@headless-lms/core 0.1.0 → 0.2.0

package/dist/organizations/ports.d.ts

@@ -1,4 +1,4 @@
-import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, InviteRole, NewOrganizationInput, OrgUser, Organization, Role } from "../types/schemas/organizations.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, InviteRole, NewOrganizationInput, OrgUser, Organization, Role, UpdateOrgUserInput } from "../types/schemas/organizations.js";
 import { OutboxAppender, UnitOfWork } from "../shared/ports.js";
 import { AuthHeaders } from "../identity/ports.js";
 import "../identity/index.js";
@@ -12,7 +12,8 @@ interface OrganizationService {
   updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization>;
   deleteOrganization(id: string): Promise<Organization>;
   addOrgUser(input: AddOrgUserInput): Promise<OrgUser>;
-  removeOrgUser(orgId: string, id: string): Promise<OrgUser>;
+  removeOrgUser(orgId: string, userId: string): Promise<OrgUser>;
+  updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser>;
   getByExternalId(externalId: string): Promise<Organization | null>;
   getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
   getOrgUsersForUser(userId: string): Promise<OrgUser[]>;
@@ -59,12 +60,13 @@ interface OrganizationsRepository {
   findById(id: string): Promise<Organization | null>;
   findByExternalId(externalId: string): Promise<Organization | null>;
   findBySlug(slug: string): Promise<Organization | null>;
-  upsertOrgUser(orgId: string, input: AddOrgUserInput): Promise<OrgUser>;
   /** Inserts a pending invite, or re-issues the org's existing pending one
    *  for this email (fresh token/expiry/role) — atomic upsert. */
   upsertPendingInvite(orgId: string, input: NewInviteRow): Promise<Invite>;
   setInviteStatus(orgId: string, id: string, status: string): Promise<Invite | null>;
   findInviteByTokenHash(tokenHash: string): Promise<Invite | null>;
+  findPendingInvite(orgId: string, email: string): Promise<Invite | null>;
+  setInviteToken(orgId: string, id: string, tokenHash: string, expiresAt: Date): Promise<Invite | null>;
   /** The person's row in one org. `(org_id, user_id)` is unique. */
   findOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
   /** Every org this person belongs to, oldest first. */
@@ -73,13 +75,7 @@ interface OrganizationsRepository {
   /** Links a user to the org under a role. Throws ConflictError when they
    *  already hold a row there. */
   createOrgUser(input: CreateOrgUserInput): Promise<OrgUser>;
-  /** createOrgUser, but idempotent on `(org_id, user_id)`: an existing row is
-   *  promoted to the requested status rather than refused. `created` says
-   *  whether a row appeared, so `student.created` fires exactly once. */
-  ensureOrgUser(input: CreateOrgUserInput): Promise<{
-    orgUser: OrgUser;
-    created: boolean;
-  }>;
+  updateOrgUser(orgId: string, id: string, patch: UpdateOrgUserInput): Promise<OrgUser | null>;
   /** Every org this person is a student in — the scope of `student.linked`. */
   findStudentOrgUsers(userId: string): Promise<OrgUser[]>;
   /** Kills the org's pending invite for an address, if any. */

package/dist/organizations/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","names":[],"sources":["../../src/organizations/roles.ts"],"sourcesContent":["// organizations context — roles and the authorization matrix.\n// Defined in code (no DB enum). The DB stores role as text; the domain narrows\n// it to Role and answers authorization questions here. The Role type itself is\n// owned by @headless-lms/core/types; RANK/MATRIX below are Record<Role, …>, so the\n// compiler forces this file to cover every role the published type declares.\nimport type { Role } from '../types/index.js';\n\nexport type { Role };\nexport const ROLES = [\n  'owner',\n  'admin',\n  'instructor',\n  'student',\n] as const satisfies readonly Role[];\n\n/**\n * The roles that operate the back office. `student` belongs to the org but\n * never appears on a staff surface, so the member-management types are typed\n * with this narrower union — the exclusion is a compiler guarantee, not a\n * convention a query has to remember.\n */\nexport type StaffRole = Exclude<Role, 'student'>;\nexport const STAFF_ROLES = ['owner', 'admin', 'instructor'] as const satisfies readonly StaffRole[];\n\nexport function isRole(value: string): value is Role {\n  return (ROLES as readonly string[]).includes(value);\n}\n\nexport function isStaffRole(value: string): value is StaffRole {\n  return (STAFF_ROLES as readonly string[]).includes(value);\n}\n\nexport function parseRole(value: string): Role {\n  if (!isRole(value)) {\n    throw new Error(`unknown role: ${value}`);\n  }\n  return value;\n}\n\nexport type Permission =\n  | 'manage_billing'\n  | 'manage_org_settings'\n  | 'manage_users'\n  | 'create_course'\n  | 'edit_assigned_course'\n  | 'view_student_progress'\n  | 'consume_content';\n\n// Unconditional (true), course-scoped (\"assigned\"), or enrollment-scoped\n// (\"enrolled\" — access owned by entitlements). Absent ⇒ denied.\n//\n// \"assigned\" is a granted-but-narrowed answer: the role holds the permission,\n// but only over some subset of courses. Nothing narrows it today — there is no\n// course-assignment store — so callers must decide what a narrowed grant means\n// for them. `authorize` treats it as denied; `tools.ts` treats it as granted.\nexport type Capability = true | 'assigned' | 'enrolled';\n\nconst MATRIX: Record<Role, Partial<Record<Permission, Capability>>> = {\n  owner: {\n    manage_billing: true,\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n  },\n  admin: {\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n  },\n  instructor: {\n    edit_assigned_course: 'assigned',\n    view_student_progress: 'assigned',\n  },\n  // A learner belongs to the org to consume content they hold an\n  // entitlement for. No management capability of any kind.\n  student: {\n    consume_content: 'enrolled',\n  },\n};\n\nexport function capability(role: Role, permission: Permission): Capability | false {\n  return MATRIX[role][permission] ?? false;\n}\n\n// Better Auth's role model is broader than ours: it keeps a built-in `member`\n// role and allows comma-joined multi-role strings. Normalize any incoming role\n// string to a single domain Role before persisting: `member` -> `instructor`, a\n// multi-role string -> its highest-privilege known role, unknown -> `instructor`.\nconst RANK: Record<Role, number> = { owner: 3, admin: 2, instructor: 1, student: 0 };\n\nexport function normalizeRole(raw: string): Role {\n  let best: Role = 'instructor';\n  let bestRank = -1;\n  for (const token of raw.split(',').map((t) => t.trim())) {\n    const r: Role | null = isRole(token) ? token : token === 'member' ? 'instructor' : null;\n    if (r && RANK[r] > bestRank) {\n      best = r;\n      bestRank = RANK[r];\n    }\n  }\n  return best;\n}\n\n// Invites carry either a staff Role or this marker: the invited account is\n// a portal student, not an org member. Owned by the organizations domain — the\n// invite provider adapter reuses it to branch links, emails, and grants.\nexport const STUDENT_ROLE = 'student';\n"],"mappings":";AAQA,MAAa,QAAQ;CACnB;CACA;CACA;CACA;AACF;AASA,MAAa,cAAc;CAAC;CAAS;CAAS;AAAY;AAE1D,SAAgB,OAAO,OAA8B;CACnD,OAAQ,MAA4B,SAAS,KAAK;AACpD;AAEA,SAAgB,YAAY,OAAmC;CAC7D,OAAQ,YAAkC,SAAS,KAAK;AAC1D;AAEA,SAAgB,UAAU,OAAqB;CAC7C,IAAI,CAAC,OAAO,KAAK,GACf,MAAM,IAAI,MAAM,iBAAiB,OAAO;CAE1C,OAAO;AACT;AAoBA,MAAM,SAAgE;CACpE,OAAO;EACL,gBAAgB;EAChB,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;CACzB;CACA,OAAO;EACL,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;CACzB;CACA,YAAY;EACV,sBAAsB;EACtB,uBAAuB;CACzB;CAGA,SAAS,EACP,iBAAiB,WACnB;AACF;AAEA,SAAgB,WAAW,MAAY,YAA4C;CACjF,OAAO,OAAO,KAAK,CAAC,eAAe;AACrC;AAMA,MAAM,OAA6B;CAAE,OAAO;CAAG,OAAO;CAAG,YAAY;CAAG,SAAS;AAAE;AAEnF,SAAgB,cAAc,KAAmB;CAC/C,IAAI,OAAa;CACjB,IAAI,WAAW;CACf,KAAK,MAAM,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,CAAC,GAAG;EACvD,MAAM,IAAiB,OAAO,KAAK,IAAI,QAAQ,UAAU,WAAW,eAAe;EACnF,IAAI,KAAK,KAAK,KAAK,UAAU;GAC3B,OAAO;GACP,WAAW,KAAK;EAClB;CACF;CACA,OAAO;AACT;AAKA,MAAa,eAAe"}
+{"version":3,"file":"roles.js","names":[],"sources":["../../src/organizations/roles.ts"],"sourcesContent":["// organizations context — roles and the authorization matrix.\n// Defined in code (no DB enum). The DB stores role as text; the domain narrows\n// it to Role and answers authorization questions here. The Role type itself is\n// owned by @headless-lms/core/types; RANK/MATRIX below are Record<Role, …>, so the\n// compiler forces this file to cover every role the published type declares.\nimport type { Role } from '../types/index.js';\n\nexport type { Role };\nexport const ROLES = ['owner', 'admin', 'instructor', 'student'] as const satisfies readonly Role[];\n\n/**\n * The roles that operate the back office. `student` belongs to the org but\n * never appears on a staff surface, so the member-management types are typed\n * with this narrower union — the exclusion is a compiler guarantee, not a\n * convention a query has to remember.\n */\nexport type StaffRole = Exclude<Role, 'student'>;\nexport const STAFF_ROLES = ['owner', 'admin', 'instructor'] as const satisfies readonly StaffRole[];\n\nexport function isRole(value: string): value is Role {\n  return (ROLES as readonly string[]).includes(value);\n}\n\nexport function isStaffRole(value: string): value is StaffRole {\n  return (STAFF_ROLES as readonly string[]).includes(value);\n}\n\nexport function parseRole(value: string): Role {\n  if (!isRole(value)) {\n    throw new Error(`unknown role: ${value}`);\n  }\n  return value;\n}\n\nexport type Permission =\n  | 'manage_billing'\n  | 'manage_org_settings'\n  | 'manage_users'\n  | 'create_course'\n  | 'edit_assigned_course'\n  | 'view_student_progress'\n  | 'consume_content';\n\n// Unconditional (true), course-scoped (\"assigned\"), or enrollment-scoped\n// (\"enrolled\" — access owned by entitlements). Absent ⇒ denied.\n//\n// \"assigned\" is a granted-but-narrowed answer: the role holds the permission,\n// but only over some subset of courses. Nothing narrows it today — there is no\n// course-assignment store — so callers must decide what a narrowed grant means\n// for them. `authorize` treats it as denied; `tools.ts` treats it as granted.\nexport type Capability = true | 'assigned' | 'enrolled';\n\nconst MATRIX: Record<Role, Partial<Record<Permission, Capability>>> = {\n  owner: {\n    manage_billing: true,\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n  },\n  admin: {\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n  },\n  instructor: {\n    edit_assigned_course: 'assigned',\n    view_student_progress: 'assigned',\n  },\n  // A learner belongs to the org to consume content they hold an\n  // entitlement for. No management capability of any kind.\n  student: {\n    consume_content: 'enrolled',\n  },\n};\n\nexport function capability(role: Role, permission: Permission): Capability | false {\n  return MATRIX[role][permission] ?? false;\n}\n\n// Better Auth's role model is broader than ours: it keeps a built-in `member`\n// role and allows comma-joined multi-role strings. Normalize any incoming role\n// string to a single domain Role before persisting: `member` -> `instructor`, a\n// multi-role string -> its highest-privilege known role, unknown -> `instructor`.\nconst RANK: Record<Role, number> = { owner: 3, admin: 2, instructor: 1, student: 0 };\n\nexport function normalizeRole(raw: string): Role {\n  let best: Role = 'instructor';\n  let bestRank = -1;\n  for (const token of raw.split(',').map((t) => t.trim())) {\n    const r: Role | null = isRole(token) ? token : token === 'member' ? 'instructor' : null;\n    if (r && RANK[r] > bestRank) {\n      best = r;\n      bestRank = RANK[r];\n    }\n  }\n  return best;\n}\n\n// Invites carry either a staff Role or this marker: the invited account is\n// a portal student, not an org member. Owned by the organizations domain — the\n// invite provider adapter reuses it to branch links, emails, and grants.\nexport const STUDENT_ROLE = 'student';\n"],"mappings":";AAQA,MAAa,QAAQ;CAAC;CAAS;CAAS;CAAc;AAAS;AAS/D,MAAa,cAAc;CAAC;CAAS;CAAS;AAAY;AAE1D,SAAgB,OAAO,OAA8B;CACnD,OAAQ,MAA4B,SAAS,KAAK;AACpD;AAEA,SAAgB,YAAY,OAAmC;CAC7D,OAAQ,YAAkC,SAAS,KAAK;AAC1D;AAEA,SAAgB,UAAU,OAAqB;CAC7C,IAAI,CAAC,OAAO,KAAK,GACf,MAAM,IAAI,MAAM,iBAAiB,OAAO;CAE1C,OAAO;AACT;AAoBA,MAAM,SAAgE;CACpE,OAAO;EACL,gBAAgB;EAChB,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;CACzB;CACA,OAAO;EACL,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;CACzB;CACA,YAAY;EACV,sBAAsB;EACtB,uBAAuB;CACzB;CAGA,SAAS,EACP,iBAAiB,WACnB;AACF;AAEA,SAAgB,WAAW,MAAY,YAA4C;CACjF,OAAO,OAAO,KAAK,CAAC,eAAe;AACrC;AAMA,MAAM,OAA6B;CAAE,OAAO;CAAG,OAAO;CAAG,YAAY;CAAG,SAAS;AAAE;AAEnF,SAAgB,cAAc,KAAmB;CAC/C,IAAI,OAAa;CACjB,IAAI,WAAW;CACf,KAAK,MAAM,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,CAAC,GAAG;EACvD,MAAM,IAAiB,OAAO,KAAK,IAAI,QAAQ,UAAU,WAAW,eAAe;EACnF,IAAI,KAAK,KAAK,KAAK,UAAU;GAC3B,OAAO;GACP,WAAW,KAAK;EAClB;CACF;CACA,OAAO;AACT;AAKA,MAAa,eAAe"}

package/dist/organizations/service.d.ts

@@ -1,5 +1,5 @@
 import { Logger } from "../types/ports.js";
-import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, Invite, OrgUser, Organization, Role } from "../types/schemas/organizations.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, Invite, OrgUser, Organization, Role, UpdateOrgUserInput } from "../types/schemas/organizations.js";
 import "../shared/ports.js";
 import { Mailer } from "../shared/mailer.js";
 import { IdentityService } from "../identity/ports.js";
@@ -8,7 +8,7 @@ import "./model.js";
 import "./roles.js";
 import { Member, MembersQuery, Page } from "./members.js";
 import { CreateOrganizationInput, ResendStudentInviteInput, UpdateOrganizationInput, UpdateStudentInput } from "./types.js";
-import { MemberWriteContext, MembersRepository, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork } from "./ports.js";
+import { MemberWriteContext, MembersRepository, OrgAdmin, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork } from "./ports.js";
 //#region src/organizations/service.d.ts
 interface InviteUrls {
   studentPortalUrl: string;
@@ -19,6 +19,7 @@ type OrganizationServiceParams = {
   membersRepo: MembersRepository;
   people: IdentityService;
   uow: OrganizationsUnitOfWork;
+  orgAdmin: () => OrgAdmin;
   logger?: Logger;
   mailer?: Pick<Mailer, 'send'>;
   inviteUrls?: InviteUrls;
@@ -28,6 +29,7 @@ declare class OrganizationServiceImpl implements OrganizationService {
   private readonly membersRepo;
   private readonly people;
   private readonly uow;
+  private readonly orgAdmin;
   private readonly logger;
   private readonly mailer?;
   private readonly inviteUrls?;
@@ -36,12 +38,15 @@ declare class OrganizationServiceImpl implements OrganizationService {
   updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization>;
   deleteOrganization(id: string): Promise<Organization>;
   addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser>;
-  removeOrgUser(orgId: string, id: string): Promise<OrgUser>;
+  removeOrgUser(orgId: string, userId: string): Promise<OrgUser>;
+  updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser>;
   createInvite(input: CreateInviteInput): Promise<Invite>;
   updateStudent(input: UpdateStudentInput): Promise<OrgUser>;
   resendStudentInvite(input: ResendStudentInviteInput): Promise<void>;
   peekInvite(token: string): Promise<Invite | null>;
   acceptInvite(input: AcceptInviteInput): Promise<OrgUser>;
+  private acceptStudentInvite;
+  private acceptStaffInvite;
   getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
   deleteOrgUser(orgId: string, id: string): Promise<OrgUser>;
   getOrgUsersForUser(userId: string): Promise<OrgUser[]>;
@@ -51,7 +56,7 @@ declare class OrganizationServiceImpl implements OrganizationService {
   getBySlug(slug: string): Promise<Organization | null>;
   listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>>;
   updateMemberRole(ctx: MemberWriteContext, id: string, role: Role): Promise<Member | null>;
-  removeMember(_ctx: MemberWriteContext, _id: string): Promise<boolean>;
+  removeMember(ctx: MemberWriteContext, id: string): Promise<boolean>;
 }
 //#endregion
 export { InviteUrls, OrganizationServiceImpl, OrganizationServiceParams };

package/dist/organizations/service.js

@@ -1,5 +1,5 @@
-import { genId } from "../shared/id.js";
 import { noopLogger } from "../shared/logger.js";
+import { genId } from "../shared/id.js";
 import { NotFoundError } from "../shared/errors.js";
 import { STUDENT_ROLE } from "./roles.js";
 import { InviteError, OrganizationRuleError } from "./members.js";
@@ -25,6 +25,7 @@ var OrganizationServiceImpl = class {
 	membersRepo;
 	people;
 	uow;
+	orgAdmin;
 	logger;
 	mailer;
 	inviteUrls;
@@ -33,6 +34,7 @@ var OrganizationServiceImpl = class {
 		this.membersRepo = params.membersRepo;
 		this.people = params.people;
 		this.uow = params.uow;
+		this.orgAdmin = params.orgAdmin;
 		this.logger = params.logger ?? noopLogger;
 		this.mailer = params.mailer;
 		this.inviteUrls = params.inviteUrls;
@@ -108,57 +110,85 @@ var OrganizationServiceImpl = class {
 		});
 		return orgUser;
 	}
-	async removeOrgUser(orgId, id) {
+	async removeOrgUser(orgId, userId) {
 		const deleted = await this.uow.run(async ({ organizations, outbox }) => {
-			const deletedUser = await organizations.deleteOrgUser(orgId, id);
-			if (!deletedUser) throw new NotFoundError("OrgUser", id);
+			const orgUser = await organizations.findOrgUser(orgId, userId);
+			if (!orgUser) throw new NotFoundError("OrgUser", userId);
+			const deletedUser = await organizations.deleteOrgUser(orgId, orgUser.id);
+			if (!deletedUser) throw new NotFoundError("OrgUser", orgUser.id);
 			await outbox.append([organizationEvents.orgUserDeleted.make({
 				orgId,
 				data: deletedUser
 			})]);
 			return deletedUser;
 		});
-		this.logger.info("organization deleted", { orgId: deleted.id });
+		this.logger.info("org user removed", {
+			orgId,
+			userId,
+			orgUserId: deleted.id
+		});
 		return deleted;
 	}
+	async updateOrgUser(orgId, userId, patch) {
+		const orgUser = await this.repo.findOrgUser(orgId, userId);
+		if (!orgUser) throw new NotFoundError("OrgUser", userId);
+		const updated = await this.repo.updateOrgUser(orgId, orgUser.id, patch);
+		if (!updated) throw new NotFoundError("OrgUser", orgUser.id);
+		this.logger.info("org user updated", {
+			orgId,
+			userId,
+			orgUserId: updated.id,
+			patch
+		});
+		return updated;
+	}
 	async createInvite(input) {
 		const { orgId, email, role, inviterUserId, firstName, lastName } = input;
 		const sendEmail = input.sendEmail ?? true;
 		const { token, tokenHash } = generateInviteToken();
 		const expiresAt = new Date(Date.now() + INVITE_TTL_MS);
-		const person = role === "student" ? await this.people.createUser({
+		const person = role === "student" ? await this.people.getUserByEmail(email) ?? await this.people.createUser({
 			email,
 			...firstName !== void 0 && { firstName },
 			...lastName !== void 0 && { lastName }
 		}) : null;
 		const invite = await this.uow.run(async ({ organizations, outbox }) => {
-			const row = await organizations.upsertPendingInvite(orgId, {
-				email,
-				role,
-				invitedBy: inviterUserId,
-				tokenHash,
-				expiresAt
-			});
-			const events = [organizationEvents.inviteCreated.make({
-				orgId,
-				data: row
-			})];
+			const events = [];
 			if (person) {
-				const { orgUser, created } = await organizations.ensureOrgUser({
+				const orgUser = await organizations.createOrgUser({
 					orgId,
 					userId: person.id,
 					role: STUDENT_ROLE,
 					status: "invited"
 				});
-				if (created) events.push(organizationEvents.studentCreated.make({
+				events.push(organizationEvents.studentCreated.make({
 					orgId,
 					data: orgUser
 				}));
 			}
+			const row = await organizations.upsertPendingInvite(orgId, {
+				email,
+				role,
+				invitedBy: inviterUserId,
+				tokenHash,
+				expiresAt
+			});
+			events.push(organizationEvents.inviteCreated.make({
+				orgId,
+				data: row
+			}));
 			await outbox.append(events);
 			return row;
 		});
-		if (sendEmail) await this.sendInviteEmail(invite, token);
+		if (sendEmail) try {
+			await this.sendInviteEmail(invite, token);
+		} catch (err) {
+			this.logger.error("failed to send invite email", {
+				email: invite.email,
+				role: invite.role,
+				err: err instanceof Error ? err : new Error(String(err))
+			});
+		}
 		this.logger.info("invite created", {
 			orgId,
 			inviteId: invite.id,
@@ -195,16 +225,18 @@ var OrganizationServiceImpl = class {
 		if (orgUser.status === "active") throw new OrganizationRuleError("That student has already accepted their invitation");
 		const person = await this.people.getUserById(orgUser.userId);
 		if (!person) throw new NotFoundError("User", orgUser.userId);
-		await this.createInvite({
-			orgId,
-			email: person.email,
-			role: STUDENT_ROLE,
-			inviterUserId,
-			sendEmail: true
-		});
+		const pending = await this.repo.findPendingInvite(orgId, person.email);
+		if (!pending) throw new NotFoundError("Invite", person.email);
+		const { token, tokenHash } = generateInviteToken();
+		const expiresAt = new Date(Date.now() + INVITE_TTL_MS);
+		const invite = await this.repo.setInviteToken(orgId, pending.id, tokenHash, expiresAt);
+		if (!invite) throw new NotFoundError("Invite", pending.id);
+		await this.sendInviteEmail(invite, token);
 		this.logger.info("student invite resent", {
 			orgId,
-			orgUserId
+			orgUserId,
+			inviteId: invite.id,
+			inviterUserId
 		});
 	}
 	async peekInvite(token) {
@@ -226,39 +258,48 @@ var OrganizationServiceImpl = class {
 			});
 			throw new InviteError("emails must match");
 		}
-		if (!await this.repo.findById(invite.orgId)) throw new InviteError("Org not found");
-		const orgUser = await this.uow.run(async ({ organizations, outbox }) => {
-			const { orgUser: row, created } = await organizations.ensureOrgUser({
-				orgId: invite.orgId,
-				userId: input.userId,
-				role: invite.role,
-				status: "active"
-			});
+		const org = await this.repo.findById(invite.orgId);
+		if (!org) throw new InviteError("Org not found");
+		const orgUser = invite.role === "student" ? await this.acceptStudentInvite(invite, input.userId) : await this.acceptStaffInvite(invite, org, input.userId);
+		this.logger.info("invite accepted", {
+			orgId: invite.orgId,
+			userId: input.userId
+		});
+		return orgUser;
+	}
+	async acceptStudentInvite(invite, userId) {
+		return this.uow.run(async ({ organizations, outbox }) => {
+			const existing = await organizations.findOrgUser(invite.orgId, userId);
+			if (!existing) throw new NotFoundError("OrgUser", userId);
+			const activated = await organizations.updateOrgUser(invite.orgId, existing.id, { status: "active" });
+			if (!activated) throw new NotFoundError("OrgUser", existing.id);
 			const acceptedInvite = await organizations.setInviteStatus(invite.orgId, invite.id, "accepted");
 			if (!acceptedInvite) throw new NotFoundError("Invite", invite.id);
-			const events = [organizationEvents.inviteAccepted.make({
+			await outbox.append([organizationEvents.inviteAccepted.make({
 				orgId: invite.orgId,
 				data: acceptedInvite
-			})];
-			if (row.role === "student") events.push(created ? organizationEvents.studentCreated.make({
+			}), organizationEvents.studentLinked.make({
 				orgId: invite.orgId,
-				data: row
-			}) : organizationEvents.studentLinked.make({
-				orgId: invite.orgId,
-				data: row
-			}));
-			else if (created) events.push(organizationEvents.orgUserLinked.make({
-				orgId: invite.orgId,
-				data: row
-			}));
-			await outbox.append(events);
-			return row;
+				data: activated
+			})]);
+			return activated;
 		});
-		this.logger.info("invite accepted", {
-			orgId: invite.orgId,
-			userId: input.userId
+	}
+	async acceptStaffInvite(invite, org, userId) {
+		const person = await this.people.getUserById(userId);
+		if (!person?.externalId) throw new NotFoundError("User", userId);
+		await this.orgAdmin().grantMembership(org.externalId ?? org.id, person.externalId, invite.role);
+		return this.uow.run(async ({ organizations, outbox }) => {
+			const orgUser = await organizations.findOrgUser(invite.orgId, userId);
+			if (!orgUser) throw new NotFoundError("OrgUser", userId);
+			const acceptedInvite = await organizations.setInviteStatus(invite.orgId, invite.id, "accepted");
+			if (!acceptedInvite) throw new NotFoundError("Invite", invite.id);
+			await outbox.append([organizationEvents.inviteAccepted.make({
+				orgId: invite.orgId,
+				data: acceptedInvite
+			})]);
+			return orgUser;
 		});
-		return orgUser;
 	}
 	async getOrgUser(orgId, userId) {
 		return this.repo.findOrgUser(orgId, userId);
@@ -297,23 +338,15 @@ var OrganizationServiceImpl = class {
 			token,
 			email
 		})).toString()}`;
-		try {
-			if (role === "student") await this.mailer.send(email, "studentInvite", {
-				inviteUrl,
-				studentName: email
-			});
-			else await this.mailer.send(email, "memberInvite", {
-				inviteUrl,
-				inviterName: "Your team",
-				role
-			});
-		} catch (err) {
-			this.logger.error("failed to send invite email", {
-				email,
-				role,
-				err: err instanceof Error ? err : new Error(String(err))
-			});
-		}
+		if (role === "student") await this.mailer.send(email, "studentInvite", {
+			inviteUrl,
+			studentName: email
+		});
+		else await this.mailer.send(email, "memberInvite", {
+			inviteUrl,
+			inviterName: "Your team",
+			role
+		});
 	}
 	async getByExternalId(externalId) {
 		return this.repo.findByExternalId(externalId);
@@ -341,6 +374,7 @@ var OrganizationServiceImpl = class {
 			});
 			throw new OrganizationRuleError("Only active members can have their role changed");
 		}
+		await this.orgAdmin().updateRole(ctx, member.userExternalId, role);
 		const updated = await this.membersRepo.findById(ctx.orgId, id);
 		this.logger.info("member role updated", {
 			orgId: ctx.orgId,
@@ -349,7 +383,32 @@ var OrganizationServiceImpl = class {
 		});
 		return updated ? toMember(updated) : null;
 	}
-	async removeMember(_ctx, _id) {
+	async removeMember(ctx, id) {
+		const member = await this.membersRepo.findById(ctx.orgId, id);
+		if (!member) return false;
+		if (member.role === "owner") {
+			this.logger.warn("member removal rejected: owner cannot be removed", {
+				orgId: ctx.orgId,
+				memberId: id
+			});
+			throw new OrganizationRuleError("The owner cannot be removed");
+		}
+		if (member.kind === "member" && member.userExternalId) await this.orgAdmin().removeMember(ctx, member.userExternalId);
+		else if (member.kind === "invite" && member.inviteId) {
+			const inviteId = member.inviteId;
+			await this.uow.run(async ({ organizations, outbox }) => {
+				const canceled = await organizations.setInviteStatus(ctx.orgId, inviteId, "canceled");
+				if (!canceled) throw new NotFoundError("Invite", inviteId);
+				await outbox.append([organizationEvents.inviteCanceled.make({
+					orgId: ctx.orgId,
+					data: canceled
+				})]);
+			});
+		}
+		this.logger.info("member removed", {
+			orgId: ctx.orgId,
+			memberId: id
+		});
 		return true;
 	}
 };

package/dist/organizations/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../src/organizations/service.ts"],"sourcesContent":["// organizations context — service implementation (inbound port).\nimport type {\n  MemberRecord,\n  MembersRepository,\n  MemberWriteContext,\n  OrganizationService,\n  OrganizationsRepository,\n  OrganizationsUnitOfWork,\n} from './ports.js';\nimport type { Invite, Organization, OrgUser } from './model.js';\nimport { type Role, STUDENT_ROLE } from './roles.js';\nimport {\n  InviteError,\n  type Member,\n  type MembersQuery,\n  OrganizationRuleError,\n  type Page,\n} from './members.js';\nimport type {\n  AcceptInviteInput,\n  AddOrgUserInput,\n  CreateInviteInput,\n  CreateOrganizationInput,\n  ResendStudentInviteInput,\n  UpdateOrganizationInput,\n  UpdateStudentInput,\n} from './types.js';\nimport { organizationEvents, type OrganizationEvent } from './events.js';\nimport type { Logger, NewDomainEvent } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport { generateInviteToken, hashInviteToken } from '../shared/invite-token.js';\nimport { NotFoundError } from '../shared/errors.js';\nimport type { IdentityService } from '../identity/index.js';\nimport { genId } from '../shared/id.js';\n\nconst INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ntype NewOrganizationEvent = NewDomainEvent<OrganizationEvent>;\n\nexport interface InviteUrls {\n  studentPortalUrl: string;\n  adminAppUrl: string;\n}\n\nfunction toMember(r: MemberRecord): Member {\n  return {\n    id: r.id,\n    firstName: r.firstName,\n    lastName: r.lastName,\n    email: r.email,\n    image: r.image,\n    role: r.role,\n    status: r.status,\n    joinedAt: r.joinedAt,\n    invitedAt: r.invitedAt,\n  };\n}\n\nexport type OrganizationServiceParams = {\n  repo: OrganizationsRepository;\n  membersRepo: MembersRepository;\n  people: IdentityService;\n  uow: OrganizationsUnitOfWork;\n  logger?: Logger;\n  mailer?: Pick<Mailer, 'send'>;\n  inviteUrls?: InviteUrls;\n};\n\nexport class OrganizationServiceImpl implements OrganizationService {\n  private readonly repo: OrganizationsRepository;\n  private readonly membersRepo: MembersRepository;\n  private readonly people: IdentityService;\n  private readonly uow: OrganizationsUnitOfWork;\n  private readonly logger: Logger;\n  private readonly mailer?: Pick<Mailer, 'send'>;\n  private readonly inviteUrls?: InviteUrls;\n\n  constructor(params: OrganizationServiceParams) {\n    this.repo = params.repo;\n    this.membersRepo = params.membersRepo;\n    this.people = params.people;\n    this.uow = params.uow;\n    this.logger = params.logger ?? noopLogger;\n    this.mailer = params.mailer;\n    this.inviteUrls = params.inviteUrls;\n  }\n\n  async createOrganization(input: CreateOrganizationInput): Promise<Organization> {\n    const created = await this.uow.run(async ({ organizations, outbox }) => {\n      const id = genId('organization');\n\n      const created = await organizations.create({\n        id,\n        // The auth provider adopts this id for its own org row, so the org is\n        // its own external id — a lookup by either id lands on the same row.\n        externalId: input.externalId ?? id,\n        name: input.name ?? `My Org`,\n        slug: input.slug ?? '',\n        ownerId: input.ownerId,\n      });\n      await outbox.append([\n        organizationEvents.organizationCreated.make({\n          orgId: created.id,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('organization created', { orgId: created.id, slug: created.slug });\n    return created;\n  }\n\n  async updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization> {\n    const updatedOrg = await this.uow.run(async ({ organizations, outbox }) => {\n      const updated = await organizations.update(id, {\n        name: input.name,\n        slug: input.slug,\n      });\n      if (!updated) {\n        throw new NotFoundError('Organization', id);\n      }\n      await outbox.append([\n        organizationEvents.organizationUpdated.make({ orgId: id, data: updated }),\n      ]);\n      return updated;\n    });\n\n    this.logger.info('organization updated', { updatedOrg });\n    return updatedOrg!;\n  }\n\n  async deleteOrganization(id: string): Promise<Organization> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const deleted = await organizations.delete(id);\n\n      await outbox.append([\n        organizationEvents.organizationDeleted.make({\n          orgId: deleted.id,\n          data: deleted,\n        }),\n      ]);\n      return deleted;\n    });\n    this.logger.info('organization deleted', { orgId: deleted.id });\n    return deleted;\n  }\n\n  async addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser> {\n    const orgUser = await this.uow.run(async ({ organizations, outbox }) => {\n      const created = await organizations.createOrgUser({ orgId, role, userId, status: 'active' });\n      await outbox.append([\n        organizationEvents.orgUserLinked.make({ orgId, data: created }),\n      ]);\n      return created;\n    });\n    this.logger.info('user added to organization', { orgId, userId, role });\n    return orgUser;\n  }\n\n  async removeOrgUser(orgId: string, id: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const deletedUser = await organizations.deleteOrgUser(orgId, id);\n      if (!deletedUser) {\n        throw new NotFoundError('OrgUser', id);\n      }\n      await outbox.append([\n        organizationEvents.orgUserDeleted.make({\n          orgId,\n          data: deletedUser,\n        }),\n      ]);\n      return deletedUser;\n    });\n    this.logger.info('organization deleted', { orgId: deleted.id });\n    return deleted;\n  }\n\n  async createInvite(input: CreateInviteInput): Promise<Invite> {\n    const { orgId, email, role, inviterUserId, firstName, lastName } = input;\n    const sendEmail = input.sendEmail ?? true;\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n\n    // A student belongs to the org from the moment an admin adds them, not from\n    // the moment they click a link — so the person exists before the invite\n    // does. Staff are excluded: their org_users row is mirrored from the auth\n    // provider's member record, which does not exist until they join.\n    const person =\n      role === STUDENT_ROLE\n        ? await this.people.createUser({\n            email,\n            ...(firstName !== undefined && { firstName }),\n            ...(lastName !== undefined && { lastName }),\n          })\n        : null;\n\n    const invite = await this.uow.run(async ({ organizations, outbox }) => {\n      const row = await organizations.upsertPendingInvite(orgId, {\n        email,\n        role,\n        invitedBy: inviterUserId,\n        tokenHash,\n        expiresAt,\n      });\n      const events: NewOrganizationEvent[] = [\n        organizationEvents.inviteCreated.make({ orgId, data: row }),\n      ];\n      if (person) {\n        // Idempotent: re-inviting an address rotates the token without\n        // producing a second org user or a second student.created.\n        const { orgUser, created } = await organizations.ensureOrgUser({\n          orgId,\n          userId: person.id,\n          role: STUDENT_ROLE,\n          status: 'invited',\n        });\n        if (created) {\n          events.push(\n            organizationEvents.studentCreated.make({ orgId, data: orgUser }),\n          );\n        }\n      }\n      await outbox.append(events);\n      return row;\n    });\n\n    if (sendEmail) {\n      // TODO make this workflow durable\n      await this.sendInviteEmail(invite, token);\n    }\n\n    this.logger.info('invite created', { orgId, inviteId: invite.id, role, sendEmail });\n    return invite;\n  }\n\n  async updateStudent(input: UpdateStudentInput): Promise<OrgUser> {\n    const { orgId, orgUserId, firstName, lastName, email } = input;\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n\n    const previousEmail = person.email;\n    await this.people.updateUser(person.id, {\n      ...(firstName !== undefined && { firstName }),\n      ...(lastName !== undefined && { lastName }),\n      ...(email !== undefined && { email }),\n    });\n\n    // The pending invite carries its own copy of the address and a token minted\n    // against it. Once the address is corrected that invite points at the wrong\n    // person, so it is cancelled rather than left live — the admin re-sends,\n    // which mints a fresh one for the new address. A student who has already\n    // accepted has no pending invite to worry about.\n    const emailChanged = email !== undefined && email.toLowerCase() !== previousEmail.toLowerCase();\n    if (emailChanged && orgUser.status !== 'active') {\n      await this.repo.cancelPendingInvite(orgId, previousEmail);\n    }\n\n    this.logger.info('student updated', { orgId, orgUserId, emailChanged });\n    return orgUser;\n  }\n\n  async resendStudentInvite(input: ResendStudentInviteInput): Promise<void> {\n    const { orgId, orgUserId, inviterUserId } = input;\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    if (orgUser.status === 'active') {\n      throw new OrganizationRuleError('That student has already accepted their invitation');\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n    // Straight back through createInvite: it rotates the token on the pending\n    // row and finds the existing org user, so a resend is an invite that\n    // happens to be the second one.\n    await this.createInvite({\n      orgId,\n      email: person.email,\n      role: STUDENT_ROLE,\n      inviterUserId,\n      sendEmail: true,\n    });\n    this.logger.info('student invite resent', { orgId, orgUserId });\n  }\n\n  async peekInvite(token: string): Promise<Invite | null> {\n    const invite = await this.repo.findInviteByTokenHash(hashInviteToken(token));\n    if (!invite || invite.status !== 'pending') {\n      return null;\n    }\n    if (invite.expiresAt && invite.expiresAt < new Date()) {\n      return null;\n    }\n    return invite;\n  }\n\n  async acceptInvite(input: AcceptInviteInput): Promise<OrgUser> {\n    const invite = await this.peekInvite(input.token);\n    if (!invite) {\n      this.logger.warn('invite accept refused: token invalid or expired');\n      throw new InviteError('invalid invite');\n    }\n    if (invite.email.toLowerCase() !== input.email.toLowerCase()) {\n      this.logger.warn('invite accept refused: email mismatch', {\n        orgId: invite.orgId,\n        inviteId: invite.id,\n      });\n      throw new InviteError('emails must match');\n    }\n    const org = await this.repo.findById(invite.orgId);\n    if (!org) {\n      throw new InviteError('Org not found');\n    }\n\n    const orgUser = await this.uow.run(async ({ organizations, outbox }) => {\n      // A student provisioned at invite time already has a row — acceptance\n      // activates it. Staff have none yet, so this inserts one.\n      const { orgUser: row, created } = await organizations.ensureOrgUser({\n        orgId: invite.orgId,\n        userId: input.userId,\n        role: invite.role,\n        status: 'active',\n      });\n      const acceptedInvite = await organizations.setInviteStatus(invite.orgId, invite.id, 'accepted');\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      const events: NewOrganizationEvent[] = [\n        organizationEvents.inviteAccepted.make({\n          orgId: invite.orgId,\n          data: acceptedInvite,\n        }),\n      ];\n      if (row.role === STUDENT_ROLE) {\n        events.push(\n          created\n            ? organizationEvents.studentCreated.make({\n                orgId: invite.orgId,\n                data: row,\n              })\n            : organizationEvents.studentLinked.make({\n                orgId: invite.orgId,\n                data: row,\n              }),\n        );\n      } else if (created) {\n        events.push(\n          organizationEvents.orgUserLinked.make({\n            orgId: invite.orgId,\n            data: row,\n          }),\n        );\n      }\n      await outbox.append(events);\n      return row;\n    });\n    this.logger.info('invite accepted', { orgId: invite.orgId, userId: input.userId });\n    return orgUser;\n  }\n\n  // By identity USER id — `(org_id, user_id)` is unique. Every caller (scope\n  // resolution, the MCP principal, the learn routes) asks \"what is this person\n  // in this org\", never \"what is this org_users row\".\n  async getOrgUser(orgId: string, userId: string): Promise<OrgUser | null> {\n    return this.repo.findOrgUser(orgId, userId);\n  }\n\n  async deleteOrgUser(orgId: string, id: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUserById(orgId, id);\n      if (!orgUser) {\n        throw new NotFoundError('OrgUser', id);\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, id);\n      if (!deletedUser) {\n        throw new NotFoundError('OrgUser', id);\n      }\n      const events: NewOrganizationEvent[] = [];\n      if (deletedUser.role === STUDENT_ROLE) {\n        events.push(\n          organizationEvents.studentDeleted.make({ orgId, data: orgUser }),\n        );\n      }\n\n      await outbox.append(events);\n      return deletedUser;\n    });\n    this.logger.info('org user deleted', { orgId, orgUserId: id });\n    return deleted;\n  }\n\n  async getOrgUsersForUser(userId: string): Promise<OrgUser[]> {\n    return this.repo.findOrgUsersByUser(userId);\n  }\n\n  async getById(id: string): Promise<Organization | null> {\n    return this.repo.findById(id);\n  }\n\n  private async sendInviteEmail(invite: Invite, token: string): Promise<void> {\n    if (!this.mailer || !this.inviteUrls) {\n      throw new Error('invite delivery is not configured (mailer / invite urls missing)');\n    }\n    const { email, role } = invite;\n    const isStudent = role === STUDENT_ROLE;\n    const base = isStudent\n      ? `${this.inviteUrls.studentPortalUrl}/welcome`\n      : `${this.inviteUrls.adminAppUrl}/invite`;\n    // The portal resolves the token to the invited email, so the link carries\n    // only the token. The admin app still reads it from the query.\n    const query = isStudent\n      ? new URLSearchParams({ token })\n      : new URLSearchParams({ token, email });\n    const inviteUrl = `${base}?${query.toString()}`;\n    try {\n      if (role === STUDENT_ROLE) {\n        await this.mailer.send(email, 'studentInvite', { inviteUrl, studentName: email });\n      } else {\n        await this.mailer.send(email, 'memberInvite', {\n          inviteUrl,\n          inviterName: 'Your team',\n          role,\n        });\n      }\n    } catch (err) {\n      // A failed email must not abort invite creation: the token is already\n      // minted and recorded, so the admin can fix transport and resend.\n      this.logger.error('failed to send invite email', {\n        email,\n        role,\n        err: err instanceof Error ? err : new Error(String(err)),\n      });\n    }\n  }\n\n  async getByExternalId(externalId: string): Promise<Organization | null> {\n    return this.repo.findByExternalId(externalId);\n  }\n\n  async getBySlug(slug: string): Promise<Organization | null> {\n    return this.repo.findBySlug(slug);\n  }\n\n  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>> {\n    return this.membersRepo.list(orgId, query);\n  }\n\n  async updateMemberRole(ctx: MemberWriteContext, id: string, role: Role): Promise<Member | null> {\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return null;\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('role change rejected: owner role immutable', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner role cannot be reassigned');\n    }\n    if (member.kind !== 'member' || !member.userExternalId) {\n      this.logger.warn('role change rejected: not an active member', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('Only active members can have their role changed');\n    }\n\n    const updated = await this.membersRepo.findById(ctx.orgId, id);\n    this.logger.info('member role updated', { orgId: ctx.orgId, memberId: id, role });\n    return updated ? toMember(updated) : null;\n  }\n\n  async removeMember(_ctx: MemberWriteContext, _id: string): Promise<boolean> {\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;AAoCA,MAAM,gBAAgB,QAAc,KAAK;AASzC,SAAS,SAAS,GAAyB;CACzC,OAAO;EACL,IAAI,EAAE;EACN,WAAW,EAAE;EACb,UAAU,EAAE;EACZ,OAAO,EAAE;EACT,OAAO,EAAE;EACT,MAAM,EAAE;EACR,QAAQ,EAAE;EACV,UAAU,EAAE;EACZ,WAAW,EAAE;CACf;AACF;AAYA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,OAAO,OAAO;EACnB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO;EACrB,KAAK,MAAM,OAAO;EAClB,KAAK,SAAS,OAAO,UAAU;EAC/B,KAAK,SAAS,OAAO;EACrB,KAAK,aAAa,OAAO;CAC3B;CAEA,MAAM,mBAAmB,OAAuD;EAC9E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,KAAK,MAAM,cAAc;GAE/B,MAAM,UAAU,MAAM,cAAc,OAAO;IACzC;IAGA,YAAY,MAAM,cAAc;IAChC,MAAM,MAAM,QAAQ;IACpB,MAAM,MAAM,QAAQ;IACpB,SAAS,MAAM;GACjB,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB;GAAE,OAAO,QAAQ;GAAI,MAAM,QAAQ;EAAK,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAY,OAAuD;EAC1F,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACzE,MAAM,UAAU,MAAM,cAAc,OAAO,IAAI;IAC7C,MAAM,MAAM;IACZ,MAAM,MAAM;GACd,CAAC;GACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,gBAAgB,EAAE;GAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAAE,OAAO;IAAI,MAAM;GAAQ,CAAC,CAC1E,CAAC;GACD,OAAO;EACT,CAAC;EAED,KAAK,OAAO,KAAK,wBAAwB,EAAE,WAAW,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAmC;EAC1D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB,EAAE,OAAO,QAAQ,GAAG,CAAC;EAC9D,OAAO;CACT;CAEA,MAAM,WAAW,EAAE,OAAO,QAAQ,QAA2C;EAC3E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,cAAc;IAAE;IAAO;IAAM;IAAQ,QAAQ;GAAS,CAAC;GAC3F,MAAM,OAAO,OAAO,CAClB,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAChE,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,8BAA8B;GAAE;GAAO;GAAQ;EAAK,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,IAA8B;EAC/D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,EAAE;GAC/D,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IACrC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB,EAAE,OAAO,QAAQ,GAAG,CAAC;EAC9D,OAAO;CACT;CAEA,MAAM,aAAa,OAA2C;EAC5D,MAAM,EAAE,OAAO,OAAO,MAAM,eAAe,WAAW,aAAa;EACnE,MAAM,YAAY,MAAM,aAAa;EACrC,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EAMrD,MAAM,SACJ,SAAA,YACI,MAAM,KAAK,OAAO,WAAW;GAC3B;GACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;EAC3C,CAAC,IACD;EAEN,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACrE,MAAM,MAAM,MAAM,cAAc,oBAAoB,OAAO;IACzD;IACA;IACA,WAAW;IACX;IACA;GACF,CAAC;GACD,MAAM,SAAiC,CACrC,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAI,CAAC,CAC5D;GACA,IAAI,QAAQ;IAGV,MAAM,EAAE,SAAS,YAAY,MAAM,cAAc,cAAc;KAC7D;KACA,QAAQ,OAAO;KACf,MAAM;KACN,QAAQ;IACV,CAAC;IACD,IAAI,SACF,OAAO,KACL,mBAAmB,eAAe,KAAK;KAAE;KAAO,MAAM;IAAQ,CAAC,CACjE;GAEJ;GACA,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EAED,IAAI,WAEF,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EAG1C,KAAK,OAAO,KAAK,kBAAkB;GAAE;GAAO,UAAU,OAAO;GAAI;GAAM;EAAU,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,cAAc,OAA6C;EAC/D,MAAM,EAAE,OAAO,WAAW,WAAW,UAAU,UAAU;EACzD,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAGhD,MAAM,gBAAgB,OAAO;EAC7B,MAAM,KAAK,OAAO,WAAW,OAAO,IAAI;GACtC,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;GACzC,GAAI,UAAU,KAAA,KAAa,EAAE,MAAM;EACrC,CAAC;EAOD,MAAM,eAAe,UAAU,KAAA,KAAa,MAAM,YAAY,MAAM,cAAc,YAAY;EAC9F,IAAI,gBAAgB,QAAQ,WAAW,UACrC,MAAM,KAAK,KAAK,oBAAoB,OAAO,aAAa;EAG1D,KAAK,OAAO,KAAK,mBAAmB;GAAE;GAAO;GAAW;EAAa,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,oBAAoB,OAAgD;EACxE,MAAM,EAAE,OAAO,WAAW,kBAAkB;EAC5C,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,IAAI,QAAQ,WAAW,UACrB,MAAM,IAAI,sBAAsB,oDAAoD;EAEtF,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAKhD,MAAM,KAAK,aAAa;GACtB;GACA,OAAO,OAAO;GACd,MAAM;GACN;GACA,WAAW;EACb,CAAC;EACD,KAAK,OAAO,KAAK,yBAAyB;GAAE;GAAO;EAAU,CAAC;CAChE;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,SAAS,MAAM,KAAK,KAAK,sBAAsB,gBAAgB,KAAK,CAAC;EAC3E,IAAI,CAAC,UAAU,OAAO,WAAW,WAC/B,OAAO;EAET,IAAI,OAAO,aAAa,OAAO,4BAAY,IAAI,KAAK,GAClD,OAAO;EAET,OAAO;CACT;CAEA,MAAM,aAAa,OAA4C;EAC7D,MAAM,SAAS,MAAM,KAAK,WAAW,MAAM,KAAK;EAChD,IAAI,CAAC,QAAQ;GACX,KAAK,OAAO,KAAK,iDAAiD;GAClE,MAAM,IAAI,YAAY,gBAAgB;EACxC;EACA,IAAI,OAAO,MAAM,YAAY,MAAM,MAAM,MAAM,YAAY,GAAG;GAC5D,KAAK,OAAO,KAAK,yCAAyC;IACxD,OAAO,OAAO;IACd,UAAU,OAAO;GACnB,CAAC;GACD,MAAM,IAAI,YAAY,mBAAmB;EAC3C;EAEA,IAAI,CAAC,MADa,KAAK,KAAK,SAAS,OAAO,KAAK,GAE/C,MAAM,IAAI,YAAY,eAAe;EAGvC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GAGtE,MAAM,EAAE,SAAS,KAAK,YAAY,MAAM,cAAc,cAAc;IAClE,OAAO,OAAO;IACd,QAAQ,MAAM;IACd,MAAM,OAAO;IACb,QAAQ;GACV,CAAC;GACD,MAAM,iBAAiB,MAAM,cAAc,gBAAgB,OAAO,OAAO,OAAO,IAAI,UAAU;GAC9F,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,SAAiC,CACrC,mBAAmB,eAAe,KAAK;IACrC,OAAO,OAAO;IACd,MAAM;GACR,CAAC,CACH;GACA,IAAI,IAAI,SAAA,WACN,OAAO,KACL,UACI,mBAAmB,eAAe,KAAK;IACrC,OAAO,OAAO;IACd,MAAM;GACR,CAAC,IACD,mBAAmB,cAAc,KAAK;IACpC,OAAO,OAAO;IACd,MAAM;GACR,CAAC,CACP;QACK,IAAI,SACT,OAAO,KACL,mBAAmB,cAAc,KAAK;IACpC,OAAO,OAAO;IACd,MAAM;GACR,CAAC,CACH;GAEF,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,mBAAmB;GAAE,OAAO,OAAO;GAAO,QAAQ,MAAM;EAAO,CAAC;EACjF,OAAO;CACT;CAKA,MAAM,WAAW,OAAe,QAAyC;EACvE,OAAO,KAAK,KAAK,YAAY,OAAO,MAAM;CAC5C;CAEA,MAAM,cAAc,OAAe,IAA8B;EAC/D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,gBAAgB,OAAO,EAAE;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,EAAE;GAC/D,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,SAAiC,CAAC;GACxC,IAAI,YAAY,SAAA,WACd,OAAO,KACL,mBAAmB,eAAe,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CACjE;GAGF,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO,WAAW;EAAG,CAAC;EAC7D,OAAO;CACT;CAEA,MAAM,mBAAmB,QAAoC;EAC3D,OAAO,KAAK,KAAK,mBAAmB,MAAM;CAC5C;CAEA,MAAM,QAAQ,IAA0C;EACtD,OAAO,KAAK,KAAK,SAAS,EAAE;CAC9B;CAEA,MAAc,gBAAgB,QAAgB,OAA8B;EAC1E,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,YACxB,MAAM,IAAI,MAAM,kEAAkE;EAEpF,MAAM,EAAE,OAAO,SAAS;EACxB,MAAM,YAAY,SAAS;EAS3B,MAAM,YAAY,GARL,YACT,GAAG,KAAK,WAAW,iBAAiB,YACpC,GAAG,KAAK,WAAW,YAAY,SAMT,IAHZ,YACV,IAAI,gBAAgB,EAAE,MAAM,CAAC,IAC7B,IAAI,gBAAgB;GAAE;GAAO;EAAM,CAAC,EAAA,CACL,SAAS;EAC5C,IAAI;GACF,IAAI,SAAA,WACF,MAAM,KAAK,OAAO,KAAK,OAAO,iBAAiB;IAAE;IAAW,aAAa;GAAM,CAAC;QAEhF,MAAM,KAAK,OAAO,KAAK,OAAO,gBAAgB;IAC5C;IACA,aAAa;IACb;GACF,CAAC;EAEL,SAAS,KAAK;GAGZ,KAAK,OAAO,MAAM,+BAA+B;IAC/C;IACA;IACA,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;GACzD,CAAC;EACH;CACF;CAEA,MAAM,gBAAgB,YAAkD;EACtE,OAAO,KAAK,KAAK,iBAAiB,UAAU;CAC9C;CAEA,MAAM,UAAU,MAA4C;EAC1D,OAAO,KAAK,KAAK,WAAW,IAAI;CAClC;CAEA,YAAY,OAAe,OAA4C;EACrE,OAAO,KAAK,YAAY,KAAK,OAAO,KAAK;CAC3C;CAEA,MAAM,iBAAiB,KAAyB,IAAY,MAAoC;EAC9F,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO;EAET,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,qCAAqC;EACvE;EACA,IAAI,OAAO,SAAS,YAAY,CAAC,OAAO,gBAAgB;GACtD,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iDAAiD;EACnF;EAEA,MAAM,UAAU,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC7D,KAAK,OAAO,KAAK,uBAAuB;GAAE,OAAO,IAAI;GAAO,UAAU;GAAI;EAAK,CAAC;EAChF,OAAO,UAAU,SAAS,OAAO,IAAI;CACvC;CAEA,MAAM,aAAa,MAA0B,KAA+B;EAC1E,OAAO;CACT;AACF"}
+{"version":3,"file":"service.js","names":[],"sources":["../../src/organizations/service.ts"],"sourcesContent":["// organizations context — service implementation (inbound port).\nimport type {\n  MemberRecord,\n  MembersRepository,\n  MemberWriteContext,\n  OrgAdmin,\n  OrganizationService,\n  OrganizationsRepository,\n  OrganizationsUnitOfWork,\n} from './ports.js';\nimport type { Invite, Organization, OrgUser } from './model.js';\nimport { type Role, STUDENT_ROLE } from './roles.js';\nimport {\n  InviteError,\n  type Member,\n  type MembersQuery,\n  OrganizationRuleError,\n  type Page,\n} from './members.js';\nimport type {\n  AcceptInviteInput,\n  AddOrgUserInput,\n  CreateInviteInput,\n  CreateOrganizationInput,\n  ResendStudentInviteInput,\n  UpdateOrganizationInput,\n  UpdateOrgUserInput,\n  UpdateStudentInput,\n} from './types.js';\nimport { organizationEvents, type OrganizationEvent } from './events.js';\nimport type { Logger, NewDomainEvent } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport { generateInviteToken, hashInviteToken } from '../shared/invite-token.js';\nimport { NotFoundError } from '../shared/errors.js';\nimport type { IdentityService } from '../identity/index.js';\nimport { genId } from '../shared/id.js';\n\nconst INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ntype NewOrganizationEvent = NewDomainEvent<OrganizationEvent>;\n\nexport interface InviteUrls {\n  studentPortalUrl: string;\n  adminAppUrl: string;\n}\n\nfunction toMember(r: MemberRecord): Member {\n  return {\n    id: r.id,\n    firstName: r.firstName,\n    lastName: r.lastName,\n    email: r.email,\n    image: r.image,\n    role: r.role,\n    status: r.status,\n    joinedAt: r.joinedAt,\n    invitedAt: r.invitedAt,\n  };\n}\n\nexport type OrganizationServiceParams = {\n  repo: OrganizationsRepository;\n  membersRepo: MembersRepository;\n  people: IdentityService;\n  uow: OrganizationsUnitOfWork;\n  orgAdmin: () => OrgAdmin;\n  logger?: Logger;\n  mailer?: Pick<Mailer, 'send'>;\n  inviteUrls?: InviteUrls;\n};\n\nexport class OrganizationServiceImpl implements OrganizationService {\n  private readonly repo: OrganizationsRepository;\n  private readonly membersRepo: MembersRepository;\n  private readonly people: IdentityService;\n  private readonly uow: OrganizationsUnitOfWork;\n  private readonly orgAdmin: () => OrgAdmin;\n  private readonly logger: Logger;\n  private readonly mailer?: Pick<Mailer, 'send'>;\n  private readonly inviteUrls?: InviteUrls;\n\n  constructor(params: OrganizationServiceParams) {\n    this.repo = params.repo;\n    this.membersRepo = params.membersRepo;\n    this.people = params.people;\n    this.uow = params.uow;\n    this.orgAdmin = params.orgAdmin;\n    this.logger = params.logger ?? noopLogger;\n    this.mailer = params.mailer;\n    this.inviteUrls = params.inviteUrls;\n  }\n\n  async createOrganization(input: CreateOrganizationInput): Promise<Organization> {\n    const created = await this.uow.run(async ({ organizations, outbox }) => {\n      const id = genId('organization');\n\n      const created = await organizations.create({\n        id,\n        // The auth provider adopts this id for its own org row, so the org is\n        // its own external id — a lookup by either id lands on the same row.\n        externalId: input.externalId ?? id,\n        name: input.name ?? `My Org`,\n        slug: input.slug ?? '',\n        ownerId: input.ownerId,\n      });\n      await outbox.append([\n        organizationEvents.organizationCreated.make({\n          orgId: created.id,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('organization created', { orgId: created.id, slug: created.slug });\n    return created;\n  }\n\n  async updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization> {\n    const updatedOrg = await this.uow.run(async ({ organizations, outbox }) => {\n      const updated = await organizations.update(id, {\n        name: input.name,\n        slug: input.slug,\n      });\n      if (!updated) {\n        throw new NotFoundError('Organization', id);\n      }\n      await outbox.append([\n        organizationEvents.organizationUpdated.make({ orgId: id, data: updated }),\n      ]);\n      return updated;\n    });\n\n    this.logger.info('organization updated', { updatedOrg });\n    return updatedOrg!;\n  }\n\n  async deleteOrganization(id: string): Promise<Organization> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const deleted = await organizations.delete(id);\n\n      await outbox.append([\n        organizationEvents.organizationDeleted.make({\n          orgId: deleted.id,\n          data: deleted,\n        }),\n      ]);\n      return deleted;\n    });\n    this.logger.info('organization deleted', { orgId: deleted.id });\n    return deleted;\n  }\n\n  async addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser> {\n    const orgUser = await this.uow.run(async ({ organizations, outbox }) => {\n      const created = await organizations.createOrgUser({ orgId, role, userId, status: 'active' });\n      await outbox.append([organizationEvents.orgUserLinked.make({ orgId, data: created })]);\n      return created;\n    });\n    this.logger.info('user added to organization', { orgId, userId, role });\n    return orgUser;\n  }\n\n  async removeOrgUser(orgId: string, userId: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('OrgUser', userId);\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, orgUser.id);\n      if (!deletedUser) {\n        throw new NotFoundError('OrgUser', orgUser.id);\n      }\n      await outbox.append([\n        organizationEvents.orgUserDeleted.make({\n          orgId,\n          data: deletedUser,\n        }),\n      ]);\n      return deletedUser;\n    });\n    this.logger.info('org user removed', { orgId, userId, orgUserId: deleted.id });\n    return deleted;\n  }\n\n  async updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser> {\n    const orgUser = await this.repo.findOrgUser(orgId, userId);\n    if (!orgUser) {\n      throw new NotFoundError('OrgUser', userId);\n    }\n    const updated = await this.repo.updateOrgUser(orgId, orgUser.id, patch);\n    if (!updated) {\n      throw new NotFoundError('OrgUser', orgUser.id);\n    }\n    this.logger.info('org user updated', { orgId, userId, orgUserId: updated.id, patch });\n    return updated;\n  }\n\n  async createInvite(input: CreateInviteInput): Promise<Invite> {\n    const { orgId, email, role, inviterUserId, firstName, lastName } = input;\n    const sendEmail = input.sendEmail ?? true;\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n\n    // A student belongs to the org from the moment an admin adds them, not from\n    // the moment they click a link — so the person exists before the invite\n    // does. Staff are excluded: their org_users row is mirrored from the auth\n    // provider's member record, which does not exist until they join.\n    const person =\n      role === STUDENT_ROLE\n        ? ((await this.people.getUserByEmail(email)) ??\n          (await this.people.createUser({\n            email,\n            ...(firstName !== undefined && { firstName }),\n            ...(lastName !== undefined && { lastName }),\n          })))\n        : null;\n\n    const invite = await this.uow.run(async ({ organizations, outbox }) => {\n      const events: NewOrganizationEvent[] = [];\n      if (person) {\n        const orgUser = await organizations.createOrgUser({\n          orgId,\n          userId: person.id,\n          role: STUDENT_ROLE,\n          status: 'invited',\n        });\n        events.push(organizationEvents.studentCreated.make({ orgId, data: orgUser }));\n      }\n      const row = await organizations.upsertPendingInvite(orgId, {\n        email,\n        role,\n        invitedBy: inviterUserId,\n        tokenHash,\n        expiresAt,\n      });\n      events.push(organizationEvents.inviteCreated.make({ orgId, data: row }));\n      await outbox.append(events);\n      return row;\n    });\n\n    if (sendEmail) {\n      // TODO make this workflow durable\n      try {\n        await this.sendInviteEmail(invite, token);\n      } catch (err) {\n        // A failed email must not abort invite creation: the token is already\n        // minted and recorded, so the admin can fix transport and resend.\n        this.logger.error('failed to send invite email', {\n          email: invite.email,\n          role: invite.role,\n          err: err instanceof Error ? err : new Error(String(err)),\n        });\n      }\n    }\n\n    this.logger.info('invite created', { orgId, inviteId: invite.id, role, sendEmail });\n    return invite;\n  }\n\n  async updateStudent(input: UpdateStudentInput): Promise<OrgUser> {\n    const { orgId, orgUserId, firstName, lastName, email } = input;\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n\n    const previousEmail = person.email;\n    await this.people.updateUser(person.id, {\n      ...(firstName !== undefined && { firstName }),\n      ...(lastName !== undefined && { lastName }),\n      ...(email !== undefined && { email }),\n    });\n\n    // The pending invite carries its own copy of the address and a token minted\n    // against it. Once the address is corrected that invite points at the wrong\n    // person, so it is cancelled rather than left live — the admin re-sends,\n    // which mints a fresh one for the new address. A student who has already\n    // accepted has no pending invite to worry about.\n    const emailChanged = email !== undefined && email.toLowerCase() !== previousEmail.toLowerCase();\n    if (emailChanged && orgUser.status !== 'active') {\n      await this.repo.cancelPendingInvite(orgId, previousEmail);\n    }\n\n    this.logger.info('student updated', { orgId, orgUserId, emailChanged });\n    return orgUser;\n  }\n\n  async resendStudentInvite(input: ResendStudentInviteInput): Promise<void> {\n    const { orgId, orgUserId, inviterUserId } = input;\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    if (orgUser.status === 'active') {\n      throw new OrganizationRuleError('That student has already accepted their invitation');\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n    const pending = await this.repo.findPendingInvite(orgId, person.email);\n    if (!pending) {\n      throw new NotFoundError('Invite', person.email);\n    }\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n    const invite = await this.repo.setInviteToken(orgId, pending.id, tokenHash, expiresAt);\n    if (!invite) {\n      throw new NotFoundError('Invite', pending.id);\n    }\n    await this.sendInviteEmail(invite, token);\n    this.logger.info('student invite resent', {\n      orgId,\n      orgUserId,\n      inviteId: invite.id,\n      inviterUserId,\n    });\n  }\n\n  async peekInvite(token: string): Promise<Invite | null> {\n    const invite = await this.repo.findInviteByTokenHash(hashInviteToken(token));\n    if (!invite || invite.status !== 'pending') {\n      return null;\n    }\n    if (invite.expiresAt && invite.expiresAt < new Date()) {\n      return null;\n    }\n    return invite;\n  }\n\n  async acceptInvite(input: AcceptInviteInput): Promise<OrgUser> {\n    const invite = await this.peekInvite(input.token);\n    if (!invite) {\n      this.logger.warn('invite accept refused: token invalid or expired');\n      throw new InviteError('invalid invite');\n    }\n    if (invite.email.toLowerCase() !== input.email.toLowerCase()) {\n      this.logger.warn('invite accept refused: email mismatch', {\n        orgId: invite.orgId,\n        inviteId: invite.id,\n      });\n      throw new InviteError('emails must match');\n    }\n    const org = await this.repo.findById(invite.orgId);\n    if (!org) {\n      throw new InviteError('Org not found');\n    }\n\n    const orgUser =\n      invite.role === STUDENT_ROLE\n        ? await this.acceptStudentInvite(invite, input.userId)\n        : await this.acceptStaffInvite(invite, org, input.userId);\n    this.logger.info('invite accepted', { orgId: invite.orgId, userId: input.userId });\n    return orgUser;\n  }\n\n  private async acceptStudentInvite(invite: Invite, userId: string): Promise<OrgUser> {\n    return this.uow.run(async ({ organizations, outbox }) => {\n      const existing = await organizations.findOrgUser(invite.orgId, userId);\n      if (!existing) {\n        throw new NotFoundError('OrgUser', userId);\n      }\n      const activated = await organizations.updateOrgUser(invite.orgId, existing.id, {\n        status: 'active',\n      });\n      if (!activated) {\n        throw new NotFoundError('OrgUser', existing.id);\n      }\n      const acceptedInvite = await organizations.setInviteStatus(\n        invite.orgId,\n        invite.id,\n        'accepted',\n      );\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      await outbox.append([\n        organizationEvents.inviteAccepted.make({ orgId: invite.orgId, data: acceptedInvite }),\n        organizationEvents.studentLinked.make({ orgId: invite.orgId, data: activated }),\n      ]);\n      return activated;\n    });\n  }\n\n  private async acceptStaffInvite(\n    invite: Invite,\n    org: Organization,\n    userId: string,\n  ): Promise<OrgUser> {\n    const person = await this.people.getUserById(userId);\n    if (!person?.externalId) {\n      throw new NotFoundError('User', userId);\n    }\n    await this.orgAdmin().grantMembership(org.externalId ?? org.id, person.externalId, invite.role);\n    return this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(invite.orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('OrgUser', userId);\n      }\n      const acceptedInvite = await organizations.setInviteStatus(\n        invite.orgId,\n        invite.id,\n        'accepted',\n      );\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      await outbox.append([\n        organizationEvents.inviteAccepted.make({ orgId: invite.orgId, data: acceptedInvite }),\n      ]);\n      return orgUser;\n    });\n  }\n\n  // By identity USER id — `(org_id, user_id)` is unique. Every caller (scope\n  // resolution, the MCP principal, the learn routes) asks \"what is this person\n  // in this org\", never \"what is this org_users row\".\n  async getOrgUser(orgId: string, userId: string): Promise<OrgUser | null> {\n    return this.repo.findOrgUser(orgId, userId);\n  }\n\n  async deleteOrgUser(orgId: string, id: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUserById(orgId, id);\n      if (!orgUser) {\n        throw new NotFoundError('OrgUser', id);\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, id);\n      if (!deletedUser) {\n        throw new NotFoundError('OrgUser', id);\n      }\n      const events: NewOrganizationEvent[] = [];\n      if (deletedUser.role === STUDENT_ROLE) {\n        events.push(organizationEvents.studentDeleted.make({ orgId, data: orgUser }));\n      }\n\n      await outbox.append(events);\n      return deletedUser;\n    });\n    this.logger.info('org user deleted', { orgId, orgUserId: id });\n    return deleted;\n  }\n\n  async getOrgUsersForUser(userId: string): Promise<OrgUser[]> {\n    return this.repo.findOrgUsersByUser(userId);\n  }\n\n  async getById(id: string): Promise<Organization | null> {\n    return this.repo.findById(id);\n  }\n\n  private async sendInviteEmail(invite: Invite, token: string): Promise<void> {\n    if (!this.mailer || !this.inviteUrls) {\n      throw new Error('invite delivery is not configured (mailer / invite urls missing)');\n    }\n    const { email, role } = invite;\n    const isStudent = role === STUDENT_ROLE;\n    const base = isStudent\n      ? `${this.inviteUrls.studentPortalUrl}/welcome`\n      : `${this.inviteUrls.adminAppUrl}/invite`;\n    // The portal resolves the token to the invited email, so the link carries\n    // only the token. The admin app still reads it from the query.\n    const query = isStudent\n      ? new URLSearchParams({ token })\n      : new URLSearchParams({ token, email });\n    const inviteUrl = `${base}?${query.toString()}`;\n    if (role === STUDENT_ROLE) {\n      await this.mailer.send(email, 'studentInvite', { inviteUrl, studentName: email });\n    } else {\n      await this.mailer.send(email, 'memberInvite', {\n        inviteUrl,\n        inviterName: 'Your team',\n        role,\n      });\n    }\n  }\n\n  async getByExternalId(externalId: string): Promise<Organization | null> {\n    return this.repo.findByExternalId(externalId);\n  }\n\n  async getBySlug(slug: string): Promise<Organization | null> {\n    return this.repo.findBySlug(slug);\n  }\n\n  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>> {\n    return this.membersRepo.list(orgId, query);\n  }\n\n  async updateMemberRole(ctx: MemberWriteContext, id: string, role: Role): Promise<Member | null> {\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return null;\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('role change rejected: owner role immutable', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner role cannot be reassigned');\n    }\n    if (member.kind !== 'member' || !member.userExternalId) {\n      this.logger.warn('role change rejected: not an active member', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('Only active members can have their role changed');\n    }\n    await this.orgAdmin().updateRole(ctx, member.userExternalId, role);\n    const updated = await this.membersRepo.findById(ctx.orgId, id);\n    this.logger.info('member role updated', { orgId: ctx.orgId, memberId: id, role });\n    return updated ? toMember(updated) : null;\n  }\n\n  async removeMember(ctx: MemberWriteContext, id: string): Promise<boolean> {\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return false;\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('member removal rejected: owner cannot be removed', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner cannot be removed');\n    }\n    if (member.kind === 'member' && member.userExternalId) {\n      await this.orgAdmin().removeMember(ctx, member.userExternalId);\n    } else if (member.kind === 'invite' && member.inviteId) {\n      const inviteId = member.inviteId;\n      await this.uow.run(async ({ organizations, outbox }) => {\n        const canceled = await organizations.setInviteStatus(ctx.orgId, inviteId, 'canceled');\n        if (!canceled) {\n          throw new NotFoundError('Invite', inviteId);\n        }\n        await outbox.append([\n          organizationEvents.inviteCanceled.make({ orgId: ctx.orgId, data: canceled }),\n        ]);\n      });\n    }\n    this.logger.info('member removed', { orgId: ctx.orgId, memberId: id });\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;AAsCA,MAAM,gBAAgB,QAAc,KAAK;AASzC,SAAS,SAAS,GAAyB;CACzC,OAAO;EACL,IAAI,EAAE;EACN,WAAW,EAAE;EACb,UAAU,EAAE;EACZ,OAAO,EAAE;EACT,OAAO,EAAE;EACT,MAAM,EAAE;EACR,QAAQ,EAAE;EACV,UAAU,EAAE;EACZ,WAAW,EAAE;CACf;AACF;AAaA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,OAAO,OAAO;EACnB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO;EACrB,KAAK,MAAM,OAAO;EAClB,KAAK,WAAW,OAAO;EACvB,KAAK,SAAS,OAAO,UAAU;EAC/B,KAAK,SAAS,OAAO;EACrB,KAAK,aAAa,OAAO;CAC3B;CAEA,MAAM,mBAAmB,OAAuD;EAC9E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,KAAK,MAAM,cAAc;GAE/B,MAAM,UAAU,MAAM,cAAc,OAAO;IACzC;IAGA,YAAY,MAAM,cAAc;IAChC,MAAM,MAAM,QAAQ;IACpB,MAAM,MAAM,QAAQ;IACpB,SAAS,MAAM;GACjB,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB;GAAE,OAAO,QAAQ;GAAI,MAAM,QAAQ;EAAK,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAY,OAAuD;EAC1F,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACzE,MAAM,UAAU,MAAM,cAAc,OAAO,IAAI;IAC7C,MAAM,MAAM;IACZ,MAAM,MAAM;GACd,CAAC;GACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,gBAAgB,EAAE;GAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAAE,OAAO;IAAI,MAAM;GAAQ,CAAC,CAC1E,CAAC;GACD,OAAO;EACT,CAAC;EAED,KAAK,OAAO,KAAK,wBAAwB,EAAE,WAAW,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAmC;EAC1D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB,EAAE,OAAO,QAAQ,GAAG,CAAC;EAC9D,OAAO;CACT;CAEA,MAAM,WAAW,EAAE,OAAO,QAAQ,QAA2C;EAC3E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,cAAc;IAAE;IAAO;IAAM;IAAQ,QAAQ;GAAS,CAAC;GAC3F,MAAM,OAAO,OAAO,CAAC,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC,CAAC;GACrF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,8BAA8B;GAAE;GAAO;GAAQ;EAAK,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,QAAkC;EACnE,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,MAAM;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,MAAM;GAE3C,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,QAAQ,EAAE;GACvE,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,QAAQ,EAAE;GAE/C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IACrC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO;GAAQ,WAAW,QAAQ;EAAG,CAAC;EAC7E,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,QAAgB,OAA6C;EAC9F,MAAM,UAAU,MAAM,KAAK,KAAK,YAAY,OAAO,MAAM;EACzD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,MAAM;EAE3C,MAAM,UAAU,MAAM,KAAK,KAAK,cAAc,OAAO,QAAQ,IAAI,KAAK;EACtE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,QAAQ,EAAE;EAE/C,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO;GAAQ,WAAW,QAAQ;GAAI;EAAM,CAAC;EACpF,OAAO;CACT;CAEA,MAAM,aAAa,OAA2C;EAC5D,MAAM,EAAE,OAAO,OAAO,MAAM,eAAe,WAAW,aAAa;EACnE,MAAM,YAAY,MAAM,aAAa;EACrC,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EAMrD,MAAM,SACJ,SAAA,YACM,MAAM,KAAK,OAAO,eAAe,KAAK,KACvC,MAAM,KAAK,OAAO,WAAW;GAC5B;GACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;EAC3C,CAAC,IACD;EAEN,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACrE,MAAM,SAAiC,CAAC;GACxC,IAAI,QAAQ;IACV,MAAM,UAAU,MAAM,cAAc,cAAc;KAChD;KACA,QAAQ,OAAO;KACf,MAAM;KACN,QAAQ;IACV,CAAC;IACD,OAAO,KAAK,mBAAmB,eAAe,KAAK;KAAE;KAAO,MAAM;IAAQ,CAAC,CAAC;GAC9E;GACA,MAAM,MAAM,MAAM,cAAc,oBAAoB,OAAO;IACzD;IACA;IACA,WAAW;IACX;IACA;GACF,CAAC;GACD,OAAO,KAAK,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAI,CAAC,CAAC;GACvE,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EAED,IAAI,WAEF,IAAI;GACF,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EAC1C,SAAS,KAAK;GAGZ,KAAK,OAAO,MAAM,+BAA+B;IAC/C,OAAO,OAAO;IACd,MAAM,OAAO;IACb,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;GACzD,CAAC;EACH;EAGF,KAAK,OAAO,KAAK,kBAAkB;GAAE;GAAO,UAAU,OAAO;GAAI;GAAM;EAAU,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,cAAc,OAA6C;EAC/D,MAAM,EAAE,OAAO,WAAW,WAAW,UAAU,UAAU;EACzD,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAGhD,MAAM,gBAAgB,OAAO;EAC7B,MAAM,KAAK,OAAO,WAAW,OAAO,IAAI;GACtC,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;GACzC,GAAI,UAAU,KAAA,KAAa,EAAE,MAAM;EACrC,CAAC;EAOD,MAAM,eAAe,UAAU,KAAA,KAAa,MAAM,YAAY,MAAM,cAAc,YAAY;EAC9F,IAAI,gBAAgB,QAAQ,WAAW,UACrC,MAAM,KAAK,KAAK,oBAAoB,OAAO,aAAa;EAG1D,KAAK,OAAO,KAAK,mBAAmB;GAAE;GAAO;GAAW;EAAa,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,oBAAoB,OAAgD;EACxE,MAAM,EAAE,OAAO,WAAW,kBAAkB;EAC5C,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,IAAI,QAAQ,WAAW,UACrB,MAAM,IAAI,sBAAsB,oDAAoD;EAEtF,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAEhD,MAAM,UAAU,MAAM,KAAK,KAAK,kBAAkB,OAAO,OAAO,KAAK;EACrE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,OAAO,KAAK;EAEhD,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EACrD,MAAM,SAAS,MAAM,KAAK,KAAK,eAAe,OAAO,QAAQ,IAAI,WAAW,SAAS;EACrF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;EAE9C,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EACxC,KAAK,OAAO,KAAK,yBAAyB;GACxC;GACA;GACA,UAAU,OAAO;GACjB;EACF,CAAC;CACH;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,SAAS,MAAM,KAAK,KAAK,sBAAsB,gBAAgB,KAAK,CAAC;EAC3E,IAAI,CAAC,UAAU,OAAO,WAAW,WAC/B,OAAO;EAET,IAAI,OAAO,aAAa,OAAO,4BAAY,IAAI,KAAK,GAClD,OAAO;EAET,OAAO;CACT;CAEA,MAAM,aAAa,OAA4C;EAC7D,MAAM,SAAS,MAAM,KAAK,WAAW,MAAM,KAAK;EAChD,IAAI,CAAC,QAAQ;GACX,KAAK,OAAO,KAAK,iDAAiD;GAClE,MAAM,IAAI,YAAY,gBAAgB;EACxC;EACA,IAAI,OAAO,MAAM,YAAY,MAAM,MAAM,MAAM,YAAY,GAAG;GAC5D,KAAK,OAAO,KAAK,yCAAyC;IACxD,OAAO,OAAO;IACd,UAAU,OAAO;GACnB,CAAC;GACD,MAAM,IAAI,YAAY,mBAAmB;EAC3C;EACA,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,OAAO,KAAK;EACjD,IAAI,CAAC,KACH,MAAM,IAAI,YAAY,eAAe;EAGvC,MAAM,UACJ,OAAO,SAAA,YACH,MAAM,KAAK,oBAAoB,QAAQ,MAAM,MAAM,IACnD,MAAM,KAAK,kBAAkB,QAAQ,KAAK,MAAM,MAAM;EAC5D,KAAK,OAAO,KAAK,mBAAmB;GAAE,OAAO,OAAO;GAAO,QAAQ,MAAM;EAAO,CAAC;EACjF,OAAO;CACT;CAEA,MAAc,oBAAoB,QAAgB,QAAkC;EAClF,OAAO,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACvD,MAAM,WAAW,MAAM,cAAc,YAAY,OAAO,OAAO,MAAM;GACrE,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,WAAW,MAAM;GAE3C,MAAM,YAAY,MAAM,cAAc,cAAc,OAAO,OAAO,SAAS,IAAI,EAC7E,QAAQ,SACV,CAAC;GACD,IAAI,CAAC,WACH,MAAM,IAAI,cAAc,WAAW,SAAS,EAAE;GAEhD,MAAM,iBAAiB,MAAM,cAAc,gBACzC,OAAO,OACP,OAAO,IACP,UACF;GACA,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAe,CAAC,GACpF,mBAAmB,cAAc,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAU,CAAC,CAChF,CAAC;GACD,OAAO;EACT,CAAC;CACH;CAEA,MAAc,kBACZ,QACA,KACA,QACkB;EAClB,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,MAAM;EACnD,IAAI,CAAC,QAAQ,YACX,MAAM,IAAI,cAAc,QAAQ,MAAM;EAExC,MAAM,KAAK,SAAS,CAAC,CAAC,gBAAgB,IAAI,cAAc,IAAI,IAAI,OAAO,YAAY,OAAO,IAAI;EAC9F,OAAO,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACvD,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,OAAO,MAAM;GACpE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,MAAM;GAE3C,MAAM,iBAAiB,MAAM,cAAc,gBACzC,OAAO,OACP,OAAO,IACP,UACF;GACA,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAe,CAAC,CACtF,CAAC;GACD,OAAO;EACT,CAAC;CACH;CAKA,MAAM,WAAW,OAAe,QAAyC;EACvE,OAAO,KAAK,KAAK,YAAY,OAAO,MAAM;CAC5C;CAEA,MAAM,cAAc,OAAe,IAA8B;EAC/D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,gBAAgB,OAAO,EAAE;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,EAAE;GAC/D,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,SAAiC,CAAC;GACxC,IAAI,YAAY,SAAA,WACd,OAAO,KAAK,mBAAmB,eAAe,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC;GAG9E,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO,WAAW;EAAG,CAAC;EAC7D,OAAO;CACT;CAEA,MAAM,mBAAmB,QAAoC;EAC3D,OAAO,KAAK,KAAK,mBAAmB,MAAM;CAC5C;CAEA,MAAM,QAAQ,IAA0C;EACtD,OAAO,KAAK,KAAK,SAAS,EAAE;CAC9B;CAEA,MAAc,gBAAgB,QAAgB,OAA8B;EAC1E,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,YACxB,MAAM,IAAI,MAAM,kEAAkE;EAEpF,MAAM,EAAE,OAAO,SAAS;EACxB,MAAM,YAAY,SAAS;EAS3B,MAAM,YAAY,GARL,YACT,GAAG,KAAK,WAAW,iBAAiB,YACpC,GAAG,KAAK,WAAW,YAAY,SAMT,IAHZ,YACV,IAAI,gBAAgB,EAAE,MAAM,CAAC,IAC7B,IAAI,gBAAgB;GAAE;GAAO;EAAM,CAAC,EAAA,CACL,SAAS;EAC5C,IAAI,SAAA,WACF,MAAM,KAAK,OAAO,KAAK,OAAO,iBAAiB;GAAE;GAAW,aAAa;EAAM,CAAC;OAEhF,MAAM,KAAK,OAAO,KAAK,OAAO,gBAAgB;GAC5C;GACA,aAAa;GACb;EACF,CAAC;CAEL;CAEA,MAAM,gBAAgB,YAAkD;EACtE,OAAO,KAAK,KAAK,iBAAiB,UAAU;CAC9C;CAEA,MAAM,UAAU,MAA4C;EAC1D,OAAO,KAAK,KAAK,WAAW,IAAI;CAClC;CAEA,YAAY,OAAe,OAA4C;EACrE,OAAO,KAAK,YAAY,KAAK,OAAO,KAAK;CAC3C;CAEA,MAAM,iBAAiB,KAAyB,IAAY,MAAoC;EAC9F,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO;EAET,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,qCAAqC;EACvE;EACA,IAAI,OAAO,SAAS,YAAY,CAAC,OAAO,gBAAgB;GACtD,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iDAAiD;EACnF;EACA,MAAM,KAAK,SAAS,CAAC,CAAC,WAAW,KAAK,OAAO,gBAAgB,IAAI;EACjE,MAAM,UAAU,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC7D,KAAK,OAAO,KAAK,uBAAuB;GAAE,OAAO,IAAI;GAAO,UAAU;GAAI;EAAK,CAAC;EAChF,OAAO,UAAU,SAAS,OAAO,IAAI;CACvC;CAEA,MAAM,aAAa,KAAyB,IAA8B;EACxE,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO;EAET,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,oDAAoD;IACnE,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,6BAA6B;EAC/D;EACA,IAAI,OAAO,SAAS,YAAY,OAAO,gBACrC,MAAM,KAAK,SAAS,CAAC,CAAC,aAAa,KAAK,OAAO,cAAc;OACxD,IAAI,OAAO,SAAS,YAAY,OAAO,UAAU;GACtD,MAAM,WAAW,OAAO;GACxB,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;IACtD,MAAM,WAAW,MAAM,cAAc,gBAAgB,IAAI,OAAO,UAAU,UAAU;IACpF,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,UAAU,QAAQ;IAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KAAE,OAAO,IAAI;KAAO,MAAM;IAAS,CAAC,CAC7E,CAAC;GACH,CAAC;EACH;EACA,KAAK,OAAO,KAAK,kBAAkB;GAAE,OAAO,IAAI;GAAO,UAAU;EAAG,CAAC;EACrE,OAAO;CACT;AACF"}

package/dist/organizations/types.d.ts

@@ -1,5 +1,5 @@
 import { ProvisionUserInput } from "../types/schemas/identity.js";
-import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, InviteRole, NewOrganizationInput, OrgUserStatus, Organization } from "../types/schemas/organizations.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, InviteRole, NewOrganizationInput, OrgUserStatus, Organization, UpdateOrgUserInput } from "../types/schemas/organizations.js";
 import { InviteId, OrgUserId, OrganizationId } from "../types/organizations.js";
 import "../types/index.js";
 //#region src/organizations/types.d.ts
@@ -35,5 +35,5 @@ interface ResendStudentInviteInput {
   inviterUserId: string;
 }
 //#endregion
-export { type AcceptInviteInput, type AddOrgUserInput, type CreateInviteInput, type CreateOrgUserInput, CreateOrganizationInput, type InviteId, type InviteRole, LinkOrgUserInput, type NewOrganizationInput, type OrgUserId, type OrgUserStatus, type OrganizationId, type ProvisionUserInput, ResendStudentInviteInput, UnlinkOrgUserInput, UpdateOrganizationInput, UpdatePersonInput, UpdateStudentInput };
+export { type AcceptInviteInput, type AddOrgUserInput, type CreateInviteInput, type CreateOrgUserInput, CreateOrganizationInput, type InviteId, type InviteRole, LinkOrgUserInput, type NewOrganizationInput, type OrgUserId, type OrgUserStatus, type OrganizationId, type ProvisionUserInput, ResendStudentInviteInput, UnlinkOrgUserInput, type UpdateOrgUserInput, UpdateOrganizationInput, UpdatePersonInput, UpdateStudentInput };
 //# sourceMappingURL=types.d.ts.map