@happyvertical/smrt-education 0.57.47 → 0.57.49

package/AGENTS.md

@@ -52,6 +52,11 @@ Structured questions from scans and imported course files use
 ingestion handler. Anchors come from provider region catalogs only; match by worksheet
 id and layout, never text; ambiguous matches stay unattached; source-keyed replays.
 
+Course bundles (zip with a closed manifest, or a file set) use
+[CourseBundleImportService](agents/course-bundle-import.md). Parse only with the
+bounded reader; refuse, never trim, hostile input; unsupported members stay
+visible; proposals only, nothing auto-published.
+
 Source import: [host boundary and transaction contract](agents/source-import.md).
 `SourceImportService` requires host opt-in, matching active actor/tenant and
 explicit licensing authorization; never add a system/global write bypass.
@@ -75,3 +80,7 @@ then revalidate each exact family edge and current policy. Media delivery must c
 the reader on every request; signed storage URLs are not a sharing grant. Saved
 parent comment visibility applies on every child read. Progress with feedback
 disabled contains counts only, never correctness, scores or concept labels.
+
+Learner-safe tutor context and append-only tutor transcripts use
+[TutorContextService and TutorSessionService](agents/tutor-context.md). Learner
+audience never carries keys, rubrics, notes or storage URIs; no AI call here.

package/README.md

@@ -17,7 +17,8 @@ authorizer, private media delivery, facet semantics and migration/test matrix.
 
 Guardians author courses with `CourseAuthoringService`: append-only course and
 lesson revisions, a reviewed release that materializes immutable lessons,
-reversible archive, and recorded enrollment pins and upgrades. See the
+reversible archive, recorded enrollment pins and upgrades, a recorded
+visibility (`family`, `groups`, `public`) and an education-owned cover image. See the
 [course authoring contract](agents/course-authoring-service.md).
 
 ## Install
@@ -101,7 +102,27 @@ host's permission decision. Sibling membership does not grant access.
 `putBackLesson` returns started work to `not_started` and `setEnrollmentStatus`
 starts, pauses, resumes or drops an enrollment along a fixed transition table;
 both append immutable history (actor, and for status the host policy basis)
-and never touch submissions, grades or other progress.
+and never touch submissions, grades or other progress. `completeOwnLesson`
+lets a learner mark their own lesson of any kind done when the host's
+`education.progress.complete-own` decision allows it, recording the actor, the
+host setting and optional evidence submission; guardian `attestLesson` is
+unchanged. `setEnrollmentPace` sets or clears an enrollment's planned lessons
+per week (1 to 14) under the host's `education.enrollment.set-pace` decision with
+an immutable change row, and `nextLessons({ count })` returns a week's set of
+unfinished lessons (default one).
+`TutorContextService.compose` builds a bounded, learner-safe `TutorContext`
+(lesson text, learner-visible questions, own progress, released feedback; for the
+learner audience only `answerKeyAvailable`, never keys, rubrics, notes or storage
+URIs) under the host's `education.tutor.read` decision, and `TutorSessionService`
+(`open`, `append`, `close`, `listForLearner`; `education.tutor.exchange` and
+`education.tutor.read`) keeps append-only guardian-readable transcripts. No model
+call happens in the package; see [tutor contract](agents/tutor-context.md).
+
+`CourseBundleImportService` imports a course zip (optional closed `manifest.json`)
+or file set under hard size, ratio, path and entry bounds, keeps unsupported and
+duplicate members as append-only evidence, hands accepted members to ingestion and
+proposes sections and lessons through `CourseGenerationReviewService`; see
+[bundle import](agents/course-bundle-import.md).
 Repeated starts preserve the existing progress, including attempts and scores.
 A new curriculum/year creates a distinct enrollment and fresh progress history.
 An unscored lesson has `bestScore: null`, distinct from zero. The service does

package/agents/course-authoring-service.md

@@ -21,7 +21,7 @@ change to existing tables, test-pinned); the runtime never creates tables.
 
 ## Actions and host mapping
 
-`education.course.read-draft|author|generate|review|release|assign|archive`. The host
+`education.course.read-draft|author|generate|review|release|assign|archive|set-visibility|set-cover`. The host
 maps roles; the authorizer also receives `operation`, `courseId`,
 `enrollmentId`/`learnerId` and `delegatingGuardianUserId` (agent calls) and must
 re-validate that delegation on the supplied executor. The service checks the
@@ -144,6 +144,49 @@ course is not-found, a foreign enrollment a denial). Lists take `limit` (default
   enrollment's effective lessons (else `QuestionResponseScopeError`), keyless bundle,
   no materials or provenance, personal-use body withheld (`bodyWithheld`).
 
+## Visibility and cover
+
+Two optional attributes live on the stable `AuthoredCourse` identity row (added
+columns `visibility`, `cover_asset_id` on `courses`; additive, migration-tested on
+a populated database). Each change is an append-only row (`CourseVisibilityChange`,
+`CourseCoverChange`: previous, new, actor, delegation, request key, time) and every
+write needs a `requestKey`; the same key with another payload is
+`CourseRequestKeyConflictError`, an unchanged value writes nothing. Reads degrade
+to `family` and no cover on a database without the columns; a write without the
+change tables throws `schema-unavailable`.
+
+- `setVisibility({ courseId, visibility: 'family'|'groups'|'public', requestKey })`
+  (action `education.course.set-visibility`, operation `set-visibility`). Default
+  is `family`. A stored value of `''` (never set, including every course authored
+  before this existed) reads as `family`; an explicit `setVisibility('family')` on
+  such a course is recorded (it is how a host pins a course family-only).
+  A course whose licence is `personal-use-copy` (head revision or any release,
+  which never loosens) refuses `groups` and `public` with
+  `CourseVisibilityRefusedError` (`visibility-refused`). A revision that turns a
+  `groups`/`public` course personal-use narrows it to `family` in the same
+  transaction with a change row (`reason: 'licence'`, request key
+  `licence:<revisionId>`). `AuthoredCourse.save()` also refuses the combination.
+- `listCourses({ visibility })` filters by effective visibility; views
+  (`CourseSummaryView`, `CourseStateView`) carry `visibility` and `coverAssetId`.
+- `setCover({ courseId, assetId: string | null, requestKey })` (action
+  `education.course.set-cover`, operation `set-cover`; `null` clears). The asset
+  must be a material this course copied into the tenant (`materialCopy`: the only
+  education-owned provenance the service records), with image content type
+  (png, jpeg, webp, gif), in the course's tenant, never `answer-key` in any lesson
+  revision or released lesson link, and readable by the acting user through the
+  asset guard (a private asset only when its owner is the actor's profile).
+  Anything else is `CourseCoverInvalidError` (`cover-invalid`, `reason`:
+  `missing`, `not-image`, `not-course-material`, `answer-key`, `unreadable`);
+  fail closed. A host that wants a standalone cover adds the image as an
+  attachment material of a lesson first.
+- `release` snapshots the current cover onto the immutable release Course row
+  (re-checked for eligibility, not for the releasing actor's read; dropped if no
+  longer eligible). `CourseReleaseView.coverAssetId` and
+  `latestRelease.coverAssetId` report it; later cover changes never rewrite it.
+- Group sharing: see [group sharing](group-sharing.md#authored-course-visibility).
+  `public` is a read-filter label: no marketplace, no payment, and no cross-tenant
+  read exists for it.
+
 ## Archive and discard
 
 `archive`/`unarchive` append reversible decisions, mirror release `Course.status`

package/agents/course-bundle-import.md

@@ -0,0 +1,148 @@
+# Course bundle import
+
+`CourseBundleImportService` (SMRT #4578, extends `CourseAuthoringService`,
+consumed by Hearth #94) imports a course bundle, a zip with an optional manifest
+or a plain file set, as bounded evidence, hands its supported members to the
+host for ingestion extraction and proposes sections and lessons for review.
+Risk is high: untrusted archive parsing and new schema. It reuses the course
+authorizer: `importBundle` needs `education.course.author`, `readImport`
+`education.course.read-draft`, `proposeStructure` `education.course.generate`
+(via `CourseGenerationReviewService`). Operations: `import-course-bundle`,
+`read-course-bundle`. Server only (Node `zlib`/`crypto`); no new dependency.
+
+## Flow
+
+1. `importBundle({ ...actor, bundle, limits?, onProgress?, receiveMember? })`
+   authorizes **before parsing**, unpacks (stage `unpack`), classifies and lays
+   out the structure (`classify`), writes the evidence in one transaction and
+   then calls `receiveMember` for each accepted member (`extract`), outside any
+   transaction. `bundle` is `{ archive: Uint8Array }` or `{ files: [{ path,
+   bytes }] }`. Hostile or damaged input throws `CourseBundleRefusedError`
+   (`reason`, optional `entry`) and writes nothing.
+2. `receiveMember(member, { replayed })` is the host's ingestion seam: call
+   `IngestionService.receive` with `sourceKind: 'course_import'` and the member
+   bytes, then queue extraction and `preserveQuestionExtractionAnalysis` as in
+   [question extraction](question-extraction.md). Members carry `role`
+   (manifest page role), `lessonKey`, `sectionKey`. It runs on a replay too
+   (ingestion dedups by content hash), so an interrupted first run resumes. Its
+   return values are in `result.receipts`.
+3. `proposeStructure({ ...actor, importId, bundle, courseId,
+   expectedHeadRevisionId })` (stage `propose`) re-supplies the bundle (bytes
+   are never retained), checks it is the imported one, and runs a deterministic
+   `CourseMaterialGenerator` (`smrt-bundle-import`) through
+   `requestGeneration`/`runGeneration`. The result is an ordinary proposal: a
+   new draft revision of additions and fills; conflicts wait for
+   `decideProposal`. Nothing is released, assigned or published. The request key
+   is `bundle:<courseId>:<bundleIdentity>`, so a retry returns the same job; the
+   same key with another head is `CourseRequestKeyConflictError`.
+4. `readImport({ ...actor, importId })` returns the recorded evidence.
+
+Progress is an observer callback (`onProgress({ stage, completed, total })`,
+stages `unpack`, `classify`, `extract`, `propose`; each starts at `completed: 0`).
+Ingestion has no public job-progress seam, so none is invented. A throwing
+listener never affects the import.
+
+## Hard bounds (`COURSE_BUNDLE_LIMITS`; a host may only lower them)
+
+| limit | value |
+|---|---|
+| `maxArchiveBytes` (input) | 100 MiB |
+| `maxEntries` | 200 |
+| `maxEntryBytes` (inflated) | 50 MiB |
+| `maxTotalBytes` (inflated) | 200 MiB |
+| `maxCompressionRatio` (members over `ratioFloorBytes` = 64 KiB) | 100 |
+| `maxPathBytes` / `maxSegmentBytes` / `maxPathDepth` | 512 / 255 / 8 |
+| `maxManifestBytes` | 256 KiB |
+| `maxLessons` (the proposal schema's cap) | 50 |
+| `maxLessonBodyChars` | 100 000 |
+| archive nesting | 1: a zip inside a zip is never expanded |
+
+A lesson whose combined text members exceed `maxLessonBodyChars` refuses the
+bundle (`lesson_too_large`, `entry` = lesson key) at import; text is never
+trimmed or dropped. A plain file set enforces `maxTotalBytes` on its member
+bytes exactly as an archive does on inflated bytes.
+
+The reader (`course-bundle-zip.ts`) parses the end record and central directory,
+validates every offset and size against the real buffer, inflates with
+`maxOutputLength` equal to the declared size (declared sizes are never trusted:
+a mismatch either way is `size_mismatch`), checks CRC32 and re-checks the total
+on actual output. Stored and deflate only. Refusals (`CourseBundleRefusalReason`)
+cover: not a zip, truncated, ambiguous end record (two end records that both fit
+the file, for example one forged in a comment), zip64, multi-disk, central
+directory not ending at the end record, entries out of range or overlapping,
+local header name/method mismatch, encrypted entries (flags 0/6/13, AES method),
+symlink and special files (unix mode; DOS reparse flag), unsupported method,
+bad CRC, ratio, entry count, totals, duplicate names (case/NFC-insensitive,
+backslashes normalised first) and bad paths (`..`, `.`, empty segments, absolute,
+drive letter or `:` anywhere, NUL/control/bidi characters, lone surrogates,
+too long or deep). An **honestly** oversize member (declared over
+`maxEntryBytes`) is not inflated and is recorded `refused / entry_too_large`.
+
+## Members and statuses
+
+By content (never by extension alone): `pdf` (`%PDF-` in the first 1 KiB),
+`image` (PNG, JPEG, WebP), `text` (`.txt`/`.md`, strict UTF-8, no control
+characters, body-sized), `manifest` (root `manifest.json`), else `unsupported`.
+Status: `accepted` (handed to extraction), `duplicate` (same sha256 as an earlier
+member in canonical order; recorded once as evidence, `duplicateOfPath`, never
+extracted again), `unsupported` (`unsupported_type`, `nested_archive`,
+`unreadable_text`), `refused` (`encrypted_pdf`, `entry_too_large`), `metadata`
+(the manifest). Nothing is dropped. An encrypted PDF is any PDF with an
+`/Encrypt` token anywhere in its bytes (trailer, xref stream): a false positive
+on literal text inside an uncompressed stream is refused, never read.
+
+## Manifest (`manifest.json`, version 1, closed)
+
+```json
+{ "version": 1, "course": { "subject": "Math" },
+  "sections": [ { "key": "unit-1", "title": "Unit One",
+    "lessons": [ { "key": "sums", "title": "Sums",
+      "members": [ { "path": "sheets/sums.pdf", "role": "exercise" } ] } ] } ] }
+```
+Every object is closed: an unknown key anywhere is `manifest_unknown_key` (with
+its path in `entry`); another version is `manifest_version`. Keys match
+`[A-Za-z0-9._:-]{1,120}` and are unique; roles are the extraction page roles
+(`exercise`, `example`, `instructions`, `cover`, `answer_key`, `mixed`,
+`unknown`); a listed path must exist and be listed once. The manifest is a source
+fact: roles are `source`, anything the extractor infers stays `inferred`, and a
+manifest/extraction disagreement belongs in extraction review, not here. Without
+a manifest each accepted member is one lesson, sections come from the top-level
+directory and order is natural path order (digit runs compare numerically, no
+locale). Manifest order: the manifest, declared members, then the rest by path.
+Lesson bodies are the readable text members of a lesson, joined; PDFs and images
+are never inlined. Members whose declared role is `answer_key` or `mixed` never
+contribute text to a lesson body (they remain recorded evidence members); the
+proposal rationale only counts how many were withheld.
+
+## Readers
+
+`BundleReader { formatId, detect, prepare }` in a `BundleReaderRegistry`;
+built-ins are `manifest-v1` and `plain-files`. SCORM and Common Cartridge are
+**not implemented** (their manifests describe launch resources and activity
+trees that do not map to sections/lessons without design); a host can register
+a reader ahead of the built-ins (`register(reader, { first: true })`).
+
+## Identity and replay
+
+`bundleIdentity` (`cbi1-...`) digests the sorted (path, sha256) pairs, so
+re-zipping, reordering and timestamps replay. One `CourseBundleImport` per
+(tenant, identity); a concurrent first import replays once on the unique index.
+
+## Models (closed, required tenant, no REST/CLI/MCP/AI, append-only)
+
+`CourseBundleImport` (`course_bundle_imports`: identity, format, reader,
+manifest version, counts, actor) and `CourseBundleMember` (`course_bundle_members`:
+unique tenant/import/path; ordinal, sha256, size, media type, kind, status,
+reason, duplicate-of, role, section and lesson key). Hashes and placements only:
+bytes stay with the host's ingestion receipts. Rewrites and deletes throw.
+Normal manifest migrations create both tables.
+
+## Not in this release
+
+- Ingestion's receipt contract is unchanged: there is no `application/zip` part
+  type or `parentEvidenceId` in ingestion. The education side unpacks and the
+  host receives members one by one, so archive-to-member lineage lives in
+  `course_bundle_members` (and the host's receipts), not in ingestion evidence.
+  Changing ingestion's published receipt is a separate design decision.
+- A manifest/extraction disagreement is not compared automatically.
+- SCORM / Common Cartridge readers; zip64; nested archives; encrypted zips.

package/agents/group-sharing.md

@@ -276,3 +276,23 @@ family kind. The helper provides no arbitrary cross-tenant directory.
 | Behavior/invariant | Trigger | Positive | Negative/failure | Actor/context | Executor/transaction | Runtime/dialect | External edge | Level | Command |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
 | G33 workspace kind | trusted exact resource lookup | existing family false; active/inactive group true | blank/malformed/absent tenant; ambiguous group rows; PostgreSQL RLS-hidden or indeterminate zero refuses family; database failures propagate | host-selected exact tenant, no synthetic session/context | caller-supplied executor, fresh reads; no writes | Node SQLite/PostgreSQL | status/membership/role absence never implies family or grants | integration | `pnpm --filter @happyvertical/smrt-education exec vitest run src/__tests__/group-sharing-workspace.test.ts` (same file with TEST_DB_ADAPTER=postgres and isolated DATABASE_URL) |
+
+## Authored course visibility
+
+Authored-course `visibility` (see [course authoring](course-authoring-service.md))
+only ever narrows group sharing; it never adds a reader, a tenant or a facet.
+
+Before: every authored release that was not personal-use was eligible (policy
+options, `listSharedWork`, preview) subject to the policy, edge and review rules.
+After: the same, except an authored release whose identity is explicitly recorded
+as `family` (including any unrecognized stored value) is `course-private`: it is
+absent from the policy options and its work evaluates `course-private`, also when
+only another release of that course is in the enrollment's pin lineage.
+`groups` and `public` change nothing relative to before. A course whose visibility
+was never recorded (everything authored before visibility existed) also behaves as
+before, so existing contracts and tests are unchanged; hosts that want a default
+of "family only" call `setVisibility('family')` explicitly. `public` is a listing
+label only; no reviewed cross-tenant read path exists for it, so it grants nothing.
+Non-authored courses, answer keys and personal-use rules are untouched, and a
+database without the visibility column or release tables reads as never recorded.
+The gate is `authoredVisibilityPermitsGroups(db, tenantId, releaseCourseId)`.

package/agents/learner-service.md

@@ -101,6 +101,41 @@ Same-tenant membership alone never grants sibling access.
   submissions and history never cascade. Bad input throws
   `LearnerValidationError`; a host without `enrollment_status_changes` gets
   `LearnerHistoryUnavailableError`.
+- `completeOwnLesson({ enrollmentId, lessonId, policyBasis, evidence?: { submissionId } })`
+  moves progress to `complete` (any lesson kind, `completedAt` set, a missing
+  row created) under `education.progress.complete-own`; the host decides per
+  setting and may allow a guardian too (own is not blocked). It appends an
+  immutable `LessonCompletionRecord` (actor, `policyBasis`, prior status,
+  optional evidence submission, at most one per progress) and a `complete`
+  `LessonProgressTransition` when that optional table exists. `evidence`
+  must be a non-rejected submission of the same tenant, learner, lesson and
+  progress, else `LearnerAuthorizationError`. Counters, score and start time
+  are untouched; no score is invented. Returns `{ changed, progress }`.
+  Repeat rule: a lesson already completed through this path (a record exists)
+  returns `{ changed: false }`; one complete any other way (guardian
+  `attestLesson`/grade, workbook completion) throws `LessonAlreadyCompleteError`.
+  Also `EnrollmentNotActiveError` (`.status`; only `active` enrollments),
+  `LessonSkippedError`, `WorkbookOwnedLessonError` (a workbook lesson completes
+  through its workbook decision), and `LearnerHistoryUnavailableError` without
+  `lesson_completion_records`. Guardian `attestLesson` is unchanged.
+- `setEnrollmentPace({ enrollmentId, pace: { lessonsPerWeek } | null, policyBasis })`
+  sets or clears the enrollment's planned lessons per week under
+  `education.enrollment.set-pace` (the host decides whether a learner may act
+  on their own enrollment). `lessonsPerWeek` is a whole number from 1 to 14
+  (`MIN_/MAX_LESSONS_PER_WEEK`), else `EnrollmentPaceError`. It is stored as the
+  integer column `enrollments.pace_lessons_per_week` (`0` = no pace, like
+  `targetMinutesPerWeek`) and surfaces as `EnrollmentView.pace` (`null` when
+  unset). Each change appends an immutable `EnrollmentPaceChange` (actor,
+  `policyBasis`, previous and new value, `0` = none); an unchanged pace is
+  `{ changed: false }` with no row. Status and progress are untouched. A host
+  without `enrollment_pace_changes` gets `LearnerHistoryUnavailableError`.
+  Apply the additive migration (new column plus table) before deploying writes;
+  reads of an un-migrated table report no pace.
+- `nextLessons({ enrollmentId?, count? })`: `count` is an integer from 1 to
+  14 (`MAX_NEXT_LESSONS_COUNT`, default 1, else `LearnerValidationError`) and
+  returns up to that many unfinished (not complete or skipped) lessons per
+  enrollment in lesson order, as the same flat entries; the default is
+  unchanged.
 - `listProgress` reads only the validated learner/enrollment and lessons still
   visible in that enrollment's course. Inconsistent persisted links fail
   closed or are omitted from the list.

package/agents/question-extraction.md

@@ -104,5 +104,8 @@ Both ship through normal manifest migrations. The originals stay in ingestion
 and are never copied. Imported material keeps its course licence; extraction
 does not change sharing.
 
-Not in this release: zip/bundle manifests (SMRT #4578), automatic new
+Zip and manifest bundles are handled before extraction by
+[CourseBundleImportService](course-bundle-import.md) (SMRT #4578).
+
+Not in this release: automatic new
 revisions on `source_changed`, and media assets for extracted diagrams.

package/agents/tutor-context.md

@@ -0,0 +1,62 @@
+# Tutor context and sessions
+
+No AI call, prompt text or provider lives here. The host builds prompts from
+`TutorContext` and owns the model call and spend ceiling; this package records
+what was said.
+
+## TutorContextService.compose
+
+`compose({ ...LearnerRequest, audience: 'learner' | 'guardian', enrollmentId?,
+lessonId?, questionRevisionId? })` extends `QuestionResponseService`; every read uses
+the service executor (the transaction's inside `withTransaction`). The host
+authorizer is asked `education.tutor.read` with `own` and `relationshipTypeId`
+as for `LearnerService`. A lesson needs its enrollment and must be in the
+enrollment's effective set; a focus question must belong to that lesson
+(otherwise `LearnerAuthorizationError`). The guardian audience is refused for
+the learner's own actor whatever the host answers.
+
+Result: learner (name, level), enrollment (status, pace; no notes), course,
+section and lesson titles, learner-facing lesson body (withheld for
+personal-use-copy), objectives, own progress status, the learner-visible
+question rendering (prompt, response type, choices, subpart prompts, points; no
+media or anchors), submission count with latest status only, and the newest
+**released** feedback text (guardian: newest guardian-confirmed revision), plus
+`answerKeyAvailable`, `truncated` and `contextHash`.
+
+Learner audience never carries answer keys, rubrics, key assets or their ids,
+storage URIs, enrollment parent notes, grades, other learners or grading
+internals: it is built from an allowlist and keys are read only to set the
+boolean. The guardian audience adds capped answer-key and rubric text, still no
+storage locators or notes. Do not add fields without a sentinel test in
+`tutor-context.test.ts`.
+
+Bounds (exported constants): body 8000, prompt/choice/subpart 2000, key 2000,
+feedback 2000, titles 300, 30 questions (the focus question is kept), 12 choices
+and subparts, 10 objectives, 48000 serialized characters overall (trailing
+questions drop first). Any cut sets `truncated`.
+
+## TutorSessionService
+
+Append-only `TutorSession`, `TutorSessionClosure` and `TutorExchange` (new
+tables `tutor_sessions`, `tutor_session_closures`, `tutor_exchanges`;
+tenant-scoped, closed generated surfaces, update/delete rejected). A session is
+open until its single closure row exists. Sessions store ids, audience, mode,
+actor, voice consent and the context digest, never context text.
+
+- `open` (`education.tutor.exchange`): `requestKey` idempotent per learner; a
+  replay with a changed payload is `TutorRequestKeyConflictError`. Voice needs
+  `voiceConsent: true` the host recorded (`TutorConsentRequiredError`). Guardian
+  audience is refused for the learner's own actor.
+- `append` (`education.tutor.exchange`): role `learner|tutor|system`; `learner`
+  only from the learner themself. Text 1 to 4000 characters else
+  `TutorExchangeError`. Idempotent per session `requestKey`; sequence is
+  server-assigned from 1; closed session is `TutorSessionClosedError`. Optional
+  `marker` (`none|filtered|redacted|flagged`), `toolSummary`, token counts.
+- `close`: appends the closure; closing twice returns `changed: false`.
+- `listForLearner` (`education.tutor.read`): sessions newest first, `limit`
+  (<=50) and `cursor`, per-session exchanges bounded by `exchangeLimit` (<=200)
+  with `exchangesTruncated`; `sessionId` + `afterSequence` page one transcript.
+  A guardian reads through the host's decision on the relationship.
+
+Missing tables raise `LearnerHistoryUnavailableError`. Concurrent appends rely on
+the unique `(tenant, session, sequence)` index.

package/dist/catalog.d.ts

@@ -29,7 +29,19 @@ export declare class Course extends SmrtObject {
 }
 export declare class ExternalCourse extends Course {
 }
+/** Who an authored course is meant for: its family, its family's groups, a public listing label. */
+export declare const COURSE_VISIBILITIES: readonly ["family", "groups", "public"];
+export type CourseVisibility = (typeof COURSE_VISIBILITIES)[number];
 export declare class AuthoredCourse extends Course {
+    /**
+     * Authored-course visibility; '' means never set (reads as 'family'). Only the
+     * course-authoring service writes it, with an append-only change row.
+     */
+    visibility: CourseVisibility | '';
+    /** Education-owned image asset shown as the course cover; '' means none. */
+    coverAssetId: string;
+    constructor(options?: Record<string, unknown>);
+    save(options?: SmrtSaveOptions): Promise<this>;
 }
 export declare class CourseSection extends SmrtObject {
     tenantId: string | null;

package/dist/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,UAAU,EACV,KAAK,eAAe,EAErB,MAAM,0BAA0B,CAAC;AAGlC,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,cAAc,GACd,mBAAmB,GACnB,sBAAsB,CAAC;AAC3B,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,WAAW,GACX,KAAK,GACL,OAAO,GACP,MAAM,GACN,OAAO,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,WAAW,GAAG,UAAU,CAAC;AAC9D,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAwB9E,qBAEa,MAAO,SAAQ,UAAU;IACN,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAClC,KAAK,SAAM;IACtC,OAAO,SAAM;IACb,WAAW,SAAM;IACjB,SAAS,SAAY;IACrB,SAAS,SAAM;IACf,SAAS,SAAM;IACf,OAAO,SAAM;IACb,WAAW,EAAE,iBAAiB,CAAc;IAC5C,WAAW,SAAM;IACjB,UAAU,SAAM;IAChB,OAAO,SAAM;IACb,IAAI,SAAM;IACV,QAAQ,SAAK;IACb,QAAQ,SAAK;IACb,UAAU,SAAO;IACjB,gBAAgB,SAAK;IACrB,QAAQ,EAAE,cAAc,CAAY;IACpC,MAAM,EAAE,YAAY,CAAW;gBACnB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAKjD,yEAAyE;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAyC9D;AAED,qBACa,cAAe,SAAQ,MAAM;CAAG;AAE7C,qBACa,cAAe,SAAQ,MAAM;CAAG;AAE7C,qBAEa,aAAc,SAAQ,UAAU;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IACnB,QAAQ,SAAM;IAC7B,KAAK,SAAM;IACtC,SAAS,SAAK;gBACF,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAIlC,IAAI,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAmB9D;AAED,qBAEa,MAAO,SAAQ,UAAU;IACN,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IACZ,SAAS,SAAM;IACrC,KAAK,SAAM;IACtC,IAAI,SAAM;IACV,SAAS,SAAK;IACd,gBAAgB,SAAK;IACrB,UAAU,SAAO;IACjB,QAAQ,EAAE,cAAc,CAAY;IACpC,cAAc,EAAE,oBAAoB,CAAY;IAChD,WAAW,SAAM;IACjB,WAAW,SAAM;gBACL,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAIlC,IAAI,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAmB9D;AAED,qBACa,OAAQ,SAAQ,MAAM;CAAG;AACtC,qBACa,KAAM,SAAQ,MAAM;IAC/B,QAAQ,SAAM;gBACF,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAIlD;AACD,qBACa,SAAU,SAAQ,MAAM;IACnC,YAAY,SAAM;IAClB,SAAS,SAAM;IACf,KAAK,SAAK;IACD,cAAc,EAAE,oBAAoB,CAAY;gBAC7C,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAIlD;AACD,qBACa,QAAS,SAAQ,MAAM;CAAG"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,UAAU,EACV,KAAK,eAAe,EAErB,MAAM,0BAA0B,CAAC;AAGlC,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,cAAc,GACd,mBAAmB,GACnB,sBAAsB,CAAC;AAC3B,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,WAAW,GACX,KAAK,GACL,OAAO,GACP,MAAM,GACN,OAAO,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,WAAW,GAAG,UAAU,CAAC;AAC9D,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAwB9E,qBAEa,MAAO,SAAQ,UAAU;IACN,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAClC,KAAK,SAAM;IACtC,OAAO,SAAM;IACb,WAAW,SAAM;IACjB,SAAS,SAAY;IACrB,SAAS,SAAM;IACf,SAAS,SAAM;IACf,OAAO,SAAM;IACb,WAAW,EAAE,iBAAiB,CAAc;IAC5C,WAAW,SAAM;IACjB,UAAU,SAAM;IAChB,OAAO,SAAM;IACb,IAAI,SAAM;IACV,QAAQ,SAAK;IACb,QAAQ,SAAK;IACb,UAAU,SAAO;IACjB,gBAAgB,SAAK;IACrB,QAAQ,EAAE,cAAc,CAAY;IACpC,MAAM,EAAE,YAAY,CAAW;gBACnB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAKjD,yEAAyE;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAyC9D;AAED,qBACa,cAAe,SAAQ,MAAM;CAAG;AAE7C,oGAAoG;AACpG,eAAO,MAAM,mBAAmB,yCAA0C,CAAC;AAC3E,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,qBACa,cAAe,SAAQ,MAAM;IACxC;;;OAGG;IACH,UAAU,EAAE,gBAAgB,GAAG,EAAE,CAAM;IACvC,4EAA4E;IAC5E,YAAY,SAAM;gBACN,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAIlC,IAAI,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAQ9D;AAED,qBAEa,aAAc,SAAQ,UAAU;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IACnB,QAAQ,SAAM;IAC7B,KAAK,SAAM;IACtC,SAAS,SAAK;gBACF,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAIlC,IAAI,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAmB9D;AAED,qBAEa,MAAO,SAAQ,UAAU;IACN,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IACZ,SAAS,SAAM;IACrC,KAAK,SAAM;IACtC,IAAI,SAAM;IACV,SAAS,SAAK;IACd,gBAAgB,SAAK;IACrB,UAAU,SAAO;IACjB,QAAQ,EAAE,cAAc,CAAY;IACpC,cAAc,EAAE,oBAAoB,CAAY;IAChD,WAAW,SAAM;IACjB,WAAW,SAAM;gBACL,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAIlC,IAAI,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAmB9D;AAED,qBACa,OAAQ,SAAQ,MAAM;CAAG;AACtC,qBACa,KAAM,SAAQ,MAAM;IAC/B,QAAQ,SAAM;gBACF,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAIlD;AACD,qBACa,SAAU,SAAQ,MAAM;IACnC,YAAY,SAAM;IAClB,SAAS,SAAM;IACf,KAAK,SAAK;IACD,cAAc,EAAE,oBAAoB,CAAY;gBAC7C,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAIlD;AACD,qBACa,QAAS,SAAQ,MAAM;CAAG"}