@protobase/server 0.22.0 → 0.22.1

package/dist/better-auth/invitations/invitation-endpoints.js

@@ -0,0 +1,102 @@
+import { noGlobalRole } from "../organizations/role-definitions.js";
+import { findOrganization } from "../organizations/store.js";
+import { acceptInvitation } from "../organizations/accept-invitation.js";
+import { deleteAppInvitation } from "../users/app-invitation-store.js";
+import { createInvitedAccount, signInInvitedAccount } from "./account-from-invitation.js";
+import { invitationOfToken } from "./invitation-of-token.js";
+import * as z$1 from "zod";
+import { APIError, createAuthEndpoint } from "better-auth/api";
+//#region src/better-auth/invitations/invitation-endpoints.ts
+const tokenQuery = z$1.object({ token: z$1.string().min(1) });
+/**
+* The endpoints an emailed invitation link opens, to the app or, with organizations, to one of them: what it is for,
+* and creating an account from it for someone who has none. Open sign-up stays off; an invitation is an address someone
+* vouched for, and the link in the mail proves the person reads it. Accepting an organization's invitation signed in is
+* the organization plugin's.
+*/
+const invitationEndpoints = ({ mail, organizations }) => ({
+	/**
+	* `GET /invitation?token=`: who invites, the address and roles, until when, and whether the address has an account;
+	* for an invitation to the app also the app's name, and for an organization's the organization and the role there.
+	*/
+	getInvitation: createAuthEndpoint("/invitation", {
+		method: "GET",
+		query: tokenQuery
+	}, async (ctx) => {
+		const found = await invitationOfToken(ctx.context, ctx.query.token, { organizations: Boolean(organizations) });
+		const { invitation } = found;
+		const inviter = await ctx.context.internalAdapter.findUserById(invitation.inviterId);
+		const account = await ctx.context.internalAdapter.findUserByEmail(invitation.email.toLowerCase());
+		const common = {
+			inviter: { name: inviter?.name || inviter?.email || "" },
+			email: invitation.email,
+			expiresAt: new Date(invitation.expiresAt).toISOString(),
+			hasAccount: Boolean(account)
+		};
+		if (found.kind === "app") return ctx.json({
+			app: { name: ctx.context.appName },
+			...common,
+			appRoles: found.invitation.roles
+		});
+		const organization = await findOrganization(ctx.context.adapter, found.invitation.organizationId);
+		return ctx.json({
+			organization: {
+				id: found.invitation.organizationId,
+				name: organization?.name ?? ""
+			},
+			...common,
+			role: found.invitation.role,
+			appRoles: found.invitation.appRoles
+		});
+	}),
+	/**
+	* `POST /invitation/sign-up` with `{ token, name, password? }`, for an address without an account: creates it, as
+	* verified, and signs the person in. An invitation to the app gives the account its roles; one to an organization
+	* gives no global role, and accepts the membership, where the session then works.
+	*/
+	signUpFromInvitation: createAuthEndpoint("/invitation/sign-up", {
+		method: "POST",
+		body: z$1.object({
+			token: z$1.string().min(1),
+			name: z$1.string().trim().min(1).max(200),
+			password: z$1.string().optional()
+		})
+	}, async (ctx) => {
+		const found = await invitationOfToken(ctx.context, ctx.body.token, { organizations: Boolean(organizations) });
+		const { email } = found.invitation;
+		if (await ctx.context.internalAdapter.findUserByEmail(email.toLowerCase())) {
+			const message = found.kind === "app" ? "This address has an account already: sign in." : "This address has an account already: sign in to accept the invitation.";
+			throw new APIError("BAD_REQUEST", {
+				code: "ACCOUNT_EXISTS",
+				message
+			});
+		}
+		const account = {
+			email,
+			name: ctx.body.name,
+			...ctx.body.password !== void 0 && { password: ctx.body.password },
+			mail
+		};
+		if (found.kind === "app") {
+			const user = await createInvitedAccount(ctx, {
+				...account,
+				role: found.invitation.roles.join(",")
+			});
+			await deleteAppInvitation(ctx.context, found.invitation.id);
+			await signInInvitedAccount(ctx, user);
+			return ctx.json({ user: {
+				id: user.id,
+				email: user.email
+			} });
+		}
+		const user = await createInvitedAccount(ctx, {
+			...account,
+			role: noGlobalRole
+		});
+		const member = await acceptInvitation(ctx.context, found.invitation, user, organizations.membershipLimit);
+		await signInInvitedAccount(ctx, user, found.invitation.organizationId);
+		return ctx.json({ member });
+	})
+});
+//#endregion
+export { invitationEndpoints };

package/dist/better-auth/invitations/invitation-link-hook.js

@@ -0,0 +1,34 @@
+import { invitationLink, invitationToken } from "./invitation-token.js";
+import { createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/invitations/invitation-link-hook.ts
+/**
+* Without a mailer an invitation cannot be emailed, so whoever invites, at one of `paths`, gets its link in the answer,
+* once, to pass on. The answer carries the invitation's `id` and `expiresAt`. Inviting again gives a new link, since it
+* moves the expiry.
+*/
+const invitationLinkHook = (paths, invitationUrl) => ({
+	matcher: (context) => paths.includes(context.path ?? ""),
+	handler: createAuthMiddleware(async (ctx) => {
+		const answer = await withInvitationLink(ctx.context.returned, ctx.context.secret, invitationUrl);
+		if (answer) ctx.context.returned = answer;
+	})
+});
+/** An invitation's answer with its `link` added; `undefined` for an error or an answer without an invitation. */
+const withInvitationLink = async (returned, secret, invitationUrl) => {
+	const answer = returned;
+	if (!answer || answer instanceof Response || answer instanceof Error || !answer.id || !answer.expiresAt) return void 0;
+	const token = await invitationToken(secret, {
+		id: answer.id,
+		expiresAt: new Date(answer.expiresAt)
+	});
+	return {
+		...answer,
+		link: invitationLink(invitationUrl, token)
+	};
+};
+/** The page an invitation link opens, with `?token=`, unless the app names another. */
+const defaultInvitationUrl = (baseURL) => `${baseURL.replace(/\/$/, "")}/-/invitation`;
+/** How long an invitation works unless the app says otherwise: 7 days, in seconds. */
+const defaultInvitationSeconds = 604800;
+//#endregion
+export { defaultInvitationSeconds, defaultInvitationUrl, invitationLinkHook, withInvitationLink };

package/dist/better-auth/invitations/invitation-of-token.js

@@ -0,0 +1,24 @@
+import { invalidInvitation, invitationIdOf, verifyInvitationToken } from "./invitation-token.js";
+import { invitationOfToken as invitationOfToken$1 } from "../organizations/accept-invitation.js";
+import { findAppInvitation } from "../users/app-invitation-store.js";
+import { APIError } from "better-auth/api";
+//#region src/better-auth/invitations/invitation-of-token.ts
+/** The pending invitation an emailed link's token names, either kind, or a 400 `INVITATION_INVALID`. */
+const invitationOfToken = async (context, token, { organizations }) => {
+	const id = invitationIdOf(token);
+	const app = id ? await findAppInvitation(context, id) : void 0;
+	if (app) {
+		if (!await verifyInvitationToken(context.secret, token, app)) throw new APIError("BAD_REQUEST", invalidInvitation);
+		return {
+			kind: "app",
+			invitation: app
+		};
+	}
+	if (!organizations) throw new APIError("BAD_REQUEST", invalidInvitation);
+	return {
+		kind: "organization",
+		invitation: await invitationOfToken$1(context, token)
+	};
+};
+//#endregion
+export { invitationOfToken };

package/dist/better-auth/{organizations → invitations}/invitation-token.js

@@ -1,4 +1,4 @@
-//#region src/better-auth/organizations/invitation-token.ts
+//#region src/better-auth/invitations/invitation-token.ts
 const encoder = new TextEncoder();
 const base64url = (bytes) => btoa(String.fromCharCode(...new Uint8Array(bytes))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 const signature = async (secret, id, expiresAt) => {
@@ -23,5 +23,10 @@ const verifyInvitationToken = async (secret, token, invitation) => {
 };
 /** The link in the email: the app's invitation page with the token. */
 const invitationLink = (pageUrl, token) => `${pageUrl}?token=${encodeURIComponent(token)}`;
+/** Why a link's token finds no pending invitation, of either kind: the body of its 400. */
+const invalidInvitation = {
+	code: "INVITATION_INVALID",
+	message: "This invitation link is not valid any more: it was used, revoked, replaced by a newer one, or it expired."
+};
 //#endregion
-export { invitationIdOf, invitationLink, invitationToken, verifyInvitationToken };
+export { invalidInvitation, invitationIdOf, invitationLink, invitationToken, verifyInvitationToken };

package/dist/better-auth/last-admin-guard.js

@@ -0,0 +1,62 @@
+import { parseRoles } from "./parse-roles.js";
+import { wouldLeaveNoAdmin } from "./last-admin.js";
+import { APIError, createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/last-admin-guard.ts
+const rolesOf = (role) => typeof role === "string" || Array.isArray(role) ? parseRoles(role) : void 0;
+/** The change an admin endpoint makes to its user, from its path and body; `undefined` when it touches no role or block. */
+const adminChange = (path, body) => {
+	if (typeof body.userId !== "string") return void 0;
+	const userId = body.userId;
+	if (path === "/admin/set-role") return {
+		userId,
+		roles: rolesOf(body.role) ?? []
+	};
+	if (path === "/admin/ban-user") return {
+		userId,
+		banned: true
+	};
+	if (path === "/admin/remove-user") return {
+		userId,
+		removed: true
+	};
+	if (path !== "/admin/update-user") return void 0;
+	const roles = rolesOf(body.data?.role);
+	const banned = typeof body.data?.banned === "boolean" ? body.data.banned : void 0;
+	if (roles === void 0 && banned === void 0) return void 0;
+	return {
+		userId,
+		...roles && { roles },
+		...banned !== void 0 && { banned }
+	};
+};
+const guardedPaths = [
+	"/admin/set-role",
+	"/admin/ban-user",
+	"/admin/remove-user",
+	"/admin/update-user"
+];
+/** Refuses, with `400 LAST_ADMIN`, an admin endpoint that would demote, block or remove the last active admin. */
+const lastAdminGuardPlugin = () => ({
+	id: "protobase-last-admin",
+	hooks: { before: [{
+		matcher: (ctx) => guardedPaths.includes(ctx.path ?? ""),
+		handler: createAuthMiddleware(async (ctx) => {
+			const change = adminChange(ctx.path, ctx.body ?? {});
+			if (!change) return;
+			const users = await ctx.context.adapter.findMany({
+				model: "user",
+				select: [
+					"id",
+					"role",
+					"banned"
+				]
+			});
+			if (wouldLeaveNoAdmin(users, change)) throw new APIError("BAD_REQUEST", {
+				code: "LAST_ADMIN",
+				message: "This is the last admin: make someone else an admin first."
+			});
+		})
+	}] }
+});
+//#endregion
+export { adminChange, lastAdminGuardPlugin };

package/dist/better-auth/last-admin.js

@@ -0,0 +1,18 @@
+import { parseRoles } from "./parse-roles.js";
+//#region src/better-auth/last-admin.ts
+/** Holds the admin role and is not blocked: the last of these can never be demoted, blocked or removed. */
+const isActiveAdmin = (user) => parseRoles(user.role).includes("admin") && !user.banned;
+/** Whether `change` would leave `users` without an active admin, while they have one now. */
+const wouldLeaveNoAdmin = (users, change) => {
+	const target = users.find((user) => user.id === change.userId);
+	if (!target || !isActiveAdmin(target)) return false;
+	if (change.removed) return users.filter(isActiveAdmin).length <= 1;
+	const after = {
+		...target,
+		...change.roles && { role: change.roles },
+		...change.banned !== void 0 && { banned: change.banned }
+	};
+	return !isActiveAdmin(after) && users.filter(isActiveAdmin).length <= 1;
+};
+//#endregion
+export { isActiveAdmin, wouldLeaveNoAdmin };

package/dist/better-auth/organizations/accept-invitation.js

@@ -1,12 +1,8 @@
+import { invalidInvitation, invitationIdOf, verifyInvitationToken } from "../invitations/invitation-token.js";
 import { parseAppRoles } from "./app-roles.js";
 import { findMember, membersOf } from "./store.js";
-import { invitationIdOf, verifyInvitationToken } from "./invitation-token.js";
 import { APIError } from "better-auth/api";
 //#region src/better-auth/organizations/accept-invitation.ts
-const invalid = {
-	code: "INVITATION_INVALID",
-	message: "This invitation link is not valid any more: it was used, revoked, replaced by a newer one, or it expired."
-};
 /** The pending invitation an emailed link's token names, or a 400 `INVITATION_INVALID`. */
 const invitationOfToken = async (context, token) => {
 	const id = invitationIdOf(token);
@@ -17,8 +13,8 @@ const invitationOfToken = async (context, token) => {
 			value: id
 		}]
 	});
-	if (!row || !await verifyInvitationToken(context.secret, token, row)) throw new APIError("BAD_REQUEST", invalid);
-	if (row.status !== "pending" || new Date(row.expiresAt).getTime() < Date.now()) throw new APIError("BAD_REQUEST", invalid);
+	if (!row || !await verifyInvitationToken(context.secret, token, row)) throw new APIError("BAD_REQUEST", invalidInvitation);
+	if (row.status !== "pending" || new Date(row.expiresAt).getTime() < Date.now()) throw new APIError("BAD_REQUEST", invalidInvitation);
 	return {
 		...row,
 		appRoles: parseAppRoles(row.appRoles)
@@ -60,7 +56,7 @@ const acceptInvitation = async (context, invitation, user, membershipLimit) => {
 				value: "pending"
 			}],
 			update: { status: "accepted" }
-		})) throw new APIError("BAD_REQUEST", invalid);
+		})) throw new APIError("BAD_REQUEST", invalidInvitation);
 		return {
 			...await trx.create({
 				model: "member",

package/dist/better-auth/organizations/invitation-endpoints.js

@@ -1,120 +1,23 @@
-import { noGlobalRole } from "./role-definitions.js";
-import { findOrganization } from "./store.js";
-import { invitationLink, invitationToken } from "./invitation-token.js";
-import { checkNewAccountPassword } from "../new-account-password.js";
-import { effectiveSignInPolicy } from "../sign-in-policy.js";
-import { readSignInPolicy } from "../policy-store.js";
 import { acceptInvitation, invitationOfToken } from "./accept-invitation.js";
 import * as z$1 from "zod";
-import { APIError, createAuthEndpoint, createAuthMiddleware, sessionMiddleware } from "better-auth/api";
-import { setSessionCookie } from "better-auth/cookies";
+import { createAuthEndpoint, sessionMiddleware } from "better-auth/api";
 //#region src/better-auth/organizations/invitation-endpoints.ts
-const tokenBody = z$1.object({ token: z$1.string().min(1) });
-const startIn = (context, sessionToken, organizationId) => context.internalAdapter.updateSession(sessionToken, { activeOrganizationId: organizationId });
 /**
-* The endpoints an emailed invitation link uses: what it is for, accepting it signed in, and creating an account from it
-* for someone who has none. Open sign-up stays off; an invitation is an address someone vouched for, and the link in
-* the mail proves the person reads it.
+* Accepting an organization's emailed invitation signed in. What a link is for, and making an account from it, are the
+* shared invitation endpoints (`invitations/invitation-endpoints.ts`), which serve invitations to the app as well.
 */
-const invitationEndpoints = ({ resolved, mail }) => ({
-	/** `GET /invitation?token=`: the organization, who invites, the address and roles, until when, and whether the address has an account. */
-	getInvitation: createAuthEndpoint("/invitation", {
-		method: "GET",
-		query: tokenBody
-	}, async (ctx) => {
-		const invitation = await invitationOfToken(ctx.context, ctx.query.token);
-		const organization = await findOrganization(ctx.context.adapter, invitation.organizationId);
-		const inviter = await ctx.context.internalAdapter.findUserById(invitation.inviterId);
-		const account = await ctx.context.internalAdapter.findUserByEmail(invitation.email.toLowerCase());
-		return ctx.json({
-			organization: {
-				id: invitation.organizationId,
-				name: organization?.name ?? ""
-			},
-			inviter: { name: inviter?.name || inviter?.email || "" },
-			email: invitation.email,
-			role: invitation.role,
-			appRoles: invitation.appRoles,
-			expiresAt: new Date(invitation.expiresAt).toISOString(),
-			hasAccount: Boolean(account)
-		});
-	}),
-	/** `POST /invitation/accept` with `{ token }`, signed in as the invited address: becomes a member, and works there. */
-	acceptInvitation: createAuthEndpoint("/invitation/accept", {
-		method: "POST",
-		body: tokenBody,
-		use: [sessionMiddleware]
-	}, async (ctx) => {
-		const invitation = await invitationOfToken(ctx.context, ctx.body.token);
-		const { user, session } = ctx.context.session;
-		const member = await acceptInvitation(ctx.context, invitation, user, resolved.membershipLimit);
-		await startIn(ctx.context, session.token, invitation.organizationId);
-		return ctx.json({ member });
-	}),
-	/**
-	* `POST /invitation/sign-up` with `{ token, name, password? }`, for an address without an account: creates it, as
-	* verified and with no global role, accepts the invitation and signs the person in there. A password is needed unless
-	* the sign-in policy offers emailed codes; the policy's required methods are then set up as after any sign-in.
-	*/
-	signUpFromInvitation: createAuthEndpoint("/invitation/sign-up", {
-		method: "POST",
-		body: z$1.object({
-			token: z$1.string().min(1),
-			name: z$1.string().trim().min(1).max(200),
-			password: z$1.string().optional()
-		})
-	}, async (ctx) => {
-		const invitation = await invitationOfToken(ctx.context, ctx.body.token);
-		const { internalAdapter } = ctx.context;
-		if (await internalAdapter.findUserByEmail(invitation.email.toLowerCase())) throw new APIError("BAD_REQUEST", {
-			code: "ACCOUNT_EXISTS",
-			message: "This address has an account already: sign in to accept the invitation."
-		});
-		const { password } = ctx.body;
-		checkNewAccountPassword(effectiveSignInPolicy((await readSignInPolicy(ctx.context.adapter)).policy, { mail }), password);
-		const user = await internalAdapter.createUser({
-			email: invitation.email.toLowerCase(),
-			name: ctx.body.name,
-			emailVerified: true,
-			role: noGlobalRole
-		}, { method: "invitation" });
-		if (password !== void 0) await internalAdapter.linkAccount({
-			userId: user.id,
-			providerId: "credential",
-			accountId: user.id,
-			password: await ctx.context.password.hash(password)
-		});
-		const member = await acceptInvitation(ctx.context, invitation, user, resolved.membershipLimit);
-		const session = await internalAdapter.createSession(user.id, false);
-		await startIn(ctx.context, session.token, invitation.organizationId);
-		await setSessionCookie(ctx, {
-			session: {
-				...session,
-				activeOrganizationId: invitation.organizationId
-			},
-			user
-		});
-		return ctx.json({ member });
-	})
-});
-/**
-* Without a mailer the invitation cannot be emailed, so whoever invites gets its link in the answer, once, to pass on.
-* Resending gives a new link, since it moves the expiry.
-*/
-const invitationLinkHook = (resolved) => ({
-	matcher: (context) => context.path === "/organization/invite-member",
-	handler: createAuthMiddleware(async (ctx) => {
-		const returned = ctx.context.returned;
-		if (!returned || returned instanceof Response || returned instanceof Error || !returned.id || !returned.expiresAt) return;
-		const token = await invitationToken(ctx.context.secret, {
-			id: returned.id,
-			expiresAt: new Date(returned.expiresAt)
-		});
-		ctx.context.returned = {
-			...returned,
-			link: invitationLink(resolved.invitationUrl, token)
-		};
-	})
-});
+const invitationEndpoints = ({ resolved }) => ({ 
+/** `POST /invitation/accept` with `{ token }`, signed in as the invited address: becomes a member, and works there. */
+acceptInvitation: createAuthEndpoint("/invitation/accept", {
+	method: "POST",
+	body: z$1.object({ token: z$1.string().min(1) }),
+	use: [sessionMiddleware]
+}, async (ctx) => {
+	const invitation = await invitationOfToken(ctx.context, ctx.body.token);
+	const { user, session } = ctx.context.session;
+	const member = await acceptInvitation(ctx.context, invitation, user, resolved.membershipLimit);
+	await ctx.context.internalAdapter.updateSession(session.token, { activeOrganizationId: invitation.organizationId });
+	return ctx.json({ member });
+}) });
 //#endregion
-export { invitationEndpoints, invitationLinkHook };
+export { invitationEndpoints };

package/dist/better-auth/organizations/options.js

@@ -1,3 +1,4 @@
+import { defaultInvitationUrl } from "../invitations/invitation-link-hook.js";
 import { membershipRoles } from "./role-definitions.js";
 //#region src/better-auth/organizations/options.ts
 const resolveOrganizations = (options, definitions, baseURL) => {
@@ -15,7 +16,7 @@ const resolveOrganizations = (options, definitions, baseURL) => {
 		membershipLimit: options.membershipLimit ?? 1e3,
 		generateId: options.generateId ?? (() => crypto.randomUUID()),
 		deleteRecords: options.deleteRecords ?? "refuse",
-		invitationUrl: options.invitationUrl ?? `${baseURL.replace(/\/$/, "")}/-/invitation`,
+		invitationUrl: options.invitationUrl ?? defaultInvitationUrl(baseURL),
 		options
 	};
 };

package/dist/better-auth/organizations/organization-plugin.js

@@ -1,8 +1,8 @@
+import { invitationLink, invitationToken } from "../invitations/invitation-token.js";
 import "./role-definitions.js";
 import { checkAppRoleChange, effectiveRoles, globalRoles, parseAppRoles } from "./app-roles.js";
 import { findMember } from "./store.js";
 import { sendAuthEmail } from "../auth-mail/send-auth-email.js";
-import { invitationLink, invitationToken } from "./invitation-token.js";
 import { APIError } from "better-auth/api";
 import { organization } from "better-auth/plugins/organization";
 //#region src/better-auth/organizations/organization-plugin.ts

package/dist/better-auth/organizations/protobase-plugin.js

@@ -1,21 +1,19 @@
-import { invitationEndpoints, invitationLinkHook } from "./invitation-endpoints.js";
+import { invitationLinkHook } from "../invitations/invitation-link-hook.js";
+import { invitationEndpoints } from "./invitation-endpoints.js";
 import { memberEndpoints } from "./member-endpoints.js";
 //#region src/better-auth/organizations/protobase-plugin.ts
 /**
-* Protobase's endpoints beside Better Auth's organization plugin: invitation links that also make accounts, app roles,
-* handing ownership over, and finding organizations for people with a global role. Without a mailer, whoever invites
-* gets the link in the answer.
+* Protobase's endpoints beside Better Auth's organization plugin: accepting invitations signed in, app roles, handing
+* ownership over, and finding organizations for people with a global role. Without a mailer, whoever invites gets the
+* link in the answer.
 */
 const protobaseOrganizationPlugin = ({ resolved, mail }) => ({
 	id: "protobase-organizations",
 	endpoints: {
-		...invitationEndpoints({
-			resolved,
-			mail
-		}),
+		...invitationEndpoints({ resolved }),
 		...memberEndpoints({ resolved })
 	},
-	hooks: { after: mail ? [] : [invitationLinkHook(resolved)] }
+	hooks: { after: mail ? [] : [invitationLinkHook(["/organization/invite-member"], resolved.invitationUrl)] }
 });
 //#endregion
 export { protobaseOrganizationPlugin };

package/dist/better-auth/organizations/role-definitions.js

@@ -5,10 +5,10 @@ const superuserRole = "admin";
 /** The admin plugin's role for an account without a global role; in organization mode it grants nothing. */
 const noGlobalRole = "user";
 const organizationRoleNames = ["owner", "member"];
-const builtInLabels = {
+const builtInLabels = (organizations) => ({
 	[superuserRole]: "Superuser",
-	[noGlobalRole]: "No global role"
-};
+	[noGlobalRole]: organizations ? "No global role" : "User"
+});
 const entriesOf = (input) => Array.isArray(input) ? input.map((name) => [name, void 0]) : Object.entries(input);
 /**
 * The roles with `admin` first (added when missing), their labels and grants. With `organizations`, every role needs a
@@ -26,10 +26,11 @@ const roleDefinitions = (input = ["admin", "user"], { organizations = false } =
 		...organizations && !given.has("user") ? [noGlobalRole] : []
 	];
 	const labels = {};
+	const builtIn = builtInLabels(organizations);
 	const grants = {};
 	for (const name of names) {
 		const definition = given.get(name);
-		const label = typeof definition === "string" ? definition : definition?.label ?? builtInLabels[name];
+		const label = typeof definition === "string" ? definition : definition?.label ?? builtIn[name];
 		if (label !== void 0) labels[name] = label;
 		grants[name] = typeof definition === "object" ? definition.grants ?? [] : [];
 		const unknown = grants[name].find((granted) => !names.includes(granted));

package/dist/better-auth/passkey-plugin.js

@@ -1,9 +1,9 @@
 import { pluginNames } from "./snake-case-names.js";
 import * as z$1 from "zod";
 import { APIError, createAuthEndpoint, getSessionFromCtx } from "better-auth/api";
-import { setSessionCookie } from "better-auth/cookies";
 import { PASSKEY_ERROR_CODES, passkey } from "@better-auth/passkey";
 import { generateAuthenticationOptions, verifyAuthenticationResponse } from "@simplewebauthn/server";
+import { setSessionCookie } from "better-auth/cookies";
 import { generateRandomString } from "better-auth/crypto";
 //#region src/better-auth/passkey-plugin.ts
 const challengeCookie = "better-auth-passkey";

package/dist/better-auth/roles/role-labels.js

@@ -0,0 +1,14 @@
+import { membershipRoles } from "../organizations/role-definitions.js";
+//#region src/better-auth/roles/role-labels.ts
+/** Every role with its label, `membership` for those a member can hold, and the roles each one's holders may also give. */
+const roleLabels = (definitions) => {
+	const membership = membershipRoles(definitions);
+	return definitions.names.map((name) => ({
+		name,
+		label: definitions.labels[name] ?? name,
+		membership: membership.includes(name),
+		grants: definitions.grants[name] ?? []
+	}));
+};
+//#endregion
+export { roleLabels };

package/dist/better-auth/sign-up/sign-up-plugin.js

@@ -1,7 +1,7 @@
 import { sendAuthEmail } from "../auth-mail/send-auth-email.js";
-import { checkNewAccountPassword } from "../new-account-password.js";
 import { effectiveSignInPolicy } from "../sign-in-policy.js";
 import { readSignInPolicy } from "../policy-store.js";
+import { checkNewAccountPassword } from "../new-account-password.js";
 import { consumeSignUpCode, issueSignUpCode, signUpCodeLifetime } from "./sign-up-code.js";
 import { consumeSignUpTicket, issueSignUpTicket } from "./sign-up-ticket.js";
 import * as z$1 from "zod";

package/dist/better-auth/status-route.js

@@ -1,7 +1,7 @@
-import { membershipRoles } from "./organizations/role-definitions.js";
+import { signInPasskeyDomains } from "./passkey-domain.js";
 import { effectiveSignInPolicy } from "./sign-in-policy.js";
 import { readSignInPolicy } from "./policy-store.js";
-import { signInPasskeyDomains } from "./passkey-domain.js";
+import { roleLabels } from "./roles/role-labels.js";
 import { hasUsers } from "./users.js";
 import { Hono } from "hono";
 //#region src/better-auth/status-route.ts
@@ -46,12 +46,7 @@ const statusRoute = (auth, { anonymous = false, plugins = [] } = {}) => {
 			...plugins.length > 0 && { plugins },
 			...auth.organizations && { organizations: {
 				create: auth.organizations.create,
-				roles: auth.roleDefinitions.names.map((name) => ({
-					name,
-					label: auth.roleDefinitions.labels[name] ?? name,
-					membership: membershipRoles(auth.roleDefinitions).includes(name),
-					grants: auth.roleDefinitions.grants[name] ?? []
-				}))
+				roles: roleLabels(auth.roleDefinitions)
 			} }
 		});
 	});

package/dist/better-auth/users/app-invitation-store.js

@@ -0,0 +1,62 @@
+//#region src/better-auth/users/app-invitation-store.ts
+const prefix = "app-invitation:";
+const invitationOf = (row) => {
+	const { email, roles, inviterId } = JSON.parse(row.value);
+	return {
+		id: row.identifier.slice(15),
+		email,
+		roles,
+		inviterId,
+		expiresAt: new Date(row.expiresAt)
+	};
+};
+const pending = (invitation) => invitation.expiresAt.getTime() > Date.now();
+const allAppInvitations = async (context) => {
+	return (await context.adapter.findMany({
+		model: "verification",
+		where: [{
+			field: "identifier",
+			operator: "starts_with",
+			value: prefix
+		}],
+		sortBy: {
+			field: "createdAt",
+			direction: "asc"
+		},
+		limit: 1e5
+	})).map(invitationOf);
+};
+/** The pending app invitations, oldest first; expired ones are left out. */
+const listAppInvitations = async (context) => (await allAppInvitations(context)).filter(pending);
+/** The pending app invitation with `id`, or `undefined` when there is none or it expired. */
+const findAppInvitation = async (context, id) => {
+	const row = await context.internalAdapter.findVerificationValue(`${prefix}${id}`);
+	const invitation = row ? invitationOf(row) : void 0;
+	return invitation && pending(invitation) ? invitation : void 0;
+};
+const deleteAppInvitation = (context, id) => context.internalAdapter.deleteVerificationByIdentifier(`${prefix}${id}`);
+/** Invites `email` with `roles` for `lifetimeSeconds`; an earlier invitation of the same address is replaced, so its link stops working. */
+const createAppInvitation = async (context, input, lifetimeSeconds) => {
+	const email = input.email.toLowerCase();
+	const earlier = (await allAppInvitations(context)).filter((invitation) => invitation.email === email);
+	for (const invitation of earlier) await deleteAppInvitation(context, invitation.id);
+	const invitation = {
+		id: crypto.randomUUID(),
+		email,
+		roles: input.roles,
+		inviterId: input.inviterId,
+		expiresAt: new Date(Date.now() + lifetimeSeconds * 1e3)
+	};
+	await context.internalAdapter.createVerificationValue({
+		identifier: `${prefix}${invitation.id}`,
+		value: JSON.stringify({
+			email,
+			roles: invitation.roles,
+			inviterId: invitation.inviterId
+		}),
+		expiresAt: invitation.expiresAt
+	});
+	return invitation;
+};
+//#endregion
+export { createAppInvitation, deleteAppInvitation, findAppInvitation, listAppInvitations };