@headless-lms/core 0.1.0 → 0.3.0

package/dist/integrations/model.js

@@ -22,7 +22,7 @@ var ActionInvocationError = class extends Error {
 	integrationId;
 	actionId;
 	constructor(integrationId, actionId, cause) {
-		super(`action "${integrationId}.${actionId}" failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+		super(`action "${integrationId}.${actionId}" failed: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
 		this.integrationId = integrationId;
 		this.actionId = actionId;
 		this.name = "ActionInvocationError";

package/dist/integrations/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","names":[],"sources":["../../src/integrations/model.ts"],"sourcesContent":["// integrations context — entities & DTOs are owned by @headless-lms/core/types;\n// the domain errors below are runtime code and stay in core.\nexport type { Connection, ConnectInput, ConfigureInput } from '../types/index.js';\n\n/** An org already has a connection for this integration (one per integration per org). */\nexport class AlreadyConnectedError extends Error {\n  constructor(readonly integrationId: string) {\n    super(`a connection for \"${integrationId}\" already exists`);\n    this.name = 'AlreadyConnectedError';\n  }\n}\n\n/** The named integration is not declared in the registry. */\nexport class UnknownIntegrationError extends Error {\n  constructor(readonly integrationId: string) {\n    super(`unknown integration \"${integrationId}\"`);\n    this.name = 'UnknownIntegrationError';\n  }\n}\n\n/** An action's external call failed (or the action rejected its input). */\nexport class ActionInvocationError extends Error {\n  constructor(\n    readonly integrationId: string,\n    readonly actionId: string,\n    cause: unknown,\n  ) {\n    super(\n      `action \"${integrationId}.${actionId}\" failed: ${\n        cause instanceof Error ? cause.message : String(cause)\n      }`,\n    );\n    this.name = 'ActionInvocationError';\n  }\n}\n\n/** The config was rejected by the integration's validator. */\nexport class InvalidConfigError extends Error {\n  constructor(\n    readonly integrationId: string,\n    readonly errors: string[],\n  ) {\n    super(`invalid config for \"${integrationId}\": ${errors.join('; ')}`);\n    this.name = 'InvalidConfigError';\n  }\n}\n"],"mappings":";;AAKA,IAAa,wBAAb,cAA2C,MAAM;CAC1B;CAArB,YAAY,eAAgC;EAC1C,MAAM,qBAAqB,cAAc,iBAAiB;EADvC,KAAA,gBAAA;EAEnB,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,0BAAb,cAA6C,MAAM;CAC5B;CAArB,YAAY,eAAgC;EAC1C,MAAM,wBAAwB,cAAc,EAAE;EAD3B,KAAA,gBAAA;EAEnB,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,wBAAb,cAA2C,MAAM;CAEpC;CACA;CAFX,YACE,eACA,UACA,OACA;EACA,MACE,WAAW,cAAc,GAAG,SAAS,YACnC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAEzD;EARS,KAAA,gBAAA;EACA,KAAA,WAAA;EAQT,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CAFX,YACE,eACA,QACA;EACA,MAAM,uBAAuB,cAAc,KAAK,OAAO,KAAK,IAAI,GAAG;EAH1D,KAAA,gBAAA;EACA,KAAA,SAAA;EAGT,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"model.js","names":[],"sources":["../../src/integrations/model.ts"],"sourcesContent":["// integrations context — entities & DTOs are owned by @headless-lms/core/types;\n// the domain errors below are runtime code and stay in core.\nexport type { Connection, ConnectInput, ConfigureInput } from '../types/index.js';\n\n/** An org already has a connection for this integration (one per integration per org). */\nexport class AlreadyConnectedError extends Error {\n  constructor(readonly integrationId: string) {\n    super(`a connection for \"${integrationId}\" already exists`);\n    this.name = 'AlreadyConnectedError';\n  }\n}\n\n/** The named integration is not declared in the registry. */\nexport class UnknownIntegrationError extends Error {\n  constructor(readonly integrationId: string) {\n    super(`unknown integration \"${integrationId}\"`);\n    this.name = 'UnknownIntegrationError';\n  }\n}\n\n/** An action's external call failed (or the action rejected its input). */\nexport class ActionInvocationError extends Error {\n  constructor(\n    readonly integrationId: string,\n    readonly actionId: string,\n    cause: unknown,\n  ) {\n    super(\n      `action \"${integrationId}.${actionId}\" failed: ${\n        cause instanceof Error ? cause.message : String(cause)\n      }`,\n      { cause },\n    );\n    this.name = 'ActionInvocationError';\n  }\n}\n\n/** The config was rejected by the integration's validator. */\nexport class InvalidConfigError extends Error {\n  constructor(\n    readonly integrationId: string,\n    readonly errors: string[],\n  ) {\n    super(`invalid config for \"${integrationId}\": ${errors.join('; ')}`);\n    this.name = 'InvalidConfigError';\n  }\n}\n"],"mappings":";;AAKA,IAAa,wBAAb,cAA2C,MAAM;CAC1B;CAArB,YAAY,eAAgC;EAC1C,MAAM,qBAAqB,cAAc,iBAAiB;EADvC,KAAA,gBAAA;EAEnB,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,0BAAb,cAA6C,MAAM;CAC5B;CAArB,YAAY,eAAgC;EAC1C,MAAM,wBAAwB,cAAc,EAAE;EAD3B,KAAA,gBAAA;EAEnB,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,wBAAb,cAA2C,MAAM;CAEpC;CACA;CAFX,YACE,eACA,UACA,OACA;EACA,MACE,WAAW,cAAc,GAAG,SAAS,YACnC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,KAEvD,EAAE,MAAM,CACV;EATS,KAAA,gBAAA;EACA,KAAA,WAAA;EAST,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CAFX,YACE,eACA,QACA;EACA,MAAM,uBAAuB,cAAc,KAAK,OAAO,KAAK,IAAI,GAAG;EAH1D,KAAA,gBAAA;EACA,KAAA,SAAA;EAGT,KAAK,OAAO;CACd;AACF"}

package/dist/integrations/service.js

@@ -1,6 +1,6 @@
 import { genId } from "../shared/id.js";
-import { noopLogger } from "../shared/logger.js";
 import { ConflictError, NotFoundError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
 import { ActionInvocationError, AlreadyConnectedError, InvalidConfigError, UnknownIntegrationError } from "./model.js";
 import { integrationEvents } from "./events.js";
 //#region src/integrations/service.ts
@@ -172,7 +172,7 @@ var IntegrationsServiceImpl = class {
 				connectionId,
 				integrationId: connection.integrationId,
 				actionId,
-				error: err instanceof Error ? err.message : String(err)
+				err
 			});
 			throw new ActionInvocationError(connection.integrationId, actionId, err);
 		}

package/dist/integrations/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../src/integrations/service.ts"],"sourcesContent":["// integrations context — service implementation (inbound port). Owns the\n// connection lifecycle; credentials live in the shared secure credential store\n// (this service holds only the ref). The integrations the system supports are\n// declared at startup via the IntegrationsRegistry: connect/configure reject\n// unknown integration ids and validate config with the integration's own\n// validator. The domain never calls the external service — consumers take the\n// connection, reveal the credential at point of use, and build their own adapter.\n//\n// Mutations run inside the context's UnitOfWork: credential writes, connection\n// writes, and the outbox append commit in ONE transaction (transactional\n// outbox; this also closed the historical orphan-credential window). The\n// outbox relay — not this service — publishes to the EventBus.\nimport { genId } from '../shared/id.js';\nimport {\n  ActionInvocationError,\n  AlreadyConnectedError,\n  InvalidConfigError,\n  UnknownIntegrationError,\n  type ConfigureInput,\n  type ConnectInput,\n  type Connection,\n} from './model.js';\nimport type {\n  ConnectionsRepository,\n  IntegrationsRegistry,\n  IntegrationsService,\n  IntegrationsUnitOfWork,\n} from './ports.js';\nimport type { CredentialStore, Logger } from '../shared/ports.js';\nimport { ConflictError, NotFoundError } from '../shared/errors.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { integrationEvents } from './events.js';\n\nexport type IntegrationsServiceParams = {\n  registry: IntegrationsRegistry;\n  /** Read-only access (find/list) — runs outside any transaction. */\n  repo: ConnectionsRepository;\n  /** Atomic write scope: tx-bound connections repo + credential store + outbox. */\n  uow: IntegrationsUnitOfWork;\n  /** Point-of-use credential reveal for action invocation — reads only. */\n  credentials: CredentialStore;\n  logger?: Logger;\n};\n\nexport class IntegrationsServiceImpl implements IntegrationsService {\n  private readonly registry: IntegrationsRegistry;\n  private readonly repo: ConnectionsRepository;\n  private readonly uow: IntegrationsUnitOfWork;\n  private readonly credentials: CredentialStore;\n  private readonly logger: Logger;\n\n  constructor(params: IntegrationsServiceParams) {\n    this.registry = params.registry;\n    this.repo = params.repo;\n    this.uow = params.uow;\n    this.credentials = params.credentials;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  available() {\n    return this.registry.list().map((integration) => ({\n      id: integration.id,\n      configSchema: integration.configSchema(),\n      secretsSchema: integration.secretsSchema(),\n      actions: integration.actions.map((action) => ({\n        id: action.id,\n        description: action.description,\n        inputSchema: action.inputSchema(),\n        outputSchema: action.outputSchema(),\n      })),\n    }));\n  }\n\n  private validate(integrationId: string, config: Record<string, unknown>): void {\n    const integration = this.registry.get(integrationId);\n    if (!integration) {\n      this.logger.warn('unknown integration rejected', { integrationId });\n      throw new UnknownIntegrationError(integrationId);\n    }\n    const result = integration.validateConfig(config);\n    if (!result.ok) {\n      this.logger.warn('invalid integration config rejected', {\n        integrationId,\n        errors: result.errors,\n      });\n      throw new InvalidConfigError(integrationId, result.errors);\n    }\n  }\n\n  async connect(orgId: string, input: ConnectInput): Promise<Connection> {\n    const config = input.config ?? {};\n    this.validate(input.integrationId, config);\n    const existing = await this.repo.findByIntegration(orgId, input.integrationId);\n    if (existing) {\n      this.logger.warn('duplicate connection rejected', {\n        orgId,\n        integrationId: input.integrationId,\n      });\n      throw new AlreadyConnectedError(input.integrationId);\n    }\n    const connection = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      const credentialRef = await credentials.store(orgId, input.secrets);\n      const at = new Date();\n      const created = await connections.insert(orgId, {\n        orgId,\n        id: genId('connection'),\n        integrationId: input.integrationId,\n        config,\n        active: true,\n        credentialRef,\n        createdAt: at,\n        updatedAt: at,\n      });\n      await outbox.append([\n        integrationEvents.connectionCreated.make({\n          orgId,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('integration connected', {\n      orgId,\n      integrationId: connection.integrationId,\n      connectionId: connection.id,\n    });\n    return connection;\n  }\n\n  async reconnect(\n    orgId: string,\n    id: string,\n    secrets: Record<string, unknown>,\n  ): Promise<Connection | null> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return null;\n    }\n    const updated = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      await credentials.update(orgId, connection.credentialRef, secrets);\n      const result = await connections.update(orgId, id, { updatedAt: new Date() });\n      if (result) {\n        await outbox.append([\n          integrationEvents.connectionUpdated.make({ orgId, data: result }),\n        ]);\n      }\n      return result;\n    });\n    this.logger.info('integration credentials rotated', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return updated;\n  }\n\n  async configure(orgId: string, id: string, input: ConfigureInput): Promise<Connection | null> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return null;\n    }\n    if (input.config !== undefined) {\n      this.validate(connection.integrationId, input.config);\n    }\n    const updated = await this.uow.run(async ({ connections, outbox }) => {\n      const result = await connections.update(orgId, id, {\n        ...(input.config !== undefined ? { config: input.config } : {}),\n        ...(input.active !== undefined ? { active: input.active } : {}),\n        updatedAt: new Date(),\n      });\n      if (result) {\n        await outbox.append([\n          integrationEvents.connectionUpdated.make({ orgId, data: result }),\n        ]);\n      }\n      return result;\n    });\n    this.logger.info('integration configured', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return updated;\n  }\n\n  async disconnect(orgId: string, id: string): Promise<boolean> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return false;\n    }\n    const deleted = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      // Connection first: it holds the FK onto the credential row.\n      const ok = await connections.delete(orgId, id);\n      await credentials.destroy(orgId, connection.credentialRef);\n      await outbox.append([\n        integrationEvents.connectionRemoved.make({ orgId, data: connection }),\n      ]);\n      return ok;\n    });\n    this.logger.info('integration disconnected', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return deleted;\n  }\n\n  list(orgId: string): Promise<Connection[]> {\n    return this.repo.list(orgId);\n  }\n\n  get(orgId: string, id: string): Promise<Connection | null> {\n    return this.repo.findById(orgId, id);\n  }\n\n  getByIntegration(orgId: string, integrationId: string): Promise<Connection | null> {\n    return this.repo.findByIntegration(orgId, integrationId);\n  }\n\n  async invoke(\n    orgId: string,\n    connectionId: string,\n    actionId: string,\n    input: Record<string, unknown>,\n  ): Promise<unknown> {\n    const connection = await this.repo.findById(orgId, connectionId);\n    if (!connection) {\n      throw new NotFoundError('Connection', connectionId);\n    }\n    if (!connection.active) {\n      throw new ConflictError(`connection \"${connectionId}\" is inactive`);\n    }\n    const integration = this.registry.get(connection.integrationId);\n    if (!integration) {\n      throw new UnknownIntegrationError(connection.integrationId);\n    }\n    const action = integration.actions.find((a) => a.id === actionId);\n    if (!action) {\n      throw new NotFoundError('Action', actionId);\n    }\n    const secrets = await this.credentials.reveal(orgId, connection.credentialRef);\n    if (!secrets) {\n      throw new NotFoundError('Credential', connectionId);\n    }\n    try {\n      return await action.invoke({ secrets, config: connection.config }, input);\n    } catch (err) {\n      this.logger.warn('integration action failed', {\n        orgId,\n        connectionId,\n        integrationId: connection.integrationId,\n        actionId,\n        error: err instanceof Error ? err.message : String(err),\n      });\n      throw new ActionInvocationError(connection.integrationId, actionId, err);\n    }\n  }\n}\n"],"mappings":";;;;;;AA4CA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,WAAW,OAAO;EACvB,KAAK,OAAO,OAAO;EACnB,KAAK,MAAM,OAAO;EAClB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,YAAY;EACV,OAAO,KAAK,SAAS,KAAK,CAAC,CAAC,KAAK,iBAAiB;GAChD,IAAI,YAAY;GAChB,cAAc,YAAY,aAAa;GACvC,eAAe,YAAY,cAAc;GACzC,SAAS,YAAY,QAAQ,KAAK,YAAY;IAC5C,IAAI,OAAO;IACX,aAAa,OAAO;IACpB,aAAa,OAAO,YAAY;IAChC,cAAc,OAAO,aAAa;GACpC,EAAE;EACJ,EAAE;CACJ;CAEA,SAAiB,eAAuB,QAAuC;EAC7E,MAAM,cAAc,KAAK,SAAS,IAAI,aAAa;EACnD,IAAI,CAAC,aAAa;GAChB,KAAK,OAAO,KAAK,gCAAgC,EAAE,cAAc,CAAC;GAClE,MAAM,IAAI,wBAAwB,aAAa;EACjD;EACA,MAAM,SAAS,YAAY,eAAe,MAAM;EAChD,IAAI,CAAC,OAAO,IAAI;GACd,KAAK,OAAO,KAAK,uCAAuC;IACtD;IACA,QAAQ,OAAO;GACjB,CAAC;GACD,MAAM,IAAI,mBAAmB,eAAe,OAAO,MAAM;EAC3D;CACF;CAEA,MAAM,QAAQ,OAAe,OAA0C;EACrE,MAAM,SAAS,MAAM,UAAU,CAAC;EAChC,KAAK,SAAS,MAAM,eAAe,MAAM;EAEzC,IAAI,MADmB,KAAK,KAAK,kBAAkB,OAAO,MAAM,aAAa,GAC/D;GACZ,KAAK,OAAO,KAAK,iCAAiC;IAChD;IACA,eAAe,MAAM;GACvB,CAAC;GACD,MAAM,IAAI,sBAAsB,MAAM,aAAa;EACrD;EACA,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACpF,MAAM,gBAAgB,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO;GAClE,MAAM,qBAAK,IAAI,KAAK;GACpB,MAAM,UAAU,MAAM,YAAY,OAAO,OAAO;IAC9C;IACA,IAAI,MAAM,YAAY;IACtB,eAAe,MAAM;IACrB;IACA,QAAQ;IACR;IACA,WAAW;IACX,WAAW;GACb,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,kBAAkB,kBAAkB,KAAK;IACvC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,yBAAyB;GACxC;GACA,eAAe,WAAW;GAC1B,cAAc,WAAW;EAC3B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UACJ,OACA,IACA,SAC4B;EAC5B,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACjF,MAAM,YAAY,OAAO,OAAO,WAAW,eAAe,OAAO;GACjE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI,EAAE,2BAAW,IAAI,KAAK,EAAE,CAAC;GAC5E,IAAI,QACF,MAAM,OAAO,OAAO,CAClB,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAClE,CAAC;GAEH,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,mCAAmC;GAClD;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UAAU,OAAe,IAAY,OAAmD;EAC5F,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,IAAI,MAAM,WAAW,KAAA,GACnB,KAAK,SAAS,WAAW,eAAe,MAAM,MAAM;EAEtD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa;GACpE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI;IACjD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,2BAAW,IAAI,KAAK;GACtB,CAAC;GACD,IAAI,QACF,MAAM,OAAO,OAAO,CAClB,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAClE,CAAC;GAEH,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,0BAA0B;GACzC;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,WAAW,OAAe,IAA8B;EAC5D,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GAEjF,MAAM,KAAK,MAAM,YAAY,OAAO,OAAO,EAAE;GAC7C,MAAM,YAAY,QAAQ,OAAO,WAAW,aAAa;GACzD,MAAM,OAAO,OAAO,CAClB,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAW,CAAC,CACtE,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,4BAA4B;GAC3C;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,KAAK,OAAsC;EACzC,OAAO,KAAK,KAAK,KAAK,KAAK;CAC7B;CAEA,IAAI,OAAe,IAAwC;EACzD,OAAO,KAAK,KAAK,SAAS,OAAO,EAAE;CACrC;CAEA,iBAAiB,OAAe,eAAmD;EACjF,OAAO,KAAK,KAAK,kBAAkB,OAAO,aAAa;CACzD;CAEA,MAAM,OACJ,OACA,cACA,UACA,OACkB;EAClB,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,YAAY;EAC/D,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI,CAAC,WAAW,QACd,MAAM,IAAI,cAAc,eAAe,aAAa,cAAc;EAEpE,MAAM,cAAc,KAAK,SAAS,IAAI,WAAW,aAAa;EAC9D,IAAI,CAAC,aACH,MAAM,IAAI,wBAAwB,WAAW,aAAa;EAE5D,MAAM,SAAS,YAAY,QAAQ,MAAM,MAAM,EAAE,OAAO,QAAQ;EAChE,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,QAAQ;EAE5C,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO,OAAO,WAAW,aAAa;EAC7E,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI;GACF,OAAO,MAAM,OAAO,OAAO;IAAE;IAAS,QAAQ,WAAW;GAAO,GAAG,KAAK;EAC1E,SAAS,KAAK;GACZ,KAAK,OAAO,KAAK,6BAA6B;IAC5C;IACA;IACA,eAAe,WAAW;IAC1B;IACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;GACD,MAAM,IAAI,sBAAsB,WAAW,eAAe,UAAU,GAAG;EACzE;CACF;AACF"}
+{"version":3,"file":"service.js","names":[],"sources":["../../src/integrations/service.ts"],"sourcesContent":["// integrations context — service implementation (inbound port). Owns the\n// connection lifecycle; credentials live in the shared secure credential store\n// (this service holds only the ref). The integrations the system supports are\n// declared at startup via the IntegrationsRegistry: connect/configure reject\n// unknown integration ids and validate config with the integration's own\n// validator. The domain never calls the external service — consumers take the\n// connection, reveal the credential at point of use, and build their own adapter.\n//\n// Mutations run inside the context's UnitOfWork: credential writes, connection\n// writes, and the outbox append commit in ONE transaction (transactional\n// outbox; this also closed the historical orphan-credential window). The\n// outbox relay — not this service — publishes to the EventBus.\nimport { genId } from '../shared/id.js';\nimport {\n  ActionInvocationError,\n  AlreadyConnectedError,\n  InvalidConfigError,\n  UnknownIntegrationError,\n  type ConfigureInput,\n  type ConnectInput,\n  type Connection,\n} from './model.js';\nimport type {\n  ConnectionsRepository,\n  IntegrationsRegistry,\n  IntegrationsService,\n  IntegrationsUnitOfWork,\n} from './ports.js';\nimport type { CredentialStore, Logger } from '../shared/ports.js';\nimport { ConflictError, NotFoundError } from '../shared/errors.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { integrationEvents } from './events.js';\n\nexport type IntegrationsServiceParams = {\n  registry: IntegrationsRegistry;\n  /** Read-only access (find/list) — runs outside any transaction. */\n  repo: ConnectionsRepository;\n  /** Atomic write scope: tx-bound connections repo + credential store + outbox. */\n  uow: IntegrationsUnitOfWork;\n  /** Point-of-use credential reveal for action invocation — reads only. */\n  credentials: CredentialStore;\n  logger?: Logger;\n};\n\nexport class IntegrationsServiceImpl implements IntegrationsService {\n  private readonly registry: IntegrationsRegistry;\n  private readonly repo: ConnectionsRepository;\n  private readonly uow: IntegrationsUnitOfWork;\n  private readonly credentials: CredentialStore;\n  private readonly logger: Logger;\n\n  constructor(params: IntegrationsServiceParams) {\n    this.registry = params.registry;\n    this.repo = params.repo;\n    this.uow = params.uow;\n    this.credentials = params.credentials;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  available() {\n    return this.registry.list().map((integration) => ({\n      id: integration.id,\n      configSchema: integration.configSchema(),\n      secretsSchema: integration.secretsSchema(),\n      actions: integration.actions.map((action) => ({\n        id: action.id,\n        description: action.description,\n        inputSchema: action.inputSchema(),\n        outputSchema: action.outputSchema(),\n      })),\n    }));\n  }\n\n  private validate(integrationId: string, config: Record<string, unknown>): void {\n    const integration = this.registry.get(integrationId);\n    if (!integration) {\n      this.logger.warn('unknown integration rejected', { integrationId });\n      throw new UnknownIntegrationError(integrationId);\n    }\n    const result = integration.validateConfig(config);\n    if (!result.ok) {\n      this.logger.warn('invalid integration config rejected', {\n        integrationId,\n        errors: result.errors,\n      });\n      throw new InvalidConfigError(integrationId, result.errors);\n    }\n  }\n\n  async connect(orgId: string, input: ConnectInput): Promise<Connection> {\n    const config = input.config ?? {};\n    this.validate(input.integrationId, config);\n    const existing = await this.repo.findByIntegration(orgId, input.integrationId);\n    if (existing) {\n      this.logger.warn('duplicate connection rejected', {\n        orgId,\n        integrationId: input.integrationId,\n      });\n      throw new AlreadyConnectedError(input.integrationId);\n    }\n    const connection = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      const credentialRef = await credentials.store(orgId, input.secrets);\n      const at = new Date();\n      const created = await connections.insert(orgId, {\n        orgId,\n        id: genId('connection'),\n        integrationId: input.integrationId,\n        config,\n        active: true,\n        credentialRef,\n        createdAt: at,\n        updatedAt: at,\n      });\n      await outbox.append([\n        integrationEvents.connectionCreated.make({\n          orgId,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('integration connected', {\n      orgId,\n      integrationId: connection.integrationId,\n      connectionId: connection.id,\n    });\n    return connection;\n  }\n\n  async reconnect(\n    orgId: string,\n    id: string,\n    secrets: Record<string, unknown>,\n  ): Promise<Connection | null> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return null;\n    }\n    const updated = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      await credentials.update(orgId, connection.credentialRef, secrets);\n      const result = await connections.update(orgId, id, { updatedAt: new Date() });\n      if (result) {\n        await outbox.append([integrationEvents.connectionUpdated.make({ orgId, data: result })]);\n      }\n      return result;\n    });\n    this.logger.info('integration credentials rotated', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return updated;\n  }\n\n  async configure(orgId: string, id: string, input: ConfigureInput): Promise<Connection | null> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return null;\n    }\n    if (input.config !== undefined) {\n      this.validate(connection.integrationId, input.config);\n    }\n    const updated = await this.uow.run(async ({ connections, outbox }) => {\n      const result = await connections.update(orgId, id, {\n        ...(input.config !== undefined ? { config: input.config } : {}),\n        ...(input.active !== undefined ? { active: input.active } : {}),\n        updatedAt: new Date(),\n      });\n      if (result) {\n        await outbox.append([integrationEvents.connectionUpdated.make({ orgId, data: result })]);\n      }\n      return result;\n    });\n    this.logger.info('integration configured', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return updated;\n  }\n\n  async disconnect(orgId: string, id: string): Promise<boolean> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return false;\n    }\n    const deleted = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      // Connection first: it holds the FK onto the credential row.\n      const ok = await connections.delete(orgId, id);\n      await credentials.destroy(orgId, connection.credentialRef);\n      await outbox.append([integrationEvents.connectionRemoved.make({ orgId, data: connection })]);\n      return ok;\n    });\n    this.logger.info('integration disconnected', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return deleted;\n  }\n\n  list(orgId: string): Promise<Connection[]> {\n    return this.repo.list(orgId);\n  }\n\n  get(orgId: string, id: string): Promise<Connection | null> {\n    return this.repo.findById(orgId, id);\n  }\n\n  getByIntegration(orgId: string, integrationId: string): Promise<Connection | null> {\n    return this.repo.findByIntegration(orgId, integrationId);\n  }\n\n  async invoke(\n    orgId: string,\n    connectionId: string,\n    actionId: string,\n    input: Record<string, unknown>,\n  ): Promise<unknown> {\n    const connection = await this.repo.findById(orgId, connectionId);\n    if (!connection) {\n      throw new NotFoundError('Connection', connectionId);\n    }\n    if (!connection.active) {\n      throw new ConflictError(`connection \"${connectionId}\" is inactive`);\n    }\n    const integration = this.registry.get(connection.integrationId);\n    if (!integration) {\n      throw new UnknownIntegrationError(connection.integrationId);\n    }\n    const action = integration.actions.find((a) => a.id === actionId);\n    if (!action) {\n      throw new NotFoundError('Action', actionId);\n    }\n    const secrets = await this.credentials.reveal(orgId, connection.credentialRef);\n    if (!secrets) {\n      throw new NotFoundError('Credential', connectionId);\n    }\n    try {\n      return await action.invoke({ secrets, config: connection.config }, input);\n    } catch (err) {\n      this.logger.warn('integration action failed', {\n        orgId,\n        connectionId,\n        integrationId: connection.integrationId,\n        actionId,\n        err,\n      });\n      throw new ActionInvocationError(connection.integrationId, actionId, err);\n    }\n  }\n}\n"],"mappings":";;;;;;AA4CA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,WAAW,OAAO;EACvB,KAAK,OAAO,OAAO;EACnB,KAAK,MAAM,OAAO;EAClB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,YAAY;EACV,OAAO,KAAK,SAAS,KAAK,CAAC,CAAC,KAAK,iBAAiB;GAChD,IAAI,YAAY;GAChB,cAAc,YAAY,aAAa;GACvC,eAAe,YAAY,cAAc;GACzC,SAAS,YAAY,QAAQ,KAAK,YAAY;IAC5C,IAAI,OAAO;IACX,aAAa,OAAO;IACpB,aAAa,OAAO,YAAY;IAChC,cAAc,OAAO,aAAa;GACpC,EAAE;EACJ,EAAE;CACJ;CAEA,SAAiB,eAAuB,QAAuC;EAC7E,MAAM,cAAc,KAAK,SAAS,IAAI,aAAa;EACnD,IAAI,CAAC,aAAa;GAChB,KAAK,OAAO,KAAK,gCAAgC,EAAE,cAAc,CAAC;GAClE,MAAM,IAAI,wBAAwB,aAAa;EACjD;EACA,MAAM,SAAS,YAAY,eAAe,MAAM;EAChD,IAAI,CAAC,OAAO,IAAI;GACd,KAAK,OAAO,KAAK,uCAAuC;IACtD;IACA,QAAQ,OAAO;GACjB,CAAC;GACD,MAAM,IAAI,mBAAmB,eAAe,OAAO,MAAM;EAC3D;CACF;CAEA,MAAM,QAAQ,OAAe,OAA0C;EACrE,MAAM,SAAS,MAAM,UAAU,CAAC;EAChC,KAAK,SAAS,MAAM,eAAe,MAAM;EAEzC,IAAI,MADmB,KAAK,KAAK,kBAAkB,OAAO,MAAM,aAAa,GAC/D;GACZ,KAAK,OAAO,KAAK,iCAAiC;IAChD;IACA,eAAe,MAAM;GACvB,CAAC;GACD,MAAM,IAAI,sBAAsB,MAAM,aAAa;EACrD;EACA,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACpF,MAAM,gBAAgB,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO;GAClE,MAAM,qBAAK,IAAI,KAAK;GACpB,MAAM,UAAU,MAAM,YAAY,OAAO,OAAO;IAC9C;IACA,IAAI,MAAM,YAAY;IACtB,eAAe,MAAM;IACrB;IACA,QAAQ;IACR;IACA,WAAW;IACX,WAAW;GACb,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,kBAAkB,kBAAkB,KAAK;IACvC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,yBAAyB;GACxC;GACA,eAAe,WAAW;GAC1B,cAAc,WAAW;EAC3B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UACJ,OACA,IACA,SAC4B;EAC5B,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACjF,MAAM,YAAY,OAAO,OAAO,WAAW,eAAe,OAAO;GACjE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI,EAAE,2BAAW,IAAI,KAAK,EAAE,CAAC;GAC5E,IAAI,QACF,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAAC,CAAC;GAEzF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,mCAAmC;GAClD;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UAAU,OAAe,IAAY,OAAmD;EAC5F,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,IAAI,MAAM,WAAW,KAAA,GACnB,KAAK,SAAS,WAAW,eAAe,MAAM,MAAM;EAEtD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa;GACpE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI;IACjD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,2BAAW,IAAI,KAAK;GACtB,CAAC;GACD,IAAI,QACF,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAAC,CAAC;GAEzF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,0BAA0B;GACzC;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,WAAW,OAAe,IAA8B;EAC5D,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GAEjF,MAAM,KAAK,MAAM,YAAY,OAAO,OAAO,EAAE;GAC7C,MAAM,YAAY,QAAQ,OAAO,WAAW,aAAa;GACzD,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAW,CAAC,CAAC,CAAC;GAC3F,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,4BAA4B;GAC3C;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,KAAK,OAAsC;EACzC,OAAO,KAAK,KAAK,KAAK,KAAK;CAC7B;CAEA,IAAI,OAAe,IAAwC;EACzD,OAAO,KAAK,KAAK,SAAS,OAAO,EAAE;CACrC;CAEA,iBAAiB,OAAe,eAAmD;EACjF,OAAO,KAAK,KAAK,kBAAkB,OAAO,aAAa;CACzD;CAEA,MAAM,OACJ,OACA,cACA,UACA,OACkB;EAClB,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,YAAY;EAC/D,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI,CAAC,WAAW,QACd,MAAM,IAAI,cAAc,eAAe,aAAa,cAAc;EAEpE,MAAM,cAAc,KAAK,SAAS,IAAI,WAAW,aAAa;EAC9D,IAAI,CAAC,aACH,MAAM,IAAI,wBAAwB,WAAW,aAAa;EAE5D,MAAM,SAAS,YAAY,QAAQ,MAAM,MAAM,EAAE,OAAO,QAAQ;EAChE,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,QAAQ;EAE5C,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO,OAAO,WAAW,aAAa;EAC7E,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI;GACF,OAAO,MAAM,OAAO,OAAO;IAAE;IAAS,QAAQ,WAAW;GAAO,GAAG,KAAK;EAC1E,SAAS,KAAK;GACZ,KAAK,OAAO,KAAK,6BAA6B;IAC5C;IACA;IACA,eAAe,WAAW;IAC1B;IACA;GACF,CAAC;GACD,MAAM,IAAI,sBAAsB,WAAW,eAAe,UAAU,GAAG;EACzE;CACF;AACF"}

package/dist/organizations/access-scopes.d.ts

@@ -0,0 +1,19 @@
+import { Role } from "../types/schemas/organizations.js";
+import { Permission } from "./roles.js";
+//#region src/organizations/access-scopes.d.ts
+declare const ACCESS_SCOPES: readonly ["courses:read", "courses:write", "courses:delete", "downloads:read", "downloads:write", "downloads:delete", "bundles:read", "bundles:write", "bundles:delete", "media:read", "students:read", "students:invite", "access:read", "access:write", "analytics:read", "automations:read", "automations:write", "automations:delete", "comments:read", "comments:moderate", "communities:read", "communities:write", "communities:delete", "community_members:read", "community_members:write", "community_moderation:read", "community_moderation:write"];
+type AccessScope = (typeof ACCESS_SCOPES)[number];
+declare const SCOPE_PERMISSION: Record<AccessScope, Permission | null>;
+type ScopeOption = {
+  scope: AccessScope;
+  allowed: boolean;
+};
+declare function isAccessScope(value: string): value is AccessScope;
+declare function isDeleteScope(scope: AccessScope): boolean;
+declare function roleHoldsScope(role: Role, scope: AccessScope): boolean;
+declare function scopesForRole(role: Role): AccessScope[];
+declare function scopeOptions(role: Role): ScopeOption[];
+declare function assertRoleHoldsScopes(role: Role, scopes: readonly AccessScope[]): void;
+//#endregion
+export { ACCESS_SCOPES, AccessScope, SCOPE_PERMISSION, ScopeOption, assertRoleHoldsScopes, isAccessScope, isDeleteScope, roleHoldsScope, scopeOptions, scopesForRole };
+//# sourceMappingURL=access-scopes.d.ts.map

package/dist/organizations/access-scopes.js

@@ -0,0 +1,89 @@
+import { ForbiddenError } from "../shared/errors.js";
+import { capability, isStaffRole } from "./roles.js";
+//#region src/organizations/access-scopes.ts
+const ACCESS_SCOPES = [
+	"courses:read",
+	"courses:write",
+	"courses:delete",
+	"downloads:read",
+	"downloads:write",
+	"downloads:delete",
+	"bundles:read",
+	"bundles:write",
+	"bundles:delete",
+	"media:read",
+	"students:read",
+	"students:invite",
+	"access:read",
+	"access:write",
+	"analytics:read",
+	"automations:read",
+	"automations:write",
+	"automations:delete",
+	"comments:read",
+	"comments:moderate",
+	"communities:read",
+	"communities:write",
+	"communities:delete",
+	"community_members:read",
+	"community_members:write",
+	"community_moderation:read",
+	"community_moderation:write"
+];
+const SCOPE_PERMISSION = {
+	"courses:read": null,
+	"courses:write": "create_course",
+	"courses:delete": "create_course",
+	"downloads:read": null,
+	"downloads:write": "create_course",
+	"downloads:delete": "create_course",
+	"bundles:read": null,
+	"bundles:write": "create_course",
+	"bundles:delete": "create_course",
+	"media:read": null,
+	"students:read": "view_student_progress",
+	"students:invite": "manage_users",
+	"access:read": "view_student_progress",
+	"access:write": "manage_users",
+	"analytics:read": "view_student_progress",
+	"automations:read": null,
+	"automations:write": "manage_org_settings",
+	"automations:delete": "manage_org_settings",
+	"comments:read": null,
+	"comments:moderate": "edit_assigned_course",
+	"communities:read": null,
+	"communities:write": "create_course",
+	"communities:delete": "create_course",
+	"community_members:read": null,
+	"community_members:write": "moderate",
+	"community_moderation:read": null,
+	"community_moderation:write": "moderate"
+};
+function isAccessScope(value) {
+	return ACCESS_SCOPES.includes(value);
+}
+function isDeleteScope(scope) {
+	return scope.endsWith(":delete");
+}
+function roleHoldsScope(role, scope) {
+	if (!isStaffRole(role)) return false;
+	const permission = SCOPE_PERMISSION[scope];
+	return permission === null || capability(role, permission) === true;
+}
+function scopesForRole(role) {
+	return ACCESS_SCOPES.filter((scope) => roleHoldsScope(role, scope));
+}
+function scopeOptions(role) {
+	return ACCESS_SCOPES.map((scope) => ({
+		scope,
+		allowed: roleHoldsScope(role, scope)
+	}));
+}
+function assertRoleHoldsScopes(role, scopes) {
+	const missing = scopes.filter((scope) => !roleHoldsScope(role, scope));
+	if (missing.length > 0) throw new ForbiddenError(`Your role cannot grant ${missing.join(", ")}`);
+}
+//#endregion
+export { ACCESS_SCOPES, SCOPE_PERMISSION, assertRoleHoldsScopes, isAccessScope, isDeleteScope, roleHoldsScope, scopeOptions, scopesForRole };
+
+//# sourceMappingURL=access-scopes.js.map

package/dist/organizations/access-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-scopes.js","names":[],"sources":["../../src/organizations/access-scopes.ts"],"sourcesContent":["import { ForbiddenError } from '../shared/errors.js';\nimport { capability, isStaffRole, type Permission, type Role } from './roles.js';\n\nexport const ACCESS_SCOPES = [\n  'courses:read',\n  'courses:write',\n  'courses:delete',\n  'downloads:read',\n  'downloads:write',\n  'downloads:delete',\n  'bundles:read',\n  'bundles:write',\n  'bundles:delete',\n  'media:read',\n  'students:read',\n  'students:invite',\n  'access:read',\n  'access:write',\n  'analytics:read',\n  'automations:read',\n  'automations:write',\n  'automations:delete',\n  'comments:read',\n  'comments:moderate',\n  'communities:read',\n  'communities:write',\n  'communities:delete',\n  'community_members:read',\n  'community_members:write',\n  'community_moderation:read',\n  'community_moderation:write',\n] as const;\n\nexport type AccessScope = (typeof ACCESS_SCOPES)[number];\n\nexport const SCOPE_PERMISSION: Record<AccessScope, Permission | null> = {\n  'courses:read': null,\n  'courses:write': 'create_course',\n  'courses:delete': 'create_course',\n  'downloads:read': null,\n  'downloads:write': 'create_course',\n  'downloads:delete': 'create_course',\n  'bundles:read': null,\n  'bundles:write': 'create_course',\n  'bundles:delete': 'create_course',\n  'media:read': null,\n  'students:read': 'view_student_progress',\n  'students:invite': 'manage_users',\n  'access:read': 'view_student_progress',\n  'access:write': 'manage_users',\n  'analytics:read': 'view_student_progress',\n  'automations:read': null,\n  'automations:write': 'manage_org_settings',\n  'automations:delete': 'manage_org_settings',\n  'comments:read': null,\n  'comments:moderate': 'edit_assigned_course',\n  'communities:read': null,\n  'communities:write': 'create_course',\n  'communities:delete': 'create_course',\n  'community_members:read': null,\n  'community_members:write': 'moderate',\n  'community_moderation:read': null,\n  'community_moderation:write': 'moderate',\n};\n\nexport type ScopeOption = { scope: AccessScope; allowed: boolean };\n\nexport function isAccessScope(value: string): value is AccessScope {\n  return (ACCESS_SCOPES as readonly string[]).includes(value);\n}\n\nexport function isDeleteScope(scope: AccessScope): boolean {\n  return scope.endsWith(':delete');\n}\n\nexport function roleHoldsScope(role: Role, scope: AccessScope): boolean {\n  if (!isStaffRole(role)) {\n    return false;\n  }\n  const permission = SCOPE_PERMISSION[scope];\n  return permission === null || capability(role, permission) === true;\n}\n\nexport function scopesForRole(role: Role): AccessScope[] {\n  return ACCESS_SCOPES.filter((scope) => roleHoldsScope(role, scope));\n}\n\nexport function scopeOptions(role: Role): ScopeOption[] {\n  return ACCESS_SCOPES.map((scope) => ({ scope, allowed: roleHoldsScope(role, scope) }));\n}\n\nexport function assertRoleHoldsScopes(role: Role, scopes: readonly AccessScope[]): void {\n  const missing = scopes.filter((scope) => !roleHoldsScope(role, scope));\n  if (missing.length > 0) {\n    throw new ForbiddenError(`Your role cannot grant ${missing.join(', ')}`);\n  }\n}\n"],"mappings":";;;AAGA,MAAa,gBAAgB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAIA,MAAa,mBAA2D;CACtE,gBAAgB;CAChB,iBAAiB;CACjB,kBAAkB;CAClB,kBAAkB;CAClB,mBAAmB;CACnB,oBAAoB;CACpB,gBAAgB;CAChB,iBAAiB;CACjB,kBAAkB;CAClB,cAAc;CACd,iBAAiB;CACjB,mBAAmB;CACnB,eAAe;CACf,gBAAgB;CAChB,kBAAkB;CAClB,oBAAoB;CACpB,qBAAqB;CACrB,sBAAsB;CACtB,iBAAiB;CACjB,qBAAqB;CACrB,oBAAoB;CACpB,qBAAqB;CACrB,sBAAsB;CACtB,0BAA0B;CAC1B,2BAA2B;CAC3B,6BAA6B;CAC7B,8BAA8B;AAChC;AAIA,SAAgB,cAAc,OAAqC;CACjE,OAAQ,cAAoC,SAAS,KAAK;AAC5D;AAEA,SAAgB,cAAc,OAA6B;CACzD,OAAO,MAAM,SAAS,SAAS;AACjC;AAEA,SAAgB,eAAe,MAAY,OAA6B;CACtE,IAAI,CAAC,YAAY,IAAI,GACnB,OAAO;CAET,MAAM,aAAa,iBAAiB;CACpC,OAAO,eAAe,QAAQ,WAAW,MAAM,UAAU,MAAM;AACjE;AAEA,SAAgB,cAAc,MAA2B;CACvD,OAAO,cAAc,QAAQ,UAAU,eAAe,MAAM,KAAK,CAAC;AACpE;AAEA,SAAgB,aAAa,MAA2B;CACtD,OAAO,cAAc,KAAK,WAAW;EAAE;EAAO,SAAS,eAAe,MAAM,KAAK;CAAE,EAAE;AACvF;AAEA,SAAgB,sBAAsB,MAAY,QAAsC;CACtF,MAAM,UAAU,OAAO,QAAQ,UAAU,CAAC,eAAe,MAAM,KAAK,CAAC;CACrE,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,eAAe,0BAA0B,QAAQ,KAAK,IAAI,GAAG;AAE3E"}

package/dist/organizations/events.d.ts

@@ -18,7 +18,14 @@ declare const organizationEvents: {
     ownerId: string;
     createdAt: unknown;
     updatedAt: unknown;
-  }>;
+  }, import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    name: import("zod").ZodString;
+    slug: import("zod").ZodString;
+    ownerId: import("zod").ZodString;
+  }, import("zod/v4/core").$strip>>;
   organizationUpdated: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
     externalId: string | null;
@@ -35,7 +42,14 @@ declare const organizationEvents: {
     ownerId: string;
     createdAt: unknown;
     updatedAt: unknown;
-  }>;
+  }, import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    name: import("zod").ZodString;
+    slug: import("zod").ZodString;
+    ownerId: import("zod").ZodString;
+  }, import("zod/v4/core").$strip>>;
   organizationDeleted: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
     externalId: string | null;
@@ -52,12 +66,19 @@ declare const organizationEvents: {
     ownerId: string;
     createdAt: unknown;
     updatedAt: unknown;
-  }>;
+  }, import("zod").ZodObject<{
+    id: import("zod").ZodString;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    name: import("zod").ZodString;
+    slug: import("zod").ZodString;
+    ownerId: import("zod").ZodString;
+  }, import("zod/v4/core").$strip>>;
   orgUserLinked: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
     orgId: string;
     userId: string;
-    role: "owner" | "admin" | "instructor" | "student";
+    role: "owner" | "admin" | "instructor" | "moderator" | "student";
     status: "active" | "invited";
     createdAt: Date;
     updatedAt: Date;
@@ -65,16 +86,33 @@ declare const organizationEvents: {
     id: string;
     orgId: string;
     userId: string;
-    role: "owner" | "admin" | "instructor" | "student";
+    role: "owner" | "admin" | "instructor" | "moderator" | "student";
     status: "active" | "invited";
     createdAt: unknown;
     updatedAt: unknown;
-  }>;
+  }, import("zod").ZodObject<{
+    orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
+    status: import("zod").ZodEnum<{
+      active: "active";
+      invited: "invited";
+    }>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    userId: import("zod").ZodString;
+    role: import("zod").ZodEnum<{
+      owner: "owner";
+      admin: "admin";
+      instructor: "instructor";
+      moderator: "moderator";
+      student: "student";
+    }>;
+  }, import("zod/v4/core").$strip>>;
   orgUserDeleted: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
     orgId: string;
     userId: string;
-    role: "owner" | "admin" | "instructor" | "student";
+    role: "owner" | "admin" | "instructor" | "moderator" | "student";
     status: "active" | "invited";
     createdAt: Date;
     updatedAt: Date;
@@ -82,58 +120,176 @@ declare const organizationEvents: {
     id: string;
     orgId: string;
     userId: string;
-    role: "owner" | "admin" | "instructor" | "student";
+    role: "owner" | "admin" | "instructor" | "moderator" | "student";
     status: "active" | "invited";
     createdAt: unknown;
     updatedAt: unknown;
-  }>;
+  }, import("zod").ZodObject<{
+    orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
+    status: import("zod").ZodEnum<{
+      active: "active";
+      invited: "invited";
+    }>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    userId: import("zod").ZodString;
+    role: import("zod").ZodEnum<{
+      owner: "owner";
+      admin: "admin";
+      instructor: "instructor";
+      moderator: "moderator";
+      student: "student";
+    }>;
+  }, import("zod/v4/core").$strip>>;
+  orgUserUpdated: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    orgId: string;
+    userId: string;
+    role: "owner" | "admin" | "instructor" | "moderator" | "student";
+    status: "active" | "invited";
+    createdAt: Date;
+    updatedAt: Date;
+  }, "organization.user.updated", 1>, {
+    id: string;
+    orgId: string;
+    userId: string;
+    role: "owner" | "admin" | "instructor" | "moderator" | "student";
+    status: "active" | "invited";
+    createdAt: unknown;
+    updatedAt: unknown;
+  }, import("zod").ZodObject<{
+    orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
+    status: import("zod").ZodEnum<{
+      active: "active";
+      invited: "invited";
+    }>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    userId: import("zod").ZodString;
+    role: import("zod").ZodEnum<{
+      owner: "owner";
+      admin: "admin";
+      instructor: "instructor";
+      moderator: "moderator";
+      student: "student";
+    }>;
+  }, import("zod/v4/core").$strip>>;
   inviteCreated: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
     orgId: string;
     email: string;
-    role: "admin" | "instructor" | "student";
+    role: "admin" | "instructor" | "moderator" | "student";
     status: "pending" | "accepted" | "rejected" | "canceled";
     invitedBy: string;
     tokenHash: string | null;
     expiresAt: Date | null;
     createdAt: Date;
+    updatedAt: Date;
   }, "organization.invite.created", 1>, {
     id: string;
     orgId: string;
     email: string;
-    role: "admin" | "instructor" | "student";
+    role: "admin" | "instructor" | "moderator" | "student";
     status: "pending" | "accepted" | "rejected" | "canceled";
     invitedBy: string;
     tokenHash: string | null;
     expiresAt: unknown;
     createdAt: unknown;
-  }>;
+    updatedAt: unknown;
+  }, import("zod").ZodObject<{
+    orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
+    status: import("zod").ZodEnum<{
+      pending: "pending";
+      accepted: "accepted";
+      rejected: "rejected";
+      canceled: "canceled";
+    }>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    expiresAt: import("zod").ZodNullable<import("zod").ZodCoercedDate<unknown>>;
+    email: import("zod").ZodEmail;
+    role: import("zod").ZodEnum<{
+      admin: "admin";
+      instructor: "instructor";
+      moderator: "moderator";
+      student: "student";
+    }>;
+    invitedBy: import("zod").ZodString;
+  }, import("zod/v4/core").$strip>>;
   inviteAccepted: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
     orgId: string;
     email: string;
-    role: "admin" | "instructor" | "student";
+    role: "admin" | "instructor" | "moderator" | "student";
     status: "pending" | "accepted" | "rejected" | "canceled";
     invitedBy: string;
     tokenHash: string | null;
     expiresAt: Date | null;
     createdAt: Date;
+    updatedAt: Date;
   }, "organization.invite.accepted", 1>, {
     id: string;
     orgId: string;
     email: string;
-    role: "admin" | "instructor" | "student";
+    role: "admin" | "instructor" | "moderator" | "student";
+    status: "pending" | "accepted" | "rejected" | "canceled";
+    invitedBy: string;
+    tokenHash: string | null;
+    expiresAt: unknown;
+    createdAt: unknown;
+    updatedAt: unknown;
+  }, import("zod").ZodObject<{
+    orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
+    status: import("zod").ZodEnum<{
+      pending: "pending";
+      accepted: "accepted";
+      rejected: "rejected";
+      canceled: "canceled";
+    }>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    expiresAt: import("zod").ZodNullable<import("zod").ZodCoercedDate<unknown>>;
+    email: import("zod").ZodEmail;
+    role: import("zod").ZodEnum<{
+      admin: "admin";
+      instructor: "instructor";
+      moderator: "moderator";
+      student: "student";
+    }>;
+    invitedBy: import("zod").ZodString;
+  }, import("zod/v4/core").$strip>>;
+  inviteCanceled: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    orgId: string;
+    email: string;
+    role: "admin" | "instructor" | "moderator" | "student";
+    status: "pending" | "accepted" | "rejected" | "canceled";
+    invitedBy: string;
+    tokenHash: string | null;
+    expiresAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+  }, "organization.invite.canceled", 1>, {
+    id: string;
+    orgId: string;
+    email: string;
+    role: "admin" | "instructor" | "moderator" | "student";
     status: "pending" | "accepted" | "rejected" | "canceled";
     invitedBy: string;
     tokenHash: string | null;
     expiresAt: unknown;
     createdAt: unknown;
-  }>;
+    updatedAt: unknown;
+  }, undefined>;
   studentCreated: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
     orgId: string;
     userId: string;
-    role: "owner" | "admin" | "instructor" | "student";
+    role: "owner" | "admin" | "instructor" | "moderator" | "student";
     status: "active" | "invited";
     createdAt: Date;
     updatedAt: Date;
@@ -141,16 +297,33 @@ declare const organizationEvents: {
     id: string;
     orgId: string;
     userId: string;
-    role: "owner" | "admin" | "instructor" | "student";
+    role: "owner" | "admin" | "instructor" | "moderator" | "student";
     status: "active" | "invited";
     createdAt: unknown;
     updatedAt: unknown;
-  }>;
+  }, import("zod").ZodObject<{
+    orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
+    status: import("zod").ZodEnum<{
+      active: "active";
+      invited: "invited";
+    }>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    userId: import("zod").ZodString;
+    role: import("zod").ZodEnum<{
+      owner: "owner";
+      admin: "admin";
+      instructor: "instructor";
+      moderator: "moderator";
+      student: "student";
+    }>;
+  }, import("zod/v4/core").$strip>>;
   studentDeleted: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
     orgId: string;
     userId: string;
-    role: "owner" | "admin" | "instructor" | "student";
+    role: "owner" | "admin" | "instructor" | "moderator" | "student";
     status: "active" | "invited";
     createdAt: Date;
     updatedAt: Date;
@@ -158,16 +331,33 @@ declare const organizationEvents: {
     id: string;
     orgId: string;
     userId: string;
-    role: "owner" | "admin" | "instructor" | "student";
+    role: "owner" | "admin" | "instructor" | "moderator" | "student";
     status: "active" | "invited";
     createdAt: unknown;
     updatedAt: unknown;
-  }>;
+  }, import("zod").ZodObject<{
+    orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
+    status: import("zod").ZodEnum<{
+      active: "active";
+      invited: "invited";
+    }>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    userId: import("zod").ZodString;
+    role: import("zod").ZodEnum<{
+      owner: "owner";
+      admin: "admin";
+      instructor: "instructor";
+      moderator: "moderator";
+      student: "student";
+    }>;
+  }, import("zod/v4/core").$strip>>;
   studentLinked: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
     orgId: string;
     userId: string;
-    role: "owner" | "admin" | "instructor" | "student";
+    role: "owner" | "admin" | "instructor" | "moderator" | "student";
     status: "active" | "invited";
     createdAt: Date;
     updatedAt: Date;
@@ -175,23 +365,42 @@ declare const organizationEvents: {
     id: string;
     orgId: string;
     userId: string;
-    role: "owner" | "admin" | "instructor" | "student";
+    role: "owner" | "admin" | "instructor" | "moderator" | "student";
     status: "active" | "invited";
     createdAt: unknown;
     updatedAt: unknown;
-  }>;
+  }, import("zod").ZodObject<{
+    orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
+    status: import("zod").ZodEnum<{
+      active: "active";
+      invited: "invited";
+    }>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    userId: import("zod").ZodString;
+    role: import("zod").ZodEnum<{
+      owner: "owner";
+      admin: "admin";
+      instructor: "instructor";
+      moderator: "moderator";
+      student: "student";
+    }>;
+  }, import("zod/v4/core").$strip>>;
 };
 type OrganizationCreated = EventOf<typeof organizationEvents.organizationCreated>;
 type OrganizationUpdated = EventOf<typeof organizationEvents.organizationUpdated>;
 type OrganizationDeleted = EventOf<typeof organizationEvents.organizationDeleted>;
 type OrgUserLinked = EventOf<typeof organizationEvents.orgUserLinked>;
 type OrgUserDeleted = EventOf<typeof organizationEvents.orgUserDeleted>;
+type OrgUserUpdated = EventOf<typeof organizationEvents.orgUserUpdated>;
 type InviteCreated = EventOf<typeof organizationEvents.inviteCreated>;
 type InviteAccepted = EventOf<typeof organizationEvents.inviteAccepted>;
+type InviteCanceled = EventOf<typeof organizationEvents.inviteCanceled>;
 type StudentCreated = EventOf<typeof organizationEvents.studentCreated>;
 type StudentDeleted = EventOf<typeof organizationEvents.studentDeleted>;
 type StudentLinked = EventOf<typeof organizationEvents.studentLinked>;
 type OrganizationEvent = EventOfValues<typeof organizationEvents>;
 //#endregion
-export { InviteAccepted, InviteCreated, OrgUserDeleted, OrgUserLinked, OrganizationCreated, OrganizationDeleted, OrganizationEvent, OrganizationUpdated, StudentCreated, StudentDeleted, StudentLinked, organizationEvents };
+export { InviteAccepted, InviteCanceled, InviteCreated, OrgUserDeleted, OrgUserLinked, OrgUserUpdated, OrganizationCreated, OrganizationDeleted, OrganizationEvent, OrganizationUpdated, StudentCreated, StudentDeleted, StudentLinked, organizationEvents };
 //# sourceMappingURL=events.d.ts.map