@intelligo-dev/auth 1.0.0-beta.1 → 1.0.0-beta.13

package/dist/workspace/service.js

@@ -1,78 +1,17 @@
 /**
- * Workspace management service — the durable business rules behind
- * workspace listing, creation, switching, editing and deletion,
- * extracted from the product application's workspace actions (page/
- * registry migration, `workspace-settings` family, roadmap item 8).
- *
- * Mirrors `createTeamService(ports)` (./../team/service.ts) one
- * directory over: a factory over optional ports, so this package's
- * allowlisted dependency (`@intelligo-dev/core` only — see
- * tests/architecture/dependency-direction.test.ts) never grows to
- * include billing. A consumer binds that in at its composition root:
- *
- *   const workspaceService = createWorkspaceService({
- *     checkWorkspaceLimit: ...,   // adapts @intelligo-dev/billing's checkPlanLimit
- *   });
- *
- * Authorization (`requireAuth`/`requireWorkspace`/`requireRole`) lives
- * INSIDE each method, not at the transport. Every recognized failure
- * throws `WorkspaceServiceError` with a stable `code` — no
- * revalidatePath/Sentry/next-intl/toast here; that shaping is the
- * transport's job (a Server Action, a route handler).
- *
- * ---------------------------------------------------------------------
- * Why `checkWorkspaceLimit` takes a `userId`, not a `workspaceId`
- * ---------------------------------------------------------------------
- * `createWorkspace` has no workspace to check the plan of yet — it is
- * the thing being created. Ignite's original action worked around this
- * by reading the caller's *existing* workspaces and using the first
- * one's id to look up a plan via `@intelligo-dev/billing`'s
- * `checkPlanLimit(workspaceId, "workspaces", currentCount)`, i.e. it
- * borrowed an arbitrary existing workspace's subscription as a stand-in
- * for "the caller's plan". That borrowing is a binding-layer concern,
- * not a service-layer one: this service only knows the caller's
- * `userId` and how many workspaces they already have. The composition
- * root's binding (`checkWorkspaceLimit`) is where a consumer decides
- * how to resolve "this user's plan" — by reading their first workspace
- * the same way ignite did, or by a real per-user plan lookup if one
- * exists.
- *
- * ---------------------------------------------------------------------
- * The two Better-Auth pitfalls (already solved in ../team/service.ts —
- * copied here rather than re-derived)
- * ---------------------------------------------------------------------
- * 1. Method-name mismatch: the typed `orgApi` wrapper (../org-api.ts)
- *    exists precisely because `auth.api`'s organization-plugin methods
- *    are keyed by their own camelCase *server* id, which does not
- *    always match the HTTP path or the client SDK name. This service
- *    uses `orgApi["/organization/list"]` and
- *    `orgApi["/organization/set-active"]` for the two calls the
- *    wrapper covers, and calls `auth.api.{createOrganization,
- *    updateOrganization, deleteOrganization, getFullOrganization}`
- *    directly for the base organization CRUD surface, which is not
- *    part of `orgApi`'s typed table (the same approach
- *    `../team/service.ts` takes for `getFullOrganization`). Ignite's
- *    original `actions/workspace.ts` already called these four by
- *    their correct `auth.api` names directly (it never went through a
- *    path-keyed cast), so there is no method-name bug to fix here.
- * 2. `sessions.activeOrganizationId` does not exist on this repo's
- *    Drizzle schema. Ignite's original `getActiveWorkspace()` called
- *    `auth.api.getFullOrganization({ headers })` with no
- *    `organizationId` — the exact bug documented in
- *    `../team/service.ts`'s module comment: that resolves to *no*
- *    organization regardless of what the caller most recently
- *    activated. This service's `getActiveWorkspace` instead resolves
- *    the caller's workspace via `requireWorkspace()` first (which has
- *    its own explicit-id fallback) and passes that id explicitly to
- *    `getFullOrganization`.
+ * Workspace listing, creation, switching, editing and deletion. Each method
+ * authorizes itself and throws `WorkspaceServiceError`; the plan limit
+ * arrives as the `checkWorkspaceLimit` port bound at the composition root.
+ * `getFullOrganization` always gets an explicit `organizationId`, because a
+ * bare call resolves to nothing when the session has no active organization.
  */
-import { headers } from "next/headers";
+import { getRequestHeaders } from "@intelligo-dev/core/request-context";
 import { createLogger } from "@intelligo-dev/core/logger";
-import { auth } from "../server";
-import { requireAuth, requireRole, requireWorkspace } from "../helpers";
-import { orgApi } from "../org-api";
-import { createWorkspaceSchema, updateWorkspaceSchema, } from "./schemas";
-import { WorkspaceServiceError, isWorkspaceServiceError } from "./errors";
+import { auth } from "../server.js";
+import { requireAuth, requireRole, requireWorkspace } from "../helpers.js";
+import { orgApi } from "../org-api.js";
+import { createWorkspaceSchema, updateWorkspaceSchema, } from "./schemas.js";
+import { WorkspaceServiceError, isWorkspaceServiceError } from "./errors.js";
 const log = createLogger("WorkspaceService");
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
@@ -138,12 +77,10 @@ export function createWorkspaceService(ports = {}) {
             throw new WorkspaceServiceError("provider_error", `Better-Auth organization API call failed (${context})`, { cause: error });
         }
     }
-    /**
-     * List all workspaces for the current user.
-     */
+    /** Every workspace the current user belongs to. */
     async function listWorkspaces() {
         await callRequireAuth();
-        const hdrs = await headers();
+        const hdrs = await getRequestHeaders();
         const orgs = await callOrgApi("list", () => orgApi["/organization/list"]({ headers: hdrs }));
         return orgs ?? [];
     }
@@ -157,7 +94,7 @@ export function createWorkspaceService(ports = {}) {
     async function createWorkspace(input) {
         const { user } = await callRequireAuth();
         const validated = parseInput(createWorkspaceSchema, input);
-        const hdrs = await headers();
+        const hdrs = await getRequestHeaders();
         const existing = await callOrgApi("list", () => orgApi["/organization/list"]({ headers: hdrs }));
         const existingCount = existing?.length ?? 0;
         if (ports.checkWorkspaceLimit && existingCount > 0) {
@@ -182,27 +119,23 @@ export function createWorkspaceService(ports = {}) {
         }));
         return org;
     }
-    /**
-     * Switch the caller's active workspace.
-     */
+    /** Switch the caller's active workspace. */
     async function switchWorkspace(organizationId) {
         await callRequireAuth();
         if (typeof organizationId !== "string" || organizationId.length === 0) {
             throw new WorkspaceServiceError("invalid_input", "Invalid workspace id");
         }
-        const hdrs = await headers();
+        const hdrs = await getRequestHeaders();
         await callOrgApi("set-active", () => orgApi["/organization/set-active"]({
             headers: hdrs,
             body: { organizationId },
         }));
     }
-    /**
-     * Update workspace settings (name/slug/logo). Owner/admin only.
-     */
+    /** Update workspace settings (name/slug/logo). Owner/admin only. */
     async function updateWorkspace(input) {
         const { workspace } = await callRequireRole(["owner", "admin"]);
         const validated = parseInput(updateWorkspaceSchema, input);
-        const hdrs = await headers();
+        const hdrs = await getRequestHeaders();
         const updateData = {};
         if (validated.name)
             updateData.name = validated.name;
@@ -225,7 +158,15 @@ export function createWorkspaceService(ports = {}) {
      */
     async function deleteWorkspace() {
         const { workspace } = await callRequireRole(["owner"]);
-        const hdrs = await headers();
+        const hdrs = await getRequestHeaders();
+        if (ports.beforeDeleteWorkspace) {
+            try {
+                await ports.beforeDeleteWorkspace(workspace.id);
+            }
+            catch (error) {
+                throw new WorkspaceServiceError("provider_error", `Could not prepare the workspace for deletion: ${errorMessage(error)}`, { cause: error });
+            }
+        }
         await callOrgApi("delete", () => auth.api.deleteOrganization({
             headers: hdrs,
             body: { organizationId: workspace.id },
@@ -239,14 +180,13 @@ export function createWorkspaceService(ports = {}) {
         }
     }
     /**
-     * Get the caller's active workspace, fully resolved. Unlike
-     * ignite's original (see the module doc comment), this resolves the
-     * workspace id explicitly via `requireWorkspace()` rather than
-     * relying on a non-existent `sessions.activeOrganizationId` fallback.
+     * The caller's active workspace, fully resolved. The id comes from
+     * `requireWorkspace()`, which falls back to the first workspace when the
+     * session has none active.
      */
     async function getActiveWorkspace() {
         const { workspace } = await callRequireWorkspace();
-        const hdrs = await headers();
+        const hdrs = await getRequestHeaders();
         const org = (await callOrgApi("getFullOrganization", () => auth.api.getFullOrganization({
             headers: hdrs,
             query: { organizationId: workspace.id },

package/dist/workspace/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/workspace/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,MAAM,EAAoB,MAAM,YAAY,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GAGtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAE1E,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;AA0B7C,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,uBAAuB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,IAAI,qBAAqB,CAAC,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE;QACjE,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAI,MAAkB,EAAE,KAAc;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,qBAAqB,CAC7B,eAAe,EACf,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1D,eAAe,EACjB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,0DAA0D;AAC1D,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAA+B,EAAE;IACtE,KAAK,UAAU,eAAe;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,UAAU,oBAAoB;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,gBAAgB,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,YAAiD;QAEjD,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,EAAoB;QAEpB,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,uBAAuB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAChD,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1E,MAAM,IAAI,qBAAqB,CAC7B,gBAAgB,EAChB,6CAA6C,OAAO,GAAG,EACvD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,cAAc;QAC3B,MAAM,eAAe,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAChD,CAAC;QAEF,OAAO,IAAI,IAAI,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,eAAe,CAC5B,KAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAC7C,MAAM,CAAC,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,aAAa,GAAG,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;QAE5C,IAAI,KAAK,CAAC,mBAAmB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAChD,IAAI,CAAC,EAAE,EACP,aAAa,CACd,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,qBAAqB,CAC7B,yBAAyB,EACzB,0BAA0B,UAAU,CAAC,KAAK,aACxC,UAAU,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAChC,sCAAsC,EACtC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,CACtC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3D,uEAAuE;QACvE,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAEtD,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC3C,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE;SACrC,CAAC,CACH,CAA2B,CAAC;QAE7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,qBAAqB,CAC7B,gBAAgB,EAChB,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,CAAC,YAAY,EAAE,GAAG,EAAE,CAClC,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE;SACjC,CAAC,CACH,CAAC;QAEF,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,eAAe,CAAC,cAAsB;QACnD,MAAM,eAAe,EAAE,CAAC;QAExB,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,qBAAqB,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,UAAU,CAAC,YAAY,EAAE,GAAG,EAAE,CAClC,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,cAAc,EAAE;SACzB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,eAAe,CAC5B,KAA2B;QAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,UAAU,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,UAAU,GAAoD,EAAE,CAAC;QACvE,IAAI,SAAS,CAAC,IAAI;YAAE,UAAU,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QACrD,IAAI,SAAS,CAAC,IAAI;YAAE,UAAU,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QACrD,IAAI,SAAS,CAAC,IAAI;YAAE,UAAU,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QAErD,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC9C,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;SACzD,CAAC,CACH,CAA2B,CAAC;QAE7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,qBAAqB,CAC7B,gBAAgB,EAChB,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,eAAe;QAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC9B,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;SACvC,CAAC,CACH,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAChD,CAAC;QACF,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,UAAU,CAAC,YAAY,EAAE,GAAG,EAAE,CAClC,MAAM,CAAC,0BAA0B,CAAC,CAAC;gBACjC,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE;aACtC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,kBAAkB;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;QAE7B,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,qBAAqB,EAAE,GAAG,EAAE,CACxD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;SACxC,CAAC,CACH,CAA2B,CAAC;QAE7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,cAAc;QACd,eAAe;QACf,eAAe;QACf,eAAe;QACf,eAAe;QACf,kBAAkB;KACnB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/workspace/service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAExE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,MAAM,EAAoB,MAAM,YAAY,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GAGtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAE1E,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;AA8B7C,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,uBAAuB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,IAAI,qBAAqB,CAAC,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE;QACjE,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAI,MAAkB,EAAE,KAAc;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,qBAAqB,CAC7B,eAAe,EACf,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1D,eAAe,EACjB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,0DAA0D;AAC1D,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAA+B,EAAE;IACtE,KAAK,UAAU,eAAe;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,UAAU,oBAAoB;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,gBAAgB,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,YAAiD;QAEjD,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,EAAoB;QAEpB,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,uBAAuB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAChD,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1E,MAAM,IAAI,qBAAqB,CAC7B,gBAAgB,EAChB,6CAA6C,OAAO,GAAG,EACvD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,KAAK,UAAU,cAAc;QAC3B,MAAM,eAAe,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAEvC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAChD,CAAC;QAEF,OAAO,IAAI,IAAI,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,eAAe,CAC5B,KAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAEvC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAC7C,MAAM,CAAC,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAChD,CAAC;QACF,MAAM,aAAa,GAAG,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;QAE5C,IAAI,KAAK,CAAC,mBAAmB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAChD,IAAI,CAAC,EAAE,EACP,aAAa,CACd,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,qBAAqB,CAC7B,yBAAyB,EACzB,0BAA0B,UAAU,CAAC,KAAK,aACxC,UAAU,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAChC,sCAAsC,EACtC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,CACtC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3D,uEAAuE;QACvE,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAEtD,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC3C,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE;SACrC,CAAC,CACH,CAA2B,CAAC;QAE7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,qBAAqB,CAC7B,gBAAgB,EAChB,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,CAAC,YAAY,EAAE,GAAG,EAAE,CAClC,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE;SACjC,CAAC,CACH,CAAC;QAEF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,4CAA4C;IAC5C,KAAK,UAAU,eAAe,CAAC,cAAsB;QACnD,MAAM,eAAe,EAAE,CAAC;QAExB,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,qBAAqB,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAEvC,MAAM,UAAU,CAAC,YAAY,EAAE,GAAG,EAAE,CAClC,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,cAAc,EAAE;SACzB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,KAAK,UAAU,eAAe,CAC5B,KAA2B;QAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,UAAU,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAEvC,MAAM,UAAU,GAAoD,EAAE,CAAC;QACvE,IAAI,SAAS,CAAC,IAAI;YAAE,UAAU,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QACrD,IAAI,SAAS,CAAC,IAAI;YAAE,UAAU,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QACrD,IAAI,SAAS,CAAC,IAAI;YAAE,UAAU,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;QAErD,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC9C,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;SACzD,CAAC,CACH,CAA2B,CAAC;QAE7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,qBAAqB,CAC7B,gBAAgB,EAChB,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,eAAe;QAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAEvC,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,qBAAqB,CAC7B,gBAAgB,EAChB,iDAAiD,YAAY,CAAC,KAAK,CAAC,EAAE,EACtE,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC9B,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;SACvC,CAAC,CACH,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CACzC,MAAM,CAAC,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAChD,CAAC;QACF,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,UAAU,CAAC,YAAY,EAAE,GAAG,EAAE,CAClC,MAAM,CAAC,0BAA0B,CAAC,CAAC;gBACjC,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE;aACtC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,kBAAkB;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAEvC,MAAM,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,qBAAqB,EAAE,GAAG,EAAE,CACxD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;SACxC,CAAC,CACH,CAA2B,CAAC;QAE7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,cAAc;QACd,eAAe;QACf,eAAe;QACf,eAAe;QACf,eAAe;QACf,kBAAkB;KACnB,CAAC;AACJ,CAAC"}

package/dist/workspace-bootstrap.js

@@ -0,0 +1,33 @@
+/**
+ * What runs once a user's personal workspace exists: trial credits, a
+ * welcome note, a referral bonus. The product decides, so auth takes it
+ * as a handler set from the composition root and never imports billing.
+ *
+ * The workspace is created by the `user.create` hook at signup, or by
+ * `ensureUserWorkspace` when that hook did not get to it; both call the
+ * handler, for the one workspace each of them created.
+ */
+import { createLogger } from "@intelligo-dev/core/logger";
+import { createRegistryRef } from "@intelligo-dev/core/registry";
+const log = createLogger("WorkspaceBootstrap");
+const handler = createRegistryRef("auth/workspace-created", null);
+/** Set from the composition root; the last call wins. */
+export function setWorkspaceCreatedHandler(next) {
+    handler.set(next);
+}
+export function clearWorkspaceCreatedHandler() {
+    handler.set(null);
+}
+/**
+ * Runs the handler without waiting for it: a failed bootstrap is
+ * logged and never fails the signup that created the workspace.
+ */
+export function workspaceCreated(created, run = handler.get()) {
+    if (!run)
+        return;
+    run(created).catch((error) => log.error("Workspace bootstrap failed", {
+        workspaceId: created.workspaceId,
+        error: error instanceof Error ? error.message : String(error),
+    }));
+}
+//# sourceMappingURL=workspace-bootstrap.js.map

package/dist/workspace-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-bootstrap.js","sourceRoot":"","sources":["../src/workspace-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;AAY/C,MAAM,OAAO,GAAG,iBAAiB,CAC/B,wBAAwB,EACxB,IAAI,CACL,CAAC;AAEF,yDAAyD;AACzD,MAAM,UAAU,0BAA0B,CACxC,IAA6B;IAE7B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAyB,EACzB,MAAsC,OAAO,CAAC,GAAG,EAAE;IAEnD,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,GAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC9D,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/workspace-init.js

@@ -1,51 +1,45 @@
 /**
- * Workspace Initialization
- *
- * Ensures every authenticated user has at least one workspace.
- * Called from the (app) layout to guarantee workspace exists.
- * Idempotent - safe to call on every page load.
- *
- * Pattern: "Belt-and-suspenders" approach consistent with Phase 9.
- * Better-Auth doesn't provide a reliable hook for post-signup workspace creation,
- * so we check + create on every authenticated page load.
- *
- * Dependency Inversion (Phase 42, PKG-01 preparation):
- * Post-creation logic (e.g., trial provisioning) is injected via callback,
- * so this module has ZERO billing imports. The actual billing call lives
- * in the consumer application's authenticated layout, which already
- * imports billing.
- * This breaks the auth → billing circular dependency before Phase 43 extraction.
+ * Ensures every authenticated user has a workspace; called from the
+ * authenticated layout on every render. Post-creation work (trial
+ * provisioning) is the handler set with `setWorkspaceCreatedHandler`,
+ * so auth never imports billing.
  */
-import { auth } from "./server";
+import { auth } from "./server.js";
 import { createLogger } from "@intelligo-dev/core/logger";
+import { personalWorkspaceSlug } from "./workspace-slug.js";
+import { workspaceCreated, } from "./workspace-bootstrap.js";
 const log = createLogger("WorkspaceInit");
 /**
- * Ensure user has at least one workspace (WORK-01).
+ * Ensure the user has at least one workspace.
  *
- * If user has organizations, sets the first as active. If none exist,
- * creates a personal workspace — this serves as a fallback in case the
- * user.create hook (server.ts databaseHooks) hasn't completed yet, and
- * also handles users created via non-Better-Auth flows (e.g. admin panel).
- *
- * Idempotent - safe to call repeatedly. Returns quickly if workspace exists.
+ * If the session already has a valid active workspace, returns it
+ * untouched; otherwise sets the first workspace as active. If none
+ * exist, creates a personal workspace, in case the user.create hook has not
+ * completed yet or the user was created outside Better-Auth. Idempotent.
  *
  * @param user - Authenticated user from session
  * @param headers - Request headers (required for Better-Auth API)
- * @param options.onWorkspaceCreated - Optional callback invoked after a new workspace is created.
- *   Receives workspaceId and email. Failure does NOT block workspace creation (same fire-and-forget
- *   behavior as the previous inline trial provisioning call).
+ * @param options.onWorkspaceCreated - Runs after this call creates a workspace, in place of
+ *   the handler set with `setWorkspaceCreatedHandler`. Fire-and-forget: a failure is logged,
+ *   never thrown.
  * @returns The organization ID that was set as active (useful for immediate access before session updates)
  */
 export async function ensureUserWorkspace(user, headers, options) {
     log.info("Starting workspace check", { email: user.email });
-    // Check if user has any organizations
     const orgs = await auth.api.listOrganizations({
         headers,
     });
     log.info("Found organizations", { count: orgs?.length ?? 0 });
     if (orgs && orgs.length > 0 && orgs[0]) {
-        log.debug("User has workspaces, setting first as active");
-        // User has workspaces - ensure one is active
+        // Keep a workspace the user switched to while they are still a
+        // member; resetting to orgs[0] would undo every switch on re-render.
+        const current = await auth.api.getSession({ headers });
+        const active = current?.session?.activeOrganizationId;
+        if (active && orgs.some((org) => org.id === active)) {
+            log.debug("Active workspace still valid, keeping it", { orgId: active });
+            return active;
+        }
+        log.debug("No valid active workspace, setting first as active");
         try {
             await auth.api.setActiveOrganization({
                 headers,
@@ -61,25 +55,20 @@ export async function ensureUserWorkspace(user, headers, options) {
         }
         return orgs[0].id;
     }
-    // TR-DB03 fix: No organizations found — the user.create hook may not have
-    // completed yet, or user was created via a non-Better-Auth flow.
-    // Create the workspace here as a fallback rather than throwing.
-    // Idempotent: the unique constraint on organization.slug prevents duplicates
-    // if both this fallback and the hook fire for the same signup.
+    // No workspace yet: create one. The unique index on organization.slug
+    // prevents duplicates when the hook or a concurrent request also creates
+    // it, because `personalWorkspaceSlug` is derived from the user; the loser
+    // takes the adopt-the-winner path below.
     log.warn("No workspace found, creating one (hook may still fire)", {
         email: user.email,
     });
-    const slug = ((user.email || "user").split("@")[0] || "user")
-        .toLowerCase()
-        .replace(/[^a-z0-9-]/g, "-")
-        .slice(0, 30);
     let workspaceId;
     try {
         const result = await auth.api.createOrganization({
             headers,
             body: {
                 name: `${user.name || "User"}'s Workspace`,
-                slug: `${slug}-${Date.now().toString(36)}`,
+                slug: personalWorkspaceSlug(user.email, user.id),
                 userId: user.id,
             },
         });
@@ -90,9 +79,8 @@ export async function ensureUserWorkspace(user, headers, options) {
         log.info("Created fallback workspace", { workspaceId });
     }
     catch (error) {
-        // If creation failed because the unique constraint was hit (hook already
-        // created), the error message contains the duplicate key info.
-        // List orgs again — if one now exists, use it.
+        // A concurrent creator may have won the unique index; if a workspace
+        // now exists, use it.
         const orgsAfter = await auth.api.listOrganizations({ headers });
         if (orgsAfter && orgsAfter.length > 0 && orgsAfter[0]) {
             log.info("Workspace created concurrently by hook, using it");
@@ -102,20 +90,27 @@ export async function ensureUserWorkspace(user, headers, options) {
             });
             return orgsAfter[0].id;
         }
-        // Genuine failure
         log.error("Failed to create fallback workspace", {
             error: error instanceof Error ? error.message : String(error),
         });
         throw error;
     }
-    // Fire the optional callback (trial credits, referral tracking, etc.)
-    if (options?.onWorkspaceCreated) {
-        options
-            .onWorkspaceCreated({ workspaceId, email: user.email })
-            .catch((err) => log.error("onWorkspaceCreated callback failed", {
-            error: err instanceof Error ? err.message : String(err),
-        }));
+    // Point the session at the new workspace, or later requests that resolve
+    // one from the session alone find none. Not fatal (the next request sets
+    // it), so a failure is logged rather than thrown.
+    try {
+        await auth.api.setActiveOrganization({
+            headers,
+            body: { organizationId: workspaceId },
+        });
+        log.info("Set new workspace active", { workspaceId });
+    }
+    catch (error) {
+        log.error("Failed to set the new workspace active", {
+            error: error instanceof Error ? error.message : String(error),
+        });
     }
+    workspaceCreated({ workspaceId, userId: user.id, email: user.email }, options?.onWorkspaceCreated);
     return workspaceId;
 }
 //# sourceMappingURL=workspace-init.js.map

package/dist/workspace-init.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-init.js","sourceRoot":"","sources":["../src/workspace-init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAU,EACV,OAAgB,EAChB,OAKC;IAED,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAE5D,sCAAsC;IACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,OAAO;KACR,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IAE9D,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC1D,6CAA6C;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBACnC,OAAO;gBACP,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;aACrC,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE;gBAC7C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpB,CAAC;IAED,0EAA0E;IAC1E,iEAAiE;IACjE,gEAAgE;IAChE,6EAA6E;IAC7E,+DAA+D;IAC/D,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE;QACjE,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;SAC1D,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC/C,OAAO;YACP,IAAI,EAAE;gBACJ,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,cAAc;gBAC1C,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;gBAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;aAChB;SACF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,+DAA+D;QAC/D,+CAA+C;QAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBACnC,OAAO;gBACP,IAAI,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,CAAC;QACD,kBAAkB;QAClB,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE;YAC/C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,IAAI,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAChC,OAAO;aACJ,kBAAkB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;aACtD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACb,GAAG,CAAC,KAAK,CAAC,oCAAoC,EAAE;YAC9C,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CACH,CAAC;IACN,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"workspace-init.js","sourceRoot":"","sources":["../src/workspace-init.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EACL,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAU,EACV,OAAgB,EAChB,OAEC;IAED,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,OAAO;KACR,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IAE9D,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,+DAA+D;QAC/D,qEAAqE;QACrE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,MAAM,MAAM,GACV,OAAO,EAAE,OACV,EAAE,oBAAoB,CAAC;QACxB,IAAI,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACzE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,GAAG,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBACnC,OAAO;gBACP,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;aACrC,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE;gBAC7C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpB,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,0EAA0E;IAC1E,yCAAyC;IACzC,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE;QACjE,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IAEH,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC/C,OAAO;YACP,IAAI,EAAE;gBACJ,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,cAAc;gBAC1C,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,EAAE,IAAI,CAAC,EAAE;aAChB;SACF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qEAAqE;QACrE,sBAAsB;QACtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChE,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC;gBACnC,OAAO;gBACP,IAAI,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE;YAC/C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACnC,OAAO;YACP,IAAI,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;SACtC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,wCAAwC,EAAE;YAClD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CACd,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EACnD,OAAO,EAAE,kBAAkB,CAC5B,CAAC;IAEF,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/workspace-slug.js

@@ -0,0 +1,29 @@
+/**
+ * The slug an auto-provisioned personal workspace gets.
+ *
+ * Deterministic on purpose. Two paths provision a first workspace —
+ * the `user.create` hook in `server.ts` and the layout's
+ * `ensureUserWorkspace` fallback — and several requests can reach the
+ * fallback at once, because the `(app)` layout re-renders for every
+ * request that enters the group (the document, each prefetched sibling
+ * route, an error-boundary retry).
+ *
+ * A slug derived from the user makes `organization.slug`'s unique index
+ * the arbiter: the first caller wins, every other one gets
+ * `ORGANIZATION_ALREADY_EXISTS` and adopts the winner's workspace. A
+ * per-attempt suffix would let each racer create a workspace of its own.
+ *
+ * Only the automatic personal workspace is named this way; a workspace
+ * someone creates by hand names itself.
+ */
+export function personalWorkspaceSlug(email, userId) {
+    const base = ((email || "user").split("@")[0] || "user").slice(0, 30);
+    // The id fragment is normalised with the rest: Better-Auth ids are
+    // mixed-case, and a slug the workspace settings form refuses
+    // (`[a-z0-9-]+`) makes the personal workspace impossible to rename.
+    return toSlug(`${base}-${userId.slice(0, 8)}`);
+}
+function toSlug(value) {
+    return value.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+}
+//# sourceMappingURL=workspace-slug.js.map

package/dist/workspace-slug.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-slug.js","sourceRoot":"","sources":["../src/workspace-slug.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAgC,EAChC,MAAc;IAEd,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtE,mEAAmE;IACnE,6DAA6D;IAC7D,oEAAoE;IACpE,OAAO,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC"}

package/package.json

@@ -1,15 +1,28 @@
 {
   "name": "@intelligo-dev/auth",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.13",
+  "description": "Multi-tenant authentication on Better-Auth: sign-up, workspaces, invitations and role-based access control.",
+  "keywords": [
+    "intelligo",
+    "ai-saas",
+    "saas",
+    "typescript",
+    "authentication",
+    "better-auth",
+    "multi-tenant",
+    "rbac",
+    "workspaces"
+  ],
   "license": "Apache-2.0",
+  "author": "Turtuvshin Byambaa <toroo.byamba@gmail.com>",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/intelligo-mn/framework.git",
+    "url": "git+https://github.com/intelligo-dev/intelligo.git",
     "directory": "packages/auth"
   },
-  "homepage": "https://github.com/intelligo-mn/framework#readme",
+  "homepage": "https://intelligo.dev/docs/packages/auth",
   "bugs": {
-    "url": "https://github.com/intelligo-mn/framework/issues"
+    "url": "https://github.com/intelligo-dev/intelligo/issues"
   },
   "type": "module",
   "exports": {
@@ -27,32 +40,41 @@
     }
   },
   "dependencies": {
-    "better-auth": "~1.6.30",
-    "drizzle-orm": "^0.45.1",
     "server-only": "^0.0.1",
-    "zod": "^3.24.1",
-    "@intelligo-dev/core": "1.0.0-beta.1"
+    "@intelligo-dev/core": "1.0.0-beta.13"
   },
   "peerDependencies": {
-    "next": "^15.0.0 || ^16.0.0"
+    "better-auth": "~1.6.30",
+    "drizzle-orm": "^0.45.1",
+    "zod": "^3.25.76 || ^4.0.0"
   },
   "devDependencies": {
-    "@types/react": "^19.0.10",
-    "next": "^16.0.7",
-    "typescript": "^5.7.2"
+    "@types/react": "19.2.18",
+    "better-auth": "~1.6.33",
+    "drizzle-orm": "^0.45.2",
+    "typescript": "^5.9.3",
+    "zod": "^4.6.5"
   },
   "files": [
     "dist",
     "src",
     "!src/**/*.test.ts",
-    "!src/**/*.test.tsx"
+    "!src/**/*.test.tsx",
+    "!src/**/__tests__/**",
+    "LICENSE",
+    "NOTICE",
+    "README.md",
+    "!dist/**/*.tsbuildinfo"
   ],
   "publishConfig": {
     "access": "public"
   },
+  "engines": {
+    "node": ">=22.14"
+  },
   "scripts": {
     "type-check": "tsc --noEmit",
     "lint": "eslint .",
-    "build": "tsc -p tsconfig.build.json"
+    "build": "tsc -p tsconfig.build.json && node ../../scripts/fix-esm-extensions.mjs dist"
   }
 }

package/src/client.ts

@@ -1,27 +1,17 @@
 /**
- * Better-Auth Client
- *
- * Client-side authentication utilities for React components.
- * This module uses "better-auth/react" which is a client-side module.
- *
- * IMPORTANT: Only import this in "use client" components.
- * For server-side auth, use @intelligo-dev/auth (server.ts)
+ * The Better-Auth React client. Import only from "use client" components;
+ * server code uses `@intelligo-dev/auth`.
  */
 
 import { createAuthClient } from "better-auth/react";
 import { organizationClient } from "better-auth/client/plugins";
 
-// No `baseURL`: the client and the Better-Auth server always live on the
-// same origin (this app's own `/api/auth/*` routes), so Better-Auth's
-// client defaults to `window.location.origin` and every request is
-// same-origin. Do not reintroduce an absolute `NEXT_PUBLIC_APP_URL`
-// baseURL here — the dev port has drifted before (3000 -> 3001 -> 4000)
-// and an absolute cross-origin URL is blocked by the app's CSP
-// (`connect-src 'self'`) whenever it doesn't match the port the app is
-// actually served on.
+// No `baseURL`: the client and server share an origin (`/api/auth/*`), so
+// Better-Auth defaults to `window.location.origin`. An absolute URL is
+// blocked by the app's CSP (`connect-src 'self'`) whenever its port differs
+// from the one the app is served on.
 export const authClient = createAuthClient({
   plugins: [organizationClient()],
 });
 
-// Export commonly used hooks and methods for convenience
 export const { useSession, signIn, signUp, signOut } = authClient;