@headless-lms/server 0.3.0 → 0.5.0

package/dist/http/schemas/shared.js

@@ -12,9 +12,10 @@ const ValidationErrorBody = ErrorBody.extend({ issues: z.array(z.object({
 	path: z.string().describe("Where in the request, such as `body.topics[1].name`"),
 	message: z.string()
 })).optional() });
+const UnavailableErrorBody = ErrorBody.extend({ details: z.record(z.string(), z.string()).optional().describe("Ids of what the request left behind, such as the post kept as a draft") });
 /** Response schemas for the refusals a route can answer. A 400 keeps the validation `issues`. */
 function refusals(...statuses) {
-	return Object.fromEntries(statuses.map((status) => [status, status === 400 ? ValidationErrorBody : ErrorBody]));
+	return Object.fromEntries(statuses.map((status) => [status, status === 400 || status === 422 ? ValidationErrorBody : status === 503 ? UnavailableErrorBody : ErrorBody]));
 }
 /** An RFC 3339 date-time in a request, such as `2026-10-29T12:00:00Z`, read as a Date. */
 const DateTimeInput = z.iso.datetime({ offset: true }).pipe(z.coerce.date());
@@ -43,15 +44,6 @@ function paginated(row) {
 		pageSize: z.number().int()
 	});
 }
-/** All four org roles. `members.ts` exports a staff-only three-value `Role`;
-*  this is the full set, used wherever a learner can also appear. */
-const OrgRole = z.enum([
-	"owner",
-	"admin",
-	"instructor",
-	"moderator",
-	"student"
-]);
 /** Mirrors UserProfile in @headless-lms/core/types — keyed on the auth user id. */
 const UserProfileSchema = z.object({
 	id: z.string(),
@@ -68,6 +60,6 @@ const OrgUserProfileSchema = z.object({
 	image: z.string().nullable()
 });
 //#endregion
-export { DateTimeInput, ErrorBody, ListQuery, OrgRole, OrgUserProfileSchema, PageQuery, UserProfileSchema, ValidationErrorBody, paginated, refusals };
+export { DateTimeInput, ErrorBody, ListQuery, OrgUserProfileSchema, PageQuery, UnavailableErrorBody, UserProfileSchema, ValidationErrorBody, paginated, refusals };
 
 //# sourceMappingURL=shared.js.map

package/dist/http/schemas/shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared.js","names":[],"sources":["../../../src/http/schemas/shared.ts"],"sourcesContent":["// Shared contract primitives reused across resource contracts.\nimport { z } from 'zod';\n\n/** Fails typecheck when a schema and its domain type drift apart. */\nexport type Matches<A, _B extends A> = true;\n\n/** Uniform error envelope returned by every non-2xx response. */\nexport const ErrorBody = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  /** Server-side correlation id — quote it to find the matching API log line. */\n  requestId: z.string().optional(),\n});\nexport type ErrorBody = z.infer<typeof ErrorBody>;\n\n/** A 400 from request validation: `message` names the first problem, `issues` lists them all. */\nexport const ValidationErrorBody = ErrorBody.extend({\n  issues: z\n    .array(\n      z.object({\n        path: z.string().describe('Where in the request, such as `body.topics[1].name`'),\n        message: z.string(),\n      }),\n    )\n    .optional(),\n});\nexport type ValidationErrorBody = z.infer<typeof ValidationErrorBody>;\n\ntype RefusalStatus = 400 | 403 | 404 | 409 | 413 | 415 | 502;\ntype RefusalBodies<S extends RefusalStatus> = {\n  [K in S]: K extends 400 ? typeof ValidationErrorBody : typeof ErrorBody;\n};\n\n/** Response schemas for the refusals a route can answer. A 400 keeps the validation `issues`. */\nexport function refusals<S extends RefusalStatus>(...statuses: S[]): RefusalBodies<S> {\n  return Object.fromEntries(\n    statuses.map((status) => [status, status === 400 ? ValidationErrorBody : ErrorBody]),\n  ) as RefusalBodies<S>;\n}\n\n/** An RFC 3339 date-time in a request, such as `2026-10-29T12:00:00Z`, read as a Date. */\nexport const DateTimeInput = z.iso.datetime({ offset: true }).pipe(z.coerce.date());\n\n/** Page position only, for lists that take no search or sort. */\nexport const PageQuery = z\n  .object({\n    page: z.coerce.number().int().min(1).default(1),\n    pageSize: z.coerce.number().int().min(1).max(100).default(20),\n  })\n  .strict();\nexport type PageQuery = z.infer<typeof PageQuery>;\n\n/**\n * Common list query for page-based collections. `z.coerce` because query-string\n * values arrive as strings; defaults make the params optional for callers.\n */\nexport const ListQuery = z.object({\n  page: z.coerce.number().int().min(1).default(1),\n  pageSize: z.coerce.number().int().min(1).max(100).default(20),\n  search: z.string().trim().max(200).optional(),\n  /** Sort field, optionally prefixed with `-` for descending (e.g. `-updatedAt`). */\n  sort: z.string().optional(),\n});\nexport type ListQuery = z.infer<typeof ListQuery>;\n\n/** Wrap a row schema into the standard paginated envelope. */\nexport function paginated<T extends z.ZodTypeAny>(row: T) {\n  return z.object({\n    rows: z.array(row),\n    total: z.number().int(),\n    page: z.number().int(),\n    pageSize: z.number().int(),\n  });\n}\n\n/** All four org roles. `members.ts` exports a staff-only three-value `Role`;\n *  this is the full set, used wherever a learner can also appear. */\nexport const OrgRole = z.enum(['owner', 'admin', 'instructor', 'moderator', 'student']);\nexport type OrgRole = z.infer<typeof OrgRole>;\n\n/** Mirrors UserProfile in @headless-lms/core/types — keyed on the auth user id. */\nexport const UserProfileSchema = z.object({\n  id: z.string(),\n  name: z.string(),\n  email: z.string(),\n  image: z.string().nullable(),\n});\nexport type UserProfileSchema = z.infer<typeof UserProfileSchema>;\n\n/** Mirrors OrgUserProfile in @headless-lms/core/types — keyed on org_users.id. */\nexport const OrgUserProfileSchema = z.object({\n  id: z.string(),\n  firstName: z.string().nullable(),\n  lastName: z.string().nullable(),\n  email: z.string(),\n  image: z.string().nullable(),\n});\nexport type OrgUserProfileSchema = z.infer<typeof OrgUserProfileSchema>;\n"],"mappings":";;;AAOA,MAAa,YAAY,EAAE,OAAO;CAChC,OAAO,EAAE,OAAO;CAChB,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC;;AAID,MAAa,sBAAsB,UAAU,OAAO,EAClD,QAAQ,EACL,MACC,EAAE,OAAO;CACP,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,qDAAqD;CAC/E,SAAS,EAAE,OAAO;AACpB,CAAC,CACH,CAAC,CACA,SAAS,EACd,CAAC;;AASD,SAAgB,SAAkC,GAAG,UAAiC;CACpF,OAAO,OAAO,YACZ,SAAS,KAAK,WAAW,CAAC,QAAQ,WAAW,MAAM,sBAAsB,SAAS,CAAC,CACrF;AACF;;AAGA,MAAa,gBAAgB,EAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;;AAGlF,MAAa,YAAY,EACtB,OAAO;CACN,MAAM,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;CAC9C,UAAU,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC9D,CAAC,CAAC,CACD,OAAO;;;;;AAOV,MAAa,YAAY,EAAE,OAAO;CAChC,MAAM,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;CAC9C,UAAU,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5D,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;;CAE5C,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;AAC5B,CAAC;;AAID,SAAgB,UAAkC,KAAQ;CACxD,OAAO,EAAE,OAAO;EACd,MAAM,EAAE,MAAM,GAAG;EACjB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI;EACtB,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI;EACrB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CAC3B,CAAC;AACH;;;AAIA,MAAa,UAAU,EAAE,KAAK;CAAC;CAAS;CAAS;CAAc;CAAa;AAAS,CAAC;;AAItF,MAAa,oBAAoB,EAAE,OAAO;CACxC,IAAI,EAAE,OAAO;CACb,MAAM,EAAE,OAAO;CACf,OAAO,EAAE,OAAO;CAChB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;AAC7B,CAAC;;AAID,MAAa,uBAAuB,EAAE,OAAO;CAC3C,IAAI,EAAE,OAAO;CACb,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,OAAO,EAAE,OAAO;CAChB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;AAC7B,CAAC"}
+{"version":3,"file":"shared.js","names":[],"sources":["../../../src/http/schemas/shared.ts"],"sourcesContent":["// Shared contract primitives reused across resource contracts.\nimport { z } from 'zod';\n\n/** Fails typecheck when a schema and its domain type drift apart. */\nexport type Matches<A, _B extends A> = true;\n\n/** Uniform error envelope returned by every non-2xx response. */\nexport const ErrorBody = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  /** Server-side correlation id — quote it to find the matching API log line. */\n  requestId: z.string().optional(),\n});\nexport type ErrorBody = z.infer<typeof ErrorBody>;\n\n/** A 400 from request validation: `message` names the first problem, `issues` lists them all. */\nexport const ValidationErrorBody = ErrorBody.extend({\n  issues: z\n    .array(\n      z.object({\n        path: z.string().describe('Where in the request, such as `body.topics[1].name`'),\n        message: z.string(),\n      }),\n    )\n    .optional(),\n});\nexport type ValidationErrorBody = z.infer<typeof ValidationErrorBody>;\n\nexport const UnavailableErrorBody = ErrorBody.extend({\n  details: z\n    .record(z.string(), z.string())\n    .optional()\n    .describe('Ids of what the request left behind, such as the post kept as a draft'),\n});\nexport type UnavailableErrorBody = z.infer<typeof UnavailableErrorBody>;\n\ntype RefusalStatus = 400 | 403 | 404 | 409 | 413 | 415 | 422 | 502 | 503;\ntype RefusalBodies<S extends RefusalStatus> = {\n  [K in S]: K extends 400 | 422\n    ? typeof ValidationErrorBody\n    : K extends 503\n      ? typeof UnavailableErrorBody\n      : typeof ErrorBody;\n};\n\n/** Response schemas for the refusals a route can answer. A 400 keeps the validation `issues`. */\nexport function refusals<S extends RefusalStatus>(...statuses: S[]): RefusalBodies<S> {\n  return Object.fromEntries(\n    statuses.map((status) => [\n      status,\n      status === 400 || status === 422\n        ? ValidationErrorBody\n        : status === 503\n          ? UnavailableErrorBody\n          : ErrorBody,\n    ]),\n  ) as RefusalBodies<S>;\n}\n\n/** An RFC 3339 date-time in a request, such as `2026-10-29T12:00:00Z`, read as a Date. */\nexport const DateTimeInput = z.iso.datetime({ offset: true }).pipe(z.coerce.date());\n\n/** Page position only, for lists that take no search or sort. */\nexport const PageQuery = z\n  .object({\n    page: z.coerce.number().int().min(1).default(1),\n    pageSize: z.coerce.number().int().min(1).max(100).default(20),\n  })\n  .strict();\nexport type PageQuery = z.infer<typeof PageQuery>;\n\n/**\n * Common list query for page-based collections. `z.coerce` because query-string\n * values arrive as strings; defaults make the params optional for callers.\n */\nexport const ListQuery = z.object({\n  page: z.coerce.number().int().min(1).default(1),\n  pageSize: z.coerce.number().int().min(1).max(100).default(20),\n  search: z.string().trim().max(200).optional(),\n  /** Sort field, optionally prefixed with `-` for descending (e.g. `-updatedAt`). */\n  sort: z.string().optional(),\n});\nexport type ListQuery = z.infer<typeof ListQuery>;\n\n/** Wrap a row schema into the standard paginated envelope. */\nexport function paginated<T extends z.ZodTypeAny>(row: T) {\n  return z.object({\n    rows: z.array(row),\n    total: z.number().int(),\n    page: z.number().int(),\n    pageSize: z.number().int(),\n  });\n}\n\n/** Mirrors UserProfile in @headless-lms/core/types — keyed on the auth user id. */\nexport const UserProfileSchema = z.object({\n  id: z.string(),\n  name: z.string(),\n  email: z.string(),\n  image: z.string().nullable(),\n});\nexport type UserProfileSchema = z.infer<typeof UserProfileSchema>;\n\n/** Mirrors OrgUserProfile in @headless-lms/core/types — keyed on org_users.id. */\nexport const OrgUserProfileSchema = z.object({\n  id: z.string(),\n  firstName: z.string().nullable(),\n  lastName: z.string().nullable(),\n  email: z.string(),\n  image: z.string().nullable(),\n});\nexport type OrgUserProfileSchema = z.infer<typeof OrgUserProfileSchema>;\n"],"mappings":";;;AAOA,MAAa,YAAY,EAAE,OAAO;CAChC,OAAO,EAAE,OAAO;CAChB,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC;;AAID,MAAa,sBAAsB,UAAU,OAAO,EAClD,QAAQ,EACL,MACC,EAAE,OAAO;CACP,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,qDAAqD;CAC/E,SAAS,EAAE,OAAO;AACpB,CAAC,CACH,CAAC,CACA,SAAS,EACd,CAAC;AAGD,MAAa,uBAAuB,UAAU,OAAO,EACnD,SAAS,EACN,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAC9B,SAAS,CAAC,CACV,SAAS,uEAAuE,EACrF,CAAC;;AAaD,SAAgB,SAAkC,GAAG,UAAiC;CACpF,OAAO,OAAO,YACZ,SAAS,KAAK,WAAW,CACvB,QACA,WAAW,OAAO,WAAW,MACzB,sBACA,WAAW,MACT,uBACA,SACR,CAAC,CACH;AACF;;AAGA,MAAa,gBAAgB,EAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;;AAGlF,MAAa,YAAY,EACtB,OAAO;CACN,MAAM,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;CAC9C,UAAU,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC9D,CAAC,CAAC,CACD,OAAO;;;;;AAOV,MAAa,YAAY,EAAE,OAAO;CAChC,MAAM,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;CAC9C,UAAU,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5D,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;;CAE5C,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;AAC5B,CAAC;;AAID,SAAgB,UAAkC,KAAQ;CACxD,OAAO,EAAE,OAAO;EACd,MAAM,EAAE,MAAM,GAAG;EACjB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI;EACtB,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI;EACrB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CAC3B,CAAC;AACH;;AAGA,MAAa,oBAAoB,EAAE,OAAO;CACxC,IAAI,EAAE,OAAO;CACb,MAAM,EAAE,OAAO;CACf,OAAO,EAAE,OAAO;CAChB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;AAC7B,CAAC;;AAID,MAAa,uBAAuB,EAAE,OAAO;CAC3C,IAAI,EAAE,OAAO;CACb,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,OAAO,EAAE,OAAO;CAChB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;AAC7B,CAAC"}

package/dist/http/schemas/students.d.ts

@@ -19,6 +19,17 @@ declare const Student: z.ZodObject<{
   }>;
   joinedAt: z.ZodString;
   lastActiveAt: z.ZodNullable<z.ZodString>;
+  items: z.ZodArray<z.ZodObject<{
+    contentId: z.ZodString;
+    contentType: z.ZodEnum<{
+      community: "community";
+      course: "course";
+      download: "download";
+      event: "event";
+    }>;
+    roleKey: z.ZodString;
+    roleName: z.ZodString;
+  }, z.core.$strip>>;
 }, z.core.$strip>;
 type Student = z.infer<typeof Student>;
 declare const StudentCourseProgress: z.ZodObject<{
@@ -71,6 +82,17 @@ declare const StudentsPage: z.ZodObject<{
     }>;
     joinedAt: z.ZodString;
     lastActiveAt: z.ZodNullable<z.ZodString>;
+    items: z.ZodArray<z.ZodObject<{
+      contentId: z.ZodString;
+      contentType: z.ZodEnum<{
+        community: "community";
+        course: "course";
+        download: "download";
+        event: "event";
+      }>;
+      roleKey: z.ZodString;
+      roleName: z.ZodString;
+    }, z.core.$strip>>;
   }, z.core.$strip>>;
   total: z.ZodNumber;
   page: z.ZodNumber;

package/dist/http/schemas/students.js

@@ -1,4 +1,5 @@
 import { ListQuery, OrgUserProfileSchema, paginated } from "./shared.js";
+import { ItemRole } from "./members.js";
 import { z } from "zod";
 //#region src/http/schemas/students.ts
 const OrgUserStatus = z.enum(["invited", "active"]);
@@ -9,7 +10,8 @@ const Student = OrgUserProfileSchema.extend({
 	/** `invited` means an admin added them and they have not accepted yet. */
 	status: OrgUserStatus,
 	joinedAt: z.string(),
-	lastActiveAt: z.string().nullable()
+	lastActiveAt: z.string().nullable(),
+	items: z.array(ItemRole).describe("The roles they hold on content items.")
 });
 const StudentCourseProgress = z.object({
 	courseId: z.string(),

package/dist/http/schemas/students.js.map

@@ -1 +1 @@
-{"version":3,"file":"students.js","names":[],"sources":["../../../src/http/schemas/students.ts"],"sourcesContent":["// Students resource schemas.\nimport { z } from 'zod';\nimport { ListQuery, paginated, OrgUserProfileSchema } from './shared.js';\n\nexport const OrgUserStatus = z.enum(['invited', 'active']);\nexport type OrgUserStatus = z.infer<typeof OrgUserStatus>;\n\nexport const Student = OrgUserProfileSchema.extend({\n  entitlementCount: z.number().int(),\n  /** 0–100, averaged across active entitlements. */\n  avgProgress: z.number().int(),\n  /** `invited` means an admin added them and they have not accepted yet. */\n  status: OrgUserStatus,\n  joinedAt: z.string(),\n  lastActiveAt: z.string().nullable(),\n});\nexport type Student = z.infer<typeof Student>;\n\nexport const StudentCourseProgress = z.object({\n  courseId: z.string(),\n  title: z.string(),\n  totalActivities: z.number().int(),\n  completedActivities: z.number().int(),\n  /** 0–100, completed published activities over the course's total. */\n  progress: z.number().int(),\n  startedAt: z.string().nullable(),\n  lastActivityAt: z.string().nullable(),\n  completedAt: z.string().nullable(),\n});\nexport type StudentCourseProgress = z.infer<typeof StudentCourseProgress>;\n\nexport const StudentAnalytics = z.object({\n  enrolled: z.number().int(),\n  started: z.number().int(),\n  completed: z.number().int(),\n  avgProgress: z.number().int(),\n  courses: z.array(StudentCourseProgress),\n});\nexport type StudentAnalytics = z.infer<typeof StudentAnalytics>;\n\nexport const StudentsQuery = ListQuery;\nexport type StudentsQuery = z.infer<typeof StudentsQuery>;\n\nexport const StudentsPage = paginated(Student);\nexport type StudentsPage = z.infer<typeof StudentsPage>;\n\nexport const StudentIdParam = z.object({ id: z.string() });\nexport type StudentIdParam = z.infer<typeof StudentIdParam>;\n"],"mappings":";;;AAIA,MAAa,gBAAgB,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAGzD,MAAa,UAAU,qBAAqB,OAAO;CACjD,kBAAkB,EAAE,OAAO,CAAC,CAAC,IAAI;;CAEjC,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI;;CAE5B,QAAQ;CACR,UAAU,EAAE,OAAO;CACnB,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;AACpC,CAAC;AAGD,MAAa,wBAAwB,EAAE,OAAO;CAC5C,UAAU,EAAE,OAAO;CACnB,OAAO,EAAE,OAAO;CAChB,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI;CAChC,qBAAqB,EAAE,OAAO,CAAC,CAAC,IAAI;;CAEpC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CACzB,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,gBAAgB,EAAE,OAAO,CAAC,CAAC,SAAS;CACpC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC;AAGD,MAAa,mBAAmB,EAAE,OAAO;CACvC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CACzB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI;CACxB,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI;CAC1B,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI;CAC5B,SAAS,EAAE,MAAM,qBAAqB;AACxC,CAAC;AAGD,MAAa,gBAAgB;AAG7B,MAAa,eAAe,UAAU,OAAO;AAG7C,MAAa,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"students.js","names":[],"sources":["../../../src/http/schemas/students.ts"],"sourcesContent":["// Students resource schemas.\nimport { z } from 'zod';\nimport { ListQuery, paginated, OrgUserProfileSchema } from './shared.js';\nimport { ItemRole } from './members.js';\n\nexport const OrgUserStatus = z.enum(['invited', 'active']);\nexport type OrgUserStatus = z.infer<typeof OrgUserStatus>;\n\nexport const Student = OrgUserProfileSchema.extend({\n  entitlementCount: z.number().int(),\n  /** 0–100, averaged across active entitlements. */\n  avgProgress: z.number().int(),\n  /** `invited` means an admin added them and they have not accepted yet. */\n  status: OrgUserStatus,\n  joinedAt: z.string(),\n  lastActiveAt: z.string().nullable(),\n  items: z.array(ItemRole).describe('The roles they hold on content items.'),\n});\nexport type Student = z.infer<typeof Student>;\n\nexport const StudentCourseProgress = z.object({\n  courseId: z.string(),\n  title: z.string(),\n  totalActivities: z.number().int(),\n  completedActivities: z.number().int(),\n  /** 0–100, completed published activities over the course's total. */\n  progress: z.number().int(),\n  startedAt: z.string().nullable(),\n  lastActivityAt: z.string().nullable(),\n  completedAt: z.string().nullable(),\n});\nexport type StudentCourseProgress = z.infer<typeof StudentCourseProgress>;\n\nexport const StudentAnalytics = z.object({\n  enrolled: z.number().int(),\n  started: z.number().int(),\n  completed: z.number().int(),\n  avgProgress: z.number().int(),\n  courses: z.array(StudentCourseProgress),\n});\nexport type StudentAnalytics = z.infer<typeof StudentAnalytics>;\n\nexport const StudentsQuery = ListQuery;\nexport type StudentsQuery = z.infer<typeof StudentsQuery>;\n\nexport const StudentsPage = paginated(Student);\nexport type StudentsPage = z.infer<typeof StudentsPage>;\n\nexport const StudentIdParam = z.object({ id: z.string() });\nexport type StudentIdParam = z.infer<typeof StudentIdParam>;\n"],"mappings":";;;;AAKA,MAAa,gBAAgB,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAGzD,MAAa,UAAU,qBAAqB,OAAO;CACjD,kBAAkB,EAAE,OAAO,CAAC,CAAC,IAAI;;CAEjC,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI;;CAE5B,QAAQ;CACR,UAAU,EAAE,OAAO;CACnB,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS;CAClC,OAAO,EAAE,MAAM,QAAQ,CAAC,CAAC,SAAS,uCAAuC;AAC3E,CAAC;AAGD,MAAa,wBAAwB,EAAE,OAAO;CAC5C,UAAU,EAAE,OAAO;CACnB,OAAO,EAAE,OAAO;CAChB,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI;CAChC,qBAAqB,EAAE,OAAO,CAAC,CAAC,IAAI;;CAEpC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CACzB,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,gBAAgB,EAAE,OAAO,CAAC,CAAC,SAAS;CACpC,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;AACnC,CAAC;AAGD,MAAa,mBAAmB,EAAE,OAAO;CACvC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI;CACzB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI;CACxB,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI;CAC1B,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI;CAC5B,SAAS,EAAE,MAAM,qBAAqB;AACxC,CAAC;AAGD,MAAa,gBAAgB;AAG7B,MAAa,eAAe,UAAU,OAAO;AAG7C,MAAa,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC"}

package/dist/http/scope.d.ts

@@ -1,23 +1,20 @@
 import { Container } from "../app/container.js";
-import { StaffRole } from "@headless-lms/core/organizations";
+import { CallerLimit } from "@headless-lms/core/organizations";
 import { FastifyRequest } from "fastify";
+import { Actor } from "@headless-lms/core/shared/actor";
 //#region src/http/scope.d.ts
-interface OrgScope {
-  /** Domain `organizations.id` for the session's active org. */
+interface Caller {
+  actor: Actor;
   orgId: string;
-  /** Domain `users.id` of the acting person. */
   userId: string;
-  /** Domain `org_users.id` — the acting org user in this org. */
   orgUserId: string;
-  /** The role held in this org. */
-  role: StaffRole;
-  /** Better-auth organization id (for writes that go through the auth provider). */
   authOrgId: string;
+  authUserId: string;
 }
-/** Thrown when the session has no resolvable active org / domain user. */
 declare class NoActiveOrgError extends Error {}
-declare function resolveScope(container: Container, req: FastifyRequest): Promise<OrgScope>;
-declare function resolveScopeFor(container: Container, authUserId: string, authOrgId: string): Promise<OrgScope>;
+declare function resolveCaller(container: Container, req: FastifyRequest): Promise<Caller>;
+declare function resolveActor(container: Container, req: FastifyRequest): Promise<Actor>;
+declare function resolveCallerFor(container: Container, authUserId: string, authOrgId: string, limit: CallerLimit): Promise<Caller>;
 //#endregion
-export { NoActiveOrgError, OrgScope, resolveScope, resolveScopeFor };
+export { Caller, NoActiveOrgError, resolveActor, resolveCaller, resolveCallerFor };
 //# sourceMappingURL=scope.d.ts.map

package/dist/http/scope.js

@@ -1,44 +1,39 @@
-import { isStaffRole } from "@headless-lms/core/organizations";
 //#region src/http/scope.ts
-/** Thrown when the session has no resolvable active org / domain user. */
 var NoActiveOrgError = class extends Error {};
-async function resolveScope(container, req) {
-	const authUser = req.authUser;
-	const authOrgId = req.authOrgId ?? null;
-	if (!authUser) throw new NoActiveOrgError("Sign in to continue");
-	if (!authOrgId || !req.orgId) throw new NoActiveOrgError("Choose an organization to continue");
-	const org = await container.organizations.getById(req.orgId);
-	if (!org) throw new NoActiveOrgError("The active organization no longer exists");
-	const user = await container.identity.getUserByExternalId(authUser.id);
-	if (!user) throw new NoActiveOrgError("Your account is not set up yet");
-	const orgUser = await container.organizations.getOrgUser(org.id, user.id);
-	if (!orgUser || !isStaffRole(orgUser.role)) throw new NoActiveOrgError("Only staff of this organization can do this");
-	container.requestContext.set({ orgId: org.id });
+function callerFrom(container, resolved, authUserId, authOrgId) {
+	if (!resolved) throw new NoActiveOrgError("The active organization no longer exists");
+	if (!resolved.userId) throw new NoActiveOrgError("Your account is not set up yet");
+	if (!resolved.orgUserId) throw new NoActiveOrgError("You are not a member of this organization");
+	container.requestContext.set({
+		orgId: resolved.orgId,
+		actorId: resolved.orgUserId
+	});
+	if (!resolved.actor) throw new NoActiveOrgError("Accept your invitation to this organization to continue");
 	return {
-		orgId: org.id,
-		userId: user.id,
-		orgUserId: orgUser.id,
-		role: orgUser.role,
-		authOrgId
+		actor: resolved.actor,
+		orgId: resolved.orgId,
+		userId: resolved.userId,
+		orgUserId: resolved.orgUserId,
+		authOrgId,
+		authUserId
 	};
 }
-async function resolveScopeFor(container, authUserId, authOrgId) {
-	const org = await container.organizations.getByExternalId(authOrgId);
-	if (!org) throw new NoActiveOrgError("active organization not found");
-	const user = await container.identity.getUserByExternalId(authUserId);
-	if (!user) throw new NoActiveOrgError("no domain user for the current user");
-	const orgUser = await container.organizations.getOrgUser(org.id, user.id);
-	if (!orgUser || !isStaffRole(orgUser.role)) throw new NoActiveOrgError("not a staff member of the active organization");
-	container.requestContext.set({ orgId: org.id });
-	return {
-		orgId: org.id,
-		userId: user.id,
-		orgUserId: orgUser.id,
-		role: orgUser.role,
-		authOrgId
-	};
+async function resolveCaller(container, req) {
+	const authUserId = req.authUserId;
+	const authOrgId = req.authOrgId ?? null;
+	if (!authUserId) throw new NoActiveOrgError("Sign in to continue");
+	if (!authOrgId || !req.orgId) throw new NoActiveOrgError("Choose an organization to continue");
+	const resolved = req.resolvedCaller ?? await container.organizations.resolveCaller(authOrgId, authUserId);
+	req.resolvedCaller = resolved ?? void 0;
+	return callerFrom(container, resolved, authUserId, authOrgId);
+}
+async function resolveActor(container, req) {
+	return (await resolveCaller(container, req)).actor;
+}
+async function resolveCallerFor(container, authUserId, authOrgId, limit) {
+	return callerFrom(container, await container.organizations.resolveCaller(authOrgId, authUserId, limit), authUserId, authOrgId);
 }
 //#endregion
-export { NoActiveOrgError, resolveScope, resolveScopeFor };
+export { NoActiveOrgError, resolveActor, resolveCaller, resolveCallerFor };
 
 //# sourceMappingURL=scope.js.map

package/dist/http/scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope.js","names":[],"sources":["../../src/http/scope.ts"],"sourcesContent":["import type { FastifyRequest } from 'fastify';\nimport type { Container } from '../app/container.js';\nimport { isStaffRole, type StaffRole } from '@headless-lms/core/organizations';\n\nexport interface OrgScope {\n  /** Domain `organizations.id` for the session's active org. */\n  orgId: string;\n  /** Domain `users.id` of the acting person. */\n  userId: string;\n  /** Domain `org_users.id` — the acting org user in this org. */\n  orgUserId: string;\n  /** The role held in this org. */\n  role: StaffRole;\n  /** Better-auth organization id (for writes that go through the auth provider). */\n  authOrgId: string;\n}\n\n/** Thrown when the session has no resolvable active org / domain user. */\nexport class NoActiveOrgError extends Error {}\n\nexport async function resolveScope(container: Container, req: FastifyRequest): Promise<OrgScope> {\n  const authUser = req.authUser;\n  const authOrgId = req.authOrgId ?? null;\n  if (!authUser) {\n    throw new NoActiveOrgError('Sign in to continue');\n  }\n  if (!authOrgId || !req.orgId) {\n    throw new NoActiveOrgError('Choose an organization to continue');\n  }\n  // The session guard already translated the auth org id to the domain org.\n  const org = await container.organizations.getById(req.orgId);\n  if (!org) {\n    throw new NoActiveOrgError('The active organization no longer exists');\n  }\n  const user = await container.identity.getUserByExternalId(authUser.id);\n  if (!user) {\n    throw new NoActiveOrgError('Your account is not set up yet');\n  }\n  const orgUser = await container.organizations.getOrgUser(org.id, user.id);\n  if (!orgUser || !isStaffRole(orgUser.role)) {\n    throw new NoActiveOrgError('Only staff of this organization can do this');\n  }\n  container.requestContext.set({ orgId: org.id });\n  return {\n    orgId: org.id,\n    userId: user.id,\n    orgUserId: orgUser.id,\n    role: orgUser.role,\n    authOrgId,\n  };\n}\n\nexport async function resolveScopeFor(\n  container: Container,\n  authUserId: string,\n  authOrgId: string,\n): Promise<OrgScope> {\n  const org = await container.organizations.getByExternalId(authOrgId);\n  if (!org) {\n    throw new NoActiveOrgError('active organization not found');\n  }\n  const user = await container.identity.getUserByExternalId(authUserId);\n  if (!user) {\n    throw new NoActiveOrgError('no domain user for the current user');\n  }\n  const orgUser = await container.organizations.getOrgUser(org.id, user.id);\n  if (!orgUser || !isStaffRole(orgUser.role)) {\n    throw new NoActiveOrgError('not a staff member of the active organization');\n  }\n  container.requestContext.set({ orgId: org.id });\n  return { orgId: org.id, userId: user.id, orgUserId: orgUser.id, role: orgUser.role, authOrgId };\n}\n"],"mappings":";;;AAkBA,IAAa,mBAAb,cAAsC,MAAM,CAAC;AAE7C,eAAsB,aAAa,WAAsB,KAAwC;CAC/F,MAAM,WAAW,IAAI;CACrB,MAAM,YAAY,IAAI,aAAa;CACnC,IAAI,CAAC,UACH,MAAM,IAAI,iBAAiB,qBAAqB;CAElD,IAAI,CAAC,aAAa,CAAC,IAAI,OACrB,MAAM,IAAI,iBAAiB,oCAAoC;CAGjE,MAAM,MAAM,MAAM,UAAU,cAAc,QAAQ,IAAI,KAAK;CAC3D,IAAI,CAAC,KACH,MAAM,IAAI,iBAAiB,0CAA0C;CAEvE,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB,SAAS,EAAE;CACrE,IAAI,CAAC,MACH,MAAM,IAAI,iBAAiB,gCAAgC;CAE7D,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,IAAI,KAAK,EAAE;CACxE,IAAI,CAAC,WAAW,CAAC,YAAY,QAAQ,IAAI,GACvC,MAAM,IAAI,iBAAiB,6CAA6C;CAE1E,UAAU,eAAe,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC;CAC9C,OAAO;EACL,OAAO,IAAI;EACX,QAAQ,KAAK;EACb,WAAW,QAAQ;EACnB,MAAM,QAAQ;EACd;CACF;AACF;AAEA,eAAsB,gBACpB,WACA,YACA,WACmB;CACnB,MAAM,MAAM,MAAM,UAAU,cAAc,gBAAgB,SAAS;CACnE,IAAI,CAAC,KACH,MAAM,IAAI,iBAAiB,+BAA+B;CAE5D,MAAM,OAAO,MAAM,UAAU,SAAS,oBAAoB,UAAU;CACpE,IAAI,CAAC,MACH,MAAM,IAAI,iBAAiB,qCAAqC;CAElE,MAAM,UAAU,MAAM,UAAU,cAAc,WAAW,IAAI,IAAI,KAAK,EAAE;CACxE,IAAI,CAAC,WAAW,CAAC,YAAY,QAAQ,IAAI,GACvC,MAAM,IAAI,iBAAiB,+CAA+C;CAE5E,UAAU,eAAe,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC;CAC9C,OAAO;EAAE,OAAO,IAAI;EAAI,QAAQ,KAAK;EAAI,WAAW,QAAQ;EAAI,MAAM,QAAQ;EAAM;CAAU;AAChG"}
+{"version":3,"file":"scope.js","names":[],"sources":["../../src/http/scope.ts"],"sourcesContent":["import type { FastifyRequest } from 'fastify';\nimport type { Container } from '../app/container.js';\nimport type { Actor } from '@headless-lms/core/shared/actor';\nimport type { CallerLimit, ResolvedCaller } from '@headless-lms/core/organizations';\n\nexport interface Caller {\n  actor: Actor;\n  orgId: string;\n  userId: string;\n  orgUserId: string;\n  authOrgId: string;\n  authUserId: string;\n}\n\nexport class NoActiveOrgError extends Error {}\n\nfunction callerFrom(\n  container: Container,\n  resolved: ResolvedCaller | null,\n  authUserId: string,\n  authOrgId: string,\n): Caller {\n  if (!resolved) {\n    throw new NoActiveOrgError('The active organization no longer exists');\n  }\n  if (!resolved.userId) {\n    throw new NoActiveOrgError('Your account is not set up yet');\n  }\n  if (!resolved.orgUserId) {\n    throw new NoActiveOrgError('You are not a member of this organization');\n  }\n  container.requestContext.set({ orgId: resolved.orgId, actorId: resolved.orgUserId });\n  if (!resolved.actor) {\n    throw new NoActiveOrgError('Accept your invitation to this organization to continue');\n  }\n  return {\n    actor: resolved.actor,\n    orgId: resolved.orgId,\n    userId: resolved.userId,\n    orgUserId: resolved.orgUserId,\n    authOrgId,\n    authUserId,\n  };\n}\n\nexport async function resolveCaller(container: Container, req: FastifyRequest): Promise<Caller> {\n  const authUserId = req.authUserId;\n  const authOrgId = req.authOrgId ?? null;\n  if (!authUserId) {\n    throw new NoActiveOrgError('Sign in to continue');\n  }\n  if (!authOrgId || !req.orgId) {\n    throw new NoActiveOrgError('Choose an organization to continue');\n  }\n  const resolved =\n    req.resolvedCaller ?? (await container.organizations.resolveCaller(authOrgId, authUserId));\n  req.resolvedCaller = resolved ?? undefined;\n  return callerFrom(container, resolved, authUserId, authOrgId);\n}\n\nexport async function resolveActor(container: Container, req: FastifyRequest): Promise<Actor> {\n  return (await resolveCaller(container, req)).actor;\n}\n\nexport async function resolveCallerFor(\n  container: Container,\n  authUserId: string,\n  authOrgId: string,\n  limit: CallerLimit,\n): Promise<Caller> {\n  return callerFrom(\n    container,\n    await container.organizations.resolveCaller(authOrgId, authUserId, limit),\n    authUserId,\n    authOrgId,\n  );\n}\n"],"mappings":";AAcA,IAAa,mBAAb,cAAsC,MAAM,CAAC;AAE7C,SAAS,WACP,WACA,UACA,YACA,WACQ;CACR,IAAI,CAAC,UACH,MAAM,IAAI,iBAAiB,0CAA0C;CAEvE,IAAI,CAAC,SAAS,QACZ,MAAM,IAAI,iBAAiB,gCAAgC;CAE7D,IAAI,CAAC,SAAS,WACZ,MAAM,IAAI,iBAAiB,2CAA2C;CAExE,UAAU,eAAe,IAAI;EAAE,OAAO,SAAS;EAAO,SAAS,SAAS;CAAU,CAAC;CACnF,IAAI,CAAC,SAAS,OACZ,MAAM,IAAI,iBAAiB,yDAAyD;CAEtF,OAAO;EACL,OAAO,SAAS;EAChB,OAAO,SAAS;EAChB,QAAQ,SAAS;EACjB,WAAW,SAAS;EACpB;EACA;CACF;AACF;AAEA,eAAsB,cAAc,WAAsB,KAAsC;CAC9F,MAAM,aAAa,IAAI;CACvB,MAAM,YAAY,IAAI,aAAa;CACnC,IAAI,CAAC,YACH,MAAM,IAAI,iBAAiB,qBAAqB;CAElD,IAAI,CAAC,aAAa,CAAC,IAAI,OACrB,MAAM,IAAI,iBAAiB,oCAAoC;CAEjE,MAAM,WACJ,IAAI,kBAAmB,MAAM,UAAU,cAAc,cAAc,WAAW,UAAU;CAC1F,IAAI,iBAAiB,YAAY,KAAA;CACjC,OAAO,WAAW,WAAW,UAAU,YAAY,SAAS;AAC9D;AAEA,eAAsB,aAAa,WAAsB,KAAqC;CAC5F,QAAQ,MAAM,cAAc,WAAW,GAAG,EAAA,CAAG;AAC/C;AAEA,eAAsB,iBACpB,WACA,YACA,WACA,OACiB;CACjB,OAAO,WACL,WACA,MAAM,UAAU,cAAc,cAAc,WAAW,YAAY,KAAK,GACxE,YACA,SACF;AACF"}

package/dist/http/server.js

@@ -3,11 +3,13 @@ import { registerOpenApi } from "./plugins/openapi.js";
 import { registerAuth } from "./plugins/auth.js";
 import { registerWellKnown } from "./well-known.js";
 import { errorHandler, notFoundHandler } from "./plugins/error-handler.js";
+import { trackEventStreams } from "./sse.js";
 import { registerRoutes } from "./routes.js";
 import { registerMcp } from "./mcp/route.js";
 import Fastify from "fastify";
 import { serializerCompiler, validatorCompiler } from "fastify-type-provider-zod";
 //#region src/http/server.ts
+const STREAMS_CLOSE_MS = 2e3;
 async function buildServer(config, container) {
 	const app = Fastify({
 		loggerInstance: container.loggerInstance,
@@ -28,9 +30,16 @@ async function buildServer(config, container) {
 	if (container.mcp.oauthEnabled) registerWellKnown(app, container);
 	registerRoutes(app, container);
 	registerMcp(app, container);
+	const eventStreams = trackEventStreams(app);
+	app.addHook("preClose", async () => {
+		const deadline = Date.now() + STREAMS_CLOSE_MS;
+		await container.chatHub?.close();
+		await eventStreams.settled(Math.max(0, deadline - Date.now()));
+	});
 	app.addHook("onClose", async () => {
 		await container.outboxRelay.stop();
 		await container.automationEngine.stop();
+		await container.pubsub?.stop();
 	});
 	return app;
 }

package/dist/http/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","names":[],"sources":["../../src/http/server.ts"],"sourcesContent":["import Fastify, { type FastifyBaseLogger, type FastifyInstance } from 'fastify';\nimport { serializerCompiler, validatorCompiler } from 'fastify-type-provider-zod';\nimport type { Container } from '../app/container.js';\nimport type { ServerConfig } from './config.js';\nimport { registerCors } from './plugins/cors.js';\nimport { registerOpenApi } from './plugins/openapi.js';\nimport { registerAuth } from './plugins/auth.js';\nimport { registerWellKnown } from './well-known.js';\nimport { errorHandler, notFoundHandler } from './plugins/error-handler.js';\nimport { registerRoutes } from './routes.js';\nimport { registerMcp } from './mcp/route.js';\n\nexport async function buildServer(\n  config: ServerConfig,\n  container: Container,\n): Promise<FastifyInstance> {\n  // One log stream for the whole process: HTTP shares the container's pino root.\n  // Widened to FastifyBaseLogger so the instance keeps the default logger\n  // generic (a concrete pino type would ripple through every plugin signature).\n  const app = Fastify({\n    loggerInstance: container.loggerInstance as FastifyBaseLogger,\n    // Fastify's own request/response pair per call — noisy in a dev console,\n    // useful as an access log in production. Our own logs are unaffected.\n    disableRequestLogging: config.requestLogging === false,\n    // Adopt the caller's correlation id when it sends one, so one id joins\n    // the client's log line to this process's.\n    requestIdHeader: 'x-request-id',\n  });\n\n  // Enter the request-scoped log context: every line logged inside this\n  // request's async scope carries its reqId (and orgId once resolveScope runs),\n  // wherever it is emitted. The id is echoed on the response so callers can\n  // quote it when reporting a failure.\n  app.addHook('onRequest', (request, reply, done) => {\n    reply.header('x-request-id', request.id);\n    container.requestContext.run({ reqId: request.id }, done);\n  });\n\n  // Validate + serialize request/response bodies from the shared Zod contract.\n  app.setValidatorCompiler(validatorCompiler);\n  app.setSerializerCompiler(serializerCompiler);\n  app.setErrorHandler(errorHandler);\n  app.setNotFoundHandler(notFoundHandler);\n\n  registerCors(app, config);\n  registerOpenApi(app, config);\n  registerAuth(app, container);\n  if (container.mcp.oauthEnabled) {\n    registerWellKnown(app, container);\n  }\n\n  registerRoutes(app, container);\n  registerMcp(app, container);\n\n  // Drain + stop the outbox relay and the automation engine on shutdown.\n  // Harmless when neither was started (gen-openapi boots this app with\n  // ready() + close() only).\n  app.addHook('onClose', async () => {\n    await container.outboxRelay.stop();\n    await container.automationEngine.stop();\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;AAYA,eAAsB,YACpB,QACA,WAC0B;CAI1B,MAAM,MAAM,QAAQ;EAClB,gBAAgB,UAAU;EAG1B,uBAAuB,OAAO,mBAAmB;EAGjD,iBAAiB;CACnB,CAAC;CAMD,IAAI,QAAQ,cAAc,SAAS,OAAO,SAAS;EACjD,MAAM,OAAO,gBAAgB,QAAQ,EAAE;EACvC,UAAU,eAAe,IAAI,EAAE,OAAO,QAAQ,GAAG,GAAG,IAAI;CAC1D,CAAC;CAGD,IAAI,qBAAqB,iBAAiB;CAC1C,IAAI,sBAAsB,kBAAkB;CAC5C,IAAI,gBAAgB,YAAY;CAChC,IAAI,mBAAmB,eAAe;CAEtC,aAAa,KAAK,MAAM;CACxB,gBAAgB,KAAK,MAAM;CAC3B,aAAa,KAAK,SAAS;CAC3B,IAAI,UAAU,IAAI,cAChB,kBAAkB,KAAK,SAAS;CAGlC,eAAe,KAAK,SAAS;CAC7B,YAAY,KAAK,SAAS;CAK1B,IAAI,QAAQ,WAAW,YAAY;EACjC,MAAM,UAAU,YAAY,KAAK;EACjC,MAAM,UAAU,iBAAiB,KAAK;CACxC,CAAC;CAED,OAAO;AACT"}
+{"version":3,"file":"server.js","names":[],"sources":["../../src/http/server.ts"],"sourcesContent":["import Fastify, { type FastifyBaseLogger, type FastifyInstance } from 'fastify';\nimport { serializerCompiler, validatorCompiler } from 'fastify-type-provider-zod';\nimport type { Container } from '../app/container.js';\nimport type { ServerConfig } from './config.js';\nimport { registerCors } from './plugins/cors.js';\nimport { registerOpenApi } from './plugins/openapi.js';\nimport { registerAuth } from './plugins/auth.js';\nimport { registerWellKnown } from './well-known.js';\nimport { errorHandler, notFoundHandler } from './plugins/error-handler.js';\nimport { registerRoutes } from './routes.js';\nimport { registerMcp } from './mcp/route.js';\nimport { trackEventStreams } from './sse.js';\n\nconst STREAMS_CLOSE_MS = 2000;\n\nexport async function buildServer(\n  config: ServerConfig,\n  container: Container,\n): Promise<FastifyInstance> {\n  // One log stream for the whole process: HTTP shares the container's pino root.\n  // Widened to FastifyBaseLogger so the instance keeps the default logger\n  // generic (a concrete pino type would ripple through every plugin signature).\n  const app = Fastify({\n    loggerInstance: container.loggerInstance as FastifyBaseLogger,\n    // Fastify's own request/response pair per call — noisy in a dev console,\n    // useful as an access log in production. Our own logs are unaffected.\n    disableRequestLogging: config.requestLogging === false,\n    // Adopt the caller's correlation id when it sends one, so one id joins\n    // the client's log line to this process's.\n    requestIdHeader: 'x-request-id',\n  });\n\n  // Enter the request-scoped log context: every line logged inside this\n  // request's async scope carries its reqId (and orgId once resolveScope runs),\n  // wherever it is emitted. The id is echoed on the response so callers can\n  // quote it when reporting a failure.\n  app.addHook('onRequest', (request, reply, done) => {\n    reply.header('x-request-id', request.id);\n    container.requestContext.run({ reqId: request.id }, done);\n  });\n\n  // Validate + serialize request/response bodies from the shared Zod contract.\n  app.setValidatorCompiler(validatorCompiler);\n  app.setSerializerCompiler(serializerCompiler);\n  app.setErrorHandler(errorHandler);\n  app.setNotFoundHandler(notFoundHandler);\n\n  registerCors(app, config);\n  registerOpenApi(app, config);\n  registerAuth(app, container);\n  if (container.mcp.oauthEnabled) {\n    registerWellKnown(app, container);\n  }\n\n  registerRoutes(app, container);\n  registerMcp(app, container);\n\n  // Open chat streams, and stream requests still on their way to the hub, get\n  // their closing frame before Fastify drops every connection.\n  const eventStreams = trackEventStreams(app);\n  app.addHook('preClose', async () => {\n    const deadline = Date.now() + STREAMS_CLOSE_MS;\n    await container.chatHub?.close();\n    await eventStreams.settled(Math.max(0, deadline - Date.now()));\n  });\n\n  // Drain + stop the outbox relay, the automation engine and then PubSub on\n  // shutdown, so events still in flight are forwarded. Harmless when none was\n  // started (gen-openapi boots this app with ready() + close() only).\n  app.addHook('onClose', async () => {\n    await container.outboxRelay.stop();\n    await container.automationEngine.stop();\n    await container.pubsub?.stop();\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;AAaA,MAAM,mBAAmB;AAEzB,eAAsB,YACpB,QACA,WAC0B;CAI1B,MAAM,MAAM,QAAQ;EAClB,gBAAgB,UAAU;EAG1B,uBAAuB,OAAO,mBAAmB;EAGjD,iBAAiB;CACnB,CAAC;CAMD,IAAI,QAAQ,cAAc,SAAS,OAAO,SAAS;EACjD,MAAM,OAAO,gBAAgB,QAAQ,EAAE;EACvC,UAAU,eAAe,IAAI,EAAE,OAAO,QAAQ,GAAG,GAAG,IAAI;CAC1D,CAAC;CAGD,IAAI,qBAAqB,iBAAiB;CAC1C,IAAI,sBAAsB,kBAAkB;CAC5C,IAAI,gBAAgB,YAAY;CAChC,IAAI,mBAAmB,eAAe;CAEtC,aAAa,KAAK,MAAM;CACxB,gBAAgB,KAAK,MAAM;CAC3B,aAAa,KAAK,SAAS;CAC3B,IAAI,UAAU,IAAI,cAChB,kBAAkB,KAAK,SAAS;CAGlC,eAAe,KAAK,SAAS;CAC7B,YAAY,KAAK,SAAS;CAI1B,MAAM,eAAe,kBAAkB,GAAG;CAC1C,IAAI,QAAQ,YAAY,YAAY;EAClC,MAAM,WAAW,KAAK,IAAI,IAAI;EAC9B,MAAM,UAAU,SAAS,MAAM;EAC/B,MAAM,aAAa,QAAQ,KAAK,IAAI,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC;CAC/D,CAAC;CAKD,IAAI,QAAQ,WAAW,YAAY;EACjC,MAAM,UAAU,YAAY,KAAK;EACjC,MAAM,UAAU,iBAAiB,KAAK;EACtC,MAAM,UAAU,QAAQ,KAAK;CAC/B,CAAC;CAED,OAAO;AACT"}

package/dist/http/shutdown.d.ts

@@ -0,0 +1,11 @@
+import { FastifyInstance } from "fastify";
+//#region src/http/shutdown.d.ts
+interface CloseOnSignalsOptions {
+  signals?: NodeJS.Signals[];
+  timeoutMs?: number;
+  process?: Pick<NodeJS.Process, 'on' | 'exit'>;
+}
+declare function closeOnSignals(app: FastifyInstance, options?: CloseOnSignalsOptions): void;
+//#endregion
+export { CloseOnSignalsOptions, closeOnSignals };
+//# sourceMappingURL=shutdown.d.ts.map

package/dist/http/shutdown.js

@@ -0,0 +1,40 @@
+//#region src/http/shutdown.ts
+function closeOnSignals(app, options = {}) {
+	const proc = options.process ?? process;
+	const timeoutMs = options.timeoutMs ?? 1e4;
+	let closing = false;
+	const onSignal = (signal) => {
+		if (closing) {
+			app.log.warn({ signal }, "second signal; exiting without finishing shutdown");
+			proc.exit(1);
+			return;
+		}
+		closing = true;
+		app.log.info({ signal }, "shutting down");
+		const timer = setTimeout(() => {
+			app.log.error({
+				signal,
+				timeoutMs
+			}, "shutdown timed out; exiting");
+			proc.exit(1);
+		}, timeoutMs);
+		timer.unref();
+		app.close().then(() => {
+			clearTimeout(timer);
+			app.log.info({ signal }, "shut down");
+			proc.exit(0);
+		}, (err) => {
+			clearTimeout(timer);
+			app.log.error({
+				err,
+				signal
+			}, "shutdown failed");
+			proc.exit(1);
+		});
+	};
+	for (const signal of options.signals ?? ["SIGTERM", "SIGINT"]) proc.on(signal, onSignal);
+}
+//#endregion
+export { closeOnSignals };
+
+//# sourceMappingURL=shutdown.js.map

package/dist/http/shutdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shutdown.js","names":[],"sources":["../../src/http/shutdown.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\n\nexport interface CloseOnSignalsOptions {\n  signals?: NodeJS.Signals[];\n  timeoutMs?: number;\n  process?: Pick<NodeJS.Process, 'on' | 'exit'>;\n}\n\nexport function closeOnSignals(app: FastifyInstance, options: CloseOnSignalsOptions = {}): void {\n  const proc = options.process ?? process;\n  const timeoutMs = options.timeoutMs ?? 10_000;\n  let closing = false;\n  const onSignal = (signal: NodeJS.Signals) => {\n    if (closing) {\n      app.log.warn({ signal }, 'second signal; exiting without finishing shutdown');\n      proc.exit(1);\n      return;\n    }\n    closing = true;\n    app.log.info({ signal }, 'shutting down');\n    const timer = setTimeout(() => {\n      app.log.error({ signal, timeoutMs }, 'shutdown timed out; exiting');\n      proc.exit(1);\n    }, timeoutMs);\n    timer.unref();\n    app.close().then(\n      () => {\n        clearTimeout(timer);\n        app.log.info({ signal }, 'shut down');\n        proc.exit(0);\n      },\n      (err: unknown) => {\n        clearTimeout(timer);\n        app.log.error({ err, signal }, 'shutdown failed');\n        proc.exit(1);\n      },\n    );\n  };\n  for (const signal of options.signals ?? ['SIGTERM', 'SIGINT']) {\n    proc.on(signal, onSignal);\n  }\n}\n"],"mappings":";AAQA,SAAgB,eAAe,KAAsB,UAAiC,CAAC,GAAS;CAC9F,MAAM,OAAO,QAAQ,WAAW;CAChC,MAAM,YAAY,QAAQ,aAAa;CACvC,IAAI,UAAU;CACd,MAAM,YAAY,WAA2B;EAC3C,IAAI,SAAS;GACX,IAAI,IAAI,KAAK,EAAE,OAAO,GAAG,mDAAmD;GAC5E,KAAK,KAAK,CAAC;GACX;EACF;EACA,UAAU;EACV,IAAI,IAAI,KAAK,EAAE,OAAO,GAAG,eAAe;EACxC,MAAM,QAAQ,iBAAiB;GAC7B,IAAI,IAAI,MAAM;IAAE;IAAQ;GAAU,GAAG,6BAA6B;GAClE,KAAK,KAAK,CAAC;EACb,GAAG,SAAS;EACZ,MAAM,MAAM;EACZ,IAAI,MAAM,CAAC,CAAC,WACJ;GACJ,aAAa,KAAK;GAClB,IAAI,IAAI,KAAK,EAAE,OAAO,GAAG,WAAW;GACpC,KAAK,KAAK,CAAC;EACb,IACC,QAAiB;GAChB,aAAa,KAAK;GAClB,IAAI,IAAI,MAAM;IAAE;IAAK;GAAO,GAAG,iBAAiB;GAChD,KAAK,KAAK,CAAC;EACb,CACF;CACF;CACA,KAAK,MAAM,UAAU,QAAQ,WAAW,CAAC,WAAW,QAAQ,GAC1D,KAAK,GAAG,QAAQ,QAAQ;AAE5B"}

package/dist/http/sse.d.ts

@@ -0,0 +1,19 @@
+import { FastifyInstance, FastifyReply } from "fastify";
+//#region src/http/sse.d.ts
+interface EventStreams {
+  /** Resolves once every event stream request in flight has finished, or after `timeoutMs`. */
+  settled(timeoutMs: number): Promise<void>;
+}
+/** Tracks the requests to routes marked `config.eventStream`, from routing to
+ *  the end of their response. */
+declare function trackEventStreams(app: FastifyInstance): EventStreams;
+interface SseOptions {
+  pingMs?: number;
+  drainTimeoutMs?: number;
+}
+declare function sse<T extends {
+  type: string;
+}>(reply: FastifyReply, events: AsyncIterable<T>, options?: SseOptions): Promise<void>;
+//#endregion
+export { EventStreams, SseOptions, sse, trackEventStreams };
+//# sourceMappingURL=sse.d.ts.map

package/dist/http/sse.js

@@ -0,0 +1,104 @@
+//#region src/http/sse.ts
+const PING_MS = 25e3;
+const DRAIN_TIMEOUT_MS = 3e4;
+/** Tracks the requests to routes marked `config.eventStream`, from routing to
+*  the end of their response. */
+function trackEventStreams(app) {
+	const open = /* @__PURE__ */ new Set();
+	app.addHook("onRequest", async (req, reply) => {
+		if (!req.routeOptions.config.eventStream) return;
+		const closed = new Promise((resolve) => reply.raw.once("close", () => resolve()));
+		open.add(closed);
+		closed.then(() => open.delete(closed));
+	});
+	return { async settled(timeoutMs) {
+		let timer;
+		await Promise.race([Promise.all(open), new Promise((resolve) => {
+			timer = setTimeout(resolve, timeoutMs);
+		})]);
+		clearTimeout(timer);
+	} };
+}
+async function sse(reply, events, options = {}) {
+	const pingMs = options.pingMs ?? PING_MS;
+	const drainTimeoutMs = options.drainTimeoutMs ?? DRAIN_TIMEOUT_MS;
+	const res = reply.raw;
+	const iterator = events[Symbol.asyncIterator]();
+	reply.hijack();
+	const set = Object.entries(reply.getHeaders()).filter((entry) => entry[1] !== void 0);
+	res.writeHead(200, {
+		...Object.fromEntries(set),
+		"content-type": "text/event-stream; charset=utf-8",
+		"cache-control": "no-cache, no-transform",
+		"x-accel-buffering": "no"
+	});
+	res.flushHeaders();
+	let closed = false;
+	let draining = false;
+	let ended = "client";
+	let sent = 0;
+	const close = () => {
+		if (closed) return;
+		closed = true;
+		clearInterval(ping);
+		iterator.return?.();
+	};
+	res.on("close", close);
+	const write = async (chunk) => {
+		if (closed) return false;
+		if (res.write(chunk)) return true;
+		draining = true;
+		const drained = await new Promise((resolve) => {
+			const done = (ok) => {
+				clearTimeout(timer);
+				res.off("drain", onDrain);
+				res.off("close", onClose);
+				resolve(ok);
+			};
+			const onDrain = () => done(true);
+			const onClose = () => done(false);
+			const timer = setTimeout(() => done(false), drainTimeoutMs);
+			res.on("drain", onDrain);
+			res.on("close", onClose);
+		});
+		draining = false;
+		if (!drained && !closed) {
+			ended = "undrained";
+			reply.log.warn("event stream not drained; closing it");
+			close();
+			res.destroy();
+		}
+		return drained;
+	};
+	const ping = setInterval(() => {
+		if (!draining) write(": ping\n\n");
+	}, pingMs);
+	ping.unref();
+	try {
+		while (!closed) {
+			const next = await iterator.next();
+			if (next.done) {
+				if (!closed) ended = "server";
+				break;
+			}
+			const event = next.value;
+			if (!await write(`event: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`)) break;
+			sent += 1;
+		}
+	} catch (error) {
+		ended = "error";
+		reply.log.error({ err: error }, "event stream failed");
+	} finally {
+		close();
+		if (!res.destroyed && !res.writableEnded) res.end();
+		reply.log.info({
+			responseTime: reply.elapsedTime,
+			ended,
+			events: sent
+		}, "event stream ended");
+	}
+}
+//#endregion
+export { sse, trackEventStreams };
+
+//# sourceMappingURL=sse.js.map

package/dist/http/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","names":[],"sources":["../../src/http/sse.ts"],"sourcesContent":["import type { FastifyInstance, FastifyReply } from 'fastify';\n\nconst PING_MS = 25_000;\nconst DRAIN_TIMEOUT_MS = 30_000;\n\nexport interface EventStreams {\n  /** Resolves once every event stream request in flight has finished, or after `timeoutMs`. */\n  settled(timeoutMs: number): Promise<void>;\n}\n\n/** Tracks the requests to routes marked `config.eventStream`, from routing to\n *  the end of their response. */\nexport function trackEventStreams(app: FastifyInstance): EventStreams {\n  const open = new Set<Promise<void>>();\n  app.addHook('onRequest', async (req, reply) => {\n    if (!req.routeOptions.config.eventStream) {\n      return;\n    }\n    const closed = new Promise<void>((resolve) => reply.raw.once('close', () => resolve()));\n    open.add(closed);\n    void closed.then(() => open.delete(closed));\n  });\n  return {\n    async settled(timeoutMs) {\n      let timer: NodeJS.Timeout | undefined;\n      await Promise.race([\n        Promise.all(open),\n        new Promise((resolve) => {\n          timer = setTimeout(resolve, timeoutMs);\n        }),\n      ]);\n      clearTimeout(timer);\n    },\n  };\n}\n\nexport interface SseOptions {\n  pingMs?: number;\n  drainTimeoutMs?: number;\n}\n\nexport async function sse<T extends { type: string }>(\n  reply: FastifyReply,\n  events: AsyncIterable<T>,\n  options: SseOptions = {},\n): Promise<void> {\n  const pingMs = options.pingMs ?? PING_MS;\n  const drainTimeoutMs = options.drainTimeoutMs ?? DRAIN_TIMEOUT_MS;\n  const res = reply.raw;\n  const iterator = events[Symbol.asyncIterator]();\n\n  reply.hijack();\n  const set = Object.entries(reply.getHeaders()).filter(\n    (entry): entry is [string, string | number | string[]] => entry[1] !== undefined,\n  );\n  res.writeHead(200, {\n    ...Object.fromEntries(set),\n    'content-type': 'text/event-stream; charset=utf-8',\n    'cache-control': 'no-cache, no-transform',\n    'x-accel-buffering': 'no',\n  });\n  res.flushHeaders();\n\n  let closed = false;\n  let draining = false;\n  let ended: 'client' | 'server' | 'undrained' | 'error' = 'client';\n  let sent = 0;\n  const close = () => {\n    if (closed) {\n      return;\n    }\n    closed = true;\n    clearInterval(ping);\n    void iterator.return?.();\n  };\n  res.on('close', close);\n\n  const write = async (chunk: string): Promise<boolean> => {\n    if (closed) {\n      return false;\n    }\n    if (res.write(chunk)) {\n      return true;\n    }\n    draining = true;\n    const drained = await new Promise<boolean>((resolve) => {\n      const done = (ok: boolean) => {\n        clearTimeout(timer);\n        res.off('drain', onDrain);\n        res.off('close', onClose);\n        resolve(ok);\n      };\n      const onDrain = () => done(true);\n      const onClose = () => done(false);\n      const timer = setTimeout(() => done(false), drainTimeoutMs);\n      res.on('drain', onDrain);\n      res.on('close', onClose);\n    });\n    draining = false;\n    if (!drained && !closed) {\n      ended = 'undrained';\n      reply.log.warn('event stream not drained; closing it');\n      close();\n      res.destroy();\n    }\n    return drained;\n  };\n\n  const ping = setInterval(() => {\n    if (!draining) {\n      void write(': ping\\n\\n');\n    }\n  }, pingMs);\n  ping.unref();\n\n  try {\n    while (!closed) {\n      const next = await iterator.next();\n      if (next.done) {\n        if (!closed) {\n          ended = 'server';\n        }\n        break;\n      }\n      const event = next.value;\n      // The generated SDK client yields only `data`, so it carries `type` too.\n      if (!(await write(`event: ${event.type}\\ndata: ${JSON.stringify(event)}\\n\\n`))) {\n        break;\n      }\n      sent += 1;\n    }\n  } catch (error) {\n    ended = 'error';\n    reply.log.error({ err: error }, 'event stream failed');\n  } finally {\n    close();\n    if (!res.destroyed && !res.writableEnded) {\n      res.end();\n    }\n    reply.log.info({ responseTime: reply.elapsedTime, ended, events: sent }, 'event stream ended');\n  }\n}\n"],"mappings":";AAEA,MAAM,UAAU;AAChB,MAAM,mBAAmB;;;AASzB,SAAgB,kBAAkB,KAAoC;CACpE,MAAM,uBAAO,IAAI,IAAmB;CACpC,IAAI,QAAQ,aAAa,OAAO,KAAK,UAAU;EAC7C,IAAI,CAAC,IAAI,aAAa,OAAO,aAC3B;EAEF,MAAM,SAAS,IAAI,SAAe,YAAY,MAAM,IAAI,KAAK,eAAe,QAAQ,CAAC,CAAC;EACtF,KAAK,IAAI,MAAM;EACf,OAAY,WAAW,KAAK,OAAO,MAAM,CAAC;CAC5C,CAAC;CACD,OAAO,EACL,MAAM,QAAQ,WAAW;EACvB,IAAI;EACJ,MAAM,QAAQ,KAAK,CACjB,QAAQ,IAAI,IAAI,GAChB,IAAI,SAAS,YAAY;GACvB,QAAQ,WAAW,SAAS,SAAS;EACvC,CAAC,CACH,CAAC;EACD,aAAa,KAAK;CACpB,EACF;AACF;AAOA,eAAsB,IACpB,OACA,QACA,UAAsB,CAAC,GACR;CACf,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,MAAM,MAAM;CAClB,MAAM,WAAW,OAAO,OAAO,cAAc,CAAC;CAE9C,MAAM,OAAO;CACb,MAAM,MAAM,OAAO,QAAQ,MAAM,WAAW,CAAC,CAAC,CAAC,QAC5C,UAAyD,MAAM,OAAO,KAAA,CACzE;CACA,IAAI,UAAU,KAAK;EACjB,GAAG,OAAO,YAAY,GAAG;EACzB,gBAAgB;EAChB,iBAAiB;EACjB,qBAAqB;CACvB,CAAC;CACD,IAAI,aAAa;CAEjB,IAAI,SAAS;CACb,IAAI,WAAW;CACf,IAAI,QAAqD;CACzD,IAAI,OAAO;CACX,MAAM,cAAc;EAClB,IAAI,QACF;EAEF,SAAS;EACT,cAAc,IAAI;EAClB,SAAc,SAAS;CACzB;CACA,IAAI,GAAG,SAAS,KAAK;CAErB,MAAM,QAAQ,OAAO,UAAoC;EACvD,IAAI,QACF,OAAO;EAET,IAAI,IAAI,MAAM,KAAK,GACjB,OAAO;EAET,WAAW;EACX,MAAM,UAAU,MAAM,IAAI,SAAkB,YAAY;GACtD,MAAM,QAAQ,OAAgB;IAC5B,aAAa,KAAK;IAClB,IAAI,IAAI,SAAS,OAAO;IACxB,IAAI,IAAI,SAAS,OAAO;IACxB,QAAQ,EAAE;GACZ;GACA,MAAM,gBAAgB,KAAK,IAAI;GAC/B,MAAM,gBAAgB,KAAK,KAAK;GAChC,MAAM,QAAQ,iBAAiB,KAAK,KAAK,GAAG,cAAc;GAC1D,IAAI,GAAG,SAAS,OAAO;GACvB,IAAI,GAAG,SAAS,OAAO;EACzB,CAAC;EACD,WAAW;EACX,IAAI,CAAC,WAAW,CAAC,QAAQ;GACvB,QAAQ;GACR,MAAM,IAAI,KAAK,sCAAsC;GACrD,MAAM;GACN,IAAI,QAAQ;EACd;EACA,OAAO;CACT;CAEA,MAAM,OAAO,kBAAkB;EAC7B,IAAI,CAAC,UACH,MAAW,YAAY;CAE3B,GAAG,MAAM;CACT,KAAK,MAAM;CAEX,IAAI;EACF,OAAO,CAAC,QAAQ;GACd,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,IAAI,KAAK,MAAM;IACb,IAAI,CAAC,QACH,QAAQ;IAEV;GACF;GACA,MAAM,QAAQ,KAAK;GAEnB,IAAI,CAAE,MAAM,MAAM,UAAU,MAAM,KAAK,UAAU,KAAK,UAAU,KAAK,EAAE,KAAK,GAC1E;GAEF,QAAQ;EACV;CACF,SAAS,OAAO;EACd,QAAQ;EACR,MAAM,IAAI,MAAM,EAAE,KAAK,MAAM,GAAG,qBAAqB;CACvD,UAAU;EACR,MAAM;EACN,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,eACzB,IAAI,IAAI;EAEV,MAAM,IAAI,KAAK;GAAE,cAAc,MAAM;GAAa;GAAO,QAAQ;EAAK,GAAG,oBAAoB;CAC/F;AACF"}

package/dist/http/test-caller.d.ts

@@ -0,0 +1,13 @@
+import { ResolvedCaller } from "@headless-lms/core/organizations";
+import { Actor } from "@headless-lms/core/shared/actor";
+//#region src/http/test-caller.d.ts
+declare function resolvedCaller<O extends {
+  id: string;
+}, U extends {
+  id: string;
+}, M extends {
+  id: string;
+}>(org: O | null, user: U | null, orgUser: M | null, actor: Actor | null): ResolvedCaller | null;
+//#endregion
+export { resolvedCaller };
+//# sourceMappingURL=test-caller.d.ts.map

package/dist/http/test-caller.js

@@ -0,0 +1,14 @@
+//#region src/http/test-caller.ts
+function resolvedCaller(org, user, orgUser, actor) {
+	if (!org) return null;
+	return {
+		orgId: org.id,
+		userId: user?.id ?? null,
+		orgUserId: user && orgUser ? orgUser.id : null,
+		actor: user && orgUser ? actor : null
+	};
+}
+//#endregion
+export { resolvedCaller };
+
+//# sourceMappingURL=test-caller.js.map

package/dist/http/test-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-caller.js","names":[],"sources":["../../src/http/test-caller.ts"],"sourcesContent":["import type { Actor } from '@headless-lms/core/shared/actor';\nimport type { ResolvedCaller } from '@headless-lms/core/organizations';\n\nexport function resolvedCaller<\n  O extends { id: string },\n  U extends { id: string },\n  M extends { id: string },\n>(org: O | null, user: U | null, orgUser: M | null, actor: Actor | null): ResolvedCaller | null {\n  if (!org) {\n    return null;\n  }\n  return {\n    orgId: org.id,\n    userId: user?.id ?? null,\n    orgUserId: user && orgUser ? orgUser.id : null,\n    actor: user && orgUser ? actor : null,\n  };\n}\n"],"mappings":";AAGA,SAAgB,eAId,KAAe,MAAgB,SAAmB,OAA4C;CAC9F,IAAI,CAAC,KACH,OAAO;CAET,OAAO;EACL,OAAO,IAAI;EACX,QAAQ,MAAM,MAAM;EACpB,WAAW,QAAQ,UAAU,QAAQ,KAAK;EAC1C,OAAO,QAAQ,UAAU,QAAQ;CACnC;AACF"}

package/dist/http/well-known.js

@@ -1,12 +1,12 @@
 import { bridgeWebResponse, toWebRequest } from "./web-bridge.js";
-import { ACCESS_SCOPES } from "@headless-lms/core/organizations";
+import { ALL_PERMISSIONS } from "@headless-lms/core/organizations";
 //#region src/http/well-known.ts
 function registerWellKnown(app, container) {
 	const origin = new URL(container.mcp.issuer).origin;
 	const resourceMetadata = () => ({
 		resource: container.mcp.resource,
 		authorization_servers: [container.mcp.issuer],
-		scopes_supported: [...ACCESS_SCOPES],
+		scopes_supported: [...ALL_PERMISSIONS],
 		bearer_methods_supported: ["header"]
 	});
 	const hidden = { schema: { hide: true } };

package/dist/http/well-known.js.map

@@ -1 +1 @@
-{"version":3,"file":"well-known.js","names":[],"sources":["../../src/http/well-known.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport { ACCESS_SCOPES } from '@headless-lms/core/organizations';\nimport type { Container } from '../app/container.js';\nimport { bridgeWebResponse, toWebRequest } from './web-bridge.js';\n\nexport function registerWellKnown(app: FastifyInstance, container: Container): void {\n  const origin = new URL(container.mcp.issuer).origin;\n  const resourceMetadata = () => ({\n    resource: container.mcp.resource,\n    authorization_servers: [container.mcp.issuer],\n    scopes_supported: [...ACCESS_SCOPES],\n    bearer_methods_supported: ['header'],\n  });\n  const hidden = { schema: { hide: true } };\n\n  app.get('/.well-known/oauth-protected-resource/mcp', hidden, async () => resourceMetadata());\n  app.get('/.well-known/oauth-protected-resource', hidden, async () => resourceMetadata());\n  app.get('/.well-known/oauth-authorization-server/api/auth', hidden, async (request, reply) => {\n    await bridgeWebResponse(\n      await container.auth.authorizationServerMetadata(toWebRequest(request, origin)),\n      reply,\n    );\n  });\n}\n"],"mappings":";;;AAKA,SAAgB,kBAAkB,KAAsB,WAA4B;CAClF,MAAM,SAAS,IAAI,IAAI,UAAU,IAAI,MAAM,CAAC,CAAC;CAC7C,MAAM,0BAA0B;EAC9B,UAAU,UAAU,IAAI;EACxB,uBAAuB,CAAC,UAAU,IAAI,MAAM;EAC5C,kBAAkB,CAAC,GAAG,aAAa;EACnC,0BAA0B,CAAC,QAAQ;CACrC;CACA,MAAM,SAAS,EAAE,QAAQ,EAAE,MAAM,KAAK,EAAE;CAExC,IAAI,IAAI,6CAA6C,QAAQ,YAAY,iBAAiB,CAAC;CAC3F,IAAI,IAAI,yCAAyC,QAAQ,YAAY,iBAAiB,CAAC;CACvF,IAAI,IAAI,oDAAoD,QAAQ,OAAO,SAAS,UAAU;EAC5F,MAAM,kBACJ,MAAM,UAAU,KAAK,4BAA4B,aAAa,SAAS,MAAM,CAAC,GAC9E,KACF;CACF,CAAC;AACH"}
+{"version":3,"file":"well-known.js","names":[],"sources":["../../src/http/well-known.ts"],"sourcesContent":["import type { FastifyInstance } from 'fastify';\nimport { ALL_PERMISSIONS } from '@headless-lms/core/organizations';\nimport type { Container } from '../app/container.js';\nimport { bridgeWebResponse, toWebRequest } from './web-bridge.js';\n\nexport function registerWellKnown(app: FastifyInstance, container: Container): void {\n  const origin = new URL(container.mcp.issuer).origin;\n  const resourceMetadata = () => ({\n    resource: container.mcp.resource,\n    authorization_servers: [container.mcp.issuer],\n    scopes_supported: [...ALL_PERMISSIONS],\n    bearer_methods_supported: ['header'],\n  });\n  const hidden = { schema: { hide: true } };\n\n  app.get('/.well-known/oauth-protected-resource/mcp', hidden, async () => resourceMetadata());\n  app.get('/.well-known/oauth-protected-resource', hidden, async () => resourceMetadata());\n  app.get('/.well-known/oauth-authorization-server/api/auth', hidden, async (request, reply) => {\n    await bridgeWebResponse(\n      await container.auth.authorizationServerMetadata(toWebRequest(request, origin)),\n      reply,\n    );\n  });\n}\n"],"mappings":";;;AAKA,SAAgB,kBAAkB,KAAsB,WAA4B;CAClF,MAAM,SAAS,IAAI,IAAI,UAAU,IAAI,MAAM,CAAC,CAAC;CAC7C,MAAM,0BAA0B;EAC9B,UAAU,UAAU,IAAI;EACxB,uBAAuB,CAAC,UAAU,IAAI,MAAM;EAC5C,kBAAkB,CAAC,GAAG,eAAe;EACrC,0BAA0B,CAAC,QAAQ;CACrC;CACA,MAAM,SAAS,EAAE,QAAQ,EAAE,MAAM,KAAK,EAAE;CAExC,IAAI,IAAI,6CAA6C,QAAQ,YAAY,iBAAiB,CAAC;CAC3F,IAAI,IAAI,yCAAyC,QAAQ,YAAY,iBAAiB,CAAC;CACvF,IAAI,IAAI,oDAAoD,QAAQ,OAAO,SAAS,UAAU;EAC5F,MAAM,kBACJ,MAAM,UAAU,KAAK,4BAA4B,aAAa,SAAS,MAAM,CAAC,GAC9E,KACF;CACF,CAAC;AACH"}

package/dist/index.d.ts

@@ -1,16 +1,19 @@
 import { AuthUser } from "./http/fastify.js";
+import { PlatformConfig } from "./app/platform.js";
 import { AdapterOverrides, BuildContainerOptions, Config, Container, LoggingConfig } from "./app/container.js";
 import { loadIntegrations } from "./app/integrations.js";
 import { ServerConfig } from "./http/config.js";
-import { CatalogueField, CatalogueScope, CatalogueTool, McpCatalogue, mcpCatalogue } from "./http/mcp/catalogue.js";
+import { CatalogueField, CataloguePermission, CatalogueTool, McpCatalogue, mcpCatalogue } from "./http/mcp/catalogue.js";
 import { buildServer } from "./http/server.js";
+import { CloseOnSignalsOptions, closeOnSignals } from "./http/shutdown.js";
 import { runMigrations } from "@headless-lms/adapter-db";
 import { InlineAutomationEngine } from "@headless-lms/adapter-defaults/workflows";
 import { AutomationEngine, WebhookSender } from "@headless-lms/core/automations";
 import { Mailer } from "@headless-lms/core/shared/mailer";
+import { PushConfig } from "@headless-lms/core/types";
 import { EmailMessage, EmailSender, ObjectStorage } from "@headless-lms/core/shared/ports";
 //#region src/index.d.ts
 declare function createContainer(config: ServerConfig, options?: BuildContainerOptions): Promise<Container>;
 //#endregion
-export { type AdapterOverrides, type AuthUser, type AutomationEngine, type BuildContainerOptions, type CatalogueField, type CatalogueScope, type CatalogueTool, type Container, type Config as ContainerConfig, type EmailMessage, type EmailSender, InlineAutomationEngine, type LoggingConfig, type Mailer, type McpCatalogue, type ObjectStorage, type ServerConfig, type WebhookSender, buildServer, createContainer, loadIntegrations, mcpCatalogue, runMigrations };
+export { type AdapterOverrides, type AuthUser, type AutomationEngine, type BuildContainerOptions, type CatalogueField, type CataloguePermission, type CatalogueTool, type CloseOnSignalsOptions, type Container, type Config as ContainerConfig, type EmailMessage, type EmailSender, InlineAutomationEngine, type LoggingConfig, type Mailer, type McpCatalogue, type ObjectStorage, type PlatformConfig, type PushConfig, type ServerConfig, type WebhookSender, buildServer, closeOnSignals, createContainer, loadIntegrations, mcpCatalogue, runMigrations };
 //# sourceMappingURL=index.d.ts.map