@happyvertical/smrt-users 0.37.0 → 0.37.2

package/dist/chunks/{TerminalAuthService-bY1oWeAh.js → TerminalAuthService-DcgimQYo.js}

@@ -1,11 +1,44 @@
-import { ObjectRegistry, field, smrt, SmrtObject, SmrtCollection, foreignKey, crossPackageRef } from "@happyvertical/smrt-core";
+import { ObjectRegistry, crossPackageRef, field, smrt, SmrtObject, SmrtCollection, foreignKey } from "@happyvertical/smrt-core";
 import { getPackageConfig } from "@happyvertical/smrt-config";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, createHash } from "node:crypto";
-import { MembershipStatus, OverrideEffect, SessionStatus, TenantStatus, TenantPermissionEffect, UserStatus } from "@happyvertical/smrt-types";
+import { UserStatus, MembershipStatus, OverrideEffect, SessionStatus, TenantStatus, TenantPermissionEffect } from "@happyvertical/smrt-types";
 ObjectRegistry.registerPackageManifest(
   new URL("./manifest.json", import.meta.url)
 );
+const DEFAULT_ROLE_SLUGS = {
+  OWNER: "owner",
+  ADMIN: "admin",
+  MEMBER: "member",
+  VIEWER: "viewer"
+};
+const DEFAULT_ROLES = [
+  {
+    slug: DEFAULT_ROLE_SLUGS.OWNER,
+    name: "Owner",
+    description: "Full access to all resources"
+  },
+  {
+    slug: DEFAULT_ROLE_SLUGS.ADMIN,
+    name: "Administrator",
+    description: "Manage users and settings"
+  },
+  {
+    slug: DEFAULT_ROLE_SLUGS.MEMBER,
+    name: "Member",
+    description: "Standard access"
+  },
+  {
+    slug: DEFAULT_ROLE_SLUGS.VIEWER,
+    name: "Viewer",
+    description: "Read-only access"
+  }
+];
+const DEFAULT_TENANT_POLICY = {
+  mode: "flexible",
+  maxTenants: 0,
+  defaultName: "Default Workspace"
+};
 var __defProp$a = Object.defineProperty;
 var __getOwnPropDesc$b = Object.getOwnPropertyDescriptor;
 var __decorateClass$b = (decorators, target, key, kind) => {
@@ -16,6 +49,91 @@ var __decorateClass$b = (decorators, target, key, kind) => {
   if (kind && result) __defProp$a(target, key, result);
   return result;
 };
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function isValidEmail(email) {
+  if (!email || typeof email !== "string") return false;
+  return EMAIL_REGEX.test(email.trim());
+}
+function normalizeEmail(email) {
+  if (!email || typeof email !== "string") return "";
+  return email.trim().toLowerCase();
+}
+let User = class extends SmrtObject {
+  profileId = "";
+  /**
+   * User's email address (unique, used for lookup)
+   */
+  email = "";
+  status = UserStatus.ACTIVE;
+  /**
+   * Last login timestamp
+   */
+  lastLoginAt = null;
+  constructor(options = {}) {
+    super(options);
+    if (options.profileId !== void 0) this.profileId = options.profileId;
+    if (options.email !== void 0) this.email = normalizeEmail(options.email);
+    if (options.status !== void 0) this.status = options.status;
+    if (options.lastLoginAt !== void 0)
+      this.lastLoginAt = options.lastLoginAt;
+  }
+  /**
+   * Validate the user's email format.
+   * @returns true if email is valid
+   */
+  hasValidEmail() {
+    return isValidEmail(this.email);
+  }
+  /**
+   * Check if user is active
+   */
+  isActive() {
+    return this.status === UserStatus.ACTIVE;
+  }
+  /**
+   * Check if user is suspended
+   */
+  isSuspended() {
+    return this.status === UserStatus.SUSPENDED;
+  }
+  /**
+   * Check if user is pending verification
+   */
+  isPending() {
+    return this.status === UserStatus.PENDING;
+  }
+  /**
+   * Record a login event
+   */
+  recordLogin() {
+    this.lastLoginAt = /* @__PURE__ */ new Date();
+  }
+};
+__decorateClass$b([
+  crossPackageRef("@happyvertical/smrt-profiles:Profile")
+], User.prototype, "profileId", 2);
+__decorateClass$b([
+  field({ type: "text" })
+], User.prototype, "status", 2);
+User = __decorateClass$b([
+  smrt({
+    // #1400: read-only generated surface — User is auth identity (email/status/
+    // profileId), provisioned via OIDC/magic-link, not arbitrary authed POST/PUT.
+    api: { include: ["list", "get"] },
+    mcp: { include: ["list", "get"] },
+    cli: true
+  })
+], User);
+var __defProp$9 = Object.defineProperty;
+var __getOwnPropDesc$a = Object.getOwnPropertyDescriptor;
+var __decorateClass$a = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$a(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+  if (kind && result) __defProp$9(target, key, result);
+  return result;
+};
 let UsersCliAuthRequest = class extends SmrtObject {
   userCode = "";
   deviceCodeHash = "";
@@ -26,31 +144,31 @@ let UsersCliAuthRequest = class extends SmrtObject {
   expiresAt = /* @__PURE__ */ new Date();
   approvedAt = null;
 };
-__decorateClass$b([
+__decorateClass$a([
   field({ type: "text" })
 ], UsersCliAuthRequest.prototype, "userCode", 2);
-__decorateClass$b([
+__decorateClass$a([
   field({ type: "text" })
 ], UsersCliAuthRequest.prototype, "deviceCodeHash", 2);
-__decorateClass$b([
+__decorateClass$a([
   field({ type: "text" })
 ], UsersCliAuthRequest.prototype, "status", 2);
-__decorateClass$b([
+__decorateClass$a([
   field({ type: "text" })
 ], UsersCliAuthRequest.prototype, "userId", 2);
-__decorateClass$b([
+__decorateClass$a([
   field({ type: "text" })
 ], UsersCliAuthRequest.prototype, "tenantId", 2);
-__decorateClass$b([
+__decorateClass$a([
   field({ type: "text" })
 ], UsersCliAuthRequest.prototype, "sessionId", 2);
-__decorateClass$b([
+__decorateClass$a([
   field({ type: "datetime" })
 ], UsersCliAuthRequest.prototype, "expiresAt", 2);
-__decorateClass$b([
+__decorateClass$a([
   field({ type: "datetime", nullable: true })
 ], UsersCliAuthRequest.prototype, "approvedAt", 2);
-UsersCliAuthRequest = __decorateClass$b([
+UsersCliAuthRequest = __decorateClass$a([
   smrt({
     tableName: "users_cli_auth_requests",
     api: { include: [] },
@@ -98,14 +216,14 @@ class UsersCliAuthRequestCollection extends SmrtCollection {
     return count;
   }
 }
-var __defProp$9 = Object.defineProperty;
-var __getOwnPropDesc$a = Object.getOwnPropertyDescriptor;
-var __decorateClass$a = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$a(target, key) : target;
+var __defProp$8 = Object.defineProperty;
+var __getOwnPropDesc$9 = Object.getOwnPropertyDescriptor;
+var __decorateClass$9 = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$9(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
     if (decorator = decorators[i])
       result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp$9(target, key, result);
+  if (kind && result) __defProp$8(target, key, result);
   return result;
 };
 let Group = class extends SmrtObject {
@@ -126,10 +244,10 @@ let Group = class extends SmrtObject {
       this.description = options.description;
   }
 };
-__decorateClass$a([
+__decorateClass$9([
   foreignKey("Tenant", { required: true })
 ], Group.prototype, "tenantId", 2);
-Group = __decorateClass$a([
+Group = __decorateClass$9([
   smrt({
     // #1400: read-only generated surface — RBAC/identity writes go through
     // permission-gated services, not auth-only generated CRUD.
@@ -160,14 +278,14 @@ class GroupCollection extends SmrtCollection {
     return results.length > 0 ? results[0] : null;
   }
 }
-var __defProp$8 = Object.defineProperty;
-var __getOwnPropDesc$9 = Object.getOwnPropertyDescriptor;
-var __decorateClass$9 = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$9(target, key) : target;
+var __defProp$7 = Object.defineProperty;
+var __getOwnPropDesc$8 = Object.getOwnPropertyDescriptor;
+var __decorateClass$8 = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$8(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
     if (decorator = decorators[i])
       result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp$8(target, key, result);
+  if (kind && result) __defProp$7(target, key, result);
   return result;
 };
 let GroupMember = class extends SmrtObject {
@@ -179,13 +297,13 @@ let GroupMember = class extends SmrtObject {
     if (options.userId !== void 0) this.userId = options.userId;
   }
 };
-__decorateClass$9([
+__decorateClass$8([
   foreignKey("Group", { required: true })
 ], GroupMember.prototype, "groupId", 2);
-__decorateClass$9([
+__decorateClass$8([
   foreignKey("User", { required: true })
 ], GroupMember.prototype, "userId", 2);
-GroupMember = __decorateClass$9([
+GroupMember = __decorateClass$8([
   smrt({
     // #1400: read-only generated REST + MCP surface — RBAC/identity writes go
     // through permission-gated services, not auth-only generated CRUD. mcp must
@@ -301,14 +419,14 @@ class GroupMemberCollection extends SmrtCollection {
     return members.map((m) => m.userId);
   }
 }
-var __defProp$7 = Object.defineProperty;
-var __getOwnPropDesc$8 = Object.getOwnPropertyDescriptor;
-var __decorateClass$8 = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$8(target, key) : target;
+var __defProp$6 = Object.defineProperty;
+var __getOwnPropDesc$7 = Object.getOwnPropertyDescriptor;
+var __decorateClass$7 = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$7(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
     if (decorator = decorators[i])
       result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp$7(target, key, result);
+  if (kind && result) __defProp$6(target, key, result);
   return result;
 };
 let GroupRole = class extends SmrtObject {
@@ -320,13 +438,13 @@ let GroupRole = class extends SmrtObject {
     if (options.roleId !== void 0) this.roleId = options.roleId;
   }
 };
-__decorateClass$8([
+__decorateClass$7([
   foreignKey("Group", { required: true })
 ], GroupRole.prototype, "groupId", 2);
-__decorateClass$8([
+__decorateClass$7([
   foreignKey("Role", { required: true })
 ], GroupRole.prototype, "roleId", 2);
-GroupRole = __decorateClass$8([
+GroupRole = __decorateClass$7([
   smrt({
     // #1400: read-only generated REST + MCP surface — RBAC/identity writes go
     // through permission-gated services, not auth-only generated CRUD. mcp must
@@ -401,47 +519,14 @@ class GroupRoleCollection extends SmrtCollection {
     return groupRoles.map((gr) => gr.roleId);
   }
 }
-const DEFAULT_ROLE_SLUGS = {
-  OWNER: "owner",
-  ADMIN: "admin",
-  MEMBER: "member",
-  VIEWER: "viewer"
-};
-const DEFAULT_ROLES = [
-  {
-    slug: DEFAULT_ROLE_SLUGS.OWNER,
-    name: "Owner",
-    description: "Full access to all resources"
-  },
-  {
-    slug: DEFAULT_ROLE_SLUGS.ADMIN,
-    name: "Administrator",
-    description: "Manage users and settings"
-  },
-  {
-    slug: DEFAULT_ROLE_SLUGS.MEMBER,
-    name: "Member",
-    description: "Standard access"
-  },
-  {
-    slug: DEFAULT_ROLE_SLUGS.VIEWER,
-    name: "Viewer",
-    description: "Read-only access"
-  }
-];
-const DEFAULT_TENANT_POLICY = {
-  mode: "flexible",
-  maxTenants: 0,
-  defaultName: "Default Workspace"
-};
-var __defProp$6 = Object.defineProperty;
-var __getOwnPropDesc$7 = Object.getOwnPropertyDescriptor;
-var __decorateClass$7 = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$7(target, key) : target;
+var __defProp$5 = Object.defineProperty;
+var __getOwnPropDesc$6 = Object.getOwnPropertyDescriptor;
+var __decorateClass$6 = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$6(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
     if (decorator = decorators[i])
       result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp$6(target, key, result);
+  if (kind && result) __defProp$5(target, key, result);
   return result;
 };
 let Membership = class extends SmrtObject {
@@ -469,19 +554,19 @@ let Membership = class extends SmrtObject {
     return this.status === MembershipStatus.PENDING;
   }
 };
-__decorateClass$7([
+__decorateClass$6([
   foreignKey("User", { required: true })
 ], Membership.prototype, "userId", 2);
-__decorateClass$7([
+__decorateClass$6([
   foreignKey("Tenant", { required: true })
 ], Membership.prototype, "tenantId", 2);
-__decorateClass$7([
+__decorateClass$6([
   foreignKey("Role", { required: true })
 ], Membership.prototype, "roleId", 2);
-__decorateClass$7([
+__decorateClass$6([
   field({ type: "text" })
 ], Membership.prototype, "status", 2);
-Membership = __decorateClass$7([
+Membership = __decorateClass$6([
   smrt({
     // #1400: read-only generated surface — RBAC/identity writes go through
     // permission-gated services, not auth-only generated CRUD (requireRouteAuth
@@ -558,14 +643,14 @@ class MembershipCollection extends SmrtCollection {
     });
   }
 }
-var __defProp$5 = Object.defineProperty;
-var __getOwnPropDesc$6 = Object.getOwnPropertyDescriptor;
-var __decorateClass$6 = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$6(target, key) : target;
+var __defProp$4 = Object.defineProperty;
+var __getOwnPropDesc$5 = Object.getOwnPropertyDescriptor;
+var __decorateClass$5 = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$5(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
     if (decorator = decorators[i])
       result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp$5(target, key, result);
+  if (kind && result) __defProp$4(target, key, result);
   return result;
 };
 let MembershipOverride = class extends SmrtObject {
@@ -593,16 +678,16 @@ let MembershipOverride = class extends SmrtObject {
     return this.effect === OverrideEffect.DENY;
   }
 };
-__decorateClass$6([
+__decorateClass$5([
   foreignKey("Membership", { required: true })
 ], MembershipOverride.prototype, "membershipId", 2);
-__decorateClass$6([
+__decorateClass$5([
   foreignKey("Permission", { required: true })
 ], MembershipOverride.prototype, "permissionId", 2);
-__decorateClass$6([
+__decorateClass$5([
   field({ type: "text" })
 ], MembershipOverride.prototype, "effect", 2);
-MembershipOverride = __decorateClass$6([
+MembershipOverride = __decorateClass$5([
   smrt({
     // #1400: read-only generated REST + MCP surface — RBAC/identity writes go
     // through permission-gated services, not auth-only generated CRUD. mcp must
@@ -711,9 +796,9 @@ class MembershipOverrideCollection extends SmrtCollection {
     );
   }
 }
-var __getOwnPropDesc$5 = Object.getOwnPropertyDescriptor;
-var __decorateClass$5 = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$5(target, key) : target;
+var __getOwnPropDesc$4 = Object.getOwnPropertyDescriptor;
+var __decorateClass$4 = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$4(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
     if (decorator = decorators[i])
       result = decorator(result) || result;
@@ -785,7 +870,7 @@ let Permission = class extends SmrtObject {
     return this.parseSlug().isValid;
   }
 };
-Permission = __decorateClass$5([
+Permission = __decorateClass$4([
   smrt({
     // #1400: read-only generated surface — RBAC/identity writes go through
     // permission-gated services, not auth-only generated CRUD.
@@ -864,14 +949,14 @@ class PermissionCollection extends SmrtCollection {
     return permission;
   }
 }
-var __defProp$4 = Object.defineProperty;
-var __getOwnPropDesc$4 = Object.getOwnPropertyDescriptor;
-var __decorateClass$4 = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$4(target, key) : target;
+var __defProp$3 = Object.defineProperty;
+var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
+var __decorateClass$3 = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$3(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
     if (decorator = decorators[i])
       result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp$4(target, key, result);
+  if (kind && result) __defProp$3(target, key, result);
   return result;
 };
 let RolePermission = class extends SmrtObject {
@@ -884,13 +969,13 @@ let RolePermission = class extends SmrtObject {
       this.permissionId = options.permissionId;
   }
 };
-__decorateClass$4([
+__decorateClass$3([
   foreignKey("Role", { required: true })
 ], RolePermission.prototype, "roleId", 2);
-__decorateClass$4([
+__decorateClass$3([
   foreignKey("Permission", { required: true })
 ], RolePermission.prototype, "permissionId", 2);
-RolePermission = __decorateClass$4([
+RolePermission = __decorateClass$3([
   smrt({
     // #1400: read-only generated REST + MCP surface — RBAC/identity writes go
     // through permission-gated services, not auth-only generated CRUD. mcp must
@@ -965,14 +1050,14 @@ class RolePermissionCollection extends SmrtCollection {
     return rolePermissions.map((rp) => rp.permissionId);
   }
 }
-var __defProp$3 = Object.defineProperty;
-var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
-var __decorateClass$3 = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$3(target, key) : target;
+var __defProp$2 = Object.defineProperty;
+var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
+var __decorateClass$2 = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$2(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
     if (decorator = decorators[i])
       result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp$3(target, key, result);
+  if (kind && result) __defProp$2(target, key, result);
   return result;
 };
 const DEFAULT_SESSION_TTL = 7 * 24 * 60 * 60;
@@ -1080,16 +1165,16 @@ let Session = class extends SmrtObject {
     delete this.data[key];
   }
 };
-__decorateClass$3([
+__decorateClass$2([
   foreignKey("User")
 ], Session.prototype, "userId", 2);
-__decorateClass$3([
+__decorateClass$2([
   foreignKey("Tenant", { nullable: true })
 ], Session.prototype, "tenantId", 2);
-__decorateClass$3([
+__decorateClass$2([
   field({ type: "text" })
 ], Session.prototype, "status", 2);
-Session = __decorateClass$3([
+Session = __decorateClass$2([
   smrt({
     // Sessions should not be exposed via public API for security
     api: { include: ["get", "delete"] },
@@ -1268,14 +1353,14 @@ class SessionCollection extends SmrtCollection {
     return session.getData(key);
   }
 }
-var __defProp$2 = Object.defineProperty;
-var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
-var __decorateClass$2 = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$2(target, key) : target;
+var __defProp$1 = Object.defineProperty;
+var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __decorateClass$1 = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
     if (decorator = decorators[i])
       result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp$2(target, key, result);
+  if (kind && result) __defProp$1(target, key, result);
   return result;
 };
 const MAX_TENANT_HIERARCHY_DEPTH = 10;
@@ -1382,13 +1467,13 @@ let Tenant = class extends SmrtObject {
     return this.hierarchyPath.split("/").filter((id) => id.length > 0);
   }
 };
-__decorateClass$2([
+__decorateClass$1([
   field({ type: "text" })
 ], Tenant.prototype, "status", 2);
-__decorateClass$2([
+__decorateClass$1([
   foreignKey("Tenant", { nullable: true })
 ], Tenant.prototype, "parentTenantId", 2);
-Tenant = __decorateClass$2([
+Tenant = __decorateClass$1([
   smrt({
     tableStrategy: "sti",
     // #1400: read-only generated surface — tenant create/update (incl. the
@@ -1771,14 +1856,14 @@ class TenantCollection extends SmrtCollection {
     return super.create(options);
   }
 }
-var __defProp$1 = Object.defineProperty;
-var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
-var __decorateClass$1 = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
     if (decorator = decorators[i])
       result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp$1(target, key, result);
+  if (kind && result) __defProp(target, key, result);
   return result;
 };
 let TenantPermissionOverride = class extends SmrtObject {
@@ -1817,16 +1902,16 @@ let TenantPermissionOverride = class extends SmrtObject {
     return this.effect !== TenantPermissionEffect.INHERIT;
   }
 };
-__decorateClass$1([
+__decorateClass([
   foreignKey("Tenant", { required: true })
 ], TenantPermissionOverride.prototype, "tenantId", 2);
-__decorateClass$1([
+__decorateClass([
   foreignKey("Permission", { required: true })
 ], TenantPermissionOverride.prototype, "permissionId", 2);
-__decorateClass$1([
+__decorateClass([
   field({ type: "text" })
 ], TenantPermissionOverride.prototype, "effect", 2);
-TenantPermissionOverride = __decorateClass$1([
+TenantPermissionOverride = __decorateClass([
   smrt({
     // #1400: read-only generated REST + MCP surface — RBAC/identity writes go
     // through permission-gated services, not auth-only generated CRUD. mcp must
@@ -2062,91 +2147,6 @@ class TenantPermissionOverrideCollection extends SmrtCollection {
     return results;
   }
 }
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __decorateClass = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
-  for (var i = decorators.length - 1, decorator; i >= 0; i--)
-    if (decorator = decorators[i])
-      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp(target, key, result);
-  return result;
-};
-const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-function isValidEmail(email) {
-  if (!email || typeof email !== "string") return false;
-  return EMAIL_REGEX.test(email.trim());
-}
-function normalizeEmail(email) {
-  if (!email || typeof email !== "string") return "";
-  return email.trim().toLowerCase();
-}
-let User = class extends SmrtObject {
-  profileId = "";
-  /**
-   * User's email address (unique, used for lookup)
-   */
-  email = "";
-  status = UserStatus.ACTIVE;
-  /**
-   * Last login timestamp
-   */
-  lastLoginAt = null;
-  constructor(options = {}) {
-    super(options);
-    if (options.profileId !== void 0) this.profileId = options.profileId;
-    if (options.email !== void 0) this.email = normalizeEmail(options.email);
-    if (options.status !== void 0) this.status = options.status;
-    if (options.lastLoginAt !== void 0)
-      this.lastLoginAt = options.lastLoginAt;
-  }
-  /**
-   * Validate the user's email format.
-   * @returns true if email is valid
-   */
-  hasValidEmail() {
-    return isValidEmail(this.email);
-  }
-  /**
-   * Check if user is active
-   */
-  isActive() {
-    return this.status === UserStatus.ACTIVE;
-  }
-  /**
-   * Check if user is suspended
-   */
-  isSuspended() {
-    return this.status === UserStatus.SUSPENDED;
-  }
-  /**
-   * Check if user is pending verification
-   */
-  isPending() {
-    return this.status === UserStatus.PENDING;
-  }
-  /**
-   * Record a login event
-   */
-  recordLogin() {
-    this.lastLoginAt = /* @__PURE__ */ new Date();
-  }
-};
-__decorateClass([
-  crossPackageRef("@happyvertical/smrt-profiles:Profile")
-], User.prototype, "profileId", 2);
-__decorateClass([
-  field({ type: "text" })
-], User.prototype, "status", 2);
-User = __decorateClass([
-  smrt({
-    // #1400: read-only generated surface — User is auth identity (email/status/
-    // profileId), provisioned via OIDC/magic-link, not arbitrary authed POST/PUT.
-    api: { include: ["list", "get"] },
-    mcp: { include: ["list", "get"] },
-    cli: true
-  })
-], User);
 class UserCollection extends SmrtCollection {
   static _itemClass = User;
   /**
@@ -5184,17 +5184,17 @@ class TerminalAuthRateLimitError extends TerminalAuthError {
 }
 export {
   checkKeyLength as $,
-  Tenant as A,
-  TenantHierarchyError as B,
-  TenantPermissionOverride as C,
+  SessionService as A,
+  Tenant as B,
+  TenantHierarchyError as C,
   DEFAULT_ROLES as D,
-  TenantPermissionOverrideCollection as E,
-  TerminalAuthError as F,
+  TenantPermissionOverride as E,
+  TenantPermissionOverrideCollection as F,
   Group as G,
-  TerminalAuthRateLimitError as H,
-  TerminalAuthService as I,
-  User as J,
-  UserCollection as K,
+  TerminalAuthError as H,
+  TerminalAuthRateLimitError as I,
+  TerminalAuthService as J,
+  User as K,
   decodeOidcTransaction as L,
   MembershipCollection as M,
   encodeOidcTransaction as N,
@@ -5204,14 +5204,14 @@ export {
   RolePermission as R,
   Session as S,
   TenantCollection as T,
-  UsersCliAuthRequest as U,
+  UserCollection as U,
   getCurrentSessionPermissionContext as V,
   getRequestScopedDatabase as W,
   getUsersOidcConfig as X,
   resolveOidcProviderConfig as Y,
   withSessionPermissionContext as Z,
   getSigKey as _,
-  isValidPermissionSlug as a,
+  DEFAULT_ROLE_SLUGS as a,
   subtleAlgorithm as a0,
   JWSInvalid as a1,
   isDisjoint as a2,
@@ -5232,30 +5232,30 @@ export {
   flattenedVerify as ah,
   importJWK as ai,
   jwksCache as aj,
-  DEFAULT_TENANT_POLICY as b,
-  DEFAULT_ROLE_SLUGS as c,
-  UsersCliAuthRequestCollection as d,
-  DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS as e,
-  DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS as f,
-  DEFAULT_CLI_SESSION_TTL_SECONDS as g,
-  DEFAULT_SESSION_TTL as h,
+  isValidPermissionSlug as b,
+  DEFAULT_TENANT_POLICY as c,
+  UsersCliAuthRequest as d,
+  UsersCliAuthRequestCollection as e,
+  DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS as f,
+  DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS as g,
+  DEFAULT_CLI_SESSION_TTL_SECONDS as h,
   isValidEmail as i,
-  GroupCollection as j,
-  GroupMember as k,
-  GroupMemberCollection as l,
-  GroupRole as m,
+  DEFAULT_SESSION_TTL as j,
+  GroupCollection as k,
+  GroupMember as l,
+  GroupMemberCollection as m,
   normalizeEmail as n,
-  GroupRoleCollection as o,
+  GroupRole as o,
   parsePermissionSlug as p,
-  MAX_TENANT_HIERARCHY_DEPTH as q,
-  Membership as r,
-  MembershipOverride as s,
-  MembershipOverrideCollection as t,
-  OidcLoginService as u,
-  Permission as v,
-  PermissionResolver as w,
-  RolePermissionCollection as x,
-  SessionCollection as y,
-  SessionService as z
+  GroupRoleCollection as q,
+  MAX_TENANT_HIERARCHY_DEPTH as r,
+  Membership as s,
+  MembershipOverride as t,
+  MembershipOverrideCollection as u,
+  OidcLoginService as v,
+  Permission as w,
+  PermissionResolver as x,
+  RolePermissionCollection as y,
+  SessionCollection as z
 };
-//# sourceMappingURL=TerminalAuthService-bY1oWeAh.js.map
+//# sourceMappingURL=TerminalAuthService-DcgimQYo.js.map