npm - @headless-lms/server - Versions diffs - 0.1.0 → 0.3.0 - Mend

@headless-lms/server 0.1.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (351) hide show

package/dist/app/container.js CHANGED Viewed

@@ -1,25 +1,26 @@
 import { loadIntegrations } from "./integrations.js";
-import { registerNotificationSubscribers } from "./notifications.js";
-import { DrizzleAssetsRepository, DrizzleAutomationRunsRepository, DrizzleAutomationsRepository, DrizzleConnectionsRepository, DrizzleContentRepository, DrizzleCredentialStore, DrizzleDashboardRepository, DrizzleDiscussionRepository, DrizzleEntitlementsRepository, DrizzleIdentityRepository, DrizzleLearnRepository, DrizzleMembersRepository, DrizzleOrganizationsRepository, DrizzleOutboxAppender, DrizzleOutboxStore, DrizzleProgressRepository, DrizzleSettingsRepository, DrizzleStudentsRepository, DrizzleUnitOfWork, createDb } from "@headless-lms/adapter-db";
+import { mcpEndpoints } from "./mcp-endpoints.js";
+import { communityMail } from "./community-mail.js";
+import { DrizzleAdminRepository, DrizzleAssetsRepository, DrizzleAutomationRunsRepository, DrizzleAutomationsRepository, DrizzleChatRepository, DrizzleConnectionsRepository, DrizzleContentRepository, DrizzleCredentialStore, DrizzleDiscussionRepository, DrizzleEntitlementsRepository, DrizzleIdentityRepository, DrizzleMemberRepository, DrizzleMembersRepository, DrizzleNotificationsRepository, DrizzleOrganizationsRepository, DrizzleOutboxAppender, DrizzleOutboxStore, DrizzlePostRepository, DrizzleProgressRepository, DrizzleSettingsRepository, DrizzleUnitOfWork, createDb } from "@headless-lms/adapter-db";
 import { InMemoryEventBus } from "@headless-lms/adapter-defaults/events";
 import { PollingOutboxRelay } from "@headless-lms/adapter-defaults/events/outbox-relay";
 import { InlineAutomationEngine } from "@headless-lms/adapter-defaults/workflows";
+import { FetchWebhookSender } from "@headless-lms/adapter-defaults/webhooks";
 import { EmailAdapter, StubTemplateRenderer } from "@headless-lms/adapter-defaults/email";
 import { createRootLogger, requestLogContext } from "@headless-lms/adapter-defaults/logging";
 import { StorageAdapter } from "@headless-lms/adapter-defaults/storage";
 import { BetterAuth } from "@headless-lms/adapter-auth";
-import { ContentServiceImpl } from "@headless-lms/core/content";
+import { ContentService } from "@headless-lms/core/content";
 import { EntitlementsServiceImpl } from "@headless-lms/core/entitlements";
 import { ProgressServiceImpl } from "@headless-lms/core/progress";
-import { DiscussionServiceImpl } from "@headless-lms/core/discussion";
-import { IdentityServiceImpl } from "@headless-lms/core/identity";
+import { ChatServiceImpl, DiscussionServiceImpl, PostServiceImpl } from "@headless-lms/core/discussion";
+import { IdentityServiceImpl, NotificationServiceImpl } from "@headless-lms/core/identity";
 import { OrganizationServiceImpl, parseRole } from "@headless-lms/core/organizations";
-import { AssetsServiceImpl } from "@headless-lms/core/assets";
+import { AssetsServiceImpl, createFileUrls } from "@headless-lms/core/assets";
 import { IntegrationsServiceImpl } from "@headless-lms/core/integrations";
 import { AutomationsServiceImpl } from "@headless-lms/core/automations";
-import { StudentsReportServiceImpl } from "@headless-lms/core/reporting/students";
-import { DashboardReportServiceImpl } from "@headless-lms/core/reporting/dashboard";
-import { LearnReportServiceImpl } from "@headless-lms/core/reporting/learn";
+import { AdminReportServiceImpl } from "@headless-lms/core/reporting/admin";
+import { MemberReportServiceImpl } from "@headless-lms/core/reporting/member";
 import { Mailer } from "@headless-lms/core/shared/mailer";
 import { SettingsService } from "@headless-lms/core/shared/settings";
 //#region src/app/container.ts
@@ -54,7 +55,8 @@ async function buildContainer(config, options) {
 	const email = options?.adapters?.email ?? new EmailAdapter(logger.child({ name: "email" }));
 	const storage = options?.adapters?.storage ?? new StorageAdapter(logger.child({ name: "storage" }));
 	const templates = options?.adapters?.templates ?? new StubTemplateRenderer(logger.child({ name: "email" }));
-	const automationEngine = options?.adapters?.workflows ?? new InlineAutomationEngine();
+	const workflows = options?.adapters?.workflows;
+	const automationEngine = typeof workflows === "function" ? workflows(automationsLogger) : workflows ?? new InlineAutomationEngine(automationsLogger);
 	const mailer = new Mailer(templates, email, {
 		...config.emailBranding ?? {
 			brandName: "Headless LMS",
@@ -62,6 +64,19 @@ async function buildContainer(config, options) {
 		},
 		studentPortalUrl: config.studentPortalUrl
 	});
+	const fileUrls = createFileUrls(config.authBaseURL);
+	const assets = new AssetsServiceImpl({
+		storage,
+		repo: new DrizzleAssetsRepository(db, assetsLogger),
+		uow: new DrizzleUnitOfWork(db, (tx) => ({
+			assets: new DrizzleAssetsRepository(tx, assetsLogger),
+			outbox: new DrizzleOutboxAppender(tx, outboxLogger)
+		})),
+		memberImageMaxBytes: config.memberImageMaxBytes,
+		downloadLinkExpirySeconds: config.deliveryExpirySeconds,
+		fileUrls,
+		logger: assetsLogger
+	});
 	const identityUoW = new DrizzleUnitOfWork(db, (tx) => ({
 		identity: new DrizzleIdentityRepository(tx, logger.child({ name: "identity" })),
 		outbox: new DrizzleOutboxAppender(tx, logger.child({ name: "identity" }))
@@ -70,17 +85,29 @@ async function buildContainer(config, options) {
 		repo: new DrizzleIdentityRepository(db, logger.child({ name: "identity_repo" })),
 		logger: logger.child({ name: "identity" }),
 		uow: identityUoW,
-		mailer
+		mailer,
+		images: assets,
+		fileUrls
 	});
+	const notifications = new NotificationServiceImpl({
+		repo: new DrizzleNotificationsRepository(db),
+		logger: logger.child({ name: "notifications" })
+	});
+	const organizationsRepo = new DrizzleOrganizationsRepository(db, logger.child({ name: "org" }));
 	const organizationsUow = new DrizzleUnitOfWork(db, (tx) => ({
 		organizations: new DrizzleOrganizationsRepository(tx, logger.child({ name: "org" })),
 		outbox: new DrizzleOutboxAppender(tx, logger.child({ name: "org" }))
 	}));
+	const orgAdminRef = { current: void 0 };
 	const organizations = new OrganizationServiceImpl({
-		repo: new DrizzleOrganizationsRepository(db, logger.child({ name: "org" })),
+		repo: organizationsRepo,
 		membersRepo: new DrizzleMembersRepository(db, logger.child({ name: "org" })),
 		people: identity,
 		uow: organizationsUow,
+		orgAdmin: () => {
+			if (!orgAdminRef.current) throw new Error("orgAdmin not initialised");
+			return orgAdminRef.current;
+		},
 		logger: logger.child({ name: "org" }),
 		mailer,
 		inviteUrls: {
@@ -93,18 +120,31 @@ async function buildContainer(config, options) {
 		content: new DrizzleContentRepository(tx, contentLogger),
 		outbox: new DrizzleOutboxAppender(tx, outboxLogger)
 	}));
-	const content = new ContentServiceImpl({
+	const content = new ContentService({
 		repo: new DrizzleContentRepository(db, contentLogger),
 		uow: contentUow,
-		settings,
+		libraryAssets: assets,
+		files: assets,
+		fileUrls,
 		logger: contentLogger
 	});
 	const entitlementsUow = new DrizzleUnitOfWork(db, (tx) => ({
 		entitlements: new DrizzleEntitlementsRepository(tx, entitlementsLogger),
+		spaces: new DrizzleContentRepository(tx, contentLogger),
 		outbox: new DrizzleOutboxAppender(tx, outboxLogger)
 	}));
+	const authors = {
+		roleOf: async (orgId, orgUserId) => {
+			return (await organizationsRepo.findOrgUserById(orgId, orgUserId))?.role ?? null;
+		},
+		rolesOf: async (orgId, orgUserIds) => {
+			const rows = await organizationsRepo.findOrgUsersByIds(orgId, orgUserIds);
+			return Object.fromEntries(rows.map((row) => [row.id, row.role]));
+		}
+	};
 	const entitlements = new EntitlementsServiceImpl({
 		repo: new DrizzleEntitlementsRepository(db, entitlementsLogger),
+		content,
 		uow: entitlementsUow,
 		logger: entitlementsLogger
 	});
@@ -115,45 +155,68 @@ async function buildContainer(config, options) {
 	const progress = new ProgressServiceImpl({
 		repo: new DrizzleProgressRepository(db, progressLogger),
 		content,
+		access: entitlements,
 		uow: progressUow,
 		logger: progressLogger
 	});
-	const discussion = new DiscussionServiceImpl({
-		repo: new DrizzleDiscussionRepository(db, discussionLogger),
+	const postReads = new DrizzlePostRepository(db, discussionLogger);
+	const discussionReads = new DrizzleDiscussionRepository(db, discussionLogger);
+	const chatReads = new DrizzleChatRepository(db, discussionLogger);
+	const posts = new PostServiceImpl({
+		repo: postReads,
 		access: entitlements,
 		content,
+		authors,
+		profiles: discussionReads,
+		comments: discussionReads,
+		images: assets,
+		fileUrls,
 		uow: new DrizzleUnitOfWork(db, (tx) => ({
-			discussion: new DrizzleDiscussionRepository(tx, discussionLogger),
+			posts: new DrizzlePostRepository(tx, discussionLogger),
 			outbox: new DrizzleOutboxAppender(tx, outboxLogger)
 		})),
-		settings,
 		logger: discussionLogger
 	});
-	const assets = new AssetsServiceImpl({
-		storage,
-		repo: new DrizzleAssetsRepository(db, assetsLogger),
+	const chats = new ChatServiceImpl({
+		repo: chatReads,
+		access: entitlements,
+		content,
+		authors,
+		profiles: discussionReads,
+		images: assets,
+		fileUrls,
 		uow: new DrizzleUnitOfWork(db, (tx) => ({
-			assets: new DrizzleAssetsRepository(tx, assetsLogger),
+			chats: new DrizzleChatRepository(tx, discussionLogger),
 			outbox: new DrizzleOutboxAppender(tx, outboxLogger)
 		})),
-		logger: assetsLogger
+		logger: discussionLogger
+	});
+	const discussion = new DiscussionServiceImpl({
+		repo: discussionReads,
+		access: entitlements,
+		content,
+		posts,
+		communities: { listIds: (orgId) => content.listPublishedCommunityIds(orgId) },
+		fileUrls,
+		uow: new DrizzleUnitOfWork(db, (tx) => ({
+			discussion: new DrizzleDiscussionRepository(tx, discussionLogger),
+			outbox: new DrizzleOutboxAppender(tx, outboxLogger)
+		})),
+		settings,
+		logger: discussionLogger
 	});
 	const reporting = {
-		students: new StudentsReportServiceImpl({
-			repo: new DrizzleStudentsRepository(db, reportingLogger),
-			logger: reportingLogger
-		}),
-		dashboard: new DashboardReportServiceImpl({
-			repo: new DrizzleDashboardRepository(db, reportingLogger),
-			logger: reportingLogger
-		}),
-		learn: new LearnReportServiceImpl({
-			reader: new DrizzleLearnRepository(db, reportingLogger),
+		admin: new AdminReportServiceImpl({ repo: new DrizzleAdminRepository(db, reportingLogger) }),
+		member: new MemberReportServiceImpl({
+			repo: new DrizzleMemberRepository(db, reportingLogger),
 			content,
 			progress,
-			assets,
-			deliveryExpirySeconds: config.deliveryExpirySeconds,
-			logger: reportingLogger
+			files: assets,
+			fileUrls,
+			access: entitlements,
+			notifications,
+			posts,
+			chats
 		})
 	};
 	const credentialStore = new DrizzleCredentialStore(db, config.credentialStoreKey, integrationsLogger);
@@ -173,58 +236,111 @@ async function buildContainer(config, options) {
 	const automationsUow = new DrizzleUnitOfWork(db, (tx) => ({
 		automations: new DrizzleAutomationsRepository(tx, automationsLogger),
 		runs: new DrizzleAutomationRunsRepository(tx, automationsLogger),
+		credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, automationsLogger),
 		outbox: new DrizzleOutboxAppender(tx, automationsLogger)
 	}));
 	const mailerLookups = {
-		orgUserEmail: async (orgId, orgUserId) => (await reporting.students.get(orgId, orgUserId))?.email ?? null,
+		orgUserPerson: async (orgId, orgUserId) => {
+			const orgUser = await organizationsRepo.findOrgUserById(orgId, orgUserId);
+			const user = orgUser ? await identity.getUserById(orgUser.userId) : null;
+			return user ? {
+				userId: user.id,
+				email: user.email
+			} : null;
+		},
 		contentInfo: async (orgId, contentId) => {
 			const course = await content.getCourse(orgId, contentId);
 			if (course) return {
 				id: course.id,
-				title: course.title
+				title: course.title,
+				type: course.type
 			};
 			const download = await content.getDownload(orgId, contentId);
-			return download ? {
+			if (download) return {
 				id: download.id,
-				title: download.title
+				title: download.title,
+				type: download.type
+			};
+			const community = await content.getCommunity(orgId, contentId);
+			return community ? {
+				id: community.id,
+				title: community.title,
+				type: community.type
 			} : null;
 		}
 	};
+	const runsRepo = new DrizzleAutomationRunsRepository(db, automationsLogger);
+	const wired = communityMail({
+		content,
+		entitlements,
+		organizations,
+		identity,
+		posts,
+		discussion,
+		chats,
+		assets
+	});
 	const automations = new AutomationsServiceImpl({
 		repo: new DrizzleAutomationsRepository(db, automationsLogger),
-		runsRepo: new DrizzleAutomationRunsRepository(db, automationsLogger),
+		runsRepo,
 		uow: automationsUow,
 		engine: automationEngine,
 		mailer,
 		lookups: mailerLookups,
 		integrations,
+		credentials: credentialStore,
+		webhooks: options?.adapters?.webhooks ?? new FetchWebhookSender({ allowPrivateNetwork: config.webhookAllowPrivateNetwork }),
+		mail: wired.mail,
+		grants: wired.grants,
+		desk: notifications,
+		scheduledWork: wired.scheduledWork,
 		logger: automationsLogger
 	});
 	automationEngine.register(automations);
 	const eventBus = new InMemoryEventBus();
-	registerNotificationSubscribers(eventBus, mailer, mailerLookups);
 	eventBus.subscribeAll((event) => automations.handle(event));
 	const outboxConfig = resolveOutboxConfig(config.outbox);
 	const outboxRelay = new PollingOutboxRelay(new DrizzleOutboxStore(db, outboxLogger), eventBus, outboxConfig, outboxLogger);
+	const authLogger = logger.child({ name: "auth" });
+	const authHook = (name, fn) => async (...args) => {
+		try {
+			return await fn(...args);
+		} catch (err) {
+			authLogger.error(`auth hook ${name} failed`, { err });
+			throw err;
+		}
+	};
+	const mcp = mcpEndpoints(config);
+	if (!mcp.oauthEnabled) authLogger.warn("MCP OAuth is off: BETTER_AUTH_URL must be https or a loopback host; /mcp accepts API keys only", { authBaseURL: config.authBaseURL });
 	const auth = new BetterAuth({
 		db,
 		baseUrl: config.authBaseURL,
+		mcp: {
+			oauthEnabled: mcp.oauthEnabled,
+			resource: mcp.resource,
+			loginPage: mcp.loginPage,
+			consentPage: mcp.consentPage,
+			orgPickerPage: mcp.orgPickerPage
+		},
 		secret: config.authSecret,
 		trustedOrigins: config.trustedOrigins,
 		hooks: {
-			sendResetPassword: async (data) => {
+			sendResetPassword: async ({ user, url }) => {
 				await identity.sendPasswordReset({
-					email: data.user.email,
-					url: ""
+					email: user.email,
+					url
 				});
 			},
-			sendMagicLink: async ({ email, url }) => {
+			onPasswordReset: async ({ user }) => {
+				await identity.sendPasswordChanged({ email: user.email });
+			},
+			sendMagicLink: authHook("sendMagicLink", async ({ email, url }) => {
 				await identity.sendMagicLink({
 					email,
 					url
 				});
-			},
-			beforeUserCreate: async (user) => {
+			}),
+			beforeUserCreate: authHook("beforeUserCreate", async (user) => {
 				const { email, name } = user;
 				const [firstName, lastName] = name.split(" ");
 				const domainUser = await identity.linkOrCreateUser({
@@ -236,8 +352,8 @@ async function buildContainer(config, options) {
 					...user,
 					id: domainUser.id
 				} };
-			},
-			beforeCreateSession: async (session) => {
+			}),
+			beforeCreateSession: authHook("beforeCreateSession", async (session) => {
 				const person = await identity.getUserByExternalId(session.userId);
 				if (!person) return;
 				const orgs = await organizations.getOrgUsersForUser(person.id);
@@ -248,8 +364,8 @@ async function buildContainer(config, options) {
 					...session,
 					activeOrganizationId: org.id
 				} };
-			},
-			beforeCreateOrganization: async ({ organization: org, user: baUser }) => {
+			}),
+			beforeCreateOrganization: authHook("beforeCreateOrganization", async ({ organization: org, user: baUser }) => {
 				const domainOrg = await organizations.createOrganization({
 					ownerId: baUser.id,
 					...org,
@@ -259,37 +375,45 @@ async function buildContainer(config, options) {
 					...org,
 					id: domainOrg.id
 				} };
-			},
-			beforeUpdateOrganization: async ({ organization }) => {
+			}),
+			beforeUpdateOrganization: authHook("beforeUpdateOrganization", async ({ organization }) => {
 				await organizations.updateOrganization(organization.id, organization);
-			},
-			beforeDeleteOrganization: async ({ organization }) => {
+			}),
+			beforeDeleteOrganization: authHook("beforeDeleteOrganization", async ({ organization }) => {
 				await organizations.deleteOrganization(organization.id);
-			},
-			beforeAddMember: async ({ member }) => {
+			}),
+			beforeAddMember: authHook("beforeAddMember", async ({ member }) => {
 				await organizations.addOrgUser({
 					orgId: member.organizationId,
 					userId: member.userId,
 					role: parseRole(member.role)
 				});
-			},
-			beforeRemoveMember: async ({ member }) => {
+			}),
+			beforeUpdateMemberRole: authHook("beforeUpdateMemberRole", async ({ member, newRole }) => {
+				await organizations.updateOrgUser(member.organizationId, member.userId, { role: parseRole(newRole) });
+			}),
+			beforeRemoveMember: authHook("beforeRemoveMember", async ({ member }) => {
 				await organizations.removeOrgUser(member.organizationId, member.userId);
-			}
+			})
 		},
-		logger: logger.child({ name: "auth" }),
+		logger: authLogger,
 		cookieDomain: config.cookieDomain,
 		secureCookies: config.secureCookies
 	});
+	orgAdminRef.current = auth;
 	return {
 		auth,
+		mcp,
 		identity,
+		notifications,
 		organizations,
 		orgProvider: auth,
 		content,
 		entitlements,
 		progress,
 		discussion,
+		posts,
+		chats,
 		assets,
 		integrations,
 		automations,

package/dist/app/container.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"container.js","names":[],"sources":["../../src/app/container.ts"],"sourcesContent":["// Wires adapters + services in dependency order. Starts nothing.\nimport {\n createDb,\n DrizzleAssetsRepository,\n DrizzleAutomationRunsRepository,\n DrizzleAutomationsRepository,\n DrizzleConnectionsRepository,\n DrizzleContentRepository,\n DrizzleCredentialStore,\n DrizzleDashboardRepository,\n DrizzleDiscussionRepository,\n DrizzleEntitlementsRepository,\n DrizzleIdentityRepository,\n DrizzleLearnRepository,\n DrizzleMembersRepository,\n DrizzleOrganizationsRepository,\n DrizzleOutboxAppender,\n DrizzleOutboxStore,\n DrizzleProgressRepository,\n DrizzleSettingsRepository,\n DrizzleStudentsRepository,\n DrizzleUnitOfWork,\n} from '@headless-lms/adapter-db';\nimport { InMemoryEventBus } from '@headless-lms/adapter-defaults/events';\nimport {\n PollingOutboxRelay,\n type PollingOutboxRelayConfig,\n} from '@headless-lms/adapter-defaults/events/outbox-relay';\nimport { InlineAutomationEngine } from '@headless-lms/adapter-defaults/workflows';\nimport { EmailAdapter, StubTemplateRenderer } from '@headless-lms/adapter-defaults/email';\nimport {\n createRootLogger,\n type LogLevel,\n type PinoInstance,\n requestLogContext,\n type RequestLogContext,\n} from '@headless-lms/adapter-defaults/logging';\nimport { StorageAdapter } from '@headless-lms/adapter-defaults/storage';\nimport { BetterAuth } from '@headless-lms/adapter-auth';\n\nimport { ContentServiceImpl } from '@headless-lms/core/content';\nimport { EntitlementsServiceImpl } from '@headless-lms/core/entitlements';\nimport { ProgressServiceImpl } from '@headless-lms/core/progress';\nimport { DiscussionServiceImpl } from '@headless-lms/core/discussion';\nimport { IdentityServiceImpl, type SessionAdmin } from '@headless-lms/core/identity';\nimport { type OrgAdmin, OrganizationServiceImpl, parseRole } from '@headless-lms/core/organizations';\nimport { AssetsServiceImpl } from '@headless-lms/core/assets';\nimport { IntegrationsServiceImpl } from '@headless-lms/core/integrations';\nimport { AutomationsServiceImpl } from '@headless-lms/core/automations';\nimport { loadIntegrations } from './integrations.js';\nimport { registerNotificationSubscribers } from './notifications.js';\nimport { StudentsReportServiceImpl } from '@headless-lms/core/reporting/students';\nimport { DashboardReportServiceImpl } from '@headless-lms/core/reporting/dashboard';\nimport { LearnReportServiceImpl } from '@headless-lms/core/reporting/learn';\nimport { Mailer, type MailerLookups } from '@headless-lms/core/shared/mailer';\nimport { SettingsService } from '@headless-lms/core/shared/settings';\n\nimport type {\n CredentialStore,\n EmailSender,\n Logger,\n ObjectStorage,\n OutboxRelay,\n TemplateContext,\n TemplateRenderer,\n} from '@headless-lms/core/shared/ports';\nimport type { AutomationEngine } from '@headless-lms/core/types';\n\n/** Installation-supplied ports; an absent slot falls back to a fail-loudly stub. /\nexport interface AdapterOverrides {\n email?: EmailSender;\n storage?: ObjectStorage;\n /* Resolves email templates to rendered content. Absent → fail-loudly stub. /\n templates?: TemplateRenderer;\n /* Durable automation engine. Absent → InlineAutomationEngine (in-process, one attempt per action). /\n workflows?: AutomationEngine;\n}\n\nexport interface BuildContainerOptions {\n /* Installation's plugins folder, scanned by loadIntegrations. Absent → no integrations. /\n pluginsDir?: string;\n adapters?: AdapterOverrides;\n}\n\nexport interface Config {\n databaseUrl: string;\n authBaseURL: string;\n authSecret: string;\n trustedOrigins: string[];\n /* Branding threaded into every email template. Default: brandName \"Headless LMS\", baseUrl = adminAppUrl.\n * (studentPortalUrl is composed in from the top-level config field.) /\n emailBranding?: Omit<TemplateContext, 'studentPortalUrl'>;\n /* base64-encoded 32-byte key for the credential store (CREDENTIAL_STORE_KEY). /\n credentialStoreKey: string;\n /* Parent domain for cross-subdomain session cookies (e.g. \".example.com\"); undefined → host-only cookie. /\n cookieDomain?: string;\n /* Mark session cookies Secure (set behind HTTPS / in production). /\n secureCookies?: boolean;\n /* Student portal origin — invite links for students, and the origin whose signups are invite-gated. /\n studentPortalUrl: string;\n /* Admin app origin — invite links for staff. /\n adminAppUrl: string;\n /* Transactional-outbox relay tuning. All optional — see OUTBOX_DEFAULTS. /\n outbox?: OutboxConfig;\n /* Log level for the process-wide logger (HTTP + domain + relay). Default \"info\". /\n logging?: LoggingConfig;\n /* Presigned URL lifetime for entitled download delivery, seconds. Mirrors\n * ServerConfig.deliveryExpirySeconds — createContainer threads it through. /\n deliveryExpirySeconds: number;\n}\n\n/* Tuning for the transactional-outbox relay. Every field is optional; the\n * container resolves against OUTBOX_DEFAULTS. /\nexport interface OutboxConfig {\n /* Master switch for the same-process relay. Default true. /\n enabled?: boolean;\n /* Idle delay between polls. Default 1000. /\n pollIntervalMs?: number;\n /* Max rows fetched/dispatched per tick. Default 100. /\n batchSize?: number;\n}\n\nexport const OUTBOX_DEFAULTS: PollingOutboxRelayConfig = {\n enabled: true,\n pollIntervalMs: 1000,\n batchSize: 100,\n};\n\nexport function resolveOutboxConfig(config: OutboxConfig = {}): PollingOutboxRelayConfig {\n const overrides = Object.fromEntries(\n Object.entries(config).filter(([, value]) => value !== undefined),\n );\n return { ...OUTBOX_DEFAULTS, ...overrides };\n}\n\n/* Logging tuning. Optional; resolved against LOGGING_DEFAULTS. /\nexport interface LoggingConfig {\n /* Minimum level emitted. Default \"info\". /\n level?: LogLevel;\n}\n\nexport const LOGGING_DEFAULTS: Required<LoggingConfig> = { level: 'info' };\n\nexport function resolveLoggingConfig(config: LoggingConfig = {}): Required<LoggingConfig> {\n return { level: config.level ?? LOGGING_DEFAULTS.level };\n}\n\nexport interface Container {\n auth: BetterAuth;\n // Org Provider\n orgProvider: OrgAdmin;\n\n // Domains\n identity: IdentityServiceImpl;\n organizations: OrganizationServiceImpl;\n content: ContentServiceImpl;\n entitlements: EntitlementsServiceImpl;\n progress: ProgressServiceImpl;\n discussion: DiscussionServiceImpl;\n assets: AssetsServiceImpl;\n integrations: IntegrationsServiceImpl;\n automations: AutomationsServiceImpl;\n /* Cross-cutting settings store. Not a context — a leaf every context may use;\n * inject `settings.for('<namespace>')` into a service, never the service itself. /\n settings: SettingsService;\n // Reporting read layer (composed cross-context reads; owns no domain rules).\n reporting: {\n students: StudentsReportServiceImpl;\n dashboard: DashboardReportServiceImpl;\n learn: LearnReportServiceImpl;\n };\n storage: ObjectStorage;\n mailer: Mailer;\n /* Shared secure credential store — encrypted at rest, org-scoped, decrypt at point of use. /\n credentials: CredentialStore;\n /* The outbox relay — constructed but NEVER started by the container; the\n * installation's entry point starts it after listen (gen-openapi must not\n * poll). buildServer stops it onClose. /\n outboxRelay: OutboxRelay;\n /* The automation engine — constructed but NEVER started by the container;\n * the installation's entry point starts it after listen (gen-openapi must\n * not run a worker). buildServer stops it onClose. /\n automationEngine: AutomationEngine;\n /* Root logger port — components receive children bound with { name }. /\n logger: Logger;\n /* The raw pino root; buildServer hands it to Fastify so HTTP shares the stream. /\n loggerInstance: PinoInstance;\n /* Request-scoped log correlation; the HTTP layer enters it per request. /\n requestContext: RequestLogContext;\n /* Identity's session-write port; the auth adapter fulfils it. /\n sessions: SessionAdmin;\n}\n\nexport async function buildContainer(\n config: Config,\n options?: BuildContainerOptions,\n): Promise<Container> {\n const { instance: loggerInstance, logger } = createRootLogger(\n resolveLoggingConfig(config.logging).level,\n );\n // One child per domain — a context's service and repositories share it.\n\n const contentLogger = logger.child({ name: 'content' });\n const entitlementsLogger = logger.child({ name: 'entitlements' });\n const progressLogger = logger.child({ name: 'progress' });\n const discussionLogger = logger.child({ name: 'discussion' });\n const assetsLogger = logger.child({ name: 'assets' });\n const integrationsLogger = logger.child({ name: 'integrations' });\n const automationsLogger = logger.child({ name: 'automations' });\n const reportingLogger = logger.child({ name: 'reporting' });\n const outboxLogger = logger.child({ name: 'outbox' });\n\n // Outbound adapters\n const db = createDb(config.databaseUrl);\n const email = options?.adapters?.email ?? new EmailAdapter(logger.child({ name: 'email' }));\n const storage: ObjectStorage =\n options?.adapters?.storage ?? new StorageAdapter(logger.child({ name: 'storage' }));\n const templates =\n options?.adapters?.templates ?? new StubTemplateRenderer(logger.child({ name: 'email' }));\n const automationEngine: AutomationEngine =\n options?.adapters?.workflows ?? new InlineAutomationEngine();\n const mailer = new Mailer(templates, email, {\n ...(config.emailBranding ?? { brandName: 'Headless LMS', baseUrl: config.adminAppUrl }),\n studentPortalUrl: config.studentPortalUrl,\n });\n\n /\n * Identity\n /\n const identityUoW = new DrizzleUnitOfWork(db, (tx) => ({\n identity: new DrizzleIdentityRepository(tx, logger.child({ name: 'identity' })),\n outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'identity' })),\n }));\n const identity = new IdentityServiceImpl({\n repo: new DrizzleIdentityRepository(db, logger.child({ name: 'identity_repo' })),\n logger: logger.child({ name: 'identity' }),\n uow: identityUoW,\n mailer,\n });\n\n /\n * Organization\n /\n const organizationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n organizations: new DrizzleOrganizationsRepository(tx, logger.child({ name: 'org' })),\n outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'org' })),\n }));\n const organizations = new OrganizationServiceImpl({\n repo: new DrizzleOrganizationsRepository(db, logger.child({ name: 'org' })),\n membersRepo: new DrizzleMembersRepository(db, logger.child({ name: 'org' })),\n people: identity,\n uow: organizationsUow,\n logger: logger.child({ name: 'org' }),\n mailer,\n inviteUrls: { studentPortalUrl: config.studentPortalUrl, adminAppUrl: config.adminAppUrl },\n });\n\n /\n * Settings\n /\n const settings = new SettingsService(\n new DrizzleSettingsRepository(db, logger.child({ name: 'settings' })),\n );\n // Content: reads on the root db; course writes + outbox append in one tx.\n const contentUow = new DrizzleUnitOfWork(db, (tx) => ({\n content: new DrizzleContentRepository(tx, contentLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n }));\n const content = new ContentServiceImpl({\n repo: new DrizzleContentRepository(db, contentLogger),\n uow: contentUow,\n settings,\n logger: contentLogger,\n });\n // Entitlements: reads on the root db; writes + outbox append in one tx.\n const entitlementsUow = new DrizzleUnitOfWork(db, (tx) => ({\n entitlements: new DrizzleEntitlementsRepository(tx, entitlementsLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n }));\n const entitlements = new EntitlementsServiceImpl({\n repo: new DrizzleEntitlementsRepository(db, entitlementsLogger),\n uow: entitlementsUow,\n logger: entitlementsLogger,\n });\n // Progress: report writes + outbox append in one tx; content supplies the\n // structure and completion rules the service evaluates against.\n const progressUow = new DrizzleUnitOfWork(db, (tx) => ({\n progress: new DrizzleProgressRepository(tx, progressLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n }));\n const progress = new ProgressServiceImpl({\n repo: new DrizzleProgressRepository(db, progressLogger),\n content,\n uow: progressUow,\n logger: progressLogger,\n });\n\n const discussion = new DiscussionServiceImpl({\n repo: new DrizzleDiscussionRepository(db, discussionLogger),\n access: entitlements,\n content: content,\n uow: new DrizzleUnitOfWork(db, (tx) => ({\n discussion: new DrizzleDiscussionRepository(tx, discussionLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n })),\n settings,\n logger: discussionLogger,\n });\n const assets = new AssetsServiceImpl({\n storage,\n repo: new DrizzleAssetsRepository(db, assetsLogger),\n uow: new DrizzleUnitOfWork(db, (tx) => ({\n assets: new DrizzleAssetsRepository(tx, assetsLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n })),\n logger: assetsLogger,\n });\n\n const reporting = {\n students: new StudentsReportServiceImpl({\n repo: new DrizzleStudentsRepository(db, reportingLogger),\n logger: reportingLogger,\n }),\n dashboard: new DashboardReportServiceImpl({\n repo: new DrizzleDashboardRepository(db, reportingLogger),\n logger: reportingLogger,\n }),\n learn: new LearnReportServiceImpl({\n reader: new DrizzleLearnRepository(db, reportingLogger),\n content,\n progress,\n assets,\n deliveryExpirySeconds: config.deliveryExpirySeconds,\n logger: reportingLogger,\n }),\n };\n\n const credentialStore = new DrizzleCredentialStore(\n db,\n config.credentialStoreKey,\n integrationsLogger,\n );\n // The integrations this deployment supports: the installation's declared\n // plugins folder (directory name = integration id), loaded at startup.\n // Connect/configure reject undeclared ids and validate config with the\n // integration's own schema. No folder → no integrations.\n const integrationsRegistry = await loadIntegrations(options?.pluginsDir, integrationsLogger);\n // Integrations: credential + connection writes + outbox append in one tx\n // (a tx-bound credential store instance shares the scope's transaction).\n const integrationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n connections: new DrizzleConnectionsRepository(tx, integrationsLogger),\n credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, integrationsLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n }));\n const integrations = new IntegrationsServiceImpl({\n registry: integrationsRegistry,\n repo: new DrizzleConnectionsRepository(db, integrationsLogger),\n uow: integrationsUow,\n credentials: credentialStore,\n logger: integrationsLogger,\n });\n\n // Automations: run writes + outbox append in one tx; the engine drives\n // execution (register below), integrations supplies the loaded\n // integrations' actions for `available`.\n const automationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n automations: new DrizzleAutomationsRepository(tx, automationsLogger),\n runs: new DrizzleAutomationRunsRepository(tx, automationsLogger),\n outbox: new DrizzleOutboxAppender(tx, automationsLogger),\n }));\n // Emails triggered by row-shaped events resolve their recipient and content\n // details at send time — the event carries ids only.\n const mailerLookups: MailerLookups = {\n orgUserEmail: async (orgId, orgUserId) =>\n (await reporting.students.get(orgId, orgUserId))?.email ?? null,\n contentInfo: async (orgId, contentId) => {\n const course = await content.getCourse(orgId, contentId);\n if (course) {\n return { id: course.id, title: course.title };\n }\n const download = await content.getDownload(orgId, contentId);\n return download ? { id: download.id, title: download.title } : null;\n },\n };\n\n const automations = new AutomationsServiceImpl({\n repo: new DrizzleAutomationsRepository(db, automationsLogger),\n runsRepo: new DrizzleAutomationRunsRepository(db, automationsLogger),\n uow: automationsUow,\n engine: automationEngine,\n mailer,\n lookups: mailerLookups,\n integrations,\n logger: automationsLogger,\n });\n automationEngine.register(automations);\n\n const eventBus = new InMemoryEventBus();\n registerNotificationSubscribers(eventBus, mailer, mailerLookups);\n // handle() never throws — the EventBus fans out to every subscriber\n // sequentially, and a rejection here would break sibling subscribers.\n eventBus.subscribeAll((event) => automations.handle(event));\n const outboxConfig = resolveOutboxConfig(config.outbox);\n const outboxRelay = new PollingOutboxRelay(\n new DrizzleOutboxStore(db, outboxLogger),\n eventBus,\n outboxConfig,\n outboxLogger,\n );\n\n /\n * Auth Adapter\n /\n const auth = new BetterAuth({\n db,\n baseUrl: config.authBaseURL,\n secret: config.authSecret,\n trustedOrigins: config.trustedOrigins,\n hooks: {\n sendResetPassword: async (data) => {\n await identity.sendPasswordReset({\n email: data.user.email,\n url: '',\n });\n },\n sendMagicLink: async ({ email, url }) => {\n await identity.sendMagicLink({\n email,\n url,\n });\n },\n beforeUserCreate: async (user) => {\n const { email, name } = user;\n const [firstName, lastName] = name.split(' ');\n // Better Auth has not minted an id yet — the id returned below becomes\n // its account id. A person provisioned at invite time is linked instead of re-created.\n const domainUser = await identity.linkOrCreateUser({\n email,\n ...(firstName !== undefined && { firstName }),\n ...(lastName !== undefined && { lastName }),\n });\n\n return {\n data: {\n ...user,\n id: domainUser.id,\n },\n };\n },\n beforeCreateSession: async (session) => {\n const person = await identity.getUserByExternalId(session.userId);\n if (!person) {\n return;\n }\n const orgs = await organizations.getOrgUsersForUser(person.id);\n if (orgs.length !== 1) {\n return;\n }\n // TODO - fix, why default to the first?\n const org = await organizations.getById(orgs[0]!.orgId);\n if (!org) {\n return;\n }\n\n return { data: { ...session, activeOrganizationId: org.id } };\n },\n /\n * We're making sure the domain org creates and using the same ID for better-auth org ID.\n */\n beforeCreateOrganization: async ({ organization: org, user: baUser }) => {\n const domainOrg = await organizations.createOrganization({\n ownerId: baUser.id,\n ...org,\n logo: org.logo ?? undefined,\n });\n return { data: { ...org, id: domainOrg.id } };\n },\n beforeUpdateOrganization: async ({ organization }) => {\n await organizations.updateOrganization(organization.id, organization);\n },\n beforeDeleteOrganization: async ({ organization }) => {\n await organizations.deleteOrganization(organization.id);\n },\n beforeAddMember: async ({ member }) => {\n await organizations.addOrgUser({\n orgId: member.organizationId,\n userId: member.userId,\n role: parseRole(member.role),\n });\n },\n beforeRemoveMember: async ({ member }) => {\n await organizations.removeOrgUser(member.organizationId, member.userId);\n },\n },\n logger: logger.child({ name: 'auth' }),\n cookieDomain: config.cookieDomain,\n secureCookies: config.secureCookies,\n });\n\n return {\n auth,\n identity,\n organizations,\n // Better Auth owns org writes; the same instance fulfils the OrgAdmin port.\n orgProvider: auth,\n content,\n entitlements,\n progress,\n discussion,\n assets,\n integrations,\n automations,\n settings,\n reporting,\n storage,\n mailer,\n credentials: credentialStore,\n outboxRelay,\n automationEngine,\n logger,\n loggerInstance,\n requestContext: requestLogContext,\n // Better Auth owns the session store; the same instance fulfils SessionAdmin.\n sessions: auth,\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA0HA,MAAa,kBAA4C;CACvD,SAAS;CACT,gBAAgB;CAChB,WAAW;AACb;AAEA,SAAgB,oBAAoB,SAAuB,CAAC,GAA6B;CACvF,MAAM,YAAY,OAAO,YACvB,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAClE;CACA,OAAO;EAAE,GAAG;EAAiB,GAAG;CAAU;AAC5C;AAQA,MAAa,mBAA4C,EAAE,OAAO,OAAO;AAEzE,SAAgB,qBAAqB,SAAwB,CAAC,GAA4B;CACxF,OAAO,EAAE,OAAO,OAAO,SAAS,iBAAiB,MAAM;AACzD;AAgDA,eAAsB,eACpB,QACA,SACoB;CACpB,MAAM,EAAE,UAAU,gBAAgB,WAAW,iBAC3C,qBAAqB,OAAO,OAAO,CAAC,CAAC,KACvC;CAGA,MAAM,gBAAgB,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC;CACtD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,iBAAiB,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;CACxD,MAAM,mBAAmB,OAAO,MAAM,EAAE,MAAM,aAAa,CAAC;CAC5D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CACpD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,oBAAoB,OAAO,MAAM,EAAE,MAAM,cAAc,CAAC;CAC9D,MAAM,kBAAkB,OAAO,MAAM,EAAE,MAAM,YAAY,CAAC;CAC1D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CAGpD,MAAM,KAAK,SAAS,OAAO,WAAW;CACtC,MAAM,QAAQ,SAAS,UAAU,SAAS,IAAI,aAAa,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,UACJ,SAAS,UAAU,WAAW,IAAI,eAAe,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC,CAAC;CACpF,MAAM,YACJ,SAAS,UAAU,aAAa,IAAI,qBAAqB,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,mBACJ,SAAS,UAAU,aAAa,IAAI,uBAAuB;CAC7D,MAAM,SAAS,IAAI,OAAO,WAAW,OAAO;EAC1C,GAAI,OAAO,iBAAiB;GAAE,WAAW;GAAgB,SAAS,OAAO;EAAY;EACrF,kBAAkB,OAAO;CAC3B,CAAC;CAKD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;EAC9E,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;CAC1E,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,gBAAgB,CAAC,CAAC;EAC/E,QAAQ,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;EACzC,KAAK;EACL;CACF,CAAC;CAKD,MAAM,mBAAmB,IAAI,kBAAkB,KAAK,QAAQ;EAC1D,eAAe,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EACnF,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;CACrE,EAAE;CACF,MAAM,gBAAgB,IAAI,wBAAwB;EAChD,MAAM,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EAC1E,aAAa,IAAI,yBAAyB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EAC3E,QAAQ;EACR,KAAK;EACL,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC;EACpC;EACA,YAAY;GAAE,kBAAkB,OAAO;GAAkB,aAAa,OAAO;EAAY;CAC3F,CAAC;CAKD,MAAM,WAAW,IAAI,gBACnB,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,CACtE;CAEA,MAAM,aAAa,IAAI,kBAAkB,KAAK,QAAQ;EACpD,SAAS,IAAI,yBAAyB,IAAI,aAAa;EACvD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,UAAU,IAAI,mBAAmB;EACrC,MAAM,IAAI,yBAAyB,IAAI,aAAa;EACpD,KAAK;EACL;EACA,QAAQ;CACV,CAAC;CAED,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,cAAc,IAAI,8BAA8B,IAAI,kBAAkB;EACtE,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,eAAe,IAAI,wBAAwB;EAC/C,MAAM,IAAI,8BAA8B,IAAI,kBAAkB;EAC9D,KAAK;EACL,QAAQ;CACV,CAAC;CAGD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,cAAc;EAC1D,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,cAAc;EACtD;EACA,KAAK;EACL,QAAQ;CACV,CAAC;CAED,MAAM,aAAa,IAAI,sBAAsB;EAC3C,MAAM,IAAI,4BAA4B,IAAI,gBAAgB;EAC1D,QAAQ;EACC;EACT,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,YAAY,IAAI,4BAA4B,IAAI,gBAAgB;GAChE,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF;EACA,QAAQ;CACV,CAAC;CACD,MAAM,SAAS,IAAI,kBAAkB;EACnC;EACA,MAAM,IAAI,wBAAwB,IAAI,YAAY;EAClD,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,QAAQ,IAAI,wBAAwB,IAAI,YAAY;GACpD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,QAAQ;CACV,CAAC;CAED,MAAM,YAAY;EAChB,UAAU,IAAI,0BAA0B;GACtC,MAAM,IAAI,0BAA0B,IAAI,eAAe;GACvD,QAAQ;EACV,CAAC;EACD,WAAW,IAAI,2BAA2B;GACxC,MAAM,IAAI,2BAA2B,IAAI,eAAe;GACxD,QAAQ;EACV,CAAC;EACD,OAAO,IAAI,uBAAuB;GAChC,QAAQ,IAAI,uBAAuB,IAAI,eAAe;GACtD;GACA;GACA;GACA,uBAAuB,OAAO;GAC9B,QAAQ;EACV,CAAC;CACH;CAEA,MAAM,kBAAkB,IAAI,uBAC1B,IACA,OAAO,oBACP,kBACF;CAKA,MAAM,uBAAuB,MAAM,iBAAiB,SAAS,YAAY,kBAAkB;CAG3F,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,aAAa,IAAI,6BAA6B,IAAI,kBAAkB;EACpE,aAAa,IAAI,uBAAuB,IAAI,OAAO,oBAAoB,kBAAkB;EACzF,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,eAAe,IAAI,wBAAwB;EAC/C,UAAU;EACV,MAAM,IAAI,6BAA6B,IAAI,kBAAkB;EAC7D,KAAK;EACL,aAAa;EACb,QAAQ;CACV,CAAC;CAKD,MAAM,iBAAiB,IAAI,kBAAkB,KAAK,QAAQ;EACxD,aAAa,IAAI,6BAA6B,IAAI,iBAAiB;EACnE,MAAM,IAAI,gCAAgC,IAAI,iBAAiB;EAC/D,QAAQ,IAAI,sBAAsB,IAAI,iBAAiB;CACzD,EAAE;CAGF,MAAM,gBAA+B;EACnC,cAAc,OAAO,OAAO,eACzB,MAAM,UAAU,SAAS,IAAI,OAAO,SAAS,EAAA,EAAI,SAAS;EAC7D,aAAa,OAAO,OAAO,cAAc;GACvC,MAAM,SAAS,MAAM,QAAQ,UAAU,OAAO,SAAS;GACvD,IAAI,QACF,OAAO;IAAE,IAAI,OAAO;IAAI,OAAO,OAAO;GAAM;GAE9C,MAAM,WAAW,MAAM,QAAQ,YAAY,OAAO,SAAS;GAC3D,OAAO,WAAW;IAAE,IAAI,SAAS;IAAI,OAAO,SAAS;GAAM,IAAI;EACjE;CACF;CAEA,MAAM,cAAc,IAAI,uBAAuB;EAC7C,MAAM,IAAI,6BAA6B,IAAI,iBAAiB;EAC5D,UAAU,IAAI,gCAAgC,IAAI,iBAAiB;EACnE,KAAK;EACL,QAAQ;EACR;EACA,SAAS;EACT;EACA,QAAQ;CACV,CAAC;CACD,iBAAiB,SAAS,WAAW;CAErC,MAAM,WAAW,IAAI,iBAAiB;CACtC,gCAAgC,UAAU,QAAQ,aAAa;CAG/D,SAAS,cAAc,UAAU,YAAY,OAAO,KAAK,CAAC;CAC1D,MAAM,eAAe,oBAAoB,OAAO,MAAM;CACtD,MAAM,cAAc,IAAI,mBACtB,IAAI,mBAAmB,IAAI,YAAY,GACvC,UACA,cACA,YACF;CAKA,MAAM,OAAO,IAAI,WAAW;EAC1B;EACA,SAAS,OAAO;EAChB,QAAQ,OAAO;EACf,gBAAgB,OAAO;EACvB,OAAO;GACL,mBAAmB,OAAO,SAAS;IACjC,MAAM,SAAS,kBAAkB;KAC/B,OAAO,KAAK,KAAK;KACjB,KAAK;IACP,CAAC;GACH;GACA,eAAe,OAAO,EAAE,OAAO,UAAU;IACvC,MAAM,SAAS,cAAc;KAC3B;KACA;IACF,CAAC;GACH;GACA,kBAAkB,OAAO,SAAS;IAChC,MAAM,EAAE,OAAO,SAAS;IACxB,MAAM,CAAC,WAAW,YAAY,KAAK,MAAM,GAAG;IAG5C,MAAM,aAAa,MAAM,SAAS,iBAAiB;KACjD;KACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;KAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;IAC3C,CAAC;IAED,OAAO,EACL,MAAM;KACJ,GAAG;KACH,IAAI,WAAW;IACjB,EACF;GACF;GACA,qBAAqB,OAAO,YAAY;IACtC,MAAM,SAAS,MAAM,SAAS,oBAAoB,QAAQ,MAAM;IAChE,IAAI,CAAC,QACH;IAEF,MAAM,OAAO,MAAM,cAAc,mBAAmB,OAAO,EAAE;IAC7D,IAAI,KAAK,WAAW,GAClB;IAGF,MAAM,MAAM,MAAM,cAAc,QAAQ,KAAK,EAAE,CAAE,KAAK;IACtD,IAAI,CAAC,KACH;IAGF,OAAO,EAAE,MAAM;KAAE,GAAG;KAAS,sBAAsB,IAAI;IAAG,EAAE;GAC9D;GAIA,0BAA0B,OAAO,EAAE,cAAc,KAAK,MAAM,aAAa;IACvE,MAAM,YAAY,MAAM,cAAc,mBAAmB;KACvD,SAAS,OAAO;KAChB,GAAG;KACH,MAAM,IAAI,QAAQ,KAAA;IACpB,CAAC;IACD,OAAO,EAAE,MAAM;KAAE,GAAG;KAAK,IAAI,UAAU;IAAG,EAAE;GAC9C;GACA,0BAA0B,OAAO,EAAE,mBAAmB;IACpD,MAAM,cAAc,mBAAmB,aAAa,IAAI,YAAY;GACtE;GACA,0BAA0B,OAAO,EAAE,mBAAmB;IACpD,MAAM,cAAc,mBAAmB,aAAa,EAAE;GACxD;GACA,iBAAiB,OAAO,EAAE,aAAa;IACrC,MAAM,cAAc,WAAW;KAC7B,OAAO,OAAO;KACd,QAAQ,OAAO;KACf,MAAM,UAAU,OAAO,IAAI;IAC7B,CAAC;GACH;GACA,oBAAoB,OAAO,EAAE,aAAa;IACxC,MAAM,cAAc,cAAc,OAAO,gBAAgB,OAAO,MAAM;GACxE;EACF;EACA,QAAQ,OAAO,MAAM,EAAE,MAAM,OAAO,CAAC;EACrC,cAAc,OAAO;EACrB,eAAe,OAAO;CACxB,CAAC;CAED,OAAO;EACL;EACA;EACA;EAEA,aAAa;EACb;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA;EACA;EACA;EACA,gBAAgB;EAEhB,UAAU;CACZ;AACF"}
1	+ {"version":3,"file":"container.js","names":[],"sources":["../../src/app/container.ts"],"sourcesContent":["// Wires adapters + services in dependency order. Starts nothing.\nimport {\n createDb,\n DrizzleAssetsRepository,\n DrizzleAutomationRunsRepository,\n DrizzleAutomationsRepository,\n DrizzleConnectionsRepository,\n DrizzleContentRepository,\n DrizzleCredentialStore,\n DrizzleAdminRepository,\n DrizzleDiscussionRepository,\n DrizzlePostRepository,\n DrizzleChatRepository,\n DrizzleEntitlementsRepository,\n DrizzleIdentityRepository,\n DrizzleMemberRepository,\n DrizzleMembersRepository,\n DrizzleNotificationsRepository,\n DrizzleOrganizationsRepository,\n DrizzleOutboxAppender,\n DrizzleOutboxStore,\n DrizzleProgressRepository,\n DrizzleSettingsRepository,\n DrizzleUnitOfWork,\n} from '@headless-lms/adapter-db';\nimport { InMemoryEventBus } from '@headless-lms/adapter-defaults/events';\nimport {\n PollingOutboxRelay,\n type PollingOutboxRelayConfig,\n} from '@headless-lms/adapter-defaults/events/outbox-relay';\nimport { InlineAutomationEngine } from '@headless-lms/adapter-defaults/workflows';\nimport { FetchWebhookSender } from '@headless-lms/adapter-defaults/webhooks';\nimport { EmailAdapter, StubTemplateRenderer } from '@headless-lms/adapter-defaults/email';\nimport {\n createRootLogger,\n type LogLevel,\n type PinoInstance,\n requestLogContext,\n type RequestLogContext,\n} from '@headless-lms/adapter-defaults/logging';\nimport { StorageAdapter } from '@headless-lms/adapter-defaults/storage';\nimport { BetterAuth } from '@headless-lms/adapter-auth';\n\nimport { ContentService } from '@headless-lms/core/content';\nimport { EntitlementsServiceImpl } from '@headless-lms/core/entitlements';\nimport { ProgressServiceImpl } from '@headless-lms/core/progress';\nimport {\n ChatServiceImpl,\n DiscussionServiceImpl,\n PostServiceImpl,\n} from '@headless-lms/core/discussion';\nimport {\n IdentityServiceImpl,\n NotificationServiceImpl,\n type SessionAdmin,\n} from '@headless-lms/core/identity';\nimport {\n type OrgAdmin,\n OrganizationServiceImpl,\n parseRole,\n} from '@headless-lms/core/organizations';\nimport { AssetsServiceImpl, createFileUrls } from '@headless-lms/core/assets';\nimport { IntegrationsServiceImpl } from '@headless-lms/core/integrations';\nimport { AutomationsServiceImpl } from '@headless-lms/core/automations';\nimport { loadIntegrations } from './integrations.js';\nimport { mcpEndpoints, type McpEndpoints } from './mcp-endpoints.js';\nimport { communityMail } from './community-mail.js';\nimport { AdminReportServiceImpl } from '@headless-lms/core/reporting/admin';\nimport { MemberReportServiceImpl } from '@headless-lms/core/reporting/member';\nimport { Mailer, type MailerLookups } from '@headless-lms/core/shared/mailer';\nimport { SettingsService } from '@headless-lms/core/shared/settings';\n\nimport type {\n CredentialStore,\n EmailSender,\n Logger,\n ObjectStorage,\n OutboxRelay,\n TemplateContext,\n TemplateRenderer,\n} from '@headless-lms/core/shared/ports';\nimport type { AutomationEngine, WebhookSender } from '@headless-lms/core/types';\n\n/** Installation-supplied ports; an absent slot falls back to a fail-loudly stub. /\nexport interface AdapterOverrides {\n email?: EmailSender;\n storage?: ObjectStorage;\n /* Resolves email templates to rendered content. Absent → fail-loudly stub. /\n templates?: TemplateRenderer;\n /* Durable automation engine, or a factory given the automations logger. Absent → InlineAutomationEngine (in-process, one attempt per action). /\n workflows?: AutomationEngine \| ((logger: Logger) => AutomationEngine);\n /* Outbound HTTP for webhook deliveries. Absent → FetchWebhookSender (public addresses only, 10s timeout). /\n webhooks?: WebhookSender;\n}\n\nexport interface BuildContainerOptions {\n /* Installation's plugins folder, scanned by loadIntegrations. Absent → no integrations. /\n pluginsDir?: string;\n adapters?: AdapterOverrides;\n}\n\nexport interface Config {\n databaseUrl: string;\n authBaseURL: string;\n authSecret: string;\n trustedOrigins: string[];\n /* Branding threaded into every email template. Default: brandName \"Headless LMS\", baseUrl = adminAppUrl.\n * (studentPortalUrl is composed in from the top-level config field.) /\n emailBranding?: Omit<TemplateContext, 'studentPortalUrl'>;\n /* base64-encoded 32-byte key for the credential store (CREDENTIAL_STORE_KEY). /\n credentialStoreKey: string;\n /* Parent domain for cross-subdomain session cookies (e.g. \".example.com\"); undefined → host-only cookie. /\n cookieDomain?: string;\n /* Mark session cookies Secure (set behind HTTPS / in production). /\n secureCookies?: boolean;\n /* Student portal origin — invite links for students, and the origin whose signups are invite-gated. /\n studentPortalUrl: string;\n /* Admin app origin — invite links for staff. /\n adminAppUrl: string;\n /* Transactional-outbox relay tuning. All optional — see OUTBOX_DEFAULTS. /\n outbox?: OutboxConfig;\n /* Log level for the process-wide logger (HTTP + domain + relay). Default \"info\". /\n logging?: LoggingConfig;\n /* Lifetime of every signed file URL a response carries, seconds. Mirrors\n * ServerConfig.deliveryExpirySeconds — createContainer threads it through. /\n deliveryExpirySeconds: number;\n memberImageMaxBytes: number;\n /* Let the default webhook sender reach loopback and private network addresses. Local development only. /\n webhookAllowPrivateNetwork?: boolean;\n}\n\n/* Tuning for the transactional-outbox relay. Every field is optional; the\n * container resolves against OUTBOX_DEFAULTS. /\nexport interface OutboxConfig {\n /* Master switch for the same-process relay. Default true. /\n enabled?: boolean;\n /* Idle delay between polls. Default 1000. /\n pollIntervalMs?: number;\n /* Max rows fetched/dispatched per tick. Default 100. /\n batchSize?: number;\n}\n\nexport const OUTBOX_DEFAULTS: PollingOutboxRelayConfig = {\n enabled: true,\n pollIntervalMs: 1000,\n batchSize: 100,\n};\n\nexport function resolveOutboxConfig(config: OutboxConfig = {}): PollingOutboxRelayConfig {\n const overrides = Object.fromEntries(\n Object.entries(config).filter(([, value]) => value !== undefined),\n );\n return { ...OUTBOX_DEFAULTS, ...overrides };\n}\n\n/* Logging tuning. Optional; resolved against LOGGING_DEFAULTS. /\nexport interface LoggingConfig {\n /* Minimum level emitted. Default \"info\". /\n level?: LogLevel;\n}\n\nexport const LOGGING_DEFAULTS: Required<LoggingConfig> = { level: 'info' };\n\nexport function resolveLoggingConfig(config: LoggingConfig = {}): Required<LoggingConfig> {\n return { level: config.level ?? LOGGING_DEFAULTS.level };\n}\n\nexport interface Container {\n auth: BetterAuth;\n mcp: McpEndpoints;\n // Org Provider\n orgProvider: OrgAdmin;\n\n // Domains\n identity: IdentityServiceImpl;\n notifications: NotificationServiceImpl;\n organizations: OrganizationServiceImpl;\n content: ContentService;\n entitlements: EntitlementsServiceImpl;\n progress: ProgressServiceImpl;\n discussion: DiscussionServiceImpl;\n posts: PostServiceImpl;\n chats: ChatServiceImpl;\n assets: AssetsServiceImpl;\n integrations: IntegrationsServiceImpl;\n automations: AutomationsServiceImpl;\n /* Cross-cutting settings store. Not a context — a leaf every context may use;\n * inject `settings.for('<namespace>')` into a service, never the service itself. /\n settings: SettingsService;\n // Reporting read layer (composed cross-context reads; owns no domain rules).\n reporting: {\n admin: AdminReportServiceImpl;\n member: MemberReportServiceImpl;\n };\n storage: ObjectStorage;\n mailer: Mailer;\n /* Shared secure credential store — encrypted at rest, org-scoped, decrypt at point of use. /\n credentials: CredentialStore;\n /* The outbox relay — constructed but NEVER started by the container; the\n * installation's entry point starts it after listen (gen-openapi must not\n * poll). buildServer stops it onClose. /\n outboxRelay: OutboxRelay;\n /* The automation engine — constructed but NEVER started by the container;\n * the installation's entry point starts it after listen (gen-openapi must\n * not run a worker). buildServer stops it onClose. /\n automationEngine: AutomationEngine;\n /* Root logger port — components receive children bound with { name }. /\n logger: Logger;\n /* The raw pino root; buildServer hands it to Fastify so HTTP shares the stream. /\n loggerInstance: PinoInstance;\n /* Request-scoped log correlation; the HTTP layer enters it per request. /\n requestContext: RequestLogContext;\n /* Identity's session-write port; the auth adapter fulfils it. /\n sessions: SessionAdmin;\n}\n\nexport async function buildContainer(\n config: Config,\n options?: BuildContainerOptions,\n): Promise<Container> {\n const { instance: loggerInstance, logger } = createRootLogger(\n resolveLoggingConfig(config.logging).level,\n );\n // One child per domain — a context's service and repositories share it.\n\n const contentLogger = logger.child({ name: 'content' });\n const entitlementsLogger = logger.child({ name: 'entitlements' });\n const progressLogger = logger.child({ name: 'progress' });\n const discussionLogger = logger.child({ name: 'discussion' });\n const assetsLogger = logger.child({ name: 'assets' });\n const integrationsLogger = logger.child({ name: 'integrations' });\n const automationsLogger = logger.child({ name: 'automations' });\n const reportingLogger = logger.child({ name: 'reporting' });\n const outboxLogger = logger.child({ name: 'outbox' });\n\n // Outbound adapters\n const db = createDb(config.databaseUrl);\n const email = options?.adapters?.email ?? new EmailAdapter(logger.child({ name: 'email' }));\n const storage: ObjectStorage =\n options?.adapters?.storage ?? new StorageAdapter(logger.child({ name: 'storage' }));\n const templates =\n options?.adapters?.templates ?? new StubTemplateRenderer(logger.child({ name: 'email' }));\n const workflows = options?.adapters?.workflows;\n const automationEngine: AutomationEngine =\n typeof workflows === 'function'\n ? workflows(automationsLogger)\n : (workflows ?? new InlineAutomationEngine(automationsLogger));\n const mailer = new Mailer(templates, email, {\n ...(config.emailBranding ?? { brandName: 'Headless LMS', baseUrl: config.adminAppUrl }),\n studentPortalUrl: config.studentPortalUrl,\n });\n\n const fileUrls = createFileUrls(config.authBaseURL);\n const assets = new AssetsServiceImpl({\n storage,\n repo: new DrizzleAssetsRepository(db, assetsLogger),\n uow: new DrizzleUnitOfWork(db, (tx) => ({\n assets: new DrizzleAssetsRepository(tx, assetsLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n })),\n memberImageMaxBytes: config.memberImageMaxBytes,\n downloadLinkExpirySeconds: config.deliveryExpirySeconds,\n fileUrls,\n logger: assetsLogger,\n });\n\n /\n * Identity\n /\n const identityUoW = new DrizzleUnitOfWork(db, (tx) => ({\n identity: new DrizzleIdentityRepository(tx, logger.child({ name: 'identity' })),\n outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'identity' })),\n }));\n const identity = new IdentityServiceImpl({\n repo: new DrizzleIdentityRepository(db, logger.child({ name: 'identity_repo' })),\n logger: logger.child({ name: 'identity' }),\n uow: identityUoW,\n mailer,\n images: assets,\n fileUrls,\n });\n const notifications = new NotificationServiceImpl({\n repo: new DrizzleNotificationsRepository(db),\n logger: logger.child({ name: 'notifications' }),\n });\n\n /\n * Organization\n /\n const organizationsRepo = new DrizzleOrganizationsRepository(db, logger.child({ name: 'org' }));\n const organizationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n organizations: new DrizzleOrganizationsRepository(tx, logger.child({ name: 'org' })),\n outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'org' })),\n }));\n const orgAdminRef: { current: OrgAdmin \| undefined } = { current: undefined };\n const organizations = new OrganizationServiceImpl({\n repo: organizationsRepo,\n membersRepo: new DrizzleMembersRepository(db, logger.child({ name: 'org' })),\n people: identity,\n uow: organizationsUow,\n orgAdmin: () => {\n if (!orgAdminRef.current) {\n throw new Error('orgAdmin not initialised');\n }\n return orgAdminRef.current;\n },\n logger: logger.child({ name: 'org' }),\n mailer,\n inviteUrls: { studentPortalUrl: config.studentPortalUrl, adminAppUrl: config.adminAppUrl },\n });\n\n /\n * Settings\n /\n const settings = new SettingsService(\n new DrizzleSettingsRepository(db, logger.child({ name: 'settings' })),\n );\n // Content: reads on the root db; course writes + outbox append in one tx.\n const contentUow = new DrizzleUnitOfWork(db, (tx) => ({\n content: new DrizzleContentRepository(tx, contentLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n }));\n const content = new ContentService({\n repo: new DrizzleContentRepository(db, contentLogger),\n uow: contentUow,\n libraryAssets: assets,\n files: assets,\n fileUrls,\n logger: contentLogger,\n });\n // Entitlements: reads on the root db; writes + outbox append in one tx.\n const entitlementsUow = new DrizzleUnitOfWork(db, (tx) => ({\n entitlements: new DrizzleEntitlementsRepository(tx, entitlementsLogger),\n spaces: new DrizzleContentRepository(tx, contentLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n }));\n const authors = {\n roleOf: async (orgId: string, orgUserId: string) => {\n const row = await organizationsRepo.findOrgUserById(orgId, orgUserId);\n return row?.role ?? null;\n },\n rolesOf: async (orgId: string, orgUserIds: string[]) => {\n const rows = await organizationsRepo.findOrgUsersByIds(orgId, orgUserIds);\n return Object.fromEntries(rows.map((row) => [row.id, row.role]));\n },\n };\n const entitlementsRepo = new DrizzleEntitlementsRepository(db, entitlementsLogger);\n const entitlements = new EntitlementsServiceImpl({\n repo: entitlementsRepo,\n content,\n uow: entitlementsUow,\n logger: entitlementsLogger,\n });\n // Progress: report writes + outbox append in one tx; content supplies the\n // structure and completion rules the service evaluates against.\n const progressUow = new DrizzleUnitOfWork(db, (tx) => ({\n progress: new DrizzleProgressRepository(tx, progressLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n }));\n const progress = new ProgressServiceImpl({\n repo: new DrizzleProgressRepository(db, progressLogger),\n content,\n access: entitlements,\n uow: progressUow,\n logger: progressLogger,\n });\n\n const postReads = new DrizzlePostRepository(db, discussionLogger);\n const discussionReads = new DrizzleDiscussionRepository(db, discussionLogger);\n const chatReads = new DrizzleChatRepository(db, discussionLogger);\n const posts = new PostServiceImpl({\n repo: postReads,\n access: entitlements,\n content,\n authors,\n profiles: discussionReads,\n comments: discussionReads,\n images: assets,\n fileUrls,\n uow: new DrizzleUnitOfWork(db, (tx) => ({\n posts: new DrizzlePostRepository(tx, discussionLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n })),\n logger: discussionLogger,\n });\n const chats = new ChatServiceImpl({\n repo: chatReads,\n access: entitlements,\n content,\n authors,\n profiles: discussionReads,\n images: assets,\n fileUrls,\n uow: new DrizzleUnitOfWork(db, (tx) => ({\n chats: new DrizzleChatRepository(tx, discussionLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n })),\n logger: discussionLogger,\n });\n const discussion = new DiscussionServiceImpl({\n repo: discussionReads,\n access: entitlements,\n content: content,\n posts,\n communities: { listIds: (orgId) => content.listPublishedCommunityIds(orgId) },\n fileUrls,\n uow: new DrizzleUnitOfWork(db, (tx) => ({\n discussion: new DrizzleDiscussionRepository(tx, discussionLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n })),\n settings,\n logger: discussionLogger,\n });\n\n const reporting = {\n admin: new AdminReportServiceImpl({\n repo: new DrizzleAdminRepository(db, reportingLogger),\n }),\n member: new MemberReportServiceImpl({\n repo: new DrizzleMemberRepository(db, reportingLogger),\n content,\n progress,\n files: assets,\n fileUrls,\n access: entitlements,\n notifications,\n posts,\n chats,\n }),\n };\n\n const credentialStore = new DrizzleCredentialStore(\n db,\n config.credentialStoreKey,\n integrationsLogger,\n );\n // The integrations this deployment supports: the installation's declared\n // plugins folder (directory name = integration id), loaded at startup.\n // Connect/configure reject undeclared ids and validate config with the\n // integration's own schema. No folder → no integrations.\n const integrationsRegistry = await loadIntegrations(options?.pluginsDir, integrationsLogger);\n // Integrations: credential + connection writes + outbox append in one tx\n // (a tx-bound credential store instance shares the scope's transaction).\n const integrationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n connections: new DrizzleConnectionsRepository(tx, integrationsLogger),\n credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, integrationsLogger),\n outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n }));\n const integrations = new IntegrationsServiceImpl({\n registry: integrationsRegistry,\n repo: new DrizzleConnectionsRepository(db, integrationsLogger),\n uow: integrationsUow,\n credentials: credentialStore,\n logger: integrationsLogger,\n });\n\n // Automations: run writes + outbox append in one tx; the engine drives\n // execution (register below), integrations supplies the loaded\n // integrations' actions for `available`.\n const automationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n automations: new DrizzleAutomationsRepository(tx, automationsLogger),\n runs: new DrizzleAutomationRunsRepository(tx, automationsLogger),\n credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, automationsLogger),\n outbox: new DrizzleOutboxAppender(tx, automationsLogger),\n }));\n // Emails triggered by row-shaped events resolve their recipient and content\n // details at send time — the event carries ids only.\n const mailerLookups: MailerLookups = {\n orgUserPerson: async (orgId, orgUserId) => {\n const orgUser = await organizationsRepo.findOrgUserById(orgId, orgUserId);\n const user = orgUser ? await identity.getUserById(orgUser.userId) : null;\n return user ? { userId: user.id, email: user.email } : null;\n },\n contentInfo: async (orgId, contentId) => {\n const course = await content.getCourse(orgId, contentId);\n if (course) {\n return { id: course.id, title: course.title, type: course.type };\n }\n const download = await content.getDownload(orgId, contentId);\n if (download) {\n return { id: download.id, title: download.title, type: download.type };\n }\n const community = await content.getCommunity(orgId, contentId);\n return community ? { id: community.id, title: community.title, type: community.type } : null;\n },\n };\n\n const runsRepo = new DrizzleAutomationRunsRepository(db, automationsLogger);\n const wired = communityMail({\n content,\n entitlements,\n organizations,\n identity,\n posts,\n discussion,\n chats,\n assets,\n });\n const automations = new AutomationsServiceImpl({\n repo: new DrizzleAutomationsRepository(db, automationsLogger),\n runsRepo,\n uow: automationsUow,\n engine: automationEngine,\n mailer,\n lookups: mailerLookups,\n integrations,\n credentials: credentialStore,\n webhooks:\n options?.adapters?.webhooks ??\n new FetchWebhookSender({ allowPrivateNetwork: config.webhookAllowPrivateNetwork }),\n mail: wired.mail,\n grants: wired.grants,\n desk: notifications,\n scheduledWork: wired.scheduledWork,\n logger: automationsLogger,\n });\n automationEngine.register(automations);\n\n const eventBus = new InMemoryEventBus();\n eventBus.subscribeAll((event) => automations.handle(event));\n const outboxConfig = resolveOutboxConfig(config.outbox);\n const outboxRelay = new PollingOutboxRelay(\n new DrizzleOutboxStore(db, outboxLogger),\n eventBus,\n outboxConfig,\n outboxLogger,\n );\n\n /\n * Auth Adapter\n /\n const authLogger = logger.child({ name: 'auth' });\n // Hook failures otherwise surface through Better Auth's route as an opaque\n // 500 — log which hook died before rethrowing.\n const authHook =\n <A extends unknown[], R>(name: string, fn: (...args: A) => Promise<R>) =>\n async (...args: A): Promise<R> => {\n try {\n return await fn(...args);\n } catch (err) {\n authLogger.error(`auth hook ${name} failed`, { err });\n throw err;\n }\n };\n const mcp = mcpEndpoints(config);\n if (!mcp.oauthEnabled) {\n authLogger.warn(\n 'MCP OAuth is off: BETTER_AUTH_URL must be https or a loopback host; /mcp accepts API keys only',\n { authBaseURL: config.authBaseURL },\n );\n }\n const auth = new BetterAuth({\n db,\n baseUrl: config.authBaseURL,\n mcp: {\n oauthEnabled: mcp.oauthEnabled,\n resource: mcp.resource,\n loginPage: mcp.loginPage,\n consentPage: mcp.consentPage,\n orgPickerPage: mcp.orgPickerPage,\n },\n secret: config.authSecret,\n trustedOrigins: config.trustedOrigins,\n hooks: {\n sendResetPassword: async ({ user, url }) => {\n await identity.sendPasswordReset({ email: user.email, url });\n },\n onPasswordReset: async ({ user }) => {\n await identity.sendPasswordChanged({ email: user.email });\n },\n sendMagicLink: authHook('sendMagicLink', async ({ email, url }) => {\n await identity.sendMagicLink({\n email,\n url,\n });\n }),\n beforeUserCreate: authHook('beforeUserCreate', async (user) => {\n const { email, name } = user;\n const [firstName, lastName] = name.split(' ');\n // Better Auth has not minted an id yet — the id returned below becomes\n // its account id. A person provisioned at invite time is linked instead of re-created.\n const domainUser = await identity.linkOrCreateUser({\n email,\n ...(firstName !== undefined && { firstName }),\n ...(lastName !== undefined && { lastName }),\n });\n\n return {\n data: {\n ...user,\n id: domainUser.id,\n },\n };\n }),\n beforeCreateSession: authHook('beforeCreateSession', async (session) => {\n const person = await identity.getUserByExternalId(session.userId);\n if (!person) {\n return;\n }\n const orgs = await organizations.getOrgUsersForUser(person.id);\n if (orgs.length !== 1) {\n return;\n }\n // TODO - fix, why default to the first?\n const org = await organizations.getById(orgs[0]!.orgId);\n if (!org) {\n return;\n }\n\n return { data: { ...session, activeOrganizationId: org.id } };\n }),\n /\n * We're making sure the domain org creates and using the same ID for better-auth org ID.\n */\n beforeCreateOrganization: authHook(\n 'beforeCreateOrganization',\n async ({ organization: org, user: baUser }) => {\n const domainOrg = await organizations.createOrganization({\n ownerId: baUser.id,\n ...org,\n logo: org.logo ?? undefined,\n });\n return { data: { ...org, id: domainOrg.id } };\n },\n ),\n beforeUpdateOrganization: authHook('beforeUpdateOrganization', async ({ organization }) => {\n await organizations.updateOrganization(organization.id, organization);\n }),\n beforeDeleteOrganization: authHook('beforeDeleteOrganization', async ({ organization }) => {\n await organizations.deleteOrganization(organization.id);\n }),\n beforeAddMember: authHook('beforeAddMember', async ({ member }) => {\n await organizations.addOrgUser({\n orgId: member.organizationId,\n userId: member.userId,\n role: parseRole(member.role),\n });\n }),\n beforeUpdateMemberRole: authHook('beforeUpdateMemberRole', async ({ member, newRole }) => {\n await organizations.updateOrgUser(member.organizationId, member.userId, {\n role: parseRole(newRole),\n });\n }),\n beforeRemoveMember: authHook('beforeRemoveMember', async ({ member }) => {\n await organizations.removeOrgUser(member.organizationId, member.userId);\n }),\n },\n logger: authLogger,\n cookieDomain: config.cookieDomain,\n secureCookies: config.secureCookies,\n });\n orgAdminRef.current = auth;\n\n return {\n auth,\n mcp,\n identity,\n notifications,\n organizations,\n // Better Auth owns org writes; the same instance fulfils the OrgAdmin port.\n orgProvider: auth,\n content,\n entitlements,\n progress,\n discussion,\n posts,\n chats,\n assets,\n integrations,\n automations,\n settings,\n reporting,\n storage,\n mailer,\n credentials: credentialStore,\n outboxRelay,\n automationEngine,\n logger,\n loggerInstance,\n requestContext: requestLogContext,\n // Better Auth owns the session store; the same instance fulfils SessionAdmin.\n sessions: auth,\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA8IA,MAAa,kBAA4C;CACvD,SAAS;CACT,gBAAgB;CAChB,WAAW;AACb;AAEA,SAAgB,oBAAoB,SAAuB,CAAC,GAA6B;CACvF,MAAM,YAAY,OAAO,YACvB,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAClE;CACA,OAAO;EAAE,GAAG;EAAiB,GAAG;CAAU;AAC5C;AAQA,MAAa,mBAA4C,EAAE,OAAO,OAAO;AAEzE,SAAgB,qBAAqB,SAAwB,CAAC,GAA4B;CACxF,OAAO,EAAE,OAAO,OAAO,SAAS,iBAAiB,MAAM;AACzD;AAmDA,eAAsB,eACpB,QACA,SACoB;CACpB,MAAM,EAAE,UAAU,gBAAgB,WAAW,iBAC3C,qBAAqB,OAAO,OAAO,CAAC,CAAC,KACvC;CAGA,MAAM,gBAAgB,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC;CACtD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,iBAAiB,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;CACxD,MAAM,mBAAmB,OAAO,MAAM,EAAE,MAAM,aAAa,CAAC;CAC5D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CACpD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,oBAAoB,OAAO,MAAM,EAAE,MAAM,cAAc,CAAC;CAC9D,MAAM,kBAAkB,OAAO,MAAM,EAAE,MAAM,YAAY,CAAC;CAC1D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CAGpD,MAAM,KAAK,SAAS,OAAO,WAAW;CACtC,MAAM,QAAQ,SAAS,UAAU,SAAS,IAAI,aAAa,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,UACJ,SAAS,UAAU,WAAW,IAAI,eAAe,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC,CAAC;CACpF,MAAM,YACJ,SAAS,UAAU,aAAa,IAAI,qBAAqB,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,YAAY,SAAS,UAAU;CACrC,MAAM,mBACJ,OAAO,cAAc,aACjB,UAAU,iBAAiB,IAC1B,aAAa,IAAI,uBAAuB,iBAAiB;CAChE,MAAM,SAAS,IAAI,OAAO,WAAW,OAAO;EAC1C,GAAI,OAAO,iBAAiB;GAAE,WAAW;GAAgB,SAAS,OAAO;EAAY;EACrF,kBAAkB,OAAO;CAC3B,CAAC;CAED,MAAM,WAAW,eAAe,OAAO,WAAW;CAClD,MAAM,SAAS,IAAI,kBAAkB;EACnC;EACA,MAAM,IAAI,wBAAwB,IAAI,YAAY;EAClD,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,QAAQ,IAAI,wBAAwB,IAAI,YAAY;GACpD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,qBAAqB,OAAO;EAC5B,2BAA2B,OAAO;EAClC;EACA,QAAQ;CACV,CAAC;CAKD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;EAC9E,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;CAC1E,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,gBAAgB,CAAC,CAAC;EAC/E,QAAQ,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;EACzC,KAAK;EACL;EACA,QAAQ;EACR;CACF,CAAC;CACD,MAAM,gBAAgB,IAAI,wBAAwB;EAChD,MAAM,IAAI,+BAA+B,EAAE;EAC3C,QAAQ,OAAO,MAAM,EAAE,MAAM,gBAAgB,CAAC;CAChD,CAAC;CAKD,MAAM,oBAAoB,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;CAC9F,MAAM,mBAAmB,IAAI,kBAAkB,KAAK,QAAQ;EAC1D,eAAe,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EACnF,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;CACrE,EAAE;CACF,MAAM,cAAiD,EAAE,SAAS,KAAA,EAAU;CAC5E,MAAM,gBAAgB,IAAI,wBAAwB;EAChD,MAAM;EACN,aAAa,IAAI,yBAAyB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EAC3E,QAAQ;EACR,KAAK;EACL,gBAAgB;GACd,IAAI,CAAC,YAAY,SACf,MAAM,IAAI,MAAM,0BAA0B;GAE5C,OAAO,YAAY;EACrB;EACA,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC;EACpC;EACA,YAAY;GAAE,kBAAkB,OAAO;GAAkB,aAAa,OAAO;EAAY;CAC3F,CAAC;CAKD,MAAM,WAAW,IAAI,gBACnB,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,CACtE;CAEA,MAAM,aAAa,IAAI,kBAAkB,KAAK,QAAQ;EACpD,SAAS,IAAI,yBAAyB,IAAI,aAAa;EACvD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,UAAU,IAAI,eAAe;EACjC,MAAM,IAAI,yBAAyB,IAAI,aAAa;EACpD,KAAK;EACL,eAAe;EACf,OAAO;EACP;EACA,QAAQ;CACV,CAAC;CAED,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,cAAc,IAAI,8BAA8B,IAAI,kBAAkB;EACtE,QAAQ,IAAI,yBAAyB,IAAI,aAAa;EACtD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,UAAU;EACd,QAAQ,OAAO,OAAe,cAAsB;GAElD,QAAO,MADW,kBAAkB,gBAAgB,OAAO,SAAS,EAAA,EACxD,QAAQ;EACtB;EACA,SAAS,OAAO,OAAe,eAAyB;GACtD,MAAM,OAAO,MAAM,kBAAkB,kBAAkB,OAAO,UAAU;GACxE,OAAO,OAAO,YAAY,KAAK,KAAK,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC;EACjE;CACF;CAEA,MAAM,eAAe,IAAI,wBAAwB;EAC/C,MAAM,IAFqB,8BAA8B,IAAI,kBAExC;EACrB;EACA,KAAK;EACL,QAAQ;CACV,CAAC;CAGD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,cAAc;EAC1D,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,cAAc;EACtD;EACA,QAAQ;EACR,KAAK;EACL,QAAQ;CACV,CAAC;CAED,MAAM,YAAY,IAAI,sBAAsB,IAAI,gBAAgB;CAChE,MAAM,kBAAkB,IAAI,4BAA4B,IAAI,gBAAgB;CAC5E,MAAM,YAAY,IAAI,sBAAsB,IAAI,gBAAgB;CAChE,MAAM,QAAQ,IAAI,gBAAgB;EAChC,MAAM;EACN,QAAQ;EACR;EACA;EACA,UAAU;EACV,UAAU;EACV,QAAQ;EACR;EACA,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,OAAO,IAAI,sBAAsB,IAAI,gBAAgB;GACrD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,QAAQ;CACV,CAAC;CACD,MAAM,QAAQ,IAAI,gBAAgB;EAChC,MAAM;EACN,QAAQ;EACR;EACA;EACA,UAAU;EACV,QAAQ;EACR;EACA,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,OAAO,IAAI,sBAAsB,IAAI,gBAAgB;GACrD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,QAAQ;CACV,CAAC;CACD,MAAM,aAAa,IAAI,sBAAsB;EAC3C,MAAM;EACN,QAAQ;EACC;EACT;EACA,aAAa,EAAE,UAAU,UAAU,QAAQ,0BAA0B,KAAK,EAAE;EAC5E;EACA,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,YAAY,IAAI,4BAA4B,IAAI,gBAAgB;GAChE,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF;EACA,QAAQ;CACV,CAAC;CAED,MAAM,YAAY;EAChB,OAAO,IAAI,uBAAuB,EAChC,MAAM,IAAI,uBAAuB,IAAI,eAAe,EACtD,CAAC;EACD,QAAQ,IAAI,wBAAwB;GAClC,MAAM,IAAI,wBAAwB,IAAI,eAAe;GACrD;GACA;GACA,OAAO;GACP;GACA,QAAQ;GACR;GACA;GACA;EACF,CAAC;CACH;CAEA,MAAM,kBAAkB,IAAI,uBAC1B,IACA,OAAO,oBACP,kBACF;CAKA,MAAM,uBAAuB,MAAM,iBAAiB,SAAS,YAAY,kBAAkB;CAG3F,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,aAAa,IAAI,6BAA6B,IAAI,kBAAkB;EACpE,aAAa,IAAI,uBAAuB,IAAI,OAAO,oBAAoB,kBAAkB;EACzF,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,eAAe,IAAI,wBAAwB;EAC/C,UAAU;EACV,MAAM,IAAI,6BAA6B,IAAI,kBAAkB;EAC7D,KAAK;EACL,aAAa;EACb,QAAQ;CACV,CAAC;CAKD,MAAM,iBAAiB,IAAI,kBAAkB,KAAK,QAAQ;EACxD,aAAa,IAAI,6BAA6B,IAAI,iBAAiB;EACnE,MAAM,IAAI,gCAAgC,IAAI,iBAAiB;EAC/D,aAAa,IAAI,uBAAuB,IAAI,OAAO,oBAAoB,iBAAiB;EACxF,QAAQ,IAAI,sBAAsB,IAAI,iBAAiB;CACzD,EAAE;CAGF,MAAM,gBAA+B;EACnC,eAAe,OAAO,OAAO,cAAc;GACzC,MAAM,UAAU,MAAM,kBAAkB,gBAAgB,OAAO,SAAS;GACxE,MAAM,OAAO,UAAU,MAAM,SAAS,YAAY,QAAQ,MAAM,IAAI;GACpE,OAAO,OAAO;IAAE,QAAQ,KAAK;IAAI,OAAO,KAAK;GAAM,IAAI;EACzD;EACA,aAAa,OAAO,OAAO,cAAc;GACvC,MAAM,SAAS,MAAM,QAAQ,UAAU,OAAO,SAAS;GACvD,IAAI,QACF,OAAO;IAAE,IAAI,OAAO;IAAI,OAAO,OAAO;IAAO,MAAM,OAAO;GAAK;GAEjE,MAAM,WAAW,MAAM,QAAQ,YAAY,OAAO,SAAS;GAC3D,IAAI,UACF,OAAO;IAAE,IAAI,SAAS;IAAI,OAAO,SAAS;IAAO,MAAM,SAAS;GAAK;GAEvE,MAAM,YAAY,MAAM,QAAQ,aAAa,OAAO,SAAS;GAC7D,OAAO,YAAY;IAAE,IAAI,UAAU;IAAI,OAAO,UAAU;IAAO,MAAM,UAAU;GAAK,IAAI;EAC1F;CACF;CAEA,MAAM,WAAW,IAAI,gCAAgC,IAAI,iBAAiB;CAC1E,MAAM,QAAQ,cAAc;EAC1B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,MAAM,cAAc,IAAI,uBAAuB;EAC7C,MAAM,IAAI,6BAA6B,IAAI,iBAAiB;EAC5D;EACA,KAAK;EACL,QAAQ;EACR;EACA,SAAS;EACT;EACA,aAAa;EACb,UACE,SAAS,UAAU,YACnB,IAAI,mBAAmB,EAAE,qBAAqB,OAAO,2BAA2B,CAAC;EACnF,MAAM,MAAM;EACZ,QAAQ,MAAM;EACd,MAAM;EACN,eAAe,MAAM;EACrB,QAAQ;CACV,CAAC;CACD,iBAAiB,SAAS,WAAW;CAErC,MAAM,WAAW,IAAI,iBAAiB;CACtC,SAAS,cAAc,UAAU,YAAY,OAAO,KAAK,CAAC;CAC1D,MAAM,eAAe,oBAAoB,OAAO,MAAM;CACtD,MAAM,cAAc,IAAI,mBACtB,IAAI,mBAAmB,IAAI,YAAY,GACvC,UACA,cACA,YACF;CAKA,MAAM,aAAa,OAAO,MAAM,EAAE,MAAM,OAAO,CAAC;CAGhD,MAAM,YACqB,MAAc,OACvC,OAAO,GAAG,SAAwB;EAChC,IAAI;GACF,OAAO,MAAM,GAAG,GAAG,IAAI;EACzB,SAAS,KAAK;GACZ,WAAW,MAAM,aAAa,KAAK,UAAU,EAAE,IAAI,CAAC;GACpD,MAAM;EACR;CACF;CACF,MAAM,MAAM,aAAa,MAAM;CAC/B,IAAI,CAAC,IAAI,cACP,WAAW,KACT,kGACA,EAAE,aAAa,OAAO,YAAY,CACpC;CAEF,MAAM,OAAO,IAAI,WAAW;EAC1B;EACA,SAAS,OAAO;EAChB,KAAK;GACH,cAAc,IAAI;GAClB,UAAU,IAAI;GACd,WAAW,IAAI;GACf,aAAa,IAAI;GACjB,eAAe,IAAI;EACrB;EACA,QAAQ,OAAO;EACf,gBAAgB,OAAO;EACvB,OAAO;GACL,mBAAmB,OAAO,EAAE,MAAM,UAAU;IAC1C,MAAM,SAAS,kBAAkB;KAAE,OAAO,KAAK;KAAO;IAAI,CAAC;GAC7D;GACA,iBAAiB,OAAO,EAAE,WAAW;IACnC,MAAM,SAAS,oBAAoB,EAAE,OAAO,KAAK,MAAM,CAAC;GAC1D;GACA,eAAe,SAAS,iBAAiB,OAAO,EAAE,OAAO,UAAU;IACjE,MAAM,SAAS,cAAc;KAC3B;KACA;IACF,CAAC;GACH,CAAC;GACD,kBAAkB,SAAS,oBAAoB,OAAO,SAAS;IAC7D,MAAM,EAAE,OAAO,SAAS;IACxB,MAAM,CAAC,WAAW,YAAY,KAAK,MAAM,GAAG;IAG5C,MAAM,aAAa,MAAM,SAAS,iBAAiB;KACjD;KACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;KAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;IAC3C,CAAC;IAED,OAAO,EACL,MAAM;KACJ,GAAG;KACH,IAAI,WAAW;IACjB,EACF;GACF,CAAC;GACD,qBAAqB,SAAS,uBAAuB,OAAO,YAAY;IACtE,MAAM,SAAS,MAAM,SAAS,oBAAoB,QAAQ,MAAM;IAChE,IAAI,CAAC,QACH;IAEF,MAAM,OAAO,MAAM,cAAc,mBAAmB,OAAO,EAAE;IAC7D,IAAI,KAAK,WAAW,GAClB;IAGF,MAAM,MAAM,MAAM,cAAc,QAAQ,KAAK,EAAE,CAAE,KAAK;IACtD,IAAI,CAAC,KACH;IAGF,OAAO,EAAE,MAAM;KAAE,GAAG;KAAS,sBAAsB,IAAI;IAAG,EAAE;GAC9D,CAAC;GAID,0BAA0B,SACxB,4BACA,OAAO,EAAE,cAAc,KAAK,MAAM,aAAa;IAC7C,MAAM,YAAY,MAAM,cAAc,mBAAmB;KACvD,SAAS,OAAO;KAChB,GAAG;KACH,MAAM,IAAI,QAAQ,KAAA;IACpB,CAAC;IACD,OAAO,EAAE,MAAM;KAAE,GAAG;KAAK,IAAI,UAAU;IAAG,EAAE;GAC9C,CACF;GACA,0BAA0B,SAAS,4BAA4B,OAAO,EAAE,mBAAmB;IACzF,MAAM,cAAc,mBAAmB,aAAa,IAAI,YAAY;GACtE,CAAC;GACD,0BAA0B,SAAS,4BAA4B,OAAO,EAAE,mBAAmB;IACzF,MAAM,cAAc,mBAAmB,aAAa,EAAE;GACxD,CAAC;GACD,iBAAiB,SAAS,mBAAmB,OAAO,EAAE,aAAa;IACjE,MAAM,cAAc,WAAW;KAC7B,OAAO,OAAO;KACd,QAAQ,OAAO;KACf,MAAM,UAAU,OAAO,IAAI;IAC7B,CAAC;GACH,CAAC;GACD,wBAAwB,SAAS,0BAA0B,OAAO,EAAE,QAAQ,cAAc;IACxF,MAAM,cAAc,cAAc,OAAO,gBAAgB,OAAO,QAAQ,EACtE,MAAM,UAAU,OAAO,EACzB,CAAC;GACH,CAAC;GACD,oBAAoB,SAAS,sBAAsB,OAAO,EAAE,aAAa;IACvE,MAAM,cAAc,cAAc,OAAO,gBAAgB,OAAO,MAAM;GACxE,CAAC;EACH;EACA,QAAQ;EACR,cAAc,OAAO;EACrB,eAAe,OAAO;CACxB,CAAC;CACD,YAAY,UAAU;CAEtB,OAAO;EACL;EACA;EACA;EACA;EACA;EAEA,aAAa;EACb;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA;EACA;EACA;EACA,gBAAgB;EAEhB,UAAU;CACZ;AACF"}

package/dist/app/mcp-endpoints.d.ts ADDED Viewed

@@ -0,0 +1,13 @@
+import { McpAuthOptions } from "@headless-lms/adapter-auth";
+//#region src/app/mcp-endpoints.d.ts
+interface McpEndpoints extends McpAuthOptions {
+  issuer: string;
+  resourceMetadataUrl: string;
+}
+declare function mcpEndpoints(config: {
+  authBaseURL: string;
+  adminAppUrl: string;
+}): McpEndpoints;
+//#endregion
+export { McpEndpoints, mcpEndpoints };
+//# sourceMappingURL=mcp-endpoints.d.ts.map

package/dist/app/mcp-endpoints.js ADDED Viewed

@@ -0,0 +1,25 @@
+//#region src/app/mcp-endpoints.ts
+const trimSlash = (url) => url.replace(/\/+$/, "");
+const LOOPBACK_IPV4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+function oauthEligible(resource) {
+	const { protocol, hostname } = new URL(resource);
+	if (protocol === "https:") return true;
+	return protocol === "http:" && (hostname === "localhost" || hostname === "[::1]" || LOOPBACK_IPV4.test(hostname));
+}
+function mcpEndpoints(config) {
+	const api = trimSlash(config.authBaseURL);
+	const admin = trimSlash(config.adminAppUrl);
+	return {
+		oauthEnabled: oauthEligible(`${api}/mcp`),
+		resource: `${api}/mcp`,
+		resourceMetadataUrl: `${api}/.well-known/oauth-protected-resource/mcp`,
+		issuer: `${api}/api/auth`,
+		loginPage: `${admin}/login`,
+		consentPage: `${admin}/oauth/consent`,
+		orgPickerPage: `${admin}/onboarding/select-organization`
+	};
+}
+//#endregion
+export { mcpEndpoints };
+//# sourceMappingURL=mcp-endpoints.js.map

package/dist/app/mcp-endpoints.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"mcp-endpoints.js","names":[],"sources":["../../src/app/mcp-endpoints.ts"],"sourcesContent":["import type { McpAuthOptions } from '@headless-lms/adapter-auth';\n\nexport interface McpEndpoints extends McpAuthOptions {\n issuer: string;\n resourceMetadataUrl: string;\n}\n\nconst trimSlash = (url: string) => url.replace(/\\/+$/, '');\n\nconst LOOPBACK_IPV4 = /^127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$/;\n\nfunction oauthEligible(resource: string): boolean {\n const { protocol, hostname } = new URL(resource);\n if (protocol === 'https:') {\n return true;\n }\n return (\n protocol === 'http:' &&\n (hostname === 'localhost' || hostname === '[::1]' || LOOPBACK_IPV4.test(hostname))\n );\n}\n\nexport function mcpEndpoints(config: { authBaseURL: string; adminAppUrl: string }): McpEndpoints {\n const api = trimSlash(config.authBaseURL);\n const admin = trimSlash(config.adminAppUrl);\n return {\n oauthEnabled: oauthEligible(`${api}/mcp`),\n resource: `${api}/mcp`,\n resourceMetadataUrl: `${api}/.well-known/oauth-protected-resource/mcp`,\n issuer: `${api}/api/auth`,\n loginPage: `${admin}/login`,\n consentPage: `${admin}/oauth/consent`,\n orgPickerPage: `${admin}/onboarding/select-organization`,\n };\n}\n"],"mappings":";AAOA,MAAM,aAAa,QAAgB,IAAI,QAAQ,QAAQ,EAAE;AAEzD,MAAM,gBAAgB;AAEtB,SAAS,cAAc,UAA2B;CAChD,MAAM,EAAE,UAAU,aAAa,IAAI,IAAI,QAAQ;CAC/C,IAAI,aAAa,UACf,OAAO;CAET,OACE,aAAa,YACZ,aAAa,eAAe,aAAa,WAAW,cAAc,KAAK,QAAQ;AAEpF;AAEA,SAAgB,aAAa,QAAoE;CAC/F,MAAM,MAAM,UAAU,OAAO,WAAW;CACxC,MAAM,QAAQ,UAAU,OAAO,WAAW;CAC1C,OAAO;EACL,cAAc,cAAc,GAAG,IAAI,KAAK;EACxC,UAAU,GAAG,IAAI;EACjB,qBAAqB,GAAG,IAAI;EAC5B,QAAQ,GAAG,IAAI;EACf,WAAW,GAAG,MAAM;EACpB,aAAa,GAAG,MAAM;EACtB,eAAe,GAAG,MAAM;CAC1B;AACF"}

package/dist/http/config.d.ts CHANGED Viewed

@@ -13,10 +13,11 @@ interface ServerConfig {
    *  Unset → on. Turn off for a quiet dev console; app-level logs are
    *  unaffected either way. */
   requestLogging?: boolean;
-  /** Presigned URL lifetime for entitled download delivery, seconds. Separate
+  /** Lifetime of every signed file URL a response carries, seconds. Separate
    *  from the storage adapter's general download expiry so raising that one
    *  can't silently extend paywalled link lifetimes. */
   deliveryExpirySeconds: number;
+  memberImageMaxBytes: number;
   /** Everything the composition container needs to wire adapters + services. */
   container: Config;
 }

package/dist/http/errors.d.ts ADDED Viewed

@@ -0,0 +1,14 @@
+//#region src/http/errors.d.ts
+type Refusal = {
+  status: number;
+  error: string;
+  message: string;
+  issues?: {
+    path: string;
+    message: string;
+  }[];
+};
+declare function classifyError(error: unknown): Refusal | undefined;
+//#endregion
+export { Refusal, classifyError };
+//# sourceMappingURL=errors.d.ts.map