@happyvertical/smrt-education 0.58.0 → 0.59.0

package/AGENTS.md

@@ -57,11 +57,16 @@ Structured questions from scans and imported course files use
 ingestion handler. Anchors come from provider region catalogs only; match by worksheet
 id and layout, never text; ambiguous matches stay unattached; source-keyed replays.
 
-Course bundles (zip with a closed manifest, or a file set; Word/PowerPoint members render through an injected `DocumentConverter`, fail closed) use
+Course bundles (zip with a closed manifest v1 or v2, or a file set; Word/PowerPoint members render through an injected `DocumentConverter`, fail closed; v2 carries material roles, audience, lesson pages, course members and YouTube references) use
 [CourseBundleImportService](agents/course-bundle-import.md). Parse only with the
 bounded reader; refuse, never trim, hostile input; unsupported members stay
 visible; proposals only, nothing auto-published.
 
+Class CrunchLabs (a download read into a manifest v2 bundle; an operator-only
+global catalog provider until the operator's single public switch):
+[source contract](agents/class-crunchlabs.md). Never host its files; `operator`
+visibility needs the host's `operatorTenantIds`.
+
 Source import: [host boundary and transaction contract](agents/source-import.md).
 `SourceImportService` requires host opt-in, matching active actor/tenant and
 explicit licensing authorization; never add a system/global write bypass.

package/agents/class-crunchlabs.md

@@ -0,0 +1,83 @@
+# Class CrunchLabs source (SMRT #4616)
+
+Class CrunchLabs is a global catalog provider (`class-crunchlabs`) whose units are
+listed under Science, with the @ClassCrunchLabs YouTube course playlists as
+previews. "Add to a course" reads the family's own download of the unit and runs
+the [bundle import](course-bundle-import.md) with a manifest version 2 built from
+it. Files come from CrunchLabs' own downloads and YouTube; **nothing is hosted
+here** and the listing has no acquirable formats.
+
+## Operator-only until permission, one public switch
+
+`CatalogVisibility` gains `operator`. A `CatalogPolicy` built with
+`operatorTenantIds` lets only those families (host configuration, never a
+request) see `operator` records; the default policy shows them to nobody, and
+`authorize` answers `operator-only`. Materialization refuses them.
+
+`createClassCrunchLabsCatalogAdapter({ playlists, publicListing? })` is a snapshot
+`CatalogSyncAdapter` (one terminal page, no cursor). By default
+(`CLASS_CRUNCHLABS_PUBLIC_LISTING_DEFAULT = false`) every record is `operator`
+visibility with licence state `unknown`, no permitted operations and the text
+"free curriculum, permission pending". Only the literal `publicListing: true`,
+set by the operator in host configuration, makes records `catalog` visibility
+with `verified` evidence permitting `link` only. The switch is part of each
+record's revision, so the next sync rewrites the rows when it is flipped.
+`classCrunchLabsPreviewEmbedUrl(record)` returns the youtube-nocookie playlist
+embed for a listed unit (null for anything else). The playlist data is an
+injected `ClassCrunchLabsPlaylistSource`; the adapter never touches the network.
+
+`addClassCrunchLabsUnit({ service, actor, catalogActor, record, listing, policy,
+files, playlists, pageCounter?, receiveMember? })` re-checks
+`canAddClassCrunchLabsUnit(actor, policy, listing)`: visibility is derived from the
+host's own `listing.publicListing` (operator unless the literal `true`), never from
+the record or any caller-supplied visibility or licence; an operator-only listing
+is refused to every other family, and the course actor must be the catalog actor, builds the bundle and imports each part. Then propose
+structure and `applyMaterials` per part as for any bundle. Courses are
+`personal-use-copy` (`build.licenseKind`).
+
+## Reading a download
+
+`buildClassCrunchLabsBundle({ files, playlists?, unit?, pageCounter?,
+includeUnitWideAggregates?, maxPartBytes? })` takes a `ClassCrunchLabsFileSource`:
+`folderClassCrunchLabsSource(dir)` (Node only, from `@happyvertical/smrt-education/node`, never the root: a folder, the Drive zip parts, or both;
+zips are read lazily from their central directory, zip64/encrypted/symlinks are
+skipped) or `memoryClassCrunchLabsSource(files)`. It never reads video files.
+
+- Layout: `<Unit>_All Unit Wide Materials` and `<Unit>_Lesson <n>`; letters A
+  teacher manual, B slides, C student mission log, D status check assessment
+  (plus guidance and the editable master), E handouts, F extras, G videos. A
+  lettered directory wins over a file's own letter. Several units need `unit`.
+- Mapping to manifest v2: A `teacher-guide`, B `slides`, C `learner-pages`, D
+  `assessment` / `assessment-guidance`, E `handout`, F `printable`, the unit-wide
+  Supply List `attachment`. Audiences are the role defaults (teacher manual and
+  guidance guardian, slides guardian, mission log learner); the editable
+  assessment master is guardian. Unit-wide files become course members.
+- The unit-wide "(all lessons)" combined files repeat the per-lesson files and
+  are large, so they are left out unless `includeUnitWideAggregates` (reported as
+  `aggregate-of-lessons`); the supply list, posters and other extras are kept.
+- Lesson pages: the first mission log of a lesson gets a `Mission log` range
+  from `pageCounter` (`createClassCrunchLabsPageCounter({ converter? })` counts
+  PDFs with pdf-lib and Word files by rendering them through the converter).
+  Without a count the lesson gets no pages and the report says so.
+- Videos: names `Lnn.step_Video_Kind_Title` are matched, by unit (playlist
+  title), lesson and step (`L03.6` or `Lesson 3 ... Step 6` in the item title),
+  to the unit playlist; two videos sharing a step are told apart by the item
+  title naming their title or kind, else both stay unmatched (`ambiguous`).
+  Matches become `videos` references with a title and a step order (materials
+  prep videos are guardian audience); unit-level videos (a teaser) and unmatched
+  ones are only reported.
+- De-duplication: repeated exports of one logical path collapse (CRC and size
+  when known; the newer export wins, a changed file is `superseded`); the same
+  bytes under another name or place keep one copy (the lesson-named file in its
+  lesson, posters unit wide, never a `copy`).
+- A unit larger than one archive (bundle cap 100 MiB) is split by lesson into
+  `build.parts` (default 90 MiB each; the first part carries the course members and
+  any lesson that fits beside them, others go to the first part with room; if no
+  lesson fits beside the course members the build refuses with `too_large`); `build.bundle`
+  and `build.manifest` are the first part.
+
+The `report` lists lessons, members, parts, pages, matched and unmatched videos,
+duplicates, ignored files and warnings. Fixtures in tests are synthetic files
+with the same naming; no real download is ever copied into the repository.
+
+Tests: `src/__tests__/class-crunchlabs.test.ts`.

package/agents/course-bundle-import.md

@@ -84,7 +84,7 @@ too long or deep). An **honestly** oversize member (declared over
 
 ## Members and statuses
 
-By content (never by extension alone): `docx`/`pptx` (see below), `pdf` (`%PDF-` in the first 1 KiB),
+By content (never by extension alone): `docx`/`pptx`/`xlsx` (see below), `pdf` (`%PDF-` in the first 1 KiB),
 `image` (PNG, JPEG, WebP), `text` (`.txt`/`.md`, strict UTF-8, no control
 characters, body-sized), `manifest` (root `manifest.json`), else `unsupported`.
 Status: `accepted` (handed to extraction), `duplicate` (same sha256 as an earlier
@@ -97,9 +97,11 @@ on literal text inside an uncompressed stream is refused, never read.
 
 ## Word and PowerPoint members (SMRT #4615)
 
-A `.docx`/`.pptx` member is an OOXML package only when the name and the content
-agree: a zip whose entries include `[Content_Types].xml` and `word/document.xml`
-(docx) or `ppt/presentation.xml` (pptx). Before the bytes go anywhere, the
+A `.docx`/`.pptx`/`.xlsx` member is an OOXML package only when the name and the
+content agree: a zip whose entries include `[Content_Types].xml` and
+`word/document.xml` (docx), `ppt/presentation.xml` (pptx) or `xl/workbook.xml`
+(xlsx). A workbook (a supply list) is rendered and kept like the others but has
+no text reader. Before the bytes go anywhere, the
 package itself passes the same bounded zip reader (ratio, overlap, paths, CRC,
 100 MiB inflated); a failure is `refused / unsafe_office`, never a refusal of the
 whole bundle. Other zips stay `unsupported / nested_archive`.
@@ -158,10 +160,15 @@ network**, its own size/time limits and no shared volume with the app; this
 package assumes untrusted files never run next to the application. Tests use
 `FakeDocumentConverter` (records calls; `failWith`, `failWhen`, `delayMs`, `output`).
 
-`OfficeTextReader` is deliberately not wired to the SDK here, so this package
-does not depend on an unreleased `@happyvertical/documents`. Once the Office
-processors ship (sdk#1485, `extractOffice(bytes, 'docx' | 'pptx')`), implement
-`read` with it; the snippet is in the `OfficeTextReader` doc comment.
+`OfficeTextReader` reads Office text through the SDK without this package
+depending on `@happyvertical/documents`: the host imports `extractOffice`
+(released in `@happyvertical/documents` 0.111.4, sdk#1486, Kreuzberg) and passes
+it to `createOfficeTextReader(extractOffice)`, which returns whole-document
+text for Word and text plus speaker notes per slide for PowerPoint (images are
+never requested). An absent engine reads as `null`; a corrupt file rejects and
+the importer treats that as "no text". The repository's current `catalog:`
+pin is 0.111.3, which predates the Office processors, so the host bumps the SDK
+set (and its minimum release age) before it can import `extractOffice`.
 
 ## Manifest (`manifest.json`, version 1, closed)
 
@@ -186,10 +193,96 @@ are never inlined. Members whose declared role is `answer_key` or `mixed` never
 contribute text to a lesson body (they remain recorded evidence members); the
 proposal rationale only counts how many were withheld.
 
+## Manifest version 2 (SMRT #4615)
+
+A root `manifest.json` with `"version": 2` is laid out by the `manifest-v2`
+reader; version 1 keeps its own reader and page roles. The schema is closed in
+the same way: an unknown key anywhere is `manifest_unknown_key` (with its path in
+`entry`), another version is `manifest_version`.
+
+```json
+{ "version": 2, "course": { "subject": "Science" },
+  "courseMembers": [ { "path": "unit/supplies.pdf", "role": "attachment", "title": "Supply list" } ],
+  "sections": [ { "key": "unit", "title": "Unit", "lessons": [ {
+    "key": "l1", "title": "Lesson 1",
+    "members": [ { "path": "l1/log.docx", "role": "learner-pages" },
+                 { "path": "l1/deck.pptx", "role": "slides" },
+                 { "path": "l1/guidance.pdf", "role": "assessment-guidance" } ],
+    "pages":  [ { "member": "l1/log.docx", "from": 1, "to": 4, "label": "Mission log" } ],
+    "videos": [ { "reference": "dQw4w9WgXcQ", "title": "Recap", "step": 1 } ] } ] } ] }
+```
+
+- **Members** (lesson `members` and root `courseMembers`): `path` (must exist, listed
+  once), `role` (required) one of `teacher-guide`, `slides`, `learner-pages`,
+  `assessment`, `assessment-guidance`, `handout`, `printable`, `answer-key`,
+  `attachment` (`manifest_role` otherwise; a video is a reference, never a file),
+  optional `audience` and `title`. The audience is the role default
+  (`LESSON_ASSET_DEFAULT_AUDIENCE`) unless stated; `answer-key` and
+  `assessment-guidance` are always guardian (a learner audience is
+  `manifest_audience`). Members not listed stay recorded evidence with no role.
+- **Pages**: `{ member, from, to, label? }` ranges over a member of the same lesson
+  (PDF, Word or PowerPoint; the rendered PDF for Office). Each page becomes a
+  `LessonPage` keyed `p<n>`, labelled `<label> <n>` (default `Page <n>`), ordered by
+  declaration. Bad, overlapping or unpageable ranges are `manifest_pages`; at most
+  500 pages per lesson.
+- **Videos**: `{ reference, title, step, audience? }` where `reference` is a bare id
+  or an allowlisted https YouTube URL (`parseYouTubeReference`; anything else is
+  `manifest_video`), `step` an integer 0-9999. They become `LessonExternalVideo`
+  rows; nothing is downloaded.
+- **Course members** become `CourseAsset` rows, not tied to any lesson.
+
+Guardian-audience text (teacher guides, guidance, keys) never enters a proposed
+lesson body; only learner-audience text members do. Under v2 `role` on the member
+evidence row is the material role and `audience` the effective audience (NULL on
+rows recorded before v2). The plan carries `materials` (also on
+`CourseBundleImportResult.materials`): the resolved materials, pages and videos,
+plus `skipped` for declared members that were unsupported, refused or failed
+rendering. A duplicate member resolves to the earlier identical member's bytes
+(`assetPath`) and one material per (place, role, content).
+
+`receiveMember` also gets `audience` and `courseLevel`. **Slides** keep the original
+deck (hand `bytes` to the host as a private asset: "Open in PowerPoint") and its
+rendered pages (`rendered`: "Present").
+
+### Applying materials
+
+`applyMaterials({ ...actor, importId, bundle, courseId, lessons, assets })`
+(`education.course.author`, operation `apply-course-bundle-materials`) writes the
+rows in one transaction. The host has stored each accepted member as a private
+asset and created the course's lessons: `lessons` maps manifest lesson key to the
+`Lesson` id, `assets` maps member path to `{ original, rendered }` asset ids.
+Slides join both the original deck and the rendered PDF; the original join is always
+guardian-only whatever the deck's declared audience (the audience applies to the
+rendered PDF), and a join written earlier with a wider audience is repaired on
+re-apply (`repaired`); any other Word/PowerPoint
+member joins only its rendered PDF, so a learner is never handed an editable
+original. `LessonAsset`/`CourseAsset` saves keep their private-asset rule (guardian-
+only roles and personal-use-copy courses need private assets). It targets
+family-owned courses; an authored course is `authored-course` because authored
+material changes through course authoring. Idempotent: an identical row is
+`unchanged`, a row with other details is `CourseBundleMaterialsError('conflict')`,
+a missing asset or lesson is `asset-missing`/`lesson-missing`; any error writes
+nothing.
+
+### Retrying a failed rendering
+
+`retryRendering({ ...actor, importId, bundle, paths?, receiveMember? })`
+(`education.course.author`, operation `retry-course-bundle-rendering`, needs a
+converter) renders the Word/PowerPoint members whose first import recorded a
+*transient* failure (`converter_unavailable`, `converter_failed`,
+`converter_timeout`; `COURSE_BUNDLE_RETRYABLE_REASONS`). The first import's member
+rows are never rewritten. A success appends one `course_bundle_renderings` row
+per (import, content hash); every reader (`readImport`, replayed imports,
+proposals) overlays it, so the member reads `accepted` (identical copies as
+duplicates) with its rendered hash. A failure records nothing, so asking again is
+always allowed; a second retry of a repaired member is `unchanged` and renders
+nothing. Converter rejections, size limits and the Office member cap are not
+retryable: change the bundle. The bundle must be the imported one.
+
 ## Readers
 
 `BundleReader { formatId, detect, prepare }` in a `BundleReaderRegistry`;
-built-ins are `manifest-v1` and `plain-files`. SCORM and Common Cartridge are
+built-ins are `manifest-v2`, `manifest-v1` and `plain-files`. SCORM and Common Cartridge are
 **not implemented** (their manifests describe launch resources and activity
 trees that do not map to sections/lessons without design); a host can register
 a reader ahead of the built-ins (`register(reader, { first: true })`).
@@ -203,20 +296,17 @@ re-zipping, reordering and timestamps replay. One `CourseBundleImport` per
 ## Models (closed, required tenant, no REST/CLI/MCP/AI, append-only)
 
 `CourseBundleImport` (`course_bundle_imports`: identity, format, reader,
-manifest version, counts, actor) and `CourseBundleMember` (`course_bundle_members`:
+manifest version, counts, actor), `CourseBundleMember` (`course_bundle_members`:
 unique tenant/import/path; ordinal, sha256, size, media type, kind, status,
-reason, duplicate-of, role, section and lesson key). Hashes and placements only:
+reason, duplicate-of, role, audience, section and lesson key) and
+`CourseBundleRendering` (`course_bundle_renderings`: a deliberate retry's success). Hashes and placements only:
 bytes stay with the host's ingestion receipts. Rewrites and deletes throw.
-Normal manifest migrations create both tables.
+Normal manifest migrations create the tables and add `audience` (NULL on older rows).
 
 ## Not in this release
 
-- Manifest version 2 (material roles with audience, lesson pages, course-level
-  members, external video references) waits for the phase 1 role vocabulary
-  (smrt#4614). The page-role vocabulary and the closed v1 schema are unchanged;
-  see the hand-off note on smrt#4615.
-- Re-rendering a member whose first import recorded a converter failure (outcomes
-  are append-only per bundle identity).
+- Material rows for authored courses: a proposal still carries lesson text only;
+  authored course material goes through `CourseMaterialInput` and release.
 - Ingestion's receipt contract is unchanged: there is no `application/zip` part
   type or `parentEvidenceId` in ingestion. The education side unpacks and the
   host receives members one by one, so archive-to-member lineage lives in

package/dist/catalog-contracts.d.ts

@@ -1,6 +1,10 @@
 import type { CatalogPreview } from './catalog-preview.js';
-/** Metadata-only resource visibility. Teacher material is never learner-visible. */
-export type CatalogVisibility = 'catalog' | 'teacher';
+/**
+ * Metadata-only resource visibility. Teacher material is never learner-visible.
+ * `operator` records (a provider whose permission is pending) are visible only
+ * to the tenants the host designated as operator families; see `CatalogPolicy`.
+ */
+export type CatalogVisibility = 'catalog' | 'teacher' | 'operator';
 export type CatalogLicenseState = 'verified' | 'unknown' | 'conflicting' | 'restricted';
 export type CatalogOperation = 'link' | 'download' | 'print' | 'adapt' | 'redistribute' | 'commercial-use';
 /** Exact source evidence; no provider-wide license inference is permitted. */

package/dist/catalog-contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-contracts.d.ts","sourceRoot":"","sources":["../src/catalog-contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,CAAC;AACtD,MAAM,MAAM,mBAAmB,GAC3B,UAAU,GACV,SAAS,GACT,aAAa,GACb,YAAY,CAAC;AACjB,MAAM,MAAM,gBAAgB,GACxB,MAAM,GACN,UAAU,GACV,OAAO,GACP,OAAO,GACP,cAAc,GACd,gBAAgB,CAAC;AAErB,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,mBAAmB,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAC1C;AAED,oFAAoF;AACpF,UAAU,6BAA6B;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AACD,MAAM,MAAM,6BAA6B,GAAG,6BAA6B,GACvE,CACI;IACE,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC/B,SAAS,EACL,iBAAiB,GACjB,iBAAiB,GACjB,yEAAyE,CAAC;IAC9E,WAAW,EACP;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACzC;QAAE,MAAM,EAAE,oBAAoB,CAAA;KAAE,GAChC;QAAE,MAAM,EAAE,YAAY,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,kFAAkF;IAClF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE;QACX,MAAM,EAAE,gBAAgB,CAAC;QACzB,MAAM,EAAE,sBAAsB,GAAG,2BAA2B,CAAC;KAC9D,CAAC;CACH,CACJ,CAAC;AACJ,MAAM,MAAM,oCAAoC,GAC5C;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,UAAU,GAAG,QAAQ,CAAA;CAAE,GACtD;IACE,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EACF,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,YAAY,GACZ,iCAAiC,CAAC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEN,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,eAAe,EAAE,sBAAsB,CAAC;IACxC,UAAU,EAAE,iBAAiB,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAClC,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,KAAK,EAAE;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,qBAAqB,CAAC;KACnC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,KAAK,EAAE;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B"}
+{"version":3,"file":"catalog-contracts.d.ts","sourceRoot":"","sources":["../src/catalog-contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AACnE,MAAM,MAAM,mBAAmB,GAC3B,UAAU,GACV,SAAS,GACT,aAAa,GACb,YAAY,CAAC;AACjB,MAAM,MAAM,gBAAgB,GACxB,MAAM,GACN,UAAU,GACV,OAAO,GACP,OAAO,GACP,cAAc,GACd,gBAAgB,CAAC;AAErB,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,mBAAmB,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAC1C;AAED,oFAAoF;AACpF,UAAU,6BAA6B;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AACD,MAAM,MAAM,6BAA6B,GAAG,6BAA6B,GACvE,CACI;IACE,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC/B,SAAS,EACL,iBAAiB,GACjB,iBAAiB,GACjB,yEAAyE,CAAC;IAC9E,WAAW,EACP;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACzC;QAAE,MAAM,EAAE,oBAAoB,CAAA;KAAE,GAChC;QAAE,MAAM,EAAE,YAAY,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD,GACD;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,kFAAkF;IAClF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE;QACX,MAAM,EAAE,gBAAgB,CAAC;QACzB,MAAM,EAAE,sBAAsB,GAAG,2BAA2B,CAAC;KAC9D,CAAC;CACH,CACJ,CAAC;AACJ,MAAM,MAAM,oCAAoC,GAC5C;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,UAAU,GAAG,QAAQ,CAAA;CAAE,GACtD;IACE,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EACF,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,YAAY,GACZ,iCAAiC,CAAC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEN,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,eAAe,EAAE,sBAAsB,CAAC;IACxC,UAAU,EAAE,iBAAiB,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAClC,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,KAAK,EAAE;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,qBAAqB,CAAC;KACnC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,KAAK,EAAE;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B"}

package/dist/catalog-materialization-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-materialization-service.d.ts","sourceRoot":"","sources":["../src/catalog-materialization-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,KAAK,EAAgB,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CACT,UAAU,EAAE,MAAM,GACjB,OAAO,CACR,CAAC,mBAAmB,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,GAAG,SAAS,CAC7E,CAAC;IACF,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;CACnD;AAED,uGAAuG;AACvG,MAAM,WAAW,6BAA6B;IAC5C,kBAAkB,CAAC,KAAK,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,wBAAwB,CAAC;QACtC,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CACJ,KAAK,EAAE,cAAc,GAAG;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACjE,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,iGAAiG;AACjG,MAAM,MAAM,gCAAgC,GAAG,CAAC,KAAK,EAAE;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,MAAM,EAAE,+BAA+B,CAAC;CACzC,KAAK,OAAO,CAAC,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAAC;AAExE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAeD,6EAA6E;AAC7E,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED,+EAA+E;AAC/E,qBAAa,6BAA6B;IAEtC,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBALN,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,2BAA2B,EAClC,OAAO,EAAE,6BAA6B,EACtC,OAAO,EAAE,qBAAqB,GAAG,SAAS,EAC1C,SAAS,EAAE,gCAAgC,EAC3C,MAAM,gBAAsB;IAGzC,WAAW,CACf,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,4BAA4B,CAAC;CA6KzC"}
+{"version":3,"file":"catalog-materialization-service.d.ts","sourceRoot":"","sources":["../src/catalog-materialization-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,KAAK,EAAgB,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CACT,UAAU,EAAE,MAAM,GACjB,OAAO,CACR,CAAC,mBAAmB,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,GAAG,SAAS,CAC7E,CAAC;IACF,cAAc,CAAC,KAAK,EAAE;QACpB,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;CACnD;AAED,uGAAuG;AACvG,MAAM,WAAW,6BAA6B;IAC5C,kBAAkB,CAAC,KAAK,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,wBAAwB,CAAC;QACtC,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CACJ,KAAK,EAAE,cAAc,GAAG;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACjE,OAAO,CAAC;QACT,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,iGAAiG;AACjG,MAAM,MAAM,gCAAgC,GAAG,CAAC,KAAK,EAAE;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,MAAM,EAAE,+BAA+B,CAAC;CACzC,KAAK,OAAO,CAAC,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAAC;AAExE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAeD,6EAA6E;AAC7E,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED,+EAA+E;AAC/E,qBAAa,6BAA6B;IAEtC,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBALN,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,2BAA2B,EAClC,OAAO,EAAE,6BAA6B,EACtC,OAAO,EAAE,qBAAqB,GAAG,SAAS,EAC1C,SAAS,EAAE,gCAAgC,EAC3C,MAAM,gBAAsB;IAGzC,WAAW,CACf,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,4BAA4B,CAAC;CA+KzC"}

package/dist/catalog-policy.d.ts

@@ -1,10 +1,20 @@
 import type { CatalogActor, CatalogOperation, CatalogSourceRecord } from './catalog-contracts.js';
 export interface CatalogPolicyDecision {
     allowed: boolean;
-    reason?: 'teacher-material' | 'unverified-license' | 'operation-not-permitted';
+    reason?: 'teacher-material' | 'operator-only' | 'unverified-license' | 'operation-not-permitted';
+}
+export interface CatalogPolicyOptions {
+    /**
+     * Tenants (families) designated by the host operator that may see `operator`
+     * visibility records. Host configuration, never derived from a request; the
+     * default is none, so operator-only records are invisible to everyone.
+     */
+    operatorTenantIds?: Iterable<string>;
 }
 /** Server-side resource policy. UI affordances are advisory and cannot bypass it. */
 export declare class CatalogPolicy {
+    private readonly operatorTenants;
+    constructor(options?: CatalogPolicyOptions);
     canView(record: Pick<CatalogSourceRecord, 'visibility'>, actor: CatalogActor): boolean;
     authorize(record: Pick<CatalogSourceRecord, 'visibility' | 'licenseEvidence'>, operation: CatalogOperation, actor: CatalogActor): CatalogPolicyDecision;
     private isVerified;

package/dist/catalog-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-policy.d.ts","sourceRoot":"","sources":["../src/catalog-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EAEZ,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EACH,kBAAkB,GAClB,oBAAoB,GACpB,yBAAyB,CAAC;CAC/B;AAED,qFAAqF;AACrF,qBAAa,aAAa;IACxB,OAAO,CACL,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC,EAC/C,KAAK,EAAE,YAAY,GAClB,OAAO;IAIV,SAAS,CACP,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,YAAY,GAAG,iBAAiB,CAAC,EACnE,SAAS,EAAE,gBAAgB,EAC3B,KAAK,EAAE,YAAY,GAClB,qBAAqB;IAWxB,OAAO,CAAC,UAAU;CAGnB"}
+{"version":3,"file":"catalog-policy.d.ts","sourceRoot":"","sources":["../src/catalog-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EAEZ,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EACH,kBAAkB,GAClB,eAAe,GACf,oBAAoB,GACpB,yBAAyB,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,qFAAqF;AACrF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;gBAC1C,OAAO,GAAE,oBAAyB;IAQ9C,OAAO,CACL,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,YAAY,CAAC,EAC/C,KAAK,EAAE,YAAY,GAClB,OAAO;IASV,SAAS,CACP,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,YAAY,GAAG,iBAAiB,CAAC,EACnE,SAAS,EAAE,gBAAgB,EAC3B,KAAK,EAAE,YAAY,GAClB,qBAAqB;IAiBxB,OAAO,CAAC,UAAU;CAGnB"}

package/dist/catalog-preview.d.ts

@@ -1,4 +1,5 @@
 import type { CatalogActor, CatalogSourceRecord } from './catalog-contracts.js';
+import { CatalogPolicy } from './catalog-policy.js';
 /** Publisher preview permission is independent of original-resource permissions. */
 export interface CatalogPreview {
     providerId: 'illustrative-mathematics';
@@ -51,9 +52,13 @@ export interface CatalogPreviewLoader {
 export declare class CatalogPreviewService {
     private readonly store;
     private readonly loader;
+    /** Host policy carrying the operator families; the default shows operator records to nobody. */
+    private readonly policy;
     private readonly cache;
     private cacheBytes;
-    constructor(store: CatalogPreviewStore, loader: CatalogPreviewLoader);
+    constructor(store: CatalogPreviewStore, loader: CatalogPreviewLoader, 
+    /** Host policy carrying the operator families; the default shows operator records to nobody. */
+    policy?: CatalogPolicy);
     serve(input: {
         actor: CatalogActor;
         resourceId: string;

package/dist/catalog-preview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-preview.d.ts","sourceRoot":"","sources":["../src/catalog-preview.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGhF,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,0BAA0B,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,WAAW,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE;QACN,KAAK,EAAE,UAAU,CAAC;QAClB,UAAU,EAAE,WAAW,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,eAAO,MAAM,yBAAyB,QAAkB,CAAC;AACzD,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAElD,oFAAoF;AACpF,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,GACb,cAAc,GAAG,SAAS,CAgF5B;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,IAAI,CACV,mBAAmB,EACnB,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CACnD,EACD,GAAG,SAAa,GACf,cAAc,GAAG,SAAS,CAS5B;AAED,yFAAyF;AACzF,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,UAAU,GAAG;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAqFA;AAED,MAAM,WAAW,mBAAmB;IAClC,6FAA6F;IAC7F,WAAW,CACT,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GAClB,OAAO,CACN,CAAC,mBAAmB,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,GACnE,SAAS,CACZ,CAAC;IACF,uGAAuG;IACvG,SAAS,CACP,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,mBAAmB,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AACD,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC3D;AAED,uGAAuG;AACvG,qBAAa,qBAAqB;IAO9B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAGlB;IACJ,OAAO,CAAC,UAAU,CAAK;gBAEJ,KAAK,EAAE,mBAAmB,EAC1B,MAAM,EAAE,oBAAoB;IAGzC,KAAK,CAAC,KAAK,EAAE;QACjB,KAAK,EAAE,YAAY,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,QAAQ,CAAC;CA8FtB"}
+{"version":3,"file":"catalog-preview.d.ts","sourceRoot":"","sources":["../src/catalog-preview.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,0BAA0B,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,WAAW,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE;QACN,KAAK,EAAE,UAAU,CAAC;QAClB,UAAU,EAAE,WAAW,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,eAAO,MAAM,yBAAyB,QAAkB,CAAC;AACzD,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAElD,oFAAoF;AACpF,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,GACb,cAAc,GAAG,SAAS,CAgF5B;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,IAAI,CACV,mBAAmB,EACnB,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CACnD,EACD,GAAG,SAAa,GACf,cAAc,GAAG,SAAS,CAS5B;AAED,yFAAyF;AACzF,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,UAAU,GAAG;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAqFA;AAED,MAAM,WAAW,mBAAmB;IAClC,6FAA6F;IAC7F,WAAW,CACT,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GAClB,OAAO,CACN,CAAC,mBAAmB,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,GACnE,SAAS,CACZ,CAAC;IACF,uGAAuG;IACvG,SAAS,CACP,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,mBAAmB,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AACD,MAAM,WAAW,oBAAoB;IACnC,4FAA4F;IAC5F,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC3D;AAED,uGAAuG;AACvG,qBAAa,qBAAqB;IAO9B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,gGAAgG;IAChG,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAGlB;IACJ,OAAO,CAAC,UAAU,CAAK;gBAEJ,KAAK,EAAE,mBAAmB,EAC1B,MAAM,EAAE,oBAAoB;IAC7C,gGAAgG;IAC/E,MAAM,GAAE,aAAmC;IAGxD,KAAK,CAAC,KAAK,EAAE;QACjB,KAAK,EAAE,YAAY,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,QAAQ,CAAC;CA8FtB"}

package/dist/chunks/course-authoring-contracts-C4Hqba-e.js

@@ -0,0 +1,131 @@
+//#region src/course-authoring-contracts.ts
+var COURSE_AUTHORING_ACTIONS = [
+	"education.course.read-draft",
+	"education.course.author",
+	"education.course.generate",
+	"education.course.review",
+	"education.course.release",
+	"education.course.assign",
+	"education.course.archive",
+	"education.course.set-visibility",
+	"education.course.set-cover"
+];
+var COURSE_PROVENANCES = [
+	"supplied",
+	"generated",
+	"edited",
+	"extracted"
+];
+var MAX_PAGE_SIZE = 100;
+var DEFAULT_PAGE_SIZE = 50;
+var CourseAuthoringError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = new.target.name;
+	}
+	code;
+};
+var CourseAuthoringAuthorizationError = class extends CourseAuthoringError {
+	constructor() {
+		super("not-authorized", "Course authoring access is not authorized.");
+	}
+};
+var CourseAuthoringValidationError = class extends CourseAuthoringError {
+	constructor(message) {
+		super("invalid-request", message);
+	}
+};
+var CourseNotFoundError = class extends CourseAuthoringError {
+	constructor() {
+		super("course-not-found", "Course was not found.");
+	}
+};
+var CourseDiscardedError = class extends CourseAuthoringError {
+	constructor() {
+		super("course-discarded", "Course draft was discarded.");
+	}
+};
+var CourseArchivedError = class extends CourseAuthoringError {
+	constructor() {
+		super("course-archived", "Course is archived; unarchive it first.");
+	}
+};
+var CourseAppendRefusedError = class extends CourseAuthoringError {
+	constructor(reason) {
+		super("append-refused", `Lesson append refused: ${reason}.`);
+		this.reason = reason;
+	}
+	reason;
+};
+var CourseStaleHeadError = class extends CourseAuthoringError {
+	constructor(currentHeadRevisionId) {
+		super("stale-head", "The draft head moved; reload and retry.");
+		this.currentHeadRevisionId = currentHeadRevisionId;
+	}
+	currentHeadRevisionId;
+};
+var CoursePolicyBasisMismatchError = class extends CourseAuthoringError {
+	constructor() {
+		super("policy-basis-mismatch", "The supplied policy basis differs from the one the authorizer relied on.");
+	}
+};
+var CourseRequestKeyConflictError = class extends CourseAuthoringError {
+	constructor() {
+		super("request-key-conflict", "The request key was already used for a different request.");
+	}
+};
+var ReviewGateRequiredError = class extends CourseAuthoringError {
+	constructor() {
+		super("review-gate-required", "Release requires a configured review gate; none is configured.");
+	}
+};
+var ReviewNotCurrentError = class extends CourseAuthoringError {
+	constructor(reason) {
+		super("review-not-current", "Release requires a current review of this exact revision.");
+		this.reason = reason;
+	}
+	reason;
+};
+var CourseRevisionAlreadyReleasedError = class extends CourseAuthoringError {
+	constructor(releaseId) {
+		super("revision-already-released", "This revision is already released.");
+		this.releaseId = releaseId;
+	}
+	releaseId;
+};
+var CourseDiscardRefusedError = class extends CourseAuthoringError {
+	constructor(references) {
+		super("discard-refused", "Only drafts with no release, enrollment, attempt, review or variant can be discarded.");
+		this.references = references;
+	}
+	references;
+};
+var EnrollmentPinConflictError = class extends CourseAuthoringError {
+	constructor(message = "Enrollment pin request conflicts with current state.") {
+		super("enrollment-pin-conflict", message);
+	}
+};
+var CourseMaterialCopyError = class extends CourseAuthoringError {
+	constructor(message = "Course material could not be copied to an owned asset.") {
+		super("material-copy-failed", message);
+	}
+};
+var CourseVisibilityRefusedError = class extends CourseAuthoringError {
+	constructor(visibility) {
+		super("visibility-refused", "A personal-use course can only be family-visible.");
+		this.visibility = visibility;
+	}
+	visibility;
+};
+var CourseCoverInvalidError = class extends CourseAuthoringError {
+	constructor(reason) {
+		super("cover-invalid", "The cover must be a readable education-owned image.");
+		this.reason = reason;
+	}
+	reason;
+};
+//#endregion
+export { ReviewNotCurrentError as S, CourseVisibilityRefusedError as _, CourseAuthoringAuthorizationError as a, MAX_PAGE_SIZE as b, CourseCoverInvalidError as c, CourseMaterialCopyError as d, CourseNotFoundError as f, CourseStaleHeadError as g, CourseRevisionAlreadyReleasedError as h, CourseArchivedError as i, CourseDiscardRefusedError as l, CourseRequestKeyConflictError as m, COURSE_PROVENANCES as n, CourseAuthoringError as o, CoursePolicyBasisMismatchError as p, CourseAppendRefusedError as r, CourseAuthoringValidationError as s, COURSE_AUTHORING_ACTIONS as t, CourseDiscardedError as u, DEFAULT_PAGE_SIZE as v, ReviewGateRequiredError as x, EnrollmentPinConflictError as y };
+
+//# sourceMappingURL=course-authoring-contracts-C4Hqba-e.js.map

package/dist/chunks/course-authoring-contracts-C4Hqba-e.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"course-authoring-contracts-C4Hqba-e.js","names":[],"sources":["../../src/course-authoring-contracts.ts"],"sourcesContent":["import type { DatabaseInterface } from '@happyvertical/sql';\nimport type {\n  CourseLicenseKind,\n  CourseModality,\n  CourseVisibility,\n} from './catalog.js';\nimport type {\n  LessonAssetRelationship,\n  MaterialAudience,\n} from './lesson-assets.js';\nimport type {\n  LessonLayoutParams,\n  LessonQuestionRefInput,\n} from './question-contracts.js';\n\n/** Authorizer actions. The host maps roles; the service never infers a role. */\nexport type CourseAuthoringAction =\n  | 'education.course.read-draft'\n  | 'education.course.author'\n  | 'education.course.generate'\n  | 'education.course.review'\n  | 'education.course.release'\n  | 'education.course.assign'\n  | 'education.course.archive'\n  | 'education.course.set-visibility'\n  | 'education.course.set-cover';\n\nexport const COURSE_AUTHORING_ACTIONS: readonly CourseAuthoringAction[] = [\n  'education.course.read-draft',\n  'education.course.author',\n  'education.course.generate',\n  'education.course.review',\n  'education.course.release',\n  'education.course.assign',\n  'education.course.archive',\n  'education.course.set-visibility',\n  'education.course.set-cover',\n];\n\n/** Which service operation asked, so a host can deny agents specific operations. */\nexport type CourseAuthoringOperation =\n  | 'create'\n  | 'save-draft'\n  | 'append-lesson'\n  | 'read-draft'\n  | 'release'\n  | 'archive'\n  | 'unarchive'\n  | 'set-visibility'\n  | 'set-cover'\n  | 'discard'\n  | 'pin-enrollment'\n  | 'upgrade-enrollment'\n  | 'set-auto-upgrade'\n  | 'auto-upgrade'\n  | 'read-enrollment'\n  | 'create-question'\n  | 'save-question'\n  | 'read-question'\n  | 'resolve-question-revisions'\n  | 'create-objective'\n  | 'save-objective'\n  | 'link-objectives'\n  | 'read-worksheet'\n  | 'request-generation'\n  | 'run-generation'\n  | 'cancel-generation'\n  | 'accept-proposal'\n  | 'read-generation'\n  | 'record-review'\n  | 'read-review'\n  | 'resolve-finding'\n  | 'note-context-change'\n  | 'list-courses'\n  | 'list-upgrade-choices'\n  | 'list-auto-upgrade-skips'\n  | 'read-released-lesson'\n  | 'attach-printable'\n  | 'preserve-question-extraction'\n  | 'read-question-extraction'\n  | 'apply-question-extraction'\n  | 'import-course-bundle'\n  | 'read-course-bundle'\n  | 'retry-course-bundle-rendering'\n  | 'apply-course-bundle-materials';\n\n/** Trusted identity supplied by the host session, never by a browser form. */\nexport interface CourseAuthoringActor {\n  tenantId: string;\n  actorUserId: string;\n  /** Agent calls: the guardian whose delegation the host re-validates per check. */\n  delegatingGuardianUserId?: string;\n  /**\n   * Host-supplied opaque delegation id (1-200 printable characters), required\n   * with, and only with, `delegatingGuardianUserId`. Recorded on every decision\n   * and passed to every authorizer call; it grants nothing by itself.\n   */\n  delegationId?: string;\n}\n\n/**\n * A richer authorizer answer. `reason` (at most 200 characters) and `code` (a\n * short token, at most 64 characters of `[a-z0-9._-]`) are recorded on an\n * auto-upgrade skip when `allowed` is false; invalid values are dropped, never\n * thrown. A plain `boolean` stays valid everywhere.\n */\nexport interface CourseAuthorizationDecision {\n  allowed: boolean;\n  reason?: string;\n  code?: string;\n  /**\n   * `education.course.assign` only: the assignment-setting value the host relied\n   * on (1-200 printable characters). It becomes the recorded policy basis for pin,\n   * upgrade and opt-in rows, replacing the caller-supplied one; if the caller also\n   * sent one it must be equal (`CoursePolicyBasisMismatchError`). Ignored for other\n   * actions. An invalid value is a validation error and nothing is written.\n   */\n  policyBasis?: string;\n}\n\n/** Result of a host delegation check; a bare boolean is accepted as well. */\nexport type CourseDelegationDecision =\n  | boolean\n  | { allowed: boolean; reason?: string; code?: string };\n\n/**\n * Host port that verifies a delegation (the agent may act for the guardian under\n * this id) on the supplied transaction executor. Without it every delegated\n * request is refused; it runs before the host authorizer and never grants by\n * itself.\n */\nexport type CourseDelegationVerifier = (\n  executor: DatabaseInterface,\n  request: {\n    tenantId: string;\n    actorUserId: string;\n    delegatingGuardianUserId: string;\n    delegationId: string;\n    action: CourseAuthoringAction;\n    operation: CourseAuthoringOperation;\n    courseId?: string;\n    enrollmentId?: string;\n    learnerId?: string;\n    /** Pin and upgrade only: the target release and its materialized course. */\n    releaseId?: string;\n    releaseCourseId?: string;\n  },\n) => CourseDelegationDecision | Promise<CourseDelegationDecision>;\n\nexport type CourseAuthoringAuthorizer = (\n  request: CourseAuthoringActor & {\n    action: CourseAuthoringAction;\n    operation: CourseAuthoringOperation;\n    /** The active service executor; host policy reads must share its transaction. */\n    executor: DatabaseInterface;\n    courseId?: string;\n    enrollmentId?: string;\n    learnerId?: string;\n    /** Pin and upgrade only: the target release and its materialized course. */\n    releaseId?: string;\n    releaseCourseId?: string;\n  },\n) =>\n  | boolean\n  | CourseAuthorizationDecision\n  | Promise<boolean | CourseAuthorizationDecision>;\n\nexport type CourseProvenance =\n  | 'supplied'\n  | 'generated'\n  | 'edited'\n  | 'extracted';\nexport const COURSE_PROVENANCES: readonly CourseProvenance[] = [\n  'supplied',\n  'generated',\n  'edited',\n  'extracted',\n];\nexport type CourseLessonType = 'reading' | 'video' | 'worksheet' | 'exercise';\nexport type CourseLessonCompletion = 'attest' | 'submit' | 'score' | 'external';\n\n/** Hook supplied by #4516; the service never treats an absent gate as a pass. */\nexport type ReleaseReviewGate = (\n  executor: DatabaseInterface,\n  request: { tenantId: string; courseId: string; revisionId: string },\n) =>\n  | { current: boolean; reviewId?: string; reason?: string }\n  | Promise<{ current: boolean; reviewId?: string; reason?: string }>;\n\n/** Hook supplied by #4516/variants: report review/variant rows that reference a draft. */\nexport type CourseReferenceGuard = (\n  executor: DatabaseInterface,\n  request: { tenantId: string; courseId: string },\n) =>\n  | { referenced: boolean; kinds?: readonly string[] }\n  | Promise<{ referenced: boolean; kinds?: readonly string[] }>;\n\n/** Copies an upload (for example an ingestion item) to an education-owned asset. */\nexport interface CourseMaterialSource {\n  kind: string;\n  ref: string;\n}\nexport interface CourseMaterialCopyRequest {\n  tenantId: string;\n  actorUserId: string;\n  courseId: string;\n  source: CourseMaterialSource;\n  relationship: LessonAssetRelationship;\n}\nexport interface CourseMaterialCopyPort {\n  /** Must return an asset owned by the same tenant, independent of the source's expiry. */\n  copy(\n    executor: DatabaseInterface,\n    request: CourseMaterialCopyRequest,\n  ): Promise<{ assetId: string }>;\n}\n\nexport interface CourseMaterialInput {\n  /** Uploaded material to copy; mutually exclusive with `assetId`. */\n  source?: CourseMaterialSource;\n  /** Reuse an asset already copied into this course by an earlier revision. */\n  assetId?: string;\n  relationship: LessonAssetRelationship;\n  licenseKind?: CourseLicenseKind;\n  /** Who it is for; omitted means the role default (`LESSON_ASSET_DEFAULT_AUDIENCE`). */\n  audience?: MaterialAudience;\n}\nexport interface CourseMaterialView {\n  assetId: string;\n  relationship: LessonAssetRelationship;\n  /** Stated audience; absent means the role default. */\n  audience?: MaterialAudience;\n  licenseKind: CourseLicenseKind;\n  provenance: {\n    source: CourseMaterialSource | null;\n    copiedAt: string;\n    copiedByUserId: string;\n  };\n}\n\nexport interface CourseLessonInput {\n  /** Stable cross-version identity; omit for a new lesson. */\n  lessonKey?: string;\n  title: string;\n  body?: string;\n  lessonType?: CourseLessonType;\n  completionRule?: CourseLessonCompletion;\n  estimatedMinutes?: number;\n  difficulty?: number;\n  modality?: CourseModality;\n  externalRef?: string;\n  externalUrl?: string;\n  licenseKind?: CourseLicenseKind;\n  provenance?: CourseProvenance;\n  fieldProvenance?: Record<string, CourseProvenance>;\n  materials?: CourseMaterialInput[];\n  /** Ordered immutable question revisions; each must exist in this tenant. */\n  questions?: LessonQuestionRefInput[];\n  /** Flat render parameters folded into the worksheet version id. */\n  layoutParams?: LessonLayoutParams;\n}\nexport interface CourseSectionInput {\n  sectionKey: string;\n  title: string;\n  lessons: CourseLessonInput[];\n}\nexport interface CourseDraftInput {\n  title: string;\n  summary?: string;\n  subject?: string;\n  theme?: string;\n  levelMin?: number;\n  levelMax?: number;\n  objectives?: string[];\n  sections: CourseSectionInput[];\n  provenance: CourseProvenance;\n  fieldProvenance?: Record<string, CourseProvenance>;\n}\n\nexport interface CourseLessonRevisionView {\n  id: string;\n  lessonKey: string;\n  parentRevisionId: string | null;\n  title: string;\n  body: string;\n  lessonType: CourseLessonType;\n  completionRule: CourseLessonCompletion;\n  estimatedMinutes: number;\n  difficulty: number;\n  modality: CourseModality;\n  externalRef: string;\n  externalUrl: string;\n  licenseKind: CourseLicenseKind;\n  provenance: CourseProvenance;\n  fieldProvenance: Record<string, CourseProvenance>;\n  materials: CourseMaterialView[];\n  questions: LessonQuestionRefInput[];\n  layoutParams: LessonLayoutParams;\n}\n/** Alias for hosts: a lesson revision as read by the authoring views. */\nexport type LessonRevisionView = CourseLessonRevisionView;\nexport interface CourseRevisionView {\n  id: string;\n  courseId: string;\n  parentRevisionId: string | null;\n  sequence: number;\n  title: string;\n  summary: string;\n  subject: string;\n  theme: string;\n  levelMin: number;\n  levelMax: number;\n  objectives: string[];\n  licenseKind: CourseLicenseKind;\n  provenance: CourseProvenance;\n  fieldProvenance: Record<string, CourseProvenance>;\n  authorUserId: string;\n  delegatingGuardianUserId: string | null;\n  delegationId: string | null;\n  recordedAt: string;\n  sections: Array<{\n    sectionKey: string;\n    title: string;\n    lessons: CourseLessonRevisionView[];\n  }>;\n}\nexport interface CourseHeadView {\n  courseId: string;\n  /** The expected-head token for the next save. */\n  headRevisionId: string;\n  version: number;\n}\n/** Result of `appendLesson`: the new revision and, unless skipped, its release. */\nexport type CourseAppendLessonView = Readonly<{\n  courseId: string;\n  /** The appended revision; the new draft head. */\n  revisionId: string;\n  version: number;\n  lessonKey: string;\n  /** The release of that revision; null when `release: false` was requested. */\n  release: CourseReleaseView | null;\n}>;\n\nexport type CourseReleaseView = Readonly<{\n  id: string;\n  courseId: string;\n  revisionId: string;\n  releaseNumber: number;\n  releaseCourseId: string;\n  /** The cover snapshotted onto this release; null when the course had none. */\n  coverAssetId: string | null;\n  reviewId: string | null;\n  actorUserId: string;\n  delegatingGuardianUserId: string | null;\n  delegationId: string | null;\n  /** The host setting the release relied on (for example an auto-approve); null if none. */\n  policyBasis: string | null;\n  recordedAt: string;\n  lessons: ReadonlyArray<{\n    lessonKey: string;\n    lessonRevisionId: string;\n    lessonId: string;\n    sectionId: string;\n  }>;\n}>;\nexport type CourseLifecycleState =\n  | 'draft'\n  | 'released'\n  | 'archived'\n  | 'discarded';\nexport type CourseStateView = Readonly<{\n  courseId: string;\n  title: string;\n  state: CourseLifecycleState;\n  licenseKind: CourseLicenseKind;\n  /** Personal-use material makes the course tenant-private and never group-shareable. */\n  groupShareable: boolean;\n  /** `family` unless set otherwise (see `setVisibility`). */\n  visibility: CourseVisibility;\n  /** The education-owned cover image asset, or null (hosts render a fallback). */\n  coverAssetId: string | null;\n  headRevisionId: string | null;\n  releases: ReadonlyArray<{\n    id: string;\n    releaseNumber: number;\n    revisionId: string;\n    releaseCourseId: string;\n  }>;\n}>;\n/** Largest page a list read returns; the default is `DEFAULT_PAGE_SIZE`. */\nexport const MAX_PAGE_SIZE = 100;\nexport const DEFAULT_PAGE_SIZE = 50;\n\n/** Opaque, deterministic pagination: pass back `nextCursor` unchanged. */\nexport interface CoursePageRequest {\n  limit?: number;\n  cursor?: string;\n}\nexport type CoursePage<T> = Readonly<{\n  items: ReadonlyArray<T>;\n  /** Null on the last page. */\n  nextCursor: string | null;\n}>;\n\nexport type CourseArchiveDecisionView = Readonly<{\n  action: 'archive' | 'unarchive';\n  sequence: number;\n  actorUserId: string;\n  delegatingGuardianUserId: string | null;\n  delegationId: string | null;\n  recordedAt: string;\n}>;\n/** One authored course in `listCourses`. */\nexport type CourseSummaryView = Readonly<{\n  courseId: string;\n  title: string;\n  state: CourseLifecycleState;\n  createdAt: string;\n  /**\n   * Effective licence: the most restrictive of the head revision and every release's\n   * materialized course, so a restriction recorded by any release never loosens.\n   * `CourseStateView.licenseKind` reads the head alone and may be looser.\n   */\n  licenseKind: CourseLicenseKind;\n  /**\n   * The group-sharing rule applied to this course: false for personal-use and\n   * false until the course has a release (nothing to share).\n   */\n  groupShareable: boolean;\n  visibility: CourseVisibility;\n  coverAssetId: string | null;\n  /** Number of releases (0 for a draft-only course). */\n  releaseCount: number;\n  /** The draft head; `revisionId` is the expected-head token for the next save. */\n  head: Readonly<{\n    revisionId: string;\n    sequence: number;\n    version: number;\n  }> | null;\n  latestRelease: Readonly<{\n    id: string;\n    revisionId: string;\n    releaseNumber: number;\n    releaseCourseId: string;\n    /** The cover snapshotted onto that release. */\n    coverAssetId: string | null;\n    recordedAt: string;\n  }> | null;\n  archive: Readonly<{\n    archived: boolean;\n    latestDecision: CourseArchiveDecisionView | null;\n  }>;\n}>;\n\nexport type CourseUpgradeChoiceView = Readonly<{\n  id: string;\n  courseId: string;\n  scope: 'course' | 'enrollment';\n  /** Null for a course-level choice. */\n  enrollmentId: string | null;\n  enabled: boolean;\n  kind: 'opt-in' | 'opt-out';\n  sequence: number;\n  actorUserId: string;\n  delegatingGuardianUserId: string | null;\n  delegationId: string | null;\n  policyBasis: string;\n  recordedAt: string;\n}>;\n\nexport type AutoUpgradeSkipView = Readonly<{\n  id: string;\n  enrollmentId: string;\n  learnerId: string;\n  courseId: string;\n  releaseId: string;\n  optInScope: 'course' | 'enrollment';\n  optInActorUserId: string;\n  optInDelegatingGuardianUserId: string | null;\n  optInDelegationId: string | null;\n  policyBasis: string;\n  /** The authorizer's reason when it gave one, else `not-authorized`. */\n  reason: string;\n  /** The authorizer's short code, or an empty string. */\n  code: string;\n  recordedAt: string;\n}>;\n\nexport type EnrollmentPinKind = 'initial' | 'explicit' | 'auto';\nexport type EnrollmentPinView = Readonly<{\n  enrollmentId: string;\n  /** The enrollment's learner, from the enrollment row; hosts never read `enrollments`. */\n  learnerId: string;\n  /** The authored course identity (`AuthoredCourse` id) the pin follows. */\n  courseId: string;\n  releaseId: string;\n  /** The materialized release `Course` id the enrollment is created on. */\n  releaseCourseId: string;\n  releaseNumber: number;\n  kind: EnrollmentPinKind;\n  autoUpgrade: boolean;\n  /** Assignment-setting value the host relied on for the current pin. */\n  policyBasis: string;\n  history: ReadonlyArray<{\n    releaseId: string;\n    releaseCourseId: string;\n    previousReleaseId: string | null;\n    kind: EnrollmentPinKind;\n    sequence: number;\n    actorUserId: string | null;\n    delegatingGuardianUserId: string | null;\n    delegationId: string | null;\n    policyBasis: string;\n    /** For automatic moves: the scope of the opt-in followed. */\n    optInScope: 'course' | 'enrollment' | null;\n    recordedAt: string;\n  }>;\n}>;\n/** Result of `getEnrollmentRelease`; identity fields repeat the pin's for convenience. */\nexport type EnrollmentReleaseView = Readonly<{\n  learnerId: string;\n  courseId: string;\n  releaseCourseId: string;\n  pin: EnrollmentPinView;\n  lessons: EffectiveLessonView[];\n}>;\n/** Result of `setAutoUpgrade`; `learnerId` is null for a course-level choice. */\nexport type SetAutoUpgradeResult = Readonly<{\n  courseId: string;\n  enrollmentId: string | null;\n  learnerId: string | null;\n  enabled: boolean;\n  policyBasis: string;\n}>;\nexport type EffectiveLessonView = Readonly<{\n  lessonKey: string;\n  lessonId: string;\n  releaseId: string;\n  /** True when a started lesson stays on an older release than the current pin. */\n  pinnedToOlderRelease: boolean;\n}>;\n\nexport class CourseAuthoringError extends Error {\n  constructor(\n    readonly code: string,\n    message: string,\n  ) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\nexport class CourseAuthoringAuthorizationError extends CourseAuthoringError {\n  constructor() {\n    super('not-authorized', 'Course authoring access is not authorized.');\n  }\n}\nexport class CourseAuthoringValidationError extends CourseAuthoringError {\n  constructor(message: string) {\n    super('invalid-request', message);\n  }\n}\nexport class CourseNotFoundError extends CourseAuthoringError {\n  constructor() {\n    super('course-not-found', 'Course was not found.');\n  }\n}\nexport class CourseDiscardedError extends CourseAuthoringError {\n  constructor() {\n    super('course-discarded', 'Course draft was discarded.');\n  }\n}\nexport class CourseArchivedError extends CourseAuthoringError {\n  constructor() {\n    super('course-archived', 'Course is archived; unarchive it first.');\n  }\n}\n/**\n * `appendLesson` was refused for the course's state: it has no release yet\n * (`not-released`), its head holds changes that are not released\n * (`unreleased-changes`), or the lesson key or section is already taken\n * (`duplicate-lesson`).\n */\nexport class CourseAppendRefusedError extends CourseAuthoringError {\n  constructor(\n    readonly reason: 'not-released' | 'unreleased-changes' | 'duplicate-lesson',\n  ) {\n    super('append-refused', `Lesson append refused: ${reason}.`);\n  }\n}\nexport class CourseStaleHeadError extends CourseAuthoringError {\n  constructor(readonly currentHeadRevisionId: string) {\n    super('stale-head', 'The draft head moved; reload and retry.');\n  }\n}\n/** The caller and the assign authorizer named different policy bases. */\nexport class CoursePolicyBasisMismatchError extends CourseAuthoringError {\n  constructor() {\n    super(\n      'policy-basis-mismatch',\n      'The supplied policy basis differs from the one the authorizer relied on.',\n    );\n  }\n}\nexport class CourseRequestKeyConflictError extends CourseAuthoringError {\n  constructor() {\n    super(\n      'request-key-conflict',\n      'The request key was already used for a different request.',\n    );\n  }\n}\nexport class ReviewGateRequiredError extends CourseAuthoringError {\n  constructor() {\n    super(\n      'review-gate-required',\n      'Release requires a configured review gate; none is configured.',\n    );\n  }\n}\nexport class ReviewNotCurrentError extends CourseAuthoringError {\n  constructor(readonly reason?: string) {\n    super(\n      'review-not-current',\n      'Release requires a current review of this exact revision.',\n    );\n  }\n}\nexport class CourseRevisionAlreadyReleasedError extends CourseAuthoringError {\n  constructor(readonly releaseId: string) {\n    super('revision-already-released', 'This revision is already released.');\n  }\n}\nexport class CourseDiscardRefusedError extends CourseAuthoringError {\n  constructor(readonly references: readonly string[]) {\n    super(\n      'discard-refused',\n      'Only drafts with no release, enrollment, attempt, review or variant can be discarded.',\n    );\n  }\n}\nexport class EnrollmentPinConflictError extends CourseAuthoringError {\n  constructor(\n    message = 'Enrollment pin request conflicts with current state.',\n  ) {\n    super('enrollment-pin-conflict', message);\n  }\n}\nexport class CourseMaterialCopyError extends CourseAuthoringError {\n  constructor(\n    message = 'Course material could not be copied to an owned asset.',\n  ) {\n    super('material-copy-failed', message);\n  }\n}\n\n/** Result of `setVisibility`/`setCover`: the course state after the (maybe unchanged) write. */\nexport type CourseVisibilityResult = CourseStateView;\nexport type CourseCoverResult = CourseStateView;\n\n/** A personal-use-copy course can never be shared with groups or listed publicly. */\nexport class CourseVisibilityRefusedError extends CourseAuthoringError {\n  constructor(readonly visibility: CourseVisibility) {\n    super(\n      'visibility-refused',\n      'A personal-use course can only be family-visible.',\n    );\n  }\n}\n/** The cover asset is missing, foreign, not an image, an answer key or unreadable. */\nexport class CourseCoverInvalidError extends CourseAuthoringError {\n  constructor(readonly reason: string) {\n    super(\n      'cover-invalid',\n      'The cover must be a readable education-owned image.',\n    );\n  }\n}\n"],"mappings":";AA2BO,IAAM,2BAA6D;CACxE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAuIO,IAAM,qBAAkD;CAC7D;CACA;CACA;CACA;AACF;AAqNO,IAAM,gBAAgB;AACtB,IAAM,oBAAoB;AAuJ1B,IAAM,uBAAN,cAAmC,MAAM;CAC9C,YACW,MACT,SACA;EACA,MAAM,OAAO;EAHJ,KAAA,OAAA;EAIT,KAAK,OAAO,IAAA,OAAW;CACzB;CALW;AAMb;AACO,IAAM,oCAAN,cAAgD,qBAAqB;CAC1E,cAAc;EACZ,MAAM,kBAAkB,4CAA4C;CACtE;AACF;AACO,IAAM,iCAAN,cAA6C,qBAAqB;CACvE,YAAY,SAAiB;EAC3B,MAAM,mBAAmB,OAAO;CAClC;AACF;AACO,IAAM,sBAAN,cAAkC,qBAAqB;CAC5D,cAAc;EACZ,MAAM,oBAAoB,uBAAuB;CACnD;AACF;AACO,IAAM,uBAAN,cAAmC,qBAAqB;CAC7D,cAAc;EACZ,MAAM,oBAAoB,6BAA6B;CACzD;AACF;AACO,IAAM,sBAAN,cAAkC,qBAAqB;CAC5D,cAAc;EACZ,MAAM,mBAAmB,yCAAyC;CACpE;AACF;AAOO,IAAM,2BAAN,cAAuC,qBAAqB;CACjE,YACW,QACT;EACA,MAAM,kBAAkB,0BAA0B,OAAM,EAAG;EAFlD,KAAA,SAAA;CAGX;CAHW;AAIb;AACO,IAAM,uBAAN,cAAmC,qBAAqB;CAC7D,YAAqB,uBAA+B;EAClD,MAAM,cAAc,yCAAyC;EAD1C,KAAA,wBAAA;CAErB;CAFqB;AAGvB;AAEO,IAAM,iCAAN,cAA6C,qBAAqB;CACvE,cAAc;EACZ,MACE,yBACA,0EACF;CACF;AACF;AACO,IAAM,gCAAN,cAA4C,qBAAqB;CACtE,cAAc;EACZ,MACE,wBACA,2DACF;CACF;AACF;AACO,IAAM,0BAAN,cAAsC,qBAAqB;CAChE,cAAc;EACZ,MACE,wBACA,gEACF;CACF;AACF;AACO,IAAM,wBAAN,cAAoC,qBAAqB;CAC9D,YAAqB,QAAiB;EACpC,MACE,sBACA,2DACF;EAJmB,KAAA,SAAA;CAKrB;CALqB;AAMvB;AACO,IAAM,qCAAN,cAAiD,qBAAqB;CAC3E,YAAqB,WAAmB;EACtC,MAAM,6BAA6B,oCAAoC;EADpD,KAAA,YAAA;CAErB;CAFqB;AAGvB;AACO,IAAM,4BAAN,cAAwC,qBAAqB;CAClE,YAAqB,YAA+B;EAClD,MACE,mBACA,uFACF;EAJmB,KAAA,aAAA;CAKrB;CALqB;AAMvB;AACO,IAAM,6BAAN,cAAyC,qBAAqB;CACnE,YACE,UAAU,wDACV;EACA,MAAM,2BAA2B,OAAO;CAC1C;AACF;AACO,IAAM,0BAAN,cAAsC,qBAAqB;CAChE,YACE,UAAU,0DACV;EACA,MAAM,wBAAwB,OAAO;CACvC;AACF;AAOO,IAAM,+BAAN,cAA2C,qBAAqB;CACrE,YAAqB,YAA8B;EACjD,MACE,sBACA,mDACF;EAJmB,KAAA,aAAA;CAKrB;CALqB;AAMvB;AAEO,IAAM,0BAAN,cAAsC,qBAAqB;CAChE,YAAqB,QAAgB;EACnC,MACE,iBACA,qDACF;EAJmB,KAAA,SAAA;CAKrB;CALqB;AAMvB"}