@shaferllc/keel 0.80.0 → 0.81.1

package/dist/core/relations.js

@@ -28,6 +28,13 @@ import { db } from "./database.js";
 function unique(values) {
     return [...new Set(values)];
 }
+/** Count how many times each value appears — the basis of `withCount`. */
+function tally(values) {
+    const counts = new Map();
+    for (const value of values)
+        counts.set(value, (counts.get(value) ?? 0) + 1);
+    return counts;
+}
 /** Base class: a relationship is awaitable (resolves to its loaded result). */
 export class Relation {
     parent;
@@ -76,6 +83,21 @@ export class HasMany extends Relation {
             m.setRelation(name, grouped.get(m[this.localKey]) ?? []);
         }
     }
+    parentColumn() {
+        return this.localKey;
+    }
+    async matchingParentKeys(constrain) {
+        const q = db(this.related.table, this.related.connection);
+        constrain?.(q);
+        return unique((await q.pluck(this.foreignKey)).filter((v) => v != null));
+    }
+    async countsByParent(parentKeys) {
+        return tally(parentKeys.length
+            ? await db(this.related.table, this.related.connection)
+                .whereIn(this.foreignKey, parentKeys)
+                .pluck(this.foreignKey)
+            : []);
+    }
 }
 /* --------------------------------- has-one --------------------------------- */
 export class HasOne extends Relation {
@@ -110,6 +132,21 @@ export class HasOne extends Relation {
             m.setRelation(name, byKey.get(m[this.localKey]) ?? null);
         }
     }
+    parentColumn() {
+        return this.localKey;
+    }
+    async matchingParentKeys(constrain) {
+        const q = db(this.related.table, this.related.connection);
+        constrain?.(q);
+        return unique((await q.pluck(this.foreignKey)).filter((v) => v != null));
+    }
+    async countsByParent(parentKeys) {
+        return tally(parentKeys.length
+            ? await db(this.related.table, this.related.connection)
+                .whereIn(this.foreignKey, parentKeys)
+                .pluck(this.foreignKey)
+            : []);
+    }
 }
 /* -------------------------------- belongs-to ------------------------------- */
 export class BelongsTo extends Relation {
@@ -144,6 +181,25 @@ export class BelongsTo extends Relation {
             m.setRelation(name, byKey.get(m[this.foreignKey]) ?? null);
         }
     }
+    parentColumn() {
+        return this.foreignKey;
+    }
+    async matchingParentKeys(constrain) {
+        const q = db(this.related.table, this.related.connection);
+        constrain?.(q);
+        return unique((await q.pluck(this.ownerKey)).filter((v) => v != null));
+    }
+    async countsByParent(parentKeys) {
+        const existing = new Set(parentKeys.length
+            ? await db(this.related.table, this.related.connection)
+                .whereIn(this.ownerKey, parentKeys)
+                .pluck(this.ownerKey)
+            : []);
+        const counts = new Map();
+        for (const key of parentKeys)
+            counts.set(key, existing.has(key) ? 1 : 0);
+        return counts;
+    }
 }
 /* ----------------------------- belongs-to-many ----------------------------- */
 export class BelongsToMany extends Relation {
@@ -226,4 +282,190 @@ export class BelongsToMany extends Relation {
         for (const id of ids)
             await this.attach(id);
     }
+    parentColumn() {
+        return this.parentKey;
+    }
+    async matchingParentKeys(constrain) {
+        const rq = db(this.related.table, this.related.connection);
+        constrain?.(rq);
+        const relatedIds = unique((await rq.pluck(this.relatedKey)).filter((v) => v != null));
+        if (!relatedIds.length)
+            return [];
+        const pivots = await db(this.pivotTable, this.related.connection)
+            .whereIn(this.relatedPivotKey, relatedIds)
+            .pluck(this.foreignPivotKey);
+        return unique(pivots.filter((v) => v != null));
+    }
+    async countsByParent(parentKeys) {
+        return tally(parentKeys.length
+            ? await db(this.pivotTable, this.related.connection)
+                .whereIn(this.foreignPivotKey, parentKeys)
+                .pluck(this.foreignPivotKey)
+            : []);
+    }
+}
+/* ----------------------------- polymorphic --------------------------------- */
+/** Maps a stored morph-type string to its model class, so `morphTo` can resolve it. */
+const morphRegistry = new Map();
+/** Register a model under a morph type string (usually its class name). */
+export function registerMorphType(type, related) {
+    morphRegistry.set(type, related);
+}
+/** The parent side of a polymorphic one-to-many (`Post.comments()` over `commentable`). */
+export class MorphMany extends Relation {
+    morphType;
+    idColumn;
+    typeColumn;
+    localKey;
+    constructor(parent, related, morphType, idColumn, typeColumn, localKey) {
+        super(parent, related);
+        this.morphType = morphType;
+        this.idColumn = idColumn;
+        this.typeColumn = typeColumn;
+        this.localKey = localKey;
+    }
+    localValue() {
+        return this.parent[this.localKey];
+    }
+    query() {
+        return db(this.related.table, this.related.connection)
+            .where(this.typeColumn, this.morphType)
+            .where(this.idColumn, this.localValue());
+    }
+    async get() {
+        return this.hydrate(await this.query().get());
+    }
+    async eager(models, name) {
+        const keys = unique(models.map((m) => m[this.localKey]).filter((v) => v != null));
+        const rows = keys.length
+            ? await db(this.related.table, this.related.connection)
+                .where(this.typeColumn, this.morphType)
+                .whereIn(this.idColumn, keys)
+                .get()
+            : [];
+        const grouped = new Map();
+        for (const row of rows) {
+            const bucket = grouped.get(row[this.idColumn]) ?? [];
+            bucket.push(new this.related(row));
+            grouped.set(row[this.idColumn], bucket);
+        }
+        for (const m of models)
+            m.setRelation(name, grouped.get(m[this.localKey]) ?? []);
+    }
+    parentColumn() {
+        return this.localKey;
+    }
+    async matchingParentKeys(constrain) {
+        const q = db(this.related.table, this.related.connection).where(this.typeColumn, this.morphType);
+        constrain?.(q);
+        return unique((await q.pluck(this.idColumn)).filter((v) => v != null));
+    }
+    async countsByParent(parentKeys) {
+        return tally(parentKeys.length
+            ? await db(this.related.table, this.related.connection)
+                .where(this.typeColumn, this.morphType)
+                .whereIn(this.idColumn, parentKeys)
+                .pluck(this.idColumn)
+            : []);
+    }
+    /** Create a related row with the morph keys (`*_id` / `*_type`) filled in. */
+    create(attributes) {
+        return this.related.create({
+            ...attributes,
+            [this.idColumn]: this.localValue(),
+            [this.typeColumn]: this.morphType,
+        });
+    }
+}
+/** The parent side of a polymorphic one-to-one. */
+export class MorphOne extends Relation {
+    morphType;
+    idColumn;
+    typeColumn;
+    localKey;
+    constructor(parent, related, morphType, idColumn, typeColumn, localKey) {
+        super(parent, related);
+        this.morphType = morphType;
+        this.idColumn = idColumn;
+        this.typeColumn = typeColumn;
+        this.localKey = localKey;
+    }
+    query() {
+        return db(this.related.table, this.related.connection)
+            .where(this.typeColumn, this.morphType)
+            .where(this.idColumn, this.parent[this.localKey]);
+    }
+    async get() {
+        const row = await this.query().first();
+        return row ? new this.related(row) : null;
+    }
+    async eager(models, name) {
+        const keys = unique(models.map((m) => m[this.localKey]).filter((v) => v != null));
+        const rows = keys.length
+            ? await db(this.related.table, this.related.connection)
+                .where(this.typeColumn, this.morphType)
+                .whereIn(this.idColumn, keys)
+                .get()
+            : [];
+        const byKey = new Map();
+        for (const row of rows)
+            if (!byKey.has(row[this.idColumn]))
+                byKey.set(row[this.idColumn], new this.related(row));
+        for (const m of models)
+            m.setRelation(name, byKey.get(m[this.localKey]) ?? null);
+    }
+}
+/** The owning side of a polymorphic relation — resolves its parent by stored type + id. */
+export class MorphTo {
+    parent;
+    idColumn;
+    typeColumn;
+    constructor(parent, idColumn, typeColumn) {
+        this.parent = parent;
+        this.idColumn = idColumn;
+        this.typeColumn = typeColumn;
+    }
+    relatedClass() {
+        const type = this.parent[this.typeColumn];
+        return type ? morphRegistry.get(type) : undefined;
+    }
+    async get() {
+        const cls = this.relatedClass();
+        const id = this.parent[this.idColumn];
+        if (!cls || id == null)
+            return null;
+        const row = await db(cls.table, cls.connection).where(cls.primaryKey, id).first();
+        return row ? new cls(row) : null;
+    }
+    async eager(models, name) {
+        const byType = new Map();
+        for (const m of models) {
+            const type = m[this.typeColumn];
+            if (!type) {
+                m.setRelation(name, null);
+                continue;
+            }
+            const group = byType.get(type) ?? [];
+            group.push(m);
+            byType.set(type, group);
+        }
+        for (const [type, group] of byType) {
+            const cls = morphRegistry.get(type);
+            if (!cls) {
+                for (const m of group)
+                    m.setRelation(name, null);
+                continue;
+            }
+            const ids = unique(group.map((m) => m[this.idColumn]).filter((v) => v != null));
+            const rows = ids.length ? await db(cls.table, cls.connection).whereIn(cls.primaryKey, ids).get() : [];
+            const byId = new Map(rows.map((row) => [row[cls.primaryKey], row]));
+            for (const m of group) {
+                const row = byId.get(m[this.idColumn]);
+                m.setRelation(name, row ? new cls(row) : null);
+            }
+        }
+    }
+    then(onFulfilled, onRejected) {
+        return this.get().then(onFulfilled, onRejected);
+    }
 }

package/dist/teams/config.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Teams configuration. Merged under `config("teams")` by the provider; override in
+ * `config/teams.ts` (publish it with `keel vendor:publish --tag teams-config`).
+ */
+export interface TeamsConfig {
+    /** The users table. Teams adds `current_team_id` to it and touches nothing else. */
+    userTable: string;
+    /**
+     * Give every new user a team of their own on signup.
+     *
+     * On by default, and worth leaving on even for an app that feels single-user:
+     * a "personal workspace" is just a team of one, and *adding* tenancy later means
+     * backfilling every table and rewriting every query. Ignoring a team you have is
+     * one unused row; needing a team you don't have is a migration nobody enjoys.
+     */
+    personalTeams: boolean;
+    invitations: {
+        expiresInHours: number;
+        /** Where the emailed link points. `:token` is replaced. */
+        url: string;
+    };
+    mail: {
+        from?: string;
+    };
+}
+export declare const defaultConfig: TeamsConfig;
+export declare function resolveConfig(): TeamsConfig;

package/dist/teams/config.js

@@ -0,0 +1,23 @@
+/**
+ * Teams configuration. Merged under `config("teams")` by the provider; override in
+ * `config/teams.ts` (publish it with `keel vendor:publish --tag teams-config`).
+ */
+import { config } from "../core/helpers.js";
+export const defaultConfig = {
+    userTable: "users",
+    personalTeams: true,
+    invitations: {
+        expiresInHours: 72,
+        url: "/invitations/:token",
+    },
+    mail: {},
+};
+export function resolveConfig() {
+    const raw = config("teams", {});
+    return {
+        userTable: raw.userTable ?? defaultConfig.userTable,
+        personalTeams: raw.personalTeams ?? defaultConfig.personalTeams,
+        invitations: { ...defaultConfig.invitations, ...raw.invitations },
+        mail: { ...defaultConfig.mail, ...raw.mail },
+    };
+}

package/dist/teams/context.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Which team the current work belongs to.
+ *
+ * Carried in `AsyncLocalStorage`, not a module global, so two concurrent requests
+ * can't see each other's team — the same reason Keel carries the request and the
+ * open transaction that way.
+ *
+ * **There is no "no team" fallback.** `currentTeamId()` throws when nothing has set
+ * a team, and `TenantModel`'s scope calls it on every query. That is deliberate, and
+ * it is the whole security model:
+ *
+ *   - Return *unscoped* when there's no team, and every background job silently sees
+ *     every tenant's rows. This is how customer A's invoice reaches customer B.
+ *   - Return `undefined` into the where clause (`teamId = NULL`) and jobs match
+ *     nothing, "work" fine, and quietly do nothing for a month.
+ *   - Throw, and a job that forgot crashes in development instead of leaking in
+ *     production.
+ *
+ * A job, a console command, a webhook, a seeder — none of them run inside a request,
+ * so each one has to say which team it is for:
+ *
+ *   await runForTeam(team, () => sendInvoices());
+ *
+ * ...or say, out loud and greppably, that it isn't for one:
+ *
+ *   await withoutTenant(() => Post.query().get());   // every team's posts
+ */
+export interface TeamContext {
+    /** `null` means "deliberately no tenant" — set by `withoutTenant`. */
+    teamId: string | number | null;
+}
+/** Run `fn` with this team as the current tenant. */
+export declare function runForTeam<T>(team: string | number | {
+    id: string | number;
+}, fn: () => T): T;
+/**
+ * Run `fn` with tenant scoping switched **off**.
+ *
+ * Every use of this is a query that crosses tenant boundaries, so it should be easy
+ * to find and easy to justify. That's the point of making it a named call rather
+ * than something you get by forgetting a `where`.
+ */
+export declare function withoutTenant<T>(fn: () => T): T;
+/** The current team's id, or `undefined` outside any team context. */
+export declare function currentTeam(): string | number | null | undefined;
+/** Is there a team context at all (including a deliberate `withoutTenant`)? */
+export declare function hasTeamContext(): boolean;
+/**
+ * The current team's id — or an error.
+ *
+ * Called by the tenant scope on every query, so this is the thing that turns "I
+ * forgot" into a crash rather than a leak.
+ */
+export declare function currentTeamId(): string | number;

package/dist/teams/context.js

@@ -0,0 +1,73 @@
+/**
+ * Which team the current work belongs to.
+ *
+ * Carried in `AsyncLocalStorage`, not a module global, so two concurrent requests
+ * can't see each other's team — the same reason Keel carries the request and the
+ * open transaction that way.
+ *
+ * **There is no "no team" fallback.** `currentTeamId()` throws when nothing has set
+ * a team, and `TenantModel`'s scope calls it on every query. That is deliberate, and
+ * it is the whole security model:
+ *
+ *   - Return *unscoped* when there's no team, and every background job silently sees
+ *     every tenant's rows. This is how customer A's invoice reaches customer B.
+ *   - Return `undefined` into the where clause (`teamId = NULL`) and jobs match
+ *     nothing, "work" fine, and quietly do nothing for a month.
+ *   - Throw, and a job that forgot crashes in development instead of leaking in
+ *     production.
+ *
+ * A job, a console command, a webhook, a seeder — none of them run inside a request,
+ * so each one has to say which team it is for:
+ *
+ *   await runForTeam(team, () => sendInvoices());
+ *
+ * ...or say, out loud and greppably, that it isn't for one:
+ *
+ *   await withoutTenant(() => Post.query().get());   // every team's posts
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+const storage = new AsyncLocalStorage();
+/** Run `fn` with this team as the current tenant. */
+export function runForTeam(team, fn) {
+    const teamId = typeof team === "object" ? team.id : team;
+    return storage.run({ teamId }, fn);
+}
+/**
+ * Run `fn` with tenant scoping switched **off**.
+ *
+ * Every use of this is a query that crosses tenant boundaries, so it should be easy
+ * to find and easy to justify. That's the point of making it a named call rather
+ * than something you get by forgetting a `where`.
+ */
+export function withoutTenant(fn) {
+    return storage.run({ teamId: null }, fn);
+}
+/** The current team's id, or `undefined` outside any team context. */
+export function currentTeam() {
+    return storage.getStore()?.teamId;
+}
+/** Is there a team context at all (including a deliberate `withoutTenant`)? */
+export function hasTeamContext() {
+    return storage.getStore() !== undefined;
+}
+/**
+ * The current team's id — or an error.
+ *
+ * Called by the tenant scope on every query, so this is the thing that turns "I
+ * forgot" into a crash rather than a leak.
+ */
+export function currentTeamId() {
+    const store = storage.getStore();
+    if (!store) {
+        throw new Error("No team in context, so a tenant-scoped query can't be built safely.\n" +
+            "Inside a request, add teamContext() to your middleware.\n" +
+            "In a job, command, or seeder, wrap the work: runForTeam(team, () => …).\n" +
+            "If it genuinely spans every team, say so: withoutTenant(() => …).");
+    }
+    if (store.teamId === null) {
+        // withoutTenant() — the caller has already said this query crosses tenants, and
+        // the scope is skipped before it ever asks for an id.
+        throw new Error("currentTeamId() called inside withoutTenant().");
+    }
+    return store.teamId;
+}

package/dist/teams/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Keel Teams — multi-tenancy, membership, roles, invitations.
+ * Imported from `@shaferllc/keel/teams`.
+ *
+ *   class Post extends TenantModel { static table = "posts"; }
+ *   await Post.all();   // only the current team's posts. Always.
+ *
+ * Isolation is deny-by-default: a `TenantModel` query outside a team context
+ * **throws** rather than quietly returning everything. Crossing tenants is possible,
+ * but only by saying so — `withoutTenant(() => …)` — which is a thing you can grep
+ * for at audit time. See context.ts for why the alternatives are worse.
+ */
+export { TeamsServiceProvider } from "./provider.js";
+export { TenantModel, TENANT_SCOPE } from "./tenant.js";
+export { currentTeam, currentTeamId, hasTeamContext, runForTeam, withoutTenant, } from "./context.js";
+export type { TeamContext } from "./context.js";
+export { Team, Membership, ROLES, createTeam, memberOf, roleAtLeast, roleOf, switchTeam, teamsFor, } from "./models.js";
+export type { Role } from "./models.js";
+export { acceptInvitation, invite, pendingInvitations, revokeInvitation, } from "./invitations.js";
+export type { Invitation, SentInvitation } from "./invitations.js";
+export { requireRole, teamContext } from "./middleware.js";
+export type { TeamContextOptions } from "./middleware.js";
+export { teamsMigration } from "./migration.js";
+export { defaultConfig, resolveConfig } from "./config.js";
+export type { TeamsConfig } from "./config.js";

package/dist/teams/index.js

@@ -0,0 +1,20 @@
+/**
+ * Keel Teams — multi-tenancy, membership, roles, invitations.
+ * Imported from `@shaferllc/keel/teams`.
+ *
+ *   class Post extends TenantModel { static table = "posts"; }
+ *   await Post.all();   // only the current team's posts. Always.
+ *
+ * Isolation is deny-by-default: a `TenantModel` query outside a team context
+ * **throws** rather than quietly returning everything. Crossing tenants is possible,
+ * but only by saying so — `withoutTenant(() => …)` — which is a thing you can grep
+ * for at audit time. See context.ts for why the alternatives are worse.
+ */
+export { TeamsServiceProvider } from "./provider.js";
+export { TenantModel, TENANT_SCOPE } from "./tenant.js";
+export { currentTeam, currentTeamId, hasTeamContext, runForTeam, withoutTenant, } from "./context.js";
+export { Team, Membership, ROLES, createTeam, memberOf, roleAtLeast, roleOf, switchTeam, teamsFor, } from "./models.js";
+export { acceptInvitation, invite, pendingInvitations, revokeInvitation, } from "./invitations.js";
+export { requireRole, teamContext } from "./middleware.js";
+export { teamsMigration } from "./migration.js";
+export { defaultConfig, resolveConfig } from "./config.js";

package/dist/teams/invitations.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Team invitations.
+ *
+ * Unlike password reset, an invitation **is** a database row — because it has to be
+ * listable ("3 pending invites") and revocable, and you can't revoke a stateless
+ * token. What isn't stored is the token itself: only its hash, so a leaked database
+ * doesn't let someone walk into every pending team.
+ *
+ * The email is baked into the invitation and re-checked on accept, so a forwarded
+ * link doesn't let a different person join in the invitee's place.
+ */
+import { Team, type Role } from "./models.js";
+export interface Invitation {
+    id: number;
+    team_id: number;
+    email: string;
+    role: Role;
+    expires_at: string;
+}
+export interface SentInvitation {
+    invitation: Invitation;
+    /** The plaintext token — it goes in the email and is never stored. */
+    token: string;
+}
+/** Invite someone to a team. Returns the token so a caller can build its own link. */
+export declare function invite(teamId: string | number, email: string, role?: Role): Promise<SentInvitation>;
+/** Outstanding invitations for a team. */
+export declare function pendingInvitations(teamId: string | number): Promise<Invitation[]>;
+/** Withdraw an invitation. */
+export declare function revokeInvitation(id: string | number): Promise<void>;
+/**
+ * Accept an invitation, joining the team.
+ *
+ * `email` is the address of the person actually accepting — it must match the one
+ * invited. Otherwise a forwarded link lets anyone join a team they were never asked
+ * to, which is the interesting attack on an invitation system.
+ */
+export declare function acceptInvitation(token: string, userId: string | number, email: string): Promise<Team | null>;

package/dist/teams/invitations.js

@@ -0,0 +1,123 @@
+/**
+ * Team invitations.
+ *
+ * Unlike password reset, an invitation **is** a database row — because it has to be
+ * listable ("3 pending invites") and revocable, and you can't revoke a stateless
+ * token. What isn't stored is the token itself: only its hash, so a leaked database
+ * doesn't let someone walk into every pending team.
+ *
+ * The email is baked into the invitation and re-checked on accept, so a forwarded
+ * link doesn't let a different person join in the invitee's place.
+ */
+import { db } from "../core/database.js";
+import { hash } from "../core/crypto.js";
+import { config } from "../core/helpers.js";
+import { mail } from "../core/mail.js";
+import { Membership, Team } from "./models.js";
+import { resolveConfig } from "./config.js";
+/** Invite someone to a team. Returns the token so a caller can build its own link. */
+export async function invite(teamId, email, role = "member") {
+    const settings = resolveConfig();
+    const address = email.toLowerCase();
+    // Re-inviting replaces the outstanding invitation rather than stacking duplicates.
+    await db("team_invitations").where("team_id", teamId).where("email", address).delete();
+    const token = randomToken();
+    const expires = new Date(Date.now() + settings.invitations.expiresInHours * 3_600_000);
+    const id = await db("team_invitations").insertGetId({
+        team_id: teamId,
+        email: address,
+        role,
+        // Only the hash. The token exists in the email and nowhere else.
+        token: await hash.make(token),
+        expires_at: expires.toISOString(),
+        created_at: new Date().toISOString(),
+    });
+    const invitation = {
+        id: Number(id),
+        team_id: Number(teamId),
+        email: address,
+        role,
+        expires_at: expires.toISOString(),
+    };
+    await sendInvitationEmail(invitation, token);
+    return { invitation, token };
+}
+/** Outstanding invitations for a team. */
+export async function pendingInvitations(teamId) {
+    const rows = await db("team_invitations").where("team_id", teamId).get();
+    return rows.map(toInvitation);
+}
+/** Withdraw an invitation. */
+export async function revokeInvitation(id) {
+    await db("team_invitations").where("id", id).delete();
+}
+/**
+ * Accept an invitation, joining the team.
+ *
+ * `email` is the address of the person actually accepting — it must match the one
+ * invited. Otherwise a forwarded link lets anyone join a team they were never asked
+ * to, which is the interesting attack on an invitation system.
+ */
+export async function acceptInvitation(token, userId, email) {
+    const address = email.toLowerCase();
+    const rows = await db("team_invitations").where("email", address).get();
+    for (const row of rows) {
+        if (!(await hash.verify(String(row.token), token)))
+            continue;
+        // Expired invitations are dead, and worth clearing out while we're here.
+        if (new Date(String(row.expires_at)) < new Date()) {
+            await db("team_invitations").where("id", row.id).delete();
+            return null;
+        }
+        const existing = await db(Membership.table)
+            .where("team_id", row.team_id)
+            .where("user_id", userId)
+            .first();
+        if (!existing) {
+            await Membership.create({
+                team_id: row.team_id,
+                user_id: userId,
+                role: row.role,
+            });
+        }
+        // Single use.
+        await db("team_invitations").where("id", row.id).delete();
+        const team = await db(Team.table).where("id", row.team_id).first();
+        return team ? new Team(team) : null;
+    }
+    return null;
+}
+/* --------------------------------- internals ------------------------------ */
+async function sendInvitationEmail(invitation, token) {
+    const settings = resolveConfig();
+    const team = await db(Team.table).where("id", invitation.team_id).first();
+    const link = absolute(settings.invitations.url.replace(":token", encodeURIComponent(token)));
+    const message = mail()
+        .to(invitation.email)
+        .subject(`You've been invited to ${team?.name ?? "a team"}`)
+        .html(`<p>You've been invited to join <strong>${team?.name ?? "a team"}</strong>.</p>` +
+        `<p><a href="${link}">Accept the invitation</a></p>` +
+        `<p>It expires in ${settings.invitations.expiresInHours} hours.</p>`);
+    if (settings.mail.from)
+        message.from(settings.mail.from);
+    await message.send();
+}
+function randomToken() {
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function toInvitation(row) {
+    return {
+        id: Number(row.id),
+        team_id: Number(row.team_id),
+        email: String(row.email),
+        role: row.role,
+        expires_at: String(row.expires_at),
+    };
+}
+function absolute(url) {
+    if (/^https?:\/\//i.test(url))
+        return url;
+    const base = config("app.url", "http://localhost:3000").replace(/\/$/, "");
+    return `${base}${url.startsWith("/") ? "" : "/"}${url}`;
+}