## Acceptance Criteria

### Happy path
**AC-1: Owner sends invite to a new email**
Given I am the owner of a project
And I have not previously invited the email "teammate@example.com"
When I enter "teammate@example.com" in the invite field and click "Send invite"
Then the invitee receives an email containing a unique invite link
And I see "teammate@example.com" listed under "Pending invites" in the project
And the action is recorded in the project audit log

**AC-2: Invitee accepts and joins the project**
Given I received an invite email from a project owner
When I click the invite link and complete sign-in (or sign-up if new)
Then I am added to the project as a "Member" (default role)
And I land on the project home view
And the project owner sees me listed under "Members" (not "Pending invites")

### Edge cases
**AC-3: Email already invited (still pending)**
Given "teammate@example.com" is in "Pending invites"
When I try to invite the same email again
Then I see "Already invited — resent the email" inline (not an error)
And a new invite email is sent (link can be the same or refreshed)

**AC-4: Email is already a member**
Given "teammate@example.com" is already a member of the project
When I try to invite them
Then I see "Already a member" inline
And no email is sent

**AC-5: Multiple emails at once (batch invite)**
Given I paste a comma-separated list of emails (e.g. "a@example.com, b@example.com")
When I click "Send invite"
Then one invite is sent per email
And each email's status is reported (sent / already-invited / already-member / invalid)

### Error / boundary cases
**AC-6: Invalid email format**
Given I enter "not-an-email" in the invite field
When I click "Send invite"
Then I see "That's not a valid email address" inline
And no email is sent

**AC-7: I'm not the owner (permission denied)**
Given I am a Member (not Owner) of the project
And Members are not permitted to invite (per current product policy)
When I navigate to the project
Then I do not see the "Invite teammate" UI at all (not greyed out)
And hitting the invite API directly returns 403

**AC-8: Email send fails (transient)**
Given the email-sending service is down
When I click "Send invite"
Then the invite record is created in "Pending invites" with status "send failed"
And I see a "couldn't send — retry" affordance on that row
And retry attempts on the row trigger the send again

**AC-9: Invite link expired**
Given I clicked an invite link more than 14 days after it was sent
When the invite-acceptance page loads
Then I see "This invite has expired. Ask the project owner to send a new one."
And no project access is granted

**AC-10: Concurrent acceptance (rare)**
Given the same invite link is opened in two tabs by the invitee
When they sign up / sign in in the first tab
And then click "Join" in the second tab
Then the second tab shows "You're already a member" (not an error)

### Out of scope
- Inviting groups / mailing lists (only direct email addresses).
- Custom roles on invite (everyone joins as Member; role changes happen after).
- Domain-restricted auto-join (e.g. "anyone with @example.com joins automatically").
- SCIM / IdP-driven provisioning.
- Invite expiry configuration (fixed at 14 days for this iteration).

### Open questions for product / design
1. Are Member roles assignable at invite time, or always join-as-Member with later role change? (AC-2 assumed the latter.)
2. Does the owner need an in-app confirmation that the invitee accepted, or just the membership-list update? (AC-2 only shows the list.)
3. Should I see ALL pending invites I created, or only ones still pending? (Affects whether expired/cancelled appear in the list.)
4. What's the rate limit on sending invites — and the right error message if hit?