@headless-lms/server 0.3.0 → 0.5.0

package/dist/http/mcp/tools/organization.js

@@ -0,0 +1,214 @@
+import { AssignmentList, ContentIdParam, CreateRole, MembersPage, MembersQuery, OrgRoleList, OrgRoleView, OrgUserContentParam, OrgUserIdParam, RoleKeyParam, SetRole, UpdateRole } from "../../schemas/members.js";
+import { Organization, UpdateOrganization } from "../../schemas/organizations.js";
+import { CreateInvite, Invite } from "../../schemas/invites.js";
+import "../../schemas/index.js";
+import { defineTool, noInput } from "../tool.js";
+import { z } from "zod";
+//#region src/http/mcp/tools/organization.ts
+const organizationTools = [
+	defineTool({
+		name: "update_organization",
+		title: "Update organization",
+		description: "Change the organization's name or slug.",
+		kind: "write",
+		idempotent: true,
+		openWorld: false,
+		input: UpdateOrganization,
+		output: Organization,
+		call: async (input, { container, caller }) => {
+			const org = await container.organizations.updateOrganization(input, caller.actor);
+			return {
+				id: org.id,
+				name: org.name,
+				slug: org.slug,
+				createdAt: org.createdAt.toISOString()
+			};
+		}
+	}),
+	defineTool({
+		name: "list_roles",
+		title: "List roles",
+		description: "The organization's roles with their levels, permissions and how many people hold each.",
+		kind: "read",
+		idempotent: true,
+		openWorld: false,
+		input: noInput,
+		output: z.object({ roles: OrgRoleList }),
+		call: async (_input, { container, caller }) => ({ roles: await container.organizations.listRoles(caller.actor) })
+	}),
+	defineTool({
+		name: "get_role",
+		title: "Get role",
+		description: "One role with its levels and permissions.",
+		kind: "read",
+		idempotent: true,
+		openWorld: false,
+		input: RoleKeyParam,
+		output: OrgRoleView,
+		call: ({ key }, { container, caller }) => container.organizations.getRole(key, caller.actor)
+	}),
+	defineTool({
+		name: "update_role",
+		title: "Update role",
+		description: "Rename a role, or change its permissions, levels or team flag. Changes need every permission the role holds before and after.",
+		kind: "write",
+		idempotent: true,
+		openWorld: false,
+		input: UpdateRole.extend(RoleKeyParam.shape),
+		output: OrgRoleView,
+		call: ({ key, ...input }, { container, caller }) => container.organizations.updateRole(key, input, caller.actor)
+	}),
+	defineTool({
+		name: "create_role",
+		title: "Create role",
+		description: "Add a role to the organization, starting from a deployment role (base).",
+		kind: "write",
+		idempotent: false,
+		openWorld: false,
+		input: CreateRole,
+		output: OrgRoleView,
+		call: (input, { container, caller }) => container.organizations.createRole(input, caller.actor)
+	}),
+	defineTool({
+		name: "reset_role",
+		title: "Reset role",
+		description: "Reset a deployment role to the deployment's version.",
+		kind: "destructive",
+		idempotent: true,
+		openWorld: false,
+		input: RoleKeyParam,
+		output: OrgRoleView,
+		call: ({ key }, { container, caller }) => container.organizations.resetRole(key, caller.actor)
+	}),
+	defineTool({
+		name: "delete_role",
+		title: "Delete role",
+		description: "Delete a role the organization added. Refused while anyone holds it.",
+		kind: "destructive",
+		idempotent: false,
+		openWorld: false,
+		input: RoleKeyParam,
+		call: ({ key }, { container, caller }) => container.organizations.deleteRole(key, caller.actor)
+	}),
+	defineTool({
+		name: "list_team",
+		title: "List team",
+		description: "Everyone with an org role other than Member or a role on a content item, invited people included.",
+		kind: "read",
+		idempotent: true,
+		openWorld: false,
+		input: MembersQuery,
+		output: MembersPage,
+		call: (input, { container, caller }) => container.organizations.listTeam(input, caller.actor)
+	}),
+	defineTool({
+		name: "list_person_roles",
+		title: "List a person's roles",
+		description: "A person's org role and every role they hold on a content item.",
+		kind: "read",
+		idempotent: true,
+		openWorld: false,
+		input: OrgUserIdParam,
+		output: z.object({ roles: AssignmentList }),
+		call: async ({ orgUserId }, { container, caller }) => ({ roles: await container.organizations.listAssignments(orgUserId, caller.actor) })
+	}),
+	defineTool({
+		name: "list_roles_on_content",
+		title: "List roles on content",
+		description: "The people with a role on one course, download, community or event.",
+		kind: "read",
+		idempotent: true,
+		openWorld: false,
+		input: ContentIdParam,
+		output: z.object({ roles: AssignmentList }),
+		call: async ({ contentId }, { container, caller }) => ({ roles: await container.organizations.listAssignmentsOn(contentId, caller.actor) })
+	}),
+	defineTool({
+		name: "set_org_role",
+		title: "Set org role",
+		description: "Set a person's org role. Needs every permission the old and the new role hold.",
+		kind: "write",
+		idempotent: true,
+		openWorld: false,
+		input: SetRole.extend(OrgUserIdParam.shape),
+		output: z.object({ roles: AssignmentList }),
+		call: async ({ orgUserId, roleKey }, { container, caller }) => ({ roles: await container.organizations.setOrgRole(orgUserId, roleKey, caller.actor) })
+	}),
+	defineTool({
+		name: "assign_role",
+		title: "Give a role on content",
+		description: "Give a person a role on one course, download, community or event. The role must list the item's type.",
+		kind: "write",
+		idempotent: true,
+		openWorld: false,
+		input: SetRole.extend(OrgUserContentParam.shape),
+		output: z.object({ roles: AssignmentList }),
+		call: async ({ orgUserId, contentId, roleKey }, { container, caller }) => ({ roles: await container.organizations.assignRole(orgUserId, contentId, roleKey, caller.actor) })
+	}),
+	defineTool({
+		name: "unassign_role",
+		title: "Remove a role on content",
+		description: "Remove a person's role on one course, download, community or event.",
+		kind: "destructive",
+		idempotent: true,
+		openWorld: false,
+		input: OrgUserContentParam,
+		output: z.object({ roles: AssignmentList }),
+		call: async ({ orgUserId, contentId }, { container, caller }) => ({ roles: await container.organizations.unassignRole(orgUserId, contentId, caller.actor) })
+	}),
+	defineTool({
+		name: "invite_person",
+		title: "Invite person",
+		description: "Invite someone by email with an org role (default member). They exist as an invited person at once.",
+		kind: "write",
+		idempotent: false,
+		openWorld: true,
+		input: CreateInvite,
+		output: Invite,
+		call: async (input, { container, caller }) => {
+			const invite = await container.organizations.createInvite(input, caller.actor, caller.userId);
+			return {
+				id: invite.id,
+				email: invite.email,
+				roleKey: invite.roleKey,
+				status: invite.status,
+				expiresAt: invite.expiresAt,
+				createdAt: invite.createdAt
+			};
+		}
+	}),
+	defineTool({
+		name: "resend_invite",
+		title: "Resend invite",
+		description: "Send a person's pending invite email again, with a new link.",
+		kind: "write",
+		idempotent: false,
+		openWorld: true,
+		input: OrgUserIdParam,
+		call: ({ orgUserId }, { container, caller }) => container.organizations.resendInvite(orgUserId, caller.actor, caller.userId)
+	}),
+	defineTool({
+		name: "cancel_invite",
+		title: "Cancel invite",
+		description: "Cancel a person's pending invite.",
+		kind: "destructive",
+		idempotent: false,
+		openWorld: false,
+		input: OrgUserIdParam,
+		call: ({ orgUserId }, { container, caller }) => container.organizations.cancelInvite(orgUserId, caller.actor)
+	}),
+	defineTool({
+		name: "remove_person",
+		title: "Remove person",
+		description: "Remove a person from the organization, with their API keys and connected apps here. Needs every permission they hold.",
+		kind: "destructive",
+		idempotent: false,
+		openWorld: false,
+		input: OrgUserIdParam,
+		call: ({ orgUserId }, { container, caller }) => container.organizations.removePerson(orgUserId, caller.actor)
+	})
+];
+//#endregion
+export { organizationTools };
+
+//# sourceMappingURL=organization.js.map

package/dist/http/mcp/tools/organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.js","names":[],"sources":["../../../../src/http/mcp/tools/organization.ts"],"sourcesContent":["import { z } from 'zod';\nimport {\n  AssignmentList,\n  ContentIdParam,\n  CreateInvite,\n  CreateRole,\n  Invite,\n  MembersPage,\n  MembersQuery,\n  OrgRoleList,\n  OrgRoleView,\n  OrgUserContentParam,\n  OrgUserIdParam,\n  Organization,\n  RoleKeyParam,\n  SetRole,\n  UpdateOrganization,\n  UpdateRole,\n} from '../../schemas/index.js';\nimport { defineTool, noInput, type Tool } from '../tool.js';\n\nexport const organizationTools: Tool[] = [\n  defineTool({\n    name: 'update_organization',\n    title: 'Update organization',\n    description: \"Change the organization's name or slug.\",\n    kind: 'write',\n    idempotent: true,\n    openWorld: false,\n    input: UpdateOrganization,\n    output: Organization,\n    call: async (input, { container, caller }) => {\n      const org = await container.organizations.updateOrganization(input, caller.actor);\n      return { id: org.id, name: org.name, slug: org.slug, createdAt: org.createdAt.toISOString() };\n    },\n  }),\n  defineTool({\n    name: 'list_roles',\n    title: 'List roles',\n    description:\n      \"The organization's roles with their levels, permissions and how many people hold each.\",\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: noInput,\n    output: z.object({ roles: OrgRoleList }),\n    call: async (_input, { container, caller }) => ({\n      roles: await container.organizations.listRoles(caller.actor),\n    }),\n  }),\n  defineTool({\n    name: 'get_role',\n    title: 'Get role',\n    description: 'One role with its levels and permissions.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: RoleKeyParam,\n    output: OrgRoleView,\n    call: ({ key }, { container, caller }) => container.organizations.getRole(key, caller.actor),\n  }),\n  defineTool({\n    name: 'update_role',\n    title: 'Update role',\n    description:\n      'Rename a role, or change its permissions, levels or team flag. Changes need every permission the role holds before and after.',\n    kind: 'write',\n    idempotent: true,\n    openWorld: false,\n    input: UpdateRole.extend(RoleKeyParam.shape),\n    output: OrgRoleView,\n    call: ({ key, ...input }, { container, caller }) =>\n      container.organizations.updateRole(key, input, caller.actor),\n  }),\n  defineTool({\n    name: 'create_role',\n    title: 'Create role',\n    description: 'Add a role to the organization, starting from a deployment role (base).',\n    kind: 'write',\n    idempotent: false,\n    openWorld: false,\n    input: CreateRole,\n    output: OrgRoleView,\n    call: (input, { container, caller }) => container.organizations.createRole(input, caller.actor),\n  }),\n  defineTool({\n    name: 'reset_role',\n    title: 'Reset role',\n    description: \"Reset a deployment role to the deployment's version.\",\n    kind: 'destructive',\n    idempotent: true,\n    openWorld: false,\n    input: RoleKeyParam,\n    output: OrgRoleView,\n    call: ({ key }, { container, caller }) => container.organizations.resetRole(key, caller.actor),\n  }),\n  defineTool({\n    name: 'delete_role',\n    title: 'Delete role',\n    description: 'Delete a role the organization added. Refused while anyone holds it.',\n    kind: 'destructive',\n    idempotent: false,\n    openWorld: false,\n    input: RoleKeyParam,\n    call: ({ key }, { container, caller }) => container.organizations.deleteRole(key, caller.actor),\n  }),\n  defineTool({\n    name: 'list_team',\n    title: 'List team',\n    description:\n      'Everyone with an org role other than Member or a role on a content item, invited people included.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: MembersQuery,\n    output: MembersPage,\n    call: (input, { container, caller }) => container.organizations.listTeam(input, caller.actor),\n  }),\n  defineTool({\n    name: 'list_person_roles',\n    title: \"List a person's roles\",\n    description: \"A person's org role and every role they hold on a content item.\",\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: OrgUserIdParam,\n    output: z.object({ roles: AssignmentList }),\n    call: async ({ orgUserId }, { container, caller }) => ({\n      roles: await container.organizations.listAssignments(orgUserId, caller.actor),\n    }),\n  }),\n  defineTool({\n    name: 'list_roles_on_content',\n    title: 'List roles on content',\n    description: 'The people with a role on one course, download, community or event.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: ContentIdParam,\n    output: z.object({ roles: AssignmentList }),\n    call: async ({ contentId }, { container, caller }) => ({\n      roles: await container.organizations.listAssignmentsOn(contentId, caller.actor),\n    }),\n  }),\n  defineTool({\n    name: 'set_org_role',\n    title: 'Set org role',\n    description: \"Set a person's org role. Needs every permission the old and the new role hold.\",\n    kind: 'write',\n    idempotent: true,\n    openWorld: false,\n    input: SetRole.extend(OrgUserIdParam.shape),\n    output: z.object({ roles: AssignmentList }),\n    call: async ({ orgUserId, roleKey }, { container, caller }) => ({\n      roles: await container.organizations.setOrgRole(orgUserId, roleKey, caller.actor),\n    }),\n  }),\n  defineTool({\n    name: 'assign_role',\n    title: 'Give a role on content',\n    description:\n      \"Give a person a role on one course, download, community or event. The role must list the item's type.\",\n    kind: 'write',\n    idempotent: true,\n    openWorld: false,\n    input: SetRole.extend(OrgUserContentParam.shape),\n    output: z.object({ roles: AssignmentList }),\n    call: async ({ orgUserId, contentId, roleKey }, { container, caller }) => ({\n      roles: await container.organizations.assignRole(orgUserId, contentId, roleKey, caller.actor),\n    }),\n  }),\n  defineTool({\n    name: 'unassign_role',\n    title: 'Remove a role on content',\n    description: \"Remove a person's role on one course, download, community or event.\",\n    kind: 'destructive',\n    idempotent: true,\n    openWorld: false,\n    input: OrgUserContentParam,\n    output: z.object({ roles: AssignmentList }),\n    call: async ({ orgUserId, contentId }, { container, caller }) => ({\n      roles: await container.organizations.unassignRole(orgUserId, contentId, caller.actor),\n    }),\n  }),\n  defineTool({\n    name: 'invite_person',\n    title: 'Invite person',\n    description:\n      'Invite someone by email with an org role (default member). They exist as an invited person at once.',\n    kind: 'write',\n    idempotent: false,\n    openWorld: true,\n    input: CreateInvite,\n    output: Invite,\n    call: async (input, { container, caller }) => {\n      const invite = await container.organizations.createInvite(input, caller.actor, caller.userId);\n      return {\n        id: invite.id,\n        email: invite.email,\n        roleKey: invite.roleKey,\n        status: invite.status,\n        expiresAt: invite.expiresAt,\n        createdAt: invite.createdAt,\n      };\n    },\n  }),\n  defineTool({\n    name: 'resend_invite',\n    title: 'Resend invite',\n    description: \"Send a person's pending invite email again, with a new link.\",\n    kind: 'write',\n    idempotent: false,\n    openWorld: true,\n    input: OrgUserIdParam,\n    call: ({ orgUserId }, { container, caller }) =>\n      container.organizations.resendInvite(orgUserId, caller.actor, caller.userId),\n  }),\n  defineTool({\n    name: 'cancel_invite',\n    title: 'Cancel invite',\n    description: \"Cancel a person's pending invite.\",\n    kind: 'destructive',\n    idempotent: false,\n    openWorld: false,\n    input: OrgUserIdParam,\n    call: ({ orgUserId }, { container, caller }) =>\n      container.organizations.cancelInvite(orgUserId, caller.actor),\n  }),\n  defineTool({\n    name: 'remove_person',\n    title: 'Remove person',\n    description:\n      'Remove a person from the organization, with their API keys and connected apps here. Needs every permission they hold.',\n    kind: 'destructive',\n    idempotent: false,\n    openWorld: false,\n    input: OrgUserIdParam,\n    call: ({ orgUserId }, { container, caller }) =>\n      container.organizations.removePerson(orgUserId, caller.actor),\n  }),\n];\n"],"mappings":";;;;;;;AAqBA,MAAa,oBAA4B;CACvC,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,QAAQ;EACR,MAAM,OAAO,OAAO,EAAE,WAAW,aAAa;GAC5C,MAAM,MAAM,MAAM,UAAU,cAAc,mBAAmB,OAAO,OAAO,KAAK;GAChF,OAAO;IAAE,IAAI,IAAI;IAAI,MAAM,IAAI;IAAM,MAAM,IAAI;IAAM,WAAW,IAAI,UAAU,YAAY;GAAE;EAC9F;CACF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,QAAQ,EAAE,OAAO,EAAE,OAAO,YAAY,CAAC;EACvC,MAAM,OAAO,QAAQ,EAAE,WAAW,cAAc,EAC9C,OAAO,MAAM,UAAU,cAAc,UAAU,OAAO,KAAK,EAC7D;CACF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,QAAQ;EACR,OAAO,EAAE,OAAO,EAAE,WAAW,aAAa,UAAU,cAAc,QAAQ,KAAK,OAAO,KAAK;CAC7F,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,WAAW,OAAO,aAAa,KAAK;EAC3C,QAAQ;EACR,OAAO,EAAE,KAAK,GAAG,SAAS,EAAE,WAAW,aACrC,UAAU,cAAc,WAAW,KAAK,OAAO,OAAO,KAAK;CAC/D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,QAAQ;EACR,OAAO,OAAO,EAAE,WAAW,aAAa,UAAU,cAAc,WAAW,OAAO,OAAO,KAAK;CAChG,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,QAAQ;EACR,OAAO,EAAE,OAAO,EAAE,WAAW,aAAa,UAAU,cAAc,UAAU,KAAK,OAAO,KAAK;CAC/F,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,OAAO,EAAE,WAAW,aAAa,UAAU,cAAc,WAAW,KAAK,OAAO,KAAK;CAChG,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,QAAQ;EACR,OAAO,OAAO,EAAE,WAAW,aAAa,UAAU,cAAc,SAAS,OAAO,OAAO,KAAK;CAC9F,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,QAAQ,EAAE,OAAO,EAAE,OAAO,eAAe,CAAC;EAC1C,MAAM,OAAO,EAAE,aAAa,EAAE,WAAW,cAAc,EACrD,OAAO,MAAM,UAAU,cAAc,gBAAgB,WAAW,OAAO,KAAK,EAC9E;CACF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,QAAQ,EAAE,OAAO,EAAE,OAAO,eAAe,CAAC;EAC1C,MAAM,OAAO,EAAE,aAAa,EAAE,WAAW,cAAc,EACrD,OAAO,MAAM,UAAU,cAAc,kBAAkB,WAAW,OAAO,KAAK,EAChF;CACF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,QAAQ,OAAO,eAAe,KAAK;EAC1C,QAAQ,EAAE,OAAO,EAAE,OAAO,eAAe,CAAC;EAC1C,MAAM,OAAO,EAAE,WAAW,WAAW,EAAE,WAAW,cAAc,EAC9D,OAAO,MAAM,UAAU,cAAc,WAAW,WAAW,SAAS,OAAO,KAAK,EAClF;CACF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,QAAQ,OAAO,oBAAoB,KAAK;EAC/C,QAAQ,EAAE,OAAO,EAAE,OAAO,eAAe,CAAC;EAC1C,MAAM,OAAO,EAAE,WAAW,WAAW,WAAW,EAAE,WAAW,cAAc,EACzE,OAAO,MAAM,UAAU,cAAc,WAAW,WAAW,WAAW,SAAS,OAAO,KAAK,EAC7F;CACF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,QAAQ,EAAE,OAAO,EAAE,OAAO,eAAe,CAAC;EAC1C,MAAM,OAAO,EAAE,WAAW,aAAa,EAAE,WAAW,cAAc,EAChE,OAAO,MAAM,UAAU,cAAc,aAAa,WAAW,WAAW,OAAO,KAAK,EACtF;CACF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,QAAQ;EACR,MAAM,OAAO,OAAO,EAAE,WAAW,aAAa;GAC5C,MAAM,SAAS,MAAM,UAAU,cAAc,aAAa,OAAO,OAAO,OAAO,OAAO,MAAM;GAC5F,OAAO;IACL,IAAI,OAAO;IACX,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,QAAQ,OAAO;IACf,WAAW,OAAO;IAClB,WAAW,OAAO;GACpB;EACF;CACF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,aAAa,EAAE,WAAW,aACjC,UAAU,cAAc,aAAa,WAAW,OAAO,OAAO,OAAO,MAAM;CAC/E,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,aAAa,EAAE,WAAW,aACjC,UAAU,cAAc,aAAa,WAAW,OAAO,KAAK;CAChE,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,aAAa,EAAE,WAAW,aACjC,UAAU,cAAc,aAAa,WAAW,OAAO,KAAK;CAChE,CAAC;AACH"}

package/dist/http/mcp/tools/people.js

@@ -1,142 +1,123 @@
 import { CourseIdPathParam } from "../../schemas/activities.js";
 import { StudentIdParam, StudentsQuery } from "../../schemas/students.js";
-import { EntitlementIdParam, EntitlementsQuery, GrantEntitlement, SetEntitlementStatus } from "../../schemas/entitlements.js";
+import { EntitlementsQuery, GrantEntitlement, RevokeEntitlement } from "../../schemas/entitlements.js";
 import { CreateInvite, Invite } from "../../schemas/invites.js";
 import { EnrollmentSeriesQuery } from "../../schemas/dashboard.js";
+import { CourseLearnersQuery } from "../../schemas/course-analytics.js";
 import "../../schemas/index.js";
-import { actor, defineTool, noInput } from "../tool.js";
+import { defineTool, noInput } from "../tool.js";
 //#region src/http/mcp/tools/people.ts
 const peopleTools = [
 	defineTool({
 		name: "list_students",
 		title: "List students",
 		description: "Search and page through the students with their access count, average progress, status and last activity.",
-		scope: "students:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: StudentsQuery,
-		call: (input, { container, scope }) => container.reporting.admin.listStudents(scope.orgId, input)
+		call: (input, { container, caller }) => container.reporting.admin.listStudents(input, caller.actor)
 	}),
 	defineTool({
 		name: "invite_student",
 		title: "Invite student",
 		description: "Invite someone by email as a student. They exist as an invited student at once. sendEmail false skips the email.",
-		scope: "students:invite",
 		kind: "write",
 		idempotent: false,
 		openWorld: true,
-		input: CreateInvite.omit({ role: true }),
+		input: CreateInvite.omit({ roleKey: true }),
 		output: Invite,
-		call: (input, { container, scope }) => container.organizations.createInvite(actor(scope), {
-			orgId: scope.orgId,
-			inviterUserId: scope.userId,
-			role: "student",
-			...input
-		})
-	}),
-	defineTool({
-		name: "resend_student_invite",
-		title: "Resend student invite",
-		description: "Send a pending student's invite email again.",
-		scope: "students:invite",
-		kind: "write",
-		idempotent: false,
-		openWorld: true,
-		input: StudentIdParam,
-		call: ({ id }, { container, scope }) => container.organizations.resendStudentInvite(actor(scope), {
-			orgId: scope.orgId,
-			orgUserId: id,
-			inviterUserId: scope.userId
-		})
+		call: (input, { container, caller }) => container.organizations.createInvite(input, caller.actor, caller.userId)
 	}),
 	defineTool({
 		name: "list_access",
 		title: "List access",
 		description: "Who has access to what. Filter by student (orgUserId), content, type or status.",
-		scope: "access:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: EntitlementsQuery,
-		call: (input, { container, scope }) => container.entitlements.list(scope.orgId, input)
+		call: (input, { container, caller }) => container.entitlements.list(input, caller.actor)
 	}),
 	defineTool({
 		name: "grant_access",
 		title: "Grant access",
-		description: "Give a student access to one course, download or community (contentId) or to a bundle (bundleId), never both. expiresAt is a date-time, or null for no expiry.",
-		scope: "access:write",
+		description: "Give a student access to one course, download, community or event (contentId) or to a bundle (bundleId), never both. expiresAt is a date-time, or null for no expiry.",
 		kind: "write",
 		idempotent: false,
 		openWorld: false,
 		input: GrantEntitlement,
-		call: (input, { container, scope }) => container.entitlements.grant(scope.orgId, input)
+		call: (input, { container, caller }) => container.entitlements.grant(input, caller.actor)
 	}),
 	defineTool({
-		name: "set_access_status",
-		title: "Revoke or reinstate access",
-		description: "Revoke an access grant, or reinstate a revoked one.",
-		scope: "access:write",
+		name: "revoke_access",
+		title: "Revoke access",
+		description: "Revoke a student's direct grant to one course, download, community or event (contentId) or to a bundle (bundleId), never both. Access through a bundle stays. grant_access makes it active again.",
 		kind: "destructive",
-		idempotent: true,
+		idempotent: false,
 		openWorld: false,
-		input: SetEntitlementStatus.extend(EntitlementIdParam.shape),
-		call: ({ id, status }, { container, scope }) => container.entitlements.setStatus(scope.orgId, id, status)
+		input: RevokeEntitlement,
+		call: (input, { container, caller }) => container.entitlements.revoke(input, caller.actor)
 	}),
 	defineTool({
 		name: "get_dashboard",
 		title: "Get dashboard",
 		description: "Published and draft course counts, active students, and access grants expiring soon.",
-		scope: "analytics:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: noInput,
-		call: (_input, { container, scope }) => container.reporting.admin.overview(scope.orgId)
+		call: (_input, { container, caller }) => container.reporting.admin.overview(caller.actor)
 	}),
 	defineTool({
 		name: "get_enrollment_trend",
 		title: "Get enrollment trend",
 		description: "Daily enrollments across the organization for the last days (default 30, at most 365).",
-		scope: "analytics:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: EnrollmentSeriesQuery,
-		call: ({ days }, { container, scope }) => container.reporting.admin.enrollments(scope.orgId, days)
+		call: ({ days }, { container, caller }) => container.reporting.admin.enrollments(days, caller.actor)
 	}),
 	defineTool({
 		name: "get_course_analytics",
 		title: "Get course analytics",
 		description: "Enrolled, started and completed counts, average progress and per-activity engagement for one course.",
-		scope: "analytics:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: CourseIdPathParam,
-		call: ({ courseId }, { container, scope }) => container.reporting.admin.courseAnalytics(scope.orgId, courseId)
+		call: ({ courseId }, { container, caller }) => container.reporting.admin.courseAnalytics(courseId, caller.actor)
+	}),
+	defineTool({
+		name: "list_course_learners",
+		title: "List course learners",
+		description: "Page through a course's learners: everyone with a grant that opens it, directly or through a bundle, active or not, with that grant and their progress. Search by name or email.",
+		kind: "read",
+		idempotent: true,
+		openWorld: false,
+		input: CourseLearnersQuery.extend(CourseIdPathParam.shape),
+		call: ({ courseId, ...query }, { container, caller }) => container.reporting.admin.courseLearners(courseId, query, caller.actor)
 	}),
 	defineTool({
 		name: "get_course_enrollment_trend",
 		title: "Get course enrollment trend",
 		description: "Daily enrollments in one course for the last days (default 30, at most 365).",
-		scope: "analytics:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: EnrollmentSeriesQuery.extend(CourseIdPathParam.shape),
-		call: ({ courseId, days }, { container, scope }) => container.reporting.admin.courseEnrollments(scope.orgId, courseId, days)
+		call: ({ courseId, days }, { container, caller }) => container.reporting.admin.courseEnrollments(courseId, days, caller.actor)
 	}),
 	defineTool({
 		name: "get_student_analytics",
 		title: "Get student analytics",
 		description: "One student's enrolled, started and completed counts, average progress and progress in each course.",
-		scope: "analytics:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: StudentIdParam,
-		call: ({ id }, { container, scope }) => container.reporting.admin.studentAnalytics(scope.orgId, id)
+		call: ({ id }, { container, caller }) => container.reporting.admin.studentAnalytics(id, caller.actor)
 	})
 ];
 //#endregion

package/dist/http/mcp/tools/people.js.map

@@ -1 +1 @@
-{"version":3,"file":"people.js","names":[],"sources":["../../../../src/http/mcp/tools/people.ts"],"sourcesContent":["import {\n  CourseIdPathParam,\n  CreateInvite,\n  EnrollmentSeriesQuery,\n  EntitlementIdParam,\n  EntitlementsQuery,\n  GrantEntitlement,\n  Invite,\n  SetEntitlementStatus,\n  StudentIdParam,\n  StudentsQuery,\n} from '../../schemas/index.js';\nimport { actor, defineTool, noInput, type Tool } from '../tool.js';\n\nexport const peopleTools: Tool[] = [\n  defineTool({\n    name: 'list_students',\n    title: 'List students',\n    description:\n      'Search and page through the students with their access count, average progress, status and last activity.',\n    scope: 'students:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: StudentsQuery,\n    call: (input, { container, scope }) =>\n      container.reporting.admin.listStudents(scope.orgId, input),\n  }),\n  defineTool({\n    name: 'invite_student',\n    title: 'Invite student',\n    description:\n      'Invite someone by email as a student. They exist as an invited student at once. sendEmail false skips the email.',\n    scope: 'students:invite',\n    kind: 'write',\n    idempotent: false,\n    openWorld: true,\n    input: CreateInvite.omit({ role: true }),\n    output: Invite,\n    call: (input, { container, scope }) =>\n      container.organizations.createInvite(actor(scope), {\n        orgId: scope.orgId,\n        inviterUserId: scope.userId,\n        role: 'student',\n        ...input,\n      }),\n  }),\n  defineTool({\n    name: 'resend_student_invite',\n    title: 'Resend student invite',\n    description: \"Send a pending student's invite email again.\",\n    scope: 'students:invite',\n    kind: 'write',\n    idempotent: false,\n    openWorld: true,\n    input: StudentIdParam,\n    call: ({ id }, { container, scope }) =>\n      container.organizations.resendStudentInvite(actor(scope), {\n        orgId: scope.orgId,\n        orgUserId: id,\n        inviterUserId: scope.userId,\n      }),\n  }),\n  defineTool({\n    name: 'list_access',\n    title: 'List access',\n    description: 'Who has access to what. Filter by student (orgUserId), content, type or status.',\n    scope: 'access:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: EntitlementsQuery,\n    call: (input, { container, scope }) => container.entitlements.list(scope.orgId, input),\n  }),\n  defineTool({\n    name: 'grant_access',\n    title: 'Grant access',\n    description:\n      'Give a student access to one course, download or community (contentId) or to a bundle (bundleId), never both. expiresAt is a date-time, or null for no expiry.',\n    scope: 'access:write',\n    kind: 'write',\n    idempotent: false,\n    openWorld: false,\n    input: GrantEntitlement,\n    call: (input, { container, scope }) => container.entitlements.grant(scope.orgId, input),\n  }),\n  defineTool({\n    name: 'set_access_status',\n    title: 'Revoke or reinstate access',\n    description: 'Revoke an access grant, or reinstate a revoked one.',\n    scope: 'access:write',\n    kind: 'destructive',\n    idempotent: true,\n    openWorld: false,\n    input: SetEntitlementStatus.extend(EntitlementIdParam.shape),\n    call: ({ id, status }, { container, scope }) =>\n      container.entitlements.setStatus(scope.orgId, id, status),\n  }),\n  defineTool({\n    name: 'get_dashboard',\n    title: 'Get dashboard',\n    description:\n      'Published and draft course counts, active students, and access grants expiring soon.',\n    scope: 'analytics:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: noInput,\n    call: (_input, { container, scope }) => container.reporting.admin.overview(scope.orgId),\n  }),\n  defineTool({\n    name: 'get_enrollment_trend',\n    title: 'Get enrollment trend',\n    description:\n      'Daily enrollments across the organization for the last days (default 30, at most 365).',\n    scope: 'analytics:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: EnrollmentSeriesQuery,\n    call: ({ days }, { container, scope }) =>\n      container.reporting.admin.enrollments(scope.orgId, days),\n  }),\n  defineTool({\n    name: 'get_course_analytics',\n    title: 'Get course analytics',\n    description:\n      'Enrolled, started and completed counts, average progress and per-activity engagement for one course.',\n    scope: 'analytics:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: CourseIdPathParam,\n    call: ({ courseId }, { container, scope }) =>\n      container.reporting.admin.courseAnalytics(scope.orgId, courseId),\n  }),\n  defineTool({\n    name: 'get_course_enrollment_trend',\n    title: 'Get course enrollment trend',\n    description: 'Daily enrollments in one course for the last days (default 30, at most 365).',\n    scope: 'analytics:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: EnrollmentSeriesQuery.extend(CourseIdPathParam.shape),\n    call: ({ courseId, days }, { container, scope }) =>\n      container.reporting.admin.courseEnrollments(scope.orgId, courseId, days),\n  }),\n  defineTool({\n    name: 'get_student_analytics',\n    title: 'Get student analytics',\n    description:\n      \"One student's enrolled, started and completed counts, average progress and progress in each course.\",\n    scope: 'analytics:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: StudentIdParam,\n    call: ({ id }, { container, scope }) =>\n      container.reporting.admin.studentAnalytics(scope.orgId, id),\n  }),\n];\n"],"mappings":";;;;;;;;AAcA,MAAa,cAAsB;CACjC,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,YACzB,UAAU,UAAU,MAAM,aAAa,MAAM,OAAO,KAAK;CAC7D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,aAAa,KAAK,EAAE,MAAM,KAAK,CAAC;EACvC,QAAQ;EACR,OAAO,OAAO,EAAE,WAAW,YACzB,UAAU,cAAc,aAAa,MAAM,KAAK,GAAG;GACjD,OAAO,MAAM;GACb,eAAe,MAAM;GACrB,MAAM;GACN,GAAG;EACL,CAAC;CACL,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,MAAM,EAAE,WAAW,YAC1B,UAAU,cAAc,oBAAoB,MAAM,KAAK,GAAG;GACxD,OAAO,MAAM;GACb,WAAW;GACX,eAAe,MAAM;EACvB,CAAC;CACL,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,YAAY,UAAU,aAAa,KAAK,MAAM,OAAO,KAAK;CACvF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,YAAY,UAAU,aAAa,MAAM,MAAM,OAAO,KAAK;CACxF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,qBAAqB,OAAO,mBAAmB,KAAK;EAC3D,OAAO,EAAE,IAAI,UAAU,EAAE,WAAW,YAClC,UAAU,aAAa,UAAU,MAAM,OAAO,IAAI,MAAM;CAC5D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,QAAQ,EAAE,WAAW,YAAY,UAAU,UAAU,MAAM,SAAS,MAAM,KAAK;CACxF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,QAAQ,EAAE,WAAW,YAC5B,UAAU,UAAU,MAAM,YAAY,MAAM,OAAO,IAAI;CAC3D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,YAAY,EAAE,WAAW,YAChC,UAAU,UAAU,MAAM,gBAAgB,MAAM,OAAO,QAAQ;CACnE,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,sBAAsB,OAAO,kBAAkB,KAAK;EAC3D,OAAO,EAAE,UAAU,QAAQ,EAAE,WAAW,YACtC,UAAU,UAAU,MAAM,kBAAkB,MAAM,OAAO,UAAU,IAAI;CAC3E,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,MAAM,EAAE,WAAW,YAC1B,UAAU,UAAU,MAAM,iBAAiB,MAAM,OAAO,EAAE;CAC9D,CAAC;AACH"}
+{"version":3,"file":"people.js","names":[],"sources":["../../../../src/http/mcp/tools/people.ts"],"sourcesContent":["import {\n  CourseIdPathParam,\n  CourseLearnersQuery,\n  CreateInvite,\n  EnrollmentSeriesQuery,\n  EntitlementsQuery,\n  GrantEntitlement,\n  Invite,\n  RevokeEntitlement,\n  StudentIdParam,\n  StudentsQuery,\n} from '../../schemas/index.js';\nimport { defineTool, noInput, type Tool } from '../tool.js';\n\nexport const peopleTools: Tool[] = [\n  defineTool({\n    name: 'list_students',\n    title: 'List students',\n    description:\n      'Search and page through the students with their access count, average progress, status and last activity.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: StudentsQuery,\n    call: (input, { container, caller }) =>\n      container.reporting.admin.listStudents(input, caller.actor),\n  }),\n  defineTool({\n    name: 'invite_student',\n    title: 'Invite student',\n    description:\n      'Invite someone by email as a student. They exist as an invited student at once. sendEmail false skips the email.',\n    kind: 'write',\n    idempotent: false,\n    openWorld: true,\n    input: CreateInvite.omit({ roleKey: true }),\n    output: Invite,\n    call: (input, { container, caller }) =>\n      container.organizations.createInvite(input, caller.actor, caller.userId),\n  }),\n  defineTool({\n    name: 'list_access',\n    title: 'List access',\n    description: 'Who has access to what. Filter by student (orgUserId), content, type or status.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: EntitlementsQuery,\n    call: (input, { container, caller }) => container.entitlements.list(input, caller.actor),\n  }),\n  defineTool({\n    name: 'grant_access',\n    title: 'Grant access',\n    description:\n      'Give a student access to one course, download, community or event (contentId) or to a bundle (bundleId), never both. expiresAt is a date-time, or null for no expiry.',\n    kind: 'write',\n    idempotent: false,\n    openWorld: false,\n    input: GrantEntitlement,\n    call: (input, { container, caller }) => container.entitlements.grant(input, caller.actor),\n  }),\n  defineTool({\n    name: 'revoke_access',\n    title: 'Revoke access',\n    description:\n      \"Revoke a student's direct grant to one course, download, community or event (contentId) or to a bundle (bundleId), never both. Access through a bundle stays. grant_access makes it active again.\",\n    kind: 'destructive',\n    idempotent: false,\n    openWorld: false,\n    input: RevokeEntitlement,\n    call: (input, { container, caller }) => container.entitlements.revoke(input, caller.actor),\n  }),\n  defineTool({\n    name: 'get_dashboard',\n    title: 'Get dashboard',\n    description:\n      'Published and draft course counts, active students, and access grants expiring soon.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: noInput,\n    call: (_input, { container, caller }) => container.reporting.admin.overview(caller.actor),\n  }),\n  defineTool({\n    name: 'get_enrollment_trend',\n    title: 'Get enrollment trend',\n    description:\n      'Daily enrollments across the organization for the last days (default 30, at most 365).',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: EnrollmentSeriesQuery,\n    call: ({ days }, { container, caller }) =>\n      container.reporting.admin.enrollments(days, caller.actor),\n  }),\n  defineTool({\n    name: 'get_course_analytics',\n    title: 'Get course analytics',\n    description:\n      'Enrolled, started and completed counts, average progress and per-activity engagement for one course.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: CourseIdPathParam,\n    call: ({ courseId }, { container, caller }) =>\n      container.reporting.admin.courseAnalytics(courseId, caller.actor),\n  }),\n  defineTool({\n    name: 'list_course_learners',\n    title: 'List course learners',\n    description:\n      \"Page through a course's learners: everyone with a grant that opens it, directly or through a bundle, active or not, with that grant and their progress. Search by name or email.\",\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: CourseLearnersQuery.extend(CourseIdPathParam.shape),\n    call: ({ courseId, ...query }, { container, caller }) =>\n      container.reporting.admin.courseLearners(courseId, query, caller.actor),\n  }),\n  defineTool({\n    name: 'get_course_enrollment_trend',\n    title: 'Get course enrollment trend',\n    description: 'Daily enrollments in one course for the last days (default 30, at most 365).',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: EnrollmentSeriesQuery.extend(CourseIdPathParam.shape),\n    call: ({ courseId, days }, { container, caller }) =>\n      container.reporting.admin.courseEnrollments(courseId, days, caller.actor),\n  }),\n  defineTool({\n    name: 'get_student_analytics',\n    title: 'Get student analytics',\n    description:\n      \"One student's enrolled, started and completed counts, average progress and progress in each course.\",\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: StudentIdParam,\n    call: ({ id }, { container, caller }) =>\n      container.reporting.admin.studentAnalytics(id, caller.actor),\n  }),\n];\n"],"mappings":";;;;;;;;;AAcA,MAAa,cAAsB;CACjC,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,aACzB,UAAU,UAAU,MAAM,aAAa,OAAO,OAAO,KAAK;CAC9D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,aAAa,KAAK,EAAE,SAAS,KAAK,CAAC;EAC1C,QAAQ;EACR,OAAO,OAAO,EAAE,WAAW,aACzB,UAAU,cAAc,aAAa,OAAO,OAAO,OAAO,OAAO,MAAM;CAC3E,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,aAAa,UAAU,aAAa,KAAK,OAAO,OAAO,KAAK;CACzF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,aAAa,UAAU,aAAa,MAAM,OAAO,OAAO,KAAK;CAC1F,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,aAAa,UAAU,aAAa,OAAO,OAAO,OAAO,KAAK;CAC3F,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,QAAQ,EAAE,WAAW,aAAa,UAAU,UAAU,MAAM,SAAS,OAAO,KAAK;CAC1F,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,QAAQ,EAAE,WAAW,aAC5B,UAAU,UAAU,MAAM,YAAY,MAAM,OAAO,KAAK;CAC5D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,YAAY,EAAE,WAAW,aAChC,UAAU,UAAU,MAAM,gBAAgB,UAAU,OAAO,KAAK;CACpE,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,oBAAoB,OAAO,kBAAkB,KAAK;EACzD,OAAO,EAAE,UAAU,GAAG,SAAS,EAAE,WAAW,aAC1C,UAAU,UAAU,MAAM,eAAe,UAAU,OAAO,OAAO,KAAK;CAC1E,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,sBAAsB,OAAO,kBAAkB,KAAK;EAC3D,OAAO,EAAE,UAAU,QAAQ,EAAE,WAAW,aACtC,UAAU,UAAU,MAAM,kBAAkB,UAAU,MAAM,OAAO,KAAK;CAC5E,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,MAAM,EAAE,WAAW,aAC1B,UAAU,UAAU,MAAM,iBAAiB,IAAI,OAAO,KAAK;CAC/D,CAAC;AACH"}

package/dist/http/plugins/auth.js

@@ -1,4 +1,5 @@
 import { bridgeWebResponse, toWebRequest } from "../web-bridge.js";
+import { isPermission } from "@headless-lms/core/organizations";
 //#region src/http/plugins/auth.ts
 /** The request carries no session. The central error handler maps this to 401. */
 var UnauthorizedError = class extends Error {
@@ -7,6 +8,12 @@ var UnauthorizedError = class extends Error {
 		this.name = "UnauthorizedError";
 	}
 };
+function carriesKey(request) {
+	return request.headers["x-api-key"] !== void 0 || request.headers.authorization !== void 0;
+}
+function callerLimit(limit) {
+	return "roleKey" in limit ? limit : { scopes: limit.scopes.filter(isPermission) };
+}
 function registerAuth(app, appServer) {
 	const { auth } = appServer;
 	const origin = new URL(appServer.mcp.issuer).origin;
@@ -20,32 +27,54 @@ function registerAuth(app, appServer) {
 			await bridgeWebResponse(await auth.handler(toWebRequest(request, origin)), reply);
 		}
 	});
+	async function requireKey(request) {
+		const grant = await appServer.auth.verifyApiKey(request.headers);
+		if (!grant) throw new UnauthorizedError("The API key is not valid");
+		const caller = await appServer.organizations.resolveCaller(grant.orgId, grant.userId, callerLimit(grant.limit));
+		if (!caller) throw new UnauthorizedError("The API key's organization no longer exists");
+		request.authUserId = grant.userId;
+		request.userId = caller.userId ?? grant.userId;
+		request.orgId = caller.orgId;
+		request.authOrgId = grant.orgId;
+		request.resolvedCaller = caller;
+		appServer.requestContext.set({ orgId: caller.orgId });
+	}
 	app.decorate("requireSession", async (request) => {
+		if (carriesKey(request)) throw new UnauthorizedError("Sign in to continue; an API key is not accepted here");
 		const session = await appServer.auth.verify(request.headers);
 		if (!session) throw new UnauthorizedError();
 		request.authUser = session.user;
+		request.authUserId = session.user.id;
 		request.userId = session.user.id;
 		const authOrgId = session.session.activeOrganizationId;
 		if (authOrgId) {
 			request.authOrgId = authOrgId;
-			const org = await appServer.organizations.getByExternalId(authOrgId);
-			if (org) {
-				request.orgId = org.id;
-				appServer.requestContext.set({ orgId: org.id });
+			const caller = await appServer.organizations.resolveCaller(authOrgId, session.user.id);
+			if (caller) {
+				request.resolvedCaller = caller;
+				request.orgId = caller.orgId;
+				appServer.requestContext.set({ orgId: caller.orgId });
 			}
 		}
 	});
 	app.decorate("requireOrgSession", async (request) => {
+		if (request.resolvedCaller && request.orgId) return;
+		if (carriesKey(request)) {
+			await requireKey(request);
+			return;
+		}
 		const session = await appServer.auth.verify(request.headers);
 		if (!session) throw new UnauthorizedError();
 		const authOrgId = session.session.activeOrganizationId;
 		if (!authOrgId) throw new UnauthorizedError("Choose an organization to continue");
-		const org = await appServer.organizations.getByExternalId(authOrgId);
-		if (!org) throw new UnauthorizedError("Your session points to an organization that no longer exists");
+		const caller = await appServer.organizations.resolveCaller(authOrgId, session.user.id);
+		if (!caller) throw new UnauthorizedError("Your session points to an organization that no longer exists");
 		request.authUser = session.user;
+		request.authUserId = session.user.id;
 		request.userId = session.user.id;
-		request.orgId = org.id;
-		appServer.requestContext.set({ orgId: org.id });
+		request.orgId = caller.orgId;
+		request.resolvedCaller = caller;
+		appServer.requestContext.set({ orgId: caller.orgId });
 		request.authOrgId = authOrgId;
 	});
 }

package/dist/http/plugins/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":[],"sources":["../../../src/http/plugins/auth.ts"],"sourcesContent":["// Everything better-auth touches on the HTTP surface:\n//   - the /api/auth/* catch-all bridged to better-auth's Web handler\n//   - the `requireSession` / `requireOrgSession` decorators routes guard with\nimport type { FastifyInstance, FastifyRequest } from 'fastify';\nimport type { Container } from '../../app/container.js';\nimport { bridgeWebResponse, toWebRequest } from '../web-bridge.js';\n\n/** The request carries no session. The central error handler maps this to 401. */\nexport class UnauthorizedError extends Error {\n  constructor(message = 'Sign in to continue') {\n    super(message);\n    this.name = 'UnauthorizedError';\n  }\n}\n\nexport function registerAuth(app: FastifyInstance, appServer: Container): void {\n  const { auth } = appServer;\n  const origin = new URL(appServer.mcp.issuer).origin;\n\n  app.addContentTypeParser(\n    'application/x-www-form-urlencoded',\n    { parseAs: 'string' },\n    (_request, body, done) => {\n      done(null, body);\n    },\n  );\n\n  // Mount better-auth: a catch-all that bridges Fastify <-> Web Request/Response.\n  app.route({\n    method: ['GET', 'POST'],\n    url: '/api/auth/*',\n    async handler(request, reply) {\n      await bridgeWebResponse(await auth.handler(toWebRequest(request, origin)), reply);\n    },\n  });\n\n  // Session only, no active org required. For the routes a caller reaches\n  // *before* they have an org: creating their first organization, and accepting\n  // an invitation (which is what stamps the active org onto the session).\n  app.decorate('requireSession', async (request: FastifyRequest) => {\n    const session = await appServer.auth.verify(request.headers);\n    if (!session) {\n      throw new UnauthorizedError();\n    }\n    request.authUser = session.user;\n    request.userId = session.user.id;\n\n    const authOrgId = session.session.activeOrganizationId;\n    if (authOrgId) {\n      request.authOrgId = authOrgId;\n      const org = await appServer.organizations.getByExternalId(authOrgId);\n      if (org) {\n        request.orgId = org.id;\n        appServer.requestContext.set({ orgId: org.id });\n      }\n    }\n  });\n\n  // Requires a valid session with an active org set — every org-scoped route.\n  app.decorate('requireOrgSession', async (request: FastifyRequest) => {\n    const session = await appServer.auth.verify(request.headers);\n    if (!session) {\n      throw new UnauthorizedError();\n    }\n    const authOrgId = session.session.activeOrganizationId;\n    if (!authOrgId) {\n      throw new UnauthorizedError('Choose an organization to continue');\n    }\n\n    const org = await appServer.organizations.getByExternalId(authOrgId);\n    if (!org) {\n      throw new UnauthorizedError('Your session points to an organization that no longer exists');\n    }\n    request.authUser = session.user;\n    request.userId = session.user.id;\n    request.orgId = org.id;\n    appServer.requestContext.set({ orgId: org.id });\n    // resolveScope requires the auth-provider id too — routes that write back\n    // through better-auth key on it.\n    request.authOrgId = authOrgId;\n  });\n}\n"],"mappings":";;;AAQA,IAAa,oBAAb,cAAuC,MAAM;CAC3C,YAAY,UAAU,uBAAuB;EAC3C,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAEA,SAAgB,aAAa,KAAsB,WAA4B;CAC7E,MAAM,EAAE,SAAS;CACjB,MAAM,SAAS,IAAI,IAAI,UAAU,IAAI,MAAM,CAAC,CAAC;CAE7C,IAAI,qBACF,qCACA,EAAE,SAAS,SAAS,IACnB,UAAU,MAAM,SAAS;EACxB,KAAK,MAAM,IAAI;CACjB,CACF;CAGA,IAAI,MAAM;EACR,QAAQ,CAAC,OAAO,MAAM;EACtB,KAAK;EACL,MAAM,QAAQ,SAAS,OAAO;GAC5B,MAAM,kBAAkB,MAAM,KAAK,QAAQ,aAAa,SAAS,MAAM,CAAC,GAAG,KAAK;EAClF;CACF,CAAC;CAKD,IAAI,SAAS,kBAAkB,OAAO,YAA4B;EAChE,MAAM,UAAU,MAAM,UAAU,KAAK,OAAO,QAAQ,OAAO;EAC3D,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;EAE9B,QAAQ,WAAW,QAAQ;EAC3B,QAAQ,SAAS,QAAQ,KAAK;EAE9B,MAAM,YAAY,QAAQ,QAAQ;EAClC,IAAI,WAAW;GACb,QAAQ,YAAY;GACpB,MAAM,MAAM,MAAM,UAAU,cAAc,gBAAgB,SAAS;GACnE,IAAI,KAAK;IACP,QAAQ,QAAQ,IAAI;IACpB,UAAU,eAAe,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC;GAChD;EACF;CACF,CAAC;CAGD,IAAI,SAAS,qBAAqB,OAAO,YAA4B;EACnE,MAAM,UAAU,MAAM,UAAU,KAAK,OAAO,QAAQ,OAAO;EAC3D,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;EAE9B,MAAM,YAAY,QAAQ,QAAQ;EAClC,IAAI,CAAC,WACH,MAAM,IAAI,kBAAkB,oCAAoC;EAGlE,MAAM,MAAM,MAAM,UAAU,cAAc,gBAAgB,SAAS;EACnE,IAAI,CAAC,KACH,MAAM,IAAI,kBAAkB,8DAA8D;EAE5F,QAAQ,WAAW,QAAQ;EAC3B,QAAQ,SAAS,QAAQ,KAAK;EAC9B,QAAQ,QAAQ,IAAI;EACpB,UAAU,eAAe,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC;EAG9C,QAAQ,YAAY;CACtB,CAAC;AACH"}
+{"version":3,"file":"auth.js","names":[],"sources":["../../../src/http/plugins/auth.ts"],"sourcesContent":["// Everything better-auth touches on the HTTP surface:\n//   - the /api/auth/* catch-all bridged to better-auth's Web handler\n//   - the `requireSession` / `requireOrgSession` decorators routes guard with\nimport type { FastifyInstance, FastifyRequest } from 'fastify';\nimport type { Container } from '../../app/container.js';\nimport { isPermission } from '@headless-lms/core/organizations';\nimport type { CallerLimit } from '@headless-lms/core/organizations';\nimport type { CredentialLimit } from '@headless-lms/core/types';\nimport { bridgeWebResponse, toWebRequest } from '../web-bridge.js';\n\n/** The request carries no session. The central error handler maps this to 401. */\nexport class UnauthorizedError extends Error {\n  constructor(message = 'Sign in to continue') {\n    super(message);\n    this.name = 'UnauthorizedError';\n  }\n}\n\nfunction carriesKey(request: FastifyRequest): boolean {\n  return request.headers['x-api-key'] !== undefined || request.headers.authorization !== undefined;\n}\n\nfunction callerLimit(limit: CredentialLimit): CallerLimit {\n  return 'roleKey' in limit ? limit : { scopes: limit.scopes.filter(isPermission) };\n}\n\nexport function registerAuth(app: FastifyInstance, appServer: Container): void {\n  const { auth } = appServer;\n  const origin = new URL(appServer.mcp.issuer).origin;\n\n  app.addContentTypeParser(\n    'application/x-www-form-urlencoded',\n    { parseAs: 'string' },\n    (_request, body, done) => {\n      done(null, body);\n    },\n  );\n\n  // Mount better-auth: a catch-all that bridges Fastify <-> Web Request/Response.\n  app.route({\n    method: ['GET', 'POST'],\n    url: '/api/auth/*',\n    async handler(request, reply) {\n      await bridgeWebResponse(await auth.handler(toWebRequest(request, origin)), reply);\n    },\n  });\n\n  async function requireKey(request: FastifyRequest): Promise<void> {\n    const grant = await appServer.auth.verifyApiKey(request.headers);\n    if (!grant) {\n      throw new UnauthorizedError('The API key is not valid');\n    }\n    const caller = await appServer.organizations.resolveCaller(\n      grant.orgId,\n      grant.userId,\n      callerLimit(grant.limit),\n    );\n    if (!caller) {\n      throw new UnauthorizedError(\"The API key's organization no longer exists\");\n    }\n    request.authUserId = grant.userId;\n    request.userId = caller.userId ?? grant.userId;\n    request.orgId = caller.orgId;\n    request.authOrgId = grant.orgId;\n    request.resolvedCaller = caller;\n    appServer.requestContext.set({ orgId: caller.orgId });\n  }\n\n  // Session only, no active org required. For the routes a caller reaches\n  // *before* they have an org: creating their first organization, and accepting\n  // an invitation (which is what stamps the active org onto the session).\n  app.decorate('requireSession', async (request: FastifyRequest) => {\n    if (carriesKey(request)) {\n      throw new UnauthorizedError('Sign in to continue; an API key is not accepted here');\n    }\n    const session = await appServer.auth.verify(request.headers);\n    if (!session) {\n      throw new UnauthorizedError();\n    }\n    request.authUser = session.user;\n    request.authUserId = session.user.id;\n    request.userId = session.user.id;\n\n    const authOrgId = session.session.activeOrganizationId;\n    if (authOrgId) {\n      request.authOrgId = authOrgId;\n      const caller = await appServer.organizations.resolveCaller(authOrgId, session.user.id);\n      if (caller) {\n        request.resolvedCaller = caller;\n        request.orgId = caller.orgId;\n        appServer.requestContext.set({ orgId: caller.orgId });\n      }\n    }\n  });\n\n  // Requires a valid API key, or a valid session with an active org set — every org-scoped route.\n  app.decorate('requireOrgSession', async (request: FastifyRequest) => {\n    if (request.resolvedCaller && request.orgId) {\n      return;\n    }\n    if (carriesKey(request)) {\n      await requireKey(request);\n      return;\n    }\n    const session = await appServer.auth.verify(request.headers);\n    if (!session) {\n      throw new UnauthorizedError();\n    }\n    const authOrgId = session.session.activeOrganizationId;\n    if (!authOrgId) {\n      throw new UnauthorizedError('Choose an organization to continue');\n    }\n\n    const caller = await appServer.organizations.resolveCaller(authOrgId, session.user.id);\n    if (!caller) {\n      throw new UnauthorizedError('Your session points to an organization that no longer exists');\n    }\n    request.authUser = session.user;\n    request.authUserId = session.user.id;\n    request.userId = session.user.id;\n    request.orgId = caller.orgId;\n    request.resolvedCaller = caller;\n    appServer.requestContext.set({ orgId: caller.orgId });\n    // resolveScope requires the auth-provider id too — routes that write back\n    // through better-auth key on it.\n    request.authOrgId = authOrgId;\n  });\n}\n"],"mappings":";;;;AAWA,IAAa,oBAAb,cAAuC,MAAM;CAC3C,YAAY,UAAU,uBAAuB;EAC3C,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAEA,SAAS,WAAW,SAAkC;CACpD,OAAO,QAAQ,QAAQ,iBAAiB,KAAA,KAAa,QAAQ,QAAQ,kBAAkB,KAAA;AACzF;AAEA,SAAS,YAAY,OAAqC;CACxD,OAAO,aAAa,QAAQ,QAAQ,EAAE,QAAQ,MAAM,OAAO,OAAO,YAAY,EAAE;AAClF;AAEA,SAAgB,aAAa,KAAsB,WAA4B;CAC7E,MAAM,EAAE,SAAS;CACjB,MAAM,SAAS,IAAI,IAAI,UAAU,IAAI,MAAM,CAAC,CAAC;CAE7C,IAAI,qBACF,qCACA,EAAE,SAAS,SAAS,IACnB,UAAU,MAAM,SAAS;EACxB,KAAK,MAAM,IAAI;CACjB,CACF;CAGA,IAAI,MAAM;EACR,QAAQ,CAAC,OAAO,MAAM;EACtB,KAAK;EACL,MAAM,QAAQ,SAAS,OAAO;GAC5B,MAAM,kBAAkB,MAAM,KAAK,QAAQ,aAAa,SAAS,MAAM,CAAC,GAAG,KAAK;EAClF;CACF,CAAC;CAED,eAAe,WAAW,SAAwC;EAChE,MAAM,QAAQ,MAAM,UAAU,KAAK,aAAa,QAAQ,OAAO;EAC/D,IAAI,CAAC,OACH,MAAM,IAAI,kBAAkB,0BAA0B;EAExD,MAAM,SAAS,MAAM,UAAU,cAAc,cAC3C,MAAM,OACN,MAAM,QACN,YAAY,MAAM,KAAK,CACzB;EACA,IAAI,CAAC,QACH,MAAM,IAAI,kBAAkB,6CAA6C;EAE3E,QAAQ,aAAa,MAAM;EAC3B,QAAQ,SAAS,OAAO,UAAU,MAAM;EACxC,QAAQ,QAAQ,OAAO;EACvB,QAAQ,YAAY,MAAM;EAC1B,QAAQ,iBAAiB;EACzB,UAAU,eAAe,IAAI,EAAE,OAAO,OAAO,MAAM,CAAC;CACtD;CAKA,IAAI,SAAS,kBAAkB,OAAO,YAA4B;EAChE,IAAI,WAAW,OAAO,GACpB,MAAM,IAAI,kBAAkB,sDAAsD;EAEpF,MAAM,UAAU,MAAM,UAAU,KAAK,OAAO,QAAQ,OAAO;EAC3D,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;EAE9B,QAAQ,WAAW,QAAQ;EAC3B,QAAQ,aAAa,QAAQ,KAAK;EAClC,QAAQ,SAAS,QAAQ,KAAK;EAE9B,MAAM,YAAY,QAAQ,QAAQ;EAClC,IAAI,WAAW;GACb,QAAQ,YAAY;GACpB,MAAM,SAAS,MAAM,UAAU,cAAc,cAAc,WAAW,QAAQ,KAAK,EAAE;GACrF,IAAI,QAAQ;IACV,QAAQ,iBAAiB;IACzB,QAAQ,QAAQ,OAAO;IACvB,UAAU,eAAe,IAAI,EAAE,OAAO,OAAO,MAAM,CAAC;GACtD;EACF;CACF,CAAC;CAGD,IAAI,SAAS,qBAAqB,OAAO,YAA4B;EACnE,IAAI,QAAQ,kBAAkB,QAAQ,OACpC;EAEF,IAAI,WAAW,OAAO,GAAG;GACvB,MAAM,WAAW,OAAO;GACxB;EACF;EACA,MAAM,UAAU,MAAM,UAAU,KAAK,OAAO,QAAQ,OAAO;EAC3D,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;EAE9B,MAAM,YAAY,QAAQ,QAAQ;EAClC,IAAI,CAAC,WACH,MAAM,IAAI,kBAAkB,oCAAoC;EAGlE,MAAM,SAAS,MAAM,UAAU,cAAc,cAAc,WAAW,QAAQ,KAAK,EAAE;EACrF,IAAI,CAAC,QACH,MAAM,IAAI,kBAAkB,8DAA8D;EAE5F,QAAQ,WAAW,QAAQ;EAC3B,QAAQ,aAAa,QAAQ,KAAK;EAClC,QAAQ,SAAS,QAAQ,KAAK;EAC9B,QAAQ,QAAQ,OAAO;EACvB,QAAQ,iBAAiB;EACzB,UAAU,eAAe,IAAI,EAAE,OAAO,OAAO,MAAM,CAAC;EAGpD,QAAQ,YAAY;CACtB,CAAC;AACH"}

package/dist/http/plugins/error-handler.d.ts

@@ -1,7 +1,11 @@
 import { FastifyReply, FastifyRequest } from "fastify";
 //#region src/http/plugins/error-handler.d.ts
+declare function refusalSubject(error: unknown): {
+  permission?: string;
+  contentId?: string;
+};
 declare function errorHandler(error: unknown, request: FastifyRequest, reply: FastifyReply): FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
 declare function notFoundHandler(request: FastifyRequest, reply: FastifyReply): FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
 //#endregion
-export { errorHandler, notFoundHandler };
+export { errorHandler, notFoundHandler, refusalSubject };
 //# sourceMappingURL=error-handler.d.ts.map

package/dist/http/plugins/error-handler.js

@@ -5,6 +5,13 @@ import { isResponseSerializationError } from "fastify-type-provider-zod";
 function routeOf(request) {
 	return `${request.method} ${request.routeOptions.url ?? "unmatched route"}`;
 }
+function refusalSubject(error) {
+	const subject = error;
+	return {
+		...typeof subject?.permission === "string" && { permission: subject.permission },
+		...typeof subject?.contentId === "string" && { contentId: subject.contentId }
+	};
+}
 function errorHandler(error, request, reply) {
 	if (error instanceof ActionInvocationError) {
 		request.log.error({
@@ -24,12 +31,15 @@ function errorHandler(error, request, reply) {
 			error: refusal.error,
 			message: refusal.message,
 			...refusal.issues && { issues: refusal.issues },
-			...refusal.error === "bad_request" && { cause: error.message }
+			...refusal.details && { details: refusal.details },
+			...refusal.error === "bad_request" && { cause: error.message },
+			...refusalSubject(error)
 		}, `${routeOf(request)} refused`);
 		return reply.status(refusal.status).send({
 			error: refusal.error,
 			message: refusal.message,
-			...refusal.issues && { issues: refusal.issues }
+			...refusal.issues && { issues: refusal.issues },
+			...refusal.details && { details: refusal.details }
 		});
 	}
 	if (isResponseSerializationError(error)) request.log.error({
@@ -54,6 +64,6 @@ function notFoundHandler(request, reply) {
 	});
 }
 //#endregion
-export { errorHandler, notFoundHandler };
+export { errorHandler, notFoundHandler, refusalSubject };
 
 //# sourceMappingURL=error-handler.js.map