@headless-lms/core 0.3.0 → 0.4.0

package/dist/organizations/ports.d.ts

@@ -18,8 +18,10 @@ interface OrganizationService {
   getByExternalId(externalId: string): Promise<Organization | null>;
   getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
   getOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
+  getOrgUsersByIds(orgId: string, ids: string[]): Promise<OrgUser[]>;
   getOrgUsersForUser(userId: string): Promise<OrgUser[]>;
   getById(id: string): Promise<Organization | null>;
+  orgIds(): Promise<string[]>;
   createInvite(actor: Actor, input: CreateInviteInput): Promise<Invite>;
   peekInvite(token: string): Promise<Invite | null>;
   acceptInvite(input: AcceptInviteInput): Promise<OrgUser>;
@@ -60,6 +62,7 @@ interface OrganizationsRepository {
   /** Drops the org row and its dependents; null when none matched. */
   delete(id: string): Promise<Organization>;
   findById(id: string): Promise<Organization | null>;
+  listIds(): Promise<string[]>;
   findByExternalId(externalId: string): Promise<Organization | null>;
   findBySlug(slug: string): Promise<Organization | null>;
   /** Inserts a pending invite, or re-issues the org's existing pending one

package/dist/organizations/service.d.ts

@@ -49,10 +49,12 @@ declare class OrganizationServiceImpl implements OrganizationService {
   private acceptStudentInvite;
   private acceptStaffInvite;
   getOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
+  getOrgUsersByIds(orgId: string, ids: string[]): Promise<OrgUser[]>;
   getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
   deleteOrgUser(orgId: string, actor: Actor, id: string): Promise<OrgUser>;
   getOrgUsersForUser(userId: string): Promise<OrgUser[]>;
   getById(id: string): Promise<Organization | null>;
+  orgIds(): Promise<string[]>;
   private sendInviteEmail;
   getByExternalId(externalId: string): Promise<Organization | null>;
   getBySlug(slug: string): Promise<Organization | null>;

package/dist/organizations/service.js

@@ -316,6 +316,10 @@ var OrganizationServiceImpl = class {
 	getOrgUserById(orgId, id) {
 		return this.repo.findOrgUserById(orgId, id);
 	}
+	async getOrgUsersByIds(orgId, ids) {
+		const unique = [...new Set(ids)];
+		return unique.length > 0 ? this.repo.findOrgUsersByIds(orgId, unique) : [];
+	}
 	async getOrgUser(orgId, userId) {
 		return this.repo.findOrgUser(orgId, userId);
 	}
@@ -344,6 +348,9 @@ var OrganizationServiceImpl = class {
 	async getById(id) {
 		return this.repo.findById(id);
 	}
+	orgIds() {
+		return this.repo.listIds();
+	}
 	async sendInviteEmail(invite, token) {
 		if (!this.mailer || !this.inviteUrls) throw new Error("invite delivery is not configured (mailer / invite urls missing)");
 		const { email, role } = invite;

package/dist/organizations/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../src/organizations/service.ts"],"sourcesContent":["// organizations context — service implementation (inbound port).\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport type {\n  MemberRecord,\n  MembersRepository,\n  MemberWriteContext,\n  OrgAdmin,\n  OrganizationService,\n  OrganizationsRepository,\n  OrganizationsUnitOfWork,\n} from './ports.js';\nimport type { Invite, Organization, OrgUser } from './model.js';\nimport { capability, type Role, STAFF_ROLES, STUDENT_ROLE } from './roles.js';\nimport {\n  InviteError,\n  type Member,\n  type MemberRoleChange,\n  type MembersQuery,\n  OrganizationRuleError,\n  type Page,\n} from './members.js';\nimport type {\n  AcceptInviteInput,\n  AddOrgUserInput,\n  CreateInviteInput,\n  CreateOrganizationInput,\n  ResendStudentInviteInput,\n  UpdateOrganizationInput,\n  UpdateOrgUserInput,\n} from './types.js';\nimport { organizationEvents, type OrganizationEvent } from './events.js';\nimport type { Logger, NewDomainEvent } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport { generateInviteToken, hashInviteToken } from '../shared/invite-token.js';\nimport { ForbiddenError, NotFoundError } from '../shared/errors.js';\nimport type { Actor } from '../shared/actor.js';\nimport type { IdentityService } from '../identity/index.js';\nimport { genId } from '../shared/id.js';\n\nconst INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ntype NewOrganizationEvent = NewDomainEvent<OrganizationEvent>;\n\ninterface MemberWrite {\n  orgUserId: string;\n  actorOrgUserId: string;\n  demote: boolean;\n}\n\nexport interface InviteUrls {\n  studentPortalUrl: string;\n  adminAppUrl: string;\n}\n\nfunction toMember(r: MemberRecord): Member {\n  return {\n    id: r.id,\n    firstName: r.firstName,\n    lastName: r.lastName,\n    email: r.email,\n    image: r.image,\n    role: r.role,\n    status: r.status,\n    joinedAt: r.joinedAt,\n    invitedAt: r.invitedAt,\n  };\n}\n\nexport type OrganizationServiceParams = {\n  repo: OrganizationsRepository;\n  membersRepo: MembersRepository;\n  people: IdentityService;\n  uow: OrganizationsUnitOfWork;\n  orgAdmin: () => OrgAdmin;\n  logger?: Logger;\n  mailer?: Pick<Mailer, 'send'>;\n  inviteUrls?: InviteUrls;\n};\n\nexport class OrganizationServiceImpl implements OrganizationService {\n  private readonly repo: OrganizationsRepository;\n  private readonly membersRepo: MembersRepository;\n  private readonly people: IdentityService;\n  private readonly uow: OrganizationsUnitOfWork;\n  private readonly orgAdmin: () => OrgAdmin;\n  private readonly logger: Logger;\n  private readonly mailer?: Pick<Mailer, 'send'>;\n  private readonly inviteUrls?: InviteUrls;\n  private readonly memberWrites = new AsyncLocalStorage<MemberWrite>();\n\n  constructor(params: OrganizationServiceParams) {\n    this.repo = params.repo;\n    this.membersRepo = params.membersRepo;\n    this.people = params.people;\n    this.uow = params.uow;\n    this.orgAdmin = params.orgAdmin;\n    this.logger = params.logger ?? noopLogger;\n    this.mailer = params.mailer;\n    this.inviteUrls = params.inviteUrls;\n  }\n\n  async createOrganization(input: CreateOrganizationInput): Promise<Organization> {\n    const created = await this.uow.run(async ({ organizations, outbox }) => {\n      const id = genId('organization');\n\n      const created = await organizations.create({\n        id,\n        // The auth provider adopts this id for its own org row, so the org is\n        // its own external id — a lookup by either id lands on the same row.\n        externalId: input.externalId ?? id,\n        name: input.name ?? `My Org`,\n        slug: input.slug ?? '',\n        ownerId: input.ownerId,\n      });\n      await outbox.append([\n        organizationEvents.organizationCreated.make({\n          orgId: created.id,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('organization created', { orgId: created.id, slug: created.slug });\n    return created;\n  }\n\n  async updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization> {\n    const updatedOrg = await this.uow.run(async ({ organizations, outbox }) => {\n      const updated = await organizations.update(id, {\n        name: input.name,\n        slug: input.slug,\n      });\n      if (!updated) {\n        throw new NotFoundError('Organization', id);\n      }\n      await outbox.append([\n        organizationEvents.organizationUpdated.make({ orgId: id, data: updated }),\n      ]);\n      return updated;\n    });\n\n    this.logger.info('organization updated', { updatedOrg });\n    return updatedOrg!;\n  }\n\n  async deleteOrganization(id: string): Promise<Organization> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const deleted = await organizations.delete(id);\n\n      await outbox.append([\n        organizationEvents.organizationDeleted.make({\n          orgId: deleted.id,\n          data: deleted,\n        }),\n      ]);\n      return deleted;\n    });\n    this.logger.info('organization deleted', { orgId: deleted.id });\n    return deleted;\n  }\n\n  async addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser> {\n    const existing = await this.repo.findOrgUser(orgId, userId);\n    if (existing) {\n      return this.updateOrgUser(orgId, userId, { role, status: 'active' });\n    }\n    const orgUser = await this.uow.run(async ({ organizations, outbox }) => {\n      const created = await organizations.createOrgUser({ orgId, role, userId, status: 'active' });\n      await outbox.append([organizationEvents.orgUserLinked.make({ orgId, data: created })]);\n      return created;\n    });\n    this.logger.info('user added to organization', { orgId, userId, role });\n    return orgUser;\n  }\n\n  async removeOrgUser(orgId: string, userId: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('Member', userId);\n      }\n      const write = this.memberWrite(orgUser.id);\n      if (write?.demote) {\n        const demoted = await organizations.updateOrgUser(orgId, orgUser.id, {\n          role: STUDENT_ROLE,\n        });\n        if (!demoted) {\n          throw new NotFoundError('Member', orgUser.id);\n        }\n        if (orgUser.role !== STUDENT_ROLE) {\n          await outbox.append([\n            organizationEvents.orgUserUpdated.make({\n              orgId,\n              data: demoted,\n              metadata: { actorOrgUserId: write.actorOrgUserId },\n            }),\n          ]);\n        }\n        return demoted;\n      }\n      if (orgUser.role === STUDENT_ROLE) {\n        return orgUser;\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, orgUser.id);\n      if (!deletedUser) {\n        throw new NotFoundError('Member', orgUser.id);\n      }\n      await outbox.append([\n        organizationEvents.orgUserDeleted.make({\n          orgId,\n          data: deletedUser,\n        }),\n      ]);\n      return deletedUser;\n    });\n    this.logger.info('org user removed', { orgId, userId, orgUserId: deleted.id });\n    return deleted;\n  }\n\n  async updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser> {\n    const updated = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('Member', userId);\n      }\n      const next = await organizations.updateOrgUser(orgId, orgUser.id, patch);\n      if (!next) {\n        throw new NotFoundError('Member', orgUser.id);\n      }\n      if (patch.role !== undefined && patch.role !== orgUser.role) {\n        const actorOrgUserId = this.memberWrite(orgUser.id)?.actorOrgUserId;\n        await outbox.append([\n          organizationEvents.orgUserUpdated.make({\n            orgId,\n            data: next,\n            ...(actorOrgUserId !== undefined && { metadata: { actorOrgUserId } }),\n          }),\n        ]);\n      }\n      return next;\n    });\n    this.logger.info('org user updated', { orgId, userId, orgUserId: updated.id, patch });\n    return updated;\n  }\n\n  async createInvite(actor: Actor, input: CreateInviteInput): Promise<Invite> {\n    const { orgId, email, role, inviterUserId, firstName, lastName } = input;\n    this.assertManagesUsers(actor, orgId);\n    this.assertNotOwner(role, orgId);\n    const sendEmail = input.sendEmail ?? true;\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n\n    // A student belongs to the org from the moment an admin adds them, not from\n    // the moment they click a link — so the person exists before the invite\n    // does. Staff are excluded: their org_users row is mirrored from the auth\n    // provider's member record, which does not exist until they join.\n    const person =\n      role === STUDENT_ROLE\n        ? ((await this.people.getUserByEmail(email)) ??\n          (await this.people.createUser({\n            email,\n            ...(firstName !== undefined && { firstName }),\n            ...(lastName !== undefined && { lastName }),\n          })))\n        : null;\n\n    const invite = await this.uow.run(async ({ organizations, outbox }) => {\n      const events: NewOrganizationEvent[] = [];\n      if (person) {\n        const orgUser = await organizations.createOrgUser({\n          orgId,\n          userId: person.id,\n          role: STUDENT_ROLE,\n          status: 'invited',\n        });\n        events.push(organizationEvents.studentCreated.make({ orgId, data: orgUser }));\n      }\n      const row = await organizations.upsertPendingInvite(orgId, {\n        email,\n        role,\n        invitedBy: inviterUserId,\n        tokenHash,\n        expiresAt,\n      });\n      events.push(organizationEvents.inviteCreated.make({ orgId, data: row }));\n      await outbox.append(events);\n      return row;\n    });\n\n    if (sendEmail) {\n      // TODO make this workflow durable\n      try {\n        await this.sendInviteEmail(invite, token);\n      } catch (err) {\n        // A failed email must not abort invite creation: the token is already\n        // minted and recorded, so the admin can fix transport and resend.\n        this.logger.error('failed to send invite email', {\n          orgId,\n          inviteId: invite.id,\n          role: invite.role,\n          err: err instanceof Error ? err : new Error(String(err)),\n        });\n      }\n    }\n\n    this.logger.info('invite created', { orgId, inviteId: invite.id, role, sendEmail });\n    return invite;\n  }\n\n  async resendStudentInvite(actor: Actor, input: ResendStudentInviteInput): Promise<void> {\n    const { orgId, orgUserId, inviterUserId } = input;\n    this.assertManagesUsers(actor, orgId);\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    if (orgUser.status === 'active') {\n      throw new OrganizationRuleError('That student has already accepted their invitation');\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n    const pending = await this.repo.findPendingInvite(orgId, person.email);\n    if (!pending) {\n      throw new NotFoundError('Invite', person.email);\n    }\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n    const invite = await this.repo.setInviteToken(orgId, pending.id, tokenHash, expiresAt);\n    if (!invite) {\n      throw new NotFoundError('Invite', pending.id);\n    }\n    await this.sendInviteEmail(invite, token);\n    this.logger.info('student invite resent', {\n      orgId,\n      orgUserId,\n      inviteId: invite.id,\n      inviterUserId,\n    });\n  }\n\n  async peekInvite(token: string): Promise<Invite | null> {\n    const invite = await this.repo.findInviteByTokenHash(hashInviteToken(token));\n    if (!invite || invite.status !== 'pending') {\n      return null;\n    }\n    if (invite.expiresAt && invite.expiresAt < new Date()) {\n      return null;\n    }\n    return invite;\n  }\n\n  async acceptInvite(input: AcceptInviteInput): Promise<OrgUser> {\n    const invite = await this.peekInvite(input.token);\n    if (!invite) {\n      this.logger.warn('invite accept refused: token invalid or expired');\n      throw new InviteError('invalid invite');\n    }\n    if (invite.email.toLowerCase() !== input.email.toLowerCase()) {\n      this.logger.warn('invite accept refused: email mismatch', {\n        orgId: invite.orgId,\n        inviteId: invite.id,\n      });\n      throw new InviteError('emails must match');\n    }\n    const org = await this.repo.findById(invite.orgId);\n    if (!org) {\n      throw new InviteError('Org not found');\n    }\n\n    const orgUser =\n      invite.role === STUDENT_ROLE\n        ? await this.acceptStudentInvite(invite, input.userId)\n        : await this.acceptStaffInvite(invite, org, input.userId);\n    this.logger.info('invite accepted', { orgId: invite.orgId, userId: input.userId });\n    return orgUser;\n  }\n\n  private async acceptStudentInvite(invite: Invite, userId: string): Promise<OrgUser> {\n    return this.uow.run(async ({ organizations, outbox }) => {\n      const existing = await organizations.findOrgUser(invite.orgId, userId);\n      if (!existing) {\n        throw new NotFoundError('Member', userId);\n      }\n      const activated = await organizations.updateOrgUser(invite.orgId, existing.id, {\n        status: 'active',\n      });\n      if (!activated) {\n        throw new NotFoundError('Member', existing.id);\n      }\n      const acceptedInvite = await organizations.setInviteStatus(\n        invite.orgId,\n        invite.id,\n        'accepted',\n      );\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      await outbox.append([\n        organizationEvents.inviteAccepted.make({ orgId: invite.orgId, data: acceptedInvite }),\n        organizationEvents.studentLinked.make({ orgId: invite.orgId, data: activated }),\n      ]);\n      return activated;\n    });\n  }\n\n  private async acceptStaffInvite(\n    invite: Invite,\n    org: Organization,\n    userId: string,\n  ): Promise<OrgUser> {\n    const person = await this.people.getUserById(userId);\n    if (!person?.externalId) {\n      throw new NotFoundError('User', userId);\n    }\n    await this.orgAdmin().grantMembership(org.externalId ?? org.id, person.externalId, invite.role);\n    return this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(invite.orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('Member', userId);\n      }\n      const acceptedInvite = await organizations.setInviteStatus(\n        invite.orgId,\n        invite.id,\n        'accepted',\n      );\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      await outbox.append([\n        organizationEvents.inviteAccepted.make({ orgId: invite.orgId, data: acceptedInvite }),\n      ]);\n      return orgUser;\n    });\n  }\n\n  // By identity USER id — `(org_id, user_id)` is unique. Every caller (scope\n  // resolution, the MCP principal, the member routes) asks \"what is this person\n  // in this org\", never \"what is this org_users row\".\n  getOrgUserById(orgId: string, id: string): Promise<OrgUser | null> {\n    return this.repo.findOrgUserById(orgId, id);\n  }\n\n  async getOrgUser(orgId: string, userId: string): Promise<OrgUser | null> {\n    return this.repo.findOrgUser(orgId, userId);\n  }\n\n  async deleteOrgUser(orgId: string, actor: Actor, id: string): Promise<OrgUser> {\n    this.assertManagesUsers(actor, orgId);\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUserById(orgId, id);\n      if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n        throw new NotFoundError('Student', id);\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, id);\n      if (!deletedUser) {\n        throw new NotFoundError('Student', id);\n      }\n      await outbox.append([organizationEvents.studentDeleted.make({ orgId, data: orgUser })]);\n      return deletedUser;\n    });\n    this.logger.info('org user deleted', { orgId, orgUserId: id });\n    return deleted;\n  }\n\n  async getOrgUsersForUser(userId: string): Promise<OrgUser[]> {\n    return this.repo.findOrgUsersByUser(userId);\n  }\n\n  async getById(id: string): Promise<Organization | null> {\n    return this.repo.findById(id);\n  }\n\n  private async sendInviteEmail(invite: Invite, token: string): Promise<void> {\n    if (!this.mailer || !this.inviteUrls) {\n      throw new Error('invite delivery is not configured (mailer / invite urls missing)');\n    }\n    const { email, role } = invite;\n    const isStudent = role === STUDENT_ROLE;\n    const base = isStudent\n      ? `${this.inviteUrls.studentPortalUrl}/welcome`\n      : `${this.inviteUrls.adminAppUrl}/invite`;\n    // The portal resolves the token to the invited email, so the link carries\n    // only the token. The admin app still reads it from the query.\n    const query = isStudent\n      ? new URLSearchParams({ token })\n      : new URLSearchParams({ token, email });\n    const inviteUrl = `${base}?${query.toString()}`;\n    if (role === STUDENT_ROLE) {\n      await this.mailer.send(email, 'studentInvite', { inviteUrl, studentName: email });\n    } else {\n      await this.mailer.send(email, 'memberInvite', {\n        inviteUrl,\n        inviterName: 'Your team',\n        role,\n      });\n    }\n  }\n\n  async getByExternalId(externalId: string): Promise<Organization | null> {\n    return this.repo.findByExternalId(externalId);\n  }\n\n  async getBySlug(slug: string): Promise<Organization | null> {\n    return this.repo.findBySlug(slug);\n  }\n\n  staffOrgUserIds(orgId: string): Promise<string[]> {\n    return this.repo.findOrgUserIdsByRole(orgId, [...STAFF_ROLES]);\n  }\n\n  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>> {\n    return this.membersRepo.list(orgId, query);\n  }\n\n  async updateMemberRole(\n    ctx: MemberWriteContext,\n    actor: Actor,\n    id: string,\n    role: Role,\n  ): Promise<MemberRoleChange | null> {\n    this.assertManagesUsers(actor, ctx.orgId);\n    this.assertNotOwner(role, ctx.orgId);\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return this.promoteStudent(ctx, actor, id, role);\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('role change rejected: owner role immutable', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner role cannot be reassigned');\n    }\n    if (member.kind !== 'member' || !member.userExternalId) {\n      this.logger.warn('role change rejected: not an active member', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('Only active members can have their role changed');\n    }\n    if (role === STUDENT_ROLE) {\n      return this.demoteModerator(ctx, actor, member, member.userExternalId);\n    }\n    const userExternalId = member.userExternalId;\n    await this.asActor(actor, id, false, () =>\n      this.orgAdmin().updateRole(ctx, userExternalId, role),\n    );\n    const updated = await this.membersRepo.findById(ctx.orgId, id);\n    this.logger.info('member role updated', { orgId: ctx.orgId, memberId: id, role });\n    return updated ? toMember(updated) : null;\n  }\n\n  private async demoteModerator(\n    ctx: MemberWriteContext,\n    actor: Actor,\n    member: MemberRecord,\n    userExternalId: string,\n  ): Promise<MemberRoleChange | null> {\n    if (member.role !== 'moderator') {\n      this.logger.warn('role change rejected: only a moderator becomes a student', {\n        orgId: ctx.orgId,\n        memberId: member.id,\n      });\n      throw new OrganizationRuleError('Only a moderator can be made a student');\n    }\n    await this.asActor(actor, member.id, true, () =>\n      this.orgAdmin().removeMember(ctx, userExternalId),\n    );\n    const orgUser = await this.repo.findOrgUserById(ctx.orgId, member.id);\n    if (!orgUser) {\n      return null;\n    }\n    this.logger.info('moderator made a student', { orgId: ctx.orgId, memberId: member.id });\n    return { ...toMember(member), role: orgUser.role, status: orgUser.status };\n  }\n\n  private async promoteStudent(\n    ctx: MemberWriteContext,\n    actor: Actor,\n    id: string,\n    role: Role,\n  ): Promise<MemberRoleChange | null> {\n    const orgUser = await this.repo.findOrgUserById(ctx.orgId, id);\n    if (!orgUser) {\n      return null;\n    }\n    if (orgUser.role !== STUDENT_ROLE || role === STUDENT_ROLE) {\n      this.logger.warn('role change rejected: not an active member', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('Only active members can have their role changed');\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person?.externalId) {\n      this.logger.warn('role change rejected: student has no account', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('That student has not joined yet');\n    }\n    const org = await this.repo.findById(ctx.orgId);\n    if (!org) {\n      return null;\n    }\n    const orgExternalId = org.externalId ?? org.id;\n    const userExternalId = person.externalId;\n    await this.asActor(actor, orgUser.id, false, async () => {\n      await this.orgAdmin().grantMembership(orgExternalId, userExternalId, role);\n      if (!(await this.membersRepo.findById(ctx.orgId, id))) {\n        await this.orgAdmin().updateRole(ctx, userExternalId, role);\n      }\n    });\n    const updated = await this.membersRepo.findById(ctx.orgId, id);\n    if (!updated) {\n      this.logger.warn('role change rejected: membership not mirrored', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The role change did not take effect');\n    }\n    this.logger.info('student promoted', { orgId: ctx.orgId, memberId: id, role });\n    return toMember(updated);\n  }\n\n  private asActor<T>(\n    actor: Actor,\n    orgUserId: string,\n    demote: boolean,\n    write: () => Promise<T>,\n  ): Promise<T> {\n    return this.memberWrites.run({ orgUserId, actorOrgUserId: actor.id, demote }, write);\n  }\n\n  private memberWrite(orgUserId: string): MemberWrite | undefined {\n    const write = this.memberWrites.getStore();\n    return write?.orgUserId === orgUserId ? write : undefined;\n  }\n\n  private assertManagesUsers(actor: Actor, orgId: string): void {\n    if (capability(actor.role, 'manage_users') !== true) {\n      this.logger.warn('member write rejected: actor cannot manage users', {\n        orgId,\n        actorOrgUserId: actor.id,\n      });\n      throw new ForbiddenError('Only an owner or admin can manage members');\n    }\n  }\n\n  private assertNotOwner(role: Role, orgId: string): void {\n    if (role === 'owner') {\n      this.logger.warn('member write rejected: owner cannot be granted', { orgId });\n      throw new OrganizationRuleError('Ownership cannot be granted');\n    }\n  }\n\n  async removeMember(ctx: MemberWriteContext, actor: Actor, id: string): Promise<boolean> {\n    this.assertManagesUsers(actor, ctx.orgId);\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return false;\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('member removal rejected: owner cannot be removed', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner cannot be removed');\n    }\n    if (member.kind === 'member' && member.userExternalId) {\n      await this.orgAdmin().removeMember(ctx, member.userExternalId);\n    } else if (member.kind === 'invite' && member.inviteId) {\n      const inviteId = member.inviteId;\n      await this.uow.run(async ({ organizations, outbox }) => {\n        const canceled = await organizations.setInviteStatus(ctx.orgId, inviteId, 'canceled');\n        if (!canceled) {\n          throw new NotFoundError('Invite', inviteId);\n        }\n        await outbox.append([\n          organizationEvents.inviteCanceled.make({ orgId: ctx.orgId, data: canceled }),\n        ]);\n      });\n    }\n    this.logger.info('member removed', { orgId: ctx.orgId, memberId: id });\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;;AAwCA,MAAM,gBAAgB,QAAc,KAAK;AAezC,SAAS,SAAS,GAAyB;CACzC,OAAO;EACL,IAAI,EAAE;EACN,WAAW,EAAE;EACb,UAAU,EAAE;EACZ,OAAO,EAAE;EACT,OAAO,EAAE;EACT,MAAM,EAAE;EACR,QAAQ,EAAE;EACV,UAAU,EAAE;EACZ,WAAW,EAAE;CACf;AACF;AAaA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,eAAgC,IAAI,kBAA+B;CAEnE,YAAY,QAAmC;EAC7C,KAAK,OAAO,OAAO;EACnB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO;EACrB,KAAK,MAAM,OAAO;EAClB,KAAK,WAAW,OAAO;EACvB,KAAK,SAAS,OAAO,UAAU;EAC/B,KAAK,SAAS,OAAO;EACrB,KAAK,aAAa,OAAO;CAC3B;CAEA,MAAM,mBAAmB,OAAuD;EAC9E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,KAAK,MAAM,cAAc;GAE/B,MAAM,UAAU,MAAM,cAAc,OAAO;IACzC;IAGA,YAAY,MAAM,cAAc;IAChC,MAAM,MAAM,QAAQ;IACpB,MAAM,MAAM,QAAQ;IACpB,SAAS,MAAM;GACjB,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB;GAAE,OAAO,QAAQ;GAAI,MAAM,QAAQ;EAAK,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAY,OAAuD;EAC1F,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACzE,MAAM,UAAU,MAAM,cAAc,OAAO,IAAI;IAC7C,MAAM,MAAM;IACZ,MAAM,MAAM;GACd,CAAC;GACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,gBAAgB,EAAE;GAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAAE,OAAO;IAAI,MAAM;GAAQ,CAAC,CAC1E,CAAC;GACD,OAAO;EACT,CAAC;EAED,KAAK,OAAO,KAAK,wBAAwB,EAAE,WAAW,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAmC;EAC1D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB,EAAE,OAAO,QAAQ,GAAG,CAAC;EAC9D,OAAO;CACT;CAEA,MAAM,WAAW,EAAE,OAAO,QAAQ,QAA2C;EAE3E,IAAI,MADmB,KAAK,KAAK,YAAY,OAAO,MAAM,GAExD,OAAO,KAAK,cAAc,OAAO,QAAQ;GAAE;GAAM,QAAQ;EAAS,CAAC;EAErE,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,cAAc;IAAE;IAAO;IAAM;IAAQ,QAAQ;GAAS,CAAC;GAC3F,MAAM,OAAO,OAAO,CAAC,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC,CAAC;GACrF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,8BAA8B;GAAE;GAAO;GAAQ;EAAK,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,QAAkC;EACnE,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,MAAM;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,QAAQ,KAAK,YAAY,QAAQ,EAAE;GACzC,IAAI,OAAO,QAAQ;IACjB,MAAM,UAAU,MAAM,cAAc,cAAc,OAAO,QAAQ,IAAI,EACnE,MAAM,aACR,CAAC;IACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;IAE9C,IAAI,QAAQ,SAAA,WACV,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KACrC;KACA,MAAM;KACN,UAAU,EAAE,gBAAgB,MAAM,eAAe;IACnD,CAAC,CACH,CAAC;IAEH,OAAO;GACT;GACA,IAAI,QAAQ,SAAA,WACV,OAAO;GAET,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,QAAQ,EAAE;GACvE,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;GAE9C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IACrC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO;GAAQ,WAAW,QAAQ;EAAG,CAAC;EAC7E,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,QAAgB,OAA6C;EAC9F,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,MAAM;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,OAAO,MAAM,cAAc,cAAc,OAAO,QAAQ,IAAI,KAAK;GACvE,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;GAE9C,IAAI,MAAM,SAAS,KAAA,KAAa,MAAM,SAAS,QAAQ,MAAM;IAC3D,MAAM,iBAAiB,KAAK,YAAY,QAAQ,EAAE,CAAC,EAAE;IACrD,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KACrC;KACA,MAAM;KACN,GAAI,mBAAmB,KAAA,KAAa,EAAE,UAAU,EAAE,eAAe,EAAE;IACrE,CAAC,CACH,CAAC;GACH;GACA,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO;GAAQ,WAAW,QAAQ;GAAI;EAAM,CAAC;EACpF,OAAO;CACT;CAEA,MAAM,aAAa,OAAc,OAA2C;EAC1E,MAAM,EAAE,OAAO,OAAO,MAAM,eAAe,WAAW,aAAa;EACnE,KAAK,mBAAmB,OAAO,KAAK;EACpC,KAAK,eAAe,MAAM,KAAK;EAC/B,MAAM,YAAY,MAAM,aAAa;EACrC,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EAMrD,MAAM,SACJ,SAAA,YACM,MAAM,KAAK,OAAO,eAAe,KAAK,KACvC,MAAM,KAAK,OAAO,WAAW;GAC5B;GACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;EAC3C,CAAC,IACD;EAEN,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACrE,MAAM,SAAiC,CAAC;GACxC,IAAI,QAAQ;IACV,MAAM,UAAU,MAAM,cAAc,cAAc;KAChD;KACA,QAAQ,OAAO;KACf,MAAM;KACN,QAAQ;IACV,CAAC;IACD,OAAO,KAAK,mBAAmB,eAAe,KAAK;KAAE;KAAO,MAAM;IAAQ,CAAC,CAAC;GAC9E;GACA,MAAM,MAAM,MAAM,cAAc,oBAAoB,OAAO;IACzD;IACA;IACA,WAAW;IACX;IACA;GACF,CAAC;GACD,OAAO,KAAK,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAI,CAAC,CAAC;GACvE,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EAED,IAAI,WAEF,IAAI;GACF,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EAC1C,SAAS,KAAK;GAGZ,KAAK,OAAO,MAAM,+BAA+B;IAC/C;IACA,UAAU,OAAO;IACjB,MAAM,OAAO;IACb,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;GACzD,CAAC;EACH;EAGF,KAAK,OAAO,KAAK,kBAAkB;GAAE;GAAO,UAAU,OAAO;GAAI;GAAM;EAAU,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,oBAAoB,OAAc,OAAgD;EACtF,MAAM,EAAE,OAAO,WAAW,kBAAkB;EAC5C,KAAK,mBAAmB,OAAO,KAAK;EACpC,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,IAAI,QAAQ,WAAW,UACrB,MAAM,IAAI,sBAAsB,oDAAoD;EAEtF,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAEhD,MAAM,UAAU,MAAM,KAAK,KAAK,kBAAkB,OAAO,OAAO,KAAK;EACrE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,OAAO,KAAK;EAEhD,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EACrD,MAAM,SAAS,MAAM,KAAK,KAAK,eAAe,OAAO,QAAQ,IAAI,WAAW,SAAS;EACrF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;EAE9C,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EACxC,KAAK,OAAO,KAAK,yBAAyB;GACxC;GACA;GACA,UAAU,OAAO;GACjB;EACF,CAAC;CACH;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,SAAS,MAAM,KAAK,KAAK,sBAAsB,gBAAgB,KAAK,CAAC;EAC3E,IAAI,CAAC,UAAU,OAAO,WAAW,WAC/B,OAAO;EAET,IAAI,OAAO,aAAa,OAAO,4BAAY,IAAI,KAAK,GAClD,OAAO;EAET,OAAO;CACT;CAEA,MAAM,aAAa,OAA4C;EAC7D,MAAM,SAAS,MAAM,KAAK,WAAW,MAAM,KAAK;EAChD,IAAI,CAAC,QAAQ;GACX,KAAK,OAAO,KAAK,iDAAiD;GAClE,MAAM,IAAI,YAAY,gBAAgB;EACxC;EACA,IAAI,OAAO,MAAM,YAAY,MAAM,MAAM,MAAM,YAAY,GAAG;GAC5D,KAAK,OAAO,KAAK,yCAAyC;IACxD,OAAO,OAAO;IACd,UAAU,OAAO;GACnB,CAAC;GACD,MAAM,IAAI,YAAY,mBAAmB;EAC3C;EACA,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,OAAO,KAAK;EACjD,IAAI,CAAC,KACH,MAAM,IAAI,YAAY,eAAe;EAGvC,MAAM,UACJ,OAAO,SAAA,YACH,MAAM,KAAK,oBAAoB,QAAQ,MAAM,MAAM,IACnD,MAAM,KAAK,kBAAkB,QAAQ,KAAK,MAAM,MAAM;EAC5D,KAAK,OAAO,KAAK,mBAAmB;GAAE,OAAO,OAAO;GAAO,QAAQ,MAAM;EAAO,CAAC;EACjF,OAAO;CACT;CAEA,MAAc,oBAAoB,QAAgB,QAAkC;EAClF,OAAO,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACvD,MAAM,WAAW,MAAM,cAAc,YAAY,OAAO,OAAO,MAAM;GACrE,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,YAAY,MAAM,cAAc,cAAc,OAAO,OAAO,SAAS,IAAI,EAC7E,QAAQ,SACV,CAAC;GACD,IAAI,CAAC,WACH,MAAM,IAAI,cAAc,UAAU,SAAS,EAAE;GAE/C,MAAM,iBAAiB,MAAM,cAAc,gBACzC,OAAO,OACP,OAAO,IACP,UACF;GACA,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAe,CAAC,GACpF,mBAAmB,cAAc,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAU,CAAC,CAChF,CAAC;GACD,OAAO;EACT,CAAC;CACH;CAEA,MAAc,kBACZ,QACA,KACA,QACkB;EAClB,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,MAAM;EACnD,IAAI,CAAC,QAAQ,YACX,MAAM,IAAI,cAAc,QAAQ,MAAM;EAExC,MAAM,KAAK,SAAS,CAAC,CAAC,gBAAgB,IAAI,cAAc,IAAI,IAAI,OAAO,YAAY,OAAO,IAAI;EAC9F,OAAO,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACvD,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,OAAO,MAAM;GACpE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,iBAAiB,MAAM,cAAc,gBACzC,OAAO,OACP,OAAO,IACP,UACF;GACA,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAe,CAAC,CACtF,CAAC;GACD,OAAO;EACT,CAAC;CACH;CAKA,eAAe,OAAe,IAAqC;EACjE,OAAO,KAAK,KAAK,gBAAgB,OAAO,EAAE;CAC5C;CAEA,MAAM,WAAW,OAAe,QAAyC;EACvE,OAAO,KAAK,KAAK,YAAY,OAAO,MAAM;CAC5C;CAEA,MAAM,cAAc,OAAe,OAAc,IAA8B;EAC7E,KAAK,mBAAmB,OAAO,KAAK;EACpC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,gBAAgB,OAAO,EAAE;GAC7D,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,EAAE;GAC/D,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,OAAO,OAAO,CAAC,mBAAmB,eAAe,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC,CAAC;GACtF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO,WAAW;EAAG,CAAC;EAC7D,OAAO;CACT;CAEA,MAAM,mBAAmB,QAAoC;EAC3D,OAAO,KAAK,KAAK,mBAAmB,MAAM;CAC5C;CAEA,MAAM,QAAQ,IAA0C;EACtD,OAAO,KAAK,KAAK,SAAS,EAAE;CAC9B;CAEA,MAAc,gBAAgB,QAAgB,OAA8B;EAC1E,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,YACxB,MAAM,IAAI,MAAM,kEAAkE;EAEpF,MAAM,EAAE,OAAO,SAAS;EACxB,MAAM,YAAY,SAAS;EAS3B,MAAM,YAAY,GARL,YACT,GAAG,KAAK,WAAW,iBAAiB,YACpC,GAAG,KAAK,WAAW,YAAY,SAMT,IAHZ,YACV,IAAI,gBAAgB,EAAE,MAAM,CAAC,IAC7B,IAAI,gBAAgB;GAAE;GAAO;EAAM,CAAC,EAAA,CACL,SAAS;EAC5C,IAAI,SAAA,WACF,MAAM,KAAK,OAAO,KAAK,OAAO,iBAAiB;GAAE;GAAW,aAAa;EAAM,CAAC;OAEhF,MAAM,KAAK,OAAO,KAAK,OAAO,gBAAgB;GAC5C;GACA,aAAa;GACb;EACF,CAAC;CAEL;CAEA,MAAM,gBAAgB,YAAkD;EACtE,OAAO,KAAK,KAAK,iBAAiB,UAAU;CAC9C;CAEA,MAAM,UAAU,MAA4C;EAC1D,OAAO,KAAK,KAAK,WAAW,IAAI;CAClC;CAEA,gBAAgB,OAAkC;EAChD,OAAO,KAAK,KAAK,qBAAqB,OAAO,CAAC,GAAG,WAAW,CAAC;CAC/D;CAEA,YAAY,OAAe,OAA4C;EACrE,OAAO,KAAK,YAAY,KAAK,OAAO,KAAK;CAC3C;CAEA,MAAM,iBACJ,KACA,OACA,IACA,MACkC;EAClC,KAAK,mBAAmB,OAAO,IAAI,KAAK;EACxC,KAAK,eAAe,MAAM,IAAI,KAAK;EACnC,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO,KAAK,eAAe,KAAK,OAAO,IAAI,IAAI;EAEjD,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,qCAAqC;EACvE;EACA,IAAI,OAAO,SAAS,YAAY,CAAC,OAAO,gBAAgB;GACtD,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iDAAiD;EACnF;EACA,IAAI,SAAA,WACF,OAAO,KAAK,gBAAgB,KAAK,OAAO,QAAQ,OAAO,cAAc;EAEvE,MAAM,iBAAiB,OAAO;EAC9B,MAAM,KAAK,QAAQ,OAAO,IAAI,aAC5B,KAAK,SAAS,CAAC,CAAC,WAAW,KAAK,gBAAgB,IAAI,CACtD;EACA,MAAM,UAAU,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC7D,KAAK,OAAO,KAAK,uBAAuB;GAAE,OAAO,IAAI;GAAO,UAAU;GAAI;EAAK,CAAC;EAChF,OAAO,UAAU,SAAS,OAAO,IAAI;CACvC;CAEA,MAAc,gBACZ,KACA,OACA,QACA,gBACkC;EAClC,IAAI,OAAO,SAAS,aAAa;GAC/B,KAAK,OAAO,KAAK,4DAA4D;IAC3E,OAAO,IAAI;IACX,UAAU,OAAO;GACnB,CAAC;GACD,MAAM,IAAI,sBAAsB,wCAAwC;EAC1E;EACA,MAAM,KAAK,QAAQ,OAAO,OAAO,IAAI,YACnC,KAAK,SAAS,CAAC,CAAC,aAAa,KAAK,cAAc,CAClD;EACA,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,IAAI,OAAO,OAAO,EAAE;EACpE,IAAI,CAAC,SACH,OAAO;EAET,KAAK,OAAO,KAAK,4BAA4B;GAAE,OAAO,IAAI;GAAO,UAAU,OAAO;EAAG,CAAC;EACtF,OAAO;GAAE,GAAG,SAAS,MAAM;GAAG,MAAM,QAAQ;GAAM,QAAQ,QAAQ;EAAO;CAC3E;CAEA,MAAc,eACZ,KACA,OACA,IACA,MACkC;EAClC,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,IAAI,OAAO,EAAE;EAC7D,IAAI,CAAC,SACH,OAAO;EAET,IAAI,QAAQ,SAAA,aAAyB,SAAA,WAAuB;GAC1D,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iDAAiD;EACnF;EACA,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QAAQ,YAAY;GACvB,KAAK,OAAO,KAAK,gDAAgD;IAC/D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iCAAiC;EACnE;EACA,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,IAAI,KAAK;EAC9C,IAAI,CAAC,KACH,OAAO;EAET,MAAM,gBAAgB,IAAI,cAAc,IAAI;EAC5C,MAAM,iBAAiB,OAAO;EAC9B,MAAM,KAAK,QAAQ,OAAO,QAAQ,IAAI,OAAO,YAAY;GACvD,MAAM,KAAK,SAAS,CAAC,CAAC,gBAAgB,eAAe,gBAAgB,IAAI;GACzE,IAAI,CAAE,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE,GACjD,MAAM,KAAK,SAAS,CAAC,CAAC,WAAW,KAAK,gBAAgB,IAAI;EAE9D,CAAC;EACD,MAAM,UAAU,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC7D,IAAI,CAAC,SAAS;GACZ,KAAK,OAAO,KAAK,iDAAiD;IAChE,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,qCAAqC;EACvE;EACA,KAAK,OAAO,KAAK,oBAAoB;GAAE,OAAO,IAAI;GAAO,UAAU;GAAI;EAAK,CAAC;EAC7E,OAAO,SAAS,OAAO;CACzB;CAEA,QACE,OACA,WACA,QACA,OACY;EACZ,OAAO,KAAK,aAAa,IAAI;GAAE;GAAW,gBAAgB,MAAM;GAAI;EAAO,GAAG,KAAK;CACrF;CAEA,YAAoB,WAA4C;EAC9D,MAAM,QAAQ,KAAK,aAAa,SAAS;EACzC,OAAO,OAAO,cAAc,YAAY,QAAQ,KAAA;CAClD;CAEA,mBAA2B,OAAc,OAAqB;EAC5D,IAAI,WAAW,MAAM,MAAM,cAAc,MAAM,MAAM;GACnD,KAAK,OAAO,KAAK,oDAAoD;IACnE;IACA,gBAAgB,MAAM;GACxB,CAAC;GACD,MAAM,IAAI,eAAe,2CAA2C;EACtE;CACF;CAEA,eAAuB,MAAY,OAAqB;EACtD,IAAI,SAAS,SAAS;GACpB,KAAK,OAAO,KAAK,kDAAkD,EAAE,MAAM,CAAC;GAC5E,MAAM,IAAI,sBAAsB,6BAA6B;EAC/D;CACF;CAEA,MAAM,aAAa,KAAyB,OAAc,IAA8B;EACtF,KAAK,mBAAmB,OAAO,IAAI,KAAK;EACxC,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO;EAET,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,oDAAoD;IACnE,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,6BAA6B;EAC/D;EACA,IAAI,OAAO,SAAS,YAAY,OAAO,gBACrC,MAAM,KAAK,SAAS,CAAC,CAAC,aAAa,KAAK,OAAO,cAAc;OACxD,IAAI,OAAO,SAAS,YAAY,OAAO,UAAU;GACtD,MAAM,WAAW,OAAO;GACxB,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;IACtD,MAAM,WAAW,MAAM,cAAc,gBAAgB,IAAI,OAAO,UAAU,UAAU;IACpF,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,UAAU,QAAQ;IAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KAAE,OAAO,IAAI;KAAO,MAAM;IAAS,CAAC,CAC7E,CAAC;GACH,CAAC;EACH;EACA,KAAK,OAAO,KAAK,kBAAkB;GAAE,OAAO,IAAI;GAAO,UAAU;EAAG,CAAC;EACrE,OAAO;CACT;AACF"}
+{"version":3,"file":"service.js","names":[],"sources":["../../src/organizations/service.ts"],"sourcesContent":["// organizations context — service implementation (inbound port).\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport type {\n  MemberRecord,\n  MembersRepository,\n  MemberWriteContext,\n  OrgAdmin,\n  OrganizationService,\n  OrganizationsRepository,\n  OrganizationsUnitOfWork,\n} from './ports.js';\nimport type { Invite, Organization, OrgUser } from './model.js';\nimport { capability, type Role, STAFF_ROLES, STUDENT_ROLE } from './roles.js';\nimport {\n  InviteError,\n  type Member,\n  type MemberRoleChange,\n  type MembersQuery,\n  OrganizationRuleError,\n  type Page,\n} from './members.js';\nimport type {\n  AcceptInviteInput,\n  AddOrgUserInput,\n  CreateInviteInput,\n  CreateOrganizationInput,\n  ResendStudentInviteInput,\n  UpdateOrganizationInput,\n  UpdateOrgUserInput,\n} from './types.js';\nimport { organizationEvents, type OrganizationEvent } from './events.js';\nimport type { Logger, NewDomainEvent } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport { generateInviteToken, hashInviteToken } from '../shared/invite-token.js';\nimport { ForbiddenError, NotFoundError } from '../shared/errors.js';\nimport type { Actor } from '../shared/actor.js';\nimport type { IdentityService } from '../identity/index.js';\nimport { genId } from '../shared/id.js';\n\nconst INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;\n\ntype NewOrganizationEvent = NewDomainEvent<OrganizationEvent>;\n\ninterface MemberWrite {\n  orgUserId: string;\n  actorOrgUserId: string;\n  demote: boolean;\n}\n\nexport interface InviteUrls {\n  studentPortalUrl: string;\n  adminAppUrl: string;\n}\n\nfunction toMember(r: MemberRecord): Member {\n  return {\n    id: r.id,\n    firstName: r.firstName,\n    lastName: r.lastName,\n    email: r.email,\n    image: r.image,\n    role: r.role,\n    status: r.status,\n    joinedAt: r.joinedAt,\n    invitedAt: r.invitedAt,\n  };\n}\n\nexport type OrganizationServiceParams = {\n  repo: OrganizationsRepository;\n  membersRepo: MembersRepository;\n  people: IdentityService;\n  uow: OrganizationsUnitOfWork;\n  orgAdmin: () => OrgAdmin;\n  logger?: Logger;\n  mailer?: Pick<Mailer, 'send'>;\n  inviteUrls?: InviteUrls;\n};\n\nexport class OrganizationServiceImpl implements OrganizationService {\n  private readonly repo: OrganizationsRepository;\n  private readonly membersRepo: MembersRepository;\n  private readonly people: IdentityService;\n  private readonly uow: OrganizationsUnitOfWork;\n  private readonly orgAdmin: () => OrgAdmin;\n  private readonly logger: Logger;\n  private readonly mailer?: Pick<Mailer, 'send'>;\n  private readonly inviteUrls?: InviteUrls;\n  private readonly memberWrites = new AsyncLocalStorage<MemberWrite>();\n\n  constructor(params: OrganizationServiceParams) {\n    this.repo = params.repo;\n    this.membersRepo = params.membersRepo;\n    this.people = params.people;\n    this.uow = params.uow;\n    this.orgAdmin = params.orgAdmin;\n    this.logger = params.logger ?? noopLogger;\n    this.mailer = params.mailer;\n    this.inviteUrls = params.inviteUrls;\n  }\n\n  async createOrganization(input: CreateOrganizationInput): Promise<Organization> {\n    const created = await this.uow.run(async ({ organizations, outbox }) => {\n      const id = genId('organization');\n\n      const created = await organizations.create({\n        id,\n        // The auth provider adopts this id for its own org row, so the org is\n        // its own external id — a lookup by either id lands on the same row.\n        externalId: input.externalId ?? id,\n        name: input.name ?? `My Org`,\n        slug: input.slug ?? '',\n        ownerId: input.ownerId,\n      });\n      await outbox.append([\n        organizationEvents.organizationCreated.make({\n          orgId: created.id,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('organization created', { orgId: created.id, slug: created.slug });\n    return created;\n  }\n\n  async updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization> {\n    const updatedOrg = await this.uow.run(async ({ organizations, outbox }) => {\n      const updated = await organizations.update(id, {\n        name: input.name,\n        slug: input.slug,\n      });\n      if (!updated) {\n        throw new NotFoundError('Organization', id);\n      }\n      await outbox.append([\n        organizationEvents.organizationUpdated.make({ orgId: id, data: updated }),\n      ]);\n      return updated;\n    });\n\n    this.logger.info('organization updated', { updatedOrg });\n    return updatedOrg!;\n  }\n\n  async deleteOrganization(id: string): Promise<Organization> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const deleted = await organizations.delete(id);\n\n      await outbox.append([\n        organizationEvents.organizationDeleted.make({\n          orgId: deleted.id,\n          data: deleted,\n        }),\n      ]);\n      return deleted;\n    });\n    this.logger.info('organization deleted', { orgId: deleted.id });\n    return deleted;\n  }\n\n  async addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser> {\n    const existing = await this.repo.findOrgUser(orgId, userId);\n    if (existing) {\n      return this.updateOrgUser(orgId, userId, { role, status: 'active' });\n    }\n    const orgUser = await this.uow.run(async ({ organizations, outbox }) => {\n      const created = await organizations.createOrgUser({ orgId, role, userId, status: 'active' });\n      await outbox.append([organizationEvents.orgUserLinked.make({ orgId, data: created })]);\n      return created;\n    });\n    this.logger.info('user added to organization', { orgId, userId, role });\n    return orgUser;\n  }\n\n  async removeOrgUser(orgId: string, userId: string): Promise<OrgUser> {\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('Member', userId);\n      }\n      const write = this.memberWrite(orgUser.id);\n      if (write?.demote) {\n        const demoted = await organizations.updateOrgUser(orgId, orgUser.id, {\n          role: STUDENT_ROLE,\n        });\n        if (!demoted) {\n          throw new NotFoundError('Member', orgUser.id);\n        }\n        if (orgUser.role !== STUDENT_ROLE) {\n          await outbox.append([\n            organizationEvents.orgUserUpdated.make({\n              orgId,\n              data: demoted,\n              metadata: { actorOrgUserId: write.actorOrgUserId },\n            }),\n          ]);\n        }\n        return demoted;\n      }\n      if (orgUser.role === STUDENT_ROLE) {\n        return orgUser;\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, orgUser.id);\n      if (!deletedUser) {\n        throw new NotFoundError('Member', orgUser.id);\n      }\n      await outbox.append([\n        organizationEvents.orgUserDeleted.make({\n          orgId,\n          data: deletedUser,\n        }),\n      ]);\n      return deletedUser;\n    });\n    this.logger.info('org user removed', { orgId, userId, orgUserId: deleted.id });\n    return deleted;\n  }\n\n  async updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser> {\n    const updated = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('Member', userId);\n      }\n      const next = await organizations.updateOrgUser(orgId, orgUser.id, patch);\n      if (!next) {\n        throw new NotFoundError('Member', orgUser.id);\n      }\n      if (patch.role !== undefined && patch.role !== orgUser.role) {\n        const actorOrgUserId = this.memberWrite(orgUser.id)?.actorOrgUserId;\n        await outbox.append([\n          organizationEvents.orgUserUpdated.make({\n            orgId,\n            data: next,\n            ...(actorOrgUserId !== undefined && { metadata: { actorOrgUserId } }),\n          }),\n        ]);\n      }\n      return next;\n    });\n    this.logger.info('org user updated', { orgId, userId, orgUserId: updated.id, patch });\n    return updated;\n  }\n\n  async createInvite(actor: Actor, input: CreateInviteInput): Promise<Invite> {\n    const { orgId, email, role, inviterUserId, firstName, lastName } = input;\n    this.assertManagesUsers(actor, orgId);\n    this.assertNotOwner(role, orgId);\n    const sendEmail = input.sendEmail ?? true;\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n\n    // A student belongs to the org from the moment an admin adds them, not from\n    // the moment they click a link — so the person exists before the invite\n    // does. Staff are excluded: their org_users row is mirrored from the auth\n    // provider's member record, which does not exist until they join.\n    const person =\n      role === STUDENT_ROLE\n        ? ((await this.people.getUserByEmail(email)) ??\n          (await this.people.createUser({\n            email,\n            ...(firstName !== undefined && { firstName }),\n            ...(lastName !== undefined && { lastName }),\n          })))\n        : null;\n\n    const invite = await this.uow.run(async ({ organizations, outbox }) => {\n      const events: NewOrganizationEvent[] = [];\n      if (person) {\n        const orgUser = await organizations.createOrgUser({\n          orgId,\n          userId: person.id,\n          role: STUDENT_ROLE,\n          status: 'invited',\n        });\n        events.push(organizationEvents.studentCreated.make({ orgId, data: orgUser }));\n      }\n      const row = await organizations.upsertPendingInvite(orgId, {\n        email,\n        role,\n        invitedBy: inviterUserId,\n        tokenHash,\n        expiresAt,\n      });\n      events.push(organizationEvents.inviteCreated.make({ orgId, data: row }));\n      await outbox.append(events);\n      return row;\n    });\n\n    if (sendEmail) {\n      // TODO make this workflow durable\n      try {\n        await this.sendInviteEmail(invite, token);\n      } catch (err) {\n        // A failed email must not abort invite creation: the token is already\n        // minted and recorded, so the admin can fix transport and resend.\n        this.logger.error('failed to send invite email', {\n          orgId,\n          inviteId: invite.id,\n          role: invite.role,\n          err: err instanceof Error ? err : new Error(String(err)),\n        });\n      }\n    }\n\n    this.logger.info('invite created', { orgId, inviteId: invite.id, role, sendEmail });\n    return invite;\n  }\n\n  async resendStudentInvite(actor: Actor, input: ResendStudentInviteInput): Promise<void> {\n    const { orgId, orgUserId, inviterUserId } = input;\n    this.assertManagesUsers(actor, orgId);\n    const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);\n    if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n      throw new NotFoundError('Student', orgUserId);\n    }\n    if (orgUser.status === 'active') {\n      throw new OrganizationRuleError('That student has already accepted their invitation');\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person) {\n      throw new NotFoundError('User', orgUser.userId);\n    }\n    const pending = await this.repo.findPendingInvite(orgId, person.email);\n    if (!pending) {\n      throw new NotFoundError('Invite', person.email);\n    }\n    const { token, tokenHash } = generateInviteToken();\n    const expiresAt = new Date(Date.now() + INVITE_TTL_MS);\n    const invite = await this.repo.setInviteToken(orgId, pending.id, tokenHash, expiresAt);\n    if (!invite) {\n      throw new NotFoundError('Invite', pending.id);\n    }\n    await this.sendInviteEmail(invite, token);\n    this.logger.info('student invite resent', {\n      orgId,\n      orgUserId,\n      inviteId: invite.id,\n      inviterUserId,\n    });\n  }\n\n  async peekInvite(token: string): Promise<Invite | null> {\n    const invite = await this.repo.findInviteByTokenHash(hashInviteToken(token));\n    if (!invite || invite.status !== 'pending') {\n      return null;\n    }\n    if (invite.expiresAt && invite.expiresAt < new Date()) {\n      return null;\n    }\n    return invite;\n  }\n\n  async acceptInvite(input: AcceptInviteInput): Promise<OrgUser> {\n    const invite = await this.peekInvite(input.token);\n    if (!invite) {\n      this.logger.warn('invite accept refused: token invalid or expired');\n      throw new InviteError('invalid invite');\n    }\n    if (invite.email.toLowerCase() !== input.email.toLowerCase()) {\n      this.logger.warn('invite accept refused: email mismatch', {\n        orgId: invite.orgId,\n        inviteId: invite.id,\n      });\n      throw new InviteError('emails must match');\n    }\n    const org = await this.repo.findById(invite.orgId);\n    if (!org) {\n      throw new InviteError('Org not found');\n    }\n\n    const orgUser =\n      invite.role === STUDENT_ROLE\n        ? await this.acceptStudentInvite(invite, input.userId)\n        : await this.acceptStaffInvite(invite, org, input.userId);\n    this.logger.info('invite accepted', { orgId: invite.orgId, userId: input.userId });\n    return orgUser;\n  }\n\n  private async acceptStudentInvite(invite: Invite, userId: string): Promise<OrgUser> {\n    return this.uow.run(async ({ organizations, outbox }) => {\n      const existing = await organizations.findOrgUser(invite.orgId, userId);\n      if (!existing) {\n        throw new NotFoundError('Member', userId);\n      }\n      const activated = await organizations.updateOrgUser(invite.orgId, existing.id, {\n        status: 'active',\n      });\n      if (!activated) {\n        throw new NotFoundError('Member', existing.id);\n      }\n      const acceptedInvite = await organizations.setInviteStatus(\n        invite.orgId,\n        invite.id,\n        'accepted',\n      );\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      await outbox.append([\n        organizationEvents.inviteAccepted.make({ orgId: invite.orgId, data: acceptedInvite }),\n        organizationEvents.studentLinked.make({ orgId: invite.orgId, data: activated }),\n      ]);\n      return activated;\n    });\n  }\n\n  private async acceptStaffInvite(\n    invite: Invite,\n    org: Organization,\n    userId: string,\n  ): Promise<OrgUser> {\n    const person = await this.people.getUserById(userId);\n    if (!person?.externalId) {\n      throw new NotFoundError('User', userId);\n    }\n    await this.orgAdmin().grantMembership(org.externalId ?? org.id, person.externalId, invite.role);\n    return this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUser(invite.orgId, userId);\n      if (!orgUser) {\n        throw new NotFoundError('Member', userId);\n      }\n      const acceptedInvite = await organizations.setInviteStatus(\n        invite.orgId,\n        invite.id,\n        'accepted',\n      );\n      if (!acceptedInvite) {\n        throw new NotFoundError('Invite', invite.id);\n      }\n      await outbox.append([\n        organizationEvents.inviteAccepted.make({ orgId: invite.orgId, data: acceptedInvite }),\n      ]);\n      return orgUser;\n    });\n  }\n\n  // By identity USER id — `(org_id, user_id)` is unique. Every caller (scope\n  // resolution, the MCP principal, the member routes) asks \"what is this person\n  // in this org\", never \"what is this org_users row\".\n  getOrgUserById(orgId: string, id: string): Promise<OrgUser | null> {\n    return this.repo.findOrgUserById(orgId, id);\n  }\n\n  async getOrgUsersByIds(orgId: string, ids: string[]): Promise<OrgUser[]> {\n    const unique = [...new Set(ids)];\n    return unique.length > 0 ? this.repo.findOrgUsersByIds(orgId, unique) : [];\n  }\n\n  async getOrgUser(orgId: string, userId: string): Promise<OrgUser | null> {\n    return this.repo.findOrgUser(orgId, userId);\n  }\n\n  async deleteOrgUser(orgId: string, actor: Actor, id: string): Promise<OrgUser> {\n    this.assertManagesUsers(actor, orgId);\n    const deleted = await this.uow.run(async ({ organizations, outbox }) => {\n      const orgUser = await organizations.findOrgUserById(orgId, id);\n      if (!orgUser || orgUser.role !== STUDENT_ROLE) {\n        throw new NotFoundError('Student', id);\n      }\n      const deletedUser = await organizations.deleteOrgUser(orgId, id);\n      if (!deletedUser) {\n        throw new NotFoundError('Student', id);\n      }\n      await outbox.append([organizationEvents.studentDeleted.make({ orgId, data: orgUser })]);\n      return deletedUser;\n    });\n    this.logger.info('org user deleted', { orgId, orgUserId: id });\n    return deleted;\n  }\n\n  async getOrgUsersForUser(userId: string): Promise<OrgUser[]> {\n    return this.repo.findOrgUsersByUser(userId);\n  }\n\n  async getById(id: string): Promise<Organization | null> {\n    return this.repo.findById(id);\n  }\n\n  orgIds(): Promise<string[]> {\n    return this.repo.listIds();\n  }\n\n  private async sendInviteEmail(invite: Invite, token: string): Promise<void> {\n    if (!this.mailer || !this.inviteUrls) {\n      throw new Error('invite delivery is not configured (mailer / invite urls missing)');\n    }\n    const { email, role } = invite;\n    const isStudent = role === STUDENT_ROLE;\n    const base = isStudent\n      ? `${this.inviteUrls.studentPortalUrl}/welcome`\n      : `${this.inviteUrls.adminAppUrl}/invite`;\n    // The portal resolves the token to the invited email, so the link carries\n    // only the token. The admin app still reads it from the query.\n    const query = isStudent\n      ? new URLSearchParams({ token })\n      : new URLSearchParams({ token, email });\n    const inviteUrl = `${base}?${query.toString()}`;\n    if (role === STUDENT_ROLE) {\n      await this.mailer.send(email, 'studentInvite', { inviteUrl, studentName: email });\n    } else {\n      await this.mailer.send(email, 'memberInvite', {\n        inviteUrl,\n        inviterName: 'Your team',\n        role,\n      });\n    }\n  }\n\n  async getByExternalId(externalId: string): Promise<Organization | null> {\n    return this.repo.findByExternalId(externalId);\n  }\n\n  async getBySlug(slug: string): Promise<Organization | null> {\n    return this.repo.findBySlug(slug);\n  }\n\n  staffOrgUserIds(orgId: string): Promise<string[]> {\n    return this.repo.findOrgUserIdsByRole(orgId, [...STAFF_ROLES]);\n  }\n\n  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>> {\n    return this.membersRepo.list(orgId, query);\n  }\n\n  async updateMemberRole(\n    ctx: MemberWriteContext,\n    actor: Actor,\n    id: string,\n    role: Role,\n  ): Promise<MemberRoleChange | null> {\n    this.assertManagesUsers(actor, ctx.orgId);\n    this.assertNotOwner(role, ctx.orgId);\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return this.promoteStudent(ctx, actor, id, role);\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('role change rejected: owner role immutable', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner role cannot be reassigned');\n    }\n    if (member.kind !== 'member' || !member.userExternalId) {\n      this.logger.warn('role change rejected: not an active member', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('Only active members can have their role changed');\n    }\n    if (role === STUDENT_ROLE) {\n      return this.demoteModerator(ctx, actor, member, member.userExternalId);\n    }\n    const userExternalId = member.userExternalId;\n    await this.asActor(actor, id, false, () =>\n      this.orgAdmin().updateRole(ctx, userExternalId, role),\n    );\n    const updated = await this.membersRepo.findById(ctx.orgId, id);\n    this.logger.info('member role updated', { orgId: ctx.orgId, memberId: id, role });\n    return updated ? toMember(updated) : null;\n  }\n\n  private async demoteModerator(\n    ctx: MemberWriteContext,\n    actor: Actor,\n    member: MemberRecord,\n    userExternalId: string,\n  ): Promise<MemberRoleChange | null> {\n    if (member.role !== 'moderator') {\n      this.logger.warn('role change rejected: only a moderator becomes a student', {\n        orgId: ctx.orgId,\n        memberId: member.id,\n      });\n      throw new OrganizationRuleError('Only a moderator can be made a student');\n    }\n    await this.asActor(actor, member.id, true, () =>\n      this.orgAdmin().removeMember(ctx, userExternalId),\n    );\n    const orgUser = await this.repo.findOrgUserById(ctx.orgId, member.id);\n    if (!orgUser) {\n      return null;\n    }\n    this.logger.info('moderator made a student', { orgId: ctx.orgId, memberId: member.id });\n    return { ...toMember(member), role: orgUser.role, status: orgUser.status };\n  }\n\n  private async promoteStudent(\n    ctx: MemberWriteContext,\n    actor: Actor,\n    id: string,\n    role: Role,\n  ): Promise<MemberRoleChange | null> {\n    const orgUser = await this.repo.findOrgUserById(ctx.orgId, id);\n    if (!orgUser) {\n      return null;\n    }\n    if (orgUser.role !== STUDENT_ROLE || role === STUDENT_ROLE) {\n      this.logger.warn('role change rejected: not an active member', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('Only active members can have their role changed');\n    }\n    const person = await this.people.getUserById(orgUser.userId);\n    if (!person?.externalId) {\n      this.logger.warn('role change rejected: student has no account', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('That student has not joined yet');\n    }\n    const org = await this.repo.findById(ctx.orgId);\n    if (!org) {\n      return null;\n    }\n    const orgExternalId = org.externalId ?? org.id;\n    const userExternalId = person.externalId;\n    await this.asActor(actor, orgUser.id, false, async () => {\n      await this.orgAdmin().grantMembership(orgExternalId, userExternalId, role);\n      if (!(await this.membersRepo.findById(ctx.orgId, id))) {\n        await this.orgAdmin().updateRole(ctx, userExternalId, role);\n      }\n    });\n    const updated = await this.membersRepo.findById(ctx.orgId, id);\n    if (!updated) {\n      this.logger.warn('role change rejected: membership not mirrored', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The role change did not take effect');\n    }\n    this.logger.info('student promoted', { orgId: ctx.orgId, memberId: id, role });\n    return toMember(updated);\n  }\n\n  private asActor<T>(\n    actor: Actor,\n    orgUserId: string,\n    demote: boolean,\n    write: () => Promise<T>,\n  ): Promise<T> {\n    return this.memberWrites.run({ orgUserId, actorOrgUserId: actor.id, demote }, write);\n  }\n\n  private memberWrite(orgUserId: string): MemberWrite | undefined {\n    const write = this.memberWrites.getStore();\n    return write?.orgUserId === orgUserId ? write : undefined;\n  }\n\n  private assertManagesUsers(actor: Actor, orgId: string): void {\n    if (capability(actor.role, 'manage_users') !== true) {\n      this.logger.warn('member write rejected: actor cannot manage users', {\n        orgId,\n        actorOrgUserId: actor.id,\n      });\n      throw new ForbiddenError('Only an owner or admin can manage members');\n    }\n  }\n\n  private assertNotOwner(role: Role, orgId: string): void {\n    if (role === 'owner') {\n      this.logger.warn('member write rejected: owner cannot be granted', { orgId });\n      throw new OrganizationRuleError('Ownership cannot be granted');\n    }\n  }\n\n  async removeMember(ctx: MemberWriteContext, actor: Actor, id: string): Promise<boolean> {\n    this.assertManagesUsers(actor, ctx.orgId);\n    const member = await this.membersRepo.findById(ctx.orgId, id);\n    if (!member) {\n      return false;\n    }\n    if (member.role === 'owner') {\n      this.logger.warn('member removal rejected: owner cannot be removed', {\n        orgId: ctx.orgId,\n        memberId: id,\n      });\n      throw new OrganizationRuleError('The owner cannot be removed');\n    }\n    if (member.kind === 'member' && member.userExternalId) {\n      await this.orgAdmin().removeMember(ctx, member.userExternalId);\n    } else if (member.kind === 'invite' && member.inviteId) {\n      const inviteId = member.inviteId;\n      await this.uow.run(async ({ organizations, outbox }) => {\n        const canceled = await organizations.setInviteStatus(ctx.orgId, inviteId, 'canceled');\n        if (!canceled) {\n          throw new NotFoundError('Invite', inviteId);\n        }\n        await outbox.append([\n          organizationEvents.inviteCanceled.make({ orgId: ctx.orgId, data: canceled }),\n        ]);\n      });\n    }\n    this.logger.info('member removed', { orgId: ctx.orgId, memberId: id });\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;;AAwCA,MAAM,gBAAgB,QAAc,KAAK;AAezC,SAAS,SAAS,GAAyB;CACzC,OAAO;EACL,IAAI,EAAE;EACN,WAAW,EAAE;EACb,UAAU,EAAE;EACZ,OAAO,EAAE;EACT,OAAO,EAAE;EACT,MAAM,EAAE;EACR,QAAQ,EAAE;EACV,UAAU,EAAE;EACZ,WAAW,EAAE;CACf;AACF;AAaA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,eAAgC,IAAI,kBAA+B;CAEnE,YAAY,QAAmC;EAC7C,KAAK,OAAO,OAAO;EACnB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO;EACrB,KAAK,MAAM,OAAO;EAClB,KAAK,WAAW,OAAO;EACvB,KAAK,SAAS,OAAO,UAAU;EAC/B,KAAK,SAAS,OAAO;EACrB,KAAK,aAAa,OAAO;CAC3B;CAEA,MAAM,mBAAmB,OAAuD;EAC9E,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,KAAK,MAAM,cAAc;GAE/B,MAAM,UAAU,MAAM,cAAc,OAAO;IACzC;IAGA,YAAY,MAAM,cAAc;IAChC,MAAM,MAAM,QAAQ;IACpB,MAAM,MAAM,QAAQ;IACpB,SAAS,MAAM;GACjB,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB;GAAE,OAAO,QAAQ;GAAI,MAAM,QAAQ;EAAK,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAY,OAAuD;EAC1F,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACzE,MAAM,UAAU,MAAM,cAAc,OAAO,IAAI;IAC7C,MAAM,MAAM;IACZ,MAAM,MAAM;GACd,CAAC;GACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,gBAAgB,EAAE;GAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAAE,OAAO;IAAI,MAAM;GAAQ,CAAC,CAC1E,CAAC;GACD,OAAO;EACT,CAAC;EAED,KAAK,OAAO,KAAK,wBAAwB,EAAE,WAAW,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,mBAAmB,IAAmC;EAC1D,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,oBAAoB,KAAK;IAC1C,OAAO,QAAQ;IACf,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,wBAAwB,EAAE,OAAO,QAAQ,GAAG,CAAC;EAC9D,OAAO;CACT;CAEA,MAAM,WAAW,EAAE,OAAO,QAAQ,QAA2C;EAE3E,IAAI,MADmB,KAAK,KAAK,YAAY,OAAO,MAAM,GAExD,OAAO,KAAK,cAAc,OAAO,QAAQ;GAAE;GAAM,QAAQ;EAAS,CAAC;EAErE,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,cAAc;IAAE;IAAO;IAAM;IAAQ,QAAQ;GAAS,CAAC;GAC3F,MAAM,OAAO,OAAO,CAAC,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC,CAAC;GACrF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,8BAA8B;GAAE;GAAO;GAAQ;EAAK,CAAC;EACtE,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,QAAkC;EACnE,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,MAAM;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,QAAQ,KAAK,YAAY,QAAQ,EAAE;GACzC,IAAI,OAAO,QAAQ;IACjB,MAAM,UAAU,MAAM,cAAc,cAAc,OAAO,QAAQ,IAAI,EACnE,MAAM,aACR,CAAC;IACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;IAE9C,IAAI,QAAQ,SAAA,WACV,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KACrC;KACA,MAAM;KACN,UAAU,EAAE,gBAAgB,MAAM,eAAe;IACnD,CAAC,CACH,CAAC;IAEH,OAAO;GACT;GACA,IAAI,QAAQ,SAAA,WACV,OAAO;GAET,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,QAAQ,EAAE;GACvE,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;GAE9C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IACrC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO;GAAQ,WAAW,QAAQ;EAAG,CAAC;EAC7E,OAAO;CACT;CAEA,MAAM,cAAc,OAAe,QAAgB,OAA6C;EAC9F,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,MAAM;GAC7D,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,OAAO,MAAM,cAAc,cAAc,OAAO,QAAQ,IAAI,KAAK;GACvE,IAAI,CAAC,MACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;GAE9C,IAAI,MAAM,SAAS,KAAA,KAAa,MAAM,SAAS,QAAQ,MAAM;IAC3D,MAAM,iBAAiB,KAAK,YAAY,QAAQ,EAAE,CAAC,EAAE;IACrD,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KACrC;KACA,MAAM;KACN,GAAI,mBAAmB,KAAA,KAAa,EAAE,UAAU,EAAE,eAAe,EAAE;IACrE,CAAC,CACH,CAAC;GACH;GACA,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO;GAAQ,WAAW,QAAQ;GAAI;EAAM,CAAC;EACpF,OAAO;CACT;CAEA,MAAM,aAAa,OAAc,OAA2C;EAC1E,MAAM,EAAE,OAAO,OAAO,MAAM,eAAe,WAAW,aAAa;EACnE,KAAK,mBAAmB,OAAO,KAAK;EACpC,KAAK,eAAe,MAAM,KAAK;EAC/B,MAAM,YAAY,MAAM,aAAa;EACrC,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EAMrD,MAAM,SACJ,SAAA,YACM,MAAM,KAAK,OAAO,eAAe,KAAK,KACvC,MAAM,KAAK,OAAO,WAAW;GAC5B;GACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;EAC3C,CAAC,IACD;EAEN,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACrE,MAAM,SAAiC,CAAC;GACxC,IAAI,QAAQ;IACV,MAAM,UAAU,MAAM,cAAc,cAAc;KAChD;KACA,QAAQ,OAAO;KACf,MAAM;KACN,QAAQ;IACV,CAAC;IACD,OAAO,KAAK,mBAAmB,eAAe,KAAK;KAAE;KAAO,MAAM;IAAQ,CAAC,CAAC;GAC9E;GACA,MAAM,MAAM,MAAM,cAAc,oBAAoB,OAAO;IACzD;IACA;IACA,WAAW;IACX;IACA;GACF,CAAC;GACD,OAAO,KAAK,mBAAmB,cAAc,KAAK;IAAE;IAAO,MAAM;GAAI,CAAC,CAAC;GACvE,MAAM,OAAO,OAAO,MAAM;GAC1B,OAAO;EACT,CAAC;EAED,IAAI,WAEF,IAAI;GACF,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EAC1C,SAAS,KAAK;GAGZ,KAAK,OAAO,MAAM,+BAA+B;IAC/C;IACA,UAAU,OAAO;IACjB,MAAM,OAAO;IACb,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;GACzD,CAAC;EACH;EAGF,KAAK,OAAO,KAAK,kBAAkB;GAAE;GAAO,UAAU,OAAO;GAAI;GAAM;EAAU,CAAC;EAClF,OAAO;CACT;CAEA,MAAM,oBAAoB,OAAc,OAAgD;EACtF,MAAM,EAAE,OAAO,WAAW,kBAAkB;EAC5C,KAAK,mBAAmB,OAAO,KAAK;EACpC,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,OAAO,SAAS;EAChE,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,SAAS;EAE9C,IAAI,QAAQ,WAAW,UACrB,MAAM,IAAI,sBAAsB,oDAAoD;EAEtF,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,QAAQ,QAAQ,MAAM;EAEhD,MAAM,UAAU,MAAM,KAAK,KAAK,kBAAkB,OAAO,OAAO,KAAK;EACrE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,OAAO,KAAK;EAEhD,MAAM,EAAE,OAAO,cAAc,oBAAoB;EACjD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa;EACrD,MAAM,SAAS,MAAM,KAAK,KAAK,eAAe,OAAO,QAAQ,IAAI,WAAW,SAAS;EACrF,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,QAAQ,EAAE;EAE9C,MAAM,KAAK,gBAAgB,QAAQ,KAAK;EACxC,KAAK,OAAO,KAAK,yBAAyB;GACxC;GACA;GACA,UAAU,OAAO;GACjB;EACF,CAAC;CACH;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,SAAS,MAAM,KAAK,KAAK,sBAAsB,gBAAgB,KAAK,CAAC;EAC3E,IAAI,CAAC,UAAU,OAAO,WAAW,WAC/B,OAAO;EAET,IAAI,OAAO,aAAa,OAAO,4BAAY,IAAI,KAAK,GAClD,OAAO;EAET,OAAO;CACT;CAEA,MAAM,aAAa,OAA4C;EAC7D,MAAM,SAAS,MAAM,KAAK,WAAW,MAAM,KAAK;EAChD,IAAI,CAAC,QAAQ;GACX,KAAK,OAAO,KAAK,iDAAiD;GAClE,MAAM,IAAI,YAAY,gBAAgB;EACxC;EACA,IAAI,OAAO,MAAM,YAAY,MAAM,MAAM,MAAM,YAAY,GAAG;GAC5D,KAAK,OAAO,KAAK,yCAAyC;IACxD,OAAO,OAAO;IACd,UAAU,OAAO;GACnB,CAAC;GACD,MAAM,IAAI,YAAY,mBAAmB;EAC3C;EACA,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,OAAO,KAAK;EACjD,IAAI,CAAC,KACH,MAAM,IAAI,YAAY,eAAe;EAGvC,MAAM,UACJ,OAAO,SAAA,YACH,MAAM,KAAK,oBAAoB,QAAQ,MAAM,MAAM,IACnD,MAAM,KAAK,kBAAkB,QAAQ,KAAK,MAAM,MAAM;EAC5D,KAAK,OAAO,KAAK,mBAAmB;GAAE,OAAO,OAAO;GAAO,QAAQ,MAAM;EAAO,CAAC;EACjF,OAAO;CACT;CAEA,MAAc,oBAAoB,QAAgB,QAAkC;EAClF,OAAO,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACvD,MAAM,WAAW,MAAM,cAAc,YAAY,OAAO,OAAO,MAAM;GACrE,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,YAAY,MAAM,cAAc,cAAc,OAAO,OAAO,SAAS,IAAI,EAC7E,QAAQ,SACV,CAAC;GACD,IAAI,CAAC,WACH,MAAM,IAAI,cAAc,UAAU,SAAS,EAAE;GAE/C,MAAM,iBAAiB,MAAM,cAAc,gBACzC,OAAO,OACP,OAAO,IACP,UACF;GACA,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAe,CAAC,GACpF,mBAAmB,cAAc,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAU,CAAC,CAChF,CAAC;GACD,OAAO;EACT,CAAC;CACH;CAEA,MAAc,kBACZ,QACA,KACA,QACkB;EAClB,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,MAAM;EACnD,IAAI,CAAC,QAAQ,YACX,MAAM,IAAI,cAAc,QAAQ,MAAM;EAExC,MAAM,KAAK,SAAS,CAAC,CAAC,gBAAgB,IAAI,cAAc,IAAI,IAAI,OAAO,YAAY,OAAO,IAAI;EAC9F,OAAO,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACvD,MAAM,UAAU,MAAM,cAAc,YAAY,OAAO,OAAO,MAAM;GACpE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,UAAU,MAAM;GAE1C,MAAM,iBAAiB,MAAM,cAAc,gBACzC,OAAO,OACP,OAAO,IACP,UACF;GACA,IAAI,CAAC,gBACH,MAAM,IAAI,cAAc,UAAU,OAAO,EAAE;GAE7C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;IAAE,OAAO,OAAO;IAAO,MAAM;GAAe,CAAC,CACtF,CAAC;GACD,OAAO;EACT,CAAC;CACH;CAKA,eAAe,OAAe,IAAqC;EACjE,OAAO,KAAK,KAAK,gBAAgB,OAAO,EAAE;CAC5C;CAEA,MAAM,iBAAiB,OAAe,KAAmC;EACvE,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;EAC/B,OAAO,OAAO,SAAS,IAAI,KAAK,KAAK,kBAAkB,OAAO,MAAM,IAAI,CAAC;CAC3E;CAEA,MAAM,WAAW,OAAe,QAAyC;EACvE,OAAO,KAAK,KAAK,YAAY,OAAO,MAAM;CAC5C;CAEA,MAAM,cAAc,OAAe,OAAc,IAA8B;EAC7E,KAAK,mBAAmB,OAAO,KAAK;EACpC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;GACtE,MAAM,UAAU,MAAM,cAAc,gBAAgB,OAAO,EAAE;GAC7D,IAAI,CAAC,WAAW,QAAQ,SAAA,WACtB,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,cAAc,MAAM,cAAc,cAAc,OAAO,EAAE;GAC/D,IAAI,CAAC,aACH,MAAM,IAAI,cAAc,WAAW,EAAE;GAEvC,MAAM,OAAO,OAAO,CAAC,mBAAmB,eAAe,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC,CAAC;GACtF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,oBAAoB;GAAE;GAAO,WAAW;EAAG,CAAC;EAC7D,OAAO;CACT;CAEA,MAAM,mBAAmB,QAAoC;EAC3D,OAAO,KAAK,KAAK,mBAAmB,MAAM;CAC5C;CAEA,MAAM,QAAQ,IAA0C;EACtD,OAAO,KAAK,KAAK,SAAS,EAAE;CAC9B;CAEA,SAA4B;EAC1B,OAAO,KAAK,KAAK,QAAQ;CAC3B;CAEA,MAAc,gBAAgB,QAAgB,OAA8B;EAC1E,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,YACxB,MAAM,IAAI,MAAM,kEAAkE;EAEpF,MAAM,EAAE,OAAO,SAAS;EACxB,MAAM,YAAY,SAAS;EAS3B,MAAM,YAAY,GARL,YACT,GAAG,KAAK,WAAW,iBAAiB,YACpC,GAAG,KAAK,WAAW,YAAY,SAMT,IAHZ,YACV,IAAI,gBAAgB,EAAE,MAAM,CAAC,IAC7B,IAAI,gBAAgB;GAAE;GAAO;EAAM,CAAC,EAAA,CACL,SAAS;EAC5C,IAAI,SAAA,WACF,MAAM,KAAK,OAAO,KAAK,OAAO,iBAAiB;GAAE;GAAW,aAAa;EAAM,CAAC;OAEhF,MAAM,KAAK,OAAO,KAAK,OAAO,gBAAgB;GAC5C;GACA,aAAa;GACb;EACF,CAAC;CAEL;CAEA,MAAM,gBAAgB,YAAkD;EACtE,OAAO,KAAK,KAAK,iBAAiB,UAAU;CAC9C;CAEA,MAAM,UAAU,MAA4C;EAC1D,OAAO,KAAK,KAAK,WAAW,IAAI;CAClC;CAEA,gBAAgB,OAAkC;EAChD,OAAO,KAAK,KAAK,qBAAqB,OAAO,CAAC,GAAG,WAAW,CAAC;CAC/D;CAEA,YAAY,OAAe,OAA4C;EACrE,OAAO,KAAK,YAAY,KAAK,OAAO,KAAK;CAC3C;CAEA,MAAM,iBACJ,KACA,OACA,IACA,MACkC;EAClC,KAAK,mBAAmB,OAAO,IAAI,KAAK;EACxC,KAAK,eAAe,MAAM,IAAI,KAAK;EACnC,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO,KAAK,eAAe,KAAK,OAAO,IAAI,IAAI;EAEjD,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,qCAAqC;EACvE;EACA,IAAI,OAAO,SAAS,YAAY,CAAC,OAAO,gBAAgB;GACtD,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iDAAiD;EACnF;EACA,IAAI,SAAA,WACF,OAAO,KAAK,gBAAgB,KAAK,OAAO,QAAQ,OAAO,cAAc;EAEvE,MAAM,iBAAiB,OAAO;EAC9B,MAAM,KAAK,QAAQ,OAAO,IAAI,aAC5B,KAAK,SAAS,CAAC,CAAC,WAAW,KAAK,gBAAgB,IAAI,CACtD;EACA,MAAM,UAAU,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC7D,KAAK,OAAO,KAAK,uBAAuB;GAAE,OAAO,IAAI;GAAO,UAAU;GAAI;EAAK,CAAC;EAChF,OAAO,UAAU,SAAS,OAAO,IAAI;CACvC;CAEA,MAAc,gBACZ,KACA,OACA,QACA,gBACkC;EAClC,IAAI,OAAO,SAAS,aAAa;GAC/B,KAAK,OAAO,KAAK,4DAA4D;IAC3E,OAAO,IAAI;IACX,UAAU,OAAO;GACnB,CAAC;GACD,MAAM,IAAI,sBAAsB,wCAAwC;EAC1E;EACA,MAAM,KAAK,QAAQ,OAAO,OAAO,IAAI,YACnC,KAAK,SAAS,CAAC,CAAC,aAAa,KAAK,cAAc,CAClD;EACA,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,IAAI,OAAO,OAAO,EAAE;EACpE,IAAI,CAAC,SACH,OAAO;EAET,KAAK,OAAO,KAAK,4BAA4B;GAAE,OAAO,IAAI;GAAO,UAAU,OAAO;EAAG,CAAC;EACtF,OAAO;GAAE,GAAG,SAAS,MAAM;GAAG,MAAM,QAAQ;GAAM,QAAQ,QAAQ;EAAO;CAC3E;CAEA,MAAc,eACZ,KACA,OACA,IACA,MACkC;EAClC,MAAM,UAAU,MAAM,KAAK,KAAK,gBAAgB,IAAI,OAAO,EAAE;EAC7D,IAAI,CAAC,SACH,OAAO;EAET,IAAI,QAAQ,SAAA,aAAyB,SAAA,WAAuB;GAC1D,KAAK,OAAO,KAAK,8CAA8C;IAC7D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iDAAiD;EACnF;EACA,MAAM,SAAS,MAAM,KAAK,OAAO,YAAY,QAAQ,MAAM;EAC3D,IAAI,CAAC,QAAQ,YAAY;GACvB,KAAK,OAAO,KAAK,gDAAgD;IAC/D,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,iCAAiC;EACnE;EACA,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,IAAI,KAAK;EAC9C,IAAI,CAAC,KACH,OAAO;EAET,MAAM,gBAAgB,IAAI,cAAc,IAAI;EAC5C,MAAM,iBAAiB,OAAO;EAC9B,MAAM,KAAK,QAAQ,OAAO,QAAQ,IAAI,OAAO,YAAY;GACvD,MAAM,KAAK,SAAS,CAAC,CAAC,gBAAgB,eAAe,gBAAgB,IAAI;GACzE,IAAI,CAAE,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE,GACjD,MAAM,KAAK,SAAS,CAAC,CAAC,WAAW,KAAK,gBAAgB,IAAI;EAE9D,CAAC;EACD,MAAM,UAAU,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC7D,IAAI,CAAC,SAAS;GACZ,KAAK,OAAO,KAAK,iDAAiD;IAChE,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,qCAAqC;EACvE;EACA,KAAK,OAAO,KAAK,oBAAoB;GAAE,OAAO,IAAI;GAAO,UAAU;GAAI;EAAK,CAAC;EAC7E,OAAO,SAAS,OAAO;CACzB;CAEA,QACE,OACA,WACA,QACA,OACY;EACZ,OAAO,KAAK,aAAa,IAAI;GAAE;GAAW,gBAAgB,MAAM;GAAI;EAAO,GAAG,KAAK;CACrF;CAEA,YAAoB,WAA4C;EAC9D,MAAM,QAAQ,KAAK,aAAa,SAAS;EACzC,OAAO,OAAO,cAAc,YAAY,QAAQ,KAAA;CAClD;CAEA,mBAA2B,OAAc,OAAqB;EAC5D,IAAI,WAAW,MAAM,MAAM,cAAc,MAAM,MAAM;GACnD,KAAK,OAAO,KAAK,oDAAoD;IACnE;IACA,gBAAgB,MAAM;GACxB,CAAC;GACD,MAAM,IAAI,eAAe,2CAA2C;EACtE;CACF;CAEA,eAAuB,MAAY,OAAqB;EACtD,IAAI,SAAS,SAAS;GACpB,KAAK,OAAO,KAAK,kDAAkD,EAAE,MAAM,CAAC;GAC5E,MAAM,IAAI,sBAAsB,6BAA6B;EAC/D;CACF;CAEA,MAAM,aAAa,KAAyB,OAAc,IAA8B;EACtF,KAAK,mBAAmB,OAAO,IAAI,KAAK;EACxC,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,IAAI,OAAO,EAAE;EAC5D,IAAI,CAAC,QACH,OAAO;EAET,IAAI,OAAO,SAAS,SAAS;GAC3B,KAAK,OAAO,KAAK,oDAAoD;IACnE,OAAO,IAAI;IACX,UAAU;GACZ,CAAC;GACD,MAAM,IAAI,sBAAsB,6BAA6B;EAC/D;EACA,IAAI,OAAO,SAAS,YAAY,OAAO,gBACrC,MAAM,KAAK,SAAS,CAAC,CAAC,aAAa,KAAK,OAAO,cAAc;OACxD,IAAI,OAAO,SAAS,YAAY,OAAO,UAAU;GACtD,MAAM,WAAW,OAAO;GACxB,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,eAAe,aAAa;IACtD,MAAM,WAAW,MAAM,cAAc,gBAAgB,IAAI,OAAO,UAAU,UAAU;IACpF,IAAI,CAAC,UACH,MAAM,IAAI,cAAc,UAAU,QAAQ;IAE5C,MAAM,OAAO,OAAO,CAClB,mBAAmB,eAAe,KAAK;KAAE,OAAO,IAAI;KAAO,MAAM;IAAS,CAAC,CAC7E,CAAC;GACH,CAAC;EACH;EACA,KAAK,OAAO,KAAK,kBAAkB;GAAE,OAAO,IAAI;GAAO,UAAU;EAAG,CAAC;EACrE,OAAO;CACT;AACF"}

package/dist/progress/events.d.ts

@@ -7,7 +7,7 @@ declare const progressEvents: {
     id: string;
     orgId: string;
     orgUserId: string;
-    targetType: "course" | "activity" | "module";
+    targetType: "activity" | "module" | "course";
     targetId: string;
     startedAt: Date;
     position: JsonValue;
@@ -18,7 +18,7 @@ declare const progressEvents: {
     id: string;
     orgId: string;
     orgUserId: string;
-    targetType: "course" | "activity" | "module";
+    targetType: "activity" | "module" | "course";
     targetId: string;
     startedAt: unknown;
     position: unknown;
@@ -26,25 +26,25 @@ declare const progressEvents: {
     createdAt: unknown;
     updatedAt: unknown;
   }, import("zod").ZodObject<{
-    orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
-    startedAt: import("zod").ZodCoercedDate<unknown>;
+    orgId: import("zod").ZodString;
     orgUserId: import("zod").ZodString;
     targetType: import("zod").ZodEnum<{
-      course: "course";
       activity: "activity";
       module: "module";
+      course: "course";
     }>;
     targetId: import("zod").ZodString;
+    startedAt: import("zod").ZodCoercedDate<unknown>;
     completedAt: import("zod").ZodNullable<import("zod").ZodCoercedDate<unknown>>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
   }, import("zod/v4/core").$strip>>;
   progressCompleted: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
     orgId: string;
     orgUserId: string;
-    targetType: "course" | "activity" | "module";
+    targetType: "activity" | "module" | "course";
     targetId: string;
     startedAt: Date;
     position: JsonValue;
@@ -55,7 +55,7 @@ declare const progressEvents: {
     id: string;
     orgId: string;
     orgUserId: string;
-    targetType: "course" | "activity" | "module";
+    targetType: "activity" | "module" | "course";
     targetId: string;
     startedAt: unknown;
     position: unknown;
@@ -63,19 +63,19 @@ declare const progressEvents: {
     createdAt: unknown;
     updatedAt: unknown;
   }, import("zod").ZodObject<{
-    orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
-    startedAt: import("zod").ZodCoercedDate<unknown>;
+    orgId: import("zod").ZodString;
     orgUserId: import("zod").ZodString;
     targetType: import("zod").ZodEnum<{
-      course: "course";
       activity: "activity";
       module: "module";
+      course: "course";
     }>;
     targetId: import("zod").ZodString;
+    startedAt: import("zod").ZodCoercedDate<unknown>;
     completedAt: import("zod").ZodNullable<import("zod").ZodCoercedDate<unknown>>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
   }, import("zod/v4/core").$strip>>;
 };
 type ProgressStarted = EventOf<typeof progressEvents.progressStarted>;

package/dist/reporting/member/index.d.ts

@@ -1,5 +1,5 @@
 import { CourseView, Module } from "../../types/schemas/content.js";
-import { CommunityHome, CommunityHomeSpace, CourseProgressView, DirectoryEntry, DirectoryQuery, DirectoryRow, LockedCommunitySpace, NotificationView, NotificationsView, OpenCommunitySpace } from "./model.js";
+import { CommunityHome, CommunityHomeSpace, CommunityNotificationSettingsView, CourseProgressView, DirectoryEntry, DirectoryQuery, DirectoryRow, LockedCommunitySpace, NotificationItemView, NotificationSettingsCategoryView, NotificationUnreadCounts, NotificationView, NotificationsView, OpenCommunitySpace, OrgNotificationSettingsView, SettingsChannelView } from "./model.js";
 import { MemberReportRepository, MemberReportService } from "./ports.js";
 import { MemberReportServiceImpl } from "./service.js";
-export { type CommunityHome, type CommunityHomeSpace, type CourseProgressView, type CourseView, type DirectoryEntry, type DirectoryQuery, type DirectoryRow, type LockedCommunitySpace, type MemberReportRepository, type MemberReportService, MemberReportServiceImpl, type Module, type NotificationView, type NotificationsView, type OpenCommunitySpace };
+export { type CommunityHome, type CommunityHomeSpace, type CommunityNotificationSettingsView, type CourseProgressView, type CourseView, type DirectoryEntry, type DirectoryQuery, type DirectoryRow, type LockedCommunitySpace, type MemberReportRepository, type MemberReportService, MemberReportServiceImpl, type Module, type NotificationItemView, type NotificationSettingsCategoryView, type NotificationUnreadCounts, type NotificationView, type NotificationsView, type OpenCommunitySpace, type OrgNotificationSettingsView, type SettingsChannelView };

package/dist/reporting/member/model.d.ts

@@ -1,7 +1,10 @@
-import { ActivityView, CourseView, DownloadFile, DownloadView, Module } from "../../types/schemas/content.js";
-import { NotificationKind } from "../../types/schemas/identity.js";
+import { JsonValue } from "../../types/shared.js";
+import { ActivityView, CourseView, DigestSchedule, DownloadFile, DownloadView, Module } from "../../types/schemas/content.js";
+import { SubscriptionView } from "../../types/schemas/discussion.js";
+import { Reason, Scope, SubjectRef } from "../../types/notifications.js";
+import "../../types/index.js";
 import "../../content/index.js";
-import "../../identity/index.js";
+import { ResolvedChannel } from "../../shared/notification-settings.js";
 //#region src/reporting/member/model.d.ts
 /** Per-course progress for the student surface. Derived on read against the
  *  current published structure — never stored. */
@@ -53,6 +56,7 @@ interface OpenCommunitySpace extends CommunityHomeSpaceBase {
     name: string;
   }[];
   links: CommunityHomeLink[];
+  subscription: SubscriptionView | null;
 }
 type CommunityHomeSpace = LockedCommunitySpace | OpenCommunitySpace;
 interface CommunityHome {
@@ -81,18 +85,20 @@ interface CourseProgressView {
   /** Per-activity reported state (the record's position map); absent key = none reported. */
   positions: Record<string, unknown>;
 }
-/** One of the viewer's notifications, with the names of what it refers to.
- *  A post or chat the viewer can no longer see comes back null. */
+interface NotificationItemView {
+  type: SubjectRef['type'];
+  id: string;
+  title?: string;
+  excerpt?: string;
+}
 interface NotificationView {
   id: string;
-  kind: NotificationKind;
-  createdAt: Date;
-  readAt: Date | null;
-  actor: {
-    orgUserId: string;
-    displayName: string | null;
-    imageUrl: string | null;
-  } | null;
+  type: string;
+  scope: Scope;
+  reasons: Reason[];
+  matchedReason: Reason;
+  category: string;
+  display: Record<string, JsonValue>;
   community: {
     id: string;
     title: string;
@@ -101,16 +107,22 @@ interface NotificationView {
     id: string;
     name: string;
   } | null;
-  post: {
-    id: string;
-    title: string;
-  } | null;
-  commentId: string | null;
-  chat: {
-    id: string;
-    title: string;
+  actor: {
+    orgUserId: string;
+    name: string | null;
+    imageUrl: string | null;
   } | null;
-  messageId: string | null;
+  subject: NotificationItemView | null;
+  parent: NotificationItemView | null;
+  createdAt: Date;
+  readAt: Date | null;
+}
+interface NotificationUnreadCounts {
+  org: number;
+  communities: {
+    communityId: string;
+    unread: number;
+  }[];
 }
 interface NotificationsView {
   rows: NotificationView[];
@@ -119,6 +131,27 @@ interface NotificationsView {
   pageSize: number;
   unreadCount: number;
 }
+interface SettingsChannelView extends ResolvedChannel {
+  default: boolean;
+}
+interface NotificationSettingsCategoryView {
+  key: string;
+  perSpace: boolean;
+  channels: SettingsChannelView[];
+  spaces?: {
+    spaceId: string;
+    name: string;
+    channels: SettingsChannelView[];
+  }[];
+}
+interface CommunityNotificationSettingsView {
+  communityId: string;
+  digest: DigestSchedule | null;
+  categories: NotificationSettingsCategoryView[];
+}
+interface OrgNotificationSettingsView {
+  categories: NotificationSettingsCategoryView[];
+}
 //#endregion
-export { type ActivityView, CommunityHome, CommunityHomeLink, CommunityHomeSpace, CourseProgressView, type CourseView, DirectoryEntry, DirectoryQuery, DirectoryRow, type DownloadFile, type DownloadView, LockedCommunitySpace, type Module, NotificationView, NotificationsView, OpenCommunitySpace };
+export { type ActivityView, CommunityHome, CommunityHomeLink, CommunityHomeSpace, CommunityNotificationSettingsView, CourseProgressView, type CourseView, DirectoryEntry, DirectoryQuery, DirectoryRow, type DownloadFile, type DownloadView, LockedCommunitySpace, type Module, NotificationItemView, NotificationSettingsCategoryView, NotificationUnreadCounts, NotificationView, NotificationsView, OpenCommunitySpace, OrgNotificationSettingsView, SettingsChannelView };
 //# sourceMappingURL=model.d.ts.map

package/dist/reporting/member/ports.d.ts

@@ -1,10 +1,9 @@
 import { Page } from "../../types/shared.js";
 import { ActivityView, CourseView, DownloadFile, DownloadView, Module } from "../../types/schemas/content.js";
-import { Notification } from "../../types/schemas/identity.js";
+import { NotificationFilter } from "../../types/notifications.js";
 import "../../types/index.js";
 import { Actor } from "../../shared/actor.js";
-import "../../identity/index.js";
-import { CommunityHome, CommunityHomeSpace, CourseProgressView, DirectoryEntry, DirectoryQuery, DirectoryRow, NotificationView, NotificationsView } from "./model.js";
+import { CommunityHome, CommunityHomeSpace, CommunityNotificationSettingsView, CourseProgressView, DirectoryEntry, DirectoryQuery, DirectoryRow, NotificationUnreadCounts, NotificationView, NotificationsView, OrgNotificationSettingsView } from "./model.js";
 //#region src/reporting/member/ports.d.ts
 interface MemberReportService {
   listCourses(orgId: string, orgUserId: string): Promise<CourseView[]>;
@@ -28,12 +27,16 @@ interface MemberReportService {
   directory(orgId: string, actor: Actor, communityId: string, query: DirectoryQuery): Promise<Page<DirectoryEntry> | null>;
   communityHome(orgId: string, actor: Actor, communityId: string): Promise<CommunityHome | null>;
   communitySpace(orgId: string, actor: Actor, communityId: string, spaceId: string): Promise<CommunityHomeSpace | null>;
-  notifications(orgId: string, actor: Actor, userId: string, query: {
+  notifications(orgId: string, actor: Actor, userId: string, filter: NotificationFilter, page: {
     page: number;
     pageSize: number;
   }): Promise<NotificationsView>;
-  /** One notification the way `notifications` lists it. */
-  notificationView(orgId: string, actor: Actor, notification: Notification): Promise<NotificationView>;
+  notification(orgId: string, actor: Actor, userId: string, notificationId: string): Promise<NotificationView | null>;
+  notificationUnreadCounts(orgId: string, actor: Actor, userId: string): Promise<NotificationUnreadCounts>;
+  /** The person's notification settings in a community they can open, resolved per channel. */
+  communityNotificationSettings(orgId: string, actor: Actor, userId: string, communityId: string): Promise<CommunityNotificationSettingsView | null>;
+  /** The person's notification settings for the org's categories. */
+  orgNotificationSettings(orgId: string, userId: string): Promise<OrgNotificationSettingsView>;
 }
 interface MemberReportRepository {
   directory(orgId: string, communityId: string, query: DirectoryQuery): Promise<Page<DirectoryRow>>;

package/dist/reporting/member/service.d.ts

@@ -1,25 +1,28 @@
 import { Page } from "../../types/shared.js";
 import { ActivityView, CourseView, DownloadFile, DownloadView, Module } from "../../types/schemas/content.js";
-import { Notification } from "../../types/schemas/identity.js";
+import { NotificationFilter } from "../../types/notifications.js";
 import "../../types/index.js";
+import { ChannelRegistry, NotificationCategoryService } from "../../shared/ports.js";
 import { FileUrls } from "../../assets/file-urls.js";
 import { AssetFiles } from "../../assets/ports.js";
 import "../../assets/index.js";
 import { Actor } from "../../shared/actor.js";
-import { ContentService } from "../../content/ports.js";
+import { ContentService, ItemTitles } from "../../content/ports.js";
 import "../../content/index.js";
-import { NotificationInbox } from "../../identity/ports.js";
+import { NotificationSettingsService } from "../../identity/ports.js";
 import "../../identity/index.js";
 import { EntitlementsService } from "../../entitlements/ports.js";
 import "../../entitlements/index.js";
-import { ChatService, PostService } from "../../discussion/ports.js";
+import { NotificationsService } from "../../automations/ports.js";
+import "../../automations/index.js";
+import { ItemTitles as ItemTitles$1, SubscriptionService } from "../../discussion/ports.js";
 import "../../discussion/index.js";
 import { ProgressService } from "../../progress/ports.js";
 import "../../progress/index.js";
-import { CommunityHome, CommunityHomeSpace, CourseProgressView, DirectoryEntry, DirectoryQuery, NotificationView, NotificationsView } from "./model.js";
+import { CommunityHome, CommunityHomeSpace, CommunityNotificationSettingsView, CourseProgressView, DirectoryEntry, DirectoryQuery, NotificationUnreadCounts, NotificationView, NotificationsView, OrgNotificationSettingsView } from "./model.js";
 import { MemberReportRepository, MemberReportService } from "./ports.js";
 //#region src/reporting/member/service.d.ts
-type MemberAccess = Pick<EntitlementsService, 'isCommunityMember' | 'openSpaceIds' | 'spaceStandings' | 'hasAccess' | 'listAccessibleContent'>;
+type MemberAccess = Pick<EntitlementsService, 'isCommunityMember' | 'openSpaceIds' | 'spaceStandings' | 'hasAccess' | 'listAccessibleContent' | 'openCommunityIds'>;
 type MemberReportServiceParams = {
   repo: MemberReportRepository;
   content: ContentService;
@@ -27,9 +30,18 @@ type MemberReportServiceParams = {
   files: Pick<AssetFiles, 'signFile'>;
   fileUrls: FileUrls;
   access: MemberAccess;
-  notifications: Pick<NotificationInbox, 'listNotifications'>;
-  posts: Pick<PostService, 'visibleTitles'>;
-  chats: Pick<ChatService, 'titlesFor'>;
+  notifications: Pick<NotificationsService, 'list' | 'get' | 'unreadCounts'>;
+  titles: {
+    discussion: ItemTitles$1;
+    content: ItemTitles;
+  };
+  subscriptions: Pick<SubscriptionService, 'viewerSubscriptions'>;
+  notificationCategories: {
+    community: Pick<NotificationCategoryService, 'get'>;
+    org: Pick<NotificationCategoryService, 'get'>;
+  };
+  notificationSettings: Pick<NotificationSettingsService, 'get'>;
+  channels: Pick<ChannelRegistry, 'list'>;
 };
 declare class MemberReportServiceImpl implements MemberReportService {
   private readonly repo;
@@ -38,15 +50,22 @@ declare class MemberReportServiceImpl implements MemberReportService {
   private readonly files;
   private readonly fileUrls;
   private readonly access;
-  private readonly inbox;
-  private readonly posts;
-  private readonly chats;
+  private readonly notificationList;
+  private readonly titles;
+  private readonly subscriptions;
+  private readonly notificationCategories;
+  private readonly notificationSettings;
+  private readonly channels;
   constructor(params: MemberReportServiceParams);
-  notifications(orgId: string, actor: Actor, userId: string, query: {
+  communityNotificationSettings(orgId: string, actor: Actor, userId: string, communityId: string): Promise<CommunityNotificationSettingsView | null>;
+  orgNotificationSettings(orgId: string, userId: string): Promise<OrgNotificationSettingsView>;
+  private settingsView;
+  notifications(orgId: string, actor: Actor, userId: string, filter: NotificationFilter, page: {
     page: number;
     pageSize: number;
   }): Promise<NotificationsView>;
-  notificationView(orgId: string, actor: Actor, notification: Notification): Promise<NotificationView>;
+  notification(orgId: string, actor: Actor, userId: string, notificationId: string): Promise<NotificationView | null>;
+  notificationUnreadCounts(orgId: string, actor: Actor, userId: string): Promise<NotificationUnreadCounts>;
   private describeNotifications;
   listCourses(orgId: string, orgUserId: string): Promise<CourseView[]>;
   getCourse(orgId: string, orgUserId: string, courseId: string): Promise<CourseView | null>;