@voyant-travel/auth 0.139.0 → 0.140.1

package/dist/storefront-admin-contracts.d.ts

@@ -0,0 +1,218 @@
+/**
+ * Storefront admin API contracts (provider-neutral, pure zod).
+ *
+ * These mirror the DTOs on {@link storefrontRuntimePort} without importing the
+ * DB schema, so the admin React client can validate responses and request
+ * bodies without pulling server-only modules into the browser bundle. The
+ * literal unions are kept in lockstep with the persisted schema; the runtime
+ * adapter re-normalizes every write, so these are the transport contract only.
+ */
+import { z } from "zod";
+export declare const storefrontHostingKindSchema: z.ZodEnum<{
+    external: "external";
+    cloud_site: "cloud_site";
+}>;
+export declare const storefrontApiKeyKindSchema: z.ZodEnum<{
+    secret: "secret";
+    publishable: "publishable";
+}>;
+export declare const storefrontSocialProviderSchema: z.ZodEnum<{
+    apple: "apple";
+    facebook: "facebook";
+    google: "google";
+}>;
+export declare const storefrontCustomerAuthMethodsSchema: z.ZodObject<{
+    emailCode: z.ZodBoolean;
+    emailPassword: z.ZodBoolean;
+    google: z.ZodBoolean;
+    facebook: z.ZodBoolean;
+    apple: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const storefrontCustomerAccountPolicySchema: z.ZodObject<{
+    allowedKinds: z.ZodArray<z.ZodEnum<{
+        personal: "personal";
+        business: "business";
+    }>>;
+    personalSignup: z.ZodEnum<{
+        open: "open";
+        disabled: "disabled";
+    }>;
+    businessOnboarding: z.ZodEnum<{
+        open: "open";
+        disabled: "disabled";
+        request: "request";
+        "invite-only": "invite-only";
+    }>;
+}, z.core.$strict>;
+export declare const storefrontSchema: z.ZodObject<{
+    id: z.ZodString;
+    organizationId: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    hostingKind: z.ZodEnum<{
+        external: "external";
+        cloud_site: "cloud_site";
+    }>;
+    siteId: z.ZodNullable<z.ZodString>;
+    allowedOrigins: z.ZodArray<z.ZodString>;
+    methods: z.ZodObject<{
+        emailCode: z.ZodBoolean;
+        emailPassword: z.ZodBoolean;
+        google: z.ZodBoolean;
+        facebook: z.ZodBoolean;
+        apple: z.ZodBoolean;
+    }, z.core.$strict>;
+    accountPolicy: z.ZodObject<{
+        allowedKinds: z.ZodArray<z.ZodEnum<{
+            personal: "personal";
+            business: "business";
+        }>>;
+        personalSignup: z.ZodEnum<{
+            open: "open";
+            disabled: "disabled";
+        }>;
+        businessOnboarding: z.ZodEnum<{
+            open: "open";
+            disabled: "disabled";
+            request: "request";
+            "invite-only": "invite-only";
+        }>;
+    }, z.core.$strict>;
+    hostOnlyCookies: z.ZodBoolean;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export declare const storefrontApiKeySchema: z.ZodObject<{
+    id: z.ZodString;
+    storefrontId: z.ZodString;
+    kind: z.ZodEnum<{
+        secret: "secret";
+        publishable: "publishable";
+    }>;
+    tokenPreview: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strict>;
+/** Issuance/rotation payload: the plaintext token is present exactly once. */
+export declare const issuedStorefrontApiKeySchema: z.ZodObject<{
+    id: z.ZodString;
+    storefrontId: z.ZodString;
+    kind: z.ZodEnum<{
+        secret: "secret";
+        publishable: "publishable";
+    }>;
+    tokenPreview: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    token: z.ZodString;
+}, z.core.$strict>;
+export declare const storefrontProviderCredentialStatusSchema: z.ZodObject<{
+    provider: z.ZodEnum<{
+        apple: "apple";
+        facebook: "facebook";
+        google: "google";
+    }>;
+    configured: z.ZodBoolean;
+    updatedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * Operator-facing capability signal. `businessAccounts` reflects whether the
+ * deployment wires the customer business-account onboarding runtime; the
+ * business buyer-account controls are disabled when it is false.
+ */
+export declare const storefrontAdminCapabilitiesSchema: z.ZodObject<{
+    businessAccounts: z.ZodBoolean;
+    manageProviders: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const createStorefrontInputSchema: z.ZodObject<{
+    name: z.ZodString;
+    slug: z.ZodString;
+    hostingKind: z.ZodEnum<{
+        external: "external";
+        cloud_site: "cloud_site";
+    }>;
+    siteId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    allowedOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    methods: z.ZodObject<{
+        emailCode: z.ZodBoolean;
+        emailPassword: z.ZodBoolean;
+        google: z.ZodBoolean;
+        facebook: z.ZodBoolean;
+        apple: z.ZodBoolean;
+    }, z.core.$strict>;
+    accountPolicy: z.ZodOptional<z.ZodObject<{
+        allowedKinds: z.ZodArray<z.ZodEnum<{
+            personal: "personal";
+            business: "business";
+        }>>;
+        personalSignup: z.ZodEnum<{
+            open: "open";
+            disabled: "disabled";
+        }>;
+        businessOnboarding: z.ZodEnum<{
+            open: "open";
+            disabled: "disabled";
+            request: "request";
+            "invite-only": "invite-only";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const updateStorefrontInputSchema: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strict>;
+export declare const setStorefrontAllowedOriginsInputSchema: z.ZodObject<{
+    origins: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare const issueStorefrontApiKeyInputSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        secret: "secret";
+        publishable: "publishable";
+    }>;
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strict>;
+export declare const updateStorefrontAccountPolicyInputSchema: z.ZodObject<{
+    allowedKinds: z.ZodArray<z.ZodEnum<{
+        personal: "personal";
+        business: "business";
+    }>>;
+    personalSignup: z.ZodEnum<{
+        open: "open";
+        disabled: "disabled";
+    }>;
+    businessOnboarding: z.ZodEnum<{
+        open: "open";
+        disabled: "disabled";
+        request: "request";
+        "invite-only": "invite-only";
+    }>;
+}, z.core.$strict>;
+export declare const updateStorefrontMethodsInputSchema: z.ZodObject<{
+    emailCode: z.ZodBoolean;
+    emailPassword: z.ZodBoolean;
+    google: z.ZodBoolean;
+    facebook: z.ZodBoolean;
+    apple: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const putStorefrontProviderCredentialInputSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+}, z.core.$strict>;
+export type StorefrontHostingKind = z.infer<typeof storefrontHostingKindSchema>;
+export type StorefrontApiKeyKind = z.infer<typeof storefrontApiKeyKindSchema>;
+export type StorefrontSocialProvider = z.infer<typeof storefrontSocialProviderSchema>;
+export type StorefrontCustomerAuthMethods = z.infer<typeof storefrontCustomerAuthMethodsSchema>;
+export type StorefrontCustomerAccountPolicy = z.infer<typeof storefrontCustomerAccountPolicySchema>;
+export type StorefrontDto = z.infer<typeof storefrontSchema>;
+export type StorefrontApiKeyDto = z.infer<typeof storefrontApiKeySchema>;
+export type IssuedStorefrontApiKeyDto = z.infer<typeof issuedStorefrontApiKeySchema>;
+export type StorefrontProviderCredentialStatusDto = z.infer<typeof storefrontProviderCredentialStatusSchema>;
+export type StorefrontAdminCapabilitiesDto = z.infer<typeof storefrontAdminCapabilitiesSchema>;
+export type CreateStorefrontInput = z.infer<typeof createStorefrontInputSchema>;
+export type UpdateStorefrontInput = z.infer<typeof updateStorefrontInputSchema>;
+export type SetStorefrontAllowedOriginsInput = z.infer<typeof setStorefrontAllowedOriginsInputSchema>;
+export type IssueStorefrontApiKeyInput = z.infer<typeof issueStorefrontApiKeyInputSchema>;
+export type PutStorefrontProviderCredentialInput = z.infer<typeof putStorefrontProviderCredentialInputSchema>;

package/dist/storefront-admin-contracts.js

@@ -0,0 +1,111 @@
+/**
+ * Storefront admin API contracts (provider-neutral, pure zod).
+ *
+ * These mirror the DTOs on {@link storefrontRuntimePort} without importing the
+ * DB schema, so the admin React client can validate responses and request
+ * bodies without pulling server-only modules into the browser bundle. The
+ * literal unions are kept in lockstep with the persisted schema; the runtime
+ * adapter re-normalizes every write, so these are the transport contract only.
+ */
+import { z } from "zod";
+export const storefrontHostingKindSchema = z.enum(["cloud_site", "external"]);
+export const storefrontApiKeyKindSchema = z.enum(["publishable", "secret"]);
+export const storefrontSocialProviderSchema = z.enum(["google", "facebook", "apple"]);
+export const storefrontCustomerAuthMethodsSchema = z
+    .object({
+    emailCode: z.boolean(),
+    emailPassword: z.boolean(),
+    google: z.boolean(),
+    facebook: z.boolean(),
+    apple: z.boolean(),
+})
+    .strict();
+export const storefrontCustomerAccountPolicySchema = z
+    .object({
+    allowedKinds: z.array(z.enum(["personal", "business"])).min(1),
+    personalSignup: z.enum(["open", "disabled"]),
+    businessOnboarding: z.enum(["disabled", "open", "request", "invite-only"]),
+})
+    .strict();
+export const storefrontSchema = z
+    .object({
+    id: z.string(),
+    organizationId: z.string(),
+    name: z.string(),
+    slug: z.string(),
+    hostingKind: storefrontHostingKindSchema,
+    siteId: z.string().nullable(),
+    allowedOrigins: z.array(z.string()),
+    methods: storefrontCustomerAuthMethodsSchema,
+    accountPolicy: storefrontCustomerAccountPolicySchema,
+    hostOnlyCookies: z.boolean(),
+    createdAt: z.string(),
+    updatedAt: z.string(),
+})
+    .strict();
+export const storefrontApiKeySchema = z
+    .object({
+    id: z.string(),
+    storefrontId: z.string(),
+    kind: storefrontApiKeyKindSchema,
+    tokenPreview: z.string(),
+    name: z.string().nullable(),
+    lastUsedAt: z.string().nullable(),
+    revokedAt: z.string().nullable(),
+    createdAt: z.string(),
+})
+    .strict();
+/** Issuance/rotation payload: the plaintext token is present exactly once. */
+export const issuedStorefrontApiKeySchema = storefrontApiKeySchema
+    .extend({ token: z.string() })
+    .strict();
+export const storefrontProviderCredentialStatusSchema = z
+    .object({
+    provider: storefrontSocialProviderSchema,
+    configured: z.boolean(),
+    updatedAt: z.string().nullable(),
+})
+    .strict();
+/**
+ * Operator-facing capability signal. `businessAccounts` reflects whether the
+ * deployment wires the customer business-account onboarding runtime; the
+ * business buyer-account controls are disabled when it is false.
+ */
+export const storefrontAdminCapabilitiesSchema = z
+    .object({
+    businessAccounts: z.boolean(),
+    manageProviders: z.boolean(),
+})
+    .strict();
+export const createStorefrontInputSchema = z
+    .object({
+    name: z.string().trim().min(1).max(200),
+    slug: z.string().trim().min(1).max(120),
+    hostingKind: storefrontHostingKindSchema,
+    siteId: z.string().trim().min(1).nullable().optional(),
+    allowedOrigins: z.array(z.string().trim().min(1)).default([]),
+    methods: storefrontCustomerAuthMethodsSchema,
+    accountPolicy: storefrontCustomerAccountPolicySchema.optional(),
+})
+    .strict();
+export const updateStorefrontInputSchema = z
+    .object({ name: z.string().trim().min(1).max(200) })
+    .strict();
+export const setStorefrontAllowedOriginsInputSchema = z
+    .object({ origins: z.array(z.string().trim().min(1)) })
+    .strict();
+export const issueStorefrontApiKeyInputSchema = z
+    .object({
+    kind: storefrontApiKeyKindSchema,
+    name: z.string().trim().min(1).max(200).nullable().optional(),
+})
+    .strict();
+export const updateStorefrontAccountPolicyInputSchema = storefrontCustomerAccountPolicySchema;
+export const updateStorefrontMethodsInputSchema = storefrontCustomerAuthMethodsSchema;
+export const putStorefrontProviderCredentialInputSchema = z
+    .object({
+    clientId: z.string().trim().min(1).max(16_384),
+    clientSecret: z.string().trim().min(1).max(16_384),
+})
+    .strict();
+//# sourceMappingURL=storefront-admin-contracts.js.map

package/dist/storefront-admin-contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storefront-admin-contracts.js","sourceRoot":"","sources":["../src/storefront-admin-contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAA;AAC7E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAA;AAC3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;AAErF,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5C,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;CAC3E,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,2BAA2B;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,OAAO,EAAE,mCAAmC;IAC5C,aAAa,EAAE,qCAAqC;IACpD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,IAAI,EAAE,0BAA0B;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,8EAA8E;AAC9E,MAAM,CAAC,MAAM,4BAA4B,GAAG,sBAAsB;KAC/D,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KAC7B,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC;KACtD,MAAM,CAAC;IACN,QAAQ,EAAE,8BAA8B;IACxC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,EAAE,CAAA;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;CAC7B,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,WAAW,EAAE,2BAA2B;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,OAAO,EAAE,mCAAmC;IAC5C,aAAa,EAAE,qCAAqC,CAAC,QAAQ,EAAE;CAChE,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;KACnD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,IAAI,EAAE,0BAA0B;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,wCAAwC,GAAG,qCAAqC,CAAA;AAC7F,MAAM,CAAC,MAAM,kCAAkC,GAAG,mCAAmC,CAAA;AAErF,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC;KACxD,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;CACnD,CAAC;KACD,MAAM,EAAE,CAAA","sourcesContent":["/**\n * Storefront admin API contracts (provider-neutral, pure zod).\n *\n * These mirror the DTOs on {@link storefrontRuntimePort} without importing the\n * DB schema, so the admin React client can validate responses and request\n * bodies without pulling server-only modules into the browser bundle. The\n * literal unions are kept in lockstep with the persisted schema; the runtime\n * adapter re-normalizes every write, so these are the transport contract only.\n */\nimport { z } from \"zod\"\n\nexport const storefrontHostingKindSchema = z.enum([\"cloud_site\", \"external\"])\nexport const storefrontApiKeyKindSchema = z.enum([\"publishable\", \"secret\"])\nexport const storefrontSocialProviderSchema = z.enum([\"google\", \"facebook\", \"apple\"])\n\nexport const storefrontCustomerAuthMethodsSchema = z\n  .object({\n    emailCode: z.boolean(),\n    emailPassword: z.boolean(),\n    google: z.boolean(),\n    facebook: z.boolean(),\n    apple: z.boolean(),\n  })\n  .strict()\n\nexport const storefrontCustomerAccountPolicySchema = z\n  .object({\n    allowedKinds: z.array(z.enum([\"personal\", \"business\"])).min(1),\n    personalSignup: z.enum([\"open\", \"disabled\"]),\n    businessOnboarding: z.enum([\"disabled\", \"open\", \"request\", \"invite-only\"]),\n  })\n  .strict()\n\nexport const storefrontSchema = z\n  .object({\n    id: z.string(),\n    organizationId: z.string(),\n    name: z.string(),\n    slug: z.string(),\n    hostingKind: storefrontHostingKindSchema,\n    siteId: z.string().nullable(),\n    allowedOrigins: z.array(z.string()),\n    methods: storefrontCustomerAuthMethodsSchema,\n    accountPolicy: storefrontCustomerAccountPolicySchema,\n    hostOnlyCookies: z.boolean(),\n    createdAt: z.string(),\n    updatedAt: z.string(),\n  })\n  .strict()\n\nexport const storefrontApiKeySchema = z\n  .object({\n    id: z.string(),\n    storefrontId: z.string(),\n    kind: storefrontApiKeyKindSchema,\n    tokenPreview: z.string(),\n    name: z.string().nullable(),\n    lastUsedAt: z.string().nullable(),\n    revokedAt: z.string().nullable(),\n    createdAt: z.string(),\n  })\n  .strict()\n\n/** Issuance/rotation payload: the plaintext token is present exactly once. */\nexport const issuedStorefrontApiKeySchema = storefrontApiKeySchema\n  .extend({ token: z.string() })\n  .strict()\n\nexport const storefrontProviderCredentialStatusSchema = z\n  .object({\n    provider: storefrontSocialProviderSchema,\n    configured: z.boolean(),\n    updatedAt: z.string().nullable(),\n  })\n  .strict()\n\n/**\n * Operator-facing capability signal. `businessAccounts` reflects whether the\n * deployment wires the customer business-account onboarding runtime; the\n * business buyer-account controls are disabled when it is false.\n */\nexport const storefrontAdminCapabilitiesSchema = z\n  .object({\n    businessAccounts: z.boolean(),\n    manageProviders: z.boolean(),\n  })\n  .strict()\n\nexport const createStorefrontInputSchema = z\n  .object({\n    name: z.string().trim().min(1).max(200),\n    slug: z.string().trim().min(1).max(120),\n    hostingKind: storefrontHostingKindSchema,\n    siteId: z.string().trim().min(1).nullable().optional(),\n    allowedOrigins: z.array(z.string().trim().min(1)).default([]),\n    methods: storefrontCustomerAuthMethodsSchema,\n    accountPolicy: storefrontCustomerAccountPolicySchema.optional(),\n  })\n  .strict()\n\nexport const updateStorefrontInputSchema = z\n  .object({ name: z.string().trim().min(1).max(200) })\n  .strict()\n\nexport const setStorefrontAllowedOriginsInputSchema = z\n  .object({ origins: z.array(z.string().trim().min(1)) })\n  .strict()\n\nexport const issueStorefrontApiKeyInputSchema = z\n  .object({\n    kind: storefrontApiKeyKindSchema,\n    name: z.string().trim().min(1).max(200).nullable().optional(),\n  })\n  .strict()\n\nexport const updateStorefrontAccountPolicyInputSchema = storefrontCustomerAccountPolicySchema\nexport const updateStorefrontMethodsInputSchema = storefrontCustomerAuthMethodsSchema\n\nexport const putStorefrontProviderCredentialInputSchema = z\n  .object({\n    clientId: z.string().trim().min(1).max(16_384),\n    clientSecret: z.string().trim().min(1).max(16_384),\n  })\n  .strict()\n\nexport type StorefrontHostingKind = z.infer<typeof storefrontHostingKindSchema>\nexport type StorefrontApiKeyKind = z.infer<typeof storefrontApiKeyKindSchema>\nexport type StorefrontSocialProvider = z.infer<typeof storefrontSocialProviderSchema>\nexport type StorefrontCustomerAuthMethods = z.infer<typeof storefrontCustomerAuthMethodsSchema>\nexport type StorefrontCustomerAccountPolicy = z.infer<typeof storefrontCustomerAccountPolicySchema>\nexport type StorefrontDto = z.infer<typeof storefrontSchema>\nexport type StorefrontApiKeyDto = z.infer<typeof storefrontApiKeySchema>\nexport type IssuedStorefrontApiKeyDto = z.infer<typeof issuedStorefrontApiKeySchema>\nexport type StorefrontProviderCredentialStatusDto = z.infer<\n  typeof storefrontProviderCredentialStatusSchema\n>\nexport type StorefrontAdminCapabilitiesDto = z.infer<typeof storefrontAdminCapabilitiesSchema>\nexport type CreateStorefrontInput = z.infer<typeof createStorefrontInputSchema>\nexport type UpdateStorefrontInput = z.infer<typeof updateStorefrontInputSchema>\nexport type SetStorefrontAllowedOriginsInput = z.infer<\n  typeof setStorefrontAllowedOriginsInputSchema\n>\nexport type IssueStorefrontApiKeyInput = z.infer<typeof issueStorefrontApiKeyInputSchema>\nexport type PutStorefrontProviderCredentialInput = z.infer<\n  typeof putStorefrontProviderCredentialInputSchema\n>\n"]}

package/dist/storefront-graph-runtime.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Selected-graph runtime for the storefront admin surface. The business
+ * buyer-account capability is derived from whether the deployment also wires
+ * the customer business-account onboarding runtime, so the admin UI can gate
+ * the org-account controls on a real runtime signal rather than a static flag.
+ */
+export declare const createStorefrontVoyantRuntime: import("@voyant-travel/core/project").VoyantGraphRuntimeFactory<{
+    module: {
+        name: string;
+    };
+    adminRoutes: import("@hono/zod-openapi").OpenAPIHono<{
+        Bindings: Record<string, unknown>;
+        Variables: {
+            userId?: string;
+            organizationId?: string | null;
+            scopes?: string[] | null;
+            db: import("@voyant-travel/hono").VoyantDb;
+        };
+    }, {}, "/">;
+}>;

package/dist/storefront-graph-runtime.js

@@ -0,0 +1,17 @@
+import { defineGraphRuntimeFactory } from "@voyant-travel/core/project";
+import { customerBusinessAccountOnboardingRuntimePort } from "./customer-business-onboarding-runtime-port.js";
+import { createStorefrontAdminRoutes } from "./storefront-routes.js";
+import { storefrontRuntimePort } from "./storefront-runtime-port.js";
+/**
+ * Selected-graph runtime for the storefront admin surface. The business
+ * buyer-account capability is derived from whether the deployment also wires
+ * the customer business-account onboarding runtime, so the admin UI can gate
+ * the org-account controls on a real runtime signal rather than a static flag.
+ */
+export const createStorefrontVoyantRuntime = defineGraphRuntimeFactory(async ({ getPort, hasPort }) => ({
+    module: { name: "storefronts" },
+    adminRoutes: createStorefrontAdminRoutes(await getPort(storefrontRuntimePort), {
+        businessAccounts: hasPort(customerBusinessAccountOnboardingRuntimePort),
+    }),
+}));
+//# sourceMappingURL=storefront-graph-runtime.js.map

package/dist/storefront-graph-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storefront-graph-runtime.js","sourceRoot":"","sources":["../src/storefront-graph-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AAEvE,OAAO,EAAE,4CAA4C,EAAE,MAAM,gDAAgD,CAAA;AAC7G,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CACpE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;IAC/B,WAAW,EAAE,2BAA2B,CAAC,MAAM,OAAO,CAAC,qBAAqB,CAAC,EAAE;QAC7E,gBAAgB,EAAE,OAAO,CAAC,4CAA4C,CAAC;KACxE,CAAC;CACH,CAAC,CACH,CAAA","sourcesContent":["import { defineGraphRuntimeFactory } from \"@voyant-travel/core/project\"\n\nimport { customerBusinessAccountOnboardingRuntimePort } from \"./customer-business-onboarding-runtime-port.js\"\nimport { createStorefrontAdminRoutes } from \"./storefront-routes.js\"\nimport { storefrontRuntimePort } from \"./storefront-runtime-port.js\"\n\n/**\n * Selected-graph runtime for the storefront admin surface. The business\n * buyer-account capability is derived from whether the deployment also wires\n * the customer business-account onboarding runtime, so the admin UI can gate\n * the org-account controls on a real runtime signal rather than a static flag.\n */\nexport const createStorefrontVoyantRuntime = defineGraphRuntimeFactory(\n  async ({ getPort, hasPort }) => ({\n    module: { name: \"storefronts\" },\n    adminRoutes: createStorefrontAdminRoutes(await getPort(storefrontRuntimePort), {\n      businessAccounts: hasPort(customerBusinessAccountOnboardingRuntimePort),\n    }),\n  }),\n)\n"]}

package/dist/storefront-routes.d.ts

@@ -0,0 +1,18 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { type VoyantDb } from "@voyant-travel/hono";
+import type { StorefrontRuntimeProvider } from "./storefront-runtime-port.js";
+type StorefrontEnv = {
+    Bindings: Record<string, unknown>;
+    Variables: {
+        userId?: string;
+        organizationId?: string | null;
+        scopes?: string[] | null;
+        db: VoyantDb;
+    };
+};
+export interface StorefrontAdminRouteOptions {
+    /** Whether the deployment supports business (organization) buyer accounts. */
+    businessAccounts: boolean;
+}
+export declare function createStorefrontAdminRoutes(runtime: StorefrontRuntimeProvider, options: StorefrontAdminRouteOptions): OpenAPIHono<StorefrontEnv, {}, "/">;
+export {};

package/dist/storefront-routes.js

@@ -0,0 +1,282 @@
+import { createRoute, OpenAPIHono, z } from "@hono/zod-openapi";
+import { openApiValidationHook, parseJsonBody } from "@voyant-travel/hono";
+import { hasApiKeyPermission, permissionStringsToPermissions } from "@voyant-travel/types/api-keys";
+import { createStorefrontInputSchema, issueStorefrontApiKeyInputSchema, putStorefrontProviderCredentialInputSchema, setStorefrontAllowedOriginsInputSchema, updateStorefrontAccountPolicyInputSchema, updateStorefrontInputSchema, updateStorefrontMethodsInputSchema, } from "./storefront-admin-contracts.js";
+import { StorefrontInputError } from "./storefront-origins.js";
+const storefrontAdminApiId = "@voyant-travel/auth#storefront.api.admin";
+const jsonBody = (schema) => ({
+    required: true,
+    content: { "application/json": { schema } },
+});
+const responses = (...statuses) => Object.fromEntries(statuses.map((status) => [status, { description: `HTTP ${status}` }]));
+const storefrontRoute = (config) => createRoute({
+    method: config.method,
+    path: config.path,
+    operationId: config.operationId,
+    "x-voyant-api-id": storefrontAdminApiId,
+    ...(config.request ? { request: config.request } : {}),
+    responses: responses(...config.statuses),
+});
+const storefrontIdParams = z.object({ storefrontId: z.string() });
+const keyIdParams = z.object({ storefrontId: z.string(), keyId: z.string() });
+const providerParams = z.object({
+    storefrontId: z.string(),
+    provider: z.enum(["google", "facebook", "apple"]),
+});
+const capabilitiesRoute = storefrontRoute({
+    method: "get",
+    path: "/capabilities",
+    operationId: "getStorefrontCapabilities",
+    statuses: [200, 401, 403],
+});
+const listStorefrontsRoute = storefrontRoute({
+    method: "get",
+    path: "/storefronts",
+    operationId: "listStorefronts",
+    statuses: [200, 401, 403],
+});
+const createStorefrontRoute = storefrontRoute({
+    method: "post",
+    path: "/storefronts",
+    operationId: "createStorefront",
+    request: { body: jsonBody(createStorefrontInputSchema) },
+    statuses: [201, 400, 401, 403],
+});
+const getStorefrontRoute = storefrontRoute({
+    method: "get",
+    path: "/storefronts/{storefrontId}",
+    operationId: "getStorefront",
+    request: { params: storefrontIdParams },
+    statuses: [200, 401, 403, 404],
+});
+const updateStorefrontRoute = storefrontRoute({
+    method: "patch",
+    path: "/storefronts/{storefrontId}",
+    operationId: "updateStorefront",
+    request: { params: storefrontIdParams, body: jsonBody(updateStorefrontInputSchema) },
+    statuses: [200, 400, 401, 403, 404],
+});
+const deleteStorefrontRoute = storefrontRoute({
+    method: "delete",
+    path: "/storefronts/{storefrontId}",
+    operationId: "deleteStorefront",
+    request: { params: storefrontIdParams },
+    statuses: [204, 401, 403, 404],
+});
+const setAllowedOriginsRoute = storefrontRoute({
+    method: "put",
+    path: "/storefronts/{storefrontId}/allowed-origins",
+    operationId: "setStorefrontAllowedOrigins",
+    request: { params: storefrontIdParams, body: jsonBody(setStorefrontAllowedOriginsInputSchema) },
+    statuses: [200, 400, 401, 403, 404],
+});
+const listApiKeysRoute = storefrontRoute({
+    method: "get",
+    path: "/storefronts/{storefrontId}/keys",
+    operationId: "listStorefrontApiKeys",
+    request: { params: storefrontIdParams },
+    statuses: [200, 401, 403, 404],
+});
+const issueApiKeyRoute = storefrontRoute({
+    method: "post",
+    path: "/storefronts/{storefrontId}/keys",
+    operationId: "issueStorefrontApiKey",
+    request: { params: storefrontIdParams, body: jsonBody(issueStorefrontApiKeyInputSchema) },
+    statuses: [201, 400, 401, 403, 404],
+});
+const rotateApiKeyRoute = storefrontRoute({
+    method: "post",
+    path: "/storefronts/{storefrontId}/keys/{keyId}/rotate",
+    operationId: "rotateStorefrontApiKey",
+    request: { params: keyIdParams },
+    statuses: [201, 400, 401, 403, 404],
+});
+const revokeApiKeyRoute = storefrontRoute({
+    method: "delete",
+    path: "/storefronts/{storefrontId}/keys/{keyId}",
+    operationId: "revokeStorefrontApiKey",
+    request: { params: keyIdParams },
+    statuses: [204, 401, 403, 404],
+});
+const updateAccountPolicyRoute = storefrontRoute({
+    method: "put",
+    path: "/storefronts/{storefrontId}/account-policy",
+    operationId: "updateStorefrontAccountPolicy",
+    request: { params: storefrontIdParams, body: jsonBody(updateStorefrontAccountPolicyInputSchema) },
+    statuses: [200, 400, 401, 403, 404],
+});
+const updateMethodsRoute = storefrontRoute({
+    method: "put",
+    path: "/storefronts/{storefrontId}/methods",
+    operationId: "updateStorefrontMethods",
+    request: { params: storefrontIdParams, body: jsonBody(updateStorefrontMethodsInputSchema) },
+    statuses: [200, 400, 401, 403, 404],
+});
+const listProviderCredentialsRoute = storefrontRoute({
+    method: "get",
+    path: "/storefronts/{storefrontId}/provider-credentials",
+    operationId: "listStorefrontProviderCredentials",
+    request: { params: storefrontIdParams },
+    statuses: [200, 401, 403, 404],
+});
+const putProviderCredentialRoute = storefrontRoute({
+    method: "put",
+    path: "/storefronts/{storefrontId}/provider-credentials/{provider}",
+    operationId: "putStorefrontProviderCredential",
+    request: {
+        params: providerParams,
+        body: jsonBody(putStorefrontProviderCredentialInputSchema),
+    },
+    statuses: [204, 400, 401, 403, 404],
+});
+const deleteProviderCredentialRoute = storefrontRoute({
+    method: "delete",
+    path: "/storefronts/{storefrontId}/provider-credentials/{provider}",
+    operationId: "deleteStorefrontProviderCredential",
+    request: { params: providerParams },
+    statuses: [204, 401, 403, 404],
+});
+/**
+ * Resolve the operator-scoped request context. The organization is derived from
+ * the admin session — never a client parameter — so every write is bounded to
+ * the acting operator's organization.
+ */
+function requestContext(c) {
+    const userId = c.get("userId");
+    if (!userId)
+        return c.json({ error: "Unauthorized" }, 401);
+    const organizationId = c.get("organizationId");
+    if (!organizationId)
+        return c.json({ error: "No active operator organization." }, 403);
+    return { bindings: c.env, db: c.get("db"), organizationId };
+}
+function canManageStorefronts(c) {
+    return hasApiKeyPermission(permissionStringsToPermissions(c.get("scopes") ?? []), "storefronts", "write");
+}
+function requireManage(c) {
+    return canManageStorefronts(c) ? null : c.json({ error: "Forbidden" }, 403);
+}
+function handleError(c, error) {
+    if (error instanceof StorefrontInputError) {
+        return c.json({ error: error.message }, 400);
+    }
+    if (error instanceof Error &&
+        "status" in error &&
+        typeof error.status === "number" &&
+        error.status >= 400 &&
+        error.status <= 599) {
+        return c.json({ error: error.message }, error.status);
+    }
+    throw error;
+}
+export function createStorefrontAdminRoutes(runtime, options) {
+    const routes = new OpenAPIHono({ defaultHook: openApiValidationHook });
+    const run = async (c, operation, guard = "read") => {
+        const context = requestContext(c);
+        if (context instanceof Response)
+            return context;
+        if (guard === "write") {
+            const forbidden = requireManage(c);
+            if (forbidden)
+                return forbidden;
+        }
+        try {
+            return await operation(context);
+        }
+        catch (error) {
+            return handleError(c, error);
+        }
+    };
+    routes.openapi(capabilitiesRoute, (c) => {
+        if (!c.get("userId"))
+            return c.json({ error: "Unauthorized" }, 401);
+        if (!c.get("organizationId"))
+            return c.json({ error: "No active operator organization." }, 403);
+        const manageProviders = canManageStorefronts(c);
+        return c.json({
+            data: { businessAccounts: options.businessAccounts, manageProviders },
+        });
+    });
+    routes.openapi(listStorefrontsRoute, async (c) => {
+        const result = await run(c, (context) => runtime.listStorefronts(context));
+        return result instanceof Response ? result : c.json({ data: result });
+    });
+    routes.openapi(createStorefrontRoute, async (c) => {
+        const input = await parseJsonBody(c, createStorefrontInputSchema);
+        const result = await run(c, (context) => runtime.createStorefront(context, input), "write");
+        return result instanceof Response ? result : c.json({ data: result }, 201);
+    });
+    routes.openapi(getStorefrontRoute, async (c) => {
+        const { storefrontId } = c.req.param();
+        const result = await run(c, (context) => runtime.getStorefront(context, storefrontId));
+        return result instanceof Response ? result : c.json({ data: result });
+    });
+    routes.openapi(updateStorefrontRoute, async (c) => {
+        const { storefrontId } = c.req.param();
+        const input = await parseJsonBody(c, updateStorefrontInputSchema);
+        const result = await run(c, (context) => runtime.updateStorefront(context, storefrontId, input), "write");
+        return result instanceof Response ? result : c.json({ data: result });
+    });
+    routes.openapi(deleteStorefrontRoute, async (c) => {
+        const { storefrontId } = c.req.param();
+        const result = await run(c, (context) => runtime.deleteStorefront(context, storefrontId), "write");
+        return result instanceof Response ? result : c.body(null, 204);
+    });
+    routes.openapi(setAllowedOriginsRoute, async (c) => {
+        const { storefrontId } = c.req.param();
+        const input = await parseJsonBody(c, setStorefrontAllowedOriginsInputSchema);
+        const result = await run(c, (context) => runtime.setAllowedOrigins(context, storefrontId, input.origins), "write");
+        return result instanceof Response ? result : c.json({ data: result });
+    });
+    routes.openapi(listApiKeysRoute, async (c) => {
+        const { storefrontId } = c.req.param();
+        const result = await run(c, (context) => runtime.listApiKeys(context, storefrontId));
+        return result instanceof Response ? result : c.json({ data: result });
+    });
+    routes.openapi(issueApiKeyRoute, async (c) => {
+        const { storefrontId } = c.req.param();
+        const input = await parseJsonBody(c, issueStorefrontApiKeyInputSchema);
+        const result = await run(c, (context) => runtime.issueApiKey(context, storefrontId, input.kind, input.name ?? null), "write");
+        return result instanceof Response ? result : c.json({ data: result }, 201);
+    });
+    routes.openapi(rotateApiKeyRoute, async (c) => {
+        const { storefrontId, keyId } = c.req.param();
+        const result = await run(c, (context) => runtime.rotateApiKey(context, storefrontId, keyId), "write");
+        return result instanceof Response ? result : c.json({ data: result }, 201);
+    });
+    routes.openapi(revokeApiKeyRoute, async (c) => {
+        const { storefrontId, keyId } = c.req.param();
+        const result = await run(c, (context) => runtime.revokeApiKey(context, storefrontId, keyId), "write");
+        return result instanceof Response ? result : c.body(null, 204);
+    });
+    routes.openapi(updateAccountPolicyRoute, async (c) => {
+        const { storefrontId } = c.req.param();
+        const input = await parseJsonBody(c, updateStorefrontAccountPolicyInputSchema);
+        const result = await run(c, (context) => runtime.updateAccountPolicy(context, storefrontId, input), "write");
+        return result instanceof Response ? result : c.json({ data: result });
+    });
+    routes.openapi(updateMethodsRoute, async (c) => {
+        const { storefrontId } = c.req.param();
+        const input = await parseJsonBody(c, updateStorefrontMethodsInputSchema);
+        const result = await run(c, (context) => runtime.updateMethods(context, storefrontId, input), "write");
+        return result instanceof Response ? result : c.json({ data: result });
+    });
+    routes.openapi(listProviderCredentialsRoute, async (c) => {
+        const { storefrontId } = c.req.param();
+        const result = await run(c, (context) => runtime.listProviderCredentials(context, storefrontId));
+        return result instanceof Response ? result : c.json({ data: result });
+    });
+    routes.openapi(putProviderCredentialRoute, async (c) => {
+        const { storefrontId, provider } = c.req.param();
+        const input = await parseJsonBody(c, putStorefrontProviderCredentialInputSchema);
+        const result = await run(c, (context) => runtime.putProviderCredential(context, storefrontId, provider, input), "write");
+        return result instanceof Response ? result : c.body(null, 204);
+    });
+    routes.openapi(deleteProviderCredentialRoute, async (c) => {
+        const { storefrontId, provider } = c.req.param();
+        const result = await run(c, (context) => runtime.deleteProviderCredential(context, storefrontId, provider), "write");
+        return result instanceof Response ? result : c.body(null, 204);
+    });
+    return routes;
+}
+//# sourceMappingURL=storefront-routes.js.map

package/dist/storefront-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storefront-routes.js","sourceRoot":"","sources":["../src/storefront-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAiB,MAAM,qBAAqB,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAA;AAGnG,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,EAChC,0CAA0C,EAC1C,sCAAsC,EACtC,wCAAwC,EACxC,2BAA2B,EAC3B,kCAAkC,GACnC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAiB9D,MAAM,oBAAoB,GAAG,0CAA0C,CAAA;AACvE,MAAM,QAAQ,GAAG,CAAyB,MAAS,EAAE,EAAE,CAAC,CAAC;IACvD,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE;CAC5C,CAAC,CAAA;AACF,MAAM,SAAS,GAAG,CAAC,GAAG,QAAkB,EAAE,EAAE,CAC1C,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;AAC3F,MAAM,eAAe,GAAG,CAGtB,MAMD,EAAE,EAAE,CACH,WAAW,CAAC;IACV,MAAM,EAAE,MAAM,CAAC,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,WAAW,EAAE,MAAM,CAAC,WAAW;IAC/B,iBAAiB,EAAE,oBAAoB;IACvC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;CACzC,CAAC,CAAA;AAEJ,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACjE,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAC7E,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;CAClD,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,eAAe,CAAC;IACxC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,2BAA2B;IACxC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC1B,CAAC,CAAA;AACF,MAAM,oBAAoB,GAAG,eAAe,CAAC;IAC3C,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,iBAAiB;IAC9B,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC1B,CAAC,CAAA;AACF,MAAM,qBAAqB,GAAG,eAAe,CAAC;IAC5C,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,kBAAkB;IAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,2BAA2B,CAAC,EAAE;IACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,kBAAkB,GAAG,eAAe,CAAC;IACzC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,eAAe;IAC5B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,qBAAqB,GAAG,eAAe,CAAC;IAC5C,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,kBAAkB;IAC/B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,CAAC,2BAA2B,CAAC,EAAE;IACpF,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,qBAAqB,GAAG,eAAe,CAAC;IAC5C,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,kBAAkB;IAC/B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,sBAAsB,GAAG,eAAe,CAAC;IAC7C,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,6CAA6C;IACnD,WAAW,EAAE,6BAA6B;IAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,CAAC,sCAAsC,CAAC,EAAE;IAC/F,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,gBAAgB,GAAG,eAAe,CAAC;IACvC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,kCAAkC;IACxC,WAAW,EAAE,uBAAuB;IACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,gBAAgB,GAAG,eAAe,CAAC;IACvC,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,kCAAkC;IACxC,WAAW,EAAE,uBAAuB;IACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,CAAC,gCAAgC,CAAC,EAAE;IACzF,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,iBAAiB,GAAG,eAAe,CAAC;IACxC,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,iDAAiD;IACvD,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;IAChC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,iBAAiB,GAAG,eAAe,CAAC;IACxC,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,0CAA0C;IAChD,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;IAChC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,wBAAwB,GAAG,eAAe,CAAC;IAC/C,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,4CAA4C;IAClD,WAAW,EAAE,+BAA+B;IAC5C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,CAAC,wCAAwC,CAAC,EAAE;IACjG,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,kBAAkB,GAAG,eAAe,CAAC;IACzC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,qCAAqC;IAC3C,WAAW,EAAE,yBAAyB;IACtC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,CAAC,kCAAkC,CAAC,EAAE;IAC3F,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,4BAA4B,GAAG,eAAe,CAAC;IACnD,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,kDAAkD;IACxD,WAAW,EAAE,mCAAmC;IAChD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AACF,MAAM,0BAA0B,GAAG,eAAe,CAAC;IACjD,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,6DAA6D;IACnE,WAAW,EAAE,iCAAiC;IAC9C,OAAO,EAAE;QACP,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,QAAQ,CAAC,0CAA0C,CAAC;KAC3D;IACD,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CACpC,CAAC,CAAA;AACF,MAAM,6BAA6B,GAAG,eAAe,CAAC;IACpD,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,6DAA6D;IACnE,WAAW,EAAE,oCAAoC;IACjD,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;IACnC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;CAC/B,CAAC,CAAA;AAEF;;;;GAIG;AACH,SAAS,cAAc,CAAC,CAAyB;IAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAC9C,IAAI,CAAC,cAAc;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtF,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAA;AAC7D,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAyB;IACrD,OAAO,mBAAmB,CACxB,8BAA8B,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EACrD,aAAa,EACb,OAAO,CACR,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,CAAyB;IAC9C,OAAO,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,CAAyB,EAAE,KAAc;IAC5D,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;QAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;IAC9C,CAAC;IACD,IACE,KAAK,YAAY,KAAK;QACtB,QAAQ,IAAI,KAAK;QACjB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,KAAK,CAAC,MAAM,IAAI,GAAG,EACnB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,MAAa,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,KAAK,CAAA;AACb,CAAC;AAOD,MAAM,UAAU,2BAA2B,CACzC,OAAkC,EAClC,OAAoC;IAEpC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAgB,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAErF,MAAM,GAAG,GAAG,KAAK,EACf,CAAyB,EACzB,SAA4D,EAC5D,QAA0B,MAAM,EACT,EAAE;QACzB,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;QACjC,IAAI,OAAO,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC/C,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;YAClC,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAA;QACjC,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE;QACtC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QACnE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/F,MAAM,eAAe,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QAC/C,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,eAAe,EAAE;SACtE,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QAC1E,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAA;QACjE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;QAC3F,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACtF,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAA;QACjE,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,CAAC,EACD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EACnE,OAAO,CACR,CAAA;QACD,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,CAAC,EACD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,EAC5D,OAAO,CACR,CAAA;QACD,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,sCAAsC,CAAC,CAAA;QAC5E,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,CAAC,EACD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,EAC5E,OAAO,CACR,CAAA;QACD,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACpF,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAA;QACtE,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,CAAC,EACD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,EACvF,OAAO,CACR,CAAA;QACD,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QAC7C,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,CAAC,EACD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAC/D,OAAO,CACR,CAAA;QACD,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QAC7C,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,CAAC,EACD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAC/D,OAAO,CACR,CAAA;QACD,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAA;QAC9E,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,CAAC,EACD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EACtE,OAAO,CACR,CAAA;QACD,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,kCAAkC,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,CAAC,EACD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAChE,OAAO,CACR,CAAA;QACD,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAChG,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAoC,CAAA;QAClF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,0CAA0C,CAAC,CAAA;QAChF,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,CAAC,EACD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,EAClF,OAAO,CACR,CAAA;QACD,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAoC,CAAA;QAClF,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,CAAC,EACD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,EAC9E,OAAO,CACR,CAAA;QACD,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC","sourcesContent":["import { createRoute, OpenAPIHono, z } from \"@hono/zod-openapi\"\nimport { openApiValidationHook, parseJsonBody, type VoyantDb } from \"@voyant-travel/hono\"\nimport { hasApiKeyPermission, permissionStringsToPermissions } from \"@voyant-travel/types/api-keys\"\nimport type { Context } from \"hono\"\n\nimport {\n  createStorefrontInputSchema,\n  issueStorefrontApiKeyInputSchema,\n  putStorefrontProviderCredentialInputSchema,\n  setStorefrontAllowedOriginsInputSchema,\n  updateStorefrontAccountPolicyInputSchema,\n  updateStorefrontInputSchema,\n  updateStorefrontMethodsInputSchema,\n} from \"./storefront-admin-contracts.js\"\nimport { StorefrontInputError } from \"./storefront-origins.js\"\nimport type {\n  StorefrontRequestContext,\n  StorefrontRuntimeProvider,\n} from \"./storefront-runtime-port.js\"\n\ntype StorefrontEnv = {\n  Bindings: Record<string, unknown>\n  Variables: {\n    userId?: string\n    organizationId?: string | null\n    scopes?: string[] | null\n    db: VoyantDb\n  }\n}\ntype StorefrontRouteContext = Context<StorefrontEnv>\n\nconst storefrontAdminApiId = \"@voyant-travel/auth#storefront.api.admin\"\nconst jsonBody = <T extends z.ZodTypeAny>(schema: T) => ({\n  required: true,\n  content: { \"application/json\": { schema } },\n})\nconst responses = (...statuses: number[]) =>\n  Object.fromEntries(statuses.map((status) => [status, { description: `HTTP ${status}` }]))\nconst storefrontRoute = <\n  M extends \"get\" | \"post\" | \"put\" | \"patch\" | \"delete\",\n  P extends string,\n>(config: {\n  method: M\n  path: P\n  operationId: string\n  request?: Record<string, unknown>\n  statuses: number[]\n}) =>\n  createRoute({\n    method: config.method,\n    path: config.path,\n    operationId: config.operationId,\n    \"x-voyant-api-id\": storefrontAdminApiId,\n    ...(config.request ? { request: config.request } : {}),\n    responses: responses(...config.statuses),\n  })\n\nconst storefrontIdParams = z.object({ storefrontId: z.string() })\nconst keyIdParams = z.object({ storefrontId: z.string(), keyId: z.string() })\nconst providerParams = z.object({\n  storefrontId: z.string(),\n  provider: z.enum([\"google\", \"facebook\", \"apple\"]),\n})\n\nconst capabilitiesRoute = storefrontRoute({\n  method: \"get\",\n  path: \"/capabilities\",\n  operationId: \"getStorefrontCapabilities\",\n  statuses: [200, 401, 403],\n})\nconst listStorefrontsRoute = storefrontRoute({\n  method: \"get\",\n  path: \"/storefronts\",\n  operationId: \"listStorefronts\",\n  statuses: [200, 401, 403],\n})\nconst createStorefrontRoute = storefrontRoute({\n  method: \"post\",\n  path: \"/storefronts\",\n  operationId: \"createStorefront\",\n  request: { body: jsonBody(createStorefrontInputSchema) },\n  statuses: [201, 400, 401, 403],\n})\nconst getStorefrontRoute = storefrontRoute({\n  method: \"get\",\n  path: \"/storefronts/{storefrontId}\",\n  operationId: \"getStorefront\",\n  request: { params: storefrontIdParams },\n  statuses: [200, 401, 403, 404],\n})\nconst updateStorefrontRoute = storefrontRoute({\n  method: \"patch\",\n  path: \"/storefronts/{storefrontId}\",\n  operationId: \"updateStorefront\",\n  request: { params: storefrontIdParams, body: jsonBody(updateStorefrontInputSchema) },\n  statuses: [200, 400, 401, 403, 404],\n})\nconst deleteStorefrontRoute = storefrontRoute({\n  method: \"delete\",\n  path: \"/storefronts/{storefrontId}\",\n  operationId: \"deleteStorefront\",\n  request: { params: storefrontIdParams },\n  statuses: [204, 401, 403, 404],\n})\nconst setAllowedOriginsRoute = storefrontRoute({\n  method: \"put\",\n  path: \"/storefronts/{storefrontId}/allowed-origins\",\n  operationId: \"setStorefrontAllowedOrigins\",\n  request: { params: storefrontIdParams, body: jsonBody(setStorefrontAllowedOriginsInputSchema) },\n  statuses: [200, 400, 401, 403, 404],\n})\nconst listApiKeysRoute = storefrontRoute({\n  method: \"get\",\n  path: \"/storefronts/{storefrontId}/keys\",\n  operationId: \"listStorefrontApiKeys\",\n  request: { params: storefrontIdParams },\n  statuses: [200, 401, 403, 404],\n})\nconst issueApiKeyRoute = storefrontRoute({\n  method: \"post\",\n  path: \"/storefronts/{storefrontId}/keys\",\n  operationId: \"issueStorefrontApiKey\",\n  request: { params: storefrontIdParams, body: jsonBody(issueStorefrontApiKeyInputSchema) },\n  statuses: [201, 400, 401, 403, 404],\n})\nconst rotateApiKeyRoute = storefrontRoute({\n  method: \"post\",\n  path: \"/storefronts/{storefrontId}/keys/{keyId}/rotate\",\n  operationId: \"rotateStorefrontApiKey\",\n  request: { params: keyIdParams },\n  statuses: [201, 400, 401, 403, 404],\n})\nconst revokeApiKeyRoute = storefrontRoute({\n  method: \"delete\",\n  path: \"/storefronts/{storefrontId}/keys/{keyId}\",\n  operationId: \"revokeStorefrontApiKey\",\n  request: { params: keyIdParams },\n  statuses: [204, 401, 403, 404],\n})\nconst updateAccountPolicyRoute = storefrontRoute({\n  method: \"put\",\n  path: \"/storefronts/{storefrontId}/account-policy\",\n  operationId: \"updateStorefrontAccountPolicy\",\n  request: { params: storefrontIdParams, body: jsonBody(updateStorefrontAccountPolicyInputSchema) },\n  statuses: [200, 400, 401, 403, 404],\n})\nconst updateMethodsRoute = storefrontRoute({\n  method: \"put\",\n  path: \"/storefronts/{storefrontId}/methods\",\n  operationId: \"updateStorefrontMethods\",\n  request: { params: storefrontIdParams, body: jsonBody(updateStorefrontMethodsInputSchema) },\n  statuses: [200, 400, 401, 403, 404],\n})\nconst listProviderCredentialsRoute = storefrontRoute({\n  method: \"get\",\n  path: \"/storefronts/{storefrontId}/provider-credentials\",\n  operationId: \"listStorefrontProviderCredentials\",\n  request: { params: storefrontIdParams },\n  statuses: [200, 401, 403, 404],\n})\nconst putProviderCredentialRoute = storefrontRoute({\n  method: \"put\",\n  path: \"/storefronts/{storefrontId}/provider-credentials/{provider}\",\n  operationId: \"putStorefrontProviderCredential\",\n  request: {\n    params: providerParams,\n    body: jsonBody(putStorefrontProviderCredentialInputSchema),\n  },\n  statuses: [204, 400, 401, 403, 404],\n})\nconst deleteProviderCredentialRoute = storefrontRoute({\n  method: \"delete\",\n  path: \"/storefronts/{storefrontId}/provider-credentials/{provider}\",\n  operationId: \"deleteStorefrontProviderCredential\",\n  request: { params: providerParams },\n  statuses: [204, 401, 403, 404],\n})\n\n/**\n * Resolve the operator-scoped request context. The organization is derived from\n * the admin session — never a client parameter — so every write is bounded to\n * the acting operator's organization.\n */\nfunction requestContext(c: StorefrontRouteContext): StorefrontRequestContext | Response {\n  const userId = c.get(\"userId\")\n  if (!userId) return c.json({ error: \"Unauthorized\" }, 401)\n  const organizationId = c.get(\"organizationId\")\n  if (!organizationId) return c.json({ error: \"No active operator organization.\" }, 403)\n  return { bindings: c.env, db: c.get(\"db\"), organizationId }\n}\n\nfunction canManageStorefronts(c: StorefrontRouteContext): boolean {\n  return hasApiKeyPermission(\n    permissionStringsToPermissions(c.get(\"scopes\") ?? []),\n    \"storefronts\",\n    \"write\",\n  )\n}\n\nfunction requireManage(c: StorefrontRouteContext): Response | null {\n  return canManageStorefronts(c) ? null : c.json({ error: \"Forbidden\" }, 403)\n}\n\nfunction handleError(c: StorefrontRouteContext, error: unknown): Response {\n  if (error instanceof StorefrontInputError) {\n    return c.json({ error: error.message }, 400)\n  }\n  if (\n    error instanceof Error &&\n    \"status\" in error &&\n    typeof error.status === \"number\" &&\n    error.status >= 400 &&\n    error.status <= 599\n  ) {\n    return c.json({ error: error.message }, error.status as 400)\n  }\n  throw error\n}\n\nexport interface StorefrontAdminRouteOptions {\n  /** Whether the deployment supports business (organization) buyer accounts. */\n  businessAccounts: boolean\n}\n\nexport function createStorefrontAdminRoutes(\n  runtime: StorefrontRuntimeProvider,\n  options: StorefrontAdminRouteOptions,\n) {\n  const routes = new OpenAPIHono<StorefrontEnv>({ defaultHook: openApiValidationHook })\n\n  const run = async <T>(\n    c: StorefrontRouteContext,\n    operation: (context: StorefrontRequestContext) => Promise<T>,\n    guard: \"read\" | \"write\" = \"read\",\n  ): Promise<T | Response> => {\n    const context = requestContext(c)\n    if (context instanceof Response) return context\n    if (guard === \"write\") {\n      const forbidden = requireManage(c)\n      if (forbidden) return forbidden\n    }\n    try {\n      return await operation(context)\n    } catch (error) {\n      return handleError(c, error)\n    }\n  }\n\n  routes.openapi(capabilitiesRoute, (c) => {\n    if (!c.get(\"userId\")) return c.json({ error: \"Unauthorized\" }, 401)\n    if (!c.get(\"organizationId\")) return c.json({ error: \"No active operator organization.\" }, 403)\n    const manageProviders = canManageStorefronts(c)\n    return c.json({\n      data: { businessAccounts: options.businessAccounts, manageProviders },\n    })\n  })\n\n  routes.openapi(listStorefrontsRoute, async (c) => {\n    const result = await run(c, (context) => runtime.listStorefronts(context))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n\n  routes.openapi(createStorefrontRoute, async (c) => {\n    const input = await parseJsonBody(c, createStorefrontInputSchema)\n    const result = await run(c, (context) => runtime.createStorefront(context, input), \"write\")\n    return result instanceof Response ? result : c.json({ data: result }, 201)\n  })\n\n  routes.openapi(getStorefrontRoute, async (c) => {\n    const { storefrontId } = c.req.param()\n    const result = await run(c, (context) => runtime.getStorefront(context, storefrontId))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n\n  routes.openapi(updateStorefrontRoute, async (c) => {\n    const { storefrontId } = c.req.param()\n    const input = await parseJsonBody(c, updateStorefrontInputSchema)\n    const result = await run(\n      c,\n      (context) => runtime.updateStorefront(context, storefrontId, input),\n      \"write\",\n    )\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n\n  routes.openapi(deleteStorefrontRoute, async (c) => {\n    const { storefrontId } = c.req.param()\n    const result = await run(\n      c,\n      (context) => runtime.deleteStorefront(context, storefrontId),\n      \"write\",\n    )\n    return result instanceof Response ? result : c.body(null, 204)\n  })\n\n  routes.openapi(setAllowedOriginsRoute, async (c) => {\n    const { storefrontId } = c.req.param()\n    const input = await parseJsonBody(c, setStorefrontAllowedOriginsInputSchema)\n    const result = await run(\n      c,\n      (context) => runtime.setAllowedOrigins(context, storefrontId, input.origins),\n      \"write\",\n    )\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n\n  routes.openapi(listApiKeysRoute, async (c) => {\n    const { storefrontId } = c.req.param()\n    const result = await run(c, (context) => runtime.listApiKeys(context, storefrontId))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n\n  routes.openapi(issueApiKeyRoute, async (c) => {\n    const { storefrontId } = c.req.param()\n    const input = await parseJsonBody(c, issueStorefrontApiKeyInputSchema)\n    const result = await run(\n      c,\n      (context) => runtime.issueApiKey(context, storefrontId, input.kind, input.name ?? null),\n      \"write\",\n    )\n    return result instanceof Response ? result : c.json({ data: result }, 201)\n  })\n\n  routes.openapi(rotateApiKeyRoute, async (c) => {\n    const { storefrontId, keyId } = c.req.param()\n    const result = await run(\n      c,\n      (context) => runtime.rotateApiKey(context, storefrontId, keyId),\n      \"write\",\n    )\n    return result instanceof Response ? result : c.json({ data: result }, 201)\n  })\n\n  routes.openapi(revokeApiKeyRoute, async (c) => {\n    const { storefrontId, keyId } = c.req.param()\n    const result = await run(\n      c,\n      (context) => runtime.revokeApiKey(context, storefrontId, keyId),\n      \"write\",\n    )\n    return result instanceof Response ? result : c.body(null, 204)\n  })\n\n  routes.openapi(updateAccountPolicyRoute, async (c) => {\n    const { storefrontId } = c.req.param()\n    const input = await parseJsonBody(c, updateStorefrontAccountPolicyInputSchema)\n    const result = await run(\n      c,\n      (context) => runtime.updateAccountPolicy(context, storefrontId, input),\n      \"write\",\n    )\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n\n  routes.openapi(updateMethodsRoute, async (c) => {\n    const { storefrontId } = c.req.param()\n    const input = await parseJsonBody(c, updateStorefrontMethodsInputSchema)\n    const result = await run(\n      c,\n      (context) => runtime.updateMethods(context, storefrontId, input),\n      \"write\",\n    )\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n\n  routes.openapi(listProviderCredentialsRoute, async (c) => {\n    const { storefrontId } = c.req.param()\n    const result = await run(c, (context) => runtime.listProviderCredentials(context, storefrontId))\n    return result instanceof Response ? result : c.json({ data: result })\n  })\n\n  routes.openapi(putProviderCredentialRoute, async (c) => {\n    const { storefrontId, provider } = c.req.param() as z.infer<typeof providerParams>\n    const input = await parseJsonBody(c, putStorefrontProviderCredentialInputSchema)\n    const result = await run(\n      c,\n      (context) => runtime.putProviderCredential(context, storefrontId, provider, input),\n      \"write\",\n    )\n    return result instanceof Response ? result : c.body(null, 204)\n  })\n\n  routes.openapi(deleteProviderCredentialRoute, async (c) => {\n    const { storefrontId, provider } = c.req.param() as z.infer<typeof providerParams>\n    const result = await run(\n      c,\n      (context) => runtime.deleteProviderCredential(context, storefrontId, provider),\n      \"write\",\n    )\n    return result instanceof Response ? result : c.body(null, 204)\n  })\n\n  return routes\n}\n"]}

package/dist/voyant.js

@@ -434,9 +434,85 @@ export const authStorefrontVoyantModule = defineModule({
     localId: "auth.storefront",
     // Self-host storefront access model: keys, operator-declared origins, and
     // KMS-encrypted provider credentials backing the local customer-auth
-    // resolver. Admin routes/tools and the managed cloud adapter are follow-ups.
+    // resolver, surfaced through the operator "Storefronts" admin surface. The
+    // managed cloud storefront adapter is a follow-up.
     provides: { ports: [providePort(storefrontRuntimePort)] },
-    runtimePorts: [requirePort(storefrontRuntimePort)],
+    runtimePorts: [
+        requirePort(storefrontRuntimePort),
+        requirePort(customerBusinessAccountOnboardingRuntimePort, { optional: true }),
+    ],
+    api: [
+        {
+            id: "@voyant-travel/auth#storefront.api.admin",
+            surface: "admin",
+            mount: "storefronts",
+            resource: "storefronts",
+            openapi: { document: "storefronts" },
+            transactional: true,
+            runtime: {
+                entry: "@voyant-travel/auth/storefront-graph-runtime",
+                export: "createStorefrontVoyantRuntime",
+            },
+        },
+    ],
+    access: {
+        resources: [
+            {
+                id: "@voyant-travel/auth#access.storefronts",
+                resource: "storefronts",
+                label: "Storefronts",
+                description: "Manage storefront access keys, origins, and customer auth.",
+                actions: [
+                    {
+                        action: "read",
+                        label: "View storefronts",
+                        description: "View storefront configuration, keys, and provider status.",
+                    },
+                    {
+                        action: "write",
+                        label: "Manage storefronts",
+                        description: "Create storefronts, issue keys, and configure origins, methods, and provider credentials.",
+                        sensitive: true,
+                    },
+                    {
+                        action: "delete",
+                        label: "Delete storefronts",
+                        description: "Delete storefronts and revoke their access keys.",
+                        sensitive: true,
+                    },
+                ],
+            },
+        ],
+    },
+    admin: {
+        compositionOrder: 7,
+        runtime: {
+            entry: "@voyant-travel/auth-react/admin",
+            export: "createSelectedStorefrontAdminExtension",
+        },
+        copy: [
+            {
+                id: "@voyant-travel/auth#storefront.admin.copy",
+                namespace: "auth.admin.storefronts",
+                fallbackLocale: "en",
+                runtime: {
+                    entry: "@voyant-travel/auth-react/i18n",
+                    export: "authUiMessageDefinitions",
+                },
+            },
+        ],
+        routes: [
+            {
+                id: "@voyant-travel/auth#storefront.admin.route",
+                path: "/storefronts",
+                requiredScopes: ["storefronts:read"],
+                runtime: {
+                    entry: "@voyant-travel/auth-react/admin",
+                    export: "createSelectedStorefrontAdminExtension",
+                },
+            },
+        ],
+    },
     meta: {
         ownership: "package",
         agentTools: {

package/dist/voyant.js.map

@@ -1 +1 @@
-{"version":3,"file":"voyant.js","sourceRoot":"","sources":["../src/voyant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACpF,OAAO,EAAE,4CAA4C,EAAE,MAAM,gDAAgD,CAAA;AAC7G,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAE7E,MAAM,CAAC,MAAM,wCAAwC,GAAG,YAAY,CAAC;IACnE,EAAE,EAAE,gDAAgD;IACpD,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,iCAAiC;IAC1C,QAAQ,EAAE,EAAE,YAAY,EAAE,CAAC,uBAAuB,CAAC,EAAE;IACrD,YAAY,EAAE,CAAC,WAAW,CAAC,4CAA4C,CAAC,CAAC;IACzE,GAAG,EAAE;QACH;YACE,EAAE,EAAE,0DAA0D;YAC9D,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,4BAA4B;YACnC,QAAQ,EAAE,4BAA4B;YACtC,OAAO,EAAE,EAAE,QAAQ,EAAE,4BAA4B,EAAE;YACnD,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,gEAAgE;gBACvE,MAAM,EAAE,4CAA4C;aACrD;SACF;KACF;IACD,MAAM,EAAE;QACN,SAAS,EAAE;YACT;gBACE,EAAE,EAAE,uDAAuD;gBAC3D,QAAQ,EAAE,4BAA4B;gBACtC,KAAK,EAAE,4BAA4B;gBACnC,WAAW,EAAE,sEAAsE;gBACnF,OAAO,EAAE;oBACP;wBACE,MAAM,EAAE,MAAM;wBACd,KAAK,EAAE,iCAAiC;wBACxC,WAAW,EAAE,sEAAsE;qBACpF;oBACD;wBACE,MAAM,EAAE,OAAO;wBACf,KAAK,EAAE,mCAAmC;wBAC1C,WAAW,EAAE,4DAA4D;wBACzE,SAAS,EAAE,IAAI;qBAChB;iBACF;aACF;SACF;KACF;IACD,KAAK,EAAE;QACL,gBAAgB,EAAE,CAAC;QACnB,OAAO,EAAE;YACP,KAAK,EAAE,iCAAiC;YACxC,MAAM,EAAE,sDAAsD;SAC/D;QACD,IAAI,EAAE;YACJ;gBACE,EAAE,EAAE,2DAA2D;gBAC/D,SAAS,EAAE,uCAAuC;gBAClD,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE;oBACP,KAAK,EAAE,gCAAgC;oBACvC,MAAM,EAAE,0BAA0B;iBACnC;aACF;SACF;QACD,MAAM,EAAE;YACN;gBACE,EAAE,EAAE,4DAA4D;gBAChE,IAAI,EAAE,oBAAoB;gBAC1B,cAAc,EAAE,CAAC,iCAAiC,CAAC;gBACnD,OAAO,EAAE;oBACP,KAAK,EAAE,iCAAiC;oBACxC,MAAM,EAAE,sDAAsD;iBAC/D;aACF;SACF;KACF;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE;YACV,OAAO,EAAE,gBAAgB;YACzB,SAAS,EAAE,4EAA4E;SACxF;KACF;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;IACtD,EAAE,EAAE,iCAAiC;IACrC,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,EAAE;IAC7D,YAAY,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IACtD,GAAG,EAAE;QACH;YACE,EAAE,EAAE,2CAA2C;YAC/C,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YACpC,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,mDAAmD;gBAC1D,MAAM,EAAE,gCAAgC;aACzC;SACF;QACD;YACE,EAAE,EAAE,4CAA4C;YAChD,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YACpC,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,mDAAmD;gBAC1D,MAAM,EAAE,gCAAgC;aACzC;SACF;KACF;IACD,aAAa,EAAE;QACb;YACE,EAAE,EAAE,6CAA6C;YACjD,OAAO,EAAE;gBACP,KAAK,EAAE,6CAA6C;gBACpD,MAAM,EAAE,kCAAkC;aAC3C;SACF;KACF;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE;YACV,OAAO,EAAE,gBAAgB;YACzB,SAAS,EACP,uHAAuH;SAC1H;KACF;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;IAC/C,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,EAAE;IAC7D,YAAY,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IACtD,GAAG,EAAE;QACH;YACE,EAAE,EAAE,oCAAoC;YACxC,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;YAC7B,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,mDAAmD;gBAC1D,MAAM,EAAE,yBAAyB;aAClC;SACF;KACF;IACD,MAAM,EAAE;QACN,SAAS,EAAE;YACT;gBACE,EAAE,EAAE,iCAAiC;gBACrC,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,MAAM;gBACb,WAAW,EAAE,6CAA6C;gBAC1D,QAAQ,EAAE,mBAAmB;gBAC7B,OAAO,EAAE;oBACP;wBACE,MAAM,EAAE,MAAM;wBACd,KAAK,EAAE,WAAW;wBAClB,WAAW,EAAE,0BAA0B;qBACxC;oBACD;wBACE,MAAM,EAAE,OAAO;wBACf,KAAK,EAAE,aAAa;wBACpB,WAAW,EAAE,0CAA0C;wBACvD,SAAS,EAAE,IAAI;wBACf,QAAQ,EAAE,UAAU;qBACrB;oBACD;wBACE,MAAM,EAAE,QAAQ;wBAChB,KAAK,EAAE,oBAAoB;wBAC3B,WAAW,EAAE,sDAAsD;wBACnE,SAAS,EAAE,IAAI;wBACf,QAAQ,EAAE,UAAU;qBACrB;iBACF;aACF;SACF;KACF;IACD,KAAK,EAAE;QACL;YACE,EAAE,EAAE,gDAAgD;YACpD,IAAI,EAAE,kCAAkC;YACxC,OAAO,EAAE;gBACP,KAAK,EAAE,2BAA2B;gBAClC,MAAM,EAAE,mCAAmC;aAC5C;YACD,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,KAAK;SACZ;QACD;YACE,EAAE,EAAE,4CAA4C;YAChD,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,qBAAqB,EAAE;YAC9E,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,0CAA0C;YAC9C,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,mBAAmB,EAAE;YAC5E,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,KAAK;SACZ;QACD;YACE,EAAE,EAAE,gDAAgD;YACpD,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,yBAAyB,EAAE;YAClF,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,6CAA6C;YACjD,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,sBAAsB,EAAE;YAC/E,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,iDAAiD;YACrD,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,0BAA0B,EAAE;YACnF,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,kDAAkD;YACtD,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,0BAA0B,EAAE;YACnF,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,+CAA+C;YACnD,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,wBAAwB,EAAE;YACjF,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,iDAAiD;YACrD,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,0BAA0B,EAAE;YACnF,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;KACF;IACD,OAAO,EAAE;QACP;YACE,EAAE,EAAE,kDAAkD;YACtD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,mBAAmB;YAC/B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,OAAO;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,gDAAgD,CAAC,EAAE;SACpE;QACD;YACE,EAAE,EAAE,8CAA8C;YAClD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,OAAO;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,4CAA4C,CAAC,EAAE;SAChE;QACD;YACE,EAAE,EAAE,4CAA4C;YAChD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,WAAW;YACvB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,OAAO;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,0CAA0C,CAAC,EAAE;SAC9D;QACD;YACE,EAAE,EAAE,kDAAkD;YACtD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,OAAO;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,gDAAgD,CAAC,EAAE;SACpE;QACD;YACE,EAAE,EAAE,+CAA+C;YACnD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,OAAO;YACf,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,6CAA6C,CAAC,EAAE;SACjE;QACD;YACE,EAAE,EAAE,mDAAmD;YACvD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,QAAQ;YAChB,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,iDAAiD,CAAC,EAAE;SACrE;QACD;YACE,EAAE,EAAE,oDAAoD;YACxD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,OAAO;YACf,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,kDAAkD,CAAC,EAAE;SACtE;QACD;YACE,EAAE,EAAE,iDAAiD;YACrD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,OAAO;YACf,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,+CAA+C,CAAC,EAAE;SACnE;QACD;YACE,EAAE,EAAE,mDAAmD;YACvD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,QAAQ;YAChB,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,iDAAiD,CAAC,EAAE;SACrE;KACF;IACD,KAAK,EAAE;QACL,gBAAgB,EAAE,CAAC;QACnB,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,gCAAgC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvE,OAAO,EAAE;YACP,KAAK,EAAE,iCAAiC;YACxC,MAAM,EAAE,sCAAsC;SAC/C;QACD,IAAI,EAAE;YACJ;gBACE,EAAE,EAAE,qCAAqC;gBACzC,SAAS,EAAE,iBAAiB;gBAC5B,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE;oBACP,KAAK,EAAE,gCAAgC;oBACvC,MAAM,EAAE,0BAA0B;iBACnC;aACF;SACF;QACD,MAAM,EAAE;YACN;gBACE,EAAE,EAAE,sCAAsC;gBAC1C,IAAI,EAAE,gBAAgB;gBACtB,cAAc,EAAE,CAAC,WAAW,CAAC;gBAC7B,OAAO,EAAE;oBACP,KAAK,EAAE,iCAAiC;oBACxC,MAAM,EAAE,sCAAsC;iBAC/C;aACF;SACF;KACF;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,SAAS;KACrB;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAC;IACrD,EAAE,EAAE,gCAAgC;IACpC,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,iBAAiB;IAC1B,0EAA0E;IAC1E,qEAAqE;IACrE,6EAA6E;IAC7E,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC,EAAE;IACzD,YAAY,EAAE,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,EAAE;QACJ,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE;YACV,OAAO,EAAE,gBAAgB;YACzB,SAAS,EACP,mHAAmH;SACtH;KACF;CACF,CAAC,CAAA","sourcesContent":["import { defineModule, providePort, requirePort } from \"@voyant-travel/core/project\"\nimport { customerBusinessAccountOnboardingRuntimePort } from \"./customer-business-onboarding-runtime-port.js\"\nimport { identityAccessRuntimePort } from \"./identity-access-runtime-port.js\"\nimport { storefrontRuntimePort } from \"./storefront-runtime-port.js\"\nimport { teamManagementRuntimePort } from \"./team-management-runtime-port.js\"\n\nexport const authCustomerBusinessAccountsVoyantModule = defineModule({\n  id: \"@voyant-travel/auth#customer-business-accounts\",\n  packageName: \"@voyant-travel/auth\",\n  localId: \"auth.customer-business-accounts\",\n  requires: { capabilities: [\"storefront.data-owner\"] },\n  runtimePorts: [requirePort(customerBusinessAccountOnboardingRuntimePort)],\n  api: [\n    {\n      id: \"@voyant-travel/auth#customer-business-accounts.api.admin\",\n      surface: \"admin\",\n      mount: \"customer-business-accounts\",\n      resource: \"customer-business-accounts\",\n      openapi: { document: \"customer-business-accounts\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/customer-business-onboarding-graph-runtime\",\n        export: \"createCustomerBusinessAccountVoyantRuntime\",\n      },\n    },\n  ],\n  access: {\n    resources: [\n      {\n        id: \"@voyant-travel/auth#access.customer-business-accounts\",\n        resource: \"customer-business-accounts\",\n        label: \"Customer business accounts\",\n        description: \"Review onboarding requests and provision customer business accounts.\",\n        actions: [\n          {\n            action: \"read\",\n            label: \"View customer business accounts\",\n            description: \"View customer business-account capabilities and onboarding requests.\",\n          },\n          {\n            action: \"write\",\n            label: \"Manage customer business accounts\",\n            description: \"Approve, reject, and provision customer business accounts.\",\n            sensitive: true,\n          },\n        ],\n      },\n    ],\n  },\n  admin: {\n    compositionOrder: 6,\n    runtime: {\n      entry: \"@voyant-travel/auth-react/admin\",\n      export: \"createSelectedCustomerBusinessAccountsAdminExtension\",\n    },\n    copy: [\n      {\n        id: \"@voyant-travel/auth#customer-business-accounts.admin.copy\",\n        namespace: \"auth.admin.customer-business-accounts\",\n        fallbackLocale: \"en\",\n        runtime: {\n          entry: \"@voyant-travel/auth-react/i18n\",\n          export: \"authUiMessageDefinitions\",\n        },\n      },\n    ],\n    routes: [\n      {\n        id: \"@voyant-travel/auth#customer-business-accounts.admin.route\",\n        path: \"/business-accounts\",\n        requiredScopes: [\"customer-business-accounts:read\"],\n        runtime: {\n          entry: \"@voyant-travel/auth-react/admin\",\n          export: \"createSelectedCustomerBusinessAccountsAdminExtension\",\n        },\n      },\n    ],\n  },\n  meta: {\n    ownership: \"package\",\n    agentTools: {\n      posture: \"not-applicable\",\n      rationale: \"Business-account onboarding is exposed through staff-guarded admin routes.\",\n    },\n  },\n})\n\nexport const authInvitationsVoyantModule = defineModule({\n  id: \"@voyant-travel/auth#invitations\",\n  packageName: \"@voyant-travel/auth\",\n  localId: \"auth.invitations\",\n  provides: { ports: [providePort(identityAccessRuntimePort)] },\n  runtimePorts: [requirePort(identityAccessRuntimePort)],\n  api: [\n    {\n      id: \"@voyant-travel/auth#invitations.api.admin\",\n      surface: \"admin\",\n      mount: \"invitations\",\n      resource: \"team\",\n      openapi: { document: \"invitations\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/identity-access-graph-runtime\",\n        export: \"createInvitationsVoyantRuntime\",\n      },\n    },\n    {\n      id: \"@voyant-travel/auth#invitations.api.public\",\n      surface: \"public\",\n      mount: \"invitations\",\n      anonymous: true,\n      openapi: { document: \"invitations\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/identity-access-graph-runtime\",\n        export: \"createInvitationsVoyantRuntime\",\n      },\n    },\n  ],\n  presentations: [\n    {\n      id: \"@voyant-travel/auth#presentation.local-auth\",\n      runtime: {\n        entry: \"@voyant-travel/auth-react/local-auth-routes\",\n        export: \"createLocalAuthRouteContribution\",\n      },\n    },\n  ],\n  meta: {\n    ownership: \"package\",\n    agentTools: {\n      posture: \"not-applicable\",\n      rationale:\n        \"This unit owns public invitation acceptance; staff invitation management is exposed by the guarded auth team runtime.\",\n    },\n  },\n})\n\nexport const authTeamVoyantModule = defineModule({\n  id: \"@voyant-travel/auth#team\",\n  packageName: \"@voyant-travel/auth\",\n  localId: \"auth.team\",\n  provides: { ports: [providePort(teamManagementRuntimePort)] },\n  runtimePorts: [requirePort(teamManagementRuntimePort)],\n  api: [\n    {\n      id: \"@voyant-travel/auth#team.api.admin\",\n      surface: \"admin\",\n      mount: \"team\",\n      resource: \"team\",\n      openapi: { document: \"team\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/identity-access-graph-runtime\",\n        export: \"createTeamVoyantRuntime\",\n      },\n    },\n  ],\n  access: {\n    resources: [\n      {\n        id: \"@voyant-travel/auth#access.team\",\n        resource: \"team\",\n        label: \"Team\",\n        description: \"Manage staff team members and their access.\",\n        wildcard: \"explicit-resource\",\n        actions: [\n          {\n            action: \"read\",\n            label: \"View team\",\n            description: \"View staff team members.\",\n          },\n          {\n            action: \"write\",\n            label: \"Manage team\",\n            description: \"Invite staff and update roles or access.\",\n            sensitive: true,\n            wildcard: \"explicit\",\n          },\n          {\n            action: \"delete\",\n            label: \"Remove team access\",\n            description: \"Revoke invitations or deactivate staff team members.\",\n            sensitive: true,\n            wildcard: \"explicit\",\n          },\n        ],\n      },\n    ],\n  },\n  tools: [\n    {\n      id: \"@voyant-travel/auth#team.tool.get-capabilities\",\n      name: \"get_team_management_capabilities\",\n      runtime: {\n        entry: \"@voyant-travel/auth/tools\",\n        export: \"getTeamManagementCapabilitiesTool\",\n      },\n      requiredScopes: [\"team:read\"],\n      context: [\"teamManagement\"],\n      risk: \"low\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.list-members\",\n      name: \"list_team_members\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"listTeamMembersTool\" },\n      requiredScopes: [\"team:read\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.list-roles\",\n      name: \"list_team_roles\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"listTeamRolesTool\" },\n      requiredScopes: [\"team:read\"],\n      context: [\"teamManagement\"],\n      risk: \"low\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.list-invitations\",\n      name: \"list_team_invitations\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"listTeamInvitationsTool\" },\n      requiredScopes: [\"team:read\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.invite-member\",\n      name: \"invite_team_member\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"inviteTeamMemberTool\" },\n      requiredScopes: [\"team:write\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.revoke-invitation\",\n      name: \"revoke_team_invitation\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"revokeTeamInvitationTool\" },\n      requiredScopes: [\"team:delete\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.update-member-role\",\n      name: \"update_team_member_role\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"updateTeamMemberRoleTool\" },\n      requiredScopes: [\"team:write\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.activate-member\",\n      name: \"activate_team_member\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"activateTeamMemberTool\" },\n      requiredScopes: [\"team:write\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.deactivate-member\",\n      name: \"deactivate_team_member\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"deactivateTeamMemberTool\" },\n      requiredScopes: [\"team:delete\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n  ],\n  actions: [\n    {\n      id: \"@voyant-travel/auth#team.action.get-capabilities\",\n      version: \"v1\",\n      kind: \"read\",\n      targetType: \"team-capabilities\",\n      resource: \"team\",\n      action: \"read\",\n      requiredScopes: [\"team:read\"],\n      risk: \"low\",\n      ledger: \"optional\",\n      approval: \"never\",\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.get-capabilities\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.list-members\",\n      version: \"v1\",\n      kind: \"sensitive-read\",\n      targetType: \"team-member\",\n      resource: \"team\",\n      action: \"read\",\n      requiredScopes: [\"team:read\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"never\",\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.list-members\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.list-roles\",\n      version: \"v1\",\n      kind: \"read\",\n      targetType: \"team-role\",\n      resource: \"team\",\n      action: \"read\",\n      requiredScopes: [\"team:read\"],\n      risk: \"low\",\n      ledger: \"optional\",\n      approval: \"never\",\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.list-roles\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.list-invitations\",\n      version: \"v1\",\n      kind: \"sensitive-read\",\n      targetType: \"team-invitation\",\n      resource: \"team\",\n      action: \"read\",\n      requiredScopes: [\"team:read\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"never\",\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.list-invitations\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.invite-member\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-invitation\",\n      resource: \"team\",\n      action: \"write\",\n      requiredScopes: [\"team:write\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: false,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.invite-member\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.revoke-invitation\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-invitation\",\n      resource: \"team\",\n      action: \"delete\",\n      requiredScopes: [\"team:delete\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: false,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.revoke-invitation\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.update-member-role\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-member\",\n      resource: \"team\",\n      action: \"write\",\n      requiredScopes: [\"team:write\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: true,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.update-member-role\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.activate-member\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-member\",\n      resource: \"team\",\n      action: \"write\",\n      requiredScopes: [\"team:write\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: true,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.activate-member\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.deactivate-member\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-member\",\n      resource: \"team\",\n      action: \"delete\",\n      requiredScopes: [\"team:delete\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: false,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.deactivate-member\"] },\n    },\n  ],\n  admin: {\n    compositionOrder: 5,\n    setupSteps: [{ id: \"@voyant-travel/auth#setup.team\", skippable: true }],\n    runtime: {\n      entry: \"@voyant-travel/auth-react/admin\",\n      export: \"createSelectedAuthTeamAdminExtension\",\n    },\n    copy: [\n      {\n        id: \"@voyant-travel/auth#team.admin.copy\",\n        namespace: \"auth.admin.team\",\n        fallbackLocale: \"en\",\n        runtime: {\n          entry: \"@voyant-travel/auth-react/i18n\",\n          export: \"authUiMessageDefinitions\",\n        },\n      },\n    ],\n    routes: [\n      {\n        id: \"@voyant-travel/auth#team.admin.route\",\n        path: \"/settings/team\",\n        requiredScopes: [\"team:read\"],\n        runtime: {\n          entry: \"@voyant-travel/auth-react/admin\",\n          export: \"createSelectedAuthTeamAdminExtension\",\n        },\n      },\n    ],\n  },\n  meta: {\n    ownership: \"package\",\n  },\n})\n\nexport const authStorefrontVoyantModule = defineModule({\n  id: \"@voyant-travel/auth#storefront\",\n  packageName: \"@voyant-travel/auth\",\n  localId: \"auth.storefront\",\n  // Self-host storefront access model: keys, operator-declared origins, and\n  // KMS-encrypted provider credentials backing the local customer-auth\n  // resolver. Admin routes/tools and the managed cloud adapter are follow-ups.\n  provides: { ports: [providePort(storefrontRuntimePort)] },\n  runtimePorts: [requirePort(storefrontRuntimePort)],\n  meta: {\n    ownership: \"package\",\n    agentTools: {\n      posture: \"not-applicable\",\n      rationale:\n        \"Storefront access configuration is operator-owned; it is exposed through guarded admin surfaces, not agent tools.\",\n    },\n  },\n})\n"]}
+{"version":3,"file":"voyant.js","sourceRoot":"","sources":["../src/voyant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACpF,OAAO,EAAE,4CAA4C,EAAE,MAAM,gDAAgD,CAAA;AAC7G,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAE7E,MAAM,CAAC,MAAM,wCAAwC,GAAG,YAAY,CAAC;IACnE,EAAE,EAAE,gDAAgD;IACpD,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,iCAAiC;IAC1C,QAAQ,EAAE,EAAE,YAAY,EAAE,CAAC,uBAAuB,CAAC,EAAE;IACrD,YAAY,EAAE,CAAC,WAAW,CAAC,4CAA4C,CAAC,CAAC;IACzE,GAAG,EAAE;QACH;YACE,EAAE,EAAE,0DAA0D;YAC9D,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,4BAA4B;YACnC,QAAQ,EAAE,4BAA4B;YACtC,OAAO,EAAE,EAAE,QAAQ,EAAE,4BAA4B,EAAE;YACnD,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,gEAAgE;gBACvE,MAAM,EAAE,4CAA4C;aACrD;SACF;KACF;IACD,MAAM,EAAE;QACN,SAAS,EAAE;YACT;gBACE,EAAE,EAAE,uDAAuD;gBAC3D,QAAQ,EAAE,4BAA4B;gBACtC,KAAK,EAAE,4BAA4B;gBACnC,WAAW,EAAE,sEAAsE;gBACnF,OAAO,EAAE;oBACP;wBACE,MAAM,EAAE,MAAM;wBACd,KAAK,EAAE,iCAAiC;wBACxC,WAAW,EAAE,sEAAsE;qBACpF;oBACD;wBACE,MAAM,EAAE,OAAO;wBACf,KAAK,EAAE,mCAAmC;wBAC1C,WAAW,EAAE,4DAA4D;wBACzE,SAAS,EAAE,IAAI;qBAChB;iBACF;aACF;SACF;KACF;IACD,KAAK,EAAE;QACL,gBAAgB,EAAE,CAAC;QACnB,OAAO,EAAE;YACP,KAAK,EAAE,iCAAiC;YACxC,MAAM,EAAE,sDAAsD;SAC/D;QACD,IAAI,EAAE;YACJ;gBACE,EAAE,EAAE,2DAA2D;gBAC/D,SAAS,EAAE,uCAAuC;gBAClD,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE;oBACP,KAAK,EAAE,gCAAgC;oBACvC,MAAM,EAAE,0BAA0B;iBACnC;aACF;SACF;QACD,MAAM,EAAE;YACN;gBACE,EAAE,EAAE,4DAA4D;gBAChE,IAAI,EAAE,oBAAoB;gBAC1B,cAAc,EAAE,CAAC,iCAAiC,CAAC;gBACnD,OAAO,EAAE;oBACP,KAAK,EAAE,iCAAiC;oBACxC,MAAM,EAAE,sDAAsD;iBAC/D;aACF;SACF;KACF;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE;YACV,OAAO,EAAE,gBAAgB;YACzB,SAAS,EAAE,4EAA4E;SACxF;KACF;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;IACtD,EAAE,EAAE,iCAAiC;IACrC,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,EAAE;IAC7D,YAAY,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IACtD,GAAG,EAAE;QACH;YACE,EAAE,EAAE,2CAA2C;YAC/C,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YACpC,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,mDAAmD;gBAC1D,MAAM,EAAE,gCAAgC;aACzC;SACF;QACD;YACE,EAAE,EAAE,4CAA4C;YAChD,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,aAAa;YACpB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YACpC,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,mDAAmD;gBAC1D,MAAM,EAAE,gCAAgC;aACzC;SACF;KACF;IACD,aAAa,EAAE;QACb;YACE,EAAE,EAAE,6CAA6C;YACjD,OAAO,EAAE;gBACP,KAAK,EAAE,6CAA6C;gBACpD,MAAM,EAAE,kCAAkC;aAC3C;SACF;KACF;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE;YACV,OAAO,EAAE,gBAAgB;YACzB,SAAS,EACP,uHAAuH;SAC1H;KACF;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;IAC/C,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC,EAAE;IAC7D,YAAY,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IACtD,GAAG,EAAE;QACH;YACE,EAAE,EAAE,oCAAoC;YACxC,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;YAC7B,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,mDAAmD;gBAC1D,MAAM,EAAE,yBAAyB;aAClC;SACF;KACF;IACD,MAAM,EAAE;QACN,SAAS,EAAE;YACT;gBACE,EAAE,EAAE,iCAAiC;gBACrC,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,MAAM;gBACb,WAAW,EAAE,6CAA6C;gBAC1D,QAAQ,EAAE,mBAAmB;gBAC7B,OAAO,EAAE;oBACP;wBACE,MAAM,EAAE,MAAM;wBACd,KAAK,EAAE,WAAW;wBAClB,WAAW,EAAE,0BAA0B;qBACxC;oBACD;wBACE,MAAM,EAAE,OAAO;wBACf,KAAK,EAAE,aAAa;wBACpB,WAAW,EAAE,0CAA0C;wBACvD,SAAS,EAAE,IAAI;wBACf,QAAQ,EAAE,UAAU;qBACrB;oBACD;wBACE,MAAM,EAAE,QAAQ;wBAChB,KAAK,EAAE,oBAAoB;wBAC3B,WAAW,EAAE,sDAAsD;wBACnE,SAAS,EAAE,IAAI;wBACf,QAAQ,EAAE,UAAU;qBACrB;iBACF;aACF;SACF;KACF;IACD,KAAK,EAAE;QACL;YACE,EAAE,EAAE,gDAAgD;YACpD,IAAI,EAAE,kCAAkC;YACxC,OAAO,EAAE;gBACP,KAAK,EAAE,2BAA2B;gBAClC,MAAM,EAAE,mCAAmC;aAC5C;YACD,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,KAAK;SACZ;QACD;YACE,EAAE,EAAE,4CAA4C;YAChD,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,qBAAqB,EAAE;YAC9E,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,0CAA0C;YAC9C,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,mBAAmB,EAAE;YAC5E,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,KAAK;SACZ;QACD;YACE,EAAE,EAAE,gDAAgD;YACpD,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,yBAAyB,EAAE;YAClF,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,6CAA6C;YACjD,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,sBAAsB,EAAE;YAC/E,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,iDAAiD;YACrD,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,0BAA0B,EAAE;YACnF,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,kDAAkD;YACtD,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,0BAA0B,EAAE;YACnF,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,+CAA+C;YACnD,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,wBAAwB,EAAE;YACjF,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;QACD;YACE,EAAE,EAAE,iDAAiD;YACrD,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,0BAA0B,EAAE;YACnF,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,MAAM;SACb;KACF;IACD,OAAO,EAAE;QACP;YACE,EAAE,EAAE,kDAAkD;YACtD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,mBAAmB;YAC/B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,OAAO;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,gDAAgD,CAAC,EAAE;SACpE;QACD;YACE,EAAE,EAAE,8CAA8C;YAClD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,OAAO;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,4CAA4C,CAAC,EAAE;SAChE;QACD;YACE,EAAE,EAAE,4CAA4C;YAChD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,WAAW;YACvB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,OAAO;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,0CAA0C,CAAC,EAAE;SAC9D;QACD;YACE,EAAE,EAAE,kDAAkD;YACtD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,OAAO;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,gDAAgD,CAAC,EAAE;SACpE;QACD;YACE,EAAE,EAAE,+CAA+C;YACnD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,OAAO;YACf,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,6CAA6C,CAAC,EAAE;SACjE;QACD;YACE,EAAE,EAAE,mDAAmD;YACvD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,QAAQ;YAChB,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,iDAAiD,CAAC,EAAE;SACrE;QACD;YACE,EAAE,EAAE,oDAAoD;YACxD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,OAAO;YACf,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,kDAAkD,CAAC,EAAE;SACtE;QACD;YACE,EAAE,EAAE,iDAAiD;YACrD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,OAAO;YACf,cAAc,EAAE,CAAC,YAAY,CAAC;YAC9B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,+CAA+C,CAAC,EAAE;SACnE;QACD;YACE,EAAE,EAAE,mDAAmD;YACvD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,QAAQ;YAChB,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,UAAU;YAClB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,KAAK;YACjB,iBAAiB,EAAE,CAAC,OAAO,CAAC;YAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,iDAAiD,CAAC,EAAE;SACrE;KACF;IACD,KAAK,EAAE;QACL,gBAAgB,EAAE,CAAC;QACnB,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,gCAAgC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvE,OAAO,EAAE;YACP,KAAK,EAAE,iCAAiC;YACxC,MAAM,EAAE,sCAAsC;SAC/C;QACD,IAAI,EAAE;YACJ;gBACE,EAAE,EAAE,qCAAqC;gBACzC,SAAS,EAAE,iBAAiB;gBAC5B,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE;oBACP,KAAK,EAAE,gCAAgC;oBACvC,MAAM,EAAE,0BAA0B;iBACnC;aACF;SACF;QACD,MAAM,EAAE;YACN;gBACE,EAAE,EAAE,sCAAsC;gBAC1C,IAAI,EAAE,gBAAgB;gBACtB,cAAc,EAAE,CAAC,WAAW,CAAC;gBAC7B,OAAO,EAAE;oBACP,KAAK,EAAE,iCAAiC;oBACxC,MAAM,EAAE,sCAAsC;iBAC/C;aACF;SACF;KACF;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,SAAS;KACrB;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAC;IACrD,EAAE,EAAE,gCAAgC;IACpC,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,iBAAiB;IAC1B,0EAA0E;IAC1E,qEAAqE;IACrE,2EAA2E;IAC3E,mDAAmD;IACnD,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC,EAAE;IACzD,YAAY,EAAE;QACZ,WAAW,CAAC,qBAAqB,CAAC;QAClC,WAAW,CAAC,4CAA4C,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KAC9E;IACD,GAAG,EAAE;QACH;YACE,EAAE,EAAE,0CAA0C;YAC9C,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,aAAa;YACpB,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;YACpC,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,8CAA8C;gBACrD,MAAM,EAAE,+BAA+B;aACxC;SACF;KACF;IACD,MAAM,EAAE;QACN,SAAS,EAAE;YACT;gBACE,EAAE,EAAE,wCAAwC;gBAC5C,QAAQ,EAAE,aAAa;gBACvB,KAAK,EAAE,aAAa;gBACpB,WAAW,EAAE,4DAA4D;gBACzE,OAAO,EAAE;oBACP;wBACE,MAAM,EAAE,MAAM;wBACd,KAAK,EAAE,kBAAkB;wBACzB,WAAW,EAAE,2DAA2D;qBACzE;oBACD;wBACE,MAAM,EAAE,OAAO;wBACf,KAAK,EAAE,oBAAoB;wBAC3B,WAAW,EACT,2FAA2F;wBAC7F,SAAS,EAAE,IAAI;qBAChB;oBACD;wBACE,MAAM,EAAE,QAAQ;wBAChB,KAAK,EAAE,oBAAoB;wBAC3B,WAAW,EAAE,kDAAkD;wBAC/D,SAAS,EAAE,IAAI;qBAChB;iBACF;aACF;SACF;KACF;IACD,KAAK,EAAE;QACL,gBAAgB,EAAE,CAAC;QACnB,OAAO,EAAE;YACP,KAAK,EAAE,iCAAiC;YACxC,MAAM,EAAE,wCAAwC;SACjD;QACD,IAAI,EAAE;YACJ;gBACE,EAAE,EAAE,2CAA2C;gBAC/C,SAAS,EAAE,wBAAwB;gBACnC,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE;oBACP,KAAK,EAAE,gCAAgC;oBACvC,MAAM,EAAE,0BAA0B;iBACnC;aACF;SACF;QACD,MAAM,EAAE;YACN;gBACE,EAAE,EAAE,4CAA4C;gBAChD,IAAI,EAAE,cAAc;gBACpB,cAAc,EAAE,CAAC,kBAAkB,CAAC;gBACpC,OAAO,EAAE;oBACP,KAAK,EAAE,iCAAiC;oBACxC,MAAM,EAAE,wCAAwC;iBACjD;aACF;SACF;KACF;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE;YACV,OAAO,EAAE,gBAAgB;YACzB,SAAS,EACP,mHAAmH;SACtH;KACF;CACF,CAAC,CAAA","sourcesContent":["import { defineModule, providePort, requirePort } from \"@voyant-travel/core/project\"\nimport { customerBusinessAccountOnboardingRuntimePort } from \"./customer-business-onboarding-runtime-port.js\"\nimport { identityAccessRuntimePort } from \"./identity-access-runtime-port.js\"\nimport { storefrontRuntimePort } from \"./storefront-runtime-port.js\"\nimport { teamManagementRuntimePort } from \"./team-management-runtime-port.js\"\n\nexport const authCustomerBusinessAccountsVoyantModule = defineModule({\n  id: \"@voyant-travel/auth#customer-business-accounts\",\n  packageName: \"@voyant-travel/auth\",\n  localId: \"auth.customer-business-accounts\",\n  requires: { capabilities: [\"storefront.data-owner\"] },\n  runtimePorts: [requirePort(customerBusinessAccountOnboardingRuntimePort)],\n  api: [\n    {\n      id: \"@voyant-travel/auth#customer-business-accounts.api.admin\",\n      surface: \"admin\",\n      mount: \"customer-business-accounts\",\n      resource: \"customer-business-accounts\",\n      openapi: { document: \"customer-business-accounts\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/customer-business-onboarding-graph-runtime\",\n        export: \"createCustomerBusinessAccountVoyantRuntime\",\n      },\n    },\n  ],\n  access: {\n    resources: [\n      {\n        id: \"@voyant-travel/auth#access.customer-business-accounts\",\n        resource: \"customer-business-accounts\",\n        label: \"Customer business accounts\",\n        description: \"Review onboarding requests and provision customer business accounts.\",\n        actions: [\n          {\n            action: \"read\",\n            label: \"View customer business accounts\",\n            description: \"View customer business-account capabilities and onboarding requests.\",\n          },\n          {\n            action: \"write\",\n            label: \"Manage customer business accounts\",\n            description: \"Approve, reject, and provision customer business accounts.\",\n            sensitive: true,\n          },\n        ],\n      },\n    ],\n  },\n  admin: {\n    compositionOrder: 6,\n    runtime: {\n      entry: \"@voyant-travel/auth-react/admin\",\n      export: \"createSelectedCustomerBusinessAccountsAdminExtension\",\n    },\n    copy: [\n      {\n        id: \"@voyant-travel/auth#customer-business-accounts.admin.copy\",\n        namespace: \"auth.admin.customer-business-accounts\",\n        fallbackLocale: \"en\",\n        runtime: {\n          entry: \"@voyant-travel/auth-react/i18n\",\n          export: \"authUiMessageDefinitions\",\n        },\n      },\n    ],\n    routes: [\n      {\n        id: \"@voyant-travel/auth#customer-business-accounts.admin.route\",\n        path: \"/business-accounts\",\n        requiredScopes: [\"customer-business-accounts:read\"],\n        runtime: {\n          entry: \"@voyant-travel/auth-react/admin\",\n          export: \"createSelectedCustomerBusinessAccountsAdminExtension\",\n        },\n      },\n    ],\n  },\n  meta: {\n    ownership: \"package\",\n    agentTools: {\n      posture: \"not-applicable\",\n      rationale: \"Business-account onboarding is exposed through staff-guarded admin routes.\",\n    },\n  },\n})\n\nexport const authInvitationsVoyantModule = defineModule({\n  id: \"@voyant-travel/auth#invitations\",\n  packageName: \"@voyant-travel/auth\",\n  localId: \"auth.invitations\",\n  provides: { ports: [providePort(identityAccessRuntimePort)] },\n  runtimePorts: [requirePort(identityAccessRuntimePort)],\n  api: [\n    {\n      id: \"@voyant-travel/auth#invitations.api.admin\",\n      surface: \"admin\",\n      mount: \"invitations\",\n      resource: \"team\",\n      openapi: { document: \"invitations\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/identity-access-graph-runtime\",\n        export: \"createInvitationsVoyantRuntime\",\n      },\n    },\n    {\n      id: \"@voyant-travel/auth#invitations.api.public\",\n      surface: \"public\",\n      mount: \"invitations\",\n      anonymous: true,\n      openapi: { document: \"invitations\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/identity-access-graph-runtime\",\n        export: \"createInvitationsVoyantRuntime\",\n      },\n    },\n  ],\n  presentations: [\n    {\n      id: \"@voyant-travel/auth#presentation.local-auth\",\n      runtime: {\n        entry: \"@voyant-travel/auth-react/local-auth-routes\",\n        export: \"createLocalAuthRouteContribution\",\n      },\n    },\n  ],\n  meta: {\n    ownership: \"package\",\n    agentTools: {\n      posture: \"not-applicable\",\n      rationale:\n        \"This unit owns public invitation acceptance; staff invitation management is exposed by the guarded auth team runtime.\",\n    },\n  },\n})\n\nexport const authTeamVoyantModule = defineModule({\n  id: \"@voyant-travel/auth#team\",\n  packageName: \"@voyant-travel/auth\",\n  localId: \"auth.team\",\n  provides: { ports: [providePort(teamManagementRuntimePort)] },\n  runtimePorts: [requirePort(teamManagementRuntimePort)],\n  api: [\n    {\n      id: \"@voyant-travel/auth#team.api.admin\",\n      surface: \"admin\",\n      mount: \"team\",\n      resource: \"team\",\n      openapi: { document: \"team\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/identity-access-graph-runtime\",\n        export: \"createTeamVoyantRuntime\",\n      },\n    },\n  ],\n  access: {\n    resources: [\n      {\n        id: \"@voyant-travel/auth#access.team\",\n        resource: \"team\",\n        label: \"Team\",\n        description: \"Manage staff team members and their access.\",\n        wildcard: \"explicit-resource\",\n        actions: [\n          {\n            action: \"read\",\n            label: \"View team\",\n            description: \"View staff team members.\",\n          },\n          {\n            action: \"write\",\n            label: \"Manage team\",\n            description: \"Invite staff and update roles or access.\",\n            sensitive: true,\n            wildcard: \"explicit\",\n          },\n          {\n            action: \"delete\",\n            label: \"Remove team access\",\n            description: \"Revoke invitations or deactivate staff team members.\",\n            sensitive: true,\n            wildcard: \"explicit\",\n          },\n        ],\n      },\n    ],\n  },\n  tools: [\n    {\n      id: \"@voyant-travel/auth#team.tool.get-capabilities\",\n      name: \"get_team_management_capabilities\",\n      runtime: {\n        entry: \"@voyant-travel/auth/tools\",\n        export: \"getTeamManagementCapabilitiesTool\",\n      },\n      requiredScopes: [\"team:read\"],\n      context: [\"teamManagement\"],\n      risk: \"low\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.list-members\",\n      name: \"list_team_members\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"listTeamMembersTool\" },\n      requiredScopes: [\"team:read\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.list-roles\",\n      name: \"list_team_roles\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"listTeamRolesTool\" },\n      requiredScopes: [\"team:read\"],\n      context: [\"teamManagement\"],\n      risk: \"low\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.list-invitations\",\n      name: \"list_team_invitations\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"listTeamInvitationsTool\" },\n      requiredScopes: [\"team:read\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.invite-member\",\n      name: \"invite_team_member\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"inviteTeamMemberTool\" },\n      requiredScopes: [\"team:write\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.revoke-invitation\",\n      name: \"revoke_team_invitation\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"revokeTeamInvitationTool\" },\n      requiredScopes: [\"team:delete\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.update-member-role\",\n      name: \"update_team_member_role\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"updateTeamMemberRoleTool\" },\n      requiredScopes: [\"team:write\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.activate-member\",\n      name: \"activate_team_member\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"activateTeamMemberTool\" },\n      requiredScopes: [\"team:write\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n    {\n      id: \"@voyant-travel/auth#team.tool.deactivate-member\",\n      name: \"deactivate_team_member\",\n      runtime: { entry: \"@voyant-travel/auth/tools\", export: \"deactivateTeamMemberTool\" },\n      requiredScopes: [\"team:delete\"],\n      context: [\"teamManagement\"],\n      risk: \"high\",\n    },\n  ],\n  actions: [\n    {\n      id: \"@voyant-travel/auth#team.action.get-capabilities\",\n      version: \"v1\",\n      kind: \"read\",\n      targetType: \"team-capabilities\",\n      resource: \"team\",\n      action: \"read\",\n      requiredScopes: [\"team:read\"],\n      risk: \"low\",\n      ledger: \"optional\",\n      approval: \"never\",\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.get-capabilities\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.list-members\",\n      version: \"v1\",\n      kind: \"sensitive-read\",\n      targetType: \"team-member\",\n      resource: \"team\",\n      action: \"read\",\n      requiredScopes: [\"team:read\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"never\",\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.list-members\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.list-roles\",\n      version: \"v1\",\n      kind: \"read\",\n      targetType: \"team-role\",\n      resource: \"team\",\n      action: \"read\",\n      requiredScopes: [\"team:read\"],\n      risk: \"low\",\n      ledger: \"optional\",\n      approval: \"never\",\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.list-roles\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.list-invitations\",\n      version: \"v1\",\n      kind: \"sensitive-read\",\n      targetType: \"team-invitation\",\n      resource: \"team\",\n      action: \"read\",\n      requiredScopes: [\"team:read\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"never\",\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.list-invitations\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.invite-member\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-invitation\",\n      resource: \"team\",\n      action: \"write\",\n      requiredScopes: [\"team:write\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: false,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.invite-member\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.revoke-invitation\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-invitation\",\n      resource: \"team\",\n      action: \"delete\",\n      requiredScopes: [\"team:delete\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: false,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.revoke-invitation\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.update-member-role\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-member\",\n      resource: \"team\",\n      action: \"write\",\n      requiredScopes: [\"team:write\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: true,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.update-member-role\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.activate-member\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-member\",\n      resource: \"team\",\n      action: \"write\",\n      requiredScopes: [\"team:write\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: true,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.activate-member\"] },\n    },\n    {\n      id: \"@voyant-travel/auth#team.action.deactivate-member\",\n      version: \"v1\",\n      kind: \"execute\",\n      targetType: \"team-member\",\n      resource: \"team\",\n      action: \"delete\",\n      requiredScopes: [\"team:delete\"],\n      risk: \"high\",\n      ledger: \"required\",\n      approval: \"required\",\n      reversible: false,\n      allowedActorTypes: [\"staff\"],\n      from: { tools: [\"@voyant-travel/auth#team.tool.deactivate-member\"] },\n    },\n  ],\n  admin: {\n    compositionOrder: 5,\n    setupSteps: [{ id: \"@voyant-travel/auth#setup.team\", skippable: true }],\n    runtime: {\n      entry: \"@voyant-travel/auth-react/admin\",\n      export: \"createSelectedAuthTeamAdminExtension\",\n    },\n    copy: [\n      {\n        id: \"@voyant-travel/auth#team.admin.copy\",\n        namespace: \"auth.admin.team\",\n        fallbackLocale: \"en\",\n        runtime: {\n          entry: \"@voyant-travel/auth-react/i18n\",\n          export: \"authUiMessageDefinitions\",\n        },\n      },\n    ],\n    routes: [\n      {\n        id: \"@voyant-travel/auth#team.admin.route\",\n        path: \"/settings/team\",\n        requiredScopes: [\"team:read\"],\n        runtime: {\n          entry: \"@voyant-travel/auth-react/admin\",\n          export: \"createSelectedAuthTeamAdminExtension\",\n        },\n      },\n    ],\n  },\n  meta: {\n    ownership: \"package\",\n  },\n})\n\nexport const authStorefrontVoyantModule = defineModule({\n  id: \"@voyant-travel/auth#storefront\",\n  packageName: \"@voyant-travel/auth\",\n  localId: \"auth.storefront\",\n  // Self-host storefront access model: keys, operator-declared origins, and\n  // KMS-encrypted provider credentials backing the local customer-auth\n  // resolver, surfaced through the operator \"Storefronts\" admin surface. The\n  // managed cloud storefront adapter is a follow-up.\n  provides: { ports: [providePort(storefrontRuntimePort)] },\n  runtimePorts: [\n    requirePort(storefrontRuntimePort),\n    requirePort(customerBusinessAccountOnboardingRuntimePort, { optional: true }),\n  ],\n  api: [\n    {\n      id: \"@voyant-travel/auth#storefront.api.admin\",\n      surface: \"admin\",\n      mount: \"storefronts\",\n      resource: \"storefronts\",\n      openapi: { document: \"storefronts\" },\n      transactional: true,\n      runtime: {\n        entry: \"@voyant-travel/auth/storefront-graph-runtime\",\n        export: \"createStorefrontVoyantRuntime\",\n      },\n    },\n  ],\n  access: {\n    resources: [\n      {\n        id: \"@voyant-travel/auth#access.storefronts\",\n        resource: \"storefronts\",\n        label: \"Storefronts\",\n        description: \"Manage storefront access keys, origins, and customer auth.\",\n        actions: [\n          {\n            action: \"read\",\n            label: \"View storefronts\",\n            description: \"View storefront configuration, keys, and provider status.\",\n          },\n          {\n            action: \"write\",\n            label: \"Manage storefronts\",\n            description:\n              \"Create storefronts, issue keys, and configure origins, methods, and provider credentials.\",\n            sensitive: true,\n          },\n          {\n            action: \"delete\",\n            label: \"Delete storefronts\",\n            description: \"Delete storefronts and revoke their access keys.\",\n            sensitive: true,\n          },\n        ],\n      },\n    ],\n  },\n  admin: {\n    compositionOrder: 7,\n    runtime: {\n      entry: \"@voyant-travel/auth-react/admin\",\n      export: \"createSelectedStorefrontAdminExtension\",\n    },\n    copy: [\n      {\n        id: \"@voyant-travel/auth#storefront.admin.copy\",\n        namespace: \"auth.admin.storefronts\",\n        fallbackLocale: \"en\",\n        runtime: {\n          entry: \"@voyant-travel/auth-react/i18n\",\n          export: \"authUiMessageDefinitions\",\n        },\n      },\n    ],\n    routes: [\n      {\n        id: \"@voyant-travel/auth#storefront.admin.route\",\n        path: \"/storefronts\",\n        requiredScopes: [\"storefronts:read\"],\n        runtime: {\n          entry: \"@voyant-travel/auth-react/admin\",\n          export: \"createSelectedStorefrontAdminExtension\",\n        },\n      },\n    ],\n  },\n  meta: {\n    ownership: \"package\",\n    agentTools: {\n      posture: \"not-applicable\",\n      rationale:\n        \"Storefront access configuration is operator-owned; it is exposed through guarded admin surfaces, not agent tools.\",\n    },\n  },\n})\n"]}

package/openapi/admin/storefronts.json

@@ -0,0 +1,133 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "Voyant Auth Storefronts Admin API",
+    "version": "1.0.0"
+  },
+  "paths": {
+    "/v1/admin/storefronts/capabilities": {
+      "get": {
+        "operationId": "getStorefrontCapabilities",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": { "200": { "description": "Storefront admin capabilities." } }
+      }
+    },
+    "/v1/admin/storefronts/storefronts": {
+      "get": {
+        "operationId": "listStorefronts",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": { "200": { "description": "Storefronts for the operator organization." } }
+      },
+      "post": {
+        "operationId": "createStorefront",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": { "201": { "description": "Created storefront." } }
+      }
+    },
+    "/v1/admin/storefronts/storefronts/{storefrontId}": {
+      "get": {
+        "operationId": "getStorefront",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": { "200": { "description": "Storefront detail." } }
+      },
+      "patch": {
+        "operationId": "updateStorefront",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": { "200": { "description": "Updated storefront." } }
+      },
+      "delete": {
+        "operationId": "deleteStorefront",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": { "204": { "description": "Storefront deleted." } }
+      }
+    },
+    "/v1/admin/storefronts/storefronts/{storefrontId}/allowed-origins": {
+      "put": {
+        "operationId": "setStorefrontAllowedOrigins",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": { "200": { "description": "Updated storefront allowed origins." } }
+      }
+    },
+    "/v1/admin/storefronts/storefronts/{storefrontId}/keys": {
+      "get": {
+        "operationId": "listStorefrontApiKeys",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": { "200": { "description": "Storefront access keys." } }
+      },
+      "post": {
+        "operationId": "issueStorefrontApiKey",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": {
+          "201": { "description": "Issued access key, plaintext token revealed once." }
+        }
+      }
+    },
+    "/v1/admin/storefronts/storefronts/{storefrontId}/keys/{keyId}/rotate": {
+      "post": {
+        "operationId": "rotateStorefrontApiKey",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": {
+          "201": { "description": "Rotated access key, plaintext token revealed once." }
+        }
+      }
+    },
+    "/v1/admin/storefronts/storefronts/{storefrontId}/keys/{keyId}": {
+      "delete": {
+        "operationId": "revokeStorefrontApiKey",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": { "204": { "description": "Access key revoked." } }
+      }
+    },
+    "/v1/admin/storefronts/storefronts/{storefrontId}/account-policy": {
+      "put": {
+        "operationId": "updateStorefrontAccountPolicy",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": { "200": { "description": "Updated buyer-account policy." } }
+      }
+    },
+    "/v1/admin/storefronts/storefronts/{storefrontId}/methods": {
+      "put": {
+        "operationId": "updateStorefrontMethods",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": { "200": { "description": "Updated customer auth methods." } }
+      }
+    },
+    "/v1/admin/storefronts/storefronts/{storefrontId}/provider-credentials": {
+      "get": {
+        "operationId": "listStorefrontProviderCredentials",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": {
+          "200": { "description": "Provider credential status (never secret values)." }
+        }
+      }
+    },
+    "/v1/admin/storefronts/storefronts/{storefrontId}/provider-credentials/{provider}": {
+      "put": {
+        "operationId": "putStorefrontProviderCredential",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": { "204": { "description": "Provider credential stored." } }
+      },
+      "delete": {
+        "operationId": "deleteStorefrontProviderCredential",
+        "tags": ["Storefronts"],
+        "x-voyant-api-id": "@voyant-travel/auth#storefront.api.admin",
+        "responses": { "204": { "description": "Provider credential cleared." } }
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/auth",
-  "version": "0.139.0",
+  "version": "0.140.1",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -102,6 +102,16 @@
       "import": "./dist/storefront-runtime-port.js",
       "default": "./dist/storefront-runtime-port.js"
     },
+    "./storefront-admin-contracts": {
+      "types": "./dist/storefront-admin-contracts.d.ts",
+      "import": "./dist/storefront-admin-contracts.js",
+      "default": "./dist/storefront-admin-contracts.js"
+    },
+    "./storefront-graph-runtime": {
+      "types": "./dist/storefront-graph-runtime.d.ts",
+      "import": "./dist/storefront-graph-runtime.js",
+      "default": "./dist/storefront-graph-runtime.js"
+    },
     "./storefront-local-adapter": {
       "types": "./dist/storefront-local-adapter.d.ts",
       "import": "./dist/storefront-local-adapter.js",
@@ -135,6 +145,7 @@
     "./openapi/admin/invitations": "./openapi/admin/invitations.json",
     "./openapi/admin/team": "./openapi/admin/team.json",
     "./openapi/admin/customer-business-accounts": "./openapi/admin/customer-business-accounts.json",
+    "./openapi/admin/storefronts": "./openapi/admin/storefronts.json",
     "./openapi/storefront/invitations": "./openapi/storefront/invitations.json",
     "./voyant": {
       "types": "./dist/voyant.d.ts",