@happyvertical/smrt-users 0.38.11 → 0.38.13

package/dist/collections/TenantIntegrationCollection.d.ts

@@ -0,0 +1,9 @@
+import { SmrtCollection } from '@happyvertical/smrt-core';
+import { TenantIntegration, TenantIntegrationProvider } from '../models/TenantIntegration.js';
+export declare class TenantIntegrationCollection extends SmrtCollection<TenantIntegration> {
+    static readonly _itemClass: typeof TenantIntegration;
+    listForTenant(tenantId: string): Promise<TenantIntegration[]>;
+    findFor(tenantId: string, provider: TenantIntegrationProvider): Promise<TenantIntegration | null>;
+    findOrInit(tenantId: string, provider: TenantIntegrationProvider): Promise<TenantIntegration>;
+}
+//# sourceMappingURL=TenantIntegrationCollection.d.ts.map

package/dist/collections/TenantIntegrationCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantIntegrationCollection.d.ts","sourceRoot":"","sources":["../../src/collections/TenantIntegrationCollection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACL,iBAAiB,EACjB,KAAK,yBAAyB,EAC/B,MAAM,gCAAgC,CAAC;AAExC,qBAAa,2BAA4B,SAAQ,cAAc,CAAC,iBAAiB,CAAC;IAChF,MAAM,CAAC,QAAQ,CAAC,UAAU,2BAAqB;IAEzC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAO7D,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAM9B,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,iBAAiB,CAAC;CA0B9B"}

package/dist/collections/index.d.ts

@@ -15,6 +15,7 @@ export { RoleCollection, type SeedSystemRolesOptions, } from './RoleCollection.j
 export { DEFAULT_ROLE_PERMISSION_PATTERNS, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, } from './RolePermissionCollection.js';
 export { type CreateSessionOptions, SessionCollection, } from './SessionCollection.js';
 export { type CreateChildTenantOptions, TenantCollection, TenantHierarchyError, } from './TenantCollection.js';
+export { TenantIntegrationCollection } from './TenantIntegrationCollection.js';
 export { TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, } from './TenantPermissionOverrideCollection.js';
 export { type GetOrCreateFromOidcOptions, type OidcClaims, type OidcIdentityResult, UserCollection, } from './UserCollection.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/collections/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collections/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,cAAc,EACd,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,oBAAoB,EACzB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kCAAkC,EAClC,KAAK,8BAA8B,GACpC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,cAAc,GACf,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collections/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,cAAc,EACd,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,oBAAoB,EACzB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,kCAAkC,EAClC,KAAK,8BAA8B,GACpC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,cAAc,GACf,MAAM,qBAAqB,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { AccessRequestCollection, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type OidcClaims, type OidcIdentityResult, PermissionCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthRequestCollection, UsersMagicLinkTokenCollection, } from './collections/index.js';
-export { AccessRequest, type AccessRequestOptions, CliAuthRequest, type CliAuthRequestStatus, DEFAULT_SESSION_TTL, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupMember, GroupRole, generateSessionId, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkToken, Membership, MembershipOverride, Permission, Role, RolePermission, Session, Tenant, TenantPermissionOverride, User, UsersCliAuthRequest, UsersMagicLinkToken, } from './models/index.js';
+export { AccessRequestCollection, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type OidcClaims, type OidcIdentityResult, PermissionCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantIntegrationCollection, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthRequestCollection, UsersMagicLinkTokenCollection, } from './collections/index.js';
+export { AccessRequest, type AccessRequestOptions, CliAuthRequest, type CliAuthRequestStatus, DEFAULT_SESSION_TTL, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupMember, GroupRole, generateSessionId, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkToken, Membership, MembershipOverride, Permission, Role, RolePermission, Session, Tenant, TenantIntegration, type TenantIntegrationCheckSummary, type TenantIntegrationOptions, type TenantIntegrationProvider, type TenantIntegrationStatus, TenantPermissionOverride, User, UsersCliAuthRequest, UsersMagicLinkToken, } from './models/index.js';
 export { ACCESS_REQUEST_CAPABILITIES, type AccessRequestAuthorizationContext, type AccessRequestAuthorizer, type AccessRequestCapability, AccessRequestError, type AccessRequestErrorCode, type AccessRequestEvent, type AccessRequestEventHandler, type AccessRequestEventType, AccessRequestService, type AccessRequestServiceOptions, type ApproveAccessRequestOptions, type ApproveCliAuthRequestInput, applyPostgresPermissionPolicies, assertOperationPermission, type CancelAccessRequestOptions, type CliAuthStartResult, type CliAuthTokenResult, type CreateAccessRequestInput, type CreateAuthorizationUrlOptions, checkOperationPermission, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, type DeclineAccessRequestOptions, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, type EnsureTenantResult, encodeOidcTransaction, type GeneratePostgresPermissionSqlResult, type GraduateAccessRequestOptions, type GraduateAccessRequestResult, type GraduateExistingTenantOption, type GraduateNewTenantOption, type GraduateTenantOption, generatePostgresPermissionSql, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, type ListAccessRequestsFilter, MagicLinkError, type MagicLinkResult, MagicLinkService, type MagicLinkServiceOptions, type MagicLinkVerifyResult, MobileAuthError, type MobileAuthErrorCode, MobileAuthService, type MobileAuthServiceOptions, type MobileBootstrapContext, type MobileLoginContext, type MobileLogoutResult, type MobileRequestMeta, type MobileResolvedUser, type MobileTenantContext, normalizeOperationPermissionAction, type OidcCallbackResult, OidcLoginError, type OidcLoginResult, OidcLoginService, type OidcLoginServiceOptions, type OidcProviderConfig, type OidcProviderKind, type OidcProviderMetadata, type OidcProviderResolution, type OidcProviderResolutionOptions, type OidcTokenEndpointAuthMethod, type OidcTokenSet, type OidcTransaction, type OperationPermissionAllowReason, type OperationPermissionCollectionInput, type OperationPermissionDecision, type OperationPermissionDenyReason, OperationPermissionError, type OperationPermissionOptions, type PermissionCatalog, PermissionCatalogService, type PermissionCatalogSource, type PermissionCatalogSyncResult, type PermissionDefinition, type PermissionResolutionOptions, type PermissionResolutionResult, PermissionResolver, type PostgresPermissionAction, type PostgresPermissionBinding, type PostgresPermissionPolicyReportItem, type PostgresPermissionPolicyTarget, type ResolvedOidcProviderConfig, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, type SessionContext, type SessionPermissionRuntimeContext, type SessionPermissionRuntimeOptions, SessionService, type SessionServiceOptions, type SwitchTenantResult, syncPermissionCatalog, type TenantPermissionInheritanceResult, TenantService, type TenantWithOwnershipResult, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, type TerminalAuthServiceOptions, type UsersConfig, type UsersOidcConfig, validateMobileRedirectUri, withSessionPermissionContext, } from './services/index.js';
 export { AccessRequestStatus, DEFAULT_ROLE_SLUGS, DEFAULT_ROLES, DEFAULT_TENANT_POLICY, type DefaultRoleSlug, MembershipStatus, OverrideEffect, SessionStatus, TenantPermissionEffect, type TenantPolicy, type TenantPolicyMode, TenantStatus, UserStatus, } from './types/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAGhC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,wBAAwB,EACxB,IAAI,EACJ,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAGhC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,14 +1,15 @@
-import { $ as MembershipCollection, A as TenantCollection, B as PermissionCatalogService, C as encodeOidcTransaction, D as UserCollection, F as DEFAULT_SESSION_TTL, G as syncPermissionCatalog, H as deriveOperationPermissionSlug, I as Session, J as Role, K as RolePermission, L as generateSessionId, M as MAX_TENANT_HIERARCHY_DEPTH, N as Tenant, O as TenantPermissionOverrideCollection, P as SessionCollection, Q as MembershipOverride, R as DEFAULT_ROLE_PERMISSION_PATTERNS, S as decodeOidcTransaction, T as resolveOidcProviderConfig, U as normalizeOperationPermissionAction, V as deriveOperationPermissionCollectionName, W as registerPermissionDefinitions, X as Permission, Y as PermissionCollection, Z as MembershipOverrideCollection, _ as validateMobileRedirectUri, _t as OverrideEffect, a as TerminalAuthRateLimitError, at as GroupCollection, b as OidcLoginError, bt as TenantStatus, c as assertOperationPermission, ct as UsersCliAuthRequest, d as getCurrentSessionPermissionContext, dt as normalizeEmail, et as Membership, f as getRequestScopedDatabase, ft as AccessRequestStatus, g as readMobileBearerToken, gt as MembershipStatus, h as MobileAuthService, ht as DEFAULT_TENANT_POLICY, i as TerminalAuthError, it as GroupMember, j as TenantHierarchyError, k as TenantPermissionOverride, l as checkOperationPermission, lt as User, m as MobileAuthError, mt as DEFAULT_ROLE_SLUGS, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as GroupRole, o as TerminalAuthService, ot as Group, p as withSessionPermissionContext, pt as DEFAULT_ROLES, q as RoleCollection, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as GroupMemberCollection, s as OperationPermissionError, st as UsersCliAuthRequestCollection, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as GroupRoleCollection, u as hasOperationPermission, ut as isValidEmail, v as SessionService, vt as SessionStatus, w as getUsersOidcConfig, x as OidcLoginService, xt as UserStatus, y as PermissionResolver, yt as TenantPermissionEffect, z as RolePermissionCollection } from "./chunks/TerminalAuthService-DGp_Wsil.js";
+import { $ as MembershipCollection, A as TenantCollection, B as PermissionCatalogService, C as encodeOidcTransaction, D as UserCollection, F as DEFAULT_SESSION_TTL, G as syncPermissionCatalog, H as deriveOperationPermissionSlug, I as Session, J as Role, K as RolePermission, L as generateSessionId, M as MAX_TENANT_HIERARCHY_DEPTH, N as Tenant, O as TenantPermissionOverrideCollection, P as SessionCollection, Q as MembershipOverride, R as DEFAULT_ROLE_PERMISSION_PATTERNS, S as decodeOidcTransaction, T as resolveOidcProviderConfig, U as normalizeOperationPermissionAction, V as deriveOperationPermissionCollectionName, W as registerPermissionDefinitions, X as Permission, Y as PermissionCollection, Z as MembershipOverrideCollection, _ as validateMobileRedirectUri, _t as OverrideEffect, a as TerminalAuthRateLimitError, at as GroupCollection, b as OidcLoginError, bt as TenantStatus, c as assertOperationPermission, ct as UsersCliAuthRequest, d as getCurrentSessionPermissionContext, dt as normalizeEmail, et as Membership, f as getRequestScopedDatabase, ft as AccessRequestStatus, g as readMobileBearerToken, gt as MembershipStatus, h as MobileAuthService, ht as DEFAULT_TENANT_POLICY, i as TerminalAuthError, it as GroupMember, j as TenantHierarchyError, k as TenantPermissionOverride, l as checkOperationPermission, lt as User, m as MobileAuthError, mt as DEFAULT_ROLE_SLUGS, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as GroupRole, o as TerminalAuthService, ot as Group, p as withSessionPermissionContext, pt as DEFAULT_ROLES, q as RoleCollection, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as GroupMemberCollection, s as OperationPermissionError, st as UsersCliAuthRequestCollection, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as GroupRoleCollection, u as hasOperationPermission, ut as isValidEmail, v as SessionService, vt as SessionStatus, w as getUsersOidcConfig, x as OidcLoginService, xt as UserStatus, y as PermissionResolver, yt as TenantPermissionEffect, z as RolePermissionCollection } from "./chunks/TerminalAuthService-BZ9p1mzh.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, field, findManifestEntryByQualifiedName, smrt } from "@happyvertical/smrt-core";
+import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";
 import { createLogger } from "@happyvertical/logger";
 import { createHash } from "node:crypto";
 //#region src/models/AccessRequest.ts
-var __defProp$1 = Object.defineProperty;
-var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
-var __decorateClass$1 = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
+var __defProp$2 = Object.defineProperty;
+var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
+var __decorateClass$2 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$2(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp$1(target, key, result);
+	if (kind && result) __defProp$2(target, key, result);
 	return result;
 };
 var AccessRequest = class extends SmrtObject {
@@ -93,24 +94,24 @@ var AccessRequest = class extends SmrtObject {
 		return this.status === AccessRequestStatus.DECLINED || this.status === AccessRequestStatus.GRADUATED || this.status === AccessRequestStatus.CANCELED;
 	}
 };
-__decorateClass$1([field({
+__decorateClass$2([field({
 	required: true,
 	indexed: true
 })], AccessRequest.prototype, "email", 2);
-__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "name", 2);
-__decorateClass$1([field({
+__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "name", 2);
+__decorateClass$2([field({
 	type: "text",
 	indexed: true
 })], AccessRequest.prototype, "status", 2);
-__decorateClass$1([field({ indexed: true })], AccessRequest.prototype, "source", 2);
-__decorateClass$1([field()], AccessRequest.prototype, "requestContext", 2);
-__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "note", 2);
-__decorateClass$1([field()], AccessRequest.prototype, "requestedAt", 2);
-__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "decidedAt", 2);
-__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "decidedBy", 2);
-__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "resultingUserId", 2);
-__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "tenantHint", 2);
-AccessRequest = __decorateClass$1([smrt({
+__decorateClass$2([field({ indexed: true })], AccessRequest.prototype, "source", 2);
+__decorateClass$2([field()], AccessRequest.prototype, "requestContext", 2);
+__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "note", 2);
+__decorateClass$2([field()], AccessRequest.prototype, "requestedAt", 2);
+__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "decidedAt", 2);
+__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "decidedBy", 2);
+__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "resultingUserId", 2);
+__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "tenantHint", 2);
+AccessRequest = __decorateClass$2([smrt({
 	tableName: "access_requests",
 	conflictColumns: ["id"],
 	api: { include: [] },
@@ -164,12 +165,12 @@ var AccessRequestCollection = class extends SmrtCollection {
 };
 //#endregion
 //#region src/models/MagicLinkToken.ts
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __decorateClass = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+var __defProp$1 = Object.defineProperty;
+var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __decorateClass$1 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp(target, key, result);
+	if (kind && result) __defProp$1(target, key, result);
 	return result;
 };
 var DEFAULT_TOKEN_EXPIRY_SECONDS = 600;
@@ -197,11 +198,11 @@ var UsersMagicLinkToken = class extends SmrtObject {
 		return !this.used && !this.isExpired();
 	}
 };
-__decorateClass([field({
+__decorateClass$1([field({
 	required: true,
 	unique: true
 })], UsersMagicLinkToken.prototype, "nonce", 2);
-UsersMagicLinkToken = __decorateClass([smrt({
+UsersMagicLinkToken = __decorateClass$1([smrt({
 	tableName: "users_magic_link_tokens",
 	api: { include: [] },
 	mcp: { include: [] },
@@ -246,6 +247,187 @@ var UsersMagicLinkTokenCollection = class extends SmrtCollection {
 	}
 };
 //#endregion
+//#region src/models/TenantIntegration.ts
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp(target, key, result);
+	return result;
+};
+function parseExternalIds(raw) {
+	if (!raw) return {};
+	if (typeof raw === "object" && !Array.isArray(raw)) return Object.fromEntries(Object.entries(raw).filter(([, value]) => typeof value === "string"));
+	if (typeof raw !== "string") return {};
+	try {
+		const parsed = JSON.parse(raw);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+		return Object.fromEntries(Object.entries(parsed).filter(([, value]) => typeof value === "string"));
+	} catch {
+		return {};
+	}
+}
+function stringifyExternalIds(externalIds) {
+	for (const [key, value] of Object.entries(externalIds)) if (typeof value !== "string") throw new TypeError(`TenantIntegration external id '${key}' must be a string`);
+	return JSON.stringify(externalIds);
+}
+function parseCheckSummary(raw) {
+	if (!raw) return [];
+	if (Array.isArray(raw)) return normalizeCheckSummary(raw);
+	if (typeof raw !== "string") return [];
+	try {
+		const parsed = JSON.parse(raw);
+		return Array.isArray(parsed) ? normalizeCheckSummary(parsed) : [];
+	} catch {
+		return [];
+	}
+}
+function normalizeCheckSummary(raw) {
+	return raw.filter((entry) => !!entry && typeof entry === "object" && !Array.isArray(entry)).map((entry) => ({
+		name: typeof entry.name === "string" ? entry.name : "",
+		ok: entry.ok === true,
+		...typeof entry.message === "string" ? { message: entry.message } : {}
+	})).filter((entry) => entry.name.length > 0);
+}
+function stringifyCheckSummary(summary) {
+	return JSON.stringify(summary);
+}
+var TenantIntegration = class extends SmrtObject {
+	tenantId = "";
+	/**
+	* Provider identifier, such as `aws`, `matomo`, `glitchtip`, or an
+	* app-defined provider string.
+	*/
+	provider = "aws";
+	/**
+	* Provider-side identifiers. Shape depends on the provider. This must not
+	* contain provider credentials or secret material.
+	*/
+	externalIds = "{}";
+	/**
+	* Current provisioning/health status.
+	*/
+	status = "unprovisioned";
+	/**
+	* UTC timestamp of the most recent doctor/provisioning check.
+	*/
+	lastCheckedAt = null;
+	/**
+	* Per-check pass/fail summary from the most recent doctor run.
+	*/
+	lastCheckSummary = "[]";
+	/**
+	* Most recent error message when `status === 'failed'`, or null otherwise.
+	*/
+	lastError = null;
+	constructor(options = {}) {
+		super(options);
+		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
+		if (options.provider !== void 0) this.provider = options.provider;
+		if (options.externalIds !== void 0) this.setExternalIds(options.externalIds);
+		if (options.status !== void 0) this.status = options.status;
+		if (options.lastCheckedAt !== void 0) this.lastCheckedAt = options.lastCheckedAt;
+		if (options.lastCheckSummary !== void 0) this.setLastCheckSummary(options.lastCheckSummary);
+		if (options.lastError !== void 0) this.lastError = options.lastError;
+	}
+	async initialize() {
+		await super.initialize();
+		this.normalizeJsonFields();
+		return this;
+	}
+	normalizeJsonFields() {
+		const fields = this;
+		if (fields.externalIds == null) this.externalIds = "{}";
+		else if (typeof fields.externalIds !== "string") this.setExternalIds(fields.externalIds);
+		if (fields.lastCheckSummary == null) this.lastCheckSummary = "[]";
+		else if (typeof fields.lastCheckSummary !== "string") this.setLastCheckSummary(fields.lastCheckSummary);
+	}
+	getExternalIds() {
+		return parseExternalIds(this.externalIds);
+	}
+	setExternalIds(externalIds) {
+		this.externalIds = typeof externalIds === "string" ? externalIds : stringifyExternalIds(externalIds);
+	}
+	getExternalId(key) {
+		const value = this.getExternalIds()[key];
+		return typeof value === "string" && value.length > 0 ? value : void 0;
+	}
+	setExternalId(key, value) {
+		const externalIds = this.getExternalIds();
+		if (value === void 0) delete externalIds[key];
+		else externalIds[key] = value;
+		this.setExternalIds(externalIds);
+	}
+	getLastCheckSummary() {
+		return parseCheckSummary(this.lastCheckSummary);
+	}
+	setLastCheckSummary(summary) {
+		this.lastCheckSummary = typeof summary === "string" ? summary : stringifyCheckSummary(summary);
+	}
+	recordDoctorRun(outcome) {
+		this.status = outcome.status;
+		this.setLastCheckSummary(outcome.summary);
+		this.lastCheckedAt = /* @__PURE__ */ new Date();
+		this.lastError = outcome.error ?? null;
+	}
+};
+__decorateClass([tenantId()], TenantIntegration.prototype, "tenantId", 2);
+TenantIntegration = __decorateClass([TenantScoped({ mode: "required" }), smrt({
+	tableName: "tenant_integrations",
+	conflictColumns: ["tenant_id", "provider"],
+	api: { include: ["list", "get"] },
+	mcp: { include: ["list", "get"] },
+	cli: true
+})], TenantIntegration);
+//#endregion
+//#region src/collections/TenantIntegrationCollection.ts
+var TenantIntegrationCollection = class extends SmrtCollection {
+	static _itemClass = TenantIntegration;
+	async listForTenant(tenantId) {
+		return this.list({
+			where: { tenantId },
+			orderBy: "provider ASC"
+		});
+	}
+	async findFor(tenantId, provider) {
+		return this.findOne({ where: {
+			tenantId,
+			provider
+		} });
+	}
+	async findOrInit(tenantId, provider) {
+		const existing = await this.findFor(tenantId, provider);
+		if (existing) return existing;
+		try {
+			return await this.create({
+				tenantId,
+				provider,
+				status: "unprovisioned",
+				_insertOnly: true
+			});
+		} catch (err) {
+			if (!isDuplicateKeyError(err)) throw err;
+			const winner = await this.findFor(tenantId, provider);
+			if (winner) return winner;
+			throw err;
+		}
+	}
+};
+function isDuplicateKeyError(err) {
+	const seen = /* @__PURE__ */ new Set();
+	let cur = err;
+	while (cur && typeof cur === "object" && !seen.has(cur)) {
+		seen.add(cur);
+		const e = cur;
+		if (e.code === "23505" || e.code === "VALIDATION_UNIQUE_CONSTRAINT") return true;
+		const message = typeof e.message === "string" ? e.message : "";
+		if (/duplicate key|unique.+violat|code=23505|SQLITE_CONSTRAINT.*UNIQUE/i.test(message)) return true;
+		cur = e.cause;
+	}
+	return false;
+}
+//#endregion
 //#region src/services/AccessRequestService.ts
 var logger = createLogger({ level: "info" });
 var ACCESS_REQUEST_CAPABILITIES = {
@@ -736,7 +918,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-DGp_Wsil.js").then((n) => n.E);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-BZ9p1mzh.js").then((n) => n.E);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -765,7 +947,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-DGp_Wsil.js").then((n) => n.E);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-BZ9p1mzh.js").then((n) => n.E);
 		const key = await this.getSigningKey();
 		let payload;
 		try {
@@ -1238,6 +1420,6 @@ var TenantService = class TenantService {
 	}
 };
 //#endregion
-export { ACCESS_REQUEST_CAPABILITIES, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, Role, RoleCollection, RolePermission, RolePermissionCollection, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, User, UserCollection, UserStatus, applyPostgresPermissionPolicies, assertOperationPermission, checkOperationPermission, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, normalizeOperationPermissionAction, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, syncPermissionCatalog, validateMobileRedirectUri, withSessionPermissionContext };
+export { ACCESS_REQUEST_CAPABILITIES, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, Role, RoleCollection, RolePermission, RolePermissionCollection, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, User, UserCollection, UserStatus, applyPostgresPermissionPolicies, assertOperationPermission, checkOperationPermission, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, normalizeOperationPermissionAction, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, syncPermissionCatalog, validateMobileRedirectUri, withSessionPermissionContext };
 
 //# sourceMappingURL=index.js.map