@headless-lms/core 0.4.0 → 0.6.0

package/dist/organizations/service.js

@@ -1,61 +1,127 @@
-import { genId } from "../shared/id.js";
+import { levelSchema } from "../types/schemas/organizations.js";
+import { genId, prefixId } from "../shared/id.js";
 import { ForbiddenError, NotFoundError } from "../shared/errors.js";
 import { noopLogger } from "../shared/logger.js";
-import { STAFF_ROLES, STUDENT_ROLE, capability } from "./roles.js";
 import { InviteError, OrganizationRuleError } from "./members.js";
 import { organizationEvents } from "./events.js";
 import { generateInviteToken, hashInviteToken } from "../shared/invite-token.js";
-import { AsyncLocalStorage } from "node:async_hooks";
+import { ALL_PERMISSIONS, fitsLevels, permissionAbout, permissionList, withImplied } from "./permissions.js";
+import { DEFAULT_ROLES, MEMBER_ROLE_KEY, OWNER_ROLE_KEY, validateRoleSet } from "./default-roles.js";
+import { catalogOf, isSystemRole, resolveOrgRoles, resolveRole } from "./org-roles.js";
+import { ResolvedPermissions, resolvePermissions, systemPermissions } from "./effective-permissions.js";
 //#region src/organizations/service.ts
 const INVITE_TTL_MS = 10080 * 60 * 1e3;
-function toMember(r) {
+const SYSTEM_ID = "system";
+function snapshot(role) {
 	return {
-		id: r.id,
-		firstName: r.firstName,
-		lastName: r.lastName,
-		email: r.email,
-		image: r.image,
-		role: r.role,
-		status: r.status,
-		joinedAt: r.joinedAt,
-		invitedAt: r.invitedAt
+		key: role.key,
+		name: role.name,
+		description: role.description,
+		base: role.base,
+		levels: role.levels,
+		team: role.team,
+		permissions: role.permissions
 	};
 }
+function lockKeys(orgId, roleKeys, orgUserIds) {
+	return [...roleKeys.map((key) => `role:${orgId}:${key}`), ...orgUserIds.map((id) => `org-user:${orgId}:${id}`)];
+}
+function roleView(role, holders) {
+	return {
+		...role,
+		holders,
+		givable: role.key !== OWNER_ROLE_KEY
+	};
+}
+function keySummary(key, roles) {
+	return {
+		id: key.id,
+		name: key.name,
+		start: key.start,
+		role: key.roleKey ? {
+			key: key.roleKey,
+			name: roles.get(key.roleKey)?.name ?? null
+		} : null,
+		createdAt: key.createdAt,
+		lastUsedAt: key.lastUsedAt,
+		expiresAt: key.expiresAt
+	};
+}
+function limitScopes(limit, roles) {
+	if (!limit) return;
+	if ("scopes" in limit) return limit.scopes;
+	return roles.get(limit.roleKey)?.permissions ?? [];
+}
 var OrganizationServiceImpl = class {
 	repo;
+	roles;
 	membersRepo;
 	people;
+	images;
 	uow;
 	orgAdmin;
+	sessions;
+	apiKeysPort;
+	accountsPort;
+	platform;
+	grants;
+	catalog;
 	logger;
 	mailer;
 	inviteUrls;
-	memberWrites = new AsyncLocalStorage();
 	constructor(params) {
 		this.repo = params.repo;
+		this.roles = params.roles;
 		this.membersRepo = params.membersRepo;
 		this.people = params.people;
+		this.images = params.images;
 		this.uow = params.uow;
 		this.orgAdmin = params.orgAdmin;
+		this.sessions = params.sessions;
+		this.apiKeysPort = params.apiKeys;
+		this.accountsPort = params.accounts;
+		this.platform = params.platform && {
+			...params.platform,
+			email: params.platform.email.toLowerCase()
+		};
+		this.grants = params.grants;
+		const defaults = params.defaultRoles ?? DEFAULT_ROLES;
+		validateRoleSet(defaults);
+		this.catalog = catalogOf(defaults);
 		this.logger = params.logger ?? noopLogger;
 		this.mailer = params.mailer;
 		this.inviteUrls = params.inviteUrls;
 	}
-	async createOrganization(input) {
-		const created = await this.uow.run(async ({ organizations, outbox }) => {
+	createOrganization(input, headers) {
+		return this.orgAdmin().createOrganization(headers, input);
+	}
+	async provisionOrganization(input) {
+		const created = await this.uow.run(async ({ organizations, roles, outbox }) => {
 			const id = genId("organization");
-			const created = await organizations.create({
+			const org = await organizations.create({
 				id,
 				externalId: input.externalId ?? id,
-				name: input.name ?? `My Org`,
+				name: input.name ?? "My Org",
 				slug: input.slug ?? "",
 				ownerId: input.ownerId
 			});
+			const owner = await organizations.createOrgUser({
+				orgId: org.id,
+				userId: input.ownerId,
+				status: "active"
+			});
+			await roles.setOrgRole(org.id, owner.id, OWNER_ROLE_KEY, SYSTEM_ID);
 			await outbox.append([organizationEvents.organizationCreated.make({
-				orgId: created.id,
-				data: created
+				orgId: org.id,
+				data: org
+			}), organizationEvents.orgUserLinked.make({
+				orgId: org.id,
+				data: {
+					...owner,
+					orgRole: { key: OWNER_ROLE_KEY }
+				}
 			})]);
-			return created;
+			return org;
 		});
 		this.logger.info("organization created", {
 			orgId: created.id,
@@ -63,21 +129,40 @@ var OrganizationServiceImpl = class {
 		});
 		return created;
 	}
-	async updateOrganization(id, input) {
-		const updatedOrg = await this.uow.run(async ({ organizations, outbox }) => {
-			const updated = await organizations.update(id, {
+	async updateOrganization(input, actor) {
+		actor.permissions.require("organizations:write");
+		const orgId = actor.orgId;
+		const org = await this.repo.findById(orgId);
+		if (!org) throw new NotFoundError("Organization", orgId);
+		if (input.slug !== void 0 && input.slug !== org.slug) {
+			const taken = await this.repo.findBySlug(input.slug);
+			if (taken && taken.id !== orgId) {
+				this.logger.warn("organization update refused: slug taken", {
+					orgId,
+					slug: input.slug
+				});
+				throw new OrganizationRuleError("That slug is already taken");
+			}
+		}
+		await this.orgAdmin().updateOrganization(org.externalId ?? org.id, input);
+		const updated = await this.uow.run(async ({ organizations, outbox }) => {
+			const next = await organizations.update(orgId, {
 				name: input.name,
 				slug: input.slug
 			});
-			if (!updated) throw new NotFoundError("Organization", id);
+			if (!next) throw new NotFoundError("Organization", orgId);
 			await outbox.append([organizationEvents.organizationUpdated.make({
-				orgId: id,
-				data: updated
+				orgId,
+				data: next,
+				metadata: { actorId: actor.id }
 			})]);
-			return updated;
+			return next;
 		});
-		this.logger.info("organization updated", { updatedOrg });
-		return updatedOrg;
+		this.logger.info("organization updated", {
+			orgId,
+			actorId: actor.id
+		});
+		return updated;
 	}
 	async deleteOrganization(id) {
 		const deleted = await this.uow.run(async ({ organizations, outbox }) => {
@@ -91,164 +176,782 @@ var OrganizationServiceImpl = class {
 		this.logger.info("organization deleted", { orgId: deleted.id });
 		return deleted;
 	}
-	async addOrgUser({ orgId, userId, role }) {
-		if (await this.repo.findOrgUser(orgId, userId)) return this.updateOrgUser(orgId, userId, {
-			role,
-			status: "active"
-		});
+	async addOrgUser({ orgId, userId }) {
+		const existing = await this.repo.findOrgUser(orgId, userId);
+		if (existing) return existing;
 		const orgUser = await this.uow.run(async ({ organizations, outbox }) => {
 			const created = await organizations.createOrgUser({
 				orgId,
-				role,
 				userId,
 				status: "active"
 			});
 			await outbox.append([organizationEvents.orgUserLinked.make({
 				orgId,
-				data: created
+				data: {
+					...created,
+					orgRole: { key: MEMBER_ROLE_KEY }
+				}
 			})]);
 			return created;
 		});
 		this.logger.info("user added to organization", {
 			orgId,
 			userId,
-			role
+			orgUserId: orgUser.id
 		});
 		return orgUser;
 	}
 	async removeOrgUser(orgId, userId) {
-		const deleted = await this.uow.run(async ({ organizations, outbox }) => {
-			const orgUser = await organizations.findOrgUser(orgId, userId);
-			if (!orgUser) throw new NotFoundError("Member", userId);
-			const write = this.memberWrite(orgUser.id);
-			if (write?.demote) {
-				const demoted = await organizations.updateOrgUser(orgId, orgUser.id, { role: STUDENT_ROLE });
-				if (!demoted) throw new NotFoundError("Member", orgUser.id);
-				if (orgUser.role !== "student") await outbox.append([organizationEvents.orgUserUpdated.make({
+		const orgUser = await this.repo.findOrgUser(orgId, userId);
+		if (!orgUser) return null;
+		return this.deleteOrgUserRow(orgId, orgUser);
+	}
+	getByExternalId(externalId) {
+		return this.repo.findByExternalId(externalId);
+	}
+	getBySlug(slug) {
+		return this.repo.findBySlug(slug);
+	}
+	getById(id) {
+		return this.repo.findById(id);
+	}
+	async portalIdentity(id) {
+		const org = await this.repo.findById(id);
+		if (!org) throw new NotFoundError("Organization", id);
+		return {
+			id: org.id,
+			name: org.name,
+			slug: org.slug
+		};
+	}
+	getOrgUser(orgId, userId) {
+		return this.repo.findOrgUser(orgId, userId);
+	}
+	getOrgUserById(orgId, id) {
+		return this.repo.findOrgUserById(orgId, id);
+	}
+	async getOrgUsersByIds(orgId, ids) {
+		const unique = [...new Set(ids)];
+		return unique.length > 0 ? this.repo.findOrgUsersByIds(orgId, unique) : [];
+	}
+	getOrgUsersForUser(userId) {
+		return this.repo.findOrgUsersByUser(userId);
+	}
+	orgIds() {
+		return this.repo.listIds();
+	}
+	async actorFor(orgId, orgUserId, limit) {
+		const facts = await this.roles.actorFacts(orgId, orgUserId);
+		if (!facts || facts.status !== "active") return null;
+		const roles = this.roleMap(facts.storedRoles);
+		const tokenScopes = limitScopes(limit, roles);
+		return {
+			id: orgUserId,
+			orgId,
+			permissions: resolvePermissions({
+				assignments: facts.assignments,
+				roles,
+				...tokenScopes !== void 0 && { tokenScopes }
+			})
+		};
+	}
+	async resolveCaller(authOrgId, authUserId, limit) {
+		const facts = await this.roles.callerFacts(authOrgId, authUserId);
+		if (!facts) return null;
+		const orgUser = facts.orgUser;
+		if (orgUser?.status !== "active") return {
+			orgId: facts.orgId,
+			userId: facts.userId,
+			orgUserId: orgUser?.orgUserId ?? null,
+			actor: null
+		};
+		const roles = this.roleMap(orgUser.storedRoles);
+		const tokenScopes = limitScopes(limit, roles);
+		return {
+			orgId: facts.orgId,
+			userId: facts.userId,
+			orgUserId: orgUser.orgUserId,
+			actor: {
+				id: orgUser.orgUserId,
+				orgId: facts.orgId,
+				permissions: resolvePermissions({
+					assignments: orgUser.assignments,
+					roles,
+					...tokenScopes !== void 0 && { tokenScopes }
+				})
+			}
+		};
+	}
+	systemActor(orgId) {
+		return {
+			id: SYSTEM_ID,
+			orgId,
+			permissions: systemPermissions()
+		};
+	}
+	async permissionsOfMany(orgId, orgUserIds) {
+		const unique = [...new Set(orgUserIds)];
+		const out = /* @__PURE__ */ new Map();
+		if (unique.length === 0) return out;
+		const [stored, assignments] = await Promise.all([this.roles.storedRoles(orgId), this.roles.assignmentsOfMany(orgId, unique)]);
+		const roles = this.roleMap(stored);
+		for (const id of unique) out.set(id, resolvePermissions({
+			assignments: assignments.get(id) ?? [],
+			roles
+		}));
+		return out;
+	}
+	async holders(orgId, permission, on) {
+		const stored = await this.roles.storedRoles(orgId);
+		const keys = resolveOrgRoles(this.catalog, stored).filter((role) => withImplied(role.permissions).has(permission)).map((role) => role.key);
+		const candidates = await this.roles.holdersOf(orgId, keys, on);
+		if (candidates.length === 0) return [];
+		const permissions = await this.permissionsOfMany(orgId, candidates);
+		return candidates.filter((id) => permissions.get(id)?.has(permission, on) ?? false);
+	}
+	permissionList() {
+		return permissionList();
+	}
+	viewerPermissions(actor) {
+		const role = actor.permissions.roleOn();
+		if (actor.permissions instanceof ResolvedPermissions) return {
+			orgRole: {
+				key: role.key,
+				name: role.name
+			},
+			isOwner: actor.permissions.isOwner(),
+			org: actor.permissions.orgPermissions(),
+			content: actor.permissions.contentPermissions()
+		};
+		return {
+			orgRole: {
+				key: role.key,
+				name: role.name
+			},
+			isOwner: actor.permissions.isOwner(),
+			org: ALL_PERMISSIONS.filter((p) => actor.permissions.has(p)),
+			content: {}
+		};
+	}
+	async auditRoleKeys() {
+		const usage = await this.roles.roleKeyUsage();
+		const storedByOrg = /* @__PURE__ */ new Map();
+		let dangling = 0;
+		for (const row of usage) {
+			if (!storedByOrg.has(row.orgId)) storedByOrg.set(row.orgId, await this.roles.storedRoles(row.orgId));
+			const role = this.resolveIn(storedByOrg.get(row.orgId), row.roleKey);
+			if (!role) {
+				dangling += row.count;
+				this.logger.warn("assignments name a role the set no longer has", {
+					orgId: row.orgId,
+					roleKey: row.roleKey,
+					level: row.level,
+					count: row.count
+				});
+			} else if (!role.levels.includes(row.level)) {
+				dangling += row.count;
+				this.logger.warn("assignments sit at a level their role no longer lists", {
+					orgId: row.orgId,
+					roleKey: row.roleKey,
+					level: row.level,
+					count: row.count
+				});
+			}
+		}
+		return dangling;
+	}
+	async listRoles(actor) {
+		actor.permissions.require("roles:read");
+		const [stored, counts] = await Promise.all([this.roles.storedRoles(actor.orgId), this.roles.holderCounts(actor.orgId)]);
+		return resolveOrgRoles(this.catalog, stored).map((role) => roleView(role, counts[role.key] ?? 0));
+	}
+	async getRole(key, actor) {
+		actor.permissions.require("roles:read");
+		return roleView(await this.findRole(actor.orgId, key), await this.roles.countHolders(actor.orgId, key));
+	}
+	async updateRole(key, input, actor) {
+		actor.permissions.require("roles:write");
+		const orgId = actor.orgId;
+		const changesAccess = input.levels !== void 0 || input.team !== void 0 || input.permissions !== void 0;
+		const result = await this.uow.run(async (scope) => {
+			const { roles, outbox } = scope;
+			await roles.lock(lockKeys(orgId, [key], [actor.id]));
+			const editor = await this.relockedActor(scope, actor);
+			editor.permissions.require("roles:write");
+			const stored = await roles.storedRoles(orgId);
+			const current = stored.find((row) => row.key === key);
+			const before = this.resolveIn(stored, key);
+			if (!before) throw new NotFoundError("Role", key);
+			if (changesAccess && isSystemRole(key)) throw new OrganizationRuleError(`${before.name} can only be renamed`);
+			if (input.name !== void 0) this.assertUniqueName(stored, key, input.name);
+			const next = {
+				key,
+				name: input.name ?? current?.name ?? null,
+				description: input.description ?? current?.description ?? null,
+				base: current?.base ?? before.base,
+				levels: input.levels ? this.parseLevels(input.levels) : current?.levels ?? null,
+				permissions: {
+					...current?.permissions ?? {},
+					...input.permissions ?? {}
+				},
+				team: input.team ?? current?.team ?? null
+			};
+			const after = resolveRole(key, this.catalog, next);
+			if (!after) throw new NotFoundError("Role", key);
+			if (changesAccess) {
+				this.assertFits(next);
+				this.assertHolds(editor, [...before.permissions, ...after.permissions]);
+				await this.assertLevelsNotInUse(roles, orgId, before, after);
+			}
+			await roles.saveStoredRole(orgId, next);
+			await outbox.append([organizationEvents.roleUpdated.make({
+				orgId,
+				data: {
+					key,
+					before: snapshot(before),
+					after: snapshot(after)
+				},
+				metadata: { actorId: actor.id }
+			})]);
+			return after;
+		});
+		this.logger.info("role updated", {
+			orgId,
+			roleKey: key,
+			actorId: actor.id
+		});
+		return roleView(result, await this.roles.countHolders(orgId, key));
+	}
+	async createRole(input, actor) {
+		actor.permissions.require("roles:write");
+		const orgId = actor.orgId;
+		if (!this.catalog.get(input.base) || isSystemRole(input.base)) throw new OrganizationRuleError("A role is added from one of the deployment roles");
+		const key = prefixId("role");
+		const created = await this.uow.run(async (scope) => {
+			const { roles, outbox } = scope;
+			await roles.lock(lockKeys(orgId, [key, `name:${input.name.trim().toLowerCase()}`], [actor.id]));
+			const editor = await this.relockedActor(scope, actor);
+			editor.permissions.require("roles:write");
+			const stored = await roles.storedRoles(orgId);
+			this.assertUniqueName(stored, key, input.name);
+			const row = {
+				key,
+				name: input.name,
+				description: input.description ?? null,
+				base: input.base,
+				levels: input.levels ? this.parseLevels(input.levels) : null,
+				permissions: input.permissions ?? {},
+				team: input.team ?? null
+			};
+			this.assertFits(row);
+			const role = resolveRole(key, this.catalog, row);
+			this.assertHolds(editor, role.permissions);
+			await roles.saveStoredRole(orgId, row);
+			await outbox.append([organizationEvents.roleCreated.make({
+				orgId,
+				data: { role: snapshot(role) },
+				metadata: { actorId: actor.id }
+			})]);
+			return role;
+		});
+		this.logger.info("role created", {
+			orgId,
+			roleKey: key,
+			actorId: actor.id
+		});
+		return roleView(created, 0);
+	}
+	async resetRole(key, actor) {
+		actor.permissions.require("roles:write");
+		const orgId = actor.orgId;
+		if (!this.catalog.has(key)) throw new OrganizationRuleError("Only a deployment role can be reset");
+		const result = await this.uow.run(async (scope) => {
+			const { roles, outbox } = scope;
+			await roles.lock(lockKeys(orgId, [key], [actor.id]));
+			const editor = await this.relockedActor(scope, actor);
+			editor.permissions.require("roles:write");
+			const stored = await roles.storedRoles(orgId);
+			const before = this.resolveIn(stored, key);
+			const after = resolveRole(key, this.catalog, void 0);
+			if (!before || !after) throw new NotFoundError("Role", key);
+			this.assertUniqueName(stored.filter((row) => row.key !== key), key, after.name);
+			this.assertHolds(editor, [...before.permissions, ...after.permissions]);
+			await this.assertLevelsNotInUse(roles, orgId, before, after);
+			await roles.deleteStoredRole(orgId, key);
+			await outbox.append([organizationEvents.roleUpdated.make({
+				orgId,
+				data: {
+					key,
+					before: snapshot(before),
+					after: snapshot(after)
+				},
+				metadata: { actorId: actor.id }
+			})]);
+			return after;
+		});
+		this.logger.info("role reset", {
+			orgId,
+			roleKey: key,
+			actorId: actor.id
+		});
+		return roleView(result, await this.roles.countHolders(orgId, key));
+	}
+	async deleteRole(key, actor) {
+		actor.permissions.require("roles:delete");
+		const orgId = actor.orgId;
+		if (this.catalog.has(key)) throw new OrganizationRuleError("A deployment role can be renamed and reset, not deleted");
+		const keys = await this.keysWithRole(orgId, key);
+		if (keys > 0) {
+			this.logger.warn("role deletion refused: role is on api keys", {
+				orgId,
+				roleKey: key,
+				keys
+			});
+			throw new OrganizationRuleError(`This role is on ${keys} API ${keys === 1 ? "key" : "keys"}; revoke ${keys === 1 ? "it" : "them"} first`);
+		}
+		await this.uow.run(async (scope) => {
+			const { roles, outbox } = scope;
+			await roles.lock(lockKeys(orgId, [key], [actor.id]));
+			(await this.relockedActor(scope, actor)).permissions.require("roles:delete");
+			const holders = await roles.countHolders(orgId, key);
+			if (holders > 0) {
+				this.logger.warn("role deletion refused: role is held", {
 					orgId,
-					data: demoted,
-					metadata: { actorOrgUserId: write.actorOrgUserId }
-				})]);
-				return demoted;
+					roleKey: key,
+					holders
+				});
+				throw new OrganizationRuleError(`This role is held by ${holders} ${holders === 1 ? "person" : "people"}`);
 			}
-			if (orgUser.role === "student") return orgUser;
-			const deletedUser = await organizations.deleteOrgUser(orgId, orgUser.id);
-			if (!deletedUser) throw new NotFoundError("Member", orgUser.id);
-			await outbox.append([organizationEvents.orgUserDeleted.make({
+			if (!await roles.deleteStoredRole(orgId, key)) throw new NotFoundError("Role", key);
+			await outbox.append([organizationEvents.roleDeleted.make({
 				orgId,
-				data: deletedUser
+				data: { key },
+				metadata: { actorId: actor.id }
 			})]);
-			return deletedUser;
 		});
-		this.logger.info("org user removed", {
+		this.logger.info("role deleted", {
 			orgId,
-			userId,
-			orgUserId: deleted.id
+			roleKey: key,
+			actorId: actor.id
 		});
-		return deleted;
 	}
-	async updateOrgUser(orgId, userId, patch) {
-		const updated = await this.uow.run(async ({ organizations, outbox }) => {
-			const orgUser = await organizations.findOrgUser(orgId, userId);
-			if (!orgUser) throw new NotFoundError("Member", userId);
-			const next = await organizations.updateOrgUser(orgId, orgUser.id, patch);
-			if (!next) throw new NotFoundError("Member", orgUser.id);
-			if (patch.role !== void 0 && patch.role !== orgUser.role) {
-				const actorOrgUserId = this.memberWrite(orgUser.id)?.actorOrgUserId;
-				await outbox.append([organizationEvents.orgUserUpdated.make({
+	async listTeam(query, actor) {
+		actor.permissions.require("people:read");
+		const orgId = actor.orgId;
+		const [rows, stored] = await Promise.all([this.membersRepo.teamRows(orgId, MEMBER_ROLE_KEY), this.roles.storedRoles(orgId)]);
+		const roles = this.roleMap(stored);
+		const nameOf = (key) => roles.get(key)?.name ?? key;
+		let members = rows.map((row) => this.toMember(row, nameOf));
+		if (query.roleKey) members = members.filter((m) => m.orgRole.key === query.roleKey || m.items.some((i) => i.roleKey === query.roleKey));
+		if (query.status) members = members.filter((m) => m.status === query.status);
+		const q = query.search?.trim().toLowerCase();
+		if (q) members = members.filter((m) => [
+			m.firstName,
+			m.lastName,
+			m.email
+		].some((v) => v?.toLowerCase().includes(q)));
+		const sort = query.sort;
+		const desc = sort?.startsWith("-") ?? false;
+		const key = desc ? sort.slice(1) : sort;
+		const byName = (a, b) => a === b ? 0 : a === null ? 1 : b === null ? -1 : a.localeCompare(b);
+		members.sort((a, b) => {
+			const cmp = key === "email" ? a.email.localeCompare(b.email) : key === "role" ? a.orgRole.name.localeCompare(b.orgRole.name) : key === "lastName" ? byName(a.lastName, b.lastName) || byName(a.firstName, b.firstName) : byName(a.firstName, b.firstName) || byName(a.lastName, b.lastName);
+			return desc ? -cmp : cmp;
+		});
+		const start = (query.page - 1) * query.pageSize;
+		return {
+			rows: members.slice(start, start + query.pageSize),
+			total: members.length,
+			page: query.page,
+			pageSize: query.pageSize
+		};
+	}
+	async listAssignments(orgUserId, actor) {
+		actor.permissions.require("people:read");
+		return this.assignmentViews(actor.orgId, orgUserId);
+	}
+	async listAssignmentsOn(contentId, actor) {
+		actor.permissions.require("people:read");
+		const [rows, stored] = await Promise.all([this.roles.assignmentsOn(actor.orgId, contentId), this.roles.storedRoles(actor.orgId)]);
+		const roles = this.roleMap(stored);
+		return rows.map((row) => ({
+			orgUserId: row.orgUserId,
+			roleKey: row.roleKey,
+			roleName: roles.get(row.roleKey)?.name ?? row.roleKey,
+			contentId: row.contentId,
+			contentType: row.contentType
+		}));
+	}
+	async setOrgRole(orgUserId, roleKey, actor) {
+		actor.permissions.require("people:write");
+		const orgId = actor.orgId;
+		this.assertNotSelf(actor, orgUserId);
+		const seen = (await this.roles.assignmentsOf(orgId, orgUserId)).find((row) => row.contentId === null);
+		const target = await this.repo.findOrgUserById(orgId, orgUserId);
+		const invitee = target?.status === "invited" ? await this.people.getUserById(target.userId) : null;
+		await this.uow.run(async (scope) => {
+			const { roles, organizations, outbox } = scope;
+			await roles.lock(lockKeys(orgId, [roleKey, seen?.roleKey ?? "member"], [orgUserId, actor.id]));
+			const editor = await this.relockedActor(scope, actor);
+			editor.permissions.require("people:write");
+			const orgUser = await organizations.findOrgUserById(orgId, orgUserId);
+			if (!orgUser) throw new NotFoundError("Person", orgUserId);
+			const stored = await roles.storedRoles(orgId);
+			const next = this.resolveIn(stored, roleKey);
+			if (!next) throw new NotFoundError("Role", roleKey);
+			if (roleKey === "owner") throw new OrganizationRuleError("Ownership moves only by transfer");
+			if (!next.levels.includes("org")) throw new OrganizationRuleError(`${next.name} can't be given on the organization`);
+			const current = (await roles.assignmentsOf(orgId, orgUserId)).find((row) => row.contentId === null);
+			if (current?.roleKey === "owner") {
+				this.logger.warn("org role change refused: target is the owner", {
 					orgId,
-					data: next,
-					...actorOrgUserId !== void 0 && { metadata: { actorOrgUserId } }
-				})]);
+					orgUserId
+				});
+				throw new OrganizationRuleError("The owner's role changes only by transfer");
 			}
-			return next;
+			if (orgUser.status === "invited") {
+				const person = invitee?.id === orgUser.userId ? invitee : null;
+				const pending = person ? await organizations.findPendingInvite(orgId, person.email) : null;
+				if (!pending) throw new NotFoundError("Invite", orgUserId);
+				const invited = this.resolveIn(stored, pending.roleKey);
+				this.assertHolds(editor, [...invited?.permissions ?? [], ...next.permissions]);
+				const editorUser = await organizations.findOrgUserById(orgId, actor.id);
+				if (!editorUser) throw new ForbiddenError("You are no longer an active member of this organization");
+				await organizations.setInviteRole(orgId, pending.id, roleKey, editorUser.userId);
+				this.logger.info("pending invite role changed", {
+					orgId,
+					orgUserId,
+					inviteId: pending.id,
+					roleKey,
+					actorId: actor.id
+				});
+				return;
+			}
+			const previousKey = current?.roleKey ?? "member";
+			const previous = this.resolveIn(stored, previousKey);
+			this.assertHolds(editor, [...previous?.permissions ?? [], ...next.permissions]);
+			await roles.setOrgRole(orgId, orgUserId, roleKey === "member" ? null : roleKey, actor.id);
+			if (previousKey !== roleKey) await outbox.append([organizationEvents.roleAssigned.make({
+				orgId,
+				data: {
+					orgUserId,
+					roleKey,
+					contentId: null,
+					contentType: null,
+					previousRoleKey: previousKey
+				},
+				metadata: { actorId: actor.id }
+			})]);
+			this.logger.info("org role set", {
+				orgId,
+				orgUserId,
+				roleKey,
+				actorId: actor.id
+			});
+		});
+		return this.assignmentViews(orgId, orgUserId);
+	}
+	async assignRole(orgUserId, contentId, roleKey, actor) {
+		actor.permissions.require("people:write");
+		const orgId = actor.orgId;
+		this.assertNotSelf(actor, orgUserId);
+		const seen = (await this.roles.assignmentsOf(orgId, orgUserId)).find((row) => row.contentId === contentId);
+		await this.uow.run(async (scope) => {
+			const { roles, organizations, outbox } = scope;
+			await roles.lock(lockKeys(orgId, [roleKey, ...seen ? [seen.roleKey] : []], [orgUserId, actor.id]));
+			const editor = await this.relockedActor(scope, actor);
+			editor.permissions.require("people:write");
+			if (!await organizations.findOrgUserById(orgId, orgUserId)) throw new NotFoundError("Person", orgUserId);
+			const contentType = await roles.contentTypeOf(orgId, contentId);
+			if (!contentType) throw new NotFoundError("Content", contentId);
+			const stored = await roles.storedRoles(orgId);
+			const next = this.resolveIn(stored, roleKey);
+			if (!next) throw new NotFoundError("Role", roleKey);
+			if (isSystemRole(roleKey) || !next.levels.includes(contentType)) {
+				this.logger.warn("role assignment refused: level not listed", {
+					orgId,
+					roleKey,
+					contentType
+				});
+				throw new OrganizationRuleError(`${next.name} can't be given on a ${contentType}`);
+			}
+			const current = (await roles.assignmentsOf(orgId, orgUserId)).find((row) => row.contentId === contentId);
+			const previous = current ? this.resolveIn(stored, current.roleKey) : null;
+			this.assertHoldsOn(editor, [...this.itemPermissions(previous, contentType), ...this.itemPermissions(next, contentType)], contentId);
+			await roles.setItemRole(orgId, orgUserId, contentId, contentType, roleKey, actor.id);
+			if (current?.roleKey !== roleKey) await outbox.append([organizationEvents.roleAssigned.make({
+				orgId,
+				data: {
+					orgUserId,
+					roleKey,
+					contentId,
+					contentType,
+					previousRoleKey: current?.roleKey ?? null
+				},
+				metadata: { actorId: actor.id }
+			})]);
 		});
-		this.logger.info("org user updated", {
+		this.logger.info("item role given", {
 			orgId,
-			userId,
-			orgUserId: updated.id,
-			patch
+			orgUserId,
+			contentId,
+			roleKey,
+			actorId: actor.id
+		});
+		return this.assignmentViews(orgId, orgUserId);
+	}
+	async unassignRole(orgUserId, contentId, actor) {
+		actor.permissions.require("people:write");
+		const orgId = actor.orgId;
+		this.assertNotSelf(actor, orgUserId);
+		const seen = (await this.roles.assignmentsOf(orgId, orgUserId)).find((row) => row.contentId === contentId);
+		await this.uow.run(async (scope) => {
+			const { roles, outbox } = scope;
+			await roles.lock(lockKeys(orgId, seen ? [seen.roleKey] : [], [orgUserId, actor.id]));
+			const current = (await roles.assignmentsOf(orgId, orgUserId)).find((row) => row.contentId === contentId);
+			if (!current || !current.contentType) throw new NotFoundError("Role assignment", contentId);
+			const editor = await this.relockedActor(scope, actor);
+			editor.permissions.require("people:write");
+			const stored = await roles.storedRoles(orgId);
+			const role = this.resolveIn(stored, current.roleKey);
+			this.assertHoldsOn(editor, this.itemPermissions(role, current.contentType), contentId);
+			const removed = await roles.removeItemRole(orgId, orgUserId, contentId);
+			if (removed) await outbox.append([organizationEvents.roleUnassigned.make({
+				orgId,
+				data: {
+					orgUserId,
+					roleKey: removed.roleKey,
+					contentId,
+					contentType: current.contentType
+				},
+				metadata: { actorId: actor.id }
+			})]);
+		});
+		this.logger.info("item role removed", {
+			orgId,
+			orgUserId,
+			contentId,
+			actorId: actor.id
+		});
+		return this.assignmentViews(orgId, orgUserId);
+	}
+	async removePerson(orgUserId, actor) {
+		actor.permissions.require("people:delete");
+		const orgId = actor.orgId;
+		this.assertNotSelf(actor, orgUserId);
+		const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);
+		if (!orgUser) throw new NotFoundError("Person", orgUserId);
+		const person = await this.people.getUserById(orgUser.userId);
+		await this.uow.run(async (scope) => {
+			const { roles } = scope;
+			await roles.lock(lockKeys(orgId, [], [orgUserId, actor.id]));
+			const editor = await this.relockedActor(scope, actor);
+			editor.permissions.require("people:delete");
+			const held = await roles.assignmentsOf(orgId, orgUserId);
+			if (held.some((row) => row.roleKey === "owner")) {
+				this.logger.warn("removal refused: target is the owner", {
+					orgId,
+					orgUserId
+				});
+				throw new OrganizationRuleError("The owner cannot be removed");
+			}
+			const stored = await roles.storedRoles(orgId);
+			for (const row of held) {
+				const role = this.resolveIn(stored, row.roleKey);
+				if (!role) continue;
+				if (row.contentId === null) this.assertHolds(editor, role.permissions);
+				else if (row.contentType) this.assertHoldsOn(editor, this.itemPermissions(role, row.contentType), row.contentId);
+			}
+			await this.deleteOrgUserIn(scope, orgId, orgUser, held, actor.id);
+		});
+		this.logger.info("person removed", {
+			orgId,
+			orgUserId,
+			actorId: actor.id
+		});
+		await this.cleanUpAfterRemoval(orgId, orgUserId, person);
+	}
+	async transferOwnership(input, actor) {
+		if (!actor.permissions.isOwner()) {
+			this.logger.warn("ownership transfer refused: caller is not the owner", {
+				orgId: actor.orgId,
+				actorId: actor.id
+			});
+			throw new ForbiddenError("Only the owner can transfer ownership");
+		}
+		const orgId = actor.orgId;
+		const previousRoleKey = input.previousOwnerRoleKey ?? "member";
+		if (input.newOwnerOrgUserId === actor.id) throw new OrganizationRuleError("You already own this organization");
+		const stored = await this.roles.storedRoles(orgId);
+		const previousRole = this.resolveIn(stored, previousRoleKey);
+		if (!previousRole || previousRoleKey === "owner" || !previousRole.levels.includes("org")) throw new OrganizationRuleError("The previous owner needs a role given on the organization");
+		const [org, newOwner, previousOwner] = await Promise.all([
+			this.repo.findById(orgId),
+			this.repo.findOrgUserById(orgId, input.newOwnerOrgUserId),
+			this.repo.findOrgUserById(orgId, actor.id)
+		]);
+		if (!org || !previousOwner) throw new NotFoundError("Organization", orgId);
+		if (!newOwner || newOwner.status !== "active") throw new OrganizationRuleError("The new owner must be an active member of the organization");
+		const [newPerson, previousPerson] = await Promise.all([this.people.getUserById(newOwner.userId), this.people.getUserById(previousOwner.userId)]);
+		if (!newPerson?.externalId || !previousPerson?.externalId) throw new OrganizationRuleError("Both people need an account");
+		const orgExternalId = org.externalId ?? org.id;
+		await this.orgAdmin().setMembershipOwner(orgExternalId, newPerson.externalId, true);
+		await this.orgAdmin().setMembershipOwner(orgExternalId, previousPerson.externalId, false);
+		await this.uow.run(async ({ roles, outbox }) => {
+			await roles.lock(lockKeys(orgId, [OWNER_ROLE_KEY, previousRoleKey], [newOwner.id, previousOwner.id]));
+			if (await roles.ownerOrgUserId(orgId) !== previousOwner.id) throw new ForbiddenError("Only the owner can transfer ownership");
+			await roles.setOrgRole(orgId, newOwner.id, null, actor.id);
+			await roles.setOrgRole(orgId, previousOwner.id, previousRoleKey === "member" ? null : previousRoleKey, actor.id);
+			await roles.setOrgRole(orgId, newOwner.id, OWNER_ROLE_KEY, actor.id);
+			await outbox.append([organizationEvents.ownershipTransferred.make({
+				orgId,
+				data: {
+					previousOwnerOrgUserId: previousOwner.id,
+					newOwnerOrgUserId: newOwner.id
+				},
+				metadata: { actorId: actor.id }
+			})]);
+		});
+		this.logger.info("ownership transferred", {
+			orgId,
+			previousOwnerOrgUserId: previousOwner.id,
+			newOwnerOrgUserId: newOwner.id
 		});
-		return updated;
 	}
-	async createInvite(actor, input) {
-		const { orgId, email, role, inviterUserId, firstName, lastName } = input;
-		this.assertManagesUsers(actor, orgId);
-		this.assertNotOwner(role, orgId);
+	async createInvite(input, actor, inviterUserId) {
+		actor.permissions.require("people:write");
+		const orgId = actor.orgId;
+		const roleKey = input.roleKey ?? "member";
+		const email = input.email;
+		if (roleKey === "owner") {
+			this.logger.warn("invite refused: ownership cannot be granted", { orgId });
+			throw new OrganizationRuleError("Ownership moves only by transfer");
+		}
+		const stored = await this.roles.storedRoles(orgId);
+		const role = this.resolveIn(stored, roleKey);
+		if (!role) throw new NotFoundError("Role", roleKey);
+		if (!role.levels.includes("org")) throw new OrganizationRuleError(`${role.name} can't be given on the organization`);
+		this.assertHolds(actor, role.permissions);
+		const known = await this.people.getUserByEmail(email);
+		const existing = known ? await this.repo.findOrgUser(orgId, known.id) : null;
+		if (existing?.id === actor.id) {
+			this.logger.warn("invite refused: inviting yourself", {
+				orgId,
+				actorId: actor.id
+			});
+			throw new ForbiddenError("You can't change your own roles");
+		}
+		let contributed = role.permissions;
+		if (existing) {
+			const current = (await this.roles.assignmentsOf(orgId, existing.id)).find((row) => row.contentId === null);
+			if (current?.roleKey === "owner") {
+				this.logger.warn("invite refused: target is the owner", { orgId });
+				throw new OrganizationRuleError("The owner cannot be invited");
+			}
+			const currentRole = this.resolveIn(stored, current?.roleKey ?? "member");
+			contributed = [...contributed, ...currentRole?.permissions ?? []];
+		}
+		this.assertHolds(actor, contributed);
+		const person = known ?? await this.people.createUser({
+			email,
+			...input.firstName !== void 0 && { firstName: input.firstName },
+			...input.lastName !== void 0 && { lastName: input.lastName }
+		});
 		const sendEmail = input.sendEmail ?? true;
 		const { token, tokenHash } = generateInviteToken();
 		const expiresAt = new Date(Date.now() + INVITE_TTL_MS);
-		const person = role === "student" ? await this.people.getUserByEmail(email) ?? await this.people.createUser({
-			email,
-			...firstName !== void 0 && { firstName },
-			...lastName !== void 0 && { lastName }
-		}) : null;
 		const invite = await this.uow.run(async ({ organizations, outbox }) => {
 			const events = [];
-			if (person) {
+			if (!existing) {
 				const orgUser = await organizations.createOrgUser({
 					orgId,
 					userId: person.id,
-					role: STUDENT_ROLE,
 					status: "invited"
 				});
-				events.push(organizationEvents.studentCreated.make({
+				events.push(roleKey === "member" ? organizationEvents.studentCreated.make({
 					orgId,
 					data: orgUser
+				}) : organizationEvents.orgUserLinked.make({
+					orgId,
+					data: {
+						...orgUser,
+						orgRole: { key: MEMBER_ROLE_KEY }
+					}
 				}));
 			}
 			const row = await organizations.upsertPendingInvite(orgId, {
 				email,
-				role,
+				roleKey,
 				invitedBy: inviterUserId,
 				tokenHash,
 				expiresAt
 			});
 			events.push(organizationEvents.inviteCreated.make({
 				orgId,
-				data: row
+				data: row,
+				metadata: { actorId: actor.id }
 			}));
 			await outbox.append(events);
 			return row;
 		});
 		if (sendEmail) try {
-			await this.sendInviteEmail(invite, token);
+			await this.sendInviteEmail(invite, token, role);
 		} catch (err) {
 			this.logger.error("failed to send invite email", {
 				orgId,
 				inviteId: invite.id,
-				role: invite.role,
+				roleKey,
 				err: err instanceof Error ? err : new Error(String(err))
 			});
 		}
 		this.logger.info("invite created", {
 			orgId,
 			inviteId: invite.id,
-			role,
-			sendEmail
+			roleKey,
+			sendEmail,
+			actorId: actor.id
 		});
 		return invite;
 	}
-	async resendStudentInvite(actor, input) {
-		const { orgId, orgUserId, inviterUserId } = input;
-		this.assertManagesUsers(actor, orgId);
-		const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);
-		if (!orgUser || orgUser.role !== "student") throw new NotFoundError("Student", orgUserId);
-		if (orgUser.status === "active") throw new OrganizationRuleError("That student has already accepted their invitation");
-		const person = await this.people.getUserById(orgUser.userId);
-		if (!person) throw new NotFoundError("User", orgUser.userId);
-		const pending = await this.repo.findPendingInvite(orgId, person.email);
-		if (!pending) throw new NotFoundError("Invite", person.email);
+	async resendInvite(orgUserId, actor, inviterUserId) {
+		actor.permissions.require("people:write");
+		const orgId = actor.orgId;
+		const { invite, role } = await this.pendingInviteOf(orgId, orgUserId);
+		this.assertHolds(actor, role.permissions);
 		const { token, tokenHash } = generateInviteToken();
 		const expiresAt = new Date(Date.now() + INVITE_TTL_MS);
-		const invite = await this.repo.setInviteToken(orgId, pending.id, tokenHash, expiresAt);
-		if (!invite) throw new NotFoundError("Invite", pending.id);
-		await this.sendInviteEmail(invite, token);
-		this.logger.info("student invite resent", {
+		const refreshed = await this.repo.setInviteToken(orgId, invite.id, tokenHash, expiresAt, inviterUserId);
+		if (!refreshed) throw new NotFoundError("Invite", invite.id);
+		await this.sendInviteEmail(refreshed, token, role);
+		this.logger.info("invite resent", {
 			orgId,
 			orgUserId,
 			inviteId: invite.id,
-			inviterUserId
+			actorId: actor.id
+		});
+	}
+	async cancelInvite(orgUserId, actor) {
+		actor.permissions.require("people:write");
+		const orgId = actor.orgId;
+		const { invite, role, orgUser } = await this.pendingInviteOf(orgId, orgUserId);
+		this.assertHolds(actor, role.permissions);
+		const held = await this.roles.assignmentsOf(orgId, orgUserId);
+		const holdsGrant = this.grants ? await this.grants().holdsAnyGrant(orgId, orgUserId) : true;
+		await this.uow.run(async (scope) => {
+			const canceled = await scope.organizations.setInviteStatus(orgId, invite.id, "canceled");
+			if (!canceled) throw new NotFoundError("Invite", invite.id);
+			await scope.outbox.append([organizationEvents.inviteCanceled.make({
+				orgId,
+				data: canceled,
+				metadata: { actorId: actor.id }
+			})]);
+			if (orgUser.status === "invited" && held.length === 0 && !holdsGrant) await this.deleteOrgUserIn(scope, orgId, orgUser, held, actor.id);
+		});
+		this.logger.info("invite canceled", {
+			orgId,
+			orgUserId,
+			inviteId: invite.id,
+			actorId: actor.id
 		});
 	}
 	async peekInvite(token) {
@@ -257,7 +960,17 @@ var OrganizationServiceImpl = class {
 		if (invite.expiresAt && invite.expiresAt < /* @__PURE__ */ new Date()) return null;
 		return invite;
 	}
-	async acceptInvite(input) {
+	async describeInvite(token) {
+		const invite = await this.peekInvite(token);
+		if (!invite) throw new NotFoundError("Invite", "token");
+		const person = await this.people.getUserByEmail(invite.email);
+		return {
+			email: invite.email,
+			firstName: person?.firstName ?? null,
+			lastName: person?.lastName ?? null
+		};
+	}
+	async acceptInvite(input, headers) {
 		const invite = await this.peekInvite(input.token);
 		if (!invite) {
 			this.logger.warn("invite accept refused: token invalid or expired");
@@ -270,263 +983,477 @@ var OrganizationServiceImpl = class {
 			});
 			throw new InviteError("emails must match");
 		}
-		const org = await this.repo.findById(invite.orgId);
+		const orgId = invite.orgId;
+		const org = await this.repo.findById(orgId);
 		if (!org) throw new InviteError("Org not found");
-		const orgUser = invite.role === "student" ? await this.acceptStudentInvite(invite, input.userId) : await this.acceptStaffInvite(invite, org, input.userId);
-		this.logger.info("invite accepted", {
-			orgId: invite.orgId,
-			userId: input.userId
-		});
-		return orgUser;
-	}
-	async acceptStudentInvite(invite, userId) {
-		return this.uow.run(async ({ organizations, outbox }) => {
-			const existing = await organizations.findOrgUser(invite.orgId, userId);
-			if (!existing) throw new NotFoundError("Member", userId);
-			const activated = await organizations.updateOrgUser(invite.orgId, existing.id, { status: "active" });
-			if (!activated) throw new NotFoundError("Member", existing.id);
-			const acceptedInvite = await organizations.setInviteStatus(invite.orgId, invite.id, "accepted");
+		const person = await this.people.getUserByExternalId(input.authUserId);
+		if (!person?.externalId) throw new NotFoundError("User", input.authUserId);
+		const orgUser = await this.repo.findOrgUser(orgId, person.id);
+		if (!orgUser) throw new NotFoundError("Person", person.id);
+		const inviter = await this.repo.findOrgUser(orgId, invite.invitedBy);
+		if (!inviter) {
+			this.logger.warn("invite accept refused: inviter left", {
+				orgId,
+				inviteId: invite.id
+			});
+			throw new InviteError("This invitation is no longer valid; ask for a new one");
+		}
+		await this.uow.run((scope) => this.checkAcceptance(scope, invite, orgUser, inviter.id));
+		await this.orgAdmin().grantMembership(org.externalId ?? org.id, person.externalId);
+		const accepted = await this.uow.run(async (scope) => {
+			const { organizations, roles, outbox } = scope;
+			const seen = (await roles.assignmentsOf(orgId, orgUser.id)).find((row) => row.contentId === null);
+			await roles.lock(lockKeys(orgId, [invite.roleKey, seen?.roleKey ?? "member"], [orgUser.id, inviter.id]));
+			const previousKey = await this.checkAcceptance(scope, invite, orgUser, inviter.id);
+			const activated = orgUser.status === "active" ? orgUser : await organizations.updateOrgUser(orgId, orgUser.id, { status: "active" });
+			if (!activated) throw new NotFoundError("Person", orgUser.id);
+			const acceptedInvite = await organizations.setInviteStatus(orgId, invite.id, "accepted");
 			if (!acceptedInvite) throw new NotFoundError("Invite", invite.id);
-			await outbox.append([organizationEvents.inviteAccepted.make({
-				orgId: invite.orgId,
+			await roles.setOrgRole(orgId, orgUser.id, invite.roleKey === "member" ? null : invite.roleKey, inviter.id);
+			const events = [organizationEvents.inviteAccepted.make({
+				orgId,
 				data: acceptedInvite
-			}), organizationEvents.studentLinked.make({
-				orgId: invite.orgId,
-				data: activated
-			})]);
+			})];
+			if (orgUser.status !== "active") {
+				events.push(organizationEvents.orgUserUpdated.make({
+					orgId,
+					data: {
+						...activated,
+						orgRole: { key: invite.roleKey }
+					}
+				}));
+				if (invite.roleKey === "member") events.push(organizationEvents.studentLinked.make({
+					orgId,
+					data: activated
+				}));
+			}
+			if (previousKey !== invite.roleKey) events.push(organizationEvents.roleAssigned.make({
+				orgId,
+				data: {
+					orgUserId: orgUser.id,
+					roleKey: invite.roleKey,
+					contentId: null,
+					contentType: null,
+					previousRoleKey: previousKey
+				},
+				metadata: { actorId: inviter.id }
+			}));
+			await outbox.append(events);
 			return activated;
 		});
+		await this.sessions().stampActiveOrganization(headers, orgId);
+		this.logger.info("invite accepted", {
+			orgId,
+			inviteId: invite.id,
+			orgUserId: orgUser.id
+		});
+		return accepted;
 	}
-	async acceptStaffInvite(invite, org, userId) {
-		const person = await this.people.getUserById(userId);
-		if (!person?.externalId) throw new NotFoundError("User", userId);
-		await this.orgAdmin().grantMembership(org.externalId ?? org.id, person.externalId, invite.role);
-		return this.uow.run(async ({ organizations, outbox }) => {
-			const orgUser = await organizations.findOrgUser(invite.orgId, userId);
-			if (!orgUser) throw new NotFoundError("Member", userId);
-			const acceptedInvite = await organizations.setInviteStatus(invite.orgId, invite.id, "accepted");
-			if (!acceptedInvite) throw new NotFoundError("Invite", invite.id);
-			await outbox.append([organizationEvents.inviteAccepted.make({
-				orgId: invite.orgId,
-				data: acceptedInvite
-			})]);
-			return orgUser;
+	async checkAcceptance(scope, invite, orgUser, inviterOrgUserId) {
+		const orgId = invite.orgId;
+		const stored = await scope.roles.storedRoles(orgId);
+		const role = this.resolveIn(stored, invite.roleKey);
+		if (!role || invite.roleKey === "owner") throw new InviteError("The invited role no longer exists");
+		const current = (await scope.roles.assignmentsOf(orgId, orgUser.id)).find((row) => row.contentId === null);
+		if (current?.roleKey === "owner") throw new InviteError("The owner's role changes only by transfer");
+		const currentRole = this.resolveIn(stored, current?.roleKey ?? "member");
+		const facts = await scope.roles.actorFacts(orgId, inviterOrgUserId);
+		const inviter = facts && facts.status === "active" ? resolvePermissions({
+			assignments: facts.assignments,
+			roles: this.roleMap(facts.storedRoles)
+		}) : null;
+		const needed = [
+			"people:write",
+			...role.permissions,
+			...currentRole?.permissions ?? []
+		];
+		const missing = inviter ? needed.filter((p) => !inviter.has(p)) : needed;
+		if (missing.length > 0) {
+			this.logger.warn("invite accept refused: inviter no longer holds the role", {
+				orgId,
+				inviteId: invite.id,
+				inviterOrgUserId,
+				missing
+			});
+			throw new InviteError("This invitation is no longer valid; ask for a new one");
+		}
+		return current?.roleKey ?? "member";
+	}
+	async listApiKeys(actor) {
+		actor.permissions.require("api_keys:read");
+		const { orgExternalId, userExternalId } = await this.externalIdsOf(actor);
+		const [keys, stored] = await Promise.all([this.apiKeys().list(orgExternalId, userExternalId), this.roles.storedRoles(actor.orgId)]);
+		const roles = this.roleMap(stored);
+		return keys.map((key) => keySummary(key, roles));
+	}
+	async listApiKeyRoles(actor) {
+		actor.permissions.require("api_keys:write");
+		const stored = await this.roles.storedRoles(actor.orgId);
+		return resolveOrgRoles(this.catalog, stored).filter((role) => role.permissions.every((permission) => actor.permissions.anywhere(permission))).map((role) => ({
+			key: role.key,
+			name: role.name,
+			description: role.description
+		}));
+	}
+	async createApiKey(input, actor) {
+		actor.permissions.require("api_keys:write");
+		if (actor.permissions.isToken()) {
+			this.logger.warn("api key refused: caller is a key or an app token", {
+				orgId: actor.orgId,
+				actorId: actor.id
+			});
+			throw new ForbiddenError("Sign in to create an API key");
+		}
+		const roles = this.roleMap(await this.roles.storedRoles(actor.orgId));
+		const role = roles.get(input.role);
+		if (!role) throw new NotFoundError("Role", input.role);
+		const missing = role.permissions.filter((permission) => !actor.permissions.anywhere(permission));
+		if (missing.length > 0) {
+			this.logger.warn("api key refused: role permissions not held", {
+				orgId: actor.orgId,
+				actorId: actor.id,
+				roleKey: role.key,
+				missing
+			});
+			throw new ForbiddenError(`You don't hold ${missing.join(", ")}`);
+		}
+		const { orgExternalId, userExternalId } = await this.externalIdsOf(actor);
+		const created = await this.apiKeys().create(orgExternalId, userExternalId, {
+			name: input.name,
+			roleKey: role.key,
+			expiresInDays: input.expiresInDays
 		});
+		this.logger.info("api key created", {
+			orgId: actor.orgId,
+			actorId: actor.id,
+			keyId: created.id,
+			roleKey: role.key
+		});
+		return {
+			...keySummary(created, roles),
+			key: created.key
+		};
 	}
-	getOrgUserById(orgId, id) {
-		return this.repo.findOrgUserById(orgId, id);
+	async deleteApiKey(keyId, actor) {
+		actor.permissions.require("api_keys:delete");
+		const { orgExternalId, userExternalId } = await this.externalIdsOf(actor);
+		await this.apiKeys().revoke(orgExternalId, userExternalId, keyId);
+		this.logger.info("api key revoked", {
+			orgId: actor.orgId,
+			actorId: actor.id,
+			keyId
+		});
 	}
-	async getOrgUsersByIds(orgId, ids) {
-		const unique = [...new Set(ids)];
-		return unique.length > 0 ? this.repo.findOrgUsersByIds(orgId, unique) : [];
+	async listConnectedApps(actor) {
+		const { orgExternalId, userExternalId } = await this.externalIdsOf(actor);
+		return this.apiKeys().listApps(orgExternalId, userExternalId);
 	}
-	async getOrgUser(orgId, userId) {
-		return this.repo.findOrgUser(orgId, userId);
+	async revokeConnectedApp(clientId, actor) {
+		const { orgExternalId, userExternalId } = await this.externalIdsOf(actor);
+		await this.apiKeys().revokeApp(orgExternalId, userExternalId, clientId);
+		this.logger.info("connected app revoked", {
+			orgId: actor.orgId,
+			actorId: actor.id,
+			clientId
+		});
 	}
-	async deleteOrgUser(orgId, actor, id) {
-		this.assertManagesUsers(actor, orgId);
-		const deleted = await this.uow.run(async ({ organizations, outbox }) => {
-			const orgUser = await organizations.findOrgUserById(orgId, id);
-			if (!orgUser || orgUser.role !== "student") throw new NotFoundError("Student", id);
-			const deletedUser = await organizations.deleteOrgUser(orgId, id);
-			if (!deletedUser) throw new NotFoundError("Student", id);
-			await outbox.append([organizationEvents.studentDeleted.make({
-				orgId,
-				data: orgUser
-			})]);
-			return deletedUser;
+	async createPlatformOrganization(input) {
+		const ownerExternalId = await this.platformAccountId();
+		const created = await this.orgAdmin().createOrganizationFor(ownerExternalId, {
+			name: input.name,
+			slug: input.slug
 		});
-		this.logger.info("org user deleted", {
-			orgId,
-			orgUserId: id
+		const found = await this.repo.findByExternalId(created.id);
+		if (!found) throw new NotFoundError("Organization", created.id);
+		const org = await this.repo.setMetadata(found.id, input.metadata ?? {});
+		const apiKey = await this.platformKey(org, ownerExternalId, "Platform");
+		this.logger.info("platform organization created", {
+			orgId: org.id,
+			slug: org.slug
 		});
-		return deleted;
+		return {
+			organization: {
+				id: org.id,
+				name: org.name,
+				slug: org.slug,
+				metadata: org.metadata,
+				createdAt: org.createdAt
+			},
+			apiKey
+		};
 	}
-	async getOrgUsersForUser(userId) {
-		return this.repo.findOrgUsersByUser(userId);
+	async createPlatformApiKey(orgId, name) {
+		const account = this.platformAccount();
+		const [org, person] = await Promise.all([this.repo.findById(orgId), this.people.getUserByEmail(account.email)]);
+		const orgUser = org && person ? await this.repo.findOrgUser(org.id, person.id) : null;
+		if (!org || !person?.externalId || orgUser?.status !== "active") throw new NotFoundError("Organization", orgId);
+		const apiKey = await this.platformKey(org, person.externalId, name);
+		this.logger.info("platform api key created", {
+			orgId: org.id,
+			keyId: apiKey.id
+		});
+		return apiKey;
 	}
-	async getById(id) {
-		return this.repo.findById(id);
+	isPlatformAccount(email) {
+		return this.platform !== void 0 && email.toLowerCase() === this.platform.email;
 	}
-	orgIds() {
-		return this.repo.listIds();
+	async platformKey(org, ownerExternalId, name) {
+		const [created, stored] = await Promise.all([this.apiKeys().create(org.externalId ?? org.id, ownerExternalId, {
+			name,
+			roleKey: OWNER_ROLE_KEY
+		}), this.roles.storedRoles(org.id)]);
+		return {
+			...keySummary(created, this.roleMap(stored)),
+			key: created.key
+		};
+	}
+	async platformAccountId() {
+		const account = this.platformAccount();
+		const person = await this.people.getUserByEmail(account.email);
+		if (person?.externalId) return person.externalId;
+		const { externalId } = await this.accounts().createAccount(account);
+		this.logger.info("platform account created", { userId: externalId });
+		return externalId;
 	}
-	async sendInviteEmail(invite, token) {
+	platformAccount() {
+		if (!this.platform) throw new Error("the platform account is not configured");
+		return this.platform;
+	}
+	accounts() {
+		if (!this.accountsPort) throw new Error("accounts are not configured");
+		return this.accountsPort();
+	}
+	async keysWithRole(orgId, roleKey) {
+		if (!this.apiKeysPort) return 0;
+		const org = await this.repo.findById(orgId);
+		return org ? this.apiKeysPort().countWithRole(org.externalId ?? org.id, roleKey) : 0;
+	}
+	async cleanUpAfterRemoval(orgId, orgUserId, person) {
+		const steps = [];
+		const org = await this.repo.findById(orgId);
+		if (person?.externalId && org) {
+			const orgExternalId = org.externalId ?? org.id;
+			const userExternalId = person.externalId;
+			steps.push(["membership", () => this.orgAdmin().removeMembership(orgExternalId, userExternalId)]);
+			steps.push(["api keys and tokens", () => this.apiKeys().revokeAllFor(orgExternalId, userExternalId)]);
+		}
+		steps.push(["profile photo", () => this.images.syncPublicImages(orgId, orgUserId, [])]);
+		if (person) steps.push(["pending invite", async () => {
+			const pending = await this.repo.findPendingInvite(orgId, person.email);
+			if (pending) await this.repo.setInviteStatus(orgId, pending.id, "canceled");
+		}]);
+		for (const [step, run] of steps) for (let attempt = 1; attempt <= 3; attempt++) try {
+			await run();
+			break;
+		} catch (err) {
+			this.logger.error("cleanup after removal failed", {
+				orgId,
+				orgUserId,
+				step,
+				attempt,
+				err: err instanceof Error ? err : new Error(String(err))
+			});
+		}
+	}
+	apiKeys() {
+		if (!this.apiKeysPort) throw new Error("api keys are not configured");
+		return this.apiKeysPort();
+	}
+	async externalIdsOf(actor) {
+		const [org, orgUser] = await Promise.all([this.repo.findById(actor.orgId), this.repo.findOrgUserById(actor.orgId, actor.id)]);
+		if (!org || !orgUser) throw new NotFoundError("Person", actor.id);
+		const person = await this.people.getUserById(orgUser.userId);
+		if (!person?.externalId) throw new NotFoundError("User", orgUser.userId);
+		return {
+			orgExternalId: org.externalId ?? org.id,
+			userExternalId: person.externalId
+		};
+	}
+	async pendingInviteOf(orgId, orgUserId) {
+		const orgUser = await this.repo.findOrgUserById(orgId, orgUserId);
+		if (!orgUser) throw new NotFoundError("Person", orgUserId);
+		const person = await this.people.getUserById(orgUser.userId);
+		const invite = person ? await this.repo.findPendingInvite(orgId, person.email) : null;
+		if (!invite) throw new NotFoundError("Invite", orgUserId);
+		const stored = await this.roles.storedRoles(orgId);
+		const role = this.resolveIn(stored, invite.roleKey);
+		if (!role) throw new NotFoundError("Role", invite.roleKey);
+		return {
+			invite,
+			role,
+			orgUser
+		};
+	}
+	async deleteOrgUserRow(orgId, orgUser) {
+		const held = await this.roles.assignmentsOf(orgId, orgUser.id);
+		return this.uow.run((scope) => this.deleteOrgUserIn(scope, orgId, orgUser, held, SYSTEM_ID));
+	}
+	async deleteOrgUserIn(scope, orgId, orgUser, held, actorId) {
+		const orgRoleKey = held.find((row) => row.contentId === null)?.roleKey ?? "member";
+		const deleted = await scope.organizations.deleteOrgUser(orgId, orgUser.id);
+		if (!deleted) return null;
+		const events = [organizationEvents.orgUserDeleted.make({
+			orgId,
+			data: {
+				...deleted,
+				orgRole: { key: orgRoleKey }
+			},
+			metadata: { actorId }
+		})];
+		if (orgRoleKey === "member") events.push(organizationEvents.studentDeleted.make({
+			orgId,
+			data: deleted
+		}));
+		await scope.outbox.append(events);
+		return deleted;
+	}
+	async sendInviteEmail(invite, token, role) {
 		if (!this.mailer || !this.inviteUrls) throw new Error("invite delivery is not configured (mailer / invite urls missing)");
-		const { email, role } = invite;
-		const isStudent = role === STUDENT_ROLE;
-		const inviteUrl = `${isStudent ? `${this.inviteUrls.studentPortalUrl}/welcome` : `${this.inviteUrls.adminAppUrl}/invite`}?${(isStudent ? new URLSearchParams({ token }) : new URLSearchParams({
+		const learner = role.permissions.length === 0;
+		const inviteUrl = `${learner ? `${this.inviteUrls.studentPortalUrl}/welcome` : `${this.inviteUrls.adminAppUrl}/invite`}?${(learner ? new URLSearchParams({ token }) : new URLSearchParams({
 			token,
-			email
+			email: invite.email
 		})).toString()}`;
-		if (role === "student") await this.mailer.send(email, "studentInvite", {
+		if (learner) await this.mailer.send(invite.email, "studentInvite", {
 			inviteUrl,
-			studentName: email
+			studentName: invite.email
 		});
-		else await this.mailer.send(email, "memberInvite", {
+		else await this.mailer.send(invite.email, "memberInvite", {
 			inviteUrl,
 			inviterName: "Your team",
-			role
+			role: role.name
 		});
 	}
-	async getByExternalId(externalId) {
-		return this.repo.findByExternalId(externalId);
+	toMember(row, nameOf) {
+		const orgRoleKey = row.status === "invited" && row.inviteRoleKey ? row.inviteRoleKey : row.orgRoleKey ?? "member";
+		return {
+			id: row.id,
+			firstName: row.firstName,
+			lastName: row.lastName,
+			email: row.email,
+			image: row.image,
+			orgRole: {
+				key: orgRoleKey,
+				name: nameOf(orgRoleKey)
+			},
+			isOwner: row.orgRoleKey === OWNER_ROLE_KEY,
+			items: row.items.map((item) => ({
+				...item,
+				roleName: nameOf(item.roleKey)
+			})),
+			status: row.status,
+			joinedAt: row.status === "active" ? row.joinedAt.toISOString() : null,
+			invitedAt: row.invitedAt ? row.invitedAt.toISOString() : null
+		};
 	}
-	async getBySlug(slug) {
-		return this.repo.findBySlug(slug);
+	async assignmentViews(orgId, orgUserId) {
+		const [rows, stored] = await Promise.all([this.roles.assignmentsOf(orgId, orgUserId), this.roles.storedRoles(orgId)]);
+		const roles = this.roleMap(stored);
+		const views = rows.map((row) => ({
+			orgUserId,
+			roleKey: row.roleKey,
+			roleName: roles.get(row.roleKey)?.name ?? row.roleKey,
+			contentId: row.contentId,
+			contentType: row.contentType
+		}));
+		if (!rows.some((row) => row.contentId === null)) views.unshift({
+			orgUserId,
+			roleKey: MEMBER_ROLE_KEY,
+			roleName: roles.get("member")?.name ?? "Member",
+			contentId: null,
+			contentType: null
+		});
+		return views;
 	}
-	staffOrgUserIds(orgId) {
-		return this.repo.findOrgUserIdsByRole(orgId, [...STAFF_ROLES]);
-	}
-	listMembers(orgId, query) {
-		return this.membersRepo.list(orgId, query);
-	}
-	async updateMemberRole(ctx, actor, id, role) {
-		this.assertManagesUsers(actor, ctx.orgId);
-		this.assertNotOwner(role, ctx.orgId);
-		const member = await this.membersRepo.findById(ctx.orgId, id);
-		if (!member) return this.promoteStudent(ctx, actor, id, role);
-		if (member.role === "owner") {
-			this.logger.warn("role change rejected: owner role immutable", {
-				orgId: ctx.orgId,
-				memberId: id
-			});
-			throw new OrganizationRuleError("The owner role cannot be reassigned");
-		}
-		if (member.kind !== "member" || !member.userExternalId) {
-			this.logger.warn("role change rejected: not an active member", {
-				orgId: ctx.orgId,
-				memberId: id
-			});
-			throw new OrganizationRuleError("Only active members can have their role changed");
-		}
-		if (role === "student") return this.demoteModerator(ctx, actor, member, member.userExternalId);
-		const userExternalId = member.userExternalId;
-		await this.asActor(actor, id, false, () => this.orgAdmin().updateRole(ctx, userExternalId, role));
-		const updated = await this.membersRepo.findById(ctx.orgId, id);
-		this.logger.info("member role updated", {
-			orgId: ctx.orgId,
-			memberId: id,
-			role
-		});
-		return updated ? toMember(updated) : null;
-	}
-	async demoteModerator(ctx, actor, member, userExternalId) {
-		if (member.role !== "moderator") {
-			this.logger.warn("role change rejected: only a moderator becomes a student", {
-				orgId: ctx.orgId,
-				memberId: member.id
-			});
-			throw new OrganizationRuleError("Only a moderator can be made a student");
-		}
-		await this.asActor(actor, member.id, true, () => this.orgAdmin().removeMember(ctx, userExternalId));
-		const orgUser = await this.repo.findOrgUserById(ctx.orgId, member.id);
-		if (!orgUser) return null;
-		this.logger.info("moderator made a student", {
-			orgId: ctx.orgId,
-			memberId: member.id
+	roleMap(stored) {
+		return new Map(resolveOrgRoles(this.catalog, stored).map((role) => [role.key, role]));
+	}
+	resolveIn(stored, key) {
+		return resolveRole(key, this.catalog, stored.find((row) => row.key === key));
+	}
+	async findRole(orgId, key) {
+		const role = this.resolveIn(await this.roles.storedRoles(orgId), key);
+		if (!role) throw new NotFoundError("Role", key);
+		return role;
+	}
+	async relockedActor(scope, actor) {
+		if (actor.id === SYSTEM_ID) return actor;
+		const facts = await scope.roles.actorFacts(actor.orgId, actor.id);
+		if (!facts || facts.status !== "active") throw new ForbiddenError("You are no longer an active member of this organization");
+		const fresh = resolvePermissions({
+			assignments: facts.assignments,
+			roles: this.roleMap(facts.storedRoles)
 		});
 		return {
-			...toMember(member),
-			role: orgUser.role,
-			status: orgUser.status
+			...actor,
+			permissions: {
+				has: (p, on) => fresh.has(p, on) && actor.permissions.has(p, on),
+				require: (p, on) => {
+					if (!(fresh.has(p, on) && actor.permissions.has(p, on))) throw new ForbiddenError(`You need ${p}`);
+				},
+				anywhere: (p) => fresh.anywhere(p) && actor.permissions.anywhere(p),
+				where: (p) => actor.permissions.where(p),
+				roleOn: (on) => fresh.roleOn(on),
+				isOwner: () => fresh.isOwner() && actor.permissions.isOwner(),
+				isToken: () => actor.permissions.isToken()
+			}
 		};
 	}
-	async promoteStudent(ctx, actor, id, role) {
-		const orgUser = await this.repo.findOrgUserById(ctx.orgId, id);
-		if (!orgUser) return null;
-		if (orgUser.role !== "student" || role === "student") {
-			this.logger.warn("role change rejected: not an active member", {
-				orgId: ctx.orgId,
-				memberId: id
+	itemPermissions(role, type) {
+		if (!role || !role.levels.includes(type)) return [];
+		return role.permissions.filter((p) => permissionAbout(p) === type);
+	}
+	assertHolds(actor, permissions) {
+		const missing = [...new Set(permissions)].filter((p) => !actor.permissions.has(p));
+		if (missing.length > 0) {
+			this.logger.warn("refused: editor lacks permissions", {
+				orgId: actor.orgId,
+				actorId: actor.id,
+				missing
 			});
-			throw new OrganizationRuleError("Only active members can have their role changed");
+			throw new ForbiddenError(`You need ${missing.join(", ")}`);
 		}
-		const person = await this.people.getUserById(orgUser.userId);
-		if (!person?.externalId) {
-			this.logger.warn("role change rejected: student has no account", {
-				orgId: ctx.orgId,
-				memberId: id
+	}
+	assertHoldsOn(actor, permissions, contentId) {
+		const missing = [...new Set(permissions)].filter((p) => !actor.permissions.has(p, contentId));
+		if (missing.length > 0) {
+			this.logger.warn("refused: editor lacks permissions on the item", {
+				orgId: actor.orgId,
+				actorId: actor.id,
+				contentId,
+				missing
 			});
-			throw new OrganizationRuleError("That student has not joined yet");
+			throw new ForbiddenError(`You need ${missing.join(", ")} there`);
 		}
-		const org = await this.repo.findById(ctx.orgId);
-		if (!org) return null;
-		const orgExternalId = org.externalId ?? org.id;
-		const userExternalId = person.externalId;
-		await this.asActor(actor, orgUser.id, false, async () => {
-			await this.orgAdmin().grantMembership(orgExternalId, userExternalId, role);
-			if (!await this.membersRepo.findById(ctx.orgId, id)) await this.orgAdmin().updateRole(ctx, userExternalId, role);
-		});
-		const updated = await this.membersRepo.findById(ctx.orgId, id);
-		if (!updated) {
-			this.logger.warn("role change rejected: membership not mirrored", {
-				orgId: ctx.orgId,
-				memberId: id
+	}
+	assertNotSelf(actor, orgUserId) {
+		if (actor.id === orgUserId) {
+			this.logger.warn("refused: changing own roles", {
+				orgId: actor.orgId,
+				orgUserId
 			});
-			throw new OrganizationRuleError("The role change did not take effect");
+			throw new ForbiddenError("You can't change your own roles");
 		}
-		this.logger.info("student promoted", {
-			orgId: ctx.orgId,
-			memberId: id,
-			role
-		});
-		return toMember(updated);
 	}
-	asActor(actor, orgUserId, demote, write) {
-		return this.memberWrites.run({
-			orgUserId,
-			actorOrgUserId: actor.id,
-			demote
-		}, write);
+	assertUniqueName(stored, key, name) {
+		const wanted = name.trim().toLowerCase();
+		if (wanted.length === 0) throw new OrganizationRuleError("A role needs a name");
+		if (resolveOrgRoles(this.catalog, stored).some((role) => role.key !== key && role.name.trim().toLowerCase() === wanted)) throw new OrganizationRuleError(`A role named ${name} already exists`);
 	}
-	memberWrite(orgUserId) {
-		const write = this.memberWrites.getStore();
-		return write?.orgUserId === orgUserId ? write : void 0;
+	parseLevels(levels) {
+		if (levels.length === 0) throw new OrganizationRuleError("A role needs at least one level");
+		for (const level of levels) if (!levelSchema.safeParse(level).success) throw new OrganizationRuleError(`Unknown level ${String(level)}`);
+		return [...new Set(levels)];
 	}
-	assertManagesUsers(actor, orgId) {
-		if (capability(actor.role, "manage_users") !== true) {
-			this.logger.warn("member write rejected: actor cannot manage users", {
-				orgId,
-				actorOrgUserId: actor.id
-			});
-			throw new ForbiddenError("Only an owner or admin can manage members");
-		}
+	assertFits(row) {
+		const base = this.catalog.get(row.base);
+		const levels = row.levels ?? base?.levels ?? [];
+		const misfits = Object.entries(row.permissions).filter(([, held]) => held).map(([p]) => p).filter((p) => !fitsLevels(p, levels));
+		if (misfits.length > 0) throw new OrganizationRuleError(`${misfits.join(", ")} ${misfits.length === 1 ? "doesn't" : "don't"} fit the role's levels`);
 	}
-	assertNotOwner(role, orgId) {
-		if (role === "owner") {
-			this.logger.warn("member write rejected: owner cannot be granted", { orgId });
-			throw new OrganizationRuleError("Ownership cannot be granted");
-		}
-	}
-	async removeMember(ctx, actor, id) {
-		this.assertManagesUsers(actor, ctx.orgId);
-		const member = await this.membersRepo.findById(ctx.orgId, id);
-		if (!member) return false;
-		if (member.role === "owner") {
-			this.logger.warn("member removal rejected: owner cannot be removed", {
-				orgId: ctx.orgId,
-				memberId: id
-			});
-			throw new OrganizationRuleError("The owner cannot be removed");
-		}
-		if (member.kind === "member" && member.userExternalId) await this.orgAdmin().removeMember(ctx, member.userExternalId);
-		else if (member.kind === "invite" && member.inviteId) {
-			const inviteId = member.inviteId;
-			await this.uow.run(async ({ organizations, outbox }) => {
-				const canceled = await organizations.setInviteStatus(ctx.orgId, inviteId, "canceled");
-				if (!canceled) throw new NotFoundError("Invite", inviteId);
-				await outbox.append([organizationEvents.inviteCanceled.make({
-					orgId: ctx.orgId,
-					data: canceled
-				})]);
-			});
-		}
-		this.logger.info("member removed", {
-			orgId: ctx.orgId,
-			memberId: id
-		});
-		return true;
+	async assertLevelsNotInUse(roles, orgId, before, after) {
+		const removed = before.levels.filter((level) => !after.levels.includes(level));
+		for (const level of removed) if (await roles.countHolders(orgId, before.key, level) > 0) throw new OrganizationRuleError(`${before.name} is given on ${level === "org" ? "the organization" : `a ${level}`}; remove those first`);
 	}
 };
 //#endregion