@headless-lms/core 0.2.0 → 0.3.0

package/dist/entitlements/service.js

@@ -1,12 +1,19 @@
+import { ConflictError, ForbiddenError, NotFoundError } from "../shared/errors.js";
 import { noopLogger } from "../shared/logger.js";
+import { canModerate, isStaffRole } from "../organizations/roles.js";
 import { entitlementEvents } from "./events.js";
+import { laterExpiry, opensSpace, seesSpace } from "./rules.js";
 //#region src/entitlements/service.ts
+const ENDING_SOON_MS = 10080 * 60 * 1e3;
+const NOTICE_BATCH_SIZE = 100;
 var EntitlementsServiceImpl = class {
 	repo;
+	content;
 	uow;
 	logger;
 	constructor(params) {
 		this.repo = params.repo;
+		this.content = params.content;
 		this.uow = params.uow;
 		this.logger = params.logger ?? noopLogger;
 	}
@@ -31,6 +38,50 @@ var EntitlementsServiceImpl = class {
 		});
 		return entitlement;
 	}
+	async ensureGrant(orgId, input) {
+		const { entitlement, change } = await this.uow.run(async ({ entitlements, outbox }) => {
+			const created = await entitlements.insertIfAbsent(orgId, input);
+			if (created) {
+				await outbox.append([entitlementEvents.entitlementCreated.make({
+					orgId,
+					data: created
+				})]);
+				return {
+					entitlement: created,
+					change: "created"
+				};
+			}
+			const existing = await entitlements.lockGrant(orgId, input);
+			if (!existing) throw new ConflictError("The grant changed while it was being given");
+			if (existing.status === "revoked") return {
+				entitlement: existing,
+				change: null
+			};
+			const expiresAt = laterExpiry(existing.expiresAt, input.expiresAt ?? null);
+			if (expiresAt?.getTime() === existing.expiresAt?.getTime()) return {
+				entitlement: existing,
+				change: null
+			};
+			const updated = await entitlements.setExpiresAt(orgId, existing.id, expiresAt);
+			if (!updated) throw new NotFoundError("Entitlement", existing.id);
+			await outbox.append([entitlementEvents.entitlementUpdated.make({
+				orgId,
+				data: updated
+			})]);
+			return {
+				entitlement: updated,
+				change: "updated"
+			};
+		});
+		if (change) this.logger.info(change === "created" ? "entitlement granted" : "entitlement extended", {
+			orgId,
+			entitlementId: entitlement.id,
+			orgUserId: entitlement.orgUserId,
+			bundleId: entitlement.bundleId,
+			contentId: entitlement.contentId
+		});
+		return entitlement;
+	}
 	async setStatus(orgId, id, status) {
 		const entitlement = await this.uow.run(async ({ entitlements, outbox }) => {
 			const updated = await entitlements.setStatus(orgId, id, status);
@@ -51,10 +102,429 @@ var EntitlementsServiceImpl = class {
 		});
 		return entitlement;
 	}
-	hasCourseAccess(orgId, orgUserId, courseId) {
-		return this.repo.hasCourseAccess(orgId, orgUserId, courseId);
+	hasAccess(orgId, orgUserId, contentId) {
+		return this.repo.hasAccess(orgId, orgUserId, contentId);
+	}
+	listAccessibleContent(orgId, orgUserId, type) {
+		return this.repo.listAccessibleContent(orgId, orgUserId, type);
+	}
+	async isCommunityMember(orgId, actor, communityId) {
+		return (await this.accessOf(orgId, actor.id, communityId, null))?.member === true;
+	}
+	async canOpenSpace(orgId, actor, spaceId) {
+		const space = await this.content.getSpace(orgId, spaceId);
+		if (!space) return false;
+		return this.canOpen(orgId, actor, space);
+	}
+	async canOpen(orgId, actor, space) {
+		const facts = await this.accessOf(orgId, actor.id, space.communityId, space.id);
+		if (!facts) return false;
+		return opensSpace(facts.role, facts.member, space.accessRule, facts.activeInSpace);
+	}
+	async spaceStandings(orgId, actor, communityId) {
+		const rows = await this.repo.listSpaceMembersFor(orgId, actor.id, communityId);
+		return Object.fromEntries(rows.map((row) => [row.spaceId, row.status]));
+	}
+	async openSpacesFor(orgId, actor, communityId) {
+		const facts = await this.accessOf(orgId, actor.id, communityId, null);
+		if (!facts?.member) return [];
+		const [spaces, activeIds] = await Promise.all([this.content.listSpaces(orgId, communityId), this.repo.activeSpaceIds(orgId, actor.id, communityId)]);
+		const active = new Set(activeIds);
+		return spaces.filter((space) => opensSpace(facts.role, facts.member, space.accessRule, active.has(space.id)));
+	}
+	async openSpaceIds(orgId, actor, communityId) {
+		return (await this.openSpacesFor(orgId, actor, communityId)).map((space) => space.id);
+	}
+	async communityMembersAmong(orgId, communityId, orgUserIds) {
+		if (orgUserIds.length === 0) return [];
+		return (await this.repo.accessAmong(orgId, communityId, null, orgUserIds)).filter((fact) => fact.member).map((fact) => fact.orgUserId);
+	}
+	async spaceOpenersAmong(orgId, spaceId, orgUserIds) {
+		if (orgUserIds.length === 0) return [];
+		const space = await this.content.getSpace(orgId, spaceId);
+		if (!space) return [];
+		return (await this.repo.accessAmong(orgId, space.communityId, space.id, orgUserIds)).filter((fact) => opensSpace(fact.role, fact.member, space.accessRule, fact.activeInSpace)).map((fact) => fact.orgUserId);
+	}
+	async spaceOpeners(orgId, spaceId) {
+		const space = await this.content.getSpace(orgId, spaceId);
+		if (!space) return [];
+		const members = await this.repo.communityMemberIds(orgId, space.communityId);
+		return this.spaceOpenersAmong(orgId, spaceId, members);
+	}
+	communitiesOpenedBy(orgId, grant) {
+		return this.repo.communitiesOpenedBy(orgId, grant);
+	}
+	communityModeratorIds(orgId, communityId) {
+		return this.repo.communityModeratorIds(orgId, communityId);
+	}
+	communityIdsOpenedFor(orgId, orgUserId) {
+		return this.repo.communityIdsOpenedFor(orgId, orgUserId);
+	}
+	countActiveSpaceMembers(orgId, spaceId) {
+		return this.repo.countActiveSpaceMembers(orgId, spaceId);
+	}
+	async requestJoin(orgId, actor, communityId, spaceId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertRule(space.accessRule, "by_request");
+		if (canModerate(actor.role)) throw new ForbiddenError("Staff do not request a place in a space");
+		await this.assertGrant(orgId, actor, actor.id, space.communityId);
+		const created = await this.createMember(orgId, actor, space, actor.id, "requested", "request");
+		this.logger.info("space member created", {
+			orgId,
+			spaceId,
+			orgUserId: actor.id,
+			status: created.status,
+			actorId: actor.id
+		});
+		return created;
+	}
+	async invite(orgId, actor, communityId, spaceId, orgUserId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertRule(space.accessRule, "by_invite");
+		await this.assertCanManage(orgId, actor, space.communityId);
+		await this.assertHolds(orgId, actor, orgUserId, space.communityId);
+		const created = await this.createMember(orgId, actor, space, orgUserId, "invited", "invite");
+		this.logger.info("space member created", {
+			orgId,
+			spaceId,
+			orgUserId,
+			status: created.status,
+			actorId: actor.id
+		});
+		return created;
+	}
+	async addSpaceMember(orgId, actor, communityId, spaceId, orgUserId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertHasMembers(space.accessRule);
+		await this.assertCanManage(orgId, actor, space.communityId);
+		await this.assertHolds(orgId, actor, orgUserId, space.communityId);
+		const created = await this.uow.run(async (scope) => {
+			const locked = await this.lockSpace(scope.spaces, orgId, spaceId);
+			this.assertHasMembers(locked.accessRule);
+			return this.insertMember(scope.entitlements, scope.outbox, orgId, actor, {
+				communityId: space.communityId,
+				spaceId,
+				orgUserId,
+				status: "active",
+				source: "manual"
+			}, locked);
+		});
+		this.logger.info("space member created", {
+			orgId,
+			spaceId,
+			orgUserId,
+			status: created.status,
+			actorId: actor.id
+		});
+		return created;
+	}
+	async accept(orgId, actor, communityId, spaceId) {
+		this.assertHolder(actor);
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertRule(space.accessRule, "by_invite");
+		await this.assertGrant(orgId, actor, actor.id, space.communityId);
+		return this.activate(orgId, actor, spaceId, actor.id, "by_invite", "invited", () => ownRowMissing("invited"));
+	}
+	async approve(orgId, actor, communityId, spaceId, orgUserId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertRule(space.accessRule, "by_request");
+		await this.assertCanManage(orgId, actor, space.communityId);
+		await this.assertGrant(orgId, actor, orgUserId, space.communityId);
+		return this.activate(orgId, actor, spaceId, orgUserId, "by_request", "requested", () => new NotFoundError("Space member", orgUserId));
+	}
+	async decline(orgId, actor, communityId, spaceId, orgUserId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		await this.assertCanManage(orgId, actor, space.communityId);
+		return this.deleteMember(orgId, actor, spaceId, orgUserId, "requested", () => new NotFoundError("Space member", orgUserId));
+	}
+	async refuse(orgId, actor, communityId, spaceId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertHolder(actor);
+		await this.assertGrant(orgId, actor, actor.id, space.communityId);
+		return this.deleteMember(orgId, actor, spaceId, actor.id, "invited", () => ownRowMissing("invited"));
+	}
+	async leave(orgId, actor, communityId, spaceId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertHolder(actor);
+		await this.assertGrant(orgId, actor, actor.id, space.communityId);
+		return this.deleteMember(orgId, actor, spaceId, actor.id, "active", () => ownRowMissing("active"));
+	}
+	async remove(orgId, actor, communityId, spaceId, orgUserId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertHasMembers(space.accessRule);
+		await this.assertCanManage(orgId, actor, space.communityId);
+		const { updated, previousStatus } = await this.uow.run(async ({ entitlements, spaces, outbox }) => {
+			const locked = await this.lockSpace(spaces, orgId, spaceId);
+			this.assertHasMembers(locked.accessRule);
+			const row = await entitlements.lockSpaceMember(orgId, spaceId, orgUserId);
+			if (!row) {
+				this.logger.warn("space member remove rejected — not found", {
+					orgId,
+					spaceId,
+					orgUserId,
+					actorId: actor.id
+				});
+				throw new NotFoundError("Space member", orgUserId);
+			}
+			if (row.status === "revoked") throw new ConflictError("This person is already removed from the space");
+			const next = await entitlements.updateSpaceMemberStatus(orgId, row.id, "revoked");
+			if (!next) throw new NotFoundError("Space member", row.id);
+			await outbox.append([entitlementEvents.spaceMemberUpdated.make({
+				orgId,
+				data: next,
+				metadata: {
+					actorOrgUserId: actor.id,
+					previousStatus: row.status
+				}
+			})]);
+			return {
+				updated: next,
+				previousStatus: row.status
+			};
+		});
+		this.logger.info("space member removed", {
+			orgId,
+			spaceId,
+			orgUserId,
+			previousStatus,
+			actorId: actor.id
+		});
+		return updated;
+	}
+	async listSpaceMembers(orgId, actor, communityId, spaceId, query) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		if (!await this.canOpen(orgId, actor, space)) throw new NotFoundError("Space", spaceId);
+		return this.repo.listSpaceMembers(orgId, spaceId, {
+			...query,
+			...canModerate(actor.role) ? {} : { statuses: ["active"] }
+		});
+	}
+	hasDueNotices(orgId, now) {
+		return this.repo.hasDueNotices(orgId, now, new Date(now.getTime() + ENDING_SOON_MS));
+	}
+	async expireDue(orgId, now) {
+		const until = new Date(now.getTime() + ENDING_SOON_MS);
+		let appended = 0;
+		let afterId;
+		for (;;) {
+			const batch = await this.uow.run(async ({ entitlements, outbox }) => {
+				const events = [];
+				const grants = await entitlements.listGrantsExpiredBy(orgId, now, NOTICE_BATCH_SIZE, afterId);
+				for (const grant of grants) {
+					if (!grant.expiresAt) continue;
+					if (await entitlements.claimNotice(orgId, {
+						kind: "expired",
+						entitlementId: grant.id,
+						expiresAt: grant.expiresAt
+					}, now)) events.push(entitlementEvents.entitlementExpired.make({
+						orgId,
+						data: grant
+					}));
+				}
+				if (events.length > 0) await outbox.append(events);
+				return {
+					events: events.length,
+					last: grants.at(-1)?.id,
+					size: grants.length
+				};
+			});
+			appended += batch.events;
+			if (batch.size < NOTICE_BATCH_SIZE || batch.last === void 0) break;
+			afterId = batch.last;
+		}
+		let afterKey;
+		for (;;) {
+			const batch = await this.uow.run(async ({ entitlements, outbox }) => {
+				const events = [];
+				const ending = await entitlements.listGrantsEndingBetween(orgId, now, until, NOTICE_BATCH_SIZE, afterKey);
+				for (const { grant, communityId } of ending) {
+					if (!grant.expiresAt) continue;
+					if (await entitlements.claimNotice(orgId, {
+						kind: "ending_soon",
+						entitlementId: grant.id,
+						communityId,
+						expiresAt: grant.expiresAt
+					}, now)) events.push(entitlementEvents.entitlementEndingSoon.make({
+						orgId,
+						data: {
+							...grant,
+							communityId
+						}
+					}));
+				}
+				if (events.length > 0) await outbox.append(events);
+				const last = ending.at(-1);
+				return {
+					events: events.length,
+					last: last && {
+						entitlementId: last.grant.id,
+						communityId: last.communityId
+					},
+					size: ending.length
+				};
+			});
+			appended += batch.events;
+			if (batch.size < NOTICE_BATCH_SIZE || batch.last === void 0) break;
+			afterKey = batch.last;
+		}
+		if (appended > 0) this.logger.info("due grants expired", {
+			orgId,
+			events: appended
+		});
+	}
+	async requireSpaceIn(orgId, communityId, spaceId) {
+		const space = await this.content.getSpace(orgId, spaceId);
+		if (!space || space.communityId !== communityId) {
+			this.logger.warn("space members rejected — space not found", {
+				orgId,
+				communityId,
+				spaceId
+			});
+			throw new NotFoundError("Space", spaceId);
+		}
+		return space;
+	}
+	async requireVisibleSpaceIn(orgId, actor, communityId, spaceId) {
+		const space = await this.requireSpaceIn(orgId, communityId, spaceId);
+		if (seesSpace(actor.role, space.accessRule, void 0)) return space;
+		const row = await this.repo.findSpaceMember(orgId, spaceId, actor.id);
+		if (!seesSpace(actor.role, space.accessRule, row?.status)) throw new NotFoundError("Space", spaceId);
+		return space;
+	}
+	assertHasMembers(accessRule) {
+		if (accessRule === "all_members") throw new ConflictError("An all-members space has no space members");
+	}
+	assertRule(accessRule, expected) {
+		this.assertHasMembers(accessRule);
+		if (accessRule !== expected) throw new ConflictError(accessRule === "by_invite" ? "This space is by invitation" : "This space is by request");
+	}
+	assertHolder(actor) {
+		if (isStaffRole(actor.role)) throw new ForbiddenError("Staff do not hold a place in a space");
+	}
+	async assertGrant(orgId, actor, orgUserId, communityId) {
+		if (!await this.repo.hasCommunityAccess(orgId, orgUserId, communityId)) throw new ForbiddenError(orgUserId === actor.id ? "You are not a member of this community" : "That person is not a member of this community");
+	}
+	async assertHolds(orgId, actor, orgUserId, communityId) {
+		const facts = await this.accessOf(orgId, orgUserId, communityId, null);
+		if (facts && isStaffRole(facts.role)) throw new ForbiddenError("Staff do not hold a place in a space");
+		await this.assertGrant(orgId, actor, orgUserId, communityId);
+	}
+	async assertCanManage(orgId, actor, communityId) {
+		const facts = await this.accessOf(orgId, actor.id, communityId, null);
+		if (facts?.member && canModerate(facts.role)) return;
+		throw new ForbiddenError("You cannot manage members of this space");
+	}
+	async accessOf(orgId, orgUserId, communityId, spaceId) {
+		const [facts] = await this.repo.accessAmong(orgId, communityId, spaceId, [orgUserId]);
+		return facts ?? null;
+	}
+	async createMember(orgId, actor, space, orgUserId, status, source) {
+		return this.uow.run(async ({ entitlements, outbox }) => this.insertMember(entitlements, outbox, orgId, actor, {
+			communityId: space.communityId,
+			spaceId: space.id,
+			orgUserId,
+			status,
+			source
+		}));
+	}
+	async insertMember(entitlements, outbox, orgId, actor, input, room) {
+		const existing = await entitlements.lockSpaceMember(orgId, input.spaceId, input.orgUserId);
+		if (existing && existing.status !== "revoked") throw new ConflictError(input.orgUserId === actor.id ? "You already have a place in this space" : "That person already has a place in this space");
+		if (room) await this.assertRoom(entitlements, orgId, room);
+		if (existing) await entitlements.deleteSpaceMember(orgId, existing.id);
+		const created = await entitlements.insertSpaceMember(orgId, input);
+		await outbox.append([entitlementEvents.spaceMemberCreated.make({
+			orgId,
+			data: created,
+			metadata: { actorOrgUserId: actor.id }
+		})]);
+		return created;
+	}
+	async activate(orgId, actor, spaceId, orgUserId, rule, from, missing) {
+		const updated = await this.uow.run(async ({ entitlements, spaces, outbox }) => {
+			const locked = await this.lockSpace(spaces, orgId, spaceId);
+			this.assertRule(locked.accessRule, rule);
+			const row = await entitlements.lockSpaceMember(orgId, spaceId, orgUserId);
+			if (row?.status === "active") throw alreadyPlaced(actor, orgUserId);
+			if (!row || row.status !== from) {
+				this.logger.warn("space member activate rejected — not found", {
+					orgId,
+					spaceId,
+					orgUserId,
+					actorId: actor.id
+				});
+				throw missing();
+			}
+			await this.assertRoom(entitlements, orgId, locked);
+			const next = await entitlements.updateSpaceMemberStatus(orgId, row.id, "active");
+			if (!next) throw missing();
+			await outbox.append([entitlementEvents.spaceMemberUpdated.make({
+				orgId,
+				data: next,
+				metadata: {
+					actorOrgUserId: actor.id,
+					previousStatus: from
+				}
+			})]);
+			return next;
+		});
+		this.logger.info("space member activated", {
+			orgId,
+			spaceId,
+			orgUserId,
+			actorId: actor.id
+		});
+		return updated;
+	}
+	async deleteMember(orgId, actor, spaceId, orgUserId, from, missing) {
+		const row = await this.uow.run(async ({ entitlements, outbox }) => {
+			const current = await entitlements.lockSpaceMember(orgId, spaceId, orgUserId);
+			if (from !== "active" && current?.status === "active") throw alreadyPlaced(actor, orgUserId);
+			if (!current || current.status !== from) {
+				this.logger.warn("space member delete rejected — not found", {
+					orgId,
+					spaceId,
+					orgUserId,
+					actorId: actor.id
+				});
+				throw missing();
+			}
+			await entitlements.deleteSpaceMember(orgId, current.id);
+			await outbox.append([entitlementEvents.spaceMemberDeleted.make({
+				orgId,
+				data: current,
+				metadata: {
+					actorOrgUserId: actor.id,
+					previousStatus: from
+				}
+			})]);
+			return current;
+		});
+		this.logger.info("space member deleted", {
+			orgId,
+			spaceId,
+			orgUserId,
+			previousStatus: from,
+			actorId: actor.id
+		});
+		return row;
+	}
+	async lockSpace(spaces, orgId, spaceId) {
+		const locked = await spaces.lockSpace(orgId, spaceId);
+		if (!locked) throw new NotFoundError("Space", spaceId);
+		return locked;
+	}
+	async assertRoom(entitlements, orgId, space) {
+		if (space.capacity === null) return;
+		if (await entitlements.countActiveSpaceMembers(orgId, space.id) >= space.capacity) throw new ConflictError("This space is full");
 	}
 };
+function alreadyPlaced(actor, orgUserId) {
+	return new ConflictError(orgUserId === actor.id ? "You already have a place in this space" : "That person already has a place in this space");
+}
+function ownRowMissing(status) {
+	return new ConflictError(status === "invited" ? "You do not have an invitation to this space" : "You are not a member of this space");
+}
 //#endregion
 export { EntitlementsServiceImpl };
 

package/dist/entitlements/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../src/entitlements/service.ts"],"sourcesContent":["// entitlements context — service implementation (inbound port).\n//\n// Mutations run inside the context's UnitOfWork: the domain write and the\n// outbox append commit in ONE transaction (transactional outbox). This\n// service never publishes — the outbox relay republishes committed events to\n// the EventBus at-least-once.\nimport type { Entitlement, EntitlementsQuery, GrantEntitlementInput, Page } from './model.js';\nimport type {\n  EntitlementsRepository,\n  EntitlementsService,\n  EntitlementsUnitOfWork,\n} from './ports.js';\nimport type { Logger } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { entitlementEvents } from './events.js';\n\nexport type EntitlementsServiceParams = {\n  /** Read-only access (list) — runs outside any transaction. */\n  repo: EntitlementsRepository;\n  /** Atomic write scope: tx-bound repo + outbox appender. */\n  uow: EntitlementsUnitOfWork;\n  logger?: Logger;\n};\n\nexport class EntitlementsServiceImpl implements EntitlementsService {\n  private readonly repo: EntitlementsRepository;\n  private readonly uow: EntitlementsUnitOfWork;\n  private readonly logger: Logger;\n\n  constructor(params: EntitlementsServiceParams) {\n    this.repo = params.repo;\n    this.uow = params.uow;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  list(orgId: string, query: EntitlementsQuery): Promise<Page<Entitlement>> {\n    return this.repo.list(orgId, query);\n  }\n\n  async grant(orgId: string, input: GrantEntitlementInput): Promise<Entitlement> {\n    const entitlement = await this.uow.run(async ({ entitlements, outbox }) => {\n      const created = await entitlements.insert(orgId, input);\n      await outbox.append([\n        entitlementEvents.entitlementCreated.make({\n          orgId,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('entitlement granted', {\n      orgId,\n      entitlementId: entitlement.id,\n      orgUserId: entitlement.orgUserId,\n      bundleId: entitlement.bundleId,\n      contentId: entitlement.contentId,\n    });\n    return entitlement;\n  }\n\n  async setStatus(\n    orgId: string,\n    id: string,\n    status: 'active' | 'revoked',\n  ): Promise<Entitlement | null> {\n    const entitlement = await this.uow.run(async ({ entitlements, outbox }) => {\n      const updated = await entitlements.setStatus(orgId, id, status);\n      if (!updated) {\n        return null;\n      }\n      await outbox.append([\n        status === 'revoked'\n          ? entitlementEvents.entitlementDeleted.make({\n              orgId,\n              data: updated,\n            })\n          : entitlementEvents.entitlementUpdated.make({\n              orgId,\n              data: updated,\n            }),\n      ]);\n      return updated;\n    });\n    if (entitlement) {\n      this.logger.info('entitlement status changed', { orgId, entitlementId: id, status });\n    }\n    return entitlement;\n  }\n\n  hasCourseAccess(orgId: string, orgUserId: string, courseId: string): Promise<boolean> {\n    return this.repo.hasCourseAccess(orgId, orgUserId, courseId);\n  }\n}\n"],"mappings":";;;AAwBA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,OAAO,OAAO;EACnB,KAAK,MAAM,OAAO;EAClB,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,KAAK,OAAe,OAAsD;EACxE,OAAO,KAAK,KAAK,KAAK,OAAO,KAAK;CACpC;CAEA,MAAM,MAAM,OAAe,OAAoD;EAC7E,MAAM,cAAc,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,cAAc,aAAa;GACzE,MAAM,UAAU,MAAM,aAAa,OAAO,OAAO,KAAK;GACtD,MAAM,OAAO,OAAO,CAClB,kBAAkB,mBAAmB,KAAK;IACxC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,uBAAuB;GACtC;GACA,eAAe,YAAY;GAC3B,WAAW,YAAY;GACvB,UAAU,YAAY;GACtB,WAAW,YAAY;EACzB,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UACJ,OACA,IACA,QAC6B;EAC7B,MAAM,cAAc,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,cAAc,aAAa;GACzE,MAAM,UAAU,MAAM,aAAa,UAAU,OAAO,IAAI,MAAM;GAC9D,IAAI,CAAC,SACH,OAAO;GAET,MAAM,OAAO,OAAO,CAClB,WAAW,YACP,kBAAkB,mBAAmB,KAAK;IACxC;IACA,MAAM;GACR,CAAC,IACD,kBAAkB,mBAAmB,KAAK;IACxC;IACA,MAAM;GACR,CAAC,CACP,CAAC;GACD,OAAO;EACT,CAAC;EACD,IAAI,aACF,KAAK,OAAO,KAAK,8BAA8B;GAAE;GAAO,eAAe;GAAI;EAAO,CAAC;EAErF,OAAO;CACT;CAEA,gBAAgB,OAAe,WAAmB,UAAoC;EACpF,OAAO,KAAK,KAAK,gBAAgB,OAAO,WAAW,QAAQ;CAC7D;AACF"}
+{"version":3,"file":"service.js","names":[],"sources":["../../src/entitlements/service.ts"],"sourcesContent":["// entitlements context — service implementation (inbound port).\n//\n// Mutations run inside the context's UnitOfWork: the domain write and the\n// outbox append commit in ONE transaction (transactional outbox). This\n// service never publishes — the outbox relay republishes committed events to\n// the EventBus at-least-once.\nimport type { CommunityReader, Space, SpaceRowLock } from '../content/index.js';\nimport type {\n  ContentType,\n  Entitlement,\n  EntitlementsQuery,\n  GrantEntitlementInput,\n  Page,\n  SpaceMember,\n} from './model.js';\nimport type {\n  AccessFacts,\n  EntitlementsRepository,\n  EntitlementsService,\n  EntitlementsUnitOfWork,\n  EndingGrantKey,\n  GrantTarget,\n  InsertSpaceMemberInput,\n  OpenableSpace,\n  SpaceAccessRule,\n} from './ports.js';\nimport type { Actor } from '../shared/actor.js';\nimport type { Logger, NewDomainEvent, OutboxAppender } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { ConflictError, ForbiddenError, NotFoundError } from '../shared/errors.js';\nimport { canModerate, isStaffRole } from '../organizations/index.js';\nimport { entitlementEvents } from './events.js';\nimport { laterExpiry, opensSpace, seesSpace } from './rules.js';\n\nconst ENDING_SOON_MS = 7 * 24 * 60 * 60 * 1000;\nconst NOTICE_BATCH_SIZE = 100;\n\nexport type EntitlementsServiceParams = {\n  /** Read-only access (list) — runs outside any transaction. */\n  repo: EntitlementsRepository;\n  content: CommunityReader;\n  /** Atomic write scope: tx-bound repo + outbox appender. */\n  uow: EntitlementsUnitOfWork;\n  logger?: Logger;\n};\n\nexport class EntitlementsServiceImpl implements EntitlementsService {\n  private readonly repo: EntitlementsRepository;\n  private readonly content: CommunityReader;\n  private readonly uow: EntitlementsUnitOfWork;\n  private readonly logger: Logger;\n\n  constructor(params: EntitlementsServiceParams) {\n    this.repo = params.repo;\n    this.content = params.content;\n    this.uow = params.uow;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  list(orgId: string, query: EntitlementsQuery): Promise<Page<Entitlement>> {\n    return this.repo.list(orgId, query);\n  }\n\n  async grant(orgId: string, input: GrantEntitlementInput): Promise<Entitlement> {\n    const entitlement = await this.uow.run(async ({ entitlements, outbox }) => {\n      const created = await entitlements.insert(orgId, input);\n      await outbox.append([\n        entitlementEvents.entitlementCreated.make({\n          orgId,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('entitlement granted', {\n      orgId,\n      entitlementId: entitlement.id,\n      orgUserId: entitlement.orgUserId,\n      bundleId: entitlement.bundleId,\n      contentId: entitlement.contentId,\n    });\n    return entitlement;\n  }\n\n  async ensureGrant(orgId: string, input: GrantEntitlementInput): Promise<Entitlement> {\n    const { entitlement, change } = await this.uow.run(async ({ entitlements, outbox }) => {\n      const created = await entitlements.insertIfAbsent(orgId, input);\n      if (created) {\n        await outbox.append([entitlementEvents.entitlementCreated.make({ orgId, data: created })]);\n        return { entitlement: created, change: 'created' as const };\n      }\n      const existing = await entitlements.lockGrant(orgId, input);\n      if (!existing) {\n        throw new ConflictError('The grant changed while it was being given');\n      }\n      if (existing.status === 'revoked') {\n        return { entitlement: existing, change: null };\n      }\n      const expiresAt = laterExpiry(existing.expiresAt, input.expiresAt ?? null);\n      if (expiresAt?.getTime() === existing.expiresAt?.getTime()) {\n        return { entitlement: existing, change: null };\n      }\n      const updated = await entitlements.setExpiresAt(orgId, existing.id, expiresAt);\n      if (!updated) {\n        throw new NotFoundError('Entitlement', existing.id);\n      }\n      await outbox.append([entitlementEvents.entitlementUpdated.make({ orgId, data: updated })]);\n      return { entitlement: updated, change: 'updated' as const };\n    });\n    if (change) {\n      this.logger.info(change === 'created' ? 'entitlement granted' : 'entitlement extended', {\n        orgId,\n        entitlementId: entitlement.id,\n        orgUserId: entitlement.orgUserId,\n        bundleId: entitlement.bundleId,\n        contentId: entitlement.contentId,\n      });\n    }\n    return entitlement;\n  }\n\n  async setStatus(\n    orgId: string,\n    id: string,\n    status: 'active' | 'revoked',\n  ): Promise<Entitlement | null> {\n    const entitlement = await this.uow.run(async ({ entitlements, outbox }) => {\n      const updated = await entitlements.setStatus(orgId, id, status);\n      if (!updated) {\n        return null;\n      }\n      await outbox.append([\n        status === 'revoked'\n          ? entitlementEvents.entitlementDeleted.make({\n              orgId,\n              data: updated,\n            })\n          : entitlementEvents.entitlementUpdated.make({\n              orgId,\n              data: updated,\n            }),\n      ]);\n      return updated;\n    });\n    if (entitlement) {\n      this.logger.info('entitlement status changed', { orgId, entitlementId: id, status });\n    }\n    return entitlement;\n  }\n\n  hasAccess(orgId: string, orgUserId: string, contentId: string): Promise<boolean> {\n    return this.repo.hasAccess(orgId, orgUserId, contentId);\n  }\n\n  listAccessibleContent(orgId: string, orgUserId: string, type?: ContentType): Promise<string[]> {\n    return this.repo.listAccessibleContent(orgId, orgUserId, type);\n  }\n\n  async isCommunityMember(orgId: string, actor: Actor, communityId: string): Promise<boolean> {\n    const facts = await this.accessOf(orgId, actor.id, communityId, null);\n    return facts?.member === true;\n  }\n\n  async canOpenSpace(orgId: string, actor: Actor, spaceId: string): Promise<boolean> {\n    const space = await this.content.getSpace(orgId, spaceId);\n    if (!space) {\n      return false;\n    }\n    return this.canOpen(orgId, actor, space);\n  }\n\n  async canOpen(orgId: string, actor: Actor, space: OpenableSpace): Promise<boolean> {\n    const facts = await this.accessOf(orgId, actor.id, space.communityId, space.id);\n    if (!facts) {\n      return false;\n    }\n    return opensSpace(facts.role, facts.member, space.accessRule, facts.activeInSpace);\n  }\n\n  async spaceStandings(\n    orgId: string,\n    actor: Actor,\n    communityId: string,\n  ): Promise<Record<string, SpaceMember['status']>> {\n    const rows = await this.repo.listSpaceMembersFor(orgId, actor.id, communityId);\n    return Object.fromEntries(rows.map((row) => [row.spaceId, row.status]));\n  }\n\n  async openSpacesFor(orgId: string, actor: Actor, communityId: string): Promise<Space[]> {\n    const facts = await this.accessOf(orgId, actor.id, communityId, null);\n    if (!facts?.member) {\n      return [];\n    }\n    const [spaces, activeIds] = await Promise.all([\n      this.content.listSpaces(orgId, communityId),\n      this.repo.activeSpaceIds(orgId, actor.id, communityId),\n    ]);\n    const active = new Set(activeIds);\n    return spaces.filter((space) =>\n      opensSpace(facts.role, facts.member, space.accessRule, active.has(space.id)),\n    );\n  }\n\n  async openSpaceIds(orgId: string, actor: Actor, communityId: string): Promise<string[]> {\n    const spaces = await this.openSpacesFor(orgId, actor, communityId);\n    return spaces.map((space) => space.id);\n  }\n\n  async communityMembersAmong(\n    orgId: string,\n    communityId: string,\n    orgUserIds: string[],\n  ): Promise<string[]> {\n    if (orgUserIds.length === 0) {\n      return [];\n    }\n    const facts = await this.repo.accessAmong(orgId, communityId, null, orgUserIds);\n    return facts.filter((fact) => fact.member).map((fact) => fact.orgUserId);\n  }\n\n  async spaceOpenersAmong(orgId: string, spaceId: string, orgUserIds: string[]): Promise<string[]> {\n    if (orgUserIds.length === 0) {\n      return [];\n    }\n    const space = await this.content.getSpace(orgId, spaceId);\n    if (!space) {\n      return [];\n    }\n    const facts = await this.repo.accessAmong(orgId, space.communityId, space.id, orgUserIds);\n    return facts\n      .filter((fact) => opensSpace(fact.role, fact.member, space.accessRule, fact.activeInSpace))\n      .map((fact) => fact.orgUserId);\n  }\n\n  async spaceOpeners(orgId: string, spaceId: string): Promise<string[]> {\n    const space = await this.content.getSpace(orgId, spaceId);\n    if (!space) {\n      return [];\n    }\n    const members = await this.repo.communityMemberIds(orgId, space.communityId);\n    return this.spaceOpenersAmong(orgId, spaceId, members);\n  }\n\n  communitiesOpenedBy(orgId: string, grant: GrantTarget): Promise<string[]> {\n    return this.repo.communitiesOpenedBy(orgId, grant);\n  }\n\n  communityModeratorIds(orgId: string, communityId: string): Promise<string[]> {\n    return this.repo.communityModeratorIds(orgId, communityId);\n  }\n\n  communityIdsOpenedFor(orgId: string, orgUserId: string): Promise<string[]> {\n    return this.repo.communityIdsOpenedFor(orgId, orgUserId);\n  }\n\n  countActiveSpaceMembers(orgId: string, spaceId: string): Promise<number> {\n    return this.repo.countActiveSpaceMembers(orgId, spaceId);\n  }\n\n  async requestJoin(\n    orgId: string,\n    actor: Actor,\n    communityId: string,\n    spaceId: string,\n  ): Promise<SpaceMember> {\n    const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);\n    this.assertRule(space.accessRule, 'by_request');\n    if (canModerate(actor.role)) {\n      throw new ForbiddenError('Staff do not request a place in a space');\n    }\n    await this.assertGrant(orgId, actor, actor.id, space.communityId);\n    const created = await this.createMember(orgId, actor, space, actor.id, 'requested', 'request');\n    this.logger.info('space member created', {\n      orgId,\n      spaceId,\n      orgUserId: actor.id,\n      status: created.status,\n      actorId: actor.id,\n    });\n    return created;\n  }\n\n  async invite(\n    orgId: string,\n    actor: Actor,\n    communityId: string,\n    spaceId: string,\n    orgUserId: string,\n  ): Promise<SpaceMember> {\n    const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);\n    this.assertRule(space.accessRule, 'by_invite');\n    await this.assertCanManage(orgId, actor, space.communityId);\n    await this.assertHolds(orgId, actor, orgUserId, space.communityId);\n    const created = await this.createMember(orgId, actor, space, orgUserId, 'invited', 'invite');\n    this.logger.info('space member created', {\n      orgId,\n      spaceId,\n      orgUserId,\n      status: created.status,\n      actorId: actor.id,\n    });\n    return created;\n  }\n\n  async addSpaceMember(\n    orgId: string,\n    actor: Actor,\n    communityId: string,\n    spaceId: string,\n    orgUserId: string,\n  ): Promise<SpaceMember> {\n    const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);\n    this.assertHasMembers(space.accessRule);\n    await this.assertCanManage(orgId, actor, space.communityId);\n    await this.assertHolds(orgId, actor, orgUserId, space.communityId);\n    const created = await this.uow.run(async (scope) => {\n      const locked = await this.lockSpace(scope.spaces, orgId, spaceId);\n      this.assertHasMembers(locked.accessRule);\n      return this.insertMember(\n        scope.entitlements,\n        scope.outbox,\n        orgId,\n        actor,\n        {\n          communityId: space.communityId,\n          spaceId,\n          orgUserId,\n          status: 'active',\n          source: 'manual',\n        },\n        locked,\n      );\n    });\n    this.logger.info('space member created', {\n      orgId,\n      spaceId,\n      orgUserId,\n      status: created.status,\n      actorId: actor.id,\n    });\n    return created;\n  }\n\n  async accept(\n    orgId: string,\n    actor: Actor,\n    communityId: string,\n    spaceId: string,\n  ): Promise<SpaceMember> {\n    this.assertHolder(actor);\n    const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);\n    this.assertRule(space.accessRule, 'by_invite');\n    await this.assertGrant(orgId, actor, actor.id, space.communityId);\n    return this.activate(orgId, actor, spaceId, actor.id, 'by_invite', 'invited', () =>\n      ownRowMissing('invited'),\n    );\n  }\n\n  async approve(\n    orgId: string,\n    actor: Actor,\n    communityId: string,\n    spaceId: string,\n    orgUserId: string,\n  ): Promise<SpaceMember> {\n    const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);\n    this.assertRule(space.accessRule, 'by_request');\n    await this.assertCanManage(orgId, actor, space.communityId);\n    await this.assertGrant(orgId, actor, orgUserId, space.communityId);\n    return this.activate(\n      orgId,\n      actor,\n      spaceId,\n      orgUserId,\n      'by_request',\n      'requested',\n      () => new NotFoundError('Space member', orgUserId),\n    );\n  }\n\n  async decline(\n    orgId: string,\n    actor: Actor,\n    communityId: string,\n    spaceId: string,\n    orgUserId: string,\n  ): Promise<SpaceMember> {\n    const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);\n    await this.assertCanManage(orgId, actor, space.communityId);\n    return this.deleteMember(\n      orgId,\n      actor,\n      spaceId,\n      orgUserId,\n      'requested',\n      () => new NotFoundError('Space member', orgUserId),\n    );\n  }\n\n  async refuse(\n    orgId: string,\n    actor: Actor,\n    communityId: string,\n    spaceId: string,\n  ): Promise<SpaceMember> {\n    const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);\n    this.assertHolder(actor);\n    await this.assertGrant(orgId, actor, actor.id, space.communityId);\n    return this.deleteMember(orgId, actor, spaceId, actor.id, 'invited', () =>\n      ownRowMissing('invited'),\n    );\n  }\n\n  async leave(\n    orgId: string,\n    actor: Actor,\n    communityId: string,\n    spaceId: string,\n  ): Promise<SpaceMember> {\n    const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);\n    this.assertHolder(actor);\n    await this.assertGrant(orgId, actor, actor.id, space.communityId);\n    return this.deleteMember(orgId, actor, spaceId, actor.id, 'active', () =>\n      ownRowMissing('active'),\n    );\n  }\n\n  async remove(\n    orgId: string,\n    actor: Actor,\n    communityId: string,\n    spaceId: string,\n    orgUserId: string,\n  ): Promise<SpaceMember> {\n    const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);\n    this.assertHasMembers(space.accessRule);\n    await this.assertCanManage(orgId, actor, space.communityId);\n    const { updated, previousStatus } = await this.uow.run(\n      async ({ entitlements, spaces, outbox }) => {\n        const locked = await this.lockSpace(spaces, orgId, spaceId);\n        this.assertHasMembers(locked.accessRule);\n        const row = await entitlements.lockSpaceMember(orgId, spaceId, orgUserId);\n        if (!row) {\n          this.logger.warn('space member remove rejected — not found', {\n            orgId,\n            spaceId,\n            orgUserId,\n            actorId: actor.id,\n          });\n          throw new NotFoundError('Space member', orgUserId);\n        }\n        if (row.status === 'revoked') {\n          throw new ConflictError('This person is already removed from the space');\n        }\n        const next = await entitlements.updateSpaceMemberStatus(orgId, row.id, 'revoked');\n        if (!next) {\n          throw new NotFoundError('Space member', row.id);\n        }\n        await outbox.append([\n          entitlementEvents.spaceMemberUpdated.make({\n            orgId,\n            data: next,\n            metadata: { actorOrgUserId: actor.id, previousStatus: row.status },\n          }),\n        ]);\n        return { updated: next, previousStatus: row.status };\n      },\n    );\n    this.logger.info('space member removed', {\n      orgId,\n      spaceId,\n      orgUserId,\n      previousStatus,\n      actorId: actor.id,\n    });\n    return updated;\n  }\n\n  async listSpaceMembers(\n    orgId: string,\n    actor: Actor,\n    communityId: string,\n    spaceId: string,\n    query: { page: number; pageSize: number },\n  ): Promise<Page<SpaceMember>> {\n    const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);\n    if (!(await this.canOpen(orgId, actor, space))) {\n      throw new NotFoundError('Space', spaceId);\n    }\n    return this.repo.listSpaceMembers(orgId, spaceId, {\n      ...query,\n      ...(canModerate(actor.role) ? {} : { statuses: ['active'] }),\n    });\n  }\n\n  hasDueNotices(orgId: string, now: Date): Promise<boolean> {\n    return this.repo.hasDueNotices(orgId, now, new Date(now.getTime() + ENDING_SOON_MS));\n  }\n\n  async expireDue(orgId: string, now: Date): Promise<void> {\n    const until = new Date(now.getTime() + ENDING_SOON_MS);\n    let appended = 0;\n    let afterId: string | undefined;\n    for (;;) {\n      const batch = await this.uow.run(async ({ entitlements, outbox }) => {\n        const events: NewDomainEvent[] = [];\n        const grants = await entitlements.listGrantsExpiredBy(\n          orgId,\n          now,\n          NOTICE_BATCH_SIZE,\n          afterId,\n        );\n        for (const grant of grants) {\n          if (!grant.expiresAt) {\n            continue;\n          }\n          const claimed = await entitlements.claimNotice(\n            orgId,\n            { kind: 'expired', entitlementId: grant.id, expiresAt: grant.expiresAt },\n            now,\n          );\n          if (claimed) {\n            events.push(entitlementEvents.entitlementExpired.make({ orgId, data: grant }));\n          }\n        }\n        if (events.length > 0) {\n          await outbox.append(events);\n        }\n        return { events: events.length, last: grants.at(-1)?.id, size: grants.length };\n      });\n      appended += batch.events;\n      if (batch.size < NOTICE_BATCH_SIZE || batch.last === undefined) {\n        break;\n      }\n      afterId = batch.last;\n    }\n    let afterKey: EndingGrantKey | undefined;\n    for (;;) {\n      const batch = await this.uow.run(async ({ entitlements, outbox }) => {\n        const events: NewDomainEvent[] = [];\n        const ending = await entitlements.listGrantsEndingBetween(\n          orgId,\n          now,\n          until,\n          NOTICE_BATCH_SIZE,\n          afterKey,\n        );\n        for (const { grant, communityId } of ending) {\n          if (!grant.expiresAt) {\n            continue;\n          }\n          const claimed = await entitlements.claimNotice(\n            orgId,\n            {\n              kind: 'ending_soon',\n              entitlementId: grant.id,\n              communityId,\n              expiresAt: grant.expiresAt,\n            },\n            now,\n          );\n          if (claimed) {\n            events.push(\n              entitlementEvents.entitlementEndingSoon.make({\n                orgId,\n                data: { ...grant, communityId },\n              }),\n            );\n          }\n        }\n        if (events.length > 0) {\n          await outbox.append(events);\n        }\n        const last = ending.at(-1);\n        return {\n          events: events.length,\n          last: last && { entitlementId: last.grant.id, communityId: last.communityId },\n          size: ending.length,\n        };\n      });\n      appended += batch.events;\n      if (batch.size < NOTICE_BATCH_SIZE || batch.last === undefined) {\n        break;\n      }\n      afterKey = batch.last;\n    }\n    if (appended > 0) {\n      this.logger.info('due grants expired', { orgId, events: appended });\n    }\n  }\n\n  private async requireSpaceIn(orgId: string, communityId: string, spaceId: string) {\n    const space = await this.content.getSpace(orgId, spaceId);\n    if (!space || space.communityId !== communityId) {\n      this.logger.warn('space members rejected — space not found', {\n        orgId,\n        communityId,\n        spaceId,\n      });\n      throw new NotFoundError('Space', spaceId);\n    }\n    return space;\n  }\n\n  private async requireVisibleSpaceIn(\n    orgId: string,\n    actor: Actor,\n    communityId: string,\n    spaceId: string,\n  ) {\n    const space = await this.requireSpaceIn(orgId, communityId, spaceId);\n    if (seesSpace(actor.role, space.accessRule, undefined)) {\n      return space;\n    }\n    const row = await this.repo.findSpaceMember(orgId, spaceId, actor.id);\n    if (!seesSpace(actor.role, space.accessRule, row?.status)) {\n      throw new NotFoundError('Space', spaceId);\n    }\n    return space;\n  }\n\n  private assertHasMembers(accessRule: SpaceAccessRule): void {\n    if (accessRule === 'all_members') {\n      throw new ConflictError('An all-members space has no space members');\n    }\n  }\n\n  private assertRule(accessRule: SpaceAccessRule, expected: 'by_request' | 'by_invite'): void {\n    this.assertHasMembers(accessRule);\n    if (accessRule !== expected) {\n      throw new ConflictError(\n        accessRule === 'by_invite' ? 'This space is by invitation' : 'This space is by request',\n      );\n    }\n  }\n\n  private assertHolder(actor: Actor): void {\n    if (isStaffRole(actor.role)) {\n      throw new ForbiddenError('Staff do not hold a place in a space');\n    }\n  }\n\n  private async assertGrant(\n    orgId: string,\n    actor: Actor,\n    orgUserId: string,\n    communityId: string,\n  ): Promise<void> {\n    const member = await this.repo.hasCommunityAccess(orgId, orgUserId, communityId);\n    if (!member) {\n      throw new ForbiddenError(\n        orgUserId === actor.id\n          ? 'You are not a member of this community'\n          : 'That person is not a member of this community',\n      );\n    }\n  }\n\n  private async assertHolds(\n    orgId: string,\n    actor: Actor,\n    orgUserId: string,\n    communityId: string,\n  ): Promise<void> {\n    const facts = await this.accessOf(orgId, orgUserId, communityId, null);\n    if (facts && isStaffRole(facts.role)) {\n      throw new ForbiddenError('Staff do not hold a place in a space');\n    }\n    await this.assertGrant(orgId, actor, orgUserId, communityId);\n  }\n\n  private async assertCanManage(orgId: string, actor: Actor, communityId: string): Promise<void> {\n    const facts = await this.accessOf(orgId, actor.id, communityId, null);\n    if (facts?.member && canModerate(facts.role)) {\n      return;\n    }\n    throw new ForbiddenError('You cannot manage members of this space');\n  }\n\n  private async accessOf(\n    orgId: string,\n    orgUserId: string,\n    communityId: string,\n    spaceId: string | null,\n  ): Promise<AccessFacts | null> {\n    const [facts] = await this.repo.accessAmong(orgId, communityId, spaceId, [orgUserId]);\n    return facts ?? null;\n  }\n\n  private async createMember(\n    orgId: string,\n    actor: Actor,\n    space: { communityId: string; id: string },\n    orgUserId: string,\n    status: InsertSpaceMemberInput['status'],\n    source: InsertSpaceMemberInput['source'],\n  ): Promise<SpaceMember> {\n    return this.uow.run(async ({ entitlements, outbox }) =>\n      this.insertMember(entitlements, outbox, orgId, actor, {\n        communityId: space.communityId,\n        spaceId: space.id,\n        orgUserId,\n        status,\n        source,\n      }),\n    );\n  }\n\n  private async insertMember(\n    entitlements: EntitlementsRepository,\n    outbox: OutboxAppender,\n    orgId: string,\n    actor: Actor,\n    input: InsertSpaceMemberInput,\n    room?: Space,\n  ): Promise<SpaceMember> {\n    const existing = await entitlements.lockSpaceMember(orgId, input.spaceId, input.orgUserId);\n    if (existing && existing.status !== 'revoked') {\n      throw new ConflictError(\n        input.orgUserId === actor.id\n          ? 'You already have a place in this space'\n          : 'That person already has a place in this space',\n      );\n    }\n    if (room) {\n      await this.assertRoom(entitlements, orgId, room);\n    }\n    if (existing) {\n      await entitlements.deleteSpaceMember(orgId, existing.id);\n    }\n    const created = await entitlements.insertSpaceMember(orgId, input);\n    await outbox.append([\n      entitlementEvents.spaceMemberCreated.make({\n        orgId,\n        data: created,\n        metadata: { actorOrgUserId: actor.id },\n      }),\n    ]);\n    return created;\n  }\n\n  private async activate(\n    orgId: string,\n    actor: Actor,\n    spaceId: string,\n    orgUserId: string,\n    rule: 'by_request' | 'by_invite',\n    from: SpaceMember['status'],\n    missing: () => Error,\n  ): Promise<SpaceMember> {\n    const updated = await this.uow.run(async ({ entitlements, spaces, outbox }) => {\n      const locked = await this.lockSpace(spaces, orgId, spaceId);\n      this.assertRule(locked.accessRule, rule);\n      const row = await entitlements.lockSpaceMember(orgId, spaceId, orgUserId);\n      if (row?.status === 'active') {\n        throw alreadyPlaced(actor, orgUserId);\n      }\n      if (!row || row.status !== from) {\n        this.logger.warn('space member activate rejected — not found', {\n          orgId,\n          spaceId,\n          orgUserId,\n          actorId: actor.id,\n        });\n        throw missing();\n      }\n      await this.assertRoom(entitlements, orgId, locked);\n      const next = await entitlements.updateSpaceMemberStatus(orgId, row.id, 'active');\n      if (!next) {\n        throw missing();\n      }\n      await outbox.append([\n        entitlementEvents.spaceMemberUpdated.make({\n          orgId,\n          data: next,\n          metadata: { actorOrgUserId: actor.id, previousStatus: from },\n        }),\n      ]);\n      return next;\n    });\n    this.logger.info('space member activated', { orgId, spaceId, orgUserId, actorId: actor.id });\n    return updated;\n  }\n\n  private async deleteMember(\n    orgId: string,\n    actor: Actor,\n    spaceId: string,\n    orgUserId: string,\n    from: SpaceMember['status'],\n    missing: () => Error,\n  ): Promise<SpaceMember> {\n    const row = await this.uow.run(async ({ entitlements, outbox }) => {\n      const current = await entitlements.lockSpaceMember(orgId, spaceId, orgUserId);\n      if (from !== 'active' && current?.status === 'active') {\n        throw alreadyPlaced(actor, orgUserId);\n      }\n      if (!current || current.status !== from) {\n        this.logger.warn('space member delete rejected — not found', {\n          orgId,\n          spaceId,\n          orgUserId,\n          actorId: actor.id,\n        });\n        throw missing();\n      }\n      await entitlements.deleteSpaceMember(orgId, current.id);\n      await outbox.append([\n        entitlementEvents.spaceMemberDeleted.make({\n          orgId,\n          data: current,\n          metadata: { actorOrgUserId: actor.id, previousStatus: from },\n        }),\n      ]);\n      return current;\n    });\n    this.logger.info('space member deleted', {\n      orgId,\n      spaceId,\n      orgUserId,\n      previousStatus: from,\n      actorId: actor.id,\n    });\n    return row;\n  }\n\n  private async lockSpace(spaces: SpaceRowLock, orgId: string, spaceId: string) {\n    const locked = await spaces.lockSpace(orgId, spaceId);\n    if (!locked) {\n      throw new NotFoundError('Space', spaceId);\n    }\n    return locked;\n  }\n\n  private async assertRoom(\n    entitlements: EntitlementsRepository,\n    orgId: string,\n    space: Space,\n  ): Promise<void> {\n    if (space.capacity === null) {\n      return;\n    }\n    const count = await entitlements.countActiveSpaceMembers(orgId, space.id);\n    if (count >= space.capacity) {\n      throw new ConflictError('This space is full');\n    }\n  }\n}\n\nfunction alreadyPlaced(actor: Actor, orgUserId: string): ConflictError {\n  return new ConflictError(\n    orgUserId === actor.id\n      ? 'You already have a place in this space'\n      : 'That person already has a place in this space',\n  );\n}\n\nfunction ownRowMissing(status: 'invited' | 'active'): ConflictError {\n  return new ConflictError(\n    status === 'invited'\n      ? 'You do not have an invitation to this space'\n      : 'You are not a member of this space',\n  );\n}\n"],"mappings":";;;;;;AAkCA,MAAM,iBAAiB,QAAc,KAAK;AAC1C,MAAM,oBAAoB;AAW1B,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,OAAO,OAAO;EACnB,KAAK,UAAU,OAAO;EACtB,KAAK,MAAM,OAAO;EAClB,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,KAAK,OAAe,OAAsD;EACxE,OAAO,KAAK,KAAK,KAAK,OAAO,KAAK;CACpC;CAEA,MAAM,MAAM,OAAe,OAAoD;EAC7E,MAAM,cAAc,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,cAAc,aAAa;GACzE,MAAM,UAAU,MAAM,aAAa,OAAO,OAAO,KAAK;GACtD,MAAM,OAAO,OAAO,CAClB,kBAAkB,mBAAmB,KAAK;IACxC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,uBAAuB;GACtC;GACA,eAAe,YAAY;GAC3B,WAAW,YAAY;GACvB,UAAU,YAAY;GACtB,WAAW,YAAY;EACzB,CAAC;EACD,OAAO;CACT;CAEA,MAAM,YAAY,OAAe,OAAoD;EACnF,MAAM,EAAE,aAAa,WAAW,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,cAAc,aAAa;GACrF,MAAM,UAAU,MAAM,aAAa,eAAe,OAAO,KAAK;GAC9D,IAAI,SAAS;IACX,MAAM,OAAO,OAAO,CAAC,kBAAkB,mBAAmB,KAAK;KAAE;KAAO,MAAM;IAAQ,CAAC,CAAC,CAAC;IACzF,OAAO;KAAE,aAAa;KAAS,QAAQ;IAAmB;GAC5D;GACA,MAAM,WAAW,MAAM,aAAa,UAAU,OAAO,KAAK;GAC1D,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,4CAA4C;GAEtE,IAAI,SAAS,WAAW,WACtB,OAAO;IAAE,aAAa;IAAU,QAAQ;GAAK;GAE/C,MAAM,YAAY,YAAY,SAAS,WAAW,MAAM,aAAa,IAAI;GACzE,IAAI,WAAW,QAAQ,MAAM,SAAS,WAAW,QAAQ,GACvD,OAAO;IAAE,aAAa;IAAU,QAAQ;GAAK;GAE/C,MAAM,UAAU,MAAM,aAAa,aAAa,OAAO,SAAS,IAAI,SAAS;GAC7E,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,eAAe,SAAS,EAAE;GAEpD,MAAM,OAAO,OAAO,CAAC,kBAAkB,mBAAmB,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC,CAAC;GACzF,OAAO;IAAE,aAAa;IAAS,QAAQ;GAAmB;EAC5D,CAAC;EACD,IAAI,QACF,KAAK,OAAO,KAAK,WAAW,YAAY,wBAAwB,wBAAwB;GACtF;GACA,eAAe,YAAY;GAC3B,WAAW,YAAY;GACvB,UAAU,YAAY;GACtB,WAAW,YAAY;EACzB,CAAC;EAEH,OAAO;CACT;CAEA,MAAM,UACJ,OACA,IACA,QAC6B;EAC7B,MAAM,cAAc,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,cAAc,aAAa;GACzE,MAAM,UAAU,MAAM,aAAa,UAAU,OAAO,IAAI,MAAM;GAC9D,IAAI,CAAC,SACH,OAAO;GAET,MAAM,OAAO,OAAO,CAClB,WAAW,YACP,kBAAkB,mBAAmB,KAAK;IACxC;IACA,MAAM;GACR,CAAC,IACD,kBAAkB,mBAAmB,KAAK;IACxC;IACA,MAAM;GACR,CAAC,CACP,CAAC;GACD,OAAO;EACT,CAAC;EACD,IAAI,aACF,KAAK,OAAO,KAAK,8BAA8B;GAAE;GAAO,eAAe;GAAI;EAAO,CAAC;EAErF,OAAO;CACT;CAEA,UAAU,OAAe,WAAmB,WAAqC;EAC/E,OAAO,KAAK,KAAK,UAAU,OAAO,WAAW,SAAS;CACxD;CAEA,sBAAsB,OAAe,WAAmB,MAAuC;EAC7F,OAAO,KAAK,KAAK,sBAAsB,OAAO,WAAW,IAAI;CAC/D;CAEA,MAAM,kBAAkB,OAAe,OAAc,aAAuC;EAE1F,QAAO,MADa,KAAK,SAAS,OAAO,MAAM,IAAI,aAAa,IAAI,EAAA,EACtD,WAAW;CAC3B;CAEA,MAAM,aAAa,OAAe,OAAc,SAAmC;EACjF,MAAM,QAAQ,MAAM,KAAK,QAAQ,SAAS,OAAO,OAAO;EACxD,IAAI,CAAC,OACH,OAAO;EAET,OAAO,KAAK,QAAQ,OAAO,OAAO,KAAK;CACzC;CAEA,MAAM,QAAQ,OAAe,OAAc,OAAwC;EACjF,MAAM,QAAQ,MAAM,KAAK,SAAS,OAAO,MAAM,IAAI,MAAM,aAAa,MAAM,EAAE;EAC9E,IAAI,CAAC,OACH,OAAO;EAET,OAAO,WAAW,MAAM,MAAM,MAAM,QAAQ,MAAM,YAAY,MAAM,aAAa;CACnF;CAEA,MAAM,eACJ,OACA,OACA,aACgD;EAChD,MAAM,OAAO,MAAM,KAAK,KAAK,oBAAoB,OAAO,MAAM,IAAI,WAAW;EAC7E,OAAO,OAAO,YAAY,KAAK,KAAK,QAAQ,CAAC,IAAI,SAAS,IAAI,MAAM,CAAC,CAAC;CACxE;CAEA,MAAM,cAAc,OAAe,OAAc,aAAuC;EACtF,MAAM,QAAQ,MAAM,KAAK,SAAS,OAAO,MAAM,IAAI,aAAa,IAAI;EACpE,IAAI,CAAC,OAAO,QACV,OAAO,CAAC;EAEV,MAAM,CAAC,QAAQ,aAAa,MAAM,QAAQ,IAAI,CAC5C,KAAK,QAAQ,WAAW,OAAO,WAAW,GAC1C,KAAK,KAAK,eAAe,OAAO,MAAM,IAAI,WAAW,CACvD,CAAC;EACD,MAAM,SAAS,IAAI,IAAI,SAAS;EAChC,OAAO,OAAO,QAAQ,UACpB,WAAW,MAAM,MAAM,MAAM,QAAQ,MAAM,YAAY,OAAO,IAAI,MAAM,EAAE,CAAC,CAC7E;CACF;CAEA,MAAM,aAAa,OAAe,OAAc,aAAwC;EAEtF,QAAO,MADc,KAAK,cAAc,OAAO,OAAO,WAAW,EAAA,CACnD,KAAK,UAAU,MAAM,EAAE;CACvC;CAEA,MAAM,sBACJ,OACA,aACA,YACmB;EACnB,IAAI,WAAW,WAAW,GACxB,OAAO,CAAC;EAGV,QAAO,MADa,KAAK,KAAK,YAAY,OAAO,aAAa,MAAM,UAAU,EAAA,CACjE,QAAQ,SAAS,KAAK,MAAM,CAAC,CAAC,KAAK,SAAS,KAAK,SAAS;CACzE;CAEA,MAAM,kBAAkB,OAAe,SAAiB,YAAyC;EAC/F,IAAI,WAAW,WAAW,GACxB,OAAO,CAAC;EAEV,MAAM,QAAQ,MAAM,KAAK,QAAQ,SAAS,OAAO,OAAO;EACxD,IAAI,CAAC,OACH,OAAO,CAAC;EAGV,QAAO,MADa,KAAK,KAAK,YAAY,OAAO,MAAM,aAAa,MAAM,IAAI,UAAU,EAAA,CAErF,QAAQ,SAAS,WAAW,KAAK,MAAM,KAAK,QAAQ,MAAM,YAAY,KAAK,aAAa,CAAC,CAAC,CAC1F,KAAK,SAAS,KAAK,SAAS;CACjC;CAEA,MAAM,aAAa,OAAe,SAAoC;EACpE,MAAM,QAAQ,MAAM,KAAK,QAAQ,SAAS,OAAO,OAAO;EACxD,IAAI,CAAC,OACH,OAAO,CAAC;EAEV,MAAM,UAAU,MAAM,KAAK,KAAK,mBAAmB,OAAO,MAAM,WAAW;EAC3E,OAAO,KAAK,kBAAkB,OAAO,SAAS,OAAO;CACvD;CAEA,oBAAoB,OAAe,OAAuC;EACxE,OAAO,KAAK,KAAK,oBAAoB,OAAO,KAAK;CACnD;CAEA,sBAAsB,OAAe,aAAwC;EAC3E,OAAO,KAAK,KAAK,sBAAsB,OAAO,WAAW;CAC3D;CAEA,sBAAsB,OAAe,WAAsC;EACzE,OAAO,KAAK,KAAK,sBAAsB,OAAO,SAAS;CACzD;CAEA,wBAAwB,OAAe,SAAkC;EACvE,OAAO,KAAK,KAAK,wBAAwB,OAAO,OAAO;CACzD;CAEA,MAAM,YACJ,OACA,OACA,aACA,SACsB;EACtB,MAAM,QAAQ,MAAM,KAAK,sBAAsB,OAAO,OAAO,aAAa,OAAO;EACjF,KAAK,WAAW,MAAM,YAAY,YAAY;EAC9C,IAAI,YAAY,MAAM,IAAI,GACxB,MAAM,IAAI,eAAe,yCAAyC;EAEpE,MAAM,KAAK,YAAY,OAAO,OAAO,MAAM,IAAI,MAAM,WAAW;EAChE,MAAM,UAAU,MAAM,KAAK,aAAa,OAAO,OAAO,OAAO,MAAM,IAAI,aAAa,SAAS;EAC7F,KAAK,OAAO,KAAK,wBAAwB;GACvC;GACA;GACA,WAAW,MAAM;GACjB,QAAQ,QAAQ;GAChB,SAAS,MAAM;EACjB,CAAC;EACD,OAAO;CACT;CAEA,MAAM,OACJ,OACA,OACA,aACA,SACA,WACsB;EACtB,MAAM,QAAQ,MAAM,KAAK,sBAAsB,OAAO,OAAO,aAAa,OAAO;EACjF,KAAK,WAAW,MAAM,YAAY,WAAW;EAC7C,MAAM,KAAK,gBAAgB,OAAO,OAAO,MAAM,WAAW;EAC1D,MAAM,KAAK,YAAY,OAAO,OAAO,WAAW,MAAM,WAAW;EACjE,MAAM,UAAU,MAAM,KAAK,aAAa,OAAO,OAAO,OAAO,WAAW,WAAW,QAAQ;EAC3F,KAAK,OAAO,KAAK,wBAAwB;GACvC;GACA;GACA;GACA,QAAQ,QAAQ;GAChB,SAAS,MAAM;EACjB,CAAC;EACD,OAAO;CACT;CAEA,MAAM,eACJ,OACA,OACA,aACA,SACA,WACsB;EACtB,MAAM,QAAQ,MAAM,KAAK,sBAAsB,OAAO,OAAO,aAAa,OAAO;EACjF,KAAK,iBAAiB,MAAM,UAAU;EACtC,MAAM,KAAK,gBAAgB,OAAO,OAAO,MAAM,WAAW;EAC1D,MAAM,KAAK,YAAY,OAAO,OAAO,WAAW,MAAM,WAAW;EACjE,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,UAAU;GAClD,MAAM,SAAS,MAAM,KAAK,UAAU,MAAM,QAAQ,OAAO,OAAO;GAChE,KAAK,iBAAiB,OAAO,UAAU;GACvC,OAAO,KAAK,aACV,MAAM,cACN,MAAM,QACN,OACA,OACA;IACE,aAAa,MAAM;IACnB;IACA;IACA,QAAQ;IACR,QAAQ;GACV,GACA,MACF;EACF,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB;GACvC;GACA;GACA;GACA,QAAQ,QAAQ;GAChB,SAAS,MAAM;EACjB,CAAC;EACD,OAAO;CACT;CAEA,MAAM,OACJ,OACA,OACA,aACA,SACsB;EACtB,KAAK,aAAa,KAAK;EACvB,MAAM,QAAQ,MAAM,KAAK,sBAAsB,OAAO,OAAO,aAAa,OAAO;EACjF,KAAK,WAAW,MAAM,YAAY,WAAW;EAC7C,MAAM,KAAK,YAAY,OAAO,OAAO,MAAM,IAAI,MAAM,WAAW;EAChE,OAAO,KAAK,SAAS,OAAO,OAAO,SAAS,MAAM,IAAI,aAAa,iBACjE,cAAc,SAAS,CACzB;CACF;CAEA,MAAM,QACJ,OACA,OACA,aACA,SACA,WACsB;EACtB,MAAM,QAAQ,MAAM,KAAK,sBAAsB,OAAO,OAAO,aAAa,OAAO;EACjF,KAAK,WAAW,MAAM,YAAY,YAAY;EAC9C,MAAM,KAAK,gBAAgB,OAAO,OAAO,MAAM,WAAW;EAC1D,MAAM,KAAK,YAAY,OAAO,OAAO,WAAW,MAAM,WAAW;EACjE,OAAO,KAAK,SACV,OACA,OACA,SACA,WACA,cACA,mBACM,IAAI,cAAc,gBAAgB,SAAS,CACnD;CACF;CAEA,MAAM,QACJ,OACA,OACA,aACA,SACA,WACsB;EACtB,MAAM,QAAQ,MAAM,KAAK,sBAAsB,OAAO,OAAO,aAAa,OAAO;EACjF,MAAM,KAAK,gBAAgB,OAAO,OAAO,MAAM,WAAW;EAC1D,OAAO,KAAK,aACV,OACA,OACA,SACA,WACA,mBACM,IAAI,cAAc,gBAAgB,SAAS,CACnD;CACF;CAEA,MAAM,OACJ,OACA,OACA,aACA,SACsB;EACtB,MAAM,QAAQ,MAAM,KAAK,sBAAsB,OAAO,OAAO,aAAa,OAAO;EACjF,KAAK,aAAa,KAAK;EACvB,MAAM,KAAK,YAAY,OAAO,OAAO,MAAM,IAAI,MAAM,WAAW;EAChE,OAAO,KAAK,aAAa,OAAO,OAAO,SAAS,MAAM,IAAI,iBACxD,cAAc,SAAS,CACzB;CACF;CAEA,MAAM,MACJ,OACA,OACA,aACA,SACsB;EACtB,MAAM,QAAQ,MAAM,KAAK,sBAAsB,OAAO,OAAO,aAAa,OAAO;EACjF,KAAK,aAAa,KAAK;EACvB,MAAM,KAAK,YAAY,OAAO,OAAO,MAAM,IAAI,MAAM,WAAW;EAChE,OAAO,KAAK,aAAa,OAAO,OAAO,SAAS,MAAM,IAAI,gBACxD,cAAc,QAAQ,CACxB;CACF;CAEA,MAAM,OACJ,OACA,OACA,aACA,SACA,WACsB;EACtB,MAAM,QAAQ,MAAM,KAAK,sBAAsB,OAAO,OAAO,aAAa,OAAO;EACjF,KAAK,iBAAiB,MAAM,UAAU;EACtC,MAAM,KAAK,gBAAgB,OAAO,OAAO,MAAM,WAAW;EAC1D,MAAM,EAAE,SAAS,mBAAmB,MAAM,KAAK,IAAI,IACjD,OAAO,EAAE,cAAc,QAAQ,aAAa;GAC1C,MAAM,SAAS,MAAM,KAAK,UAAU,QAAQ,OAAO,OAAO;GAC1D,KAAK,iBAAiB,OAAO,UAAU;GACvC,MAAM,MAAM,MAAM,aAAa,gBAAgB,OAAO,SAAS,SAAS;GACxE,IAAI,CAAC,KAAK;IACR,KAAK,OAAO,KAAK,4CAA4C;KAC3D;KACA;KACA;KACA,SAAS,MAAM;IACjB,CAAC;IACD,MAAM,IAAI,cAAc,gBAAgB,SAAS;GACnD;GACA,IAAI,IAAI,WAAW,WACjB,MAAM,IAAI,cAAc,+CAA+C;GAEzE,MAAM,OAAO,MAAM,aAAa,wBAAwB,OAAO,IAAI,IAAI,SAAS;GAChF,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,gBAAgB,IAAI,EAAE;GAEhD,MAAM,OAAO,OAAO,CAClB,kBAAkB,mBAAmB,KAAK;IACxC;IACA,MAAM;IACN,UAAU;KAAE,gBAAgB,MAAM;KAAI,gBAAgB,IAAI;IAAO;GACnE,CAAC,CACH,CAAC;GACD,OAAO;IAAE,SAAS;IAAM,gBAAgB,IAAI;GAAO;EACrD,CACF;EACA,KAAK,OAAO,KAAK,wBAAwB;GACvC;GACA;GACA;GACA;GACA,SAAS,MAAM;EACjB,CAAC;EACD,OAAO;CACT;CAEA,MAAM,iBACJ,OACA,OACA,aACA,SACA,OAC4B;EAC5B,MAAM,QAAQ,MAAM,KAAK,sBAAsB,OAAO,OAAO,aAAa,OAAO;EACjF,IAAI,CAAE,MAAM,KAAK,QAAQ,OAAO,OAAO,KAAK,GAC1C,MAAM,IAAI,cAAc,SAAS,OAAO;EAE1C,OAAO,KAAK,KAAK,iBAAiB,OAAO,SAAS;GAChD,GAAG;GACH,GAAI,YAAY,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;EAC5D,CAAC;CACH;CAEA,cAAc,OAAe,KAA6B;EACxD,OAAO,KAAK,KAAK,cAAc,OAAO,KAAK,IAAI,KAAK,IAAI,QAAQ,IAAI,cAAc,CAAC;CACrF;CAEA,MAAM,UAAU,OAAe,KAA0B;EACvD,MAAM,QAAQ,IAAI,KAAK,IAAI,QAAQ,IAAI,cAAc;EACrD,IAAI,WAAW;EACf,IAAI;EACJ,SAAS;GACP,MAAM,QAAQ,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,cAAc,aAAa;IACnE,MAAM,SAA2B,CAAC;IAClC,MAAM,SAAS,MAAM,aAAa,oBAChC,OACA,KACA,mBACA,OACF;IACA,KAAK,MAAM,SAAS,QAAQ;KAC1B,IAAI,CAAC,MAAM,WACT;KAOF,IAAI,MALkB,aAAa,YACjC,OACA;MAAE,MAAM;MAAW,eAAe,MAAM;MAAI,WAAW,MAAM;KAAU,GACvE,GACF,GAEE,OAAO,KAAK,kBAAkB,mBAAmB,KAAK;MAAE;MAAO,MAAM;KAAM,CAAC,CAAC;IAEjF;IACA,IAAI,OAAO,SAAS,GAClB,MAAM,OAAO,OAAO,MAAM;IAE5B,OAAO;KAAE,QAAQ,OAAO;KAAQ,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE;KAAI,MAAM,OAAO;IAAO;GAC/E,CAAC;GACD,YAAY,MAAM;GAClB,IAAI,MAAM,OAAO,qBAAqB,MAAM,SAAS,KAAA,GACnD;GAEF,UAAU,MAAM;EAClB;EACA,IAAI;EACJ,SAAS;GACP,MAAM,QAAQ,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,cAAc,aAAa;IACnE,MAAM,SAA2B,CAAC;IAClC,MAAM,SAAS,MAAM,aAAa,wBAChC,OACA,KACA,OACA,mBACA,QACF;IACA,KAAK,MAAM,EAAE,OAAO,iBAAiB,QAAQ;KAC3C,IAAI,CAAC,MAAM,WACT;KAYF,IAAI,MAVkB,aAAa,YACjC,OACA;MACE,MAAM;MACN,eAAe,MAAM;MACrB;MACA,WAAW,MAAM;KACnB,GACA,GACF,GAEE,OAAO,KACL,kBAAkB,sBAAsB,KAAK;MAC3C;MACA,MAAM;OAAE,GAAG;OAAO;MAAY;KAChC,CAAC,CACH;IAEJ;IACA,IAAI,OAAO,SAAS,GAClB,MAAM,OAAO,OAAO,MAAM;IAE5B,MAAM,OAAO,OAAO,GAAG,EAAE;IACzB,OAAO;KACL,QAAQ,OAAO;KACf,MAAM,QAAQ;MAAE,eAAe,KAAK,MAAM;MAAI,aAAa,KAAK;KAAY;KAC5E,MAAM,OAAO;IACf;GACF,CAAC;GACD,YAAY,MAAM;GAClB,IAAI,MAAM,OAAO,qBAAqB,MAAM,SAAS,KAAA,GACnD;GAEF,WAAW,MAAM;EACnB;EACA,IAAI,WAAW,GACb,KAAK,OAAO,KAAK,sBAAsB;GAAE;GAAO,QAAQ;EAAS,CAAC;CAEtE;CAEA,MAAc,eAAe,OAAe,aAAqB,SAAiB;EAChF,MAAM,QAAQ,MAAM,KAAK,QAAQ,SAAS,OAAO,OAAO;EACxD,IAAI,CAAC,SAAS,MAAM,gBAAgB,aAAa;GAC/C,KAAK,OAAO,KAAK,4CAA4C;IAC3D;IACA;IACA;GACF,CAAC;GACD,MAAM,IAAI,cAAc,SAAS,OAAO;EAC1C;EACA,OAAO;CACT;CAEA,MAAc,sBACZ,OACA,OACA,aACA,SACA;EACA,MAAM,QAAQ,MAAM,KAAK,eAAe,OAAO,aAAa,OAAO;EACnE,IAAI,UAAU,MAAM,MAAM,MAAM,YAAY,KAAA,CAAS,GACnD,OAAO;EAET,MAAM,MAAM,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS,MAAM,EAAE;EACpE,IAAI,CAAC,UAAU,MAAM,MAAM,MAAM,YAAY,KAAK,MAAM,GACtD,MAAM,IAAI,cAAc,SAAS,OAAO;EAE1C,OAAO;CACT;CAEA,iBAAyB,YAAmC;EAC1D,IAAI,eAAe,eACjB,MAAM,IAAI,cAAc,2CAA2C;CAEvE;CAEA,WAAmB,YAA6B,UAA4C;EAC1F,KAAK,iBAAiB,UAAU;EAChC,IAAI,eAAe,UACjB,MAAM,IAAI,cACR,eAAe,cAAc,gCAAgC,0BAC/D;CAEJ;CAEA,aAAqB,OAAoB;EACvC,IAAI,YAAY,MAAM,IAAI,GACxB,MAAM,IAAI,eAAe,sCAAsC;CAEnE;CAEA,MAAc,YACZ,OACA,OACA,WACA,aACe;EAEf,IAAI,CAAC,MADgB,KAAK,KAAK,mBAAmB,OAAO,WAAW,WAAW,GAE7E,MAAM,IAAI,eACR,cAAc,MAAM,KAChB,2CACA,+CACN;CAEJ;CAEA,MAAc,YACZ,OACA,OACA,WACA,aACe;EACf,MAAM,QAAQ,MAAM,KAAK,SAAS,OAAO,WAAW,aAAa,IAAI;EACrE,IAAI,SAAS,YAAY,MAAM,IAAI,GACjC,MAAM,IAAI,eAAe,sCAAsC;EAEjE,MAAM,KAAK,YAAY,OAAO,OAAO,WAAW,WAAW;CAC7D;CAEA,MAAc,gBAAgB,OAAe,OAAc,aAAoC;EAC7F,MAAM,QAAQ,MAAM,KAAK,SAAS,OAAO,MAAM,IAAI,aAAa,IAAI;EACpE,IAAI,OAAO,UAAU,YAAY,MAAM,IAAI,GACzC;EAEF,MAAM,IAAI,eAAe,yCAAyC;CACpE;CAEA,MAAc,SACZ,OACA,WACA,aACA,SAC6B;EAC7B,MAAM,CAAC,SAAS,MAAM,KAAK,KAAK,YAAY,OAAO,aAAa,SAAS,CAAC,SAAS,CAAC;EACpF,OAAO,SAAS;CAClB;CAEA,MAAc,aACZ,OACA,OACA,OACA,WACA,QACA,QACsB;EACtB,OAAO,KAAK,IAAI,IAAI,OAAO,EAAE,cAAc,aACzC,KAAK,aAAa,cAAc,QAAQ,OAAO,OAAO;GACpD,aAAa,MAAM;GACnB,SAAS,MAAM;GACf;GACA;GACA;EACF,CAAC,CACH;CACF;CAEA,MAAc,aACZ,cACA,QACA,OACA,OACA,OACA,MACsB;EACtB,MAAM,WAAW,MAAM,aAAa,gBAAgB,OAAO,MAAM,SAAS,MAAM,SAAS;EACzF,IAAI,YAAY,SAAS,WAAW,WAClC,MAAM,IAAI,cACR,MAAM,cAAc,MAAM,KACtB,2CACA,+CACN;EAEF,IAAI,MACF,MAAM,KAAK,WAAW,cAAc,OAAO,IAAI;EAEjD,IAAI,UACF,MAAM,aAAa,kBAAkB,OAAO,SAAS,EAAE;EAEzD,MAAM,UAAU,MAAM,aAAa,kBAAkB,OAAO,KAAK;EACjE,MAAM,OAAO,OAAO,CAClB,kBAAkB,mBAAmB,KAAK;GACxC;GACA,MAAM;GACN,UAAU,EAAE,gBAAgB,MAAM,GAAG;EACvC,CAAC,CACH,CAAC;EACD,OAAO;CACT;CAEA,MAAc,SACZ,OACA,OACA,SACA,WACA,MACA,MACA,SACsB;EACtB,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,cAAc,QAAQ,aAAa;GAC7E,MAAM,SAAS,MAAM,KAAK,UAAU,QAAQ,OAAO,OAAO;GAC1D,KAAK,WAAW,OAAO,YAAY,IAAI;GACvC,MAAM,MAAM,MAAM,aAAa,gBAAgB,OAAO,SAAS,SAAS;GACxE,IAAI,KAAK,WAAW,UAClB,MAAM,cAAc,OAAO,SAAS;GAEtC,IAAI,CAAC,OAAO,IAAI,WAAW,MAAM;IAC/B,KAAK,OAAO,KAAK,8CAA8C;KAC7D;KACA;KACA;KACA,SAAS,MAAM;IACjB,CAAC;IACD,MAAM,QAAQ;GAChB;GACA,MAAM,KAAK,WAAW,cAAc,OAAO,MAAM;GACjD,MAAM,OAAO,MAAM,aAAa,wBAAwB,OAAO,IAAI,IAAI,QAAQ;GAC/E,IAAI,CAAC,MACH,MAAM,QAAQ;GAEhB,MAAM,OAAO,OAAO,CAClB,kBAAkB,mBAAmB,KAAK;IACxC;IACA,MAAM;IACN,UAAU;KAAE,gBAAgB,MAAM;KAAI,gBAAgB;IAAK;GAC7D,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,0BAA0B;GAAE;GAAO;GAAS;GAAW,SAAS,MAAM;EAAG,CAAC;EAC3F,OAAO;CACT;CAEA,MAAc,aACZ,OACA,OACA,SACA,WACA,MACA,SACsB;EACtB,MAAM,MAAM,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,cAAc,aAAa;GACjE,MAAM,UAAU,MAAM,aAAa,gBAAgB,OAAO,SAAS,SAAS;GAC5E,IAAI,SAAS,YAAY,SAAS,WAAW,UAC3C,MAAM,cAAc,OAAO,SAAS;GAEtC,IAAI,CAAC,WAAW,QAAQ,WAAW,MAAM;IACvC,KAAK,OAAO,KAAK,4CAA4C;KAC3D;KACA;KACA;KACA,SAAS,MAAM;IACjB,CAAC;IACD,MAAM,QAAQ;GAChB;GACA,MAAM,aAAa,kBAAkB,OAAO,QAAQ,EAAE;GACtD,MAAM,OAAO,OAAO,CAClB,kBAAkB,mBAAmB,KAAK;IACxC;IACA,MAAM;IACN,UAAU;KAAE,gBAAgB,MAAM;KAAI,gBAAgB;IAAK;GAC7D,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB;GACvC;GACA;GACA;GACA,gBAAgB;GAChB,SAAS,MAAM;EACjB,CAAC;EACD,OAAO;CACT;CAEA,MAAc,UAAU,QAAsB,OAAe,SAAiB;EAC5E,MAAM,SAAS,MAAM,OAAO,UAAU,OAAO,OAAO;EACpD,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,SAAS,OAAO;EAE1C,OAAO;CACT;CAEA,MAAc,WACZ,cACA,OACA,OACe;EACf,IAAI,MAAM,aAAa,MACrB;EAGF,IAAI,MADgB,aAAa,wBAAwB,OAAO,MAAM,EAAE,KAC3D,MAAM,UACjB,MAAM,IAAI,cAAc,oBAAoB;CAEhD;AACF;AAEA,SAAS,cAAc,OAAc,WAAkC;CACrE,OAAO,IAAI,cACT,cAAc,MAAM,KAChB,2CACA,+CACN;AACF;AAEA,SAAS,cAAc,QAA6C;CAClE,OAAO,IAAI,cACT,WAAW,YACP,gDACA,oCACN;AACF"}

package/dist/identity/access.d.ts

@@ -0,0 +1,6 @@
+//#region src/identity/access.d.ts
+declare const ORG_CLAIM = "org_id";
+declare const ACCESS_TOKEN_TTL_SECONDS = 900;
+//#endregion
+export { ACCESS_TOKEN_TTL_SECONDS, ORG_CLAIM };
+//# sourceMappingURL=access.d.ts.map

package/dist/identity/access.js

@@ -0,0 +1,7 @@
+//#region src/identity/access.ts
+const ORG_CLAIM = "org_id";
+const ACCESS_TOKEN_TTL_SECONDS = 900;
+//#endregion
+export { ACCESS_TOKEN_TTL_SECONDS, ORG_CLAIM };
+
+//# sourceMappingURL=access.js.map

package/dist/identity/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","names":[],"sources":["../../src/identity/access.ts"],"sourcesContent":["export const ORG_CLAIM = 'org_id';\nexport const ACCESS_TOKEN_TTL_SECONDS = 900;\n"],"mappings":";AAAA,MAAa,YAAY;AACzB,MAAa,2BAA2B"}

package/dist/identity/index.d.ts

@@ -1,8 +1,10 @@
-import { CreateUserInput, ProvisionUserInput, UpdateUserInput } from "../types/schemas/identity.js";
+import { CreateUserInput, Notification, NotificationKind, NotificationPreference, ProvisionUserInput, UpdateUserInput, UserProfile, UserProfileView } from "../types/schemas/identity.js";
 import { User, UserId } from "../types/identity.js";
-import { IdentityEvent, UserCreated, UserDeleted, UserUpdated, identityEvents } from "./events.js";
 import "./model.js";
 import "./types.js";
-import { AuthHeaders, IdentityRepository, IdentityService, SessionAdmin, UserEditor, UserProvisioner, UserResolver } from "./ports.js";
+import { AuthHeaders, IdentityRepository, IdentityService, NewNotification, NotificationDesk, NotificationInbox, NotificationPage, NotificationService, NotificationsQuery, NotificationsRepository, ProfilePatch, SessionAdmin, UpdateProfileInput, UserEditor, UserProvisioner, UserResolver } from "./ports.js";
 import { IdentityServiceImpl } from "./service.js";
-export { type AuthHeaders, type CreateUserInput, type IdentityEvent, type IdentityRepository, type IdentityService, IdentityServiceImpl, type ProvisionUserInput, type SessionAdmin, type UpdateUserInput, type User, type UserCreated, type UserDeleted, type UserEditor, type UserId, type UserProvisioner, type UserResolver, type UserUpdated, identityEvents };
+import { NotificationServiceImpl, defaultPreference } from "./notifications.js";
+import { IdentityEvent, UserCreated, UserDeleted, UserUpdated, identityEvents } from "./events.js";
+import { ACCESS_TOKEN_TTL_SECONDS, ORG_CLAIM } from "./access.js";
+export { ACCESS_TOKEN_TTL_SECONDS, type AuthHeaders, type CreateUserInput, type IdentityEvent, type IdentityRepository, type IdentityService, IdentityServiceImpl, type NewNotification, type Notification, type NotificationDesk, type NotificationInbox, type NotificationKind, type NotificationPage, type NotificationPreference, type NotificationService, NotificationServiceImpl, type NotificationsQuery, type NotificationsRepository, ORG_CLAIM, type ProfilePatch, type ProvisionUserInput, type SessionAdmin, type UpdateProfileInput, type UpdateUserInput, type User, type UserCreated, type UserDeleted, type UserEditor, type UserId, type UserProfile, type UserProfileView, type UserProvisioner, type UserResolver, type UserUpdated, defaultPreference, identityEvents };

package/dist/identity/index.js

@@ -1,3 +1,5 @@
 import { identityEvents } from "./events.js";
 import { IdentityServiceImpl } from "./service.js";
-export { IdentityServiceImpl, identityEvents };
+import { NotificationServiceImpl, defaultPreference } from "./notifications.js";
+import { ACCESS_TOKEN_TTL_SECONDS, ORG_CLAIM } from "./access.js";
+export { ACCESS_TOKEN_TTL_SECONDS, IdentityServiceImpl, NotificationServiceImpl, ORG_CLAIM, defaultPreference, identityEvents };

package/dist/identity/model.d.ts

@@ -1,3 +1,4 @@
+import { Notification, NotificationKind, NotificationPreference, UserProfile, UserProfileView } from "../types/schemas/identity.js";
 import { User } from "../types/identity.js";
 import "../types/index.js";
-export type { User };
+export type { Notification, NotificationKind, NotificationPreference, User, UserProfile, UserProfileView };