@voyant-travel/auth 0.129.0 → 0.131.0

package/dist/team-routes.js

@@ -1,17 +1,12 @@
 import { createRoute, OpenAPIHono, z } from "@hono/zod-openapi";
-import { cloudAuthUserLinks } from "@voyant-travel/db/schema/iam";
 import { openApiValidationHook, parseJsonBody } from "@voyant-travel/hono";
-import { eq } from "drizzle-orm";
-import { CloudAdminMembersError, inviteCloudAdminMember, listCloudAdminInvitations, listCloudAdminMemberRoles, listCloudAdminMembers, revokeCloudAdminInvitation, setCloudAdminMemberAccess, setCloudAdminMemberPermissions, } from "./cloud-broker.js";
+import { TeamManagementError } from "./team-management-policy.js";
 const inviteSchema = z.object({
     email: z.string().email(),
-    roleSlug: z.string().trim().min(1).max(120).optional().nullable(),
+    roleId: z.string().trim().min(1).max(120),
     expiresInDays: z.number().int().min(1).max(30).optional(),
 });
-const accessSchema = z.object({ hasAccess: z.boolean() });
-const permissionsSchema = z.object({
-    permissions: z.array(z.string().trim().min(1).max(120)).max(200),
-});
+const roleSchema = z.object({ roleId: z.string().trim().min(1).max(120) });
 const teamAdminApiId = "@voyant-travel/auth#team.api.admin";
 const jsonBody = (schema) => ({
     required: true,
@@ -26,185 +21,141 @@ const teamRoute = (config) => createRoute({
     ...(config.request ? { request: config.request } : {}),
     responses: responses(...config.statuses),
 });
+const capabilitiesRoute = teamRoute({
+    method: "get",
+    path: "/capabilities",
+    operationId: "getTeamManagementCapabilities",
+    statuses: [200, 401, 403, 501],
+});
 const listMembersRoute = teamRoute({
     method: "get",
     path: "/members",
     operationId: "listTeamMembers",
-    statuses: [200, 401, 403, 404, 501],
+    statuses: [200, 401, 403, 501],
 });
 const listRolesRoute = teamRoute({
     method: "get",
     path: "/roles",
     operationId: "listTeamRoles",
-    statuses: [200, 401, 403, 404, 501],
+    statuses: [200, 401, 403, 501],
 });
-const listTeamInvitationsRoute = teamRoute({
+const listInvitationsRoute = teamRoute({
     method: "get",
     path: "/invitations",
     operationId: "listTeamInvitations",
-    statuses: [200, 401, 403, 404, 501],
+    statuses: [200, 401, 403, 501],
 });
-const createTeamInvitationRoute = teamRoute({
+const createInvitationRoute = teamRoute({
     method: "post",
     path: "/invitations",
     operationId: "createTeamInvitation",
     request: { body: jsonBody(inviteSchema) },
-    statuses: [201, 400, 401, 403, 404, 501],
+    statuses: [201, 400, 401, 403, 404, 409, 501],
 });
-const revokeTeamInvitationRoute = teamRoute({
+const revokeInvitationRoute = teamRoute({
     method: "delete",
     path: "/invitations/{invitationId}",
     operationId: "revokeTeamInvitation",
     request: { params: z.object({ invitationId: z.string() }) },
     statuses: [204, 401, 403, 404, 501],
 });
-const setTeamMemberAccessRoute = teamRoute({
+const updateRoleRoute = teamRoute({
     method: "put",
-    path: "/members/{membershipId}/access",
-    operationId: "setTeamMemberAccess",
+    path: "/members/{memberId}/role",
+    operationId: "updateTeamMemberRole",
     request: {
-        params: z.object({ membershipId: z.string() }),
-        body: jsonBody(accessSchema),
+        params: z.object({ memberId: z.string() }),
+        body: jsonBody(roleSchema),
     },
-    statuses: [200, 400, 401, 403, 404, 501],
+    statuses: [200, 400, 401, 403, 404, 409, 501],
+});
+const deactivateMemberRoute = teamRoute({
+    method: "delete",
+    path: "/members/{memberId}",
+    operationId: "deactivateTeamMember",
+    request: { params: z.object({ memberId: z.string() }) },
+    statuses: [200, 401, 403, 404, 409, 501],
 });
-const setTeamMemberPermissionsRoute = teamRoute({
+const activateMemberRoute = teamRoute({
     method: "put",
-    path: "/members/{membershipId}/permissions",
-    operationId: "setTeamMemberPermissions",
-    request: {
-        params: z.object({ membershipId: z.string() }),
-        body: jsonBody(permissionsSchema),
-    },
-    statuses: [200, 400, 401, 403, 404, 501],
+    path: "/members/{memberId}/activation",
+    operationId: "activateTeamMember",
+    request: { params: z.object({ memberId: z.string() }) },
+    statuses: [200, 401, 403, 404, 409, 501],
 });
-async function resolveActingWorkosUserId(db, userId) {
-    const [link] = await db
-        .select({ providerAccountId: cloudAuthUserLinks.providerAccountId })
-        .from(cloudAuthUserLinks)
-        .where(eq(cloudAuthUserLinks.userId, userId))
-        .limit(1);
-    return link?.providerAccountId ?? null;
+function requestContext(c) {
+    const userId = c.get("userId");
+    if (!userId)
+        return c.json({ error: "Unauthorized" }, 401);
+    return { bindings: c.env, db: c.get("db"), userId };
+}
+function handleError(c, error) {
+    if (error instanceof TeamManagementError) {
+        return c.json({ error: error.message, code: error.code }, error.status);
+    }
+    if (error instanceof Error &&
+        "status" in error &&
+        typeof error.status === "number" &&
+        error.status >= 400 &&
+        error.status <= 599) {
+        return c.json({ error: error.message }, error.status);
+    }
+    throw error;
 }
 export function createTeamAdminRoutes(runtime) {
     const routes = new OpenAPIHono({ defaultHook: openApiValidationHook });
-    const resolveContext = async (c) => {
-        const deployment = runtime.resolveDeployment(c.env);
-        if (deployment.authMode !== "voyant-cloud")
-            return c.json({ error: "Not found" }, 404);
-        const userId = c.get("userId");
-        if (!userId)
-            return c.json({ error: "Unauthorized" }, 401);
-        if (!deployment.cloudAdminMembers) {
-            return c.json({ error: "Voyant Cloud member management is not configured" }, 501);
-        }
-        const actingWorkosUserId = await resolveActingWorkosUserId(c.get("db"), userId);
-        if (!actingWorkosUserId) {
-            return c.json({ error: "No Voyant Cloud identity for this session" }, 403);
-        }
-        return { config: deployment.cloudAdminMembers, actingWorkosUserId };
-    };
-    const handleError = (c, error) => {
-        if (error instanceof CloudAdminMembersError) {
-            return c.json({ error: error.reason ?? error.message }, error.status);
-        }
-        throw error;
-    };
-    routes.openapi(listMembersRoute, async (c) => {
-        const context = await resolveContext(c);
+    const run = async (c, operation) => {
+        const context = requestContext(c);
         if (context instanceof Response)
             return context;
         try {
-            return c.json({ data: await listCloudAdminMembers(context) });
+            return await operation(context);
         }
         catch (error) {
             return handleError(c, error);
         }
+    };
+    routes.openapi(capabilitiesRoute, async (c) => {
+        const result = await run(c, (context) => runtime.getCapabilities(context));
+        return result instanceof Response ? result : c.json({ data: result });
+    });
+    routes.openapi(listMembersRoute, async (c) => {
+        const result = await run(c, (context) => runtime.listMembers(context));
+        return result instanceof Response ? result : c.json({ data: result });
     });
     routes.openapi(listRolesRoute, async (c) => {
-        const context = await resolveContext(c);
-        if (context instanceof Response)
-            return context;
-        try {
-            return c.json({ data: await listCloudAdminMemberRoles(context) });
-        }
-        catch (error) {
-            return handleError(c, error);
-        }
+        const result = await run(c, (context) => runtime.listRoles(context));
+        return result instanceof Response ? result : c.json({ data: result });
     });
-    routes.openapi(listTeamInvitationsRoute, async (c) => {
-        const context = await resolveContext(c);
-        if (context instanceof Response)
-            return context;
-        try {
-            return c.json({ data: await listCloudAdminInvitations(context) });
-        }
-        catch (error) {
-            return handleError(c, error);
-        }
+    routes.openapi(listInvitationsRoute, async (c) => {
+        const result = await run(c, (context) => runtime.listInvitations(context));
+        return result instanceof Response ? result : c.json({ data: result });
     });
-    routes.openapi(createTeamInvitationRoute, async (c) => {
-        const context = await resolveContext(c);
-        if (context instanceof Response)
-            return context;
+    routes.openapi(createInvitationRoute, async (c) => {
         const input = await parseJsonBody(c, inviteSchema);
-        try {
-            return c.json({ data: await inviteCloudAdminMember({ ...context, input }) }, 201);
-        }
-        catch (error) {
-            return handleError(c, error);
-        }
+        const result = await run(c, (context) => runtime.inviteMember(context, input));
+        return result instanceof Response ? result : c.json({ data: result }, 201);
     });
-    routes.openapi(revokeTeamInvitationRoute, async (c) => {
-        const context = await resolveContext(c);
-        if (context instanceof Response)
-            return context;
-        try {
-            await revokeCloudAdminInvitation({
-                ...context,
-                invitationId: c.req.param("invitationId"),
-            });
-            return c.body(null, 204);
-        }
-        catch (error) {
-            return handleError(c, error);
-        }
+    routes.openapi(revokeInvitationRoute, async (c) => {
+        const { invitationId } = c.req.param();
+        const result = await run(c, (context) => runtime.revokeInvitation(context, invitationId));
+        return result instanceof Response ? result : c.body(null, 204);
     });
-    routes.openapi(setTeamMemberAccessRoute, async (c) => {
-        const context = await resolveContext(c);
-        if (context instanceof Response)
-            return context;
-        const input = await parseJsonBody(c, accessSchema);
-        try {
-            return c.json({
-                data: await setCloudAdminMemberAccess({
-                    ...context,
-                    membershipId: c.req.param("membershipId"),
-                    hasAccess: input.hasAccess,
-                }),
-            });
-        }
-        catch (error) {
-            return handleError(c, error);
-        }
+    routes.openapi(updateRoleRoute, async (c) => {
+        const { memberId } = c.req.param();
+        const input = await parseJsonBody(c, roleSchema);
+        const result = await run(c, (context) => runtime.updateMemberRole(context, memberId, input.roleId));
+        return result instanceof Response ? result : c.json({ data: result });
     });
-    routes.openapi(setTeamMemberPermissionsRoute, async (c) => {
-        const context = await resolveContext(c);
-        if (context instanceof Response)
-            return context;
-        const input = await parseJsonBody(c, permissionsSchema);
-        try {
-            return c.json({
-                data: await setCloudAdminMemberPermissions({
-                    ...context,
-                    membershipId: c.req.param("membershipId"),
-                    permissions: input.permissions,
-                }),
-            });
-        }
-        catch (error) {
-            return handleError(c, error);
-        }
+    routes.openapi(deactivateMemberRoute, async (c) => {
+        const { memberId } = c.req.param();
+        const result = await run(c, (context) => runtime.deactivateMember(context, memberId));
+        return result instanceof Response ? result : c.json({ data: result });
+    });
+    routes.openapi(activateMemberRoute, async (c) => {
+        const { memberId } = c.req.param();
+        const result = await run(c, (context) => runtime.activateMember(context, memberId));
+        return result instanceof Response ? result : c.json({ data: result });
     });
     return routes;
 }

package/dist/team-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"team-routes.js","sourceRoot":"","sources":["../src/team-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAiB,MAAM,qBAAqB,CAAA;AACzF,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAGhC,OAAO,EAEL,sBAAsB,EACtB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,mBAAmB,CAAA;AAU1B,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAA;AACF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AACzD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACjE,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,oCAAoC,CAAA;AAC3D,MAAM,QAAQ,GAAG,CAAyB,MAAS,EAAE,EAAE,CAAC,CAAC;IACvD,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE;CAC5C,CAAC,CAAA;AACF,MAAM,SAAS,GAAG,CAAC,GAAG,QAAkB,EAAE,EAAE,CAC1C,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;AAC3F,MAAM,SAAS,GAAG,CAAgE,MAMjF,EAAE,EAAE,CACH,WAAW,CAAC;IACV,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,WAAW,EAAE,MAAM,CAAC,WAAW;IAC/B,iBAAiB,EAAE,cAAc;IACjC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;CACzC,CAAC,CAAA;AAEJ,MAAM,gBAAgB,GAAG,SAAS,CAAC;IACjC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,iBAAiB;IAC9B,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,cAAc,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,eAAe;IAC5B,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,wBAAwB,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,qBAAqB;IAClC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,yBAAyB,GAAG,SAAS,CAAC;IAC1C,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,sBAAsB;IACnC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;IACzC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACzC,CAAC,CAAA;AACF,MAAM,yBAAyB,GAAG,SAAS,CAAC;IAC1C,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,sBAAsB;IACnC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;IAC3D,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,wBAAwB,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,gCAAgC;IACtC,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE;QACP,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC;KAC7B;IACD,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACzC,CAAC,CAAA;AACF,MAAM,6BAA6B,GAAG,SAAS,CAAC;IAC9C,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,qCAAqC;IAC3C,WAAW,EAAE,0BAA0B;IACvC,OAAO,EAAE;QACP,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC;KAClC;IACD,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACzC,CAAC,CAAA;AAEF,KAAK,UAAU,yBAAyB,CAAC,EAAY,EAAE,MAAc;IACnE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;SACnE,IAAI,CAAC,kBAAkB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC5C,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,OAAO,IAAI,EAAE,iBAAiB,IAAI,IAAI,CAAA;AACxC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAsC;IAC1E,MAAM,MAAM,GAAG,IAAI,WAAW,CAAoB,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAEzF,MAAM,cAAc,GAAG,KAAK,EAAE,CAAmB,EAAmC,EAAE;QACpF,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACnD,IAAI,UAAU,CAAC,QAAQ,KAAK,cAAc;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAEtF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QAC1D,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,GAAG,CAAC,CAAA;QACnF,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;QAC/E,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5E,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,CAAA;IACrE,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,CAAC,CAAmB,EAAE,KAAc,EAAY,EAAE;QACpE,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;YAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,MAAa,CAAC,CAAA;QAC9E,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;QAClD,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QACnF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,IAAI,CAAC;YACH,MAAM,0BAA0B,CAAC;gBAC/B,GAAG,OAAO;gBACV,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC;aAC1C,CAAC,CAAA;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;QAClD,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,MAAM,yBAAyB,CAAC;oBACpC,GAAG,OAAO;oBACV,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC;oBACzC,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC;aACH,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAA;QACvD,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,MAAM,8BAA8B,CAAC;oBACzC,GAAG,OAAO;oBACV,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC;oBACzC,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B,CAAC;aACH,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC","sourcesContent":["import { createRoute, OpenAPIHono, z } from \"@hono/zod-openapi\"\nimport { cloudAuthUserLinks } from \"@voyant-travel/db/schema/iam\"\nimport { openApiValidationHook, parseJsonBody, type VoyantDb } from \"@voyant-travel/hono\"\nimport { eq } from \"drizzle-orm\"\nimport type { Context } from \"hono\"\n\nimport {\n  type CloudAdminMembersConfig,\n  CloudAdminMembersError,\n  inviteCloudAdminMember,\n  listCloudAdminInvitations,\n  listCloudAdminMemberRoles,\n  listCloudAdminMembers,\n  revokeCloudAdminInvitation,\n  setCloudAdminMemberAccess,\n  setCloudAdminMemberPermissions,\n} from \"./cloud-broker.js\"\nimport type { IdentityAccessRuntimeProvider } from \"./identity-access-runtime-port.js\"\n\ntype IdentityAccessEnv = {\n  Bindings: Record<string, unknown>\n  Variables: { userId?: string; db: VoyantDb }\n}\ntype TeamContext = { config: CloudAdminMembersConfig; actingWorkosUserId: string }\ntype TeamRouteContext = Context<IdentityAccessEnv>\n\nconst inviteSchema = z.object({\n  email: z.string().email(),\n  roleSlug: z.string().trim().min(1).max(120).optional().nullable(),\n  expiresInDays: z.number().int().min(1).max(30).optional(),\n})\nconst accessSchema = z.object({ hasAccess: z.boolean() })\nconst permissionsSchema = z.object({\n  permissions: z.array(z.string().trim().min(1).max(120)).max(200),\n})\n\nconst teamAdminApiId = \"@voyant-travel/auth#team.api.admin\"\nconst jsonBody = <T extends z.ZodTypeAny>(schema: T) => ({\n  required: true,\n  content: { \"application/json\": { schema } },\n})\nconst responses = (...statuses: number[]) =>\n  Object.fromEntries(statuses.map((status) => [status, { description: `HTTP ${status}` }]))\nconst teamRoute = <M extends \"get\" | \"post\" | \"put\" | \"delete\", P extends string>(config: {\n  method: M\n  path: P\n  operationId: string\n  request?: Record<string, unknown>\n  statuses: number[]\n}) =>\n  createRoute({\n    method: config.method,\n    path: config.path,\n    operationId: config.operationId,\n    \"x-voyant-api-id\": teamAdminApiId,\n    ...(config.request ? { request: config.request } : {}),\n    responses: responses(...config.statuses),\n  })\n\nconst listMembersRoute = teamRoute({\n  method: \"get\",\n  path: \"/members\",\n  operationId: \"listTeamMembers\",\n  statuses: [200, 401, 403, 404, 501],\n})\nconst listRolesRoute = teamRoute({\n  method: \"get\",\n  path: \"/roles\",\n  operationId: \"listTeamRoles\",\n  statuses: [200, 401, 403, 404, 501],\n})\nconst listTeamInvitationsRoute = teamRoute({\n  method: \"get\",\n  path: \"/invitations\",\n  operationId: \"listTeamInvitations\",\n  statuses: [200, 401, 403, 404, 501],\n})\nconst createTeamInvitationRoute = teamRoute({\n  method: \"post\",\n  path: \"/invitations\",\n  operationId: \"createTeamInvitation\",\n  request: { body: jsonBody(inviteSchema) },\n  statuses: [201, 400, 401, 403, 404, 501],\n})\nconst revokeTeamInvitationRoute = teamRoute({\n  method: \"delete\",\n  path: \"/invitations/{invitationId}\",\n  operationId: \"revokeTeamInvitation\",\n  request: { params: z.object({ invitationId: z.string() }) },\n  statuses: [204, 401, 403, 404, 501],\n})\nconst setTeamMemberAccessRoute = teamRoute({\n  method: \"put\",\n  path: \"/members/{membershipId}/access\",\n  operationId: \"setTeamMemberAccess\",\n  request: {\n    params: z.object({ membershipId: z.string() }),\n    body: jsonBody(accessSchema),\n  },\n  statuses: [200, 400, 401, 403, 404, 501],\n})\nconst setTeamMemberPermissionsRoute = teamRoute({\n  method: \"put\",\n  path: \"/members/{membershipId}/permissions\",\n  operationId: \"setTeamMemberPermissions\",\n  request: {\n    params: z.object({ membershipId: z.string() }),\n    body: jsonBody(permissionsSchema),\n  },\n  statuses: [200, 400, 401, 403, 404, 501],\n})\n\nasync function resolveActingWorkosUserId(db: VoyantDb, userId: string): Promise<string | null> {\n  const [link] = await db\n    .select({ providerAccountId: cloudAuthUserLinks.providerAccountId })\n    .from(cloudAuthUserLinks)\n    .where(eq(cloudAuthUserLinks.userId, userId))\n    .limit(1)\n  return link?.providerAccountId ?? null\n}\n\nexport function createTeamAdminRoutes(runtime: IdentityAccessRuntimeProvider) {\n  const routes = new OpenAPIHono<IdentityAccessEnv>({ defaultHook: openApiValidationHook })\n\n  const resolveContext = async (c: TeamRouteContext): Promise<TeamContext | Response> => {\n    const deployment = runtime.resolveDeployment(c.env)\n    if (deployment.authMode !== \"voyant-cloud\") return c.json({ error: \"Not found\" }, 404)\n\n    const userId = c.get(\"userId\")\n    if (!userId) return c.json({ error: \"Unauthorized\" }, 401)\n    if (!deployment.cloudAdminMembers) {\n      return c.json({ error: \"Voyant Cloud member management is not configured\" }, 501)\n    }\n\n    const actingWorkosUserId = await resolveActingWorkosUserId(c.get(\"db\"), userId)\n    if (!actingWorkosUserId) {\n      return c.json({ error: \"No Voyant Cloud identity for this session\" }, 403)\n    }\n    return { config: deployment.cloudAdminMembers, actingWorkosUserId }\n  }\n\n  const handleError = (c: TeamRouteContext, error: unknown): Response => {\n    if (error instanceof CloudAdminMembersError) {\n      return c.json({ error: error.reason ?? error.message }, error.status as 403)\n    }\n    throw error\n  }\n\n  routes.openapi(listMembersRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    try {\n      return c.json({ data: await listCloudAdminMembers(context) })\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n  routes.openapi(listRolesRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    try {\n      return c.json({ data: await listCloudAdminMemberRoles(context) })\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n  routes.openapi(listTeamInvitationsRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    try {\n      return c.json({ data: await listCloudAdminInvitations(context) })\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n  routes.openapi(createTeamInvitationRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    const input = await parseJsonBody(c, inviteSchema)\n    try {\n      return c.json({ data: await inviteCloudAdminMember({ ...context, input }) }, 201)\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n  routes.openapi(revokeTeamInvitationRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    try {\n      await revokeCloudAdminInvitation({\n        ...context,\n        invitationId: c.req.param(\"invitationId\"),\n      })\n      return c.body(null, 204)\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n  routes.openapi(setTeamMemberAccessRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    const input = await parseJsonBody(c, accessSchema)\n    try {\n      return c.json({\n        data: await setCloudAdminMemberAccess({\n          ...context,\n          membershipId: c.req.param(\"membershipId\"),\n          hasAccess: input.hasAccess,\n        }),\n      })\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n  routes.openapi(setTeamMemberPermissionsRoute, async (c) => {\n    const context = await resolveContext(c)\n    if (context instanceof Response) return context\n    const input = await parseJsonBody(c, permissionsSchema)\n    try {\n      return c.json({\n        data: await setCloudAdminMemberPermissions({\n          ...context,\n          membershipId: c.req.param(\"membershipId\"),\n          permissions: input.permissions,\n        }),\n      })\n    } catch (error) {\n      return handleError(c, error)\n    }\n  })\n\n  return routes\n}\n"]}
+{"version":3,"file":"team-routes.js","sourceRoot":"","sources":["../src/team-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAiB,MAAM,qBAAqB,CAAA;AAGzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAYjE,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAA;AACF,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AAE1E,MAAM,cAAc,GAAG,oCAAoC,CAAA;AAC3D,MAAM,QAAQ,GAAG,CAAyB,MAAS,EAAE,EAAE,CAAC,CAAC;IACvD,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE;CAC5C,CAAC,CAAA;AACF,MAAM,SAAS,GAAG,CAAC,GAAG,QAAkB,EAAE,EAAE,CAC1C,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;AAC3F,MAAM,SAAS,GAAG,CAAgE,MAMjF,EAAE,EAAE,CACH,WAAW,CAAC;IACV,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,WAAW,EAAE,MAAM,CAAC,WAAW;IAC/B,iBAAiB,EAAE,cAAc;IACjC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;CACzC,CAAC,CAAA;AAEJ,MAAM,iBAAiB,GAAG,SAAS,CAAC;IAClC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,+BAA+B;IAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,gBAAgB,GAAG,SAAS,CAAC;IACjC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,iBAAiB;IAC9B,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,cAAc,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,eAAe;IAC5B,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,oBAAoB,GAAG,SAAS,CAAC;IACrC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,qBAAqB;IAClC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,qBAAqB,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,sBAAsB;IACnC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE;IACzC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC9C,CAAC,CAAA;AACF,MAAM,qBAAqB,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,sBAAsB;IACnC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;IAC3D,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,eAAe,GAAG,SAAS,CAAC;IAChC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,sBAAsB;IACnC,OAAO,EAAE;QACP,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC;KAC3B;IACD,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC9C,CAAC,CAAA;AACF,MAAM,qBAAqB,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,sBAAsB;IACnC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;IACvD,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACzC,CAAC,CAAA;AACF,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACpC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,gCAAgC;IACtC,WAAW,EAAE,oBAAoB;IACjC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE;IACvD,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACzC,CAAC,CAAA;AAEF,SAAS,cAAc,CAAC,CAAmB;IACzC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;IAC1D,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,CAAmB,EAAE,KAAc;IACtD,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACzE,CAAC;IACD,IACE,KAAK,YAAY,KAAK;QACtB,QAAQ,IAAI,KAAK;QACjB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,KAAK,CAAC,MAAM,IAAI,GAAG,EACnB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,MAAa,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,KAAK,CAAA;AACb,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAsC;IAC1E,MAAM,MAAM,GAAG,IAAI,WAAW,CAAU,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAE/E,MAAM,GAAG,GAAG,KAAK,EACf,CAAmB,EACnB,SAAgE,EACzC,EAAE;QACzB,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QACjC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QAC1E,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA;QACtE,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QACpE,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QAC1E,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;QAC9E,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACzF,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CACtC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAC1D,CAAA;QACD,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;QACrF,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;QACnF,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC","sourcesContent":["import { createRoute, OpenAPIHono, z } from \"@hono/zod-openapi\"\nimport { openApiValidationHook, parseJsonBody, type VoyantDb } from \"@voyant-travel/hono\"\nimport type { Context } from \"hono\"\n\nimport { TeamManagementError } from \"./team-management-policy.js\"\nimport type {\n  TeamManagementRequestContext,\n  TeamManagementRuntimeProvider,\n} from \"./team-management-runtime-port.js\"\n\ntype TeamEnv = {\n  Bindings: Record<string, unknown>\n  Variables: { userId?: string; db: VoyantDb }\n}\ntype TeamRouteContext = Context<TeamEnv>\n\nconst inviteSchema = z.object({\n  email: z.string().email(),\n  roleId: z.string().trim().min(1).max(120),\n  expiresInDays: z.number().int().min(1).max(30).optional(),\n})\nconst roleSchema = z.object({ roleId: z.string().trim().min(1).max(120) })\n\nconst teamAdminApiId = \"@voyant-travel/auth#team.api.admin\"\nconst jsonBody = <T extends z.ZodTypeAny>(schema: T) => ({\n  required: true,\n  content: { \"application/json\": { schema } },\n})\nconst responses = (...statuses: number[]) =>\n  Object.fromEntries(statuses.map((status) => [status, { description: `HTTP ${status}` }]))\nconst teamRoute = <M extends \"get\" | \"post\" | \"put\" | \"delete\", P extends string>(config: {\n  method: M\n  path: P\n  operationId: string\n  request?: Record<string, unknown>\n  statuses: number[]\n}) =>\n  createRoute({\n    method: config.method,\n    path: config.path,\n    operationId: config.operationId,\n    \"x-voyant-api-id\": teamAdminApiId,\n    ...(config.request ? { request: config.request } : {}),\n    responses: responses(...config.statuses),\n  })\n\nconst capabilitiesRoute = teamRoute({\n  method: \"get\",\n  path: \"/capabilities\",\n  operationId: \"getTeamManagementCapabilities\",\n  statuses: [200, 401, 403, 501],\n})\nconst listMembersRoute = teamRoute({\n  method: \"get\",\n  path: \"/members\",\n  operationId: \"listTeamMembers\",\n  statuses: [200, 401, 403, 501],\n})\nconst listRolesRoute = teamRoute({\n  method: \"get\",\n  path: \"/roles\",\n  operationId: \"listTeamRoles\",\n  statuses: [200, 401, 403, 501],\n})\nconst listInvitationsRoute = teamRoute({\n  method: \"get\",\n  path: \"/invitations\",\n  operationId: \"listTeamInvitations\",\n  statuses: [200, 401, 403, 501],\n})\nconst createInvitationRoute = teamRoute({\n  method: \"post\",\n  path: \"/invitations\",\n  operationId: \"createTeamInvitation\",\n  request: { body: jsonBody(inviteSchema) },\n  statuses: [201, 400, 401, 403, 404, 409, 501],\n})\nconst revokeInvitationRoute = teamRoute({\n  method: \"delete\",\n  path: \"/invitations/{invitationId}\",\n  operationId: \"revokeTeamInvitation\",\n  request: { params: z.object({ invitationId: z.string() }) },\n  statuses: [204, 401, 403, 404, 501],\n})\nconst updateRoleRoute = teamRoute({\n  method: \"put\",\n  path: \"/members/{memberId}/role\",\n  operationId: \"updateTeamMemberRole\",\n  request: {\n    params: z.object({ memberId: z.string() }),\n    body: jsonBody(roleSchema),\n  },\n  statuses: [200, 400, 401, 403, 404, 409, 501],\n})\nconst deactivateMemberRoute = teamRoute({\n  method: \"delete\",\n  path: \"/members/{memberId}\",\n  operationId: \"deactivateTeamMember\",\n  request: { params: z.object({ memberId: z.string() }) },\n  statuses: [200, 401, 403, 404, 409, 501],\n})\nconst activateMemberRoute = teamRoute({\n  method: \"put\",\n  path: \"/members/{memberId}/activation\",\n  operationId: \"activateTeamMember\",\n  request: { params: z.object({ memberId: z.string() }) },\n  statuses: [200, 401, 403, 404, 409, 501],\n})\n\nfunction requestContext(c: TeamRouteContext): TeamManagementRequestContext | Response {\n  const userId = c.get(\"userId\")\n  if (!userId) return c.json({ error: \"Unauthorized\" }, 401)\n  return { bindings: c.env, db: c.get(\"db\"), userId }\n}\n\nfunction handleError(c: TeamRouteContext, error: unknown): Response {\n  if (error instanceof TeamManagementError) {\n    return c.json({ error: error.message, code: error.code }, error.status)\n  }\n  if (\n    error instanceof Error &&\n    \"status\" in error &&\n    typeof error.status === \"number\" &&\n    error.status >= 400 &&\n    error.status <= 599\n  ) {\n    return c.json({ error: error.message }, error.status as 400)\n  }\n  throw error\n}\n\nexport function createTeamAdminRoutes(runtime: TeamManagementRuntimeProvider) {\n  const routes = new OpenAPIHono<TeamEnv>({ defaultHook: openApiValidationHook })\n\n  const run = async <T>(\n    c: TeamRouteContext,\n    operation: (context: TeamManagementRequestContext) => Promise<T>,\n  ): Promise<T | Response> => {\n    const context = requestContext(c)\n    if (context instanceof Response) return context\n    try {\n      return await operation(context)\n    } catch (error) {\n      return handleError(c, error)\n    }\n  }\n\n  routes.openapi(capabilitiesRoute, async (c) => {\n    const result = await run(c, (context) => runtime.getCapabilities(context))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n  routes.openapi(listMembersRoute, async (c) => {\n    const result = await run(c, (context) => runtime.listMembers(context))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n  routes.openapi(listRolesRoute, async (c) => {\n    const result = await run(c, (context) => runtime.listRoles(context))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n  routes.openapi(listInvitationsRoute, async (c) => {\n    const result = await run(c, (context) => runtime.listInvitations(context))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n  routes.openapi(createInvitationRoute, async (c) => {\n    const input = await parseJsonBody(c, inviteSchema)\n    const result = await run(c, (context) => runtime.inviteMember(context, input))\n    return result instanceof Response ? result : c.json({ data: result }, 201)\n  })\n  routes.openapi(revokeInvitationRoute, async (c) => {\n    const { invitationId } = c.req.param()\n    const result = await run(c, (context) => runtime.revokeInvitation(context, invitationId))\n    return result instanceof Response ? result : c.body(null, 204)\n  })\n  routes.openapi(updateRoleRoute, async (c) => {\n    const { memberId } = c.req.param()\n    const input = await parseJsonBody(c, roleSchema)\n    const result = await run(c, (context) =>\n      runtime.updateMemberRole(context, memberId, input.roleId),\n    )\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n  routes.openapi(deactivateMemberRoute, async (c) => {\n    const { memberId } = c.req.param()\n    const result = await run(c, (context) => runtime.deactivateMember(context, memberId))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n  routes.openapi(activateMemberRoute, async (c) => {\n    const { memberId } = c.req.param()\n    const result = await run(c, (context) => runtime.activateMember(context, memberId))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n\n  return routes\n}\n"]}

package/dist/tools.d.ts

@@ -0,0 +1,58 @@
+import { type ToolContext } from "@voyant-travel/tools";
+import type { CreatedTeamInvitationDto, InviteTeamMemberInput, TeamInvitationDto, TeamManagementCapabilitiesDto, TeamMemberDto, TeamRoleDto } from "./team-management-runtime-port.js";
+export interface TeamManagementToolServices {
+    getCapabilities(): Promise<TeamManagementCapabilitiesDto>;
+    listMembers(): Promise<TeamMemberDto[]>;
+    listRoles(): Promise<TeamRoleDto[]>;
+    listInvitations(): Promise<TeamInvitationDto[]>;
+    inviteMember(input: InviteTeamMemberInput): Promise<CreatedTeamInvitationDto>;
+    revokeInvitation(invitationId: string): Promise<void>;
+    updateMemberRole(memberId: string, roleId: string): Promise<TeamMemberDto>;
+    activateMember(memberId: string): Promise<TeamMemberDto>;
+    deactivateMember(memberId: string): Promise<TeamMemberDto>;
+}
+export type TeamManagementToolContext = ToolContext & {
+    teamManagement?: TeamManagementToolServices;
+};
+export declare const getTeamManagementCapabilitiesTool: import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamManagementCapabilitiesDto, TeamManagementToolContext>;
+export declare const listTeamMembersTool: import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamMemberDto[], TeamManagementToolContext>;
+export declare const listTeamRolesTool: import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamRoleDto[], TeamManagementToolContext>;
+export declare const listTeamInvitationsTool: import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamInvitationDto[], TeamManagementToolContext>;
+export declare const inviteTeamMemberTool: import("@voyant-travel/tools").ToolDefinition<{
+    email: string;
+    roleId: string;
+    expiresInDays?: number | undefined;
+}, TeamInvitationDto, TeamManagementToolContext>;
+export declare const revokeTeamInvitationTool: import("@voyant-travel/tools").ToolDefinition<{
+    invitationId: string;
+}, {
+    invitationId: string;
+    revoked: true;
+}, TeamManagementToolContext>;
+export declare const updateTeamMemberRoleTool: import("@voyant-travel/tools").ToolDefinition<{
+    memberId: string;
+    roleId: string;
+}, TeamMemberDto, TeamManagementToolContext>;
+export declare const activateTeamMemberTool: import("@voyant-travel/tools").ToolDefinition<{
+    memberId: string;
+}, TeamMemberDto, TeamManagementToolContext>;
+export declare const deactivateTeamMemberTool: import("@voyant-travel/tools").ToolDefinition<{
+    memberId: string;
+}, TeamMemberDto, TeamManagementToolContext>;
+export declare const teamManagementTools: readonly [import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamManagementCapabilitiesDto, TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamMemberDto[], TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamRoleDto[], TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamInvitationDto[], TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<{
+    email: string;
+    roleId: string;
+    expiresInDays?: number | undefined;
+}, TeamInvitationDto, TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<{
+    invitationId: string;
+}, {
+    invitationId: string;
+    revoked: true;
+}, TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<{
+    memberId: string;
+    roleId: string;
+}, TeamMemberDto, TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<{
+    memberId: string;
+}, TeamMemberDto, TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<{
+    memberId: string;
+}, TeamMemberDto, TeamManagementToolContext>];

package/dist/tools.js

@@ -0,0 +1,226 @@
+import { defineTool, READ_ONLY_RISK, requireService, ToolError, } from "@voyant-travel/tools";
+import { z } from "zod";
+const teamMemberSchema = z.object({
+    id: z.string(),
+    email: z.string().email().nullable(),
+    name: z.string().nullable(),
+    roleId: z.string(),
+    roleName: z.string(),
+    status: z.enum(["active", "deactivated"]),
+    joinedAt: z.string().nullable(),
+    lastActivityAt: z.string().nullable(),
+});
+const teamRoleSchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    description: z.string().nullable(),
+});
+const teamInvitationSchema = z.object({
+    id: z.string(),
+    email: z.string().email(),
+    roleId: z.string(),
+    roleName: z.string(),
+    status: z.enum(["pending", "accepted", "expired", "revoked"]),
+    createdAt: z.string(),
+    expiresAt: z.string(),
+});
+const teamManagementCapabilitiesSchema = z.object({
+    viewRoster: z.boolean(),
+    inviteMembers: z.boolean(),
+    manageRoles: z.boolean(),
+    activateMembers: z.boolean(),
+    deactivateMembers: z.boolean(),
+    revokeInvitations: z.boolean(),
+});
+const emptyInputSchema = z.object({});
+const inviteTeamMemberInputSchema = z.object({
+    email: z.string().email().describe("Email address for the new team member."),
+    roleId: z.string().trim().min(1).max(120).describe("Provider-neutral team role id."),
+    expiresInDays: z
+        .number()
+        .int()
+        .min(1)
+        .max(30)
+        .optional()
+        .describe("Invitation validity in days. Uses the deployment default when omitted."),
+});
+const invitationIdInputSchema = z.object({
+    invitationId: z.string().min(1).describe("Team invitation id."),
+});
+const memberIdInputSchema = z.object({
+    memberId: z.string().min(1).describe("Team member id."),
+});
+const updateMemberRoleInputSchema = memberIdInputSchema.extend({
+    roleId: z.string().trim().min(1).max(120).describe("Provider-neutral team role id."),
+});
+const actingUserRequirement = " Requires an authenticated acting staff user; organization-only grants are rejected.";
+function teamManagement(ctx) {
+    if (ctx.actor !== "staff" || ctx.audience !== "staff") {
+        throw new ToolError("Team-management tools are restricted to staff grants.", "AUTHORIZATION_DENIED", {
+            actor: ctx.actor,
+            audience: ctx.audience,
+        });
+    }
+    return requireService(ctx.teamManagement, "teamManagement");
+}
+export const getTeamManagementCapabilitiesTool = defineTool({
+    name: "get_team_management_capabilities",
+    description: "Read the current staff user's provider-neutral team-management capabilities." +
+        actingUserRequirement,
+    inputSchema: emptyInputSchema,
+    outputSchema: teamManagementCapabilitiesSchema,
+    requiredScopes: ["team:read"],
+    tier: "read",
+    riskPolicy: READ_ONLY_RISK,
+    async handler(_input, ctx) {
+        return teamManagement(ctx).getCapabilities();
+    },
+});
+export const listTeamMembersTool = defineTool({
+    name: "list_team_members",
+    description: "List the staff team roster and access status. Contains personal information." +
+        actingUserRequirement,
+    inputSchema: emptyInputSchema,
+    outputSchema: z.array(teamMemberSchema),
+    requiredScopes: ["team:read"],
+    tier: "sensitive",
+    riskPolicy: READ_ONLY_RISK,
+    async handler(_input, ctx) {
+        return teamManagement(ctx).listMembers();
+    },
+});
+export const listTeamRolesTool = defineTool({
+    name: "list_team_roles",
+    description: "List the provider-neutral roles assignable to team members. Read-only." +
+        actingUserRequirement,
+    inputSchema: emptyInputSchema,
+    outputSchema: z.array(teamRoleSchema),
+    requiredScopes: ["team:read"],
+    tier: "read",
+    riskPolicy: READ_ONLY_RISK,
+    async handler(_input, ctx) {
+        return teamManagement(ctx).listRoles();
+    },
+});
+export const listTeamInvitationsTool = defineTool({
+    name: "list_team_invitations",
+    description: "List team invitations and their lifecycle status. Contains personal information." +
+        actingUserRequirement,
+    inputSchema: emptyInputSchema,
+    outputSchema: z.array(teamInvitationSchema),
+    requiredScopes: ["team:read"],
+    tier: "sensitive",
+    riskPolicy: READ_ONLY_RISK,
+    async handler(_input, ctx) {
+        return teamManagement(ctx).listInvitations();
+    },
+});
+export const inviteTeamMemberTool = defineTool({
+    name: "invite_team_member",
+    description: "Invite a staff team member with an assigned role. Sends an external invitation and requires explicit confirmation." +
+        actingUserRequirement,
+    inputSchema: inviteTeamMemberInputSchema,
+    outputSchema: teamInvitationSchema,
+    requiredScopes: ["team:write"],
+    tier: "destructive",
+    riskPolicy: {
+        destructive: true,
+        reversible: false,
+        dryRunSupported: false,
+        confirmationRequired: true,
+        sideEffects: ["email", "data-write"],
+    },
+    async handler(input, ctx) {
+        const { acceptUrl: _acceptUrl, ...invitation } = await teamManagement(ctx).inviteMember(input);
+        return invitation;
+    },
+});
+export const revokeTeamInvitationTool = defineTool({
+    name: "revoke_team_invitation",
+    description: "Revoke a pending team invitation. Invalidates its acceptance path and requires confirmation." +
+        actingUserRequirement,
+    inputSchema: invitationIdInputSchema,
+    outputSchema: z.object({ invitationId: z.string(), revoked: z.literal(true) }),
+    requiredScopes: ["team:delete"],
+    tier: "destructive",
+    riskPolicy: {
+        destructive: true,
+        reversible: false,
+        dryRunSupported: false,
+        confirmationRequired: true,
+        sideEffects: ["data-delete"],
+    },
+    async handler({ invitationId }, ctx) {
+        await teamManagement(ctx).revokeInvitation(invitationId);
+        return { invitationId, revoked: true };
+    },
+});
+export const updateTeamMemberRoleTool = defineTool({
+    name: "update_team_member_role",
+    description: "Change a team member's role and effective access. Requires explicit confirmation." +
+        actingUserRequirement,
+    inputSchema: updateMemberRoleInputSchema,
+    outputSchema: teamMemberSchema,
+    requiredScopes: ["team:write"],
+    tier: "sensitive",
+    riskPolicy: {
+        destructive: false,
+        reversible: true,
+        dryRunSupported: false,
+        confirmationRequired: true,
+        sideEffects: ["data-write"],
+    },
+    async handler({ memberId, roleId }, ctx) {
+        return teamManagement(ctx).updateMemberRole(memberId, roleId);
+    },
+});
+export const activateTeamMemberTool = defineTool({
+    name: "activate_team_member",
+    description: "Restore a team member's deployment access. Requires explicit confirmation." +
+        actingUserRequirement,
+    inputSchema: memberIdInputSchema,
+    outputSchema: teamMemberSchema,
+    requiredScopes: ["team:write"],
+    tier: "sensitive",
+    riskPolicy: {
+        destructive: false,
+        reversible: true,
+        dryRunSupported: false,
+        confirmationRequired: true,
+        sideEffects: ["data-write"],
+    },
+    async handler({ memberId }, ctx) {
+        return teamManagement(ctx).activateMember(memberId);
+    },
+});
+export const deactivateTeamMemberTool = defineTool({
+    name: "deactivate_team_member",
+    description: "Remove a team member's deployment access and potentially revoke active credentials. Requires explicit confirmation." +
+        actingUserRequirement,
+    inputSchema: memberIdInputSchema,
+    outputSchema: teamMemberSchema,
+    requiredScopes: ["team:delete"],
+    tier: "destructive",
+    riskPolicy: {
+        destructive: true,
+        reversible: false,
+        dryRunSupported: false,
+        confirmationRequired: true,
+        sideEffects: ["data-write", "data-delete"],
+    },
+    async handler({ memberId }, ctx) {
+        return teamManagement(ctx).deactivateMember(memberId);
+    },
+});
+export const teamManagementTools = [
+    getTeamManagementCapabilitiesTool,
+    listTeamMembersTool,
+    listTeamRolesTool,
+    listTeamInvitationsTool,
+    inviteTeamMemberTool,
+    revokeTeamInvitationTool,
+    updateTeamMemberRoleTool,
+    activateTeamMemberTool,
+    deactivateTeamMemberTool,
+];
+//# sourceMappingURL=tools.js.map