@plandesk/api 0.20.0 → 1.0.0-beta.1

package/dist/github.js

@@ -0,0 +1,115 @@
+/**
+ * GitHub OAuth helpers (authorize URL + code exchange for identity).
+ * Browser sign-in is owned by better-auth social. GitHub is optional (REQ-20).
+ */
+const AUTHORIZE_URL = 'https://github.com/login/oauth/authorize';
+const ACCESS_TOKEN_URL = 'https://github.com/login/oauth/access_token';
+const USER_URL = 'https://api.github.com/user';
+export class GithubOAuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GithubOAuthError';
+    }
+}
+function present(value) {
+    return value !== undefined && value.trim() !== '';
+}
+/**
+ * Read the GitHub app from the environment. Every runtime entry uses this, so
+ * "is GitHub sign-in on?" has exactly one answer everywhere.
+ *
+ * No client id/secret → undefined → the instance runs without GitHub sign-in.
+ * That is the supported self-host path, not a degraded one (REQ-20).
+ *
+ * A half-configured app throws instead of silently disabling: someone who set
+ * a client id meant to turn this on and should be told what is missing.
+ */
+export function githubConfigFromEnv(env) {
+    const clientId = env.PLANDESK_GITHUB_CLIENT_ID;
+    const clientSecret = env.PLANDESK_GITHUB_CLIENT_SECRET;
+    const callbackUrl = env.PLANDESK_GITHUB_CALLBACK_URL;
+    if (!present(clientId) && !present(clientSecret) && !present(callbackUrl)) {
+        return undefined;
+    }
+    if (!present(clientId) || !present(clientSecret) || !present(callbackUrl)) {
+        throw new Error('GitHub sign-in needs PLANDESK_GITHUB_CLIENT_ID, PLANDESK_GITHUB_CLIENT_SECRET and ' +
+            'PLANDESK_GITHUB_CALLBACK_URL together. Unset all three to run without GitHub sign-in.');
+    }
+    return {
+        clientId: clientId.trim(),
+        clientSecret: clientSecret.trim(),
+        callbackUrl: callbackUrl.trim(),
+        dashboardUrl: present(env.PLANDESK_DASHBOARD_URL) ? env.PLANDESK_DASHBOARD_URL.trim() : '/',
+    };
+}
+/** `github:<numeric id>` — never the login, which a rename would orphan. */
+export function userRefFromGithubId(id) {
+    return `github:${String(id)}`;
+}
+export function authorizeUrl(config, state) {
+    const url = new URL(AUTHORIZE_URL);
+    url.searchParams.set('client_id', config.clientId);
+    url.searchParams.set('redirect_uri', config.callbackUrl);
+    url.searchParams.set('state', state);
+    // Identity only: we never write to the user's GitHub account.
+    url.searchParams.set('scope', 'read:user');
+    url.searchParams.set('allow_signup', 'true');
+    return url.toString();
+}
+async function exchangeCodeForToken(config, code) {
+    const doFetch = config.fetch ?? fetch;
+    const response = await doFetch(ACCESS_TOKEN_URL, {
+        method: 'POST',
+        headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            client_id: config.clientId,
+            // Confidential client: the secret stays server-side.
+            client_secret: config.clientSecret,
+            code,
+            redirect_uri: config.callbackUrl,
+        }),
+    });
+    if (!response.ok) {
+        throw new GithubOAuthError(`token exchange failed with status ${String(response.status)}`);
+    }
+    const body = (await response.json());
+    if (typeof body.error === 'string') {
+        throw new GithubOAuthError(`token exchange rejected: ${body.error}`);
+    }
+    if (typeof body.access_token !== 'string' || body.access_token.length === 0) {
+        throw new GithubOAuthError('token exchange returned no access_token');
+    }
+    return body.access_token;
+}
+async function fetchIdentity(config, accessToken) {
+    const doFetch = config.fetch ?? fetch;
+    const response = await doFetch(USER_URL, {
+        headers: {
+            Accept: 'application/vnd.github+json',
+            Authorization: `Bearer ${accessToken}`,
+            'User-Agent': 'plandesk',
+        },
+    });
+    if (!response.ok) {
+        throw new GithubOAuthError(`user lookup failed with status ${String(response.status)}`);
+    }
+    const body = (await response.json());
+    if (typeof body.id !== 'number' || typeof body.login !== 'string') {
+        throw new GithubOAuthError('user lookup returned no id/login');
+    }
+    return {
+        id: body.id,
+        login: body.login,
+        name: typeof body.name === 'string' ? body.name : null,
+    };
+}
+/**
+ * Exchange the callback code for the caller's identity.
+ * The access token is used once, here, and then dropped: storing it would make
+ * Plan Desk a breach target for no product benefit.
+ */
+export async function resolveGithubIdentity(config, code) {
+    const accessToken = await exchangeCodeForToken(config, code);
+    return fetchIdentity(config, accessToken);
+}
+//# sourceMappingURL=github.js.map

package/dist/hosted-auth.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Hosted (Workers / Vercel) better-auth wiring.
+ * Local `serve` uses sessionSecret + auto-generated local secret; edge entries
+ * require an explicit PLANDESK_BETTER_AUTH_SECRET so a misdeploy fails loud
+ * instead of 401-ing every request on a non-loopback bind.
+ */
+export type HostedAuthEnv = {
+    PLANDESK_BETTER_AUTH_SECRET?: string;
+    PLANDESK_BASE_URL?: string;
+};
+export declare const MISSING_BETTER_AUTH_SECRET_MESSAGE: string;
+export declare const MISSING_BASE_URL_MESSAGE: string;
+/**
+ * Resolve better-auth config for a hosted (non-loopback) entry.
+ * Throws a clear Error when the secret is missing — callers return 500, not silent 401.
+ * baseURL prefers PLANDESK_BASE_URL; falls back to requestOrigin (Workers per-request).
+ */
+export declare function resolveHostedBetterAuth(env: HostedAuthEnv, requestOrigin?: string): {
+    secret: string;
+    baseURL: string;
+};
+export declare function hostedMisconfigResponse(err: unknown): Response | undefined;
+//# sourceMappingURL=hosted-auth.d.ts.map

package/dist/hosted-auth.js

@@ -0,0 +1,49 @@
+/**
+ * Hosted (Workers / Vercel) better-auth wiring.
+ * Local `serve` uses sessionSecret + auto-generated local secret; edge entries
+ * require an explicit PLANDESK_BETTER_AUTH_SECRET so a misdeploy fails loud
+ * instead of 401-ing every request on a non-loopback bind.
+ */
+export const MISSING_BETTER_AUTH_SECRET_MESSAGE = 'Hosted Plan Desk requires PLANDESK_BETTER_AUTH_SECRET. ' +
+    'Set it via `wrangler secret put PLANDESK_BETTER_AUTH_SECRET` (Workers) or the platform env (Vercel). ' +
+    'Without it every request would 401 on a non-loopback bind.';
+export const MISSING_BASE_URL_MESSAGE = 'Hosted Plan Desk requires PLANDESK_BASE_URL (public origin, e.g. https://plandesk-api.example.workers.dev) ' +
+    'when the request origin is not available at construction time.';
+function present(value) {
+    return value !== undefined && value.trim() !== '';
+}
+/**
+ * Resolve better-auth config for a hosted (non-loopback) entry.
+ * Throws a clear Error when the secret is missing — callers return 500, not silent 401.
+ * baseURL prefers PLANDESK_BASE_URL; falls back to requestOrigin (Workers per-request).
+ */
+export function resolveHostedBetterAuth(env, requestOrigin) {
+    if (!present(env.PLANDESK_BETTER_AUTH_SECRET)) {
+        throw new Error(MISSING_BETTER_AUTH_SECRET_MESSAGE);
+    }
+    const fromEnv = present(env.PLANDESK_BASE_URL) ? env.PLANDESK_BASE_URL.trim() : undefined;
+    const fromRequest = requestOrigin !== undefined && requestOrigin.trim() !== ''
+        ? requestOrigin.trim().replace(/\/$/, '')
+        : undefined;
+    const baseURL = fromEnv ?? fromRequest;
+    if (baseURL === undefined) {
+        throw new Error(MISSING_BASE_URL_MESSAGE);
+    }
+    return {
+        secret: env.PLANDESK_BETTER_AUTH_SECRET.trim(),
+        baseURL: baseURL.replace(/\/$/, ''),
+    };
+}
+export function hostedMisconfigResponse(err) {
+    if (!(err instanceof Error))
+        return undefined;
+    if (err.message !== MISSING_BETTER_AUTH_SECRET_MESSAGE &&
+        err.message !== MISSING_BASE_URL_MESSAGE) {
+        return undefined;
+    }
+    return new Response(JSON.stringify({ error: 'misconfigured', message: err.message }), {
+        status: 500,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+//# sourceMappingURL=hosted-auth.js.map

package/dist/identity.d.ts

@@ -0,0 +1,38 @@
+import { type Db } from '@plandesk/db';
+import type { BetterAuthInstance } from './better-auth.js';
+import type { GithubIdentity } from './github.js';
+import { type OrganizationSummary } from './organizations.js';
+type OrganizationRow = {
+    id: string;
+    name: string;
+    slug: string;
+    createdAt: Date;
+};
+export type IdentityOrganization = Pick<OrganizationRow, 'id' | 'name' | 'slug'> & {
+    role: string;
+};
+export declare function githubAccountIdFromUserRef(userRef: string): string | undefined;
+export declare function userRefFromGithubAccountId(accountId: string): string;
+export declare function resolveOrganizationsForGithubIdentity(auth: BetterAuthInstance, identity: GithubIdentity): Promise<IdentityOrganization[]>;
+/**
+ * Ensure the well-known local better-auth organization exists (user-less).
+ * Idempotent. Used at serve boot for loopback owner-by-bind.
+ */
+export declare function ensureLocalBetterAuthOrganization(_db: Db, auth: BetterAuthInstance): Promise<OrganizationSummary>;
+export type ProvisionPersonalOrgResult = {
+    created: true;
+    orgId: string;
+    role: 'owner';
+} | {
+    created: false;
+    reason: 'not_github' | 'already_member';
+};
+/**
+ * BA4c: first better-auth GitHub session with zero memberships gets a personal
+ * org + owner member. Invited users who already hold a member row are left alone.
+ */
+export declare function provisionPersonalOrgIfNeeded(auth: BetterAuthInstance, _db: Db, userId: string): Promise<ProvisionPersonalOrgResult>;
+/** Persist the best active organization for a newly-created session. */
+export declare function setDefaultActiveOrganization(auth: BetterAuthInstance, userId: string, sessionToken: string): Promise<string | undefined>;
+export {};
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.js

@@ -0,0 +1,163 @@
+import { DEFAULT_ORG_ID } from '@plandesk/db';
+import { getOrganizationById } from './organizations.js';
+const GITHUB_PROVIDER_ID = 'github';
+const GITHUB_USER_REF_PREFIX = 'github:';
+const NUMERIC_GITHUB_ID = /^[1-9]\d*$/;
+export function githubAccountIdFromUserRef(userRef) {
+    if (!userRef.startsWith(GITHUB_USER_REF_PREFIX))
+        return undefined;
+    const accountId = userRef.slice(GITHUB_USER_REF_PREFIX.length);
+    return NUMERIC_GITHUB_ID.test(accountId) ? accountId : undefined;
+}
+export function userRefFromGithubAccountId(accountId) {
+    if (!NUMERIC_GITHUB_ID.test(accountId)) {
+        throw new Error('GitHub account id must be numeric');
+    }
+    return `${GITHUB_USER_REF_PREFIX}${accountId}`;
+}
+export async function resolveOrganizationsForGithubIdentity(auth, identity) {
+    const adapter = (await auth.$context).adapter;
+    const account = await adapter.findOne({
+        model: 'account',
+        where: [
+            { field: 'providerId', value: GITHUB_PROVIDER_ID },
+            { field: 'accountId', value: String(identity.id) },
+        ],
+    });
+    if (account === null)
+        return [];
+    const user = await adapter.findOne({
+        model: 'user',
+        where: [{ field: 'id', value: account.userId }],
+    });
+    if (user === null)
+        throw new Error('GitHub account points to a missing user');
+    const members = await adapter.findMany({
+        model: 'member',
+        where: [{ field: 'userId', value: user.id }],
+        sortBy: { field: 'createdAt', direction: 'asc' },
+    });
+    return Promise.all(members.map(async (member) => {
+        const organization = await adapter.findOne({
+            model: 'organization',
+            where: [{ field: 'id', value: member.organizationId }],
+        });
+        if (organization === null)
+            throw new Error('Membership points to a missing organization');
+        return {
+            id: organization.id,
+            name: organization.name,
+            slug: organization.slug,
+            role: member.role,
+        };
+    }));
+}
+/**
+ * Ensure the well-known local better-auth organization exists (user-less).
+ * Idempotent. Used at serve boot for loopback owner-by-bind.
+ */
+export async function ensureLocalBetterAuthOrganization(_db, auth) {
+    const existing = await getOrganizationById(auth, DEFAULT_ORG_ID);
+    if (existing !== undefined) {
+        return existing;
+    }
+    const now = new Date();
+    const adapter = (await auth.$context).adapter;
+    const data = {
+        id: DEFAULT_ORG_ID,
+        name: 'Personal',
+        slug: 'local',
+        createdAt: now,
+    };
+    const created = await adapter.create({
+        model: 'organization',
+        data,
+        forceAllowId: true,
+    });
+    return {
+        id: created.id,
+        name: created.name,
+        slug: created.slug,
+        createdAt: created.createdAt,
+    };
+}
+/**
+ * BA4c: first better-auth GitHub session with zero memberships gets a personal
+ * org + owner member. Invited users who already hold a member row are left alone.
+ */
+export async function provisionPersonalOrgIfNeeded(auth, _db, userId) {
+    const adapter = (await auth.$context).adapter;
+    const account = await adapter.findOne({
+        model: 'account',
+        where: [
+            { field: 'userId', value: userId },
+            { field: 'providerId', value: GITHUB_PROVIDER_ID },
+        ],
+    });
+    if (account === null) {
+        return { created: false, reason: 'not_github' };
+    }
+    const members = await adapter.findMany({
+        model: 'member',
+        where: [{ field: 'userId', value: userId }],
+    });
+    if (members.length > 0) {
+        return { created: false, reason: 'already_member' };
+    }
+    const user = await adapter.findOne({
+        model: 'user',
+        where: [{ field: 'id', value: userId }],
+    });
+    if (user === null) {
+        throw new Error('session user missing during personal org provision');
+    }
+    const orgName = user.name.trim().length > 0 ? user.name.trim() : 'Personal';
+    const now = new Date();
+    const organization = await adapter.create({
+        model: 'organization',
+        data: {
+            name: orgName,
+            slug: `u-${userId}`,
+            createdAt: now,
+        },
+    });
+    await adapter.create({
+        model: 'member',
+        data: {
+            organizationId: organization.id,
+            userId,
+            role: 'owner',
+            createdAt: now,
+        },
+    });
+    return { created: true, orgId: organization.id, role: 'owner' };
+}
+/** Persist the best active organization for a newly-created session. */
+export async function setDefaultActiveOrganization(auth, userId, sessionToken) {
+    const context = await auth.$context;
+    const members = await context.adapter.findMany({
+        model: 'member',
+        where: [{ field: 'userId', value: userId }],
+        sortBy: { field: 'createdAt', direction: 'asc' },
+    });
+    if (members.length === 0) {
+        return undefined;
+    }
+    const memberOrgIds = new Set(members.map((member) => member.organizationId));
+    const sessions = await context.adapter.findMany({
+        model: 'session',
+        where: [{ field: 'userId', value: userId }],
+        sortBy: { field: 'updatedAt', direction: 'desc' },
+    });
+    const priorActiveOrganizationId = sessions.find((session) => session.token !== sessionToken &&
+        session.activeOrganizationId !== undefined &&
+        session.activeOrganizationId !== null &&
+        memberOrgIds.has(session.activeOrganizationId))?.activeOrganizationId;
+    const activeOrganizationId = priorActiveOrganizationId ?? members[0]?.organizationId;
+    if (activeOrganizationId === undefined) {
+        return undefined;
+    }
+    await context.internalAdapter.updateSession(sessionToken, { activeOrganizationId });
+    return activeOrganizationId;
+}
+//# sourceMappingURL=identity.js.map

package/dist/index.d.ts

@@ -1,9 +1,20 @@
 export { createApp, type AppDeps } from './server.js';
-export { createAuthMiddleware } from './auth.js';
+export { createBetterAuth, runBetterAuthMigrations, type BetterAuthDeps, type BetterAuthInstance, } from './better-auth.js';
+export { ensureLocalBetterAuthOrganization } from './identity.js';
+export { createAuthMiddleware, createOrgAuthMiddleware, createWriteGuardMiddleware, isLoopbackBind, isPublicAuthPath, isInvitationAcceptPath, type OrgAuthOptions, } from './auth.js';
+export { acceptOrganizationInvitation, createOrganizationInvitation, ensureShellOwner, invitationClaimUrl, isAuthApiError, isInvitationRole, mintOwnerInvitation, mintSessionCookieHeader, removeOrganizationMember, updateOrganizationMemberRole, INVITATION_ROLES, type InvitationRole, } from './invitations.js';
+export { authorizeUrl, githubConfigFromEnv, resolveGithubIdentity, userRefFromGithubId, GithubOAuthError, type FetchLike, type GithubConfig, type GithubEnv, type GithubIdentity, } from './github.js';
+export { GUEST_SESSION_COOKIE, readGuestSessionCookie } from './session.js';
+export { createAuthRouter, type AuthRouterDeps } from './routes/auth.js';
+export { runWithAuthContext, tryGetAuthContext, getAuthContext, ReadOnlyTokenError, type AuthContext, } from './auth-context.js';
+export { applyAgentKeyPermissionCeiling, createScopedAgentKey, createOrgOwnerKey, verifyBetterAuthApiKey, DEFAULT_AGENT_KEY_PERMISSIONS, DEFAULT_OWNER_KEY_PERMISSIONS, AGENT_FORBIDDEN_RESOURCES, type ApiKeyKind, type CreateScopedAgentKeyInput, type CreatedScopedAgentKey, type CreateOrgOwnerKeyInput, type CreatedOrgOwnerKey, type VerifiedApiKey, } from './agent-keys.js';
+export { requirePermission, hasPermission, hasAnyWritePermission, orgRoleToPermissionSet, PermissionDeniedError, type PermissionSet, } from './permissions.js';
 export { healthRouter } from './routes/health.js';
 export { mountStatic } from './static.js';
+export { createS3Adapter, type S3AdapterConfig } from './storage/s3.js';
+export type { StorageAdapter } from './storage/adapter.js';
 export { createServices, type Services, type ServicesDeps } from './services/index.js';
-export { createEventBus, type EventBus, type PlankDeskEvent } from './events.js';
+export { assertProjectInOrg, ProjectNotInOrgError } from './services/scope.js';
 export type { ProjectService } from './services/projects.js';
 export type { GoalService, VerificationEvidence } from './services/goals.js';
 export { GoalCompletionBlockedError, GoalVerificationRequiredError, InvalidGoalTransitionError, InvalidVerificationSurfaceError, } from './services/goals.js';

package/dist/index.js

@@ -1,9 +1,19 @@
 export { createApp } from './server.js';
-export { createAuthMiddleware } from './auth.js';
+export { createBetterAuth, runBetterAuthMigrations, } from './better-auth.js';
+export { ensureLocalBetterAuthOrganization } from './identity.js';
+export { createAuthMiddleware, createOrgAuthMiddleware, createWriteGuardMiddleware, isLoopbackBind, isPublicAuthPath, isInvitationAcceptPath, } from './auth.js';
+export { acceptOrganizationInvitation, createOrganizationInvitation, ensureShellOwner, invitationClaimUrl, isAuthApiError, isInvitationRole, mintOwnerInvitation, mintSessionCookieHeader, removeOrganizationMember, updateOrganizationMemberRole, INVITATION_ROLES, } from './invitations.js';
+export { authorizeUrl, githubConfigFromEnv, resolveGithubIdentity, userRefFromGithubId, GithubOAuthError, } from './github.js';
+export { GUEST_SESSION_COOKIE, readGuestSessionCookie } from './session.js';
+export { createAuthRouter } from './routes/auth.js';
+export { runWithAuthContext, tryGetAuthContext, getAuthContext, ReadOnlyTokenError, } from './auth-context.js';
+export { applyAgentKeyPermissionCeiling, createScopedAgentKey, createOrgOwnerKey, verifyBetterAuthApiKey, DEFAULT_AGENT_KEY_PERMISSIONS, DEFAULT_OWNER_KEY_PERMISSIONS, AGENT_FORBIDDEN_RESOURCES, } from './agent-keys.js';
+export { requirePermission, hasPermission, hasAnyWritePermission, orgRoleToPermissionSet, PermissionDeniedError, } from './permissions.js';
 export { healthRouter } from './routes/health.js';
 export { mountStatic } from './static.js';
+export { createS3Adapter } from './storage/s3.js';
 export { createServices } from './services/index.js';
-export { createEventBus } from './events.js';
+export { assertProjectInOrg, ProjectNotInOrgError } from './services/scope.js';
 export { GoalCompletionBlockedError, GoalVerificationRequiredError, InvalidGoalTransitionError, InvalidVerificationSurfaceError, } from './services/goals.js';
 export { InvalidGoalReferenceError } from './services/tasks.js';
 export { InvalidDocumentError } from './services/documents.js';

package/dist/invitations.d.ts

@@ -0,0 +1,94 @@
+import type { BetterAuthInstance } from './better-auth.js';
+export declare const INVITATION_ROLES: readonly ["owner", "admin", "member"];
+export type InvitationRole = (typeof INVITATION_ROLES)[number];
+export declare function isInvitationRole(value: string): value is InvitationRole;
+export declare function invitationClaimUrl(baseURL: string, invitationId: string): string;
+type InvitationRow = {
+    id: string;
+    email: string;
+    role: string;
+    organizationId: string;
+    inviterId: string;
+    status: string;
+    expiresAt: Date;
+    createdAt: Date;
+};
+type AcceptResult = {
+    invitation: InvitationRow;
+    member: {
+        id: string;
+        organizationId: string;
+        userId: string;
+        role: string;
+    };
+};
+/** better-auth APIError shape (runtime; not imported — version-stable fields only). */
+export type AuthApiErrorShape = {
+    statusCode: number;
+    status: string;
+    message: string;
+};
+export declare function isAuthApiError(err: unknown): err is AuthApiErrorShape;
+/**
+ * Create an invitation using the caller's better-auth session (Cookie headers).
+ * No mailer: sendInvitationEmail is unset; caller delivers claimUrl by hand.
+ */
+export declare function createOrganizationInvitation(auth: BetterAuthInstance, opts: {
+    email: string;
+    role: InvitationRole;
+    organizationId: string;
+    headers: Headers;
+    baseURL: string;
+}): Promise<{
+    invitationId: string;
+    claimUrl: string;
+    invitation: InvitationRow;
+}>;
+/**
+ * Accept a pending invitation as the signed-in better-auth user (email must match).
+ * Single-use CAS: a second accept fails (maps to 410 at the route).
+ */
+export declare function acceptOrganizationInvitation(auth: BetterAuthInstance, opts: {
+    invitationId: string;
+    headers: Headers;
+}): Promise<AcceptResult>;
+/**
+ * Remove a member via better-auth (enforces ≥1 owner). Used by tests / future routes.
+ */
+export declare function removeOrganizationMember(auth: BetterAuthInstance, opts: {
+    memberIdOrEmail: string;
+    organizationId: string;
+    headers: Headers;
+}): Promise<unknown>;
+/**
+ * Update a member role via better-auth (enforces ≥1 owner on demote).
+ */
+export declare function updateOrganizationMemberRole(auth: BetterAuthInstance, opts: {
+    memberId: string;
+    role: InvitationRole;
+    organizationId: string;
+    headers: Headers;
+}): Promise<unknown>;
+/** Mint a signed better-auth session cookie header for an existing user. */
+export declare function mintSessionCookieHeader(auth: BetterAuthInstance, userId: string): Promise<Headers>;
+/**
+ * Ensure a shell inviter user exists as owner of organizationId (REQ-3 bootstrap).
+ * Shell authority owns the DB — no interactive session required from the operator.
+ */
+export declare function ensureShellOwner(auth: BetterAuthInstance, organizationId: string): Promise<{
+    userId: string;
+    headers: Headers;
+}>;
+/**
+ * Shell-side owner invitation for `plandesk admin invite-owner` (no GitHub, no mailer).
+ */
+export declare function mintOwnerInvitation(auth: BetterAuthInstance, opts: {
+    email: string;
+    organizationId: string;
+    baseURL: string;
+}): Promise<{
+    invitationId: string;
+    claimUrl: string;
+}>;
+export {};
+//# sourceMappingURL=invitations.d.ts.map