@actuate-media/cms-core 0.39.0 → 0.40.0

package/dist/auth/index.d.ts

@@ -3,8 +3,10 @@ export type { SessionPayload, SessionOptions } from './session.js';
 export { hashPassword, verifyPassword, validatePasswordPolicy, checkPasswordBreach, } from './password.js';
 export { generateResetToken, hashToken, createPasswordReset, executePasswordReset, } from './reset.js';
 export type { ResetToken } from './reset.js';
-export { createUserInvite, normalizeInviteRole, VALID_INVITE_ROLES } from './invite.js';
-export type { InviteRole, CreateInviteInput, CreateInviteResult } from './invite.js';
+export { createInvite, listInvites, resendInvite, cancelInvite, updateInviteRole, extendInvite, expireStaleInvites, markInviteAcceptedForEmail, INVITE_EXPIRY_MS, VALID_EXPIRY_DAYS, } from './invites.js';
+export type { CreateInviteInput, InviteResult, SerializedInvite, InviteConfig, ListInvitesParams, } from './invites.js';
+export { ASSIGNABLE_ROLES, DISPLAY_ROLES, toDisplayRole, normalizeAssignableRole, enumRolesForDisplay, isOwnerRole, roleRank, permissionsForRole, } from './roles.js';
+export type { UserRoleEnum, DisplayRole, Permission } from './roles.js';
 export { generateTOTPSecret, verifyTOTP, generateBackupCodes, generateTOTPUri } from './totp.js';
 export { initiateOAuth, handleCallback, linkAccount } from './oauth.js';
 export { generateCodeVerifier, generateCodeChallenge, getAuthorizationUrl, exchangeCodeForTokens, getUserProfile, handleOAuthCallback, } from './oauth.js';

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC1F,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAElE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,eAAe,CAAA;AAEtB,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACvF,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEpF,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhG,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC1F,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAElE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,eAAe,CAAA;AAEtB,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC1B,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,GAClB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,mBAAmB,EACnB,WAAW,EACX,QAAQ,EACR,kBAAkB,GACnB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhG,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA"}

package/dist/auth/index.js

@@ -1,7 +1,8 @@
 export { createSession, verifySession, revokeSession, refreshSession } from './session.js';
 export { hashPassword, verifyPassword, validatePasswordPolicy, checkPasswordBreach, } from './password.js';
 export { generateResetToken, hashToken, createPasswordReset, executePasswordReset, } from './reset.js';
-export { createUserInvite, normalizeInviteRole, VALID_INVITE_ROLES } from './invite.js';
+export { createInvite, listInvites, resendInvite, cancelInvite, updateInviteRole, extendInvite, expireStaleInvites, markInviteAcceptedForEmail, INVITE_EXPIRY_MS, VALID_EXPIRY_DAYS, } from './invites.js';
+export { ASSIGNABLE_ROLES, DISPLAY_ROLES, toDisplayRole, normalizeAssignableRole, enumRolesForDisplay, isOwnerRole, roleRank, permissionsForRole, } from './roles.js';
 export { generateTOTPSecret, verifyTOTP, generateBackupCodes, generateTOTPUri } from './totp.js';
 export { initiateOAuth, handleCallback, linkAccount } from './oauth.js';
 export { generateCodeVerifier, generateCodeChallenge, getAuthorizationUrl, exchangeCodeForTokens, getUserProfile, handleOAuthCallback, } from './oauth.js';

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAG1F,OAAO,EACL,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,eAAe,CAAA;AAEtB,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAGnB,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAGvF,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhG,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,YAAY,CAAA;AASnB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAG1F,OAAO,EACL,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,eAAe,CAAA;AAEtB,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,0BAA0B,EAC1B,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,cAAc,CAAA;AAQrB,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,mBAAmB,EACnB,WAAW,EACX,QAAQ,EACR,kBAAkB,GACnB,MAAM,YAAY,CAAA;AAGnB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhG,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,mBAAmB,GACpB,MAAM,YAAY,CAAA;AASnB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA"}

package/dist/auth/invites.d.ts

@@ -0,0 +1,71 @@
+import { type UserRoleEnum } from './roles.js';
+/** Invitations are valid for a week by default — a person has to act. */
+export declare const INVITE_EXPIRY_MS: number;
+export declare const VALID_EXPIRY_DAYS: readonly [7, 14, 30];
+export interface InviteConfig {
+    siteUrl: string;
+    /** Admin mount path; the accept link is `<siteUrl><adminPath>/reset-password`. */
+    adminPath?: string;
+    invitedByName?: string;
+    invitedByUserId?: string;
+    siteName?: string;
+}
+export interface CreateInviteInput {
+    email: string;
+    role: string;
+    message?: string;
+    /** Days until expiry; one of {@link VALID_EXPIRY_DAYS}. Defaults to 7. */
+    expiresInDays?: number;
+}
+export interface InviteResult {
+    success: boolean;
+    error?: string;
+    /** Distinguish "already invited" so the UI can offer Resend instead. */
+    code?: 'DUPLICATE_USER' | 'PENDING_INVITE' | 'INVALID_EMAIL' | 'INVALID_ROLE' | 'NOT_FOUND';
+    /** The accept link. Returned only when email was NOT sent, so an admin can share it. */
+    inviteUrl?: string;
+    emailed?: boolean;
+    invite?: SerializedInvite;
+}
+export interface SerializedInvite {
+    id: string;
+    email: string;
+    role: UserRoleEnum;
+    roleName: string;
+    status: string;
+    invitedByUserId: string | null;
+    expiresAt: string;
+    createdAt: string;
+    expired: boolean;
+}
+/**
+ * Create an invitation. Provisions a placeholder user, persists a PENDING
+ * invite + single-use reset token, and emails the accept link.
+ */
+export declare function createInvite(db: any, input: CreateInviteInput, config: InviteConfig): Promise<InviteResult>;
+export interface ListInvitesParams {
+    status?: string;
+    search?: string;
+}
+/**
+ * List invites, lazily flipping any past-expiry PENDING rows to EXPIRED so the
+ * status is always honest without a background job.
+ */
+export declare function listInvites(db: any, params?: ListInvitesParams): Promise<SerializedInvite[]>;
+/** Flip PENDING invites whose expiry has passed to EXPIRED. Returns the count. */
+export declare function expireStaleInvites(db: any): Promise<number>;
+/** Resend (or revive an expired) invite: fresh token, reset expiry, re-email. */
+export declare function resendInvite(db: any, inviteId: string, config: InviteConfig): Promise<InviteResult>;
+/** Cancel an invite and deactivate its placeholder user so the link is dead. */
+export declare function cancelInvite(db: any, inviteId: string): Promise<InviteResult>;
+/** Change the role on a pending invite (and its placeholder user). */
+export declare function updateInviteRole(db: any, inviteId: string, role: string): Promise<InviteResult>;
+/** Extend a pending invite's expiry and re-sync its reset token expiry. */
+export declare function extendInvite(db: any, inviteId: string, days: number): Promise<InviteResult>;
+/**
+ * Mark the pending invite for an email as ACCEPTED. Called when a user sets
+ * their password through the reset/accept flow. Safe to call for non-invited
+ * users — it simply updates zero rows.
+ */
+export declare function markInviteAcceptedForEmail(db: any, email: string, userId: string): Promise<boolean>;
+//# sourceMappingURL=invites.d.ts.map

package/dist/auth/invites.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invites.d.ts","sourceRoot":"","sources":["../../src/auth/invites.ts"],"names":[],"mappings":"AAoBA,OAAO,EAA0C,KAAK,YAAY,EAAE,MAAM,YAAY,CAAA;AAEtF,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,QAA0B,CAAA;AACvD,eAAO,MAAM,iBAAiB,sBAAuB,CAAA;AAIrD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wEAAwE;IACxE,IAAI,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,GAAG,cAAc,GAAG,WAAW,CAAA;IAC3F,wFAAwF;IACxF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,YAAY,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;CACjB;AAqDD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,GAAG,EACP,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CAgFvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,GAAG,EACP,MAAM,GAAE,iBAAsB,GAC7B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAS7B;AAED,kFAAkF;AAClF,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE;AAED,iFAAiF;AACjF,wBAAsB,YAAY,CAChC,EAAE,EAAE,GAAG,EACP,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,YAAY,CAAC,CA6CvB;AAED,gFAAgF;AAChF,wBAAsB,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAuBnF;AAED,sEAAsE;AACtE,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,GAAG,EACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,CAAC,CAgBvB;AAED,2EAA2E;AAC3E,wBAAsB,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBjG;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,GAAG,EACP,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAOlB"}

package/dist/auth/invites.js

@@ -0,0 +1,279 @@
+/**
+ * Invite lifecycle service (backed by the `actuate_invites` table).
+ *
+ * The `Invite` row is the authoritative record of an invitation — it drives the
+ * Users admin UI (pending list, resend/cancel/extend/change-role) and seat
+ * accounting. To keep a working, secure acceptance flow without a separate
+ * invitee page, creating an invite also provisions a placeholder user with an
+ * unusable password (the proven Batch-2 mechanism) and issues a single-use,
+ * hashed password-reset token. The invitee sets their password via the existing
+ * `/reset-password` page; completing that flips the invite to ACCEPTED (see
+ * `markInviteAcceptedForEmail`, called from `executePasswordReset`).
+ *
+ * Members are de-duplicated against pending invites by email so a not-yet-
+ * accepted invite is shown only as a pending row, never double-counted.
+ */
+import { randomBytes } from 'node:crypto';
+import { hashPassword } from './password.js';
+import { generateResetToken } from './reset.js';
+import { userInvitationEmailTemplate } from './invite-email.js';
+import { resolveEmailSender } from '../email/sender.js';
+import { normalizeAssignableRole, toDisplayRole } from './roles.js';
+/** Invitations are valid for a week by default — a person has to act. */
+export const INVITE_EXPIRY_MS = 7 * 24 * 60 * 60 * 1000;
+export const VALID_EXPIRY_DAYS = [7, 14, 30];
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function expiryDays(input) {
+    const v = input ?? 7;
+    return VALID_EXPIRY_DAYS.includes(v) ? v : 7;
+}
+function buildAcceptUrl(rawToken, config) {
+    const base = config.siteUrl.replace(/\/$/, '');
+    const adminPath = (config.adminPath ?? '/admin').replace(/\/$/, '');
+    return `${base}${adminPath}/reset-password?token=${rawToken}`;
+}
+function serializeInvite(row) {
+    return {
+        id: row.id,
+        email: row.email,
+        role: row.role,
+        roleName: toDisplayRole(row.role),
+        status: row.status,
+        invitedByUserId: row.invitedByUserId ?? null,
+        expiresAt: row.expiresAt instanceof Date ? row.expiresAt.toISOString() : row.expiresAt,
+        createdAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : row.createdAt,
+        expired: new Date(row.expiresAt).getTime() < Date.now(),
+    };
+}
+async function sendInviteEmail(email, name, role, inviteUrl, config) {
+    const sender = resolveEmailSender();
+    if (!sender)
+        return false;
+    const tpl = userInvitationEmailTemplate({
+        inviteUrl,
+        userName: name,
+        role,
+        invitedByName: config.invitedByName,
+        siteName: config.siteName,
+    });
+    try {
+        await sender.send({ to: email, subject: tpl.subject, html: tpl.html, text: tpl.text });
+        return true;
+    }
+    catch {
+        // Best-effort: the invite + token are persisted, so the admin can share the
+        // returned link manually. Don't fail the whole invite on a send error.
+        return false;
+    }
+}
+/**
+ * Create an invitation. Provisions a placeholder user, persists a PENDING
+ * invite + single-use reset token, and emails the accept link.
+ */
+export async function createInvite(db, input, config) {
+    const email = input.email.toLowerCase().trim();
+    if (!EMAIL_RE.test(email)) {
+        return { success: false, error: 'Enter a valid email address.', code: 'INVALID_EMAIL' };
+    }
+    const role = normalizeAssignableRole(input.role);
+    if (!role) {
+        return { success: false, error: 'Select a valid role.', code: 'INVALID_ROLE' };
+    }
+    // Already a pending invite? Offer resend rather than a duplicate.
+    const pending = await db.invite.findFirst({
+        where: { email: { equals: email, mode: 'insensitive' }, status: 'PENDING' },
+    });
+    if (pending) {
+        return {
+            success: false,
+            error: 'This person already has a pending invitation. Resend it instead.',
+            code: 'PENDING_INVITE',
+            invite: serializeInvite(pending),
+        };
+    }
+    // An existing, already-accepted user can't be re-invited.
+    const existingUser = await db.user.findFirst({
+        where: { email: { equals: email, mode: 'insensitive' } },
+    });
+    if (existingUser) {
+        return {
+            success: false,
+            error: 'A user with this email already exists.',
+            code: 'DUPLICATE_USER',
+        };
+    }
+    const name = email.split('@')[0] || email;
+    const passwordHash = await hashPassword(randomBytes(32).toString('hex'));
+    const expiresAt = new Date(Date.now() + expiryDays(input.expiresInDays) * 24 * 60 * 60 * 1000);
+    // Placeholder user — unusable password, not yet approved/accepted.
+    const user = await db.user.create({
+        data: {
+            email,
+            name,
+            role,
+            passwordHash,
+            isActive: true,
+            isApproved: false,
+            emailVerified: false,
+            invitedById: config.invitedByUserId ?? null,
+        },
+    });
+    const { raw, hash } = generateResetToken();
+    await db.passwordResetToken.create({
+        data: { userId: user.id, tokenHash: hash, expiresAt },
+    });
+    const invite = await db.invite.create({
+        data: {
+            email,
+            role,
+            status: 'PENDING',
+            tokenHash: hash,
+            message: input.message?.trim() || null,
+            invitedByUserId: config.invitedByUserId ?? null,
+            expiresAt,
+        },
+    });
+    const inviteUrl = buildAcceptUrl(raw, config);
+    const emailed = await sendInviteEmail(email, name, role, inviteUrl, config);
+    return {
+        success: true,
+        emailed,
+        inviteUrl: emailed ? undefined : inviteUrl,
+        invite: serializeInvite(invite),
+    };
+}
+/**
+ * List invites, lazily flipping any past-expiry PENDING rows to EXPIRED so the
+ * status is always honest without a background job.
+ */
+export async function listInvites(db, params = {}) {
+    await expireStaleInvites(db);
+    const where = {};
+    if (params.status && params.status !== 'all')
+        where.status = params.status.toUpperCase();
+    if (params.search)
+        where.email = { contains: params.search.trim(), mode: 'insensitive' };
+    const rows = await db.invite.findMany({ where, orderBy: { createdAt: 'desc' } });
+    return rows.map(serializeInvite);
+}
+/** Flip PENDING invites whose expiry has passed to EXPIRED. Returns the count. */
+export async function expireStaleInvites(db) {
+    const res = await db.invite.updateMany({
+        where: { status: 'PENDING', expiresAt: { lt: new Date() } },
+        data: { status: 'EXPIRED' },
+    });
+    return res.count ?? 0;
+}
+/** Resend (or revive an expired) invite: fresh token, reset expiry, re-email. */
+export async function resendInvite(db, inviteId, config) {
+    const invite = await db.invite.findUnique({ where: { id: inviteId } });
+    if (!invite)
+        return { success: false, error: 'Invite not found.', code: 'NOT_FOUND' };
+    if (invite.status === 'ACCEPTED') {
+        return { success: false, error: 'This invitation was already accepted.' };
+    }
+    if (invite.status === 'CANCELLED') {
+        return { success: false, error: 'This invitation was cancelled.' };
+    }
+    const user = await db.user.findFirst({
+        where: { email: { equals: invite.email, mode: 'insensitive' } },
+    });
+    const expiresAt = new Date(Date.now() + INVITE_EXPIRY_MS);
+    const { raw, hash } = generateResetToken();
+    if (user) {
+        await db.passwordResetToken.updateMany({
+            where: { userId: user.id, usedAt: null },
+            data: { usedAt: new Date() },
+        });
+        await db.passwordResetToken.create({ data: { userId: user.id, tokenHash: hash, expiresAt } });
+    }
+    const updated = await db.invite.update({
+        where: { id: inviteId },
+        data: { status: 'PENDING', tokenHash: hash, expiresAt },
+    });
+    const inviteUrl = buildAcceptUrl(raw, config);
+    const emailed = await sendInviteEmail(invite.email, user?.name ?? invite.email, invite.role, inviteUrl, config);
+    return {
+        success: true,
+        emailed,
+        inviteUrl: emailed ? undefined : inviteUrl,
+        invite: serializeInvite(updated),
+    };
+}
+/** Cancel an invite and deactivate its placeholder user so the link is dead. */
+export async function cancelInvite(db, inviteId) {
+    const invite = await db.invite.findUnique({ where: { id: inviteId } });
+    if (!invite)
+        return { success: false, error: 'Invite not found.', code: 'NOT_FOUND' };
+    if (invite.status === 'ACCEPTED') {
+        return { success: false, error: 'This invitation was already accepted.' };
+    }
+    const user = await db.user.findFirst({
+        where: { email: { equals: invite.email, mode: 'insensitive' }, acceptedInviteAt: null },
+    });
+    if (user) {
+        await db.passwordResetToken.updateMany({
+            where: { userId: user.id, usedAt: null },
+            data: { usedAt: new Date() },
+        });
+        await db.user.update({ where: { id: user.id }, data: { isActive: false } });
+    }
+    const updated = await db.invite.update({
+        where: { id: inviteId },
+        data: { status: 'CANCELLED', cancelledAt: new Date() },
+    });
+    return { success: true, invite: serializeInvite(updated) };
+}
+/** Change the role on a pending invite (and its placeholder user). */
+export async function updateInviteRole(db, inviteId, role) {
+    const normalized = normalizeAssignableRole(role);
+    if (!normalized)
+        return { success: false, error: 'Select a valid role.', code: 'INVALID_ROLE' };
+    const invite = await db.invite.findUnique({ where: { id: inviteId } });
+    if (!invite)
+        return { success: false, error: 'Invite not found.', code: 'NOT_FOUND' };
+    if (invite.status !== 'PENDING') {
+        return { success: false, error: 'Only pending invitations can be changed.' };
+    }
+    await db.user.updateMany({
+        where: { email: { equals: invite.email, mode: 'insensitive' }, acceptedInviteAt: null },
+        data: { role: normalized },
+    });
+    const updated = await db.invite.update({ where: { id: inviteId }, data: { role: normalized } });
+    return { success: true, invite: serializeInvite(updated) };
+}
+/** Extend a pending invite's expiry and re-sync its reset token expiry. */
+export async function extendInvite(db, inviteId, days) {
+    const invite = await db.invite.findUnique({ where: { id: inviteId } });
+    if (!invite)
+        return { success: false, error: 'Invite not found.', code: 'NOT_FOUND' };
+    if (invite.status !== 'PENDING') {
+        return { success: false, error: 'Only pending invitations can be extended.' };
+    }
+    const expiresAt = new Date(Date.now() + expiryDays(days) * 24 * 60 * 60 * 1000);
+    const user = await db.user.findFirst({
+        where: { email: { equals: invite.email, mode: 'insensitive' }, acceptedInviteAt: null },
+    });
+    if (user) {
+        await db.passwordResetToken.updateMany({
+            where: { userId: user.id, usedAt: null },
+            data: { expiresAt },
+        });
+    }
+    const updated = await db.invite.update({ where: { id: inviteId }, data: { expiresAt } });
+    return { success: true, invite: serializeInvite(updated) };
+}
+/**
+ * Mark the pending invite for an email as ACCEPTED. Called when a user sets
+ * their password through the reset/accept flow. Safe to call for non-invited
+ * users — it simply updates zero rows.
+ */
+export async function markInviteAcceptedForEmail(db, email, userId) {
+    const normalized = email.toLowerCase().trim();
+    const res = await db.invite.updateMany({
+        where: { email: { equals: normalized, mode: 'insensitive' }, status: 'PENDING' },
+        data: { status: 'ACCEPTED', acceptedAt: new Date(), acceptedUserId: userId },
+    });
+    return (res.count ?? 0) > 0;
+}
+//# sourceMappingURL=invites.js.map

package/dist/auth/invites.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invites.js","sourceRoot":"","sources":["../../src/auth/invites.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAqB,MAAM,YAAY,CAAA;AAEtF,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAU,CAAA;AAErD,MAAM,QAAQ,GAAG,4BAA4B,CAAA;AA0C7C,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,CAAA;IACpB,OAAQ,iBAAuC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,MAAoB;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC9C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACnE,OAAO,GAAG,IAAI,GAAG,SAAS,yBAAyB,QAAQ,EAAE,CAAA;AAC/D,CAAC;AAED,SAAS,eAAe,CAAC,GAAQ;IAC/B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QACjC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,SAAS,EAAE,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS;QACtF,SAAS,EAAE,GAAG,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS;QACtF,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;KACxD,CAAA;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAAa,EACb,IAAY,EACZ,IAAkB,EAClB,SAAiB,EACjB,MAAoB;IAEpB,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAA;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,GAAG,GAAG,2BAA2B,CAAC;QACtC,SAAS;QACT,QAAQ,EAAE,IAAI;QACd,IAAI;QACJ,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAA;IACF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QACtF,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,uEAAuE;QACvE,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAO,EACP,KAAwB,EACxB,MAAoB;IAEpB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;IAC9C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IACzF,CAAC;IAED,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAChD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAA;IAChF,CAAC;IAED,kEAAkE;IAClE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;QACxC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;KAC5E,CAAC,CAAA;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,kEAAkE;YACzE,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC;SACjC,CAAA;IACH,CAAC;IAED,0DAA0D;IAC1D,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3C,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;KACzD,CAAC,CAAA;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,wCAAwC;YAC/C,IAAI,EAAE,gBAAgB;SACvB,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAA;IACzC,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IACxE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAE9F,mEAAmE;IACnE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;QAChC,IAAI,EAAE;YACJ,KAAK;YACL,IAAI;YACJ,IAAI;YACJ,YAAY;YACZ,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;SAC5C;KACF,CAAC,CAAA;IAEF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,kBAAkB,EAAE,CAAA;IAC1C,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;QACjC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;KACtD,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACpC,IAAI,EAAE;YACJ,KAAK;YACL,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI;YACtC,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;YAC/C,SAAS;SACV;KACF,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;IAE3E,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC1C,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;KAChC,CAAA;AACH,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAO,EACP,SAA4B,EAAE;IAE9B,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAA;IAE5B,MAAM,KAAK,GAA4B,EAAE,CAAA;IACzC,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK;QAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAA;IACxF,IAAI,MAAM,CAAC,MAAM;QAAE,KAAK,CAAC,KAAK,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IAExF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;AAClC,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAO;IAC9C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;QACrC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE;QAC3D,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;KAC5B,CAAC,CAAA;IACF,OAAO,GAAG,CAAC,KAAK,IAAI,CAAC,CAAA;AACvB,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAO,EACP,QAAgB,EAChB,MAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IACrF,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAA;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAA;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;QACnC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;KAChE,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,CAAA;IACzD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,kBAAkB,EAAE,CAAA;IAE1C,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;YACrC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YACxC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE;SAC7B,CAAC,CAAA;QACF,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACrC,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;QACvB,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;KACxD,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,MAAM,eAAe,CACnC,MAAM,CAAC,KAAK,EACZ,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,KAAK,EAC1B,MAAM,CAAC,IAAI,EACX,SAAS,EACT,MAAM,CACP,CAAA;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC1C,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC;KACjC,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAO,EAAE,QAAgB;IAC1D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IACrF,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAA;IAC3E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;QACnC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;KACxF,CAAC,CAAA;IACF,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;YACrC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YACxC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE;SAC7B,CAAC,CAAA;QACF,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACrC,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;QACvB,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE;KACvD,CAAC,CAAA;IACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAO,EACP,QAAgB,EAChB,IAAY;IAEZ,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;IAChD,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAA;IAE/F,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IACrF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAA;IAC9E,CAAC;IAED,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;QACvB,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;QACvF,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;KAC3B,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IAC/F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAO,EAAE,QAAgB,EAAE,IAAY;IACxE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IACrF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAA;IAC/E,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC/E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;QACnC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;KACxF,CAAC,CAAA;IACF,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;YACrC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;YACxC,IAAI,EAAE,EAAE,SAAS,EAAE;SACpB,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;IACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAO,EACP,KAAa,EACb,MAAc;IAEd,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;IAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;QACrC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;QAChF,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE;KAC7E,CAAC,CAAA;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;AAC7B,CAAC"}

package/dist/auth/reset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reset.d.ts","sourceRoot":"","sources":["../../src/auth/reset.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb;AAID,4EAA4E;AAC5E,wBAAgB,kBAAkB,IAAI,UAAU,CAI/C;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,GAAG,EACP,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IACN,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE;YACN,IAAI,EAAE,CAAC,IAAI,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;SAC5F,CAAA;KACF,CAAA;CACF,GACA,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,GAAG,EACP,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAuD/C"}
+{"version":3,"file":"reset.d.ts","sourceRoot":"","sources":["../../src/auth/reset.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb;AAID,4EAA4E;AAC5E,wBAAgB,kBAAkB,IAAI,UAAU,CAI/C;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,GAAG,EACP,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IACN,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE;YACN,IAAI,EAAE,CAAC,IAAI,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;SAC5F,CAAA;KACF,CAAA;CACF,GACA,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,GAAG,EACP,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAiF/C"}

package/dist/auth/reset.js

@@ -97,11 +97,33 @@ export async function executePasswordReset(db, rawToken, newPassword) {
         return { success: false, error: policy.errors[0] ?? 'Password does not meet requirements.' };
     }
     const passwordHash = await hashPassword(newPassword);
+    // If this account has a pending invite, completing the reset *is* the
+    // acceptance: mark the invite ACCEPTED and stamp the user as accepted +
+    // approved. Done in the same transaction so password + acceptance commit
+    // atomically. A normal (non-invite) reset matches no invite and is unaffected.
+    let pendingInvite = null;
+    try {
+        pendingInvite =
+            (await db.invite?.findFirst?.({
+                where: { email: { equals: resetToken.user.email, mode: 'insensitive' }, status: 'PENDING' },
+            })) ?? null;
+    }
+    catch {
+        pendingInvite = null;
+    }
+    const userData = { passwordHash };
+    const ops = [];
+    if (pendingInvite) {
+        userData.acceptedInviteAt = new Date();
+        userData.isApproved = true;
+        userData.emailVerified = true;
+        ops.push(db.invite.update({
+            where: { id: pendingInvite.id },
+            data: { status: 'ACCEPTED', acceptedAt: new Date(), acceptedUserId: resetToken.userId },
+        }));
+    }
     await db.$transaction([
-        db.user.update({
-            where: { id: resetToken.userId },
-            data: { passwordHash },
-        }),
+        db.user.update({ where: { id: resetToken.userId }, data: userData }),
         db.passwordResetToken.update({
             where: { id: resetToken.id },
             data: { usedAt: new Date() },
@@ -110,6 +132,7 @@ export async function executePasswordReset(db, rawToken, newPassword) {
             where: { userId: resetToken.userId, revokedAt: null },
             data: { revokedAt: new Date() },
         }),
+        ...ops,
     ]);
     return { success: true };
 }

package/dist/auth/reset.js.map

@@ -1 +1 @@
-{"version":3,"file":"reset.js","sourceRoot":"","sources":["../../src/auth/reset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAOvD,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,SAAS;AAEhD,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3D,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;AACtB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAO,EACP,KAAa,EACb,MAaC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;IAC7C,IAAI,CAAC,UAAU;QAAE,OAAM;IAEvB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;QACnC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;KAC9D,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAM;IAEnC,MAAM,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;QACrC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACxC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE;KAC7B,CAAC,CAAA;IAEF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,kBAAkB,EAAE,CAAA;IAC1C,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;QACjC,IAAI,EAAE;YACJ,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;SAClD;KACF,CAAC,CAAA;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,wCAAwC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,kBAAkB,EAAE,CAAA;IAC7D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACnE,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAG,SAAS,yBAAyB,GAAG,EAAE,CAAA;QAClE,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACpE,MAAM,MAAM,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,IAAI,CAAC,KAAK;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAO,EACP,QAAgB,EAChB,WAAmB;IAEnB,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IAErC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC;QACvD,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;QAClC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;KACxB,CAAC,CAAA;IAEF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAA;IACpE,CAAC;IAED,IAAI,UAAU,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAA;IAC5F,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAA;IACxE,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,kCAAkC;IAClC,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAA;IACpC,MAAM,cAAc,GAAG,SAAS,EAAE,IAAI,EAAE,cAAc,IAAI;QACxD,SAAS,EAAE,EAAE;QACb,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;KAC3B,CAAA;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,sCAAsC,EAAE,CAAA;IAC9F,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAEpD,MAAM,EAAE,CAAC,YAAY,CAAC;QACpB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACb,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,EAAE;YAChC,IAAI,EAAE,EAAE,YAAY,EAAE;SACvB,CAAC;QACF,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE;YAC5B,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE;SAC7B,CAAC;QACF,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;YACpB,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;YACrD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAChC,CAAC;KACH,CAAC,CAAA;IAEF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC"}
+{"version":3,"file":"reset.js","sourceRoot":"","sources":["../../src/auth/reset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAOvD,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,SAAS;AAEhD,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3D,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;AACtB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAO,EACP,KAAa,EACb,MAaC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;IAC7C,IAAI,CAAC,UAAU;QAAE,OAAM;IAEvB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;QACnC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;KAC9D,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAM;IAEnC,MAAM,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;QACrC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACxC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE;KAC7B,CAAC,CAAA;IAEF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,kBAAkB,EAAE,CAAA;IAC1C,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;QACjC,IAAI,EAAE;YACJ,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;SAClD;KACF,CAAC,CAAA;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,wCAAwC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,kBAAkB,EAAE,CAAA;IAC7D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACnE,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAG,SAAS,yBAAyB,GAAG,EAAE,CAAA;QAClE,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACpE,MAAM,MAAM,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,IAAI,CAAC,KAAK;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAO,EACP,QAAgB,EAChB,WAAmB;IAEnB,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IAErC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC;QACvD,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;QAClC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;KACxB,CAAC,CAAA;IAEF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAA;IACpE,CAAC;IAED,IAAI,UAAU,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAA;IAC5F,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAA;IACxE,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,kCAAkC;IAClC,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAA;IACpC,MAAM,cAAc,GAAG,SAAS,EAAE,IAAI,EAAE,cAAc,IAAI;QACxD,SAAS,EAAE,EAAE;QACb,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;KAC3B,CAAA;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,sCAAsC,EAAE,CAAA;IAC9F,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAEpD,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,+EAA+E;IAC/E,IAAI,aAAa,GAA0B,IAAI,CAAA;IAC/C,IAAI,CAAC;QACH,aAAa;YACX,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC5B,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;aAC5F,CAAC,CAAC,IAAI,IAAI,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,IAAI,CAAA;IACtB,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,YAAY,EAAE,CAAA;IAC1D,MAAM,GAAG,GAAc,EAAE,CAAA;IACzB,IAAI,aAAa,EAAE,CAAC;QAClB,QAAQ,CAAC,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAA;QACtC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAA;QAC1B,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAA;QAC7B,GAAG,CAAC,IAAI,CACN,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YACf,KAAK,EAAE,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE;YAC/B,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,MAAM,EAAE;SACxF,CAAC,CACH,CAAA;IACH,CAAC;IAED,MAAM,EAAE,CAAC,YAAY,CAAC;QACpB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE;YAC5B,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE;SAC7B,CAAC;QACF,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;YACpB,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;YACrD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAChC,CAAC;QACF,GAAG,GAAG;KACP,CAAC,CAAA;IAEF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC"}

package/dist/auth/roles.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Role model for the Users / access-control subsystem.
+ *
+ * The database enum (`UserRole`) carries six values for backward compatibility:
+ * the four product-facing roles `OWNER`, `ADMIN`, `EDITOR`, `VIEWER` plus the
+ * two legacy values `AUTHOR` and `CLIENT` that predate this subsystem. The admin
+ * UI only ever speaks in the four product roles, so this module is the single
+ * source of truth for:
+ *
+ *   - mapping any stored role to a product-facing display label,
+ *   - mapping a display-label filter back to the enum values it covers,
+ *   - which roles may be *assigned* to new/updated users,
+ *   - a privilege rank used by protection checks (last-owner, self-demotion),
+ *   - the permission groups each role grants.
+ *
+ * Everything here is pure and dependency-free so it can be unit-tested in
+ * isolation and imported from the lightweight `@actuate-media/cms-core/roles`
+ * subpath without pulling the full barrel.
+ */
+export type UserRoleEnum = 'OWNER' | 'ADMIN' | 'EDITOR' | 'AUTHOR' | 'CLIENT' | 'VIEWER';
+export type DisplayRole = 'Owner' | 'Admin' | 'Editor' | 'Viewer';
+/** Roles offered in the invite modal and role dropdowns, in privilege order. */
+export declare const ASSIGNABLE_ROLES: readonly UserRoleEnum[];
+/** All product-facing display roles, used for the filter pills. */
+export declare const DISPLAY_ROLES: readonly DisplayRole[];
+/**
+ * Privilege rank — higher is more privileged. Used to enforce "you cannot act on
+ * someone more privileged than you" and last-owner / self-demotion protections.
+ * Legacy roles rank with their display equivalent.
+ */
+export declare const ROLE_RANK: Record<UserRoleEnum, number>;
+/** Map any stored role (incl. legacy) to its product-facing display label. */
+export declare function toDisplayRole(role: string | null | undefined): DisplayRole;
+/** Validate + normalize a role coming from the UI for assignment. */
+export declare function normalizeAssignableRole(role: string | null | undefined): UserRoleEnum | null;
+/**
+ * The enum values a display-role filter covers. Returns `null` for "all" or an
+ * unrecognized label so callers can skip filtering.
+ */
+export declare function enumRolesForDisplay(display: string | null | undefined): UserRoleEnum[] | null;
+export declare function isOwnerRole(role: string | null | undefined): boolean;
+/** Rank of a role (0 for unknown). */
+export declare function roleRank(role: string | null | undefined): number;
+/** Every permission scope recognised by the system. */
+export declare const ALL_PERMISSIONS: readonly ["dashboard.view", "content.view", "content.create", "content.update", "content.publish", "content.delete", "pages.manage", "posts.manage", "media.manage", "forms.manage", "seo.manage", "redirects.manage", "scripts.manage", "users.view", "users.invite", "users.update", "users.update_role", "users.remove", "users.suspend", "users.reset_password", "users.reset_mfa", "sessions.view", "sessions.revoke", "api_keys.manage", "settings.manage", "security.manage", "audit.view", "billing.manage", "workspace.delete", "workspace.owner_actions"];
+export type Permission = (typeof ALL_PERMISSIONS)[number];
+/** Effective permissions granted by a role. */
+export declare function permissionsForRole(role: string | null | undefined): Permission[];
+/** Whether a role grants a specific permission. */
+export declare function roleHasPermission(role: string | null | undefined, permission: Permission): boolean;
+//# sourceMappingURL=roles.d.ts.map

package/dist/auth/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;AACxF,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAEjE,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,EAAE,SAAS,YAAY,EAA2C,CAAA;AAE/F,mEAAmE;AACnE,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAA2C,CAAA;AAkB3F;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAOlD,CAAA;AAQD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,CAG1E;AAED,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAG5F;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,EAAE,GAAG,IAAI,CAM7F;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEpE;AAED,sCAAsC;AACtC,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGhE;AAMD,uDAAuD;AACvD,eAAO,MAAM,eAAe,qiBA+BlB,CAAA;AAEV,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAA;AAqBzD,+CAA+C;AAC/C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE,CAehF;AAED,mDAAmD;AACnD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,UAAU,EAAE,UAAU,GACrB,OAAO,CAET"}