@happyvertical/smrt-users 0.30.0

package/dist/services/TenantService.d.ts

@@ -0,0 +1,135 @@
+import { SmrtClassOptions } from '@happyvertical/smrt-core';
+import { Membership } from '../models/Membership.js';
+import { Tenant } from '../models/Tenant.js';
+import { TenantPolicy } from '../types/index.js';
+/**
+ * Result of tenant creation with ownership
+ */
+export interface TenantWithOwnershipResult {
+    tenant: Tenant;
+    membership: Membership;
+}
+/**
+ * Result of ensureTenantForUser
+ */
+export interface EnsureTenantResult {
+    /** The tenant (null if flexible mode and no existing tenant) */
+    tenant: Tenant | null;
+    /** The membership (null if no tenant) */
+    membership: Membership | null;
+    /** Whether a new tenant was created */
+    created: boolean;
+}
+/**
+ * TenantService manages tenant creation with configurable policies.
+ *
+ * Policies:
+ * - `flexible`: No tenant created on signup, user can have zero tenants
+ * - `personal`: Auto-create personal tenant on first login, can delete all
+ * - `required`: Auto-create personal tenant, must keep at least one
+ *
+ * @example
+ * ```typescript
+ * const tenantService = new TenantService(options, {
+ *   mode: 'personal',
+ *   maxTenants: 5,
+ *   defaultName: 'My Workspace',
+ * });
+ * await tenantService.initialize();
+ *
+ * // During OIDC login
+ * const { tenant, membership, created } = await tenantService.ensureTenantForUser(
+ *   user.id,
+ *   { email: user.email, name: user.name }
+ * );
+ *
+ * // Creating additional tenants
+ * if (await tenantService.canCreateTenant(user.id)) {
+ *   const { tenant } = await tenantService.createTenantWithOwnership(
+ *     user.id,
+ *     'New Organization'
+ *   );
+ * }
+ * ```
+ */
+export declare class TenantService {
+    private options;
+    private policy;
+    private tenantCollection;
+    private membershipCollection;
+    private roleCollection;
+    constructor(options: SmrtClassOptions, policy?: TenantPolicy);
+    /**
+     * Initialize collections
+     */
+    initialize(): Promise<void>;
+    /**
+     * Get the current policy
+     */
+    getPolicy(): TenantPolicy;
+    /**
+     * Create a tenant and make the user the owner
+     *
+     * @param userId - The user to make owner
+     * @param name - Tenant name
+     * @param options - Optional slug override
+     * @returns The created tenant and membership
+     */
+    createTenantWithOwnership(userId: string, name: string, options?: {
+        slug?: string;
+    }): Promise<TenantWithOwnershipResult>;
+    /**
+     * Check if a user can create a new tenant
+     *
+     * Returns false if maxTenants limit is reached (0 = unlimited)
+     */
+    canCreateTenant(userId: string): Promise<boolean>;
+    /**
+     * Get a specific error message explaining why a tenant cannot be deleted.
+     *
+     * @returns Error message if deletion is not allowed, or null if allowed.
+     */
+    private getDeleteTenantError;
+    /**
+     * Check if a user can delete a specific tenant
+     *
+     * Returns false if:
+     * - User is not an active member
+     * - User is not the owner
+     * - Policy is 'required' and this is the last tenant
+     */
+    canDeleteTenant(userId: string, tenantId: string): Promise<boolean>;
+    /**
+     * Delete a tenant
+     *
+     * Note: This does not cascade delete related records (memberships, etc.).
+     * The caller should handle cleanup of related data if needed.
+     *
+     * @throws Error if user cannot delete the tenant (with specific reason)
+     */
+    deleteTenant(userId: string, tenantId: string): Promise<void>;
+    /**
+     * Ensure a tenant exists for the user based on policy
+     *
+     * Called during OIDC login to apply tenant policy:
+     * - `flexible`: Returns first existing tenant or null (no auto-create)
+     * - `personal`/`required`: Creates default tenant if none exists
+     *
+     * @param userId - The user ID
+     * @param userInfo - User info for naming the auto-created tenant
+     * @returns Tenant and membership (may be null in flexible mode)
+     */
+    ensureTenantForUser(userId: string, userInfo: {
+        email?: string;
+        name?: string;
+    }): Promise<EnsureTenantResult>;
+    /**
+     * Get all tenants for a user (where they are owner)
+     */
+    getOwnedTenants(userId: string): Promise<Tenant[]>;
+    /**
+     * Static factory method
+     */
+    static create(options: SmrtClassOptions, policy?: TenantPolicy): Promise<TenantService>;
+}
+//# sourceMappingURL=TenantService.d.ts.map

package/dist/services/TenantService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantService.d.ts","sourceRoot":"","sources":["../../src/services/TenantService.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAIjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAIL,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AAE3B;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,yCAAyC;IACzC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,OAAO,CAAmB;IAClC,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,oBAAoB,CAAwB;IACpD,OAAO,CAAC,cAAc,CAAkB;gBAE5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,YAAY;IAK5D;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAajC;;OAEG;IACH,SAAS,IAAI,YAAY;IAIzB;;;;;;;OAOG;IACG,yBAAyB,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1B,OAAO,CAAC,yBAAyB,CAAC;IAmCrC;;;;OAIG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBvD;;;;OAIG;YACW,oBAAoB;IAwClC;;;;;;;OAOG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzE;;;;;;;OAOG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYnE;;;;;;;;;;OAUG;IACG,mBAAmB,CACvB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1C,OAAO,CAAC,kBAAkB,CAAC;IA+C9B;;OAEG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAuBxD;;OAEG;WACU,MAAM,CACjB,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,aAAa,CAAC;CAK1B"}

package/dist/services/TerminalAuthService.d.ts

@@ -0,0 +1,189 @@
+import { SmrtClassOptions } from '@happyvertical/smrt-core';
+import { CliAuthRequestStatus, UsersCliAuthRequest } from '../models/CliAuthRequest.js';
+import { User } from '../models/User.js';
+import { SessionContext } from './SessionService.js';
+/** Default polling interval the CLI should honour while waiting for approval. */
+export declare const DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS = 2;
+/** Default lifetime of a pending request (10 minutes). */
+export declare const DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS: number;
+/** Default lifetime of the session minted on approval (30 days). */
+export declare const DEFAULT_CLI_SESSION_TTL_SECONDS: number;
+/** Default cap on consecutive failed approve attempts per user before lockout. */
+export declare const DEFAULT_CLI_AUTH_MAX_APPROVE_ATTEMPTS = 5;
+/** Default sliding window for counting failed approve attempts (5 minutes). */
+export declare const DEFAULT_CLI_AUTH_APPROVE_ATTEMPT_WINDOW_SECONDS: number;
+/**
+ * Options for {@link TerminalAuthService}.
+ */
+export interface TerminalAuthServiceOptions extends SmrtClassOptions {
+    /**
+     * Cookie name passed through to {@link SessionService}. Should match the
+     * site's normal session cookie name so the same SessionService can
+     * resolve both browser cookies and CLI bearer tokens.
+     */
+    sessionCookieName?: string;
+    /**
+     * Prefix prepended to randomly generated user codes — purely for human
+     * recognition ("WG-1A2B3C4D"). Defaults to no prefix.
+     */
+    userCodePrefix?: string;
+    /** TTL of a pending request, in seconds. */
+    requestTtlSeconds?: number;
+    /** TTL of the session minted on approval, in seconds. */
+    sessionTtlSeconds?: number;
+    /** Polling interval hint returned to clients. */
+    pollIntervalSeconds?: number;
+    /**
+     * Path on the site's origin where the approval page is mounted. Used to
+     * build the verification URL returned to the CLI. Defaults to
+     * `/terminal-login`.
+     */
+    verificationPath?: string;
+    /** Whether the underlying SessionService should auto-extend on access. */
+    sessionAutoExtend?: boolean;
+    /**
+     * Maximum consecutive failed approve attempts allowed per user inside the
+     * sliding window before the user is locked out from approving any further
+     * codes. Defaults to {@link DEFAULT_CLI_AUTH_MAX_APPROVE_ATTEMPTS}.
+     *
+     * User codes are only 32 bits of entropy; without this throttle, an
+     * authenticated attacker could brute-force pending codes and hijack
+     * another user's CLI session by approving it themselves.
+     */
+    maxApproveAttempts?: number;
+    /**
+     * Sliding window (seconds) over which {@link maxApproveAttempts} counts.
+     * Defaults to {@link DEFAULT_CLI_AUTH_APPROVE_ATTEMPT_WINDOW_SECONDS}.
+     */
+    approveAttemptWindowSeconds?: number;
+}
+/**
+ * What `createRequest` returns to the CLI.
+ */
+export interface CliAuthStartResult {
+    deviceCode: string;
+    expiresAt: string;
+    interval: number;
+    userCode: string;
+    verificationUrl: string;
+}
+/**
+ * What `exchangeDeviceCode` returns to the polling CLI.
+ */
+export type CliAuthTokenResult = {
+    status: 'pending';
+    expiresAt: string;
+    interval: number;
+} | {
+    status: 'expired';
+} | {
+    status: 'approved';
+    accessToken: string;
+    expiresIn: number;
+    tokenType: 'Bearer';
+};
+/**
+ * Inputs for `approveRequest`. The caller is responsible for authenticating
+ * the user via its existing browser session before calling this.
+ */
+export interface ApproveCliAuthRequestInput {
+    userCode: string;
+    user: Pick<User, 'id' | 'email'>;
+    tenantId: string | null | undefined;
+    ipAddress?: string;
+    userAgent?: string;
+}
+/**
+ * High-level orchestration of the terminal device-code flow.
+ */
+export declare class TerminalAuthService {
+    private readonly options;
+    private readonly userCodePrefix;
+    private readonly requestTtlSeconds;
+    private readonly sessionTtlSeconds;
+    private readonly pollIntervalSeconds;
+    private readonly verificationPath;
+    private readonly maxApproveAttempts;
+    private readonly approveAttemptWindowMs;
+    private readonly failedApprovesByUser;
+    private requestCollection;
+    private sessionService;
+    constructor(options: TerminalAuthServiceOptions);
+    initialize(): Promise<void>;
+    static create(options: TerminalAuthServiceOptions): Promise<TerminalAuthService>;
+    private makeUserCode;
+    /**
+     * Generate a user code that is not currently in use by another *active*
+     * (pending or approved-but-unclaimed) request. Collisions are vanishingly
+     * rare (1 in 2^32 per attempt) but happen at scale; retrying keeps the
+     * affected CLI from being locked out.
+     */
+    private makeUniqueUserCode;
+    /**
+     * Start a new request. Returns the device code the CLI keeps secret, the
+     * user code the human types into the browser, and the verification URL to
+     * open. The device code is stored only as a hash.
+     */
+    createRequest(origin: string): Promise<CliAuthStartResult>;
+    /**
+     * Look up a request by user code. Performs lazy expiry: pending requests
+     * past their TTL are flipped to `expired` and persisted.
+     */
+    getRequestForUserCode(userCode: string): Promise<UsersCliAuthRequest | null>;
+    /**
+     * Mark a pending request as approved and mint a bearer session bound to the
+     * approving user. Idempotent: re-approving an already-approved request is a
+     * no-op. Throws if the user/tenant are missing, the request is unknown, or
+     * the request has expired.
+     */
+    approveRequest(input: ApproveCliAuthRequestInput): Promise<UsersCliAuthRequest>;
+    /**
+     * Throw {@link TerminalAuthRateLimitError} if the user has exceeded the
+     * configured failed-approve budget inside the current sliding window.
+     */
+    private assertApproveRateLimit;
+    /** Increment the failed-approve counter for `userId`, starting the window if needed. */
+    private recordFailedApprove;
+    /**
+     * Exchange a device code (the secret the CLI keeps) for an access token
+     * once the request has been approved. Returns `{ status: 'pending' }` while
+     * the CLI should keep polling, and `{ status: 'expired' }` if the request
+     * was never approved within its TTL.
+     */
+    exchangeDeviceCode(deviceCode: string): Promise<CliAuthTokenResult>;
+    /**
+     * Resolve a bearer token issued by this service into a full session
+     * context — load the user, permissions, and tenant just like the cookie
+     * path does. Returns `null` if the token is unknown, expired, or revoked.
+     */
+    loadBearerSession(token: string): Promise<SessionContext | null>;
+    /**
+     * Revoke a bearer token (CLI logout). Returns true if a session was
+     * actually revoked.
+     */
+    destroyBearerSession(token: string): Promise<boolean>;
+    /**
+     * Delete expired pending requests (cleanup job).
+     */
+    cleanupExpiredRequests(): Promise<number>;
+    /** The default polling interval clients should use. Exposed for tests. */
+    get pollInterval(): number;
+}
+/**
+ * Error class for terminal auth failures the caller is expected to surface to
+ * the user (vs. unexpected internal errors).
+ */
+export declare class TerminalAuthError extends Error {
+    constructor(message: string);
+}
+/**
+ * Thrown when a user has exceeded the configured failed-approve budget. The
+ * caller (SvelteKit handler, REST adapter, etc.) is expected to surface this
+ * as HTTP 429 with `Retry-After: retryAfterSeconds`.
+ */
+export declare class TerminalAuthRateLimitError extends TerminalAuthError {
+    readonly retryAfterSeconds: number;
+    constructor(message: string, retryAfterSeconds: number);
+}
+export type { CliAuthRequestStatus };
+//# sourceMappingURL=TerminalAuthService.d.ts.map

package/dist/services/TerminalAuthService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TerminalAuthService.d.ts","sourceRoot":"","sources":["../../src/services/TerminalAuthService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAE1E,iFAAiF;AACjF,eAAO,MAAM,sCAAsC,IAAI,CAAC;AACxD,0DAA0D;AAC1D,eAAO,MAAM,oCAAoC,QAAU,CAAC;AAC5D,oEAAoE;AACpE,eAAO,MAAM,+BAA+B,QAAoB,CAAC;AACjE,kFAAkF;AAClF,eAAO,MAAM,qCAAqC,IAAI,CAAC;AACvD,+EAA+E;AAC/E,eAAO,MAAM,+CAA+C,QAAS,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,0BAA2B,SAAQ,gBAAgB;IAClE;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yDAAyD;IACzD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IACE,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,QAAQ,CAAC;CACrB,CAAC;AAEN;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAcD;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAGjC;IACJ,OAAO,CAAC,iBAAiB,CAAiC;IAC1D,OAAO,CAAC,cAAc,CAAkB;gBAE5B,OAAO,EAAE,0BAA0B;IAuBzC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;WAYpB,MAAM,CACjB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,mBAAmB,CAAC;IAM/B,OAAO,CAAC,YAAY;IAKpB;;;;;OAKG;YACW,kBAAkB;IAahC;;;;OAIG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAuBhE;;;OAGG;IACG,qBAAqB,CACzB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAWtC;;;;;OAKG;IACG,cAAc,CAClB,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAiD/B;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAsB9B,wFAAwF;IACxF,OAAO,CAAC,mBAAmB;IAY3B;;;;;OAKG;IACG,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAwCzE;;;;OAIG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAItE;;;OAGG;IACG,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI3D;;OAEG;IACG,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/C,0EAA0E;IAC1E,IAAI,YAAY,IAAI,MAAM,CAEzB;CACF;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,iBAAiB;IAC/D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM;CAKvD;AAED,YAAY,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/services/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Service exports for smrt-users
+ * @packageDocumentation
+ */
+export { MagicLinkError, type MagicLinkResult, MagicLinkService, type MagicLinkServiceOptions, type MagicLinkVerifyResult, } from './MagicLinkService.js';
+export { type CreateAuthorizationUrlOptions, decodeOidcTransaction, encodeOidcTransaction, getUsersOidcConfig, type OidcCallbackResult, OidcLoginError, type OidcLoginResult, OidcLoginService, type OidcLoginServiceOptions, type OidcProviderConfig, type OidcProviderKind, type OidcProviderMetadata, type OidcProviderResolution, type OidcProviderResolutionOptions, type OidcTokenEndpointAuthMethod, type OidcTokenSet, type OidcTransaction, type ResolvedOidcProviderConfig, resolveOidcProviderConfig, type UsersOidcConfig, } from './OidcLoginService.js';
+export { type PermissionCatalog, PermissionCatalogService, type PermissionCatalogSource, type PermissionCatalogSyncResult, type PermissionDefinition, type PostgresPermissionAction, type PostgresPermissionBinding, registerPermissionDefinitions, syncPermissionCatalog, type UsersConfig, } from './PermissionCatalogService.js';
+export { type PermissionResolutionOptions, type PermissionResolutionResult, PermissionResolver, type TenantPermissionInheritanceResult, } from './PermissionResolver.js';
+export { applyPostgresPermissionPolicies, type GeneratePostgresPermissionSqlResult, generatePostgresPermissionSql, type PostgresPermissionPolicyReportItem, type PostgresPermissionPolicyTarget, } from './PostgresPermissionPolicies.js';
+export { getCurrentSessionPermissionContext, getRequestScopedDatabase, type SessionPermissionRuntimeContext, type SessionPermissionRuntimeOptions, withSessionPermissionContext, } from './SessionPermissionContext.js';
+export { type SessionContext, SessionService, type SessionServiceOptions, } from './SessionService.js';
+export { type EnsureTenantResult, TenantService, type TenantWithOwnershipResult, } from './TenantService.js';
+export { type ApproveCliAuthRequestInput, type CliAuthStartResult, type CliAuthTokenResult, DEFAULT_CLI_AUTH_APPROVE_ATTEMPT_WINDOW_SECONDS, DEFAULT_CLI_AUTH_MAX_APPROVE_ATTEMPTS, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, type TerminalAuthServiceOptions, } from './TerminalAuthService.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/services/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,6BAA6B,EAClC,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,6BAA6B,EAC7B,qBAAqB,EACrB,KAAK,WAAW,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,iCAAiC,GACvC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,+BAA+B,EAC/B,KAAK,mCAAmC,EACxC,6BAA6B,EAC7B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,GACpC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,cAAc,EACnB,cAAc,EACd,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,+CAA+C,EAC/C,qCAAqC,EACrC,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,0BAA0B,CAAC"}