@tangle-network/agent-app 0.28.0 → 0.29.0

package/dist/teams/drizzle.d.ts

@@ -0,0 +1,42 @@
+import { T as TeamDatabase, a as TeamTables, O as OrganizationRow, b as OrganizationMemberRow } from '../access-ChAHG4Tp.js';
+export { C as CreateAccessOptions, c as CreateOrganizationAccessOptions, d as CreateTeamTablesOptions, e as OrganizationAccess, f as OrganizationAccessApi, g as TeamParentTable, U as UserWorkspaceSummary, W as WorkspaceAccess, h as WorkspaceAccessApi, i as WorkspaceAccessTable, j as WorkspaceMemberRow, k as createOrganizationAccess, l as createTeamTables, m as createWorkspaceAccess } from '../access-ChAHG4Tp.js';
+import { O as OrganizationRole } from '../roles-CLtYKHHl.js';
+import 'drizzle-orm/sqlite-core';
+
+/**
+ * `ensurePersonalOrganization` — the substrate that makes solo-user adoption
+ * work. Every user gets exactly one auto-created `kind: 'personal'` org with
+ * the user as `owner` member. That org is the tenant that owns their
+ * workspaces, so role resolution (`getWorkspaceAccess`) has an org row to read
+ * even before any team/invite exists.
+ *
+ * Idempotent by construction: the org `slug` is derived from the user id
+ * (`personal-<id>`) and upserted; the membership upserts on the
+ * (organizationId, userId) unique index. Concurrent calls converge — no
+ * duplicate personal orgs, no duplicate owner rows.
+ *
+ * ADOPTION CONTRACT: call this once per user at first authenticated entry
+ * (e.g. right after sign-in / session bootstrap) BEFORE the first
+ * `getWorkspaceAccess`. Role resolution requires the org membership to exist;
+ * an adopter that skips this will see `null` access for a brand-new user with
+ * no org row. There is no implicit creation inside the access builders — that
+ * keeps reads side-effect-free; provisioning is this explicit call.
+ */
+
+interface EnsurePersonalOrganizationUser {
+    id: string;
+    name?: string | null;
+    email?: string | null;
+}
+interface PersonalOrganizationResult {
+    organization: OrganizationRow;
+    member: OrganizationMemberRow;
+    role: OrganizationRole;
+}
+interface CreatePersonalOrganizationOptions {
+    db: TeamDatabase;
+    tables: TeamTables;
+}
+declare function createEnsurePersonalOrganization(opts: CreatePersonalOrganizationOptions): (user: EnsurePersonalOrganizationUser) => Promise<PersonalOrganizationResult>;
+
+export { type CreatePersonalOrganizationOptions, type EnsurePersonalOrganizationUser, OrganizationMemberRow, OrganizationRow, type PersonalOrganizationResult, TeamDatabase, TeamTables, createEnsurePersonalOrganization };

package/dist/teams/drizzle.js

@@ -0,0 +1,194 @@
+import {
+  hasOrganizationRole,
+  hasWorkspaceRole,
+  resolveWorkspaceRole
+} from "../chunk-63CE7FEZ.js";
+
+// src/teams/drizzle/schema.ts
+import { sql } from "drizzle-orm";
+import { index, integer, sqliteTable, text, uniqueIndex } from "drizzle-orm/sqlite-core";
+var hexId = () => text("id").primaryKey().default(sql`(lower(hex(randomblob(16))))`);
+var createdAt = () => integer("created_at", { mode: "timestamp" }).notNull().default(sql`(unixepoch())`);
+var updatedAt = () => integer("updated_at", { mode: "timestamp" }).notNull().default(sql`(unixepoch())`);
+function createTeamTables(opts) {
+  const { userTable, workspaceTable } = opts;
+  const organizations = sqliteTable("organization", {
+    id: hexId(),
+    name: text("name").notNull(),
+    slug: text("slug").notNull().unique(),
+    kind: text("kind", { enum: ["personal", "team"] }).notNull().default("personal"),
+    createdBy: text("created_by").notNull().references(() => userTable.id, { onDelete: "cascade" }),
+    createdAt: createdAt(),
+    updatedAt: updatedAt()
+  }, (table) => [
+    index("idx_organization_created_by").on(table.createdBy)
+  ]);
+  const organizationMembers = sqliteTable("organization_member", {
+    id: hexId(),
+    organizationId: text("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+    userId: text("user_id").notNull().references(() => userTable.id, { onDelete: "cascade" }),
+    role: text("role", { enum: ["owner", "admin", "member", "billing"] }).notNull().default("member"),
+    createdAt: createdAt(),
+    updatedAt: updatedAt()
+  }, (table) => [
+    uniqueIndex("uniq_org_member_user").on(table.organizationId, table.userId),
+    index("idx_org_member_user").on(table.userId)
+  ]);
+  const workspaceMembers = sqliteTable("workspace_member", {
+    id: hexId(),
+    workspaceId: text("workspace_id").notNull().references(() => workspaceTable.id, { onDelete: "cascade" }),
+    organizationMemberId: text("organization_member_id").references(() => organizationMembers.id, { onDelete: "cascade" }),
+    userId: text("user_id").references(() => userTable.id, { onDelete: "cascade" }),
+    role: text("role", { enum: ["owner", "admin", "editor", "viewer"] }).notNull().default("editor"),
+    invitedBy: text("invited_by"),
+    inviteEmail: text("invite_email"),
+    inviteToken: text("invite_token"),
+    invitedAt: integer("invited_at", { mode: "timestamp" }).notNull().default(sql`(unixepoch())`),
+    acceptedAt: integer("accepted_at", { mode: "timestamp" })
+  }, (table) => [
+    uniqueIndex("uniq_workspace_member_org_member").on(table.workspaceId, table.organizationMemberId),
+    index("idx_workspace_member_user").on(table.workspaceId, table.userId),
+    index("idx_member_user").on(table.userId),
+    uniqueIndex("idx_member_invite_token").on(table.inviteToken)
+  ]);
+  return { organizations, organizationMembers, workspaceMembers };
+}
+
+// src/teams/drizzle/access.ts
+import { and, desc, eq, isNotNull } from "drizzle-orm";
+function createWorkspaceAccess(opts) {
+  const { db, tables, workspaceTable } = opts;
+  const { organizations, organizationMembers, workspaceMembers } = tables;
+  const workspaces = workspaceTable;
+  async function getWorkspaceAccess(workspaceId, userId, minRole = "viewer") {
+    const [row] = await db.select({
+      workspace: workspaces,
+      organization: organizations,
+      organizationMember: organizationMembers,
+      projectRole: workspaceMembers.role,
+      acceptedAt: workspaceMembers.acceptedAt
+    }).from(workspaces).innerJoin(organizations, eq(organizations.id, workspaces.organizationId)).innerJoin(organizationMembers, and(
+      eq(organizationMembers.organizationId, workspaces.organizationId),
+      eq(organizationMembers.userId, userId)
+    )).leftJoin(workspaceMembers, and(
+      eq(workspaceMembers.workspaceId, workspaces.id),
+      eq(workspaceMembers.organizationMemberId, organizationMembers.id),
+      isNotNull(workspaceMembers.acceptedAt)
+    )).where(eq(workspaces.id, workspaceId)).limit(1);
+    if (!row) return null;
+    const role = resolveWorkspaceRole(row.organizationMember.role, row.projectRole);
+    if (!role) return null;
+    if (!hasWorkspaceRole(role, minRole)) return null;
+    return {
+      workspace: row.workspace,
+      organization: row.organization,
+      organizationMember: row.organizationMember,
+      role
+    };
+  }
+  async function requireWorkspaceAccess(workspaceId, userId, minRole = "viewer") {
+    const access = await getWorkspaceAccess(workspaceId, userId, minRole);
+    if (!access) throw new Response("Workspace not found", { status: 404 });
+    return access;
+  }
+  async function listUserWorkspaces(userId) {
+    const rows = await db.select({
+      workspace: workspaces,
+      organization: organizations,
+      organizationMember: organizationMembers,
+      projectRole: workspaceMembers.role
+    }).from(workspaces).innerJoin(organizations, eq(organizations.id, workspaces.organizationId)).innerJoin(organizationMembers, and(
+      eq(organizationMembers.organizationId, workspaces.organizationId),
+      eq(organizationMembers.userId, userId)
+    )).leftJoin(workspaceMembers, and(
+      eq(workspaceMembers.workspaceId, workspaces.id),
+      eq(workspaceMembers.organizationMemberId, organizationMembers.id),
+      isNotNull(workspaceMembers.acceptedAt)
+    )).orderBy(desc(workspaces.updatedAt));
+    return rows.flatMap((row) => {
+      const role = resolveWorkspaceRole(row.organizationMember.role, row.projectRole);
+      if (!role) return [];
+      return [{
+        ...row.workspace,
+        organizationId: row.organization.id,
+        organizationName: row.organization.name,
+        role
+      }];
+    });
+  }
+  return { getWorkspaceAccess, requireWorkspaceAccess, listUserWorkspaces };
+}
+function createOrganizationAccess(opts) {
+  const { db, tables } = opts;
+  const { organizations, organizationMembers } = tables;
+  async function getOrganizationAccess(organizationId, userId, minRole = "member") {
+    const [row] = await db.select({
+      organization: organizations,
+      member: organizationMembers
+    }).from(organizationMembers).innerJoin(organizations, eq(organizations.id, organizationMembers.organizationId)).where(and(
+      eq(organizationMembers.organizationId, organizationId),
+      eq(organizationMembers.userId, userId)
+    )).limit(1);
+    if (!row) return null;
+    const role = row.member.role;
+    if (!hasOrganizationRole(role, minRole)) return null;
+    return { organization: row.organization, member: row.member, role };
+  }
+  async function requireOrganizationAccess(organizationId, userId, minRole = "member") {
+    const access = await getOrganizationAccess(organizationId, userId, minRole);
+    if (!access) throw new Response("Organization not found", { status: 404 });
+    return access;
+  }
+  return { getOrganizationAccess, requireOrganizationAccess };
+}
+
+// src/teams/drizzle/personal-organization.ts
+import { and as and2, eq as eq2 } from "drizzle-orm";
+function createEnsurePersonalOrganization(opts) {
+  const { db, tables } = opts;
+  const { organizations, organizationMembers } = tables;
+  return async function ensurePersonalOrganization(user) {
+    const [existing] = await db.select({
+      organization: organizations,
+      member: organizationMembers
+    }).from(organizationMembers).innerJoin(organizations, eq2(organizations.id, organizationMembers.organizationId)).where(and2(
+      eq2(organizationMembers.userId, user.id),
+      eq2(organizations.kind, "personal")
+    )).limit(1);
+    if (existing) {
+      return {
+        organization: existing.organization,
+        member: existing.member,
+        role: existing.member.role
+      };
+    }
+    const orgName = user.name?.trim() || user.email?.split("@")[0] || "Personal";
+    const slug = `personal-${user.id}`;
+    const [organization] = await db.insert(organizations).values({
+      name: `${orgName}'s Organization`,
+      slug,
+      kind: "personal",
+      createdBy: user.id
+    }).onConflictDoUpdate({
+      target: organizations.slug,
+      set: { updatedAt: /* @__PURE__ */ new Date() }
+    }).returning();
+    const org = organization;
+    const [member] = await db.insert(organizationMembers).values({
+      organizationId: org.id,
+      userId: user.id,
+      role: "owner"
+    }).onConflictDoUpdate({
+      target: [organizationMembers.organizationId, organizationMembers.userId],
+      set: { role: "owner", updatedAt: /* @__PURE__ */ new Date() }
+    }).returning();
+    return { organization: org, member, role: "owner" };
+  };
+}
+export {
+  createEnsurePersonalOrganization,
+  createOrganizationAccess,
+  createTeamTables,
+  createWorkspaceAccess
+};
+//# sourceMappingURL=drizzle.js.map

package/dist/teams/drizzle.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/teams/drizzle/schema.ts","../../src/teams/drizzle/access.ts","../../src/teams/drizzle/personal-organization.ts"],"sourcesContent":["/**\n * Drizzle schema factory for the teams tables. The product owns the user and\n * workspace tables; this factory creates the tenancy/membership tables and\n * wires their foreign keys into the passed-in tables so the whole graph lives\n * in one drizzle schema with real cascade semantics. Column names, types,\n * defaults, enums, and indexes mirror gtm's hand-rolled tables so a product\n * with those tables can adopt the factory without rewriting rows.\n *\n * The three tables and their roles:\n *   - `organization` — the TENANT/ownership primitive. `kind` is 'personal'\n *     (one auto-created per user; see ensurePersonalOrganization) or 'team'.\n *     This is what owns workspaces and what billing/seats attach to.\n *   - `organizationMember` — who belongs to an org and at what org role.\n *   - `workspaceMember` — the additive invite/member surface: per-workspace\n *     access grants, including pending email-only invites carrying a token.\n *\n * Imports `drizzle-orm` at module top — that is WHY this lives behind the\n * `/teams/drizzle` sub-subpath. The pure `./teams` leaf imports none of this,\n * so a consumer that never touches the DB never pulls the optional peer.\n */\n\nimport { sql } from 'drizzle-orm'\nimport { index, integer, sqliteTable, text, uniqueIndex } from 'drizzle-orm/sqlite-core'\nimport type { AnySQLiteColumn, AnySQLiteTable } from 'drizzle-orm/sqlite-core'\n\n/** A product table referenced by FK — only the `id` column is touched. */\nexport type TeamParentTable = AnySQLiteTable & { id: AnySQLiteColumn }\n\nexport interface CreateTeamTablesOptions {\n  /** The product's user table — org/member rows reference `userTable.id`. */\n  userTable: TeamParentTable\n  /** The product's workspace table — workspace members reference `workspaceTable.id`. */\n  workspaceTable: TeamParentTable\n}\n\nconst hexId = () => text('id').primaryKey().default(sql`(lower(hex(randomblob(16))))`)\n\nconst createdAt = () => integer('created_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`)\n\nconst updatedAt = () => integer('updated_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`)\n\nexport function createTeamTables(opts: CreateTeamTablesOptions) {\n  const { userTable, workspaceTable } = opts\n\n  const organizations = sqliteTable('organization', {\n    id: hexId(),\n    name: text('name').notNull(),\n    slug: text('slug').notNull().unique(),\n    kind: text('kind', { enum: ['personal', 'team'] }).notNull().default('personal'),\n    createdBy: text('created_by').notNull().references(() => userTable.id, { onDelete: 'cascade' }),\n    createdAt: createdAt(),\n    updatedAt: updatedAt(),\n  }, (table) => [\n    index('idx_organization_created_by').on(table.createdBy),\n  ])\n\n  const organizationMembers = sqliteTable('organization_member', {\n    id: hexId(),\n    organizationId: text('organization_id').notNull().references(() => organizations.id, { onDelete: 'cascade' }),\n    userId: text('user_id').notNull().references(() => userTable.id, { onDelete: 'cascade' }),\n    role: text('role', { enum: ['owner', 'admin', 'member', 'billing'] }).notNull().default('member'),\n    createdAt: createdAt(),\n    updatedAt: updatedAt(),\n  }, (table) => [\n    uniqueIndex('uniq_org_member_user').on(table.organizationId, table.userId),\n    index('idx_org_member_user').on(table.userId),\n  ])\n\n  const workspaceMembers = sqliteTable('workspace_member', {\n    id: hexId(),\n    workspaceId: text('workspace_id').notNull().references(() => workspaceTable.id, { onDelete: 'cascade' }),\n    organizationMemberId: text('organization_member_id').references(() => organizationMembers.id, { onDelete: 'cascade' }),\n    userId: text('user_id').references(() => userTable.id, { onDelete: 'cascade' }),\n    role: text('role', { enum: ['owner', 'admin', 'editor', 'viewer'] }).notNull().default('editor'),\n    invitedBy: text('invited_by'),\n    inviteEmail: text('invite_email'),\n    inviteToken: text('invite_token'),\n    invitedAt: integer('invited_at', { mode: 'timestamp' }).notNull().default(sql`(unixepoch())`),\n    acceptedAt: integer('accepted_at', { mode: 'timestamp' }),\n  }, (table) => [\n    uniqueIndex('uniq_workspace_member_org_member').on(table.workspaceId, table.organizationMemberId),\n    index('idx_workspace_member_user').on(table.workspaceId, table.userId),\n    index('idx_member_user').on(table.userId),\n    uniqueIndex('idx_member_invite_token').on(table.inviteToken),\n  ])\n\n  return { organizations, organizationMembers, workspaceMembers }\n}\n\nexport type TeamTables = ReturnType<typeof createTeamTables>\n\nexport type OrganizationRow = TeamTables['organizations']['$inferSelect']\nexport type OrganizationMemberRow = TeamTables['organizationMembers']['$inferSelect']\nexport type WorkspaceMemberRow = TeamTables['workspaceMembers']['$inferSelect']\n","/**\n * RBAC access builders over the teams tables. `createWorkspaceAccess` and\n * `createOrganizationAccess` close over the product's `db`, the tables from\n * `createTeamTables`, and the product's `workspace` table, returning the exact\n * `getWorkspaceAccess` / `requireWorkspaceAccess` / `listUserWorkspaces` /\n * `getOrganizationAccess` / `requireOrganizationAccess` functions a consumer\n * already calls — so adoption is a one-line import swap, every call site stays\n * identical.\n *\n * Defense in depth: org owners/admins are workspace owners across the org;\n * everyone else gets their explicit per-workspace role. Effective role is the\n * fold in `resolveWorkspaceRole` (pure, from `../roles`). Every query pins\n * `userId`, so a leaked id can never read across the tenancy boundary — it\n * surfaces as \"not found\".\n *\n * Driver-agnostic: builders are awaited, never `.run()`/`.all()`, so\n * better-sqlite3, D1, and libsql handles all behave identically.\n */\n\nimport { and, desc, eq, isNotNull } from 'drizzle-orm'\nimport type { BaseSQLiteDatabase } from 'drizzle-orm/sqlite-core'\nimport {\n  type OrganizationRole,\n  type WorkspaceRole,\n  hasOrganizationRole,\n  hasWorkspaceRole,\n  resolveWorkspaceRole,\n} from '../roles'\nimport type { TeamParentTable } from './schema'\nimport type { OrganizationMemberRow, OrganizationRow, TeamTables } from './schema'\n\n/** Any SQLite drizzle database — `any` erases driver-specific generics so\n *  better-sqlite3, D1, and libsql handles all fit. */\nexport type TeamDatabase = BaseSQLiteDatabase<'sync' | 'async', any, any>\n\n/**\n * The product's workspace table, narrowed to the columns the access joins read.\n * Adopters pass their real drizzle workspace table — it carries these columns\n * (gtm's does); the type only asserts the minimum the joins touch.\n */\nexport interface WorkspaceAccessTable {\n  id: any\n  organizationId: any\n  name: any\n  updatedAt: any\n}\n\nexport interface CreateAccessOptions {\n  db: TeamDatabase\n  tables: TeamTables\n  /** The product's workspace table (the FK target passed to createTeamTables). */\n  workspaceTable: TeamParentTable & WorkspaceAccessTable\n}\n\nexport interface WorkspaceAccess {\n  workspace: Record<string, unknown>\n  organization: OrganizationRow\n  organizationMember: OrganizationMemberRow\n  role: WorkspaceRole\n}\n\nexport interface UserWorkspaceSummary extends Record<string, unknown> {\n  organizationId: string\n  organizationName: string\n  role: WorkspaceRole\n}\n\nexport interface WorkspaceAccessApi {\n  getWorkspaceAccess(workspaceId: string, userId: string, minRole?: WorkspaceRole): Promise<WorkspaceAccess | null>\n  requireWorkspaceAccess(workspaceId: string, userId: string, minRole?: WorkspaceRole): Promise<WorkspaceAccess>\n  listUserWorkspaces(userId: string): Promise<UserWorkspaceSummary[]>\n}\n\nexport function createWorkspaceAccess(opts: CreateAccessOptions): WorkspaceAccessApi {\n  const { db, tables, workspaceTable } = opts\n  const { organizations, organizationMembers, workspaceMembers } = tables\n  const workspaces = workspaceTable\n\n  async function getWorkspaceAccess(\n    workspaceId: string,\n    userId: string,\n    minRole: WorkspaceRole = 'viewer',\n  ): Promise<WorkspaceAccess | null> {\n    const [row] = await db\n      .select({\n        workspace: workspaces,\n        organization: organizations,\n        organizationMember: organizationMembers,\n        projectRole: workspaceMembers.role,\n        acceptedAt: workspaceMembers.acceptedAt,\n      })\n      .from(workspaces)\n      .innerJoin(organizations, eq(organizations.id, workspaces.organizationId))\n      .innerJoin(organizationMembers, and(\n        eq(organizationMembers.organizationId, workspaces.organizationId),\n        eq(organizationMembers.userId, userId),\n      ))\n      .leftJoin(workspaceMembers, and(\n        eq(workspaceMembers.workspaceId, workspaces.id),\n        eq(workspaceMembers.organizationMemberId, organizationMembers.id),\n        isNotNull(workspaceMembers.acceptedAt),\n      ))\n      .where(eq(workspaces.id, workspaceId))\n      .limit(1)\n\n    if (!row) return null\n\n    const role = resolveWorkspaceRole(row.organizationMember.role, row.projectRole as WorkspaceRole | null)\n    if (!role) return null\n    if (!hasWorkspaceRole(role, minRole)) return null\n\n    return {\n      workspace: row.workspace as Record<string, unknown>,\n      organization: row.organization,\n      organizationMember: row.organizationMember,\n      role,\n    }\n  }\n\n  async function requireWorkspaceAccess(\n    workspaceId: string,\n    userId: string,\n    minRole: WorkspaceRole = 'viewer',\n  ): Promise<WorkspaceAccess> {\n    const access = await getWorkspaceAccess(workspaceId, userId, minRole)\n    if (!access) throw new Response('Workspace not found', { status: 404 })\n    return access\n  }\n\n  async function listUserWorkspaces(userId: string): Promise<UserWorkspaceSummary[]> {\n    const rows = await db\n      .select({\n        workspace: workspaces,\n        organization: organizations,\n        organizationMember: organizationMembers,\n        projectRole: workspaceMembers.role,\n      })\n      .from(workspaces)\n      .innerJoin(organizations, eq(organizations.id, workspaces.organizationId))\n      .innerJoin(organizationMembers, and(\n        eq(organizationMembers.organizationId, workspaces.organizationId),\n        eq(organizationMembers.userId, userId),\n      ))\n      .leftJoin(workspaceMembers, and(\n        eq(workspaceMembers.workspaceId, workspaces.id),\n        eq(workspaceMembers.organizationMemberId, organizationMembers.id),\n        isNotNull(workspaceMembers.acceptedAt),\n      ))\n      // Most recently active workspace first, so callers taking rows[0] as the\n      // default pick the freshest one.\n      .orderBy(desc(workspaces.updatedAt))\n\n    return rows.flatMap((row: any) => {\n      const role = resolveWorkspaceRole(row.organizationMember.role, row.projectRole as WorkspaceRole | null)\n      if (!role) return []\n      return [{\n        ...(row.workspace as Record<string, unknown>),\n        organizationId: row.organization.id,\n        organizationName: row.organization.name,\n        role,\n      } as UserWorkspaceSummary]\n    })\n  }\n\n  return { getWorkspaceAccess, requireWorkspaceAccess, listUserWorkspaces }\n}\n\nexport interface OrganizationAccess {\n  organization: OrganizationRow\n  member: OrganizationMemberRow\n  role: OrganizationRole\n}\n\nexport interface OrganizationAccessApi {\n  getOrganizationAccess(organizationId: string, userId: string, minRole?: OrganizationRole): Promise<OrganizationAccess | null>\n  requireOrganizationAccess(organizationId: string, userId: string, minRole?: OrganizationRole): Promise<OrganizationAccess>\n}\n\nexport interface CreateOrganizationAccessOptions {\n  db: TeamDatabase\n  tables: TeamTables\n}\n\nexport function createOrganizationAccess(opts: CreateOrganizationAccessOptions): OrganizationAccessApi {\n  const { db, tables } = opts\n  const { organizations, organizationMembers } = tables\n\n  async function getOrganizationAccess(\n    organizationId: string,\n    userId: string,\n    minRole: OrganizationRole = 'member',\n  ): Promise<OrganizationAccess | null> {\n    const [row] = await db\n      .select({\n        organization: organizations,\n        member: organizationMembers,\n      })\n      .from(organizationMembers)\n      .innerJoin(organizations, eq(organizations.id, organizationMembers.organizationId))\n      .where(and(\n        eq(organizationMembers.organizationId, organizationId),\n        eq(organizationMembers.userId, userId),\n      ))\n      .limit(1)\n\n    if (!row) return null\n    const role = row.member.role as OrganizationRole\n    if (!hasOrganizationRole(role, minRole)) return null\n    return { organization: row.organization, member: row.member, role }\n  }\n\n  async function requireOrganizationAccess(\n    organizationId: string,\n    userId: string,\n    minRole: OrganizationRole = 'member',\n  ): Promise<OrganizationAccess> {\n    const access = await getOrganizationAccess(organizationId, userId, minRole)\n    if (!access) throw new Response('Organization not found', { status: 404 })\n    return access\n  }\n\n  return { getOrganizationAccess, requireOrganizationAccess }\n}\n","/**\n * `ensurePersonalOrganization` — the substrate that makes solo-user adoption\n * work. Every user gets exactly one auto-created `kind: 'personal'` org with\n * the user as `owner` member. That org is the tenant that owns their\n * workspaces, so role resolution (`getWorkspaceAccess`) has an org row to read\n * even before any team/invite exists.\n *\n * Idempotent by construction: the org `slug` is derived from the user id\n * (`personal-<id>`) and upserted; the membership upserts on the\n * (organizationId, userId) unique index. Concurrent calls converge — no\n * duplicate personal orgs, no duplicate owner rows.\n *\n * ADOPTION CONTRACT: call this once per user at first authenticated entry\n * (e.g. right after sign-in / session bootstrap) BEFORE the first\n * `getWorkspaceAccess`. Role resolution requires the org membership to exist;\n * an adopter that skips this will see `null` access for a brand-new user with\n * no org row. There is no implicit creation inside the access builders — that\n * keeps reads side-effect-free; provisioning is this explicit call.\n */\n\nimport { and, eq } from 'drizzle-orm'\nimport type { OrganizationRole } from '../roles'\nimport type { TeamDatabase } from './access'\nimport type { OrganizationMemberRow, OrganizationRow, TeamTables } from './schema'\n\nexport interface EnsurePersonalOrganizationUser {\n  id: string\n  name?: string | null\n  email?: string | null\n}\n\nexport interface PersonalOrganizationResult {\n  organization: OrganizationRow\n  member: OrganizationMemberRow\n  role: OrganizationRole\n}\n\nexport interface CreatePersonalOrganizationOptions {\n  db: TeamDatabase\n  tables: TeamTables\n}\n\nexport function createEnsurePersonalOrganization(opts: CreatePersonalOrganizationOptions) {\n  const { db, tables } = opts\n  const { organizations, organizationMembers } = tables\n\n  return async function ensurePersonalOrganization(\n    user: EnsurePersonalOrganizationUser,\n  ): Promise<PersonalOrganizationResult> {\n    const [existing] = await db\n      .select({\n        organization: organizations,\n        member: organizationMembers,\n      })\n      .from(organizationMembers)\n      .innerJoin(organizations, eq(organizations.id, organizationMembers.organizationId))\n      .where(and(\n        eq(organizationMembers.userId, user.id),\n        eq(organizations.kind, 'personal'),\n      ))\n      .limit(1)\n\n    if (existing) {\n      return {\n        organization: existing.organization,\n        member: existing.member,\n        role: existing.member.role as OrganizationRole,\n      }\n    }\n\n    const orgName = user.name?.trim() || user.email?.split('@')[0] || 'Personal'\n    const slug = `personal-${user.id}`\n    const [organization] = await db\n      .insert(organizations)\n      .values({\n        name: `${orgName}'s Organization`,\n        slug,\n        kind: 'personal',\n        createdBy: user.id,\n      })\n      .onConflictDoUpdate({\n        target: organizations.slug,\n        set: { updatedAt: new Date() },\n      })\n      .returning()\n\n    // A single-row upsert with .returning() always yields exactly one row.\n    const org = organization as OrganizationRow\n\n    const [member] = await db\n      .insert(organizationMembers)\n      .values({\n        organizationId: org.id,\n        userId: user.id,\n        role: 'owner',\n      })\n      .onConflictDoUpdate({\n        target: [organizationMembers.organizationId, organizationMembers.userId],\n        set: { role: 'owner', updatedAt: new Date() },\n      })\n      .returning()\n\n    return { organization: org, member: member as OrganizationMemberRow, role: 'owner' }\n  }\n}\n"],"mappings":";;;;;;;AAqBA,SAAS,WAAW;AACpB,SAAS,OAAO,SAAS,aAAa,MAAM,mBAAmB;AAa/D,IAAM,QAAQ,MAAM,KAAK,IAAI,EAAE,WAAW,EAAE,QAAQ,iCAAiC;AAErF,IAAM,YAAY,MAAM,QAAQ,cAAc,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,kBAAkB;AAEzG,IAAM,YAAY,MAAM,QAAQ,cAAc,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,kBAAkB;AAElG,SAAS,iBAAiB,MAA+B;AAC9D,QAAM,EAAE,WAAW,eAAe,IAAI;AAEtC,QAAM,gBAAgB,YAAY,gBAAgB;AAAA,IAChD,IAAI,MAAM;AAAA,IACV,MAAM,KAAK,MAAM,EAAE,QAAQ;AAAA,IAC3B,MAAM,KAAK,MAAM,EAAE,QAAQ,EAAE,OAAO;AAAA,IACpC,MAAM,KAAK,QAAQ,EAAE,MAAM,CAAC,YAAY,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,UAAU;AAAA,IAC/E,WAAW,KAAK,YAAY,EAAE,QAAQ,EAAE,WAAW,MAAM,UAAU,IAAI,EAAE,UAAU,UAAU,CAAC;AAAA,IAC9F,WAAW,UAAU;AAAA,IACrB,WAAW,UAAU;AAAA,EACvB,GAAG,CAAC,UAAU;AAAA,IACZ,MAAM,6BAA6B,EAAE,GAAG,MAAM,SAAS;AAAA,EACzD,CAAC;AAED,QAAM,sBAAsB,YAAY,uBAAuB;AAAA,IAC7D,IAAI,MAAM;AAAA,IACV,gBAAgB,KAAK,iBAAiB,EAAE,QAAQ,EAAE,WAAW,MAAM,cAAc,IAAI,EAAE,UAAU,UAAU,CAAC;AAAA,IAC5G,QAAQ,KAAK,SAAS,EAAE,QAAQ,EAAE,WAAW,MAAM,UAAU,IAAI,EAAE,UAAU,UAAU,CAAC;AAAA,IACxF,MAAM,KAAK,QAAQ,EAAE,MAAM,CAAC,SAAS,SAAS,UAAU,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,QAAQ;AAAA,IAChG,WAAW,UAAU;AAAA,IACrB,WAAW,UAAU;AAAA,EACvB,GAAG,CAAC,UAAU;AAAA,IACZ,YAAY,sBAAsB,EAAE,GAAG,MAAM,gBAAgB,MAAM,MAAM;AAAA,IACzE,MAAM,qBAAqB,EAAE,GAAG,MAAM,MAAM;AAAA,EAC9C,CAAC;AAED,QAAM,mBAAmB,YAAY,oBAAoB;AAAA,IACvD,IAAI,MAAM;AAAA,IACV,aAAa,KAAK,cAAc,EAAE,QAAQ,EAAE,WAAW,MAAM,eAAe,IAAI,EAAE,UAAU,UAAU,CAAC;AAAA,IACvG,sBAAsB,KAAK,wBAAwB,EAAE,WAAW,MAAM,oBAAoB,IAAI,EAAE,UAAU,UAAU,CAAC;AAAA,IACrH,QAAQ,KAAK,SAAS,EAAE,WAAW,MAAM,UAAU,IAAI,EAAE,UAAU,UAAU,CAAC;AAAA,IAC9E,MAAM,KAAK,QAAQ,EAAE,MAAM,CAAC,SAAS,SAAS,UAAU,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,QAAQ;AAAA,IAC/F,WAAW,KAAK,YAAY;AAAA,IAC5B,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,WAAW,QAAQ,cAAc,EAAE,MAAM,YAAY,CAAC,EAAE,QAAQ,EAAE,QAAQ,kBAAkB;AAAA,IAC5F,YAAY,QAAQ,eAAe,EAAE,MAAM,YAAY,CAAC;AAAA,EAC1D,GAAG,CAAC,UAAU;AAAA,IACZ,YAAY,kCAAkC,EAAE,GAAG,MAAM,aAAa,MAAM,oBAAoB;AAAA,IAChG,MAAM,2BAA2B,EAAE,GAAG,MAAM,aAAa,MAAM,MAAM;AAAA,IACrE,MAAM,iBAAiB,EAAE,GAAG,MAAM,MAAM;AAAA,IACxC,YAAY,yBAAyB,EAAE,GAAG,MAAM,WAAW;AAAA,EAC7D,CAAC;AAED,SAAO,EAAE,eAAe,qBAAqB,iBAAiB;AAChE;;;ACpEA,SAAS,KAAK,MAAM,IAAI,iBAAiB;AAsDlC,SAAS,sBAAsB,MAA+C;AACnF,QAAM,EAAE,IAAI,QAAQ,eAAe,IAAI;AACvC,QAAM,EAAE,eAAe,qBAAqB,iBAAiB,IAAI;AACjE,QAAM,aAAa;AAEnB,iBAAe,mBACb,aACA,QACA,UAAyB,UACQ;AACjC,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO;AAAA,MACN,WAAW;AAAA,MACX,cAAc;AAAA,MACd,oBAAoB;AAAA,MACpB,aAAa,iBAAiB;AAAA,MAC9B,YAAY,iBAAiB;AAAA,IAC/B,CAAC,EACA,KAAK,UAAU,EACf,UAAU,eAAe,GAAG,cAAc,IAAI,WAAW,cAAc,CAAC,EACxE,UAAU,qBAAqB;AAAA,MAC9B,GAAG,oBAAoB,gBAAgB,WAAW,cAAc;AAAA,MAChE,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IACvC,CAAC,EACA,SAAS,kBAAkB;AAAA,MAC1B,GAAG,iBAAiB,aAAa,WAAW,EAAE;AAAA,MAC9C,GAAG,iBAAiB,sBAAsB,oBAAoB,EAAE;AAAA,MAChE,UAAU,iBAAiB,UAAU;AAAA,IACvC,CAAC,EACA,MAAM,GAAG,WAAW,IAAI,WAAW,CAAC,EACpC,MAAM,CAAC;AAEV,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,OAAO,qBAAqB,IAAI,mBAAmB,MAAM,IAAI,WAAmC;AACtG,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,CAAC,iBAAiB,MAAM,OAAO,EAAG,QAAO;AAE7C,WAAO;AAAA,MACL,WAAW,IAAI;AAAA,MACf,cAAc,IAAI;AAAA,MAClB,oBAAoB,IAAI;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,uBACb,aACA,QACA,UAAyB,UACC;AAC1B,UAAM,SAAS,MAAM,mBAAmB,aAAa,QAAQ,OAAO;AACpE,QAAI,CAAC,OAAQ,OAAM,IAAI,SAAS,uBAAuB,EAAE,QAAQ,IAAI,CAAC;AACtE,WAAO;AAAA,EACT;AAEA,iBAAe,mBAAmB,QAAiD;AACjF,UAAM,OAAO,MAAM,GAChB,OAAO;AAAA,MACN,WAAW;AAAA,MACX,cAAc;AAAA,MACd,oBAAoB;AAAA,MACpB,aAAa,iBAAiB;AAAA,IAChC,CAAC,EACA,KAAK,UAAU,EACf,UAAU,eAAe,GAAG,cAAc,IAAI,WAAW,cAAc,CAAC,EACxE,UAAU,qBAAqB;AAAA,MAC9B,GAAG,oBAAoB,gBAAgB,WAAW,cAAc;AAAA,MAChE,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IACvC,CAAC,EACA,SAAS,kBAAkB;AAAA,MAC1B,GAAG,iBAAiB,aAAa,WAAW,EAAE;AAAA,MAC9C,GAAG,iBAAiB,sBAAsB,oBAAoB,EAAE;AAAA,MAChE,UAAU,iBAAiB,UAAU;AAAA,IACvC,CAAC,EAGA,QAAQ,KAAK,WAAW,SAAS,CAAC;AAErC,WAAO,KAAK,QAAQ,CAAC,QAAa;AAChC,YAAM,OAAO,qBAAqB,IAAI,mBAAmB,MAAM,IAAI,WAAmC;AACtG,UAAI,CAAC,KAAM,QAAO,CAAC;AACnB,aAAO,CAAC;AAAA,QACN,GAAI,IAAI;AAAA,QACR,gBAAgB,IAAI,aAAa;AAAA,QACjC,kBAAkB,IAAI,aAAa;AAAA,QACnC;AAAA,MACF,CAAyB;AAAA,IAC3B,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,oBAAoB,wBAAwB,mBAAmB;AAC1E;AAkBO,SAAS,yBAAyB,MAA8D;AACrG,QAAM,EAAE,IAAI,OAAO,IAAI;AACvB,QAAM,EAAE,eAAe,oBAAoB,IAAI;AAE/C,iBAAe,sBACb,gBACA,QACA,UAA4B,UACQ;AACpC,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO;AAAA,MACN,cAAc;AAAA,MACd,QAAQ;AAAA,IACV,CAAC,EACA,KAAK,mBAAmB,EACxB,UAAU,eAAe,GAAG,cAAc,IAAI,oBAAoB,cAAc,CAAC,EACjF,MAAM;AAAA,MACL,GAAG,oBAAoB,gBAAgB,cAAc;AAAA,MACrD,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IACvC,CAAC,EACA,MAAM,CAAC;AAEV,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,OAAO,IAAI,OAAO;AACxB,QAAI,CAAC,oBAAoB,MAAM,OAAO,EAAG,QAAO;AAChD,WAAO,EAAE,cAAc,IAAI,cAAc,QAAQ,IAAI,QAAQ,KAAK;AAAA,EACpE;AAEA,iBAAe,0BACb,gBACA,QACA,UAA4B,UACC;AAC7B,UAAM,SAAS,MAAM,sBAAsB,gBAAgB,QAAQ,OAAO;AAC1E,QAAI,CAAC,OAAQ,OAAM,IAAI,SAAS,0BAA0B,EAAE,QAAQ,IAAI,CAAC;AACzE,WAAO;AAAA,EACT;AAEA,SAAO,EAAE,uBAAuB,0BAA0B;AAC5D;;;AC1MA,SAAS,OAAAA,MAAK,MAAAC,WAAU;AAsBjB,SAAS,iCAAiC,MAAyC;AACxF,QAAM,EAAE,IAAI,OAAO,IAAI;AACvB,QAAM,EAAE,eAAe,oBAAoB,IAAI;AAE/C,SAAO,eAAe,2BACpB,MACqC;AACrC,UAAM,CAAC,QAAQ,IAAI,MAAM,GACtB,OAAO;AAAA,MACN,cAAc;AAAA,MACd,QAAQ;AAAA,IACV,CAAC,EACA,KAAK,mBAAmB,EACxB,UAAU,eAAeA,IAAG,cAAc,IAAI,oBAAoB,cAAc,CAAC,EACjF,MAAMD;AAAA,MACLC,IAAG,oBAAoB,QAAQ,KAAK,EAAE;AAAA,MACtCA,IAAG,cAAc,MAAM,UAAU;AAAA,IACnC,CAAC,EACA,MAAM,CAAC;AAEV,QAAI,UAAU;AACZ,aAAO;AAAA,QACL,cAAc,SAAS;AAAA,QACvB,QAAQ,SAAS;AAAA,QACjB,MAAM,SAAS,OAAO;AAAA,MACxB;AAAA,IACF;AAEA,UAAM,UAAU,KAAK,MAAM,KAAK,KAAK,KAAK,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AAClE,UAAM,OAAO,YAAY,KAAK,EAAE;AAChC,UAAM,CAAC,YAAY,IAAI,MAAM,GAC1B,OAAO,aAAa,EACpB,OAAO;AAAA,MACN,MAAM,GAAG,OAAO;AAAA,MAChB;AAAA,MACA,MAAM;AAAA,MACN,WAAW,KAAK;AAAA,IAClB,CAAC,EACA,mBAAmB;AAAA,MAClB,QAAQ,cAAc;AAAA,MACtB,KAAK,EAAE,WAAW,oBAAI,KAAK,EAAE;AAAA,IAC/B,CAAC,EACA,UAAU;AAGb,UAAM,MAAM;AAEZ,UAAM,CAAC,MAAM,IAAI,MAAM,GACpB,OAAO,mBAAmB,EAC1B,OAAO;AAAA,MACN,gBAAgB,IAAI;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,MAAM;AAAA,IACR,CAAC,EACA,mBAAmB;AAAA,MAClB,QAAQ,CAAC,oBAAoB,gBAAgB,oBAAoB,MAAM;AAAA,MACvE,KAAK,EAAE,MAAM,SAAS,WAAW,oBAAI,KAAK,EAAE;AAAA,IAC9C,CAAC,EACA,UAAU;AAEb,WAAO,EAAE,cAAc,KAAK,QAAyC,MAAM,QAAQ;AAAA,EACrF;AACF;","names":["and","eq"]}

package/dist/teams/index.d.ts

@@ -0,0 +1,44 @@
+export { A as ASSIGNABLE_WORKSPACE_ROLES, a as AssignableWorkspaceRole, b as ORGANIZATION_ROLES, c as ORGANIZATION_ROLE_RANK, O as OrganizationRole, S as SandboxWorkspaceRole, W as WORKSPACE_ROLES, d as WORKSPACE_ROLE_RANK, e as WorkspaceCollaborationAccess, f as WorkspaceRole, g as canManageWorkspaceMemberRole, h as hasOrganizationRole, i as hasWorkspaceRole, j as isAssignableWorkspaceRole, o as organizationRoleGrantsWorkspaceOwner, r as resolveWorkspaceRole, w as workspaceRoleToCollaborationAccess, k as workspaceRoleToSandboxRole } from '../roles-CLtYKHHl.js';
+
+/**
+ * Pure invite-token helpers — generation, shape validation, and expiry math.
+ * No I/O: the members API persists/looks up tokens; these functions only
+ * produce well-formed tokens and decide, given values the caller already
+ * loaded, whether an invite is usable.
+ *
+ * A token is an opaque high-entropy URL-safe string. It is the bearer secret
+ * in `/invite/:token`, so it must be unguessable and never derived from the
+ * email or workspace. `generateInviteToken` uses Web Crypto (`crypto`), which
+ * is present in Workers, Node 18+, Deno, and browsers — no Node-only import,
+ * so this stays a pure leaf.
+ */
+/** Cryptographically-random, URL-safe (base64url) invite token. */
+declare function generateInviteToken(): string;
+/** True when `value` has the shape of an invite token (not whether it exists). */
+declare function isInviteTokenShape(value: unknown): value is string;
+/** A pending invite row, narrowed to the fields invite acceptance reasons over. */
+interface InviteTokenState {
+    /** null until accepted — a non-null value means the invite was already used. */
+    acceptedAt: Date | number | null | undefined;
+    /** Email the invite was addressed to, if any. */
+    inviteEmail?: string | null;
+    /** Optional hard expiry; omit/undefined for invites that never expire. */
+    expiresAt?: Date | number | null;
+}
+type InviteRejectionReason = 'already-accepted' | 'expired' | 'email-mismatch';
+interface InviteValidationResult {
+    ok: boolean;
+    reason?: InviteRejectionReason;
+}
+/**
+ * Decide whether a loaded invite can be accepted by `acceptingEmail` at `now`.
+ * Pure: the caller has already fetched the row by token; this only judges it.
+ * Email match is case-insensitive and only enforced when the invite was
+ * addressed to a specific email (an open invite has no `inviteEmail`).
+ */
+declare function validateInviteToken(invite: InviteTokenState, opts?: {
+    acceptingEmail?: string | null;
+    now?: Date;
+}): InviteValidationResult;
+
+export { type InviteRejectionReason, type InviteTokenState, type InviteValidationResult, generateInviteToken, isInviteTokenShape, validateInviteToken };

package/dist/teams/index.js

@@ -0,0 +1,39 @@
+import {
+  generateInviteToken,
+  isInviteTokenShape,
+  validateInviteToken
+} from "../chunk-3SVAA3MA.js";
+import {
+  ASSIGNABLE_WORKSPACE_ROLES,
+  ORGANIZATION_ROLES,
+  ORGANIZATION_ROLE_RANK,
+  WORKSPACE_ROLES,
+  WORKSPACE_ROLE_RANK,
+  canManageWorkspaceMemberRole,
+  hasOrganizationRole,
+  hasWorkspaceRole,
+  isAssignableWorkspaceRole,
+  organizationRoleGrantsWorkspaceOwner,
+  resolveWorkspaceRole,
+  workspaceRoleToCollaborationAccess,
+  workspaceRoleToSandboxRole
+} from "../chunk-63CE7FEZ.js";
+export {
+  ASSIGNABLE_WORKSPACE_ROLES,
+  ORGANIZATION_ROLES,
+  ORGANIZATION_ROLE_RANK,
+  WORKSPACE_ROLES,
+  WORKSPACE_ROLE_RANK,
+  canManageWorkspaceMemberRole,
+  generateInviteToken,
+  hasOrganizationRole,
+  hasWorkspaceRole,
+  isAssignableWorkspaceRole,
+  isInviteTokenShape,
+  organizationRoleGrantsWorkspaceOwner,
+  resolveWorkspaceRole,
+  validateInviteToken,
+  workspaceRoleToCollaborationAccess,
+  workspaceRoleToSandboxRole
+};
+//# sourceMappingURL=index.js.map

package/dist/teams/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/teams/members-api.d.ts

@@ -0,0 +1,152 @@
+import { f as WorkspaceRole } from '../roles-CLtYKHHl.js';
+import { T as TeamDatabase, a as TeamTables, g as TeamParentTable, h as WorkspaceAccessApi } from '../access-ChAHG4Tp.js';
+import 'drizzle-orm/sqlite-core';
+
+/**
+ * Framework-neutral members API for the teams module: the invite / list /
+ * update-role / remove / accept-invite logic, lifted out of any one app's route
+ * file. Each app mounts these in its own route with its own auth — the handlers
+ * take an already-authenticated `actor`, the parsed inputs, the `db` + `tables`
+ * from `createTeamTables`, the product's user + workspace tables, and the
+ * workspace-access API from `createWorkspaceAccess`. They return web-standard
+ * `Response`s (available in Workers, Node 18+, Deno, browsers), so
+ * "framework-neutral" is literal: no Remix/React-Router/Express import anywhere.
+ *
+ * Two OPTIONAL seams an app wires only if it needs them:
+ *   - `enforceSeat` — billing/seat-limit gate, called at invite time only when
+ *     the invite would consume a NEW billable seat. An app without seat billing
+ *     passes nothing and seats are never checked.
+ *   - `memberSyncSeam` — fire-and-forget propagation of membership changes to a
+ *     sandbox/external system (add on accept, role on update, remove on
+ *     delete). An app without sandbox sync passes nothing. Fail-soft by
+ *     contract: a thrown sync is caught and never blocks the DB mutation.
+ *
+ * Imports `drizzle-orm`, so this is a subpath, never re-exported from root.
+ */
+
+/** The authenticated caller — apps resolve this from their own session layer. */
+interface MembersApiActor {
+    id: string;
+    email?: string | null;
+}
+/**
+ * The product's user table, narrowed to the columns the member queries read.
+ * Adopters pass their real drizzle user table.
+ */
+interface UserLookupTable {
+    id: any;
+    name: any;
+    email: any;
+}
+/**
+ * The product's workspace table, narrowed to the columns the member queries
+ * read. The handlers join it to resolve a workspace's organization (the same
+ * table passed to createTeamTables as workspaceTable).
+ */
+interface WorkspaceLookupTable {
+    id: any;
+    organizationId: any;
+}
+/**
+ * Optional billing seat gate. The seam resolves the count input itself (it
+ * owns the plan/seat model) and throws when over the limit; the handler turns a
+ * thrown `SeatLimitError` into a 402. Called only when an invite would consume
+ * a NEW seat (invitee is not already an org member and has no pending org
+ * invite) — the same guard gtm uses, so the seam never fires on a no-op invite.
+ */
+interface EnforceSeatSeam {
+    (input: {
+        actorId: string;
+        organizationId: string;
+    }): Promise<void> | void;
+}
+/** Thrown by an `enforceSeat` seam to deny an invite; serialized to a 402. */
+declare class SeatLimitError extends Error {
+    readonly status: number;
+    readonly capability?: string;
+    readonly requiredPlan?: string;
+    constructor(message: string, opts?: {
+        status?: number;
+        capability?: string;
+        requiredPlan?: string;
+    });
+}
+/**
+ * Optional membership-change propagation to an external system (e.g. sandbox).
+ * Every method is fire-and-forget and fail-soft: the handler awaits nothing and
+ * swallows rejections, so an unavailable downstream never blocks the mutation.
+ * Each fires only for members with a real `userId` (never email-only invites).
+ */
+interface MemberSyncSeam {
+    add?(input: {
+        workspaceId: string;
+        userId: string;
+        role: WorkspaceRole;
+    }): Promise<void> | void;
+    role?(input: {
+        workspaceId: string;
+        userId: string;
+        role: WorkspaceRole;
+    }): Promise<void> | void;
+    remove?(input: {
+        workspaceId: string;
+        userId: string;
+    }): Promise<void> | void;
+}
+interface MembersApiOptions {
+    db: TeamDatabase;
+    tables: TeamTables;
+    /** The product's user table (FK target passed to createTeamTables). */
+    userTable: TeamParentTable & UserLookupTable;
+    /** The product's workspace table (FK target passed to createTeamTables). */
+    workspaceTable: TeamParentTable & WorkspaceLookupTable;
+    /** Workspace-access API from createWorkspaceAccess — RBAC stays one source. */
+    access: Pick<WorkspaceAccessApi, 'getWorkspaceAccess'>;
+    enforceSeat?: EnforceSeatSeam;
+    memberSyncSeam?: MemberSyncSeam;
+}
+interface MemberListEntry {
+    id: string;
+    userId: string | null;
+    organizationMemberId: string | null;
+    role: WorkspaceRole;
+    name: string | null;
+    email: string | null;
+    invitedAt: Date | number | null;
+    acceptedAt: Date | number | null;
+    inherited: boolean;
+}
+/**
+ * Build the members API bound to one product's db/tables/access. Returns five
+ * handlers; an app maps its route methods onto them (GET→list, POST→invite,
+ * PATCH→updateRole, DELETE→remove; accept on its own route).
+ */
+declare function createMembersApi(opts: MembersApiOptions): {
+    listMembers: (input: {
+        workspaceId: string;
+        actor: MembersApiActor;
+    }) => Promise<Response>;
+    inviteMember: (input: {
+        workspaceId: string;
+        actor: MembersApiActor;
+        email?: string;
+        role?: string;
+    }) => Promise<Response>;
+    updateMemberRole: (input: {
+        workspaceId: string;
+        actor: MembersApiActor;
+        memberId?: string;
+        role?: string;
+    }) => Promise<Response>;
+    removeMember: (input: {
+        workspaceId: string;
+        actor: MembersApiActor;
+        memberId?: string;
+    }) => Promise<Response>;
+    acceptInvite: (input: {
+        token?: string;
+        actor: MembersApiActor;
+    }) => Promise<Response>;
+};
+
+export { type EnforceSeatSeam, type MemberListEntry, type MemberSyncSeam, type MembersApiActor, type MembersApiOptions, SeatLimitError, type UserLookupTable, type WorkspaceLookupTable, createMembersApi };