@headless-lms/core 0.1.0

package/dist/organizations/service.js

@@ -0,0 +1,359 @@
+import { genId } from "../shared/id.js";
+import { noopLogger } from "../shared/logger.js";
+import { NotFoundError } from "../shared/errors.js";
+import { STUDENT_ROLE } from "./roles.js";
+import { InviteError, OrganizationRuleError } from "./members.js";
+import { organizationEvents } from "./events.js";
+import { generateInviteToken, hashInviteToken } from "../shared/invite-token.js";
+//#region src/organizations/service.ts
+const INVITE_TTL_MS = 10080 * 60 * 1e3;
+function toMember(r) {
+	return {
+		id: r.id,
+		firstName: r.firstName,
+		lastName: r.lastName,
+		email: r.email,
+		image: r.image,
+		role: r.role,
+		status: r.status,
+		joinedAt: r.joinedAt,
+		invitedAt: r.invitedAt
+	};
+}
+var OrganizationServiceImpl = class {
+	repo;
+	membersRepo;
+	people;
+	uow;
+	logger;
+	mailer;
+	inviteUrls;
+	constructor(params) {
+		this.repo = params.repo;
+		this.membersRepo = params.membersRepo;
+		this.people = params.people;
+		this.uow = params.uow;
+		this.logger = params.logger ?? noopLogger;
+		this.mailer = params.mailer;
+		this.inviteUrls = params.inviteUrls;
+	}
+	async createOrganization(input) {
+		const created = await this.uow.run(async ({ organizations, outbox }) => {
+			const id = genId("organization");
+			const created = await organizations.create({
+				id,
+				externalId: input.externalId ?? id,
+				name: input.name ?? `My Org`,
+				slug: input.slug ?? "",
+				ownerId: input.ownerId
+			});
+			await outbox.append([organizationEvents.organizationCreated.make({
+				orgId: created.id,
+				data: created
+			})]);
+			return created;
+		});
+		this.logger.info("organization created", {
+			orgId: created.id,
+			slug: created.slug
+		});
+		return created;
+	}
+	async updateOrganization(id, input) {
+		const updatedOrg = await this.uow.run(async ({ organizations, outbox }) => {
+			const updated = await organizations.update(id, {
+				name: input.name,
+				slug: input.slug
+			});
+			if (!updated) throw new NotFoundError("Organization", id);
+			await outbox.append([organizationEvents.organizationUpdated.make({
+				orgId: id,
+				data: updated
+			})]);
+			return updated;
+		});
+		this.logger.info("organization updated", { updatedOrg });
+		return updatedOrg;
+	}
+	async deleteOrganization(id) {
+		const deleted = await this.uow.run(async ({ organizations, outbox }) => {
+			const deleted = await organizations.delete(id);
+			await outbox.append([organizationEvents.organizationDeleted.make({
+				orgId: deleted.id,
+				data: deleted
+			})]);
+			return deleted;
+		});
+		this.logger.info("organization deleted", { orgId: deleted.id });
+		return deleted;
+	}
+	async addOrgUser({ orgId, userId, role }) {
+		const orgUser = await this.uow.run(async ({ organizations, outbox }) => {
+			const created = await organizations.createOrgUser({
+				orgId,
+				role,
+				userId,
+				status: "active"
+			});
+			await outbox.append([organizationEvents.orgUserLinked.make({
+				orgId,
+				data: created
+			})]);
+			return created;
+		});
+		this.logger.info("user added to organization", {
+			orgId,
+			userId,
+			role
+		});
+		return orgUser;
+	}
+	async removeOrgUser(orgId, id) {
+		const deleted = await this.uow.run(async ({ organizations, outbox }) => {
+			const deletedUser = await organizations.deleteOrgUser(orgId, id);
+			if (!deletedUser) throw new NotFoundError("OrgUser", id);
+			await outbox.append([organizationEvents.orgUserDeleted.make({
+				orgId,
+				data: deletedUser
+			})]);
+			return deletedUser;
+		});
+		this.logger.info("organization deleted", { orgId: deleted.id });
+		return deleted;
+	}
+	async createInvite(input) {
+		const { orgId, email, role, inviterUserId, firstName, lastName } = input;
+		const sendEmail = input.sendEmail ?? true;
+		const { token, tokenHash } = generateInviteToken();
+		const expiresAt = new Date(Date.now() + INVITE_TTL_MS);
+		const person = role === "student" ? await this.people.createUser({
+			email,
+			...firstName !== void 0 && { firstName },
+			...lastName !== void 0 && { lastName }
+		}) : null;
+		const invite = await this.uow.run(async ({ organizations, outbox }) => {
+			const row = await organizations.upsertPendingInvite(orgId, {
+				email,
+				role,
+				invitedBy: inviterUserId,
+				tokenHash,
+				expiresAt
+			});
+			const events = [organizationEvents.inviteCreated.make({
+				orgId,
+				data: row
+			})];
+			if (person) {
+				const { orgUser, created } = await organizations.ensureOrgUser({
+					orgId,
+					userId: person.id,
+					role: STUDENT_ROLE,
+					status: "invited"
+				});
+				if (created) events.push(organizationEvents.studentCreated.make({
+					orgId,
+					data: orgUser
+				}));
+			}
+			await outbox.append(events);
+			return row;
+		});
+		if (sendEmail) await this.sendInviteEmail(invite, token);
+		this.logger.info("invite created", {
+			orgId,
+			inviteId: invite.id,
+			role,
+			sendEmail
+		});
+		return invite;
+	}
+	async updateStudent(input) {
+		const { orgId, orgUserId, firstName, lastName, email } = input;
+		const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);
+		if (!orgUser || orgUser.role !== "student") throw new NotFoundError("Student", orgUserId);
+		const person = await this.people.getUserById(orgUser.userId);
+		if (!person) throw new NotFoundError("User", orgUser.userId);
+		const previousEmail = person.email;
+		await this.people.updateUser(person.id, {
+			...firstName !== void 0 && { firstName },
+			...lastName !== void 0 && { lastName },
+			...email !== void 0 && { email }
+		});
+		const emailChanged = email !== void 0 && email.toLowerCase() !== previousEmail.toLowerCase();
+		if (emailChanged && orgUser.status !== "active") await this.repo.cancelPendingInvite(orgId, previousEmail);
+		this.logger.info("student updated", {
+			orgId,
+			orgUserId,
+			emailChanged
+		});
+		return orgUser;
+	}
+	async resendStudentInvite(input) {
+		const { orgId, orgUserId, inviterUserId } = input;
+		const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);
+		if (!orgUser || orgUser.role !== "student") throw new NotFoundError("Student", orgUserId);
+		if (orgUser.status === "active") throw new OrganizationRuleError("That student has already accepted their invitation");
+		const person = await this.people.getUserById(orgUser.userId);
+		if (!person) throw new NotFoundError("User", orgUser.userId);
+		await this.createInvite({
+			orgId,
+			email: person.email,
+			role: STUDENT_ROLE,
+			inviterUserId,
+			sendEmail: true
+		});
+		this.logger.info("student invite resent", {
+			orgId,
+			orgUserId
+		});
+	}
+	async peekInvite(token) {
+		const invite = await this.repo.findInviteByTokenHash(hashInviteToken(token));
+		if (!invite || invite.status !== "pending") return null;
+		if (invite.expiresAt && invite.expiresAt < /* @__PURE__ */ new Date()) return null;
+		return invite;
+	}
+	async acceptInvite(input) {
+		const invite = await this.peekInvite(input.token);
+		if (!invite) {
+			this.logger.warn("invite accept refused: token invalid or expired");
+			throw new InviteError("invalid invite");
+		}
+		if (invite.email.toLowerCase() !== input.email.toLowerCase()) {
+			this.logger.warn("invite accept refused: email mismatch", {
+				orgId: invite.orgId,
+				inviteId: invite.id
+			});
+			throw new InviteError("emails must match");
+		}
+		if (!await this.repo.findById(invite.orgId)) throw new InviteError("Org not found");
+		const orgUser = await this.uow.run(async ({ organizations, outbox }) => {
+			const { orgUser: row, created } = await organizations.ensureOrgUser({
+				orgId: invite.orgId,
+				userId: input.userId,
+				role: invite.role,
+				status: "active"
+			});
+			const acceptedInvite = await organizations.setInviteStatus(invite.orgId, invite.id, "accepted");
+			if (!acceptedInvite) throw new NotFoundError("Invite", invite.id);
+			const events = [organizationEvents.inviteAccepted.make({
+				orgId: invite.orgId,
+				data: acceptedInvite
+			})];
+			if (row.role === "student") events.push(created ? organizationEvents.studentCreated.make({
+				orgId: invite.orgId,
+				data: row
+			}) : organizationEvents.studentLinked.make({
+				orgId: invite.orgId,
+				data: row
+			}));
+			else if (created) events.push(organizationEvents.orgUserLinked.make({
+				orgId: invite.orgId,
+				data: row
+			}));
+			await outbox.append(events);
+			return row;
+		});
+		this.logger.info("invite accepted", {
+			orgId: invite.orgId,
+			userId: input.userId
+		});
+		return orgUser;
+	}
+	async getOrgUser(orgId, userId) {
+		return this.repo.findOrgUser(orgId, userId);
+	}
+	async deleteOrgUser(orgId, id) {
+		const deleted = await this.uow.run(async ({ organizations, outbox }) => {
+			const orgUser = await organizations.findOrgUserById(orgId, id);
+			if (!orgUser) throw new NotFoundError("OrgUser", id);
+			const deletedUser = await organizations.deleteOrgUser(orgId, id);
+			if (!deletedUser) throw new NotFoundError("OrgUser", id);
+			const events = [];
+			if (deletedUser.role === "student") events.push(organizationEvents.studentDeleted.make({
+				orgId,
+				data: orgUser
+			}));
+			await outbox.append(events);
+			return deletedUser;
+		});
+		this.logger.info("org user deleted", {
+			orgId,
+			orgUserId: id
+		});
+		return deleted;
+	}
+	async getOrgUsersForUser(userId) {
+		return this.repo.findOrgUsersByUser(userId);
+	}
+	async getById(id) {
+		return this.repo.findById(id);
+	}
+	async sendInviteEmail(invite, token) {
+		if (!this.mailer || !this.inviteUrls) throw new Error("invite delivery is not configured (mailer / invite urls missing)");
+		const { email, role } = invite;
+		const isStudent = role === STUDENT_ROLE;
+		const inviteUrl = `${isStudent ? `${this.inviteUrls.studentPortalUrl}/welcome` : `${this.inviteUrls.adminAppUrl}/invite`}?${(isStudent ? new URLSearchParams({ token }) : new URLSearchParams({
+			token,
+			email
+		})).toString()}`;
+		try {
+			if (role === "student") await this.mailer.send(email, "studentInvite", {
+				inviteUrl,
+				studentName: email
+			});
+			else await this.mailer.send(email, "memberInvite", {
+				inviteUrl,
+				inviterName: "Your team",
+				role
+			});
+		} catch (err) {
+			this.logger.error("failed to send invite email", {
+				email,
+				role,
+				err: err instanceof Error ? err : new Error(String(err))
+			});
+		}
+	}
+	async getByExternalId(externalId) {
+		return this.repo.findByExternalId(externalId);
+	}
+	async getBySlug(slug) {
+		return this.repo.findBySlug(slug);
+	}
+	listMembers(orgId, query) {
+		return this.membersRepo.list(orgId, query);
+	}
+	async updateMemberRole(ctx, id, role) {
+		const member = await this.membersRepo.findById(ctx.orgId, id);
+		if (!member) return null;
+		if (member.role === "owner") {
+			this.logger.warn("role change rejected: owner role immutable", {
+				orgId: ctx.orgId,
+				memberId: id
+			});
+			throw new OrganizationRuleError("The owner role cannot be reassigned");
+		}
+		if (member.kind !== "member" || !member.userExternalId) {
+			this.logger.warn("role change rejected: not an active member", {
+				orgId: ctx.orgId,
+				memberId: id
+			});
+			throw new OrganizationRuleError("Only active members can have their role changed");
+		}
+		const updated = await this.membersRepo.findById(ctx.orgId, id);
+		this.logger.info("member role updated", {
+			orgId: ctx.orgId,
+			memberId: id,
+			role
+		});
+		return updated ? toMember(updated) : null;
+	}
+	async removeMember(_ctx, _id) {
+		return true;
+	}
+};
+//#endregion
+export { OrganizationServiceImpl };
+
+//# sourceMappingURL=service.js.map

package/dist/organizations/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","names":[],"sources":["../../src/organizations/service.ts"],"sourcesContent":["// organizations context — service implementation (inbound port).\nimport type {\n  MemberRecord,\n  MembersRepository,\n  MemberWriteContext,\n  OrganizationService,\n  OrganizationsRepository,\n  OrganizationsUnitOfWork,\n} from './ports.js';\nimport type { Invite, Organization, OrgUser } from './model.js';\nimport { type Role, STUDENT_ROLE } from './roles.js';\nimport {\n  InviteError,\n  type Member,\n  type MembersQuery,\n  OrganizationRuleError,\n  type Page,\n} from './members.js';\nimport type {\n  AcceptInviteInput,\n  AddOrgUserInput,\n  CreateInviteInput,\n  CreateOrganizationInput,\n  ResendStudentInviteInput,\n  UpdateOrganizationInput,\n  UpdateStudentInput,\n} from './types.js';\nimport { organizationEvents, type OrganizationEvent } from './events.js';\nimport type { Logger, NewDomainEvent } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport { generateInviteToken, hashInviteToken } from '../shared/invite-token.js';\nimport { NotFoundError } from '../shared/errors.js';\nimport type { IdentityService } from '../identity/index.js';\nimport { genId } from '../shared/id.js';\n\nconst INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ntype NewOrganizationEvent = NewDomainEvent<OrganizationEvent>;\n\nexport interface InviteUrls {\n  studentPortalUrl: string;\n  adminAppUrl: string;\n}\n\nfunction toMember(r: MemberRecord): Member {\n  return {\n    id: r.id,\n    firstName: r.firstName,\n    lastName: r.lastName,\n    email: r.email,\n    image: r.image,\n    role: r.role,\n    status: r.status,\n    joinedAt: r.joinedAt,\n    invitedAt: r.invitedAt,\n  };\n}\n\nexport type OrganizationServiceParams = {\n  repo: OrganizationsRepository;\n  membersRepo: MembersRepository;\n  people: IdentityService;\n  uow: OrganizationsUnitOfWork;\n  logger?: Logger;\n  mailer?: Pick<Mailer, 'send'>;\n  inviteUrls?: InviteUrls;\n};\n\nexport class OrganizationServiceImpl implements OrganizationService {\n  private readonly repo: OrganizationsRepository;\n  private readonly membersRepo: MembersRepository;\n  private readonly people: IdentityService;\n  private readonly uow: OrganizationsUnitOfWork;\n  private readonly logger: Logger;\n  private readonly mailer?: Pick<Mailer, 'send'>;\n  private readonly inviteUrls?: InviteUrls;\n\n  constructor(params: OrganizationServiceParams) {\n    this.repo = params.repo;\n    this.membersRepo = params.membersRepo;\n    this.people = params.people;\n    this.uow = params.uow;\n    this.logger = params.logger ?? noopLogger;\n    this.mailer = params.mailer;\n    this.inviteUrls = params.inviteUrls;\n  }\n\n  async createOrganization(input: CreateOrganizationInput): Promise<Organization> {\n    const created = await this.uow.run(async ({ organizations, outbox }) => {\n      const id = genId('organization');\n\n      const created = await organizations.create({\n        id,\n        // The auth provider adopts this id for its own org row, so the org is\n        // its own external id — a lookup by either id lands on the same row.\n        externalId: input.externalId ?? id,\n        name: input.name ?? `My Org`,\n        slug: input.slug ?? '',\n        ownerId: input.ownerId,\n      });\n      await outbox.append([\n        organizationEvents.organizationCreated.make({\n          orgId: created.id,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('organization created', { orgId: created.id, slug: created.slug });\n    return created;\n  }\n\n  async updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization> {\n    const updatedOrg = await this.uow.run(async ({ organizations, outbox }) => {\n      const updated = await organizations.update(id, {\n        name: input.name,\n        slug: input.slug,\n      });\n      if (!updated) {\n        throw new NotFoundError('Organization', id);\n      }\n      await outbox.append([\n        organizationEvents.organizationUpdated.make({ orgId: id, data: updated }),\n      ]);\n      return updated;\n    });\n\n    this.logger.info('organization updated', { updatedOrg });\n    return updatedOrg!;\n  }\n\n  async deleteOrganization(id: string): Promise<Organization> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const deleted = await organizations.delete(id);\n\n      await outbox.append([\n        organizationEvents.organizationDeleted.make({\n          orgId: deleted.id,\n          data: deleted,\n        }),\n      ]);\n      return deleted;\n    });\n    this.logger.info('organization deleted', { orgId: deleted.id });\n    return deleted;\n  }\n\n  async addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser> {\n    const orgUser = await this.uow.run(async ({ organizations, outbox }) => {\n      const created = await organizations.createOrgUser({ orgId, role, userId, status: 'active' });\n      await outbox.append([\n        organizationEvents.orgUserLinked.make({ orgId, data: created }),\n      ]);\n      return created;\n    });\n    this.logger.info('user added to organization', { orgId, userId, role });\n    return orgUser;\n  }\n\n  async removeOrgUser(orgId: string, id: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const deletedUser = await organizations.deleteOrgUser(orgId, id);\n      if (!deletedUser) {\n        throw new NotFoundError('OrgUser', id);\n      }\n      await outbox.append([\n        organizationEvents.orgUserDeleted.make({\n          orgId,\n          data: deletedUser,\n        }),\n      ]);\n      return deletedUser;\n    });\n    this.logger.info('organization deleted', { orgId: deleted.id });\n    return deleted;\n  }\n\n  async createInvite(input: CreateInviteInput): Promise<Invite> {\n    const { orgId, email, role, inviterUserId, firstName, lastName } = input;\n    const sendEmail = input.sendEmail ?? true;\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n\n    // A student belongs to the org from the moment an admin adds them, not from\n    // the moment they click a link — so the person exists before the invite\n    // does. Staff are excluded: their org_users row is mirrored from the auth\n    // provider's member record, which does not exist until they join.\n    const person =\n      role === STUDENT_ROLE\n        ? await this.people.createUser({\n            email,\n            ...(firstName !== undefined && { firstName }),\n            ...(lastName !== undefined && { lastName }),\n          })\n        : null;\n\n    const invite = await this.uow.run(async ({ organizations, outbox }) => {\n      const row = await organizations.upsertPendingInvite(orgId, {\n        email,\n        role,\n        invitedBy: inviterUserId,\n        tokenHash,\n        expiresAt,\n      });\n      const events: NewOrganizationEvent[] = [\n        organizationEvents.inviteCreated.make({ orgId, data: row }),\n      ];\n      if (person) {\n        // Idempotent: re-inviting an address rotates the token without\n        // producing a second org user or a second student.created.\n        const { orgUser, created } = await organizations.ensureOrgUser({\n          orgId,\n          userId: person.id,\n          role: STUDENT_ROLE,\n          status: 'invited',\n        });\n        if (created) {\n          events.push(\n            organizationEvents.studentCreated.make({ orgId, data: orgUser }),\n          );\n        }\n      }\n      await outbox.append(events);\n      return row;\n    });\n\n    if (sendEmail) {\n      // TODO make this workflow durable\n      await this.sendInviteEmail(invite, token);\n    }\n\n    this.logger.info('invite created', { orgId, inviteId: invite.id, role, sendEmail });\n    return invite;\n  }\n\n  async updateStudent(input: UpdateStudentInput): Promise<OrgUser> {\n    const { orgId, orgUserId, firstName, lastName, email } = input;\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n\n    const previousEmail = person.email;\n    await this.people.updateUser(person.id, {\n      ...(firstName !== undefined && { firstName }),\n      ...(lastName !== undefined && { lastName }),\n      ...(email !== undefined && { email }),\n    });\n\n    // The pending invite carries its own copy of the address and a token minted\n    // against it. Once the address is corrected that invite points at the wrong\n    // person, so it is cancelled rather than left live — the admin re-sends,\n    // which mints a fresh one for the new address. A student who has already\n    // accepted has no pending invite to worry about.\n    const emailChanged = email !== undefined && email.toLowerCase() !== previousEmail.toLowerCase();\n    if (emailChanged && orgUser.status !== 'active') {\n      await this.repo.cancelPendingInvite(orgId, previousEmail);\n    }\n\n    this.logger.info('student updated', { orgId, orgUserId, emailChanged });\n    return orgUser;\n  }\n\n  async resendStudentInvite(input: ResendStudentInviteInput): Promise<void> {\n    const { orgId, orgUserId, inviterUserId } = input;\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    if (orgUser.status === 'active') {\n      throw new OrganizationRuleError('That student has already accepted their invitation');\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n    // Straight back through createInvite: it rotates the token on the pending\n    // row and finds the existing org user, so a resend is an invite that\n    // happens to be the second one.\n    await this.createInvite({\n      orgId,\n      email: person.email,\n      role: STUDENT_ROLE,\n      inviterUserId,\n      sendEmail: true,\n    });\n    this.logger.info('student invite resent', { orgId, orgUserId });\n  }\n\n  async peekInvite(token: string): Promise<Invite | null> {\n    const invite = await this.repo.findInviteByTokenHash(hashInviteToken(token));\n    if (!invite || invite.status !== 'pending') {\n      return null;\n    }\n    if (invite.expiresAt && invite.expiresAt < new Date()) {\n      return null;\n    }\n    return invite;\n  }\n\n  async acceptInvite(input: AcceptInviteInput): Promise<OrgUser> {\n    const invite = await this.peekInvite(input.token);\n    if (!invite) {\n      this.logger.warn('invite accept refused: token invalid or expired');\n      throw new InviteError('invalid invite');\n    }\n    if (invite.email.toLowerCase() !== input.email.toLowerCase()) {\n      this.logger.warn('invite accept refused: email mismatch', {\n        orgId: invite.orgId,\n        inviteId: invite.id,\n      });\n      throw new InviteError('emails must match');\n    }\n    const org = await this.repo.findById(invite.orgId);\n    if (!org) {\n      throw new InviteError('Org not found');\n    }\n\n    const orgUser = await this.uow.run(async ({ organizations, outbox }) => {\n      // A student provisioned at invite time already has a row — acceptance\n      // activates it. Staff have none yet, so this inserts one.\n      const { orgUser: row, created } = await organizations.ensureOrgUser({\n        orgId: invite.orgId,\n        userId: input.userId,\n        role: invite.role,\n        status: 'active',\n      });\n      const acceptedInvite = await organizations.setInviteStatus(invite.orgId, invite.id, 'accepted');\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      const events: NewOrganizationEvent[] = [\n        organizationEvents.inviteAccepted.make({\n          orgId: invite.orgId,\n          data: acceptedInvite,\n        }),\n      ];\n      if (row.role === STUDENT_ROLE) {\n        events.push(\n          created\n            ? organizationEvents.studentCreated.make({\n                orgId: invite.orgId,\n                data: row,\n              })\n            : organizationEvents.studentLinked.make({\n                orgId: invite.orgId,\n                data: row,\n              }),\n        );\n      } else if (created) {\n        events.push(\n          organizationEvents.orgUserLinked.make({\n            orgId: invite.orgId,\n            data: row,\n          }),\n        );\n      }\n      await outbox.append(events);\n      return row;\n    });\n    this.logger.info('invite accepted', { orgId: invite.orgId, userId: input.userId });\n    return orgUser;\n  }\n\n  // By identity USER id — `(org_id, user_id)` is unique. Every caller (scope\n  // resolution, the MCP principal, the learn routes) asks \"what is this person\n  // in this org\", never \"what is this org_users row\".\n  async getOrgUser(orgId: string, userId: string): Promise<OrgUser | null> {\n    return this.repo.findOrgUser(orgId, userId);\n  }\n\n  async deleteOrgUser(orgId: string, id: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUserById(orgId, id);\n      if (!orgUser) {\n        throw new NotFoundError('OrgUser', id);\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, id);\n      if (!deletedUser) {\n        throw new NotFoundError('OrgUser', id);\n      }\n      const events: NewOrganizationEvent[] = [];\n      if (deletedUser.role === STUDENT_ROLE) {\n        events.push(\n          organizationEvents.studentDeleted.make({ orgId, data: orgUser }),\n        );\n      }\n\n      await outbox.append(events);\n      return deletedUser;\n    });\n    this.logger.info('org user deleted', { orgId, orgUserId: id });\n    return deleted;\n  }\n\n  async getOrgUsersForUser(userId: string): Promise<OrgUser[]> {\n    return this.repo.findOrgUsersByUser(userId);\n  }\n\n  async getById(id: string): Promise<Organization | null> {\n    return this.repo.findById(id);\n  }\n\n  private async sendInviteEmail(invite: Invite, token: string): Promise<void> {\n    if (!this.mailer || !this.inviteUrls) {\n      throw new Error('invite delivery is not configured (mailer / invite urls missing)');\n    }\n    const { email, role } = invite;\n    const isStudent = role === STUDENT_ROLE;\n    const base = isStudent\n      ? `${this.inviteUrls.studentPortalUrl}/welcome`\n      : `${this.inviteUrls.adminAppUrl}/invite`;\n    // The portal resolves the token to the invited email, so the link carries\n    // only the token. The admin app still reads it from the query.\n    const query = isStudent\n      ? new URLSearchParams({ token })\n      : new URLSearchParams({ token, email });\n    const inviteUrl = `${base}?${query.toString()}`;\n    try {\n      if (role === STUDENT_ROLE) {\n        await this.mailer.send(email, 'studentInvite', { inviteUrl, studentName: email });\n      } else {\n        await this.mailer.send(email, 'memberInvite', {\n          inviteUrl,\n          inviterName: 'Your team',\n          role,\n        });\n      }\n    } catch (err) {\n      // A failed email must not abort invite creation: the token is already\n      // minted and recorded, so the admin can fix transport and resend.\n      this.logger.error('failed to send invite email', {\n        email,\n        role,\n        err: err instanceof Error ? err : new Error(String(err)),\n      });\n    }\n  }\n\n  async getByExternalId(externalId: string): Promise<Organization | null> {\n    return this.repo.findByExternalId(externalId);\n  }\n\n  async getBySlug(slug: string): Promise<Organization | null> {\n    return this.repo.findBySlug(slug);\n  }\n\n  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>> {\n    return this.membersRepo.list(orgId, query);\n  }\n\n  async updateMemberRole(ctx: MemberWriteContext, id: string, role: Role): Promise<Member | null> {\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return null;\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('role change rejected: owner role immutable', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner role cannot be reassigned');\n    }\n    if (member.kind !== 'member' || !member.userExternalId) {\n      this.logger.warn('role change rejected: not an active member', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('Only active members can have their role changed');\n    }\n\n    const updated = await this.membersRepo.findById(ctx.orgId, id);\n    this.logger.info('member role updated', { orgId: ctx.orgId, memberId: id, role });\n    return updated ? toMember(updated) : null;\n  }\n\n  async removeMember(_ctx: MemberWriteContext, _id: string): Promise<boolean> {\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;AAoCA,MAAM,gBAAgB,QAAc,KAAK;AASzC,SAAS,SAAS,GAAyB;CACzC,OAAO;EACL,IAAI,EAAE;EACN,WAAW,EAAE;EACb,UAAU,EAAE;EACZ,OAAO,EAAE;EACT,OAAO,EAAE;EACT,MAAM,EAAE;EACR,QAAQ,EAAE;EACV,UAAU,EAAE;EACZ,WAAW,EAAE;CACf;AACF;AAYA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,OAAO,OAAO;EACnB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO;EACrB,KAAK,MAAM,OAAO;EAClB,KAAK,SAAS,OAAO,UAAU;EAC/B,KAAK,SAAS,OAAO;EACrB,KAAK,aAAa,OAAO;CAC3B;CAEA,MAAM,mBAAmB,OAAuD;EAC9E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,KAAK,MAAM,cAAc;GAE/B,MAAM,UAAU,MAAM,cAAc,OAAO;IACzC;IAGA,YAAY,MAAM,cAAc;IAChC,MAAM,MAAM,QAAQ;IACpB,MAAM,MAAM,QAAQ;IACpB,SAAS,MAAM;GACjB,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB;GAAE,OAAO,QAAQ;GAAI,MAAM,QAAQ;EAAK,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAY,OAAuD;EAC1F,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACzE,MAAM,UAAU,MAAM,cAAc,OAAO,IAAI;IAC7C,MAAM,MAAM;IACZ,MAAM,MAAM;GACd,CAAC;GACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,gBAAgB,EAAE;GAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAAE,OAAO;IAAI,MAAM;GAAQ,CAAC,CAC1E,CAAC;GACD,OAAO;EACT,CAAC;EAED,KAAK,OAAO,KAAK,wBAAwB,EAAE,WAAW,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAmC;EAC1D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB,EAAE,OAAO,QAAQ,GAAG,CAAC;EAC9D,OAAO;CACT;CAEA,MAAM,WAAW,EAAE,OAAO,QAAQ,QAA2C;EAC3E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,cAAc;IAAE;IAAO;IAAM;IAAQ,QAAQ;GAAS,CAAC;GAC3F,MAAM,OAAO,OAAO,CAClB,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAChE,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,8BAA8B;GAAE;GAAO;GAAQ;EAAK,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,IAA8B;EAC/D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,EAAE;GAC/D,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IACrC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB,EAAE,OAAO,QAAQ,GAAG,CAAC;EAC9D,OAAO;CACT;CAEA,MAAM,aAAa,OAA2C;EAC5D,MAAM,EAAE,OAAO,OAAO,MAAM,eAAe,WAAW,aAAa;EACnE,MAAM,YAAY,MAAM,aAAa;EACrC,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EAMrD,MAAM,SACJ,SAAA,YACI,MAAM,KAAK,OAAO,WAAW;GAC3B;GACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;EAC3C,CAAC,IACD;EAEN,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACrE,MAAM,MAAM,MAAM,cAAc,oBAAoB,OAAO;IACzD;IACA;IACA,WAAW;IACX;IACA;GACF,CAAC;GACD,MAAM,SAAiC,CACrC,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAI,CAAC,CAC5D;GACA,IAAI,QAAQ;IAGV,MAAM,EAAE,SAAS,YAAY,MAAM,cAAc,cAAc;KAC7D;KACA,QAAQ,OAAO;KACf,MAAM;KACN,QAAQ;IACV,CAAC;IACD,IAAI,SACF,OAAO,KACL,mBAAmB,eAAe,KAAK;KAAE;KAAO,MAAM;IAAQ,CAAC,CACjE;GAEJ;GACA,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EAED,IAAI,WAEF,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EAG1C,KAAK,OAAO,KAAK,kBAAkB;GAAE;GAAO,UAAU,OAAO;GAAI;GAAM;EAAU,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,cAAc,OAA6C;EAC/D,MAAM,EAAE,OAAO,WAAW,WAAW,UAAU,UAAU;EACzD,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAGhD,MAAM,gBAAgB,OAAO;EAC7B,MAAM,KAAK,OAAO,WAAW,OAAO,IAAI;GACtC,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;GACzC,GAAI,UAAU,KAAA,KAAa,EAAE,MAAM;EACrC,CAAC;EAOD,MAAM,eAAe,UAAU,KAAA,KAAa,MAAM,YAAY,MAAM,cAAc,YAAY;EAC9F,IAAI,gBAAgB,QAAQ,WAAW,UACrC,MAAM,KAAK,KAAK,oBAAoB,OAAO,aAAa;EAG1D,KAAK,OAAO,KAAK,mBAAmB;GAAE;GAAO;GAAW;EAAa,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,oBAAoB,OAAgD;EACxE,MAAM,EAAE,OAAO,WAAW,kBAAkB;EAC5C,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,IAAI,QAAQ,WAAW,UACrB,MAAM,IAAI,sBAAsB,oDAAoD;EAEtF,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAKhD,MAAM,KAAK,aAAa;GACtB;GACA,OAAO,OAAO;GACd,MAAM;GACN;GACA,WAAW;EACb,CAAC;EACD,KAAK,OAAO,KAAK,yBAAyB;GAAE;GAAO;EAAU,CAAC;CAChE;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,SAAS,MAAM,KAAK,KAAK,sBAAsB,gBAAgB,KAAK,CAAC;EAC3E,IAAI,CAAC,UAAU,OAAO,WAAW,WAC/B,OAAO;EAET,IAAI,OAAO,aAAa,OAAO,4BAAY,IAAI,KAAK,GAClD,OAAO;EAET,OAAO;CACT;CAEA,MAAM,aAAa,OAA4C;EAC7D,MAAM,SAAS,MAAM,KAAK,WAAW,MAAM,KAAK;EAChD,IAAI,CAAC,QAAQ;GACX,KAAK,OAAO,KAAK,iDAAiD;GAClE,MAAM,IAAI,YAAY,gBAAgB;EACxC;EACA,IAAI,OAAO,MAAM,YAAY,MAAM,MAAM,MAAM,YAAY,GAAG;GAC5D,KAAK,OAAO,KAAK,yCAAyC;IACxD,OAAO,OAAO;IACd,UAAU,OAAO;GACnB,CAAC;GACD,MAAM,IAAI,YAAY,mBAAmB;EAC3C;EAEA,IAAI,CAAC,MADa,KAAK,KAAK,SAAS,OAAO,KAAK,GAE/C,MAAM,IAAI,YAAY,eAAe;EAGvC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GAGtE,MAAM,EAAE,SAAS,KAAK,YAAY,MAAM,cAAc,cAAc;IAClE,OAAO,OAAO;IACd,QAAQ,MAAM;IACd,MAAM,OAAO;IACb,QAAQ;GACV,CAAC;GACD,MAAM,iBAAiB,MAAM,cAAc,gBAAgB,OAAO,OAAO,OAAO,IAAI,UAAU;GAC9F,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,SAAiC,CACrC,mBAAmB,eAAe,KAAK;IACrC,OAAO,OAAO;IACd,MAAM;GACR,CAAC,CACH;GACA,IAAI,IAAI,SAAA,WACN,OAAO,KACL,UACI,mBAAmB,eAAe,KAAK;IACrC,OAAO,OAAO;IACd,MAAM;GACR,CAAC,IACD,mBAAmB,cAAc,KAAK;IACpC,OAAO,OAAO;IACd,MAAM;GACR,CAAC,CACP;QACK,IAAI,SACT,OAAO,KACL,mBAAmB,cAAc,KAAK;IACpC,OAAO,OAAO;IACd,MAAM;GACR,CAAC,CACH;GAEF,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,mBAAmB;GAAE,OAAO,OAAO;GAAO,QAAQ,MAAM;EAAO,CAAC;EACjF,OAAO;CACT;CAKA,MAAM,WAAW,OAAe,QAAyC;EACvE,OAAO,KAAK,KAAK,YAAY,OAAO,MAAM;CAC5C;CAEA,MAAM,cAAc,OAAe,IAA8B;EAC/D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,gBAAgB,OAAO,EAAE;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,EAAE;GAC/D,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,SAAiC,CAAC;GACxC,IAAI,YAAY,SAAA,WACd,OAAO,KACL,mBAAmB,eAAe,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CACjE;GAGF,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO,WAAW;EAAG,CAAC;EAC7D,OAAO;CACT;CAEA,MAAM,mBAAmB,QAAoC;EAC3D,OAAO,KAAK,KAAK,mBAAmB,MAAM;CAC5C;CAEA,MAAM,QAAQ,IAA0C;EACtD,OAAO,KAAK,KAAK,SAAS,EAAE;CAC9B;CAEA,MAAc,gBAAgB,QAAgB,OAA8B;EAC1E,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,YACxB,MAAM,IAAI,MAAM,kEAAkE;EAEpF,MAAM,EAAE,OAAO,SAAS;EACxB,MAAM,YAAY,SAAS;EAS3B,MAAM,YAAY,GARL,YACT,GAAG,KAAK,WAAW,iBAAiB,YACpC,GAAG,KAAK,WAAW,YAAY,SAMT,IAHZ,YACV,IAAI,gBAAgB,EAAE,MAAM,CAAC,IAC7B,IAAI,gBAAgB;GAAE;GAAO;EAAM,CAAC,EAAA,CACL,SAAS;EAC5C,IAAI;GACF,IAAI,SAAA,WACF,MAAM,KAAK,OAAO,KAAK,OAAO,iBAAiB;IAAE;IAAW,aAAa;GAAM,CAAC;QAEhF,MAAM,KAAK,OAAO,KAAK,OAAO,gBAAgB;IAC5C;IACA,aAAa;IACb;GACF,CAAC;EAEL,SAAS,KAAK;GAGZ,KAAK,OAAO,MAAM,+BAA+B;IAC/C;IACA;IACA,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;GACzD,CAAC;EACH;CACF;CAEA,MAAM,gBAAgB,YAAkD;EACtE,OAAO,KAAK,KAAK,iBAAiB,UAAU;CAC9C;CAEA,MAAM,UAAU,MAA4C;EAC1D,OAAO,KAAK,KAAK,WAAW,IAAI;CAClC;CAEA,YAAY,OAAe,OAA4C;EACrE,OAAO,KAAK,YAAY,KAAK,OAAO,KAAK;CAC3C;CAEA,MAAM,iBAAiB,KAAyB,IAAY,MAAoC;EAC9F,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO;EAET,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,qCAAqC;EACvE;EACA,IAAI,OAAO,SAAS,YAAY,CAAC,OAAO,gBAAgB;GACtD,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iDAAiD;EACnF;EAEA,MAAM,UAAU,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC7D,KAAK,OAAO,KAAK,uBAAuB;GAAE,OAAO,IAAI;GAAO,UAAU;GAAI;EAAK,CAAC;EAChF,OAAO,UAAU,SAAS,OAAO,IAAI;CACvC;CAEA,MAAM,aAAa,MAA0B,KAA+B;EAC1E,OAAO;CACT;AACF"}

package/dist/organizations/types.d.ts

@@ -0,0 +1,39 @@
+import { ProvisionUserInput } from "../types/schemas/identity.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, InviteRole, NewOrganizationInput, OrgUserStatus, Organization } from "../types/schemas/organizations.js";
+import { InviteId, OrgUserId, OrganizationId } from "../types/organizations.js";
+import "../types/index.js";
+//#region src/organizations/types.d.ts
+interface CreateOrganizationInput {
+  externalId?: string;
+  name?: string;
+  slug?: string;
+  logo?: string;
+  ownerId: string;
+}
+type UpdateOrganizationInput = Partial<Omit<Organization, 'createdAt,updatedAt'>>;
+interface LinkOrgUserInput {
+  orgId: string;
+  userId: string;
+  role: string;
+}
+interface UnlinkOrgUserInput {
+  orgExternalId: string;
+  userExternalId: string;
+}
+interface UpdatePersonInput {
+  firstName?: string;
+  lastName?: string;
+  email?: string;
+}
+interface UpdateStudentInput extends UpdatePersonInput {
+  orgId: string;
+  orgUserId: string;
+}
+interface ResendStudentInviteInput {
+  orgId: string;
+  orgUserId: string;
+  inviterUserId: string;
+}
+//#endregion
+export { type AcceptInviteInput, type AddOrgUserInput, type CreateInviteInput, type CreateOrgUserInput, CreateOrganizationInput, type InviteId, type InviteRole, LinkOrgUserInput, type NewOrganizationInput, type OrgUserId, type OrgUserStatus, type OrganizationId, type ProvisionUserInput, ResendStudentInviteInput, UnlinkOrgUserInput, UpdateOrganizationInput, UpdatePersonInput, UpdateStudentInput };
+//# sourceMappingURL=types.d.ts.map

package/dist/organizations/types.js

@@ -0,0 +1 @@
+export {};

package/dist/progress/events.d.ts

@@ -0,0 +1,55 @@
+import { JsonValue, NewDomainEvent } from "../types/shared.js";
+import { EventOf, EventOfValues, RuntimeEventDefinition, VersionedDomainEvent } from "../shared/events.js";
+import "../shared/ports.js";
+//#region src/progress/events.d.ts
+declare const progressEvents: {
+  progressStarted: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    orgId: string;
+    orgUserId: string;
+    targetType: "course" | "activity" | "module";
+    targetId: string;
+    startedAt: Date;
+    position: JsonValue;
+    completedAt: Date | null;
+    updatedAt: Date;
+  }, "progress.record.started", 1>, {
+    id: string;
+    orgId: string;
+    orgUserId: string;
+    targetType: "course" | "activity" | "module";
+    targetId: string;
+    startedAt: unknown;
+    position: unknown;
+    completedAt: unknown;
+    updatedAt: unknown;
+  }>;
+  progressCompleted: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    orgId: string;
+    orgUserId: string;
+    targetType: "course" | "activity" | "module";
+    targetId: string;
+    startedAt: Date;
+    position: JsonValue;
+    completedAt: Date | null;
+    updatedAt: Date;
+  }, "progress.record.completed", 1>, {
+    id: string;
+    orgId: string;
+    orgUserId: string;
+    targetType: "course" | "activity" | "module";
+    targetId: string;
+    startedAt: unknown;
+    position: unknown;
+    completedAt: unknown;
+    updatedAt: unknown;
+  }>;
+};
+type ProgressStarted = EventOf<typeof progressEvents.progressStarted>;
+type ProgressCompleted = EventOf<typeof progressEvents.progressCompleted>;
+type ProgressEvent = EventOfValues<typeof progressEvents>;
+type NewProgressEvent = NewDomainEvent<ProgressEvent>;
+//#endregion
+export { NewProgressEvent, ProgressCompleted, ProgressEvent, ProgressStarted, progressEvents };
+//# sourceMappingURL=events.d.ts.map

package/dist/progress/events.js

@@ -0,0 +1,19 @@
+import { progressRecordSchema } from "../types/schemas/progress.js";
+import { defineEvent } from "../shared/events.js";
+//#region src/progress/events.ts
+const progressEvents = {
+	progressStarted: defineEvent({
+		type: "progress.record.started",
+		version: 1,
+		data: progressRecordSchema
+	}),
+	progressCompleted: defineEvent({
+		type: "progress.record.completed",
+		version: 1,
+		data: progressRecordSchema
+	})
+};
+//#endregion
+export { progressEvents };
+
+//# sourceMappingURL=events.js.map

package/dist/progress/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","names":[],"sources":["../../src/progress/events.ts"],"sourcesContent":["import { progressRecordSchema } from '../types/schemas/index.js';\nimport {\n  defineEvent,\n  type EventOf,\n  type EventOfValues,\n  type NewDomainEvent,\n} from '../shared/ports.js';\n\nexport const progressEvents = {\n  progressStarted: defineEvent({\n    type: 'progress.record.started',\n    version: 1,\n    data: progressRecordSchema,\n  }),\n  progressCompleted: defineEvent({\n    type: 'progress.record.completed',\n    version: 1,\n    data: progressRecordSchema,\n  }),\n};\n\nexport type ProgressStarted = EventOf<typeof progressEvents.progressStarted>;\nexport type ProgressCompleted = EventOf<typeof progressEvents.progressCompleted>;\nexport type ProgressEvent = EventOfValues<typeof progressEvents>;\nexport type NewProgressEvent = NewDomainEvent<ProgressEvent>;\n"],"mappings":";;;AAQA,MAAa,iBAAiB;CAC5B,iBAAiB,YAAY;EAC3B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,mBAAmB,YAAY;EAC7B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;AACH"}

package/dist/progress/index.d.ts

@@ -0,0 +1,8 @@
+import { ProgressRecord, ProgressReportItem, ProgressTarget, ProgressTargetType, ReportProgressInput } from "../types/schemas/progress.js";
+import { ProgressId } from "../types/progress.js";
+import { ProgressCompleted, ProgressEvent, ProgressStarted, progressEvents } from "./events.js";
+import "./model.js";
+import "./types.js";
+import { ProgressRepository, ProgressService, ProgressUnitOfWork } from "./ports.js";
+import { ProgressServiceImpl } from "./service.js";
+export { type ProgressCompleted, type ProgressEvent, type ProgressId, type ProgressRecord, type ProgressReportItem, type ProgressRepository, type ProgressService, ProgressServiceImpl, type ProgressStarted, type ProgressTarget, type ProgressTargetType, type ProgressUnitOfWork, type ReportProgressInput, progressEvents };

package/dist/progress/index.js

@@ -0,0 +1,3 @@
+import { progressEvents } from "./events.js";
+import { ProgressServiceImpl } from "./service.js";
+export { ProgressServiceImpl, progressEvents };

package/dist/progress/model.d.ts

@@ -0,0 +1,3 @@
+import { ProgressRecord, ProgressTargetType } from "../types/schemas/progress.js";
+import "../types/index.js";
+export type { ProgressRecord, ProgressTargetType };

package/dist/progress/model.js

@@ -0,0 +1 @@
+export {};

package/dist/progress/ports.d.ts

@@ -0,0 +1,37 @@
+import { ProgressRecord, ProgressTarget, ReportProgressInput } from "../types/schemas/progress.js";
+import { OutboxAppender, UnitOfWork } from "../shared/ports.js";
+import "./model.js";
+import "./types.js";
+//#region src/progress/ports.d.ts
+interface ProgressService {
+  /** Process a usage report: ensure the record, apply position, evaluate
+   *  completion (activity rule, then module/course against current structure),
+   *  emit events. Returns the activity's record after the decision. */
+  report(orgId: string, input: ReportProgressInput): Promise<ProgressRecord>;
+  /** Fetch the record for a single (student, target), or null. */
+  get(orgId: string, target: ProgressTarget): Promise<ProgressRecord | null>;
+  /** Records for a set of target ids — the read the reporting layer composes. */
+  listByTargets(orgId: string, orgUserId: string, targetIds: string[]): Promise<ProgressRecord[]>;
+}
+interface ProgressRepository {
+  /** Conflict-safe insert. null = lost a concurrent-insert race (unique key already taken). */
+  insert(orgId: string, record: ProgressRecord): Promise<ProgressRecord | null>;
+  /** Scoped to the org — returns the record for the unique (student, target) key, or null. */
+  findByTarget(orgId: string, target: ProgressTarget): Promise<ProgressRecord | null>;
+  /** All of the student's records whose targetId is in the set. `forUpdate` takes tx-scoped
+   *  row locks (ordered) to serialize concurrent reports for the same student+course. */
+  findByTargets(orgId: string, orgUserId: string, targetIds: string[], opts?: {
+    forUpdate?: boolean;
+  }): Promise<ProgressRecord[]>;
+  update(orgId: string, id: string, patch: Partial<Pick<ProgressRecord, 'position' | 'completedAt'>>): Promise<ProgressRecord | null>;
+}
+/** Writes that emit events run through this scope so row + outbox entry commit
+ *  in one transaction. */
+interface ProgressWriteScope {
+  progress: ProgressRepository;
+  outbox: OutboxAppender;
+}
+type ProgressUnitOfWork = UnitOfWork<ProgressWriteScope>;
+//#endregion
+export { ProgressRepository, ProgressService, ProgressUnitOfWork, ProgressWriteScope };
+//# sourceMappingURL=ports.d.ts.map

package/dist/progress/ports.js

@@ -0,0 +1 @@
+export {};

package/dist/progress/service.d.ts

@@ -0,0 +1,33 @@
+import { Logger } from "../types/ports.js";
+import { ProgressRecord, ProgressTarget, ReportProgressInput } from "../types/schemas/progress.js";
+import "../shared/ports.js";
+import { ContentService } from "../content/ports.js";
+import "../content/index.js";
+import "./model.js";
+import "./types.js";
+import { ProgressRepository, ProgressService, ProgressUnitOfWork } from "./ports.js";
+//#region src/progress/service.d.ts
+type ProgressServiceParams = {
+  repo: ProgressRepository;
+  content: ContentService;
+  uow: ProgressUnitOfWork;
+  logger?: Logger;
+};
+declare class ProgressServiceImpl implements ProgressService {
+  private readonly repo;
+  private readonly content;
+  private readonly uow;
+  private readonly logger;
+  constructor(params: ProgressServiceParams);
+  report(orgId: string, input: ReportProgressInput): Promise<ProgressRecord>;
+  private ensureActivityRecord;
+  /** After an activity completes: newly-complete containers get their records
+   *  (created complete) and a progress.completed event — same transaction. */
+  private completeContainers;
+  private ensureContainerComplete;
+  get(orgId: string, target: ProgressTarget): Promise<ProgressRecord | null>;
+  listByTargets(orgId: string, orgUserId: string, targetIds: string[]): Promise<ProgressRecord[]>;
+}
+//#endregion
+export { ProgressServiceImpl, ProgressServiceParams };
+//# sourceMappingURL=service.d.ts.map