@meetreeve/module-team 0.0.0-stage → 0.1.0

package/dist/index.d.mts

@@ -0,0 +1,104 @@
+/**
+ * Roles the org-members router knows. `billing_manager` is a legacy alias
+ * the backend still accepts; no surface offers it from the invite dialog.
+ * Rows may still carry a role this union doesn't name, so row fields are
+ * typed `string` and the panel renders unknown roles verbatim.
+ */
+type TeamRole = "owner" | "admin" | "billing_manager" | "member" | "viewer";
+/** A role the invite dialog and the role picker can hand out (never `owner`). */
+type AssignableRole = Exclude<TeamRole, "owner" | "billing_manager">;
+/** One live member of the org (`OrganizationMember` row). `GET /api/org/members`. */
+interface TeamMember {
+    /** OrganizationMember.id — the id every member route takes. */
+    id: string;
+    user_id: string;
+    email: string | null;
+    role: string;
+    is_default: boolean;
+    /** ISO-8601. */
+    created_at: string;
+}
+/** One invitation record. `GET /api/org/invitations`. */
+interface Invitation {
+    id: string;
+    email: string;
+    role: string;
+    invited_by_email: string | null;
+    /** pending | accepted | expired | revoked */
+    status: string;
+    /** ISO-8601. */
+    created_at: string;
+    /** ISO-8601. */
+    expires_at: string;
+    accepted_at: string | null;
+}
+/** `POST /api/org/invite`. */
+interface InviteMemberResponse {
+    message: string;
+    email: string;
+    role: string;
+    invitation_id?: string;
+}
+/**
+ * The data-access boundary the panel is built against. Every method takes
+ * the org it acts on: there is no ambient "current org" anywhere in this
+ * package, so a request can never be issued for an org other than the one
+ * the caller named (DEV-8592). `createTeamClient` is the reference
+ * implementation; a host may supply its own.
+ */
+interface TeamClient {
+    listMembers(orgId: string): Promise<TeamMember[]>;
+    updateMemberRole(orgId: string, memberId: string, role: string): Promise<void>;
+    removeMember(orgId: string, memberId: string): Promise<void>;
+    inviteMember(orgId: string, email: string, role: string): Promise<InviteMemberResponse>;
+    listInvitations(orgId: string): Promise<Invitation[]>;
+    revokeInvitation(orgId: string, invitationId: string): Promise<void>;
+    resendInvitation(orgId: string, invitationId: string): Promise<void>;
+}
+
+/**
+ * Framework-agnostic Reeve.Team client (DEV-9998, C2 of epic DEV-9983).
+ *
+ * The server-safe half: no React, no Next.js. The only import is type-only,
+ * erased at build time.
+ *
+ * Contract: reeve-services' org-members router, ported route-for-route from
+ * reeve-frontend's `src/lib/api/team.ts`:
+ *
+ *   GET    /api/org/members                      -> TeamMember[]
+ *   PUT    /api/org/members/{id}/role   {role}   -> 2xx
+ *   DELETE /api/org/members/{id}                 -> 2xx
+ *   POST   /api/org/invite        {email, role}  -> InviteMemberResponse
+ *   GET    /api/org/invitations                  -> Invitation[]
+ *   DELETE /api/org/invitations/{id}             -> 2xx
+ *   POST   /api/org/invitations/{id}/resend      -> 2xx (resets the 7-day expiry)
+ *
+ * Transport is the HOST's: `createTeamClient({ fetch })` takes a JSON
+ * fetcher (reeve-frontend passes `productFetch`, which owns auth, 401
+ * refresh and timeouts). The org is never ambient. Every method takes the
+ * org it acts on and stamps it as `X-Reeve-Org-Id`, the header the backend's
+ * tenant resolver reads, so a request is keyed on the org its caller named
+ * rather than on whatever org a global pin held when it went out (DEV-8592).
+ */
+
+/** The request header the backend tenant resolver reads the org assertion from. */
+declare const ORG_HEADER = "X-Reeve-Org-Id";
+/** What the client hands the host fetcher. `path` is relative to the API origin. */
+type TeamRequestInit = {
+    method: "GET" | "POST" | "PUT" | "DELETE";
+    headers: Record<string, string>;
+    /** JSON-encoded, present only on requests that carry a body. */
+    body?: string;
+};
+/**
+ * A host-supplied JSON fetcher: resolve with the parsed response body (any
+ * value for an empty 2xx), reject on a non-2xx. reeve-frontend's
+ * `productFetch` has exactly this shape.
+ */
+type TeamFetch = (path: string, init: TeamRequestInit) => Promise<unknown>;
+type TeamClientOptions = {
+    fetch: TeamFetch;
+};
+declare function createTeamClient({ fetch }: TeamClientOptions): TeamClient;
+
+export { type AssignableRole, type Invitation, type InviteMemberResponse, ORG_HEADER, type TeamClient, type TeamClientOptions, type TeamFetch, type TeamMember, type TeamRequestInit, type TeamRole, createTeamClient };

package/dist/index.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Roles the org-members router knows. `billing_manager` is a legacy alias
+ * the backend still accepts; no surface offers it from the invite dialog.
+ * Rows may still carry a role this union doesn't name, so row fields are
+ * typed `string` and the panel renders unknown roles verbatim.
+ */
+type TeamRole = "owner" | "admin" | "billing_manager" | "member" | "viewer";
+/** A role the invite dialog and the role picker can hand out (never `owner`). */
+type AssignableRole = Exclude<TeamRole, "owner" | "billing_manager">;
+/** One live member of the org (`OrganizationMember` row). `GET /api/org/members`. */
+interface TeamMember {
+    /** OrganizationMember.id — the id every member route takes. */
+    id: string;
+    user_id: string;
+    email: string | null;
+    role: string;
+    is_default: boolean;
+    /** ISO-8601. */
+    created_at: string;
+}
+/** One invitation record. `GET /api/org/invitations`. */
+interface Invitation {
+    id: string;
+    email: string;
+    role: string;
+    invited_by_email: string | null;
+    /** pending | accepted | expired | revoked */
+    status: string;
+    /** ISO-8601. */
+    created_at: string;
+    /** ISO-8601. */
+    expires_at: string;
+    accepted_at: string | null;
+}
+/** `POST /api/org/invite`. */
+interface InviteMemberResponse {
+    message: string;
+    email: string;
+    role: string;
+    invitation_id?: string;
+}
+/**
+ * The data-access boundary the panel is built against. Every method takes
+ * the org it acts on: there is no ambient "current org" anywhere in this
+ * package, so a request can never be issued for an org other than the one
+ * the caller named (DEV-8592). `createTeamClient` is the reference
+ * implementation; a host may supply its own.
+ */
+interface TeamClient {
+    listMembers(orgId: string): Promise<TeamMember[]>;
+    updateMemberRole(orgId: string, memberId: string, role: string): Promise<void>;
+    removeMember(orgId: string, memberId: string): Promise<void>;
+    inviteMember(orgId: string, email: string, role: string): Promise<InviteMemberResponse>;
+    listInvitations(orgId: string): Promise<Invitation[]>;
+    revokeInvitation(orgId: string, invitationId: string): Promise<void>;
+    resendInvitation(orgId: string, invitationId: string): Promise<void>;
+}
+
+/**
+ * Framework-agnostic Reeve.Team client (DEV-9998, C2 of epic DEV-9983).
+ *
+ * The server-safe half: no React, no Next.js. The only import is type-only,
+ * erased at build time.
+ *
+ * Contract: reeve-services' org-members router, ported route-for-route from
+ * reeve-frontend's `src/lib/api/team.ts`:
+ *
+ *   GET    /api/org/members                      -> TeamMember[]
+ *   PUT    /api/org/members/{id}/role   {role}   -> 2xx
+ *   DELETE /api/org/members/{id}                 -> 2xx
+ *   POST   /api/org/invite        {email, role}  -> InviteMemberResponse
+ *   GET    /api/org/invitations                  -> Invitation[]
+ *   DELETE /api/org/invitations/{id}             -> 2xx
+ *   POST   /api/org/invitations/{id}/resend      -> 2xx (resets the 7-day expiry)
+ *
+ * Transport is the HOST's: `createTeamClient({ fetch })` takes a JSON
+ * fetcher (reeve-frontend passes `productFetch`, which owns auth, 401
+ * refresh and timeouts). The org is never ambient. Every method takes the
+ * org it acts on and stamps it as `X-Reeve-Org-Id`, the header the backend's
+ * tenant resolver reads, so a request is keyed on the org its caller named
+ * rather than on whatever org a global pin held when it went out (DEV-8592).
+ */
+
+/** The request header the backend tenant resolver reads the org assertion from. */
+declare const ORG_HEADER = "X-Reeve-Org-Id";
+/** What the client hands the host fetcher. `path` is relative to the API origin. */
+type TeamRequestInit = {
+    method: "GET" | "POST" | "PUT" | "DELETE";
+    headers: Record<string, string>;
+    /** JSON-encoded, present only on requests that carry a body. */
+    body?: string;
+};
+/**
+ * A host-supplied JSON fetcher: resolve with the parsed response body (any
+ * value for an empty 2xx), reject on a non-2xx. reeve-frontend's
+ * `productFetch` has exactly this shape.
+ */
+type TeamFetch = (path: string, init: TeamRequestInit) => Promise<unknown>;
+type TeamClientOptions = {
+    fetch: TeamFetch;
+};
+declare function createTeamClient({ fetch }: TeamClientOptions): TeamClient;
+
+export { type AssignableRole, type Invitation, type InviteMemberResponse, ORG_HEADER, type TeamClient, type TeamClientOptions, type TeamFetch, type TeamMember, type TeamRequestInit, type TeamRole, createTeamClient };

package/dist/index.js

@@ -0,0 +1,100 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  ORG_HEADER: () => ORG_HEADER,
+  createTeamClient: () => createTeamClient
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/client.ts
+var ORG_HEADER = "X-Reeve-Org-Id";
+var ORG_ID_SHAPE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+function orgHeaders(orgId) {
+  if (typeof orgId !== "string" || !ORG_ID_SHAPE.test(orgId)) {
+    throw new Error(`orgId must be a plausible org id, got ${JSON.stringify(orgId)}`);
+  }
+  return { [ORG_HEADER]: orgId };
+}
+function segment(value, name) {
+  if (typeof value !== "string" || value === "") {
+    throw new Error(`${name} must be a non-empty string`);
+  }
+  return encodeURIComponent(value);
+}
+function hasStringId(row) {
+  return typeof row === "object" && row !== null && typeof row.id === "string" && row.id !== "";
+}
+function rows(data, what) {
+  if (!Array.isArray(data) || !data.every(hasStringId)) {
+    throw new Error(`team: malformed ${what} response`);
+  }
+  return data;
+}
+function createTeamClient({ fetch }) {
+  if (typeof fetch !== "function") {
+    throw new Error("createTeamClient: `fetch` must be a function");
+  }
+  const send = (orgId, method, path, body) => {
+    const headers = orgHeaders(orgId);
+    const init = { method, headers };
+    if (body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      init.body = JSON.stringify(body);
+    }
+    return fetch(path, init);
+  };
+  return {
+    listMembers: (orgId) => send(orgId, "GET", "/api/org/members").then((d) => rows(d, "members")),
+    updateMemberRole: (orgId, memberId, role) => {
+      segment(role, "role");
+      return send(orgId, "PUT", `/api/org/members/${segment(memberId, "memberId")}/role`, {
+        role
+      }).then(() => void 0);
+    },
+    removeMember: (orgId, memberId) => send(orgId, "DELETE", `/api/org/members/${segment(memberId, "memberId")}`).then(
+      () => void 0
+    ),
+    inviteMember: (orgId, email, role) => {
+      if (typeof email !== "string" || email.trim() === "") {
+        throw new Error("email must be a non-empty string");
+      }
+      segment(role, "role");
+      return send(orgId, "POST", "/api/org/invite", { email: email.trim(), role }).then(
+        (d) => d
+      );
+    },
+    listInvitations: (orgId) => send(orgId, "GET", "/api/org/invitations").then((d) => rows(d, "invitations")),
+    revokeInvitation: (orgId, invitationId) => send(orgId, "DELETE", `/api/org/invitations/${segment(invitationId, "invitationId")}`).then(
+      () => void 0
+    ),
+    resendInvitation: (orgId, invitationId) => send(
+      orgId,
+      "POST",
+      `/api/org/invitations/${segment(invitationId, "invitationId")}/resend`
+    ).then(() => void 0)
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ORG_HEADER,
+  createTeamClient
+});

package/dist/index.mjs

@@ -0,0 +1,72 @@
+// src/client.ts
+var ORG_HEADER = "X-Reeve-Org-Id";
+var ORG_ID_SHAPE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+function orgHeaders(orgId) {
+  if (typeof orgId !== "string" || !ORG_ID_SHAPE.test(orgId)) {
+    throw new Error(`orgId must be a plausible org id, got ${JSON.stringify(orgId)}`);
+  }
+  return { [ORG_HEADER]: orgId };
+}
+function segment(value, name) {
+  if (typeof value !== "string" || value === "") {
+    throw new Error(`${name} must be a non-empty string`);
+  }
+  return encodeURIComponent(value);
+}
+function hasStringId(row) {
+  return typeof row === "object" && row !== null && typeof row.id === "string" && row.id !== "";
+}
+function rows(data, what) {
+  if (!Array.isArray(data) || !data.every(hasStringId)) {
+    throw new Error(`team: malformed ${what} response`);
+  }
+  return data;
+}
+function createTeamClient({ fetch }) {
+  if (typeof fetch !== "function") {
+    throw new Error("createTeamClient: `fetch` must be a function");
+  }
+  const send = (orgId, method, path, body) => {
+    const headers = orgHeaders(orgId);
+    const init = { method, headers };
+    if (body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      init.body = JSON.stringify(body);
+    }
+    return fetch(path, init);
+  };
+  return {
+    listMembers: (orgId) => send(orgId, "GET", "/api/org/members").then((d) => rows(d, "members")),
+    updateMemberRole: (orgId, memberId, role) => {
+      segment(role, "role");
+      return send(orgId, "PUT", `/api/org/members/${segment(memberId, "memberId")}/role`, {
+        role
+      }).then(() => void 0);
+    },
+    removeMember: (orgId, memberId) => send(orgId, "DELETE", `/api/org/members/${segment(memberId, "memberId")}`).then(
+      () => void 0
+    ),
+    inviteMember: (orgId, email, role) => {
+      if (typeof email !== "string" || email.trim() === "") {
+        throw new Error("email must be a non-empty string");
+      }
+      segment(role, "role");
+      return send(orgId, "POST", "/api/org/invite", { email: email.trim(), role }).then(
+        (d) => d
+      );
+    },
+    listInvitations: (orgId) => send(orgId, "GET", "/api/org/invitations").then((d) => rows(d, "invitations")),
+    revokeInvitation: (orgId, invitationId) => send(orgId, "DELETE", `/api/org/invitations/${segment(invitationId, "invitationId")}`).then(
+      () => void 0
+    ),
+    resendInvitation: (orgId, invitationId) => send(
+      orgId,
+      "POST",
+      `/api/org/invitations/${segment(invitationId, "invitationId")}/resend`
+    ).then(() => void 0)
+  };
+}
+export {
+  ORG_HEADER,
+  createTeamClient
+};

package/package.json

@@ -1,6 +1,72 @@
 {
   "name": "@meetreeve/module-team",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Reeve.Team module (DEV-9998, C2 of epic DEV-9983): the CONFIG surface for an org's people - members table, role picker, remove member, invite dialog, pending invitations (revoke/resend) and seat count - plus a server-safe typed client over /api/org/*. Talks to the host through an injected fetch. Versioned in lockstep with the Python reeve-module-team package (both ship the same MAJOR.MINOR.PATCH).",
+  "license": "UNLICENSED",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "import": "./dist/client/index.mjs",
+      "require": "./dist/client/index.js"
+    },
+    "./config": {
+      "types": "./dist/config/index.d.ts",
+      "import": "./dist/config/index.mjs",
+      "require": "./dist/config/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "rm -rf dist && tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "check:esm": "node ../../scripts/check-esm-import.mjs .",
+    "prepublishOnly": "npm run build"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "react": ">=18",
+    "react-dom": ">=18"
+  },
+  "devDependencies": {
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^16.3.2",
+    "@testing-library/user-event": "^14.6.1",
+    "@types/node": "^20.19.43",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "@vitejs/plugin-react": "^5.1.3",
+    "jsdom": "^28.0.0",
+    "react": "19.2.3",
+    "react-dom": "19.2.3",
+    "tsup": "^8.0.0",
+    "typescript": "5.9.3",
+    "vitest": "^4.0.18"
+  },
+  "keywords": [
+    "react",
+    "reeve",
+    "team",
+    "members",
+    "invitations"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MindFortressInc/reeve-frontend.git",
+    "directory": "packages/module-team"
+  }
+}