@headless-lms/core 0.2.0 → 0.4.0

package/dist/organizations/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../src/organizations/service.ts"],"sourcesContent":["// organizations context — service implementation (inbound port).\nimport type {\n  MemberRecord,\n  MembersRepository,\n  MemberWriteContext,\n  OrgAdmin,\n  OrganizationService,\n  OrganizationsRepository,\n  OrganizationsUnitOfWork,\n} from './ports.js';\nimport type { Invite, Organization, OrgUser } from './model.js';\nimport { type Role, STUDENT_ROLE } from './roles.js';\nimport {\n  InviteError,\n  type Member,\n  type MembersQuery,\n  OrganizationRuleError,\n  type Page,\n} from './members.js';\nimport type {\n  AcceptInviteInput,\n  AddOrgUserInput,\n  CreateInviteInput,\n  CreateOrganizationInput,\n  ResendStudentInviteInput,\n  UpdateOrganizationInput,\n  UpdateOrgUserInput,\n  UpdateStudentInput,\n} from './types.js';\nimport { organizationEvents, type OrganizationEvent } from './events.js';\nimport type { Logger, NewDomainEvent } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport { generateInviteToken, hashInviteToken } from '../shared/invite-token.js';\nimport { NotFoundError } from '../shared/errors.js';\nimport type { IdentityService } from '../identity/index.js';\nimport { genId } from '../shared/id.js';\n\nconst INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ntype NewOrganizationEvent = NewDomainEvent<OrganizationEvent>;\n\nexport interface InviteUrls {\n  studentPortalUrl: string;\n  adminAppUrl: string;\n}\n\nfunction toMember(r: MemberRecord): Member {\n  return {\n    id: r.id,\n    firstName: r.firstName,\n    lastName: r.lastName,\n    email: r.email,\n    image: r.image,\n    role: r.role,\n    status: r.status,\n    joinedAt: r.joinedAt,\n    invitedAt: r.invitedAt,\n  };\n}\n\nexport type OrganizationServiceParams = {\n  repo: OrganizationsRepository;\n  membersRepo: MembersRepository;\n  people: IdentityService;\n  uow: OrganizationsUnitOfWork;\n  orgAdmin: () => OrgAdmin;\n  logger?: Logger;\n  mailer?: Pick<Mailer, 'send'>;\n  inviteUrls?: InviteUrls;\n};\n\nexport class OrganizationServiceImpl implements OrganizationService {\n  private readonly repo: OrganizationsRepository;\n  private readonly membersRepo: MembersRepository;\n  private readonly people: IdentityService;\n  private readonly uow: OrganizationsUnitOfWork;\n  private readonly orgAdmin: () => OrgAdmin;\n  private readonly logger: Logger;\n  private readonly mailer?: Pick<Mailer, 'send'>;\n  private readonly inviteUrls?: InviteUrls;\n\n  constructor(params: OrganizationServiceParams) {\n    this.repo = params.repo;\n    this.membersRepo = params.membersRepo;\n    this.people = params.people;\n    this.uow = params.uow;\n    this.orgAdmin = params.orgAdmin;\n    this.logger = params.logger ?? noopLogger;\n    this.mailer = params.mailer;\n    this.inviteUrls = params.inviteUrls;\n  }\n\n  async createOrganization(input: CreateOrganizationInput): Promise<Organization> {\n    const created = await this.uow.run(async ({ organizations, outbox }) => {\n      const id = genId('organization');\n\n      const created = await organizations.create({\n        id,\n        // The auth provider adopts this id for its own org row, so the org is\n        // its own external id — a lookup by either id lands on the same row.\n        externalId: input.externalId ?? id,\n        name: input.name ?? `My Org`,\n        slug: input.slug ?? '',\n        ownerId: input.ownerId,\n      });\n      await outbox.append([\n        organizationEvents.organizationCreated.make({\n          orgId: created.id,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('organization created', { orgId: created.id, slug: created.slug });\n    return created;\n  }\n\n  async updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization> {\n    const updatedOrg = await this.uow.run(async ({ organizations, outbox }) => {\n      const updated = await organizations.update(id, {\n        name: input.name,\n        slug: input.slug,\n      });\n      if (!updated) {\n        throw new NotFoundError('Organization', id);\n      }\n      await outbox.append([\n        organizationEvents.organizationUpdated.make({ orgId: id, data: updated }),\n      ]);\n      return updated;\n    });\n\n    this.logger.info('organization updated', { updatedOrg });\n    return updatedOrg!;\n  }\n\n  async deleteOrganization(id: string): Promise<Organization> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const deleted = await organizations.delete(id);\n\n      await outbox.append([\n        organizationEvents.organizationDeleted.make({\n          orgId: deleted.id,\n          data: deleted,\n        }),\n      ]);\n      return deleted;\n    });\n    this.logger.info('organization deleted', { orgId: deleted.id });\n    return deleted;\n  }\n\n  async addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser> {\n    const orgUser = await this.uow.run(async ({ organizations, outbox }) => {\n      const created = await organizations.createOrgUser({ orgId, role, userId, status: 'active' });\n      await outbox.append([organizationEvents.orgUserLinked.make({ orgId, data: created })]);\n      return created;\n    });\n    this.logger.info('user added to organization', { orgId, userId, role });\n    return orgUser;\n  }\n\n  async removeOrgUser(orgId: string, userId: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('OrgUser', userId);\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, orgUser.id);\n      if (!deletedUser) {\n        throw new NotFoundError('OrgUser', orgUser.id);\n      }\n      await outbox.append([\n        organizationEvents.orgUserDeleted.make({\n          orgId,\n          data: deletedUser,\n        }),\n      ]);\n      return deletedUser;\n    });\n    this.logger.info('org user removed', { orgId, userId, orgUserId: deleted.id });\n    return deleted;\n  }\n\n  async updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser> {\n    const orgUser = await this.repo.findOrgUser(orgId, userId);\n    if (!orgUser) {\n      throw new NotFoundError('OrgUser', userId);\n    }\n    const updated = await this.repo.updateOrgUser(orgId, orgUser.id, patch);\n    if (!updated) {\n      throw new NotFoundError('OrgUser', orgUser.id);\n    }\n    this.logger.info('org user updated', { orgId, userId, orgUserId: updated.id, patch });\n    return updated;\n  }\n\n  async createInvite(input: CreateInviteInput): Promise<Invite> {\n    const { orgId, email, role, inviterUserId, firstName, lastName } = input;\n    const sendEmail = input.sendEmail ?? true;\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n\n    // A student belongs to the org from the moment an admin adds them, not from\n    // the moment they click a link — so the person exists before the invite\n    // does. Staff are excluded: their org_users row is mirrored from the auth\n    // provider's member record, which does not exist until they join.\n    const person =\n      role === STUDENT_ROLE\n        ? ((await this.people.getUserByEmail(email)) ??\n          (await this.people.createUser({\n            email,\n            ...(firstName !== undefined && { firstName }),\n            ...(lastName !== undefined && { lastName }),\n          })))\n        : null;\n\n    const invite = await this.uow.run(async ({ organizations, outbox }) => {\n      const events: NewOrganizationEvent[] = [];\n      if (person) {\n        const orgUser = await organizations.createOrgUser({\n          orgId,\n          userId: person.id,\n          role: STUDENT_ROLE,\n          status: 'invited',\n        });\n        events.push(organizationEvents.studentCreated.make({ orgId, data: orgUser }));\n      }\n      const row = await organizations.upsertPendingInvite(orgId, {\n        email,\n        role,\n        invitedBy: inviterUserId,\n        tokenHash,\n        expiresAt,\n      });\n      events.push(organizationEvents.inviteCreated.make({ orgId, data: row }));\n      await outbox.append(events);\n      return row;\n    });\n\n    if (sendEmail) {\n      // TODO make this workflow durable\n      try {\n        await this.sendInviteEmail(invite, token);\n      } catch (err) {\n        // A failed email must not abort invite creation: the token is already\n        // minted and recorded, so the admin can fix transport and resend.\n        this.logger.error('failed to send invite email', {\n          email: invite.email,\n          role: invite.role,\n          err: err instanceof Error ? err : new Error(String(err)),\n        });\n      }\n    }\n\n    this.logger.info('invite created', { orgId, inviteId: invite.id, role, sendEmail });\n    return invite;\n  }\n\n  async updateStudent(input: UpdateStudentInput): Promise<OrgUser> {\n    const { orgId, orgUserId, firstName, lastName, email } = input;\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n\n    const previousEmail = person.email;\n    await this.people.updateUser(person.id, {\n      ...(firstName !== undefined && { firstName }),\n      ...(lastName !== undefined && { lastName }),\n      ...(email !== undefined && { email }),\n    });\n\n    // The pending invite carries its own copy of the address and a token minted\n    // against it. Once the address is corrected that invite points at the wrong\n    // person, so it is cancelled rather than left live — the admin re-sends,\n    // which mints a fresh one for the new address. A student who has already\n    // accepted has no pending invite to worry about.\n    const emailChanged = email !== undefined && email.toLowerCase() !== previousEmail.toLowerCase();\n    if (emailChanged && orgUser.status !== 'active') {\n      await this.repo.cancelPendingInvite(orgId, previousEmail);\n    }\n\n    this.logger.info('student updated', { orgId, orgUserId, emailChanged });\n    return orgUser;\n  }\n\n  async resendStudentInvite(input: ResendStudentInviteInput): Promise<void> {\n    const { orgId, orgUserId, inviterUserId } = input;\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    if (orgUser.status === 'active') {\n      throw new OrganizationRuleError('That student has already accepted their invitation');\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n    const pending = await this.repo.findPendingInvite(orgId, person.email);\n    if (!pending) {\n      throw new NotFoundError('Invite', person.email);\n    }\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n    const invite = await this.repo.setInviteToken(orgId, pending.id, tokenHash, expiresAt);\n    if (!invite) {\n      throw new NotFoundError('Invite', pending.id);\n    }\n    await this.sendInviteEmail(invite, token);\n    this.logger.info('student invite resent', {\n      orgId,\n      orgUserId,\n      inviteId: invite.id,\n      inviterUserId,\n    });\n  }\n\n  async peekInvite(token: string): Promise<Invite | null> {\n    const invite = await this.repo.findInviteByTokenHash(hashInviteToken(token));\n    if (!invite || invite.status !== 'pending') {\n      return null;\n    }\n    if (invite.expiresAt && invite.expiresAt < new Date()) {\n      return null;\n    }\n    return invite;\n  }\n\n  async acceptInvite(input: AcceptInviteInput): Promise<OrgUser> {\n    const invite = await this.peekInvite(input.token);\n    if (!invite) {\n      this.logger.warn('invite accept refused: token invalid or expired');\n      throw new InviteError('invalid invite');\n    }\n    if (invite.email.toLowerCase() !== input.email.toLowerCase()) {\n      this.logger.warn('invite accept refused: email mismatch', {\n        orgId: invite.orgId,\n        inviteId: invite.id,\n      });\n      throw new InviteError('emails must match');\n    }\n    const org = await this.repo.findById(invite.orgId);\n    if (!org) {\n      throw new InviteError('Org not found');\n    }\n\n    const orgUser =\n      invite.role === STUDENT_ROLE\n        ? await this.acceptStudentInvite(invite, input.userId)\n        : await this.acceptStaffInvite(invite, org, input.userId);\n    this.logger.info('invite accepted', { orgId: invite.orgId, userId: input.userId });\n    return orgUser;\n  }\n\n  private async acceptStudentInvite(invite: Invite, userId: string): Promise<OrgUser> {\n    return this.uow.run(async ({ organizations, outbox }) => {\n      const existing = await organizations.findOrgUser(invite.orgId, userId);\n      if (!existing) {\n        throw new NotFoundError('OrgUser', userId);\n      }\n      const activated = await organizations.updateOrgUser(invite.orgId, existing.id, {\n        status: 'active',\n      });\n      if (!activated) {\n        throw new NotFoundError('OrgUser', existing.id);\n      }\n      const acceptedInvite = await organizations.setInviteStatus(\n        invite.orgId,\n        invite.id,\n        'accepted',\n      );\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      await outbox.append([\n        organizationEvents.inviteAccepted.make({ orgId: invite.orgId, data: acceptedInvite }),\n        organizationEvents.studentLinked.make({ orgId: invite.orgId, data: activated }),\n      ]);\n      return activated;\n    });\n  }\n\n  private async acceptStaffInvite(\n    invite: Invite,\n    org: Organization,\n    userId: string,\n  ): Promise<OrgUser> {\n    const person = await this.people.getUserById(userId);\n    if (!person?.externalId) {\n      throw new NotFoundError('User', userId);\n    }\n    await this.orgAdmin().grantMembership(org.externalId ?? org.id, person.externalId, invite.role);\n    return this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(invite.orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('OrgUser', userId);\n      }\n      const acceptedInvite = await organizations.setInviteStatus(\n        invite.orgId,\n        invite.id,\n        'accepted',\n      );\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      await outbox.append([\n        organizationEvents.inviteAccepted.make({ orgId: invite.orgId, data: acceptedInvite }),\n      ]);\n      return orgUser;\n    });\n  }\n\n  // By identity USER id — `(org_id, user_id)` is unique. Every caller (scope\n  // resolution, the MCP principal, the learn routes) asks \"what is this person\n  // in this org\", never \"what is this org_users row\".\n  async getOrgUser(orgId: string, userId: string): Promise<OrgUser | null> {\n    return this.repo.findOrgUser(orgId, userId);\n  }\n\n  async deleteOrgUser(orgId: string, id: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUserById(orgId, id);\n      if (!orgUser) {\n        throw new NotFoundError('OrgUser', id);\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, id);\n      if (!deletedUser) {\n        throw new NotFoundError('OrgUser', id);\n      }\n      const events: NewOrganizationEvent[] = [];\n      if (deletedUser.role === STUDENT_ROLE) {\n        events.push(organizationEvents.studentDeleted.make({ orgId, data: orgUser }));\n      }\n\n      await outbox.append(events);\n      return deletedUser;\n    });\n    this.logger.info('org user deleted', { orgId, orgUserId: id });\n    return deleted;\n  }\n\n  async getOrgUsersForUser(userId: string): Promise<OrgUser[]> {\n    return this.repo.findOrgUsersByUser(userId);\n  }\n\n  async getById(id: string): Promise<Organization | null> {\n    return this.repo.findById(id);\n  }\n\n  private async sendInviteEmail(invite: Invite, token: string): Promise<void> {\n    if (!this.mailer || !this.inviteUrls) {\n      throw new Error('invite delivery is not configured (mailer / invite urls missing)');\n    }\n    const { email, role } = invite;\n    const isStudent = role === STUDENT_ROLE;\n    const base = isStudent\n      ? `${this.inviteUrls.studentPortalUrl}/welcome`\n      : `${this.inviteUrls.adminAppUrl}/invite`;\n    // The portal resolves the token to the invited email, so the link carries\n    // only the token. The admin app still reads it from the query.\n    const query = isStudent\n      ? new URLSearchParams({ token })\n      : new URLSearchParams({ token, email });\n    const inviteUrl = `${base}?${query.toString()}`;\n    if (role === STUDENT_ROLE) {\n      await this.mailer.send(email, 'studentInvite', { inviteUrl, studentName: email });\n    } else {\n      await this.mailer.send(email, 'memberInvite', {\n        inviteUrl,\n        inviterName: 'Your team',\n        role,\n      });\n    }\n  }\n\n  async getByExternalId(externalId: string): Promise<Organization | null> {\n    return this.repo.findByExternalId(externalId);\n  }\n\n  async getBySlug(slug: string): Promise<Organization | null> {\n    return this.repo.findBySlug(slug);\n  }\n\n  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>> {\n    return this.membersRepo.list(orgId, query);\n  }\n\n  async updateMemberRole(ctx: MemberWriteContext, id: string, role: Role): Promise<Member | null> {\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return null;\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('role change rejected: owner role immutable', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner role cannot be reassigned');\n    }\n    if (member.kind !== 'member' || !member.userExternalId) {\n      this.logger.warn('role change rejected: not an active member', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('Only active members can have their role changed');\n    }\n    await this.orgAdmin().updateRole(ctx, member.userExternalId, role);\n    const updated = await this.membersRepo.findById(ctx.orgId, id);\n    this.logger.info('member role updated', { orgId: ctx.orgId, memberId: id, role });\n    return updated ? toMember(updated) : null;\n  }\n\n  async removeMember(ctx: MemberWriteContext, id: string): Promise<boolean> {\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return false;\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('member removal rejected: owner cannot be removed', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner cannot be removed');\n    }\n    if (member.kind === 'member' && member.userExternalId) {\n      await this.orgAdmin().removeMember(ctx, member.userExternalId);\n    } else if (member.kind === 'invite' && member.inviteId) {\n      const inviteId = member.inviteId;\n      await this.uow.run(async ({ organizations, outbox }) => {\n        const canceled = await organizations.setInviteStatus(ctx.orgId, inviteId, 'canceled');\n        if (!canceled) {\n          throw new NotFoundError('Invite', inviteId);\n        }\n        await outbox.append([\n          organizationEvents.inviteCanceled.make({ orgId: ctx.orgId, data: canceled }),\n        ]);\n      });\n    }\n    this.logger.info('member removed', { orgId: ctx.orgId, memberId: id });\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;AAsCA,MAAM,gBAAgB,QAAc,KAAK;AASzC,SAAS,SAAS,GAAyB;CACzC,OAAO;EACL,IAAI,EAAE;EACN,WAAW,EAAE;EACb,UAAU,EAAE;EACZ,OAAO,EAAE;EACT,OAAO,EAAE;EACT,MAAM,EAAE;EACR,QAAQ,EAAE;EACV,UAAU,EAAE;EACZ,WAAW,EAAE;CACf;AACF;AAaA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,OAAO,OAAO;EACnB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO;EACrB,KAAK,MAAM,OAAO;EAClB,KAAK,WAAW,OAAO;EACvB,KAAK,SAAS,OAAO,UAAU;EAC/B,KAAK,SAAS,OAAO;EACrB,KAAK,aAAa,OAAO;CAC3B;CAEA,MAAM,mBAAmB,OAAuD;EAC9E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,KAAK,MAAM,cAAc;GAE/B,MAAM,UAAU,MAAM,cAAc,OAAO;IACzC;IAGA,YAAY,MAAM,cAAc;IAChC,MAAM,MAAM,QAAQ;IACpB,MAAM,MAAM,QAAQ;IACpB,SAAS,MAAM;GACjB,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB;GAAE,OAAO,QAAQ;GAAI,MAAM,QAAQ;EAAK,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAY,OAAuD;EAC1F,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACzE,MAAM,UAAU,MAAM,cAAc,OAAO,IAAI;IAC7C,MAAM,MAAM;IACZ,MAAM,MAAM;GACd,CAAC;GACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,gBAAgB,EAAE;GAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAAE,OAAO;IAAI,MAAM;GAAQ,CAAC,CAC1E,CAAC;GACD,OAAO;EACT,CAAC;EAED,KAAK,OAAO,KAAK,wBAAwB,EAAE,WAAW,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAmC;EAC1D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB,EAAE,OAAO,QAAQ,GAAG,CAAC;EAC9D,OAAO;CACT;CAEA,MAAM,WAAW,EAAE,OAAO,QAAQ,QAA2C;EAC3E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,cAAc;IAAE;IAAO;IAAM;IAAQ,QAAQ;GAAS,CAAC;GAC3F,MAAM,OAAO,OAAO,CAAC,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC,CAAC;GACrF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,8BAA8B;GAAE;GAAO;GAAQ;EAAK,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,QAAkC;EACnE,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,MAAM;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,MAAM;GAE3C,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,QAAQ,EAAE;GACvE,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,QAAQ,EAAE;GAE/C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IACrC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO;GAAQ,WAAW,QAAQ;EAAG,CAAC;EAC7E,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,QAAgB,OAA6C;EAC9F,MAAM,UAAU,MAAM,KAAK,KAAK,YAAY,OAAO,MAAM;EACzD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,MAAM;EAE3C,MAAM,UAAU,MAAM,KAAK,KAAK,cAAc,OAAO,QAAQ,IAAI,KAAK;EACtE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,QAAQ,EAAE;EAE/C,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO;GAAQ,WAAW,QAAQ;GAAI;EAAM,CAAC;EACpF,OAAO;CACT;CAEA,MAAM,aAAa,OAA2C;EAC5D,MAAM,EAAE,OAAO,OAAO,MAAM,eAAe,WAAW,aAAa;EACnE,MAAM,YAAY,MAAM,aAAa;EACrC,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EAMrD,MAAM,SACJ,SAAA,YACM,MAAM,KAAK,OAAO,eAAe,KAAK,KACvC,MAAM,KAAK,OAAO,WAAW;GAC5B;GACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;EAC3C,CAAC,IACD;EAEN,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACrE,MAAM,SAAiC,CAAC;GACxC,IAAI,QAAQ;IACV,MAAM,UAAU,MAAM,cAAc,cAAc;KAChD;KACA,QAAQ,OAAO;KACf,MAAM;KACN,QAAQ;IACV,CAAC;IACD,OAAO,KAAK,mBAAmB,eAAe,KAAK;KAAE;KAAO,MAAM;IAAQ,CAAC,CAAC;GAC9E;GACA,MAAM,MAAM,MAAM,cAAc,oBAAoB,OAAO;IACzD;IACA;IACA,WAAW;IACX;IACA;GACF,CAAC;GACD,OAAO,KAAK,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAI,CAAC,CAAC;GACvE,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EAED,IAAI,WAEF,IAAI;GACF,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EAC1C,SAAS,KAAK;GAGZ,KAAK,OAAO,MAAM,+BAA+B;IAC/C,OAAO,OAAO;IACd,MAAM,OAAO;IACb,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;GACzD,CAAC;EACH;EAGF,KAAK,OAAO,KAAK,kBAAkB;GAAE;GAAO,UAAU,OAAO;GAAI;GAAM;EAAU,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,cAAc,OAA6C;EAC/D,MAAM,EAAE,OAAO,WAAW,WAAW,UAAU,UAAU;EACzD,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAGhD,MAAM,gBAAgB,OAAO;EAC7B,MAAM,KAAK,OAAO,WAAW,OAAO,IAAI;GACtC,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;GACzC,GAAI,UAAU,KAAA,KAAa,EAAE,MAAM;EACrC,CAAC;EAOD,MAAM,eAAe,UAAU,KAAA,KAAa,MAAM,YAAY,MAAM,cAAc,YAAY;EAC9F,IAAI,gBAAgB,QAAQ,WAAW,UACrC,MAAM,KAAK,KAAK,oBAAoB,OAAO,aAAa;EAG1D,KAAK,OAAO,KAAK,mBAAmB;GAAE;GAAO;GAAW;EAAa,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,oBAAoB,OAAgD;EACxE,MAAM,EAAE,OAAO,WAAW,kBAAkB;EAC5C,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,IAAI,QAAQ,WAAW,UACrB,MAAM,IAAI,sBAAsB,oDAAoD;EAEtF,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAEhD,MAAM,UAAU,MAAM,KAAK,KAAK,kBAAkB,OAAO,OAAO,KAAK;EACrE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,OAAO,KAAK;EAEhD,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EACrD,MAAM,SAAS,MAAM,KAAK,KAAK,eAAe,OAAO,QAAQ,IAAI,WAAW,SAAS;EACrF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;EAE9C,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EACxC,KAAK,OAAO,KAAK,yBAAyB;GACxC;GACA;GACA,UAAU,OAAO;GACjB;EACF,CAAC;CACH;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,SAAS,MAAM,KAAK,KAAK,sBAAsB,gBAAgB,KAAK,CAAC;EAC3E,IAAI,CAAC,UAAU,OAAO,WAAW,WAC/B,OAAO;EAET,IAAI,OAAO,aAAa,OAAO,4BAAY,IAAI,KAAK,GAClD,OAAO;EAET,OAAO;CACT;CAEA,MAAM,aAAa,OAA4C;EAC7D,MAAM,SAAS,MAAM,KAAK,WAAW,MAAM,KAAK;EAChD,IAAI,CAAC,QAAQ;GACX,KAAK,OAAO,KAAK,iDAAiD;GAClE,MAAM,IAAI,YAAY,gBAAgB;EACxC;EACA,IAAI,OAAO,MAAM,YAAY,MAAM,MAAM,MAAM,YAAY,GAAG;GAC5D,KAAK,OAAO,KAAK,yCAAyC;IACxD,OAAO,OAAO;IACd,UAAU,OAAO;GACnB,CAAC;GACD,MAAM,IAAI,YAAY,mBAAmB;EAC3C;EACA,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,OAAO,KAAK;EACjD,IAAI,CAAC,KACH,MAAM,IAAI,YAAY,eAAe;EAGvC,MAAM,UACJ,OAAO,SAAA,YACH,MAAM,KAAK,oBAAoB,QAAQ,MAAM,MAAM,IACnD,MAAM,KAAK,kBAAkB,QAAQ,KAAK,MAAM,MAAM;EAC5D,KAAK,OAAO,KAAK,mBAAmB;GAAE,OAAO,OAAO;GAAO,QAAQ,MAAM;EAAO,CAAC;EACjF,OAAO;CACT;CAEA,MAAc,oBAAoB,QAAgB,QAAkC;EAClF,OAAO,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACvD,MAAM,WAAW,MAAM,cAAc,YAAY,OAAO,OAAO,MAAM;GACrE,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,WAAW,MAAM;GAE3C,MAAM,YAAY,MAAM,cAAc,cAAc,OAAO,OAAO,SAAS,IAAI,EAC7E,QAAQ,SACV,CAAC;GACD,IAAI,CAAC,WACH,MAAM,IAAI,cAAc,WAAW,SAAS,EAAE;GAEhD,MAAM,iBAAiB,MAAM,cAAc,gBACzC,OAAO,OACP,OAAO,IACP,UACF;GACA,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAe,CAAC,GACpF,mBAAmB,cAAc,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAU,CAAC,CAChF,CAAC;GACD,OAAO;EACT,CAAC;CACH;CAEA,MAAc,kBACZ,QACA,KACA,QACkB;EAClB,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,MAAM;EACnD,IAAI,CAAC,QAAQ,YACX,MAAM,IAAI,cAAc,QAAQ,MAAM;EAExC,MAAM,KAAK,SAAS,CAAC,CAAC,gBAAgB,IAAI,cAAc,IAAI,IAAI,OAAO,YAAY,OAAO,IAAI;EAC9F,OAAO,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACvD,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,OAAO,MAAM;GACpE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,MAAM;GAE3C,MAAM,iBAAiB,MAAM,cAAc,gBACzC,OAAO,OACP,OAAO,IACP,UACF;GACA,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAe,CAAC,CACtF,CAAC;GACD,OAAO;EACT,CAAC;CACH;CAKA,MAAM,WAAW,OAAe,QAAyC;EACvE,OAAO,KAAK,KAAK,YAAY,OAAO,MAAM;CAC5C;CAEA,MAAM,cAAc,OAAe,IAA8B;EAC/D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,gBAAgB,OAAO,EAAE;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,EAAE;GAC/D,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,SAAiC,CAAC;GACxC,IAAI,YAAY,SAAA,WACd,OAAO,KAAK,mBAAmB,eAAe,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC;GAG9E,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO,WAAW;EAAG,CAAC;EAC7D,OAAO;CACT;CAEA,MAAM,mBAAmB,QAAoC;EAC3D,OAAO,KAAK,KAAK,mBAAmB,MAAM;CAC5C;CAEA,MAAM,QAAQ,IAA0C;EACtD,OAAO,KAAK,KAAK,SAAS,EAAE;CAC9B;CAEA,MAAc,gBAAgB,QAAgB,OAA8B;EAC1E,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,YACxB,MAAM,IAAI,MAAM,kEAAkE;EAEpF,MAAM,EAAE,OAAO,SAAS;EACxB,MAAM,YAAY,SAAS;EAS3B,MAAM,YAAY,GARL,YACT,GAAG,KAAK,WAAW,iBAAiB,YACpC,GAAG,KAAK,WAAW,YAAY,SAMT,IAHZ,YACV,IAAI,gBAAgB,EAAE,MAAM,CAAC,IAC7B,IAAI,gBAAgB;GAAE;GAAO;EAAM,CAAC,EAAA,CACL,SAAS;EAC5C,IAAI,SAAA,WACF,MAAM,KAAK,OAAO,KAAK,OAAO,iBAAiB;GAAE;GAAW,aAAa;EAAM,CAAC;OAEhF,MAAM,KAAK,OAAO,KAAK,OAAO,gBAAgB;GAC5C;GACA,aAAa;GACb;EACF,CAAC;CAEL;CAEA,MAAM,gBAAgB,YAAkD;EACtE,OAAO,KAAK,KAAK,iBAAiB,UAAU;CAC9C;CAEA,MAAM,UAAU,MAA4C;EAC1D,OAAO,KAAK,KAAK,WAAW,IAAI;CAClC;CAEA,YAAY,OAAe,OAA4C;EACrE,OAAO,KAAK,YAAY,KAAK,OAAO,KAAK;CAC3C;CAEA,MAAM,iBAAiB,KAAyB,IAAY,MAAoC;EAC9F,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO;EAET,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,qCAAqC;EACvE;EACA,IAAI,OAAO,SAAS,YAAY,CAAC,OAAO,gBAAgB;GACtD,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iDAAiD;EACnF;EACA,MAAM,KAAK,SAAS,CAAC,CAAC,WAAW,KAAK,OAAO,gBAAgB,IAAI;EACjE,MAAM,UAAU,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC7D,KAAK,OAAO,KAAK,uBAAuB;GAAE,OAAO,IAAI;GAAO,UAAU;GAAI;EAAK,CAAC;EAChF,OAAO,UAAU,SAAS,OAAO,IAAI;CACvC;CAEA,MAAM,aAAa,KAAyB,IAA8B;EACxE,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO;EAET,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,oDAAoD;IACnE,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,6BAA6B;EAC/D;EACA,IAAI,OAAO,SAAS,YAAY,OAAO,gBACrC,MAAM,KAAK,SAAS,CAAC,CAAC,aAAa,KAAK,OAAO,cAAc;OACxD,IAAI,OAAO,SAAS,YAAY,OAAO,UAAU;GACtD,MAAM,WAAW,OAAO;GACxB,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;IACtD,MAAM,WAAW,MAAM,cAAc,gBAAgB,IAAI,OAAO,UAAU,UAAU;IACpF,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,UAAU,QAAQ;IAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KAAE,OAAO,IAAI;KAAO,MAAM;IAAS,CAAC,CAC7E,CAAC;GACH,CAAC;EACH;EACA,KAAK,OAAO,KAAK,kBAAkB;GAAE,OAAO,IAAI;GAAO,UAAU;EAAG,CAAC;EACrE,OAAO;CACT;AACF"}
+{"version":3,"file":"service.js","names":[],"sources":["../../src/organizations/service.ts"],"sourcesContent":["// organizations context — service implementation (inbound port).\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport type {\n  MemberRecord,\n  MembersRepository,\n  MemberWriteContext,\n  OrgAdmin,\n  OrganizationService,\n  OrganizationsRepository,\n  OrganizationsUnitOfWork,\n} from './ports.js';\nimport type { Invite, Organization, OrgUser } from './model.js';\nimport { capability, type Role, STAFF_ROLES, STUDENT_ROLE } from './roles.js';\nimport {\n  InviteError,\n  type Member,\n  type MemberRoleChange,\n  type MembersQuery,\n  OrganizationRuleError,\n  type Page,\n} from './members.js';\nimport type {\n  AcceptInviteInput,\n  AddOrgUserInput,\n  CreateInviteInput,\n  CreateOrganizationInput,\n  ResendStudentInviteInput,\n  UpdateOrganizationInput,\n  UpdateOrgUserInput,\n} from './types.js';\nimport { organizationEvents, type OrganizationEvent } from './events.js';\nimport type { Logger, NewDomainEvent } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport { generateInviteToken, hashInviteToken } from '../shared/invite-token.js';\nimport { ForbiddenError, NotFoundError } from '../shared/errors.js';\nimport type { Actor } from '../shared/actor.js';\nimport type { IdentityService } from '../identity/index.js';\nimport { genId } from '../shared/id.js';\n\nconst INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ntype NewOrganizationEvent = NewDomainEvent<OrganizationEvent>;\n\ninterface MemberWrite {\n  orgUserId: string;\n  actorOrgUserId: string;\n  demote: boolean;\n}\n\nexport interface InviteUrls {\n  studentPortalUrl: string;\n  adminAppUrl: string;\n}\n\nfunction toMember(r: MemberRecord): Member {\n  return {\n    id: r.id,\n    firstName: r.firstName,\n    lastName: r.lastName,\n    email: r.email,\n    image: r.image,\n    role: r.role,\n    status: r.status,\n    joinedAt: r.joinedAt,\n    invitedAt: r.invitedAt,\n  };\n}\n\nexport type OrganizationServiceParams = {\n  repo: OrganizationsRepository;\n  membersRepo: MembersRepository;\n  people: IdentityService;\n  uow: OrganizationsUnitOfWork;\n  orgAdmin: () => OrgAdmin;\n  logger?: Logger;\n  mailer?: Pick<Mailer, 'send'>;\n  inviteUrls?: InviteUrls;\n};\n\nexport class OrganizationServiceImpl implements OrganizationService {\n  private readonly repo: OrganizationsRepository;\n  private readonly membersRepo: MembersRepository;\n  private readonly people: IdentityService;\n  private readonly uow: OrganizationsUnitOfWork;\n  private readonly orgAdmin: () => OrgAdmin;\n  private readonly logger: Logger;\n  private readonly mailer?: Pick<Mailer, 'send'>;\n  private readonly inviteUrls?: InviteUrls;\n  private readonly memberWrites = new AsyncLocalStorage<MemberWrite>();\n\n  constructor(params: OrganizationServiceParams) {\n    this.repo = params.repo;\n    this.membersRepo = params.membersRepo;\n    this.people = params.people;\n    this.uow = params.uow;\n    this.orgAdmin = params.orgAdmin;\n    this.logger = params.logger ?? noopLogger;\n    this.mailer = params.mailer;\n    this.inviteUrls = params.inviteUrls;\n  }\n\n  async createOrganization(input: CreateOrganizationInput): Promise<Organization> {\n    const created = await this.uow.run(async ({ organizations, outbox }) => {\n      const id = genId('organization');\n\n      const created = await organizations.create({\n        id,\n        // The auth provider adopts this id for its own org row, so the org is\n        // its own external id — a lookup by either id lands on the same row.\n        externalId: input.externalId ?? id,\n        name: input.name ?? `My Org`,\n        slug: input.slug ?? '',\n        ownerId: input.ownerId,\n      });\n      await outbox.append([\n        organizationEvents.organizationCreated.make({\n          orgId: created.id,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('organization created', { orgId: created.id, slug: created.slug });\n    return created;\n  }\n\n  async updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization> {\n    const updatedOrg = await this.uow.run(async ({ organizations, outbox }) => {\n      const updated = await organizations.update(id, {\n        name: input.name,\n        slug: input.slug,\n      });\n      if (!updated) {\n        throw new NotFoundError('Organization', id);\n      }\n      await outbox.append([\n        organizationEvents.organizationUpdated.make({ orgId: id, data: updated }),\n      ]);\n      return updated;\n    });\n\n    this.logger.info('organization updated', { updatedOrg });\n    return updatedOrg!;\n  }\n\n  async deleteOrganization(id: string): Promise<Organization> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const deleted = await organizations.delete(id);\n\n      await outbox.append([\n        organizationEvents.organizationDeleted.make({\n          orgId: deleted.id,\n          data: deleted,\n        }),\n      ]);\n      return deleted;\n    });\n    this.logger.info('organization deleted', { orgId: deleted.id });\n    return deleted;\n  }\n\n  async addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser> {\n    const existing = await this.repo.findOrgUser(orgId, userId);\n    if (existing) {\n      return this.updateOrgUser(orgId, userId, { role, status: 'active' });\n    }\n    const orgUser = await this.uow.run(async ({ organizations, outbox }) => {\n      const created = await organizations.createOrgUser({ orgId, role, userId, status: 'active' });\n      await outbox.append([organizationEvents.orgUserLinked.make({ orgId, data: created })]);\n      return created;\n    });\n    this.logger.info('user added to organization', { orgId, userId, role });\n    return orgUser;\n  }\n\n  async removeOrgUser(orgId: string, userId: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('Member', userId);\n      }\n      const write = this.memberWrite(orgUser.id);\n      if (write?.demote) {\n        const demoted = await organizations.updateOrgUser(orgId, orgUser.id, {\n          role: STUDENT_ROLE,\n        });\n        if (!demoted) {\n          throw new NotFoundError('Member', orgUser.id);\n        }\n        if (orgUser.role !== STUDENT_ROLE) {\n          await outbox.append([\n            organizationEvents.orgUserUpdated.make({\n              orgId,\n              data: demoted,\n              metadata: { actorOrgUserId: write.actorOrgUserId },\n            }),\n          ]);\n        }\n        return demoted;\n      }\n      if (orgUser.role === STUDENT_ROLE) {\n        return orgUser;\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, orgUser.id);\n      if (!deletedUser) {\n        throw new NotFoundError('Member', orgUser.id);\n      }\n      await outbox.append([\n        organizationEvents.orgUserDeleted.make({\n          orgId,\n          data: deletedUser,\n        }),\n      ]);\n      return deletedUser;\n    });\n    this.logger.info('org user removed', { orgId, userId, orgUserId: deleted.id });\n    return deleted;\n  }\n\n  async updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser> {\n    const updated = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('Member', userId);\n      }\n      const next = await organizations.updateOrgUser(orgId, orgUser.id, patch);\n      if (!next) {\n        throw new NotFoundError('Member', orgUser.id);\n      }\n      if (patch.role !== undefined && patch.role !== orgUser.role) {\n        const actorOrgUserId = this.memberWrite(orgUser.id)?.actorOrgUserId;\n        await outbox.append([\n          organizationEvents.orgUserUpdated.make({\n            orgId,\n            data: next,\n            ...(actorOrgUserId !== undefined && { metadata: { actorOrgUserId } }),\n          }),\n        ]);\n      }\n      return next;\n    });\n    this.logger.info('org user updated', { orgId, userId, orgUserId: updated.id, patch });\n    return updated;\n  }\n\n  async createInvite(actor: Actor, input: CreateInviteInput): Promise<Invite> {\n    const { orgId, email, role, inviterUserId, firstName, lastName } = input;\n    this.assertManagesUsers(actor, orgId);\n    this.assertNotOwner(role, orgId);\n    const sendEmail = input.sendEmail ?? true;\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n\n    // A student belongs to the org from the moment an admin adds them, not from\n    // the moment they click a link — so the person exists before the invite\n    // does. Staff are excluded: their org_users row is mirrored from the auth\n    // provider's member record, which does not exist until they join.\n    const person =\n      role === STUDENT_ROLE\n        ? ((await this.people.getUserByEmail(email)) ??\n          (await this.people.createUser({\n            email,\n            ...(firstName !== undefined && { firstName }),\n            ...(lastName !== undefined && { lastName }),\n          })))\n        : null;\n\n    const invite = await this.uow.run(async ({ organizations, outbox }) => {\n      const events: NewOrganizationEvent[] = [];\n      if (person) {\n        const orgUser = await organizations.createOrgUser({\n          orgId,\n          userId: person.id,\n          role: STUDENT_ROLE,\n          status: 'invited',\n        });\n        events.push(organizationEvents.studentCreated.make({ orgId, data: orgUser }));\n      }\n      const row = await organizations.upsertPendingInvite(orgId, {\n        email,\n        role,\n        invitedBy: inviterUserId,\n        tokenHash,\n        expiresAt,\n      });\n      events.push(organizationEvents.inviteCreated.make({ orgId, data: row }));\n      await outbox.append(events);\n      return row;\n    });\n\n    if (sendEmail) {\n      // TODO make this workflow durable\n      try {\n        await this.sendInviteEmail(invite, token);\n      } catch (err) {\n        // A failed email must not abort invite creation: the token is already\n        // minted and recorded, so the admin can fix transport and resend.\n        this.logger.error('failed to send invite email', {\n          orgId,\n          inviteId: invite.id,\n          role: invite.role,\n          err: err instanceof Error ? err : new Error(String(err)),\n        });\n      }\n    }\n\n    this.logger.info('invite created', { orgId, inviteId: invite.id, role, sendEmail });\n    return invite;\n  }\n\n  async resendStudentInvite(actor: Actor, input: ResendStudentInviteInput): Promise<void> {\n    const { orgId, orgUserId, inviterUserId } = input;\n    this.assertManagesUsers(actor, orgId);\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    if (orgUser.status === 'active') {\n      throw new OrganizationRuleError('That student has already accepted their invitation');\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n    const pending = await this.repo.findPendingInvite(orgId, person.email);\n    if (!pending) {\n      throw new NotFoundError('Invite', person.email);\n    }\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n    const invite = await this.repo.setInviteToken(orgId, pending.id, tokenHash, expiresAt);\n    if (!invite) {\n      throw new NotFoundError('Invite', pending.id);\n    }\n    await this.sendInviteEmail(invite, token);\n    this.logger.info('student invite resent', {\n      orgId,\n      orgUserId,\n      inviteId: invite.id,\n      inviterUserId,\n    });\n  }\n\n  async peekInvite(token: string): Promise<Invite | null> {\n    const invite = await this.repo.findInviteByTokenHash(hashInviteToken(token));\n    if (!invite || invite.status !== 'pending') {\n      return null;\n    }\n    if (invite.expiresAt && invite.expiresAt < new Date()) {\n      return null;\n    }\n    return invite;\n  }\n\n  async acceptInvite(input: AcceptInviteInput): Promise<OrgUser> {\n    const invite = await this.peekInvite(input.token);\n    if (!invite) {\n      this.logger.warn('invite accept refused: token invalid or expired');\n      throw new InviteError('invalid invite');\n    }\n    if (invite.email.toLowerCase() !== input.email.toLowerCase()) {\n      this.logger.warn('invite accept refused: email mismatch', {\n        orgId: invite.orgId,\n        inviteId: invite.id,\n      });\n      throw new InviteError('emails must match');\n    }\n    const org = await this.repo.findById(invite.orgId);\n    if (!org) {\n      throw new InviteError('Org not found');\n    }\n\n    const orgUser =\n      invite.role === STUDENT_ROLE\n        ? await this.acceptStudentInvite(invite, input.userId)\n        : await this.acceptStaffInvite(invite, org, input.userId);\n    this.logger.info('invite accepted', { orgId: invite.orgId, userId: input.userId });\n    return orgUser;\n  }\n\n  private async acceptStudentInvite(invite: Invite, userId: string): Promise<OrgUser> {\n    return this.uow.run(async ({ organizations, outbox }) => {\n      const existing = await organizations.findOrgUser(invite.orgId, userId);\n      if (!existing) {\n        throw new NotFoundError('Member', userId);\n      }\n      const activated = await organizations.updateOrgUser(invite.orgId, existing.id, {\n        status: 'active',\n      });\n      if (!activated) {\n        throw new NotFoundError('Member', existing.id);\n      }\n      const acceptedInvite = await organizations.setInviteStatus(\n        invite.orgId,\n        invite.id,\n        'accepted',\n      );\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      await outbox.append([\n        organizationEvents.inviteAccepted.make({ orgId: invite.orgId, data: acceptedInvite }),\n        organizationEvents.studentLinked.make({ orgId: invite.orgId, data: activated }),\n      ]);\n      return activated;\n    });\n  }\n\n  private async acceptStaffInvite(\n    invite: Invite,\n    org: Organization,\n    userId: string,\n  ): Promise<OrgUser> {\n    const person = await this.people.getUserById(userId);\n    if (!person?.externalId) {\n      throw new NotFoundError('User', userId);\n    }\n    await this.orgAdmin().grantMembership(org.externalId ?? org.id, person.externalId, invite.role);\n    return this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(invite.orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('Member', userId);\n      }\n      const acceptedInvite = await organizations.setInviteStatus(\n        invite.orgId,\n        invite.id,\n        'accepted',\n      );\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      await outbox.append([\n        organizationEvents.inviteAccepted.make({ orgId: invite.orgId, data: acceptedInvite }),\n      ]);\n      return orgUser;\n    });\n  }\n\n  // By identity USER id — `(org_id, user_id)` is unique. Every caller (scope\n  // resolution, the MCP principal, the member routes) asks \"what is this person\n  // in this org\", never \"what is this org_users row\".\n  getOrgUserById(orgId: string, id: string): Promise<OrgUser | null> {\n    return this.repo.findOrgUserById(orgId, id);\n  }\n\n  async getOrgUsersByIds(orgId: string, ids: string[]): Promise<OrgUser[]> {\n    const unique = [...new Set(ids)];\n    return unique.length > 0 ? this.repo.findOrgUsersByIds(orgId, unique) : [];\n  }\n\n  async getOrgUser(orgId: string, userId: string): Promise<OrgUser | null> {\n    return this.repo.findOrgUser(orgId, userId);\n  }\n\n  async deleteOrgUser(orgId: string, actor: Actor, id: string): Promise<OrgUser> {\n    this.assertManagesUsers(actor, orgId);\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUserById(orgId, id);\n      if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n        throw new NotFoundError('Student', id);\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, id);\n      if (!deletedUser) {\n        throw new NotFoundError('Student', id);\n      }\n      await outbox.append([organizationEvents.studentDeleted.make({ orgId, data: orgUser })]);\n      return deletedUser;\n    });\n    this.logger.info('org user deleted', { orgId, orgUserId: id });\n    return deleted;\n  }\n\n  async getOrgUsersForUser(userId: string): Promise<OrgUser[]> {\n    return this.repo.findOrgUsersByUser(userId);\n  }\n\n  async getById(id: string): Promise<Organization | null> {\n    return this.repo.findById(id);\n  }\n\n  orgIds(): Promise<string[]> {\n    return this.repo.listIds();\n  }\n\n  private async sendInviteEmail(invite: Invite, token: string): Promise<void> {\n    if (!this.mailer || !this.inviteUrls) {\n      throw new Error('invite delivery is not configured (mailer / invite urls missing)');\n    }\n    const { email, role } = invite;\n    const isStudent = role === STUDENT_ROLE;\n    const base = isStudent\n      ? `${this.inviteUrls.studentPortalUrl}/welcome`\n      : `${this.inviteUrls.adminAppUrl}/invite`;\n    // The portal resolves the token to the invited email, so the link carries\n    // only the token. The admin app still reads it from the query.\n    const query = isStudent\n      ? new URLSearchParams({ token })\n      : new URLSearchParams({ token, email });\n    const inviteUrl = `${base}?${query.toString()}`;\n    if (role === STUDENT_ROLE) {\n      await this.mailer.send(email, 'studentInvite', { inviteUrl, studentName: email });\n    } else {\n      await this.mailer.send(email, 'memberInvite', {\n        inviteUrl,\n        inviterName: 'Your team',\n        role,\n      });\n    }\n  }\n\n  async getByExternalId(externalId: string): Promise<Organization | null> {\n    return this.repo.findByExternalId(externalId);\n  }\n\n  async getBySlug(slug: string): Promise<Organization | null> {\n    return this.repo.findBySlug(slug);\n  }\n\n  staffOrgUserIds(orgId: string): Promise<string[]> {\n    return this.repo.findOrgUserIdsByRole(orgId, [...STAFF_ROLES]);\n  }\n\n  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>> {\n    return this.membersRepo.list(orgId, query);\n  }\n\n  async updateMemberRole(\n    ctx: MemberWriteContext,\n    actor: Actor,\n    id: string,\n    role: Role,\n  ): Promise<MemberRoleChange | null> {\n    this.assertManagesUsers(actor, ctx.orgId);\n    this.assertNotOwner(role, ctx.orgId);\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return this.promoteStudent(ctx, actor, id, role);\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('role change rejected: owner role immutable', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner role cannot be reassigned');\n    }\n    if (member.kind !== 'member' || !member.userExternalId) {\n      this.logger.warn('role change rejected: not an active member', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('Only active members can have their role changed');\n    }\n    if (role === STUDENT_ROLE) {\n      return this.demoteModerator(ctx, actor, member, member.userExternalId);\n    }\n    const userExternalId = member.userExternalId;\n    await this.asActor(actor, id, false, () =>\n      this.orgAdmin().updateRole(ctx, userExternalId, role),\n    );\n    const updated = await this.membersRepo.findById(ctx.orgId, id);\n    this.logger.info('member role updated', { orgId: ctx.orgId, memberId: id, role });\n    return updated ? toMember(updated) : null;\n  }\n\n  private async demoteModerator(\n    ctx: MemberWriteContext,\n    actor: Actor,\n    member: MemberRecord,\n    userExternalId: string,\n  ): Promise<MemberRoleChange | null> {\n    if (member.role !== 'moderator') {\n      this.logger.warn('role change rejected: only a moderator becomes a student', {\n        orgId: ctx.orgId,\n        memberId: member.id,\n      });\n      throw new OrganizationRuleError('Only a moderator can be made a student');\n    }\n    await this.asActor(actor, member.id, true, () =>\n      this.orgAdmin().removeMember(ctx, userExternalId),\n    );\n    const orgUser = await this.repo.findOrgUserById(ctx.orgId, member.id);\n    if (!orgUser) {\n      return null;\n    }\n    this.logger.info('moderator made a student', { orgId: ctx.orgId, memberId: member.id });\n    return { ...toMember(member), role: orgUser.role, status: orgUser.status };\n  }\n\n  private async promoteStudent(\n    ctx: MemberWriteContext,\n    actor: Actor,\n    id: string,\n    role: Role,\n  ): Promise<MemberRoleChange | null> {\n    const orgUser = await this.repo.findOrgUserById(ctx.orgId, id);\n    if (!orgUser) {\n      return null;\n    }\n    if (orgUser.role !== STUDENT_ROLE || role === STUDENT_ROLE) {\n      this.logger.warn('role change rejected: not an active member', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('Only active members can have their role changed');\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person?.externalId) {\n      this.logger.warn('role change rejected: student has no account', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('That student has not joined yet');\n    }\n    const org = await this.repo.findById(ctx.orgId);\n    if (!org) {\n      return null;\n    }\n    const orgExternalId = org.externalId ?? org.id;\n    const userExternalId = person.externalId;\n    await this.asActor(actor, orgUser.id, false, async () => {\n      await this.orgAdmin().grantMembership(orgExternalId, userExternalId, role);\n      if (!(await this.membersRepo.findById(ctx.orgId, id))) {\n        await this.orgAdmin().updateRole(ctx, userExternalId, role);\n      }\n    });\n    const updated = await this.membersRepo.findById(ctx.orgId, id);\n    if (!updated) {\n      this.logger.warn('role change rejected: membership not mirrored', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The role change did not take effect');\n    }\n    this.logger.info('student promoted', { orgId: ctx.orgId, memberId: id, role });\n    return toMember(updated);\n  }\n\n  private asActor<T>(\n    actor: Actor,\n    orgUserId: string,\n    demote: boolean,\n    write: () => Promise<T>,\n  ): Promise<T> {\n    return this.memberWrites.run({ orgUserId, actorOrgUserId: actor.id, demote }, write);\n  }\n\n  private memberWrite(orgUserId: string): MemberWrite | undefined {\n    const write = this.memberWrites.getStore();\n    return write?.orgUserId === orgUserId ? write : undefined;\n  }\n\n  private assertManagesUsers(actor: Actor, orgId: string): void {\n    if (capability(actor.role, 'manage_users') !== true) {\n      this.logger.warn('member write rejected: actor cannot manage users', {\n        orgId,\n        actorOrgUserId: actor.id,\n      });\n      throw new ForbiddenError('Only an owner or admin can manage members');\n    }\n  }\n\n  private assertNotOwner(role: Role, orgId: string): void {\n    if (role === 'owner') {\n      this.logger.warn('member write rejected: owner cannot be granted', { orgId });\n      throw new OrganizationRuleError('Ownership cannot be granted');\n    }\n  }\n\n  async removeMember(ctx: MemberWriteContext, actor: Actor, id: string): Promise<boolean> {\n    this.assertManagesUsers(actor, ctx.orgId);\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return false;\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('member removal rejected: owner cannot be removed', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner cannot be removed');\n    }\n    if (member.kind === 'member' && member.userExternalId) {\n      await this.orgAdmin().removeMember(ctx, member.userExternalId);\n    } else if (member.kind === 'invite' && member.inviteId) {\n      const inviteId = member.inviteId;\n      await this.uow.run(async ({ organizations, outbox }) => {\n        const canceled = await organizations.setInviteStatus(ctx.orgId, inviteId, 'canceled');\n        if (!canceled) {\n          throw new NotFoundError('Invite', inviteId);\n        }\n        await outbox.append([\n          organizationEvents.inviteCanceled.make({ orgId: ctx.orgId, data: canceled }),\n        ]);\n      });\n    }\n    this.logger.info('member removed', { orgId: ctx.orgId, memberId: id });\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;;AAwCA,MAAM,gBAAgB,QAAc,KAAK;AAezC,SAAS,SAAS,GAAyB;CACzC,OAAO;EACL,IAAI,EAAE;EACN,WAAW,EAAE;EACb,UAAU,EAAE;EACZ,OAAO,EAAE;EACT,OAAO,EAAE;EACT,MAAM,EAAE;EACR,QAAQ,EAAE;EACV,UAAU,EAAE;EACZ,WAAW,EAAE;CACf;AACF;AAaA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,eAAgC,IAAI,kBAA+B;CAEnE,YAAY,QAAmC;EAC7C,KAAK,OAAO,OAAO;EACnB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO;EACrB,KAAK,MAAM,OAAO;EAClB,KAAK,WAAW,OAAO;EACvB,KAAK,SAAS,OAAO,UAAU;EAC/B,KAAK,SAAS,OAAO;EACrB,KAAK,aAAa,OAAO;CAC3B;CAEA,MAAM,mBAAmB,OAAuD;EAC9E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,KAAK,MAAM,cAAc;GAE/B,MAAM,UAAU,MAAM,cAAc,OAAO;IACzC;IAGA,YAAY,MAAM,cAAc;IAChC,MAAM,MAAM,QAAQ;IACpB,MAAM,MAAM,QAAQ;IACpB,SAAS,MAAM;GACjB,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB;GAAE,OAAO,QAAQ;GAAI,MAAM,QAAQ;EAAK,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAY,OAAuD;EAC1F,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACzE,MAAM,UAAU,MAAM,cAAc,OAAO,IAAI;IAC7C,MAAM,MAAM;IACZ,MAAM,MAAM;GACd,CAAC;GACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,gBAAgB,EAAE;GAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAAE,OAAO;IAAI,MAAM;GAAQ,CAAC,CAC1E,CAAC;GACD,OAAO;EACT,CAAC;EAED,KAAK,OAAO,KAAK,wBAAwB,EAAE,WAAW,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAmC;EAC1D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB,EAAE,OAAO,QAAQ,GAAG,CAAC;EAC9D,OAAO;CACT;CAEA,MAAM,WAAW,EAAE,OAAO,QAAQ,QAA2C;EAE3E,IAAI,MADmB,KAAK,KAAK,YAAY,OAAO,MAAM,GAExD,OAAO,KAAK,cAAc,OAAO,QAAQ;GAAE;GAAM,QAAQ;EAAS,CAAC;EAErE,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,cAAc;IAAE;IAAO;IAAM;IAAQ,QAAQ;GAAS,CAAC;GAC3F,MAAM,OAAO,OAAO,CAAC,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC,CAAC;GACrF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,8BAA8B;GAAE;GAAO;GAAQ;EAAK,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,QAAkC;EACnE,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,MAAM;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,QAAQ,KAAK,YAAY,QAAQ,EAAE;GACzC,IAAI,OAAO,QAAQ;IACjB,MAAM,UAAU,MAAM,cAAc,cAAc,OAAO,QAAQ,IAAI,EACnE,MAAM,aACR,CAAC;IACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;IAE9C,IAAI,QAAQ,SAAA,WACV,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KACrC;KACA,MAAM;KACN,UAAU,EAAE,gBAAgB,MAAM,eAAe;IACnD,CAAC,CACH,CAAC;IAEH,OAAO;GACT;GACA,IAAI,QAAQ,SAAA,WACV,OAAO;GAET,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,QAAQ,EAAE;GACvE,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;GAE9C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IACrC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO;GAAQ,WAAW,QAAQ;EAAG,CAAC;EAC7E,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,QAAgB,OAA6C;EAC9F,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,MAAM;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,OAAO,MAAM,cAAc,cAAc,OAAO,QAAQ,IAAI,KAAK;GACvE,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;GAE9C,IAAI,MAAM,SAAS,KAAA,KAAa,MAAM,SAAS,QAAQ,MAAM;IAC3D,MAAM,iBAAiB,KAAK,YAAY,QAAQ,EAAE,CAAC,EAAE;IACrD,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KACrC;KACA,MAAM;KACN,GAAI,mBAAmB,KAAA,KAAa,EAAE,UAAU,EAAE,eAAe,EAAE;IACrE,CAAC,CACH,CAAC;GACH;GACA,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO;GAAQ,WAAW,QAAQ;GAAI;EAAM,CAAC;EACpF,OAAO;CACT;CAEA,MAAM,aAAa,OAAc,OAA2C;EAC1E,MAAM,EAAE,OAAO,OAAO,MAAM,eAAe,WAAW,aAAa;EACnE,KAAK,mBAAmB,OAAO,KAAK;EACpC,KAAK,eAAe,MAAM,KAAK;EAC/B,MAAM,YAAY,MAAM,aAAa;EACrC,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EAMrD,MAAM,SACJ,SAAA,YACM,MAAM,KAAK,OAAO,eAAe,KAAK,KACvC,MAAM,KAAK,OAAO,WAAW;GAC5B;GACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;EAC3C,CAAC,IACD;EAEN,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACrE,MAAM,SAAiC,CAAC;GACxC,IAAI,QAAQ;IACV,MAAM,UAAU,MAAM,cAAc,cAAc;KAChD;KACA,QAAQ,OAAO;KACf,MAAM;KACN,QAAQ;IACV,CAAC;IACD,OAAO,KAAK,mBAAmB,eAAe,KAAK;KAAE;KAAO,MAAM;IAAQ,CAAC,CAAC;GAC9E;GACA,MAAM,MAAM,MAAM,cAAc,oBAAoB,OAAO;IACzD;IACA;IACA,WAAW;IACX;IACA;GACF,CAAC;GACD,OAAO,KAAK,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAI,CAAC,CAAC;GACvE,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EAED,IAAI,WAEF,IAAI;GACF,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EAC1C,SAAS,KAAK;GAGZ,KAAK,OAAO,MAAM,+BAA+B;IAC/C;IACA,UAAU,OAAO;IACjB,MAAM,OAAO;IACb,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;GACzD,CAAC;EACH;EAGF,KAAK,OAAO,KAAK,kBAAkB;GAAE;GAAO,UAAU,OAAO;GAAI;GAAM;EAAU,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,oBAAoB,OAAc,OAAgD;EACtF,MAAM,EAAE,OAAO,WAAW,kBAAkB;EAC5C,KAAK,mBAAmB,OAAO,KAAK;EACpC,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,IAAI,QAAQ,WAAW,UACrB,MAAM,IAAI,sBAAsB,oDAAoD;EAEtF,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAEhD,MAAM,UAAU,MAAM,KAAK,KAAK,kBAAkB,OAAO,OAAO,KAAK;EACrE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,OAAO,KAAK;EAEhD,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EACrD,MAAM,SAAS,MAAM,KAAK,KAAK,eAAe,OAAO,QAAQ,IAAI,WAAW,SAAS;EACrF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;EAE9C,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EACxC,KAAK,OAAO,KAAK,yBAAyB;GACxC;GACA;GACA,UAAU,OAAO;GACjB;EACF,CAAC;CACH;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,SAAS,MAAM,KAAK,KAAK,sBAAsB,gBAAgB,KAAK,CAAC;EAC3E,IAAI,CAAC,UAAU,OAAO,WAAW,WAC/B,OAAO;EAET,IAAI,OAAO,aAAa,OAAO,4BAAY,IAAI,KAAK,GAClD,OAAO;EAET,OAAO;CACT;CAEA,MAAM,aAAa,OAA4C;EAC7D,MAAM,SAAS,MAAM,KAAK,WAAW,MAAM,KAAK;EAChD,IAAI,CAAC,QAAQ;GACX,KAAK,OAAO,KAAK,iDAAiD;GAClE,MAAM,IAAI,YAAY,gBAAgB;EACxC;EACA,IAAI,OAAO,MAAM,YAAY,MAAM,MAAM,MAAM,YAAY,GAAG;GAC5D,KAAK,OAAO,KAAK,yCAAyC;IACxD,OAAO,OAAO;IACd,UAAU,OAAO;GACnB,CAAC;GACD,MAAM,IAAI,YAAY,mBAAmB;EAC3C;EACA,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,OAAO,KAAK;EACjD,IAAI,CAAC,KACH,MAAM,IAAI,YAAY,eAAe;EAGvC,MAAM,UACJ,OAAO,SAAA,YACH,MAAM,KAAK,oBAAoB,QAAQ,MAAM,MAAM,IACnD,MAAM,KAAK,kBAAkB,QAAQ,KAAK,MAAM,MAAM;EAC5D,KAAK,OAAO,KAAK,mBAAmB;GAAE,OAAO,OAAO;GAAO,QAAQ,MAAM;EAAO,CAAC;EACjF,OAAO;CACT;CAEA,MAAc,oBAAoB,QAAgB,QAAkC;EAClF,OAAO,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACvD,MAAM,WAAW,MAAM,cAAc,YAAY,OAAO,OAAO,MAAM;GACrE,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,YAAY,MAAM,cAAc,cAAc,OAAO,OAAO,SAAS,IAAI,EAC7E,QAAQ,SACV,CAAC;GACD,IAAI,CAAC,WACH,MAAM,IAAI,cAAc,UAAU,SAAS,EAAE;GAE/C,MAAM,iBAAiB,MAAM,cAAc,gBACzC,OAAO,OACP,OAAO,IACP,UACF;GACA,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAe,CAAC,GACpF,mBAAmB,cAAc,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAU,CAAC,CAChF,CAAC;GACD,OAAO;EACT,CAAC;CACH;CAEA,MAAc,kBACZ,QACA,KACA,QACkB;EAClB,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,MAAM;EACnD,IAAI,CAAC,QAAQ,YACX,MAAM,IAAI,cAAc,QAAQ,MAAM;EAExC,MAAM,KAAK,SAAS,CAAC,CAAC,gBAAgB,IAAI,cAAc,IAAI,IAAI,OAAO,YAAY,OAAO,IAAI;EAC9F,OAAO,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACvD,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,OAAO,MAAM;GACpE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,iBAAiB,MAAM,cAAc,gBACzC,OAAO,OACP,OAAO,IACP,UACF;GACA,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAe,CAAC,CACtF,CAAC;GACD,OAAO;EACT,CAAC;CACH;CAKA,eAAe,OAAe,IAAqC;EACjE,OAAO,KAAK,KAAK,gBAAgB,OAAO,EAAE;CAC5C;CAEA,MAAM,iBAAiB,OAAe,KAAmC;EACvE,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;EAC/B,OAAO,OAAO,SAAS,IAAI,KAAK,KAAK,kBAAkB,OAAO,MAAM,IAAI,CAAC;CAC3E;CAEA,MAAM,WAAW,OAAe,QAAyC;EACvE,OAAO,KAAK,KAAK,YAAY,OAAO,MAAM;CAC5C;CAEA,MAAM,cAAc,OAAe,OAAc,IAA8B;EAC7E,KAAK,mBAAmB,OAAO,KAAK;EACpC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,gBAAgB,OAAO,EAAE;GAC7D,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,EAAE;GAC/D,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,OAAO,OAAO,CAAC,mBAAmB,eAAe,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC,CAAC;GACtF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO,WAAW;EAAG,CAAC;EAC7D,OAAO;CACT;CAEA,MAAM,mBAAmB,QAAoC;EAC3D,OAAO,KAAK,KAAK,mBAAmB,MAAM;CAC5C;CAEA,MAAM,QAAQ,IAA0C;EACtD,OAAO,KAAK,KAAK,SAAS,EAAE;CAC9B;CAEA,SAA4B;EAC1B,OAAO,KAAK,KAAK,QAAQ;CAC3B;CAEA,MAAc,gBAAgB,QAAgB,OAA8B;EAC1E,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,YACxB,MAAM,IAAI,MAAM,kEAAkE;EAEpF,MAAM,EAAE,OAAO,SAAS;EACxB,MAAM,YAAY,SAAS;EAS3B,MAAM,YAAY,GARL,YACT,GAAG,KAAK,WAAW,iBAAiB,YACpC,GAAG,KAAK,WAAW,YAAY,SAMT,IAHZ,YACV,IAAI,gBAAgB,EAAE,MAAM,CAAC,IAC7B,IAAI,gBAAgB;GAAE;GAAO;EAAM,CAAC,EAAA,CACL,SAAS;EAC5C,IAAI,SAAA,WACF,MAAM,KAAK,OAAO,KAAK,OAAO,iBAAiB;GAAE;GAAW,aAAa;EAAM,CAAC;OAEhF,MAAM,KAAK,OAAO,KAAK,OAAO,gBAAgB;GAC5C;GACA,aAAa;GACb;EACF,CAAC;CAEL;CAEA,MAAM,gBAAgB,YAAkD;EACtE,OAAO,KAAK,KAAK,iBAAiB,UAAU;CAC9C;CAEA,MAAM,UAAU,MAA4C;EAC1D,OAAO,KAAK,KAAK,WAAW,IAAI;CAClC;CAEA,gBAAgB,OAAkC;EAChD,OAAO,KAAK,KAAK,qBAAqB,OAAO,CAAC,GAAG,WAAW,CAAC;CAC/D;CAEA,YAAY,OAAe,OAA4C;EACrE,OAAO,KAAK,YAAY,KAAK,OAAO,KAAK;CAC3C;CAEA,MAAM,iBACJ,KACA,OACA,IACA,MACkC;EAClC,KAAK,mBAAmB,OAAO,IAAI,KAAK;EACxC,KAAK,eAAe,MAAM,IAAI,KAAK;EACnC,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO,KAAK,eAAe,KAAK,OAAO,IAAI,IAAI;EAEjD,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,qCAAqC;EACvE;EACA,IAAI,OAAO,SAAS,YAAY,CAAC,OAAO,gBAAgB;GACtD,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iDAAiD;EACnF;EACA,IAAI,SAAA,WACF,OAAO,KAAK,gBAAgB,KAAK,OAAO,QAAQ,OAAO,cAAc;EAEvE,MAAM,iBAAiB,OAAO;EAC9B,MAAM,KAAK,QAAQ,OAAO,IAAI,aAC5B,KAAK,SAAS,CAAC,CAAC,WAAW,KAAK,gBAAgB,IAAI,CACtD;EACA,MAAM,UAAU,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC7D,KAAK,OAAO,KAAK,uBAAuB;GAAE,OAAO,IAAI;GAAO,UAAU;GAAI;EAAK,CAAC;EAChF,OAAO,UAAU,SAAS,OAAO,IAAI;CACvC;CAEA,MAAc,gBACZ,KACA,OACA,QACA,gBACkC;EAClC,IAAI,OAAO,SAAS,aAAa;GAC/B,KAAK,OAAO,KAAK,4DAA4D;IAC3E,OAAO,IAAI;IACX,UAAU,OAAO;GACnB,CAAC;GACD,MAAM,IAAI,sBAAsB,wCAAwC;EAC1E;EACA,MAAM,KAAK,QAAQ,OAAO,OAAO,IAAI,YACnC,KAAK,SAAS,CAAC,CAAC,aAAa,KAAK,cAAc,CAClD;EACA,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,IAAI,OAAO,OAAO,EAAE;EACpE,IAAI,CAAC,SACH,OAAO;EAET,KAAK,OAAO,KAAK,4BAA4B;GAAE,OAAO,IAAI;GAAO,UAAU,OAAO;EAAG,CAAC;EACtF,OAAO;GAAE,GAAG,SAAS,MAAM;GAAG,MAAM,QAAQ;GAAM,QAAQ,QAAQ;EAAO;CAC3E;CAEA,MAAc,eACZ,KACA,OACA,IACA,MACkC;EAClC,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,IAAI,OAAO,EAAE;EAC7D,IAAI,CAAC,SACH,OAAO;EAET,IAAI,QAAQ,SAAA,aAAyB,SAAA,WAAuB;GAC1D,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iDAAiD;EACnF;EACA,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QAAQ,YAAY;GACvB,KAAK,OAAO,KAAK,gDAAgD;IAC/D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iCAAiC;EACnE;EACA,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,IAAI,KAAK;EAC9C,IAAI,CAAC,KACH,OAAO;EAET,MAAM,gBAAgB,IAAI,cAAc,IAAI;EAC5C,MAAM,iBAAiB,OAAO;EAC9B,MAAM,KAAK,QAAQ,OAAO,QAAQ,IAAI,OAAO,YAAY;GACvD,MAAM,KAAK,SAAS,CAAC,CAAC,gBAAgB,eAAe,gBAAgB,IAAI;GACzE,IAAI,CAAE,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE,GACjD,MAAM,KAAK,SAAS,CAAC,CAAC,WAAW,KAAK,gBAAgB,IAAI;EAE9D,CAAC;EACD,MAAM,UAAU,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC7D,IAAI,CAAC,SAAS;GACZ,KAAK,OAAO,KAAK,iDAAiD;IAChE,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,qCAAqC;EACvE;EACA,KAAK,OAAO,KAAK,oBAAoB;GAAE,OAAO,IAAI;GAAO,UAAU;GAAI;EAAK,CAAC;EAC7E,OAAO,SAAS,OAAO;CACzB;CAEA,QACE,OACA,WACA,QACA,OACY;EACZ,OAAO,KAAK,aAAa,IAAI;GAAE;GAAW,gBAAgB,MAAM;GAAI;EAAO,GAAG,KAAK;CACrF;CAEA,YAAoB,WAA4C;EAC9D,MAAM,QAAQ,KAAK,aAAa,SAAS;EACzC,OAAO,OAAO,cAAc,YAAY,QAAQ,KAAA;CAClD;CAEA,mBAA2B,OAAc,OAAqB;EAC5D,IAAI,WAAW,MAAM,MAAM,cAAc,MAAM,MAAM;GACnD,KAAK,OAAO,KAAK,oDAAoD;IACnE;IACA,gBAAgB,MAAM;GACxB,CAAC;GACD,MAAM,IAAI,eAAe,2CAA2C;EACtE;CACF;CAEA,eAAuB,MAAY,OAAqB;EACtD,IAAI,SAAS,SAAS;GACpB,KAAK,OAAO,KAAK,kDAAkD,EAAE,MAAM,CAAC;GAC5E,MAAM,IAAI,sBAAsB,6BAA6B;EAC/D;CACF;CAEA,MAAM,aAAa,KAAyB,OAAc,IAA8B;EACtF,KAAK,mBAAmB,OAAO,IAAI,KAAK;EACxC,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO;EAET,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,oDAAoD;IACnE,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,6BAA6B;EAC/D;EACA,IAAI,OAAO,SAAS,YAAY,OAAO,gBACrC,MAAM,KAAK,SAAS,CAAC,CAAC,aAAa,KAAK,OAAO,cAAc;OACxD,IAAI,OAAO,SAAS,YAAY,OAAO,UAAU;GACtD,MAAM,WAAW,OAAO;GACxB,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;IACtD,MAAM,WAAW,MAAM,cAAc,gBAAgB,IAAI,OAAO,UAAU,UAAU;IACpF,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,UAAU,QAAQ;IAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KAAE,OAAO,IAAI;KAAO,MAAM;IAAS,CAAC,CAC7E,CAAC;GACH,CAAC;EACH;EACA,KAAK,OAAO,KAAK,kBAAkB;GAAE,OAAO,IAAI;GAAO,UAAU;EAAG,CAAC;EACrE,OAAO;CACT;AACF"}

package/dist/organizations/types.d.ts

@@ -20,20 +20,11 @@ interface UnlinkOrgUserInput {
   orgExternalId: string;
   userExternalId: string;
 }
-interface UpdatePersonInput {
-  firstName?: string;
-  lastName?: string;
-  email?: string;
-}
-interface UpdateStudentInput extends UpdatePersonInput {
-  orgId: string;
-  orgUserId: string;
-}
 interface ResendStudentInviteInput {
   orgId: string;
   orgUserId: string;
   inviterUserId: string;
 }
 //#endregion
-export { type AcceptInviteInput, type AddOrgUserInput, type CreateInviteInput, type CreateOrgUserInput, CreateOrganizationInput, type InviteId, type InviteRole, LinkOrgUserInput, type NewOrganizationInput, type OrgUserId, type OrgUserStatus, type OrganizationId, type ProvisionUserInput, ResendStudentInviteInput, UnlinkOrgUserInput, type UpdateOrgUserInput, UpdateOrganizationInput, UpdatePersonInput, UpdateStudentInput };
+export { type AcceptInviteInput, type AddOrgUserInput, type CreateInviteInput, type CreateOrgUserInput, CreateOrganizationInput, type InviteId, type InviteRole, LinkOrgUserInput, type NewOrganizationInput, type OrgUserId, type OrgUserStatus, type OrganizationId, type ProvisionUserInput, ResendStudentInviteInput, UnlinkOrgUserInput, type UpdateOrgUserInput, UpdateOrganizationInput };
 //# sourceMappingURL=types.d.ts.map

package/dist/progress/events.d.ts

@@ -7,7 +7,7 @@ declare const progressEvents: {
     id: string;
     orgId: string;
     orgUserId: string;
-    targetType: "course" | "activity" | "module";
+    targetType: "activity" | "module" | "course";
     targetId: string;
     startedAt: Date;
     position: JsonValue;
@@ -18,7 +18,7 @@ declare const progressEvents: {
     id: string;
     orgId: string;
     orgUserId: string;
-    targetType: "course" | "activity" | "module";
+    targetType: "activity" | "module" | "course";
     targetId: string;
     startedAt: unknown;
     position: unknown;
@@ -26,25 +26,25 @@ declare const progressEvents: {
     createdAt: unknown;
     updatedAt: unknown;
   }, import("zod").ZodObject<{
-    orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
-    startedAt: import("zod").ZodCoercedDate<unknown>;
+    orgId: import("zod").ZodString;
     orgUserId: import("zod").ZodString;
     targetType: import("zod").ZodEnum<{
-      course: "course";
       activity: "activity";
       module: "module";
+      course: "course";
     }>;
     targetId: import("zod").ZodString;
+    startedAt: import("zod").ZodCoercedDate<unknown>;
     completedAt: import("zod").ZodNullable<import("zod").ZodCoercedDate<unknown>>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
   }, import("zod/v4/core").$strip>>;
   progressCompleted: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
     orgId: string;
     orgUserId: string;
-    targetType: "course" | "activity" | "module";
+    targetType: "activity" | "module" | "course";
     targetId: string;
     startedAt: Date;
     position: JsonValue;
@@ -55,7 +55,7 @@ declare const progressEvents: {
     id: string;
     orgId: string;
     orgUserId: string;
-    targetType: "course" | "activity" | "module";
+    targetType: "activity" | "module" | "course";
     targetId: string;
     startedAt: unknown;
     position: unknown;
@@ -63,19 +63,19 @@ declare const progressEvents: {
     createdAt: unknown;
     updatedAt: unknown;
   }, import("zod").ZodObject<{
-    orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
-    startedAt: import("zod").ZodCoercedDate<unknown>;
+    orgId: import("zod").ZodString;
     orgUserId: import("zod").ZodString;
     targetType: import("zod").ZodEnum<{
-      course: "course";
       activity: "activity";
       module: "module";
+      course: "course";
     }>;
     targetId: import("zod").ZodString;
+    startedAt: import("zod").ZodCoercedDate<unknown>;
     completedAt: import("zod").ZodNullable<import("zod").ZodCoercedDate<unknown>>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
   }, import("zod/v4/core").$strip>>;
 };
 type ProgressStarted = EventOf<typeof progressEvents.progressStarted>;

package/dist/progress/index.d.ts

@@ -3,6 +3,6 @@ import { ProgressId } from "../types/progress.js";
 import { ProgressCompleted, ProgressEvent, ProgressStarted, progressEvents } from "./events.js";
 import "./model.js";
 import "./types.js";
-import { ProgressRepository, ProgressService, ProgressUnitOfWork } from "./ports.js";
+import { ContentAccessReader, ProgressRepository, ProgressService, ProgressUnitOfWork } from "./ports.js";
 import { ProgressServiceImpl } from "./service.js";
-export { type ProgressCompleted, type ProgressEvent, type ProgressId, type ProgressRecord, type ProgressReportItem, type ProgressRepository, type ProgressService, ProgressServiceImpl, type ProgressStarted, type ProgressTarget, type ProgressTargetType, type ProgressUnitOfWork, type ReportProgressInput, progressEvents };
+export { type ContentAccessReader, type ProgressCompleted, type ProgressEvent, type ProgressId, type ProgressRecord, type ProgressReportItem, type ProgressRepository, type ProgressService, ProgressServiceImpl, type ProgressStarted, type ProgressTarget, type ProgressTargetType, type ProgressUnitOfWork, type ReportProgressInput, progressEvents };

package/dist/progress/ports.d.ts

@@ -25,6 +25,11 @@ interface ProgressRepository {
   }): Promise<ProgressRecord[]>;
   update(orgId: string, id: string, patch: Partial<Pick<ProgressRecord, 'position' | 'completedAt'>>): Promise<ProgressRecord | null>;
 }
+/** Access is resolved by entitlements — a report is only taken from a student
+ *  who can open the course. */
+interface ContentAccessReader {
+  hasAccess(orgId: string, orgUserId: string, contentId: string): Promise<boolean>;
+}
 /** Writes that emit events run through this scope so row + outbox entry commit
  *  in one transaction. */
 interface ProgressWriteScope {
@@ -33,5 +38,5 @@ interface ProgressWriteScope {
 }
 type ProgressUnitOfWork = UnitOfWork<ProgressWriteScope>;
 //#endregion
-export { ProgressRepository, ProgressService, ProgressUnitOfWork, ProgressWriteScope };
+export { ContentAccessReader, ProgressRepository, ProgressService, ProgressUnitOfWork, ProgressWriteScope };
 //# sourceMappingURL=ports.d.ts.map

package/dist/progress/service.d.ts

@@ -5,17 +5,19 @@ import { CourseManagementService } from "../content/ports.js";
 import "../content/index.js";
 import "./model.js";
 import "./types.js";
-import { ProgressRepository, ProgressService, ProgressUnitOfWork } from "./ports.js";
+import { ContentAccessReader, ProgressRepository, ProgressService, ProgressUnitOfWork } from "./ports.js";
 //#region src/progress/service.d.ts
 type ProgressServiceParams = {
   repo: ProgressRepository;
   content: CourseManagementService;
+  access: ContentAccessReader;
   uow: ProgressUnitOfWork;
   logger?: Logger;
 };
 declare class ProgressServiceImpl implements ProgressService {
   private readonly repo;
   private readonly content;
+  private readonly access;
   private readonly uow;
   private readonly logger;
   constructor(params: ProgressServiceParams);

package/dist/progress/service.js

@@ -1,9 +1,9 @@
-import { noopLogger } from "../shared/logger.js";
 import { genId } from "../shared/id.js";
 import { NotFoundError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
 import { progressEvents } from "./events.js";
 //#region src/progress/service.ts
-/** Mirrors reporting/learn: `settings.published === false` is the only draft signal. */
+/** Mirrors reporting/member: `settings.published === false` is the only draft signal. */
 function isActivityPublished(settings) {
 	return settings?.published !== false;
 }
@@ -39,11 +39,13 @@ function completionSatisfied(settings, claimed) {
 var ProgressServiceImpl = class {
 	repo;
 	content;
+	access;
 	uow;
 	logger;
 	constructor(params) {
 		this.repo = params.repo;
 		this.content = params.content;
+		this.access = params.access;
 		this.uow = params.uow;
 		this.logger = params.logger ?? noopLogger;
 	}
@@ -51,6 +53,8 @@ var ProgressServiceImpl = class {
 		const activity = await this.content.getActivity(orgId, input.activityId);
 		if (!activity || !isActivityPublished(activity.settings)) throw new NotFoundError("Activity", input.activityId);
 		const courseId = activity.courseId;
+		const course = await this.content.getCourse(orgId, courseId);
+		if (!course || course.status !== "published" || !await this.access.hasAccess(orgId, input.orgUserId, courseId)) throw new NotFoundError("Activity", input.activityId);
 		const modules = await this.content.listCourseModules(orgId, courseId);
 		const courseActivities = await this.content.listCourseActivities(orgId, courseId);
 		return this.uow.run(async (scope) => {

package/dist/progress/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../src/progress/service.ts"],"sourcesContent":["// progress context — service implementation (inbound port).\n// The frontend only reports usage; this service makes every completion\n// decision. One report batch runs in one UoW transaction: ensure the record,\n// merge item payloads into the per-subject state map, evaluate the activity's\n// completion rule, then module/course against current published structure —\n// appending events with the writes. The container is resolved from the\n// hierarchy (activity → module → course), never supplied by the caller.\n// Percentage/resume are derived by readers, never stored here.\nimport { genId } from '../shared/id.js';\nimport { NotFoundError } from '../shared/errors.js';\nimport type { ProgressRecord } from './model.js';\nimport type {\n  ProgressRepository,\n  ProgressService,\n  ProgressUnitOfWork,\n  ProgressWriteScope,\n} from './ports.js';\nimport type { ProgressReportItem, ProgressTarget, ReportProgressInput } from './types.js';\nimport { progressEvents, type NewProgressEvent } from './events.js';\nimport type { Activity, CourseManagementService, Module } from '../content/index.js';\nimport type { JsonValue } from '../types/index.js';\nimport type { Logger } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\n\n/** Mirrors reporting/learn: `settings.published === false` is the only draft signal. */\nfunction isActivityPublished(settings: unknown): boolean {\n  return (settings as { published?: boolean } | null)?.published !== false;\n}\n\n/** Fold a report batch into the record's per-subject state map. Reserved keys\n *  (`asset` = subject, `completed` = claim) are stripped; the rest is the asset\n *  type's own vocabulary, stored opaquely — latest report per subject wins. */\nfunction mergeReports(\n  position: unknown,\n  items: ProgressReportItem[],\n): { map: Record<string, JsonValue>; changed: boolean; claimed: boolean } {\n  const map = { ...((position as Record<string, JsonValue> | null) ?? {}) };\n  let changed = false;\n  let claimed = false;\n  for (const item of items) {\n    const { asset, completed, ...payload } = item;\n    if (completed === true) {\n      claimed = true;\n    }\n    if (Object.keys(payload).length > 0) {\n      map[asset ?? 'self'] = payload;\n      changed = true;\n    }\n  }\n  return { map, changed, claimed };\n}\n\n/** The completion-rule seam. Only `manual` ships: no authored rule → the\n *  learner's claim decides. Authored rules are never satisfied until their\n *  evaluators exist. Future rules evaluate against the accumulated state map. */\nfunction completionSatisfied(settings: unknown, claimed: boolean): boolean {\n  const rule = (settings as { completion?: { rule?: string } } | null)?.completion?.rule;\n  if (!rule || rule === 'manual') {\n    return claimed;\n  }\n  return false;\n}\n\nexport type ProgressServiceParams = {\n  repo: ProgressRepository;\n  content: CourseManagementService;\n  uow: ProgressUnitOfWork;\n  logger?: Logger;\n};\n\nexport class ProgressServiceImpl implements ProgressService {\n  private readonly repo: ProgressRepository;\n  private readonly content: CourseManagementService;\n  private readonly uow: ProgressUnitOfWork;\n  private readonly logger: Logger;\n\n  constructor(params: ProgressServiceParams) {\n    this.repo = params.repo;\n    this.content = params.content;\n    this.uow = params.uow;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  async report(orgId: string, input: ReportProgressInput): Promise<ProgressRecord> {\n    const activity = await this.content.getActivity(orgId, input.activityId);\n    if (!activity || !isActivityPublished(activity.settings)) {\n      throw new NotFoundError('Activity', input.activityId);\n    }\n    const courseId = activity.courseId;\n    const modules = await this.content.listCourseModules(orgId, courseId);\n    const courseActivities = await this.content.listCourseActivities(orgId, courseId);\n    return this.uow.run(async (scope) => {\n      // Serializes concurrent reports for this student+course (locks are tx-scoped;\n      // both racers lock in the same order, the loser waits and then sees committed state).\n      const lockIds = [\n        ...courseActivities.filter((a) => isActivityPublished(a.settings)).map((a) => a.id),\n        ...modules.map((m) => m.id),\n        courseId,\n      ];\n      await scope.progress.findByTargets(orgId, input.orgUserId, lockIds, { forUpdate: true });\n      const events: NewProgressEvent[] = [];\n      let record = await this.ensureActivityRecord(orgId, input, scope, events);\n      const state = mergeReports(record.position, input.reports);\n      if (state.changed) {\n        record = (await scope.progress.update(orgId, record.id, { position: state.map })) ?? record;\n      }\n      if (!record.completedAt && completionSatisfied(activity.settings, state.claimed)) {\n        record =\n          (await scope.progress.update(orgId, record.id, {\n            completedAt: new Date(),\n          })) ?? record;\n        events.push(progressEvents.progressCompleted.make({ orgId, data: record }));\n        await this.completeContainers(\n          orgId,\n          input,\n          courseId,\n          modules,\n          courseActivities,\n          scope,\n          events,\n        );\n        this.logger.info('progress completed', { orgId, recordId: record.id });\n      }\n      if (events.length > 0) {\n        await scope.outbox.append(events);\n      }\n      return record;\n    });\n  }\n\n  private async ensureActivityRecord(\n    orgId: string,\n    input: ReportProgressInput,\n    scope: ProgressWriteScope,\n    events: NewProgressEvent[],\n  ): Promise<ProgressRecord> {\n    const target: ProgressTarget = {\n      orgUserId: input.orgUserId,\n      targetType: 'activity',\n      targetId: input.activityId,\n    };\n    const existing = await scope.progress.findByTarget(orgId, target);\n    if (existing) {\n      return existing;\n    }\n    const now = new Date();\n    const record = await scope.progress.insert(orgId, {\n      id: genId('progress'),\n      orgId,\n      orgUserId: input.orgUserId,\n      targetType: 'activity',\n      targetId: input.activityId,\n      startedAt: now,\n      position: null,\n      completedAt: null,\n      createdAt: now,\n      updatedAt: now,\n    });\n    if (!record) {\n      // Lost a concurrent first-touch insert: the winner owns the row and emitted\n      // progress.started. Return its row without re-emitting.\n      const winner = await scope.progress.findByTarget(orgId, target);\n      if (!winner) {\n        throw new Error('progress record vanished after insert conflict');\n      }\n      return winner;\n    }\n    events.push(progressEvents.progressStarted.make({ orgId, data: record }));\n    this.logger.info('progress started', { orgId, recordId: record.id });\n    return record;\n  }\n\n  /** After an activity completes: newly-complete containers get their records\n   *  (created complete) and a progress.completed event — same transaction. */\n  private async completeContainers(\n    orgId: string,\n    input: ReportProgressInput,\n    courseId: string,\n    modules: Module[],\n    courseActivities: Activity[],\n    scope: ProgressWriteScope,\n    events: NewProgressEvent[],\n  ): Promise<void> {\n    const published = courseActivities.filter((a) => isActivityPublished(a.settings));\n    const byModule = modules.map((m) => ({\n      id: m.id,\n      activityIds: published.filter((a) => a.moduleId === m.id).map((a) => a.id),\n    }));\n    const allIds = byModule.flatMap((m) => m.activityIds);\n    const records = await scope.progress.findByTargets(orgId, input.orgUserId, allIds);\n    const done = new Set(\n      records.filter((r) => r.targetType === 'activity' && r.completedAt).map((r) => r.targetId),\n    );\n    const containing = byModule.find((m) => m.activityIds.includes(input.activityId));\n    if (containing && containing.activityIds.every((id) => done.has(id))) {\n      await this.ensureContainerComplete(orgId, input, 'module', containing.id, scope, events);\n    }\n    if (allIds.length > 0 && allIds.every((id) => done.has(id))) {\n      await this.ensureContainerComplete(orgId, input, 'course', courseId, scope, events);\n    }\n  }\n\n  private async ensureContainerComplete(\n    orgId: string,\n    input: ReportProgressInput,\n    targetType: 'module' | 'course',\n    targetId: string,\n    scope: ProgressWriteScope,\n    events: NewProgressEvent[],\n  ): Promise<void> {\n    const target: ProgressTarget = { orgUserId: input.orgUserId, targetType, targetId };\n    let existing = await scope.progress.findByTarget(orgId, target);\n    if (existing?.completedAt) {\n      return;\n    }\n    if (!existing) {\n      const now = new Date();\n      const inserted = await scope.progress.insert(orgId, {\n        id: genId('progress'),\n        orgId,\n        orgUserId: input.orgUserId,\n        targetType,\n        targetId,\n        startedAt: now,\n        position: null,\n        completedAt: now,\n        createdAt: now,\n        updatedAt: now,\n      });\n      if (inserted) {\n        events.push(progressEvents.progressCompleted.make({ orgId, data: inserted }));\n        return;\n      }\n      // Lost a concurrent insert: re-read the winner's row.\n      existing = await scope.progress.findByTarget(orgId, target);\n      if (existing?.completedAt) {\n        return;\n      }\n      if (!existing) {\n        throw new Error('progress container record vanished after insert conflict');\n      }\n    }\n    const record =\n      (await scope.progress.update(orgId, existing.id, {\n        completedAt: new Date(),\n      })) ?? existing;\n    events.push(progressEvents.progressCompleted.make({ orgId, data: record }));\n  }\n\n  get(orgId: string, target: ProgressTarget): Promise<ProgressRecord | null> {\n    return this.repo.findByTarget(orgId, target);\n  }\n\n  listByTargets(orgId: string, orgUserId: string, targetIds: string[]): Promise<ProgressRecord[]> {\n    return this.repo.findByTargets(orgId, orgUserId, targetIds);\n  }\n}\n"],"mappings":";;;;;;AAyBA,SAAS,oBAAoB,UAA4B;CACvD,OAAQ,UAA6C,cAAc;AACrE;;;;AAKA,SAAS,aACP,UACA,OACwE;CACxE,MAAM,MAAM,EAAE,GAAK,YAAiD,CAAC,EAAG;CACxE,IAAI,UAAU;CACd,IAAI,UAAU;CACd,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,EAAE,OAAO,WAAW,GAAG,YAAY;EACzC,IAAI,cAAc,MAChB,UAAU;EAEZ,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,GAAG;GACnC,IAAI,SAAS,UAAU;GACvB,UAAU;EACZ;CACF;CACA,OAAO;EAAE;EAAK;EAAS;CAAQ;AACjC;;;;AAKA,SAAS,oBAAoB,UAAmB,SAA2B;CACzE,MAAM,OAAQ,UAAwD,YAAY;CAClF,IAAI,CAAC,QAAQ,SAAS,UACpB,OAAO;CAET,OAAO;AACT;AASA,IAAa,sBAAb,MAA4D;CAC1D;CACA;CACA;CACA;CAEA,YAAY,QAA+B;EACzC,KAAK,OAAO,OAAO;EACnB,KAAK,UAAU,OAAO;EACtB,KAAK,MAAM,OAAO;EAClB,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,MAAM,OAAO,OAAe,OAAqD;EAC/E,MAAM,WAAW,MAAM,KAAK,QAAQ,YAAY,OAAO,MAAM,UAAU;EACvE,IAAI,CAAC,YAAY,CAAC,oBAAoB,SAAS,QAAQ,GACrD,MAAM,IAAI,cAAc,YAAY,MAAM,UAAU;EAEtD,MAAM,WAAW,SAAS;EAC1B,MAAM,UAAU,MAAM,KAAK,QAAQ,kBAAkB,OAAO,QAAQ;EACpE,MAAM,mBAAmB,MAAM,KAAK,QAAQ,qBAAqB,OAAO,QAAQ;EAChF,OAAO,KAAK,IAAI,IAAI,OAAO,UAAU;GAGnC,MAAM,UAAU;IACd,GAAG,iBAAiB,QAAQ,MAAM,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE;IAClF,GAAG,QAAQ,KAAK,MAAM,EAAE,EAAE;IAC1B;GACF;GACA,MAAM,MAAM,SAAS,cAAc,OAAO,MAAM,WAAW,SAAS,EAAE,WAAW,KAAK,CAAC;GACvF,MAAM,SAA6B,CAAC;GACpC,IAAI,SAAS,MAAM,KAAK,qBAAqB,OAAO,OAAO,OAAO,MAAM;GACxE,MAAM,QAAQ,aAAa,OAAO,UAAU,MAAM,OAAO;GACzD,IAAI,MAAM,SACR,SAAU,MAAM,MAAM,SAAS,OAAO,OAAO,OAAO,IAAI,EAAE,UAAU,MAAM,IAAI,CAAC,KAAM;GAEvF,IAAI,CAAC,OAAO,eAAe,oBAAoB,SAAS,UAAU,MAAM,OAAO,GAAG;IAChF,SACG,MAAM,MAAM,SAAS,OAAO,OAAO,OAAO,IAAI,EAC7C,6BAAa,IAAI,KAAK,EACxB,CAAC,KAAM;IACT,OAAO,KAAK,eAAe,kBAAkB,KAAK;KAAE;KAAO,MAAM;IAAO,CAAC,CAAC;IAC1E,MAAM,KAAK,mBACT,OACA,OACA,UACA,SACA,kBACA,OACA,MACF;IACA,KAAK,OAAO,KAAK,sBAAsB;KAAE;KAAO,UAAU,OAAO;IAAG,CAAC;GACvE;GACA,IAAI,OAAO,SAAS,GAClB,MAAM,MAAM,OAAO,OAAO,MAAM;GAElC,OAAO;EACT,CAAC;CACH;CAEA,MAAc,qBACZ,OACA,OACA,OACA,QACyB;EACzB,MAAM,SAAyB;GAC7B,WAAW,MAAM;GACjB,YAAY;GACZ,UAAU,MAAM;EAClB;EACA,MAAM,WAAW,MAAM,MAAM,SAAS,aAAa,OAAO,MAAM;EAChE,IAAI,UACF,OAAO;EAET,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,SAAS,MAAM,MAAM,SAAS,OAAO,OAAO;GAChD,IAAI,MAAM,UAAU;GACpB;GACA,WAAW,MAAM;GACjB,YAAY;GACZ,UAAU,MAAM;GAChB,WAAW;GACX,UAAU;GACV,aAAa;GACb,WAAW;GACX,WAAW;EACb,CAAC;EACD,IAAI,CAAC,QAAQ;GAGX,MAAM,SAAS,MAAM,MAAM,SAAS,aAAa,OAAO,MAAM;GAC9D,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,gDAAgD;GAElE,OAAO;EACT;EACA,OAAO,KAAK,eAAe,gBAAgB,KAAK;GAAE;GAAO,MAAM;EAAO,CAAC,CAAC;EACxE,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO,UAAU,OAAO;EAAG,CAAC;EACnE,OAAO;CACT;;;CAIA,MAAc,mBACZ,OACA,OACA,UACA,SACA,kBACA,OACA,QACe;EACf,MAAM,YAAY,iBAAiB,QAAQ,MAAM,oBAAoB,EAAE,QAAQ,CAAC;EAChF,MAAM,WAAW,QAAQ,KAAK,OAAO;GACnC,IAAI,EAAE;GACN,aAAa,UAAU,QAAQ,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE;EAC3E,EAAE;EACF,MAAM,SAAS,SAAS,SAAS,MAAM,EAAE,WAAW;EACpD,MAAM,UAAU,MAAM,MAAM,SAAS,cAAc,OAAO,MAAM,WAAW,MAAM;EACjF,MAAM,OAAO,IAAI,IACf,QAAQ,QAAQ,MAAM,EAAE,eAAe,cAAc,EAAE,WAAW,CAAC,CAAC,KAAK,MAAM,EAAE,QAAQ,CAC3F;EACA,MAAM,aAAa,SAAS,MAAM,MAAM,EAAE,YAAY,SAAS,MAAM,UAAU,CAAC;EAChF,IAAI,cAAc,WAAW,YAAY,OAAO,OAAO,KAAK,IAAI,EAAE,CAAC,GACjE,MAAM,KAAK,wBAAwB,OAAO,OAAO,UAAU,WAAW,IAAI,OAAO,MAAM;EAEzF,IAAI,OAAO,SAAS,KAAK,OAAO,OAAO,OAAO,KAAK,IAAI,EAAE,CAAC,GACxD,MAAM,KAAK,wBAAwB,OAAO,OAAO,UAAU,UAAU,OAAO,MAAM;CAEtF;CAEA,MAAc,wBACZ,OACA,OACA,YACA,UACA,OACA,QACe;EACf,MAAM,SAAyB;GAAE,WAAW,MAAM;GAAW;GAAY;EAAS;EAClF,IAAI,WAAW,MAAM,MAAM,SAAS,aAAa,OAAO,MAAM;EAC9D,IAAI,UAAU,aACZ;EAEF,IAAI,CAAC,UAAU;GACb,MAAM,sBAAM,IAAI,KAAK;GACrB,MAAM,WAAW,MAAM,MAAM,SAAS,OAAO,OAAO;IAClD,IAAI,MAAM,UAAU;IACpB;IACA,WAAW,MAAM;IACjB;IACA;IACA,WAAW;IACX,UAAU;IACV,aAAa;IACb,WAAW;IACX,WAAW;GACb,CAAC;GACD,IAAI,UAAU;IACZ,OAAO,KAAK,eAAe,kBAAkB,KAAK;KAAE;KAAO,MAAM;IAAS,CAAC,CAAC;IAC5E;GACF;GAEA,WAAW,MAAM,MAAM,SAAS,aAAa,OAAO,MAAM;GAC1D,IAAI,UAAU,aACZ;GAEF,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,0DAA0D;EAE9E;EACA,MAAM,SACH,MAAM,MAAM,SAAS,OAAO,OAAO,SAAS,IAAI,EAC/C,6BAAa,IAAI,KAAK,EACxB,CAAC,KAAM;EACT,OAAO,KAAK,eAAe,kBAAkB,KAAK;GAAE;GAAO,MAAM;EAAO,CAAC,CAAC;CAC5E;CAEA,IAAI,OAAe,QAAwD;EACzE,OAAO,KAAK,KAAK,aAAa,OAAO,MAAM;CAC7C;CAEA,cAAc,OAAe,WAAmB,WAAgD;EAC9F,OAAO,KAAK,KAAK,cAAc,OAAO,WAAW,SAAS;CAC5D;AACF"}
+{"version":3,"file":"service.js","names":[],"sources":["../../src/progress/service.ts"],"sourcesContent":["// progress context — service implementation (inbound port).\n// The frontend only reports usage; this service makes every completion\n// decision. One report batch runs in one UoW transaction: ensure the record,\n// merge item payloads into the per-subject state map, evaluate the activity's\n// completion rule, then module/course against current published structure —\n// appending events with the writes. The container is resolved from the\n// hierarchy (activity → module → course), never supplied by the caller.\n// Percentage/resume are derived by readers, never stored here.\nimport { genId } from '../shared/id.js';\nimport { NotFoundError } from '../shared/errors.js';\nimport type { ProgressRecord } from './model.js';\nimport type {\n  ContentAccessReader,\n  ProgressRepository,\n  ProgressService,\n  ProgressUnitOfWork,\n  ProgressWriteScope,\n} from './ports.js';\nimport type { ProgressReportItem, ProgressTarget, ReportProgressInput } from './types.js';\nimport { progressEvents, type NewProgressEvent } from './events.js';\nimport type { Activity, CourseManagementService, Module } from '../content/index.js';\nimport type { JsonValue } from '../types/index.js';\nimport type { Logger } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\n\n/** Mirrors reporting/member: `settings.published === false` is the only draft signal. */\nfunction isActivityPublished(settings: unknown): boolean {\n  return (settings as { published?: boolean } | null)?.published !== false;\n}\n\n/** Fold a report batch into the record's per-subject state map. Reserved keys\n *  (`asset` = subject, `completed` = claim) are stripped; the rest is the asset\n *  type's own vocabulary, stored opaquely — latest report per subject wins. */\nfunction mergeReports(\n  position: unknown,\n  items: ProgressReportItem[],\n): { map: Record<string, JsonValue>; changed: boolean; claimed: boolean } {\n  const map = { ...((position as Record<string, JsonValue> | null) ?? {}) };\n  let changed = false;\n  let claimed = false;\n  for (const item of items) {\n    const { asset, completed, ...payload } = item;\n    if (completed === true) {\n      claimed = true;\n    }\n    if (Object.keys(payload).length > 0) {\n      map[asset ?? 'self'] = payload;\n      changed = true;\n    }\n  }\n  return { map, changed, claimed };\n}\n\n/** The completion-rule seam. Only `manual` ships: no authored rule → the\n *  learner's claim decides. Authored rules are never satisfied until their\n *  evaluators exist. Future rules evaluate against the accumulated state map. */\nfunction completionSatisfied(settings: unknown, claimed: boolean): boolean {\n  const rule = (settings as { completion?: { rule?: string } } | null)?.completion?.rule;\n  if (!rule || rule === 'manual') {\n    return claimed;\n  }\n  return false;\n}\n\nexport type ProgressServiceParams = {\n  repo: ProgressRepository;\n  content: CourseManagementService;\n  access: ContentAccessReader;\n  uow: ProgressUnitOfWork;\n  logger?: Logger;\n};\n\nexport class ProgressServiceImpl implements ProgressService {\n  private readonly repo: ProgressRepository;\n  private readonly content: CourseManagementService;\n  private readonly access: ContentAccessReader;\n  private readonly uow: ProgressUnitOfWork;\n  private readonly logger: Logger;\n\n  constructor(params: ProgressServiceParams) {\n    this.repo = params.repo;\n    this.content = params.content;\n    this.access = params.access;\n    this.uow = params.uow;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  async report(orgId: string, input: ReportProgressInput): Promise<ProgressRecord> {\n    const activity = await this.content.getActivity(orgId, input.activityId);\n    if (!activity || !isActivityPublished(activity.settings)) {\n      throw new NotFoundError('Activity', input.activityId);\n    }\n    const courseId = activity.courseId;\n    const course = await this.content.getCourse(orgId, courseId);\n    if (\n      !course ||\n      course.status !== 'published' ||\n      !(await this.access.hasAccess(orgId, input.orgUserId, courseId))\n    ) {\n      throw new NotFoundError('Activity', input.activityId);\n    }\n    const modules = await this.content.listCourseModules(orgId, courseId);\n    const courseActivities = await this.content.listCourseActivities(orgId, courseId);\n    return this.uow.run(async (scope) => {\n      // Serializes concurrent reports for this student+course (locks are tx-scoped;\n      // both racers lock in the same order, the loser waits and then sees committed state).\n      const lockIds = [\n        ...courseActivities.filter((a) => isActivityPublished(a.settings)).map((a) => a.id),\n        ...modules.map((m) => m.id),\n        courseId,\n      ];\n      await scope.progress.findByTargets(orgId, input.orgUserId, lockIds, { forUpdate: true });\n      const events: NewProgressEvent[] = [];\n      let record = await this.ensureActivityRecord(orgId, input, scope, events);\n      const state = mergeReports(record.position, input.reports);\n      if (state.changed) {\n        record = (await scope.progress.update(orgId, record.id, { position: state.map })) ?? record;\n      }\n      if (!record.completedAt && completionSatisfied(activity.settings, state.claimed)) {\n        record =\n          (await scope.progress.update(orgId, record.id, {\n            completedAt: new Date(),\n          })) ?? record;\n        events.push(progressEvents.progressCompleted.make({ orgId, data: record }));\n        await this.completeContainers(\n          orgId,\n          input,\n          courseId,\n          modules,\n          courseActivities,\n          scope,\n          events,\n        );\n        this.logger.info('progress completed', { orgId, recordId: record.id });\n      }\n      if (events.length > 0) {\n        await scope.outbox.append(events);\n      }\n      return record;\n    });\n  }\n\n  private async ensureActivityRecord(\n    orgId: string,\n    input: ReportProgressInput,\n    scope: ProgressWriteScope,\n    events: NewProgressEvent[],\n  ): Promise<ProgressRecord> {\n    const target: ProgressTarget = {\n      orgUserId: input.orgUserId,\n      targetType: 'activity',\n      targetId: input.activityId,\n    };\n    const existing = await scope.progress.findByTarget(orgId, target);\n    if (existing) {\n      return existing;\n    }\n    const now = new Date();\n    const record = await scope.progress.insert(orgId, {\n      id: genId('progress'),\n      orgId,\n      orgUserId: input.orgUserId,\n      targetType: 'activity',\n      targetId: input.activityId,\n      startedAt: now,\n      position: null,\n      completedAt: null,\n      createdAt: now,\n      updatedAt: now,\n    });\n    if (!record) {\n      // Lost a concurrent first-touch insert: the winner owns the row and emitted\n      // progress.started. Return its row without re-emitting.\n      const winner = await scope.progress.findByTarget(orgId, target);\n      if (!winner) {\n        throw new Error('progress record vanished after insert conflict');\n      }\n      return winner;\n    }\n    events.push(progressEvents.progressStarted.make({ orgId, data: record }));\n    this.logger.info('progress started', { orgId, recordId: record.id });\n    return record;\n  }\n\n  /** After an activity completes: newly-complete containers get their records\n   *  (created complete) and a progress.completed event — same transaction. */\n  private async completeContainers(\n    orgId: string,\n    input: ReportProgressInput,\n    courseId: string,\n    modules: Module[],\n    courseActivities: Activity[],\n    scope: ProgressWriteScope,\n    events: NewProgressEvent[],\n  ): Promise<void> {\n    const published = courseActivities.filter((a) => isActivityPublished(a.settings));\n    const byModule = modules.map((m) => ({\n      id: m.id,\n      activityIds: published.filter((a) => a.moduleId === m.id).map((a) => a.id),\n    }));\n    const allIds = byModule.flatMap((m) => m.activityIds);\n    const records = await scope.progress.findByTargets(orgId, input.orgUserId, allIds);\n    const done = new Set(\n      records.filter((r) => r.targetType === 'activity' && r.completedAt).map((r) => r.targetId),\n    );\n    const containing = byModule.find((m) => m.activityIds.includes(input.activityId));\n    if (containing && containing.activityIds.every((id) => done.has(id))) {\n      await this.ensureContainerComplete(orgId, input, 'module', containing.id, scope, events);\n    }\n    if (allIds.length > 0 && allIds.every((id) => done.has(id))) {\n      await this.ensureContainerComplete(orgId, input, 'course', courseId, scope, events);\n    }\n  }\n\n  private async ensureContainerComplete(\n    orgId: string,\n    input: ReportProgressInput,\n    targetType: 'module' | 'course',\n    targetId: string,\n    scope: ProgressWriteScope,\n    events: NewProgressEvent[],\n  ): Promise<void> {\n    const target: ProgressTarget = { orgUserId: input.orgUserId, targetType, targetId };\n    let existing = await scope.progress.findByTarget(orgId, target);\n    if (existing?.completedAt) {\n      return;\n    }\n    if (!existing) {\n      const now = new Date();\n      const inserted = await scope.progress.insert(orgId, {\n        id: genId('progress'),\n        orgId,\n        orgUserId: input.orgUserId,\n        targetType,\n        targetId,\n        startedAt: now,\n        position: null,\n        completedAt: now,\n        createdAt: now,\n        updatedAt: now,\n      });\n      if (inserted) {\n        events.push(progressEvents.progressCompleted.make({ orgId, data: inserted }));\n        return;\n      }\n      // Lost a concurrent insert: re-read the winner's row.\n      existing = await scope.progress.findByTarget(orgId, target);\n      if (existing?.completedAt) {\n        return;\n      }\n      if (!existing) {\n        throw new Error('progress container record vanished after insert conflict');\n      }\n    }\n    const record =\n      (await scope.progress.update(orgId, existing.id, {\n        completedAt: new Date(),\n      })) ?? existing;\n    events.push(progressEvents.progressCompleted.make({ orgId, data: record }));\n  }\n\n  get(orgId: string, target: ProgressTarget): Promise<ProgressRecord | null> {\n    return this.repo.findByTarget(orgId, target);\n  }\n\n  listByTargets(orgId: string, orgUserId: string, targetIds: string[]): Promise<ProgressRecord[]> {\n    return this.repo.findByTargets(orgId, orgUserId, targetIds);\n  }\n}\n"],"mappings":";;;;;;AA0BA,SAAS,oBAAoB,UAA4B;CACvD,OAAQ,UAA6C,cAAc;AACrE;;;;AAKA,SAAS,aACP,UACA,OACwE;CACxE,MAAM,MAAM,EAAE,GAAK,YAAiD,CAAC,EAAG;CACxE,IAAI,UAAU;CACd,IAAI,UAAU;CACd,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,EAAE,OAAO,WAAW,GAAG,YAAY;EACzC,IAAI,cAAc,MAChB,UAAU;EAEZ,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,GAAG;GACnC,IAAI,SAAS,UAAU;GACvB,UAAU;EACZ;CACF;CACA,OAAO;EAAE;EAAK;EAAS;CAAQ;AACjC;;;;AAKA,SAAS,oBAAoB,UAAmB,SAA2B;CACzE,MAAM,OAAQ,UAAwD,YAAY;CAClF,IAAI,CAAC,QAAQ,SAAS,UACpB,OAAO;CAET,OAAO;AACT;AAUA,IAAa,sBAAb,MAA4D;CAC1D;CACA;CACA;CACA;CACA;CAEA,YAAY,QAA+B;EACzC,KAAK,OAAO,OAAO;EACnB,KAAK,UAAU,OAAO;EACtB,KAAK,SAAS,OAAO;EACrB,KAAK,MAAM,OAAO;EAClB,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,MAAM,OAAO,OAAe,OAAqD;EAC/E,MAAM,WAAW,MAAM,KAAK,QAAQ,YAAY,OAAO,MAAM,UAAU;EACvE,IAAI,CAAC,YAAY,CAAC,oBAAoB,SAAS,QAAQ,GACrD,MAAM,IAAI,cAAc,YAAY,MAAM,UAAU;EAEtD,MAAM,WAAW,SAAS;EAC1B,MAAM,SAAS,MAAM,KAAK,QAAQ,UAAU,OAAO,QAAQ;EAC3D,IACE,CAAC,UACD,OAAO,WAAW,eAClB,CAAE,MAAM,KAAK,OAAO,UAAU,OAAO,MAAM,WAAW,QAAQ,GAE9D,MAAM,IAAI,cAAc,YAAY,MAAM,UAAU;EAEtD,MAAM,UAAU,MAAM,KAAK,QAAQ,kBAAkB,OAAO,QAAQ;EACpE,MAAM,mBAAmB,MAAM,KAAK,QAAQ,qBAAqB,OAAO,QAAQ;EAChF,OAAO,KAAK,IAAI,IAAI,OAAO,UAAU;GAGnC,MAAM,UAAU;IACd,GAAG,iBAAiB,QAAQ,MAAM,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE;IAClF,GAAG,QAAQ,KAAK,MAAM,EAAE,EAAE;IAC1B;GACF;GACA,MAAM,MAAM,SAAS,cAAc,OAAO,MAAM,WAAW,SAAS,EAAE,WAAW,KAAK,CAAC;GACvF,MAAM,SAA6B,CAAC;GACpC,IAAI,SAAS,MAAM,KAAK,qBAAqB,OAAO,OAAO,OAAO,MAAM;GACxE,MAAM,QAAQ,aAAa,OAAO,UAAU,MAAM,OAAO;GACzD,IAAI,MAAM,SACR,SAAU,MAAM,MAAM,SAAS,OAAO,OAAO,OAAO,IAAI,EAAE,UAAU,MAAM,IAAI,CAAC,KAAM;GAEvF,IAAI,CAAC,OAAO,eAAe,oBAAoB,SAAS,UAAU,MAAM,OAAO,GAAG;IAChF,SACG,MAAM,MAAM,SAAS,OAAO,OAAO,OAAO,IAAI,EAC7C,6BAAa,IAAI,KAAK,EACxB,CAAC,KAAM;IACT,OAAO,KAAK,eAAe,kBAAkB,KAAK;KAAE;KAAO,MAAM;IAAO,CAAC,CAAC;IAC1E,MAAM,KAAK,mBACT,OACA,OACA,UACA,SACA,kBACA,OACA,MACF;IACA,KAAK,OAAO,KAAK,sBAAsB;KAAE;KAAO,UAAU,OAAO;IAAG,CAAC;GACvE;GACA,IAAI,OAAO,SAAS,GAClB,MAAM,MAAM,OAAO,OAAO,MAAM;GAElC,OAAO;EACT,CAAC;CACH;CAEA,MAAc,qBACZ,OACA,OACA,OACA,QACyB;EACzB,MAAM,SAAyB;GAC7B,WAAW,MAAM;GACjB,YAAY;GACZ,UAAU,MAAM;EAClB;EACA,MAAM,WAAW,MAAM,MAAM,SAAS,aAAa,OAAO,MAAM;EAChE,IAAI,UACF,OAAO;EAET,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,SAAS,MAAM,MAAM,SAAS,OAAO,OAAO;GAChD,IAAI,MAAM,UAAU;GACpB;GACA,WAAW,MAAM;GACjB,YAAY;GACZ,UAAU,MAAM;GAChB,WAAW;GACX,UAAU;GACV,aAAa;GACb,WAAW;GACX,WAAW;EACb,CAAC;EACD,IAAI,CAAC,QAAQ;GAGX,MAAM,SAAS,MAAM,MAAM,SAAS,aAAa,OAAO,MAAM;GAC9D,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,gDAAgD;GAElE,OAAO;EACT;EACA,OAAO,KAAK,eAAe,gBAAgB,KAAK;GAAE;GAAO,MAAM;EAAO,CAAC,CAAC;EACxE,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO,UAAU,OAAO;EAAG,CAAC;EACnE,OAAO;CACT;;;CAIA,MAAc,mBACZ,OACA,OACA,UACA,SACA,kBACA,OACA,QACe;EACf,MAAM,YAAY,iBAAiB,QAAQ,MAAM,oBAAoB,EAAE,QAAQ,CAAC;EAChF,MAAM,WAAW,QAAQ,KAAK,OAAO;GACnC,IAAI,EAAE;GACN,aAAa,UAAU,QAAQ,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE;EAC3E,EAAE;EACF,MAAM,SAAS,SAAS,SAAS,MAAM,EAAE,WAAW;EACpD,MAAM,UAAU,MAAM,MAAM,SAAS,cAAc,OAAO,MAAM,WAAW,MAAM;EACjF,MAAM,OAAO,IAAI,IACf,QAAQ,QAAQ,MAAM,EAAE,eAAe,cAAc,EAAE,WAAW,CAAC,CAAC,KAAK,MAAM,EAAE,QAAQ,CAC3F;EACA,MAAM,aAAa,SAAS,MAAM,MAAM,EAAE,YAAY,SAAS,MAAM,UAAU,CAAC;EAChF,IAAI,cAAc,WAAW,YAAY,OAAO,OAAO,KAAK,IAAI,EAAE,CAAC,GACjE,MAAM,KAAK,wBAAwB,OAAO,OAAO,UAAU,WAAW,IAAI,OAAO,MAAM;EAEzF,IAAI,OAAO,SAAS,KAAK,OAAO,OAAO,OAAO,KAAK,IAAI,EAAE,CAAC,GACxD,MAAM,KAAK,wBAAwB,OAAO,OAAO,UAAU,UAAU,OAAO,MAAM;CAEtF;CAEA,MAAc,wBACZ,OACA,OACA,YACA,UACA,OACA,QACe;EACf,MAAM,SAAyB;GAAE,WAAW,MAAM;GAAW;GAAY;EAAS;EAClF,IAAI,WAAW,MAAM,MAAM,SAAS,aAAa,OAAO,MAAM;EAC9D,IAAI,UAAU,aACZ;EAEF,IAAI,CAAC,UAAU;GACb,MAAM,sBAAM,IAAI,KAAK;GACrB,MAAM,WAAW,MAAM,MAAM,SAAS,OAAO,OAAO;IAClD,IAAI,MAAM,UAAU;IACpB;IACA,WAAW,MAAM;IACjB;IACA;IACA,WAAW;IACX,UAAU;IACV,aAAa;IACb,WAAW;IACX,WAAW;GACb,CAAC;GACD,IAAI,UAAU;IACZ,OAAO,KAAK,eAAe,kBAAkB,KAAK;KAAE;KAAO,MAAM;IAAS,CAAC,CAAC;IAC5E;GACF;GAEA,WAAW,MAAM,MAAM,SAAS,aAAa,OAAO,MAAM;GAC1D,IAAI,UAAU,aACZ;GAEF,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,0DAA0D;EAE9E;EACA,MAAM,SACH,MAAM,MAAM,SAAS,OAAO,OAAO,SAAS,IAAI,EAC/C,6BAAa,IAAI,KAAK,EACxB,CAAC,KAAM;EACT,OAAO,KAAK,eAAe,kBAAkB,KAAK;GAAE;GAAO,MAAM;EAAO,CAAC,CAAC;CAC5E;CAEA,IAAI,OAAe,QAAwD;EACzE,OAAO,KAAK,KAAK,aAAa,OAAO,MAAM;CAC7C;CAEA,cAAc,OAAe,WAAmB,WAAgD;EAC9F,OAAO,KAAK,KAAK,cAAc,OAAO,WAAW,SAAS;CAC5D;AACF"}

package/dist/reporting/admin/index.d.ts

@@ -0,0 +1,4 @@
+import { CommunityAnalytics, CommunityMember, CommunityMembersQuery, CourseActivityEngagement, CourseAnalytics, CourseEnrollmentPoint, EnrollmentPoint, OverviewStats, Page, Student, StudentAnalytics, StudentCourseProgress, StudentsQuery } from "./model.js";
+import { AdminReportRepository, AdminReportService } from "./ports.js";
+import { AdminReportServiceImpl } from "./service.js";
+export { type AdminReportRepository, type AdminReportService, AdminReportServiceImpl, type CommunityAnalytics, type CommunityMember, type CommunityMembersQuery, type CourseActivityEngagement, type CourseAnalytics, type CourseEnrollmentPoint, type EnrollmentPoint, type OverviewStats, type Page, type Student, type StudentAnalytics, type StudentCourseProgress, type StudentsQuery };

package/dist/reporting/admin/index.js

@@ -0,0 +1,2 @@
+import { AdminReportServiceImpl } from "./service.js";
+export { AdminReportServiceImpl };

package/dist/reporting/admin/model.d.ts

@@ -0,0 +1,108 @@
+import { OrgUserProfile, OrgUserStatus, Role } from "../../types/schemas/organizations.js";
+import "../../types/index.js";
+//#region src/reporting/admin/model.d.ts
+interface SpacePostCount {
+  spaceId: string;
+  count: number;
+}
+interface PostCommentCount {
+  postId: string;
+  count: number;
+}
+interface CommunityAnalytics {
+  memberCount: number;
+  activeMembers: number;
+  postsPerSpace: SpacePostCount[];
+  commentsPerPost: PostCommentCount[];
+  messagesSent: number;
+  flagsRaised: number;
+  flagsResolved: number;
+  grantsLapsed: number;
+  grantsRenewed: number;
+}
+interface OverviewStats {
+  publishedCourses: number;
+  draftCourses: number;
+  activeStudents: number;
+  expiringSoon: number;
+}
+interface EnrollmentPoint {
+  date: string;
+  count: number;
+}
+interface CourseActivityEngagement {
+  activityId: string;
+  title: string;
+  moduleId: string;
+  moduleTitle: string;
+  started: number;
+  completed: number;
+}
+interface CourseAnalytics {
+  enrolled: number;
+  started: number;
+  completed: number;
+  /** Mean of each cohort member's completed-activities percentage (0–100). */
+  avgProgress: number;
+  activities: CourseActivityEngagement[];
+}
+interface CourseEnrollmentPoint {
+  date: string;
+  count: number;
+}
+interface Student extends OrgUserProfile {
+  /** As typed on the invite form. `name` is the composed rendering name and
+   *  drifts once the person edits their own profile; these are what the admin
+   *  edits. Null for anyone who arrived by self-signup. */
+  firstName: string | null;
+  lastName: string | null;
+  entitlementCount: number;
+  avgProgress: number;
+  /** `invited` until they accept — the admin added them, they have not arrived. */
+  status: OrgUserStatus;
+  joinedAt: string;
+  lastActiveAt: string | null;
+}
+interface StudentCourseProgress {
+  courseId: string;
+  title: string;
+  /** Published activities in the course. */
+  totalActivities: number;
+  completedActivities: number;
+  /** 0–100, completed published activities over the total. */
+  progress: number;
+  startedAt: string | null;
+  lastActivityAt: string | null;
+  completedAt: string | null;
+}
+interface StudentAnalytics {
+  enrolled: number;
+  started: number;
+  completed: number;
+  /** Mean of the per-course progress percentages (0–100). */
+  avgProgress: number;
+  courses: StudentCourseProgress[];
+}
+interface CommunityMember extends OrgUserProfile {
+  role: Role;
+}
+interface CommunityMembersQuery {
+  page: number;
+  pageSize: number;
+  search?: string | undefined;
+}
+interface StudentsQuery {
+  page: number;
+  pageSize: number;
+  search?: string | undefined;
+  sort?: string | undefined;
+}
+interface Page<T> {
+  rows: T[];
+  total: number;
+  page: number;
+  pageSize: number;
+}
+//#endregion
+export { CommunityAnalytics, CommunityMember, CommunityMembersQuery, CourseActivityEngagement, CourseAnalytics, CourseEnrollmentPoint, EnrollmentPoint, OverviewStats, Page, PostCommentCount, SpacePostCount, Student, StudentAnalytics, StudentCourseProgress, StudentsQuery };
+//# sourceMappingURL=model.d.ts.map

package/dist/reporting/admin/ports.d.ts

@@ -0,0 +1,27 @@
+import { CommunityAnalytics, CommunityMember, CommunityMembersQuery, CourseAnalytics, CourseEnrollmentPoint, EnrollmentPoint, OverviewStats, Page, Student, StudentAnalytics, StudentsQuery } from "./model.js";
+//#region src/reporting/admin/ports.d.ts
+interface AdminReportService {
+  overview(orgId: string): Promise<OverviewStats>;
+  enrollments(orgId: string, days: number): Promise<EnrollmentPoint[]>;
+  courseAnalytics(orgId: string, courseId: string): Promise<CourseAnalytics | null>;
+  courseEnrollments(orgId: string, courseId: string, days: number): Promise<CourseEnrollmentPoint[] | null>;
+  listStudents(orgId: string, query: StudentsQuery): Promise<Page<Student>>;
+  getStudent(orgId: string, id: string): Promise<Student | null>;
+  studentAnalytics(orgId: string, id: string): Promise<StudentAnalytics | null>;
+  communityAnalytics(orgId: string, communityId: string): Promise<CommunityAnalytics | null>;
+  communityMembers(orgId: string, communityId: string, query: CommunityMembersQuery): Promise<Page<CommunityMember> | null>;
+}
+interface AdminReportRepository {
+  overview(orgId: string): Promise<OverviewStats>;
+  enrollments(orgId: string, days: number): Promise<EnrollmentPoint[]>;
+  courseAnalytics(orgId: string, courseId: string): Promise<CourseAnalytics | null>;
+  courseEnrollments(orgId: string, courseId: string, days: number): Promise<CourseEnrollmentPoint[] | null>;
+  listStudents(orgId: string, query: StudentsQuery): Promise<Page<Student>>;
+  getStudent(orgId: string, id: string): Promise<Student | null>;
+  studentAnalytics(orgId: string, id: string): Promise<StudentAnalytics | null>;
+  communityAnalytics(orgId: string, communityId: string): Promise<CommunityAnalytics | null>;
+  communityMembers(orgId: string, communityId: string, query: CommunityMembersQuery): Promise<Page<CommunityMember> | null>;
+}
+//#endregion
+export { AdminReportRepository, AdminReportService };
+//# sourceMappingURL=ports.d.ts.map

package/dist/reporting/admin/service.d.ts

@@ -0,0 +1,22 @@
+import { CommunityAnalytics, CommunityMember, CommunityMembersQuery, CourseAnalytics, CourseEnrollmentPoint, EnrollmentPoint, OverviewStats, Page, Student, StudentAnalytics, StudentsQuery } from "./model.js";
+import { AdminReportRepository, AdminReportService } from "./ports.js";
+//#region src/reporting/admin/service.d.ts
+type AdminReportServiceParams = {
+  repo: AdminReportRepository;
+};
+declare class AdminReportServiceImpl implements AdminReportService {
+  private readonly repo;
+  constructor(params: AdminReportServiceParams);
+  overview(orgId: string): Promise<OverviewStats>;
+  enrollments(orgId: string, days: number): Promise<EnrollmentPoint[]>;
+  courseAnalytics(orgId: string, courseId: string): Promise<CourseAnalytics | null>;
+  courseEnrollments(orgId: string, courseId: string, days: number): Promise<CourseEnrollmentPoint[] | null>;
+  listStudents(orgId: string, query: StudentsQuery): Promise<Page<Student>>;
+  getStudent(orgId: string, id: string): Promise<Student | null>;
+  studentAnalytics(orgId: string, id: string): Promise<StudentAnalytics | null>;
+  communityAnalytics(orgId: string, communityId: string): Promise<CommunityAnalytics | null>;
+  communityMembers(orgId: string, communityId: string, query: CommunityMembersQuery): Promise<Page<CommunityMember> | null>;
+}
+//#endregion
+export { AdminReportServiceImpl, AdminReportServiceParams };
+//# sourceMappingURL=service.d.ts.map