@voyant-travel/auth 0.128.3 → 0.130.0

package/dist/team-management-policy.js

@@ -0,0 +1,109 @@
+export class TeamManagementError extends Error {
+    code;
+    status;
+    constructor(code, message, status = 403) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.name = "TeamManagementError";
+    }
+}
+function requireCapability(capabilities, capability) {
+    if (!capabilities[capability]) {
+        throw new TeamManagementError("forbidden", "This team-management action is not allowed.");
+    }
+}
+async function authorize(adapter, context, capability) {
+    const actor = await adapter.getActor(context);
+    const capabilities = await adapter.getCapabilities(context, actor);
+    requireCapability(capabilities, capability);
+    return { actor, capabilities };
+}
+async function mutationState(adapter, context, capability, memberId) {
+    const { actor } = await authorize(adapter, context, capability);
+    const members = await adapter.listMembers(context);
+    const target = members.find((member) => member.id === memberId);
+    if (!target) {
+        throw new TeamManagementError("member_not_found", "Team member not found.", 404);
+    }
+    if (target.id === actor.memberId) {
+        throw new TeamManagementError("self_change_forbidden", "You cannot change your own role or access.", 409);
+    }
+    if (adapter.roleLevel(target.roleId) > adapter.roleLevel(actor.roleId)) {
+        throw new TeamManagementError("privilege_escalation", "You cannot manage a member with a more privileged role.");
+    }
+    return { actor, members, target };
+}
+function assertAssignableRole(adapter, actor, roles, roleId) {
+    if (!roles.some((role) => role.id === roleId)) {
+        throw new TeamManagementError("role_not_found", "Team role not found.", 404);
+    }
+    if (adapter.roleLevel(roleId) > adapter.roleLevel(actor.roleId)) {
+        throw new TeamManagementError("privilege_escalation", "You cannot assign a role above your own privilege level.");
+    }
+}
+function assertOwnerRemains(adapter, members, target) {
+    if (!adapter.isOwnerRole(target.roleId))
+        return;
+    const activeOwners = members.filter((member) => member.status === "active" && adapter.isOwnerRole(member.roleId));
+    if (activeOwners.length <= 1) {
+        throw new TeamManagementError("last_owner", "The last active owner cannot be demoted or deactivated.", 409);
+    }
+}
+/** Applies provider-neutral authorization and invariants before invoking an adapter. */
+export function createGuardedTeamManagementProvider(resolveAdapter) {
+    return {
+        async getCapabilities(context) {
+            const adapter = resolveAdapter(context);
+            const actor = await adapter.getActor(context);
+            return adapter.getCapabilities(context, actor);
+        },
+        async listMembers(context) {
+            const adapter = resolveAdapter(context);
+            await authorize(adapter, context, "viewRoster");
+            return adapter.listMembers(context);
+        },
+        async listRoles(context) {
+            const adapter = resolveAdapter(context);
+            await authorize(adapter, context, "viewRoster");
+            return adapter.listRoles(context);
+        },
+        async listInvitations(context) {
+            const adapter = resolveAdapter(context);
+            await authorize(adapter, context, "viewRoster");
+            return adapter.listInvitations(context);
+        },
+        async inviteMember(context, input) {
+            const adapter = resolveAdapter(context);
+            const { actor } = await authorize(adapter, context, "inviteMembers");
+            assertAssignableRole(adapter, actor, await adapter.listRoles(context), input.roleId);
+            return adapter.inviteMember(context, input);
+        },
+        async revokeInvitation(context, invitationId) {
+            const adapter = resolveAdapter(context);
+            await authorize(adapter, context, "revokeInvitations");
+            return adapter.revokeInvitation(context, invitationId);
+        },
+        async updateMemberRole(context, memberId, roleId) {
+            const adapter = resolveAdapter(context);
+            const { actor, members, target } = await mutationState(adapter, context, "manageRoles", memberId);
+            assertAssignableRole(adapter, actor, await adapter.listRoles(context), roleId);
+            if (adapter.isOwnerRole(target.roleId) && !adapter.isOwnerRole(roleId)) {
+                assertOwnerRemains(adapter, members, target);
+            }
+            return adapter.updateMemberRole(context, memberId, roleId);
+        },
+        async deactivateMember(context, memberId) {
+            const adapter = resolveAdapter(context);
+            const { members, target } = await mutationState(adapter, context, "deactivateMembers", memberId);
+            assertOwnerRemains(adapter, members, target);
+            return adapter.deactivateMember(context, memberId);
+        },
+        async activateMember(context, memberId) {
+            const adapter = resolveAdapter(context);
+            await mutationState(adapter, context, "activateMembers", memberId);
+            return adapter.activateMember(context, memberId);
+        },
+    };
+}
+//# sourceMappingURL=team-management-policy.js.map

package/dist/team-management-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-management-policy.js","sourceRoot":"","sources":["../src/team-management-policy.ts"],"names":[],"mappings":"AAqBA,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC;IAEA;IAHX,YACW,IAA6B,EACtC,OAAe,EACN,SAAsC,GAAG;QAElD,KAAK,CAAC,OAAO,CAAC,CAAA;QAJL,SAAI,GAAJ,IAAI,CAAyB;QAE7B,WAAM,GAAN,MAAM,CAAmC;QAGlD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAkCD,SAAS,iBAAiB,CAAC,YAA2C,EAAE,UAAsB;IAC5F,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAE,6CAA6C,CAAC,CAAA;IAC3F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,OAA8B,EAC9B,OAAqC,EACrC,UAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAClE,iBAAiB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAC3C,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;AAChC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAA8B,EAC9B,OAAqC,EACrC,UAAsB,EACtB,QAAgB;IAEhB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAA;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,EACvB,4CAA4C,EAC5C,GAAG,CACJ,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,mBAAmB,CAC3B,sBAAsB,EACtB,yDAAyD,CAC1D,CAAA;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AACnC,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAA8B,EAC9B,KAA0B,EAC1B,KAAoB,EACpB,MAAc;IAEd,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,mBAAmB,CAC3B,sBAAsB,EACtB,0DAA0D,CAC3D,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAA8B,EAC9B,OAAwB,EACxB,MAAqB;IAErB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAM;IAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CACjC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAC7E,CAAA;IACD,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,mBAAmB,CAC3B,YAAY,EACZ,yDAAyD,EACzD,GAAG,CACJ,CAAA;IACH,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,mCAAmC,CACjD,cAAgF;IAEhF,OAAO;QACL,KAAK,CAAC,eAAe,CAAC,OAAO;YAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC7C,OAAO,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAChD,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAO;YACvB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAC/C,OAAO,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAC/C,OAAO,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,OAAO;YAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAC/C,OAAO,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;QACzC,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK;YAC/B,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,CAAA;YACpE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YACpF,OAAO,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAC7C,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY;YAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAA;YACtD,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QACxD,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM;YAC9C,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpD,OAAO,EACP,OAAO,EACP,aAAa,EACb,QAAQ,CACT,CAAA;YACD,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;YAC9E,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvE,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YAC9C,CAAC;YACD,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC5D,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ;YACtC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAC7C,OAAO,EACP,OAAO,EACP,mBAAmB,EACnB,QAAQ,CACT,CAAA;YACD,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5C,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACpD,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ;YACpC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAA;YAClE,OAAO,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAClD,CAAC;KACF,CAAA;AACH,CAAC","sourcesContent":["import type {\n  CreatedTeamInvitationDto,\n  InviteTeamMemberInput,\n  TeamInvitationDto,\n  TeamManagementCapabilitiesDto,\n  TeamManagementRequestContext,\n  TeamManagementRuntimeProvider,\n  TeamMemberDto,\n  TeamRoleDto,\n} from \"./team-management-runtime-port.js\"\n\nexport type TeamManagementErrorCode =\n  | \"forbidden\"\n  | \"member_not_found\"\n  | \"role_not_found\"\n  | \"self_change_forbidden\"\n  | \"privilege_escalation\"\n  | \"last_owner\"\n  | \"activation_unavailable\"\n  | \"not_configured\"\n\nexport class TeamManagementError extends Error {\n  constructor(\n    readonly code: TeamManagementErrorCode,\n    message: string,\n    readonly status: 400 | 403 | 404 | 409 | 501 = 403,\n  ) {\n    super(message)\n    this.name = \"TeamManagementError\"\n  }\n}\n\nexport interface TeamManagementActor {\n  memberId: string\n  roleId: string\n}\n\nexport interface TeamManagementAdapter {\n  getActor(context: TeamManagementRequestContext): Promise<TeamManagementActor>\n  getCapabilities(\n    context: TeamManagementRequestContext,\n    actor: TeamManagementActor,\n  ): Promise<TeamManagementCapabilitiesDto>\n  listMembers(context: TeamManagementRequestContext): Promise<TeamMemberDto[]>\n  listRoles(context: TeamManagementRequestContext): Promise<TeamRoleDto[]>\n  listInvitations(context: TeamManagementRequestContext): Promise<TeamInvitationDto[]>\n  inviteMember(\n    context: TeamManagementRequestContext,\n    input: InviteTeamMemberInput,\n  ): Promise<CreatedTeamInvitationDto>\n  revokeInvitation(context: TeamManagementRequestContext, invitationId: string): Promise<void>\n  updateMemberRole(\n    context: TeamManagementRequestContext,\n    memberId: string,\n    roleId: string,\n  ): Promise<TeamMemberDto>\n  activateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>\n  deactivateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>\n  roleLevel(roleId: string): number\n  isOwnerRole(roleId: string): boolean\n}\n\ntype Capability = keyof TeamManagementCapabilitiesDto\n\nfunction requireCapability(capabilities: TeamManagementCapabilitiesDto, capability: Capability) {\n  if (!capabilities[capability]) {\n    throw new TeamManagementError(\"forbidden\", \"This team-management action is not allowed.\")\n  }\n}\n\nasync function authorize(\n  adapter: TeamManagementAdapter,\n  context: TeamManagementRequestContext,\n  capability: Capability,\n) {\n  const actor = await adapter.getActor(context)\n  const capabilities = await adapter.getCapabilities(context, actor)\n  requireCapability(capabilities, capability)\n  return { actor, capabilities }\n}\n\nasync function mutationState(\n  adapter: TeamManagementAdapter,\n  context: TeamManagementRequestContext,\n  capability: Capability,\n  memberId: string,\n) {\n  const { actor } = await authorize(adapter, context, capability)\n  const members = await adapter.listMembers(context)\n  const target = members.find((member) => member.id === memberId)\n  if (!target) {\n    throw new TeamManagementError(\"member_not_found\", \"Team member not found.\", 404)\n  }\n  if (target.id === actor.memberId) {\n    throw new TeamManagementError(\n      \"self_change_forbidden\",\n      \"You cannot change your own role or access.\",\n      409,\n    )\n  }\n  if (adapter.roleLevel(target.roleId) > adapter.roleLevel(actor.roleId)) {\n    throw new TeamManagementError(\n      \"privilege_escalation\",\n      \"You cannot manage a member with a more privileged role.\",\n    )\n  }\n  return { actor, members, target }\n}\n\nfunction assertAssignableRole(\n  adapter: TeamManagementAdapter,\n  actor: TeamManagementActor,\n  roles: TeamRoleDto[],\n  roleId: string,\n) {\n  if (!roles.some((role) => role.id === roleId)) {\n    throw new TeamManagementError(\"role_not_found\", \"Team role not found.\", 404)\n  }\n  if (adapter.roleLevel(roleId) > adapter.roleLevel(actor.roleId)) {\n    throw new TeamManagementError(\n      \"privilege_escalation\",\n      \"You cannot assign a role above your own privilege level.\",\n    )\n  }\n}\n\nfunction assertOwnerRemains(\n  adapter: TeamManagementAdapter,\n  members: TeamMemberDto[],\n  target: TeamMemberDto,\n) {\n  if (!adapter.isOwnerRole(target.roleId)) return\n  const activeOwners = members.filter(\n    (member) => member.status === \"active\" && adapter.isOwnerRole(member.roleId),\n  )\n  if (activeOwners.length <= 1) {\n    throw new TeamManagementError(\n      \"last_owner\",\n      \"The last active owner cannot be demoted or deactivated.\",\n      409,\n    )\n  }\n}\n\n/** Applies provider-neutral authorization and invariants before invoking an adapter. */\nexport function createGuardedTeamManagementProvider(\n  resolveAdapter: (context: TeamManagementRequestContext) => TeamManagementAdapter,\n): TeamManagementRuntimeProvider {\n  return {\n    async getCapabilities(context) {\n      const adapter = resolveAdapter(context)\n      const actor = await adapter.getActor(context)\n      return adapter.getCapabilities(context, actor)\n    },\n    async listMembers(context) {\n      const adapter = resolveAdapter(context)\n      await authorize(adapter, context, \"viewRoster\")\n      return adapter.listMembers(context)\n    },\n    async listRoles(context) {\n      const adapter = resolveAdapter(context)\n      await authorize(adapter, context, \"viewRoster\")\n      return adapter.listRoles(context)\n    },\n    async listInvitations(context) {\n      const adapter = resolveAdapter(context)\n      await authorize(adapter, context, \"viewRoster\")\n      return adapter.listInvitations(context)\n    },\n    async inviteMember(context, input) {\n      const adapter = resolveAdapter(context)\n      const { actor } = await authorize(adapter, context, \"inviteMembers\")\n      assertAssignableRole(adapter, actor, await adapter.listRoles(context), input.roleId)\n      return adapter.inviteMember(context, input)\n    },\n    async revokeInvitation(context, invitationId) {\n      const adapter = resolveAdapter(context)\n      await authorize(adapter, context, \"revokeInvitations\")\n      return adapter.revokeInvitation(context, invitationId)\n    },\n    async updateMemberRole(context, memberId, roleId) {\n      const adapter = resolveAdapter(context)\n      const { actor, members, target } = await mutationState(\n        adapter,\n        context,\n        \"manageRoles\",\n        memberId,\n      )\n      assertAssignableRole(adapter, actor, await adapter.listRoles(context), roleId)\n      if (adapter.isOwnerRole(target.roleId) && !adapter.isOwnerRole(roleId)) {\n        assertOwnerRemains(adapter, members, target)\n      }\n      return adapter.updateMemberRole(context, memberId, roleId)\n    },\n    async deactivateMember(context, memberId) {\n      const adapter = resolveAdapter(context)\n      const { members, target } = await mutationState(\n        adapter,\n        context,\n        \"deactivateMembers\",\n        memberId,\n      )\n      assertOwnerRemains(adapter, members, target)\n      return adapter.deactivateMember(context, memberId)\n    },\n    async activateMember(context, memberId) {\n      const adapter = resolveAdapter(context)\n      await mutationState(adapter, context, \"activateMembers\", memberId)\n      return adapter.activateMember(context, memberId)\n    },\n  }\n}\n"]}

package/dist/team-management-runtime-port.d.ts

@@ -0,0 +1,60 @@
+import type { VoyantDb } from "@voyant-travel/hono";
+export type TeamMemberStatus = "active" | "deactivated";
+export type TeamInvitationStatus = "pending" | "accepted" | "expired" | "revoked";
+export interface TeamMemberDto {
+    id: string;
+    email: string | null;
+    name: string | null;
+    roleId: string;
+    roleName: string;
+    status: TeamMemberStatus;
+    joinedAt: string | null;
+    lastActivityAt: string | null;
+}
+export interface TeamRoleDto {
+    id: string;
+    name: string;
+    description: string | null;
+}
+export interface TeamInvitationDto {
+    id: string;
+    email: string;
+    roleId: string;
+    roleName: string;
+    status: TeamInvitationStatus;
+    createdAt: string;
+    expiresAt: string;
+}
+export interface CreatedTeamInvitationDto extends TeamInvitationDto {
+    acceptUrl: string | null;
+}
+export interface TeamManagementCapabilitiesDto {
+    viewRoster: boolean;
+    inviteMembers: boolean;
+    manageRoles: boolean;
+    activateMembers: boolean;
+    deactivateMembers: boolean;
+    revokeInvitations: boolean;
+}
+export interface TeamManagementRequestContext {
+    bindings: Record<string, unknown>;
+    db: VoyantDb;
+    userId: string;
+}
+export interface InviteTeamMemberInput {
+    email: string;
+    roleId: string;
+    expiresInDays?: number;
+}
+export interface TeamManagementRuntimeProvider {
+    getCapabilities(context: TeamManagementRequestContext): Promise<TeamManagementCapabilitiesDto>;
+    listMembers(context: TeamManagementRequestContext): Promise<TeamMemberDto[]>;
+    listRoles(context: TeamManagementRequestContext): Promise<TeamRoleDto[]>;
+    listInvitations(context: TeamManagementRequestContext): Promise<TeamInvitationDto[]>;
+    inviteMember(context: TeamManagementRequestContext, input: InviteTeamMemberInput): Promise<CreatedTeamInvitationDto>;
+    revokeInvitation(context: TeamManagementRequestContext, invitationId: string): Promise<void>;
+    updateMemberRole(context: TeamManagementRequestContext, memberId: string, roleId: string): Promise<TeamMemberDto>;
+    activateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>;
+    deactivateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>;
+}
+export declare const teamManagementRuntimePort: import("@voyant-travel/core/project").VoyantPort<TeamManagementRuntimeProvider>;

package/dist/team-management-runtime-port.js

@@ -0,0 +1,25 @@
+import { definePort } from "@voyant-travel/core/project";
+export const teamManagementRuntimePort = definePort({
+    id: "auth.team-management-runtime",
+    test(provider) {
+        if (provider === null || typeof provider !== "object") {
+            throw new Error("auth.team-management-runtime provider must be an object.");
+        }
+        for (const method of [
+            "getCapabilities",
+            "listMembers",
+            "listRoles",
+            "listInvitations",
+            "inviteMember",
+            "revokeInvitation",
+            "updateMemberRole",
+            "activateMember",
+            "deactivateMember",
+        ]) {
+            if (typeof provider[method] !== "function") {
+                throw new Error(`auth.team-management-runtime provider must implement ${method}().`);
+            }
+        }
+    },
+});
+//# sourceMappingURL=team-management-runtime-port.js.map

package/dist/team-management-runtime-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-management-runtime-port.js","sourceRoot":"","sources":["../src/team-management-runtime-port.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AA6ExD,MAAM,CAAC,MAAM,yBAAyB,GAAG,UAAU,CAAgC;IACjF,EAAE,EAAE,8BAA8B;IAClC,IAAI,CAAC,QAAQ;QACX,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC7E,CAAC;QACD,KAAK,MAAM,MAAM,IAAI;YACnB,iBAAiB;YACjB,aAAa;YACb,WAAW;YACX,iBAAiB;YACjB,cAAc;YACd,kBAAkB;YAClB,kBAAkB;YAClB,gBAAgB;YAChB,kBAAkB;SACV,EAAE,CAAC;YACX,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,wDAAwD,MAAM,KAAK,CAAC,CAAA;YACtF,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC,CAAA","sourcesContent":["import { definePort } from \"@voyant-travel/core/project\"\nimport type { VoyantDb } from \"@voyant-travel/hono\"\n\nexport type TeamMemberStatus = \"active\" | \"deactivated\"\nexport type TeamInvitationStatus = \"pending\" | \"accepted\" | \"expired\" | \"revoked\"\n\nexport interface TeamMemberDto {\n  id: string\n  email: string | null\n  name: string | null\n  roleId: string\n  roleName: string\n  status: TeamMemberStatus\n  joinedAt: string | null\n  lastActivityAt: string | null\n}\n\nexport interface TeamRoleDto {\n  id: string\n  name: string\n  description: string | null\n}\n\nexport interface TeamInvitationDto {\n  id: string\n  email: string\n  roleId: string\n  roleName: string\n  status: TeamInvitationStatus\n  createdAt: string\n  expiresAt: string\n}\n\nexport interface CreatedTeamInvitationDto extends TeamInvitationDto {\n  acceptUrl: string | null\n}\n\nexport interface TeamManagementCapabilitiesDto {\n  viewRoster: boolean\n  inviteMembers: boolean\n  manageRoles: boolean\n  activateMembers: boolean\n  deactivateMembers: boolean\n  revokeInvitations: boolean\n}\n\nexport interface TeamManagementRequestContext {\n  bindings: Record<string, unknown>\n  db: VoyantDb\n  userId: string\n}\n\nexport interface InviteTeamMemberInput {\n  email: string\n  roleId: string\n  expiresInDays?: number\n}\n\nexport interface TeamManagementRuntimeProvider {\n  getCapabilities(context: TeamManagementRequestContext): Promise<TeamManagementCapabilitiesDto>\n  listMembers(context: TeamManagementRequestContext): Promise<TeamMemberDto[]>\n  listRoles(context: TeamManagementRequestContext): Promise<TeamRoleDto[]>\n  listInvitations(context: TeamManagementRequestContext): Promise<TeamInvitationDto[]>\n  inviteMember(\n    context: TeamManagementRequestContext,\n    input: InviteTeamMemberInput,\n  ): Promise<CreatedTeamInvitationDto>\n  revokeInvitation(context: TeamManagementRequestContext, invitationId: string): Promise<void>\n  updateMemberRole(\n    context: TeamManagementRequestContext,\n    memberId: string,\n    roleId: string,\n  ): Promise<TeamMemberDto>\n  activateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>\n  deactivateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>\n}\n\nexport const teamManagementRuntimePort = definePort<TeamManagementRuntimeProvider>({\n  id: \"auth.team-management-runtime\",\n  test(provider) {\n    if (provider === null || typeof provider !== \"object\") {\n      throw new Error(\"auth.team-management-runtime provider must be an object.\")\n    }\n    for (const method of [\n      \"getCapabilities\",\n      \"listMembers\",\n      \"listRoles\",\n      \"listInvitations\",\n      \"inviteMember\",\n      \"revokeInvitation\",\n      \"updateMemberRole\",\n      \"activateMember\",\n      \"deactivateMember\",\n    ] as const) {\n      if (typeof provider[method] !== \"function\") {\n        throw new Error(`auth.team-management-runtime provider must implement ${method}().`)\n      }\n    }\n  },\n})\n"]}

package/dist/team-routes.d.ts

@@ -1,12 +1,12 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { type VoyantDb } from "@voyant-travel/hono";
-import type { IdentityAccessRuntimeProvider } from "./identity-access-runtime-port.js";
-type IdentityAccessEnv = {
+import type { TeamManagementRuntimeProvider } from "./team-management-runtime-port.js";
+type TeamEnv = {
     Bindings: Record<string, unknown>;
     Variables: {
         userId?: string;
         db: VoyantDb;
     };
 };
-export declare function createTeamAdminRoutes(runtime: IdentityAccessRuntimeProvider): OpenAPIHono<IdentityAccessEnv, {}, "/">;
+export declare function createTeamAdminRoutes(runtime: TeamManagementRuntimeProvider): OpenAPIHono<TeamEnv, {}, "/">;
 export {};

package/dist/team-routes.js

@@ -1,17 +1,12 @@
 import { createRoute, OpenAPIHono, z } from "@hono/zod-openapi";
-import { cloudAuthUserLinks } from "@voyant-travel/db/schema/iam";
 import { openApiValidationHook, parseJsonBody } from "@voyant-travel/hono";
-import { eq } from "drizzle-orm";
-import { CloudAdminMembersError, inviteCloudAdminMember, listCloudAdminInvitations, listCloudAdminMemberRoles, listCloudAdminMembers, revokeCloudAdminInvitation, setCloudAdminMemberAccess, setCloudAdminMemberPermissions, } from "./cloud-broker.js";
+import { TeamManagementError } from "./team-management-policy.js";
 const inviteSchema = z.object({
     email: z.string().email(),
-    roleSlug: z.string().trim().min(1).max(120).optional().nullable(),
+    roleId: z.string().trim().min(1).max(120),
     expiresInDays: z.number().int().min(1).max(30).optional(),
 });
-const accessSchema = z.object({ hasAccess: z.boolean() });
-const permissionsSchema = z.object({
-    permissions: z.array(z.string().trim().min(1).max(120)).max(200),
-});
+const roleSchema = z.object({ roleId: z.string().trim().min(1).max(120) });
 const teamAdminApiId = "@voyant-travel/auth#team.api.admin";
 const jsonBody = (schema) => ({
     required: true,
@@ -26,185 +21,141 @@ const teamRoute = (config) => createRoute({
     ...(config.request ? { request: config.request } : {}),
     responses: responses(...config.statuses),
 });
+const capabilitiesRoute = teamRoute({
+    method: "get",
+    path: "/capabilities",
+    operationId: "getTeamManagementCapabilities",
+    statuses: [200, 401, 403, 501],
+});
 const listMembersRoute = teamRoute({
     method: "get",
     path: "/members",
     operationId: "listTeamMembers",
-    statuses: [200, 401, 403, 404, 501],
+    statuses: [200, 401, 403, 501],
 });
 const listRolesRoute = teamRoute({
     method: "get",
     path: "/roles",
     operationId: "listTeamRoles",
-    statuses: [200, 401, 403, 404, 501],
+    statuses: [200, 401, 403, 501],
 });
-const listTeamInvitationsRoute = teamRoute({
+const listInvitationsRoute = teamRoute({
     method: "get",
     path: "/invitations",
     operationId: "listTeamInvitations",
-    statuses: [200, 401, 403, 404, 501],
+    statuses: [200, 401, 403, 501],
 });
-const createTeamInvitationRoute = teamRoute({
+const createInvitationRoute = teamRoute({
     method: "post",
     path: "/invitations",
     operationId: "createTeamInvitation",
     request: { body: jsonBody(inviteSchema) },
-    statuses: [201, 400, 401, 403, 404, 501],
+    statuses: [201, 400, 401, 403, 404, 409, 501],
 });
-const revokeTeamInvitationRoute = teamRoute({
+const revokeInvitationRoute = teamRoute({
     method: "delete",
     path: "/invitations/{invitationId}",
     operationId: "revokeTeamInvitation",
     request: { params: z.object({ invitationId: z.string() }) },
     statuses: [204, 401, 403, 404, 501],
 });
-const setTeamMemberAccessRoute = teamRoute({
+const updateRoleRoute = teamRoute({
     method: "put",
-    path: "/members/{membershipId}/access",
-    operationId: "setTeamMemberAccess",
+    path: "/members/{memberId}/role",
+    operationId: "updateTeamMemberRole",
     request: {
-        params: z.object({ membershipId: z.string() }),
-        body: jsonBody(accessSchema),
+        params: z.object({ memberId: z.string() }),
+        body: jsonBody(roleSchema),
     },
-    statuses: [200, 400, 401, 403, 404, 501],
+    statuses: [200, 400, 401, 403, 404, 409, 501],
+});
+const deactivateMemberRoute = teamRoute({
+    method: "delete",
+    path: "/members/{memberId}",
+    operationId: "deactivateTeamMember",
+    request: { params: z.object({ memberId: z.string() }) },
+    statuses: [200, 401, 403, 404, 409, 501],
 });
-const setTeamMemberPermissionsRoute = teamRoute({
+const activateMemberRoute = teamRoute({
     method: "put",
-    path: "/members/{membershipId}/permissions",
-    operationId: "setTeamMemberPermissions",
-    request: {
-        params: z.object({ membershipId: z.string() }),
-        body: jsonBody(permissionsSchema),
-    },
-    statuses: [200, 400, 401, 403, 404, 501],
+    path: "/members/{memberId}/activation",
+    operationId: "activateTeamMember",
+    request: { params: z.object({ memberId: z.string() }) },
+    statuses: [200, 401, 403, 404, 409, 501],
 });
-async function resolveActingWorkosUserId(db, userId) {
-    const [link] = await db
-        .select({ providerAccountId: cloudAuthUserLinks.providerAccountId })
-        .from(cloudAuthUserLinks)
-        .where(eq(cloudAuthUserLinks.userId, userId))
-        .limit(1);
-    return link?.providerAccountId ?? null;
+function requestContext(c) {
+    const userId = c.get("userId");
+    if (!userId)
+        return c.json({ error: "Unauthorized" }, 401);
+    return { bindings: c.env, db: c.get("db"), userId };
+}
+function handleError(c, error) {
+    if (error instanceof TeamManagementError) {
+        return c.json({ error: error.message, code: error.code }, error.status);
+    }
+    if (error instanceof Error &&
+        "status" in error &&
+        typeof error.status === "number" &&
+        error.status >= 400 &&
+        error.status <= 599) {
+        return c.json({ error: error.message }, error.status);
+    }
+    throw error;
 }
 export function createTeamAdminRoutes(runtime) {
     const routes = new OpenAPIHono({ defaultHook: openApiValidationHook });
-    const resolveContext = async (c) => {
-        const deployment = runtime.resolveDeployment(c.env);
-        if (deployment.authMode !== "voyant-cloud")
-            return c.json({ error: "Not found" }, 404);
-        const userId = c.get("userId");
-        if (!userId)
-            return c.json({ error: "Unauthorized" }, 401);
-        if (!deployment.cloudAdminMembers) {
-            return c.json({ error: "Voyant Cloud member management is not configured" }, 501);
-        }
-        const actingWorkosUserId = await resolveActingWorkosUserId(c.get("db"), userId);
-        if (!actingWorkosUserId) {
-            return c.json({ error: "No Voyant Cloud identity for this session" }, 403);
-        }
-        return { config: deployment.cloudAdminMembers, actingWorkosUserId };
-    };
-    const handleError = (c, error) => {
-        if (error instanceof CloudAdminMembersError) {
-            return c.json({ error: error.reason ?? error.message }, error.status);
-        }
-        throw error;
-    };
-    routes.openapi(listMembersRoute, async (c) => {
-        const context = await resolveContext(c);
+    const run = async (c, operation) => {
+        const context = requestContext(c);
         if (context instanceof Response)
             return context;
         try {
-            return c.json({ data: await listCloudAdminMembers(context) });
+            return await operation(context);
         }
         catch (error) {
             return handleError(c, error);
         }
+    };
+    routes.openapi(capabilitiesRoute, async (c) => {
+        const result = await run(c, (context) => runtime.getCapabilities(context));
+        return result instanceof Response ? result : c.json({ data: result });
+    });
+    routes.openapi(listMembersRoute, async (c) => {
+        const result = await run(c, (context) => runtime.listMembers(context));
+        return result instanceof Response ? result : c.json({ data: result });
     });
     routes.openapi(listRolesRoute, async (c) => {
-        const context = await resolveContext(c);
-        if (context instanceof Response)
-            return context;
-        try {
-            return c.json({ data: await listCloudAdminMemberRoles(context) });
-        }
-        catch (error) {
-            return handleError(c, error);
-        }
+        const result = await run(c, (context) => runtime.listRoles(context));
+        return result instanceof Response ? result : c.json({ data: result });
     });
-    routes.openapi(listTeamInvitationsRoute, async (c) => {
-        const context = await resolveContext(c);
-        if (context instanceof Response)
-            return context;
-        try {
-            return c.json({ data: await listCloudAdminInvitations(context) });
-        }
-        catch (error) {
-            return handleError(c, error);
-        }
+    routes.openapi(listInvitationsRoute, async (c) => {
+        const result = await run(c, (context) => runtime.listInvitations(context));
+        return result instanceof Response ? result : c.json({ data: result });
     });
-    routes.openapi(createTeamInvitationRoute, async (c) => {
-        const context = await resolveContext(c);
-        if (context instanceof Response)
-            return context;
+    routes.openapi(createInvitationRoute, async (c) => {
         const input = await parseJsonBody(c, inviteSchema);
-        try {
-            return c.json({ data: await inviteCloudAdminMember({ ...context, input }) }, 201);
-        }
-        catch (error) {
-            return handleError(c, error);
-        }
+        const result = await run(c, (context) => runtime.inviteMember(context, input));
+        return result instanceof Response ? result : c.json({ data: result }, 201);
     });
-    routes.openapi(revokeTeamInvitationRoute, async (c) => {
-        const context = await resolveContext(c);
-        if (context instanceof Response)
-            return context;
-        try {
-            await revokeCloudAdminInvitation({
-                ...context,
-                invitationId: c.req.param("invitationId"),
-            });
-            return c.body(null, 204);
-        }
-        catch (error) {
-            return handleError(c, error);
-        }
+    routes.openapi(revokeInvitationRoute, async (c) => {
+        const { invitationId } = c.req.param();
+        const result = await run(c, (context) => runtime.revokeInvitation(context, invitationId));
+        return result instanceof Response ? result : c.body(null, 204);
     });
-    routes.openapi(setTeamMemberAccessRoute, async (c) => {
-        const context = await resolveContext(c);
-        if (context instanceof Response)
-            return context;
-        const input = await parseJsonBody(c, accessSchema);
-        try {
-            return c.json({
-                data: await setCloudAdminMemberAccess({
-                    ...context,
-                    membershipId: c.req.param("membershipId"),
-                    hasAccess: input.hasAccess,
-                }),
-            });
-        }
-        catch (error) {
-            return handleError(c, error);
-        }
+    routes.openapi(updateRoleRoute, async (c) => {
+        const { memberId } = c.req.param();
+        const input = await parseJsonBody(c, roleSchema);
+        const result = await run(c, (context) => runtime.updateMemberRole(context, memberId, input.roleId));
+        return result instanceof Response ? result : c.json({ data: result });
     });
-    routes.openapi(setTeamMemberPermissionsRoute, async (c) => {
-        const context = await resolveContext(c);
-        if (context instanceof Response)
-            return context;
-        const input = await parseJsonBody(c, permissionsSchema);
-        try {
-            return c.json({
-                data: await setCloudAdminMemberPermissions({
-                    ...context,
-                    membershipId: c.req.param("membershipId"),
-                    permissions: input.permissions,
-                }),
-            });
-        }
-        catch (error) {
-            return handleError(c, error);
-        }
+    routes.openapi(deactivateMemberRoute, async (c) => {
+        const { memberId } = c.req.param();
+        const result = await run(c, (context) => runtime.deactivateMember(context, memberId));
+        return result instanceof Response ? result : c.json({ data: result });
+    });
+    routes.openapi(activateMemberRoute, async (c) => {
+        const { memberId } = c.req.param();
+        const result = await run(c, (context) => runtime.activateMember(context, memberId));
+        return result instanceof Response ? result : c.json({ data: result });
     });
     return routes;
 }

package/dist/team-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"team-routes.js","sourceRoot":"","sources":["../src/team-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAiB,MAAM,qBAAqB,CAAA;AACzF,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAGhC,OAAO,EAEL,sBAAsB,EACtB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,mBAAmB,CAAA;AAU1B,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAA;AACF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AACzD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACjE,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,oCAAoC,CAAA;AAC3D,MAAM,QAAQ,GAAG,CAAyB,MAAS,EAAE,EAAE,CAAC,CAAC;IACvD,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE;CAC5C,CAAC,CAAA;AACF,MAAM,SAAS,GAAG,CAAC,GAAG,QAAkB,EAAE,EAAE,CAC1C,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;AAC3F,MAAM,SAAS,GAAG,CAAgE,MAMjF,EAAE,EAAE,CACH,WAAW,CAAC;IACV,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,WAAW,EAAE,MAAM,CAAC,WAAW;IAC/B,iBAAiB,EAAE,cAAc;IACjC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;CACzC,CAAC,CAAA;AAEJ,MAAM,gBAAgB,GAAG,SAAS,CAAC;IACjC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,iBAAiB;IAC9B,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,cAAc,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,eAAe;IAC5B,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,wBAAwB,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,qBAAqB;IAClC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,yBAAyB,GAAG,SAAS,CAAC;IAC1C,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,sBAAsB;IACnC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;IACzC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACzC,CAAC,CAAA;AACF,MAAM,yBAAyB,GAAG,SAAS,CAAC;IAC1C,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,sBAAsB;IACnC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;IAC3D,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,wBAAwB,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,gCAAgC;IACtC,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE;QACP,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC;KAC7B;IACD,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACzC,CAAC,CAAA;AACF,MAAM,6BAA6B,GAAG,SAAS,CAAC;IAC9C,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,qCAAqC;IAC3C,WAAW,EAAE,0BAA0B;IACvC,OAAO,EAAE;QACP,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC;KAClC;IACD,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACzC,CAAC,CAAA;AAEF,KAAK,UAAU,yBAAyB,CAAC,EAAY,EAAE,MAAc;IACnE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;SACnE,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC5C,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,OAAO,IAAI,EAAE,iBAAiB,IAAI,IAAI,CAAA;AACxC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAsC;IAC1E,MAAM,MAAM,GAAG,IAAI,WAAW,CAAoB,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAEzF,MAAM,cAAc,GAAG,KAAK,EAAE,CAAmB,EAAmC,EAAE;QACpF,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACnD,IAAI,UAAU,CAAC,QAAQ,KAAK,cAAc;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAEtF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QAC1D,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,GAAG,CAAC,CAAA;QACnF,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;QAC/E,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5E,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,CAAA;IACrE,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,CAAC,CAAmB,EAAE,KAAc,EAAY,EAAE;QACpE,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;YAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,MAAa,CAAC,CAAA;QAC9E,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;QAClD,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QACnF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,IAAI,CAAC;YACH,MAAM,0BAA0B,CAAC;gBAC/B,GAAG,OAAO;gBACV,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC;aAC1C,CAAC,CAAA;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;QAClD,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,MAAM,yBAAyB,CAAC;oBACpC,GAAG,OAAO;oBACV,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC;oBACzC,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC;aACH,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAA;QACvD,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,MAAM,8BAA8B,CAAC;oBACzC,GAAG,OAAO;oBACV,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC;oBACzC,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B,CAAC;aACH,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC","sourcesContent":["import { createRoute, OpenAPIHono, z } from \"@hono/zod-openapi\"\nimport { cloudAuthUserLinks } from \"@voyant-travel/db/schema/iam\"\nimport { openApiValidationHook, parseJsonBody, type VoyantDb } from \"@voyant-travel/hono\"\nimport { eq } from \"drizzle-orm\"\nimport type { Context } from \"hono\"\n\nimport {\n  type CloudAdminMembersConfig,\n  CloudAdminMembersError,\n  inviteCloudAdminMember,\n  listCloudAdminInvitations,\n  listCloudAdminMemberRoles,\n  listCloudAdminMembers,\n  revokeCloudAdminInvitation,\n  setCloudAdminMemberAccess,\n  setCloudAdminMemberPermissions,\n} from \"./cloud-broker.js\"\nimport type { IdentityAccessRuntimeProvider } from \"./identity-access-runtime-port.js\"\n\ntype IdentityAccessEnv = {\n  Bindings: Record<string, unknown>\n  Variables: { userId?: string; db: VoyantDb }\n}\ntype TeamContext = { config: CloudAdminMembersConfig; actingWorkosUserId: string }\ntype TeamRouteContext = Context<IdentityAccessEnv>\n\nconst inviteSchema = z.object({\n  email: z.string().email(),\n  roleSlug: z.string().trim().min(1).max(120).optional().nullable(),\n  expiresInDays: z.number().int().min(1).max(30).optional(),\n})\nconst accessSchema = z.object({ hasAccess: z.boolean() })\nconst permissionsSchema = z.object({\n  permissions: z.array(z.string().trim().min(1).max(120)).max(200),\n})\n\nconst teamAdminApiId = \"@voyant-travel/auth#team.api.admin\"\nconst jsonBody = <T extends z.ZodTypeAny>(schema: T) => ({\n  required: true,\n  content: { \"application/json\": { schema } },\n})\nconst responses = (...statuses: number[]) =>\n  Object.fromEntries(statuses.map((status) => [status, { description: `HTTP ${status}` }]))\nconst teamRoute = <M extends \"get\" | \"post\" | \"put\" | \"delete\", P extends string>(config: {\n  method: M\n  path: P\n  operationId: string\n  request?: Record<string, unknown>\n  statuses: number[]\n}) =>\n  createRoute({\n    method: config.method,\n    path: config.path,\n    operationId: config.operationId,\n    \"x-voyant-api-id\": teamAdminApiId,\n    ...(config.request ? { request: config.request } : {}),\n    responses: responses(...config.statuses),\n  })\n\nconst listMembersRoute = teamRoute({\n  method: \"get\",\n  path: \"/members\",\n  operationId: \"listTeamMembers\",\n  statuses: [200, 401, 403, 404, 501],\n})\nconst listRolesRoute = teamRoute({\n  method: \"get\",\n  path: \"/roles\",\n  operationId: \"listTeamRoles\",\n  statuses: [200, 401, 403, 404, 501],\n})\nconst listTeamInvitationsRoute = teamRoute({\n  method: \"get\",\n  path: \"/invitations\",\n  operationId: \"listTeamInvitations\",\n  statuses: [200, 401, 403, 404, 501],\n})\nconst createTeamInvitationRoute = teamRoute({\n  method: \"post\",\n  path: \"/invitations\",\n  operationId: \"createTeamInvitation\",\n  request: { body: jsonBody(inviteSchema) },\n  statuses: [201, 400, 401, 403, 404, 501],\n})\nconst revokeTeamInvitationRoute = teamRoute({\n  method: \"delete\",\n  path: \"/invitations/{invitationId}\",\n  operationId: \"revokeTeamInvitation\",\n  request: { params: z.object({ invitationId: z.string() }) },\n  statuses: [204, 401, 403, 404, 501],\n})\nconst setTeamMemberAccessRoute = teamRoute({\n  method: \"put\",\n  path: \"/members/{membershipId}/access\",\n  operationId: \"setTeamMemberAccess\",\n  request: {\n    params: z.object({ membershipId: z.string() }),\n    body: jsonBody(accessSchema),\n  },\n  statuses: [200, 400, 401, 403, 404, 501],\n})\nconst setTeamMemberPermissionsRoute = teamRoute({\n  method: \"put\",\n  path: \"/members/{membershipId}/permissions\",\n  operationId: \"setTeamMemberPermissions\",\n  request: {\n    params: z.object({ membershipId: z.string() }),\n    body: jsonBody(permissionsSchema),\n  },\n  statuses: [200, 400, 401, 403, 404, 501],\n})\n\nasync function resolveActingWorkosUserId(db: VoyantDb, userId: string): Promise<string | null> {\n  const [link] = await db\n    .select({ providerAccountId: cloudAuthUserLinks.providerAccountId })\n    .from(cloudAuthUserLinks)\n    .where(eq(cloudAuthUserLinks.userId, userId))\n    .limit(1)\n  return link?.providerAccountId ?? null\n}\n\nexport function createTeamAdminRoutes(runtime: IdentityAccessRuntimeProvider) {\n  const routes = new OpenAPIHono<IdentityAccessEnv>({ defaultHook: openApiValidationHook })\n\n  const resolveContext = async (c: TeamRouteContext): Promise<TeamContext | Response> => {\n    const deployment = runtime.resolveDeployment(c.env)\n    if (deployment.authMode !== \"voyant-cloud\") return c.json({ error: \"Not found\" }, 404)\n\n    const userId = c.get(\"userId\")\n    if (!userId) return c.json({ error: \"Unauthorized\" }, 401)\n    if (!deployment.cloudAdminMembers) {\n      return c.json({ error: \"Voyant Cloud member management is not configured\" }, 501)\n    }\n\n    const actingWorkosUserId = await resolveActingWorkosUserId(c.get(\"db\"), userId)\n    if (!actingWorkosUserId) {\n      return c.json({ error: \"No Voyant Cloud identity for this session\" }, 403)\n    }\n    return { config: deployment.cloudAdminMembers, actingWorkosUserId }\n  }\n\n  const handleError = (c: TeamRouteContext, error: unknown): Response => {\n    if (error instanceof CloudAdminMembersError) {\n      return c.json({ error: error.reason ?? error.message }, error.status as 403)\n    }\n    throw error\n  }\n\n  routes.openapi(listMembersRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    try {\n      return c.json({ data: await listCloudAdminMembers(context) })\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n  routes.openapi(listRolesRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    try {\n      return c.json({ data: await listCloudAdminMemberRoles(context) })\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n  routes.openapi(listTeamInvitationsRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    try {\n      return c.json({ data: await listCloudAdminInvitations(context) })\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n  routes.openapi(createTeamInvitationRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    const input = await parseJsonBody(c, inviteSchema)\n    try {\n      return c.json({ data: await inviteCloudAdminMember({ ...context, input }) }, 201)\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n  routes.openapi(revokeTeamInvitationRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    try {\n      await revokeCloudAdminInvitation({\n        ...context,\n        invitationId: c.req.param(\"invitationId\"),\n      })\n      return c.body(null, 204)\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n  routes.openapi(setTeamMemberAccessRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    const input = await parseJsonBody(c, accessSchema)\n    try {\n      return c.json({\n        data: await setCloudAdminMemberAccess({\n          ...context,\n          membershipId: c.req.param(\"membershipId\"),\n          hasAccess: input.hasAccess,\n        }),\n      })\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n  routes.openapi(setTeamMemberPermissionsRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    const input = await parseJsonBody(c, permissionsSchema)\n    try {\n      return c.json({\n        data: await setCloudAdminMemberPermissions({\n          ...context,\n          membershipId: c.req.param(\"membershipId\"),\n          permissions: input.permissions,\n        }),\n      })\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n\n  return routes\n}\n"]}
+{"version":3,"file":"team-routes.js","sourceRoot":"","sources":["../src/team-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAiB,MAAM,qBAAqB,CAAA;AAGzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAYjE,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAA;AACF,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AAE1E,MAAM,cAAc,GAAG,oCAAoC,CAAA;AAC3D,MAAM,QAAQ,GAAG,CAAyB,MAAS,EAAE,EAAE,CAAC,CAAC;IACvD,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE;CAC5C,CAAC,CAAA;AACF,MAAM,SAAS,GAAG,CAAC,GAAG,QAAkB,EAAE,EAAE,CAC1C,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;AAC3F,MAAM,SAAS,GAAG,CAAgE,MAMjF,EAAE,EAAE,CACH,WAAW,CAAC;IACV,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,WAAW,EAAE,MAAM,CAAC,WAAW;IAC/B,iBAAiB,EAAE,cAAc;IACjC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;CACzC,CAAC,CAAA;AAEJ,MAAM,iBAAiB,GAAG,SAAS,CAAC;IAClC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,+BAA+B;IAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,gBAAgB,GAAG,SAAS,CAAC;IACjC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,iBAAiB;IAC9B,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,cAAc,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,eAAe;IAC5B,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,oBAAoB,GAAG,SAAS,CAAC;IACrC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,qBAAqB;IAClC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,qBAAqB,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,sBAAsB;IACnC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;IACzC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC9C,CAAC,CAAA;AACF,MAAM,qBAAqB,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,sBAAsB;IACnC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;IAC3D,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,eAAe,GAAG,SAAS,CAAC;IAChC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,sBAAsB;IACnC,OAAO,EAAE;QACP,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC;KAC3B;IACD,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC9C,CAAC,CAAA;AACF,MAAM,qBAAqB,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,sBAAsB;IACnC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;IACvD,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACzC,CAAC,CAAA;AACF,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACpC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,gCAAgC;IACtC,WAAW,EAAE,oBAAoB;IACjC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;IACvD,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACzC,CAAC,CAAA;AAEF,SAAS,cAAc,CAAC,CAAmB;IACzC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;IAC1D,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,CAAmB,EAAE,KAAc;IACtD,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACzE,CAAC;IACD,IACE,KAAK,YAAY,KAAK;QACtB,QAAQ,IAAI,KAAK;QACjB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,KAAK,CAAC,MAAM,IAAI,GAAG,EACnB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,MAAa,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,KAAK,CAAA;AACb,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAsC;IAC1E,MAAM,MAAM,GAAG,IAAI,WAAW,CAAU,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAE/E,MAAM,GAAG,GAAG,KAAK,EACf,CAAmB,EACnB,SAAgE,EACzC,EAAE;QACzB,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QACjC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QAC1E,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA;QACtE,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QACpE,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QAC1E,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;QAC9E,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACzF,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CACtC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAC1D,CAAA;QACD,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;QACrF,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;QACnF,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC","sourcesContent":["import { createRoute, OpenAPIHono, z } from \"@hono/zod-openapi\"\nimport { openApiValidationHook, parseJsonBody, type VoyantDb } from \"@voyant-travel/hono\"\nimport type { Context } from \"hono\"\n\nimport { TeamManagementError } from \"./team-management-policy.js\"\nimport type {\n  TeamManagementRequestContext,\n  TeamManagementRuntimeProvider,\n} from \"./team-management-runtime-port.js\"\n\ntype TeamEnv = {\n  Bindings: Record<string, unknown>\n  Variables: { userId?: string; db: VoyantDb }\n}\ntype TeamRouteContext = Context<TeamEnv>\n\nconst inviteSchema = z.object({\n  email: z.string().email(),\n  roleId: z.string().trim().min(1).max(120),\n  expiresInDays: z.number().int().min(1).max(30).optional(),\n})\nconst roleSchema = z.object({ roleId: z.string().trim().min(1).max(120) })\n\nconst teamAdminApiId = \"@voyant-travel/auth#team.api.admin\"\nconst jsonBody = <T extends z.ZodTypeAny>(schema: T) => ({\n  required: true,\n  content: { \"application/json\": { schema } },\n})\nconst responses = (...statuses: number[]) =>\n  Object.fromEntries(statuses.map((status) => [status, { description: `HTTP ${status}` }]))\nconst teamRoute = <M extends \"get\" | \"post\" | \"put\" | \"delete\", P extends string>(config: {\n  method: M\n  path: P\n  operationId: string\n  request?: Record<string, unknown>\n  statuses: number[]\n}) =>\n  createRoute({\n    method: config.method,\n    path: config.path,\n    operationId: config.operationId,\n    \"x-voyant-api-id\": teamAdminApiId,\n    ...(config.request ? { request: config.request } : {}),\n    responses: responses(...config.statuses),\n  })\n\nconst capabilitiesRoute = teamRoute({\n  method: \"get\",\n  path: \"/capabilities\",\n  operationId: \"getTeamManagementCapabilities\",\n  statuses: [200, 401, 403, 501],\n})\nconst listMembersRoute = teamRoute({\n  method: \"get\",\n  path: \"/members\",\n  operationId: \"listTeamMembers\",\n  statuses: [200, 401, 403, 501],\n})\nconst listRolesRoute = teamRoute({\n  method: \"get\",\n  path: \"/roles\",\n  operationId: \"listTeamRoles\",\n  statuses: [200, 401, 403, 501],\n})\nconst listInvitationsRoute = teamRoute({\n  method: \"get\",\n  path: \"/invitations\",\n  operationId: \"listTeamInvitations\",\n  statuses: [200, 401, 403, 501],\n})\nconst createInvitationRoute = teamRoute({\n  method: \"post\",\n  path: \"/invitations\",\n  operationId: \"createTeamInvitation\",\n  request: { body: jsonBody(inviteSchema) },\n  statuses: [201, 400, 401, 403, 404, 409, 501],\n})\nconst revokeInvitationRoute = teamRoute({\n  method: \"delete\",\n  path: \"/invitations/{invitationId}\",\n  operationId: \"revokeTeamInvitation\",\n  request: { params: z.object({ invitationId: z.string() }) },\n  statuses: [204, 401, 403, 404, 501],\n})\nconst updateRoleRoute = teamRoute({\n  method: \"put\",\n  path: \"/members/{memberId}/role\",\n  operationId: \"updateTeamMemberRole\",\n  request: {\n    params: z.object({ memberId: z.string() }),\n    body: jsonBody(roleSchema),\n  },\n  statuses: [200, 400, 401, 403, 404, 409, 501],\n})\nconst deactivateMemberRoute = teamRoute({\n  method: \"delete\",\n  path: \"/members/{memberId}\",\n  operationId: \"deactivateTeamMember\",\n  request: { params: z.object({ memberId: z.string() }) },\n  statuses: [200, 401, 403, 404, 409, 501],\n})\nconst activateMemberRoute = teamRoute({\n  method: \"put\",\n  path: \"/members/{memberId}/activation\",\n  operationId: \"activateTeamMember\",\n  request: { params: z.object({ memberId: z.string() }) },\n  statuses: [200, 401, 403, 404, 409, 501],\n})\n\nfunction requestContext(c: TeamRouteContext): TeamManagementRequestContext | Response {\n  const userId = c.get(\"userId\")\n  if (!userId) return c.json({ error: \"Unauthorized\" }, 401)\n  return { bindings: c.env, db: c.get(\"db\"), userId }\n}\n\nfunction handleError(c: TeamRouteContext, error: unknown): Response {\n  if (error instanceof TeamManagementError) {\n    return c.json({ error: error.message, code: error.code }, error.status)\n  }\n  if (\n    error instanceof Error &&\n    \"status\" in error &&\n    typeof error.status === \"number\" &&\n    error.status >= 400 &&\n    error.status <= 599\n  ) {\n    return c.json({ error: error.message }, error.status as 400)\n  }\n  throw error\n}\n\nexport function createTeamAdminRoutes(runtime: TeamManagementRuntimeProvider) {\n  const routes = new OpenAPIHono<TeamEnv>({ defaultHook: openApiValidationHook })\n\n  const run = async <T>(\n    c: TeamRouteContext,\n    operation: (context: TeamManagementRequestContext) => Promise<T>,\n  ): Promise<T | Response> => {\n    const context = requestContext(c)\n    if (context instanceof Response) return context\n    try {\n      return await operation(context)\n    } catch (error) {\n      return handleError(c, error)\n    }\n  }\n\n  routes.openapi(capabilitiesRoute, async (c) => {\n    const result = await run(c, (context) => runtime.getCapabilities(context))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n  routes.openapi(listMembersRoute, async (c) => {\n    const result = await run(c, (context) => runtime.listMembers(context))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n  routes.openapi(listRolesRoute, async (c) => {\n    const result = await run(c, (context) => runtime.listRoles(context))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n  routes.openapi(listInvitationsRoute, async (c) => {\n    const result = await run(c, (context) => runtime.listInvitations(context))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n  routes.openapi(createInvitationRoute, async (c) => {\n    const input = await parseJsonBody(c, inviteSchema)\n    const result = await run(c, (context) => runtime.inviteMember(context, input))\n    return result instanceof Response ? result : c.json({ data: result }, 201)\n  })\n  routes.openapi(revokeInvitationRoute, async (c) => {\n    const { invitationId } = c.req.param()\n    const result = await run(c, (context) => runtime.revokeInvitation(context, invitationId))\n    return result instanceof Response ? result : c.body(null, 204)\n  })\n  routes.openapi(updateRoleRoute, async (c) => {\n    const { memberId } = c.req.param()\n    const input = await parseJsonBody(c, roleSchema)\n    const result = await run(c, (context) =>\n      runtime.updateMemberRole(context, memberId, input.roleId),\n    )\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n  routes.openapi(deactivateMemberRoute, async (c) => {\n    const { memberId } = c.req.param()\n    const result = await run(c, (context) => runtime.deactivateMember(context, memberId))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n  routes.openapi(activateMemberRoute, async (c) => {\n    const { memberId } = c.req.param()\n    const result = await run(c, (context) => runtime.activateMember(context, memberId))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n\n  return routes\n}\n"]}