@headless-lms/core 0.2.0 → 0.4.0

package/dist/entitlements/service.d.ts

@@ -1,26 +1,80 @@
 import { Page } from "../types/shared.js";
 import { Logger } from "../types/ports.js";
-import { Entitlement, EntitlementsQuery, GrantEntitlementInput } from "../types/schemas/entitlements.js";
+import { ContentType, Space } from "../types/schemas/content.js";
+import { Entitlement, EntitlementsQuery, GrantEntitlementInput, SpaceMember } from "../types/schemas/entitlements.js";
 import "../shared/ports.js";
+import { Actor } from "../shared/actor.js";
+import { CommunityReader } from "../content/ports.js";
+import "../content/index.js";
 import "./model.js";
-import { EntitlementsRepository, EntitlementsService, EntitlementsUnitOfWork } from "./ports.js";
+import { EntitlementsRepository, EntitlementsService, EntitlementsUnitOfWork, GrantTarget, OpenableSpace } from "./ports.js";
 //#region src/entitlements/service.d.ts
 type EntitlementsServiceParams = {
   /** Read-only access (list) — runs outside any transaction. */
   repo: EntitlementsRepository;
+  content: CommunityReader;
   /** Atomic write scope: tx-bound repo + outbox appender. */
   uow: EntitlementsUnitOfWork;
   logger?: Logger;
 };
 declare class EntitlementsServiceImpl implements EntitlementsService {
   private readonly repo;
+  private readonly content;
   private readonly uow;
   private readonly logger;
   constructor(params: EntitlementsServiceParams);
   list(orgId: string, query: EntitlementsQuery): Promise<Page<Entitlement>>;
   grant(orgId: string, input: GrantEntitlementInput): Promise<Entitlement>;
+  ensureGrant(orgId: string, input: GrantEntitlementInput): Promise<Entitlement>;
   setStatus(orgId: string, id: string, status: 'active' | 'revoked'): Promise<Entitlement | null>;
-  hasCourseAccess(orgId: string, orgUserId: string, courseId: string): Promise<boolean>;
+  hasAccess(orgId: string, orgUserId: string, contentId: string): Promise<boolean>;
+  listAccessibleContent(orgId: string, orgUserId: string, type?: ContentType): Promise<string[]>;
+  isCommunityMember(orgId: string, actor: Actor, communityId: string): Promise<boolean>;
+  canOpenSpace(orgId: string, actor: Actor, spaceId: string): Promise<boolean>;
+  canOpen(orgId: string, actor: Actor, space: OpenableSpace): Promise<boolean>;
+  spaceStandings(orgId: string, actor: Actor, communityId: string): Promise<Record<string, SpaceMember['status']>>;
+  openSpacesFor(orgId: string, actor: Actor, communityId: string): Promise<Space[]>;
+  openSpaceIds(orgId: string, actor: Actor, communityId: string): Promise<string[]>;
+  communityMembersAmong(orgId: string, communityId: string, orgUserIds: string[]): Promise<string[]>;
+  spaceOpenersAmong(orgId: string, spaceId: string, orgUserIds: string[]): Promise<string[]>;
+  spaceOpeners(orgId: string, spaceId: string): Promise<string[]>;
+  communitiesOpenedBy(orgId: string, grant: GrantTarget): Promise<string[]>;
+  communityModeratorIds(orgId: string, communityId: string): Promise<string[]>;
+  communityIdsOpenedFor(orgId: string, orgUserId: string): Promise<string[]>;
+  openCommunityIds(orgId: string, actor: Actor): Promise<string[]>;
+  communityMemberIds(orgId: string, communityId: string): Promise<string[]>;
+  contentHolderIds(orgId: string, contentId: string): Promise<string[]>;
+  countActiveSpaceMembers(orgId: string, spaceId: string): Promise<number>;
+  requestJoin(orgId: string, actor: Actor, communityId: string, spaceId: string): Promise<SpaceMember>;
+  invite(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
+  addSpaceMember(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
+  accept(orgId: string, actor: Actor, communityId: string, spaceId: string): Promise<SpaceMember>;
+  approve(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
+  decline(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
+  refuse(orgId: string, actor: Actor, communityId: string, spaceId: string): Promise<SpaceMember>;
+  leave(orgId: string, actor: Actor, communityId: string, spaceId: string): Promise<SpaceMember>;
+  remove(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
+  listSpaceMembers(orgId: string, actor: Actor, communityId: string, spaceId: string, query: {
+    page: number;
+    pageSize: number;
+  }): Promise<Page<SpaceMember>>;
+  expireDueGrants(now: Date): Promise<void>;
+  private expireDueIn;
+  private requireSpaceIn;
+  private requireVisibleSpaceIn;
+  private assertHasMembers;
+  private assertRule;
+  private assertHolder;
+  private assertGrant;
+  private assertHolds;
+  private assertCanManage;
+  private accessOf;
+  private createMember;
+  private insertMember;
+  private activate;
+  private deleteMember;
+  private lockSpace;
+  private assertRoom;
 }
 //#endregion
 export { EntitlementsServiceImpl, EntitlementsServiceParams };

package/dist/entitlements/service.js

@@ -1,12 +1,19 @@
+import { ConflictError, ForbiddenError, NotFoundError } from "../shared/errors.js";
 import { noopLogger } from "../shared/logger.js";
+import { canModerate, isStaffRole } from "../organizations/roles.js";
 import { entitlementEvents } from "./events.js";
+import { laterExpiry, opensSpace, seesSpace } from "./rules.js";
 //#region src/entitlements/service.ts
+const ENDING_SOON_MS = 10080 * 60 * 1e3;
+const NOTICE_BATCH_SIZE = 100;
 var EntitlementsServiceImpl = class {
 	repo;
+	content;
 	uow;
 	logger;
 	constructor(params) {
 		this.repo = params.repo;
+		this.content = params.content;
 		this.uow = params.uow;
 		this.logger = params.logger ?? noopLogger;
 	}
@@ -31,6 +38,50 @@ var EntitlementsServiceImpl = class {
 		});
 		return entitlement;
 	}
+	async ensureGrant(orgId, input) {
+		const { entitlement, change } = await this.uow.run(async ({ entitlements, outbox }) => {
+			const created = await entitlements.insertIfAbsent(orgId, input);
+			if (created) {
+				await outbox.append([entitlementEvents.entitlementCreated.make({
+					orgId,
+					data: created
+				})]);
+				return {
+					entitlement: created,
+					change: "created"
+				};
+			}
+			const existing = await entitlements.lockGrant(orgId, input);
+			if (!existing) throw new ConflictError("The grant changed while it was being given");
+			if (existing.status === "revoked") return {
+				entitlement: existing,
+				change: null
+			};
+			const expiresAt = laterExpiry(existing.expiresAt, input.expiresAt ?? null);
+			if (expiresAt?.getTime() === existing.expiresAt?.getTime()) return {
+				entitlement: existing,
+				change: null
+			};
+			const updated = await entitlements.setExpiresAt(orgId, existing.id, expiresAt);
+			if (!updated) throw new NotFoundError("Entitlement", existing.id);
+			await outbox.append([entitlementEvents.entitlementUpdated.make({
+				orgId,
+				data: updated
+			})]);
+			return {
+				entitlement: updated,
+				change: "updated"
+			};
+		});
+		if (change) this.logger.info(change === "created" ? "entitlement granted" : "entitlement extended", {
+			orgId,
+			entitlementId: entitlement.id,
+			orgUserId: entitlement.orgUserId,
+			bundleId: entitlement.bundleId,
+			contentId: entitlement.contentId
+		});
+		return entitlement;
+	}
 	async setStatus(orgId, id, status) {
 		const entitlement = await this.uow.run(async ({ entitlements, outbox }) => {
 			const updated = await entitlements.setStatus(orgId, id, status);
@@ -51,10 +102,449 @@ var EntitlementsServiceImpl = class {
 		});
 		return entitlement;
 	}
-	hasCourseAccess(orgId, orgUserId, courseId) {
-		return this.repo.hasCourseAccess(orgId, orgUserId, courseId);
+	hasAccess(orgId, orgUserId, contentId) {
+		return this.repo.hasAccess(orgId, orgUserId, contentId);
+	}
+	listAccessibleContent(orgId, orgUserId, type) {
+		return this.repo.listAccessibleContent(orgId, orgUserId, type);
+	}
+	async isCommunityMember(orgId, actor, communityId) {
+		return (await this.accessOf(orgId, actor.id, communityId, null))?.member === true;
+	}
+	async canOpenSpace(orgId, actor, spaceId) {
+		const space = await this.content.getSpace(orgId, spaceId);
+		if (!space) return false;
+		return this.canOpen(orgId, actor, space);
+	}
+	async canOpen(orgId, actor, space) {
+		const facts = await this.accessOf(orgId, actor.id, space.communityId, space.id);
+		if (!facts) return false;
+		return opensSpace(facts.role, facts.member, space.accessRule, facts.activeInSpace);
+	}
+	async spaceStandings(orgId, actor, communityId) {
+		const rows = await this.repo.listSpaceMembersFor(orgId, actor.id, communityId);
+		return Object.fromEntries(rows.map((row) => [row.spaceId, row.status]));
+	}
+	async openSpacesFor(orgId, actor, communityId) {
+		const facts = await this.accessOf(orgId, actor.id, communityId, null);
+		if (!facts?.member) return [];
+		const [spaces, activeIds] = await Promise.all([this.content.listSpaces(orgId, communityId), this.repo.activeSpaceIds(orgId, actor.id, communityId)]);
+		const active = new Set(activeIds);
+		return spaces.filter((space) => opensSpace(facts.role, facts.member, space.accessRule, active.has(space.id)));
+	}
+	async openSpaceIds(orgId, actor, communityId) {
+		return (await this.openSpacesFor(orgId, actor, communityId)).map((space) => space.id);
+	}
+	async communityMembersAmong(orgId, communityId, orgUserIds) {
+		if (orgUserIds.length === 0) return [];
+		return (await this.repo.accessAmong(orgId, communityId, null, orgUserIds)).filter((fact) => fact.member).map((fact) => fact.orgUserId);
+	}
+	async spaceOpenersAmong(orgId, spaceId, orgUserIds) {
+		if (orgUserIds.length === 0) return [];
+		const space = await this.content.getSpace(orgId, spaceId);
+		if (!space) return [];
+		return (await this.repo.accessAmong(orgId, space.communityId, space.id, orgUserIds)).filter((fact) => opensSpace(fact.role, fact.member, space.accessRule, fact.activeInSpace)).map((fact) => fact.orgUserId);
+	}
+	async spaceOpeners(orgId, spaceId) {
+		const space = await this.content.getSpace(orgId, spaceId);
+		if (!space) return [];
+		const members = await this.repo.communityMemberIds(orgId, space.communityId);
+		return this.spaceOpenersAmong(orgId, spaceId, members);
+	}
+	communitiesOpenedBy(orgId, grant) {
+		return this.repo.communitiesOpenedBy(orgId, grant);
+	}
+	communityModeratorIds(orgId, communityId) {
+		return this.repo.communityModeratorIds(orgId, communityId);
+	}
+	communityIdsOpenedFor(orgId, orgUserId) {
+		return this.repo.communityIdsOpenedFor(orgId, orgUserId);
+	}
+	openCommunityIds(orgId, actor) {
+		return this.repo.openCommunityIds(orgId, actor.id);
+	}
+	communityMemberIds(orgId, communityId) {
+		return this.repo.communityMemberIds(orgId, communityId);
+	}
+	contentHolderIds(orgId, contentId) {
+		return this.repo.contentHolderIds(orgId, contentId);
+	}
+	countActiveSpaceMembers(orgId, spaceId) {
+		return this.repo.countActiveSpaceMembers(orgId, spaceId);
+	}
+	async requestJoin(orgId, actor, communityId, spaceId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertRule(space.accessRule, "by_request");
+		if (canModerate(actor.role)) throw new ForbiddenError("Staff do not request a place in a space");
+		await this.assertGrant(orgId, actor, actor.id, space.communityId);
+		const created = await this.createMember(orgId, actor, space, actor.id, "requested", "request");
+		this.logger.info("space member created", {
+			orgId,
+			spaceId,
+			orgUserId: actor.id,
+			status: created.status,
+			actorId: actor.id
+		});
+		return created;
+	}
+	async invite(orgId, actor, communityId, spaceId, orgUserId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertRule(space.accessRule, "by_invite");
+		await this.assertCanManage(orgId, actor, space.communityId);
+		await this.assertHolds(orgId, actor, orgUserId, space.communityId);
+		const created = await this.createMember(orgId, actor, space, orgUserId, "invited", "invite");
+		this.logger.info("space member created", {
+			orgId,
+			spaceId,
+			orgUserId,
+			status: created.status,
+			actorId: actor.id
+		});
+		return created;
+	}
+	async addSpaceMember(orgId, actor, communityId, spaceId, orgUserId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertHasMembers(space.accessRule);
+		await this.assertCanManage(orgId, actor, space.communityId);
+		await this.assertHolds(orgId, actor, orgUserId, space.communityId);
+		const created = await this.uow.run(async (scope) => {
+			const locked = await this.lockSpace(scope.spaces, orgId, spaceId);
+			this.assertHasMembers(locked.accessRule);
+			return this.insertMember(scope.entitlements, scope.outbox, orgId, actor, {
+				communityId: space.communityId,
+				spaceId,
+				orgUserId,
+				status: "active",
+				source: "manual"
+			}, locked);
+		});
+		this.logger.info("space member created", {
+			orgId,
+			spaceId,
+			orgUserId,
+			status: created.status,
+			actorId: actor.id
+		});
+		return created;
+	}
+	async accept(orgId, actor, communityId, spaceId) {
+		this.assertHolder(actor);
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertRule(space.accessRule, "by_invite");
+		await this.assertGrant(orgId, actor, actor.id, space.communityId);
+		return this.activate(orgId, actor, spaceId, actor.id, "by_invite", "invited", () => ownRowMissing("invited"));
+	}
+	async approve(orgId, actor, communityId, spaceId, orgUserId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertRule(space.accessRule, "by_request");
+		await this.assertCanManage(orgId, actor, space.communityId);
+		await this.assertGrant(orgId, actor, orgUserId, space.communityId);
+		return this.activate(orgId, actor, spaceId, orgUserId, "by_request", "requested", () => new NotFoundError("Space member", orgUserId));
+	}
+	async decline(orgId, actor, communityId, spaceId, orgUserId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		await this.assertCanManage(orgId, actor, space.communityId);
+		return this.deleteMember(orgId, actor, spaceId, orgUserId, "requested", () => new NotFoundError("Space member", orgUserId));
+	}
+	async refuse(orgId, actor, communityId, spaceId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertHolder(actor);
+		await this.assertGrant(orgId, actor, actor.id, space.communityId);
+		return this.deleteMember(orgId, actor, spaceId, actor.id, "invited", () => ownRowMissing("invited"));
+	}
+	async leave(orgId, actor, communityId, spaceId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertHolder(actor);
+		await this.assertGrant(orgId, actor, actor.id, space.communityId);
+		return this.deleteMember(orgId, actor, spaceId, actor.id, "active", () => ownRowMissing("active"));
+	}
+	async remove(orgId, actor, communityId, spaceId, orgUserId) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		this.assertHasMembers(space.accessRule);
+		await this.assertCanManage(orgId, actor, space.communityId);
+		const { updated, previousStatus } = await this.uow.run(async ({ entitlements, spaces, outbox }) => {
+			const locked = await this.lockSpace(spaces, orgId, spaceId);
+			this.assertHasMembers(locked.accessRule);
+			const row = await entitlements.lockSpaceMember(orgId, spaceId, orgUserId);
+			if (!row) {
+				this.logger.warn("space member remove rejected — not found", {
+					orgId,
+					spaceId,
+					orgUserId,
+					actorId: actor.id
+				});
+				throw new NotFoundError("Space member", orgUserId);
+			}
+			if (row.status === "revoked") throw new ConflictError("This person is already removed from the space");
+			const next = await entitlements.updateSpaceMemberStatus(orgId, row.id, "revoked");
+			if (!next) throw new NotFoundError("Space member", row.id);
+			await outbox.append([entitlementEvents.spaceMemberUpdated.make({
+				orgId,
+				data: next,
+				metadata: {
+					actorOrgUserId: actor.id,
+					previousStatus: row.status
+				}
+			})]);
+			return {
+				updated: next,
+				previousStatus: row.status
+			};
+		});
+		this.logger.info("space member removed", {
+			orgId,
+			spaceId,
+			orgUserId,
+			previousStatus,
+			actorId: actor.id
+		});
+		return updated;
+	}
+	async listSpaceMembers(orgId, actor, communityId, spaceId, query) {
+		const space = await this.requireVisibleSpaceIn(orgId, actor, communityId, spaceId);
+		if (!await this.canOpen(orgId, actor, space)) throw new NotFoundError("Space", spaceId);
+		return this.repo.listSpaceMembers(orgId, spaceId, {
+			...query,
+			...canModerate(actor.role) ? {} : { statuses: ["active"] }
+		});
+	}
+	async expireDueGrants(now) {
+		const orgIds = await this.repo.orgIdsWithDueNotices(now, new Date(now.getTime() + ENDING_SOON_MS));
+		let failed = 0;
+		for (const orgId of orgIds) try {
+			await this.expireDueIn(orgId, now);
+		} catch (err) {
+			failed += 1;
+			this.logger.error("due grants not expired", {
+				orgId,
+				err
+			});
+		}
+		if (failed > 0) throw new Error(`due grants of ${failed} orgs could not be expired`);
+	}
+	async expireDueIn(orgId, now) {
+		const until = new Date(now.getTime() + ENDING_SOON_MS);
+		let appended = 0;
+		let afterId;
+		for (;;) {
+			const batch = await this.uow.run(async ({ entitlements, outbox }) => {
+				const events = [];
+				const grants = await entitlements.listGrantsExpiredBy(orgId, now, NOTICE_BATCH_SIZE, afterId);
+				for (const grant of grants) {
+					if (!grant.expiresAt) continue;
+					if (await entitlements.claimNotice(orgId, {
+						kind: "expired",
+						entitlementId: grant.id,
+						expiresAt: grant.expiresAt
+					}, now)) events.push(entitlementEvents.entitlementExpired.make({
+						orgId,
+						data: grant
+					}));
+				}
+				if (events.length > 0) await outbox.append(events);
+				return {
+					events: events.length,
+					last: grants.at(-1)?.id,
+					size: grants.length
+				};
+			});
+			appended += batch.events;
+			if (batch.size < NOTICE_BATCH_SIZE || batch.last === void 0) break;
+			afterId = batch.last;
+		}
+		let afterKey;
+		for (;;) {
+			const batch = await this.uow.run(async ({ entitlements, outbox }) => {
+				const events = [];
+				const ending = await entitlements.listGrantsEndingBetween(orgId, now, until, NOTICE_BATCH_SIZE, afterKey);
+				for (const { grant, communityId } of ending) {
+					if (!grant.expiresAt) continue;
+					if (await entitlements.claimNotice(orgId, {
+						kind: "ending_soon",
+						entitlementId: grant.id,
+						communityId,
+						expiresAt: grant.expiresAt
+					}, now)) events.push(entitlementEvents.entitlementEndingSoon.make({
+						orgId,
+						data: {
+							...grant,
+							communityId
+						}
+					}));
+				}
+				if (events.length > 0) await outbox.append(events);
+				const last = ending.at(-1);
+				return {
+					events: events.length,
+					last: last && {
+						entitlementId: last.grant.id,
+						communityId: last.communityId
+					},
+					size: ending.length
+				};
+			});
+			appended += batch.events;
+			if (batch.size < NOTICE_BATCH_SIZE || batch.last === void 0) break;
+			afterKey = batch.last;
+		}
+		if (appended > 0) this.logger.info("due grants expired", {
+			orgId,
+			events: appended
+		});
+	}
+	async requireSpaceIn(orgId, communityId, spaceId) {
+		const space = await this.content.getSpace(orgId, spaceId);
+		if (!space || space.communityId !== communityId) {
+			this.logger.warn("space members rejected — space not found", {
+				orgId,
+				communityId,
+				spaceId
+			});
+			throw new NotFoundError("Space", spaceId);
+		}
+		return space;
+	}
+	async requireVisibleSpaceIn(orgId, actor, communityId, spaceId) {
+		const space = await this.requireSpaceIn(orgId, communityId, spaceId);
+		if (seesSpace(actor.role, space.accessRule, void 0)) return space;
+		const row = await this.repo.findSpaceMember(orgId, spaceId, actor.id);
+		if (!seesSpace(actor.role, space.accessRule, row?.status)) throw new NotFoundError("Space", spaceId);
+		return space;
+	}
+	assertHasMembers(accessRule) {
+		if (accessRule === "all_members") throw new ConflictError("An all-members space has no space members");
+	}
+	assertRule(accessRule, expected) {
+		this.assertHasMembers(accessRule);
+		if (accessRule !== expected) throw new ConflictError(accessRule === "by_invite" ? "This space is by invitation" : "This space is by request");
+	}
+	assertHolder(actor) {
+		if (isStaffRole(actor.role)) throw new ForbiddenError("Staff do not hold a place in a space");
+	}
+	async assertGrant(orgId, actor, orgUserId, communityId) {
+		if (!await this.repo.hasCommunityAccess(orgId, orgUserId, communityId)) throw new ForbiddenError(orgUserId === actor.id ? "You are not a member of this community" : "That person is not a member of this community");
+	}
+	async assertHolds(orgId, actor, orgUserId, communityId) {
+		const facts = await this.accessOf(orgId, orgUserId, communityId, null);
+		if (facts && isStaffRole(facts.role)) throw new ForbiddenError("Staff do not hold a place in a space");
+		await this.assertGrant(orgId, actor, orgUserId, communityId);
+	}
+	async assertCanManage(orgId, actor, communityId) {
+		const facts = await this.accessOf(orgId, actor.id, communityId, null);
+		if (facts?.member && canModerate(facts.role)) return;
+		throw new ForbiddenError("You cannot manage members of this space");
+	}
+	async accessOf(orgId, orgUserId, communityId, spaceId) {
+		const [facts] = await this.repo.accessAmong(orgId, communityId, spaceId, [orgUserId]);
+		return facts ?? null;
+	}
+	async createMember(orgId, actor, space, orgUserId, status, source) {
+		return this.uow.run(async ({ entitlements, outbox }) => this.insertMember(entitlements, outbox, orgId, actor, {
+			communityId: space.communityId,
+			spaceId: space.id,
+			orgUserId,
+			status,
+			source
+		}));
+	}
+	async insertMember(entitlements, outbox, orgId, actor, input, room) {
+		const existing = await entitlements.lockSpaceMember(orgId, input.spaceId, input.orgUserId);
+		if (existing && existing.status !== "revoked") throw new ConflictError(input.orgUserId === actor.id ? "You already have a place in this space" : "That person already has a place in this space");
+		if (room) await this.assertRoom(entitlements, orgId, room);
+		if (existing) await entitlements.deleteSpaceMember(orgId, existing.id);
+		const created = await entitlements.insertSpaceMember(orgId, input);
+		await outbox.append([entitlementEvents.spaceMemberCreated.make({
+			orgId,
+			data: created,
+			metadata: { actorOrgUserId: actor.id }
+		})]);
+		return created;
+	}
+	async activate(orgId, actor, spaceId, orgUserId, rule, from, missing) {
+		const updated = await this.uow.run(async ({ entitlements, spaces, outbox }) => {
+			const locked = await this.lockSpace(spaces, orgId, spaceId);
+			this.assertRule(locked.accessRule, rule);
+			const row = await entitlements.lockSpaceMember(orgId, spaceId, orgUserId);
+			if (row?.status === "active") throw alreadyPlaced(actor, orgUserId);
+			if (!row || row.status !== from) {
+				this.logger.warn("space member activate rejected — not found", {
+					orgId,
+					spaceId,
+					orgUserId,
+					actorId: actor.id
+				});
+				throw missing();
+			}
+			await this.assertRoom(entitlements, orgId, locked);
+			const next = await entitlements.updateSpaceMemberStatus(orgId, row.id, "active");
+			if (!next) throw missing();
+			await outbox.append([entitlementEvents.spaceMemberUpdated.make({
+				orgId,
+				data: next,
+				metadata: {
+					actorOrgUserId: actor.id,
+					previousStatus: from
+				}
+			})]);
+			return next;
+		});
+		this.logger.info("space member activated", {
+			orgId,
+			spaceId,
+			orgUserId,
+			actorId: actor.id
+		});
+		return updated;
+	}
+	async deleteMember(orgId, actor, spaceId, orgUserId, from, missing) {
+		const row = await this.uow.run(async ({ entitlements, outbox }) => {
+			const current = await entitlements.lockSpaceMember(orgId, spaceId, orgUserId);
+			if (from !== "active" && current?.status === "active") throw alreadyPlaced(actor, orgUserId);
+			if (!current || current.status !== from) {
+				this.logger.warn("space member delete rejected — not found", {
+					orgId,
+					spaceId,
+					orgUserId,
+					actorId: actor.id
+				});
+				throw missing();
+			}
+			await entitlements.deleteSpaceMember(orgId, current.id);
+			await outbox.append([entitlementEvents.spaceMemberDeleted.make({
+				orgId,
+				data: current,
+				metadata: {
+					actorOrgUserId: actor.id,
+					previousStatus: from
+				}
+			})]);
+			return current;
+		});
+		this.logger.info("space member deleted", {
+			orgId,
+			spaceId,
+			orgUserId,
+			previousStatus: from,
+			actorId: actor.id
+		});
+		return row;
+	}
+	async lockSpace(spaces, orgId, spaceId) {
+		const locked = await spaces.lockSpace(orgId, spaceId);
+		if (!locked) throw new NotFoundError("Space", spaceId);
+		return locked;
+	}
+	async assertRoom(entitlements, orgId, space) {
+		if (space.capacity === null) return;
+		if (await entitlements.countActiveSpaceMembers(orgId, space.id) >= space.capacity) throw new ConflictError("This space is full");
 	}
 };
+function alreadyPlaced(actor, orgUserId) {
+	return new ConflictError(orgUserId === actor.id ? "You already have a place in this space" : "That person already has a place in this space");
+}
+function ownRowMissing(status) {
+	return new ConflictError(status === "invited" ? "You do not have an invitation to this space" : "You are not a member of this space");
+}
 //#endregion
 export { EntitlementsServiceImpl };