@voyant-travel/auth 0.129.0 → 0.131.0

package/dist/team-management-local-adapter.js

@@ -0,0 +1,285 @@
+import { newId } from "@voyant-travel/db/lib/typeid";
+import { apikeyTable, authAccount, authSession, authUser, userInvitationsTable, userProfilesTable, } from "@voyant-travel/db/schema/iam";
+import { scopesForRole } from "@voyant-travel/types/member-roles";
+import { desc, eq, sql } from "drizzle-orm";
+import { isDeactivatedProviderId, localProviderIdForStatus } from "./local-member-access.js";
+import { TeamManagementError } from "./team-management-policy.js";
+const LOCAL_ROLES = [
+    { id: "owner", name: "Owner", description: "Full access, including ownership changes." },
+    { id: "admin", name: "Admin", description: "Full access to team and operator settings." },
+    { id: "editor", name: "Editor", description: "Can manage day-to-day operator data." },
+    { id: "viewer", name: "Viewer", description: "Read-only operator access." },
+];
+const ROLE_LEVELS = { owner: 40, admin: 30, editor: 20, viewer: 10 };
+export { localProviderIdForStatus } from "./local-member-access.js";
+function roleName(roleId) {
+    return LOCAL_ROLES.find((role) => role.id === roleId)?.name ?? roleId;
+}
+function sameScopes(left, right) {
+    return [...left].sort().join("\0") === [...right].sort().join("\0");
+}
+function resolveLocalRole(isSuperAdmin, permissions) {
+    if (isSuperAdmin)
+        return "owner";
+    if (permissions === null || permissions.includes("*"))
+        return "admin";
+    if (sameScopes(permissions, scopesForRole("editor") ?? []))
+        return "editor";
+    if (sameScopes(permissions, scopesForRole("viewer") ?? []))
+        return "viewer";
+    return "custom";
+}
+function permissionsForRole(roleId) {
+    const scopes = scopesForRole(roleId);
+    if (!scopes)
+        throw new TeamManagementError("role_not_found", "Team role not found.", 404);
+    return [...scopes];
+}
+function invitationRole(metadata) {
+    const roleId = metadata?.roleId;
+    return typeof roleId === "string" && ROLE_LEVELS[roleId] !== undefined ? roleId : "editor";
+}
+function invitationStatus(input) {
+    if (input.redeemedAt)
+        return "accepted";
+    if (input.expiresAt.getTime() <= Date.now())
+        return "expired";
+    return "pending";
+}
+function randomTokenBase64Url(bytes) {
+    const buffer = new Uint8Array(bytes);
+    crypto.getRandomValues(buffer);
+    let binary = "";
+    for (const byte of buffer)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function sha256Hex(input) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+    return Array.from(new Uint8Array(digest))
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
+async function listLocalMembers(context) {
+    const [rows, accounts] = await Promise.all([
+        context.db
+            .select({
+            id: authUser.id,
+            email: authUser.email,
+            authName: authUser.name,
+            createdAt: authUser.createdAt,
+            firstName: userProfilesTable.firstName,
+            lastName: userProfilesTable.lastName,
+            isSuperAdmin: userProfilesTable.isSuperAdmin,
+            permissions: userProfilesTable.permissions,
+            lastActiveAt: userProfilesTable.lastActiveAt,
+        })
+            .from(authUser)
+            .leftJoin(userProfilesTable, eq(userProfilesTable.id, authUser.id)),
+        context.db
+            .select({ userId: authAccount.userId, providerId: authAccount.providerId })
+            .from(authAccount),
+    ]);
+    const activeUserIds = new Set(accounts
+        .filter((account) => !isDeactivatedProviderId(account.providerId))
+        .map((account) => account.userId));
+    return rows.map((row) => {
+        const roleId = resolveLocalRole(row.isSuperAdmin ?? false, row.permissions ?? null);
+        const profileName = [row.firstName, row.lastName].filter(Boolean).join(" ").trim();
+        return {
+            id: row.id,
+            email: row.email,
+            name: profileName || row.authName || null,
+            roleId,
+            roleName: roleName(roleId),
+            status: activeUserIds.has(row.id) ? "active" : "deactivated",
+            joinedAt: row.createdAt?.toISOString() ?? null,
+            lastActivityAt: row.lastActiveAt?.toISOString() ?? null,
+        };
+    });
+}
+function memberOrThrow(members, memberId) {
+    const member = members.find((candidate) => candidate.id === memberId);
+    if (!member)
+        throw new TeamManagementError("member_not_found", "Team member not found.", 404);
+    return member;
+}
+function assertActiveOwnerRemains(members, target) {
+    if (target.status !== "active" || target.roleId !== "owner")
+        return;
+    const activeOwnerCount = members.filter((member) => member.status === "active" && member.roleId === "owner").length;
+    if (activeOwnerCount <= 1) {
+        throw new TeamManagementError("last_owner", "The last active owner cannot be demoted or deactivated.", 409);
+    }
+}
+async function withLockedLocalTeam(context, operation) {
+    return context.db.transaction(async (transaction) => {
+        // agent-quality: raw-sql reviewed -- owner: auth; table identifiers are static Drizzle schema objects.
+        await transaction.execute(sql `SELECT ${authUser.id} FROM ${authUser} ORDER BY ${authUser.id} FOR UPDATE`);
+        return operation({ ...context, db: transaction });
+    });
+}
+export function createLocalTeamManagementAdapter(identityAccess) {
+    return {
+        async getActor(context) {
+            const actor = (await listLocalMembers(context)).find((member) => member.id === context.userId);
+            if (actor?.status !== "active") {
+                throw new TeamManagementError("forbidden", "The current user cannot manage this team.");
+            }
+            return { memberId: actor.id, roleId: actor.roleId };
+        },
+        async getCapabilities(_context, actor) {
+            const canManage = actor.roleId === "owner" || actor.roleId === "admin";
+            return {
+                viewRoster: true,
+                inviteMembers: canManage,
+                manageRoles: canManage,
+                activateMembers: canManage,
+                deactivateMembers: canManage,
+                revokeInvitations: canManage,
+            };
+        },
+        listMembers: listLocalMembers,
+        async listRoles() {
+            return LOCAL_ROLES;
+        },
+        async listInvitations(context) {
+            const rows = await context.db
+                .select({
+                id: userInvitationsTable.id,
+                email: userInvitationsTable.email,
+                metadata: userInvitationsTable.metadata,
+                expiresAt: userInvitationsTable.expiresAt,
+                redeemedAt: userInvitationsTable.redeemedAt,
+                createdAt: userInvitationsTable.createdAt,
+            })
+                .from(userInvitationsTable)
+                .orderBy(desc(userInvitationsTable.createdAt))
+                .limit(100);
+            return rows.map((row) => {
+                const roleId = invitationRole(row.metadata);
+                return {
+                    id: row.id,
+                    email: row.email,
+                    roleId,
+                    roleName: roleName(roleId),
+                    status: invitationStatus(row),
+                    createdAt: row.createdAt.toISOString(),
+                    expiresAt: row.expiresAt.toISOString(),
+                };
+            });
+        },
+        async inviteMember(context, input) {
+            const email = input.email.trim().toLowerCase();
+            const [existingUser] = await context.db
+                .select({ id: authUser.id })
+                .from(authUser)
+                .where(eq(authUser.email, email))
+                .limit(1);
+            if (existingUser) {
+                throw new TeamManagementError("forbidden", "A team member with this email already exists.", 409);
+            }
+            const rawToken = randomTokenBase64Url(32);
+            const expiresInDays = input.expiresInDays ?? 3;
+            const expiresAt = new Date(Date.now() + expiresInDays * 86_400_000);
+            const now = new Date();
+            const id = newId("user_invitations");
+            await context.db.insert(userInvitationsTable).values({
+                id,
+                email,
+                tokenHash: await sha256Hex(rawToken),
+                expiresAt,
+                createdBy: context.userId,
+                metadata: { roleId: input.roleId },
+                createdAt: now,
+            });
+            const { appUrl } = identityAccess.resolveDeployment(context.bindings);
+            const acceptUrl = `${appUrl}/accept-invite?token=${encodeURIComponent(rawToken)}`;
+            await identityAccess.sendInvitationEmail(context.bindings, {
+                acceptUrl,
+                expiresInHours: expiresInDays * 24,
+                to: email,
+            });
+            return {
+                id,
+                email,
+                roleId: input.roleId,
+                roleName: roleName(input.roleId),
+                status: "pending",
+                createdAt: now.toISOString(),
+                expiresAt: expiresAt.toISOString(),
+                acceptUrl,
+            };
+        },
+        async revokeInvitation(context, invitationId) {
+            await context.db.delete(userInvitationsTable).where(eq(userInvitationsTable.id, invitationId));
+        },
+        async updateMemberRole(context, memberId, roleId) {
+            return withLockedLocalTeam(context, async (transactionContext) => {
+                const members = await listLocalMembers(transactionContext);
+                const target = memberOrThrow(members, memberId);
+                if (roleId !== "owner")
+                    assertActiveOwnerRemains(members, target);
+                await transactionContext.db
+                    .update(userProfilesTable)
+                    .set({
+                    isSuperAdmin: roleId === "owner",
+                    permissions: permissionsForRole(roleId),
+                    updatedAt: new Date(),
+                })
+                    .where(eq(userProfilesTable.id, memberId));
+                return memberOrThrow(await listLocalMembers(transactionContext), memberId);
+            });
+        },
+        async deactivateMember(context, memberId) {
+            return withLockedLocalTeam(context, async (transactionContext) => {
+                const members = await listLocalMembers(transactionContext);
+                assertActiveOwnerRemains(members, memberOrThrow(members, memberId));
+                await transactionContext.db.delete(authSession).where(eq(authSession.userId, memberId));
+                await transactionContext.db.delete(apikeyTable).where(eq(apikeyTable.referenceId, memberId));
+                const accounts = await transactionContext.db
+                    .select({ id: authAccount.id, providerId: authAccount.providerId })
+                    .from(authAccount)
+                    .where(eq(authAccount.userId, memberId));
+                for (const account of accounts) {
+                    await transactionContext.db
+                        .update(authAccount)
+                        .set({ providerId: localProviderIdForStatus(account.providerId, "deactivated") })
+                        .where(eq(authAccount.id, account.id));
+                }
+                return memberOrThrow(await listLocalMembers(transactionContext), memberId);
+            });
+        },
+        async activateMember(context, memberId) {
+            return withLockedLocalTeam(context, async (transactionContext) => {
+                memberOrThrow(await listLocalMembers(transactionContext), memberId);
+                const accounts = await transactionContext.db
+                    .select({ id: authAccount.id, providerId: authAccount.providerId })
+                    .from(authAccount)
+                    .where(eq(authAccount.userId, memberId));
+                for (const account of accounts) {
+                    await transactionContext.db
+                        .update(authAccount)
+                        .set({ providerId: localProviderIdForStatus(account.providerId, "active") })
+                        .where(eq(authAccount.id, account.id));
+                }
+                const member = memberOrThrow(await listLocalMembers(transactionContext), memberId);
+                if (member.status !== "active") {
+                    throw new TeamManagementError("activation_unavailable", "This local member has no sign-in account to reactivate.", 409);
+                }
+                return member;
+            });
+        },
+        roleLevel(roleId) {
+            return ROLE_LEVELS[roleId] ?? 0;
+        },
+        isOwnerRole(roleId) {
+            return roleId === "owner";
+        },
+    };
+}
+export function localRoleForRedeemedInvitation(metadata) {
+    const roleId = invitationRole(metadata);
+    return { isSuperAdmin: roleId === "owner", permissions: permissionsForRole(roleId) };
+}
+//# sourceMappingURL=team-management-local-adapter.js.map

package/dist/team-management-local-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-management-local-adapter.js","sourceRoot":"","sources":["../src/team-management-local-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACpD,OAAO,EACL,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAG3C,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AAC5F,OAAO,EAA8B,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAW7F,MAAM,WAAW,GAAkB;IACjC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,2CAA2C,EAAE;IACxF,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,4CAA4C,EAAE;IACzF,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;IACrF,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE;CAC5E,CAAA;AAED,MAAM,WAAW,GAA2B,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;AAe5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,IAAI,MAAM,CAAA;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,IAAuB,EAAE,KAAwB;IACnE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,gBAAgB,CAAC,YAAqB,EAAE,WAA4B;IAC3E,IAAI,YAAY;QAAE,OAAO,OAAO,CAAA;IAChC,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAA;IACrE,IAAI,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC3E,IAAI,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC3E,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;IACzF,OAAO,CAAC,GAAG,MAAM,CAAC,CAAA;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,QAAwC;IAC9D,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAA;IAC/B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC5F,CAAC;AAED,SAAS,gBAAgB,CAAC,KAGzB;IACC,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,UAAU,CAAA;IACvC,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAA;IAC7D,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACpC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IAC9B,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACrF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAgC;IAC9D,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,OAAO,CAAC,EAAE;aACP,MAAM,CAAC;YACN,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,iBAAiB,CAAC,SAAS;YACtC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;YACpC,YAAY,EAAE,iBAAiB,CAAC,YAAY;YAC5C,WAAW,EAAE,iBAAiB,CAAC,WAAW;YAC1C,YAAY,EAAE,iBAAiB,CAAC,YAAY;SAC7C,CAAC;aACD,IAAI,CAAC,QAAQ,CAAC;aACd,QAAQ,CAAC,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,EAAE;aACP,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC;aAC1E,IAAI,CAAC,WAAW,CAAC;KACrB,CAAC,CAAA;IACF,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,QAAQ;SACL,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SACjE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CACpC,CAAA;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;QACnF,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QAClF,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,WAAW,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI;YACzC,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC;YAC1B,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa;YAC5D,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;YAC9C,cAAc,EAAE,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,IAAI;SACxD,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAwB,EAAE,QAAgB;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAA;IACrE,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAA;IAC7F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAwB,EAAE,MAAqB;IAC/E,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;QAAE,OAAM;IACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CACpE,CAAC,MAAM,CAAA;IACR,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,mBAAmB,CAC3B,YAAY,EACZ,yDAAyD,EACzD,GAAG,CACJ,CAAA;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAqC,EACrC,SAAsE;IAEtE,OAAO,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;QAClD,uGAAuG;QACvG,MAAM,WAAW,CAAC,OAAO,CACvB,GAAG,CAAA,UAAU,QAAQ,CAAC,EAAE,SAAS,QAAQ,aAAa,QAAQ,CAAC,EAAE,aAAa,CAC/E,CAAA;QACD,OAAO,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,cAA6C;IAE7C,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,OAAO;YACpB,MAAM,KAAK,GAAG,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;YAC9F,IAAI,KAAK,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAE,2CAA2C,CAAC,CAAA;YACzF,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;QACrD,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK;YACnC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAA;YACtE,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,SAAS;gBACxB,WAAW,EAAE,SAAS;gBACtB,eAAe,EAAE,SAAS;gBAC1B,iBAAiB,EAAE,SAAS;gBAC5B,iBAAiB,EAAE,SAAS;aAC7B,CAAA;QACH,CAAC;QACD,WAAW,EAAE,gBAAgB;QAC7B,KAAK,CAAC,SAAS;YACb,OAAO,WAAW,CAAA;QACpB,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,OAAO;YAC3B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE;iBAC1B,MAAM,CAAC;gBACN,EAAE,EAAE,oBAAoB,CAAC,EAAE;gBAC3B,KAAK,EAAE,oBAAoB,CAAC,KAAK;gBACjC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ;gBACvC,SAAS,EAAE,oBAAoB,CAAC,SAAS;gBACzC,UAAU,EAAE,oBAAoB,CAAC,UAAU;gBAC3C,SAAS,EAAE,oBAAoB,CAAC,SAAS;aAC1C,CAAC;iBACD,IAAI,CAAC,oBAAoB,CAAC;iBAC1B,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;iBAC7C,KAAK,CAAC,GAAG,CAAC,CAAA;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACtB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBAC3C,OAAO;oBACL,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,MAAM;oBACN,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC;oBAC1B,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC;oBAC7B,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;oBACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;iBACvC,CAAA;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,KAA4B;YACtD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAC9C,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;iBACpC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;iBAC3B,IAAI,CAAC,QAAQ,CAAC;iBACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;iBAChC,KAAK,CAAC,CAAC,CAAC,CAAA;YACX,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,mBAAmB,CAC3B,WAAW,EACX,+CAA+C,EAC/C,GAAG,CACJ,CAAA;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;YACzC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,CAAC,CAAA;YAC9C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,UAAU,CAAC,CAAA;YACnE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;YACtB,MAAM,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACpC,MAAM,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC;gBACnD,EAAE;gBACF,KAAK;gBACL,SAAS,EAAE,MAAM,SAAS,CAAC,QAAQ,CAAC;gBACpC,SAAS;gBACT,SAAS,EAAE,OAAO,CAAC,MAAM;gBACzB,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;gBAClC,SAAS,EAAE,GAAG;aACf,CAAC,CAAA;YAEF,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACrE,MAAM,SAAS,GAAG,GAAG,MAAM,wBAAwB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAA;YACjF,MAAM,cAAc,CAAC,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE;gBACzD,SAAS;gBACT,cAAc,EAAE,aAAa,GAAG,EAAE;gBAClC,EAAE,EAAE,KAAK;aACV,CAAC,CAAA;YACF,OAAO;gBACL,EAAE;gBACF,KAAK;gBACL,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChC,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;gBAClC,SAAS;aACV,CAAA;QACH,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY;YAC1C,MAAM,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAA;QAChG,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM;YAC9C,OAAO,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE;gBAC/D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,kBAAkB,CAAC,CAAA;gBAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;gBAC/C,IAAI,MAAM,KAAK,OAAO;oBAAE,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAEjE,MAAM,kBAAkB,CAAC,EAAE;qBACxB,MAAM,CAAC,iBAAiB,CAAC;qBACzB,GAAG,CAAC;oBACH,YAAY,EAAE,MAAM,KAAK,OAAO;oBAChC,WAAW,EAAE,kBAAkB,CAAC,MAAM,CAAC;oBACvC,SAAS,EAAE,IAAI,IAAI,EAAE;iBACtB,CAAC;qBACD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAA;gBAC5C,OAAO,aAAa,CAAC,MAAM,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,CAAA;YAC5E,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ;YACtC,OAAO,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE;gBAC/D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,kBAAkB,CAAC,CAAA;gBAC1D,wBAAwB,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;gBAEnE,MAAM,kBAAkB,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;gBACvF,MAAM,kBAAkB,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAA;gBAC5F,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE;qBACzC,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC;qBAClE,IAAI,CAAC,WAAW,CAAC;qBACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;gBAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,MAAM,kBAAkB,CAAC,EAAE;yBACxB,MAAM,CAAC,WAAW,CAAC;yBACnB,GAAG,CAAC,EAAE,UAAU,EAAE,wBAAwB,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;yBAChF,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;gBAC1C,CAAC;gBACD,OAAO,aAAa,CAAC,MAAM,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,CAAA;YAC5E,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ;YACpC,OAAO,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE;gBAC/D,aAAa,CAAC,MAAM,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,CAAA;gBACnE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE;qBACzC,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC;qBAClE,IAAI,CAAC,WAAW,CAAC;qBACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;gBAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,MAAM,kBAAkB,CAAC,EAAE;yBACxB,MAAM,CAAC,WAAW,CAAC;yBACnB,GAAG,CAAC,EAAE,UAAU,EAAE,wBAAwB,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;yBAC3E,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;gBAC1C,CAAC;gBACD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,CAAA;gBAClF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,MAAM,IAAI,mBAAmB,CAC3B,wBAAwB,EACxB,yDAAyD,EACzD,GAAG,CACJ,CAAA;gBACH,CAAC;gBACD,OAAO,MAAM,CAAA;YACf,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,SAAS,CAAC,MAAM;YACd,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjC,CAAC;QACD,WAAW,CAAC,MAAM;YAChB,OAAO,MAAM,KAAK,OAAO,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,QAAwC;IAIrF,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IACvC,OAAO,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAA;AACtF,CAAC","sourcesContent":["import { newId } from \"@voyant-travel/db/lib/typeid\"\nimport {\n  apikeyTable,\n  authAccount,\n  authSession,\n  authUser,\n  userInvitationsTable,\n  userProfilesTable,\n} from \"@voyant-travel/db/schema/iam\"\nimport { scopesForRole } from \"@voyant-travel/types/member-roles\"\nimport { desc, eq, sql } from \"drizzle-orm\"\n\nimport type { IdentityAccessRuntimeProvider } from \"./identity-access-runtime-port.js\"\nimport { isDeactivatedProviderId, localProviderIdForStatus } from \"./local-member-access.js\"\nimport { type TeamManagementAdapter, TeamManagementError } from \"./team-management-policy.js\"\nimport type {\n  CreatedTeamInvitationDto,\n  InviteTeamMemberInput,\n  TeamInvitationDto,\n  TeamManagementCapabilitiesDto,\n  TeamManagementRequestContext,\n  TeamMemberDto,\n  TeamRoleDto,\n} from \"./team-management-runtime-port.js\"\n\nconst LOCAL_ROLES: TeamRoleDto[] = [\n  { id: \"owner\", name: \"Owner\", description: \"Full access, including ownership changes.\" },\n  { id: \"admin\", name: \"Admin\", description: \"Full access to team and operator settings.\" },\n  { id: \"editor\", name: \"Editor\", description: \"Can manage day-to-day operator data.\" },\n  { id: \"viewer\", name: \"Viewer\", description: \"Read-only operator access.\" },\n]\n\nconst ROLE_LEVELS: Record<string, number> = { owner: 40, admin: 30, editor: 20, viewer: 10 }\n\ntype TransactionDb<TDb> = TDb extends {\n  transaction<TResult>(\n    callback: (transaction: infer TTransaction) => Promise<TResult>,\n  ): Promise<TResult>\n}\n  ? TTransaction\n  : never\n\ntype LocalTeamDb =\n  | TeamManagementRequestContext[\"db\"]\n  | TransactionDb<TeamManagementRequestContext[\"db\"]>\ntype LocalTeamRequestContext = Omit<TeamManagementRequestContext, \"db\"> & { db: LocalTeamDb }\n\nexport { localProviderIdForStatus } from \"./local-member-access.js\"\n\nfunction roleName(roleId: string): string {\n  return LOCAL_ROLES.find((role) => role.id === roleId)?.name ?? roleId\n}\n\nfunction sameScopes(left: readonly string[], right: readonly string[]) {\n  return [...left].sort().join(\"\\0\") === [...right].sort().join(\"\\0\")\n}\n\nfunction resolveLocalRole(isSuperAdmin: boolean, permissions: string[] | null): string {\n  if (isSuperAdmin) return \"owner\"\n  if (permissions === null || permissions.includes(\"*\")) return \"admin\"\n  if (sameScopes(permissions, scopesForRole(\"editor\") ?? [])) return \"editor\"\n  if (sameScopes(permissions, scopesForRole(\"viewer\") ?? [])) return \"viewer\"\n  return \"custom\"\n}\n\nfunction permissionsForRole(roleId: string): string[] {\n  const scopes = scopesForRole(roleId)\n  if (!scopes) throw new TeamManagementError(\"role_not_found\", \"Team role not found.\", 404)\n  return [...scopes]\n}\n\nfunction invitationRole(metadata: Record<string, unknown> | null): string {\n  const roleId = metadata?.roleId\n  return typeof roleId === \"string\" && ROLE_LEVELS[roleId] !== undefined ? roleId : \"editor\"\n}\n\nfunction invitationStatus(input: {\n  redeemedAt: Date | null\n  expiresAt: Date\n}): TeamInvitationDto[\"status\"] {\n  if (input.redeemedAt) return \"accepted\"\n  if (input.expiresAt.getTime() <= Date.now()) return \"expired\"\n  return \"pending\"\n}\n\nfunction randomTokenBase64Url(bytes: number): string {\n  const buffer = new Uint8Array(bytes)\n  crypto.getRandomValues(buffer)\n  let binary = \"\"\n  for (const byte of buffer) binary += String.fromCharCode(byte)\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\")\n}\n\nasync function sha256Hex(input: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(input))\n  return Array.from(new Uint8Array(digest))\n    .map((byte) => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\")\n}\n\nasync function listLocalMembers(context: LocalTeamRequestContext): Promise<TeamMemberDto[]> {\n  const [rows, accounts] = await Promise.all([\n    context.db\n      .select({\n        id: authUser.id,\n        email: authUser.email,\n        authName: authUser.name,\n        createdAt: authUser.createdAt,\n        firstName: userProfilesTable.firstName,\n        lastName: userProfilesTable.lastName,\n        isSuperAdmin: userProfilesTable.isSuperAdmin,\n        permissions: userProfilesTable.permissions,\n        lastActiveAt: userProfilesTable.lastActiveAt,\n      })\n      .from(authUser)\n      .leftJoin(userProfilesTable, eq(userProfilesTable.id, authUser.id)),\n    context.db\n      .select({ userId: authAccount.userId, providerId: authAccount.providerId })\n      .from(authAccount),\n  ])\n  const activeUserIds = new Set(\n    accounts\n      .filter((account) => !isDeactivatedProviderId(account.providerId))\n      .map((account) => account.userId),\n  )\n\n  return rows.map((row) => {\n    const roleId = resolveLocalRole(row.isSuperAdmin ?? false, row.permissions ?? null)\n    const profileName = [row.firstName, row.lastName].filter(Boolean).join(\" \").trim()\n    return {\n      id: row.id,\n      email: row.email,\n      name: profileName || row.authName || null,\n      roleId,\n      roleName: roleName(roleId),\n      status: activeUserIds.has(row.id) ? \"active\" : \"deactivated\",\n      joinedAt: row.createdAt?.toISOString() ?? null,\n      lastActivityAt: row.lastActiveAt?.toISOString() ?? null,\n    }\n  })\n}\n\nfunction memberOrThrow(members: TeamMemberDto[], memberId: string): TeamMemberDto {\n  const member = members.find((candidate) => candidate.id === memberId)\n  if (!member) throw new TeamManagementError(\"member_not_found\", \"Team member not found.\", 404)\n  return member\n}\n\nfunction assertActiveOwnerRemains(members: TeamMemberDto[], target: TeamMemberDto): void {\n  if (target.status !== \"active\" || target.roleId !== \"owner\") return\n  const activeOwnerCount = members.filter(\n    (member) => member.status === \"active\" && member.roleId === \"owner\",\n  ).length\n  if (activeOwnerCount <= 1) {\n    throw new TeamManagementError(\n      \"last_owner\",\n      \"The last active owner cannot be demoted or deactivated.\",\n      409,\n    )\n  }\n}\n\nasync function withLockedLocalTeam<T>(\n  context: TeamManagementRequestContext,\n  operation: (transactionContext: LocalTeamRequestContext) => Promise<T>,\n): Promise<T> {\n  return context.db.transaction(async (transaction) => {\n    // agent-quality: raw-sql reviewed -- owner: auth; table identifiers are static Drizzle schema objects.\n    await transaction.execute(\n      sql`SELECT ${authUser.id} FROM ${authUser} ORDER BY ${authUser.id} FOR UPDATE`,\n    )\n    return operation({ ...context, db: transaction })\n  })\n}\n\nexport function createLocalTeamManagementAdapter(\n  identityAccess: IdentityAccessRuntimeProvider,\n): TeamManagementAdapter {\n  return {\n    async getActor(context) {\n      const actor = (await listLocalMembers(context)).find((member) => member.id === context.userId)\n      if (actor?.status !== \"active\") {\n        throw new TeamManagementError(\"forbidden\", \"The current user cannot manage this team.\")\n      }\n      return { memberId: actor.id, roleId: actor.roleId }\n    },\n    async getCapabilities(_context, actor): Promise<TeamManagementCapabilitiesDto> {\n      const canManage = actor.roleId === \"owner\" || actor.roleId === \"admin\"\n      return {\n        viewRoster: true,\n        inviteMembers: canManage,\n        manageRoles: canManage,\n        activateMembers: canManage,\n        deactivateMembers: canManage,\n        revokeInvitations: canManage,\n      }\n    },\n    listMembers: listLocalMembers,\n    async listRoles() {\n      return LOCAL_ROLES\n    },\n    async listInvitations(context) {\n      const rows = await context.db\n        .select({\n          id: userInvitationsTable.id,\n          email: userInvitationsTable.email,\n          metadata: userInvitationsTable.metadata,\n          expiresAt: userInvitationsTable.expiresAt,\n          redeemedAt: userInvitationsTable.redeemedAt,\n          createdAt: userInvitationsTable.createdAt,\n        })\n        .from(userInvitationsTable)\n        .orderBy(desc(userInvitationsTable.createdAt))\n        .limit(100)\n      return rows.map((row) => {\n        const roleId = invitationRole(row.metadata)\n        return {\n          id: row.id,\n          email: row.email,\n          roleId,\n          roleName: roleName(roleId),\n          status: invitationStatus(row),\n          createdAt: row.createdAt.toISOString(),\n          expiresAt: row.expiresAt.toISOString(),\n        }\n      })\n    },\n    async inviteMember(context, input: InviteTeamMemberInput): Promise<CreatedTeamInvitationDto> {\n      const email = input.email.trim().toLowerCase()\n      const [existingUser] = await context.db\n        .select({ id: authUser.id })\n        .from(authUser)\n        .where(eq(authUser.email, email))\n        .limit(1)\n      if (existingUser) {\n        throw new TeamManagementError(\n          \"forbidden\",\n          \"A team member with this email already exists.\",\n          409,\n        )\n      }\n\n      const rawToken = randomTokenBase64Url(32)\n      const expiresInDays = input.expiresInDays ?? 3\n      const expiresAt = new Date(Date.now() + expiresInDays * 86_400_000)\n      const now = new Date()\n      const id = newId(\"user_invitations\")\n      await context.db.insert(userInvitationsTable).values({\n        id,\n        email,\n        tokenHash: await sha256Hex(rawToken),\n        expiresAt,\n        createdBy: context.userId,\n        metadata: { roleId: input.roleId },\n        createdAt: now,\n      })\n\n      const { appUrl } = identityAccess.resolveDeployment(context.bindings)\n      const acceptUrl = `${appUrl}/accept-invite?token=${encodeURIComponent(rawToken)}`\n      await identityAccess.sendInvitationEmail(context.bindings, {\n        acceptUrl,\n        expiresInHours: expiresInDays * 24,\n        to: email,\n      })\n      return {\n        id,\n        email,\n        roleId: input.roleId,\n        roleName: roleName(input.roleId),\n        status: \"pending\",\n        createdAt: now.toISOString(),\n        expiresAt: expiresAt.toISOString(),\n        acceptUrl,\n      }\n    },\n    async revokeInvitation(context, invitationId) {\n      await context.db.delete(userInvitationsTable).where(eq(userInvitationsTable.id, invitationId))\n    },\n    async updateMemberRole(context, memberId, roleId) {\n      return withLockedLocalTeam(context, async (transactionContext) => {\n        const members = await listLocalMembers(transactionContext)\n        const target = memberOrThrow(members, memberId)\n        if (roleId !== \"owner\") assertActiveOwnerRemains(members, target)\n\n        await transactionContext.db\n          .update(userProfilesTable)\n          .set({\n            isSuperAdmin: roleId === \"owner\",\n            permissions: permissionsForRole(roleId),\n            updatedAt: new Date(),\n          })\n          .where(eq(userProfilesTable.id, memberId))\n        return memberOrThrow(await listLocalMembers(transactionContext), memberId)\n      })\n    },\n    async deactivateMember(context, memberId) {\n      return withLockedLocalTeam(context, async (transactionContext) => {\n        const members = await listLocalMembers(transactionContext)\n        assertActiveOwnerRemains(members, memberOrThrow(members, memberId))\n\n        await transactionContext.db.delete(authSession).where(eq(authSession.userId, memberId))\n        await transactionContext.db.delete(apikeyTable).where(eq(apikeyTable.referenceId, memberId))\n        const accounts = await transactionContext.db\n          .select({ id: authAccount.id, providerId: authAccount.providerId })\n          .from(authAccount)\n          .where(eq(authAccount.userId, memberId))\n        for (const account of accounts) {\n          await transactionContext.db\n            .update(authAccount)\n            .set({ providerId: localProviderIdForStatus(account.providerId, \"deactivated\") })\n            .where(eq(authAccount.id, account.id))\n        }\n        return memberOrThrow(await listLocalMembers(transactionContext), memberId)\n      })\n    },\n    async activateMember(context, memberId) {\n      return withLockedLocalTeam(context, async (transactionContext) => {\n        memberOrThrow(await listLocalMembers(transactionContext), memberId)\n        const accounts = await transactionContext.db\n          .select({ id: authAccount.id, providerId: authAccount.providerId })\n          .from(authAccount)\n          .where(eq(authAccount.userId, memberId))\n        for (const account of accounts) {\n          await transactionContext.db\n            .update(authAccount)\n            .set({ providerId: localProviderIdForStatus(account.providerId, \"active\") })\n            .where(eq(authAccount.id, account.id))\n        }\n        const member = memberOrThrow(await listLocalMembers(transactionContext), memberId)\n        if (member.status !== \"active\") {\n          throw new TeamManagementError(\n            \"activation_unavailable\",\n            \"This local member has no sign-in account to reactivate.\",\n            409,\n          )\n        }\n        return member\n      })\n    },\n    roleLevel(roleId) {\n      return ROLE_LEVELS[roleId] ?? 0\n    },\n    isOwnerRole(roleId) {\n      return roleId === \"owner\"\n    },\n  }\n}\n\nexport function localRoleForRedeemedInvitation(metadata: Record<string, unknown> | null): {\n  isSuperAdmin: boolean\n  permissions: string[]\n} {\n  const roleId = invitationRole(metadata)\n  return { isSuperAdmin: roleId === \"owner\", permissions: permissionsForRole(roleId) }\n}\n"]}

package/dist/team-management-policy.d.ts

@@ -0,0 +1,27 @@
+import type { CreatedTeamInvitationDto, InviteTeamMemberInput, TeamInvitationDto, TeamManagementCapabilitiesDto, TeamManagementRequestContext, TeamManagementRuntimeProvider, TeamMemberDto, TeamRoleDto } from "./team-management-runtime-port.js";
+export type TeamManagementErrorCode = "forbidden" | "member_not_found" | "role_not_found" | "self_change_forbidden" | "privilege_escalation" | "last_owner" | "activation_unavailable" | "not_configured";
+export declare class TeamManagementError extends Error {
+    readonly code: TeamManagementErrorCode;
+    readonly status: 400 | 403 | 404 | 409 | 501;
+    constructor(code: TeamManagementErrorCode, message: string, status?: 400 | 403 | 404 | 409 | 501);
+}
+export interface TeamManagementActor {
+    memberId: string;
+    roleId: string;
+}
+export interface TeamManagementAdapter {
+    getActor(context: TeamManagementRequestContext): Promise<TeamManagementActor>;
+    getCapabilities(context: TeamManagementRequestContext, actor: TeamManagementActor): Promise<TeamManagementCapabilitiesDto>;
+    listMembers(context: TeamManagementRequestContext): Promise<TeamMemberDto[]>;
+    listRoles(context: TeamManagementRequestContext): Promise<TeamRoleDto[]>;
+    listInvitations(context: TeamManagementRequestContext): Promise<TeamInvitationDto[]>;
+    inviteMember(context: TeamManagementRequestContext, input: InviteTeamMemberInput): Promise<CreatedTeamInvitationDto>;
+    revokeInvitation(context: TeamManagementRequestContext, invitationId: string): Promise<void>;
+    updateMemberRole(context: TeamManagementRequestContext, memberId: string, roleId: string): Promise<TeamMemberDto>;
+    activateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>;
+    deactivateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>;
+    roleLevel(roleId: string): number;
+    isOwnerRole(roleId: string): boolean;
+}
+/** Applies provider-neutral authorization and invariants before invoking an adapter. */
+export declare function createGuardedTeamManagementProvider(resolveAdapter: (context: TeamManagementRequestContext) => TeamManagementAdapter): TeamManagementRuntimeProvider;

package/dist/team-management-policy.js

@@ -0,0 +1,109 @@
+export class TeamManagementError extends Error {
+    code;
+    status;
+    constructor(code, message, status = 403) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.name = "TeamManagementError";
+    }
+}
+function requireCapability(capabilities, capability) {
+    if (!capabilities[capability]) {
+        throw new TeamManagementError("forbidden", "This team-management action is not allowed.");
+    }
+}
+async function authorize(adapter, context, capability) {
+    const actor = await adapter.getActor(context);
+    const capabilities = await adapter.getCapabilities(context, actor);
+    requireCapability(capabilities, capability);
+    return { actor, capabilities };
+}
+async function mutationState(adapter, context, capability, memberId) {
+    const { actor } = await authorize(adapter, context, capability);
+    const members = await adapter.listMembers(context);
+    const target = members.find((member) => member.id === memberId);
+    if (!target) {
+        throw new TeamManagementError("member_not_found", "Team member not found.", 404);
+    }
+    if (target.id === actor.memberId) {
+        throw new TeamManagementError("self_change_forbidden", "You cannot change your own role or access.", 409);
+    }
+    if (adapter.roleLevel(target.roleId) > adapter.roleLevel(actor.roleId)) {
+        throw new TeamManagementError("privilege_escalation", "You cannot manage a member with a more privileged role.");
+    }
+    return { actor, members, target };
+}
+function assertAssignableRole(adapter, actor, roles, roleId) {
+    if (!roles.some((role) => role.id === roleId)) {
+        throw new TeamManagementError("role_not_found", "Team role not found.", 404);
+    }
+    if (adapter.roleLevel(roleId) > adapter.roleLevel(actor.roleId)) {
+        throw new TeamManagementError("privilege_escalation", "You cannot assign a role above your own privilege level.");
+    }
+}
+function assertOwnerRemains(adapter, members, target) {
+    if (!adapter.isOwnerRole(target.roleId))
+        return;
+    const activeOwners = members.filter((member) => member.status === "active" && adapter.isOwnerRole(member.roleId));
+    if (activeOwners.length <= 1) {
+        throw new TeamManagementError("last_owner", "The last active owner cannot be demoted or deactivated.", 409);
+    }
+}
+/** Applies provider-neutral authorization and invariants before invoking an adapter. */
+export function createGuardedTeamManagementProvider(resolveAdapter) {
+    return {
+        async getCapabilities(context) {
+            const adapter = resolveAdapter(context);
+            const actor = await adapter.getActor(context);
+            return adapter.getCapabilities(context, actor);
+        },
+        async listMembers(context) {
+            const adapter = resolveAdapter(context);
+            await authorize(adapter, context, "viewRoster");
+            return adapter.listMembers(context);
+        },
+        async listRoles(context) {
+            const adapter = resolveAdapter(context);
+            await authorize(adapter, context, "viewRoster");
+            return adapter.listRoles(context);
+        },
+        async listInvitations(context) {
+            const adapter = resolveAdapter(context);
+            await authorize(adapter, context, "viewRoster");
+            return adapter.listInvitations(context);
+        },
+        async inviteMember(context, input) {
+            const adapter = resolveAdapter(context);
+            const { actor } = await authorize(adapter, context, "inviteMembers");
+            assertAssignableRole(adapter, actor, await adapter.listRoles(context), input.roleId);
+            return adapter.inviteMember(context, input);
+        },
+        async revokeInvitation(context, invitationId) {
+            const adapter = resolveAdapter(context);
+            await authorize(adapter, context, "revokeInvitations");
+            return adapter.revokeInvitation(context, invitationId);
+        },
+        async updateMemberRole(context, memberId, roleId) {
+            const adapter = resolveAdapter(context);
+            const { actor, members, target } = await mutationState(adapter, context, "manageRoles", memberId);
+            assertAssignableRole(adapter, actor, await adapter.listRoles(context), roleId);
+            if (adapter.isOwnerRole(target.roleId) && !adapter.isOwnerRole(roleId)) {
+                assertOwnerRemains(adapter, members, target);
+            }
+            return adapter.updateMemberRole(context, memberId, roleId);
+        },
+        async deactivateMember(context, memberId) {
+            const adapter = resolveAdapter(context);
+            const { members, target } = await mutationState(adapter, context, "deactivateMembers", memberId);
+            assertOwnerRemains(adapter, members, target);
+            return adapter.deactivateMember(context, memberId);
+        },
+        async activateMember(context, memberId) {
+            const adapter = resolveAdapter(context);
+            await mutationState(adapter, context, "activateMembers", memberId);
+            return adapter.activateMember(context, memberId);
+        },
+    };
+}
+//# sourceMappingURL=team-management-policy.js.map

package/dist/team-management-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-management-policy.js","sourceRoot":"","sources":["../src/team-management-policy.ts"],"names":[],"mappings":"AAqBA,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC;IAEA;IAHX,YACW,IAA6B,EACtC,OAAe,EACN,SAAsC,GAAG;QAElD,KAAK,CAAC,OAAO,CAAC,CAAA;QAJL,SAAI,GAAJ,IAAI,CAAyB;QAE7B,WAAM,GAAN,MAAM,CAAmC;QAGlD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAkCD,SAAS,iBAAiB,CAAC,YAA2C,EAAE,UAAsB;IAC5F,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAE,6CAA6C,CAAC,CAAA;IAC3F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,OAA8B,EAC9B,OAAqC,EACrC,UAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAClE,iBAAiB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAC3C,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;AAChC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAA8B,EAC9B,OAAqC,EACrC,UAAsB,EACtB,QAAgB;IAEhB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAA;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,EACvB,4CAA4C,EAC5C,GAAG,CACJ,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,mBAAmB,CAC3B,sBAAsB,EACtB,yDAAyD,CAC1D,CAAA;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AACnC,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAA8B,EAC9B,KAA0B,EAC1B,KAAoB,EACpB,MAAc;IAEd,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,mBAAmB,CAC3B,sBAAsB,EACtB,0DAA0D,CAC3D,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAA8B,EAC9B,OAAwB,EACxB,MAAqB;IAErB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAM;IAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CACjC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAC7E,CAAA;IACD,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,mBAAmB,CAC3B,YAAY,EACZ,yDAAyD,EACzD,GAAG,CACJ,CAAA;IACH,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,mCAAmC,CACjD,cAAgF;IAEhF,OAAO;QACL,KAAK,CAAC,eAAe,CAAC,OAAO;YAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC7C,OAAO,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAChD,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAO;YACvB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAC/C,OAAO,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAC/C,OAAO,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,OAAO;YAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAC/C,OAAO,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;QACzC,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK;YAC/B,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,CAAA;YACpE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YACpF,OAAO,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAC7C,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY;YAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAA;YACtD,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QACxD,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM;YAC9C,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpD,OAAO,EACP,OAAO,EACP,aAAa,EACb,QAAQ,CACT,CAAA;YACD,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;YAC9E,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvE,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YAC9C,CAAC;YACD,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC5D,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ;YACtC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAC7C,OAAO,EACP,OAAO,EACP,mBAAmB,EACnB,QAAQ,CACT,CAAA;YACD,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5C,OAAO,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACpD,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ;YACpC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YACvC,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAA;YAClE,OAAO,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAClD,CAAC;KACF,CAAA;AACH,CAAC","sourcesContent":["import type {\n  CreatedTeamInvitationDto,\n  InviteTeamMemberInput,\n  TeamInvitationDto,\n  TeamManagementCapabilitiesDto,\n  TeamManagementRequestContext,\n  TeamManagementRuntimeProvider,\n  TeamMemberDto,\n  TeamRoleDto,\n} from \"./team-management-runtime-port.js\"\n\nexport type TeamManagementErrorCode =\n  | \"forbidden\"\n  | \"member_not_found\"\n  | \"role_not_found\"\n  | \"self_change_forbidden\"\n  | \"privilege_escalation\"\n  | \"last_owner\"\n  | \"activation_unavailable\"\n  | \"not_configured\"\n\nexport class TeamManagementError extends Error {\n  constructor(\n    readonly code: TeamManagementErrorCode,\n    message: string,\n    readonly status: 400 | 403 | 404 | 409 | 501 = 403,\n  ) {\n    super(message)\n    this.name = \"TeamManagementError\"\n  }\n}\n\nexport interface TeamManagementActor {\n  memberId: string\n  roleId: string\n}\n\nexport interface TeamManagementAdapter {\n  getActor(context: TeamManagementRequestContext): Promise<TeamManagementActor>\n  getCapabilities(\n    context: TeamManagementRequestContext,\n    actor: TeamManagementActor,\n  ): Promise<TeamManagementCapabilitiesDto>\n  listMembers(context: TeamManagementRequestContext): Promise<TeamMemberDto[]>\n  listRoles(context: TeamManagementRequestContext): Promise<TeamRoleDto[]>\n  listInvitations(context: TeamManagementRequestContext): Promise<TeamInvitationDto[]>\n  inviteMember(\n    context: TeamManagementRequestContext,\n    input: InviteTeamMemberInput,\n  ): Promise<CreatedTeamInvitationDto>\n  revokeInvitation(context: TeamManagementRequestContext, invitationId: string): Promise<void>\n  updateMemberRole(\n    context: TeamManagementRequestContext,\n    memberId: string,\n    roleId: string,\n  ): Promise<TeamMemberDto>\n  activateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>\n  deactivateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>\n  roleLevel(roleId: string): number\n  isOwnerRole(roleId: string): boolean\n}\n\ntype Capability = keyof TeamManagementCapabilitiesDto\n\nfunction requireCapability(capabilities: TeamManagementCapabilitiesDto, capability: Capability) {\n  if (!capabilities[capability]) {\n    throw new TeamManagementError(\"forbidden\", \"This team-management action is not allowed.\")\n  }\n}\n\nasync function authorize(\n  adapter: TeamManagementAdapter,\n  context: TeamManagementRequestContext,\n  capability: Capability,\n) {\n  const actor = await adapter.getActor(context)\n  const capabilities = await adapter.getCapabilities(context, actor)\n  requireCapability(capabilities, capability)\n  return { actor, capabilities }\n}\n\nasync function mutationState(\n  adapter: TeamManagementAdapter,\n  context: TeamManagementRequestContext,\n  capability: Capability,\n  memberId: string,\n) {\n  const { actor } = await authorize(adapter, context, capability)\n  const members = await adapter.listMembers(context)\n  const target = members.find((member) => member.id === memberId)\n  if (!target) {\n    throw new TeamManagementError(\"member_not_found\", \"Team member not found.\", 404)\n  }\n  if (target.id === actor.memberId) {\n    throw new TeamManagementError(\n      \"self_change_forbidden\",\n      \"You cannot change your own role or access.\",\n      409,\n    )\n  }\n  if (adapter.roleLevel(target.roleId) > adapter.roleLevel(actor.roleId)) {\n    throw new TeamManagementError(\n      \"privilege_escalation\",\n      \"You cannot manage a member with a more privileged role.\",\n    )\n  }\n  return { actor, members, target }\n}\n\nfunction assertAssignableRole(\n  adapter: TeamManagementAdapter,\n  actor: TeamManagementActor,\n  roles: TeamRoleDto[],\n  roleId: string,\n) {\n  if (!roles.some((role) => role.id === roleId)) {\n    throw new TeamManagementError(\"role_not_found\", \"Team role not found.\", 404)\n  }\n  if (adapter.roleLevel(roleId) > adapter.roleLevel(actor.roleId)) {\n    throw new TeamManagementError(\n      \"privilege_escalation\",\n      \"You cannot assign a role above your own privilege level.\",\n    )\n  }\n}\n\nfunction assertOwnerRemains(\n  adapter: TeamManagementAdapter,\n  members: TeamMemberDto[],\n  target: TeamMemberDto,\n) {\n  if (!adapter.isOwnerRole(target.roleId)) return\n  const activeOwners = members.filter(\n    (member) => member.status === \"active\" && adapter.isOwnerRole(member.roleId),\n  )\n  if (activeOwners.length <= 1) {\n    throw new TeamManagementError(\n      \"last_owner\",\n      \"The last active owner cannot be demoted or deactivated.\",\n      409,\n    )\n  }\n}\n\n/** Applies provider-neutral authorization and invariants before invoking an adapter. */\nexport function createGuardedTeamManagementProvider(\n  resolveAdapter: (context: TeamManagementRequestContext) => TeamManagementAdapter,\n): TeamManagementRuntimeProvider {\n  return {\n    async getCapabilities(context) {\n      const adapter = resolveAdapter(context)\n      const actor = await adapter.getActor(context)\n      return adapter.getCapabilities(context, actor)\n    },\n    async listMembers(context) {\n      const adapter = resolveAdapter(context)\n      await authorize(adapter, context, \"viewRoster\")\n      return adapter.listMembers(context)\n    },\n    async listRoles(context) {\n      const adapter = resolveAdapter(context)\n      await authorize(adapter, context, \"viewRoster\")\n      return adapter.listRoles(context)\n    },\n    async listInvitations(context) {\n      const adapter = resolveAdapter(context)\n      await authorize(adapter, context, \"viewRoster\")\n      return adapter.listInvitations(context)\n    },\n    async inviteMember(context, input) {\n      const adapter = resolveAdapter(context)\n      const { actor } = await authorize(adapter, context, \"inviteMembers\")\n      assertAssignableRole(adapter, actor, await adapter.listRoles(context), input.roleId)\n      return adapter.inviteMember(context, input)\n    },\n    async revokeInvitation(context, invitationId) {\n      const adapter = resolveAdapter(context)\n      await authorize(adapter, context, \"revokeInvitations\")\n      return adapter.revokeInvitation(context, invitationId)\n    },\n    async updateMemberRole(context, memberId, roleId) {\n      const adapter = resolveAdapter(context)\n      const { actor, members, target } = await mutationState(\n        adapter,\n        context,\n        \"manageRoles\",\n        memberId,\n      )\n      assertAssignableRole(adapter, actor, await adapter.listRoles(context), roleId)\n      if (adapter.isOwnerRole(target.roleId) && !adapter.isOwnerRole(roleId)) {\n        assertOwnerRemains(adapter, members, target)\n      }\n      return adapter.updateMemberRole(context, memberId, roleId)\n    },\n    async deactivateMember(context, memberId) {\n      const adapter = resolveAdapter(context)\n      const { members, target } = await mutationState(\n        adapter,\n        context,\n        \"deactivateMembers\",\n        memberId,\n      )\n      assertOwnerRemains(adapter, members, target)\n      return adapter.deactivateMember(context, memberId)\n    },\n    async activateMember(context, memberId) {\n      const adapter = resolveAdapter(context)\n      await mutationState(adapter, context, \"activateMembers\", memberId)\n      return adapter.activateMember(context, memberId)\n    },\n  }\n}\n"]}

package/dist/team-management-runtime-port.d.ts

@@ -0,0 +1,60 @@
+import type { VoyantDb } from "@voyant-travel/hono";
+export type TeamMemberStatus = "active" | "deactivated";
+export type TeamInvitationStatus = "pending" | "accepted" | "expired" | "revoked";
+export interface TeamMemberDto {
+    id: string;
+    email: string | null;
+    name: string | null;
+    roleId: string;
+    roleName: string;
+    status: TeamMemberStatus;
+    joinedAt: string | null;
+    lastActivityAt: string | null;
+}
+export interface TeamRoleDto {
+    id: string;
+    name: string;
+    description: string | null;
+}
+export interface TeamInvitationDto {
+    id: string;
+    email: string;
+    roleId: string;
+    roleName: string;
+    status: TeamInvitationStatus;
+    createdAt: string;
+    expiresAt: string;
+}
+export interface CreatedTeamInvitationDto extends TeamInvitationDto {
+    acceptUrl: string | null;
+}
+export interface TeamManagementCapabilitiesDto {
+    viewRoster: boolean;
+    inviteMembers: boolean;
+    manageRoles: boolean;
+    activateMembers: boolean;
+    deactivateMembers: boolean;
+    revokeInvitations: boolean;
+}
+export interface TeamManagementRequestContext {
+    bindings: Record<string, unknown>;
+    db: VoyantDb;
+    userId: string;
+}
+export interface InviteTeamMemberInput {
+    email: string;
+    roleId: string;
+    expiresInDays?: number;
+}
+export interface TeamManagementRuntimeProvider {
+    getCapabilities(context: TeamManagementRequestContext): Promise<TeamManagementCapabilitiesDto>;
+    listMembers(context: TeamManagementRequestContext): Promise<TeamMemberDto[]>;
+    listRoles(context: TeamManagementRequestContext): Promise<TeamRoleDto[]>;
+    listInvitations(context: TeamManagementRequestContext): Promise<TeamInvitationDto[]>;
+    inviteMember(context: TeamManagementRequestContext, input: InviteTeamMemberInput): Promise<CreatedTeamInvitationDto>;
+    revokeInvitation(context: TeamManagementRequestContext, invitationId: string): Promise<void>;
+    updateMemberRole(context: TeamManagementRequestContext, memberId: string, roleId: string): Promise<TeamMemberDto>;
+    activateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>;
+    deactivateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>;
+}
+export declare const teamManagementRuntimePort: import("@voyant-travel/core/project").VoyantPort<TeamManagementRuntimeProvider>;

package/dist/team-management-runtime-port.js

@@ -0,0 +1,25 @@
+import { definePort } from "@voyant-travel/core/project";
+export const teamManagementRuntimePort = definePort({
+    id: "auth.team-management-runtime",
+    test(provider) {
+        if (provider === null || typeof provider !== "object") {
+            throw new Error("auth.team-management-runtime provider must be an object.");
+        }
+        for (const method of [
+            "getCapabilities",
+            "listMembers",
+            "listRoles",
+            "listInvitations",
+            "inviteMember",
+            "revokeInvitation",
+            "updateMemberRole",
+            "activateMember",
+            "deactivateMember",
+        ]) {
+            if (typeof provider[method] !== "function") {
+                throw new Error(`auth.team-management-runtime provider must implement ${method}().`);
+            }
+        }
+    },
+});
+//# sourceMappingURL=team-management-runtime-port.js.map

package/dist/team-management-runtime-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-management-runtime-port.js","sourceRoot":"","sources":["../src/team-management-runtime-port.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AA6ExD,MAAM,CAAC,MAAM,yBAAyB,GAAG,UAAU,CAAgC;IACjF,EAAE,EAAE,8BAA8B;IAClC,IAAI,CAAC,QAAQ;QACX,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC7E,CAAC;QACD,KAAK,MAAM,MAAM,IAAI;YACnB,iBAAiB;YACjB,aAAa;YACb,WAAW;YACX,iBAAiB;YACjB,cAAc;YACd,kBAAkB;YAClB,kBAAkB;YAClB,gBAAgB;YAChB,kBAAkB;SACV,EAAE,CAAC;YACX,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,wDAAwD,MAAM,KAAK,CAAC,CAAA;YACtF,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC,CAAA","sourcesContent":["import { definePort } from \"@voyant-travel/core/project\"\nimport type { VoyantDb } from \"@voyant-travel/hono\"\n\nexport type TeamMemberStatus = \"active\" | \"deactivated\"\nexport type TeamInvitationStatus = \"pending\" | \"accepted\" | \"expired\" | \"revoked\"\n\nexport interface TeamMemberDto {\n  id: string\n  email: string | null\n  name: string | null\n  roleId: string\n  roleName: string\n  status: TeamMemberStatus\n  joinedAt: string | null\n  lastActivityAt: string | null\n}\n\nexport interface TeamRoleDto {\n  id: string\n  name: string\n  description: string | null\n}\n\nexport interface TeamInvitationDto {\n  id: string\n  email: string\n  roleId: string\n  roleName: string\n  status: TeamInvitationStatus\n  createdAt: string\n  expiresAt: string\n}\n\nexport interface CreatedTeamInvitationDto extends TeamInvitationDto {\n  acceptUrl: string | null\n}\n\nexport interface TeamManagementCapabilitiesDto {\n  viewRoster: boolean\n  inviteMembers: boolean\n  manageRoles: boolean\n  activateMembers: boolean\n  deactivateMembers: boolean\n  revokeInvitations: boolean\n}\n\nexport interface TeamManagementRequestContext {\n  bindings: Record<string, unknown>\n  db: VoyantDb\n  userId: string\n}\n\nexport interface InviteTeamMemberInput {\n  email: string\n  roleId: string\n  expiresInDays?: number\n}\n\nexport interface TeamManagementRuntimeProvider {\n  getCapabilities(context: TeamManagementRequestContext): Promise<TeamManagementCapabilitiesDto>\n  listMembers(context: TeamManagementRequestContext): Promise<TeamMemberDto[]>\n  listRoles(context: TeamManagementRequestContext): Promise<TeamRoleDto[]>\n  listInvitations(context: TeamManagementRequestContext): Promise<TeamInvitationDto[]>\n  inviteMember(\n    context: TeamManagementRequestContext,\n    input: InviteTeamMemberInput,\n  ): Promise<CreatedTeamInvitationDto>\n  revokeInvitation(context: TeamManagementRequestContext, invitationId: string): Promise<void>\n  updateMemberRole(\n    context: TeamManagementRequestContext,\n    memberId: string,\n    roleId: string,\n  ): Promise<TeamMemberDto>\n  activateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>\n  deactivateMember(context: TeamManagementRequestContext, memberId: string): Promise<TeamMemberDto>\n}\n\nexport const teamManagementRuntimePort = definePort<TeamManagementRuntimeProvider>({\n  id: \"auth.team-management-runtime\",\n  test(provider) {\n    if (provider === null || typeof provider !== \"object\") {\n      throw new Error(\"auth.team-management-runtime provider must be an object.\")\n    }\n    for (const method of [\n      \"getCapabilities\",\n      \"listMembers\",\n      \"listRoles\",\n      \"listInvitations\",\n      \"inviteMember\",\n      \"revokeInvitation\",\n      \"updateMemberRole\",\n      \"activateMember\",\n      \"deactivateMember\",\n    ] as const) {\n      if (typeof provider[method] !== \"function\") {\n        throw new Error(`auth.team-management-runtime provider must implement ${method}().`)\n      }\n    }\n  },\n})\n"]}

package/dist/team-routes.d.ts

@@ -1,12 +1,12 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { type VoyantDb } from "@voyant-travel/hono";
-import type { IdentityAccessRuntimeProvider } from "./identity-access-runtime-port.js";
-type IdentityAccessEnv = {
+import type { TeamManagementRuntimeProvider } from "./team-management-runtime-port.js";
+type TeamEnv = {
     Bindings: Record<string, unknown>;
     Variables: {
         userId?: string;
         db: VoyantDb;
     };
 };
-export declare function createTeamAdminRoutes(runtime: IdentityAccessRuntimeProvider): OpenAPIHono<IdentityAccessEnv, {}, "/">;
+export declare function createTeamAdminRoutes(runtime: TeamManagementRuntimeProvider): OpenAPIHono<TeamEnv, {}, "/">;
 export {};