@headless-lms/adapter-db 0.1.0

package/dist/repositories/content.js

@@ -0,0 +1,350 @@
+import { activities, activityAssets, contentItems, courses, downloadAssets, downloads, modules } from "../schema/content.js";
+import { isUniqueViolation } from "./pg-errors.js";
+import { and, asc, count, desc, eq, ilike, inArray, or, sql } from "drizzle-orm";
+import { genId } from "@headless-lms/core/shared/id";
+import { noopLogger } from "@headless-lms/core/shared/logger";
+import { ConflictError, NotFoundError } from "@headless-lms/core/shared/errors";
+//#region src/repositories/content.ts
+function toCourse(row) {
+	return {
+		...row,
+		status: row.status
+	};
+}
+const sortColumns = {
+	title: courses.title,
+	slug: courses.slug,
+	status: courses.status,
+	category: courses.category,
+	createdAt: courses.createdAt,
+	updatedAt: courses.updatedAt
+};
+const downloadSortColumns = {
+	title: downloads.title,
+	slug: downloads.slug,
+	status: downloads.status,
+	category: downloads.category,
+	createdAt: downloads.createdAt,
+	updatedAt: downloads.updatedAt
+};
+function toDownload(row) {
+	return {
+		...row,
+		status: row.status
+	};
+}
+var DrizzleContentRepository = class {
+	db;
+	logger;
+	constructor(db, logger = noopLogger) {
+		this.db = db;
+		this.logger = logger;
+	}
+	/** On the root db this opens a transaction; tx-bound (ContentUnitOfWork) it
+	*  nests as a savepoint inside the surrounding transaction. */
+	tx(fn) {
+		return this.db.transaction(fn);
+	}
+	async list(orgId, query) {
+		const conditions = [eq(courses.orgId, orgId)];
+		if (query.status) conditions.push(eq(courses.status, query.status));
+		if (query.category) conditions.push(eq(courses.category, query.category));
+		const search = query.search?.trim();
+		if (search) {
+			const like = `%${search}%`;
+			const match = or(ilike(courses.title, like), ilike(courses.category, like));
+			if (match) conditions.push(match);
+		}
+		const where = and(...conditions);
+		let sortKey = "createdAt";
+		let direction = "desc";
+		if (query.sort) {
+			const isDesc = query.sort.startsWith("-");
+			const key = isDesc ? query.sort.slice(1) : query.sort;
+			if (key in sortColumns) {
+				sortKey = key;
+				direction = isDesc ? "desc" : "asc";
+			}
+		}
+		const sortExpr = sortColumns[sortKey] ?? courses.createdAt;
+		const orderBy = direction === "desc" ? desc(sortExpr) : asc(sortExpr);
+		const rows = await this.db.select().from(courses).where(where).orderBy(orderBy).limit(query.pageSize).offset((query.page - 1) * query.pageSize);
+		const [totalRow] = await this.db.select({ value: count() }).from(courses).where(where);
+		return {
+			rows: rows.map(toCourse),
+			total: totalRow?.value ?? 0,
+			page: query.page,
+			pageSize: query.pageSize
+		};
+	}
+	async findById(orgId, id) {
+		const [row] = await this.db.select().from(courses).where(and(eq(courses.orgId, orgId), eq(courses.id, id))).limit(1);
+		return row ? toCourse(row) : null;
+	}
+	async create(orgId, input, slug) {
+		const id = genId("course");
+		await this.db.insert(contentItems).values({
+			orgId,
+			id,
+			type: "course"
+		});
+		const [inserted] = await this.db.insert(courses).values({
+			orgId,
+			id,
+			title: input.title,
+			slug,
+			description: input.description ?? "",
+			category: input.category ?? ""
+		}).returning({ id: courses.id });
+		if (!inserted) throw new Error("failed to insert course");
+		const created = await this.findById(orgId, inserted.id);
+		if (!created) throw new Error("failed to load created course");
+		return created;
+	}
+	async update(orgId, id, patch) {
+		const set = { updatedAt: /* @__PURE__ */ new Date() };
+		if (patch.title !== void 0) set.title = patch.title;
+		if (patch.description !== void 0) set.description = patch.description;
+		if (patch.category !== void 0) set.category = patch.category;
+		if (patch.status !== void 0) set.status = patch.status;
+		if (patch.thumbnailAssetId !== void 0) set.thumbnailAssetId = patch.thumbnailAssetId;
+		if (patch.settings !== void 0) set.settings = sql`${courses.settings} || ${JSON.stringify(patch.settings)}::jsonb`;
+		const [updated] = await this.db.update(courses).set(set).where(and(eq(courses.orgId, orgId), eq(courses.id, id))).returning({ id: courses.id });
+		if (!updated) return null;
+		return this.findById(orgId, id);
+	}
+	async delete(orgId, id) {
+		return (await this.db.delete(contentItems).where(and(eq(contentItems.orgId, orgId), eq(contentItems.id, id), eq(contentItems.type, "course"))).returning({ id: contentItems.id })).length > 0;
+	}
+	listForCourse(orgId, courseId) {
+		return this.tx((tx) => this.listModules(tx, orgId, courseId));
+	}
+	async listActivitiesForCourse(orgId, courseId) {
+		return this.db.select().from(activities).where(and(eq(activities.orgId, orgId), eq(activities.courseId, courseId))).orderBy(activities.moduleId, activities.seq);
+	}
+	async findActivity(orgId, activityId) {
+		const [row] = await this.db.select().from(activities).where(and(eq(activities.orgId, orgId), eq(activities.id, activityId))).limit(1);
+		return row ?? null;
+	}
+	async findModule(orgId, moduleId) {
+		const [row] = await this.db.select().from(modules).where(and(eq(modules.orgId, orgId), eq(modules.id, moduleId))).limit(1);
+		return row ?? null;
+	}
+	/** The course's full ordered module list. */
+	async listModules(tx, orgId, courseId) {
+		return tx.select().from(modules).where(and(eq(modules.orgId, orgId), eq(modules.courseId, courseId))).orderBy(modules.seq);
+	}
+	/** Assert the module belongs to the org + course; throw otherwise. */
+	async assertModule(tx, orgId, courseId, moduleId) {
+		const [row] = await tx.select({ id: modules.id }).from(modules).where(and(eq(modules.orgId, orgId), eq(modules.id, moduleId), eq(modules.courseId, courseId))).limit(1);
+		if (!row) throw new NotFoundError("Module", moduleId);
+	}
+	/** Replace an activity's ordered asset links with `assetIds`. */
+	async replaceActivityAssets(tx, orgId, activityId, assetIds) {
+		await tx.delete(activityAssets).where(and(eq(activityAssets.orgId, orgId), eq(activityAssets.activityId, activityId)));
+		if (assetIds.length) await tx.insert(activityAssets).values(assetIds.map((assetId, i) => ({
+			orgId,
+			activityId,
+			assetId,
+			seq: i
+		})));
+	}
+	createModule(orgId, courseId, title) {
+		return this.tx(async (tx) => {
+			const nextSeq = (await tx.select({ seq: modules.seq }).from(modules).where(and(eq(modules.orgId, orgId), eq(modules.courseId, courseId)))).reduce((max, r) => Math.max(max, r.seq), -1) + 1;
+			await tx.insert(modules).values({
+				orgId,
+				courseId,
+				title,
+				seq: nextSeq
+			});
+			return this.listModules(tx, orgId, courseId);
+		});
+	}
+	updateModule(orgId, courseId, moduleId, title) {
+		return this.tx(async (tx) => {
+			await this.assertModule(tx, orgId, courseId, moduleId);
+			await tx.update(modules).set({ title }).where(and(eq(modules.orgId, orgId), eq(modules.id, moduleId), eq(modules.courseId, courseId)));
+			return this.listModules(tx, orgId, courseId);
+		});
+	}
+	deleteModule(orgId, courseId, moduleId) {
+		return this.tx(async (tx) => {
+			await this.assertModule(tx, orgId, courseId, moduleId);
+			const activityIds = (await tx.select({ id: activities.id }).from(activities).where(and(eq(activities.orgId, orgId), eq(activities.moduleId, moduleId)))).map((a) => a.id);
+			if (activityIds.length) {
+				await tx.delete(activityAssets).where(and(eq(activityAssets.orgId, orgId), inArray(activityAssets.activityId, activityIds)));
+				await tx.delete(activities).where(and(eq(activities.orgId, orgId), eq(activities.moduleId, moduleId)));
+			}
+			await tx.delete(modules).where(and(eq(modules.orgId, orgId), eq(modules.id, moduleId), eq(modules.courseId, courseId)));
+			return this.listModules(tx, orgId, courseId);
+		});
+	}
+	reorderModules(orgId, courseId, orderedIds) {
+		return this.tx(async (tx) => {
+			for (let i = 0; i < orderedIds.length; i++) await tx.update(modules).set({ seq: i }).where(and(eq(modules.orgId, orgId), eq(modules.courseId, courseId), eq(modules.id, orderedIds[i])));
+			return this.listModules(tx, orgId, courseId);
+		});
+	}
+	reorderActivities(orgId, courseId, moduleId, orderedIds) {
+		return this.tx(async (tx) => {
+			await this.assertModule(tx, orgId, courseId, moduleId);
+			for (let i = 0; i < orderedIds.length; i++) await tx.update(activities).set({ seq: -(i + 1) }).where(and(eq(activities.orgId, orgId), eq(activities.moduleId, moduleId), eq(activities.id, orderedIds[i])));
+			for (let i = 0; i < orderedIds.length; i++) await tx.update(activities).set({ seq: i }).where(and(eq(activities.orgId, orgId), eq(activities.moduleId, moduleId), eq(activities.id, orderedIds[i])));
+			return this.listModules(tx, orgId, courseId);
+		});
+	}
+	saveActivity(orgId, courseId, moduleId, input, activityId) {
+		return this.tx(async (tx) => {
+			await this.assertModule(tx, orgId, courseId, moduleId);
+			let savedId;
+			if (activityId) {
+				const [existing] = await tx.select({ id: activities.id }).from(activities).where(and(eq(activities.orgId, orgId), eq(activities.id, activityId), eq(activities.moduleId, moduleId))).limit(1);
+				if (!existing) throw new NotFoundError("Activity", activityId);
+				await tx.update(activities).set({ settings: input.settings ?? null }).where(and(eq(activities.orgId, orgId), eq(activities.id, activityId)));
+				if (input.assetIds !== void 0) await this.replaceActivityAssets(tx, orgId, activityId, input.assetIds);
+				savedId = activityId;
+			} else {
+				const nextSeq = (await tx.select({ seq: activities.seq }).from(activities).where(and(eq(activities.orgId, orgId), eq(activities.moduleId, moduleId)))).reduce((max, r) => Math.max(max, r.seq), -1) + 1;
+				const [ins] = await tx.insert(activities).values({
+					orgId,
+					moduleId,
+					courseId,
+					seq: nextSeq,
+					settings: input.settings ?? null
+				}).returning({ id: activities.id });
+				if (!ins) throw new Error("failed to insert activity");
+				await this.replaceActivityAssets(tx, orgId, ins.id, input.assetIds ?? []);
+				savedId = ins.id;
+			}
+			const [activity] = await tx.select().from(activities).where(and(eq(activities.orgId, orgId), eq(activities.id, savedId))).limit(1);
+			if (!activity) throw new Error("failed to load saved activity");
+			return {
+				modules: await this.listModules(tx, orgId, courseId),
+				activity
+			};
+		});
+	}
+	deleteActivity(orgId, courseId, moduleId, activityId) {
+		return this.tx(async (tx) => {
+			await this.assertModule(tx, orgId, courseId, moduleId);
+			await tx.delete(activityAssets).where(and(eq(activityAssets.orgId, orgId), eq(activityAssets.activityId, activityId)));
+			await tx.delete(activities).where(and(eq(activities.orgId, orgId), eq(activities.id, activityId), eq(activities.moduleId, moduleId)));
+			return this.listModules(tx, orgId, courseId);
+		});
+	}
+	async listDownloads(orgId, query) {
+		const conditions = [eq(downloads.orgId, orgId)];
+		if (query.status) conditions.push(eq(downloads.status, query.status));
+		if (query.category) conditions.push(eq(downloads.category, query.category));
+		const search = query.search?.trim();
+		if (search) {
+			const like = `%${search}%`;
+			const match = or(ilike(downloads.title, like), ilike(downloads.category, like));
+			if (match) conditions.push(match);
+		}
+		const where = and(...conditions);
+		let sortKey = "createdAt";
+		let direction = "desc";
+		if (query.sort) {
+			const isDesc = query.sort.startsWith("-");
+			const key = isDesc ? query.sort.slice(1) : query.sort;
+			if (key in downloadSortColumns) {
+				sortKey = key;
+				direction = isDesc ? "desc" : "asc";
+			}
+		}
+		const sortExpr = downloadSortColumns[sortKey] ?? downloads.createdAt;
+		const orderBy = direction === "desc" ? desc(sortExpr) : asc(sortExpr);
+		const rows = await this.db.select().from(downloads).where(where).orderBy(orderBy).limit(query.pageSize).offset((query.page - 1) * query.pageSize);
+		const [totalRow] = await this.db.select({ value: count() }).from(downloads).where(where);
+		return {
+			rows: rows.map(toDownload),
+			total: totalRow?.value ?? 0,
+			page: query.page,
+			pageSize: query.pageSize
+		};
+	}
+	async getDownload(orgId, id) {
+		const [row] = await this.db.select().from(downloads).where(and(eq(downloads.orgId, orgId), eq(downloads.id, id))).limit(1);
+		return row ? toDownload(row) : null;
+	}
+	async createDownload(orgId, input, slug) {
+		const id = genId("download");
+		await this.db.insert(contentItems).values({
+			orgId,
+			id,
+			type: "download"
+		});
+		await this.db.insert(downloads).values({
+			orgId,
+			id,
+			title: input.title,
+			slug,
+			description: input.description ?? "",
+			category: input.category ?? ""
+		});
+		const created = await this.getDownload(orgId, id);
+		if (!created) throw new Error("failed to load created download");
+		return created;
+	}
+	async updateDownload(orgId, id, patch) {
+		const set = { updatedAt: /* @__PURE__ */ new Date() };
+		if (patch.title !== void 0) set.title = patch.title;
+		if (patch.description !== void 0) set.description = patch.description;
+		if (patch.category !== void 0) set.category = patch.category;
+		if (patch.status !== void 0) set.status = patch.status;
+		if (patch.thumbnailAssetId !== void 0) set.thumbnailAssetId = patch.thumbnailAssetId;
+		const [updated] = await this.db.update(downloads).set(set).where(and(eq(downloads.orgId, orgId), eq(downloads.id, id))).returning({ id: downloads.id });
+		if (!updated) return null;
+		return this.getDownload(orgId, id);
+	}
+	async deleteDownload(orgId, id) {
+		return (await this.db.delete(contentItems).where(and(eq(contentItems.orgId, orgId), eq(contentItems.id, id), eq(contentItems.type, "download"))).returning({ id: contentItems.id })).length > 0;
+	}
+	async listDownloadAssets(orgId, downloadId) {
+		return this.db.select().from(downloadAssets).where(and(eq(downloadAssets.orgId, orgId), eq(downloadAssets.downloadId, downloadId))).orderBy(asc(downloadAssets.seq));
+	}
+	/** Assert the download exists in the org; throw otherwise. */
+	async assertDownload(orgId, downloadId) {
+		const [row] = await this.db.select({ id: downloads.id }).from(downloads).where(and(eq(downloads.orgId, orgId), eq(downloads.id, downloadId))).limit(1);
+		if (!row) throw new NotFoundError("Download", downloadId);
+	}
+	async addDownloadAsset(orgId, downloadId, input) {
+		await this.assertDownload(orgId, downloadId);
+		const [maxRow] = await this.db.select({ maxSeq: sql`max(${downloadAssets.seq})` }).from(downloadAssets).where(and(eq(downloadAssets.orgId, orgId), eq(downloadAssets.downloadId, downloadId)));
+		const nextSeq = (maxRow?.maxSeq ?? -1) + 1;
+		try {
+			await this.db.insert(downloadAssets).values({
+				orgId,
+				downloadId,
+				assetId: input.assetId,
+				seq: nextSeq,
+				displayName: input.displayName ?? null
+			});
+		} catch (err) {
+			if (isUniqueViolation(err)) throw new ConflictError("This asset is already linked to the download");
+			throw err;
+		}
+		return this.listDownloadAssets(orgId, downloadId);
+	}
+	async removeDownloadAsset(orgId, downloadId, assetId) {
+		await this.assertDownload(orgId, downloadId);
+		await this.db.delete(downloadAssets).where(and(eq(downloadAssets.orgId, orgId), eq(downloadAssets.downloadId, downloadId), eq(downloadAssets.assetId, assetId)));
+		return this.listDownloadAssets(orgId, downloadId);
+	}
+	async renameDownloadAsset(orgId, downloadId, assetId, displayName) {
+		await this.assertDownload(orgId, downloadId);
+		await this.db.update(downloadAssets).set({ displayName }).where(and(eq(downloadAssets.orgId, orgId), eq(downloadAssets.downloadId, downloadId), eq(downloadAssets.assetId, assetId)));
+		return this.listDownloadAssets(orgId, downloadId);
+	}
+	async reorderDownloadAssets(orgId, downloadId, assetIds) {
+		await this.assertDownload(orgId, downloadId);
+		for (const [seq, assetId] of assetIds.entries()) await this.db.update(downloadAssets).set({ seq }).where(and(eq(downloadAssets.orgId, orgId), eq(downloadAssets.downloadId, downloadId), eq(downloadAssets.assetId, assetId)));
+		return this.listDownloadAssets(orgId, downloadId);
+	}
+};
+//#endregion
+export { DrizzleContentRepository };
+
+//# sourceMappingURL=content.js.map

package/dist/repositories/content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.js","names":[],"sources":["../../src/repositories/content.ts"],"sourcesContent":["// content — Drizzle repository for the course aggregate root (implements the core\n// outbound `ContentRepository` port). Org-scoped: every method takes the domain\n// `organizations.id` and constrains its queries to that tenant. Rows come back\n// as stored — derived counts and cross-entity composition live in reporting.\nimport {\n  eq,\n  and,\n  sql,\n  count,\n  asc,\n  desc,\n  ilike,\n  or,\n  inArray,\n  type SQL,\n  type AnyColumn,\n} from 'drizzle-orm';\nimport type { NodePgDatabase } from 'drizzle-orm/node-postgres';\nimport type { DbExecutor, Tx } from '../client.js';\nimport type {\n  Activity,\n  AddDownloadAssetInput,\n  ContentRepository,\n  Course,\n  CourseStatus,\n  CreateCourseInput,\n  CreateDownloadInput,\n  Download,\n  DownloadAsset,\n  DownloadStatus,\n  ListCoursesQuery,\n  ListDownloadsQuery,\n  Module,\n  Page,\n  SaveActivityInput,\n  UpdateCourseInput,\n  UpdateDownloadInput,\n} from '@headless-lms/core/content';\nimport {\n  contentItems,\n  courses,\n  modules,\n  activities,\n  activityAssets,\n  downloads,\n  downloadAssets,\n} from '../schema/content.js';\nimport { genId } from '@headless-lms/core/shared/id';\nimport type { Logger } from '@headless-lms/core/shared/ports';\nimport { noopLogger } from '@headless-lms/core/shared/logger';\nimport { NotFoundError, ConflictError } from '@headless-lms/core/shared/errors';\nimport { isUniqueViolation } from './pg-errors.js';\n\nfunction toCourse(row: typeof courses.$inferSelect): Course {\n  return { ...row, status: row.status as CourseStatus };\n}\n\n// Columns a caller may sort by. Default falls back to createdAt desc.\nconst sortColumns: Record<string, AnyColumn | SQL> = {\n  title: courses.title,\n  slug: courses.slug,\n  status: courses.status,\n  category: courses.category,\n  createdAt: courses.createdAt,\n  updatedAt: courses.updatedAt,\n};\n\nconst downloadSortColumns: Record<string, AnyColumn | SQL> = {\n  title: downloads.title,\n  slug: downloads.slug,\n  status: downloads.status,\n  category: downloads.category,\n  createdAt: downloads.createdAt,\n  updatedAt: downloads.updatedAt,\n};\n\nfunction toDownload(row: typeof downloads.$inferSelect): Download {\n  return { ...row, status: row.status as DownloadStatus };\n}\n\nexport class DrizzleContentRepository implements ContentRepository {\n  constructor(\n    private readonly db: DbExecutor,\n    private readonly logger: Logger = noopLogger,\n  ) {}\n\n  /** On the root db this opens a transaction; tx-bound (ContentUnitOfWork) it\n   *  nests as a savepoint inside the surrounding transaction. */\n  private tx<T>(fn: (tx: Tx) => Promise<T>): Promise<T> {\n    return (this.db as NodePgDatabase).transaction(fn);\n  }\n\n  async list(orgId: string, query: ListCoursesQuery): Promise<Page<Course>> {\n    const conditions: SQL[] = [eq(courses.orgId, orgId)];\n    if (query.status) {\n      conditions.push(eq(courses.status, query.status));\n    }\n    if (query.category) {\n      conditions.push(eq(courses.category, query.category));\n    }\n\n    const search = query.search?.trim();\n    if (search) {\n      const like = `%${search}%`;\n      const match = or(ilike(courses.title, like), ilike(courses.category, like));\n      if (match) {\n        conditions.push(match);\n      }\n    }\n\n    const where = and(...conditions);\n\n    // Resolve sort: `-` prefix = desc, default createdAt desc.\n    let sortKey = 'createdAt';\n    let direction: 'asc' | 'desc' = 'desc';\n    if (query.sort) {\n      const isDesc = query.sort.startsWith('-');\n      const key = isDesc ? query.sort.slice(1) : query.sort;\n      if (key in sortColumns) {\n        sortKey = key;\n        direction = isDesc ? 'desc' : 'asc';\n      }\n    }\n    const sortExpr = sortColumns[sortKey] ?? courses.createdAt;\n    const orderBy = direction === 'desc' ? desc(sortExpr) : asc(sortExpr);\n\n    const rows = await this.db\n      .select()\n      .from(courses)\n      .where(where)\n      .orderBy(orderBy)\n      .limit(query.pageSize)\n      .offset((query.page - 1) * query.pageSize);\n\n    const [totalRow] = await this.db.select({ value: count() }).from(courses).where(where);\n\n    return {\n      rows: rows.map(toCourse),\n      total: totalRow?.value ?? 0,\n      page: query.page,\n      pageSize: query.pageSize,\n    };\n  }\n\n  async findById(orgId: string, id: string): Promise<Course | null> {\n    const [row] = await this.db\n      .select()\n      .from(courses)\n      .where(and(eq(courses.orgId, orgId), eq(courses.id, id)))\n      .limit(1);\n    return row ? toCourse(row) : null;\n  }\n\n  async create(orgId: string, input: CreateCourseInput, slug: string): Promise<Course> {\n    // Registry row + concrete row share one id. Both inserts run on the same\n    // executor — mutations reach this repository tx-bound (ContentUnitOfWork),\n    // so they commit or roll back together.\n    const id = genId('course');\n    await this.db.insert(contentItems).values({ orgId, id, type: 'course' });\n    const [inserted] = await this.db\n      .insert(courses)\n      .values({\n        orgId,\n        id,\n        title: input.title,\n        slug,\n        description: input.description ?? '',\n        category: input.category ?? '',\n      })\n      .returning({ id: courses.id });\n    if (!inserted) {\n      throw new Error('failed to insert course');\n    }\n    const created = await this.findById(orgId, inserted.id);\n    if (!created) {\n      throw new Error('failed to load created course');\n    }\n    return created;\n  }\n\n  async update(orgId: string, id: string, patch: UpdateCourseInput): Promise<Course | null> {\n    const set: Record<string, unknown> = { updatedAt: new Date() };\n    if (patch.title !== undefined) {\n      set.title = patch.title;\n    }\n    if (patch.description !== undefined) {\n      set.description = patch.description;\n    }\n    if (patch.category !== undefined) {\n      set.category = patch.category;\n    }\n    if (patch.status !== undefined) {\n      set.status = patch.status;\n    }\n    // null is meaningful here — it clears the cover — so only `undefined` skips.\n    if (patch.thumbnailAssetId !== undefined) {\n      set.thumbnailAssetId = patch.thumbnailAssetId;\n    }\n    if (patch.settings !== undefined) {\n      // Shallow merge, so a partial patch can't drop the keys it omits.\n      set.settings = sql`${courses.settings} || ${JSON.stringify(patch.settings)}::jsonb`;\n    }\n\n    const [updated] = await this.db\n      .update(courses)\n      .set(set)\n      .where(and(eq(courses.orgId, orgId), eq(courses.id, id)))\n      .returning({ id: courses.id });\n    if (!updated) {\n      return null;\n    }\n    return this.findById(orgId, id);\n  }\n\n  async delete(orgId: string, id: string): Promise<boolean> {\n    // Deletes go through the registry: cascades to the course row and its\n    // entitlements in one statement. Never delete from `courses` directly —\n    // that would strand the registry row.\n    const deleted = await this.db\n      .delete(contentItems)\n      .where(\n        and(eq(contentItems.orgId, orgId), eq(contentItems.id, id), eq(contentItems.type, 'course')),\n      )\n      .returning({ id: contentItems.id });\n    return deleted.length > 0;\n  }\n\n  // --- modules & activities ----------------------------------------------\n  // Every mutation returns the course's full ordered module list (by `seq`),\n  // so `listModules` runs at the end of every mutation within the same\n  // transaction. An Activity's media is the many-to-many `activity_assets`\n  // join: `saveActivity` upserts the row and replaces its asset links; deletes\n  // drop the links first (they FK the activity), then the activity rows.\n\n  listForCourse(orgId: string, courseId: string): Promise<Module[]> {\n    return this.tx((tx) => this.listModules(tx, orgId, courseId));\n  }\n\n  async listActivitiesForCourse(orgId: string, courseId: string): Promise<Activity[]> {\n    return this.db\n      .select()\n      .from(activities)\n      .where(and(eq(activities.orgId, orgId), eq(activities.courseId, courseId)))\n      .orderBy(activities.moduleId, activities.seq);\n  }\n\n  async findActivity(orgId: string, activityId: string): Promise<Activity | null> {\n    const [row] = await this.db\n      .select()\n      .from(activities)\n      .where(and(eq(activities.orgId, orgId), eq(activities.id, activityId)))\n      .limit(1);\n    return row ?? null;\n  }\n\n  async findModule(orgId: string, moduleId: string): Promise<Module | null> {\n    const [row] = await this.db\n      .select()\n      .from(modules)\n      .where(and(eq(modules.orgId, orgId), eq(modules.id, moduleId)))\n      .limit(1);\n    return row ?? null;\n  }\n\n  /** The course's full ordered module list. */\n  private async listModules(tx: Tx, orgId: string, courseId: string): Promise<Module[]> {\n    return tx\n      .select()\n      .from(modules)\n      .where(and(eq(modules.orgId, orgId), eq(modules.courseId, courseId)))\n      .orderBy(modules.seq);\n  }\n\n  /** Assert the module belongs to the org + course; throw otherwise. */\n  private async assertModule(\n    tx: Tx,\n    orgId: string,\n    courseId: string,\n    moduleId: string,\n  ): Promise<void> {\n    const [row] = await tx\n      .select({ id: modules.id })\n      .from(modules)\n      .where(\n        and(eq(modules.orgId, orgId), eq(modules.id, moduleId), eq(modules.courseId, courseId)),\n      )\n      .limit(1);\n    if (!row) {\n      throw new NotFoundError('Module', moduleId);\n    }\n  }\n\n  /** Replace an activity's ordered asset links with `assetIds`. */\n  private async replaceActivityAssets(\n    tx: Tx,\n    orgId: string,\n    activityId: string,\n    assetIds: string[],\n  ): Promise<void> {\n    await tx\n      .delete(activityAssets)\n      .where(and(eq(activityAssets.orgId, orgId), eq(activityAssets.activityId, activityId)));\n    if (assetIds.length) {\n      await tx\n        .insert(activityAssets)\n        .values(assetIds.map((assetId, i) => ({ orgId, activityId, assetId, seq: i })));\n    }\n  }\n\n  createModule(orgId: string, courseId: string, title: string): Promise<Module[]> {\n    return this.tx(async (tx) => {\n      const existing = await tx\n        .select({ seq: modules.seq })\n        .from(modules)\n        .where(and(eq(modules.orgId, orgId), eq(modules.courseId, courseId)));\n      const nextSeq = existing.reduce((max, r) => Math.max(max, r.seq), -1) + 1;\n      await tx.insert(modules).values({ orgId, courseId, title, seq: nextSeq });\n      return this.listModules(tx, orgId, courseId);\n    });\n  }\n\n  updateModule(\n    orgId: string,\n    courseId: string,\n    moduleId: string,\n    title: string,\n  ): Promise<Module[]> {\n    return this.tx(async (tx) => {\n      await this.assertModule(tx, orgId, courseId, moduleId);\n      await tx\n        .update(modules)\n        .set({ title })\n        .where(\n          and(eq(modules.orgId, orgId), eq(modules.id, moduleId), eq(modules.courseId, courseId)),\n        );\n      return this.listModules(tx, orgId, courseId);\n    });\n  }\n\n  deleteModule(orgId: string, courseId: string, moduleId: string): Promise<Module[]> {\n    return this.tx(async (tx) => {\n      await this.assertModule(tx, orgId, courseId, moduleId);\n\n      // Drop the module's activities: their asset links first (they FK the\n      // activity), then the activity rows, then the module.\n      const activityRows = await tx\n        .select({ id: activities.id })\n        .from(activities)\n        .where(and(eq(activities.orgId, orgId), eq(activities.moduleId, moduleId)));\n      const activityIds = activityRows.map((a) => a.id);\n\n      if (activityIds.length) {\n        await tx\n          .delete(activityAssets)\n          .where(\n            and(eq(activityAssets.orgId, orgId), inArray(activityAssets.activityId, activityIds)),\n          );\n        await tx\n          .delete(activities)\n          .where(and(eq(activities.orgId, orgId), eq(activities.moduleId, moduleId)));\n      }\n\n      await tx\n        .delete(modules)\n        .where(\n          and(eq(modules.orgId, orgId), eq(modules.id, moduleId), eq(modules.courseId, courseId)),\n        );\n      return this.listModules(tx, orgId, courseId);\n    });\n  }\n\n  reorderModules(orgId: string, courseId: string, orderedIds: string[]): Promise<Module[]> {\n    return this.tx(async (tx) => {\n      // Two-phase to dodge the unique(org_id, id) is fine, but modules have no\n      // unique(seq); still, park then assign to stay consistent with activities.\n      for (let i = 0; i < orderedIds.length; i++) {\n        await tx\n          .update(modules)\n          .set({ seq: i })\n          .where(\n            and(\n              eq(modules.orgId, orgId),\n              eq(modules.courseId, courseId),\n              eq(modules.id, orderedIds[i]!),\n            ),\n          );\n      }\n      return this.listModules(tx, orgId, courseId);\n    });\n  }\n\n  reorderActivities(\n    orgId: string,\n    courseId: string,\n    moduleId: string,\n    orderedIds: string[],\n  ): Promise<Module[]> {\n    return this.tx(async (tx) => {\n      await this.assertModule(tx, orgId, courseId, moduleId);\n      // Two-phase to dodge the unique(org_id, module_id, seq) constraint mid-swap:\n      // park rows at negative seqs, then assign the final 0..n-1.\n      for (let i = 0; i < orderedIds.length; i++) {\n        await tx\n          .update(activities)\n          .set({ seq: -(i + 1) })\n          .where(\n            and(\n              eq(activities.orgId, orgId),\n              eq(activities.moduleId, moduleId),\n              eq(activities.id, orderedIds[i]!),\n            ),\n          );\n      }\n      for (let i = 0; i < orderedIds.length; i++) {\n        await tx\n          .update(activities)\n          .set({ seq: i })\n          .where(\n            and(\n              eq(activities.orgId, orgId),\n              eq(activities.moduleId, moduleId),\n              eq(activities.id, orderedIds[i]!),\n            ),\n          );\n      }\n      return this.listModules(tx, orgId, courseId);\n    });\n  }\n\n  saveActivity(\n    orgId: string,\n    courseId: string,\n    moduleId: string,\n    input: SaveActivityInput,\n    activityId?: string,\n  ): Promise<{ modules: Module[]; activity: Activity }> {\n    return this.tx(async (tx) => {\n      await this.assertModule(tx, orgId, courseId, moduleId);\n\n      let savedId: string;\n      if (activityId) {\n        const [existing] = await tx\n          .select({ id: activities.id })\n          .from(activities)\n          .where(\n            and(\n              eq(activities.orgId, orgId),\n              eq(activities.id, activityId),\n              eq(activities.moduleId, moduleId),\n            ),\n          )\n          .limit(1);\n        if (!existing) {\n          throw new NotFoundError('Activity', activityId);\n        }\n\n        await tx\n          .update(activities)\n          .set({ settings: input.settings ?? null })\n          .where(and(eq(activities.orgId, orgId), eq(activities.id, activityId)));\n        if (input.assetIds !== undefined) {\n          await this.replaceActivityAssets(tx, orgId, activityId, input.assetIds);\n        }\n        savedId = activityId;\n      } else {\n        const existing = await tx\n          .select({ seq: activities.seq })\n          .from(activities)\n          .where(and(eq(activities.orgId, orgId), eq(activities.moduleId, moduleId)));\n        const nextSeq = existing.reduce((max, r) => Math.max(max, r.seq), -1) + 1;\n\n        const [ins] = await tx\n          .insert(activities)\n          .values({ orgId, moduleId, courseId, seq: nextSeq, settings: input.settings ?? null })\n          .returning({ id: activities.id });\n        if (!ins) {\n          throw new Error('failed to insert activity');\n        }\n        await this.replaceActivityAssets(tx, orgId, ins.id, input.assetIds ?? []);\n        savedId = ins.id;\n      }\n\n      const [activity] = await tx\n        .select()\n        .from(activities)\n        .where(and(eq(activities.orgId, orgId), eq(activities.id, savedId)))\n        .limit(1);\n      if (!activity) {\n        throw new Error('failed to load saved activity');\n      }\n      return { modules: await this.listModules(tx, orgId, courseId), activity };\n    });\n  }\n\n  deleteActivity(\n    orgId: string,\n    courseId: string,\n    moduleId: string,\n    activityId: string,\n  ): Promise<Module[]> {\n    return this.tx(async (tx) => {\n      await this.assertModule(tx, orgId, courseId, moduleId);\n\n      // Drop the asset links first (they FK the activity), then the activity.\n      await tx\n        .delete(activityAssets)\n        .where(and(eq(activityAssets.orgId, orgId), eq(activityAssets.activityId, activityId)));\n      await tx\n        .delete(activities)\n        .where(\n          and(\n            eq(activities.orgId, orgId),\n            eq(activities.id, activityId),\n            eq(activities.moduleId, moduleId),\n          ),\n        );\n\n      return this.listModules(tx, orgId, courseId);\n    });\n  }\n\n  // --- downloads --------------------------------------------------------\n\n  async listDownloads(orgId: string, query: ListDownloadsQuery): Promise<Page<Download>> {\n    const conditions: SQL[] = [eq(downloads.orgId, orgId)];\n    if (query.status) {\n      conditions.push(eq(downloads.status, query.status));\n    }\n    if (query.category) {\n      conditions.push(eq(downloads.category, query.category));\n    }\n\n    const search = query.search?.trim();\n    if (search) {\n      const like = `%${search}%`;\n      const match = or(ilike(downloads.title, like), ilike(downloads.category, like));\n      if (match) {\n        conditions.push(match);\n      }\n    }\n\n    const where = and(...conditions);\n\n    // Resolve sort: `-` prefix = desc, default createdAt desc.\n    let sortKey = 'createdAt';\n    let direction: 'asc' | 'desc' = 'desc';\n    if (query.sort) {\n      const isDesc = query.sort.startsWith('-');\n      const key = isDesc ? query.sort.slice(1) : query.sort;\n      if (key in downloadSortColumns) {\n        sortKey = key;\n        direction = isDesc ? 'desc' : 'asc';\n      }\n    }\n    const sortExpr = downloadSortColumns[sortKey] ?? downloads.createdAt;\n    const orderBy = direction === 'desc' ? desc(sortExpr) : asc(sortExpr);\n\n    const rows = await this.db\n      .select()\n      .from(downloads)\n      .where(where)\n      .orderBy(orderBy)\n      .limit(query.pageSize)\n      .offset((query.page - 1) * query.pageSize);\n\n    const [totalRow] = await this.db.select({ value: count() }).from(downloads).where(where);\n\n    return {\n      rows: rows.map(toDownload),\n      total: totalRow?.value ?? 0,\n      page: query.page,\n      pageSize: query.pageSize,\n    };\n  }\n\n  async getDownload(orgId: string, id: string): Promise<Download | null> {\n    const [row] = await this.db\n      .select()\n      .from(downloads)\n      .where(and(eq(downloads.orgId, orgId), eq(downloads.id, id)))\n      .limit(1);\n    return row ? toDownload(row) : null;\n  }\n\n  async createDownload(\n    orgId: string,\n    input: CreateDownloadInput,\n    slug: string,\n  ): Promise<Download> {\n    // Registry row + concrete row share one id, same as courses. Both inserts\n    // run on the same executor — mutations reach this repository tx-bound.\n    const id = genId('download');\n    await this.db.insert(contentItems).values({ orgId, id, type: 'download' });\n    await this.db.insert(downloads).values({\n      orgId,\n      id,\n      title: input.title,\n      slug,\n      description: input.description ?? '',\n      category: input.category ?? '',\n    });\n    const created = await this.getDownload(orgId, id);\n    if (!created) {\n      throw new Error('failed to load created download');\n    }\n    return created;\n  }\n\n  async updateDownload(\n    orgId: string,\n    id: string,\n    patch: UpdateDownloadInput,\n  ): Promise<Download | null> {\n    const set: Record<string, unknown> = { updatedAt: new Date() };\n    if (patch.title !== undefined) {\n      set.title = patch.title;\n    }\n    if (patch.description !== undefined) {\n      set.description = patch.description;\n    }\n    if (patch.category !== undefined) {\n      set.category = patch.category;\n    }\n    if (patch.status !== undefined) {\n      set.status = patch.status;\n    }\n    if (patch.thumbnailAssetId !== undefined) {\n      set.thumbnailAssetId = patch.thumbnailAssetId;\n    }\n\n    const [updated] = await this.db\n      .update(downloads)\n      .set(set)\n      .where(and(eq(downloads.orgId, orgId), eq(downloads.id, id)))\n      .returning({ id: downloads.id });\n    if (!updated) {\n      return null;\n    }\n    return this.getDownload(orgId, id);\n  }\n\n  async deleteDownload(orgId: string, id: string): Promise<boolean> {\n    // Through the registry, so the cascade reaches the download row, its asset\n    // links, and the grants. Never delete from `downloads` directly.\n    const deleted = await this.db\n      .delete(contentItems)\n      .where(\n        and(\n          eq(contentItems.orgId, orgId),\n          eq(contentItems.id, id),\n          eq(contentItems.type, 'download'),\n        ),\n      )\n      .returning({ id: contentItems.id });\n    return deleted.length > 0;\n  }\n\n  async listDownloadAssets(orgId: string, downloadId: string): Promise<DownloadAsset[]> {\n    return this.db\n      .select()\n      .from(downloadAssets)\n      .where(and(eq(downloadAssets.orgId, orgId), eq(downloadAssets.downloadId, downloadId)))\n      .orderBy(asc(downloadAssets.seq));\n  }\n\n  /** Assert the download exists in the org; throw otherwise. */\n  private async assertDownload(orgId: string, downloadId: string): Promise<void> {\n    const [row] = await this.db\n      .select({ id: downloads.id })\n      .from(downloads)\n      .where(and(eq(downloads.orgId, orgId), eq(downloads.id, downloadId)))\n      .limit(1);\n    if (!row) {\n      throw new NotFoundError('Download', downloadId);\n    }\n  }\n\n  async addDownloadAsset(\n    orgId: string,\n    downloadId: string,\n    input: AddDownloadAssetInput,\n  ): Promise<DownloadAsset[]> {\n    await this.assertDownload(orgId, downloadId);\n    const [maxRow] = await this.db\n      .select({ maxSeq: sql<number | null>`max(${downloadAssets.seq})` })\n      .from(downloadAssets)\n      .where(and(eq(downloadAssets.orgId, orgId), eq(downloadAssets.downloadId, downloadId)));\n    const nextSeq = (maxRow?.maxSeq ?? -1) + 1;\n    try {\n      await this.db.insert(downloadAssets).values({\n        orgId,\n        downloadId,\n        assetId: input.assetId,\n        seq: nextSeq,\n        displayName: input.displayName ?? null,\n      });\n    } catch (err) {\n      if (isUniqueViolation(err)) {\n        throw new ConflictError('This asset is already linked to the download');\n      }\n      throw err;\n    }\n    return this.listDownloadAssets(orgId, downloadId);\n  }\n\n  async removeDownloadAsset(\n    orgId: string,\n    downloadId: string,\n    assetId: string,\n  ): Promise<DownloadAsset[]> {\n    await this.assertDownload(orgId, downloadId);\n    await this.db\n      .delete(downloadAssets)\n      .where(\n        and(\n          eq(downloadAssets.orgId, orgId),\n          eq(downloadAssets.downloadId, downloadId),\n          eq(downloadAssets.assetId, assetId),\n        ),\n      );\n    return this.listDownloadAssets(orgId, downloadId);\n  }\n\n  async renameDownloadAsset(\n    orgId: string,\n    downloadId: string,\n    assetId: string,\n    displayName: string | null,\n  ): Promise<DownloadAsset[]> {\n    await this.assertDownload(orgId, downloadId);\n    await this.db\n      .update(downloadAssets)\n      .set({ displayName })\n      .where(\n        and(\n          eq(downloadAssets.orgId, orgId),\n          eq(downloadAssets.downloadId, downloadId),\n          eq(downloadAssets.assetId, assetId),\n        ),\n      );\n    return this.listDownloadAssets(orgId, downloadId);\n  }\n\n  async reorderDownloadAssets(\n    orgId: string,\n    downloadId: string,\n    assetIds: string[],\n  ): Promise<DownloadAsset[]> {\n    await this.assertDownload(orgId, downloadId);\n    // The service has already verified this is exactly the current set.\n    for (const [seq, assetId] of assetIds.entries()) {\n      await this.db\n        .update(downloadAssets)\n        .set({ seq })\n        .where(\n          and(\n            eq(downloadAssets.orgId, orgId),\n            eq(downloadAssets.downloadId, downloadId),\n            eq(downloadAssets.assetId, assetId),\n          ),\n        );\n    }\n    return this.listDownloadAssets(orgId, downloadId);\n  }\n}\n"],"mappings":";;;;;;;AAqDA,SAAS,SAAS,KAA0C;CAC1D,OAAO;EAAE,GAAG;EAAK,QAAQ,IAAI;CAAuB;AACtD;AAGA,MAAM,cAA+C;CACnD,OAAO,QAAQ;CACf,MAAM,QAAQ;CACd,QAAQ,QAAQ;CAChB,UAAU,QAAQ;CAClB,WAAW,QAAQ;CACnB,WAAW,QAAQ;AACrB;AAEA,MAAM,sBAAuD;CAC3D,OAAO,UAAU;CACjB,MAAM,UAAU;CAChB,QAAQ,UAAU;CAClB,UAAU,UAAU;CACpB,WAAW,UAAU;CACrB,WAAW,UAAU;AACvB;AAEA,SAAS,WAAW,KAA8C;CAChE,OAAO;EAAE,GAAG;EAAK,QAAQ,IAAI;CAAyB;AACxD;AAEA,IAAa,2BAAb,MAAmE;CAE9C;CACA;CAFnB,YACE,IACA,SAAkC,YAClC;EAFiB,KAAA,KAAA;EACA,KAAA,SAAA;CAChB;;;CAIH,GAAc,IAAwC;EACpD,OAAQ,KAAK,GAAsB,YAAY,EAAE;CACnD;CAEA,MAAM,KAAK,OAAe,OAAgD;EACxE,MAAM,aAAoB,CAAC,GAAG,QAAQ,OAAO,KAAK,CAAC;EACnD,IAAI,MAAM,QACR,WAAW,KAAK,GAAG,QAAQ,QAAQ,MAAM,MAAM,CAAC;EAElD,IAAI,MAAM,UACR,WAAW,KAAK,GAAG,QAAQ,UAAU,MAAM,QAAQ,CAAC;EAGtD,MAAM,SAAS,MAAM,QAAQ,KAAK;EAClC,IAAI,QAAQ;GACV,MAAM,OAAO,IAAI,OAAO;GACxB,MAAM,QAAQ,GAAG,MAAM,QAAQ,OAAO,IAAI,GAAG,MAAM,QAAQ,UAAU,IAAI,CAAC;GAC1E,IAAI,OACF,WAAW,KAAK,KAAK;EAEzB;EAEA,MAAM,QAAQ,IAAI,GAAG,UAAU;EAG/B,IAAI,UAAU;EACd,IAAI,YAA4B;EAChC,IAAI,MAAM,MAAM;GACd,MAAM,SAAS,MAAM,KAAK,WAAW,GAAG;GACxC,MAAM,MAAM,SAAS,MAAM,KAAK,MAAM,CAAC,IAAI,MAAM;GACjD,IAAI,OAAO,aAAa;IACtB,UAAU;IACV,YAAY,SAAS,SAAS;GAChC;EACF;EACA,MAAM,WAAW,YAAY,YAAY,QAAQ;EACjD,MAAM,UAAU,cAAc,SAAS,KAAK,QAAQ,IAAI,IAAI,QAAQ;EAEpE,MAAM,OAAO,MAAM,KAAK,GACrB,OAAO,CAAC,CACR,KAAK,OAAO,CAAC,CACb,MAAM,KAAK,CAAC,CACZ,QAAQ,OAAO,CAAC,CAChB,MAAM,MAAM,QAAQ,CAAC,CACrB,QAAQ,MAAM,OAAO,KAAK,MAAM,QAAQ;EAE3C,MAAM,CAAC,YAAY,MAAM,KAAK,GAAG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,MAAM,KAAK;EAErF,OAAO;GACL,MAAM,KAAK,IAAI,QAAQ;GACvB,OAAO,UAAU,SAAS;GAC1B,MAAM,MAAM;GACZ,UAAU,MAAM;EAClB;CACF;CAEA,MAAM,SAAS,OAAe,IAAoC;EAChE,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,CAAC,CACR,KAAK,OAAO,CAAC,CACb,MAAM,IAAI,GAAG,QAAQ,OAAO,KAAK,GAAG,GAAG,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CACxD,MAAM,CAAC;EACV,OAAO,MAAM,SAAS,GAAG,IAAI;CAC/B;CAEA,MAAM,OAAO,OAAe,OAA0B,MAA+B;EAInF,MAAM,KAAK,MAAM,QAAQ;EACzB,MAAM,KAAK,GAAG,OAAO,YAAY,CAAC,CAAC,OAAO;GAAE;GAAO;GAAI,MAAM;EAAS,CAAC;EACvE,MAAM,CAAC,YAAY,MAAM,KAAK,GAC3B,OAAO,OAAO,CAAC,CACf,OAAO;GACN;GACA;GACA,OAAO,MAAM;GACb;GACA,aAAa,MAAM,eAAe;GAClC,UAAU,MAAM,YAAY;EAC9B,CAAC,CAAC,CACD,UAAU,EAAE,IAAI,QAAQ,GAAG,CAAC;EAC/B,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,yBAAyB;EAE3C,MAAM,UAAU,MAAM,KAAK,SAAS,OAAO,SAAS,EAAE;EACtD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,+BAA+B;EAEjD,OAAO;CACT;CAEA,MAAM,OAAO,OAAe,IAAY,OAAkD;EACxF,MAAM,MAA+B,EAAE,2BAAW,IAAI,KAAK,EAAE;EAC7D,IAAI,MAAM,UAAU,KAAA,GAClB,IAAI,QAAQ,MAAM;EAEpB,IAAI,MAAM,gBAAgB,KAAA,GACxB,IAAI,cAAc,MAAM;EAE1B,IAAI,MAAM,aAAa,KAAA,GACrB,IAAI,WAAW,MAAM;EAEvB,IAAI,MAAM,WAAW,KAAA,GACnB,IAAI,SAAS,MAAM;EAGrB,IAAI,MAAM,qBAAqB,KAAA,GAC7B,IAAI,mBAAmB,MAAM;EAE/B,IAAI,MAAM,aAAa,KAAA,GAErB,IAAI,WAAW,GAAG,GAAG,QAAQ,SAAS,MAAM,KAAK,UAAU,MAAM,QAAQ,EAAE;EAG7E,MAAM,CAAC,WAAW,MAAM,KAAK,GAC1B,OAAO,OAAO,CAAC,CACf,IAAI,GAAG,CAAC,CACR,MAAM,IAAI,GAAG,QAAQ,OAAO,KAAK,GAAG,GAAG,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CACxD,UAAU,EAAE,IAAI,QAAQ,GAAG,CAAC;EAC/B,IAAI,CAAC,SACH,OAAO;EAET,OAAO,KAAK,SAAS,OAAO,EAAE;CAChC;CAEA,MAAM,OAAO,OAAe,IAA8B;EAUxD,QAAO,MANe,KAAK,GACxB,OAAO,YAAY,CAAC,CACpB,MACC,IAAI,GAAG,aAAa,OAAO,KAAK,GAAG,GAAG,aAAa,IAAI,EAAE,GAAG,GAAG,aAAa,MAAM,QAAQ,CAAC,CAC7F,CAAC,CACA,UAAU,EAAE,IAAI,aAAa,GAAG,CAAC,EAAA,CACrB,SAAS;CAC1B;CASA,cAAc,OAAe,UAAqC;EAChE,OAAO,KAAK,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,QAAQ,CAAC;CAC9D;CAEA,MAAM,wBAAwB,OAAe,UAAuC;EAClF,OAAO,KAAK,GACT,OAAO,CAAC,CACR,KAAK,UAAU,CAAC,CAChB,MAAM,IAAI,GAAG,WAAW,OAAO,KAAK,GAAG,GAAG,WAAW,UAAU,QAAQ,CAAC,CAAC,CAAC,CAC1E,QAAQ,WAAW,UAAU,WAAW,GAAG;CAChD;CAEA,MAAM,aAAa,OAAe,YAA8C;EAC9E,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,CAAC,CACR,KAAK,UAAU,CAAC,CAChB,MAAM,IAAI,GAAG,WAAW,OAAO,KAAK,GAAG,GAAG,WAAW,IAAI,UAAU,CAAC,CAAC,CAAC,CACtE,MAAM,CAAC;EACV,OAAO,OAAO;CAChB;CAEA,MAAM,WAAW,OAAe,UAA0C;EACxE,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,CAAC,CACR,KAAK,OAAO,CAAC,CACb,MAAM,IAAI,GAAG,QAAQ,OAAO,KAAK,GAAG,GAAG,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,CAC9D,MAAM,CAAC;EACV,OAAO,OAAO;CAChB;;CAGA,MAAc,YAAY,IAAQ,OAAe,UAAqC;EACpF,OAAO,GACJ,OAAO,CAAC,CACR,KAAK,OAAO,CAAC,CACb,MAAM,IAAI,GAAG,QAAQ,OAAO,KAAK,GAAG,GAAG,QAAQ,UAAU,QAAQ,CAAC,CAAC,CAAC,CACpE,QAAQ,QAAQ,GAAG;CACxB;;CAGA,MAAc,aACZ,IACA,OACA,UACA,UACe;EACf,MAAM,CAAC,OAAO,MAAM,GACjB,OAAO,EAAE,IAAI,QAAQ,GAAG,CAAC,CAAC,CAC1B,KAAK,OAAO,CAAC,CACb,MACC,IAAI,GAAG,QAAQ,OAAO,KAAK,GAAG,GAAG,QAAQ,IAAI,QAAQ,GAAG,GAAG,QAAQ,UAAU,QAAQ,CAAC,CACxF,CAAC,CACA,MAAM,CAAC;EACV,IAAI,CAAC,KACH,MAAM,IAAI,cAAc,UAAU,QAAQ;CAE9C;;CAGA,MAAc,sBACZ,IACA,OACA,YACA,UACe;EACf,MAAM,GACH,OAAO,cAAc,CAAC,CACtB,MAAM,IAAI,GAAG,eAAe,OAAO,KAAK,GAAG,GAAG,eAAe,YAAY,UAAU,CAAC,CAAC;EACxF,IAAI,SAAS,QACX,MAAM,GACH,OAAO,cAAc,CAAC,CACtB,OAAO,SAAS,KAAK,SAAS,OAAO;GAAE;GAAO;GAAY;GAAS,KAAK;EAAE,EAAE,CAAC;CAEpF;CAEA,aAAa,OAAe,UAAkB,OAAkC;EAC9E,OAAO,KAAK,GAAG,OAAO,OAAO;GAK3B,MAAM,WAAU,MAJO,GACpB,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAC5B,KAAK,OAAO,CAAC,CACb,MAAM,IAAI,GAAG,QAAQ,OAAO,KAAK,GAAG,GAAG,QAAQ,UAAU,QAAQ,CAAC,CAAC,EAAA,CAC7C,QAAQ,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,GAAG,GAAG,EAAE,IAAI;GACxE,MAAM,GAAG,OAAO,OAAO,CAAC,CAAC,OAAO;IAAE;IAAO;IAAU;IAAO,KAAK;GAAQ,CAAC;GACxE,OAAO,KAAK,YAAY,IAAI,OAAO,QAAQ;EAC7C,CAAC;CACH;CAEA,aACE,OACA,UACA,UACA,OACmB;EACnB,OAAO,KAAK,GAAG,OAAO,OAAO;GAC3B,MAAM,KAAK,aAAa,IAAI,OAAO,UAAU,QAAQ;GACrD,MAAM,GACH,OAAO,OAAO,CAAC,CACf,IAAI,EAAE,MAAM,CAAC,CAAC,CACd,MACC,IAAI,GAAG,QAAQ,OAAO,KAAK,GAAG,GAAG,QAAQ,IAAI,QAAQ,GAAG,GAAG,QAAQ,UAAU,QAAQ,CAAC,CACxF;GACF,OAAO,KAAK,YAAY,IAAI,OAAO,QAAQ;EAC7C,CAAC;CACH;CAEA,aAAa,OAAe,UAAkB,UAAqC;EACjF,OAAO,KAAK,GAAG,OAAO,OAAO;GAC3B,MAAM,KAAK,aAAa,IAAI,OAAO,UAAU,QAAQ;GAQrD,MAAM,eAAc,MAJO,GACxB,OAAO,EAAE,IAAI,WAAW,GAAG,CAAC,CAAC,CAC7B,KAAK,UAAU,CAAC,CAChB,MAAM,IAAI,GAAG,WAAW,OAAO,KAAK,GAAG,GAAG,WAAW,UAAU,QAAQ,CAAC,CAAC,EAAA,CAC3C,KAAK,MAAM,EAAE,EAAE;GAEhD,IAAI,YAAY,QAAQ;IACtB,MAAM,GACH,OAAO,cAAc,CAAC,CACtB,MACC,IAAI,GAAG,eAAe,OAAO,KAAK,GAAG,QAAQ,eAAe,YAAY,WAAW,CAAC,CACtF;IACF,MAAM,GACH,OAAO,UAAU,CAAC,CAClB,MAAM,IAAI,GAAG,WAAW,OAAO,KAAK,GAAG,GAAG,WAAW,UAAU,QAAQ,CAAC,CAAC;GAC9E;GAEA,MAAM,GACH,OAAO,OAAO,CAAC,CACf,MACC,IAAI,GAAG,QAAQ,OAAO,KAAK,GAAG,GAAG,QAAQ,IAAI,QAAQ,GAAG,GAAG,QAAQ,UAAU,QAAQ,CAAC,CACxF;GACF,OAAO,KAAK,YAAY,IAAI,OAAO,QAAQ;EAC7C,CAAC;CACH;CAEA,eAAe,OAAe,UAAkB,YAAyC;EACvF,OAAO,KAAK,GAAG,OAAO,OAAO;GAG3B,KAAK,IAAI,IAAI,GAAG,IAAI,WAAW,QAAQ,KACrC,MAAM,GACH,OAAO,OAAO,CAAC,CACf,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CACf,MACC,IACE,GAAG,QAAQ,OAAO,KAAK,GACvB,GAAG,QAAQ,UAAU,QAAQ,GAC7B,GAAG,QAAQ,IAAI,WAAW,EAAG,CAC/B,CACF;GAEJ,OAAO,KAAK,YAAY,IAAI,OAAO,QAAQ;EAC7C,CAAC;CACH;CAEA,kBACE,OACA,UACA,UACA,YACmB;EACnB,OAAO,KAAK,GAAG,OAAO,OAAO;GAC3B,MAAM,KAAK,aAAa,IAAI,OAAO,UAAU,QAAQ;GAGrD,KAAK,IAAI,IAAI,GAAG,IAAI,WAAW,QAAQ,KACrC,MAAM,GACH,OAAO,UAAU,CAAC,CAClB,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CACtB,MACC,IACE,GAAG,WAAW,OAAO,KAAK,GAC1B,GAAG,WAAW,UAAU,QAAQ,GAChC,GAAG,WAAW,IAAI,WAAW,EAAG,CAClC,CACF;GAEJ,KAAK,IAAI,IAAI,GAAG,IAAI,WAAW,QAAQ,KACrC,MAAM,GACH,OAAO,UAAU,CAAC,CAClB,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CACf,MACC,IACE,GAAG,WAAW,OAAO,KAAK,GAC1B,GAAG,WAAW,UAAU,QAAQ,GAChC,GAAG,WAAW,IAAI,WAAW,EAAG,CAClC,CACF;GAEJ,OAAO,KAAK,YAAY,IAAI,OAAO,QAAQ;EAC7C,CAAC;CACH;CAEA,aACE,OACA,UACA,UACA,OACA,YACoD;EACpD,OAAO,KAAK,GAAG,OAAO,OAAO;GAC3B,MAAM,KAAK,aAAa,IAAI,OAAO,UAAU,QAAQ;GAErD,IAAI;GACJ,IAAI,YAAY;IACd,MAAM,CAAC,YAAY,MAAM,GACtB,OAAO,EAAE,IAAI,WAAW,GAAG,CAAC,CAAC,CAC7B,KAAK,UAAU,CAAC,CAChB,MACC,IACE,GAAG,WAAW,OAAO,KAAK,GAC1B,GAAG,WAAW,IAAI,UAAU,GAC5B,GAAG,WAAW,UAAU,QAAQ,CAClC,CACF,CAAC,CACA,MAAM,CAAC;IACV,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,YAAY,UAAU;IAGhD,MAAM,GACH,OAAO,UAAU,CAAC,CAClB,IAAI,EAAE,UAAU,MAAM,YAAY,KAAK,CAAC,CAAC,CACzC,MAAM,IAAI,GAAG,WAAW,OAAO,KAAK,GAAG,GAAG,WAAW,IAAI,UAAU,CAAC,CAAC;IACxE,IAAI,MAAM,aAAa,KAAA,GACrB,MAAM,KAAK,sBAAsB,IAAI,OAAO,YAAY,MAAM,QAAQ;IAExE,UAAU;GACZ,OAAO;IAKL,MAAM,WAAU,MAJO,GACpB,OAAO,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,CAC/B,KAAK,UAAU,CAAC,CAChB,MAAM,IAAI,GAAG,WAAW,OAAO,KAAK,GAAG,GAAG,WAAW,UAAU,QAAQ,CAAC,CAAC,EAAA,CACnD,QAAQ,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,GAAG,GAAG,EAAE,IAAI;IAExE,MAAM,CAAC,OAAO,MAAM,GACjB,OAAO,UAAU,CAAC,CAClB,OAAO;KAAE;KAAO;KAAU;KAAU,KAAK;KAAS,UAAU,MAAM,YAAY;IAAK,CAAC,CAAC,CACrF,UAAU,EAAE,IAAI,WAAW,GAAG,CAAC;IAClC,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,2BAA2B;IAE7C,MAAM,KAAK,sBAAsB,IAAI,OAAO,IAAI,IAAI,MAAM,YAAY,CAAC,CAAC;IACxE,UAAU,IAAI;GAChB;GAEA,MAAM,CAAC,YAAY,MAAM,GACtB,OAAO,CAAC,CACR,KAAK,UAAU,CAAC,CAChB,MAAM,IAAI,GAAG,WAAW,OAAO,KAAK,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,CAAC,CAAC,CACnE,MAAM,CAAC;GACV,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,+BAA+B;GAEjD,OAAO;IAAE,SAAS,MAAM,KAAK,YAAY,IAAI,OAAO,QAAQ;IAAG;GAAS;EAC1E,CAAC;CACH;CAEA,eACE,OACA,UACA,UACA,YACmB;EACnB,OAAO,KAAK,GAAG,OAAO,OAAO;GAC3B,MAAM,KAAK,aAAa,IAAI,OAAO,UAAU,QAAQ;GAGrD,MAAM,GACH,OAAO,cAAc,CAAC,CACtB,MAAM,IAAI,GAAG,eAAe,OAAO,KAAK,GAAG,GAAG,eAAe,YAAY,UAAU,CAAC,CAAC;GACxF,MAAM,GACH,OAAO,UAAU,CAAC,CAClB,MACC,IACE,GAAG,WAAW,OAAO,KAAK,GAC1B,GAAG,WAAW,IAAI,UAAU,GAC5B,GAAG,WAAW,UAAU,QAAQ,CAClC,CACF;GAEF,OAAO,KAAK,YAAY,IAAI,OAAO,QAAQ;EAC7C,CAAC;CACH;CAIA,MAAM,cAAc,OAAe,OAAoD;EACrF,MAAM,aAAoB,CAAC,GAAG,UAAU,OAAO,KAAK,CAAC;EACrD,IAAI,MAAM,QACR,WAAW,KAAK,GAAG,UAAU,QAAQ,MAAM,MAAM,CAAC;EAEpD,IAAI,MAAM,UACR,WAAW,KAAK,GAAG,UAAU,UAAU,MAAM,QAAQ,CAAC;EAGxD,MAAM,SAAS,MAAM,QAAQ,KAAK;EAClC,IAAI,QAAQ;GACV,MAAM,OAAO,IAAI,OAAO;GACxB,MAAM,QAAQ,GAAG,MAAM,UAAU,OAAO,IAAI,GAAG,MAAM,UAAU,UAAU,IAAI,CAAC;GAC9E,IAAI,OACF,WAAW,KAAK,KAAK;EAEzB;EAEA,MAAM,QAAQ,IAAI,GAAG,UAAU;EAG/B,IAAI,UAAU;EACd,IAAI,YAA4B;EAChC,IAAI,MAAM,MAAM;GACd,MAAM,SAAS,MAAM,KAAK,WAAW,GAAG;GACxC,MAAM,MAAM,SAAS,MAAM,KAAK,MAAM,CAAC,IAAI,MAAM;GACjD,IAAI,OAAO,qBAAqB;IAC9B,UAAU;IACV,YAAY,SAAS,SAAS;GAChC;EACF;EACA,MAAM,WAAW,oBAAoB,YAAY,UAAU;EAC3D,MAAM,UAAU,cAAc,SAAS,KAAK,QAAQ,IAAI,IAAI,QAAQ;EAEpE,MAAM,OAAO,MAAM,KAAK,GACrB,OAAO,CAAC,CACR,KAAK,SAAS,CAAC,CACf,MAAM,KAAK,CAAC,CACZ,QAAQ,OAAO,CAAC,CAChB,MAAM,MAAM,QAAQ,CAAC,CACrB,QAAQ,MAAM,OAAO,KAAK,MAAM,QAAQ;EAE3C,MAAM,CAAC,YAAY,MAAM,KAAK,GAAG,OAAO,EAAE,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM,KAAK;EAEvF,OAAO;GACL,MAAM,KAAK,IAAI,UAAU;GACzB,OAAO,UAAU,SAAS;GAC1B,MAAM,MAAM;GACZ,UAAU,MAAM;EAClB;CACF;CAEA,MAAM,YAAY,OAAe,IAAsC;EACrE,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,CAAC,CACR,KAAK,SAAS,CAAC,CACf,MAAM,IAAI,GAAG,UAAU,OAAO,KAAK,GAAG,GAAG,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAC5D,MAAM,CAAC;EACV,OAAO,MAAM,WAAW,GAAG,IAAI;CACjC;CAEA,MAAM,eACJ,OACA,OACA,MACmB;EAGnB,MAAM,KAAK,MAAM,UAAU;EAC3B,MAAM,KAAK,GAAG,OAAO,YAAY,CAAC,CAAC,OAAO;GAAE;GAAO;GAAI,MAAM;EAAW,CAAC;EACzE,MAAM,KAAK,GAAG,OAAO,SAAS,CAAC,CAAC,OAAO;GACrC;GACA;GACA,OAAO,MAAM;GACb;GACA,aAAa,MAAM,eAAe;GAClC,UAAU,MAAM,YAAY;EAC9B,CAAC;EACD,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO,EAAE;EAChD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,iCAAiC;EAEnD,OAAO;CACT;CAEA,MAAM,eACJ,OACA,IACA,OAC0B;EAC1B,MAAM,MAA+B,EAAE,2BAAW,IAAI,KAAK,EAAE;EAC7D,IAAI,MAAM,UAAU,KAAA,GAClB,IAAI,QAAQ,MAAM;EAEpB,IAAI,MAAM,gBAAgB,KAAA,GACxB,IAAI,cAAc,MAAM;EAE1B,IAAI,MAAM,aAAa,KAAA,GACrB,IAAI,WAAW,MAAM;EAEvB,IAAI,MAAM,WAAW,KAAA,GACnB,IAAI,SAAS,MAAM;EAErB,IAAI,MAAM,qBAAqB,KAAA,GAC7B,IAAI,mBAAmB,MAAM;EAG/B,MAAM,CAAC,WAAW,MAAM,KAAK,GAC1B,OAAO,SAAS,CAAC,CACjB,IAAI,GAAG,CAAC,CACR,MAAM,IAAI,GAAG,UAAU,OAAO,KAAK,GAAG,GAAG,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAC5D,UAAU,EAAE,IAAI,UAAU,GAAG,CAAC;EACjC,IAAI,CAAC,SACH,OAAO;EAET,OAAO,KAAK,YAAY,OAAO,EAAE;CACnC;CAEA,MAAM,eAAe,OAAe,IAA8B;EAahE,QAAO,MAVe,KAAK,GACxB,OAAO,YAAY,CAAC,CACpB,MACC,IACE,GAAG,aAAa,OAAO,KAAK,GAC5B,GAAG,aAAa,IAAI,EAAE,GACtB,GAAG,aAAa,MAAM,UAAU,CAClC,CACF,CAAC,CACA,UAAU,EAAE,IAAI,aAAa,GAAG,CAAC,EAAA,CACrB,SAAS;CAC1B;CAEA,MAAM,mBAAmB,OAAe,YAA8C;EACpF,OAAO,KAAK,GACT,OAAO,CAAC,CACR,KAAK,cAAc,CAAC,CACpB,MAAM,IAAI,GAAG,eAAe,OAAO,KAAK,GAAG,GAAG,eAAe,YAAY,UAAU,CAAC,CAAC,CAAC,CACtF,QAAQ,IAAI,eAAe,GAAG,CAAC;CACpC;;CAGA,MAAc,eAAe,OAAe,YAAmC;EAC7E,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,EAAE,IAAI,UAAU,GAAG,CAAC,CAAC,CAC5B,KAAK,SAAS,CAAC,CACf,MAAM,IAAI,GAAG,UAAU,OAAO,KAAK,GAAG,GAAG,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,CACpE,MAAM,CAAC;EACV,IAAI,CAAC,KACH,MAAM,IAAI,cAAc,YAAY,UAAU;CAElD;CAEA,MAAM,iBACJ,OACA,YACA,OAC0B;EAC1B,MAAM,KAAK,eAAe,OAAO,UAAU;EAC3C,MAAM,CAAC,UAAU,MAAM,KAAK,GACzB,OAAO,EAAE,QAAQ,GAAkB,OAAO,eAAe,IAAI,GAAG,CAAC,CAAC,CAClE,KAAK,cAAc,CAAC,CACpB,MAAM,IAAI,GAAG,eAAe,OAAO,KAAK,GAAG,GAAG,eAAe,YAAY,UAAU,CAAC,CAAC;EACxF,MAAM,WAAW,QAAQ,UAAU,MAAM;EACzC,IAAI;GACF,MAAM,KAAK,GAAG,OAAO,cAAc,CAAC,CAAC,OAAO;IAC1C;IACA;IACA,SAAS,MAAM;IACf,KAAK;IACL,aAAa,MAAM,eAAe;GACpC,CAAC;EACH,SAAS,KAAK;GACZ,IAAI,kBAAkB,GAAG,GACvB,MAAM,IAAI,cAAc,8CAA8C;GAExE,MAAM;EACR;EACA,OAAO,KAAK,mBAAmB,OAAO,UAAU;CAClD;CAEA,MAAM,oBACJ,OACA,YACA,SAC0B;EAC1B,MAAM,KAAK,eAAe,OAAO,UAAU;EAC3C,MAAM,KAAK,GACR,OAAO,cAAc,CAAC,CACtB,MACC,IACE,GAAG,eAAe,OAAO,KAAK,GAC9B,GAAG,eAAe,YAAY,UAAU,GACxC,GAAG,eAAe,SAAS,OAAO,CACpC,CACF;EACF,OAAO,KAAK,mBAAmB,OAAO,UAAU;CAClD;CAEA,MAAM,oBACJ,OACA,YACA,SACA,aAC0B;EAC1B,MAAM,KAAK,eAAe,OAAO,UAAU;EAC3C,MAAM,KAAK,GACR,OAAO,cAAc,CAAC,CACtB,IAAI,EAAE,YAAY,CAAC,CAAC,CACpB,MACC,IACE,GAAG,eAAe,OAAO,KAAK,GAC9B,GAAG,eAAe,YAAY,UAAU,GACxC,GAAG,eAAe,SAAS,OAAO,CACpC,CACF;EACF,OAAO,KAAK,mBAAmB,OAAO,UAAU;CAClD;CAEA,MAAM,sBACJ,OACA,YACA,UAC0B;EAC1B,MAAM,KAAK,eAAe,OAAO,UAAU;EAE3C,KAAK,MAAM,CAAC,KAAK,YAAY,SAAS,QAAQ,GAC5C,MAAM,KAAK,GACR,OAAO,cAAc,CAAC,CACtB,IAAI,EAAE,IAAI,CAAC,CAAC,CACZ,MACC,IACE,GAAG,eAAe,OAAO,KAAK,GAC9B,GAAG,eAAe,YAAY,UAAU,GACxC,GAAG,eAAe,SAAS,OAAO,CACpC,CACF;EAEJ,OAAO,KAAK,mBAAmB,OAAO,UAAU;CAClD;AACF"}

package/dist/repositories/credentials.d.ts

@@ -0,0 +1,25 @@
+import { DbExecutor } from "../client.js";
+import { CredentialStore, Logger } from "@headless-lms/core/shared/ports";
+//#region src/repositories/credentials.d.ts
+/** base64(iv ‖ auth tag ‖ ciphertext) */
+declare function encryptSecret(key: Buffer, plaintext: string, aadValue: Buffer): string;
+/** Throws if the payload was tampered with or the AAD/key doesn't match. */
+declare function decryptSecret(key: Buffer, payload: string, aadValue: Buffer): string;
+declare class DrizzleCredentialStore implements CredentialStore {
+  private readonly db;
+  /** base64-encoded 32-byte key (CREDENTIAL_STORE_KEY). Validated on first use, not at boot. */
+  private readonly keyBase64;
+  private readonly logger;
+  private key;
+  constructor(db: DbExecutor,
+  /** base64-encoded 32-byte key (CREDENTIAL_STORE_KEY). Validated on first use, not at boot. */
+  keyBase64: string, logger?: Logger);
+  private getKey;
+  store(orgId: string, secrets: Record<string, unknown>): Promise<string>;
+  reveal(orgId: string, ref: string): Promise<Record<string, unknown> | null>;
+  update(orgId: string, ref: string, secrets: Record<string, unknown>): Promise<void>;
+  destroy(orgId: string, ref: string): Promise<void>;
+}
+//#endregion
+export { DrizzleCredentialStore, decryptSecret, encryptSecret };
+//# sourceMappingURL=credentials.d.ts.map

package/dist/repositories/credentials.js

@@ -0,0 +1,86 @@
+import { credentials } from "../schema/credentials.js";
+import { and, eq } from "drizzle-orm";
+import { genId } from "@headless-lms/core/shared/id";
+import { noopLogger } from "@headless-lms/core/shared/logger";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+//#region src/repositories/credentials.ts
+const IV_BYTES = 12;
+/** Version of the key currently used for new writes (stored per row for rotation). */
+const KEY_VERSION = 1;
+function aad(orgId, id) {
+	return Buffer.from(`${orgId}:${id}`, "utf8");
+}
+/** base64(iv ‖ auth tag ‖ ciphertext) */
+function encryptSecret(key, plaintext, aadValue) {
+	const iv = randomBytes(IV_BYTES);
+	const cipher = createCipheriv("aes-256-gcm", key, iv);
+	cipher.setAAD(aadValue);
+	const data = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+	return Buffer.concat([
+		iv,
+		cipher.getAuthTag(),
+		data
+	]).toString("base64");
+}
+/** Throws if the payload was tampered with or the AAD/key doesn't match. */
+function decryptSecret(key, payload, aadValue) {
+	const buf = Buffer.from(payload, "base64");
+	const iv = buf.subarray(0, IV_BYTES);
+	const tag = buf.subarray(IV_BYTES, 28);
+	const data = buf.subarray(28);
+	const decipher = createDecipheriv("aes-256-gcm", key, iv);
+	decipher.setAAD(aadValue);
+	decipher.setAuthTag(tag);
+	return Buffer.concat([decipher.update(data), decipher.final()]).toString("utf8");
+}
+var DrizzleCredentialStore = class {
+	db;
+	keyBase64;
+	logger;
+	key;
+	constructor(db, keyBase64, logger = noopLogger) {
+		this.db = db;
+		this.keyBase64 = keyBase64;
+		this.logger = logger;
+	}
+	getKey() {
+		if (!this.key) {
+			const key = Buffer.from(this.keyBase64, "base64");
+			if (key.length !== 32) throw new Error("CREDENTIAL_STORE_KEY must be a base64-encoded 32-byte key (generate with: openssl rand -base64 32)");
+			this.key = key;
+		}
+		return this.key;
+	}
+	async store(orgId, secrets) {
+		const id = genId("credential");
+		const ciphertext = encryptSecret(this.getKey(), JSON.stringify(secrets), aad(orgId, id));
+		await this.db.insert(credentials).values({
+			orgId,
+			id,
+			ciphertext,
+			keyVersion: KEY_VERSION
+		});
+		return id;
+	}
+	async reveal(orgId, ref) {
+		const [row] = await this.db.select().from(credentials).where(and(eq(credentials.orgId, orgId), eq(credentials.id, ref))).limit(1);
+		if (!row) return null;
+		const plaintext = decryptSecret(this.getKey(), row.ciphertext, aad(orgId, ref));
+		return JSON.parse(plaintext);
+	}
+	async update(orgId, ref, secrets) {
+		const ciphertext = encryptSecret(this.getKey(), JSON.stringify(secrets), aad(orgId, ref));
+		await this.db.update(credentials).set({
+			ciphertext,
+			keyVersion: KEY_VERSION,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(and(eq(credentials.orgId, orgId), eq(credentials.id, ref)));
+	}
+	async destroy(orgId, ref) {
+		await this.db.delete(credentials).where(and(eq(credentials.orgId, orgId), eq(credentials.id, ref)));
+	}
+};
+//#endregion
+export { DrizzleCredentialStore, decryptSecret, encryptSecret };
+
+//# sourceMappingURL=credentials.js.map

package/dist/repositories/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","names":[],"sources":["../../src/repositories/credentials.ts"],"sourcesContent":["// credentials — Drizzle-backed secure credential store (implements the shared\n// core port). Secrets are JSON documents: serialized here, encrypted with\n// AES-256-GCM via node:crypto (single 32-byte key from the environment), and\n// parsed back to objects on reveal — callers never (de)serialize. The AAD\n// binds each ciphertext to its (org, id) row, so moving a ciphertext to\n// another row or org makes it undecryptable. Plaintext exists only inside\n// store/reveal — it is never logged, listed, or returned elsewhere.\nimport { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\nimport { and, eq } from 'drizzle-orm';\nimport type { DbExecutor } from '../client.js';\nimport type { CredentialStore, Logger } from '@headless-lms/core/shared/ports';\nimport { noopLogger } from '@headless-lms/core/shared/logger';\nimport { genId } from '@headless-lms/core/shared/id';\nimport { credentials } from '../schema/credentials.js';\n\nconst IV_BYTES = 12;\nconst TAG_BYTES = 16;\n/** Version of the key currently used for new writes (stored per row for rotation). */\nconst KEY_VERSION = 1;\n\nfunction aad(orgId: string, id: string): Buffer {\n  return Buffer.from(`${orgId}:${id}`, 'utf8');\n}\n\n/** base64(iv ‖ auth tag ‖ ciphertext) */\nexport function encryptSecret(key: Buffer, plaintext: string, aadValue: Buffer): string {\n  const iv = randomBytes(IV_BYTES);\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n  cipher.setAAD(aadValue);\n  const data = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n  return Buffer.concat([iv, cipher.getAuthTag(), data]).toString('base64');\n}\n\n/** Throws if the payload was tampered with or the AAD/key doesn't match. */\nexport function decryptSecret(key: Buffer, payload: string, aadValue: Buffer): string {\n  const buf = Buffer.from(payload, 'base64');\n  const iv = buf.subarray(0, IV_BYTES);\n  const tag = buf.subarray(IV_BYTES, IV_BYTES + TAG_BYTES);\n  const data = buf.subarray(IV_BYTES + TAG_BYTES);\n  const decipher = createDecipheriv('aes-256-gcm', key, iv);\n  decipher.setAAD(aadValue);\n  decipher.setAuthTag(tag);\n  return Buffer.concat([decipher.update(data), decipher.final()]).toString('utf8');\n}\n\nexport class DrizzleCredentialStore implements CredentialStore {\n  private key: Buffer | undefined;\n\n  constructor(\n    private readonly db: DbExecutor,\n    /** base64-encoded 32-byte key (CREDENTIAL_STORE_KEY). Validated on first use, not at boot. */\n    private readonly keyBase64: string,\n    private readonly logger: Logger = noopLogger,\n  ) {}\n\n  private getKey(): Buffer {\n    if (!this.key) {\n      const key = Buffer.from(this.keyBase64, 'base64');\n      if (key.length !== 32) {\n        throw new Error(\n          'CREDENTIAL_STORE_KEY must be a base64-encoded 32-byte key (generate with: openssl rand -base64 32)',\n        );\n      }\n      this.key = key;\n    }\n    return this.key;\n  }\n\n  async store(orgId: string, secrets: Record<string, unknown>): Promise<string> {\n    const id = genId('credential');\n    const ciphertext = encryptSecret(this.getKey(), JSON.stringify(secrets), aad(orgId, id));\n    await this.db.insert(credentials).values({ orgId, id, ciphertext, keyVersion: KEY_VERSION });\n    return id;\n  }\n\n  async reveal(orgId: string, ref: string): Promise<Record<string, unknown> | null> {\n    const [row] = await this.db\n      .select()\n      .from(credentials)\n      .where(and(eq(credentials.orgId, orgId), eq(credentials.id, ref)))\n      .limit(1);\n    if (!row) {\n      return null;\n    }\n    const plaintext = decryptSecret(this.getKey(), row.ciphertext, aad(orgId, ref));\n    return JSON.parse(plaintext) as Record<string, unknown>;\n  }\n\n  async update(orgId: string, ref: string, secrets: Record<string, unknown>): Promise<void> {\n    const ciphertext = encryptSecret(this.getKey(), JSON.stringify(secrets), aad(orgId, ref));\n    await this.db\n      .update(credentials)\n      .set({ ciphertext, keyVersion: KEY_VERSION, updatedAt: new Date() })\n      .where(and(eq(credentials.orgId, orgId), eq(credentials.id, ref)));\n  }\n\n  async destroy(orgId: string, ref: string): Promise<void> {\n    await this.db\n      .delete(credentials)\n      .where(and(eq(credentials.orgId, orgId), eq(credentials.id, ref)));\n  }\n}\n"],"mappings":";;;;;;AAeA,MAAM,WAAW;;AAGjB,MAAM,cAAc;AAEpB,SAAS,IAAI,OAAe,IAAoB;CAC9C,OAAO,OAAO,KAAK,GAAG,MAAM,GAAG,MAAM,MAAM;AAC7C;;AAGA,SAAgB,cAAc,KAAa,WAAmB,UAA0B;CACtF,MAAM,KAAK,YAAY,QAAQ;CAC/B,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;CACpD,OAAO,OAAO,QAAQ;CACtB,MAAM,OAAO,OAAO,OAAO,CAAC,OAAO,OAAO,WAAW,MAAM,GAAG,OAAO,MAAM,CAAC,CAAC;CAC7E,OAAO,OAAO,OAAO;EAAC;EAAI,OAAO,WAAW;EAAG;CAAI,CAAC,CAAC,CAAC,SAAS,QAAQ;AACzE;;AAGA,SAAgB,cAAc,KAAa,SAAiB,UAA0B;CACpF,MAAM,MAAM,OAAO,KAAK,SAAS,QAAQ;CACzC,MAAM,KAAK,IAAI,SAAS,GAAG,QAAQ;CACnC,MAAM,MAAM,IAAI,SAAS,UAAU,EAAoB;CACvD,MAAM,OAAO,IAAI,SAAS,EAAoB;CAC9C,MAAM,WAAW,iBAAiB,eAAe,KAAK,EAAE;CACxD,SAAS,OAAO,QAAQ;CACxB,SAAS,WAAW,GAAG;CACvB,OAAO,OAAO,OAAO,CAAC,SAAS,OAAO,IAAI,GAAG,SAAS,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM;AACjF;AAEA,IAAa,yBAAb,MAA+D;CAI1C;CAEA;CACA;CANnB;CAEA,YACE,IAEA,WACA,SAAkC,YAClC;EAJiB,KAAA,KAAA;EAEA,KAAA,YAAA;EACA,KAAA,SAAA;CAChB;CAEH,SAAyB;EACvB,IAAI,CAAC,KAAK,KAAK;GACb,MAAM,MAAM,OAAO,KAAK,KAAK,WAAW,QAAQ;GAChD,IAAI,IAAI,WAAW,IACjB,MAAM,IAAI,MACR,oGACF;GAEF,KAAK,MAAM;EACb;EACA,OAAO,KAAK;CACd;CAEA,MAAM,MAAM,OAAe,SAAmD;EAC5E,MAAM,KAAK,MAAM,YAAY;EAC7B,MAAM,aAAa,cAAc,KAAK,OAAO,GAAG,KAAK,UAAU,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;EACvF,MAAM,KAAK,GAAG,OAAO,WAAW,CAAC,CAAC,OAAO;GAAE;GAAO;GAAI;GAAY,YAAY;EAAY,CAAC;EAC3F,OAAO;CACT;CAEA,MAAM,OAAO,OAAe,KAAsD;EAChF,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,CAAC,CACR,KAAK,WAAW,CAAC,CACjB,MAAM,IAAI,GAAG,YAAY,OAAO,KAAK,GAAG,GAAG,YAAY,IAAI,GAAG,CAAC,CAAC,CAAC,CACjE,MAAM,CAAC;EACV,IAAI,CAAC,KACH,OAAO;EAET,MAAM,YAAY,cAAc,KAAK,OAAO,GAAG,IAAI,YAAY,IAAI,OAAO,GAAG,CAAC;EAC9E,OAAO,KAAK,MAAM,SAAS;CAC7B;CAEA,MAAM,OAAO,OAAe,KAAa,SAAiD;EACxF,MAAM,aAAa,cAAc,KAAK,OAAO,GAAG,KAAK,UAAU,OAAO,GAAG,IAAI,OAAO,GAAG,CAAC;EACxF,MAAM,KAAK,GACR,OAAO,WAAW,CAAC,CACnB,IAAI;GAAE;GAAY,YAAY;GAAa,2BAAW,IAAI,KAAK;EAAE,CAAC,CAAC,CACnE,MAAM,IAAI,GAAG,YAAY,OAAO,KAAK,GAAG,GAAG,YAAY,IAAI,GAAG,CAAC,CAAC;CACrE;CAEA,MAAM,QAAQ,OAAe,KAA4B;EACvD,MAAM,KAAK,GACR,OAAO,WAAW,CAAC,CACnB,MAAM,IAAI,GAAG,YAAY,OAAO,KAAK,GAAG,GAAG,YAAY,IAAI,GAAG,CAAC,CAAC;CACrE;AACF"}

package/dist/repositories/dashboard.d.ts

@@ -0,0 +1,14 @@
+import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { Logger } from "@headless-lms/core/shared/ports";
+import { DashboardReportRepository, EnrollmentPoint, OverviewStats } from "@headless-lms/core/reporting/dashboard";
+//#region src/repositories/dashboard.d.ts
+declare class DrizzleDashboardRepository implements DashboardReportRepository {
+  private readonly db;
+  private readonly logger;
+  constructor(db: NodePgDatabase, logger?: Logger);
+  overview(orgId: string): Promise<OverviewStats>;
+  enrollments(orgId: string, days: number): Promise<EnrollmentPoint[]>;
+}
+//#endregion
+export { DrizzleDashboardRepository };
+//# sourceMappingURL=dashboard.d.ts.map

package/dist/repositories/dashboard.js

@@ -0,0 +1,55 @@
+import { courses } from "../schema/content.js";
+import { entitlements } from "../schema/entitlements.js";
+import "../schema/index.js";
+import { and, eq, gte, isNull, or, sql } from "drizzle-orm";
+import { noopLogger } from "@headless-lms/core/shared/logger";
+//#region src/repositories/dashboard.ts
+var DrizzleDashboardRepository = class {
+	db;
+	logger;
+	constructor(db, logger = noopLogger) {
+		this.db = db;
+		this.logger = logger;
+	}
+	async overview(orgId) {
+		const [courseCounts] = await this.db.select({
+			published: sql`count(*) filter (where ${courses.status} = 'published')`,
+			draft: sql`count(*) filter (where ${courses.status} = 'draft')`
+		}).from(courses).where(eq(courses.orgId, orgId));
+		const effectiveActive = and(eq(entitlements.orgId, orgId), eq(entitlements.status, "active"), or(isNull(entitlements.expiresAt), gte(entitlements.expiresAt, sql`now()`)));
+		const [entitlementCounts] = await this.db.select({
+			activeStudents: sql`count(distinct ${entitlements.orgUserId})`,
+			expiringSoon: sql`count(*) filter (where ${entitlements.expiresAt} is not null and ${entitlements.expiresAt} < now() + interval '14 days')`
+		}).from(entitlements).where(effectiveActive);
+		return {
+			publishedCourses: Number(courseCounts?.published ?? 0),
+			draftCourses: Number(courseCounts?.draft ?? 0),
+			activeStudents: Number(entitlementCounts?.activeStudents ?? 0),
+			expiringSoon: Number(entitlementCounts?.expiringSoon ?? 0)
+		};
+	}
+	async enrollments(orgId, days) {
+		return (await this.db.execute(sql`
+      select
+        to_char(d.day, 'YYYY-MM-DD') as date,
+        count(${entitlements.id})::int as count
+      from generate_series(
+        (now() at time zone 'utc')::date - (${days} - 1),
+        (now() at time zone 'utc')::date,
+        interval '1 day'
+      ) as d(day)
+      left join ${entitlements}
+        on ${entitlements.orgId} = ${orgId}
+        and (${entitlements.grantedAt} at time zone 'utc')::date = d.day::date
+      group by d.day
+      order by d.day
+    `)).rows.map((r) => ({
+			date: r.date,
+			count: Number(r.count)
+		}));
+	}
+};
+//#endregion
+export { DrizzleDashboardRepository };
+
+//# sourceMappingURL=dashboard.js.map

package/dist/repositories/dashboard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard.js","names":[],"sources":["../../src/repositories/dashboard.ts"],"sourcesContent":["// dashboard — Drizzle repository (implements the core outbound port).\n// Back-office overview counts, every figure scoped to the active org. An\n// entitlement is \"effective-active\" when status='active' and it has not expired\n// (expires_at null or in the future) — expiry is derived at read time.\nimport { and, eq, gte, isNull, or, sql } from 'drizzle-orm';\nimport type { NodePgDatabase } from 'drizzle-orm/node-postgres';\nimport type {\n  DashboardReportRepository,\n  EnrollmentPoint,\n  OverviewStats,\n} from '@headless-lms/core/reporting/dashboard';\nimport { courses, entitlements } from '../schema/index.js';\nimport type { Logger } from '@headless-lms/core/shared/ports';\nimport { noopLogger } from '@headless-lms/core/shared/logger';\n\nexport class DrizzleDashboardRepository implements DashboardReportRepository {\n  constructor(\n    private readonly db: NodePgDatabase,\n    private readonly logger: Logger = noopLogger,\n  ) {}\n\n  async overview(orgId: string): Promise<OverviewStats> {\n    const [courseCounts] = await this.db\n      .select({\n        published: sql<number>`count(*) filter (where ${courses.status} = 'published')`,\n        draft: sql<number>`count(*) filter (where ${courses.status} = 'draft')`,\n      })\n      .from(courses)\n      .where(eq(courses.orgId, orgId));\n\n    const effectiveActive = and(\n      eq(entitlements.orgId, orgId),\n      eq(entitlements.status, 'active'),\n      or(isNull(entitlements.expiresAt), gte(entitlements.expiresAt, sql`now()`)),\n    );\n\n    const [entitlementCounts] = await this.db\n      .select({\n        activeStudents: sql<number>`count(distinct ${entitlements.orgUserId})`,\n        expiringSoon: sql<number>`count(*) filter (where ${entitlements.expiresAt} is not null and ${entitlements.expiresAt} < now() + interval '14 days')`,\n      })\n      .from(entitlements)\n      .where(effectiveActive);\n\n    return {\n      publishedCourses: Number(courseCounts?.published ?? 0),\n      draftCourses: Number(courseCounts?.draft ?? 0),\n      activeStudents: Number(entitlementCounts?.activeStudents ?? 0),\n      expiringSoon: Number(entitlementCounts?.expiringSoon ?? 0),\n    };\n  }\n\n  // Grants per day over the trailing window, zero-filled so the series has one\n  // point per calendar day (UTC) even when nothing was granted.\n  async enrollments(orgId: string, days: number): Promise<EnrollmentPoint[]> {\n    const result = await this.db.execute(sql`\n      select\n        to_char(d.day, 'YYYY-MM-DD') as date,\n        count(${entitlements.id})::int as count\n      from generate_series(\n        (now() at time zone 'utc')::date - (${days} - 1),\n        (now() at time zone 'utc')::date,\n        interval '1 day'\n      ) as d(day)\n      left join ${entitlements}\n        on ${entitlements.orgId} = ${orgId}\n        and (${entitlements.grantedAt} at time zone 'utc')::date = d.day::date\n      group by d.day\n      order by d.day\n    `);\n    const rows = result.rows as { date: string; count: number }[];\n    return rows.map((r) => ({ date: r.date, count: Number(r.count) }));\n  }\n}\n"],"mappings":";;;;;;AAeA,IAAa,6BAAb,MAA6E;CAExD;CACA;CAFnB,YACE,IACA,SAAkC,YAClC;EAFiB,KAAA,KAAA;EACA,KAAA,SAAA;CAChB;CAEH,MAAM,SAAS,OAAuC;EACpD,MAAM,CAAC,gBAAgB,MAAM,KAAK,GAC/B,OAAO;GACN,WAAW,GAAW,0BAA0B,QAAQ,OAAO;GAC/D,OAAO,GAAW,0BAA0B,QAAQ,OAAO;EAC7D,CAAC,CAAC,CACD,KAAK,OAAO,CAAC,CACb,MAAM,GAAG,QAAQ,OAAO,KAAK,CAAC;EAEjC,MAAM,kBAAkB,IACtB,GAAG,aAAa,OAAO,KAAK,GAC5B,GAAG,aAAa,QAAQ,QAAQ,GAChC,GAAG,OAAO,aAAa,SAAS,GAAG,IAAI,aAAa,WAAW,GAAG,OAAO,CAAC,CAC5E;EAEA,MAAM,CAAC,qBAAqB,MAAM,KAAK,GACpC,OAAO;GACN,gBAAgB,GAAW,kBAAkB,aAAa,UAAU;GACpE,cAAc,GAAW,0BAA0B,aAAa,UAAU,mBAAmB,aAAa,UAAU;EACtH,CAAC,CAAC,CACD,KAAK,YAAY,CAAC,CAClB,MAAM,eAAe;EAExB,OAAO;GACL,kBAAkB,OAAO,cAAc,aAAa,CAAC;GACrD,cAAc,OAAO,cAAc,SAAS,CAAC;GAC7C,gBAAgB,OAAO,mBAAmB,kBAAkB,CAAC;GAC7D,cAAc,OAAO,mBAAmB,gBAAgB,CAAC;EAC3D;CACF;CAIA,MAAM,YAAY,OAAe,MAA0C;EAiBzE,QADa,MAfQ,KAAK,GAAG,QAAQ,GAAG;;;gBAG5B,aAAa,GAAG;;8CAEc,KAAK;;;;kBAIjC,aAAa;aAClB,aAAa,MAAM,KAAK,MAAM;eAC5B,aAAa,UAAU;;;KAGjC,EAAA,CACmB,KACR,KAAK,OAAO;GAAE,MAAM,EAAE;GAAM,OAAO,OAAO,EAAE,KAAK;EAAE,EAAE;CACnE;AACF"}