@headless-lms/core 0.3.0 → 0.5.0

package/dist/identity/notifications.js

@@ -1,101 +0,0 @@
-import { notificationKindSchema } from "../types/schemas/identity.js";
-import { genId } from "../shared/id.js";
-import { NotFoundError } from "../shared/errors.js";
-import { noopLogger } from "../shared/logger.js";
-//#region src/identity/notifications.ts
-function defaultPreference(kind) {
-	return {
-		kind,
-		inApp: true,
-		email: true
-	};
-}
-var NotificationServiceImpl = class {
-	repo;
-	logger;
-	constructor(params) {
-		this.repo = params.repo;
-		this.logger = params.logger ?? noopLogger;
-	}
-	async notify(orgId, notifications) {
-		if (notifications.length === 0) return;
-		const now = /* @__PURE__ */ new Date();
-		const rows = notifications.map((notification) => ({
-			...notification,
-			orgId,
-			id: genId("notification"),
-			createdAt: now,
-			readAt: null
-		}));
-		await this.repo.insert(orgId, rows);
-		this.logger.info("notifications added", {
-			orgId,
-			kinds: [...new Set(rows.map((row) => row.kind))],
-			count: rows.length
-		});
-	}
-	async preferencesFor(orgId, userIds, kind) {
-		const unique = [...new Set(userIds)];
-		const stored = await this.repo.preferences(orgId, unique);
-		const result = {};
-		for (const userId of unique) result[userId] = defaultPreference(kind);
-		for (const row of stored) if (row.kind === kind) result[row.userId] = {
-			kind,
-			inApp: row.inApp,
-			email: row.email
-		};
-		return result;
-	}
-	async listNotifications(orgId, userId, query) {
-		const page = await this.repo.page(orgId, userId, query);
-		this.logger.debug("notifications listed", {
-			orgId,
-			userId,
-			count: page.rows.length
-		});
-		return {
-			...page,
-			page: query.page,
-			pageSize: query.pageSize
-		};
-	}
-	async markNotificationRead(orgId, userId, notificationId) {
-		const row = await this.repo.markRead(orgId, userId, notificationId, /* @__PURE__ */ new Date());
-		if (!row) throw new NotFoundError("Notification", notificationId);
-		return row;
-	}
-	async markAllNotificationsRead(orgId, userId) {
-		const updated = await this.repo.markAllRead(orgId, userId, /* @__PURE__ */ new Date());
-		this.logger.debug("notifications marked read", {
-			orgId,
-			userId,
-			updated
-		});
-		return { updated };
-	}
-	async notificationPreferences(orgId, userId) {
-		const stored = await this.repo.preferences(orgId, [userId]);
-		const byKind = new Map(stored.map((row) => [row.kind, row]));
-		return notificationKindSchema.options.map((kind) => {
-			const row = byKind.get(kind);
-			return row ? {
-				kind,
-				inApp: row.inApp,
-				email: row.email
-			} : defaultPreference(kind);
-		});
-	}
-	async setNotificationPreferences(orgId, userId, preferences) {
-		await this.repo.upsertPreferences(orgId, userId, preferences);
-		this.logger.info("notification preferences updated", {
-			orgId,
-			userId,
-			kinds: preferences.map((pref) => pref.kind)
-		});
-		return this.notificationPreferences(orgId, userId);
-	}
-};
-//#endregion
-export { NotificationServiceImpl, defaultPreference };
-
-//# sourceMappingURL=notifications.js.map

package/dist/identity/notifications.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"notifications.js","names":[],"sources":["../../src/identity/notifications.ts"],"sourcesContent":["import { NotFoundError } from '../shared/errors.js';\nimport { genId } from '../shared/id.js';\nimport { noopLogger } from '../shared/logger.js';\nimport type { Logger } from '../shared/ports.js';\nimport { notificationKindSchema } from '../types/schemas/identity.js';\nimport type { Notification, NotificationKind, NotificationPreference } from './model.js';\nimport type {\n  NewNotification,\n  NotificationPage,\n  NotificationService,\n  NotificationsQuery,\n  NotificationsRepository,\n} from './ports.js';\n\nexport function defaultPreference(kind: NotificationKind): NotificationPreference {\n  return { kind, inApp: true, email: true };\n}\n\nexport class NotificationServiceImpl implements NotificationService {\n  private readonly repo: NotificationsRepository;\n  private readonly logger: Logger;\n\n  constructor(params: { repo: NotificationsRepository; logger?: Logger }) {\n    this.repo = params.repo;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  async notify(orgId: string, notifications: NewNotification[]): Promise<void> {\n    if (notifications.length === 0) {\n      return;\n    }\n    const now = new Date();\n    const rows: Notification[] = notifications.map((notification) => ({\n      ...notification,\n      orgId,\n      id: genId('notification'),\n      createdAt: now,\n      readAt: null,\n    }));\n    await this.repo.insert(orgId, rows);\n    this.logger.info('notifications added', {\n      orgId,\n      kinds: [...new Set(rows.map((row) => row.kind))],\n      count: rows.length,\n    });\n  }\n\n  async preferencesFor(\n    orgId: string,\n    userIds: string[],\n    kind: NotificationKind,\n  ): Promise<Record<string, NotificationPreference>> {\n    const unique = [...new Set(userIds)];\n    const stored = await this.repo.preferences(orgId, unique);\n    const result: Record<string, NotificationPreference> = {};\n    for (const userId of unique) {\n      result[userId] = defaultPreference(kind);\n    }\n    for (const row of stored) {\n      if (row.kind === kind) {\n        result[row.userId] = { kind, inApp: row.inApp, email: row.email };\n      }\n    }\n    return result;\n  }\n\n  async listNotifications(\n    orgId: string,\n    userId: string,\n    query: NotificationsQuery,\n  ): Promise<NotificationPage> {\n    const page = await this.repo.page(orgId, userId, query);\n    this.logger.debug('notifications listed', { orgId, userId, count: page.rows.length });\n    return { ...page, page: query.page, pageSize: query.pageSize };\n  }\n\n  async markNotificationRead(\n    orgId: string,\n    userId: string,\n    notificationId: string,\n  ): Promise<Notification> {\n    const row = await this.repo.markRead(orgId, userId, notificationId, new Date());\n    if (!row) {\n      throw new NotFoundError('Notification', notificationId);\n    }\n    return row;\n  }\n\n  async markAllNotificationsRead(orgId: string, userId: string): Promise<{ updated: number }> {\n    const updated = await this.repo.markAllRead(orgId, userId, new Date());\n    this.logger.debug('notifications marked read', { orgId, userId, updated });\n    return { updated };\n  }\n\n  async notificationPreferences(orgId: string, userId: string): Promise<NotificationPreference[]> {\n    const stored = await this.repo.preferences(orgId, [userId]);\n    const byKind = new Map(stored.map((row) => [row.kind, row]));\n    return notificationKindSchema.options.map((kind) => {\n      const row = byKind.get(kind);\n      return row ? { kind, inApp: row.inApp, email: row.email } : defaultPreference(kind);\n    });\n  }\n\n  async setNotificationPreferences(\n    orgId: string,\n    userId: string,\n    preferences: NotificationPreference[],\n  ): Promise<NotificationPreference[]> {\n    await this.repo.upsertPreferences(orgId, userId, preferences);\n    this.logger.info('notification preferences updated', {\n      orgId,\n      userId,\n      kinds: preferences.map((pref) => pref.kind),\n    });\n    return this.notificationPreferences(orgId, userId);\n  }\n}\n"],"mappings":";;;;;AAcA,SAAgB,kBAAkB,MAAgD;CAChF,OAAO;EAAE;EAAM,OAAO;EAAM,OAAO;CAAK;AAC1C;AAEA,IAAa,0BAAb,MAAoE;CAClE;CACA;CAEA,YAAY,QAA4D;EACtE,KAAK,OAAO,OAAO;EACnB,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,MAAM,OAAO,OAAe,eAAiD;EAC3E,IAAI,cAAc,WAAW,GAC3B;EAEF,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,OAAuB,cAAc,KAAK,kBAAkB;GAChE,GAAG;GACH;GACA,IAAI,MAAM,cAAc;GACxB,WAAW;GACX,QAAQ;EACV,EAAE;EACF,MAAM,KAAK,KAAK,OAAO,OAAO,IAAI;EAClC,KAAK,OAAO,KAAK,uBAAuB;GACtC;GACA,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC;GAC/C,OAAO,KAAK;EACd,CAAC;CACH;CAEA,MAAM,eACJ,OACA,SACA,MACiD;EACjD,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC;EACnC,MAAM,SAAS,MAAM,KAAK,KAAK,YAAY,OAAO,MAAM;EACxD,MAAM,SAAiD,CAAC;EACxD,KAAK,MAAM,UAAU,QACnB,OAAO,UAAU,kBAAkB,IAAI;EAEzC,KAAK,MAAM,OAAO,QAChB,IAAI,IAAI,SAAS,MACf,OAAO,IAAI,UAAU;GAAE;GAAM,OAAO,IAAI;GAAO,OAAO,IAAI;EAAM;EAGpE,OAAO;CACT;CAEA,MAAM,kBACJ,OACA,QACA,OAC2B;EAC3B,MAAM,OAAO,MAAM,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK;EACtD,KAAK,OAAO,MAAM,wBAAwB;GAAE;GAAO;GAAQ,OAAO,KAAK,KAAK;EAAO,CAAC;EACpF,OAAO;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,UAAU,MAAM;EAAS;CAC/D;CAEA,MAAM,qBACJ,OACA,QACA,gBACuB;EACvB,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS,OAAO,QAAQ,gCAAgB,IAAI,KAAK,CAAC;EAC9E,IAAI,CAAC,KACH,MAAM,IAAI,cAAc,gBAAgB,cAAc;EAExD,OAAO;CACT;CAEA,MAAM,yBAAyB,OAAe,QAA8C;EAC1F,MAAM,UAAU,MAAM,KAAK,KAAK,YAAY,OAAO,wBAAQ,IAAI,KAAK,CAAC;EACrE,KAAK,OAAO,MAAM,6BAA6B;GAAE;GAAO;GAAQ;EAAQ,CAAC;EACzE,OAAO,EAAE,QAAQ;CACnB;CAEA,MAAM,wBAAwB,OAAe,QAAmD;EAC9F,MAAM,SAAS,MAAM,KAAK,KAAK,YAAY,OAAO,CAAC,MAAM,CAAC;EAC1D,MAAM,SAAS,IAAI,IAAI,OAAO,KAAK,QAAQ,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;EAC3D,OAAO,uBAAuB,QAAQ,KAAK,SAAS;GAClD,MAAM,MAAM,OAAO,IAAI,IAAI;GAC3B,OAAO,MAAM;IAAE;IAAM,OAAO,IAAI;IAAO,OAAO,IAAI;GAAM,IAAI,kBAAkB,IAAI;EACpF,CAAC;CACH;CAEA,MAAM,2BACJ,OACA,QACA,aACmC;EACnC,MAAM,KAAK,KAAK,kBAAkB,OAAO,QAAQ,WAAW;EAC5D,KAAK,OAAO,KAAK,oCAAoC;GACnD;GACA;GACA,OAAO,YAAY,KAAK,SAAS,KAAK,IAAI;EAC5C,CAAC;EACD,OAAO,KAAK,wBAAwB,OAAO,MAAM;CACnD;AACF"}

package/dist/organizations/access-scopes.d.ts

@@ -1,19 +0,0 @@
-import { Role } from "../types/schemas/organizations.js";
-import { Permission } from "./roles.js";
-//#region src/organizations/access-scopes.d.ts
-declare const ACCESS_SCOPES: readonly ["courses:read", "courses:write", "courses:delete", "downloads:read", "downloads:write", "downloads:delete", "bundles:read", "bundles:write", "bundles:delete", "media:read", "students:read", "students:invite", "access:read", "access:write", "analytics:read", "automations:read", "automations:write", "automations:delete", "comments:read", "comments:moderate", "communities:read", "communities:write", "communities:delete", "community_members:read", "community_members:write", "community_moderation:read", "community_moderation:write"];
-type AccessScope = (typeof ACCESS_SCOPES)[number];
-declare const SCOPE_PERMISSION: Record<AccessScope, Permission | null>;
-type ScopeOption = {
-  scope: AccessScope;
-  allowed: boolean;
-};
-declare function isAccessScope(value: string): value is AccessScope;
-declare function isDeleteScope(scope: AccessScope): boolean;
-declare function roleHoldsScope(role: Role, scope: AccessScope): boolean;
-declare function scopesForRole(role: Role): AccessScope[];
-declare function scopeOptions(role: Role): ScopeOption[];
-declare function assertRoleHoldsScopes(role: Role, scopes: readonly AccessScope[]): void;
-//#endregion
-export { ACCESS_SCOPES, AccessScope, SCOPE_PERMISSION, ScopeOption, assertRoleHoldsScopes, isAccessScope, isDeleteScope, roleHoldsScope, scopeOptions, scopesForRole };
-//# sourceMappingURL=access-scopes.d.ts.map

package/dist/organizations/access-scopes.js

@@ -1,89 +0,0 @@
-import { ForbiddenError } from "../shared/errors.js";
-import { capability, isStaffRole } from "./roles.js";
-//#region src/organizations/access-scopes.ts
-const ACCESS_SCOPES = [
-	"courses:read",
-	"courses:write",
-	"courses:delete",
-	"downloads:read",
-	"downloads:write",
-	"downloads:delete",
-	"bundles:read",
-	"bundles:write",
-	"bundles:delete",
-	"media:read",
-	"students:read",
-	"students:invite",
-	"access:read",
-	"access:write",
-	"analytics:read",
-	"automations:read",
-	"automations:write",
-	"automations:delete",
-	"comments:read",
-	"comments:moderate",
-	"communities:read",
-	"communities:write",
-	"communities:delete",
-	"community_members:read",
-	"community_members:write",
-	"community_moderation:read",
-	"community_moderation:write"
-];
-const SCOPE_PERMISSION = {
-	"courses:read": null,
-	"courses:write": "create_course",
-	"courses:delete": "create_course",
-	"downloads:read": null,
-	"downloads:write": "create_course",
-	"downloads:delete": "create_course",
-	"bundles:read": null,
-	"bundles:write": "create_course",
-	"bundles:delete": "create_course",
-	"media:read": null,
-	"students:read": "view_student_progress",
-	"students:invite": "manage_users",
-	"access:read": "view_student_progress",
-	"access:write": "manage_users",
-	"analytics:read": "view_student_progress",
-	"automations:read": null,
-	"automations:write": "manage_org_settings",
-	"automations:delete": "manage_org_settings",
-	"comments:read": null,
-	"comments:moderate": "edit_assigned_course",
-	"communities:read": null,
-	"communities:write": "create_course",
-	"communities:delete": "create_course",
-	"community_members:read": null,
-	"community_members:write": "moderate",
-	"community_moderation:read": null,
-	"community_moderation:write": "moderate"
-};
-function isAccessScope(value) {
-	return ACCESS_SCOPES.includes(value);
-}
-function isDeleteScope(scope) {
-	return scope.endsWith(":delete");
-}
-function roleHoldsScope(role, scope) {
-	if (!isStaffRole(role)) return false;
-	const permission = SCOPE_PERMISSION[scope];
-	return permission === null || capability(role, permission) === true;
-}
-function scopesForRole(role) {
-	return ACCESS_SCOPES.filter((scope) => roleHoldsScope(role, scope));
-}
-function scopeOptions(role) {
-	return ACCESS_SCOPES.map((scope) => ({
-		scope,
-		allowed: roleHoldsScope(role, scope)
-	}));
-}
-function assertRoleHoldsScopes(role, scopes) {
-	const missing = scopes.filter((scope) => !roleHoldsScope(role, scope));
-	if (missing.length > 0) throw new ForbiddenError(`Your role cannot grant ${missing.join(", ")}`);
-}
-//#endregion
-export { ACCESS_SCOPES, SCOPE_PERMISSION, assertRoleHoldsScopes, isAccessScope, isDeleteScope, roleHoldsScope, scopeOptions, scopesForRole };
-
-//# sourceMappingURL=access-scopes.js.map

package/dist/organizations/access-scopes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-scopes.js","names":[],"sources":["../../src/organizations/access-scopes.ts"],"sourcesContent":["import { ForbiddenError } from '../shared/errors.js';\nimport { capability, isStaffRole, type Permission, type Role } from './roles.js';\n\nexport const ACCESS_SCOPES = [\n  'courses:read',\n  'courses:write',\n  'courses:delete',\n  'downloads:read',\n  'downloads:write',\n  'downloads:delete',\n  'bundles:read',\n  'bundles:write',\n  'bundles:delete',\n  'media:read',\n  'students:read',\n  'students:invite',\n  'access:read',\n  'access:write',\n  'analytics:read',\n  'automations:read',\n  'automations:write',\n  'automations:delete',\n  'comments:read',\n  'comments:moderate',\n  'communities:read',\n  'communities:write',\n  'communities:delete',\n  'community_members:read',\n  'community_members:write',\n  'community_moderation:read',\n  'community_moderation:write',\n] as const;\n\nexport type AccessScope = (typeof ACCESS_SCOPES)[number];\n\nexport const SCOPE_PERMISSION: Record<AccessScope, Permission | null> = {\n  'courses:read': null,\n  'courses:write': 'create_course',\n  'courses:delete': 'create_course',\n  'downloads:read': null,\n  'downloads:write': 'create_course',\n  'downloads:delete': 'create_course',\n  'bundles:read': null,\n  'bundles:write': 'create_course',\n  'bundles:delete': 'create_course',\n  'media:read': null,\n  'students:read': 'view_student_progress',\n  'students:invite': 'manage_users',\n  'access:read': 'view_student_progress',\n  'access:write': 'manage_users',\n  'analytics:read': 'view_student_progress',\n  'automations:read': null,\n  'automations:write': 'manage_org_settings',\n  'automations:delete': 'manage_org_settings',\n  'comments:read': null,\n  'comments:moderate': 'edit_assigned_course',\n  'communities:read': null,\n  'communities:write': 'create_course',\n  'communities:delete': 'create_course',\n  'community_members:read': null,\n  'community_members:write': 'moderate',\n  'community_moderation:read': null,\n  'community_moderation:write': 'moderate',\n};\n\nexport type ScopeOption = { scope: AccessScope; allowed: boolean };\n\nexport function isAccessScope(value: string): value is AccessScope {\n  return (ACCESS_SCOPES as readonly string[]).includes(value);\n}\n\nexport function isDeleteScope(scope: AccessScope): boolean {\n  return scope.endsWith(':delete');\n}\n\nexport function roleHoldsScope(role: Role, scope: AccessScope): boolean {\n  if (!isStaffRole(role)) {\n    return false;\n  }\n  const permission = SCOPE_PERMISSION[scope];\n  return permission === null || capability(role, permission) === true;\n}\n\nexport function scopesForRole(role: Role): AccessScope[] {\n  return ACCESS_SCOPES.filter((scope) => roleHoldsScope(role, scope));\n}\n\nexport function scopeOptions(role: Role): ScopeOption[] {\n  return ACCESS_SCOPES.map((scope) => ({ scope, allowed: roleHoldsScope(role, scope) }));\n}\n\nexport function assertRoleHoldsScopes(role: Role, scopes: readonly AccessScope[]): void {\n  const missing = scopes.filter((scope) => !roleHoldsScope(role, scope));\n  if (missing.length > 0) {\n    throw new ForbiddenError(`Your role cannot grant ${missing.join(', ')}`);\n  }\n}\n"],"mappings":";;;AAGA,MAAa,gBAAgB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAIA,MAAa,mBAA2D;CACtE,gBAAgB;CAChB,iBAAiB;CACjB,kBAAkB;CAClB,kBAAkB;CAClB,mBAAmB;CACnB,oBAAoB;CACpB,gBAAgB;CAChB,iBAAiB;CACjB,kBAAkB;CAClB,cAAc;CACd,iBAAiB;CACjB,mBAAmB;CACnB,eAAe;CACf,gBAAgB;CAChB,kBAAkB;CAClB,oBAAoB;CACpB,qBAAqB;CACrB,sBAAsB;CACtB,iBAAiB;CACjB,qBAAqB;CACrB,oBAAoB;CACpB,qBAAqB;CACrB,sBAAsB;CACtB,0BAA0B;CAC1B,2BAA2B;CAC3B,6BAA6B;CAC7B,8BAA8B;AAChC;AAIA,SAAgB,cAAc,OAAqC;CACjE,OAAQ,cAAoC,SAAS,KAAK;AAC5D;AAEA,SAAgB,cAAc,OAA6B;CACzD,OAAO,MAAM,SAAS,SAAS;AACjC;AAEA,SAAgB,eAAe,MAAY,OAA6B;CACtE,IAAI,CAAC,YAAY,IAAI,GACnB,OAAO;CAET,MAAM,aAAa,iBAAiB;CACpC,OAAO,eAAe,QAAQ,WAAW,MAAM,UAAU,MAAM;AACjE;AAEA,SAAgB,cAAc,MAA2B;CACvD,OAAO,cAAc,QAAQ,UAAU,eAAe,MAAM,KAAK,CAAC;AACpE;AAEA,SAAgB,aAAa,MAA2B;CACtD,OAAO,cAAc,KAAK,WAAW;EAAE;EAAO,SAAS,eAAe,MAAM,KAAK;CAAE,EAAE;AACvF;AAEA,SAAgB,sBAAsB,MAAY,QAAsC;CACtF,MAAM,UAAU,OAAO,QAAQ,UAAU,CAAC,eAAe,MAAM,KAAK,CAAC;CACrE,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,eAAe,0BAA0B,QAAQ,KAAK,IAAI,GAAG;AAE3E"}

package/dist/organizations/roles.d.ts

@@ -1,19 +0,0 @@
-import { Role } from "../types/schemas/organizations.js";
-import "../types/index.js";
-//#region src/organizations/roles.d.ts
-declare const ROLES: readonly ["owner", "admin", "instructor", "moderator", "student"];
-type StaffRole = 'owner' | 'admin' | 'instructor';
-declare const STAFF_ROLES: readonly ["owner", "admin", "instructor"];
-type TeamRole = Exclude<Role, 'student'>;
-declare function isRole(value: string): value is Role;
-declare function isStaffRole(value: string): value is StaffRole;
-declare function parseRole(value: string): Role;
-type Permission = 'manage_billing' | 'manage_org_settings' | 'manage_users' | 'create_course' | 'edit_assigned_course' | 'view_student_progress' | 'moderate' | 'consume_content';
-type Capability = true | 'assigned' | 'enrolled';
-declare function capability(role: Role, permission: Permission): Capability | false;
-declare function canModerate(role: Role): boolean;
-declare function normalizeRole(raw: string): Role;
-declare const STUDENT_ROLE = "student";
-//#endregion
-export { Capability, Permission, ROLES, type Role, STAFF_ROLES, STUDENT_ROLE, StaffRole, TeamRole, canModerate, capability, isRole, isStaffRole, normalizeRole, parseRole };
-//# sourceMappingURL=roles.d.ts.map

package/dist/organizations/roles.js

@@ -1,82 +0,0 @@
-//#region src/organizations/roles.ts
-const ROLES = [
-	"owner",
-	"admin",
-	"instructor",
-	"moderator",
-	"student"
-];
-const STAFF_ROLES = [
-	"owner",
-	"admin",
-	"instructor"
-];
-function isRole(value) {
-	return ROLES.includes(value);
-}
-function isStaffRole(value) {
-	return STAFF_ROLES.includes(value);
-}
-function parseRole(value) {
-	if (!isRole(value)) throw new Error(`unknown role: ${value}`);
-	return value;
-}
-const MATRIX = {
-	owner: {
-		manage_billing: true,
-		manage_org_settings: true,
-		manage_users: true,
-		create_course: true,
-		edit_assigned_course: true,
-		view_student_progress: true,
-		moderate: true
-	},
-	admin: {
-		manage_org_settings: true,
-		manage_users: true,
-		create_course: true,
-		edit_assigned_course: true,
-		view_student_progress: true,
-		moderate: true
-	},
-	instructor: {
-		edit_assigned_course: "assigned",
-		view_student_progress: "assigned",
-		moderate: true
-	},
-	moderator: {
-		moderate: true,
-		consume_content: "enrolled"
-	},
-	student: { consume_content: "enrolled" }
-};
-function capability(role, permission) {
-	return MATRIX[role][permission] ?? false;
-}
-function canModerate(role) {
-	return capability(role, "moderate") === true;
-}
-const RANK = {
-	owner: 4,
-	admin: 3,
-	instructor: 2,
-	moderator: 1,
-	student: 0
-};
-function normalizeRole(raw) {
-	let best = "instructor";
-	let bestRank = -1;
-	for (const token of raw.split(",").map((t) => t.trim())) {
-		const r = isRole(token) ? token : token === "member" ? "instructor" : null;
-		if (r && RANK[r] > bestRank) {
-			best = r;
-			bestRank = RANK[r];
-		}
-	}
-	return best;
-}
-const STUDENT_ROLE = "student";
-//#endregion
-export { ROLES, STAFF_ROLES, STUDENT_ROLE, canModerate, capability, isRole, isStaffRole, normalizeRole, parseRole };
-
-//# sourceMappingURL=roles.js.map

package/dist/organizations/roles.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"roles.js","names":[],"sources":["../../src/organizations/roles.ts"],"sourcesContent":["// organizations context — roles and the authorization matrix.\n// Defined in code (no DB enum). The DB stores role as text; the domain narrows\n// it to Role and answers authorization questions here. The Role type itself is\n// owned by @headless-lms/core/types; RANK/MATRIX below are Record<Role, …>, so the\n// compiler forces this file to cover every role the published type declares.\nimport type { Role } from '../types/index.js';\n\nexport type { Role };\nexport const ROLES = [\n  'owner',\n  'admin',\n  'instructor',\n  'moderator',\n  'student',\n] as const satisfies readonly Role[];\n\nexport type StaffRole = 'owner' | 'admin' | 'instructor';\nexport const STAFF_ROLES = ['owner', 'admin', 'instructor'] as const satisfies readonly StaffRole[];\n\nexport type TeamRole = Exclude<Role, 'student'>;\n\nexport function isRole(value: string): value is Role {\n  return (ROLES as readonly string[]).includes(value);\n}\n\nexport function isStaffRole(value: string): value is StaffRole {\n  return (STAFF_ROLES as readonly string[]).includes(value);\n}\n\nexport function parseRole(value: string): Role {\n  if (!isRole(value)) {\n    throw new Error(`unknown role: ${value}`);\n  }\n  return value;\n}\n\nexport type Permission =\n  | 'manage_billing'\n  | 'manage_org_settings'\n  | 'manage_users'\n  | 'create_course'\n  | 'edit_assigned_course'\n  | 'view_student_progress'\n  | 'moderate'\n  | 'consume_content';\n\n// Unconditional (true), course-scoped (\"assigned\"), or enrollment-scoped\n// (\"enrolled\" — access owned by entitlements). Absent ⇒ denied.\n//\n// \"assigned\" is a granted-but-narrowed answer: the role holds the permission,\n// but only over some subset of courses. Nothing narrows it today — there is no\n// course-assignment store — so callers must decide what a narrowed grant means\n// for them. `authorize` treats it as denied; `tools.ts` treats it as granted.\nexport type Capability = true | 'assigned' | 'enrolled';\n\nconst MATRIX: Record<Role, Partial<Record<Permission, Capability>>> = {\n  owner: {\n    manage_billing: true,\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n    moderate: true,\n  },\n  admin: {\n    manage_org_settings: true,\n    manage_users: true,\n    create_course: true,\n    edit_assigned_course: true,\n    view_student_progress: true,\n    moderate: true,\n  },\n  instructor: {\n    edit_assigned_course: 'assigned',\n    view_student_progress: 'assigned',\n    moderate: true,\n  },\n  moderator: {\n    moderate: true,\n    consume_content: 'enrolled',\n  },\n  student: {\n    consume_content: 'enrolled',\n  },\n};\n\nexport function capability(role: Role, permission: Permission): Capability | false {\n  return MATRIX[role][permission] ?? false;\n}\n\nexport function canModerate(role: Role): boolean {\n  return capability(role, 'moderate') === true;\n}\n\n// Better Auth's role model is broader than ours: it keeps a built-in `member`\n// role and allows comma-joined multi-role strings. Normalize any incoming role\n// string to a single domain Role before persisting: `member` -> `instructor`, a\n// multi-role string -> its highest-privilege known role, unknown -> `instructor`.\nconst RANK: Record<Role, number> = { owner: 4, admin: 3, instructor: 2, moderator: 1, student: 0 };\n\nexport function normalizeRole(raw: string): Role {\n  let best: Role = 'instructor';\n  let bestRank = -1;\n  for (const token of raw.split(',').map((t) => t.trim())) {\n    const r: Role | null = isRole(token) ? token : token === 'member' ? 'instructor' : null;\n    if (r && RANK[r] > bestRank) {\n      best = r;\n      bestRank = RANK[r];\n    }\n  }\n  return best;\n}\n\n// Invites carry either a staff Role or this marker: the invited account is\n// a portal student, not an org member. Owned by the organizations domain — the\n// invite provider adapter reuses it to branch links, emails, and grants.\nexport const STUDENT_ROLE = 'student';\n"],"mappings":";AAQA,MAAa,QAAQ;CACnB;CACA;CACA;CACA;CACA;AACF;AAGA,MAAa,cAAc;CAAC;CAAS;CAAS;AAAY;AAI1D,SAAgB,OAAO,OAA8B;CACnD,OAAQ,MAA4B,SAAS,KAAK;AACpD;AAEA,SAAgB,YAAY,OAAmC;CAC7D,OAAQ,YAAkC,SAAS,KAAK;AAC1D;AAEA,SAAgB,UAAU,OAAqB;CAC7C,IAAI,CAAC,OAAO,KAAK,GACf,MAAM,IAAI,MAAM,iBAAiB,OAAO;CAE1C,OAAO;AACT;AAqBA,MAAM,SAAgE;CACpE,OAAO;EACL,gBAAgB;EAChB,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;EACvB,UAAU;CACZ;CACA,OAAO;EACL,qBAAqB;EACrB,cAAc;EACd,eAAe;EACf,sBAAsB;EACtB,uBAAuB;EACvB,UAAU;CACZ;CACA,YAAY;EACV,sBAAsB;EACtB,uBAAuB;EACvB,UAAU;CACZ;CACA,WAAW;EACT,UAAU;EACV,iBAAiB;CACnB;CACA,SAAS,EACP,iBAAiB,WACnB;AACF;AAEA,SAAgB,WAAW,MAAY,YAA4C;CACjF,OAAO,OAAO,KAAK,CAAC,eAAe;AACrC;AAEA,SAAgB,YAAY,MAAqB;CAC/C,OAAO,WAAW,MAAM,UAAU,MAAM;AAC1C;AAMA,MAAM,OAA6B;CAAE,OAAO;CAAG,OAAO;CAAG,YAAY;CAAG,WAAW;CAAG,SAAS;AAAE;AAEjG,SAAgB,cAAc,KAAmB;CAC/C,IAAI,OAAa;CACjB,IAAI,WAAW;CACf,KAAK,MAAM,SAAS,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,CAAC,GAAG;EACvD,MAAM,IAAiB,OAAO,KAAK,IAAI,QAAQ,UAAU,WAAW,eAAe;EACnF,IAAI,KAAK,KAAK,KAAK,UAAU;GAC3B,OAAO;GACP,WAAW,KAAK;EAClB;CACF;CACA,OAAO;AACT;AAKA,MAAa,eAAe"}