fix(invitations): break outbox import cycle

[TheodoreSpeaks]

Summary

• isolate the direct-grant outbox contract from the grant implementation
• defer auth-dependent session activation to prevent circular server module initialization
• add import-boundary regression coverage

Type of Change

• Bug fix

Testing

• 104 focused tests passed
• lint and all 32 repository audits passed
• type-check and API validation passed

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 22, 2026 3:05am

[cursor]

PR Summary

Medium Risk
Touches invitation-acceptance session activation and outbox event wiring used by admin/enterprise jobs. Behavior is intended to be unchanged, but a wrong import boundary could still cause server init or missed email jobs.

Overview
Breaks a circular server-module graph between auth initialization, invitation acceptance, and direct-grant outbox handling.

The workspace-added email event type and payload now live in a dependency-free direct-grant-event module. Admin invitation operations and enterprise provisioning import that contract instead of the grant implementation.

Invitation acceptance still activates the org on the current session, but loads setActiveOrganizationForCurrentSession dynamically so core is no longer in the static auth init graph. A new import-boundary test guards both constraints.

^{Reviewed by Cursor Bugbot for commit 522874b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR breaks an invitation/outbox initialization cycle by extracting the direct-grant email event contract and deferring the auth-dependent organization activation import.

• Moves the direct-grant email event type and payload into a dependency-free module.
• Updates admin, billing, implementation, and test imports to use the extracted contract.
• Dynamically loads session activation after invitation acceptance.
• Adds regression coverage for the relevant static import boundaries.

Confidence Score: 5/5

The PR appears safe to merge with no concrete correctness, security, or build failures identified.

The moved exports have no stale consumers, the deferred import remains within the invitation route’s request scope, and the new boundary tests cover the static initialization relationship responsible for the cycle.

Important Files Changed

Filename	Overview
apps/sim/lib/invitations/core.ts	Replaces the static auth dependency with a request-scoped dynamic import while preserving post-commit activation and error handling.
apps/sim/lib/invitations/direct-grant-event.ts	Introduces a dependency-free module containing the unchanged direct-grant email event contract.
apps/sim/lib/invitations/direct-grant.ts	Imports the extracted event contract without changing direct-grant behavior or its remaining public exports.
apps/sim/lib/invitations/import-boundary.test.ts	Adds focused regression checks preventing direct grants from statically reaching auth initialization and keeping the event contract dependency-free.
apps/sim/lib/admin/invitation-operation.ts	Redirects event-contract imports to the new dependency-free module.
apps/sim/lib/billing/enterprise-provisioning.ts	Redirects the direct-grant event-type import to the extracted contract module.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Outbox[Outbox processor] --> Grant[direct-grant.ts]
  Grant --> Core[invitations/core.ts]
  Grant --> Event[direct-grant-event.ts]
  Core -. deferred import .-> ActiveOrg[auth/active-organization.ts]
  ActiveOrg --> Auth[auth/auth.ts]
  Event -. dependency-free contract .-> Admin[Admin invitation operations]
  Event -. dependency-free contract .-> Billing[Enterprise provisioning]

Loading

_{Reviews (1): Last reviewed commit: "fix(invitations): break outbox import cy..." | Re-trigger Greptile}