.0.0 — 2026-07-04 — Initial (email invitations for unregistered users).
  */
 import { randomBytes, createHash } from 'node:crypto';
 import { v4 as uuidv4 } from 'uuid';
 import { notify } from './notify.js';
 import { emitChange } from './event-bus.js';
 import { getActiveEmailService } from './email.js';
+import { grantWorkspaceRole } from './workspace-roles.js';
 export const INVITE_DEFAULT_EXPIRY_DAYS = 7;
 export const INVITE_MAX_EXPIRY_DAYS = 30;
 export const INVITE_MAX_PENDING_PER_ORG = 50; // abuse cap on outstanding email invites per organism
@@ -34,6 +47,64 @@ export function hashInviteToken(raw) {
 export function inviteEmailHash(email) {
     return createHash('sha256').update(email.toLowerCase().trim()).digest('hex');
 }
+/**
+ * Resolve + ALLOWLIST an inviter-supplied return target for the post-accept redirect. Accepts either
+ * a full URL or a bare app slug ("experience-center" → https://experience-center.<appHost>). Returns
+ * the normalized absolute URL ONLY when its host is the node's own origin or an app-origin host/
+ * subdomain (`apps.<apex>` / `*.apps.<apex>`, plus `*.apps.localhost` on a localhost node). Returns
+ * null for anything else. This is the open-redirect guard: an accept page is auth-adjacent (it sets a
+ * session cookie), so an arbitrary attacker URL must never be reflected. Enforced at BOTH mint time
+ * (store only a safe value) and redirect time (re-validate the stored value — the security-critical
+ * check, in case the allowlist changed after mint). Plaintext http is rejected off-localhost.
+ */
+export function resolveInvitationReturnTarget(raw, config) {
+    if (typeof raw !== 'string')
+        return null;
+    const s = raw.trim();
+    if (!s || s.length > 2048)
+        return null;
+    let candidate = s;
+    if (/^[a-z0-9][a-z0-9-]{0,62}$/i.test(s)) {
+        // Bare app slug → the app's subdomain of the app-origin host (needs a configured app host).
+        if (!config.appHost)
+            return null;
+        candidate = `https://${s.toLowerCase()}.${config.appHost}`;
+    }
+    else if (!/^https?:\/\//i.test(s)) {
+        // A host (or host/path) without a scheme — assume https so URL() can parse it.
+        candidate = `https://${s}`;
+    }
+    let url;
+    try {
+        url = new URL(candidate);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:')
+        return null;
+    const host = url.hostname.toLowerCase();
+    const isLocalHost = host === 'localhost' || host.endsWith('.localhost');
+    if (url.protocol === 'http:' && !isLocalHost)
+        return null; // no plaintext redirect off localhost
+    // 1) The node's own origin (baseUrl host).
+    let nodeHost = '';
+    try {
+        nodeHost = new URL(config.baseUrl).hostname.toLowerCase();
+    }
+    catch { /* host-less baseUrl */ }
+    if (nodeHost && host === nodeHost)
+        return url.toString();
+    // 2) The app-origin host + any per-app subdomain (apps.<apex> / *.apps.<apex>).
+    const appHost = (config.appHost || '').toLowerCase();
+    if (appHost && (host === appHost || host.endsWith(`.${appHost}`)))
+        return url.toString();
+    // 3) Local-dev convenience: *.apps.localhost when the node itself runs on localhost.
+    const nodeIsLocal = nodeHost === 'localhost' || nodeHost.endsWith('.localhost');
+    if (nodeIsLocal && (host === 'apps.localhost' || host.endsWith('.apps.localhost')))
+        return url.toString();
+    return null;
+}
 /** A validation/precondition failure the caller maps to its own error shape (HTTP envelope / MCP text). */
 export class InvitationError extends Error {
     status;
@@ -124,6 +195,8 @@ export async function createEmailInvitation(storage, config, input) {
         : INVITE_DEFAULT_EXPIRY_DAYS;
     const now = Date.now();
     const rawToken = randomBytes(32).toString('hex');
+    // Allowlist the return target now so an unsafe value is never persisted (re-validated at redirect).
+    const returnUrl = input.returnUrl != null ? resolveInvitationReturnTarget(input.returnUrl, config) : null;
     const invitation = {
         id: uuidv4(),
         tokenHash: hashInviteToken(rawToken),
@@ -141,6 +214,7 @@ export async function createEmailInvitation(storage, config, input) {
         expiresAt: new Date(now + days * DAY_MS).toISOString(),
         acceptedAt: null,
         acceptedBy: null,
+        returnUrl,
     };
     await storage.createInvitation(invitation);
     // The accept URL (same construction as the magic link) — the raw token lives ONLY here.
@@ -171,4 +245,216 @@ export async function createEmailInvitation(storage, config, input) {
     emitChange('organisms');
     return { invitation, rawToken, acceptUrl, emailSent, existingUser: !!existing };
 }
+/* ══ Name invitations + direct adds — already-registered LOCAL owners ══
+ * The membership row IS the invitation (status 'invited'); `role` + `invitedWorkspaces` carry the
+ * access chosen at invite time so the invitee lands with the right rights the moment they accept.
+ * A direct add skips the accept round-trip entirely (product decision 2026-07-16): the member is
+ * active immediately, grants applied, and they are notified (they can always leave). */
+/** Find a workspace's registry entry across every member's registry copy (one key per creator).
+ *  Standalone twin of routes/organisms/shared.ts findWsEntry so the service layer needs no route
+ *  helper bag. */
+export async function findWorkspaceEntry(storage, orgId, ws) {
+    const regKey = `organism.${orgId}.meta.workspaces`;
+    const { items } = await storage.listAllMemory({ prefix: regKey, limit: 1000 });
+    for (const rec of items) {
+        if (rec.key !== regKey)
+            continue;
+        const list = rec.value?.workspaces ?? [];
+        const entry = list.find(w => w.id === ws);
+        if (entry)
+            return { ...entry, ownerGaii: rec.ownerGaii };
+    }
+    return null;
+}
+/** The bare owner behind a memory record's owner identity (`agent#owner@node` / `owner@node` → `owner`). */
+function bareOwnerOf(gaii) {
+    return (gaii.includes('#') ? gaii.split('#')[1] : gaii).split('@')[0];
+}
+/**
+ * Apply a set of invite-time workspace grants to a grantee: resolve each workspace's creator (= the
+ * consent owner) and grant the role with source 'invite'. Skips a deleted workspace and the case
+ * where the grantee IS the creator. The ONE code path behind email-invite accept, code-invite mint,
+ * name-invite accept, and direct add. Returns the workspace ids actually granted.
+ */
+export async function applyInvitationWorkspaceGrants(storage, config, args) {
+    const granted = [];
+    for (const g of args.grants) {
+        const entry = await findWorkspaceEntry(storage, args.orgId, g.ws);
+        if (!entry)
+            continue; // workspace deleted since the invite — skip
+        const createdBy = entry.createdBy ?? bareOwnerOf(entry.ownerGaii);
+        if (createdBy === args.grantee)
+            continue; // the creator already has full access
+        await grantWorkspaceRole(storage, config, {
+            creatorGhii: `${createdBy}@${config.nodeId}`, orgId: args.orgId, ws: g.ws,
+            grantee: args.grantee, role: g.role, source: 'invite', grantedBy: args.invitedBy,
+        });
+        granted.push(g.ws);
+    }
+    return granted;
+}
+/** Validate that every grant's workspace exists (invite/update time — an org creator/admin may grant
+ *  any existing workspace, so existence is the only per-grant precondition). */
+async function assertWorkspacesExist(storage, orgId, grants) {
+    for (const g of grants) {
+        if (!(await findWorkspaceEntry(storage, orgId, g.ws))) {
+            throw new InvitationError(404, 'WORKSPACE_NOT_FOUND', `Workspace "${g.ws}" not found in this organism`);
+        }
+    }
+}
+/** Normalize + validate a name-invite / direct-add target. Throws InvitationError on a remote name,
+ *  an unknown owner, or a conflicting membership state. Returns the bare owner name + any existing
+ *  membership row (for the caller to upgrade/replace where that is legal). */
+async function resolveInvitee(storage, config, organismId, inviteeRaw) {
+    // Organism members are HUMANS (owners). A GAII/GEAI would fall through to a confusing
+    // OWNER_NOT_FOUND ("No owner named agent#owner") — name the real problem instead.
+    if (inviteeRaw.includes('#') || inviteeRaw.trim().startsWith('eco:')) {
+        throw new InvitationError(400, 'INVALID_INPUT', 'Agents and apps cannot be organism members — invite their owner instead (agents inherit the membership)');
+    }
+    const invitee = normalizeInviteeName(inviteeRaw, config.nodeId);
+    if (!invitee)
+        throw new InvitationError(400, 'INVALID_INPUT', 'Invitee belongs to another node — name-invites work for local owners only');
+    if (!(await storage.getOwner(invitee)))
+        throw new InvitationError(404, 'OWNER_NOT_FOUND', `No owner named "${invitee}" on this node`);
+    const existing = await storage.getMembership(organismId, invitee);
+    if (existing && existing.status === 'active')
+        throw new InvitationError(409, 'ALREADY_MEMBER', 'That owner is already a member');
+    if (existing && existing.status === 'banned')
+        throw new InvitationError(409, 'BANNED', 'That owner is blocked — lift the block before inviting');
+    return { invitee, existing };
+}
+/** Create a name invitation carrying role + workspace grants. Throws InvitationError. */
+export async function createNameInvitation(storage, config, input) {
+    const { invitee, existing } = await resolveInvitee(storage, config, input.organism.id, input.inviteeRaw);
+    if (existing && existing.status === 'invited')
+        throw new InvitationError(409, 'ALREADY_INVITED', 'That owner already has a pending invitation');
+    const role = normalizeOrgRole(input.role);
+    const grants = normalizeWorkspaceGrants(input.workspaces);
+    await assertWorkspacesExist(storage, input.organism.id, grants);
+    const now = new Date().toISOString();
+    const membership = await storage.createMembership({
+        id: uuidv4(), organismId: input.organism.id, ghii: invitee,
+        role, status: 'invited', invitedBy: input.inviterGhii, joinedAt: now,
+        invitedWorkspaces: grants.length ? grants : undefined,
+    });
+    await notify(storage, `${invitee}@${config.nodeId}`, {
+        type: 'organism_invitation',
+        title: `${input.inviterGhii} invited you to join "${input.organism.name}"`,
+        link: '/v1/profile#organisms',
+        // Accept/Decline post the invitee's own invitation endpoints (no body; keyed by org id + caller).
+        actions: [
+            { id: 'accept', label: 'Accept', kind: 'api', method: 'POST', endpoint: `/v1/organisms/${input.organism.id}/invitations/accept`, style: 'primary' },
+            { id: 'decline', label: 'Decline', kind: 'api', method: 'POST', endpoint: `/v1/organisms/${input.organism.id}/invitations/decline`, style: 'default', confirm: true },
+        ],
+    });
+    emitChange('notifications', `${invitee}@${config.nodeId}`);
+    emitChange('organisms');
+    return membership;
+}
+/** Edit a PENDING name invitation's role and/or workspace grants (rights stay editable before the
+ *  invitee accepts — product decision 2026-07-16). Throws InvitationError. */
+export async function updateNameInvitation(storage, config, input) {
+    const invitee = normalizeInviteeName(input.inviteeRaw, config.nodeId);
+    const membership = invitee ? await storage.getMembership(input.organism.id, invitee) : null;
+    if (!membership || membership.status !== 'invited') {
+        throw new InvitationError(404, 'NO_INVITATION', 'No pending invitation for that owner');
+    }
+    const updates = {};
+    if (input.role !== undefined)
+        updates.role = normalizeOrgRole(input.role);
+    if (input.workspaces !== undefined) {
+        const grants = normalizeWorkspaceGrants(input.workspaces);
+        await assertWorkspacesExist(storage, input.organism.id, grants);
+        updates.invitedWorkspaces = grants;
+    }
+    const updated = await storage.updateMembership(membership.id, updates);
+    emitChange('organisms');
+    return updated ?? { ...membership, ...updates };
+}
+/** Cancel a PENDING name invitation (creator/admin). Throws InvitationError when none exists. */
+export async function cancelNameInvitation(storage, config, input) {
+    const invitee = normalizeInviteeName(input.inviteeRaw, config.nodeId);
+    const membership = invitee ? await storage.getMembership(input.organism.id, invitee) : null;
+    if (!membership || membership.status !== 'invited') {
+        throw new InvitationError(404, 'NO_INVITATION', 'No pending invitation for that owner');
+    }
+    await storage.deleteMembership(membership.id);
+    await notify(storage, `${membership.ghii}@${config.nodeId}`, {
+        type: 'organism_invitation_cancelled',
+        title: `Your invitation to "${input.organism.name}" was withdrawn`,
+        link: '/v1/profile#organisms',
+    });
+    emitChange('notifications', `${membership.ghii}@${config.nodeId}`);
+    emitChange('organisms');
+}
+/**
+ * The invitee accepts: activate the membership, sync the organism roster arrays (admins too when the
+ * invite carried role 'admin'), apply the invite-time workspace grants, clear them off the row, and
+ * tell the inviter. The ONE accept path shared by REST and MCP. Returns the granted workspace ids.
+ */
+export async function acceptNameInvitation(storage, config, input) {
+    const { organism, membership } = input;
+    const invitee = membership.ghii;
+    const now = new Date().toISOString();
+    await storage.updateMembership(membership.id, { status: 'active', joinedAt: now, invitedWorkspaces: [] });
+    await storage.updateOrganism(organism.id, {
+        members: [...new Set([...organism.members, invitee])],
+        admins: membership.role === 'admin' ? [...new Set([...organism.admins, invitee])] : organism.admins,
+        updatedAt: now,
+    });
+    const granted = await applyInvitationWorkspaceGrants(storage, config, {
+        orgId: organism.id, grants: membership.invitedWorkspaces ?? [],
+        grantee: invitee, invitedBy: membership.invitedBy ?? invitee,
+    });
+    if (membership.invitedBy) {
+        await notify(storage, `${membership.invitedBy}@${config.nodeId}`, {
+            type: 'organism_invitation_accepted',
+            title: `${invitee} accepted your invitation to "${organism.name}"`,
+            link: '/v1/profile#organisms',
+        });
+        emitChange('notifications');
+    }
+    emitChange('organisms');
+    return granted;
+}
+/**
+ * DIRECT ADD — a creator/admin adds an existing local owner as an ACTIVE member with role +
+ * workspace grants applied immediately, no accept round-trip (product decision 2026-07-16: the
+ * notification + the ability to leave replace the consent step). A pending name-invite for the same
+ * owner is upgraded in place. Throws InvitationError. Returns the membership + granted workspaces.
+ */
+export async function addOrganismMember(storage, config, input) {
+    const { invitee, existing } = await resolveInvitee(storage, config, input.organism.id, input.inviteeRaw);
+    const role = normalizeOrgRole(input.role);
+    const grants = normalizeWorkspaceGrants(input.workspaces);
+    await assertWorkspacesExist(storage, input.organism.id, grants);
+    const now = new Date().toISOString();
+    let membership;
+    if (existing) { // status 'invited' or legacy 'pending' — upgrade in place
+        membership = (await storage.updateMembership(existing.id, { status: 'active', role, joinedAt: now, invitedWorkspaces: [] }))
+            ?? { ...existing, status: 'active', role, joinedAt: now };
+    }
+    else {
+        membership = await storage.createMembership({
+            id: uuidv4(), organismId: input.organism.id, ghii: invitee,
+            role, status: 'active', invitedBy: input.inviterGhii, joinedAt: now,
+        });
+    }
+    await storage.updateOrganism(input.organism.id, {
+        members: [...new Set([...input.organism.members, invitee])],
+        admins: role === 'admin' ? [...new Set([...input.organism.admins, invitee])] : input.organism.admins,
+        updatedAt: now,
+    });
+    const grantedWorkspaces = await applyInvitationWorkspaceGrants(storage, config, {
+        orgId: input.organism.id, grants, grantee: invitee, invitedBy: input.inviterGhii,
+    });
+    await notify(storage, `${invitee}@${config.nodeId}`, {
+        type: 'organism_member_added',
+        title: `${input.inviterGhii} added you to "${input.organism.name}" as ${role}`,
+        link: '/v1/profile#organisms',
+    });
+    emitChange('notifications', `${invitee}@${config.nodeId}`);
+    emitChange('organisms');
+    return { membership, grantedWorkspaces };
+}
 //# sourceMappingURL=invitations.js.map

package/dist/src/services/invitations.js.map

@@ -1 +1 @@
-{"version":3,"file":"invitations.js","sourceRoot":"","sources":["../../../src/services/invitations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAIpC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAC5C,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC,CAAC,sDAAsD;AACpG,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,CAAC,uFAAuF;AACtI,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AACD,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED,2GAA2G;AAC3G,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACrB;IAAuB;IAA1C,YAAmB,MAAc,EAAS,IAAY,EAAE,OAAe;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QADE,WAAM,GAAN,MAAM,CAAQ;QAAS,SAAI,GAAJ,IAAI,CAAQ;QAEpD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,GAAqB;IAChD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,GAAG,CAAC,UAAU;QAC3B,QAAQ,EAAE,GAAG,CAAC,OAAO;QACrB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,iBAAiB,EAAE,GAAG,CAAC,gBAAgB;QACvC,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,SAAS;QACzB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,GAAG,CAAC,SAAS;QACzB,UAAU,EAAE,GAAG,CAAC,SAAS;QACzB,WAAW,EAAE,GAAG,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,MAAc;IAC9D,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,MAAM,GAAG,GAA+B,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,OAAQ,CAAsB,EAAE,EAAE,KAAK,QAAQ;YACxD,CAAC,CAAE,CAAoB,CAAC,EAAE;YAC1B,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,IAAI,GAA8B,CAAwB,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;QACpH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAoBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,MAAoB,EACpB,KAAiC;IAEjC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,6BAA6B,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,yBAAyB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;QACjD,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,kBAAkB,EAAE,kFAAkF,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,iBAAiB,EAAE,sDAAsD,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,0BAA0B,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,UAAU,GAAqB;QACnC,EAAE,EAAE,MAAM,EAAE;QACZ,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC;QACpC,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,UAAU;QACjB,SAAS;QACT,SAAS,EAAE,KAAK,CAAC,WAAW;QAC5B,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAC7F,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;QACtD,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;KACjB,CAAC;IACF,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAE3C,wFAAwF;IACxF,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,OAAO,oBAAoB,QAAQ,EAAE,CAAC;IAElE,kGAAkG;IAClG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;YACnC,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,GAAG,KAAK,CAAC,WAAW,yBAAyB,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG;YAC1E,IAAI,EAAE,oBAAoB,QAAQ,EAAE;SACrC,CAAC,CAAC;QACH,UAAU,CAAC,eAAe,CAAC,CAAC;IAC9B,CAAC;IAED,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,QAAQ,EAAE,OAAO,EAAE,CAAC;QACtB,SAAS,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE;YAChD,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS;YACT,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACxE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,YAAY,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SAChD,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,UAAU,CAAC,WAAW,CAAC,CAAC;IACxB,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAClF,CAAC"}
+{"version":3,"file":"invitations.js","sourceRoot":"","sources":["../../../src/services/invitations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAIpC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAC5C,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC,CAAC,sDAAsD;AACpG,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,CAAC,uFAAuF;AACtI,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AACD,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,GAAY,EAAE,MAAoB;IAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,4FAA4F;QAC5F,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,SAAS,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IAC7D,CAAC;SAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,+EAA+E;QAC/E,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAEvE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,CAAC,sCAAsC;IAEjG,2CAA2C;IAC3C,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IACpG,IAAI,QAAQ,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IAEzD,gFAAgF;IAChF,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IAEzF,qFAAqF;IACrF,MAAM,WAAW,GAAG,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAChF,IAAI,WAAW,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IAE1G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2GAA2G;AAC3G,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACrB;IAAuB;IAA1C,YAAmB,MAAc,EAAS,IAAY,EAAE,OAAe;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QADE,WAAM,GAAN,MAAM,CAAQ;QAAS,SAAI,GAAJ,IAAI,CAAQ;QAEpD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,GAAqB;IAChD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,GAAG,CAAC,UAAU;QAC3B,QAAQ,EAAE,GAAG,CAAC,OAAO;QACrB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,iBAAiB,EAAE,GAAG,CAAC,gBAAgB;QACvC,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,SAAS;QACzB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,GAAG,CAAC,SAAS;QACzB,UAAU,EAAE,GAAG,CAAC,SAAS;QACzB,WAAW,EAAE,GAAG,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,MAAc;IAC9D,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,MAAM,GAAG,GAA+B,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,OAAQ,CAAsB,EAAE,EAAE,KAAK,QAAQ;YACxD,CAAC,CAAE,CAAoB,CAAC,EAAE;YAC1B,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,IAAI,GAA8B,CAAwB,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;QACpH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAqBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,MAAoB,EACpB,KAAiC;IAEjC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,6BAA6B,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,yBAAyB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC;QACjD,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,kBAAkB,EAAE,kFAAkF,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,iBAAiB,EAAE,sDAAsD,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,0BAA0B,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,oGAAoG;IACpG,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,6BAA6B,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1G,MAAM,UAAU,GAAqB;QACnC,EAAE,EAAE,MAAM,EAAE;QACZ,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC;QACpC,UAAU,EAAE,EAAE;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,UAAU;QACjB,SAAS;QACT,SAAS,EAAE,KAAK,CAAC,WAAW;QAC5B,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAC7F,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;QACtD,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,SAAS;KACV,CAAC;IACF,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAE3C,wFAAwF;IACxF,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,OAAO,oBAAoB,QAAQ,EAAE,CAAC;IAElE,kGAAkG;IAClG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;YACnC,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,GAAG,KAAK,CAAC,WAAW,yBAAyB,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG;YAC1E,IAAI,EAAE,oBAAoB,QAAQ,EAAE;SACrC,CAAC,CAAC;QACH,UAAU,CAAC,eAAe,CAAC,CAAC;IAC9B,CAAC;IAED,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,QAAQ,EAAE,OAAO,EAAE,CAAC;QACtB,SAAS,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE;YAChD,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS;YACT,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACxE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,YAAY,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SAChD,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,UAAU,CAAC,WAAW,CAAC,CAAC;IACxB,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAClF,CAAC;AAED;;;;wFAIwF;AAExF;;kBAEkB;AAClB,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAAE,KAAa,EAAE,EAAU;IAE3C,MAAM,MAAM,GAAG,YAAY,KAAK,kBAAkB,CAAC;IACnD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM;YAAE,SAAS;QACjC,MAAM,IAAI,GAAI,GAAG,CAAC,KAA0F,EAAE,UAAU,IAAI,EAAE,CAAC;QAC/H,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,IAAI,KAAK;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4GAA4G;AAC5G,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAgB,EAChB,MAAoB,EACpB,IAA+F;IAE/F,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,4CAA4C;QAClE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,SAAS,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS,CAAC,sCAAsC;QAChF,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE;YACxC,WAAW,EAAE,GAAG,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;YACzE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;SACjF,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;gFACgF;AAChF,KAAK,UAAU,qBAAqB,CAAC,OAAgB,EAAE,KAAa,EAAE,MAAkC;IACtG,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,qBAAqB,EAAE,cAAc,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;AACH,CAAC;AAED;;8EAE8E;AAC9E,KAAK,UAAU,cAAc,CAC3B,OAAgB,EAAE,MAAoB,EAAE,UAAkB,EAAE,UAAkB;IAE9E,sFAAsF;IACtF,kFAAkF;IAClF,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,yGAAyG,CAAC,CAAC;IAC7J,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,2EAA2E,CAAC,CAAC;IAC3I,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,iBAAiB,EAAE,mBAAmB,OAAO,gBAAgB,CAAC,CAAC;IACtI,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAClE,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IACjI,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,wDAAwD,CAAC,CAAC;IACjJ,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAUD,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAAE,MAAoB,EAAE,KAAsB;IAE9D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACzG,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;IAChJ,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAEhE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC;QAChD,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO;QAC1D,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG;QACpE,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KACtD,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE;QACnD,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,GAAG,KAAK,CAAC,WAAW,yBAAyB,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG;QAC1E,IAAI,EAAE,uBAAuB;QAC7B,kGAAkG;QAClG,OAAO,EAAE;YACP,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,KAAK,CAAC,QAAQ,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE;YACnJ,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,KAAK,CAAC,QAAQ,CAAC,EAAE,sBAAsB,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;SACtK;KACF,CAAC,CAAC;IACH,UAAU,CAAC,eAAe,EAAE,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,UAAU,CAAC,WAAW,CAAC,CAAC;IACxB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAAE,MAAoB,EACtC,KAA6F;IAE7F,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,sCAAsC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAsC,EAAE,CAAC;IACtD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,iBAAiB,GAAG,MAAM,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACvE,UAAU,CAAC,WAAW,CAAC,CAAC;IACxB,OAAO,OAAO,IAAI,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAAE,MAAoB,EACtC,KAA8E;IAE9E,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,sCAAsC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9C,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE;QAC3D,IAAI,EAAE,+BAA+B;QACrC,KAAK,EAAE,uBAAuB,KAAK,CAAC,QAAQ,CAAC,IAAI,iBAAiB;QAClE,IAAI,EAAE,uBAAuB;KAC9B,CAAC,CAAC;IACH,UAAU,CAAC,eAAe,EAAE,GAAG,UAAU,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,UAAU,CAAC,WAAW,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAAE,MAAoB,EACtC,KAAyE;IAEzE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1G,MAAM,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE;QACxC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACrD,MAAM,EAAE,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;QACnG,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,OAAO,EAAE,MAAM,EAAE;QACpE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,iBAAiB,IAAI,EAAE;QAC9D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,OAAO;KAC7D,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACzB,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE;YAChE,IAAI,EAAE,8BAA8B;YACpC,KAAK,EAAE,GAAG,OAAO,iCAAiC,QAAQ,CAAC,IAAI,GAAG;YAClE,IAAI,EAAE,uBAAuB;SAC9B,CAAC,CAAC;QACH,UAAU,CAAC,eAAe,CAAC,CAAC;IAC9B,CAAC;IACD,UAAU,CAAC,WAAW,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAgB,EAAE,MAAoB,EAAE,KAAsB;IAE9D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACzG,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAEhE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,UAAoC,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC,CAAC,0DAA0D;QACxE,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC;eACvH,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC;YAC1C,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO;YAC1D,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG;SACpE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE;QAC9C,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3D,MAAM,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM;QACpG,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC,OAAO,EAAE,MAAM,EAAE;QAC9E,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW;KACjF,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE;QACnD,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,GAAG,KAAK,CAAC,WAAW,kBAAkB,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,EAAE;QAC9E,IAAI,EAAE,uBAAuB;KAC9B,CAAC,CAAC;IACH,UAAU,CAAC,eAAe,EAAE,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,UAAU,CAAC,WAAW,CAAC,CAAC;IACxB,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;AAC3C,CAAC"}

package/dist/src/services/job-seeding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-seeding.d.ts","sourceRoot":"","sources":["../../../src/services/job-seeding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAUvD;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAoDjG"}
+{"version":3,"file":"job-seeding.d.ts","sourceRoot":"","sources":["../../../src/services/job-seeding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAUvD;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDjG"}

package/dist/src/services/job-seeding.js

@@ -12,6 +12,8 @@ export async function seedCoreScheduledJobs(config, storage) {
         { id: 'core:execution-log-prune', name: 'Execution Log Prune', coreHandler: 'execution-log-prune', cron: '0 3 * * *' },
         // Mark still-pending email invitations expired once their TTL passes (lazy checks also enforce this).
         { id: 'core:invitation-expiry', name: 'Invitation Expiry', coreHandler: 'invitation-expiry', cron: '*/10 * * * *' },
+        // Operator storage-growth telemetry: capture a per-table row-count snapshot every hour.
+        { id: 'core:storage-stats-snapshot', name: 'Storage Stats Snapshot', coreHandler: 'storage-stats-snapshot', cron: '0 * * * *' },
     ];
     if (config.consentEnabled) {
         jobs.push({ id: 'core:consent-expiry', name: 'Consent Expiry', coreHandler: 'consent-expiry', cron: '*/10 * * * *' });