@headless-lms/core 0.1.0

package/dist/organizations/events.js

@@ -0,0 +1,59 @@
+import { inviteSchema, orgUserSchema, organizationSchema } from "../types/schemas/organizations.js";
+import { defineEvent } from "../shared/events.js";
+//#region src/organizations/events.ts
+const organizationEvents = {
+	organizationCreated: defineEvent({
+		type: "organization.created",
+		version: 1,
+		data: organizationSchema
+	}),
+	organizationUpdated: defineEvent({
+		type: "organization.updated",
+		version: 1,
+		data: organizationSchema
+	}),
+	organizationDeleted: defineEvent({
+		type: "organization.deleted",
+		version: 1,
+		data: organizationSchema
+	}),
+	orgUserLinked: defineEvent({
+		type: "organization.user.linked",
+		version: 1,
+		data: orgUserSchema
+	}),
+	orgUserDeleted: defineEvent({
+		type: "organization.user.deleted",
+		version: 1,
+		data: orgUserSchema
+	}),
+	inviteCreated: defineEvent({
+		type: "organization.invite.created",
+		version: 1,
+		data: inviteSchema
+	}),
+	inviteAccepted: defineEvent({
+		type: "organization.invite.accepted",
+		version: 1,
+		data: inviteSchema
+	}),
+	studentCreated: defineEvent({
+		type: "organization.student.created",
+		version: 1,
+		data: orgUserSchema
+	}),
+	studentDeleted: defineEvent({
+		type: "organization.student.deleted",
+		version: 1,
+		data: orgUserSchema
+	}),
+	studentLinked: defineEvent({
+		type: "organization.student.linked",
+		version: 1,
+		data: orgUserSchema
+	})
+};
+//#endregion
+export { organizationEvents };
+
+//# sourceMappingURL=events.js.map

package/dist/organizations/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","names":[],"sources":["../../src/organizations/events.ts"],"sourcesContent":["import {\n  inviteSchema,\n  organizationSchema,\n  orgUserSchema,\n} from '../types/schemas/index.js';\nimport { defineEvent, type EventOf, type EventOfValues } from '../shared/ports.js';\n\nexport const organizationEvents = {\n  organizationCreated: defineEvent({\n    type: 'organization.created',\n    version: 1,\n    data: organizationSchema,\n  }),\n  organizationUpdated: defineEvent({\n    type: 'organization.updated',\n    version: 1,\n    data: organizationSchema,\n  }),\n  organizationDeleted: defineEvent({\n    type: 'organization.deleted',\n    version: 1,\n    data: organizationSchema,\n  }),\n  orgUserLinked: defineEvent({\n    type: 'organization.user.linked',\n    version: 1,\n    data: orgUserSchema,\n  }),\n  orgUserDeleted: defineEvent({\n    type: 'organization.user.deleted',\n    version: 1,\n    data: orgUserSchema,\n  }),\n  inviteCreated: defineEvent({\n    type: 'organization.invite.created',\n    version: 1,\n    data: inviteSchema,\n  }),\n  inviteAccepted: defineEvent({\n    type: 'organization.invite.accepted',\n    version: 1,\n    data: inviteSchema,\n  }),\n  studentCreated: defineEvent({\n    type: 'organization.student.created',\n    version: 1,\n    data: orgUserSchema,\n  }),\n  studentDeleted: defineEvent({\n    type: 'organization.student.deleted',\n    version: 1,\n    data: orgUserSchema,\n  }),\n  studentLinked: defineEvent({\n    type: 'organization.student.linked',\n    version: 1,\n    data: orgUserSchema,\n  }),\n};\n\nexport type OrganizationCreated = EventOf<typeof organizationEvents.organizationCreated>;\nexport type OrganizationUpdated = EventOf<typeof organizationEvents.organizationUpdated>;\nexport type OrganizationDeleted = EventOf<typeof organizationEvents.organizationDeleted>;\nexport type OrgUserLinked = EventOf<typeof organizationEvents.orgUserLinked>;\nexport type OrgUserDeleted = EventOf<typeof organizationEvents.orgUserDeleted>;\nexport type InviteCreated = EventOf<typeof organizationEvents.inviteCreated>;\nexport type InviteAccepted = EventOf<typeof organizationEvents.inviteAccepted>;\nexport type StudentCreated = EventOf<typeof organizationEvents.studentCreated>;\nexport type StudentDeleted = EventOf<typeof organizationEvents.studentDeleted>;\nexport type StudentLinked = EventOf<typeof organizationEvents.studentLinked>;\nexport type OrganizationEvent = EventOfValues<typeof organizationEvents>;\n"],"mappings":";;;AAOA,MAAa,qBAAqB;CAChC,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;AACH"}

package/dist/organizations/index.d.ts

@@ -0,0 +1,11 @@
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, InviteRole, NewOrganizationInput, OrgUser, OrgUserStatus, Organization, Role } from "../types/schemas/organizations.js";
+import { InviteId, OrgUserId, OrganizationId } from "../types/organizations.js";
+import { AuthHeaders } from "../identity/ports.js";
+import { InviteAccepted, InviteCreated, OrgUserDeleted, OrgUserLinked, OrganizationCreated, OrganizationDeleted, OrganizationEvent, OrganizationUpdated, StudentCreated, StudentDeleted, StudentLinked, organizationEvents } from "./events.js";
+import "./model.js";
+import { Capability, Permission, ROLES, STAFF_ROLES, STUDENT_ROLE, StaffRole, capability, isRole, isStaffRole, normalizeRole, parseRole } from "./roles.js";
+import { Member, MemberStatus, MembersQuery, OrganizationRuleError, Page } from "./members.js";
+import { CreateOrganizationInput, LinkOrgUserInput, ResendStudentInviteInput, UnlinkOrgUserInput, UpdateOrganizationInput, UpdatePersonInput, UpdateStudentInput } from "./types.js";
+import { AuthOrganization, MemberRecord, MemberWriteContext, MembersRepository, NewInviteRow, NewOrganizationRow, OrgAdmin, OrganizationService, OrganizationsRepository } from "./ports.js";
+import { OrganizationServiceImpl } from "./service.js";
+export { type AcceptInviteInput, type AddOrgUserInput, type AuthHeaders, type AuthOrganization, type Capability, type CreateInviteInput, type CreateOrgUserInput, type CreateOrganizationInput, type Invite, type InviteAccepted, type InviteCreated, type InviteId, type InviteRole, type LinkOrgUserInput, type Member, type MemberRecord, type MemberStatus, type MemberWriteContext, type MembersQuery, type MembersRepository, type NewInviteRow, type NewOrganizationInput, type NewOrganizationRow, type OrgAdmin, type OrgUser, type OrgUserDeleted, type OrgUserId, type OrgUserLinked, type OrgUserStatus, type Organization, type OrganizationCreated, type OrganizationDeleted, type OrganizationEvent, type OrganizationId, OrganizationRuleError, type OrganizationService, OrganizationServiceImpl, type OrganizationUpdated, type OrganizationsRepository, type Page, type Permission, ROLES, type ResendStudentInviteInput, type Role, STAFF_ROLES, STUDENT_ROLE, type StaffRole, type StudentCreated, type StudentDeleted, type StudentLinked, type UnlinkOrgUserInput, type UpdateOrganizationInput, type UpdatePersonInput, type UpdateStudentInput, capability, isRole, isStaffRole, normalizeRole, organizationEvents, parseRole };

package/dist/organizations/index.js

@@ -0,0 +1,5 @@
+import { ROLES, STAFF_ROLES, STUDENT_ROLE, capability, isRole, isStaffRole, normalizeRole, parseRole } from "./roles.js";
+import { OrganizationRuleError } from "./members.js";
+import { organizationEvents } from "./events.js";
+import { OrganizationServiceImpl } from "./service.js";
+export { OrganizationRuleError, OrganizationServiceImpl, ROLES, STAFF_ROLES, STUDENT_ROLE, capability, isRole, isStaffRole, normalizeRole, organizationEvents, parseRole };

package/dist/organizations/members.d.ts

@@ -0,0 +1,32 @@
+import { OrgUserProfile } from "../types/schemas/organizations.js";
+import "../types/index.js";
+import { StaffRole } from "./roles.js";
+//#region src/organizations/members.d.ts
+type MemberStatus = 'active' | 'invited';
+interface Member extends OrgUserProfile {
+  role: StaffRole;
+  status: MemberStatus;
+  joinedAt: string | null;
+  invitedAt: string | null;
+}
+interface MembersQuery {
+  page: number;
+  pageSize: number;
+  search?: string | undefined;
+  sort?: string | undefined;
+  role?: StaffRole | undefined;
+  status?: MemberStatus | undefined;
+}
+interface Page<T> {
+  rows: T[];
+  total: number;
+  page: number;
+  pageSize: number;
+}
+declare class OrganizationRuleError extends Error {}
+declare class InviteError extends Error {
+  constructor(message: string);
+}
+//#endregion
+export { InviteError, Member, MemberStatus, MembersQuery, OrganizationRuleError, Page };
+//# sourceMappingURL=members.d.ts.map

package/dist/organizations/members.js

@@ -0,0 +1,12 @@
+//#region src/organizations/members.ts
+var OrganizationRuleError = class extends Error {};
+var InviteError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InviteError";
+	}
+};
+//#endregion
+export { InviteError, OrganizationRuleError };
+
+//# sourceMappingURL=members.js.map

package/dist/organizations/members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.js","names":[],"sources":["../../src/organizations/members.ts"],"sourcesContent":["// organizations context — member-management types (invite / change-role / remove).\n// The operational surface over the org's members and pending invites. Roles\n// come from ./roles.ts (the single role model); writes go through Better Auth.\nimport type { StaffRole } from './roles.js';\nimport type { OrgUserProfile } from '../types/index.js';\n\nexport type MemberStatus = 'active' | 'invited';\n\nexport interface Member extends OrgUserProfile {\n  role: StaffRole;\n  status: MemberStatus;\n  joinedAt: string | null;\n  invitedAt: string | null;\n}\n\nexport interface MembersQuery {\n  page: number;\n  pageSize: number;\n  search?: string | undefined;\n  sort?: string | undefined;\n  role?: StaffRole | undefined;\n  status?: MemberStatus | undefined;\n}\n\nexport interface Page<T> {\n  rows: T[];\n  total: number;\n  page: number;\n  pageSize: number;\n}\n\n\nexport class OrganizationRuleError extends Error {}\nexport class InviteError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'InviteError';\n  }\n}\n"],"mappings":";AAgCA,IAAa,wBAAb,cAA2C,MAAM,CAAC;AAClD,IAAa,cAAb,cAAiC,MAAM;CACrC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF"}

package/dist/organizations/model.d.ts

@@ -0,0 +1,3 @@
+import { Invite, OrgUser, Organization } from "../types/schemas/organizations.js";
+import "../types/index.js";
+export type { Invite, OrgUser, Organization };

package/dist/organizations/model.js

@@ -0,0 +1 @@
+export {};

package/dist/organizations/ports.d.ts

@@ -0,0 +1,127 @@
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, InviteRole, NewOrganizationInput, OrgUser, Organization, Role } from "../types/schemas/organizations.js";
+import { OutboxAppender, UnitOfWork } from "../shared/ports.js";
+import { AuthHeaders } from "../identity/ports.js";
+import "../identity/index.js";
+import "./model.js";
+import "./roles.js";
+import { Member, MembersQuery, Page } from "./members.js";
+import { CreateOrganizationInput, ResendStudentInviteInput, UpdateOrganizationInput, UpdateStudentInput } from "./types.js";
+//#region src/organizations/ports.d.ts
+interface OrganizationService {
+  createOrganization(input: CreateOrganizationInput): Promise<Organization>;
+  updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization>;
+  deleteOrganization(id: string): Promise<Organization>;
+  addOrgUser(input: AddOrgUserInput): Promise<OrgUser>;
+  removeOrgUser(orgId: string, id: string): Promise<OrgUser>;
+  getByExternalId(externalId: string): Promise<Organization | null>;
+  getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
+  getOrgUsersForUser(userId: string): Promise<OrgUser[]>;
+  getById(id: string): Promise<Organization | null>;
+  createInvite(input: CreateInviteInput): Promise<Invite>;
+  peekInvite(token: string): Promise<Invite | null>;
+  acceptInvite(input: AcceptInviteInput): Promise<OrgUser>;
+  deleteOrgUser(orgId: string, id: string): Promise<OrgUser>;
+  resendStudentInvite(input: ResendStudentInviteInput): Promise<void>;
+  updateStudent(input: UpdateStudentInput): Promise<OrgUser>;
+  getBySlug(slug: string): Promise<Organization | null>;
+  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>>;
+  updateMemberRole(ctx: MemberWriteContext, id: string, role: Role): Promise<Member | null>;
+  removeMember(ctx: MemberWriteContext, id: string): Promise<boolean>;
+}
+/** Atomic write scope: tx-bound repo + outbox appender, one transaction. */
+interface OrganizationsWriteScope {
+  organizations: OrganizationsRepository;
+  outbox: OutboxAppender;
+}
+type OrganizationsUnitOfWork = UnitOfWork<OrganizationsWriteScope>;
+/** Repo-facing write shape for a new org row. The service mints the id and
+ *  resolves the defaults, so nothing is optional by the time it lands here. */
+interface NewOrganizationRow {
+  id: string;
+  externalId?: string | null;
+  name: string;
+  slug: string;
+  ownerId: string;
+}
+/** Repo-facing write shape for a freshly minted invite. */
+interface NewInviteRow {
+  email: string;
+  role: InviteRole;
+  invitedBy: string;
+  tokenHash: string;
+  expiresAt: Date;
+}
+interface OrganizationsRepository {
+  create(input: NewOrganizationRow): Promise<Organization>;
+  update(id: string, input: UpdateOrganizationInput): Promise<Organization | null>;
+  /** Drops the org row and its dependents; null when none matched. */
+  delete(id: string): Promise<Organization>;
+  findById(id: string): Promise<Organization | null>;
+  findByExternalId(externalId: string): Promise<Organization | null>;
+  findBySlug(slug: string): Promise<Organization | null>;
+  upsertOrgUser(orgId: string, input: AddOrgUserInput): Promise<OrgUser>;
+  /** Inserts a pending invite, or re-issues the org's existing pending one
+   *  for this email (fresh token/expiry/role) — atomic upsert. */
+  upsertPendingInvite(orgId: string, input: NewInviteRow): Promise<Invite>;
+  setInviteStatus(orgId: string, id: string, status: string): Promise<Invite | null>;
+  findInviteByTokenHash(tokenHash: string): Promise<Invite | null>;
+  /** The person's row in one org. `(org_id, user_id)` is unique. */
+  findOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
+  /** Every org this person belongs to, oldest first. */
+  findOrgUsersByUser(userId: string): Promise<OrgUser[]>;
+  findOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
+  /** Links a user to the org under a role. Throws ConflictError when they
+   *  already hold a row there. */
+  createOrgUser(input: CreateOrgUserInput): Promise<OrgUser>;
+  /** createOrgUser, but idempotent on `(org_id, user_id)`: an existing row is
+   *  promoted to the requested status rather than refused. `created` says
+   *  whether a row appeared, so `student.created` fires exactly once. */
+  ensureOrgUser(input: CreateOrgUserInput): Promise<{
+    orgUser: OrgUser;
+    created: boolean;
+  }>;
+  /** Every org this person is a student in — the scope of `student.linked`. */
+  findStudentOrgUsers(userId: string): Promise<OrgUser[]>;
+  /** Kills the org's pending invite for an address, if any. */
+  cancelPendingInvite(orgId: string, email: string): Promise<Invite | null>;
+  deleteOrgUser(orgId: string, id: string): Promise<OrgUser | null>;
+}
+/** A member row enriched with the ids needed to drive writes. */
+interface MemberRecord extends Member {
+  kind: 'member' | 'invite';
+  userExternalId: string | null;
+  inviteId: string | null;
+}
+interface MembersRepository {
+  list(orgId: string, query: MembersQuery): Promise<Page<Member>>;
+  findByEmail(orgId: string, email: string): Promise<MemberRecord | null>;
+  findById(orgId: string, id: string): Promise<MemberRecord | null>;
+}
+/** The person as this context reads them back after a correction. */
+interface PersonRecord {
+  id: string;
+  email: string;
+  firstName: string | null;
+  lastName: string | null;
+}
+/** Context for a write: domain org (reads/rules) + auth org & session (writes). */
+interface MemberWriteContext {
+  orgId: string;
+  authOrgId: string;
+  headers: Record<string, string | string[] | undefined>;
+}
+/** The provider's view of an org: what it stores itself, minus the fields only
+ *  the domain row carries (`ownerId`, `externalId`, `updatedAt`). */
+type AuthOrganization = Pick<Organization, 'id' | 'name' | 'slug' | 'createdAt'>;
+interface OrgAdmin {
+  createOrganization(headers: AuthHeaders, input: NewOrganizationInput): Promise<AuthOrganization>;
+  setActiveOrganization(headers: AuthHeaders, externalId: string): Promise<void>;
+  updateOrganization(headers: AuthHeaders, id: string, input: UpdateOrganizationInput): Promise<AuthOrganization>;
+  deleteOrganization(headers: AuthHeaders, externalId: string): Promise<void>;
+  grantMembership(orgExternalId: string, userExternalId: string, role: string): Promise<void>;
+  updateRole(ctx: MemberWriteContext, userExternalId: string, role: Role): Promise<void>;
+  removeMember(ctx: MemberWriteContext, userExternalId: string): Promise<void>;
+}
+//#endregion
+export { type AuthHeaders, AuthOrganization, MemberRecord, MemberWriteContext, MembersRepository, NewInviteRow, NewOrganizationRow, OrgAdmin, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork, OrganizationsWriteScope, PersonRecord };
+//# sourceMappingURL=ports.d.ts.map

package/dist/organizations/ports.js

@@ -0,0 +1 @@
+export {};

package/dist/organizations/roles.d.ts

@@ -0,0 +1,23 @@
+import { Role } from "../types/schemas/organizations.js";
+import "../types/index.js";
+//#region src/organizations/roles.d.ts
+declare const ROLES: readonly ["owner", "admin", "instructor", "student"];
+/**
+ * The roles that operate the back office. `student` belongs to the org but
+ * never appears on a staff surface, so the member-management types are typed
+ * with this narrower union — the exclusion is a compiler guarantee, not a
+ * convention a query has to remember.
+ */
+type StaffRole = Exclude<Role, 'student'>;
+declare const STAFF_ROLES: readonly ["owner", "admin", "instructor"];
+declare function isRole(value: string): value is Role;
+declare function isStaffRole(value: string): value is StaffRole;
+declare function parseRole(value: string): Role;
+type Permission = 'manage_billing' | 'manage_org_settings' | 'manage_users' | 'create_course' | 'edit_assigned_course' | 'view_student_progress' | 'consume_content';
+type Capability = true | 'assigned' | 'enrolled';
+declare function capability(role: Role, permission: Permission): Capability | false;
+declare function normalizeRole(raw: string): Role;
+declare const STUDENT_ROLE = "student";
+//#endregion
+export { Capability, Permission, ROLES, type Role, STAFF_ROLES, STUDENT_ROLE, StaffRole, capability, isRole, isStaffRole, normalizeRole, parseRole };
+//# sourceMappingURL=roles.d.ts.map

package/dist/organizations/roles.js

@@ -0,0 +1,70 @@
+//#region src/organizations/roles.ts
+const ROLES = [
+	"owner",
+	"admin",
+	"instructor",
+	"student"
+];
+const STAFF_ROLES = [
+	"owner",
+	"admin",
+	"instructor"
+];
+function isRole(value) {
+	return ROLES.includes(value);
+}
+function isStaffRole(value) {
+	return STAFF_ROLES.includes(value);
+}
+function parseRole(value) {
+	if (!isRole(value)) throw new Error(`unknown role: ${value}`);
+	return value;
+}
+const MATRIX = {
+	owner: {
+		manage_billing: true,
+		manage_org_settings: true,
+		manage_users: true,
+		create_course: true,
+		edit_assigned_course: true,
+		view_student_progress: true
+	},
+	admin: {
+		manage_org_settings: true,
+		manage_users: true,
+		create_course: true,
+		edit_assigned_course: true,
+		view_student_progress: true
+	},
+	instructor: {
+		edit_assigned_course: "assigned",
+		view_student_progress: "assigned"
+	},
+	student: { consume_content: "enrolled" }
+};
+function capability(role, permission) {
+	return MATRIX[role][permission] ?? false;
+}
+const RANK = {
+	owner: 3,
+	admin: 2,
+	instructor: 1,
+	student: 0
+};
+function normalizeRole(raw) {
+	let best = "instructor";
+	let bestRank = -1;
+	for (const token of raw.split(",").map((t) => t.trim())) {
+		const r = isRole(token) ? token : token === "member" ? "instructor" : null;
+		if (r && RANK[r] > bestRank) {
+			best = r;
+			bestRank = RANK[r];
+		}
+	}
+	return best;
+}
+const STUDENT_ROLE = "student";
+//#endregion
+export { ROLES, STAFF_ROLES, STUDENT_ROLE, capability, isRole, isStaffRole, normalizeRole, parseRole };
+
+//# sourceMappingURL=roles.js.map

package/dist/organizations/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","names":[],"sources":["../../src/organizations/roles.ts"],"sourcesContent":["// organizations context — roles and the authorization matrix.\n// Defined in code (no DB enum). The DB stores role as text; the domain narrows\n// it to Role and answers authorization questions here. The Role type itself is\n// owned by @headless-lms/core/types; RANK/MATRIX below are Record<Role, …>, so the\n// compiler forces this file to cover every role the published type declares.\nimport type { Role } from '../types/index.js';\n\nexport type { Role };\nexport const ROLES = [\n  'owner',\n  'admin',\n  'instructor',\n  'student',\n] as const satisfies readonly Role[];\n\n/**\n * The roles that operate the back office. `student` belongs to the org but\n * never appears on a staff surface, so the member-management types are typed\n * with this narrower union — the exclusion is a compiler guarantee, not a\n * convention a query has to remember.\n */\nexport type StaffRole = Exclude<Role, 'student'>;\nexport const STAFF_ROLES = ['owner', 'admin', 'instructor'] as const satisfies readonly StaffRole[];\n\nexport function isRole(value: string): value is Role {\n  return (ROLES as readonly string[]).includes(value);\n}\n\nexport function isStaffRole(value: string): value is StaffRole {\n  return (STAFF_ROLES as readonly string[]).includes(value);\n}\n\nexport function parseRole(value: string): Role {\n  if (!isRole(value)) {\n    throw new Error(`unknown role: ${value}`);\n  }\n  return value;\n}\n\nexport type Permission =\n  | 'manage_billing'\n  | 'manage_org_settings'\n  | 'manage_users'\n  | 'create_course'\n  | 'edit_assigned_course'\n  | 'view_student_progress'\n  | 'consume_content';\n\n// Unconditional (true), course-scoped (\"assigned\"), or enrollment-scoped\n// (\"enrolled\" — access owned by entitlements). Absent ⇒ denied.\n//\n// \"assigned\" is a granted-but-narrowed answer: the role holds the permission,\n// but only over some subset of courses. Nothing narrows it today — there is no\n// course-assignment store — so callers must decide what a narrowed grant means\n// for them. `authorize` treats it as denied; `tools.ts` treats it as granted.\nexport type Capability = true | 'assigned' | 'enrolled';\n\nconst MATRIX: Record<Role, Partial<Record<Permission, Capability>>> = {\n  owner: {\n    manage_billing: true,\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n  },\n  admin: {\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n  },\n  instructor: {\n    edit_assigned_course: 'assigned',\n    view_student_progress: 'assigned',\n  },\n  // A learner belongs to the org to consume content they hold an\n  // entitlement for. No management capability of any kind.\n  student: {\n    consume_content: 'enrolled',\n  },\n};\n\nexport function capability(role: Role, permission: Permission): Capability | false {\n  return MATRIX[role][permission] ?? false;\n}\n\n// Better Auth's role model is broader than ours: it keeps a built-in `member`\n// role and allows comma-joined multi-role strings. Normalize any incoming role\n// string to a single domain Role before persisting: `member` -> `instructor`, a\n// multi-role string -> its highest-privilege known role, unknown -> `instructor`.\nconst RANK: Record<Role, number> = { owner: 3, admin: 2, instructor: 1, student: 0 };\n\nexport function normalizeRole(raw: string): Role {\n  let best: Role = 'instructor';\n  let bestRank = -1;\n  for (const token of raw.split(',').map((t) => t.trim())) {\n    const r: Role | null = isRole(token) ? token : token === 'member' ? 'instructor' : null;\n    if (r && RANK[r] > bestRank) {\n      best = r;\n      bestRank = RANK[r];\n    }\n  }\n  return best;\n}\n\n// Invites carry either a staff Role or this marker: the invited account is\n// a portal student, not an org member. Owned by the organizations domain — the\n// invite provider adapter reuses it to branch links, emails, and grants.\nexport const STUDENT_ROLE = 'student';\n"],"mappings":";AAQA,MAAa,QAAQ;CACnB;CACA;CACA;CACA;AACF;AASA,MAAa,cAAc;CAAC;CAAS;CAAS;AAAY;AAE1D,SAAgB,OAAO,OAA8B;CACnD,OAAQ,MAA4B,SAAS,KAAK;AACpD;AAEA,SAAgB,YAAY,OAAmC;CAC7D,OAAQ,YAAkC,SAAS,KAAK;AAC1D;AAEA,SAAgB,UAAU,OAAqB;CAC7C,IAAI,CAAC,OAAO,KAAK,GACf,MAAM,IAAI,MAAM,iBAAiB,OAAO;CAE1C,OAAO;AACT;AAoBA,MAAM,SAAgE;CACpE,OAAO;EACL,gBAAgB;EAChB,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;CACzB;CACA,OAAO;EACL,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;CACzB;CACA,YAAY;EACV,sBAAsB;EACtB,uBAAuB;CACzB;CAGA,SAAS,EACP,iBAAiB,WACnB;AACF;AAEA,SAAgB,WAAW,MAAY,YAA4C;CACjF,OAAO,OAAO,KAAK,CAAC,eAAe;AACrC;AAMA,MAAM,OAA6B;CAAE,OAAO;CAAG,OAAO;CAAG,YAAY;CAAG,SAAS;AAAE;AAEnF,SAAgB,cAAc,KAAmB;CAC/C,IAAI,OAAa;CACjB,IAAI,WAAW;CACf,KAAK,MAAM,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,CAAC,GAAG;EACvD,MAAM,IAAiB,OAAO,KAAK,IAAI,QAAQ,UAAU,WAAW,eAAe;EACnF,IAAI,KAAK,KAAK,KAAK,UAAU;GAC3B,OAAO;GACP,WAAW,KAAK;EAClB;CACF;CACA,OAAO;AACT;AAKA,MAAa,eAAe"}

package/dist/organizations/service.d.ts

@@ -0,0 +1,58 @@
+import { Logger } from "../types/ports.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, Invite, OrgUser, Organization, Role } from "../types/schemas/organizations.js";
+import "../shared/ports.js";
+import { Mailer } from "../shared/mailer.js";
+import { IdentityService } from "../identity/ports.js";
+import "../identity/index.js";
+import "./model.js";
+import "./roles.js";
+import { Member, MembersQuery, Page } from "./members.js";
+import { CreateOrganizationInput, ResendStudentInviteInput, UpdateOrganizationInput, UpdateStudentInput } from "./types.js";
+import { MemberWriteContext, MembersRepository, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork } from "./ports.js";
+//#region src/organizations/service.d.ts
+interface InviteUrls {
+  studentPortalUrl: string;
+  adminAppUrl: string;
+}
+type OrganizationServiceParams = {
+  repo: OrganizationsRepository;
+  membersRepo: MembersRepository;
+  people: IdentityService;
+  uow: OrganizationsUnitOfWork;
+  logger?: Logger;
+  mailer?: Pick<Mailer, 'send'>;
+  inviteUrls?: InviteUrls;
+};
+declare class OrganizationServiceImpl implements OrganizationService {
+  private readonly repo;
+  private readonly membersRepo;
+  private readonly people;
+  private readonly uow;
+  private readonly logger;
+  private readonly mailer?;
+  private readonly inviteUrls?;
+  constructor(params: OrganizationServiceParams);
+  createOrganization(input: CreateOrganizationInput): Promise<Organization>;
+  updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization>;
+  deleteOrganization(id: string): Promise<Organization>;
+  addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser>;
+  removeOrgUser(orgId: string, id: string): Promise<OrgUser>;
+  createInvite(input: CreateInviteInput): Promise<Invite>;
+  updateStudent(input: UpdateStudentInput): Promise<OrgUser>;
+  resendStudentInvite(input: ResendStudentInviteInput): Promise<void>;
+  peekInvite(token: string): Promise<Invite | null>;
+  acceptInvite(input: AcceptInviteInput): Promise<OrgUser>;
+  getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
+  deleteOrgUser(orgId: string, id: string): Promise<OrgUser>;
+  getOrgUsersForUser(userId: string): Promise<OrgUser[]>;
+  getById(id: string): Promise<Organization | null>;
+  private sendInviteEmail;
+  getByExternalId(externalId: string): Promise<Organization | null>;
+  getBySlug(slug: string): Promise<Organization | null>;
+  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>>;
+  updateMemberRole(ctx: MemberWriteContext, id: string, role: Role): Promise<Member | null>;
+  removeMember(_ctx: MemberWriteContext, _id: string): Promise<boolean>;
+}
+//#endregion
+export { InviteUrls, OrganizationServiceImpl, OrganizationServiceParams };
+//# sourceMappingURL=service.d.ts.map