@brightweblabs/module-orgs 0.6.2 → 0.7.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@brightweblabs/module-orgs",
   "private": false,
-  "version": "0.6.2",
+  "version": "0.7.0",
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "files": [
@@ -26,7 +26,7 @@
     "lucide-react": "^1.26.0",
     "server-only": "^0.0.1",
     "@brightweblabs/app-shell": "0.16.0",
-    "@brightweblabs/core-auth": "0.11.0",
+    "@brightweblabs/core-auth": "0.12.0",
     "@brightweblabs/infra": "0.7.0",
     "@brightweblabs/ui": "1.5.4"
   },

package/src/data.ts

@@ -289,6 +289,25 @@ export async function setOrganizationMemberRole(
   return data as OrganizationMember;
 }
 
+export async function syncOrganizationPrimaryContactFromAdmins(
+  supabase: SupabaseClient,
+  organizationId: string,
+): Promise<void> {
+  const { data, error } = await supabase
+    .from("organization_members")
+    .select("profile_id")
+    .eq("organization_id", organizationId)
+    .eq("role", "admin")
+    .order("joined_at", { ascending: true })
+    .limit(1);
+  if (error) throw new Error(error.message);
+  const { error: updateError } = await supabase
+    .from("organizations")
+    .update({ primary_contact_id: typeof data?.[0]?.profile_id === "string" ? data[0].profile_id : null })
+    .eq("id", organizationId);
+  if (updateError) throw new Error(updateError.message);
+}
+
 async function requireSafeOrganizationMemberMutation(
   supabase: SupabaseClient,
   organizationId: string,
@@ -305,21 +324,6 @@ async function requireSafeOrganizationMemberMutation(
   return member;
 }
 
-async function assertOrganizationKeepsAdmin(
-  supabase: SupabaseClient,
-  organizationId: string,
-  member: OrganizationMember,
-): Promise<void> {
-  if (member.role !== "admin") return;
-  const { count, error } = await supabase
-    .from("organization_members")
-    .select("id", { count: "exact", head: true })
-    .eq("organization_id", organizationId)
-    .eq("role", "admin");
-  if (error) throw new Error(error.message);
-  if ((count ?? 0) <= 1) throw new Error("A organização deve manter pelo menos um Administrador.");
-}
-
 export async function updateOrganizationMemberRole(
   supabase: SupabaseClient,
   organizationId: string,
@@ -328,8 +332,11 @@ export async function updateOrganizationMemberRole(
 ): Promise<OrganizationMember> {
   const member = await requireSafeOrganizationMemberMutation(supabase, organizationId, profileId);
   if (member.role === role) return member;
-  if (role === "member") await assertOrganizationKeepsAdmin(supabase, organizationId, member);
-  return setOrganizationMemberRole(supabase, organizationId, profileId, role);
+  const updated = await setOrganizationMemberRole(supabase, organizationId, profileId, role);
+  if (member.role === "admin" || role === "admin") {
+    await syncOrganizationPrimaryContactFromAdmins(supabase, organizationId);
+  }
+  return updated;
 }
 
 export async function removeOrganizationMember(
@@ -338,11 +345,11 @@ export async function removeOrganizationMember(
   profileId: string,
 ): Promise<void> {
   const member = await requireSafeOrganizationMemberMutation(supabase, organizationId, profileId);
-  await assertOrganizationKeepsAdmin(supabase, organizationId, member);
   const { error } = await supabase
     .from("organization_members")
     .delete()
     .eq("organization_id", organizationId)
     .eq("profile_id", profileId);
   if (error) throw new Error(error.message);
+  if (member.role === "admin") await syncOrganizationPrimaryContactFromAdmins(supabase, organizationId);
 }

package/src/handlers.ts

@@ -11,10 +11,13 @@ import {
   logOrganizationActivity,
   listOrganizationInvitations,
   listOrganizationMemberViews,
+  resendOrganizationInvitation,
   revokeOrganizationInvitation,
+  type EnsureCrmContact,
 } from "./invitations";
 import {
   createOrganizationInvitationDeleteHandler,
+  createOrganizationInvitationResendHandler,
   createOrganizationDeleteHandler,
   createOrganizationInvitationsHandler,
   createOrganizationMemberMutationHandlers,
@@ -22,40 +25,56 @@ import {
   createOrganizationsPostHandler,
 } from "./http";
 
-const writeDependencies = {
-  getCreateAccess: requireOrganizationsStaffAccess,
-  getManageAccess: requireOrganizationManageAccess,
-  createOrganization,
-  updateOrganization,
-  deleteOrganization,
-  inviteMembers: inviteOrganizationMembers,
-  logActivity: logOrganizationActivity,
-};
-
-const invitationDependencies = {
-  getManageAccess: requireOrganizationManageAccess,
-  inviteMembers: inviteOrganizationMembers,
-  listInvitations: listOrganizationInvitations,
-  listMembers: listOrganizationMemberViews,
-  revokeInvitation: revokeOrganizationInvitation,
-  logActivity: logOrganizationActivity,
-};
-
-export const handleOrganizationsPostRequest = createOrganizationsPostHandler(writeDependencies);
-export const handleOrganizationPatchRequest = createOrganizationPatchHandler(writeDependencies);
-export const handleOrganizationDeleteRequest = createOrganizationDeleteHandler(writeDependencies);
-
-const invitationHandlers = createOrganizationInvitationsHandler(invitationDependencies);
-export const handleOrganizationInvitationsGetRequest = invitationHandlers.GET;
-export const handleOrganizationInvitationsPostRequest = invitationHandlers.POST;
-export const handleOrganizationInvitationDeleteRequest =
-  createOrganizationInvitationDeleteHandler(invitationDependencies);
+export function createOrganizationRequestHandlers(options?: { ensureCrmContactForProfile?: EnsureCrmContact }) {
+  const inviteMembers: typeof inviteOrganizationMembers = (supabase, organizationId, invites, actorProfileId) =>
+    inviteOrganizationMembers(supabase, organizationId, invites, actorProfileId, {
+      ensureCrmContactForProfile: options?.ensureCrmContactForProfile,
+    });
+  const writeDependencies = {
+    getCreateAccess: requireOrganizationsStaffAccess,
+    getManageAccess: requireOrganizationManageAccess,
+    createOrganization,
+    updateOrganization,
+    deleteOrganization,
+    inviteMembers,
+    logActivity: logOrganizationActivity,
+  };
+  const invitationDependencies = {
+    getManageAccess: requireOrganizationManageAccess,
+    inviteMembers,
+    listInvitations: listOrganizationInvitations,
+    listMembers: listOrganizationMemberViews,
+    revokeInvitation: revokeOrganizationInvitation,
+    resendInvitation: resendOrganizationInvitation,
+    logActivity: logOrganizationActivity,
+  };
+  const invitationHandlers = createOrganizationInvitationsHandler(invitationDependencies);
+  const memberMutationHandlers = createOrganizationMemberMutationHandlers({
+    getManageAccess: requireOrganizationManageAccess,
+    updateMemberRole: updateOrganizationMemberRole,
+    removeMember: removeOrganizationMember,
+    logActivity: logOrganizationActivity,
+  });
+  return {
+    organizationsPost: createOrganizationsPostHandler(writeDependencies),
+    organizationPatch: createOrganizationPatchHandler(writeDependencies),
+    organizationDelete: createOrganizationDeleteHandler(writeDependencies),
+    invitationsGet: invitationHandlers.GET,
+    invitationsPost: invitationHandlers.POST,
+    invitationDelete: createOrganizationInvitationDeleteHandler(invitationDependencies),
+    invitationResend: createOrganizationInvitationResendHandler(invitationDependencies),
+    memberPatch: memberMutationHandlers.PATCH,
+    memberDelete: memberMutationHandlers.DELETE,
+  };
+}
 
-const memberMutationHandlers = createOrganizationMemberMutationHandlers({
-  getManageAccess: requireOrganizationManageAccess,
-  updateMemberRole: updateOrganizationMemberRole,
-  removeMember: removeOrganizationMember,
-  logActivity: logOrganizationActivity,
-});
-export const handleOrganizationMemberPatchRequest = memberMutationHandlers.PATCH;
-export const handleOrganizationMemberDeleteRequest = memberMutationHandlers.DELETE;
+const handlers = createOrganizationRequestHandlers();
+export const handleOrganizationsPostRequest = handlers.organizationsPost;
+export const handleOrganizationPatchRequest = handlers.organizationPatch;
+export const handleOrganizationDeleteRequest = handlers.organizationDelete;
+export const handleOrganizationInvitationsGetRequest = handlers.invitationsGet;
+export const handleOrganizationInvitationsPostRequest = handlers.invitationsPost;
+export const handleOrganizationInvitationDeleteRequest = handlers.invitationDelete;
+export const handleOrganizationInvitationResendRequest = handlers.invitationResend;
+export const handleOrganizationMemberPatchRequest = handlers.memberPatch;
+export const handleOrganizationMemberDeleteRequest = handlers.memberDelete;

package/src/http.ts

@@ -6,6 +6,7 @@ import type {
   logOrganizationActivity,
   listOrganizationInvitations,
   listOrganizationMemberViews,
+  resendOrganizationInvitation,
   revokeOrganizationInvitation,
 } from "./invitations";
 
@@ -36,6 +37,7 @@ type OrganizationInvitationDependencies = {
   listInvitations: typeof listOrganizationInvitations;
   listMembers: typeof listOrganizationMemberViews;
   revokeInvitation: typeof revokeOrganizationInvitation;
+  resendInvitation: typeof resendOrganizationInvitation;
   logActivity: typeof logOrganizationActivity;
 };
 
@@ -90,9 +92,10 @@ function organizationError(error: unknown): Response {
   if (message === "Convite pendente não encontrado.") {
     return json({ error: message }, { status: 404 });
   }
-  if (message.startsWith("Não foi possível enviar o email de convite.")) {
+  if (message.startsWith("Não foi possível enviar o email de convite.") || message.startsWith("Não foi possível reenviar o email de convite.")) {
     return json({ error: message }, { status: 502 });
   }
+  if (message === "Este convite expirou.") return json({ error: message }, { status: 410 });
   return json({ error: message || "Erro interno do servidor." }, { status: 500 });
 }
 
@@ -120,10 +123,13 @@ export function createOrganizationsPostHandler(dependencies: OrganizationWriteDe
         payload: {
           organization_id: organization.id,
           pending_invitations: result.summary.pendingInvitations,
+          duplicate_pending_invitations: result.summary.duplicatePendingInvitations,
           direct_assignments: result.summary.directAssignments,
+          failed_email_deliveries: result.summary.failedEmailDeliveries,
+          failed_api_operations: result.summary.failedApiOperations,
         },
       });
-      return json({ data: { organization, invitations: result.invitations, inviteSummary: result.summary } }, { status: 201 });
+      return json({ data: { organization, invitations: result.invitations, outcomes: result.outcomes, inviteSummary: result.summary } }, { status: 201 });
     } catch (error) {
       return organizationError(error);
     }
@@ -161,9 +167,12 @@ export function createOrganizationPatchHandler(dependencies: OrganizationWriteDe
           pending_invitations: result.summary.pendingInvitations,
           direct_assignments: result.summary.directAssignments,
           updated_existing_members: result.summary.updatedExistingMembers,
+          duplicate_pending_invitations: result.summary.duplicatePendingInvitations,
+          failed_email_deliveries: result.summary.failedEmailDeliveries,
+          failed_api_operations: result.summary.failedApiOperations,
         },
       });
-      return json({ data: { organization, invitations: result.invitations, inviteSummary: result.summary } });
+      return json({ data: { organization, invitations: result.invitations, outcomes: result.outcomes, inviteSummary: result.summary } });
     } catch (error) {
       return organizationError(error);
     }
@@ -245,9 +254,12 @@ export function createOrganizationInvitationsHandler(dependencies: OrganizationI
             pending_invitations: result.summary.pendingInvitations,
             direct_assignments: result.summary.directAssignments,
             updated_existing_members: result.summary.updatedExistingMembers,
+            duplicate_pending_invitations: result.summary.duplicatePendingInvitations,
+            failed_email_deliveries: result.summary.failedEmailDeliveries,
+            failed_api_operations: result.summary.failedApiOperations,
           },
         });
-        return json({ data: { invitations: result.invitations, inviteSummary: result.summary } }, { status: 201 });
+        return json({ data: { invitations: result.invitations, outcomes: result.outcomes, inviteSummary: result.summary } }, { status: 201 });
       } catch (error) {
         return organizationError(error);
       }
@@ -337,3 +349,28 @@ export function createOrganizationInvitationDeleteHandler(dependencies: Organiza
     }
   };
 }
+
+export function createOrganizationInvitationResendHandler(dependencies: OrganizationInvitationDependencies) {
+  return async function handleOrganizationInvitationResendRequest(
+    _request: Request,
+    context: { params: Promise<{ id: string; invitationId: string }> },
+  ): Promise<Response> {
+    const { id, invitationId } = await context.params;
+    if (!id || !invitationId) return json({ error: "id e invitationId são obrigatórios." }, { status: 400 });
+    const access = await dependencies.getManageAccess(id);
+    if (!access.ok) return json({ error: access.error }, { status: access.status });
+    try {
+      const invitation = await dependencies.resendInvitation(access.serviceSupabase, id, invitationId);
+      await dependencies.logActivity(access.serviceSupabase, {
+        actorProfileId: access.profileId,
+        organizationId: id,
+        eventType: "crm_organization_invitation_resent",
+        summary: "Convite da organização CRM reenviado.",
+        payload: { organization_id: id, invitation_id: invitationId },
+      });
+      return json({ data: { invitation } });
+    } catch (error) {
+      return organizationError(error);
+    }
+  };
+}

package/src/index.ts

@@ -7,6 +7,7 @@ export {
   listOrganizations,
   removeOrganizationMember,
   setOrganizationMemberRole,
+  syncOrganizationPrimaryContactFromAdmins,
   updateOrganizationMemberRole,
   updateOrganization,
   type CreateOrganizationInput,
@@ -19,7 +20,9 @@ export {
   type UpdateOrganizationInput,
 } from "./data";
 export {
+  createOrganizationRequestHandlers,
   handleOrganizationInvitationDeleteRequest,
+  handleOrganizationInvitationResendRequest,
   handleOrganizationDeleteRequest,
   handleOrganizationInvitationsGetRequest,
   handleOrganizationInvitationsPostRequest,
@@ -37,11 +40,15 @@ export {
   listOrganizationMemberViews,
   logOrganizationActivity,
   registerUserFromOrganizationInvitation,
+  resendOrganizationInvitation,
   revokeOrganizationInvitation,
   type EnsureCrmContact,
+  type SendOrganizationInvite,
   type OrganizationInvitation,
   type OrganizationInvitationDetails,
   type OrganizationInviteDraft,
+  type OrganizationInviteOutcome,
+  type OrganizationInviteOutcomeStatus,
   type OrganizationInviteSummary,
   type OrganizationMemberView,
 } from "./invitations";

package/src/invitations.ts

@@ -1,5 +1,5 @@
 import type { SupabaseClient } from "@supabase/supabase-js";
-import type { OrganizationMemberRole } from "./data";
+import { syncOrganizationPrimaryContactFromAdmins, type OrganizationMemberRole } from "./data";
 import { sendOrganizationInviteEmail } from "./invite-email";
 
 const INVITE_EXPIRY_DAYS = 14;
@@ -38,10 +38,32 @@ export type OrganizationInvitationDetails = {
 
 export type OrganizationInviteSummary = {
   pendingInvitations: number;
+  duplicatePendingInvitations: number;
   directAssignments: number;
   updatedExistingMembers: number;
   unchangedExistingMembers: number;
   failedEmailDeliveries: number;
+  failedContactLinks: number;
+  failedApiOperations: number;
+};
+
+export type OrganizationInviteOutcomeStatus =
+  | "immediate_access"
+  | "membership_updated"
+  | "already_member"
+  | "pending_invitation"
+  | "duplicate_pending"
+  | "email_failed"
+  | "api_failed";
+
+export type OrganizationInviteOutcome = {
+  email: string;
+  role: OrganizationMemberRole;
+  status: OrganizationInviteOutcomeStatus;
+  profileId?: string;
+  invitationId?: string;
+  message?: string;
+  failureKind?: "crm_link" | "membership" | "invitation";
 };
 
 export type OrganizationMemberView = {
@@ -58,6 +80,8 @@ export type EnsureCrmContact = (
   options: { source: string; organizationId?: string | null; serviceClient: SupabaseClient },
 ) => Promise<{ success: boolean; contactId?: string; error?: string }>;
 
+export type SendOrganizationInvite = typeof sendOrganizationInviteEmail;
+
 export async function logOrganizationActivity(
   supabase: SupabaseClient,
   input: {
@@ -89,14 +113,16 @@ function normalizeStatus(value: unknown): OrganizationInvitation["status"] {
 }
 
 function normalizeInvitation(raw: Record<string, unknown>): OrganizationInvitation {
+  const expiresAt = String(raw.expires_at);
+  const storedStatus = normalizeStatus(raw.status);
   return {
     id: String(raw.id),
     organizationId: String(raw.organization_id),
     email: typeof raw.invited_email === "string" ? normalizeEmail(raw.invited_email) : "",
     role: raw.role === "admin" ? "admin" : "member",
-    status: normalizeStatus(raw.status),
+    status: storedStatus === "pending" && isInvitationExpired(expiresAt) ? "expired" : storedStatus,
     createdAt: String(raw.created_at),
-    expiresAt: String(raw.expires_at),
+    expiresAt,
     invitedByProfileId: typeof raw.invited_by_profile_id === "string" ? raw.invited_by_profile_id : null,
     acceptedAt: typeof raw.accepted_at === "string" ? raw.accepted_at : null,
     acceptedByProfileId: typeof raw.accepted_by_profile_id === "string" ? raw.accepted_by_profile_id : null,
@@ -115,25 +141,6 @@ function isExistingAccountError(error: { message?: string } | null): boolean {
   return message.includes("already") || message.includes("exists") || message.includes("registered");
 }
 
-async function syncOrganizationPrimaryContactFromAdmins(
-  supabase: SupabaseClient,
-  organizationId: string,
-): Promise<void> {
-  const { data, error } = await supabase
-    .from("organization_members")
-    .select("profile_id")
-    .eq("organization_id", organizationId)
-    .eq("role", "admin")
-    .order("joined_at", { ascending: true })
-    .limit(1);
-  if (error) throw new Error(error.message);
-  const { error: updateError } = await supabase
-    .from("organizations")
-    .update({ primary_contact_id: typeof data?.[0]?.profile_id === "string" ? data[0].profile_id : null })
-    .eq("id", organizationId);
-  if (updateError) throw new Error(updateError.message);
-}
-
 async function findAuthUserIdByEmail(supabase: SupabaseClient, email: string): Promise<string | null> {
   const target = normalizeEmail(email);
   const perPage = 1000;
@@ -254,24 +261,33 @@ export async function inviteOrganizationMembers(
   organizationId: string,
   invites: OrganizationInviteDraft[],
   actorProfileId: string,
-): Promise<{ invitations: OrganizationInvitation[]; summary: OrganizationInviteSummary }> {
+  options?: {
+    ensureCrmContactForProfile?: EnsureCrmContact;
+    sendInviteEmail?: SendOrganizationInvite;
+  },
+): Promise<{ invitations: OrganizationInvitation[]; outcomes: OrganizationInviteOutcome[]; summary: OrganizationInviteSummary }> {
   const normalized = dedupeInviteDrafts(invites);
   const emptySummary = {
     pendingInvitations: 0,
+    duplicatePendingInvitations: 0,
     directAssignments: 0,
     updatedExistingMembers: 0,
     unchangedExistingMembers: 0,
     failedEmailDeliveries: 0,
+    failedContactLinks: 0,
+    failedApiOperations: 0,
   };
-  if (normalized.length === 0) return { invitations: [], summary: emptySummary };
+  if (normalized.length === 0) return { invitations: [], outcomes: [], summary: emptySummary };
 
   const emails = normalized.map((invite) => invite.email);
-  const [{ data: existingMembers, error: memberError }, { data: profiles, error: profileError }] = await Promise.all([
+  const [{ data: existingMembers, error: memberError }, { data: profiles, error: profileError }, { data: existingInvitations, error: invitationError }] = await Promise.all([
     supabase.from("organization_members").select("profile_id, role, profile:profiles!organization_members_profile_id_fkey(email)").eq("organization_id", organizationId),
     supabase.from("profiles").select("id, email").in("email", emails),
+    supabase.from("organization_invitations").select("id, invited_email, role, status, expires_at").eq("organization_id", organizationId).in("invited_email", emails),
   ]);
   if (memberError) throw new Error(memberError.message);
   if (profileError) throw new Error(profileError.message);
+  if (invitationError) throw new Error(invitationError.message);
   const { data: organization, error: organizationError } = await supabase
     .from("organizations")
     .select("name")
@@ -294,23 +310,64 @@ export async function inviteOrganizationMembers(
       profileByEmail.set(normalizeEmail(profile.email), profile.id);
     }
   }
+  const pendingInvitationByEmail = new Map<string, { id: string; role: OrganizationMemberRole }>();
+  for (const invitation of existingInvitations ?? []) {
+    if (
+      invitation.status !== "pending"
+      || typeof invitation.id !== "string"
+      || typeof invitation.invited_email !== "string"
+      || isInvitationExpired(String(invitation.expires_at))
+    ) continue;
+    pendingInvitationByEmail.set(normalizeEmail(invitation.invited_email), {
+      id: invitation.id,
+      role: invitation.role === "admin" ? "admin" : "member",
+    });
+  }
 
   const pendingRows: Array<Record<string, unknown>> = [];
   const resolvedProfilesByEmail = new Map<string, string>();
+  const outcomes: OrganizationInviteOutcome[] = [];
   let directAssignments = 0;
   let updatedExistingMembers = 0;
   let unchangedExistingMembers = 0;
   for (const invite of normalized) {
     const member = memberByEmail.get(invite.email);
     if (member) {
-      resolvedProfilesByEmail.set(invite.email, member.profileId);
-      if (member.role === invite.role) unchangedExistingMembers += 1;
+      if (member.role === invite.role) {
+        if (options?.ensureCrmContactForProfile) {
+          const linked = await options.ensureCrmContactForProfile(member.profileId, {
+            source: "organization_member_direct_access", organizationId, serviceClient: supabase,
+          });
+          if (!linked.success) {
+            outcomes.push({ email: invite.email, role: invite.role, status: "api_failed", profileId: member.profileId, message: "Não foi possível ligar o contacto CRM.", failureKind: "crm_link" });
+            continue;
+          }
+        }
+        unchangedExistingMembers += 1;
+        outcomes.push({ email: invite.email, role: invite.role, status: "already_member", profileId: member.profileId });
+      }
       else {
         const { error } = await supabase.from("organization_members").update({ role: invite.role })
           .eq("organization_id", organizationId).eq("profile_id", member.profileId);
-        if (error) throw new Error(error.message);
+        if (error) {
+          outcomes.push({ email: invite.email, role: invite.role, status: "api_failed", profileId: member.profileId, message: "Não foi possível atualizar a função do membro.", failureKind: "membership" });
+          continue;
+        }
+        if (options?.ensureCrmContactForProfile) {
+          const linked = await options.ensureCrmContactForProfile(member.profileId, {
+            source: "organization_member_direct_access", organizationId, serviceClient: supabase,
+          });
+          if (!linked.success) {
+            const { error: rollbackError } = await supabase.from("organization_members").update({ role: member.role })
+              .eq("organization_id", organizationId).eq("profile_id", member.profileId);
+            outcomes.push({ email: invite.email, role: invite.role, status: "api_failed", profileId: member.profileId, message: rollbackError ? "Não foi possível ligar o contacto CRM nem reverter a alteração de função; é necessária reconciliação." : "Não foi possível ligar o contacto CRM; a alteração de função foi revertida.", failureKind: "crm_link" });
+            continue;
+          }
+        }
         updatedExistingMembers += 1;
+        outcomes.push({ email: invite.email, role: invite.role, status: "membership_updated", profileId: member.profileId });
       }
+      resolvedProfilesByEmail.set(invite.email, member.profileId);
       continue;
     }
     const profileId = profileByEmail.get(invite.email);
@@ -320,9 +377,29 @@ export async function inviteOrganizationMembers(
         profile_id: profileId,
         role: invite.role,
       }, { onConflict: "organization_id,profile_id" });
-      if (error) throw new Error(error.message);
+      if (error) {
+        outcomes.push({ email: invite.email, role: invite.role, status: "api_failed", profileId, message: "Não foi possível conceder o acesso à organização.", failureKind: "membership" });
+        continue;
+      }
+      if (options?.ensureCrmContactForProfile) {
+        const linked = await options.ensureCrmContactForProfile(profileId, {
+          source: "organization_member_direct_access", organizationId, serviceClient: supabase,
+        });
+        if (!linked.success) {
+          const { error: rollbackError } = await supabase.from("organization_members").delete()
+            .eq("organization_id", organizationId).eq("profile_id", profileId);
+          outcomes.push({ email: invite.email, role: invite.role, status: "api_failed", profileId, message: rollbackError ? "Não foi possível ligar o contacto CRM nem reverter o acesso; é necessária reconciliação." : "Não foi possível ligar o contacto CRM; o acesso não foi mantido.", failureKind: "crm_link" });
+          continue;
+        }
+      }
       resolvedProfilesByEmail.set(invite.email, profileId);
       directAssignments += 1;
+      outcomes.push({ email: invite.email, role: invite.role, status: "immediate_access", profileId });
+      continue;
+    }
+    const pendingInvitation = pendingInvitationByEmail.get(invite.email);
+    if (pendingInvitation) {
+      outcomes.push({ email: invite.email, role: pendingInvitation.role, status: "duplicate_pending", invitationId: pendingInvitation.id });
       continue;
     }
     pendingRows.push({
@@ -340,7 +417,7 @@ export async function inviteOrganizationMembers(
   }
 
   if (directAssignments > 0 || updatedExistingMembers > 0) {
-    await syncOrganizationPrimaryContactFromAdmins(supabase, organizationId);
+    try { await syncOrganizationPrimaryContactFromAdmins(supabase, organizationId); } catch { /* Retry on the next idempotent member operation. */ }
   }
   if (resolvedProfilesByEmail.size > 0) {
     const acceptedAt = new Date().toISOString();
@@ -350,7 +427,8 @@ export async function inviteOrganizationMembers(
         accepted_at: acceptedAt,
         accepted_by_profile_id: profileId,
       }).eq("organization_id", organizationId).eq("invited_email", email).eq("status", "pending");
-      if (error) throw new Error(error.message);
+      // Access is already effective. Leave a pending row for the next idempotent call to reconcile.
+      if (error) return;
     }));
   }
   if (pendingRows.length > 0) {
@@ -358,17 +436,29 @@ export async function inviteOrganizationMembers(
       onConflict: "organization_id,invited_email",
       ignoreDuplicates: false,
     });
-    if (error) throw new Error(error.message);
-    const { data: inserted, error: selectError } = await supabase
+    if (error) {
+      outcomes.push(...pendingRows.map((row) => ({
+        email: String(row.invited_email), role: row.role === "admin" ? "admin" as const : "member" as const,
+        status: "api_failed" as const, message: "Não foi possível criar o convite.", failureKind: "invitation" as const,
+      })));
+    }
+    const { data: inserted, error: selectError } = error ? { data: [], error: null } : await supabase
       .from("organization_invitations")
       .select("id, invited_email, role, expires_at")
       .eq("organization_id", organizationId)
       .in("invited_email", pendingRows.map((row) => String(row.invited_email)))
       .eq("status", "pending");
-    if (selectError) throw new Error(selectError.message);
+    if (selectError) {
+      outcomes.push(...pendingRows.map((row) => ({
+        email: String(row.invited_email), role: row.role === "admin" ? "admin" as const : "member" as const,
+        status: "api_failed" as const, message: "Não foi possível confirmar o convite criado.", failureKind: "invitation" as const,
+      })));
+    }
     const deliveries = await Promise.all((inserted ?? []).map(async (invitation) => ({
       id: String(invitation.id),
-      delivered: await sendOrganizationInviteEmail({
+      email: normalizeEmail(String(invitation.invited_email)),
+      role: invitation.role === "admin" ? "admin" as const : "member" as const,
+      delivered: await (options?.sendInviteEmail ?? sendOrganizationInviteEmail)({
         invitationId: String(invitation.id),
         organizationName,
         invitedEmail: String(invitation.invited_email),
@@ -383,23 +473,86 @@ export async function inviteOrganizationMembers(
         .delete()
         .in("id", failedIds)
         .eq("status", "pending");
-      if (deleteError) throw new Error(deleteError.message);
-      throw new Error(ORGANIZATION_INVITE_EMAIL_DELIVERY_ERROR);
+      // Preserve the email failure outcome. A remaining row is safe to revoke/retry and stays visible as pending.
+      void deleteError;
+    }
+    for (const delivery of deliveries) {
+      outcomes.push({
+        email: delivery.email,
+        role: delivery.role,
+        status: delivery.delivered ? "pending_invitation" : "email_failed",
+        invitationId: delivery.delivered ? delivery.id : undefined,
+        message: delivery.delivered ? undefined : ORGANIZATION_INVITE_EMAIL_DELIVERY_ERROR,
+      });
     }
   }
 
+  const failedEmailDeliveries = outcomes.filter((outcome) => outcome.status === "email_failed").length;
+  const failedContactLinks = outcomes.filter((outcome) => outcome.status === "api_failed" && outcome.failureKind === "crm_link").length;
+  const failedApiOperations = outcomes.filter((outcome) => outcome.status === "api_failed").length;
+  let invitations: OrganizationInvitation[] = [];
+  try {
+    invitations = await listOrganizationInvitations(supabase, organizationId, { status: "pending" });
+  } catch (error) {
+    console.error("[organizations.invite-members.refresh]", error);
+  }
+
   return {
-    invitations: await listOrganizationInvitations(supabase, organizationId, { status: "pending" }),
+    invitations,
+    outcomes,
     summary: {
-      pendingInvitations: pendingRows.length,
+      pendingInvitations: outcomes.filter((outcome) => outcome.status === "pending_invitation").length,
+      duplicatePendingInvitations: outcomes.filter((outcome) => outcome.status === "duplicate_pending").length,
       directAssignments,
       updatedExistingMembers,
       unchangedExistingMembers,
-      failedEmailDeliveries: 0,
+      failedEmailDeliveries,
+      failedContactLinks,
+      failedApiOperations,
     },
   };
 }
 
+export async function resendOrganizationInvitation(
+  supabase: SupabaseClient,
+  organizationId: string,
+  invitationId: string,
+  options?: { sendInviteEmail?: SendOrganizationInvite },
+): Promise<OrganizationInvitation> {
+  const { data, error } = await supabase
+    .from("organization_invitations")
+    .select("id, organization_id, invited_email, role, status, invited_by_profile_id, accepted_at, accepted_by_profile_id, accepted_contact_id, revoked_at, expires_at, created_at, organizations(name)")
+    .eq("id", invitationId)
+    .eq("organization_id", organizationId)
+    .maybeSingle();
+  if (error) throw new Error(error.message);
+  if (!data || data.status !== "pending") throw new Error("Convite pendente não encontrado.");
+  if (isInvitationExpired(String(data.expires_at))) {
+    const { error: expireError } = await supabase
+      .from("organization_invitations")
+      .update({ status: "expired" })
+      .eq("id", invitationId)
+      .eq("status", "pending");
+    if (expireError) throw new Error(expireError.message);
+    throw new Error("Este convite expirou.");
+  }
+  const organizationRaw = Array.isArray(data.organizations) ? data.organizations[0] ?? null : data.organizations;
+  const organizationName = organizationRaw && typeof organizationRaw === "object" && typeof organizationRaw.name === "string"
+    ? organizationRaw.name
+    : "Organização";
+  const delivered = await (options?.sendInviteEmail ?? sendOrganizationInviteEmail)({
+    invitationId,
+    organizationName,
+    invitedEmail: String(data.invited_email),
+    role: data.role === "admin" ? "admin" : "member",
+    expiresAt: String(data.expires_at),
+  });
+  if (!delivered) {
+    throw new Error("Não foi possível reenviar o email de convite. O convite pendente foi mantido.");
+  }
+  return normalizeInvitation(data as Record<string, unknown>);
+}
+
 export async function revokeOrganizationInvitation(
   supabase: SupabaseClient,
   organizationId: string,