@headless-lms/server 0.2.0 → 0.3.0

package/dist/http/routes/webhooks.js

@@ -1,11 +1,11 @@
+import { refusals } from "../schemas/shared.js";
 import { resolveScope } from "../scope.js";
-import { ErrorBody } from "../schemas/shared.js";
 import { AutomationIdParam, CreateWebhookBody, CreatedWebhook, UpdateWebhookBody, Webhook, WebhookSecret } from "../schemas/automations.js";
 import "../schemas/index.js";
-import { NotFoundError } from "@headless-lms/core/shared/errors";
 import { z } from "zod";
+import { NotFoundError } from "@headless-lms/core/shared/errors";
 //#region src/http/routes/webhooks.ts
-const DELIVERY_DESCRIPTION = "Each subscribed event is POSTed to `url` as the JSON event envelope (`id`, `type`, `version`, `orgId`, `occurredAt`, `data`), signed per the Standard Webhooks spec: `webhook-id` (the event id, stable across retries), `webhook-timestamp` (unix seconds) and `webhook-signature` (`v1,` + base64 HMAC-SHA256 of `{webhook-id}.{webhook-timestamp}.{body}`, keyed with the base64-decoded part of the `whsec_` secret). Any non-2xx response or timeout is a failed attempt and is retried. Deliveries are the webhook's automation runs: `GET /api/automations/{id}/runs`.";
+const DELIVERY_DESCRIPTION = "Staff only (owner, admin, instructor). `url` must be a public address: localhost and private network addresses are refused when saved and when delivering. Each subscribed event is POSTed to `url` as the JSON event envelope (`id`, `type`, `version`, `orgId`, `occurredAt`, `data`), signed per the Standard Webhooks spec: `webhook-id` (the event id, stable across retries), `webhook-timestamp` (unix seconds) and `webhook-signature` (`v1,` + base64 HMAC-SHA256 of `{webhook-id}.{webhook-timestamp}.{body}`, keyed with the base64-decoded part of the `whsec_` secret). Any non-2xx response or timeout is a failed attempt and is retried. Deliveries are the webhook's automation runs: `GET /api/automations/{id}/runs`.";
 async function webhooksRoutes(app, container) {
 	const r = app.withTypeProvider();
 	const automations = container.automations;
@@ -17,8 +17,12 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "listWebhooks",
 			tags,
-			summary: "List the organization's webhooks",
-			response: { 200: z.array(Webhook) }
+			summary: "List the organization's webhooks (staff)",
+			description: "Staff only (owner, admin, instructor). Signing secrets are not included.",
+			response: {
+				200: z.array(Webhook),
+				...refusals(403)
+			}
 		},
 		handler: async (req) => {
 			const scope = await resolveScope(container, req);
@@ -32,12 +36,12 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "createWebhook",
 			tags,
-			summary: "Create a webhook — returns its signing secret",
+			summary: "Create a webhook (staff)",
 			description: DELIVERY_DESCRIPTION,
 			body: CreateWebhookBody,
 			response: {
 				201: CreatedWebhook,
-				400: ErrorBody
+				...refusals(400, 403)
 			}
 		},
 		handler: async (req, reply) => {
@@ -53,11 +57,12 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "getWebhook",
 			tags,
-			summary: "Get a webhook by id",
+			summary: "Get a webhook (staff)",
+			description: "Staff only (owner, admin, instructor). The signing secret is not included.",
 			params: AutomationIdParam,
 			response: {
 				200: Webhook,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req) => {
@@ -74,13 +79,13 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "updateWebhook",
 			tags,
-			summary: "Change a webhook's URL, events, description or enabled flag",
+			summary: "Change a webhook's URL, events, description or enabled flag (staff)",
+			description: "Staff only (owner, admin, instructor). Changes only the fields sent. 400 when an event is reserved or unknown.",
 			params: AutomationIdParam,
 			body: UpdateWebhookBody,
 			response: {
 				200: Webhook,
-				400: ErrorBody,
-				404: ErrorBody
+				...refusals(400, 403, 404)
 			}
 		},
 		handler: async (req) => {
@@ -97,11 +102,12 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "deleteWebhook",
 			tags,
-			summary: "Delete a webhook and its signing secret — its delivery history is kept",
+			summary: "Delete a webhook and its signing secret (staff)",
+			description: "Staff only (owner, admin, instructor). Its delivery history is kept.",
 			params: AutomationIdParam,
 			response: {
 				204: z.void(),
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req, reply) => {
@@ -117,11 +123,12 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "getWebhookSecret",
 			tags,
-			summary: "Reveal a webhook's signing secret",
+			summary: "Reveal a webhook's signing secret (staff)",
+			description: "Staff only (owner, admin, instructor).",
 			params: AutomationIdParam,
 			response: {
 				200: WebhookSecret,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req) => {
@@ -138,11 +145,12 @@ async function webhooksRoutes(app, container) {
 		schema: {
 			operationId: "rotateWebhookSecret",
 			tags,
-			summary: "Replace a webhook's signing secret — the old one stops working immediately",
+			summary: "Replace a webhook's signing secret (staff)",
+			description: "Staff only (owner, admin, instructor). The old secret stops working immediately.",
 			params: AutomationIdParam,
 			response: {
 				200: WebhookSecret,
-				404: ErrorBody
+				...refusals(403, 404)
 			}
 		},
 		handler: async (req) => {

package/dist/http/routes/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","names":[],"sources":["../../../src/http/routes/webhooks.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport { z } from 'zod';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  AutomationIdParam,\n  CreatedWebhook,\n  CreateWebhookBody,\n  ErrorBody,\n  UpdateWebhookBody,\n  Webhook,\n  WebhookSecret,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nconst DELIVERY_DESCRIPTION =\n  \"Each subscribed event is POSTed to `url` as the JSON event envelope (`id`, `type`, `version`, `orgId`, `occurredAt`, `data`), signed per the Standard Webhooks spec: `webhook-id` (the event id, stable across retries), `webhook-timestamp` (unix seconds) and `webhook-signature` (`v1,` + base64 HMAC-SHA256 of `{webhook-id}.{webhook-timestamp}.{body}`, keyed with the base64-decoded part of the `whsec_` secret). Any non-2xx response or timeout is a failed attempt and is retried. Deliveries are the webhook's automation runs: `GET /api/automations/{id}/runs`.\";\n\nexport async function webhooksRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const automations = container.automations;\n  const tags = ['Automations'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/automations/webhooks',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listWebhooks',\n      tags,\n      summary: \"List the organization's webhooks\",\n      response: { 200: z.array(Webhook) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return automations.listWebhooks(scope.orgId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/automations/webhooks',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createWebhook',\n      tags,\n      summary: 'Create a webhook — returns its signing secret',\n      description: DELIVERY_DESCRIPTION,\n      body: CreateWebhookBody,\n      response: { 201: CreatedWebhook, 400: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const webhook = await automations.createWebhook(scope.orgId, req.body);\n      return reply.code(201).send(webhook);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/automations/webhooks/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getWebhook',\n      tags,\n      summary: 'Get a webhook by id',\n      params: AutomationIdParam,\n      response: { 200: Webhook, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const webhook = await automations.getWebhook(scope.orgId, req.params.id);\n      if (!webhook) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return webhook;\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/automations/webhooks/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateWebhook',\n      tags,\n      summary: \"Change a webhook's URL, events, description or enabled flag\",\n      params: AutomationIdParam,\n      body: UpdateWebhookBody,\n      response: { 200: Webhook, 400: ErrorBody, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const webhook = await automations.updateWebhook(scope.orgId, req.params.id, req.body);\n      if (!webhook) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return webhook;\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/automations/webhooks/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteWebhook',\n      tags,\n      summary: 'Delete a webhook and its signing secret — its delivery history is kept',\n      params: AutomationIdParam,\n      response: { 204: z.void(), 404: ErrorBody },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const deleted = await automations.deleteWebhook(scope.orgId, req.params.id);\n      if (!deleted) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/automations/webhooks/:id/secret',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getWebhookSecret',\n      tags,\n      summary: \"Reveal a webhook's signing secret\",\n      params: AutomationIdParam,\n      response: { 200: WebhookSecret, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const secret = await automations.revealWebhookSecret(scope.orgId, req.params.id);\n      if (!secret) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return secret;\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/automations/webhooks/:id/secret/rotate',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'rotateWebhookSecret',\n      tags,\n      summary: \"Replace a webhook's signing secret — the old one stops working immediately\",\n      params: AutomationIdParam,\n      response: { 200: WebhookSecret, 404: ErrorBody },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const secret = await automations.rotateWebhookSecret(scope.orgId, req.params.id);\n      if (!secret) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return secret;\n    },\n  });\n}\n"],"mappings":";;;;;;;AAgBA,MAAM,uBACJ;AAEF,eAAsB,eAAe,KAAsB,WAAqC;CAC9F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,cAAc,UAAU;CAC9B,MAAM,OAAO,CAAC,aAAa;CAE3B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,UAAU,EAAE,KAAK,EAAE,MAAM,OAAO,EAAE;EACpC;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,YAAY,aAAa,MAAM,KAAK;EAC7C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAgB,KAAK;GAAU;EAClD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,YAAY,cAAc,MAAM,OAAO,IAAI,IAAI;GACrE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;EACrC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAS,KAAK;GAAU;EAC3C;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,YAAY,WAAW,MAAM,OAAO,IAAI,OAAO,EAAE;GACvE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAS,KAAK;IAAW,KAAK;GAAU;EAC3D;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,YAAY,cAAc,MAAM,OAAO,IAAI,OAAO,IAAI,IAAI,IAAI;GACpF,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,KAAK;GAAU;EAC5C;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,IAAI,CAAC,MADiB,YAAY,cAAc,MAAM,OAAO,IAAI,OAAO,EAAE,GAExE,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,KAAK;GAAU;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,YAAY,oBAAoB,MAAM,OAAO,IAAI,OAAO,EAAE;GAC/E,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,KAAK;GAAU;EACjD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,YAAY,oBAAoB,MAAM,OAAO,IAAI,OAAO,EAAE;GAC/E,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;AACH"}
+{"version":3,"file":"webhooks.js","names":[],"sources":["../../../src/http/routes/webhooks.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport { z } from 'zod';\nimport type { ZodTypeProvider } from 'fastify-type-provider-zod';\nimport {\n  AutomationIdParam,\n  CreatedWebhook,\n  CreateWebhookBody,\n  UpdateWebhookBody,\n  Webhook,\n  WebhookSecret,\n  refusals,\n} from '../schemas/index.js';\nimport { NotFoundError } from '@headless-lms/core/shared/errors';\nimport type { Container } from '../../app/container.js';\nimport { resolveScope } from '../scope.js';\n\nconst DELIVERY_DESCRIPTION =\n  \"Staff only (owner, admin, instructor). `url` must be a public address: localhost and private network addresses are refused when saved and when delivering. Each subscribed event is POSTed to `url` as the JSON event envelope (`id`, `type`, `version`, `orgId`, `occurredAt`, `data`), signed per the Standard Webhooks spec: `webhook-id` (the event id, stable across retries), `webhook-timestamp` (unix seconds) and `webhook-signature` (`v1,` + base64 HMAC-SHA256 of `{webhook-id}.{webhook-timestamp}.{body}`, keyed with the base64-decoded part of the `whsec_` secret). Any non-2xx response or timeout is a failed attempt and is retried. Deliveries are the webhook's automation runs: `GET /api/automations/{id}/runs`.\";\n\nexport async function webhooksRoutes(app: FastifyInstance, container: Container): Promise<void> {\n  const r = app.withTypeProvider<ZodTypeProvider>();\n  const automations = container.automations;\n  const tags = ['Automations'];\n\n  r.route({\n    method: 'GET',\n    url: '/api/automations/webhooks',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'listWebhooks',\n      tags,\n      summary: \"List the organization's webhooks (staff)\",\n      description: 'Staff only (owner, admin, instructor). Signing secrets are not included.',\n      response: { 200: z.array(Webhook), ...refusals(403) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      return automations.listWebhooks(scope.orgId);\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/automations/webhooks',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'createWebhook',\n      tags,\n      summary: 'Create a webhook (staff)',\n      description: DELIVERY_DESCRIPTION,\n      body: CreateWebhookBody,\n      response: { 201: CreatedWebhook, ...refusals(400, 403) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const webhook = await automations.createWebhook(scope.orgId, req.body);\n      return reply.code(201).send(webhook);\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/automations/webhooks/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getWebhook',\n      tags,\n      summary: 'Get a webhook (staff)',\n      description: 'Staff only (owner, admin, instructor). The signing secret is not included.',\n      params: AutomationIdParam,\n      response: { 200: Webhook, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const webhook = await automations.getWebhook(scope.orgId, req.params.id);\n      if (!webhook) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return webhook;\n    },\n  });\n\n  r.route({\n    method: 'PATCH',\n    url: '/api/automations/webhooks/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'updateWebhook',\n      tags,\n      summary: \"Change a webhook's URL, events, description or enabled flag (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). Changes only the fields sent. 400 when an event is reserved or unknown.',\n      params: AutomationIdParam,\n      body: UpdateWebhookBody,\n      response: { 200: Webhook, ...refusals(400, 403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const webhook = await automations.updateWebhook(scope.orgId, req.params.id, req.body);\n      if (!webhook) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return webhook;\n    },\n  });\n\n  r.route({\n    method: 'DELETE',\n    url: '/api/automations/webhooks/:id',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'deleteWebhook',\n      tags,\n      summary: 'Delete a webhook and its signing secret (staff)',\n      description: 'Staff only (owner, admin, instructor). Its delivery history is kept.',\n      params: AutomationIdParam,\n      response: { 204: z.void(), ...refusals(403, 404) },\n    },\n    handler: async (req, reply) => {\n      const scope = await resolveScope(container, req);\n      const deleted = await automations.deleteWebhook(scope.orgId, req.params.id);\n      if (!deleted) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return reply.code(204).send();\n    },\n  });\n\n  r.route({\n    method: 'GET',\n    url: '/api/automations/webhooks/:id/secret',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'getWebhookSecret',\n      tags,\n      summary: \"Reveal a webhook's signing secret (staff)\",\n      description: 'Staff only (owner, admin, instructor).',\n      params: AutomationIdParam,\n      response: { 200: WebhookSecret, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const secret = await automations.revealWebhookSecret(scope.orgId, req.params.id);\n      if (!secret) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return secret;\n    },\n  });\n\n  r.route({\n    method: 'POST',\n    url: '/api/automations/webhooks/:id/secret/rotate',\n    preHandler: app.requireOrgSession,\n    schema: {\n      operationId: 'rotateWebhookSecret',\n      tags,\n      summary: \"Replace a webhook's signing secret (staff)\",\n      description:\n        'Staff only (owner, admin, instructor). The old secret stops working immediately.',\n      params: AutomationIdParam,\n      response: { 200: WebhookSecret, ...refusals(403, 404) },\n    },\n    handler: async (req) => {\n      const scope = await resolveScope(container, req);\n      const secret = await automations.rotateWebhookSecret(scope.orgId, req.params.id);\n      if (!secret) {\n        throw new NotFoundError('Webhook', req.params.id);\n      }\n      return secret;\n    },\n  });\n}\n"],"mappings":";;;;;;;AAgBA,MAAM,uBACJ;AAEF,eAAsB,eAAe,KAAsB,WAAqC;CAC9F,MAAM,IAAI,IAAI,iBAAkC;CAChD,MAAM,cAAc,UAAU;CAC9B,MAAM,OAAO,CAAC,aAAa;CAE3B,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,UAAU;IAAE,KAAK,EAAE,MAAM,OAAO;IAAG,GAAG,SAAS,GAAG;GAAE;EACtD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,OAAO,YAAY,aAAa,MAAM,KAAK;EAC7C;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,MAAM;GACN,UAAU;IAAE,KAAK;IAAgB,GAAG,SAAS,KAAK,GAAG;GAAE;EACzD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,YAAY,cAAc,MAAM,OAAO,IAAI,IAAI;GACrE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;EACrC;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAS,GAAG,SAAS,KAAK,GAAG;GAAE;EAClD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,YAAY,WAAW,MAAM,OAAO,IAAI,OAAO,EAAE;GACvE,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,MAAM;GACN,UAAU;IAAE,KAAK;IAAS,GAAG,SAAS,KAAK,KAAK,GAAG;GAAE;EACvD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,UAAU,MAAM,YAAY,cAAc,MAAM,OAAO,IAAI,OAAO,IAAI,IAAI,IAAI;GACpF,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK,EAAE,KAAK;IAAG,GAAG,SAAS,KAAK,GAAG;GAAE;EACnD;EACA,SAAS,OAAO,KAAK,UAAU;GAC7B,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAE/C,IAAI,CAAC,MADiB,YAAY,cAAc,MAAM,OAAO,IAAI,OAAO,EAAE,GAExE,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;EAC9B;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aAAa;GACb,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,YAAY,oBAAoB,MAAM,OAAO,IAAI,OAAO,EAAE;GAC/E,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;CAED,EAAE,MAAM;EACN,QAAQ;EACR,KAAK;EACL,YAAY,IAAI;EAChB,QAAQ;GACN,aAAa;GACb;GACA,SAAS;GACT,aACE;GACF,QAAQ;GACR,UAAU;IAAE,KAAK;IAAe,GAAG,SAAS,KAAK,GAAG;GAAE;EACxD;EACA,SAAS,OAAO,QAAQ;GACtB,MAAM,QAAQ,MAAM,aAAa,WAAW,GAAG;GAC/C,MAAM,SAAS,MAAM,YAAY,oBAAoB,MAAM,OAAO,IAAI,OAAO,EAAE;GAC/E,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,WAAW,IAAI,OAAO,EAAE;GAElD,OAAO;EACT;CACF,CAAC;AACH"}

package/dist/http/routes.js

@@ -1,7 +1,9 @@
+import { communitiesRoutes } from "./routes/communities.js";
+import { communityModerationRoutes } from "./routes/community-moderation.js";
 import { coursesRoutes } from "./routes/courses.js";
 import { downloadsRoutes } from "./routes/downloads.js";
 import { bundlesRoutes } from "./routes/bundles.js";
-import { learnRoutes } from "./routes/learn/index.js";
+import { memberRoutes } from "./routes/member/index.js";
 import { discussionRoutes } from "./routes/discussion.js";
 import { activitiesRoutes } from "./routes/activities.js";
 import { studentsRoutes } from "./routes/students.js";
@@ -13,6 +15,7 @@ import { dashboardRoutes } from "./routes/dashboard.js";
 import { courseAnalyticsRoutes } from "./routes/course-analytics.js";
 import { assetsRoutes } from "./routes/assets.js";
 import { integrationsRoutes } from "./routes/integrations.js";
+import { accessRoutes } from "./routes/access.js";
 //#region src/http/routes.ts
 function registerRoutes(app, container) {
 	app.get("/health", async () => ({ status: "ok" }));
@@ -22,9 +25,11 @@ function registerRoutes(app, container) {
 	app.register(async (instance) => {
 		instance.addHook("onRequest", instance.requireOrgSession);
 		await coursesRoutes(instance, container);
+		await communitiesRoutes(instance, container);
+		await communityModerationRoutes(instance, container);
 		await downloadsRoutes(instance, container);
 		await bundlesRoutes(instance, container);
-		await learnRoutes(instance, container);
+		await memberRoutes(instance, container);
 		await discussionRoutes(instance, container);
 		await activitiesRoutes(instance, container);
 		await studentsRoutes(instance, container);
@@ -35,6 +40,7 @@ function registerRoutes(app, container) {
 		await courseAnalyticsRoutes(instance, container);
 		await assetsRoutes(instance, container);
 		await integrationsRoutes(instance, container);
+		await accessRoutes(instance, container);
 	});
 }
 //#endregion

package/dist/http/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","names":[],"sources":["../../src/http/routes.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { Container } from '../app/container.js';\nimport { coursesRoutes } from './routes/courses.js';\nimport { downloadsRoutes } from './routes/downloads.js';\nimport { bundlesRoutes } from './routes/bundles.js';\nimport { learnRoutes } from './routes/learn/index.js';\nimport { discussionRoutes } from './routes/discussion.js';\nimport { activitiesRoutes } from './routes/activities.js';\nimport { studentsRoutes } from './routes/students.js';\nimport { entitlementsRoutes } from './routes/entitlements.js';\nimport { automationsRoutes } from './routes/automations.js';\nimport { webhooksRoutes } from './routes/webhooks.js';\nimport { organizationsRoutes } from './routes/organizations.js';\nimport { dashboardRoutes } from './routes/dashboard.js';\nimport { courseAnalyticsRoutes } from './routes/course-analytics.js';\nimport { assetsRoutes } from './routes/assets.js';\nimport { integrationsRoutes } from './routes/integrations.js';\n\nexport function registerRoutes(app: FastifyInstance, container: Container): void {\n  app.get('/health', async () => ({ status: 'ok' }));\n\n  app.register(async (instance) => {\n    // instance.addHook('onRequest', instance.requireSession);\n    await organizationsRoutes(instance, container);\n  });\n\n  app.register(async (instance) => {\n    instance.addHook('onRequest', instance.requireOrgSession);\n    await coursesRoutes(instance, container);\n    await downloadsRoutes(instance, container);\n    await bundlesRoutes(instance, container);\n    await learnRoutes(instance, container);\n    await discussionRoutes(instance, container);\n    await activitiesRoutes(instance, container);\n    await studentsRoutes(instance, container);\n    await entitlementsRoutes(instance, container);\n    await automationsRoutes(instance, container);\n    await webhooksRoutes(instance, container);\n    await dashboardRoutes(instance, container);\n    await courseAnalyticsRoutes(instance, container);\n    await assetsRoutes(instance, container);\n    await integrationsRoutes(instance, container);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkBA,SAAgB,eAAe,KAAsB,WAA4B;CAC/E,IAAI,IAAI,WAAW,aAAa,EAAE,QAAQ,KAAK,EAAE;CAEjD,IAAI,SAAS,OAAO,aAAa;EAE/B,MAAM,oBAAoB,UAAU,SAAS;CAC/C,CAAC;CAED,IAAI,SAAS,OAAO,aAAa;EAC/B,SAAS,QAAQ,aAAa,SAAS,iBAAiB;EACxD,MAAM,cAAc,UAAU,SAAS;EACvC,MAAM,gBAAgB,UAAU,SAAS;EACzC,MAAM,cAAc,UAAU,SAAS;EACvC,MAAM,YAAY,UAAU,SAAS;EACrC,MAAM,iBAAiB,UAAU,SAAS;EAC1C,MAAM,iBAAiB,UAAU,SAAS;EAC1C,MAAM,eAAe,UAAU,SAAS;EACxC,MAAM,mBAAmB,UAAU,SAAS;EAC5C,MAAM,kBAAkB,UAAU,SAAS;EAC3C,MAAM,eAAe,UAAU,SAAS;EACxC,MAAM,gBAAgB,UAAU,SAAS;EACzC,MAAM,sBAAsB,UAAU,SAAS;EAC/C,MAAM,aAAa,UAAU,SAAS;EACtC,MAAM,mBAAmB,UAAU,SAAS;CAC9C,CAAC;AACH"}
+{"version":3,"file":"routes.js","names":[],"sources":["../../src/http/routes.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport type { Container } from '../app/container.js';\nimport { communitiesRoutes } from './routes/communities.js';\nimport { communityModerationRoutes } from './routes/community-moderation.js';\nimport { coursesRoutes } from './routes/courses.js';\nimport { downloadsRoutes } from './routes/downloads.js';\nimport { bundlesRoutes } from './routes/bundles.js';\nimport { memberRoutes } from './routes/member/index.js';\nimport { discussionRoutes } from './routes/discussion.js';\nimport { activitiesRoutes } from './routes/activities.js';\nimport { studentsRoutes } from './routes/students.js';\nimport { entitlementsRoutes } from './routes/entitlements.js';\nimport { automationsRoutes } from './routes/automations.js';\nimport { webhooksRoutes } from './routes/webhooks.js';\nimport { organizationsRoutes } from './routes/organizations.js';\nimport { dashboardRoutes } from './routes/dashboard.js';\nimport { courseAnalyticsRoutes } from './routes/course-analytics.js';\nimport { assetsRoutes } from './routes/assets.js';\nimport { integrationsRoutes } from './routes/integrations.js';\nimport { accessRoutes } from './routes/access.js';\n\nexport function registerRoutes(app: FastifyInstance, container: Container): void {\n  app.get('/health', async () => ({ status: 'ok' }));\n\n  app.register(async (instance) => {\n    // instance.addHook('onRequest', instance.requireSession);\n    await organizationsRoutes(instance, container);\n  });\n\n  app.register(async (instance) => {\n    instance.addHook('onRequest', instance.requireOrgSession);\n    await coursesRoutes(instance, container);\n    await communitiesRoutes(instance, container);\n    await communityModerationRoutes(instance, container);\n    await downloadsRoutes(instance, container);\n    await bundlesRoutes(instance, container);\n    await memberRoutes(instance, container);\n    await discussionRoutes(instance, container);\n    await activitiesRoutes(instance, container);\n    await studentsRoutes(instance, container);\n    await entitlementsRoutes(instance, container);\n    await automationsRoutes(instance, container);\n    await webhooksRoutes(instance, container);\n    await dashboardRoutes(instance, container);\n    await courseAnalyticsRoutes(instance, container);\n    await assetsRoutes(instance, container);\n    await integrationsRoutes(instance, container);\n    await accessRoutes(instance, container);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,eAAe,KAAsB,WAA4B;CAC/E,IAAI,IAAI,WAAW,aAAa,EAAE,QAAQ,KAAK,EAAE;CAEjD,IAAI,SAAS,OAAO,aAAa;EAE/B,MAAM,oBAAoB,UAAU,SAAS;CAC/C,CAAC;CAED,IAAI,SAAS,OAAO,aAAa;EAC/B,SAAS,QAAQ,aAAa,SAAS,iBAAiB;EACxD,MAAM,cAAc,UAAU,SAAS;EACvC,MAAM,kBAAkB,UAAU,SAAS;EAC3C,MAAM,0BAA0B,UAAU,SAAS;EACnD,MAAM,gBAAgB,UAAU,SAAS;EACzC,MAAM,cAAc,UAAU,SAAS;EACvC,MAAM,aAAa,UAAU,SAAS;EACtC,MAAM,iBAAiB,UAAU,SAAS;EAC1C,MAAM,iBAAiB,UAAU,SAAS;EAC1C,MAAM,eAAe,UAAU,SAAS;EACxC,MAAM,mBAAmB,UAAU,SAAS;EAC5C,MAAM,kBAAkB,UAAU,SAAS;EAC3C,MAAM,eAAe,UAAU,SAAS;EACxC,MAAM,gBAAgB,UAAU,SAAS;EACzC,MAAM,sBAAsB,UAAU,SAAS;EAC/C,MAAM,aAAa,UAAU,SAAS;EACtC,MAAM,mBAAmB,UAAU,SAAS;EAC5C,MAAM,aAAa,UAAU,SAAS;CACxC,CAAC;AACH"}

package/dist/http/schemas/access.d.ts

@@ -0,0 +1,146 @@
+import { z } from "zod";
+//#region src/http/schemas/access.d.ts
+declare const ScopeOption: z.ZodObject<{
+  scope: z.ZodEnum<{
+    "courses:read": "courses:read";
+    "courses:write": "courses:write";
+    "courses:delete": "courses:delete";
+    "downloads:read": "downloads:read";
+    "downloads:write": "downloads:write";
+    "downloads:delete": "downloads:delete";
+    "bundles:read": "bundles:read";
+    "bundles:write": "bundles:write";
+    "bundles:delete": "bundles:delete";
+    "media:read": "media:read";
+    "students:read": "students:read";
+    "students:invite": "students:invite";
+    "access:read": "access:read";
+    "access:write": "access:write";
+    "analytics:read": "analytics:read";
+    "automations:read": "automations:read";
+    "automations:write": "automations:write";
+    "automations:delete": "automations:delete";
+    "comments:read": "comments:read";
+    "comments:moderate": "comments:moderate";
+    "communities:read": "communities:read";
+    "communities:write": "communities:write";
+    "communities:delete": "communities:delete";
+    "community_members:read": "community_members:read";
+    "community_members:write": "community_members:write";
+    "community_moderation:read": "community_moderation:read";
+    "community_moderation:write": "community_moderation:write";
+  }>;
+  allowed: z.ZodBoolean;
+}, z.core.$strip>;
+declare const ScopeOptionList: z.ZodArray<z.ZodObject<{
+  scope: z.ZodEnum<{
+    "courses:read": "courses:read";
+    "courses:write": "courses:write";
+    "courses:delete": "courses:delete";
+    "downloads:read": "downloads:read";
+    "downloads:write": "downloads:write";
+    "downloads:delete": "downloads:delete";
+    "bundles:read": "bundles:read";
+    "bundles:write": "bundles:write";
+    "bundles:delete": "bundles:delete";
+    "media:read": "media:read";
+    "students:read": "students:read";
+    "students:invite": "students:invite";
+    "access:read": "access:read";
+    "access:write": "access:write";
+    "analytics:read": "analytics:read";
+    "automations:read": "automations:read";
+    "automations:write": "automations:write";
+    "automations:delete": "automations:delete";
+    "comments:read": "comments:read";
+    "comments:moderate": "comments:moderate";
+    "communities:read": "communities:read";
+    "communities:write": "communities:write";
+    "communities:delete": "communities:delete";
+    "community_members:read": "community_members:read";
+    "community_members:write": "community_members:write";
+    "community_moderation:read": "community_moderation:read";
+    "community_moderation:write": "community_moderation:write";
+  }>;
+  allowed: z.ZodBoolean;
+}, z.core.$strip>>;
+declare const ConnectedApp: z.ZodObject<{
+  clientId: z.ZodString;
+  name: z.ZodString;
+  iconUrl: z.ZodNullable<z.ZodString>;
+  scopes: z.ZodArray<z.ZodString>;
+  connectedAt: z.ZodCoercedDate<unknown>;
+}, z.core.$strip>;
+declare const ConnectedAppList: z.ZodArray<z.ZodObject<{
+  clientId: z.ZodString;
+  name: z.ZodString;
+  iconUrl: z.ZodNullable<z.ZodString>;
+  scopes: z.ZodArray<z.ZodString>;
+  connectedAt: z.ZodCoercedDate<unknown>;
+}, z.core.$strip>>;
+declare const ClientIdParam: z.ZodObject<{
+  clientId: z.ZodString;
+}, z.core.$strip>;
+declare const ApiKey: z.ZodObject<{
+  id: z.ZodString;
+  name: z.ZodNullable<z.ZodString>;
+  start: z.ZodNullable<z.ZodString>;
+  scopes: z.ZodArray<z.ZodString>;
+  createdAt: z.ZodCoercedDate<unknown>;
+  lastUsedAt: z.ZodNullable<z.ZodCoercedDate<unknown>>;
+}, z.core.$strip>;
+declare const ApiKeyList: z.ZodArray<z.ZodObject<{
+  id: z.ZodString;
+  name: z.ZodNullable<z.ZodString>;
+  start: z.ZodNullable<z.ZodString>;
+  scopes: z.ZodArray<z.ZodString>;
+  createdAt: z.ZodCoercedDate<unknown>;
+  lastUsedAt: z.ZodNullable<z.ZodCoercedDate<unknown>>;
+}, z.core.$strip>>;
+declare const CreatedApiKey: z.ZodObject<{
+  id: z.ZodString;
+  name: z.ZodNullable<z.ZodString>;
+  start: z.ZodNullable<z.ZodString>;
+  scopes: z.ZodArray<z.ZodString>;
+  createdAt: z.ZodCoercedDate<unknown>;
+  lastUsedAt: z.ZodNullable<z.ZodCoercedDate<unknown>>;
+  key: z.ZodString;
+}, z.core.$strip>;
+declare const CreateApiKey: z.ZodObject<{
+  name: z.ZodString;
+  scopes: z.ZodArray<z.ZodEnum<{
+    "courses:read": "courses:read";
+    "courses:write": "courses:write";
+    "courses:delete": "courses:delete";
+    "downloads:read": "downloads:read";
+    "downloads:write": "downloads:write";
+    "downloads:delete": "downloads:delete";
+    "bundles:read": "bundles:read";
+    "bundles:write": "bundles:write";
+    "bundles:delete": "bundles:delete";
+    "media:read": "media:read";
+    "students:read": "students:read";
+    "students:invite": "students:invite";
+    "access:read": "access:read";
+    "access:write": "access:write";
+    "analytics:read": "analytics:read";
+    "automations:read": "automations:read";
+    "automations:write": "automations:write";
+    "automations:delete": "automations:delete";
+    "comments:read": "comments:read";
+    "comments:moderate": "comments:moderate";
+    "communities:read": "communities:read";
+    "communities:write": "communities:write";
+    "communities:delete": "communities:delete";
+    "community_members:read": "community_members:read";
+    "community_members:write": "community_members:write";
+    "community_moderation:read": "community_moderation:read";
+    "community_moderation:write": "community_moderation:write";
+  }>>;
+}, z.core.$strip>;
+declare const ApiKeyIdParam: z.ZodObject<{
+  id: z.ZodString;
+}, z.core.$strip>;
+//#endregion
+export { ApiKey, ApiKeyIdParam, ApiKeyList, ClientIdParam, ConnectedApp, ConnectedAppList, CreateApiKey, CreatedApiKey, ScopeOption, ScopeOptionList };
+//# sourceMappingURL=access.d.ts.map

package/dist/http/schemas/access.js

@@ -0,0 +1,36 @@
+import { ACCESS_SCOPES } from "@headless-lms/core/organizations";
+import { z } from "zod";
+//#region src/http/schemas/access.ts
+const ScopeOption = z.object({
+	scope: z.enum(ACCESS_SCOPES),
+	allowed: z.boolean()
+});
+const ScopeOptionList = z.array(ScopeOption);
+const ConnectedApp = z.object({
+	clientId: z.string(),
+	name: z.string(),
+	iconUrl: z.string().nullable(),
+	scopes: z.array(z.string()),
+	connectedAt: z.coerce.date()
+});
+const ConnectedAppList = z.array(ConnectedApp);
+const ClientIdParam = z.object({ clientId: z.string() });
+const ApiKey = z.object({
+	id: z.string(),
+	name: z.string().nullable(),
+	start: z.string().nullable(),
+	scopes: z.array(z.string()),
+	createdAt: z.coerce.date(),
+	lastUsedAt: z.coerce.date().nullable()
+});
+const ApiKeyList = z.array(ApiKey);
+const CreatedApiKey = ApiKey.extend({ key: z.string() });
+const CreateApiKey = z.object({
+	name: z.string().trim().min(1).max(80),
+	scopes: z.array(z.enum(ACCESS_SCOPES)).min(1)
+});
+const ApiKeyIdParam = z.object({ id: z.string() });
+//#endregion
+export { ApiKey, ApiKeyIdParam, ApiKeyList, ClientIdParam, ConnectedApp, ConnectedAppList, CreateApiKey, CreatedApiKey, ScopeOption, ScopeOptionList };
+
+//# sourceMappingURL=access.js.map

package/dist/http/schemas/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","names":[],"sources":["../../../src/http/schemas/access.ts"],"sourcesContent":["import { z } from 'zod';\nimport { ACCESS_SCOPES } from '@headless-lms/core/organizations';\n\nexport const ScopeOption = z.object({ scope: z.enum(ACCESS_SCOPES), allowed: z.boolean() });\nexport const ScopeOptionList = z.array(ScopeOption);\n\nexport const ConnectedApp = z.object({\n  clientId: z.string(),\n  name: z.string(),\n  iconUrl: z.string().nullable(),\n  scopes: z.array(z.string()),\n  connectedAt: z.coerce.date(),\n});\nexport const ConnectedAppList = z.array(ConnectedApp);\nexport const ClientIdParam = z.object({ clientId: z.string() });\n\nexport const ApiKey = z.object({\n  id: z.string(),\n  name: z.string().nullable(),\n  start: z.string().nullable(),\n  scopes: z.array(z.string()),\n  createdAt: z.coerce.date(),\n  lastUsedAt: z.coerce.date().nullable(),\n});\nexport const ApiKeyList = z.array(ApiKey);\nexport const CreatedApiKey = ApiKey.extend({ key: z.string() });\nexport const CreateApiKey = z.object({\n  name: z.string().trim().min(1).max(80),\n  scopes: z.array(z.enum(ACCESS_SCOPES)).min(1),\n});\nexport const ApiKeyIdParam = z.object({ id: z.string() });\n"],"mappings":";;;AAGA,MAAa,cAAc,EAAE,OAAO;CAAE,OAAO,EAAE,KAAK,aAAa;CAAG,SAAS,EAAE,QAAQ;AAAE,CAAC;AAC1F,MAAa,kBAAkB,EAAE,MAAM,WAAW;AAElD,MAAa,eAAe,EAAE,OAAO;CACnC,UAAU,EAAE,OAAO;CACnB,MAAM,EAAE,OAAO;CACf,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;CAC1B,aAAa,EAAE,OAAO,KAAK;AAC7B,CAAC;AACD,MAAa,mBAAmB,EAAE,MAAM,YAAY;AACpD,MAAa,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAE9D,MAAa,SAAS,EAAE,OAAO;CAC7B,IAAI,EAAE,OAAO;CACb,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;CAC1B,WAAW,EAAE,OAAO,KAAK;CACzB,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC,SAAS;AACvC,CAAC;AACD,MAAa,aAAa,EAAE,MAAM,MAAM;AACxC,MAAa,gBAAgB,OAAO,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC9D,MAAa,eAAe,EAAE,OAAO;CACnC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;CACrC,QAAQ,EAAE,MAAM,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AACD,MAAa,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC"}

package/dist/http/schemas/activities.d.ts

@@ -9,6 +9,7 @@ declare const Activity: z.ZodObject<{
   settings: z.ZodNullable<z.ZodType<import("@headless-lms/core/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("@headless-lms/core/types").JsonValue, unknown>>>;
   createdAt: z.ZodCoercedDate<unknown>;
   updatedAt: z.ZodCoercedDate<unknown>;
+  assetUrls: z.ZodRecord<z.ZodString, z.ZodString>;
 }, z.core.$strict>;
 type Activity = z.infer<typeof Activity>;
 declare const ActivityAsset: z.ZodObject<{
@@ -42,7 +43,7 @@ declare const ModuleList: z.ZodArray<z.ZodObject<{
   updatedAt: z.ZodCoercedDate<unknown>;
 }, z.core.$strict>>;
 type ModuleList = z.infer<typeof ModuleList>;
-/** A course's activities as bare rows, ordered by (moduleId, seq). */
+/** A course's activities, each with the stable file URLs of the files it links, ordered by (moduleId, seq). */
 declare const ActivityList: z.ZodArray<z.ZodObject<{
   orgId: z.ZodString;
   id: z.ZodString;
@@ -52,6 +53,7 @@ declare const ActivityList: z.ZodArray<z.ZodObject<{
   settings: z.ZodNullable<z.ZodType<import("@headless-lms/core/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("@headless-lms/core/types").JsonValue, unknown>>>;
   createdAt: z.ZodCoercedDate<unknown>;
   updatedAt: z.ZodCoercedDate<unknown>;
+  assetUrls: z.ZodRecord<z.ZodString, z.ZodString>;
 }, z.core.$strict>>;
 type ActivityList = z.infer<typeof ActivityList>;
 /** A course's activity→asset link rows, ordered by (activityId, seq). */

package/dist/http/schemas/activities.js

@@ -1,12 +1,12 @@
 import { z } from "zod";
-import { activityAssetSchema, activitySchema, moduleSchema, saveActivityInputSchema } from "@headless-lms/core/schemas";
+import { activityAssetSchema, activityViewSchema, idSchema, moduleSchema, saveActivityInputSchema } from "@headless-lms/core/schemas";
 //#region src/http/schemas/activities.ts
-const Activity = activitySchema;
+const Activity = activityViewSchema;
 const ActivityAsset = activityAssetSchema;
 const Module = moduleSchema;
 /** Module/activity-write endpoints return the full, reordered module list. */
 const ModuleList = z.array(Module);
-/** A course's activities as bare rows, ordered by (moduleId, seq). */
+/** A course's activities, each with the stable file URLs of the files it links, ordered by (moduleId, seq). */
 const ActivityList = z.array(Activity);
 /** A course's activity→asset link rows, ordered by (activityId, seq). */
 const ActivityAssetList = z.array(ActivityAsset);
@@ -22,7 +22,7 @@ const ActivityPathParam = z.object({
 });
 const CreateModule = z.object({ title: z.string().min(1) });
 const UpdateModule = z.object({ title: z.string().min(1) });
-const ReorderInput = z.object({ orderedIds: z.array(z.string()) });
+const ReorderInput = z.object({ orderedIds: z.array(idSchema).max(500).describe("Every id in the collection, in the new order") });
 const SaveActivity = saveActivityInputSchema;
 //#endregion
 export { Activity, ActivityAsset, ActivityAssetList, ActivityList, ActivityPathParam, CourseIdPathParam, CreateModule, Module, ModuleList, ModulePathParam, ReorderInput, SaveActivity, UpdateModule };

package/dist/http/schemas/activities.js.map

@@ -1 +1 @@
-{"version":3,"file":"activities.js","names":[],"sources":["../../../src/http/schemas/activities.ts"],"sourcesContent":["// Course modules + activities resource schemas. A module holds an ordered list\n// of activities directly; each activity is a uniform, orderable unit placing an\n// opaque settings blob at a position (`seq`) with a set of linked assets.\nimport { z } from 'zod';\nimport {\n  activityAssetSchema,\n  activitySchema,\n  moduleSchema,\n  saveActivityInputSchema,\n} from '@headless-lms/core/schemas';\n\nexport const Activity = activitySchema;\nexport type Activity = z.infer<typeof Activity>;\n\nexport const ActivityAsset = activityAssetSchema;\nexport type ActivityAsset = z.infer<typeof ActivityAsset>;\n\nexport const Module = moduleSchema;\nexport type Module = z.infer<typeof Module>;\n\n/** Module/activity-write endpoints return the full, reordered module list. */\nexport const ModuleList = z.array(Module);\nexport type ModuleList = z.infer<typeof ModuleList>;\n\n/** A course's activities as bare rows, ordered by (moduleId, seq). */\nexport const ActivityList = z.array(Activity);\nexport type ActivityList = z.infer<typeof ActivityList>;\n\n/** A course's activity→asset link rows, ordered by (activityId, seq). */\nexport const ActivityAssetList = z.array(ActivityAsset);\nexport type ActivityAssetList = z.infer<typeof ActivityAssetList>;\n\nexport const CourseIdPathParam = z.object({ courseId: z.string() });\nexport type CourseIdPathParam = z.infer<typeof CourseIdPathParam>;\n\nexport const ModulePathParam = z.object({ courseId: z.string(), moduleId: z.string() });\nexport type ModulePathParam = z.infer<typeof ModulePathParam>;\n\nexport const ActivityPathParam = z.object({\n  courseId: z.string(),\n  moduleId: z.string(),\n  activityId: z.string(),\n});\nexport type ActivityPathParam = z.infer<typeof ActivityPathParam>;\n\nexport const CreateModule = z.object({ title: z.string().min(1) });\nexport type CreateModule = z.infer<typeof CreateModule>;\n\nexport const UpdateModule = z.object({ title: z.string().min(1) });\nexport type UpdateModule = z.infer<typeof UpdateModule>;\n\nexport const ReorderInput = z.object({ orderedIds: z.array(z.string()) });\nexport type ReorderInput = z.infer<typeof ReorderInput>;\n\nexport const SaveActivity = saveActivityInputSchema;\nexport type SaveActivity = z.infer<typeof SaveActivity>;\n"],"mappings":";;;AAWA,MAAa,WAAW;AAGxB,MAAa,gBAAgB;AAG7B,MAAa,SAAS;;AAItB,MAAa,aAAa,EAAE,MAAM,MAAM;;AAIxC,MAAa,eAAe,EAAE,MAAM,QAAQ;;AAI5C,MAAa,oBAAoB,EAAE,MAAM,aAAa;AAGtD,MAAa,oBAAoB,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAGlE,MAAa,kBAAkB,EAAE,OAAO;CAAE,UAAU,EAAE,OAAO;CAAG,UAAU,EAAE,OAAO;AAAE,CAAC;AAGtF,MAAa,oBAAoB,EAAE,OAAO;CACxC,UAAU,EAAE,OAAO;CACnB,UAAU,EAAE,OAAO;CACnB,YAAY,EAAE,OAAO;AACvB,CAAC;AAGD,MAAa,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAGjE,MAAa,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAGjE,MAAa,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AAGxE,MAAa,eAAe"}
+{"version":3,"file":"activities.js","names":[],"sources":["../../../src/http/schemas/activities.ts"],"sourcesContent":["// Course modules + activities resource schemas. A module holds an ordered list\n// of activities directly; each activity is a uniform, orderable unit placing an\n// opaque settings blob at a position (`seq`) with a set of linked assets.\nimport { z } from 'zod';\nimport {\n  activityAssetSchema,\n  activityViewSchema,\n  moduleSchema,\n  saveActivityInputSchema,\n  idSchema,\n} from '@headless-lms/core/schemas';\n\nexport const Activity = activityViewSchema;\nexport type Activity = z.infer<typeof Activity>;\n\nexport const ActivityAsset = activityAssetSchema;\nexport type ActivityAsset = z.infer<typeof ActivityAsset>;\n\nexport const Module = moduleSchema;\nexport type Module = z.infer<typeof Module>;\n\n/** Module/activity-write endpoints return the full, reordered module list. */\nexport const ModuleList = z.array(Module);\nexport type ModuleList = z.infer<typeof ModuleList>;\n\n/** A course's activities, each with the stable file URLs of the files it links, ordered by (moduleId, seq). */\nexport const ActivityList = z.array(Activity);\nexport type ActivityList = z.infer<typeof ActivityList>;\n\n/** A course's activity→asset link rows, ordered by (activityId, seq). */\nexport const ActivityAssetList = z.array(ActivityAsset);\nexport type ActivityAssetList = z.infer<typeof ActivityAssetList>;\n\nexport const CourseIdPathParam = z.object({ courseId: z.string() });\nexport type CourseIdPathParam = z.infer<typeof CourseIdPathParam>;\n\nexport const ModulePathParam = z.object({ courseId: z.string(), moduleId: z.string() });\nexport type ModulePathParam = z.infer<typeof ModulePathParam>;\n\nexport const ActivityPathParam = z.object({\n  courseId: z.string(),\n  moduleId: z.string(),\n  activityId: z.string(),\n});\nexport type ActivityPathParam = z.infer<typeof ActivityPathParam>;\n\nexport const CreateModule = z.object({ title: z.string().min(1) });\nexport type CreateModule = z.infer<typeof CreateModule>;\n\nexport const UpdateModule = z.object({ title: z.string().min(1) });\nexport type UpdateModule = z.infer<typeof UpdateModule>;\n\nexport const ReorderInput = z.object({\n  orderedIds: z.array(idSchema).max(500).describe('Every id in the collection, in the new order'),\n});\nexport type ReorderInput = z.infer<typeof ReorderInput>;\n\nexport const SaveActivity = saveActivityInputSchema;\nexport type SaveActivity = z.infer<typeof SaveActivity>;\n"],"mappings":";;;AAYA,MAAa,WAAW;AAGxB,MAAa,gBAAgB;AAG7B,MAAa,SAAS;;AAItB,MAAa,aAAa,EAAE,MAAM,MAAM;;AAIxC,MAAa,eAAe,EAAE,MAAM,QAAQ;;AAI5C,MAAa,oBAAoB,EAAE,MAAM,aAAa;AAGtD,MAAa,oBAAoB,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAGlE,MAAa,kBAAkB,EAAE,OAAO;CAAE,UAAU,EAAE,OAAO;CAAG,UAAU,EAAE,OAAO;AAAE,CAAC;AAGtF,MAAa,oBAAoB,EAAE,OAAO;CACxC,UAAU,EAAE,OAAO;CACnB,UAAU,EAAE,OAAO;CACnB,YAAY,EAAE,OAAO;AACvB,CAAC;AAGD,MAAa,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAGjE,MAAa,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAGjE,MAAa,eAAe,EAAE,OAAO,EACnC,YAAY,EAAE,MAAM,QAAQ,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,8CAA8C,EAChG,CAAC;AAGD,MAAa,eAAe"}