@headless-lms/core 0.4.0 → 0.6.0

package/dist/organizations/events.js

@@ -1,5 +1,7 @@
-import { inviteSchema, orgUserSchema, organizationSchema } from "../types/schemas/organizations.js";
+import { contentTypeSchema } from "../types/schemas/content.js";
+import { inviteSchema, levelSchema, orgUserSchema, organizationSchema } from "../types/schemas/organizations.js";
 import { defineEvent } from "../shared/events.js";
+import { z } from "zod";
 //#region src/organizations/events.ts
 const publicOrganization = organizationSchema.pick({
 	id: true,
@@ -13,7 +15,6 @@ const publicOrgUser = orgUserSchema.pick({
 	id: true,
 	orgId: true,
 	userId: true,
-	role: true,
 	status: true,
 	createdAt: true,
 	updatedAt: true
@@ -22,13 +23,48 @@ const publicInvite = inviteSchema.pick({
 	id: true,
 	orgId: true,
 	email: true,
-	role: true,
+	roleKey: true,
 	status: true,
 	invitedBy: true,
 	expiresAt: true,
 	createdAt: true,
 	updatedAt: true
 }).strip();
+const orgUserWithRole = orgUserSchema.extend({ orgRole: z.object({ key: z.string() }) });
+const publicOrgUserWithRole = publicOrgUser.extend({ orgRole: z.object({ key: z.string() }) });
+const roleSnapshot = z.object({
+	key: z.string(),
+	name: z.string(),
+	description: z.string(),
+	base: z.string(),
+	levels: z.array(levelSchema),
+	team: z.boolean(),
+	permissions: z.array(z.string())
+});
+const roleUpdated = z.object({
+	key: z.string(),
+	before: roleSnapshot,
+	after: roleSnapshot
+});
+const roleCreated = z.object({ role: roleSnapshot });
+const roleDeleted = z.object({ key: z.string() });
+const roleAssigned = z.object({
+	orgUserId: z.string(),
+	roleKey: z.string(),
+	contentId: z.string().nullable(),
+	contentType: contentTypeSchema.nullable(),
+	previousRoleKey: z.string().nullable()
+});
+const roleUnassigned = z.object({
+	orgUserId: z.string(),
+	roleKey: z.string(),
+	contentId: z.string(),
+	contentType: contentTypeSchema
+});
+const ownershipTransferred = z.object({
+	previousOwnerOrgUserId: z.string(),
+	newOwnerOrgUserId: z.string()
+});
 const organizationEvents = {
 	organizationCreated: defineEvent({
 		type: "organization.created",
@@ -50,54 +86,90 @@ const organizationEvents = {
 	}),
 	orgUserLinked: defineEvent({
 		type: "organization.user.linked",
-		version: 1,
-		data: orgUserSchema,
-		publicData: publicOrgUser
+		version: 2,
+		data: orgUserWithRole,
+		publicData: publicOrgUserWithRole
 	}),
 	orgUserDeleted: defineEvent({
 		type: "organization.user.deleted",
-		version: 1,
-		data: orgUserSchema,
-		publicData: publicOrgUser
+		version: 2,
+		data: orgUserWithRole,
+		publicData: publicOrgUserWithRole
 	}),
 	orgUserUpdated: defineEvent({
 		type: "organization.user.updated",
-		version: 1,
-		data: orgUserSchema,
-		publicData: publicOrgUser
+		version: 2,
+		data: orgUserWithRole,
+		publicData: publicOrgUserWithRole
 	}),
 	inviteCreated: defineEvent({
 		type: "organization.invite.created",
-		version: 1,
+		version: 2,
 		data: inviteSchema,
 		publicData: publicInvite
 	}),
 	inviteAccepted: defineEvent({
 		type: "organization.invite.accepted",
-		version: 1,
+		version: 2,
 		data: inviteSchema,
 		publicData: publicInvite
 	}),
 	inviteCanceled: defineEvent({
 		type: "organization.invite.canceled",
-		version: 1,
+		version: 2,
 		data: inviteSchema
 	}),
 	studentCreated: defineEvent({
 		type: "organization.student.created",
-		version: 1,
+		version: 2,
 		data: orgUserSchema,
 		publicData: publicOrgUser
 	}),
 	studentDeleted: defineEvent({
 		type: "organization.student.deleted",
-		version: 1,
+		version: 2,
 		data: orgUserSchema,
 		publicData: publicOrgUser
 	}),
+	roleUpdated: defineEvent({
+		type: "organization.role.updated",
+		version: 1,
+		data: roleUpdated,
+		publicData: roleUpdated
+	}),
+	roleCreated: defineEvent({
+		type: "organization.role.created",
+		version: 1,
+		data: roleCreated,
+		publicData: roleCreated
+	}),
+	roleDeleted: defineEvent({
+		type: "organization.role.deleted",
+		version: 1,
+		data: roleDeleted,
+		publicData: roleDeleted
+	}),
+	roleAssigned: defineEvent({
+		type: "organization.role.assigned",
+		version: 1,
+		data: roleAssigned,
+		publicData: roleAssigned
+	}),
+	roleUnassigned: defineEvent({
+		type: "organization.role.unassigned",
+		version: 1,
+		data: roleUnassigned,
+		publicData: roleUnassigned
+	}),
+	ownershipTransferred: defineEvent({
+		type: "organization.ownership.transferred",
+		version: 1,
+		data: ownershipTransferred,
+		publicData: ownershipTransferred
+	}),
 	studentLinked: defineEvent({
 		type: "organization.student.linked",
-		version: 1,
+		version: 2,
 		data: orgUserSchema,
 		publicData: publicOrgUser
 	})

package/dist/organizations/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","names":[],"sources":["../../src/organizations/events.ts"],"sourcesContent":["import { inviteSchema, organizationSchema, orgUserSchema } from '../types/schemas/index.js';\nimport { defineEvent, type EventOf, type EventOfValues } from '../shared/ports.js';\n\nconst publicOrganization = organizationSchema\n  .pick({\n    id: true,\n    name: true,\n    slug: true,\n    ownerId: true,\n    createdAt: true,\n    updatedAt: true,\n  })\n  .strip();\n\nconst publicOrgUser = orgUserSchema\n  .pick({\n    id: true,\n    orgId: true,\n    userId: true,\n    role: true,\n    status: true,\n    createdAt: true,\n    updatedAt: true,\n  })\n  .strip();\n\nconst publicInvite = inviteSchema\n  .pick({\n    id: true,\n    orgId: true,\n    email: true,\n    role: true,\n    status: true,\n    invitedBy: true,\n    expiresAt: true,\n    createdAt: true,\n    updatedAt: true,\n  })\n  .strip();\n\nexport const organizationEvents = {\n  organizationCreated: defineEvent({\n    type: 'organization.created',\n    version: 1,\n    data: organizationSchema,\n    publicData: publicOrganization,\n  }),\n  organizationUpdated: defineEvent({\n    type: 'organization.updated',\n    version: 1,\n    data: organizationSchema,\n    publicData: publicOrganization,\n  }),\n  organizationDeleted: defineEvent({\n    type: 'organization.deleted',\n    version: 1,\n    data: organizationSchema,\n    publicData: publicOrganization,\n  }),\n  orgUserLinked: defineEvent({\n    type: 'organization.user.linked',\n    version: 1,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n  orgUserDeleted: defineEvent({\n    type: 'organization.user.deleted',\n    version: 1,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n  orgUserUpdated: defineEvent({\n    type: 'organization.user.updated',\n    version: 1,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n  inviteCreated: defineEvent({\n    type: 'organization.invite.created',\n    version: 1,\n    data: inviteSchema,\n    publicData: publicInvite,\n  }),\n  inviteAccepted: defineEvent({\n    type: 'organization.invite.accepted',\n    version: 1,\n    data: inviteSchema,\n    publicData: publicInvite,\n  }),\n  inviteCanceled: defineEvent({\n    type: 'organization.invite.canceled',\n    version: 1,\n    data: inviteSchema,\n  }),\n  studentCreated: defineEvent({\n    type: 'organization.student.created',\n    version: 1,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n  studentDeleted: defineEvent({\n    type: 'organization.student.deleted',\n    version: 1,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n  studentLinked: defineEvent({\n    type: 'organization.student.linked',\n    version: 1,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n};\n\nexport type OrganizationCreated = EventOf<typeof organizationEvents.organizationCreated>;\nexport type OrganizationUpdated = EventOf<typeof organizationEvents.organizationUpdated>;\nexport type OrganizationDeleted = EventOf<typeof organizationEvents.organizationDeleted>;\nexport type OrgUserLinked = EventOf<typeof organizationEvents.orgUserLinked>;\nexport type OrgUserDeleted = EventOf<typeof organizationEvents.orgUserDeleted>;\nexport type OrgUserUpdated = EventOf<typeof organizationEvents.orgUserUpdated>;\nexport type InviteCreated = EventOf<typeof organizationEvents.inviteCreated>;\nexport type InviteAccepted = EventOf<typeof organizationEvents.inviteAccepted>;\nexport type InviteCanceled = EventOf<typeof organizationEvents.inviteCanceled>;\nexport type StudentCreated = EventOf<typeof organizationEvents.studentCreated>;\nexport type StudentDeleted = EventOf<typeof organizationEvents.studentDeleted>;\nexport type StudentLinked = EventOf<typeof organizationEvents.studentLinked>;\nexport type OrganizationEvent = EventOfValues<typeof organizationEvents>;\n"],"mappings":";;;AAGA,MAAM,qBAAqB,mBACxB,KAAK;CACJ,IAAI;CACJ,MAAM;CACN,MAAM;CACN,SAAS;CACT,WAAW;CACX,WAAW;AACb,CAAC,CAAC,CACD,MAAM;AAET,MAAM,gBAAgB,cACnB,KAAK;CACJ,IAAI;CACJ,OAAO;CACP,QAAQ;CACR,MAAM;CACN,QAAQ;CACR,WAAW;CACX,WAAW;AACb,CAAC,CAAC,CACD,MAAM;AAET,MAAM,eAAe,aAClB,KAAK;CACJ,IAAI;CACJ,OAAO;CACP,OAAO;CACP,MAAM;CACN,QAAQ;CACR,WAAW;CACX,WAAW;CACX,WAAW;CACX,WAAW;AACb,CAAC,CAAC,CACD,MAAM;AAET,MAAa,qBAAqB;CAChC,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;AACH"}
+{"version":3,"file":"events.js","names":[],"sources":["../../src/organizations/events.ts"],"sourcesContent":["import { z } from 'zod';\nimport {\n  contentTypeSchema,\n  inviteSchema,\n  levelSchema,\n  organizationSchema,\n  orgUserSchema,\n} from '../types/schemas/index.js';\nimport { defineEvent, type EventOf, type EventOfValues } from '../shared/ports.js';\n\nconst publicOrganization = organizationSchema\n  .pick({\n    id: true,\n    name: true,\n    slug: true,\n    ownerId: true,\n    createdAt: true,\n    updatedAt: true,\n  })\n  .strip();\n\nconst publicOrgUser = orgUserSchema\n  .pick({\n    id: true,\n    orgId: true,\n    userId: true,\n    status: true,\n    createdAt: true,\n    updatedAt: true,\n  })\n  .strip();\n\nconst publicInvite = inviteSchema\n  .pick({\n    id: true,\n    orgId: true,\n    email: true,\n    roleKey: true,\n    status: true,\n    invitedBy: true,\n    expiresAt: true,\n    createdAt: true,\n    updatedAt: true,\n  })\n  .strip();\n\nconst orgUserWithRole = orgUserSchema.extend({ orgRole: z.object({ key: z.string() }) });\nconst publicOrgUserWithRole = publicOrgUser.extend({ orgRole: z.object({ key: z.string() }) });\n\nconst roleSnapshot = z.object({\n  key: z.string(),\n  name: z.string(),\n  description: z.string(),\n  base: z.string(),\n  levels: z.array(levelSchema),\n  team: z.boolean(),\n  permissions: z.array(z.string()),\n});\n\nconst roleUpdated = z.object({ key: z.string(), before: roleSnapshot, after: roleSnapshot });\nconst roleCreated = z.object({ role: roleSnapshot });\nconst roleDeleted = z.object({ key: z.string() });\nconst roleAssigned = z.object({\n  orgUserId: z.string(),\n  roleKey: z.string(),\n  contentId: z.string().nullable(),\n  contentType: contentTypeSchema.nullable(),\n  previousRoleKey: z.string().nullable(),\n});\nconst roleUnassigned = z.object({\n  orgUserId: z.string(),\n  roleKey: z.string(),\n  contentId: z.string(),\n  contentType: contentTypeSchema,\n});\nconst ownershipTransferred = z.object({\n  previousOwnerOrgUserId: z.string(),\n  newOwnerOrgUserId: z.string(),\n});\n\nexport const organizationEvents = {\n  organizationCreated: defineEvent({\n    type: 'organization.created',\n    version: 1,\n    data: organizationSchema,\n    publicData: publicOrganization,\n  }),\n  organizationUpdated: defineEvent({\n    type: 'organization.updated',\n    version: 1,\n    data: organizationSchema,\n    publicData: publicOrganization,\n  }),\n  organizationDeleted: defineEvent({\n    type: 'organization.deleted',\n    version: 1,\n    data: organizationSchema,\n    publicData: publicOrganization,\n  }),\n  orgUserLinked: defineEvent({\n    type: 'organization.user.linked',\n    version: 2,\n    data: orgUserWithRole,\n    publicData: publicOrgUserWithRole,\n  }),\n  orgUserDeleted: defineEvent({\n    type: 'organization.user.deleted',\n    version: 2,\n    data: orgUserWithRole,\n    publicData: publicOrgUserWithRole,\n  }),\n  orgUserUpdated: defineEvent({\n    type: 'organization.user.updated',\n    version: 2,\n    data: orgUserWithRole,\n    publicData: publicOrgUserWithRole,\n  }),\n  inviteCreated: defineEvent({\n    type: 'organization.invite.created',\n    version: 2,\n    data: inviteSchema,\n    publicData: publicInvite,\n  }),\n  inviteAccepted: defineEvent({\n    type: 'organization.invite.accepted',\n    version: 2,\n    data: inviteSchema,\n    publicData: publicInvite,\n  }),\n  inviteCanceled: defineEvent({\n    type: 'organization.invite.canceled',\n    version: 2,\n    data: inviteSchema,\n  }),\n  studentCreated: defineEvent({\n    type: 'organization.student.created',\n    version: 2,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n  studentDeleted: defineEvent({\n    type: 'organization.student.deleted',\n    version: 2,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n  roleUpdated: defineEvent({\n    type: 'organization.role.updated',\n    version: 1,\n    data: roleUpdated,\n    publicData: roleUpdated,\n  }),\n  roleCreated: defineEvent({\n    type: 'organization.role.created',\n    version: 1,\n    data: roleCreated,\n    publicData: roleCreated,\n  }),\n  roleDeleted: defineEvent({\n    type: 'organization.role.deleted',\n    version: 1,\n    data: roleDeleted,\n    publicData: roleDeleted,\n  }),\n  roleAssigned: defineEvent({\n    type: 'organization.role.assigned',\n    version: 1,\n    data: roleAssigned,\n    publicData: roleAssigned,\n  }),\n  roleUnassigned: defineEvent({\n    type: 'organization.role.unassigned',\n    version: 1,\n    data: roleUnassigned,\n    publicData: roleUnassigned,\n  }),\n  ownershipTransferred: defineEvent({\n    type: 'organization.ownership.transferred',\n    version: 1,\n    data: ownershipTransferred,\n    publicData: ownershipTransferred,\n  }),\n  studentLinked: defineEvent({\n    type: 'organization.student.linked',\n    version: 2,\n    data: orgUserSchema,\n    publicData: publicOrgUser,\n  }),\n};\n\nexport type OrganizationCreated = EventOf<typeof organizationEvents.organizationCreated>;\nexport type OrganizationUpdated = EventOf<typeof organizationEvents.organizationUpdated>;\nexport type OrganizationDeleted = EventOf<typeof organizationEvents.organizationDeleted>;\nexport type OrgUserLinked = EventOf<typeof organizationEvents.orgUserLinked>;\nexport type OrgUserDeleted = EventOf<typeof organizationEvents.orgUserDeleted>;\nexport type OrgUserUpdated = EventOf<typeof organizationEvents.orgUserUpdated>;\nexport type InviteCreated = EventOf<typeof organizationEvents.inviteCreated>;\nexport type InviteAccepted = EventOf<typeof organizationEvents.inviteAccepted>;\nexport type InviteCanceled = EventOf<typeof organizationEvents.inviteCanceled>;\nexport type StudentCreated = EventOf<typeof organizationEvents.studentCreated>;\nexport type StudentDeleted = EventOf<typeof organizationEvents.studentDeleted>;\nexport type StudentLinked = EventOf<typeof organizationEvents.studentLinked>;\nexport type RoleUpdated = EventOf<typeof organizationEvents.roleUpdated>;\nexport type RoleCreated = EventOf<typeof organizationEvents.roleCreated>;\nexport type RoleDeleted = EventOf<typeof organizationEvents.roleDeleted>;\nexport type RoleAssigned = EventOf<typeof organizationEvents.roleAssigned>;\nexport type RoleUnassigned = EventOf<typeof organizationEvents.roleUnassigned>;\nexport type OwnershipTransferred = EventOf<typeof organizationEvents.ownershipTransferred>;\nexport type OrganizationEvent = EventOfValues<typeof organizationEvents>;\n"],"mappings":";;;;;AAUA,MAAM,qBAAqB,mBACxB,KAAK;CACJ,IAAI;CACJ,MAAM;CACN,MAAM;CACN,SAAS;CACT,WAAW;CACX,WAAW;AACb,CAAC,CAAC,CACD,MAAM;AAET,MAAM,gBAAgB,cACnB,KAAK;CACJ,IAAI;CACJ,OAAO;CACP,QAAQ;CACR,QAAQ;CACR,WAAW;CACX,WAAW;AACb,CAAC,CAAC,CACD,MAAM;AAET,MAAM,eAAe,aAClB,KAAK;CACJ,IAAI;CACJ,OAAO;CACP,OAAO;CACP,SAAS;CACT,QAAQ;CACR,WAAW;CACX,WAAW;CACX,WAAW;CACX,WAAW;AACb,CAAC,CAAC,CACD,MAAM;AAET,MAAM,kBAAkB,cAAc,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACvF,MAAM,wBAAwB,cAAc,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAE7F,MAAM,eAAe,EAAE,OAAO;CAC5B,KAAK,EAAE,OAAO;CACd,MAAM,EAAE,OAAO;CACf,aAAa,EAAE,OAAO;CACtB,MAAM,EAAE,OAAO;CACf,QAAQ,EAAE,MAAM,WAAW;CAC3B,MAAM,EAAE,QAAQ;CAChB,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC;AACjC,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;CAAE,KAAK,EAAE,OAAO;CAAG,QAAQ;CAAc,OAAO;AAAa,CAAC;AAC3F,MAAM,cAAc,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACnD,MAAM,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChD,MAAM,eAAe,EAAE,OAAO;CAC5B,WAAW,EAAE,OAAO;CACpB,SAAS,EAAE,OAAO;CAClB,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,aAAa,kBAAkB,SAAS;CACxC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;AACvC,CAAC;AACD,MAAM,iBAAiB,EAAE,OAAO;CAC9B,WAAW,EAAE,OAAO;CACpB,SAAS,EAAE,OAAO;CAClB,WAAW,EAAE,OAAO;CACpB,aAAa;AACf,CAAC;AACD,MAAM,uBAAuB,EAAE,OAAO;CACpC,wBAAwB,EAAE,OAAO;CACjC,mBAAmB,EAAE,OAAO;AAC9B,CAAC;AAED,MAAa,qBAAqB;CAChC,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,qBAAqB,YAAY;EAC/B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,aAAa,YAAY;EACvB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,aAAa,YAAY;EACvB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,aAAa,YAAY;EACvB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,cAAc,YAAY;EACxB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,gBAAgB,YAAY;EAC1B,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,sBAAsB,YAAY;EAChC,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,eAAe,YAAY;EACzB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;AACH"}

package/dist/organizations/index.d.ts

@@ -1,13 +1,17 @@
-import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, InviteRole, NewOrganizationInput, OrgUser, OrgUserStatus, Organization, Role, UpdateOrgUserInput } from "../types/schemas/organizations.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, NewOrganizationInput, OrgUser, OrgUserStatus, Organization, OrganizationMetadata, UpdateOrgUserInput } from "../types/schemas/organizations.js";
 import { InviteId, OrgUserId, OrganizationId } from "../types/organizations.js";
-import "./model.js";
-import { Capability, Permission, ROLES, STAFF_ROLES, STUDENT_ROLE, StaffRole, TeamRole, canModerate, capability, isRole, isStaffRole, normalizeRole, parseRole } from "./roles.js";
-import { InviteError, Member, MemberRoleChange, MemberStatus, MembersQuery, OrganizationRuleError, Page } from "./members.js";
-import { CreateOrganizationInput, LinkOrgUserInput, ResendStudentInviteInput, UnlinkOrgUserInput, UpdateOrganizationInput } from "./types.js";
 import { AuthHeaders } from "../identity/ports.js";
-import { AuthOrganization, MemberRecord, MemberWriteContext, MembersRepository, NewInviteRow, NewOrganizationRow, OrgAdmin, OrganizationService, OrganizationsRepository } from "./ports.js";
-import { OrganizationServiceImpl } from "./service.js";
+import { DEFAULT_ROLES, MEMBER_ROLE_KEY, OWNER_ROLE_KEY, RoleDefinition, RoleSetError, defaultHolders, validateRoleSet } from "./default-roles.js";
+import { OrgRole, RoleCatalog, StoredOrgRole, catalogOf, isSystemRole, resolveOrgRoles, resolveRole } from "./org-roles.js";
+import { AssignmentRow, ResolveInput, ResolvedPermissions, resolvePermissions, systemPermissions } from "./effective-permissions.js";
+import { InviteAccepted, InviteCanceled, InviteCreated, OrgUserDeleted, OrgUserLinked, OrgUserUpdated, OrganizationCreated, OrganizationDeleted, OrganizationEvent, OrganizationUpdated, OwnershipTransferred, RoleAssigned, RoleCreated, RoleDeleted, RoleUnassigned, RoleUpdated, StudentCreated, StudentDeleted, StudentLinked, organizationEvents } from "./events.js";
+import "./model.js";
+import { AssignmentView, CreateRoleInput, InviteDetails, InviteError, ItemRole, Member, MemberStatus, MembersQuery, OrganizationRuleError, Page, RoleView, UpdateRoleInput, ViewerPermissions } from "./members.js";
+import { ALL_PERMISSIONS, PERMISSIONS, PermissionDefinition, PermissionGroup, PermissionListEntry, fitsLevels, isPermission, permissionList, withImplied } from "./permissions.js";
+import { CreateOrganizationInput, UpdateOrganizationInput } from "./types.js";
+import { Accounts, ActorFacts, ApiKeyRole, ApiKeys, AuthOrganization, CallerFacts, CallerLimit, CreateApiKeyInput, GrantReader, MembersRepository, NewApiKey, NewInviteRow, NewOrganizationRow, OrgAdmin, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork, OrganizationsWriteScope, PlatformAccount, PlatformOrganization, PlatformOrganizationInput, ResolvedCaller, RolesRepository, StoredApiKey, TeamRow, TransferOwnershipInput } from "./ports.js";
+import { InviteUrls, OrganizationServiceImpl, OrganizationServiceParams } from "./service.js";
 import { OrgNotificationCategories } from "./notification-categories.js";
-import { InviteAccepted, InviteCanceled, InviteCreated, OrgUserDeleted, OrgUserLinked, OrgUserUpdated, OrganizationCreated, OrganizationDeleted, OrganizationEvent, OrganizationUpdated, StudentCreated, StudentDeleted, StudentLinked, organizationEvents } from "./events.js";
-import { ACCESS_SCOPES, AccessScope, SCOPE_PERMISSION, ScopeOption, assertRoleHoldsScopes, isAccessScope, isDeleteScope, roleHoldsScope, scopeOptions, scopesForRole } from "./access-scopes.js";
-export { ACCESS_SCOPES, type AcceptInviteInput, AccessScope, type AddOrgUserInput, type AuthHeaders, type AuthOrganization, type Capability, type CreateInviteInput, type CreateOrgUserInput, type CreateOrganizationInput, type Invite, type InviteAccepted, type InviteCanceled, type InviteCreated, InviteError, type InviteId, type InviteRole, type LinkOrgUserInput, type Member, type MemberRecord, type MemberRoleChange, type MemberStatus, type MemberWriteContext, type MembersQuery, type MembersRepository, type NewInviteRow, type NewOrganizationInput, type NewOrganizationRow, type OrgAdmin, OrgNotificationCategories, type OrgUser, type OrgUserDeleted, type OrgUserId, type OrgUserLinked, type OrgUserStatus, type OrgUserUpdated, type Organization, type OrganizationCreated, type OrganizationDeleted, type OrganizationEvent, type OrganizationId, OrganizationRuleError, type OrganizationService, OrganizationServiceImpl, type OrganizationUpdated, type OrganizationsRepository, type Page, type Permission, ROLES, type ResendStudentInviteInput, type Role, SCOPE_PERMISSION, STAFF_ROLES, STUDENT_ROLE, ScopeOption, type StaffRole, type StudentCreated, type StudentDeleted, type StudentLinked, type TeamRole, type UnlinkOrgUserInput, type UpdateOrgUserInput, type UpdateOrganizationInput, assertRoleHoldsScopes, canModerate, capability, isAccessScope, isDeleteScope, isRole, isStaffRole, normalizeRole, organizationEvents, parseRole, roleHoldsScope, scopeOptions, scopesForRole };
+import { NotificationCatalog, NotificationCatalogParams, NotificationCatalogService } from "./notification-catalog.js";
+import { ActorShape, actorWith } from "./testing.js";
+export { ALL_PERMISSIONS, type AcceptInviteInput, type Accounts, type ActorFacts, type ActorShape, type AddOrgUserInput, type ApiKeyRole, type ApiKeys, type AssignmentRow, type AssignmentView, type AuthHeaders, type AuthOrganization, type CallerFacts, type CallerLimit, type CreateApiKeyInput, type CreateInviteInput, type CreateOrgUserInput, type CreateOrganizationInput, type CreateRoleInput, DEFAULT_ROLES, type GrantReader, type Invite, type InviteAccepted, type InviteCanceled, type InviteCreated, type InviteDetails, InviteError, type InviteId, type InviteUrls, type ItemRole, MEMBER_ROLE_KEY, type Member, type MemberStatus, type MembersQuery, type MembersRepository, type NewApiKey, type NewInviteRow, type NewOrganizationInput, type NewOrganizationRow, NotificationCatalog, type NotificationCatalogParams, type NotificationCatalogService, OWNER_ROLE_KEY, type OrgAdmin, OrgNotificationCategories, type OrgRole, type OrgUser, type OrgUserDeleted, type OrgUserId, type OrgUserLinked, type OrgUserStatus, type OrgUserUpdated, type Organization, type OrganizationCreated, type OrganizationDeleted, type OrganizationEvent, type OrganizationId, type OrganizationMetadata, OrganizationRuleError, type OrganizationService, OrganizationServiceImpl, type OrganizationServiceParams, type OrganizationUpdated, type OrganizationsRepository, type OrganizationsUnitOfWork, type OrganizationsWriteScope, type OwnershipTransferred, PERMISSIONS, type Page, type PermissionDefinition, type PermissionGroup, type PermissionListEntry, type PlatformAccount, type PlatformOrganization, type PlatformOrganizationInput, type ResolveInput, type ResolvedCaller, ResolvedPermissions, type RoleAssigned, type RoleCatalog, type RoleCreated, type RoleDefinition, type RoleDeleted, RoleSetError, type RoleUnassigned, type RoleUpdated, type RoleView, type RolesRepository, type StoredApiKey, type StoredOrgRole, type StudentCreated, type StudentDeleted, type StudentLinked, type TeamRow, type TransferOwnershipInput, type UpdateOrgUserInput, type UpdateOrganizationInput, type UpdateRoleInput, type ViewerPermissions, actorWith, catalogOf, defaultHolders, fitsLevels, isPermission, isSystemRole, organizationEvents, permissionList, resolveOrgRoles, resolvePermissions, resolveRole, systemPermissions, validateRoleSet, withImplied };

package/dist/organizations/index.js

@@ -1,7 +1,11 @@
-import { ROLES, STAFF_ROLES, STUDENT_ROLE, canModerate, capability, isRole, isStaffRole, normalizeRole, parseRole } from "./roles.js";
 import { InviteError, OrganizationRuleError } from "./members.js";
 import { organizationEvents } from "./events.js";
+import { ALL_PERMISSIONS, PERMISSIONS, fitsLevels, isPermission, permissionList, withImplied } from "./permissions.js";
+import { DEFAULT_ROLES, MEMBER_ROLE_KEY, OWNER_ROLE_KEY, RoleSetError, defaultHolders, validateRoleSet } from "./default-roles.js";
+import { catalogOf, isSystemRole, resolveOrgRoles, resolveRole } from "./org-roles.js";
+import { ResolvedPermissions, resolvePermissions, systemPermissions } from "./effective-permissions.js";
 import { OrganizationServiceImpl } from "./service.js";
 import { OrgNotificationCategories } from "./notification-categories.js";
-import { ACCESS_SCOPES, SCOPE_PERMISSION, assertRoleHoldsScopes, isAccessScope, isDeleteScope, roleHoldsScope, scopeOptions, scopesForRole } from "./access-scopes.js";
-export { ACCESS_SCOPES, InviteError, OrgNotificationCategories, OrganizationRuleError, OrganizationServiceImpl, ROLES, SCOPE_PERMISSION, STAFF_ROLES, STUDENT_ROLE, assertRoleHoldsScopes, canModerate, capability, isAccessScope, isDeleteScope, isRole, isStaffRole, normalizeRole, organizationEvents, parseRole, roleHoldsScope, scopeOptions, scopesForRole };
+import { NotificationCatalog } from "./notification-catalog.js";
+import { actorWith } from "./testing.js";
+export { ALL_PERMISSIONS, DEFAULT_ROLES, InviteError, MEMBER_ROLE_KEY, NotificationCatalog, OWNER_ROLE_KEY, OrgNotificationCategories, OrganizationRuleError, OrganizationServiceImpl, PERMISSIONS, ResolvedPermissions, RoleSetError, actorWith, catalogOf, defaultHolders, fitsLevels, isPermission, isSystemRole, organizationEvents, permissionList, resolveOrgRoles, resolvePermissions, resolveRole, systemPermissions, validateRoleSet, withImplied };

package/dist/organizations/members.d.ts

@@ -1,23 +1,31 @@
-import { OrgUserProfile, Role } from "../types/schemas/organizations.js";
+import { ContentType } from "../types/schemas/content.js";
+import { Level, OrgUserProfile, Permission } from "../types/schemas/organizations.js";
 import "../types/index.js";
-import { TeamRole } from "./roles.js";
 //#region src/organizations/members.d.ts
 type MemberStatus = 'active' | 'invited';
+interface ItemRole {
+  contentId: string;
+  contentType: ContentType;
+  roleKey: string;
+  roleName: string;
+}
 interface Member extends OrgUserProfile {
-  role: TeamRole;
+  orgRole: {
+    key: string;
+    name: string;
+  };
+  isOwner: boolean;
+  items: ItemRole[];
   status: MemberStatus;
   joinedAt: string | null;
   invitedAt: string | null;
 }
-interface MemberRoleChange extends Omit<Member, 'role'> {
-  role: Role;
-}
 interface MembersQuery {
   page: number;
   pageSize: number;
   search?: string | undefined;
   sort?: string | undefined;
-  role?: TeamRole | undefined;
+  roleKey?: string | undefined;
   status?: MemberStatus | undefined;
 }
 interface Page<T> {
@@ -26,10 +34,60 @@ interface Page<T> {
   page: number;
   pageSize: number;
 }
+interface RoleView {
+  key: string;
+  name: string;
+  description: string;
+  base: string;
+  levels: Level[];
+  team: boolean;
+  permissions: Permission[];
+  system: boolean;
+  added: boolean;
+  customized: boolean;
+  holders: number;
+  givable: boolean;
+}
+interface UpdateRoleInput {
+  name?: string | undefined;
+  description?: string | undefined;
+  levels?: Level[] | undefined;
+  team?: boolean | undefined;
+  permissions?: Partial<Record<Permission, boolean>> | undefined;
+}
+interface CreateRoleInput {
+  base: string;
+  name: string;
+  description?: string | undefined;
+  levels?: Level[] | undefined;
+  team?: boolean | undefined;
+  permissions?: Partial<Record<Permission, boolean>> | undefined;
+}
+interface AssignmentView {
+  orgUserId: string;
+  roleKey: string;
+  roleName: string;
+  contentId: string | null;
+  contentType: ContentType | null;
+}
+interface ViewerPermissions {
+  orgRole: {
+    key: string;
+    name: string;
+  };
+  isOwner: boolean;
+  org: Permission[];
+  content: Record<string, Permission[]>;
+}
+interface InviteDetails {
+  email: string;
+  firstName: string | null;
+  lastName: string | null;
+}
 declare class OrganizationRuleError extends Error {}
 declare class InviteError extends Error {
   constructor(message: string);
 }
 //#endregion
-export { InviteError, Member, MemberRoleChange, MemberStatus, MembersQuery, OrganizationRuleError, Page };
+export { AssignmentView, CreateRoleInput, InviteDetails, InviteError, ItemRole, Member, MemberStatus, MembersQuery, OrganizationRuleError, Page, RoleView, UpdateRoleInput, ViewerPermissions };
 //# sourceMappingURL=members.d.ts.map

package/dist/organizations/members.js.map

@@ -1 +1 @@
-{"version":3,"file":"members.js","names":[],"sources":["../../src/organizations/members.ts"],"sourcesContent":["// organizations context — member-management types (invite / change-role / remove).\n// The operational surface over the org's members and pending invites. Roles\n// come from ./roles.ts (the single role model); writes go through Better Auth.\nimport type { Role, TeamRole } from './roles.js';\nimport type { OrgUserProfile } from '../types/index.js';\n\nexport type MemberStatus = 'active' | 'invited';\n\nexport interface Member extends OrgUserProfile {\n  role: TeamRole;\n  status: MemberStatus;\n  joinedAt: string | null;\n  invitedAt: string | null;\n}\n\nexport interface MemberRoleChange extends Omit<Member, 'role'> {\n  role: Role;\n}\n\nexport interface MembersQuery {\n  page: number;\n  pageSize: number;\n  search?: string | undefined;\n  sort?: string | undefined;\n  role?: TeamRole | undefined;\n  status?: MemberStatus | undefined;\n}\n\nexport interface Page<T> {\n  rows: T[];\n  total: number;\n  page: number;\n  pageSize: number;\n}\n\nexport class OrganizationRuleError extends Error {}\nexport class InviteError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'InviteError';\n  }\n}\n"],"mappings":";AAmCA,IAAa,wBAAb,cAA2C,MAAM,CAAC;AAClD,IAAa,cAAb,cAAiC,MAAM;CACrC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"members.js","names":[],"sources":["../../src/organizations/members.ts"],"sourcesContent":["import type { ContentType, Level, OrgUserProfile, Permission } from '../types/index.js';\n\nexport type MemberStatus = 'active' | 'invited';\n\nexport interface ItemRole {\n  contentId: string;\n  contentType: ContentType;\n  roleKey: string;\n  roleName: string;\n}\n\nexport interface Member extends OrgUserProfile {\n  orgRole: { key: string; name: string };\n  isOwner: boolean;\n  items: ItemRole[];\n  status: MemberStatus;\n  joinedAt: string | null;\n  invitedAt: string | null;\n}\n\nexport interface MembersQuery {\n  page: number;\n  pageSize: number;\n  search?: string | undefined;\n  sort?: string | undefined;\n  roleKey?: string | undefined;\n  status?: MemberStatus | undefined;\n}\n\nexport interface Page<T> {\n  rows: T[];\n  total: number;\n  page: number;\n  pageSize: number;\n}\n\nexport interface RoleView {\n  key: string;\n  name: string;\n  description: string;\n  base: string;\n  levels: Level[];\n  team: boolean;\n  permissions: Permission[];\n  system: boolean;\n  added: boolean;\n  customized: boolean;\n  holders: number;\n  givable: boolean;\n}\n\nexport interface UpdateRoleInput {\n  name?: string | undefined;\n  description?: string | undefined;\n  levels?: Level[] | undefined;\n  team?: boolean | undefined;\n  permissions?: Partial<Record<Permission, boolean>> | undefined;\n}\n\nexport interface CreateRoleInput {\n  base: string;\n  name: string;\n  description?: string | undefined;\n  levels?: Level[] | undefined;\n  team?: boolean | undefined;\n  permissions?: Partial<Record<Permission, boolean>> | undefined;\n}\n\nexport interface AssignmentView {\n  orgUserId: string;\n  roleKey: string;\n  roleName: string;\n  contentId: string | null;\n  contentType: ContentType | null;\n}\n\nexport interface ViewerPermissions {\n  orgRole: { key: string; name: string };\n  isOwner: boolean;\n  org: Permission[];\n  content: Record<string, Permission[]>;\n}\n\nexport interface InviteDetails {\n  email: string;\n  firstName: string | null;\n  lastName: string | null;\n}\n\nexport class OrganizationRuleError extends Error {}\nexport class InviteError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'InviteError';\n  }\n}\n"],"mappings":";AAyFA,IAAa,wBAAb,cAA2C,MAAM,CAAC;AAClD,IAAa,cAAb,cAAiC,MAAM;CACrC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF"}

package/dist/organizations/model.d.ts

@@ -1,3 +1,3 @@
-import { Invite, OrgUser, Organization } from "../types/schemas/organizations.js";
+import { Invite, OrgUser, Organization, OrganizationMetadata } from "../types/schemas/organizations.js";
 import "../types/index.js";
-export type { Invite, OrgUser, Organization };
+export type { Invite, OrgUser, Organization, OrganizationMetadata };

package/dist/organizations/notification-catalog.d.ts

@@ -0,0 +1,31 @@
+import { NotificationCategory, NotificationTypeDeclaration } from "../types/notifications.js";
+import "../types/index.js";
+import { Actor } from "../shared/actor.js";
+import { ChannelRegistry, NotificationTypeRegistry } from "../shared/ports.js";
+import { CategoryListScope } from "../shared/notification-categories.js";
+//#region src/organizations/notification-catalog.d.ts
+interface NotificationCatalogService {
+  types(actor: Actor, scope: CategoryListScope): Pick<NotificationTypeDeclaration, 'type' | 'scopes' | 'reasons'>[];
+  channels(actor: Actor): {
+    channel: string;
+  }[];
+  defaults(actor: Actor, scope: CategoryListScope): NotificationCategory[];
+}
+type NotificationCatalogParams = {
+  types: NotificationTypeRegistry;
+  channels: Pick<ChannelRegistry, 'list'>;
+};
+declare class NotificationCatalog implements NotificationCatalogService {
+  private readonly registry;
+  private readonly channelRegistry;
+  constructor(params: NotificationCatalogParams);
+  types(actor: Actor, scope: CategoryListScope): Pick<NotificationTypeDeclaration, 'type' | 'scopes' | 'reasons'>[];
+  channels(actor: Actor): {
+    channel: string;
+  }[];
+  defaults(actor: Actor, scope: CategoryListScope): NotificationCategory[];
+  private requireFor;
+}
+//#endregion
+export { NotificationCatalog, NotificationCatalogParams, NotificationCatalogService };
+//# sourceMappingURL=notification-catalog.d.ts.map

package/dist/organizations/notification-catalog.js

@@ -0,0 +1,32 @@
+import { ForbiddenError } from "../shared/errors.js";
+import { typesForList } from "../shared/notification-categories.js";
+//#region src/organizations/notification-catalog.ts
+var NotificationCatalog = class {
+	registry;
+	channelRegistry;
+	constructor(params) {
+		this.registry = params.types;
+		this.channelRegistry = params.channels;
+	}
+	types(actor, scope) {
+		this.requireFor(actor, scope);
+		return typesForList(this.registry, scope);
+	}
+	channels(actor) {
+		this.requireFor(actor, "community");
+		return this.channelRegistry.list().map((channel) => ({ channel }));
+	}
+	defaults(actor, scope) {
+		this.requireFor(actor, scope);
+		return this.registry.defaults(scope);
+	}
+	requireFor(actor, scope) {
+		if (actor.permissions.has("notification_categories:read")) return;
+		if (scope === "community" && actor.permissions.anywhere("communities:read")) return;
+		throw new ForbiddenError(scope === "org" ? "You need notification_categories:read" : "You need notification_categories:read or communities:read");
+	}
+};
+//#endregion
+export { NotificationCatalog };
+
+//# sourceMappingURL=notification-catalog.js.map

package/dist/organizations/notification-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-catalog.js","names":[],"sources":["../../src/organizations/notification-catalog.ts"],"sourcesContent":["import type { NotificationCategory, NotificationTypeDeclaration } from '../types/index.js';\nimport type { ChannelRegistry, NotificationTypeRegistry } from '../shared/ports.js';\nimport type { Actor } from '../shared/actor.js';\nimport { ForbiddenError } from '../shared/errors.js';\nimport { typesForList, type CategoryListScope } from '../shared/notification-categories.js';\n\nexport interface NotificationCatalogService {\n  types(\n    actor: Actor,\n    scope: CategoryListScope,\n  ): Pick<NotificationTypeDeclaration, 'type' | 'scopes' | 'reasons'>[];\n  channels(actor: Actor): { channel: string }[];\n  defaults(actor: Actor, scope: CategoryListScope): NotificationCategory[];\n}\n\nexport type NotificationCatalogParams = {\n  types: NotificationTypeRegistry;\n  channels: Pick<ChannelRegistry, 'list'>;\n};\n\nexport class NotificationCatalog implements NotificationCatalogService {\n  private readonly registry: NotificationTypeRegistry;\n  private readonly channelRegistry: Pick<ChannelRegistry, 'list'>;\n\n  constructor(params: NotificationCatalogParams) {\n    this.registry = params.types;\n    this.channelRegistry = params.channels;\n  }\n\n  types(\n    actor: Actor,\n    scope: CategoryListScope,\n  ): Pick<NotificationTypeDeclaration, 'type' | 'scopes' | 'reasons'>[] {\n    this.requireFor(actor, scope);\n    return typesForList(this.registry, scope);\n  }\n\n  channels(actor: Actor): { channel: string }[] {\n    this.requireFor(actor, 'community');\n    return this.channelRegistry.list().map((channel) => ({ channel }));\n  }\n\n  defaults(actor: Actor, scope: CategoryListScope): NotificationCategory[] {\n    this.requireFor(actor, scope);\n    return this.registry.defaults(scope);\n  }\n\n  private requireFor(actor: Actor, scope: CategoryListScope): void {\n    if (actor.permissions.has('notification_categories:read')) {\n      return;\n    }\n    if (scope === 'community' && actor.permissions.anywhere('communities:read')) {\n      return;\n    }\n    throw new ForbiddenError(\n      scope === 'org'\n        ? 'You need notification_categories:read'\n        : 'You need notification_categories:read or communities:read',\n    );\n  }\n}\n"],"mappings":";;;AAoBA,IAAa,sBAAb,MAAuE;CACrE;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,WAAW,OAAO;EACvB,KAAK,kBAAkB,OAAO;CAChC;CAEA,MACE,OACA,OACoE;EACpE,KAAK,WAAW,OAAO,KAAK;EAC5B,OAAO,aAAa,KAAK,UAAU,KAAK;CAC1C;CAEA,SAAS,OAAqC;EAC5C,KAAK,WAAW,OAAO,WAAW;EAClC,OAAO,KAAK,gBAAgB,KAAK,CAAC,CAAC,KAAK,aAAa,EAAE,QAAQ,EAAE;CACnE;CAEA,SAAS,OAAc,OAAkD;EACvE,KAAK,WAAW,OAAO,KAAK;EAC5B,OAAO,KAAK,SAAS,SAAS,KAAK;CACrC;CAEA,WAAmB,OAAc,OAAgC;EAC/D,IAAI,MAAM,YAAY,IAAI,8BAA8B,GACtD;EAEF,IAAI,UAAU,eAAe,MAAM,YAAY,SAAS,kBAAkB,GACxE;EAEF,MAAM,IAAI,eACR,UAAU,QACN,0CACA,2DACN;CACF;AACF"}

package/dist/organizations/notification-categories.d.ts

@@ -1,6 +1,7 @@
 import { Logger } from "../types/ports.js";
 import { NotificationCategory } from "../types/notifications.js";
 import "../types/index.js";
+import { Actor } from "../shared/actor.js";
 import { ChannelRegistry, NotificationCategoryService, NotificationTypeRegistry } from "../shared/ports.js";
 import { SettingsService } from "../shared/settings.js";
 //#region src/organizations/notification-categories.d.ts
@@ -16,16 +17,17 @@ declare class OrgNotificationCategories implements NotificationCategoryService {
   private readonly channels;
   private readonly logger;
   constructor(params: OrgNotificationCategoriesParams);
-  get(orgId: string, scopeId: string): Promise<{
+  get(scopeId: string, actor: Actor): Promise<{
     categories: NotificationCategory[];
     source: 'default' | 'stored';
   }>;
-  replace(orgId: string, scopeId: string, categories: NotificationCategory[]): Promise<{
+  replace(scopeId: string, categories: NotificationCategory[], actor: Actor): Promise<{
     categories: NotificationCategory[];
     source: 'stored';
   }>;
-  reset(orgId: string, scopeId: string): Promise<void>;
-  defaults(): NotificationCategory[];
+  reset(scopeId: string, actor: Actor): Promise<void>;
+  defaults(actor: Actor): NotificationCategory[];
+  private assertOrg;
 }
 //#endregion
 export { OrgNotificationCategories, OrgNotificationCategoriesParams };

package/dist/organizations/notification-categories.js

@@ -1,3 +1,4 @@
+import { NotFoundError } from "../shared/errors.js";
 import { noopLogger } from "../shared/logger.js";
 import "../shared/settings.js";
 import { assertValidCategoryList, offeringConfigured, storedCategoryList } from "../shared/notification-categories.js";
@@ -13,23 +14,28 @@ var OrgNotificationCategories = class {
 		this.channels = params.channels;
 		this.logger = params.logger ?? noopLogger;
 	}
-	async get(orgId, scopeId) {
-		const stored = storedCategoryList((await this.settings.get(orgId, "organizations", scopeId))?.notificationCategories);
+	async get(scopeId, actor) {
+		actor.permissions.require("notification_categories:read");
+		this.assertOrg(scopeId, actor);
+		const stored = storedCategoryList((await this.settings.get(actor.orgId, "organizations", scopeId))?.notificationCategories);
 		return stored ? {
 			categories: offeringConfigured(stored, this.channels.list()),
 			source: "stored"
 		} : {
-			categories: this.defaults(),
+			categories: this.types.defaults("org"),
 			source: "default"
 		};
 	}
-	async replace(orgId, scopeId, categories) {
+	async replace(scopeId, categories, actor) {
+		actor.permissions.require("notification_categories:write");
+		this.assertOrg(scopeId, actor);
 		const configured = this.channels.list();
 		assertValidCategoryList(categories, "org", this.types, configured);
 		const ordered = offeringConfigured(categories, configured);
-		await this.settings.patch(orgId, "organizations", scopeId, { notificationCategories: ordered });
+		await this.settings.patch(actor.orgId, "organizations", scopeId, { notificationCategories: ordered });
 		this.logger.info("org notification categories replaced", {
-			orgId,
+			orgId: actor.orgId,
+			orgUserId: actor.id,
 			keys: categories.map((category) => category.key)
 		});
 		return {
@@ -37,13 +43,22 @@ var OrgNotificationCategories = class {
 			source: "stored"
 		};
 	}
-	async reset(orgId, scopeId) {
-		await this.settings.patch(orgId, "organizations", scopeId, { notificationCategories: null });
-		this.logger.info("org notification categories reset", { orgId });
+	async reset(scopeId, actor) {
+		actor.permissions.require("notification_categories:write");
+		this.assertOrg(scopeId, actor);
+		await this.settings.patch(actor.orgId, "organizations", scopeId, { notificationCategories: null });
+		this.logger.info("org notification categories reset", {
+			orgId: actor.orgId,
+			orgUserId: actor.id
+		});
 	}
-	defaults() {
+	defaults(actor) {
+		actor.permissions.require("notification_categories:read");
 		return this.types.defaults("org");
 	}
+	assertOrg(scopeId, actor) {
+		if (scopeId !== actor.orgId) throw new NotFoundError("Organization", scopeId);
+	}
 };
 //#endregion
 export { OrgNotificationCategories };

package/dist/organizations/notification-categories.js.map

@@ -1 +1 @@
-{"version":3,"file":"notification-categories.js","names":[],"sources":["../../src/organizations/notification-categories.ts"],"sourcesContent":["import type { NotificationCategory } from '../types/index.js';\nimport type {\n  ChannelRegistry,\n  Logger,\n  NotificationCategoryService,\n  NotificationTypeRegistry,\n} from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { SettingsNamespace, type SettingsService } from '../shared/settings.js';\nimport {\n  assertValidCategoryList,\n  offeringConfigured,\n  storedCategoryList,\n} from '../shared/notification-categories.js';\n\nexport type OrgNotificationCategoriesParams = {\n  settings: SettingsService;\n  types: NotificationTypeRegistry;\n  channels: ChannelRegistry;\n  logger?: Logger;\n};\n\nexport class OrgNotificationCategories implements NotificationCategoryService {\n  private readonly settings: SettingsService;\n  private readonly types: NotificationTypeRegistry;\n  private readonly channels: ChannelRegistry;\n  private readonly logger: Logger;\n\n  constructor(params: OrgNotificationCategoriesParams) {\n    this.settings = params.settings;\n    this.types = params.types;\n    this.channels = params.channels;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  async get(\n    orgId: string,\n    scopeId: string,\n  ): Promise<{ categories: NotificationCategory[]; source: 'default' | 'stored' }> {\n    const value = await this.settings.get<Record<string, unknown>>(\n      orgId,\n      SettingsNamespace.organizations,\n      scopeId,\n    );\n    const stored = storedCategoryList(value?.notificationCategories);\n    return stored\n      ? { categories: offeringConfigured(stored, this.channels.list()), source: 'stored' }\n      : { categories: this.defaults(), source: 'default' };\n  }\n\n  async replace(\n    orgId: string,\n    scopeId: string,\n    categories: NotificationCategory[],\n  ): Promise<{ categories: NotificationCategory[]; source: 'stored' }> {\n    const configured = this.channels.list();\n    assertValidCategoryList(categories, 'org', this.types, configured);\n    const ordered = offeringConfigured(categories, configured);\n    await this.settings.patch(orgId, SettingsNamespace.organizations, scopeId, {\n      notificationCategories: ordered,\n    });\n    this.logger.info('org notification categories replaced', {\n      orgId,\n      keys: categories.map((category) => category.key),\n    });\n    return { categories: ordered, source: 'stored' };\n  }\n\n  async reset(orgId: string, scopeId: string): Promise<void> {\n    await this.settings.patch(orgId, SettingsNamespace.organizations, scopeId, {\n      notificationCategories: null,\n    });\n    this.logger.info('org notification categories reset', { orgId });\n  }\n\n  defaults(): NotificationCategory[] {\n    return this.types.defaults('org');\n  }\n}\n"],"mappings":";;;;AAsBA,IAAa,4BAAb,MAA8E;CAC5E;CACA;CACA;CACA;CAEA,YAAY,QAAyC;EACnD,KAAK,WAAW,OAAO;EACvB,KAAK,QAAQ,OAAO;EACpB,KAAK,WAAW,OAAO;EACvB,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,MAAM,IACJ,OACA,SAC+E;EAM/E,MAAM,SAAS,oBAAmB,MALd,KAAK,SAAS,IAChC,OAAA,iBAEA,OACF,EAAA,EACyC,sBAAsB;EAC/D,OAAO,SACH;GAAE,YAAY,mBAAmB,QAAQ,KAAK,SAAS,KAAK,CAAC;GAAG,QAAQ;EAAS,IACjF;GAAE,YAAY,KAAK,SAAS;GAAG,QAAQ;EAAU;CACvD;CAEA,MAAM,QACJ,OACA,SACA,YACmE;EACnE,MAAM,aAAa,KAAK,SAAS,KAAK;EACtC,wBAAwB,YAAY,OAAO,KAAK,OAAO,UAAU;EACjE,MAAM,UAAU,mBAAmB,YAAY,UAAU;EACzD,MAAM,KAAK,SAAS,MAAM,OAAA,iBAAwC,SAAS,EACzE,wBAAwB,QAC1B,CAAC;EACD,KAAK,OAAO,KAAK,wCAAwC;GACvD;GACA,MAAM,WAAW,KAAK,aAAa,SAAS,GAAG;EACjD,CAAC;EACD,OAAO;GAAE,YAAY;GAAS,QAAQ;EAAS;CACjD;CAEA,MAAM,MAAM,OAAe,SAAgC;EACzD,MAAM,KAAK,SAAS,MAAM,OAAA,iBAAwC,SAAS,EACzE,wBAAwB,KAC1B,CAAC;EACD,KAAK,OAAO,KAAK,qCAAqC,EAAE,MAAM,CAAC;CACjE;CAEA,WAAmC;EACjC,OAAO,KAAK,MAAM,SAAS,KAAK;CAClC;AACF"}
+{"version":3,"file":"notification-categories.js","names":[],"sources":["../../src/organizations/notification-categories.ts"],"sourcesContent":["import type { NotificationCategory } from '../types/index.js';\nimport type {\n  ChannelRegistry,\n  Logger,\n  NotificationCategoryService,\n  NotificationTypeRegistry,\n} from '../shared/ports.js';\nimport type { Actor } from '../shared/actor.js';\nimport { NotFoundError } from '../shared/errors.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { SettingsNamespace, type SettingsService } from '../shared/settings.js';\nimport {\n  assertValidCategoryList,\n  offeringConfigured,\n  storedCategoryList,\n} from '../shared/notification-categories.js';\n\nexport type OrgNotificationCategoriesParams = {\n  settings: SettingsService;\n  types: NotificationTypeRegistry;\n  channels: ChannelRegistry;\n  logger?: Logger;\n};\n\nexport class OrgNotificationCategories implements NotificationCategoryService {\n  private readonly settings: SettingsService;\n  private readonly types: NotificationTypeRegistry;\n  private readonly channels: ChannelRegistry;\n  private readonly logger: Logger;\n\n  constructor(params: OrgNotificationCategoriesParams) {\n    this.settings = params.settings;\n    this.types = params.types;\n    this.channels = params.channels;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  async get(\n    scopeId: string,\n    actor: Actor,\n  ): Promise<{ categories: NotificationCategory[]; source: 'default' | 'stored' }> {\n    actor.permissions.require('notification_categories:read');\n    this.assertOrg(scopeId, actor);\n    const value = await this.settings.get<Record<string, unknown>>(\n      actor.orgId,\n      SettingsNamespace.organizations,\n      scopeId,\n    );\n    const stored = storedCategoryList(value?.notificationCategories);\n    return stored\n      ? { categories: offeringConfigured(stored, this.channels.list()), source: 'stored' }\n      : { categories: this.types.defaults('org'), source: 'default' };\n  }\n\n  async replace(\n    scopeId: string,\n    categories: NotificationCategory[],\n    actor: Actor,\n  ): Promise<{ categories: NotificationCategory[]; source: 'stored' }> {\n    actor.permissions.require('notification_categories:write');\n    this.assertOrg(scopeId, actor);\n    const configured = this.channels.list();\n    assertValidCategoryList(categories, 'org', this.types, configured);\n    const ordered = offeringConfigured(categories, configured);\n    await this.settings.patch(actor.orgId, SettingsNamespace.organizations, scopeId, {\n      notificationCategories: ordered,\n    });\n    this.logger.info('org notification categories replaced', {\n      orgId: actor.orgId,\n      orgUserId: actor.id,\n      keys: categories.map((category) => category.key),\n    });\n    return { categories: ordered, source: 'stored' };\n  }\n\n  async reset(scopeId: string, actor: Actor): Promise<void> {\n    actor.permissions.require('notification_categories:write');\n    this.assertOrg(scopeId, actor);\n    await this.settings.patch(actor.orgId, SettingsNamespace.organizations, scopeId, {\n      notificationCategories: null,\n    });\n    this.logger.info('org notification categories reset', {\n      orgId: actor.orgId,\n      orgUserId: actor.id,\n    });\n  }\n\n  defaults(actor: Actor): NotificationCategory[] {\n    actor.permissions.require('notification_categories:read');\n    return this.types.defaults('org');\n  }\n\n  private assertOrg(scopeId: string, actor: Actor): void {\n    if (scopeId !== actor.orgId) {\n      throw new NotFoundError('Organization', scopeId);\n    }\n  }\n}\n"],"mappings":";;;;;AAwBA,IAAa,4BAAb,MAA8E;CAC5E;CACA;CACA;CACA;CAEA,YAAY,QAAyC;EACnD,KAAK,WAAW,OAAO;EACvB,KAAK,QAAQ,OAAO;EACpB,KAAK,WAAW,OAAO;EACvB,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,MAAM,IACJ,SACA,OAC+E;EAC/E,MAAM,YAAY,QAAQ,8BAA8B;EACxD,KAAK,UAAU,SAAS,KAAK;EAM7B,MAAM,SAAS,oBAAmB,MALd,KAAK,SAAS,IAChC,MAAM,OAAA,iBAEN,OACF,EAAA,EACyC,sBAAsB;EAC/D,OAAO,SACH;GAAE,YAAY,mBAAmB,QAAQ,KAAK,SAAS,KAAK,CAAC;GAAG,QAAQ;EAAS,IACjF;GAAE,YAAY,KAAK,MAAM,SAAS,KAAK;GAAG,QAAQ;EAAU;CAClE;CAEA,MAAM,QACJ,SACA,YACA,OACmE;EACnE,MAAM,YAAY,QAAQ,+BAA+B;EACzD,KAAK,UAAU,SAAS,KAAK;EAC7B,MAAM,aAAa,KAAK,SAAS,KAAK;EACtC,wBAAwB,YAAY,OAAO,KAAK,OAAO,UAAU;EACjE,MAAM,UAAU,mBAAmB,YAAY,UAAU;EACzD,MAAM,KAAK,SAAS,MAAM,MAAM,OAAA,iBAAwC,SAAS,EAC/E,wBAAwB,QAC1B,CAAC;EACD,KAAK,OAAO,KAAK,wCAAwC;GACvD,OAAO,MAAM;GACb,WAAW,MAAM;GACjB,MAAM,WAAW,KAAK,aAAa,SAAS,GAAG;EACjD,CAAC;EACD,OAAO;GAAE,YAAY;GAAS,QAAQ;EAAS;CACjD;CAEA,MAAM,MAAM,SAAiB,OAA6B;EACxD,MAAM,YAAY,QAAQ,+BAA+B;EACzD,KAAK,UAAU,SAAS,KAAK;EAC7B,MAAM,KAAK,SAAS,MAAM,MAAM,OAAA,iBAAwC,SAAS,EAC/E,wBAAwB,KAC1B,CAAC;EACD,KAAK,OAAO,KAAK,qCAAqC;GACpD,OAAO,MAAM;GACb,WAAW,MAAM;EACnB,CAAC;CACH;CAEA,SAAS,OAAsC;EAC7C,MAAM,YAAY,QAAQ,8BAA8B;EACxD,OAAO,KAAK,MAAM,SAAS,KAAK;CAClC;CAEA,UAAkB,SAAiB,OAAoB;EACrD,IAAI,YAAY,MAAM,OACpB,MAAM,IAAI,cAAc,gBAAgB,OAAO;CAEnD;AACF"}

package/dist/organizations/org-roles.d.ts

@@ -0,0 +1,33 @@
+import { Level, Permission } from "../types/schemas/organizations.js";
+import "../types/index.js";
+import { RoleDefinition } from "./default-roles.js";
+//#region src/organizations/org-roles.d.ts
+interface StoredOrgRole {
+  key: string;
+  name: string | null;
+  description: string | null;
+  base: string;
+  levels: Level[] | null;
+  permissions: Partial<Record<Permission, boolean>>;
+  team: boolean | null;
+}
+interface OrgRole {
+  key: string;
+  name: string;
+  description: string;
+  base: string;
+  levels: Level[];
+  team: boolean;
+  permissions: Permission[];
+  system: boolean;
+  added: boolean;
+  customized: boolean;
+}
+type RoleCatalog = ReadonlyMap<string, RoleDefinition>;
+declare function catalogOf(roles: readonly RoleDefinition[]): RoleCatalog;
+declare function isSystemRole(key: string): boolean;
+declare function resolveRole(key: string, catalog: RoleCatalog, stored: StoredOrgRole | undefined): OrgRole | null;
+declare function resolveOrgRoles(catalog: RoleCatalog, stored: readonly StoredOrgRole[]): OrgRole[];
+//#endregion
+export { OrgRole, RoleCatalog, StoredOrgRole, catalogOf, isSystemRole, resolveOrgRoles, resolveRole };
+//# sourceMappingURL=org-roles.d.ts.map