@headless-lms/core 0.1.0 → 0.3.0

package/dist/organizations/events.js

@@ -1,56 +1,105 @@
 import { inviteSchema, orgUserSchema, organizationSchema } from "../types/schemas/organizations.js";
 import { defineEvent } from "../shared/events.js";
 //#region src/organizations/events.ts
+const publicOrganization = organizationSchema.pick({
+	id: true,
+	name: true,
+	slug: true,
+	ownerId: true,
+	createdAt: true,
+	updatedAt: true
+}).strip();
+const publicOrgUser = orgUserSchema.pick({
+	id: true,
+	orgId: true,
+	userId: true,
+	role: true,
+	status: true,
+	createdAt: true,
+	updatedAt: true
+}).strip();
+const publicInvite = inviteSchema.pick({
+	id: true,
+	orgId: true,
+	email: true,
+	role: true,
+	status: true,
+	invitedBy: true,
+	expiresAt: true,
+	createdAt: true,
+	updatedAt: true
+}).strip();
 const organizationEvents = {
 	organizationCreated: defineEvent({
 		type: "organization.created",
 		version: 1,
-		data: organizationSchema
+		data: organizationSchema,
+		publicData: publicOrganization
 	}),
 	organizationUpdated: defineEvent({
 		type: "organization.updated",
 		version: 1,
-		data: organizationSchema
+		data: organizationSchema,
+		publicData: publicOrganization
 	}),
 	organizationDeleted: defineEvent({
 		type: "organization.deleted",
 		version: 1,
-		data: organizationSchema
+		data: organizationSchema,
+		publicData: publicOrganization
 	}),
 	orgUserLinked: defineEvent({
 		type: "organization.user.linked",
 		version: 1,
-		data: orgUserSchema
+		data: orgUserSchema,
+		publicData: publicOrgUser
 	}),
 	orgUserDeleted: defineEvent({
 		type: "organization.user.deleted",
 		version: 1,
-		data: orgUserSchema
+		data: orgUserSchema,
+		publicData: publicOrgUser
+	}),
+	orgUserUpdated: defineEvent({
+		type: "organization.user.updated",
+		version: 1,
+		data: orgUserSchema,
+		publicData: publicOrgUser
 	}),
 	inviteCreated: defineEvent({
 		type: "organization.invite.created",
 		version: 1,
-		data: inviteSchema
+		data: inviteSchema,
+		publicData: publicInvite
 	}),
 	inviteAccepted: defineEvent({
 		type: "organization.invite.accepted",
 		version: 1,
+		data: inviteSchema,
+		publicData: publicInvite
+	}),
+	inviteCanceled: defineEvent({
+		type: "organization.invite.canceled",
+		version: 1,
 		data: inviteSchema
 	}),
 	studentCreated: defineEvent({
 		type: "organization.student.created",
 		version: 1,
-		data: orgUserSchema
+		data: orgUserSchema,
+		publicData: publicOrgUser
 	}),
 	studentDeleted: defineEvent({
 		type: "organization.student.deleted",
 		version: 1,
-		data: orgUserSchema
+		data: orgUserSchema,
+		publicData: publicOrgUser
 	}),
 	studentLinked: defineEvent({
 		type: "organization.student.linked",
 		version: 1,
-		data: orgUserSchema
+		data: orgUserSchema,
+		publicData: publicOrgUser
 	})
 };
 //#endregion

package/dist/organizations/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","names":[],"sources":["../../src/organizations/events.ts"],"sourcesContent":["import {\n  inviteSchema,\n  organizationSchema,\n  orgUserSchema,\n} from '../types/schemas/index.js';\nimport { defineEvent, type EventOf, type EventOfValues } from '../shared/ports.js';\n\nexport const organizationEvents = {\n  organizationCreated: defineEvent({\n    type: 'organization.created',\n    version: 1,\n    data: organizationSchema,\n  }),\n  organizationUpdated: defineEvent({\n    type: 'organization.updated',\n    version: 1,\n    data: organizationSchema,\n  }),\n  organizationDeleted: defineEvent({\n    type: 'organization.deleted',\n    version: 1,\n    data: organizationSchema,\n  }),\n  orgUserLinked: defineEvent({\n    type: 'organization.user.linked',\n    version: 1,\n    data: orgUserSchema,\n  }),\n  orgUserDeleted: defineEvent({\n    type: 'organization.user.deleted',\n    version: 1,\n    data: orgUserSchema,\n  }),\n  inviteCreated: defineEvent({\n    type: 'organization.invite.created',\n    version: 1,\n    data: inviteSchema,\n  }),\n  inviteAccepted: defineEvent({\n    type: 'organization.invite.accepted',\n    version: 1,\n    data: inviteSchema,\n  }),\n  studentCreated: defineEvent({\n    type: 'organization.student.created',\n    version: 1,\n    data: orgUserSchema,\n  }),\n  studentDeleted: defineEvent({\n    type: 'organization.student.deleted',\n    version: 1,\n    data: orgUserSchema,\n  }),\n  studentLinked: defineEvent({\n    type: 'organization.student.linked',\n    version: 1,\n    data: orgUserSchema,\n  }),\n};\n\nexport type OrganizationCreated = EventOf<typeof organizationEvents.organizationCreated>;\nexport type OrganizationUpdated = EventOf<typeof organizationEvents.organizationUpdated>;\nexport type OrganizationDeleted = EventOf<typeof organizationEvents.organizationDeleted>;\nexport type OrgUserLinked = EventOf<typeof organizationEvents.orgUserLinked>;\nexport type OrgUserDeleted = EventOf<typeof organizationEvents.orgUserDeleted>;\nexport type InviteCreated = EventOf<typeof organizationEvents.inviteCreated>;\nexport type InviteAccepted = EventOf<typeof organizationEvents.inviteAccepted>;\nexport type StudentCreated = EventOf<typeof organizationEvents.studentCreated>;\nexport type StudentDeleted = EventOf<typeof organizationEvents.studentDeleted>;\nexport type StudentLinked = EventOf<typeof organizationEvents.studentLinked>;\nexport type OrganizationEvent = EventOfValues<typeof organizationEvents>;\n"],"mappings":";;;AAOA,MAAa,qBAAqB;CAChC,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;AACH"}
+{"version":3,"file":"events.js","names":[],"sources":["../../src/organizations/events.ts"],"sourcesContent":["import { inviteSchema, organizationSchema, orgUserSchema } from '../types/schemas/index.js';\nimport { defineEvent, type EventOf, type EventOfValues } from '../shared/ports.js';\n\nconst publicOrganization = organizationSchema\n  .pick({\n    id: true,\n    name: true,\n    slug: true,\n    ownerId: true,\n    createdAt: true,\n    updatedAt: true,\n  })\n  .strip();\n\nconst publicOrgUser = orgUserSchema\n  .pick({\n    id: true,\n    orgId: true,\n    userId: true,\n    role: true,\n    status: true,\n    createdAt: true,\n    updatedAt: true,\n  })\n  .strip();\n\nconst publicInvite = inviteSchema\n  .pick({\n    id: true,\n    orgId: true,\n    email: true,\n    role: true,\n    status: true,\n    invitedBy: true,\n    expiresAt: true,\n    createdAt: true,\n    updatedAt: true,\n  })\n  .strip();\n\nexport const organizationEvents = {\n  organizationCreated: defineEvent({\n    type: 'organization.created',\n    version: 1,\n    data: organizationSchema,\n    publicData: publicOrganization,\n  }),\n  organizationUpdated: defineEvent({\n    type: 'organization.updated',\n    version: 1,\n    data: organizationSchema,\n    publicData: publicOrganization,\n  }),\n  organizationDeleted: defineEvent({\n    type: 'organization.deleted',\n    version: 1,\n    data: organizationSchema,\n    publicData: publicOrganization,\n  }),\n  orgUserLinked: defineEvent({\n    type: 'organization.user.linked',\n    version: 1,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n  orgUserDeleted: defineEvent({\n    type: 'organization.user.deleted',\n    version: 1,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n  orgUserUpdated: defineEvent({\n    type: 'organization.user.updated',\n    version: 1,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n  inviteCreated: defineEvent({\n    type: 'organization.invite.created',\n    version: 1,\n    data: inviteSchema,\n    publicData: publicInvite,\n  }),\n  inviteAccepted: defineEvent({\n    type: 'organization.invite.accepted',\n    version: 1,\n    data: inviteSchema,\n    publicData: publicInvite,\n  }),\n  inviteCanceled: defineEvent({\n    type: 'organization.invite.canceled',\n    version: 1,\n    data: inviteSchema,\n  }),\n  studentCreated: defineEvent({\n    type: 'organization.student.created',\n    version: 1,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n  studentDeleted: defineEvent({\n    type: 'organization.student.deleted',\n    version: 1,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n  studentLinked: defineEvent({\n    type: 'organization.student.linked',\n    version: 1,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n};\n\nexport type OrganizationCreated = EventOf<typeof organizationEvents.organizationCreated>;\nexport type OrganizationUpdated = EventOf<typeof organizationEvents.organizationUpdated>;\nexport type OrganizationDeleted = EventOf<typeof organizationEvents.organizationDeleted>;\nexport type OrgUserLinked = EventOf<typeof organizationEvents.orgUserLinked>;\nexport type OrgUserDeleted = EventOf<typeof organizationEvents.orgUserDeleted>;\nexport type OrgUserUpdated = EventOf<typeof organizationEvents.orgUserUpdated>;\nexport type InviteCreated = EventOf<typeof organizationEvents.inviteCreated>;\nexport type InviteAccepted = EventOf<typeof organizationEvents.inviteAccepted>;\nexport type InviteCanceled = EventOf<typeof organizationEvents.inviteCanceled>;\nexport type StudentCreated = EventOf<typeof organizationEvents.studentCreated>;\nexport type StudentDeleted = EventOf<typeof organizationEvents.studentDeleted>;\nexport type StudentLinked = EventOf<typeof organizationEvents.studentLinked>;\nexport type OrganizationEvent = EventOfValues<typeof organizationEvents>;\n"],"mappings":";;;AAGA,MAAM,qBAAqB,mBACxB,KAAK;CACJ,IAAI;CACJ,MAAM;CACN,MAAM;CACN,SAAS;CACT,WAAW;CACX,WAAW;AACb,CAAC,CAAC,CACD,MAAM;AAET,MAAM,gBAAgB,cACnB,KAAK;CACJ,IAAI;CACJ,OAAO;CACP,QAAQ;CACR,MAAM;CACN,QAAQ;CACR,WAAW;CACX,WAAW;AACb,CAAC,CAAC,CACD,MAAM;AAET,MAAM,eAAe,aAClB,KAAK;CACJ,IAAI;CACJ,OAAO;CACP,OAAO;CACP,MAAM;CACN,QAAQ;CACR,WAAW;CACX,WAAW;CACX,WAAW;CACX,WAAW;AACb,CAAC,CAAC,CACD,MAAM;AAET,MAAa,qBAAqB;CAChC,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;AACH"}

package/dist/organizations/index.d.ts

@@ -1,11 +1,12 @@
-import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, InviteRole, NewOrganizationInput, OrgUser, OrgUserStatus, Organization, Role } from "../types/schemas/organizations.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, InviteRole, NewOrganizationInput, OrgUser, OrgUserStatus, Organization, Role, UpdateOrgUserInput } from "../types/schemas/organizations.js";
 import { InviteId, OrgUserId, OrganizationId } from "../types/organizations.js";
-import { AuthHeaders } from "../identity/ports.js";
-import { InviteAccepted, InviteCreated, OrgUserDeleted, OrgUserLinked, OrganizationCreated, OrganizationDeleted, OrganizationEvent, OrganizationUpdated, StudentCreated, StudentDeleted, StudentLinked, organizationEvents } from "./events.js";
 import "./model.js";
-import { Capability, Permission, ROLES, STAFF_ROLES, STUDENT_ROLE, StaffRole, capability, isRole, isStaffRole, normalizeRole, parseRole } from "./roles.js";
-import { Member, MemberStatus, MembersQuery, OrganizationRuleError, Page } from "./members.js";
-import { CreateOrganizationInput, LinkOrgUserInput, ResendStudentInviteInput, UnlinkOrgUserInput, UpdateOrganizationInput, UpdatePersonInput, UpdateStudentInput } from "./types.js";
+import { Capability, Permission, ROLES, STAFF_ROLES, STUDENT_ROLE, StaffRole, TeamRole, canModerate, capability, isRole, isStaffRole, normalizeRole, parseRole } from "./roles.js";
+import { InviteError, Member, MemberRoleChange, MemberStatus, MembersQuery, OrganizationRuleError, Page } from "./members.js";
+import { CreateOrganizationInput, LinkOrgUserInput, ResendStudentInviteInput, UnlinkOrgUserInput, UpdateOrganizationInput } from "./types.js";
+import { AuthHeaders } from "../identity/ports.js";
 import { AuthOrganization, MemberRecord, MemberWriteContext, MembersRepository, NewInviteRow, NewOrganizationRow, OrgAdmin, OrganizationService, OrganizationsRepository } from "./ports.js";
 import { OrganizationServiceImpl } from "./service.js";
-export { type AcceptInviteInput, type AddOrgUserInput, type AuthHeaders, type AuthOrganization, type Capability, type CreateInviteInput, type CreateOrgUserInput, type CreateOrganizationInput, type Invite, type InviteAccepted, type InviteCreated, type InviteId, type InviteRole, type LinkOrgUserInput, type Member, type MemberRecord, type MemberStatus, type MemberWriteContext, type MembersQuery, type MembersRepository, type NewInviteRow, type NewOrganizationInput, type NewOrganizationRow, type OrgAdmin, type OrgUser, type OrgUserDeleted, type OrgUserId, type OrgUserLinked, type OrgUserStatus, type Organization, type OrganizationCreated, type OrganizationDeleted, type OrganizationEvent, type OrganizationId, OrganizationRuleError, type OrganizationService, OrganizationServiceImpl, type OrganizationUpdated, type OrganizationsRepository, type Page, type Permission, ROLES, type ResendStudentInviteInput, type Role, STAFF_ROLES, STUDENT_ROLE, type StaffRole, type StudentCreated, type StudentDeleted, type StudentLinked, type UnlinkOrgUserInput, type UpdateOrganizationInput, type UpdatePersonInput, type UpdateStudentInput, capability, isRole, isStaffRole, normalizeRole, organizationEvents, parseRole };
+import { InviteAccepted, InviteCanceled, InviteCreated, OrgUserDeleted, OrgUserLinked, OrgUserUpdated, OrganizationCreated, OrganizationDeleted, OrganizationEvent, OrganizationUpdated, StudentCreated, StudentDeleted, StudentLinked, organizationEvents } from "./events.js";
+import { ACCESS_SCOPES, AccessScope, SCOPE_PERMISSION, ScopeOption, assertRoleHoldsScopes, isAccessScope, isDeleteScope, roleHoldsScope, scopeOptions, scopesForRole } from "./access-scopes.js";
+export { ACCESS_SCOPES, type AcceptInviteInput, AccessScope, type AddOrgUserInput, type AuthHeaders, type AuthOrganization, type Capability, type CreateInviteInput, type CreateOrgUserInput, type CreateOrganizationInput, type Invite, type InviteAccepted, type InviteCanceled, type InviteCreated, InviteError, type InviteId, type InviteRole, type LinkOrgUserInput, type Member, type MemberRecord, type MemberRoleChange, type MemberStatus, type MemberWriteContext, type MembersQuery, type MembersRepository, type NewInviteRow, type NewOrganizationInput, type NewOrganizationRow, type OrgAdmin, type OrgUser, type OrgUserDeleted, type OrgUserId, type OrgUserLinked, type OrgUserStatus, type OrgUserUpdated, type Organization, type OrganizationCreated, type OrganizationDeleted, type OrganizationEvent, type OrganizationId, OrganizationRuleError, type OrganizationService, OrganizationServiceImpl, type OrganizationUpdated, type OrganizationsRepository, type Page, type Permission, ROLES, type ResendStudentInviteInput, type Role, SCOPE_PERMISSION, STAFF_ROLES, STUDENT_ROLE, ScopeOption, type StaffRole, type StudentCreated, type StudentDeleted, type StudentLinked, type TeamRole, type UnlinkOrgUserInput, type UpdateOrgUserInput, type UpdateOrganizationInput, assertRoleHoldsScopes, canModerate, capability, isAccessScope, isDeleteScope, isRole, isStaffRole, normalizeRole, organizationEvents, parseRole, roleHoldsScope, scopeOptions, scopesForRole };

package/dist/organizations/index.js

@@ -1,5 +1,6 @@
-import { ROLES, STAFF_ROLES, STUDENT_ROLE, capability, isRole, isStaffRole, normalizeRole, parseRole } from "./roles.js";
-import { OrganizationRuleError } from "./members.js";
+import { ROLES, STAFF_ROLES, STUDENT_ROLE, canModerate, capability, isRole, isStaffRole, normalizeRole, parseRole } from "./roles.js";
+import { InviteError, OrganizationRuleError } from "./members.js";
 import { organizationEvents } from "./events.js";
 import { OrganizationServiceImpl } from "./service.js";
-export { OrganizationRuleError, OrganizationServiceImpl, ROLES, STAFF_ROLES, STUDENT_ROLE, capability, isRole, isStaffRole, normalizeRole, organizationEvents, parseRole };
+import { ACCESS_SCOPES, SCOPE_PERMISSION, assertRoleHoldsScopes, isAccessScope, isDeleteScope, roleHoldsScope, scopeOptions, scopesForRole } from "./access-scopes.js";
+export { ACCESS_SCOPES, InviteError, OrganizationRuleError, OrganizationServiceImpl, ROLES, SCOPE_PERMISSION, STAFF_ROLES, STUDENT_ROLE, assertRoleHoldsScopes, canModerate, capability, isAccessScope, isDeleteScope, isRole, isStaffRole, normalizeRole, organizationEvents, parseRole, roleHoldsScope, scopeOptions, scopesForRole };

package/dist/organizations/members.d.ts

@@ -1,20 +1,23 @@
-import { OrgUserProfile } from "../types/schemas/organizations.js";
+import { OrgUserProfile, Role } from "../types/schemas/organizations.js";
 import "../types/index.js";
-import { StaffRole } from "./roles.js";
+import { TeamRole } from "./roles.js";
 //#region src/organizations/members.d.ts
 type MemberStatus = 'active' | 'invited';
 interface Member extends OrgUserProfile {
-  role: StaffRole;
+  role: TeamRole;
   status: MemberStatus;
   joinedAt: string | null;
   invitedAt: string | null;
 }
+interface MemberRoleChange extends Omit<Member, 'role'> {
+  role: Role;
+}
 interface MembersQuery {
   page: number;
   pageSize: number;
   search?: string | undefined;
   sort?: string | undefined;
-  role?: StaffRole | undefined;
+  role?: TeamRole | undefined;
   status?: MemberStatus | undefined;
 }
 interface Page<T> {
@@ -28,5 +31,5 @@ declare class InviteError extends Error {
   constructor(message: string);
 }
 //#endregion
-export { InviteError, Member, MemberStatus, MembersQuery, OrganizationRuleError, Page };
+export { InviteError, Member, MemberRoleChange, MemberStatus, MembersQuery, OrganizationRuleError, Page };
 //# sourceMappingURL=members.d.ts.map

package/dist/organizations/members.js.map

@@ -1 +1 @@
-{"version":3,"file":"members.js","names":[],"sources":["../../src/organizations/members.ts"],"sourcesContent":["// organizations context — member-management types (invite / change-role / remove).\n// The operational surface over the org's members and pending invites. Roles\n// come from ./roles.ts (the single role model); writes go through Better Auth.\nimport type { StaffRole } from './roles.js';\nimport type { OrgUserProfile } from '../types/index.js';\n\nexport type MemberStatus = 'active' | 'invited';\n\nexport interface Member extends OrgUserProfile {\n  role: StaffRole;\n  status: MemberStatus;\n  joinedAt: string | null;\n  invitedAt: string | null;\n}\n\nexport interface MembersQuery {\n  page: number;\n  pageSize: number;\n  search?: string | undefined;\n  sort?: string | undefined;\n  role?: StaffRole | undefined;\n  status?: MemberStatus | undefined;\n}\n\nexport interface Page<T> {\n  rows: T[];\n  total: number;\n  page: number;\n  pageSize: number;\n}\n\n\nexport class OrganizationRuleError extends Error {}\nexport class InviteError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'InviteError';\n  }\n}\n"],"mappings":";AAgCA,IAAa,wBAAb,cAA2C,MAAM,CAAC;AAClD,IAAa,cAAb,cAAiC,MAAM;CACrC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"members.js","names":[],"sources":["../../src/organizations/members.ts"],"sourcesContent":["// organizations context — member-management types (invite / change-role / remove).\n// The operational surface over the org's members and pending invites. Roles\n// come from ./roles.ts (the single role model); writes go through Better Auth.\nimport type { Role, TeamRole } from './roles.js';\nimport type { OrgUserProfile } from '../types/index.js';\n\nexport type MemberStatus = 'active' | 'invited';\n\nexport interface Member extends OrgUserProfile {\n  role: TeamRole;\n  status: MemberStatus;\n  joinedAt: string | null;\n  invitedAt: string | null;\n}\n\nexport interface MemberRoleChange extends Omit<Member, 'role'> {\n  role: Role;\n}\n\nexport interface MembersQuery {\n  page: number;\n  pageSize: number;\n  search?: string | undefined;\n  sort?: string | undefined;\n  role?: TeamRole | undefined;\n  status?: MemberStatus | undefined;\n}\n\nexport interface Page<T> {\n  rows: T[];\n  total: number;\n  page: number;\n  pageSize: number;\n}\n\nexport class OrganizationRuleError extends Error {}\nexport class InviteError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'InviteError';\n  }\n}\n"],"mappings":";AAmCA,IAAa,wBAAb,cAA2C,MAAM,CAAC;AAClD,IAAa,cAAb,cAAiC,MAAM;CACrC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF"}

package/dist/organizations/ports.d.ts

@@ -1,32 +1,35 @@
-import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, InviteRole, NewOrganizationInput, OrgUser, Organization, Role } from "../types/schemas/organizations.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, InviteRole, NewOrganizationInput, OrgUser, Organization, Role, UpdateOrgUserInput } from "../types/schemas/organizations.js";
 import { OutboxAppender, UnitOfWork } from "../shared/ports.js";
-import { AuthHeaders } from "../identity/ports.js";
-import "../identity/index.js";
+import { Actor } from "../shared/actor.js";
 import "./model.js";
 import "./roles.js";
-import { Member, MembersQuery, Page } from "./members.js";
-import { CreateOrganizationInput, ResendStudentInviteInput, UpdateOrganizationInput, UpdateStudentInput } from "./types.js";
+import { Member, MemberRoleChange, MembersQuery, Page } from "./members.js";
+import { CreateOrganizationInput, ResendStudentInviteInput, UpdateOrganizationInput } from "./types.js";
+import { AuthHeaders } from "../identity/ports.js";
+import "../identity/index.js";
 //#region src/organizations/ports.d.ts
 interface OrganizationService {
   createOrganization(input: CreateOrganizationInput): Promise<Organization>;
   updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization>;
   deleteOrganization(id: string): Promise<Organization>;
   addOrgUser(input: AddOrgUserInput): Promise<OrgUser>;
-  removeOrgUser(orgId: string, id: string): Promise<OrgUser>;
+  removeOrgUser(orgId: string, userId: string): Promise<OrgUser>;
+  updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser>;
   getByExternalId(externalId: string): Promise<Organization | null>;
   getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
+  getOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
   getOrgUsersForUser(userId: string): Promise<OrgUser[]>;
   getById(id: string): Promise<Organization | null>;
-  createInvite(input: CreateInviteInput): Promise<Invite>;
+  createInvite(actor: Actor, input: CreateInviteInput): Promise<Invite>;
   peekInvite(token: string): Promise<Invite | null>;
   acceptInvite(input: AcceptInviteInput): Promise<OrgUser>;
-  deleteOrgUser(orgId: string, id: string): Promise<OrgUser>;
-  resendStudentInvite(input: ResendStudentInviteInput): Promise<void>;
-  updateStudent(input: UpdateStudentInput): Promise<OrgUser>;
+  deleteOrgUser(orgId: string, actor: Actor, id: string): Promise<OrgUser>;
+  resendStudentInvite(actor: Actor, input: ResendStudentInviteInput): Promise<void>;
   getBySlug(slug: string): Promise<Organization | null>;
   listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>>;
-  updateMemberRole(ctx: MemberWriteContext, id: string, role: Role): Promise<Member | null>;
-  removeMember(ctx: MemberWriteContext, id: string): Promise<boolean>;
+  updateMemberRole(ctx: MemberWriteContext, actor: Actor, id: string, role: Role): Promise<MemberRoleChange | null>;
+  removeMember(ctx: MemberWriteContext, actor: Actor, id: string): Promise<boolean>;
+  staffOrgUserIds(orgId: string): Promise<string[]>;
 }
 /** Atomic write scope: tx-bound repo + outbox appender, one transaction. */
 interface OrganizationsWriteScope {
@@ -59,31 +62,27 @@ interface OrganizationsRepository {
   findById(id: string): Promise<Organization | null>;
   findByExternalId(externalId: string): Promise<Organization | null>;
   findBySlug(slug: string): Promise<Organization | null>;
-  upsertOrgUser(orgId: string, input: AddOrgUserInput): Promise<OrgUser>;
   /** Inserts a pending invite, or re-issues the org's existing pending one
    *  for this email (fresh token/expiry/role) — atomic upsert. */
   upsertPendingInvite(orgId: string, input: NewInviteRow): Promise<Invite>;
   setInviteStatus(orgId: string, id: string, status: string): Promise<Invite | null>;
   findInviteByTokenHash(tokenHash: string): Promise<Invite | null>;
+  findPendingInvite(orgId: string, email: string): Promise<Invite | null>;
+  setInviteToken(orgId: string, id: string, tokenHash: string, expiresAt: Date): Promise<Invite | null>;
   /** The person's row in one org. `(org_id, user_id)` is unique. */
   findOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
   /** Every org this person belongs to, oldest first. */
   findOrgUsersByUser(userId: string): Promise<OrgUser[]>;
   findOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
+  findOrgUsersByIds(orgId: string, ids: string[]): Promise<OrgUser[]>;
+  findOrgUserIdsByRole(orgId: string, roles: Role[]): Promise<string[]>;
   /** Links a user to the org under a role. Throws ConflictError when they
    *  already hold a row there. */
   createOrgUser(input: CreateOrgUserInput): Promise<OrgUser>;
-  /** createOrgUser, but idempotent on `(org_id, user_id)`: an existing row is
-   *  promoted to the requested status rather than refused. `created` says
-   *  whether a row appeared, so `student.created` fires exactly once. */
-  ensureOrgUser(input: CreateOrgUserInput): Promise<{
-    orgUser: OrgUser;
-    created: boolean;
-  }>;
+  updateOrgUser(orgId: string, id: string, patch: UpdateOrgUserInput): Promise<OrgUser | null>;
   /** Every org this person is a student in — the scope of `student.linked`. */
   findStudentOrgUsers(userId: string): Promise<OrgUser[]>;
   /** Kills the org's pending invite for an address, if any. */
-  cancelPendingInvite(orgId: string, email: string): Promise<Invite | null>;
   deleteOrgUser(orgId: string, id: string): Promise<OrgUser | null>;
 }
 /** A member row enriched with the ids needed to drive writes. */

package/dist/organizations/roles.d.ts

@@ -1,23 +1,19 @@
 import { Role } from "../types/schemas/organizations.js";
 import "../types/index.js";
 //#region src/organizations/roles.d.ts
-declare const ROLES: readonly ["owner", "admin", "instructor", "student"];
-/**
- * The roles that operate the back office. `student` belongs to the org but
- * never appears on a staff surface, so the member-management types are typed
- * with this narrower union — the exclusion is a compiler guarantee, not a
- * convention a query has to remember.
- */
-type StaffRole = Exclude<Role, 'student'>;
+declare const ROLES: readonly ["owner", "admin", "instructor", "moderator", "student"];
+type StaffRole = 'owner' | 'admin' | 'instructor';
 declare const STAFF_ROLES: readonly ["owner", "admin", "instructor"];
+type TeamRole = Exclude<Role, 'student'>;
 declare function isRole(value: string): value is Role;
 declare function isStaffRole(value: string): value is StaffRole;
 declare function parseRole(value: string): Role;
-type Permission = 'manage_billing' | 'manage_org_settings' | 'manage_users' | 'create_course' | 'edit_assigned_course' | 'view_student_progress' | 'consume_content';
+type Permission = 'manage_billing' | 'manage_org_settings' | 'manage_users' | 'create_course' | 'edit_assigned_course' | 'view_student_progress' | 'moderate' | 'consume_content';
 type Capability = true | 'assigned' | 'enrolled';
 declare function capability(role: Role, permission: Permission): Capability | false;
+declare function canModerate(role: Role): boolean;
 declare function normalizeRole(raw: string): Role;
 declare const STUDENT_ROLE = "student";
 //#endregion
-export { Capability, Permission, ROLES, type Role, STAFF_ROLES, STUDENT_ROLE, StaffRole, capability, isRole, isStaffRole, normalizeRole, parseRole };
+export { Capability, Permission, ROLES, type Role, STAFF_ROLES, STUDENT_ROLE, StaffRole, TeamRole, canModerate, capability, isRole, isStaffRole, normalizeRole, parseRole };
 //# sourceMappingURL=roles.d.ts.map

package/dist/organizations/roles.js

@@ -3,6 +3,7 @@ const ROLES = [
 	"owner",
 	"admin",
 	"instructor",
+	"moderator",
 	"student"
 ];
 const STAFF_ROLES = [
@@ -27,28 +28,39 @@ const MATRIX = {
 		manage_users: true,
 		create_course: true,
 		edit_assigned_course: true,
-		view_student_progress: true
+		view_student_progress: true,
+		moderate: true
 	},
 	admin: {
 		manage_org_settings: true,
 		manage_users: true,
 		create_course: true,
 		edit_assigned_course: true,
-		view_student_progress: true
+		view_student_progress: true,
+		moderate: true
 	},
 	instructor: {
 		edit_assigned_course: "assigned",
-		view_student_progress: "assigned"
+		view_student_progress: "assigned",
+		moderate: true
+	},
+	moderator: {
+		moderate: true,
+		consume_content: "enrolled"
 	},
 	student: { consume_content: "enrolled" }
 };
 function capability(role, permission) {
 	return MATRIX[role][permission] ?? false;
 }
+function canModerate(role) {
+	return capability(role, "moderate") === true;
+}
 const RANK = {
-	owner: 3,
-	admin: 2,
-	instructor: 1,
+	owner: 4,
+	admin: 3,
+	instructor: 2,
+	moderator: 1,
 	student: 0
 };
 function normalizeRole(raw) {
@@ -65,6 +77,6 @@ function normalizeRole(raw) {
 }
 const STUDENT_ROLE = "student";
 //#endregion
-export { ROLES, STAFF_ROLES, STUDENT_ROLE, capability, isRole, isStaffRole, normalizeRole, parseRole };
+export { ROLES, STAFF_ROLES, STUDENT_ROLE, canModerate, capability, isRole, isStaffRole, normalizeRole, parseRole };
 
 //# sourceMappingURL=roles.js.map

package/dist/organizations/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","names":[],"sources":["../../src/organizations/roles.ts"],"sourcesContent":["// organizations context — roles and the authorization matrix.\n// Defined in code (no DB enum). The DB stores role as text; the domain narrows\n// it to Role and answers authorization questions here. The Role type itself is\n// owned by @headless-lms/core/types; RANK/MATRIX below are Record<Role, …>, so the\n// compiler forces this file to cover every role the published type declares.\nimport type { Role } from '../types/index.js';\n\nexport type { Role };\nexport const ROLES = [\n  'owner',\n  'admin',\n  'instructor',\n  'student',\n] as const satisfies readonly Role[];\n\n/**\n * The roles that operate the back office. `student` belongs to the org but\n * never appears on a staff surface, so the member-management types are typed\n * with this narrower union — the exclusion is a compiler guarantee, not a\n * convention a query has to remember.\n */\nexport type StaffRole = Exclude<Role, 'student'>;\nexport const STAFF_ROLES = ['owner', 'admin', 'instructor'] as const satisfies readonly StaffRole[];\n\nexport function isRole(value: string): value is Role {\n  return (ROLES as readonly string[]).includes(value);\n}\n\nexport function isStaffRole(value: string): value is StaffRole {\n  return (STAFF_ROLES as readonly string[]).includes(value);\n}\n\nexport function parseRole(value: string): Role {\n  if (!isRole(value)) {\n    throw new Error(`unknown role: ${value}`);\n  }\n  return value;\n}\n\nexport type Permission =\n  | 'manage_billing'\n  | 'manage_org_settings'\n  | 'manage_users'\n  | 'create_course'\n  | 'edit_assigned_course'\n  | 'view_student_progress'\n  | 'consume_content';\n\n// Unconditional (true), course-scoped (\"assigned\"), or enrollment-scoped\n// (\"enrolled\" — access owned by entitlements). Absent ⇒ denied.\n//\n// \"assigned\" is a granted-but-narrowed answer: the role holds the permission,\n// but only over some subset of courses. Nothing narrows it today — there is no\n// course-assignment store — so callers must decide what a narrowed grant means\n// for them. `authorize` treats it as denied; `tools.ts` treats it as granted.\nexport type Capability = true | 'assigned' | 'enrolled';\n\nconst MATRIX: Record<Role, Partial<Record<Permission, Capability>>> = {\n  owner: {\n    manage_billing: true,\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n  },\n  admin: {\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n  },\n  instructor: {\n    edit_assigned_course: 'assigned',\n    view_student_progress: 'assigned',\n  },\n  // A learner belongs to the org to consume content they hold an\n  // entitlement for. No management capability of any kind.\n  student: {\n    consume_content: 'enrolled',\n  },\n};\n\nexport function capability(role: Role, permission: Permission): Capability | false {\n  return MATRIX[role][permission] ?? false;\n}\n\n// Better Auth's role model is broader than ours: it keeps a built-in `member`\n// role and allows comma-joined multi-role strings. Normalize any incoming role\n// string to a single domain Role before persisting: `member` -> `instructor`, a\n// multi-role string -> its highest-privilege known role, unknown -> `instructor`.\nconst RANK: Record<Role, number> = { owner: 3, admin: 2, instructor: 1, student: 0 };\n\nexport function normalizeRole(raw: string): Role {\n  let best: Role = 'instructor';\n  let bestRank = -1;\n  for (const token of raw.split(',').map((t) => t.trim())) {\n    const r: Role | null = isRole(token) ? token : token === 'member' ? 'instructor' : null;\n    if (r && RANK[r] > bestRank) {\n      best = r;\n      bestRank = RANK[r];\n    }\n  }\n  return best;\n}\n\n// Invites carry either a staff Role or this marker: the invited account is\n// a portal student, not an org member. Owned by the organizations domain — the\n// invite provider adapter reuses it to branch links, emails, and grants.\nexport const STUDENT_ROLE = 'student';\n"],"mappings":";AAQA,MAAa,QAAQ;CACnB;CACA;CACA;CACA;AACF;AASA,MAAa,cAAc;CAAC;CAAS;CAAS;AAAY;AAE1D,SAAgB,OAAO,OAA8B;CACnD,OAAQ,MAA4B,SAAS,KAAK;AACpD;AAEA,SAAgB,YAAY,OAAmC;CAC7D,OAAQ,YAAkC,SAAS,KAAK;AAC1D;AAEA,SAAgB,UAAU,OAAqB;CAC7C,IAAI,CAAC,OAAO,KAAK,GACf,MAAM,IAAI,MAAM,iBAAiB,OAAO;CAE1C,OAAO;AACT;AAoBA,MAAM,SAAgE;CACpE,OAAO;EACL,gBAAgB;EAChB,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;CACzB;CACA,OAAO;EACL,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;CACzB;CACA,YAAY;EACV,sBAAsB;EACtB,uBAAuB;CACzB;CAGA,SAAS,EACP,iBAAiB,WACnB;AACF;AAEA,SAAgB,WAAW,MAAY,YAA4C;CACjF,OAAO,OAAO,KAAK,CAAC,eAAe;AACrC;AAMA,MAAM,OAA6B;CAAE,OAAO;CAAG,OAAO;CAAG,YAAY;CAAG,SAAS;AAAE;AAEnF,SAAgB,cAAc,KAAmB;CAC/C,IAAI,OAAa;CACjB,IAAI,WAAW;CACf,KAAK,MAAM,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,CAAC,GAAG;EACvD,MAAM,IAAiB,OAAO,KAAK,IAAI,QAAQ,UAAU,WAAW,eAAe;EACnF,IAAI,KAAK,KAAK,KAAK,UAAU;GAC3B,OAAO;GACP,WAAW,KAAK;EAClB;CACF;CACA,OAAO;AACT;AAKA,MAAa,eAAe"}
+{"version":3,"file":"roles.js","names":[],"sources":["../../src/organizations/roles.ts"],"sourcesContent":["// organizations context — roles and the authorization matrix.\n// Defined in code (no DB enum). The DB stores role as text; the domain narrows\n// it to Role and answers authorization questions here. The Role type itself is\n// owned by @headless-lms/core/types; RANK/MATRIX below are Record<Role, …>, so the\n// compiler forces this file to cover every role the published type declares.\nimport type { Role } from '../types/index.js';\n\nexport type { Role };\nexport const ROLES = [\n  'owner',\n  'admin',\n  'instructor',\n  'moderator',\n  'student',\n] as const satisfies readonly Role[];\n\nexport type StaffRole = 'owner' | 'admin' | 'instructor';\nexport const STAFF_ROLES = ['owner', 'admin', 'instructor'] as const satisfies readonly StaffRole[];\n\nexport type TeamRole = Exclude<Role, 'student'>;\n\nexport function isRole(value: string): value is Role {\n  return (ROLES as readonly string[]).includes(value);\n}\n\nexport function isStaffRole(value: string): value is StaffRole {\n  return (STAFF_ROLES as readonly string[]).includes(value);\n}\n\nexport function parseRole(value: string): Role {\n  if (!isRole(value)) {\n    throw new Error(`unknown role: ${value}`);\n  }\n  return value;\n}\n\nexport type Permission =\n  | 'manage_billing'\n  | 'manage_org_settings'\n  | 'manage_users'\n  | 'create_course'\n  | 'edit_assigned_course'\n  | 'view_student_progress'\n  | 'moderate'\n  | 'consume_content';\n\n// Unconditional (true), course-scoped (\"assigned\"), or enrollment-scoped\n// (\"enrolled\" — access owned by entitlements). Absent ⇒ denied.\n//\n// \"assigned\" is a granted-but-narrowed answer: the role holds the permission,\n// but only over some subset of courses. Nothing narrows it today — there is no\n// course-assignment store — so callers must decide what a narrowed grant means\n// for them. `authorize` treats it as denied; `tools.ts` treats it as granted.\nexport type Capability = true | 'assigned' | 'enrolled';\n\nconst MATRIX: Record<Role, Partial<Record<Permission, Capability>>> = {\n  owner: {\n    manage_billing: true,\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n    moderate: true,\n  },\n  admin: {\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n    moderate: true,\n  },\n  instructor: {\n    edit_assigned_course: 'assigned',\n    view_student_progress: 'assigned',\n    moderate: true,\n  },\n  moderator: {\n    moderate: true,\n    consume_content: 'enrolled',\n  },\n  student: {\n    consume_content: 'enrolled',\n  },\n};\n\nexport function capability(role: Role, permission: Permission): Capability | false {\n  return MATRIX[role][permission] ?? false;\n}\n\nexport function canModerate(role: Role): boolean {\n  return capability(role, 'moderate') === true;\n}\n\n// Better Auth's role model is broader than ours: it keeps a built-in `member`\n// role and allows comma-joined multi-role strings. Normalize any incoming role\n// string to a single domain Role before persisting: `member` -> `instructor`, a\n// multi-role string -> its highest-privilege known role, unknown -> `instructor`.\nconst RANK: Record<Role, number> = { owner: 4, admin: 3, instructor: 2, moderator: 1, student: 0 };\n\nexport function normalizeRole(raw: string): Role {\n  let best: Role = 'instructor';\n  let bestRank = -1;\n  for (const token of raw.split(',').map((t) => t.trim())) {\n    const r: Role | null = isRole(token) ? token : token === 'member' ? 'instructor' : null;\n    if (r && RANK[r] > bestRank) {\n      best = r;\n      bestRank = RANK[r];\n    }\n  }\n  return best;\n}\n\n// Invites carry either a staff Role or this marker: the invited account is\n// a portal student, not an org member. Owned by the organizations domain — the\n// invite provider adapter reuses it to branch links, emails, and grants.\nexport const STUDENT_ROLE = 'student';\n"],"mappings":";AAQA,MAAa,QAAQ;CACnB;CACA;CACA;CACA;CACA;AACF;AAGA,MAAa,cAAc;CAAC;CAAS;CAAS;AAAY;AAI1D,SAAgB,OAAO,OAA8B;CACnD,OAAQ,MAA4B,SAAS,KAAK;AACpD;AAEA,SAAgB,YAAY,OAAmC;CAC7D,OAAQ,YAAkC,SAAS,KAAK;AAC1D;AAEA,SAAgB,UAAU,OAAqB;CAC7C,IAAI,CAAC,OAAO,KAAK,GACf,MAAM,IAAI,MAAM,iBAAiB,OAAO;CAE1C,OAAO;AACT;AAqBA,MAAM,SAAgE;CACpE,OAAO;EACL,gBAAgB;EAChB,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;EACvB,UAAU;CACZ;CACA,OAAO;EACL,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;EACvB,UAAU;CACZ;CACA,YAAY;EACV,sBAAsB;EACtB,uBAAuB;EACvB,UAAU;CACZ;CACA,WAAW;EACT,UAAU;EACV,iBAAiB;CACnB;CACA,SAAS,EACP,iBAAiB,WACnB;AACF;AAEA,SAAgB,WAAW,MAAY,YAA4C;CACjF,OAAO,OAAO,KAAK,CAAC,eAAe;AACrC;AAEA,SAAgB,YAAY,MAAqB;CAC/C,OAAO,WAAW,MAAM,UAAU,MAAM;AAC1C;AAMA,MAAM,OAA6B;CAAE,OAAO;CAAG,OAAO;CAAG,YAAY;CAAG,WAAW;CAAG,SAAS;AAAE;AAEjG,SAAgB,cAAc,KAAmB;CAC/C,IAAI,OAAa;CACjB,IAAI,WAAW;CACf,KAAK,MAAM,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,CAAC,GAAG;EACvD,MAAM,IAAiB,OAAO,KAAK,IAAI,QAAQ,UAAU,WAAW,eAAe;EACnF,IAAI,KAAK,KAAK,KAAK,UAAU;GAC3B,OAAO;GACP,WAAW,KAAK;EAClB;CACF;CACA,OAAO;AACT;AAKA,MAAa,eAAe"}

package/dist/organizations/service.d.ts

@@ -1,14 +1,15 @@
 import { Logger } from "../types/ports.js";
-import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, Invite, OrgUser, Organization, Role } from "../types/schemas/organizations.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, Invite, OrgUser, Organization, Role, UpdateOrgUserInput } from "../types/schemas/organizations.js";
 import "../shared/ports.js";
-import { Mailer } from "../shared/mailer.js";
-import { IdentityService } from "../identity/ports.js";
-import "../identity/index.js";
+import { Actor } from "../shared/actor.js";
 import "./model.js";
 import "./roles.js";
-import { Member, MembersQuery, Page } from "./members.js";
-import { CreateOrganizationInput, ResendStudentInviteInput, UpdateOrganizationInput, UpdateStudentInput } from "./types.js";
-import { MemberWriteContext, MembersRepository, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork } from "./ports.js";
+import { Member, MemberRoleChange, MembersQuery, Page } from "./members.js";
+import { CreateOrganizationInput, ResendStudentInviteInput, UpdateOrganizationInput } from "./types.js";
+import { IdentityService } from "../identity/ports.js";
+import { Mailer } from "../shared/mailer.js";
+import "../identity/index.js";
+import { MemberWriteContext, MembersRepository, OrgAdmin, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork } from "./ports.js";
 //#region src/organizations/service.d.ts
 interface InviteUrls {
   studentPortalUrl: string;
@@ -19,6 +20,7 @@ type OrganizationServiceParams = {
   membersRepo: MembersRepository;
   people: IdentityService;
   uow: OrganizationsUnitOfWork;
+  orgAdmin: () => OrgAdmin;
   logger?: Logger;
   mailer?: Pick<Mailer, 'send'>;
   inviteUrls?: InviteUrls;
@@ -28,30 +30,42 @@ declare class OrganizationServiceImpl implements OrganizationService {
   private readonly membersRepo;
   private readonly people;
   private readonly uow;
+  private readonly orgAdmin;
   private readonly logger;
   private readonly mailer?;
   private readonly inviteUrls?;
+  private readonly memberWrites;
   constructor(params: OrganizationServiceParams);
   createOrganization(input: CreateOrganizationInput): Promise<Organization>;
   updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization>;
   deleteOrganization(id: string): Promise<Organization>;
   addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser>;
-  removeOrgUser(orgId: string, id: string): Promise<OrgUser>;
-  createInvite(input: CreateInviteInput): Promise<Invite>;
-  updateStudent(input: UpdateStudentInput): Promise<OrgUser>;
-  resendStudentInvite(input: ResendStudentInviteInput): Promise<void>;
+  removeOrgUser(orgId: string, userId: string): Promise<OrgUser>;
+  updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser>;
+  createInvite(actor: Actor, input: CreateInviteInput): Promise<Invite>;
+  resendStudentInvite(actor: Actor, input: ResendStudentInviteInput): Promise<void>;
   peekInvite(token: string): Promise<Invite | null>;
   acceptInvite(input: AcceptInviteInput): Promise<OrgUser>;
+  private acceptStudentInvite;
+  private acceptStaffInvite;
+  getOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
   getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
-  deleteOrgUser(orgId: string, id: string): Promise<OrgUser>;
+  deleteOrgUser(orgId: string, actor: Actor, id: string): Promise<OrgUser>;
   getOrgUsersForUser(userId: string): Promise<OrgUser[]>;
   getById(id: string): Promise<Organization | null>;
   private sendInviteEmail;
   getByExternalId(externalId: string): Promise<Organization | null>;
   getBySlug(slug: string): Promise<Organization | null>;
+  staffOrgUserIds(orgId: string): Promise<string[]>;
   listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>>;
-  updateMemberRole(ctx: MemberWriteContext, id: string, role: Role): Promise<Member | null>;
-  removeMember(_ctx: MemberWriteContext, _id: string): Promise<boolean>;
+  updateMemberRole(ctx: MemberWriteContext, actor: Actor, id: string, role: Role): Promise<MemberRoleChange | null>;
+  private demoteModerator;
+  private promoteStudent;
+  private asActor;
+  private memberWrite;
+  private assertManagesUsers;
+  private assertNotOwner;
+  removeMember(ctx: MemberWriteContext, actor: Actor, id: string): Promise<boolean>;
 }
 //#endregion
 export { InviteUrls, OrganizationServiceImpl, OrganizationServiceParams };