@headless-lms/core 0.1.0 → 0.3.0

package/dist/organizations/service.js

@@ -1,10 +1,11 @@
 import { genId } from "../shared/id.js";
+import { ForbiddenError, NotFoundError } from "../shared/errors.js";
 import { noopLogger } from "../shared/logger.js";
-import { NotFoundError } from "../shared/errors.js";
-import { STUDENT_ROLE } from "./roles.js";
+import { STAFF_ROLES, STUDENT_ROLE, capability } from "./roles.js";
 import { InviteError, OrganizationRuleError } from "./members.js";
 import { organizationEvents } from "./events.js";
 import { generateInviteToken, hashInviteToken } from "../shared/invite-token.js";
+import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/organizations/service.ts
 const INVITE_TTL_MS = 10080 * 60 * 1e3;
 function toMember(r) {
@@ -25,14 +26,17 @@ var OrganizationServiceImpl = class {
 	membersRepo;
 	people;
 	uow;
+	orgAdmin;
 	logger;
 	mailer;
 	inviteUrls;
+	memberWrites = new AsyncLocalStorage();
 	constructor(params) {
 		this.repo = params.repo;
 		this.membersRepo = params.membersRepo;
 		this.people = params.people;
 		this.uow = params.uow;
+		this.orgAdmin = params.orgAdmin;
 		this.logger = params.logger ?? noopLogger;
 		this.mailer = params.mailer;
 		this.inviteUrls = params.inviteUrls;
@@ -88,6 +92,10 @@ var OrganizationServiceImpl = class {
 		return deleted;
 	}
 	async addOrgUser({ orgId, userId, role }) {
+		if (await this.repo.findOrgUser(orgId, userId)) return this.updateOrgUser(orgId, userId, {
+			role,
+			status: "active"
+		});
 		const orgUser = await this.uow.run(async ({ organizations, outbox }) => {
 			const created = await organizations.createOrgUser({
 				orgId,
@@ -108,57 +116,111 @@ var OrganizationServiceImpl = class {
 		});
 		return orgUser;
 	}
-	async removeOrgUser(orgId, id) {
+	async removeOrgUser(orgId, userId) {
 		const deleted = await this.uow.run(async ({ organizations, outbox }) => {
-			const deletedUser = await organizations.deleteOrgUser(orgId, id);
-			if (!deletedUser) throw new NotFoundError("OrgUser", id);
+			const orgUser = await organizations.findOrgUser(orgId, userId);
+			if (!orgUser) throw new NotFoundError("Member", userId);
+			const write = this.memberWrite(orgUser.id);
+			if (write?.demote) {
+				const demoted = await organizations.updateOrgUser(orgId, orgUser.id, { role: STUDENT_ROLE });
+				if (!demoted) throw new NotFoundError("Member", orgUser.id);
+				if (orgUser.role !== "student") await outbox.append([organizationEvents.orgUserUpdated.make({
+					orgId,
+					data: demoted,
+					metadata: { actorOrgUserId: write.actorOrgUserId }
+				})]);
+				return demoted;
+			}
+			if (orgUser.role === "student") return orgUser;
+			const deletedUser = await organizations.deleteOrgUser(orgId, orgUser.id);
+			if (!deletedUser) throw new NotFoundError("Member", orgUser.id);
 			await outbox.append([organizationEvents.orgUserDeleted.make({
 				orgId,
 				data: deletedUser
 			})]);
 			return deletedUser;
 		});
-		this.logger.info("organization deleted", { orgId: deleted.id });
+		this.logger.info("org user removed", {
+			orgId,
+			userId,
+			orgUserId: deleted.id
+		});
 		return deleted;
 	}
-	async createInvite(input) {
+	async updateOrgUser(orgId, userId, patch) {
+		const updated = await this.uow.run(async ({ organizations, outbox }) => {
+			const orgUser = await organizations.findOrgUser(orgId, userId);
+			if (!orgUser) throw new NotFoundError("Member", userId);
+			const next = await organizations.updateOrgUser(orgId, orgUser.id, patch);
+			if (!next) throw new NotFoundError("Member", orgUser.id);
+			if (patch.role !== void 0 && patch.role !== orgUser.role) {
+				const actorOrgUserId = this.memberWrite(orgUser.id)?.actorOrgUserId;
+				await outbox.append([organizationEvents.orgUserUpdated.make({
+					orgId,
+					data: next,
+					...actorOrgUserId !== void 0 && { metadata: { actorOrgUserId } }
+				})]);
+			}
+			return next;
+		});
+		this.logger.info("org user updated", {
+			orgId,
+			userId,
+			orgUserId: updated.id,
+			patch
+		});
+		return updated;
+	}
+	async createInvite(actor, input) {
 		const { orgId, email, role, inviterUserId, firstName, lastName } = input;
+		this.assertManagesUsers(actor, orgId);
+		this.assertNotOwner(role, orgId);
 		const sendEmail = input.sendEmail ?? true;
 		const { token, tokenHash } = generateInviteToken();
 		const expiresAt = new Date(Date.now() + INVITE_TTL_MS);
-		const person = role === "student" ? await this.people.createUser({
+		const person = role === "student" ? await this.people.getUserByEmail(email) ?? await this.people.createUser({
 			email,
 			...firstName !== void 0 && { firstName },
 			...lastName !== void 0 && { lastName }
 		}) : null;
 		const invite = await this.uow.run(async ({ organizations, outbox }) => {
-			const row = await organizations.upsertPendingInvite(orgId, {
-				email,
-				role,
-				invitedBy: inviterUserId,
-				tokenHash,
-				expiresAt
-			});
-			const events = [organizationEvents.inviteCreated.make({
-				orgId,
-				data: row
-			})];
+			const events = [];
 			if (person) {
-				const { orgUser, created } = await organizations.ensureOrgUser({
+				const orgUser = await organizations.createOrgUser({
 					orgId,
 					userId: person.id,
 					role: STUDENT_ROLE,
 					status: "invited"
 				});
-				if (created) events.push(organizationEvents.studentCreated.make({
+				events.push(organizationEvents.studentCreated.make({
 					orgId,
 					data: orgUser
 				}));
 			}
+			const row = await organizations.upsertPendingInvite(orgId, {
+				email,
+				role,
+				invitedBy: inviterUserId,
+				tokenHash,
+				expiresAt
+			});
+			events.push(organizationEvents.inviteCreated.make({
+				orgId,
+				data: row
+			}));
 			await outbox.append(events);
 			return row;
 		});
-		if (sendEmail) await this.sendInviteEmail(invite, token);
+		if (sendEmail) try {
+			await this.sendInviteEmail(invite, token);
+		} catch (err) {
+			this.logger.error("failed to send invite email", {
+				orgId,
+				inviteId: invite.id,
+				role: invite.role,
+				err: err instanceof Error ? err : new Error(String(err))
+			});
+		}
 		this.logger.info("invite created", {
 			orgId,
 			inviteId: invite.id,
@@ -167,44 +229,26 @@ var OrganizationServiceImpl = class {
 		});
 		return invite;
 	}
-	async updateStudent(input) {
-		const { orgId, orgUserId, firstName, lastName, email } = input;
-		const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);
-		if (!orgUser || orgUser.role !== "student") throw new NotFoundError("Student", orgUserId);
-		const person = await this.people.getUserById(orgUser.userId);
-		if (!person) throw new NotFoundError("User", orgUser.userId);
-		const previousEmail = person.email;
-		await this.people.updateUser(person.id, {
-			...firstName !== void 0 && { firstName },
-			...lastName !== void 0 && { lastName },
-			...email !== void 0 && { email }
-		});
-		const emailChanged = email !== void 0 && email.toLowerCase() !== previousEmail.toLowerCase();
-		if (emailChanged && orgUser.status !== "active") await this.repo.cancelPendingInvite(orgId, previousEmail);
-		this.logger.info("student updated", {
-			orgId,
-			orgUserId,
-			emailChanged
-		});
-		return orgUser;
-	}
-	async resendStudentInvite(input) {
+	async resendStudentInvite(actor, input) {
 		const { orgId, orgUserId, inviterUserId } = input;
+		this.assertManagesUsers(actor, orgId);
 		const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);
 		if (!orgUser || orgUser.role !== "student") throw new NotFoundError("Student", orgUserId);
 		if (orgUser.status === "active") throw new OrganizationRuleError("That student has already accepted their invitation");
 		const person = await this.people.getUserById(orgUser.userId);
 		if (!person) throw new NotFoundError("User", orgUser.userId);
-		await this.createInvite({
-			orgId,
-			email: person.email,
-			role: STUDENT_ROLE,
-			inviterUserId,
-			sendEmail: true
-		});
+		const pending = await this.repo.findPendingInvite(orgId, person.email);
+		if (!pending) throw new NotFoundError("Invite", person.email);
+		const { token, tokenHash } = generateInviteToken();
+		const expiresAt = new Date(Date.now() + INVITE_TTL_MS);
+		const invite = await this.repo.setInviteToken(orgId, pending.id, tokenHash, expiresAt);
+		if (!invite) throw new NotFoundError("Invite", pending.id);
+		await this.sendInviteEmail(invite, token);
 		this.logger.info("student invite resent", {
 			orgId,
-			orgUserId
+			orgUserId,
+			inviteId: invite.id,
+			inviterUserId
 		});
 	}
 	async peekInvite(token) {
@@ -226,55 +270,66 @@ var OrganizationServiceImpl = class {
 			});
 			throw new InviteError("emails must match");
 		}
-		if (!await this.repo.findById(invite.orgId)) throw new InviteError("Org not found");
-		const orgUser = await this.uow.run(async ({ organizations, outbox }) => {
-			const { orgUser: row, created } = await organizations.ensureOrgUser({
-				orgId: invite.orgId,
-				userId: input.userId,
-				role: invite.role,
-				status: "active"
-			});
+		const org = await this.repo.findById(invite.orgId);
+		if (!org) throw new InviteError("Org not found");
+		const orgUser = invite.role === "student" ? await this.acceptStudentInvite(invite, input.userId) : await this.acceptStaffInvite(invite, org, input.userId);
+		this.logger.info("invite accepted", {
+			orgId: invite.orgId,
+			userId: input.userId
+		});
+		return orgUser;
+	}
+	async acceptStudentInvite(invite, userId) {
+		return this.uow.run(async ({ organizations, outbox }) => {
+			const existing = await organizations.findOrgUser(invite.orgId, userId);
+			if (!existing) throw new NotFoundError("Member", userId);
+			const activated = await organizations.updateOrgUser(invite.orgId, existing.id, { status: "active" });
+			if (!activated) throw new NotFoundError("Member", existing.id);
 			const acceptedInvite = await organizations.setInviteStatus(invite.orgId, invite.id, "accepted");
 			if (!acceptedInvite) throw new NotFoundError("Invite", invite.id);
-			const events = [organizationEvents.inviteAccepted.make({
+			await outbox.append([organizationEvents.inviteAccepted.make({
 				orgId: invite.orgId,
 				data: acceptedInvite
-			})];
-			if (row.role === "student") events.push(created ? organizationEvents.studentCreated.make({
+			}), organizationEvents.studentLinked.make({
 				orgId: invite.orgId,
-				data: row
-			}) : organizationEvents.studentLinked.make({
-				orgId: invite.orgId,
-				data: row
-			}));
-			else if (created) events.push(organizationEvents.orgUserLinked.make({
-				orgId: invite.orgId,
-				data: row
-			}));
-			await outbox.append(events);
-			return row;
+				data: activated
+			})]);
+			return activated;
 		});
-		this.logger.info("invite accepted", {
-			orgId: invite.orgId,
-			userId: input.userId
+	}
+	async acceptStaffInvite(invite, org, userId) {
+		const person = await this.people.getUserById(userId);
+		if (!person?.externalId) throw new NotFoundError("User", userId);
+		await this.orgAdmin().grantMembership(org.externalId ?? org.id, person.externalId, invite.role);
+		return this.uow.run(async ({ organizations, outbox }) => {
+			const orgUser = await organizations.findOrgUser(invite.orgId, userId);
+			if (!orgUser) throw new NotFoundError("Member", userId);
+			const acceptedInvite = await organizations.setInviteStatus(invite.orgId, invite.id, "accepted");
+			if (!acceptedInvite) throw new NotFoundError("Invite", invite.id);
+			await outbox.append([organizationEvents.inviteAccepted.make({
+				orgId: invite.orgId,
+				data: acceptedInvite
+			})]);
+			return orgUser;
 		});
-		return orgUser;
+	}
+	getOrgUserById(orgId, id) {
+		return this.repo.findOrgUserById(orgId, id);
 	}
 	async getOrgUser(orgId, userId) {
 		return this.repo.findOrgUser(orgId, userId);
 	}
-	async deleteOrgUser(orgId, id) {
+	async deleteOrgUser(orgId, actor, id) {
+		this.assertManagesUsers(actor, orgId);
 		const deleted = await this.uow.run(async ({ organizations, outbox }) => {
 			const orgUser = await organizations.findOrgUserById(orgId, id);
-			if (!orgUser) throw new NotFoundError("OrgUser", id);
+			if (!orgUser || orgUser.role !== "student") throw new NotFoundError("Student", id);
 			const deletedUser = await organizations.deleteOrgUser(orgId, id);
-			if (!deletedUser) throw new NotFoundError("OrgUser", id);
-			const events = [];
-			if (deletedUser.role === "student") events.push(organizationEvents.studentDeleted.make({
+			if (!deletedUser) throw new NotFoundError("Student", id);
+			await outbox.append([organizationEvents.studentDeleted.make({
 				orgId,
 				data: orgUser
-			}));
-			await outbox.append(events);
+			})]);
 			return deletedUser;
 		});
 		this.logger.info("org user deleted", {
@@ -297,23 +352,15 @@ var OrganizationServiceImpl = class {
 			token,
 			email
 		})).toString()}`;
-		try {
-			if (role === "student") await this.mailer.send(email, "studentInvite", {
-				inviteUrl,
-				studentName: email
-			});
-			else await this.mailer.send(email, "memberInvite", {
-				inviteUrl,
-				inviterName: "Your team",
-				role
-			});
-		} catch (err) {
-			this.logger.error("failed to send invite email", {
-				email,
-				role,
-				err: err instanceof Error ? err : new Error(String(err))
-			});
-		}
+		if (role === "student") await this.mailer.send(email, "studentInvite", {
+			inviteUrl,
+			studentName: email
+		});
+		else await this.mailer.send(email, "memberInvite", {
+			inviteUrl,
+			inviterName: "Your team",
+			role
+		});
 	}
 	async getByExternalId(externalId) {
 		return this.repo.findByExternalId(externalId);
@@ -321,12 +368,17 @@ var OrganizationServiceImpl = class {
 	async getBySlug(slug) {
 		return this.repo.findBySlug(slug);
 	}
+	staffOrgUserIds(orgId) {
+		return this.repo.findOrgUserIdsByRole(orgId, [...STAFF_ROLES]);
+	}
 	listMembers(orgId, query) {
 		return this.membersRepo.list(orgId, query);
 	}
-	async updateMemberRole(ctx, id, role) {
+	async updateMemberRole(ctx, actor, id, role) {
+		this.assertManagesUsers(actor, ctx.orgId);
+		this.assertNotOwner(role, ctx.orgId);
 		const member = await this.membersRepo.findById(ctx.orgId, id);
-		if (!member) return null;
+		if (!member) return this.promoteStudent(ctx, actor, id, role);
 		if (member.role === "owner") {
 			this.logger.warn("role change rejected: owner role immutable", {
 				orgId: ctx.orgId,
@@ -341,6 +393,9 @@ var OrganizationServiceImpl = class {
 			});
 			throw new OrganizationRuleError("Only active members can have their role changed");
 		}
+		if (role === "student") return this.demoteModerator(ctx, actor, member, member.userExternalId);
+		const userExternalId = member.userExternalId;
+		await this.asActor(actor, id, false, () => this.orgAdmin().updateRole(ctx, userExternalId, role));
 		const updated = await this.membersRepo.findById(ctx.orgId, id);
 		this.logger.info("member role updated", {
 			orgId: ctx.orgId,
@@ -349,7 +404,121 @@ var OrganizationServiceImpl = class {
 		});
 		return updated ? toMember(updated) : null;
 	}
-	async removeMember(_ctx, _id) {
+	async demoteModerator(ctx, actor, member, userExternalId) {
+		if (member.role !== "moderator") {
+			this.logger.warn("role change rejected: only a moderator becomes a student", {
+				orgId: ctx.orgId,
+				memberId: member.id
+			});
+			throw new OrganizationRuleError("Only a moderator can be made a student");
+		}
+		await this.asActor(actor, member.id, true, () => this.orgAdmin().removeMember(ctx, userExternalId));
+		const orgUser = await this.repo.findOrgUserById(ctx.orgId, member.id);
+		if (!orgUser) return null;
+		this.logger.info("moderator made a student", {
+			orgId: ctx.orgId,
+			memberId: member.id
+		});
+		return {
+			...toMember(member),
+			role: orgUser.role,
+			status: orgUser.status
+		};
+	}
+	async promoteStudent(ctx, actor, id, role) {
+		const orgUser = await this.repo.findOrgUserById(ctx.orgId, id);
+		if (!orgUser) return null;
+		if (orgUser.role !== "student" || role === "student") {
+			this.logger.warn("role change rejected: not an active member", {
+				orgId: ctx.orgId,
+				memberId: id
+			});
+			throw new OrganizationRuleError("Only active members can have their role changed");
+		}
+		const person = await this.people.getUserById(orgUser.userId);
+		if (!person?.externalId) {
+			this.logger.warn("role change rejected: student has no account", {
+				orgId: ctx.orgId,
+				memberId: id
+			});
+			throw new OrganizationRuleError("That student has not joined yet");
+		}
+		const org = await this.repo.findById(ctx.orgId);
+		if (!org) return null;
+		const orgExternalId = org.externalId ?? org.id;
+		const userExternalId = person.externalId;
+		await this.asActor(actor, orgUser.id, false, async () => {
+			await this.orgAdmin().grantMembership(orgExternalId, userExternalId, role);
+			if (!await this.membersRepo.findById(ctx.orgId, id)) await this.orgAdmin().updateRole(ctx, userExternalId, role);
+		});
+		const updated = await this.membersRepo.findById(ctx.orgId, id);
+		if (!updated) {
+			this.logger.warn("role change rejected: membership not mirrored", {
+				orgId: ctx.orgId,
+				memberId: id
+			});
+			throw new OrganizationRuleError("The role change did not take effect");
+		}
+		this.logger.info("student promoted", {
+			orgId: ctx.orgId,
+			memberId: id,
+			role
+		});
+		return toMember(updated);
+	}
+	asActor(actor, orgUserId, demote, write) {
+		return this.memberWrites.run({
+			orgUserId,
+			actorOrgUserId: actor.id,
+			demote
+		}, write);
+	}
+	memberWrite(orgUserId) {
+		const write = this.memberWrites.getStore();
+		return write?.orgUserId === orgUserId ? write : void 0;
+	}
+	assertManagesUsers(actor, orgId) {
+		if (capability(actor.role, "manage_users") !== true) {
+			this.logger.warn("member write rejected: actor cannot manage users", {
+				orgId,
+				actorOrgUserId: actor.id
+			});
+			throw new ForbiddenError("Only an owner or admin can manage members");
+		}
+	}
+	assertNotOwner(role, orgId) {
+		if (role === "owner") {
+			this.logger.warn("member write rejected: owner cannot be granted", { orgId });
+			throw new OrganizationRuleError("Ownership cannot be granted");
+		}
+	}
+	async removeMember(ctx, actor, id) {
+		this.assertManagesUsers(actor, ctx.orgId);
+		const member = await this.membersRepo.findById(ctx.orgId, id);
+		if (!member) return false;
+		if (member.role === "owner") {
+			this.logger.warn("member removal rejected: owner cannot be removed", {
+				orgId: ctx.orgId,
+				memberId: id
+			});
+			throw new OrganizationRuleError("The owner cannot be removed");
+		}
+		if (member.kind === "member" && member.userExternalId) await this.orgAdmin().removeMember(ctx, member.userExternalId);
+		else if (member.kind === "invite" && member.inviteId) {
+			const inviteId = member.inviteId;
+			await this.uow.run(async ({ organizations, outbox }) => {
+				const canceled = await organizations.setInviteStatus(ctx.orgId, inviteId, "canceled");
+				if (!canceled) throw new NotFoundError("Invite", inviteId);
+				await outbox.append([organizationEvents.inviteCanceled.make({
+					orgId: ctx.orgId,
+					data: canceled
+				})]);
+			});
+		}
+		this.logger.info("member removed", {
+			orgId: ctx.orgId,
+			memberId: id
+		});
 		return true;
 	}
 };

package/dist/organizations/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../src/organizations/service.ts"],"sourcesContent":["// organizations context — service implementation (inbound port).\nimport type {\n  MemberRecord,\n  MembersRepository,\n  MemberWriteContext,\n  OrganizationService,\n  OrganizationsRepository,\n  OrganizationsUnitOfWork,\n} from './ports.js';\nimport type { Invite, Organization, OrgUser } from './model.js';\nimport { type Role, STUDENT_ROLE } from './roles.js';\nimport {\n  InviteError,\n  type Member,\n  type MembersQuery,\n  OrganizationRuleError,\n  type Page,\n} from './members.js';\nimport type {\n  AcceptInviteInput,\n  AddOrgUserInput,\n  CreateInviteInput,\n  CreateOrganizationInput,\n  ResendStudentInviteInput,\n  UpdateOrganizationInput,\n  UpdateStudentInput,\n} from './types.js';\nimport { organizationEvents, type OrganizationEvent } from './events.js';\nimport type { Logger, NewDomainEvent } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport { generateInviteToken, hashInviteToken } from '../shared/invite-token.js';\nimport { NotFoundError } from '../shared/errors.js';\nimport type { IdentityService } from '../identity/index.js';\nimport { genId } from '../shared/id.js';\n\nconst INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ntype NewOrganizationEvent = NewDomainEvent<OrganizationEvent>;\n\nexport interface InviteUrls {\n  studentPortalUrl: string;\n  adminAppUrl: string;\n}\n\nfunction toMember(r: MemberRecord): Member {\n  return {\n    id: r.id,\n    firstName: r.firstName,\n    lastName: r.lastName,\n    email: r.email,\n    image: r.image,\n    role: r.role,\n    status: r.status,\n    joinedAt: r.joinedAt,\n    invitedAt: r.invitedAt,\n  };\n}\n\nexport type OrganizationServiceParams = {\n  repo: OrganizationsRepository;\n  membersRepo: MembersRepository;\n  people: IdentityService;\n  uow: OrganizationsUnitOfWork;\n  logger?: Logger;\n  mailer?: Pick<Mailer, 'send'>;\n  inviteUrls?: InviteUrls;\n};\n\nexport class OrganizationServiceImpl implements OrganizationService {\n  private readonly repo: OrganizationsRepository;\n  private readonly membersRepo: MembersRepository;\n  private readonly people: IdentityService;\n  private readonly uow: OrganizationsUnitOfWork;\n  private readonly logger: Logger;\n  private readonly mailer?: Pick<Mailer, 'send'>;\n  private readonly inviteUrls?: InviteUrls;\n\n  constructor(params: OrganizationServiceParams) {\n    this.repo = params.repo;\n    this.membersRepo = params.membersRepo;\n    this.people = params.people;\n    this.uow = params.uow;\n    this.logger = params.logger ?? noopLogger;\n    this.mailer = params.mailer;\n    this.inviteUrls = params.inviteUrls;\n  }\n\n  async createOrganization(input: CreateOrganizationInput): Promise<Organization> {\n    const created = await this.uow.run(async ({ organizations, outbox }) => {\n      const id = genId('organization');\n\n      const created = await organizations.create({\n        id,\n        // The auth provider adopts this id for its own org row, so the org is\n        // its own external id — a lookup by either id lands on the same row.\n        externalId: input.externalId ?? id,\n        name: input.name ?? `My Org`,\n        slug: input.slug ?? '',\n        ownerId: input.ownerId,\n      });\n      await outbox.append([\n        organizationEvents.organizationCreated.make({\n          orgId: created.id,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('organization created', { orgId: created.id, slug: created.slug });\n    return created;\n  }\n\n  async updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization> {\n    const updatedOrg = await this.uow.run(async ({ organizations, outbox }) => {\n      const updated = await organizations.update(id, {\n        name: input.name,\n        slug: input.slug,\n      });\n      if (!updated) {\n        throw new NotFoundError('Organization', id);\n      }\n      await outbox.append([\n        organizationEvents.organizationUpdated.make({ orgId: id, data: updated }),\n      ]);\n      return updated;\n    });\n\n    this.logger.info('organization updated', { updatedOrg });\n    return updatedOrg!;\n  }\n\n  async deleteOrganization(id: string): Promise<Organization> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const deleted = await organizations.delete(id);\n\n      await outbox.append([\n        organizationEvents.organizationDeleted.make({\n          orgId: deleted.id,\n          data: deleted,\n        }),\n      ]);\n      return deleted;\n    });\n    this.logger.info('organization deleted', { orgId: deleted.id });\n    return deleted;\n  }\n\n  async addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser> {\n    const orgUser = await this.uow.run(async ({ organizations, outbox }) => {\n      const created = await organizations.createOrgUser({ orgId, role, userId, status: 'active' });\n      await outbox.append([\n        organizationEvents.orgUserLinked.make({ orgId, data: created }),\n      ]);\n      return created;\n    });\n    this.logger.info('user added to organization', { orgId, userId, role });\n    return orgUser;\n  }\n\n  async removeOrgUser(orgId: string, id: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const deletedUser = await organizations.deleteOrgUser(orgId, id);\n      if (!deletedUser) {\n        throw new NotFoundError('OrgUser', id);\n      }\n      await outbox.append([\n        organizationEvents.orgUserDeleted.make({\n          orgId,\n          data: deletedUser,\n        }),\n      ]);\n      return deletedUser;\n    });\n    this.logger.info('organization deleted', { orgId: deleted.id });\n    return deleted;\n  }\n\n  async createInvite(input: CreateInviteInput): Promise<Invite> {\n    const { orgId, email, role, inviterUserId, firstName, lastName } = input;\n    const sendEmail = input.sendEmail ?? true;\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n\n    // A student belongs to the org from the moment an admin adds them, not from\n    // the moment they click a link — so the person exists before the invite\n    // does. Staff are excluded: their org_users row is mirrored from the auth\n    // provider's member record, which does not exist until they join.\n    const person =\n      role === STUDENT_ROLE\n        ? await this.people.createUser({\n            email,\n            ...(firstName !== undefined && { firstName }),\n            ...(lastName !== undefined && { lastName }),\n          })\n        : null;\n\n    const invite = await this.uow.run(async ({ organizations, outbox }) => {\n      const row = await organizations.upsertPendingInvite(orgId, {\n        email,\n        role,\n        invitedBy: inviterUserId,\n        tokenHash,\n        expiresAt,\n      });\n      const events: NewOrganizationEvent[] = [\n        organizationEvents.inviteCreated.make({ orgId, data: row }),\n      ];\n      if (person) {\n        // Idempotent: re-inviting an address rotates the token without\n        // producing a second org user or a second student.created.\n        const { orgUser, created } = await organizations.ensureOrgUser({\n          orgId,\n          userId: person.id,\n          role: STUDENT_ROLE,\n          status: 'invited',\n        });\n        if (created) {\n          events.push(\n            organizationEvents.studentCreated.make({ orgId, data: orgUser }),\n          );\n        }\n      }\n      await outbox.append(events);\n      return row;\n    });\n\n    if (sendEmail) {\n      // TODO make this workflow durable\n      await this.sendInviteEmail(invite, token);\n    }\n\n    this.logger.info('invite created', { orgId, inviteId: invite.id, role, sendEmail });\n    return invite;\n  }\n\n  async updateStudent(input: UpdateStudentInput): Promise<OrgUser> {\n    const { orgId, orgUserId, firstName, lastName, email } = input;\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n\n    const previousEmail = person.email;\n    await this.people.updateUser(person.id, {\n      ...(firstName !== undefined && { firstName }),\n      ...(lastName !== undefined && { lastName }),\n      ...(email !== undefined && { email }),\n    });\n\n    // The pending invite carries its own copy of the address and a token minted\n    // against it. Once the address is corrected that invite points at the wrong\n    // person, so it is cancelled rather than left live — the admin re-sends,\n    // which mints a fresh one for the new address. A student who has already\n    // accepted has no pending invite to worry about.\n    const emailChanged = email !== undefined && email.toLowerCase() !== previousEmail.toLowerCase();\n    if (emailChanged && orgUser.status !== 'active') {\n      await this.repo.cancelPendingInvite(orgId, previousEmail);\n    }\n\n    this.logger.info('student updated', { orgId, orgUserId, emailChanged });\n    return orgUser;\n  }\n\n  async resendStudentInvite(input: ResendStudentInviteInput): Promise<void> {\n    const { orgId, orgUserId, inviterUserId } = input;\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    if (orgUser.status === 'active') {\n      throw new OrganizationRuleError('That student has already accepted their invitation');\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n    // Straight back through createInvite: it rotates the token on the pending\n    // row and finds the existing org user, so a resend is an invite that\n    // happens to be the second one.\n    await this.createInvite({\n      orgId,\n      email: person.email,\n      role: STUDENT_ROLE,\n      inviterUserId,\n      sendEmail: true,\n    });\n    this.logger.info('student invite resent', { orgId, orgUserId });\n  }\n\n  async peekInvite(token: string): Promise<Invite | null> {\n    const invite = await this.repo.findInviteByTokenHash(hashInviteToken(token));\n    if (!invite || invite.status !== 'pending') {\n      return null;\n    }\n    if (invite.expiresAt && invite.expiresAt < new Date()) {\n      return null;\n    }\n    return invite;\n  }\n\n  async acceptInvite(input: AcceptInviteInput): Promise<OrgUser> {\n    const invite = await this.peekInvite(input.token);\n    if (!invite) {\n      this.logger.warn('invite accept refused: token invalid or expired');\n      throw new InviteError('invalid invite');\n    }\n    if (invite.email.toLowerCase() !== input.email.toLowerCase()) {\n      this.logger.warn('invite accept refused: email mismatch', {\n        orgId: invite.orgId,\n        inviteId: invite.id,\n      });\n      throw new InviteError('emails must match');\n    }\n    const org = await this.repo.findById(invite.orgId);\n    if (!org) {\n      throw new InviteError('Org not found');\n    }\n\n    const orgUser = await this.uow.run(async ({ organizations, outbox }) => {\n      // A student provisioned at invite time already has a row — acceptance\n      // activates it. Staff have none yet, so this inserts one.\n      const { orgUser: row, created } = await organizations.ensureOrgUser({\n        orgId: invite.orgId,\n        userId: input.userId,\n        role: invite.role,\n        status: 'active',\n      });\n      const acceptedInvite = await organizations.setInviteStatus(invite.orgId, invite.id, 'accepted');\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      const events: NewOrganizationEvent[] = [\n        organizationEvents.inviteAccepted.make({\n          orgId: invite.orgId,\n          data: acceptedInvite,\n        }),\n      ];\n      if (row.role === STUDENT_ROLE) {\n        events.push(\n          created\n            ? organizationEvents.studentCreated.make({\n                orgId: invite.orgId,\n                data: row,\n              })\n            : organizationEvents.studentLinked.make({\n                orgId: invite.orgId,\n                data: row,\n              }),\n        );\n      } else if (created) {\n        events.push(\n          organizationEvents.orgUserLinked.make({\n            orgId: invite.orgId,\n            data: row,\n          }),\n        );\n      }\n      await outbox.append(events);\n      return row;\n    });\n    this.logger.info('invite accepted', { orgId: invite.orgId, userId: input.userId });\n    return orgUser;\n  }\n\n  // By identity USER id — `(org_id, user_id)` is unique. Every caller (scope\n  // resolution, the MCP principal, the learn routes) asks \"what is this person\n  // in this org\", never \"what is this org_users row\".\n  async getOrgUser(orgId: string, userId: string): Promise<OrgUser | null> {\n    return this.repo.findOrgUser(orgId, userId);\n  }\n\n  async deleteOrgUser(orgId: string, id: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUserById(orgId, id);\n      if (!orgUser) {\n        throw new NotFoundError('OrgUser', id);\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, id);\n      if (!deletedUser) {\n        throw new NotFoundError('OrgUser', id);\n      }\n      const events: NewOrganizationEvent[] = [];\n      if (deletedUser.role === STUDENT_ROLE) {\n        events.push(\n          organizationEvents.studentDeleted.make({ orgId, data: orgUser }),\n        );\n      }\n\n      await outbox.append(events);\n      return deletedUser;\n    });\n    this.logger.info('org user deleted', { orgId, orgUserId: id });\n    return deleted;\n  }\n\n  async getOrgUsersForUser(userId: string): Promise<OrgUser[]> {\n    return this.repo.findOrgUsersByUser(userId);\n  }\n\n  async getById(id: string): Promise<Organization | null> {\n    return this.repo.findById(id);\n  }\n\n  private async sendInviteEmail(invite: Invite, token: string): Promise<void> {\n    if (!this.mailer || !this.inviteUrls) {\n      throw new Error('invite delivery is not configured (mailer / invite urls missing)');\n    }\n    const { email, role } = invite;\n    const isStudent = role === STUDENT_ROLE;\n    const base = isStudent\n      ? `${this.inviteUrls.studentPortalUrl}/welcome`\n      : `${this.inviteUrls.adminAppUrl}/invite`;\n    // The portal resolves the token to the invited email, so the link carries\n    // only the token. The admin app still reads it from the query.\n    const query = isStudent\n      ? new URLSearchParams({ token })\n      : new URLSearchParams({ token, email });\n    const inviteUrl = `${base}?${query.toString()}`;\n    try {\n      if (role === STUDENT_ROLE) {\n        await this.mailer.send(email, 'studentInvite', { inviteUrl, studentName: email });\n      } else {\n        await this.mailer.send(email, 'memberInvite', {\n          inviteUrl,\n          inviterName: 'Your team',\n          role,\n        });\n      }\n    } catch (err) {\n      // A failed email must not abort invite creation: the token is already\n      // minted and recorded, so the admin can fix transport and resend.\n      this.logger.error('failed to send invite email', {\n        email,\n        role,\n        err: err instanceof Error ? err : new Error(String(err)),\n      });\n    }\n  }\n\n  async getByExternalId(externalId: string): Promise<Organization | null> {\n    return this.repo.findByExternalId(externalId);\n  }\n\n  async getBySlug(slug: string): Promise<Organization | null> {\n    return this.repo.findBySlug(slug);\n  }\n\n  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>> {\n    return this.membersRepo.list(orgId, query);\n  }\n\n  async updateMemberRole(ctx: MemberWriteContext, id: string, role: Role): Promise<Member | null> {\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return null;\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('role change rejected: owner role immutable', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner role cannot be reassigned');\n    }\n    if (member.kind !== 'member' || !member.userExternalId) {\n      this.logger.warn('role change rejected: not an active member', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('Only active members can have their role changed');\n    }\n\n    const updated = await this.membersRepo.findById(ctx.orgId, id);\n    this.logger.info('member role updated', { orgId: ctx.orgId, memberId: id, role });\n    return updated ? toMember(updated) : null;\n  }\n\n  async removeMember(_ctx: MemberWriteContext, _id: string): Promise<boolean> {\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;AAoCA,MAAM,gBAAgB,QAAc,KAAK;AASzC,SAAS,SAAS,GAAyB;CACzC,OAAO;EACL,IAAI,EAAE;EACN,WAAW,EAAE;EACb,UAAU,EAAE;EACZ,OAAO,EAAE;EACT,OAAO,EAAE;EACT,MAAM,EAAE;EACR,QAAQ,EAAE;EACV,UAAU,EAAE;EACZ,WAAW,EAAE;CACf;AACF;AAYA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,OAAO,OAAO;EACnB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO;EACrB,KAAK,MAAM,OAAO;EAClB,KAAK,SAAS,OAAO,UAAU;EAC/B,KAAK,SAAS,OAAO;EACrB,KAAK,aAAa,OAAO;CAC3B;CAEA,MAAM,mBAAmB,OAAuD;EAC9E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,KAAK,MAAM,cAAc;GAE/B,MAAM,UAAU,MAAM,cAAc,OAAO;IACzC;IAGA,YAAY,MAAM,cAAc;IAChC,MAAM,MAAM,QAAQ;IACpB,MAAM,MAAM,QAAQ;IACpB,SAAS,MAAM;GACjB,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB;GAAE,OAAO,QAAQ;GAAI,MAAM,QAAQ;EAAK,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAY,OAAuD;EAC1F,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACzE,MAAM,UAAU,MAAM,cAAc,OAAO,IAAI;IAC7C,MAAM,MAAM;IACZ,MAAM,MAAM;GACd,CAAC;GACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,gBAAgB,EAAE;GAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAAE,OAAO;IAAI,MAAM;GAAQ,CAAC,CAC1E,CAAC;GACD,OAAO;EACT,CAAC;EAED,KAAK,OAAO,KAAK,wBAAwB,EAAE,WAAW,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAmC;EAC1D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB,EAAE,OAAO,QAAQ,GAAG,CAAC;EAC9D,OAAO;CACT;CAEA,MAAM,WAAW,EAAE,OAAO,QAAQ,QAA2C;EAC3E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,cAAc;IAAE;IAAO;IAAM;IAAQ,QAAQ;GAAS,CAAC;GAC3F,MAAM,OAAO,OAAO,CAClB,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAChE,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,8BAA8B;GAAE;GAAO;GAAQ;EAAK,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,IAA8B;EAC/D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,EAAE;GAC/D,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IACrC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB,EAAE,OAAO,QAAQ,GAAG,CAAC;EAC9D,OAAO;CACT;CAEA,MAAM,aAAa,OAA2C;EAC5D,MAAM,EAAE,OAAO,OAAO,MAAM,eAAe,WAAW,aAAa;EACnE,MAAM,YAAY,MAAM,aAAa;EACrC,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EAMrD,MAAM,SACJ,SAAA,YACI,MAAM,KAAK,OAAO,WAAW;GAC3B;GACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;EAC3C,CAAC,IACD;EAEN,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACrE,MAAM,MAAM,MAAM,cAAc,oBAAoB,OAAO;IACzD;IACA;IACA,WAAW;IACX;IACA;GACF,CAAC;GACD,MAAM,SAAiC,CACrC,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAI,CAAC,CAC5D;GACA,IAAI,QAAQ;IAGV,MAAM,EAAE,SAAS,YAAY,MAAM,cAAc,cAAc;KAC7D;KACA,QAAQ,OAAO;KACf,MAAM;KACN,QAAQ;IACV,CAAC;IACD,IAAI,SACF,OAAO,KACL,mBAAmB,eAAe,KAAK;KAAE;KAAO,MAAM;IAAQ,CAAC,CACjE;GAEJ;GACA,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EAED,IAAI,WAEF,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EAG1C,KAAK,OAAO,KAAK,kBAAkB;GAAE;GAAO,UAAU,OAAO;GAAI;GAAM;EAAU,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,cAAc,OAA6C;EAC/D,MAAM,EAAE,OAAO,WAAW,WAAW,UAAU,UAAU;EACzD,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAGhD,MAAM,gBAAgB,OAAO;EAC7B,MAAM,KAAK,OAAO,WAAW,OAAO,IAAI;GACtC,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;GACzC,GAAI,UAAU,KAAA,KAAa,EAAE,MAAM;EACrC,CAAC;EAOD,MAAM,eAAe,UAAU,KAAA,KAAa,MAAM,YAAY,MAAM,cAAc,YAAY;EAC9F,IAAI,gBAAgB,QAAQ,WAAW,UACrC,MAAM,KAAK,KAAK,oBAAoB,OAAO,aAAa;EAG1D,KAAK,OAAO,KAAK,mBAAmB;GAAE;GAAO;GAAW;EAAa,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,oBAAoB,OAAgD;EACxE,MAAM,EAAE,OAAO,WAAW,kBAAkB;EAC5C,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,IAAI,QAAQ,WAAW,UACrB,MAAM,IAAI,sBAAsB,oDAAoD;EAEtF,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAKhD,MAAM,KAAK,aAAa;GACtB;GACA,OAAO,OAAO;GACd,MAAM;GACN;GACA,WAAW;EACb,CAAC;EACD,KAAK,OAAO,KAAK,yBAAyB;GAAE;GAAO;EAAU,CAAC;CAChE;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,SAAS,MAAM,KAAK,KAAK,sBAAsB,gBAAgB,KAAK,CAAC;EAC3E,IAAI,CAAC,UAAU,OAAO,WAAW,WAC/B,OAAO;EAET,IAAI,OAAO,aAAa,OAAO,4BAAY,IAAI,KAAK,GAClD,OAAO;EAET,OAAO;CACT;CAEA,MAAM,aAAa,OAA4C;EAC7D,MAAM,SAAS,MAAM,KAAK,WAAW,MAAM,KAAK;EAChD,IAAI,CAAC,QAAQ;GACX,KAAK,OAAO,KAAK,iDAAiD;GAClE,MAAM,IAAI,YAAY,gBAAgB;EACxC;EACA,IAAI,OAAO,MAAM,YAAY,MAAM,MAAM,MAAM,YAAY,GAAG;GAC5D,KAAK,OAAO,KAAK,yCAAyC;IACxD,OAAO,OAAO;IACd,UAAU,OAAO;GACnB,CAAC;GACD,MAAM,IAAI,YAAY,mBAAmB;EAC3C;EAEA,IAAI,CAAC,MADa,KAAK,KAAK,SAAS,OAAO,KAAK,GAE/C,MAAM,IAAI,YAAY,eAAe;EAGvC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GAGtE,MAAM,EAAE,SAAS,KAAK,YAAY,MAAM,cAAc,cAAc;IAClE,OAAO,OAAO;IACd,QAAQ,MAAM;IACd,MAAM,OAAO;IACb,QAAQ;GACV,CAAC;GACD,MAAM,iBAAiB,MAAM,cAAc,gBAAgB,OAAO,OAAO,OAAO,IAAI,UAAU;GAC9F,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,SAAiC,CACrC,mBAAmB,eAAe,KAAK;IACrC,OAAO,OAAO;IACd,MAAM;GACR,CAAC,CACH;GACA,IAAI,IAAI,SAAA,WACN,OAAO,KACL,UACI,mBAAmB,eAAe,KAAK;IACrC,OAAO,OAAO;IACd,MAAM;GACR,CAAC,IACD,mBAAmB,cAAc,KAAK;IACpC,OAAO,OAAO;IACd,MAAM;GACR,CAAC,CACP;QACK,IAAI,SACT,OAAO,KACL,mBAAmB,cAAc,KAAK;IACpC,OAAO,OAAO;IACd,MAAM;GACR,CAAC,CACH;GAEF,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,mBAAmB;GAAE,OAAO,OAAO;GAAO,QAAQ,MAAM;EAAO,CAAC;EACjF,OAAO;CACT;CAKA,MAAM,WAAW,OAAe,QAAyC;EACvE,OAAO,KAAK,KAAK,YAAY,OAAO,MAAM;CAC5C;CAEA,MAAM,cAAc,OAAe,IAA8B;EAC/D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,gBAAgB,OAAO,EAAE;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,EAAE;GAC/D,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,SAAiC,CAAC;GACxC,IAAI,YAAY,SAAA,WACd,OAAO,KACL,mBAAmB,eAAe,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CACjE;GAGF,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO,WAAW;EAAG,CAAC;EAC7D,OAAO;CACT;CAEA,MAAM,mBAAmB,QAAoC;EAC3D,OAAO,KAAK,KAAK,mBAAmB,MAAM;CAC5C;CAEA,MAAM,QAAQ,IAA0C;EACtD,OAAO,KAAK,KAAK,SAAS,EAAE;CAC9B;CAEA,MAAc,gBAAgB,QAAgB,OAA8B;EAC1E,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,YACxB,MAAM,IAAI,MAAM,kEAAkE;EAEpF,MAAM,EAAE,OAAO,SAAS;EACxB,MAAM,YAAY,SAAS;EAS3B,MAAM,YAAY,GARL,YACT,GAAG,KAAK,WAAW,iBAAiB,YACpC,GAAG,KAAK,WAAW,YAAY,SAMT,IAHZ,YACV,IAAI,gBAAgB,EAAE,MAAM,CAAC,IAC7B,IAAI,gBAAgB;GAAE;GAAO;EAAM,CAAC,EAAA,CACL,SAAS;EAC5C,IAAI;GACF,IAAI,SAAA,WACF,MAAM,KAAK,OAAO,KAAK,OAAO,iBAAiB;IAAE;IAAW,aAAa;GAAM,CAAC;QAEhF,MAAM,KAAK,OAAO,KAAK,OAAO,gBAAgB;IAC5C;IACA,aAAa;IACb;GACF,CAAC;EAEL,SAAS,KAAK;GAGZ,KAAK,OAAO,MAAM,+BAA+B;IAC/C;IACA;IACA,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;GACzD,CAAC;EACH;CACF;CAEA,MAAM,gBAAgB,YAAkD;EACtE,OAAO,KAAK,KAAK,iBAAiB,UAAU;CAC9C;CAEA,MAAM,UAAU,MAA4C;EAC1D,OAAO,KAAK,KAAK,WAAW,IAAI;CAClC;CAEA,YAAY,OAAe,OAA4C;EACrE,OAAO,KAAK,YAAY,KAAK,OAAO,KAAK;CAC3C;CAEA,MAAM,iBAAiB,KAAyB,IAAY,MAAoC;EAC9F,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO;EAET,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,qCAAqC;EACvE;EACA,IAAI,OAAO,SAAS,YAAY,CAAC,OAAO,gBAAgB;GACtD,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iDAAiD;EACnF;EAEA,MAAM,UAAU,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC7D,KAAK,OAAO,KAAK,uBAAuB;GAAE,OAAO,IAAI;GAAO,UAAU;GAAI;EAAK,CAAC;EAChF,OAAO,UAAU,SAAS,OAAO,IAAI;CACvC;CAEA,MAAM,aAAa,MAA0B,KAA+B;EAC1E,OAAO;CACT;AACF"}
+{"version":3,"file":"service.js","names":[],"sources":["../../src/organizations/service.ts"],"sourcesContent":["// organizations context — service implementation (inbound port).\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport type {\n  MemberRecord,\n  MembersRepository,\n  MemberWriteContext,\n  OrgAdmin,\n  OrganizationService,\n  OrganizationsRepository,\n  OrganizationsUnitOfWork,\n} from './ports.js';\nimport type { Invite, Organization, OrgUser } from './model.js';\nimport { capability, type Role, STAFF_ROLES, STUDENT_ROLE } from './roles.js';\nimport {\n  InviteError,\n  type Member,\n  type MemberRoleChange,\n  type MembersQuery,\n  OrganizationRuleError,\n  type Page,\n} from './members.js';\nimport type {\n  AcceptInviteInput,\n  AddOrgUserInput,\n  CreateInviteInput,\n  CreateOrganizationInput,\n  ResendStudentInviteInput,\n  UpdateOrganizationInput,\n  UpdateOrgUserInput,\n} from './types.js';\nimport { organizationEvents, type OrganizationEvent } from './events.js';\nimport type { Logger, NewDomainEvent } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport { generateInviteToken, hashInviteToken } from '../shared/invite-token.js';\nimport { ForbiddenError, NotFoundError } from '../shared/errors.js';\nimport type { Actor } from '../shared/actor.js';\nimport type { IdentityService } from '../identity/index.js';\nimport { genId } from '../shared/id.js';\n\nconst INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ntype NewOrganizationEvent = NewDomainEvent<OrganizationEvent>;\n\ninterface MemberWrite {\n  orgUserId: string;\n  actorOrgUserId: string;\n  demote: boolean;\n}\n\nexport interface InviteUrls {\n  studentPortalUrl: string;\n  adminAppUrl: string;\n}\n\nfunction toMember(r: MemberRecord): Member {\n  return {\n    id: r.id,\n    firstName: r.firstName,\n    lastName: r.lastName,\n    email: r.email,\n    image: r.image,\n    role: r.role,\n    status: r.status,\n    joinedAt: r.joinedAt,\n    invitedAt: r.invitedAt,\n  };\n}\n\nexport type OrganizationServiceParams = {\n  repo: OrganizationsRepository;\n  membersRepo: MembersRepository;\n  people: IdentityService;\n  uow: OrganizationsUnitOfWork;\n  orgAdmin: () => OrgAdmin;\n  logger?: Logger;\n  mailer?: Pick<Mailer, 'send'>;\n  inviteUrls?: InviteUrls;\n};\n\nexport class OrganizationServiceImpl implements OrganizationService {\n  private readonly repo: OrganizationsRepository;\n  private readonly membersRepo: MembersRepository;\n  private readonly people: IdentityService;\n  private readonly uow: OrganizationsUnitOfWork;\n  private readonly orgAdmin: () => OrgAdmin;\n  private readonly logger: Logger;\n  private readonly mailer?: Pick<Mailer, 'send'>;\n  private readonly inviteUrls?: InviteUrls;\n  private readonly memberWrites = new AsyncLocalStorage<MemberWrite>();\n\n  constructor(params: OrganizationServiceParams) {\n    this.repo = params.repo;\n    this.membersRepo = params.membersRepo;\n    this.people = params.people;\n    this.uow = params.uow;\n    this.orgAdmin = params.orgAdmin;\n    this.logger = params.logger ?? noopLogger;\n    this.mailer = params.mailer;\n    this.inviteUrls = params.inviteUrls;\n  }\n\n  async createOrganization(input: CreateOrganizationInput): Promise<Organization> {\n    const created = await this.uow.run(async ({ organizations, outbox }) => {\n      const id = genId('organization');\n\n      const created = await organizations.create({\n        id,\n        // The auth provider adopts this id for its own org row, so the org is\n        // its own external id — a lookup by either id lands on the same row.\n        externalId: input.externalId ?? id,\n        name: input.name ?? `My Org`,\n        slug: input.slug ?? '',\n        ownerId: input.ownerId,\n      });\n      await outbox.append([\n        organizationEvents.organizationCreated.make({\n          orgId: created.id,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('organization created', { orgId: created.id, slug: created.slug });\n    return created;\n  }\n\n  async updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization> {\n    const updatedOrg = await this.uow.run(async ({ organizations, outbox }) => {\n      const updated = await organizations.update(id, {\n        name: input.name,\n        slug: input.slug,\n      });\n      if (!updated) {\n        throw new NotFoundError('Organization', id);\n      }\n      await outbox.append([\n        organizationEvents.organizationUpdated.make({ orgId: id, data: updated }),\n      ]);\n      return updated;\n    });\n\n    this.logger.info('organization updated', { updatedOrg });\n    return updatedOrg!;\n  }\n\n  async deleteOrganization(id: string): Promise<Organization> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const deleted = await organizations.delete(id);\n\n      await outbox.append([\n        organizationEvents.organizationDeleted.make({\n          orgId: deleted.id,\n          data: deleted,\n        }),\n      ]);\n      return deleted;\n    });\n    this.logger.info('organization deleted', { orgId: deleted.id });\n    return deleted;\n  }\n\n  async addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser> {\n    const existing = await this.repo.findOrgUser(orgId, userId);\n    if (existing) {\n      return this.updateOrgUser(orgId, userId, { role, status: 'active' });\n    }\n    const orgUser = await this.uow.run(async ({ organizations, outbox }) => {\n      const created = await organizations.createOrgUser({ orgId, role, userId, status: 'active' });\n      await outbox.append([organizationEvents.orgUserLinked.make({ orgId, data: created })]);\n      return created;\n    });\n    this.logger.info('user added to organization', { orgId, userId, role });\n    return orgUser;\n  }\n\n  async removeOrgUser(orgId: string, userId: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('Member', userId);\n      }\n      const write = this.memberWrite(orgUser.id);\n      if (write?.demote) {\n        const demoted = await organizations.updateOrgUser(orgId, orgUser.id, {\n          role: STUDENT_ROLE,\n        });\n        if (!demoted) {\n          throw new NotFoundError('Member', orgUser.id);\n        }\n        if (orgUser.role !== STUDENT_ROLE) {\n          await outbox.append([\n            organizationEvents.orgUserUpdated.make({\n              orgId,\n              data: demoted,\n              metadata: { actorOrgUserId: write.actorOrgUserId },\n            }),\n          ]);\n        }\n        return demoted;\n      }\n      if (orgUser.role === STUDENT_ROLE) {\n        return orgUser;\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, orgUser.id);\n      if (!deletedUser) {\n        throw new NotFoundError('Member', orgUser.id);\n      }\n      await outbox.append([\n        organizationEvents.orgUserDeleted.make({\n          orgId,\n          data: deletedUser,\n        }),\n      ]);\n      return deletedUser;\n    });\n    this.logger.info('org user removed', { orgId, userId, orgUserId: deleted.id });\n    return deleted;\n  }\n\n  async updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser> {\n    const updated = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('Member', userId);\n      }\n      const next = await organizations.updateOrgUser(orgId, orgUser.id, patch);\n      if (!next) {\n        throw new NotFoundError('Member', orgUser.id);\n      }\n      if (patch.role !== undefined && patch.role !== orgUser.role) {\n        const actorOrgUserId = this.memberWrite(orgUser.id)?.actorOrgUserId;\n        await outbox.append([\n          organizationEvents.orgUserUpdated.make({\n            orgId,\n            data: next,\n            ...(actorOrgUserId !== undefined && { metadata: { actorOrgUserId } }),\n          }),\n        ]);\n      }\n      return next;\n    });\n    this.logger.info('org user updated', { orgId, userId, orgUserId: updated.id, patch });\n    return updated;\n  }\n\n  async createInvite(actor: Actor, input: CreateInviteInput): Promise<Invite> {\n    const { orgId, email, role, inviterUserId, firstName, lastName } = input;\n    this.assertManagesUsers(actor, orgId);\n    this.assertNotOwner(role, orgId);\n    const sendEmail = input.sendEmail ?? true;\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n\n    // A student belongs to the org from the moment an admin adds them, not from\n    // the moment they click a link — so the person exists before the invite\n    // does. Staff are excluded: their org_users row is mirrored from the auth\n    // provider's member record, which does not exist until they join.\n    const person =\n      role === STUDENT_ROLE\n        ? ((await this.people.getUserByEmail(email)) ??\n          (await this.people.createUser({\n            email,\n            ...(firstName !== undefined && { firstName }),\n            ...(lastName !== undefined && { lastName }),\n          })))\n        : null;\n\n    const invite = await this.uow.run(async ({ organizations, outbox }) => {\n      const events: NewOrganizationEvent[] = [];\n      if (person) {\n        const orgUser = await organizations.createOrgUser({\n          orgId,\n          userId: person.id,\n          role: STUDENT_ROLE,\n          status: 'invited',\n        });\n        events.push(organizationEvents.studentCreated.make({ orgId, data: orgUser }));\n      }\n      const row = await organizations.upsertPendingInvite(orgId, {\n        email,\n        role,\n        invitedBy: inviterUserId,\n        tokenHash,\n        expiresAt,\n      });\n      events.push(organizationEvents.inviteCreated.make({ orgId, data: row }));\n      await outbox.append(events);\n      return row;\n    });\n\n    if (sendEmail) {\n      // TODO make this workflow durable\n      try {\n        await this.sendInviteEmail(invite, token);\n      } catch (err) {\n        // A failed email must not abort invite creation: the token is already\n        // minted and recorded, so the admin can fix transport and resend.\n        this.logger.error('failed to send invite email', {\n          orgId,\n          inviteId: invite.id,\n          role: invite.role,\n          err: err instanceof Error ? err : new Error(String(err)),\n        });\n      }\n    }\n\n    this.logger.info('invite created', { orgId, inviteId: invite.id, role, sendEmail });\n    return invite;\n  }\n\n  async resendStudentInvite(actor: Actor, input: ResendStudentInviteInput): Promise<void> {\n    const { orgId, orgUserId, inviterUserId } = input;\n    this.assertManagesUsers(actor, orgId);\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    if (orgUser.status === 'active') {\n      throw new OrganizationRuleError('That student has already accepted their invitation');\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n    const pending = await this.repo.findPendingInvite(orgId, person.email);\n    if (!pending) {\n      throw new NotFoundError('Invite', person.email);\n    }\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n    const invite = await this.repo.setInviteToken(orgId, pending.id, tokenHash, expiresAt);\n    if (!invite) {\n      throw new NotFoundError('Invite', pending.id);\n    }\n    await this.sendInviteEmail(invite, token);\n    this.logger.info('student invite resent', {\n      orgId,\n      orgUserId,\n      inviteId: invite.id,\n      inviterUserId,\n    });\n  }\n\n  async peekInvite(token: string): Promise<Invite | null> {\n    const invite = await this.repo.findInviteByTokenHash(hashInviteToken(token));\n    if (!invite || invite.status !== 'pending') {\n      return null;\n    }\n    if (invite.expiresAt && invite.expiresAt < new Date()) {\n      return null;\n    }\n    return invite;\n  }\n\n  async acceptInvite(input: AcceptInviteInput): Promise<OrgUser> {\n    const invite = await this.peekInvite(input.token);\n    if (!invite) {\n      this.logger.warn('invite accept refused: token invalid or expired');\n      throw new InviteError('invalid invite');\n    }\n    if (invite.email.toLowerCase() !== input.email.toLowerCase()) {\n      this.logger.warn('invite accept refused: email mismatch', {\n        orgId: invite.orgId,\n        inviteId: invite.id,\n      });\n      throw new InviteError('emails must match');\n    }\n    const org = await this.repo.findById(invite.orgId);\n    if (!org) {\n      throw new InviteError('Org not found');\n    }\n\n    const orgUser =\n      invite.role === STUDENT_ROLE\n        ? await this.acceptStudentInvite(invite, input.userId)\n        : await this.acceptStaffInvite(invite, org, input.userId);\n    this.logger.info('invite accepted', { orgId: invite.orgId, userId: input.userId });\n    return orgUser;\n  }\n\n  private async acceptStudentInvite(invite: Invite, userId: string): Promise<OrgUser> {\n    return this.uow.run(async ({ organizations, outbox }) => {\n      const existing = await organizations.findOrgUser(invite.orgId, userId);\n      if (!existing) {\n        throw new NotFoundError('Member', userId);\n      }\n      const activated = await organizations.updateOrgUser(invite.orgId, existing.id, {\n        status: 'active',\n      });\n      if (!activated) {\n        throw new NotFoundError('Member', existing.id);\n      }\n      const acceptedInvite = await organizations.setInviteStatus(\n        invite.orgId,\n        invite.id,\n        'accepted',\n      );\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      await outbox.append([\n        organizationEvents.inviteAccepted.make({ orgId: invite.orgId, data: acceptedInvite }),\n        organizationEvents.studentLinked.make({ orgId: invite.orgId, data: activated }),\n      ]);\n      return activated;\n    });\n  }\n\n  private async acceptStaffInvite(\n    invite: Invite,\n    org: Organization,\n    userId: string,\n  ): Promise<OrgUser> {\n    const person = await this.people.getUserById(userId);\n    if (!person?.externalId) {\n      throw new NotFoundError('User', userId);\n    }\n    await this.orgAdmin().grantMembership(org.externalId ?? org.id, person.externalId, invite.role);\n    return this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(invite.orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('Member', userId);\n      }\n      const acceptedInvite = await organizations.setInviteStatus(\n        invite.orgId,\n        invite.id,\n        'accepted',\n      );\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      await outbox.append([\n        organizationEvents.inviteAccepted.make({ orgId: invite.orgId, data: acceptedInvite }),\n      ]);\n      return orgUser;\n    });\n  }\n\n  // By identity USER id — `(org_id, user_id)` is unique. Every caller (scope\n  // resolution, the MCP principal, the member routes) asks \"what is this person\n  // in this org\", never \"what is this org_users row\".\n  getOrgUserById(orgId: string, id: string): Promise<OrgUser | null> {\n    return this.repo.findOrgUserById(orgId, id);\n  }\n\n  async getOrgUser(orgId: string, userId: string): Promise<OrgUser | null> {\n    return this.repo.findOrgUser(orgId, userId);\n  }\n\n  async deleteOrgUser(orgId: string, actor: Actor, id: string): Promise<OrgUser> {\n    this.assertManagesUsers(actor, orgId);\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUserById(orgId, id);\n      if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n        throw new NotFoundError('Student', id);\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, id);\n      if (!deletedUser) {\n        throw new NotFoundError('Student', id);\n      }\n      await outbox.append([organizationEvents.studentDeleted.make({ orgId, data: orgUser })]);\n      return deletedUser;\n    });\n    this.logger.info('org user deleted', { orgId, orgUserId: id });\n    return deleted;\n  }\n\n  async getOrgUsersForUser(userId: string): Promise<OrgUser[]> {\n    return this.repo.findOrgUsersByUser(userId);\n  }\n\n  async getById(id: string): Promise<Organization | null> {\n    return this.repo.findById(id);\n  }\n\n  private async sendInviteEmail(invite: Invite, token: string): Promise<void> {\n    if (!this.mailer || !this.inviteUrls) {\n      throw new Error('invite delivery is not configured (mailer / invite urls missing)');\n    }\n    const { email, role } = invite;\n    const isStudent = role === STUDENT_ROLE;\n    const base = isStudent\n      ? `${this.inviteUrls.studentPortalUrl}/welcome`\n      : `${this.inviteUrls.adminAppUrl}/invite`;\n    // The portal resolves the token to the invited email, so the link carries\n    // only the token. The admin app still reads it from the query.\n    const query = isStudent\n      ? new URLSearchParams({ token })\n      : new URLSearchParams({ token, email });\n    const inviteUrl = `${base}?${query.toString()}`;\n    if (role === STUDENT_ROLE) {\n      await this.mailer.send(email, 'studentInvite', { inviteUrl, studentName: email });\n    } else {\n      await this.mailer.send(email, 'memberInvite', {\n        inviteUrl,\n        inviterName: 'Your team',\n        role,\n      });\n    }\n  }\n\n  async getByExternalId(externalId: string): Promise<Organization | null> {\n    return this.repo.findByExternalId(externalId);\n  }\n\n  async getBySlug(slug: string): Promise<Organization | null> {\n    return this.repo.findBySlug(slug);\n  }\n\n  staffOrgUserIds(orgId: string): Promise<string[]> {\n    return this.repo.findOrgUserIdsByRole(orgId, [...STAFF_ROLES]);\n  }\n\n  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>> {\n    return this.membersRepo.list(orgId, query);\n  }\n\n  async updateMemberRole(\n    ctx: MemberWriteContext,\n    actor: Actor,\n    id: string,\n    role: Role,\n  ): Promise<MemberRoleChange | null> {\n    this.assertManagesUsers(actor, ctx.orgId);\n    this.assertNotOwner(role, ctx.orgId);\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return this.promoteStudent(ctx, actor, id, role);\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('role change rejected: owner role immutable', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner role cannot be reassigned');\n    }\n    if (member.kind !== 'member' || !member.userExternalId) {\n      this.logger.warn('role change rejected: not an active member', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('Only active members can have their role changed');\n    }\n    if (role === STUDENT_ROLE) {\n      return this.demoteModerator(ctx, actor, member, member.userExternalId);\n    }\n    const userExternalId = member.userExternalId;\n    await this.asActor(actor, id, false, () =>\n      this.orgAdmin().updateRole(ctx, userExternalId, role),\n    );\n    const updated = await this.membersRepo.findById(ctx.orgId, id);\n    this.logger.info('member role updated', { orgId: ctx.orgId, memberId: id, role });\n    return updated ? toMember(updated) : null;\n  }\n\n  private async demoteModerator(\n    ctx: MemberWriteContext,\n    actor: Actor,\n    member: MemberRecord,\n    userExternalId: string,\n  ): Promise<MemberRoleChange | null> {\n    if (member.role !== 'moderator') {\n      this.logger.warn('role change rejected: only a moderator becomes a student', {\n        orgId: ctx.orgId,\n        memberId: member.id,\n      });\n      throw new OrganizationRuleError('Only a moderator can be made a student');\n    }\n    await this.asActor(actor, member.id, true, () =>\n      this.orgAdmin().removeMember(ctx, userExternalId),\n    );\n    const orgUser = await this.repo.findOrgUserById(ctx.orgId, member.id);\n    if (!orgUser) {\n      return null;\n    }\n    this.logger.info('moderator made a student', { orgId: ctx.orgId, memberId: member.id });\n    return { ...toMember(member), role: orgUser.role, status: orgUser.status };\n  }\n\n  private async promoteStudent(\n    ctx: MemberWriteContext,\n    actor: Actor,\n    id: string,\n    role: Role,\n  ): Promise<MemberRoleChange | null> {\n    const orgUser = await this.repo.findOrgUserById(ctx.orgId, id);\n    if (!orgUser) {\n      return null;\n    }\n    if (orgUser.role !== STUDENT_ROLE || role === STUDENT_ROLE) {\n      this.logger.warn('role change rejected: not an active member', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('Only active members can have their role changed');\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person?.externalId) {\n      this.logger.warn('role change rejected: student has no account', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('That student has not joined yet');\n    }\n    const org = await this.repo.findById(ctx.orgId);\n    if (!org) {\n      return null;\n    }\n    const orgExternalId = org.externalId ?? org.id;\n    const userExternalId = person.externalId;\n    await this.asActor(actor, orgUser.id, false, async () => {\n      await this.orgAdmin().grantMembership(orgExternalId, userExternalId, role);\n      if (!(await this.membersRepo.findById(ctx.orgId, id))) {\n        await this.orgAdmin().updateRole(ctx, userExternalId, role);\n      }\n    });\n    const updated = await this.membersRepo.findById(ctx.orgId, id);\n    if (!updated) {\n      this.logger.warn('role change rejected: membership not mirrored', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The role change did not take effect');\n    }\n    this.logger.info('student promoted', { orgId: ctx.orgId, memberId: id, role });\n    return toMember(updated);\n  }\n\n  private asActor<T>(\n    actor: Actor,\n    orgUserId: string,\n    demote: boolean,\n    write: () => Promise<T>,\n  ): Promise<T> {\n    return this.memberWrites.run({ orgUserId, actorOrgUserId: actor.id, demote }, write);\n  }\n\n  private memberWrite(orgUserId: string): MemberWrite | undefined {\n    const write = this.memberWrites.getStore();\n    return write?.orgUserId === orgUserId ? write : undefined;\n  }\n\n  private assertManagesUsers(actor: Actor, orgId: string): void {\n    if (capability(actor.role, 'manage_users') !== true) {\n      this.logger.warn('member write rejected: actor cannot manage users', {\n        orgId,\n        actorOrgUserId: actor.id,\n      });\n      throw new ForbiddenError('Only an owner or admin can manage members');\n    }\n  }\n\n  private assertNotOwner(role: Role, orgId: string): void {\n    if (role === 'owner') {\n      this.logger.warn('member write rejected: owner cannot be granted', { orgId });\n      throw new OrganizationRuleError('Ownership cannot be granted');\n    }\n  }\n\n  async removeMember(ctx: MemberWriteContext, actor: Actor, id: string): Promise<boolean> {\n    this.assertManagesUsers(actor, ctx.orgId);\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return false;\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('member removal rejected: owner cannot be removed', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner cannot be removed');\n    }\n    if (member.kind === 'member' && member.userExternalId) {\n      await this.orgAdmin().removeMember(ctx, member.userExternalId);\n    } else if (member.kind === 'invite' && member.inviteId) {\n      const inviteId = member.inviteId;\n      await this.uow.run(async ({ organizations, outbox }) => {\n        const canceled = await organizations.setInviteStatus(ctx.orgId, inviteId, 'canceled');\n        if (!canceled) {\n          throw new NotFoundError('Invite', inviteId);\n        }\n        await outbox.append([\n          organizationEvents.inviteCanceled.make({ orgId: ctx.orgId, data: canceled }),\n        ]);\n      });\n    }\n    this.logger.info('member removed', { orgId: ctx.orgId, memberId: id });\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;;AAwCA,MAAM,gBAAgB,QAAc,KAAK;AAezC,SAAS,SAAS,GAAyB;CACzC,OAAO;EACL,IAAI,EAAE;EACN,WAAW,EAAE;EACb,UAAU,EAAE;EACZ,OAAO,EAAE;EACT,OAAO,EAAE;EACT,MAAM,EAAE;EACR,QAAQ,EAAE;EACV,UAAU,EAAE;EACZ,WAAW,EAAE;CACf;AACF;AAaA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,eAAgC,IAAI,kBAA+B;CAEnE,YAAY,QAAmC;EAC7C,KAAK,OAAO,OAAO;EACnB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO;EACrB,KAAK,MAAM,OAAO;EAClB,KAAK,WAAW,OAAO;EACvB,KAAK,SAAS,OAAO,UAAU;EAC/B,KAAK,SAAS,OAAO;EACrB,KAAK,aAAa,OAAO;CAC3B;CAEA,MAAM,mBAAmB,OAAuD;EAC9E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,KAAK,MAAM,cAAc;GAE/B,MAAM,UAAU,MAAM,cAAc,OAAO;IACzC;IAGA,YAAY,MAAM,cAAc;IAChC,MAAM,MAAM,QAAQ;IACpB,MAAM,MAAM,QAAQ;IACpB,SAAS,MAAM;GACjB,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB;GAAE,OAAO,QAAQ;GAAI,MAAM,QAAQ;EAAK,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAY,OAAuD;EAC1F,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACzE,MAAM,UAAU,MAAM,cAAc,OAAO,IAAI;IAC7C,MAAM,MAAM;IACZ,MAAM,MAAM;GACd,CAAC;GACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,gBAAgB,EAAE;GAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAAE,OAAO;IAAI,MAAM;GAAQ,CAAC,CAC1E,CAAC;GACD,OAAO;EACT,CAAC;EAED,KAAK,OAAO,KAAK,wBAAwB,EAAE,WAAW,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAmC;EAC1D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB,EAAE,OAAO,QAAQ,GAAG,CAAC;EAC9D,OAAO;CACT;CAEA,MAAM,WAAW,EAAE,OAAO,QAAQ,QAA2C;EAE3E,IAAI,MADmB,KAAK,KAAK,YAAY,OAAO,MAAM,GAExD,OAAO,KAAK,cAAc,OAAO,QAAQ;GAAE;GAAM,QAAQ;EAAS,CAAC;EAErE,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,cAAc;IAAE;IAAO;IAAM;IAAQ,QAAQ;GAAS,CAAC;GAC3F,MAAM,OAAO,OAAO,CAAC,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC,CAAC;GACrF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,8BAA8B;GAAE;GAAO;GAAQ;EAAK,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,QAAkC;EACnE,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,MAAM;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,QAAQ,KAAK,YAAY,QAAQ,EAAE;GACzC,IAAI,OAAO,QAAQ;IACjB,MAAM,UAAU,MAAM,cAAc,cAAc,OAAO,QAAQ,IAAI,EACnE,MAAM,aACR,CAAC;IACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;IAE9C,IAAI,QAAQ,SAAA,WACV,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KACrC;KACA,MAAM;KACN,UAAU,EAAE,gBAAgB,MAAM,eAAe;IACnD,CAAC,CACH,CAAC;IAEH,OAAO;GACT;GACA,IAAI,QAAQ,SAAA,WACV,OAAO;GAET,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,QAAQ,EAAE;GACvE,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;GAE9C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IACrC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO;GAAQ,WAAW,QAAQ;EAAG,CAAC;EAC7E,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,QAAgB,OAA6C;EAC9F,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,MAAM;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,OAAO,MAAM,cAAc,cAAc,OAAO,QAAQ,IAAI,KAAK;GACvE,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;GAE9C,IAAI,MAAM,SAAS,KAAA,KAAa,MAAM,SAAS,QAAQ,MAAM;IAC3D,MAAM,iBAAiB,KAAK,YAAY,QAAQ,EAAE,CAAC,EAAE;IACrD,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KACrC;KACA,MAAM;KACN,GAAI,mBAAmB,KAAA,KAAa,EAAE,UAAU,EAAE,eAAe,EAAE;IACrE,CAAC,CACH,CAAC;GACH;GACA,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO;GAAQ,WAAW,QAAQ;GAAI;EAAM,CAAC;EACpF,OAAO;CACT;CAEA,MAAM,aAAa,OAAc,OAA2C;EAC1E,MAAM,EAAE,OAAO,OAAO,MAAM,eAAe,WAAW,aAAa;EACnE,KAAK,mBAAmB,OAAO,KAAK;EACpC,KAAK,eAAe,MAAM,KAAK;EAC/B,MAAM,YAAY,MAAM,aAAa;EACrC,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EAMrD,MAAM,SACJ,SAAA,YACM,MAAM,KAAK,OAAO,eAAe,KAAK,KACvC,MAAM,KAAK,OAAO,WAAW;GAC5B;GACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;EAC3C,CAAC,IACD;EAEN,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACrE,MAAM,SAAiC,CAAC;GACxC,IAAI,QAAQ;IACV,MAAM,UAAU,MAAM,cAAc,cAAc;KAChD;KACA,QAAQ,OAAO;KACf,MAAM;KACN,QAAQ;IACV,CAAC;IACD,OAAO,KAAK,mBAAmB,eAAe,KAAK;KAAE;KAAO,MAAM;IAAQ,CAAC,CAAC;GAC9E;GACA,MAAM,MAAM,MAAM,cAAc,oBAAoB,OAAO;IACzD;IACA;IACA,WAAW;IACX;IACA;GACF,CAAC;GACD,OAAO,KAAK,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAI,CAAC,CAAC;GACvE,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EAED,IAAI,WAEF,IAAI;GACF,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EAC1C,SAAS,KAAK;GAGZ,KAAK,OAAO,MAAM,+BAA+B;IAC/C;IACA,UAAU,OAAO;IACjB,MAAM,OAAO;IACb,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;GACzD,CAAC;EACH;EAGF,KAAK,OAAO,KAAK,kBAAkB;GAAE;GAAO,UAAU,OAAO;GAAI;GAAM;EAAU,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,oBAAoB,OAAc,OAAgD;EACtF,MAAM,EAAE,OAAO,WAAW,kBAAkB;EAC5C,KAAK,mBAAmB,OAAO,KAAK;EACpC,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,IAAI,QAAQ,WAAW,UACrB,MAAM,IAAI,sBAAsB,oDAAoD;EAEtF,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAEhD,MAAM,UAAU,MAAM,KAAK,KAAK,kBAAkB,OAAO,OAAO,KAAK;EACrE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,OAAO,KAAK;EAEhD,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EACrD,MAAM,SAAS,MAAM,KAAK,KAAK,eAAe,OAAO,QAAQ,IAAI,WAAW,SAAS;EACrF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;EAE9C,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EACxC,KAAK,OAAO,KAAK,yBAAyB;GACxC;GACA;GACA,UAAU,OAAO;GACjB;EACF,CAAC;CACH;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,SAAS,MAAM,KAAK,KAAK,sBAAsB,gBAAgB,KAAK,CAAC;EAC3E,IAAI,CAAC,UAAU,OAAO,WAAW,WAC/B,OAAO;EAET,IAAI,OAAO,aAAa,OAAO,4BAAY,IAAI,KAAK,GAClD,OAAO;EAET,OAAO;CACT;CAEA,MAAM,aAAa,OAA4C;EAC7D,MAAM,SAAS,MAAM,KAAK,WAAW,MAAM,KAAK;EAChD,IAAI,CAAC,QAAQ;GACX,KAAK,OAAO,KAAK,iDAAiD;GAClE,MAAM,IAAI,YAAY,gBAAgB;EACxC;EACA,IAAI,OAAO,MAAM,YAAY,MAAM,MAAM,MAAM,YAAY,GAAG;GAC5D,KAAK,OAAO,KAAK,yCAAyC;IACxD,OAAO,OAAO;IACd,UAAU,OAAO;GACnB,CAAC;GACD,MAAM,IAAI,YAAY,mBAAmB;EAC3C;EACA,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,OAAO,KAAK;EACjD,IAAI,CAAC,KACH,MAAM,IAAI,YAAY,eAAe;EAGvC,MAAM,UACJ,OAAO,SAAA,YACH,MAAM,KAAK,oBAAoB,QAAQ,MAAM,MAAM,IACnD,MAAM,KAAK,kBAAkB,QAAQ,KAAK,MAAM,MAAM;EAC5D,KAAK,OAAO,KAAK,mBAAmB;GAAE,OAAO,OAAO;GAAO,QAAQ,MAAM;EAAO,CAAC;EACjF,OAAO;CACT;CAEA,MAAc,oBAAoB,QAAgB,QAAkC;EAClF,OAAO,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACvD,MAAM,WAAW,MAAM,cAAc,YAAY,OAAO,OAAO,MAAM;GACrE,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,YAAY,MAAM,cAAc,cAAc,OAAO,OAAO,SAAS,IAAI,EAC7E,QAAQ,SACV,CAAC;GACD,IAAI,CAAC,WACH,MAAM,IAAI,cAAc,UAAU,SAAS,EAAE;GAE/C,MAAM,iBAAiB,MAAM,cAAc,gBACzC,OAAO,OACP,OAAO,IACP,UACF;GACA,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAe,CAAC,GACpF,mBAAmB,cAAc,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAU,CAAC,CAChF,CAAC;GACD,OAAO;EACT,CAAC;CACH;CAEA,MAAc,kBACZ,QACA,KACA,QACkB;EAClB,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,MAAM;EACnD,IAAI,CAAC,QAAQ,YACX,MAAM,IAAI,cAAc,QAAQ,MAAM;EAExC,MAAM,KAAK,SAAS,CAAC,CAAC,gBAAgB,IAAI,cAAc,IAAI,IAAI,OAAO,YAAY,OAAO,IAAI;EAC9F,OAAO,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACvD,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,OAAO,MAAM;GACpE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,iBAAiB,MAAM,cAAc,gBACzC,OAAO,OACP,OAAO,IACP,UACF;GACA,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAe,CAAC,CACtF,CAAC;GACD,OAAO;EACT,CAAC;CACH;CAKA,eAAe,OAAe,IAAqC;EACjE,OAAO,KAAK,KAAK,gBAAgB,OAAO,EAAE;CAC5C;CAEA,MAAM,WAAW,OAAe,QAAyC;EACvE,OAAO,KAAK,KAAK,YAAY,OAAO,MAAM;CAC5C;CAEA,MAAM,cAAc,OAAe,OAAc,IAA8B;EAC7E,KAAK,mBAAmB,OAAO,KAAK;EACpC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,gBAAgB,OAAO,EAAE;GAC7D,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,EAAE;GAC/D,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,OAAO,OAAO,CAAC,mBAAmB,eAAe,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC,CAAC;GACtF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO,WAAW;EAAG,CAAC;EAC7D,OAAO;CACT;CAEA,MAAM,mBAAmB,QAAoC;EAC3D,OAAO,KAAK,KAAK,mBAAmB,MAAM;CAC5C;CAEA,MAAM,QAAQ,IAA0C;EACtD,OAAO,KAAK,KAAK,SAAS,EAAE;CAC9B;CAEA,MAAc,gBAAgB,QAAgB,OAA8B;EAC1E,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,YACxB,MAAM,IAAI,MAAM,kEAAkE;EAEpF,MAAM,EAAE,OAAO,SAAS;EACxB,MAAM,YAAY,SAAS;EAS3B,MAAM,YAAY,GARL,YACT,GAAG,KAAK,WAAW,iBAAiB,YACpC,GAAG,KAAK,WAAW,YAAY,SAMT,IAHZ,YACV,IAAI,gBAAgB,EAAE,MAAM,CAAC,IAC7B,IAAI,gBAAgB;GAAE;GAAO;EAAM,CAAC,EAAA,CACL,SAAS;EAC5C,IAAI,SAAA,WACF,MAAM,KAAK,OAAO,KAAK,OAAO,iBAAiB;GAAE;GAAW,aAAa;EAAM,CAAC;OAEhF,MAAM,KAAK,OAAO,KAAK,OAAO,gBAAgB;GAC5C;GACA,aAAa;GACb;EACF,CAAC;CAEL;CAEA,MAAM,gBAAgB,YAAkD;EACtE,OAAO,KAAK,KAAK,iBAAiB,UAAU;CAC9C;CAEA,MAAM,UAAU,MAA4C;EAC1D,OAAO,KAAK,KAAK,WAAW,IAAI;CAClC;CAEA,gBAAgB,OAAkC;EAChD,OAAO,KAAK,KAAK,qBAAqB,OAAO,CAAC,GAAG,WAAW,CAAC;CAC/D;CAEA,YAAY,OAAe,OAA4C;EACrE,OAAO,KAAK,YAAY,KAAK,OAAO,KAAK;CAC3C;CAEA,MAAM,iBACJ,KACA,OACA,IACA,MACkC;EAClC,KAAK,mBAAmB,OAAO,IAAI,KAAK;EACxC,KAAK,eAAe,MAAM,IAAI,KAAK;EACnC,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO,KAAK,eAAe,KAAK,OAAO,IAAI,IAAI;EAEjD,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,qCAAqC;EACvE;EACA,IAAI,OAAO,SAAS,YAAY,CAAC,OAAO,gBAAgB;GACtD,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iDAAiD;EACnF;EACA,IAAI,SAAA,WACF,OAAO,KAAK,gBAAgB,KAAK,OAAO,QAAQ,OAAO,cAAc;EAEvE,MAAM,iBAAiB,OAAO;EAC9B,MAAM,KAAK,QAAQ,OAAO,IAAI,aAC5B,KAAK,SAAS,CAAC,CAAC,WAAW,KAAK,gBAAgB,IAAI,CACtD;EACA,MAAM,UAAU,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC7D,KAAK,OAAO,KAAK,uBAAuB;GAAE,OAAO,IAAI;GAAO,UAAU;GAAI;EAAK,CAAC;EAChF,OAAO,UAAU,SAAS,OAAO,IAAI;CACvC;CAEA,MAAc,gBACZ,KACA,OACA,QACA,gBACkC;EAClC,IAAI,OAAO,SAAS,aAAa;GAC/B,KAAK,OAAO,KAAK,4DAA4D;IAC3E,OAAO,IAAI;IACX,UAAU,OAAO;GACnB,CAAC;GACD,MAAM,IAAI,sBAAsB,wCAAwC;EAC1E;EACA,MAAM,KAAK,QAAQ,OAAO,OAAO,IAAI,YACnC,KAAK,SAAS,CAAC,CAAC,aAAa,KAAK,cAAc,CAClD;EACA,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,IAAI,OAAO,OAAO,EAAE;EACpE,IAAI,CAAC,SACH,OAAO;EAET,KAAK,OAAO,KAAK,4BAA4B;GAAE,OAAO,IAAI;GAAO,UAAU,OAAO;EAAG,CAAC;EACtF,OAAO;GAAE,GAAG,SAAS,MAAM;GAAG,MAAM,QAAQ;GAAM,QAAQ,QAAQ;EAAO;CAC3E;CAEA,MAAc,eACZ,KACA,OACA,IACA,MACkC;EAClC,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,IAAI,OAAO,EAAE;EAC7D,IAAI,CAAC,SACH,OAAO;EAET,IAAI,QAAQ,SAAA,aAAyB,SAAA,WAAuB;GAC1D,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iDAAiD;EACnF;EACA,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QAAQ,YAAY;GACvB,KAAK,OAAO,KAAK,gDAAgD;IAC/D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iCAAiC;EACnE;EACA,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,IAAI,KAAK;EAC9C,IAAI,CAAC,KACH,OAAO;EAET,MAAM,gBAAgB,IAAI,cAAc,IAAI;EAC5C,MAAM,iBAAiB,OAAO;EAC9B,MAAM,KAAK,QAAQ,OAAO,QAAQ,IAAI,OAAO,YAAY;GACvD,MAAM,KAAK,SAAS,CAAC,CAAC,gBAAgB,eAAe,gBAAgB,IAAI;GACzE,IAAI,CAAE,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE,GACjD,MAAM,KAAK,SAAS,CAAC,CAAC,WAAW,KAAK,gBAAgB,IAAI;EAE9D,CAAC;EACD,MAAM,UAAU,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC7D,IAAI,CAAC,SAAS;GACZ,KAAK,OAAO,KAAK,iDAAiD;IAChE,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,qCAAqC;EACvE;EACA,KAAK,OAAO,KAAK,oBAAoB;GAAE,OAAO,IAAI;GAAO,UAAU;GAAI;EAAK,CAAC;EAC7E,OAAO,SAAS,OAAO;CACzB;CAEA,QACE,OACA,WACA,QACA,OACY;EACZ,OAAO,KAAK,aAAa,IAAI;GAAE;GAAW,gBAAgB,MAAM;GAAI;EAAO,GAAG,KAAK;CACrF;CAEA,YAAoB,WAA4C;EAC9D,MAAM,QAAQ,KAAK,aAAa,SAAS;EACzC,OAAO,OAAO,cAAc,YAAY,QAAQ,KAAA;CAClD;CAEA,mBAA2B,OAAc,OAAqB;EAC5D,IAAI,WAAW,MAAM,MAAM,cAAc,MAAM,MAAM;GACnD,KAAK,OAAO,KAAK,oDAAoD;IACnE;IACA,gBAAgB,MAAM;GACxB,CAAC;GACD,MAAM,IAAI,eAAe,2CAA2C;EACtE;CACF;CAEA,eAAuB,MAAY,OAAqB;EACtD,IAAI,SAAS,SAAS;GACpB,KAAK,OAAO,KAAK,kDAAkD,EAAE,MAAM,CAAC;GAC5E,MAAM,IAAI,sBAAsB,6BAA6B;EAC/D;CACF;CAEA,MAAM,aAAa,KAAyB,OAAc,IAA8B;EACtF,KAAK,mBAAmB,OAAO,IAAI,KAAK;EACxC,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO;EAET,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,oDAAoD;IACnE,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,6BAA6B;EAC/D;EACA,IAAI,OAAO,SAAS,YAAY,OAAO,gBACrC,MAAM,KAAK,SAAS,CAAC,CAAC,aAAa,KAAK,OAAO,cAAc;OACxD,IAAI,OAAO,SAAS,YAAY,OAAO,UAAU;GACtD,MAAM,WAAW,OAAO;GACxB,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;IACtD,MAAM,WAAW,MAAM,cAAc,gBAAgB,IAAI,OAAO,UAAU,UAAU;IACpF,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,UAAU,QAAQ;IAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KAAE,OAAO,IAAI;KAAO,MAAM;IAAS,CAAC,CAC7E,CAAC;GACH,CAAC;EACH;EACA,KAAK,OAAO,KAAK,kBAAkB;GAAE,OAAO,IAAI;GAAO,UAAU;EAAG,CAAC;EACrE,OAAO;CACT;AACF"}