@headless-lms/core 0.4.0 → 0.6.0

package/dist/organizations/ports.d.ts

@@ -1,46 +1,155 @@
-import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, InviteRole, NewOrganizationInput, OrgUser, Organization, Role, UpdateOrgUserInput } from "../types/schemas/organizations.js";
+import { ContentType } from "../types/schemas/content.js";
+import { ApiKeySummary, ConnectedApp, CreatedApiKey } from "../types/identity.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, NewOrganizationInput, OrgUser, OrgUserProfile, Organization, OrganizationMetadata, Permission, RoleAssignment, UpdateOrgUserInput } from "../types/schemas/organizations.js";
+import "../types/index.js";
+import { Actor, EffectivePermissions } from "../shared/actor.js";
 import { OutboxAppender, UnitOfWork } from "../shared/ports.js";
-import { Actor } from "../shared/actor.js";
-import "./model.js";
-import "./roles.js";
-import { Member, MemberRoleChange, MembersQuery, Page } from "./members.js";
-import { CreateOrganizationInput, ResendStudentInviteInput, UpdateOrganizationInput } from "./types.js";
 import { AuthHeaders } from "../identity/ports.js";
 import "../identity/index.js";
+import { StoredOrgRole } from "./org-roles.js";
+import { AssignmentRow } from "./effective-permissions.js";
+import "./model.js";
+import { AssignmentView, CreateRoleInput, InviteDetails, Member, MembersQuery, Page, RoleView, UpdateRoleInput, ViewerPermissions } from "./members.js";
+import { PermissionListEntry } from "./permissions.js";
+import { CreateOrganizationInput, UpdateOrganizationInput } from "./types.js";
 //#region src/organizations/ports.d.ts
+interface TransferOwnershipInput {
+  newOwnerOrgUserId: string;
+  previousOwnerRoleKey?: string | undefined;
+}
+interface CreateApiKeyInput {
+  name: string;
+  role: string;
+  expiresInDays?: number | undefined;
+}
+interface ApiKeyRole {
+  key: string;
+  name: string;
+  description: string;
+}
+type CallerLimit = {
+  scopes: readonly Permission[];
+} | {
+  roleKey: string;
+};
+interface PlatformOrganizationInput {
+  name: string;
+  slug: string;
+  metadata?: OrganizationMetadata | undefined;
+}
+interface PlatformOrganization {
+  organization: AuthOrganization & {
+    metadata: OrganizationMetadata;
+  };
+  apiKey: CreatedApiKey;
+}
+interface PlatformAccount {
+  email: string;
+  name: string;
+}
 interface OrganizationService {
-  createOrganization(input: CreateOrganizationInput): Promise<Organization>;
-  updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization>;
+  createOrganization(input: NewOrganizationInput, headers: AuthHeaders): Promise<AuthOrganization>;
+  provisionOrganization(input: CreateOrganizationInput): Promise<Organization>;
+  updateOrganization(input: UpdateOrganizationInput, actor: Actor): Promise<Organization>;
   deleteOrganization(id: string): Promise<Organization>;
   addOrgUser(input: AddOrgUserInput): Promise<OrgUser>;
-  removeOrgUser(orgId: string, userId: string): Promise<OrgUser>;
-  updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser>;
+  removeOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
   getByExternalId(externalId: string): Promise<Organization | null>;
+  getBySlug(slug: string): Promise<Organization | null>;
+  getById(id: string): Promise<Organization | null>;
+  portalIdentity(id: string): Promise<Pick<Organization, 'id' | 'name' | 'slug'>>;
   getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
   getOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
   getOrgUsersByIds(orgId: string, ids: string[]): Promise<OrgUser[]>;
   getOrgUsersForUser(userId: string): Promise<OrgUser[]>;
-  getById(id: string): Promise<Organization | null>;
   orgIds(): Promise<string[]>;
-  createInvite(actor: Actor, input: CreateInviteInput): Promise<Invite>;
+  actorFor(orgId: string, orgUserId: string, limit?: CallerLimit): Promise<Actor | null>;
+  resolveCaller(authOrgId: string, authUserId: string, limit?: CallerLimit): Promise<ResolvedCaller | null>;
+  systemActor(orgId: string): Actor;
+  permissionsOfMany(orgId: string, orgUserIds: string[]): Promise<Map<string, EffectivePermissions>>;
+  holders(orgId: string, permission: Permission, on?: string): Promise<string[]>;
+  permissionList(): PermissionListEntry[];
+  viewerPermissions(actor: Actor): ViewerPermissions;
+  auditRoleKeys(): Promise<number>;
+  listRoles(actor: Actor): Promise<RoleView[]>;
+  getRole(key: string, actor: Actor): Promise<RoleView>;
+  updateRole(key: string, input: UpdateRoleInput, actor: Actor): Promise<RoleView>;
+  createRole(input: CreateRoleInput, actor: Actor): Promise<RoleView>;
+  resetRole(key: string, actor: Actor): Promise<RoleView>;
+  deleteRole(key: string, actor: Actor): Promise<void>;
+  listTeam(query: MembersQuery, actor: Actor): Promise<Page<Member>>;
+  listAssignments(orgUserId: string, actor: Actor): Promise<AssignmentView[]>;
+  listAssignmentsOn(contentId: string, actor: Actor): Promise<AssignmentView[]>;
+  setOrgRole(orgUserId: string, roleKey: string, actor: Actor): Promise<AssignmentView[]>;
+  assignRole(orgUserId: string, contentId: string, roleKey: string, actor: Actor): Promise<AssignmentView[]>;
+  unassignRole(orgUserId: string, contentId: string, actor: Actor): Promise<AssignmentView[]>;
+  removePerson(orgUserId: string, actor: Actor): Promise<void>;
+  transferOwnership(input: TransferOwnershipInput, actor: Actor): Promise<void>;
+  createInvite(input: CreateInviteInput, actor: Actor, inviterUserId: string): Promise<Invite>;
+  resendInvite(orgUserId: string, actor: Actor, inviterUserId: string): Promise<void>;
+  cancelInvite(orgUserId: string, actor: Actor): Promise<void>;
   peekInvite(token: string): Promise<Invite | null>;
-  acceptInvite(input: AcceptInviteInput): Promise<OrgUser>;
-  deleteOrgUser(orgId: string, actor: Actor, id: string): Promise<OrgUser>;
-  resendStudentInvite(actor: Actor, input: ResendStudentInviteInput): Promise<void>;
-  getBySlug(slug: string): Promise<Organization | null>;
-  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>>;
-  updateMemberRole(ctx: MemberWriteContext, actor: Actor, id: string, role: Role): Promise<MemberRoleChange | null>;
-  removeMember(ctx: MemberWriteContext, actor: Actor, id: string): Promise<boolean>;
-  staffOrgUserIds(orgId: string): Promise<string[]>;
+  describeInvite(token: string): Promise<InviteDetails>;
+  acceptInvite(input: AcceptInviteInput, headers: AuthHeaders): Promise<OrgUser>;
+  listApiKeys(actor: Actor): Promise<ApiKeySummary[]>;
+  listApiKeyRoles(actor: Actor): Promise<ApiKeyRole[]>;
+  createApiKey(input: CreateApiKeyInput, actor: Actor): Promise<CreatedApiKey>;
+  deleteApiKey(keyId: string, actor: Actor): Promise<void>;
+  listConnectedApps(actor: Actor): Promise<ConnectedApp[]>;
+  revokeConnectedApp(clientId: string, actor: Actor): Promise<void>;
+  createPlatformOrganization(input: PlatformOrganizationInput): Promise<PlatformOrganization>;
+  createPlatformApiKey(orgId: string, name: string): Promise<CreatedApiKey>;
+  isPlatformAccount(email: string): boolean;
+}
+interface ActorFacts {
+  orgUserId: string;
+  status: OrgUser['status'];
+  assignments: AssignmentRow[];
+  storedRoles: StoredOrgRole[];
+}
+interface CallerFacts {
+  orgId: string;
+  userId: string | null;
+  orgUser: ActorFacts | null;
+}
+interface ResolvedCaller {
+  orgId: string;
+  userId: string | null;
+  orgUserId: string | null;
+  actor: Actor | null;
+}
+interface RolesRepository {
+  actorFacts(orgId: string, orgUserId: string): Promise<ActorFacts | null>;
+  callerFacts(authOrgId: string, authUserId: string): Promise<CallerFacts | null>;
+  storedRoles(orgId: string): Promise<StoredOrgRole[]>;
+  saveStoredRole(orgId: string, role: StoredOrgRole): Promise<void>;
+  deleteStoredRole(orgId: string, key: string): Promise<boolean>;
+  assignmentsOf(orgId: string, orgUserId: string): Promise<RoleAssignment[]>;
+  assignmentsOfMany(orgId: string, orgUserIds: string[]): Promise<Map<string, AssignmentRow[]>>;
+  assignmentsOn(orgId: string, contentId: string): Promise<RoleAssignment[]>;
+  holdersOf(orgId: string, roleKeys: string[], contentId?: string): Promise<string[]>;
+  setOrgRole(orgId: string, orgUserId: string, roleKey: string | null, assignedBy: string): Promise<void>;
+  setItemRole(orgId: string, orgUserId: string, contentId: string, contentType: ContentType, roleKey: string, assignedBy: string): Promise<void>;
+  removeItemRole(orgId: string, orgUserId: string, contentId: string): Promise<RoleAssignment | null>;
+  countHolders(orgId: string, roleKey: string, contentType?: ContentType | 'org'): Promise<number>;
+  holderCounts(orgId: string): Promise<Record<string, number>>;
+  contentTypeOf(orgId: string, contentId: string): Promise<ContentType | null>;
+  ownerOrgUserId(orgId: string): Promise<string | null>;
+  roleKeyUsage(): Promise<{
+    orgId: string;
+    roleKey: string;
+    level: string;
+    count: number;
+    stored: boolean;
+  }[]>;
+  lock(keys: string[]): Promise<void>;
 }
-/** Atomic write scope: tx-bound repo + outbox appender, one transaction. */
 interface OrganizationsWriteScope {
   organizations: OrganizationsRepository;
+  roles: RolesRepository;
   outbox: OutboxAppender;
 }
 type OrganizationsUnitOfWork = UnitOfWork<OrganizationsWriteScope>;
-/** Repo-facing write shape for a new org row. The service mints the id and
- *  resolves the defaults, so nothing is optional by the time it lands here. */
 interface NewOrganizationRow {
   id: string;
   externalId?: string | null;
@@ -48,10 +157,9 @@ interface NewOrganizationRow {
   slug: string;
   ownerId: string;
 }
-/** Repo-facing write shape for a freshly minted invite. */
 interface NewInviteRow {
   email: string;
-  role: InviteRole;
+  roleKey: string;
   invitedBy: string;
   tokenHash: string;
   expiresAt: Date;
@@ -59,71 +167,85 @@ interface NewInviteRow {
 interface OrganizationsRepository {
   create(input: NewOrganizationRow): Promise<Organization>;
   update(id: string, input: UpdateOrganizationInput): Promise<Organization | null>;
-  /** Drops the org row and its dependents; null when none matched. */
   delete(id: string): Promise<Organization>;
   findById(id: string): Promise<Organization | null>;
   listIds(): Promise<string[]>;
   findByExternalId(externalId: string): Promise<Organization | null>;
   findBySlug(slug: string): Promise<Organization | null>;
-  /** Inserts a pending invite, or re-issues the org's existing pending one
-   *  for this email (fresh token/expiry/role) — atomic upsert. */
+  setMetadata(id: string, metadata: OrganizationMetadata): Promise<Organization>;
   upsertPendingInvite(orgId: string, input: NewInviteRow): Promise<Invite>;
   setInviteStatus(orgId: string, id: string, status: string): Promise<Invite | null>;
+  setInviteRole(orgId: string, id: string, roleKey: string, invitedBy: string): Promise<Invite | null>;
   findInviteByTokenHash(tokenHash: string): Promise<Invite | null>;
   findPendingInvite(orgId: string, email: string): Promise<Invite | null>;
-  setInviteToken(orgId: string, id: string, tokenHash: string, expiresAt: Date): Promise<Invite | null>;
-  /** The person's row in one org. `(org_id, user_id)` is unique. */
+  setInviteToken(orgId: string, id: string, tokenHash: string, expiresAt: Date, invitedBy: string): Promise<Invite | null>;
   findOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
-  /** Every org this person belongs to, oldest first. */
   findOrgUsersByUser(userId: string): Promise<OrgUser[]>;
   findOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
   findOrgUsersByIds(orgId: string, ids: string[]): Promise<OrgUser[]>;
-  findOrgUserIdsByRole(orgId: string, roles: Role[]): Promise<string[]>;
-  /** Links a user to the org under a role. Throws ConflictError when they
-   *  already hold a row there. */
   createOrgUser(input: CreateOrgUserInput): Promise<OrgUser>;
   updateOrgUser(orgId: string, id: string, patch: UpdateOrgUserInput): Promise<OrgUser | null>;
-  /** Every org this person is a student in — the scope of `student.linked`. */
-  findStudentOrgUsers(userId: string): Promise<OrgUser[]>;
-  /** Kills the org's pending invite for an address, if any. */
   deleteOrgUser(orgId: string, id: string): Promise<OrgUser | null>;
 }
-/** A member row enriched with the ids needed to drive writes. */
-interface MemberRecord extends Member {
-  kind: 'member' | 'invite';
-  userExternalId: string | null;
-  inviteId: string | null;
-}
-interface MembersRepository {
-  list(orgId: string, query: MembersQuery): Promise<Page<Member>>;
-  findByEmail(orgId: string, email: string): Promise<MemberRecord | null>;
-  findById(orgId: string, id: string): Promise<MemberRecord | null>;
+interface GrantReader {
+  holdsAnyGrant(orgId: string, orgUserId: string): Promise<boolean>;
 }
-/** The person as this context reads them back after a correction. */
-interface PersonRecord {
-  id: string;
-  email: string;
-  firstName: string | null;
-  lastName: string | null;
+interface TeamRow extends OrgUserProfile {
+  status: OrgUser['status'];
+  joinedAt: Date;
+  invitedAt: Date | null;
+  orgRoleKey: string | null;
+  inviteRoleKey: string | null;
+  items: {
+    contentId: string;
+    contentType: ContentType;
+    roleKey: string;
+  }[];
 }
-/** Context for a write: domain org (reads/rules) + auth org & session (writes). */
-interface MemberWriteContext {
-  orgId: string;
-  authOrgId: string;
-  headers: Record<string, string | string[] | undefined>;
+interface MembersRepository {
+  teamRows(orgId: string, memberRoleKey: string): Promise<TeamRow[]>;
 }
-/** The provider's view of an org: what it stores itself, minus the fields only
- *  the domain row carries (`ownerId`, `externalId`, `updatedAt`). */
 type AuthOrganization = Pick<Organization, 'id' | 'name' | 'slug' | 'createdAt'>;
 interface OrgAdmin {
   createOrganization(headers: AuthHeaders, input: NewOrganizationInput): Promise<AuthOrganization>;
+  createOrganizationFor(ownerExternalId: string, input: NewOrganizationInput): Promise<AuthOrganization>;
   setActiveOrganization(headers: AuthHeaders, externalId: string): Promise<void>;
-  updateOrganization(headers: AuthHeaders, id: string, input: UpdateOrganizationInput): Promise<AuthOrganization>;
   deleteOrganization(headers: AuthHeaders, externalId: string): Promise<void>;
-  grantMembership(orgExternalId: string, userExternalId: string, role: string): Promise<void>;
-  updateRole(ctx: MemberWriteContext, userExternalId: string, role: Role): Promise<void>;
-  removeMember(ctx: MemberWriteContext, userExternalId: string): Promise<void>;
+  updateOrganization(externalId: string, input: UpdateOrganizationInput): Promise<void>;
+  grantMembership(orgExternalId: string, userExternalId: string): Promise<void>;
+  setMembershipOwner(orgExternalId: string, userExternalId: string, owner: boolean): Promise<void>;
+  removeMembership(orgExternalId: string, userExternalId: string): Promise<void>;
+}
+interface Accounts {
+  createAccount(input: PlatformAccount): Promise<{
+    externalId: string;
+  }>;
+}
+interface StoredApiKey {
+  id: string;
+  name: string | null;
+  start: string | null;
+  roleKey: string | null;
+  createdAt: Date;
+  lastUsedAt: Date | null;
+  expiresAt: Date | null;
+}
+interface NewApiKey {
+  name: string;
+  roleKey: string;
+  expiresInDays?: number | undefined;
+}
+interface ApiKeys {
+  list(orgId: string, userExternalId: string): Promise<StoredApiKey[]>;
+  create(orgId: string, userExternalId: string, input: NewApiKey): Promise<StoredApiKey & {
+    key: string;
+  }>;
+  countWithRole(orgId: string, roleKey: string): Promise<number>;
+  revoke(orgId: string, userExternalId: string, keyId: string): Promise<void>;
+  listApps(orgId: string, userExternalId: string): Promise<ConnectedApp[]>;
+  revokeApp(orgId: string, userExternalId: string, clientId: string): Promise<void>;
+  revokeAllFor(orgId: string, userExternalId: string): Promise<void>;
 }
 //#endregion
-export { type AuthHeaders, AuthOrganization, MemberRecord, MemberWriteContext, MembersRepository, NewInviteRow, NewOrganizationRow, OrgAdmin, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork, OrganizationsWriteScope, PersonRecord };
+export { Accounts, ActorFacts, ApiKeyRole, ApiKeys, type AuthHeaders, AuthOrganization, CallerFacts, CallerLimit, CreateApiKeyInput, GrantReader, MembersRepository, NewApiKey, NewInviteRow, NewOrganizationRow, OrgAdmin, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork, OrganizationsWriteScope, PlatformAccount, PlatformOrganization, PlatformOrganizationInput, ResolvedCaller, RolesRepository, StoredApiKey, TeamRow, TransferOwnershipInput };
 //# sourceMappingURL=ports.d.ts.map

package/dist/organizations/service.d.ts

@@ -1,15 +1,20 @@
 import { Logger } from "../types/ports.js";
-import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, Invite, OrgUser, Organization, Role, UpdateOrgUserInput } from "../types/schemas/organizations.js";
+import { ApiKeySummary, ConnectedApp, CreatedApiKey } from "../types/identity.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, Invite, NewOrganizationInput, OrgUser, Organization, Permission } from "../types/schemas/organizations.js";
+import "../types/index.js";
+import { Actor, EffectivePermissions } from "../shared/actor.js";
 import "../shared/ports.js";
-import { Actor } from "../shared/actor.js";
-import "./model.js";
-import "./roles.js";
-import { Member, MemberRoleChange, MembersQuery, Page } from "./members.js";
-import { CreateOrganizationInput, ResendStudentInviteInput, UpdateOrganizationInput } from "./types.js";
-import { IdentityService } from "../identity/ports.js";
+import { AssetFiles } from "../assets/ports.js";
+import "../assets/index.js";
 import { Mailer } from "../shared/mailer.js";
+import { AuthHeaders, IdentityService, SessionAdmin } from "../identity/ports.js";
 import "../identity/index.js";
-import { MemberWriteContext, MembersRepository, OrgAdmin, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork } from "./ports.js";
+import { RoleDefinition } from "./default-roles.js";
+import "./model.js";
+import { AssignmentView, CreateRoleInput, InviteDetails, Member, MembersQuery, Page, RoleView, UpdateRoleInput, ViewerPermissions } from "./members.js";
+import { PermissionListEntry } from "./permissions.js";
+import { CreateOrganizationInput, UpdateOrganizationInput } from "./types.js";
+import { Accounts, ApiKeyRole, ApiKeys, AuthOrganization, CallerLimit, CreateApiKeyInput, GrantReader, MembersRepository, OrgAdmin, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork, PlatformAccount, PlatformOrganization, PlatformOrganizationInput, ResolvedCaller, RolesRepository, TransferOwnershipInput } from "./ports.js";
 //#region src/organizations/service.d.ts
 interface InviteUrls {
   studentPortalUrl: string;
@@ -17,57 +22,119 @@ interface InviteUrls {
 }
 type OrganizationServiceParams = {
   repo: OrganizationsRepository;
+  roles: RolesRepository;
   membersRepo: MembersRepository;
   people: IdentityService;
+  images: Pick<AssetFiles, 'syncPublicImages'>;
   uow: OrganizationsUnitOfWork;
   orgAdmin: () => OrgAdmin;
+  sessions: () => SessionAdmin;
+  apiKeys?: () => ApiKeys;
+  accounts?: () => Accounts;
+  platform?: PlatformAccount;
+  grants?: () => GrantReader;
+  defaultRoles?: readonly RoleDefinition[];
   logger?: Logger;
   mailer?: Pick<Mailer, 'send'>;
   inviteUrls?: InviteUrls;
 };
 declare class OrganizationServiceImpl implements OrganizationService {
   private readonly repo;
+  private readonly roles;
   private readonly membersRepo;
   private readonly people;
+  private readonly images;
   private readonly uow;
   private readonly orgAdmin;
+  private readonly sessions;
+  private readonly apiKeysPort?;
+  private readonly accountsPort?;
+  private readonly platform?;
+  private readonly grants?;
+  private readonly catalog;
   private readonly logger;
   private readonly mailer?;
   private readonly inviteUrls?;
-  private readonly memberWrites;
   constructor(params: OrganizationServiceParams);
-  createOrganization(input: CreateOrganizationInput): Promise<Organization>;
-  updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization>;
+  createOrganization(input: NewOrganizationInput, headers: AuthHeaders): Promise<AuthOrganization>;
+  provisionOrganization(input: CreateOrganizationInput): Promise<Organization>;
+  updateOrganization(input: UpdateOrganizationInput, actor: Actor): Promise<Organization>;
   deleteOrganization(id: string): Promise<Organization>;
-  addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser>;
-  removeOrgUser(orgId: string, userId: string): Promise<OrgUser>;
-  updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser>;
-  createInvite(actor: Actor, input: CreateInviteInput): Promise<Invite>;
-  resendStudentInvite(actor: Actor, input: ResendStudentInviteInput): Promise<void>;
-  peekInvite(token: string): Promise<Invite | null>;
-  acceptInvite(input: AcceptInviteInput): Promise<OrgUser>;
-  private acceptStudentInvite;
-  private acceptStaffInvite;
+  addOrgUser({ orgId, userId }: AddOrgUserInput): Promise<OrgUser>;
+  removeOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
+  getByExternalId(externalId: string): Promise<Organization | null>;
+  getBySlug(slug: string): Promise<Organization | null>;
+  getById(id: string): Promise<Organization | null>;
+  portalIdentity(id: string): Promise<Pick<Organization, 'id' | 'name' | 'slug'>>;
+  getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
   getOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
   getOrgUsersByIds(orgId: string, ids: string[]): Promise<OrgUser[]>;
-  getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
-  deleteOrgUser(orgId: string, actor: Actor, id: string): Promise<OrgUser>;
   getOrgUsersForUser(userId: string): Promise<OrgUser[]>;
-  getById(id: string): Promise<Organization | null>;
   orgIds(): Promise<string[]>;
+  actorFor(orgId: string, orgUserId: string, limit?: CallerLimit): Promise<Actor | null>;
+  resolveCaller(authOrgId: string, authUserId: string, limit?: CallerLimit): Promise<ResolvedCaller | null>;
+  systemActor(orgId: string): Actor;
+  permissionsOfMany(orgId: string, orgUserIds: string[]): Promise<Map<string, EffectivePermissions>>;
+  holders(orgId: string, permission: Permission, on?: string): Promise<string[]>;
+  permissionList(): PermissionListEntry[];
+  viewerPermissions(actor: Actor): ViewerPermissions;
+  auditRoleKeys(): Promise<number>;
+  listRoles(actor: Actor): Promise<RoleView[]>;
+  getRole(key: string, actor: Actor): Promise<RoleView>;
+  updateRole(key: string, input: UpdateRoleInput, actor: Actor): Promise<RoleView>;
+  createRole(input: CreateRoleInput, actor: Actor): Promise<RoleView>;
+  resetRole(key: string, actor: Actor): Promise<RoleView>;
+  deleteRole(key: string, actor: Actor): Promise<void>;
+  listTeam(query: MembersQuery, actor: Actor): Promise<Page<Member>>;
+  listAssignments(orgUserId: string, actor: Actor): Promise<AssignmentView[]>;
+  listAssignmentsOn(contentId: string, actor: Actor): Promise<AssignmentView[]>;
+  setOrgRole(orgUserId: string, roleKey: string, actor: Actor): Promise<AssignmentView[]>;
+  assignRole(orgUserId: string, contentId: string, roleKey: string, actor: Actor): Promise<AssignmentView[]>;
+  unassignRole(orgUserId: string, contentId: string, actor: Actor): Promise<AssignmentView[]>;
+  removePerson(orgUserId: string, actor: Actor): Promise<void>;
+  transferOwnership(input: TransferOwnershipInput, actor: Actor): Promise<void>;
+  createInvite(input: CreateInviteInput, actor: Actor, inviterUserId: string): Promise<Invite>;
+  resendInvite(orgUserId: string, actor: Actor, inviterUserId: string): Promise<void>;
+  cancelInvite(orgUserId: string, actor: Actor): Promise<void>;
+  peekInvite(token: string): Promise<Invite | null>;
+  describeInvite(token: string): Promise<InviteDetails>;
+  acceptInvite(input: AcceptInviteInput, headers: AuthHeaders): Promise<OrgUser>;
+  private checkAcceptance;
+  listApiKeys(actor: Actor): Promise<ApiKeySummary[]>;
+  listApiKeyRoles(actor: Actor): Promise<ApiKeyRole[]>;
+  createApiKey(input: CreateApiKeyInput, actor: Actor): Promise<CreatedApiKey>;
+  deleteApiKey(keyId: string, actor: Actor): Promise<void>;
+  listConnectedApps(actor: Actor): Promise<ConnectedApp[]>;
+  revokeConnectedApp(clientId: string, actor: Actor): Promise<void>;
+  createPlatformOrganization(input: PlatformOrganizationInput): Promise<PlatformOrganization>;
+  createPlatformApiKey(orgId: string, name: string): Promise<CreatedApiKey>;
+  isPlatformAccount(email: string): boolean;
+  private platformKey;
+  private platformAccountId;
+  private platformAccount;
+  private accounts;
+  private keysWithRole;
+  private cleanUpAfterRemoval;
+  private apiKeys;
+  private externalIdsOf;
+  private pendingInviteOf;
+  private deleteOrgUserRow;
+  private deleteOrgUserIn;
   private sendInviteEmail;
-  getByExternalId(externalId: string): Promise<Organization | null>;
-  getBySlug(slug: string): Promise<Organization | null>;
-  staffOrgUserIds(orgId: string): Promise<string[]>;
-  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>>;
-  updateMemberRole(ctx: MemberWriteContext, actor: Actor, id: string, role: Role): Promise<MemberRoleChange | null>;
-  private demoteModerator;
-  private promoteStudent;
-  private asActor;
-  private memberWrite;
-  private assertManagesUsers;
-  private assertNotOwner;
-  removeMember(ctx: MemberWriteContext, actor: Actor, id: string): Promise<boolean>;
+  private toMember;
+  private assignmentViews;
+  private roleMap;
+  private resolveIn;
+  private findRole;
+  private relockedActor;
+  private itemPermissions;
+  private assertHolds;
+  private assertHoldsOn;
+  private assertNotSelf;
+  private assertUniqueName;
+  private parseLevels;
+  private assertFits;
+  private assertLevelsNotInUse;
 }
 //#endregion
 export { InviteUrls, OrganizationServiceImpl, OrganizationServiceParams };