feat: add mailing and organizations

[RedStar071]

Summary

Following supastarter's Nuxt guides (mailing overview, organizations: store data for organizations):

• packages/mail: a Maizzle-backed mail package. Templates live in emails/ (Vue SFC + Tailwind, compiled and inlined per send), registered by id in src/util/templates.ts with their subject. Delivery goes through a single MailProvider contract selected in src/provider/index.ts; console is the default (logs instead of sending), with Resend and Nodemailer SMTP behind it, both imported lazily so only the configured transport has to be installed.
• Organizations, added at the auth layer and in the dashboard: Better Auth's organization plugin wired into packages/auth, a Drizzle migration for organization/member/invitation plus session.active_organization_id, and an app/modules/organizations dashboard module (switcher, member list, invite form, accept-invitation page).
• apps/dashboard restructured into supastarter-style feature modules (modules/{auth,dashboard,shared,organizations}) before adding the above, so the new organizations module has somewhere to land that matches the rest of the app.

Architecture boundary

packages/auth declares SendInvitationEmail structurally and never imports @agent-zero/mail — one capability package must not import another. apps/auth-server (the composition root) builds a mailer with createMailer() and injects it into createAuth(). createAuth refuses to construct when organizations are enabled without a transport, so a misconfigured deployment fails at startup rather than accepting invitations nobody is ever told about.

apps/dashboard stays frontend-only: the organizations module only calls the Better Auth client (organizationClient()), declares its own Organization/OrganizationMember types rather than importing them from @agent-zero/auth (which would pull the database adapter into the browser bundle), and every mutation refetches from the server rather than patching local state.

Both features are off by default: AUTH_ENABLE_ORGANIZATIONS=false and MAIL_PROVIDER=console, so this PR doesn't change behavior for existing deployments.

Also in this branch

• refactor(dashboard): reorganizes apps/dashboard/app into modules/{auth,dashboard,shared} (prerequisite restructuring, done first at the user's request and reviewed separately in-session).
• chore(ci): drops two CI jobs (knip, i18n) that were unrelated to this work and got swept into an earlier commit — the i18n job checked packages/i18n/* paths that don't exist in this repo (i18n lives under apps/dashboard/i18n/), so it would have failed or silently no-op'd against the wrong paths. Left for whoever intended that CI coverage to reintroduce it correctly, separately.

Type of Change

• New feature
• Bug fix
• Breaking change
• Refactor
• Cosmetic
• Documentation
• Workflow

Test Procedure

Ran the full required check set from CONTRIBUTING.md:

aube run check:repo # pass
aube run lint:ci # pass, 0 warnings/errors across all 20 packages, incl. new packages/mail
aube run typecheck # pass, 20/20 packages
aube test # pass, 20/20 task files — packages/mail: 12 tests (incl. a real Maizzle
# render pass: interpolation, Tailwind inlining, plaintext), packages/auth:
# 19 tests (incl. the sendInvitationEmail startup guard), apps/dashboard:
# 35 tests
aube run build # pass, 12/12 tasks

Also manually rendered OrganizationInvitation.vue through @maizzle/framework's render() outside the test suite to confirm Tailwind classes compile to inlined style= attributes rather than leaking class= into the output (mail clients routinely strip <style>/classes).

resend is pinned to 6.17.1 in packages/mail/package.json: aube add refused 6.18.1 because it dropped the trusted-publisher provenance that 6.17.1 carries (ERR_AUBE_TRUST_DOWNGRADE) — not bypassed.

Safety Impact

• packages/auth and apps/dashboard still do not execute repository work or own persistence outside apps/auth-server, per the architecture boundaries in AGENTS.md.
• The console mail provider never logs a message body, since invitation and password-reset links carry single-use tokens that routinely end up in shared terminal scrollback and CI logs otherwise — covered by a test.
• The organization Drizzle migration (packages/auth/drizzle/0001_peaceful_franklin_storm.sql) is additive only: new tables plus one nullable column on session, safe against an existing database.
• Invitation-accept links resolve against the dashboard origin, not the auth server's, and the invitation id from the email link is passed straight to the auth server without being trusted to build a redirect target.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

Confidence Score: 4/5

Member removal is not ready to merge until a rejected request reliably remains visible to the administrator.

One confirmed user-facing failure remains: the follow-up member refresh clears the error from a rejected removal request.

Files Needing Attention: apps/dashboard/app/modules/organizations/composables/useOrganizations.ts

T-Rex Logs

What T-Rex did

• Generated and validated proofs for a posted P1 finding, including two finding-comment proofs.
• Ran an authored executable that started the auth-server composition root with organizations enabled, first without MAIL_PROVIDER and then with MAIL_PROVIDER=console, and observed exits before binding a listener, confirming console-only invitation delivery is rejected.
• Performed an SMTP STARTTLS integration check against a local relay to verify plaintext fallback is blocked, with STARTTLS attempt leading to a guarded failure as expected.
• Verified the useOrganizations test context and code behavior, including where error state is cleared at the start and how refreshMembers is invoked after removeMember, with related outputs uploaded and no production code changes.
• Captured and preserved the authored executable source and runtime outputs, including guard messages for both provider configurations.

_{Ran code and verified through T-Rex}

Prompt To Fix All With AI

### Issue 1
apps/dashboard/app/modules/organizations/composables/useOrganizations.ts:138
**Member-removal errors are cleared by the refresh**
When `organization.removeMember()` resolves with an API error, `run` records that error, but `removeMember` immediately calls `refreshMembers`. A successful refresh clears the shared error at the start of its own `run`, so the organizations page has no error to display for the rejected removal. Refresh members only after a successful removal, or preserve the mutation error across the refresh.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (3): Last reviewed commit: "Merge branch 'main' into feat/mailing-an..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​ai-sdk/​google@​4.0.41
	@​ai-sdk/​openai@​4.0.37
	@​maizzle/​tailwindcss@​1.5.6
	shiki@​4.4.3
	@​maizzle/​framework@​6.0.13
	tsx@​4.23.12
	tailwind-merge@​3.6.0
	@​ai-sdk/​anthropic@​4.0.37
	oxlint@​1.77.0 ⏵ 1.78.0	+1		+1
	nodemailer@​9.0.5
	kysely@​0.29.5
	knip@​6.32.1
	resend@​6.17.1
	@​ai-sdk/​openai-compatible@​3.0.29
	ai@​7.0.59
	@​agent-zero/​mail@​0.3.0	N/A	N/A	N/A	N/A	N/A
	@​agent-zero/​i18n@​0.3.0	N/A	N/A	N/A	N/A	N/A

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm culori is 90.0% likely obfuscated Confidence: 0.90 Location:Package overview From:pnpm-lock.yaml → npm/@maizzle/framework@6.0.13 → npm/culori@4.0.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/culori@4.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[RedStar071]

@greptile-apps

[RedStar071]

@greptile-apps

[greptile-apps]

Too many files changed for review (101 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.