@happyvertical/smrt-education 0.58.0 → 0.59.0

package/dist/smrt-knowledge.json

@@ -3,13 +3,13 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-education",
-  "packageVersion": "0.58.0",
+  "packageVersion": "0.59.0",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "75b8165b6abf95186fad6f02c6dbbe42c121520c2317621c6013426ad64ca0e3",
-    "packageJson": "0f19188d8f43c8cc001d6f752dbdfac617e1f4a06616cfc950e6c8909bebb6b1",
-    "agents": "2bce7f0cbfc77e210c15341ccca74da23ec63cc3e826c5fee1fc03c7bf640db6",
+    "manifest": "d6abefb071a665c56641e46b012dde1de313bfbb6076f81d384150211ac8a8db",
+    "packageJson": "f0aa70daa555aa2ad3935a7bc01a8ff3652d233d8c9ccf65fa4a2cdf89e53dc4",
+    "agents": "6f6c8fbb6bd5e2fa28c992987c889d7cc3b067566f1415863228908494a57ca3",
     "moduleDoc:agents/lesson-materials.md": "f103812b0f5ebfda446747ae9e4d7a97254e22b12aebc2ec43a865c5bd56e56a",
     "moduleDoc:agents/learner-service.md": "d7edf68000aec96b52920fb5e8dc4ff4e20b1d81b34413809e8212a885e1c3f9",
     "moduleDoc:agents/submission-service.md": "0bb827a62848a3e0708fe2545eac7b64f829a6c9be96eee849c8f16c1fa631d0",
@@ -20,7 +20,8 @@
     "moduleDoc:agents/course-generation-review.md": "7f6d5e67ed56ec9923bd00df05650b363fb0db30c1b1f004c8b203f9c62cd117",
     "moduleDoc:agents/question-records.md": "c1648cccc27ed46b1b60cded93b20c7f3812cbcd2c37f183fd727ac030364703",
     "moduleDoc:agents/question-extraction.md": "75972dda9b2f837471fb42f963ef143a098005c919a1a49db7ce395a5e5e50a7",
-    "moduleDoc:agents/course-bundle-import.md": "4ae9ec59d1ad91cbd7019f73cf38dd788cdd28375c8964c3b08b91feddfc5086",
+    "moduleDoc:agents/course-bundle-import.md": "9829211a6af7f600ea41a4143b4355b510bcb04c720d4b1011d3d98845c08377",
+    "moduleDoc:agents/class-crunchlabs.md": "3ce60bed13802d482fa7ba330363c6bed2c777eff803cdca6429330722ed63a8",
     "moduleDoc:agents/source-import.md": "30ee823589d655442bcf1abcd86a2132172065b4bc5e3c4d89b1e8b7afcc66bc",
     "moduleDoc:agents/family-intake.md": "540b6d37f438496acb0208b6ac7258264e2142bce3d2f986967b7741606fe4f7",
     "moduleDoc:agents/catalog-previews.md": "5f4e0352274009b3ce00408017a16666036d24df695a7078c27317ba4e66f0a7",
@@ -32,7 +33,8 @@
     ".",
     "./ingestion",
     "./manifest",
-    "./manifest.json"
+    "./manifest.json",
+    "./node"
   ],
   "dependencies": {
     "@happyvertical/smrt-assets": "workspace:*",
@@ -5283,6 +5285,12 @@
           "required": false,
           "columnType": "TEXT"
         },
+        {
+          "name": "audience",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        },
         {
           "name": "sectionKey",
           "type": "text",
@@ -5394,6 +5402,145 @@
       "tags": [],
       "risks": []
     },
+    {
+      "name": "CourseBundleRendering",
+      "qualifiedName": "@happyvertical/smrt-education:CourseBundleRendering",
+      "collection": "coursebundlerenderings",
+      "description": "Append-only record that a Word/PowerPoint member whose first rendering failed was rendered later by a deliberate retry (SMRT #4615).",
+      "tableName": "course_bundle_renderings",
+      "packageName": "@happyvertical/smrt-education",
+      "extends": "SmrtObject",
+      "fields": [
+        {
+          "name": "tenantId",
+          "type": "text",
+          "required": true,
+          "columnType": "UUID"
+        },
+        {
+          "name": "importId",
+          "type": "foreignKey",
+          "required": true,
+          "related": "CourseBundleImport",
+          "columnType": "UUID"
+        },
+        {
+          "name": "sha256",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "renderedSha256",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "renderedSizeBytes",
+          "type": "integer",
+          "required": true,
+          "columnType": "INTEGER",
+          "default": 0
+        },
+        {
+          "name": "converterId",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "retriedByUserId",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "recordedAt",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        }
+      ],
+      "relationships": [
+        {
+          "name": "importId",
+          "type": "foreignKey",
+          "required": true,
+          "related": "CourseBundleImport",
+          "columnType": "UUID"
+        }
+      ],
+      "methods": [
+        "delete",
+        "save"
+      ],
+      "methodSignatures": [
+        {
+          "name": "delete",
+          "async": true,
+          "returns": "Promise<void>"
+        },
+        {
+          "name": "save",
+          "async": true,
+          "params": [
+            "options?: SmrtSaveOptions"
+          ],
+          "returns": "Promise<this>"
+        }
+      ],
+      "tenant": {
+        "scoped": true,
+        "mode": "required",
+        "field": "tenantId"
+      },
+      "conflictColumns": [
+        "tenant_id",
+        "import_id",
+        "sha256"
+      ],
+      "surfaces": [],
+      "withheldSurfaces": [
+        {
+          "kind": "api",
+          "operation": "delete",
+          "code": "api-disabled",
+          "reason": "api is disabled",
+          "objectName": "@happyvertical/smrt-education:CourseBundleRendering"
+        },
+        {
+          "kind": "api",
+          "operation": "save",
+          "code": "api-disabled",
+          "reason": "api is disabled",
+          "objectName": "@happyvertical/smrt-education:CourseBundleRendering"
+        }
+      ],
+      "relationshipFeatures": [
+        "foreignKey",
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
+    {
+      "name": "CourseBundleRenderingCollection",
+      "qualifiedName": "@happyvertical/smrt-education:CourseBundleRenderingCollection",
+      "collection": "coursebundlerenderings",
+      "tableName": "course_bundle_renderings",
+      "packageName": "@happyvertical/smrt-education",
+      "extends": "SmrtCollection",
+      "fields": [],
+      "relationships": [],
+      "methods": [],
+      "surfaces": [],
+      "relationshipFeatures": [
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
     {
       "name": "CourseGenerationJob",
       "qualifiedName": "@happyvertical/smrt-education:CourseGenerationJob",
@@ -15484,14 +15631,14 @@
   "surfaces": [],
   "prompts": [],
   "relationshipsV2": {
-    "foreignKeyFields": 188,
+    "foreignKeyFields": 189,
     "crossPackageRefFields": 24,
     "junctionCollections": 2,
     "hierarchicalObjects": 0,
     "polymorphicAssociations": 0,
-    "uuidColumns": 794
+    "uuidColumns": 800
   },
-  "agentDoc": "# smrt-education\n\nCatalog objects are optional-tenant scoped and have no generated REST, CLI, MCP,\nor AI surface. Applications use `CatalogService`, supplying their actor-bound\nauthorization decision and the trusted `TenantCollection.withTenantCatalogReadScope`\nadapter from smrt-users. Catalog authorization receives the exact shared collection\nexecutor; live session/permission checks must use that executor. That read scope may widen only an allowlisted catalog\ncollection's `list` to self, ancestors, and globals; it never authorizes a get,\nwrite, raw query, sibling, or descendant read.\n\n`personal-use-copy` courses and all `answer-key`/`assessment-guidance` material\nare private family material. Do not publish them, promote them, or expose them\nthrough a learner-facing result. `LessonAsset` (lesson) and `CourseAsset` (course)\nare the sole owner joins for material files; do not add asset-id fields to lesson\nsubclasses. Material audience rules and external videos: [lesson materials](agents/lesson-materials.md);\na learner never sees guardian-audience material.\n\nLearner objects require exact tenant ownership and close generated surfaces.\n`LearnerService` owns actor/resource authorization and transactional planning and\nstart-progress; see [learner contract](agents/learner-service.md). Guardian\nrelationships require a host decision about their type and effective terms.\nNever expose direct collection writes as learner handlers, reset progress on a\nretry, or treat an unscored nullable decimal as zero.\n\nSubmission capture, guardian grading and private PDF packet splitting use\n`SubmissionService`; see [submission contract](agents/submission-service.md).\nKeep asset metadata on the same transaction and compensate only newly planned\nfiles after rollback; never expose source URIs or accept learner grade patches.\n\nValidation: `pnpm --filter @happyvertical/smrt-education test`,\n`test:postgres`, `typecheck`, and `build`.\n\nEvery lesson hand-in is lesson work (activity, attempt, revisions, release,\ncompletion decision); books are courses with `bookKey`, pages are `LessonPage`s,\nand loose work is placed by filing. Use [LessonWorkService](agents/lesson-work-service.md)\nand the [design record](agents/course-work-design.md); `migrateWorkbooksToCourses`\nis the one-time host migration. Keep provisional sharing separate from guardian\nGrade authority; never move filed work's IDs. Photo-first receipt/context\ncapture uses [WorkbookPhotoService](agents/photo-intake.md); covers/references\nnever create learning evidence, and blank exercises need explicit work intent.\n\nRevisioned authored courses, release, archive, enrollment pins and licence use\n[CourseAuthoringService](agents/course-authoring-service.md). Keep history\nappend-only, require request keys, and never weaken personal-use-copy rules.\n\nGeneration proposals into new draft revisions and revision-bound educational\nreview use [CourseGenerationReviewService](agents/course-generation-review.md).\nKeep supplied content unless a decision is recorded; reviews carry no score.\n\nImmutable questions, answer keys/rubrics, stable learning objectives, worksheet\nrender ids and exact-revision references use [QuestionAuthoringService](agents/question-records.md).\nKeep keys out of learner bundles; a missing key stays null. `attachGeneratedPrintable`\nstores the rendered PDFs; the guardian copy is always an `answer-key`, never `printable`.\n\nStructured questions from scans and imported course files use\n[QuestionExtractionService](agents/question-extraction.md) and the `extract-questions`\ningestion handler. Anchors come from provider region catalogs only; match by worksheet\nid and layout, never text; ambiguous matches stay unattached; source-keyed replays.\n\nCourse bundles (zip with a closed manifest, or a file set; Word/PowerPoint members render through an injected `DocumentConverter`, fail closed) use\n[CourseBundleImportService](agents/course-bundle-import.md). Parse only with the\nbounded reader; refuse, never trim, hostile input; unsupported members stay\nvisible; proposals only, nothing auto-published.\n\nSource import: [host boundary and transaction contract](agents/source-import.md).\n`SourceImportService` requires host opt-in, matching active actor/tenant and\nexplicit licensing authorization; never add a system/global write bypass.\n\nFamily-owned unassigned originals and audited learner adoption use\n[FamilyIntakeService](agents/family-intake.md). Keep family source scope immutable;\nassignment alone never creates learning history or grants learner inbox access.\n\nPublisher catalog previews use [the preview contract](agents/catalog-previews.md).\nKeep independent image rights and source revisions; serve via `CatalogPreviewService`\nwith live actor/tenant authorization, never direct provider image URLs.\n\nEnrollment Plan projections and guardian-only parent notes use\n[the Plan contract](agents/learner-plan.md). Keep awaiting review separate from\nContinue; note authority/provenance never grants learner access or learning evidence.\n\nHomeschool group sharing uses [GroupSharingService](agents/group-sharing.md),\nits read-only reader and revision comment service. Group tenants never become\nfamily ancestors or guardians. Enumerate only the group-owned opaque roster index,\nthen revalidate each exact family edge and current policy. Media delivery must call\nthe reader on every request; signed storage URLs are not a sharing grant. Saved\nparent comment visibility applies on every child read. Progress with feedback\ndisabled contains counts only, never correctness, scores or concept labels.\n\nLearner-safe tutor context and append-only tutor transcripts use\n[TutorContextService and TutorSessionService](agents/tutor-context.md). Learner\naudience never carries keys, rubrics, notes or storage URIs; no AI call here.\n",
+  "agentDoc": "# smrt-education\n\nCatalog objects are optional-tenant scoped and have no generated REST, CLI, MCP,\nor AI surface. Applications use `CatalogService`, supplying their actor-bound\nauthorization decision and the trusted `TenantCollection.withTenantCatalogReadScope`\nadapter from smrt-users. Catalog authorization receives the exact shared collection\nexecutor; live session/permission checks must use that executor. That read scope may widen only an allowlisted catalog\ncollection's `list` to self, ancestors, and globals; it never authorizes a get,\nwrite, raw query, sibling, or descendant read.\n\n`personal-use-copy` courses and all `answer-key`/`assessment-guidance` material\nare private family material. Do not publish them, promote them, or expose them\nthrough a learner-facing result. `LessonAsset` (lesson) and `CourseAsset` (course)\nare the sole owner joins for material files; do not add asset-id fields to lesson\nsubclasses. Material audience rules and external videos: [lesson materials](agents/lesson-materials.md);\na learner never sees guardian-audience material.\n\nLearner objects require exact tenant ownership and close generated surfaces.\n`LearnerService` owns actor/resource authorization and transactional planning and\nstart-progress; see [learner contract](agents/learner-service.md). Guardian\nrelationships require a host decision about their type and effective terms.\nNever expose direct collection writes as learner handlers, reset progress on a\nretry, or treat an unscored nullable decimal as zero.\n\nSubmission capture, guardian grading and private PDF packet splitting use\n`SubmissionService`; see [submission contract](agents/submission-service.md).\nKeep asset metadata on the same transaction and compensate only newly planned\nfiles after rollback; never expose source URIs or accept learner grade patches.\n\nValidation: `pnpm --filter @happyvertical/smrt-education test`,\n`test:postgres`, `typecheck`, and `build`.\n\nEvery lesson hand-in is lesson work (activity, attempt, revisions, release,\ncompletion decision); books are courses with `bookKey`, pages are `LessonPage`s,\nand loose work is placed by filing. Use [LessonWorkService](agents/lesson-work-service.md)\nand the [design record](agents/course-work-design.md); `migrateWorkbooksToCourses`\nis the one-time host migration. Keep provisional sharing separate from guardian\nGrade authority; never move filed work's IDs. Photo-first receipt/context\ncapture uses [WorkbookPhotoService](agents/photo-intake.md); covers/references\nnever create learning evidence, and blank exercises need explicit work intent.\n\nRevisioned authored courses, release, archive, enrollment pins and licence use\n[CourseAuthoringService](agents/course-authoring-service.md). Keep history\nappend-only, require request keys, and never weaken personal-use-copy rules.\n\nGeneration proposals into new draft revisions and revision-bound educational\nreview use [CourseGenerationReviewService](agents/course-generation-review.md).\nKeep supplied content unless a decision is recorded; reviews carry no score.\n\nImmutable questions, answer keys/rubrics, stable learning objectives, worksheet\nrender ids and exact-revision references use [QuestionAuthoringService](agents/question-records.md).\nKeep keys out of learner bundles; a missing key stays null. `attachGeneratedPrintable`\nstores the rendered PDFs; the guardian copy is always an `answer-key`, never `printable`.\n\nStructured questions from scans and imported course files use\n[QuestionExtractionService](agents/question-extraction.md) and the `extract-questions`\ningestion handler. Anchors come from provider region catalogs only; match by worksheet\nid and layout, never text; ambiguous matches stay unattached; source-keyed replays.\n\nCourse bundles (zip with a closed manifest v1 or v2, or a file set; Word/PowerPoint members render through an injected `DocumentConverter`, fail closed; v2 carries material roles, audience, lesson pages, course members and YouTube references) use\n[CourseBundleImportService](agents/course-bundle-import.md). Parse only with the\nbounded reader; refuse, never trim, hostile input; unsupported members stay\nvisible; proposals only, nothing auto-published.\n\nClass CrunchLabs (a download read into a manifest v2 bundle; an operator-only\nglobal catalog provider until the operator's single public switch):\n[source contract](agents/class-crunchlabs.md). Never host its files; `operator`\nvisibility needs the host's `operatorTenantIds`.\n\nSource import: [host boundary and transaction contract](agents/source-import.md).\n`SourceImportService` requires host opt-in, matching active actor/tenant and\nexplicit licensing authorization; never add a system/global write bypass.\n\nFamily-owned unassigned originals and audited learner adoption use\n[FamilyIntakeService](agents/family-intake.md). Keep family source scope immutable;\nassignment alone never creates learning history or grants learner inbox access.\n\nPublisher catalog previews use [the preview contract](agents/catalog-previews.md).\nKeep independent image rights and source revisions; serve via `CatalogPreviewService`\nwith live actor/tenant authorization, never direct provider image URLs.\n\nEnrollment Plan projections and guardian-only parent notes use\n[the Plan contract](agents/learner-plan.md). Keep awaiting review separate from\nContinue; note authority/provenance never grants learner access or learning evidence.\n\nHomeschool group sharing uses [GroupSharingService](agents/group-sharing.md),\nits read-only reader and revision comment service. Group tenants never become\nfamily ancestors or guardians. Enumerate only the group-owned opaque roster index,\nthen revalidate each exact family edge and current policy. Media delivery must call\nthe reader on every request; signed storage URLs are not a sharing grant. Saved\nparent comment visibility applies on every child read. Progress with feedback\ndisabled contains counts only, never correctness, scores or concept labels.\n\nLearner-safe tutor context and append-only tutor transcripts use\n[TutorContextService and TutorSessionService](agents/tutor-context.md). Learner\naudience never carries keys, rubrics, notes or storage URIs; no AI call here.\n",
   "moduleDocs": [
     {
       "path": "agents/lesson-materials.md",
@@ -15546,7 +15693,12 @@
     {
       "path": "agents/course-bundle-import.md",
       "module": "course-bundle-import",
-      "content": "# Course bundle import\n\n`CourseBundleImportService` (SMRT #4578, extends `CourseAuthoringService`,\nconsumed by Hearth #94) imports a course bundle, a zip with an optional manifest\nor a plain file set, as bounded evidence, hands its supported members to the\nhost for ingestion extraction and proposes sections and lessons for review.\nRisk is high: untrusted archive parsing and new schema. It reuses the course\nauthorizer: `importBundle` needs `education.course.author`, `readImport`\n`education.course.read-draft`, `proposeStructure` `education.course.generate`\n(via `CourseGenerationReviewService`). Operations: `import-course-bundle`,\n`read-course-bundle`. Server only (Node `zlib`/`crypto`); no new dependency.\n\n## Flow\n\n1. `importBundle({ ...actor, bundle, limits?, onProgress?, receiveMember? })`\n   authorizes **before parsing**, unpacks (stage `unpack`), classifies and lays\n   out the structure (`classify`), writes the evidence in one transaction and\n   then calls `receiveMember` for each accepted member (`extract`), outside any\n   transaction. `bundle` is `{ archive: Uint8Array }` or `{ files: [{ path,\n   bytes }] }`. Hostile or damaged input throws `CourseBundleRefusedError`\n   (`reason`, optional `entry`) and writes nothing.\n2. `receiveMember(member, { replayed })` is the host's ingestion seam: call\n   `IngestionService.receive` with `sourceKind: 'course_import'` and the member\n   bytes, then queue extraction and `preserveQuestionExtractionAnalysis` as in\n   [question extraction](question-extraction.md). Members carry `role`\n   (manifest page role), `lessonKey`, `sectionKey`. It runs on a replay too\n   (ingestion dedups by content hash), so an interrupted first run resumes. Its\n   return values are in `result.receipts`.\n3. `proposeStructure({ ...actor, importId, bundle, courseId,\n   expectedHeadRevisionId })` (stage `propose`) re-supplies the bundle (bytes\n   are never retained), checks it is the imported one, and runs a deterministic\n   `CourseMaterialGenerator` (`smrt-bundle-import`) through\n   `requestGeneration`/`runGeneration`. The result is an ordinary proposal: a\n   new draft revision of additions and fills; conflicts wait for\n   `decideProposal`. Nothing is released, assigned or published. The request key\n   is `bundle:<courseId>:<bundleIdentity>`, so a retry returns the same job; the\n   same key with another head is `CourseRequestKeyConflictError`.\n4. `readImport({ ...actor, importId })` returns the recorded evidence.\n\nProgress is an observer callback (`onProgress({ stage, completed, total })`,\nstages `unpack`, `classify`, `render`, `extract`, `propose`; each starts at `completed: 0`;\n`render` is emitted only when the bundle has Word/PowerPoint members).\nIngestion has no public job-progress seam, so none is invented. A throwing\nlistener never affects the import.\n\n## Hard bounds (`COURSE_BUNDLE_LIMITS`; a host may only lower them)\n\n| limit | value |\n|---|---|\n| `maxArchiveBytes` (input) | 100 MiB |\n| `maxEntries` | 200 |\n| `maxEntryBytes` (inflated) | 50 MiB |\n| `maxTotalBytes` (inflated) | 200 MiB |\n| `maxCompressionRatio` (members over `ratioFloorBytes` = 64 KiB) | 100 |\n| `maxPathBytes` / `maxSegmentBytes` / `maxPathDepth` | 512 / 255 / 8 |\n| `maxManifestBytes` | 256 KiB |\n| `maxLessons` (the proposal schema's cap) | 50 |\n| `maxLessonBodyChars` | 100 000 |\n| `maxOfficeMembers` (Word/PowerPoint members rendered per bundle) | 50 |\n| `maxRenderedBytes` (PDF accepted back from the converter) | 50 MiB |\n| `conversionTimeoutMs` (one Office member) | 60 000 |\n| archive nesting | 1: a zip inside a zip is never expanded |\n\nA lesson whose combined text members exceed `maxLessonBodyChars` refuses the\nbundle (`lesson_too_large`, `entry` = lesson key) at import; text is never\ntrimmed or dropped. A plain file set enforces `maxTotalBytes` on its member\nbytes exactly as an archive does on inflated bytes.\n\nThe reader (`course-bundle-zip.ts`) parses the end record and central directory,\nvalidates every offset and size against the real buffer, inflates with\n`maxOutputLength` equal to the declared size (declared sizes are never trusted:\na mismatch either way is `size_mismatch`), checks CRC32 and re-checks the total\non actual output. Stored and deflate only. Refusals (`CourseBundleRefusalReason`)\ncover: not a zip, truncated, ambiguous end record (two end records that both fit\nthe file, for example one forged in a comment), zip64, multi-disk, central\ndirectory not ending at the end record, entries out of range or overlapping,\nlocal header name/method mismatch, encrypted entries (flags 0/6/13, AES method),\nsymlink and special files (unix mode; DOS reparse flag), unsupported method,\nbad CRC, ratio, entry count, totals, duplicate names (case/NFC-insensitive,\nbackslashes normalised first) and bad paths (`..`, `.`, empty segments, absolute,\ndrive letter or `:` anywhere, NUL/control/bidi characters, lone surrogates,\ntoo long or deep). An **honestly** oversize member (declared over\n`maxEntryBytes`) is not inflated and is recorded `refused / entry_too_large`.\n\n## Members and statuses\n\nBy content (never by extension alone): `docx`/`pptx` (see below), `pdf` (`%PDF-` in the first 1 KiB),\n`image` (PNG, JPEG, WebP), `text` (`.txt`/`.md`, strict UTF-8, no control\ncharacters, body-sized), `manifest` (root `manifest.json`), else `unsupported`.\nStatus: `accepted` (handed to extraction), `duplicate` (same sha256 as an earlier\nmember in canonical order; recorded once as evidence, `duplicateOfPath`, never\nextracted again), `unsupported` (`unsupported_type`, `nested_archive`,\n`unreadable_text`), `refused` (`encrypted_pdf`, `entry_too_large`), `metadata`\n(the manifest). Nothing is dropped. An encrypted PDF is any PDF with an\n`/Encrypt` token anywhere in its bytes (trailer, xref stream): a false positive\non literal text inside an uncompressed stream is refused, never read.\n\n## Word and PowerPoint members (SMRT #4615)\n\nA `.docx`/`.pptx` member is an OOXML package only when the name and the content\nagree: a zip whose entries include `[Content_Types].xml` and `word/document.xml`\n(docx) or `ppt/presentation.xml` (pptx). Before the bytes go anywhere, the\npackage itself passes the same bounded zip reader (ratio, overlap, paths, CRC,\n100 MiB inflated); a failure is `refused / unsafe_office`, never a refusal of the\nwhole bundle. Other zips stay `unsupported / nested_archive`.\n\nTwo separate things happen to an accepted Office member, both after\nauthorization and before the evidence is written:\n\n- **Pages**: a `DocumentConverter` (`document-converter.ts`) renders the original\n  to PDF. The importer enforces the byte and time limits itself (input\n  `maxEntryBytes`, output `maxRenderedBytes`, `conversionTimeoutMs` with an abort\n  signal and a hard race, so an adapter that ignores the signal still times out),\n  and rejects output that is not a PDF or is encrypted. The converter is told a\n  neutral file name (`document.docx`), never the bundle path. Identical documents\n  are rendered once.\n- **Text**: an injectable `OfficeTextReader` (best effort; a failure or a `null`\n  costs the member nothing) returns whole-document text and, for decks, text and\n  speaker notes per slide. Office text is handed to the host on the accepted\n  member (`officeText`) and is **never** inlined into a proposed lesson body:\n  teacher guides and notes carry answers, and audience belongs to manifest v2.\n\n`receiveMember` gets the original `bytes` (store them as the private original\nasset: \"Open in PowerPoint\" for decks) and `rendered` (`{ bytes, sha256, mediaType:\n'application/pdf', converterId }`, store as a private asset beside the original:\nthe pages for \"Present\"/reading). The member row records `renderedSha256` and\n`renderedSizeBytes`; bytes are still not retained here.\n\n**Fail closed.** Any converter problem records that member `unsupported` with a\nreason and writes the rest of the bundle normally: `converter_unavailable` (none\nconfigured), `converter_failed` (unreachable or 5xx), `converter_timeout`,\n`converter_too_large`, `converter_rejected` (HTTP 4xx, not a PDF, encrypted),\n`office_limit` (beyond `maxOfficeMembers`, in natural path order). A member that\nfailed is not a lesson in the proposal, and identical copies of a failed document\nfail the same way rather than becoming duplicates of nothing. Outcomes are part\nof the append-only evidence, so a replay does not retry a recorded failure (to\nretry, change the bundle). A replay does re-render recorded-accepted members so the\nhost receives the bytes again; if it can no longer render one it throws\n`DocumentConversionError` rather than silently dropping an accepted member.\n\n### Host configuration\n\n```ts\nconst service = new CourseBundleImportService(db, authorizer, {\n  converter: new GotenbergDocumentConverter({\n    baseUrl: process.env.GOTENBERG_URL, // for example http://gotenberg:3000\n    timeoutMs: 60_000,\n    maxBytes: 50 * 1024 * 1024,\n  }),\n  officeTextReader, // optional, see below\n});\n```\n\n`GotenbergDocumentConverter` posts to `<baseUrl>/forms/libreoffice/convert`, talks\nto nothing else, refuses redirects and URLs with credentials, and caps the response\nas it streams. Run Gotenberg as an internal-only service with **no outbound\nnetwork**, its own size/time limits and no shared volume with the app; this\npackage assumes untrusted files never run next to the application. Tests use\n`FakeDocumentConverter` (records calls; `failWith`, `failWhen`, `delayMs`, `output`).\n\n`OfficeTextReader` is deliberately not wired to the SDK here, so this package\ndoes not depend on an unreleased `@happyvertical/documents`. Once the Office\nprocessors ship (sdk#1485, `extractOffice(bytes, 'docx' | 'pptx')`), implement\n`read` with it; the snippet is in the `OfficeTextReader` doc comment.\n\n## Manifest (`manifest.json`, version 1, closed)\n\n```json\n{ \"version\": 1, \"course\": { \"subject\": \"Math\" },\n  \"sections\": [ { \"key\": \"unit-1\", \"title\": \"Unit One\",\n    \"lessons\": [ { \"key\": \"sums\", \"title\": \"Sums\",\n      \"members\": [ { \"path\": \"sheets/sums.pdf\", \"role\": \"exercise\" } ] } ] } ] }\n```\nEvery object is closed: an unknown key anywhere is `manifest_unknown_key` (with\nits path in `entry`); another version is `manifest_version`. Keys match\n`[A-Za-z0-9._:-]{1,120}` and are unique; roles are the extraction page roles\n(`exercise`, `example`, `instructions`, `cover`, `answer_key`, `mixed`,\n`unknown`); a listed path must exist and be listed once. The manifest is a source\nfact: roles are `source`, anything the extractor infers stays `inferred`, and a\nmanifest/extraction disagreement belongs in extraction review, not here. Without\na manifest each accepted member is one lesson, sections come from the top-level\ndirectory and order is natural path order (digit runs compare numerically, no\nlocale). Manifest order: the manifest, declared members, then the rest by path.\nLesson bodies are the readable text members of a lesson, joined; PDFs and images\nare never inlined. Members whose declared role is `answer_key` or `mixed` never\ncontribute text to a lesson body (they remain recorded evidence members); the\nproposal rationale only counts how many were withheld.\n\n## Readers\n\n`BundleReader { formatId, detect, prepare }` in a `BundleReaderRegistry`;\nbuilt-ins are `manifest-v1` and `plain-files`. SCORM and Common Cartridge are\n**not implemented** (their manifests describe launch resources and activity\ntrees that do not map to sections/lessons without design); a host can register\na reader ahead of the built-ins (`register(reader, { first: true })`).\n\n## Identity and replay\n\n`bundleIdentity` (`cbi1-...`) digests the sorted (path, sha256) pairs, so\nre-zipping, reordering and timestamps replay. One `CourseBundleImport` per\n(tenant, identity); a concurrent first import replays once on the unique index.\n\n## Models (closed, required tenant, no REST/CLI/MCP/AI, append-only)\n\n`CourseBundleImport` (`course_bundle_imports`: identity, format, reader,\nmanifest version, counts, actor) and `CourseBundleMember` (`course_bundle_members`:\nunique tenant/import/path; ordinal, sha256, size, media type, kind, status,\nreason, duplicate-of, role, section and lesson key). Hashes and placements only:\nbytes stay with the host's ingestion receipts. Rewrites and deletes throw.\nNormal manifest migrations create both tables.\n\n## Not in this release\n\n- Manifest version 2 (material roles with audience, lesson pages, course-level\n  members, external video references) waits for the phase 1 role vocabulary\n  (smrt#4614). The page-role vocabulary and the closed v1 schema are unchanged;\n  see the hand-off note on smrt#4615.\n- Re-rendering a member whose first import recorded a converter failure (outcomes\n  are append-only per bundle identity).\n- Ingestion's receipt contract is unchanged: there is no `application/zip` part\n  type or `parentEvidenceId` in ingestion. The education side unpacks and the\n  host receives members one by one, so archive-to-member lineage lives in\n  `course_bundle_members` (and the host's receipts), not in ingestion evidence.\n  Changing ingestion's published receipt is a separate design decision.\n- A manifest/extraction disagreement is not compared automatically.\n- SCORM / Common Cartridge readers; zip64; nested archives; encrypted zips.\n"
+      "content": "# Course bundle import\n\n`CourseBundleImportService` (SMRT #4578, extends `CourseAuthoringService`,\nconsumed by Hearth #94) imports a course bundle, a zip with an optional manifest\nor a plain file set, as bounded evidence, hands its supported members to the\nhost for ingestion extraction and proposes sections and lessons for review.\nRisk is high: untrusted archive parsing and new schema. It reuses the course\nauthorizer: `importBundle` needs `education.course.author`, `readImport`\n`education.course.read-draft`, `proposeStructure` `education.course.generate`\n(via `CourseGenerationReviewService`). Operations: `import-course-bundle`,\n`read-course-bundle`. Server only (Node `zlib`/`crypto`); no new dependency.\n\n## Flow\n\n1. `importBundle({ ...actor, bundle, limits?, onProgress?, receiveMember? })`\n   authorizes **before parsing**, unpacks (stage `unpack`), classifies and lays\n   out the structure (`classify`), writes the evidence in one transaction and\n   then calls `receiveMember` for each accepted member (`extract`), outside any\n   transaction. `bundle` is `{ archive: Uint8Array }` or `{ files: [{ path,\n   bytes }] }`. Hostile or damaged input throws `CourseBundleRefusedError`\n   (`reason`, optional `entry`) and writes nothing.\n2. `receiveMember(member, { replayed })` is the host's ingestion seam: call\n   `IngestionService.receive` with `sourceKind: 'course_import'` and the member\n   bytes, then queue extraction and `preserveQuestionExtractionAnalysis` as in\n   [question extraction](question-extraction.md). Members carry `role`\n   (manifest page role), `lessonKey`, `sectionKey`. It runs on a replay too\n   (ingestion dedups by content hash), so an interrupted first run resumes. Its\n   return values are in `result.receipts`.\n3. `proposeStructure({ ...actor, importId, bundle, courseId,\n   expectedHeadRevisionId })` (stage `propose`) re-supplies the bundle (bytes\n   are never retained), checks it is the imported one, and runs a deterministic\n   `CourseMaterialGenerator` (`smrt-bundle-import`) through\n   `requestGeneration`/`runGeneration`. The result is an ordinary proposal: a\n   new draft revision of additions and fills; conflicts wait for\n   `decideProposal`. Nothing is released, assigned or published. The request key\n   is `bundle:<courseId>:<bundleIdentity>`, so a retry returns the same job; the\n   same key with another head is `CourseRequestKeyConflictError`.\n4. `readImport({ ...actor, importId })` returns the recorded evidence.\n\nProgress is an observer callback (`onProgress({ stage, completed, total })`,\nstages `unpack`, `classify`, `render`, `extract`, `propose`; each starts at `completed: 0`;\n`render` is emitted only when the bundle has Word/PowerPoint members).\nIngestion has no public job-progress seam, so none is invented. A throwing\nlistener never affects the import.\n\n## Hard bounds (`COURSE_BUNDLE_LIMITS`; a host may only lower them)\n\n| limit | value |\n|---|---|\n| `maxArchiveBytes` (input) | 100 MiB |\n| `maxEntries` | 200 |\n| `maxEntryBytes` (inflated) | 50 MiB |\n| `maxTotalBytes` (inflated) | 200 MiB |\n| `maxCompressionRatio` (members over `ratioFloorBytes` = 64 KiB) | 100 |\n| `maxPathBytes` / `maxSegmentBytes` / `maxPathDepth` | 512 / 255 / 8 |\n| `maxManifestBytes` | 256 KiB |\n| `maxLessons` (the proposal schema's cap) | 50 |\n| `maxLessonBodyChars` | 100 000 |\n| `maxOfficeMembers` (Word/PowerPoint members rendered per bundle) | 50 |\n| `maxRenderedBytes` (PDF accepted back from the converter) | 50 MiB |\n| `conversionTimeoutMs` (one Office member) | 60 000 |\n| archive nesting | 1: a zip inside a zip is never expanded |\n\nA lesson whose combined text members exceed `maxLessonBodyChars` refuses the\nbundle (`lesson_too_large`, `entry` = lesson key) at import; text is never\ntrimmed or dropped. A plain file set enforces `maxTotalBytes` on its member\nbytes exactly as an archive does on inflated bytes.\n\nThe reader (`course-bundle-zip.ts`) parses the end record and central directory,\nvalidates every offset and size against the real buffer, inflates with\n`maxOutputLength` equal to the declared size (declared sizes are never trusted:\na mismatch either way is `size_mismatch`), checks CRC32 and re-checks the total\non actual output. Stored and deflate only. Refusals (`CourseBundleRefusalReason`)\ncover: not a zip, truncated, ambiguous end record (two end records that both fit\nthe file, for example one forged in a comment), zip64, multi-disk, central\ndirectory not ending at the end record, entries out of range or overlapping,\nlocal header name/method mismatch, encrypted entries (flags 0/6/13, AES method),\nsymlink and special files (unix mode; DOS reparse flag), unsupported method,\nbad CRC, ratio, entry count, totals, duplicate names (case/NFC-insensitive,\nbackslashes normalised first) and bad paths (`..`, `.`, empty segments, absolute,\ndrive letter or `:` anywhere, NUL/control/bidi characters, lone surrogates,\ntoo long or deep). An **honestly** oversize member (declared over\n`maxEntryBytes`) is not inflated and is recorded `refused / entry_too_large`.\n\n## Members and statuses\n\nBy content (never by extension alone): `docx`/`pptx`/`xlsx` (see below), `pdf` (`%PDF-` in the first 1 KiB),\n`image` (PNG, JPEG, WebP), `text` (`.txt`/`.md`, strict UTF-8, no control\ncharacters, body-sized), `manifest` (root `manifest.json`), else `unsupported`.\nStatus: `accepted` (handed to extraction), `duplicate` (same sha256 as an earlier\nmember in canonical order; recorded once as evidence, `duplicateOfPath`, never\nextracted again), `unsupported` (`unsupported_type`, `nested_archive`,\n`unreadable_text`), `refused` (`encrypted_pdf`, `entry_too_large`), `metadata`\n(the manifest). Nothing is dropped. An encrypted PDF is any PDF with an\n`/Encrypt` token anywhere in its bytes (trailer, xref stream): a false positive\non literal text inside an uncompressed stream is refused, never read.\n\n## Word and PowerPoint members (SMRT #4615)\n\nA `.docx`/`.pptx`/`.xlsx` member is an OOXML package only when the name and the\ncontent agree: a zip whose entries include `[Content_Types].xml` and\n`word/document.xml` (docx), `ppt/presentation.xml` (pptx) or `xl/workbook.xml`\n(xlsx). A workbook (a supply list) is rendered and kept like the others but has\nno text reader. Before the bytes go anywhere, the\npackage itself passes the same bounded zip reader (ratio, overlap, paths, CRC,\n100 MiB inflated); a failure is `refused / unsafe_office`, never a refusal of the\nwhole bundle. Other zips stay `unsupported / nested_archive`.\n\nTwo separate things happen to an accepted Office member, both after\nauthorization and before the evidence is written:\n\n- **Pages**: a `DocumentConverter` (`document-converter.ts`) renders the original\n  to PDF. The importer enforces the byte and time limits itself (input\n  `maxEntryBytes`, output `maxRenderedBytes`, `conversionTimeoutMs` with an abort\n  signal and a hard race, so an adapter that ignores the signal still times out),\n  and rejects output that is not a PDF or is encrypted. The converter is told a\n  neutral file name (`document.docx`), never the bundle path. Identical documents\n  are rendered once.\n- **Text**: an injectable `OfficeTextReader` (best effort; a failure or a `null`\n  costs the member nothing) returns whole-document text and, for decks, text and\n  speaker notes per slide. Office text is handed to the host on the accepted\n  member (`officeText`) and is **never** inlined into a proposed lesson body:\n  teacher guides and notes carry answers, and audience belongs to manifest v2.\n\n`receiveMember` gets the original `bytes` (store them as the private original\nasset: \"Open in PowerPoint\" for decks) and `rendered` (`{ bytes, sha256, mediaType:\n'application/pdf', converterId }`, store as a private asset beside the original:\nthe pages for \"Present\"/reading). The member row records `renderedSha256` and\n`renderedSizeBytes`; bytes are still not retained here.\n\n**Fail closed.** Any converter problem records that member `unsupported` with a\nreason and writes the rest of the bundle normally: `converter_unavailable` (none\nconfigured), `converter_failed` (unreachable or 5xx), `converter_timeout`,\n`converter_too_large`, `converter_rejected` (HTTP 4xx, not a PDF, encrypted),\n`office_limit` (beyond `maxOfficeMembers`, in natural path order). A member that\nfailed is not a lesson in the proposal, and identical copies of a failed document\nfail the same way rather than becoming duplicates of nothing. Outcomes are part\nof the append-only evidence, so a replay does not retry a recorded failure (to\nretry, change the bundle). A replay does re-render recorded-accepted members so the\nhost receives the bytes again; if it can no longer render one it throws\n`DocumentConversionError` rather than silently dropping an accepted member.\n\n### Host configuration\n\n```ts\nconst service = new CourseBundleImportService(db, authorizer, {\n  converter: new GotenbergDocumentConverter({\n    baseUrl: process.env.GOTENBERG_URL, // for example http://gotenberg:3000\n    timeoutMs: 60_000,\n    maxBytes: 50 * 1024 * 1024,\n  }),\n  officeTextReader, // optional, see below\n});\n```\n\n`GotenbergDocumentConverter` posts to `<baseUrl>/forms/libreoffice/convert`, talks\nto nothing else, refuses redirects and URLs with credentials, and caps the response\nas it streams. Run Gotenberg as an internal-only service with **no outbound\nnetwork**, its own size/time limits and no shared volume with the app; this\npackage assumes untrusted files never run next to the application. Tests use\n`FakeDocumentConverter` (records calls; `failWith`, `failWhen`, `delayMs`, `output`).\n\n`OfficeTextReader` reads Office text through the SDK without this package\ndepending on `@happyvertical/documents`: the host imports `extractOffice`\n(released in `@happyvertical/documents` 0.111.4, sdk#1486, Kreuzberg) and passes\nit to `createOfficeTextReader(extractOffice)`, which returns whole-document\ntext for Word and text plus speaker notes per slide for PowerPoint (images are\nnever requested). An absent engine reads as `null`; a corrupt file rejects and\nthe importer treats that as \"no text\". The repository's current `catalog:`\npin is 0.111.3, which predates the Office processors, so the host bumps the SDK\nset (and its minimum release age) before it can import `extractOffice`.\n\n## Manifest (`manifest.json`, version 1, closed)\n\n```json\n{ \"version\": 1, \"course\": { \"subject\": \"Math\" },\n  \"sections\": [ { \"key\": \"unit-1\", \"title\": \"Unit One\",\n    \"lessons\": [ { \"key\": \"sums\", \"title\": \"Sums\",\n      \"members\": [ { \"path\": \"sheets/sums.pdf\", \"role\": \"exercise\" } ] } ] } ] }\n```\nEvery object is closed: an unknown key anywhere is `manifest_unknown_key` (with\nits path in `entry`); another version is `manifest_version`. Keys match\n`[A-Za-z0-9._:-]{1,120}` and are unique; roles are the extraction page roles\n(`exercise`, `example`, `instructions`, `cover`, `answer_key`, `mixed`,\n`unknown`); a listed path must exist and be listed once. The manifest is a source\nfact: roles are `source`, anything the extractor infers stays `inferred`, and a\nmanifest/extraction disagreement belongs in extraction review, not here. Without\na manifest each accepted member is one lesson, sections come from the top-level\ndirectory and order is natural path order (digit runs compare numerically, no\nlocale). Manifest order: the manifest, declared members, then the rest by path.\nLesson bodies are the readable text members of a lesson, joined; PDFs and images\nare never inlined. Members whose declared role is `answer_key` or `mixed` never\ncontribute text to a lesson body (they remain recorded evidence members); the\nproposal rationale only counts how many were withheld.\n\n## Manifest version 2 (SMRT #4615)\n\nA root `manifest.json` with `\"version\": 2` is laid out by the `manifest-v2`\nreader; version 1 keeps its own reader and page roles. The schema is closed in\nthe same way: an unknown key anywhere is `manifest_unknown_key` (with its path in\n`entry`), another version is `manifest_version`.\n\n```json\n{ \"version\": 2, \"course\": { \"subject\": \"Science\" },\n  \"courseMembers\": [ { \"path\": \"unit/supplies.pdf\", \"role\": \"attachment\", \"title\": \"Supply list\" } ],\n  \"sections\": [ { \"key\": \"unit\", \"title\": \"Unit\", \"lessons\": [ {\n    \"key\": \"l1\", \"title\": \"Lesson 1\",\n    \"members\": [ { \"path\": \"l1/log.docx\", \"role\": \"learner-pages\" },\n                 { \"path\": \"l1/deck.pptx\", \"role\": \"slides\" },\n                 { \"path\": \"l1/guidance.pdf\", \"role\": \"assessment-guidance\" } ],\n    \"pages\":  [ { \"member\": \"l1/log.docx\", \"from\": 1, \"to\": 4, \"label\": \"Mission log\" } ],\n    \"videos\": [ { \"reference\": \"dQw4w9WgXcQ\", \"title\": \"Recap\", \"step\": 1 } ] } ] } ] }\n```\n\n- **Members** (lesson `members` and root `courseMembers`): `path` (must exist, listed\n  once), `role` (required) one of `teacher-guide`, `slides`, `learner-pages`,\n  `assessment`, `assessment-guidance`, `handout`, `printable`, `answer-key`,\n  `attachment` (`manifest_role` otherwise; a video is a reference, never a file),\n  optional `audience` and `title`. The audience is the role default\n  (`LESSON_ASSET_DEFAULT_AUDIENCE`) unless stated; `answer-key` and\n  `assessment-guidance` are always guardian (a learner audience is\n  `manifest_audience`). Members not listed stay recorded evidence with no role.\n- **Pages**: `{ member, from, to, label? }` ranges over a member of the same lesson\n  (PDF, Word or PowerPoint; the rendered PDF for Office). Each page becomes a\n  `LessonPage` keyed `p<n>`, labelled `<label> <n>` (default `Page <n>`), ordered by\n  declaration. Bad, overlapping or unpageable ranges are `manifest_pages`; at most\n  500 pages per lesson.\n- **Videos**: `{ reference, title, step, audience? }` where `reference` is a bare id\n  or an allowlisted https YouTube URL (`parseYouTubeReference`; anything else is\n  `manifest_video`), `step` an integer 0-9999. They become `LessonExternalVideo`\n  rows; nothing is downloaded.\n- **Course members** become `CourseAsset` rows, not tied to any lesson.\n\nGuardian-audience text (teacher guides, guidance, keys) never enters a proposed\nlesson body; only learner-audience text members do. Under v2 `role` on the member\nevidence row is the material role and `audience` the effective audience (NULL on\nrows recorded before v2). The plan carries `materials` (also on\n`CourseBundleImportResult.materials`): the resolved materials, pages and videos,\nplus `skipped` for declared members that were unsupported, refused or failed\nrendering. A duplicate member resolves to the earlier identical member's bytes\n(`assetPath`) and one material per (place, role, content).\n\n`receiveMember` also gets `audience` and `courseLevel`. **Slides** keep the original\ndeck (hand `bytes` to the host as a private asset: \"Open in PowerPoint\") and its\nrendered pages (`rendered`: \"Present\").\n\n### Applying materials\n\n`applyMaterials({ ...actor, importId, bundle, courseId, lessons, assets })`\n(`education.course.author`, operation `apply-course-bundle-materials`) writes the\nrows in one transaction. The host has stored each accepted member as a private\nasset and created the course's lessons: `lessons` maps manifest lesson key to the\n`Lesson` id, `assets` maps member path to `{ original, rendered }` asset ids.\nSlides join both the original deck and the rendered PDF; the original join is always\nguardian-only whatever the deck's declared audience (the audience applies to the\nrendered PDF), and a join written earlier with a wider audience is repaired on\nre-apply (`repaired`); any other Word/PowerPoint\nmember joins only its rendered PDF, so a learner is never handed an editable\noriginal. `LessonAsset`/`CourseAsset` saves keep their private-asset rule (guardian-\nonly roles and personal-use-copy courses need private assets). It targets\nfamily-owned courses; an authored course is `authored-course` because authored\nmaterial changes through course authoring. Idempotent: an identical row is\n`unchanged`, a row with other details is `CourseBundleMaterialsError('conflict')`,\na missing asset or lesson is `asset-missing`/`lesson-missing`; any error writes\nnothing.\n\n### Retrying a failed rendering\n\n`retryRendering({ ...actor, importId, bundle, paths?, receiveMember? })`\n(`education.course.author`, operation `retry-course-bundle-rendering`, needs a\nconverter) renders the Word/PowerPoint members whose first import recorded a\n*transient* failure (`converter_unavailable`, `converter_failed`,\n`converter_timeout`; `COURSE_BUNDLE_RETRYABLE_REASONS`). The first import's member\nrows are never rewritten. A success appends one `course_bundle_renderings` row\nper (import, content hash); every reader (`readImport`, replayed imports,\nproposals) overlays it, so the member reads `accepted` (identical copies as\nduplicates) with its rendered hash. A failure records nothing, so asking again is\nalways allowed; a second retry of a repaired member is `unchanged` and renders\nnothing. Converter rejections, size limits and the Office member cap are not\nretryable: change the bundle. The bundle must be the imported one.\n\n## Readers\n\n`BundleReader { formatId, detect, prepare }` in a `BundleReaderRegistry`;\nbuilt-ins are `manifest-v2`, `manifest-v1` and `plain-files`. SCORM and Common Cartridge are\n**not implemented** (their manifests describe launch resources and activity\ntrees that do not map to sections/lessons without design); a host can register\na reader ahead of the built-ins (`register(reader, { first: true })`).\n\n## Identity and replay\n\n`bundleIdentity` (`cbi1-...`) digests the sorted (path, sha256) pairs, so\nre-zipping, reordering and timestamps replay. One `CourseBundleImport` per\n(tenant, identity); a concurrent first import replays once on the unique index.\n\n## Models (closed, required tenant, no REST/CLI/MCP/AI, append-only)\n\n`CourseBundleImport` (`course_bundle_imports`: identity, format, reader,\nmanifest version, counts, actor), `CourseBundleMember` (`course_bundle_members`:\nunique tenant/import/path; ordinal, sha256, size, media type, kind, status,\nreason, duplicate-of, role, audience, section and lesson key) and\n`CourseBundleRendering` (`course_bundle_renderings`: a deliberate retry's success). Hashes and placements only:\nbytes stay with the host's ingestion receipts. Rewrites and deletes throw.\nNormal manifest migrations create the tables and add `audience` (NULL on older rows).\n\n## Not in this release\n\n- Material rows for authored courses: a proposal still carries lesson text only;\n  authored course material goes through `CourseMaterialInput` and release.\n- Ingestion's receipt contract is unchanged: there is no `application/zip` part\n  type or `parentEvidenceId` in ingestion. The education side unpacks and the\n  host receives members one by one, so archive-to-member lineage lives in\n  `course_bundle_members` (and the host's receipts), not in ingestion evidence.\n  Changing ingestion's published receipt is a separate design decision.\n- A manifest/extraction disagreement is not compared automatically.\n- SCORM / Common Cartridge readers; zip64; nested archives; encrypted zips.\n"
+    },
+    {
+      "path": "agents/class-crunchlabs.md",
+      "module": "class-crunchlabs",
+      "content": "# Class CrunchLabs source (SMRT #4616)\n\nClass CrunchLabs is a global catalog provider (`class-crunchlabs`) whose units are\nlisted under Science, with the @ClassCrunchLabs YouTube course playlists as\npreviews. \"Add to a course\" reads the family's own download of the unit and runs\nthe [bundle import](course-bundle-import.md) with a manifest version 2 built from\nit. Files come from CrunchLabs' own downloads and YouTube; **nothing is hosted\nhere** and the listing has no acquirable formats.\n\n## Operator-only until permission, one public switch\n\n`CatalogVisibility` gains `operator`. A `CatalogPolicy` built with\n`operatorTenantIds` lets only those families (host configuration, never a\nrequest) see `operator` records; the default policy shows them to nobody, and\n`authorize` answers `operator-only`. Materialization refuses them.\n\n`createClassCrunchLabsCatalogAdapter({ playlists, publicListing? })` is a snapshot\n`CatalogSyncAdapter` (one terminal page, no cursor). By default\n(`CLASS_CRUNCHLABS_PUBLIC_LISTING_DEFAULT = false`) every record is `operator`\nvisibility with licence state `unknown`, no permitted operations and the text\n\"free curriculum, permission pending\". Only the literal `publicListing: true`,\nset by the operator in host configuration, makes records `catalog` visibility\nwith `verified` evidence permitting `link` only. The switch is part of each\nrecord's revision, so the next sync rewrites the rows when it is flipped.\n`classCrunchLabsPreviewEmbedUrl(record)` returns the youtube-nocookie playlist\nembed for a listed unit (null for anything else). The playlist data is an\ninjected `ClassCrunchLabsPlaylistSource`; the adapter never touches the network.\n\n`addClassCrunchLabsUnit({ service, actor, catalogActor, record, listing, policy,\nfiles, playlists, pageCounter?, receiveMember? })` re-checks\n`canAddClassCrunchLabsUnit(actor, policy, listing)`: visibility is derived from the\nhost's own `listing.publicListing` (operator unless the literal `true`), never from\nthe record or any caller-supplied visibility or licence; an operator-only listing\nis refused to every other family, and the course actor must be the catalog actor, builds the bundle and imports each part. Then propose\nstructure and `applyMaterials` per part as for any bundle. Courses are\n`personal-use-copy` (`build.licenseKind`).\n\n## Reading a download\n\n`buildClassCrunchLabsBundle({ files, playlists?, unit?, pageCounter?,\nincludeUnitWideAggregates?, maxPartBytes? })` takes a `ClassCrunchLabsFileSource`:\n`folderClassCrunchLabsSource(dir)` (Node only, from `@happyvertical/smrt-education/node`, never the root: a folder, the Drive zip parts, or both;\nzips are read lazily from their central directory, zip64/encrypted/symlinks are\nskipped) or `memoryClassCrunchLabsSource(files)`. It never reads video files.\n\n- Layout: `<Unit>_All Unit Wide Materials` and `<Unit>_Lesson <n>`; letters A\n  teacher manual, B slides, C student mission log, D status check assessment\n  (plus guidance and the editable master), E handouts, F extras, G videos. A\n  lettered directory wins over a file's own letter. Several units need `unit`.\n- Mapping to manifest v2: A `teacher-guide`, B `slides`, C `learner-pages`, D\n  `assessment` / `assessment-guidance`, E `handout`, F `printable`, the unit-wide\n  Supply List `attachment`. Audiences are the role defaults (teacher manual and\n  guidance guardian, slides guardian, mission log learner); the editable\n  assessment master is guardian. Unit-wide files become course members.\n- The unit-wide \"(all lessons)\" combined files repeat the per-lesson files and\n  are large, so they are left out unless `includeUnitWideAggregates` (reported as\n  `aggregate-of-lessons`); the supply list, posters and other extras are kept.\n- Lesson pages: the first mission log of a lesson gets a `Mission log` range\n  from `pageCounter` (`createClassCrunchLabsPageCounter({ converter? })` counts\n  PDFs with pdf-lib and Word files by rendering them through the converter).\n  Without a count the lesson gets no pages and the report says so.\n- Videos: names `Lnn.step_Video_Kind_Title` are matched, by unit (playlist\n  title), lesson and step (`L03.6` or `Lesson 3 ... Step 6` in the item title),\n  to the unit playlist; two videos sharing a step are told apart by the item\n  title naming their title or kind, else both stay unmatched (`ambiguous`).\n  Matches become `videos` references with a title and a step order (materials\n  prep videos are guardian audience); unit-level videos (a teaser) and unmatched\n  ones are only reported.\n- De-duplication: repeated exports of one logical path collapse (CRC and size\n  when known; the newer export wins, a changed file is `superseded`); the same\n  bytes under another name or place keep one copy (the lesson-named file in its\n  lesson, posters unit wide, never a `copy`).\n- A unit larger than one archive (bundle cap 100 MiB) is split by lesson into\n  `build.parts` (default 90 MiB each; the first part carries the course members and\n  any lesson that fits beside them, others go to the first part with room; if no\n  lesson fits beside the course members the build refuses with `too_large`); `build.bundle`\n  and `build.manifest` are the first part.\n\nThe `report` lists lessons, members, parts, pages, matched and unmatched videos,\nduplicates, ignored files and warnings. Fixtures in tests are synthetic files\nwith the same naming; no real download is ever copied into the repository.\n\nTests: `src/__tests__/class-crunchlabs.test.ts`.\n"
     },
     {
       "path": "agents/source-import.md",

package/dist/sources/class-crunchlabs-files.d.ts

@@ -0,0 +1,8 @@
+import type { ClassCrunchLabsFileSource } from './class-crunchlabs.js';
+/**
+ * Every unit file under `directory`: plain files, and the entries of any `.zip`
+ * (a zip is not expanded into the filesystem, and a zip inside a zip is not
+ * opened). Symbolic links are skipped; hidden files are ignored.
+ */
+export declare function folderClassCrunchLabsSource(directory: string): ClassCrunchLabsFileSource;
+//# sourceMappingURL=class-crunchlabs-files.d.ts.map

package/dist/sources/class-crunchlabs-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"class-crunchlabs-files.d.ts","sourceRoot":"","sources":["../../src/sources/class-crunchlabs-files.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAEV,yBAAyB,EAC1B,MAAM,uBAAuB,CAAC;AAiJ/B;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,GAChB,yBAAyB,CAgD3B"}

package/dist/sources/class-crunchlabs.d.ts

@@ -0,0 +1,217 @@
+/**
+ * Class CrunchLabs unit downloads to a course bundle (SMRT #4616).
+ *
+ * A unit download is a folder (or the zip parts a Drive export splits it into)
+ * holding `<Unit>_All Unit Wide Materials` and `<Unit>_Lesson <n>` folders. Files
+ * are lettered: A teacher manual, B slides, C student mission log, D status check
+ * assessment (plus guidance, editable), E handouts, F extras, G videos. The
+ * videos are not read: their names (`Lnn.step_Video_Kind_Title`) are matched,
+ * by unit, lesson and step, to the unit's YouTube course playlist and become
+ * external references.
+ *
+ * `buildClassCrunchLabsBundle` reads such a download and returns a manifest
+ * version 2 bundle for `CourseBundleImportService`. Nothing here touches the
+ * network: the playlist comes from an injected `ClassCrunchLabsPlaylistSource`,
+ * and files from an injected `ClassCrunchLabsFileSource` (Node folder and zip
+ * readers are in `class-crunchlabs-files.ts`). The files are CrunchLabs' own
+ * downloads, never hosted by us.
+ */
+import type { DocumentConverter, OfficeDocumentKind } from '../document-converter.js';
+export declare const CLASS_CRUNCHLABS_PROVIDER_ID: "class-crunchlabs";
+export declare const CLASS_CRUNCHLABS_SUBJECT = "Science";
+/** The licence a family's own copy of a CrunchLabs unit carries. */
+export declare const CLASS_CRUNCHLABS_LICENSE_KIND: "personal-use-copy";
+export declare class ClassCrunchLabsError extends Error {
+    readonly code: 'no_unit' | 'multiple_units' | 'empty_unit' | 'too_large' | 'access_denied';
+    readonly detail: readonly string[];
+    constructor(code: 'no_unit' | 'multiple_units' | 'empty_unit' | 'too_large' | 'access_denied', message: string, detail?: readonly string[]);
+}
+/** One file of a unit download. Bytes are read lazily, and only for files that are used. */
+export interface ClassCrunchLabsFile {
+    /** Path inside its source (folder-relative, or the zip entry name). */
+    path: string;
+    size: number;
+    /** CRC-32 (lower-case hex) when known without reading, used to spot repeated exports. */
+    crc32?: string;
+    /** Orders repeated exports of the same unit: the larger value is the newer export. */
+    exportId?: string;
+    read(): Promise<Uint8Array>;
+}
+export interface ClassCrunchLabsFileSource {
+    files(): Promise<ClassCrunchLabsFile[]>;
+}
+/** An in-memory source (tests, or a host that already holds the files). */
+export declare function memoryClassCrunchLabsSource(files: ReadonlyArray<{
+    path: string;
+    bytes?: Uint8Array;
+    size?: number;
+    exportId?: string;
+    crc32?: string;
+}>): ClassCrunchLabsFileSource;
+export interface ClassCrunchLabsPlaylistItem {
+    videoId: string;
+    title: string;
+    position: number;
+}
+/** A YouTube course playlist of the @ClassCrunchLabs channel. */
+export interface ClassCrunchLabsPlaylist {
+    id: string;
+    title: string;
+    /** The unit the playlist belongs to when the source knows it; else derived from the title. */
+    unit?: string;
+    items: ClassCrunchLabsPlaylistItem[];
+}
+/** Injected: tests use fixtures, a host fetches the channel's playlists. Never called from a test with a network. */
+export interface ClassCrunchLabsPlaylistSource {
+    playlists(): Promise<ClassCrunchLabsPlaylist[]>;
+}
+export type ClassCrunchLabsPageCounter = (input: {
+    bytes: Uint8Array;
+    kind: 'pdf' | OfficeDocumentKind;
+}) => Promise<number | null>;
+/** Case, punctuation and spacing insensitive key. */
+export declare const classCrunchLabsKey: (value: string) => string;
+export interface ClassCrunchLabsVideoName {
+    lesson: number;
+    /** Lower-case step such as `6` or `1b`. */
+    step: string;
+    /** The kind token as named, for example `MaterialsPrep`. */
+    kind: string;
+    /** Humanized title, `''` when the name has none. */
+    title: string;
+}
+/** Parse `Lnn.step_Video_Kind_Title_Unit.mp4`; null when the name is not a lesson video. */
+export declare function parseClassCrunchLabsVideoName(fileName: string, unit: string): ClassCrunchLabsVideoName | null;
+export interface ClassCrunchLabsVideoMatch {
+    lesson: number;
+    step: string;
+    kind: string;
+    title: string;
+    videoId: string;
+    playlistItem: string;
+}
+export interface ClassCrunchLabsVideoMiss {
+    lesson: number;
+    step: string;
+    kind: string;
+    title: string;
+    reason: 'no_playlist' | 'no_item' | 'ambiguous' | 'item_taken';
+}
+/** The (lesson, step) a playlist item title names: `L03.6`, `Lesson 3 ... Step 6`. */
+export declare function parsePlaylistItemTitle(title: string): {
+    lesson: number;
+    step: string;
+} | null;
+/** The playlist for a unit: its title (or `unit`) names the unit; the shortest title wins. */
+export declare function pickUnitPlaylist(playlists: readonly ClassCrunchLabsPlaylist[], unit: string): ClassCrunchLabsPlaylist | null;
+/**
+ * Match lesson videos to playlist items by lesson and step. Two videos that
+ * share a step (a materials-prep and a hands-on video) are told apart by the
+ * item title naming their title or kind; if that cannot decide, they are left
+ * unmatched as `ambiguous` rather than guessed. Each item is used once.
+ */
+export declare function matchClassCrunchLabsVideos(videos: readonly ClassCrunchLabsVideoName[], playlist: ClassCrunchLabsPlaylist | null): {
+    matched: ClassCrunchLabsVideoMatch[];
+    unmatched: ClassCrunchLabsVideoMiss[];
+    unusedItems: number;
+};
+export interface ClassCrunchLabsBuildOptions {
+    files: ClassCrunchLabsFileSource;
+    /** Without one, videos are reported unmatched (`no_playlist`) and no reference is written. */
+    playlists?: ClassCrunchLabsPlaylistSource;
+    /** Which unit when the download holds several; matched ignoring case and punctuation. */
+    unit?: string;
+    /**
+     * How many pages a mission log has, to write its lesson page range. Without
+     * one, or when it returns null, the lesson gets no page rows (a warning says so).
+     */
+    pageCounter?: ClassCrunchLabsPageCounter;
+    /**
+     * The unit-wide "(all lessons)" files (the combined manual, deck, mission log,
+     * status checks and handouts) repeat the per-lesson files and are large, so they
+     * are left out by default. The supply list, posters and other unit-wide extras
+     * are always course members.
+     */
+    includeUnitWideAggregates?: boolean;
+    /** Largest bundle part in bytes; default 90 MiB, never above the bundle archive limit. */
+    maxPartBytes?: number;
+}
+export interface ClassCrunchLabsReport {
+    unit: string;
+    lessons: number;
+    members: number;
+    courseMembers: number;
+    /** Bundles the unit was split into (1 unless it is large). */
+    parts: number;
+    pages: Array<{
+        lesson: number;
+        path: string;
+        pages: number;
+    }>;
+    videos: {
+        playlist: {
+            id: string;
+            title: string;
+        } | null;
+        matched: ClassCrunchLabsVideoMatch[];
+        unmatched: ClassCrunchLabsVideoMiss[];
+        unusedPlaylistItems: number;
+        /** Unit-level videos (a teaser): a course has no video of its own, so none is written. */
+        unitLevel: string[];
+    };
+    /** Same bytes under another name or place: only the preferred copy is bundled. */
+    duplicates: Array<{
+        path: string;
+        duplicateOf: string;
+    }>;
+    /** The same file in more than one export of the unit. */
+    duplicateExports: number;
+    /** A file that differs between exports: the newer export is used. */
+    superseded: number;
+    ignored: Array<{
+        path: string;
+        reason: string;
+    }>;
+    warnings: string[];
+}
+/** One importable bundle: a manifest version 2 and the files it names. */
+export interface ClassCrunchLabsBundlePart {
+    bundle: {
+        files: Array<{
+            path: string;
+            bytes: Uint8Array;
+        }>;
+    };
+    manifest: Record<string, unknown>;
+    /** The lesson numbers this part carries. */
+    lessons: number[];
+}
+export interface ClassCrunchLabsBuild {
+    unit: string;
+    /**
+     * The bundles to import, in order, each with `CourseBundleImportService`. A
+     * unit that fits one archive is one part; a large one is split by lesson
+     * (course-level members go in the first part), never by file.
+     */
+    parts: ClassCrunchLabsBundlePart[];
+    /** The first part, for the usual single-bundle unit. */
+    bundle: ClassCrunchLabsBundlePart['bundle'];
+    manifest: Record<string, unknown>;
+    /** A family's own copy of a unit is a personal-use copy. */
+    licenseKind: typeof CLASS_CRUNCHLABS_LICENSE_KIND;
+    report: ClassCrunchLabsReport;
+}
+/** Read a Class CrunchLabs unit download and build a manifest version 2 bundle. */
+export declare function buildClassCrunchLabsBundle(options: ClassCrunchLabsBuildOptions): Promise<ClassCrunchLabsBuild>;
+/**
+ * A page counter for mission logs: PDFs are counted directly (`pdf-lib`), Word
+ * and PowerPoint files by asking the injected converter to render them. Without
+ * a converter, only PDFs are counted. The count is a convenience for the page
+ * range; the importer still renders the member itself.
+ */
+export declare function createClassCrunchLabsPageCounter(options?: {
+    converter?: DocumentConverter;
+    timeoutMs?: number;
+    maxBytes?: number;
+}): ClassCrunchLabsPageCounter;
+//# sourceMappingURL=class-crunchlabs.d.ts.map

package/dist/sources/class-crunchlabs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"class-crunchlabs.d.ts","sourceRoot":"","sources":["../../src/sources/class-crunchlabs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AASH,OAAO,KAAK,EACV,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,0BAA0B,CAAC;AAOlC,eAAO,MAAM,4BAA4B,EAAG,kBAA2B,CAAC;AACxE,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAClD,oEAAoE;AACpE,eAAO,MAAM,6BAA6B,EAAG,mBAA4B,CAAC;AAE1E,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EACT,SAAS,GACT,gBAAgB,GAChB,YAAY,GACZ,WAAW,GACX,eAAe;IAEnB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE;gBAPzB,IAAI,EACT,SAAS,GACT,gBAAgB,GAChB,YAAY,GACZ,WAAW,GACX,eAAe,EACnB,OAAO,EAAE,MAAM,EACN,MAAM,GAAE,SAAS,MAAM,EAAO;CAK1C;AAID,4FAA4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7B;AACD,MAAM,WAAW,yBAAyB;IACxC,KAAK,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;CACzC;AAED,2EAA2E;AAC3E,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,aAAa,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,GACD,yBAAyB,CAW3B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AACD,iEAAiE;AACjE,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,2BAA2B,EAAE,CAAC;CACtC;AACD,qHAAqH;AACrH,MAAM,WAAW,6BAA6B;IAC5C,SAAS,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACjD;AAED,MAAM,MAAM,0BAA0B,GAAG,CAAC,KAAK,EAAE;IAC/C,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,EAAE,KAAK,GAAG,kBAAkB,CAAC;CAClC,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAK7B,qDAAqD;AACrD,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,WAIrC,CAAC;AA8FZ,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,4FAA4F;AAC5F,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,wBAAwB,GAAG,IAAI,CAoBjC;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AACD,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;CAChE;AAKD,sFAAsF;AACtF,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASzC;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,SAAS,uBAAuB,EAAE,EAC7C,IAAI,EAAE,MAAM,GACX,uBAAuB,GAAG,IAAI,CAkBhC;AAWD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,wBAAwB,EAAE,EAC3C,QAAQ,EAAE,uBAAuB,GAAG,IAAI,GACvC;IACD,OAAO,EAAE,yBAAyB,EAAE,CAAC;IACrC,SAAS,EAAE,wBAAwB,EAAE,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;CACrB,CA8EA;AA0ED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,yBAAyB,CAAC;IACjC,8FAA8F;IAC9F,SAAS,CAAC,EAAE,6BAA6B,CAAC;IAC1C,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,WAAW,CAAC,EAAE,0BAA0B,CAAC;IACzC;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,MAAM,EAAE;QACN,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;QAC/C,OAAO,EAAE,yBAAyB,EAAE,CAAC;QACrC,SAAS,EAAE,wBAAwB,EAAE,CAAC;QACtC,mBAAmB,EAAE,MAAM,CAAC;QAC5B,0FAA0F;QAC1F,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IACF,kFAAkF;IAClF,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzD,yDAAyD;IACzD,gBAAgB,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AACD,0EAA0E;AAC1E,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,UAAU,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC9D,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,4CAA4C;IAC5C,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AACD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACnC,wDAAwD;IACxD,MAAM,EAAE,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,4DAA4D;IAC5D,WAAW,EAAE,OAAO,6BAA6B,CAAC;IAClD,MAAM,EAAE,qBAAqB,CAAC;CAC/B;AAcD,mFAAmF;AACnF,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAua/B;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE;IACP,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACd,GACL,0BAA0B,CAsC5B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-education",
-  "version": "0.58.0",
+  "version": "0.59.0",
   "smrtJsdoc": "strict",
   "description": "Tenant-aware learning catalog models and authorized catalog access for SMRT",
   "type": "module",
@@ -22,21 +22,25 @@
     "./ingestion": {
       "types": "./dist/ingestion.d.ts",
       "import": "./dist/ingestion.js"
+    },
+    "./node": {
+      "types": "./dist/node.d.ts",
+      "import": "./dist/node.js"
     }
   },
   "dependencies": {
-    "@happyvertical/smrt-assets": "0.58.0",
-    "@happyvertical/smrt-core": "0.58.0",
-    "@happyvertical/smrt-profiles": "0.58.0",
-    "@happyvertical/smrt-tenancy": "0.58.0",
-    "@happyvertical/smrt-users": "0.58.0",
+    "@happyvertical/smrt-assets": "0.59.0",
+    "@happyvertical/smrt-core": "0.59.0",
+    "@happyvertical/smrt-profiles": "0.59.0",
+    "@happyvertical/smrt-tenancy": "0.59.0",
+    "@happyvertical/smrt-users": "0.59.0",
     "@happyvertical/files": "^0.111.3",
     "@happyvertical/sql": "^0.111.3",
     "pdf-lib": "1.17.1",
-    "@happyvertical/smrt-ingestion": "0.58.0"
+    "@happyvertical/smrt-ingestion": "0.59.0"
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.58.0",
+    "@happyvertical/smrt-vitest": "0.59.0",
     "@types/node": "24.13.6",
     "typescript": "6.0.3",
     "vite": "8.1.6",