@@ -0,0 +1,12 @@
+---
+'@objectstack/plugin-auth': patch
+'@objectstack/platform-objects': patch
+---
+
+fix(plugin-auth, platform-objects): resending an expired invitation replaces it, leaving one pending invitation for the person
+
+Clause-②: no
+Metadata-protocol: none
+
+- **`@objectstack/plugin-auth`**: when `POST /organization/invite-member` issues an invitation, the person's other pending invitations in that organization whose expiry has passed are now marked `expired`. A resend on an invitation that has already expired issues a new invitation, as before, and the expired one now moves to the Expired / Canceled list instead of staying in Pending beside the new one. A plain invite to an address whose earlier invitation expired does the same. A resend on an invitation that has not expired still renews that invitation (same id). A refused call changes nothing.
+- **`@objectstack/platform-objects`**: the Resend Invitation confirmation on `sys_invitation` now reads "Resend the invitation to {{ record.email }}? The expiry date starts over, and an invitation that has already expired is replaced by a new one.", which is true for both rows the action is offered on. The zh-CN, ja-JP and es-ES translations say the same.
@@ -848,7 +848,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       resend_invitation: {
         label: "Resend Invitation",
-        description: "Resend the invitation to {{ record.email }}? Its expiry date starts over.",
+        description: "Resend the invitation to {{ record.email }}? The expiry date starts over, and an invitation that has already expired is replaced by a new one.",
         successMessage: "Invitation resent",
         outcomeMessages: {
           sent: "Invitation resent to {{ result.email }}",
 
@@ -848,7 +848,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       resend_invitation: {
         label: "Reenviar invitación",
-        description: "¿Reenviar la invitación a {{ record.email }}? Su plazo de vencimiento vuelve a empezar.",
+        description: "¿Reenviar la invitación a {{ record.email }}? El plazo de vencimiento vuelve a empezar, y una invitación que ya ha vencido se sustituye por una nueva.",
         successMessage: "Invitación reenviada",
         outcomeMessages: {
           sent: "Invitación reenviada a {{ result.email }}",
 
@@ -848,7 +848,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       resend_invitation: {
         label: "招待を再送",
-        description: "{{ record.email }} に招待を再送しますか？有効期限は改めて始まります。",
+        description: "{{ record.email }} に招待を再送しますか？有効期限は改めて始まります。すでに期限切れの招待は新しい招待に置き換えられます。",
         successMessage: "招待を再送しました",
         outcomeMessages: {
           sent: "{{ result.email }} に招待を再送しました",
 
@@ -848,7 +848,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       resend_invitation: {
         label: "重新发送邀请",
-        description: "要重新发送邀请给 {{ record.email }} 吗？邀请的有效期将重新计算。",
+        description: "要重新发送邀请给 {{ record.email }} 吗？有效期将重新计算；已过期的邀请会被一份新邀请取代。",
         successMessage: "邀请已重新发送",
         outcomeMessages: {
           sent: "已向 {{ result.email }} 重新发送邀请",
 
@@ -145,7 +145,12 @@ export const SysInvitation = ObjectSchema.create({
       // carried over from the row. invite-member renews a pending invitation
       // with its stored role whatever role is sent, and another email would
       // invite a different person, so neither is the user's to edit here.
-      description: 'Resend the invitation to {{ record.email }}? Its expiry date starts over.',
+      // [#28540] True for both rows Resend is offered on: an unexpired
+      // invitation is renewed, and an expired one is replaced by a new
+      // invitation while the old row moves to `expired` (plugin-auth's
+      // `invitation-expired-supersede.ts`), so one pending row remains.
+      description:
+        'Resend the invitation to {{ record.email }}? The expiry date starts over, and an invitation that has already expired is replaced by a new one.',
       icon: 'send',
       variant: 'secondary',
       locations: ['list_item'],
@@ -170,7 +175,7 @@ export const SysInvitation = ObjectSchema.create({
       ai: {
         exposed: true,
         description:
-          'Send a pending invitation (the record) again (params: its email and role, copied from the invitation; the stored role is kept). Its expiry date starts over. Use when the invitee lost the invitation or never received it.',
+          'Send a pending invitation (the record) again (params: its email and role, copied from the invitation; the stored role is kept). The expiry date starts over, and an invitation that has already expired is replaced by a new one. Use when the invitee lost the invitation or never received it.',
       },
     },
     {
 
@@ -45,6 +45,7 @@ import { SIGN_IN_EMAIL_PATH } from './auth-session-audit.js';
 import { narrowDirectoryForExternalCaller } from './external-directory-door.js';
 import { rotateCallerBearerOnImpersonation } from './impersonation-bearer-rotation.js';
 import { stampInvitationDeliveryOutcome } from './invitation-delivery-outcome.js';
+import { retireExpiredInvitationsOnReissue } from './invitation-expired-supersede.js';
 import { codeInviteRoleNotFound } from './invite-role-not-found-code.js';
 import { readRequestClientAddress } from './request-client-address.js';
 import { stampRoleChangeGrantedSet } from './role-change-granted-set.js';
@@ -234,6 +235,13 @@ export async function globalAfterHook(this: AfterHookHost, ctx: any) {
   // `invitation-delivery-outcome.ts`). A refusal passes untouched.
   await stampInvitationDeliveryOutcome(ctx, () => this.isEmailDeliveryLive());
 
+  // ── #28540: a new invitation retires the person's expired pending one ──
+  // The vendor skips an expired row when it looks for one to renew, so a
+  // resend (or an invite) on it issues a new invitation; the expired row is
+  // moved to `expired` here, so the Pending list holds one row per person
+  // (see `invitation-expired-supersede.ts`). A refusal retires nothing.
+  await retireExpiredInvitationsOnReissue(ctx);
+
   // ── #27862: a role change names the permission set it granted ──
   // The before hook read the member's org-admin grants; a success that
   // left a new one held answers `outcome: 'permission_set_granted'` and
 
@@ -0,0 +1,110 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #28540 — an invitation issued for a person retires that person's expired
+ * pending invitations in the same organization.
+ *
+ * better-auth's `invite-member` looks for the person's pending invitation with
+ * `findPendingInvitation`, which drops every row whose `expiresAt` has passed.
+ * So a resend (`resend: true`, the `sys_invitation.resend_invitation` action)
+ * on an invitation that has already expired finds nothing to renew and issues
+ * a NEW invitation, and so does a plain invite. The expired row keeps reading
+ * `pending`: nothing in the vendor or in the platform ever moves it, and the
+ * Pending list then shows two rows for one person, the older one admitting
+ * no one.
+ *
+ * This runs in the global `after` hook, only on a successful invite-member
+ * answer, so it acts only once the vendor has admitted the caller and written
+ * the answered row; a refusal retires nothing. It moves each of the person's
+ * other pending rows in that organization whose `expires_at` has passed to
+ * `expired` (the ObjectStack half of `InvitationStatus`; better-auth has no
+ * such value), so the row moves to the Expired / Canceled list. A resend that
+ * renewed an unexpired row answers that same row, which is excluded by id;
+ * any older expired row beside it is retired too.
+ *
+ * An expiry that does not read as a date counts as expired, as the vendor's
+ * own check and the copy-link gate read it. The write names `status:
+ * 'pending'` beside the id, so a row that left `pending` meanwhile (accepted,
+ * declined, canceled) is not touched.
+ *
+ * Failure-isolated: the invitation is already issued and its mail handed off
+ * when this runs, so a read or write that fails leaves the old row as it was
+ * (the state before this existed), says so once at `warn`, and never turns
+ * the issued invitation into an error answer.
+ */
+
+import { INVITE_MEMBER_PATH } from './invite-role-not-found-code.js';
+import { isBeforeExpiry } from './invitation-link-action.js';
+
+/** The better-auth model name of `sys_invitation`. */
+const INVITATION_MODEL = 'invitation';
+
+/** The status a retired row takes. */
+const RETIRED_STATUS = 'expired';
+
+/** One `where` clause of the better-auth adapter. */
+interface AdapterWhere {
+  field: string;
+  value: unknown;
+}
+
+/**
+ * The two better-auth adapter calls this reads and writes through
+ * (`ctx.context.adapter`): keyword-object calls on a vendor model name, the
+ * same ones the vendor's own invitation routes make, not the data engine's
+ * `(object, data, options)` door.
+ */
+interface InvitationRowAdapter {
+  findMany(args: { model: string; where: AdapterWhere[] }): Promise<any[]>;
+  update(args: { model: string; where: AdapterWhere[]; update: Record<string, unknown> }): Promise<unknown>;
+}
+
+/**
+ * Retire the answered person's expired pending invitations after a successful
+ * invite-member. A no-op on every other path, on a refusal, and on an answer
+ * that does not carry an invitation's id, email and organization. Never throws.
+ */
+export async function retireExpiredInvitationsOnReissue(ctx: any): Promise<void> {
+  if (ctx?.path !== INVITE_MEMBER_PATH) return;
+  const returned = ctx?.context?.returned;
+  if (!returned || typeof returned !== 'object' || Array.isArray(returned)) return;
+  try {
+    const { isAPIError } = await import('better-auth/api');
+    if (isAPIError(returned)) return;
+  } catch {
+    if (returned instanceof Error) return;
+  }
+  const answeredId = typeof returned.id === 'string' ? returned.id : undefined;
+  const email = typeof returned.email === 'string' ? returned.email.toLowerCase() : undefined;
+  const organizationId = typeof returned.organizationId === 'string' ? returned.organizationId : undefined;
+  const adapter: InvitationRowAdapter | undefined = ctx?.context?.adapter;
+  if (!answeredId || !email || !organizationId || !adapter) return;
+
+  try {
+    const pending = await adapter.findMany({
+      model: INVITATION_MODEL,
+      where: [
+        { field: 'email', value: email },
+        { field: 'organizationId', value: organizationId },
+        { field: 'status', value: 'pending' },
+      ],
+    });
+    for (const row of pending ?? []) {
+      if (!row || row.id === answeredId || isBeforeExpiry(row.expiresAt)) continue;
+      await adapter.update({
+        model: INVITATION_MODEL,
+        where: [
+          { field: 'id', value: row.id },
+          { field: 'status', value: 'pending' },
+        ],
+        update: { status: RETIRED_STATUS },
+      });
+    }
+  } catch (err: any) {
+    console.warn(
+      '[auth] The new invitation was issued, but an earlier expired invitation for the same person could '
+        + 'not be marked expired, so it still reads pending in the invitation list (it admits no one): '
+        + `${err?.message ?? String(err)}`,
+    );
+  }
+}
@@ -114,7 +114,7 @@ function nonEmptyString(value: unknown): string | undefined {
  * Anything that does not read as a date answers `false`, as the vendor's own
  * `new Date(expiresAt) > new Date()` check does.
  */
-function isBeforeExpiry(expiresAt: unknown): boolean {
+export function isBeforeExpiry(expiresAt: unknown): boolean {
   if (!(expiresAt instanceof Date) && typeof expiresAt !== 'string' && typeof expiresAt !== 'number') return false;
   const ms = new Date(expiresAt).getTime();
   return Number.isFinite(ms) && ms > Date.now();