@braedonsaunders/appkit-auth 0.1.3

package/README.md

@@ -0,0 +1,36 @@
+# @braedonsaunders/appkit-auth
+
+Production authentication extracted from the complete reference runtime and generalized around explicit application inputs.
+
+## What ships
+
+- persisted Better Auth sessions, password accounts, OAuth accounts, and single-use verification records;
+- password sign-in, reset requests, reset completion, session refresh/revocation, and encrypted OAuth tokens;
+- hashed one-time magic links with framework-neutral email delivery;
+- membership-targeted invitation grants that cannot activate a different user, tenant, membership, or resend generation;
+- atomic Postgres invitation acceptance and audit through `@braedonsaunders/appkit-auth/drizzle`;
+- deterministic memory invitation storage for tests and database-free applications;
+- React sign-in, forgot-password, reset-password, and auth-screen compositions;
+- Better Auth React client and Next.js route bindings as optional entry points.
+
+## Server
+
+```ts
+import { createAppkitAuth, createLazyAuth } from '@braedonsaunders/appkit-auth/server'
+
+export const getAuth = createLazyAuth(() => createAppkitAuth({
+  database: pool,
+  baseURL: process.env.APP_URL!,
+  secret: process.env.BETTER_AUTH_SECRET!,
+  appName: 'My app',
+  sendEmail: (message) => emailQueue.enqueue(message),
+}))
+```
+
+Mount `toNextJsHandler(getAuth())` from `@braedonsaunders/appkit-auth/next` in a Next.js catch-all route. Other frameworks can mount `getAuth().handler` directly.
+
+## Invitations
+
+Create one `InviteService` with an explicit signing secret and a memory or Drizzle store. Mint a new grant after atomically advancing `membership.invitedAt`, pass its callback path to `signInMagicLink`, and provide the same service to `createAppkitAuth`. Membership activation then occurs only after Better Auth successfully consumes the matching one-time magic link.
+
+Applications own branding, transactional email transport, route authorization, tenant selection cookies, and optional post-acceptance domain effects. The package owns the security state machine and complete UI/runtime boundary.

package/client.d.ts

@@ -0,0 +1,129 @@
+import { createAuthClient } from 'better-auth/react';
+export type AppkitAuthClientOptions = {
+    baseURL?: string;
+    basePath?: string;
+    fetchOptions?: Parameters<typeof createAuthClient>[0] extends infer Options ? Options extends {
+        fetchOptions?: infer FetchOptions;
+    } ? FetchOptions : never : never;
+};
+/** React client with password, session, reset, and magic-link APIs. */
+export declare function createAppkitAuthClient(options?: AppkitAuthClientOptions): import("better-auth/react").ReactAuthClient<{
+    plugins: {
+        id: "magic-link";
+        version: string;
+        $InferServerPlugin: ReturnType<(options: import("better-auth/plugins").MagicLinkOptions) => {
+            id: "magic-link";
+            version: string;
+            endpoints: {
+                signInMagicLink: import("better-auth").StrictEndpoint<"/sign-in/magic-link", {
+                    method: "POST";
+                    requireHeaders: true;
+                    body: import("zod").ZodObject<{
+                        email: import("zod").ZodEmail;
+                        name: import("zod").ZodOptional<import("zod").ZodString>;
+                        callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                        newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                        errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                        metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+                    }, import("zod/v4/core").$strip>;
+                    metadata: {
+                        openapi: {
+                            operationId: string;
+                            description: string;
+                            responses: {
+                                200: {
+                                    description: string;
+                                    content: {
+                                        "application/json": {
+                                            schema: {
+                                                type: "object";
+                                                properties: {
+                                                    status: {
+                                                        type: string;
+                                                    };
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                }, {
+                    status: boolean;
+                }>;
+                magicLinkVerify: import("better-auth").StrictEndpoint<"/magic-link/verify", {
+                    method: "GET";
+                    query: import("zod").ZodObject<{
+                        token: import("zod").ZodString;
+                        callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                        errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                        newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                    }, import("zod/v4/core").$strip>;
+                    use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>)[];
+                    requireHeaders: true;
+                    metadata: {
+                        openapi: {
+                            operationId: string;
+                            description: string;
+                            responses: {
+                                200: {
+                                    description: string;
+                                    content: {
+                                        "application/json": {
+                                            schema: {
+                                                type: "object";
+                                                properties: {
+                                                    session: {
+                                                        $ref: string;
+                                                    };
+                                                    user: {
+                                                        $ref: string;
+                                                    };
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                }, {
+                    token: string;
+                    user: {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                    session: {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                }>;
+            };
+            rateLimit: {
+                pathMatcher(path: string): boolean;
+                window: number;
+                max: number;
+            }[];
+            options: import("better-auth/plugins").MagicLinkOptions;
+        }>;
+    }[];
+    baseURL?: string;
+    basePath?: string;
+    fetchOptions?: Parameters<typeof createAuthClient>[0] extends infer Options ? Options extends {
+        fetchOptions?: infer FetchOptions;
+    } ? FetchOptions : never : never;
+}>;
+export type AppkitAuthClient = ReturnType<typeof createAppkitAuthClient>;
+//# sourceMappingURL=client.d.ts.map

package/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,OAAO,GACvE,OAAO,SAAS;QAAE,YAAY,CAAC,EAAE,MAAM,YAAY,CAAA;KAAE,GACnD,YAAY,GACZ,KAAK,GACP,KAAK,CAAA;CACV,CAAA;AAED,uEAAuE;AACvE,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,uBAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAQu6I,CAAC;;;;;;;;;iCAAsN,CAAC;iCAA8C,CAAC;;;;;;;;;;;;cAlB9uJ,MAAM;eACL,MAAM;mBACF,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,OAAO,GACvE,OAAO,SAAS;QAAE,YAAY,CAAC,EAAE,MAAM,YAAY,CAAA;KAAE,GACnD,YAAY,GACZ,KAAK,GACP,KAAK;GASV;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAA"}

package/client.js

@@ -0,0 +1,10 @@
+import { createAuthClient } from 'better-auth/react';
+import { magicLinkClient } from 'better-auth/client/plugins';
+/** React client with password, session, reset, and magic-link APIs. */
+export function createAppkitAuthClient(options = {}) {
+    return createAuthClient({
+        ...options,
+        plugins: [magicLinkClient()],
+    });
+}
+//# sourceMappingURL=client.js.map

package/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAY5D,uEAAuE;AACvE,MAAM,UAAU,sBAAsB,CAAC,UAAmC,EAAE;IAC1E,OAAO,gBAAgB,CAAC;QACtB,GAAG,OAAO;QACV,OAAO,EAAE,CAAC,eAAe,EAAE,CAAC;KAC7B,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { createAuthClient } from 'better-auth/react'\nimport { magicLinkClient } from 'better-auth/client/plugins'\n\nexport type AppkitAuthClientOptions = {\n  baseURL?: string\n  basePath?: string\n  fetchOptions?: Parameters<typeof createAuthClient>[0] extends infer Options\n    ? Options extends { fetchOptions?: infer FetchOptions }\n      ? FetchOptions\n      : never\n    : never\n}\n\n/** React client with password, session, reset, and magic-link APIs. */\nexport function createAppkitAuthClient(options: AppkitAuthClientOptions = {}) {\n  return createAuthClient({\n    ...options,\n    plugins: [magicLinkClient()],\n  })\n}\n\nexport type AppkitAuthClient = ReturnType<typeof createAppkitAuthClient>\n"]}

package/drizzle.d.ts

@@ -0,0 +1,23 @@
+import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
+import type { AppkitDb } from '@braedonsaunders/appkit-db';
+import type { InviteStore } from './invites.js';
+import * as appkitSchema from '@braedonsaunders/appkit-db/schema';
+type Schema = typeof appkitSchema;
+type Database = NodePgDatabase<Schema>;
+export type DrizzleInviteStoreOptions = {
+    /** Optional domain hook committed in the same transaction as acceptance. */
+    onAccepted?: (db: Database, tenantId: string, userId: string) => Promise<void>;
+    /** Customize the audit vocabulary without changing the state machine. */
+    audit?: {
+        entityType?: string;
+        action?: string;
+        summary?: string;
+    };
+};
+/**
+ * Tenant-safe durable invitation adapter. Acceptance, the optional domain hook,
+ * and its audit record commit atomically under the BYPASSRLS system handle.
+ */
+export declare function createDrizzleInviteStore(database: Pick<AppkitDb<Schema>, 'withSuperAdmin'>, options?: DrizzleInviteStoreOptions): InviteStore;
+export {};
+//# sourceMappingURL=drizzle.d.ts.map

package/drizzle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drizzle.d.ts","sourceRoot":"","sources":["../src/drizzle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AAO1D,OAAO,KAAK,EAGV,WAAW,EACZ,MAAM,WAAW,CAAA;AAElB,OAAO,KAAK,YAAY,MAAM,mCAAmC,CAAA;AAEjE,KAAK,MAAM,GAAG,OAAO,YAAY,CAAA;AACjC,KAAK,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;AAEtC,MAAM,MAAM,yBAAyB,GAAG;IACtC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9E,yEAAyE;IACzE,KAAK,CAAC,EAAE;QACN,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;CACF,CAAA;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,EAClD,OAAO,GAAE,yBAA8B,GACtC,WAAW,CA8Bb"}

package/drizzle.js

@@ -0,0 +1,66 @@
+import { and, eq } from 'drizzle-orm';
+import { auditLog, memberships, tenants, users, } from '@braedonsaunders/appkit-db/schema';
+import { evaluateInviteAccess } from './invites.js';
+import * as appkitSchema from '@braedonsaunders/appkit-db/schema';
+/**
+ * Tenant-safe durable invitation adapter. Acceptance, the optional domain hook,
+ * and its audit record commit atomically under the BYPASSRLS system handle.
+ */
+export function createDrizzleInviteStore(database, options = {}) {
+    async function load(db, membershipId, lock) {
+        let query = db
+            .select({
+            membershipId: memberships.id,
+            tenantId: memberships.tenantId,
+            tenantName: tenants.name,
+            userId: memberships.userId,
+            invitedAt: memberships.invitedAt,
+            status: memberships.status,
+            emailVerified: users.emailVerified,
+            tenantStatus: tenants.status,
+        })
+            .from(memberships)
+            .innerJoin(users, eq(users.id, memberships.userId))
+            .innerJoin(tenants, eq(tenants.id, memberships.tenantId))
+            .where(eq(memberships.id, membershipId))
+            .limit(1);
+        if (lock)
+            query = query.for('update');
+        const [row] = await query;
+        return row ?? null;
+    }
+    return {
+        inspect: (membershipId) => database.withSuperAdmin((db) => load(db, membershipId, false)),
+        accept: (payload, sessionUserId) => database.withSuperAdmin((db) => db.transaction(async (tx) => acceptInTransaction(tx, payload, sessionUserId, options, load))),
+    };
+}
+async function acceptInTransaction(tx, payload, sessionUserId, options, load) {
+    const row = await load(tx, payload.membershipId, true);
+    const state = evaluateInviteAccess(payload, sessionUserId, row);
+    if (state !== 'pending' || !row)
+        return state;
+    const acceptedAt = new Date();
+    const [accepted] = await tx
+        .update(memberships)
+        .set({ status: 'active', joinedAt: acceptedAt, updatedAt: acceptedAt })
+        .where(and(eq(memberships.id, payload.membershipId), eq(memberships.tenantId, payload.tenantId), eq(memberships.userId, payload.userId), eq(memberships.status, 'invited'), eq(memberships.invitedAt, new Date(payload.invitedAt))))
+        .returning({ id: memberships.id });
+    if (!accepted) {
+        const current = await load(tx, payload.membershipId, false);
+        return evaluateInviteAccess(payload, sessionUserId, current);
+    }
+    await options.onAccepted?.(tx, payload.tenantId, payload.userId);
+    await tx.insert(auditLog).values({
+        tenantId: payload.tenantId,
+        actorUserId: sessionUserId,
+        entityType: options.audit?.entityType ?? 'tenant_user',
+        entityId: payload.membershipId,
+        action: options.audit?.action ?? 'update',
+        summary: options.audit?.summary ?? 'Accepted membership invitation',
+        before: { status: 'invited' },
+        after: { status: 'active', joinedAt: acceptedAt.toISOString() },
+        metadata: { acceptedVia: 'magic_link' },
+    });
+    return 'active';
+}
+//# sourceMappingURL=drizzle.js.map

package/drizzle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drizzle.js","sourceRoot":"","sources":["../src/drizzle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAGrC,OAAO,EACL,QAAQ,EACR,WAAW,EACX,OAAO,EACP,KAAK,GACN,MAAM,mCAAmC,CAAA;AAM1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,YAAY,MAAM,mCAAmC,CAAA;AAgBjE;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAkD,EAClD,UAAqC,EAAE;IAEvC,KAAK,UAAU,IAAI,CAAC,EAAY,EAAE,YAAoB,EAAE,IAAa;QACnE,IAAI,KAAK,GAAG,EAAE;aACX,MAAM,CAAC;YACN,YAAY,EAAE,WAAW,CAAC,EAAE;YAC5B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,YAAY,EAAE,OAAO,CAAC,MAAM;SAC7B,CAAC;aACD,IAAI,CAAC,WAAW,CAAC;aACjB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;aAClD,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;aACxD,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAA;QACX,IAAI,IAAI;YAAE,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAiB,CAAA;QACrD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,CAAA;QACzB,OAAO,GAAG,IAAI,IAAI,CAAA;IACpB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QACzF,MAAM,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,CACjC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE,EAAE,CAC7B,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAC7F;KACJ,CAAA;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAAY,EACZ,OAA2B,EAC3B,aAAqB,EACrB,OAAkC,EAClC,IAAyF;IAEzF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,CAAA;IAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAE7C,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAA;IAC7B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC,WAAW,CAAC;SACnB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;SACtE,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,EACxC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAC1C,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EACtC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,EACjC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CACvD,CACF;SACA,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAA;IAEpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QAC3D,OAAO,oBAAoB,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IAChE,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,aAAa;QAC1B,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,IAAI,aAAa;QACtD,QAAQ,EAAE,OAAO,CAAC,YAAY;QAC9B,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,QAAQ;QACzC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,gCAAgC;QACnE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;QAC7B,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE;QAC/D,QAAQ,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE;KACxC,CAAC,CAAA;IACF,OAAO,QAAiB,CAAA;AAC1B,CAAC","sourcesContent":["import { and, eq } from 'drizzle-orm'\nimport type { NodePgDatabase } from 'drizzle-orm/node-postgres'\nimport type { AppkitDb } from '@braedonsaunders/appkit-db'\nimport {\n  auditLog,\n  memberships,\n  tenants,\n  users,\n} from '@braedonsaunders/appkit-db/schema'\nimport type {\n  InviteGrantPayload,\n  InviteRecord,\n  InviteStore,\n} from './invites'\nimport { evaluateInviteAccess } from './invites'\nimport * as appkitSchema from '@braedonsaunders/appkit-db/schema'\n\ntype Schema = typeof appkitSchema\ntype Database = NodePgDatabase<Schema>\n\nexport type DrizzleInviteStoreOptions = {\n  /** Optional domain hook committed in the same transaction as acceptance. */\n  onAccepted?: (db: Database, tenantId: string, userId: string) => Promise<void>\n  /** Customize the audit vocabulary without changing the state machine. */\n  audit?: {\n    entityType?: string\n    action?: string\n    summary?: string\n  }\n}\n\n/**\n * Tenant-safe durable invitation adapter. Acceptance, the optional domain hook,\n * and its audit record commit atomically under the BYPASSRLS system handle.\n */\nexport function createDrizzleInviteStore(\n  database: Pick<AppkitDb<Schema>, 'withSuperAdmin'>,\n  options: DrizzleInviteStoreOptions = {},\n): InviteStore {\n  async function load(db: Database, membershipId: string, lock: boolean): Promise<InviteRecord | null> {\n    let query = db\n      .select({\n        membershipId: memberships.id,\n        tenantId: memberships.tenantId,\n        tenantName: tenants.name,\n        userId: memberships.userId,\n        invitedAt: memberships.invitedAt,\n        status: memberships.status,\n        emailVerified: users.emailVerified,\n        tenantStatus: tenants.status,\n      })\n      .from(memberships)\n      .innerJoin(users, eq(users.id, memberships.userId))\n      .innerJoin(tenants, eq(tenants.id, memberships.tenantId))\n      .where(eq(memberships.id, membershipId))\n      .limit(1)\n    if (lock) query = query.for('update') as typeof query\n    const [row] = await query\n    return row ?? null\n  }\n\n  return {\n    inspect: (membershipId) => database.withSuperAdmin((db) => load(db, membershipId, false)),\n    accept: (payload, sessionUserId) =>\n      database.withSuperAdmin((db) =>\n        db.transaction(async (tx) => acceptInTransaction(tx, payload, sessionUserId, options, load)),\n      ),\n  }\n}\n\nasync function acceptInTransaction(\n  tx: Database,\n  payload: InviteGrantPayload,\n  sessionUserId: string,\n  options: DrizzleInviteStoreOptions,\n  load: (db: Database, membershipId: string, lock: boolean) => Promise<InviteRecord | null>,\n) {\n  const row = await load(tx, payload.membershipId, true)\n  const state = evaluateInviteAccess(payload, sessionUserId, row)\n  if (state !== 'pending' || !row) return state\n\n  const acceptedAt = new Date()\n  const [accepted] = await tx\n    .update(memberships)\n    .set({ status: 'active', joinedAt: acceptedAt, updatedAt: acceptedAt })\n    .where(\n      and(\n        eq(memberships.id, payload.membershipId),\n        eq(memberships.tenantId, payload.tenantId),\n        eq(memberships.userId, payload.userId),\n        eq(memberships.status, 'invited'),\n        eq(memberships.invitedAt, new Date(payload.invitedAt)),\n      ),\n    )\n    .returning({ id: memberships.id })\n\n  if (!accepted) {\n    const current = await load(tx, payload.membershipId, false)\n    return evaluateInviteAccess(payload, sessionUserId, current)\n  }\n\n  await options.onAccepted?.(tx, payload.tenantId, payload.userId)\n  await tx.insert(auditLog).values({\n    tenantId: payload.tenantId,\n    actorUserId: sessionUserId,\n    entityType: options.audit?.entityType ?? 'tenant_user',\n    entityId: payload.membershipId,\n    action: options.audit?.action ?? 'update',\n    summary: options.audit?.summary ?? 'Accepted membership invitation',\n    before: { status: 'invited' },\n    after: { status: 'active', joinedAt: acceptedAt.toISOString() },\n    metadata: { acceptedVia: 'magic_link' },\n  })\n  return 'active' as const\n}\n"]}

package/index.d.ts

@@ -0,0 +1,4 @@
+export { createAppkitAuth, createLazyAuth, type AppkitAuth, type AppkitAuthOptions } from './server.js';
+export { createInviteService, evaluateInviteAccess, nextInviteGenerationDate, type InviteAccessState, type InviteGrantInput, type InviteGrantPayload, type InviteGrantVerification, type InviteInspection, type InviteRecord, type InviteService, type InviteServiceOptions, type InviteStore, } from './invites.js';
+export type { AuthEmail, AuthEmailKind, AuthEmailRenderer, AuthEmailSender } from './mail.js';
+//# sourceMappingURL=index.d.ts.map

package/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAA;AACpG,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA"}

package/index.js

@@ -0,0 +1,3 @@
+export { createAppkitAuth, createLazyAuth } from './server.js';
+export { createInviteService, evaluateInviteAccess, nextInviteGenerationDate, } from './invites.js';
+//# sourceMappingURL=index.js.map

package/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAA2C,MAAM,UAAU,CAAA;AACpG,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,GAUzB,MAAM,WAAW,CAAA","sourcesContent":["export { createAppkitAuth, createLazyAuth, type AppkitAuth, type AppkitAuthOptions } from './server'\nexport {\n  createInviteService,\n  evaluateInviteAccess,\n  nextInviteGenerationDate,\n  type InviteAccessState,\n  type InviteGrantInput,\n  type InviteGrantPayload,\n  type InviteGrantVerification,\n  type InviteInspection,\n  type InviteRecord,\n  type InviteService,\n  type InviteServiceOptions,\n  type InviteStore,\n} from './invites'\nexport type { AuthEmail, AuthEmailKind, AuthEmailRenderer, AuthEmailSender } from './mail'\n"]}

package/invites.d.ts

@@ -0,0 +1,79 @@
+declare const INVITE_GRANT_VERSION = 1;
+export type InviteGrantInput = {
+    membershipId: string;
+    tenantId: string;
+    userId: string;
+    invitedAt: Date;
+};
+export type InviteGrantPayload = {
+    v: typeof INVITE_GRANT_VERSION;
+    membershipId: string;
+    tenantId: string;
+    userId: string;
+    invitedAt: number;
+    issuedAt: number;
+    expiresAt: number;
+};
+export type InviteGrantVerification = {
+    ok: true;
+    payload: InviteGrantPayload;
+} | {
+    ok: false;
+    reason: 'invalid' | 'expired';
+};
+export type InviteAccessState = 'active' | 'pending' | 'suspended' | 'tenant_unavailable' | 'unverified' | 'invalid' | 'expired';
+export type InviteRecord = {
+    membershipId: string;
+    tenantId: string;
+    tenantName: string;
+    userId: string;
+    invitedAt: Date | null;
+    status: 'active' | 'invited' | 'suspended';
+    emailVerified: boolean;
+    tenantStatus: 'active' | 'suspended' | 'archived';
+};
+export type InviteInspection = {
+    state: InviteAccessState;
+    tenantId: string | null;
+    tenantName: string | null;
+};
+export type InviteStore = {
+    /** Read-only inspection. This must never activate a membership. */
+    inspect: (membershipId: string) => Promise<InviteRecord | null>;
+    /**
+     * Atomically lock, re-evaluate, activate, and audit a pending membership.
+     * The store receives the already signature-verified grant and must return the
+     * final state so concurrent or superseded links cannot double-accept.
+     */
+    accept: (payload: InviteGrantPayload, sessionUserId: string) => Promise<InviteAccessState>;
+};
+export type InviteServiceOptions = {
+    secret: string;
+    store: InviteStore;
+    ttlSeconds?: number;
+    /** HKDF domain separation. Change this only when intentionally rotating formats. */
+    signingContext?: string;
+    callbackPath?: string;
+};
+export type InviteService = {
+    ttlSeconds: number;
+    createInviteGrant: (input: InviteGrantInput, now?: number) => string;
+    verifyInviteGrant: (raw: string, now?: number) => InviteGrantVerification;
+    inviteCallbackPath: (grant: string) => string;
+    inviteGrantFromCallbackURL: (callbackURL: unknown, baseURL: string) => string | null;
+    acceptInviteAfterMagicLink: (rawGrant: string, sessionUserId: string) => Promise<InviteAccessState>;
+    inspectInviteForUser: (rawGrant: string, sessionUserId: string) => Promise<InviteInspection>;
+};
+/**
+ * The complete invitation grant flow extracted from the production runtime.
+ * Better Auth's one-time magic-link token proves mailbox possession; this
+ * independently signed grant binds that verified callback to exactly one
+ * pending membership generation.
+ */
+export declare function createInviteService(options: InviteServiceOptions): InviteService;
+/** Pure state machine shared by memory and durable stores. */
+export declare function evaluateInviteAccess(payload: InviteGrantPayload, sessionUserId: string, record: InviteRecord | null): InviteAccessState;
+/** Every resend advances the generation, even within the same clock tick. */
+export declare function nextInviteGenerationDate(previous: Date | null, now?: Date): Date;
+export {};
+//# sourceMappingURL=invites.d.ts.map

package/invites.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invites.d.ts","sourceRoot":"","sources":["../src/invites.ts"],"names":[],"mappings":"AAEA,QAAA,MAAM,oBAAoB,IAAI,CAAA;AAI9B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,CAAC,EAAE,OAAO,oBAAoB,CAAA;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAA;AAEhD,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,SAAS,GACT,WAAW,GACX,oBAAoB,GACpB,YAAY,GACZ,SAAS,GACT,SAAS,CAAA;AAEb,MAAM,MAAM,YAAY,GAAG;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,IAAI,GAAG,IAAI,CAAA;IACtB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAA;IAC1C,aAAa,EAAE,OAAO,CAAA;IACtB,YAAY,EAAE,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAA;CAClD,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,iBAAiB,CAAA;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,mEAAmE;IACnE,OAAO,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAC/D;;;;OAIG;IACH,MAAM,EAAE,CAAC,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;CAC3F,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,WAAW,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,iBAAiB,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,MAAM,CAAA;IACpE,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,uBAAuB,CAAA;IACzE,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;IAC7C,0BAA0B,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IACpF,0BAA0B,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACnG,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAC7F,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CA4HhF;AAED,8DAA8D;AAC9D,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,kBAAkB,EAC3B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,YAAY,GAAG,IAAI,GAC1B,iBAAiB,CAenB;AAED,6EAA6E;AAC7E,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,OAAa,GAAG,IAAI,CAOtF"}

package/invites.js

@@ -0,0 +1,185 @@
+import { createHmac, hkdfSync, timingSafeEqual } from 'node:crypto';
+const INVITE_GRANT_VERSION = 1;
+const DEFAULT_INVITE_TTL_SECONDS = 15 * 60;
+const MAX_GRANT_LENGTH = 4096;
+/**
+ * The complete invitation grant flow extracted from the production runtime.
+ * Better Auth's one-time magic-link token proves mailbox possession; this
+ * independently signed grant binds that verified callback to exactly one
+ * pending membership generation.
+ */
+export function createInviteService(options) {
+    if (options.secret.length < 32)
+        throw new Error('Invitation signing secret must contain at least 32 characters.');
+    const ttlSeconds = options.ttlSeconds ?? DEFAULT_INVITE_TTL_SECONDS;
+    if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 60) {
+        throw new Error('Invitation TTL must be a whole number of at least 60 seconds.');
+    }
+    const callbackPath = normalizeCallbackPath(options.callbackPath ?? '/invite/accept');
+    const signingKey = Buffer.from(hkdfSync('sha256', Buffer.from(options.secret), Buffer.alloc(0), Buffer.from(options.signingContext ?? 'appkit.invite.v1'), 32));
+    const sign = (payload) => createHmac('sha256', signingKey).update(payload).digest();
+    function createInviteGrant(input, now = Date.now()) {
+        if (!Number.isSafeInteger(now) || !Number.isSafeInteger(input.invitedAt.getTime())) {
+            throw new Error('Invalid invitation issuance time.');
+        }
+        for (const [name, value] of Object.entries({
+            membershipId: input.membershipId,
+            tenantId: input.tenantId,
+            userId: input.userId,
+        })) {
+            if (!isBoundedString(value, name === 'userId' ? 200 : 100)) {
+                throw new Error(`Invalid ${name}.`);
+            }
+        }
+        const payload = {
+            v: INVITE_GRANT_VERSION,
+            membershipId: input.membershipId,
+            tenantId: input.tenantId,
+            userId: input.userId,
+            invitedAt: input.invitedAt.getTime(),
+            issuedAt: now,
+            expiresAt: now + ttlSeconds * 1000,
+        };
+        const encoded = Buffer.from(JSON.stringify(payload)).toString('base64url');
+        return `${encoded}.${sign(encoded).toString('base64url')}`;
+    }
+    function verifyInviteGrant(raw, now = Date.now()) {
+        if (!raw || raw.length > MAX_GRANT_LENGTH || !Number.isSafeInteger(now)) {
+            return { ok: false, reason: 'invalid' };
+        }
+        const separator = raw.lastIndexOf('.');
+        if (separator <= 0 || separator === raw.length - 1)
+            return { ok: false, reason: 'invalid' };
+        const encoded = raw.slice(0, separator);
+        const signature = raw.slice(separator + 1);
+        let expected;
+        let provided;
+        try {
+            expected = sign(encoded);
+            provided = Buffer.from(signature, 'base64url');
+        }
+        catch {
+            return { ok: false, reason: 'invalid' };
+        }
+        if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
+            return { ok: false, reason: 'invalid' };
+        }
+        let payload = null;
+        try {
+            payload = parsePayload(JSON.parse(Buffer.from(encoded, 'base64url').toString('utf8')), ttlSeconds);
+        }
+        catch {
+            return { ok: false, reason: 'invalid' };
+        }
+        if (!payload)
+            return { ok: false, reason: 'invalid' };
+        if (now < payload.issuedAt - 60_000 || now > payload.expiresAt) {
+            return { ok: false, reason: 'expired' };
+        }
+        return { ok: true, payload };
+    }
+    function inviteCallbackPath(grant) {
+        return `${callbackPath}?${new URLSearchParams({ grant }).toString()}`;
+    }
+    function inviteGrantFromCallbackURL(callbackURL, baseURL) {
+        if (typeof callbackURL !== 'string' || !callbackURL)
+            return null;
+        try {
+            const base = new URL(baseURL);
+            const callback = new URL(callbackURL, base);
+            if (callback.origin !== base.origin || callback.pathname !== callbackPath)
+                return null;
+            return callback.searchParams.get('grant');
+        }
+        catch {
+            return null;
+        }
+    }
+    async function acceptInviteAfterMagicLink(rawGrant, sessionUserId) {
+        const verified = verifyInviteGrant(rawGrant);
+        if (!verified.ok)
+            return verified.reason;
+        return options.store.accept(verified.payload, sessionUserId);
+    }
+    async function inspectInviteForUser(rawGrant, sessionUserId) {
+        const verified = verifyInviteGrant(rawGrant);
+        if (!verified.ok)
+            return { state: verified.reason, tenantId: null, tenantName: null };
+        const record = await options.store.inspect(verified.payload.membershipId);
+        return {
+            state: evaluateInviteAccess(verified.payload, sessionUserId, record),
+            tenantId: record?.tenantId ?? null,
+            tenantName: record?.tenantName ?? null,
+        };
+    }
+    return {
+        ttlSeconds,
+        createInviteGrant,
+        verifyInviteGrant,
+        inviteCallbackPath,
+        inviteGrantFromCallbackURL,
+        acceptInviteAfterMagicLink,
+        inspectInviteForUser,
+    };
+}
+/** Pure state machine shared by memory and durable stores. */
+export function evaluateInviteAccess(payload, sessionUserId, record) {
+    if (!record || sessionUserId !== payload.userId)
+        return 'invalid';
+    if (record.membershipId !== payload.membershipId ||
+        record.tenantId !== payload.tenantId ||
+        record.userId !== payload.userId ||
+        record.invitedAt?.getTime() !== payload.invitedAt) {
+        return 'invalid';
+    }
+    if (record.tenantStatus !== 'active')
+        return 'tenant_unavailable';
+    if (record.status === 'suspended')
+        return 'suspended';
+    if (record.status === 'active')
+        return 'active';
+    if (!record.emailVerified)
+        return 'unverified';
+    return 'pending';
+}
+/** Every resend advances the generation, even within the same clock tick. */
+export function nextInviteGenerationDate(previous, now = new Date()) {
+    const nowMs = now.getTime();
+    const previousMs = previous?.getTime() ?? -1;
+    if (!Number.isSafeInteger(nowMs) || !Number.isSafeInteger(previousMs)) {
+        throw new Error('Invalid invitation generation time.');
+    }
+    return new Date(Math.max(nowMs, previousMs + 1));
+}
+function parsePayload(value, ttlSeconds) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const payload = value;
+    if (payload.v !== INVITE_GRANT_VERSION ||
+        !isBoundedString(payload.membershipId, 100) ||
+        !isBoundedString(payload.tenantId, 100) ||
+        !isBoundedString(payload.userId, 200) ||
+        !Number.isSafeInteger(payload.invitedAt) ||
+        !Number.isSafeInteger(payload.issuedAt) ||
+        !Number.isSafeInteger(payload.expiresAt) ||
+        payload.expiresAt <= payload.issuedAt ||
+        payload.expiresAt - payload.issuedAt > ttlSeconds * 1000) {
+        return null;
+    }
+    return payload;
+}
+function isBoundedString(value, max) {
+    return typeof value === 'string' && value.length > 0 && value.length <= max;
+}
+function normalizeCallbackPath(value) {
+    try {
+        const url = new URL(value, 'https://app.invalid');
+        if (url.origin !== 'https://app.invalid' || !url.pathname.startsWith('/'))
+            throw new Error();
+        return url.pathname;
+    }
+    catch {
+        throw new Error('Invitation callback path must be an absolute same-origin path.');
+    }
+}
+//# sourceMappingURL=invites.js.map

package/invites.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invites.js","sourceRoot":"","sources":["../src/invites.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEnE,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAC9B,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,CAAA;AAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAA;AA+E7B;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACjH,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,0BAA0B,CAAA;IACnE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC,CAAA;IACpF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAC5B,QAAQ,CACN,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAC3B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EACf,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,kBAAkB,CAAC,EACzD,EAAE,CACH,CACF,CAAA;IACD,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAA;IAE3F,SAAS,iBAAiB,CAAC,KAAuB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACtD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;YACzC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,EAAE,CAAC;YACH,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,GAAG,CAAC,CAAA;YACrC,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAuB;YAClC,CAAC,EAAE,oBAAoB;YACvB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE;YACpC,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,GAAG,GAAG,UAAU,GAAG,IAAI;SACnC,CAAA;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAC1E,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;IAC5D,CAAC;IAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACtD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,gBAAgB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACzC,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAC3F,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;QACvC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;QAC1C,IAAI,QAAgB,CAAA;QACpB,IAAI,QAAgB,CAAA;QACpB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;YACxB,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACzC,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACzC,CAAC;QACD,IAAI,OAAO,GAA8B,IAAI,CAAA;QAC7C,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QACpG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACzC,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACrD,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACzC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC9B,CAAC;IAED,SAAS,kBAAkB,CAAC,KAAa;QACvC,OAAO,GAAG,YAAY,IAAI,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAA;IACvE,CAAC;IAED,SAAS,0BAA0B,CAAC,WAAoB,EAAE,OAAe;QACvE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QAChE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;YAC7B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;YAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY;gBAAE,OAAO,IAAI,CAAA;YACtF,OAAO,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,UAAU,0BAA0B,CACvC,QAAgB,EAChB,aAAqB;QAErB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAA;QACxC,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,QAAgB,EAChB,aAAqB;QAErB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;QACrF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QACzE,OAAO;YACL,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC;YACpE,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI;YAClC,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI;SACvC,CAAA;IACH,CAAC;IAED,OAAO;QACL,UAAU;QACV,iBAAiB;QACjB,iBAAiB;QACjB,kBAAkB;QAClB,0BAA0B;QAC1B,0BAA0B;QAC1B,oBAAoB;KACrB,CAAA;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,oBAAoB,CAClC,OAA2B,EAC3B,aAAqB,EACrB,MAA2B;IAE3B,IAAI,CAAC,MAAM,IAAI,aAAa,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IACjE,IACE,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY;QAC5C,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;QACpC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAChC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,SAAS,EACjD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,oBAAoB,CAAA;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,WAAW,CAAA;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,YAAY,CAAA;IAC9C,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CAAC,QAAqB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAA;IAC3B,MAAM,UAAU,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAA;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,UAAkB;IACtD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,MAAM,OAAO,GAAG,KAAoC,CAAA;IACpD,IACE,OAAO,CAAC,CAAC,KAAK,oBAAoB;QAClC,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;QAC3C,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;QACvC,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;QACrC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;QACxC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;QACxC,OAAO,CAAC,SAAU,IAAI,OAAO,CAAC,QAAS;QACvC,OAAO,CAAC,SAAU,GAAG,OAAO,CAAC,QAAS,GAAG,UAAU,GAAG,IAAI,EAC1D,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,OAA6B,CAAA;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,GAAW;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAA;AAC7E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAA;QACjD,IAAI,GAAG,CAAC,MAAM,KAAK,qBAAqB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAA;QAC5F,OAAO,GAAG,CAAC,QAAQ,CAAA;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;AACH,CAAC","sourcesContent":["import { createHmac, hkdfSync, timingSafeEqual } from 'node:crypto'\n\nconst INVITE_GRANT_VERSION = 1\nconst DEFAULT_INVITE_TTL_SECONDS = 15 * 60\nconst MAX_GRANT_LENGTH = 4096\n\nexport type InviteGrantInput = {\n  membershipId: string\n  tenantId: string\n  userId: string\n  invitedAt: Date\n}\n\nexport type InviteGrantPayload = {\n  v: typeof INVITE_GRANT_VERSION\n  membershipId: string\n  tenantId: string\n  userId: string\n  invitedAt: number\n  issuedAt: number\n  expiresAt: number\n}\n\nexport type InviteGrantVerification =\n  | { ok: true; payload: InviteGrantPayload }\n  | { ok: false; reason: 'invalid' | 'expired' }\n\nexport type InviteAccessState =\n  | 'active'\n  | 'pending'\n  | 'suspended'\n  | 'tenant_unavailable'\n  | 'unverified'\n  | 'invalid'\n  | 'expired'\n\nexport type InviteRecord = {\n  membershipId: string\n  tenantId: string\n  tenantName: string\n  userId: string\n  invitedAt: Date | null\n  status: 'active' | 'invited' | 'suspended'\n  emailVerified: boolean\n  tenantStatus: 'active' | 'suspended' | 'archived'\n}\n\nexport type InviteInspection = {\n  state: InviteAccessState\n  tenantId: string | null\n  tenantName: string | null\n}\n\nexport type InviteStore = {\n  /** Read-only inspection. This must never activate a membership. */\n  inspect: (membershipId: string) => Promise<InviteRecord | null>\n  /**\n   * Atomically lock, re-evaluate, activate, and audit a pending membership.\n   * The store receives the already signature-verified grant and must return the\n   * final state so concurrent or superseded links cannot double-accept.\n   */\n  accept: (payload: InviteGrantPayload, sessionUserId: string) => Promise<InviteAccessState>\n}\n\nexport type InviteServiceOptions = {\n  secret: string\n  store: InviteStore\n  ttlSeconds?: number\n  /** HKDF domain separation. Change this only when intentionally rotating formats. */\n  signingContext?: string\n  callbackPath?: string\n}\n\nexport type InviteService = {\n  ttlSeconds: number\n  createInviteGrant: (input: InviteGrantInput, now?: number) => string\n  verifyInviteGrant: (raw: string, now?: number) => InviteGrantVerification\n  inviteCallbackPath: (grant: string) => string\n  inviteGrantFromCallbackURL: (callbackURL: unknown, baseURL: string) => string | null\n  acceptInviteAfterMagicLink: (rawGrant: string, sessionUserId: string) => Promise<InviteAccessState>\n  inspectInviteForUser: (rawGrant: string, sessionUserId: string) => Promise<InviteInspection>\n}\n\n/**\n * The complete invitation grant flow extracted from the production runtime.\n * Better Auth's one-time magic-link token proves mailbox possession; this\n * independently signed grant binds that verified callback to exactly one\n * pending membership generation.\n */\nexport function createInviteService(options: InviteServiceOptions): InviteService {\n  if (options.secret.length < 32) throw new Error('Invitation signing secret must contain at least 32 characters.')\n  const ttlSeconds = options.ttlSeconds ?? DEFAULT_INVITE_TTL_SECONDS\n  if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 60) {\n    throw new Error('Invitation TTL must be a whole number of at least 60 seconds.')\n  }\n  const callbackPath = normalizeCallbackPath(options.callbackPath ?? '/invite/accept')\n  const signingKey = Buffer.from(\n    hkdfSync(\n      'sha256',\n      Buffer.from(options.secret),\n      Buffer.alloc(0),\n      Buffer.from(options.signingContext ?? 'appkit.invite.v1'),\n      32,\n    ),\n  )\n  const sign = (payload: string) => createHmac('sha256', signingKey).update(payload).digest()\n\n  function createInviteGrant(input: InviteGrantInput, now = Date.now()): string {\n    if (!Number.isSafeInteger(now) || !Number.isSafeInteger(input.invitedAt.getTime())) {\n      throw new Error('Invalid invitation issuance time.')\n    }\n    for (const [name, value] of Object.entries({\n      membershipId: input.membershipId,\n      tenantId: input.tenantId,\n      userId: input.userId,\n    })) {\n      if (!isBoundedString(value, name === 'userId' ? 200 : 100)) {\n        throw new Error(`Invalid ${name}.`)\n      }\n    }\n    const payload: InviteGrantPayload = {\n      v: INVITE_GRANT_VERSION,\n      membershipId: input.membershipId,\n      tenantId: input.tenantId,\n      userId: input.userId,\n      invitedAt: input.invitedAt.getTime(),\n      issuedAt: now,\n      expiresAt: now + ttlSeconds * 1000,\n    }\n    const encoded = Buffer.from(JSON.stringify(payload)).toString('base64url')\n    return `${encoded}.${sign(encoded).toString('base64url')}`\n  }\n\n  function verifyInviteGrant(raw: string, now = Date.now()): InviteGrantVerification {\n    if (!raw || raw.length > MAX_GRANT_LENGTH || !Number.isSafeInteger(now)) {\n      return { ok: false, reason: 'invalid' }\n    }\n    const separator = raw.lastIndexOf('.')\n    if (separator <= 0 || separator === raw.length - 1) return { ok: false, reason: 'invalid' }\n    const encoded = raw.slice(0, separator)\n    const signature = raw.slice(separator + 1)\n    let expected: Buffer\n    let provided: Buffer\n    try {\n      expected = sign(encoded)\n      provided = Buffer.from(signature, 'base64url')\n    } catch {\n      return { ok: false, reason: 'invalid' }\n    }\n    if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {\n      return { ok: false, reason: 'invalid' }\n    }\n    let payload: InviteGrantPayload | null = null\n    try {\n      payload = parsePayload(JSON.parse(Buffer.from(encoded, 'base64url').toString('utf8')), ttlSeconds)\n    } catch {\n      return { ok: false, reason: 'invalid' }\n    }\n    if (!payload) return { ok: false, reason: 'invalid' }\n    if (now < payload.issuedAt - 60_000 || now > payload.expiresAt) {\n      return { ok: false, reason: 'expired' }\n    }\n    return { ok: true, payload }\n  }\n\n  function inviteCallbackPath(grant: string): string {\n    return `${callbackPath}?${new URLSearchParams({ grant }).toString()}`\n  }\n\n  function inviteGrantFromCallbackURL(callbackURL: unknown, baseURL: string): string | null {\n    if (typeof callbackURL !== 'string' || !callbackURL) return null\n    try {\n      const base = new URL(baseURL)\n      const callback = new URL(callbackURL, base)\n      if (callback.origin !== base.origin || callback.pathname !== callbackPath) return null\n      return callback.searchParams.get('grant')\n    } catch {\n      return null\n    }\n  }\n\n  async function acceptInviteAfterMagicLink(\n    rawGrant: string,\n    sessionUserId: string,\n  ): Promise<InviteAccessState> {\n    const verified = verifyInviteGrant(rawGrant)\n    if (!verified.ok) return verified.reason\n    return options.store.accept(verified.payload, sessionUserId)\n  }\n\n  async function inspectInviteForUser(\n    rawGrant: string,\n    sessionUserId: string,\n  ): Promise<InviteInspection> {\n    const verified = verifyInviteGrant(rawGrant)\n    if (!verified.ok) return { state: verified.reason, tenantId: null, tenantName: null }\n    const record = await options.store.inspect(verified.payload.membershipId)\n    return {\n      state: evaluateInviteAccess(verified.payload, sessionUserId, record),\n      tenantId: record?.tenantId ?? null,\n      tenantName: record?.tenantName ?? null,\n    }\n  }\n\n  return {\n    ttlSeconds,\n    createInviteGrant,\n    verifyInviteGrant,\n    inviteCallbackPath,\n    inviteGrantFromCallbackURL,\n    acceptInviteAfterMagicLink,\n    inspectInviteForUser,\n  }\n}\n\n/** Pure state machine shared by memory and durable stores. */\nexport function evaluateInviteAccess(\n  payload: InviteGrantPayload,\n  sessionUserId: string,\n  record: InviteRecord | null,\n): InviteAccessState {\n  if (!record || sessionUserId !== payload.userId) return 'invalid'\n  if (\n    record.membershipId !== payload.membershipId ||\n    record.tenantId !== payload.tenantId ||\n    record.userId !== payload.userId ||\n    record.invitedAt?.getTime() !== payload.invitedAt\n  ) {\n    return 'invalid'\n  }\n  if (record.tenantStatus !== 'active') return 'tenant_unavailable'\n  if (record.status === 'suspended') return 'suspended'\n  if (record.status === 'active') return 'active'\n  if (!record.emailVerified) return 'unverified'\n  return 'pending'\n}\n\n/** Every resend advances the generation, even within the same clock tick. */\nexport function nextInviteGenerationDate(previous: Date | null, now = new Date()): Date {\n  const nowMs = now.getTime()\n  const previousMs = previous?.getTime() ?? -1\n  if (!Number.isSafeInteger(nowMs) || !Number.isSafeInteger(previousMs)) {\n    throw new Error('Invalid invitation generation time.')\n  }\n  return new Date(Math.max(nowMs, previousMs + 1))\n}\n\nfunction parsePayload(value: unknown, ttlSeconds: number): InviteGrantPayload | null {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return null\n  const payload = value as Partial<InviteGrantPayload>\n  if (\n    payload.v !== INVITE_GRANT_VERSION ||\n    !isBoundedString(payload.membershipId, 100) ||\n    !isBoundedString(payload.tenantId, 100) ||\n    !isBoundedString(payload.userId, 200) ||\n    !Number.isSafeInteger(payload.invitedAt) ||\n    !Number.isSafeInteger(payload.issuedAt) ||\n    !Number.isSafeInteger(payload.expiresAt) ||\n    payload.expiresAt! <= payload.issuedAt! ||\n    payload.expiresAt! - payload.issuedAt! > ttlSeconds * 1000\n  ) {\n    return null\n  }\n  return payload as InviteGrantPayload\n}\n\nfunction isBoundedString(value: unknown, max: number): value is string {\n  return typeof value === 'string' && value.length > 0 && value.length <= max\n}\n\nfunction normalizeCallbackPath(value: string): string {\n  try {\n    const url = new URL(value, 'https://app.invalid')\n    if (url.origin !== 'https://app.invalid' || !url.pathname.startsWith('/')) throw new Error()\n    return url.pathname\n  } catch {\n    throw new Error('Invitation callback path must be an absolute same-origin path.')\n  }\n}\n"]}