@headless-lms/server 0.4.0 → 0.6.0

package/dist/http/mcp/tools/people.js

@@ -1,142 +1,123 @@
 import { CourseIdPathParam } from "../../schemas/activities.js";
 import { StudentIdParam, StudentsQuery } from "../../schemas/students.js";
-import { EntitlementIdParam, EntitlementsQuery, GrantEntitlement, SetEntitlementStatus } from "../../schemas/entitlements.js";
+import { EntitlementsQuery, GrantEntitlement, RevokeEntitlement } from "../../schemas/entitlements.js";
 import { CreateInvite, Invite } from "../../schemas/invites.js";
 import { EnrollmentSeriesQuery } from "../../schemas/dashboard.js";
+import { CourseLearnersQuery } from "../../schemas/course-analytics.js";
 import "../../schemas/index.js";
-import { actor, defineTool, noInput } from "../tool.js";
+import { defineTool, noInput } from "../tool.js";
 //#region src/http/mcp/tools/people.ts
 const peopleTools = [
 	defineTool({
 		name: "list_students",
 		title: "List students",
 		description: "Search and page through the students with their access count, average progress, status and last activity.",
-		scope: "students:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: StudentsQuery,
-		call: (input, { container, scope }) => container.reporting.admin.listStudents(scope.orgId, input)
+		call: (input, { container, caller }) => container.reporting.admin.listStudents(input, caller.actor)
 	}),
 	defineTool({
 		name: "invite_student",
 		title: "Invite student",
 		description: "Invite someone by email as a student. They exist as an invited student at once. sendEmail false skips the email.",
-		scope: "students:invite",
 		kind: "write",
 		idempotent: false,
 		openWorld: true,
-		input: CreateInvite.omit({ role: true }),
+		input: CreateInvite.omit({ roleKey: true }),
 		output: Invite,
-		call: (input, { container, scope }) => container.organizations.createInvite(actor(scope), {
-			orgId: scope.orgId,
-			inviterUserId: scope.userId,
-			role: "student",
-			...input
-		})
-	}),
-	defineTool({
-		name: "resend_student_invite",
-		title: "Resend student invite",
-		description: "Send a pending student's invite email again.",
-		scope: "students:invite",
-		kind: "write",
-		idempotent: false,
-		openWorld: true,
-		input: StudentIdParam,
-		call: ({ id }, { container, scope }) => container.organizations.resendStudentInvite(actor(scope), {
-			orgId: scope.orgId,
-			orgUserId: id,
-			inviterUserId: scope.userId
-		})
+		call: (input, { container, caller }) => container.organizations.createInvite(input, caller.actor, caller.userId)
 	}),
 	defineTool({
 		name: "list_access",
 		title: "List access",
 		description: "Who has access to what. Filter by student (orgUserId), content, type or status.",
-		scope: "access:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: EntitlementsQuery,
-		call: (input, { container, scope }) => container.entitlements.list(scope.orgId, input)
+		call: (input, { container, caller }) => container.entitlements.list(input, caller.actor)
 	}),
 	defineTool({
 		name: "grant_access",
 		title: "Grant access",
-		description: "Give a student access to one course, download or community (contentId) or to a bundle (bundleId), never both. expiresAt is a date-time, or null for no expiry.",
-		scope: "access:write",
+		description: "Give a student access to one course, download, community or event (contentId) or to a bundle (bundleId), never both. expiresAt is a date-time, or null for no expiry.",
 		kind: "write",
 		idempotent: false,
 		openWorld: false,
 		input: GrantEntitlement,
-		call: (input, { container, scope }) => container.entitlements.grant(scope.orgId, input)
+		call: (input, { container, caller }) => container.entitlements.grant(input, caller.actor)
 	}),
 	defineTool({
-		name: "set_access_status",
-		title: "Revoke or reinstate access",
-		description: "Revoke an access grant, or reinstate a revoked one.",
-		scope: "access:write",
+		name: "revoke_access",
+		title: "Revoke access",
+		description: "Revoke a student's direct grant to one course, download, community or event (contentId) or to a bundle (bundleId), never both. Access through a bundle stays. grant_access makes it active again.",
 		kind: "destructive",
-		idempotent: true,
+		idempotent: false,
 		openWorld: false,
-		input: SetEntitlementStatus.extend(EntitlementIdParam.shape),
-		call: ({ id, status }, { container, scope }) => container.entitlements.setStatus(scope.orgId, id, status)
+		input: RevokeEntitlement,
+		call: (input, { container, caller }) => container.entitlements.revoke(input, caller.actor)
 	}),
 	defineTool({
 		name: "get_dashboard",
 		title: "Get dashboard",
 		description: "Published and draft course counts, active students, and access grants expiring soon.",
-		scope: "analytics:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: noInput,
-		call: (_input, { container, scope }) => container.reporting.admin.overview(scope.orgId)
+		call: (_input, { container, caller }) => container.reporting.admin.overview(caller.actor)
 	}),
 	defineTool({
 		name: "get_enrollment_trend",
 		title: "Get enrollment trend",
 		description: "Daily enrollments across the organization for the last days (default 30, at most 365).",
-		scope: "analytics:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: EnrollmentSeriesQuery,
-		call: ({ days }, { container, scope }) => container.reporting.admin.enrollments(scope.orgId, days)
+		call: ({ days }, { container, caller }) => container.reporting.admin.enrollments(days, caller.actor)
 	}),
 	defineTool({
 		name: "get_course_analytics",
 		title: "Get course analytics",
 		description: "Enrolled, started and completed counts, average progress and per-activity engagement for one course.",
-		scope: "analytics:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: CourseIdPathParam,
-		call: ({ courseId }, { container, scope }) => container.reporting.admin.courseAnalytics(scope.orgId, courseId)
+		call: ({ courseId }, { container, caller }) => container.reporting.admin.courseAnalytics(courseId, caller.actor)
+	}),
+	defineTool({
+		name: "list_course_learners",
+		title: "List course learners",
+		description: "Page through a course's learners: everyone with a grant that opens it, directly or through a bundle, active or not, with that grant and their progress. Search by name or email.",
+		kind: "read",
+		idempotent: true,
+		openWorld: false,
+		input: CourseLearnersQuery.extend(CourseIdPathParam.shape),
+		call: ({ courseId, ...query }, { container, caller }) => container.reporting.admin.courseLearners(courseId, query, caller.actor)
 	}),
 	defineTool({
 		name: "get_course_enrollment_trend",
 		title: "Get course enrollment trend",
 		description: "Daily enrollments in one course for the last days (default 30, at most 365).",
-		scope: "analytics:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: EnrollmentSeriesQuery.extend(CourseIdPathParam.shape),
-		call: ({ courseId, days }, { container, scope }) => container.reporting.admin.courseEnrollments(scope.orgId, courseId, days)
+		call: ({ courseId, days }, { container, caller }) => container.reporting.admin.courseEnrollments(courseId, days, caller.actor)
 	}),
 	defineTool({
 		name: "get_student_analytics",
 		title: "Get student analytics",
 		description: "One student's enrolled, started and completed counts, average progress and progress in each course.",
-		scope: "analytics:read",
 		kind: "read",
 		idempotent: true,
 		openWorld: false,
 		input: StudentIdParam,
-		call: ({ id }, { container, scope }) => container.reporting.admin.studentAnalytics(scope.orgId, id)
+		call: ({ id }, { container, caller }) => container.reporting.admin.studentAnalytics(id, caller.actor)
 	})
 ];
 //#endregion

package/dist/http/mcp/tools/people.js.map

@@ -1 +1 @@
-{"version":3,"file":"people.js","names":[],"sources":["../../../../src/http/mcp/tools/people.ts"],"sourcesContent":["import {\n  CourseIdPathParam,\n  CreateInvite,\n  EnrollmentSeriesQuery,\n  EntitlementIdParam,\n  EntitlementsQuery,\n  GrantEntitlement,\n  Invite,\n  SetEntitlementStatus,\n  StudentIdParam,\n  StudentsQuery,\n} from '../../schemas/index.js';\nimport { actor, defineTool, noInput, type Tool } from '../tool.js';\n\nexport const peopleTools: Tool[] = [\n  defineTool({\n    name: 'list_students',\n    title: 'List students',\n    description:\n      'Search and page through the students with their access count, average progress, status and last activity.',\n    scope: 'students:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: StudentsQuery,\n    call: (input, { container, scope }) =>\n      container.reporting.admin.listStudents(scope.orgId, input),\n  }),\n  defineTool({\n    name: 'invite_student',\n    title: 'Invite student',\n    description:\n      'Invite someone by email as a student. They exist as an invited student at once. sendEmail false skips the email.',\n    scope: 'students:invite',\n    kind: 'write',\n    idempotent: false,\n    openWorld: true,\n    input: CreateInvite.omit({ role: true }),\n    output: Invite,\n    call: (input, { container, scope }) =>\n      container.organizations.createInvite(actor(scope), {\n        orgId: scope.orgId,\n        inviterUserId: scope.userId,\n        role: 'student',\n        ...input,\n      }),\n  }),\n  defineTool({\n    name: 'resend_student_invite',\n    title: 'Resend student invite',\n    description: \"Send a pending student's invite email again.\",\n    scope: 'students:invite',\n    kind: 'write',\n    idempotent: false,\n    openWorld: true,\n    input: StudentIdParam,\n    call: ({ id }, { container, scope }) =>\n      container.organizations.resendStudentInvite(actor(scope), {\n        orgId: scope.orgId,\n        orgUserId: id,\n        inviterUserId: scope.userId,\n      }),\n  }),\n  defineTool({\n    name: 'list_access',\n    title: 'List access',\n    description: 'Who has access to what. Filter by student (orgUserId), content, type or status.',\n    scope: 'access:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: EntitlementsQuery,\n    call: (input, { container, scope }) => container.entitlements.list(scope.orgId, input),\n  }),\n  defineTool({\n    name: 'grant_access',\n    title: 'Grant access',\n    description:\n      'Give a student access to one course, download or community (contentId) or to a bundle (bundleId), never both. expiresAt is a date-time, or null for no expiry.',\n    scope: 'access:write',\n    kind: 'write',\n    idempotent: false,\n    openWorld: false,\n    input: GrantEntitlement,\n    call: (input, { container, scope }) => container.entitlements.grant(scope.orgId, input),\n  }),\n  defineTool({\n    name: 'set_access_status',\n    title: 'Revoke or reinstate access',\n    description: 'Revoke an access grant, or reinstate a revoked one.',\n    scope: 'access:write',\n    kind: 'destructive',\n    idempotent: true,\n    openWorld: false,\n    input: SetEntitlementStatus.extend(EntitlementIdParam.shape),\n    call: ({ id, status }, { container, scope }) =>\n      container.entitlements.setStatus(scope.orgId, id, status),\n  }),\n  defineTool({\n    name: 'get_dashboard',\n    title: 'Get dashboard',\n    description:\n      'Published and draft course counts, active students, and access grants expiring soon.',\n    scope: 'analytics:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: noInput,\n    call: (_input, { container, scope }) => container.reporting.admin.overview(scope.orgId),\n  }),\n  defineTool({\n    name: 'get_enrollment_trend',\n    title: 'Get enrollment trend',\n    description:\n      'Daily enrollments across the organization for the last days (default 30, at most 365).',\n    scope: 'analytics:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: EnrollmentSeriesQuery,\n    call: ({ days }, { container, scope }) =>\n      container.reporting.admin.enrollments(scope.orgId, days),\n  }),\n  defineTool({\n    name: 'get_course_analytics',\n    title: 'Get course analytics',\n    description:\n      'Enrolled, started and completed counts, average progress and per-activity engagement for one course.',\n    scope: 'analytics:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: CourseIdPathParam,\n    call: ({ courseId }, { container, scope }) =>\n      container.reporting.admin.courseAnalytics(scope.orgId, courseId),\n  }),\n  defineTool({\n    name: 'get_course_enrollment_trend',\n    title: 'Get course enrollment trend',\n    description: 'Daily enrollments in one course for the last days (default 30, at most 365).',\n    scope: 'analytics:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: EnrollmentSeriesQuery.extend(CourseIdPathParam.shape),\n    call: ({ courseId, days }, { container, scope }) =>\n      container.reporting.admin.courseEnrollments(scope.orgId, courseId, days),\n  }),\n  defineTool({\n    name: 'get_student_analytics',\n    title: 'Get student analytics',\n    description:\n      \"One student's enrolled, started and completed counts, average progress and progress in each course.\",\n    scope: 'analytics:read',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: StudentIdParam,\n    call: ({ id }, { container, scope }) =>\n      container.reporting.admin.studentAnalytics(scope.orgId, id),\n  }),\n];\n"],"mappings":";;;;;;;;AAcA,MAAa,cAAsB;CACjC,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,YACzB,UAAU,UAAU,MAAM,aAAa,MAAM,OAAO,KAAK;CAC7D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,aAAa,KAAK,EAAE,MAAM,KAAK,CAAC;EACvC,QAAQ;EACR,OAAO,OAAO,EAAE,WAAW,YACzB,UAAU,cAAc,aAAa,MAAM,KAAK,GAAG;GACjD,OAAO,MAAM;GACb,eAAe,MAAM;GACrB,MAAM;GACN,GAAG;EACL,CAAC;CACL,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,MAAM,EAAE,WAAW,YAC1B,UAAU,cAAc,oBAAoB,MAAM,KAAK,GAAG;GACxD,OAAO,MAAM;GACb,WAAW;GACX,eAAe,MAAM;EACvB,CAAC;CACL,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,YAAY,UAAU,aAAa,KAAK,MAAM,OAAO,KAAK;CACvF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,YAAY,UAAU,aAAa,MAAM,MAAM,OAAO,KAAK;CACxF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,qBAAqB,OAAO,mBAAmB,KAAK;EAC3D,OAAO,EAAE,IAAI,UAAU,EAAE,WAAW,YAClC,UAAU,aAAa,UAAU,MAAM,OAAO,IAAI,MAAM;CAC5D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,QAAQ,EAAE,WAAW,YAAY,UAAU,UAAU,MAAM,SAAS,MAAM,KAAK;CACxF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,QAAQ,EAAE,WAAW,YAC5B,UAAU,UAAU,MAAM,YAAY,MAAM,OAAO,IAAI;CAC3D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,YAAY,EAAE,WAAW,YAChC,UAAU,UAAU,MAAM,gBAAgB,MAAM,OAAO,QAAQ;CACnE,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,sBAAsB,OAAO,kBAAkB,KAAK;EAC3D,OAAO,EAAE,UAAU,QAAQ,EAAE,WAAW,YACtC,UAAU,UAAU,MAAM,kBAAkB,MAAM,OAAO,UAAU,IAAI;CAC3E,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,OAAO;EACP,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,MAAM,EAAE,WAAW,YAC1B,UAAU,UAAU,MAAM,iBAAiB,MAAM,OAAO,EAAE;CAC9D,CAAC;AACH"}
+{"version":3,"file":"people.js","names":[],"sources":["../../../../src/http/mcp/tools/people.ts"],"sourcesContent":["import {\n  CourseIdPathParam,\n  CourseLearnersQuery,\n  CreateInvite,\n  EnrollmentSeriesQuery,\n  EntitlementsQuery,\n  GrantEntitlement,\n  Invite,\n  RevokeEntitlement,\n  StudentIdParam,\n  StudentsQuery,\n} from '../../schemas/index.js';\nimport { defineTool, noInput, type Tool } from '../tool.js';\n\nexport const peopleTools: Tool[] = [\n  defineTool({\n    name: 'list_students',\n    title: 'List students',\n    description:\n      'Search and page through the students with their access count, average progress, status and last activity.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: StudentsQuery,\n    call: (input, { container, caller }) =>\n      container.reporting.admin.listStudents(input, caller.actor),\n  }),\n  defineTool({\n    name: 'invite_student',\n    title: 'Invite student',\n    description:\n      'Invite someone by email as a student. They exist as an invited student at once. sendEmail false skips the email.',\n    kind: 'write',\n    idempotent: false,\n    openWorld: true,\n    input: CreateInvite.omit({ roleKey: true }),\n    output: Invite,\n    call: (input, { container, caller }) =>\n      container.organizations.createInvite(input, caller.actor, caller.userId),\n  }),\n  defineTool({\n    name: 'list_access',\n    title: 'List access',\n    description: 'Who has access to what. Filter by student (orgUserId), content, type or status.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: EntitlementsQuery,\n    call: (input, { container, caller }) => container.entitlements.list(input, caller.actor),\n  }),\n  defineTool({\n    name: 'grant_access',\n    title: 'Grant access',\n    description:\n      'Give a student access to one course, download, community or event (contentId) or to a bundle (bundleId), never both. expiresAt is a date-time, or null for no expiry.',\n    kind: 'write',\n    idempotent: false,\n    openWorld: false,\n    input: GrantEntitlement,\n    call: (input, { container, caller }) => container.entitlements.grant(input, caller.actor),\n  }),\n  defineTool({\n    name: 'revoke_access',\n    title: 'Revoke access',\n    description:\n      \"Revoke a student's direct grant to one course, download, community or event (contentId) or to a bundle (bundleId), never both. Access through a bundle stays. grant_access makes it active again.\",\n    kind: 'destructive',\n    idempotent: false,\n    openWorld: false,\n    input: RevokeEntitlement,\n    call: (input, { container, caller }) => container.entitlements.revoke(input, caller.actor),\n  }),\n  defineTool({\n    name: 'get_dashboard',\n    title: 'Get dashboard',\n    description:\n      'Published and draft course counts, active students, and access grants expiring soon.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: noInput,\n    call: (_input, { container, caller }) => container.reporting.admin.overview(caller.actor),\n  }),\n  defineTool({\n    name: 'get_enrollment_trend',\n    title: 'Get enrollment trend',\n    description:\n      'Daily enrollments across the organization for the last days (default 30, at most 365).',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: EnrollmentSeriesQuery,\n    call: ({ days }, { container, caller }) =>\n      container.reporting.admin.enrollments(days, caller.actor),\n  }),\n  defineTool({\n    name: 'get_course_analytics',\n    title: 'Get course analytics',\n    description:\n      'Enrolled, started and completed counts, average progress and per-activity engagement for one course.',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: CourseIdPathParam,\n    call: ({ courseId }, { container, caller }) =>\n      container.reporting.admin.courseAnalytics(courseId, caller.actor),\n  }),\n  defineTool({\n    name: 'list_course_learners',\n    title: 'List course learners',\n    description:\n      \"Page through a course's learners: everyone with a grant that opens it, directly or through a bundle, active or not, with that grant and their progress. Search by name or email.\",\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: CourseLearnersQuery.extend(CourseIdPathParam.shape),\n    call: ({ courseId, ...query }, { container, caller }) =>\n      container.reporting.admin.courseLearners(courseId, query, caller.actor),\n  }),\n  defineTool({\n    name: 'get_course_enrollment_trend',\n    title: 'Get course enrollment trend',\n    description: 'Daily enrollments in one course for the last days (default 30, at most 365).',\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: EnrollmentSeriesQuery.extend(CourseIdPathParam.shape),\n    call: ({ courseId, days }, { container, caller }) =>\n      container.reporting.admin.courseEnrollments(courseId, days, caller.actor),\n  }),\n  defineTool({\n    name: 'get_student_analytics',\n    title: 'Get student analytics',\n    description:\n      \"One student's enrolled, started and completed counts, average progress and progress in each course.\",\n    kind: 'read',\n    idempotent: true,\n    openWorld: false,\n    input: StudentIdParam,\n    call: ({ id }, { container, caller }) =>\n      container.reporting.admin.studentAnalytics(id, caller.actor),\n  }),\n];\n"],"mappings":";;;;;;;;;AAcA,MAAa,cAAsB;CACjC,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,aACzB,UAAU,UAAU,MAAM,aAAa,OAAO,OAAO,KAAK;CAC9D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,aAAa,KAAK,EAAE,SAAS,KAAK,CAAC;EAC1C,QAAQ;EACR,OAAO,OAAO,EAAE,WAAW,aACzB,UAAU,cAAc,aAAa,OAAO,OAAO,OAAO,OAAO,MAAM;CAC3E,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,aAAa,UAAU,aAAa,KAAK,OAAO,OAAO,KAAK;CACzF,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,aAAa,UAAU,aAAa,MAAM,OAAO,OAAO,KAAK;CAC1F,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,OAAO,EAAE,WAAW,aAAa,UAAU,aAAa,OAAO,OAAO,OAAO,KAAK;CAC3F,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,QAAQ,EAAE,WAAW,aAAa,UAAU,UAAU,MAAM,SAAS,OAAO,KAAK;CAC1F,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,QAAQ,EAAE,WAAW,aAC5B,UAAU,UAAU,MAAM,YAAY,MAAM,OAAO,KAAK;CAC5D,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,YAAY,EAAE,WAAW,aAChC,UAAU,UAAU,MAAM,gBAAgB,UAAU,OAAO,KAAK;CACpE,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,oBAAoB,OAAO,kBAAkB,KAAK;EACzD,OAAO,EAAE,UAAU,GAAG,SAAS,EAAE,WAAW,aAC1C,UAAU,UAAU,MAAM,eAAe,UAAU,OAAO,OAAO,KAAK;CAC1E,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aAAa;EACb,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO,sBAAsB,OAAO,kBAAkB,KAAK;EAC3D,OAAO,EAAE,UAAU,QAAQ,EAAE,WAAW,aACtC,UAAU,UAAU,MAAM,kBAAkB,UAAU,MAAM,OAAO,KAAK;CAC5E,CAAC;CACD,WAAW;EACT,MAAM;EACN,OAAO;EACP,aACE;EACF,MAAM;EACN,YAAY;EACZ,WAAW;EACX,OAAO;EACP,OAAO,EAAE,MAAM,EAAE,WAAW,aAC1B,UAAU,UAAU,MAAM,iBAAiB,IAAI,OAAO,KAAK;CAC/D,CAAC;AACH"}

package/dist/http/plugins/auth.js

@@ -1,4 +1,5 @@
 import { bridgeWebResponse, toWebRequest } from "../web-bridge.js";
+import { isPermission } from "@headless-lms/core/organizations";
 //#region src/http/plugins/auth.ts
 /** The request carries no session. The central error handler maps this to 401. */
 var UnauthorizedError = class extends Error {
@@ -7,6 +8,12 @@ var UnauthorizedError = class extends Error {
 		this.name = "UnauthorizedError";
 	}
 };
+function carriesKey(request) {
+	return request.headers["x-api-key"] !== void 0 || request.headers.authorization !== void 0;
+}
+function callerLimit(limit) {
+	return "roleKey" in limit ? limit : { scopes: limit.scopes.filter(isPermission) };
+}
 function registerAuth(app, appServer) {
 	const { auth } = appServer;
 	const origin = new URL(appServer.mcp.issuer).origin;
@@ -20,32 +27,54 @@ function registerAuth(app, appServer) {
 			await bridgeWebResponse(await auth.handler(toWebRequest(request, origin)), reply);
 		}
 	});
+	async function requireKey(request) {
+		const grant = await appServer.auth.verifyApiKey(request.headers);
+		if (!grant) throw new UnauthorizedError("The API key is not valid");
+		const caller = await appServer.organizations.resolveCaller(grant.orgId, grant.userId, callerLimit(grant.limit));
+		if (!caller) throw new UnauthorizedError("The API key's organization no longer exists");
+		request.authUserId = grant.userId;
+		request.userId = caller.userId ?? grant.userId;
+		request.orgId = caller.orgId;
+		request.authOrgId = grant.orgId;
+		request.resolvedCaller = caller;
+		appServer.requestContext.set({ orgId: caller.orgId });
+	}
 	app.decorate("requireSession", async (request) => {
+		if (carriesKey(request)) throw new UnauthorizedError("Sign in to continue; an API key is not accepted here");
 		const session = await appServer.auth.verify(request.headers);
 		if (!session) throw new UnauthorizedError();
 		request.authUser = session.user;
+		request.authUserId = session.user.id;
 		request.userId = session.user.id;
 		const authOrgId = session.session.activeOrganizationId;
 		if (authOrgId) {
 			request.authOrgId = authOrgId;
-			const org = await appServer.organizations.getByExternalId(authOrgId);
-			if (org) {
-				request.orgId = org.id;
-				appServer.requestContext.set({ orgId: org.id });
+			const caller = await appServer.organizations.resolveCaller(authOrgId, session.user.id);
+			if (caller) {
+				request.resolvedCaller = caller;
+				request.orgId = caller.orgId;
+				appServer.requestContext.set({ orgId: caller.orgId });
 			}
 		}
 	});
 	app.decorate("requireOrgSession", async (request) => {
+		if (request.resolvedCaller && request.orgId) return;
+		if (carriesKey(request)) {
+			await requireKey(request);
+			return;
+		}
 		const session = await appServer.auth.verify(request.headers);
 		if (!session) throw new UnauthorizedError();
 		const authOrgId = session.session.activeOrganizationId;
 		if (!authOrgId) throw new UnauthorizedError("Choose an organization to continue");
-		const org = await appServer.organizations.getByExternalId(authOrgId);
-		if (!org) throw new UnauthorizedError("Your session points to an organization that no longer exists");
+		const caller = await appServer.organizations.resolveCaller(authOrgId, session.user.id);
+		if (!caller) throw new UnauthorizedError("Your session points to an organization that no longer exists");
 		request.authUser = session.user;
+		request.authUserId = session.user.id;
 		request.userId = session.user.id;
-		request.orgId = org.id;
-		appServer.requestContext.set({ orgId: org.id });
+		request.orgId = caller.orgId;
+		request.resolvedCaller = caller;
+		appServer.requestContext.set({ orgId: caller.orgId });
 		request.authOrgId = authOrgId;
 	});
 }

package/dist/http/plugins/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":[],"sources":["../../../src/http/plugins/auth.ts"],"sourcesContent":["// Everything better-auth touches on the HTTP surface:\n//   - the /api/auth/* catch-all bridged to better-auth's Web handler\n//   - the `requireSession` / `requireOrgSession` decorators routes guard with\nimport type { FastifyInstance, FastifyRequest } from 'fastify';\nimport type { Container } from '../../app/container.js';\nimport { bridgeWebResponse, toWebRequest } from '../web-bridge.js';\n\n/** The request carries no session. The central error handler maps this to 401. */\nexport class UnauthorizedError extends Error {\n  constructor(message = 'Sign in to continue') {\n    super(message);\n    this.name = 'UnauthorizedError';\n  }\n}\n\nexport function registerAuth(app: FastifyInstance, appServer: Container): void {\n  const { auth } = appServer;\n  const origin = new URL(appServer.mcp.issuer).origin;\n\n  app.addContentTypeParser(\n    'application/x-www-form-urlencoded',\n    { parseAs: 'string' },\n    (_request, body, done) => {\n      done(null, body);\n    },\n  );\n\n  // Mount better-auth: a catch-all that bridges Fastify <-> Web Request/Response.\n  app.route({\n    method: ['GET', 'POST'],\n    url: '/api/auth/*',\n    async handler(request, reply) {\n      await bridgeWebResponse(await auth.handler(toWebRequest(request, origin)), reply);\n    },\n  });\n\n  // Session only, no active org required. For the routes a caller reaches\n  // *before* they have an org: creating their first organization, and accepting\n  // an invitation (which is what stamps the active org onto the session).\n  app.decorate('requireSession', async (request: FastifyRequest) => {\n    const session = await appServer.auth.verify(request.headers);\n    if (!session) {\n      throw new UnauthorizedError();\n    }\n    request.authUser = session.user;\n    request.userId = session.user.id;\n\n    const authOrgId = session.session.activeOrganizationId;\n    if (authOrgId) {\n      request.authOrgId = authOrgId;\n      const org = await appServer.organizations.getByExternalId(authOrgId);\n      if (org) {\n        request.orgId = org.id;\n        appServer.requestContext.set({ orgId: org.id });\n      }\n    }\n  });\n\n  // Requires a valid session with an active org set — every org-scoped route.\n  app.decorate('requireOrgSession', async (request: FastifyRequest) => {\n    const session = await appServer.auth.verify(request.headers);\n    if (!session) {\n      throw new UnauthorizedError();\n    }\n    const authOrgId = session.session.activeOrganizationId;\n    if (!authOrgId) {\n      throw new UnauthorizedError('Choose an organization to continue');\n    }\n\n    const org = await appServer.organizations.getByExternalId(authOrgId);\n    if (!org) {\n      throw new UnauthorizedError('Your session points to an organization that no longer exists');\n    }\n    request.authUser = session.user;\n    request.userId = session.user.id;\n    request.orgId = org.id;\n    appServer.requestContext.set({ orgId: org.id });\n    // resolveScope requires the auth-provider id too — routes that write back\n    // through better-auth key on it.\n    request.authOrgId = authOrgId;\n  });\n}\n"],"mappings":";;;AAQA,IAAa,oBAAb,cAAuC,MAAM;CAC3C,YAAY,UAAU,uBAAuB;EAC3C,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAEA,SAAgB,aAAa,KAAsB,WAA4B;CAC7E,MAAM,EAAE,SAAS;CACjB,MAAM,SAAS,IAAI,IAAI,UAAU,IAAI,MAAM,CAAC,CAAC;CAE7C,IAAI,qBACF,qCACA,EAAE,SAAS,SAAS,IACnB,UAAU,MAAM,SAAS;EACxB,KAAK,MAAM,IAAI;CACjB,CACF;CAGA,IAAI,MAAM;EACR,QAAQ,CAAC,OAAO,MAAM;EACtB,KAAK;EACL,MAAM,QAAQ,SAAS,OAAO;GAC5B,MAAM,kBAAkB,MAAM,KAAK,QAAQ,aAAa,SAAS,MAAM,CAAC,GAAG,KAAK;EAClF;CACF,CAAC;CAKD,IAAI,SAAS,kBAAkB,OAAO,YAA4B;EAChE,MAAM,UAAU,MAAM,UAAU,KAAK,OAAO,QAAQ,OAAO;EAC3D,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;EAE9B,QAAQ,WAAW,QAAQ;EAC3B,QAAQ,SAAS,QAAQ,KAAK;EAE9B,MAAM,YAAY,QAAQ,QAAQ;EAClC,IAAI,WAAW;GACb,QAAQ,YAAY;GACpB,MAAM,MAAM,MAAM,UAAU,cAAc,gBAAgB,SAAS;GACnE,IAAI,KAAK;IACP,QAAQ,QAAQ,IAAI;IACpB,UAAU,eAAe,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC;GAChD;EACF;CACF,CAAC;CAGD,IAAI,SAAS,qBAAqB,OAAO,YAA4B;EACnE,MAAM,UAAU,MAAM,UAAU,KAAK,OAAO,QAAQ,OAAO;EAC3D,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;EAE9B,MAAM,YAAY,QAAQ,QAAQ;EAClC,IAAI,CAAC,WACH,MAAM,IAAI,kBAAkB,oCAAoC;EAGlE,MAAM,MAAM,MAAM,UAAU,cAAc,gBAAgB,SAAS;EACnE,IAAI,CAAC,KACH,MAAM,IAAI,kBAAkB,8DAA8D;EAE5F,QAAQ,WAAW,QAAQ;EAC3B,QAAQ,SAAS,QAAQ,KAAK;EAC9B,QAAQ,QAAQ,IAAI;EACpB,UAAU,eAAe,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC;EAG9C,QAAQ,YAAY;CACtB,CAAC;AACH"}
+{"version":3,"file":"auth.js","names":[],"sources":["../../../src/http/plugins/auth.ts"],"sourcesContent":["// Everything better-auth touches on the HTTP surface:\n//   - the /api/auth/* catch-all bridged to better-auth's Web handler\n//   - the `requireSession` / `requireOrgSession` decorators routes guard with\nimport type { FastifyInstance, FastifyRequest } from 'fastify';\nimport type { Container } from '../../app/container.js';\nimport { isPermission } from '@headless-lms/core/organizations';\nimport type { CallerLimit } from '@headless-lms/core/organizations';\nimport type { CredentialLimit } from '@headless-lms/core/types';\nimport { bridgeWebResponse, toWebRequest } from '../web-bridge.js';\n\n/** The request carries no session. The central error handler maps this to 401. */\nexport class UnauthorizedError extends Error {\n  constructor(message = 'Sign in to continue') {\n    super(message);\n    this.name = 'UnauthorizedError';\n  }\n}\n\nfunction carriesKey(request: FastifyRequest): boolean {\n  return request.headers['x-api-key'] !== undefined || request.headers.authorization !== undefined;\n}\n\nfunction callerLimit(limit: CredentialLimit): CallerLimit {\n  return 'roleKey' in limit ? limit : { scopes: limit.scopes.filter(isPermission) };\n}\n\nexport function registerAuth(app: FastifyInstance, appServer: Container): void {\n  const { auth } = appServer;\n  const origin = new URL(appServer.mcp.issuer).origin;\n\n  app.addContentTypeParser(\n    'application/x-www-form-urlencoded',\n    { parseAs: 'string' },\n    (_request, body, done) => {\n      done(null, body);\n    },\n  );\n\n  // Mount better-auth: a catch-all that bridges Fastify <-> Web Request/Response.\n  app.route({\n    method: ['GET', 'POST'],\n    url: '/api/auth/*',\n    async handler(request, reply) {\n      await bridgeWebResponse(await auth.handler(toWebRequest(request, origin)), reply);\n    },\n  });\n\n  async function requireKey(request: FastifyRequest): Promise<void> {\n    const grant = await appServer.auth.verifyApiKey(request.headers);\n    if (!grant) {\n      throw new UnauthorizedError('The API key is not valid');\n    }\n    const caller = await appServer.organizations.resolveCaller(\n      grant.orgId,\n      grant.userId,\n      callerLimit(grant.limit),\n    );\n    if (!caller) {\n      throw new UnauthorizedError(\"The API key's organization no longer exists\");\n    }\n    request.authUserId = grant.userId;\n    request.userId = caller.userId ?? grant.userId;\n    request.orgId = caller.orgId;\n    request.authOrgId = grant.orgId;\n    request.resolvedCaller = caller;\n    appServer.requestContext.set({ orgId: caller.orgId });\n  }\n\n  // Session only, no active org required. For the routes a caller reaches\n  // *before* they have an org: creating their first organization, and accepting\n  // an invitation (which is what stamps the active org onto the session).\n  app.decorate('requireSession', async (request: FastifyRequest) => {\n    if (carriesKey(request)) {\n      throw new UnauthorizedError('Sign in to continue; an API key is not accepted here');\n    }\n    const session = await appServer.auth.verify(request.headers);\n    if (!session) {\n      throw new UnauthorizedError();\n    }\n    request.authUser = session.user;\n    request.authUserId = session.user.id;\n    request.userId = session.user.id;\n\n    const authOrgId = session.session.activeOrganizationId;\n    if (authOrgId) {\n      request.authOrgId = authOrgId;\n      const caller = await appServer.organizations.resolveCaller(authOrgId, session.user.id);\n      if (caller) {\n        request.resolvedCaller = caller;\n        request.orgId = caller.orgId;\n        appServer.requestContext.set({ orgId: caller.orgId });\n      }\n    }\n  });\n\n  // Requires a valid API key, or a valid session with an active org set — every org-scoped route.\n  app.decorate('requireOrgSession', async (request: FastifyRequest) => {\n    if (request.resolvedCaller && request.orgId) {\n      return;\n    }\n    if (carriesKey(request)) {\n      await requireKey(request);\n      return;\n    }\n    const session = await appServer.auth.verify(request.headers);\n    if (!session) {\n      throw new UnauthorizedError();\n    }\n    const authOrgId = session.session.activeOrganizationId;\n    if (!authOrgId) {\n      throw new UnauthorizedError('Choose an organization to continue');\n    }\n\n    const caller = await appServer.organizations.resolveCaller(authOrgId, session.user.id);\n    if (!caller) {\n      throw new UnauthorizedError('Your session points to an organization that no longer exists');\n    }\n    request.authUser = session.user;\n    request.authUserId = session.user.id;\n    request.userId = session.user.id;\n    request.orgId = caller.orgId;\n    request.resolvedCaller = caller;\n    appServer.requestContext.set({ orgId: caller.orgId });\n    // resolveScope requires the auth-provider id too — routes that write back\n    // through better-auth key on it.\n    request.authOrgId = authOrgId;\n  });\n}\n"],"mappings":";;;;AAWA,IAAa,oBAAb,cAAuC,MAAM;CAC3C,YAAY,UAAU,uBAAuB;EAC3C,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAEA,SAAS,WAAW,SAAkC;CACpD,OAAO,QAAQ,QAAQ,iBAAiB,KAAA,KAAa,QAAQ,QAAQ,kBAAkB,KAAA;AACzF;AAEA,SAAS,YAAY,OAAqC;CACxD,OAAO,aAAa,QAAQ,QAAQ,EAAE,QAAQ,MAAM,OAAO,OAAO,YAAY,EAAE;AAClF;AAEA,SAAgB,aAAa,KAAsB,WAA4B;CAC7E,MAAM,EAAE,SAAS;CACjB,MAAM,SAAS,IAAI,IAAI,UAAU,IAAI,MAAM,CAAC,CAAC;CAE7C,IAAI,qBACF,qCACA,EAAE,SAAS,SAAS,IACnB,UAAU,MAAM,SAAS;EACxB,KAAK,MAAM,IAAI;CACjB,CACF;CAGA,IAAI,MAAM;EACR,QAAQ,CAAC,OAAO,MAAM;EACtB,KAAK;EACL,MAAM,QAAQ,SAAS,OAAO;GAC5B,MAAM,kBAAkB,MAAM,KAAK,QAAQ,aAAa,SAAS,MAAM,CAAC,GAAG,KAAK;EAClF;CACF,CAAC;CAED,eAAe,WAAW,SAAwC;EAChE,MAAM,QAAQ,MAAM,UAAU,KAAK,aAAa,QAAQ,OAAO;EAC/D,IAAI,CAAC,OACH,MAAM,IAAI,kBAAkB,0BAA0B;EAExD,MAAM,SAAS,MAAM,UAAU,cAAc,cAC3C,MAAM,OACN,MAAM,QACN,YAAY,MAAM,KAAK,CACzB;EACA,IAAI,CAAC,QACH,MAAM,IAAI,kBAAkB,6CAA6C;EAE3E,QAAQ,aAAa,MAAM;EAC3B,QAAQ,SAAS,OAAO,UAAU,MAAM;EACxC,QAAQ,QAAQ,OAAO;EACvB,QAAQ,YAAY,MAAM;EAC1B,QAAQ,iBAAiB;EACzB,UAAU,eAAe,IAAI,EAAE,OAAO,OAAO,MAAM,CAAC;CACtD;CAKA,IAAI,SAAS,kBAAkB,OAAO,YAA4B;EAChE,IAAI,WAAW,OAAO,GACpB,MAAM,IAAI,kBAAkB,sDAAsD;EAEpF,MAAM,UAAU,MAAM,UAAU,KAAK,OAAO,QAAQ,OAAO;EAC3D,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;EAE9B,QAAQ,WAAW,QAAQ;EAC3B,QAAQ,aAAa,QAAQ,KAAK;EAClC,QAAQ,SAAS,QAAQ,KAAK;EAE9B,MAAM,YAAY,QAAQ,QAAQ;EAClC,IAAI,WAAW;GACb,QAAQ,YAAY;GACpB,MAAM,SAAS,MAAM,UAAU,cAAc,cAAc,WAAW,QAAQ,KAAK,EAAE;GACrF,IAAI,QAAQ;IACV,QAAQ,iBAAiB;IACzB,QAAQ,QAAQ,OAAO;IACvB,UAAU,eAAe,IAAI,EAAE,OAAO,OAAO,MAAM,CAAC;GACtD;EACF;CACF,CAAC;CAGD,IAAI,SAAS,qBAAqB,OAAO,YAA4B;EACnE,IAAI,QAAQ,kBAAkB,QAAQ,OACpC;EAEF,IAAI,WAAW,OAAO,GAAG;GACvB,MAAM,WAAW,OAAO;GACxB;EACF;EACA,MAAM,UAAU,MAAM,UAAU,KAAK,OAAO,QAAQ,OAAO;EAC3D,IAAI,CAAC,SACH,MAAM,IAAI,kBAAkB;EAE9B,MAAM,YAAY,QAAQ,QAAQ;EAClC,IAAI,CAAC,WACH,MAAM,IAAI,kBAAkB,oCAAoC;EAGlE,MAAM,SAAS,MAAM,UAAU,cAAc,cAAc,WAAW,QAAQ,KAAK,EAAE;EACrF,IAAI,CAAC,QACH,MAAM,IAAI,kBAAkB,8DAA8D;EAE5F,QAAQ,WAAW,QAAQ;EAC3B,QAAQ,aAAa,QAAQ,KAAK;EAClC,QAAQ,SAAS,QAAQ,KAAK;EAC9B,QAAQ,QAAQ,OAAO;EACvB,QAAQ,iBAAiB;EACzB,UAAU,eAAe,IAAI,EAAE,OAAO,OAAO,MAAM,CAAC;EAGpD,QAAQ,YAAY;CACtB,CAAC;AACH"}

package/dist/http/plugins/error-handler.d.ts

@@ -1,7 +1,11 @@
 import { FastifyReply, FastifyRequest } from "fastify";
 //#region src/http/plugins/error-handler.d.ts
+declare function refusalSubject(error: unknown): {
+  permission?: string;
+  contentId?: string;
+};
 declare function errorHandler(error: unknown, request: FastifyRequest, reply: FastifyReply): FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
 declare function notFoundHandler(request: FastifyRequest, reply: FastifyReply): FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
 //#endregion
-export { errorHandler, notFoundHandler };
+export { errorHandler, notFoundHandler, refusalSubject };
 //# sourceMappingURL=error-handler.d.ts.map

package/dist/http/plugins/error-handler.js

@@ -5,6 +5,13 @@ import { isResponseSerializationError } from "fastify-type-provider-zod";
 function routeOf(request) {
 	return `${request.method} ${request.routeOptions.url ?? "unmatched route"}`;
 }
+function refusalSubject(error) {
+	const subject = error;
+	return {
+		...typeof subject?.permission === "string" && { permission: subject.permission },
+		...typeof subject?.contentId === "string" && { contentId: subject.contentId }
+	};
+}
 function errorHandler(error, request, reply) {
 	if (error instanceof ActionInvocationError) {
 		request.log.error({
@@ -25,7 +32,8 @@ function errorHandler(error, request, reply) {
 			message: refusal.message,
 			...refusal.issues && { issues: refusal.issues },
 			...refusal.details && { details: refusal.details },
-			...refusal.error === "bad_request" && { cause: error.message }
+			...refusal.error === "bad_request" && { cause: error.message },
+			...refusalSubject(error)
 		}, `${routeOf(request)} refused`);
 		return reply.status(refusal.status).send({
 			error: refusal.error,
@@ -56,6 +64,6 @@ function notFoundHandler(request, reply) {
 	});
 }
 //#endregion
-export { errorHandler, notFoundHandler };
+export { errorHandler, notFoundHandler, refusalSubject };
 
 //# sourceMappingURL=error-handler.js.map

package/dist/http/plugins/error-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-handler.js","names":[],"sources":["../../../src/http/plugins/error-handler.ts"],"sourcesContent":["import type { FastifyReply, FastifyRequest } from 'fastify';\nimport { ActionInvocationError } from '@headless-lms/core/integrations';\nimport { isResponseSerializationError } from 'fastify-type-provider-zod';\nimport { classifyError } from '../errors.js';\n\nfunction routeOf(request: FastifyRequest): string {\n  return `${request.method} ${request.routeOptions.url ?? 'unmatched route'}`;\n}\n\nexport function errorHandler(error: unknown, request: FastifyRequest, reply: FastifyReply) {\n  if (error instanceof ActionInvocationError) {\n    request.log.error(\n      { err: error, integrationId: error.integrationId, actionId: error.actionId },\n      `integration action failed in ${routeOf(request)}`,\n    );\n    return reply.status(502).send({\n      error: 'action_failed',\n      message: 'The integration did not respond as expected',\n    });\n  }\n  const refusal = classifyError(error);\n  if (refusal) {\n    request.log.info(\n      {\n        status: refusal.status,\n        error: refusal.error,\n        message: refusal.message,\n        ...(refusal.issues && { issues: refusal.issues }),\n        ...(refusal.details && { details: refusal.details }),\n        ...(refusal.error === 'bad_request' && { cause: (error as Error).message }),\n      },\n      `${routeOf(request)} refused`,\n    );\n    return reply.status(refusal.status).send({\n      error: refusal.error,\n      message: refusal.message,\n      ...(refusal.issues && { issues: refusal.issues }),\n      ...(refusal.details && { details: refusal.details }),\n    });\n  }\n  if (isResponseSerializationError(error)) {\n    request.log.error(\n      { err: error, issues: error.cause.issues },\n      `response of ${routeOf(request)} does not match its schema`,\n    );\n  } else {\n    request.log.error({ err: error }, `unhandled error in ${routeOf(request)}`);\n  }\n  return reply.status(500).send({\n    error: 'internal_error',\n    message: 'Something went wrong on our side. Quote the request id when reporting it.',\n    requestId: request.id,\n  });\n}\n\nexport function notFoundHandler(request: FastifyRequest, reply: FastifyReply) {\n  request.log.info(\n    { status: 404, error: 'not_found' },\n    `${request.method} unmatched route refused`,\n  );\n  return reply\n    .status(404)\n    .send({ error: 'not_found', message: `No route for ${request.method} ${request.url}` });\n}\n"],"mappings":";;;;AAKA,SAAS,QAAQ,SAAiC;CAChD,OAAO,GAAG,QAAQ,OAAO,GAAG,QAAQ,aAAa,OAAO;AAC1D;AAEA,SAAgB,aAAa,OAAgB,SAAyB,OAAqB;CACzF,IAAI,iBAAiB,uBAAuB;EAC1C,QAAQ,IAAI,MACV;GAAE,KAAK;GAAO,eAAe,MAAM;GAAe,UAAU,MAAM;EAAS,GAC3E,gCAAgC,QAAQ,OAAO,GACjD;EACA,OAAO,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK;GAC5B,OAAO;GACP,SAAS;EACX,CAAC;CACH;CACA,MAAM,UAAU,cAAc,KAAK;CACnC,IAAI,SAAS;EACX,QAAQ,IAAI,KACV;GACE,QAAQ,QAAQ;GAChB,OAAO,QAAQ;GACf,SAAS,QAAQ;GACjB,GAAI,QAAQ,UAAU,EAAE,QAAQ,QAAQ,OAAO;GAC/C,GAAI,QAAQ,WAAW,EAAE,SAAS,QAAQ,QAAQ;GAClD,GAAI,QAAQ,UAAU,iBAAiB,EAAE,OAAQ,MAAgB,QAAQ;EAC3E,GACA,GAAG,QAAQ,OAAO,EAAE,SACtB;EACA,OAAO,MAAM,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK;GACvC,OAAO,QAAQ;GACf,SAAS,QAAQ;GACjB,GAAI,QAAQ,UAAU,EAAE,QAAQ,QAAQ,OAAO;GAC/C,GAAI,QAAQ,WAAW,EAAE,SAAS,QAAQ,QAAQ;EACpD,CAAC;CACH;CACA,IAAI,6BAA6B,KAAK,GACpC,QAAQ,IAAI,MACV;EAAE,KAAK;EAAO,QAAQ,MAAM,MAAM;CAAO,GACzC,eAAe,QAAQ,OAAO,EAAE,2BAClC;MAEA,QAAQ,IAAI,MAAM,EAAE,KAAK,MAAM,GAAG,sBAAsB,QAAQ,OAAO,GAAG;CAE5E,OAAO,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK;EAC5B,OAAO;EACP,SAAS;EACT,WAAW,QAAQ;CACrB,CAAC;AACH;AAEA,SAAgB,gBAAgB,SAAyB,OAAqB;CAC5E,QAAQ,IAAI,KACV;EAAE,QAAQ;EAAK,OAAO;CAAY,GAClC,GAAG,QAAQ,OAAO,yBACpB;CACA,OAAO,MACJ,OAAO,GAAG,CAAC,CACX,KAAK;EAAE,OAAO;EAAa,SAAS,gBAAgB,QAAQ,OAAO,GAAG,QAAQ;CAAM,CAAC;AAC1F"}
+{"version":3,"file":"error-handler.js","names":[],"sources":["../../../src/http/plugins/error-handler.ts"],"sourcesContent":["import type { FastifyReply, FastifyRequest } from 'fastify';\nimport { ActionInvocationError } from '@headless-lms/core/integrations';\nimport { isResponseSerializationError } from 'fastify-type-provider-zod';\nimport { classifyError } from '../errors.js';\n\nfunction routeOf(request: FastifyRequest): string {\n  return `${request.method} ${request.routeOptions.url ?? 'unmatched route'}`;\n}\n\nexport function refusalSubject(error: unknown): { permission?: string; contentId?: string } {\n  const subject = error as { permission?: unknown; contentId?: unknown };\n  return {\n    ...(typeof subject?.permission === 'string' && { permission: subject.permission }),\n    ...(typeof subject?.contentId === 'string' && { contentId: subject.contentId }),\n  };\n}\n\nexport function errorHandler(error: unknown, request: FastifyRequest, reply: FastifyReply) {\n  if (error instanceof ActionInvocationError) {\n    request.log.error(\n      { err: error, integrationId: error.integrationId, actionId: error.actionId },\n      `integration action failed in ${routeOf(request)}`,\n    );\n    return reply.status(502).send({\n      error: 'action_failed',\n      message: 'The integration did not respond as expected',\n    });\n  }\n  const refusal = classifyError(error);\n  if (refusal) {\n    request.log.info(\n      {\n        status: refusal.status,\n        error: refusal.error,\n        message: refusal.message,\n        ...(refusal.issues && { issues: refusal.issues }),\n        ...(refusal.details && { details: refusal.details }),\n        ...(refusal.error === 'bad_request' && { cause: (error as Error).message }),\n        ...refusalSubject(error),\n      },\n      `${routeOf(request)} refused`,\n    );\n    return reply.status(refusal.status).send({\n      error: refusal.error,\n      message: refusal.message,\n      ...(refusal.issues && { issues: refusal.issues }),\n      ...(refusal.details && { details: refusal.details }),\n    });\n  }\n  if (isResponseSerializationError(error)) {\n    request.log.error(\n      { err: error, issues: error.cause.issues },\n      `response of ${routeOf(request)} does not match its schema`,\n    );\n  } else {\n    request.log.error({ err: error }, `unhandled error in ${routeOf(request)}`);\n  }\n  return reply.status(500).send({\n    error: 'internal_error',\n    message: 'Something went wrong on our side. Quote the request id when reporting it.',\n    requestId: request.id,\n  });\n}\n\nexport function notFoundHandler(request: FastifyRequest, reply: FastifyReply) {\n  request.log.info(\n    { status: 404, error: 'not_found' },\n    `${request.method} unmatched route refused`,\n  );\n  return reply\n    .status(404)\n    .send({ error: 'not_found', message: `No route for ${request.method} ${request.url}` });\n}\n"],"mappings":";;;;AAKA,SAAS,QAAQ,SAAiC;CAChD,OAAO,GAAG,QAAQ,OAAO,GAAG,QAAQ,aAAa,OAAO;AAC1D;AAEA,SAAgB,eAAe,OAA6D;CAC1F,MAAM,UAAU;CAChB,OAAO;EACL,GAAI,OAAO,SAAS,eAAe,YAAY,EAAE,YAAY,QAAQ,WAAW;EAChF,GAAI,OAAO,SAAS,cAAc,YAAY,EAAE,WAAW,QAAQ,UAAU;CAC/E;AACF;AAEA,SAAgB,aAAa,OAAgB,SAAyB,OAAqB;CACzF,IAAI,iBAAiB,uBAAuB;EAC1C,QAAQ,IAAI,MACV;GAAE,KAAK;GAAO,eAAe,MAAM;GAAe,UAAU,MAAM;EAAS,GAC3E,gCAAgC,QAAQ,OAAO,GACjD;EACA,OAAO,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK;GAC5B,OAAO;GACP,SAAS;EACX,CAAC;CACH;CACA,MAAM,UAAU,cAAc,KAAK;CACnC,IAAI,SAAS;EACX,QAAQ,IAAI,KACV;GACE,QAAQ,QAAQ;GAChB,OAAO,QAAQ;GACf,SAAS,QAAQ;GACjB,GAAI,QAAQ,UAAU,EAAE,QAAQ,QAAQ,OAAO;GAC/C,GAAI,QAAQ,WAAW,EAAE,SAAS,QAAQ,QAAQ;GAClD,GAAI,QAAQ,UAAU,iBAAiB,EAAE,OAAQ,MAAgB,QAAQ;GACzE,GAAG,eAAe,KAAK;EACzB,GACA,GAAG,QAAQ,OAAO,EAAE,SACtB;EACA,OAAO,MAAM,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK;GACvC,OAAO,QAAQ;GACf,SAAS,QAAQ;GACjB,GAAI,QAAQ,UAAU,EAAE,QAAQ,QAAQ,OAAO;GAC/C,GAAI,QAAQ,WAAW,EAAE,SAAS,QAAQ,QAAQ;EACpD,CAAC;CACH;CACA,IAAI,6BAA6B,KAAK,GACpC,QAAQ,IAAI,MACV;EAAE,KAAK;EAAO,QAAQ,MAAM,MAAM;CAAO,GACzC,eAAe,QAAQ,OAAO,EAAE,2BAClC;MAEA,QAAQ,IAAI,MAAM,EAAE,KAAK,MAAM,GAAG,sBAAsB,QAAQ,OAAO,GAAG;CAE5E,OAAO,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK;EAC5B,OAAO;EACP,SAAS;EACT,WAAW,QAAQ;CACrB,CAAC;AACH;AAEA,SAAgB,gBAAgB,SAAyB,OAAqB;CAC5E,QAAQ,IAAI,KACV;EAAE,QAAQ;EAAK,OAAO;CAAY,GAClC,GAAG,QAAQ,OAAO,yBACpB;CACA,OAAO,MACJ,OAAO,GAAG,CAAC,CACX,KAAK;EAAE,OAAO;EAAa,SAAS,gBAAgB,QAAQ,OAAO,GAAG,QAAQ;CAAM,CAAC;AAC1F"}

package/dist/http/plugins/openapi.js

@@ -22,7 +22,7 @@ function registerOpenApi(app, config) {
 			info: {
 				title: "Headless LMS API",
 				version,
-				description: "API documentation for the Headless LMS platform",
+				description: "API documentation for the Headless LMS platform. Every route under /api takes a signed-in session or an API key, sent in the `x-api-key` header or as `Authorization: Bearer <key>`. The platform routes take the platform key as `Authorization: Bearer <platform key>`.",
 				license: {
 					name: "MIT",
 					url: "https://opensource.org/licenses/MIT"
@@ -38,6 +38,10 @@ function registerOpenApi(app, config) {
 					name: "Content",
 					description: "Authored content: courses and downloads, their structure and delivery"
 				},
+				{
+					name: "Events",
+					description: "Live sessions at a set time: their details, location, recording and files"
+				},
 				{
 					name: "Entitlements",
 					description: "Access grants to content"
@@ -90,9 +94,21 @@ function registerOpenApi(app, config) {
 					name: "Reporting",
 					description: "Reporting and analytics"
 				},
+				{
+					name: "People",
+					description: "The organization's people, invites and the roles they hold"
+				},
+				{
+					name: "Roles",
+					description: "The organization's roles and their permissions"
+				},
 				{
 					name: "Access",
-					description: "Access scopes, connected apps and API keys"
+					description: "Your permissions, connected apps and API keys"
+				},
+				{
+					name: "Platform",
+					description: "Organizations and their API keys, created with the platform key"
 				}
 			]
 		},

package/dist/http/plugins/openapi.js.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.js","names":["pkg.version"],"sources":["../../../src/http/plugins/openapi.ts"],"sourcesContent":["// OpenAPI documentation. @fastify/swagger reads the Zod route schemas (via the\n// transform) to build the spec the frontend SDK is generated from; it must be\n// registered before the routes so its onRoute hook captures them. UI + JSON are\n// served under /docs.\nimport type { FastifyInstance } from 'fastify';\nimport swagger from '@fastify/swagger';\nimport swaggerUi from '@fastify/swagger-ui';\nimport { jsonSchemaTransform, jsonSchemaTransformObject } from 'fastify-type-provider-zod';\nimport type { ServerConfig } from '../config.js';\nimport { ErrorBody, ValidationErrorBody } from '../schemas/shared.js';\nimport pkg from '../../../package.json' with { type: 'json' };\n\nconst PUBLIC_ROUTES = new Set(['GET /api/organizations/invites/:token']);\n\ntype RouteSchema = {\n  body?: unknown;\n  querystring?: unknown;\n  params?: unknown;\n  response?: Record<string, unknown>;\n};\n\nfunction withDefaultResponses(\n  schema: RouteSchema | undefined,\n  method: string,\n  url: string,\n): RouteSchema | undefined {\n  if (!schema || !url.startsWith('/api/') || url.startsWith('/api/auth/')) {\n    return schema;\n  }\n  const response: Record<string, unknown> = { ...(schema.response ?? {}) };\n  if ((schema.body || schema.querystring || schema.params) && !response['400']) {\n    response['400'] = ValidationErrorBody;\n  }\n  if (!PUBLIC_ROUTES.has(`${method} ${url}`) && !response['401']) {\n    response['401'] = ErrorBody;\n  }\n  if (!response['500']) {\n    response['500'] = ErrorBody;\n  }\n  return { ...schema, response };\n}\n\nexport function registerOpenApi(app: FastifyInstance, config: ServerConfig): void {\n  app.register(swagger, {\n    openapi: {\n      info: {\n        title: 'Headless LMS API',\n        version: pkg.version,\n        description: 'API documentation for the Headless LMS platform',\n        license: {\n          name: 'MIT',\n          url: 'https://opensource.org/licenses/MIT',\n        },\n      },\n      servers: [{ url: config.publicUrl }],\n      tags: [\n        {\n          name: 'Organizations',\n          description: 'The tenant: its members, roles, invites and students',\n        },\n        {\n          name: 'Content',\n          description: 'Authored content: courses and downloads, their structure and delivery',\n        },\n        { name: 'Entitlements', description: 'Access grants to content' },\n        {\n          name: 'Progress',\n          description: 'Per-student progress and completion through course content',\n        },\n        { name: 'Discussion', description: 'Learner comments, replies, reactions and moderation' },\n        {\n          name: 'Communities',\n          description: 'Communities, their spaces, topics, and direct-message settings',\n        },\n        { name: 'Posts', description: 'Posts in a space, reactions, and the moderation queue' },\n        { name: 'Chats', description: 'Direct and group chats inside one community' },\n        { name: 'Profile', description: 'The signed-in member profile' },\n        {\n          name: 'Notifications',\n          description: 'What happened to the signed-in member, and how they want to be told',\n        },\n        { name: 'Assets', description: 'The org media library: uploads, serving and lifecycle' },\n        {\n          name: 'Files',\n          description: 'Stable file URLs that check access and redirect to a signed storage URL',\n        },\n        { name: 'Automations', description: 'Workflows and webhooks that react to system events' },\n        { name: 'Integrations', description: 'Connections to external services' },\n        { name: 'Reporting', description: 'Reporting and analytics' },\n        { name: 'Access', description: 'Access scopes, connected apps and API keys' },\n      ],\n    },\n    transform: (input) => {\n      const method = String(\n        Array.isArray(input.route.method) ? input.route.method[0] : input.route.method,\n      );\n      return jsonSchemaTransform({\n        ...input,\n        schema: withDefaultResponses(input.schema as RouteSchema | undefined, method, input.url),\n      } as typeof input);\n    },\n    transformObject: jsonSchemaTransformObject,\n  });\n  app.register(swaggerUi, { routePrefix: '/docs' });\n}\n"],"mappings":";;;;;;AAYA,MAAM,gCAAgB,IAAI,IAAI,CAAC,uCAAuC,CAAC;AASvE,SAAS,qBACP,QACA,QACA,KACyB;CACzB,IAAI,CAAC,UAAU,CAAC,IAAI,WAAW,OAAO,KAAK,IAAI,WAAW,YAAY,GACpE,OAAO;CAET,MAAM,WAAoC,EAAE,GAAI,OAAO,YAAY,CAAC,EAAG;CACvE,KAAK,OAAO,QAAQ,OAAO,eAAe,OAAO,WAAW,CAAC,SAAS,QACpE,SAAS,SAAS;CAEpB,IAAI,CAAC,cAAc,IAAI,GAAG,OAAO,GAAG,KAAK,KAAK,CAAC,SAAS,QACtD,SAAS,SAAS;CAEpB,IAAI,CAAC,SAAS,QACZ,SAAS,SAAS;CAEpB,OAAO;EAAE,GAAG;EAAQ;CAAS;AAC/B;AAEA,SAAgB,gBAAgB,KAAsB,QAA4B;CAChF,IAAI,SAAS,SAAS;EACpB,SAAS;GACP,MAAM;IACJ,OAAO;IACEA;IACT,aAAa;IACb,SAAS;KACP,MAAM;KACN,KAAK;IACP;GACF;GACA,SAAS,CAAC,EAAE,KAAK,OAAO,UAAU,CAAC;GACnC,MAAM;IACJ;KACE,MAAM;KACN,aAAa;IACf;IACA;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAgB,aAAa;IAA2B;IAChE;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAc,aAAa;IAAsD;IACzF;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAS,aAAa;IAAwD;IACtF;KAAE,MAAM;KAAS,aAAa;IAA8C;IAC5E;KAAE,MAAM;KAAW,aAAa;IAA+B;IAC/D;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAU,aAAa;IAAwD;IACvF;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAe,aAAa;IAAqD;IACzF;KAAE,MAAM;KAAgB,aAAa;IAAmC;IACxE;KAAE,MAAM;KAAa,aAAa;IAA0B;IAC5D;KAAE,MAAM;KAAU,aAAa;IAA6C;GAC9E;EACF;EACA,YAAY,UAAU;GACpB,MAAM,SAAS,OACb,MAAM,QAAQ,MAAM,MAAM,MAAM,IAAI,MAAM,MAAM,OAAO,KAAK,MAAM,MAAM,MAC1E;GACA,OAAO,oBAAoB;IACzB,GAAG;IACH,QAAQ,qBAAqB,MAAM,QAAmC,QAAQ,MAAM,GAAG;GACzF,CAAiB;EACnB;EACA,iBAAiB;CACnB,CAAC;CACD,IAAI,SAAS,WAAW,EAAE,aAAa,QAAQ,CAAC;AAClD"}
+{"version":3,"file":"openapi.js","names":["pkg.version"],"sources":["../../../src/http/plugins/openapi.ts"],"sourcesContent":["// OpenAPI documentation. @fastify/swagger reads the Zod route schemas (via the\n// transform) to build the spec the frontend SDK is generated from; it must be\n// registered before the routes so its onRoute hook captures them. UI + JSON are\n// served under /docs.\nimport type { FastifyInstance } from 'fastify';\nimport swagger from '@fastify/swagger';\nimport swaggerUi from '@fastify/swagger-ui';\nimport { jsonSchemaTransform, jsonSchemaTransformObject } from 'fastify-type-provider-zod';\nimport type { ServerConfig } from '../config.js';\nimport { ErrorBody, ValidationErrorBody } from '../schemas/shared.js';\nimport pkg from '../../../package.json' with { type: 'json' };\n\nconst PUBLIC_ROUTES = new Set(['GET /api/organizations/invites/:token']);\n\ntype RouteSchema = {\n  body?: unknown;\n  querystring?: unknown;\n  params?: unknown;\n  response?: Record<string, unknown>;\n};\n\nfunction withDefaultResponses(\n  schema: RouteSchema | undefined,\n  method: string,\n  url: string,\n): RouteSchema | undefined {\n  if (!schema || !url.startsWith('/api/') || url.startsWith('/api/auth/')) {\n    return schema;\n  }\n  const response: Record<string, unknown> = { ...(schema.response ?? {}) };\n  if ((schema.body || schema.querystring || schema.params) && !response['400']) {\n    response['400'] = ValidationErrorBody;\n  }\n  if (!PUBLIC_ROUTES.has(`${method} ${url}`) && !response['401']) {\n    response['401'] = ErrorBody;\n  }\n  if (!response['500']) {\n    response['500'] = ErrorBody;\n  }\n  return { ...schema, response };\n}\n\nexport function registerOpenApi(app: FastifyInstance, config: ServerConfig): void {\n  app.register(swagger, {\n    openapi: {\n      info: {\n        title: 'Headless LMS API',\n        version: pkg.version,\n        description:\n          'API documentation for the Headless LMS platform. Every route under /api takes a signed-in session or an API key, sent in the `x-api-key` header or as `Authorization: Bearer <key>`. The platform routes take the platform key as `Authorization: Bearer <platform key>`.',\n        license: {\n          name: 'MIT',\n          url: 'https://opensource.org/licenses/MIT',\n        },\n      },\n      servers: [{ url: config.publicUrl }],\n      tags: [\n        {\n          name: 'Organizations',\n          description: 'The tenant: its members, roles, invites and students',\n        },\n        {\n          name: 'Content',\n          description: 'Authored content: courses and downloads, their structure and delivery',\n        },\n        {\n          name: 'Events',\n          description: 'Live sessions at a set time: their details, location, recording and files',\n        },\n        { name: 'Entitlements', description: 'Access grants to content' },\n        {\n          name: 'Progress',\n          description: 'Per-student progress and completion through course content',\n        },\n        { name: 'Discussion', description: 'Learner comments, replies, reactions and moderation' },\n        {\n          name: 'Communities',\n          description: 'Communities, their spaces, topics, and direct-message settings',\n        },\n        { name: 'Posts', description: 'Posts in a space, reactions, and the moderation queue' },\n        { name: 'Chats', description: 'Direct and group chats inside one community' },\n        { name: 'Profile', description: 'The signed-in member profile' },\n        {\n          name: 'Notifications',\n          description: 'What happened to the signed-in member, and how they want to be told',\n        },\n        { name: 'Assets', description: 'The org media library: uploads, serving and lifecycle' },\n        {\n          name: 'Files',\n          description: 'Stable file URLs that check access and redirect to a signed storage URL',\n        },\n        { name: 'Automations', description: 'Workflows and webhooks that react to system events' },\n        { name: 'Integrations', description: 'Connections to external services' },\n        { name: 'Reporting', description: 'Reporting and analytics' },\n        {\n          name: 'People',\n          description: \"The organization's people, invites and the roles they hold\",\n        },\n        { name: 'Roles', description: \"The organization's roles and their permissions\" },\n        { name: 'Access', description: 'Your permissions, connected apps and API keys' },\n        {\n          name: 'Platform',\n          description: 'Organizations and their API keys, created with the platform key',\n        },\n      ],\n    },\n    transform: (input) => {\n      const method = String(\n        Array.isArray(input.route.method) ? input.route.method[0] : input.route.method,\n      );\n      return jsonSchemaTransform({\n        ...input,\n        schema: withDefaultResponses(input.schema as RouteSchema | undefined, method, input.url),\n      } as typeof input);\n    },\n    transformObject: jsonSchemaTransformObject,\n  });\n  app.register(swaggerUi, { routePrefix: '/docs' });\n}\n"],"mappings":";;;;;;AAYA,MAAM,gCAAgB,IAAI,IAAI,CAAC,uCAAuC,CAAC;AASvE,SAAS,qBACP,QACA,QACA,KACyB;CACzB,IAAI,CAAC,UAAU,CAAC,IAAI,WAAW,OAAO,KAAK,IAAI,WAAW,YAAY,GACpE,OAAO;CAET,MAAM,WAAoC,EAAE,GAAI,OAAO,YAAY,CAAC,EAAG;CACvE,KAAK,OAAO,QAAQ,OAAO,eAAe,OAAO,WAAW,CAAC,SAAS,QACpE,SAAS,SAAS;CAEpB,IAAI,CAAC,cAAc,IAAI,GAAG,OAAO,GAAG,KAAK,KAAK,CAAC,SAAS,QACtD,SAAS,SAAS;CAEpB,IAAI,CAAC,SAAS,QACZ,SAAS,SAAS;CAEpB,OAAO;EAAE,GAAG;EAAQ;CAAS;AAC/B;AAEA,SAAgB,gBAAgB,KAAsB,QAA4B;CAChF,IAAI,SAAS,SAAS;EACpB,SAAS;GACP,MAAM;IACJ,OAAO;IACEA;IACT,aACE;IACF,SAAS;KACP,MAAM;KACN,KAAK;IACP;GACF;GACA,SAAS,CAAC,EAAE,KAAK,OAAO,UAAU,CAAC;GACnC,MAAM;IACJ;KACE,MAAM;KACN,aAAa;IACf;IACA;KACE,MAAM;KACN,aAAa;IACf;IACA;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAgB,aAAa;IAA2B;IAChE;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAc,aAAa;IAAsD;IACzF;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAS,aAAa;IAAwD;IACtF;KAAE,MAAM;KAAS,aAAa;IAA8C;IAC5E;KAAE,MAAM;KAAW,aAAa;IAA+B;IAC/D;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAU,aAAa;IAAwD;IACvF;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAe,aAAa;IAAqD;IACzF;KAAE,MAAM;KAAgB,aAAa;IAAmC;IACxE;KAAE,MAAM;KAAa,aAAa;IAA0B;IAC5D;KACE,MAAM;KACN,aAAa;IACf;IACA;KAAE,MAAM;KAAS,aAAa;IAAiD;IAC/E;KAAE,MAAM;KAAU,aAAa;IAAgD;IAC/E;KACE,MAAM;KACN,aAAa;IACf;GACF;EACF;EACA,YAAY,UAAU;GACpB,MAAM,SAAS,OACb,MAAM,QAAQ,MAAM,MAAM,MAAM,IAAI,MAAM,MAAM,OAAO,KAAK,MAAM,MAAM,MAC1E;GACA,OAAO,oBAAoB;IACzB,GAAG;IACH,QAAQ,qBAAqB,MAAM,QAAmC,QAAQ,MAAM,GAAG;GACzF,CAAiB;EACnB;EACA,iBAAiB;CACnB,CAAC;CACD,IAAI,SAAS,WAAW,EAAE,aAAa,QAAQ,CAAC;AAClD"}

package/dist/http/plugins/platform.d.ts

@@ -0,0 +1,7 @@
+import { PlatformKeyCheck } from "../../app/platform.js";
+import { FastifyInstance } from "fastify";
+//#region src/http/plugins/platform.d.ts
+declare function registerPlatformAuth(app: FastifyInstance, platform: PlatformKeyCheck): void;
+//#endregion
+export { registerPlatformAuth };
+//# sourceMappingURL=platform.d.ts.map

package/dist/http/plugins/platform.js

@@ -0,0 +1,13 @@
+import { UnauthorizedError } from "./auth.js";
+//#region src/http/plugins/platform.ts
+const BEARER = /^Bearer\s+(\S+)$/i;
+function registerPlatformAuth(app, platform) {
+	app.decorate("requirePlatform", async (request) => {
+		const match = BEARER.exec(request.headers.authorization ?? "");
+		if (!match || !platform.matches(match[1])) throw new UnauthorizedError("The platform key is not valid");
+	});
+}
+//#endregion
+export { registerPlatformAuth };
+
+//# sourceMappingURL=platform.js.map

package/dist/http/plugins/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","names":[],"sources":["../../../src/http/plugins/platform.ts"],"sourcesContent":["import type { FastifyInstance, FastifyRequest } from 'fastify';\nimport type { PlatformKeyCheck } from '../../app/platform.js';\nimport { UnauthorizedError } from './auth.js';\n\nconst BEARER = /^Bearer\\s+(\\S+)$/i;\n\nexport function registerPlatformAuth(app: FastifyInstance, platform: PlatformKeyCheck): void {\n  app.decorate('requirePlatform', async (request: FastifyRequest) => {\n    const match = BEARER.exec(request.headers.authorization ?? '');\n    if (!match || !platform.matches(match[1]!)) {\n      throw new UnauthorizedError('The platform key is not valid');\n    }\n  });\n}\n"],"mappings":";;AAIA,MAAM,SAAS;AAEf,SAAgB,qBAAqB,KAAsB,UAAkC;CAC3F,IAAI,SAAS,mBAAmB,OAAO,YAA4B;EACjE,MAAM,QAAQ,OAAO,KAAK,QAAQ,QAAQ,iBAAiB,EAAE;EAC7D,IAAI,CAAC,SAAS,CAAC,SAAS,QAAQ,MAAM,EAAG,GACvC,MAAM,IAAI,kBAAkB,+BAA+B;CAE/D,CAAC;AACH"}