@headless-lms/core 0.3.0 → 0.5.0

package/dist/entitlements/events.d.ts

@@ -29,15 +29,15 @@ declare const entitlementEvents: {
   }, import("zod").ZodObject<{
     orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    source: import("zod").ZodString;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
     status: import("zod").ZodEnum<{
       active: "active";
       revoked: "revoked";
     }>;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
-    bundleId: import("zod").ZodNullable<import("zod").ZodString>;
+    source: import("zod").ZodString;
     contentId: import("zod").ZodNullable<import("zod").ZodString>;
+    bundleId: import("zod").ZodNullable<import("zod").ZodString>;
     orgUserId: import("zod").ZodString;
     grantedAt: import("zod").ZodCoercedDate<unknown>;
     expiresAt: import("zod").ZodNullable<import("zod").ZodCoercedDate<unknown>>;
@@ -69,15 +69,15 @@ declare const entitlementEvents: {
   }, import("zod").ZodObject<{
     orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    source: import("zod").ZodString;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
     status: import("zod").ZodEnum<{
       active: "active";
       revoked: "revoked";
     }>;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
-    bundleId: import("zod").ZodNullable<import("zod").ZodString>;
+    source: import("zod").ZodString;
     contentId: import("zod").ZodNullable<import("zod").ZodString>;
+    bundleId: import("zod").ZodNullable<import("zod").ZodString>;
     orgUserId: import("zod").ZodString;
     grantedAt: import("zod").ZodCoercedDate<unknown>;
     expiresAt: import("zod").ZodNullable<import("zod").ZodCoercedDate<unknown>>;
@@ -109,15 +109,15 @@ declare const entitlementEvents: {
   }, import("zod").ZodObject<{
     orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    source: import("zod").ZodString;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
     status: import("zod").ZodEnum<{
       active: "active";
       revoked: "revoked";
     }>;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
-    bundleId: import("zod").ZodNullable<import("zod").ZodString>;
+    source: import("zod").ZodString;
     contentId: import("zod").ZodNullable<import("zod").ZodString>;
+    bundleId: import("zod").ZodNullable<import("zod").ZodString>;
     orgUserId: import("zod").ZodString;
     grantedAt: import("zod").ZodCoercedDate<unknown>;
     expiresAt: import("zod").ZodNullable<import("zod").ZodCoercedDate<unknown>>;
@@ -149,15 +149,15 @@ declare const entitlementEvents: {
   }, import("zod").ZodObject<{
     orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    source: import("zod").ZodString;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
     status: import("zod").ZodEnum<{
       active: "active";
       revoked: "revoked";
     }>;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
-    bundleId: import("zod").ZodNullable<import("zod").ZodString>;
+    source: import("zod").ZodString;
     contentId: import("zod").ZodNullable<import("zod").ZodString>;
+    bundleId: import("zod").ZodNullable<import("zod").ZodString>;
     orgUserId: import("zod").ZodString;
     grantedAt: import("zod").ZodCoercedDate<unknown>;
     expiresAt: import("zod").ZodNullable<import("zod").ZodCoercedDate<unknown>>;
@@ -191,15 +191,15 @@ declare const entitlementEvents: {
   }, import("zod").ZodObject<{
     orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    source: import("zod").ZodString;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
     status: import("zod").ZodEnum<{
       active: "active";
       revoked: "revoked";
     }>;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
-    bundleId: import("zod").ZodNullable<import("zod").ZodString>;
+    source: import("zod").ZodString;
     contentId: import("zod").ZodNullable<import("zod").ZodString>;
+    bundleId: import("zod").ZodNullable<import("zod").ZodString>;
     orgUserId: import("zod").ZodString;
     grantedAt: import("zod").ZodCoercedDate<unknown>;
     expiresAt: import("zod").ZodNullable<import("zod").ZodCoercedDate<unknown>>;

package/dist/entitlements/index.d.ts

@@ -1,8 +1,9 @@
 import { Page } from "../types/shared.js";
-import { Entitlement, EntitlementStatus, EntitlementsQuery, GrantEntitlementInput, SpaceMember, SpaceMemberSource, SpaceMemberStatus } from "../types/schemas/entitlements.js";
+import { Entitlement, EntitlementStatus, EntitlementsQuery, GrantEntitlementInput, GrantSource, SpaceMember, SpaceMemberSource, SpaceMemberStatus } from "../types/schemas/entitlements.js";
 import "./model.js";
-import { AccessFacts, CommunityAccessReader, EndingGrant, EndingGrantKey, EntitlementNotice, EntitlementsRepository, EntitlementsService, GrantKey, GrantTarget, InsertSpaceMemberInput, OpenableSpace, SpaceAccessRule, SpaceMembersQuery } from "./ports.js";
+import { AccessFacts, CommunityAccessReader, CommunityReaders, ContentReader, EndingGrant, EndingGrantKey, EntitlementNotice, EntitlementsRepository, EntitlementsService, GrantKey, GrantTarget, InsertGrantInput, InsertSpaceMemberInput, OpenableSpace, PermissionHolders, RevokeGrantInput, SpaceAccessRule, SpaceMembersQuery } from "./ports.js";
 import { EntitlementsServiceImpl } from "./service.js";
 import { EntitlementCreated, EntitlementDeleted, EntitlementEndingSoon, EntitlementEvent, EntitlementExpired, EntitlementUpdated, SpaceMemberCreated, SpaceMemberDeleted, SpaceMemberUpdated, entitlementEvents } from "./events.js";
-import { seesSpace } from "./rules.js";
-export { type AccessFacts, type CommunityAccessReader, type EndingGrant, type EndingGrantKey, type Entitlement, type EntitlementCreated, type EntitlementDeleted, type EntitlementEndingSoon, type EntitlementEvent, type EntitlementExpired, type EntitlementNotice, type EntitlementStatus, type EntitlementUpdated, type EntitlementsQuery, type EntitlementsRepository, type EntitlementsService, EntitlementsServiceImpl, type GrantEntitlementInput, type GrantKey, type GrantTarget, type InsertSpaceMemberInput, type OpenableSpace, type Page, type SpaceAccessRule, type SpaceMember, type SpaceMemberCreated, type SpaceMemberDeleted, type SpaceMemberSource, type SpaceMemberStatus, type SpaceMemberUpdated, type SpaceMembersQuery, entitlementEvents, seesSpace };
+import { opensSpace, seesSpace } from "./rules.js";
+import { GRANTS_EXPIRE_JOB, entitlementsJobs, entitlementsRecurringJobs } from "./jobs.js";
+export { type AccessFacts, type CommunityAccessReader, type CommunityReaders, type ContentReader, type EndingGrant, type EndingGrantKey, type Entitlement, type EntitlementCreated, type EntitlementDeleted, type EntitlementEndingSoon, type EntitlementEvent, type EntitlementExpired, type EntitlementNotice, type EntitlementStatus, type EntitlementUpdated, type EntitlementsQuery, type EntitlementsRepository, type EntitlementsService, EntitlementsServiceImpl, GRANTS_EXPIRE_JOB, type GrantEntitlementInput, type GrantKey, type GrantSource, type GrantTarget, type InsertGrantInput, type InsertSpaceMemberInput, type OpenableSpace, type Page, type PermissionHolders, type RevokeGrantInput, type SpaceAccessRule, type SpaceMember, type SpaceMemberCreated, type SpaceMemberDeleted, type SpaceMemberSource, type SpaceMemberStatus, type SpaceMemberUpdated, type SpaceMembersQuery, entitlementEvents, entitlementsJobs, entitlementsRecurringJobs, opensSpace, seesSpace };

package/dist/entitlements/index.js

@@ -1,4 +1,5 @@
 import { entitlementEvents } from "./events.js";
-import { seesSpace } from "./rules.js";
+import { opensSpace, seesSpace } from "./rules.js";
 import { EntitlementsServiceImpl } from "./service.js";
-export { EntitlementsServiceImpl, entitlementEvents, seesSpace };
+import { GRANTS_EXPIRE_JOB, entitlementsJobs, entitlementsRecurringJobs } from "./jobs.js";
+export { EntitlementsServiceImpl, GRANTS_EXPIRE_JOB, entitlementEvents, entitlementsJobs, entitlementsRecurringJobs, opensSpace, seesSpace };

package/dist/entitlements/jobs.d.ts

@@ -0,0 +1,12 @@
+import { RecurringJob, ScheduledJob } from "../shared/ports.js";
+import { EntitlementsService } from "./ports.js";
+//#region src/entitlements/jobs.d.ts
+declare const GRANTS_EXPIRE_JOB = "entitlements.grants.expire";
+interface EntitlementsJobDeps {
+  grants: Pick<EntitlementsService, 'expireDueGrants'>;
+}
+declare function entitlementsJobs(deps: EntitlementsJobDeps): ScheduledJob[];
+declare const entitlementsRecurringJobs: RecurringJob[];
+//#endregion
+export { EntitlementsJobDeps, GRANTS_EXPIRE_JOB, entitlementsJobs, entitlementsRecurringJobs };
+//# sourceMappingURL=jobs.d.ts.map

package/dist/entitlements/jobs.js

@@ -0,0 +1,18 @@
+//#region src/entitlements/jobs.ts
+const GRANTS_EXPIRE_JOB = "entitlements.grants.expire";
+function entitlementsJobs(deps) {
+	return [{
+		job: GRANTS_EXPIRE_JOB,
+		async run(_payload, fire) {
+			await deps.grants.expireDueGrants(fire.startedAt);
+		}
+	}];
+}
+const entitlementsRecurringJobs = [{
+	job: GRANTS_EXPIRE_JOB,
+	cron: "0 * * * *"
+}];
+//#endregion
+export { GRANTS_EXPIRE_JOB, entitlementsJobs, entitlementsRecurringJobs };
+
+//# sourceMappingURL=jobs.js.map

package/dist/entitlements/jobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobs.js","names":[],"sources":["../../src/entitlements/jobs.ts"],"sourcesContent":["import type { RecurringJob, ScheduledJob } from '../shared/ports.js';\nimport type { EntitlementsService } from './ports.js';\n\nexport const GRANTS_EXPIRE_JOB = 'entitlements.grants.expire';\n\nexport interface EntitlementsJobDeps {\n  grants: Pick<EntitlementsService, 'expireDueGrants'>;\n}\n\nexport function entitlementsJobs(deps: EntitlementsJobDeps): ScheduledJob[] {\n  return [\n    {\n      job: GRANTS_EXPIRE_JOB,\n      async run(_payload, fire) {\n        await deps.grants.expireDueGrants(fire.startedAt);\n      },\n    },\n  ];\n}\n\nexport const entitlementsRecurringJobs: RecurringJob[] = [\n  { job: GRANTS_EXPIRE_JOB, cron: '0 * * * *' },\n];\n"],"mappings":";AAGA,MAAa,oBAAoB;AAMjC,SAAgB,iBAAiB,MAA2C;CAC1E,OAAO,CACL;EACE,KAAK;EACL,MAAM,IAAI,UAAU,MAAM;GACxB,MAAM,KAAK,OAAO,gBAAgB,KAAK,SAAS;EAClD;CACF,CACF;AACF;AAEA,MAAa,4BAA4C,CACvD;CAAE,KAAK;CAAmB,MAAM;AAAY,CAC9C"}

package/dist/entitlements/model.d.ts

@@ -1,5 +1,5 @@
 import { Page } from "../types/shared.js";
 import { ContentType } from "../types/schemas/content.js";
-import { Entitlement, EntitlementStatus, EntitlementsQuery, GrantEntitlementInput, SpaceMember, SpaceMemberSource, SpaceMemberStatus } from "../types/schemas/entitlements.js";
+import { Entitlement, EntitlementStatus, EntitlementsQuery, GrantEntitlementInput, GrantSource, SpaceMember, SpaceMemberSource, SpaceMemberStatus } from "../types/schemas/entitlements.js";
 import "../types/index.js";
-export type { ContentType, Entitlement, EntitlementStatus, EntitlementsQuery, GrantEntitlementInput, Page, SpaceMember, SpaceMemberSource, SpaceMemberStatus };
+export type { ContentType, Entitlement, EntitlementStatus, EntitlementsQuery, GrantEntitlementInput, GrantSource, Page, SpaceMember, SpaceMemberSource, SpaceMemberStatus };

package/dist/entitlements/ports.d.ts

@@ -1,13 +1,13 @@
 import { Page } from "../types/shared.js";
-import { ContentType, Space } from "../types/schemas/content.js";
-import { Role } from "../types/schemas/organizations.js";
-import { Entitlement, EntitlementsQuery, GrantEntitlementInput, SpaceMember, SpaceMemberSource, SpaceMemberStatus } from "../types/schemas/entitlements.js";
-import { OutboxAppender, UnitOfWork } from "../shared/ports.js";
+import { ContentType, Event, Space } from "../types/schemas/content.js";
+import { Permission } from "../types/schemas/organizations.js";
+import { Entitlement, EntitlementsQuery, GrantEntitlementInput, GrantSource, SpaceMember, SpaceMemberSource, SpaceMemberStatus } from "../types/schemas/entitlements.js";
+import "../types/index.js";
 import { Actor } from "../shared/actor.js";
+import { OutboxAppender, UnitOfWork } from "../shared/ports.js";
 import { SpaceRowLock } from "../content/ports.js";
 import "../content/index.js";
 import "./model.js";
-import "../organizations/index.js";
 //#region src/entitlements/ports.d.ts
 interface GrantTarget {
   contentId: string | null;
@@ -20,12 +20,12 @@ interface OpenableSpace {
   accessRule: SpaceAccessRule;
 }
 interface CommunityAccessReader {
-  isCommunityMember(orgId: string, actor: Actor, communityId: string): Promise<boolean>;
-  canOpenSpace(orgId: string, actor: Actor, spaceId: string): Promise<boolean>;
-  canOpen(orgId: string, actor: Actor, space: OpenableSpace): Promise<boolean>;
-  openSpaceIds(orgId: string, actor: Actor, communityId: string): Promise<string[]>;
-  openSpacesFor(orgId: string, actor: Actor, communityId: string): Promise<Space[]>;
-  spaceStandings(orgId: string, actor: Actor, communityId: string): Promise<Record<string, SpaceMember['status']>>;
+  isCommunityMember(communityId: string, actor: Actor): Promise<boolean>;
+  canOpenSpace(spaceId: string, actor: Actor): Promise<boolean>;
+  canOpen(space: OpenableSpace, actor: Actor): Promise<boolean>;
+  openSpaceIds(communityId: string, actor: Actor): Promise<string[]>;
+  openSpacesFor(communityId: string, actor: Actor): Promise<Space[]>;
+  spaceStandings(communityId: string, actor: Actor): Promise<Record<string, SpaceMember['status']>>;
   communityMembersAmong(orgId: string, communityId: string, orgUserIds: string[]): Promise<string[]>;
   spaceOpenersAmong(orgId: string, spaceId: string, orgUserIds: string[]): Promise<string[]>;
   spaceOpeners(orgId: string, spaceId: string): Promise<string[]>;
@@ -50,10 +50,28 @@ interface EndingGrantKey {
 }
 interface AccessFacts {
   orgUserId: string;
-  role: Role;
-  member: boolean;
+  granted: boolean;
   activeInSpace: boolean;
 }
+interface PermissionHolders {
+  holders(orgId: string, permission: Permission, on?: string): Promise<string[]>;
+  systemActor(orgId: string): Actor;
+}
+interface ContentReader {
+  getSpace(spaceId: string, actor: Actor): Promise<Space | null>;
+  listSpaces(communityId: string, actor: Actor): Promise<Space[]>;
+  getEvent(eventId: string, actor: Actor): Promise<Event>;
+}
+interface RevokeGrantInput {
+  orgUserId: string;
+  contentId?: string | null;
+  bundleId?: string | null;
+  contentType?: ContentType;
+}
+interface CommunityReaders {
+  all: boolean;
+  ids: string[];
+}
 interface GrantKey {
   orgUserId: string;
   contentId?: string | null;
@@ -63,7 +81,11 @@ interface SpaceMembersQuery {
   page: number;
   pageSize: number;
   statuses?: SpaceMemberStatus[];
+  excluding?: string[];
 }
+type InsertGrantInput = Omit<GrantEntitlementInput, 'contentType'> & {
+  source: GrantSource;
+};
 interface InsertSpaceMemberInput {
   communityId: string;
   spaceId: string;
@@ -72,46 +94,52 @@ interface InsertSpaceMemberInput {
   source: SpaceMemberSource;
 }
 interface EntitlementsService extends CommunityAccessReader {
-  list(orgId: string, query: EntitlementsQuery): Promise<Page<Entitlement>>;
-  grant(orgId: string, input: GrantEntitlementInput): Promise<Entitlement>;
-  ensureGrant(orgId: string, input: GrantEntitlementInput): Promise<Entitlement>;
-  setStatus(orgId: string, id: string, status: 'active' | 'revoked'): Promise<Entitlement | null>;
+  list(query: EntitlementsQuery, actor: Actor): Promise<Page<Entitlement>>;
+  grant(input: GrantEntitlementInput, actor: Actor): Promise<Entitlement>;
+  revoke(input: RevokeGrantInput, actor: Actor): Promise<Entitlement>;
   /** Whether this org user can open the content right now, through a grant to
    *  it or to a bundle holding it. The only access check — nothing else may
    *  derive access from grants. */
   hasAccess(orgId: string, orgUserId: string, contentId: string): Promise<boolean>;
   /** Ids of the content this org user can open right now, optionally of one type. */
   listAccessibleContent(orgId: string, orgUserId: string, type?: ContentType): Promise<string[]>;
-  requestJoin(orgId: string, actor: Actor, communityId: string, spaceId: string): Promise<SpaceMember>;
-  invite(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
-  addSpaceMember(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
-  accept(orgId: string, actor: Actor, communityId: string, spaceId: string): Promise<SpaceMember>;
-  approve(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
-  decline(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
-  refuse(orgId: string, actor: Actor, communityId: string, spaceId: string): Promise<SpaceMember>;
-  leave(orgId: string, actor: Actor, communityId: string, spaceId: string): Promise<SpaceMember>;
-  remove(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
-  listSpaceMembers(orgId: string, actor: Actor, communityId: string, spaceId: string, query: {
+  holdsAnyGrant(orgId: string, orgUserId: string): Promise<boolean>;
+  /** `communities:read` on the community, or a member of it holding `communities:moderate` on it. */
+  opensEverySpace(actor: Actor, communityId: string): Promise<boolean>;
+  requestJoin(communityId: string, spaceId: string, actor: Actor): Promise<SpaceMember>;
+  invite(communityId: string, spaceId: string, orgUserId: string, actor: Actor): Promise<SpaceMember>;
+  addSpaceMember(communityId: string, spaceId: string, orgUserId: string, actor: Actor): Promise<SpaceMember>;
+  accept(communityId: string, spaceId: string, actor: Actor): Promise<SpaceMember>;
+  approve(communityId: string, spaceId: string, orgUserId: string, actor: Actor): Promise<SpaceMember>;
+  decline(communityId: string, spaceId: string, orgUserId: string, actor: Actor): Promise<SpaceMember>;
+  refuse(communityId: string, spaceId: string, actor: Actor): Promise<SpaceMember>;
+  leave(communityId: string, spaceId: string, actor: Actor): Promise<SpaceMember>;
+  remove(communityId: string, spaceId: string, orgUserId: string, actor: Actor): Promise<SpaceMember>;
+  listSpaceMembers(communityId: string, spaceId: string, query: {
     page: number;
     pageSize: number;
-  }): Promise<Page<SpaceMember>>;
-  expireDue(orgId: string, now: Date): Promise<void>;
-  hasDueNotices(orgId: string, now: Date): Promise<boolean>;
+  }, actor: Actor): Promise<Page<SpaceMember>>;
+  expireDueGrants(now: Date): Promise<void>;
   communitiesOpenedBy(orgId: string, grant: GrantTarget): Promise<string[]>;
   communityModeratorIds(orgId: string, communityId: string): Promise<string[]>;
   communityIdsOpenedFor(orgId: string, orgUserId: string): Promise<string[]>;
+  openCommunityIds(actor: Actor): Promise<string[]>;
+  communityMemberIds(orgId: string, communityId: string): Promise<string[]>;
+  grantedOrgUserIds(orgId: string, contentId: string): Promise<string[]>;
   countActiveSpaceMembers(orgId: string, spaceId: string): Promise<number>;
+  /** Org users who open every space of the community, so hold no place in its spaces. */
+  everySpaceOpeners(orgId: string, communityId: string): Promise<string[]>;
 }
 interface EntitlementsRepository {
   list(orgId: string, query: EntitlementsQuery): Promise<Page<Entitlement>>;
-  insert(orgId: string, input: GrantEntitlementInput): Promise<Entitlement>;
-  insertIfAbsent(orgId: string, input: GrantEntitlementInput): Promise<Entitlement | null>;
+  insert(orgId: string, input: InsertGrantInput): Promise<Entitlement>;
   lockGrant(orgId: string, key: GrantKey): Promise<Entitlement | null>;
-  setExpiresAt(orgId: string, id: string, expiresAt: Date | null): Promise<Entitlement | null>;
   setStatus(orgId: string, id: string, status: 'active' | 'revoked'): Promise<Entitlement | null>;
   hasAccess(orgId: string, orgUserId: string, contentId: string): Promise<boolean>;
   listAccessibleContent(orgId: string, orgUserId: string, type?: ContentType): Promise<string[]>;
   hasCommunityAccess(orgId: string, orgUserId: string, communityId: string): Promise<boolean>;
+  holdsAnyGrant(orgId: string, orgUserId: string): Promise<boolean>;
+  contentTypeOf(orgId: string, contentId: string): Promise<ContentType | null>;
   communitiesOpenedBy(orgId: string, grant: GrantTarget): Promise<string[]>;
   accessAmong(orgId: string, communityId: string, spaceId: string | null, orgUserIds: string[]): Promise<AccessFacts[]>;
   findSpaceMember(orgId: string, spaceId: string, orgUserId: string): Promise<SpaceMember | null>;
@@ -121,17 +149,19 @@ interface EntitlementsRepository {
   insertSpaceMember(orgId: string, input: InsertSpaceMemberInput): Promise<SpaceMember>;
   updateSpaceMemberStatus(orgId: string, id: string, status: SpaceMemberStatus): Promise<SpaceMember | null>;
   deleteSpaceMember(orgId: string, id: string): Promise<void>;
-  countActiveSpaceMembers(orgId: string, spaceId: string): Promise<number>;
+  countActiveSpaceMembers(orgId: string, spaceId: string, excluding: string[]): Promise<number>;
   activeSpaceIds(orgId: string, orgUserId: string, communityId: string): Promise<string[]>;
   /** Expired grants with no expiry notice, in id order, after `afterId` when given. */
   listGrantsExpiredBy(orgId: string, now: Date, limit: number, afterId?: string): Promise<Entitlement[]>;
   /** Grants ending in the window with no notice, in (grant id, community id) order, after `afterKey`. */
   listGrantsEndingBetween(orgId: string, after: Date, until: Date, limit: number, afterKey?: EndingGrantKey): Promise<EndingGrant[]>;
-  hasDueNotices(orgId: string, now: Date, until: Date): Promise<boolean>;
+  orgIdsWithDueNotices(now: Date, until: Date): Promise<string[]>;
   claimNotice(orgId: string, notice: EntitlementNotice, now: Date): Promise<boolean>;
-  communityModeratorIds(orgId: string, communityId: string): Promise<string[]>;
-  communityMemberIds(orgId: string, communityId: string): Promise<string[]>;
+  communityMemberIds(orgId: string, communityId: string, readerIds: string[]): Promise<string[]>;
   communityIdsOpenedFor(orgId: string, orgUserId: string): Promise<string[]>;
+  openCommunityIds(orgId: string, orgUserId: string, readers: CommunityReaders): Promise<string[]>;
+  grantedOrgUserIds(orgId: string, contentId: string): Promise<string[]>;
+  lockCapacity(orgId: string, contentId: string): Promise<void>;
 }
 /** Tx-scoped port bundle for this context's mutating use cases — every member
  *  is bound to the UnitOfWork's transaction, so the write and the event append
@@ -143,5 +173,5 @@ interface EntitlementsTxScope {
 }
 type EntitlementsUnitOfWork = UnitOfWork<EntitlementsTxScope>;
 //#endregion
-export { AccessFacts, CommunityAccessReader, EndingGrant, EndingGrantKey, EntitlementNotice, EntitlementsRepository, EntitlementsService, EntitlementsTxScope, EntitlementsUnitOfWork, GrantKey, GrantTarget, InsertSpaceMemberInput, OpenableSpace, SpaceAccessRule, SpaceMembersQuery };
+export { AccessFacts, CommunityAccessReader, CommunityReaders, ContentReader, EndingGrant, EndingGrantKey, EntitlementNotice, EntitlementsRepository, EntitlementsService, EntitlementsTxScope, EntitlementsUnitOfWork, GrantKey, GrantTarget, InsertGrantInput, InsertSpaceMemberInput, OpenableSpace, PermissionHolders, RevokeGrantInput, SpaceAccessRule, SpaceMembersQuery };
 //# sourceMappingURL=ports.d.ts.map

package/dist/entitlements/rules.d.ts

@@ -1,12 +1,9 @@
-import { Role } from "../types/schemas/organizations.js";
 import { SpaceMemberStatus } from "../types/schemas/entitlements.js";
 import "./model.js";
-import "../organizations/index.js";
 import { SpaceAccessRule } from "./ports.js";
 //#region src/entitlements/rules.d.ts
-declare function opensSpace(role: Role, member: boolean, accessRule: SpaceAccessRule, activeInSpace: boolean): boolean;
-declare function seesSpace(role: Role, accessRule: SpaceAccessRule, status: SpaceMemberStatus | undefined): boolean;
-declare function laterExpiry(a: Date | null, b: Date | null): Date | null;
+declare function opensSpace(member: boolean, everySpace: boolean, accessRule: SpaceAccessRule, activeInSpace: boolean): boolean;
+declare function seesSpace(everySpace: boolean, accessRule: SpaceAccessRule, status: SpaceMemberStatus | undefined): boolean;
 //#endregion
-export { laterExpiry, opensSpace, seesSpace };
+export { opensSpace, seesSpace };
 //# sourceMappingURL=rules.d.ts.map

package/dist/entitlements/rules.js

@@ -1,17 +1,12 @@
-import { canModerate } from "../organizations/roles.js";
 //#region src/entitlements/rules.ts
-function opensSpace(role, member, accessRule, activeInSpace) {
+function opensSpace(member, everySpace, accessRule, activeInSpace) {
 	if (!member) return false;
-	return canModerate(role) || accessRule === "all_members" || activeInSpace;
+	return everySpace || accessRule === "all_members" || activeInSpace;
 }
-function seesSpace(role, accessRule, status) {
-	return canModerate(role) || accessRule !== "by_invite" || status !== void 0 && status !== "revoked";
-}
-function laterExpiry(a, b) {
-	if (a === null || b === null) return null;
-	return a.getTime() >= b.getTime() ? a : b;
+function seesSpace(everySpace, accessRule, status) {
+	return everySpace || accessRule !== "by_invite" || status !== void 0 && status !== "revoked";
 }
 //#endregion
-export { laterExpiry, opensSpace, seesSpace };
+export { opensSpace, seesSpace };
 
 //# sourceMappingURL=rules.js.map

package/dist/entitlements/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","names":[],"sources":["../../src/entitlements/rules.ts"],"sourcesContent":["import { canModerate, type Role } from '../organizations/index.js';\nimport type { SpaceAccessRule } from './ports.js';\nimport type { SpaceMemberStatus } from './model.js';\n\nexport function opensSpace(\n  role: Role,\n  member: boolean,\n  accessRule: SpaceAccessRule,\n  activeInSpace: boolean,\n): boolean {\n  if (!member) {\n    return false;\n  }\n  return canModerate(role) || accessRule === 'all_members' || activeInSpace;\n}\n\nexport function seesSpace(\n  role: Role,\n  accessRule: SpaceAccessRule,\n  status: SpaceMemberStatus | undefined,\n): boolean {\n  return (\n    canModerate(role) ||\n    accessRule !== 'by_invite' ||\n    (status !== undefined && status !== 'revoked')\n  );\n}\n\nexport function laterExpiry(a: Date | null, b: Date | null): Date | null {\n  if (a === null || b === null) {\n    return null;\n  }\n  return a.getTime() >= b.getTime() ? a : b;\n}\n"],"mappings":";;AAIA,SAAgB,WACd,MACA,QACA,YACA,eACS;CACT,IAAI,CAAC,QACH,OAAO;CAET,OAAO,YAAY,IAAI,KAAK,eAAe,iBAAiB;AAC9D;AAEA,SAAgB,UACd,MACA,YACA,QACS;CACT,OACE,YAAY,IAAI,KAChB,eAAe,eACd,WAAW,KAAA,KAAa,WAAW;AAExC;AAEA,SAAgB,YAAY,GAAgB,GAA6B;CACvE,IAAI,MAAM,QAAQ,MAAM,MACtB,OAAO;CAET,OAAO,EAAE,QAAQ,KAAK,EAAE,QAAQ,IAAI,IAAI;AAC1C"}
+{"version":3,"file":"rules.js","names":[],"sources":["../../src/entitlements/rules.ts"],"sourcesContent":["import type { SpaceAccessRule } from './ports.js';\nimport type { SpaceMemberStatus } from './model.js';\n\nexport function opensSpace(\n  member: boolean,\n  everySpace: boolean,\n  accessRule: SpaceAccessRule,\n  activeInSpace: boolean,\n): boolean {\n  if (!member) {\n    return false;\n  }\n  return everySpace || accessRule === 'all_members' || activeInSpace;\n}\n\nexport function seesSpace(\n  everySpace: boolean,\n  accessRule: SpaceAccessRule,\n  status: SpaceMemberStatus | undefined,\n): boolean {\n  return everySpace || accessRule !== 'by_invite' || (status !== undefined && status !== 'revoked');\n}\n"],"mappings":";AAGA,SAAgB,WACd,QACA,YACA,YACA,eACS;CACT,IAAI,CAAC,QACH,OAAO;CAET,OAAO,cAAc,eAAe,iBAAiB;AACvD;AAEA,SAAgB,UACd,YACA,YACA,QACS;CACT,OAAO,cAAc,eAAe,eAAgB,WAAW,KAAA,KAAa,WAAW;AACzF"}

package/dist/entitlements/service.d.ts

@@ -2,17 +2,17 @@ import { Page } from "../types/shared.js";
 import { Logger } from "../types/ports.js";
 import { ContentType, Space } from "../types/schemas/content.js";
 import { Entitlement, EntitlementsQuery, GrantEntitlementInput, SpaceMember } from "../types/schemas/entitlements.js";
-import "../shared/ports.js";
 import { Actor } from "../shared/actor.js";
-import { CommunityReader } from "../content/ports.js";
+import "../shared/ports.js";
 import "../content/index.js";
 import "./model.js";
-import { EntitlementsRepository, EntitlementsService, EntitlementsUnitOfWork, GrantTarget, OpenableSpace } from "./ports.js";
+import { ContentReader, EntitlementsRepository, EntitlementsService, EntitlementsUnitOfWork, GrantTarget, OpenableSpace, PermissionHolders, RevokeGrantInput } from "./ports.js";
 //#region src/entitlements/service.d.ts
 type EntitlementsServiceParams = {
   /** Read-only access (list) — runs outside any transaction. */
   repo: EntitlementsRepository;
-  content: CommunityReader;
+  content: ContentReader;
+  permissions: PermissionHolders;
   /** Atomic write scope: tx-bound repo + outbox appender. */
   uow: EntitlementsUnitOfWork;
   logger?: Logger;
@@ -20,49 +20,64 @@ type EntitlementsServiceParams = {
 declare class EntitlementsServiceImpl implements EntitlementsService {
   private readonly repo;
   private readonly content;
+  private readonly permissions;
   private readonly uow;
   private readonly logger;
   constructor(params: EntitlementsServiceParams);
-  list(orgId: string, query: EntitlementsQuery): Promise<Page<Entitlement>>;
-  grant(orgId: string, input: GrantEntitlementInput): Promise<Entitlement>;
-  ensureGrant(orgId: string, input: GrantEntitlementInput): Promise<Entitlement>;
-  setStatus(orgId: string, id: string, status: 'active' | 'revoked'): Promise<Entitlement | null>;
+  list(query: EntitlementsQuery, actor: Actor): Promise<Page<Entitlement>>;
+  grant(input: GrantEntitlementInput, actor: Actor): Promise<Entitlement>;
+  revoke(input: RevokeGrantInput, actor: Actor): Promise<Entitlement>;
+  private grantEvent;
+  private assertCanRegister;
+  private requireAttendeeManager;
+  private assertPlace;
+  private sourceOf;
+  private actorMetadata;
   hasAccess(orgId: string, orgUserId: string, contentId: string): Promise<boolean>;
   listAccessibleContent(orgId: string, orgUserId: string, type?: ContentType): Promise<string[]>;
-  isCommunityMember(orgId: string, actor: Actor, communityId: string): Promise<boolean>;
-  canOpenSpace(orgId: string, actor: Actor, spaceId: string): Promise<boolean>;
-  canOpen(orgId: string, actor: Actor, space: OpenableSpace): Promise<boolean>;
-  spaceStandings(orgId: string, actor: Actor, communityId: string): Promise<Record<string, SpaceMember['status']>>;
-  openSpacesFor(orgId: string, actor: Actor, communityId: string): Promise<Space[]>;
-  openSpaceIds(orgId: string, actor: Actor, communityId: string): Promise<string[]>;
+  holdsAnyGrant(orgId: string, orgUserId: string): Promise<boolean>;
+  opensEverySpace(actor: Actor, communityId: string): Promise<boolean>;
+  isCommunityMember(communityId: string, actor: Actor): Promise<boolean>;
+  canOpenSpace(spaceId: string, actor: Actor): Promise<boolean>;
+  canOpen(space: OpenableSpace, actor: Actor): Promise<boolean>;
+  spaceStandings(communityId: string, actor: Actor): Promise<Record<string, SpaceMember['status']>>;
+  openSpacesFor(communityId: string, actor: Actor): Promise<Space[]>;
+  openSpaceIds(communityId: string, actor: Actor): Promise<string[]>;
   communityMembersAmong(orgId: string, communityId: string, orgUserIds: string[]): Promise<string[]>;
   spaceOpenersAmong(orgId: string, spaceId: string, orgUserIds: string[]): Promise<string[]>;
   spaceOpeners(orgId: string, spaceId: string): Promise<string[]>;
   communitiesOpenedBy(orgId: string, grant: GrantTarget): Promise<string[]>;
   communityModeratorIds(orgId: string, communityId: string): Promise<string[]>;
   communityIdsOpenedFor(orgId: string, orgUserId: string): Promise<string[]>;
+  openCommunityIds(actor: Actor): Promise<string[]>;
+  communityMemberIds(orgId: string, communityId: string): Promise<string[]>;
+  grantedOrgUserIds(orgId: string, contentId: string): Promise<string[]>;
   countActiveSpaceMembers(orgId: string, spaceId: string): Promise<number>;
-  requestJoin(orgId: string, actor: Actor, communityId: string, spaceId: string): Promise<SpaceMember>;
-  invite(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
-  addSpaceMember(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
-  accept(orgId: string, actor: Actor, communityId: string, spaceId: string): Promise<SpaceMember>;
-  approve(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
-  decline(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
-  refuse(orgId: string, actor: Actor, communityId: string, spaceId: string): Promise<SpaceMember>;
-  leave(orgId: string, actor: Actor, communityId: string, spaceId: string): Promise<SpaceMember>;
-  remove(orgId: string, actor: Actor, communityId: string, spaceId: string, orgUserId: string): Promise<SpaceMember>;
-  listSpaceMembers(orgId: string, actor: Actor, communityId: string, spaceId: string, query: {
+  everySpaceOpeners(orgId: string, communityId: string): Promise<string[]>;
+  requestJoin(communityId: string, spaceId: string, actor: Actor): Promise<SpaceMember>;
+  invite(communityId: string, spaceId: string, orgUserId: string, actor: Actor): Promise<SpaceMember>;
+  addSpaceMember(communityId: string, spaceId: string, orgUserId: string, actor: Actor): Promise<SpaceMember>;
+  accept(communityId: string, spaceId: string, actor: Actor): Promise<SpaceMember>;
+  approve(communityId: string, spaceId: string, orgUserId: string, actor: Actor): Promise<SpaceMember>;
+  decline(communityId: string, spaceId: string, orgUserId: string, actor: Actor): Promise<SpaceMember>;
+  refuse(communityId: string, spaceId: string, actor: Actor): Promise<SpaceMember>;
+  leave(communityId: string, spaceId: string, actor: Actor): Promise<SpaceMember>;
+  remove(communityId: string, spaceId: string, orgUserId: string, actor: Actor): Promise<SpaceMember>;
+  listSpaceMembers(communityId: string, spaceId: string, query: {
     page: number;
     pageSize: number;
-  }): Promise<Page<SpaceMember>>;
-  hasDueNotices(orgId: string, now: Date): Promise<boolean>;
-  expireDue(orgId: string, now: Date): Promise<void>;
+  }, actor: Actor): Promise<Page<SpaceMember>>;
+  expireDueGrants(now: Date): Promise<void>;
+  private expireDueIn;
+  private system;
+  private teamOf;
+  private standingOf;
   private requireSpaceIn;
   private requireVisibleSpaceIn;
   private assertHasMembers;
   private assertRule;
   private assertHolder;
-  private assertGrant;
+  private assertMember;
   private assertHolds;
   private assertCanManage;
   private accessOf;