fix(client): default organizations.invite role to 'member' so the shorter call works - #17270

Fixes #16582

Clause-②: no

organizations.invite declares role? as optional, and better-auth 1.7.2's body schema for POST /organization/invite-member makes role required. The SDK forwarded the caller's object verbatim, so the documented-looking minimal call was refused before it reached any ObjectStack code. Omitting role now sends 'member'.

⛔ No published type moves. role stays optional; the declaration is untouched. The other self-consistent repair — declaring role required — is a narrowing of a published request type and was weighed and rejected on the card; case ⑤ of the new suite is a compile-time pin that reddens if anyone takes it later.

Why 'member', and the objection answered out loud

Defaulting a role means implicitly choosing a permission level for the caller. Three things make 'member' the answer rather than a guess:

• The sibling already does it. organizations.invitations.resend has always substituted role ?? 'member' over the same vendor endpoint. That asymmetry is the whole reason the gap stayed invisible: one member of the family papered over the vendor's requirement and the other did not, so only the shorter form ever failed. Aligning them is 「① 缩小特例」的直接兑现——同一家族一套行为.
• It is the floor of a closed vocabulary. ADR-0108 D1 fixes the membership roles at owner, admin, delegated_admin, member; orgRoleGrade starts at GRADE_MEMBER and rises only for owner/admin. The default cannot confer more reach than the caller asked for.
• Nothing is conferred at invite time. The row lands status: 'pending'; the invitee must still accept, and an admin can change the role first.

I do not judge implicit role assignment unacceptable here, so the route was not switched.

Driven — before and after, on a real wire

Real AuthManager (better-auth 1.7.2, organization plugin, teams enabled — 9 team endpoints present) over a real SqlDriver (better-sqlite3), through the real ObjectStackClient:

BEFORE   POST /organization/invite-member -> 400 {"message":"[body.role] Invalid input","code":"VALIDATION_ERROR"}
AFTER    POST /organization/invite-member -> 200 {"role":"member","status":"pending","teamId":null, ...}

Both runs also drove the two controls that must not move: an explicit role: 'member' (200 before and after) and invitations.resend (200 before and after).

The committed suite packages/client/src/organization-invite-role-default.test.ts re-drives this rather than mocking it — real AuthManager over a real ObjectQL on a real SqliteWasmDriver, only the socket stood in for. Cases ④a–c additionally hold the request bytes to full-string equality, which is the half the drive structurally cannot see.

Caller census — the stop condition, and it did not trip

The card and triage made this the first task, with a positive control, because 「一个未经证明的搜索面给出的零是仪器的零,不是读数」.

The three in-repo hits that are not live callers: resend (sends a role), return-type-precision.test.ts (type-only expectTypeOf, never issues a request), and a packages/client/CHANGELOG.md example — which this change makes true. ⇒ Latent trap, not a path broken today; the p3 grading stands.

Ablation — prediction written first, observed as predicted

Predicted before any leg ran: reverting to the pre-fix body turns the suite RED at 4 failed / 2 passed, failing exactly ①, ③, ④a, ④c and passing ② and ④b (both name a role explicitly, so their bytes are unchanged).

Observed: Tests 4 failed | 2 passed (6) — × ①, × ③, × ④a, × ④c. Prediction held.

Mutation proven on disk before the run (fixed spelling 1 → 0, pre-fix spelling 16 → 17, blob 264f459c… → 9f399ef7…). Restore proven after: git checkout HEAD -- ABSOLUTE_PATH, blob back to 264f459c… = HEAD's blob, git diff HEAD empty, counts back to 1/16, git status --porcelain clean. No dist/ preflight applies — the suite imports the subject as ./index, so the resolution path is source, not the package's exports.

Verification

Anchored at the final head (post-merge with origin/main).

• Gate family — derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack on the final tree: 59 families, all green, reconciled with --ran (59 derived / 59 run / 0 NOT-MEASURED / 0 UNRUN). Three of them (check:skill-examples, check:dual-build-cjs-loads, check:type-check-debt) first answered PREREQUISITE NOT MET / OOM against an unbuilt tree — ⛔ recorded as NOT MEASURED, then rebuilt and re-run to a real green.
• Package — pnpm --filter @objectstack/client test: 41 files / 492 tests passed. typecheck: green, and check:test-typecheck compiles the test layer, so case ⑤'s type pin is really evaluated.
• Lint — the whole population, not a narrowing: eslint . --no-inline-config --format json over 6449 files, 0 errors, 0 warnings, exit 0.
• Docs drift — affected-docs.mjs lists 0 rows. The three blind spots checked by hand: the only text this change makes newly TRUE is the generated packages/client/CHANGELOG.md example; the prose-class sweep across content/docs and docs/ (which the tool never walks) finds 5 files naming the surface, and every one of them spells role explicitly, so none is stale in either direction.

Scope

Request shape only. No response body, no declared return type, no published response contract. ⛔ PR #16576 / card #14314 untouched — it binds return types and its pin's invite({ email }) is a type-only assertion that never issues a request. ⛔ Not merged with #15447 (same seam, opposite failure mode: there the vendor silently strips, here it loudly requires).

packages/client/src/index.ts is a measured hard-serial hot spot. Re-swept at claim time and again at the end of the run: 23 open PRs, paged to the end, each read against its own merge base (the one 100-file page fully paged to 207) — zero touch this file. Control: the same method detects it on #17237 and #16694.

验收备注

• invitations.resend still spells its own role: invitation.role ?? 'member'. It is now redundant, and it is left alone deliberately: removing it is polish on a hard-serial file and changes no behaviour. Worth folding into whatever next edits that method.
• invitations.resend declares teamId?: string | null and never forwards it — invite has no teamId member, so a caller's team placement is silently dropped. Noted here rather than filed; see the report comment on the card.

Generated by Claude Code