@capybara-hq/kernel 0.1.0-rc.0 → 0.1.0-rc.2

package/dist/orgs/invitations.controller.js

@@ -10,37 +10,42 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { Body, Controller, Delete, Get, HttpCode, Inject, Param, Post, Req, Res, } from "@nestjs/common";
 import { z } from "zod";
 import { ApiError } from "../errors.js";
-import { INVITATIONS, KERNEL_CONFIG, RATE_LIMITER, SESSIONS } from "../http/tokens.js";
-import { ZodPipe } from "../http/zod.pipe.js";
 import { clientMeta } from "../identity/auth.controller.js";
 import { setSessionCookies } from "../identity/cookies.js";
 import { CurrentPrincipal, Public, patTokenId, requireUser, } from "../identity/principal.js";
-import { INVITABLE_ROLES, MAX_INVITATION_HOURS, } from "./invitations.service.js";
+import { SessionService } from "../identity/sessions.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { CredentialThrottler } from "../infra/throttler/credential-throttler.js";
+import { createZodDto } from "../infra/validation/create-zod-dto.js";
+import { parseWithZod } from "../infra/validation/parse-with-zod.js";
+import { ZBody } from "../infra/validation/zod-params.js";
+import { INVITABLE_ROLES, InvitationsService, MAX_INVITATION_HOURS, } from "./invitations.service.js";
 import { CurrentOrg, OrgAction } from "./org.guard.js";
-const CreateBody = z.object({
+const CreateSchema = z.object({
     role: z.enum(INVITABLE_ROLES),
     expiresInHours: z.number().int().min(1).max(MAX_INVITATION_HOURS).optional(),
 });
+class InvitationCreateBody extends createZodDto(CreateSchema, "InvitationCreateBody") {
+}
+/** Validated inside the handler, after the attempt is reserved (a signed-in principal sends none). */
 const SignupBody = z.object({
     login: z.string(),
     password: z.string(),
     displayName: z.string().min(1).max(100),
 });
-const signupPipe = new ZodPipe(SignupBody);
-/** 接受邀请的限流（scope `inv`）：同一令牌 10 次、同一客户端 IP 20 次 / 900s。 */
-const ACCEPT_LIMIT_PER_TOKEN = 10;
-const ACCEPT_LIMIT_PER_IP = 20;
+/** Accepting an invitation is throttled per token (10) and per client IP (20) every 900 s. */
+const ACCEPT_THROTTLERS = ["invitation", "invitation-ip"];
 /** 组织邀请：组织内管理（`/api/v1/orgs/:orgId/invitations`）与凭令牌预览 / 接受（`/api/v1/invitations/:token`，公开）。 */
 let InvitationsController = class InvitationsController {
     invitations;
     sessions;
     config;
-    limiter;
-    constructor(invitations, sessions, config, limiter) {
+    throttler;
+    constructor(invitations, sessions, config, throttler) {
         this.invitations = invitations;
         this.sessions = sessions;
         this.config = config;
-        this.limiter = limiter;
+        this.throttler = throttler;
     }
     /** 令牌只在此返回一次。 */
     async create(principal, org, body) {
@@ -69,25 +74,21 @@ let InvitationsController = class InvitationsController {
             throw new ApiError("forbidden", "Service tokens cannot accept invitations");
         }
         const meta = clientMeta(req);
-        const rl = await this.limiter.reserveScoped("inv", token, meta.ip, ACCEPT_LIMIT_PER_TOKEN, ACCEPT_LIMIT_PER_IP);
-        if (!rl.allowed) {
-            reply.header("retry-after", String(rl.retryAfterSeconds));
-            throw new ApiError("auth.rate_limited", "Too many invitation attempts; try again later");
-        }
+        await this.throttler.reserve(ACCEPT_THROTTLERS, req, reply);
         let result;
         if (principal) {
             result = await this.invitations.accept(token, { accountId: principal.account.id });
-            await this.limiter.succeededScoped("inv", token, meta.ip);
+            await this.throttler.succeeded(ACCEPT_THROTTLERS, req);
         }
         else {
-            const signup = signupPipe.transform(body);
+            const signup = parseWithZod(SignupBody, body);
             // 新账号、成员关系与会话行在同一事务里写入；Cookie 在提交之后才设置
-            const { extra: session, ...rest } = await this.invitations.accept(token, { signup }, (t, account) => this.sessions.create(account.id, meta, t));
+            const { extra: session, ...rest } = await this.invitations.accept(token, { signup }, (account) => this.sessions.create(account.id, meta));
             if (!session)
                 throw new Error("signup completed without a session");
             result = rest;
-            await this.limiter.succeededScoped("inv", token, meta.ip);
-            setSessionCookies(reply, session, this.config());
+            await this.throttler.succeeded(ACCEPT_THROTTLERS, req);
+            setSessionCookies(reply, session, this.config.get());
         }
         return result;
     }
@@ -97,7 +98,7 @@ __decorate([
     OrgAction("org.invitations.manage"),
     __param(0, CurrentPrincipal()),
     __param(1, CurrentOrg()),
-    __param(2, Body(new ZodPipe(CreateBody)))
+    __param(2, ZBody(InvitationCreateBody))
 ], InvitationsController.prototype, "create", null);
 __decorate([
     Get("orgs/:orgId/invitations"),
@@ -129,9 +130,9 @@ __decorate([
 ], InvitationsController.prototype, "accept", null);
 InvitationsController = __decorate([
     Controller("api/v1"),
-    __param(0, Inject(INVITATIONS)),
-    __param(1, Inject(SESSIONS)),
-    __param(2, Inject(KERNEL_CONFIG)),
-    __param(3, Inject(RATE_LIMITER))
+    __param(0, Inject(InvitationsService)),
+    __param(1, Inject(SessionService)),
+    __param(2, Inject(KernelConfigService)),
+    __param(3, Inject(CredentialThrottler))
 ], InvitationsController);
 export { InvitationsController };

package/dist/orgs/invitations.service.d.ts

@@ -1,9 +1,9 @@
-import { type Transaction } from "kysely";
-import type { KernelDatabase, KernelDb } from "../db/kernel-schema.js";
-import type { Account, AccountsService } from "../identity/accounts.js";
-import type { MembersService } from "./members.service.js";
+import { type Account, AccountsService } from "../identity/accounts.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { MembersService } from "./members.service.js";
+import { OrgLock } from "./org-lock.js";
 import { type OrgRole } from "./roles.js";
-type Trx = Transaction<KernelDatabase>;
 /** 可邀请的角色（owner 只能经转让获得）。 */
 export declare const INVITABLE_ROLES: readonly ["admin", "member", "guest"];
 export type InvitableRole = (typeof INVITABLE_ROLES)[number];
@@ -32,13 +32,15 @@ export type AcceptAs = {
 /**
  * 组织邀请。令牌 `cap_inv_` + 32 字节 base64url，库里只存 SHA-256（按 hash 在 SQL 里查找）。
  * 写操作（create / revoke）与成员服务一样先锁组织行，并在锁内实时重读发起人角色（只接收账号 id，不接收角色）。
- * 加锁顺序统一为「组织行 → 邀请行」，accept 也先锁组织行，避免与 revoke 死锁。框架无关，由调用方注入依赖。
+ * 加锁顺序统一为「组织行 → 邀请行」，accept 也先锁组织行，避免与 revoke 死锁。
  */
 export declare class InvitationsService {
     private readonly db;
+    readonly txHost: TransactionHost;
     private readonly accounts;
     private readonly members;
-    constructor(db: KernelDb, accounts: AccountsService, members: MembersService);
+    private readonly orgLock;
+    constructor(db: KernelDb, txHost: TransactionHost, accounts: AccountsService, members: MembersService, orgLock: OrgLock);
     create(orgId: string, input: {
         role: InvitableRole;
         expiresInHours?: number | undefined;
@@ -46,6 +48,7 @@ export declare class InvitationsService {
         invitation: Invitation;
         token: string;
     }>;
+    private createIn;
     list(orgId: string): Promise<(Invitation & {
         status: InvitationStatus;
     })[]>;
@@ -65,16 +68,16 @@ export declare class InvitationsService {
      * signup 时先在事务外分类一次（无效令牌不白跑 scrypt），再在 BEGIN 之前算好密码哈希，
      * 事务内只有读写，连接不会在 scrypt 期间处于 idle in transaction。
      */
-    accept<T = undefined>(token: string, who: AcceptAs, inTx?: (t: Trx, account: Account) => Promise<T>): Promise<{
+    accept<T = undefined>(token: string, who: AcceptAs, inTx?: (account: Account) => Promise<T>): Promise<{
         account: Account;
         orgId: string;
         role: OrgRole;
         extra: T | undefined;
     }>;
+    private acceptIn;
     /**
      * 按令牌 hash 读邀请并分类：不存在、已撤销或组织已软删除 → `invitation.invalid`；
      * 已接受 → `invitation.used`；已过期 → `invitation.expired`。过期按数据库时间判定。
      */
     private classify;
 }
-export {};

package/dist/orgs/invitations.service.js

@@ -1,9 +1,24 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { randomBytes, randomUUID } from "node:crypto";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { ApiError } from "../errors.js";
+import { AccountsService } from "../identity/accounts.js";
 import { audit } from "../identity/audit.js";
 import { sha256Hex } from "../identity/hash.js";
-import { lockOrgAndAuthorize, tryLockOrg } from "./org-lock.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { MembersService } from "./members.service.js";
+import { OrgLock } from "./org-lock.js";
 import { roleAtLeast } from "./roles.js";
 /** 可邀请的角色（owner 只能经转让获得）。 */
 export const INVITABLE_ROLES = ["admin", "member", "guest"];
@@ -27,16 +42,20 @@ const forbidden = () => new ApiError("forbidden", "Insufficient organization rol
 /**
  * 组织邀请。令牌 `cap_inv_` + 32 字节 base64url，库里只存 SHA-256（按 hash 在 SQL 里查找）。
  * 写操作（create / revoke）与成员服务一样先锁组织行，并在锁内实时重读发起人角色（只接收账号 id，不接收角色）。
- * 加锁顺序统一为「组织行 → 邀请行」，accept 也先锁组织行，避免与 revoke 死锁。框架无关，由调用方注入依赖。
+ * 加锁顺序统一为「组织行 → 邀请行」，accept 也先锁组织行，避免与 revoke 死锁。
  */
-export class InvitationsService {
+let InvitationsService = class InvitationsService {
     db;
+    txHost;
     accounts;
     members;
-    constructor(db, accounts, members) {
+    orgLock;
+    constructor(db, txHost, accounts, members, orgLock) {
         this.db = db;
+        this.txHost = txHost;
         this.accounts = accounts;
         this.members = members;
+        this.orgLock = orgLock;
     }
     async create(orgId, input, actorAccountId, actorTokenId) {
         if (!INVITABLE_ROLES.includes(input.role)) {
@@ -47,32 +66,34 @@ export class InvitationsService {
             throw new ApiError("validation_failed", `expiresInHours must be an integer between 1 and ${MAX_INVITATION_HOURS}`);
         }
         const token = TOKEN_PREFIX + randomBytes(32).toString("base64url");
-        return this.db.transaction().execute(async (t) => {
-            const { role: actorRole } = await lockOrgAndAuthorize(t, orgId, actorAccountId, "org.invitations.manage");
-            if (!roleAtLeast(actorRole, input.role))
-                throw forbidden();
-            const row = await t
-                .insertInto("invitations")
-                .values({
-                id: randomUUID(),
-                org_id: orgId,
-                role: input.role,
-                token_hash: sha256Hex(token),
-                created_by: actorAccountId,
-                expires_at: sql `now() + make_interval(hours => ${hours})`,
-            })
-                .returningAll()
-                .executeTakeFirstOrThrow();
-            await audit(t, {
-                actorAccountId,
-                ...(actorTokenId !== undefined && { actorTokenId }),
-                orgId,
-                action: "org.invitation.created",
-                target: row.id,
-                detail: { role: input.role, expiresAt: row.expires_at.toISOString() },
-            });
-            return { invitation: toInvitation(row), token };
+        return this.createIn(orgId, input.role, hours, token, actorAccountId, actorTokenId);
+    }
+    async createIn(orgId, role, hours, token, actorAccountId, actorTokenId) {
+        const input = { role };
+        const { role: actorRole } = await this.orgLock.lockAndAuthorize(orgId, actorAccountId, "org.invitations.manage");
+        if (!roleAtLeast(actorRole, input.role))
+            throw forbidden();
+        const row = await this.db
+            .insertInto("invitations")
+            .values({
+            id: randomUUID(),
+            org_id: orgId,
+            role: input.role,
+            token_hash: sha256Hex(token),
+            created_by: actorAccountId,
+            expires_at: sql `now() + make_interval(hours => ${hours})`,
+        })
+            .returningAll()
+            .executeTakeFirstOrThrow();
+        await audit(this.db.db, {
+            actorAccountId,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            orgId,
+            action: "org.invitation.created",
+            target: row.id,
+            detail: { role: input.role, expiresAt: row.expires_at.toISOString() },
         });
+        return { invitation: toInvitation(row), token };
     }
     async list(orgId) {
         const rows = await this.db
@@ -96,38 +117,36 @@ export class InvitationsService {
     }
     /** 撤销；不属于该组织 → `invitation.invalid`；已接受 → `invitation.used`；已撤销则无操作。 */
     async revoke(orgId, id, actorAccountId, actorTokenId) {
-        await this.db.transaction().execute(async (t) => {
-            await lockOrgAndAuthorize(t, orgId, actorAccountId, "org.invitations.manage");
-            const row = await t
-                .selectFrom("invitations")
-                .selectAll()
-                .where("id", "=", id)
-                .where("org_id", "=", orgId)
-                .forUpdate()
-                .executeTakeFirst();
-            if (!row)
-                throw invalid();
-            if (row.accepted_at)
-                throw new ApiError("invitation.used", "Invitation was already used");
-            if (row.revoked_at)
-                return;
-            await t
-                .updateTable("invitations")
-                .set({ revoked_at: sql `now()` })
-                .where("id", "=", id)
-                .execute();
-            await audit(t, {
-                actorAccountId,
-                ...(actorTokenId !== undefined && { actorTokenId }),
-                orgId,
-                action: "org.invitation.revoked",
-                target: id,
-                detail: { role: row.role },
-            });
+        await this.orgLock.lockAndAuthorize(orgId, actorAccountId, "org.invitations.manage");
+        const row = await this.db
+            .selectFrom("invitations")
+            .selectAll()
+            .where("id", "=", id)
+            .where("org_id", "=", orgId)
+            .forUpdate()
+            .executeTakeFirst();
+        if (!row)
+            throw invalid();
+        if (row.accepted_at)
+            throw new ApiError("invitation.used", "Invitation was already used");
+        if (row.revoked_at)
+            return;
+        await this.db
+            .updateTable("invitations")
+            .set({ revoked_at: sql `now()` })
+            .where("id", "=", id)
+            .execute();
+        await audit(this.db.db, {
+            actorAccountId,
+            ...(actorTokenId !== undefined && { actorTokenId }),
+            orgId,
+            action: "org.invitation.revoked",
+            target: id,
+            detail: { role: row.role },
         });
     }
     async preview(token) {
-        const r = await this.classify(this.db, token);
+        const r = await this.classify(token);
         return { org: { id: r.org_id, name: r.org_name }, role: r.role, expiresAt: r.expires_at };
     }
     /**
@@ -145,47 +164,48 @@ export class InvitationsService {
                 throw new ApiError("account.not_found", "Account not found");
         }
         else {
-            await this.classify(this.db, token);
+            await this.classify(token);
             passwordHash = await this.accounts.hashNewPassword(who.signup.password);
         }
-        return this.db.transaction().execute(async (t) => {
-            const inv = await this.classify(t, token);
-            // 先建账号再锁组织行，缩短持锁时间；失败时随事务回滚，不残留账号
-            const account = existing ?? (await this.accounts.createLocal(signupOf(who), t, passwordHash));
-            if (!(await tryLockOrg(t, inv.org_id)))
-                throw invalid();
-            const taken = await t
-                .updateTable("invitations")
-                .set({ accepted_at: sql `now()`, accepted_by: account.id })
-                .where("id", "=", inv.id)
-                .where("accepted_at", "is", null)
-                .where("revoked_at", "is", null)
-                .where(sql `expires_at > now()`)
-                .returning("id")
-                .executeTakeFirst();
-            if (!taken) {
-                await this.classify(t, token);
-                throw new ApiError("invitation.used", "Invitation was already used");
-            }
-            await this.members.add(inv.org_id, account.id, inv.role, account.id, t);
-            await audit(t, {
-                actorAccountId: account.id,
-                orgId: inv.org_id,
-                action: "org.invitation.accepted",
-                target: inv.id,
-                detail: { role: inv.role, signup: "signup" in who },
-            });
-            // 凭邀请注册时在同一事务里建会话：失败整体回滚，不残留没有会话的新账号
-            const extra = inTx ? await inTx(t, account) : undefined;
-            return { account, orgId: inv.org_id, role: inv.role, extra };
+        return this.acceptIn(token, who, existing, passwordHash, inTx);
+    }
+    async acceptIn(token, who, existing, passwordHash, inTx) {
+        const inv = await this.classify(token);
+        // 先建账号再锁组织行，缩短持锁时间；失败时随事务回滚，不残留账号
+        const account = existing ?? (await this.accounts.createLocal(signupOf(who), passwordHash));
+        if (!(await this.orgLock.tryLock(inv.org_id)))
+            throw invalid();
+        const taken = await this.db
+            .updateTable("invitations")
+            .set({ accepted_at: sql `now()`, accepted_by: account.id })
+            .where("id", "=", inv.id)
+            .where("accepted_at", "is", null)
+            .where("revoked_at", "is", null)
+            .where(sql `expires_at > now()`)
+            .returning("id")
+            .executeTakeFirst();
+        if (!taken) {
+            await this.classify(token);
+            throw new ApiError("invitation.used", "Invitation was already used");
+        }
+        await this.members.add(inv.org_id, account.id, inv.role, account.id);
+        await audit(this.db.db, {
+            actorAccountId: account.id,
+            orgId: inv.org_id,
+            action: "org.invitation.accepted",
+            target: inv.id,
+            detail: { role: inv.role, signup: "signup" in who },
         });
+        // 凭邀请注册时在同一事务里建会话：失败整体回滚，不残留没有会话的新账号
+        const extra = inTx ? await inTx(account) : undefined;
+        return { account, orgId: inv.org_id, role: inv.role, extra };
     }
     /**
      * 按令牌 hash 读邀请并分类：不存在、已撤销或组织已软删除 → `invitation.invalid`；
      * 已接受 → `invitation.used`；已过期 → `invitation.expired`。过期按数据库时间判定。
      */
-    async classify(db, token) {
-        const r = await db
+    async classify(token) {
+        const r = await this.db
             .selectFrom("invitations")
             .innerJoin("orgs", "orgs.id", "invitations.org_id")
             .select([
@@ -209,7 +229,25 @@ export class InvitationsService {
             throw new ApiError("invitation.expired", "Invitation has expired");
         return r;
     }
-}
+};
+__decorate([
+    Transactional()
+], InvitationsService.prototype, "createIn", null);
+__decorate([
+    Transactional()
+], InvitationsService.prototype, "revoke", null);
+__decorate([
+    Transactional()
+], InvitationsService.prototype, "acceptIn", null);
+InvitationsService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(AccountsService)),
+    __param(3, Inject(MembersService)),
+    __param(4, Inject(OrgLock))
+], InvitationsService);
+export { InvitationsService };
 function signupOf(who) {
     if (!("signup" in who))
         throw new Error("unreachable");

package/dist/orgs/job-ids.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The maintenance job scheduler ids the offboarding sweep and the directory scan had before
+ * becoming `@LockedCron` jobs (retired at worker start, `RETIRED_SCHEDULER_IDS`). A leaf module.
+ */
+/** The offboarding sweep's old scheduler (every 10 minutes). */
+export declare const OFFBOARD_SWEEP_SCHEDULER_ID = "offboard-sweep-every-10m";
+/** The directory scan's old scheduler (hourly). */
+export declare const DIRECTORY_SCAN_SCHEDULER_ID = "directory-scan-hourly";

package/dist/orgs/job-ids.js

@@ -0,0 +1,8 @@
+/**
+ * The maintenance job scheduler ids the offboarding sweep and the directory scan had before
+ * becoming `@LockedCron` jobs (retired at worker start, `RETIRED_SCHEDULER_IDS`). A leaf module.
+ */
+/** The offboarding sweep's old scheduler (every 10 minutes). */
+export const OFFBOARD_SWEEP_SCHEDULER_ID = "offboard-sweep-every-10m";
+/** The directory scan's old scheduler (hourly). */
+export const DIRECTORY_SCAN_SCHEDULER_ID = "directory-scan-hourly";

package/dist/orgs/members.service.d.ts

@@ -1,9 +1,10 @@
-import type { Transaction } from "kysely";
-import type { KernelDatabase, KernelDb } from "../db/kernel-schema.js";
+import type { KernelSchemaDb } from "../db/kernel-schema.js";
 import type { Account } from "../identity/accounts.js";
-import type { Offboarding } from "./offboarding.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Offboarding } from "./offboarding.js";
+import { OrgLock } from "./org-lock.js";
 import type { OrgRole } from "./roles.js";
-type Trx = Transaction<KernelDatabase>;
 export interface Member {
     account: Pick<Account, "id" | "displayName" | "email">;
     role: OrgRole;
@@ -15,26 +16,29 @@ export interface Member {
  * 账号是不是某个组织的匿名访客（`org_anonymous_accounts`）。匿名访客没有登录方式，只能以 guest 身份
  * 代表 IM 里未绑定的人：不能被授予别的角色、成为 owner、指派为 agent 负责人、加入别的组织或被移出。
  */
-export declare function isAnonymousGuest(db: KernelDb | Trx, accountId: string): Promise<boolean>;
+export declare function isAnonymousGuest(db: KernelSchemaDb, accountId: string): Promise<boolean>;
 /** 目标是匿名访客 → `409 member.anonymous_guest`。 */
-export declare function rejectAnonymousGuest(db: KernelDb | Trx, accountId: string): Promise<void>;
+export declare function rejectAnonymousGuest(db: KernelSchemaDb, accountId: string): Promise<void>;
 /**
  * 成员服务。发起人只传账号 id，角色由服务在组织行锁内实时读取，调用方无法传入过期角色。所有写操作在事务内先 `SELECT … FROM orgs WHERE id = $1 FOR NO KEY UPDATE`，
  * 把同一组织的成员变更串行化（多副本下两个 owner 并发互相降级也恰好剩一个 owner）。
- * 框架无关，由调用方注入 db。
  */
 export declare class MembersService {
     private readonly db;
+    readonly txHost: TransactionHost;
+    private readonly orgLock;
+    /** Removing and leaving go through offboarding. */
     private readonly offboarding;
-    /** `offboarding`：移出与离开走的离职处理（内核用 `Kernel.identity.offboarding`）。 */
-    constructor(db: KernelDb, offboarding: Offboarding);
+    constructor(db: KernelDb, txHost: TransactionHost, orgLock: OrgLock, 
+    /** Removing and leaving go through offboarding. */
+    offboarding: Offboarding);
     list(orgId: string): Promise<Member[]>;
     /**
      * 加入成员（邀请接受等，手动加入的唯一入口）；已是成员 → `member.already_exists`；匿名访客 → `member.anonymous_guest`。
      * 同一事务删除此人在该组织的通讯录排除（Ruling A20：手动重新加入后，通讯录同步恢复照常管理此人）。
-     * `actorAccountId` 仅用于审计。
+     * `actorAccountId` 仅用于审计。In the caller's transaction when there is one.
      */
-    add(orgId: string, accountId: string, role: OrgRole, actorAccountId: string, trx?: Trx): Promise<void>;
+    add(orgId: string, accountId: string, role: OrgRole, actorAccountId: string): Promise<void>;
     /**
      * 改角色：授予或撤销 owner、或改动一个 owner，只有 owner 能做（`org.owner_required`）；
      * admin 只能在 guest / member / admin 之间调整非 owner。操作后 owner 数为 0 → `org.last_owner`。
@@ -42,22 +46,25 @@ export declare class MembersService {
      * 目标是匿名访客 → `member.anonymous_guest`。
      */
     changeRole(orgId: string, targetId: string, role: OrgRole, actorAccountId: string, actorTokenId?: string): Promise<void>;
+    private changeRoleIn;
     /**
      * 移出成员：权限规则同 changeRole（移除 owner 须发起人是 owner）；移除最后一个 owner → `org.last_owner`。
      * 走离职处理（{@link Offboarding.offboard}，原因 `removed`），与之同一事务；提交后写吊销标记、发布事件。
      * 匿名访客不能移出（`member.anonymous_guest`；不再需要匿名访问时把渠道连接改回绑定策略）。
      */
     remove(orgId: string, targetId: string, actorAccountId: string, actorTokenId?: string): Promise<void>;
+    private removeIn;
     /** 主动离开：走离职处理（原因 `left`）；最后一个 owner → `org.last_owner`。 */
     leave(orgId: string, accountId: string, actorTokenId?: string): Promise<void>;
+    private leaveIn;
     /**
      * 转让所有权：from 必须是 owner（`org.owner_required`）；to 必须是成员（`member.not_found`）且不是匿名访客
      * （`member.anonymous_guest`）；to → owner、from → admin。
      */
     transferOwnership(orgId: string, fromAccountId: string, toAccountId: string, actorTokenId?: string): Promise<void>;
+    private transferIn;
     private roleIn;
     private requireMember;
     private setRole;
     private assertHasOwner;
 }
-export {};