@headless-lms/server 0.3.0 → 0.5.0

package/dist/app/container.js.map

@@ -1 +1 @@
-{"version":3,"file":"container.js","names":[],"sources":["../../src/app/container.ts"],"sourcesContent":["// Wires adapters + services in dependency order. Starts nothing.\nimport {\n  createDb,\n  DrizzleAssetsRepository,\n  DrizzleAutomationRunsRepository,\n  DrizzleAutomationsRepository,\n  DrizzleConnectionsRepository,\n  DrizzleContentRepository,\n  DrizzleCredentialStore,\n  DrizzleAdminRepository,\n  DrizzleDiscussionRepository,\n  DrizzlePostRepository,\n  DrizzleChatRepository,\n  DrizzleEntitlementsRepository,\n  DrizzleIdentityRepository,\n  DrizzleMemberRepository,\n  DrizzleMembersRepository,\n  DrizzleNotificationsRepository,\n  DrizzleOrganizationsRepository,\n  DrizzleOutboxAppender,\n  DrizzleOutboxStore,\n  DrizzleProgressRepository,\n  DrizzleSettingsRepository,\n  DrizzleUnitOfWork,\n} from '@headless-lms/adapter-db';\nimport { InMemoryEventBus } from '@headless-lms/adapter-defaults/events';\nimport {\n  PollingOutboxRelay,\n  type PollingOutboxRelayConfig,\n} from '@headless-lms/adapter-defaults/events/outbox-relay';\nimport { InlineAutomationEngine } from '@headless-lms/adapter-defaults/workflows';\nimport { FetchWebhookSender } from '@headless-lms/adapter-defaults/webhooks';\nimport { EmailAdapter, StubTemplateRenderer } from '@headless-lms/adapter-defaults/email';\nimport {\n  createRootLogger,\n  type LogLevel,\n  type PinoInstance,\n  requestLogContext,\n  type RequestLogContext,\n} from '@headless-lms/adapter-defaults/logging';\nimport { StorageAdapter } from '@headless-lms/adapter-defaults/storage';\nimport { BetterAuth } from '@headless-lms/adapter-auth';\n\nimport { ContentService } from '@headless-lms/core/content';\nimport { EntitlementsServiceImpl } from '@headless-lms/core/entitlements';\nimport { ProgressServiceImpl } from '@headless-lms/core/progress';\nimport {\n  ChatServiceImpl,\n  DiscussionServiceImpl,\n  PostServiceImpl,\n} from '@headless-lms/core/discussion';\nimport {\n  IdentityServiceImpl,\n  NotificationServiceImpl,\n  type SessionAdmin,\n} from '@headless-lms/core/identity';\nimport {\n  type OrgAdmin,\n  OrganizationServiceImpl,\n  parseRole,\n} from '@headless-lms/core/organizations';\nimport { AssetsServiceImpl, createFileUrls } from '@headless-lms/core/assets';\nimport { IntegrationsServiceImpl } from '@headless-lms/core/integrations';\nimport { AutomationsServiceImpl } from '@headless-lms/core/automations';\nimport { loadIntegrations } from './integrations.js';\nimport { mcpEndpoints, type McpEndpoints } from './mcp-endpoints.js';\nimport { communityMail } from './community-mail.js';\nimport { AdminReportServiceImpl } from '@headless-lms/core/reporting/admin';\nimport { MemberReportServiceImpl } from '@headless-lms/core/reporting/member';\nimport { Mailer, type MailerLookups } from '@headless-lms/core/shared/mailer';\nimport { SettingsService } from '@headless-lms/core/shared/settings';\n\nimport type {\n  CredentialStore,\n  EmailSender,\n  Logger,\n  ObjectStorage,\n  OutboxRelay,\n  TemplateContext,\n  TemplateRenderer,\n} from '@headless-lms/core/shared/ports';\nimport type { AutomationEngine, WebhookSender } from '@headless-lms/core/types';\n\n/** Installation-supplied ports; an absent slot falls back to a fail-loudly stub. */\nexport interface AdapterOverrides {\n  email?: EmailSender;\n  storage?: ObjectStorage;\n  /** Resolves email templates to rendered content. Absent → fail-loudly stub. */\n  templates?: TemplateRenderer;\n  /** Durable automation engine, or a factory given the automations logger. Absent → InlineAutomationEngine (in-process, one attempt per action). */\n  workflows?: AutomationEngine | ((logger: Logger) => AutomationEngine);\n  /** Outbound HTTP for webhook deliveries. Absent → FetchWebhookSender (public addresses only, 10s timeout). */\n  webhooks?: WebhookSender;\n}\n\nexport interface BuildContainerOptions {\n  /** Installation's plugins folder, scanned by loadIntegrations. Absent → no integrations. */\n  pluginsDir?: string;\n  adapters?: AdapterOverrides;\n}\n\nexport interface Config {\n  databaseUrl: string;\n  authBaseURL: string;\n  authSecret: string;\n  trustedOrigins: string[];\n  /** Branding threaded into every email template. Default: brandName \"Headless LMS\", baseUrl = adminAppUrl.\n   *  (studentPortalUrl is composed in from the top-level config field.) */\n  emailBranding?: Omit<TemplateContext, 'studentPortalUrl'>;\n  /** base64-encoded 32-byte key for the credential store (CREDENTIAL_STORE_KEY). */\n  credentialStoreKey: string;\n  /** Parent domain for cross-subdomain session cookies (e.g. \".example.com\"); undefined → host-only cookie. */\n  cookieDomain?: string;\n  /** Mark session cookies Secure (set behind HTTPS / in production). */\n  secureCookies?: boolean;\n  /** Student portal origin — invite links for students, and the origin whose signups are invite-gated. */\n  studentPortalUrl: string;\n  /** Admin app origin — invite links for staff. */\n  adminAppUrl: string;\n  /** Transactional-outbox relay tuning. All optional — see OUTBOX_DEFAULTS. */\n  outbox?: OutboxConfig;\n  /** Log level for the process-wide logger (HTTP + domain + relay). Default \"info\". */\n  logging?: LoggingConfig;\n  /** Lifetime of every signed file URL a response carries, seconds. Mirrors\n   *  ServerConfig.deliveryExpirySeconds — createContainer threads it through. */\n  deliveryExpirySeconds: number;\n  memberImageMaxBytes: number;\n  /** Let the default webhook sender reach loopback and private network addresses. Local development only. */\n  webhookAllowPrivateNetwork?: boolean;\n}\n\n/** Tuning for the transactional-outbox relay. Every field is optional; the\n *  container resolves against OUTBOX_DEFAULTS. */\nexport interface OutboxConfig {\n  /** Master switch for the same-process relay. Default true. */\n  enabled?: boolean;\n  /** Idle delay between polls. Default 1000. */\n  pollIntervalMs?: number;\n  /** Max rows fetched/dispatched per tick. Default 100. */\n  batchSize?: number;\n}\n\nexport const OUTBOX_DEFAULTS: PollingOutboxRelayConfig = {\n  enabled: true,\n  pollIntervalMs: 1000,\n  batchSize: 100,\n};\n\nexport function resolveOutboxConfig(config: OutboxConfig = {}): PollingOutboxRelayConfig {\n  const overrides = Object.fromEntries(\n    Object.entries(config).filter(([, value]) => value !== undefined),\n  );\n  return { ...OUTBOX_DEFAULTS, ...overrides };\n}\n\n/** Logging tuning. Optional; resolved against LOGGING_DEFAULTS. */\nexport interface LoggingConfig {\n  /** Minimum level emitted. Default \"info\". */\n  level?: LogLevel;\n}\n\nexport const LOGGING_DEFAULTS: Required<LoggingConfig> = { level: 'info' };\n\nexport function resolveLoggingConfig(config: LoggingConfig = {}): Required<LoggingConfig> {\n  return { level: config.level ?? LOGGING_DEFAULTS.level };\n}\n\nexport interface Container {\n  auth: BetterAuth;\n  mcp: McpEndpoints;\n  // Org Provider\n  orgProvider: OrgAdmin;\n\n  // Domains\n  identity: IdentityServiceImpl;\n  notifications: NotificationServiceImpl;\n  organizations: OrganizationServiceImpl;\n  content: ContentService;\n  entitlements: EntitlementsServiceImpl;\n  progress: ProgressServiceImpl;\n  discussion: DiscussionServiceImpl;\n  posts: PostServiceImpl;\n  chats: ChatServiceImpl;\n  assets: AssetsServiceImpl;\n  integrations: IntegrationsServiceImpl;\n  automations: AutomationsServiceImpl;\n  /** Cross-cutting settings store. Not a context — a leaf every context may use;\n   *  inject `settings.for('<namespace>')` into a service, never the service itself. */\n  settings: SettingsService;\n  // Reporting read layer (composed cross-context reads; owns no domain rules).\n  reporting: {\n    admin: AdminReportServiceImpl;\n    member: MemberReportServiceImpl;\n  };\n  storage: ObjectStorage;\n  mailer: Mailer;\n  /** Shared secure credential store — encrypted at rest, org-scoped, decrypt at point of use. */\n  credentials: CredentialStore;\n  /** The outbox relay — constructed but NEVER started by the container; the\n   *  installation's entry point starts it after listen (gen-openapi must not\n   *  poll). buildServer stops it onClose. */\n  outboxRelay: OutboxRelay;\n  /** The automation engine — constructed but NEVER started by the container;\n   *  the installation's entry point starts it after listen (gen-openapi must\n   *  not run a worker). buildServer stops it onClose. */\n  automationEngine: AutomationEngine;\n  /** Root logger port — components receive children bound with { name }. */\n  logger: Logger;\n  /** The raw pino root; buildServer hands it to Fastify so HTTP shares the stream. */\n  loggerInstance: PinoInstance;\n  /** Request-scoped log correlation; the HTTP layer enters it per request. */\n  requestContext: RequestLogContext;\n  /** Identity's session-write port; the auth adapter fulfils it. */\n  sessions: SessionAdmin;\n}\n\nexport async function buildContainer(\n  config: Config,\n  options?: BuildContainerOptions,\n): Promise<Container> {\n  const { instance: loggerInstance, logger } = createRootLogger(\n    resolveLoggingConfig(config.logging).level,\n  );\n  // One child per domain — a context's service and repositories share it.\n\n  const contentLogger = logger.child({ name: 'content' });\n  const entitlementsLogger = logger.child({ name: 'entitlements' });\n  const progressLogger = logger.child({ name: 'progress' });\n  const discussionLogger = logger.child({ name: 'discussion' });\n  const assetsLogger = logger.child({ name: 'assets' });\n  const integrationsLogger = logger.child({ name: 'integrations' });\n  const automationsLogger = logger.child({ name: 'automations' });\n  const reportingLogger = logger.child({ name: 'reporting' });\n  const outboxLogger = logger.child({ name: 'outbox' });\n\n  // Outbound adapters\n  const db = createDb(config.databaseUrl);\n  const email = options?.adapters?.email ?? new EmailAdapter(logger.child({ name: 'email' }));\n  const storage: ObjectStorage =\n    options?.adapters?.storage ?? new StorageAdapter(logger.child({ name: 'storage' }));\n  const templates =\n    options?.adapters?.templates ?? new StubTemplateRenderer(logger.child({ name: 'email' }));\n  const workflows = options?.adapters?.workflows;\n  const automationEngine: AutomationEngine =\n    typeof workflows === 'function'\n      ? workflows(automationsLogger)\n      : (workflows ?? new InlineAutomationEngine(automationsLogger));\n  const mailer = new Mailer(templates, email, {\n    ...(config.emailBranding ?? { brandName: 'Headless LMS', baseUrl: config.adminAppUrl }),\n    studentPortalUrl: config.studentPortalUrl,\n  });\n\n  const fileUrls = createFileUrls(config.authBaseURL);\n  const assets = new AssetsServiceImpl({\n    storage,\n    repo: new DrizzleAssetsRepository(db, assetsLogger),\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      assets: new DrizzleAssetsRepository(tx, assetsLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    memberImageMaxBytes: config.memberImageMaxBytes,\n    downloadLinkExpirySeconds: config.deliveryExpirySeconds,\n    fileUrls,\n    logger: assetsLogger,\n  });\n\n  /*\n   * Identity\n   */\n  const identityUoW = new DrizzleUnitOfWork(db, (tx) => ({\n    identity: new DrizzleIdentityRepository(tx, logger.child({ name: 'identity' })),\n    outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'identity' })),\n  }));\n  const identity = new IdentityServiceImpl({\n    repo: new DrizzleIdentityRepository(db, logger.child({ name: 'identity_repo' })),\n    logger: logger.child({ name: 'identity' }),\n    uow: identityUoW,\n    mailer,\n    images: assets,\n    fileUrls,\n  });\n  const notifications = new NotificationServiceImpl({\n    repo: new DrizzleNotificationsRepository(db),\n    logger: logger.child({ name: 'notifications' }),\n  });\n\n  /*\n   * Organization\n   */\n  const organizationsRepo = new DrizzleOrganizationsRepository(db, logger.child({ name: 'org' }));\n  const organizationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    organizations: new DrizzleOrganizationsRepository(tx, logger.child({ name: 'org' })),\n    outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'org' })),\n  }));\n  const orgAdminRef: { current: OrgAdmin | undefined } = { current: undefined };\n  const organizations = new OrganizationServiceImpl({\n    repo: organizationsRepo,\n    membersRepo: new DrizzleMembersRepository(db, logger.child({ name: 'org' })),\n    people: identity,\n    uow: organizationsUow,\n    orgAdmin: () => {\n      if (!orgAdminRef.current) {\n        throw new Error('orgAdmin not initialised');\n      }\n      return orgAdminRef.current;\n    },\n    logger: logger.child({ name: 'org' }),\n    mailer,\n    inviteUrls: { studentPortalUrl: config.studentPortalUrl, adminAppUrl: config.adminAppUrl },\n  });\n\n  /*\n   * Settings\n   */\n  const settings = new SettingsService(\n    new DrizzleSettingsRepository(db, logger.child({ name: 'settings' })),\n  );\n  // Content: reads on the root db; course writes + outbox append in one tx.\n  const contentUow = new DrizzleUnitOfWork(db, (tx) => ({\n    content: new DrizzleContentRepository(tx, contentLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const content = new ContentService({\n    repo: new DrizzleContentRepository(db, contentLogger),\n    uow: contentUow,\n    libraryAssets: assets,\n    files: assets,\n    fileUrls,\n    logger: contentLogger,\n  });\n  // Entitlements: reads on the root db; writes + outbox append in one tx.\n  const entitlementsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    entitlements: new DrizzleEntitlementsRepository(tx, entitlementsLogger),\n    spaces: new DrizzleContentRepository(tx, contentLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const authors = {\n    roleOf: async (orgId: string, orgUserId: string) => {\n      const row = await organizationsRepo.findOrgUserById(orgId, orgUserId);\n      return row?.role ?? null;\n    },\n    rolesOf: async (orgId: string, orgUserIds: string[]) => {\n      const rows = await organizationsRepo.findOrgUsersByIds(orgId, orgUserIds);\n      return Object.fromEntries(rows.map((row) => [row.id, row.role]));\n    },\n  };\n  const entitlementsRepo = new DrizzleEntitlementsRepository(db, entitlementsLogger);\n  const entitlements = new EntitlementsServiceImpl({\n    repo: entitlementsRepo,\n    content,\n    uow: entitlementsUow,\n    logger: entitlementsLogger,\n  });\n  // Progress: report writes + outbox append in one tx; content supplies the\n  // structure and completion rules the service evaluates against.\n  const progressUow = new DrizzleUnitOfWork(db, (tx) => ({\n    progress: new DrizzleProgressRepository(tx, progressLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const progress = new ProgressServiceImpl({\n    repo: new DrizzleProgressRepository(db, progressLogger),\n    content,\n    access: entitlements,\n    uow: progressUow,\n    logger: progressLogger,\n  });\n\n  const postReads = new DrizzlePostRepository(db, discussionLogger);\n  const discussionReads = new DrizzleDiscussionRepository(db, discussionLogger);\n  const chatReads = new DrizzleChatRepository(db, discussionLogger);\n  const posts = new PostServiceImpl({\n    repo: postReads,\n    access: entitlements,\n    content,\n    authors,\n    profiles: discussionReads,\n    comments: discussionReads,\n    images: assets,\n    fileUrls,\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      posts: new DrizzlePostRepository(tx, discussionLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    logger: discussionLogger,\n  });\n  const chats = new ChatServiceImpl({\n    repo: chatReads,\n    access: entitlements,\n    content,\n    authors,\n    profiles: discussionReads,\n    images: assets,\n    fileUrls,\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      chats: new DrizzleChatRepository(tx, discussionLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    logger: discussionLogger,\n  });\n  const discussion = new DiscussionServiceImpl({\n    repo: discussionReads,\n    access: entitlements,\n    content: content,\n    posts,\n    communities: { listIds: (orgId) => content.listPublishedCommunityIds(orgId) },\n    fileUrls,\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      discussion: new DrizzleDiscussionRepository(tx, discussionLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    settings,\n    logger: discussionLogger,\n  });\n\n  const reporting = {\n    admin: new AdminReportServiceImpl({\n      repo: new DrizzleAdminRepository(db, reportingLogger),\n    }),\n    member: new MemberReportServiceImpl({\n      repo: new DrizzleMemberRepository(db, reportingLogger),\n      content,\n      progress,\n      files: assets,\n      fileUrls,\n      access: entitlements,\n      notifications,\n      posts,\n      chats,\n    }),\n  };\n\n  const credentialStore = new DrizzleCredentialStore(\n    db,\n    config.credentialStoreKey,\n    integrationsLogger,\n  );\n  // The integrations this deployment supports: the installation's declared\n  // plugins folder (directory name = integration id), loaded at startup.\n  // Connect/configure reject undeclared ids and validate config with the\n  // integration's own schema. No folder → no integrations.\n  const integrationsRegistry = await loadIntegrations(options?.pluginsDir, integrationsLogger);\n  // Integrations: credential + connection writes + outbox append in one tx\n  // (a tx-bound credential store instance shares the scope's transaction).\n  const integrationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    connections: new DrizzleConnectionsRepository(tx, integrationsLogger),\n    credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, integrationsLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const integrations = new IntegrationsServiceImpl({\n    registry: integrationsRegistry,\n    repo: new DrizzleConnectionsRepository(db, integrationsLogger),\n    uow: integrationsUow,\n    credentials: credentialStore,\n    logger: integrationsLogger,\n  });\n\n  // Automations: run writes + outbox append in one tx; the engine drives\n  // execution (register below), integrations supplies the loaded\n  // integrations' actions for `available`.\n  const automationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    automations: new DrizzleAutomationsRepository(tx, automationsLogger),\n    runs: new DrizzleAutomationRunsRepository(tx, automationsLogger),\n    credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, automationsLogger),\n    outbox: new DrizzleOutboxAppender(tx, automationsLogger),\n  }));\n  // Emails triggered by row-shaped events resolve their recipient and content\n  // details at send time — the event carries ids only.\n  const mailerLookups: MailerLookups = {\n    orgUserPerson: async (orgId, orgUserId) => {\n      const orgUser = await organizationsRepo.findOrgUserById(orgId, orgUserId);\n      const user = orgUser ? await identity.getUserById(orgUser.userId) : null;\n      return user ? { userId: user.id, email: user.email } : null;\n    },\n    contentInfo: async (orgId, contentId) => {\n      const course = await content.getCourse(orgId, contentId);\n      if (course) {\n        return { id: course.id, title: course.title, type: course.type };\n      }\n      const download = await content.getDownload(orgId, contentId);\n      if (download) {\n        return { id: download.id, title: download.title, type: download.type };\n      }\n      const community = await content.getCommunity(orgId, contentId);\n      return community ? { id: community.id, title: community.title, type: community.type } : null;\n    },\n  };\n\n  const runsRepo = new DrizzleAutomationRunsRepository(db, automationsLogger);\n  const wired = communityMail({\n    content,\n    entitlements,\n    organizations,\n    identity,\n    posts,\n    discussion,\n    chats,\n    assets,\n  });\n  const automations = new AutomationsServiceImpl({\n    repo: new DrizzleAutomationsRepository(db, automationsLogger),\n    runsRepo,\n    uow: automationsUow,\n    engine: automationEngine,\n    mailer,\n    lookups: mailerLookups,\n    integrations,\n    credentials: credentialStore,\n    webhooks:\n      options?.adapters?.webhooks ??\n      new FetchWebhookSender({ allowPrivateNetwork: config.webhookAllowPrivateNetwork }),\n    mail: wired.mail,\n    grants: wired.grants,\n    desk: notifications,\n    scheduledWork: wired.scheduledWork,\n    logger: automationsLogger,\n  });\n  automationEngine.register(automations);\n\n  const eventBus = new InMemoryEventBus();\n  eventBus.subscribeAll((event) => automations.handle(event));\n  const outboxConfig = resolveOutboxConfig(config.outbox);\n  const outboxRelay = new PollingOutboxRelay(\n    new DrizzleOutboxStore(db, outboxLogger),\n    eventBus,\n    outboxConfig,\n    outboxLogger,\n  );\n\n  /*\n   * Auth Adapter\n   */\n  const authLogger = logger.child({ name: 'auth' });\n  // Hook failures otherwise surface through Better Auth's route as an opaque\n  // 500 — log which hook died before rethrowing.\n  const authHook =\n    <A extends unknown[], R>(name: string, fn: (...args: A) => Promise<R>) =>\n    async (...args: A): Promise<R> => {\n      try {\n        return await fn(...args);\n      } catch (err) {\n        authLogger.error(`auth hook ${name} failed`, { err });\n        throw err;\n      }\n    };\n  const mcp = mcpEndpoints(config);\n  if (!mcp.oauthEnabled) {\n    authLogger.warn(\n      'MCP OAuth is off: BETTER_AUTH_URL must be https or a loopback host; /mcp accepts API keys only',\n      { authBaseURL: config.authBaseURL },\n    );\n  }\n  const auth = new BetterAuth({\n    db,\n    baseUrl: config.authBaseURL,\n    mcp: {\n      oauthEnabled: mcp.oauthEnabled,\n      resource: mcp.resource,\n      loginPage: mcp.loginPage,\n      consentPage: mcp.consentPage,\n      orgPickerPage: mcp.orgPickerPage,\n    },\n    secret: config.authSecret,\n    trustedOrigins: config.trustedOrigins,\n    hooks: {\n      sendResetPassword: async ({ user, url }) => {\n        await identity.sendPasswordReset({ email: user.email, url });\n      },\n      onPasswordReset: async ({ user }) => {\n        await identity.sendPasswordChanged({ email: user.email });\n      },\n      sendMagicLink: authHook('sendMagicLink', async ({ email, url }) => {\n        await identity.sendMagicLink({\n          email,\n          url,\n        });\n      }),\n      beforeUserCreate: authHook('beforeUserCreate', async (user) => {\n        const { email, name } = user;\n        const [firstName, lastName] = name.split(' ');\n        // Better Auth has not minted an id yet — the id returned below becomes\n        // its account id. A person provisioned at invite time is linked instead of re-created.\n        const domainUser = await identity.linkOrCreateUser({\n          email,\n          ...(firstName !== undefined && { firstName }),\n          ...(lastName !== undefined && { lastName }),\n        });\n\n        return {\n          data: {\n            ...user,\n            id: domainUser.id,\n          },\n        };\n      }),\n      beforeCreateSession: authHook('beforeCreateSession', async (session) => {\n        const person = await identity.getUserByExternalId(session.userId);\n        if (!person) {\n          return;\n        }\n        const orgs = await organizations.getOrgUsersForUser(person.id);\n        if (orgs.length !== 1) {\n          return;\n        }\n        // TODO - fix, why default to the first?\n        const org = await organizations.getById(orgs[0]!.orgId);\n        if (!org) {\n          return;\n        }\n\n        return { data: { ...session, activeOrganizationId: org.id } };\n      }),\n      /*\n       * We're making sure the domain org creates and using the same ID for better-auth org ID.\n       */\n      beforeCreateOrganization: authHook(\n        'beforeCreateOrganization',\n        async ({ organization: org, user: baUser }) => {\n          const domainOrg = await organizations.createOrganization({\n            ownerId: baUser.id,\n            ...org,\n            logo: org.logo ?? undefined,\n          });\n          return { data: { ...org, id: domainOrg.id } };\n        },\n      ),\n      beforeUpdateOrganization: authHook('beforeUpdateOrganization', async ({ organization }) => {\n        await organizations.updateOrganization(organization.id, organization);\n      }),\n      beforeDeleteOrganization: authHook('beforeDeleteOrganization', async ({ organization }) => {\n        await organizations.deleteOrganization(organization.id);\n      }),\n      beforeAddMember: authHook('beforeAddMember', async ({ member }) => {\n        await organizations.addOrgUser({\n          orgId: member.organizationId,\n          userId: member.userId,\n          role: parseRole(member.role),\n        });\n      }),\n      beforeUpdateMemberRole: authHook('beforeUpdateMemberRole', async ({ member, newRole }) => {\n        await organizations.updateOrgUser(member.organizationId, member.userId, {\n          role: parseRole(newRole),\n        });\n      }),\n      beforeRemoveMember: authHook('beforeRemoveMember', async ({ member }) => {\n        await organizations.removeOrgUser(member.organizationId, member.userId);\n      }),\n    },\n    logger: authLogger,\n    cookieDomain: config.cookieDomain,\n    secureCookies: config.secureCookies,\n  });\n  orgAdminRef.current = auth;\n\n  return {\n    auth,\n    mcp,\n    identity,\n    notifications,\n    organizations,\n    // Better Auth owns org writes; the same instance fulfils the OrgAdmin port.\n    orgProvider: auth,\n    content,\n    entitlements,\n    progress,\n    discussion,\n    posts,\n    chats,\n    assets,\n    integrations,\n    automations,\n    settings,\n    reporting,\n    storage,\n    mailer,\n    credentials: credentialStore,\n    outboxRelay,\n    automationEngine,\n    logger,\n    loggerInstance,\n    requestContext: requestLogContext,\n    // Better Auth owns the session store; the same instance fulfils SessionAdmin.\n    sessions: auth,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA8IA,MAAa,kBAA4C;CACvD,SAAS;CACT,gBAAgB;CAChB,WAAW;AACb;AAEA,SAAgB,oBAAoB,SAAuB,CAAC,GAA6B;CACvF,MAAM,YAAY,OAAO,YACvB,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAClE;CACA,OAAO;EAAE,GAAG;EAAiB,GAAG;CAAU;AAC5C;AAQA,MAAa,mBAA4C,EAAE,OAAO,OAAO;AAEzE,SAAgB,qBAAqB,SAAwB,CAAC,GAA4B;CACxF,OAAO,EAAE,OAAO,OAAO,SAAS,iBAAiB,MAAM;AACzD;AAmDA,eAAsB,eACpB,QACA,SACoB;CACpB,MAAM,EAAE,UAAU,gBAAgB,WAAW,iBAC3C,qBAAqB,OAAO,OAAO,CAAC,CAAC,KACvC;CAGA,MAAM,gBAAgB,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC;CACtD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,iBAAiB,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;CACxD,MAAM,mBAAmB,OAAO,MAAM,EAAE,MAAM,aAAa,CAAC;CAC5D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CACpD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,oBAAoB,OAAO,MAAM,EAAE,MAAM,cAAc,CAAC;CAC9D,MAAM,kBAAkB,OAAO,MAAM,EAAE,MAAM,YAAY,CAAC;CAC1D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CAGpD,MAAM,KAAK,SAAS,OAAO,WAAW;CACtC,MAAM,QAAQ,SAAS,UAAU,SAAS,IAAI,aAAa,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,UACJ,SAAS,UAAU,WAAW,IAAI,eAAe,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC,CAAC;CACpF,MAAM,YACJ,SAAS,UAAU,aAAa,IAAI,qBAAqB,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,YAAY,SAAS,UAAU;CACrC,MAAM,mBACJ,OAAO,cAAc,aACjB,UAAU,iBAAiB,IAC1B,aAAa,IAAI,uBAAuB,iBAAiB;CAChE,MAAM,SAAS,IAAI,OAAO,WAAW,OAAO;EAC1C,GAAI,OAAO,iBAAiB;GAAE,WAAW;GAAgB,SAAS,OAAO;EAAY;EACrF,kBAAkB,OAAO;CAC3B,CAAC;CAED,MAAM,WAAW,eAAe,OAAO,WAAW;CAClD,MAAM,SAAS,IAAI,kBAAkB;EACnC;EACA,MAAM,IAAI,wBAAwB,IAAI,YAAY;EAClD,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,QAAQ,IAAI,wBAAwB,IAAI,YAAY;GACpD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,qBAAqB,OAAO;EAC5B,2BAA2B,OAAO;EAClC;EACA,QAAQ;CACV,CAAC;CAKD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;EAC9E,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;CAC1E,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,gBAAgB,CAAC,CAAC;EAC/E,QAAQ,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;EACzC,KAAK;EACL;EACA,QAAQ;EACR;CACF,CAAC;CACD,MAAM,gBAAgB,IAAI,wBAAwB;EAChD,MAAM,IAAI,+BAA+B,EAAE;EAC3C,QAAQ,OAAO,MAAM,EAAE,MAAM,gBAAgB,CAAC;CAChD,CAAC;CAKD,MAAM,oBAAoB,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;CAC9F,MAAM,mBAAmB,IAAI,kBAAkB,KAAK,QAAQ;EAC1D,eAAe,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EACnF,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;CACrE,EAAE;CACF,MAAM,cAAiD,EAAE,SAAS,KAAA,EAAU;CAC5E,MAAM,gBAAgB,IAAI,wBAAwB;EAChD,MAAM;EACN,aAAa,IAAI,yBAAyB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EAC3E,QAAQ;EACR,KAAK;EACL,gBAAgB;GACd,IAAI,CAAC,YAAY,SACf,MAAM,IAAI,MAAM,0BAA0B;GAE5C,OAAO,YAAY;EACrB;EACA,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC;EACpC;EACA,YAAY;GAAE,kBAAkB,OAAO;GAAkB,aAAa,OAAO;EAAY;CAC3F,CAAC;CAKD,MAAM,WAAW,IAAI,gBACnB,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,CACtE;CAEA,MAAM,aAAa,IAAI,kBAAkB,KAAK,QAAQ;EACpD,SAAS,IAAI,yBAAyB,IAAI,aAAa;EACvD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,UAAU,IAAI,eAAe;EACjC,MAAM,IAAI,yBAAyB,IAAI,aAAa;EACpD,KAAK;EACL,eAAe;EACf,OAAO;EACP;EACA,QAAQ;CACV,CAAC;CAED,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,cAAc,IAAI,8BAA8B,IAAI,kBAAkB;EACtE,QAAQ,IAAI,yBAAyB,IAAI,aAAa;EACtD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,UAAU;EACd,QAAQ,OAAO,OAAe,cAAsB;GAElD,QAAO,MADW,kBAAkB,gBAAgB,OAAO,SAAS,EAAA,EACxD,QAAQ;EACtB;EACA,SAAS,OAAO,OAAe,eAAyB;GACtD,MAAM,OAAO,MAAM,kBAAkB,kBAAkB,OAAO,UAAU;GACxE,OAAO,OAAO,YAAY,KAAK,KAAK,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC;EACjE;CACF;CAEA,MAAM,eAAe,IAAI,wBAAwB;EAC/C,MAAM,IAFqB,8BAA8B,IAAI,kBAExC;EACrB;EACA,KAAK;EACL,QAAQ;CACV,CAAC;CAGD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,cAAc;EAC1D,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,cAAc;EACtD;EACA,QAAQ;EACR,KAAK;EACL,QAAQ;CACV,CAAC;CAED,MAAM,YAAY,IAAI,sBAAsB,IAAI,gBAAgB;CAChE,MAAM,kBAAkB,IAAI,4BAA4B,IAAI,gBAAgB;CAC5E,MAAM,YAAY,IAAI,sBAAsB,IAAI,gBAAgB;CAChE,MAAM,QAAQ,IAAI,gBAAgB;EAChC,MAAM;EACN,QAAQ;EACR;EACA;EACA,UAAU;EACV,UAAU;EACV,QAAQ;EACR;EACA,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,OAAO,IAAI,sBAAsB,IAAI,gBAAgB;GACrD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,QAAQ;CACV,CAAC;CACD,MAAM,QAAQ,IAAI,gBAAgB;EAChC,MAAM;EACN,QAAQ;EACR;EACA;EACA,UAAU;EACV,QAAQ;EACR;EACA,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,OAAO,IAAI,sBAAsB,IAAI,gBAAgB;GACrD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,QAAQ;CACV,CAAC;CACD,MAAM,aAAa,IAAI,sBAAsB;EAC3C,MAAM;EACN,QAAQ;EACC;EACT;EACA,aAAa,EAAE,UAAU,UAAU,QAAQ,0BAA0B,KAAK,EAAE;EAC5E;EACA,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,YAAY,IAAI,4BAA4B,IAAI,gBAAgB;GAChE,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF;EACA,QAAQ;CACV,CAAC;CAED,MAAM,YAAY;EAChB,OAAO,IAAI,uBAAuB,EAChC,MAAM,IAAI,uBAAuB,IAAI,eAAe,EACtD,CAAC;EACD,QAAQ,IAAI,wBAAwB;GAClC,MAAM,IAAI,wBAAwB,IAAI,eAAe;GACrD;GACA;GACA,OAAO;GACP;GACA,QAAQ;GACR;GACA;GACA;EACF,CAAC;CACH;CAEA,MAAM,kBAAkB,IAAI,uBAC1B,IACA,OAAO,oBACP,kBACF;CAKA,MAAM,uBAAuB,MAAM,iBAAiB,SAAS,YAAY,kBAAkB;CAG3F,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,aAAa,IAAI,6BAA6B,IAAI,kBAAkB;EACpE,aAAa,IAAI,uBAAuB,IAAI,OAAO,oBAAoB,kBAAkB;EACzF,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,eAAe,IAAI,wBAAwB;EAC/C,UAAU;EACV,MAAM,IAAI,6BAA6B,IAAI,kBAAkB;EAC7D,KAAK;EACL,aAAa;EACb,QAAQ;CACV,CAAC;CAKD,MAAM,iBAAiB,IAAI,kBAAkB,KAAK,QAAQ;EACxD,aAAa,IAAI,6BAA6B,IAAI,iBAAiB;EACnE,MAAM,IAAI,gCAAgC,IAAI,iBAAiB;EAC/D,aAAa,IAAI,uBAAuB,IAAI,OAAO,oBAAoB,iBAAiB;EACxF,QAAQ,IAAI,sBAAsB,IAAI,iBAAiB;CACzD,EAAE;CAGF,MAAM,gBAA+B;EACnC,eAAe,OAAO,OAAO,cAAc;GACzC,MAAM,UAAU,MAAM,kBAAkB,gBAAgB,OAAO,SAAS;GACxE,MAAM,OAAO,UAAU,MAAM,SAAS,YAAY,QAAQ,MAAM,IAAI;GACpE,OAAO,OAAO;IAAE,QAAQ,KAAK;IAAI,OAAO,KAAK;GAAM,IAAI;EACzD;EACA,aAAa,OAAO,OAAO,cAAc;GACvC,MAAM,SAAS,MAAM,QAAQ,UAAU,OAAO,SAAS;GACvD,IAAI,QACF,OAAO;IAAE,IAAI,OAAO;IAAI,OAAO,OAAO;IAAO,MAAM,OAAO;GAAK;GAEjE,MAAM,WAAW,MAAM,QAAQ,YAAY,OAAO,SAAS;GAC3D,IAAI,UACF,OAAO;IAAE,IAAI,SAAS;IAAI,OAAO,SAAS;IAAO,MAAM,SAAS;GAAK;GAEvE,MAAM,YAAY,MAAM,QAAQ,aAAa,OAAO,SAAS;GAC7D,OAAO,YAAY;IAAE,IAAI,UAAU;IAAI,OAAO,UAAU;IAAO,MAAM,UAAU;GAAK,IAAI;EAC1F;CACF;CAEA,MAAM,WAAW,IAAI,gCAAgC,IAAI,iBAAiB;CAC1E,MAAM,QAAQ,cAAc;EAC1B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,MAAM,cAAc,IAAI,uBAAuB;EAC7C,MAAM,IAAI,6BAA6B,IAAI,iBAAiB;EAC5D;EACA,KAAK;EACL,QAAQ;EACR;EACA,SAAS;EACT;EACA,aAAa;EACb,UACE,SAAS,UAAU,YACnB,IAAI,mBAAmB,EAAE,qBAAqB,OAAO,2BAA2B,CAAC;EACnF,MAAM,MAAM;EACZ,QAAQ,MAAM;EACd,MAAM;EACN,eAAe,MAAM;EACrB,QAAQ;CACV,CAAC;CACD,iBAAiB,SAAS,WAAW;CAErC,MAAM,WAAW,IAAI,iBAAiB;CACtC,SAAS,cAAc,UAAU,YAAY,OAAO,KAAK,CAAC;CAC1D,MAAM,eAAe,oBAAoB,OAAO,MAAM;CACtD,MAAM,cAAc,IAAI,mBACtB,IAAI,mBAAmB,IAAI,YAAY,GACvC,UACA,cACA,YACF;CAKA,MAAM,aAAa,OAAO,MAAM,EAAE,MAAM,OAAO,CAAC;CAGhD,MAAM,YACqB,MAAc,OACvC,OAAO,GAAG,SAAwB;EAChC,IAAI;GACF,OAAO,MAAM,GAAG,GAAG,IAAI;EACzB,SAAS,KAAK;GACZ,WAAW,MAAM,aAAa,KAAK,UAAU,EAAE,IAAI,CAAC;GACpD,MAAM;EACR;CACF;CACF,MAAM,MAAM,aAAa,MAAM;CAC/B,IAAI,CAAC,IAAI,cACP,WAAW,KACT,kGACA,EAAE,aAAa,OAAO,YAAY,CACpC;CAEF,MAAM,OAAO,IAAI,WAAW;EAC1B;EACA,SAAS,OAAO;EAChB,KAAK;GACH,cAAc,IAAI;GAClB,UAAU,IAAI;GACd,WAAW,IAAI;GACf,aAAa,IAAI;GACjB,eAAe,IAAI;EACrB;EACA,QAAQ,OAAO;EACf,gBAAgB,OAAO;EACvB,OAAO;GACL,mBAAmB,OAAO,EAAE,MAAM,UAAU;IAC1C,MAAM,SAAS,kBAAkB;KAAE,OAAO,KAAK;KAAO;IAAI,CAAC;GAC7D;GACA,iBAAiB,OAAO,EAAE,WAAW;IACnC,MAAM,SAAS,oBAAoB,EAAE,OAAO,KAAK,MAAM,CAAC;GAC1D;GACA,eAAe,SAAS,iBAAiB,OAAO,EAAE,OAAO,UAAU;IACjE,MAAM,SAAS,cAAc;KAC3B;KACA;IACF,CAAC;GACH,CAAC;GACD,kBAAkB,SAAS,oBAAoB,OAAO,SAAS;IAC7D,MAAM,EAAE,OAAO,SAAS;IACxB,MAAM,CAAC,WAAW,YAAY,KAAK,MAAM,GAAG;IAG5C,MAAM,aAAa,MAAM,SAAS,iBAAiB;KACjD;KACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;KAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;IAC3C,CAAC;IAED,OAAO,EACL,MAAM;KACJ,GAAG;KACH,IAAI,WAAW;IACjB,EACF;GACF,CAAC;GACD,qBAAqB,SAAS,uBAAuB,OAAO,YAAY;IACtE,MAAM,SAAS,MAAM,SAAS,oBAAoB,QAAQ,MAAM;IAChE,IAAI,CAAC,QACH;IAEF,MAAM,OAAO,MAAM,cAAc,mBAAmB,OAAO,EAAE;IAC7D,IAAI,KAAK,WAAW,GAClB;IAGF,MAAM,MAAM,MAAM,cAAc,QAAQ,KAAK,EAAE,CAAE,KAAK;IACtD,IAAI,CAAC,KACH;IAGF,OAAO,EAAE,MAAM;KAAE,GAAG;KAAS,sBAAsB,IAAI;IAAG,EAAE;GAC9D,CAAC;GAID,0BAA0B,SACxB,4BACA,OAAO,EAAE,cAAc,KAAK,MAAM,aAAa;IAC7C,MAAM,YAAY,MAAM,cAAc,mBAAmB;KACvD,SAAS,OAAO;KAChB,GAAG;KACH,MAAM,IAAI,QAAQ,KAAA;IACpB,CAAC;IACD,OAAO,EAAE,MAAM;KAAE,GAAG;KAAK,IAAI,UAAU;IAAG,EAAE;GAC9C,CACF;GACA,0BAA0B,SAAS,4BAA4B,OAAO,EAAE,mBAAmB;IACzF,MAAM,cAAc,mBAAmB,aAAa,IAAI,YAAY;GACtE,CAAC;GACD,0BAA0B,SAAS,4BAA4B,OAAO,EAAE,mBAAmB;IACzF,MAAM,cAAc,mBAAmB,aAAa,EAAE;GACxD,CAAC;GACD,iBAAiB,SAAS,mBAAmB,OAAO,EAAE,aAAa;IACjE,MAAM,cAAc,WAAW;KAC7B,OAAO,OAAO;KACd,QAAQ,OAAO;KACf,MAAM,UAAU,OAAO,IAAI;IAC7B,CAAC;GACH,CAAC;GACD,wBAAwB,SAAS,0BAA0B,OAAO,EAAE,QAAQ,cAAc;IACxF,MAAM,cAAc,cAAc,OAAO,gBAAgB,OAAO,QAAQ,EACtE,MAAM,UAAU,OAAO,EACzB,CAAC;GACH,CAAC;GACD,oBAAoB,SAAS,sBAAsB,OAAO,EAAE,aAAa;IACvE,MAAM,cAAc,cAAc,OAAO,gBAAgB,OAAO,MAAM;GACxE,CAAC;EACH;EACA,QAAQ;EACR,cAAc,OAAO;EACrB,eAAe,OAAO;CACxB,CAAC;CACD,YAAY,UAAU;CAEtB,OAAO;EACL;EACA;EACA;EACA;EACA;EAEA,aAAa;EACb;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA;EACA;EACA;EACA,gBAAgB;EAEhB,UAAU;CACZ;AACF"}
+{"version":3,"file":"container.js","names":[],"sources":["../../src/app/container.ts"],"sourcesContent":["// Wires adapters + services in dependency order. Starts nothing.\nimport {\n  createDb,\n  type DatabasePoolOptions,\n  DrizzleAssetsRepository,\n  DrizzleAutomationRunsRepository,\n  DrizzleAutomationsRepository,\n  DrizzleConnectionsRepository,\n  DrizzleContentRepository,\n  DrizzleCredentialStore,\n  DrizzleAdminRepository,\n  DrizzleDigestRunRepository,\n  DrizzleDevicesRepository,\n  DrizzleDiscussionRepository,\n  DrizzlePostRepository,\n  DrizzleChatRepository,\n  DrizzleEntitlementsRepository,\n  DrizzleIdentityRepository,\n  DrizzleMemberRepository,\n  DrizzleMembersRepository,\n  DrizzleMentionsRepository,\n  DrizzleNotificationsRepository,\n  DrizzleNotificationSettingsRepository,\n  DrizzleOrganizationsRepository,\n  DrizzleRolesRepository,\n  DrizzleOutboxAppender,\n  DrizzleOutboxStore,\n  DrizzleProgressRepository,\n  DrizzleSettingsRepository,\n  DrizzleSubscriptionsRepository,\n  DrizzleUnitOfWork,\n} from '@headless-lms/adapter-db';\nimport { InMemoryEventBus } from '@headless-lms/adapter-defaults/events';\nimport {\n  PollingOutboxRelay,\n  type PollingOutboxRelayConfig,\n} from '@headless-lms/adapter-defaults/events/outbox-relay';\nimport { InlineAutomationEngine } from '@headless-lms/adapter-defaults/workflows';\nimport { FetchWebhookSender } from '@headless-lms/adapter-defaults/webhooks';\nimport { EmailAdapter, StubTemplateRenderer } from '@headless-lms/adapter-defaults/email';\nimport {\n  createRootLogger,\n  type LogLevel,\n  type PinoInstance,\n  requestLogContext,\n  type RequestLogContext,\n} from '@headless-lms/adapter-defaults/logging';\nimport { StorageAdapter } from '@headless-lms/adapter-defaults/storage';\nimport { PlainBodyParser } from '@headless-lms/adapter-defaults/body';\nimport { BetterAuth } from '@headless-lms/adapter-auth';\n\nimport {\n  CommunityNotificationCategories,\n  ContentItemTitles,\n  ContentService,\n  contentJobs,\n} from '@headless-lms/core/content';\nimport {\n  EntitlementsServiceImpl,\n  entitlementsJobs,\n  entitlementsRecurringJobs,\n} from '@headless-lms/core/entitlements';\nimport { ProgressServiceImpl } from '@headless-lms/core/progress';\nimport {\n  type ChatHub,\n  type ChatHubOptions,\n  ChatLiveForwarder,\n  ChatServiceImpl,\n  DigestServiceImpl,\n  DiscussionItemTitles,\n  DiscussionServiceImpl,\n  type AuthorPermissionReader,\n  PostServiceImpl,\n  SubscriptionServiceImpl,\n  discussionJobs,\n  discussionRecurringJobs,\n} from '@headless-lms/core/discussion';\nimport {\n  DevicesServiceImpl,\n  IdentityServiceImpl,\n  NotificationSettingsServiceImpl,\n  type SessionAdmin,\n} from '@headless-lms/core/identity';\nimport {\n  type ApiKeys,\n  type GrantReader,\n  type OrgAdmin,\n  NotificationCatalog,\n  OrganizationServiceImpl,\n  OrgNotificationCategories,\n  type RoleDefinition,\n} from '@headless-lms/core/organizations';\nimport {\n  AssetsServiceImpl,\n  assetsJobs,\n  assetsRecurringJobs,\n  createFileUrls,\n} from '@headless-lms/core/assets';\nimport { IntegrationsServiceImpl } from '@headless-lms/core/integrations';\nimport {\n  AutomationsServiceImpl,\n  DEFAULT_COMMUNITY_CATEGORIES,\n  DEFAULT_ORG_CATEGORIES,\n  NOTIFICATION_TYPES,\n  NotificationDelivery,\n  NotificationProcessor,\n  NotificationsServiceImpl,\n  RECIPIENT_RULES,\n  SchedulerChatDebounce,\n  notificationJobs,\n  type NotificationCategories,\n} from '@headless-lms/core/automations';\nimport { buildNotificationRegistries, configuredPushSender } from './notification-channels.js';\nimport { loadIntegrations } from './integrations.js';\nimport { mcpEndpoints, type McpEndpoints } from './mcp-endpoints.js';\nimport { communityMail } from './community-mail.js';\nimport { notificationReads } from './notification-reads.js';\nimport { AdminReportServiceImpl } from '@headless-lms/core/reporting/admin';\nimport { MemberReportServiceImpl } from '@headless-lms/core/reporting/member';\nimport { Mailer, type MailerLookups } from '@headless-lms/core/shared/mailer';\nimport { SettingsService } from '@headless-lms/core/shared/settings';\nimport { platformKeyCheck, type PlatformConfig, type PlatformKeyCheck } from './platform.js';\n\nimport type {\n  BodyParser,\n  ChannelRegistry,\n  CredentialStore,\n  EmailSender,\n  Logger,\n  NotificationChannel,\n  NotificationTypeRegistry,\n  ObjectStorage,\n  OutboxRelay,\n  PubSub,\n  PushSender,\n  Scheduler,\n  TemplateContext,\n  TemplateRenderer,\n} from '@headless-lms/core/shared/ports';\nimport type { AutomationEngine, PushConfig, WebhookSender } from '@headless-lms/core/types';\n\n/** Installation-supplied ports; an absent slot falls back to a fail-loudly stub. */\nexport interface AdapterOverrides {\n  email?: EmailSender;\n  storage?: ObjectStorage;\n  /** Resolves email templates to rendered content. Absent → fail-loudly stub. */\n  templates?: TemplateRenderer;\n  /** Durable automation engine, or a factory given the automations logger. Absent → InlineAutomationEngine (in-process, one attempt per action). */\n  workflows?: (AutomationEngine & Scheduler) | ((logger: Logger) => AutomationEngine & Scheduler);\n  /** Outbound HTTP for webhook deliveries. Absent → FetchWebhookSender (public addresses only, 10s timeout). */\n  webhooks?: WebhookSender;\n  /** Notification channels beyond in-app, email and push; each key must be new. */\n  notificationChannels?: NotificationChannel[];\n  /** Push credentials per provider. Absent → no provider is configured and devices cannot register. */\n  push?: PushConfig;\n  pushSender?: PushSender;\n  /** Reads post bodies: their text, mentions and images. Absent → PlainBodyParser (plain text, no images). */\n  bodyParser?: BodyParser;\n  /** Delivery to every API instance, or a factory given its logger. Absent → no live chat; the chat stream answers 503. */\n  pubsub?: PubSub | ((logger: Logger) => PubSub);\n}\n\nexport interface BuildContainerOptions {\n  /** Installation's plugins folder, scanned by loadIntegrations. Absent → no integrations. */\n  pluginsDir?: string;\n  adapters?: AdapterOverrides;\n  roles?: readonly RoleDefinition[];\n  /** Live chat hub timings. Absent → the defaults (1 s state flush, 30 s session check). */\n  live?: ChatHubOptions;\n}\n\nexport interface Config {\n  databaseUrl: string;\n  databasePool?: DatabasePoolOptions;\n  authBaseURL: string;\n  authSecret: string;\n  trustedOrigins: string[];\n  /** Branding threaded into every email template. Default: brandName \"Headless LMS\", baseUrl = adminAppUrl.\n   *  (studentPortalUrl is composed in from the top-level config field.) */\n  emailBranding?: Omit<TemplateContext, 'studentPortalUrl'>;\n  /** base64-encoded 32-byte key for the credential store (CREDENTIAL_STORE_KEY). */\n  credentialStoreKey: string;\n  /** Parent domain for cross-subdomain session cookies (e.g. \".example.com\"); undefined → host-only cookie. */\n  cookieDomain?: string;\n  /** Mark session cookies Secure (set behind HTTPS / in production). */\n  secureCookies?: boolean;\n  /** Student portal origin — invite links for students, and the origin whose signups are invite-gated. */\n  studentPortalUrl: string;\n  /** Admin app origin — invite links for staff. */\n  adminAppUrl: string;\n  /** Transactional-outbox relay tuning. All optional — see OUTBOX_DEFAULTS. */\n  outbox?: OutboxConfig;\n  /** Log level for the process-wide logger (HTTP + domain + relay). Default \"info\". */\n  logging?: LoggingConfig;\n  /** Lifetime of every signed file URL a response carries, seconds. Mirrors\n   *  ServerConfig.deliveryExpirySeconds — createContainer threads it through. */\n  deliveryExpirySeconds: number;\n  memberImageMaxBytes: number;\n  memberFileMaxBytes: number;\n  /** Let the default webhook sender reach loopback and private network addresses. Local development only. */\n  webhookAllowPrivateNetwork?: boolean;\n  platform?: PlatformConfig;\n}\n\n/** Tuning for the transactional-outbox relay. Every field is optional; the\n *  container resolves against OUTBOX_DEFAULTS. */\nexport interface OutboxConfig {\n  /** Master switch for the same-process relay. Default true. */\n  enabled?: boolean;\n  /** Idle delay between polls. Default 1000. */\n  pollIntervalMs?: number;\n  /** Max rows fetched/dispatched per tick. Default 100. */\n  batchSize?: number;\n  concurrency?: number;\n}\n\nexport const OUTBOX_DEFAULTS: PollingOutboxRelayConfig = {\n  enabled: true,\n  pollIntervalMs: 1000,\n  batchSize: 100,\n  concurrency: 16,\n};\n\nexport function resolveOutboxConfig(config: OutboxConfig = {}): PollingOutboxRelayConfig {\n  const overrides = Object.fromEntries(\n    Object.entries(config).filter(([, value]) => value !== undefined),\n  );\n  return { ...OUTBOX_DEFAULTS, ...overrides };\n}\n\n/** Logging tuning. Optional; resolved against LOGGING_DEFAULTS. */\nexport interface LoggingConfig {\n  /** Minimum level emitted. Default \"info\". */\n  level?: LogLevel;\n}\n\nexport const LOGGING_DEFAULTS: Required<LoggingConfig> = { level: 'info' };\n\nexport function resolveLoggingConfig(config: LoggingConfig = {}): Required<LoggingConfig> {\n  return { level: config.level ?? LOGGING_DEFAULTS.level };\n}\n\nexport interface Container {\n  auth: BetterAuth;\n  mcp: McpEndpoints;\n  platform: PlatformKeyCheck | null;\n  // Org Provider\n  orgProvider: OrgAdmin;\n\n  // Domains\n  identity: IdentityServiceImpl;\n  organizations: OrganizationServiceImpl;\n  content: ContentService;\n  entitlements: EntitlementsServiceImpl;\n  progress: ProgressServiceImpl;\n  discussion: DiscussionServiceImpl;\n  posts: PostServiceImpl;\n  chats: ChatServiceImpl;\n  subscriptions: SubscriptionServiceImpl;\n  assets: AssetsServiceImpl;\n  integrations: IntegrationsServiceImpl;\n  automations: AutomationsServiceImpl;\n  notificationTypes: NotificationTypeRegistry;\n  notificationChannels: ChannelRegistry;\n  notificationCategories: {\n    community: CommunityNotificationCategories;\n    org: OrgNotificationCategories;\n  };\n  notificationCatalog: NotificationCatalog;\n  notificationCategoryLists: NotificationCategories;\n  notificationSettings: NotificationSettingsServiceImpl;\n  devices: DevicesServiceImpl;\n  notificationList: NotificationsServiceImpl;\n  /** Cross-cutting settings store. Not a context — a leaf every context may use;\n   *  inject `settings.for('<namespace>')` into a service, never the service itself. */\n  settings: SettingsService;\n  // Reporting read layer (composed cross-context reads; owns no domain rules).\n  reporting: {\n    admin: AdminReportServiceImpl;\n    member: MemberReportServiceImpl;\n  };\n  storage: ObjectStorage;\n  mailer: Mailer;\n  /** Shared secure credential store — encrypted at rest, org-scoped, decrypt at point of use. */\n  credentials: CredentialStore;\n  /** The outbox relay — constructed but NEVER started by the container; the\n   *  installation's entry point starts it after listen (gen-openapi must not\n   *  poll). buildServer stops it onClose. */\n  outboxRelay: OutboxRelay;\n  /** The automation engine — constructed but NEVER started by the container;\n   *  the installation's entry point starts it after listen (gen-openapi must\n   *  not run a worker). buildServer stops it onClose. */\n  automationEngine: AutomationEngine;\n  scheduler: Scheduler;\n  /** The PubSub adapter — constructed but NEVER started by the container; the\n   *  installation's entry point starts it after listen. buildServer stops it\n   *  onClose. Null without one. */\n  pubsub: PubSub | null;\n  /** This process's live chat hub; started by the entry point after `pubsub`,\n   *  closed by buildServer preClose. Null without a PubSub. */\n  chatHub: ChatHub | null;\n  /** Root logger port — components receive children bound with { name }. */\n  logger: Logger;\n  /** The raw pino root; buildServer hands it to Fastify so HTTP shares the stream. */\n  loggerInstance: PinoInstance;\n  /** Request-scoped log correlation; the HTTP layer enters it per request. */\n  requestContext: RequestLogContext;\n  /** Identity's session-write port; the auth adapter fulfils it. */\n  sessions: SessionAdmin;\n}\n\nexport async function buildContainer(\n  config: Config,\n  options?: BuildContainerOptions,\n): Promise<Container> {\n  const { instance: loggerInstance, logger } = createRootLogger(\n    resolveLoggingConfig(config.logging).level,\n  );\n  // One child per domain — a context's service and repositories share it.\n\n  const contentLogger = logger.child({ name: 'content' });\n  const entitlementsLogger = logger.child({ name: 'entitlements' });\n  const progressLogger = logger.child({ name: 'progress' });\n  const discussionLogger = logger.child({ name: 'discussion' });\n  const assetsLogger = logger.child({ name: 'assets' });\n  const integrationsLogger = logger.child({ name: 'integrations' });\n  const automationsLogger = logger.child({ name: 'automations' });\n  const reportingLogger = logger.child({ name: 'reporting' });\n  const outboxLogger = logger.child({ name: 'outbox' });\n\n  // Outbound adapters\n  const db = createDb(config.databaseUrl, logger.child({ name: 'db' }), config.databasePool);\n  const email = options?.adapters?.email ?? new EmailAdapter(logger.child({ name: 'email' }));\n  const storage: ObjectStorage =\n    options?.adapters?.storage ?? new StorageAdapter(logger.child({ name: 'storage' }));\n  const templates =\n    options?.adapters?.templates ?? new StubTemplateRenderer(logger.child({ name: 'email' }));\n  const bodies = options?.adapters?.bodyParser ?? new PlainBodyParser();\n  const workflows = options?.adapters?.workflows;\n  const automationEngine: AutomationEngine & Scheduler =\n    typeof workflows === 'function'\n      ? workflows(automationsLogger)\n      : (workflows ?? new InlineAutomationEngine(automationsLogger));\n  const pubsubOption = options?.adapters?.pubsub;\n  const pubsub: PubSub | null =\n    typeof pubsubOption === 'function'\n      ? pubsubOption(logger.child({ name: 'pubsub' }))\n      : (pubsubOption ?? null);\n  const mailer = new Mailer(templates, email, {\n    ...(config.emailBranding ?? { brandName: 'Headless LMS', baseUrl: config.adminAppUrl }),\n    studentPortalUrl: config.studentPortalUrl,\n  });\n\n  const fileUrls = createFileUrls(config.authBaseURL, (key) => storage.publicUrl(key));\n  const assets = new AssetsServiceImpl({\n    storage,\n    repo: new DrizzleAssetsRepository(db, assetsLogger),\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      assets: new DrizzleAssetsRepository(tx, assetsLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    memberImageMaxBytes: config.memberImageMaxBytes,\n    memberFileMaxBytes: config.memberFileMaxBytes,\n    downloadLinkExpirySeconds: config.deliveryExpirySeconds,\n    fileUrls,\n    logger: assetsLogger,\n  });\n\n  /*\n   * Identity\n   */\n  const identityUoW = new DrizzleUnitOfWork(db, (tx) => ({\n    identity: new DrizzleIdentityRepository(tx, logger.child({ name: 'identity' })),\n    outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'identity' })),\n  }));\n  const identity = new IdentityServiceImpl({\n    repo: new DrizzleIdentityRepository(db, logger.child({ name: 'identity_repo' })),\n    logger: logger.child({ name: 'identity' }),\n    uow: identityUoW,\n    mailer,\n    images: assets,\n    fileUrls,\n  });\n\n  /*\n   * Organization\n   */\n  const organizationsRepo = new DrizzleOrganizationsRepository(db, logger.child({ name: 'org' }));\n  const organizationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    organizations: new DrizzleOrganizationsRepository(tx, logger.child({ name: 'org' })),\n    roles: new DrizzleRolesRepository(tx),\n    outbox: new DrizzleOutboxAppender(tx, logger.child({ name: 'org' })),\n  }));\n  const orgAdminRef: { current: BetterAuth | undefined } = { current: undefined };\n  const platform = config.platform ? platformKeyCheck(config.platform) : null;\n  const organizations: OrganizationServiceImpl = new OrganizationServiceImpl({\n    repo: organizationsRepo,\n    roles: new DrizzleRolesRepository(db),\n    ...(options?.roles && { defaultRoles: options.roles }),\n    apiKeys: (): ApiKeys => {\n      if (!orgAdminRef.current) {\n        throw new Error('api keys not initialised');\n      }\n      return orgAdminRef.current;\n    },\n    accounts: () => {\n      if (!orgAdminRef.current) {\n        throw new Error('accounts not initialised');\n      }\n      return orgAdminRef.current;\n    },\n    ...(config.platform && {\n      platform: {\n        email: config.platform.accountEmail,\n        name: config.platform.accountName ?? 'Platform',\n      },\n    }),\n    membersRepo: new DrizzleMembersRepository(db, logger.child({ name: 'org' })),\n    people: identity,\n    images: assets,\n    uow: organizationsUow,\n    orgAdmin: () => {\n      if (!orgAdminRef.current) {\n        throw new Error('orgAdmin not initialised');\n      }\n      return orgAdminRef.current;\n    },\n    sessions: () => {\n      if (!orgAdminRef.current) {\n        throw new Error('sessions not initialised');\n      }\n      return orgAdminRef.current;\n    },\n    logger: logger.child({ name: 'org' }),\n    mailer,\n    inviteUrls: { studentPortalUrl: config.studentPortalUrl, adminAppUrl: config.adminAppUrl },\n    grants: (): GrantReader => entitlements,\n  });\n\n  /*\n   * Settings\n   */\n  const settings = new SettingsService(\n    new DrizzleSettingsRepository(db, logger.child({ name: 'settings' })),\n  );\n  // Content: reads on the root db; course writes + outbox append in one tx.\n  const contentUow = new DrizzleUnitOfWork(db, (tx) => ({\n    content: new DrizzleContentRepository(tx, contentLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const content = new ContentService({\n    repo: new DrizzleContentRepository(db, contentLogger),\n    uow: contentUow,\n    libraryAssets: assets,\n    files: assets,\n    fileUrls,\n    scheduler: automationEngine,\n    logger: contentLogger,\n  });\n  const pushConfig = options?.adapters?.push ?? {};\n  const pushSender = configuredPushSender(pushConfig, options?.adapters?.pushSender);\n  const notificationRegistries = buildNotificationRegistries({\n    declarations: NOTIFICATION_TYPES,\n    defaults: { community: DEFAULT_COMMUNITY_CATEGORIES, org: DEFAULT_ORG_CATEGORIES },\n    mailer: options?.adapters?.email ? mailer : null,\n    emailOf: async (_orgId, userId) => (await identity.getUserById(userId))?.email ?? null,\n    push: pushSender\n      ? {\n          sender: pushSender,\n          activeDevices: (orgId, userId, since) => devices.activeDevices(orgId, userId, since),\n        }\n      : null,\n    channels: options?.adapters?.notificationChannels ?? [],\n  });\n  const notificationCategories = {\n    community: new CommunityNotificationCategories({\n      communities: new DrizzleContentRepository(db, contentLogger),\n      settings,\n      types: notificationRegistries.types,\n      channels: notificationRegistries.channels,\n      logger: contentLogger,\n    }),\n    org: new OrgNotificationCategories({\n      settings,\n      types: notificationRegistries.types,\n      channels: notificationRegistries.channels,\n      logger: logger.child({ name: 'org' }),\n    }),\n  };\n  const notificationCatalog = new NotificationCatalog({\n    types: notificationRegistries.types,\n    channels: notificationRegistries.channels,\n  });\n  const notificationCategoryLists: NotificationCategories = {\n    listFor: async (orgId, communityId) =>\n      (communityId\n        ? await notificationCategories.community.get(communityId, organizations.systemActor(orgId))\n        : await notificationCategories.org.get(orgId, organizations.systemActor(orgId))\n      ).categories,\n  };\n  // Entitlements: reads on the root db; writes + outbox append in one tx.\n  const entitlementsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    entitlements: new DrizzleEntitlementsRepository(tx, entitlementsLogger),\n    spaces: new DrizzleContentRepository(tx, contentLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const authors: AuthorPermissionReader = organizations;\n  const entitlementsRepo = new DrizzleEntitlementsRepository(db, entitlementsLogger);\n  const entitlements = new EntitlementsServiceImpl({\n    repo: entitlementsRepo,\n    content,\n    permissions: organizations,\n    uow: entitlementsUow,\n    logger: entitlementsLogger,\n  });\n  const identityLogger = logger.child({ name: 'identity' });\n  const notificationSettings = new NotificationSettingsServiceImpl({\n    repo: new DrizzleNotificationSettingsRepository(db, identityLogger),\n    categories: {\n      communityList: async (orgId, communityId) =>\n        (await notificationCategories.community.get(communityId, organizations.systemActor(orgId)))\n          .categories,\n      orgList: async (orgId) =>\n        (await notificationCategories.org.get(orgId, organizations.systemActor(orgId))).categories,\n    },\n    access: {\n      canOpen: (orgId, actor, communityId) => entitlements.isCommunityMember(communityId, actor),\n    },\n    channels: notificationRegistries.channels,\n    logger: identityLogger,\n  });\n  const devices = new DevicesServiceImpl({\n    repo: new DrizzleDevicesRepository(db, identityLogger),\n    push: pushConfig,\n    logger: identityLogger,\n  });\n  // Progress: report writes + outbox append in one tx; content supplies the\n  // structure and completion rules the service evaluates against.\n  const progressUow = new DrizzleUnitOfWork(db, (tx) => ({\n    progress: new DrizzleProgressRepository(tx, progressLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const progress = new ProgressServiceImpl({\n    repo: new DrizzleProgressRepository(db, progressLogger),\n    content,\n    access: entitlements,\n    system: organizations,\n    uow: progressUow,\n    logger: progressLogger,\n  });\n\n  const postReads = new DrizzlePostRepository(db, discussionLogger);\n  const discussionReads = new DrizzleDiscussionRepository(db, discussionLogger);\n  const chatReads = new DrizzleChatRepository(db, discussionLogger);\n  const subscriptionReads = new DrizzleSubscriptionsRepository(db, discussionLogger);\n  const mentionReads = new DrizzleMentionsRepository(db, discussionLogger);\n  const posts = new PostServiceImpl({\n    repo: postReads,\n    access: entitlements,\n    content,\n    authors,\n    profiles: discussionReads,\n    comments: discussionReads,\n    subscriptions: subscriptionReads,\n    mentions: mentionReads,\n    images: assets,\n    fileUrls,\n    bodies,\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      posts: new DrizzlePostRepository(tx, discussionLogger),\n      mentions: new DrizzleMentionsRepository(tx, discussionLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    scheduler: automationEngine,\n    logger: discussionLogger,\n  });\n  const chats = new ChatServiceImpl({\n    repo: chatReads,\n    access: entitlements,\n    content,\n    authors,\n    profiles: discussionReads,\n    subscriptions: subscriptionReads,\n    mentions: mentionReads,\n    images: assets,\n    fileUrls,\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      chats: new DrizzleChatRepository(tx, discussionLogger),\n      mentions: new DrizzleMentionsRepository(tx, discussionLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    ...(pubsub && { pubsub }),\n    ...(options?.live && { live: options.live }),\n    logger: discussionLogger,\n  });\n  const discussion = new DiscussionServiceImpl({\n    repo: discussionReads,\n    access: entitlements,\n    content: content,\n    posts,\n    spaces: entitlements,\n    authors,\n    mentions: mentionReads,\n    fileUrls,\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      discussion: new DrizzleDiscussionRepository(tx, discussionLogger),\n      mentions: new DrizzleMentionsRepository(tx, discussionLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    settings,\n    logger: discussionLogger,\n  });\n\n  const subscriptions = new SubscriptionServiceImpl({\n    repo: subscriptionReads,\n    access: entitlements,\n    posts,\n    chats,\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      subscriptions: new DrizzleSubscriptionsRepository(tx, discussionLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    logger: discussionLogger,\n  });\n\n  const digests = new DigestServiceImpl({\n    schedules: { communitiesWithDigest: () => content.communitiesWithDigest() },\n    runs: new DrizzleDigestRunRepository(db, discussionLogger),\n    uow: new DrizzleUnitOfWork(db, (tx) => ({\n      digests: new DrizzleDigestRunRepository(tx, discussionLogger),\n      outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n    })),\n    logger: discussionLogger,\n  });\n\n  const notificationsRepo = new DrizzleNotificationsRepository(db);\n  const notificationList = new NotificationsServiceImpl({\n    repo: notificationsRepo,\n    logger: automationsLogger,\n  });\n  const itemTitles = {\n    discussion: new DiscussionItemTitles({\n      posts,\n      chats,\n      comments: discussionReads,\n      messages: chatReads,\n      profiles: discussionReads,\n      activities: content,\n      access: entitlements,\n      actors: organizations,\n    }),\n    content: new ContentItemTitles({ content, access: entitlements, organizations }),\n  };\n\n  const reporting = {\n    admin: new AdminReportServiceImpl({\n      repo: new DrizzleAdminRepository(db, reportingLogger),\n      permissions: organizations,\n      spaces: entitlements,\n      events: content,\n      fileUrls,\n    }),\n    member: new MemberReportServiceImpl({\n      repo: new DrizzleMemberRepository(db, reportingLogger),\n      content,\n      progress,\n      files: assets,\n      fileUrls,\n      access: entitlements,\n      people: organizations,\n      notifications: notificationList,\n      titles: itemTitles,\n      subscriptions,\n      notificationCategories,\n      notificationSettings,\n      channels: notificationRegistries.channels,\n      studentPortalUrl: config.studentPortalUrl,\n    }),\n  };\n\n  const credentialStore = new DrizzleCredentialStore(\n    db,\n    config.credentialStoreKey,\n    integrationsLogger,\n  );\n  // The integrations this deployment supports: the installation's declared\n  // plugins folder (directory name = integration id), loaded at startup.\n  // Connect/configure reject undeclared ids and validate config with the\n  // integration's own schema. No folder → no integrations.\n  const integrationsRegistry = await loadIntegrations(options?.pluginsDir, integrationsLogger);\n  // Integrations: credential + connection writes + outbox append in one tx\n  // (a tx-bound credential store instance shares the scope's transaction).\n  const integrationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    connections: new DrizzleConnectionsRepository(tx, integrationsLogger),\n    credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, integrationsLogger),\n    outbox: new DrizzleOutboxAppender(tx, outboxLogger),\n  }));\n  const integrations = new IntegrationsServiceImpl({\n    registry: integrationsRegistry,\n    repo: new DrizzleConnectionsRepository(db, integrationsLogger),\n    uow: integrationsUow,\n    credentials: credentialStore,\n    logger: integrationsLogger,\n  });\n\n  // Automations: run writes + outbox append in one tx; the engine drives\n  // execution (register below), integrations supplies the loaded\n  // integrations' actions for `available`.\n  const automationsUow = new DrizzleUnitOfWork(db, (tx) => ({\n    automations: new DrizzleAutomationsRepository(tx, automationsLogger),\n    runs: new DrizzleAutomationRunsRepository(tx, automationsLogger),\n    credentials: new DrizzleCredentialStore(tx, config.credentialStoreKey, automationsLogger),\n    outbox: new DrizzleOutboxAppender(tx, automationsLogger),\n  }));\n  // Emails triggered by row-shaped events resolve their recipient and content\n  // details at send time — the event carries ids only.\n  const mailerLookups: MailerLookups = {\n    orgUserPerson: async (orgId, orgUserId) => {\n      const orgUser = await organizationsRepo.findOrgUserById(orgId, orgUserId);\n      const user = orgUser ? await identity.getUserById(orgUser.userId) : null;\n      return user ? { userId: user.id, email: user.email } : null;\n    },\n    contentInfo: async (orgId, contentId) => {\n      const system = organizations.systemActor(orgId);\n      const course = await content.findCourse(contentId, system);\n      if (course) {\n        return { id: course.id, title: course.title, type: course.type };\n      }\n      const download = await content.findDownload(contentId, system);\n      if (download) {\n        return { id: download.id, title: download.title, type: download.type };\n      }\n      const community = await content.findCommunity(contentId, system);\n      if (community) {\n        return { id: community.id, title: community.title, type: community.type };\n      }\n      const event = await content.findEvent(contentId, system);\n      return event ? { id: event.id, title: event.title, type: event.type } : null;\n    },\n  };\n\n  const runsRepo = new DrizzleAutomationRunsRepository(db, automationsLogger);\n  const wired = communityMail({\n    content,\n    entitlements,\n    organizations,\n    identity,\n    posts,\n    subscriptions,\n    discussion,\n    chats,\n    bodies,\n  });\n  const recipientReads = notificationReads({\n    content,\n    entitlements,\n    organizations,\n    identity,\n    posts,\n    subscriptions,\n    discussion,\n    chats,\n    bodies,\n    settings: notificationSettings,\n  });\n  const notificationProcessor = new NotificationProcessor({\n    rules: RECIPIENT_RULES,\n    reads: recipientReads,\n    types: notificationRegistries.types,\n    channels: notificationRegistries.channels,\n    categories: notificationCategoryLists,\n    settings: notificationSettings,\n    devices,\n    repo: notificationsRepo,\n    engine: automationEngine,\n    debounce: new SchedulerChatDebounce(automationEngine),\n    logger: automationsLogger,\n  });\n  const automations = new AutomationsServiceImpl({\n    repo: new DrizzleAutomationsRepository(db, automationsLogger),\n    runsRepo,\n    uow: automationsUow,\n    engine: automationEngine,\n    mailer,\n    lookups: mailerLookups,\n    integrations,\n    systemActor: (orgId) => organizations.systemActor(orgId),\n    credentials: credentialStore,\n    webhooks:\n      options?.adapters?.webhooks ??\n      new FetchWebhookSender({ allowPrivateNetwork: config.webhookAllowPrivateNetwork }),\n    mail: wired.mail,\n    grants: wired.grants,\n    delivery: new NotificationDelivery({\n      repo: notificationsRepo,\n      channels: notificationRegistries.channels,\n      devices,\n      logger: automationsLogger,\n    }),\n    processor: notificationProcessor,\n    logger: automationsLogger,\n  });\n  automationEngine.register(automations);\n  automationEngine.registerJobs(\n    [\n      ...discussionJobs({ posts, digests, logger: discussionLogger }),\n      ...contentJobs({ events: content, logger: contentLogger }),\n      ...entitlementsJobs({ grants: entitlements }),\n      ...assetsJobs({ assets, orgs: organizations, logger: assetsLogger }),\n      ...notificationJobs({\n        processor: notificationProcessor,\n        reads: recipientReads,\n        logger: automationsLogger,\n      }),\n    ],\n    [...discussionRecurringJobs, ...entitlementsRecurringJobs, ...assetsRecurringJobs],\n  );\n\n  const eventBus = new InMemoryEventBus();\n  if (pubsub) {\n    new ChatLiveForwarder({ pubsub, logger: discussionLogger }).attach(eventBus);\n  }\n  eventBus.subscribeAll((event) => automations.handle(event));\n  const outboxConfig = resolveOutboxConfig(config.outbox);\n  const outboxRelay = new PollingOutboxRelay(\n    new DrizzleOutboxStore(db, outboxLogger),\n    eventBus,\n    outboxConfig,\n    outboxLogger,\n  );\n\n  /*\n   * Auth Adapter\n   */\n  const authLogger = logger.child({ name: 'auth' });\n  // Hook failures otherwise surface through Better Auth's route as an opaque\n  // 500 — log which hook died before rethrowing.\n  const authHook =\n    <A extends unknown[], R>(name: string, fn: (...args: A) => Promise<R>) =>\n    async (...args: A): Promise<R> => {\n      try {\n        return await fn(...args);\n      } catch (err) {\n        authLogger.error(`auth hook ${name} failed`, { err });\n        throw err;\n      }\n    };\n  const mcp = mcpEndpoints(config);\n  if (!mcp.oauthEnabled) {\n    authLogger.warn(\n      'MCP OAuth is off: BETTER_AUTH_URL must be https or a loopback host; /mcp accepts API keys only',\n      { authBaseURL: config.authBaseURL },\n    );\n  }\n  const auth: BetterAuth = new BetterAuth({\n    db,\n    baseUrl: config.authBaseURL,\n    mcp: {\n      oauthEnabled: mcp.oauthEnabled,\n      resource: mcp.resource,\n      loginPage: mcp.loginPage,\n      consentPage: mcp.consentPage,\n      orgPickerPage: mcp.orgPickerPage,\n    },\n    secret: config.authSecret,\n    trustedOrigins: config.trustedOrigins,\n    hooks: {\n      sendResetPassword: async ({ user, url }) => {\n        await identity.sendPasswordReset({ email: user.email, url });\n      },\n      onPasswordReset: async ({ user }) => {\n        await identity.sendPasswordChanged({ email: user.email });\n      },\n      sendMagicLink: authHook('sendMagicLink', async ({ email, url }) => {\n        await identity.sendMagicLink({\n          email,\n          url,\n        });\n      }),\n      beforeUserCreate: authHook('beforeUserCreate', async (user) => {\n        const { email, name } = user;\n        const [firstName, lastName] = name.split(' ');\n        // Better Auth has not minted an id yet — the id returned below becomes\n        // its account id. A person provisioned at invite time is linked instead of re-created.\n        const domainUser = await identity.linkOrCreateUser({\n          email,\n          ...(firstName !== undefined && { firstName }),\n          ...(lastName !== undefined && { lastName }),\n        });\n\n        return {\n          data: {\n            ...user,\n            id: domainUser.id,\n          },\n        };\n      }),\n      beforeCreateSession: authHook('beforeCreateSession', async (session) => {\n        const person = await identity.getUserByExternalId(session.userId);\n        if (!person) {\n          return;\n        }\n        if (organizations.isPlatformAccount(person.email)) {\n          authLogger.warn('sign-in refused for the platform account', { userId: person.id });\n          return false;\n        }\n        const orgs = await organizations.getOrgUsersForUser(person.id);\n        if (orgs.length !== 1) {\n          return;\n        }\n        // TODO - fix, why default to the first?\n        const org = await organizations.getById(orgs[0]!.orgId);\n        if (!org) {\n          return;\n        }\n\n        return { data: { ...session, activeOrganizationId: org.id } };\n      }),\n      /*\n       * We're making sure the domain org creates and using the same ID for better-auth org ID.\n       */\n      beforeCreateOrganization: authHook(\n        'beforeCreateOrganization',\n        async ({ organization: org, user: baUser }) => {\n          const domainOrg = await organizations.provisionOrganization({\n            ownerId: baUser.id,\n            ...org,\n            logo: org.logo ?? undefined,\n          });\n          return { data: { ...org, id: domainOrg.id } };\n        },\n      ),\n      beforeDeleteOrganization: authHook('beforeDeleteOrganization', async ({ organization }) => {\n        await organizations.deleteOrganization(organization.id);\n      }),\n      beforeAddMember: authHook('beforeAddMember', async ({ member }) => {\n        await organizations.addOrgUser({\n          orgId: member.organizationId,\n          userId: member.userId,\n        });\n      }),\n      beforeRemoveMember: authHook('beforeRemoveMember', async ({ member }) => {\n        await organizations.removeOrgUser(member.organizationId, member.userId);\n      }),\n    },\n    logger: authLogger,\n    cookieDomain: config.cookieDomain,\n    secureCookies: config.secureCookies,\n  });\n  orgAdminRef.current = auth;\n\n  return {\n    auth,\n    mcp,\n    platform,\n    identity,\n    organizations,\n    // Better Auth owns org writes; the same instance fulfils the OrgAdmin port.\n    orgProvider: auth,\n    content,\n    entitlements,\n    progress,\n    discussion,\n    posts,\n    chats,\n    subscriptions,\n    assets,\n    integrations,\n    automations,\n    notificationTypes: notificationRegistries.types,\n    notificationChannels: notificationRegistries.channels,\n    notificationCategories,\n    notificationCatalog,\n    notificationCategoryLists,\n    notificationSettings,\n    devices,\n    notificationList,\n    settings,\n    reporting,\n    storage,\n    mailer,\n    credentials: credentialStore,\n    outboxRelay,\n    automationEngine,\n    scheduler: automationEngine,\n    pubsub,\n    chatHub: chats.hub,\n    logger,\n    loggerInstance,\n    requestContext: requestLogContext,\n    // Better Auth owns the session store; the same instance fulfils SessionAdmin.\n    sessions: auth,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwNA,MAAa,kBAA4C;CACvD,SAAS;CACT,gBAAgB;CAChB,WAAW;CACX,aAAa;AACf;AAEA,SAAgB,oBAAoB,SAAuB,CAAC,GAA6B;CACvF,MAAM,YAAY,OAAO,YACvB,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAClE;CACA,OAAO;EAAE,GAAG;EAAiB,GAAG;CAAU;AAC5C;AAQA,MAAa,mBAA4C,EAAE,OAAO,OAAO;AAEzE,SAAgB,qBAAqB,SAAwB,CAAC,GAA4B;CACxF,OAAO,EAAE,OAAO,OAAO,SAAS,iBAAiB,MAAM;AACzD;AAuEA,eAAsB,eACpB,QACA,SACoB;CACpB,MAAM,EAAE,UAAU,gBAAgB,WAAW,iBAC3C,qBAAqB,OAAO,OAAO,CAAC,CAAC,KACvC;CAGA,MAAM,gBAAgB,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC;CACtD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,iBAAiB,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;CACxD,MAAM,mBAAmB,OAAO,MAAM,EAAE,MAAM,aAAa,CAAC;CAC5D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CACpD,MAAM,qBAAqB,OAAO,MAAM,EAAE,MAAM,eAAe,CAAC;CAChE,MAAM,oBAAoB,OAAO,MAAM,EAAE,MAAM,cAAc,CAAC;CAC9D,MAAM,kBAAkB,OAAO,MAAM,EAAE,MAAM,YAAY,CAAC;CAC1D,MAAM,eAAe,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC;CAGpD,MAAM,KAAK,SAAS,OAAO,aAAa,OAAO,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY;CACzF,MAAM,QAAQ,SAAS,UAAU,SAAS,IAAI,aAAa,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,UACJ,SAAS,UAAU,WAAW,IAAI,eAAe,OAAO,MAAM,EAAE,MAAM,UAAU,CAAC,CAAC;CACpF,MAAM,YACJ,SAAS,UAAU,aAAa,IAAI,qBAAqB,OAAO,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC1F,MAAM,SAAS,SAAS,UAAU,cAAc,IAAI,gBAAgB;CACpE,MAAM,YAAY,SAAS,UAAU;CACrC,MAAM,mBACJ,OAAO,cAAc,aACjB,UAAU,iBAAiB,IAC1B,aAAa,IAAI,uBAAuB,iBAAiB;CAChE,MAAM,eAAe,SAAS,UAAU;CACxC,MAAM,SACJ,OAAO,iBAAiB,aACpB,aAAa,OAAO,MAAM,EAAE,MAAM,SAAS,CAAC,CAAC,IAC5C,gBAAgB;CACvB,MAAM,SAAS,IAAI,OAAO,WAAW,OAAO;EAC1C,GAAI,OAAO,iBAAiB;GAAE,WAAW;GAAgB,SAAS,OAAO;EAAY;EACrF,kBAAkB,OAAO;CAC3B,CAAC;CAED,MAAM,WAAW,eAAe,OAAO,cAAc,QAAQ,QAAQ,UAAU,GAAG,CAAC;CACnF,MAAM,SAAS,IAAI,kBAAkB;EACnC;EACA,MAAM,IAAI,wBAAwB,IAAI,YAAY;EAClD,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,QAAQ,IAAI,wBAAwB,IAAI,YAAY;GACpD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,qBAAqB,OAAO;EAC5B,oBAAoB,OAAO;EAC3B,2BAA2B,OAAO;EAClC;EACA,QAAQ;CACV,CAAC;CAKD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;EAC9E,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC;CAC1E,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,gBAAgB,CAAC,CAAC;EAC/E,QAAQ,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;EACzC,KAAK;EACL;EACA,QAAQ;EACR;CACF,CAAC;CAKD,MAAM,oBAAoB,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;CAC9F,MAAM,mBAAmB,IAAI,kBAAkB,KAAK,QAAQ;EAC1D,eAAe,IAAI,+BAA+B,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EACnF,OAAO,IAAI,uBAAuB,EAAE;EACpC,QAAQ,IAAI,sBAAsB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;CACrE,EAAE;CACF,MAAM,cAAmD,EAAE,SAAS,KAAA,EAAU;CAC9E,MAAM,WAAW,OAAO,WAAW,iBAAiB,OAAO,QAAQ,IAAI;CACvE,MAAM,gBAAyC,IAAI,wBAAwB;EACzE,MAAM;EACN,OAAO,IAAI,uBAAuB,EAAE;EACpC,GAAI,SAAS,SAAS,EAAE,cAAc,QAAQ,MAAM;EACpD,eAAwB;GACtB,IAAI,CAAC,YAAY,SACf,MAAM,IAAI,MAAM,0BAA0B;GAE5C,OAAO,YAAY;EACrB;EACA,gBAAgB;GACd,IAAI,CAAC,YAAY,SACf,MAAM,IAAI,MAAM,0BAA0B;GAE5C,OAAO,YAAY;EACrB;EACA,GAAI,OAAO,YAAY,EACrB,UAAU;GACR,OAAO,OAAO,SAAS;GACvB,MAAM,OAAO,SAAS,eAAe;EACvC,EACF;EACA,aAAa,IAAI,yBAAyB,IAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;EAC3E,QAAQ;EACR,QAAQ;EACR,KAAK;EACL,gBAAgB;GACd,IAAI,CAAC,YAAY,SACf,MAAM,IAAI,MAAM,0BAA0B;GAE5C,OAAO,YAAY;EACrB;EACA,gBAAgB;GACd,IAAI,CAAC,YAAY,SACf,MAAM,IAAI,MAAM,0BAA0B;GAE5C,OAAO,YAAY;EACrB;EACA,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC;EACpC;EACA,YAAY;GAAE,kBAAkB,OAAO;GAAkB,aAAa,OAAO;EAAY;EACzF,cAA2B;CAC7B,CAAC;CAKD,MAAM,WAAW,IAAI,gBACnB,IAAI,0BAA0B,IAAI,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,CACtE;CAEA,MAAM,aAAa,IAAI,kBAAkB,KAAK,QAAQ;EACpD,SAAS,IAAI,yBAAyB,IAAI,aAAa;EACvD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,UAAU,IAAI,eAAe;EACjC,MAAM,IAAI,yBAAyB,IAAI,aAAa;EACpD,KAAK;EACL,eAAe;EACf,OAAO;EACP;EACA,WAAW;EACX,QAAQ;CACV,CAAC;CACD,MAAM,aAAa,SAAS,UAAU,QAAQ,CAAC;CAC/C,MAAM,aAAa,qBAAqB,YAAY,SAAS,UAAU,UAAU;CACjF,MAAM,yBAAyB,4BAA4B;EACzD,cAAc;EACd,UAAU;GAAE,WAAW;GAA8B,KAAK;EAAuB;EACjF,QAAQ,SAAS,UAAU,QAAQ,SAAS;EAC5C,SAAS,OAAO,QAAQ,YAAY,MAAM,SAAS,YAAY,MAAM,EAAA,EAAI,SAAS;EAClF,MAAM,aACF;GACE,QAAQ;GACR,gBAAgB,OAAO,QAAQ,UAAU,QAAQ,cAAc,OAAO,QAAQ,KAAK;EACrF,IACA;EACJ,UAAU,SAAS,UAAU,wBAAwB,CAAC;CACxD,CAAC;CACD,MAAM,yBAAyB;EAC7B,WAAW,IAAI,gCAAgC;GAC7C,aAAa,IAAI,yBAAyB,IAAI,aAAa;GAC3D;GACA,OAAO,uBAAuB;GAC9B,UAAU,uBAAuB;GACjC,QAAQ;EACV,CAAC;EACD,KAAK,IAAI,0BAA0B;GACjC;GACA,OAAO,uBAAuB;GAC9B,UAAU,uBAAuB;GACjC,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC;EACtC,CAAC;CACH;CACA,MAAM,sBAAsB,IAAI,oBAAoB;EAClD,OAAO,uBAAuB;EAC9B,UAAU,uBAAuB;CACnC,CAAC;CACD,MAAM,4BAAoD,EACxD,SAAS,OAAO,OAAO,iBACpB,cACG,MAAM,uBAAuB,UAAU,IAAI,aAAa,cAAc,YAAY,KAAK,CAAC,IACxF,MAAM,uBAAuB,IAAI,IAAI,OAAO,cAAc,YAAY,KAAK,CAAC,EAAA,CAC9E,WACN;CAEA,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,cAAc,IAAI,8BAA8B,IAAI,kBAAkB;EACtE,QAAQ,IAAI,yBAAyB,IAAI,aAAa;EACtD,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,UAAkC;CAExC,MAAM,eAAe,IAAI,wBAAwB;EAC/C,MAAM,IAFqB,8BAA8B,IAAI,kBAExC;EACrB;EACA,aAAa;EACb,KAAK;EACL,QAAQ;CACV,CAAC;CACD,MAAM,iBAAiB,OAAO,MAAM,EAAE,MAAM,WAAW,CAAC;CACxD,MAAM,uBAAuB,IAAI,gCAAgC;EAC/D,MAAM,IAAI,sCAAsC,IAAI,cAAc;EAClE,YAAY;GACV,eAAe,OAAO,OAAO,iBAC1B,MAAM,uBAAuB,UAAU,IAAI,aAAa,cAAc,YAAY,KAAK,CAAC,EAAA,CACtF;GACL,SAAS,OAAO,WACb,MAAM,uBAAuB,IAAI,IAAI,OAAO,cAAc,YAAY,KAAK,CAAC,EAAA,CAAG;EACpF;EACA,QAAQ,EACN,UAAU,OAAO,OAAO,gBAAgB,aAAa,kBAAkB,aAAa,KAAK,EAC3F;EACA,UAAU,uBAAuB;EACjC,QAAQ;CACV,CAAC;CACD,MAAM,UAAU,IAAI,mBAAmB;EACrC,MAAM,IAAI,yBAAyB,IAAI,cAAc;EACrD,MAAM;EACN,QAAQ;CACV,CAAC;CAGD,MAAM,cAAc,IAAI,kBAAkB,KAAK,QAAQ;EACrD,UAAU,IAAI,0BAA0B,IAAI,cAAc;EAC1D,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,WAAW,IAAI,oBAAoB;EACvC,MAAM,IAAI,0BAA0B,IAAI,cAAc;EACtD;EACA,QAAQ;EACR,QAAQ;EACR,KAAK;EACL,QAAQ;CACV,CAAC;CAED,MAAM,YAAY,IAAI,sBAAsB,IAAI,gBAAgB;CAChE,MAAM,kBAAkB,IAAI,4BAA4B,IAAI,gBAAgB;CAC5E,MAAM,YAAY,IAAI,sBAAsB,IAAI,gBAAgB;CAChE,MAAM,oBAAoB,IAAI,+BAA+B,IAAI,gBAAgB;CACjF,MAAM,eAAe,IAAI,0BAA0B,IAAI,gBAAgB;CACvE,MAAM,QAAQ,IAAI,gBAAgB;EAChC,MAAM;EACN,QAAQ;EACR;EACA;EACA,UAAU;EACV,UAAU;EACV,eAAe;EACf,UAAU;EACV,QAAQ;EACR;EACA;EACA,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,OAAO,IAAI,sBAAsB,IAAI,gBAAgB;GACrD,UAAU,IAAI,0BAA0B,IAAI,gBAAgB;GAC5D,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,WAAW;EACX,QAAQ;CACV,CAAC;CACD,MAAM,QAAQ,IAAI,gBAAgB;EAChC,MAAM;EACN,QAAQ;EACR;EACA;EACA,UAAU;EACV,eAAe;EACf,UAAU;EACV,QAAQ;EACR;EACA,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,OAAO,IAAI,sBAAsB,IAAI,gBAAgB;GACrD,UAAU,IAAI,0BAA0B,IAAI,gBAAgB;GAC5D,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,GAAI,UAAU,EAAE,OAAO;EACvB,GAAI,SAAS,QAAQ,EAAE,MAAM,QAAQ,KAAK;EAC1C,QAAQ;CACV,CAAC;CACD,MAAM,aAAa,IAAI,sBAAsB;EAC3C,MAAM;EACN,QAAQ;EACC;EACT;EACA,QAAQ;EACR;EACA,UAAU;EACV;EACA,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,YAAY,IAAI,4BAA4B,IAAI,gBAAgB;GAChE,UAAU,IAAI,0BAA0B,IAAI,gBAAgB;GAC5D,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF;EACA,QAAQ;CACV,CAAC;CAED,MAAM,gBAAgB,IAAI,wBAAwB;EAChD,MAAM;EACN,QAAQ;EACR;EACA;EACA,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,eAAe,IAAI,+BAA+B,IAAI,gBAAgB;GACtE,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,QAAQ;CACV,CAAC;CAED,MAAM,UAAU,IAAI,kBAAkB;EACpC,WAAW,EAAE,6BAA6B,QAAQ,sBAAsB,EAAE;EAC1E,MAAM,IAAI,2BAA2B,IAAI,gBAAgB;EACzD,KAAK,IAAI,kBAAkB,KAAK,QAAQ;GACtC,SAAS,IAAI,2BAA2B,IAAI,gBAAgB;GAC5D,QAAQ,IAAI,sBAAsB,IAAI,YAAY;EACpD,EAAE;EACF,QAAQ;CACV,CAAC;CAED,MAAM,oBAAoB,IAAI,+BAA+B,EAAE;CAC/D,MAAM,mBAAmB,IAAI,yBAAyB;EACpD,MAAM;EACN,QAAQ;CACV,CAAC;CACD,MAAM,aAAa;EACjB,YAAY,IAAI,qBAAqB;GACnC;GACA;GACA,UAAU;GACV,UAAU;GACV,UAAU;GACV,YAAY;GACZ,QAAQ;GACR,QAAQ;EACV,CAAC;EACD,SAAS,IAAI,kBAAkB;GAAE;GAAS,QAAQ;GAAc;EAAc,CAAC;CACjF;CAEA,MAAM,YAAY;EAChB,OAAO,IAAI,uBAAuB;GAChC,MAAM,IAAI,uBAAuB,IAAI,eAAe;GACpD,aAAa;GACb,QAAQ;GACR,QAAQ;GACR;EACF,CAAC;EACD,QAAQ,IAAI,wBAAwB;GAClC,MAAM,IAAI,wBAAwB,IAAI,eAAe;GACrD;GACA;GACA,OAAO;GACP;GACA,QAAQ;GACR,QAAQ;GACR,eAAe;GACf,QAAQ;GACR;GACA;GACA;GACA,UAAU,uBAAuB;GACjC,kBAAkB,OAAO;EAC3B,CAAC;CACH;CAEA,MAAM,kBAAkB,IAAI,uBAC1B,IACA,OAAO,oBACP,kBACF;CAKA,MAAM,uBAAuB,MAAM,iBAAiB,SAAS,YAAY,kBAAkB;CAG3F,MAAM,kBAAkB,IAAI,kBAAkB,KAAK,QAAQ;EACzD,aAAa,IAAI,6BAA6B,IAAI,kBAAkB;EACpE,aAAa,IAAI,uBAAuB,IAAI,OAAO,oBAAoB,kBAAkB;EACzF,QAAQ,IAAI,sBAAsB,IAAI,YAAY;CACpD,EAAE;CACF,MAAM,eAAe,IAAI,wBAAwB;EAC/C,UAAU;EACV,MAAM,IAAI,6BAA6B,IAAI,kBAAkB;EAC7D,KAAK;EACL,aAAa;EACb,QAAQ;CACV,CAAC;CAKD,MAAM,iBAAiB,IAAI,kBAAkB,KAAK,QAAQ;EACxD,aAAa,IAAI,6BAA6B,IAAI,iBAAiB;EACnE,MAAM,IAAI,gCAAgC,IAAI,iBAAiB;EAC/D,aAAa,IAAI,uBAAuB,IAAI,OAAO,oBAAoB,iBAAiB;EACxF,QAAQ,IAAI,sBAAsB,IAAI,iBAAiB;CACzD,EAAE;CAGF,MAAM,gBAA+B;EACnC,eAAe,OAAO,OAAO,cAAc;GACzC,MAAM,UAAU,MAAM,kBAAkB,gBAAgB,OAAO,SAAS;GACxE,MAAM,OAAO,UAAU,MAAM,SAAS,YAAY,QAAQ,MAAM,IAAI;GACpE,OAAO,OAAO;IAAE,QAAQ,KAAK;IAAI,OAAO,KAAK;GAAM,IAAI;EACzD;EACA,aAAa,OAAO,OAAO,cAAc;GACvC,MAAM,SAAS,cAAc,YAAY,KAAK;GAC9C,MAAM,SAAS,MAAM,QAAQ,WAAW,WAAW,MAAM;GACzD,IAAI,QACF,OAAO;IAAE,IAAI,OAAO;IAAI,OAAO,OAAO;IAAO,MAAM,OAAO;GAAK;GAEjE,MAAM,WAAW,MAAM,QAAQ,aAAa,WAAW,MAAM;GAC7D,IAAI,UACF,OAAO;IAAE,IAAI,SAAS;IAAI,OAAO,SAAS;IAAO,MAAM,SAAS;GAAK;GAEvE,MAAM,YAAY,MAAM,QAAQ,cAAc,WAAW,MAAM;GAC/D,IAAI,WACF,OAAO;IAAE,IAAI,UAAU;IAAI,OAAO,UAAU;IAAO,MAAM,UAAU;GAAK;GAE1E,MAAM,QAAQ,MAAM,QAAQ,UAAU,WAAW,MAAM;GACvD,OAAO,QAAQ;IAAE,IAAI,MAAM;IAAI,OAAO,MAAM;IAAO,MAAM,MAAM;GAAK,IAAI;EAC1E;CACF;CAEA,MAAM,WAAW,IAAI,gCAAgC,IAAI,iBAAiB;CAC1E,MAAM,QAAQ,cAAc;EAC1B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,MAAM,iBAAiB,kBAAkB;EACvC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,UAAU;CACZ,CAAC;CACD,MAAM,wBAAwB,IAAI,sBAAsB;EACtD,OAAO;EACP,OAAO;EACP,OAAO,uBAAuB;EAC9B,UAAU,uBAAuB;EACjC,YAAY;EACZ,UAAU;EACV;EACA,MAAM;EACN,QAAQ;EACR,UAAU,IAAI,sBAAsB,gBAAgB;EACpD,QAAQ;CACV,CAAC;CACD,MAAM,cAAc,IAAI,uBAAuB;EAC7C,MAAM,IAAI,6BAA6B,IAAI,iBAAiB;EAC5D;EACA,KAAK;EACL,QAAQ;EACR;EACA,SAAS;EACT;EACA,cAAc,UAAU,cAAc,YAAY,KAAK;EACvD,aAAa;EACb,UACE,SAAS,UAAU,YACnB,IAAI,mBAAmB,EAAE,qBAAqB,OAAO,2BAA2B,CAAC;EACnF,MAAM,MAAM;EACZ,QAAQ,MAAM;EACd,UAAU,IAAI,qBAAqB;GACjC,MAAM;GACN,UAAU,uBAAuB;GACjC;GACA,QAAQ;EACV,CAAC;EACD,WAAW;EACX,QAAQ;CACV,CAAC;CACD,iBAAiB,SAAS,WAAW;CACrC,iBAAiB,aACf;EACE,GAAG,eAAe;GAAE;GAAO;GAAS,QAAQ;EAAiB,CAAC;EAC9D,GAAG,YAAY;GAAE,QAAQ;GAAS,QAAQ;EAAc,CAAC;EACzD,GAAG,iBAAiB,EAAE,QAAQ,aAAa,CAAC;EAC5C,GAAG,WAAW;GAAE;GAAQ,MAAM;GAAe,QAAQ;EAAa,CAAC;EACnE,GAAG,iBAAiB;GAClB,WAAW;GACX,OAAO;GACP,QAAQ;EACV,CAAC;CACH,GACA;EAAC,GAAG;EAAyB,GAAG;EAA2B,GAAG;CAAmB,CACnF;CAEA,MAAM,WAAW,IAAI,iBAAiB;CACtC,IAAI,QACF,IAAI,kBAAkB;EAAE;EAAQ,QAAQ;CAAiB,CAAC,CAAC,CAAC,OAAO,QAAQ;CAE7E,SAAS,cAAc,UAAU,YAAY,OAAO,KAAK,CAAC;CAC1D,MAAM,eAAe,oBAAoB,OAAO,MAAM;CACtD,MAAM,cAAc,IAAI,mBACtB,IAAI,mBAAmB,IAAI,YAAY,GACvC,UACA,cACA,YACF;CAKA,MAAM,aAAa,OAAO,MAAM,EAAE,MAAM,OAAO,CAAC;CAGhD,MAAM,YACqB,MAAc,OACvC,OAAO,GAAG,SAAwB;EAChC,IAAI;GACF,OAAO,MAAM,GAAG,GAAG,IAAI;EACzB,SAAS,KAAK;GACZ,WAAW,MAAM,aAAa,KAAK,UAAU,EAAE,IAAI,CAAC;GACpD,MAAM;EACR;CACF;CACF,MAAM,MAAM,aAAa,MAAM;CAC/B,IAAI,CAAC,IAAI,cACP,WAAW,KACT,kGACA,EAAE,aAAa,OAAO,YAAY,CACpC;CAEF,MAAM,OAAmB,IAAI,WAAW;EACtC;EACA,SAAS,OAAO;EAChB,KAAK;GACH,cAAc,IAAI;GAClB,UAAU,IAAI;GACd,WAAW,IAAI;GACf,aAAa,IAAI;GACjB,eAAe,IAAI;EACrB;EACA,QAAQ,OAAO;EACf,gBAAgB,OAAO;EACvB,OAAO;GACL,mBAAmB,OAAO,EAAE,MAAM,UAAU;IAC1C,MAAM,SAAS,kBAAkB;KAAE,OAAO,KAAK;KAAO;IAAI,CAAC;GAC7D;GACA,iBAAiB,OAAO,EAAE,WAAW;IACnC,MAAM,SAAS,oBAAoB,EAAE,OAAO,KAAK,MAAM,CAAC;GAC1D;GACA,eAAe,SAAS,iBAAiB,OAAO,EAAE,OAAO,UAAU;IACjE,MAAM,SAAS,cAAc;KAC3B;KACA;IACF,CAAC;GACH,CAAC;GACD,kBAAkB,SAAS,oBAAoB,OAAO,SAAS;IAC7D,MAAM,EAAE,OAAO,SAAS;IACxB,MAAM,CAAC,WAAW,YAAY,KAAK,MAAM,GAAG;IAG5C,MAAM,aAAa,MAAM,SAAS,iBAAiB;KACjD;KACA,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;KAC3C,GAAI,aAAa,KAAA,KAAa,EAAE,SAAS;IAC3C,CAAC;IAED,OAAO,EACL,MAAM;KACJ,GAAG;KACH,IAAI,WAAW;IACjB,EACF;GACF,CAAC;GACD,qBAAqB,SAAS,uBAAuB,OAAO,YAAY;IACtE,MAAM,SAAS,MAAM,SAAS,oBAAoB,QAAQ,MAAM;IAChE,IAAI,CAAC,QACH;IAEF,IAAI,cAAc,kBAAkB,OAAO,KAAK,GAAG;KACjD,WAAW,KAAK,4CAA4C,EAAE,QAAQ,OAAO,GAAG,CAAC;KACjF,OAAO;IACT;IACA,MAAM,OAAO,MAAM,cAAc,mBAAmB,OAAO,EAAE;IAC7D,IAAI,KAAK,WAAW,GAClB;IAGF,MAAM,MAAM,MAAM,cAAc,QAAQ,KAAK,EAAE,CAAE,KAAK;IACtD,IAAI,CAAC,KACH;IAGF,OAAO,EAAE,MAAM;KAAE,GAAG;KAAS,sBAAsB,IAAI;IAAG,EAAE;GAC9D,CAAC;GAID,0BAA0B,SACxB,4BACA,OAAO,EAAE,cAAc,KAAK,MAAM,aAAa;IAC7C,MAAM,YAAY,MAAM,cAAc,sBAAsB;KAC1D,SAAS,OAAO;KAChB,GAAG;KACH,MAAM,IAAI,QAAQ,KAAA;IACpB,CAAC;IACD,OAAO,EAAE,MAAM;KAAE,GAAG;KAAK,IAAI,UAAU;IAAG,EAAE;GAC9C,CACF;GACA,0BAA0B,SAAS,4BAA4B,OAAO,EAAE,mBAAmB;IACzF,MAAM,cAAc,mBAAmB,aAAa,EAAE;GACxD,CAAC;GACD,iBAAiB,SAAS,mBAAmB,OAAO,EAAE,aAAa;IACjE,MAAM,cAAc,WAAW;KAC7B,OAAO,OAAO;KACd,QAAQ,OAAO;IACjB,CAAC;GACH,CAAC;GACD,oBAAoB,SAAS,sBAAsB,OAAO,EAAE,aAAa;IACvE,MAAM,cAAc,cAAc,OAAO,gBAAgB,OAAO,MAAM;GACxE,CAAC;EACH;EACA,QAAQ;EACR,cAAc,OAAO;EACrB,eAAe,OAAO;CACxB,CAAC;CACD,YAAY,UAAU;CAEtB,OAAO;EACL;EACA;EACA;EACA;EACA;EAEA,aAAa;EACb;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,mBAAmB,uBAAuB;EAC1C,sBAAsB,uBAAuB;EAC7C;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX;EACA,SAAS,MAAM;EACf;EACA;EACA,gBAAgB;EAEhB,UAAU;CACZ;AACF"}

package/dist/app/notification-channels.d.ts

@@ -0,0 +1,47 @@
+import { Mailer } from "@headless-lms/core/shared/mailer";
+import { PushConfig } from "@headless-lms/core/types";
+import { ChannelRegistry, EmailTemplateId, JsonValue, NotificationCategory, NotificationChannel, NotificationTypeDeclaration, NotificationTypeRegistry, PushDevice, PushSender, StoredNotification } from "@headless-lms/core/shared/ports";
+//#region src/app/notification-channels.d.ts
+declare const IN_APP = "inApp";
+declare const EMAIL = "email";
+declare function buildNotificationTypeRegistry(declarations: NotificationTypeDeclaration[], defaults: {
+  community: NotificationCategory[];
+  org: NotificationCategory[];
+}, configured: string[]): NotificationTypeRegistry;
+declare function buildChannelRegistry(channels: NotificationChannel[]): ChannelRegistry;
+declare function emailTemplateFor(declaration: NotificationTypeDeclaration, notification: Pick<StoredNotification, 'scope' | 'matchedReason'>): EmailTemplateId | null;
+declare function emailParams(notification: StoredNotification): Record<string, JsonValue>;
+declare function emailChannel(deps: {
+  mailer: Pick<Mailer, 'send'>;
+  types: NotificationTypeRegistry;
+  emailOf: (orgId: string, userId: string) => Promise<string | null>;
+}): NotificationChannel;
+declare function renderPushText(template: string, display: Record<string, JsonValue>): string;
+declare function configuredPushSender(config: PushConfig, sender: PushSender | undefined): PushSender | null;
+type ActiveDevices = (orgId: string, userId: string, since: Date) => Promise<PushDevice[]>;
+declare function pushChannel(deps: {
+  sender: PushSender;
+  types: NotificationTypeRegistry;
+  activeDevices: ActiveDevices;
+  now?: () => Date;
+}): NotificationChannel;
+declare function buildNotificationRegistries(deps: {
+  declarations: NotificationTypeDeclaration[];
+  defaults: {
+    community: NotificationCategory[];
+    org: NotificationCategory[];
+  };
+  mailer: Pick<Mailer, 'send'> | null;
+  emailOf: (orgId: string, userId: string) => Promise<string | null>;
+  push: {
+    sender: PushSender;
+    activeDevices: ActiveDevices;
+  } | null;
+  channels: NotificationChannel[];
+}): {
+  types: NotificationTypeRegistry;
+  channels: ChannelRegistry;
+};
+//#endregion
+export { ActiveDevices, EMAIL, IN_APP, buildChannelRegistry, buildNotificationRegistries, buildNotificationTypeRegistry, configuredPushSender, emailChannel, emailParams, emailTemplateFor, pushChannel, renderPushText };
+//# sourceMappingURL=notification-channels.d.ts.map

package/dist/app/notification-channels.js

@@ -0,0 +1,175 @@
+import { DEVICE_WINDOW_MS, PUSH } from "@headless-lms/core/automations";
+import { offeringConfigured } from "@headless-lms/core/shared/notification-categories";
+import { isEmailRejected, isEmailRenderError } from "@headless-lms/core/shared/mailer";
+//#region src/app/notification-channels.ts
+const IN_APP = "inApp";
+const EMAIL = "email";
+const CONTENT_SUBJECTS = /* @__PURE__ */ new Set([
+	"course",
+	"download",
+	"community",
+	"event",
+	"bundle"
+]);
+function buildNotificationTypeRegistry(declarations, defaults, configured) {
+	const byType = /* @__PURE__ */ new Map();
+	for (const declaration of declarations) {
+		if (byType.has(declaration.type)) throw new Error(`notification type ${declaration.type} is declared twice`);
+		byType.set(declaration.type, declaration);
+	}
+	const lists = {
+		community: offeringConfigured(defaults.community, configured),
+		org: offeringConfigured(defaults.org, configured)
+	};
+	return {
+		list: () => declarations.map(({ type, scopes, reasons }) => ({
+			type,
+			scopes: [...scopes],
+			reasons: [...reasons]
+		})),
+		get: (type) => byType.get(type),
+		defaults: (scope) => structuredClone(lists[scope])
+	};
+}
+function buildChannelRegistry(channels) {
+	const byKey = /* @__PURE__ */ new Map();
+	for (const channel of channels) {
+		if (channel.key === "inApp" || byKey.has(channel.key)) throw new Error(`notification channel ${channel.key} is registered twice`);
+		byKey.set(channel.key, channel);
+	}
+	const keys = [IN_APP, ...byKey.keys()];
+	return {
+		list: () => [...keys],
+		get: (key) => byKey.get(key)
+	};
+}
+function emailTemplateFor(declaration, notification) {
+	const email = declaration.email?.[notification.scope];
+	if (!email) return null;
+	return email.byReason?.[notification.matchedReason] ?? email.template;
+}
+function emailParams(notification) {
+	const ids = {};
+	for (const ref of [notification.parent, notification.subject]) if (ref) ids[`${ref.type}Id`] = ref.id;
+	if (notification.subject && CONTENT_SUBJECTS.has(notification.subject.type)) ids.contentId = notification.subject.id;
+	if (notification.communityId) ids.communityId = notification.communityId;
+	if (notification.spaceId) ids.spaceId = notification.spaceId;
+	return {
+		...ids,
+		...notification.display
+	};
+}
+function emailChannel(deps) {
+	return {
+		key: EMAIL,
+		recipient: async (orgId, userId) => {
+			const email = await deps.emailOf(orgId, userId);
+			return email ? { email } : null;
+		},
+		deliver: async (notification, to) => {
+			const declaration = deps.types.get(notification.type);
+			const template = declaration ? emailTemplateFor(declaration, notification) : null;
+			if (!to.email) return {
+				accepted: false,
+				deadDeviceIds: [],
+				error: "no address"
+			};
+			if (!template) return {
+				accepted: false,
+				deadDeviceIds: [],
+				error: `no email template for ${notification.type} in ${notification.scope}`
+			};
+			try {
+				await deps.mailer.send(to.email, template, emailParams(notification));
+			} catch (err) {
+				if (isEmailRejected(err) || isEmailRenderError(err)) return {
+					accepted: false,
+					deadDeviceIds: [],
+					error: err.message
+				};
+				throw err;
+			}
+			return {
+				accepted: true,
+				deadDeviceIds: []
+			};
+		}
+	};
+}
+function renderPushText(template, display) {
+	return template.replace(/\{\{(\w+)\}\}/g, (_placeholder, key) => {
+		const value = display[key];
+		if (typeof value === "string") return value;
+		if (Array.isArray(value) && value.every((item) => typeof item === "string")) return value.join(", ");
+		return "";
+	});
+}
+function configuredPushSender(config, sender) {
+	return Object.values(config).some((provider) => provider !== void 0) && sender ? sender : null;
+}
+function pushChannel(deps) {
+	const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+	return {
+		key: PUSH,
+		recipient: async (orgId, userId) => {
+			const since = new Date(now().getTime() - DEVICE_WINDOW_MS);
+			const devices = await deps.activeDevices(orgId, userId, since);
+			return devices.length > 0 ? { devices } : null;
+		},
+		deliver: async (notification, to) => {
+			const text = deps.types.get(notification.type)?.push?.[notification.scope];
+			if (!to.devices) return {
+				accepted: false,
+				deadDeviceIds: [],
+				error: "no address"
+			};
+			if (!text) return {
+				accepted: false,
+				deadDeviceIds: [],
+				error: `no push text for ${notification.type} in ${notification.scope}`
+			};
+			const courseId = notification.display.courseId;
+			return deps.sender.send(to.devices, {
+				title: renderPushText(text.title, notification.display),
+				body: renderPushText(text.body, notification.display),
+				data: {
+					notificationId: notification.id,
+					type: notification.type,
+					subject: notification.subject,
+					parent: notification.parent,
+					communityId: notification.communityId,
+					spaceId: notification.spaceId,
+					courseId: typeof courseId === "string" ? courseId : null
+				}
+			});
+		}
+	};
+}
+function buildNotificationRegistries(deps) {
+	const configured = [
+		IN_APP,
+		...deps.mailer ? [EMAIL] : [],
+		...deps.push ? [PUSH] : [],
+		...deps.channels.map((channel) => channel.key)
+	];
+	const types = buildNotificationTypeRegistry(deps.declarations, deps.defaults, configured);
+	return {
+		types,
+		channels: buildChannelRegistry([
+			...deps.mailer ? [emailChannel({
+				mailer: deps.mailer,
+				types,
+				emailOf: deps.emailOf
+			})] : [],
+			...deps.push ? [pushChannel({
+				...deps.push,
+				types
+			})] : [],
+			...deps.channels
+		])
+	};
+}
+//#endregion
+export { EMAIL, IN_APP, buildChannelRegistry, buildNotificationRegistries, buildNotificationTypeRegistry, configuredPushSender, emailChannel, emailParams, emailTemplateFor, pushChannel, renderPushText };
+
+//# sourceMappingURL=notification-channels.js.map

package/dist/app/notification-channels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-channels.js","names":[],"sources":["../../src/app/notification-channels.ts"],"sourcesContent":["import type {\n  ChannelRegistry,\n  EmailTemplateId,\n  EmailTemplateParams,\n  JsonValue,\n  NotificationCategory,\n  NotificationChannel,\n  NotificationTypeDeclaration,\n  NotificationTypeRegistry,\n  PushDevice,\n  PushSender,\n  StoredNotification,\n} from '@headless-lms/core/shared/ports';\nimport { DEVICE_WINDOW_MS, PUSH } from '@headless-lms/core/automations';\nimport type { PushConfig } from '@headless-lms/core/types';\nimport { offeringConfigured } from '@headless-lms/core/shared/notification-categories';\nimport { isEmailRejected, isEmailRenderError, type Mailer } from '@headless-lms/core/shared/mailer';\n\nexport const IN_APP = 'inApp';\nexport const EMAIL = 'email';\n\nconst CONTENT_SUBJECTS = new Set(['course', 'download', 'community', 'event', 'bundle']);\n\nexport function buildNotificationTypeRegistry(\n  declarations: NotificationTypeDeclaration[],\n  defaults: { community: NotificationCategory[]; org: NotificationCategory[] },\n  configured: string[],\n): NotificationTypeRegistry {\n  const byType = new Map<string, NotificationTypeDeclaration>();\n  for (const declaration of declarations) {\n    if (byType.has(declaration.type)) {\n      throw new Error(`notification type ${declaration.type} is declared twice`);\n    }\n    byType.set(declaration.type, declaration);\n  }\n  const lists = {\n    community: offeringConfigured(defaults.community, configured),\n    org: offeringConfigured(defaults.org, configured),\n  };\n  return {\n    list: () =>\n      declarations.map(({ type, scopes, reasons }) => ({\n        type,\n        scopes: [...scopes],\n        reasons: [...reasons],\n      })),\n    get: (type) => byType.get(type),\n    defaults: (scope) => structuredClone(lists[scope]),\n  };\n}\n\nexport function buildChannelRegistry(channels: NotificationChannel[]): ChannelRegistry {\n  const byKey = new Map<string, NotificationChannel>();\n  for (const channel of channels) {\n    if (channel.key === IN_APP || byKey.has(channel.key)) {\n      throw new Error(`notification channel ${channel.key} is registered twice`);\n    }\n    byKey.set(channel.key, channel);\n  }\n  const keys = [IN_APP, ...byKey.keys()];\n  return {\n    list: () => [...keys],\n    get: (key) => byKey.get(key),\n  };\n}\n\nexport function emailTemplateFor(\n  declaration: NotificationTypeDeclaration,\n  notification: Pick<StoredNotification, 'scope' | 'matchedReason'>,\n): EmailTemplateId | null {\n  const email = declaration.email?.[notification.scope];\n  if (!email) {\n    return null;\n  }\n  return email.byReason?.[notification.matchedReason] ?? email.template;\n}\n\nexport function emailParams(notification: StoredNotification): Record<string, JsonValue> {\n  const ids: Record<string, JsonValue> = {};\n  for (const ref of [notification.parent, notification.subject]) {\n    if (ref) {\n      ids[`${ref.type}Id`] = ref.id;\n    }\n  }\n  if (notification.subject && CONTENT_SUBJECTS.has(notification.subject.type)) {\n    ids.contentId = notification.subject.id;\n  }\n  if (notification.communityId) {\n    ids.communityId = notification.communityId;\n  }\n  if (notification.spaceId) {\n    ids.spaceId = notification.spaceId;\n  }\n  return { ...ids, ...notification.display };\n}\n\nexport function emailChannel(deps: {\n  mailer: Pick<Mailer, 'send'>;\n  types: NotificationTypeRegistry;\n  emailOf: (orgId: string, userId: string) => Promise<string | null>;\n}): NotificationChannel {\n  return {\n    key: EMAIL,\n    recipient: async (orgId, userId) => {\n      const email = await deps.emailOf(orgId, userId);\n      return email ? { email } : null;\n    },\n    deliver: async (notification, to) => {\n      const declaration = deps.types.get(notification.type);\n      const template = declaration ? emailTemplateFor(declaration, notification) : null;\n      if (!to.email) {\n        return { accepted: false, deadDeviceIds: [], error: 'no address' };\n      }\n      if (!template) {\n        return {\n          accepted: false,\n          deadDeviceIds: [],\n          error: `no email template for ${notification.type} in ${notification.scope}`,\n        };\n      }\n      try {\n        await deps.mailer.send(\n          to.email,\n          template,\n          emailParams(notification) as unknown as EmailTemplateParams[typeof template],\n        );\n      } catch (err) {\n        if (isEmailRejected(err) || isEmailRenderError(err)) {\n          return { accepted: false, deadDeviceIds: [], error: err.message };\n        }\n        throw err;\n      }\n      return { accepted: true, deadDeviceIds: [] };\n    },\n  };\n}\n\nexport function renderPushText(template: string, display: Record<string, JsonValue>): string {\n  return template.replace(/\\{\\{(\\w+)\\}\\}/g, (_placeholder, key: string) => {\n    const value = display[key];\n    if (typeof value === 'string') {\n      return value;\n    }\n    if (Array.isArray(value) && value.every((item) => typeof item === 'string')) {\n      return value.join(', ');\n    }\n    return '';\n  });\n}\n\nexport function configuredPushSender(\n  config: PushConfig,\n  sender: PushSender | undefined,\n): PushSender | null {\n  const configured = Object.values(config).some((provider) => provider !== undefined);\n  return configured && sender ? sender : null;\n}\n\nexport type ActiveDevices = (orgId: string, userId: string, since: Date) => Promise<PushDevice[]>;\n\nexport function pushChannel(deps: {\n  sender: PushSender;\n  types: NotificationTypeRegistry;\n  activeDevices: ActiveDevices;\n  now?: () => Date;\n}): NotificationChannel {\n  const now = deps.now ?? (() => new Date());\n  return {\n    key: PUSH,\n    recipient: async (orgId, userId) => {\n      const since = new Date(now().getTime() - DEVICE_WINDOW_MS);\n      const devices = await deps.activeDevices(orgId, userId, since);\n      return devices.length > 0 ? { devices } : null;\n    },\n    deliver: async (notification, to) => {\n      const text = deps.types.get(notification.type)?.push?.[notification.scope];\n      if (!to.devices) {\n        return { accepted: false, deadDeviceIds: [], error: 'no address' };\n      }\n      if (!text) {\n        return {\n          accepted: false,\n          deadDeviceIds: [],\n          error: `no push text for ${notification.type} in ${notification.scope}`,\n        };\n      }\n      const courseId = notification.display.courseId;\n      return deps.sender.send(to.devices, {\n        title: renderPushText(text.title, notification.display),\n        body: renderPushText(text.body, notification.display),\n        data: {\n          notificationId: notification.id,\n          type: notification.type,\n          subject: notification.subject,\n          parent: notification.parent,\n          communityId: notification.communityId,\n          spaceId: notification.spaceId,\n          courseId: typeof courseId === 'string' ? courseId : null,\n        },\n      });\n    },\n  };\n}\n\nexport function buildNotificationRegistries(deps: {\n  declarations: NotificationTypeDeclaration[];\n  defaults: { community: NotificationCategory[]; org: NotificationCategory[] };\n  mailer: Pick<Mailer, 'send'> | null;\n  emailOf: (orgId: string, userId: string) => Promise<string | null>;\n  push: { sender: PushSender; activeDevices: ActiveDevices } | null;\n  channels: NotificationChannel[];\n}): { types: NotificationTypeRegistry; channels: ChannelRegistry } {\n  const configured = [\n    IN_APP,\n    ...(deps.mailer ? [EMAIL] : []),\n    ...(deps.push ? [PUSH] : []),\n    ...deps.channels.map((channel) => channel.key),\n  ];\n  const types = buildNotificationTypeRegistry(deps.declarations, deps.defaults, configured);\n  const channels = buildChannelRegistry([\n    ...(deps.mailer ? [emailChannel({ mailer: deps.mailer, types, emailOf: deps.emailOf })] : []),\n    ...(deps.push ? [pushChannel({ ...deps.push, types })] : []),\n    ...deps.channels,\n  ]);\n  return { types, channels };\n}\n"],"mappings":";;;;AAkBA,MAAa,SAAS;AACtB,MAAa,QAAQ;AAErB,MAAM,mCAAmB,IAAI,IAAI;CAAC;CAAU;CAAY;CAAa;CAAS;AAAQ,CAAC;AAEvF,SAAgB,8BACd,cACA,UACA,YAC0B;CAC1B,MAAM,yBAAS,IAAI,IAAyC;CAC5D,KAAK,MAAM,eAAe,cAAc;EACtC,IAAI,OAAO,IAAI,YAAY,IAAI,GAC7B,MAAM,IAAI,MAAM,qBAAqB,YAAY,KAAK,mBAAmB;EAE3E,OAAO,IAAI,YAAY,MAAM,WAAW;CAC1C;CACA,MAAM,QAAQ;EACZ,WAAW,mBAAmB,SAAS,WAAW,UAAU;EAC5D,KAAK,mBAAmB,SAAS,KAAK,UAAU;CAClD;CACA,OAAO;EACL,YACE,aAAa,KAAK,EAAE,MAAM,QAAQ,eAAe;GAC/C;GACA,QAAQ,CAAC,GAAG,MAAM;GAClB,SAAS,CAAC,GAAG,OAAO;EACtB,EAAE;EACJ,MAAM,SAAS,OAAO,IAAI,IAAI;EAC9B,WAAW,UAAU,gBAAgB,MAAM,MAAM;CACnD;AACF;AAEA,SAAgB,qBAAqB,UAAkD;CACrF,MAAM,wBAAQ,IAAI,IAAiC;CACnD,KAAK,MAAM,WAAW,UAAU;EAC9B,IAAI,QAAQ,QAAA,WAAkB,MAAM,IAAI,QAAQ,GAAG,GACjD,MAAM,IAAI,MAAM,wBAAwB,QAAQ,IAAI,qBAAqB;EAE3E,MAAM,IAAI,QAAQ,KAAK,OAAO;CAChC;CACA,MAAM,OAAO,CAAC,QAAQ,GAAG,MAAM,KAAK,CAAC;CACrC,OAAO;EACL,YAAY,CAAC,GAAG,IAAI;EACpB,MAAM,QAAQ,MAAM,IAAI,GAAG;CAC7B;AACF;AAEA,SAAgB,iBACd,aACA,cACwB;CACxB,MAAM,QAAQ,YAAY,QAAQ,aAAa;CAC/C,IAAI,CAAC,OACH,OAAO;CAET,OAAO,MAAM,WAAW,aAAa,kBAAkB,MAAM;AAC/D;AAEA,SAAgB,YAAY,cAA6D;CACvF,MAAM,MAAiC,CAAC;CACxC,KAAK,MAAM,OAAO,CAAC,aAAa,QAAQ,aAAa,OAAO,GAC1D,IAAI,KACF,IAAI,GAAG,IAAI,KAAK,OAAO,IAAI;CAG/B,IAAI,aAAa,WAAW,iBAAiB,IAAI,aAAa,QAAQ,IAAI,GACxE,IAAI,YAAY,aAAa,QAAQ;CAEvC,IAAI,aAAa,aACf,IAAI,cAAc,aAAa;CAEjC,IAAI,aAAa,SACf,IAAI,UAAU,aAAa;CAE7B,OAAO;EAAE,GAAG;EAAK,GAAG,aAAa;CAAQ;AAC3C;AAEA,SAAgB,aAAa,MAIL;CACtB,OAAO;EACL,KAAK;EACL,WAAW,OAAO,OAAO,WAAW;GAClC,MAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,MAAM;GAC9C,OAAO,QAAQ,EAAE,MAAM,IAAI;EAC7B;EACA,SAAS,OAAO,cAAc,OAAO;GACnC,MAAM,cAAc,KAAK,MAAM,IAAI,aAAa,IAAI;GACpD,MAAM,WAAW,cAAc,iBAAiB,aAAa,YAAY,IAAI;GAC7E,IAAI,CAAC,GAAG,OACN,OAAO;IAAE,UAAU;IAAO,eAAe,CAAC;IAAG,OAAO;GAAa;GAEnE,IAAI,CAAC,UACH,OAAO;IACL,UAAU;IACV,eAAe,CAAC;IAChB,OAAO,yBAAyB,aAAa,KAAK,MAAM,aAAa;GACvE;GAEF,IAAI;IACF,MAAM,KAAK,OAAO,KAChB,GAAG,OACH,UACA,YAAY,YAAY,CAC1B;GACF,SAAS,KAAK;IACZ,IAAI,gBAAgB,GAAG,KAAK,mBAAmB,GAAG,GAChD,OAAO;KAAE,UAAU;KAAO,eAAe,CAAC;KAAG,OAAO,IAAI;IAAQ;IAElE,MAAM;GACR;GACA,OAAO;IAAE,UAAU;IAAM,eAAe,CAAC;GAAE;EAC7C;CACF;AACF;AAEA,SAAgB,eAAe,UAAkB,SAA4C;CAC3F,OAAO,SAAS,QAAQ,mBAAmB,cAAc,QAAgB;EACvE,MAAM,QAAQ,QAAQ;EACtB,IAAI,OAAO,UAAU,UACnB,OAAO;EAET,IAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,OAAO,SAAS,OAAO,SAAS,QAAQ,GACxE,OAAO,MAAM,KAAK,IAAI;EAExB,OAAO;CACT,CAAC;AACH;AAEA,SAAgB,qBACd,QACA,QACmB;CAEnB,OADmB,OAAO,OAAO,MAAM,CAAC,CAAC,MAAM,aAAa,aAAa,KAAA,CACzD,KAAK,SAAS,SAAS;AACzC;AAIA,SAAgB,YAAY,MAKJ;CACtB,MAAM,MAAM,KAAK,8BAAc,IAAI,KAAK;CACxC,OAAO;EACL,KAAK;EACL,WAAW,OAAO,OAAO,WAAW;GAClC,MAAM,QAAQ,IAAI,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,gBAAgB;GACzD,MAAM,UAAU,MAAM,KAAK,cAAc,OAAO,QAAQ,KAAK;GAC7D,OAAO,QAAQ,SAAS,IAAI,EAAE,QAAQ,IAAI;EAC5C;EACA,SAAS,OAAO,cAAc,OAAO;GACnC,MAAM,OAAO,KAAK,MAAM,IAAI,aAAa,IAAI,CAAC,EAAE,OAAO,aAAa;GACpE,IAAI,CAAC,GAAG,SACN,OAAO;IAAE,UAAU;IAAO,eAAe,CAAC;IAAG,OAAO;GAAa;GAEnE,IAAI,CAAC,MACH,OAAO;IACL,UAAU;IACV,eAAe,CAAC;IAChB,OAAO,oBAAoB,aAAa,KAAK,MAAM,aAAa;GAClE;GAEF,MAAM,WAAW,aAAa,QAAQ;GACtC,OAAO,KAAK,OAAO,KAAK,GAAG,SAAS;IAClC,OAAO,eAAe,KAAK,OAAO,aAAa,OAAO;IACtD,MAAM,eAAe,KAAK,MAAM,aAAa,OAAO;IACpD,MAAM;KACJ,gBAAgB,aAAa;KAC7B,MAAM,aAAa;KACnB,SAAS,aAAa;KACtB,QAAQ,aAAa;KACrB,aAAa,aAAa;KAC1B,SAAS,aAAa;KACtB,UAAU,OAAO,aAAa,WAAW,WAAW;IACtD;GACF,CAAC;EACH;CACF;AACF;AAEA,SAAgB,4BAA4B,MAOuB;CACjE,MAAM,aAAa;EACjB;EACA,GAAI,KAAK,SAAS,CAAC,KAAK,IAAI,CAAC;EAC7B,GAAI,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;EAC1B,GAAG,KAAK,SAAS,KAAK,YAAY,QAAQ,GAAG;CAC/C;CACA,MAAM,QAAQ,8BAA8B,KAAK,cAAc,KAAK,UAAU,UAAU;CAMxF,OAAO;EAAE;EAAO,UALC,qBAAqB;GACpC,GAAI,KAAK,SAAS,CAAC,aAAa;IAAE,QAAQ,KAAK;IAAQ;IAAO,SAAS,KAAK;GAAQ,CAAC,CAAC,IAAI,CAAC;GAC3F,GAAI,KAAK,OAAO,CAAC,YAAY;IAAE,GAAG,KAAK;IAAM;GAAM,CAAC,CAAC,IAAI,CAAC;GAC1D,GAAG,KAAK;EACV,CACuB;CAAE;AAC3B"}

package/dist/app/notification-reads.d.ts

@@ -0,0 +1,23 @@
+import { CommunityMailDeps } from "./community-mail.js";
+import { ContentService } from "@headless-lms/core/content";
+import { EntitlementsService } from "@headless-lms/core/entitlements";
+import { ChatService, DiscussionService, PostService, SubscriptionService } from "@headless-lms/core/discussion";
+import { IdentityService, NotificationSettingsService } from "@headless-lms/core/identity";
+import { OrganizationService } from "@headless-lms/core/organizations";
+import { NotificationReads } from "@headless-lms/core/automations";
+//#region src/app/notification-reads.d.ts
+type NotificationReadsDeps = CommunityMailDeps & {
+  content: Pick<ContentService, 'getActivity' | 'getModule' | 'findCourse' | 'findEvent' | 'listBundleItems'>;
+  entitlements: Pick<EntitlementsService, 'communityMemberIds' | 'grantedOrgUserIds' | 'hasAccess'>;
+  organizations: Pick<OrganizationService, 'getOrgUsersByIds' | 'systemActor'>;
+  identity: Pick<IdentityService, 'getUserById'>;
+  posts: Pick<PostService, 'publishedBetween'>;
+  subscriptions: Pick<SubscriptionService, 'mutedAmong'>;
+  discussion: Pick<DiscussionService, 'commenterIds'>;
+  chats: Pick<ChatService, 'unreadInChat' | 'findMessage'>;
+  settings: Pick<NotificationSettingsService, 'switchedOn'>;
+};
+declare function notificationReads(deps: NotificationReadsDeps): NotificationReads;
+//#endregion
+export { NotificationReadsDeps, notificationReads };
+//# sourceMappingURL=notification-reads.d.ts.map

package/dist/app/notification-reads.js

@@ -0,0 +1,74 @@
+import { communityMail } from "./community-mail.js";
+import { activityTitle } from "@headless-lms/core/content";
+//#region src/app/notification-reads.ts
+function notificationReads(deps) {
+	const { mail } = communityMail(deps);
+	const nameOf = (orgId, orgUserId) => mail.displayName(orgId, orgUserId);
+	const system = (orgId) => deps.organizations.systemActor(orgId);
+	return {
+		...mail,
+		async threadParticipants(orgId, item) {
+			if (item.type === "post") return deps.discussion.commenterIds(orgId, { postId: item.id });
+			if (item.type === "activity") return deps.discussion.commenterIds(orgId, { activityId: item.id });
+			return [];
+		},
+		mutedAmong: (orgId, item, orgUserIds, at) => deps.subscriptions.mutedAmong(orgId, item, orgUserIds, at),
+		communityMembers: (orgId, communityId) => deps.entitlements.communityMemberIds(orgId, communityId),
+		switchedOn: (orgId, communityId, category, spaceId) => deps.settings.switchedOn(orgId, communityId, category, spaceId),
+		courseMembers: (orgId, courseId) => deps.entitlements.grantedOrgUserIds(orgId, courseId),
+		event: (orgId, eventId) => deps.content.findEvent(eventId, system(orgId)),
+		eventAttendees: (orgId, eventId) => deps.entitlements.grantedOrgUserIds(orgId, eventId),
+		async contentLostBy(orgId, grant) {
+			const opened = grant.bundleId ? (await deps.content.listBundleItems(grant.bundleId, system(orgId))).map((item) => item.contentId) : grant.contentId ? [grant.contentId] : [];
+			const held = await Promise.all(opened.map((contentId) => deps.entitlements.hasAccess(orgId, grant.orgUserId, contentId)));
+			return opened.filter((_, index) => !held[index]);
+		},
+		async activity(orgId, activityId) {
+			const activity = await deps.content.getActivity(activityId, system(orgId));
+			if (!activity) return null;
+			const [module, course] = await Promise.all([deps.content.getModule(activity.moduleId, system(orgId)), deps.content.findCourse(activity.courseId, system(orgId))]);
+			if (!course) return null;
+			return {
+				title: activityTitle(activity),
+				moduleTitle: module?.title ?? "",
+				courseId: course.id,
+				courseTitle: course.title
+			};
+		},
+		async userIdsOf(orgId, orgUserIds) {
+			const orgUsers = await deps.organizations.getOrgUsersByIds(orgId, orgUserIds);
+			return Object.fromEntries(orgUsers.map((orgUser) => [orgUser.id, orgUser.userId]));
+		},
+		async emailOf(_orgId, userId) {
+			return (await deps.identity.getUserById(userId))?.email ?? null;
+		},
+		async message(orgId, messageId) {
+			const message = await deps.chats.findMessage(orgId, messageId);
+			return message && message.deletedAt === null ? {
+				orgUserId: message.orgUserId,
+				chatId: message.chatId,
+				body: message.body
+			} : null;
+		},
+		async postsPublished(orgId, communityId, from, to) {
+			const posts = await deps.posts.publishedBetween(orgId, communityId, from, to);
+			const spaceNames = /* @__PURE__ */ new Map();
+			for (const spaceId of new Set(posts.map((post) => post.spaceId))) spaceNames.set(spaceId, (await mail.space(orgId, spaceId))?.name ?? "");
+			const authorNames = /* @__PURE__ */ new Map();
+			for (const orgUserId of new Set(posts.map((post) => post.orgUserId))) authorNames.set(orgUserId, await nameOf(orgId, orgUserId));
+			return posts.map((post) => ({
+				postId: post.postId,
+				spaceId: post.spaceId,
+				title: post.title,
+				authorName: authorNames.get(post.orgUserId) ?? "",
+				spaceName: spaceNames.get(post.spaceId) ?? "",
+				commentCount: post.commentCount
+			}));
+		},
+		unreadInChat: (orgId, chatId, orgUserId) => deps.chats.unreadInChat(orgId, chatId, orgUserId)
+	};
+}
+//#endregion
+export { notificationReads };
+
+//# sourceMappingURL=notification-reads.js.map

package/dist/app/notification-reads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-reads.js","names":[],"sources":["../../src/app/notification-reads.ts"],"sourcesContent":["import type { NotificationReads } from '@headless-lms/core/automations';\nimport { activityTitle, type ContentService } from '@headless-lms/core/content';\nimport type {\n  ChatService,\n  DiscussionService,\n  PostService,\n  SubscriptionService,\n} from '@headless-lms/core/discussion';\nimport type { EntitlementsService } from '@headless-lms/core/entitlements';\nimport type { IdentityService, NotificationSettingsService } from '@headless-lms/core/identity';\nimport type { OrganizationService } from '@headless-lms/core/organizations';\nimport { communityMail, type CommunityMailDeps } from './community-mail.js';\n\nexport type NotificationReadsDeps = CommunityMailDeps & {\n  content: Pick<\n    ContentService,\n    'getActivity' | 'getModule' | 'findCourse' | 'findEvent' | 'listBundleItems'\n  >;\n  entitlements: Pick<EntitlementsService, 'communityMemberIds' | 'grantedOrgUserIds' | 'hasAccess'>;\n  organizations: Pick<OrganizationService, 'getOrgUsersByIds' | 'systemActor'>;\n  identity: Pick<IdentityService, 'getUserById'>;\n  posts: Pick<PostService, 'publishedBetween'>;\n  subscriptions: Pick<SubscriptionService, 'mutedAmong'>;\n  discussion: Pick<DiscussionService, 'commenterIds'>;\n  chats: Pick<ChatService, 'unreadInChat' | 'findMessage'>;\n  settings: Pick<NotificationSettingsService, 'switchedOn'>;\n};\n\nexport function notificationReads(deps: NotificationReadsDeps): NotificationReads {\n  const { mail } = communityMail(deps);\n  const nameOf = (orgId: string, orgUserId: string) => mail.displayName(orgId, orgUserId);\n  const system = (orgId: string) => deps.organizations.systemActor(orgId);\n  return {\n    ...mail,\n    async threadParticipants(orgId, item) {\n      if (item.type === 'post') {\n        return deps.discussion.commenterIds(orgId, { postId: item.id });\n      }\n      if (item.type === 'activity') {\n        return deps.discussion.commenterIds(orgId, { activityId: item.id });\n      }\n      return [];\n    },\n    mutedAmong: (orgId, item, orgUserIds, at) =>\n      deps.subscriptions.mutedAmong(orgId, item, orgUserIds, at),\n    communityMembers: (orgId, communityId) =>\n      deps.entitlements.communityMemberIds(orgId, communityId),\n    switchedOn: (orgId, communityId, category, spaceId) =>\n      deps.settings.switchedOn(orgId, communityId, category, spaceId),\n    courseMembers: (orgId, courseId) => deps.entitlements.grantedOrgUserIds(orgId, courseId),\n    event: (orgId, eventId) => deps.content.findEvent(eventId, system(orgId)),\n    eventAttendees: (orgId, eventId) => deps.entitlements.grantedOrgUserIds(orgId, eventId),\n    async contentLostBy(orgId, grant) {\n      const opened = grant.bundleId\n        ? (await deps.content.listBundleItems(grant.bundleId, system(orgId))).map(\n            (item) => item.contentId,\n          )\n        : grant.contentId\n          ? [grant.contentId]\n          : [];\n      const held = await Promise.all(\n        opened.map((contentId) => deps.entitlements.hasAccess(orgId, grant.orgUserId, contentId)),\n      );\n      return opened.filter((_, index) => !held[index]);\n    },\n    async activity(orgId, activityId) {\n      const activity = await deps.content.getActivity(activityId, system(orgId));\n      if (!activity) {\n        return null;\n      }\n      const [module, course] = await Promise.all([\n        deps.content.getModule(activity.moduleId, system(orgId)),\n        deps.content.findCourse(activity.courseId, system(orgId)),\n      ]);\n      if (!course) {\n        return null;\n      }\n      return {\n        title: activityTitle(activity),\n        moduleTitle: module?.title ?? '',\n        courseId: course.id,\n        courseTitle: course.title,\n      };\n    },\n    async userIdsOf(orgId, orgUserIds) {\n      const orgUsers = await deps.organizations.getOrgUsersByIds(orgId, orgUserIds);\n      return Object.fromEntries(orgUsers.map((orgUser) => [orgUser.id, orgUser.userId]));\n    },\n    async emailOf(_orgId, userId) {\n      return (await deps.identity.getUserById(userId))?.email ?? null;\n    },\n    async message(orgId, messageId) {\n      const message = await deps.chats.findMessage(orgId, messageId);\n      return message && message.deletedAt === null\n        ? { orgUserId: message.orgUserId, chatId: message.chatId, body: message.body }\n        : null;\n    },\n    async postsPublished(orgId, communityId, from, to) {\n      const posts = await deps.posts.publishedBetween(orgId, communityId, from, to);\n      const spaceNames = new Map<string, string>();\n      for (const spaceId of new Set(posts.map((post) => post.spaceId))) {\n        spaceNames.set(spaceId, (await mail.space(orgId, spaceId))?.name ?? '');\n      }\n      const authorNames = new Map<string, string>();\n      for (const orgUserId of new Set(posts.map((post) => post.orgUserId))) {\n        authorNames.set(orgUserId, await nameOf(orgId, orgUserId));\n      }\n      return posts.map((post) => ({\n        postId: post.postId,\n        spaceId: post.spaceId,\n        title: post.title,\n        authorName: authorNames.get(post.orgUserId) ?? '',\n        spaceName: spaceNames.get(post.spaceId) ?? '',\n        commentCount: post.commentCount,\n      }));\n    },\n    unreadInChat: (orgId, chatId, orgUserId) => deps.chats.unreadInChat(orgId, chatId, orgUserId),\n  };\n}\n"],"mappings":";;;AA4BA,SAAgB,kBAAkB,MAAgD;CAChF,MAAM,EAAE,SAAS,cAAc,IAAI;CACnC,MAAM,UAAU,OAAe,cAAsB,KAAK,YAAY,OAAO,SAAS;CACtF,MAAM,UAAU,UAAkB,KAAK,cAAc,YAAY,KAAK;CACtE,OAAO;EACL,GAAG;EACH,MAAM,mBAAmB,OAAO,MAAM;GACpC,IAAI,KAAK,SAAS,QAChB,OAAO,KAAK,WAAW,aAAa,OAAO,EAAE,QAAQ,KAAK,GAAG,CAAC;GAEhE,IAAI,KAAK,SAAS,YAChB,OAAO,KAAK,WAAW,aAAa,OAAO,EAAE,YAAY,KAAK,GAAG,CAAC;GAEpE,OAAO,CAAC;EACV;EACA,aAAa,OAAO,MAAM,YAAY,OACpC,KAAK,cAAc,WAAW,OAAO,MAAM,YAAY,EAAE;EAC3D,mBAAmB,OAAO,gBACxB,KAAK,aAAa,mBAAmB,OAAO,WAAW;EACzD,aAAa,OAAO,aAAa,UAAU,YACzC,KAAK,SAAS,WAAW,OAAO,aAAa,UAAU,OAAO;EAChE,gBAAgB,OAAO,aAAa,KAAK,aAAa,kBAAkB,OAAO,QAAQ;EACvF,QAAQ,OAAO,YAAY,KAAK,QAAQ,UAAU,SAAS,OAAO,KAAK,CAAC;EACxE,iBAAiB,OAAO,YAAY,KAAK,aAAa,kBAAkB,OAAO,OAAO;EACtF,MAAM,cAAc,OAAO,OAAO;GAChC,MAAM,SAAS,MAAM,YAChB,MAAM,KAAK,QAAQ,gBAAgB,MAAM,UAAU,OAAO,KAAK,CAAC,EAAA,CAAG,KACjE,SAAS,KAAK,SACjB,IACA,MAAM,YACJ,CAAC,MAAM,SAAS,IAChB,CAAC;GACP,MAAM,OAAO,MAAM,QAAQ,IACzB,OAAO,KAAK,cAAc,KAAK,aAAa,UAAU,OAAO,MAAM,WAAW,SAAS,CAAC,CAC1F;GACA,OAAO,OAAO,QAAQ,GAAG,UAAU,CAAC,KAAK,MAAM;EACjD;EACA,MAAM,SAAS,OAAO,YAAY;GAChC,MAAM,WAAW,MAAM,KAAK,QAAQ,YAAY,YAAY,OAAO,KAAK,CAAC;GACzE,IAAI,CAAC,UACH,OAAO;GAET,MAAM,CAAC,QAAQ,UAAU,MAAM,QAAQ,IAAI,CACzC,KAAK,QAAQ,UAAU,SAAS,UAAU,OAAO,KAAK,CAAC,GACvD,KAAK,QAAQ,WAAW,SAAS,UAAU,OAAO,KAAK,CAAC,CAC1D,CAAC;GACD,IAAI,CAAC,QACH,OAAO;GAET,OAAO;IACL,OAAO,cAAc,QAAQ;IAC7B,aAAa,QAAQ,SAAS;IAC9B,UAAU,OAAO;IACjB,aAAa,OAAO;GACtB;EACF;EACA,MAAM,UAAU,OAAO,YAAY;GACjC,MAAM,WAAW,MAAM,KAAK,cAAc,iBAAiB,OAAO,UAAU;GAC5E,OAAO,OAAO,YAAY,SAAS,KAAK,YAAY,CAAC,QAAQ,IAAI,QAAQ,MAAM,CAAC,CAAC;EACnF;EACA,MAAM,QAAQ,QAAQ,QAAQ;GAC5B,QAAQ,MAAM,KAAK,SAAS,YAAY,MAAM,EAAA,EAAI,SAAS;EAC7D;EACA,MAAM,QAAQ,OAAO,WAAW;GAC9B,MAAM,UAAU,MAAM,KAAK,MAAM,YAAY,OAAO,SAAS;GAC7D,OAAO,WAAW,QAAQ,cAAc,OACpC;IAAE,WAAW,QAAQ;IAAW,QAAQ,QAAQ;IAAQ,MAAM,QAAQ;GAAK,IAC3E;EACN;EACA,MAAM,eAAe,OAAO,aAAa,MAAM,IAAI;GACjD,MAAM,QAAQ,MAAM,KAAK,MAAM,iBAAiB,OAAO,aAAa,MAAM,EAAE;GAC5E,MAAM,6BAAa,IAAI,IAAoB;GAC3C,KAAK,MAAM,WAAW,IAAI,IAAI,MAAM,KAAK,SAAS,KAAK,OAAO,CAAC,GAC7D,WAAW,IAAI,UAAU,MAAM,KAAK,MAAM,OAAO,OAAO,EAAA,EAAI,QAAQ,EAAE;GAExE,MAAM,8BAAc,IAAI,IAAoB;GAC5C,KAAK,MAAM,aAAa,IAAI,IAAI,MAAM,KAAK,SAAS,KAAK,SAAS,CAAC,GACjE,YAAY,IAAI,WAAW,MAAM,OAAO,OAAO,SAAS,CAAC;GAE3D,OAAO,MAAM,KAAK,UAAU;IAC1B,QAAQ,KAAK;IACb,SAAS,KAAK;IACd,OAAO,KAAK;IACZ,YAAY,YAAY,IAAI,KAAK,SAAS,KAAK;IAC/C,WAAW,WAAW,IAAI,KAAK,OAAO,KAAK;IAC3C,cAAc,KAAK;GACrB,EAAE;EACJ;EACA,eAAe,OAAO,QAAQ,cAAc,KAAK,MAAM,aAAa,OAAO,QAAQ,SAAS;CAC9F;AACF"}

package/dist/app/platform.d.ts

@@ -0,0 +1,14 @@
+//#region src/app/platform.d.ts
+declare const PLATFORM_KEY_MIN_LENGTH = 32;
+interface PlatformConfig {
+  key: string;
+  accountEmail: string;
+  accountName?: string;
+}
+interface PlatformKeyCheck {
+  matches(candidate: string): boolean;
+}
+declare function platformKeyCheck(config: PlatformConfig): PlatformKeyCheck;
+//#endregion
+export { PLATFORM_KEY_MIN_LENGTH, PlatformConfig, PlatformKeyCheck, platformKeyCheck };
+//# sourceMappingURL=platform.d.ts.map

package/dist/app/platform.js

@@ -0,0 +1,14 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+//#region src/app/platform.ts
+const PLATFORM_KEY_MIN_LENGTH = 32;
+const digest = (value) => createHash("sha256").update(value).digest();
+function platformKeyCheck(config) {
+	if (config.key.length < 32) throw new Error(`the platform key must be at least 32 characters`);
+	if (!config.accountEmail.includes("@")) throw new Error("the platform account needs an email address");
+	const expected = digest(config.key);
+	return { matches: (candidate) => timingSafeEqual(digest(candidate), expected) };
+}
+//#endregion
+export { PLATFORM_KEY_MIN_LENGTH, platformKeyCheck };
+
+//# sourceMappingURL=platform.js.map

package/dist/app/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","names":[],"sources":["../../src/app/platform.ts"],"sourcesContent":["import { createHash, timingSafeEqual } from 'node:crypto';\n\nexport const PLATFORM_KEY_MIN_LENGTH = 32;\n\nexport interface PlatformConfig {\n  key: string;\n  accountEmail: string;\n  accountName?: string;\n}\n\nexport interface PlatformKeyCheck {\n  matches(candidate: string): boolean;\n}\n\nconst digest = (value: string) => createHash('sha256').update(value).digest();\n\nexport function platformKeyCheck(config: PlatformConfig): PlatformKeyCheck {\n  if (config.key.length < PLATFORM_KEY_MIN_LENGTH) {\n    throw new Error(`the platform key must be at least ${PLATFORM_KEY_MIN_LENGTH} characters`);\n  }\n  if (!config.accountEmail.includes('@')) {\n    throw new Error('the platform account needs an email address');\n  }\n  const expected = digest(config.key);\n  return { matches: (candidate) => timingSafeEqual(digest(candidate), expected) };\n}\n"],"mappings":";;AAEA,MAAa,0BAA0B;AAYvC,MAAM,UAAU,UAAkB,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;AAE5E,SAAgB,iBAAiB,QAA0C;CACzE,IAAI,OAAO,IAAI,SAAA,IACb,MAAM,IAAI,MAAM,iDAAyE;CAE3F,IAAI,CAAC,OAAO,aAAa,SAAS,GAAG,GACnC,MAAM,IAAI,MAAM,6CAA6C;CAE/D,MAAM,WAAW,OAAO,OAAO,GAAG;CAClC,OAAO,EAAE,UAAU,cAAc,gBAAgB,OAAO,SAAS,GAAG,QAAQ,EAAE;AAChF"}

package/dist/http/config.d.ts

@@ -18,6 +18,10 @@ interface ServerConfig {
    *  can't silently extend paywalled link lifetimes. */
   deliveryExpirySeconds: number;
   memberImageMaxBytes: number;
+  memberFileMaxBytes: number;
+  /** Postgres URL for the PubSub adapter's session connection. It must reach
+   *  Postgres directly, not through a transaction-mode pooler. */
+  pubsubDatabaseUrl: string;
   /** Everything the composition container needs to wire adapters + services. */
   container: Config;
 }