@headless-lms/core 0.4.0 → 0.6.0

package/dist/identity/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../src/identity/service.ts"],"sourcesContent":["import type { IdentityRepository, IdentityService, IdentityUnitOfWork } from './ports.js';\nimport type { User, UserProfile, UserProfileView } from './model.js';\nimport type { UpdateProfileInput } from './ports.js';\nimport type { CreateUserInput, UpdateUserInput } from './types.js';\nimport type { Logger } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { genId } from '../shared/id.js';\nimport { ConflictError, ForbiddenError, NotFoundError } from '../shared/errors.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport type { FileUrls, MemberImageReader } from '../assets/index.js';\nimport { identityEvents } from './events.js';\n\nconst UNNAMED = 'A member';\n\nexport class IdentityServiceImpl implements IdentityService {\n  private readonly repo: IdentityRepository;\n  private readonly logger: Logger;\n  private readonly uow: IdentityUnitOfWork;\n  private readonly mailer: Pick<Mailer, 'send'>;\n  private readonly images: MemberImageReader;\n  private readonly fileUrls: FileUrls;\n\n  constructor(input: {\n    repo: IdentityRepository;\n    logger?: Logger;\n    mailer: Mailer;\n    uow: IdentityUnitOfWork;\n    images: MemberImageReader;\n    fileUrls: FileUrls;\n  }) {\n    this.repo = input.repo;\n    this.mailer = input.mailer;\n    this.logger = input.logger ?? noopLogger;\n    this.uow = input.uow;\n    this.images = input.images;\n    this.fileUrls = input.fileUrls;\n  }\n\n  async createUser(input: CreateUserInput): Promise<User> {\n    const created = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.insertUser(input);\n      await outbox.append([identityEvents.userCreated.make({ orgId: '-', data: user })]);\n      return user;\n    });\n    this.logger.info('user created', { userId: created.id });\n    return created;\n  }\n\n  async linkOrCreateUser(input: CreateUserInput): Promise<User> {\n    const existing = await this.repo.findUserByEmail(input.email);\n    if (!existing) {\n      const id = input.id ?? genId('user');\n      return this.createUser({ ...input, id, externalId: id });\n    }\n    if (existing.externalId !== null) {\n      throw new ConflictError('That email already has an account');\n    }\n    // Existing user without external link, so invited. update the user with the\n    // id.\n    const linked = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.updateUser(existing.id, {\n        externalId: existing.id,\n        ...(input.firstName !== undefined && { firstName: input.firstName }),\n        ...(input.lastName !== undefined && { lastName: input.lastName }),\n      });\n      await outbox.append([identityEvents.userUpdated.make({ orgId: '-', data: user! })]);\n      return user!;\n    });\n    this.logger.info('user linked to auth account', { userId: linked.id });\n    return linked;\n  }\n\n  async updateUser(id: string, input: UpdateUserInput): Promise<User> {\n    const person = await this.repo.findUserById(id);\n    if (!person) {\n      throw new NotFoundError('User', id);\n    }\n\n    const updated = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.updateUser(id, input);\n      await outbox.append([identityEvents.userUpdated.make({ orgId: '-', data: user! })]);\n      return user!;\n    });\n    this.logger.info('user updated', { userId: updated.id });\n    return updated;\n  }\n\n  async getUserByExternalId(externalId: string): Promise<User | null> {\n    return this.repo.findUserByExternalId(externalId);\n  }\n\n  async getUserByEmail(email: string): Promise<User | null> {\n    return this.repo.findUserByEmail(email);\n  }\n\n  async getUserById(id: string): Promise<User | null> {\n    return this.repo.findUserById(id);\n  }\n\n  async sendPasswordReset(input: { email: string; url: string }): Promise<void> {\n    await this.mailer.send(input.email, 'passwordReset', { resetUrl: input.url });\n  }\n\n  async sendPasswordChanged(input: { email: string }): Promise<void> {\n    await this.mailer.send(input.email, 'passwordChanged', {});\n  }\n\n  async sendMagicLink(input: { email: string; url: string }): Promise<void> {\n    await this.mailer.send(input.email, 'magicLink', { url: input.url });\n  }\n\n  async profileOf(orgId: string, userId: string): Promise<UserProfileView> {\n    const stored = await this.repo.findProfile(userId);\n    if (stored) {\n      return this.view(orgId, stored);\n    }\n    const never = new Date(0);\n    return {\n      userId,\n      displayName: null,\n      headline: null,\n      bio: null,\n      imageAssetOrgId: null,\n      imageAssetId: null,\n      imageUrl: null,\n      extra: {},\n      createdAt: never,\n      updatedAt: never,\n    };\n  }\n\n  private view(orgId: string, profile: UserProfile): UserProfileView {\n    const imageAssetId = profile.imageAssetOrgId === orgId ? profile.imageAssetId : null;\n    return { ...profile, imageUrl: imageAssetId ? this.fileUrls.memberUpload(imageAssetId) : null };\n  }\n\n  async displayName(userId: string | null): Promise<string> {\n    if (userId === null) {\n      return UNNAMED;\n    }\n    const [profile, user] = await Promise.all([\n      this.repo.findProfile(userId),\n      this.repo.findUserById(userId),\n    ]);\n    const named = profile?.displayName?.trim();\n    if (named) {\n      return named;\n    }\n    const composed = [user?.firstName, user?.lastName].filter(Boolean).join(' ').trim();\n    return composed || UNNAMED;\n  }\n\n  async updateProfile(\n    orgId: string,\n    userId: string,\n    actorUserId: string,\n    orgUserId: string,\n    patch: UpdateProfileInput,\n  ): Promise<UserProfileView> {\n    if (actorUserId !== userId) {\n      throw new ForbiddenError('You can only update your own profile');\n    }\n    const user = await this.repo.findUserById(userId);\n    if (!user) {\n      throw new NotFoundError('User', userId);\n    }\n    if (patch.imageAssetId != null) {\n      const owned = await this.images.ownsImage(orgId, patch.imageAssetId, orgUserId);\n      if (!owned) {\n        this.logger.debug('profile photo refused', {\n          userId,\n          orgUserId,\n          assetId: patch.imageAssetId,\n        });\n        throw new NotFoundError('Asset', patch.imageAssetId);\n      }\n    }\n    const imageAssetOrgId =\n      patch.imageAssetId === undefined ? undefined : patch.imageAssetId === null ? null : orgId;\n    const profile = await this.repo.upsertProfile(userId, { ...patch, imageAssetOrgId });\n    this.logger.info('profile updated', { userId });\n    return this.view(orgId, profile);\n  }\n}\n"],"mappings":";;;;;AAYA,MAAM,UAAU;AAEhB,IAAa,sBAAb,MAA4D;CAC1D;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,OAOT;EACD,KAAK,OAAO,MAAM;EAClB,KAAK,SAAS,MAAM;EACpB,KAAK,SAAS,MAAM,UAAU;EAC9B,KAAK,MAAM,MAAM;EACjB,KAAK,SAAS,MAAM;EACpB,KAAK,WAAW,MAAM;CACxB;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GACjE,MAAM,OAAO,MAAM,SAAS,WAAW,KAAK;GAC5C,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAK,CAAC,CAAC,CAAC;GACjF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,gBAAgB,EAAE,QAAQ,QAAQ,GAAG,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAuC;EAC5D,MAAM,WAAW,MAAM,KAAK,KAAK,gBAAgB,MAAM,KAAK;EAC5D,IAAI,CAAC,UAAU;GACb,MAAM,KAAK,MAAM,MAAM,MAAM,MAAM;GACnC,OAAO,KAAK,WAAW;IAAE,GAAG;IAAO;IAAI,YAAY;GAAG,CAAC;EACzD;EACA,IAAI,SAAS,eAAe,MAC1B,MAAM,IAAI,cAAc,mCAAmC;EAI7D,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GAChE,MAAM,OAAO,MAAM,SAAS,WAAW,SAAS,IAAI;IAClD,YAAY,SAAS;IACrB,GAAI,MAAM,cAAc,KAAA,KAAa,EAAE,WAAW,MAAM,UAAU;IAClE,GAAI,MAAM,aAAa,KAAA,KAAa,EAAE,UAAU,MAAM,SAAS;GACjE,CAAC;GACD,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAM,CAAC,CAAC,CAAC;GAClF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,+BAA+B,EAAE,QAAQ,OAAO,GAAG,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,WAAW,IAAY,OAAuC;EAElE,IAAI,CAAC,MADgB,KAAK,KAAK,aAAa,EAAE,GAE5C,MAAM,IAAI,cAAc,QAAQ,EAAE;EAGpC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GACjE,MAAM,OAAO,MAAM,SAAS,WAAW,IAAI,KAAK;GAChD,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAM,CAAC,CAAC,CAAC;GAClF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,gBAAgB,EAAE,QAAQ,QAAQ,GAAG,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,oBAAoB,YAA0C;EAClE,OAAO,KAAK,KAAK,qBAAqB,UAAU;CAClD;CAEA,MAAM,eAAe,OAAqC;EACxD,OAAO,KAAK,KAAK,gBAAgB,KAAK;CACxC;CAEA,MAAM,YAAY,IAAkC;EAClD,OAAO,KAAK,KAAK,aAAa,EAAE;CAClC;CAEA,MAAM,kBAAkB,OAAsD;EAC5E,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,iBAAiB,EAAE,UAAU,MAAM,IAAI,CAAC;CAC9E;CAEA,MAAM,oBAAoB,OAAyC;EACjE,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,mBAAmB,CAAC,CAAC;CAC3D;CAEA,MAAM,cAAc,OAAsD;EACxE,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,aAAa,EAAE,KAAK,MAAM,IAAI,CAAC;CACrE;CAEA,MAAM,UAAU,OAAe,QAA0C;EACvE,MAAM,SAAS,MAAM,KAAK,KAAK,YAAY,MAAM;EACjD,IAAI,QACF,OAAO,KAAK,KAAK,OAAO,MAAM;EAEhC,MAAM,wBAAQ,IAAI,KAAK,CAAC;EACxB,OAAO;GACL;GACA,aAAa;GACb,UAAU;GACV,KAAK;GACL,iBAAiB;GACjB,cAAc;GACd,UAAU;GACV,OAAO,CAAC;GACR,WAAW;GACX,WAAW;EACb;CACF;CAEA,KAAa,OAAe,SAAuC;EACjE,MAAM,eAAe,QAAQ,oBAAoB,QAAQ,QAAQ,eAAe;EAChF,OAAO;GAAE,GAAG;GAAS,UAAU,eAAe,KAAK,SAAS,aAAa,YAAY,IAAI;EAAK;CAChG;CAEA,MAAM,YAAY,QAAwC;EACxD,IAAI,WAAW,MACb,OAAO;EAET,MAAM,CAAC,SAAS,QAAQ,MAAM,QAAQ,IAAI,CACxC,KAAK,KAAK,YAAY,MAAM,GAC5B,KAAK,KAAK,aAAa,MAAM,CAC/B,CAAC;EACD,MAAM,QAAQ,SAAS,aAAa,KAAK;EACzC,IAAI,OACF,OAAO;EAGT,OADiB,CAAC,MAAM,WAAW,MAAM,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAC/D,KAAK;CACrB;CAEA,MAAM,cACJ,OACA,QACA,aACA,WACA,OAC0B;EAC1B,IAAI,gBAAgB,QAClB,MAAM,IAAI,eAAe,sCAAsC;EAGjE,IAAI,CAAC,MADc,KAAK,KAAK,aAAa,MAAM,GAE9C,MAAM,IAAI,cAAc,QAAQ,MAAM;EAExC,IAAI,MAAM,gBAAgB,MAEpB;OAAA,CAAC,MADe,KAAK,OAAO,UAAU,OAAO,MAAM,cAAc,SAAS,GAClE;IACV,KAAK,OAAO,MAAM,yBAAyB;KACzC;KACA;KACA,SAAS,MAAM;IACjB,CAAC;IACD,MAAM,IAAI,cAAc,SAAS,MAAM,YAAY;GACrD;;EAEF,MAAM,kBACJ,MAAM,iBAAiB,KAAA,IAAY,KAAA,IAAY,MAAM,iBAAiB,OAAO,OAAO;EACtF,MAAM,UAAU,MAAM,KAAK,KAAK,cAAc,QAAQ;GAAE,GAAG;GAAO;EAAgB,CAAC;EACnF,KAAK,OAAO,KAAK,mBAAmB,EAAE,OAAO,CAAC;EAC9C,OAAO,KAAK,KAAK,OAAO,OAAO;CACjC;AACF"}
+{"version":3,"file":"service.js","names":[],"sources":["../../src/identity/service.ts"],"sourcesContent":["import type { IdentityRepository, IdentityService, IdentityUnitOfWork } from './ports.js';\nimport type { User, UserProfile, UserProfileView } from './model.js';\nimport type { MemberActor, UpdateProfileInput } from './ports.js';\nimport type { CreateUserInput, UpdateUserInput } from './types.js';\nimport type { Logger } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { genId } from '../shared/id.js';\nimport { ConflictError, NotFoundError } from '../shared/errors.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport type { AssetFiles, FileUrls, MemberImageReader } from '../assets/index.js';\nimport { identityEvents } from './events.js';\n\nexport const UNNAMED_MEMBER = 'A member';\n\nexport class IdentityServiceImpl implements IdentityService {\n  private readonly repo: IdentityRepository;\n  private readonly logger: Logger;\n  private readonly uow: IdentityUnitOfWork;\n  private readonly mailer: Pick<Mailer, 'send'>;\n  private readonly images: MemberImageReader & Pick<AssetFiles, 'syncPublicImages'>;\n  private readonly fileUrls: FileUrls;\n\n  constructor(input: {\n    repo: IdentityRepository;\n    logger?: Logger;\n    mailer: Mailer;\n    uow: IdentityUnitOfWork;\n    images: MemberImageReader & Pick<AssetFiles, 'syncPublicImages'>;\n    fileUrls: FileUrls;\n  }) {\n    this.repo = input.repo;\n    this.mailer = input.mailer;\n    this.logger = input.logger ?? noopLogger;\n    this.uow = input.uow;\n    this.images = input.images;\n    this.fileUrls = input.fileUrls;\n  }\n\n  async createUser(input: CreateUserInput): Promise<User> {\n    const created = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.insertUser(input);\n      await outbox.append([identityEvents.userCreated.make({ orgId: '-', data: user })]);\n      return user;\n    });\n    this.logger.info('user created', { userId: created.id });\n    return created;\n  }\n\n  async linkOrCreateUser(input: CreateUserInput): Promise<User> {\n    const existing = await this.repo.findUserByEmail(input.email);\n    if (!existing) {\n      const id = input.id ?? genId('user');\n      return this.createUser({ ...input, id, externalId: id });\n    }\n    if (existing.externalId !== null) {\n      throw new ConflictError('That email already has an account');\n    }\n    // Existing user without external link, so invited. update the user with the\n    // id.\n    const linked = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.updateUser(existing.id, {\n        externalId: existing.id,\n        ...(input.firstName !== undefined && { firstName: input.firstName }),\n        ...(input.lastName !== undefined && { lastName: input.lastName }),\n      });\n      await outbox.append([identityEvents.userUpdated.make({ orgId: '-', data: user! })]);\n      return user!;\n    });\n    this.logger.info('user linked to auth account', { userId: linked.id });\n    return linked;\n  }\n\n  async updateUser(id: string, input: UpdateUserInput): Promise<User> {\n    const person = await this.repo.findUserById(id);\n    if (!person) {\n      throw new NotFoundError('User', id);\n    }\n\n    const updated = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.updateUser(id, input);\n      await outbox.append([identityEvents.userUpdated.make({ orgId: '-', data: user! })]);\n      return user!;\n    });\n    this.logger.info('user updated', { userId: updated.id });\n    return updated;\n  }\n\n  async getUserByExternalId(externalId: string): Promise<User | null> {\n    return this.repo.findUserByExternalId(externalId);\n  }\n\n  async getUserByEmail(email: string): Promise<User | null> {\n    return this.repo.findUserByEmail(email);\n  }\n\n  async getUserById(id: string): Promise<User | null> {\n    return this.repo.findUserById(id);\n  }\n\n  async sendPasswordReset(input: { email: string; url: string }): Promise<void> {\n    await this.mailer.send(input.email, 'passwordReset', { resetUrl: input.url });\n  }\n\n  async sendPasswordChanged(input: { email: string }): Promise<void> {\n    await this.mailer.send(input.email, 'passwordChanged', {});\n  }\n\n  async sendMagicLink(input: { email: string; url: string }): Promise<void> {\n    await this.mailer.send(input.email, 'magicLink', { url: input.url });\n  }\n\n  async profileOf(actor: MemberActor): Promise<UserProfileView> {\n    const userId = actor.userId;\n    const stored = await this.repo.findProfile(userId);\n    if (stored) {\n      return this.view(actor.orgId, actor.id, stored);\n    }\n    const never = new Date(0);\n    return {\n      userId,\n      displayName: null,\n      headline: null,\n      bio: null,\n      imageAssetOrgId: null,\n      imageAssetId: null,\n      imageUrl: null,\n      extra: {},\n      createdAt: never,\n      updatedAt: never,\n    };\n  }\n\n  private view(orgId: string, orgUserId: string, profile: UserProfile): UserProfileView {\n    const imageAssetId = profile.imageAssetOrgId === orgId ? profile.imageAssetId : null;\n    return {\n      ...profile,\n      imageUrl: imageAssetId ? this.fileUrls.publicImage(orgId, orgUserId, imageAssetId) : null,\n    };\n  }\n\n  async displayName(userId: string | null): Promise<string> {\n    if (userId === null) {\n      return UNNAMED_MEMBER;\n    }\n    const [profile, user] = await Promise.all([\n      this.repo.findProfile(userId),\n      this.repo.findUserById(userId),\n    ]);\n    const named = profile?.displayName?.trim();\n    if (named) {\n      return named;\n    }\n    const composed = [user?.firstName, user?.lastName].filter(Boolean).join(' ').trim();\n    return composed || UNNAMED_MEMBER;\n  }\n\n  async updateProfile(patch: UpdateProfileInput, actor: MemberActor): Promise<UserProfileView> {\n    const orgId = actor.orgId;\n    const userId = actor.userId;\n    const orgUserId = actor.id;\n    const user = await this.repo.findUserById(userId);\n    if (!user) {\n      throw new NotFoundError('User', userId);\n    }\n    if (patch.imageAssetId != null) {\n      const owned = await this.images.ownsImage(orgId, patch.imageAssetId, orgUserId);\n      if (!owned) {\n        this.logger.debug('profile photo refused', {\n          userId,\n          orgUserId,\n          assetId: patch.imageAssetId,\n        });\n        throw new NotFoundError('Asset', patch.imageAssetId);\n      }\n    }\n    const imageAssetOrgId =\n      patch.imageAssetId === undefined ? undefined : patch.imageAssetId === null ? null : orgId;\n    const profile = await this.repo.upsertProfile(userId, { ...patch, imageAssetOrgId });\n    this.logger.info('profile updated', { userId });\n    if (patch.imageAssetId !== undefined) {\n      await this.images.syncPublicImages(\n        orgId,\n        orgUserId,\n        profile.imageAssetOrgId === orgId && profile.imageAssetId ? [profile.imageAssetId] : [],\n      );\n    }\n    return this.view(orgId, orgUserId, profile);\n  }\n}\n"],"mappings":";;;;;AAYA,MAAa,iBAAiB;AAE9B,IAAa,sBAAb,MAA4D;CAC1D;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,OAOT;EACD,KAAK,OAAO,MAAM;EAClB,KAAK,SAAS,MAAM;EACpB,KAAK,SAAS,MAAM,UAAU;EAC9B,KAAK,MAAM,MAAM;EACjB,KAAK,SAAS,MAAM;EACpB,KAAK,WAAW,MAAM;CACxB;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GACjE,MAAM,OAAO,MAAM,SAAS,WAAW,KAAK;GAC5C,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAK,CAAC,CAAC,CAAC;GACjF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,gBAAgB,EAAE,QAAQ,QAAQ,GAAG,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAuC;EAC5D,MAAM,WAAW,MAAM,KAAK,KAAK,gBAAgB,MAAM,KAAK;EAC5D,IAAI,CAAC,UAAU;GACb,MAAM,KAAK,MAAM,MAAM,MAAM,MAAM;GACnC,OAAO,KAAK,WAAW;IAAE,GAAG;IAAO;IAAI,YAAY;GAAG,CAAC;EACzD;EACA,IAAI,SAAS,eAAe,MAC1B,MAAM,IAAI,cAAc,mCAAmC;EAI7D,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GAChE,MAAM,OAAO,MAAM,SAAS,WAAW,SAAS,IAAI;IAClD,YAAY,SAAS;IACrB,GAAI,MAAM,cAAc,KAAA,KAAa,EAAE,WAAW,MAAM,UAAU;IAClE,GAAI,MAAM,aAAa,KAAA,KAAa,EAAE,UAAU,MAAM,SAAS;GACjE,CAAC;GACD,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAM,CAAC,CAAC,CAAC;GAClF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,+BAA+B,EAAE,QAAQ,OAAO,GAAG,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,WAAW,IAAY,OAAuC;EAElE,IAAI,CAAC,MADgB,KAAK,KAAK,aAAa,EAAE,GAE5C,MAAM,IAAI,cAAc,QAAQ,EAAE;EAGpC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GACjE,MAAM,OAAO,MAAM,SAAS,WAAW,IAAI,KAAK;GAChD,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAM,CAAC,CAAC,CAAC;GAClF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,gBAAgB,EAAE,QAAQ,QAAQ,GAAG,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,oBAAoB,YAA0C;EAClE,OAAO,KAAK,KAAK,qBAAqB,UAAU;CAClD;CAEA,MAAM,eAAe,OAAqC;EACxD,OAAO,KAAK,KAAK,gBAAgB,KAAK;CACxC;CAEA,MAAM,YAAY,IAAkC;EAClD,OAAO,KAAK,KAAK,aAAa,EAAE;CAClC;CAEA,MAAM,kBAAkB,OAAsD;EAC5E,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,iBAAiB,EAAE,UAAU,MAAM,IAAI,CAAC;CAC9E;CAEA,MAAM,oBAAoB,OAAyC;EACjE,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,mBAAmB,CAAC,CAAC;CAC3D;CAEA,MAAM,cAAc,OAAsD;EACxE,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,aAAa,EAAE,KAAK,MAAM,IAAI,CAAC;CACrE;CAEA,MAAM,UAAU,OAA8C;EAC5D,MAAM,SAAS,MAAM;EACrB,MAAM,SAAS,MAAM,KAAK,KAAK,YAAY,MAAM;EACjD,IAAI,QACF,OAAO,KAAK,KAAK,MAAM,OAAO,MAAM,IAAI,MAAM;EAEhD,MAAM,wBAAQ,IAAI,KAAK,CAAC;EACxB,OAAO;GACL;GACA,aAAa;GACb,UAAU;GACV,KAAK;GACL,iBAAiB;GACjB,cAAc;GACd,UAAU;GACV,OAAO,CAAC;GACR,WAAW;GACX,WAAW;EACb;CACF;CAEA,KAAa,OAAe,WAAmB,SAAuC;EACpF,MAAM,eAAe,QAAQ,oBAAoB,QAAQ,QAAQ,eAAe;EAChF,OAAO;GACL,GAAG;GACH,UAAU,eAAe,KAAK,SAAS,YAAY,OAAO,WAAW,YAAY,IAAI;EACvF;CACF;CAEA,MAAM,YAAY,QAAwC;EACxD,IAAI,WAAW,MACb,OAAO;EAET,MAAM,CAAC,SAAS,QAAQ,MAAM,QAAQ,IAAI,CACxC,KAAK,KAAK,YAAY,MAAM,GAC5B,KAAK,KAAK,aAAa,MAAM,CAC/B,CAAC;EACD,MAAM,QAAQ,SAAS,aAAa,KAAK;EACzC,IAAI,OACF,OAAO;EAGT,OADiB,CAAC,MAAM,WAAW,MAAM,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAC/D,KAAA;CAChB;CAEA,MAAM,cAAc,OAA2B,OAA8C;EAC3F,MAAM,QAAQ,MAAM;EACpB,MAAM,SAAS,MAAM;EACrB,MAAM,YAAY,MAAM;EAExB,IAAI,CAAC,MADc,KAAK,KAAK,aAAa,MAAM,GAE9C,MAAM,IAAI,cAAc,QAAQ,MAAM;EAExC,IAAI,MAAM,gBAAgB,MAEpB;OAAA,CAAC,MADe,KAAK,OAAO,UAAU,OAAO,MAAM,cAAc,SAAS,GAClE;IACV,KAAK,OAAO,MAAM,yBAAyB;KACzC;KACA;KACA,SAAS,MAAM;IACjB,CAAC;IACD,MAAM,IAAI,cAAc,SAAS,MAAM,YAAY;GACrD;;EAEF,MAAM,kBACJ,MAAM,iBAAiB,KAAA,IAAY,KAAA,IAAY,MAAM,iBAAiB,OAAO,OAAO;EACtF,MAAM,UAAU,MAAM,KAAK,KAAK,cAAc,QAAQ;GAAE,GAAG;GAAO;EAAgB,CAAC;EACnF,KAAK,OAAO,KAAK,mBAAmB,EAAE,OAAO,CAAC;EAC9C,IAAI,MAAM,iBAAiB,KAAA,GACzB,MAAM,KAAK,OAAO,iBAChB,OACA,WACA,QAAQ,oBAAoB,SAAS,QAAQ,eAAe,CAAC,QAAQ,YAAY,IAAI,CAAC,CACxF;EAEF,OAAO,KAAK,KAAK,OAAO,WAAW,OAAO;CAC5C;AACF"}

package/dist/integrations/events.d.ts

@@ -22,8 +22,8 @@ declare const integrationEvents: {
     createdAt: unknown;
     updatedAt: unknown;
   }, import("zod").ZodObject<{
-    id: import("zod").ZodString;
     orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
     createdAt: import("zod").ZodCoercedDate<unknown>;
     updatedAt: import("zod").ZodCoercedDate<unknown>;
     active: import("zod").ZodBoolean;
@@ -49,8 +49,8 @@ declare const integrationEvents: {
     createdAt: unknown;
     updatedAt: unknown;
   }, import("zod").ZodObject<{
-    id: import("zod").ZodString;
     orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
     createdAt: import("zod").ZodCoercedDate<unknown>;
     updatedAt: import("zod").ZodCoercedDate<unknown>;
     active: import("zod").ZodBoolean;
@@ -76,8 +76,8 @@ declare const integrationEvents: {
     createdAt: unknown;
     updatedAt: unknown;
   }, import("zod").ZodObject<{
-    id: import("zod").ZodString;
     orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
     createdAt: import("zod").ZodCoercedDate<unknown>;
     updatedAt: import("zod").ZodCoercedDate<unknown>;
     active: import("zod").ZodBoolean;

package/dist/integrations/ports.d.ts

@@ -1,6 +1,7 @@
 import { ConfigureInput, ConnectInput, Connection, Validation } from "../types/schemas/integrations.js";
 import { Action, ActionContext, Integration } from "../types/integrations.js";
 import "../types/index.js";
+import { Actor } from "../shared/actor.js";
 import { CredentialStore, OutboxAppender, UnitOfWork } from "../shared/ports.js";
 import "./model.js";
 //#region src/integrations/ports.d.ts
@@ -23,22 +24,22 @@ interface AvailableIntegration {
 }
 interface IntegrationsService {
   /** The integrations declared in this deployment, with their config schemas. */
-  available(): AvailableIntegration[];
+  available(actor: Actor): AvailableIntegration[];
   /** Establish a connection for an org; stores its credential and configuration. */
-  connect(orgId: string, input: ConnectInput): Promise<Connection>;
+  connect(input: ConnectInput, actor: Actor): Promise<Connection>;
   /** Replace a connection's stored secrets (re-auth / token refresh). */
-  reconnect(orgId: string, id: string, secrets: Record<string, unknown>): Promise<Connection | null>;
+  reconnect(id: string, secrets: Record<string, unknown>, actor: Actor): Promise<Connection>;
   /** Set or change a connection's configuration and/or active flag. */
-  configure(orgId: string, id: string, input: ConfigureInput): Promise<Connection | null>;
+  configure(id: string, input: ConfigureInput, actor: Actor): Promise<Connection>;
   /** Remove a connection and destroy its credential. */
-  disconnect(orgId: string, id: string): Promise<boolean>;
-  list(orgId: string): Promise<Connection[]>;
-  get(orgId: string, id: string): Promise<Connection | null>;
+  disconnect(id: string, actor: Actor): Promise<void>;
+  list(actor: Actor): Promise<Connection[]>;
+  get(id: string, actor: Actor): Promise<Connection>;
   /** The connection consumers (billing, automations) resolve an integration by id. */
   getByIntegration(orgId: string, integrationId: string): Promise<Connection | null>;
   /** Invoke one of a connection's actions with its credential revealed at point
    *  of use (e.g. a listing action that feeds a client-side picker). */
-  invoke(orgId: string, connectionId: string, actionId: string, input: Record<string, unknown>): Promise<unknown>;
+  invoke(connectionId: string, actionId: string, input: Record<string, unknown>, actor: Actor): Promise<unknown>;
 }
 interface ConnectionsRepository {
   insert(orgId: string, connection: Connection): Promise<Connection>;

package/dist/integrations/service.d.ts

@@ -1,5 +1,6 @@
 import { Logger } from "../types/ports.js";
 import { ConfigureInput, ConnectInput, Connection } from "../types/schemas/integrations.js";
+import { Actor } from "../shared/actor.js";
 import { CredentialStore } from "../shared/ports.js";
 import "./model.js";
 import { ConnectionsRepository, IntegrationsRegistry, IntegrationsService, IntegrationsUnitOfWork } from "./ports.js";
@@ -21,7 +22,7 @@ declare class IntegrationsServiceImpl implements IntegrationsService {
   private readonly credentials;
   private readonly logger;
   constructor(params: IntegrationsServiceParams);
-  available(): {
+  available(actor: Actor): {
     id: string;
     configSchema: Record<string, unknown>;
     secretsSchema: Record<string, unknown>;
@@ -33,14 +34,14 @@ declare class IntegrationsServiceImpl implements IntegrationsService {
     }[];
   }[];
   private validate;
-  connect(orgId: string, input: ConnectInput): Promise<Connection>;
-  reconnect(orgId: string, id: string, secrets: Record<string, unknown>): Promise<Connection | null>;
-  configure(orgId: string, id: string, input: ConfigureInput): Promise<Connection | null>;
-  disconnect(orgId: string, id: string): Promise<boolean>;
-  list(orgId: string): Promise<Connection[]>;
-  get(orgId: string, id: string): Promise<Connection | null>;
+  connect(input: ConnectInput, actor: Actor): Promise<Connection>;
+  reconnect(id: string, secrets: Record<string, unknown>, actor: Actor): Promise<Connection>;
+  configure(id: string, input: ConfigureInput, actor: Actor): Promise<Connection>;
+  disconnect(id: string, actor: Actor): Promise<void>;
+  list(actor: Actor): Promise<Connection[]>;
+  get(id: string, actor: Actor): Promise<Connection>;
   getByIntegration(orgId: string, integrationId: string): Promise<Connection | null>;
-  invoke(orgId: string, connectionId: string, actionId: string, input: Record<string, unknown>): Promise<unknown>;
+  invoke(connectionId: string, actionId: string, input: Record<string, unknown>, actor: Actor): Promise<unknown>;
 }
 //#endregion
 export { IntegrationsServiceImpl, IntegrationsServiceParams };

package/dist/integrations/service.js

@@ -17,7 +17,8 @@ var IntegrationsServiceImpl = class {
 		this.credentials = params.credentials;
 		this.logger = params.logger ?? noopLogger;
 	}
-	available() {
+	available(actor) {
+		actor.permissions.require("integrations:read");
 		return this.registry.list().map((integration) => ({
 			id: integration.id,
 			configSchema: integration.configSchema(),
@@ -45,7 +46,9 @@ var IntegrationsServiceImpl = class {
 			throw new InvalidConfigError(integrationId, result.errors);
 		}
 	}
-	async connect(orgId, input) {
+	async connect(input, actor) {
+		actor.permissions.require("integrations:write");
+		const orgId = actor.orgId;
 		const config = input.config ?? {};
 		this.validate(input.integrationId, config);
 		if (await this.repo.findByIntegration(orgId, input.integrationId)) {
@@ -81,9 +84,11 @@ var IntegrationsServiceImpl = class {
 		});
 		return connection;
 	}
-	async reconnect(orgId, id, secrets) {
+	async reconnect(id, secrets, actor) {
+		actor.permissions.require("integrations:write");
+		const orgId = actor.orgId;
 		const connection = await this.repo.findById(orgId, id);
-		if (!connection) return null;
+		if (!connection) throw new NotFoundError("Connection", id);
 		const updated = await this.uow.run(async ({ connections, credentials, outbox }) => {
 			await credentials.update(orgId, connection.credentialRef, secrets);
 			const result = await connections.update(orgId, id, { updatedAt: /* @__PURE__ */ new Date() });
@@ -98,11 +103,14 @@ var IntegrationsServiceImpl = class {
 			connectionId: id,
 			integrationId: connection.integrationId
 		});
+		if (!updated) throw new NotFoundError("Connection", id);
 		return updated;
 	}
-	async configure(orgId, id, input) {
+	async configure(id, input, actor) {
+		actor.permissions.require("integrations:write");
+		const orgId = actor.orgId;
 		const connection = await this.repo.findById(orgId, id);
-		if (!connection) return null;
+		if (!connection) throw new NotFoundError("Connection", id);
 		if (input.config !== void 0) this.validate(connection.integrationId, input.config);
 		const updated = await this.uow.run(async ({ connections, outbox }) => {
 			const result = await connections.update(orgId, id, {
@@ -121,11 +129,14 @@ var IntegrationsServiceImpl = class {
 			connectionId: id,
 			integrationId: connection.integrationId
 		});
+		if (!updated) throw new NotFoundError("Connection", id);
 		return updated;
 	}
-	async disconnect(orgId, id) {
+	async disconnect(id, actor) {
+		actor.permissions.require("integrations:delete");
+		const orgId = actor.orgId;
 		const connection = await this.repo.findById(orgId, id);
-		if (!connection) return false;
+		if (!connection) throw new NotFoundError("Connection", id);
 		const deleted = await this.uow.run(async ({ connections, credentials, outbox }) => {
 			const ok = await connections.delete(orgId, id);
 			await credentials.destroy(orgId, connection.credentialRef);
@@ -140,18 +151,24 @@ var IntegrationsServiceImpl = class {
 			connectionId: id,
 			integrationId: connection.integrationId
 		});
-		return deleted;
+		if (!deleted) throw new NotFoundError("Connection", id);
 	}
-	list(orgId) {
-		return this.repo.list(orgId);
+	async list(actor) {
+		actor.permissions.require("integrations:read");
+		return this.repo.list(actor.orgId);
 	}
-	get(orgId, id) {
-		return this.repo.findById(orgId, id);
+	async get(id, actor) {
+		actor.permissions.require("integrations:read");
+		const connection = await this.repo.findById(actor.orgId, id);
+		if (!connection) throw new NotFoundError("Connection", id);
+		return connection;
 	}
 	getByIntegration(orgId, integrationId) {
 		return this.repo.findByIntegration(orgId, integrationId);
 	}
-	async invoke(orgId, connectionId, actionId, input) {
+	async invoke(connectionId, actionId, input, actor) {
+		actor.permissions.require("integrations:write");
+		const orgId = actor.orgId;
 		const connection = await this.repo.findById(orgId, connectionId);
 		if (!connection) throw new NotFoundError("Connection", connectionId);
 		if (!connection.active) throw new ConflictError(`connection "${connectionId}" is inactive`);

package/dist/integrations/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../src/integrations/service.ts"],"sourcesContent":["// integrations context — service implementation (inbound port). Owns the\n// connection lifecycle; credentials live in the shared secure credential store\n// (this service holds only the ref). The integrations the system supports are\n// declared at startup via the IntegrationsRegistry: connect/configure reject\n// unknown integration ids and validate config with the integration's own\n// validator. The domain never calls the external service — consumers take the\n// connection, reveal the credential at point of use, and build their own adapter.\n//\n// Mutations run inside the context's UnitOfWork: credential writes, connection\n// writes, and the outbox append commit in ONE transaction (transactional\n// outbox; this also closed the historical orphan-credential window). The\n// outbox relay — not this service — publishes to the EventBus.\nimport { genId } from '../shared/id.js';\nimport {\n  ActionInvocationError,\n  AlreadyConnectedError,\n  InvalidConfigError,\n  UnknownIntegrationError,\n  type ConfigureInput,\n  type ConnectInput,\n  type Connection,\n} from './model.js';\nimport type {\n  ConnectionsRepository,\n  IntegrationsRegistry,\n  IntegrationsService,\n  IntegrationsUnitOfWork,\n} from './ports.js';\nimport type { CredentialStore, Logger } from '../shared/ports.js';\nimport { ConflictError, NotFoundError } from '../shared/errors.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { integrationEvents } from './events.js';\n\nexport type IntegrationsServiceParams = {\n  registry: IntegrationsRegistry;\n  /** Read-only access (find/list) — runs outside any transaction. */\n  repo: ConnectionsRepository;\n  /** Atomic write scope: tx-bound connections repo + credential store + outbox. */\n  uow: IntegrationsUnitOfWork;\n  /** Point-of-use credential reveal for action invocation — reads only. */\n  credentials: CredentialStore;\n  logger?: Logger;\n};\n\nexport class IntegrationsServiceImpl implements IntegrationsService {\n  private readonly registry: IntegrationsRegistry;\n  private readonly repo: ConnectionsRepository;\n  private readonly uow: IntegrationsUnitOfWork;\n  private readonly credentials: CredentialStore;\n  private readonly logger: Logger;\n\n  constructor(params: IntegrationsServiceParams) {\n    this.registry = params.registry;\n    this.repo = params.repo;\n    this.uow = params.uow;\n    this.credentials = params.credentials;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  available() {\n    return this.registry.list().map((integration) => ({\n      id: integration.id,\n      configSchema: integration.configSchema(),\n      secretsSchema: integration.secretsSchema(),\n      actions: integration.actions.map((action) => ({\n        id: action.id,\n        description: action.description,\n        inputSchema: action.inputSchema(),\n        outputSchema: action.outputSchema(),\n      })),\n    }));\n  }\n\n  private validate(integrationId: string, config: Record<string, unknown>): void {\n    const integration = this.registry.get(integrationId);\n    if (!integration) {\n      this.logger.warn('unknown integration rejected', { integrationId });\n      throw new UnknownIntegrationError(integrationId);\n    }\n    const result = integration.validateConfig(config);\n    if (!result.ok) {\n      this.logger.warn('invalid integration config rejected', {\n        integrationId,\n        errors: result.errors,\n      });\n      throw new InvalidConfigError(integrationId, result.errors);\n    }\n  }\n\n  async connect(orgId: string, input: ConnectInput): Promise<Connection> {\n    const config = input.config ?? {};\n    this.validate(input.integrationId, config);\n    const existing = await this.repo.findByIntegration(orgId, input.integrationId);\n    if (existing) {\n      this.logger.warn('duplicate connection rejected', {\n        orgId,\n        integrationId: input.integrationId,\n      });\n      throw new AlreadyConnectedError(input.integrationId);\n    }\n    const connection = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      const credentialRef = await credentials.store(orgId, input.secrets);\n      const at = new Date();\n      const created = await connections.insert(orgId, {\n        orgId,\n        id: genId('connection'),\n        integrationId: input.integrationId,\n        config,\n        active: true,\n        credentialRef,\n        createdAt: at,\n        updatedAt: at,\n      });\n      await outbox.append([\n        integrationEvents.connectionCreated.make({\n          orgId,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('integration connected', {\n      orgId,\n      integrationId: connection.integrationId,\n      connectionId: connection.id,\n    });\n    return connection;\n  }\n\n  async reconnect(\n    orgId: string,\n    id: string,\n    secrets: Record<string, unknown>,\n  ): Promise<Connection | null> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return null;\n    }\n    const updated = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      await credentials.update(orgId, connection.credentialRef, secrets);\n      const result = await connections.update(orgId, id, { updatedAt: new Date() });\n      if (result) {\n        await outbox.append([integrationEvents.connectionUpdated.make({ orgId, data: result })]);\n      }\n      return result;\n    });\n    this.logger.info('integration credentials rotated', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return updated;\n  }\n\n  async configure(orgId: string, id: string, input: ConfigureInput): Promise<Connection | null> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return null;\n    }\n    if (input.config !== undefined) {\n      this.validate(connection.integrationId, input.config);\n    }\n    const updated = await this.uow.run(async ({ connections, outbox }) => {\n      const result = await connections.update(orgId, id, {\n        ...(input.config !== undefined ? { config: input.config } : {}),\n        ...(input.active !== undefined ? { active: input.active } : {}),\n        updatedAt: new Date(),\n      });\n      if (result) {\n        await outbox.append([integrationEvents.connectionUpdated.make({ orgId, data: result })]);\n      }\n      return result;\n    });\n    this.logger.info('integration configured', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return updated;\n  }\n\n  async disconnect(orgId: string, id: string): Promise<boolean> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return false;\n    }\n    const deleted = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      // Connection first: it holds the FK onto the credential row.\n      const ok = await connections.delete(orgId, id);\n      await credentials.destroy(orgId, connection.credentialRef);\n      await outbox.append([integrationEvents.connectionRemoved.make({ orgId, data: connection })]);\n      return ok;\n    });\n    this.logger.info('integration disconnected', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return deleted;\n  }\n\n  list(orgId: string): Promise<Connection[]> {\n    return this.repo.list(orgId);\n  }\n\n  get(orgId: string, id: string): Promise<Connection | null> {\n    return this.repo.findById(orgId, id);\n  }\n\n  getByIntegration(orgId: string, integrationId: string): Promise<Connection | null> {\n    return this.repo.findByIntegration(orgId, integrationId);\n  }\n\n  async invoke(\n    orgId: string,\n    connectionId: string,\n    actionId: string,\n    input: Record<string, unknown>,\n  ): Promise<unknown> {\n    const connection = await this.repo.findById(orgId, connectionId);\n    if (!connection) {\n      throw new NotFoundError('Connection', connectionId);\n    }\n    if (!connection.active) {\n      throw new ConflictError(`connection \"${connectionId}\" is inactive`);\n    }\n    const integration = this.registry.get(connection.integrationId);\n    if (!integration) {\n      throw new UnknownIntegrationError(connection.integrationId);\n    }\n    const action = integration.actions.find((a) => a.id === actionId);\n    if (!action) {\n      throw new NotFoundError('Action', actionId);\n    }\n    const secrets = await this.credentials.reveal(orgId, connection.credentialRef);\n    if (!secrets) {\n      throw new NotFoundError('Credential', connectionId);\n    }\n    try {\n      return await action.invoke({ secrets, config: connection.config }, input);\n    } catch (err) {\n      this.logger.warn('integration action failed', {\n        orgId,\n        connectionId,\n        integrationId: connection.integrationId,\n        actionId,\n        err,\n      });\n      throw new ActionInvocationError(connection.integrationId, actionId, err);\n    }\n  }\n}\n"],"mappings":";;;;;;AA4CA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,WAAW,OAAO;EACvB,KAAK,OAAO,OAAO;EACnB,KAAK,MAAM,OAAO;EAClB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,YAAY;EACV,OAAO,KAAK,SAAS,KAAK,CAAC,CAAC,KAAK,iBAAiB;GAChD,IAAI,YAAY;GAChB,cAAc,YAAY,aAAa;GACvC,eAAe,YAAY,cAAc;GACzC,SAAS,YAAY,QAAQ,KAAK,YAAY;IAC5C,IAAI,OAAO;IACX,aAAa,OAAO;IACpB,aAAa,OAAO,YAAY;IAChC,cAAc,OAAO,aAAa;GACpC,EAAE;EACJ,EAAE;CACJ;CAEA,SAAiB,eAAuB,QAAuC;EAC7E,MAAM,cAAc,KAAK,SAAS,IAAI,aAAa;EACnD,IAAI,CAAC,aAAa;GAChB,KAAK,OAAO,KAAK,gCAAgC,EAAE,cAAc,CAAC;GAClE,MAAM,IAAI,wBAAwB,aAAa;EACjD;EACA,MAAM,SAAS,YAAY,eAAe,MAAM;EAChD,IAAI,CAAC,OAAO,IAAI;GACd,KAAK,OAAO,KAAK,uCAAuC;IACtD;IACA,QAAQ,OAAO;GACjB,CAAC;GACD,MAAM,IAAI,mBAAmB,eAAe,OAAO,MAAM;EAC3D;CACF;CAEA,MAAM,QAAQ,OAAe,OAA0C;EACrE,MAAM,SAAS,MAAM,UAAU,CAAC;EAChC,KAAK,SAAS,MAAM,eAAe,MAAM;EAEzC,IAAI,MADmB,KAAK,KAAK,kBAAkB,OAAO,MAAM,aAAa,GAC/D;GACZ,KAAK,OAAO,KAAK,iCAAiC;IAChD;IACA,eAAe,MAAM;GACvB,CAAC;GACD,MAAM,IAAI,sBAAsB,MAAM,aAAa;EACrD;EACA,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACpF,MAAM,gBAAgB,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO;GAClE,MAAM,qBAAK,IAAI,KAAK;GACpB,MAAM,UAAU,MAAM,YAAY,OAAO,OAAO;IAC9C;IACA,IAAI,MAAM,YAAY;IACtB,eAAe,MAAM;IACrB;IACA,QAAQ;IACR;IACA,WAAW;IACX,WAAW;GACb,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,kBAAkB,kBAAkB,KAAK;IACvC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,yBAAyB;GACxC;GACA,eAAe,WAAW;GAC1B,cAAc,WAAW;EAC3B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UACJ,OACA,IACA,SAC4B;EAC5B,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACjF,MAAM,YAAY,OAAO,OAAO,WAAW,eAAe,OAAO;GACjE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI,EAAE,2BAAW,IAAI,KAAK,EAAE,CAAC;GAC5E,IAAI,QACF,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAAC,CAAC;GAEzF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,mCAAmC;GAClD;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UAAU,OAAe,IAAY,OAAmD;EAC5F,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,IAAI,MAAM,WAAW,KAAA,GACnB,KAAK,SAAS,WAAW,eAAe,MAAM,MAAM;EAEtD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa;GACpE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI;IACjD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,2BAAW,IAAI,KAAK;GACtB,CAAC;GACD,IAAI,QACF,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAAC,CAAC;GAEzF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,0BAA0B;GACzC;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,WAAW,OAAe,IAA8B;EAC5D,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GAEjF,MAAM,KAAK,MAAM,YAAY,OAAO,OAAO,EAAE;GAC7C,MAAM,YAAY,QAAQ,OAAO,WAAW,aAAa;GACzD,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAW,CAAC,CAAC,CAAC;GAC3F,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,4BAA4B;GAC3C;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,KAAK,OAAsC;EACzC,OAAO,KAAK,KAAK,KAAK,KAAK;CAC7B;CAEA,IAAI,OAAe,IAAwC;EACzD,OAAO,KAAK,KAAK,SAAS,OAAO,EAAE;CACrC;CAEA,iBAAiB,OAAe,eAAmD;EACjF,OAAO,KAAK,KAAK,kBAAkB,OAAO,aAAa;CACzD;CAEA,MAAM,OACJ,OACA,cACA,UACA,OACkB;EAClB,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,YAAY;EAC/D,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI,CAAC,WAAW,QACd,MAAM,IAAI,cAAc,eAAe,aAAa,cAAc;EAEpE,MAAM,cAAc,KAAK,SAAS,IAAI,WAAW,aAAa;EAC9D,IAAI,CAAC,aACH,MAAM,IAAI,wBAAwB,WAAW,aAAa;EAE5D,MAAM,SAAS,YAAY,QAAQ,MAAM,MAAM,EAAE,OAAO,QAAQ;EAChE,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,QAAQ;EAE5C,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO,OAAO,WAAW,aAAa;EAC7E,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI;GACF,OAAO,MAAM,OAAO,OAAO;IAAE;IAAS,QAAQ,WAAW;GAAO,GAAG,KAAK;EAC1E,SAAS,KAAK;GACZ,KAAK,OAAO,KAAK,6BAA6B;IAC5C;IACA;IACA,eAAe,WAAW;IAC1B;IACA;GACF,CAAC;GACD,MAAM,IAAI,sBAAsB,WAAW,eAAe,UAAU,GAAG;EACzE;CACF;AACF"}
+{"version":3,"file":"service.js","names":[],"sources":["../../src/integrations/service.ts"],"sourcesContent":["// integrations context — service implementation (inbound port). Owns the\n// connection lifecycle; credentials live in the shared secure credential store\n// (this service holds only the ref). The integrations the system supports are\n// declared at startup via the IntegrationsRegistry: connect/configure reject\n// unknown integration ids and validate config with the integration's own\n// validator. The domain never calls the external service — consumers take the\n// connection, reveal the credential at point of use, and build their own adapter.\n//\n// Mutations run inside the context's UnitOfWork: credential writes, connection\n// writes, and the outbox append commit in ONE transaction (transactional\n// outbox; this also closed the historical orphan-credential window). The\n// outbox relay — not this service — publishes to the EventBus.\nimport { genId } from '../shared/id.js';\nimport {\n  ActionInvocationError,\n  AlreadyConnectedError,\n  InvalidConfigError,\n  UnknownIntegrationError,\n  type ConfigureInput,\n  type ConnectInput,\n  type Connection,\n} from './model.js';\nimport type {\n  ConnectionsRepository,\n  IntegrationsRegistry,\n  IntegrationsService,\n  IntegrationsUnitOfWork,\n} from './ports.js';\nimport type { CredentialStore, Logger } from '../shared/ports.js';\nimport type { Actor } from '../shared/actor.js';\nimport { ConflictError, NotFoundError } from '../shared/errors.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { integrationEvents } from './events.js';\n\nexport type IntegrationsServiceParams = {\n  registry: IntegrationsRegistry;\n  /** Read-only access (find/list) — runs outside any transaction. */\n  repo: ConnectionsRepository;\n  /** Atomic write scope: tx-bound connections repo + credential store + outbox. */\n  uow: IntegrationsUnitOfWork;\n  /** Point-of-use credential reveal for action invocation — reads only. */\n  credentials: CredentialStore;\n  logger?: Logger;\n};\n\nexport class IntegrationsServiceImpl implements IntegrationsService {\n  private readonly registry: IntegrationsRegistry;\n  private readonly repo: ConnectionsRepository;\n  private readonly uow: IntegrationsUnitOfWork;\n  private readonly credentials: CredentialStore;\n  private readonly logger: Logger;\n\n  constructor(params: IntegrationsServiceParams) {\n    this.registry = params.registry;\n    this.repo = params.repo;\n    this.uow = params.uow;\n    this.credentials = params.credentials;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  available(actor: Actor) {\n    actor.permissions.require('integrations:read');\n    return this.registry.list().map((integration) => ({\n      id: integration.id,\n      configSchema: integration.configSchema(),\n      secretsSchema: integration.secretsSchema(),\n      actions: integration.actions.map((action) => ({\n        id: action.id,\n        description: action.description,\n        inputSchema: action.inputSchema(),\n        outputSchema: action.outputSchema(),\n      })),\n    }));\n  }\n\n  private validate(integrationId: string, config: Record<string, unknown>): void {\n    const integration = this.registry.get(integrationId);\n    if (!integration) {\n      this.logger.warn('unknown integration rejected', { integrationId });\n      throw new UnknownIntegrationError(integrationId);\n    }\n    const result = integration.validateConfig(config);\n    if (!result.ok) {\n      this.logger.warn('invalid integration config rejected', {\n        integrationId,\n        errors: result.errors,\n      });\n      throw new InvalidConfigError(integrationId, result.errors);\n    }\n  }\n\n  async connect(input: ConnectInput, actor: Actor): Promise<Connection> {\n    actor.permissions.require('integrations:write');\n    const orgId = actor.orgId;\n    const config = input.config ?? {};\n    this.validate(input.integrationId, config);\n    const existing = await this.repo.findByIntegration(orgId, input.integrationId);\n    if (existing) {\n      this.logger.warn('duplicate connection rejected', {\n        orgId,\n        integrationId: input.integrationId,\n      });\n      throw new AlreadyConnectedError(input.integrationId);\n    }\n    const connection = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      const credentialRef = await credentials.store(orgId, input.secrets);\n      const at = new Date();\n      const created = await connections.insert(orgId, {\n        orgId,\n        id: genId('connection'),\n        integrationId: input.integrationId,\n        config,\n        active: true,\n        credentialRef,\n        createdAt: at,\n        updatedAt: at,\n      });\n      await outbox.append([\n        integrationEvents.connectionCreated.make({\n          orgId,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('integration connected', {\n      orgId,\n      integrationId: connection.integrationId,\n      connectionId: connection.id,\n    });\n    return connection;\n  }\n\n  async reconnect(id: string, secrets: Record<string, unknown>, actor: Actor): Promise<Connection> {\n    actor.permissions.require('integrations:write');\n    const orgId = actor.orgId;\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      throw new NotFoundError('Connection', id);\n    }\n    const updated = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      await credentials.update(orgId, connection.credentialRef, secrets);\n      const result = await connections.update(orgId, id, { updatedAt: new Date() });\n      if (result) {\n        await outbox.append([integrationEvents.connectionUpdated.make({ orgId, data: result })]);\n      }\n      return result;\n    });\n    this.logger.info('integration credentials rotated', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    if (!updated) {\n      throw new NotFoundError('Connection', id);\n    }\n    return updated;\n  }\n\n  async configure(id: string, input: ConfigureInput, actor: Actor): Promise<Connection> {\n    actor.permissions.require('integrations:write');\n    const orgId = actor.orgId;\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      throw new NotFoundError('Connection', id);\n    }\n    if (input.config !== undefined) {\n      this.validate(connection.integrationId, input.config);\n    }\n    const updated = await this.uow.run(async ({ connections, outbox }) => {\n      const result = await connections.update(orgId, id, {\n        ...(input.config !== undefined ? { config: input.config } : {}),\n        ...(input.active !== undefined ? { active: input.active } : {}),\n        updatedAt: new Date(),\n      });\n      if (result) {\n        await outbox.append([integrationEvents.connectionUpdated.make({ orgId, data: result })]);\n      }\n      return result;\n    });\n    this.logger.info('integration configured', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    if (!updated) {\n      throw new NotFoundError('Connection', id);\n    }\n    return updated;\n  }\n\n  async disconnect(id: string, actor: Actor): Promise<void> {\n    actor.permissions.require('integrations:delete');\n    const orgId = actor.orgId;\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      throw new NotFoundError('Connection', id);\n    }\n    const deleted = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      // Connection first: it holds the FK onto the credential row.\n      const ok = await connections.delete(orgId, id);\n      await credentials.destroy(orgId, connection.credentialRef);\n      await outbox.append([integrationEvents.connectionRemoved.make({ orgId, data: connection })]);\n      return ok;\n    });\n    this.logger.info('integration disconnected', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    if (!deleted) {\n      throw new NotFoundError('Connection', id);\n    }\n  }\n\n  async list(actor: Actor): Promise<Connection[]> {\n    actor.permissions.require('integrations:read');\n    return this.repo.list(actor.orgId);\n  }\n\n  async get(id: string, actor: Actor): Promise<Connection> {\n    actor.permissions.require('integrations:read');\n    const connection = await this.repo.findById(actor.orgId, id);\n    if (!connection) {\n      throw new NotFoundError('Connection', id);\n    }\n    return connection;\n  }\n\n  getByIntegration(orgId: string, integrationId: string): Promise<Connection | null> {\n    return this.repo.findByIntegration(orgId, integrationId);\n  }\n\n  async invoke(\n    connectionId: string,\n    actionId: string,\n    input: Record<string, unknown>,\n    actor: Actor,\n  ): Promise<unknown> {\n    actor.permissions.require('integrations:write');\n    const orgId = actor.orgId;\n    const connection = await this.repo.findById(orgId, connectionId);\n    if (!connection) {\n      throw new NotFoundError('Connection', connectionId);\n    }\n    if (!connection.active) {\n      throw new ConflictError(`connection \"${connectionId}\" is inactive`);\n    }\n    const integration = this.registry.get(connection.integrationId);\n    if (!integration) {\n      throw new UnknownIntegrationError(connection.integrationId);\n    }\n    const action = integration.actions.find((a) => a.id === actionId);\n    if (!action) {\n      throw new NotFoundError('Action', actionId);\n    }\n    const secrets = await this.credentials.reveal(orgId, connection.credentialRef);\n    if (!secrets) {\n      throw new NotFoundError('Credential', connectionId);\n    }\n    try {\n      return await action.invoke({ secrets, config: connection.config }, input);\n    } catch (err) {\n      this.logger.warn('integration action failed', {\n        orgId,\n        connectionId,\n        integrationId: connection.integrationId,\n        actionId,\n        err,\n      });\n      throw new ActionInvocationError(connection.integrationId, actionId, err);\n    }\n  }\n}\n"],"mappings":";;;;;;AA6CA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,WAAW,OAAO;EACvB,KAAK,OAAO,OAAO;EACnB,KAAK,MAAM,OAAO;EAClB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,UAAU,OAAc;EACtB,MAAM,YAAY,QAAQ,mBAAmB;EAC7C,OAAO,KAAK,SAAS,KAAK,CAAC,CAAC,KAAK,iBAAiB;GAChD,IAAI,YAAY;GAChB,cAAc,YAAY,aAAa;GACvC,eAAe,YAAY,cAAc;GACzC,SAAS,YAAY,QAAQ,KAAK,YAAY;IAC5C,IAAI,OAAO;IACX,aAAa,OAAO;IACpB,aAAa,OAAO,YAAY;IAChC,cAAc,OAAO,aAAa;GACpC,EAAE;EACJ,EAAE;CACJ;CAEA,SAAiB,eAAuB,QAAuC;EAC7E,MAAM,cAAc,KAAK,SAAS,IAAI,aAAa;EACnD,IAAI,CAAC,aAAa;GAChB,KAAK,OAAO,KAAK,gCAAgC,EAAE,cAAc,CAAC;GAClE,MAAM,IAAI,wBAAwB,aAAa;EACjD;EACA,MAAM,SAAS,YAAY,eAAe,MAAM;EAChD,IAAI,CAAC,OAAO,IAAI;GACd,KAAK,OAAO,KAAK,uCAAuC;IACtD;IACA,QAAQ,OAAO;GACjB,CAAC;GACD,MAAM,IAAI,mBAAmB,eAAe,OAAO,MAAM;EAC3D;CACF;CAEA,MAAM,QAAQ,OAAqB,OAAmC;EACpE,MAAM,YAAY,QAAQ,oBAAoB;EAC9C,MAAM,QAAQ,MAAM;EACpB,MAAM,SAAS,MAAM,UAAU,CAAC;EAChC,KAAK,SAAS,MAAM,eAAe,MAAM;EAEzC,IAAI,MADmB,KAAK,KAAK,kBAAkB,OAAO,MAAM,aAAa,GAC/D;GACZ,KAAK,OAAO,KAAK,iCAAiC;IAChD;IACA,eAAe,MAAM;GACvB,CAAC;GACD,MAAM,IAAI,sBAAsB,MAAM,aAAa;EACrD;EACA,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACpF,MAAM,gBAAgB,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO;GAClE,MAAM,qBAAK,IAAI,KAAK;GACpB,MAAM,UAAU,MAAM,YAAY,OAAO,OAAO;IAC9C;IACA,IAAI,MAAM,YAAY;IACtB,eAAe,MAAM;IACrB;IACA,QAAQ;IACR;IACA,WAAW;IACX,WAAW;GACb,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,kBAAkB,kBAAkB,KAAK;IACvC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,yBAAyB;GACxC;GACA,eAAe,WAAW;GAC1B,cAAc,WAAW;EAC3B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UAAU,IAAY,SAAkC,OAAmC;EAC/F,MAAM,YAAY,QAAQ,oBAAoB;EAC9C,MAAM,QAAQ,MAAM;EACpB,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,EAAE;EAE1C,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACjF,MAAM,YAAY,OAAO,OAAO,WAAW,eAAe,OAAO;GACjE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI,EAAE,2BAAW,IAAI,KAAK,EAAE,CAAC;GAC5E,IAAI,QACF,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAAC,CAAC;GAEzF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,mCAAmC;GAClD;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,cAAc,EAAE;EAE1C,OAAO;CACT;CAEA,MAAM,UAAU,IAAY,OAAuB,OAAmC;EACpF,MAAM,YAAY,QAAQ,oBAAoB;EAC9C,MAAM,QAAQ,MAAM;EACpB,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,EAAE;EAE1C,IAAI,MAAM,WAAW,KAAA,GACnB,KAAK,SAAS,WAAW,eAAe,MAAM,MAAM;EAEtD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa;GACpE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI;IACjD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,2BAAW,IAAI,KAAK;GACtB,CAAC;GACD,IAAI,QACF,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAAC,CAAC;GAEzF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,0BAA0B;GACzC;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,cAAc,EAAE;EAE1C,OAAO;CACT;CAEA,MAAM,WAAW,IAAY,OAA6B;EACxD,MAAM,YAAY,QAAQ,qBAAqB;EAC/C,MAAM,QAAQ,MAAM;EACpB,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,EAAE;EAE1C,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GAEjF,MAAM,KAAK,MAAM,YAAY,OAAO,OAAO,EAAE;GAC7C,MAAM,YAAY,QAAQ,OAAO,WAAW,aAAa;GACzD,MAAM,OAAO,OAAO,CAAC,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAW,CAAC,CAAC,CAAC;GAC3F,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,4BAA4B;GAC3C;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,cAAc,EAAE;CAE5C;CAEA,MAAM,KAAK,OAAqC;EAC9C,MAAM,YAAY,QAAQ,mBAAmB;EAC7C,OAAO,KAAK,KAAK,KAAK,MAAM,KAAK;CACnC;CAEA,MAAM,IAAI,IAAY,OAAmC;EACvD,MAAM,YAAY,QAAQ,mBAAmB;EAC7C,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,MAAM,OAAO,EAAE;EAC3D,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,EAAE;EAE1C,OAAO;CACT;CAEA,iBAAiB,OAAe,eAAmD;EACjF,OAAO,KAAK,KAAK,kBAAkB,OAAO,aAAa;CACzD;CAEA,MAAM,OACJ,cACA,UACA,OACA,OACkB;EAClB,MAAM,YAAY,QAAQ,oBAAoB;EAC9C,MAAM,QAAQ,MAAM;EACpB,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,YAAY;EAC/D,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI,CAAC,WAAW,QACd,MAAM,IAAI,cAAc,eAAe,aAAa,cAAc;EAEpE,MAAM,cAAc,KAAK,SAAS,IAAI,WAAW,aAAa;EAC9D,IAAI,CAAC,aACH,MAAM,IAAI,wBAAwB,WAAW,aAAa;EAE5D,MAAM,SAAS,YAAY,QAAQ,MAAM,MAAM,EAAE,OAAO,QAAQ;EAChE,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,QAAQ;EAE5C,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO,OAAO,WAAW,aAAa;EAC7E,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI;GACF,OAAO,MAAM,OAAO,OAAO;IAAE;IAAS,QAAQ,WAAW;GAAO,GAAG,KAAK;EAC1E,SAAS,KAAK;GACZ,KAAK,OAAO,KAAK,6BAA6B;IAC5C;IACA;IACA,eAAe,WAAW;IAC1B;IACA;GACF,CAAC;GACD,MAAM,IAAI,sBAAsB,WAAW,eAAe,UAAU,GAAG;EACzE;CACF;AACF"}

package/dist/organizations/default-roles.d.ts

@@ -0,0 +1,22 @@
+import { Level, Permission } from "../types/schemas/organizations.js";
+import "../types/index.js";
+//#region src/organizations/default-roles.d.ts
+interface RoleDefinition {
+  key: string;
+  name: string;
+  description: string;
+  levels: Level[];
+  team: boolean;
+  permissions: Permission[];
+}
+declare const OWNER_ROLE_KEY = "owner";
+declare const MEMBER_ROLE_KEY = "member";
+declare const DEFAULT_ROLES: readonly RoleDefinition[];
+declare class RoleSetError extends Error {
+  constructor(message: string);
+}
+declare function validateRoleSet(roles: readonly RoleDefinition[]): void;
+declare function defaultHolders(permission: Permission): string[];
+//#endregion
+export { DEFAULT_ROLES, MEMBER_ROLE_KEY, OWNER_ROLE_KEY, RoleDefinition, RoleSetError, defaultHolders, validateRoleSet };
+//# sourceMappingURL=default-roles.d.ts.map

package/dist/organizations/default-roles.js

@@ -0,0 +1,89 @@
+import { levelSchema } from "../types/schemas/organizations.js";
+import { ALL_PERMISSIONS, fitsLevels, isPermission, withImplied } from "./permissions.js";
+//#region src/organizations/default-roles.ts
+const OWNER_ROLE_KEY = "owner";
+const MEMBER_ROLE_KEY = "member";
+const ADMIN_PERMISSIONS = [...ALL_PERMISSIONS];
+const DEFAULT_ROLES = [
+	{
+		key: OWNER_ROLE_KEY,
+		name: "Owner",
+		description: "Owns the organization and holds every permission.",
+		levels: ["org"],
+		team: true,
+		permissions: [...ALL_PERMISSIONS]
+	},
+	{
+		key: "admin",
+		name: "Admin",
+		description: "Runs the organization: content, people, access, automations and settings.",
+		levels: ["org"],
+		team: true,
+		permissions: ADMIN_PERMISSIONS
+	},
+	{
+		key: "instructor",
+		name: "Instructor",
+		description: "Teaches courses: edits and publishes them, moderates lesson comments and sees learners.",
+		levels: ["org", "course"],
+		team: true,
+		permissions: [
+			"courses:read",
+			"courses:write",
+			"courses:moderate",
+			"progress:read",
+			"api_keys:read",
+			"api_keys:write",
+			"api_keys:delete"
+		]
+	},
+	{
+		key: "moderator",
+		name: "Moderator",
+		description: "Moderates communities: posts, comments, chats, reports and space members.",
+		levels: ["org", "community"],
+		team: true,
+		permissions: ["communities:moderate"]
+	},
+	{
+		key: MEMBER_ROLE_KEY,
+		name: "Member",
+		description: "Everyone who was not given another role.",
+		levels: ["org"],
+		team: false,
+		permissions: []
+	}
+];
+var RoleSetError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "RoleSetError";
+	}
+};
+function validateRoleSet(roles) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const role of roles) {
+		if (keys.has(role.key)) throw new RoleSetError(`role key ${role.key} is repeated`);
+		keys.add(role.key);
+		if (role.levels.length === 0) throw new RoleSetError(`role ${role.key} has no level`);
+		for (const level of role.levels) if (!levelSchema.safeParse(level).success) throw new RoleSetError(`role ${role.key} names an unknown level ${String(level)}`);
+		for (const permission of role.permissions) {
+			if (!isPermission(permission)) throw new RoleSetError(`role ${role.key} names an unknown permission ${String(permission)}`);
+			if (!fitsLevels(permission, role.levels)) throw new RoleSetError(`role ${role.key} holds ${permission}, which doesn't fit its levels ${role.levels.join(", ")}`);
+		}
+	}
+	const owner = roles.find((role) => role.key === OWNER_ROLE_KEY);
+	const member = roles.find((role) => role.key === MEMBER_ROLE_KEY);
+	if (!owner) throw new RoleSetError(`the role set lacks ${OWNER_ROLE_KEY}`);
+	if (!member) throw new RoleSetError(`the role set lacks ${MEMBER_ROLE_KEY}`);
+	if (owner.levels.length !== 1 || owner.levels[0] !== "org") throw new RoleSetError(`${OWNER_ROLE_KEY} must list the org only`);
+	if (owner.permissions.length !== ALL_PERMISSIONS.length) throw new RoleSetError(`${OWNER_ROLE_KEY} must hold every permission`);
+	if (member.levels.length !== 1 || member.levels[0] !== "org" || member.permissions.length > 0) throw new RoleSetError(`${MEMBER_ROLE_KEY} must list the org only and hold nothing`);
+}
+function defaultHolders(permission) {
+	return DEFAULT_ROLES.filter((role) => withImplied(role.permissions).has(permission)).map((role) => role.name);
+}
+//#endregion
+export { DEFAULT_ROLES, MEMBER_ROLE_KEY, OWNER_ROLE_KEY, RoleSetError, defaultHolders, validateRoleSet };
+
+//# sourceMappingURL=default-roles.js.map

package/dist/organizations/default-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-roles.js","names":[],"sources":["../../src/organizations/default-roles.ts"],"sourcesContent":["import { levelSchema } from '../types/schemas/organizations.js';\nimport type { Level, Permission } from '../types/index.js';\nimport { ALL_PERMISSIONS, fitsLevels, isPermission, withImplied } from './permissions.js';\n\nexport interface RoleDefinition {\n  key: string;\n  name: string;\n  description: string;\n  levels: Level[];\n  team: boolean;\n  permissions: Permission[];\n}\n\nexport const OWNER_ROLE_KEY = 'owner';\nexport const MEMBER_ROLE_KEY = 'member';\n\nconst ADMIN_PERMISSIONS: Permission[] = [...ALL_PERMISSIONS];\n\nexport const DEFAULT_ROLES: readonly RoleDefinition[] = [\n  {\n    key: OWNER_ROLE_KEY,\n    name: 'Owner',\n    description: 'Owns the organization and holds every permission.',\n    levels: ['org'],\n    team: true,\n    permissions: [...ALL_PERMISSIONS],\n  },\n  {\n    key: 'admin',\n    name: 'Admin',\n    description: 'Runs the organization: content, people, access, automations and settings.',\n    levels: ['org'],\n    team: true,\n    permissions: ADMIN_PERMISSIONS,\n  },\n  {\n    key: 'instructor',\n    name: 'Instructor',\n    description:\n      'Teaches courses: edits and publishes them, moderates lesson comments and sees learners.',\n    levels: ['org', 'course'],\n    team: true,\n    permissions: [\n      'courses:read',\n      'courses:write',\n      'courses:moderate',\n      'progress:read',\n      'api_keys:read',\n      'api_keys:write',\n      'api_keys:delete',\n    ],\n  },\n  {\n    key: 'moderator',\n    name: 'Moderator',\n    description: 'Moderates communities: posts, comments, chats, reports and space members.',\n    levels: ['org', 'community'],\n    team: true,\n    permissions: ['communities:moderate'],\n  },\n  {\n    key: MEMBER_ROLE_KEY,\n    name: 'Member',\n    description: 'Everyone who was not given another role.',\n    levels: ['org'],\n    team: false,\n    permissions: [],\n  },\n];\n\nexport class RoleSetError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'RoleSetError';\n  }\n}\n\nexport function validateRoleSet(roles: readonly RoleDefinition[]): void {\n  const keys = new Set<string>();\n  for (const role of roles) {\n    if (keys.has(role.key)) {\n      throw new RoleSetError(`role key ${role.key} is repeated`);\n    }\n    keys.add(role.key);\n    if (role.levels.length === 0) {\n      throw new RoleSetError(`role ${role.key} has no level`);\n    }\n    for (const level of role.levels) {\n      if (!levelSchema.safeParse(level).success) {\n        throw new RoleSetError(`role ${role.key} names an unknown level ${String(level)}`);\n      }\n    }\n    for (const permission of role.permissions) {\n      if (!isPermission(permission)) {\n        throw new RoleSetError(\n          `role ${role.key} names an unknown permission ${String(permission)}`,\n        );\n      }\n      if (!fitsLevels(permission, role.levels)) {\n        throw new RoleSetError(\n          `role ${role.key} holds ${permission}, which doesn't fit its levels ${role.levels.join(', ')}`,\n        );\n      }\n    }\n  }\n  const owner = roles.find((role) => role.key === OWNER_ROLE_KEY);\n  const member = roles.find((role) => role.key === MEMBER_ROLE_KEY);\n  if (!owner) {\n    throw new RoleSetError(`the role set lacks ${OWNER_ROLE_KEY}`);\n  }\n  if (!member) {\n    throw new RoleSetError(`the role set lacks ${MEMBER_ROLE_KEY}`);\n  }\n  if (owner.levels.length !== 1 || owner.levels[0] !== 'org') {\n    throw new RoleSetError(`${OWNER_ROLE_KEY} must list the org only`);\n  }\n  if (owner.permissions.length !== ALL_PERMISSIONS.length) {\n    throw new RoleSetError(`${OWNER_ROLE_KEY} must hold every permission`);\n  }\n  if (member.levels.length !== 1 || member.levels[0] !== 'org' || member.permissions.length > 0) {\n    throw new RoleSetError(`${MEMBER_ROLE_KEY} must list the org only and hold nothing`);\n  }\n}\n\nexport function defaultHolders(permission: Permission): string[] {\n  return DEFAULT_ROLES.filter((role) => withImplied(role.permissions).has(permission)).map(\n    (role) => role.name,\n  );\n}\n"],"mappings":";;;AAaA,MAAa,iBAAiB;AAC9B,MAAa,kBAAkB;AAE/B,MAAM,oBAAkC,CAAC,GAAG,eAAe;AAE3D,MAAa,gBAA2C;CACtD;EACE,KAAK;EACL,MAAM;EACN,aAAa;EACb,QAAQ,CAAC,KAAK;EACd,MAAM;EACN,aAAa,CAAC,GAAG,eAAe;CAClC;CACA;EACE,KAAK;EACL,MAAM;EACN,aAAa;EACb,QAAQ,CAAC,KAAK;EACd,MAAM;EACN,aAAa;CACf;CACA;EACE,KAAK;EACL,MAAM;EACN,aACE;EACF,QAAQ,CAAC,OAAO,QAAQ;EACxB,MAAM;EACN,aAAa;GACX;GACA;GACA;GACA;GACA;GACA;GACA;EACF;CACF;CACA;EACE,KAAK;EACL,MAAM;EACN,aAAa;EACb,QAAQ,CAAC,OAAO,WAAW;EAC3B,MAAM;EACN,aAAa,CAAC,sBAAsB;CACtC;CACA;EACE,KAAK;EACL,MAAM;EACN,aAAa;EACb,QAAQ,CAAC,KAAK;EACd,MAAM;EACN,aAAa,CAAC;CAChB;AACF;AAEA,IAAa,eAAb,cAAkC,MAAM;CACtC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAEA,SAAgB,gBAAgB,OAAwC;CACtE,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,QAAQ,OAAO;EACxB,IAAI,KAAK,IAAI,KAAK,GAAG,GACnB,MAAM,IAAI,aAAa,YAAY,KAAK,IAAI,aAAa;EAE3D,KAAK,IAAI,KAAK,GAAG;EACjB,IAAI,KAAK,OAAO,WAAW,GACzB,MAAM,IAAI,aAAa,QAAQ,KAAK,IAAI,cAAc;EAExD,KAAK,MAAM,SAAS,KAAK,QACvB,IAAI,CAAC,YAAY,UAAU,KAAK,CAAC,CAAC,SAChC,MAAM,IAAI,aAAa,QAAQ,KAAK,IAAI,0BAA0B,OAAO,KAAK,GAAG;EAGrF,KAAK,MAAM,cAAc,KAAK,aAAa;GACzC,IAAI,CAAC,aAAa,UAAU,GAC1B,MAAM,IAAI,aACR,QAAQ,KAAK,IAAI,+BAA+B,OAAO,UAAU,GACnE;GAEF,IAAI,CAAC,WAAW,YAAY,KAAK,MAAM,GACrC,MAAM,IAAI,aACR,QAAQ,KAAK,IAAI,SAAS,WAAW,iCAAiC,KAAK,OAAO,KAAK,IAAI,GAC7F;EAEJ;CACF;CACA,MAAM,QAAQ,MAAM,MAAM,SAAS,KAAK,QAAQ,cAAc;CAC9D,MAAM,SAAS,MAAM,MAAM,SAAS,KAAK,QAAQ,eAAe;CAChE,IAAI,CAAC,OACH,MAAM,IAAI,aAAa,sBAAsB,gBAAgB;CAE/D,IAAI,CAAC,QACH,MAAM,IAAI,aAAa,sBAAsB,iBAAiB;CAEhE,IAAI,MAAM,OAAO,WAAW,KAAK,MAAM,OAAO,OAAO,OACnD,MAAM,IAAI,aAAa,GAAG,eAAe,wBAAwB;CAEnE,IAAI,MAAM,YAAY,WAAW,gBAAgB,QAC/C,MAAM,IAAI,aAAa,GAAG,eAAe,4BAA4B;CAEvE,IAAI,OAAO,OAAO,WAAW,KAAK,OAAO,OAAO,OAAO,SAAS,OAAO,YAAY,SAAS,GAC1F,MAAM,IAAI,aAAa,GAAG,gBAAgB,yCAAyC;AAEvF;AAEA,SAAgB,eAAe,YAAkC;CAC/D,OAAO,cAAc,QAAQ,SAAS,YAAY,KAAK,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,KAClF,SAAS,KAAK,IACjB;AACF"}

package/dist/organizations/effective-permissions.d.ts

@@ -0,0 +1,47 @@
+import { ContentType } from "../types/schemas/content.js";
+import { Permission } from "../types/schemas/organizations.js";
+import { ContentId } from "../types/organizations.js";
+import "../types/index.js";
+import { EffectivePermissions, RoleRef } from "../shared/actor.js";
+import { OrgRole } from "./org-roles.js";
+//#region src/organizations/effective-permissions.d.ts
+interface AssignmentRow {
+  roleKey: string;
+  contentId: ContentId | null;
+  contentType: ContentType | null;
+}
+interface ResolveInput {
+  assignments: readonly AssignmentRow[];
+  roles: ReadonlyMap<string, OrgRole>;
+  tokenScopes?: readonly Permission[];
+}
+interface ContentEntry {
+  permissions: Set<Permission>;
+  role: RoleRef;
+}
+declare class ResolvedPermissions implements EffectivePermissions {
+  private readonly org;
+  private readonly orgRole;
+  private readonly content;
+  private readonly owner;
+  private readonly token;
+  constructor(org: Set<Permission>, orgRole: RoleRef, content: Map<ContentId, ContentEntry>, owner: boolean, token: boolean);
+  has(permission: Permission, on?: ContentId): boolean;
+  require(permission: Permission, on?: ContentId): void;
+  anywhere(permission: Permission): boolean;
+  where(permission: Permission): {
+    org: boolean;
+    content: ContentId[];
+  };
+  roleOn(on?: ContentId): RoleRef;
+  isOwner(): boolean;
+  isToken(): boolean;
+  orgPermissions(): Permission[];
+  contentPermissions(): Record<ContentId, Permission[]>;
+  teamOn(on?: ContentId): boolean;
+}
+declare function resolvePermissions({ assignments, roles, tokenScopes }: ResolveInput): ResolvedPermissions;
+declare function systemPermissions(): ResolvedPermissions;
+//#endregion
+export { AssignmentRow, ResolveInput, ResolvedPermissions, resolvePermissions, systemPermissions };
+//# sourceMappingURL=effective-permissions.d.ts.map

package/dist/organizations/effective-permissions.js

@@ -0,0 +1,118 @@
+import { ForbiddenError } from "../shared/errors.js";
+import { ALL_PERMISSIONS, permissionAbout, withImplied } from "./permissions.js";
+import { MEMBER_ROLE_KEY } from "./default-roles.js";
+//#region src/organizations/effective-permissions.ts
+const MEMBER_REF = {
+	key: MEMBER_ROLE_KEY,
+	name: "Member",
+	team: false
+};
+function refOf(role) {
+	return {
+		key: role.key,
+		name: role.name,
+		team: role.team
+	};
+}
+function intersect(set, scopes) {
+	if (!scopes) return set;
+	return new Set([...set].filter((permission) => scopes.has(permission)));
+}
+var ResolvedPermissions = class {
+	org;
+	orgRole;
+	content;
+	owner;
+	token;
+	constructor(org, orgRole, content, owner, token) {
+		this.org = org;
+		this.orgRole = orgRole;
+		this.content = content;
+		this.owner = owner;
+		this.token = token;
+	}
+	has(permission, on) {
+		if (this.org.has(permission)) return true;
+		return on !== void 0 && (this.content.get(on)?.permissions.has(permission) ?? false);
+	}
+	require(permission, on) {
+		if (!this.has(permission, on)) throw Object.assign(new ForbiddenError(`You need ${permission}`), {
+			permission,
+			...on !== void 0 && { contentId: on }
+		});
+	}
+	anywhere(permission) {
+		if (this.org.has(permission)) return true;
+		for (const entry of this.content.values()) if (entry.permissions.has(permission)) return true;
+		return false;
+	}
+	where(permission) {
+		if (this.org.has(permission)) return {
+			org: true,
+			content: []
+		};
+		const content = [];
+		for (const [id, entry] of this.content) if (entry.permissions.has(permission)) content.push(id);
+		return {
+			org: false,
+			content
+		};
+	}
+	roleOn(on) {
+		if (on !== void 0) {
+			const entry = this.content.get(on);
+			if (entry) return entry.role;
+		}
+		return this.orgRole;
+	}
+	isOwner() {
+		return this.owner;
+	}
+	isToken() {
+		return this.token;
+	}
+	orgPermissions() {
+		return ALL_PERMISSIONS.filter((permission) => this.org.has(permission));
+	}
+	contentPermissions() {
+		const out = {};
+		for (const [id, entry] of this.content) out[id] = ALL_PERMISSIONS.filter((permission) => entry.permissions.has(permission));
+		return out;
+	}
+	teamOn(on) {
+		if (on !== void 0 && this.content.get(on)?.role.team) return true;
+		return this.orgRole.team;
+	}
+};
+function resolvePermissions({ assignments, roles, tokenScopes }) {
+	const scopes = tokenScopes ? withImplied(tokenScopes) : null;
+	const orgRow = assignments.find((row) => row.contentId === null);
+	const listed = orgRow ? roles.get(orgRow.roleKey) : void 0;
+	const orgRole = listed?.levels.includes("org") ? listed : void 0;
+	const orgSet = orgRole ? withImplied(orgRole.permissions) : /* @__PURE__ */ new Set();
+	const content = /* @__PURE__ */ new Map();
+	for (const row of assignments) {
+		if (row.contentId === null || row.contentType === null) continue;
+		const role = roles.get(row.roleKey);
+		if (!role || !role.levels.includes(row.contentType)) continue;
+		const type = row.contentType;
+		const expanded = [...withImplied(role.permissions.filter((permission) => permissionAbout(permission) === type))].filter((permission) => permissionAbout(permission) === type);
+		content.set(row.contentId, {
+			permissions: intersect(new Set(expanded), scopes),
+			role: refOf(role)
+		});
+	}
+	const owner = orgRow?.roleKey === "owner" && orgRole !== void 0;
+	return new ResolvedPermissions(intersect(orgSet, scopes), orgRole ? refOf(orgRole) : roles.get("member") ? refOf(roles.get(MEMBER_ROLE_KEY)) : MEMBER_REF, content, owner && scopes === null, scopes !== null);
+}
+function systemPermissions() {
+	return new ResolvedPermissions(new Set(ALL_PERMISSIONS), {
+		key: "system",
+		name: "System",
+		team: false
+	}, /* @__PURE__ */ new Map(), false, false);
+}
+//#endregion
+export { ResolvedPermissions, resolvePermissions, systemPermissions };
+
+//# sourceMappingURL=effective-permissions.js.map