@happyvertical/smrt-users 0.37.2 → 0.37.4

package/dist/chunks/TerminalAuthService-BXAAuaXf.js

@@ -0,0 +1,4531 @@
+import { ObjectRegistry, SmrtCollection, SmrtObject, crossPackageRef, field, foreignKey, smrt } from "@happyvertical/smrt-core";
+import { AccessRequestStatus, MembershipStatus, OverrideEffect, SessionStatus, TenantPermissionEffect, TenantStatus, UserStatus } from "@happyvertical/smrt-types";
+import { getPackageConfig } from "@happyvertical/smrt-config";
+import { createHash, randomBytes } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region \0rolldown/runtime.js
+var __defProp$12 = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp$12(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp$12(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/__smrt-register__.ts
+ObjectRegistry.registerPackageManifest(new URL("./manifest.json", "" + import.meta.url));
+//#endregion
+//#region src/types/index.ts
+var DEFAULT_ROLE_SLUGS = {
+	OWNER: "owner",
+	ADMIN: "admin",
+	MEMBER: "member",
+	VIEWER: "viewer"
+};
+var DEFAULT_ROLES = [
+	{
+		slug: DEFAULT_ROLE_SLUGS.OWNER,
+		name: "Owner",
+		description: "Full access to all resources"
+	},
+	{
+		slug: DEFAULT_ROLE_SLUGS.ADMIN,
+		name: "Administrator",
+		description: "Manage users and settings"
+	},
+	{
+		slug: DEFAULT_ROLE_SLUGS.MEMBER,
+		name: "Member",
+		description: "Standard access"
+	},
+	{
+		slug: DEFAULT_ROLE_SLUGS.VIEWER,
+		name: "Viewer",
+		description: "Read-only access"
+	}
+];
+var DEFAULT_TENANT_POLICY = {
+	mode: "flexible",
+	maxTenants: 0,
+	defaultName: "Default Workspace"
+};
+//#endregion
+//#region src/models/User.ts
+var __defProp$11 = Object.defineProperty;
+var __getOwnPropDesc$11 = Object.getOwnPropertyDescriptor;
+var __decorateClass$11 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$11(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$11(target, key, result);
+	return result;
+};
+var EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function isValidEmail(email) {
+	if (!email || typeof email !== "string") return false;
+	return EMAIL_REGEX.test(email.trim());
+}
+function normalizeEmail(email) {
+	if (!email || typeof email !== "string") return "";
+	return email.trim().toLowerCase();
+}
+var User = class extends SmrtObject {
+	profileId = "";
+	/**
+	* User's email address (unique, used for lookup)
+	*/
+	email = "";
+	status = UserStatus.ACTIVE;
+	/**
+	* Last login timestamp
+	*/
+	lastLoginAt = null;
+	constructor(options = {}) {
+		super(options);
+		if (options.profileId !== void 0) this.profileId = options.profileId;
+		if (options.email !== void 0) this.email = normalizeEmail(options.email);
+		if (options.status !== void 0) this.status = options.status;
+		if (options.lastLoginAt !== void 0) this.lastLoginAt = options.lastLoginAt;
+	}
+	/**
+	* Validate the user's email format.
+	* @returns true if email is valid
+	*/
+	hasValidEmail() {
+		return isValidEmail(this.email);
+	}
+	/**
+	* Check if user is active
+	*/
+	isActive() {
+		return this.status === UserStatus.ACTIVE;
+	}
+	/**
+	* Check if user is suspended
+	*/
+	isSuspended() {
+		return this.status === UserStatus.SUSPENDED;
+	}
+	/**
+	* Check if user is pending verification
+	*/
+	isPending() {
+		return this.status === UserStatus.PENDING;
+	}
+	/**
+	* Record a login event
+	*/
+	recordLogin() {
+		this.lastLoginAt = /* @__PURE__ */ new Date();
+	}
+};
+__decorateClass$11([crossPackageRef("@happyvertical/smrt-profiles:Profile")], User.prototype, "profileId", 2);
+__decorateClass$11([field({ type: "text" })], User.prototype, "status", 2);
+User = __decorateClass$11([smrt({
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: true
+})], User);
+//#endregion
+//#region src/models/CliAuthRequest.ts
+var __defProp$10 = Object.defineProperty;
+var __getOwnPropDesc$10 = Object.getOwnPropertyDescriptor;
+var __decorateClass$10 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$10(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$10(target, key, result);
+	return result;
+};
+var UsersCliAuthRequest = class extends SmrtObject {
+	userCode = "";
+	deviceCodeHash = "";
+	status = "pending";
+	userId = "";
+	tenantId = "";
+	sessionId = "";
+	expiresAt = /* @__PURE__ */ new Date();
+	approvedAt = null;
+};
+__decorateClass$10([field({ type: "text" })], UsersCliAuthRequest.prototype, "userCode", 2);
+__decorateClass$10([field({ type: "text" })], UsersCliAuthRequest.prototype, "deviceCodeHash", 2);
+__decorateClass$10([field({ type: "text" })], UsersCliAuthRequest.prototype, "status", 2);
+__decorateClass$10([field({ type: "text" })], UsersCliAuthRequest.prototype, "userId", 2);
+__decorateClass$10([field({ type: "text" })], UsersCliAuthRequest.prototype, "tenantId", 2);
+__decorateClass$10([field({ type: "text" })], UsersCliAuthRequest.prototype, "sessionId", 2);
+__decorateClass$10([field({ type: "datetime" })], UsersCliAuthRequest.prototype, "expiresAt", 2);
+__decorateClass$10([field({
+	type: "datetime",
+	nullable: true
+})], UsersCliAuthRequest.prototype, "approvedAt", 2);
+UsersCliAuthRequest = __decorateClass$10([smrt({
+	tableName: "users_cli_auth_requests",
+	api: { include: [] },
+	cli: { include: [] },
+	mcp: { include: [] }
+})], UsersCliAuthRequest);
+//#endregion
+//#region src/collections/CliAuthRequestCollection.ts
+var UsersCliAuthRequestCollection = class extends SmrtCollection {
+	static _itemClass = UsersCliAuthRequest;
+	/**
+	* Look up a pending or completed request by the short user code shown in the CLI.
+	*/
+	async findByUserCode(userCode) {
+		const [request] = await this.list({
+			limit: 1,
+			where: { userCode: userCode.trim().toUpperCase() }
+		});
+		return request ?? null;
+	}
+	/**
+	* Look up a request by the hash of its device code (the CLI's polling key).
+	*/
+	async findByDeviceCodeHash(deviceCodeHash) {
+		const [request] = await this.list({
+			limit: 1,
+			where: { deviceCodeHash }
+		});
+		return request ?? null;
+	}
+	/**
+	* Delete expired pending requests (cleanup job).
+	*/
+	async deleteExpired() {
+		const requests = await this.list({ where: {
+			status: "pending",
+			"expiresAt <": (/* @__PURE__ */ new Date()).toISOString()
+		} });
+		let count = 0;
+		for (const request of requests) {
+			await request.delete();
+			count++;
+		}
+		return count;
+	}
+};
+//#endregion
+//#region src/models/Group.ts
+var __defProp$9 = Object.defineProperty;
+var __getOwnPropDesc$9 = Object.getOwnPropertyDescriptor;
+var __decorateClass$9 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$9(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$9(target, key, result);
+	return result;
+};
+var Group = class extends SmrtObject {
+	tenantId;
+	/**
+	* Display name for the group
+	*/
+	name = "";
+	/**
+	* Description of the group
+	*/
+	description = "";
+	constructor(options = {}) {
+		super(options);
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.name !== void 0) this.name = options.name;
+		if (options.description !== void 0) this.description = options.description;
+	}
+};
+__decorateClass$9([foreignKey("Tenant", { required: true })], Group.prototype, "tenantId", 2);
+Group = __decorateClass$9([smrt({
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: true
+})], Group);
+//#endregion
+//#region src/collections/GroupCollection.ts
+var GroupCollection = class extends SmrtCollection {
+	static _itemClass = Group;
+	/**
+	* Find all groups in a tenant
+	*/
+	async findByTenant(tenantId) {
+		return await this.list({
+			where: { tenantId },
+			orderBy: "name ASC"
+		});
+	}
+	/**
+	* Find group by slug within a tenant
+	*/
+	async findBySlug(slug, tenantId) {
+		const results = await this.list({
+			where: {
+				slug,
+				tenantId
+			},
+			limit: 1
+		});
+		return results.length > 0 ? results[0] : null;
+	}
+};
+//#endregion
+//#region src/models/GroupMember.ts
+var __defProp$8 = Object.defineProperty;
+var __getOwnPropDesc$8 = Object.getOwnPropertyDescriptor;
+var __decorateClass$8 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$8(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$8(target, key, result);
+	return result;
+};
+var GroupMember = class extends SmrtObject {
+	groupId;
+	userId;
+	constructor(options = {}) {
+		super(options);
+		if (options.groupId !== void 0) this.groupId = options.groupId;
+		if (options.userId !== void 0) this.userId = options.userId;
+	}
+};
+__decorateClass$8([foreignKey("Group", { required: true })], GroupMember.prototype, "groupId", 2);
+__decorateClass$8([foreignKey("User", { required: true })], GroupMember.prototype, "userId", 2);
+GroupMember = __decorateClass$8([smrt({
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: true
+})], GroupMember);
+//#endregion
+//#region src/collections/GroupMemberCollection.ts
+var GroupMemberCollection = class extends SmrtCollection {
+	static _itemClass = GroupMember;
+	/** Memoized Group collection, used to resolve the Group table name. */
+	groupCollection;
+	/**
+	* Resolve the database table name for the `Group` model from the registry
+	* (via a shared-connection GroupCollection) rather than hardcoding `groups`.
+	* A `@smrt({ tableName })` override or table prefix on Group would otherwise
+	* make raw joins reference a non-existent or foreign table.
+	*/
+	async getGroupTableName() {
+		if (!this.groupCollection) this.groupCollection = await GroupCollection.create({ db: this.options.db });
+		return this.groupCollection.tableName;
+	}
+	/**
+	* Find all members of a group
+	*/
+	async findByGroup(groupId) {
+		return await this.list({ where: { groupId } });
+	}
+	/**
+	* Find all groups a user belongs to
+	*/
+	async findByUser(userId) {
+		return await this.list({ where: { userId } });
+	}
+	/**
+	* Check if a user is in a group
+	*/
+	async isMember(groupId, userId) {
+		return (await this.list({
+			where: {
+				groupId,
+				userId
+			},
+			limit: 1
+		})).length > 0;
+	}
+	/**
+	* Add user to a group
+	*/
+	async addMember(groupId, userId) {
+		const existing = await this.list({
+			where: {
+				groupId,
+				userId
+			},
+			limit: 1
+		});
+		if (existing.length > 0) return existing[0];
+		const member = await this.create({
+			groupId,
+			userId
+		});
+		await member.save();
+		return member;
+	}
+	/**
+	* Remove user from a group
+	*/
+	async removeMember(groupId, userId) {
+		const existing = await this.list({
+			where: {
+				groupId,
+				userId
+			},
+			limit: 1
+		});
+		if (existing.length === 0) return false;
+		await existing[0].delete();
+		return true;
+	}
+	/**
+	* Get group IDs for a user
+	* @deprecated Use getGroupIdsForTenant to prevent cross-tenant leakage
+	*/
+	async getGroupIds(userId) {
+		return (await this.findByUser(userId)).map((m) => m.groupId);
+	}
+	/**
+	* Get group IDs for a user within a specific tenant
+	* This prevents cross-tenant permission leakage by filtering groups by tenant
+	*/
+	async getGroupIdsForTenant(userId, tenantId) {
+		const groupTable = await this.getGroupTableName();
+		const sql = `
+      SELECT gm.group_id
+      FROM ${this.tableName} gm
+      INNER JOIN ${groupTable} g ON g.id = gm.group_id
+      WHERE gm.user_id = ? AND g.tenant_id = ?
+    `;
+		return (await this.db.query(sql, userId, tenantId)).rows.map((r) => r.group_id);
+	}
+	/**
+	* Get user IDs in a group
+	*/
+	async getUserIds(groupId) {
+		return (await this.findByGroup(groupId)).map((m) => m.userId);
+	}
+};
+//#endregion
+//#region src/models/GroupRole.ts
+var __defProp$7 = Object.defineProperty;
+var __getOwnPropDesc$7 = Object.getOwnPropertyDescriptor;
+var __decorateClass$7 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$7(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$7(target, key, result);
+	return result;
+};
+var GroupRole = class extends SmrtObject {
+	groupId;
+	roleId;
+	constructor(options = {}) {
+		super(options);
+		if (options.groupId !== void 0) this.groupId = options.groupId;
+		if (options.roleId !== void 0) this.roleId = options.roleId;
+	}
+};
+__decorateClass$7([foreignKey("Group", { required: true })], GroupRole.prototype, "groupId", 2);
+__decorateClass$7([foreignKey("Role", { required: true })], GroupRole.prototype, "roleId", 2);
+GroupRole = __decorateClass$7([smrt({
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: true
+})], GroupRole);
+//#endregion
+//#region src/collections/GroupRoleCollection.ts
+var GroupRoleCollection = class extends SmrtCollection {
+	static _itemClass = GroupRole;
+	/**
+	* Find all roles for a group
+	*/
+	async findByGroup(groupId) {
+		return await this.list({ where: { groupId } });
+	}
+	/**
+	* Find all groups that have a role
+	*/
+	async findByRole(roleId) {
+		return await this.list({ where: { roleId } });
+	}
+	/**
+	* Check if a group has a role
+	*/
+	async hasRole(groupId, roleId) {
+		return (await this.list({
+			where: {
+				groupId,
+				roleId
+			},
+			limit: 1
+		})).length > 0;
+	}
+	/**
+	* Add role to a group
+	*/
+	async addRole(groupId, roleId) {
+		const existing = await this.list({
+			where: {
+				groupId,
+				roleId
+			},
+			limit: 1
+		});
+		if (existing.length > 0) return existing[0];
+		const groupRole = await this.create({
+			groupId,
+			roleId
+		});
+		await groupRole.save();
+		return groupRole;
+	}
+	/**
+	* Remove role from a group
+	*/
+	async removeRole(groupId, roleId) {
+		const existing = await this.list({
+			where: {
+				groupId,
+				roleId
+			},
+			limit: 1
+		});
+		if (existing.length === 0) return false;
+		await existing[0].delete();
+		return true;
+	}
+	/**
+	* Get role IDs for a group
+	*/
+	async getRoleIds(groupId) {
+		return (await this.findByGroup(groupId)).map((gr) => gr.roleId);
+	}
+};
+//#endregion
+//#region src/models/Membership.ts
+var __defProp$6 = Object.defineProperty;
+var __getOwnPropDesc$6 = Object.getOwnPropertyDescriptor;
+var __decorateClass$6 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$6(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$6(target, key, result);
+	return result;
+};
+var Membership = class extends SmrtObject {
+	userId;
+	tenantId;
+	roleId;
+	status = MembershipStatus.ACTIVE;
+	constructor(options = {}) {
+		super(options);
+		if (options.userId !== void 0) this.userId = options.userId;
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.roleId !== void 0) this.roleId = options.roleId;
+		if (options.status !== void 0) this.status = options.status;
+	}
+	/**
+	* Check if membership is active
+	*/
+	isActive() {
+		return this.status === MembershipStatus.ACTIVE;
+	}
+	/**
+	* Check if membership is pending (invitation not yet accepted)
+	*/
+	isPending() {
+		return this.status === MembershipStatus.PENDING;
+	}
+};
+__decorateClass$6([foreignKey("User", { required: true })], Membership.prototype, "userId", 2);
+__decorateClass$6([foreignKey("Tenant", { required: true })], Membership.prototype, "tenantId", 2);
+__decorateClass$6([foreignKey("Role", { required: true })], Membership.prototype, "roleId", 2);
+__decorateClass$6([field({ type: "text" })], Membership.prototype, "status", 2);
+Membership = __decorateClass$6([smrt({
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: true
+})], Membership);
+//#endregion
+//#region src/collections/MembershipCollection.ts
+var MembershipCollection = class extends SmrtCollection {
+	static _itemClass = Membership;
+	/**
+	* Find all memberships for a user
+	*/
+	async findByUser(userId) {
+		return await this.list({
+			where: { userId },
+			orderBy: "created_at DESC"
+		});
+	}
+	/**
+	* Find all active memberships for a user
+	*/
+	async findActiveByUser(userId) {
+		return await this.list({
+			where: {
+				userId,
+				status: MembershipStatus.ACTIVE
+			},
+			orderBy: "created_at DESC"
+		});
+	}
+	/**
+	* Find all memberships in a tenant
+	*/
+	async findByTenant(tenantId) {
+		return await this.list({
+			where: { tenantId },
+			orderBy: "created_at DESC"
+		});
+	}
+	/**
+	* Find active memberships in a tenant
+	*/
+	async findActiveByTenant(tenantId) {
+		return await this.list({
+			where: {
+				tenantId,
+				status: MembershipStatus.ACTIVE
+			},
+			orderBy: "created_at DESC"
+		});
+	}
+	/**
+	* Find a specific user's membership in a tenant
+	*/
+	async findByUserAndTenant(userId, tenantId) {
+		const results = await this.list({
+			where: {
+				userId,
+				tenantId
+			},
+			limit: 1
+		});
+		return results.length > 0 ? results[0] : null;
+	}
+	/**
+	* Find memberships by role
+	*/
+	async findByRole(roleId) {
+		return await this.list({
+			where: { roleId },
+			orderBy: "created_at DESC"
+		});
+	}
+	/**
+	* Find memberships by status
+	*/
+	async findByStatus(status) {
+		return await this.list({
+			where: { status },
+			orderBy: "created_at DESC"
+		});
+	}
+};
+//#endregion
+//#region src/models/MembershipOverride.ts
+var __defProp$5 = Object.defineProperty;
+var __getOwnPropDesc$5 = Object.getOwnPropertyDescriptor;
+var __decorateClass$5 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$5(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$5(target, key, result);
+	return result;
+};
+var MembershipOverride = class extends SmrtObject {
+	membershipId;
+	permissionId;
+	effect = OverrideEffect.GRANT;
+	constructor(options = {}) {
+		super(options);
+		if (options.membershipId !== void 0) this.membershipId = options.membershipId;
+		if (options.permissionId !== void 0) this.permissionId = options.permissionId;
+		if (options.effect !== void 0) this.effect = options.effect;
+	}
+	/**
+	* Check if this override grants the permission
+	*/
+	isGrant() {
+		return this.effect === OverrideEffect.GRANT;
+	}
+	/**
+	* Check if this override denies the permission
+	*/
+	isDeny() {
+		return this.effect === OverrideEffect.DENY;
+	}
+};
+__decorateClass$5([foreignKey("Membership", { required: true })], MembershipOverride.prototype, "membershipId", 2);
+__decorateClass$5([foreignKey("Permission", { required: true })], MembershipOverride.prototype, "permissionId", 2);
+__decorateClass$5([field({ type: "text" })], MembershipOverride.prototype, "effect", 2);
+MembershipOverride = __decorateClass$5([smrt({
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: true
+})], MembershipOverride);
+//#endregion
+//#region src/collections/MembershipOverrideCollection.ts
+var MembershipOverrideCollection = class extends SmrtCollection {
+	static _itemClass = MembershipOverride;
+	/**
+	* Find all overrides for a membership
+	*/
+	async findByMembership(membershipId) {
+		return await this.list({ where: { membershipId } });
+	}
+	/**
+	* Find grant overrides for a membership.
+	*
+	* Filters in memory because the `effect` column is JSON-typed and
+	* Postgres rejects bare `json = text` comparisons.  A single
+	* `findByMembership` call is reused for both grant and deny lookups
+	* within the same request (see `_overridesByMembership` cache).
+	*/
+	async findGrants(membershipId) {
+		return (await this.findByMembership(membershipId)).filter((o) => o.effect === OverrideEffect.GRANT);
+	}
+	/**
+	* Find deny overrides for a membership.
+	*
+	* See `findGrants` for rationale on in-memory filtering.
+	*/
+	async findDenies(membershipId) {
+		return (await this.findByMembership(membershipId)).filter((o) => o.effect === OverrideEffect.DENY);
+	}
+	/**
+	* Get grant permission IDs for a membership
+	*/
+	async getGrantedPermissionIds(membershipId) {
+		return (await this.findGrants(membershipId)).map((o) => o.permissionId);
+	}
+	/**
+	* Get denied permission IDs for a membership
+	*/
+	async getDeniedPermissionIds(membershipId) {
+		return (await this.findDenies(membershipId)).map((o) => o.permissionId);
+	}
+	/**
+	* Set an override for a membership
+	*/
+	async setOverride(membershipId, permissionId, effect) {
+		const existing = await this.list({
+			where: {
+				membershipId,
+				permissionId
+			},
+			limit: 1
+		});
+		if (existing.length > 0) {
+			existing[0].effect = effect;
+			await existing[0].save();
+			return existing[0];
+		}
+		const override = await this.create({
+			membershipId,
+			permissionId,
+			effect
+		});
+		await override.save();
+		return override;
+	}
+	/**
+	* Remove an override
+	*/
+	async removeOverride(membershipId, permissionId) {
+		const existing = await this.list({
+			where: {
+				membershipId,
+				permissionId
+			},
+			limit: 1
+		});
+		if (existing.length === 0) return false;
+		await existing[0].delete();
+		return true;
+	}
+	/**
+	* Grant a permission to a membership
+	* Convenience method for setOverride with GRANT effect
+	*/
+	async grantPermission(membershipId, permissionId) {
+		return await this.setOverride(membershipId, permissionId, OverrideEffect.GRANT);
+	}
+	/**
+	* Deny a permission for a membership
+	* Convenience method for setOverride with DENY effect
+	*/
+	async denyPermission(membershipId, permissionId) {
+		return await this.setOverride(membershipId, permissionId, OverrideEffect.DENY);
+	}
+};
+//#endregion
+//#region src/models/Permission.ts
+var __defProp$4 = Object.defineProperty;
+var __getOwnPropDesc$4 = Object.getOwnPropertyDescriptor;
+var __decorateClass$4 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$4(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$4(target, key, result);
+	return result;
+};
+function parsePermissionSlug(slug) {
+	const parts = slug.split(".");
+	if (parts.length === 2 && parts[0] && parts[1]) return {
+		resource: parts[0],
+		action: parts[1],
+		isValid: true
+	};
+	return {
+		resource: slug,
+		action: "",
+		isValid: false
+	};
+}
+function isValidPermissionSlug(slug) {
+	return parsePermissionSlug(slug).isValid;
+}
+var Permission = class extends SmrtObject {
+	/**
+	* Display name for the permission
+	*/
+	name = "";
+	/**
+	* Description of what this permission allows
+	*/
+	description = "";
+	/**
+	* Category for grouping in UI (e.g., 'articles', 'users', 'settings')
+	*/
+	category = "";
+	constructor(options = {}) {
+		super(options);
+		if (options.name !== void 0) this.name = options.name;
+		if (options.description !== void 0) this.description = options.description;
+		if (options.category !== void 0) this.category = options.category;
+	}
+	/**
+	* Parse the permission slug into resource and action components.
+	* @returns Parsed slug with resource, action, and validation status
+	*/
+	parseSlug() {
+		return parsePermissionSlug(this.slug ?? "");
+	}
+	/**
+	* Get the resource part of the permission slug
+	* e.g., 'articles.create' -> 'articles'
+	*/
+	getResource() {
+		return this.parseSlug().resource;
+	}
+	/**
+	* Get the action part of the permission slug
+	* e.g., 'articles.create' -> 'create'
+	*/
+	getAction() {
+		return this.parseSlug().action;
+	}
+	/**
+	* Check if the permission slug is valid (follows 'resource.action' pattern)
+	*/
+	isValidSlug() {
+		return this.parseSlug().isValid;
+	}
+};
+Permission = __decorateClass$4([smrt({
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: true
+})], Permission);
+//#endregion
+//#region src/collections/PermissionCollection.ts
+var PermissionCollection = class extends SmrtCollection {
+	static _itemClass = Permission;
+	/**
+	* Find permissions by category
+	*/
+	async findByCategory(category) {
+		return await this.list({
+			where: { category },
+			orderBy: "slug ASC"
+		});
+	}
+	/**
+	* Find permission by slug
+	*/
+	async findBySlug(slug) {
+		const results = await this.list({
+			where: { slug },
+			limit: 1
+		});
+		return results.length > 0 ? results[0] : null;
+	}
+	/**
+	* Batch fetch permissions by IDs
+	* Returns a Map of id -> Permission for efficient lookup
+	*/
+	async findByIds(ids) {
+		if (ids.length === 0) return /* @__PURE__ */ new Map();
+		const uniqueIds = [...new Set(ids)];
+		const placeholders = uniqueIds.map(() => "?").join(", ");
+		const results = await this.query(`SELECT * FROM ${this.tableName} WHERE id IN (${placeholders})`, uniqueIds);
+		const map = /* @__PURE__ */ new Map();
+		for (const perm of results) if (perm.id) map.set(perm.id, perm);
+		return map;
+	}
+	/**
+	* Get all unique categories
+	*/
+	async getCategories() {
+		return (await this.query(`SELECT DISTINCT category FROM ${this.tableName} WHERE category != '' ORDER BY category ASC`)).map((r) => r.category);
+	}
+	/**
+	* Find or create a permission by slug
+	*/
+	async findOrCreate(slug, defaults = {}) {
+		const existing = await this.findBySlug(slug);
+		if (existing) return existing;
+		const permission = await this.create({
+			slug,
+			name: defaults.name ?? slug,
+			description: defaults.description ?? "",
+			category: defaults.category ?? slug.split(".")[0]
+		});
+		await permission.save();
+		return permission;
+	}
+};
+//#endregion
+//#region src/models/RolePermission.ts
+var __defProp$3 = Object.defineProperty;
+var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
+var __decorateClass$3 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$3(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$3(target, key, result);
+	return result;
+};
+var RolePermission = class extends SmrtObject {
+	roleId;
+	permissionId;
+	constructor(options = {}) {
+		super(options);
+		if (options.roleId !== void 0) this.roleId = options.roleId;
+		if (options.permissionId !== void 0) this.permissionId = options.permissionId;
+	}
+};
+__decorateClass$3([foreignKey("Role", { required: true })], RolePermission.prototype, "roleId", 2);
+__decorateClass$3([foreignKey("Permission", { required: true })], RolePermission.prototype, "permissionId", 2);
+RolePermission = __decorateClass$3([smrt({
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: true
+})], RolePermission);
+//#endregion
+//#region src/collections/RolePermissionCollection.ts
+var RolePermissionCollection = class extends SmrtCollection {
+	static _itemClass = RolePermission;
+	/**
+	* Find all permissions for a role
+	*/
+	async findByRole(roleId) {
+		return await this.list({ where: { roleId } });
+	}
+	/**
+	* Find all roles that have a permission
+	*/
+	async findByPermission(permissionId) {
+		return await this.list({ where: { permissionId } });
+	}
+	/**
+	* Check if a role has a specific permission
+	*/
+	async hasPermission(roleId, permissionId) {
+		return (await this.list({
+			where: {
+				roleId,
+				permissionId
+			},
+			limit: 1
+		})).length > 0;
+	}
+	/**
+	* Add a permission to a role
+	*/
+	async addPermission(roleId, permissionId) {
+		const existing = await this.list({
+			where: {
+				roleId,
+				permissionId
+			},
+			limit: 1
+		});
+		if (existing.length > 0) return existing[0];
+		const rolePermission = await this.create({
+			roleId,
+			permissionId
+		});
+		await rolePermission.save();
+		return rolePermission;
+	}
+	/**
+	* Remove a permission from a role
+	*/
+	async removePermission(roleId, permissionId) {
+		const existing = await this.list({
+			where: {
+				roleId,
+				permissionId
+			},
+			limit: 1
+		});
+		if (existing.length === 0) return false;
+		await existing[0].delete();
+		return true;
+	}
+	/**
+	* Get permission IDs for a role
+	*/
+	async getPermissionIds(roleId) {
+		return (await this.findByRole(roleId)).map((rp) => rp.permissionId);
+	}
+};
+//#endregion
+//#region src/models/Session.ts
+var __defProp$2 = Object.defineProperty;
+var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
+var __decorateClass$2 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$2(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$2(target, key, result);
+	return result;
+};
+var DEFAULT_SESSION_TTL = 10080 * 60;
+function generateSessionId() {
+	return crypto.randomUUID();
+}
+var Session = class extends SmrtObject {
+	userId = "";
+	tenantId = null;
+	status = SessionStatus.ACTIVE;
+	/**
+	* Session expiration time
+	*/
+	expiresAt = /* @__PURE__ */ new Date();
+	/**
+	* User agent string from the browser
+	*/
+	userAgent = "";
+	/**
+	* IP address of the client
+	*/
+	ipAddress = "";
+	/**
+	* Last activity timestamp (updated on each request)
+	*/
+	lastAccessedAt = /* @__PURE__ */ new Date();
+	/**
+	* Custom session data (JSON serializable)
+	*/
+	data = {};
+	constructor(options = {}) {
+		super(options);
+		if (options.userId !== void 0) this.userId = options.userId;
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.status !== void 0) this.status = options.status;
+		if (options.expiresAt !== void 0) this.expiresAt = options.expiresAt instanceof Date ? options.expiresAt : new Date(options.expiresAt);
+		if (options.userAgent !== void 0) this.userAgent = options.userAgent;
+		if (options.ipAddress !== void 0) this.ipAddress = options.ipAddress;
+		if (options.lastAccessedAt !== void 0) this.lastAccessedAt = options.lastAccessedAt instanceof Date ? options.lastAccessedAt : new Date(options.lastAccessedAt);
+		if (options.data !== void 0) this.data = options.data;
+	}
+	/**
+	* Check if the session is currently valid (active and not expired)
+	*/
+	isValid() {
+		return this.status === SessionStatus.ACTIVE && /* @__PURE__ */ new Date() < this.expiresAt;
+	}
+	/**
+	* Check if the session has expired
+	*/
+	isExpired() {
+		return /* @__PURE__ */ new Date() >= this.expiresAt;
+	}
+	/**
+	* Check if the session was revoked
+	*/
+	isRevoked() {
+		return this.status === SessionStatus.REVOKED;
+	}
+	/**
+	* Update the last accessed timestamp
+	*/
+	touch() {
+		this.lastAccessedAt = /* @__PURE__ */ new Date();
+	}
+	/**
+	* Extend the session expiration by the given TTL (in seconds)
+	*/
+	extend(ttlSeconds = DEFAULT_SESSION_TTL) {
+		this.expiresAt = new Date(Date.now() + ttlSeconds * 1e3);
+		this.touch();
+	}
+	/**
+	* Revoke the session
+	*/
+	revoke() {
+		this.status = SessionStatus.REVOKED;
+	}
+	/**
+	* Set the tenant context for this session
+	*/
+	setTenant(tenantId) {
+		this.tenantId = tenantId;
+	}
+	/**
+	* Get or set custom session data
+	*/
+	getData(key) {
+		return this.data[key];
+	}
+	/**
+	* Set custom session data
+	*/
+	setData(key, value) {
+		this.data[key] = value;
+	}
+	/**
+	* Remove custom session data
+	*/
+	removeData(key) {
+		delete this.data[key];
+	}
+};
+__decorateClass$2([foreignKey("User")], Session.prototype, "userId", 2);
+__decorateClass$2([foreignKey("Tenant", { nullable: true })], Session.prototype, "tenantId", 2);
+__decorateClass$2([field({ type: "text" })], Session.prototype, "status", 2);
+Session = __decorateClass$2([smrt({
+	api: { include: ["get", "delete"] },
+	mcp: { include: [] },
+	cli: true
+})], Session);
+//#endregion
+//#region src/collections/SessionCollection.ts
+var SessionCollection = class extends SmrtCollection {
+	static _itemClass = Session;
+	/**
+	* Create a new session with a secure ID
+	*/
+	async createSession(options) {
+		const ttl = options.ttl ?? 604800;
+		const expiresAt = new Date(Date.now() + ttl * 1e3);
+		const session = await this.create({
+			id: generateSessionId(),
+			userId: options.userId,
+			tenantId: options.tenantId ?? null,
+			status: SessionStatus.ACTIVE,
+			expiresAt,
+			userAgent: options.userAgent ?? "",
+			ipAddress: options.ipAddress ?? "",
+			lastAccessedAt: /* @__PURE__ */ new Date(),
+			data: options.data ?? {}
+		});
+		await session.save();
+		return session;
+	}
+	/**
+	* Find a valid session by ID
+	* Returns null if session doesn't exist, is expired, or is revoked
+	*/
+	async findValidSession(sessionId) {
+		const session = await this.get(sessionId);
+		if (!session) return null;
+		if (!session.isValid()) {
+			if (session.isExpired() && session.status === SessionStatus.ACTIVE) {
+				const now = (/* @__PURE__ */ new Date()).toISOString();
+				await this.db.query(`UPDATE ${this.tableName}
+           SET status = ?, updated_at = ?
+           WHERE id = ? AND status = ? AND expires_at < ?`, SessionStatus.EXPIRED, now, sessionId, SessionStatus.ACTIVE, now);
+			}
+			return null;
+		}
+		return session;
+	}
+	/**
+	* Update last accessed time and optionally extend session
+	*/
+	async touch(sessionId, extendTtl = false, ttl = DEFAULT_SESSION_TTL) {
+		const session = await this.findValidSession(sessionId);
+		if (!session) return false;
+		session.touch();
+		if (extendTtl) session.extend(ttl);
+		await session.save();
+		return true;
+	}
+	/**
+	* Find all active sessions for a user
+	*/
+	async findByUser(userId) {
+		return (await this.list({
+			where: {
+				userId,
+				status: SessionStatus.ACTIVE
+			},
+			orderBy: "last_accessed_at DESC"
+		})).filter((session) => session.isValid());
+	}
+	/**
+	* Delete all sessions for a user (logout from all devices)
+	*/
+	async deleteUserSessions(userId) {
+		const sessions = await this.list({ where: { userId } });
+		let count = 0;
+		for (const session of sessions) {
+			await session.delete();
+			count++;
+		}
+		return count;
+	}
+	/**
+	* Revoke all sessions for a user (soft delete)
+	*/
+	async revokeUserSessions(userId) {
+		const sessions = await this.list({ where: {
+			userId,
+			status: SessionStatus.ACTIVE
+		} });
+		let count = 0;
+		for (const session of sessions) {
+			session.revoke();
+			await session.save();
+			count++;
+		}
+		return count;
+	}
+	/**
+	* Revoke a specific session
+	*/
+	async revokeSession(sessionId) {
+		const session = await this.get(sessionId);
+		if (!session) return false;
+		session.revoke();
+		await session.save();
+		return true;
+	}
+	/**
+	* Delete expired sessions (cleanup job)
+	* Returns the number of deleted sessions
+	*/
+	async deleteExpired() {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const { rowCount } = await this.db.query(`DELETE FROM ${this.tableName}
+       WHERE expires_at < ? OR status = ?`, now, SessionStatus.REVOKED);
+		return rowCount ?? 0;
+	}
+	/**
+	* Count active sessions for a user
+	*/
+	async countUserSessions(userId) {
+		return (await this.findByUser(userId)).length;
+	}
+	/**
+	* Update tenant context for a session (low-level primitive).
+	*
+	* SECURITY (#1400): this does NOT verify that the session's user is a member
+	* of `tenantId` — it is the unguarded storage primitive. Application/route
+	* code must go through {@link SessionService.switchTenant}, which fail-closes
+	* on a missing/inactive membership before calling this. Calling it directly
+	* with an untrusted `tenantId` reintroduces the cross-tenant access bug.
+	*/
+	async setSessionTenant(sessionId, tenantId) {
+		const session = await this.findValidSession(sessionId);
+		if (!session) return false;
+		session.setTenant(tenantId);
+		await session.save();
+		return true;
+	}
+	/**
+	* Set custom session data
+	*/
+	async setSessionData(sessionId, key, value) {
+		const session = await this.findValidSession(sessionId);
+		if (!session) return false;
+		session.setData(key, value);
+		await session.save();
+		return true;
+	}
+	/**
+	* Get custom session data
+	*/
+	async getSessionData(sessionId, key) {
+		const session = await this.findValidSession(sessionId);
+		if (!session) return void 0;
+		return session.getData(key);
+	}
+};
+//#endregion
+//#region src/models/Tenant.ts
+var __defProp$1 = Object.defineProperty;
+var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __decorateClass$1 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$1(target, key, result);
+	return result;
+};
+var MAX_TENANT_HIERARCHY_DEPTH = 10;
+var Tenant = class extends SmrtObject {
+	/**
+	* Display name for the tenant
+	*/
+	name = "";
+	status = TenantStatus.ACTIVE;
+	/**
+	* Optional description
+	*/
+	description = "";
+	parentTenantId;
+	/**
+	* Depth in the hierarchy tree (0 = root, 1 = first level child, etc.)
+	* Automatically managed by TenantCollection methods.
+	*/
+	hierarchyLevel = 0;
+	/**
+	* Materialized path for efficient tree traversal.
+	* Format: "ancestor-id/parent-id" (path to parent; does not include this tenant's id)
+	* Empty string for root tenants.
+	* Automatically managed by TenantCollection methods.
+	*/
+	hierarchyPath = "";
+	/**
+	* If true, this tenant's permissions cascade DOWN to child tenants.
+	* Children can still opt-out by setting inheritPermissions: false.
+	* Default: true
+	*/
+	cascadePermissions = true;
+	/**
+	* If true, this tenant ACCEPTS permissions from its parent tenant.
+	* Parent must also have cascadePermissions: true for inheritance to work.
+	* Default: true
+	*/
+	inheritPermissions = true;
+	constructor(options = {}) {
+		super(options);
+		if (options.name !== void 0) this.name = options.name;
+		if (options.status !== void 0) this.status = options.status;
+		if (options.description !== void 0) this.description = options.description;
+		if (options.parentTenantId !== void 0) this.parentTenantId = options.parentTenantId;
+		if (options.hierarchyLevel !== void 0) this.hierarchyLevel = options.hierarchyLevel;
+		if (options.hierarchyPath !== void 0) this.hierarchyPath = options.hierarchyPath;
+		if (options.cascadePermissions !== void 0) this.cascadePermissions = options.cascadePermissions;
+		if (options.inheritPermissions !== void 0) this.inheritPermissions = options.inheritPermissions;
+	}
+	/**
+	* Check if tenant is active
+	*/
+	isActive() {
+		return this.status === TenantStatus.ACTIVE;
+	}
+	/**
+	* Check if tenant is suspended
+	*/
+	isSuspended() {
+		return this.status === TenantStatus.SUSPENDED;
+	}
+	/**
+	* Check if this is a root-level tenant (no parent)
+	*/
+	isRoot() {
+		return !this.parentTenantId;
+	}
+	/**
+	* Check if this tenant is configured to cascade permissions to children.
+	*
+	* Note: This does NOT indicate whether any child tenants actually exist.
+	* Use TenantCollection.findChildren() for accurate child lookup.
+	*/
+	canCascadeToChildren() {
+		return this.cascadePermissions;
+	}
+	/**
+	* Check if permission inheritance is active for this tenant.
+	* Inheritance is active if:
+	* - This tenant has a parent AND
+	* - This tenant has inheritPermissions: true
+	*
+	* Note: The parent must also have cascadePermissions: true
+	* for actual inheritance to occur. Use PermissionResolver
+	* for accurate permission calculation.
+	*/
+	acceptsInheritance() {
+		return !!this.parentTenantId && this.inheritPermissions;
+	}
+	/**
+	* Get ancestor IDs from the hierarchy path.
+	* Returns an array of tenant IDs from root to immediate parent.
+	* Empty array for root tenants.
+	*/
+	getAncestorIds() {
+		if (!this.hierarchyPath) return [];
+		return this.hierarchyPath.split("/").filter((id) => id.length > 0);
+	}
+};
+__decorateClass$1([field({ type: "text" })], Tenant.prototype, "status", 2);
+__decorateClass$1([foreignKey("Tenant", { nullable: true })], Tenant.prototype, "parentTenantId", 2);
+Tenant = __decorateClass$1([smrt({
+	tableStrategy: "sti",
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: true
+})], Tenant);
+//#endregion
+//#region src/collections/TenantCollection.ts
+var TenantHierarchyError = class extends Error {
+	constructor(message, code) {
+		super(message);
+		this.code = code;
+		this.name = "TenantHierarchyError";
+	}
+	code;
+};
+var TenantCollection = class extends SmrtCollection {
+	static _itemClass = Tenant;
+	/**
+	* Find tenants by status
+	*/
+	async findByStatus(status) {
+		return await this.list({
+			where: { status },
+			orderBy: "name ASC"
+		});
+	}
+	/**
+	* Find all active tenants
+	*/
+	async findActive() {
+		return await this.findByStatus(TenantStatus.ACTIVE);
+	}
+	/**
+	* Find tenant by slug
+	*/
+	async findBySlug(slug) {
+		const results = await this.list({
+			where: { slug },
+			limit: 1
+		});
+		return results.length > 0 ? results[0] : null;
+	}
+	/**
+	* Find all root tenants (tenants with no parent)
+	*/
+	async findRoots() {
+		return await this.list({
+			where: { parentTenantId: null },
+			orderBy: "name ASC"
+		});
+	}
+	/**
+	* Find direct children of a tenant
+	*/
+	async findChildren(parentTenantId) {
+		return await this.list({
+			where: { parentTenantId },
+			orderBy: "name ASC"
+		});
+	}
+	/**
+	* Find the parent tenant of a given tenant
+	*/
+	async findParent(tenantId) {
+		const tenant = await this.get({ id: tenantId });
+		if (!tenant || !tenant.parentTenantId) return null;
+		return await this.get({ id: tenant.parentTenantId });
+	}
+	/**
+	* Get all ancestors of a tenant, from immediate parent to root.
+	* Uses the hierarchyPath for efficient lookup.
+	*/
+	async getAncestors(tenantId) {
+		const tenant = await this.get({ id: tenantId });
+		if (!tenant) return [];
+		const ancestorIds = tenant.getAncestorIds();
+		if (ancestorIds.length === 0) return [];
+		const ancestorsList = await this.listByIds(ancestorIds);
+		const ancestorsMap = new Map(ancestorsList.map((a) => [a.id, a]));
+		const ancestors = [];
+		for (let i = ancestorIds.length - 1; i >= 0; i--) {
+			const ancestor = ancestorsMap.get(ancestorIds[i]);
+			if (ancestor) ancestors.push(ancestor);
+		}
+		return ancestors;
+	}
+	/**
+	* Get all ancestors in order from root to immediate parent.
+	* Reverse of getAncestors.
+	*/
+	async getAncestorsFromRoot(tenantId) {
+		return (await this.getAncestors(tenantId)).reverse();
+	}
+	/**
+	* Get all descendants of a tenant (all children, grandchildren, etc.)
+	* Uses hierarchyPath prefix matching for efficient lookup.
+	*/
+	async getDescendants(tenantId) {
+		const tenant = await this.get({ id: tenantId });
+		if (!tenant || !tenant.id) return [];
+		const pathPrefix = tenant.hierarchyPath ? `${tenant.hierarchyPath}/${tenant.id}` : tenant.id;
+		return (await this.list({ where: { "hierarchyPath like": `${pathPrefix}%` } })).filter((t) => t.hierarchyPath === pathPrefix || t.hierarchyPath?.startsWith(`${pathPrefix}/`));
+	}
+	/**
+	* Get siblings of a tenant (other tenants with the same parent)
+	*/
+	async getSiblings(tenantId) {
+		const tenant = await this.get({ id: tenantId });
+		if (!tenant) return [];
+		return (await this.list({
+			where: { parentTenantId: tenant.parentTenantId ?? null },
+			orderBy: "name ASC"
+		})).filter((s) => s.id !== tenantId);
+	}
+	/**
+	* Check if a tenant is an ancestor of another tenant
+	*/
+	async isAncestorOf(potentialAncestorId, tenantId) {
+		const tenant = await this.get({ id: tenantId });
+		if (!tenant) return false;
+		return tenant.getAncestorIds().includes(potentialAncestorId);
+	}
+	/**
+	* Check if a tenant is a descendant of another tenant
+	*/
+	async isDescendantOf(potentialDescendantId, tenantId) {
+		return await this.isAncestorOf(tenantId, potentialDescendantId);
+	}
+	/**
+	* Create a child tenant under a parent.
+	* Automatically sets hierarchyLevel and hierarchyPath.
+	*/
+	async createChild(parentTenantId, options) {
+		const parent = await this.get({ id: parentTenantId });
+		if (!parent?.id) throw new TenantHierarchyError(`Parent tenant not found: ${parentTenantId}`, "PARENT_NOT_FOUND");
+		const newLevel = parent.hierarchyLevel + 1;
+		if (newLevel >= 10) throw new TenantHierarchyError(`Maximum hierarchy depth (10) exceeded`, "MAX_DEPTH_EXCEEDED");
+		const newPath = parent.hierarchyPath ? `${parent.hierarchyPath}/${parent.id}` : parent.id;
+		const child = await this.create({
+			name: options.name,
+			slug: options.slug,
+			description: options.description ?? "",
+			status: options.status ?? TenantStatus.ACTIVE,
+			parentTenantId,
+			hierarchyLevel: newLevel,
+			hierarchyPath: newPath,
+			cascadePermissions: options.cascadePermissions ?? true,
+			inheritPermissions: options.inheritPermissions ?? true
+		});
+		await child.save();
+		return child;
+	}
+	/**
+	* Move a tenant to a new parent.
+	* Updates hierarchyLevel and hierarchyPath for the tenant and all descendants.
+	*/
+	async moveToParent(tenantId, newParentId) {
+		const tenant = await this.get({ id: tenantId });
+		if (!tenant || !tenant.id) throw new TenantHierarchyError(`Tenant not found: ${tenantId}`, "INVALID_OPERATION");
+		if (newParentId === tenantId) throw new TenantHierarchyError("Cannot move tenant to itself", "CIRCULAR_REFERENCE");
+		if (newParentId) {
+			if (await this.isDescendantOf(newParentId, tenantId)) throw new TenantHierarchyError("Cannot move tenant to one of its descendants", "CIRCULAR_REFERENCE");
+		}
+		const descendants = await this.getDescendants(tenantId);
+		let newLevel;
+		let newPath;
+		if (newParentId === null) {
+			newLevel = 0;
+			newPath = "";
+		} else {
+			const newParent = await this.get({ id: newParentId });
+			if (!newParent) throw new TenantHierarchyError(`New parent tenant not found: ${newParentId}`, "PARENT_NOT_FOUND");
+			newLevel = newParent.hierarchyLevel + 1;
+			const maxDescendantDepth = descendants.reduce((max, d) => Math.max(max, d.hierarchyLevel - tenant.hierarchyLevel), 0);
+			if (newLevel + maxDescendantDepth >= 10) throw new TenantHierarchyError(`Moving would exceed maximum hierarchy depth (10)`, "MAX_DEPTH_EXCEEDED");
+			newPath = newParent.hierarchyPath ? `${newParent.hierarchyPath}/${newParent.id}` : newParent.id;
+		}
+		const oldPath = tenant.hierarchyPath ? `${tenant.hierarchyPath}/${tenant.id}` : tenant.id;
+		const newPathForDescendants = newPath ? `${newPath}/${tenant.id}` : tenant.id;
+		const levelDelta = newLevel - tenant.hierarchyLevel;
+		tenant.parentTenantId = newParentId;
+		tenant.hierarchyLevel = newLevel;
+		tenant.hierarchyPath = newPath;
+		await tenant.save();
+		for (const descendant of descendants) {
+			if (!descendant.hierarchyPath) throw new TenantHierarchyError(`Descendant tenant ${descendant.id} has no hierarchyPath while updating hierarchy from ${oldPath} to ${newPathForDescendants}`, "INVALID_OPERATION");
+			if (!descendant.hierarchyPath.startsWith(oldPath)) throw new TenantHierarchyError(`Descendant tenant ${descendant.id} has hierarchyPath "${descendant.hierarchyPath}" which does not start with expected prefix "${oldPath}"`, "INVALID_OPERATION");
+			descendant.hierarchyPath = newPathForDescendants + descendant.hierarchyPath.substring(oldPath.length);
+			descendant.hierarchyLevel += levelDelta;
+			await descendant.save();
+		}
+		return tenant;
+	}
+	/**
+	* Make a tenant a root tenant (remove from hierarchy)
+	*/
+	async makeRoot(tenantId) {
+		return await this.moveToParent(tenantId, null);
+	}
+	/**
+	* Validate that a tenant hierarchy is consistent.
+	* Returns validation errors if any.
+	*/
+	async validateHierarchy(tenantId) {
+		const errors = [];
+		const tenant = await this.get({ id: tenantId });
+		if (!tenant) return [`Tenant not found: ${tenantId}`];
+		if (tenant.parentTenantId) {
+			const parent = await this.get({ id: tenant.parentTenantId });
+			if (!parent) errors.push(`Parent tenant not found: ${tenant.parentTenantId}`);
+			else {
+				if (tenant.hierarchyLevel !== parent.hierarchyLevel + 1) errors.push(`Hierarchy level mismatch: expected ${parent.hierarchyLevel + 1}, got ${tenant.hierarchyLevel}`);
+				const expectedPath = parent.hierarchyPath ? `${parent.hierarchyPath}/${parent.id}` : parent.id;
+				if (tenant.hierarchyPath !== expectedPath) errors.push(`Hierarchy path mismatch: expected "${expectedPath}", got "${tenant.hierarchyPath}"`);
+			}
+		} else {
+			if (tenant.hierarchyLevel !== 0) errors.push(`Root tenant should have hierarchyLevel 0, got ${tenant.hierarchyLevel}`);
+			if (tenant.hierarchyPath !== "") errors.push(`Root tenant should have empty hierarchyPath, got "${tenant.hierarchyPath}"`);
+		}
+		if (tenant.parentTenantId && tenant.id) {
+			if (tenant.getAncestorIds().includes(tenant.id)) errors.push("Circular reference detected in hierarchy");
+		}
+		return errors;
+	}
+	/**
+	* Get the full hierarchy tree starting from a tenant.
+	* Returns a nested structure useful for UI rendering.
+	*/
+	async getTree(rootTenantId) {
+		const roots = rootTenantId ? [await this.get({ id: rootTenantId })] : await this.findRoots();
+		const buildTree = async (tenant) => {
+			if (!tenant) return null;
+			const children = await this.findChildren(tenant.id);
+			const childTrees = await Promise.all(children.map(buildTree));
+			return Object.assign(tenant, { children: childTrees.filter(Boolean) });
+		};
+		return (await Promise.all(roots.map(buildTree))).filter(Boolean);
+	}
+	/**
+	* Override create to automatically set hierarchy fields for new tenants.
+	* Only calculates them when the caller hasn't already supplied
+	* `hierarchyLevel`/`hierarchyPath` in the create input — an explicitly
+	* provided value is preserved as-is.
+	*/
+	async create(options) {
+		if (options.parentTenantId) {
+			if (options.hierarchyLevel === void 0 || options.hierarchyPath === void 0) {
+				const parent = await this.get({ id: options.parentTenantId });
+				if (!parent?.id) throw new TenantHierarchyError(`Parent tenant not found: ${options.parentTenantId}`, "PARENT_NOT_FOUND");
+				const newLevel = parent.hierarchyLevel + 1;
+				if (newLevel >= 10) throw new TenantHierarchyError(`Maximum hierarchy depth (10) exceeded`, "MAX_DEPTH_EXCEEDED");
+				if (options.hierarchyLevel === void 0) options.hierarchyLevel = newLevel;
+				if (options.hierarchyPath === void 0) options.hierarchyPath = parent.hierarchyPath ? `${parent.hierarchyPath}/${parent.id}` : parent.id;
+			}
+		} else {
+			options.hierarchyLevel = options.hierarchyLevel ?? 0;
+			options.hierarchyPath = options.hierarchyPath ?? "";
+		}
+		return super.create(options);
+	}
+};
+//#endregion
+//#region src/models/TenantPermissionOverride.ts
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp(target, key, result);
+	return result;
+};
+var TenantPermissionOverride = class extends SmrtObject {
+	tenantId;
+	permissionId;
+	effect = TenantPermissionEffect.INHERIT;
+	constructor(options = {}) {
+		super(options);
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.permissionId !== void 0) this.permissionId = options.permissionId;
+		if (options.effect !== void 0) this.effect = options.effect;
+	}
+	/**
+	* Check if this override inherits from parent
+	*/
+	isInherit() {
+		return this.effect === TenantPermissionEffect.INHERIT;
+	}
+	/**
+	* Check if this override grants the permission
+	*/
+	isGrant() {
+		return this.effect === TenantPermissionEffect.GRANT;
+	}
+	/**
+	* Check if this override denies the permission
+	*/
+	isDeny() {
+		return this.effect === TenantPermissionEffect.DENY;
+	}
+	/**
+	* Check if this override has an explicit effect (not inherit)
+	*/
+	hasExplicitEffect() {
+		return this.effect !== TenantPermissionEffect.INHERIT;
+	}
+};
+__decorateClass([foreignKey("Tenant", { required: true })], TenantPermissionOverride.prototype, "tenantId", 2);
+__decorateClass([foreignKey("Permission", { required: true })], TenantPermissionOverride.prototype, "permissionId", 2);
+__decorateClass([field({ type: "text" })], TenantPermissionOverride.prototype, "effect", 2);
+TenantPermissionOverride = __decorateClass([smrt({
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: true
+})], TenantPermissionOverride);
+//#endregion
+//#region src/collections/TenantPermissionOverrideCollection.ts
+var TenantPermissionOverrideCollection = class extends SmrtCollection {
+	static _itemClass = TenantPermissionOverride;
+	/**
+	* Find all overrides for a tenant
+	*/
+	async findByTenant(tenantId) {
+		return await this.list({ where: { tenantId } });
+	}
+	/**
+	* Find grant overrides for a tenant.
+	*
+	* Filters in memory because the `effect` column is JSON-typed and
+	* Postgres rejects bare `json = text` comparisons.  A single
+	* `findByTenant` call is reused for grant, deny, and inherit lookups.
+	*/
+	async findGrants(tenantId) {
+		return (await this.findByTenant(tenantId)).filter((o) => o.effect === TenantPermissionEffect.GRANT);
+	}
+	/**
+	* Find deny overrides for a tenant.
+	*
+	* See `findGrants` for rationale on in-memory filtering.
+	*/
+	async findDenies(tenantId) {
+		return (await this.findByTenant(tenantId)).filter((o) => o.effect === TenantPermissionEffect.DENY);
+	}
+	/**
+	* Find inherit overrides for a tenant.
+	*
+	* See `findGrants` for rationale on in-memory filtering.
+	*/
+	async findInherits(tenantId) {
+		return (await this.findByTenant(tenantId)).filter((o) => o.effect === TenantPermissionEffect.INHERIT);
+	}
+	/**
+	* Get granted permission IDs for a tenant
+	*/
+	async getGrantedPermissionIds(tenantId) {
+		return (await this.findGrants(tenantId)).map((o) => o.permissionId);
+	}
+	/**
+	* Get denied permission IDs for a tenant
+	*/
+	async getDeniedPermissionIds(tenantId) {
+		return (await this.findDenies(tenantId)).map((o) => o.permissionId);
+	}
+	/**
+	* Get all overrides for a tenant, organized by effect
+	*/
+	async getOverridesByEffect(tenantId) {
+		const overrides = await this.findByTenant(tenantId);
+		const result = {
+			grantedPermissionIds: [],
+			deniedPermissionIds: [],
+			inheritedPermissionIds: []
+		};
+		for (const override of overrides) {
+			const permId = override.permissionId;
+			switch (override.effect) {
+				case TenantPermissionEffect.GRANT:
+					result.grantedPermissionIds.push(permId);
+					break;
+				case TenantPermissionEffect.DENY:
+					result.deniedPermissionIds.push(permId);
+					break;
+				case TenantPermissionEffect.INHERIT:
+					result.inheritedPermissionIds.push(permId);
+					break;
+			}
+		}
+		return result;
+	}
+	/**
+	* Batch get all overrides for multiple tenants, organized by effect.
+	* Fetches all overrides in a single query to avoid N+1 query problem.
+	*
+	* @param tenantIds - Array of tenant IDs to fetch overrides for
+	* @returns Map of tenant ID to their permission override results
+	*/
+	async getOverridesByEffectBatch(tenantIds) {
+		const resultMap = /* @__PURE__ */ new Map();
+		for (const tenantId of tenantIds) resultMap.set(tenantId, {
+			grantedPermissionIds: [],
+			deniedPermissionIds: [],
+			inheritedPermissionIds: []
+		});
+		if (tenantIds.length === 0) return resultMap;
+		const allOverrides = await this.list({ where: { tenantId: tenantIds } });
+		for (const override of allOverrides) {
+			const tenantId = override.tenantId;
+			const permId = override.permissionId;
+			const result = resultMap.get(tenantId);
+			if (result) switch (override.effect) {
+				case TenantPermissionEffect.GRANT:
+					result.grantedPermissionIds.push(permId);
+					break;
+				case TenantPermissionEffect.DENY:
+					result.deniedPermissionIds.push(permId);
+					break;
+				case TenantPermissionEffect.INHERIT:
+					result.inheritedPermissionIds.push(permId);
+					break;
+			}
+		}
+		return resultMap;
+	}
+	/**
+	* Set an override for a tenant permission
+	*/
+	async setOverride(tenantId, permissionId, effect) {
+		const existing = await this.list({
+			where: {
+				tenantId,
+				permissionId
+			},
+			limit: 1
+		});
+		if (existing.length > 0) {
+			existing[0].effect = effect;
+			await existing[0].save();
+			return existing[0];
+		}
+		const override = await this.create({
+			tenantId,
+			permissionId,
+			effect
+		});
+		await override.save();
+		return override;
+	}
+	/**
+	* Remove an override (permission will use default behavior)
+	*/
+	async removeOverride(tenantId, permissionId) {
+		const existing = await this.list({
+			where: {
+				tenantId,
+				permissionId
+			},
+			limit: 1
+		});
+		if (existing.length === 0) return false;
+		await existing[0].delete();
+		return true;
+	}
+	/**
+	* Remove all overrides for a tenant
+	*/
+	async removeAllOverrides(tenantId) {
+		const overrides = await this.findByTenant(tenantId);
+		await Promise.all(overrides.map((override) => override.delete()));
+		return overrides.length;
+	}
+	/**
+	* Grant a permission at the tenant level.
+	* Convenience method for setOverride with GRANT effect.
+	*/
+	async grantPermission(tenantId, permissionId) {
+		return await this.setOverride(tenantId, permissionId, TenantPermissionEffect.GRANT);
+	}
+	/**
+	* Deny a permission at the tenant level.
+	* Convenience method for setOverride with DENY effect.
+	* This blocks inheritance from parent tenants.
+	*/
+	async denyPermission(tenantId, permissionId) {
+		return await this.setOverride(tenantId, permissionId, TenantPermissionEffect.DENY);
+	}
+	/**
+	* Set a permission to inherit from parent.
+	* Convenience method for setOverride with INHERIT effect.
+	* This is the default behavior, so mainly useful to document intent
+	* or to reset a previous grant/deny.
+	*/
+	async inheritPermission(tenantId, permissionId) {
+		return await this.setOverride(tenantId, permissionId, TenantPermissionEffect.INHERIT);
+	}
+	/**
+	* Bulk set overrides for a tenant.
+	* Useful for importing or copying permission configurations.
+	*/
+	async bulkSetOverrides(tenantId, overrides) {
+		const results = [];
+		for (const { permissionId, effect } of overrides) {
+			const override = await this.setOverride(tenantId, permissionId, effect);
+			results.push(override);
+		}
+		return results;
+	}
+	/**
+	* Copy overrides from one tenant to another.
+	* Useful when creating child tenants or templates.
+	*/
+	async copyOverrides(fromTenantId, toTenantId) {
+		const sourceOverrides = await this.findByTenant(fromTenantId);
+		const results = [];
+		for (const source of sourceOverrides) {
+			const override = await this.setOverride(toTenantId, source.permissionId, source.effect);
+			results.push(override);
+		}
+		return results;
+	}
+};
+//#endregion
+//#region src/collections/UserCollection.ts
+var UserCollection = class extends SmrtCollection {
+	static _itemClass = User;
+	/**
+	* Find user by email address
+	*/
+	async findByEmail(email) {
+		const results = await this.list({
+			where: { email },
+			limit: 1
+		});
+		return results.length > 0 ? results[0] : null;
+	}
+	/**
+	* Find user by profile ID
+	*/
+	async findByProfile(profileId) {
+		const results = await this.list({
+			where: { profileId },
+			limit: 1
+		});
+		return results.length > 0 ? results[0] : null;
+	}
+	/**
+	* Find users by status
+	*/
+	async findByStatus(status) {
+		return await this.list({
+			where: { status },
+			orderBy: "created_at DESC"
+		});
+	}
+	/**
+	* Find all active users
+	*/
+	async findActive() {
+		return await this.findByStatus(UserStatus.ACTIVE);
+	}
+	/**
+	* Find all pending users
+	*/
+	async findPending() {
+		return await this.findByStatus(UserStatus.PENDING);
+	}
+	/**
+	* Get or create user for a profile
+	*/
+	async getOrCreateForProfile(profileId, email, defaults = {}) {
+		const existing = await this.findByProfile(profileId);
+		if (existing) return existing;
+		const user = await this.create({
+			profileId,
+			email,
+			status: defaults.status ?? UserStatus.ACTIVE
+		});
+		await user.save();
+		return user;
+	}
+	/**
+	* Get or create user from OIDC claims
+	*
+	* This is the primary method for resolving identity from an OIDC login.
+	* It handles the full flow:
+	* 1. Find or create Profile from OIDC claims (via smrt-profiles)
+	* 2. Link OidcIdentity to the Profile
+	* 3. Find or create User linked to the Profile
+	*
+	* @param claims - OIDC token claims (sub, iss, email, name)
+	* @param provider - Provider name (e.g., 'kanidm', 'keycloak', 'google')
+	* @param options - Optional settings (recordLogin)
+	* @returns User, Profile, OidcIdentity, and whether profile was created
+	*
+	* @example
+	* ```typescript
+	* const userCollection = await UserCollection.create({ db: dbConfig });
+	*
+	* // In your OIDC callback handler:
+	* const { user, profile } = await userCollection.getOrCreateFromOidc(
+	*   {
+	*     sub: tokenClaims.sub,
+	*     iss: tokenClaims.iss,
+	*     email: tokenClaims.email,
+	*     name: tokenClaims.name,
+	*   },
+	*   'kanidm'
+	* );
+	*
+	* // User and profile are now available
+	* // Login was auto-recorded; pass { recordLogin: false } to skip
+	* ```
+	*/
+	async getOrCreateFromOidc(claims, provider, options) {
+		const sub = claims?.sub?.trim();
+		const iss = claims?.iss?.trim();
+		if (!sub || !iss) throw new Error("Invalid OIDC claims: both \"sub\" and \"iss\" must be non-empty strings.");
+		if (!claims.email) throw new Error("OIDC claims missing required \"email\" for user creation.");
+		const allowUnverified = options?.allowUnverifiedEmail === true;
+		if (claims.email_verified === false && !allowUnverified) throw new Error("OIDC claims report an unverified email; refusing to provision a user.");
+		const { createProfileFromOidc } = await import("@happyvertical/smrt-profiles");
+		const { profile, oidcIdentity, created } = await createProfileFromOidc(claims, provider, { db: this.options.db });
+		const shouldRecordLogin = options?.recordLogin !== false;
+		const existingUser = await this.findByProfile(profile.id);
+		const user = existingUser ?? await this.create({
+			email: claims.email,
+			...shouldRecordLogin ? { lastLoginAt: /* @__PURE__ */ new Date() } : {},
+			profileId: profile.id,
+			status: UserStatus.ACTIVE
+		});
+		if (existingUser && shouldRecordLogin) {
+			existingUser.recordLogin();
+			await existingUser.save();
+		}
+		return {
+			user,
+			profile,
+			oidcIdentity,
+			created
+		};
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/buffer_utils.js
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function concat(...buffers) {
+	const size = buffers.reduce((acc, { length }) => acc + length, 0);
+	const buf = new Uint8Array(size);
+	let i = 0;
+	for (const buffer of buffers) {
+		buf.set(buffer, i);
+		i += buffer.length;
+	}
+	return buf;
+}
+function encode$1(string) {
+	const bytes = new Uint8Array(string.length);
+	for (let i = 0; i < string.length; i++) {
+		const code = string.charCodeAt(i);
+		if (code > 127) throw new TypeError("non-ASCII string encountered in encode()");
+		bytes[i] = code;
+	}
+	return bytes;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/base64.js
+function encodeBase64(input) {
+	if (Uint8Array.prototype.toBase64) return input.toBase64();
+	const CHUNK_SIZE = 32768;
+	const arr = [];
+	for (let i = 0; i < input.length; i += CHUNK_SIZE) arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+	return btoa(arr.join(""));
+}
+function decodeBase64(encoded) {
+	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(encoded);
+	const binary = atob(encoded);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/util/base64url.js
+function decode(input) {
+	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), { alphabet: "base64url" });
+	let encoded = input;
+	if (encoded instanceof Uint8Array) encoded = decoder.decode(encoded);
+	encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+	try {
+		return decodeBase64(encoded);
+	} catch {
+		throw new TypeError("The input to be decoded is not correctly encoded.");
+	}
+}
+function encode(input) {
+	let unencoded = input;
+	if (typeof unencoded === "string") unencoded = encoder.encode(unencoded);
+	if (Uint8Array.prototype.toBase64) return unencoded.toBase64({
+		alphabet: "base64url",
+		omitPadding: true
+	});
+	return encodeBase64(unencoded).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/crypto_key.js
+var unusable = (name, prop = "algorithm.name") => /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+var isAlgorithm = (algorithm, name) => algorithm.name === name;
+function getHashLength(hash) {
+	return parseInt(hash.name.slice(4), 10);
+}
+function checkHashLength(algorithm, expected) {
+	if (getHashLength(algorithm.hash) !== expected) throw unusable(`SHA-${expected}`, "algorithm.hash");
+}
+function getNamedCurve(alg) {
+	switch (alg) {
+		case "ES256": return "P-256";
+		case "ES384": return "P-384";
+		case "ES512": return "P-521";
+		default: throw new Error("unreachable");
+	}
+}
+function checkUsage(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkSigCryptoKey(key, alg, usage) {
+	switch (alg) {
+		case "HS256":
+		case "HS384":
+		case "HS512":
+			if (!isAlgorithm(key.algorithm, "HMAC")) throw unusable("HMAC");
+			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
+			break;
+		case "RS256":
+		case "RS384":
+		case "RS512":
+			if (!isAlgorithm(key.algorithm, "RSASSA-PKCS1-v1_5")) throw unusable("RSASSA-PKCS1-v1_5");
+			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
+			break;
+		case "PS256":
+		case "PS384":
+		case "PS512":
+			if (!isAlgorithm(key.algorithm, "RSA-PSS")) throw unusable("RSA-PSS");
+			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
+			break;
+		case "Ed25519":
+		case "EdDSA":
+			if (!isAlgorithm(key.algorithm, "Ed25519")) throw unusable("Ed25519");
+			break;
+		case "ML-DSA-44":
+		case "ML-DSA-65":
+		case "ML-DSA-87":
+			if (!isAlgorithm(key.algorithm, alg)) throw unusable(alg);
+			break;
+		case "ES256":
+		case "ES384":
+		case "ES512": {
+			if (!isAlgorithm(key.algorithm, "ECDSA")) throw unusable("ECDSA");
+			const expected = getNamedCurve(alg);
+			if (key.algorithm.namedCurve !== expected) throw unusable(expected, "algorithm.namedCurve");
+			break;
+		}
+		default: throw new TypeError("CryptoKey does not support this operation");
+	}
+	checkUsage(key, usage);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/invalid_key_input.js
+function message(msg, actual, ...types) {
+	types = types.filter(Boolean);
+	if (types.length > 2) {
+		const last = types.pop();
+		msg += `one of type ${types.join(", ")}, or ${last}.`;
+	} else if (types.length === 2) msg += `one of type ${types[0]} or ${types[1]}.`;
+	else msg += `of type ${types[0]}.`;
+	if (actual == null) msg += ` Received ${actual}`;
+	else if (typeof actual === "function" && actual.name) msg += ` Received function ${actual.name}`;
+	else if (typeof actual === "object" && actual != null) {
+		if (actual.constructor?.name) msg += ` Received an instance of ${actual.constructor.name}`;
+	}
+	return msg;
+}
+var invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
+var withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/util/errors.js
+var errors_exports = /* @__PURE__ */ __exportAll({
+	JOSEAlgNotAllowed: () => JOSEAlgNotAllowed,
+	JOSEError: () => JOSEError,
+	JOSENotSupported: () => JOSENotSupported,
+	JWEDecryptionFailed: () => JWEDecryptionFailed,
+	JWEInvalid: () => JWEInvalid,
+	JWKInvalid: () => JWKInvalid,
+	JWKSInvalid: () => JWKSInvalid,
+	JWKSMultipleMatchingKeys: () => JWKSMultipleMatchingKeys,
+	JWKSNoMatchingKey: () => JWKSNoMatchingKey,
+	JWKSTimeout: () => JWKSTimeout,
+	JWSInvalid: () => JWSInvalid,
+	JWSSignatureVerificationFailed: () => JWSSignatureVerificationFailed,
+	JWTClaimValidationFailed: () => JWTClaimValidationFailed,
+	JWTExpired: () => JWTExpired,
+	JWTInvalid: () => JWTInvalid
+});
+var JOSEError = class extends Error {
+	static code = "ERR_JOSE_GENERIC";
+	code = "ERR_JOSE_GENERIC";
+	constructor(message, options) {
+		super(message, options);
+		this.name = this.constructor.name;
+		Error.captureStackTrace?.(this, this.constructor);
+	}
+};
+var JWTClaimValidationFailed = class extends JOSEError {
+	static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+	code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+	claim;
+	reason;
+	payload;
+	constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+		super(message, { cause: {
+			claim,
+			reason,
+			payload
+		} });
+		this.claim = claim;
+		this.reason = reason;
+		this.payload = payload;
+	}
+};
+var JWTExpired = class extends JOSEError {
+	static code = "ERR_JWT_EXPIRED";
+	code = "ERR_JWT_EXPIRED";
+	claim;
+	reason;
+	payload;
+	constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+		super(message, { cause: {
+			claim,
+			reason,
+			payload
+		} });
+		this.claim = claim;
+		this.reason = reason;
+		this.payload = payload;
+	}
+};
+var JOSEAlgNotAllowed = class extends JOSEError {
+	static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+	code = "ERR_JOSE_ALG_NOT_ALLOWED";
+};
+var JOSENotSupported = class extends JOSEError {
+	static code = "ERR_JOSE_NOT_SUPPORTED";
+	code = "ERR_JOSE_NOT_SUPPORTED";
+};
+var JWEDecryptionFailed = class extends JOSEError {
+	static code = "ERR_JWE_DECRYPTION_FAILED";
+	code = "ERR_JWE_DECRYPTION_FAILED";
+	constructor(message = "decryption operation failed", options) {
+		super(message, options);
+	}
+};
+var JWEInvalid = class extends JOSEError {
+	static code = "ERR_JWE_INVALID";
+	code = "ERR_JWE_INVALID";
+};
+var JWSInvalid = class extends JOSEError {
+	static code = "ERR_JWS_INVALID";
+	code = "ERR_JWS_INVALID";
+};
+var JWTInvalid = class extends JOSEError {
+	static code = "ERR_JWT_INVALID";
+	code = "ERR_JWT_INVALID";
+};
+var JWKInvalid = class extends JOSEError {
+	static code = "ERR_JWK_INVALID";
+	code = "ERR_JWK_INVALID";
+};
+var JWKSInvalid = class extends JOSEError {
+	static code = "ERR_JWKS_INVALID";
+	code = "ERR_JWKS_INVALID";
+};
+var JWKSNoMatchingKey = class extends JOSEError {
+	static code = "ERR_JWKS_NO_MATCHING_KEY";
+	code = "ERR_JWKS_NO_MATCHING_KEY";
+	constructor(message = "no applicable key found in the JSON Web Key Set", options) {
+		super(message, options);
+	}
+};
+var JWKSMultipleMatchingKeys = class extends JOSEError {
+	[Symbol.asyncIterator];
+	static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+	code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+	constructor(message = "multiple matching keys found in the JSON Web Key Set", options) {
+		super(message, options);
+	}
+};
+var JWKSTimeout = class extends JOSEError {
+	static code = "ERR_JWKS_TIMEOUT";
+	code = "ERR_JWKS_TIMEOUT";
+	constructor(message = "request timed out", options) {
+		super(message, options);
+	}
+};
+var JWSSignatureVerificationFailed = class extends JOSEError {
+	static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+	code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+	constructor(message = "signature verification failed", options) {
+		super(message, options);
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/is_key_like.js
+var isCryptoKey = (key) => {
+	if (key?.[Symbol.toStringTag] === "CryptoKey") return true;
+	try {
+		return key instanceof CryptoKey;
+	} catch {
+		return false;
+	}
+};
+var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/helpers.js
+function assertNotSet(value, name) {
+	if (value) throw new TypeError(`${name} can only be called once`);
+}
+function decodeBase64url(value, label, ErrorClass) {
+	try {
+		return decode(value);
+	} catch {
+		throw new ErrorClass(`Failed to base64url decode the ${label}`);
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/type_checks.js
+var isObjectLike = (value) => typeof value === "object" && value !== null;
+function isObject(input) {
+	if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") return false;
+	if (Object.getPrototypeOf(input) === null) return true;
+	let proto = input;
+	while (Object.getPrototypeOf(proto) !== null) proto = Object.getPrototypeOf(proto);
+	return Object.getPrototypeOf(input) === proto;
+}
+function isDisjoint(...headers) {
+	const sources = headers.filter(Boolean);
+	if (sources.length === 0 || sources.length === 1) return true;
+	let acc;
+	for (const header of sources) {
+		const parameters = Object.keys(header);
+		if (!acc || acc.size === 0) {
+			acc = new Set(parameters);
+			continue;
+		}
+		for (const parameter of parameters) {
+			if (acc.has(parameter)) return false;
+			acc.add(parameter);
+		}
+	}
+	return true;
+}
+var isJWK = (key) => isObject(key) && typeof key.kty === "string";
+var isPrivateJWK = (key) => key.kty !== "oct" && (key.kty === "AKP" && typeof key.priv === "string" || typeof key.d === "string");
+var isPublicJWK = (key) => key.kty !== "oct" && key.d === void 0 && key.priv === void 0;
+var isSecretJWK = (key) => key.kty === "oct" && typeof key.k === "string";
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/signing.js
+function checkKeyLength(alg, key) {
+	if (alg.startsWith("RS") || alg.startsWith("PS")) {
+		const { modulusLength } = key.algorithm;
+		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+	}
+}
+function subtleAlgorithm(alg, algorithm) {
+	const hash = `SHA-${alg.slice(-3)}`;
+	switch (alg) {
+		case "HS256":
+		case "HS384":
+		case "HS512": return {
+			hash,
+			name: "HMAC"
+		};
+		case "PS256":
+		case "PS384":
+		case "PS512": return {
+			hash,
+			name: "RSA-PSS",
+			saltLength: parseInt(alg.slice(-3), 10) >> 3
+		};
+		case "RS256":
+		case "RS384":
+		case "RS512": return {
+			hash,
+			name: "RSASSA-PKCS1-v1_5"
+		};
+		case "ES256":
+		case "ES384":
+		case "ES512": return {
+			hash,
+			name: "ECDSA",
+			namedCurve: algorithm.namedCurve
+		};
+		case "Ed25519":
+		case "EdDSA": return { name: "Ed25519" };
+		case "ML-DSA-44":
+		case "ML-DSA-65":
+		case "ML-DSA-87": return { name: alg };
+		default: throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+	}
+}
+async function getSigKey(alg, key, usage) {
+	if (key instanceof Uint8Array) {
+		if (!alg.startsWith("HS")) throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+		return crypto.subtle.importKey("raw", key, {
+			hash: `SHA-${alg.slice(-3)}`,
+			name: "HMAC"
+		}, false, [usage]);
+	}
+	checkSigCryptoKey(key, alg, usage);
+	return key;
+}
+async function sign(alg, key, data) {
+	const cryptoKey = await getSigKey(alg, key, "sign");
+	checkKeyLength(alg, cryptoKey);
+	const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);
+	return new Uint8Array(signature);
+}
+async function verify(alg, key, signature, data) {
+	const cryptoKey = await getSigKey(alg, key, "verify");
+	checkKeyLength(alg, cryptoKey);
+	const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
+	try {
+		return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/jwk_to_key.js
+var unsupportedAlg = "Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value";
+function subtleMapping(jwk) {
+	let algorithm;
+	let keyUsages;
+	switch (jwk.kty) {
+		case "AKP":
+			switch (jwk.alg) {
+				case "ML-DSA-44":
+				case "ML-DSA-65":
+				case "ML-DSA-87":
+					algorithm = { name: jwk.alg };
+					keyUsages = jwk.priv ? ["sign"] : ["verify"];
+					break;
+				default: throw new JOSENotSupported(unsupportedAlg);
+			}
+			break;
+		case "RSA":
+			switch (jwk.alg) {
+				case "PS256":
+				case "PS384":
+				case "PS512":
+					algorithm = {
+						name: "RSA-PSS",
+						hash: `SHA-${jwk.alg.slice(-3)}`
+					};
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "RS256":
+				case "RS384":
+				case "RS512":
+					algorithm = {
+						name: "RSASSA-PKCS1-v1_5",
+						hash: `SHA-${jwk.alg.slice(-3)}`
+					};
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "RSA-OAEP":
+				case "RSA-OAEP-256":
+				case "RSA-OAEP-384":
+				case "RSA-OAEP-512":
+					algorithm = {
+						name: "RSA-OAEP",
+						hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`
+					};
+					keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
+					break;
+				default: throw new JOSENotSupported(unsupportedAlg);
+			}
+			break;
+		case "EC":
+			switch (jwk.alg) {
+				case "ES256":
+				case "ES384":
+				case "ES512":
+					algorithm = {
+						name: "ECDSA",
+						namedCurve: {
+							ES256: "P-256",
+							ES384: "P-384",
+							ES512: "P-521"
+						}[jwk.alg]
+					};
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "ECDH-ES":
+				case "ECDH-ES+A128KW":
+				case "ECDH-ES+A192KW":
+				case "ECDH-ES+A256KW":
+					algorithm = {
+						name: "ECDH",
+						namedCurve: jwk.crv
+					};
+					keyUsages = jwk.d ? ["deriveBits"] : [];
+					break;
+				default: throw new JOSENotSupported(unsupportedAlg);
+			}
+			break;
+		case "OKP":
+			switch (jwk.alg) {
+				case "Ed25519":
+				case "EdDSA":
+					algorithm = { name: "Ed25519" };
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "ECDH-ES":
+				case "ECDH-ES+A128KW":
+				case "ECDH-ES+A192KW":
+				case "ECDH-ES+A256KW":
+					algorithm = { name: jwk.crv };
+					keyUsages = jwk.d ? ["deriveBits"] : [];
+					break;
+				default: throw new JOSENotSupported(unsupportedAlg);
+			}
+			break;
+		default: throw new JOSENotSupported("Invalid or unsupported JWK \"kty\" (Key Type) Parameter value");
+	}
+	return {
+		algorithm,
+		keyUsages
+	};
+}
+async function jwkToKey(jwk) {
+	if (!jwk.alg) throw new TypeError("\"alg\" argument is required when \"jwk.alg\" is not present");
+	const { algorithm, keyUsages } = subtleMapping(jwk);
+	const keyData = { ...jwk };
+	if (keyData.kty !== "AKP") delete keyData.alg;
+	delete keyData.use;
+	return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/normalize_key.js
+var unusableForAlg = "given KeyObject instance cannot be used for this algorithm";
+var cache;
+var handleJWK = async (key, jwk, alg, freeze = false) => {
+	cache ||= /* @__PURE__ */ new WeakMap();
+	let cached = cache.get(key);
+	if (cached?.[alg]) return cached[alg];
+	const cryptoKey = await jwkToKey({
+		...jwk,
+		alg
+	});
+	if (freeze) Object.freeze(key);
+	if (!cached) cache.set(key, { [alg]: cryptoKey });
+	else cached[alg] = cryptoKey;
+	return cryptoKey;
+};
+var handleKeyObject = (keyObject, alg) => {
+	cache ||= /* @__PURE__ */ new WeakMap();
+	let cached = cache.get(keyObject);
+	if (cached?.[alg]) return cached[alg];
+	const isPublic = keyObject.type === "public";
+	const extractable = isPublic ? true : false;
+	let cryptoKey;
+	if (keyObject.asymmetricKeyType === "x25519") {
+		switch (alg) {
+			case "ECDH-ES":
+			case "ECDH-ES+A128KW":
+			case "ECDH-ES+A192KW":
+			case "ECDH-ES+A256KW": break;
+			default: throw new TypeError(unusableForAlg);
+		}
+		cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ["deriveBits"]);
+	}
+	if (keyObject.asymmetricKeyType === "ed25519") {
+		if (alg !== "EdDSA" && alg !== "Ed25519") throw new TypeError(unusableForAlg);
+		cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [isPublic ? "verify" : "sign"]);
+	}
+	switch (keyObject.asymmetricKeyType) {
+		case "ml-dsa-44":
+		case "ml-dsa-65":
+		case "ml-dsa-87":
+			if (alg !== keyObject.asymmetricKeyType.toUpperCase()) throw new TypeError(unusableForAlg);
+			cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [isPublic ? "verify" : "sign"]);
+	}
+	if (keyObject.asymmetricKeyType === "rsa") {
+		let hash;
+		switch (alg) {
+			case "RSA-OAEP":
+				hash = "SHA-1";
+				break;
+			case "RS256":
+			case "PS256":
+			case "RSA-OAEP-256":
+				hash = "SHA-256";
+				break;
+			case "RS384":
+			case "PS384":
+			case "RSA-OAEP-384":
+				hash = "SHA-384";
+				break;
+			case "RS512":
+			case "PS512":
+			case "RSA-OAEP-512":
+				hash = "SHA-512";
+				break;
+			default: throw new TypeError(unusableForAlg);
+		}
+		if (alg.startsWith("RSA-OAEP")) return keyObject.toCryptoKey({
+			name: "RSA-OAEP",
+			hash
+		}, extractable, isPublic ? ["encrypt"] : ["decrypt"]);
+		cryptoKey = keyObject.toCryptoKey({
+			name: alg.startsWith("PS") ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
+			hash
+		}, extractable, [isPublic ? "verify" : "sign"]);
+	}
+	if (keyObject.asymmetricKeyType === "ec") {
+		const namedCurve = (/* @__PURE__ */ new Map([
+			["prime256v1", "P-256"],
+			["secp384r1", "P-384"],
+			["secp521r1", "P-521"]
+		])).get(keyObject.asymmetricKeyDetails?.namedCurve);
+		if (!namedCurve) throw new TypeError(unusableForAlg);
+		const expectedCurve = {
+			ES256: "P-256",
+			ES384: "P-384",
+			ES512: "P-521"
+		};
+		if (expectedCurve[alg] && namedCurve === expectedCurve[alg]) cryptoKey = keyObject.toCryptoKey({
+			name: "ECDSA",
+			namedCurve
+		}, extractable, [isPublic ? "verify" : "sign"]);
+		if (alg.startsWith("ECDH-ES")) cryptoKey = keyObject.toCryptoKey({
+			name: "ECDH",
+			namedCurve
+		}, extractable, isPublic ? [] : ["deriveBits"]);
+	}
+	if (!cryptoKey) throw new TypeError(unusableForAlg);
+	if (!cached) cache.set(keyObject, { [alg]: cryptoKey });
+	else cached[alg] = cryptoKey;
+	return cryptoKey;
+};
+async function normalizeKey(key, alg) {
+	if (key instanceof Uint8Array) return key;
+	if (isCryptoKey(key)) return key;
+	if (isKeyObject(key)) {
+		if (key.type === "secret") return key.export();
+		if ("toCryptoKey" in key && typeof key.toCryptoKey === "function") try {
+			return handleKeyObject(key, alg);
+		} catch (err) {
+			if (err instanceof TypeError) throw err;
+		}
+		return handleJWK(key, key.export({ format: "jwk" }), alg);
+	}
+	if (isJWK(key)) {
+		if (key.k) return decode(key.k);
+		return handleJWK(key, key, alg, true);
+	}
+	throw new Error("unreachable");
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/key/import.js
+async function importJWK(jwk, alg, options) {
+	if (!isObject(jwk)) throw new TypeError("JWK must be an object");
+	let ext;
+	alg ??= jwk.alg;
+	ext ??= options?.extractable ?? jwk.ext;
+	switch (jwk.kty) {
+		case "oct":
+			if (typeof jwk.k !== "string" || !jwk.k) throw new TypeError("missing \"k\" (Key Value) Parameter value");
+			return decode(jwk.k);
+		case "RSA":
+			if ("oth" in jwk && jwk.oth !== void 0) throw new JOSENotSupported("RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported");
+			return jwkToKey({
+				...jwk,
+				alg,
+				ext
+			});
+		case "AKP":
+			if (typeof jwk.alg !== "string" || !jwk.alg) throw new TypeError("missing \"alg\" (Algorithm) Parameter value");
+			if (alg !== void 0 && alg !== jwk.alg) throw new TypeError("JWK alg and alg option value mismatch");
+			return jwkToKey({
+				...jwk,
+				ext
+			});
+		case "EC":
+		case "OKP": return jwkToKey({
+			...jwk,
+			alg,
+			ext
+		});
+		default: throw new JOSENotSupported("Unsupported \"kty\" (Key Type) Parameter value");
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/validate_crit.js
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+	if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) throw new Err("\"crit\" (Critical) Header Parameter MUST be integrity protected");
+	if (!protectedHeader || protectedHeader.crit === void 0) return /* @__PURE__ */ new Set();
+	if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) throw new Err("\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present");
+	let recognized;
+	if (recognizedOption !== void 0) recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);
+	else recognized = recognizedDefault;
+	for (const parameter of protectedHeader.crit) {
+		if (!recognized.has(parameter)) throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+		if (joseHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+		if (recognized.get(parameter) && protectedHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+	}
+	return new Set(protectedHeader.crit);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/validate_algorithms.js
+function validateAlgorithms(option, algorithms) {
+	if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) throw new TypeError(`"${option}" option must be an array of strings`);
+	if (!algorithms) return;
+	return new Set(algorithms);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/check_key_type.js
+var tag = (key) => key?.[Symbol.toStringTag];
+var jwkMatchesOp = (alg, key, usage) => {
+	if (key.use !== void 0) {
+		let expected;
+		switch (usage) {
+			case "sign":
+			case "verify":
+				expected = "sig";
+				break;
+			case "encrypt":
+			case "decrypt":
+				expected = "enc";
+				break;
+		}
+		if (key.use !== expected) throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+	}
+	if (key.alg !== void 0 && key.alg !== alg) throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+	if (Array.isArray(key.key_ops)) {
+		let expectedKeyOp;
+		switch (true) {
+			case usage === "sign" || usage === "verify":
+			case alg === "dir":
+			case alg.includes("CBC-HS"):
+				expectedKeyOp = usage;
+				break;
+			case alg.startsWith("PBES2"):
+				expectedKeyOp = "deriveBits";
+				break;
+			case /^A\d{3}(?:GCM)?(?:KW)?$/.test(alg):
+				if (!alg.includes("GCM") && alg.endsWith("KW")) expectedKeyOp = usage === "encrypt" ? "wrapKey" : "unwrapKey";
+				else expectedKeyOp = usage;
+				break;
+			case usage === "encrypt" && alg.startsWith("RSA"):
+				expectedKeyOp = "wrapKey";
+				break;
+			case usage === "decrypt":
+				expectedKeyOp = alg.startsWith("RSA") ? "unwrapKey" : "deriveBits";
+				break;
+		}
+		if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+	}
+	return true;
+};
+var symmetricTypeCheck = (alg, key, usage) => {
+	if (key instanceof Uint8Array) return;
+	if (isJWK(key)) {
+		if (isSecretJWK(key) && jwkMatchesOp(alg, key, usage)) return;
+		throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
+	}
+	if (!isKeyLike(key)) throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array"));
+	if (key.type !== "secret") throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
+};
+var asymmetricTypeCheck = (alg, key, usage) => {
+	if (isJWK(key)) switch (usage) {
+		case "decrypt":
+		case "sign":
+			if (isPrivateJWK(key) && jwkMatchesOp(alg, key, usage)) return;
+			throw new TypeError(`JSON Web Key for this operation must be a private JWK`);
+		case "encrypt":
+		case "verify":
+			if (isPublicJWK(key) && jwkMatchesOp(alg, key, usage)) return;
+			throw new TypeError(`JSON Web Key for this operation must be a public JWK`);
+	}
+	if (!isKeyLike(key)) throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
+	if (key.type === "secret") throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
+	if (key.type === "public") switch (usage) {
+		case "sign": throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
+		case "decrypt": throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
+	}
+	if (key.type === "private") switch (usage) {
+		case "verify": throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
+		case "encrypt": throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
+	}
+};
+function checkKeyType(alg, key, usage) {
+	switch (alg.substring(0, 2)) {
+		case "A1":
+		case "A2":
+		case "di":
+		case "HS":
+		case "PB":
+			symmetricTypeCheck(alg, key, usage);
+			break;
+		default: asymmetricTypeCheck(alg, key, usage);
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jws/flattened/verify.js
+async function flattenedVerify(jws, key, options) {
+	if (!isObject(jws)) throw new JWSInvalid("Flattened JWS must be an object");
+	if (jws.protected === void 0 && jws.header === void 0) throw new JWSInvalid("Flattened JWS must have either of the \"protected\" or \"header\" members");
+	if (jws.protected !== void 0 && typeof jws.protected !== "string") throw new JWSInvalid("JWS Protected Header incorrect type");
+	if (jws.payload === void 0) throw new JWSInvalid("JWS Payload missing");
+	if (typeof jws.signature !== "string") throw new JWSInvalid("JWS Signature missing or incorrect type");
+	if (jws.header !== void 0 && !isObject(jws.header)) throw new JWSInvalid("JWS Unprotected Header incorrect type");
+	let parsedProt = {};
+	if (jws.protected) try {
+		const protectedHeader = decode(jws.protected);
+		parsedProt = JSON.parse(decoder.decode(protectedHeader));
+	} catch {
+		throw new JWSInvalid("JWS Protected Header is invalid");
+	}
+	if (!isDisjoint(parsedProt, jws.header)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+	const joseHeader = {
+		...parsedProt,
+		...jws.header
+	};
+	const extensions = validateCrit(JWSInvalid, /* @__PURE__ */ new Map([["b64", true]]), options?.crit, parsedProt, joseHeader);
+	let b64 = true;
+	if (extensions.has("b64")) {
+		b64 = parsedProt.b64;
+		if (typeof b64 !== "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
+	}
+	const { alg } = joseHeader;
+	if (typeof alg !== "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
+	const algorithms = options && validateAlgorithms("algorithms", options.algorithms);
+	if (algorithms && !algorithms.has(alg)) throw new JOSEAlgNotAllowed("\"alg\" (Algorithm) Header Parameter value not allowed");
+	if (b64) {
+		if (typeof jws.payload !== "string") throw new JWSInvalid("JWS Payload must be a string");
+	} else if (typeof jws.payload !== "string" && !(jws.payload instanceof Uint8Array)) throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+	let resolvedKey = false;
+	if (typeof key === "function") {
+		key = await key(parsedProt, jws);
+		resolvedKey = true;
+	}
+	checkKeyType(alg, key, "verify");
+	const data = concat(jws.protected !== void 0 ? encode$1(jws.protected) : /* @__PURE__ */ new Uint8Array(), encode$1("."), typeof jws.payload === "string" ? b64 ? encode$1(jws.payload) : encoder.encode(jws.payload) : jws.payload);
+	const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
+	const k = await normalizeKey(key, alg);
+	if (!await verify(alg, k, signature, data)) throw new JWSSignatureVerificationFailed();
+	let payload;
+	if (b64) payload = decodeBase64url(jws.payload, "payload", JWSInvalid);
+	else if (typeof jws.payload === "string") payload = encoder.encode(jws.payload);
+	else payload = jws.payload;
+	const result = { payload };
+	if (jws.protected !== void 0) result.protectedHeader = parsedProt;
+	if (jws.header !== void 0) result.unprotectedHeader = jws.header;
+	if (resolvedKey) return {
+		...result,
+		key: k
+	};
+	return result;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jws/compact/verify.js
+async function compactVerify(jws, key, options) {
+	if (jws instanceof Uint8Array) jws = decoder.decode(jws);
+	if (typeof jws !== "string") throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+	const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
+	if (length !== 3) throw new JWSInvalid("Invalid Compact JWS");
+	const verified = await flattenedVerify({
+		payload,
+		protected: protectedHeader,
+		signature
+	}, key, options);
+	const result = {
+		payload: verified.payload,
+		protectedHeader: verified.protectedHeader
+	};
+	if (typeof key === "function") return {
+		...result,
+		key: verified.key
+	};
+	return result;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+var epoch = (date) => Math.floor(date.getTime() / 1e3);
+var minute = 60;
+var hour = minute * 60;
+var day = hour * 24;
+var week = day * 7;
+var year = day * 365.25;
+var REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+function secs(str) {
+	const matched = REGEX.exec(str);
+	if (!matched || matched[4] && matched[1]) throw new TypeError("Invalid time period format");
+	const value = parseFloat(matched[2]);
+	const unit = matched[3].toLowerCase();
+	let numericDate;
+	switch (unit) {
+		case "sec":
+		case "secs":
+		case "second":
+		case "seconds":
+		case "s":
+			numericDate = Math.round(value);
+			break;
+		case "minute":
+		case "minutes":
+		case "min":
+		case "mins":
+		case "m":
+			numericDate = Math.round(value * minute);
+			break;
+		case "hour":
+		case "hours":
+		case "hr":
+		case "hrs":
+		case "h":
+			numericDate = Math.round(value * hour);
+			break;
+		case "day":
+		case "days":
+		case "d":
+			numericDate = Math.round(value * day);
+			break;
+		case "week":
+		case "weeks":
+		case "w":
+			numericDate = Math.round(value * week);
+			break;
+		default:
+			numericDate = Math.round(value * year);
+			break;
+	}
+	if (matched[1] === "-" || matched[4] === "ago") return -numericDate;
+	return numericDate;
+}
+function validateInput(label, input) {
+	if (!Number.isFinite(input)) throw new TypeError(`Invalid ${label} input`);
+	return input;
+}
+var normalizeTyp = (value) => {
+	if (value.includes("/")) return value.toLowerCase();
+	return `application/${value.toLowerCase()}`;
+};
+var checkAudiencePresence = (audPayload, audOption) => {
+	if (typeof audPayload === "string") return audOption.includes(audPayload);
+	if (Array.isArray(audPayload)) return audOption.some(Set.prototype.has.bind(new Set(audPayload)));
+	return false;
+};
+function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+	let payload;
+	try {
+		payload = JSON.parse(decoder.decode(encodedPayload));
+	} catch {}
+	if (!isObject(payload)) throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+	const { typ } = options;
+	if (typ && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) throw new JWTClaimValidationFailed("unexpected \"typ\" JWT header value", payload, "typ", "check_failed");
+	const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
+	const presenceCheck = [...requiredClaims];
+	if (maxTokenAge !== void 0) presenceCheck.push("iat");
+	if (audience !== void 0) presenceCheck.push("aud");
+	if (subject !== void 0) presenceCheck.push("sub");
+	if (issuer !== void 0) presenceCheck.push("iss");
+	for (const claim of new Set(presenceCheck.reverse())) if (!(claim in payload)) throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+	if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) throw new JWTClaimValidationFailed("unexpected \"iss\" claim value", payload, "iss", "check_failed");
+	if (subject && payload.sub !== subject) throw new JWTClaimValidationFailed("unexpected \"sub\" claim value", payload, "sub", "check_failed");
+	if (audience && !checkAudiencePresence(payload.aud, typeof audience === "string" ? [audience] : audience)) throw new JWTClaimValidationFailed("unexpected \"aud\" claim value", payload, "aud", "check_failed");
+	let tolerance;
+	switch (typeof options.clockTolerance) {
+		case "string":
+			tolerance = secs(options.clockTolerance);
+			break;
+		case "number":
+			tolerance = options.clockTolerance;
+			break;
+		case "undefined":
+			tolerance = 0;
+			break;
+		default: throw new TypeError("Invalid clockTolerance option type");
+	}
+	const { currentDate } = options;
+	const now = epoch(currentDate || /* @__PURE__ */ new Date());
+	if ((payload.iat !== void 0 || maxTokenAge) && typeof payload.iat !== "number") throw new JWTClaimValidationFailed("\"iat\" claim must be a number", payload, "iat", "invalid");
+	if (payload.nbf !== void 0) {
+		if (typeof payload.nbf !== "number") throw new JWTClaimValidationFailed("\"nbf\" claim must be a number", payload, "nbf", "invalid");
+		if (payload.nbf > now + tolerance) throw new JWTClaimValidationFailed("\"nbf\" claim timestamp check failed", payload, "nbf", "check_failed");
+	}
+	if (payload.exp !== void 0) {
+		if (typeof payload.exp !== "number") throw new JWTClaimValidationFailed("\"exp\" claim must be a number", payload, "exp", "invalid");
+		if (payload.exp <= now - tolerance) throw new JWTExpired("\"exp\" claim timestamp check failed", payload, "exp", "check_failed");
+	}
+	if (maxTokenAge) {
+		const age = now - payload.iat;
+		const max = typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge);
+		if (age - tolerance > max) throw new JWTExpired("\"iat\" claim timestamp check failed (too far in the past)", payload, "iat", "check_failed");
+		if (age < 0 - tolerance) throw new JWTClaimValidationFailed("\"iat\" claim timestamp check failed (it should be in the past)", payload, "iat", "check_failed");
+	}
+	return payload;
+}
+var JWTClaimsBuilder = class {
+	#payload;
+	constructor(payload) {
+		if (!isObject(payload)) throw new TypeError("JWT Claims Set MUST be an object");
+		this.#payload = structuredClone(payload);
+	}
+	data() {
+		return encoder.encode(JSON.stringify(this.#payload));
+	}
+	get iss() {
+		return this.#payload.iss;
+	}
+	set iss(value) {
+		this.#payload.iss = value;
+	}
+	get sub() {
+		return this.#payload.sub;
+	}
+	set sub(value) {
+		this.#payload.sub = value;
+	}
+	get aud() {
+		return this.#payload.aud;
+	}
+	set aud(value) {
+		this.#payload.aud = value;
+	}
+	set jti(value) {
+		this.#payload.jti = value;
+	}
+	set nbf(value) {
+		if (typeof value === "number") this.#payload.nbf = validateInput("setNotBefore", value);
+		else if (value instanceof Date) this.#payload.nbf = validateInput("setNotBefore", epoch(value));
+		else this.#payload.nbf = epoch(/* @__PURE__ */ new Date()) + secs(value);
+	}
+	set exp(value) {
+		if (typeof value === "number") this.#payload.exp = validateInput("setExpirationTime", value);
+		else if (value instanceof Date) this.#payload.exp = validateInput("setExpirationTime", epoch(value));
+		else this.#payload.exp = epoch(/* @__PURE__ */ new Date()) + secs(value);
+	}
+	set iat(value) {
+		if (value === void 0) this.#payload.iat = epoch(/* @__PURE__ */ new Date());
+		else if (value instanceof Date) this.#payload.iat = validateInput("setIssuedAt", epoch(value));
+		else if (typeof value === "string") this.#payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value));
+		else this.#payload.iat = validateInput("setIssuedAt", value);
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwt/verify.js
+async function jwtVerify(jwt, key, options) {
+	const verified = await compactVerify(jwt, key, options);
+	if (verified.protectedHeader.crit?.includes("b64") && verified.protectedHeader.b64 === false) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+	const result = {
+		payload: validateClaimsSet(verified.protectedHeader, verified.payload, options),
+		protectedHeader: verified.protectedHeader
+	};
+	if (typeof key === "function") return {
+		...result,
+		key: verified.key
+	};
+	return result;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jws/flattened/sign.js
+var FlattenedSign = class {
+	#payload;
+	#protectedHeader;
+	#unprotectedHeader;
+	constructor(payload) {
+		if (!(payload instanceof Uint8Array)) throw new TypeError("payload must be an instance of Uint8Array");
+		this.#payload = payload;
+	}
+	setProtectedHeader(protectedHeader) {
+		assertNotSet(this.#protectedHeader, "setProtectedHeader");
+		this.#protectedHeader = protectedHeader;
+		return this;
+	}
+	setUnprotectedHeader(unprotectedHeader) {
+		assertNotSet(this.#unprotectedHeader, "setUnprotectedHeader");
+		this.#unprotectedHeader = unprotectedHeader;
+		return this;
+	}
+	async sign(key, options) {
+		if (!this.#protectedHeader && !this.#unprotectedHeader) throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
+		if (!isDisjoint(this.#protectedHeader, this.#unprotectedHeader)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+		const joseHeader = {
+			...this.#protectedHeader,
+			...this.#unprotectedHeader
+		};
+		const extensions = validateCrit(JWSInvalid, /* @__PURE__ */ new Map([["b64", true]]), options?.crit, this.#protectedHeader, joseHeader);
+		let b64 = true;
+		if (extensions.has("b64")) {
+			b64 = this.#protectedHeader.b64;
+			if (typeof b64 !== "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
+		}
+		const { alg } = joseHeader;
+		if (typeof alg !== "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
+		checkKeyType(alg, key, "sign");
+		let payloadS;
+		let payloadB;
+		if (b64) {
+			payloadS = encode(this.#payload);
+			payloadB = encode$1(payloadS);
+		} else {
+			payloadB = this.#payload;
+			payloadS = "";
+		}
+		let protectedHeaderString;
+		let protectedHeaderBytes;
+		if (this.#protectedHeader) {
+			protectedHeaderString = encode(JSON.stringify(this.#protectedHeader));
+			protectedHeaderBytes = encode$1(protectedHeaderString);
+		} else {
+			protectedHeaderString = "";
+			protectedHeaderBytes = /* @__PURE__ */ new Uint8Array();
+		}
+		const data = concat(protectedHeaderBytes, encode$1("."), payloadB);
+		const jws = {
+			signature: encode(await sign(alg, await normalizeKey(key, alg), data)),
+			payload: payloadS
+		};
+		if (this.#unprotectedHeader) jws.header = this.#unprotectedHeader;
+		if (this.#protectedHeader) jws.protected = protectedHeaderString;
+		return jws;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jws/compact/sign.js
+var CompactSign = class {
+	#flattened;
+	constructor(payload) {
+		this.#flattened = new FlattenedSign(payload);
+	}
+	setProtectedHeader(protectedHeader) {
+		this.#flattened.setProtectedHeader(protectedHeader);
+		return this;
+	}
+	async sign(key, options) {
+		const jws = await this.#flattened.sign(key, options);
+		if (jws.payload === void 0) throw new TypeError("use the flattened module for creating JWS with b64: false");
+		return `${jws.protected}.${jws.payload}.${jws.signature}`;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwt/sign.js
+var SignJWT = class {
+	#protectedHeader;
+	#jwt;
+	constructor(payload = {}) {
+		this.#jwt = new JWTClaimsBuilder(payload);
+	}
+	setIssuer(issuer) {
+		this.#jwt.iss = issuer;
+		return this;
+	}
+	setSubject(subject) {
+		this.#jwt.sub = subject;
+		return this;
+	}
+	setAudience(audience) {
+		this.#jwt.aud = audience;
+		return this;
+	}
+	setJti(jwtId) {
+		this.#jwt.jti = jwtId;
+		return this;
+	}
+	setNotBefore(input) {
+		this.#jwt.nbf = input;
+		return this;
+	}
+	setExpirationTime(input) {
+		this.#jwt.exp = input;
+		return this;
+	}
+	setIssuedAt(input) {
+		this.#jwt.iat = input;
+		return this;
+	}
+	setProtectedHeader(protectedHeader) {
+		this.#protectedHeader = protectedHeader;
+		return this;
+	}
+	async sign(key, options) {
+		const sig = new CompactSign(this.#jwt.data());
+		sig.setProtectedHeader(this.#protectedHeader);
+		if (Array.isArray(this.#protectedHeader?.crit) && this.#protectedHeader.crit.includes("b64") && this.#protectedHeader.b64 === false) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+		return sig.sign(key, options);
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwks/local.js
+function getKtyFromAlg(alg) {
+	switch (typeof alg === "string" && alg.slice(0, 2)) {
+		case "RS":
+		case "PS": return "RSA";
+		case "ES": return "EC";
+		case "Ed": return "OKP";
+		case "ML": return "AKP";
+		default: throw new JOSENotSupported("Unsupported \"alg\" value for a JSON Web Key Set");
+	}
+}
+function isJWKSLike(jwks) {
+	return jwks && typeof jwks === "object" && Array.isArray(jwks.keys) && jwks.keys.every(isJWKLike);
+}
+function isJWKLike(key) {
+	return isObject(key);
+}
+var LocalJWKSet = class {
+	#jwks;
+	#cached = /* @__PURE__ */ new WeakMap();
+	constructor(jwks) {
+		if (!isJWKSLike(jwks)) throw new JWKSInvalid("JSON Web Key Set malformed");
+		this.#jwks = structuredClone(jwks);
+	}
+	jwks() {
+		return this.#jwks;
+	}
+	async getKey(protectedHeader, token) {
+		const { alg, kid } = {
+			...protectedHeader,
+			...token?.header
+		};
+		const kty = getKtyFromAlg(alg);
+		const candidates = this.#jwks.keys.filter((jwk) => {
+			let candidate = kty === jwk.kty;
+			if (candidate && typeof kid === "string") candidate = kid === jwk.kid;
+			if (candidate && (typeof jwk.alg === "string" || kty === "AKP")) candidate = alg === jwk.alg;
+			if (candidate && typeof jwk.use === "string") candidate = jwk.use === "sig";
+			if (candidate && Array.isArray(jwk.key_ops)) candidate = jwk.key_ops.includes("verify");
+			if (candidate) switch (alg) {
+				case "ES256":
+					candidate = jwk.crv === "P-256";
+					break;
+				case "ES384":
+					candidate = jwk.crv === "P-384";
+					break;
+				case "ES512":
+					candidate = jwk.crv === "P-521";
+					break;
+				case "Ed25519":
+				case "EdDSA":
+					candidate = jwk.crv === "Ed25519";
+					break;
+			}
+			return candidate;
+		});
+		const { 0: jwk, length } = candidates;
+		if (length === 0) throw new JWKSNoMatchingKey();
+		if (length !== 1) {
+			const error = new JWKSMultipleMatchingKeys();
+			const _cached = this.#cached;
+			error[Symbol.asyncIterator] = async function* () {
+				for (const jwk of candidates) try {
+					yield await importWithAlgCache(_cached, jwk, alg);
+				} catch {}
+			};
+			throw error;
+		}
+		return importWithAlgCache(this.#cached, jwk, alg);
+	}
+};
+async function importWithAlgCache(cache, jwk, alg) {
+	const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
+	if (cached[alg] === void 0) {
+		const key = await importJWK({
+			...jwk,
+			ext: true
+		}, alg);
+		if (key instanceof Uint8Array || key.type !== "public") throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+		cached[alg] = key;
+	}
+	return cached[alg];
+}
+function createLocalJWKSet(jwks) {
+	const set = new LocalJWKSet(jwks);
+	const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
+	Object.defineProperties(localJWKSet, { jwks: {
+		value: () => structuredClone(set.jwks()),
+		enumerable: false,
+		configurable: false,
+		writable: false
+	} });
+	return localJWKSet;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwks/remote.js
+function isCloudflareWorkers() {
+	return typeof WebSocketPair !== "undefined" || typeof navigator !== "undefined" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime !== "undefined" && EdgeRuntime === "vercel";
+}
+var USER_AGENT;
+if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) USER_AGENT = `jose/v6.2.3`;
+var customFetch = Symbol();
+async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
+	const response = await fetchImpl(url, {
+		method: "GET",
+		signal,
+		redirect: "manual",
+		headers
+	}).catch((err) => {
+		if (err.name === "TimeoutError") throw new JWKSTimeout();
+		throw err;
+	});
+	if (response.status !== 200) throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
+	try {
+		return await response.json();
+	} catch {
+		throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+	}
+}
+var jwksCache = Symbol();
+function isFreshJwksCache(input, cacheMaxAge) {
+	if (typeof input !== "object" || input === null) return false;
+	if (!("uat" in input) || typeof input.uat !== "number" || Date.now() - input.uat >= cacheMaxAge) return false;
+	if (!("jwks" in input) || !isObject(input.jwks) || !Array.isArray(input.jwks.keys) || !Array.prototype.every.call(input.jwks.keys, isObject)) return false;
+	return true;
+}
+var RemoteJWKSet = class {
+	#url;
+	#timeoutDuration;
+	#cooldownDuration;
+	#cacheMaxAge;
+	#jwksTimestamp;
+	#pendingFetch;
+	#headers;
+	#customFetch;
+	#local;
+	#cache;
+	constructor(url, options) {
+		if (!(url instanceof URL)) throw new TypeError("url must be an instance of URL");
+		this.#url = new URL(url.href);
+		this.#timeoutDuration = typeof options?.timeoutDuration === "number" ? options?.timeoutDuration : 5e3;
+		this.#cooldownDuration = typeof options?.cooldownDuration === "number" ? options?.cooldownDuration : 3e4;
+		this.#cacheMaxAge = typeof options?.cacheMaxAge === "number" ? options?.cacheMaxAge : 6e5;
+		this.#headers = new Headers(options?.headers);
+		if (USER_AGENT && !this.#headers.has("User-Agent")) this.#headers.set("User-Agent", USER_AGENT);
+		if (!this.#headers.has("accept")) {
+			this.#headers.set("accept", "application/json");
+			this.#headers.append("accept", "application/jwk-set+json");
+		}
+		this.#customFetch = options?.[customFetch];
+		if (options?.[jwksCache] !== void 0) {
+			this.#cache = options?.[jwksCache];
+			if (isFreshJwksCache(options?.[jwksCache], this.#cacheMaxAge)) {
+				this.#jwksTimestamp = this.#cache.uat;
+				this.#local = createLocalJWKSet(this.#cache.jwks);
+			}
+		}
+	}
+	pendingFetch() {
+		return !!this.#pendingFetch;
+	}
+	coolingDown() {
+		return typeof this.#jwksTimestamp === "number" ? Date.now() < this.#jwksTimestamp + this.#cooldownDuration : false;
+	}
+	fresh() {
+		return typeof this.#jwksTimestamp === "number" ? Date.now() < this.#jwksTimestamp + this.#cacheMaxAge : false;
+	}
+	jwks() {
+		return this.#local?.jwks();
+	}
+	async getKey(protectedHeader, token) {
+		if (!this.#local || !this.fresh()) await this.reload();
+		try {
+			return await this.#local(protectedHeader, token);
+		} catch (err) {
+			if (err instanceof JWKSNoMatchingKey) {
+				if (this.coolingDown() === false) {
+					await this.reload();
+					return this.#local(protectedHeader, token);
+				}
+			}
+			throw err;
+		}
+	}
+	async reload() {
+		if (this.#pendingFetch && isCloudflareWorkers()) this.#pendingFetch = void 0;
+		this.#pendingFetch ||= fetchJwks(this.#url.href, this.#headers, AbortSignal.timeout(this.#timeoutDuration), this.#customFetch).then((json) => {
+			this.#local = createLocalJWKSet(json);
+			if (this.#cache) {
+				this.#cache.uat = Date.now();
+				this.#cache.jwks = json;
+			}
+			this.#jwksTimestamp = Date.now();
+			this.#pendingFetch = void 0;
+		}).catch((err) => {
+			this.#pendingFetch = void 0;
+			throw err;
+		});
+		await this.#pendingFetch;
+	}
+};
+function createRemoteJWKSet(url, options) {
+	const set = new RemoteJWKSet(url, options);
+	const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
+	Object.defineProperties(remoteJWKSet, {
+		coolingDown: {
+			get: () => set.coolingDown(),
+			enumerable: true,
+			configurable: false
+		},
+		fresh: {
+			get: () => set.fresh(),
+			enumerable: true,
+			configurable: false
+		},
+		reload: {
+			value: () => set.reload(),
+			enumerable: true,
+			configurable: false,
+			writable: false
+		},
+		reloading: {
+			get: () => set.pendingFetch(),
+			enumerable: true,
+			configurable: false
+		},
+		jwks: {
+			value: () => set.jwks(),
+			enumerable: true,
+			configurable: false,
+			writable: false
+		}
+	});
+	return remoteJWKSet;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/index.js
+var webapi_exports = /* @__PURE__ */ __exportAll({
+	SignJWT: () => SignJWT,
+	cryptoRuntime: () => cryptoRuntime,
+	errors: () => errors_exports,
+	jwtVerify: () => jwtVerify
+});
+//#endregion
+//#region src/services/OidcLoginService.ts
+var DEFAULT_SCOPES = [
+	"openid",
+	"profile",
+	"email"
+];
+var DEFAULT_CLOCK_TOLERANCE_SECONDS = 15;
+var DEFAULT_METADATA_CACHE_TTL_MS = 300 * 1e3;
+var WELL_KNOWN_PATH = "/.well-known/openid-configuration";
+var OidcLoginError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "OidcLoginError";
+	}
+};
+function getUsersOidcConfig() {
+	return getPackageConfig("users", {}).auth?.oidc ?? {};
+}
+function normalizeIssuer(issuer) {
+	return issuer.replace(/\/+$/u, "");
+}
+function resolveDiscoveryUrl(provider) {
+	if (provider.discoveryUrl) return provider.discoveryUrl;
+	return `${normalizeIssuer(provider.issuer)}${WELL_KNOWN_PATH}`;
+}
+function bytesToBase64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+function base64UrlToBytes(value) {
+	const normalized = value.replaceAll("-", "+").replaceAll("_", "/");
+	const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
+	const binary = atob(padded);
+	const bytes = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+	return bytes;
+}
+function randomBase64Url(byteLength = 32) {
+	const bytes = new Uint8Array(byteLength);
+	crypto.getRandomValues(bytes);
+	return bytesToBase64Url(bytes);
+}
+async function pkceChallenge(codeVerifier) {
+	const bytes = new TextEncoder().encode(codeVerifier);
+	const digest = await crypto.subtle.digest("SHA-256", bytes);
+	return bytesToBase64Url(new Uint8Array(digest));
+}
+function bytesToBase64(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+}
+function formUrlEncode(value) {
+	const params = new URLSearchParams();
+	params.set("value", value);
+	return params.toString().slice(6);
+}
+function encodeBasicAuth(clientId, clientSecret) {
+	const credentials = `${formUrlEncode(clientId)}:${formUrlEncode(clientSecret)}`;
+	return bytesToBase64(new TextEncoder().encode(credentials));
+}
+function asString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function asBoolean(value) {
+	if (typeof value === "boolean") return value;
+	if (value === "true") return true;
+	if (value === "false") return false;
+}
+function ensureFetch(fetchOverride) {
+	const runtimeFetch = fetchOverride ?? globalThis.fetch;
+	if (!runtimeFetch) throw new OidcLoginError("OIDC login requires a fetch implementation.");
+	return runtimeFetch;
+}
+function requireString(value, field) {
+	if (typeof value !== "string" || value.length === 0) throw new OidcLoginError(`OIDC provider metadata missing "${field}".`);
+	return value;
+}
+async function readJsonResponse(response, context) {
+	try {
+		return await response.json();
+	} catch {
+		throw new OidcLoginError(`${context} returned invalid JSON.`);
+	}
+}
+function normalizeClaims(payload, issuer, sourceName = "OIDC claims") {
+	const sub = asString(payload.sub);
+	if (!sub) throw new OidcLoginError(`${sourceName} missing required "sub" claim.`);
+	return {
+		sub,
+		iss: asString(payload.iss) ?? issuer,
+		email: asString(payload.email),
+		email_verified: asBoolean(payload.email_verified),
+		name: asString(payload.name),
+		preferred_username: asString(payload.preferred_username)
+	};
+}
+function mergeClaims(idTokenClaims, userInfoClaims) {
+	if (userInfoClaims.sub !== idTokenClaims.sub) throw new OidcLoginError("OIDC userinfo subject does not match ID token.");
+	return {
+		...idTokenClaims,
+		email: idTokenClaims.email ?? userInfoClaims.email,
+		email_verified: idTokenClaims.email_verified ?? userInfoClaims.email_verified,
+		name: idTokenClaims.name ?? userInfoClaims.name,
+		preferred_username: idTokenClaims.preferred_username ?? userInfoClaims.preferred_username
+	};
+}
+function validateAuthorizedParty(payload, clientId) {
+	const authorizedParty = asString(payload.azp);
+	if (authorizedParty && authorizedParty !== clientId) throw new OidcLoginError("OIDC authorized party validation failed.");
+	if (Array.isArray(payload.aud) && payload.aud.length > 1 && authorizedParty !== clientId) throw new OidcLoginError("OIDC authorized party validation failed.");
+}
+function getTokenEndpointAuthMethod(provider) {
+	return provider.tokenEndpointAuthMethod ?? (provider.clientSecret ? "client_secret_basic" : "none");
+}
+function getScopes(provider) {
+	return provider.scopes?.length ? provider.scopes : [...DEFAULT_SCOPES];
+}
+function parseTokenResponse(json) {
+	if (typeof json.id_token !== "string") throw new OidcLoginError("OIDC token response missing \"id_token\".");
+	return {
+		accessToken: asString(json.access_token),
+		expiresAt: typeof json.expires_in === "number" ? new Date(Date.now() + json.expires_in * 1e3) : void 0,
+		idToken: json.id_token,
+		refreshToken: asString(json.refresh_token),
+		scope: asString(json.scope),
+		tokenType: asString(json.token_type)
+	};
+}
+function parseTransaction(value) {
+	if (!value || typeof value !== "object") throw new OidcLoginError("Invalid OIDC login transaction.");
+	const record = value;
+	if (!record.provider || !record.state || !record.nonce || !record.codeVerifier || typeof record.createdAt !== "number") throw new OidcLoginError("Invalid OIDC login transaction.");
+	return {
+		codeVerifier: record.codeVerifier,
+		createdAt: record.createdAt,
+		nonce: record.nonce,
+		provider: record.provider,
+		returnTo: asString(record.returnTo),
+		state: record.state
+	};
+}
+function encodeOidcTransaction(transaction) {
+	const json = JSON.stringify(transaction);
+	return bytesToBase64Url(new TextEncoder().encode(json));
+}
+function decodeOidcTransaction(value) {
+	try {
+		const json = new TextDecoder().decode(base64UrlToBytes(value));
+		return parseTransaction(JSON.parse(json));
+	} catch (error) {
+		if (error instanceof OidcLoginError) throw error;
+		throw new OidcLoginError("Invalid OIDC login transaction.");
+	}
+}
+function resolveOidcProviderConfig(providerName, options = {}) {
+	const oidcConfig = getUsersOidcConfig();
+	const providers = {
+		...oidcConfig.providers ?? {},
+		...options.providers ?? {}
+	};
+	const resolvedProviderName = providerName ?? options.defaultProvider ?? oidcConfig.defaultProvider;
+	if (!resolvedProviderName) throw new OidcLoginError("No OIDC provider specified. Pass a provider name or configure packages.users.auth.oidc.defaultProvider.");
+	const provider = providers[resolvedProviderName];
+	if (!provider) throw new OidcLoginError(`Unknown OIDC provider "${resolvedProviderName}". Configure it under packages.users.auth.oidc.providers.`);
+	if (!provider.issuer || !provider.clientId) throw new OidcLoginError(`OIDC provider "${resolvedProviderName}" requires issuer and clientId.`);
+	return {
+		provider,
+		providerName: resolvedProviderName
+	};
+}
+var OidcLoginService = class {
+	classOptions;
+	clockTolerance;
+	fetchImpl;
+	metadataCacheTtlMs;
+	metadataFetchedAt = 0;
+	metadataPromise;
+	remoteJwks;
+	provider;
+	providerName;
+	constructor(options) {
+		const { clockTolerance, fetch: fetchOverride, metadataCacheTtlMs, provider, providerName, ...classOptions } = options;
+		if (!provider.redirectUri) throw new OidcLoginError(`OIDC provider "${providerName}" requires a redirectUri.`);
+		this.classOptions = classOptions;
+		this.clockTolerance = clockTolerance ?? DEFAULT_CLOCK_TOLERANCE_SECONDS;
+		this.fetchImpl = ensureFetch(fetchOverride);
+		this.metadataCacheTtlMs = metadataCacheTtlMs ?? DEFAULT_METADATA_CACHE_TTL_MS;
+		this.provider = {
+			...provider,
+			issuer: normalizeIssuer(provider.issuer)
+		};
+		this.providerName = providerName;
+	}
+	createTransaction(returnTo) {
+		return {
+			codeVerifier: randomBase64Url(32),
+			createdAt: Date.now(),
+			nonce: randomBase64Url(32),
+			provider: this.providerName,
+			returnTo,
+			state: randomBase64Url(32)
+		};
+	}
+	async getMetadata() {
+		const cacheExpired = this.metadataFetchedAt > 0 && Date.now() - this.metadataFetchedAt > this.metadataCacheTtlMs;
+		if (!this.metadataPromise || cacheExpired) this.metadataPromise = this.fetchMetadata().then((metadata) => {
+			this.metadataFetchedAt = Date.now();
+			this.remoteJwks = void 0;
+			return metadata;
+		}).catch((error) => {
+			this.metadataPromise = void 0;
+			throw error;
+		});
+		return this.metadataPromise;
+	}
+	async fetchMetadata() {
+		const discoveryUrl = resolveDiscoveryUrl(this.provider);
+		const response = await this.fetchImpl(discoveryUrl, { headers: { accept: "application/json" } });
+		if (!response.ok) throw new OidcLoginError(`OIDC discovery failed for "${this.providerName}" (${response.status}).`);
+		const metadata = await readJsonResponse(response, "OIDC discovery");
+		const issuer = requireString(metadata.issuer ?? this.provider.issuer, "issuer");
+		if (normalizeIssuer(issuer) !== this.provider.issuer) throw new OidcLoginError(`OIDC discovery issuer mismatch for "${this.providerName}".`);
+		return {
+			...metadata,
+			authorization_endpoint: requireString(metadata.authorization_endpoint, "authorization_endpoint"),
+			issuer,
+			jwks_uri: requireString(metadata.jwks_uri, "jwks_uri"),
+			token_endpoint: requireString(metadata.token_endpoint, "token_endpoint")
+		};
+	}
+	async createAuthorizationUrl(options = {}) {
+		const metadata = await this.getMetadata();
+		const transaction = options.transaction ?? this.createTransaction();
+		const codeChallenge = await pkceChallenge(transaction.codeVerifier);
+		const url = new URL(metadata.authorization_endpoint);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("client_id", this.provider.clientId);
+		url.searchParams.set("redirect_uri", this.provider.redirectUri);
+		url.searchParams.set("scope", getScopes(this.provider).join(" "));
+		url.searchParams.set("state", transaction.state);
+		url.searchParams.set("nonce", transaction.nonce);
+		url.searchParams.set("code_challenge", codeChallenge);
+		url.searchParams.set("code_challenge_method", "S256");
+		for (const [key, value] of Object.entries({
+			...this.provider.authorizationParams,
+			...options.authorizationParams
+		})) if (value !== void 0) url.searchParams.set(key, String(value));
+		return {
+			transaction,
+			url
+		};
+	}
+	async exchangeCallback(callbackUrl, transaction) {
+		const code = this.validateCallback(callbackUrl, transaction);
+		const tokens = await this.exchangeCode(code, transaction);
+		const idTokenClaims = await this.verifyIdToken(tokens.idToken, transaction.nonce);
+		return {
+			claims: await this.enrichClaimsFromUserInfo(idTokenClaims, tokens),
+			tokens
+		};
+	}
+	async completeLogin(callbackUrl, transaction) {
+		const { claims, tokens } = await this.exchangeCallback(callbackUrl, transaction);
+		return {
+			...await (await UserCollection.create(this.classOptions)).getOrCreateFromOidc(claims, this.providerName),
+			claims,
+			tokens
+		};
+	}
+	validateCallback(callbackUrl, transaction) {
+		if (transaction.provider !== this.providerName) throw new OidcLoginError("OIDC login transaction provider mismatch.");
+		const url = callbackUrl instanceof URL ? callbackUrl : new URL(callbackUrl);
+		const error = url.searchParams.get("error");
+		if (error) {
+			const description = url.searchParams.get("error_description");
+			throw new OidcLoginError(description ? `OIDC provider returned "${error}": ${description}` : `OIDC provider returned "${error}".`);
+		}
+		const state = url.searchParams.get("state");
+		if (!state || state !== transaction.state) throw new OidcLoginError("OIDC state validation failed.");
+		const responseIssuer = url.searchParams.get("iss");
+		if (responseIssuer && normalizeIssuer(responseIssuer) !== this.provider.issuer) throw new OidcLoginError("OIDC response issuer validation failed.");
+		const code = url.searchParams.get("code");
+		if (!code) throw new OidcLoginError("OIDC callback missing authorization code.");
+		return code;
+	}
+	async exchangeCode(code, transaction) {
+		const metadata = await this.getMetadata();
+		const body = new URLSearchParams({
+			code,
+			code_verifier: transaction.codeVerifier,
+			grant_type: "authorization_code",
+			redirect_uri: this.provider.redirectUri
+		});
+		const headers = new Headers({
+			accept: "application/json",
+			"content-type": "application/x-www-form-urlencoded"
+		});
+		const authMethod = getTokenEndpointAuthMethod(this.provider);
+		if (authMethod === "client_secret_basic") {
+			if (!this.provider.clientSecret) throw new OidcLoginError(`OIDC provider "${this.providerName}" is missing clientSecret.`);
+			headers.set("authorization", `Basic ${encodeBasicAuth(this.provider.clientId, this.provider.clientSecret)}`);
+		} else {
+			body.set("client_id", this.provider.clientId);
+			if (authMethod === "client_secret_post") {
+				if (!this.provider.clientSecret) throw new OidcLoginError(`OIDC provider "${this.providerName}" is missing clientSecret.`);
+				body.set("client_secret", this.provider.clientSecret);
+			}
+		}
+		const response = await this.fetchImpl(metadata.token_endpoint, {
+			body,
+			headers,
+			method: "POST"
+		});
+		const json = await readJsonResponse(response, "OIDC token endpoint");
+		if (!response.ok) {
+			const providerError = asString(json.error);
+			const description = asString(json.error_description);
+			throw new OidcLoginError(description ? `OIDC token exchange failed (${providerError ?? response.status}): ${description}` : `OIDC token exchange failed (${providerError ?? response.status}).`);
+		}
+		return parseTokenResponse(json);
+	}
+	async enrichClaimsFromUserInfo(claims, tokens) {
+		if (claims.email || !tokens.accessToken) return claims;
+		const metadata = await this.getMetadata();
+		if (!metadata.userinfo_endpoint) return claims;
+		const tokenType = tokens.tokenType ?? "Bearer";
+		const response = await this.fetchImpl(metadata.userinfo_endpoint, { headers: {
+			accept: "application/json",
+			authorization: `${tokenType} ${tokens.accessToken}`
+		} });
+		if (!response.ok) throw new OidcLoginError(`OIDC userinfo request failed (${response.status}).`);
+		return mergeClaims(claims, normalizeClaims(await readJsonResponse(response, "OIDC userinfo endpoint"), metadata.issuer, "OIDC userinfo"));
+	}
+	async verifyIdToken(idToken, expectedNonce) {
+		const metadata = await this.getMetadata();
+		this.remoteJwks ??= createRemoteJWKSet(new URL(metadata.jwks_uri), { [customFetch]: this.fetchImpl });
+		const { payload } = await jwtVerify(idToken, this.remoteJwks, {
+			audience: this.provider.clientId,
+			clockTolerance: this.clockTolerance,
+			issuer: metadata.issuer
+		});
+		validateAuthorizedParty(payload, this.provider.clientId);
+		if (payload.nonce !== expectedNonce) throw new OidcLoginError("OIDC nonce validation failed.");
+		return normalizeClaims(payload, metadata.issuer, "OIDC ID token");
+	}
+};
+//#endregion
+//#region src/services/PermissionResolver.ts
+var PermissionResolver = class PermissionResolver {
+	options;
+	membershipCollection;
+	rolePermissionCollection;
+	membershipOverrideCollection;
+	groupMemberCollection;
+	groupRoleCollection;
+	permissionCollection;
+	tenantCollection;
+	tenantPermissionOverrideCollection;
+	constructor(options) {
+		this.options = options;
+	}
+	/**
+	* Initialize collections
+	*
+	* Each collection is created via the inherited static `SmrtCollection.create()`
+	* factory, which is generically typed to return the concrete subclass instance.
+	*/
+	async initialize() {
+		this.membershipCollection = await MembershipCollection.create(this.options);
+		this.rolePermissionCollection = await RolePermissionCollection.create(this.options);
+		this.membershipOverrideCollection = await MembershipOverrideCollection.create(this.options);
+		this.groupMemberCollection = await GroupMemberCollection.create(this.options);
+		this.groupRoleCollection = await GroupRoleCollection.create(this.options);
+		this.permissionCollection = await PermissionCollection.create(this.options);
+		this.tenantCollection = await TenantCollection.create(this.options);
+		this.tenantPermissionOverrideCollection = await TenantPermissionOverrideCollection.create(this.options);
+	}
+	/**
+	* Resolve effective permissions for a tenant, considering hierarchy inheritance.
+	*
+	* Algorithm:
+	* 1. Get the tenant and its ancestors (from root to immediate parent)
+	* 2. Batch fetch all permission overrides for the entire chain (single query)
+	* 3. Walk down the chain, building up permissions:
+	*    - Start with root tenant's permissions
+	*    - For each child: if parent.cascadePermissions && child.inheritPermissions:
+	*      - Merge parent's permissions
+	*      - Apply child's overrides (GRANT adds, DENY removes)
+	* 4. Return the final effective permission set
+	*/
+	async resolveTenantPermissions(tenantId) {
+		const result = {
+			permissions: /* @__PURE__ */ new Set(),
+			contributingTenantIds: [],
+			inheritanceActive: false,
+			deniedPermissions: /* @__PURE__ */ new Set()
+		};
+		const tenant = await this.tenantCollection.get({ id: tenantId });
+		if (!tenant) return result;
+		const chain = [...await this.tenantCollection.getAncestorsFromRoot(tenantId), tenant];
+		const chainTenantIds = chain.map((t) => t.id);
+		const allOverridesMap = await this.tenantPermissionOverrideCollection.getOverridesByEffectBatch(chainTenantIds);
+		const allPermissionIds = /* @__PURE__ */ new Set();
+		const deniedPermissionIds = /* @__PURE__ */ new Set();
+		for (const overrides of allOverridesMap.values()) {
+			for (const id of overrides.grantedPermissionIds) allPermissionIds.add(id);
+			for (const id of overrides.deniedPermissionIds) {
+				allPermissionIds.add(id);
+				deniedPermissionIds.add(id);
+			}
+		}
+		let inheritedPermissions = /* @__PURE__ */ new Set();
+		for (let i = 0; i < chain.length; i++) {
+			const current = chain[i];
+			const isFirst = i === 0;
+			const previous = isFirst ? null : chain[i - 1];
+			const shouldInherit = !isFirst && previous?.cascadePermissions && current.inheritPermissions;
+			if (shouldInherit) result.inheritanceActive = true;
+			const overrides = allOverridesMap.get(current.id) ?? {
+				grantedPermissionIds: [],
+				deniedPermissionIds: [],
+				inheritedPermissionIds: []
+			};
+			const currentPermissions = /* @__PURE__ */ new Set();
+			let contributed = false;
+			if (shouldInherit && inheritedPermissions.size > 0) {
+				for (const permId of inheritedPermissions) currentPermissions.add(permId);
+				contributed = true;
+			}
+			for (const permId of overrides.grantedPermissionIds) {
+				currentPermissions.add(permId);
+				contributed = true;
+			}
+			for (const permId of overrides.deniedPermissionIds) if (currentPermissions.has(permId)) {
+				currentPermissions.delete(permId);
+				contributed = true;
+			}
+			if (contributed && !result.contributingTenantIds.includes(current.id)) result.contributingTenantIds.push(current.id);
+			inheritedPermissions = currentPermissions;
+		}
+		if (allPermissionIds.size > 0) {
+			const permissionsMap = await this.permissionCollection.findByIds(Array.from(allPermissionIds));
+			for (const permId of inheritedPermissions) {
+				const perm = permissionsMap.get(permId);
+				if (perm?.slug) result.permissions.add(perm.slug);
+			}
+			for (const permId of deniedPermissionIds) {
+				if (inheritedPermissions.has(permId)) continue;
+				const perm = permissionsMap.get(permId);
+				if (perm?.slug) result.deniedPermissions.add(perm.slug);
+			}
+		}
+		return result;
+	}
+	/**
+	* Get the inheritance chain for a tenant (for debugging/display purposes)
+	*/
+	async getTenantInheritanceChain(tenantId) {
+		const tenant = await this.tenantCollection.get({ id: tenantId });
+		if (!tenant) return [];
+		const ancestors = await this.tenantCollection.getAncestorsFromRoot(tenantId);
+		const chain = [];
+		for (let i = 0; i < ancestors.length; i++) {
+			const current = ancestors[i];
+			const next = i + 1 < ancestors.length ? ancestors[i + 1] : tenant;
+			chain.push({
+				tenant: current,
+				inherits: false,
+				cascades: current.cascadePermissions && next.inheritPermissions
+			});
+		}
+		chain.push({
+			tenant,
+			inherits: tenant.inheritPermissions && ancestors.length > 0,
+			cascades: tenant.cascadePermissions
+		});
+		return chain;
+	}
+	/**
+	* Resolve all effective permissions for a user in a tenant.
+	*
+	* Precedence (broad -> specific, most-specific wins):
+	*   tenant-inherited (cascade)
+	*     -> role
+	*     -> group roles
+	*     -> tenant-DENY      (removes; overrides role/group grants, tenant-wide)
+	*     -> membership GRANT (re-adds; most specific, can win over a tenant-DENY)
+	*     -> membership DENY  (absolute; always wins)
+	*
+	* Algorithm:
+	* 1. Get membership and collect all permission IDs from all sources
+	* 2. Batch fetch all permissions in a single query
+	* 3. Apply permissions from role, then groups
+	* 4. Subtract tenant-level DENY'd slugs (hard tenant-wide block)
+	* 5. Apply membership GRANT overrides (can re-add a tenant-DENY'd slug)
+	* 6. Subtract membership DENY overrides (absolute precedence)
+	*/
+	async resolvePermissions(userId, tenantId, options = {}) {
+		const result = {
+			permissions: /* @__PURE__ */ new Set(),
+			membershipId: null,
+			roleId: null,
+			groupIds: [],
+			deniedPermissionIds: []
+		};
+		const membership = options.membership === void 0 ? await this.membershipCollection.findByUserAndTenant(userId, tenantId) : options.membership;
+		if (!membership || !membership.isActive()) return result;
+		if (membership.userId !== userId || membership.tenantId !== tenantId) return result;
+		result.membershipId = membership.id ?? null;
+		result.roleId = membership.roleId ?? null;
+		const tenantPermissions = await this.resolveTenantPermissions(tenantId);
+		for (const slug of tenantPermissions.permissions) result.permissions.add(slug);
+		if (!membership.roleId) return result;
+		const allPermissionIds = /* @__PURE__ */ new Set();
+		const rolePermissionIds = [];
+		const groupRolePermissionIds = /* @__PURE__ */ new Map();
+		const baseRolePermIds = await this.rolePermissionCollection.getPermissionIds(membership.roleId);
+		for (const id of baseRolePermIds) {
+			allPermissionIds.add(id);
+			rolePermissionIds.push(id);
+		}
+		const groupIds = await this.groupMemberCollection.getGroupIdsForTenant(userId, tenantId);
+		result.groupIds = groupIds;
+		for (const groupId of groupIds) {
+			const groupRoleIds = await this.groupRoleCollection.getRoleIds(groupId);
+			for (const roleId of groupRoleIds) {
+				const permIds = await this.rolePermissionCollection.getPermissionIds(roleId);
+				for (const id of permIds) allPermissionIds.add(id);
+				groupRolePermissionIds.set(roleId, permIds);
+			}
+		}
+		if (!membership.id) return result;
+		const membershipId = membership.id;
+		const grantedPermissionIds = await this.membershipOverrideCollection.getGrantedPermissionIds(membershipId);
+		const deniedPermissionIds = await this.membershipOverrideCollection.getDeniedPermissionIds(membershipId);
+		result.deniedPermissionIds = deniedPermissionIds;
+		for (const id of grantedPermissionIds) allPermissionIds.add(id);
+		for (const id of deniedPermissionIds) allPermissionIds.add(id);
+		const permissionsMap = await this.permissionCollection.findByIds(Array.from(allPermissionIds));
+		const permissionIdToSlug = /* @__PURE__ */ new Map();
+		for (const [id, perm] of permissionsMap) if (perm.slug) permissionIdToSlug.set(id, perm.slug);
+		for (const permId of rolePermissionIds) {
+			const slug = permissionIdToSlug.get(permId);
+			if (slug) result.permissions.add(slug);
+		}
+		for (const permIds of groupRolePermissionIds.values()) for (const permId of permIds) {
+			const slug = permissionIdToSlug.get(permId);
+			if (slug) result.permissions.add(slug);
+		}
+		for (const slug of tenantPermissions.deniedPermissions) result.permissions.delete(slug);
+		for (const permId of grantedPermissionIds) {
+			const slug = permissionIdToSlug.get(permId);
+			if (slug) result.permissions.add(slug);
+		}
+		for (const permId of deniedPermissionIds) {
+			const slug = permissionIdToSlug.get(permId);
+			if (slug) result.permissions.delete(slug);
+		}
+		return result;
+	}
+	/**
+	* Check if a user has a specific permission in a tenant
+	*/
+	async hasPermission(userId, tenantId, permissionSlug, options = {}) {
+		return (await this.resolvePermissions(userId, tenantId, options)).permissions.has(permissionSlug);
+	}
+	/**
+	* Check if a user has all of the specified permissions
+	*/
+	async hasAllPermissions(userId, tenantId, permissionSlugs, options = {}) {
+		const result = await this.resolvePermissions(userId, tenantId, options);
+		return permissionSlugs.every((slug) => result.permissions.has(slug));
+	}
+	/**
+	* Check if a user has any of the specified permissions
+	*/
+	async hasAnyPermission(userId, tenantId, permissionSlugs, options = {}) {
+		const result = await this.resolvePermissions(userId, tenantId, options);
+		return permissionSlugs.some((slug) => result.permissions.has(slug));
+	}
+	/**
+	* Static factory method
+	*/
+	static async create(options) {
+		const resolver = new PermissionResolver(options);
+		await resolver.initialize();
+		return resolver;
+	}
+};
+//#endregion
+//#region src/services/SessionService.ts
+var SessionService = class SessionService {
+	options;
+	sessionCollection;
+	userCollection;
+	membershipCollection;
+	permissionResolver;
+	defaultTTL;
+	autoExtend;
+	constructor(options) {
+		this.options = options;
+		this.defaultTTL = options.defaultTTL ?? 604800;
+		this.autoExtend = options.autoExtend ?? false;
+	}
+	/**
+	* Initialize collections
+	*/
+	async initialize() {
+		this.sessionCollection = await SessionCollection.create(this.options);
+		this.userCollection = await UserCollection.create(this.options);
+		this.membershipCollection = await MembershipCollection.create(this.options);
+		this.permissionResolver = await PermissionResolver.create(this.options);
+	}
+	/**
+	* Create a new session for a user
+	*
+	* @param userId - The user ID
+	* @param tenantId - Optional tenant context
+	* @param options - Additional session options
+	* @returns The session ID
+	*/
+	async createSession(userId, tenantId, options) {
+		return (await this.sessionCollection.createSession({
+			userId,
+			tenantId,
+			ttl: options?.ttl ?? this.defaultTTL,
+			userAgent: options?.userAgent,
+			ipAddress: options?.ipAddress,
+			data: options?.data
+		})).id;
+	}
+	/**
+	* Load full session context (user + permissions)
+	*
+	* Returns null if session is invalid or user doesn't exist
+	*/
+	async loadSessionContext(sessionId) {
+		const session = await this.sessionCollection.findValidSession(sessionId);
+		if (!session) return null;
+		const user = await this.userCollection.get(session.userId);
+		if (!user || !user.isActive()) return null;
+		let permissions = [];
+		let membership = null;
+		if (session.tenantId) {
+			const resolvedMembership = await this.membershipCollection.findByUserAndTenant(session.userId, session.tenantId);
+			membership = resolvedMembership?.isActive() ? resolvedMembership : null;
+			const result = await this.permissionResolver.resolvePermissions(session.userId, session.tenantId, { membership });
+			permissions = Array.from(result.permissions);
+		}
+		if (this.autoExtend) session.extend(this.defaultTTL);
+		else session.touch();
+		await session.save();
+		return {
+			user,
+			membership,
+			permissions,
+			tenantId: session.tenantId,
+			sessionId: session.id
+		};
+	}
+	/**
+	* Get the initialized database connection backing this session service.
+	*/
+	getDatabase() {
+		return this.sessionCollection.db;
+	}
+	/**
+	* Refresh session (extend expiry, update lastAccessed)
+	*/
+	async refreshSession(sessionId) {
+		return this.sessionCollection.touch(sessionId, true, this.defaultTTL);
+	}
+	/**
+	* Destroy a session (revoke it)
+	*/
+	async destroySession(sessionId) {
+		return this.sessionCollection.revokeSession(sessionId);
+	}
+	/**
+	* Destroy all sessions for a user (logout from all devices)
+	*/
+	async destroyAllUserSessions(userId) {
+		return this.sessionCollection.revokeUserSessions(userId);
+	}
+	/**
+	* Switch tenant context for a session.
+	*
+	* A session's `tenantId` is the tenant-isolation key for every `@TenantScoped`
+	* query, so it must never be set to a tenant the session's user is not an
+	* active member of — otherwise a caller could read/write another tenant's data
+	* by feeding an arbitrary id here (e.g. straight from untrusted form data).
+	*
+	* Fail-closed (#1400): the user's ACTIVE membership in the target tenant is
+	* verified BEFORE any write. A non-member switch returns
+	* `{ switched: false, ... }` and mutates nothing.
+	*
+	* Session-id ROTATION (#1354 follow-up): a successful switch into a non-null
+	* tenant mints a BRAND-NEW session (fresh secure id, fresh TTL) for the same
+	* user with the new tenant, then REVOKES the old session — so any captured
+	* pre-switch session id immediately stops validating, shrinking the blast
+	* radius of a leaked id across a privilege/tenant boundary. The device context
+	* (user agent, IP, custom data) carries over to the new session. Callers MUST
+	* persist the returned `sessionId` (e.g. re-set the cookie).
+	*
+	* Passing `null` clears the tenant context, is always allowed, and stays
+	* in-place (no rotation — there is no privilege boundary being crossed).
+	*
+	* @returns A {@link SwitchTenantResult}; check `switched` for success.
+	*/
+	async switchTenant(sessionId, tenantId) {
+		const failClosed = {
+			switched: false,
+			sessionId: null,
+			session: null,
+			rotated: false
+		};
+		const session = await this.sessionCollection.findValidSession(sessionId);
+		if (!session) return failClosed;
+		if (tenantId === null) {
+			if (!await this.sessionCollection.setSessionTenant(sessionId, null)) return failClosed;
+			return {
+				switched: true,
+				sessionId,
+				session: await this.sessionCollection.findValidSession(sessionId),
+				rotated: false
+			};
+		}
+		const membership = await this.membershipCollection.findByUserAndTenant(session.userId, tenantId);
+		if (!membership || !membership.isActive()) return failClosed;
+		await this.sessionCollection.revokeSession(sessionId);
+		const rotated = await this.sessionCollection.createSession({
+			userId: session.userId,
+			tenantId,
+			ttl: this.defaultTTL,
+			userAgent: session.userAgent,
+			ipAddress: session.ipAddress,
+			data: session.data
+		});
+		return {
+			switched: true,
+			sessionId: rotated.id,
+			session: rotated,
+			rotated: true
+		};
+	}
+	/**
+	* Get all active sessions for a user (for "manage sessions" UI)
+	*/
+	async getUserSessions(userId) {
+		return this.sessionCollection.findByUser(userId);
+	}
+	/**
+	* Clean up expired sessions (run periodically)
+	*/
+	async cleanupExpiredSessions() {
+		return this.sessionCollection.deleteExpired();
+	}
+	/**
+	* Check if a permission is granted for the session
+	*/
+	async hasPermission(sessionId, permission) {
+		const context = await this.loadSessionContext(sessionId);
+		if (!context) return false;
+		return context.permissions.includes(permission);
+	}
+	/**
+	* Get session data
+	*/
+	async getSessionData(sessionId, key) {
+		return this.sessionCollection.getSessionData(sessionId, key);
+	}
+	/**
+	* Set session data
+	*/
+	async setSessionData(sessionId, key, value) {
+		return this.sessionCollection.setSessionData(sessionId, key, value);
+	}
+	/**
+	* Static factory method
+	*/
+	static async create(options) {
+		const service = new SessionService(options);
+		await service.initialize();
+		return service;
+	}
+};
+//#endregion
+//#region src/services/SessionPermissionContext.ts
+var requestPermissionContextStorage = new AsyncLocalStorage();
+function getCurrentSessionPermissionContext() {
+	return requestPermissionContextStorage.getStore();
+}
+function getRequestScopedDatabase() {
+	return getCurrentSessionPermissionContext()?.database;
+}
+globalThis.__smrtGetRequestPermissionContext ??= getCurrentSessionPermissionContext;
+globalThis.__smrtGetRequestScopedDatabase ??= getRequestScopedDatabase;
+function isProbablyPostgres(configDb, database) {
+	if (configDb && typeof configDb === "object" && !("query" in configDb) && "type" in configDb && configDb.type === "postgres") return true;
+	if (typeof database.url === "string" && database.url.startsWith("postgres")) return true;
+	return (database.constructor?.name || "").toLowerCase().includes("postgres");
+}
+async function setPostgresSessionVariables(database, context) {
+	await database.query("SELECT set_config('smrt.tenant_id', $1, true)", context.tenantId ?? "");
+	await database.query("SELECT set_config('smrt.user_id', $1, true)", context.userId ?? "");
+	await database.query("SELECT set_config('smrt.session_id', $1, true)", context.sessionId ?? "");
+	await database.query("SELECT set_config('smrt.permissions', $1, true)", JSON.stringify(context.permissions));
+	await database.query("SELECT set_config('smrt.super_admin_bypass', $1, true)", context.superAdminBypass ? "true" : "false");
+	await database.query("SELECT set_config('smrt.system_context', $1, true)", context.systemContext ? "true" : "false");
+}
+function isModuleNotFoundError(error) {
+	return error instanceof Error && (error.code === "ERR_MODULE_NOT_FOUND" || /Cannot find package '@happyvertical\/smrt-tenancy'/.test(error.message));
+}
+async function runWithOptionalTenantContext(options, context, fn) {
+	if (options.systemContext) try {
+		return await (await import("@happyvertical/smrt-tenancy")).withSystemContext(fn);
+	} catch (error) {
+		if (isModuleNotFoundError(error)) return await fn();
+		throw error;
+	}
+	if (!options.enterTenantContext || !context.tenantId) return await fn();
+	try {
+		return await (await import("@happyvertical/smrt-tenancy")).withTenant({
+			database: context.database,
+			permissions: context.permissionSet,
+			superAdminBypass: context.superAdminBypass,
+			tenantId: context.tenantId,
+			user: context.user ?? void 0,
+			userId: context.userId ?? void 0
+		}, fn);
+	} catch (error) {
+		if (isModuleNotFoundError(error)) return await fn();
+		throw error;
+	}
+}
+async function withSessionPermissionContext(options, fn) {
+	const { enterTenantContext: _enterTenantContext, postgresRls: _postgresRls, sessionId: _sessionId, sessionService: _sessionService, superAdminBypass: _superAdminBypass, systemContext: _systemContext, ...sessionServiceOptions } = options;
+	const sessionService = options.sessionService ?? await SessionService.create({ ...sessionServiceOptions });
+	const configuredDb = sessionServiceOptions.db ?? sessionServiceOptions.persistence;
+	const session = options.sessionId === void 0 || options.sessionId === null ? null : await sessionService.loadSessionContext(options.sessionId);
+	const permissionSet = new Set(session?.permissions ?? []);
+	const baseDatabase = sessionService.getDatabase();
+	const config = getPackageConfig("users", {});
+	const usePostgresRls = (options.postgresRls ?? config.permissions?.postgres?.enabled ?? false) && isProbablyPostgres(configuredDb, baseDatabase);
+	let transaction;
+	let rolledBack = false;
+	if (usePostgresRls) {
+		if (!baseDatabase.beginTransaction) throw new Error("Postgres RLS requires a database adapter that supports beginTransaction().");
+		transaction = await baseDatabase.beginTransaction();
+	}
+	const runtimeContext = {
+		database: transaction ?? baseDatabase,
+		permissions: session?.permissions ?? [],
+		permissionSet,
+		membership: session?.membership ?? null,
+		postgresRls: usePostgresRls,
+		session,
+		sessionId: session?.sessionId ?? null,
+		superAdminBypass: options.superAdminBypass ?? false,
+		systemContext: options.systemContext ?? false,
+		tenantId: session?.tenantId ?? null,
+		user: session?.user ?? null,
+		userId: session?.user.id ?? null
+	};
+	try {
+		if (transaction) await setPostgresSessionVariables(transaction, runtimeContext);
+		return await requestPermissionContextStorage.run(runtimeContext, async () => runWithOptionalTenantContext(options, runtimeContext, () => fn(runtimeContext)));
+	} catch (error) {
+		if (transaction) {
+			if (transaction.isActive ? transaction.isActive() : true) {
+				rolledBack = true;
+				await transaction.rollback();
+			}
+		}
+		throw error;
+	} finally {
+		if (transaction && !rolledBack) {
+			if (transaction.isActive ? transaction.isActive() : true) await transaction.commit();
+		}
+	}
+}
+//#endregion
+//#region src/services/TerminalAuthService.ts
+var DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS = 2;
+var DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS = 600;
+var DEFAULT_CLI_SESSION_TTL_SECONDS = 720 * 60 * 60;
+function base64url(bytes) {
+	return bytes.toString("base64url");
+}
+function hashDeviceCode(deviceCode) {
+	return createHash("sha256").update(deviceCode).digest("hex");
+}
+function isExpired(request) {
+	return new Date(request.expiresAt).getTime() <= Date.now();
+}
+var TerminalAuthService = class TerminalAuthService {
+	options;
+	userCodePrefix;
+	requestTtlSeconds;
+	sessionTtlSeconds;
+	pollIntervalSeconds;
+	verificationPath;
+	maxApproveAttempts;
+	approveAttemptWindowMs;
+	failedApprovesByUser = /* @__PURE__ */ new Map();
+	requestCollection;
+	sessionService;
+	constructor(options) {
+		this.options = options;
+		this.userCodePrefix = (options.userCodePrefix ?? "").trim().toUpperCase();
+		this.requestTtlSeconds = options.requestTtlSeconds ?? 600;
+		this.sessionTtlSeconds = options.sessionTtlSeconds ?? 2592e3;
+		this.pollIntervalSeconds = options.pollIntervalSeconds ?? 2;
+		this.maxApproveAttempts = options.maxApproveAttempts ?? 5;
+		this.approveAttemptWindowMs = (options.approveAttemptWindowSeconds ?? 300) * 1e3;
+		const verificationPath = options.verificationPath ?? "/terminal-login";
+		this.verificationPath = verificationPath.startsWith("/") ? verificationPath : `/${verificationPath}`;
+	}
+	async initialize() {
+		this.requestCollection = await UsersCliAuthRequestCollection.create(this.options);
+		this.sessionService = await SessionService.create({
+			...this.options,
+			autoExtend: this.options.sessionAutoExtend ?? true,
+			cookieName: this.options.sessionCookieName,
+			defaultTTL: this.sessionTtlSeconds
+		});
+	}
+	static async create(options) {
+		const service = new TerminalAuthService(options);
+		await service.initialize();
+		return service;
+	}
+	makeUserCode() {
+		const raw = randomBytes(6).toString("hex").toUpperCase().slice(0, 8);
+		return this.userCodePrefix ? `${this.userCodePrefix}-${raw}` : raw;
+	}
+	/**
+	* Generate a user code that is not currently in use by another *active*
+	* (pending or approved-but-unclaimed) request. Collisions are vanishingly
+	* rare (1 in 2^32 per attempt) but happen at scale; retrying keeps the
+	* affected CLI from being locked out.
+	*/
+	async makeUniqueUserCode(maxAttempts = 5) {
+		for (let attempt = 0; attempt < maxAttempts; attempt++) {
+			const candidate = this.makeUserCode();
+			const existing = await this.requestCollection.findByUserCode(candidate);
+			if (!existing || existing.status === "expired") return candidate;
+		}
+		throw new TerminalAuthError("Unable to generate a unique terminal user code; try again.");
+	}
+	/**
+	* Start a new request. Returns the device code the CLI keeps secret, the
+	* user code the human types into the browser, and the verification URL to
+	* open. The device code is stored only as a hash.
+	*/
+	async createRequest(origin) {
+		const trimmedOrigin = origin.replace(/\/+$/u, "");
+		const deviceCode = base64url(randomBytes(32));
+		const userCode = await this.makeUniqueUserCode();
+		const expiresAt = new Date(Date.now() + this.requestTtlSeconds * 1e3);
+		await (await this.requestCollection.create({
+			deviceCodeHash: hashDeviceCode(deviceCode),
+			expiresAt,
+			status: "pending",
+			userCode
+		})).save();
+		return {
+			deviceCode,
+			expiresAt: expiresAt.toISOString(),
+			interval: this.pollIntervalSeconds,
+			userCode,
+			verificationUrl: `${trimmedOrigin}${this.verificationPath}?code=${encodeURIComponent(userCode)}`
+		};
+	}
+	/**
+	* Look up a request by user code. Performs lazy expiry: pending requests
+	* past their TTL are flipped to `expired` and persisted.
+	*/
+	async getRequestForUserCode(userCode) {
+		const request = await this.requestCollection.findByUserCode(userCode);
+		if (!request) return null;
+		if (request.status === "pending" && isExpired(request)) {
+			request.status = "expired";
+			await request.save();
+		}
+		return request;
+	}
+	/**
+	* Mark a pending request as approved and mint a bearer session bound to the
+	* approving user. Idempotent: re-approving an already-approved request is a
+	* no-op. Throws if the user/tenant are missing, the request is unknown, or
+	* the request has expired.
+	*/
+	async approveRequest(input) {
+		if (!input.user.id || !input.tenantId) throw new TerminalAuthError("An authenticated tenant session is required.");
+		this.assertApproveRateLimit(input.user.id);
+		const request = await this.getRequestForUserCode(input.userCode);
+		if (!request) {
+			this.recordFailedApprove(input.user.id);
+			throw new TerminalAuthError("Terminal login request not found.");
+		}
+		if (request.status === "approved") return request;
+		if (request.status !== "pending" || isExpired(request)) {
+			request.status = "expired";
+			await request.save();
+			this.recordFailedApprove(input.user.id);
+			throw new TerminalAuthError("Terminal login request has expired.");
+		}
+		const sessionId = await this.sessionService.createSession(input.user.id, input.tenantId, {
+			data: {
+				approvedBy: input.user.email ?? input.user.id,
+				kind: "terminal"
+			},
+			ipAddress: input.ipAddress,
+			ttl: this.sessionTtlSeconds,
+			userAgent: input.userAgent
+		});
+		request.approvedAt = /* @__PURE__ */ new Date();
+		request.sessionId = sessionId;
+		request.status = "approved";
+		request.tenantId = input.tenantId;
+		request.userId = input.user.id;
+		await request.save();
+		this.failedApprovesByUser.delete(input.user.id);
+		return request;
+	}
+	/**
+	* Throw {@link TerminalAuthRateLimitError} if the user has exceeded the
+	* configured failed-approve budget inside the current sliding window.
+	*/
+	assertApproveRateLimit(userId) {
+		const tracking = this.failedApprovesByUser.get(userId);
+		if (!tracking) return;
+		const elapsedMs = Date.now() - tracking.firstAttemptAt;
+		if (elapsedMs >= this.approveAttemptWindowMs) {
+			this.failedApprovesByUser.delete(userId);
+			return;
+		}
+		if (tracking.count >= this.maxApproveAttempts) throw new TerminalAuthRateLimitError("Too many failed terminal-login attempts. Try again later.", Math.max(1, Math.ceil((this.approveAttemptWindowMs - elapsedMs) / 1e3)));
+	}
+	/** Increment the failed-approve counter for `userId`, starting the window if needed. */
+	recordFailedApprove(userId) {
+		const tracking = this.failedApprovesByUser.get(userId);
+		if (!tracking) {
+			this.failedApprovesByUser.set(userId, {
+				count: 1,
+				firstAttemptAt: Date.now()
+			});
+			return;
+		}
+		tracking.count += 1;
+	}
+	/**
+	* Exchange a device code (the secret the CLI keeps) for an access token
+	* once the request has been approved. Returns `{ status: 'pending' }` while
+	* the CLI should keep polling, and `{ status: 'expired' }` if the request
+	* was never approved within its TTL.
+	*/
+	async exchangeDeviceCode(deviceCode) {
+		const request = await this.requestCollection.findByDeviceCodeHash(hashDeviceCode(deviceCode));
+		if (!request) return { status: "expired" };
+		if (request.status === "approved" && request.sessionId) return {
+			accessToken: request.sessionId,
+			expiresIn: this.sessionTtlSeconds,
+			status: "approved",
+			tokenType: "Bearer"
+		};
+		if (isExpired(request)) {
+			if (request.status === "pending") {
+				request.status = "expired";
+				await request.save();
+			}
+			return { status: "expired" };
+		}
+		if (request.status === "pending") return {
+			expiresAt: new Date(request.expiresAt).toISOString(),
+			interval: this.pollIntervalSeconds,
+			status: "pending"
+		};
+		return { status: "expired" };
+	}
+	/**
+	* Resolve a bearer token issued by this service into a full session
+	* context — load the user, permissions, and tenant just like the cookie
+	* path does. Returns `null` if the token is unknown, expired, or revoked.
+	*/
+	async loadBearerSession(token) {
+		return this.sessionService.loadSessionContext(token);
+	}
+	/**
+	* Revoke a bearer token (CLI logout). Returns true if a session was
+	* actually revoked.
+	*/
+	async destroyBearerSession(token) {
+		return this.sessionService.destroySession(token);
+	}
+	/**
+	* Delete expired pending requests (cleanup job).
+	*/
+	async cleanupExpiredRequests() {
+		return this.requestCollection.deleteExpired();
+	}
+	/** The default polling interval clients should use. Exposed for tests. */
+	get pollInterval() {
+		return this.pollIntervalSeconds;
+	}
+};
+var TerminalAuthError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "TerminalAuthError";
+	}
+};
+var TerminalAuthRateLimitError = class extends TerminalAuthError {
+	retryAfterSeconds;
+	constructor(message, retryAfterSeconds) {
+		super(message);
+		this.name = "TerminalAuthRateLimitError";
+		this.retryAfterSeconds = retryAfterSeconds;
+	}
+};
+//#endregion
+export { DEFAULT_ROLE_SLUGS as $, RolePermissionCollection as A, GroupRoleCollection as B, TenantHierarchyError as C, DEFAULT_SESSION_TTL as D, SessionCollection as E, parsePermissionSlug as F, Group as G, GroupMemberCollection as H, MembershipOverrideCollection as I, User as J, UsersCliAuthRequestCollection as K, MembershipOverride as L, PermissionCollection as M, Permission as N, Session as O, isValidPermissionSlug as P, DEFAULT_ROLES as Q, MembershipCollection as R, TenantCollection as S, Tenant as T, GroupMember as U, GroupRole as V, GroupCollection as W, normalizeEmail as X, isValidEmail as Y, AccessRequestStatus as Z, resolveOidcProviderConfig as _, TerminalAuthRateLimitError as a, TenantStatus as at, TenantPermissionOverrideCollection as b, getRequestScopedDatabase as c, PermissionResolver as d, DEFAULT_TENANT_POLICY as et, OidcLoginError as f, getUsersOidcConfig as g, encodeOidcTransaction as h, TerminalAuthError as i, TenantPermissionEffect as it, RolePermission as j, generateSessionId as k, withSessionPermissionContext as l, decodeOidcTransaction as m, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS as n, OverrideEffect as nt, TerminalAuthService as o, UserStatus as ot, OidcLoginService as p, UsersCliAuthRequest as q, DEFAULT_CLI_SESSION_TTL_SECONDS as r, SessionStatus as rt, getCurrentSessionPermissionContext as s, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS as t, MembershipStatus as tt, SessionService as u, webapi_exports as v, MAX_TENANT_HIERARCHY_DEPTH as w, TenantPermissionOverride as x, UserCollection as y, Membership as z };
+
+//# sourceMappingURL=TerminalAuthService-BXAAuaXf.js.map