@voyant-travel/auth 0.130.0 → 0.131.0

package/dist/mcp-runtime.d.ts

@@ -0,0 +1,9 @@
+export * from "./tools.js";
+/**
+ * The guarded team runtime uses a concrete acting user for authorization,
+ * self-mutation prevention, and last-owner invariants. Organization identity is
+ * not a user identity and must never be promoted into one. Until an MCP grant
+ * carries an explicit delegated user or service principal understood by this
+ * port, organization-only API keys fail closed here.
+ */
+export declare const voyantToolContextContribution: import("@voyant-travel/tools").ToolContextContribution;

package/dist/mcp-runtime.js

@@ -0,0 +1,38 @@
+import { defineToolContextContribution, requireService, ToolError } from "@voyant-travel/tools";
+import { teamManagementRuntimePort } from "./team-management-runtime-port.js";
+export * from "./tools.js";
+/**
+ * The guarded team runtime uses a concrete acting user for authorization,
+ * self-mutation prevention, and last-owner invariants. Organization identity is
+ * not a user identity and must never be promoted into one. Until an MCP grant
+ * carries an explicit delegated user or service principal understood by this
+ * port, organization-only API keys fail closed here.
+ */
+export const voyantToolContextContribution = defineToolContextContribution({
+    context: ["teamManagement"],
+    async contribute({ request, context, resources }) {
+        if (context.actor !== "staff" || context.audience !== "staff") {
+            throw new ToolError("Team-management tools are restricted to staff grants.", "AUTHORIZATION_DENIED", { actor: context.actor, audience: context.audience });
+        }
+        const c = request;
+        const userId = c.get("userId");
+        if (!userId) {
+            throw new ToolError("Team management requires an authenticated acting user.", "AUTHORIZATION_DENIED");
+        }
+        const runtime = requireService(resources[teamManagementRuntimePort.id], teamManagementRuntimePort.id);
+        const runtimeContext = { bindings: c.env, db: c.get("db"), userId };
+        const teamManagement = {
+            getCapabilities: () => runtime.getCapabilities(runtimeContext),
+            listMembers: () => runtime.listMembers(runtimeContext),
+            listRoles: () => runtime.listRoles(runtimeContext),
+            listInvitations: () => runtime.listInvitations(runtimeContext),
+            inviteMember: (input) => runtime.inviteMember(runtimeContext, input),
+            revokeInvitation: (invitationId) => runtime.revokeInvitation(runtimeContext, invitationId),
+            updateMemberRole: (memberId, roleId) => runtime.updateMemberRole(runtimeContext, memberId, roleId),
+            activateMember: (memberId) => runtime.activateMember(runtimeContext, memberId),
+            deactivateMember: (memberId) => runtime.deactivateMember(runtimeContext, memberId),
+        };
+        return { teamManagement };
+    },
+});
+//# sourceMappingURL=mcp-runtime.js.map

package/dist/mcp-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-runtime.js","sourceRoot":"","sources":["../src/mcp-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAG/F,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAG7E,cAAc,YAAY,CAAA;AAO1B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,6BAA6B,CAAC;IACzE,OAAO,EAAE,CAAC,gBAAgB,CAAC;IAC3B,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE;QAC9C,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC9D,MAAM,IAAI,SAAS,CACjB,uDAAuD,EACvD,sBAAsB,EACtB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CACrD,CAAA;QACH,CAAC;QAED,MAAM,CAAC,GAAG,OAAyB,CAAA;QACnC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CACjB,wDAAwD,EACxD,sBAAsB,CACvB,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,cAAc,CAC5B,SAAS,CAAC,yBAAyB,CAAC,EAAE,CAEzB,EACb,yBAAyB,CAAC,EAAE,CAC7B,CAAA;QACD,MAAM,cAAc,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;QACnE,MAAM,cAAc,GAA+B;YACjD,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;YAC9D,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC;YACtD,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC;YAClD,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC;YAC9D,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC;YACpE,gBAAgB,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,cAAc,EAAE,YAAY,CAAC;YAC1F,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CACrC,OAAO,CAAC,gBAAgB,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC;YAC5D,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC;YAC9E,gBAAgB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,cAAc,EAAE,QAAQ,CAAC;SACnF,CAAA;QACD,OAAO,EAAE,cAAc,EAAE,CAAA;IAC3B,CAAC;CACF,CAAC,CAAA","sourcesContent":["import { defineToolContextContribution, requireService, ToolError } from \"@voyant-travel/tools\"\nimport type { Context } from \"hono\"\n\nimport { teamManagementRuntimePort } from \"./team-management-runtime-port.js\"\nimport type { TeamManagementToolServices } from \"./tools.js\"\n\nexport * from \"./tools.js\"\n\ntype TeamMcpContext = Context<{\n  Bindings: Record<string, unknown>\n  Variables: { db: import(\"@voyant-travel/hono\").VoyantDb; userId?: string }\n}>\n\n/**\n * The guarded team runtime uses a concrete acting user for authorization,\n * self-mutation prevention, and last-owner invariants. Organization identity is\n * not a user identity and must never be promoted into one. Until an MCP grant\n * carries an explicit delegated user or service principal understood by this\n * port, organization-only API keys fail closed here.\n */\nexport const voyantToolContextContribution = defineToolContextContribution({\n  context: [\"teamManagement\"],\n  async contribute({ request, context, resources }) {\n    if (context.actor !== \"staff\" || context.audience !== \"staff\") {\n      throw new ToolError(\n        \"Team-management tools are restricted to staff grants.\",\n        \"AUTHORIZATION_DENIED\",\n        { actor: context.actor, audience: context.audience },\n      )\n    }\n\n    const c = request as TeamMcpContext\n    const userId = c.get(\"userId\")\n    if (!userId) {\n      throw new ToolError(\n        \"Team management requires an authenticated acting user.\",\n        \"AUTHORIZATION_DENIED\",\n      )\n    }\n\n    const runtime = requireService(\n      resources[teamManagementRuntimePort.id] as\n        | import(\"./team-management-runtime-port.js\").TeamManagementRuntimeProvider\n        | undefined,\n      teamManagementRuntimePort.id,\n    )\n    const runtimeContext = { bindings: c.env, db: c.get(\"db\"), userId }\n    const teamManagement: TeamManagementToolServices = {\n      getCapabilities: () => runtime.getCapabilities(runtimeContext),\n      listMembers: () => runtime.listMembers(runtimeContext),\n      listRoles: () => runtime.listRoles(runtimeContext),\n      listInvitations: () => runtime.listInvitations(runtimeContext),\n      inviteMember: (input) => runtime.inviteMember(runtimeContext, input),\n      revokeInvitation: (invitationId) => runtime.revokeInvitation(runtimeContext, invitationId),\n      updateMemberRole: (memberId, roleId) =>\n        runtime.updateMemberRole(runtimeContext, memberId, roleId),\n      activateMember: (memberId) => runtime.activateMember(runtimeContext, memberId),\n      deactivateMember: (memberId) => runtime.deactivateMember(runtimeContext, memberId),\n    }\n    return { teamManagement }\n  },\n})\n"]}

package/dist/tools.d.ts

@@ -0,0 +1,58 @@
+import { type ToolContext } from "@voyant-travel/tools";
+import type { CreatedTeamInvitationDto, InviteTeamMemberInput, TeamInvitationDto, TeamManagementCapabilitiesDto, TeamMemberDto, TeamRoleDto } from "./team-management-runtime-port.js";
+export interface TeamManagementToolServices {
+    getCapabilities(): Promise<TeamManagementCapabilitiesDto>;
+    listMembers(): Promise<TeamMemberDto[]>;
+    listRoles(): Promise<TeamRoleDto[]>;
+    listInvitations(): Promise<TeamInvitationDto[]>;
+    inviteMember(input: InviteTeamMemberInput): Promise<CreatedTeamInvitationDto>;
+    revokeInvitation(invitationId: string): Promise<void>;
+    updateMemberRole(memberId: string, roleId: string): Promise<TeamMemberDto>;
+    activateMember(memberId: string): Promise<TeamMemberDto>;
+    deactivateMember(memberId: string): Promise<TeamMemberDto>;
+}
+export type TeamManagementToolContext = ToolContext & {
+    teamManagement?: TeamManagementToolServices;
+};
+export declare const getTeamManagementCapabilitiesTool: import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamManagementCapabilitiesDto, TeamManagementToolContext>;
+export declare const listTeamMembersTool: import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamMemberDto[], TeamManagementToolContext>;
+export declare const listTeamRolesTool: import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamRoleDto[], TeamManagementToolContext>;
+export declare const listTeamInvitationsTool: import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamInvitationDto[], TeamManagementToolContext>;
+export declare const inviteTeamMemberTool: import("@voyant-travel/tools").ToolDefinition<{
+    email: string;
+    roleId: string;
+    expiresInDays?: number | undefined;
+}, TeamInvitationDto, TeamManagementToolContext>;
+export declare const revokeTeamInvitationTool: import("@voyant-travel/tools").ToolDefinition<{
+    invitationId: string;
+}, {
+    invitationId: string;
+    revoked: true;
+}, TeamManagementToolContext>;
+export declare const updateTeamMemberRoleTool: import("@voyant-travel/tools").ToolDefinition<{
+    memberId: string;
+    roleId: string;
+}, TeamMemberDto, TeamManagementToolContext>;
+export declare const activateTeamMemberTool: import("@voyant-travel/tools").ToolDefinition<{
+    memberId: string;
+}, TeamMemberDto, TeamManagementToolContext>;
+export declare const deactivateTeamMemberTool: import("@voyant-travel/tools").ToolDefinition<{
+    memberId: string;
+}, TeamMemberDto, TeamManagementToolContext>;
+export declare const teamManagementTools: readonly [import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamManagementCapabilitiesDto, TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamMemberDto[], TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamRoleDto[], TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<Record<string, never>, TeamInvitationDto[], TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<{
+    email: string;
+    roleId: string;
+    expiresInDays?: number | undefined;
+}, TeamInvitationDto, TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<{
+    invitationId: string;
+}, {
+    invitationId: string;
+    revoked: true;
+}, TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<{
+    memberId: string;
+    roleId: string;
+}, TeamMemberDto, TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<{
+    memberId: string;
+}, TeamMemberDto, TeamManagementToolContext>, import("@voyant-travel/tools").ToolDefinition<{
+    memberId: string;
+}, TeamMemberDto, TeamManagementToolContext>];

package/dist/tools.js

@@ -0,0 +1,226 @@
+import { defineTool, READ_ONLY_RISK, requireService, ToolError, } from "@voyant-travel/tools";
+import { z } from "zod";
+const teamMemberSchema = z.object({
+    id: z.string(),
+    email: z.string().email().nullable(),
+    name: z.string().nullable(),
+    roleId: z.string(),
+    roleName: z.string(),
+    status: z.enum(["active", "deactivated"]),
+    joinedAt: z.string().nullable(),
+    lastActivityAt: z.string().nullable(),
+});
+const teamRoleSchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    description: z.string().nullable(),
+});
+const teamInvitationSchema = z.object({
+    id: z.string(),
+    email: z.string().email(),
+    roleId: z.string(),
+    roleName: z.string(),
+    status: z.enum(["pending", "accepted", "expired", "revoked"]),
+    createdAt: z.string(),
+    expiresAt: z.string(),
+});
+const teamManagementCapabilitiesSchema = z.object({
+    viewRoster: z.boolean(),
+    inviteMembers: z.boolean(),
+    manageRoles: z.boolean(),
+    activateMembers: z.boolean(),
+    deactivateMembers: z.boolean(),
+    revokeInvitations: z.boolean(),
+});
+const emptyInputSchema = z.object({});
+const inviteTeamMemberInputSchema = z.object({
+    email: z.string().email().describe("Email address for the new team member."),
+    roleId: z.string().trim().min(1).max(120).describe("Provider-neutral team role id."),
+    expiresInDays: z
+        .number()
+        .int()
+        .min(1)
+        .max(30)
+        .optional()
+        .describe("Invitation validity in days. Uses the deployment default when omitted."),
+});
+const invitationIdInputSchema = z.object({
+    invitationId: z.string().min(1).describe("Team invitation id."),
+});
+const memberIdInputSchema = z.object({
+    memberId: z.string().min(1).describe("Team member id."),
+});
+const updateMemberRoleInputSchema = memberIdInputSchema.extend({
+    roleId: z.string().trim().min(1).max(120).describe("Provider-neutral team role id."),
+});
+const actingUserRequirement = " Requires an authenticated acting staff user; organization-only grants are rejected.";
+function teamManagement(ctx) {
+    if (ctx.actor !== "staff" || ctx.audience !== "staff") {
+        throw new ToolError("Team-management tools are restricted to staff grants.", "AUTHORIZATION_DENIED", {
+            actor: ctx.actor,
+            audience: ctx.audience,
+        });
+    }
+    return requireService(ctx.teamManagement, "teamManagement");
+}
+export const getTeamManagementCapabilitiesTool = defineTool({
+    name: "get_team_management_capabilities",
+    description: "Read the current staff user's provider-neutral team-management capabilities." +
+        actingUserRequirement,
+    inputSchema: emptyInputSchema,
+    outputSchema: teamManagementCapabilitiesSchema,
+    requiredScopes: ["team:read"],
+    tier: "read",
+    riskPolicy: READ_ONLY_RISK,
+    async handler(_input, ctx) {
+        return teamManagement(ctx).getCapabilities();
+    },
+});
+export const listTeamMembersTool = defineTool({
+    name: "list_team_members",
+    description: "List the staff team roster and access status. Contains personal information." +
+        actingUserRequirement,
+    inputSchema: emptyInputSchema,
+    outputSchema: z.array(teamMemberSchema),
+    requiredScopes: ["team:read"],
+    tier: "sensitive",
+    riskPolicy: READ_ONLY_RISK,
+    async handler(_input, ctx) {
+        return teamManagement(ctx).listMembers();
+    },
+});
+export const listTeamRolesTool = defineTool({
+    name: "list_team_roles",
+    description: "List the provider-neutral roles assignable to team members. Read-only." +
+        actingUserRequirement,
+    inputSchema: emptyInputSchema,
+    outputSchema: z.array(teamRoleSchema),
+    requiredScopes: ["team:read"],
+    tier: "read",
+    riskPolicy: READ_ONLY_RISK,
+    async handler(_input, ctx) {
+        return teamManagement(ctx).listRoles();
+    },
+});
+export const listTeamInvitationsTool = defineTool({
+    name: "list_team_invitations",
+    description: "List team invitations and their lifecycle status. Contains personal information." +
+        actingUserRequirement,
+    inputSchema: emptyInputSchema,
+    outputSchema: z.array(teamInvitationSchema),
+    requiredScopes: ["team:read"],
+    tier: "sensitive",
+    riskPolicy: READ_ONLY_RISK,
+    async handler(_input, ctx) {
+        return teamManagement(ctx).listInvitations();
+    },
+});
+export const inviteTeamMemberTool = defineTool({
+    name: "invite_team_member",
+    description: "Invite a staff team member with an assigned role. Sends an external invitation and requires explicit confirmation." +
+        actingUserRequirement,
+    inputSchema: inviteTeamMemberInputSchema,
+    outputSchema: teamInvitationSchema,
+    requiredScopes: ["team:write"],
+    tier: "destructive",
+    riskPolicy: {
+        destructive: true,
+        reversible: false,
+        dryRunSupported: false,
+        confirmationRequired: true,
+        sideEffects: ["email", "data-write"],
+    },
+    async handler(input, ctx) {
+        const { acceptUrl: _acceptUrl, ...invitation } = await teamManagement(ctx).inviteMember(input);
+        return invitation;
+    },
+});
+export const revokeTeamInvitationTool = defineTool({
+    name: "revoke_team_invitation",
+    description: "Revoke a pending team invitation. Invalidates its acceptance path and requires confirmation." +
+        actingUserRequirement,
+    inputSchema: invitationIdInputSchema,
+    outputSchema: z.object({ invitationId: z.string(), revoked: z.literal(true) }),
+    requiredScopes: ["team:delete"],
+    tier: "destructive",
+    riskPolicy: {
+        destructive: true,
+        reversible: false,
+        dryRunSupported: false,
+        confirmationRequired: true,
+        sideEffects: ["data-delete"],
+    },
+    async handler({ invitationId }, ctx) {
+        await teamManagement(ctx).revokeInvitation(invitationId);
+        return { invitationId, revoked: true };
+    },
+});
+export const updateTeamMemberRoleTool = defineTool({
+    name: "update_team_member_role",
+    description: "Change a team member's role and effective access. Requires explicit confirmation." +
+        actingUserRequirement,
+    inputSchema: updateMemberRoleInputSchema,
+    outputSchema: teamMemberSchema,
+    requiredScopes: ["team:write"],
+    tier: "sensitive",
+    riskPolicy: {
+        destructive: false,
+        reversible: true,
+        dryRunSupported: false,
+        confirmationRequired: true,
+        sideEffects: ["data-write"],
+    },
+    async handler({ memberId, roleId }, ctx) {
+        return teamManagement(ctx).updateMemberRole(memberId, roleId);
+    },
+});
+export const activateTeamMemberTool = defineTool({
+    name: "activate_team_member",
+    description: "Restore a team member's deployment access. Requires explicit confirmation." +
+        actingUserRequirement,
+    inputSchema: memberIdInputSchema,
+    outputSchema: teamMemberSchema,
+    requiredScopes: ["team:write"],
+    tier: "sensitive",
+    riskPolicy: {
+        destructive: false,
+        reversible: true,
+        dryRunSupported: false,
+        confirmationRequired: true,
+        sideEffects: ["data-write"],
+    },
+    async handler({ memberId }, ctx) {
+        return teamManagement(ctx).activateMember(memberId);
+    },
+});
+export const deactivateTeamMemberTool = defineTool({
+    name: "deactivate_team_member",
+    description: "Remove a team member's deployment access and potentially revoke active credentials. Requires explicit confirmation." +
+        actingUserRequirement,
+    inputSchema: memberIdInputSchema,
+    outputSchema: teamMemberSchema,
+    requiredScopes: ["team:delete"],
+    tier: "destructive",
+    riskPolicy: {
+        destructive: true,
+        reversible: false,
+        dryRunSupported: false,
+        confirmationRequired: true,
+        sideEffects: ["data-write", "data-delete"],
+    },
+    async handler({ memberId }, ctx) {
+        return teamManagement(ctx).deactivateMember(memberId);
+    },
+});
+export const teamManagementTools = [
+    getTeamManagementCapabilitiesTool,
+    listTeamMembersTool,
+    listTeamRolesTool,
+    listTeamInvitationsTool,
+    inviteTeamMemberTool,
+    revokeTeamInvitationTool,
+    updateTeamMemberRoleTool,
+    activateTeamMemberTool,
+    deactivateTeamMemberTool,
+];
+//# sourceMappingURL=tools.js.map

package/dist/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,cAAc,EACd,cAAc,EAEd,SAAS,GACV,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAWvB,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAA;AAEF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAA;AAEF,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;CAC/B,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AACrC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IAC5E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IACpF,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CAAC,wEAAwE,CAAC;CACtF,CAAC,CAAA;AACF,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;CAChE,CAAC,CAAA;AACF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;CACxD,CAAC,CAAA;AACF,MAAM,2BAA2B,GAAG,mBAAmB,CAAC,MAAM,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC;CACrF,CAAC,CAAA;AAEF,MAAM,qBAAqB,GACzB,sFAAsF,CAAA;AAkBxF,SAAS,cAAc,CAAC,GAA8B;IACpD,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CACjB,uDAAuD,EACvD,sBAAsB,EACtB;YACE,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CACF,CAAA;IACH,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAA;AAC7D,CAAC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,UAAU,CAIzD;IACA,IAAI,EAAE,kCAAkC;IACxC,WAAW,EACT,8EAA8E;QAC9E,qBAAqB;IACvB,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,gCAAgC;IAC9C,cAAc,EAAE,CAAC,WAAW,CAAC;IAC7B,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,cAAc;IAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG;QACvB,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,CAAA;IAC9C,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAI3C;IACA,IAAI,EAAE,mBAAmB;IACzB,WAAW,EACT,8EAA8E;QAC9E,qBAAqB;IACvB,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACvC,cAAc,EAAE,CAAC,WAAW,CAAC;IAC7B,IAAI,EAAE,WAAW;IACjB,UAAU,EAAE,cAAc;IAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG;QACvB,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IAC1C,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAIzC;IACA,IAAI,EAAE,iBAAiB;IACvB,WAAW,EACT,wEAAwE;QACxE,qBAAqB;IACvB,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IACrC,cAAc,EAAE,CAAC,WAAW,CAAC;IAC7B,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,cAAc;IAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG;QACvB,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,CAAA;IACxC,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,UAAU,CAI/C;IACA,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EACT,kFAAkF;QAClF,qBAAqB;IACvB,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAC3C,cAAc,EAAE,CAAC,WAAW,CAAC;IAC7B,IAAI,EAAE,WAAW;IACjB,UAAU,EAAE,cAAc;IAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG;QACvB,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,CAAA;IAC9C,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAI5C;IACA,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EACT,oHAAoH;QACpH,qBAAqB;IACvB,WAAW,EAAE,2BAA2B;IACxC,YAAY,EAAE,oBAAoB;IAClC,cAAc,EAAE,CAAC,YAAY,CAAC;IAC9B,IAAI,EAAE,aAAa;IACnB,UAAU,EAAE;QACV,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,KAAK;QACjB,eAAe,EAAE,KAAK;QACtB,oBAAoB,EAAE,IAAI;QAC1B,WAAW,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC;KACrC;IACD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QAC9F,OAAO,UAAU,CAAA;IACnB,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAIhD;IACA,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EACT,8FAA8F;QAC9F,qBAAqB;IACvB,WAAW,EAAE,uBAAuB;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9E,cAAc,EAAE,CAAC,aAAa,CAAC;IAC/B,IAAI,EAAE,aAAa;IACnB,UAAU,EAAE;QACV,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,KAAK;QACjB,eAAe,EAAE,KAAK;QACtB,oBAAoB,EAAE,IAAI;QAC1B,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B;IACD,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG;QACjC,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAA;QACxD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACxC,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAIhD;IACA,IAAI,EAAE,yBAAyB;IAC/B,WAAW,EACT,mFAAmF;QACnF,qBAAqB;IACvB,WAAW,EAAE,2BAA2B;IACxC,YAAY,EAAE,gBAAgB;IAC9B,cAAc,EAAE,CAAC,YAAY,CAAC;IAC9B,IAAI,EAAE,WAAW;IACjB,UAAU,EAAE;QACV,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,IAAI;QAChB,eAAe,EAAE,KAAK;QACtB,oBAAoB,EAAE,IAAI;QAC1B,WAAW,EAAE,CAAC,YAAY,CAAC;KAC5B;IACD,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG;QACrC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC/D,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAI9C;IACA,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,4EAA4E;QAC5E,qBAAqB;IACvB,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,gBAAgB;IAC9B,cAAc,EAAE,CAAC,YAAY,CAAC;IAC9B,IAAI,EAAE,WAAW;IACjB,UAAU,EAAE;QACV,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,IAAI;QAChB,eAAe,EAAE,KAAK;QACtB,oBAAoB,EAAE,IAAI;QAC1B,WAAW,EAAE,CAAC,YAAY,CAAC;KAC5B;IACD,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG;QAC7B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;IACrD,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAIhD;IACA,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EACT,qHAAqH;QACrH,qBAAqB;IACvB,WAAW,EAAE,mBAAmB;IAChC,YAAY,EAAE,gBAAgB;IAC9B,cAAc,EAAE,CAAC,aAAa,CAAC;IAC/B,IAAI,EAAE,aAAa;IACnB,UAAU,EAAE;QACV,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,KAAK;QACjB,eAAe,EAAE,KAAK;QACtB,oBAAoB,EAAE,IAAI;QAC1B,WAAW,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;KAC3C;IACD,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG;QAC7B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACvD,CAAC;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,iCAAiC;IACjC,mBAAmB;IACnB,iBAAiB;IACjB,uBAAuB;IACvB,oBAAoB;IACpB,wBAAwB;IACxB,wBAAwB;IACxB,sBAAsB;IACtB,wBAAwB;CAChB,CAAA","sourcesContent":["import {\n  defineTool,\n  READ_ONLY_RISK,\n  requireService,\n  type ToolContext,\n  ToolError,\n} from \"@voyant-travel/tools\"\nimport { z } from \"zod\"\n\nimport type {\n  CreatedTeamInvitationDto,\n  InviteTeamMemberInput,\n  TeamInvitationDto,\n  TeamManagementCapabilitiesDto,\n  TeamMemberDto,\n  TeamRoleDto,\n} from \"./team-management-runtime-port.js\"\n\nconst teamMemberSchema = z.object({\n  id: z.string(),\n  email: z.string().email().nullable(),\n  name: z.string().nullable(),\n  roleId: z.string(),\n  roleName: z.string(),\n  status: z.enum([\"active\", \"deactivated\"]),\n  joinedAt: z.string().nullable(),\n  lastActivityAt: z.string().nullable(),\n})\n\nconst teamRoleSchema = z.object({\n  id: z.string(),\n  name: z.string(),\n  description: z.string().nullable(),\n})\n\nconst teamInvitationSchema = z.object({\n  id: z.string(),\n  email: z.string().email(),\n  roleId: z.string(),\n  roleName: z.string(),\n  status: z.enum([\"pending\", \"accepted\", \"expired\", \"revoked\"]),\n  createdAt: z.string(),\n  expiresAt: z.string(),\n})\n\nconst teamManagementCapabilitiesSchema = z.object({\n  viewRoster: z.boolean(),\n  inviteMembers: z.boolean(),\n  manageRoles: z.boolean(),\n  activateMembers: z.boolean(),\n  deactivateMembers: z.boolean(),\n  revokeInvitations: z.boolean(),\n})\n\nconst emptyInputSchema = z.object({})\nconst inviteTeamMemberInputSchema = z.object({\n  email: z.string().email().describe(\"Email address for the new team member.\"),\n  roleId: z.string().trim().min(1).max(120).describe(\"Provider-neutral team role id.\"),\n  expiresInDays: z\n    .number()\n    .int()\n    .min(1)\n    .max(30)\n    .optional()\n    .describe(\"Invitation validity in days. Uses the deployment default when omitted.\"),\n})\nconst invitationIdInputSchema = z.object({\n  invitationId: z.string().min(1).describe(\"Team invitation id.\"),\n})\nconst memberIdInputSchema = z.object({\n  memberId: z.string().min(1).describe(\"Team member id.\"),\n})\nconst updateMemberRoleInputSchema = memberIdInputSchema.extend({\n  roleId: z.string().trim().min(1).max(120).describe(\"Provider-neutral team role id.\"),\n})\n\nconst actingUserRequirement =\n  \" Requires an authenticated acting staff user; organization-only grants are rejected.\"\n\nexport interface TeamManagementToolServices {\n  getCapabilities(): Promise<TeamManagementCapabilitiesDto>\n  listMembers(): Promise<TeamMemberDto[]>\n  listRoles(): Promise<TeamRoleDto[]>\n  listInvitations(): Promise<TeamInvitationDto[]>\n  inviteMember(input: InviteTeamMemberInput): Promise<CreatedTeamInvitationDto>\n  revokeInvitation(invitationId: string): Promise<void>\n  updateMemberRole(memberId: string, roleId: string): Promise<TeamMemberDto>\n  activateMember(memberId: string): Promise<TeamMemberDto>\n  deactivateMember(memberId: string): Promise<TeamMemberDto>\n}\n\nexport type TeamManagementToolContext = ToolContext & {\n  teamManagement?: TeamManagementToolServices\n}\n\nfunction teamManagement(ctx: TeamManagementToolContext): TeamManagementToolServices {\n  if (ctx.actor !== \"staff\" || ctx.audience !== \"staff\") {\n    throw new ToolError(\n      \"Team-management tools are restricted to staff grants.\",\n      \"AUTHORIZATION_DENIED\",\n      {\n        actor: ctx.actor,\n        audience: ctx.audience,\n      },\n    )\n  }\n  return requireService(ctx.teamManagement, \"teamManagement\")\n}\n\nexport const getTeamManagementCapabilitiesTool = defineTool<\n  z.infer<typeof emptyInputSchema>,\n  TeamManagementCapabilitiesDto,\n  TeamManagementToolContext\n>({\n  name: \"get_team_management_capabilities\",\n  description:\n    \"Read the current staff user's provider-neutral team-management capabilities.\" +\n    actingUserRequirement,\n  inputSchema: emptyInputSchema,\n  outputSchema: teamManagementCapabilitiesSchema,\n  requiredScopes: [\"team:read\"],\n  tier: \"read\",\n  riskPolicy: READ_ONLY_RISK,\n  async handler(_input, ctx) {\n    return teamManagement(ctx).getCapabilities()\n  },\n})\n\nexport const listTeamMembersTool = defineTool<\n  z.infer<typeof emptyInputSchema>,\n  TeamMemberDto[],\n  TeamManagementToolContext\n>({\n  name: \"list_team_members\",\n  description:\n    \"List the staff team roster and access status. Contains personal information.\" +\n    actingUserRequirement,\n  inputSchema: emptyInputSchema,\n  outputSchema: z.array(teamMemberSchema),\n  requiredScopes: [\"team:read\"],\n  tier: \"sensitive\",\n  riskPolicy: READ_ONLY_RISK,\n  async handler(_input, ctx) {\n    return teamManagement(ctx).listMembers()\n  },\n})\n\nexport const listTeamRolesTool = defineTool<\n  z.infer<typeof emptyInputSchema>,\n  TeamRoleDto[],\n  TeamManagementToolContext\n>({\n  name: \"list_team_roles\",\n  description:\n    \"List the provider-neutral roles assignable to team members. Read-only.\" +\n    actingUserRequirement,\n  inputSchema: emptyInputSchema,\n  outputSchema: z.array(teamRoleSchema),\n  requiredScopes: [\"team:read\"],\n  tier: \"read\",\n  riskPolicy: READ_ONLY_RISK,\n  async handler(_input, ctx) {\n    return teamManagement(ctx).listRoles()\n  },\n})\n\nexport const listTeamInvitationsTool = defineTool<\n  z.infer<typeof emptyInputSchema>,\n  TeamInvitationDto[],\n  TeamManagementToolContext\n>({\n  name: \"list_team_invitations\",\n  description:\n    \"List team invitations and their lifecycle status. Contains personal information.\" +\n    actingUserRequirement,\n  inputSchema: emptyInputSchema,\n  outputSchema: z.array(teamInvitationSchema),\n  requiredScopes: [\"team:read\"],\n  tier: \"sensitive\",\n  riskPolicy: READ_ONLY_RISK,\n  async handler(_input, ctx) {\n    return teamManagement(ctx).listInvitations()\n  },\n})\n\nexport const inviteTeamMemberTool = defineTool<\n  z.infer<typeof inviteTeamMemberInputSchema>,\n  TeamInvitationDto,\n  TeamManagementToolContext\n>({\n  name: \"invite_team_member\",\n  description:\n    \"Invite a staff team member with an assigned role. Sends an external invitation and requires explicit confirmation.\" +\n    actingUserRequirement,\n  inputSchema: inviteTeamMemberInputSchema,\n  outputSchema: teamInvitationSchema,\n  requiredScopes: [\"team:write\"],\n  tier: \"destructive\",\n  riskPolicy: {\n    destructive: true,\n    reversible: false,\n    dryRunSupported: false,\n    confirmationRequired: true,\n    sideEffects: [\"email\", \"data-write\"],\n  },\n  async handler(input, ctx) {\n    const { acceptUrl: _acceptUrl, ...invitation } = await teamManagement(ctx).inviteMember(input)\n    return invitation\n  },\n})\n\nexport const revokeTeamInvitationTool = defineTool<\n  z.infer<typeof invitationIdInputSchema>,\n  { invitationId: string; revoked: true },\n  TeamManagementToolContext\n>({\n  name: \"revoke_team_invitation\",\n  description:\n    \"Revoke a pending team invitation. Invalidates its acceptance path and requires confirmation.\" +\n    actingUserRequirement,\n  inputSchema: invitationIdInputSchema,\n  outputSchema: z.object({ invitationId: z.string(), revoked: z.literal(true) }),\n  requiredScopes: [\"team:delete\"],\n  tier: \"destructive\",\n  riskPolicy: {\n    destructive: true,\n    reversible: false,\n    dryRunSupported: false,\n    confirmationRequired: true,\n    sideEffects: [\"data-delete\"],\n  },\n  async handler({ invitationId }, ctx) {\n    await teamManagement(ctx).revokeInvitation(invitationId)\n    return { invitationId, revoked: true }\n  },\n})\n\nexport const updateTeamMemberRoleTool = defineTool<\n  z.infer<typeof updateMemberRoleInputSchema>,\n  TeamMemberDto,\n  TeamManagementToolContext\n>({\n  name: \"update_team_member_role\",\n  description:\n    \"Change a team member's role and effective access. Requires explicit confirmation.\" +\n    actingUserRequirement,\n  inputSchema: updateMemberRoleInputSchema,\n  outputSchema: teamMemberSchema,\n  requiredScopes: [\"team:write\"],\n  tier: \"sensitive\",\n  riskPolicy: {\n    destructive: false,\n    reversible: true,\n    dryRunSupported: false,\n    confirmationRequired: true,\n    sideEffects: [\"data-write\"],\n  },\n  async handler({ memberId, roleId }, ctx) {\n    return teamManagement(ctx).updateMemberRole(memberId, roleId)\n  },\n})\n\nexport const activateTeamMemberTool = defineTool<\n  z.infer<typeof memberIdInputSchema>,\n  TeamMemberDto,\n  TeamManagementToolContext\n>({\n  name: \"activate_team_member\",\n  description:\n    \"Restore a team member's deployment access. Requires explicit confirmation.\" +\n    actingUserRequirement,\n  inputSchema: memberIdInputSchema,\n  outputSchema: teamMemberSchema,\n  requiredScopes: [\"team:write\"],\n  tier: \"sensitive\",\n  riskPolicy: {\n    destructive: false,\n    reversible: true,\n    dryRunSupported: false,\n    confirmationRequired: true,\n    sideEffects: [\"data-write\"],\n  },\n  async handler({ memberId }, ctx) {\n    return teamManagement(ctx).activateMember(memberId)\n  },\n})\n\nexport const deactivateTeamMemberTool = defineTool<\n  z.infer<typeof memberIdInputSchema>,\n  TeamMemberDto,\n  TeamManagementToolContext\n>({\n  name: \"deactivate_team_member\",\n  description:\n    \"Remove a team member's deployment access and potentially revoke active credentials. Requires explicit confirmation.\" +\n    actingUserRequirement,\n  inputSchema: memberIdInputSchema,\n  outputSchema: teamMemberSchema,\n  requiredScopes: [\"team:delete\"],\n  tier: \"destructive\",\n  riskPolicy: {\n    destructive: true,\n    reversible: false,\n    dryRunSupported: false,\n    confirmationRequired: true,\n    sideEffects: [\"data-write\", \"data-delete\"],\n  },\n  async handler({ memberId }, ctx) {\n    return teamManagement(ctx).deactivateMember(memberId)\n  },\n})\n\nexport const teamManagementTools = [\n  getTeamManagementCapabilitiesTool,\n  listTeamMembersTool,\n  listTeamRolesTool,\n  listTeamInvitationsTool,\n  inviteTeamMemberTool,\n  revokeTeamInvitationTool,\n  updateTeamMemberRoleTool,\n  activateTeamMemberTool,\n  deactivateTeamMemberTool,\n] as const\n"]}

package/dist/voyant.js

@@ -42,7 +42,13 @@ export const authInvitationsVoyantModule = defineModule({
             },
         },
     ],
-    meta: { ownership: "package" },
+    meta: {
+        ownership: "package",
+        agentTools: {
+            posture: "not-applicable",
+            rationale: "This unit owns public invitation acceptance; staff invitation management is exposed by the guarded auth team runtime.",
+        },
+    },
 });
 export const authTeamVoyantModule = defineModule({
     id: "@voyant-travel/auth#team",
@@ -71,6 +77,7 @@ export const authTeamVoyantModule = defineModule({
                 resource: "team",
                 label: "Team",
                 description: "Manage staff team members and their access.",
+                wildcard: "explicit-resource",
                 actions: [
                     {
                         action: "read",
@@ -80,18 +87,231 @@ export const authTeamVoyantModule = defineModule({
                     {
                         action: "write",
                         label: "Manage team",
-                        description: "Create and update staff team members.",
+                        description: "Invite staff and update roles or access.",
+                        sensitive: true,
+                        wildcard: "explicit",
                     },
                     {
                         action: "delete",
-                        label: "Delete team members",
-                        description: "Delete staff team members.",
+                        label: "Remove team access",
+                        description: "Revoke invitations or deactivate staff team members.",
                         sensitive: true,
+                        wildcard: "explicit",
                     },
                 ],
             },
         ],
     },
+    tools: [
+        {
+            id: "@voyant-travel/auth#team.tool.get-capabilities",
+            name: "get_team_management_capabilities",
+            runtime: {
+                entry: "@voyant-travel/auth/tools",
+                export: "getTeamManagementCapabilitiesTool",
+            },
+            requiredScopes: ["team:read"],
+            context: ["teamManagement"],
+            risk: "low",
+        },
+        {
+            id: "@voyant-travel/auth#team.tool.list-members",
+            name: "list_team_members",
+            runtime: { entry: "@voyant-travel/auth/tools", export: "listTeamMembersTool" },
+            requiredScopes: ["team:read"],
+            context: ["teamManagement"],
+            risk: "high",
+        },
+        {
+            id: "@voyant-travel/auth#team.tool.list-roles",
+            name: "list_team_roles",
+            runtime: { entry: "@voyant-travel/auth/tools", export: "listTeamRolesTool" },
+            requiredScopes: ["team:read"],
+            context: ["teamManagement"],
+            risk: "low",
+        },
+        {
+            id: "@voyant-travel/auth#team.tool.list-invitations",
+            name: "list_team_invitations",
+            runtime: { entry: "@voyant-travel/auth/tools", export: "listTeamInvitationsTool" },
+            requiredScopes: ["team:read"],
+            context: ["teamManagement"],
+            risk: "high",
+        },
+        {
+            id: "@voyant-travel/auth#team.tool.invite-member",
+            name: "invite_team_member",
+            runtime: { entry: "@voyant-travel/auth/tools", export: "inviteTeamMemberTool" },
+            requiredScopes: ["team:write"],
+            context: ["teamManagement"],
+            risk: "high",
+        },
+        {
+            id: "@voyant-travel/auth#team.tool.revoke-invitation",
+            name: "revoke_team_invitation",
+            runtime: { entry: "@voyant-travel/auth/tools", export: "revokeTeamInvitationTool" },
+            requiredScopes: ["team:delete"],
+            context: ["teamManagement"],
+            risk: "high",
+        },
+        {
+            id: "@voyant-travel/auth#team.tool.update-member-role",
+            name: "update_team_member_role",
+            runtime: { entry: "@voyant-travel/auth/tools", export: "updateTeamMemberRoleTool" },
+            requiredScopes: ["team:write"],
+            context: ["teamManagement"],
+            risk: "high",
+        },
+        {
+            id: "@voyant-travel/auth#team.tool.activate-member",
+            name: "activate_team_member",
+            runtime: { entry: "@voyant-travel/auth/tools", export: "activateTeamMemberTool" },
+            requiredScopes: ["team:write"],
+            context: ["teamManagement"],
+            risk: "high",
+        },
+        {
+            id: "@voyant-travel/auth#team.tool.deactivate-member",
+            name: "deactivate_team_member",
+            runtime: { entry: "@voyant-travel/auth/tools", export: "deactivateTeamMemberTool" },
+            requiredScopes: ["team:delete"],
+            context: ["teamManagement"],
+            risk: "high",
+        },
+    ],
+    actions: [
+        {
+            id: "@voyant-travel/auth#team.action.get-capabilities",
+            version: "v1",
+            kind: "read",
+            targetType: "team-capabilities",
+            resource: "team",
+            action: "read",
+            requiredScopes: ["team:read"],
+            risk: "low",
+            ledger: "optional",
+            approval: "never",
+            allowedActorTypes: ["staff"],
+            from: { tools: ["@voyant-travel/auth#team.tool.get-capabilities"] },
+        },
+        {
+            id: "@voyant-travel/auth#team.action.list-members",
+            version: "v1",
+            kind: "sensitive-read",
+            targetType: "team-member",
+            resource: "team",
+            action: "read",
+            requiredScopes: ["team:read"],
+            risk: "high",
+            ledger: "required",
+            approval: "never",
+            allowedActorTypes: ["staff"],
+            from: { tools: ["@voyant-travel/auth#team.tool.list-members"] },
+        },
+        {
+            id: "@voyant-travel/auth#team.action.list-roles",
+            version: "v1",
+            kind: "read",
+            targetType: "team-role",
+            resource: "team",
+            action: "read",
+            requiredScopes: ["team:read"],
+            risk: "low",
+            ledger: "optional",
+            approval: "never",
+            allowedActorTypes: ["staff"],
+            from: { tools: ["@voyant-travel/auth#team.tool.list-roles"] },
+        },
+        {
+            id: "@voyant-travel/auth#team.action.list-invitations",
+            version: "v1",
+            kind: "sensitive-read",
+            targetType: "team-invitation",
+            resource: "team",
+            action: "read",
+            requiredScopes: ["team:read"],
+            risk: "high",
+            ledger: "required",
+            approval: "never",
+            allowedActorTypes: ["staff"],
+            from: { tools: ["@voyant-travel/auth#team.tool.list-invitations"] },
+        },
+        {
+            id: "@voyant-travel/auth#team.action.invite-member",
+            version: "v1",
+            kind: "execute",
+            targetType: "team-invitation",
+            resource: "team",
+            action: "write",
+            requiredScopes: ["team:write"],
+            risk: "high",
+            ledger: "required",
+            approval: "required",
+            reversible: false,
+            allowedActorTypes: ["staff"],
+            from: { tools: ["@voyant-travel/auth#team.tool.invite-member"] },
+        },
+        {
+            id: "@voyant-travel/auth#team.action.revoke-invitation",
+            version: "v1",
+            kind: "execute",
+            targetType: "team-invitation",
+            resource: "team",
+            action: "delete",
+            requiredScopes: ["team:delete"],
+            risk: "high",
+            ledger: "required",
+            approval: "required",
+            reversible: false,
+            allowedActorTypes: ["staff"],
+            from: { tools: ["@voyant-travel/auth#team.tool.revoke-invitation"] },
+        },
+        {
+            id: "@voyant-travel/auth#team.action.update-member-role",
+            version: "v1",
+            kind: "execute",
+            targetType: "team-member",
+            resource: "team",
+            action: "write",
+            requiredScopes: ["team:write"],
+            risk: "high",
+            ledger: "required",
+            approval: "required",
+            reversible: true,
+            allowedActorTypes: ["staff"],
+            from: { tools: ["@voyant-travel/auth#team.tool.update-member-role"] },
+        },
+        {
+            id: "@voyant-travel/auth#team.action.activate-member",
+            version: "v1",
+            kind: "execute",
+            targetType: "team-member",
+            resource: "team",
+            action: "write",
+            requiredScopes: ["team:write"],
+            risk: "high",
+            ledger: "required",
+            approval: "required",
+            reversible: true,
+            allowedActorTypes: ["staff"],
+            from: { tools: ["@voyant-travel/auth#team.tool.activate-member"] },
+        },
+        {
+            id: "@voyant-travel/auth#team.action.deactivate-member",
+            version: "v1",
+            kind: "execute",
+            targetType: "team-member",
+            resource: "team",
+            action: "delete",
+            requiredScopes: ["team:delete"],
+            risk: "high",
+            ledger: "required",
+            approval: "required",
+            reversible: false,
+            allowedActorTypes: ["staff"],
+            from: { tools: ["@voyant-travel/auth#team.tool.deactivate-member"] },
+        },
+    ],
     admin: {
         compositionOrder: 5,
         setupSteps: [{ id: "@voyant-travel/auth#setup.team", skippable: true }],
@@ -122,6 +342,8 @@ export const authTeamVoyantModule = defineModule({
             },
         ],
     },
-    meta: { ownership: "package" },
+    meta: {
+        ownership: "package",
+    },
 });
 //# sourceMappingURL=voyant.js.map

package/dist/voyant.js.map

@@ -1 +1 @@
-{"version":3,"file":"voyant.js","sourceRoot":"","sources":["../src/voyant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAEpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAE7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;IACtD,EAAE,EAAE,iCAAiC;IACrC,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,EAAE;IAC7D,YAAY,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IACtD,GAAG,EAAE;QACH;YACE,EAAE,EAAE,2CAA2C;YAC/C,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YACpC,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,mDAAmD;gBAC1D,MAAM,EAAE,gCAAgC;aACzC;SACF;QACD;YACE,EAAE,EAAE,4CAA4C;YAChD,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YACpC,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,mDAAmD;gBAC1D,MAAM,EAAE,gCAAgC;aACzC;SACF;KACF;IACD,aAAa,EAAE;QACb;YACE,EAAE,EAAE,6CAA6C;YACjD,OAAO,EAAE;gBACP,KAAK,EAAE,6CAA6C;gBACpD,MAAM,EAAE,kCAAkC;aAC3C;SACF;KACF;IACD,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;CAC/B,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;IAC/C,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,EAAE;IAC7D,YAAY,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IACtD,GAAG,EAAE;QACH;YACE,EAAE,EAAE,oCAAoC;YACxC,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;YAC7B,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,mDAAmD;gBAC1D,MAAM,EAAE,yBAAyB;aAClC;SACF;KACF;IACD,MAAM,EAAE;QACN,SAAS,EAAE;YACT;gBACE,EAAE,EAAE,iCAAiC;gBACrC,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,MAAM;gBACb,WAAW,EAAE,6CAA6C;gBAC1D,OAAO,EAAE;oBACP;wBACE,MAAM,EAAE,MAAM;wBACd,KAAK,EAAE,WAAW;wBAClB,WAAW,EAAE,0BAA0B;qBACxC;oBACD;wBACE,MAAM,EAAE,OAAO;wBACf,KAAK,EAAE,aAAa;wBACpB,WAAW,EAAE,uCAAuC;qBACrD;oBACD;wBACE,MAAM,EAAE,QAAQ;wBAChB,KAAK,EAAE,qBAAqB;wBAC5B,WAAW,EAAE,4BAA4B;wBACzC,SAAS,EAAE,IAAI;qBAChB;iBACF;aACF;SACF;KACF;IACD,KAAK,EAAE;QACL,gBAAgB,EAAE,CAAC;QACnB,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,gCAAgC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvE,OAAO,EAAE;YACP,KAAK,EAAE,iCAAiC;YACxC,MAAM,EAAE,sCAAsC;SAC/C;QACD,IAAI,EAAE;YACJ;gBACE,EAAE,EAAE,qCAAqC;gBACzC,SAAS,EAAE,iBAAiB;gBAC5B,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE;oBACP,KAAK,EAAE,gCAAgC;oBACvC,MAAM,EAAE,0BAA0B;iBACnC;aACF;SACF;QACD,MAAM,EAAE;YACN;gBACE,EAAE,EAAE,sCAAsC;gBAC1C,IAAI,EAAE,gBAAgB;gBACtB,cAAc,EAAE,CAAC,WAAW,CAAC;gBAC7B,OAAO,EAAE;oBACP,KAAK,EAAE,iCAAiC;oBACxC,MAAM,EAAE,sCAAsC;iBAC/C;aACF;SACF;KACF;IACD,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;CAC/B,CAAC,CAAA","sourcesContent":["import { defineModule, providePort, requirePort } from \"@voyant-travel/core/project\"\n\nimport { identityAccessRuntimePort } from \"./identity-access-runtime-port.js\"\nimport { teamManagementRuntimePort } from \"./team-management-runtime-port.js\"\n\nexport const authInvitationsVoyantModule = defineModule({\n  id: \"@voyant-travel/auth#invitations\",\n  packageName: \"@voyant-travel/auth\",\n  localId: \"auth.invitations\",\n  provides: { ports: [providePort(identityAccessRuntimePort)] },\n  runtimePorts: [requirePort(identityAccessRuntimePort)],\n  api: [\n    {\n      id: \"@voyant-travel/auth#invitations.api.admin\",\n      surface: \"admin\",\n      mount: \"invitations\",\n      resource: \"team\",\n      openapi: { document: \"invitations\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/identity-access-graph-runtime\",\n        export: \"createInvitationsVoyantRuntime\",\n      },\n    },\n    {\n      id: \"@voyant-travel/auth#invitations.api.public\",\n      surface: \"public\",\n      mount: \"invitations\",\n      anonymous: true,\n      openapi: { document: \"invitations\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/identity-access-graph-runtime\",\n        export: \"createInvitationsVoyantRuntime\",\n      },\n    },\n  ],\n  presentations: [\n    {\n      id: \"@voyant-travel/auth#presentation.local-auth\",\n      runtime: {\n        entry: \"@voyant-travel/auth-react/local-auth-routes\",\n        export: \"createLocalAuthRouteContribution\",\n      },\n    },\n  ],\n  meta: { ownership: \"package\" },\n})\n\nexport const authTeamVoyantModule = defineModule({\n  id: \"@voyant-travel/auth#team\",\n  packageName: \"@voyant-travel/auth\",\n  localId: \"auth.team\",\n  provides: { ports: [providePort(teamManagementRuntimePort)] },\n  runtimePorts: [requirePort(teamManagementRuntimePort)],\n  api: [\n    {\n      id: \"@voyant-travel/auth#team.api.admin\",\n      surface: \"admin\",\n      mount: \"team\",\n      resource: \"team\",\n      openapi: { document: \"team\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/identity-access-graph-runtime\",\n        export: \"createTeamVoyantRuntime\",\n      },\n    },\n  ],\n  access: {\n    resources: [\n      {\n        id: \"@voyant-travel/auth#access.team\",\n        resource: \"team\",\n        label: \"Team\",\n        description: \"Manage staff team members and their access.\",\n        actions: [\n          {\n            action: \"read\",\n            label: \"View team\",\n            description: \"View staff team members.\",\n          },\n          {\n            action: \"write\",\n            label: \"Manage team\",\n            description: \"Create and update staff team members.\",\n          },\n          {\n            action: \"delete\",\n            label: \"Delete team members\",\n            description: \"Delete staff team members.\",\n            sensitive: true,\n          },\n        ],\n      },\n    ],\n  },\n  admin: {\n    compositionOrder: 5,\n    setupSteps: [{ id: \"@voyant-travel/auth#setup.team\", skippable: true }],\n    runtime: {\n      entry: \"@voyant-travel/auth-react/admin\",\n      export: \"createSelectedAuthTeamAdminExtension\",\n    },\n    copy: [\n      {\n        id: \"@voyant-travel/auth#team.admin.copy\",\n        namespace: \"auth.admin.team\",\n        fallbackLocale: \"en\",\n        runtime: {\n          entry: \"@voyant-travel/auth-react/i18n\",\n          export: \"authUiMessageDefinitions\",\n        },\n      },\n    ],\n    routes: [\n      {\n        id: \"@voyant-travel/auth#team.admin.route\",\n        path: \"/settings/team\",\n        requiredScopes: [\"team:read\"],\n        runtime: {\n          entry: \"@voyant-travel/auth-react/admin\",\n          export: \"createSelectedAuthTeamAdminExtension\",\n        },\n      },\n    ],\n  },\n  meta: { ownership: \"package\" },\n})\n"]}
+{"version":3,"file":"voyant.js","sourceRoot":"","sources":["../src/voyant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAEpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAE7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;IACtD,EAAE,EAAE,iCAAiC;IACrC,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,EAAE;IAC7D,YAAY,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IACtD,GAAG,EAAE;QACH;YACE,EAAE,EAAE,2CAA2C;YAC/C,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YACpC,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,mDAAmD;gBAC1D,MAAM,EAAE,gCAAgC;aACzC;SACF;QACD;YACE,EAAE,EAAE,4CAA4C;YAChD,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YACpC,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,mDAAmD;gBAC1D,MAAM,EAAE,gCAAgC;aACzC;SACF;KACF;IACD,aAAa,EAAE;QACb;YACE,EAAE,EAAE,6CAA6C;YACjD,OAAO,EAAE;gBACP,KAAK,EAAE,6CAA6C;gBACpD,MAAM,EAAE,kCAAkC;aAC3C;SACF;KACF;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE;YACV,OAAO,EAAE,gBAAgB;YACzB,SAAS,EACP,uHAAuH;SAC1H;KACF;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;IAC/C,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,EAAE;IAC7D,YAAY,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IACtD,GAAG,EAAE;QACH;YACE,EAAE,EAAE,oCAAoC;YACxC,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;YAC7B,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,mDAAmD;gBAC1D,MAAM,EAAE,yBAAyB;aAClC;SACF;KACF;IACD,MAAM,EAAE;QACN,SAAS,EAAE;YACT;gBACE,EAAE,EAAE,iCAAiC;gBACrC,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,MAAM;gBACb,WAAW,EAAE,6CAA6C;gBAC1D,QAAQ,EAAE,mBAAmB;gBAC7B,OAAO,EAAE;oBACP;wBACE,MAAM,EAAE,MAAM;wBACd,KAAK,EAAE,WAAW;wBAClB,WAAW,EAAE,0BAA0B;qBACxC;oBACD;wBACE,MAAM,EAAE,OAAO;wBACf,KAAK,EAAE,aAAa;wBACpB,WAAW,EAAE,0CAA0C;wBACvD,SAAS,EAAE,IAAI;wBACf,QAAQ,EAAE,UAAU;qBACrB;oBACD;wBACE,MAAM,EAAE,QAAQ;wBAChB,KAAK,EAAE,oBAAoB;wBAC3B,WAAW,EAAE,sDAAsD;wBACnE,SAAS,EAAE,IAAI;wBACf,QAAQ,EAAE,UAAU;qBACrB;iBACF;aACF;SACF;KACF;IACD,KAAK,EAAE;QACL;YACE,EAAE,EAAE,gDAAgD;YACpD,IAAI,EAAE,kCAAkC;YACxC,OAAO,EAAE;gBACP,KAAK,EAAE,2BAA2B;gBAClC,MAAM,EAAE,mCAAmC;aAC5C;YACD,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,KAAK;SACZ;QACD;YACE,EAAE,EAAE,4CAA4C;YAChD,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,qBAAqB,EAAE;YAC9E,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,0CAA0C;YAC9C,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,mBAAmB,EAAE;YAC5E,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,KAAK;SACZ;QACD;YACE,EAAE,EAAE,gDAAgD;YACpD,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,yBAAyB,EAAE;YAClF,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,6CAA6C;YACjD,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,sBAAsB,EAAE;YAC/E,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,iDAAiD;YACrD,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,0BAA0B,EAAE;YACnF,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,kDAAkD;YACtD,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,0BAA0B,EAAE;YACnF,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,+CAA+C;YACnD,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,wBAAwB,EAAE;YACjF,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,iDAAiD;YACrD,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,0BAA0B,EAAE;YACnF,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;KACF;IACD,OAAO,EAAE;QACP;YACE,EAAE,EAAE,kDAAkD;YACtD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,mBAAmB;YAC/B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,OAAO;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,gDAAgD,CAAC,EAAE;SACpE;QACD;YACE,EAAE,EAAE,8CAA8C;YAClD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,OAAO;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,4CAA4C,CAAC,EAAE;SAChE;QACD;YACE,EAAE,EAAE,4CAA4C;YAChD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,WAAW;YACvB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,OAAO;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,0CAA0C,CAAC,EAAE;SAC9D;QACD;YACE,EAAE,EAAE,kDAAkD;YACtD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,OAAO;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,gDAAgD,CAAC,EAAE;SACpE;QACD;YACE,EAAE,EAAE,+CAA+C;YACnD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,OAAO;YACf,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,6CAA6C,CAAC,EAAE;SACjE;QACD;YACE,EAAE,EAAE,mDAAmD;YACvD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,QAAQ;YAChB,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,iDAAiD,CAAC,EAAE;SACrE;QACD;YACE,EAAE,EAAE,oDAAoD;YACxD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,OAAO;YACf,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,kDAAkD,CAAC,EAAE;SACtE;QACD;YACE,EAAE,EAAE,iDAAiD;YACrD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,OAAO;YACf,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,+CAA+C,CAAC,EAAE;SACnE;QACD;YACE,EAAE,EAAE,mDAAmD;YACvD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,QAAQ;YAChB,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,iDAAiD,CAAC,EAAE;SACrE;KACF;IACD,KAAK,EAAE;QACL,gBAAgB,EAAE,CAAC;QACnB,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,gCAAgC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvE,OAAO,EAAE;YACP,KAAK,EAAE,iCAAiC;YACxC,MAAM,EAAE,sCAAsC;SAC/C;QACD,IAAI,EAAE;YACJ;gBACE,EAAE,EAAE,qCAAqC;gBACzC,SAAS,EAAE,iBAAiB;gBAC5B,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE;oBACP,KAAK,EAAE,gCAAgC;oBACvC,MAAM,EAAE,0BAA0B;iBACnC;aACF;SACF;QACD,MAAM,EAAE;YACN;gBACE,EAAE,EAAE,sCAAsC;gBAC1C,IAAI,EAAE,gBAAgB;gBACtB,cAAc,EAAE,CAAC,WAAW,CAAC;gBAC7B,OAAO,EAAE;oBACP,KAAK,EAAE,iCAAiC;oBACxC,MAAM,EAAE,sCAAsC;iBAC/C;aACF;SACF;KACF;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,SAAS;KACrB;CACF,CAAC,CAAA","sourcesContent":["import { defineModule, providePort, requirePort } from \"@voyant-travel/core/project\"\n\nimport { identityAccessRuntimePort } from \"./identity-access-runtime-port.js\"\nimport { teamManagementRuntimePort } from \"./team-management-runtime-port.js\"\n\nexport const authInvitationsVoyantModule = defineModule({\n  id: \"@voyant-travel/auth#invitations\",\n  packageName: \"@voyant-travel/auth\",\n  localId: \"auth.invitations\",\n  provides: { ports: [providePort(identityAccessRuntimePort)] },\n  runtimePorts: [requirePort(identityAccessRuntimePort)],\n  api: [\n    {\n      id: \"@voyant-travel/auth#invitations.api.admin\",\n      surface: \"admin\",\n      mount: \"invitations\",\n      resource: \"team\",\n      openapi: { document: \"invitations\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/identity-access-graph-runtime\",\n        export: \"createInvitationsVoyantRuntime\",\n      },\n    },\n    {\n      id: \"@voyant-travel/auth#invitations.api.public\",\n      surface: \"public\",\n      mount: \"invitations\",\n      anonymous: true,\n      openapi: { document: \"invitations\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/identity-access-graph-runtime\",\n        export: \"createInvitationsVoyantRuntime\",\n      },\n    },\n  ],\n  presentations: [\n    {\n      id: \"@voyant-travel/auth#presentation.local-auth\",\n      runtime: {\n        entry: \"@voyant-travel/auth-react/local-auth-routes\",\n        export: \"createLocalAuthRouteContribution\",\n      },\n    },\n  ],\n  meta: {\n    ownership: \"package\",\n    agentTools: {\n      posture: \"not-applicable\",\n      rationale:\n        \"This unit owns public invitation acceptance; staff invitation management is exposed by the guarded auth team runtime.\",\n    },\n  },\n})\n\nexport const authTeamVoyantModule = defineModule({\n  id: \"@voyant-travel/auth#team\",\n  packageName: \"@voyant-travel/auth\",\n  localId: \"auth.team\",\n  provides: { ports: [providePort(teamManagementRuntimePort)] },\n  runtimePorts: [requirePort(teamManagementRuntimePort)],\n  api: [\n    {\n      id: \"@voyant-travel/auth#team.api.admin\",\n      surface: \"admin\",\n      mount: \"team\",\n      resource: \"team\",\n      openapi: { document: \"team\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/identity-access-graph-runtime\",\n        export: \"createTeamVoyantRuntime\",\n      },\n    },\n  ],\n  access: {\n    resources: [\n      {\n        id: \"@voyant-travel/auth#access.team\",\n        resource: \"team\",\n        label: \"Team\",\n        description: \"Manage staff team members and their access.\",\n        wildcard: \"explicit-resource\",\n        actions: [\n          {\n            action: \"read\",\n            label: \"View team\",\n            description: \"View staff team members.\",\n          },\n          {\n            action: \"write\",\n            label: \"Manage team\",\n            description: \"Invite staff and update roles or access.\",\n            sensitive: true,\n            wildcard: \"explicit\",\n          },\n          {\n            action: \"delete\",\n            label: \"Remove team access\",\n            description: \"Revoke invitations or deactivate staff team members.\",\n            sensitive: true,\n            wildcard: \"explicit\",\n          },\n        ],\n      },\n    ],\n  },\n  tools: [\n    {\n      id: \"@voyant-travel/auth#team.tool.get-capabilities\",\n      name: \"get_team_management_capabilities\",\n      runtime: {\n        entry: \"@voyant-travel/auth/tools\",\n        export: \"getTeamManagementCapabilitiesTool\",\n      },\n      requiredScopes: [\"team:read\"],\n      context: [\"teamManagement\"],\n      risk: \"low\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.list-members\",\n      name: \"list_team_members\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"listTeamMembersTool\" },\n      requiredScopes: [\"team:read\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.list-roles\",\n      name: \"list_team_roles\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"listTeamRolesTool\" },\n      requiredScopes: [\"team:read\"],\n      context: [\"teamManagement\"],\n      risk: \"low\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.list-invitations\",\n      name: \"list_team_invitations\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"listTeamInvitationsTool\" },\n      requiredScopes: [\"team:read\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.invite-member\",\n      name: \"invite_team_member\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"inviteTeamMemberTool\" },\n      requiredScopes: [\"team:write\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.revoke-invitation\",\n      name: \"revoke_team_invitation\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"revokeTeamInvitationTool\" },\n      requiredScopes: [\"team:delete\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.update-member-role\",\n      name: \"update_team_member_role\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"updateTeamMemberRoleTool\" },\n      requiredScopes: [\"team:write\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.activate-member\",\n      name: \"activate_team_member\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"activateTeamMemberTool\" },\n      requiredScopes: [\"team:write\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.deactivate-member\",\n      name: \"deactivate_team_member\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"deactivateTeamMemberTool\" },\n      requiredScopes: [\"team:delete\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n  ],\n  actions: [\n    {\n      id: \"@voyant-travel/auth#team.action.get-capabilities\",\n      version: \"v1\",\n      kind: \"read\",\n      targetType: \"team-capabilities\",\n      resource: \"team\",\n      action: \"read\",\n      requiredScopes: [\"team:read\"],\n      risk: \"low\",\n      ledger: \"optional\",\n      approval: \"never\",\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.get-capabilities\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.list-members\",\n      version: \"v1\",\n      kind: \"sensitive-read\",\n      targetType: \"team-member\",\n      resource: \"team\",\n      action: \"read\",\n      requiredScopes: [\"team:read\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"never\",\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.list-members\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.list-roles\",\n      version: \"v1\",\n      kind: \"read\",\n      targetType: \"team-role\",\n      resource: \"team\",\n      action: \"read\",\n      requiredScopes: [\"team:read\"],\n      risk: \"low\",\n      ledger: \"optional\",\n      approval: \"never\",\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.list-roles\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.list-invitations\",\n      version: \"v1\",\n      kind: \"sensitive-read\",\n      targetType: \"team-invitation\",\n      resource: \"team\",\n      action: \"read\",\n      requiredScopes: [\"team:read\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"never\",\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.list-invitations\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.invite-member\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-invitation\",\n      resource: \"team\",\n      action: \"write\",\n      requiredScopes: [\"team:write\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: false,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.invite-member\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.revoke-invitation\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-invitation\",\n      resource: \"team\",\n      action: \"delete\",\n      requiredScopes: [\"team:delete\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: false,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.revoke-invitation\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.update-member-role\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-member\",\n      resource: \"team\",\n      action: \"write\",\n      requiredScopes: [\"team:write\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: true,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.update-member-role\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.activate-member\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-member\",\n      resource: \"team\",\n      action: \"write\",\n      requiredScopes: [\"team:write\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: true,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.activate-member\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.deactivate-member\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-member\",\n      resource: \"team\",\n      action: \"delete\",\n      requiredScopes: [\"team:delete\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: false,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.deactivate-member\"] },\n    },\n  ],\n  admin: {\n    compositionOrder: 5,\n    setupSteps: [{ id: \"@voyant-travel/auth#setup.team\", skippable: true }],\n    runtime: {\n      entry: \"@voyant-travel/auth-react/admin\",\n      export: \"createSelectedAuthTeamAdminExtension\",\n    },\n    copy: [\n      {\n        id: \"@voyant-travel/auth#team.admin.copy\",\n        namespace: \"auth.admin.team\",\n        fallbackLocale: \"en\",\n        runtime: {\n          entry: \"@voyant-travel/auth-react/i18n\",\n          export: \"authUiMessageDefinitions\",\n        },\n      },\n    ],\n    routes: [\n      {\n        id: \"@voyant-travel/auth#team.admin.route\",\n        path: \"/settings/team\",\n        requiredScopes: [\"team:read\"],\n        runtime: {\n          entry: \"@voyant-travel/auth-react/admin\",\n          export: \"createSelectedAuthTeamAdminExtension\",\n        },\n      },\n    ],\n  },\n  meta: {\n    ownership: \"package\",\n  },\n})\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/auth",
-  "version": "0.130.0",
+  "version": "0.131.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -72,6 +72,11 @@
       "import": "./dist/team-management-runtime-port.js",
       "default": "./dist/team-management-runtime-port.js"
     },
+    "./tools": {
+      "types": "./dist/mcp-runtime.d.ts",
+      "import": "./dist/mcp-runtime.js",
+      "default": "./dist/mcp-runtime.js"
+    },
     "./runtime-contributor": {
       "types": "./dist/runtime-contributor.d.ts",
       "import": "./dist/runtime-contributor.js",
@@ -100,9 +105,10 @@
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.27",
     "zod": "^4.4.3",
-    "@voyant-travel/core": "^0.123.0",
-    "@voyant-travel/db": "^0.114.6",
-    "@voyant-travel/hono": "^0.127.0",
+    "@voyant-travel/core": "^0.124.0",
+    "@voyant-travel/db": "^0.114.7",
+    "@voyant-travel/hono": "^0.127.1",
+    "@voyant-travel/tools": "^0.3.0",
     "@voyant-travel/types": "^0.109.2",
     "@voyant-travel/utils": "^0.107.1"
   },