@shipfox/api-workspaces 2.0.0

package/.turbo/turbo-build.log

@@ -0,0 +1,2 @@
+$ shipfox-swc
+Successfully compiled: 47 files with swc (171.61ms)

package/.turbo/turbo-type$colon$emit.log

@@ -0,0 +1 @@
+$ shipfox-tsc-emit

package/.turbo/turbo-type.log

@@ -0,0 +1 @@
+$ shipfox-tsc-check

package/CHANGELOG.md

@@ -0,0 +1,97 @@
+# @shipfox/api-workspaces
+
+## 2.0.0
+
+### Minor Changes
+
+- c31a7e0: Adds public auth session and cookie composition APIs with password-less user and idempotent membership provisioning.
+- 1b0d344: Publishes the complete API runtime closure with packed-consumer-safe internal imports and records its exact package set in application releases.
+
+### Patch Changes
+
+- Updated dependencies [0cd6dd4]
+- Updated dependencies [1b0d344]
+- Updated dependencies [521e006]
+  - @shipfox/node-module@0.2.0
+  - @shipfox/api-auth-context@2.0.0
+  - @shipfox/api-workspaces-dto@2.0.0
+  - @shipfox/node-tokens@0.2.0
+  - @shipfox/config@1.2.1
+  - @shipfox/node-drizzle@0.2.1
+  - @shipfox/node-email@0.2.1
+  - @shipfox/node-fastify@0.2.1
+  - @shipfox/node-mailer@0.1.2
+  - @shipfox/node-opentelemetry@0.5.0
+  - @shipfox/node-outbox@0.2.1
+  - @shipfox/node-postgres@0.4.1
+
+## 0.1.2
+
+### Patch Changes
+
+- Updated dependencies [705dd43]
+  - @shipfox/node-outbox@0.2.0
+  - @shipfox/node-module@0.1.2
+
+## 0.1.1
+
+### Patch Changes
+
+- Updated dependencies [ec75cd5]
+- Updated dependencies [6a1fb54]
+  - @shipfox/node-drizzle@0.2.0
+  - @shipfox/node-postgres@0.4.0
+  - @shipfox/node-module@0.1.1
+  - @shipfox/node-outbox@0.1.1
+
+## 0.1.0
+
+### Minor Changes
+
+- a81b68c: Adds provisioner token and auth context primitives for workspace-scoped control-plane credentials.
+
+### Patch Changes
+
+- d02c5fd: Queues auth and workspace transactional emails through module-owned outbox events so account verification, password reset, and invitation sends retry outside request transactions.
+- 72ce351: Removes the legacy workspace API-key auth surface, its DTOs, project-access branch, database table, and token prefix support.
+- 82d22e4: Make the workspace-membership gate stateless. `requireWorkspaceAccess` now lives in `@shipfox/api-auth-context` and authorizes a request purely from the verified session-token claims, replacing the `requireMembership` gate in `@shipfox/api-workspaces` that read the workspace row from the database on every workspace-scoped request. Membership and role already travel in the token, so the check needs no database access.
+
+  This removes the per-request database read and severs the runtime dependency on `@shipfox/api-workspaces` from feature modules that only needed the membership gate (integration providers, secrets, projects, agent, runners). Workspace existence and `active`-status enforcement, which no code path currently exercises, moves off the hot path; enforce it at token issuance when workspace suspension is introduced.
+
+- 27770eb: Tightens signup, workspace, and project display-name validation with shared trimming, control and format-character rejection, length limits, and contextual client form errors.
+- Updated dependencies [cdd8931]
+- Updated dependencies [34ba284]
+- Updated dependencies [5707d6d]
+- Updated dependencies [b9c3f32]
+- Updated dependencies [d02c5fd]
+- Updated dependencies [a81b68c]
+- Updated dependencies [c0a883c]
+- Updated dependencies [72ce351]
+- Updated dependencies [e47f8da]
+- Updated dependencies [7b175f5]
+- Updated dependencies [ae7a63c]
+- Updated dependencies [5729548]
+- Updated dependencies [f92122b]
+- Updated dependencies [857fd73]
+- Updated dependencies [75520ff]
+- Updated dependencies [4798517]
+- Updated dependencies [d6d4862]
+- Updated dependencies [c0a883c]
+- Updated dependencies [6077301]
+- Updated dependencies [3bea87f]
+- Updated dependencies [82d22e4]
+- Updated dependencies [27770eb]
+- Updated dependencies [6181819]
+- Updated dependencies [9c149d1]
+  - @shipfox/node-email@0.2.0
+  - @shipfox/node-fastify@0.2.0
+  - @shipfox/node-drizzle@0.1.0
+  - @shipfox/api-workspaces-dto@0.1.0
+  - @shipfox/node-tokens@0.1.0
+  - @shipfox/api-auth-context@0.1.0
+  - @shipfox/node-opentelemetry@0.4.2
+  - @shipfox/node-postgres@0.3.2
+  - @shipfox/node-module@0.1.0
+  - @shipfox/node-outbox@0.1.0
+  - @shipfox/node-mailer@0.1.1
+  - @shipfox/config@1.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shipfox
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,87 @@
+# Shipfox API Workspaces
+
+Shipfox API Workspaces manages who can use a workspace and send or accept invites.
+
+## What it does
+
+- **`workspacesModule`**: Adds table changes, API routes, outbox events, and metrics.
+- **`ensureMembership`**: Adds a user to a workspace or returns the row that is there.
+- **Invitation helpers**: Make, view, accept, list, and revoke invites.
+- **Workspace helpers**: Read workspaces and check a signed-in user's access.
+
+## Installation / Setup
+
+```sh
+pnpm add @shipfox/api-workspaces
+```
+
+Set `CLIENT_BASE_URL` to the public client URL. Invite emails use this URL for
+their accept links. Set up the shared mailer when invite email must be sent.
+
+## Usage
+
+Call `ensureMembership` after an identity callback has the user profile:
+
+```ts
+import {ensureMembership} from '@shipfox/api-workspaces';
+
+const membership = await ensureMembership({
+  userId: user.id,
+  userEmail: user.email,
+  userName: user.name,
+  workspaceId,
+});
+```
+
+## Environment
+
+| Variable | Default | Purpose |
+| --- | --- | --- |
+| `CLIENT_BASE_URL` | `http://localhost:5173` | Base URL used in workspace invitation links. |
+
+The package also uses the shared mailer configuration when it sends invitation email.
+
+## Routes / API / Data Model
+
+Routes mount under `/workspaces`. They make and list workspaces, manage members,
+and make, list, view, accept, or revoke invites.
+
+The module creates these tables:
+
+- `workspaces`
+- `workspaces_memberships`
+- `workspaces_invitations`
+- `workspaces_outbox`
+
+## Behavior Notes
+
+`ensureMembership` uses a unique database rule to keep one row for `user_id`
+and `workspace_id`. Calls at the same time get the same row. It saves the email
+and name only for a new row. Later calls do not change saved values. The metric
+counts only new rows.
+
+Invite acceptance keeps its current transaction. It does not change a row that
+is already there.
+
+`ensureMembership` fails when its workspace does not exist. Workspace checks
+throw `WorkspaceNotFoundError` or `MembershipRequiredError`. Invite helpers
+throw their exported token and email mismatch errors when an invite cannot be
+used.
+
+## Development
+
+```sh
+turbo check --filter=@shipfox/api-workspaces
+turbo type --filter=@shipfox/api-workspaces
+turbo test --filter=@shipfox/api-workspaces
+```
+
+Tests use Vitest and PostgreSQL. Start local services before the suite:
+
+```sh
+docker compose up -d
+```
+
+## License
+
+MIT

package/dist/config.d.ts

@@ -0,0 +1,12 @@
+import { type Mailer } from '@shipfox/node-mailer';
+export declare const config: Readonly<{
+    CLIENT_BASE_URL: string;
+    MAILER_TRANSPORT: "console" | "smtp";
+    MAILER_FROM: string;
+    SMTP_HOST: string | undefined;
+    SMTP_PORT: number;
+    SMTP_USER: string | undefined;
+    SMTP_PASSWORD: string | undefined;
+} & import("@shipfox/config").CleanedEnvAccessors>;
+export declare const mailer: Mailer;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAwC,KAAK,MAAM,EAAC,MAAM,sBAAsB,CAAC;AAExF,eAAO,MAAM,MAAM;;;;;;;;kDA8BjB,CAAC;AAiBH,eAAO,MAAM,MAAM,QAAiB,CAAC"}

package/dist/config.js

@@ -0,0 +1,58 @@
+import { createConfig, num, str } from '@shipfox/config';
+import { createConsoleMailer, createSmtpMailer } from '@shipfox/node-mailer';
+export const config = createConfig({
+    CLIENT_BASE_URL: str({
+        desc: 'Base URL of the client app. Used to build links in workspace invitation emails.',
+        default: 'http://localhost:5173'
+    }),
+    MAILER_TRANSPORT: str({
+        desc: 'How emails are delivered. Use console to print them to the log, or smtp to send them through an SMTP server.',
+        choices: [
+            'console',
+            'smtp'
+        ],
+        default: 'console'
+    }),
+    MAILER_FROM: str({
+        desc: 'Sender address shown on outgoing emails.',
+        default: 'noreply@shipfox.local'
+    }),
+    SMTP_HOST: str({
+        desc: 'Hostname of the SMTP server. Required when MAILER_TRANSPORT is smtp.',
+        default: undefined
+    }),
+    SMTP_PORT: num({
+        desc: 'Port of the SMTP server.',
+        default: 587
+    }),
+    SMTP_USER: str({
+        desc: 'Username for SMTP authentication. Leave it unset if the server needs no login.',
+        default: undefined
+    }),
+    SMTP_PASSWORD: str({
+        desc: 'Password for SMTP authentication. Leave it unset if the server needs no login.',
+        default: undefined
+    })
+});
+function createMailer() {
+    if (config.MAILER_TRANSPORT === 'smtp') {
+        if (!config.SMTP_HOST) throw new Error('SMTP_HOST is required when MAILER_TRANSPORT=smtp');
+        return createSmtpMailer({
+            host: config.SMTP_HOST,
+            port: config.SMTP_PORT,
+            ...config.SMTP_USER ? {
+                user: config.SMTP_USER
+            } : {},
+            ...config.SMTP_PASSWORD ? {
+                password: config.SMTP_PASSWORD
+            } : {},
+            from: config.MAILER_FROM
+        });
+    }
+    return createConsoleMailer({
+        from: config.MAILER_FROM
+    });
+}
+export const mailer = createMailer();
+
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import {createConfig, num, str} from '@shipfox/config';\nimport {createConsoleMailer, createSmtpMailer, type Mailer} from '@shipfox/node-mailer';\n\nexport const config = createConfig({\n  CLIENT_BASE_URL: str({\n    desc: 'Base URL of the client app. Used to build links in workspace invitation emails.',\n    default: 'http://localhost:5173',\n  }),\n  MAILER_TRANSPORT: str({\n    desc: 'How emails are delivered. Use console to print them to the log, or smtp to send them through an SMTP server.',\n    choices: ['console', 'smtp'],\n    default: 'console',\n  }),\n  MAILER_FROM: str({\n    desc: 'Sender address shown on outgoing emails.',\n    default: 'noreply@shipfox.local',\n  }),\n  SMTP_HOST: str({\n    desc: 'Hostname of the SMTP server. Required when MAILER_TRANSPORT is smtp.',\n    default: undefined,\n  }),\n  SMTP_PORT: num({\n    desc: 'Port of the SMTP server.',\n    default: 587,\n  }),\n  SMTP_USER: str({\n    desc: 'Username for SMTP authentication. Leave it unset if the server needs no login.',\n    default: undefined,\n  }),\n  SMTP_PASSWORD: str({\n    desc: 'Password for SMTP authentication. Leave it unset if the server needs no login.',\n    default: undefined,\n  }),\n});\n\nfunction createMailer(): Mailer {\n  if (config.MAILER_TRANSPORT === 'smtp') {\n    if (!config.SMTP_HOST) throw new Error('SMTP_HOST is required when MAILER_TRANSPORT=smtp');\n    return createSmtpMailer({\n      host: config.SMTP_HOST,\n      port: config.SMTP_PORT,\n      ...(config.SMTP_USER ? {user: config.SMTP_USER} : {}),\n      ...(config.SMTP_PASSWORD ? {password: config.SMTP_PASSWORD} : {}),\n      from: config.MAILER_FROM,\n    });\n  }\n\n  return createConsoleMailer({from: config.MAILER_FROM});\n}\n\nexport const mailer = createMailer();\n"],"names":["createConfig","num","str","createConsoleMailer","createSmtpMailer","config","CLIENT_BASE_URL","desc","default","MAILER_TRANSPORT","choices","MAILER_FROM","SMTP_HOST","undefined","SMTP_PORT","SMTP_USER","SMTP_PASSWORD","createMailer","Error","host","port","user","password","from","mailer"],"mappings":"AAAA,SAAQA,YAAY,EAAEC,GAAG,EAAEC,GAAG,QAAO,kBAAkB;AACvD,SAAQC,mBAAmB,EAAEC,gBAAgB,QAAoB,uBAAuB;AAExF,OAAO,MAAMC,SAASL,aAAa;IACjCM,iBAAiBJ,IAAI;QACnBK,MAAM;QACNC,SAAS;IACX;IACAC,kBAAkBP,IAAI;QACpBK,MAAM;QACNG,SAAS;YAAC;YAAW;SAAO;QAC5BF,SAAS;IACX;IACAG,aAAaT,IAAI;QACfK,MAAM;QACNC,SAAS;IACX;IACAI,WAAWV,IAAI;QACbK,MAAM;QACNC,SAASK;IACX;IACAC,WAAWb,IAAI;QACbM,MAAM;QACNC,SAAS;IACX;IACAO,WAAWb,IAAI;QACbK,MAAM;QACNC,SAASK;IACX;IACAG,eAAed,IAAI;QACjBK,MAAM;QACNC,SAASK;IACX;AACF,GAAG;AAEH,SAASI;IACP,IAAIZ,OAAOI,gBAAgB,KAAK,QAAQ;QACtC,IAAI,CAACJ,OAAOO,SAAS,EAAE,MAAM,IAAIM,MAAM;QACvC,OAAOd,iBAAiB;YACtBe,MAAMd,OAAOO,SAAS;YACtBQ,MAAMf,OAAOS,SAAS;YACtB,GAAIT,OAAOU,SAAS,GAAG;gBAACM,MAAMhB,OAAOU,SAAS;YAAA,IAAI,CAAC,CAAC;YACpD,GAAIV,OAAOW,aAAa,GAAG;gBAACM,UAAUjB,OAAOW,aAAa;YAAA,IAAI,CAAC,CAAC;YAChEO,MAAMlB,OAAOM,WAAW;QAC1B;IACF;IAEA,OAAOR,oBAAoB;QAACoB,MAAMlB,OAAOM,WAAW;IAAA;AACtD;AAEA,OAAO,MAAMa,SAASP,eAAe"}

package/dist/core/entities/index.d.ts

@@ -0,0 +1,4 @@
+export type { Invitation } from './invitation.js';
+export type { Membership } from './membership.js';
+export type { Workspace, WorkspaceStatus } from './workspace.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/entities/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAC,UAAU,EAAC,MAAM,iBAAiB,CAAC;AAChD,YAAY,EAAC,UAAU,EAAC,MAAM,iBAAiB,CAAC;AAChD,YAAY,EAAC,SAAS,EAAE,eAAe,EAAC,MAAM,gBAAgB,CAAC"}

package/dist/core/entities/index.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=index.js.map

package/dist/core/entities/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/entities/index.ts"],"sourcesContent":["export type {Invitation} from './invitation.js';\nexport type {Membership} from './membership.js';\nexport type {Workspace, WorkspaceStatus} from './workspace.js';\n"],"names":[],"mappings":"AAEA,WAA+D"}

package/dist/core/entities/invitation.d.ts

@@ -0,0 +1,14 @@
+export interface Invitation {
+    id: string;
+    workspaceId: string;
+    email: string;
+    hashedToken: string;
+    expiresAt: Date;
+    acceptedAt: Date | null;
+    acceptedByUserId: string | null;
+    invitedByUserId: string;
+    invitedByDisplay: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+//# sourceMappingURL=invitation.d.ts.map

package/dist/core/entities/invitation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitation.d.ts","sourceRoot":"","sources":["../../../src/core/entities/invitation.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB"}

package/dist/core/entities/invitation.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=invitation.js.map

package/dist/core/entities/invitation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/entities/invitation.ts"],"sourcesContent":["export interface Invitation {\n  id: string;\n  workspaceId: string;\n  email: string;\n  hashedToken: string;\n  expiresAt: Date;\n  acceptedAt: Date | null;\n  acceptedByUserId: string | null;\n  invitedByUserId: string;\n  invitedByDisplay: string | null;\n  createdAt: Date;\n  updatedAt: Date;\n}\n"],"names":[],"mappings":"AAAA,WAYC"}

package/dist/core/entities/membership.d.ts

@@ -0,0 +1,10 @@
+export interface Membership {
+    id: string;
+    userId: string;
+    userEmail: string;
+    userName: string | null;
+    workspaceId: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+//# sourceMappingURL=membership.d.ts.map

package/dist/core/entities/membership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership.d.ts","sourceRoot":"","sources":["../../../src/core/entities/membership.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB"}

package/dist/core/entities/membership.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=membership.js.map

package/dist/core/entities/membership.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/entities/membership.ts"],"sourcesContent":["export interface Membership {\n  id: string;\n  userId: string;\n  userEmail: string;\n  userName: string | null;\n  workspaceId: string;\n  createdAt: Date;\n  updatedAt: Date;\n}\n"],"names":[],"mappings":"AAAA,WAQC"}

package/dist/core/entities/workspace.d.ts

@@ -0,0 +1,10 @@
+export type WorkspaceStatus = 'active' | 'suspended' | 'deleted';
+export interface Workspace {
+    id: string;
+    name: string;
+    status: WorkspaceStatus;
+    settings: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}
+//# sourceMappingURL=workspace.d.ts.map

package/dist/core/entities/workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../src/core/entities/workspace.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAEjE,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB"}

package/dist/core/entities/workspace.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=workspace.js.map

package/dist/core/entities/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/entities/workspace.ts"],"sourcesContent":["export type WorkspaceStatus = 'active' | 'suspended' | 'deleted';\n\nexport interface Workspace {\n  id: string;\n  name: string;\n  status: WorkspaceStatus;\n  settings: Record<string, unknown>;\n  createdAt: Date;\n  updatedAt: Date;\n}\n"],"names":[],"mappings":"AAEA,WAOC"}

package/dist/core/errors.d.ts

@@ -0,0 +1,52 @@
+export declare class WorkspaceNotFoundError extends Error {
+    constructor(workspaceId: string);
+}
+export declare class WorkspaceInactiveError extends Error {
+    constructor(workspaceId: string);
+}
+export declare class InvitationNotFoundError extends Error {
+    constructor(id: string);
+}
+export declare class InvitationWorkspaceMismatchError extends Error {
+    constructor();
+}
+export declare class MembershipNotFoundError extends Error {
+    constructor(userId: string, workspaceId: string);
+}
+export declare class UserNotFoundError extends Error {
+    constructor(idOrEmail: string);
+}
+export declare class EmailTakenError extends Error {
+    constructor(email: string);
+}
+export declare class InvalidCredentialsError extends Error {
+    constructor();
+}
+export declare class EmailNotVerifiedError extends Error {
+    constructor();
+}
+export declare class TokenInvalidError extends Error {
+    constructor(reason?: string);
+}
+export declare class TokenExpiredError extends Error {
+    constructor();
+}
+export declare class TokenAlreadyUsedError extends Error {
+    constructor();
+}
+export declare class MembershipRequiredError extends Error {
+    constructor(workspaceId: string);
+}
+export declare class LastMemberError extends Error {
+    constructor(workspaceId: string);
+}
+export declare class SelfRemovalNotAllowedError extends Error {
+    constructor();
+}
+export declare class InvitationEmailMismatchError extends Error {
+    constructor();
+}
+export declare class OpenInvitationExistsError extends Error {
+    constructor(email: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,EAAE,EAAE,MAAM;CAIvB;AAED,qBAAa,gCAAiC,SAAQ,KAAK;;CAK1D;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;CAIhD;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,SAAS,EAAE,MAAM;CAI9B;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,KAAK,EAAE,MAAM;CAI1B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;;CAKjD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,MAAM,CAAC,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAkB,SAAQ,KAAK;;CAK3C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,0BAA2B,SAAQ,KAAK;;CAKpD;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,KAAK,EAAE,MAAM;CAI1B"}

package/dist/core/errors.js

@@ -0,0 +1,104 @@
+export class WorkspaceNotFoundError extends Error {
+    constructor(workspaceId){
+        super(`Workspace not found: ${workspaceId}`);
+        this.name = 'WorkspaceNotFoundError';
+    }
+}
+export class WorkspaceInactiveError extends Error {
+    constructor(workspaceId){
+        super(`Workspace is not active: ${workspaceId}`);
+        this.name = 'WorkspaceInactiveError';
+    }
+}
+export class InvitationNotFoundError extends Error {
+    constructor(id){
+        super(`Invitation not found: ${id}`);
+        this.name = 'InvitationNotFoundError';
+    }
+}
+export class InvitationWorkspaceMismatchError extends Error {
+    constructor(){
+        super('Invitation does not belong to this workspace');
+        this.name = 'InvitationWorkspaceMismatchError';
+    }
+}
+export class MembershipNotFoundError extends Error {
+    constructor(userId, workspaceId){
+        super(`Membership not found for user ${userId} in workspace ${workspaceId}`);
+        this.name = 'MembershipNotFoundError';
+    }
+}
+export class UserNotFoundError extends Error {
+    constructor(idOrEmail){
+        super(`User not found: ${idOrEmail}`);
+        this.name = 'UserNotFoundError';
+    }
+}
+export class EmailTakenError extends Error {
+    constructor(email){
+        super(`Email already registered: ${email}`);
+        this.name = 'EmailTakenError';
+    }
+}
+export class InvalidCredentialsError extends Error {
+    constructor(){
+        super('Invalid credentials');
+        this.name = 'InvalidCredentialsError';
+    }
+}
+export class EmailNotVerifiedError extends Error {
+    constructor(){
+        super('Email not verified');
+        this.name = 'EmailNotVerifiedError';
+    }
+}
+export class TokenInvalidError extends Error {
+    constructor(reason){
+        super(reason ? `Invalid token: ${reason}` : 'Invalid token');
+        this.name = 'TokenInvalidError';
+    }
+}
+export class TokenExpiredError extends Error {
+    constructor(){
+        super('Token has expired');
+        this.name = 'TokenExpiredError';
+    }
+}
+export class TokenAlreadyUsedError extends Error {
+    constructor(){
+        super('Token has already been used');
+        this.name = 'TokenAlreadyUsedError';
+    }
+}
+export class MembershipRequiredError extends Error {
+    constructor(workspaceId){
+        super(`Membership required for workspace: ${workspaceId}`);
+        this.name = 'MembershipRequiredError';
+    }
+}
+export class LastMemberError extends Error {
+    constructor(workspaceId){
+        super(`Cannot remove the last member of workspace: ${workspaceId}`);
+        this.name = 'LastMemberError';
+    }
+}
+export class SelfRemovalNotAllowedError extends Error {
+    constructor(){
+        super('Cannot remove yourself from a workspace');
+        this.name = 'SelfRemovalNotAllowedError';
+    }
+}
+export class InvitationEmailMismatchError extends Error {
+    constructor(){
+        super('Invitation email does not match authenticated user');
+        this.name = 'InvitationEmailMismatchError';
+    }
+}
+export class OpenInvitationExistsError extends Error {
+    constructor(email){
+        super(`An open invitation already exists for: ${email}`);
+        this.name = 'OpenInvitationExistsError';
+    }
+}
+
+//# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/errors.ts"],"sourcesContent":["export class WorkspaceNotFoundError extends Error {\n  constructor(workspaceId: string) {\n    super(`Workspace not found: ${workspaceId}`);\n    this.name = 'WorkspaceNotFoundError';\n  }\n}\n\nexport class WorkspaceInactiveError extends Error {\n  constructor(workspaceId: string) {\n    super(`Workspace is not active: ${workspaceId}`);\n    this.name = 'WorkspaceInactiveError';\n  }\n}\n\nexport class InvitationNotFoundError extends Error {\n  constructor(id: string) {\n    super(`Invitation not found: ${id}`);\n    this.name = 'InvitationNotFoundError';\n  }\n}\n\nexport class InvitationWorkspaceMismatchError extends Error {\n  constructor() {\n    super('Invitation does not belong to this workspace');\n    this.name = 'InvitationWorkspaceMismatchError';\n  }\n}\n\nexport class MembershipNotFoundError extends Error {\n  constructor(userId: string, workspaceId: string) {\n    super(`Membership not found for user ${userId} in workspace ${workspaceId}`);\n    this.name = 'MembershipNotFoundError';\n  }\n}\n\nexport class UserNotFoundError extends Error {\n  constructor(idOrEmail: string) {\n    super(`User not found: ${idOrEmail}`);\n    this.name = 'UserNotFoundError';\n  }\n}\n\nexport class EmailTakenError extends Error {\n  constructor(email: string) {\n    super(`Email already registered: ${email}`);\n    this.name = 'EmailTakenError';\n  }\n}\n\nexport class InvalidCredentialsError extends Error {\n  constructor() {\n    super('Invalid credentials');\n    this.name = 'InvalidCredentialsError';\n  }\n}\n\nexport class EmailNotVerifiedError extends Error {\n  constructor() {\n    super('Email not verified');\n    this.name = 'EmailNotVerifiedError';\n  }\n}\n\nexport class TokenInvalidError extends Error {\n  constructor(reason?: string) {\n    super(reason ? `Invalid token: ${reason}` : 'Invalid token');\n    this.name = 'TokenInvalidError';\n  }\n}\n\nexport class TokenExpiredError extends Error {\n  constructor() {\n    super('Token has expired');\n    this.name = 'TokenExpiredError';\n  }\n}\n\nexport class TokenAlreadyUsedError extends Error {\n  constructor() {\n    super('Token has already been used');\n    this.name = 'TokenAlreadyUsedError';\n  }\n}\n\nexport class MembershipRequiredError extends Error {\n  constructor(workspaceId: string) {\n    super(`Membership required for workspace: ${workspaceId}`);\n    this.name = 'MembershipRequiredError';\n  }\n}\n\nexport class LastMemberError extends Error {\n  constructor(workspaceId: string) {\n    super(`Cannot remove the last member of workspace: ${workspaceId}`);\n    this.name = 'LastMemberError';\n  }\n}\n\nexport class SelfRemovalNotAllowedError extends Error {\n  constructor() {\n    super('Cannot remove yourself from a workspace');\n    this.name = 'SelfRemovalNotAllowedError';\n  }\n}\n\nexport class InvitationEmailMismatchError extends Error {\n  constructor() {\n    super('Invitation email does not match authenticated user');\n    this.name = 'InvitationEmailMismatchError';\n  }\n}\n\nexport class OpenInvitationExistsError extends Error {\n  constructor(email: string) {\n    super(`An open invitation already exists for: ${email}`);\n    this.name = 'OpenInvitationExistsError';\n  }\n}\n"],"names":["WorkspaceNotFoundError","Error","workspaceId","name","WorkspaceInactiveError","InvitationNotFoundError","id","InvitationWorkspaceMismatchError","MembershipNotFoundError","userId","UserNotFoundError","idOrEmail","EmailTakenError","email","InvalidCredentialsError","EmailNotVerifiedError","TokenInvalidError","reason","TokenExpiredError","TokenAlreadyUsedError","MembershipRequiredError","LastMemberError","SelfRemovalNotAllowedError","InvitationEmailMismatchError","OpenInvitationExistsError"],"mappings":"AAAA,OAAO,MAAMA,+BAA+BC;IAC1C,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,qBAAqB,EAAEA,aAAa;QAC3C,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMC,+BAA+BH;IAC1C,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,yBAAyB,EAAEA,aAAa;QAC/C,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAME,gCAAgCJ;IAC3C,YAAYK,EAAU,CAAE;QACtB,KAAK,CAAC,CAAC,sBAAsB,EAAEA,IAAI;QACnC,IAAI,CAACH,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMI,yCAAyCN;IACpD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMK,gCAAgCP;IAC3C,YAAYQ,MAAc,EAAEP,WAAmB,CAAE;QAC/C,KAAK,CAAC,CAAC,8BAA8B,EAAEO,OAAO,cAAc,EAAEP,aAAa;QAC3E,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMO,0BAA0BT;IACrC,YAAYU,SAAiB,CAAE;QAC7B,KAAK,CAAC,CAAC,gBAAgB,EAAEA,WAAW;QACpC,IAAI,CAACR,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMS,wBAAwBX;IACnC,YAAYY,KAAa,CAAE;QACzB,KAAK,CAAC,CAAC,0BAA0B,EAAEA,OAAO;QAC1C,IAAI,CAACV,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMW,gCAAgCb;IAC3C,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMY,8BAA8Bd;IACzC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMa,0BAA0Bf;IACrC,YAAYgB,MAAe,CAAE;QAC3B,KAAK,CAACA,SAAS,CAAC,eAAe,EAAEA,QAAQ,GAAG;QAC5C,IAAI,CAACd,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMe,0BAA0BjB;IACrC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMgB,8BAA8BlB;IACzC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMiB,gCAAgCnB;IAC3C,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,mCAAmC,EAAEA,aAAa;QACzD,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMkB,wBAAwBpB;IACnC,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,4CAA4C,EAAEA,aAAa;QAClE,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMmB,mCAAmCrB;IAC9C,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMoB,qCAAqCtB;IAChD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMqB,kCAAkCvB;IAC7C,YAAYY,KAAa,CAAE;QACzB,KAAK,CAAC,CAAC,uCAAuC,EAAEA,OAAO;QACvD,IAAI,CAACV,IAAI,GAAG;IACd;AACF"}

package/dist/core/index.d.ts

@@ -0,0 +1,8 @@
+export type { Invitation } from './entities/invitation.js';
+export type { Membership } from './entities/membership.js';
+export type { Workspace, WorkspaceStatus } from './entities/workspace.js';
+export { InvitationEmailMismatchError, InvitationNotFoundError, InvitationWorkspaceMismatchError, LastMemberError, MembershipNotFoundError, MembershipRequiredError, OpenInvitationExistsError, SelfRemovalNotAllowedError, TokenAlreadyUsedError, TokenExpiredError, WorkspaceNotFoundError, } from './errors.js';
+export { acceptWorkspaceInvitation, createWorkspaceInvitation, listWorkspaceInvitations, type PreviewInvitationResult, previewInvitation, revokeWorkspaceInvitation, } from './invitations.js';
+export { type EnsureMembershipParams, ensureMembership } from './memberships.js';
+export { createWorkspaceForUser, getWorkspace, listUserWorkspaceMemberships, listWorkspaceMembers, type RequireWorkspaceMembershipParams, type RequireWorkspaceMembershipResult, removeWorkspaceMember, requireWorkspaceMembership, } from './workspaces.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAC,UAAU,EAAC,MAAM,0BAA0B,CAAC;AACzD,YAAY,EAAC,UAAU,EAAC,MAAM,0BAA0B,CAAC;AACzD,YAAY,EAAC,SAAS,EAAE,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACxE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,gCAAgC,EAChC,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAC,KAAK,sBAAsB,EAAE,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,4BAA4B,EAC5B,oBAAoB,EACpB,KAAK,gCAAgC,EACrC,KAAK,gCAAgC,EACrC,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,iBAAiB,CAAC"}

package/dist/core/index.js

@@ -0,0 +1,6 @@
+export { InvitationEmailMismatchError, InvitationNotFoundError, InvitationWorkspaceMismatchError, LastMemberError, MembershipNotFoundError, MembershipRequiredError, OpenInvitationExistsError, SelfRemovalNotAllowedError, TokenAlreadyUsedError, TokenExpiredError, WorkspaceNotFoundError } from './errors.js';
+export { acceptWorkspaceInvitation, createWorkspaceInvitation, listWorkspaceInvitations, previewInvitation, revokeWorkspaceInvitation } from './invitations.js';
+export { ensureMembership } from './memberships.js';
+export { createWorkspaceForUser, getWorkspace, listUserWorkspaceMemberships, listWorkspaceMembers, removeWorkspaceMember, requireWorkspaceMembership } from './workspaces.js';
+
+//# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/index.ts"],"sourcesContent":["export type {Invitation} from './entities/invitation.js';\nexport type {Membership} from './entities/membership.js';\nexport type {Workspace, WorkspaceStatus} from './entities/workspace.js';\nexport {\n  InvitationEmailMismatchError,\n  InvitationNotFoundError,\n  InvitationWorkspaceMismatchError,\n  LastMemberError,\n  MembershipNotFoundError,\n  MembershipRequiredError,\n  OpenInvitationExistsError,\n  SelfRemovalNotAllowedError,\n  TokenAlreadyUsedError,\n  TokenExpiredError,\n  WorkspaceNotFoundError,\n} from './errors.js';\nexport {\n  acceptWorkspaceInvitation,\n  createWorkspaceInvitation,\n  listWorkspaceInvitations,\n  type PreviewInvitationResult,\n  previewInvitation,\n  revokeWorkspaceInvitation,\n} from './invitations.js';\nexport {type EnsureMembershipParams, ensureMembership} from './memberships.js';\nexport {\n  createWorkspaceForUser,\n  getWorkspace,\n  listUserWorkspaceMemberships,\n  listWorkspaceMembers,\n  type RequireWorkspaceMembershipParams,\n  type RequireWorkspaceMembershipResult,\n  removeWorkspaceMember,\n  requireWorkspaceMembership,\n} from './workspaces.js';\n"],"names":["InvitationEmailMismatchError","InvitationNotFoundError","InvitationWorkspaceMismatchError","LastMemberError","MembershipNotFoundError","MembershipRequiredError","OpenInvitationExistsError","SelfRemovalNotAllowedError","TokenAlreadyUsedError","TokenExpiredError","WorkspaceNotFoundError","acceptWorkspaceInvitation","createWorkspaceInvitation","listWorkspaceInvitations","previewInvitation","revokeWorkspaceInvitation","ensureMembership","createWorkspaceForUser","getWorkspace","listUserWorkspaceMemberships","listWorkspaceMembers","removeWorkspaceMember","requireWorkspaceMembership"],"mappings":"AAGA,SACEA,4BAA4B,EAC5BC,uBAAuB,EACvBC,gCAAgC,EAChCC,eAAe,EACfC,uBAAuB,EACvBC,uBAAuB,EACvBC,yBAAyB,EACzBC,0BAA0B,EAC1BC,qBAAqB,EACrBC,iBAAiB,EACjBC,sBAAsB,QACjB,cAAc;AACrB,SACEC,yBAAyB,EACzBC,yBAAyB,EACzBC,wBAAwB,EAExBC,iBAAiB,EACjBC,yBAAyB,QACpB,mBAAmB;AAC1B,SAAqCC,gBAAgB,QAAO,mBAAmB;AAC/E,SACEC,sBAAsB,EACtBC,YAAY,EACZC,4BAA4B,EAC5BC,oBAAoB,EAGpBC,qBAAqB,EACrBC,0BAA0B,QACrB,kBAAkB"}