@headless-lms/core 0.2.0 → 0.3.0

package/dist/organizations/roles.d.ts

@@ -1,23 +1,19 @@
 import { Role } from "../types/schemas/organizations.js";
 import "../types/index.js";
 //#region src/organizations/roles.d.ts
-declare const ROLES: readonly ["owner", "admin", "instructor", "student"];
-/**
- * The roles that operate the back office. `student` belongs to the org but
- * never appears on a staff surface, so the member-management types are typed
- * with this narrower union — the exclusion is a compiler guarantee, not a
- * convention a query has to remember.
- */
-type StaffRole = Exclude<Role, 'student'>;
+declare const ROLES: readonly ["owner", "admin", "instructor", "moderator", "student"];
+type StaffRole = 'owner' | 'admin' | 'instructor';
 declare const STAFF_ROLES: readonly ["owner", "admin", "instructor"];
+type TeamRole = Exclude<Role, 'student'>;
 declare function isRole(value: string): value is Role;
 declare function isStaffRole(value: string): value is StaffRole;
 declare function parseRole(value: string): Role;
-type Permission = 'manage_billing' | 'manage_org_settings' | 'manage_users' | 'create_course' | 'edit_assigned_course' | 'view_student_progress' | 'consume_content';
+type Permission = 'manage_billing' | 'manage_org_settings' | 'manage_users' | 'create_course' | 'edit_assigned_course' | 'view_student_progress' | 'moderate' | 'consume_content';
 type Capability = true | 'assigned' | 'enrolled';
 declare function capability(role: Role, permission: Permission): Capability | false;
+declare function canModerate(role: Role): boolean;
 declare function normalizeRole(raw: string): Role;
 declare const STUDENT_ROLE = "student";
 //#endregion
-export { Capability, Permission, ROLES, type Role, STAFF_ROLES, STUDENT_ROLE, StaffRole, capability, isRole, isStaffRole, normalizeRole, parseRole };
+export { Capability, Permission, ROLES, type Role, STAFF_ROLES, STUDENT_ROLE, StaffRole, TeamRole, canModerate, capability, isRole, isStaffRole, normalizeRole, parseRole };
 //# sourceMappingURL=roles.d.ts.map

package/dist/organizations/roles.js

@@ -3,6 +3,7 @@ const ROLES = [
 	"owner",
 	"admin",
 	"instructor",
+	"moderator",
 	"student"
 ];
 const STAFF_ROLES = [
@@ -27,28 +28,39 @@ const MATRIX = {
 		manage_users: true,
 		create_course: true,
 		edit_assigned_course: true,
-		view_student_progress: true
+		view_student_progress: true,
+		moderate: true
 	},
 	admin: {
 		manage_org_settings: true,
 		manage_users: true,
 		create_course: true,
 		edit_assigned_course: true,
-		view_student_progress: true
+		view_student_progress: true,
+		moderate: true
 	},
 	instructor: {
 		edit_assigned_course: "assigned",
-		view_student_progress: "assigned"
+		view_student_progress: "assigned",
+		moderate: true
+	},
+	moderator: {
+		moderate: true,
+		consume_content: "enrolled"
 	},
 	student: { consume_content: "enrolled" }
 };
 function capability(role, permission) {
 	return MATRIX[role][permission] ?? false;
 }
+function canModerate(role) {
+	return capability(role, "moderate") === true;
+}
 const RANK = {
-	owner: 3,
-	admin: 2,
-	instructor: 1,
+	owner: 4,
+	admin: 3,
+	instructor: 2,
+	moderator: 1,
 	student: 0
 };
 function normalizeRole(raw) {
@@ -65,6 +77,6 @@ function normalizeRole(raw) {
 }
 const STUDENT_ROLE = "student";
 //#endregion
-export { ROLES, STAFF_ROLES, STUDENT_ROLE, capability, isRole, isStaffRole, normalizeRole, parseRole };
+export { ROLES, STAFF_ROLES, STUDENT_ROLE, canModerate, capability, isRole, isStaffRole, normalizeRole, parseRole };
 
 //# sourceMappingURL=roles.js.map

package/dist/organizations/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","names":[],"sources":["../../src/organizations/roles.ts"],"sourcesContent":["// organizations context — roles and the authorization matrix.\n// Defined in code (no DB enum). The DB stores role as text; the domain narrows\n// it to Role and answers authorization questions here. The Role type itself is\n// owned by @headless-lms/core/types; RANK/MATRIX below are Record<Role, …>, so the\n// compiler forces this file to cover every role the published type declares.\nimport type { Role } from '../types/index.js';\n\nexport type { Role };\nexport const ROLES = ['owner', 'admin', 'instructor', 'student'] as const satisfies readonly Role[];\n\n/**\n * The roles that operate the back office. `student` belongs to the org but\n * never appears on a staff surface, so the member-management types are typed\n * with this narrower union — the exclusion is a compiler guarantee, not a\n * convention a query has to remember.\n */\nexport type StaffRole = Exclude<Role, 'student'>;\nexport const STAFF_ROLES = ['owner', 'admin', 'instructor'] as const satisfies readonly StaffRole[];\n\nexport function isRole(value: string): value is Role {\n  return (ROLES as readonly string[]).includes(value);\n}\n\nexport function isStaffRole(value: string): value is StaffRole {\n  return (STAFF_ROLES as readonly string[]).includes(value);\n}\n\nexport function parseRole(value: string): Role {\n  if (!isRole(value)) {\n    throw new Error(`unknown role: ${value}`);\n  }\n  return value;\n}\n\nexport type Permission =\n  | 'manage_billing'\n  | 'manage_org_settings'\n  | 'manage_users'\n  | 'create_course'\n  | 'edit_assigned_course'\n  | 'view_student_progress'\n  | 'consume_content';\n\n// Unconditional (true), course-scoped (\"assigned\"), or enrollment-scoped\n// (\"enrolled\" — access owned by entitlements). Absent ⇒ denied.\n//\n// \"assigned\" is a granted-but-narrowed answer: the role holds the permission,\n// but only over some subset of courses. Nothing narrows it today — there is no\n// course-assignment store — so callers must decide what a narrowed grant means\n// for them. `authorize` treats it as denied; `tools.ts` treats it as granted.\nexport type Capability = true | 'assigned' | 'enrolled';\n\nconst MATRIX: Record<Role, Partial<Record<Permission, Capability>>> = {\n  owner: {\n    manage_billing: true,\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n  },\n  admin: {\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n  },\n  instructor: {\n    edit_assigned_course: 'assigned',\n    view_student_progress: 'assigned',\n  },\n  // A learner belongs to the org to consume content they hold an\n  // entitlement for. No management capability of any kind.\n  student: {\n    consume_content: 'enrolled',\n  },\n};\n\nexport function capability(role: Role, permission: Permission): Capability | false {\n  return MATRIX[role][permission] ?? false;\n}\n\n// Better Auth's role model is broader than ours: it keeps a built-in `member`\n// role and allows comma-joined multi-role strings. Normalize any incoming role\n// string to a single domain Role before persisting: `member` -> `instructor`, a\n// multi-role string -> its highest-privilege known role, unknown -> `instructor`.\nconst RANK: Record<Role, number> = { owner: 3, admin: 2, instructor: 1, student: 0 };\n\nexport function normalizeRole(raw: string): Role {\n  let best: Role = 'instructor';\n  let bestRank = -1;\n  for (const token of raw.split(',').map((t) => t.trim())) {\n    const r: Role | null = isRole(token) ? token : token === 'member' ? 'instructor' : null;\n    if (r && RANK[r] > bestRank) {\n      best = r;\n      bestRank = RANK[r];\n    }\n  }\n  return best;\n}\n\n// Invites carry either a staff Role or this marker: the invited account is\n// a portal student, not an org member. Owned by the organizations domain — the\n// invite provider adapter reuses it to branch links, emails, and grants.\nexport const STUDENT_ROLE = 'student';\n"],"mappings":";AAQA,MAAa,QAAQ;CAAC;CAAS;CAAS;CAAc;AAAS;AAS/D,MAAa,cAAc;CAAC;CAAS;CAAS;AAAY;AAE1D,SAAgB,OAAO,OAA8B;CACnD,OAAQ,MAA4B,SAAS,KAAK;AACpD;AAEA,SAAgB,YAAY,OAAmC;CAC7D,OAAQ,YAAkC,SAAS,KAAK;AAC1D;AAEA,SAAgB,UAAU,OAAqB;CAC7C,IAAI,CAAC,OAAO,KAAK,GACf,MAAM,IAAI,MAAM,iBAAiB,OAAO;CAE1C,OAAO;AACT;AAoBA,MAAM,SAAgE;CACpE,OAAO;EACL,gBAAgB;EAChB,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;CACzB;CACA,OAAO;EACL,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;CACzB;CACA,YAAY;EACV,sBAAsB;EACtB,uBAAuB;CACzB;CAGA,SAAS,EACP,iBAAiB,WACnB;AACF;AAEA,SAAgB,WAAW,MAAY,YAA4C;CACjF,OAAO,OAAO,KAAK,CAAC,eAAe;AACrC;AAMA,MAAM,OAA6B;CAAE,OAAO;CAAG,OAAO;CAAG,YAAY;CAAG,SAAS;AAAE;AAEnF,SAAgB,cAAc,KAAmB;CAC/C,IAAI,OAAa;CACjB,IAAI,WAAW;CACf,KAAK,MAAM,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,CAAC,GAAG;EACvD,MAAM,IAAiB,OAAO,KAAK,IAAI,QAAQ,UAAU,WAAW,eAAe;EACnF,IAAI,KAAK,KAAK,KAAK,UAAU;GAC3B,OAAO;GACP,WAAW,KAAK;EAClB;CACF;CACA,OAAO;AACT;AAKA,MAAa,eAAe"}
+{"version":3,"file":"roles.js","names":[],"sources":["../../src/organizations/roles.ts"],"sourcesContent":["// organizations context — roles and the authorization matrix.\n// Defined in code (no DB enum). The DB stores role as text; the domain narrows\n// it to Role and answers authorization questions here. The Role type itself is\n// owned by @headless-lms/core/types; RANK/MATRIX below are Record<Role, …>, so the\n// compiler forces this file to cover every role the published type declares.\nimport type { Role } from '../types/index.js';\n\nexport type { Role };\nexport const ROLES = [\n  'owner',\n  'admin',\n  'instructor',\n  'moderator',\n  'student',\n] as const satisfies readonly Role[];\n\nexport type StaffRole = 'owner' | 'admin' | 'instructor';\nexport const STAFF_ROLES = ['owner', 'admin', 'instructor'] as const satisfies readonly StaffRole[];\n\nexport type TeamRole = Exclude<Role, 'student'>;\n\nexport function isRole(value: string): value is Role {\n  return (ROLES as readonly string[]).includes(value);\n}\n\nexport function isStaffRole(value: string): value is StaffRole {\n  return (STAFF_ROLES as readonly string[]).includes(value);\n}\n\nexport function parseRole(value: string): Role {\n  if (!isRole(value)) {\n    throw new Error(`unknown role: ${value}`);\n  }\n  return value;\n}\n\nexport type Permission =\n  | 'manage_billing'\n  | 'manage_org_settings'\n  | 'manage_users'\n  | 'create_course'\n  | 'edit_assigned_course'\n  | 'view_student_progress'\n  | 'moderate'\n  | 'consume_content';\n\n// Unconditional (true), course-scoped (\"assigned\"), or enrollment-scoped\n// (\"enrolled\" — access owned by entitlements). Absent ⇒ denied.\n//\n// \"assigned\" is a granted-but-narrowed answer: the role holds the permission,\n// but only over some subset of courses. Nothing narrows it today — there is no\n// course-assignment store — so callers must decide what a narrowed grant means\n// for them. `authorize` treats it as denied; `tools.ts` treats it as granted.\nexport type Capability = true | 'assigned' | 'enrolled';\n\nconst MATRIX: Record<Role, Partial<Record<Permission, Capability>>> = {\n  owner: {\n    manage_billing: true,\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n    moderate: true,\n  },\n  admin: {\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n    moderate: true,\n  },\n  instructor: {\n    edit_assigned_course: 'assigned',\n    view_student_progress: 'assigned',\n    moderate: true,\n  },\n  moderator: {\n    moderate: true,\n    consume_content: 'enrolled',\n  },\n  student: {\n    consume_content: 'enrolled',\n  },\n};\n\nexport function capability(role: Role, permission: Permission): Capability | false {\n  return MATRIX[role][permission] ?? false;\n}\n\nexport function canModerate(role: Role): boolean {\n  return capability(role, 'moderate') === true;\n}\n\n// Better Auth's role model is broader than ours: it keeps a built-in `member`\n// role and allows comma-joined multi-role strings. Normalize any incoming role\n// string to a single domain Role before persisting: `member` -> `instructor`, a\n// multi-role string -> its highest-privilege known role, unknown -> `instructor`.\nconst RANK: Record<Role, number> = { owner: 4, admin: 3, instructor: 2, moderator: 1, student: 0 };\n\nexport function normalizeRole(raw: string): Role {\n  let best: Role = 'instructor';\n  let bestRank = -1;\n  for (const token of raw.split(',').map((t) => t.trim())) {\n    const r: Role | null = isRole(token) ? token : token === 'member' ? 'instructor' : null;\n    if (r && RANK[r] > bestRank) {\n      best = r;\n      bestRank = RANK[r];\n    }\n  }\n  return best;\n}\n\n// Invites carry either a staff Role or this marker: the invited account is\n// a portal student, not an org member. Owned by the organizations domain — the\n// invite provider adapter reuses it to branch links, emails, and grants.\nexport const STUDENT_ROLE = 'student';\n"],"mappings":";AAQA,MAAa,QAAQ;CACnB;CACA;CACA;CACA;CACA;AACF;AAGA,MAAa,cAAc;CAAC;CAAS;CAAS;AAAY;AAI1D,SAAgB,OAAO,OAA8B;CACnD,OAAQ,MAA4B,SAAS,KAAK;AACpD;AAEA,SAAgB,YAAY,OAAmC;CAC7D,OAAQ,YAAkC,SAAS,KAAK;AAC1D;AAEA,SAAgB,UAAU,OAAqB;CAC7C,IAAI,CAAC,OAAO,KAAK,GACf,MAAM,IAAI,MAAM,iBAAiB,OAAO;CAE1C,OAAO;AACT;AAqBA,MAAM,SAAgE;CACpE,OAAO;EACL,gBAAgB;EAChB,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;EACvB,UAAU;CACZ;CACA,OAAO;EACL,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;EACvB,UAAU;CACZ;CACA,YAAY;EACV,sBAAsB;EACtB,uBAAuB;EACvB,UAAU;CACZ;CACA,WAAW;EACT,UAAU;EACV,iBAAiB;CACnB;CACA,SAAS,EACP,iBAAiB,WACnB;AACF;AAEA,SAAgB,WAAW,MAAY,YAA4C;CACjF,OAAO,OAAO,KAAK,CAAC,eAAe;AACrC;AAEA,SAAgB,YAAY,MAAqB;CAC/C,OAAO,WAAW,MAAM,UAAU,MAAM;AAC1C;AAMA,MAAM,OAA6B;CAAE,OAAO;CAAG,OAAO;CAAG,YAAY;CAAG,WAAW;CAAG,SAAS;AAAE;AAEjG,SAAgB,cAAc,KAAmB;CAC/C,IAAI,OAAa;CACjB,IAAI,WAAW;CACf,KAAK,MAAM,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,CAAC,GAAG;EACvD,MAAM,IAAiB,OAAO,KAAK,IAAI,QAAQ,UAAU,WAAW,eAAe;EACnF,IAAI,KAAK,KAAK,KAAK,UAAU;GAC3B,OAAO;GACP,WAAW,KAAK;EAClB;CACF;CACA,OAAO;AACT;AAKA,MAAa,eAAe"}

package/dist/organizations/service.d.ts

@@ -1,13 +1,14 @@
 import { Logger } from "../types/ports.js";
 import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, Invite, OrgUser, Organization, Role, UpdateOrgUserInput } from "../types/schemas/organizations.js";
 import "../shared/ports.js";
-import { Mailer } from "../shared/mailer.js";
-import { IdentityService } from "../identity/ports.js";
-import "../identity/index.js";
+import { Actor } from "../shared/actor.js";
 import "./model.js";
 import "./roles.js";
-import { Member, MembersQuery, Page } from "./members.js";
-import { CreateOrganizationInput, ResendStudentInviteInput, UpdateOrganizationInput, UpdateStudentInput } from "./types.js";
+import { Member, MemberRoleChange, MembersQuery, Page } from "./members.js";
+import { CreateOrganizationInput, ResendStudentInviteInput, UpdateOrganizationInput } from "./types.js";
+import { IdentityService } from "../identity/ports.js";
+import { Mailer } from "../shared/mailer.js";
+import "../identity/index.js";
 import { MemberWriteContext, MembersRepository, OrgAdmin, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork } from "./ports.js";
 //#region src/organizations/service.d.ts
 interface InviteUrls {
@@ -33,6 +34,7 @@ declare class OrganizationServiceImpl implements OrganizationService {
   private readonly logger;
   private readonly mailer?;
   private readonly inviteUrls?;
+  private readonly memberWrites;
   constructor(params: OrganizationServiceParams);
   createOrganization(input: CreateOrganizationInput): Promise<Organization>;
   updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization>;
@@ -40,23 +42,30 @@ declare class OrganizationServiceImpl implements OrganizationService {
   addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser>;
   removeOrgUser(orgId: string, userId: string): Promise<OrgUser>;
   updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser>;
-  createInvite(input: CreateInviteInput): Promise<Invite>;
-  updateStudent(input: UpdateStudentInput): Promise<OrgUser>;
-  resendStudentInvite(input: ResendStudentInviteInput): Promise<void>;
+  createInvite(actor: Actor, input: CreateInviteInput): Promise<Invite>;
+  resendStudentInvite(actor: Actor, input: ResendStudentInviteInput): Promise<void>;
   peekInvite(token: string): Promise<Invite | null>;
   acceptInvite(input: AcceptInviteInput): Promise<OrgUser>;
   private acceptStudentInvite;
   private acceptStaffInvite;
+  getOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
   getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
-  deleteOrgUser(orgId: string, id: string): Promise<OrgUser>;
+  deleteOrgUser(orgId: string, actor: Actor, id: string): Promise<OrgUser>;
   getOrgUsersForUser(userId: string): Promise<OrgUser[]>;
   getById(id: string): Promise<Organization | null>;
   private sendInviteEmail;
   getByExternalId(externalId: string): Promise<Organization | null>;
   getBySlug(slug: string): Promise<Organization | null>;
+  staffOrgUserIds(orgId: string): Promise<string[]>;
   listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>>;
-  updateMemberRole(ctx: MemberWriteContext, id: string, role: Role): Promise<Member | null>;
-  removeMember(ctx: MemberWriteContext, id: string): Promise<boolean>;
+  updateMemberRole(ctx: MemberWriteContext, actor: Actor, id: string, role: Role): Promise<MemberRoleChange | null>;
+  private demoteModerator;
+  private promoteStudent;
+  private asActor;
+  private memberWrite;
+  private assertManagesUsers;
+  private assertNotOwner;
+  removeMember(ctx: MemberWriteContext, actor: Actor, id: string): Promise<boolean>;
 }
 //#endregion
 export { InviteUrls, OrganizationServiceImpl, OrganizationServiceParams };

package/dist/organizations/service.js

@@ -1,10 +1,11 @@
-import { noopLogger } from "../shared/logger.js";
 import { genId } from "../shared/id.js";
-import { NotFoundError } from "../shared/errors.js";
-import { STUDENT_ROLE } from "./roles.js";
+import { ForbiddenError, NotFoundError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
+import { STAFF_ROLES, STUDENT_ROLE, capability } from "./roles.js";
 import { InviteError, OrganizationRuleError } from "./members.js";
 import { organizationEvents } from "./events.js";
 import { generateInviteToken, hashInviteToken } from "../shared/invite-token.js";
+import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/organizations/service.ts
 const INVITE_TTL_MS = 10080 * 60 * 1e3;
 function toMember(r) {
@@ -29,6 +30,7 @@ var OrganizationServiceImpl = class {
 	logger;
 	mailer;
 	inviteUrls;
+	memberWrites = new AsyncLocalStorage();
 	constructor(params) {
 		this.repo = params.repo;
 		this.membersRepo = params.membersRepo;
@@ -90,6 +92,10 @@ var OrganizationServiceImpl = class {
 		return deleted;
 	}
 	async addOrgUser({ orgId, userId, role }) {
+		if (await this.repo.findOrgUser(orgId, userId)) return this.updateOrgUser(orgId, userId, {
+			role,
+			status: "active"
+		});
 		const orgUser = await this.uow.run(async ({ organizations, outbox }) => {
 			const created = await organizations.createOrgUser({
 				orgId,
@@ -113,9 +119,21 @@ var OrganizationServiceImpl = class {
 	async removeOrgUser(orgId, userId) {
 		const deleted = await this.uow.run(async ({ organizations, outbox }) => {
 			const orgUser = await organizations.findOrgUser(orgId, userId);
-			if (!orgUser) throw new NotFoundError("OrgUser", userId);
+			if (!orgUser) throw new NotFoundError("Member", userId);
+			const write = this.memberWrite(orgUser.id);
+			if (write?.demote) {
+				const demoted = await organizations.updateOrgUser(orgId, orgUser.id, { role: STUDENT_ROLE });
+				if (!demoted) throw new NotFoundError("Member", orgUser.id);
+				if (orgUser.role !== "student") await outbox.append([organizationEvents.orgUserUpdated.make({
+					orgId,
+					data: demoted,
+					metadata: { actorOrgUserId: write.actorOrgUserId }
+				})]);
+				return demoted;
+			}
+			if (orgUser.role === "student") return orgUser;
 			const deletedUser = await organizations.deleteOrgUser(orgId, orgUser.id);
-			if (!deletedUser) throw new NotFoundError("OrgUser", orgUser.id);
+			if (!deletedUser) throw new NotFoundError("Member", orgUser.id);
 			await outbox.append([organizationEvents.orgUserDeleted.make({
 				orgId,
 				data: deletedUser
@@ -130,10 +148,21 @@ var OrganizationServiceImpl = class {
 		return deleted;
 	}
 	async updateOrgUser(orgId, userId, patch) {
-		const orgUser = await this.repo.findOrgUser(orgId, userId);
-		if (!orgUser) throw new NotFoundError("OrgUser", userId);
-		const updated = await this.repo.updateOrgUser(orgId, orgUser.id, patch);
-		if (!updated) throw new NotFoundError("OrgUser", orgUser.id);
+		const updated = await this.uow.run(async ({ organizations, outbox }) => {
+			const orgUser = await organizations.findOrgUser(orgId, userId);
+			if (!orgUser) throw new NotFoundError("Member", userId);
+			const next = await organizations.updateOrgUser(orgId, orgUser.id, patch);
+			if (!next) throw new NotFoundError("Member", orgUser.id);
+			if (patch.role !== void 0 && patch.role !== orgUser.role) {
+				const actorOrgUserId = this.memberWrite(orgUser.id)?.actorOrgUserId;
+				await outbox.append([organizationEvents.orgUserUpdated.make({
+					orgId,
+					data: next,
+					...actorOrgUserId !== void 0 && { metadata: { actorOrgUserId } }
+				})]);
+			}
+			return next;
+		});
 		this.logger.info("org user updated", {
 			orgId,
 			userId,
@@ -142,8 +171,10 @@ var OrganizationServiceImpl = class {
 		});
 		return updated;
 	}
-	async createInvite(input) {
+	async createInvite(actor, input) {
 		const { orgId, email, role, inviterUserId, firstName, lastName } = input;
+		this.assertManagesUsers(actor, orgId);
+		this.assertNotOwner(role, orgId);
 		const sendEmail = input.sendEmail ?? true;
 		const { token, tokenHash } = generateInviteToken();
 		const expiresAt = new Date(Date.now() + INVITE_TTL_MS);
@@ -184,7 +215,8 @@ var OrganizationServiceImpl = class {
 			await this.sendInviteEmail(invite, token);
 		} catch (err) {
 			this.logger.error("failed to send invite email", {
-				email: invite.email,
+				orgId,
+				inviteId: invite.id,
 				role: invite.role,
 				err: err instanceof Error ? err : new Error(String(err))
 			});
@@ -197,29 +229,9 @@ var OrganizationServiceImpl = class {
 		});
 		return invite;
 	}
-	async updateStudent(input) {
-		const { orgId, orgUserId, firstName, lastName, email } = input;
-		const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);
-		if (!orgUser || orgUser.role !== "student") throw new NotFoundError("Student", orgUserId);
-		const person = await this.people.getUserById(orgUser.userId);
-		if (!person) throw new NotFoundError("User", orgUser.userId);
-		const previousEmail = person.email;
-		await this.people.updateUser(person.id, {
-			...firstName !== void 0 && { firstName },
-			...lastName !== void 0 && { lastName },
-			...email !== void 0 && { email }
-		});
-		const emailChanged = email !== void 0 && email.toLowerCase() !== previousEmail.toLowerCase();
-		if (emailChanged && orgUser.status !== "active") await this.repo.cancelPendingInvite(orgId, previousEmail);
-		this.logger.info("student updated", {
-			orgId,
-			orgUserId,
-			emailChanged
-		});
-		return orgUser;
-	}
-	async resendStudentInvite(input) {
+	async resendStudentInvite(actor, input) {
 		const { orgId, orgUserId, inviterUserId } = input;
+		this.assertManagesUsers(actor, orgId);
 		const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);
 		if (!orgUser || orgUser.role !== "student") throw new NotFoundError("Student", orgUserId);
 		if (orgUser.status === "active") throw new OrganizationRuleError("That student has already accepted their invitation");
@@ -270,9 +282,9 @@ var OrganizationServiceImpl = class {
 	async acceptStudentInvite(invite, userId) {
 		return this.uow.run(async ({ organizations, outbox }) => {
 			const existing = await organizations.findOrgUser(invite.orgId, userId);
-			if (!existing) throw new NotFoundError("OrgUser", userId);
+			if (!existing) throw new NotFoundError("Member", userId);
 			const activated = await organizations.updateOrgUser(invite.orgId, existing.id, { status: "active" });
-			if (!activated) throw new NotFoundError("OrgUser", existing.id);
+			if (!activated) throw new NotFoundError("Member", existing.id);
 			const acceptedInvite = await organizations.setInviteStatus(invite.orgId, invite.id, "accepted");
 			if (!acceptedInvite) throw new NotFoundError("Invite", invite.id);
 			await outbox.append([organizationEvents.inviteAccepted.make({
@@ -291,7 +303,7 @@ var OrganizationServiceImpl = class {
 		await this.orgAdmin().grantMembership(org.externalId ?? org.id, person.externalId, invite.role);
 		return this.uow.run(async ({ organizations, outbox }) => {
 			const orgUser = await organizations.findOrgUser(invite.orgId, userId);
-			if (!orgUser) throw new NotFoundError("OrgUser", userId);
+			if (!orgUser) throw new NotFoundError("Member", userId);
 			const acceptedInvite = await organizations.setInviteStatus(invite.orgId, invite.id, "accepted");
 			if (!acceptedInvite) throw new NotFoundError("Invite", invite.id);
 			await outbox.append([organizationEvents.inviteAccepted.make({
@@ -301,21 +313,23 @@ var OrganizationServiceImpl = class {
 			return orgUser;
 		});
 	}
+	getOrgUserById(orgId, id) {
+		return this.repo.findOrgUserById(orgId, id);
+	}
 	async getOrgUser(orgId, userId) {
 		return this.repo.findOrgUser(orgId, userId);
 	}
-	async deleteOrgUser(orgId, id) {
+	async deleteOrgUser(orgId, actor, id) {
+		this.assertManagesUsers(actor, orgId);
 		const deleted = await this.uow.run(async ({ organizations, outbox }) => {
 			const orgUser = await organizations.findOrgUserById(orgId, id);
-			if (!orgUser) throw new NotFoundError("OrgUser", id);
+			if (!orgUser || orgUser.role !== "student") throw new NotFoundError("Student", id);
 			const deletedUser = await organizations.deleteOrgUser(orgId, id);
-			if (!deletedUser) throw new NotFoundError("OrgUser", id);
-			const events = [];
-			if (deletedUser.role === "student") events.push(organizationEvents.studentDeleted.make({
+			if (!deletedUser) throw new NotFoundError("Student", id);
+			await outbox.append([organizationEvents.studentDeleted.make({
 				orgId,
 				data: orgUser
-			}));
-			await outbox.append(events);
+			})]);
 			return deletedUser;
 		});
 		this.logger.info("org user deleted", {
@@ -354,12 +368,17 @@ var OrganizationServiceImpl = class {
 	async getBySlug(slug) {
 		return this.repo.findBySlug(slug);
 	}
+	staffOrgUserIds(orgId) {
+		return this.repo.findOrgUserIdsByRole(orgId, [...STAFF_ROLES]);
+	}
 	listMembers(orgId, query) {
 		return this.membersRepo.list(orgId, query);
 	}
-	async updateMemberRole(ctx, id, role) {
+	async updateMemberRole(ctx, actor, id, role) {
+		this.assertManagesUsers(actor, ctx.orgId);
+		this.assertNotOwner(role, ctx.orgId);
 		const member = await this.membersRepo.findById(ctx.orgId, id);
-		if (!member) return null;
+		if (!member) return this.promoteStudent(ctx, actor, id, role);
 		if (member.role === "owner") {
 			this.logger.warn("role change rejected: owner role immutable", {
 				orgId: ctx.orgId,
@@ -374,7 +393,9 @@ var OrganizationServiceImpl = class {
 			});
 			throw new OrganizationRuleError("Only active members can have their role changed");
 		}
-		await this.orgAdmin().updateRole(ctx, member.userExternalId, role);
+		if (role === "student") return this.demoteModerator(ctx, actor, member, member.userExternalId);
+		const userExternalId = member.userExternalId;
+		await this.asActor(actor, id, false, () => this.orgAdmin().updateRole(ctx, userExternalId, role));
 		const updated = await this.membersRepo.findById(ctx.orgId, id);
 		this.logger.info("member role updated", {
 			orgId: ctx.orgId,
@@ -383,7 +404,96 @@ var OrganizationServiceImpl = class {
 		});
 		return updated ? toMember(updated) : null;
 	}
-	async removeMember(ctx, id) {
+	async demoteModerator(ctx, actor, member, userExternalId) {
+		if (member.role !== "moderator") {
+			this.logger.warn("role change rejected: only a moderator becomes a student", {
+				orgId: ctx.orgId,
+				memberId: member.id
+			});
+			throw new OrganizationRuleError("Only a moderator can be made a student");
+		}
+		await this.asActor(actor, member.id, true, () => this.orgAdmin().removeMember(ctx, userExternalId));
+		const orgUser = await this.repo.findOrgUserById(ctx.orgId, member.id);
+		if (!orgUser) return null;
+		this.logger.info("moderator made a student", {
+			orgId: ctx.orgId,
+			memberId: member.id
+		});
+		return {
+			...toMember(member),
+			role: orgUser.role,
+			status: orgUser.status
+		};
+	}
+	async promoteStudent(ctx, actor, id, role) {
+		const orgUser = await this.repo.findOrgUserById(ctx.orgId, id);
+		if (!orgUser) return null;
+		if (orgUser.role !== "student" || role === "student") {
+			this.logger.warn("role change rejected: not an active member", {
+				orgId: ctx.orgId,
+				memberId: id
+			});
+			throw new OrganizationRuleError("Only active members can have their role changed");
+		}
+		const person = await this.people.getUserById(orgUser.userId);
+		if (!person?.externalId) {
+			this.logger.warn("role change rejected: student has no account", {
+				orgId: ctx.orgId,
+				memberId: id
+			});
+			throw new OrganizationRuleError("That student has not joined yet");
+		}
+		const org = await this.repo.findById(ctx.orgId);
+		if (!org) return null;
+		const orgExternalId = org.externalId ?? org.id;
+		const userExternalId = person.externalId;
+		await this.asActor(actor, orgUser.id, false, async () => {
+			await this.orgAdmin().grantMembership(orgExternalId, userExternalId, role);
+			if (!await this.membersRepo.findById(ctx.orgId, id)) await this.orgAdmin().updateRole(ctx, userExternalId, role);
+		});
+		const updated = await this.membersRepo.findById(ctx.orgId, id);
+		if (!updated) {
+			this.logger.warn("role change rejected: membership not mirrored", {
+				orgId: ctx.orgId,
+				memberId: id
+			});
+			throw new OrganizationRuleError("The role change did not take effect");
+		}
+		this.logger.info("student promoted", {
+			orgId: ctx.orgId,
+			memberId: id,
+			role
+		});
+		return toMember(updated);
+	}
+	asActor(actor, orgUserId, demote, write) {
+		return this.memberWrites.run({
+			orgUserId,
+			actorOrgUserId: actor.id,
+			demote
+		}, write);
+	}
+	memberWrite(orgUserId) {
+		const write = this.memberWrites.getStore();
+		return write?.orgUserId === orgUserId ? write : void 0;
+	}
+	assertManagesUsers(actor, orgId) {
+		if (capability(actor.role, "manage_users") !== true) {
+			this.logger.warn("member write rejected: actor cannot manage users", {
+				orgId,
+				actorOrgUserId: actor.id
+			});
+			throw new ForbiddenError("Only an owner or admin can manage members");
+		}
+	}
+	assertNotOwner(role, orgId) {
+		if (role === "owner") {
+			this.logger.warn("member write rejected: owner cannot be granted", { orgId });
+			throw new OrganizationRuleError("Ownership cannot be granted");
+		}
+	}
+	async removeMember(ctx, actor, id) {
+		this.assertManagesUsers(actor, ctx.orgId);
 		const member = await this.membersRepo.findById(ctx.orgId, id);
 		if (!member) return false;
 		if (member.role === "owner") {