@headless-lms/server 0.2.0 → 0.3.0

package/dist/http/schemas/posts.js

@@ -0,0 +1,47 @@
+import { DateTimeInput, PageQuery, paginated } from "./shared.js";
+import { CommentView } from "./discussion.js";
+import { z } from "zod";
+import { boundedJsonSchema, flaggedCommentSchema, idSchema, postFlagResolutionSchema, postFlagSchema, postViewSchema } from "@headless-lms/core/schemas";
+//#region src/http/schemas/posts.ts
+const PostView = postViewSchema;
+const PostFlag = postFlagSchema;
+const PostFeedPage = paginated(PostView);
+const PostIdParam = z.object({ postId: z.string() });
+const FeedQuery = PageQuery.extend({ topicId: z.string().optional().describe("Only posts under this topic") }).strict();
+const PostTitle = z.string().trim().min(1).max(200);
+const PostBody = z.string().max(5e4);
+const PostExtra = boundedJsonSchema(16 * 1024);
+const CreatePost = z.object({
+	title: PostTitle,
+	body: PostBody,
+	topicId: idSchema.nullable().describe("One of the space's topics. Required when the space has topics, else null"),
+	extra: PostExtra.default({}),
+	coverAssetId: idSchema.nullable().describe("A finalized image you uploaded through `requestMemberUpload`"),
+	mode: z.enum([
+		"draft",
+		"submit",
+		"schedule"
+	]).describe("`draft` keeps the post to yourself. `submit` publishes it, or holds it for review when the space requires review and you are not staff. `schedule` submits it at `scheduledAt`."),
+	scheduledAt: DateTimeInput.nullable().describe("When a scheduled post is submitted. Required, and in the future, when `mode` is `schedule`; ignored otherwise.")
+}).strict();
+const UpdatePost = z.object({
+	title: PostTitle.optional(),
+	body: PostBody.optional(),
+	topicId: idSchema.nullable().optional(),
+	extra: PostExtra.optional(),
+	coverAssetId: idSchema.nullable().optional()
+}).strict();
+const SchedulePost = z.object({ scheduledAt: DateTimeInput.describe("When the post is submitted; must be in the future") }).strict();
+const SetPostReactions = z.object({ enabled: z.boolean().describe("Whether readers may react to this post") }).strict();
+const FlagReason = z.object({ reason: z.string().trim().min(1).max(1e3) }).strict();
+const ResolvePostFlags = z.object({ resolution: postFlagResolutionSchema.extract(["dismissed"]).describe("`dismissed` closes the open flags and leaves the post up. Removing the post resolves its flags as `removed` instead.") }).strict();
+const SpaceQueue = z.object({
+	pending: z.array(PostView),
+	flags: z.array(PostFlag),
+	commentFlags: z.array(flaggedCommentSchema)
+});
+const PostCommentsPage = paginated(CommentView);
+//#endregion
+export { CreatePost, FeedQuery, FlagReason, PostCommentsPage, PostFeedPage, PostFlag, PostIdParam, PostView, ResolvePostFlags, SchedulePost, SetPostReactions, SpaceQueue, UpdatePost };
+
+//# sourceMappingURL=posts.js.map

package/dist/http/schemas/posts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"posts.js","names":[],"sources":["../../../src/http/schemas/posts.ts"],"sourcesContent":["import { z } from 'zod';\nimport {\n  boundedJsonSchema,\n  flaggedCommentSchema,\n  idSchema,\n  postFlagResolutionSchema,\n  postFlagSchema,\n  postViewSchema,\n} from '@headless-lms/core/schemas';\nimport { CommentView } from './discussion.js';\nimport { DateTimeInput, PageQuery, paginated } from './shared.js';\n\nexport const PostView = postViewSchema;\nexport const PostFlag = postFlagSchema;\nexport const PostFeedPage = paginated(PostView);\nexport const PostIdParam = z.object({ postId: z.string() });\nexport const FeedQuery = PageQuery.extend({\n  topicId: z.string().optional().describe('Only posts under this topic'),\n}).strict();\n\nconst PostTitle = z.string().trim().min(1).max(200);\nconst PostBody = z.string().max(50_000);\nconst PostExtra = boundedJsonSchema(16 * 1024);\n\nexport const CreatePost = z\n  .object({\n    title: PostTitle,\n    body: PostBody,\n    topicId: idSchema\n      .nullable()\n      .describe(\"One of the space's topics. Required when the space has topics, else null\"),\n    extra: PostExtra.default({}),\n    coverAssetId: idSchema\n      .nullable()\n      .describe('A finalized image you uploaded through `requestMemberUpload`'),\n    mode: z\n      .enum(['draft', 'submit', 'schedule'])\n      .describe(\n        '`draft` keeps the post to yourself. `submit` publishes it, or holds it for review when the space requires review and you are not staff. `schedule` submits it at `scheduledAt`.',\n      ),\n    scheduledAt: DateTimeInput.nullable().describe(\n      'When a scheduled post is submitted. Required, and in the future, when `mode` is `schedule`; ignored otherwise.',\n    ),\n  })\n  .strict();\n\nexport const UpdatePost = z\n  .object({\n    title: PostTitle.optional(),\n    body: PostBody.optional(),\n    topicId: idSchema.nullable().optional(),\n    extra: PostExtra.optional(),\n    coverAssetId: idSchema.nullable().optional(),\n  })\n  .strict();\n\nexport const SchedulePost = z\n  .object({\n    scheduledAt: DateTimeInput.describe('When the post is submitted; must be in the future'),\n  })\n  .strict();\nexport const SetPostReactions = z\n  .object({ enabled: z.boolean().describe('Whether readers may react to this post') })\n  .strict();\nexport const FlagReason = z.object({ reason: z.string().trim().min(1).max(1_000) }).strict();\nexport const ResolvePostFlags = z\n  .object({\n    resolution: postFlagResolutionSchema\n      .extract(['dismissed'])\n      .describe(\n        '`dismissed` closes the open flags and leaves the post up. Removing the post resolves its flags as `removed` instead.',\n      ),\n  })\n  .strict();\n\nexport const SpaceQueue = z.object({\n  pending: z.array(PostView),\n  flags: z.array(PostFlag),\n  commentFlags: z.array(flaggedCommentSchema),\n});\n\nexport const PostCommentsPage = paginated(CommentView);\n"],"mappings":";;;;;AAYA,MAAa,WAAW;AACxB,MAAa,WAAW;AACxB,MAAa,eAAe,UAAU,QAAQ;AAC9C,MAAa,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC1D,MAAa,YAAY,UAAU,OAAO,EACxC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,6BAA6B,EACvE,CAAC,CAAC,CAAC,OAAO;AAEV,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AAClD,MAAM,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,GAAM;AACtC,MAAM,YAAY,kBAAkB,KAAK,IAAI;AAE7C,MAAa,aAAa,EACvB,OAAO;CACN,OAAO;CACP,MAAM;CACN,SAAS,SACN,SAAS,CAAC,CACV,SAAS,0EAA0E;CACtF,OAAO,UAAU,QAAQ,CAAC,CAAC;CAC3B,cAAc,SACX,SAAS,CAAC,CACV,SAAS,8DAA8D;CAC1E,MAAM,EACH,KAAK;EAAC;EAAS;EAAU;CAAU,CAAC,CAAC,CACrC,SACC,iLACF;CACF,aAAa,cAAc,SAAS,CAAC,CAAC,SACpC,gHACF;AACF,CAAC,CAAC,CACD,OAAO;AAEV,MAAa,aAAa,EACvB,OAAO;CACN,OAAO,UAAU,SAAS;CAC1B,MAAM,SAAS,SAAS;CACxB,SAAS,SAAS,SAAS,CAAC,CAAC,SAAS;CACtC,OAAO,UAAU,SAAS;CAC1B,cAAc,SAAS,SAAS,CAAC,CAAC,SAAS;AAC7C,CAAC,CAAC,CACD,OAAO;AAEV,MAAa,eAAe,EACzB,OAAO,EACN,aAAa,cAAc,SAAS,mDAAmD,EACzF,CAAC,CAAC,CACD,OAAO;AACV,MAAa,mBAAmB,EAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,wCAAwC,EAAE,CAAC,CAAC,CACnF,OAAO;AACV,MAAa,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAK,EAAE,CAAC,CAAC,CAAC,OAAO;AAC3F,MAAa,mBAAmB,EAC7B,OAAO,EACN,YAAY,yBACT,QAAQ,CAAC,WAAW,CAAC,CAAC,CACtB,SACC,sHACF,EACJ,CAAC,CAAC,CACD,OAAO;AAEV,MAAa,aAAa,EAAE,OAAO;CACjC,SAAS,EAAE,MAAM,QAAQ;CACzB,OAAO,EAAE,MAAM,QAAQ;CACvB,cAAc,EAAE,MAAM,oBAAoB;AAC5C,CAAC;AAED,MAAa,mBAAmB,UAAU,WAAW"}

package/dist/http/schemas/profile.d.ts

@@ -0,0 +1,23 @@
+import { z } from "zod";
+//#region src/http/schemas/profile.d.ts
+declare const UserProfile: z.ZodObject<{
+  createdAt: z.ZodCoercedDate<unknown>;
+  updatedAt: z.ZodCoercedDate<unknown>;
+  displayName: z.ZodNullable<z.ZodString>;
+  headline: z.ZodNullable<z.ZodString>;
+  imageAssetId: z.ZodNullable<z.ZodString>;
+  imageUrl: z.ZodNullable<z.ZodString>;
+  bio: z.ZodNullable<z.ZodString>;
+  userId: z.ZodString;
+  extra: z.ZodType<import("@headless-lms/core/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("@headless-lms/core/types").JsonValue, unknown>>;
+}, z.core.$strip>;
+declare const UpdateProfile: z.ZodObject<{
+  displayName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  headline: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  bio: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  imageAssetId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  extra: z.ZodOptional<z.ZodType<import("@headless-lms/core/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("@headless-lms/core/types").JsonValue, unknown>>>;
+}, z.core.$strict>;
+//#endregion
+export { UpdateProfile, UserProfile };
+//# sourceMappingURL=profile.d.ts.map

package/dist/http/schemas/profile.js

@@ -0,0 +1,15 @@
+import { z } from "zod";
+import { boundedJsonSchema, idSchema, userProfileViewSchema } from "@headless-lms/core/schemas";
+//#region src/http/schemas/profile.ts
+const UserProfile = userProfileViewSchema.omit({ imageAssetOrgId: true }).strip();
+const UpdateProfile = z.object({
+	displayName: z.string().trim().max(80).nullable().optional(),
+	headline: z.string().trim().max(160).nullable().optional(),
+	bio: z.string().trim().max(2e3).nullable().optional(),
+	imageAssetId: idSchema.nullable().optional().describe("A finalized image you uploaded through `requestMemberUpload`; null clears it"),
+	extra: boundedJsonSchema(16 * 1024).optional()
+}).strict();
+//#endregion
+export { UpdateProfile, UserProfile };
+
+//# sourceMappingURL=profile.js.map

package/dist/http/schemas/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","names":[],"sources":["../../../src/http/schemas/profile.ts"],"sourcesContent":["import { z } from 'zod';\nimport { boundedJsonSchema, idSchema, userProfileViewSchema } from '@headless-lms/core/schemas';\n\nexport const UserProfile = userProfileViewSchema.omit({ imageAssetOrgId: true }).strip();\nexport const UpdateProfile = z\n  .object({\n    displayName: z.string().trim().max(80).nullable().optional(),\n    headline: z.string().trim().max(160).nullable().optional(),\n    bio: z.string().trim().max(2_000).nullable().optional(),\n    imageAssetId: idSchema\n      .nullable()\n      .optional()\n      .describe('A finalized image you uploaded through `requestMemberUpload`; null clears it'),\n    extra: boundedJsonSchema(16 * 1024).optional(),\n  })\n  .strict();\n"],"mappings":";;;AAGA,MAAa,cAAc,sBAAsB,KAAK,EAAE,iBAAiB,KAAK,CAAC,CAAC,CAAC,MAAM;AACvF,MAAa,gBAAgB,EAC1B,OAAO;CACN,aAAa,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAC3D,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CACzD,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAK,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CACtD,cAAc,SACX,SAAS,CAAC,CACV,SAAS,CAAC,CACV,SAAS,8EAA8E;CAC1F,OAAO,kBAAkB,KAAK,IAAI,CAAC,CAAC,SAAS;AAC/C,CAAC,CAAC,CACD,OAAO"}

package/dist/http/schemas/shared.d.ts

@@ -9,6 +9,29 @@ declare const ErrorBody: z.ZodObject<{
   requestId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type ErrorBody = z.infer<typeof ErrorBody>;
+/** A 400 from request validation: `message` names the first problem, `issues` lists them all. */
+declare const ValidationErrorBody: z.ZodObject<{
+  error: z.ZodString;
+  message: z.ZodOptional<z.ZodString>;
+  requestId: z.ZodOptional<z.ZodString>;
+  issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+    path: z.ZodString;
+    message: z.ZodString;
+  }, z.core.$strip>>>;
+}, z.core.$strip>;
+type ValidationErrorBody = z.infer<typeof ValidationErrorBody>;
+type RefusalStatus = 400 | 403 | 404 | 409 | 413 | 415 | 502;
+type RefusalBodies<S extends RefusalStatus> = { [K in S]: K extends 400 ? typeof ValidationErrorBody : typeof ErrorBody; };
+/** Response schemas for the refusals a route can answer. A 400 keeps the validation `issues`. */
+declare function refusals<S extends RefusalStatus>(...statuses: S[]): RefusalBodies<S>;
+/** An RFC 3339 date-time in a request, such as `2026-10-29T12:00:00Z`, read as a Date. */
+declare const DateTimeInput: z.ZodPipe<z.ZodISODateTime, z.ZodCoercedDate<string>>;
+/** Page position only, for lists that take no search or sort. */
+declare const PageQuery: z.ZodObject<{
+  page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+  pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strict>;
+type PageQuery = z.infer<typeof PageQuery>;
 /**
  * Common list query for page-based collections. `z.coerce` because query-string
  * values arrive as strings; defaults make the params optional for callers.
@@ -33,6 +56,7 @@ declare const OrgRole: z.ZodEnum<{
   owner: "owner";
   admin: "admin";
   instructor: "instructor";
+  moderator: "moderator";
   student: "student";
 }>;
 type OrgRole = z.infer<typeof OrgRole>;
@@ -54,5 +78,5 @@ declare const OrgUserProfileSchema: z.ZodObject<{
 }, z.core.$strip>;
 type OrgUserProfileSchema = z.infer<typeof OrgUserProfileSchema>;
 //#endregion
-export { ErrorBody, ListQuery, Matches, OrgRole, OrgUserProfileSchema, UserProfileSchema, paginated };
+export { DateTimeInput, ErrorBody, ListQuery, Matches, OrgRole, OrgUserProfileSchema, PageQuery, UserProfileSchema, ValidationErrorBody, paginated, refusals };
 //# sourceMappingURL=shared.d.ts.map

package/dist/http/schemas/shared.js

@@ -7,6 +7,22 @@ const ErrorBody = z.object({
 	/** Server-side correlation id — quote it to find the matching API log line. */
 	requestId: z.string().optional()
 });
+/** A 400 from request validation: `message` names the first problem, `issues` lists them all. */
+const ValidationErrorBody = ErrorBody.extend({ issues: z.array(z.object({
+	path: z.string().describe("Where in the request, such as `body.topics[1].name`"),
+	message: z.string()
+})).optional() });
+/** Response schemas for the refusals a route can answer. A 400 keeps the validation `issues`. */
+function refusals(...statuses) {
+	return Object.fromEntries(statuses.map((status) => [status, status === 400 ? ValidationErrorBody : ErrorBody]));
+}
+/** An RFC 3339 date-time in a request, such as `2026-10-29T12:00:00Z`, read as a Date. */
+const DateTimeInput = z.iso.datetime({ offset: true }).pipe(z.coerce.date());
+/** Page position only, for lists that take no search or sort. */
+const PageQuery = z.object({
+	page: z.coerce.number().int().min(1).default(1),
+	pageSize: z.coerce.number().int().min(1).max(100).default(20)
+}).strict();
 /**
 * Common list query for page-based collections. `z.coerce` because query-string
 * values arrive as strings; defaults make the params optional for callers.
@@ -14,7 +30,7 @@ const ErrorBody = z.object({
 const ListQuery = z.object({
 	page: z.coerce.number().int().min(1).default(1),
 	pageSize: z.coerce.number().int().min(1).max(100).default(20),
-	search: z.string().trim().optional(),
+	search: z.string().trim().max(200).optional(),
 	/** Sort field, optionally prefixed with `-` for descending (e.g. `-updatedAt`). */
 	sort: z.string().optional()
 });
@@ -33,6 +49,7 @@ const OrgRole = z.enum([
 	"owner",
 	"admin",
 	"instructor",
+	"moderator",
 	"student"
 ]);
 /** Mirrors UserProfile in @headless-lms/core/types — keyed on the auth user id. */
@@ -51,6 +68,6 @@ const OrgUserProfileSchema = z.object({
 	image: z.string().nullable()
 });
 //#endregion
-export { ErrorBody, ListQuery, OrgRole, OrgUserProfileSchema, UserProfileSchema, paginated };
+export { DateTimeInput, ErrorBody, ListQuery, OrgRole, OrgUserProfileSchema, PageQuery, UserProfileSchema, ValidationErrorBody, paginated, refusals };
 
 //# sourceMappingURL=shared.js.map

package/dist/http/schemas/shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared.js","names":[],"sources":["../../../src/http/schemas/shared.ts"],"sourcesContent":["// Shared contract primitives reused across resource contracts.\nimport { z } from 'zod';\n\n/** Fails typecheck when a schema and its domain type drift apart. */\nexport type Matches<A, _B extends A> = true;\n\n/** Uniform error envelope returned by every non-2xx response. */\nexport const ErrorBody = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  /** Server-side correlation id — quote it to find the matching API log line. */\n  requestId: z.string().optional(),\n});\nexport type ErrorBody = z.infer<typeof ErrorBody>;\n\n/**\n * Common list query for page-based collections. `z.coerce` because query-string\n * values arrive as strings; defaults make the params optional for callers.\n */\nexport const ListQuery = z.object({\n  page: z.coerce.number().int().min(1).default(1),\n  pageSize: z.coerce.number().int().min(1).max(100).default(20),\n  search: z.string().trim().optional(),\n  /** Sort field, optionally prefixed with `-` for descending (e.g. `-updatedAt`). */\n  sort: z.string().optional(),\n});\nexport type ListQuery = z.infer<typeof ListQuery>;\n\n/** Wrap a row schema into the standard paginated envelope. */\nexport function paginated<T extends z.ZodTypeAny>(row: T) {\n  return z.object({\n    rows: z.array(row),\n    total: z.number().int(),\n    page: z.number().int(),\n    pageSize: z.number().int(),\n  });\n}\n\n/** All four org roles. `members.ts` exports a staff-only three-value `Role`;\n *  this is the full set, used wherever a learner can also appear. */\nexport const OrgRole = z.enum(['owner', 'admin', 'instructor', 'student']);\nexport type OrgRole = z.infer<typeof OrgRole>;\n\n/** Mirrors UserProfile in @headless-lms/core/types — keyed on the auth user id. */\nexport const UserProfileSchema = z.object({\n  id: z.string(),\n  name: z.string(),\n  email: z.string(),\n  image: z.string().nullable(),\n});\nexport type UserProfileSchema = z.infer<typeof UserProfileSchema>;\n\n/** Mirrors OrgUserProfile in @headless-lms/core/types — keyed on org_users.id. */\nexport const OrgUserProfileSchema = z.object({\n  id: z.string(),\n  firstName: z.string().nullable(),\n  lastName: z.string().nullable(),\n  email: z.string(),\n  image: z.string().nullable(),\n});\nexport type OrgUserProfileSchema = z.infer<typeof OrgUserProfileSchema>;\n"],"mappings":";;;AAOA,MAAa,YAAY,EAAE,OAAO;CAChC,OAAO,EAAE,OAAO;CAChB,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC;;;;;AAOD,MAAa,YAAY,EAAE,OAAO;CAChC,MAAM,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;CAC9C,UAAU,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5D,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;;CAEnC,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;AAC5B,CAAC;;AAID,SAAgB,UAAkC,KAAQ;CACxD,OAAO,EAAE,OAAO;EACd,MAAM,EAAE,MAAM,GAAG;EACjB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI;EACtB,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI;EACrB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CAC3B,CAAC;AACH;;;AAIA,MAAa,UAAU,EAAE,KAAK;CAAC;CAAS;CAAS;CAAc;AAAS,CAAC;;AAIzE,MAAa,oBAAoB,EAAE,OAAO;CACxC,IAAI,EAAE,OAAO;CACb,MAAM,EAAE,OAAO;CACf,OAAO,EAAE,OAAO;CAChB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;AAC7B,CAAC;;AAID,MAAa,uBAAuB,EAAE,OAAO;CAC3C,IAAI,EAAE,OAAO;CACb,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,OAAO,EAAE,OAAO;CAChB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;AAC7B,CAAC"}
+{"version":3,"file":"shared.js","names":[],"sources":["../../../src/http/schemas/shared.ts"],"sourcesContent":["// Shared contract primitives reused across resource contracts.\nimport { z } from 'zod';\n\n/** Fails typecheck when a schema and its domain type drift apart. */\nexport type Matches<A, _B extends A> = true;\n\n/** Uniform error envelope returned by every non-2xx response. */\nexport const ErrorBody = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  /** Server-side correlation id — quote it to find the matching API log line. */\n  requestId: z.string().optional(),\n});\nexport type ErrorBody = z.infer<typeof ErrorBody>;\n\n/** A 400 from request validation: `message` names the first problem, `issues` lists them all. */\nexport const ValidationErrorBody = ErrorBody.extend({\n  issues: z\n    .array(\n      z.object({\n        path: z.string().describe('Where in the request, such as `body.topics[1].name`'),\n        message: z.string(),\n      }),\n    )\n    .optional(),\n});\nexport type ValidationErrorBody = z.infer<typeof ValidationErrorBody>;\n\ntype RefusalStatus = 400 | 403 | 404 | 409 | 413 | 415 | 502;\ntype RefusalBodies<S extends RefusalStatus> = {\n  [K in S]: K extends 400 ? typeof ValidationErrorBody : typeof ErrorBody;\n};\n\n/** Response schemas for the refusals a route can answer. A 400 keeps the validation `issues`. */\nexport function refusals<S extends RefusalStatus>(...statuses: S[]): RefusalBodies<S> {\n  return Object.fromEntries(\n    statuses.map((status) => [status, status === 400 ? ValidationErrorBody : ErrorBody]),\n  ) as RefusalBodies<S>;\n}\n\n/** An RFC 3339 date-time in a request, such as `2026-10-29T12:00:00Z`, read as a Date. */\nexport const DateTimeInput = z.iso.datetime({ offset: true }).pipe(z.coerce.date());\n\n/** Page position only, for lists that take no search or sort. */\nexport const PageQuery = z\n  .object({\n    page: z.coerce.number().int().min(1).default(1),\n    pageSize: z.coerce.number().int().min(1).max(100).default(20),\n  })\n  .strict();\nexport type PageQuery = z.infer<typeof PageQuery>;\n\n/**\n * Common list query for page-based collections. `z.coerce` because query-string\n * values arrive as strings; defaults make the params optional for callers.\n */\nexport const ListQuery = z.object({\n  page: z.coerce.number().int().min(1).default(1),\n  pageSize: z.coerce.number().int().min(1).max(100).default(20),\n  search: z.string().trim().max(200).optional(),\n  /** Sort field, optionally prefixed with `-` for descending (e.g. `-updatedAt`). */\n  sort: z.string().optional(),\n});\nexport type ListQuery = z.infer<typeof ListQuery>;\n\n/** Wrap a row schema into the standard paginated envelope. */\nexport function paginated<T extends z.ZodTypeAny>(row: T) {\n  return z.object({\n    rows: z.array(row),\n    total: z.number().int(),\n    page: z.number().int(),\n    pageSize: z.number().int(),\n  });\n}\n\n/** All four org roles. `members.ts` exports a staff-only three-value `Role`;\n *  this is the full set, used wherever a learner can also appear. */\nexport const OrgRole = z.enum(['owner', 'admin', 'instructor', 'moderator', 'student']);\nexport type OrgRole = z.infer<typeof OrgRole>;\n\n/** Mirrors UserProfile in @headless-lms/core/types — keyed on the auth user id. */\nexport const UserProfileSchema = z.object({\n  id: z.string(),\n  name: z.string(),\n  email: z.string(),\n  image: z.string().nullable(),\n});\nexport type UserProfileSchema = z.infer<typeof UserProfileSchema>;\n\n/** Mirrors OrgUserProfile in @headless-lms/core/types — keyed on org_users.id. */\nexport const OrgUserProfileSchema = z.object({\n  id: z.string(),\n  firstName: z.string().nullable(),\n  lastName: z.string().nullable(),\n  email: z.string(),\n  image: z.string().nullable(),\n});\nexport type OrgUserProfileSchema = z.infer<typeof OrgUserProfileSchema>;\n"],"mappings":";;;AAOA,MAAa,YAAY,EAAE,OAAO;CAChC,OAAO,EAAE,OAAO;CAChB,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC;;AAID,MAAa,sBAAsB,UAAU,OAAO,EAClD,QAAQ,EACL,MACC,EAAE,OAAO;CACP,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,qDAAqD;CAC/E,SAAS,EAAE,OAAO;AACpB,CAAC,CACH,CAAC,CACA,SAAS,EACd,CAAC;;AASD,SAAgB,SAAkC,GAAG,UAAiC;CACpF,OAAO,OAAO,YACZ,SAAS,KAAK,WAAW,CAAC,QAAQ,WAAW,MAAM,sBAAsB,SAAS,CAAC,CACrF;AACF;;AAGA,MAAa,gBAAgB,EAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;;AAGlF,MAAa,YAAY,EACtB,OAAO;CACN,MAAM,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;CAC9C,UAAU,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC9D,CAAC,CAAC,CACD,OAAO;;;;;AAOV,MAAa,YAAY,EAAE,OAAO;CAChC,MAAM,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;CAC9C,UAAU,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5D,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;;CAE5C,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;AAC5B,CAAC;;AAID,SAAgB,UAAkC,KAAQ;CACxD,OAAO,EAAE,OAAO;EACd,MAAM,EAAE,MAAM,GAAG;EACjB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI;EACtB,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI;EACrB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CAC3B,CAAC;AACH;;;AAIA,MAAa,UAAU,EAAE,KAAK;CAAC;CAAS;CAAS;CAAc;CAAa;AAAS,CAAC;;AAItF,MAAa,oBAAoB,EAAE,OAAO;CACxC,IAAI,EAAE,OAAO;CACb,MAAM,EAAE,OAAO;CACf,OAAO,EAAE,OAAO;CAChB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;AAC7B,CAAC;;AAID,MAAa,uBAAuB,EAAE,OAAO;CAC3C,IAAI,EAAE,OAAO;CACb,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,OAAO,EAAE,OAAO;CAChB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;AAC7B,CAAC"}

package/dist/http/schemas/students.d.ts

@@ -1,8 +1,8 @@
 import { z } from "zod";
 //#region src/http/schemas/students.d.ts
 declare const OrgUserStatus: z.ZodEnum<{
-  active: "active";
   invited: "invited";
+  active: "active";
 }>;
 type OrgUserStatus = z.infer<typeof OrgUserStatus>;
 declare const Student: z.ZodObject<{
@@ -14,8 +14,8 @@ declare const Student: z.ZodObject<{
   entitlementCount: z.ZodNumber;
   avgProgress: z.ZodNumber;
   status: z.ZodEnum<{
-    active: "active";
     invited: "invited";
+    active: "active";
   }>;
   joinedAt: z.ZodString;
   lastActiveAt: z.ZodNullable<z.ZodString>;
@@ -66,8 +66,8 @@ declare const StudentsPage: z.ZodObject<{
     entitlementCount: z.ZodNumber;
     avgProgress: z.ZodNumber;
     status: z.ZodEnum<{
-      active: "active";
       invited: "invited";
+      active: "active";
     }>;
     joinedAt: z.ZodString;
     lastActiveAt: z.ZodNullable<z.ZodString>;
@@ -81,12 +81,6 @@ declare const StudentIdParam: z.ZodObject<{
   id: z.ZodString;
 }, z.core.$strip>;
 type StudentIdParam = z.infer<typeof StudentIdParam>;
-declare const UpdateStudentBody: z.ZodObject<{
-  firstName: z.ZodString;
-  lastName: z.ZodString;
-  email: z.ZodEmail;
-}, z.core.$strip>;
-type UpdateStudentBody = z.infer<typeof UpdateStudentBody>;
 //#endregion
-export { OrgUserStatus, Student, StudentAnalytics, StudentCourseProgress, StudentIdParam, StudentsPage, StudentsQuery, UpdateStudentBody };
+export { OrgUserStatus, Student, StudentAnalytics, StudentCourseProgress, StudentIdParam, StudentsPage, StudentsQuery };
 //# sourceMappingURL=students.d.ts.map

package/dist/http/schemas/students.js

@@ -1,6 +1,5 @@
 import { ListQuery, OrgUserProfileSchema, paginated } from "./shared.js";
 import { z } from "zod";
-import { emailSchema } from "@headless-lms/core/schemas";
 //#region src/http/schemas/students.ts
 const OrgUserStatus = z.enum(["invited", "active"]);
 const Student = OrgUserProfileSchema.extend({
@@ -33,12 +32,7 @@ const StudentAnalytics = z.object({
 const StudentsQuery = ListQuery;
 const StudentsPage = paginated(Student);
 const StudentIdParam = z.object({ id: z.string() });
-const UpdateStudentBody = z.object({
-	firstName: z.string().trim().min(1),
-	lastName: z.string().trim().min(1),
-	email: emailSchema
-});
 //#endregion
-export { OrgUserStatus, Student, StudentAnalytics, StudentCourseProgress, StudentIdParam, StudentsPage, StudentsQuery, UpdateStudentBody };
+export { OrgUserStatus, Student, StudentAnalytics, StudentCourseProgress, StudentIdParam, StudentsPage, StudentsQuery };
 
 //# sourceMappingURL=students.js.map

package/dist/http/schemas/students.js.map

@@ -1 +1 @@
-{"version":3,"file":"students.js","names":[],"sources":["../../../src/http/schemas/students.ts"],"sourcesContent":["// Students resource schemas.\nimport { z } from 'zod';\nimport { emailSchema } from '@headless-lms/core/schemas';\nimport { ListQuery, paginated, OrgUserProfileSchema } from './shared.js';\n\nexport const OrgUserStatus = z.enum(['invited', 'active']);\nexport type OrgUserStatus = z.infer<typeof OrgUserStatus>;\n\nexport const Student = OrgUserProfileSchema.extend({\n  entitlementCount: z.number().int(),\n  /** 0–100, averaged across active entitlements. */\n  avgProgress: z.number().int(),\n  /** `invited` means an admin added them and they have not accepted yet. */\n  status: OrgUserStatus,\n  joinedAt: z.string(),\n  lastActiveAt: z.string().nullable(),\n});\nexport type Student = z.infer<typeof Student>;\n\nexport const StudentCourseProgress = z.object({\n  courseId: z.string(),\n  title: z.string(),\n  totalActivities: z.number().int(),\n  completedActivities: z.number().int(),\n  /** 0–100, completed published activities over the course's total. */\n  progress: z.number().int(),\n  startedAt: z.string().nullable(),\n  lastActivityAt: z.string().nullable(),\n  completedAt: z.string().nullable(),\n});\nexport type StudentCourseProgress = z.infer<typeof StudentCourseProgress>;\n\nexport const StudentAnalytics = z.object({\n  enrolled: z.number().int(),\n  started: z.number().int(),\n  completed: z.number().int(),\n  avgProgress: z.number().int(),\n  courses: z.array(StudentCourseProgress),\n});\nexport type StudentAnalytics = z.infer<typeof StudentAnalytics>;\n\nexport const StudentsQuery = ListQuery;\nexport type StudentsQuery = z.infer<typeof StudentsQuery>;\n\nexport const StudentsPage = paginated(Student);\nexport type StudentsPage = z.infer<typeof StudentsPage>;\n\nexport const StudentIdParam = z.object({ id: z.string() });\nexport type StudentIdParam = z.infer<typeof StudentIdParam>;\n\n// Every field is a correction to what an admin typed, so all three are sent\n// together — the form edits the whole profile, not one attribute at a time.\nexport const UpdateStudentBody = z.object({\n  firstName: z.string().trim().min(1),\n  lastName: z.string().trim().min(1),\n  email: emailSchema,\n});\nexport type UpdateStudentBody = z.infer<typeof UpdateStudentBody>;\n"],"mappings":";;;;AAKA,MAAa,gBAAgB,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAGzD,MAAa,UAAU,qBAAqB,OAAO;CACjD,kBAAkB,EAAE,OAAO,CAAC,CAAC,IAAI;;CAEjC,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI;;CAE5B,QAAQ;CACR,UAAU,EAAE,OAAO;CACnB,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;AACpC,CAAC;AAGD,MAAa,wBAAwB,EAAE,OAAO;CAC5C,UAAU,EAAE,OAAO;CACnB,OAAO,EAAE,OAAO;CAChB,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI;CAChC,qBAAqB,EAAE,OAAO,CAAC,CAAC,IAAI;;CAEpC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CACzB,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,gBAAgB,EAAE,OAAO,CAAC,CAAC,SAAS;CACpC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC;AAGD,MAAa,mBAAmB,EAAE,OAAO;CACvC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CACzB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI;CACxB,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI;CAC1B,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI;CAC5B,SAAS,EAAE,MAAM,qBAAqB;AACxC,CAAC;AAGD,MAAa,gBAAgB;AAG7B,MAAa,eAAe,UAAU,OAAO;AAG7C,MAAa,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAKzD,MAAa,oBAAoB,EAAE,OAAO;CACxC,WAAW,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;CAClC,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;CACjC,OAAO;AACT,CAAC"}
+{"version":3,"file":"students.js","names":[],"sources":["../../../src/http/schemas/students.ts"],"sourcesContent":["// Students resource schemas.\nimport { z } from 'zod';\nimport { ListQuery, paginated, OrgUserProfileSchema } from './shared.js';\n\nexport const OrgUserStatus = z.enum(['invited', 'active']);\nexport type OrgUserStatus = z.infer<typeof OrgUserStatus>;\n\nexport const Student = OrgUserProfileSchema.extend({\n  entitlementCount: z.number().int(),\n  /** 0–100, averaged across active entitlements. */\n  avgProgress: z.number().int(),\n  /** `invited` means an admin added them and they have not accepted yet. */\n  status: OrgUserStatus,\n  joinedAt: z.string(),\n  lastActiveAt: z.string().nullable(),\n});\nexport type Student = z.infer<typeof Student>;\n\nexport const StudentCourseProgress = z.object({\n  courseId: z.string(),\n  title: z.string(),\n  totalActivities: z.number().int(),\n  completedActivities: z.number().int(),\n  /** 0–100, completed published activities over the course's total. */\n  progress: z.number().int(),\n  startedAt: z.string().nullable(),\n  lastActivityAt: z.string().nullable(),\n  completedAt: z.string().nullable(),\n});\nexport type StudentCourseProgress = z.infer<typeof StudentCourseProgress>;\n\nexport const StudentAnalytics = z.object({\n  enrolled: z.number().int(),\n  started: z.number().int(),\n  completed: z.number().int(),\n  avgProgress: z.number().int(),\n  courses: z.array(StudentCourseProgress),\n});\nexport type StudentAnalytics = z.infer<typeof StudentAnalytics>;\n\nexport const StudentsQuery = ListQuery;\nexport type StudentsQuery = z.infer<typeof StudentsQuery>;\n\nexport const StudentsPage = paginated(Student);\nexport type StudentsPage = z.infer<typeof StudentsPage>;\n\nexport const StudentIdParam = z.object({ id: z.string() });\nexport type StudentIdParam = z.infer<typeof StudentIdParam>;\n"],"mappings":";;;AAIA,MAAa,gBAAgB,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAGzD,MAAa,UAAU,qBAAqB,OAAO;CACjD,kBAAkB,EAAE,OAAO,CAAC,CAAC,IAAI;;CAEjC,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI;;CAE5B,QAAQ;CACR,UAAU,EAAE,OAAO;CACnB,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;AACpC,CAAC;AAGD,MAAa,wBAAwB,EAAE,OAAO;CAC5C,UAAU,EAAE,OAAO;CACnB,OAAO,EAAE,OAAO;CAChB,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI;CAChC,qBAAqB,EAAE,OAAO,CAAC,CAAC,IAAI;;CAEpC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CACzB,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,gBAAgB,EAAE,OAAO,CAAC,CAAC,SAAS;CACpC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC;AAGD,MAAa,mBAAmB,EAAE,OAAO;CACvC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CACzB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI;CACxB,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI;CAC1B,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI;CAC5B,SAAS,EAAE,MAAM,qBAAqB;AACxC,CAAC;AAGD,MAAa,gBAAgB;AAG7B,MAAa,eAAe,UAAU,OAAO;AAG7C,MAAa,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC"}

package/dist/http/scope.d.ts

@@ -17,6 +17,7 @@ interface OrgScope {
 /** Thrown when the session has no resolvable active org / domain user. */
 declare class NoActiveOrgError extends Error {}
 declare function resolveScope(container: Container, req: FastifyRequest): Promise<OrgScope>;
+declare function resolveScopeFor(container: Container, authUserId: string, authOrgId: string): Promise<OrgScope>;
 //#endregion
-export { NoActiveOrgError, OrgScope, resolveScope };
+export { NoActiveOrgError, OrgScope, resolveScope, resolveScopeFor };
 //# sourceMappingURL=scope.d.ts.map

package/dist/http/scope.js

@@ -5,11 +5,27 @@ var NoActiveOrgError = class extends Error {};
 async function resolveScope(container, req) {
 	const authUser = req.authUser;
 	const authOrgId = req.authOrgId ?? null;
-	if (!authUser) throw new NoActiveOrgError("no authenticated user");
-	if (!authOrgId || !req.orgId) throw new NoActiveOrgError("no active organization in session");
+	if (!authUser) throw new NoActiveOrgError("Sign in to continue");
+	if (!authOrgId || !req.orgId) throw new NoActiveOrgError("Choose an organization to continue");
 	const org = await container.organizations.getById(req.orgId);
-	if (!org) throw new NoActiveOrgError("active organization not found");
+	if (!org) throw new NoActiveOrgError("The active organization no longer exists");
 	const user = await container.identity.getUserByExternalId(authUser.id);
+	if (!user) throw new NoActiveOrgError("Your account is not set up yet");
+	const orgUser = await container.organizations.getOrgUser(org.id, user.id);
+	if (!orgUser || !isStaffRole(orgUser.role)) throw new NoActiveOrgError("Only staff of this organization can do this");
+	container.requestContext.set({ orgId: org.id });
+	return {
+		orgId: org.id,
+		userId: user.id,
+		orgUserId: orgUser.id,
+		role: orgUser.role,
+		authOrgId
+	};
+}
+async function resolveScopeFor(container, authUserId, authOrgId) {
+	const org = await container.organizations.getByExternalId(authOrgId);
+	if (!org) throw new NoActiveOrgError("active organization not found");
+	const user = await container.identity.getUserByExternalId(authUserId);
 	if (!user) throw new NoActiveOrgError("no domain user for the current user");
 	const orgUser = await container.organizations.getOrgUser(org.id, user.id);
 	if (!orgUser || !isStaffRole(orgUser.role)) throw new NoActiveOrgError("not a staff member of the active organization");
@@ -23,6 +39,6 @@ async function resolveScope(container, req) {
 	};
 }
 //#endregion
-export { NoActiveOrgError, resolveScope };
+export { NoActiveOrgError, resolveScope, resolveScopeFor };
 
 //# sourceMappingURL=scope.js.map

package/dist/http/scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope.js","names":[],"sources":["../../src/http/scope.ts"],"sourcesContent":["import type { FastifyRequest } from 'fastify';\nimport type { Container } from '../app/container.js';\nimport { isStaffRole, type StaffRole } from '@headless-lms/core/organizations';\n\nexport interface OrgScope {\n  /** Domain `organizations.id` for the session's active org. */\n  orgId: string;\n  /** Domain `users.id` of the acting person. */\n  userId: string;\n  /** Domain `org_users.id` — the acting org user in this org. */\n  orgUserId: string;\n  /** The role held in this org. */\n  role: StaffRole;\n  /** Better-auth organization id (for writes that go through the auth provider). */\n  authOrgId: string;\n}\n\n/** Thrown when the session has no resolvable active org / domain user. */\nexport class NoActiveOrgError extends Error {}\n\nexport async function resolveScope(container: Container, req: FastifyRequest): Promise<OrgScope> {\n  const authUser = req.authUser;\n  const authOrgId = req.authOrgId ?? null;\n  if (!authUser) {\n    throw new NoActiveOrgError('no authenticated user');\n  }\n  if (!authOrgId || !req.orgId) {\n    throw new NoActiveOrgError('no active organization in session');\n  }\n  // The session guard already translated the auth org id to the domain org.\n  const org = await container.organizations.getById(req.orgId);\n  if (!org) {\n    throw new NoActiveOrgError('active organization not found');\n  }\n  const user = await container.identity.getUserByExternalId(authUser.id);\n  if (!user) {\n    throw new NoActiveOrgError('no domain user for the current user');\n  }\n  const orgUser = await container.organizations.getOrgUser(org.id, user.id);\n  if (!orgUser || !isStaffRole(orgUser.role)) {\n    throw new NoActiveOrgError('not a staff member of the active organization');\n  }\n  container.requestContext.set({ orgId: org.id });\n  return {\n    orgId: org.id,\n    userId: user.id,\n    orgUserId: orgUser.id,\n    role: orgUser.role,\n    authOrgId,\n  };\n}\n"],"mappings":";;;AAkBA,IAAa,mBAAb,cAAsC,MAAM,CAAC;AAE7C,eAAsB,aAAa,WAAsB,KAAwC;CAC/F,MAAM,WAAW,IAAI;CACrB,MAAM,YAAY,IAAI,aAAa;CACnC,IAAI,CAAC,UACH,MAAM,IAAI,iBAAiB,uBAAuB;CAEpD,IAAI,CAAC,aAAa,CAAC,IAAI,OACrB,MAAM,IAAI,iBAAiB,mCAAmC;CAGhE,MAAM,MAAM,MAAM,UAAU,cAAc,QAAQ,IAAI,KAAK;CAC3D,IAAI,CAAC,KACH,MAAM,IAAI,iBAAiB,+BAA+B;CAE5D,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB,SAAS,EAAE;CACrE,IAAI,CAAC,MACH,MAAM,IAAI,iBAAiB,qCAAqC;CAElE,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,IAAI,KAAK,EAAE;CACxE,IAAI,CAAC,WAAW,CAAC,YAAY,QAAQ,IAAI,GACvC,MAAM,IAAI,iBAAiB,+CAA+C;CAE5E,UAAU,eAAe,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC;CAC9C,OAAO;EACL,OAAO,IAAI;EACX,QAAQ,KAAK;EACb,WAAW,QAAQ;EACnB,MAAM,QAAQ;EACd;CACF;AACF"}
+{"version":3,"file":"scope.js","names":[],"sources":["../../src/http/scope.ts"],"sourcesContent":["import type { FastifyRequest } from 'fastify';\nimport type { Container } from '../app/container.js';\nimport { isStaffRole, type StaffRole } from '@headless-lms/core/organizations';\n\nexport interface OrgScope {\n  /** Domain `organizations.id` for the session's active org. */\n  orgId: string;\n  /** Domain `users.id` of the acting person. */\n  userId: string;\n  /** Domain `org_users.id` — the acting org user in this org. */\n  orgUserId: string;\n  /** The role held in this org. */\n  role: StaffRole;\n  /** Better-auth organization id (for writes that go through the auth provider). */\n  authOrgId: string;\n}\n\n/** Thrown when the session has no resolvable active org / domain user. */\nexport class NoActiveOrgError extends Error {}\n\nexport async function resolveScope(container: Container, req: FastifyRequest): Promise<OrgScope> {\n  const authUser = req.authUser;\n  const authOrgId = req.authOrgId ?? null;\n  if (!authUser) {\n    throw new NoActiveOrgError('Sign in to continue');\n  }\n  if (!authOrgId || !req.orgId) {\n    throw new NoActiveOrgError('Choose an organization to continue');\n  }\n  // The session guard already translated the auth org id to the domain org.\n  const org = await container.organizations.getById(req.orgId);\n  if (!org) {\n    throw new NoActiveOrgError('The active organization no longer exists');\n  }\n  const user = await container.identity.getUserByExternalId(authUser.id);\n  if (!user) {\n    throw new NoActiveOrgError('Your account is not set up yet');\n  }\n  const orgUser = await container.organizations.getOrgUser(org.id, user.id);\n  if (!orgUser || !isStaffRole(orgUser.role)) {\n    throw new NoActiveOrgError('Only staff of this organization can do this');\n  }\n  container.requestContext.set({ orgId: org.id });\n  return {\n    orgId: org.id,\n    userId: user.id,\n    orgUserId: orgUser.id,\n    role: orgUser.role,\n    authOrgId,\n  };\n}\n\nexport async function resolveScopeFor(\n  container: Container,\n  authUserId: string,\n  authOrgId: string,\n): Promise<OrgScope> {\n  const org = await container.organizations.getByExternalId(authOrgId);\n  if (!org) {\n    throw new NoActiveOrgError('active organization not found');\n  }\n  const user = await container.identity.getUserByExternalId(authUserId);\n  if (!user) {\n    throw new NoActiveOrgError('no domain user for the current user');\n  }\n  const orgUser = await container.organizations.getOrgUser(org.id, user.id);\n  if (!orgUser || !isStaffRole(orgUser.role)) {\n    throw new NoActiveOrgError('not a staff member of the active organization');\n  }\n  container.requestContext.set({ orgId: org.id });\n  return { orgId: org.id, userId: user.id, orgUserId: orgUser.id, role: orgUser.role, authOrgId };\n}\n"],"mappings":";;;AAkBA,IAAa,mBAAb,cAAsC,MAAM,CAAC;AAE7C,eAAsB,aAAa,WAAsB,KAAwC;CAC/F,MAAM,WAAW,IAAI;CACrB,MAAM,YAAY,IAAI,aAAa;CACnC,IAAI,CAAC,UACH,MAAM,IAAI,iBAAiB,qBAAqB;CAElD,IAAI,CAAC,aAAa,CAAC,IAAI,OACrB,MAAM,IAAI,iBAAiB,oCAAoC;CAGjE,MAAM,MAAM,MAAM,UAAU,cAAc,QAAQ,IAAI,KAAK;CAC3D,IAAI,CAAC,KACH,MAAM,IAAI,iBAAiB,0CAA0C;CAEvE,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB,SAAS,EAAE;CACrE,IAAI,CAAC,MACH,MAAM,IAAI,iBAAiB,gCAAgC;CAE7D,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,IAAI,KAAK,EAAE;CACxE,IAAI,CAAC,WAAW,CAAC,YAAY,QAAQ,IAAI,GACvC,MAAM,IAAI,iBAAiB,6CAA6C;CAE1E,UAAU,eAAe,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC;CAC9C,OAAO;EACL,OAAO,IAAI;EACX,QAAQ,KAAK;EACb,WAAW,QAAQ;EACnB,MAAM,QAAQ;EACd;CACF;AACF;AAEA,eAAsB,gBACpB,WACA,YACA,WACmB;CACnB,MAAM,MAAM,MAAM,UAAU,cAAc,gBAAgB,SAAS;CACnE,IAAI,CAAC,KACH,MAAM,IAAI,iBAAiB,+BAA+B;CAE5D,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB,UAAU;CACpE,IAAI,CAAC,MACH,MAAM,IAAI,iBAAiB,qCAAqC;CAElE,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,IAAI,KAAK,EAAE;CACxE,IAAI,CAAC,WAAW,CAAC,YAAY,QAAQ,IAAI,GACvC,MAAM,IAAI,iBAAiB,+CAA+C;CAE5E,UAAU,eAAe,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC;CAC9C,OAAO;EAAE,OAAO,IAAI;EAAI,QAAQ,KAAK;EAAI,WAAW,QAAQ;EAAI,MAAM,QAAQ;EAAM;CAAU;AAChG"}

package/dist/http/server.js

@@ -1,8 +1,10 @@
 import { registerCors } from "./plugins/cors.js";
 import { registerOpenApi } from "./plugins/openapi.js";
 import { registerAuth } from "./plugins/auth.js";
-import { errorHandler } from "./plugins/error-handler.js";
+import { registerWellKnown } from "./well-known.js";
+import { errorHandler, notFoundHandler } from "./plugins/error-handler.js";
 import { registerRoutes } from "./routes.js";
+import { registerMcp } from "./mcp/route.js";
 import Fastify from "fastify";
 import { serializerCompiler, validatorCompiler } from "fastify-type-provider-zod";
 //#region src/http/server.ts
@@ -19,10 +21,13 @@ async function buildServer(config, container) {
 	app.setValidatorCompiler(validatorCompiler);
 	app.setSerializerCompiler(serializerCompiler);
 	app.setErrorHandler(errorHandler);
+	app.setNotFoundHandler(notFoundHandler);
 	registerCors(app, config);
 	registerOpenApi(app, config);
 	registerAuth(app, container);
+	if (container.mcp.oauthEnabled) registerWellKnown(app, container);
 	registerRoutes(app, container);
+	registerMcp(app, container);
 	app.addHook("onClose", async () => {
 		await container.outboxRelay.stop();
 		await container.automationEngine.stop();

package/dist/http/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","names":[],"sources":["../../src/http/server.ts"],"sourcesContent":["import Fastify, { type FastifyBaseLogger, type FastifyInstance } from 'fastify';\nimport { serializerCompiler, validatorCompiler } from 'fastify-type-provider-zod';\nimport type { Container } from '../app/container.js';\nimport type { ServerConfig } from './config.js';\nimport { registerCors } from './plugins/cors.js';\nimport { registerOpenApi } from './plugins/openapi.js';\nimport { registerAuth } from './plugins/auth.js';\nimport { errorHandler } from './plugins/error-handler.js';\nimport { registerRoutes } from './routes.js';\n\nexport async function buildServer(\n  config: ServerConfig,\n  container: Container,\n): Promise<FastifyInstance> {\n  // One log stream for the whole process: HTTP shares the container's pino root.\n  // Widened to FastifyBaseLogger so the instance keeps the default logger\n  // generic (a concrete pino type would ripple through every plugin signature).\n  const app = Fastify({\n    loggerInstance: container.loggerInstance as FastifyBaseLogger,\n    // Fastify's own request/response pair per call — noisy in a dev console,\n    // useful as an access log in production. Our own logs are unaffected.\n    disableRequestLogging: config.requestLogging === false,\n    // Adopt the caller's correlation id when it sends one, so one id joins\n    // the client's log line to this process's.\n    requestIdHeader: 'x-request-id',\n  });\n\n  // Enter the request-scoped log context: every line logged inside this\n  // request's async scope carries its reqId (and orgId once resolveScope runs),\n  // wherever it is emitted. The id is echoed on the response so callers can\n  // quote it when reporting a failure.\n  app.addHook('onRequest', (request, reply, done) => {\n    reply.header('x-request-id', request.id);\n    container.requestContext.run({ reqId: request.id }, done);\n  });\n\n  // Validate + serialize request/response bodies from the shared Zod contract.\n  app.setValidatorCompiler(validatorCompiler);\n  app.setSerializerCompiler(serializerCompiler);\n  app.setErrorHandler(errorHandler);\n\n  registerCors(app, config);\n  registerOpenApi(app, config);\n  registerAuth(app, container);\n\n  registerRoutes(app, container);\n\n  // Drain + stop the outbox relay and the automation engine on shutdown.\n  // Harmless when neither was started (gen-openapi boots this app with\n  // ready() + close() only).\n  app.addHook('onClose', async () => {\n    await container.outboxRelay.stop();\n    await container.automationEngine.stop();\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;AAUA,eAAsB,YACpB,QACA,WAC0B;CAI1B,MAAM,MAAM,QAAQ;EAClB,gBAAgB,UAAU;EAG1B,uBAAuB,OAAO,mBAAmB;EAGjD,iBAAiB;CACnB,CAAC;CAMD,IAAI,QAAQ,cAAc,SAAS,OAAO,SAAS;EACjD,MAAM,OAAO,gBAAgB,QAAQ,EAAE;EACvC,UAAU,eAAe,IAAI,EAAE,OAAO,QAAQ,GAAG,GAAG,IAAI;CAC1D,CAAC;CAGD,IAAI,qBAAqB,iBAAiB;CAC1C,IAAI,sBAAsB,kBAAkB;CAC5C,IAAI,gBAAgB,YAAY;CAEhC,aAAa,KAAK,MAAM;CACxB,gBAAgB,KAAK,MAAM;CAC3B,aAAa,KAAK,SAAS;CAE3B,eAAe,KAAK,SAAS;CAK7B,IAAI,QAAQ,WAAW,YAAY;EACjC,MAAM,UAAU,YAAY,KAAK;EACjC,MAAM,UAAU,iBAAiB,KAAK;CACxC,CAAC;CAED,OAAO;AACT"}
+{"version":3,"file":"server.js","names":[],"sources":["../../src/http/server.ts"],"sourcesContent":["import Fastify, { type FastifyBaseLogger, type FastifyInstance } from 'fastify';\nimport { serializerCompiler, validatorCompiler } from 'fastify-type-provider-zod';\nimport type { Container } from '../app/container.js';\nimport type { ServerConfig } from './config.js';\nimport { registerCors } from './plugins/cors.js';\nimport { registerOpenApi } from './plugins/openapi.js';\nimport { registerAuth } from './plugins/auth.js';\nimport { registerWellKnown } from './well-known.js';\nimport { errorHandler, notFoundHandler } from './plugins/error-handler.js';\nimport { registerRoutes } from './routes.js';\nimport { registerMcp } from './mcp/route.js';\n\nexport async function buildServer(\n  config: ServerConfig,\n  container: Container,\n): Promise<FastifyInstance> {\n  // One log stream for the whole process: HTTP shares the container's pino root.\n  // Widened to FastifyBaseLogger so the instance keeps the default logger\n  // generic (a concrete pino type would ripple through every plugin signature).\n  const app = Fastify({\n    loggerInstance: container.loggerInstance as FastifyBaseLogger,\n    // Fastify's own request/response pair per call — noisy in a dev console,\n    // useful as an access log in production. Our own logs are unaffected.\n    disableRequestLogging: config.requestLogging === false,\n    // Adopt the caller's correlation id when it sends one, so one id joins\n    // the client's log line to this process's.\n    requestIdHeader: 'x-request-id',\n  });\n\n  // Enter the request-scoped log context: every line logged inside this\n  // request's async scope carries its reqId (and orgId once resolveScope runs),\n  // wherever it is emitted. The id is echoed on the response so callers can\n  // quote it when reporting a failure.\n  app.addHook('onRequest', (request, reply, done) => {\n    reply.header('x-request-id', request.id);\n    container.requestContext.run({ reqId: request.id }, done);\n  });\n\n  // Validate + serialize request/response bodies from the shared Zod contract.\n  app.setValidatorCompiler(validatorCompiler);\n  app.setSerializerCompiler(serializerCompiler);\n  app.setErrorHandler(errorHandler);\n  app.setNotFoundHandler(notFoundHandler);\n\n  registerCors(app, config);\n  registerOpenApi(app, config);\n  registerAuth(app, container);\n  if (container.mcp.oauthEnabled) {\n    registerWellKnown(app, container);\n  }\n\n  registerRoutes(app, container);\n  registerMcp(app, container);\n\n  // Drain + stop the outbox relay and the automation engine on shutdown.\n  // Harmless when neither was started (gen-openapi boots this app with\n  // ready() + close() only).\n  app.addHook('onClose', async () => {\n    await container.outboxRelay.stop();\n    await container.automationEngine.stop();\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;AAYA,eAAsB,YACpB,QACA,WAC0B;CAI1B,MAAM,MAAM,QAAQ;EAClB,gBAAgB,UAAU;EAG1B,uBAAuB,OAAO,mBAAmB;EAGjD,iBAAiB;CACnB,CAAC;CAMD,IAAI,QAAQ,cAAc,SAAS,OAAO,SAAS;EACjD,MAAM,OAAO,gBAAgB,QAAQ,EAAE;EACvC,UAAU,eAAe,IAAI,EAAE,OAAO,QAAQ,GAAG,GAAG,IAAI;CAC1D,CAAC;CAGD,IAAI,qBAAqB,iBAAiB;CAC1C,IAAI,sBAAsB,kBAAkB;CAC5C,IAAI,gBAAgB,YAAY;CAChC,IAAI,mBAAmB,eAAe;CAEtC,aAAa,KAAK,MAAM;CACxB,gBAAgB,KAAK,MAAM;CAC3B,aAAa,KAAK,SAAS;CAC3B,IAAI,UAAU,IAAI,cAChB,kBAAkB,KAAK,SAAS;CAGlC,eAAe,KAAK,SAAS;CAC7B,YAAY,KAAK,SAAS;CAK1B,IAAI,QAAQ,WAAW,YAAY;EACjC,MAAM,UAAU,YAAY,KAAK;EACjC,MAAM,UAAU,iBAAiB,KAAK;CACxC,CAAC;CAED,OAAO;AACT"}

package/dist/http/web-bridge.d.ts

@@ -1,7 +1,7 @@
 import { FastifyReply, FastifyRequest } from "fastify";
 //#region src/http/web-bridge.d.ts
 /** Builds a Web `Request` from an incoming Fastify request. */
-declare function toWebRequest(request: FastifyRequest): Request;
+declare function toWebRequest(request: FastifyRequest, origin: string): Request;
 /** Copies a Web `Response` back onto a Fastify reply, preserving multiple cookies. */
 declare function bridgeWebResponse(response: Response, reply: FastifyReply): Promise<void>;
 //#endregion

package/dist/http/web-bridge.js

@@ -1,8 +1,8 @@
 import { fromNodeHeaders } from "better-auth/node";
 //#region src/http/web-bridge.ts
 /** Builds a Web `Request` from an incoming Fastify request. */
-function toWebRequest(request) {
-	const url = new URL(request.url, `http://${request.headers.host}`);
+function toWebRequest(request, origin) {
+	const url = new URL(request.url, origin);
 	const body = request.method !== "GET" && request.method !== "HEAD" && request.method !== "DELETE" ? typeof request.body === "string" ? request.body : request.body ? JSON.stringify(request.body) : void 0 : void 0;
 	return new Request(url.toString(), {
 		method: request.method,

package/dist/http/web-bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-bridge.js","names":[],"sources":["../../src/http/web-bridge.ts"],"sourcesContent":["// Bridges between Fastify's request/reply and the Web `Request`/`Response` that\n// better-auth speaks. The auth catch-all hands a Fastify request to a\n// Web-standard handler and forwards the\n// Web response back, so the conversion lives here once.\nimport type { FastifyReply, FastifyRequest } from 'fastify';\nimport { fromNodeHeaders } from 'better-auth/node';\n\n/** Builds a Web `Request` from an incoming Fastify request. */\nexport function toWebRequest(request: FastifyRequest): Request {\n  const url = new URL(request.url, `http://${request.headers.host}`);\n  // GET/HEAD/DELETE never carry a body; passing one to `Request` throws. For the\n  // rest, forward a string body verbatim and JSON-encode a parsed object.\n  const hasBody =\n    request.method !== 'GET' && request.method !== 'HEAD' && request.method !== 'DELETE';\n  const body = hasBody\n    ? typeof request.body === 'string'\n      ? request.body\n      : request.body\n        ? JSON.stringify(request.body)\n        : undefined\n    : undefined;\n  return new Request(url.toString(), {\n    method: request.method,\n    headers: fromNodeHeaders(request.headers),\n    body,\n  });\n}\n\n/** Copies a Web `Response` back onto a Fastify reply, preserving multiple cookies. */\nexport async function bridgeWebResponse(response: Response, reply: FastifyReply): Promise<void> {\n  reply.status(response.status);\n  // Emit each Set-Cookie value individually — forEach() collapses multiple\n  // Set-Cookie headers into one comma-joined string (undici behaviour), which\n  // corrupts multi-cookie auth responses. getSetCookie() returns them as an\n  // array so each one is forwarded as a separate header.\n  const cookies = response.headers.getSetCookie();\n  if (cookies.length > 0) {\n    reply.raw.setHeader('set-cookie', cookies);\n  }\n  response.headers.forEach((value, key) => {\n    if (key.toLowerCase() === 'set-cookie') {\n      return;\n    } // already handled above\n    reply.header(key, value);\n  });\n  reply.send(response.body ? await response.text() : null);\n}\n"],"mappings":";;;AAQA,SAAgB,aAAa,SAAkC;CAC7D,MAAM,MAAM,IAAI,IAAI,QAAQ,KAAK,UAAU,QAAQ,QAAQ,MAAM;CAKjE,MAAM,OADJ,QAAQ,WAAW,SAAS,QAAQ,WAAW,UAAU,QAAQ,WAAW,WAE1E,OAAO,QAAQ,SAAS,WACtB,QAAQ,OACR,QAAQ,OACN,KAAK,UAAU,QAAQ,IAAI,IAC3B,KAAA,IACJ,KAAA;CACJ,OAAO,IAAI,QAAQ,IAAI,SAAS,GAAG;EACjC,QAAQ,QAAQ;EAChB,SAAS,gBAAgB,QAAQ,OAAO;EACxC;CACF,CAAC;AACH;;AAGA,eAAsB,kBAAkB,UAAoB,OAAoC;CAC9F,MAAM,OAAO,SAAS,MAAM;CAK5B,MAAM,UAAU,SAAS,QAAQ,aAAa;CAC9C,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,UAAU,cAAc,OAAO;CAE3C,SAAS,QAAQ,SAAS,OAAO,QAAQ;EACvC,IAAI,IAAI,YAAY,MAAM,cACxB;EAEF,MAAM,OAAO,KAAK,KAAK;CACzB,CAAC;CACD,MAAM,KAAK,SAAS,OAAO,MAAM,SAAS,KAAK,IAAI,IAAI;AACzD"}
+{"version":3,"file":"web-bridge.js","names":[],"sources":["../../src/http/web-bridge.ts"],"sourcesContent":["// Bridges between Fastify's request/reply and the Web `Request`/`Response` that\n// better-auth speaks. The auth catch-all hands a Fastify request to a\n// Web-standard handler and forwards the\n// Web response back, so the conversion lives here once.\nimport type { FastifyReply, FastifyRequest } from 'fastify';\nimport { fromNodeHeaders } from 'better-auth/node';\n\n/** Builds a Web `Request` from an incoming Fastify request. */\nexport function toWebRequest(request: FastifyRequest, origin: string): Request {\n  const url = new URL(request.url, origin);\n  // GET/HEAD/DELETE never carry a body; passing one to `Request` throws. For the\n  // rest, forward a string body verbatim and JSON-encode a parsed object.\n  const hasBody =\n    request.method !== 'GET' && request.method !== 'HEAD' && request.method !== 'DELETE';\n  const body = hasBody\n    ? typeof request.body === 'string'\n      ? request.body\n      : request.body\n        ? JSON.stringify(request.body)\n        : undefined\n    : undefined;\n  return new Request(url.toString(), {\n    method: request.method,\n    headers: fromNodeHeaders(request.headers),\n    body,\n  });\n}\n\n/** Copies a Web `Response` back onto a Fastify reply, preserving multiple cookies. */\nexport async function bridgeWebResponse(response: Response, reply: FastifyReply): Promise<void> {\n  reply.status(response.status);\n  // Emit each Set-Cookie value individually — forEach() collapses multiple\n  // Set-Cookie headers into one comma-joined string (undici behaviour), which\n  // corrupts multi-cookie auth responses. getSetCookie() returns them as an\n  // array so each one is forwarded as a separate header.\n  const cookies = response.headers.getSetCookie();\n  if (cookies.length > 0) {\n    reply.raw.setHeader('set-cookie', cookies);\n  }\n  response.headers.forEach((value, key) => {\n    if (key.toLowerCase() === 'set-cookie') {\n      return;\n    } // already handled above\n    reply.header(key, value);\n  });\n  reply.send(response.body ? await response.text() : null);\n}\n"],"mappings":";;;AAQA,SAAgB,aAAa,SAAyB,QAAyB;CAC7E,MAAM,MAAM,IAAI,IAAI,QAAQ,KAAK,MAAM;CAKvC,MAAM,OADJ,QAAQ,WAAW,SAAS,QAAQ,WAAW,UAAU,QAAQ,WAAW,WAE1E,OAAO,QAAQ,SAAS,WACtB,QAAQ,OACR,QAAQ,OACN,KAAK,UAAU,QAAQ,IAAI,IAC3B,KAAA,IACJ,KAAA;CACJ,OAAO,IAAI,QAAQ,IAAI,SAAS,GAAG;EACjC,QAAQ,QAAQ;EAChB,SAAS,gBAAgB,QAAQ,OAAO;EACxC;CACF,CAAC;AACH;;AAGA,eAAsB,kBAAkB,UAAoB,OAAoC;CAC9F,MAAM,OAAO,SAAS,MAAM;CAK5B,MAAM,UAAU,SAAS,QAAQ,aAAa;CAC9C,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,UAAU,cAAc,OAAO;CAE3C,SAAS,QAAQ,SAAS,OAAO,QAAQ;EACvC,IAAI,IAAI,YAAY,MAAM,cACxB;EAEF,MAAM,OAAO,KAAK,KAAK;CACzB,CAAC;CACD,MAAM,KAAK,SAAS,OAAO,MAAM,SAAS,KAAK,IAAI,IAAI;AACzD"}

package/dist/http/well-known.d.ts

@@ -0,0 +1,7 @@
+import { Container } from "../app/container.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/well-known.d.ts
+declare function registerWellKnown(app: FastifyInstance, container: Container): void;
+//#endregion
+export { registerWellKnown };
+//# sourceMappingURL=well-known.d.ts.map

package/dist/http/well-known.js

@@ -0,0 +1,22 @@
+import { bridgeWebResponse, toWebRequest } from "./web-bridge.js";
+import { ACCESS_SCOPES } from "@headless-lms/core/organizations";
+//#region src/http/well-known.ts
+function registerWellKnown(app, container) {
+	const origin = new URL(container.mcp.issuer).origin;
+	const resourceMetadata = () => ({
+		resource: container.mcp.resource,
+		authorization_servers: [container.mcp.issuer],
+		scopes_supported: [...ACCESS_SCOPES],
+		bearer_methods_supported: ["header"]
+	});
+	const hidden = { schema: { hide: true } };
+	app.get("/.well-known/oauth-protected-resource/mcp", hidden, async () => resourceMetadata());
+	app.get("/.well-known/oauth-protected-resource", hidden, async () => resourceMetadata());
+	app.get("/.well-known/oauth-authorization-server/api/auth", hidden, async (request, reply) => {
+		await bridgeWebResponse(await container.auth.authorizationServerMetadata(toWebRequest(request, origin)), reply);
+	});
+}
+//#endregion
+export { registerWellKnown };
+
+//# sourceMappingURL=well-known.js.map

package/dist/http/well-known.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.js","names":[],"sources":["../../src/http/well-known.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport { ACCESS_SCOPES } from '@headless-lms/core/organizations';\nimport type { Container } from '../app/container.js';\nimport { bridgeWebResponse, toWebRequest } from './web-bridge.js';\n\nexport function registerWellKnown(app: FastifyInstance, container: Container): void {\n  const origin = new URL(container.mcp.issuer).origin;\n  const resourceMetadata = () => ({\n    resource: container.mcp.resource,\n    authorization_servers: [container.mcp.issuer],\n    scopes_supported: [...ACCESS_SCOPES],\n    bearer_methods_supported: ['header'],\n  });\n  const hidden = { schema: { hide: true } };\n\n  app.get('/.well-known/oauth-protected-resource/mcp', hidden, async () => resourceMetadata());\n  app.get('/.well-known/oauth-protected-resource', hidden, async () => resourceMetadata());\n  app.get('/.well-known/oauth-authorization-server/api/auth', hidden, async (request, reply) => {\n    await bridgeWebResponse(\n      await container.auth.authorizationServerMetadata(toWebRequest(request, origin)),\n      reply,\n    );\n  });\n}\n"],"mappings":";;;AAKA,SAAgB,kBAAkB,KAAsB,WAA4B;CAClF,MAAM,SAAS,IAAI,IAAI,UAAU,IAAI,MAAM,CAAC,CAAC;CAC7C,MAAM,0BAA0B;EAC9B,UAAU,UAAU,IAAI;EACxB,uBAAuB,CAAC,UAAU,IAAI,MAAM;EAC5C,kBAAkB,CAAC,GAAG,aAAa;EACnC,0BAA0B,CAAC,QAAQ;CACrC;CACA,MAAM,SAAS,EAAE,QAAQ,EAAE,MAAM,KAAK,EAAE;CAExC,IAAI,IAAI,6CAA6C,QAAQ,YAAY,iBAAiB,CAAC;CAC3F,IAAI,IAAI,yCAAyC,QAAQ,YAAY,iBAAiB,CAAC;CACvF,IAAI,IAAI,oDAAoD,QAAQ,OAAO,SAAS,UAAU;EAC5F,MAAM,kBACJ,MAAM,UAAU,KAAK,4BAA4B,aAAa,SAAS,MAAM,CAAC,GAC9E,KACF;CACF,CAAC;AACH"}

package/dist/index.d.ts

@@ -2,6 +2,7 @@ import { AuthUser } from "./http/fastify.js";
 import { AdapterOverrides, BuildContainerOptions, Config, Container, LoggingConfig } from "./app/container.js";
 import { loadIntegrations } from "./app/integrations.js";
 import { ServerConfig } from "./http/config.js";
+import { CatalogueField, CatalogueScope, CatalogueTool, McpCatalogue, mcpCatalogue } from "./http/mcp/catalogue.js";
 import { buildServer } from "./http/server.js";
 import { runMigrations } from "@headless-lms/adapter-db";
 import { InlineAutomationEngine } from "@headless-lms/adapter-defaults/workflows";
@@ -11,5 +12,5 @@ import { EmailMessage, EmailSender, ObjectStorage } from "@headless-lms/core/sha
 //#region src/index.d.ts
 declare function createContainer(config: ServerConfig, options?: BuildContainerOptions): Promise<Container>;
 //#endregion
-export { type AdapterOverrides, type AuthUser, type AutomationEngine, type BuildContainerOptions, type Container, type Config as ContainerConfig, type EmailMessage, type EmailSender, InlineAutomationEngine, type LoggingConfig, type Mailer, type ObjectStorage, type ServerConfig, type WebhookSender, buildServer, createContainer, loadIntegrations, runMigrations };
+export { type AdapterOverrides, type AuthUser, type AutomationEngine, type BuildContainerOptions, type CatalogueField, type CatalogueScope, type CatalogueTool, type Container, type Config as ContainerConfig, type EmailMessage, type EmailSender, InlineAutomationEngine, type LoggingConfig, type Mailer, type McpCatalogue, type ObjectStorage, type ServerConfig, type WebhookSender, buildServer, createContainer, loadIntegrations, mcpCatalogue, runMigrations };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,16 +1,18 @@
 import { loadIntegrations } from "./app/integrations.js";
 import { buildContainer } from "./app/container.js";
 import { buildServer } from "./http/server.js";
+import { mcpCatalogue } from "./http/mcp/catalogue.js";
 import { runMigrations } from "@headless-lms/adapter-db";
 import { InlineAutomationEngine } from "@headless-lms/adapter-defaults/workflows";
 //#region src/index.ts
 async function createContainer(config, options) {
 	return buildContainer({
 		...config.container,
-		deliveryExpirySeconds: config.deliveryExpirySeconds
+		deliveryExpirySeconds: config.deliveryExpirySeconds,
+		memberImageMaxBytes: config.memberImageMaxBytes
 	}, options);
 }
 //#endregion
-export { InlineAutomationEngine, buildServer, createContainer, loadIntegrations, runMigrations };
+export { InlineAutomationEngine, buildServer, createContainer, loadIntegrations, mcpCatalogue, runMigrations };
 
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["// Public surface of @headless-lms/server. Installations compose these:\n//   const container = await createContainer(config, { pluginsDir, adapters })\n//   const app = await buildServer(config, container)\nimport { buildContainer, type BuildContainerOptions, type Container } from './app/container.js';\nimport type { ServerConfig } from './http/config.js';\n\nexport { buildServer } from './http/server.js';\nexport { loadIntegrations } from './app/integrations.js';\nexport { InlineAutomationEngine } from '@headless-lms/adapter-defaults/workflows';\n// Operational functions consumed by the @headless-lms/cli bin.\nexport { runMigrations } from '@headless-lms/adapter-db';\nexport type { ServerConfig } from './http/config.js';\n// Re-exporting AuthUser also pulls its module into any program that imports\n// this file (directly or via the workspace path mapping), which is what\n// applies its ambient `declare module \"fastify\"` augmentation\n// (FastifyRequest.authUser/orgId, FastifyInstance.requireOrgSession) —\n// otherwise nothing imports fastify.d.ts and the augmentation never loads.\nexport type { AuthUser } from './http/fastify.js';\nexport type {\n  Config as ContainerConfig,\n  Container,\n  AdapterOverrides,\n  BuildContainerOptions,\n  LoggingConfig,\n} from './app/container.js';\nexport type { EmailSender, EmailMessage, ObjectStorage } from '@headless-lms/core/shared/ports';\nexport type { Mailer } from '@headless-lms/core/shared/mailer';\nexport type { AutomationEngine, WebhookSender } from '@headless-lms/core/automations';\n\nexport async function createContainer(\n  config: ServerConfig,\n  options?: BuildContainerOptions,\n): Promise<Container> {\n  return buildContainer(\n    { ...config.container, deliveryExpirySeconds: config.deliveryExpirySeconds },\n    options,\n  );\n}\n"],"mappings":";;;;;;AA6BA,eAAsB,gBACpB,QACA,SACoB;CACpB,OAAO,eACL;EAAE,GAAG,OAAO;EAAW,uBAAuB,OAAO;CAAsB,GAC3E,OACF;AACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["// Public surface of @headless-lms/server. Installations compose these:\n//   const container = await createContainer(config, { pluginsDir, adapters })\n//   const app = await buildServer(config, container)\nimport { buildContainer, type BuildContainerOptions, type Container } from './app/container.js';\nimport type { ServerConfig } from './http/config.js';\n\nexport { buildServer } from './http/server.js';\nexport { mcpCatalogue } from './http/mcp/catalogue.js';\nexport type {\n  CatalogueField,\n  CatalogueScope,\n  CatalogueTool,\n  McpCatalogue,\n} from './http/mcp/catalogue.js';\nexport { loadIntegrations } from './app/integrations.js';\nexport { InlineAutomationEngine } from '@headless-lms/adapter-defaults/workflows';\n// Operational functions consumed by the @headless-lms/cli bin.\nexport { runMigrations } from '@headless-lms/adapter-db';\nexport type { ServerConfig } from './http/config.js';\n// Re-exporting AuthUser also pulls its module into any program that imports\n// this file (directly or via the workspace path mapping), which is what\n// applies its ambient `declare module \"fastify\"` augmentation\n// (FastifyRequest.authUser/orgId, FastifyInstance.requireOrgSession) —\n// otherwise nothing imports fastify.d.ts and the augmentation never loads.\nexport type { AuthUser } from './http/fastify.js';\nexport type {\n  Config as ContainerConfig,\n  Container,\n  AdapterOverrides,\n  BuildContainerOptions,\n  LoggingConfig,\n} from './app/container.js';\nexport type { EmailSender, EmailMessage, ObjectStorage } from '@headless-lms/core/shared/ports';\nexport type { Mailer } from '@headless-lms/core/shared/mailer';\nexport type { AutomationEngine, WebhookSender } from '@headless-lms/core/automations';\n\nexport async function createContainer(\n  config: ServerConfig,\n  options?: BuildContainerOptions,\n): Promise<Container> {\n  return buildContainer(\n    {\n      ...config.container,\n      deliveryExpirySeconds: config.deliveryExpirySeconds,\n      memberImageMaxBytes: config.memberImageMaxBytes,\n    },\n    options,\n  );\n}\n"],"mappings":";;;;;;;AAoCA,eAAsB,gBACpB,QACA,SACoB;CACpB,OAAO,eACL;EACE,GAAG,OAAO;EACV,uBAAuB,OAAO;EAC9B,qBAAqB,OAAO;CAC9B,GACA,OACF;AACF"}