@headless-lms/core 0.2.0 → 0.3.0

package/dist/identity/notifications.d.ts

@@ -0,0 +1,27 @@
+import { Logger } from "../types/ports.js";
+import { Notification, NotificationKind, NotificationPreference } from "../types/schemas/identity.js";
+import "../shared/ports.js";
+import "./model.js";
+import { NewNotification, NotificationPage, NotificationService, NotificationsQuery, NotificationsRepository } from "./ports.js";
+//#region src/identity/notifications.d.ts
+declare function defaultPreference(kind: NotificationKind): NotificationPreference;
+declare class NotificationServiceImpl implements NotificationService {
+  private readonly repo;
+  private readonly logger;
+  constructor(params: {
+    repo: NotificationsRepository;
+    logger?: Logger;
+  });
+  notify(orgId: string, notifications: NewNotification[]): Promise<void>;
+  preferencesFor(orgId: string, userIds: string[], kind: NotificationKind): Promise<Record<string, NotificationPreference>>;
+  listNotifications(orgId: string, userId: string, query: NotificationsQuery): Promise<NotificationPage>;
+  markNotificationRead(orgId: string, userId: string, notificationId: string): Promise<Notification>;
+  markAllNotificationsRead(orgId: string, userId: string): Promise<{
+    updated: number;
+  }>;
+  notificationPreferences(orgId: string, userId: string): Promise<NotificationPreference[]>;
+  setNotificationPreferences(orgId: string, userId: string, preferences: NotificationPreference[]): Promise<NotificationPreference[]>;
+}
+//#endregion
+export { NotificationServiceImpl, defaultPreference };
+//# sourceMappingURL=notifications.d.ts.map

package/dist/identity/notifications.js

@@ -0,0 +1,101 @@
+import { notificationKindSchema } from "../types/schemas/identity.js";
+import { genId } from "../shared/id.js";
+import { NotFoundError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
+//#region src/identity/notifications.ts
+function defaultPreference(kind) {
+	return {
+		kind,
+		inApp: true,
+		email: true
+	};
+}
+var NotificationServiceImpl = class {
+	repo;
+	logger;
+	constructor(params) {
+		this.repo = params.repo;
+		this.logger = params.logger ?? noopLogger;
+	}
+	async notify(orgId, notifications) {
+		if (notifications.length === 0) return;
+		const now = /* @__PURE__ */ new Date();
+		const rows = notifications.map((notification) => ({
+			...notification,
+			orgId,
+			id: genId("notification"),
+			createdAt: now,
+			readAt: null
+		}));
+		await this.repo.insert(orgId, rows);
+		this.logger.info("notifications added", {
+			orgId,
+			kinds: [...new Set(rows.map((row) => row.kind))],
+			count: rows.length
+		});
+	}
+	async preferencesFor(orgId, userIds, kind) {
+		const unique = [...new Set(userIds)];
+		const stored = await this.repo.preferences(orgId, unique);
+		const result = {};
+		for (const userId of unique) result[userId] = defaultPreference(kind);
+		for (const row of stored) if (row.kind === kind) result[row.userId] = {
+			kind,
+			inApp: row.inApp,
+			email: row.email
+		};
+		return result;
+	}
+	async listNotifications(orgId, userId, query) {
+		const page = await this.repo.page(orgId, userId, query);
+		this.logger.debug("notifications listed", {
+			orgId,
+			userId,
+			count: page.rows.length
+		});
+		return {
+			...page,
+			page: query.page,
+			pageSize: query.pageSize
+		};
+	}
+	async markNotificationRead(orgId, userId, notificationId) {
+		const row = await this.repo.markRead(orgId, userId, notificationId, /* @__PURE__ */ new Date());
+		if (!row) throw new NotFoundError("Notification", notificationId);
+		return row;
+	}
+	async markAllNotificationsRead(orgId, userId) {
+		const updated = await this.repo.markAllRead(orgId, userId, /* @__PURE__ */ new Date());
+		this.logger.debug("notifications marked read", {
+			orgId,
+			userId,
+			updated
+		});
+		return { updated };
+	}
+	async notificationPreferences(orgId, userId) {
+		const stored = await this.repo.preferences(orgId, [userId]);
+		const byKind = new Map(stored.map((row) => [row.kind, row]));
+		return notificationKindSchema.options.map((kind) => {
+			const row = byKind.get(kind);
+			return row ? {
+				kind,
+				inApp: row.inApp,
+				email: row.email
+			} : defaultPreference(kind);
+		});
+	}
+	async setNotificationPreferences(orgId, userId, preferences) {
+		await this.repo.upsertPreferences(orgId, userId, preferences);
+		this.logger.info("notification preferences updated", {
+			orgId,
+			userId,
+			kinds: preferences.map((pref) => pref.kind)
+		});
+		return this.notificationPreferences(orgId, userId);
+	}
+};
+//#endregion
+export { NotificationServiceImpl, defaultPreference };
+
+//# sourceMappingURL=notifications.js.map

package/dist/identity/notifications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications.js","names":[],"sources":["../../src/identity/notifications.ts"],"sourcesContent":["import { NotFoundError } from '../shared/errors.js';\nimport { genId } from '../shared/id.js';\nimport { noopLogger } from '../shared/logger.js';\nimport type { Logger } from '../shared/ports.js';\nimport { notificationKindSchema } from '../types/schemas/identity.js';\nimport type { Notification, NotificationKind, NotificationPreference } from './model.js';\nimport type {\n  NewNotification,\n  NotificationPage,\n  NotificationService,\n  NotificationsQuery,\n  NotificationsRepository,\n} from './ports.js';\n\nexport function defaultPreference(kind: NotificationKind): NotificationPreference {\n  return { kind, inApp: true, email: true };\n}\n\nexport class NotificationServiceImpl implements NotificationService {\n  private readonly repo: NotificationsRepository;\n  private readonly logger: Logger;\n\n  constructor(params: { repo: NotificationsRepository; logger?: Logger }) {\n    this.repo = params.repo;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  async notify(orgId: string, notifications: NewNotification[]): Promise<void> {\n    if (notifications.length === 0) {\n      return;\n    }\n    const now = new Date();\n    const rows: Notification[] = notifications.map((notification) => ({\n      ...notification,\n      orgId,\n      id: genId('notification'),\n      createdAt: now,\n      readAt: null,\n    }));\n    await this.repo.insert(orgId, rows);\n    this.logger.info('notifications added', {\n      orgId,\n      kinds: [...new Set(rows.map((row) => row.kind))],\n      count: rows.length,\n    });\n  }\n\n  async preferencesFor(\n    orgId: string,\n    userIds: string[],\n    kind: NotificationKind,\n  ): Promise<Record<string, NotificationPreference>> {\n    const unique = [...new Set(userIds)];\n    const stored = await this.repo.preferences(orgId, unique);\n    const result: Record<string, NotificationPreference> = {};\n    for (const userId of unique) {\n      result[userId] = defaultPreference(kind);\n    }\n    for (const row of stored) {\n      if (row.kind === kind) {\n        result[row.userId] = { kind, inApp: row.inApp, email: row.email };\n      }\n    }\n    return result;\n  }\n\n  async listNotifications(\n    orgId: string,\n    userId: string,\n    query: NotificationsQuery,\n  ): Promise<NotificationPage> {\n    const page = await this.repo.page(orgId, userId, query);\n    this.logger.debug('notifications listed', { orgId, userId, count: page.rows.length });\n    return { ...page, page: query.page, pageSize: query.pageSize };\n  }\n\n  async markNotificationRead(\n    orgId: string,\n    userId: string,\n    notificationId: string,\n  ): Promise<Notification> {\n    const row = await this.repo.markRead(orgId, userId, notificationId, new Date());\n    if (!row) {\n      throw new NotFoundError('Notification', notificationId);\n    }\n    return row;\n  }\n\n  async markAllNotificationsRead(orgId: string, userId: string): Promise<{ updated: number }> {\n    const updated = await this.repo.markAllRead(orgId, userId, new Date());\n    this.logger.debug('notifications marked read', { orgId, userId, updated });\n    return { updated };\n  }\n\n  async notificationPreferences(orgId: string, userId: string): Promise<NotificationPreference[]> {\n    const stored = await this.repo.preferences(orgId, [userId]);\n    const byKind = new Map(stored.map((row) => [row.kind, row]));\n    return notificationKindSchema.options.map((kind) => {\n      const row = byKind.get(kind);\n      return row ? { kind, inApp: row.inApp, email: row.email } : defaultPreference(kind);\n    });\n  }\n\n  async setNotificationPreferences(\n    orgId: string,\n    userId: string,\n    preferences: NotificationPreference[],\n  ): Promise<NotificationPreference[]> {\n    await this.repo.upsertPreferences(orgId, userId, preferences);\n    this.logger.info('notification preferences updated', {\n      orgId,\n      userId,\n      kinds: preferences.map((pref) => pref.kind),\n    });\n    return this.notificationPreferences(orgId, userId);\n  }\n}\n"],"mappings":";;;;;AAcA,SAAgB,kBAAkB,MAAgD;CAChF,OAAO;EAAE;EAAM,OAAO;EAAM,OAAO;CAAK;AAC1C;AAEA,IAAa,0BAAb,MAAoE;CAClE;CACA;CAEA,YAAY,QAA4D;EACtE,KAAK,OAAO,OAAO;EACnB,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,MAAM,OAAO,OAAe,eAAiD;EAC3E,IAAI,cAAc,WAAW,GAC3B;EAEF,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,OAAuB,cAAc,KAAK,kBAAkB;GAChE,GAAG;GACH;GACA,IAAI,MAAM,cAAc;GACxB,WAAW;GACX,QAAQ;EACV,EAAE;EACF,MAAM,KAAK,KAAK,OAAO,OAAO,IAAI;EAClC,KAAK,OAAO,KAAK,uBAAuB;GACtC;GACA,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC;GAC/C,OAAO,KAAK;EACd,CAAC;CACH;CAEA,MAAM,eACJ,OACA,SACA,MACiD;EACjD,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC;EACnC,MAAM,SAAS,MAAM,KAAK,KAAK,YAAY,OAAO,MAAM;EACxD,MAAM,SAAiD,CAAC;EACxD,KAAK,MAAM,UAAU,QACnB,OAAO,UAAU,kBAAkB,IAAI;EAEzC,KAAK,MAAM,OAAO,QAChB,IAAI,IAAI,SAAS,MACf,OAAO,IAAI,UAAU;GAAE;GAAM,OAAO,IAAI;GAAO,OAAO,IAAI;EAAM;EAGpE,OAAO;CACT;CAEA,MAAM,kBACJ,OACA,QACA,OAC2B;EAC3B,MAAM,OAAO,MAAM,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK;EACtD,KAAK,OAAO,MAAM,wBAAwB;GAAE;GAAO;GAAQ,OAAO,KAAK,KAAK;EAAO,CAAC;EACpF,OAAO;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,UAAU,MAAM;EAAS;CAC/D;CAEA,MAAM,qBACJ,OACA,QACA,gBACuB;EACvB,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,OAAO,QAAQ,gCAAgB,IAAI,KAAK,CAAC;EAC9E,IAAI,CAAC,KACH,MAAM,IAAI,cAAc,gBAAgB,cAAc;EAExD,OAAO;CACT;CAEA,MAAM,yBAAyB,OAAe,QAA8C;EAC1F,MAAM,UAAU,MAAM,KAAK,KAAK,YAAY,OAAO,wBAAQ,IAAI,KAAK,CAAC;EACrE,KAAK,OAAO,MAAM,6BAA6B;GAAE;GAAO;GAAQ;EAAQ,CAAC;EACzE,OAAO,EAAE,QAAQ;CACnB;CAEA,MAAM,wBAAwB,OAAe,QAAmD;EAC9F,MAAM,SAAS,MAAM,KAAK,KAAK,YAAY,OAAO,CAAC,MAAM,CAAC;EAC1D,MAAM,SAAS,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;EAC3D,OAAO,uBAAuB,QAAQ,KAAK,SAAS;GAClD,MAAM,MAAM,OAAO,IAAI,IAAI;GAC3B,OAAO,MAAM;IAAE;IAAM,OAAO,IAAI;IAAO,OAAO,IAAI;GAAM,IAAI,kBAAkB,IAAI;EACpF,CAAC;CACH;CAEA,MAAM,2BACJ,OACA,QACA,aACmC;EACnC,MAAM,KAAK,KAAK,kBAAkB,OAAO,QAAQ,WAAW;EAC5D,KAAK,OAAO,KAAK,oCAAoC;GACnD;GACA;GACA,OAAO,YAAY,KAAK,SAAS,KAAK,IAAI;EAC5C,CAAC;EACD,OAAO,KAAK,wBAAwB,OAAO,MAAM;CACnD;AACF"}

package/dist/identity/ports.d.ts

@@ -1,9 +1,21 @@
-import { CreateUserInput, UpdateUserInput } from "../types/schemas/identity.js";
+import { JsonValue } from "../types/shared.js";
+import { CreateUserInput, Notification, NotificationKind, NotificationPreference, UpdateUserInput, UserProfile, UserProfileView } from "../types/schemas/identity.js";
 import { User } from "../types/identity.js";
+import "../types/index.js";
 import { OutboxAppender, UnitOfWork } from "../shared/ports.js";
 import "./model.js";
 import "./types.js";
 //#region src/identity/ports.d.ts
+interface UpdateProfileInput {
+  displayName?: string | null;
+  headline?: string | null;
+  bio?: string | null;
+  imageAssetId?: string | null;
+  extra?: JsonValue;
+}
+interface ProfilePatch extends UpdateProfileInput {
+  imageAssetOrgId?: string | null;
+}
 interface UserProvisioner {
   createUser(input: CreateUserInput): Promise<User>;
   /** Auth signup entry point. Claims a person provisioned at invite time by
@@ -43,13 +55,71 @@ interface SessionAdmin {
   /** Points the caller's current session at `orgId`.  */
   stampActiveOrganization(headers: AuthHeaders, orgId: string): Promise<boolean>;
 }
-interface IdentityService extends UserProvisioner, UserResolver, UserEditor {}
+interface NewNotification {
+  userId: string;
+  kind: NotificationKind;
+  actorOrgUserId: string | null;
+  communityId: string | null;
+  spaceId: string | null;
+  postId: string | null;
+  commentId: string | null;
+  chatId: string | null;
+  messageId: string | null;
+}
+interface NotificationsQuery {
+  page: number;
+  pageSize: number;
+}
+interface NotificationPage {
+  rows: Notification[];
+  total: number;
+  page: number;
+  pageSize: number;
+  unreadCount: number;
+}
+/** What automations calls to tell people. */
+interface NotificationDesk {
+  notify(orgId: string, notifications: NewNotification[]): Promise<void>;
+  preferencesFor(orgId: string, userIds: string[], kind: NotificationKind): Promise<Record<string, NotificationPreference>>;
+}
+/** A person's own notifications and preferences. */
+interface NotificationInbox {
+  listNotifications(orgId: string, userId: string, query: NotificationsQuery): Promise<NotificationPage>;
+  markNotificationRead(orgId: string, userId: string, notificationId: string): Promise<Notification>;
+  markAllNotificationsRead(orgId: string, userId: string): Promise<{
+    updated: number;
+  }>;
+  notificationPreferences(orgId: string, userId: string): Promise<NotificationPreference[]>;
+  setNotificationPreferences(orgId: string, userId: string, preferences: NotificationPreference[]): Promise<NotificationPreference[]>;
+}
+interface NotificationService extends NotificationDesk, NotificationInbox {}
+interface IdentityService extends UserProvisioner, UserResolver, UserEditor {
+  profileOf(orgId: string, userId: string): Promise<UserProfileView>;
+  displayName(userId: string | null): Promise<string>;
+  updateProfile(orgId: string, userId: string, actorUserId: string, orgUserId: string, patch: UpdateProfileInput): Promise<UserProfileView>;
+}
 interface IdentityRepository {
   insertUser(input: CreateUserInput): Promise<User>;
   updateUser(id: string, input: UpdateUserInput): Promise<User | null>;
   findUserById(id: string): Promise<User | null>;
   findUserByExternalId(externalId: string): Promise<User | null>;
   findUserByEmail(email: string): Promise<User | null>;
+  findProfile(userId: string): Promise<UserProfile | null>;
+  upsertProfile(userId: string, patch: ProfilePatch): Promise<UserProfile>;
+}
+interface NotificationsRepository {
+  insert(orgId: string, rows: Notification[]): Promise<void>;
+  page(orgId: string, userId: string, query: NotificationsQuery): Promise<{
+    rows: Notification[];
+    total: number;
+    unreadCount: number;
+  }>;
+  markRead(orgId: string, userId: string, notificationId: string, at: Date): Promise<Notification | null>;
+  markAllRead(orgId: string, userId: string, at: Date): Promise<number>;
+  preferences(orgId: string, userIds: string[]): Promise<(NotificationPreference & {
+    userId: string;
+  })[]>;
+  upsertPreferences(orgId: string, userId: string, preferences: NotificationPreference[]): Promise<void>;
 }
 interface IdentityTxScope {
   identity: IdentityRepository;
@@ -57,5 +127,5 @@ interface IdentityTxScope {
 }
 type IdentityUnitOfWork = UnitOfWork<IdentityTxScope>;
 //#endregion
-export { AuthHeaders, IdentityRepository, IdentityService, IdentityTxScope, IdentityUnitOfWork, SessionAdmin, UserEditor, UserProvisioner, UserResolver };
+export { AuthHeaders, IdentityRepository, IdentityService, IdentityTxScope, IdentityUnitOfWork, NewNotification, NotificationDesk, NotificationInbox, NotificationPage, NotificationService, NotificationsQuery, NotificationsRepository, ProfilePatch, SessionAdmin, UpdateProfileInput, UserEditor, UserProvisioner, UserResolver };
 //# sourceMappingURL=ports.d.ts.map

package/dist/identity/service.d.ts

@@ -1,22 +1,29 @@
 import { Logger } from "../types/ports.js";
-import { CreateUserInput, UpdateUserInput } from "../types/schemas/identity.js";
+import { CreateUserInput, UpdateUserInput, UserProfileView } from "../types/schemas/identity.js";
 import { User } from "../types/identity.js";
 import "../shared/ports.js";
-import { Mailer } from "../shared/mailer.js";
+import { FileUrls } from "../assets/file-urls.js";
+import { MemberImageReader } from "../assets/ports.js";
+import "../assets/index.js";
 import "./model.js";
 import "./types.js";
-import { IdentityRepository, IdentityService, IdentityUnitOfWork } from "./ports.js";
+import { IdentityRepository, IdentityService, IdentityUnitOfWork, UpdateProfileInput } from "./ports.js";
+import { Mailer } from "../shared/mailer.js";
 //#region src/identity/service.d.ts
 declare class IdentityServiceImpl implements IdentityService {
   private readonly repo;
   private readonly logger;
   private readonly uow;
   private readonly mailer;
+  private readonly images;
+  private readonly fileUrls;
   constructor(input: {
     repo: IdentityRepository;
     logger?: Logger;
     mailer: Mailer;
     uow: IdentityUnitOfWork;
+    images: MemberImageReader;
+    fileUrls: FileUrls;
   });
   createUser(input: CreateUserInput): Promise<User>;
   linkOrCreateUser(input: CreateUserInput): Promise<User>;
@@ -35,6 +42,10 @@ declare class IdentityServiceImpl implements IdentityService {
     email: string;
     url: string;
   }): Promise<void>;
+  profileOf(orgId: string, userId: string): Promise<UserProfileView>;
+  private view;
+  displayName(userId: string | null): Promise<string>;
+  updateProfile(orgId: string, userId: string, actorUserId: string, orgUserId: string, patch: UpdateProfileInput): Promise<UserProfileView>;
 }
 //#endregion
 export { IdentityServiceImpl };

package/dist/identity/service.js

@@ -1,18 +1,23 @@
-import { noopLogger } from "../shared/logger.js";
 import { genId } from "../shared/id.js";
-import { ConflictError, NotFoundError } from "../shared/errors.js";
+import { ConflictError, ForbiddenError, NotFoundError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
 import { identityEvents } from "./events.js";
 //#region src/identity/service.ts
+const UNNAMED = "A member";
 var IdentityServiceImpl = class {
 	repo;
 	logger;
 	uow;
 	mailer;
+	images;
+	fileUrls;
 	constructor(input) {
 		this.repo = input.repo;
 		this.mailer = input.mailer;
 		this.logger = input.logger ?? noopLogger;
 		this.uow = input.uow;
+		this.images = input.images;
+		this.fileUrls = input.fileUrls;
 	}
 	async createUser(input) {
 		const created = await this.uow.run(async ({ identity, outbox }) => {
@@ -23,7 +28,7 @@ var IdentityServiceImpl = class {
 			})]);
 			return user;
 		});
-		this.logger.info("user created", { user: created });
+		this.logger.info("user created", { userId: created.id });
 		return created;
 	}
 	async linkOrCreateUser(input) {
@@ -49,7 +54,7 @@ var IdentityServiceImpl = class {
 			})]);
 			return user;
 		});
-		this.logger.info("user linked to auth account", { user: linked });
+		this.logger.info("user linked to auth account", { userId: linked.id });
 		return linked;
 	}
 	async updateUser(id, input) {
@@ -62,7 +67,7 @@ var IdentityServiceImpl = class {
 			})]);
 			return user;
 		});
-		this.logger.info("user updated", { user: updated });
+		this.logger.info("user updated", { userId: updated.id });
 		return updated;
 	}
 	async getUserByExternalId(externalId) {
@@ -83,6 +88,58 @@ var IdentityServiceImpl = class {
 	async sendMagicLink(input) {
 		await this.mailer.send(input.email, "magicLink", { url: input.url });
 	}
+	async profileOf(orgId, userId) {
+		const stored = await this.repo.findProfile(userId);
+		if (stored) return this.view(orgId, stored);
+		const never = /* @__PURE__ */ new Date(0);
+		return {
+			userId,
+			displayName: null,
+			headline: null,
+			bio: null,
+			imageAssetOrgId: null,
+			imageAssetId: null,
+			imageUrl: null,
+			extra: {},
+			createdAt: never,
+			updatedAt: never
+		};
+	}
+	view(orgId, profile) {
+		const imageAssetId = profile.imageAssetOrgId === orgId ? profile.imageAssetId : null;
+		return {
+			...profile,
+			imageUrl: imageAssetId ? this.fileUrls.memberUpload(imageAssetId) : null
+		};
+	}
+	async displayName(userId) {
+		if (userId === null) return UNNAMED;
+		const [profile, user] = await Promise.all([this.repo.findProfile(userId), this.repo.findUserById(userId)]);
+		const named = profile?.displayName?.trim();
+		if (named) return named;
+		return [user?.firstName, user?.lastName].filter(Boolean).join(" ").trim() || UNNAMED;
+	}
+	async updateProfile(orgId, userId, actorUserId, orgUserId, patch) {
+		if (actorUserId !== userId) throw new ForbiddenError("You can only update your own profile");
+		if (!await this.repo.findUserById(userId)) throw new NotFoundError("User", userId);
+		if (patch.imageAssetId != null) {
+			if (!await this.images.ownsImage(orgId, patch.imageAssetId, orgUserId)) {
+				this.logger.debug("profile photo refused", {
+					userId,
+					orgUserId,
+					assetId: patch.imageAssetId
+				});
+				throw new NotFoundError("Asset", patch.imageAssetId);
+			}
+		}
+		const imageAssetOrgId = patch.imageAssetId === void 0 ? void 0 : patch.imageAssetId === null ? null : orgId;
+		const profile = await this.repo.upsertProfile(userId, {
+			...patch,
+			imageAssetOrgId
+		});
+		this.logger.info("profile updated", { userId });
+		return this.view(orgId, profile);
+	}
 };
 //#endregion
 export { IdentityServiceImpl };

package/dist/identity/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../src/identity/service.ts"],"sourcesContent":["import type { IdentityRepository, IdentityService, IdentityUnitOfWork } from './ports.js';\nimport type { User } from './model.js';\nimport type { CreateUserInput, UpdateUserInput } from './types.js';\nimport type { Logger } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { genId } from '../shared/id.js';\nimport { ConflictError, NotFoundError } from '../shared/errors.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport { identityEvents } from './events.js';\n\nexport class IdentityServiceImpl implements IdentityService {\n  private readonly repo: IdentityRepository;\n  private readonly logger: Logger;\n  private readonly uow: IdentityUnitOfWork;\n  private readonly mailer: Pick<Mailer, 'send'>;\n\n  constructor(input: {\n    repo: IdentityRepository;\n    logger?: Logger;\n    mailer: Mailer;\n    uow: IdentityUnitOfWork;\n  }) {\n    this.repo = input.repo;\n    this.mailer = input.mailer;\n    this.logger = input.logger ?? noopLogger;\n    this.uow = input.uow;\n  }\n\n  async createUser(input: CreateUserInput): Promise<User> {\n    const created = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.insertUser(input);\n      await outbox.append([identityEvents.userCreated.make({ orgId: '-', data: user })]);\n      return user;\n    });\n    this.logger.info('user created', { user: created });\n    return created;\n  }\n\n  async linkOrCreateUser(input: CreateUserInput): Promise<User> {\n    const existing = await this.repo.findUserByEmail(input.email);\n    if (!existing) {\n      const id = input.id ?? genId('user');\n      return this.createUser({ ...input, id, externalId: id });\n    }\n    if (existing.externalId !== null) {\n      throw new ConflictError('That email already has an account');\n    }\n    // Existing user without external link, so invited. update the user with the\n    // id.\n    const linked = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.updateUser(existing.id, {\n        externalId: existing.id,\n        ...(input.firstName !== undefined && { firstName: input.firstName }),\n        ...(input.lastName !== undefined && { lastName: input.lastName }),\n      });\n      await outbox.append([identityEvents.userUpdated.make({ orgId: '-', data: user! })]);\n      return user!;\n    });\n    this.logger.info('user linked to auth account', { user: linked });\n    return linked;\n  }\n\n  async updateUser(id: string, input: UpdateUserInput): Promise<User> {\n    const person = await this.repo.findUserById(id);\n    if (!person) {\n      throw new NotFoundError('User', id);\n    }\n\n    const updated = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.updateUser(id, input);\n      await outbox.append([identityEvents.userUpdated.make({ orgId: '-', data: user! })]);\n      return user!;\n    });\n    this.logger.info('user updated', { user: updated });\n    return updated;\n  }\n\n  async getUserByExternalId(externalId: string): Promise<User | null> {\n    return this.repo.findUserByExternalId(externalId);\n  }\n\n  async getUserByEmail(email: string): Promise<User | null> {\n    return this.repo.findUserByEmail(email);\n  }\n\n  async getUserById(id: string): Promise<User | null> {\n    return this.repo.findUserById(id);\n  }\n\n  async sendPasswordReset(input: { email: string; url: string }): Promise<void> {\n    await this.mailer.send(input.email, 'passwordReset', { resetUrl: input.url });\n  }\n\n  async sendPasswordChanged(input: { email: string }): Promise<void> {\n    await this.mailer.send(input.email, 'passwordChanged', {});\n  }\n\n  async sendMagicLink(input: { email: string; url: string }): Promise<void> {\n    await this.mailer.send(input.email, 'magicLink', { url: input.url });\n  }\n}\n"],"mappings":";;;;;AAUA,IAAa,sBAAb,MAA4D;CAC1D;CACA;CACA;CACA;CAEA,YAAY,OAKT;EACD,KAAK,OAAO,MAAM;EAClB,KAAK,SAAS,MAAM;EACpB,KAAK,SAAS,MAAM,UAAU;EAC9B,KAAK,MAAM,MAAM;CACnB;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GACjE,MAAM,OAAO,MAAM,SAAS,WAAW,KAAK;GAC5C,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAK,CAAC,CAAC,CAAC;GACjF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,gBAAgB,EAAE,MAAM,QAAQ,CAAC;EAClD,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAuC;EAC5D,MAAM,WAAW,MAAM,KAAK,KAAK,gBAAgB,MAAM,KAAK;EAC5D,IAAI,CAAC,UAAU;GACb,MAAM,KAAK,MAAM,MAAM,MAAM,MAAM;GACnC,OAAO,KAAK,WAAW;IAAE,GAAG;IAAO;IAAI,YAAY;GAAG,CAAC;EACzD;EACA,IAAI,SAAS,eAAe,MAC1B,MAAM,IAAI,cAAc,mCAAmC;EAI7D,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GAChE,MAAM,OAAO,MAAM,SAAS,WAAW,SAAS,IAAI;IAClD,YAAY,SAAS;IACrB,GAAI,MAAM,cAAc,KAAA,KAAa,EAAE,WAAW,MAAM,UAAU;IAClE,GAAI,MAAM,aAAa,KAAA,KAAa,EAAE,UAAU,MAAM,SAAS;GACjE,CAAC;GACD,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAM,CAAC,CAAC,CAAC;GAClF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,+BAA+B,EAAE,MAAM,OAAO,CAAC;EAChE,OAAO;CACT;CAEA,MAAM,WAAW,IAAY,OAAuC;EAElE,IAAI,CAAC,MADgB,KAAK,KAAK,aAAa,EAAE,GAE5C,MAAM,IAAI,cAAc,QAAQ,EAAE;EAGpC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GACjE,MAAM,OAAO,MAAM,SAAS,WAAW,IAAI,KAAK;GAChD,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAM,CAAC,CAAC,CAAC;GAClF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,gBAAgB,EAAE,MAAM,QAAQ,CAAC;EAClD,OAAO;CACT;CAEA,MAAM,oBAAoB,YAA0C;EAClE,OAAO,KAAK,KAAK,qBAAqB,UAAU;CAClD;CAEA,MAAM,eAAe,OAAqC;EACxD,OAAO,KAAK,KAAK,gBAAgB,KAAK;CACxC;CAEA,MAAM,YAAY,IAAkC;EAClD,OAAO,KAAK,KAAK,aAAa,EAAE;CAClC;CAEA,MAAM,kBAAkB,OAAsD;EAC5E,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,iBAAiB,EAAE,UAAU,MAAM,IAAI,CAAC;CAC9E;CAEA,MAAM,oBAAoB,OAAyC;EACjE,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,mBAAmB,CAAC,CAAC;CAC3D;CAEA,MAAM,cAAc,OAAsD;EACxE,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,aAAa,EAAE,KAAK,MAAM,IAAI,CAAC;CACrE;AACF"}
+{"version":3,"file":"service.js","names":[],"sources":["../../src/identity/service.ts"],"sourcesContent":["import type { IdentityRepository, IdentityService, IdentityUnitOfWork } from './ports.js';\nimport type { User, UserProfile, UserProfileView } from './model.js';\nimport type { UpdateProfileInput } from './ports.js';\nimport type { CreateUserInput, UpdateUserInput } from './types.js';\nimport type { Logger } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { genId } from '../shared/id.js';\nimport { ConflictError, ForbiddenError, NotFoundError } from '../shared/errors.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport type { FileUrls, MemberImageReader } from '../assets/index.js';\nimport { identityEvents } from './events.js';\n\nconst UNNAMED = 'A member';\n\nexport class IdentityServiceImpl implements IdentityService {\n  private readonly repo: IdentityRepository;\n  private readonly logger: Logger;\n  private readonly uow: IdentityUnitOfWork;\n  private readonly mailer: Pick<Mailer, 'send'>;\n  private readonly images: MemberImageReader;\n  private readonly fileUrls: FileUrls;\n\n  constructor(input: {\n    repo: IdentityRepository;\n    logger?: Logger;\n    mailer: Mailer;\n    uow: IdentityUnitOfWork;\n    images: MemberImageReader;\n    fileUrls: FileUrls;\n  }) {\n    this.repo = input.repo;\n    this.mailer = input.mailer;\n    this.logger = input.logger ?? noopLogger;\n    this.uow = input.uow;\n    this.images = input.images;\n    this.fileUrls = input.fileUrls;\n  }\n\n  async createUser(input: CreateUserInput): Promise<User> {\n    const created = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.insertUser(input);\n      await outbox.append([identityEvents.userCreated.make({ orgId: '-', data: user })]);\n      return user;\n    });\n    this.logger.info('user created', { userId: created.id });\n    return created;\n  }\n\n  async linkOrCreateUser(input: CreateUserInput): Promise<User> {\n    const existing = await this.repo.findUserByEmail(input.email);\n    if (!existing) {\n      const id = input.id ?? genId('user');\n      return this.createUser({ ...input, id, externalId: id });\n    }\n    if (existing.externalId !== null) {\n      throw new ConflictError('That email already has an account');\n    }\n    // Existing user without external link, so invited. update the user with the\n    // id.\n    const linked = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.updateUser(existing.id, {\n        externalId: existing.id,\n        ...(input.firstName !== undefined && { firstName: input.firstName }),\n        ...(input.lastName !== undefined && { lastName: input.lastName }),\n      });\n      await outbox.append([identityEvents.userUpdated.make({ orgId: '-', data: user! })]);\n      return user!;\n    });\n    this.logger.info('user linked to auth account', { userId: linked.id });\n    return linked;\n  }\n\n  async updateUser(id: string, input: UpdateUserInput): Promise<User> {\n    const person = await this.repo.findUserById(id);\n    if (!person) {\n      throw new NotFoundError('User', id);\n    }\n\n    const updated = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.updateUser(id, input);\n      await outbox.append([identityEvents.userUpdated.make({ orgId: '-', data: user! })]);\n      return user!;\n    });\n    this.logger.info('user updated', { userId: updated.id });\n    return updated;\n  }\n\n  async getUserByExternalId(externalId: string): Promise<User | null> {\n    return this.repo.findUserByExternalId(externalId);\n  }\n\n  async getUserByEmail(email: string): Promise<User | null> {\n    return this.repo.findUserByEmail(email);\n  }\n\n  async getUserById(id: string): Promise<User | null> {\n    return this.repo.findUserById(id);\n  }\n\n  async sendPasswordReset(input: { email: string; url: string }): Promise<void> {\n    await this.mailer.send(input.email, 'passwordReset', { resetUrl: input.url });\n  }\n\n  async sendPasswordChanged(input: { email: string }): Promise<void> {\n    await this.mailer.send(input.email, 'passwordChanged', {});\n  }\n\n  async sendMagicLink(input: { email: string; url: string }): Promise<void> {\n    await this.mailer.send(input.email, 'magicLink', { url: input.url });\n  }\n\n  async profileOf(orgId: string, userId: string): Promise<UserProfileView> {\n    const stored = await this.repo.findProfile(userId);\n    if (stored) {\n      return this.view(orgId, stored);\n    }\n    const never = new Date(0);\n    return {\n      userId,\n      displayName: null,\n      headline: null,\n      bio: null,\n      imageAssetOrgId: null,\n      imageAssetId: null,\n      imageUrl: null,\n      extra: {},\n      createdAt: never,\n      updatedAt: never,\n    };\n  }\n\n  private view(orgId: string, profile: UserProfile): UserProfileView {\n    const imageAssetId = profile.imageAssetOrgId === orgId ? profile.imageAssetId : null;\n    return { ...profile, imageUrl: imageAssetId ? this.fileUrls.memberUpload(imageAssetId) : null };\n  }\n\n  async displayName(userId: string | null): Promise<string> {\n    if (userId === null) {\n      return UNNAMED;\n    }\n    const [profile, user] = await Promise.all([\n      this.repo.findProfile(userId),\n      this.repo.findUserById(userId),\n    ]);\n    const named = profile?.displayName?.trim();\n    if (named) {\n      return named;\n    }\n    const composed = [user?.firstName, user?.lastName].filter(Boolean).join(' ').trim();\n    return composed || UNNAMED;\n  }\n\n  async updateProfile(\n    orgId: string,\n    userId: string,\n    actorUserId: string,\n    orgUserId: string,\n    patch: UpdateProfileInput,\n  ): Promise<UserProfileView> {\n    if (actorUserId !== userId) {\n      throw new ForbiddenError('You can only update your own profile');\n    }\n    const user = await this.repo.findUserById(userId);\n    if (!user) {\n      throw new NotFoundError('User', userId);\n    }\n    if (patch.imageAssetId != null) {\n      const owned = await this.images.ownsImage(orgId, patch.imageAssetId, orgUserId);\n      if (!owned) {\n        this.logger.debug('profile photo refused', {\n          userId,\n          orgUserId,\n          assetId: patch.imageAssetId,\n        });\n        throw new NotFoundError('Asset', patch.imageAssetId);\n      }\n    }\n    const imageAssetOrgId =\n      patch.imageAssetId === undefined ? undefined : patch.imageAssetId === null ? null : orgId;\n    const profile = await this.repo.upsertProfile(userId, { ...patch, imageAssetOrgId });\n    this.logger.info('profile updated', { userId });\n    return this.view(orgId, profile);\n  }\n}\n"],"mappings":";;;;;AAYA,MAAM,UAAU;AAEhB,IAAa,sBAAb,MAA4D;CAC1D;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,OAOT;EACD,KAAK,OAAO,MAAM;EAClB,KAAK,SAAS,MAAM;EACpB,KAAK,SAAS,MAAM,UAAU;EAC9B,KAAK,MAAM,MAAM;EACjB,KAAK,SAAS,MAAM;EACpB,KAAK,WAAW,MAAM;CACxB;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GACjE,MAAM,OAAO,MAAM,SAAS,WAAW,KAAK;GAC5C,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAK,CAAC,CAAC,CAAC;GACjF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,gBAAgB,EAAE,QAAQ,QAAQ,GAAG,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAuC;EAC5D,MAAM,WAAW,MAAM,KAAK,KAAK,gBAAgB,MAAM,KAAK;EAC5D,IAAI,CAAC,UAAU;GACb,MAAM,KAAK,MAAM,MAAM,MAAM,MAAM;GACnC,OAAO,KAAK,WAAW;IAAE,GAAG;IAAO;IAAI,YAAY;GAAG,CAAC;EACzD;EACA,IAAI,SAAS,eAAe,MAC1B,MAAM,IAAI,cAAc,mCAAmC;EAI7D,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GAChE,MAAM,OAAO,MAAM,SAAS,WAAW,SAAS,IAAI;IAClD,YAAY,SAAS;IACrB,GAAI,MAAM,cAAc,KAAA,KAAa,EAAE,WAAW,MAAM,UAAU;IAClE,GAAI,MAAM,aAAa,KAAA,KAAa,EAAE,UAAU,MAAM,SAAS;GACjE,CAAC;GACD,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAM,CAAC,CAAC,CAAC;GAClF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,+BAA+B,EAAE,QAAQ,OAAO,GAAG,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,WAAW,IAAY,OAAuC;EAElE,IAAI,CAAC,MADgB,KAAK,KAAK,aAAa,EAAE,GAE5C,MAAM,IAAI,cAAc,QAAQ,EAAE;EAGpC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GACjE,MAAM,OAAO,MAAM,SAAS,WAAW,IAAI,KAAK;GAChD,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAM,CAAC,CAAC,CAAC;GAClF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,gBAAgB,EAAE,QAAQ,QAAQ,GAAG,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,oBAAoB,YAA0C;EAClE,OAAO,KAAK,KAAK,qBAAqB,UAAU;CAClD;CAEA,MAAM,eAAe,OAAqC;EACxD,OAAO,KAAK,KAAK,gBAAgB,KAAK;CACxC;CAEA,MAAM,YAAY,IAAkC;EAClD,OAAO,KAAK,KAAK,aAAa,EAAE;CAClC;CAEA,MAAM,kBAAkB,OAAsD;EAC5E,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,iBAAiB,EAAE,UAAU,MAAM,IAAI,CAAC;CAC9E;CAEA,MAAM,oBAAoB,OAAyC;EACjE,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,mBAAmB,CAAC,CAAC;CAC3D;CAEA,MAAM,cAAc,OAAsD;EACxE,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,aAAa,EAAE,KAAK,MAAM,IAAI,CAAC;CACrE;CAEA,MAAM,UAAU,OAAe,QAA0C;EACvE,MAAM,SAAS,MAAM,KAAK,KAAK,YAAY,MAAM;EACjD,IAAI,QACF,OAAO,KAAK,KAAK,OAAO,MAAM;EAEhC,MAAM,wBAAQ,IAAI,KAAK,CAAC;EACxB,OAAO;GACL;GACA,aAAa;GACb,UAAU;GACV,KAAK;GACL,iBAAiB;GACjB,cAAc;GACd,UAAU;GACV,OAAO,CAAC;GACR,WAAW;GACX,WAAW;EACb;CACF;CAEA,KAAa,OAAe,SAAuC;EACjE,MAAM,eAAe,QAAQ,oBAAoB,QAAQ,QAAQ,eAAe;EAChF,OAAO;GAAE,GAAG;GAAS,UAAU,eAAe,KAAK,SAAS,aAAa,YAAY,IAAI;EAAK;CAChG;CAEA,MAAM,YAAY,QAAwC;EACxD,IAAI,WAAW,MACb,OAAO;EAET,MAAM,CAAC,SAAS,QAAQ,MAAM,QAAQ,IAAI,CACxC,KAAK,KAAK,YAAY,MAAM,GAC5B,KAAK,KAAK,aAAa,MAAM,CAC/B,CAAC;EACD,MAAM,QAAQ,SAAS,aAAa,KAAK;EACzC,IAAI,OACF,OAAO;EAGT,OADiB,CAAC,MAAM,WAAW,MAAM,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAC/D,KAAK;CACrB;CAEA,MAAM,cACJ,OACA,QACA,aACA,WACA,OAC0B;EAC1B,IAAI,gBAAgB,QAClB,MAAM,IAAI,eAAe,sCAAsC;EAGjE,IAAI,CAAC,MADc,KAAK,KAAK,aAAa,MAAM,GAE9C,MAAM,IAAI,cAAc,QAAQ,MAAM;EAExC,IAAI,MAAM,gBAAgB,MAEpB;OAAA,CAAC,MADe,KAAK,OAAO,UAAU,OAAO,MAAM,cAAc,SAAS,GAClE;IACV,KAAK,OAAO,MAAM,yBAAyB;KACzC;KACA;KACA,SAAS,MAAM;IACjB,CAAC;IACD,MAAM,IAAI,cAAc,SAAS,MAAM,YAAY;GACrD;;EAEF,MAAM,kBACJ,MAAM,iBAAiB,KAAA,IAAY,KAAA,IAAY,MAAM,iBAAiB,OAAO,OAAO;EACtF,MAAM,UAAU,MAAM,KAAK,KAAK,cAAc,QAAQ;GAAE,GAAG;GAAO;EAAgB,CAAC;EACnF,KAAK,OAAO,KAAK,mBAAmB,EAAE,OAAO,CAAC;EAC9C,OAAO,KAAK,KAAK,OAAO,OAAO;CACjC;AACF"}

package/dist/integrations/model.js

@@ -22,7 +22,7 @@ var ActionInvocationError = class extends Error {
 	integrationId;
 	actionId;
 	constructor(integrationId, actionId, cause) {
-		super(`action "${integrationId}.${actionId}" failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+		super(`action "${integrationId}.${actionId}" failed: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
 		this.integrationId = integrationId;
 		this.actionId = actionId;
 		this.name = "ActionInvocationError";

package/dist/integrations/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","names":[],"sources":["../../src/integrations/model.ts"],"sourcesContent":["// integrations context — entities & DTOs are owned by @headless-lms/core/types;\n// the domain errors below are runtime code and stay in core.\nexport type { Connection, ConnectInput, ConfigureInput } from '../types/index.js';\n\n/** An org already has a connection for this integration (one per integration per org). */\nexport class AlreadyConnectedError extends Error {\n  constructor(readonly integrationId: string) {\n    super(`a connection for \"${integrationId}\" already exists`);\n    this.name = 'AlreadyConnectedError';\n  }\n}\n\n/** The named integration is not declared in the registry. */\nexport class UnknownIntegrationError extends Error {\n  constructor(readonly integrationId: string) {\n    super(`unknown integration \"${integrationId}\"`);\n    this.name = 'UnknownIntegrationError';\n  }\n}\n\n/** An action's external call failed (or the action rejected its input). */\nexport class ActionInvocationError extends Error {\n  constructor(\n    readonly integrationId: string,\n    readonly actionId: string,\n    cause: unknown,\n  ) {\n    super(\n      `action \"${integrationId}.${actionId}\" failed: ${\n        cause instanceof Error ? cause.message : String(cause)\n      }`,\n    );\n    this.name = 'ActionInvocationError';\n  }\n}\n\n/** The config was rejected by the integration's validator. */\nexport class InvalidConfigError extends Error {\n  constructor(\n    readonly integrationId: string,\n    readonly errors: string[],\n  ) {\n    super(`invalid config for \"${integrationId}\": ${errors.join('; ')}`);\n    this.name = 'InvalidConfigError';\n  }\n}\n"],"mappings":";;AAKA,IAAa,wBAAb,cAA2C,MAAM;CAC1B;CAArB,YAAY,eAAgC;EAC1C,MAAM,qBAAqB,cAAc,iBAAiB;EADvC,KAAA,gBAAA;EAEnB,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,0BAAb,cAA6C,MAAM;CAC5B;CAArB,YAAY,eAAgC;EAC1C,MAAM,wBAAwB,cAAc,EAAE;EAD3B,KAAA,gBAAA;EAEnB,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,wBAAb,cAA2C,MAAM;CAEpC;CACA;CAFX,YACE,eACA,UACA,OACA;EACA,MACE,WAAW,cAAc,GAAG,SAAS,YACnC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAEzD;EARS,KAAA,gBAAA;EACA,KAAA,WAAA;EAQT,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CAFX,YACE,eACA,QACA;EACA,MAAM,uBAAuB,cAAc,KAAK,OAAO,KAAK,IAAI,GAAG;EAH1D,KAAA,gBAAA;EACA,KAAA,SAAA;EAGT,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"model.js","names":[],"sources":["../../src/integrations/model.ts"],"sourcesContent":["// integrations context — entities & DTOs are owned by @headless-lms/core/types;\n// the domain errors below are runtime code and stay in core.\nexport type { Connection, ConnectInput, ConfigureInput } from '../types/index.js';\n\n/** An org already has a connection for this integration (one per integration per org). */\nexport class AlreadyConnectedError extends Error {\n  constructor(readonly integrationId: string) {\n    super(`a connection for \"${integrationId}\" already exists`);\n    this.name = 'AlreadyConnectedError';\n  }\n}\n\n/** The named integration is not declared in the registry. */\nexport class UnknownIntegrationError extends Error {\n  constructor(readonly integrationId: string) {\n    super(`unknown integration \"${integrationId}\"`);\n    this.name = 'UnknownIntegrationError';\n  }\n}\n\n/** An action's external call failed (or the action rejected its input). */\nexport class ActionInvocationError extends Error {\n  constructor(\n    readonly integrationId: string,\n    readonly actionId: string,\n    cause: unknown,\n  ) {\n    super(\n      `action \"${integrationId}.${actionId}\" failed: ${\n        cause instanceof Error ? cause.message : String(cause)\n      }`,\n      { cause },\n    );\n    this.name = 'ActionInvocationError';\n  }\n}\n\n/** The config was rejected by the integration's validator. */\nexport class InvalidConfigError extends Error {\n  constructor(\n    readonly integrationId: string,\n    readonly errors: string[],\n  ) {\n    super(`invalid config for \"${integrationId}\": ${errors.join('; ')}`);\n    this.name = 'InvalidConfigError';\n  }\n}\n"],"mappings":";;AAKA,IAAa,wBAAb,cAA2C,MAAM;CAC1B;CAArB,YAAY,eAAgC;EAC1C,MAAM,qBAAqB,cAAc,iBAAiB;EADvC,KAAA,gBAAA;EAEnB,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,0BAAb,cAA6C,MAAM;CAC5B;CAArB,YAAY,eAAgC;EAC1C,MAAM,wBAAwB,cAAc,EAAE;EAD3B,KAAA,gBAAA;EAEnB,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,wBAAb,cAA2C,MAAM;CAEpC;CACA;CAFX,YACE,eACA,UACA,OACA;EACA,MACE,WAAW,cAAc,GAAG,SAAS,YACnC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,KAEvD,EAAE,MAAM,CACV;EATS,KAAA,gBAAA;EACA,KAAA,WAAA;EAST,KAAK,OAAO;CACd;AACF;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CAEjC;CACA;CAFX,YACE,eACA,QACA;EACA,MAAM,uBAAuB,cAAc,KAAK,OAAO,KAAK,IAAI,GAAG;EAH1D,KAAA,gBAAA;EACA,KAAA,SAAA;EAGT,KAAK,OAAO;CACd;AACF"}

package/dist/integrations/service.js

@@ -1,6 +1,6 @@
-import { noopLogger } from "../shared/logger.js";
 import { genId } from "../shared/id.js";
 import { ConflictError, NotFoundError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
 import { ActionInvocationError, AlreadyConnectedError, InvalidConfigError, UnknownIntegrationError } from "./model.js";
 import { integrationEvents } from "./events.js";
 //#region src/integrations/service.ts
@@ -172,7 +172,7 @@ var IntegrationsServiceImpl = class {
 				connectionId,
 				integrationId: connection.integrationId,
 				actionId,
-				error: err instanceof Error ? err.message : String(err)
+				err
 			});
 			throw new ActionInvocationError(connection.integrationId, actionId, err);
 		}

package/dist/integrations/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../src/integrations/service.ts"],"sourcesContent":["// integrations context — service implementation (inbound port). Owns the\n// connection lifecycle; credentials live in the shared secure credential store\n// (this service holds only the ref). The integrations the system supports are\n// declared at startup via the IntegrationsRegistry: connect/configure reject\n// unknown integration ids and validate config with the integration's own\n// validator. The domain never calls the external service — consumers take the\n// connection, reveal the credential at point of use, and build their own adapter.\n//\n// Mutations run inside the context's UnitOfWork: credential writes, connection\n// writes, and the outbox append commit in ONE transaction (transactional\n// outbox; this also closed the historical orphan-credential window). The\n// outbox relay — not this service — publishes to the EventBus.\nimport { genId } from '../shared/id.js';\nimport {\n  ActionInvocationError,\n  AlreadyConnectedError,\n  InvalidConfigError,\n  UnknownIntegrationError,\n  type ConfigureInput,\n  type ConnectInput,\n  type Connection,\n} from './model.js';\nimport type {\n  ConnectionsRepository,\n  IntegrationsRegistry,\n  IntegrationsService,\n  IntegrationsUnitOfWork,\n} from './ports.js';\nimport type { CredentialStore, Logger } from '../shared/ports.js';\nimport { ConflictError, NotFoundError } from '../shared/errors.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { integrationEvents } from './events.js';\n\nexport type IntegrationsServiceParams = {\n  registry: IntegrationsRegistry;\n  /** Read-only access (find/list) — runs outside any transaction. */\n  repo: ConnectionsRepository;\n  /** Atomic write scope: tx-bound connections repo + credential store + outbox. */\n  uow: IntegrationsUnitOfWork;\n  /** Point-of-use credential reveal for action invocation — reads only. */\n  credentials: CredentialStore;\n  logger?: Logger;\n};\n\nexport class IntegrationsServiceImpl implements IntegrationsService {\n  private readonly registry: IntegrationsRegistry;\n  private readonly repo: ConnectionsRepository;\n  private readonly uow: IntegrationsUnitOfWork;\n  private readonly credentials: CredentialStore;\n  private readonly logger: Logger;\n\n  constructor(params: IntegrationsServiceParams) {\n    this.registry = params.registry;\n    this.repo = params.repo;\n    this.uow = params.uow;\n    this.credentials = params.credentials;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  available() {\n    return this.registry.list().map((integration) => ({\n      id: integration.id,\n      configSchema: integration.configSchema(),\n      secretsSchema: integration.secretsSchema(),\n      actions: integration.actions.map((action) => ({\n        id: action.id,\n        description: action.description,\n        inputSchema: action.inputSchema(),\n        outputSchema: action.outputSchema(),\n      })),\n    }));\n  }\n\n  private validate(integrationId: string, config: Record<string, unknown>): void {\n    const integration = this.registry.get(integrationId);\n    if (!integration) {\n      this.logger.warn('unknown integration rejected', { integrationId });\n      throw new UnknownIntegrationError(integrationId);\n    }\n    const result = integration.validateConfig(config);\n    if (!result.ok) {\n      this.logger.warn('invalid integration config rejected', {\n        integrationId,\n        errors: result.errors,\n      });\n      throw new InvalidConfigError(integrationId, result.errors);\n    }\n  }\n\n  async connect(orgId: string, input: ConnectInput): Promise<Connection> {\n    const config = input.config ?? {};\n    this.validate(input.integrationId, config);\n    const existing = await this.repo.findByIntegration(orgId, input.integrationId);\n    if (existing) {\n      this.logger.warn('duplicate connection rejected', {\n        orgId,\n        integrationId: input.integrationId,\n      });\n      throw new AlreadyConnectedError(input.integrationId);\n    }\n    const connection = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      const credentialRef = await credentials.store(orgId, input.secrets);\n      const at = new Date();\n      const created = await connections.insert(orgId, {\n        orgId,\n        id: genId('connection'),\n        integrationId: input.integrationId,\n        config,\n        active: true,\n        credentialRef,\n        createdAt: at,\n        updatedAt: at,\n      });\n      await outbox.append([\n        integrationEvents.connectionCreated.make({\n          orgId,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('integration connected', {\n      orgId,\n      integrationId: connection.integrationId,\n      connectionId: connection.id,\n    });\n    return connection;\n  }\n\n  async reconnect(\n    orgId: string,\n    id: string,\n    secrets: Record<string, unknown>,\n  ): Promise<Connection | null> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return null;\n    }\n    const updated = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      await credentials.update(orgId, connection.credentialRef, secrets);\n      const result = await connections.update(orgId, id, { updatedAt: new Date() });\n      if (result) {\n        await outbox.append([integrationEvents.connectionUpdated.make({ orgId, data: result })]);\n      }\n      return result;\n    });\n    this.logger.info('integration credentials rotated', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return updated;\n  }\n\n  async configure(orgId: string, id: string, input: ConfigureInput): Promise<Connection | null> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return null;\n    }\n    if (input.config !== undefined) {\n      this.validate(connection.integrationId, input.config);\n    }\n    const updated = await this.uow.run(async ({ connections, outbox }) => {\n      const result = await connections.update(orgId, id, {\n        ...(input.config !== undefined ? { config: input.config } : {}),\n        ...(input.active !== undefined ? { active: input.active } : {}),\n        updatedAt: new Date(),\n      });\n      if (result) {\n        await outbox.append([integrationEvents.connectionUpdated.make({ orgId, data: result })]);\n      }\n      return result;\n    });\n    this.logger.info('integration configured', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return updated;\n  }\n\n  async disconnect(orgId: string, id: string): Promise<boolean> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return false;\n    }\n    const deleted = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      // Connection first: it holds the FK onto the credential row.\n      const ok = await connections.delete(orgId, id);\n      await credentials.destroy(orgId, connection.credentialRef);\n      await outbox.append([integrationEvents.connectionRemoved.make({ orgId, data: connection })]);\n      return ok;\n    });\n    this.logger.info('integration disconnected', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return deleted;\n  }\n\n  list(orgId: string): Promise<Connection[]> {\n    return this.repo.list(orgId);\n  }\n\n  get(orgId: string, id: string): Promise<Connection | null> {\n    return this.repo.findById(orgId, id);\n  }\n\n  getByIntegration(orgId: string, integrationId: string): Promise<Connection | null> {\n    return this.repo.findByIntegration(orgId, integrationId);\n  }\n\n  async invoke(\n    orgId: string,\n    connectionId: string,\n    actionId: string,\n    input: Record<string, unknown>,\n  ): Promise<unknown> {\n    const connection = await this.repo.findById(orgId, connectionId);\n    if (!connection) {\n      throw new NotFoundError('Connection', connectionId);\n    }\n    if (!connection.active) {\n      throw new ConflictError(`connection \"${connectionId}\" is inactive`);\n    }\n    const integration = this.registry.get(connection.integrationId);\n    if (!integration) {\n      throw new UnknownIntegrationError(connection.integrationId);\n    }\n    const action = integration.actions.find((a) => a.id === actionId);\n    if (!action) {\n      throw new NotFoundError('Action', actionId);\n    }\n    const secrets = await this.credentials.reveal(orgId, connection.credentialRef);\n    if (!secrets) {\n      throw new NotFoundError('Credential', connectionId);\n    }\n    try {\n      return await action.invoke({ secrets, config: connection.config }, input);\n    } catch (err) {\n      this.logger.warn('integration action failed', {\n        orgId,\n        connectionId,\n        integrationId: connection.integrationId,\n        actionId,\n        error: err instanceof Error ? err.message : String(err),\n      });\n      throw new ActionInvocationError(connection.integrationId, actionId, err);\n    }\n  }\n}\n"],"mappings":";;;;;;AA4CA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,WAAW,OAAO;EACvB,KAAK,OAAO,OAAO;EACnB,KAAK,MAAM,OAAO;EAClB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,YAAY;EACV,OAAO,KAAK,SAAS,KAAK,CAAC,CAAC,KAAK,iBAAiB;GAChD,IAAI,YAAY;GAChB,cAAc,YAAY,aAAa;GACvC,eAAe,YAAY,cAAc;GACzC,SAAS,YAAY,QAAQ,KAAK,YAAY;IAC5C,IAAI,OAAO;IACX,aAAa,OAAO;IACpB,aAAa,OAAO,YAAY;IAChC,cAAc,OAAO,aAAa;GACpC,EAAE;EACJ,EAAE;CACJ;CAEA,SAAiB,eAAuB,QAAuC;EAC7E,MAAM,cAAc,KAAK,SAAS,IAAI,aAAa;EACnD,IAAI,CAAC,aAAa;GAChB,KAAK,OAAO,KAAK,gCAAgC,EAAE,cAAc,CAAC;GAClE,MAAM,IAAI,wBAAwB,aAAa;EACjD;EACA,MAAM,SAAS,YAAY,eAAe,MAAM;EAChD,IAAI,CAAC,OAAO,IAAI;GACd,KAAK,OAAO,KAAK,uCAAuC;IACtD;IACA,QAAQ,OAAO;GACjB,CAAC;GACD,MAAM,IAAI,mBAAmB,eAAe,OAAO,MAAM;EAC3D;CACF;CAEA,MAAM,QAAQ,OAAe,OAA0C;EACrE,MAAM,SAAS,MAAM,UAAU,CAAC;EAChC,KAAK,SAAS,MAAM,eAAe,MAAM;EAEzC,IAAI,MADmB,KAAK,KAAK,kBAAkB,OAAO,MAAM,aAAa,GAC/D;GACZ,KAAK,OAAO,KAAK,iCAAiC;IAChD;IACA,eAAe,MAAM;GACvB,CAAC;GACD,MAAM,IAAI,sBAAsB,MAAM,aAAa;EACrD;EACA,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACpF,MAAM,gBAAgB,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO;GAClE,MAAM,qBAAK,IAAI,KAAK;GACpB,MAAM,UAAU,MAAM,YAAY,OAAO,OAAO;IAC9C;IACA,IAAI,MAAM,YAAY;IACtB,eAAe,MAAM;IACrB;IACA,QAAQ;IACR;IACA,WAAW;IACX,WAAW;GACb,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,kBAAkB,kBAAkB,KAAK;IACvC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,yBAAyB;GACxC;GACA,eAAe,WAAW;GAC1B,cAAc,WAAW;EAC3B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UACJ,OACA,IACA,SAC4B;EAC5B,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACjF,MAAM,YAAY,OAAO,OAAO,WAAW,eAAe,OAAO;GACjE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI,EAAE,2BAAW,IAAI,KAAK,EAAE,CAAC;GAC5E,IAAI,QACF,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAAC,CAAC;GAEzF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,mCAAmC;GAClD;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UAAU,OAAe,IAAY,OAAmD;EAC5F,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,IAAI,MAAM,WAAW,KAAA,GACnB,KAAK,SAAS,WAAW,eAAe,MAAM,MAAM;EAEtD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa;GACpE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI;IACjD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,2BAAW,IAAI,KAAK;GACtB,CAAC;GACD,IAAI,QACF,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAAC,CAAC;GAEzF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,0BAA0B;GACzC;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,WAAW,OAAe,IAA8B;EAC5D,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GAEjF,MAAM,KAAK,MAAM,YAAY,OAAO,OAAO,EAAE;GAC7C,MAAM,YAAY,QAAQ,OAAO,WAAW,aAAa;GACzD,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAW,CAAC,CAAC,CAAC;GAC3F,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,4BAA4B;GAC3C;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,KAAK,OAAsC;EACzC,OAAO,KAAK,KAAK,KAAK,KAAK;CAC7B;CAEA,IAAI,OAAe,IAAwC;EACzD,OAAO,KAAK,KAAK,SAAS,OAAO,EAAE;CACrC;CAEA,iBAAiB,OAAe,eAAmD;EACjF,OAAO,KAAK,KAAK,kBAAkB,OAAO,aAAa;CACzD;CAEA,MAAM,OACJ,OACA,cACA,UACA,OACkB;EAClB,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,YAAY;EAC/D,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI,CAAC,WAAW,QACd,MAAM,IAAI,cAAc,eAAe,aAAa,cAAc;EAEpE,MAAM,cAAc,KAAK,SAAS,IAAI,WAAW,aAAa;EAC9D,IAAI,CAAC,aACH,MAAM,IAAI,wBAAwB,WAAW,aAAa;EAE5D,MAAM,SAAS,YAAY,QAAQ,MAAM,MAAM,EAAE,OAAO,QAAQ;EAChE,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,QAAQ;EAE5C,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO,OAAO,WAAW,aAAa;EAC7E,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI;GACF,OAAO,MAAM,OAAO,OAAO;IAAE;IAAS,QAAQ,WAAW;GAAO,GAAG,KAAK;EAC1E,SAAS,KAAK;GACZ,KAAK,OAAO,KAAK,6BAA6B;IAC5C;IACA;IACA,eAAe,WAAW;IAC1B;IACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;GACD,MAAM,IAAI,sBAAsB,WAAW,eAAe,UAAU,GAAG;EACzE;CACF;AACF"}
+{"version":3,"file":"service.js","names":[],"sources":["../../src/integrations/service.ts"],"sourcesContent":["// integrations context — service implementation (inbound port). Owns the\n// connection lifecycle; credentials live in the shared secure credential store\n// (this service holds only the ref). The integrations the system supports are\n// declared at startup via the IntegrationsRegistry: connect/configure reject\n// unknown integration ids and validate config with the integration's own\n// validator. The domain never calls the external service — consumers take the\n// connection, reveal the credential at point of use, and build their own adapter.\n//\n// Mutations run inside the context's UnitOfWork: credential writes, connection\n// writes, and the outbox append commit in ONE transaction (transactional\n// outbox; this also closed the historical orphan-credential window). The\n// outbox relay — not this service — publishes to the EventBus.\nimport { genId } from '../shared/id.js';\nimport {\n  ActionInvocationError,\n  AlreadyConnectedError,\n  InvalidConfigError,\n  UnknownIntegrationError,\n  type ConfigureInput,\n  type ConnectInput,\n  type Connection,\n} from './model.js';\nimport type {\n  ConnectionsRepository,\n  IntegrationsRegistry,\n  IntegrationsService,\n  IntegrationsUnitOfWork,\n} from './ports.js';\nimport type { CredentialStore, Logger } from '../shared/ports.js';\nimport { ConflictError, NotFoundError } from '../shared/errors.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { integrationEvents } from './events.js';\n\nexport type IntegrationsServiceParams = {\n  registry: IntegrationsRegistry;\n  /** Read-only access (find/list) — runs outside any transaction. */\n  repo: ConnectionsRepository;\n  /** Atomic write scope: tx-bound connections repo + credential store + outbox. */\n  uow: IntegrationsUnitOfWork;\n  /** Point-of-use credential reveal for action invocation — reads only. */\n  credentials: CredentialStore;\n  logger?: Logger;\n};\n\nexport class IntegrationsServiceImpl implements IntegrationsService {\n  private readonly registry: IntegrationsRegistry;\n  private readonly repo: ConnectionsRepository;\n  private readonly uow: IntegrationsUnitOfWork;\n  private readonly credentials: CredentialStore;\n  private readonly logger: Logger;\n\n  constructor(params: IntegrationsServiceParams) {\n    this.registry = params.registry;\n    this.repo = params.repo;\n    this.uow = params.uow;\n    this.credentials = params.credentials;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  available() {\n    return this.registry.list().map((integration) => ({\n      id: integration.id,\n      configSchema: integration.configSchema(),\n      secretsSchema: integration.secretsSchema(),\n      actions: integration.actions.map((action) => ({\n        id: action.id,\n        description: action.description,\n        inputSchema: action.inputSchema(),\n        outputSchema: action.outputSchema(),\n      })),\n    }));\n  }\n\n  private validate(integrationId: string, config: Record<string, unknown>): void {\n    const integration = this.registry.get(integrationId);\n    if (!integration) {\n      this.logger.warn('unknown integration rejected', { integrationId });\n      throw new UnknownIntegrationError(integrationId);\n    }\n    const result = integration.validateConfig(config);\n    if (!result.ok) {\n      this.logger.warn('invalid integration config rejected', {\n        integrationId,\n        errors: result.errors,\n      });\n      throw new InvalidConfigError(integrationId, result.errors);\n    }\n  }\n\n  async connect(orgId: string, input: ConnectInput): Promise<Connection> {\n    const config = input.config ?? {};\n    this.validate(input.integrationId, config);\n    const existing = await this.repo.findByIntegration(orgId, input.integrationId);\n    if (existing) {\n      this.logger.warn('duplicate connection rejected', {\n        orgId,\n        integrationId: input.integrationId,\n      });\n      throw new AlreadyConnectedError(input.integrationId);\n    }\n    const connection = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      const credentialRef = await credentials.store(orgId, input.secrets);\n      const at = new Date();\n      const created = await connections.insert(orgId, {\n        orgId,\n        id: genId('connection'),\n        integrationId: input.integrationId,\n        config,\n        active: true,\n        credentialRef,\n        createdAt: at,\n        updatedAt: at,\n      });\n      await outbox.append([\n        integrationEvents.connectionCreated.make({\n          orgId,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('integration connected', {\n      orgId,\n      integrationId: connection.integrationId,\n      connectionId: connection.id,\n    });\n    return connection;\n  }\n\n  async reconnect(\n    orgId: string,\n    id: string,\n    secrets: Record<string, unknown>,\n  ): Promise<Connection | null> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return null;\n    }\n    const updated = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      await credentials.update(orgId, connection.credentialRef, secrets);\n      const result = await connections.update(orgId, id, { updatedAt: new Date() });\n      if (result) {\n        await outbox.append([integrationEvents.connectionUpdated.make({ orgId, data: result })]);\n      }\n      return result;\n    });\n    this.logger.info('integration credentials rotated', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return updated;\n  }\n\n  async configure(orgId: string, id: string, input: ConfigureInput): Promise<Connection | null> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return null;\n    }\n    if (input.config !== undefined) {\n      this.validate(connection.integrationId, input.config);\n    }\n    const updated = await this.uow.run(async ({ connections, outbox }) => {\n      const result = await connections.update(orgId, id, {\n        ...(input.config !== undefined ? { config: input.config } : {}),\n        ...(input.active !== undefined ? { active: input.active } : {}),\n        updatedAt: new Date(),\n      });\n      if (result) {\n        await outbox.append([integrationEvents.connectionUpdated.make({ orgId, data: result })]);\n      }\n      return result;\n    });\n    this.logger.info('integration configured', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return updated;\n  }\n\n  async disconnect(orgId: string, id: string): Promise<boolean> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return false;\n    }\n    const deleted = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      // Connection first: it holds the FK onto the credential row.\n      const ok = await connections.delete(orgId, id);\n      await credentials.destroy(orgId, connection.credentialRef);\n      await outbox.append([integrationEvents.connectionRemoved.make({ orgId, data: connection })]);\n      return ok;\n    });\n    this.logger.info('integration disconnected', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return deleted;\n  }\n\n  list(orgId: string): Promise<Connection[]> {\n    return this.repo.list(orgId);\n  }\n\n  get(orgId: string, id: string): Promise<Connection | null> {\n    return this.repo.findById(orgId, id);\n  }\n\n  getByIntegration(orgId: string, integrationId: string): Promise<Connection | null> {\n    return this.repo.findByIntegration(orgId, integrationId);\n  }\n\n  async invoke(\n    orgId: string,\n    connectionId: string,\n    actionId: string,\n    input: Record<string, unknown>,\n  ): Promise<unknown> {\n    const connection = await this.repo.findById(orgId, connectionId);\n    if (!connection) {\n      throw new NotFoundError('Connection', connectionId);\n    }\n    if (!connection.active) {\n      throw new ConflictError(`connection \"${connectionId}\" is inactive`);\n    }\n    const integration = this.registry.get(connection.integrationId);\n    if (!integration) {\n      throw new UnknownIntegrationError(connection.integrationId);\n    }\n    const action = integration.actions.find((a) => a.id === actionId);\n    if (!action) {\n      throw new NotFoundError('Action', actionId);\n    }\n    const secrets = await this.credentials.reveal(orgId, connection.credentialRef);\n    if (!secrets) {\n      throw new NotFoundError('Credential', connectionId);\n    }\n    try {\n      return await action.invoke({ secrets, config: connection.config }, input);\n    } catch (err) {\n      this.logger.warn('integration action failed', {\n        orgId,\n        connectionId,\n        integrationId: connection.integrationId,\n        actionId,\n        err,\n      });\n      throw new ActionInvocationError(connection.integrationId, actionId, err);\n    }\n  }\n}\n"],"mappings":";;;;;;AA4CA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,WAAW,OAAO;EACvB,KAAK,OAAO,OAAO;EACnB,KAAK,MAAM,OAAO;EAClB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,YAAY;EACV,OAAO,KAAK,SAAS,KAAK,CAAC,CAAC,KAAK,iBAAiB;GAChD,IAAI,YAAY;GAChB,cAAc,YAAY,aAAa;GACvC,eAAe,YAAY,cAAc;GACzC,SAAS,YAAY,QAAQ,KAAK,YAAY;IAC5C,IAAI,OAAO;IACX,aAAa,OAAO;IACpB,aAAa,OAAO,YAAY;IAChC,cAAc,OAAO,aAAa;GACpC,EAAE;EACJ,EAAE;CACJ;CAEA,SAAiB,eAAuB,QAAuC;EAC7E,MAAM,cAAc,KAAK,SAAS,IAAI,aAAa;EACnD,IAAI,CAAC,aAAa;GAChB,KAAK,OAAO,KAAK,gCAAgC,EAAE,cAAc,CAAC;GAClE,MAAM,IAAI,wBAAwB,aAAa;EACjD;EACA,MAAM,SAAS,YAAY,eAAe,MAAM;EAChD,IAAI,CAAC,OAAO,IAAI;GACd,KAAK,OAAO,KAAK,uCAAuC;IACtD;IACA,QAAQ,OAAO;GACjB,CAAC;GACD,MAAM,IAAI,mBAAmB,eAAe,OAAO,MAAM;EAC3D;CACF;CAEA,MAAM,QAAQ,OAAe,OAA0C;EACrE,MAAM,SAAS,MAAM,UAAU,CAAC;EAChC,KAAK,SAAS,MAAM,eAAe,MAAM;EAEzC,IAAI,MADmB,KAAK,KAAK,kBAAkB,OAAO,MAAM,aAAa,GAC/D;GACZ,KAAK,OAAO,KAAK,iCAAiC;IAChD;IACA,eAAe,MAAM;GACvB,CAAC;GACD,MAAM,IAAI,sBAAsB,MAAM,aAAa;EACrD;EACA,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACpF,MAAM,gBAAgB,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO;GAClE,MAAM,qBAAK,IAAI,KAAK;GACpB,MAAM,UAAU,MAAM,YAAY,OAAO,OAAO;IAC9C;IACA,IAAI,MAAM,YAAY;IACtB,eAAe,MAAM;IACrB;IACA,QAAQ;IACR;IACA,WAAW;IACX,WAAW;GACb,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,kBAAkB,kBAAkB,KAAK;IACvC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,yBAAyB;GACxC;GACA,eAAe,WAAW;GAC1B,cAAc,WAAW;EAC3B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UACJ,OACA,IACA,SAC4B;EAC5B,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACjF,MAAM,YAAY,OAAO,OAAO,WAAW,eAAe,OAAO;GACjE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI,EAAE,2BAAW,IAAI,KAAK,EAAE,CAAC;GAC5E,IAAI,QACF,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAAC,CAAC;GAEzF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,mCAAmC;GAClD;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UAAU,OAAe,IAAY,OAAmD;EAC5F,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,IAAI,MAAM,WAAW,KAAA,GACnB,KAAK,SAAS,WAAW,eAAe,MAAM,MAAM;EAEtD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa;GACpE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI;IACjD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,2BAAW,IAAI,KAAK;GACtB,CAAC;GACD,IAAI,QACF,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAAC,CAAC;GAEzF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,0BAA0B;GACzC;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,WAAW,OAAe,IAA8B;EAC5D,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GAEjF,MAAM,KAAK,MAAM,YAAY,OAAO,OAAO,EAAE;GAC7C,MAAM,YAAY,QAAQ,OAAO,WAAW,aAAa;GACzD,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAW,CAAC,CAAC,CAAC;GAC3F,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,4BAA4B;GAC3C;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,KAAK,OAAsC;EACzC,OAAO,KAAK,KAAK,KAAK,KAAK;CAC7B;CAEA,IAAI,OAAe,IAAwC;EACzD,OAAO,KAAK,KAAK,SAAS,OAAO,EAAE;CACrC;CAEA,iBAAiB,OAAe,eAAmD;EACjF,OAAO,KAAK,KAAK,kBAAkB,OAAO,aAAa;CACzD;CAEA,MAAM,OACJ,OACA,cACA,UACA,OACkB;EAClB,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,YAAY;EAC/D,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI,CAAC,WAAW,QACd,MAAM,IAAI,cAAc,eAAe,aAAa,cAAc;EAEpE,MAAM,cAAc,KAAK,SAAS,IAAI,WAAW,aAAa;EAC9D,IAAI,CAAC,aACH,MAAM,IAAI,wBAAwB,WAAW,aAAa;EAE5D,MAAM,SAAS,YAAY,QAAQ,MAAM,MAAM,EAAE,OAAO,QAAQ;EAChE,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,QAAQ;EAE5C,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO,OAAO,WAAW,aAAa;EAC7E,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI;GACF,OAAO,MAAM,OAAO,OAAO;IAAE;IAAS,QAAQ,WAAW;GAAO,GAAG,KAAK;EAC1E,SAAS,KAAK;GACZ,KAAK,OAAO,KAAK,6BAA6B;IAC5C;IACA;IACA,eAAe,WAAW;IAC1B;IACA;GACF,CAAC;GACD,MAAM,IAAI,sBAAsB,WAAW,eAAe,UAAU,GAAG;EACzE;CACF;AACF"}

package/dist/organizations/access-scopes.d.ts

@@ -0,0 +1,19 @@
+import { Role } from "../types/schemas/organizations.js";
+import { Permission } from "./roles.js";
+//#region src/organizations/access-scopes.d.ts
+declare const ACCESS_SCOPES: readonly ["courses:read", "courses:write", "courses:delete", "downloads:read", "downloads:write", "downloads:delete", "bundles:read", "bundles:write", "bundles:delete", "media:read", "students:read", "students:invite", "access:read", "access:write", "analytics:read", "automations:read", "automations:write", "automations:delete", "comments:read", "comments:moderate", "communities:read", "communities:write", "communities:delete", "community_members:read", "community_members:write", "community_moderation:read", "community_moderation:write"];
+type AccessScope = (typeof ACCESS_SCOPES)[number];
+declare const SCOPE_PERMISSION: Record<AccessScope, Permission | null>;
+type ScopeOption = {
+  scope: AccessScope;
+  allowed: boolean;
+};
+declare function isAccessScope(value: string): value is AccessScope;
+declare function isDeleteScope(scope: AccessScope): boolean;
+declare function roleHoldsScope(role: Role, scope: AccessScope): boolean;
+declare function scopesForRole(role: Role): AccessScope[];
+declare function scopeOptions(role: Role): ScopeOption[];
+declare function assertRoleHoldsScopes(role: Role, scopes: readonly AccessScope[]): void;
+//#endregion
+export { ACCESS_SCOPES, AccessScope, SCOPE_PERMISSION, ScopeOption, assertRoleHoldsScopes, isAccessScope, isDeleteScope, roleHoldsScope, scopeOptions, scopesForRole };
+//# sourceMappingURL=access-scopes.d.ts.map