@agent-native/core 0.10.0 → 0.11.0

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,4BAA4B,EAC5B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,EAAE,EACF,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,SAAS,EACT,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,IAAI,GACL,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,4BAA4B,EAC5B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,EAAE,EACF,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,SAAS,EACT,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,IAAI,GACL,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -2,7 +2,7 @@
 // Import everything from "@agent-native/core".
 // Agent (production mode)
 export { createProductionAgentHandler, DEFAULT_MODEL, } from "./agent/index.js";
-export { defineAction } from "./action.js";
+export { defineAction, AgentActionStopError, isAgentActionStopError, } from "./action.js";
 export { createDevScriptRegistry } from "./scripts/dev/index.js";
 export { createAgentChatPlugin, defaultAgentChatPlugin, } from "./server/agent-chat-plugin.js";
 // Server

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,+CAA+C;AAE/C,0BAA0B;AAC1B,OAAO,EACL,4BAA4B,EAS5B,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAyB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,+BAA+B,CAAC;AAEvC,SAAS;AACT,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,GAKX,MAAM,mBAAmB,CAAC;AAE3B,SAAS;AACT,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,EAAE,EACF,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EAMpB,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,sBAAsB;AACtB,OAAO,EACL,SAAS,GAGV,MAAM,mBAAmB,CAAC;AAE3B,uBAAuB;AACvB,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,aAAa,GAMd,MAAM,kBAAkB,CAAC;AAE1B,UAAU;AACV,OAAO,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,IAAI,GACL,MAAM,oBAAoB,CAAC;AAE5B,4EAA4E;AAC5E,wEAAwE;AACxE,mCAAmC;AACnC,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,GAMhB,MAAM,oBAAoB,CAAC","sourcesContent":["// Framework for agent-native apps.\n// Import everything from \"@agent-native/core\".\n\n// Agent (production mode)\nexport {\n  createProductionAgentHandler,\n  type ActionEntry,\n  type ScriptEntry,\n  type ProductionAgentOptions,\n  type ActionTool,\n  type ScriptTool,\n  type AgentMessage,\n  type AgentChatRequest,\n  type AgentChatEvent,\n  DEFAULT_MODEL,\n} from \"./agent/index.js\";\nexport { defineAction, type ActionHttpConfig } from \"./action.js\";\nexport { createDevScriptRegistry } from \"./scripts/dev/index.js\";\nexport {\n  createAgentChatPlugin,\n  defaultAgentChatPlugin,\n  type AgentChatPluginOptions,\n} from \"./server/agent-chat-plugin.js\";\n\n// Server\nexport {\n  createServer,\n  createSSEHandler,\n  defineNitroPlugin,\n  autoMountAuth,\n  getSession,\n  type CreateServerOptions,\n  type SSEHandlerOptions,\n  type AuthSession,\n  type AuthOptions,\n} from \"./server/index.js\";\n\n// Client\nexport {\n  sendToAgentChat,\n  useAgentChatGenerating,\n  useDevMode,\n  useSendToAgentChat,\n  CodeRequiredDialog,\n  useDbSync,\n  useFileWatcher,\n  cn,\n  ApiKeySettings,\n  useSession,\n  useProductionAgent,\n  ProductionAgentPanel,\n  type AgentChatMessage,\n  type CodeRequiredDialogProps,\n  type ProductionAgentMessage,\n  type UseProductionAgentResult,\n  type ProductionAgentPanelProps,\n  useActionQuery,\n  useActionMutation,\n} from \"./client/index.js\";\n\n// Shared (isomorphic)\nexport {\n  agentChat,\n  type AgentChatCallOptions,\n  type AgentChatResponse,\n} from \"./shared/index.js\";\n\n// Token usage tracking\nexport {\n  recordUsage,\n  getUsageSummary,\n  getUserUsageCents,\n  calculateCost,\n  type UsageRecord,\n  type UsageSummary,\n  type UsageBucket,\n  type DailyBucket,\n  type UsageRecentEntry,\n} from \"./usage/store.js\";\n\n// Scripts\nexport {\n  runScript,\n  loadEnv,\n  parseArgs,\n  camelCaseArgs,\n  isValidPath,\n  isValidProjectPath,\n  ensureDir,\n  fail,\n} from \"./scripts/index.js\";\n\n// Secrets registry — import from \"@agent-native/core/secrets\" when possible\n// (the subpath keeps the top-level entry point lean), but re-export the\n// public API here for convenience.\nexport {\n  registerRequiredSecret,\n  listRequiredSecrets,\n  getRequiredSecret,\n  readAppSecret,\n  writeAppSecret,\n  deleteAppSecret,\n  type RegisteredSecret,\n  type SecretScope,\n  type SecretKind,\n  type SecretValidator,\n  type SecretRef,\n} from \"./secrets/index.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,+CAA+C;AAE/C,0BAA0B;AAC1B,OAAO,EACL,4BAA4B,EAS5B,aAAa,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,GAGvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,+BAA+B,CAAC;AAEvC,SAAS;AACT,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,UAAU,GAKX,MAAM,mBAAmB,CAAC;AAE3B,SAAS;AACT,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,EAAE,EACF,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EAMpB,cAAc,EACd,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,sBAAsB;AACtB,OAAO,EACL,SAAS,GAGV,MAAM,mBAAmB,CAAC;AAE3B,uBAAuB;AACvB,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,aAAa,GAMd,MAAM,kBAAkB,CAAC;AAE1B,UAAU;AACV,OAAO,EACL,SAAS,EACT,OAAO,EACP,SAAS,EACT,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,IAAI,GACL,MAAM,oBAAoB,CAAC;AAE5B,4EAA4E;AAC5E,wEAAwE;AACxE,mCAAmC;AACnC,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,eAAe,GAMhB,MAAM,oBAAoB,CAAC","sourcesContent":["// Framework for agent-native apps.\n// Import everything from \"@agent-native/core\".\n\n// Agent (production mode)\nexport {\n  createProductionAgentHandler,\n  type ActionEntry,\n  type ScriptEntry,\n  type ProductionAgentOptions,\n  type ActionTool,\n  type ScriptTool,\n  type AgentMessage,\n  type AgentChatRequest,\n  type AgentChatEvent,\n  DEFAULT_MODEL,\n} from \"./agent/index.js\";\nexport {\n  defineAction,\n  AgentActionStopError,\n  isAgentActionStopError,\n  type ActionHttpConfig,\n  type AgentActionStopOptions,\n} from \"./action.js\";\nexport { createDevScriptRegistry } from \"./scripts/dev/index.js\";\nexport {\n  createAgentChatPlugin,\n  defaultAgentChatPlugin,\n  type AgentChatPluginOptions,\n} from \"./server/agent-chat-plugin.js\";\n\n// Server\nexport {\n  createServer,\n  createSSEHandler,\n  defineNitroPlugin,\n  autoMountAuth,\n  getSession,\n  type CreateServerOptions,\n  type SSEHandlerOptions,\n  type AuthSession,\n  type AuthOptions,\n} from \"./server/index.js\";\n\n// Client\nexport {\n  sendToAgentChat,\n  useAgentChatGenerating,\n  useDevMode,\n  useSendToAgentChat,\n  CodeRequiredDialog,\n  useDbSync,\n  useFileWatcher,\n  cn,\n  ApiKeySettings,\n  useSession,\n  useProductionAgent,\n  ProductionAgentPanel,\n  type AgentChatMessage,\n  type CodeRequiredDialogProps,\n  type ProductionAgentMessage,\n  type UseProductionAgentResult,\n  type ProductionAgentPanelProps,\n  useActionQuery,\n  useActionMutation,\n} from \"./client/index.js\";\n\n// Shared (isomorphic)\nexport {\n  agentChat,\n  type AgentChatCallOptions,\n  type AgentChatResponse,\n} from \"./shared/index.js\";\n\n// Token usage tracking\nexport {\n  recordUsage,\n  getUsageSummary,\n  getUserUsageCents,\n  calculateCost,\n  type UsageRecord,\n  type UsageSummary,\n  type UsageBucket,\n  type DailyBucket,\n  type UsageRecentEntry,\n} from \"./usage/store.js\";\n\n// Scripts\nexport {\n  runScript,\n  loadEnv,\n  parseArgs,\n  camelCaseArgs,\n  isValidPath,\n  isValidProjectPath,\n  ensureDir,\n  fail,\n} from \"./scripts/index.js\";\n\n// Secrets registry — import from \"@agent-native/core/secrets\" when possible\n// (the subpath keeps the top-level entry point lean), but re-export the\n// public API here for convenience.\nexport {\n  registerRequiredSecret,\n  listRequiredSecrets,\n  getRequiredSecret,\n  readAppSecret,\n  writeAppSecret,\n  deleteAppSecret,\n  type RegisteredSecret,\n  type SecretScope,\n  type SecretKind,\n  type SecretValidator,\n  type SecretRef,\n} from \"./secrets/index.js\";\n"]}

package/dist/org/accept-pending.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accept-pending.d.ts","sourceRoot":"","sources":["../../src/org/accept-pending.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC,CA4D9B"}
+{"version":3,"file":"accept-pending.d.ts","sourceRoot":"","sources":["../../src/org/accept-pending.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC,CA8D9B"}

package/dist/org/accept-pending.js

@@ -24,7 +24,7 @@ export async function acceptPendingInvitationsForEmail(rawEmail) {
     let rows = [];
     try {
         const res = await db.execute({
-            sql: `SELECT id, org_id AS "orgId" FROM org_invitations
+            sql: `SELECT id, org_id AS "orgId", role FROM org_invitations
             WHERE LOWER(email) = ? AND status = 'pending'
             ORDER BY created_at DESC`,
             args: [email],
@@ -32,6 +32,7 @@ export async function acceptPendingInvitationsForEmail(rawEmail) {
         rows = res.rows.map((r) => ({
             id: String(r.id),
             orgId: String(r.orgId ?? r.org_id),
+            role: r.role == null ? null : String(r.role),
         }));
     }
     catch (err) {
@@ -48,9 +49,10 @@ export async function acceptPendingInvitationsForEmail(rawEmail) {
             args: [inv.orgId, email],
         });
         if (existing.rows.length === 0) {
+            const role = inv.role === "admin" ? "admin" : "member";
             await db.execute({
-                sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, 'member', ?)`,
-                args: [nanoid(), inv.orgId, email, Date.now()],
+                sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
+                args: [nanoid(), inv.orgId, email, role, Date.now()],
             });
         }
         await db.execute({

package/dist/org/accept-pending.js.map

@@ -1 +1 @@
-{"version":3,"file":"accept-pending.js","sourceRoot":"","sources":["../../src/org/accept-pending.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAOhE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,QAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAEvB,IAAI,IAAI,GAAyC,EAAE,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAC3B,GAAG,EAAE;;qCAE0B;YAC/B,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC/B,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;SACnC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iEAAiE;QACjE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAoC,EAAE,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,yEAAyE;YAC9E,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC;SACzB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,EAAE,CAAC,OAAO,CAAC;gBACf,GAAG,EAAE,4FAA4F;gBACjG,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAC/C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,CAAC,OAAO,CAAC;YACf,GAAG,EAAE,6DAA6D;YAClE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;SACf,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,qEAAqE;IACrE,qCAAqC;IACrC,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IAC/C,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC","sourcesContent":["import { getDbExec } from \"../db/client.js\";\nimport { putUserSetting } from \"../settings/user-settings.js\";\n\nconst nanoid = (): string =>\n  globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n  Math.random().toString(36).slice(2) + Date.now().toString(36);\n\nexport interface AcceptPendingResult {\n  accepted: Array<{ invitationId: string; orgId: string }>;\n  activeOrgId: string | null;\n}\n\n/**\n * Accept every pending `org_invitations` row for this email:\n *   - insert a matching `org_members` row (role 'member') when one doesn't exist\n *   - flip the invitation's status to 'accepted'\n *   - set the user's `active-org-id` to the most-recently-created invite\n *\n * Called from the Better Auth `user.create.after` hook so that a user who signs\n * up with an email they were just invited to lands in the org immediately,\n * rather than seeing a blank-slate app until they navigate to /team.\n *\n * Safe to call when the org tables don't exist (some templates don't use the\n * org module) — it swallows the \"no such table\" error and returns empty.\n */\nexport async function acceptPendingInvitationsForEmail(\n  rawEmail: string,\n): Promise<AcceptPendingResult> {\n  const email = rawEmail.trim().toLowerCase();\n  if (!email) {\n    return { accepted: [], activeOrgId: null };\n  }\n\n  const db = getDbExec();\n\n  let rows: Array<{ id: string; orgId: string }> = [];\n  try {\n    const res = await db.execute({\n      sql: `SELECT id, org_id AS \"orgId\" FROM org_invitations\n            WHERE LOWER(email) = ? AND status = 'pending'\n            ORDER BY created_at DESC`,\n      args: [email],\n    });\n    rows = res.rows.map((r: any) => ({\n      id: String(r.id),\n      orgId: String(r.orgId ?? r.org_id),\n    }));\n  } catch (err) {\n    // Template doesn't use the org module / tables not migrated yet.\n    return { accepted: [], activeOrgId: null };\n  }\n\n  if (rows.length === 0) {\n    return { accepted: [], activeOrgId: null };\n  }\n\n  const accepted: AcceptPendingResult[\"accepted\"] = [];\n  for (const inv of rows) {\n    const existing = await db.execute({\n      sql: `SELECT 1 FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,\n      args: [inv.orgId, email],\n    });\n    if (existing.rows.length === 0) {\n      await db.execute({\n        sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, 'member', ?)`,\n        args: [nanoid(), inv.orgId, email, Date.now()],\n      });\n    }\n    await db.execute({\n      sql: `UPDATE org_invitations SET status = 'accepted' WHERE id = ?`,\n      args: [inv.id],\n    });\n    accepted.push({ invitationId: inv.id, orgId: inv.orgId });\n  }\n\n  // Set active-org-id to the most recent invite so the user lands in a\n  // populated workspace on first load.\n  const activeOrgId = accepted[0]?.orgId ?? null;\n  if (activeOrgId) {\n    try {\n      await putUserSetting(email, \"active-org-id\", { orgId: activeOrgId });\n    } catch {\n      // user_settings table might not exist in a minimal template — not fatal.\n    }\n  }\n\n  return { accepted, activeOrgId };\n}\n"]}
+{"version":3,"file":"accept-pending.js","sourceRoot":"","sources":["../../src/org/accept-pending.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAOhE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,QAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAEvB,IAAI,IAAI,GAA8D,EAAE,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAC3B,GAAG,EAAE;;qCAE0B;YAC/B,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC/B,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;SAC7C,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iEAAiE;QACjE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAoC,EAAE,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAChC,GAAG,EAAE,yEAAyE;YAC9E,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC;SACzB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YACvD,MAAM,EAAE,CAAC,OAAO,CAAC;gBACf,GAAG,EAAE,qFAAqF;gBAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,CAAC,OAAO,CAAC;YACf,GAAG,EAAE,6DAA6D;YAClE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;SACf,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,qEAAqE;IACrE,qCAAqC;IACrC,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IAC/C,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC","sourcesContent":["import { getDbExec } from \"../db/client.js\";\nimport { putUserSetting } from \"../settings/user-settings.js\";\n\nconst nanoid = (): string =>\n  globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n  Math.random().toString(36).slice(2) + Date.now().toString(36);\n\nexport interface AcceptPendingResult {\n  accepted: Array<{ invitationId: string; orgId: string }>;\n  activeOrgId: string | null;\n}\n\n/**\n * Accept every pending `org_invitations` row for this email:\n *   - insert a matching `org_members` row (role 'member') when one doesn't exist\n *   - flip the invitation's status to 'accepted'\n *   - set the user's `active-org-id` to the most-recently-created invite\n *\n * Called from the Better Auth `user.create.after` hook so that a user who signs\n * up with an email they were just invited to lands in the org immediately,\n * rather than seeing a blank-slate app until they navigate to /team.\n *\n * Safe to call when the org tables don't exist (some templates don't use the\n * org module) — it swallows the \"no such table\" error and returns empty.\n */\nexport async function acceptPendingInvitationsForEmail(\n  rawEmail: string,\n): Promise<AcceptPendingResult> {\n  const email = rawEmail.trim().toLowerCase();\n  if (!email) {\n    return { accepted: [], activeOrgId: null };\n  }\n\n  const db = getDbExec();\n\n  let rows: Array<{ id: string; orgId: string; role: string | null }> = [];\n  try {\n    const res = await db.execute({\n      sql: `SELECT id, org_id AS \"orgId\", role FROM org_invitations\n            WHERE LOWER(email) = ? AND status = 'pending'\n            ORDER BY created_at DESC`,\n      args: [email],\n    });\n    rows = res.rows.map((r: any) => ({\n      id: String(r.id),\n      orgId: String(r.orgId ?? r.org_id),\n      role: r.role == null ? null : String(r.role),\n    }));\n  } catch (err) {\n    // Template doesn't use the org module / tables not migrated yet.\n    return { accepted: [], activeOrgId: null };\n  }\n\n  if (rows.length === 0) {\n    return { accepted: [], activeOrgId: null };\n  }\n\n  const accepted: AcceptPendingResult[\"accepted\"] = [];\n  for (const inv of rows) {\n    const existing = await db.execute({\n      sql: `SELECT 1 FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,\n      args: [inv.orgId, email],\n    });\n    if (existing.rows.length === 0) {\n      const role = inv.role === \"admin\" ? \"admin\" : \"member\";\n      await db.execute({\n        sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n        args: [nanoid(), inv.orgId, email, role, Date.now()],\n      });\n    }\n    await db.execute({\n      sql: `UPDATE org_invitations SET status = 'accepted' WHERE id = ?`,\n      args: [inv.id],\n    });\n    accepted.push({ invitationId: inv.id, orgId: inv.orgId });\n  }\n\n  // Set active-org-id to the most recent invite so the user lands in a\n  // populated workspace on first load.\n  const activeOrgId = accepted[0]?.orgId ?? null;\n  if (activeOrgId) {\n    try {\n      await putUserSetting(email, \"active-org-id\", { orgId: activeOrgId });\n    } catch {\n      // user_settings table might not exist in a minimal template — not fatal.\n    }\n  }\n\n  return { accepted, activeOrgId };\n}\n"]}

package/dist/org/free-email-providers.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Free / public mailbox providers that should NOT be allowed as an
+ * organization's auto-join domain.
+ *
+ * Why: the auto-join feature lets anyone who signs up with an email at the
+ * org's `allowed_domain` join the org without an invitation. That is safe
+ * for company-owned domains (`acme.com`) — the company controls who gets
+ * an `@acme.com` address. It is catastrophic for shared mailbox providers
+ * (`gmail.com`, `outlook.com`, etc.) — anyone in the world can create a
+ * matching address and would be auto-added to the org.
+ *
+ * The list intentionally errs on the side of well-known providers; if a
+ * future provider isn't here we'll learn from a bug report rather than
+ * pretend we have an exhaustive registry.
+ */
+export declare const FREE_EMAIL_PROVIDER_DOMAINS: ReadonlySet<string>;
+export declare function isFreeEmailProvider(domain: string): boolean;
+//# sourceMappingURL=free-email-providers.d.ts.map

package/dist/org/free-email-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"free-email-providers.d.ts","sourceRoot":"","sources":["../../src/org/free-email-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAwG1D,CAAC;AAEH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE3D"}

package/dist/org/free-email-providers.js

@@ -0,0 +1,124 @@
+/**
+ * Free / public mailbox providers that should NOT be allowed as an
+ * organization's auto-join domain.
+ *
+ * Why: the auto-join feature lets anyone who signs up with an email at the
+ * org's `allowed_domain` join the org without an invitation. That is safe
+ * for company-owned domains (`acme.com`) — the company controls who gets
+ * an `@acme.com` address. It is catastrophic for shared mailbox providers
+ * (`gmail.com`, `outlook.com`, etc.) — anyone in the world can create a
+ * matching address and would be auto-added to the org.
+ *
+ * The list intentionally errs on the side of well-known providers; if a
+ * future provider isn't here we'll learn from a bug report rather than
+ * pretend we have an exhaustive registry.
+ */
+export const FREE_EMAIL_PROVIDER_DOMAINS = new Set([
+    // Google
+    "gmail.com",
+    "googlemail.com",
+    // Microsoft
+    "outlook.com",
+    "hotmail.com",
+    "live.com",
+    "msn.com",
+    "outlook.co.uk",
+    "hotmail.co.uk",
+    "live.co.uk",
+    "outlook.de",
+    "hotmail.de",
+    "live.de",
+    "outlook.fr",
+    "hotmail.fr",
+    "live.fr",
+    // Yahoo
+    "yahoo.com",
+    "yahoo.co.uk",
+    "yahoo.co.jp",
+    "yahoo.fr",
+    "yahoo.de",
+    "yahoo.it",
+    "yahoo.es",
+    "yahoo.ca",
+    "yahoo.com.au",
+    "yahoo.com.br",
+    "ymail.com",
+    "rocketmail.com",
+    // Apple
+    "icloud.com",
+    "me.com",
+    "mac.com",
+    // AOL / Verizon
+    "aol.com",
+    "aim.com",
+    // Privacy / disposable / forwarding
+    "proton.me",
+    "protonmail.com",
+    "pm.me",
+    "tutanota.com",
+    "tutanota.de",
+    "tuta.io",
+    "fastmail.com",
+    "fastmail.fm",
+    "duck.com",
+    "hey.com",
+    // Russian / Chinese majors
+    "yandex.com",
+    "yandex.ru",
+    "mail.ru",
+    "list.ru",
+    "bk.ru",
+    "inbox.ru",
+    "qq.com",
+    "163.com",
+    "126.com",
+    "sina.com",
+    "sina.cn",
+    "sohu.com",
+    // ISP / legacy / misc
+    "gmx.com",
+    "gmx.de",
+    "gmx.net",
+    "web.de",
+    "t-online.de",
+    "freenet.de",
+    "zoho.com",
+    "zohomail.com",
+    "rediffmail.com",
+    "mail.com",
+    "att.net",
+    "comcast.net",
+    "verizon.net",
+    "sbcglobal.net",
+    "bellsouth.net",
+    "cox.net",
+    "earthlink.net",
+    "btinternet.com",
+    "btopenworld.com",
+    "talktalk.net",
+    "sky.com",
+    "ntlworld.com",
+    "virginmedia.com",
+    "free.fr",
+    "orange.fr",
+    "wanadoo.fr",
+    "laposte.net",
+    "libero.it",
+    "tiscali.it",
+    "uol.com.br",
+    "bol.com.br",
+    "terra.com.br",
+    // Disposable
+    "mailinator.com",
+    "guerrillamail.com",
+    "10minutemail.com",
+    "trashmail.com",
+    "yopmail.com",
+    "tempmail.com",
+    "throwawaymail.com",
+    "sharklasers.com",
+]);
+export function isFreeEmailProvider(domain) {
+    return FREE_EMAIL_PROVIDER_DOMAINS.has(domain.trim().toLowerCase());
+}
+//# sourceMappingURL=free-email-providers.js.map

package/dist/org/free-email-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"free-email-providers.js","sourceRoot":"","sources":["../../src/org/free-email-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IACtE,SAAS;IACT,WAAW;IACX,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,aAAa;IACb,UAAU;IACV,SAAS;IACT,eAAe;IACf,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,WAAW;IACX,aAAa;IACb,aAAa;IACb,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,cAAc;IACd,cAAc;IACd,WAAW;IACX,gBAAgB;IAChB,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,gBAAgB;IAChB,SAAS;IACT,SAAS;IACT,oCAAoC;IACpC,WAAW;IACX,gBAAgB;IAChB,OAAO;IACP,cAAc;IACd,aAAa;IACb,SAAS;IACT,cAAc;IACd,aAAa;IACb,UAAU;IACV,SAAS;IACT,2BAA2B;IAC3B,YAAY;IACZ,WAAW;IACX,SAAS;IACT,SAAS;IACT,OAAO;IACP,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,UAAU;IACV,SAAS;IACT,UAAU;IACV,sBAAsB;IACtB,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,aAAa;IACb,YAAY;IACZ,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,SAAS;IACT,aAAa;IACb,aAAa;IACb,eAAe;IACf,eAAe;IACf,SAAS;IACT,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,cAAc;IACd,SAAS;IACT,cAAc;IACd,iBAAiB;IACjB,SAAS;IACT,WAAW;IACX,YAAY;IACZ,aAAa;IACb,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,aAAa;IACb,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,aAAa;IACb,cAAc;IACd,mBAAmB;IACnB,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACtE,CAAC","sourcesContent":["/**\n * Free / public mailbox providers that should NOT be allowed as an\n * organization's auto-join domain.\n *\n * Why: the auto-join feature lets anyone who signs up with an email at the\n * org's `allowed_domain` join the org without an invitation. That is safe\n * for company-owned domains (`acme.com`) — the company controls who gets\n * an `@acme.com` address. It is catastrophic for shared mailbox providers\n * (`gmail.com`, `outlook.com`, etc.) — anyone in the world can create a\n * matching address and would be auto-added to the org.\n *\n * The list intentionally errs on the side of well-known providers; if a\n * future provider isn't here we'll learn from a bug report rather than\n * pretend we have an exhaustive registry.\n */\nexport const FREE_EMAIL_PROVIDER_DOMAINS: ReadonlySet<string> = new Set([\n  // Google\n  \"gmail.com\",\n  \"googlemail.com\",\n  // Microsoft\n  \"outlook.com\",\n  \"hotmail.com\",\n  \"live.com\",\n  \"msn.com\",\n  \"outlook.co.uk\",\n  \"hotmail.co.uk\",\n  \"live.co.uk\",\n  \"outlook.de\",\n  \"hotmail.de\",\n  \"live.de\",\n  \"outlook.fr\",\n  \"hotmail.fr\",\n  \"live.fr\",\n  // Yahoo\n  \"yahoo.com\",\n  \"yahoo.co.uk\",\n  \"yahoo.co.jp\",\n  \"yahoo.fr\",\n  \"yahoo.de\",\n  \"yahoo.it\",\n  \"yahoo.es\",\n  \"yahoo.ca\",\n  \"yahoo.com.au\",\n  \"yahoo.com.br\",\n  \"ymail.com\",\n  \"rocketmail.com\",\n  // Apple\n  \"icloud.com\",\n  \"me.com\",\n  \"mac.com\",\n  // AOL / Verizon\n  \"aol.com\",\n  \"aim.com\",\n  // Privacy / disposable / forwarding\n  \"proton.me\",\n  \"protonmail.com\",\n  \"pm.me\",\n  \"tutanota.com\",\n  \"tutanota.de\",\n  \"tuta.io\",\n  \"fastmail.com\",\n  \"fastmail.fm\",\n  \"duck.com\",\n  \"hey.com\",\n  // Russian / Chinese majors\n  \"yandex.com\",\n  \"yandex.ru\",\n  \"mail.ru\",\n  \"list.ru\",\n  \"bk.ru\",\n  \"inbox.ru\",\n  \"qq.com\",\n  \"163.com\",\n  \"126.com\",\n  \"sina.com\",\n  \"sina.cn\",\n  \"sohu.com\",\n  // ISP / legacy / misc\n  \"gmx.com\",\n  \"gmx.de\",\n  \"gmx.net\",\n  \"web.de\",\n  \"t-online.de\",\n  \"freenet.de\",\n  \"zoho.com\",\n  \"zohomail.com\",\n  \"rediffmail.com\",\n  \"mail.com\",\n  \"att.net\",\n  \"comcast.net\",\n  \"verizon.net\",\n  \"sbcglobal.net\",\n  \"bellsouth.net\",\n  \"cox.net\",\n  \"earthlink.net\",\n  \"btinternet.com\",\n  \"btopenworld.com\",\n  \"talktalk.net\",\n  \"sky.com\",\n  \"ntlworld.com\",\n  \"virginmedia.com\",\n  \"free.fr\",\n  \"orange.fr\",\n  \"wanadoo.fr\",\n  \"laposte.net\",\n  \"libero.it\",\n  \"tiscali.it\",\n  \"uol.com.br\",\n  \"bol.com.br\",\n  \"terra.com.br\",\n  // Disposable\n  \"mailinator.com\",\n  \"guerrillamail.com\",\n  \"10minutemail.com\",\n  \"trashmail.com\",\n  \"yopmail.com\",\n  \"tempmail.com\",\n  \"throwawaymail.com\",\n  \"sharklasers.com\",\n]);\n\nexport function isFreeEmailProvider(domain: string): boolean {\n  return FREE_EMAIL_PROVIDER_DOMAINS.has(domain.trim().toLowerCase());\n}\n"]}

package/dist/org/handlers.d.ts

@@ -37,13 +37,23 @@ export declare const listMembersHandler: import("h3").EventHandlerWithFetch<impo
         joinedAt: number;
     }[];
 }>>;
-/** POST /_agent-native/org/invitations — invite a user by email */
-export declare const createInvitationHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+interface SingleInviteResult {
     id: string;
-    email: any;
-    status: string;
+    email: string;
+    role: "member" | "admin";
+    status: "pending";
     emailSent: boolean;
-    emailError: string;
+    emailError?: string;
+}
+interface SingleInviteFailure {
+    email: string;
+    error: string;
+}
+/** POST /_agent-native/org/invitations — invite one or many users by email */
+export declare const createInvitationHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<SingleInviteResult | {
+    succeeded: SingleInviteResult[];
+    failed: SingleInviteFailure[];
+    total: number;
 }>>;
 /** GET /_agent-native/org/invitations — list pending invitations for the org */
 export declare const listInvitationsHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
@@ -53,6 +63,7 @@ export declare const listInvitationsHandler: import("h3").EventHandlerWithFetch<
         invitedBy: string;
         createdAt: number;
         status: string;
+        role: string;
     }[];
 }>>;
 /** POST /_agent-native/org/invitations/:id/accept — accept an invitation */
@@ -65,6 +76,18 @@ export declare const acceptInvitationHandler: import("h3").EventHandlerWithFetch
 export declare const removeMemberHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     success: boolean;
 }>>;
+/**
+ * PUT /_agent-native/org/members/:email/role — change a member's role
+ * (owner/admin only). Body: { role: "admin" | "member" }.
+ *
+ * Only owners can promote/demote admins. (Admins can manage members but
+ * not other admins — otherwise an admin could escalate themselves to
+ * owner-equivalent control by promoting a confederate.)
+ */
+export declare const changeMemberRoleHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    email: string;
+    role: string;
+}>>;
 /** PATCH /_agent-native/org — rename the current organization (owner/admin only) */
 export declare const updateOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     orgId: string;
@@ -141,4 +164,5 @@ export declare const receiveA2ASecretHandler: import("h3").EventHandlerWithFetch
     ok: boolean;
     orgId: string;
 }>>;
+export {};
 //# sourceMappingURL=handlers.d.ts.map

package/dist/org/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/org/handlers.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA2B1C,2FAA2F;AAC3F,eAAO,MAAM,eAAe;;;;;;;cAaA,OAAO;;;;;;;;;;eAIC,MAAM;iBAAW,MAAM;;;;GA0EzD,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB;;;;GAkC3B,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;cAWH,OAAO;;;GAIjC,CAAC;AAEH,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;GA+EnC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,sBAAsB;;;;;;;;GAqBlC,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB;;;UAmD8B,OAAO;GAkBxE,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,mBAAmB;;GA2D/B,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB;;;GA4B3B,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB;;;UAkCC,OAAO;GAEnC,CAAC;AAEH,mGAAmG;AACnG,eAAO,MAAM,mBAAmB;;;UAqDR,OAAO;GAG9B,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB;;GA2C3B,CAAC;AAEH,oGAAoG;AACpG,eAAO,MAAM,mBAAmB;;;GA0C/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB;;;;;YA2DvB,MAAM;cACJ,MAAM;aACP,MAAM;YACP,OAAO;iBACF,MAAM;gBACP,MAAM;;GAyDnB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB;;;GAgGnC,CAAC"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/org/handlers.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA2B1C,2FAA2F;AAC3F,eAAO,MAAM,eAAe;;;;;;;cAaA,OAAO;;;;;;;;;;eAIC,MAAM;iBAAW,MAAM;;;;GA0EzD,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB;;;;GAkC3B,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;cAWH,OAAO;;;GAIjC,CAAC;AAMH,UAAU,kBAAkB;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,mBAAmB;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAsED,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB;;;;GAuEnC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,sBAAsB;;;;;;;;;GAyBlC,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB;;;UAoD8B,OAAO;GAkBxE,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,mBAAmB;;GA2D/B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;GAqEnC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB;;;GA4B3B,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB;;;UAkCC,OAAO;GAEnC,CAAC;AAEH,mGAAmG;AACnG,eAAO,MAAM,mBAAmB;;;UAqDR,OAAO;GAG9B,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB;;GAsE3B,CAAC;AAEH,oGAAoG;AACpG,eAAO,MAAM,mBAAmB;;;GA0C/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB;;;;;YA2DvB,MAAM;cACJ,MAAM;aACP,MAAM;YACP,OAAO;iBACF,MAAM;gBACP,MAAM;;GAyDnB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB;;;GAgGnC,CAAC"}