@headless-lms/server 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 mdwt
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,48 @@
+# @headless-lms/server
+
+The Fastify HTTP layer plus the composition root that wires `@headless-lms/core`
+(the hexagonal domain) to its adapters (`@headless-lms/adapter-db`,
+`-auth`, `-defaults`, and whatever an installation passes in). An installation
+(e.g. `apps/api`) composes it and owns only its config, entry point, and
+integration plugins. The `headless-lms` bin lives in `@headless-lms/cli`.
+
+## Usage
+
+```ts
+import { createContainer, buildServer } from '@headless-lms/server';
+
+const container = await createContainer(config, {
+  pluginsDir, // one folder per integration (directory name = integration id)
+});
+const app = await buildServer(config, container);
+await app.listen({ port: config.port, host: config.host });
+```
+
+Public surface (`src/index.ts`): `createContainer`, `buildServer`,
+`loadIntegrations`, the operational function `runMigrations` (re-exported from
+`@headless-lms/adapter-db`, which ships the `drizzle/` migration assets;
+`@headless-lms/cli` wraps it as `headless-lms migrate`), and the types
+installations need (`ServerConfig`, `Container`, `AdapterOverrides`, shared ports
+like `EmailSender` / `ObjectStorage`). Everything else is internal.
+
+## Layout
+
+```
+src/
+  app/          container.ts — wires adapters into core's services; integration
+                loader
+  http/         Fastify server; routes validated against the Zod schemas in
+                http/schemas — the source of truth for the OpenAPI spec and SDK
+```
+
+The domain lives in `@headless-lms/core` and the infrastructure in
+`adapters/*`; this package holds neither. Import boundaries between the packages
+are enforced by ESLint (`pnpm lint`).
+
+## Develop
+
+```bash
+pnpm --filter @headless-lms/server test        # vitest
+pnpm --filter @headless-lms/server typecheck   # tsc --noEmit (tsdown owns the build)
+pnpm db:generate                               # drizzle-kit generate in @headless-lms/adapter-db
+```

package/dist/app/container.d.ts

@@ -0,0 +1,124 @@
+import { PollingOutboxRelayConfig } from "@headless-lms/adapter-defaults/events/outbox-relay";
+import { LogLevel, PinoInstance, RequestLogContext } from "@headless-lms/adapter-defaults/logging";
+import { BetterAuth } from "@headless-lms/adapter-auth";
+import { ContentServiceImpl } from "@headless-lms/core/content";
+import { EntitlementsServiceImpl } from "@headless-lms/core/entitlements";
+import { ProgressServiceImpl } from "@headless-lms/core/progress";
+import { DiscussionServiceImpl } from "@headless-lms/core/discussion";
+import { IdentityServiceImpl, SessionAdmin } from "@headless-lms/core/identity";
+import { OrgAdmin, OrganizationServiceImpl } from "@headless-lms/core/organizations";
+import { AssetsServiceImpl } from "@headless-lms/core/assets";
+import { IntegrationsServiceImpl } from "@headless-lms/core/integrations";
+import { AutomationsServiceImpl } from "@headless-lms/core/automations";
+import { StudentsReportServiceImpl } from "@headless-lms/core/reporting/students";
+import { DashboardReportServiceImpl } from "@headless-lms/core/reporting/dashboard";
+import { LearnReportServiceImpl } from "@headless-lms/core/reporting/learn";
+import { Mailer } from "@headless-lms/core/shared/mailer";
+import { SettingsService } from "@headless-lms/core/shared/settings";
+import { AutomationEngine } from "@headless-lms/core/types";
+import { CredentialStore, EmailSender, Logger, ObjectStorage, OutboxRelay, TemplateContext, TemplateRenderer } from "@headless-lms/core/shared/ports";
+//#region src/app/container.d.ts
+/** Installation-supplied ports; an absent slot falls back to a fail-loudly stub. */
+interface AdapterOverrides {
+  email?: EmailSender;
+  storage?: ObjectStorage;
+  /** Resolves email templates to rendered content. Absent → fail-loudly stub. */
+  templates?: TemplateRenderer;
+  /** Durable automation engine. Absent → InlineAutomationEngine (in-process, one attempt per action). */
+  workflows?: AutomationEngine;
+}
+interface BuildContainerOptions {
+  /** Installation's plugins folder, scanned by loadIntegrations. Absent → no integrations. */
+  pluginsDir?: string;
+  adapters?: AdapterOverrides;
+}
+interface Config {
+  databaseUrl: string;
+  authBaseURL: string;
+  authSecret: string;
+  trustedOrigins: string[];
+  /** Branding threaded into every email template. Default: brandName "Headless LMS", baseUrl = adminAppUrl.
+   *  (studentPortalUrl is composed in from the top-level config field.) */
+  emailBranding?: Omit<TemplateContext, 'studentPortalUrl'>;
+  /** base64-encoded 32-byte key for the credential store (CREDENTIAL_STORE_KEY). */
+  credentialStoreKey: string;
+  /** Parent domain for cross-subdomain session cookies (e.g. ".example.com"); undefined → host-only cookie. */
+  cookieDomain?: string;
+  /** Mark session cookies Secure (set behind HTTPS / in production). */
+  secureCookies?: boolean;
+  /** Student portal origin — invite links for students, and the origin whose signups are invite-gated. */
+  studentPortalUrl: string;
+  /** Admin app origin — invite links for staff. */
+  adminAppUrl: string;
+  /** Transactional-outbox relay tuning. All optional — see OUTBOX_DEFAULTS. */
+  outbox?: OutboxConfig;
+  /** Log level for the process-wide logger (HTTP + domain + relay). Default "info". */
+  logging?: LoggingConfig;
+  /** Presigned URL lifetime for entitled download delivery, seconds. Mirrors
+   *  ServerConfig.deliveryExpirySeconds — createContainer threads it through. */
+  deliveryExpirySeconds: number;
+}
+/** Tuning for the transactional-outbox relay. Every field is optional; the
+ *  container resolves against OUTBOX_DEFAULTS. */
+interface OutboxConfig {
+  /** Master switch for the same-process relay. Default true. */
+  enabled?: boolean;
+  /** Idle delay between polls. Default 1000. */
+  pollIntervalMs?: number;
+  /** Max rows fetched/dispatched per tick. Default 100. */
+  batchSize?: number;
+}
+declare const OUTBOX_DEFAULTS: PollingOutboxRelayConfig;
+declare function resolveOutboxConfig(config?: OutboxConfig): PollingOutboxRelayConfig;
+/** Logging tuning. Optional; resolved against LOGGING_DEFAULTS. */
+interface LoggingConfig {
+  /** Minimum level emitted. Default "info". */
+  level?: LogLevel;
+}
+declare const LOGGING_DEFAULTS: Required<LoggingConfig>;
+declare function resolveLoggingConfig(config?: LoggingConfig): Required<LoggingConfig>;
+interface Container {
+  auth: BetterAuth;
+  orgProvider: OrgAdmin;
+  identity: IdentityServiceImpl;
+  organizations: OrganizationServiceImpl;
+  content: ContentServiceImpl;
+  entitlements: EntitlementsServiceImpl;
+  progress: ProgressServiceImpl;
+  discussion: DiscussionServiceImpl;
+  assets: AssetsServiceImpl;
+  integrations: IntegrationsServiceImpl;
+  automations: AutomationsServiceImpl;
+  /** Cross-cutting settings store. Not a context — a leaf every context may use;
+   *  inject `settings.for('<namespace>')` into a service, never the service itself. */
+  settings: SettingsService;
+  reporting: {
+    students: StudentsReportServiceImpl;
+    dashboard: DashboardReportServiceImpl;
+    learn: LearnReportServiceImpl;
+  };
+  storage: ObjectStorage;
+  mailer: Mailer;
+  /** Shared secure credential store — encrypted at rest, org-scoped, decrypt at point of use. */
+  credentials: CredentialStore;
+  /** The outbox relay — constructed but NEVER started by the container; the
+   *  installation's entry point starts it after listen (gen-openapi must not
+   *  poll). buildServer stops it onClose. */
+  outboxRelay: OutboxRelay;
+  /** The automation engine — constructed but NEVER started by the container;
+   *  the installation's entry point starts it after listen (gen-openapi must
+   *  not run a worker). buildServer stops it onClose. */
+  automationEngine: AutomationEngine;
+  /** Root logger port — components receive children bound with { name }. */
+  logger: Logger;
+  /** The raw pino root; buildServer hands it to Fastify so HTTP shares the stream. */
+  loggerInstance: PinoInstance;
+  /** Request-scoped log correlation; the HTTP layer enters it per request. */
+  requestContext: RequestLogContext;
+  /** Identity's session-write port; the auth adapter fulfils it. */
+  sessions: SessionAdmin;
+}
+declare function buildContainer(config: Config, options?: BuildContainerOptions): Promise<Container>;
+//#endregion
+export { AdapterOverrides, BuildContainerOptions, Config, Container, LOGGING_DEFAULTS, LoggingConfig, OUTBOX_DEFAULTS, OutboxConfig, buildContainer, resolveLoggingConfig, resolveOutboxConfig };
+//# sourceMappingURL=container.d.ts.map

package/dist/app/container.js

@@ -0,0 +1,312 @@
+import { loadIntegrations } from "./integrations.js";
+import { registerNotificationSubscribers } from "./notifications.js";
+import { DrizzleAssetsRepository, DrizzleAutomationRunsRepository, DrizzleAutomationsRepository, DrizzleConnectionsRepository, DrizzleContentRepository, DrizzleCredentialStore, DrizzleDashboardRepository, DrizzleDiscussionRepository, DrizzleEntitlementsRepository, DrizzleIdentityRepository, DrizzleLearnRepository, DrizzleMembersRepository, DrizzleOrganizationsRepository, DrizzleOutboxAppender, DrizzleOutboxStore, DrizzleProgressRepository, DrizzleSettingsRepository, DrizzleStudentsRepository, DrizzleUnitOfWork, createDb } from "@headless-lms/adapter-db";
+import { InMemoryEventBus } from "@headless-lms/adapter-defaults/events";
+import { PollingOutboxRelay } from "@headless-lms/adapter-defaults/events/outbox-relay";
+import { InlineAutomationEngine } from "@headless-lms/adapter-defaults/workflows";
+import { EmailAdapter, StubTemplateRenderer } from "@headless-lms/adapter-defaults/email";
+import { createRootLogger, requestLogContext } from "@headless-lms/adapter-defaults/logging";
+import { StorageAdapter } from "@headless-lms/adapter-defaults/storage";
+import { BetterAuth } from "@headless-lms/adapter-auth";
+import { ContentServiceImpl } from "@headless-lms/core/content";
+import { EntitlementsServiceImpl } from "@headless-lms/core/entitlements";
+import { ProgressServiceImpl } from "@headless-lms/core/progress";
+import { DiscussionServiceImpl } from "@headless-lms/core/discussion";
+import { IdentityServiceImpl } from "@headless-lms/core/identity";
+import { OrganizationServiceImpl, parseRole } from "@headless-lms/core/organizations";
+import { AssetsServiceImpl } from "@headless-lms/core/assets";
+import { IntegrationsServiceImpl } from "@headless-lms/core/integrations";
+import { AutomationsServiceImpl } from "@headless-lms/core/automations";
+import { StudentsReportServiceImpl } from "@headless-lms/core/reporting/students";
+import { DashboardReportServiceImpl } from "@headless-lms/core/reporting/dashboard";
+import { LearnReportServiceImpl } from "@headless-lms/core/reporting/learn";
+import { Mailer } from "@headless-lms/core/shared/mailer";
+import { SettingsService } from "@headless-lms/core/shared/settings";
+//#region src/app/container.ts
+const OUTBOX_DEFAULTS = {
+	enabled: true,
+	pollIntervalMs: 1e3,
+	batchSize: 100
+};
+function resolveOutboxConfig(config = {}) {
+	const overrides = Object.fromEntries(Object.entries(config).filter(([, value]) => value !== void 0));
+	return {
+		...OUTBOX_DEFAULTS,
+		...overrides
+	};
+}
+const LOGGING_DEFAULTS = { level: "info" };
+function resolveLoggingConfig(config = {}) {
+	return { level: config.level ?? LOGGING_DEFAULTS.level };
+}
+async function buildContainer(config, options) {
+	const { instance: loggerInstance, logger } = createRootLogger(resolveLoggingConfig(config.logging).level);
+	const contentLogger = logger.child({ name: "content" });
+	const entitlementsLogger = logger.child({ name: "entitlements" });
+	const progressLogger = logger.child({ name: "progress" });
+	const discussionLogger = logger.child({ name: "discussion" });
+	const assetsLogger = logger.child({ name: "assets" });
+	const integrationsLogger = logger.child({ name: "integrations" });
+	const automationsLogger = logger.child({ name: "automations" });
+	const reportingLogger = logger.child({ name: "reporting" });
+	const outboxLogger = logger.child({ name: "outbox" });
+	const db = createDb(config.databaseUrl);
+	const email = options?.adapters?.email ?? new EmailAdapter(logger.child({ name: "email" }));
+	const storage = options?.adapters?.storage ?? new StorageAdapter(logger.child({ name: "storage" }));
+	const templates = options?.adapters?.templates ?? new StubTemplateRenderer(logger.child({ name: "email" }));
+	const automationEngine = options?.adapters?.workflows ?? new InlineAutomationEngine();
+	const mailer = new Mailer(templates, email, {
+		...config.emailBranding ?? {
+			brandName: "Headless LMS",
+			baseUrl: config.adminAppUrl
+		},
+		studentPortalUrl: config.studentPortalUrl
+	});
+	const identityUoW = new DrizzleUnitOfWork(db, (tx) => ({
+		identity: new DrizzleIdentityRepository(tx, logger.child({ name: "identity" })),
+		outbox: new DrizzleOutboxAppender(tx, logger.child({ name: "identity" }))
+	}));
+	const identity = new IdentityServiceImpl({
+		repo: new DrizzleIdentityRepository(db, logger.child({ name: "identity_repo" })),
+		logger: logger.child({ name: "identity" }),
+		uow: identityUoW,
+		mailer
+	});
+	const organizationsUow = new DrizzleUnitOfWork(db, (tx) => ({
+		organizations: new DrizzleOrganizationsRepository(tx, logger.child({ name: "org" })),
+		outbox: new DrizzleOutboxAppender(tx, logger.child({ name: "org" }))
+	}));
+	const organizations = new OrganizationServiceImpl({
+		repo: new DrizzleOrganizationsRepository(db, logger.child({ name: "org" })),
+		membersRepo: new DrizzleMembersRepository(db, logger.child({ name: "org" })),
+		people: identity,
+		uow: organizationsUow,
+		logger: logger.child({ name: "org" }),
+		mailer,
+		inviteUrls: {
+			studentPortalUrl: config.studentPortalUrl,
+			adminAppUrl: config.adminAppUrl
+		}
+	});
+	const settings = new SettingsService(new DrizzleSettingsRepository(db, logger.child({ name: "settings" })));
+	const contentUow = new DrizzleUnitOfWork(db, (tx) => ({
+		content: new DrizzleContentRepository(tx, contentLogger),
+		outbox: new DrizzleOutboxAppender(tx, outboxLogger)
+	}));
+	const content = new ContentServiceImpl({
+		repo: new DrizzleContentRepository(db, contentLogger),
+		uow: contentUow,
+		settings,
+		logger: contentLogger
+	});
+	const entitlementsUow = new DrizzleUnitOfWork(db, (tx) => ({
+		entitlements: new DrizzleEntitlementsRepository(tx, entitlementsLogger),
+		outbox: new DrizzleOutboxAppender(tx, outboxLogger)
+	}));
+	const entitlements = new EntitlementsServiceImpl({
+		repo: new DrizzleEntitlementsRepository(db, entitlementsLogger),
+		uow: entitlementsUow,
+		logger: entitlementsLogger
+	});
+	const progressUow = new DrizzleUnitOfWork(db, (tx) => ({
+		progress: new DrizzleProgressRepository(tx, progressLogger),
+		outbox: new DrizzleOutboxAppender(tx, outboxLogger)
+	}));
+	const progress = new ProgressServiceImpl({
+		repo: new DrizzleProgressRepository(db, progressLogger),
+		content,
+		uow: progressUow,
+		logger: progressLogger
+	});
+	const discussion = new DiscussionServiceImpl({
+		repo: new DrizzleDiscussionRepository(db, discussionLogger),
+		access: entitlements,
+		content,
+		uow: new DrizzleUnitOfWork(db, (tx) => ({
+			discussion: new DrizzleDiscussionRepository(tx, discussionLogger),
+			outbox: new DrizzleOutboxAppender(tx, outboxLogger)
+		})),
+		settings,
+		logger: discussionLogger
+	});
+	const assets = new AssetsServiceImpl({
+		storage,
+		repo: new DrizzleAssetsRepository(db, assetsLogger),
+		uow: new DrizzleUnitOfWork(db, (tx) => ({
+			assets: new DrizzleAssetsRepository(tx, assetsLogger),
+			outbox: new DrizzleOutboxAppender(tx, outboxLogger)
+		})),
+		logger: assetsLogger
+	});
+	const reporting = {
+		students: new StudentsReportServiceImpl({
+			repo: new DrizzleStudentsRepository(db, reportingLogger),
+			logger: reportingLogger
+		}),
+		dashboard: new DashboardReportServiceImpl({
+			repo: new DrizzleDashboardRepository(db, reportingLogger),
+			logger: reportingLogger
+		}),
+		learn: new LearnReportServiceImpl({
+			reader: new DrizzleLearnRepository(db, reportingLogger),
+			content,
+			progress,
+			assets,
+			deliveryExpirySeconds: config.deliveryExpirySeconds,
+			logger: reportingLogger
+		})
+	};
+	const credentialStore = new DrizzleCredentialStore(db, config.credentialStoreKey, integrationsLogger);
+	const integrationsRegistry = await loadIntegrations(options?.pluginsDir, integrationsLogger);
+	const integrationsUow = new DrizzleUnitOfWork(db, (tx) => ({
+		connections: new DrizzleConnectionsRepository(tx, integrationsLogger),
+		credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, integrationsLogger),
+		outbox: new DrizzleOutboxAppender(tx, outboxLogger)
+	}));
+	const integrations = new IntegrationsServiceImpl({
+		registry: integrationsRegistry,
+		repo: new DrizzleConnectionsRepository(db, integrationsLogger),
+		uow: integrationsUow,
+		credentials: credentialStore,
+		logger: integrationsLogger
+	});
+	const automationsUow = new DrizzleUnitOfWork(db, (tx) => ({
+		automations: new DrizzleAutomationsRepository(tx, automationsLogger),
+		runs: new DrizzleAutomationRunsRepository(tx, automationsLogger),
+		outbox: new DrizzleOutboxAppender(tx, automationsLogger)
+	}));
+	const mailerLookups = {
+		orgUserEmail: async (orgId, orgUserId) => (await reporting.students.get(orgId, orgUserId))?.email ?? null,
+		contentInfo: async (orgId, contentId) => {
+			const course = await content.getCourse(orgId, contentId);
+			if (course) return {
+				id: course.id,
+				title: course.title
+			};
+			const download = await content.getDownload(orgId, contentId);
+			return download ? {
+				id: download.id,
+				title: download.title
+			} : null;
+		}
+	};
+	const automations = new AutomationsServiceImpl({
+		repo: new DrizzleAutomationsRepository(db, automationsLogger),
+		runsRepo: new DrizzleAutomationRunsRepository(db, automationsLogger),
+		uow: automationsUow,
+		engine: automationEngine,
+		mailer,
+		lookups: mailerLookups,
+		integrations,
+		logger: automationsLogger
+	});
+	automationEngine.register(automations);
+	const eventBus = new InMemoryEventBus();
+	registerNotificationSubscribers(eventBus, mailer, mailerLookups);
+	eventBus.subscribeAll((event) => automations.handle(event));
+	const outboxConfig = resolveOutboxConfig(config.outbox);
+	const outboxRelay = new PollingOutboxRelay(new DrizzleOutboxStore(db, outboxLogger), eventBus, outboxConfig, outboxLogger);
+	const auth = new BetterAuth({
+		db,
+		baseUrl: config.authBaseURL,
+		secret: config.authSecret,
+		trustedOrigins: config.trustedOrigins,
+		hooks: {
+			sendResetPassword: async (data) => {
+				await identity.sendPasswordReset({
+					email: data.user.email,
+					url: ""
+				});
+			},
+			sendMagicLink: async ({ email, url }) => {
+				await identity.sendMagicLink({
+					email,
+					url
+				});
+			},
+			beforeUserCreate: async (user) => {
+				const { email, name } = user;
+				const [firstName, lastName] = name.split(" ");
+				const domainUser = await identity.linkOrCreateUser({
+					email,
+					...firstName !== void 0 && { firstName },
+					...lastName !== void 0 && { lastName }
+				});
+				return { data: {
+					...user,
+					id: domainUser.id
+				} };
+			},
+			beforeCreateSession: async (session) => {
+				const person = await identity.getUserByExternalId(session.userId);
+				if (!person) return;
+				const orgs = await organizations.getOrgUsersForUser(person.id);
+				if (orgs.length !== 1) return;
+				const org = await organizations.getById(orgs[0].orgId);
+				if (!org) return;
+				return { data: {
+					...session,
+					activeOrganizationId: org.id
+				} };
+			},
+			beforeCreateOrganization: async ({ organization: org, user: baUser }) => {
+				const domainOrg = await organizations.createOrganization({
+					ownerId: baUser.id,
+					...org,
+					logo: org.logo ?? void 0
+				});
+				return { data: {
+					...org,
+					id: domainOrg.id
+				} };
+			},
+			beforeUpdateOrganization: async ({ organization }) => {
+				await organizations.updateOrganization(organization.id, organization);
+			},
+			beforeDeleteOrganization: async ({ organization }) => {
+				await organizations.deleteOrganization(organization.id);
+			},
+			beforeAddMember: async ({ member }) => {
+				await organizations.addOrgUser({
+					orgId: member.organizationId,
+					userId: member.userId,
+					role: parseRole(member.role)
+				});
+			},
+			beforeRemoveMember: async ({ member }) => {
+				await organizations.removeOrgUser(member.organizationId, member.userId);
+			}
+		},
+		logger: logger.child({ name: "auth" }),
+		cookieDomain: config.cookieDomain,
+		secureCookies: config.secureCookies
+	});
+	return {
+		auth,
+		identity,
+		organizations,
+		orgProvider: auth,
+		content,
+		entitlements,
+		progress,
+		discussion,
+		assets,
+		integrations,
+		automations,
+		settings,
+		reporting,
+		storage,
+		mailer,
+		credentials: credentialStore,
+		outboxRelay,
+		automationEngine,
+		logger,
+		loggerInstance,
+		requestContext: requestLogContext,
+		sessions: auth
+	};
+}
+//#endregion
+export { LOGGING_DEFAULTS, OUTBOX_DEFAULTS, buildContainer, resolveLoggingConfig, resolveOutboxConfig };
+
+//# sourceMappingURL=container.js.map

package/dist/app/container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.js","names":[],"sources":["../../src/app/container.ts"],"sourcesContent":["// Wires adapters + services in dependency order. Starts nothing.\nimport {\n  createDb,\n  DrizzleAssetsRepository,\n  DrizzleAutomationRunsRepository,\n  DrizzleAutomationsRepository,\n  DrizzleConnectionsRepository,\n  DrizzleContentRepository,\n  DrizzleCredentialStore,\n  DrizzleDashboardRepository,\n  DrizzleDiscussionRepository,\n  DrizzleEntitlementsRepository,\n  DrizzleIdentityRepository,\n  DrizzleLearnRepository,\n  DrizzleMembersRepository,\n  DrizzleOrganizationsRepository,\n  DrizzleOutboxAppender,\n  DrizzleOutboxStore,\n  DrizzleProgressRepository,\n  DrizzleSettingsRepository,\n  DrizzleStudentsRepository,\n  DrizzleUnitOfWork,\n} from '@headless-lms/adapter-db';\nimport { InMemoryEventBus } from '@headless-lms/adapter-defaults/events';\nimport {\n  PollingOutboxRelay,\n  type PollingOutboxRelayConfig,\n} from '@headless-lms/adapter-defaults/events/outbox-relay';\nimport { InlineAutomationEngine } from '@headless-lms/adapter-defaults/workflows';\nimport { EmailAdapter, StubTemplateRenderer } from '@headless-lms/adapter-defaults/email';\nimport {\n  createRootLogger,\n  type LogLevel,\n  type PinoInstance,\n  requestLogContext,\n  type RequestLogContext,\n} from '@headless-lms/adapter-defaults/logging';\nimport { StorageAdapter } from '@headless-lms/adapter-defaults/storage';\nimport { BetterAuth } from '@headless-lms/adapter-auth';\n\nimport { ContentServiceImpl } from '@headless-lms/core/content';\nimport { EntitlementsServiceImpl } from '@headless-lms/core/entitlements';\nimport { ProgressServiceImpl } from '@headless-lms/core/progress';\nimport { DiscussionServiceImpl } from '@headless-lms/core/discussion';\nimport { IdentityServiceImpl, type SessionAdmin } from '@headless-lms/core/identity';\nimport { type OrgAdmin, OrganizationServiceImpl, parseRole } from '@headless-lms/core/organizations';\nimport { AssetsServiceImpl } from '@headless-lms/core/assets';\nimport { IntegrationsServiceImpl } from '@headless-lms/core/integrations';\nimport { AutomationsServiceImpl } from '@headless-lms/core/automations';\nimport { loadIntegrations } from './integrations.js';\nimport { registerNotificationSubscribers } from './notifications.js';\nimport { StudentsReportServiceImpl } from '@headless-lms/core/reporting/students';\nimport { DashboardReportServiceImpl } from '@headless-lms/core/reporting/dashboard';\nimport { LearnReportServiceImpl } from '@headless-lms/core/reporting/learn';\nimport { Mailer, type MailerLookups } from '@headless-lms/core/shared/mailer';\nimport { SettingsService } from '@headless-lms/core/shared/settings';\n\nimport type {\n  CredentialStore,\n  EmailSender,\n  Logger,\n  ObjectStorage,\n  OutboxRelay,\n  TemplateContext,\n  TemplateRenderer,\n} from '@headless-lms/core/shared/ports';\nimport type { AutomationEngine } from '@headless-lms/core/types';\n\n/** Installation-supplied ports; an absent slot falls back to a fail-loudly stub. */\nexport interface AdapterOverrides {\n  email?: EmailSender;\n  storage?: ObjectStorage;\n  /** Resolves email templates to rendered content. Absent → fail-loudly stub. */\n  templates?: TemplateRenderer;\n  /** Durable automation engine. Absent → InlineAutomationEngine (in-process, one attempt per action). */\n  workflows?: AutomationEngine;\n}\n\nexport interface BuildContainerOptions {\n  /** Installation's plugins folder, scanned by loadIntegrations. Absent → no integrations. */\n  pluginsDir?: string;\n  adapters?: AdapterOverrides;\n}\n\nexport interface Config {\n  databaseUrl: string;\n  authBaseURL: string;\n  authSecret: string;\n  trustedOrigins: string[];\n  /** Branding threaded into every email template. Default: brandName \"Headless LMS\", baseUrl = adminAppUrl.\n   *  (studentPortalUrl is composed in from the top-level config field.) */\n  emailBranding?: Omit<TemplateContext, 'studentPortalUrl'>;\n  /** base64-encoded 32-byte key for the credential store (CREDENTIAL_STORE_KEY). */\n  credentialStoreKey: string;\n  /** Parent domain for cross-subdomain session cookies (e.g. \".example.com\"); undefined → host-only cookie. */\n  cookieDomain?: string;\n  /** Mark session cookies Secure (set behind HTTPS / in production). */\n  secureCookies?: boolean;\n  /** Student portal origin — invite links for students, and the origin whose signups are invite-gated. */\n  studentPortalUrl: string;\n  /** Admin app origin — invite links for staff. */\n  adminAppUrl: string;\n  /** Transactional-outbox relay tuning. All optional — see OUTBOX_DEFAULTS. */\n  outbox?: OutboxConfig;\n  /** Log level for the process-wide logger (HTTP + domain + relay). Default \"info\". */\n  logging?: LoggingConfig;\n  /** Presigned URL lifetime for entitled download delivery, seconds. Mirrors\n   *  ServerConfig.deliveryExpirySeconds — createContainer threads it through. */\n  deliveryExpirySeconds: number;\n}\n\n/** Tuning for the transactional-outbox relay. Every field is optional; the\n *  container resolves against OUTBOX_DEFAULTS. */\nexport interface OutboxConfig {\n  /** Master switch for the same-process relay. Default true. */\n  enabled?: boolean;\n  /** Idle delay between polls. Default 1000. */\n  pollIntervalMs?: number;\n  /** Max rows fetched/dispatched per tick. Default 100. */\n  batchSize?: number;\n}\n\nexport const OUTBOX_DEFAULTS: PollingOutboxRelayConfig = {\n  enabled: true,\n  pollIntervalMs: 1000,\n  batchSize: 100,\n};\n\nexport function resolveOutboxConfig(config: OutboxConfig = {}): PollingOutboxRelayConfig {\n  const overrides = Object.fromEntries(\n    Object.entries(config).filter(([, value]) => value !== undefined),\n  );\n  return { ...OUTBOX_DEFAULTS, ...overrides };\n}\n\n/** Logging tuning. Optional; resolved against LOGGING_DEFAULTS. */\nexport interface LoggingConfig {\n  /** Minimum level emitted. Default \"info\". */\n  level?: LogLevel;\n}\n\nexport const LOGGING_DEFAULTS: Required<LoggingConfig> = { level: 'info' };\n\nexport function resolveLoggingConfig(config: LoggingConfig = {}): Required<LoggingConfig> {\n  return { level: config.level ?? LOGGING_DEFAULTS.level };\n}\n\nexport interface Container {\n  auth: BetterAuth;\n  // Org Provider\n  orgProvider: OrgAdmin;\n\n  // Domains\n  identity: IdentityServiceImpl;\n  organizations: OrganizationServiceImpl;\n  content: ContentServiceImpl;\n  entitlements: EntitlementsServiceImpl;\n  progress: ProgressServiceImpl;\n  discussion: DiscussionServiceImpl;\n  assets: AssetsServiceImpl;\n  integrations: IntegrationsServiceImpl;\n  automations: AutomationsServiceImpl;\n  /** Cross-cutting settings store. Not a context — a leaf every context may use;\n   *  inject `settings.for('<namespace>')` into a service, never the service itself. */\n  settings: SettingsService;\n  // Reporting read layer (composed cross-context reads; owns no domain rules).\n  reporting: {\n    students: StudentsReportServiceImpl;\n    dashboard: DashboardReportServiceImpl;\n    learn: LearnReportServiceImpl;\n  };\n  storage: ObjectStorage;\n  mailer: Mailer;\n  /** Shared secure credential store — encrypted at rest, org-scoped, decrypt at point of use. */\n  credentials: CredentialStore;\n  /** The outbox relay — constructed but NEVER started by the container; the\n   *  installation's entry point starts it after listen (gen-openapi must not\n   *  poll). buildServer stops it onClose. */\n  outboxRelay: OutboxRelay;\n  /** The automation engine — constructed but NEVER started by the container;\n   *  the installation's entry point starts it after listen (gen-openapi must\n   *  not run a worker). buildServer stops it onClose. */\n  automationEngine: AutomationEngine;\n  /** Root logger port — components receive children bound with { name }. */\n  logger: Logger;\n  /** The raw pino root; buildServer hands it to Fastify so HTTP shares the stream. */\n  loggerInstance: PinoInstance;\n  /** Request-scoped log correlation; the HTTP layer enters it per request. */\n  requestContext: RequestLogContext;\n  /** Identity's session-write port; the auth adapter fulfils it. */\n  sessions: SessionAdmin;\n}\n\nexport async function buildContainer(\n  config: Config,\n  options?: BuildContainerOptions,\n): Promise<Container> {\n  const { instance: loggerInstance, logger } = createRootLogger(\n    resolveLoggingConfig(config.logging).level,\n  );\n  // One child per domain — a context's service and repositories share it.\n\n  const contentLogger = logger.child({ name: 'content' });\n  const entitlementsLogger = logger.child({ name: 'entitlements' });\n  const progressLogger = logger.child({ name: 'progress' });\n  const discussionLogger = logger.child({ name: 'discussion' });\n  const assetsLogger = logger.child({ name: 'assets' });\n  const integrationsLogger = logger.child({ name: 'integrations' });\n  const automationsLogger = logger.child({ name: 'automations' });\n  const reportingLogger = logger.child({ name: 'reporting' });\n  const outboxLogger = logger.child({ name: 'outbox' });\n\n  // Outbound adapters\n  const db = createDb(config.databaseUrl);\n  const email = options?.adapters?.email ?? new EmailAdapter(logger.child({ name: 'email' }));\n  const storage: ObjectStorage =\n    options?.adapters?.storage ?? new StorageAdapter(logger.child({ name: 'storage' }));\n  const templates =\n    options?.adapters?.templates ?? new StubTemplateRenderer(logger.child({ name: 'email' }));\n  const automationEngine: AutomationEngine =\n    options?.adapters?.workflows ?? new InlineAutomationEngine();\n  const mailer = new Mailer(templates, email, {\n    ...(config.emailBranding ?? { brandName: 'Headless LMS', baseUrl: config.adminAppUrl }),\n    studentPortalUrl: config.studentPortalUrl,\n  });\n\n  /*\n   * Identity\n   */\n  const identityUoW = new DrizzleUnitOfWork(db, (tx) => ({\n    identity: new DrizzleIdentityRepository(tx, logger.child({ name: 'identity' })),\n    outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'identity' })),\n  }));\n  const identity = new IdentityServiceImpl({\n    repo: new DrizzleIdentityRepository(db, logger.child({ name: 'identity_repo' })),\n    logger: logger.child({ name: 'identity' }),\n    uow: identityUoW,\n    mailer,\n  });\n\n  /*\n   * Organization\n   */\n  const organizationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    organizations: new DrizzleOrganizationsRepository(tx, logger.child({ name: 'org' })),\n    outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'org' })),\n  }));\n  const organizations = new OrganizationServiceImpl({\n    repo: new DrizzleOrganizationsRepository(db, logger.child({ name: 'org' })),\n    membersRepo: new DrizzleMembersRepository(db, logger.child({ name: 'org' })),\n    people: identity,\n    uow: organizationsUow,\n    logger: logger.child({ name: 'org' }),\n    mailer,\n    inviteUrls: { studentPortalUrl: config.studentPortalUrl, adminAppUrl: config.adminAppUrl },\n  });\n\n  /*\n   * Settings\n   */\n  const settings = new SettingsService(\n    new DrizzleSettingsRepository(db, logger.child({ name: 'settings' })),\n  );\n  // Content: reads on the root db; course writes + outbox append in one tx.\n  const contentUow = new DrizzleUnitOfWork(db, (tx) => ({\n    content: new DrizzleContentRepository(tx, contentLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const content = new ContentServiceImpl({\n    repo: new DrizzleContentRepository(db, contentLogger),\n    uow: contentUow,\n    settings,\n    logger: contentLogger,\n  });\n  // Entitlements: reads on the root db; writes + outbox append in one tx.\n  const entitlementsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    entitlements: new DrizzleEntitlementsRepository(tx, entitlementsLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const entitlements = new EntitlementsServiceImpl({\n    repo: new DrizzleEntitlementsRepository(db, entitlementsLogger),\n    uow: entitlementsUow,\n    logger: entitlementsLogger,\n  });\n  // Progress: report writes + outbox append in one tx; content supplies the\n  // structure and completion rules the service evaluates against.\n  const progressUow = new DrizzleUnitOfWork(db, (tx) => ({\n    progress: new DrizzleProgressRepository(tx, progressLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const progress = new ProgressServiceImpl({\n    repo: new DrizzleProgressRepository(db, progressLogger),\n    content,\n    uow: progressUow,\n    logger: progressLogger,\n  });\n\n  const discussion = new DiscussionServiceImpl({\n    repo: new DrizzleDiscussionRepository(db, discussionLogger),\n    access: entitlements,\n    content: content,\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      discussion: new DrizzleDiscussionRepository(tx, discussionLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    settings,\n    logger: discussionLogger,\n  });\n  const assets = new AssetsServiceImpl({\n    storage,\n    repo: new DrizzleAssetsRepository(db, assetsLogger),\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      assets: new DrizzleAssetsRepository(tx, assetsLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    logger: assetsLogger,\n  });\n\n  const reporting = {\n    students: new StudentsReportServiceImpl({\n      repo: new DrizzleStudentsRepository(db, reportingLogger),\n      logger: reportingLogger,\n    }),\n    dashboard: new DashboardReportServiceImpl({\n      repo: new DrizzleDashboardRepository(db, reportingLogger),\n      logger: reportingLogger,\n    }),\n    learn: new LearnReportServiceImpl({\n      reader: new DrizzleLearnRepository(db, reportingLogger),\n      content,\n      progress,\n      assets,\n      deliveryExpirySeconds: config.deliveryExpirySeconds,\n      logger: reportingLogger,\n    }),\n  };\n\n  const credentialStore = new DrizzleCredentialStore(\n    db,\n    config.credentialStoreKey,\n    integrationsLogger,\n  );\n  // The integrations this deployment supports: the installation's declared\n  // plugins folder (directory name = integration id), loaded at startup.\n  // Connect/configure reject undeclared ids and validate config with the\n  // integration's own schema. No folder → no integrations.\n  const integrationsRegistry = await loadIntegrations(options?.pluginsDir, integrationsLogger);\n  // Integrations: credential + connection writes + outbox append in one tx\n  // (a tx-bound credential store instance shares the scope's transaction).\n  const integrationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    connections: new DrizzleConnectionsRepository(tx, integrationsLogger),\n    credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, integrationsLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const integrations = new IntegrationsServiceImpl({\n    registry: integrationsRegistry,\n    repo: new DrizzleConnectionsRepository(db, integrationsLogger),\n    uow: integrationsUow,\n    credentials: credentialStore,\n    logger: integrationsLogger,\n  });\n\n  // Automations: run writes + outbox append in one tx; the engine drives\n  // execution (register below), integrations supplies the loaded\n  // integrations' actions for `available`.\n  const automationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    automations: new DrizzleAutomationsRepository(tx, automationsLogger),\n    runs: new DrizzleAutomationRunsRepository(tx, automationsLogger),\n    outbox: new DrizzleOutboxAppender(tx, automationsLogger),\n  }));\n  // Emails triggered by row-shaped events resolve their recipient and content\n  // details at send time — the event carries ids only.\n  const mailerLookups: MailerLookups = {\n    orgUserEmail: async (orgId, orgUserId) =>\n      (await reporting.students.get(orgId, orgUserId))?.email ?? null,\n    contentInfo: async (orgId, contentId) => {\n      const course = await content.getCourse(orgId, contentId);\n      if (course) {\n        return { id: course.id, title: course.title };\n      }\n      const download = await content.getDownload(orgId, contentId);\n      return download ? { id: download.id, title: download.title } : null;\n    },\n  };\n\n  const automations = new AutomationsServiceImpl({\n    repo: new DrizzleAutomationsRepository(db, automationsLogger),\n    runsRepo: new DrizzleAutomationRunsRepository(db, automationsLogger),\n    uow: automationsUow,\n    engine: automationEngine,\n    mailer,\n    lookups: mailerLookups,\n    integrations,\n    logger: automationsLogger,\n  });\n  automationEngine.register(automations);\n\n  const eventBus = new InMemoryEventBus();\n  registerNotificationSubscribers(eventBus, mailer, mailerLookups);\n  // handle() never throws — the EventBus fans out to every subscriber\n  // sequentially, and a rejection here would break sibling subscribers.\n  eventBus.subscribeAll((event) => automations.handle(event));\n  const outboxConfig = resolveOutboxConfig(config.outbox);\n  const outboxRelay = new PollingOutboxRelay(\n    new DrizzleOutboxStore(db, outboxLogger),\n    eventBus,\n    outboxConfig,\n    outboxLogger,\n  );\n\n  /*\n   * Auth Adapter\n   */\n  const auth = new BetterAuth({\n    db,\n    baseUrl: config.authBaseURL,\n    secret: config.authSecret,\n    trustedOrigins: config.trustedOrigins,\n    hooks: {\n      sendResetPassword: async (data) => {\n        await identity.sendPasswordReset({\n          email: data.user.email,\n          url: '',\n        });\n      },\n      sendMagicLink: async ({ email, url }) => {\n        await identity.sendMagicLink({\n          email,\n          url,\n        });\n      },\n      beforeUserCreate: async (user) => {\n        const { email, name } = user;\n        const [firstName, lastName] = name.split(' ');\n        // Better Auth has not minted an id yet — the id returned below becomes\n        // its account id. A person provisioned at invite time is linked instead of re-created.\n        const domainUser = await identity.linkOrCreateUser({\n          email,\n          ...(firstName !== undefined && { firstName }),\n          ...(lastName !== undefined && { lastName }),\n        });\n\n        return {\n          data: {\n            ...user,\n            id: domainUser.id,\n          },\n        };\n      },\n      beforeCreateSession: async (session) => {\n        const person = await identity.getUserByExternalId(session.userId);\n        if (!person) {\n          return;\n        }\n        const orgs = await organizations.getOrgUsersForUser(person.id);\n        if (orgs.length !== 1) {\n          return;\n        }\n        // TODO - fix, why default to the first?\n        const org = await organizations.getById(orgs[0]!.orgId);\n        if (!org) {\n          return;\n        }\n\n        return { data: { ...session, activeOrganizationId: org.id } };\n      },\n      /*\n       * We're making sure the domain org creates and using the same ID for better-auth org ID.\n       */\n      beforeCreateOrganization: async ({ organization: org, user: baUser }) => {\n        const domainOrg = await organizations.createOrganization({\n          ownerId: baUser.id,\n          ...org,\n          logo: org.logo ?? undefined,\n        });\n        return { data: { ...org, id: domainOrg.id } };\n      },\n      beforeUpdateOrganization: async ({ organization }) => {\n        await organizations.updateOrganization(organization.id, organization);\n      },\n      beforeDeleteOrganization: async ({ organization }) => {\n        await organizations.deleteOrganization(organization.id);\n      },\n      beforeAddMember: async ({ member }) => {\n        await organizations.addOrgUser({\n          orgId: member.organizationId,\n          userId: member.userId,\n          role: parseRole(member.role),\n        });\n      },\n      beforeRemoveMember: async ({ member }) => {\n        await organizations.removeOrgUser(member.organizationId, member.userId);\n      },\n    },\n    logger: logger.child({ name: 'auth' }),\n    cookieDomain: config.cookieDomain,\n    secureCookies: config.secureCookies,\n  });\n\n  return {\n    auth,\n    identity,\n    organizations,\n    // Better Auth owns org writes; the same instance fulfils the OrgAdmin port.\n    orgProvider: auth,\n    content,\n    entitlements,\n    progress,\n    discussion,\n    assets,\n    integrations,\n    automations,\n    settings,\n    reporting,\n    storage,\n    mailer,\n    credentials: credentialStore,\n    outboxRelay,\n    automationEngine,\n    logger,\n    loggerInstance,\n    requestContext: requestLogContext,\n    // Better Auth owns the session store; the same instance fulfils SessionAdmin.\n    sessions: auth,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA0HA,MAAa,kBAA4C;CACvD,SAAS;CACT,gBAAgB;CAChB,WAAW;AACb;AAEA,SAAgB,oBAAoB,SAAuB,CAAC,GAA6B;CACvF,MAAM,YAAY,OAAO,YACvB,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAClE;CACA,OAAO;EAAE,GAAG;EAAiB,GAAG;CAAU;AAC5C;AAQA,MAAa,mBAA4C,EAAE,OAAO,OAAO;AAEzE,SAAgB,qBAAqB,SAAwB,CAAC,GAA4B;CACxF,OAAO,EAAE,OAAO,OAAO,SAAS,iBAAiB,MAAM;AACzD;AAgDA,eAAsB,eACpB,QACA,SACoB;CACpB,MAAM,EAAE,UAAU,gBAAgB,WAAW,iBAC3C,qBAAqB,OAAO,OAAO,CAAC,CAAC,KACvC;CAGA,MAAM,gBAAgB,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC;CACtD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,iBAAiB,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;CACxD,MAAM,mBAAmB,OAAO,MAAM,EAAE,MAAM,aAAa,CAAC;CAC5D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CACpD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,oBAAoB,OAAO,MAAM,EAAE,MAAM,cAAc,CAAC;CAC9D,MAAM,kBAAkB,OAAO,MAAM,EAAE,MAAM,YAAY,CAAC;CAC1D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CAGpD,MAAM,KAAK,SAAS,OAAO,WAAW;CACtC,MAAM,QAAQ,SAAS,UAAU,SAAS,IAAI,aAAa,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,UACJ,SAAS,UAAU,WAAW,IAAI,eAAe,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC,CAAC;CACpF,MAAM,YACJ,SAAS,UAAU,aAAa,IAAI,qBAAqB,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,mBACJ,SAAS,UAAU,aAAa,IAAI,uBAAuB;CAC7D,MAAM,SAAS,IAAI,OAAO,WAAW,OAAO;EAC1C,GAAI,OAAO,iBAAiB;GAAE,WAAW;GAAgB,SAAS,OAAO;EAAY;EACrF,kBAAkB,OAAO;CAC3B,CAAC;CAKD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;EAC9E,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;CAC1E,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,gBAAgB,CAAC,CAAC;EAC/E,QAAQ,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;EACzC,KAAK;EACL;CACF,CAAC;CAKD,MAAM,mBAAmB,IAAI,kBAAkB,KAAK,QAAQ;EAC1D,eAAe,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EACnF,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;CACrE,EAAE;CACF,MAAM,gBAAgB,IAAI,wBAAwB;EAChD,MAAM,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EAC1E,aAAa,IAAI,yBAAyB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EAC3E,QAAQ;EACR,KAAK;EACL,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC;EACpC;EACA,YAAY;GAAE,kBAAkB,OAAO;GAAkB,aAAa,OAAO;EAAY;CAC3F,CAAC;CAKD,MAAM,WAAW,IAAI,gBACnB,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,CACtE;CAEA,MAAM,aAAa,IAAI,kBAAkB,KAAK,QAAQ;EACpD,SAAS,IAAI,yBAAyB,IAAI,aAAa;EACvD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,UAAU,IAAI,mBAAmB;EACrC,MAAM,IAAI,yBAAyB,IAAI,aAAa;EACpD,KAAK;EACL;EACA,QAAQ;CACV,CAAC;CAED,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,cAAc,IAAI,8BAA8B,IAAI,kBAAkB;EACtE,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,eAAe,IAAI,wBAAwB;EAC/C,MAAM,IAAI,8BAA8B,IAAI,kBAAkB;EAC9D,KAAK;EACL,QAAQ;CACV,CAAC;CAGD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,cAAc;EAC1D,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,cAAc;EACtD;EACA,KAAK;EACL,QAAQ;CACV,CAAC;CAED,MAAM,aAAa,IAAI,sBAAsB;EAC3C,MAAM,IAAI,4BAA4B,IAAI,gBAAgB;EAC1D,QAAQ;EACC;EACT,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,YAAY,IAAI,4BAA4B,IAAI,gBAAgB;GAChE,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF;EACA,QAAQ;CACV,CAAC;CACD,MAAM,SAAS,IAAI,kBAAkB;EACnC;EACA,MAAM,IAAI,wBAAwB,IAAI,YAAY;EAClD,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,QAAQ,IAAI,wBAAwB,IAAI,YAAY;GACpD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,QAAQ;CACV,CAAC;CAED,MAAM,YAAY;EAChB,UAAU,IAAI,0BAA0B;GACtC,MAAM,IAAI,0BAA0B,IAAI,eAAe;GACvD,QAAQ;EACV,CAAC;EACD,WAAW,IAAI,2BAA2B;GACxC,MAAM,IAAI,2BAA2B,IAAI,eAAe;GACxD,QAAQ;EACV,CAAC;EACD,OAAO,IAAI,uBAAuB;GAChC,QAAQ,IAAI,uBAAuB,IAAI,eAAe;GACtD;GACA;GACA;GACA,uBAAuB,OAAO;GAC9B,QAAQ;EACV,CAAC;CACH;CAEA,MAAM,kBAAkB,IAAI,uBAC1B,IACA,OAAO,oBACP,kBACF;CAKA,MAAM,uBAAuB,MAAM,iBAAiB,SAAS,YAAY,kBAAkB;CAG3F,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,aAAa,IAAI,6BAA6B,IAAI,kBAAkB;EACpE,aAAa,IAAI,uBAAuB,IAAI,OAAO,oBAAoB,kBAAkB;EACzF,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,eAAe,IAAI,wBAAwB;EAC/C,UAAU;EACV,MAAM,IAAI,6BAA6B,IAAI,kBAAkB;EAC7D,KAAK;EACL,aAAa;EACb,QAAQ;CACV,CAAC;CAKD,MAAM,iBAAiB,IAAI,kBAAkB,KAAK,QAAQ;EACxD,aAAa,IAAI,6BAA6B,IAAI,iBAAiB;EACnE,MAAM,IAAI,gCAAgC,IAAI,iBAAiB;EAC/D,QAAQ,IAAI,sBAAsB,IAAI,iBAAiB;CACzD,EAAE;CAGF,MAAM,gBAA+B;EACnC,cAAc,OAAO,OAAO,eACzB,MAAM,UAAU,SAAS,IAAI,OAAO,SAAS,EAAA,EAAI,SAAS;EAC7D,aAAa,OAAO,OAAO,cAAc;GACvC,MAAM,SAAS,MAAM,QAAQ,UAAU,OAAO,SAAS;GACvD,IAAI,QACF,OAAO;IAAE,IAAI,OAAO;IAAI,OAAO,OAAO;GAAM;GAE9C,MAAM,WAAW,MAAM,QAAQ,YAAY,OAAO,SAAS;GAC3D,OAAO,WAAW;IAAE,IAAI,SAAS;IAAI,OAAO,SAAS;GAAM,IAAI;EACjE;CACF;CAEA,MAAM,cAAc,IAAI,uBAAuB;EAC7C,MAAM,IAAI,6BAA6B,IAAI,iBAAiB;EAC5D,UAAU,IAAI,gCAAgC,IAAI,iBAAiB;EACnE,KAAK;EACL,QAAQ;EACR;EACA,SAAS;EACT;EACA,QAAQ;CACV,CAAC;CACD,iBAAiB,SAAS,WAAW;CAErC,MAAM,WAAW,IAAI,iBAAiB;CACtC,gCAAgC,UAAU,QAAQ,aAAa;CAG/D,SAAS,cAAc,UAAU,YAAY,OAAO,KAAK,CAAC;CAC1D,MAAM,eAAe,oBAAoB,OAAO,MAAM;CACtD,MAAM,cAAc,IAAI,mBACtB,IAAI,mBAAmB,IAAI,YAAY,GACvC,UACA,cACA,YACF;CAKA,MAAM,OAAO,IAAI,WAAW;EAC1B;EACA,SAAS,OAAO;EAChB,QAAQ,OAAO;EACf,gBAAgB,OAAO;EACvB,OAAO;GACL,mBAAmB,OAAO,SAAS;IACjC,MAAM,SAAS,kBAAkB;KAC/B,OAAO,KAAK,KAAK;KACjB,KAAK;IACP,CAAC;GACH;GACA,eAAe,OAAO,EAAE,OAAO,UAAU;IACvC,MAAM,SAAS,cAAc;KAC3B;KACA;IACF,CAAC;GACH;GACA,kBAAkB,OAAO,SAAS;IAChC,MAAM,EAAE,OAAO,SAAS;IACxB,MAAM,CAAC,WAAW,YAAY,KAAK,MAAM,GAAG;IAG5C,MAAM,aAAa,MAAM,SAAS,iBAAiB;KACjD;KACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;KAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;IAC3C,CAAC;IAED,OAAO,EACL,MAAM;KACJ,GAAG;KACH,IAAI,WAAW;IACjB,EACF;GACF;GACA,qBAAqB,OAAO,YAAY;IACtC,MAAM,SAAS,MAAM,SAAS,oBAAoB,QAAQ,MAAM;IAChE,IAAI,CAAC,QACH;IAEF,MAAM,OAAO,MAAM,cAAc,mBAAmB,OAAO,EAAE;IAC7D,IAAI,KAAK,WAAW,GAClB;IAGF,MAAM,MAAM,MAAM,cAAc,QAAQ,KAAK,EAAE,CAAE,KAAK;IACtD,IAAI,CAAC,KACH;IAGF,OAAO,EAAE,MAAM;KAAE,GAAG;KAAS,sBAAsB,IAAI;IAAG,EAAE;GAC9D;GAIA,0BAA0B,OAAO,EAAE,cAAc,KAAK,MAAM,aAAa;IACvE,MAAM,YAAY,MAAM,cAAc,mBAAmB;KACvD,SAAS,OAAO;KAChB,GAAG;KACH,MAAM,IAAI,QAAQ,KAAA;IACpB,CAAC;IACD,OAAO,EAAE,MAAM;KAAE,GAAG;KAAK,IAAI,UAAU;IAAG,EAAE;GAC9C;GACA,0BAA0B,OAAO,EAAE,mBAAmB;IACpD,MAAM,cAAc,mBAAmB,aAAa,IAAI,YAAY;GACtE;GACA,0BAA0B,OAAO,EAAE,mBAAmB;IACpD,MAAM,cAAc,mBAAmB,aAAa,EAAE;GACxD;GACA,iBAAiB,OAAO,EAAE,aAAa;IACrC,MAAM,cAAc,WAAW;KAC7B,OAAO,OAAO;KACd,QAAQ,OAAO;KACf,MAAM,UAAU,OAAO,IAAI;IAC7B,CAAC;GACH;GACA,oBAAoB,OAAO,EAAE,aAAa;IACxC,MAAM,cAAc,cAAc,OAAO,gBAAgB,OAAO,MAAM;GACxE;EACF;EACA,QAAQ,OAAO,MAAM,EAAE,MAAM,OAAO,CAAC;EACrC,cAAc,OAAO;EACrB,eAAe,OAAO;CACxB,CAAC;CAED,OAAO;EACL;EACA;EACA;EAEA,aAAa;EACb;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA;EACA;EACA;EACA,gBAAgB;EAEhB,UAAU;CACZ;AACF"}

package/dist/app/db.d.ts

@@ -0,0 +1,2 @@
+import { Db, createDb, schema } from "@headless-lms/adapter-db";
+export { type Db, createDb, schema };

package/dist/app/db.js

@@ -0,0 +1,2 @@
+import { createDb, schema } from "@headless-lms/adapter-db";
+export { createDb, schema };

package/dist/app/integrations.d.ts

@@ -0,0 +1,7 @@
+import { IntegrationsRegistry } from "@headless-lms/core/integrations";
+import { Logger } from "@headless-lms/core/shared/ports";
+//#region src/app/integrations.d.ts
+declare function loadIntegrations(dir?: string, logger?: Logger): Promise<IntegrationsRegistry>;
+//#endregion
+export { loadIntegrations };
+//# sourceMappingURL=integrations.d.ts.map

package/dist/app/integrations.js

@@ -0,0 +1,44 @@
+import { createIntegrationsRegistry } from "@headless-lms/core/integrations";
+import { readdir } from "node:fs/promises";
+import { pathToFileURL } from "node:url";
+import { join } from "node:path";
+import { noopLogger } from "@headless-lms/core/shared/logger";
+//#region src/app/integrations.ts
+function isIntegration(value) {
+	const it = value;
+	return typeof it?.id === "string" && typeof it?.configSchema === "function" && typeof it?.secretsSchema === "function" && typeof it?.validateConfig === "function" && Array.isArray(it?.actions) && it.actions.every((action) => typeof action?.id === "string" && typeof action?.description === "string" && typeof action?.inputSchema === "function" && typeof action?.outputSchema === "function" && typeof action?.invoke === "function") && new Set(it.actions.map((action) => action.id)).size === it.actions.length;
+}
+async function loadIntegrations(dir, logger = noopLogger) {
+	if (!dir) {
+		logger.debug("no plugins directory configured — zero integrations");
+		return createIntegrationsRegistry([]);
+	}
+	let entries;
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch (err) {
+		if (err.code === "ENOENT") {
+			logger.debug("plugins directory missing — zero integrations", { dir });
+			return createIntegrationsRegistry([]);
+		}
+		throw err;
+	}
+	const integrations = [];
+	for (const entry of entries.filter((e) => e.isDirectory())) {
+		const index = (await readdir(join(dir, entry.name))).find((f) => f === "index.ts" || f === "index.js");
+		if (!index) throw new Error(`integration "${entry.name}" has no index module`);
+		const mod = await import(pathToFileURL(join(dir, entry.name, index)).href);
+		if (!isIntegration(mod.default)) throw new Error(`integration "${entry.name}" must default-export an object satisfying the Integration port (id, configSchema, validateConfig, actions[] with unique ids and input/output schemas)`);
+		if (mod.default.id !== entry.name) throw new Error(`integration id "${mod.default.id}" must match its directory name "${entry.name}"`);
+		integrations.push(mod.default);
+	}
+	logger.info("integrations loaded", {
+		count: integrations.length,
+		ids: integrations.map((integration) => integration.id)
+	});
+	return createIntegrationsRegistry(integrations);
+}
+//#endregion
+export { loadIntegrations };
+
+//# sourceMappingURL=integrations.js.map

package/dist/app/integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.js","names":[],"sources":["../../src/app/integrations.ts"],"sourcesContent":["// Builds the IntegrationsRegistry by scanning an installation-owned plugins\n// directory — the home of third-party integrations, deliberately outside core\n// (not the domain) and outside adapters. Each subdirectory is one integration:\n// its name IS the integration id, and its index module's default export must\n// satisfy the core Integration port. The directory itself is passed in by\n// composition options (this package ships no plugins of its own); loaded once\n// at startup, anything malformed fails the boot, not a request.\nimport { readdir } from 'node:fs/promises';\nimport { pathToFileURL } from 'node:url';\nimport { join } from 'node:path';\nimport {\n  createIntegrationsRegistry,\n  type Integration,\n  type IntegrationsRegistry,\n} from '@headless-lms/core/integrations';\nimport type { Logger } from '@headless-lms/core/shared/ports';\nimport { noopLogger } from '@headless-lms/core/shared/logger';\n\nfunction isIntegration(value: unknown): value is Integration {\n  const it = value as Integration | undefined;\n  return (\n    typeof it?.id === 'string' &&\n    typeof it?.configSchema === 'function' &&\n    typeof it?.secretsSchema === 'function' &&\n    typeof it?.validateConfig === 'function' &&\n    Array.isArray(it?.actions) &&\n    it.actions.every(\n      (action) =>\n        typeof action?.id === 'string' &&\n        typeof action?.description === 'string' &&\n        typeof action?.inputSchema === 'function' &&\n        typeof action?.outputSchema === 'function' &&\n        typeof action?.invoke === 'function',\n    ) &&\n    new Set(it.actions.map((action) => action.id)).size === it.actions.length\n  );\n}\n\nexport async function loadIntegrations(\n  dir?: string,\n  logger: Logger = noopLogger,\n): Promise<IntegrationsRegistry> {\n  if (!dir) {\n    logger.debug('no plugins directory configured — zero integrations');\n    return createIntegrationsRegistry([]);\n  }\n  let entries;\n  try {\n    entries = await readdir(dir, { withFileTypes: true });\n  } catch (err) {\n    // A fresh installation's plugins/ dir has no .ts files yet (just a\n    // README), so the build never creates dist/plugins/ — that's zero\n    // installed integrations, not a boot failure.\n    if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n      logger.debug('plugins directory missing — zero integrations', { dir });\n      return createIntegrationsRegistry([]);\n    }\n    throw err;\n  }\n  const integrations: Integration[] = [];\n  for (const entry of entries.filter((e) => e.isDirectory())) {\n    // index.ts when running from source (tsx/vitest), index.js from dist.\n    const files = await readdir(join(dir, entry.name));\n    const index = files.find((f) => f === 'index.ts' || f === 'index.js');\n    if (!index) {\n      throw new Error(`integration \"${entry.name}\" has no index module`);\n    }\n    const mod = (await import(pathToFileURL(join(dir, entry.name, index)).href)) as {\n      default?: unknown;\n    };\n    if (!isIntegration(mod.default)) {\n      throw new Error(\n        `integration \"${entry.name}\" must default-export an object satisfying the Integration port ` +\n          `(id, configSchema, validateConfig, actions[] with unique ids and input/output schemas)`,\n      );\n    }\n    if (mod.default.id !== entry.name) {\n      throw new Error(\n        `integration id \"${mod.default.id}\" must match its directory name \"${entry.name}\"`,\n      );\n    }\n    integrations.push(mod.default);\n  }\n  logger.info('integrations loaded', {\n    count: integrations.length,\n    ids: integrations.map((integration) => integration.id),\n  });\n  return createIntegrationsRegistry(integrations);\n}\n"],"mappings":";;;;;;AAkBA,SAAS,cAAc,OAAsC;CAC3D,MAAM,KAAK;CACX,OACE,OAAO,IAAI,OAAO,YAClB,OAAO,IAAI,iBAAiB,cAC5B,OAAO,IAAI,kBAAkB,cAC7B,OAAO,IAAI,mBAAmB,cAC9B,MAAM,QAAQ,IAAI,OAAO,KACzB,GAAG,QAAQ,OACR,WACC,OAAO,QAAQ,OAAO,YACtB,OAAO,QAAQ,gBAAgB,YAC/B,OAAO,QAAQ,gBAAgB,cAC/B,OAAO,QAAQ,iBAAiB,cAChC,OAAO,QAAQ,WAAW,UAC9B,KACA,IAAI,IAAI,GAAG,QAAQ,KAAK,WAAW,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,QAAQ;AAEvE;AAEA,eAAsB,iBACpB,KACA,SAAiB,YACc;CAC/B,IAAI,CAAC,KAAK;EACR,OAAO,MAAM,qDAAqD;EAClE,OAAO,2BAA2B,CAAC,CAAC;CACtC;CACA,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;CACtD,SAAS,KAAK;EAIZ,IAAK,IAA8B,SAAS,UAAU;GACpD,OAAO,MAAM,iDAAiD,EAAE,IAAI,CAAC;GACrE,OAAO,2BAA2B,CAAC,CAAC;EACtC;EACA,MAAM;CACR;CACA,MAAM,eAA8B,CAAC;CACrC,KAAK,MAAM,SAAS,QAAQ,QAAQ,MAAM,EAAE,YAAY,CAAC,GAAG;EAG1D,MAAM,SAAQ,MADM,QAAQ,KAAK,KAAK,MAAM,IAAI,CAAC,EAAA,CAC7B,MAAM,MAAM,MAAM,cAAc,MAAM,UAAU;EACpE,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,gBAAgB,MAAM,KAAK,sBAAsB;EAEnE,MAAM,MAAO,MAAM,OAAO,cAAc,KAAK,KAAK,MAAM,MAAM,KAAK,CAAC,CAAC,CAAC;EAGtE,IAAI,CAAC,cAAc,IAAI,OAAO,GAC5B,MAAM,IAAI,MACR,gBAAgB,MAAM,KAAK,uJAE7B;EAEF,IAAI,IAAI,QAAQ,OAAO,MAAM,MAC3B,MAAM,IAAI,MACR,mBAAmB,IAAI,QAAQ,GAAG,mCAAmC,MAAM,KAAK,EAClF;EAEF,aAAa,KAAK,IAAI,OAAO;CAC/B;CACA,OAAO,KAAK,uBAAuB;EACjC,OAAO,aAAa;EACpB,KAAK,aAAa,KAAK,gBAAgB,YAAY,EAAE;CACvD,CAAC;CACD,OAAO,2BAA2B,YAAY;AAChD"}

package/dist/app/notifications.d.ts

@@ -0,0 +1,7 @@
+import { Mailer, MailerLookups } from "@headless-lms/core/shared/mailer";
+import { EventBus } from "@headless-lms/core/shared/ports";
+//#region src/app/notifications.d.ts
+declare function registerNotificationSubscribers(bus: EventBus, mailer: Pick<Mailer, 'send'>, lookups: MailerLookups): void;
+//#endregion
+export { registerNotificationSubscribers };
+//# sourceMappingURL=notifications.d.ts.map