@headless-lms/server 0.2.0 → 0.3.0

package/dist/app/container.js.map

@@ -1 +1 @@
-{"version":3,"file":"container.js","names":[],"sources":["../../src/app/container.ts"],"sourcesContent":["// Wires adapters + services in dependency order. Starts nothing.\nimport {\n  createDb,\n  DrizzleAssetsRepository,\n  DrizzleAutomationRunsRepository,\n  DrizzleAutomationsRepository,\n  DrizzleConnectionsRepository,\n  DrizzleContentRepository,\n  DrizzleCredentialStore,\n  DrizzleCourseAnalyticsRepository,\n  DrizzleDashboardRepository,\n  DrizzleDiscussionRepository,\n  DrizzleEntitlementsRepository,\n  DrizzleIdentityRepository,\n  DrizzleLearnRepository,\n  DrizzleMembersRepository,\n  DrizzleOrganizationsRepository,\n  DrizzleOutboxAppender,\n  DrizzleOutboxStore,\n  DrizzleProgressRepository,\n  DrizzleSettingsRepository,\n  DrizzleStudentsRepository,\n  DrizzleUnitOfWork,\n} from '@headless-lms/adapter-db';\nimport { InMemoryEventBus } from '@headless-lms/adapter-defaults/events';\nimport {\n  PollingOutboxRelay,\n  type PollingOutboxRelayConfig,\n} from '@headless-lms/adapter-defaults/events/outbox-relay';\nimport { InlineAutomationEngine } from '@headless-lms/adapter-defaults/workflows';\nimport { FetchWebhookSender } from '@headless-lms/adapter-defaults/webhooks';\nimport { EmailAdapter, StubTemplateRenderer } from '@headless-lms/adapter-defaults/email';\nimport {\n  createRootLogger,\n  type LogLevel,\n  type PinoInstance,\n  requestLogContext,\n  type RequestLogContext,\n} from '@headless-lms/adapter-defaults/logging';\nimport { StorageAdapter } from '@headless-lms/adapter-defaults/storage';\nimport { BetterAuth } from '@headless-lms/adapter-auth';\n\nimport { ContentService } from '@headless-lms/core/content';\nimport { EntitlementsServiceImpl } from '@headless-lms/core/entitlements';\nimport { ProgressServiceImpl } from '@headless-lms/core/progress';\nimport { DiscussionServiceImpl } from '@headless-lms/core/discussion';\nimport { IdentityServiceImpl, type SessionAdmin } from '@headless-lms/core/identity';\nimport {\n  type OrgAdmin,\n  OrganizationServiceImpl,\n  parseRole,\n} from '@headless-lms/core/organizations';\nimport { AssetsServiceImpl } from '@headless-lms/core/assets';\nimport { IntegrationsServiceImpl } from '@headless-lms/core/integrations';\nimport { AutomationsServiceImpl } from '@headless-lms/core/automations';\nimport { loadIntegrations } from './integrations.js';\nimport { registerNotificationSubscribers } from './notifications.js';\nimport { StudentsReportServiceImpl } from '@headless-lms/core/reporting/students';\nimport { DashboardReportServiceImpl } from '@headless-lms/core/reporting/dashboard';\nimport { CoursesReportServiceImpl } from '@headless-lms/core/reporting/courses';\nimport { LearnReportServiceImpl } from '@headless-lms/core/reporting/learn';\nimport { Mailer, type MailerLookups } from '@headless-lms/core/shared/mailer';\nimport { SettingsService } from '@headless-lms/core/shared/settings';\n\nimport type {\n  CredentialStore,\n  EmailSender,\n  Logger,\n  ObjectStorage,\n  OutboxRelay,\n  TemplateContext,\n  TemplateRenderer,\n} from '@headless-lms/core/shared/ports';\nimport type { AutomationEngine, WebhookSender } from '@headless-lms/core/types';\n\n/** Installation-supplied ports; an absent slot falls back to a fail-loudly stub. */\nexport interface AdapterOverrides {\n  email?: EmailSender;\n  storage?: ObjectStorage;\n  /** Resolves email templates to rendered content. Absent → fail-loudly stub. */\n  templates?: TemplateRenderer;\n  /** Durable automation engine. Absent → InlineAutomationEngine (in-process, one attempt per action). */\n  workflows?: AutomationEngine;\n  /** Outbound HTTP for webhook deliveries. Absent → FetchWebhookSender (fetch, 10s timeout). */\n  webhooks?: WebhookSender;\n}\n\nexport interface BuildContainerOptions {\n  /** Installation's plugins folder, scanned by loadIntegrations. Absent → no integrations. */\n  pluginsDir?: string;\n  adapters?: AdapterOverrides;\n}\n\nexport interface Config {\n  databaseUrl: string;\n  authBaseURL: string;\n  authSecret: string;\n  trustedOrigins: string[];\n  /** Branding threaded into every email template. Default: brandName \"Headless LMS\", baseUrl = adminAppUrl.\n   *  (studentPortalUrl is composed in from the top-level config field.) */\n  emailBranding?: Omit<TemplateContext, 'studentPortalUrl'>;\n  /** base64-encoded 32-byte key for the credential store (CREDENTIAL_STORE_KEY). */\n  credentialStoreKey: string;\n  /** Parent domain for cross-subdomain session cookies (e.g. \".example.com\"); undefined → host-only cookie. */\n  cookieDomain?: string;\n  /** Mark session cookies Secure (set behind HTTPS / in production). */\n  secureCookies?: boolean;\n  /** Student portal origin — invite links for students, and the origin whose signups are invite-gated. */\n  studentPortalUrl: string;\n  /** Admin app origin — invite links for staff. */\n  adminAppUrl: string;\n  /** Transactional-outbox relay tuning. All optional — see OUTBOX_DEFAULTS. */\n  outbox?: OutboxConfig;\n  /** Log level for the process-wide logger (HTTP + domain + relay). Default \"info\". */\n  logging?: LoggingConfig;\n  /** Presigned URL lifetime for entitled download delivery, seconds. Mirrors\n   *  ServerConfig.deliveryExpirySeconds — createContainer threads it through. */\n  deliveryExpirySeconds: number;\n}\n\n/** Tuning for the transactional-outbox relay. Every field is optional; the\n *  container resolves against OUTBOX_DEFAULTS. */\nexport interface OutboxConfig {\n  /** Master switch for the same-process relay. Default true. */\n  enabled?: boolean;\n  /** Idle delay between polls. Default 1000. */\n  pollIntervalMs?: number;\n  /** Max rows fetched/dispatched per tick. Default 100. */\n  batchSize?: number;\n}\n\nexport const OUTBOX_DEFAULTS: PollingOutboxRelayConfig = {\n  enabled: true,\n  pollIntervalMs: 1000,\n  batchSize: 100,\n};\n\nexport function resolveOutboxConfig(config: OutboxConfig = {}): PollingOutboxRelayConfig {\n  const overrides = Object.fromEntries(\n    Object.entries(config).filter(([, value]) => value !== undefined),\n  );\n  return { ...OUTBOX_DEFAULTS, ...overrides };\n}\n\n/** Logging tuning. Optional; resolved against LOGGING_DEFAULTS. */\nexport interface LoggingConfig {\n  /** Minimum level emitted. Default \"info\". */\n  level?: LogLevel;\n}\n\nexport const LOGGING_DEFAULTS: Required<LoggingConfig> = { level: 'info' };\n\nexport function resolveLoggingConfig(config: LoggingConfig = {}): Required<LoggingConfig> {\n  return { level: config.level ?? LOGGING_DEFAULTS.level };\n}\n\nexport interface Container {\n  auth: BetterAuth;\n  // Org Provider\n  orgProvider: OrgAdmin;\n\n  // Domains\n  identity: IdentityServiceImpl;\n  organizations: OrganizationServiceImpl;\n  content: ContentService;\n  entitlements: EntitlementsServiceImpl;\n  progress: ProgressServiceImpl;\n  discussion: DiscussionServiceImpl;\n  assets: AssetsServiceImpl;\n  integrations: IntegrationsServiceImpl;\n  automations: AutomationsServiceImpl;\n  /** Cross-cutting settings store. Not a context — a leaf every context may use;\n   *  inject `settings.for('<namespace>')` into a service, never the service itself. */\n  settings: SettingsService;\n  // Reporting read layer (composed cross-context reads; owns no domain rules).\n  reporting: {\n    students: StudentsReportServiceImpl;\n    dashboard: DashboardReportServiceImpl;\n    courses: CoursesReportServiceImpl;\n    learn: LearnReportServiceImpl;\n  };\n  storage: ObjectStorage;\n  mailer: Mailer;\n  /** Shared secure credential store — encrypted at rest, org-scoped, decrypt at point of use. */\n  credentials: CredentialStore;\n  /** The outbox relay — constructed but NEVER started by the container; the\n   *  installation's entry point starts it after listen (gen-openapi must not\n   *  poll). buildServer stops it onClose. */\n  outboxRelay: OutboxRelay;\n  /** The automation engine — constructed but NEVER started by the container;\n   *  the installation's entry point starts it after listen (gen-openapi must\n   *  not run a worker). buildServer stops it onClose. */\n  automationEngine: AutomationEngine;\n  /** Root logger port — components receive children bound with { name }. */\n  logger: Logger;\n  /** The raw pino root; buildServer hands it to Fastify so HTTP shares the stream. */\n  loggerInstance: PinoInstance;\n  /** Request-scoped log correlation; the HTTP layer enters it per request. */\n  requestContext: RequestLogContext;\n  /** Identity's session-write port; the auth adapter fulfils it. */\n  sessions: SessionAdmin;\n}\n\nexport async function buildContainer(\n  config: Config,\n  options?: BuildContainerOptions,\n): Promise<Container> {\n  const { instance: loggerInstance, logger } = createRootLogger(\n    resolveLoggingConfig(config.logging).level,\n  );\n  // One child per domain — a context's service and repositories share it.\n\n  const contentLogger = logger.child({ name: 'content' });\n  const entitlementsLogger = logger.child({ name: 'entitlements' });\n  const progressLogger = logger.child({ name: 'progress' });\n  const discussionLogger = logger.child({ name: 'discussion' });\n  const assetsLogger = logger.child({ name: 'assets' });\n  const integrationsLogger = logger.child({ name: 'integrations' });\n  const automationsLogger = logger.child({ name: 'automations' });\n  const reportingLogger = logger.child({ name: 'reporting' });\n  const outboxLogger = logger.child({ name: 'outbox' });\n\n  // Outbound adapters\n  const db = createDb(config.databaseUrl);\n  const email = options?.adapters?.email ?? new EmailAdapter(logger.child({ name: 'email' }));\n  const storage: ObjectStorage =\n    options?.adapters?.storage ?? new StorageAdapter(logger.child({ name: 'storage' }));\n  const templates =\n    options?.adapters?.templates ?? new StubTemplateRenderer(logger.child({ name: 'email' }));\n  const automationEngine: AutomationEngine =\n    options?.adapters?.workflows ?? new InlineAutomationEngine();\n  const mailer = new Mailer(templates, email, {\n    ...(config.emailBranding ?? { brandName: 'Headless LMS', baseUrl: config.adminAppUrl }),\n    studentPortalUrl: config.studentPortalUrl,\n  });\n\n  /*\n   * Identity\n   */\n  const identityUoW = new DrizzleUnitOfWork(db, (tx) => ({\n    identity: new DrizzleIdentityRepository(tx, logger.child({ name: 'identity' })),\n    outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'identity' })),\n  }));\n  const identity = new IdentityServiceImpl({\n    repo: new DrizzleIdentityRepository(db, logger.child({ name: 'identity_repo' })),\n    logger: logger.child({ name: 'identity' }),\n    uow: identityUoW,\n    mailer,\n  });\n\n  /*\n   * Organization\n   */\n  const organizationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    organizations: new DrizzleOrganizationsRepository(tx, logger.child({ name: 'org' })),\n    outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'org' })),\n  }));\n  const orgAdminRef: { current: OrgAdmin | undefined } = { current: undefined };\n  const organizations = new OrganizationServiceImpl({\n    repo: new DrizzleOrganizationsRepository(db, logger.child({ name: 'org' })),\n    membersRepo: new DrizzleMembersRepository(db, logger.child({ name: 'org' })),\n    people: identity,\n    uow: organizationsUow,\n    orgAdmin: () => {\n      if (!orgAdminRef.current) {\n        throw new Error('orgAdmin not initialised');\n      }\n      return orgAdminRef.current;\n    },\n    logger: logger.child({ name: 'org' }),\n    mailer,\n    inviteUrls: { studentPortalUrl: config.studentPortalUrl, adminAppUrl: config.adminAppUrl },\n  });\n\n  /*\n   * Settings\n   */\n  const settings = new SettingsService(\n    new DrizzleSettingsRepository(db, logger.child({ name: 'settings' })),\n  );\n  // Content: reads on the root db; course writes + outbox append in one tx.\n  const contentUow = new DrizzleUnitOfWork(db, (tx) => ({\n    content: new DrizzleContentRepository(tx, contentLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const content = new ContentService({\n    repo: new DrizzleContentRepository(db, contentLogger),\n    uow: contentUow,\n    logger: contentLogger,\n  });\n  // Entitlements: reads on the root db; writes + outbox append in one tx.\n  const entitlementsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    entitlements: new DrizzleEntitlementsRepository(tx, entitlementsLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const entitlements = new EntitlementsServiceImpl({\n    repo: new DrizzleEntitlementsRepository(db, entitlementsLogger),\n    uow: entitlementsUow,\n    logger: entitlementsLogger,\n  });\n  // Progress: report writes + outbox append in one tx; content supplies the\n  // structure and completion rules the service evaluates against.\n  const progressUow = new DrizzleUnitOfWork(db, (tx) => ({\n    progress: new DrizzleProgressRepository(tx, progressLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const progress = new ProgressServiceImpl({\n    repo: new DrizzleProgressRepository(db, progressLogger),\n    content,\n    uow: progressUow,\n    logger: progressLogger,\n  });\n\n  const discussion = new DiscussionServiceImpl({\n    repo: new DrizzleDiscussionRepository(db, discussionLogger),\n    access: entitlements,\n    content: content,\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      discussion: new DrizzleDiscussionRepository(tx, discussionLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    settings,\n    logger: discussionLogger,\n  });\n  const assets = new AssetsServiceImpl({\n    storage,\n    repo: new DrizzleAssetsRepository(db, assetsLogger),\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      assets: new DrizzleAssetsRepository(tx, assetsLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    logger: assetsLogger,\n  });\n\n  const reporting = {\n    students: new StudentsReportServiceImpl({\n      repo: new DrizzleStudentsRepository(db, reportingLogger),\n      logger: reportingLogger,\n    }),\n    dashboard: new DashboardReportServiceImpl({\n      repo: new DrizzleDashboardRepository(db, reportingLogger),\n      logger: reportingLogger,\n    }),\n    courses: new CoursesReportServiceImpl({\n      repo: new DrizzleCourseAnalyticsRepository(db, reportingLogger),\n      logger: reportingLogger,\n    }),\n    learn: new LearnReportServiceImpl({\n      reader: new DrizzleLearnRepository(db, reportingLogger),\n      content,\n      progress,\n      assets,\n      deliveryExpirySeconds: config.deliveryExpirySeconds,\n      logger: reportingLogger,\n    }),\n  };\n\n  const credentialStore = new DrizzleCredentialStore(\n    db,\n    config.credentialStoreKey,\n    integrationsLogger,\n  );\n  // The integrations this deployment supports: the installation's declared\n  // plugins folder (directory name = integration id), loaded at startup.\n  // Connect/configure reject undeclared ids and validate config with the\n  // integration's own schema. No folder → no integrations.\n  const integrationsRegistry = await loadIntegrations(options?.pluginsDir, integrationsLogger);\n  // Integrations: credential + connection writes + outbox append in one tx\n  // (a tx-bound credential store instance shares the scope's transaction).\n  const integrationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    connections: new DrizzleConnectionsRepository(tx, integrationsLogger),\n    credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, integrationsLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const integrations = new IntegrationsServiceImpl({\n    registry: integrationsRegistry,\n    repo: new DrizzleConnectionsRepository(db, integrationsLogger),\n    uow: integrationsUow,\n    credentials: credentialStore,\n    logger: integrationsLogger,\n  });\n\n  // Automations: run writes + outbox append in one tx; the engine drives\n  // execution (register below), integrations supplies the loaded\n  // integrations' actions for `available`.\n  const automationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    automations: new DrizzleAutomationsRepository(tx, automationsLogger),\n    runs: new DrizzleAutomationRunsRepository(tx, automationsLogger),\n    credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, automationsLogger),\n    outbox: new DrizzleOutboxAppender(tx, automationsLogger),\n  }));\n  // Emails triggered by row-shaped events resolve their recipient and content\n  // details at send time — the event carries ids only.\n  const mailerLookups: MailerLookups = {\n    orgUserEmail: async (orgId, orgUserId) =>\n      (await reporting.students.get(orgId, orgUserId))?.email ?? null,\n    contentInfo: async (orgId, contentId) => {\n      const course = await content.getCourse(orgId, contentId);\n      if (course) {\n        return { id: course.id, title: course.title, type: course.type };\n      }\n      const download = await content.getDownload(orgId, contentId);\n      return download ? { id: download.id, title: download.title, type: download.type } : null;\n    },\n  };\n\n  const automations = new AutomationsServiceImpl({\n    repo: new DrizzleAutomationsRepository(db, automationsLogger),\n    runsRepo: new DrizzleAutomationRunsRepository(db, automationsLogger),\n    uow: automationsUow,\n    engine: automationEngine,\n    mailer,\n    lookups: mailerLookups,\n    integrations,\n    credentials: credentialStore,\n    webhooks: options?.adapters?.webhooks ?? new FetchWebhookSender(),\n    logger: automationsLogger,\n  });\n  automationEngine.register(automations);\n\n  const eventBus = new InMemoryEventBus();\n  registerNotificationSubscribers(eventBus, mailer, mailerLookups);\n  // handle() never throws — the EventBus fans out to every subscriber\n  // sequentially, and a rejection here would break sibling subscribers.\n  eventBus.subscribeAll((event) => automations.handle(event));\n  const outboxConfig = resolveOutboxConfig(config.outbox);\n  const outboxRelay = new PollingOutboxRelay(\n    new DrizzleOutboxStore(db, outboxLogger),\n    eventBus,\n    outboxConfig,\n    outboxLogger,\n  );\n\n  /*\n   * Auth Adapter\n   */\n  const authLogger = logger.child({ name: 'auth' });\n  // Hook failures otherwise surface through Better Auth's route as an opaque\n  // 500 — log which hook died before rethrowing.\n  const authHook =\n    <A extends unknown[], R>(name: string, fn: (...args: A) => Promise<R>) =>\n    async (...args: A): Promise<R> => {\n      try {\n        return await fn(...args);\n      } catch (err) {\n        authLogger.error(`auth hook ${name} failed`, { err });\n        throw err;\n      }\n    };\n  const auth = new BetterAuth({\n    db,\n    baseUrl: config.authBaseURL,\n    secret: config.authSecret,\n    trustedOrigins: config.trustedOrigins,\n    hooks: {\n      sendResetPassword: async ({ user, url }) => {\n        await identity.sendPasswordReset({ email: user.email, url });\n      },\n      onPasswordReset: async ({ user }) => {\n        await identity.sendPasswordChanged({ email: user.email });\n      },\n      sendMagicLink: authHook('sendMagicLink', async ({ email, url }) => {\n        await identity.sendMagicLink({\n          email,\n          url,\n        });\n      }),\n      beforeUserCreate: authHook('beforeUserCreate', async (user) => {\n        const { email, name } = user;\n        const [firstName, lastName] = name.split(' ');\n        // Better Auth has not minted an id yet — the id returned below becomes\n        // its account id. A person provisioned at invite time is linked instead of re-created.\n        const domainUser = await identity.linkOrCreateUser({\n          email,\n          ...(firstName !== undefined && { firstName }),\n          ...(lastName !== undefined && { lastName }),\n        });\n\n        return {\n          data: {\n            ...user,\n            id: domainUser.id,\n          },\n        };\n      }),\n      beforeCreateSession: authHook('beforeCreateSession', async (session) => {\n        const person = await identity.getUserByExternalId(session.userId);\n        if (!person) {\n          return;\n        }\n        const orgs = await organizations.getOrgUsersForUser(person.id);\n        if (orgs.length !== 1) {\n          return;\n        }\n        // TODO - fix, why default to the first?\n        const org = await organizations.getById(orgs[0]!.orgId);\n        if (!org) {\n          return;\n        }\n\n        return { data: { ...session, activeOrganizationId: org.id } };\n      }),\n      /*\n       * We're making sure the domain org creates and using the same ID for better-auth org ID.\n       */\n      beforeCreateOrganization: authHook(\n        'beforeCreateOrganization',\n        async ({ organization: org, user: baUser }) => {\n          const domainOrg = await organizations.createOrganization({\n            ownerId: baUser.id,\n            ...org,\n            logo: org.logo ?? undefined,\n          });\n          return { data: { ...org, id: domainOrg.id } };\n        },\n      ),\n      beforeUpdateOrganization: authHook('beforeUpdateOrganization', async ({ organization }) => {\n        await organizations.updateOrganization(organization.id, organization);\n      }),\n      beforeDeleteOrganization: authHook('beforeDeleteOrganization', async ({ organization }) => {\n        await organizations.deleteOrganization(organization.id);\n      }),\n      beforeAddMember: authHook('beforeAddMember', async ({ member }) => {\n        await organizations.addOrgUser({\n          orgId: member.organizationId,\n          userId: member.userId,\n          role: parseRole(member.role),\n        });\n      }),\n      beforeUpdateMemberRole: authHook('beforeUpdateMemberRole', async ({ member, newRole }) => {\n        await organizations.updateOrgUser(member.organizationId, member.userId, {\n          role: parseRole(newRole),\n        });\n      }),\n      beforeRemoveMember: authHook('beforeRemoveMember', async ({ member }) => {\n        await organizations.removeOrgUser(member.organizationId, member.userId);\n      }),\n    },\n    logger: authLogger,\n    cookieDomain: config.cookieDomain,\n    secureCookies: config.secureCookies,\n  });\n  orgAdminRef.current = auth;\n\n  return {\n    auth,\n    identity,\n    organizations,\n    // Better Auth owns org writes; the same instance fulfils the OrgAdmin port.\n    orgProvider: auth,\n    content,\n    entitlements,\n    progress,\n    discussion,\n    assets,\n    integrations,\n    automations,\n    settings,\n    reporting,\n    storage,\n    mailer,\n    credentials: credentialStore,\n    outboxRelay,\n    automationEngine,\n    logger,\n    loggerInstance,\n    requestContext: requestLogContext,\n    // Better Auth owns the session store; the same instance fulfils SessionAdmin.\n    sessions: auth,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAmIA,MAAa,kBAA4C;CACvD,SAAS;CACT,gBAAgB;CAChB,WAAW;AACb;AAEA,SAAgB,oBAAoB,SAAuB,CAAC,GAA6B;CACvF,MAAM,YAAY,OAAO,YACvB,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAClE;CACA,OAAO;EAAE,GAAG;EAAiB,GAAG;CAAU;AAC5C;AAQA,MAAa,mBAA4C,EAAE,OAAO,OAAO;AAEzE,SAAgB,qBAAqB,SAAwB,CAAC,GAA4B;CACxF,OAAO,EAAE,OAAO,OAAO,SAAS,iBAAiB,MAAM;AACzD;AAiDA,eAAsB,eACpB,QACA,SACoB;CACpB,MAAM,EAAE,UAAU,gBAAgB,WAAW,iBAC3C,qBAAqB,OAAO,OAAO,CAAC,CAAC,KACvC;CAGA,MAAM,gBAAgB,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC;CACtD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,iBAAiB,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;CACxD,MAAM,mBAAmB,OAAO,MAAM,EAAE,MAAM,aAAa,CAAC;CAC5D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CACpD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,oBAAoB,OAAO,MAAM,EAAE,MAAM,cAAc,CAAC;CAC9D,MAAM,kBAAkB,OAAO,MAAM,EAAE,MAAM,YAAY,CAAC;CAC1D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CAGpD,MAAM,KAAK,SAAS,OAAO,WAAW;CACtC,MAAM,QAAQ,SAAS,UAAU,SAAS,IAAI,aAAa,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,UACJ,SAAS,UAAU,WAAW,IAAI,eAAe,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC,CAAC;CACpF,MAAM,YACJ,SAAS,UAAU,aAAa,IAAI,qBAAqB,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,mBACJ,SAAS,UAAU,aAAa,IAAI,uBAAuB;CAC7D,MAAM,SAAS,IAAI,OAAO,WAAW,OAAO;EAC1C,GAAI,OAAO,iBAAiB;GAAE,WAAW;GAAgB,SAAS,OAAO;EAAY;EACrF,kBAAkB,OAAO;CAC3B,CAAC;CAKD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;EAC9E,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;CAC1E,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,gBAAgB,CAAC,CAAC;EAC/E,QAAQ,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;EACzC,KAAK;EACL;CACF,CAAC;CAKD,MAAM,mBAAmB,IAAI,kBAAkB,KAAK,QAAQ;EAC1D,eAAe,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EACnF,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;CACrE,EAAE;CACF,MAAM,cAAiD,EAAE,SAAS,KAAA,EAAU;CAC5E,MAAM,gBAAgB,IAAI,wBAAwB;EAChD,MAAM,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EAC1E,aAAa,IAAI,yBAAyB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EAC3E,QAAQ;EACR,KAAK;EACL,gBAAgB;GACd,IAAI,CAAC,YAAY,SACf,MAAM,IAAI,MAAM,0BAA0B;GAE5C,OAAO,YAAY;EACrB;EACA,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC;EACpC;EACA,YAAY;GAAE,kBAAkB,OAAO;GAAkB,aAAa,OAAO;EAAY;CAC3F,CAAC;CAKD,MAAM,WAAW,IAAI,gBACnB,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,CACtE;CAEA,MAAM,aAAa,IAAI,kBAAkB,KAAK,QAAQ;EACpD,SAAS,IAAI,yBAAyB,IAAI,aAAa;EACvD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,UAAU,IAAI,eAAe;EACjC,MAAM,IAAI,yBAAyB,IAAI,aAAa;EACpD,KAAK;EACL,QAAQ;CACV,CAAC;CAED,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,cAAc,IAAI,8BAA8B,IAAI,kBAAkB;EACtE,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,eAAe,IAAI,wBAAwB;EAC/C,MAAM,IAAI,8BAA8B,IAAI,kBAAkB;EAC9D,KAAK;EACL,QAAQ;CACV,CAAC;CAGD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,cAAc;EAC1D,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,cAAc;EACtD;EACA,KAAK;EACL,QAAQ;CACV,CAAC;CAED,MAAM,aAAa,IAAI,sBAAsB;EAC3C,MAAM,IAAI,4BAA4B,IAAI,gBAAgB;EAC1D,QAAQ;EACC;EACT,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,YAAY,IAAI,4BAA4B,IAAI,gBAAgB;GAChE,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF;EACA,QAAQ;CACV,CAAC;CACD,MAAM,SAAS,IAAI,kBAAkB;EACnC;EACA,MAAM,IAAI,wBAAwB,IAAI,YAAY;EAClD,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,QAAQ,IAAI,wBAAwB,IAAI,YAAY;GACpD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,QAAQ;CACV,CAAC;CAED,MAAM,YAAY;EAChB,UAAU,IAAI,0BAA0B;GACtC,MAAM,IAAI,0BAA0B,IAAI,eAAe;GACvD,QAAQ;EACV,CAAC;EACD,WAAW,IAAI,2BAA2B;GACxC,MAAM,IAAI,2BAA2B,IAAI,eAAe;GACxD,QAAQ;EACV,CAAC;EACD,SAAS,IAAI,yBAAyB;GACpC,MAAM,IAAI,iCAAiC,IAAI,eAAe;GAC9D,QAAQ;EACV,CAAC;EACD,OAAO,IAAI,uBAAuB;GAChC,QAAQ,IAAI,uBAAuB,IAAI,eAAe;GACtD;GACA;GACA;GACA,uBAAuB,OAAO;GAC9B,QAAQ;EACV,CAAC;CACH;CAEA,MAAM,kBAAkB,IAAI,uBAC1B,IACA,OAAO,oBACP,kBACF;CAKA,MAAM,uBAAuB,MAAM,iBAAiB,SAAS,YAAY,kBAAkB;CAG3F,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,aAAa,IAAI,6BAA6B,IAAI,kBAAkB;EACpE,aAAa,IAAI,uBAAuB,IAAI,OAAO,oBAAoB,kBAAkB;EACzF,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,eAAe,IAAI,wBAAwB;EAC/C,UAAU;EACV,MAAM,IAAI,6BAA6B,IAAI,kBAAkB;EAC7D,KAAK;EACL,aAAa;EACb,QAAQ;CACV,CAAC;CAKD,MAAM,iBAAiB,IAAI,kBAAkB,KAAK,QAAQ;EACxD,aAAa,IAAI,6BAA6B,IAAI,iBAAiB;EACnE,MAAM,IAAI,gCAAgC,IAAI,iBAAiB;EAC/D,aAAa,IAAI,uBAAuB,IAAI,OAAO,oBAAoB,iBAAiB;EACxF,QAAQ,IAAI,sBAAsB,IAAI,iBAAiB;CACzD,EAAE;CAGF,MAAM,gBAA+B;EACnC,cAAc,OAAO,OAAO,eACzB,MAAM,UAAU,SAAS,IAAI,OAAO,SAAS,EAAA,EAAI,SAAS;EAC7D,aAAa,OAAO,OAAO,cAAc;GACvC,MAAM,SAAS,MAAM,QAAQ,UAAU,OAAO,SAAS;GACvD,IAAI,QACF,OAAO;IAAE,IAAI,OAAO;IAAI,OAAO,OAAO;IAAO,MAAM,OAAO;GAAK;GAEjE,MAAM,WAAW,MAAM,QAAQ,YAAY,OAAO,SAAS;GAC3D,OAAO,WAAW;IAAE,IAAI,SAAS;IAAI,OAAO,SAAS;IAAO,MAAM,SAAS;GAAK,IAAI;EACtF;CACF;CAEA,MAAM,cAAc,IAAI,uBAAuB;EAC7C,MAAM,IAAI,6BAA6B,IAAI,iBAAiB;EAC5D,UAAU,IAAI,gCAAgC,IAAI,iBAAiB;EACnE,KAAK;EACL,QAAQ;EACR;EACA,SAAS;EACT;EACA,aAAa;EACb,UAAU,SAAS,UAAU,YAAY,IAAI,mBAAmB;EAChE,QAAQ;CACV,CAAC;CACD,iBAAiB,SAAS,WAAW;CAErC,MAAM,WAAW,IAAI,iBAAiB;CACtC,gCAAgC,UAAU,QAAQ,aAAa;CAG/D,SAAS,cAAc,UAAU,YAAY,OAAO,KAAK,CAAC;CAC1D,MAAM,eAAe,oBAAoB,OAAO,MAAM;CACtD,MAAM,cAAc,IAAI,mBACtB,IAAI,mBAAmB,IAAI,YAAY,GACvC,UACA,cACA,YACF;CAKA,MAAM,aAAa,OAAO,MAAM,EAAE,MAAM,OAAO,CAAC;CAGhD,MAAM,YACqB,MAAc,OACvC,OAAO,GAAG,SAAwB;EAChC,IAAI;GACF,OAAO,MAAM,GAAG,GAAG,IAAI;EACzB,SAAS,KAAK;GACZ,WAAW,MAAM,aAAa,KAAK,UAAU,EAAE,IAAI,CAAC;GACpD,MAAM;EACR;CACF;CACF,MAAM,OAAO,IAAI,WAAW;EAC1B;EACA,SAAS,OAAO;EAChB,QAAQ,OAAO;EACf,gBAAgB,OAAO;EACvB,OAAO;GACL,mBAAmB,OAAO,EAAE,MAAM,UAAU;IAC1C,MAAM,SAAS,kBAAkB;KAAE,OAAO,KAAK;KAAO;IAAI,CAAC;GAC7D;GACA,iBAAiB,OAAO,EAAE,WAAW;IACnC,MAAM,SAAS,oBAAoB,EAAE,OAAO,KAAK,MAAM,CAAC;GAC1D;GACA,eAAe,SAAS,iBAAiB,OAAO,EAAE,OAAO,UAAU;IACjE,MAAM,SAAS,cAAc;KAC3B;KACA;IACF,CAAC;GACH,CAAC;GACD,kBAAkB,SAAS,oBAAoB,OAAO,SAAS;IAC7D,MAAM,EAAE,OAAO,SAAS;IACxB,MAAM,CAAC,WAAW,YAAY,KAAK,MAAM,GAAG;IAG5C,MAAM,aAAa,MAAM,SAAS,iBAAiB;KACjD;KACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;KAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;IAC3C,CAAC;IAED,OAAO,EACL,MAAM;KACJ,GAAG;KACH,IAAI,WAAW;IACjB,EACF;GACF,CAAC;GACD,qBAAqB,SAAS,uBAAuB,OAAO,YAAY;IACtE,MAAM,SAAS,MAAM,SAAS,oBAAoB,QAAQ,MAAM;IAChE,IAAI,CAAC,QACH;IAEF,MAAM,OAAO,MAAM,cAAc,mBAAmB,OAAO,EAAE;IAC7D,IAAI,KAAK,WAAW,GAClB;IAGF,MAAM,MAAM,MAAM,cAAc,QAAQ,KAAK,EAAE,CAAE,KAAK;IACtD,IAAI,CAAC,KACH;IAGF,OAAO,EAAE,MAAM;KAAE,GAAG;KAAS,sBAAsB,IAAI;IAAG,EAAE;GAC9D,CAAC;GAID,0BAA0B,SACxB,4BACA,OAAO,EAAE,cAAc,KAAK,MAAM,aAAa;IAC7C,MAAM,YAAY,MAAM,cAAc,mBAAmB;KACvD,SAAS,OAAO;KAChB,GAAG;KACH,MAAM,IAAI,QAAQ,KAAA;IACpB,CAAC;IACD,OAAO,EAAE,MAAM;KAAE,GAAG;KAAK,IAAI,UAAU;IAAG,EAAE;GAC9C,CACF;GACA,0BAA0B,SAAS,4BAA4B,OAAO,EAAE,mBAAmB;IACzF,MAAM,cAAc,mBAAmB,aAAa,IAAI,YAAY;GACtE,CAAC;GACD,0BAA0B,SAAS,4BAA4B,OAAO,EAAE,mBAAmB;IACzF,MAAM,cAAc,mBAAmB,aAAa,EAAE;GACxD,CAAC;GACD,iBAAiB,SAAS,mBAAmB,OAAO,EAAE,aAAa;IACjE,MAAM,cAAc,WAAW;KAC7B,OAAO,OAAO;KACd,QAAQ,OAAO;KACf,MAAM,UAAU,OAAO,IAAI;IAC7B,CAAC;GACH,CAAC;GACD,wBAAwB,SAAS,0BAA0B,OAAO,EAAE,QAAQ,cAAc;IACxF,MAAM,cAAc,cAAc,OAAO,gBAAgB,OAAO,QAAQ,EACtE,MAAM,UAAU,OAAO,EACzB,CAAC;GACH,CAAC;GACD,oBAAoB,SAAS,sBAAsB,OAAO,EAAE,aAAa;IACvE,MAAM,cAAc,cAAc,OAAO,gBAAgB,OAAO,MAAM;GACxE,CAAC;EACH;EACA,QAAQ;EACR,cAAc,OAAO;EACrB,eAAe,OAAO;CACxB,CAAC;CACD,YAAY,UAAU;CAEtB,OAAO;EACL;EACA;EACA;EAEA,aAAa;EACb;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA;EACA;EACA;EACA,gBAAgB;EAEhB,UAAU;CACZ;AACF"}
+{"version":3,"file":"container.js","names":[],"sources":["../../src/app/container.ts"],"sourcesContent":["// Wires adapters + services in dependency order. Starts nothing.\nimport {\n  createDb,\n  DrizzleAssetsRepository,\n  DrizzleAutomationRunsRepository,\n  DrizzleAutomationsRepository,\n  DrizzleConnectionsRepository,\n  DrizzleContentRepository,\n  DrizzleCredentialStore,\n  DrizzleAdminRepository,\n  DrizzleDiscussionRepository,\n  DrizzlePostRepository,\n  DrizzleChatRepository,\n  DrizzleEntitlementsRepository,\n  DrizzleIdentityRepository,\n  DrizzleMemberRepository,\n  DrizzleMembersRepository,\n  DrizzleNotificationsRepository,\n  DrizzleOrganizationsRepository,\n  DrizzleOutboxAppender,\n  DrizzleOutboxStore,\n  DrizzleProgressRepository,\n  DrizzleSettingsRepository,\n  DrizzleUnitOfWork,\n} from '@headless-lms/adapter-db';\nimport { InMemoryEventBus } from '@headless-lms/adapter-defaults/events';\nimport {\n  PollingOutboxRelay,\n  type PollingOutboxRelayConfig,\n} from '@headless-lms/adapter-defaults/events/outbox-relay';\nimport { InlineAutomationEngine } from '@headless-lms/adapter-defaults/workflows';\nimport { FetchWebhookSender } from '@headless-lms/adapter-defaults/webhooks';\nimport { EmailAdapter, StubTemplateRenderer } from '@headless-lms/adapter-defaults/email';\nimport {\n  createRootLogger,\n  type LogLevel,\n  type PinoInstance,\n  requestLogContext,\n  type RequestLogContext,\n} from '@headless-lms/adapter-defaults/logging';\nimport { StorageAdapter } from '@headless-lms/adapter-defaults/storage';\nimport { BetterAuth } from '@headless-lms/adapter-auth';\n\nimport { ContentService } from '@headless-lms/core/content';\nimport { EntitlementsServiceImpl } from '@headless-lms/core/entitlements';\nimport { ProgressServiceImpl } from '@headless-lms/core/progress';\nimport {\n  ChatServiceImpl,\n  DiscussionServiceImpl,\n  PostServiceImpl,\n} from '@headless-lms/core/discussion';\nimport {\n  IdentityServiceImpl,\n  NotificationServiceImpl,\n  type SessionAdmin,\n} from '@headless-lms/core/identity';\nimport {\n  type OrgAdmin,\n  OrganizationServiceImpl,\n  parseRole,\n} from '@headless-lms/core/organizations';\nimport { AssetsServiceImpl, createFileUrls } from '@headless-lms/core/assets';\nimport { IntegrationsServiceImpl } from '@headless-lms/core/integrations';\nimport { AutomationsServiceImpl } from '@headless-lms/core/automations';\nimport { loadIntegrations } from './integrations.js';\nimport { mcpEndpoints, type McpEndpoints } from './mcp-endpoints.js';\nimport { communityMail } from './community-mail.js';\nimport { AdminReportServiceImpl } from '@headless-lms/core/reporting/admin';\nimport { MemberReportServiceImpl } from '@headless-lms/core/reporting/member';\nimport { Mailer, type MailerLookups } from '@headless-lms/core/shared/mailer';\nimport { SettingsService } from '@headless-lms/core/shared/settings';\n\nimport type {\n  CredentialStore,\n  EmailSender,\n  Logger,\n  ObjectStorage,\n  OutboxRelay,\n  TemplateContext,\n  TemplateRenderer,\n} from '@headless-lms/core/shared/ports';\nimport type { AutomationEngine, WebhookSender } from '@headless-lms/core/types';\n\n/** Installation-supplied ports; an absent slot falls back to a fail-loudly stub. */\nexport interface AdapterOverrides {\n  email?: EmailSender;\n  storage?: ObjectStorage;\n  /** Resolves email templates to rendered content. Absent → fail-loudly stub. */\n  templates?: TemplateRenderer;\n  /** Durable automation engine, or a factory given the automations logger. Absent → InlineAutomationEngine (in-process, one attempt per action). */\n  workflows?: AutomationEngine | ((logger: Logger) => AutomationEngine);\n  /** Outbound HTTP for webhook deliveries. Absent → FetchWebhookSender (public addresses only, 10s timeout). */\n  webhooks?: WebhookSender;\n}\n\nexport interface BuildContainerOptions {\n  /** Installation's plugins folder, scanned by loadIntegrations. Absent → no integrations. */\n  pluginsDir?: string;\n  adapters?: AdapterOverrides;\n}\n\nexport interface Config {\n  databaseUrl: string;\n  authBaseURL: string;\n  authSecret: string;\n  trustedOrigins: string[];\n  /** Branding threaded into every email template. Default: brandName \"Headless LMS\", baseUrl = adminAppUrl.\n   *  (studentPortalUrl is composed in from the top-level config field.) */\n  emailBranding?: Omit<TemplateContext, 'studentPortalUrl'>;\n  /** base64-encoded 32-byte key for the credential store (CREDENTIAL_STORE_KEY). */\n  credentialStoreKey: string;\n  /** Parent domain for cross-subdomain session cookies (e.g. \".example.com\"); undefined → host-only cookie. */\n  cookieDomain?: string;\n  /** Mark session cookies Secure (set behind HTTPS / in production). */\n  secureCookies?: boolean;\n  /** Student portal origin — invite links for students, and the origin whose signups are invite-gated. */\n  studentPortalUrl: string;\n  /** Admin app origin — invite links for staff. */\n  adminAppUrl: string;\n  /** Transactional-outbox relay tuning. All optional — see OUTBOX_DEFAULTS. */\n  outbox?: OutboxConfig;\n  /** Log level for the process-wide logger (HTTP + domain + relay). Default \"info\". */\n  logging?: LoggingConfig;\n  /** Lifetime of every signed file URL a response carries, seconds. Mirrors\n   *  ServerConfig.deliveryExpirySeconds — createContainer threads it through. */\n  deliveryExpirySeconds: number;\n  memberImageMaxBytes: number;\n  /** Let the default webhook sender reach loopback and private network addresses. Local development only. */\n  webhookAllowPrivateNetwork?: boolean;\n}\n\n/** Tuning for the transactional-outbox relay. Every field is optional; the\n *  container resolves against OUTBOX_DEFAULTS. */\nexport interface OutboxConfig {\n  /** Master switch for the same-process relay. Default true. */\n  enabled?: boolean;\n  /** Idle delay between polls. Default 1000. */\n  pollIntervalMs?: number;\n  /** Max rows fetched/dispatched per tick. Default 100. */\n  batchSize?: number;\n}\n\nexport const OUTBOX_DEFAULTS: PollingOutboxRelayConfig = {\n  enabled: true,\n  pollIntervalMs: 1000,\n  batchSize: 100,\n};\n\nexport function resolveOutboxConfig(config: OutboxConfig = {}): PollingOutboxRelayConfig {\n  const overrides = Object.fromEntries(\n    Object.entries(config).filter(([, value]) => value !== undefined),\n  );\n  return { ...OUTBOX_DEFAULTS, ...overrides };\n}\n\n/** Logging tuning. Optional; resolved against LOGGING_DEFAULTS. */\nexport interface LoggingConfig {\n  /** Minimum level emitted. Default \"info\". */\n  level?: LogLevel;\n}\n\nexport const LOGGING_DEFAULTS: Required<LoggingConfig> = { level: 'info' };\n\nexport function resolveLoggingConfig(config: LoggingConfig = {}): Required<LoggingConfig> {\n  return { level: config.level ?? LOGGING_DEFAULTS.level };\n}\n\nexport interface Container {\n  auth: BetterAuth;\n  mcp: McpEndpoints;\n  // Org Provider\n  orgProvider: OrgAdmin;\n\n  // Domains\n  identity: IdentityServiceImpl;\n  notifications: NotificationServiceImpl;\n  organizations: OrganizationServiceImpl;\n  content: ContentService;\n  entitlements: EntitlementsServiceImpl;\n  progress: ProgressServiceImpl;\n  discussion: DiscussionServiceImpl;\n  posts: PostServiceImpl;\n  chats: ChatServiceImpl;\n  assets: AssetsServiceImpl;\n  integrations: IntegrationsServiceImpl;\n  automations: AutomationsServiceImpl;\n  /** Cross-cutting settings store. Not a context — a leaf every context may use;\n   *  inject `settings.for('<namespace>')` into a service, never the service itself. */\n  settings: SettingsService;\n  // Reporting read layer (composed cross-context reads; owns no domain rules).\n  reporting: {\n    admin: AdminReportServiceImpl;\n    member: MemberReportServiceImpl;\n  };\n  storage: ObjectStorage;\n  mailer: Mailer;\n  /** Shared secure credential store — encrypted at rest, org-scoped, decrypt at point of use. */\n  credentials: CredentialStore;\n  /** The outbox relay — constructed but NEVER started by the container; the\n   *  installation's entry point starts it after listen (gen-openapi must not\n   *  poll). buildServer stops it onClose. */\n  outboxRelay: OutboxRelay;\n  /** The automation engine — constructed but NEVER started by the container;\n   *  the installation's entry point starts it after listen (gen-openapi must\n   *  not run a worker). buildServer stops it onClose. */\n  automationEngine: AutomationEngine;\n  /** Root logger port — components receive children bound with { name }. */\n  logger: Logger;\n  /** The raw pino root; buildServer hands it to Fastify so HTTP shares the stream. */\n  loggerInstance: PinoInstance;\n  /** Request-scoped log correlation; the HTTP layer enters it per request. */\n  requestContext: RequestLogContext;\n  /** Identity's session-write port; the auth adapter fulfils it. */\n  sessions: SessionAdmin;\n}\n\nexport async function buildContainer(\n  config: Config,\n  options?: BuildContainerOptions,\n): Promise<Container> {\n  const { instance: loggerInstance, logger } = createRootLogger(\n    resolveLoggingConfig(config.logging).level,\n  );\n  // One child per domain — a context's service and repositories share it.\n\n  const contentLogger = logger.child({ name: 'content' });\n  const entitlementsLogger = logger.child({ name: 'entitlements' });\n  const progressLogger = logger.child({ name: 'progress' });\n  const discussionLogger = logger.child({ name: 'discussion' });\n  const assetsLogger = logger.child({ name: 'assets' });\n  const integrationsLogger = logger.child({ name: 'integrations' });\n  const automationsLogger = logger.child({ name: 'automations' });\n  const reportingLogger = logger.child({ name: 'reporting' });\n  const outboxLogger = logger.child({ name: 'outbox' });\n\n  // Outbound adapters\n  const db = createDb(config.databaseUrl);\n  const email = options?.adapters?.email ?? new EmailAdapter(logger.child({ name: 'email' }));\n  const storage: ObjectStorage =\n    options?.adapters?.storage ?? new StorageAdapter(logger.child({ name: 'storage' }));\n  const templates =\n    options?.adapters?.templates ?? new StubTemplateRenderer(logger.child({ name: 'email' }));\n  const workflows = options?.adapters?.workflows;\n  const automationEngine: AutomationEngine =\n    typeof workflows === 'function'\n      ? workflows(automationsLogger)\n      : (workflows ?? new InlineAutomationEngine(automationsLogger));\n  const mailer = new Mailer(templates, email, {\n    ...(config.emailBranding ?? { brandName: 'Headless LMS', baseUrl: config.adminAppUrl }),\n    studentPortalUrl: config.studentPortalUrl,\n  });\n\n  const fileUrls = createFileUrls(config.authBaseURL);\n  const assets = new AssetsServiceImpl({\n    storage,\n    repo: new DrizzleAssetsRepository(db, assetsLogger),\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      assets: new DrizzleAssetsRepository(tx, assetsLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    memberImageMaxBytes: config.memberImageMaxBytes,\n    downloadLinkExpirySeconds: config.deliveryExpirySeconds,\n    fileUrls,\n    logger: assetsLogger,\n  });\n\n  /*\n   * Identity\n   */\n  const identityUoW = new DrizzleUnitOfWork(db, (tx) => ({\n    identity: new DrizzleIdentityRepository(tx, logger.child({ name: 'identity' })),\n    outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'identity' })),\n  }));\n  const identity = new IdentityServiceImpl({\n    repo: new DrizzleIdentityRepository(db, logger.child({ name: 'identity_repo' })),\n    logger: logger.child({ name: 'identity' }),\n    uow: identityUoW,\n    mailer,\n    images: assets,\n    fileUrls,\n  });\n  const notifications = new NotificationServiceImpl({\n    repo: new DrizzleNotificationsRepository(db),\n    logger: logger.child({ name: 'notifications' }),\n  });\n\n  /*\n   * Organization\n   */\n  const organizationsRepo = new DrizzleOrganizationsRepository(db, logger.child({ name: 'org' }));\n  const organizationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    organizations: new DrizzleOrganizationsRepository(tx, logger.child({ name: 'org' })),\n    outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'org' })),\n  }));\n  const orgAdminRef: { current: OrgAdmin | undefined } = { current: undefined };\n  const organizations = new OrganizationServiceImpl({\n    repo: organizationsRepo,\n    membersRepo: new DrizzleMembersRepository(db, logger.child({ name: 'org' })),\n    people: identity,\n    uow: organizationsUow,\n    orgAdmin: () => {\n      if (!orgAdminRef.current) {\n        throw new Error('orgAdmin not initialised');\n      }\n      return orgAdminRef.current;\n    },\n    logger: logger.child({ name: 'org' }),\n    mailer,\n    inviteUrls: { studentPortalUrl: config.studentPortalUrl, adminAppUrl: config.adminAppUrl },\n  });\n\n  /*\n   * Settings\n   */\n  const settings = new SettingsService(\n    new DrizzleSettingsRepository(db, logger.child({ name: 'settings' })),\n  );\n  // Content: reads on the root db; course writes + outbox append in one tx.\n  const contentUow = new DrizzleUnitOfWork(db, (tx) => ({\n    content: new DrizzleContentRepository(tx, contentLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const content = new ContentService({\n    repo: new DrizzleContentRepository(db, contentLogger),\n    uow: contentUow,\n    libraryAssets: assets,\n    files: assets,\n    fileUrls,\n    logger: contentLogger,\n  });\n  // Entitlements: reads on the root db; writes + outbox append in one tx.\n  const entitlementsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    entitlements: new DrizzleEntitlementsRepository(tx, entitlementsLogger),\n    spaces: new DrizzleContentRepository(tx, contentLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const authors = {\n    roleOf: async (orgId: string, orgUserId: string) => {\n      const row = await organizationsRepo.findOrgUserById(orgId, orgUserId);\n      return row?.role ?? null;\n    },\n    rolesOf: async (orgId: string, orgUserIds: string[]) => {\n      const rows = await organizationsRepo.findOrgUsersByIds(orgId, orgUserIds);\n      return Object.fromEntries(rows.map((row) => [row.id, row.role]));\n    },\n  };\n  const entitlementsRepo = new DrizzleEntitlementsRepository(db, entitlementsLogger);\n  const entitlements = new EntitlementsServiceImpl({\n    repo: entitlementsRepo,\n    content,\n    uow: entitlementsUow,\n    logger: entitlementsLogger,\n  });\n  // Progress: report writes + outbox append in one tx; content supplies the\n  // structure and completion rules the service evaluates against.\n  const progressUow = new DrizzleUnitOfWork(db, (tx) => ({\n    progress: new DrizzleProgressRepository(tx, progressLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const progress = new ProgressServiceImpl({\n    repo: new DrizzleProgressRepository(db, progressLogger),\n    content,\n    access: entitlements,\n    uow: progressUow,\n    logger: progressLogger,\n  });\n\n  const postReads = new DrizzlePostRepository(db, discussionLogger);\n  const discussionReads = new DrizzleDiscussionRepository(db, discussionLogger);\n  const chatReads = new DrizzleChatRepository(db, discussionLogger);\n  const posts = new PostServiceImpl({\n    repo: postReads,\n    access: entitlements,\n    content,\n    authors,\n    profiles: discussionReads,\n    comments: discussionReads,\n    images: assets,\n    fileUrls,\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      posts: new DrizzlePostRepository(tx, discussionLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    logger: discussionLogger,\n  });\n  const chats = new ChatServiceImpl({\n    repo: chatReads,\n    access: entitlements,\n    content,\n    authors,\n    profiles: discussionReads,\n    images: assets,\n    fileUrls,\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      chats: new DrizzleChatRepository(tx, discussionLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    logger: discussionLogger,\n  });\n  const discussion = new DiscussionServiceImpl({\n    repo: discussionReads,\n    access: entitlements,\n    content: content,\n    posts,\n    communities: { listIds: (orgId) => content.listPublishedCommunityIds(orgId) },\n    fileUrls,\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      discussion: new DrizzleDiscussionRepository(tx, discussionLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    settings,\n    logger: discussionLogger,\n  });\n\n  const reporting = {\n    admin: new AdminReportServiceImpl({\n      repo: new DrizzleAdminRepository(db, reportingLogger),\n    }),\n    member: new MemberReportServiceImpl({\n      repo: new DrizzleMemberRepository(db, reportingLogger),\n      content,\n      progress,\n      files: assets,\n      fileUrls,\n      access: entitlements,\n      notifications,\n      posts,\n      chats,\n    }),\n  };\n\n  const credentialStore = new DrizzleCredentialStore(\n    db,\n    config.credentialStoreKey,\n    integrationsLogger,\n  );\n  // The integrations this deployment supports: the installation's declared\n  // plugins folder (directory name = integration id), loaded at startup.\n  // Connect/configure reject undeclared ids and validate config with the\n  // integration's own schema. No folder → no integrations.\n  const integrationsRegistry = await loadIntegrations(options?.pluginsDir, integrationsLogger);\n  // Integrations: credential + connection writes + outbox append in one tx\n  // (a tx-bound credential store instance shares the scope's transaction).\n  const integrationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    connections: new DrizzleConnectionsRepository(tx, integrationsLogger),\n    credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, integrationsLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const integrations = new IntegrationsServiceImpl({\n    registry: integrationsRegistry,\n    repo: new DrizzleConnectionsRepository(db, integrationsLogger),\n    uow: integrationsUow,\n    credentials: credentialStore,\n    logger: integrationsLogger,\n  });\n\n  // Automations: run writes + outbox append in one tx; the engine drives\n  // execution (register below), integrations supplies the loaded\n  // integrations' actions for `available`.\n  const automationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    automations: new DrizzleAutomationsRepository(tx, automationsLogger),\n    runs: new DrizzleAutomationRunsRepository(tx, automationsLogger),\n    credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, automationsLogger),\n    outbox: new DrizzleOutboxAppender(tx, automationsLogger),\n  }));\n  // Emails triggered by row-shaped events resolve their recipient and content\n  // details at send time — the event carries ids only.\n  const mailerLookups: MailerLookups = {\n    orgUserPerson: async (orgId, orgUserId) => {\n      const orgUser = await organizationsRepo.findOrgUserById(orgId, orgUserId);\n      const user = orgUser ? await identity.getUserById(orgUser.userId) : null;\n      return user ? { userId: user.id, email: user.email } : null;\n    },\n    contentInfo: async (orgId, contentId) => {\n      const course = await content.getCourse(orgId, contentId);\n      if (course) {\n        return { id: course.id, title: course.title, type: course.type };\n      }\n      const download = await content.getDownload(orgId, contentId);\n      if (download) {\n        return { id: download.id, title: download.title, type: download.type };\n      }\n      const community = await content.getCommunity(orgId, contentId);\n      return community ? { id: community.id, title: community.title, type: community.type } : null;\n    },\n  };\n\n  const runsRepo = new DrizzleAutomationRunsRepository(db, automationsLogger);\n  const wired = communityMail({\n    content,\n    entitlements,\n    organizations,\n    identity,\n    posts,\n    discussion,\n    chats,\n    assets,\n  });\n  const automations = new AutomationsServiceImpl({\n    repo: new DrizzleAutomationsRepository(db, automationsLogger),\n    runsRepo,\n    uow: automationsUow,\n    engine: automationEngine,\n    mailer,\n    lookups: mailerLookups,\n    integrations,\n    credentials: credentialStore,\n    webhooks:\n      options?.adapters?.webhooks ??\n      new FetchWebhookSender({ allowPrivateNetwork: config.webhookAllowPrivateNetwork }),\n    mail: wired.mail,\n    grants: wired.grants,\n    desk: notifications,\n    scheduledWork: wired.scheduledWork,\n    logger: automationsLogger,\n  });\n  automationEngine.register(automations);\n\n  const eventBus = new InMemoryEventBus();\n  eventBus.subscribeAll((event) => automations.handle(event));\n  const outboxConfig = resolveOutboxConfig(config.outbox);\n  const outboxRelay = new PollingOutboxRelay(\n    new DrizzleOutboxStore(db, outboxLogger),\n    eventBus,\n    outboxConfig,\n    outboxLogger,\n  );\n\n  /*\n   * Auth Adapter\n   */\n  const authLogger = logger.child({ name: 'auth' });\n  // Hook failures otherwise surface through Better Auth's route as an opaque\n  // 500 — log which hook died before rethrowing.\n  const authHook =\n    <A extends unknown[], R>(name: string, fn: (...args: A) => Promise<R>) =>\n    async (...args: A): Promise<R> => {\n      try {\n        return await fn(...args);\n      } catch (err) {\n        authLogger.error(`auth hook ${name} failed`, { err });\n        throw err;\n      }\n    };\n  const mcp = mcpEndpoints(config);\n  if (!mcp.oauthEnabled) {\n    authLogger.warn(\n      'MCP OAuth is off: BETTER_AUTH_URL must be https or a loopback host; /mcp accepts API keys only',\n      { authBaseURL: config.authBaseURL },\n    );\n  }\n  const auth = new BetterAuth({\n    db,\n    baseUrl: config.authBaseURL,\n    mcp: {\n      oauthEnabled: mcp.oauthEnabled,\n      resource: mcp.resource,\n      loginPage: mcp.loginPage,\n      consentPage: mcp.consentPage,\n      orgPickerPage: mcp.orgPickerPage,\n    },\n    secret: config.authSecret,\n    trustedOrigins: config.trustedOrigins,\n    hooks: {\n      sendResetPassword: async ({ user, url }) => {\n        await identity.sendPasswordReset({ email: user.email, url });\n      },\n      onPasswordReset: async ({ user }) => {\n        await identity.sendPasswordChanged({ email: user.email });\n      },\n      sendMagicLink: authHook('sendMagicLink', async ({ email, url }) => {\n        await identity.sendMagicLink({\n          email,\n          url,\n        });\n      }),\n      beforeUserCreate: authHook('beforeUserCreate', async (user) => {\n        const { email, name } = user;\n        const [firstName, lastName] = name.split(' ');\n        // Better Auth has not minted an id yet — the id returned below becomes\n        // its account id. A person provisioned at invite time is linked instead of re-created.\n        const domainUser = await identity.linkOrCreateUser({\n          email,\n          ...(firstName !== undefined && { firstName }),\n          ...(lastName !== undefined && { lastName }),\n        });\n\n        return {\n          data: {\n            ...user,\n            id: domainUser.id,\n          },\n        };\n      }),\n      beforeCreateSession: authHook('beforeCreateSession', async (session) => {\n        const person = await identity.getUserByExternalId(session.userId);\n        if (!person) {\n          return;\n        }\n        const orgs = await organizations.getOrgUsersForUser(person.id);\n        if (orgs.length !== 1) {\n          return;\n        }\n        // TODO - fix, why default to the first?\n        const org = await organizations.getById(orgs[0]!.orgId);\n        if (!org) {\n          return;\n        }\n\n        return { data: { ...session, activeOrganizationId: org.id } };\n      }),\n      /*\n       * We're making sure the domain org creates and using the same ID for better-auth org ID.\n       */\n      beforeCreateOrganization: authHook(\n        'beforeCreateOrganization',\n        async ({ organization: org, user: baUser }) => {\n          const domainOrg = await organizations.createOrganization({\n            ownerId: baUser.id,\n            ...org,\n            logo: org.logo ?? undefined,\n          });\n          return { data: { ...org, id: domainOrg.id } };\n        },\n      ),\n      beforeUpdateOrganization: authHook('beforeUpdateOrganization', async ({ organization }) => {\n        await organizations.updateOrganization(organization.id, organization);\n      }),\n      beforeDeleteOrganization: authHook('beforeDeleteOrganization', async ({ organization }) => {\n        await organizations.deleteOrganization(organization.id);\n      }),\n      beforeAddMember: authHook('beforeAddMember', async ({ member }) => {\n        await organizations.addOrgUser({\n          orgId: member.organizationId,\n          userId: member.userId,\n          role: parseRole(member.role),\n        });\n      }),\n      beforeUpdateMemberRole: authHook('beforeUpdateMemberRole', async ({ member, newRole }) => {\n        await organizations.updateOrgUser(member.organizationId, member.userId, {\n          role: parseRole(newRole),\n        });\n      }),\n      beforeRemoveMember: authHook('beforeRemoveMember', async ({ member }) => {\n        await organizations.removeOrgUser(member.organizationId, member.userId);\n      }),\n    },\n    logger: authLogger,\n    cookieDomain: config.cookieDomain,\n    secureCookies: config.secureCookies,\n  });\n  orgAdminRef.current = auth;\n\n  return {\n    auth,\n    mcp,\n    identity,\n    notifications,\n    organizations,\n    // Better Auth owns org writes; the same instance fulfils the OrgAdmin port.\n    orgProvider: auth,\n    content,\n    entitlements,\n    progress,\n    discussion,\n    posts,\n    chats,\n    assets,\n    integrations,\n    automations,\n    settings,\n    reporting,\n    storage,\n    mailer,\n    credentials: credentialStore,\n    outboxRelay,\n    automationEngine,\n    logger,\n    loggerInstance,\n    requestContext: requestLogContext,\n    // Better Auth owns the session store; the same instance fulfils SessionAdmin.\n    sessions: auth,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA8IA,MAAa,kBAA4C;CACvD,SAAS;CACT,gBAAgB;CAChB,WAAW;AACb;AAEA,SAAgB,oBAAoB,SAAuB,CAAC,GAA6B;CACvF,MAAM,YAAY,OAAO,YACvB,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAClE;CACA,OAAO;EAAE,GAAG;EAAiB,GAAG;CAAU;AAC5C;AAQA,MAAa,mBAA4C,EAAE,OAAO,OAAO;AAEzE,SAAgB,qBAAqB,SAAwB,CAAC,GAA4B;CACxF,OAAO,EAAE,OAAO,OAAO,SAAS,iBAAiB,MAAM;AACzD;AAmDA,eAAsB,eACpB,QACA,SACoB;CACpB,MAAM,EAAE,UAAU,gBAAgB,WAAW,iBAC3C,qBAAqB,OAAO,OAAO,CAAC,CAAC,KACvC;CAGA,MAAM,gBAAgB,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC;CACtD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,iBAAiB,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;CACxD,MAAM,mBAAmB,OAAO,MAAM,EAAE,MAAM,aAAa,CAAC;CAC5D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CACpD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,oBAAoB,OAAO,MAAM,EAAE,MAAM,cAAc,CAAC;CAC9D,MAAM,kBAAkB,OAAO,MAAM,EAAE,MAAM,YAAY,CAAC;CAC1D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CAGpD,MAAM,KAAK,SAAS,OAAO,WAAW;CACtC,MAAM,QAAQ,SAAS,UAAU,SAAS,IAAI,aAAa,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,UACJ,SAAS,UAAU,WAAW,IAAI,eAAe,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC,CAAC;CACpF,MAAM,YACJ,SAAS,UAAU,aAAa,IAAI,qBAAqB,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,YAAY,SAAS,UAAU;CACrC,MAAM,mBACJ,OAAO,cAAc,aACjB,UAAU,iBAAiB,IAC1B,aAAa,IAAI,uBAAuB,iBAAiB;CAChE,MAAM,SAAS,IAAI,OAAO,WAAW,OAAO;EAC1C,GAAI,OAAO,iBAAiB;GAAE,WAAW;GAAgB,SAAS,OAAO;EAAY;EACrF,kBAAkB,OAAO;CAC3B,CAAC;CAED,MAAM,WAAW,eAAe,OAAO,WAAW;CAClD,MAAM,SAAS,IAAI,kBAAkB;EACnC;EACA,MAAM,IAAI,wBAAwB,IAAI,YAAY;EAClD,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,QAAQ,IAAI,wBAAwB,IAAI,YAAY;GACpD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,qBAAqB,OAAO;EAC5B,2BAA2B,OAAO;EAClC;EACA,QAAQ;CACV,CAAC;CAKD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;EAC9E,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;CAC1E,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,gBAAgB,CAAC,CAAC;EAC/E,QAAQ,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;EACzC,KAAK;EACL;EACA,QAAQ;EACR;CACF,CAAC;CACD,MAAM,gBAAgB,IAAI,wBAAwB;EAChD,MAAM,IAAI,+BAA+B,EAAE;EAC3C,QAAQ,OAAO,MAAM,EAAE,MAAM,gBAAgB,CAAC;CAChD,CAAC;CAKD,MAAM,oBAAoB,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;CAC9F,MAAM,mBAAmB,IAAI,kBAAkB,KAAK,QAAQ;EAC1D,eAAe,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EACnF,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;CACrE,EAAE;CACF,MAAM,cAAiD,EAAE,SAAS,KAAA,EAAU;CAC5E,MAAM,gBAAgB,IAAI,wBAAwB;EAChD,MAAM;EACN,aAAa,IAAI,yBAAyB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EAC3E,QAAQ;EACR,KAAK;EACL,gBAAgB;GACd,IAAI,CAAC,YAAY,SACf,MAAM,IAAI,MAAM,0BAA0B;GAE5C,OAAO,YAAY;EACrB;EACA,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC;EACpC;EACA,YAAY;GAAE,kBAAkB,OAAO;GAAkB,aAAa,OAAO;EAAY;CAC3F,CAAC;CAKD,MAAM,WAAW,IAAI,gBACnB,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,CACtE;CAEA,MAAM,aAAa,IAAI,kBAAkB,KAAK,QAAQ;EACpD,SAAS,IAAI,yBAAyB,IAAI,aAAa;EACvD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,UAAU,IAAI,eAAe;EACjC,MAAM,IAAI,yBAAyB,IAAI,aAAa;EACpD,KAAK;EACL,eAAe;EACf,OAAO;EACP;EACA,QAAQ;CACV,CAAC;CAED,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,cAAc,IAAI,8BAA8B,IAAI,kBAAkB;EACtE,QAAQ,IAAI,yBAAyB,IAAI,aAAa;EACtD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,UAAU;EACd,QAAQ,OAAO,OAAe,cAAsB;GAElD,QAAO,MADW,kBAAkB,gBAAgB,OAAO,SAAS,EAAA,EACxD,QAAQ;EACtB;EACA,SAAS,OAAO,OAAe,eAAyB;GACtD,MAAM,OAAO,MAAM,kBAAkB,kBAAkB,OAAO,UAAU;GACxE,OAAO,OAAO,YAAY,KAAK,KAAK,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC;EACjE;CACF;CAEA,MAAM,eAAe,IAAI,wBAAwB;EAC/C,MAAM,IAFqB,8BAA8B,IAAI,kBAExC;EACrB;EACA,KAAK;EACL,QAAQ;CACV,CAAC;CAGD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,cAAc;EAC1D,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,cAAc;EACtD;EACA,QAAQ;EACR,KAAK;EACL,QAAQ;CACV,CAAC;CAED,MAAM,YAAY,IAAI,sBAAsB,IAAI,gBAAgB;CAChE,MAAM,kBAAkB,IAAI,4BAA4B,IAAI,gBAAgB;CAC5E,MAAM,YAAY,IAAI,sBAAsB,IAAI,gBAAgB;CAChE,MAAM,QAAQ,IAAI,gBAAgB;EAChC,MAAM;EACN,QAAQ;EACR;EACA;EACA,UAAU;EACV,UAAU;EACV,QAAQ;EACR;EACA,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,OAAO,IAAI,sBAAsB,IAAI,gBAAgB;GACrD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,QAAQ;CACV,CAAC;CACD,MAAM,QAAQ,IAAI,gBAAgB;EAChC,MAAM;EACN,QAAQ;EACR;EACA;EACA,UAAU;EACV,QAAQ;EACR;EACA,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,OAAO,IAAI,sBAAsB,IAAI,gBAAgB;GACrD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,QAAQ;CACV,CAAC;CACD,MAAM,aAAa,IAAI,sBAAsB;EAC3C,MAAM;EACN,QAAQ;EACC;EACT;EACA,aAAa,EAAE,UAAU,UAAU,QAAQ,0BAA0B,KAAK,EAAE;EAC5E;EACA,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,YAAY,IAAI,4BAA4B,IAAI,gBAAgB;GAChE,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF;EACA,QAAQ;CACV,CAAC;CAED,MAAM,YAAY;EAChB,OAAO,IAAI,uBAAuB,EAChC,MAAM,IAAI,uBAAuB,IAAI,eAAe,EACtD,CAAC;EACD,QAAQ,IAAI,wBAAwB;GAClC,MAAM,IAAI,wBAAwB,IAAI,eAAe;GACrD;GACA;GACA,OAAO;GACP;GACA,QAAQ;GACR;GACA;GACA;EACF,CAAC;CACH;CAEA,MAAM,kBAAkB,IAAI,uBAC1B,IACA,OAAO,oBACP,kBACF;CAKA,MAAM,uBAAuB,MAAM,iBAAiB,SAAS,YAAY,kBAAkB;CAG3F,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,aAAa,IAAI,6BAA6B,IAAI,kBAAkB;EACpE,aAAa,IAAI,uBAAuB,IAAI,OAAO,oBAAoB,kBAAkB;EACzF,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,eAAe,IAAI,wBAAwB;EAC/C,UAAU;EACV,MAAM,IAAI,6BAA6B,IAAI,kBAAkB;EAC7D,KAAK;EACL,aAAa;EACb,QAAQ;CACV,CAAC;CAKD,MAAM,iBAAiB,IAAI,kBAAkB,KAAK,QAAQ;EACxD,aAAa,IAAI,6BAA6B,IAAI,iBAAiB;EACnE,MAAM,IAAI,gCAAgC,IAAI,iBAAiB;EAC/D,aAAa,IAAI,uBAAuB,IAAI,OAAO,oBAAoB,iBAAiB;EACxF,QAAQ,IAAI,sBAAsB,IAAI,iBAAiB;CACzD,EAAE;CAGF,MAAM,gBAA+B;EACnC,eAAe,OAAO,OAAO,cAAc;GACzC,MAAM,UAAU,MAAM,kBAAkB,gBAAgB,OAAO,SAAS;GACxE,MAAM,OAAO,UAAU,MAAM,SAAS,YAAY,QAAQ,MAAM,IAAI;GACpE,OAAO,OAAO;IAAE,QAAQ,KAAK;IAAI,OAAO,KAAK;GAAM,IAAI;EACzD;EACA,aAAa,OAAO,OAAO,cAAc;GACvC,MAAM,SAAS,MAAM,QAAQ,UAAU,OAAO,SAAS;GACvD,IAAI,QACF,OAAO;IAAE,IAAI,OAAO;IAAI,OAAO,OAAO;IAAO,MAAM,OAAO;GAAK;GAEjE,MAAM,WAAW,MAAM,QAAQ,YAAY,OAAO,SAAS;GAC3D,IAAI,UACF,OAAO;IAAE,IAAI,SAAS;IAAI,OAAO,SAAS;IAAO,MAAM,SAAS;GAAK;GAEvE,MAAM,YAAY,MAAM,QAAQ,aAAa,OAAO,SAAS;GAC7D,OAAO,YAAY;IAAE,IAAI,UAAU;IAAI,OAAO,UAAU;IAAO,MAAM,UAAU;GAAK,IAAI;EAC1F;CACF;CAEA,MAAM,WAAW,IAAI,gCAAgC,IAAI,iBAAiB;CAC1E,MAAM,QAAQ,cAAc;EAC1B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,MAAM,cAAc,IAAI,uBAAuB;EAC7C,MAAM,IAAI,6BAA6B,IAAI,iBAAiB;EAC5D;EACA,KAAK;EACL,QAAQ;EACR;EACA,SAAS;EACT;EACA,aAAa;EACb,UACE,SAAS,UAAU,YACnB,IAAI,mBAAmB,EAAE,qBAAqB,OAAO,2BAA2B,CAAC;EACnF,MAAM,MAAM;EACZ,QAAQ,MAAM;EACd,MAAM;EACN,eAAe,MAAM;EACrB,QAAQ;CACV,CAAC;CACD,iBAAiB,SAAS,WAAW;CAErC,MAAM,WAAW,IAAI,iBAAiB;CACtC,SAAS,cAAc,UAAU,YAAY,OAAO,KAAK,CAAC;CAC1D,MAAM,eAAe,oBAAoB,OAAO,MAAM;CACtD,MAAM,cAAc,IAAI,mBACtB,IAAI,mBAAmB,IAAI,YAAY,GACvC,UACA,cACA,YACF;CAKA,MAAM,aAAa,OAAO,MAAM,EAAE,MAAM,OAAO,CAAC;CAGhD,MAAM,YACqB,MAAc,OACvC,OAAO,GAAG,SAAwB;EAChC,IAAI;GACF,OAAO,MAAM,GAAG,GAAG,IAAI;EACzB,SAAS,KAAK;GACZ,WAAW,MAAM,aAAa,KAAK,UAAU,EAAE,IAAI,CAAC;GACpD,MAAM;EACR;CACF;CACF,MAAM,MAAM,aAAa,MAAM;CAC/B,IAAI,CAAC,IAAI,cACP,WAAW,KACT,kGACA,EAAE,aAAa,OAAO,YAAY,CACpC;CAEF,MAAM,OAAO,IAAI,WAAW;EAC1B;EACA,SAAS,OAAO;EAChB,KAAK;GACH,cAAc,IAAI;GAClB,UAAU,IAAI;GACd,WAAW,IAAI;GACf,aAAa,IAAI;GACjB,eAAe,IAAI;EACrB;EACA,QAAQ,OAAO;EACf,gBAAgB,OAAO;EACvB,OAAO;GACL,mBAAmB,OAAO,EAAE,MAAM,UAAU;IAC1C,MAAM,SAAS,kBAAkB;KAAE,OAAO,KAAK;KAAO;IAAI,CAAC;GAC7D;GACA,iBAAiB,OAAO,EAAE,WAAW;IACnC,MAAM,SAAS,oBAAoB,EAAE,OAAO,KAAK,MAAM,CAAC;GAC1D;GACA,eAAe,SAAS,iBAAiB,OAAO,EAAE,OAAO,UAAU;IACjE,MAAM,SAAS,cAAc;KAC3B;KACA;IACF,CAAC;GACH,CAAC;GACD,kBAAkB,SAAS,oBAAoB,OAAO,SAAS;IAC7D,MAAM,EAAE,OAAO,SAAS;IACxB,MAAM,CAAC,WAAW,YAAY,KAAK,MAAM,GAAG;IAG5C,MAAM,aAAa,MAAM,SAAS,iBAAiB;KACjD;KACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;KAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;IAC3C,CAAC;IAED,OAAO,EACL,MAAM;KACJ,GAAG;KACH,IAAI,WAAW;IACjB,EACF;GACF,CAAC;GACD,qBAAqB,SAAS,uBAAuB,OAAO,YAAY;IACtE,MAAM,SAAS,MAAM,SAAS,oBAAoB,QAAQ,MAAM;IAChE,IAAI,CAAC,QACH;IAEF,MAAM,OAAO,MAAM,cAAc,mBAAmB,OAAO,EAAE;IAC7D,IAAI,KAAK,WAAW,GAClB;IAGF,MAAM,MAAM,MAAM,cAAc,QAAQ,KAAK,EAAE,CAAE,KAAK;IACtD,IAAI,CAAC,KACH;IAGF,OAAO,EAAE,MAAM;KAAE,GAAG;KAAS,sBAAsB,IAAI;IAAG,EAAE;GAC9D,CAAC;GAID,0BAA0B,SACxB,4BACA,OAAO,EAAE,cAAc,KAAK,MAAM,aAAa;IAC7C,MAAM,YAAY,MAAM,cAAc,mBAAmB;KACvD,SAAS,OAAO;KAChB,GAAG;KACH,MAAM,IAAI,QAAQ,KAAA;IACpB,CAAC;IACD,OAAO,EAAE,MAAM;KAAE,GAAG;KAAK,IAAI,UAAU;IAAG,EAAE;GAC9C,CACF;GACA,0BAA0B,SAAS,4BAA4B,OAAO,EAAE,mBAAmB;IACzF,MAAM,cAAc,mBAAmB,aAAa,IAAI,YAAY;GACtE,CAAC;GACD,0BAA0B,SAAS,4BAA4B,OAAO,EAAE,mBAAmB;IACzF,MAAM,cAAc,mBAAmB,aAAa,EAAE;GACxD,CAAC;GACD,iBAAiB,SAAS,mBAAmB,OAAO,EAAE,aAAa;IACjE,MAAM,cAAc,WAAW;KAC7B,OAAO,OAAO;KACd,QAAQ,OAAO;KACf,MAAM,UAAU,OAAO,IAAI;IAC7B,CAAC;GACH,CAAC;GACD,wBAAwB,SAAS,0BAA0B,OAAO,EAAE,QAAQ,cAAc;IACxF,MAAM,cAAc,cAAc,OAAO,gBAAgB,OAAO,QAAQ,EACtE,MAAM,UAAU,OAAO,EACzB,CAAC;GACH,CAAC;GACD,oBAAoB,SAAS,sBAAsB,OAAO,EAAE,aAAa;IACvE,MAAM,cAAc,cAAc,OAAO,gBAAgB,OAAO,MAAM;GACxE,CAAC;EACH;EACA,QAAQ;EACR,cAAc,OAAO;EACrB,eAAe,OAAO;CACxB,CAAC;CACD,YAAY,UAAU;CAEtB,OAAO;EACL;EACA;EACA;EACA;EACA;EAEA,aAAa;EACb;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA;EACA;EACA;EACA,gBAAgB;EAEhB,UAAU;CACZ;AACF"}

package/dist/app/mcp-endpoints.d.ts

@@ -0,0 +1,13 @@
+import { McpAuthOptions } from "@headless-lms/adapter-auth";
+//#region src/app/mcp-endpoints.d.ts
+interface McpEndpoints extends McpAuthOptions {
+  issuer: string;
+  resourceMetadataUrl: string;
+}
+declare function mcpEndpoints(config: {
+  authBaseURL: string;
+  adminAppUrl: string;
+}): McpEndpoints;
+//#endregion
+export { McpEndpoints, mcpEndpoints };
+//# sourceMappingURL=mcp-endpoints.d.ts.map

package/dist/app/mcp-endpoints.js

@@ -0,0 +1,25 @@
+//#region src/app/mcp-endpoints.ts
+const trimSlash = (url) => url.replace(/\/+$/, "");
+const LOOPBACK_IPV4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+function oauthEligible(resource) {
+	const { protocol, hostname } = new URL(resource);
+	if (protocol === "https:") return true;
+	return protocol === "http:" && (hostname === "localhost" || hostname === "[::1]" || LOOPBACK_IPV4.test(hostname));
+}
+function mcpEndpoints(config) {
+	const api = trimSlash(config.authBaseURL);
+	const admin = trimSlash(config.adminAppUrl);
+	return {
+		oauthEnabled: oauthEligible(`${api}/mcp`),
+		resource: `${api}/mcp`,
+		resourceMetadataUrl: `${api}/.well-known/oauth-protected-resource/mcp`,
+		issuer: `${api}/api/auth`,
+		loginPage: `${admin}/login`,
+		consentPage: `${admin}/oauth/consent`,
+		orgPickerPage: `${admin}/onboarding/select-organization`
+	};
+}
+//#endregion
+export { mcpEndpoints };
+
+//# sourceMappingURL=mcp-endpoints.js.map

package/dist/app/mcp-endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-endpoints.js","names":[],"sources":["../../src/app/mcp-endpoints.ts"],"sourcesContent":["import type { McpAuthOptions } from '@headless-lms/adapter-auth';\n\nexport interface McpEndpoints extends McpAuthOptions {\n  issuer: string;\n  resourceMetadataUrl: string;\n}\n\nconst trimSlash = (url: string) => url.replace(/\\/+$/, '');\n\nconst LOOPBACK_IPV4 = /^127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$/;\n\nfunction oauthEligible(resource: string): boolean {\n  const { protocol, hostname } = new URL(resource);\n  if (protocol === 'https:') {\n    return true;\n  }\n  return (\n    protocol === 'http:' &&\n    (hostname === 'localhost' || hostname === '[::1]' || LOOPBACK_IPV4.test(hostname))\n  );\n}\n\nexport function mcpEndpoints(config: { authBaseURL: string; adminAppUrl: string }): McpEndpoints {\n  const api = trimSlash(config.authBaseURL);\n  const admin = trimSlash(config.adminAppUrl);\n  return {\n    oauthEnabled: oauthEligible(`${api}/mcp`),\n    resource: `${api}/mcp`,\n    resourceMetadataUrl: `${api}/.well-known/oauth-protected-resource/mcp`,\n    issuer: `${api}/api/auth`,\n    loginPage: `${admin}/login`,\n    consentPage: `${admin}/oauth/consent`,\n    orgPickerPage: `${admin}/onboarding/select-organization`,\n  };\n}\n"],"mappings":";AAOA,MAAM,aAAa,QAAgB,IAAI,QAAQ,QAAQ,EAAE;AAEzD,MAAM,gBAAgB;AAEtB,SAAS,cAAc,UAA2B;CAChD,MAAM,EAAE,UAAU,aAAa,IAAI,IAAI,QAAQ;CAC/C,IAAI,aAAa,UACf,OAAO;CAET,OACE,aAAa,YACZ,aAAa,eAAe,aAAa,WAAW,cAAc,KAAK,QAAQ;AAEpF;AAEA,SAAgB,aAAa,QAAoE;CAC/F,MAAM,MAAM,UAAU,OAAO,WAAW;CACxC,MAAM,QAAQ,UAAU,OAAO,WAAW;CAC1C,OAAO;EACL,cAAc,cAAc,GAAG,IAAI,KAAK;EACxC,UAAU,GAAG,IAAI;EACjB,qBAAqB,GAAG,IAAI;EAC5B,QAAQ,GAAG,IAAI;EACf,WAAW,GAAG,MAAM;EACpB,aAAa,GAAG,MAAM;EACtB,eAAe,GAAG,MAAM;CAC1B;AACF"}

package/dist/http/config.d.ts

@@ -13,10 +13,11 @@ interface ServerConfig {
    *  Unset → on. Turn off for a quiet dev console; app-level logs are
    *  unaffected either way. */
   requestLogging?: boolean;
-  /** Presigned URL lifetime for entitled download delivery, seconds. Separate
+  /** Lifetime of every signed file URL a response carries, seconds. Separate
    *  from the storage adapter's general download expiry so raising that one
    *  can't silently extend paywalled link lifetimes. */
   deliveryExpirySeconds: number;
+  memberImageMaxBytes: number;
   /** Everything the composition container needs to wire adapters + services. */
   container: Config;
 }

package/dist/http/errors.d.ts

@@ -0,0 +1,14 @@
+//#region src/http/errors.d.ts
+type Refusal = {
+  status: number;
+  error: string;
+  message: string;
+  issues?: {
+    path: string;
+    message: string;
+  }[];
+};
+declare function classifyError(error: unknown): Refusal | undefined;
+//#endregion
+export { Refusal, classifyError };
+//# sourceMappingURL=errors.d.ts.map

package/dist/http/errors.js

@@ -0,0 +1,147 @@
+import { UnauthorizedError } from "./plugins/auth.js";
+import { NoActiveOrgError } from "./scope.js";
+import { InviteError, OrganizationRuleError } from "@headless-lms/core/organizations";
+import { ActionInvocationError, AlreadyConnectedError, InvalidConfigError, UnknownIntegrationError } from "@headless-lms/core/integrations";
+import { AutomationKindMismatchError, InvalidTriggerError, ReservedActionError } from "@headless-lms/core/automations";
+import { hasZodFastifySchemaValidationErrors } from "fastify-type-provider-zod";
+import { ConflictError, ForbiddenError, InvalidInputError, NotFoundError } from "@headless-lms/core/shared/errors";
+//#region src/http/errors.ts
+const BODY_ERRORS = {
+	FST_ERR_CTP_INVALID_JSON_BODY: {
+		status: 400,
+		error: "invalid_body",
+		message: "The request body must be valid JSON"
+	},
+	FST_ERR_CTP_EMPTY_JSON_BODY: {
+		status: 400,
+		error: "invalid_body",
+		message: "The request body must be valid JSON"
+	},
+	FST_ERR_CTP_INVALID_MEDIA_TYPE: {
+		status: 415,
+		error: "unsupported_media_type",
+		message: "Send the request body as application/json"
+	},
+	FST_ERR_CTP_BODY_TOO_LARGE: {
+		status: 413,
+		error: "payload_too_large",
+		message: "The request body is too large"
+	},
+	FST_ERR_NOT_FOUND: {
+		status: 404,
+		error: "not_found",
+		message: "No such route"
+	}
+};
+function issuePath(context, instancePath) {
+	return `${context}${instancePath.split("/").filter((part) => part.length > 0).map((part) => /^\d+$/.test(part) ? `[${part}]` : `.${part}`).join("")}`;
+}
+function describeIssue(keyword, params, fallback) {
+	switch (keyword) {
+		case "invalid_type":
+			if (params.received === "undefined" || params.received === "null") return "is required";
+			return params.expected ? `must be ${withArticle(params.expected)}` : fallback;
+		case "too_small": return params.origin === "string" ? Number(params.minimum) === 1 ? "must not be empty" : `must be at least ${params.minimum} characters` : params.origin === "array" ? `must have at least ${params.minimum} ${Number(params.minimum) === 1 ? "item" : "items"}` : `must be ${params.inclusive === false ? "greater than" : "at least"} ${params.minimum}`;
+		case "too_big": return params.origin === "string" ? `must be at most ${params.maximum} characters` : params.origin === "array" ? `must have at most ${params.maximum} items` : `must be ${params.inclusive === false ? "less than" : "at most"} ${params.maximum}`;
+		case "unrecognized_keys": return `has ${params.keys && params.keys.length > 1 ? "unknown fields" : "an unknown field"} ${(params.keys ?? []).map((key) => `"${key}"`).join(", ")}`;
+		case "invalid_value": return `must be one of ${(params.values ?? []).map((value) => JSON.stringify(value)).join(", ")}`;
+		case "invalid_format": return params.format ? `must be a valid ${params.format.replace(/_/g, " ")}` : fallback;
+		case "invalid_union": return "is not in an accepted shape";
+		default: return fallback;
+	}
+}
+function withArticle(noun) {
+	return /^[aeiou]/i.test(noun) ? `an ${noun}` : `a ${noun}`;
+}
+function classifyError(error) {
+	if (error instanceof NotFoundError) return {
+		status: 404,
+		error: "not_found",
+		message: error.message
+	};
+	if (error instanceof InvalidInputError) return {
+		status: 400,
+		error: "invalid_input",
+		message: error.message
+	};
+	if (error instanceof ConflictError || error instanceof OrganizationRuleError) return {
+		status: 409,
+		error: "conflict",
+		message: error.message
+	};
+	if (error instanceof ForbiddenError || error instanceof NoActiveOrgError) return {
+		status: 403,
+		error: "forbidden",
+		message: error.message
+	};
+	if (error instanceof UnauthorizedError) return {
+		status: 401,
+		error: "unauthorized",
+		message: error.message
+	};
+	if (error instanceof InviteError) return {
+		status: 400,
+		error: "invalid_invite",
+		message: error.message
+	};
+	if (error instanceof AlreadyConnectedError) return {
+		status: 409,
+		error: "already_connected",
+		message: error.message
+	};
+	if (error instanceof UnknownIntegrationError) return {
+		status: 400,
+		error: "unknown_integration",
+		message: error.message
+	};
+	if (error instanceof InvalidConfigError) return {
+		status: 400,
+		error: "invalid_config",
+		message: error.message
+	};
+	if (error instanceof InvalidTriggerError) return {
+		status: 400,
+		error: "invalid_trigger",
+		message: error.message
+	};
+	if (error instanceof ReservedActionError) return {
+		status: 400,
+		error: "reserved_action",
+		message: error.message
+	};
+	if (error instanceof ActionInvocationError) return {
+		status: 502,
+		error: "action_failed",
+		message: "The integration did not respond as expected"
+	};
+	if (error instanceof AutomationKindMismatchError) return {
+		status: 409,
+		error: "kind_mismatch",
+		message: error.message
+	};
+	if (hasZodFastifySchemaValidationErrors(error)) {
+		const context = error.validationContext ?? "request";
+		const issues = error.validation.map((issue) => ({
+			path: issuePath(context, issue.instancePath),
+			message: describeIssue(issue.keyword, issue.params ?? {}, issue.message ?? "is invalid")
+		}));
+		const first = issues[0];
+		return {
+			status: 400,
+			error: "validation",
+			message: first ? `${first.path}: ${first.message}` : "The request is invalid",
+			issues
+		};
+	}
+	const err = error;
+	if (err.code && BODY_ERRORS[err.code]) return BODY_ERRORS[err.code];
+	if (typeof err.statusCode === "number" && err.statusCode >= 400 && err.statusCode < 500) return {
+		status: err.statusCode,
+		error: "bad_request",
+		message: "The request could not be processed"
+	};
+}
+//#endregion
+export { classifyError };
+
+//# sourceMappingURL=errors.js.map

package/dist/http/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","names":[],"sources":["../../src/http/errors.ts"],"sourcesContent":["import {\n  ConflictError,\n  ForbiddenError,\n  InvalidInputError,\n  NotFoundError,\n} from '@headless-lms/core/shared/errors';\nimport { InviteError, OrganizationRuleError } from '@headless-lms/core/organizations';\nimport {\n  ActionInvocationError,\n  AlreadyConnectedError,\n  InvalidConfigError,\n  UnknownIntegrationError,\n} from '@headless-lms/core/integrations';\nimport {\n  AutomationKindMismatchError,\n  InvalidTriggerError,\n  ReservedActionError,\n} from '@headless-lms/core/automations';\nimport { hasZodFastifySchemaValidationErrors } from 'fastify-type-provider-zod';\nimport { NoActiveOrgError } from './scope.js';\nimport { UnauthorizedError } from './plugins/auth.js';\n\nexport type Refusal = {\n  status: number;\n  error: string;\n  message: string;\n  issues?: { path: string; message: string }[];\n};\n\nconst BODY_ERRORS: Record<string, Refusal> = {\n  FST_ERR_CTP_INVALID_JSON_BODY: {\n    status: 400,\n    error: 'invalid_body',\n    message: 'The request body must be valid JSON',\n  },\n  FST_ERR_CTP_EMPTY_JSON_BODY: {\n    status: 400,\n    error: 'invalid_body',\n    message: 'The request body must be valid JSON',\n  },\n  FST_ERR_CTP_INVALID_MEDIA_TYPE: {\n    status: 415,\n    error: 'unsupported_media_type',\n    message: 'Send the request body as application/json',\n  },\n  FST_ERR_CTP_BODY_TOO_LARGE: {\n    status: 413,\n    error: 'payload_too_large',\n    message: 'The request body is too large',\n  },\n  FST_ERR_NOT_FOUND: { status: 404, error: 'not_found', message: 'No such route' },\n};\n\nfunction issuePath(context: string, instancePath: string): string {\n  const inner = instancePath\n    .split('/')\n    .filter((part) => part.length > 0)\n    .map((part) => (/^\\d+$/.test(part) ? `[${part}]` : `.${part}`))\n    .join('');\n  return `${context}${inner}`;\n}\n\ntype IssueParams = {\n  expected?: string;\n  received?: string;\n  minimum?: number | bigint;\n  maximum?: number | bigint;\n  inclusive?: boolean;\n  origin?: string;\n  keys?: string[];\n  values?: unknown[];\n  format?: string;\n};\n\nfunction describeIssue(keyword: string | undefined, params: IssueParams, fallback: string): string {\n  switch (keyword) {\n    case 'invalid_type':\n      if (params.received === 'undefined' || params.received === 'null') {\n        return 'is required';\n      }\n      return params.expected ? `must be ${withArticle(params.expected)}` : fallback;\n    case 'too_small':\n      return params.origin === 'string'\n        ? Number(params.minimum) === 1\n          ? 'must not be empty'\n          : `must be at least ${params.minimum} characters`\n        : params.origin === 'array'\n          ? `must have at least ${params.minimum} ${Number(params.minimum) === 1 ? 'item' : 'items'}`\n          : `must be ${params.inclusive === false ? 'greater than' : 'at least'} ${params.minimum}`;\n    case 'too_big':\n      return params.origin === 'string'\n        ? `must be at most ${params.maximum} characters`\n        : params.origin === 'array'\n          ? `must have at most ${params.maximum} items`\n          : `must be ${params.inclusive === false ? 'less than' : 'at most'} ${params.maximum}`;\n    case 'unrecognized_keys':\n      return `has ${params.keys && params.keys.length > 1 ? 'unknown fields' : 'an unknown field'} ${(params.keys ?? []).map((key) => `\"${key}\"`).join(', ')}`;\n    case 'invalid_value':\n      return `must be one of ${(params.values ?? []).map((value) => JSON.stringify(value)).join(', ')}`;\n    case 'invalid_format':\n      return params.format ? `must be a valid ${params.format.replace(/_/g, ' ')}` : fallback;\n    case 'invalid_union':\n      return 'is not in an accepted shape';\n    default:\n      return fallback;\n  }\n}\n\nfunction withArticle(noun: string): string {\n  return /^[aeiou]/i.test(noun) ? `an ${noun}` : `a ${noun}`;\n}\n\nexport function classifyError(error: unknown): Refusal | undefined {\n  if (error instanceof NotFoundError) {\n    return { status: 404, error: 'not_found', message: error.message };\n  }\n  if (error instanceof InvalidInputError) {\n    return { status: 400, error: 'invalid_input', message: error.message };\n  }\n  if (error instanceof ConflictError || error instanceof OrganizationRuleError) {\n    return { status: 409, error: 'conflict', message: error.message };\n  }\n  if (error instanceof ForbiddenError || error instanceof NoActiveOrgError) {\n    return { status: 403, error: 'forbidden', message: error.message };\n  }\n  if (error instanceof UnauthorizedError) {\n    return { status: 401, error: 'unauthorized', message: error.message };\n  }\n  if (error instanceof InviteError) {\n    return { status: 400, error: 'invalid_invite', message: error.message };\n  }\n  if (error instanceof AlreadyConnectedError) {\n    return { status: 409, error: 'already_connected', message: error.message };\n  }\n  if (error instanceof UnknownIntegrationError) {\n    return { status: 400, error: 'unknown_integration', message: error.message };\n  }\n  if (error instanceof InvalidConfigError) {\n    return { status: 400, error: 'invalid_config', message: error.message };\n  }\n  if (error instanceof InvalidTriggerError) {\n    return { status: 400, error: 'invalid_trigger', message: error.message };\n  }\n  if (error instanceof ReservedActionError) {\n    return { status: 400, error: 'reserved_action', message: error.message };\n  }\n  if (error instanceof ActionInvocationError) {\n    return {\n      status: 502,\n      error: 'action_failed',\n      message: 'The integration did not respond as expected',\n    };\n  }\n  if (error instanceof AutomationKindMismatchError) {\n    return { status: 409, error: 'kind_mismatch', message: error.message };\n  }\n  if (hasZodFastifySchemaValidationErrors(error)) {\n    const context = (error as { validationContext?: string }).validationContext ?? 'request';\n    const issues = error.validation.map((issue) => ({\n      path: issuePath(context, issue.instancePath),\n      message: describeIssue(\n        issue.keyword,\n        (issue.params ?? {}) as IssueParams,\n        issue.message ?? 'is invalid',\n      ),\n    }));\n    const first = issues[0];\n    return {\n      status: 400,\n      error: 'validation',\n      message: first ? `${first.path}: ${first.message}` : 'The request is invalid',\n      issues,\n    };\n  }\n  const err = error as { statusCode?: number; code?: string };\n  if (err.code && BODY_ERRORS[err.code]) {\n    return BODY_ERRORS[err.code];\n  }\n  if (typeof err.statusCode === 'number' && err.statusCode >= 400 && err.statusCode < 500) {\n    return {\n      status: err.statusCode,\n      error: 'bad_request',\n      message: 'The request could not be processed',\n    };\n  }\n  return undefined;\n}\n"],"mappings":";;;;;;;;AA6BA,MAAM,cAAuC;CAC3C,+BAA+B;EAC7B,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CACA,6BAA6B;EAC3B,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CACA,gCAAgC;EAC9B,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CACA,4BAA4B;EAC1B,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CACA,mBAAmB;EAAE,QAAQ;EAAK,OAAO;EAAa,SAAS;CAAgB;AACjF;AAEA,SAAS,UAAU,SAAiB,cAA8B;CAMhE,OAAO,GAAG,UALI,aACX,MAAM,GAAG,CAAC,CACV,QAAQ,SAAS,KAAK,SAAS,CAAC,CAAC,CACjC,KAAK,SAAU,QAAQ,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,MAAO,CAAC,CAC9D,KAAK,EACgB;AAC1B;AAcA,SAAS,cAAc,SAA6B,QAAqB,UAA0B;CACjG,QAAQ,SAAR;EACE,KAAK;GACH,IAAI,OAAO,aAAa,eAAe,OAAO,aAAa,QACzD,OAAO;GAET,OAAO,OAAO,WAAW,WAAW,YAAY,OAAO,QAAQ,MAAM;EACvE,KAAK,aACH,OAAO,OAAO,WAAW,WACrB,OAAO,OAAO,OAAO,MAAM,IACzB,sBACA,oBAAoB,OAAO,QAAQ,eACrC,OAAO,WAAW,UAChB,sBAAsB,OAAO,QAAQ,GAAG,OAAO,OAAO,OAAO,MAAM,IAAI,SAAS,YAChF,WAAW,OAAO,cAAc,QAAQ,iBAAiB,WAAW,GAAG,OAAO;EACtF,KAAK,WACH,OAAO,OAAO,WAAW,WACrB,mBAAmB,OAAO,QAAQ,eAClC,OAAO,WAAW,UAChB,qBAAqB,OAAO,QAAQ,UACpC,WAAW,OAAO,cAAc,QAAQ,cAAc,UAAU,GAAG,OAAO;EAClF,KAAK,qBACH,OAAO,OAAO,OAAO,QAAQ,OAAO,KAAK,SAAS,IAAI,mBAAmB,mBAAmB,IAAI,OAAO,QAAQ,CAAC,EAAA,CAAG,KAAK,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI;EACvJ,KAAK,iBACH,OAAO,mBAAmB,OAAO,UAAU,CAAC,EAAA,CAAG,KAAK,UAAU,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;EAChG,KAAK,kBACH,OAAO,OAAO,SAAS,mBAAmB,OAAO,OAAO,QAAQ,MAAM,GAAG,MAAM;EACjF,KAAK,iBACH,OAAO;EACT,SACE,OAAO;CACX;AACF;AAEA,SAAS,YAAY,MAAsB;CACzC,OAAO,YAAY,KAAK,IAAI,IAAI,MAAM,SAAS,KAAK;AACtD;AAEA,SAAgB,cAAc,OAAqC;CACjE,IAAI,iBAAiB,eACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAa,SAAS,MAAM;CAAQ;CAEnE,IAAI,iBAAiB,mBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAiB,SAAS,MAAM;CAAQ;CAEvE,IAAI,iBAAiB,iBAAiB,iBAAiB,uBACrD,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAY,SAAS,MAAM;CAAQ;CAElE,IAAI,iBAAiB,kBAAkB,iBAAiB,kBACtD,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAa,SAAS,MAAM;CAAQ;CAEnE,IAAI,iBAAiB,mBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAgB,SAAS,MAAM;CAAQ;CAEtE,IAAI,iBAAiB,aACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAkB,SAAS,MAAM;CAAQ;CAExE,IAAI,iBAAiB,uBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAqB,SAAS,MAAM;CAAQ;CAE3E,IAAI,iBAAiB,yBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAuB,SAAS,MAAM;CAAQ;CAE7E,IAAI,iBAAiB,oBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAkB,SAAS,MAAM;CAAQ;CAExE,IAAI,iBAAiB,qBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAmB,SAAS,MAAM;CAAQ;CAEzE,IAAI,iBAAiB,qBACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAmB,SAAS,MAAM;CAAQ;CAEzE,IAAI,iBAAiB,uBACnB,OAAO;EACL,QAAQ;EACR,OAAO;EACP,SAAS;CACX;CAEF,IAAI,iBAAiB,6BACnB,OAAO;EAAE,QAAQ;EAAK,OAAO;EAAiB,SAAS,MAAM;CAAQ;CAEvE,IAAI,oCAAoC,KAAK,GAAG;EAC9C,MAAM,UAAW,MAAyC,qBAAqB;EAC/E,MAAM,SAAS,MAAM,WAAW,KAAK,WAAW;GAC9C,MAAM,UAAU,SAAS,MAAM,YAAY;GAC3C,SAAS,cACP,MAAM,SACL,MAAM,UAAU,CAAC,GAClB,MAAM,WAAW,YACnB;EACF,EAAE;EACF,MAAM,QAAQ,OAAO;EACrB,OAAO;GACL,QAAQ;GACR,OAAO;GACP,SAAS,QAAQ,GAAG,MAAM,KAAK,IAAI,MAAM,YAAY;GACrD;EACF;CACF;CACA,MAAM,MAAM;CACZ,IAAI,IAAI,QAAQ,YAAY,IAAI,OAC9B,OAAO,YAAY,IAAI;CAEzB,IAAI,OAAO,IAAI,eAAe,YAAY,IAAI,cAAc,OAAO,IAAI,aAAa,KAClF,OAAO;EACL,QAAQ,IAAI;EACZ,OAAO;EACP,SAAS;CACX;AAGJ"}

package/dist/http/mcp/catalogue.d.ts

@@ -0,0 +1,37 @@
+import { ToolKind } from "./tool.js";
+import { AccessScope, StaffRole } from "@headless-lms/core/organizations";
+//#region src/http/mcp/catalogue.d.ts
+interface CatalogueField {
+  name: string;
+  type: string;
+  required: boolean;
+  description: string | null;
+}
+interface CatalogueTool {
+  name: string;
+  title: string;
+  description: string;
+  resource: string;
+  scope: AccessScope;
+  kind: ToolKind;
+  idempotent: boolean;
+  openWorld: boolean;
+  fields: CatalogueField[];
+}
+interface CatalogueScope {
+  scope: AccessScope;
+  resource: string;
+  action: string;
+  permission: string | null;
+  roles: StaffRole[];
+  removes: boolean;
+}
+interface McpCatalogue {
+  instructions: string;
+  scopes: CatalogueScope[];
+  tools: CatalogueTool[];
+}
+declare function mcpCatalogue(): McpCatalogue;
+//#endregion
+export { CatalogueField, CatalogueScope, CatalogueTool, McpCatalogue, mcpCatalogue };
+//# sourceMappingURL=catalogue.d.ts.map

package/dist/http/mcp/catalogue.js

@@ -0,0 +1,69 @@
+import { toolInputSchema } from "./input-schema.js";
+import { MCP_INSTRUCTIONS } from "./server.js";
+import { TOOLS } from "./tools/index.js";
+import { ACCESS_SCOPES, SCOPE_PERMISSION, STAFF_ROLES, isDeleteScope, roleHoldsScope } from "@headless-lms/core/organizations";
+//#region src/http/mcp/catalogue.ts
+function typeOf(schema) {
+	const variants = schema.anyOf ?? schema.oneOf;
+	if (variants) return [...new Set(variants.map(typeOf))].join(" | ");
+	if (schema.enum) return schema.enum.map((value) => JSON.stringify(value)).join(" | ");
+	if (schema.const !== void 0) return JSON.stringify(schema.const);
+	if (schema.type === "array") return `${schema.items ? typeOf(schema.items) : "unknown"}[]`;
+	if (schema.format === "date-time") return "date-time";
+	if (Array.isArray(schema.type)) return schema.type.join(" | ");
+	return schema.type ?? "unknown";
+}
+function descriptionOf(schema) {
+	return schema.description ?? (schema.anyOf ?? schema.oneOf)?.find((variant) => variant.description)?.description ?? null;
+}
+function fieldsOf(tool) {
+	const json = toolInputSchema(tool.input)["~standard"].jsonSchema.input({ target: "draft-2020-12" });
+	const required = new Set(json.required ?? []);
+	const fields = Object.entries(json.properties ?? {}).map(([name, schema]) => ({
+		name,
+		type: typeOf(schema),
+		required: required.has(name),
+		description: descriptionOf(schema)
+	}));
+	return [...fields.filter((field) => field.required), ...fields.filter((field) => !field.required)];
+}
+const REMOVING_WRITE_SCOPES = [
+	"downloads:write",
+	"bundles:write",
+	"access:write",
+	"comments:moderate",
+	"communities:write",
+	"community_members:write",
+	"community_moderation:write"
+];
+function mcpCatalogue() {
+	return {
+		instructions: MCP_INSTRUCTIONS,
+		scopes: ACCESS_SCOPES.map((scope) => {
+			const [resource = scope, action = ""] = scope.split(":");
+			return {
+				scope,
+				resource,
+				action,
+				permission: SCOPE_PERMISSION[scope],
+				roles: STAFF_ROLES.filter((role) => roleHoldsScope(role, scope)),
+				removes: isDeleteScope(scope) || REMOVING_WRITE_SCOPES.includes(scope)
+			};
+		}),
+		tools: TOOLS.map((tool) => ({
+			name: tool.name,
+			title: tool.title,
+			description: tool.description,
+			resource: tool.scope.split(":")[0] ?? tool.scope,
+			scope: tool.scope,
+			kind: tool.kind,
+			idempotent: tool.idempotent,
+			openWorld: tool.openWorld,
+			fields: fieldsOf(tool)
+		}))
+	};
+}
+//#endregion
+export { mcpCatalogue };
+
+//# sourceMappingURL=catalogue.js.map

package/dist/http/mcp/catalogue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogue.js","names":[],"sources":["../../../src/http/mcp/catalogue.ts"],"sourcesContent":["import {\n  ACCESS_SCOPES,\n  SCOPE_PERMISSION,\n  STAFF_ROLES,\n  isDeleteScope,\n  roleHoldsScope,\n  type AccessScope,\n  type StaffRole,\n} from '@headless-lms/core/organizations';\nimport { toolInputSchema } from './input-schema.js';\nimport { MCP_INSTRUCTIONS } from './server.js';\nimport type { ToolKind } from './tool.js';\nimport { TOOLS } from './tools/index.js';\n\nexport interface CatalogueField {\n  name: string;\n  type: string;\n  required: boolean;\n  description: string | null;\n}\n\nexport interface CatalogueTool {\n  name: string;\n  title: string;\n  description: string;\n  resource: string;\n  scope: AccessScope;\n  kind: ToolKind;\n  idempotent: boolean;\n  openWorld: boolean;\n  fields: CatalogueField[];\n}\n\nexport interface CatalogueScope {\n  scope: AccessScope;\n  resource: string;\n  action: string;\n  permission: string | null;\n  roles: StaffRole[];\n  removes: boolean;\n}\n\nexport interface McpCatalogue {\n  instructions: string;\n  scopes: CatalogueScope[];\n  tools: CatalogueTool[];\n}\n\ntype JsonSchema = {\n  type?: string | string[];\n  format?: string;\n  enum?: unknown[];\n  const?: unknown;\n  items?: JsonSchema;\n  anyOf?: JsonSchema[];\n  oneOf?: JsonSchema[];\n  description?: string;\n  properties?: Record<string, JsonSchema>;\n  required?: string[];\n};\n\nfunction typeOf(schema: JsonSchema): string {\n  const variants = schema.anyOf ?? schema.oneOf;\n  if (variants) {\n    return [...new Set(variants.map(typeOf))].join(' | ');\n  }\n  if (schema.enum) {\n    return schema.enum.map((value) => JSON.stringify(value)).join(' | ');\n  }\n  if (schema.const !== undefined) {\n    return JSON.stringify(schema.const);\n  }\n  if (schema.type === 'array') {\n    return `${schema.items ? typeOf(schema.items) : 'unknown'}[]`;\n  }\n  if (schema.format === 'date-time') {\n    return 'date-time';\n  }\n  if (Array.isArray(schema.type)) {\n    return schema.type.join(' | ');\n  }\n  return schema.type ?? 'unknown';\n}\n\nfunction descriptionOf(schema: JsonSchema): string | null {\n  return (\n    schema.description ??\n    (schema.anyOf ?? schema.oneOf)?.find((variant) => variant.description)?.description ??\n    null\n  );\n}\n\nfunction fieldsOf(tool: (typeof TOOLS)[number]): CatalogueField[] {\n  const json = toolInputSchema(tool.input)['~standard'].jsonSchema.input({\n    target: 'draft-2020-12',\n  }) as JsonSchema;\n  const required = new Set(json.required ?? []);\n  const fields = Object.entries(json.properties ?? {}).map(([name, schema]) => ({\n    name,\n    type: typeOf(schema),\n    required: required.has(name),\n    description: descriptionOf(schema),\n  }));\n  return [\n    ...fields.filter((field) => field.required),\n    ...fields.filter((field) => !field.required),\n  ];\n}\n\nconst REMOVING_WRITE_SCOPES: readonly AccessScope[] = [\n  'downloads:write',\n  'bundles:write',\n  'access:write',\n  'comments:moderate',\n  'communities:write',\n  'community_members:write',\n  'community_moderation:write',\n];\n\nexport function mcpCatalogue(): McpCatalogue {\n  return {\n    instructions: MCP_INSTRUCTIONS,\n    scopes: ACCESS_SCOPES.map((scope) => {\n      const [resource = scope, action = ''] = scope.split(':');\n      return {\n        scope,\n        resource,\n        action,\n        permission: SCOPE_PERMISSION[scope],\n        roles: STAFF_ROLES.filter((role) => roleHoldsScope(role, scope)),\n        removes: isDeleteScope(scope) || REMOVING_WRITE_SCOPES.includes(scope),\n      };\n    }),\n    tools: TOOLS.map((tool) => ({\n      name: tool.name,\n      title: tool.title,\n      description: tool.description,\n      resource: tool.scope.split(':')[0] ?? tool.scope,\n      scope: tool.scope,\n      kind: tool.kind,\n      idempotent: tool.idempotent,\n      openWorld: tool.openWorld,\n      fields: fieldsOf(tool),\n    })),\n  };\n}\n"],"mappings":";;;;;AA6DA,SAAS,OAAO,QAA4B;CAC1C,MAAM,WAAW,OAAO,SAAS,OAAO;CACxC,IAAI,UACF,OAAO,CAAC,GAAG,IAAI,IAAI,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK;CAEtD,IAAI,OAAO,MACT,OAAO,OAAO,KAAK,KAAK,UAAU,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;CAErE,IAAI,OAAO,UAAU,KAAA,GACnB,OAAO,KAAK,UAAU,OAAO,KAAK;CAEpC,IAAI,OAAO,SAAS,SAClB,OAAO,GAAG,OAAO,QAAQ,OAAO,OAAO,KAAK,IAAI,UAAU;CAE5D,IAAI,OAAO,WAAW,aACpB,OAAO;CAET,IAAI,MAAM,QAAQ,OAAO,IAAI,GAC3B,OAAO,OAAO,KAAK,KAAK,KAAK;CAE/B,OAAO,OAAO,QAAQ;AACxB;AAEA,SAAS,cAAc,QAAmC;CACxD,OACE,OAAO,gBACN,OAAO,SAAS,OAAO,MAAA,EAAQ,MAAM,YAAY,QAAQ,WAAW,CAAC,EAAE,eACxE;AAEJ;AAEA,SAAS,SAAS,MAAgD;CAChE,MAAM,OAAO,gBAAgB,KAAK,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,MAAM,EACrE,QAAQ,gBACV,CAAC;CACD,MAAM,WAAW,IAAI,IAAI,KAAK,YAAY,CAAC,CAAC;CAC5C,MAAM,SAAS,OAAO,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,aAAa;EAC5E;EACA,MAAM,OAAO,MAAM;EACnB,UAAU,SAAS,IAAI,IAAI;EAC3B,aAAa,cAAc,MAAM;CACnC,EAAE;CACF,OAAO,CACL,GAAG,OAAO,QAAQ,UAAU,MAAM,QAAQ,GAC1C,GAAG,OAAO,QAAQ,UAAU,CAAC,MAAM,QAAQ,CAC7C;AACF;AAEA,MAAM,wBAAgD;CACpD;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,SAAgB,eAA6B;CAC3C,OAAO;EACL,cAAc;EACd,QAAQ,cAAc,KAAK,UAAU;GACnC,MAAM,CAAC,WAAW,OAAO,SAAS,MAAM,MAAM,MAAM,GAAG;GACvD,OAAO;IACL;IACA;IACA;IACA,YAAY,iBAAiB;IAC7B,OAAO,YAAY,QAAQ,SAAS,eAAe,MAAM,KAAK,CAAC;IAC/D,SAAS,cAAc,KAAK,KAAK,sBAAsB,SAAS,KAAK;GACvE;EACF,CAAC;EACD,OAAO,MAAM,KAAK,UAAU;GAC1B,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,aAAa,KAAK;GAClB,UAAU,KAAK,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK;GAC3C,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,YAAY,KAAK;GACjB,WAAW,KAAK;GAChB,QAAQ,SAAS,IAAI;EACvB,EAAE;CACJ;AACF"}

package/dist/http/mcp/challenge.d.ts

@@ -0,0 +1,7 @@
+import { McpEndpoints } from "../../app/mcp-endpoints.js";
+//#region src/http/mcp/challenge.d.ts
+declare function unauthorized(mcp: McpEndpoints): Response;
+declare function forbidden(): Response;
+//#endregion
+export { forbidden, unauthorized };
+//# sourceMappingURL=challenge.d.ts.map

package/dist/http/mcp/challenge.js

@@ -0,0 +1,35 @@
+import { ACCESS_SCOPES } from "@headless-lms/core/organizations";
+//#region src/http/mcp/challenge.ts
+function unauthorized(mcp) {
+	return new Response(JSON.stringify({
+		jsonrpc: "2.0",
+		error: {
+			code: -32e3,
+			message: "Unauthorized"
+		},
+		id: null
+	}), {
+		status: 401,
+		headers: {
+			"content-type": "application/json",
+			"www-authenticate": `Bearer resource_metadata="${mcp.resourceMetadataUrl}", scope="${ACCESS_SCOPES.join(" ")}"`
+		}
+	});
+}
+function forbidden() {
+	return new Response(JSON.stringify({
+		jsonrpc: "2.0",
+		error: {
+			code: -32e3,
+			message: "Only staff of this organization can use this server"
+		},
+		id: null
+	}), {
+		status: 403,
+		headers: { "content-type": "application/json" }
+	});
+}
+//#endregion
+export { forbidden, unauthorized };
+
+//# sourceMappingURL=challenge.js.map

package/dist/http/mcp/challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.js","names":[],"sources":["../../../src/http/mcp/challenge.ts"],"sourcesContent":["import { ACCESS_SCOPES } from '@headless-lms/core/organizations';\nimport type { McpEndpoints } from '../../app/mcp-endpoints.js';\n\nexport function unauthorized(mcp: McpEndpoints): Response {\n  const body = { jsonrpc: '2.0', error: { code: -32000, message: 'Unauthorized' }, id: null };\n  return new Response(JSON.stringify(body), {\n    status: 401,\n    headers: {\n      'content-type': 'application/json',\n      'www-authenticate': `Bearer resource_metadata=\"${mcp.resourceMetadataUrl}\", scope=\"${ACCESS_SCOPES.join(' ')}\"`,\n    },\n  });\n}\n\nexport function forbidden(): Response {\n  const body = {\n    jsonrpc: '2.0',\n    error: { code: -32000, message: 'Only staff of this organization can use this server' },\n    id: null,\n  };\n  return new Response(JSON.stringify(body), {\n    status: 403,\n    headers: { 'content-type': 'application/json' },\n  });\n}\n"],"mappings":";;AAGA,SAAgB,aAAa,KAA6B;CAExD,OAAO,IAAI,SAAS,KAAK,UAAU;EADpB,SAAS;EAAO,OAAO;GAAE,MAAM;GAAQ,SAAS;EAAe;EAAG,IAAI;CAC/C,CAAC,GAAG;EACxC,QAAQ;EACR,SAAS;GACP,gBAAgB;GAChB,oBAAoB,6BAA6B,IAAI,oBAAoB,YAAY,cAAc,KAAK,GAAG,EAAE;EAC/G;CACF,CAAC;AACH;AAEA,SAAgB,YAAsB;CAMpC,OAAO,IAAI,SAAS,KAAK,UAAU;EAJjC,SAAS;EACT,OAAO;GAAE,MAAM;GAAQ,SAAS;EAAsD;EACtF,IAAI;CAEgC,CAAC,GAAG;EACxC,QAAQ;EACR,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;AACH"}

package/dist/http/mcp/input-schema.d.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+import { StandardSchemaWithJSON } from "@modelcontextprotocol/server";
+//#region src/http/mcp/input-schema.d.ts
+declare function toolInputSchema(schema: z.ZodObject): StandardSchemaWithJSON<unknown, unknown>;
+//#endregion
+export { toolInputSchema };
+//# sourceMappingURL=input-schema.d.ts.map

package/dist/http/mcp/input-schema.js

@@ -0,0 +1,28 @@
+import { z } from "zod";
+//#region src/http/mcp/input-schema.ts
+function toolInputSchema(schema) {
+	const json = z.toJSONSchema(schema, {
+		io: "input",
+		target: "draft-2020-12",
+		unrepresentable: "any",
+		override: (ctx) => {
+			if (ctx.zodSchema._zod.def.type === "date") {
+				ctx.jsonSchema.type = "string";
+				ctx.jsonSchema.format = "date-time";
+			}
+		}
+	});
+	return { "~standard": {
+		version: 1,
+		vendor: "zod",
+		validate: (value) => ({ value }),
+		jsonSchema: {
+			input: () => json,
+			output: () => json
+		}
+	} };
+}
+//#endregion
+export { toolInputSchema };
+
+//# sourceMappingURL=input-schema.js.map

package/dist/http/mcp/input-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-schema.js","names":[],"sources":["../../../src/http/mcp/input-schema.ts"],"sourcesContent":["import { z } from 'zod';\nimport type { StandardSchemaWithJSON } from '@modelcontextprotocol/server';\n\nexport function toolInputSchema(schema: z.ZodObject): StandardSchemaWithJSON<unknown, unknown> {\n  const json = z.toJSONSchema(schema, {\n    io: 'input',\n    target: 'draft-2020-12',\n    unrepresentable: 'any',\n    override: (ctx) => {\n      if (ctx.zodSchema._zod.def.type === 'date') {\n        ctx.jsonSchema.type = 'string';\n        ctx.jsonSchema.format = 'date-time';\n      }\n    },\n  }) as Record<string, unknown>;\n  return {\n    '~standard': {\n      version: 1,\n      vendor: 'zod',\n      validate: (value: unknown) => ({ value }),\n      jsonSchema: { input: () => json, output: () => json },\n    },\n  } as StandardSchemaWithJSON<unknown, unknown>;\n}\n"],"mappings":";;AAGA,SAAgB,gBAAgB,QAA+D;CAC7F,MAAM,OAAO,EAAE,aAAa,QAAQ;EAClC,IAAI;EACJ,QAAQ;EACR,iBAAiB;EACjB,WAAW,QAAQ;GACjB,IAAI,IAAI,UAAU,KAAK,IAAI,SAAS,QAAQ;IAC1C,IAAI,WAAW,OAAO;IACtB,IAAI,WAAW,SAAS;GAC1B;EACF;CACF,CAAC;CACD,OAAO,EACL,aAAa;EACX,SAAS;EACT,QAAQ;EACR,WAAW,WAAoB,EAAE,MAAM;EACvC,YAAY;GAAE,aAAa;GAAM,cAAc;EAAK;CACtD,EACF;AACF"}

package/dist/http/mcp/route.d.ts

@@ -0,0 +1,8 @@
+import { Container } from "../../app/container.js";
+import { Tool } from "./tool.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/mcp/route.d.ts
+declare function registerMcp(app: FastifyInstance, container: Container, tools?: readonly Tool[]): void;
+//#endregion
+export { registerMcp };
+//# sourceMappingURL=route.d.ts.map