@intelligo-dev/auth 1.0.0-beta.1

package/dist/server.js

@@ -0,0 +1,251 @@
+/**
+ * Better-Auth Server Configuration
+ *
+ * Configures authentication with:
+ * - Email + password authentication
+ * - OAuth providers (Google, GitHub) with graceful env var fallback
+ * - Drizzle database adapter
+ * - Session persistence (7-day expiration, 1-day update age)
+ * - Organization plugin for multi-tenant workspace support (Phase 10)
+ * - Email sending via Resend for verification, password reset, welcome (Phase 14)
+ */
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { admin, organization } from "better-auth/plugins";
+import { createAccessControl } from "better-auth/plugins/access";
+import { adminAc, defaultStatements, userAc, } from "better-auth/plugins/admin/access";
+import { PLATFORM_ADMIN_ROLE } from "./roles";
+/**
+ * Access control for the platform role.
+ *
+ * Better-Auth refuses an `adminRoles` entry that no role definition
+ * backs — "Invalid admin roles" at build time — which is the right
+ * behaviour: it stops a typo from silently granting nothing, or a
+ * renamed role from silently granting everything. `platform-admin`
+ * takes the plugin's own admin statements unchanged; the product
+ * defines no extra platform permissions yet.
+ */
+const accessControl = createAccessControl(defaultStatements);
+const platformAdminRole = accessControl.newRole(adminAc.statements);
+const userRole = accessControl.newRole(userAc.statements);
+import { db } from "@intelligo-dev/core/db";
+import { users, sessions, accounts, verifications, organization as organizationTable, member, invitation, } from "@intelligo-dev/core/db/schema";
+import { sendVerifyEmail, sendPasswordResetEmail, sendWelcomeEmail, sendInvitationEmail, } from "@intelligo-dev/core/email";
+import { eq } from "drizzle-orm";
+export const auth = betterAuth({
+    database: drizzleAdapter(db, {
+        provider: "pg",
+        // Map our schema tables to Better-Auth's expected names
+        schema: {
+            user: users,
+            session: sessions,
+            account: accounts,
+            verification: verifications,
+            // Organization plugin tables (Phase 10)
+            organization: organizationTable,
+            member: member,
+            invitation: invitation,
+        },
+    }),
+    baseURL: process.env.NEXT_PUBLIC_APP_URL || "http://localhost:4000",
+    emailAndPassword: {
+        enabled: true,
+        // Only enforce email verification when a real email provider is configured
+        // or in production — otherwise dev users (no RESEND_API_KEY) cannot log in.
+        requireEmailVerification: process.env.NODE_ENV === "production" || !!process.env.RESEND_API_KEY,
+        // Password reset email hook (EMAIL-05)
+        sendResetPassword: async ({ user, url }) => {
+            sendPasswordResetEmail({
+                to: user.email,
+                userName: user.name || user.email,
+                resetUrl: url,
+            }).catch((err) => console.error("[Auth] Failed to send password reset email:", err));
+        },
+    },
+    // Email verification hook (EMAIL-04)
+    emailVerification: {
+        sendVerificationEmail: async ({ user, url }) => {
+            sendVerifyEmail({
+                to: user.email,
+                userName: user.name || user.email,
+                verificationUrl: url,
+            }).catch((err) => console.error("[Auth] Failed to send verification email:", err));
+        },
+        sendOnSignUp: true,
+        autoSignInAfterVerification: true,
+    },
+    socialProviders: {
+        // Google OAuth - only enabled when env vars are configured
+        ...(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET
+            ? {
+                google: {
+                    clientId: process.env.GOOGLE_CLIENT_ID,
+                    clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+                },
+            }
+            : {}),
+        // GitHub OAuth - only enabled when env vars are configured
+        ...(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET
+            ? {
+                github: {
+                    clientId: process.env.GITHUB_CLIENT_ID,
+                    clientSecret: process.env.GITHUB_CLIENT_SECRET,
+                },
+            }
+            : {}),
+    },
+    session: {
+        // Sessions expire after 7 days
+        expiresIn: 60 * 60 * 24 * 7,
+        // Session token updated every 24 hours (extends expiration on active usage)
+        updateAge: 60 * 60 * 24,
+    },
+    trustedOrigins: [process.env.NEXT_PUBLIC_APP_URL || "http://localhost:4000"],
+    // Database hooks for automatic workspace setup (WORK-01)
+    databaseHooks: {
+        user: {
+            create: {
+                after: async (user) => {
+                    // Auto-create personal workspace for new users
+                    try {
+                        const slug = ((user.email || "user").split("@")[0] || "user")
+                            .toLowerCase()
+                            .replace(/[^a-z0-9-]/g, "-")
+                            .slice(0, 30);
+                        await auth.api.createOrganization({
+                            headers: new Headers(),
+                            body: {
+                                name: `${user.name || "User"}'s Workspace`,
+                                slug: `${slug}-${Date.now().toString(36)}`,
+                                userId: user.id, // Associate with the user
+                            },
+                        });
+                    }
+                    catch (error) {
+                        // TR-0024: handle race — if hook fires twice for same signup (two
+                        // concurrent requests), the unique slug constraint catches the dup.
+                        // Check if an org was created despite the error.
+                        if (error instanceof Error &&
+                            (error.message?.includes("duplicate") ||
+                                error.message?.includes("unique") ||
+                                error.message?.includes("slug"))) {
+                            const orgs = await auth.api.listOrganizations({
+                                headers: new Headers(),
+                            });
+                            if (orgs && orgs.length > 0) {
+                                // Org already created by the other hook — not an error.
+                                return;
+                            }
+                        }
+                        // Log for ops visibility; do not throw (user registration succeeded)
+                        console.error("[user.create hook] Failed to create workspace:", error);
+                    }
+                    // Send welcome email (EMAIL-03, fire-and-forget).
+                    // NOTE(DB-12): No retry or outbox — downstream failures silently ignored.
+                    // Acceptable for v0.2; consider transactional outbox for Phase 14.
+                    const dashboardUrl = `${process.env.NEXT_PUBLIC_APP_URL || "http://localhost:4000"}/dashboard`;
+                    sendWelcomeEmail({
+                        to: user.email,
+                        userName: user.name || user.email,
+                        dashboardUrl,
+                    }).catch((err) => console.error("[Auth] Failed to send welcome email:", err));
+                },
+            },
+        },
+        session: {
+            create: {
+                before: async (session) => {
+                    // Check if user is soft-deleted before creating session
+                    try {
+                        const userRecord = await db
+                            .select({ deletedAt: users.deletedAt })
+                            .from(users)
+                            .where(eq(users.id, session.userId))
+                            .limit(1);
+                        if (userRecord[0]?.deletedAt) {
+                            throw new Error("This account has been deleted. Contact support@intelligo.dev to recover your account within 30 days.");
+                        }
+                    }
+                    catch (error) {
+                        console.error("[session.create hook] Deleted user check failed:", error);
+                        throw error; // Re-throw to prevent session creation
+                    }
+                    // Auto-set active organization on session creation
+                    // NOTE(DB-11): Uses new Headers() — bypasses any future middleware
+                    // (bot detection, request signing). Acceptable for v0.2; pass request
+                    // headers through hook context if middleware layering is needed later.
+                    try {
+                        const orgs = await auth.api.listOrganizations({
+                            headers: new Headers(),
+                            query: { userId: session.userId },
+                        });
+                        if (orgs && orgs.length > 0) {
+                            // Auto-set active org on session creation
+                            return {
+                                data: {
+                                    ...session,
+                                    activeOrganizationId: orgs[0].id,
+                                },
+                            };
+                        }
+                    }
+                    catch (error) {
+                        console.error("[session.create hook] Failed to set active org:", error);
+                    }
+                    return { data: session };
+                },
+            },
+        },
+    },
+    plugins: [
+        organization({
+            // Allow all users to create organizations (will be plan-gated in Phase 15)
+            allowUserToCreateOrganization: async () => true,
+            // Generous default limit (will be plan-gated later)
+            organizationLimit: 5,
+            // Creator becomes owner (explicit for clarity)
+            creatorRole: "owner",
+            // Invitation email sending via Resend (EMAIL-06, replaces Phase 10 placeholder)
+            sendInvitationEmail: async (data) => {
+                const appUrl = process.env.NEXT_PUBLIC_APP_URL || "http://localhost:4000";
+                sendInvitationEmail({
+                    to: data.email,
+                    inviterName: data.inviter?.user?.name || "A team member",
+                    workspaceName: data.organization?.name || "a workspace",
+                    role: data.role || "member",
+                    acceptUrl: `${appUrl}/accept-invitation/${data.id}`,
+                    declineUrl: `${appUrl}/invitation/decline?id=${data.id}`,
+                }).catch((err) => console.error("[Auth] Failed to send invitation email:", err));
+            },
+            // Invitations expire after 7 days (matches TEAM-10)
+            invitationExpiresIn: 60 * 60 * 24 * 7,
+        }),
+        /**
+         * Platform administration — enabled only for its impersonation
+         * endpoints, which the operational console uses for support.
+         *
+         * `adminRoles` is deliberately a platform role and not a workspace
+         * one: workspace `owner` is per-tenant and every self-serve signup
+         * owns their own workspace, so gating anything cross-tenant on it
+         * grants it to everybody. `users.role` carries the platform role;
+         * requirePlatformAdmin promotes from PLATFORM_ADMIN_EMAILS into it.
+         *
+         * An impersonation session is capped at 30 minutes. Support work
+         * is measured in minutes, and a session inherited by whoever next
+         * uses that browser is the failure mode worth designing against.
+         *
+         * `allowImpersonatingAdmins` stays false: one platform admin
+         * cannot take over another's account, which is what keeps the
+         * audit trail meaningful.
+         */
+        admin({
+            ac: accessControl,
+            roles: { user: userRole, [PLATFORM_ADMIN_ROLE]: platformAdminRole },
+            defaultRole: "user",
+            adminRoles: [PLATFORM_ADMIN_ROLE],
+            impersonationSessionDuration: 30 * 60,
+            allowImpersonatingAdmins: false,
+        }),
+    ],
+});
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,MAAM,GACP,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAE9C;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AAC7D,MAAM,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC5C,OAAO,EACL,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,YAAY,IAAI,iBAAiB,EACjC,MAAM,EACN,UAAU,GACX,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,MAAM,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC;IAC7B,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE;QAC3B,QAAQ,EAAE,IAAI;QACd,wDAAwD;QACxD,MAAM,EAAE;YACN,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,aAAa;YAC3B,wCAAwC;YACxC,YAAY,EAAE,iBAAiB;YAC/B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,UAAU;SACvB;KACF,CAAC;IAEF,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB;IAEnE,gBAAgB,EAAE;QAChB,OAAO,EAAE,IAAI;QACb,2EAA2E;QAC3E,4EAA4E;QAC5E,wBAAwB,EACtB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc;QACvE,uCAAuC;QACvC,iBAAiB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YACzC,sBAAsB,CAAC;gBACrB,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK;gBACjC,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAClE,CAAC;QACJ,CAAC;KACF;IAED,qCAAqC;IACrC,iBAAiB,EAAE;QACjB,qBAAqB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE;YAC7C,eAAe,CAAC;gBACd,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK;gBACjC,eAAe,EAAE,GAAG;aACrB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAChE,CAAC;QACJ,CAAC;QACD,YAAY,EAAE,IAAI;QAClB,2BAA2B,EAAE,IAAI;KAClC;IAED,eAAe,EAAE;QACf,2DAA2D;QAC3D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAClE,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;oBACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;iBAC/C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QAEP,2DAA2D;QAC3D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;YAClE,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;oBACtC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;iBAC/C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR;IAED,OAAO,EAAE;QACP,+BAA+B;QAC/B,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;QAC3B,4EAA4E;QAC5E,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;KACxB;IAED,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;IAE5E,yDAAyD;IACzD,aAAa,EAAE;QACb,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;oBACpB,+CAA+C;oBAC/C,IAAI,CAAC;wBACH,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;6BAC1D,WAAW,EAAE;6BACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;6BAC3B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAEhB,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;4BAChC,OAAO,EAAE,IAAI,OAAO,EAAE;4BACtB,IAAI,EAAE;gCACJ,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,cAAc;gCAC1C,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;gCAC1C,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,0BAA0B;6BAC5C;yBACF,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,kEAAkE;wBAClE,oEAAoE;wBACpE,iDAAiD;wBACjD,IACE,KAAK,YAAY,KAAK;4BACtB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC;gCACnC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC;gCACjC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,EAClC,CAAC;4BACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;gCAC5C,OAAO,EAAE,IAAI,OAAO,EAAE;6BACvB,CAAC,CAAC;4BACH,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCAC5B,wDAAwD;gCACxD,OAAO;4BACT,CAAC;wBACH,CAAC;wBACD,qEAAqE;wBACrE,OAAO,CAAC,KAAK,CACX,gDAAgD,EAChD,KAAK,CACN,CAAC;oBACJ,CAAC;oBAED,kDAAkD;oBAClD,0EAA0E;oBAC1E,mEAAmE;oBACnE,MAAM,YAAY,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,YAAY,CAAC;oBAC/F,gBAAgB,CAAC;wBACf,EAAE,EAAE,IAAI,CAAC,KAAK;wBACd,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK;wBACjC,YAAY;qBACb,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAC3D,CAAC;gBACJ,CAAC;aACF;SACF;QACD,OAAO,EAAE;YACP,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,OAAO,EAAqC,EAAE;oBAC3D,wDAAwD;oBACxD,IAAI,CAAC;wBACH,MAAM,UAAU,GAAG,MAAM,EAAE;6BACxB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;6BACtC,IAAI,CAAC,KAAK,CAAC;6BACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;6BACnC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAEZ,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;4BAC7B,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,OAAO,CAAC,KAAK,CACX,kDAAkD,EAClD,KAAK,CACN,CAAC;wBACF,MAAM,KAAK,CAAC,CAAC,uCAAuC;oBACtD,CAAC;oBAED,mDAAmD;oBACnD,mEAAmE;oBACnE,sEAAsE;oBACtE,uEAAuE;oBACvE,IAAI,CAAC;wBACH,MAAM,IAAI,GAAQ,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;4BACjD,OAAO,EAAE,IAAI,OAAO,EAAE;4BACtB,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;yBAClC,CAAC,CAAC;wBAEH,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAC5B,0CAA0C;4BAC1C,OAAO;gCACL,IAAI,EAAE;oCACJ,GAAG,OAAO;oCACV,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;iCACjC;6BACF,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,OAAO,CAAC,KAAK,CACX,iDAAiD,EACjD,KAAK,CACN,CAAC;oBACJ,CAAC;oBAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC3B,CAAC;aACF;SACF;KACF;IAED,OAAO,EAAE;QACP,YAAY,CAAC;YACX,2EAA2E;YAC3E,6BAA6B,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;YAC/C,oDAAoD;YACpD,iBAAiB,EAAE,CAAC;YACpB,+CAA+C;YAC/C,WAAW,EAAE,OAAO;YACpB,gFAAgF;YAChF,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClC,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;gBAC7D,mBAAmB,CAAC;oBAClB,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,eAAe;oBACxD,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,aAAa;oBACvD,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ;oBAC3B,SAAS,EAAE,GAAG,MAAM,sBAAsB,IAAI,CAAC,EAAE,EAAE;oBACnD,UAAU,EAAE,GAAG,MAAM,0BAA0B,IAAI,CAAC,EAAE,EAAE;iBACzD,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAC9D,CAAC;YACJ,CAAC;YACD,oDAAoD;YACpD,mBAAmB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;SACtC,CAAC;QACF;;;;;;;;;;;;;;;;;WAiBG;QACH,KAAK,CAAC;YACJ,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,iBAAiB,EAAE;YACnE,WAAW,EAAE,MAAM;YACnB,UAAU,EAAE,CAAC,mBAAmB,CAAC;YACjC,4BAA4B,EAAE,EAAE,GAAG,EAAE;YACrC,wBAAwB,EAAE,KAAK;SAChC,CAAC;KACH;CACF,CAAC,CAAC"}

package/dist/team/errors.js

@@ -0,0 +1,31 @@
+/**
+ * Team service error type.
+ *
+ * The team service (./service.ts) throws this for every failure it
+ * recognizes rather than returning an ad-hoc `{ success, error }`
+ * envelope — that shaping is a transport concern (a Server Action, a
+ * route handler) and belongs one layer up, alongside
+ * revalidatePath/Sentry/toast/i18n, none of which this package may
+ * depend on.
+ */
+export class TeamServiceError extends Error {
+    constructor(code, message, options) {
+        super(message);
+        this.name = "TeamServiceError";
+        this.code = code;
+        this.meta = options?.meta;
+        if (options?.cause !== undefined) {
+            // ES2020 target predates the standard `cause` constructor option;
+            // assign it directly so `instanceof Error` consumers (and Node's
+            // own error inspection) still see it.
+            this.cause = options.cause;
+        }
+        // Restore prototype chain (extending built-ins across some
+        // transpilation targets loses `instanceof`).
+        Object.setPrototypeOf(this, TeamServiceError.prototype);
+    }
+}
+export function isTeamServiceError(error) {
+    return error instanceof TeamServiceError;
+}
+//# sourceMappingURL=errors.js.map

package/dist/team/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/team/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAiCH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAIzC,YACE,IAA0B,EAC1B,OAAe,EACf,OAA0D;QAE1D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;QAC1B,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,kEAAkE;YAClE,iEAAiE;YACjE,sCAAsC;YACrC,IAA4B,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QACtD,CAAC;QAED,2DAA2D;QAC3D,6CAA6C;QAC7C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,KAAK,YAAY,gBAAgB,CAAC;AAC3C,CAAC"}

package/dist/team/schemas.js

@@ -0,0 +1,29 @@
+/**
+ * Team Management Validation Schemas
+ *
+ * Zod schemas for team invite and member management inputs, shared by
+ * the team service and its transports.
+ *
+ * (Ported from the product application’s team validation module — same
+ * semantics. Ignite's copy is retired at cutover.)
+ */
+import { z } from "zod";
+/**
+ * Invite Member Schema
+ * Email + role for inviting new team members
+ */
+export const inviteMemberSchema = z.object({
+    email: z.string().email("Please enter a valid email address"),
+    role: z.enum(["admin", "member"], {
+        required_error: "Please select a role",
+    }),
+});
+/**
+ * Update Role Schema
+ * For changing an existing member's role
+ */
+export const updateRoleSchema = z.object({
+    memberId: z.string().min(1),
+    role: z.enum(["admin", "member"]),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/team/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/team/schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oCAAoC,CAAC;IAC7D,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;QAChC,cAAc,EAAE,sBAAsB;KACvC,CAAC;CACH,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;CAClC,CAAC,CAAC"}