@voyantjs/transactions 0.2.0 → 0.3.0

package/dist/routes-orders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes-orders.d.ts","sourceRoot":"","sources":["../src/routes-orders.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,GAAG,EAIT,MAAM,oBAAoB,CAAA;AAoB3B,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAkQ/B,CAAA"}

package/dist/routes-orders.js

@@ -0,0 +1,180 @@
+import { Hono } from "hono";
+import { authorizeTransactionPiiAccess, createPiiService, hasParticipantIdentityInput, logTransactionPiiAccess, notFound, } from "./routes-shared.js";
+import { transactionsService } from "./service.js";
+import { insertOrderItemParticipantSchema, insertOrderItemSchema, insertOrderParticipantSchema, insertOrderSchema, insertOrderTermSchema, orderItemListQuerySchema, orderItemParticipantListQuerySchema, orderListQuerySchema, orderParticipantListQuerySchema, orderTermListQuerySchema, updateOrderItemParticipantSchema, updateOrderItemSchema, updateOrderParticipantSchema, updateOrderSchema, updateOrderTermSchema, } from "./validation.js";
+export const transactionOrderRoutes = new Hono()
+    .get("/orders", async (c) => {
+    const query = orderListQuerySchema.parse(Object.fromEntries(new URL(c.req.url).searchParams));
+    return c.json(await transactionsService.listOrders(c.get("db"), query));
+})
+    .post("/orders", async (c) => c.json({
+    data: await transactionsService.createOrder(c.get("db"), insertOrderSchema.parse(await c.req.json())),
+}, 201))
+    .get("/orders/:id", async (c) => {
+    const row = await transactionsService.getOrderById(c.get("db"), c.req.param("id"));
+    return row ? c.json({ data: row }) : notFound(c, "Order not found");
+})
+    .patch("/orders/:id", async (c) => {
+    const row = await transactionsService.updateOrder(c.get("db"), c.req.param("id"), updateOrderSchema.parse(await c.req.json()));
+    return row ? c.json({ data: row }) : notFound(c, "Order not found");
+})
+    .delete("/orders/:id", async (c) => {
+    const row = await transactionsService.deleteOrder(c.get("db"), c.req.param("id"));
+    return row ? c.json({ success: true }) : notFound(c, "Order not found");
+})
+    .get("/order-participants", async (c) => {
+    const query = orderParticipantListQuerySchema.parse(Object.fromEntries(new URL(c.req.url).searchParams));
+    return c.json(await transactionsService.listOrderParticipants(c.get("db"), query));
+})
+    .post("/order-participants", async (c) => {
+    const payload = insertOrderParticipantSchema.parse(await c.req.json());
+    const row = await transactionsService.createOrderParticipant(c.get("db"), payload);
+    if (!row)
+        return c.json({ data: row }, 201);
+    if (hasParticipantIdentityInput(payload)) {
+        const pii = createPiiService(c, "order", row.orderId);
+        await pii.upsertParticipantIdentity(c.get("db"), "order", row.id, payload, c.get("userId"));
+        return c.json({ data: await transactionsService.getOrderParticipantById(c.get("db"), row.id) }, 201);
+    }
+    return c.json({ data: row }, 201);
+})
+    .get("/order-participants/:id", async (c) => {
+    const row = await transactionsService.getOrderParticipantById(c.get("db"), c.req.param("id"));
+    return row ? c.json({ data: row }) : notFound(c, "Order participant not found");
+})
+    .patch("/order-participants/:id", async (c) => {
+    const payload = updateOrderParticipantSchema.parse(await c.req.json());
+    const row = await transactionsService.updateOrderParticipant(c.get("db"), c.req.param("id"), payload);
+    if (!row)
+        return notFound(c, "Order participant not found");
+    if (hasParticipantIdentityInput(payload)) {
+        const pii = createPiiService(c, "order", row.orderId);
+        await pii.upsertParticipantIdentity(c.get("db"), "order", row.id, payload, c.get("userId"));
+        return c.json({
+            data: await transactionsService.getOrderParticipantById(c.get("db"), row.id),
+        });
+    }
+    return c.json({ data: row });
+})
+    .get("/order-participants/:id/travel-details", async (c) => {
+    const participant = await transactionsService.getOrderParticipantById(c.get("db"), c.req.param("id"));
+    if (!participant)
+        return notFound(c, "Order participant not found");
+    const auth = await authorizeTransactionPiiAccess(c, {
+        participantKind: "order",
+        participantId: participant.id,
+        parentId: participant.orderId,
+        action: "read",
+    });
+    if (!auth.allowed)
+        return auth.response;
+    const pii = createPiiService(c, "order", participant.orderId);
+    const row = await pii.getParticipantIdentity(c.get("db"), "order", participant.id, c.get("userId"));
+    if (!row) {
+        await logTransactionPiiAccess(c, {
+            participantKind: "order",
+            parentId: participant.orderId,
+            participantId: participant.id,
+            action: "read",
+            outcome: "denied",
+            reason: "travel_details_not_found",
+        });
+        return c.json({ error: "Order participant travel details not found" }, 404);
+    }
+    return c.json({ data: row });
+})
+    .patch("/order-participants/:id/travel-details", async (c) => {
+    const participant = await transactionsService.getOrderParticipantById(c.get("db"), c.req.param("id"));
+    if (!participant)
+        return notFound(c, "Order participant not found");
+    const auth = await authorizeTransactionPiiAccess(c, {
+        participantKind: "order",
+        participantId: participant.id,
+        parentId: participant.orderId,
+        action: "update",
+    });
+    if (!auth.allowed)
+        return auth.response;
+    const pii = createPiiService(c, "order", participant.orderId);
+    const row = await pii.upsertParticipantIdentity(c.get("db"), "order", participant.id, updateOrderParticipantSchema.parse(await c.req.json()), c.get("userId"));
+    return row ? c.json({ data: row }) : notFound(c, "Order participant not found");
+})
+    .delete("/order-participants/:id/travel-details", async (c) => {
+    const participant = await transactionsService.getOrderParticipantById(c.get("db"), c.req.param("id"));
+    if (!participant)
+        return notFound(c, "Order participant not found");
+    const auth = await authorizeTransactionPiiAccess(c, {
+        participantKind: "order",
+        participantId: participant.id,
+        parentId: participant.orderId,
+        action: "delete",
+    });
+    if (!auth.allowed)
+        return auth.response;
+    const pii = createPiiService(c, "order", participant.orderId);
+    const row = await pii.deleteParticipantIdentity(c.get("db"), "order", participant.id, c.get("userId"));
+    return row
+        ? c.json({ success: true })
+        : c.json({ error: "Order participant travel details not found" }, 404);
+})
+    .delete("/order-participants/:id", async (c) => {
+    const row = await transactionsService.deleteOrderParticipant(c.get("db"), c.req.param("id"));
+    return row ? c.json({ success: true }) : notFound(c, "Order participant not found");
+})
+    .get("/order-items", async (c) => {
+    const query = orderItemListQuerySchema.parse(Object.fromEntries(new URL(c.req.url).searchParams));
+    return c.json(await transactionsService.listOrderItems(c.get("db"), query));
+})
+    .post("/order-items", async (c) => c.json({
+    data: await transactionsService.createOrderItem(c.get("db"), insertOrderItemSchema.parse(await c.req.json())),
+}, 201))
+    .get("/order-items/:id", async (c) => {
+    const row = await transactionsService.getOrderItemById(c.get("db"), c.req.param("id"));
+    return row ? c.json({ data: row }) : notFound(c, "Order item not found");
+})
+    .patch("/order-items/:id", async (c) => {
+    const row = await transactionsService.updateOrderItem(c.get("db"), c.req.param("id"), updateOrderItemSchema.parse(await c.req.json()));
+    return row ? c.json({ data: row }) : notFound(c, "Order item not found");
+})
+    .delete("/order-items/:id", async (c) => {
+    const row = await transactionsService.deleteOrderItem(c.get("db"), c.req.param("id"));
+    return row ? c.json({ success: true }) : notFound(c, "Order item not found");
+})
+    .get("/order-item-participants", async (c) => {
+    const query = orderItemParticipantListQuerySchema.parse(Object.fromEntries(new URL(c.req.url).searchParams));
+    return c.json(await transactionsService.listOrderItemParticipants(c.get("db"), query));
+})
+    .post("/order-item-participants", async (c) => c.json({
+    data: await transactionsService.createOrderItemParticipant(c.get("db"), insertOrderItemParticipantSchema.parse(await c.req.json())),
+}, 201))
+    .get("/order-item-participants/:id", async (c) => {
+    const row = await transactionsService.getOrderItemParticipantById(c.get("db"), c.req.param("id"));
+    return row ? c.json({ data: row }) : notFound(c, "Order item participant not found");
+})
+    .patch("/order-item-participants/:id", async (c) => {
+    const row = await transactionsService.updateOrderItemParticipant(c.get("db"), c.req.param("id"), updateOrderItemParticipantSchema.parse(await c.req.json()));
+    return row ? c.json({ data: row }) : notFound(c, "Order item participant not found");
+})
+    .delete("/order-item-participants/:id", async (c) => {
+    const row = await transactionsService.deleteOrderItemParticipant(c.get("db"), c.req.param("id"));
+    return row ? c.json({ success: true }) : notFound(c, "Order item participant not found");
+})
+    .get("/order-terms", async (c) => {
+    const query = orderTermListQuerySchema.parse(Object.fromEntries(new URL(c.req.url).searchParams));
+    return c.json(await transactionsService.listOrderTerms(c.get("db"), query));
+})
+    .post("/order-terms", async (c) => c.json({
+    data: await transactionsService.createOrderTerm(c.get("db"), insertOrderTermSchema.parse(await c.req.json())),
+}, 201))
+    .get("/order-terms/:id", async (c) => {
+    const row = await transactionsService.getOrderTermById(c.get("db"), c.req.param("id"));
+    return row ? c.json({ data: row }) : notFound(c, "Order term not found");
+})
+    .patch("/order-terms/:id", async (c) => {
+    const row = await transactionsService.updateOrderTerm(c.get("db"), c.req.param("id"), updateOrderTermSchema.parse(await c.req.json()));
+    return row ? c.json({ data: row }) : notFound(c, "Order term not found");
+})
+    .delete("/order-terms/:id", async (c) => {
+    const row = await transactionsService.deleteOrderTerm(c.get("db"), c.req.param("id"));
+    return row ? c.json({ success: true }) : notFound(c, "Order term not found");
+});

package/dist/routes-shared.d.ts

@@ -0,0 +1,103 @@
+import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import type { Context } from "hono";
+export type Env = {
+    Bindings: Partial<{
+        KMS_PROVIDER: string;
+        KMS_ENV_KEY: string;
+        KMS_LOCAL_KEY: string;
+        GCP_PROJECT_ID: string;
+        GCP_SERVICE_ACCOUNT_EMAIL: string;
+        GCP_PRIVATE_KEY: string;
+        GCP_KMS_KEYRING: string;
+        GCP_KMS_LOCATION: string;
+        GCP_KMS_PEOPLE_KEY_NAME: string;
+        GCP_KMS_INTEGRATIONS_KEY_NAME: string;
+        AWS_REGION: string;
+        AWS_ACCESS_KEY_ID: string;
+        AWS_SECRET_ACCESS_KEY: string;
+        AWS_SESSION_TOKEN: string;
+        AWS_KMS_ENDPOINT: string;
+        AWS_KMS_PEOPLE_KEY_ID: string;
+        AWS_KMS_INTEGRATIONS_KEY_ID: string;
+    }>;
+    Variables: {
+        db: PostgresJsDatabase;
+        userId?: string;
+        actor?: "staff" | "customer" | "partner" | "supplier";
+        callerType?: "session" | "api_key" | "internal";
+        scopes?: string[] | null;
+        isInternalRequest?: boolean;
+        authorizeTransactionPii?: (args: {
+            db: PostgresJsDatabase;
+            userId?: string;
+            actor?: "staff" | "customer" | "partner" | "supplier";
+            callerType?: "session" | "api_key" | "internal";
+            scopes?: string[] | null;
+            isInternalRequest?: boolean;
+            participantKind: "offer" | "order";
+            participantId: string;
+            parentId: string;
+            action: "read" | "update" | "delete";
+        }) => boolean | Promise<boolean>;
+    };
+};
+export declare function getRuntimeEnv(c: Context<Env>): {
+    KMS_PROVIDER?: string | undefined;
+    KMS_ENV_KEY?: string | undefined;
+    KMS_LOCAL_KEY?: string | undefined;
+    GCP_PROJECT_ID?: string | undefined;
+    GCP_SERVICE_ACCOUNT_EMAIL?: string | undefined;
+    GCP_PRIVATE_KEY?: string | undefined;
+    GCP_KMS_KEYRING?: string | undefined;
+    GCP_KMS_LOCATION?: string | undefined;
+    GCP_KMS_PEOPLE_KEY_NAME?: string | undefined;
+    GCP_KMS_INTEGRATIONS_KEY_NAME?: string | undefined;
+    AWS_REGION?: string | undefined;
+    AWS_ACCESS_KEY_ID?: string | undefined;
+    AWS_SECRET_ACCESS_KEY?: string | undefined;
+    AWS_SESSION_TOKEN?: string | undefined;
+    AWS_KMS_ENDPOINT?: string | undefined;
+    AWS_KMS_PEOPLE_KEY_ID?: string | undefined;
+    AWS_KMS_INTEGRATIONS_KEY_ID?: string | undefined;
+};
+export declare function hasParticipantIdentityInput(body: Record<string, unknown>): boolean;
+export declare function logTransactionPiiAccess(c: Context<Env>, input: {
+    participantKind: "offer" | "order";
+    parentId?: string;
+    participantId?: string;
+    action: "read" | "update" | "delete";
+    outcome: "allowed" | "denied";
+    reason?: string;
+    metadata?: Record<string, unknown>;
+}): Promise<void>;
+export declare function authorizeTransactionPiiAccess(c: Context<Env>, input: {
+    participantKind: "offer" | "order";
+    participantId: string;
+    parentId: string;
+    action: "read" | "update" | "delete";
+}): Promise<{
+    allowed: true;
+    response?: undefined;
+} | {
+    allowed: false;
+    response: Response & import("hono").TypedResponse<{
+        error: string;
+    }, 401, "json">;
+} | {
+    allowed: false;
+    response: Response & import("hono").TypedResponse<{
+        error: string;
+    }, 403, "json">;
+}>;
+export declare function createPiiService(c: Context<Env>, _participantKind: "offer" | "order", parentId: string): {
+    getParticipantIdentity(db: PostgresJsDatabase, participantKind: "offer" | "order", participantId: string, actorId?: string | null): Promise<import("./index.js").DecryptedTransactionParticipantIdentity | null>;
+    upsertParticipantIdentity(db: PostgresJsDatabase, participantKind: "offer" | "order", participantId: string, input: import("./pii.js").UpsertTransactionParticipantIdentityInput, actorId?: string | null): Promise<import("./index.js").DecryptedTransactionParticipantIdentity | null>;
+    deleteParticipantIdentity(db: PostgresJsDatabase, participantKind: "offer" | "order", participantId: string, actorId?: string | null): Promise<{
+        participantId: string;
+        participantKind: "offer" | "order";
+    } | null>;
+};
+export declare function notFound(c: Context<Env>, message: string): Response & import("hono").TypedResponse<{
+    error: string;
+}, 404, "json">;
+//# sourceMappingURL=routes-shared.d.ts.map

package/dist/routes-shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes-shared.d.ts","sourceRoot":"","sources":["../src/routes-shared.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAKnC,MAAM,MAAM,GAAG,GAAG;IAChB,QAAQ,EAAE,OAAO,CAAC;QAChB,YAAY,EAAE,MAAM,CAAA;QACpB,WAAW,EAAE,MAAM,CAAA;QACnB,aAAa,EAAE,MAAM,CAAA;QACrB,cAAc,EAAE,MAAM,CAAA;QACtB,yBAAyB,EAAE,MAAM,CAAA;QACjC,eAAe,EAAE,MAAM,CAAA;QACvB,eAAe,EAAE,MAAM,CAAA;QACvB,gBAAgB,EAAE,MAAM,CAAA;QACxB,uBAAuB,EAAE,MAAM,CAAA;QAC/B,6BAA6B,EAAE,MAAM,CAAA;QACrC,UAAU,EAAE,MAAM,CAAA;QAClB,iBAAiB,EAAE,MAAM,CAAA;QACzB,qBAAqB,EAAE,MAAM,CAAA;QAC7B,iBAAiB,EAAE,MAAM,CAAA;QACzB,gBAAgB,EAAE,MAAM,CAAA;QACxB,qBAAqB,EAAE,MAAM,CAAA;QAC7B,2BAA2B,EAAE,MAAM,CAAA;KACpC,CAAC,CAAA;IACF,SAAS,EAAE;QACT,EAAE,EAAE,kBAAkB,CAAA;QACtB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,KAAK,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,CAAA;QACrD,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CAAA;QAC/C,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;QACxB,iBAAiB,CAAC,EAAE,OAAO,CAAA;QAC3B,uBAAuB,CAAC,EAAE,CAAC,IAAI,EAAE;YAC/B,EAAE,EAAE,kBAAkB,CAAA;YACtB,MAAM,CAAC,EAAE,MAAM,CAAA;YACf,KAAK,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,CAAA;YACrD,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CAAA;YAC/C,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;YACxB,iBAAiB,CAAC,EAAE,OAAO,CAAA;YAC3B,eAAe,EAAE,OAAO,GAAG,OAAO,CAAA;YAClC,aAAa,EAAE,MAAM,CAAA;YACrB,QAAQ,EAAE,MAAM,CAAA;YAChB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAA;SACrC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KACjC,CAAA;CACF,CAAA;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;EAY5C;AAcD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WAExE;AAED,wBAAsB,uBAAuB,CAC3C,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EACf,KAAK,EAAE;IACL,eAAe,EAAE,OAAO,GAAG,OAAO,CAAA;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACpC,OAAO,EAAE,SAAS,GAAG,QAAQ,CAAA;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,iBAiBF;AAED,wBAAsB,6BAA6B,CACjD,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EACf,KAAK,EAAE;IACL,eAAe,EAAE,OAAO,GAAG,OAAO,CAAA;IAClC,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAA;CACrC;;;;;;;;;;;;;GAgDF;AAED,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EACf,gBAAgB,EAAE,OAAO,GAAG,OAAO,EACnC,QAAQ,EAAE,MAAM;;;;;;;EAcjB;AAED,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM;;gBAExD"}

package/dist/routes-shared.js

@@ -0,0 +1,97 @@
+import { createKmsProviderFromEnv } from "@voyantjs/utils";
+import { createTransactionPiiService } from "./pii.js";
+import { transactionPiiAccessLog } from "./schema.js";
+export function getRuntimeEnv(c) {
+    const processEnv = globalThis.process?.env ?? {};
+    return {
+        ...processEnv,
+        ...(c.env ?? {}),
+    };
+}
+function hasPiiScope(scopes, action) {
+    if (!scopes || scopes.length === 0) {
+        return false;
+    }
+    return (scopes.includes("*") ||
+        scopes.includes("transactions-pii:*") ||
+        scopes.includes(`transactions-pii:${action}`));
+}
+export function hasParticipantIdentityInput(body) {
+    return "dateOfBirth" in body || "nationality" in body;
+}
+export async function logTransactionPiiAccess(c, input) {
+    await c
+        .get("db")
+        .insert(transactionPiiAccessLog)
+        .values({
+        participantKind: input.participantKind,
+        parentId: input.parentId ?? null,
+        participantId: input.participantId ?? null,
+        actorId: c.get("userId") ?? null,
+        actorType: c.get("actor") ?? null,
+        callerType: c.get("callerType") ?? null,
+        action: input.action,
+        outcome: input.outcome,
+        reason: input.reason ?? null,
+        metadata: input.metadata ?? null,
+    });
+}
+export async function authorizeTransactionPiiAccess(c, input) {
+    if (c.get("isInternalRequest")) {
+        return { allowed: true };
+    }
+    const userId = c.get("userId");
+    if (!userId) {
+        await logTransactionPiiAccess(c, { ...input, outcome: "denied", reason: "missing_user" });
+        return { allowed: false, response: c.json({ error: "Unauthorized" }, 401) };
+    }
+    const customAuthorizer = c.get("authorizeTransactionPii");
+    if (customAuthorizer) {
+        const allowed = await customAuthorizer({
+            db: c.get("db"),
+            userId,
+            actor: c.get("actor"),
+            callerType: c.get("callerType"),
+            scopes: c.get("scopes"),
+            isInternalRequest: c.get("isInternalRequest"),
+            ...input,
+        });
+        if (!allowed) {
+            await logTransactionPiiAccess(c, {
+                ...input,
+                outcome: "denied",
+                reason: "custom_policy_denied",
+            });
+            return { allowed: false, response: c.json({ error: "Forbidden" }, 403) };
+        }
+        return { allowed: true };
+    }
+    const allowed = hasPiiScope(c.get("scopes"), input.action) || c.get("actor") === "staff";
+    if (!allowed) {
+        await logTransactionPiiAccess(c, {
+            ...input,
+            outcome: "denied",
+            reason: "insufficient_scope",
+            metadata: { actor: c.get("actor") ?? null },
+        });
+        return { allowed: false, response: c.json({ error: "Forbidden" }, 403) };
+    }
+    return { allowed: true };
+}
+export function createPiiService(c, _participantKind, parentId) {
+    return createTransactionPiiService({
+        kms: createKmsProviderFromEnv(getRuntimeEnv(c)),
+        onAudit: async (event) => {
+            await logTransactionPiiAccess(c, {
+                participantKind: event.participantKind,
+                parentId,
+                participantId: event.participantId,
+                action: event.action,
+                outcome: "allowed",
+            });
+        },
+    });
+}
+export function notFound(c, message) {
+    return c.json({ error: message }, 404);
+}