@plandesk/api 1.0.0-beta.8 → 1.0.0

package/dist/agent-keys.d.ts

@@ -10,8 +10,9 @@ export type ApiKeyKind = 'agent' | 'owner';
 export declare const DEFAULT_AGENT_KEY_PERMISSIONS: PermissionSet;
 /** Full owner permission set — default grant for org-wide owner keys (BA4b-1). */
 export declare const DEFAULT_OWNER_KEY_PERMISSIONS: PermissionSet;
-/** Always stripped from agent-key effective perms — a key must never mint keys. */
-export declare const AGENT_FORBIDDEN_RESOURCES: readonly ["apiKey"];
+/** Always stripped from agent-key effective perms — a key must never mint keys
+ * or create/rename workspaces (team), regardless of custom permissions. */
+export declare const AGENT_FORBIDDEN_RESOURCES: readonly ["apiKey", "team"];
 /**
  * Live-role ceiling at verify time (BA5 + BA4b-1):
  * effective = intersect(keyPermissions, liveMemberRole);
@@ -55,6 +56,29 @@ export type CreatedScopedAgentKey = {
  * Metadata has no `kind` (or may omit it) — resolver treats absent as agent.
  */
 export declare function createScopedAgentKey(input: CreateScopedAgentKeyInput): Promise<CreatedScopedAgentKey>;
+export type CreateWorkspaceScopedAgentKeyInput = {
+    auth: BetterAuthInstance;
+    userId: string;
+    orgId: string;
+    teamId: string;
+    permissions?: PermissionSet;
+    name?: string;
+};
+export type CreatedWorkspaceScopedAgentKey = {
+    id: string;
+    key: string;
+    name: string | null;
+    permissions: Record<string, string[]> | null;
+    metadata: {
+        orgId: string;
+        teamId: string;
+    };
+};
+/**
+ * Server-side mint for a workspace-scoped agent key.
+ * Metadata is `{ orgId, teamId }` — no `kind` so resolver treats absent as agent.
+ */
+export declare function createWorkspaceScopedAgentKey(input: CreateWorkspaceScopedAgentKeyInput): Promise<CreatedWorkspaceScopedAgentKey>;
 export type CreateOrgOwnerKeyInput = {
     auth: BetterAuthInstance;
     userId: string;

package/dist/agent-keys.js

@@ -19,8 +19,9 @@ export const DEFAULT_AGENT_KEY_PERMISSIONS = {
 };
 /** Full owner permission set — default grant for org-wide owner keys (BA4b-1). */
 export const DEFAULT_OWNER_KEY_PERMISSIONS = orgRoleToPermissionSet('owner');
-/** Always stripped from agent-key effective perms — a key must never mint keys. */
-export const AGENT_FORBIDDEN_RESOURCES = ['apiKey'];
+/** Always stripped from agent-key effective perms — a key must never mint keys
+ * or create/rename workspaces (team), regardless of custom permissions. */
+export const AGENT_FORBIDDEN_RESOURCES = ['apiKey', 'team'];
 /**
  * Live-role ceiling at verify time (BA5 + BA4b-1):
  * effective = intersect(keyPermissions, liveMemberRole);
@@ -158,6 +159,25 @@ export async function createScopedAgentKey(input) {
         metadata,
     };
 }
+/**
+ * Server-side mint for a workspace-scoped agent key.
+ * Metadata is `{ orgId, teamId }` — no `kind` so resolver treats absent as agent.
+ */
+export async function createWorkspaceScopedAgentKey(input) {
+    const permissions = compactPermissions(input.permissions ?? DEFAULT_AGENT_KEY_PERMISSIONS);
+    const metadata = { orgId: input.orgId, teamId: input.teamId };
+    const minted = await mintBetterAuthApiKey({
+        auth: input.auth,
+        userId: input.userId,
+        name: input.name ?? 'agent',
+        permissions,
+        metadata,
+    });
+    return {
+        ...minted,
+        metadata,
+    };
+}
 /**
  * Server-side mint for an org-wide owner key (BA4b-1).
  * No projectId in metadata → org-wide reach. kind: 'owner' retains apiKey

package/dist/auth-context.d.ts

@@ -11,23 +11,36 @@ export type AuthContext = {
     orgId: string;
     /** Stable identity, e.g. `github:<numeric id>` — never the login. */
     userRef: string;
+    /** better-auth user id owning this session. */
+    userId: string;
     /** better-auth org role (owner/admin/member) for display. */
     role: OrgRole;
     /** Resolved permission set for resource:action checks. */
     permission: PermissionSet;
+    /**
+     * Workspace (team) ids in this org the user is a `teamMember` of. Gates a
+     * member to their own workspaces; owner/admin bypass by role (see scope.ts).
+     */
+    memberWorkspaceIds: string[];
 } | {
     kind: 'loopback';
     orgId: string;
     /** REQ-21: local loopback single-org is always owner — no login. */
     role: 'owner';
     permission: PermissionSet;
+    /** Optional local workspace scope from the x-plandesk-workspace-id header; not a security boundary. */
+    workspaceId?: string;
 } | {
     kind: 'apikey';
     orgId: string;
     /** better-auth user id that owns the key (referenceId). */
     userId: string;
+    /** Key profile from metadata: agent (scoped/ceilinged) vs owner (org-wide). */
+    profile: 'agent' | 'owner';
     /** Optional project scope from key metadata; cross-project → 404. */
     projectId?: string;
+    /** Optional workspace scope from key metadata; cross-workspace → 404. */
+    workspaceId?: string;
     /**
      * Live member role when present. Effective authority is always
      * `permission` (key ∩ live role; agent profile also strips apiKey —
@@ -39,7 +52,10 @@ export type AuthContext = {
     /** Portal participant after join — no org membership, one share only. */
     kind: 'guest';
     shareId: string;
-    projectId: string;
+    /** Set for a project share; absent for a workspace share. */
+    projectId?: string;
+    /** Set for a workspace share; absent for a project share. */
+    workspaceId?: string;
     guestSessionId: string;
 };
 /** Org-bearing contexts (everything except portal guests). */

package/dist/auth.d.ts

@@ -13,6 +13,16 @@ export type OrgAuthOptions = {
      */
     betterAuth?: BetterAuthInstance;
 };
+/**
+ * Read better-auth key metadata. Absent/unknown `kind` → `'agent'` (BA4b-1
+ * back-compat: every key minted without kind keeps agent ceiling).
+ */
+export declare function readApiKeyMetadata(metadata: unknown): {
+    orgId: string | undefined;
+    projectId: string | undefined;
+    workspaceId: string | undefined;
+    kind: 'agent' | 'owner';
+};
 export declare function isInvitationAcceptPath(path: string): boolean;
 export declare function isPublicAuthPath(path: string): boolean;
 export declare function isPublicShareReadPath(path: string): boolean;

package/dist/auth.js

@@ -2,7 +2,7 @@ import { timingSafeEqual } from 'node:crypto';
 import { DEFAULT_ORG_ID, hashShareToken, orgRoles, verifyGuestSession, } from '@plandesk/db';
 import { applyAgentKeyPermissionCeiling, verifyBetterAuthApiKey, } from './agent-keys.js';
 import { runWithAuthContext, tryGetAuthContext } from './auth-context.js';
-import { userRefFromGithubAccountId } from './identity.js';
+import { userRefFromGithubAccountId, listMemberWorkspaceIds } from './identity.js';
 import { resolveDefaultOrganization } from './organizations.js';
 import { hasAnyWritePermission, orgRoleToPermissionSet, } from './permissions.js';
 import { readGuestSessionCookie } from './session.js';
@@ -115,22 +115,25 @@ async function resolveBetterAuthSessionContext(auth, headers) {
         kind: 'session',
         orgId: active.organizationId,
         userRef,
+        userId,
         role,
         permission: orgRoleToPermissionSet(role),
+        memberWorkspaceIds: await listMemberWorkspaceIds(auth, userId, active.organizationId),
     };
 }
 /**
  * Read better-auth key metadata. Absent/unknown `kind` → `'agent'` (BA4b-1
  * back-compat: every key minted without kind keeps agent ceiling).
  */
-function readApiKeyMetadata(metadata) {
+export function readApiKeyMetadata(metadata) {
     if (metadata === null || metadata === undefined || typeof metadata !== 'object') {
-        return { orgId: undefined, projectId: undefined, kind: 'agent' };
+        return { orgId: undefined, projectId: undefined, workspaceId: undefined, kind: 'agent' };
     }
     const m = metadata;
     return {
         orgId: typeof m.orgId === 'string' && m.orgId.length > 0 ? m.orgId : undefined,
         projectId: typeof m.projectId === 'string' && m.projectId.length > 0 ? m.projectId : undefined,
+        workspaceId: typeof m.teamId === 'string' && m.teamId.length > 0 ? m.teamId : undefined,
         kind: m.kind === 'owner' ? 'owner' : 'agent',
     };
 }
@@ -165,7 +168,7 @@ async function resolveBetterAuthApiKeyContext(auth, bearer) {
         return undefined;
     }
     const userId = verified.referenceId;
-    const { orgId, projectId, kind } = readApiKeyMetadata(verified.metadata);
+    const { orgId, projectId, workspaceId, kind } = readApiKeyMetadata(verified.metadata);
     if (orgId === undefined) {
         return 'unauthorized';
     }
@@ -175,7 +178,9 @@ async function resolveBetterAuthApiKeyContext(auth, bearer) {
         kind: 'apikey',
         orgId,
         userId,
+        profile: kind,
         ...(projectId !== undefined ? { projectId } : {}),
+        ...(workspaceId !== undefined ? { workspaceId } : {}),
         role: liveRole,
         permission,
     };
@@ -273,7 +278,8 @@ export function createOrgAuthMiddleware(options) {
             const ctx = {
                 kind: 'guest',
                 shareId: guest.shareId,
-                projectId: guest.projectId,
+                ...(guest.projectId !== null ? { projectId: guest.projectId } : {}),
+                ...(guest.workspaceId !== null ? { workspaceId: guest.workspaceId } : {}),
                 guestSessionId: guest.id,
             };
             await runWithAuthContext(ctx, async () => {
@@ -326,18 +332,31 @@ export function createOrgAuthMiddleware(options) {
                     // organization table missing / adapter error — keep DEFAULT_ORG_ID
                 }
             }
+            const headerWorkspaceId = c.req.header('x-plandesk-workspace-id');
             const ctx = {
                 kind: 'loopback',
                 orgId,
                 role: 'owner',
                 permission: orgRoleToPermissionSet('owner'),
+                ...(headerWorkspaceId !== undefined && headerWorkspaceId.trim() !== ''
+                    ? { workspaceId: headerWorkspaceId.trim() }
+                    : {}),
             };
             await runWithAuthContext(ctx, async () => {
                 await next();
             });
             return;
         }
-        return c.json({ error: 'unauthorized' }, 401);
+        // No credential resolved. API/auth/mcp namespaces require a credential →
+        // 401 challenge. Any other path is not an API route, so defer to routing
+        // (SPA handler or Hono 404): an unauthenticated probe of an unknown path
+        // gets a 404, not a 401 that implies a real route exists there.
+        if (c.req.path.startsWith('/api/v1') ||
+            c.req.path.startsWith('/api/auth') ||
+            c.req.path.startsWith('/mcp')) {
+            return c.json({ error: 'unauthorized' }, 401);
+        }
+        await next();
     };
 }
 /** Optional Basic auth gate (PLANDESK_AUTH_PASSWORD). Skips MCP paths. */

package/dist/better-auth.js

@@ -35,7 +35,7 @@ import { organization } from 'better-auth/plugins';
 import { apiKey } from '@better-auth/api-key';
 import { LibsqlDialect } from '@libsql/kysely-libsql';
 import { ac, admin, member, owner } from './access-control.js';
-import { provisionPersonalOrgIfNeeded, setDefaultActiveOrganization } from './identity.js';
+import { provisionPersonalOrgIfNeeded, setDefaultActiveOrganization, setDefaultActiveTeam, } from './identity.js';
 /** Absent secret -> undefined, the supported no-auth-mounted state (REQ-5). */
 export function createBetterAuth(deps) {
     if (deps.secret === undefined || deps.secret.length === 0) {
@@ -77,14 +77,15 @@ export function createBetterAuth(deps) {
                                 if (authInstance === undefined)
                                     return;
                                 await provisionPersonalOrgIfNeeded(authInstance, appDb, session.userId);
-                                await setDefaultActiveOrganization(authInstance, session.userId, session.token);
+                                const activeOrgId = await setDefaultActiveOrganization(authInstance, session.userId, session.token);
+                                await setDefaultActiveTeam(authInstance, session.userId, session.token, activeOrgId);
                             },
                         },
                     },
                 },
             }),
         plugins: [
-            organization({ ac, roles: { owner, admin, member } }),
+            organization({ ac, roles: { owner, admin, member }, teams: { enabled: true } }),
             // enableMetadata: projectId + orgId on agent keys (BA5). Rate limit off —
             // agent traffic is bursty; ceilings are permission-based, not request-count.
             apiKey({ enableMetadata: true, rateLimit: { enabled: false } }),

package/dist/identity.d.ts

@@ -8,6 +8,12 @@ type OrganizationRow = {
     slug: string;
     createdAt: Date;
 };
+type TeamRow = {
+    id: string;
+    name: string;
+    organizationId: string;
+    createdAt: Date;
+};
 export type IdentityOrganization = Pick<OrganizationRow, 'id' | 'name' | 'slug'> & {
     role: string;
 };
@@ -18,6 +24,25 @@ export declare function resolveOrganizationsForGithubIdentity(auth: BetterAuthIn
  * Ensure the well-known local better-auth organization exists (user-less).
  * Idempotent. Used at serve boot for loopback owner-by-bind.
  */
+export declare function createTeamForOrg(auth: BetterAuthInstance, organizationId: string, name: string): Promise<TeamRow>;
+/** Read helpers for the dashboard's workspace surfaces (a workspace = a team). */
+export type WorkspaceSummary = {
+    id: string;
+    name: string;
+};
+export declare function listTeamsForOrg(auth: BetterAuthInstance, organizationId: string): Promise<WorkspaceSummary[]>;
+/** A team by id, only when it belongs to `organizationId` (no cross-org leak). */
+export declare function getTeamInOrg(auth: BetterAuthInstance, teamId: string, organizationId: string): Promise<WorkspaceSummary | undefined>;
+/** Resolve the session's active team for /auth/session, scoped to its org. */
+export declare function getActiveTeamForSession(auth: BetterAuthInstance, sessionToken: string, organizationId: string): Promise<WorkspaceSummary | undefined>;
+export declare function ensureDefaultTeamForOrg(auth: BetterAuthInstance, organizationId: string, _orgName?: string): Promise<string>;
+export declare function backfillDefaultTeams(auth: BetterAuthInstance): Promise<{
+    orgsProcessed: number;
+    teamsCreated: number;
+}>;
+export declare function backfillProjectWorkspaces(db: Db, auth: BetterAuthInstance): Promise<{
+    projectsUpdated: number;
+}>;
 export declare function ensureLocalBetterAuthOrganization(_db: Db, auth: BetterAuthInstance): Promise<OrganizationSummary>;
 export type ProvisionPersonalOrgResult = {
     created: true;
@@ -34,5 +59,14 @@ export type ProvisionPersonalOrgResult = {
 export declare function provisionPersonalOrgIfNeeded(auth: BetterAuthInstance, _db: Db, userId: string): Promise<ProvisionPersonalOrgResult>;
 /** Persist the best active organization for a newly-created session. */
 export declare function setDefaultActiveOrganization(auth: BetterAuthInstance, userId: string, sessionToken: string): Promise<string | undefined>;
+/**
+ * The workspace (team) ids in `organizationId` that `userId` is a `teamMember`
+ * of, in teamMember-row order. Gates a session member to their own workspaces
+ * (owner/admin bypass by role); also backs the active-team self-heal. Empty
+ * when the user belongs to no team in the org.
+ */
+export declare function listMemberWorkspaceIds(auth: BetterAuthInstance, userId: string, organizationId: string): Promise<string[]>;
+/** Persist the best active team for a newly-created session. */
+export declare function setDefaultActiveTeam(auth: BetterAuthInstance, userId: string, sessionToken: string, activeOrganizationId: string | undefined): Promise<string | undefined>;
 export {};
 //# sourceMappingURL=identity.d.ts.map

package/dist/identity.js

@@ -1,4 +1,4 @@
-import { DEFAULT_ORG_ID } from '@plandesk/db';
+import { DEFAULT_ORG_ID, DEFAULT_WORKSPACE_ID, updateProject } from '@plandesk/db';
 import { getOrganizationById } from './organizations.js';
 const GITHUB_PROVIDER_ID = 'github';
 const GITHUB_USER_REF_PREFIX = 'github:';
@@ -56,9 +56,138 @@ export async function resolveOrganizationsForGithubIdentity(auth, identity) {
  * Ensure the well-known local better-auth organization exists (user-less).
  * Idempotent. Used at serve boot for loopback owner-by-bind.
  */
+export async function createTeamForOrg(auth, organizationId, name) {
+    const adapter = (await auth.$context).adapter;
+    const now = new Date();
+    return adapter.create({
+        model: 'team',
+        data: {
+            name,
+            organizationId,
+            createdAt: now,
+        },
+    });
+}
+export async function listTeamsForOrg(auth, organizationId) {
+    const adapter = (await auth.$context).adapter;
+    const teams = await adapter.findMany({
+        model: 'team',
+        where: [{ field: 'organizationId', value: organizationId }],
+        sortBy: { field: 'createdAt', direction: 'asc' },
+    });
+    return teams.map((team) => ({ id: team.id, name: team.name }));
+}
+/** A team by id, only when it belongs to `organizationId` (no cross-org leak). */
+export async function getTeamInOrg(auth, teamId, organizationId) {
+    const adapter = (await auth.$context).adapter;
+    const team = await adapter.findOne({
+        model: 'team',
+        where: [
+            { field: 'id', value: teamId },
+            { field: 'organizationId', value: organizationId },
+        ],
+    });
+    return team === null ? undefined : { id: team.id, name: team.name };
+}
+/** Resolve the session's active team for /auth/session, scoped to its org. */
+export async function getActiveTeamForSession(auth, sessionToken, organizationId) {
+    const context = await auth.$context;
+    const session = await context.adapter.findOne({
+        model: 'session',
+        where: [{ field: 'token', value: sessionToken }],
+    });
+    const activeTeamId = session?.activeTeamId === undefined || session.activeTeamId === null
+        ? undefined
+        : session.activeTeamId;
+    if (activeTeamId === undefined) {
+        return undefined;
+    }
+    return getTeamInOrg(auth, activeTeamId, organizationId);
+}
+export async function ensureDefaultTeamForOrg(auth, organizationId, _orgName) {
+    const adapter = (await auth.$context).adapter;
+    const existingTeams = await adapter.findMany({
+        model: 'team',
+        where: [{ field: 'organizationId', value: organizationId }],
+    });
+    let team;
+    if (existingTeams.length > 0) {
+        team = existingTeams[0];
+    }
+    else {
+        const now = new Date();
+        const isLocalOrg = organizationId === DEFAULT_ORG_ID;
+        team = await adapter.create({
+            model: 'team',
+            data: {
+                ...(isLocalOrg ? { id: DEFAULT_WORKSPACE_ID } : {}),
+                name: 'General',
+                organizationId,
+                createdAt: now,
+            },
+            ...(isLocalOrg ? { forceAllowId: true } : {}),
+        });
+    }
+    const members = await adapter.findMany({
+        model: 'member',
+        where: [{ field: 'organizationId', value: organizationId }],
+    });
+    const existingTeamMembers = await adapter.findMany({
+        model: 'teamMember',
+        where: [{ field: 'teamId', value: team.id }],
+    });
+    const userIdsInTeam = new Set(existingTeamMembers.map((tm) => tm.userId));
+    const now = new Date();
+    for (const member of members) {
+        if (!userIdsInTeam.has(member.userId)) {
+            await adapter.create({
+                model: 'teamMember',
+                data: {
+                    teamId: team.id,
+                    userId: member.userId,
+                    createdAt: now,
+                },
+            });
+        }
+    }
+    return team.id;
+}
+export async function backfillDefaultTeams(auth) {
+    const adapter = (await auth.$context).adapter;
+    const orgs = await adapter.findMany({
+        model: 'organization',
+    });
+    let teamsCreated = 0;
+    for (const org of orgs) {
+        const existingTeams = await adapter.findMany({
+            model: 'team',
+            where: [{ field: 'organizationId', value: org.id }],
+        });
+        const hadTeam = existingTeams.length > 0;
+        await ensureDefaultTeamForOrg(auth, org.id, org.name);
+        if (!hadTeam) {
+            teamsCreated++;
+        }
+    }
+    return { orgsProcessed: orgs.length, teamsCreated };
+}
+export async function backfillProjectWorkspaces(db, auth) {
+    const result = await db.$client.execute('SELECT id, org_id, workspace_id FROM projects');
+    let projectsUpdated = 0;
+    for (const row of result.rows) {
+        const project = row;
+        const teamId = await ensureDefaultTeamForOrg(auth, project.org_id);
+        if (project.workspace_id !== teamId) {
+            await updateProject(db, project.id, { workspaceId: teamId });
+            projectsUpdated++;
+        }
+    }
+    return { projectsUpdated };
+}
 export async function ensureLocalBetterAuthOrganization(_db, auth) {
     const existing = await getOrganizationById(auth, DEFAULT_ORG_ID);
     if (existing !== undefined) {
+        await ensureDefaultTeamForOrg(auth, DEFAULT_ORG_ID, 'Personal');
         return existing;
     }
     const now = new Date();
@@ -74,6 +203,7 @@ export async function ensureLocalBetterAuthOrganization(_db, auth) {
         data,
         forceAllowId: true,
     });
+    await ensureDefaultTeamForOrg(auth, DEFAULT_ORG_ID, 'Personal');
     return {
         id: created.id,
         name: created.name,
@@ -130,6 +260,7 @@ export async function provisionPersonalOrgIfNeeded(auth, _db, userId) {
             createdAt: now,
         },
     });
+    await ensureDefaultTeamForOrg(auth, organization.id, organization.name);
     return { created: true, orgId: organization.id, role: 'owner' };
 }
 /** Persist the best active organization for a newly-created session. */
@@ -160,4 +291,54 @@ export async function setDefaultActiveOrganization(auth, userId, sessionToken) {
     await context.internalAdapter.updateSession(sessionToken, { activeOrganizationId });
     return activeOrganizationId;
 }
+/**
+ * The workspace (team) ids in `organizationId` that `userId` is a `teamMember`
+ * of, in teamMember-row order. Gates a session member to their own workspaces
+ * (owner/admin bypass by role); also backs the active-team self-heal. Empty
+ * when the user belongs to no team in the org.
+ */
+export async function listMemberWorkspaceIds(auth, userId, organizationId) {
+    const context = await auth.$context;
+    const teamMembers = await context.adapter.findMany({
+        model: 'teamMember',
+        where: [{ field: 'userId', value: userId }],
+    });
+    if (teamMembers.length === 0) {
+        return [];
+    }
+    const candidateTeamIds = teamMembers.map((tm) => tm.teamId);
+    const teams = await context.adapter.findMany({
+        model: 'team',
+        where: [{ field: 'id', value: candidateTeamIds, operator: 'in' }],
+    });
+    const orgTeamIds = new Set(teams.filter((team) => team.organizationId === organizationId).map((team) => team.id));
+    return candidateTeamIds.filter((id) => orgTeamIds.has(id));
+}
+/** Persist the best active team for a newly-created session. */
+export async function setDefaultActiveTeam(auth, userId, sessionToken, activeOrganizationId) {
+    if (activeOrganizationId === undefined) {
+        return undefined;
+    }
+    const orgTeamIds = await listMemberWorkspaceIds(auth, userId, activeOrganizationId);
+    if (orgTeamIds.length === 0) {
+        return undefined;
+    }
+    const orgTeamIdSet = new Set(orgTeamIds);
+    const context = await auth.$context;
+    const sessions = await context.adapter.findMany({
+        model: 'session',
+        where: [{ field: 'userId', value: userId }],
+        sortBy: { field: 'updatedAt', direction: 'desc' },
+    });
+    const priorActiveTeamId = sessions.find((session) => session.token !== sessionToken &&
+        session.activeTeamId !== undefined &&
+        session.activeTeamId !== null &&
+        orgTeamIdSet.has(session.activeTeamId))?.activeTeamId;
+    const activeTeamId = priorActiveTeamId ?? orgTeamIds[0];
+    if (activeTeamId === undefined) {
+        return undefined;
+    }
+    await context.internalAdapter.updateSession(sessionToken, { activeTeamId });
+    return activeTeamId;
+}
 //# sourceMappingURL=identity.js.map

package/dist/index.d.ts

@@ -1,13 +1,13 @@
 export { createApp, type AppDeps } from './server.js';
 export { createBetterAuth, runBetterAuthMigrations, type BetterAuthDeps, type BetterAuthInstance, } from './better-auth.js';
-export { ensureLocalBetterAuthOrganization } from './identity.js';
+export { backfillDefaultTeams, backfillProjectWorkspaces, createTeamForOrg, ensureDefaultTeamForOrg, ensureLocalBetterAuthOrganization, listTeamsForOrg, } from './identity.js';
 export { createAuthMiddleware, createOrgAuthMiddleware, createWriteGuardMiddleware, isLoopbackBind, isPublicAuthPath, isInvitationAcceptPath, type OrgAuthOptions, } from './auth.js';
 export { acceptOrganizationInvitation, createOrganizationInvitation, ensureShellOwner, invitationClaimUrl, isAuthApiError, isInvitationRole, mintOwnerInvitation, mintSessionCookieHeader, removeOrganizationMember, updateOrganizationMemberRole, INVITATION_ROLES, type InvitationRole, } from './invitations.js';
 export { authorizeUrl, githubConfigFromEnv, resolveGithubIdentity, userRefFromGithubId, GithubOAuthError, type FetchLike, type GithubConfig, type GithubEnv, type GithubIdentity, } from './github.js';
 export { GUEST_SESSION_COOKIE, readGuestSessionCookie } from './session.js';
 export { createAuthRouter, type AuthRouterDeps } from './routes/auth.js';
 export { runWithAuthContext, tryGetAuthContext, getAuthContext, ReadOnlyTokenError, type AuthContext, } from './auth-context.js';
-export { applyAgentKeyPermissionCeiling, createScopedAgentKey, createOrgOwnerKey, verifyBetterAuthApiKey, DEFAULT_AGENT_KEY_PERMISSIONS, DEFAULT_OWNER_KEY_PERMISSIONS, AGENT_FORBIDDEN_RESOURCES, type ApiKeyKind, type CreateScopedAgentKeyInput, type CreatedScopedAgentKey, type CreateOrgOwnerKeyInput, type CreatedOrgOwnerKey, type VerifiedApiKey, } from './agent-keys.js';
+export { applyAgentKeyPermissionCeiling, createScopedAgentKey, createWorkspaceScopedAgentKey, createOrgOwnerKey, verifyBetterAuthApiKey, DEFAULT_AGENT_KEY_PERMISSIONS, DEFAULT_OWNER_KEY_PERMISSIONS, AGENT_FORBIDDEN_RESOURCES, type ApiKeyKind, type CreateScopedAgentKeyInput, type CreatedScopedAgentKey, type CreateWorkspaceScopedAgentKeyInput, type CreatedWorkspaceScopedAgentKey, type CreateOrgOwnerKeyInput, type CreatedOrgOwnerKey, type VerifiedApiKey, } from './agent-keys.js';
 export { requirePermission, hasPermission, hasAnyWritePermission, orgRoleToPermissionSet, PermissionDeniedError, type PermissionSet, } from './permissions.js';
 export { healthRouter } from './routes/health.js';
 export { mountStatic } from './static.js';

package/dist/index.js

@@ -1,13 +1,13 @@
 export { createApp } from './server.js';
 export { createBetterAuth, runBetterAuthMigrations, } from './better-auth.js';
-export { ensureLocalBetterAuthOrganization } from './identity.js';
+export { backfillDefaultTeams, backfillProjectWorkspaces, createTeamForOrg, ensureDefaultTeamForOrg, ensureLocalBetterAuthOrganization, listTeamsForOrg, } from './identity.js';
 export { createAuthMiddleware, createOrgAuthMiddleware, createWriteGuardMiddleware, isLoopbackBind, isPublicAuthPath, isInvitationAcceptPath, } from './auth.js';
 export { acceptOrganizationInvitation, createOrganizationInvitation, ensureShellOwner, invitationClaimUrl, isAuthApiError, isInvitationRole, mintOwnerInvitation, mintSessionCookieHeader, removeOrganizationMember, updateOrganizationMemberRole, INVITATION_ROLES, } from './invitations.js';
 export { authorizeUrl, githubConfigFromEnv, resolveGithubIdentity, userRefFromGithubId, GithubOAuthError, } from './github.js';
 export { GUEST_SESSION_COOKIE, readGuestSessionCookie } from './session.js';
 export { createAuthRouter } from './routes/auth.js';
 export { runWithAuthContext, tryGetAuthContext, getAuthContext, ReadOnlyTokenError, } from './auth-context.js';
-export { applyAgentKeyPermissionCeiling, createScopedAgentKey, createOrgOwnerKey, verifyBetterAuthApiKey, DEFAULT_AGENT_KEY_PERMISSIONS, DEFAULT_OWNER_KEY_PERMISSIONS, AGENT_FORBIDDEN_RESOURCES, } from './agent-keys.js';
+export { applyAgentKeyPermissionCeiling, createScopedAgentKey, createWorkspaceScopedAgentKey, createOrgOwnerKey, verifyBetterAuthApiKey, DEFAULT_AGENT_KEY_PERMISSIONS, DEFAULT_OWNER_KEY_PERMISSIONS, AGENT_FORBIDDEN_RESOURCES, } from './agent-keys.js';
 export { requirePermission, hasPermission, hasAnyWritePermission, orgRoleToPermissionSet, PermissionDeniedError, } from './permissions.js';
 export { healthRouter } from './routes/health.js';
 export { mountStatic } from './static.js';

package/dist/invitations.d.ts

@@ -8,6 +8,8 @@ type InvitationRow = {
     email: string;
     role: string;
     organizationId: string;
+    /** better-auth stores team ids comma-joined; null when no team. */
+    teamId: string | null;
     inviterId: string;
     status: string;
     expiresAt: Date;
@@ -30,18 +32,24 @@ export type AuthApiErrorShape = {
 };
 export declare function isAuthApiError(err: unknown): err is AuthApiErrorShape;
 /**
- * Create an invitation using the caller's better-auth session (Cookie headers).
- * No mailer: sendInvitationEmail is unset; caller delivers claimUrl by hand.
+ * Create a workspace-scoped invitation using the caller's better-auth session
+ * (Cookie headers). The invitee joins the org AND the team on accept
+ * (better-auth does both when teamId is set). No mailer: caller delivers
+ * claimUrl by hand.
  */
 export declare function createOrganizationInvitation(auth: BetterAuthInstance, opts: {
     email: string;
     role: InvitationRole;
     organizationId: string;
+    /** Workspace (better-auth team) the invitee will join. Required. */
+    teamId: string;
     headers: Headers;
     baseURL: string;
 }): Promise<{
     invitationId: string;
     claimUrl: string;
+    organizationId: string;
+    teamId: string;
     invitation: InvitationRow;
 }>;
 /**
@@ -81,6 +89,9 @@ export declare function ensureShellOwner(auth: BetterAuthInstance, organizationI
 }>;
 /**
  * Shell-side owner invitation for `plandesk admin invite-owner` (no GitHub, no mailer).
+ * The owner role is org-level; teamId targets the org's default workspace so
+ * the bootstrap satisfies the workspace-scoped invite contract (the owner
+ * reaches every workspace via the owner role regardless).
  */
 export declare function mintOwnerInvitation(auth: BetterAuthInstance, opts: {
     email: string;