@happyvertical/smrt-users 0.38.2 → 0.38.3

package/dist/index.js

@@ -1,15 +1,14 @@
-import { $ as DEFAULT_ROLE_SLUGS, A as RolePermissionCollection, B as GroupRoleCollection, C as TenantHierarchyError, D as DEFAULT_SESSION_TTL, E as SessionCollection, F as parsePermissionSlug, G as Group, H as GroupMemberCollection, I as MembershipOverrideCollection, J as User, K as UsersCliAuthRequestCollection, L as MembershipOverride, M as PermissionCollection, N as Permission, O as Session, P as isValidPermissionSlug, Q as DEFAULT_ROLES, R as MembershipCollection, S as TenantCollection, T as Tenant, U as GroupMember, V as GroupRole, W as GroupCollection, X as normalizeEmail, Y as isValidEmail, Z as AccessRequestStatus, _ as resolveOidcProviderConfig, a as TerminalAuthRateLimitError, at as TenantStatus, b as TenantPermissionOverrideCollection, c as getRequestScopedDatabase, d as PermissionResolver, et as DEFAULT_TENANT_POLICY, f as OidcLoginError, g as getUsersOidcConfig, h as encodeOidcTransaction, i as TerminalAuthError, it as TenantPermissionEffect, j as RolePermission, k as generateSessionId, l as withSessionPermissionContext, m as decodeOidcTransaction, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as OverrideEffect, o as TerminalAuthService, ot as UserStatus, p as OidcLoginService, q as UsersCliAuthRequest, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as SessionStatus, s as getCurrentSessionPermissionContext, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as MembershipStatus, u as SessionService, w as MAX_TENANT_HIERARCHY_DEPTH, x as TenantPermissionOverride, y as UserCollection, z as Membership } from "./chunks/TerminalAuthService-BLxjzcQj.js";
-import { ObjectRegistry, SmrtCollection, SmrtObject, field, findManifestEntryByQualifiedName, foreignKey, smrt } from "@happyvertical/smrt-core";
+import { $ as UsersCliAuthRequestCollection, A as DEFAULT_ROLE_PERMISSION_PATTERNS, B as Role, C as TenantHierarchyError, D as DEFAULT_SESSION_TTL, E as SessionCollection, F as normalizeOperationPermissionAction, G as MembershipCollection, H as Permission, I as registerPermissionDefinitions, J as GroupRole, K as Membership, L as syncPermissionCatalog, M as PermissionCatalogService, N as deriveOperationPermissionCollectionName, O as Session, P as deriveOperationPermissionSlug, Q as Group, R as RolePermission, S as TenantCollection, T as Tenant, U as MembershipOverrideCollection, V as PermissionCollection, W as MembershipOverride, X as GroupMember, Y as GroupMemberCollection, Z as GroupCollection, _ as resolveOidcProviderConfig, a as TerminalAuthRateLimitError, at as DEFAULT_ROLES, b as TenantPermissionOverrideCollection, c as getRequestScopedDatabase, ct as MembershipStatus, d as PermissionResolver, dt as TenantPermissionEffect, et as UsersCliAuthRequest, f as OidcLoginError, ft as TenantStatus, g as getUsersOidcConfig, h as encodeOidcTransaction, i as TerminalAuthError, it as AccessRequestStatus, j as RolePermissionCollection, k as generateSessionId, l as withSessionPermissionContext, lt as OverrideEffect, m as decodeOidcTransaction, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as isValidEmail, o as TerminalAuthService, ot as DEFAULT_ROLE_SLUGS, p as OidcLoginService, pt as UserStatus, q as GroupRoleCollection, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as normalizeEmail, s as getCurrentSessionPermissionContext, st as DEFAULT_TENANT_POLICY, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as User, u as SessionService, ut as SessionStatus, w as MAX_TENANT_HIERARCHY_DEPTH, x as TenantPermissionOverride, y as UserCollection, z as RoleCollection } from "./chunks/TerminalAuthService-B7RYkS27.js";
+import { ObjectRegistry, SmrtCollection, SmrtObject, field, findManifestEntryByQualifiedName, smrt } from "@happyvertical/smrt-core";
 import { createLogger } from "@happyvertical/logger";
-import { getPackageConfig } from "@happyvertical/smrt-config";
 import { createHash } from "node:crypto";
 //#region src/models/AccessRequest.ts
-var __defProp$2 = Object.defineProperty;
-var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
-var __decorateClass$2 = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$2(target, key) : target;
+var __defProp$1 = Object.defineProperty;
+var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __decorateClass$1 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp$2(target, key, result);
+	if (kind && result) __defProp$1(target, key, result);
 	return result;
 };
 var AccessRequest = class extends SmrtObject {
@@ -94,24 +93,24 @@ var AccessRequest = class extends SmrtObject {
 		return this.status === AccessRequestStatus.DECLINED || this.status === AccessRequestStatus.GRADUATED || this.status === AccessRequestStatus.CANCELED;
 	}
 };
-__decorateClass$2([field({
+__decorateClass$1([field({
 	required: true,
 	indexed: true
 })], AccessRequest.prototype, "email", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "name", 2);
-__decorateClass$2([field({
+__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "name", 2);
+__decorateClass$1([field({
 	type: "text",
 	indexed: true
 })], AccessRequest.prototype, "status", 2);
-__decorateClass$2([field({ indexed: true })], AccessRequest.prototype, "source", 2);
-__decorateClass$2([field()], AccessRequest.prototype, "requestContext", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "note", 2);
-__decorateClass$2([field()], AccessRequest.prototype, "requestedAt", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "decidedAt", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "decidedBy", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "resultingUserId", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "tenantHint", 2);
-AccessRequest = __decorateClass$2([smrt({
+__decorateClass$1([field({ indexed: true })], AccessRequest.prototype, "source", 2);
+__decorateClass$1([field()], AccessRequest.prototype, "requestContext", 2);
+__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "note", 2);
+__decorateClass$1([field()], AccessRequest.prototype, "requestedAt", 2);
+__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "decidedAt", 2);
+__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "decidedBy", 2);
+__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "resultingUserId", 2);
+__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "tenantHint", 2);
+AccessRequest = __decorateClass$1([smrt({
 	tableName: "access_requests",
 	conflictColumns: ["id"],
 	api: { include: [] },
@@ -165,12 +164,12 @@ var AccessRequestCollection = class extends SmrtCollection {
 };
 //#endregion
 //#region src/models/MagicLinkToken.ts
-var __defProp$1 = Object.defineProperty;
-var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
-var __decorateClass$1 = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp$1(target, key, result);
+	if (kind && result) __defProp(target, key, result);
 	return result;
 };
 var DEFAULT_TOKEN_EXPIRY_SECONDS = 600;
@@ -198,11 +197,11 @@ var UsersMagicLinkToken = class extends SmrtObject {
 		return !this.used && !this.isExpired();
 	}
 };
-__decorateClass$1([field({
+__decorateClass([field({
 	required: true,
 	unique: true
 })], UsersMagicLinkToken.prototype, "nonce", 2);
-UsersMagicLinkToken = __decorateClass$1([smrt({
+UsersMagicLinkToken = __decorateClass([smrt({
 	tableName: "users_magic_link_tokens",
 	api: { include: [] },
 	mcp: { include: [] },
@@ -247,140 +246,6 @@ var UsersMagicLinkTokenCollection = class extends SmrtCollection {
 	}
 };
 //#endregion
-//#region src/models/Role.ts
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __decorateClass = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
-	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp(target, key, result);
-	return result;
-};
-var Role = class extends SmrtObject {
-	tenantId;
-	/**
-	* Display name for the role
-	*/
-	name = "";
-	/**
-	* Description of the role
-	*/
-	description = "";
-	/**
-	* Whether this is a system role (cannot be deleted)
-	*/
-	isSystem = false;
-	constructor(options = {}) {
-		super(options);
-		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
-		if (options.name !== void 0) this.name = options.name;
-		if (options.description !== void 0) this.description = options.description;
-		if (options.isSystem !== void 0) this.isSystem = options.isSystem;
-	}
-	/**
-	* Check if this is a system-wide role
-	*/
-	isSystemRole() {
-		return this.tenantId === null || this.tenantId === void 0;
-	}
-	/**
-	* Check if this is a tenant-specific role
-	*/
-	isTenantRole() {
-		return this.tenantId !== null && this.tenantId !== void 0;
-	}
-	/**
-	* Check if this role can be deleted.
-	* System roles (isSystem = true) cannot be deleted.
-	* @returns true if the role can be deleted
-	*/
-	canDelete() {
-		return !this.isSystem;
-	}
-	/**
-	* Delete guard - prevents deletion of system roles.
-	* Override the delete method to check isSystem flag first.
-	*/
-	async delete() {
-		if (this.isSystem) throw new Error(`Cannot delete system role '${this.slug}'. System roles are protected.`);
-		return super.delete();
-	}
-};
-__decorateClass([foreignKey("Tenant", { nullable: true })], Role.prototype, "tenantId", 2);
-Role = __decorateClass([smrt({
-	api: { include: ["list", "get"] },
-	mcp: { include: ["list", "get"] },
-	cli: true
-})], Role);
-//#endregion
-//#region src/collections/RoleCollection.ts
-var RoleCollection = class extends SmrtCollection {
-	static _itemClass = Role;
-	/**
-	* Find all system roles (tenantId is null)
-	*/
-	async findSystemRoles() {
-		return await this.query(`SELECT * FROM ${this.tableName} WHERE tenant_id IS NULL ORDER BY name ASC`);
-	}
-	/**
-	* Find roles available for a tenant (system + tenant-specific)
-	*/
-	async findByTenant(tenantId) {
-		return await this.query(`SELECT * FROM ${this.tableName}
-       WHERE tenant_id IS NULL OR tenant_id = ?
-       ORDER BY is_system DESC, name ASC`, [tenantId]);
-	}
-	/**
-	* Find tenant-specific roles only
-	*/
-	async findTenantRoles(tenantId) {
-		return await this.list({
-			where: { tenantId },
-			orderBy: "name ASC"
-		});
-	}
-	/**
-	* Find role by slug within a tenant context
-	*/
-	async findBySlug(slug, tenantId) {
-		if (tenantId) {
-			const tenantRoles = await this.list({
-				where: {
-					slug,
-					tenantId
-				},
-				limit: 1
-			});
-			if (tenantRoles.length > 0) return tenantRoles[0];
-		}
-		const systemRoles = await this.query(`SELECT * FROM ${this.tableName} WHERE slug = ? AND tenant_id IS NULL LIMIT 1`, [slug]);
-		return systemRoles.length > 0 ? systemRoles[0] : null;
-	}
-	/**
-	* Seed default system roles
-	*/
-	async seedSystemRoles() {
-		const roles = [];
-		for (const roleDef of DEFAULT_ROLES) {
-			const existing = await this.findBySlug(roleDef.slug);
-			if (existing) {
-				roles.push(existing);
-				continue;
-			}
-			const role = await this.create({
-				slug: roleDef.slug,
-				name: roleDef.name,
-				description: roleDef.description,
-				tenantId: null,
-				isSystem: true
-			});
-			await role.save();
-			roles.push(role);
-		}
-		return roles;
-	}
-};
-//#endregion
 //#region src/services/AccessRequestService.ts
 var logger = createLogger({ level: "info" });
 var ACCESS_REQUEST_CAPABILITIES = {
@@ -871,7 +736,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-BLxjzcQj.js").then((n) => n.v);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-B7RYkS27.js").then((n) => n.v);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -900,7 +765,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-BLxjzcQj.js").then((n) => n.v);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-B7RYkS27.js").then((n) => n.v);
 		const key = await this.getSigningKey();
 		let payload;
 		try {
@@ -934,289 +799,89 @@ var MagicLinkService = class MagicLinkService {
 	}
 };
 //#endregion
-//#region src/services/PermissionCatalogService.ts
-function getRuntimePermissionRegistrations() {
-	globalThis.__smrtUsersPermissionRegistrations ??= /* @__PURE__ */ new Map();
-	return globalThis.__smrtUsersPermissionRegistrations;
-}
-function toSnakeCase$1(value) {
-	return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[-\s]+/g, "_").toLowerCase();
-}
-function pluralize(word) {
-	if (word.endsWith("y") && !/[aeiou]y$/i.test(word)) return `${word.slice(0, -1)}ies`;
-	if (word.endsWith("s") || word.endsWith("x") || word.endsWith("z") || word.endsWith("ch") || word.endsWith("sh")) return `${word}es`;
-	return `${word}s`;
-}
-function deriveCollectionName(className) {
-	return pluralize(toSnakeCase$1(className));
-}
-function humanizeResource(resource) {
-	return resource.replace(/[_-]+/g, " ").replace(/\b\w/g, (char) => char.toUpperCase());
-}
-function capitalize(value) {
-	return `${value[0]?.toUpperCase() ?? ""}${value.slice(1)}`;
-}
-function defaultPermissionName(slug) {
-	const parsed = parsePermissionSlug(slug);
-	if (!parsed.isValid) return humanizeResource(slug);
-	return `${capitalize(parsed.action)} ${humanizeResource(parsed.resource)}`;
-}
-function defaultPermissionDescription(slug) {
-	const parsed = parsePermissionSlug(slug);
-	if (!parsed.isValid) return `Allows ${slug}`;
-	return `Allows ${parsed.action} access for ${humanizeResource(parsed.resource).toLowerCase()}`;
-}
-function isCollectionManifestEntry(objectDef) {
-	return objectDef?.extends === "SmrtCollection" || objectDef?.extendsTypeArg !== void 0;
-}
-function getPublicCustomMethodNames(methodEntries, standardActions) {
-	return Array.from(new Set(methodEntries.filter((method) => Boolean(method?.name) && method?.isPublic === true && !standardActions.includes(method.name)).map((method) => method.name)));
-}
-function getCustomMethodExposureNames(config, availableCustomMethods) {
-	if (!config || config === false) return /* @__PURE__ */ new Set();
-	if (config === true || typeof config !== "object") return new Set(availableCustomMethods);
-	const rawInclude = config.include;
-	const include = Array.isArray(rawInclude) ? [...rawInclude] : void 0;
-	const rawExclude = config.exclude;
-	const exclude = Array.isArray(rawExclude) ? [...rawExclude] : [];
-	if (!include) return new Set(availableCustomMethods.filter((methodName) => !exclude.includes(methodName)));
-	const baseMethods = include.filter((methodName) => availableCustomMethods.includes(methodName));
-	return new Set(baseMethods.filter((methodName) => !exclude.includes(methodName)));
-}
-function isOperationEnabled(config, action) {
-	if (config === false) return false;
-	if (config && typeof config === "object") {
-		const include = Array.isArray(config.include) ? config.include : void 0;
-		const rawExclude = config.exclude;
-		const exclude = Array.isArray(rawExclude) ? [...rawExclude] : [];
-		if (include && !include.includes(action)) return false;
-		if (exclude.includes(action)) return false;
-	}
-	return true;
+//#region src/services/OperationPermissionService.ts
+var OperationPermissionError = class extends Error {
+	decision;
+	permission;
+	status = 403;
+	constructor(decision) {
+		super(decision.permission ? `Permission denied for '${decision.permission}'.` : "Permission denied.");
+		this.name = "OperationPermissionError";
+		this.decision = decision;
+		this.permission = decision.permission;
+	}
+};
+function isModuleNotFoundError(error) {
+	return error instanceof Error && (error.code === "ERR_MODULE_NOT_FOUND" || /Cannot find package '@happyvertical\/smrt-tenancy'/.test(error.message));
 }
-function normalizePostgresAction(action) {
-	const normalized = action.toUpperCase();
-	if (normalized === "SELECT" || normalized === "INSERT" || normalized === "UPDATE" || normalized === "DELETE") return normalized;
-	throw new Error(`Unsupported Postgres permission action '${action}'. Expected SELECT, INSERT, UPDATE, or DELETE.`);
+async function readTenancyBypassContext() {
+	try {
+		const tenancy = await import("@happyvertical/smrt-tenancy");
+		return {
+			superAdminBypass: tenancy.isSuperAdminBypass(),
+			systemContext: tenancy.isSystemContext()
+		};
+	} catch (error) {
+		if (!isModuleNotFoundError(error)) throw error;
+		return {
+			superAdminBypass: false,
+			systemContext: false
+		};
+	}
 }
-function normalizeBinding(binding, fallbackPermission) {
+function deny(permission, reason, error) {
 	return {
-		action: normalizePostgresAction(binding.action),
-		permission: binding.permission || fallbackPermission,
-		schemaName: binding.schemaName,
-		tableName: binding.tableName,
-		tenantField: binding.tenantField
+		allowed: false,
+		error,
+		permission,
+		reason
 	};
 }
-function mergeStringField(fieldName, existing, incoming, slug) {
-	const existingValue = existing[fieldName];
-	const incomingValue = incoming[fieldName];
-	if (!incomingValue) return;
-	if (!existingValue) {
-		existing[fieldName] = incomingValue;
-		return;
-	}
-	if (existingValue !== incomingValue) throw new Error(`Conflicting permission metadata for '${slug}' field '${fieldName}': '${existingValue}' !== '${incomingValue}'`);
-}
-function mergeBindings(existing, incoming) {
-	const existingBindings = existing.postgres?.bindings ?? [];
-	const incomingBindings = incoming.postgres?.bindings ?? [];
-	if (incomingBindings.length === 0) return;
-	const seen = new Set(existingBindings.map((binding) => [
-		binding.permission,
-		binding.action,
-		binding.schemaName ?? "",
-		binding.tableName,
-		binding.tenantField ?? ""
-	].join("|")));
-	const mergedBindings = [...existingBindings];
-	for (const binding of incomingBindings) {
-		const normalized = normalizeBinding(binding, incoming.slug);
-		const key = [
-			normalized.permission,
-			normalized.action,
-			normalized.schemaName ?? "",
-			normalized.tableName,
-			normalized.tenantField ?? ""
-		].join("|");
-		if (!seen.has(key)) {
-			seen.add(key);
-			mergedBindings.push(normalized);
-		}
-	}
-	existing.postgres = { bindings: mergedBindings };
-}
-function normalizeDefinition(definition, source) {
-	if (!definition.slug || !isValidPermissionSlug(definition.slug.trim())) throw new Error(`Invalid permission slug '${definition.slug}'. Expected 'resource.action'.`);
-	const slug = definition.slug.trim();
+function allow(permission, reason) {
 	return {
-		category: definition.category ?? parsePermissionSlug(slug).resource,
-		className: definition.className,
-		collection: definition.collection,
-		description: definition.description ?? defaultPermissionDescription(slug),
-		name: definition.name ?? defaultPermissionName(slug),
-		postgres: definition.postgres?.bindings ? { bindings: definition.postgres.bindings.map((binding) => normalizeBinding(binding, slug)) } : void 0,
-		qualifiedName: definition.qualifiedName,
-		slug,
-		source
+		allowed: true,
+		permission,
+		reason
 	};
 }
-function mergeDefinitionSet(current, incomingDefinitions, source) {
-	for (const rawDefinition of incomingDefinitions) {
-		const definition = normalizeDefinition(rawDefinition, source);
-		const existing = current.get(definition.slug);
-		if (!existing) {
-			current.set(definition.slug, definition);
-			continue;
-		}
-		mergeStringField("category", existing, definition, definition.slug);
-		mergeStringField("className", existing, definition, definition.slug);
-		mergeStringField("collection", existing, definition, definition.slug);
-		mergeStringField("description", existing, definition, definition.slug);
-		mergeStringField("name", existing, definition, definition.slug);
-		mergeStringField("qualifiedName", existing, definition, definition.slug);
-		mergeBindings(existing, definition);
-	}
-}
-function registerPermissionDefinitions(definitions) {
-	globalThis.__smrtUsersPermissionRegistrationCounter = (globalThis.__smrtUsersPermissionRegistrationCounter ?? 0) + 1;
-	const registrationId = globalThis.__smrtUsersPermissionRegistrationCounter;
-	getRuntimePermissionRegistrations().set(registrationId, definitions);
-	return () => {
-		getRuntimePermissionRegistrations().delete(registrationId);
-	};
+function hasCatalogSlug(catalog, permission) {
+	return catalog.permissions.some((definition) => definition.slug === permission);
 }
-var PermissionCatalogService = class PermissionCatalogService {
-	constructor(options = {}) {
-		this.options = options;
-	}
-	options;
-	getUsersConfig() {
-		return getPackageConfig("users", {});
-	}
-	getRuntimePermissionDefinitions() {
-		return Array.from(getRuntimePermissionRegistrations().values()).flat();
-	}
-	getCustomPermissionDefinitions() {
-		return this.getUsersConfig().permissions?.custom ?? [];
-	}
-	getCatalog() {
-		const manifestPermissions = this.getManifestPermissionDefinitions();
-		const customPermissions = this.getCustomPermissionDefinitions();
-		const runtimePermissions = this.getRuntimePermissionDefinitions();
-		const merged = /* @__PURE__ */ new Map();
-		mergeDefinitionSet(merged, manifestPermissions, "manifest");
-		mergeDefinitionSet(merged, customPermissions, "config");
-		mergeDefinitionSet(merged, runtimePermissions, "runtime");
-		return {
-			customPermissions: customPermissions.map((definition) => normalizeDefinition(definition, "config")),
-			manifestPermissions: manifestPermissions.map((definition) => normalizeDefinition(definition, "manifest")),
-			permissions: Array.from(merged.values()).sort((left, right) => left.slug.localeCompare(right.slug)),
-			runtimePermissions: runtimePermissions.map((definition) => normalizeDefinition(definition, "runtime"))
-		};
-	}
-	async syncPermissionCatalog() {
-		const catalog = this.getCatalog();
-		const permissions = await PermissionCollection.create(this.options);
-		const created = [];
-		const unchanged = [];
-		const updated = [];
-		for (const definition of catalog.permissions) {
-			const existing = await permissions.findBySlug(definition.slug);
-			if (!existing) {
-				await (await permissions.create({
-					category: definition.category ?? parsePermissionSlug(definition.slug).resource,
-					description: definition.description ?? "",
-					name: definition.name ?? definition.slug,
-					slug: definition.slug
-				})).save();
-				created.push(definition.slug);
-				continue;
-			}
-			const nextName = definition.name ?? existing.name;
-			const nextDescription = definition.description ?? existing.description;
-			const nextCategory = definition.category ?? existing.category;
-			if (existing.name === nextName && existing.description === nextDescription && existing.category === nextCategory) {
-				unchanged.push(definition.slug);
-				continue;
-			}
-			existing.name = nextName;
-			existing.description = nextDescription;
-			existing.category = nextCategory;
-			await existing.save();
-			updated.push(definition.slug);
-		}
-		return {
-			catalog,
-			created,
-			unchanged,
-			updated
-		};
-	}
-	getManifestPermissionDefinitions() {
-		const standardActions = [
-			"list",
-			"get",
-			"create",
-			"update",
-			"delete"
-		];
-		const definitions = /* @__PURE__ */ new Map();
-		for (const metadata of ObjectRegistry.getAllObjectMetadata()) {
-			const registered = ObjectRegistry.getClassByConstructor(metadata.constructor) ?? ObjectRegistry.getClass(metadata.name);
-			const manifestEntry = registered?.qualifiedName ? findManifestEntryByQualifiedName(registered.qualifiedName) : void 0;
-			if (isCollectionManifestEntry(manifestEntry)) continue;
-			const className = metadata.name;
-			const qualifiedName = registered?.qualifiedName;
-			const objectConfig = manifestEntry?.decoratorConfig ?? metadata.config;
-			const rawCollection = objectConfig?.collection;
-			const collection = (typeof rawCollection === "string" && rawCollection.length > 0 ? rawCollection : void 0) ?? manifestEntry?.collection ?? deriveCollectionName(metadata.name);
-			if (isOperationEnabled(objectConfig.api, "list") || isOperationEnabled(objectConfig.api, "get") || isOperationEnabled(objectConfig.cli, "list") || isOperationEnabled(objectConfig.cli, "get") || isOperationEnabled(objectConfig.mcp, "list") || isOperationEnabled(objectConfig.mcp, "get")) definitions.set(`${collection}.read`, {
-				className,
-				collection,
-				qualifiedName,
-				slug: `${collection}.read`
-			});
-			for (const action of [
-				"create",
-				"update",
-				"delete"
-			]) {
-				if (!(isOperationEnabled(objectConfig.api, action) || isOperationEnabled(objectConfig.cli, action) || isOperationEnabled(objectConfig.mcp, action))) continue;
-				definitions.set(`${collection}.${action}`, {
-					className,
-					collection,
-					qualifiedName,
-					slug: `${collection}.${action}`
-				});
-			}
-			const publicCustomMethodNames = getPublicCustomMethodNames(manifestEntry?.methods ? Object.values(manifestEntry.methods) : Array.from(metadata.methods.values()), standardActions);
-			const customApiMethods = /* @__PURE__ */ new Set();
-			const customCliMethods = getCustomMethodExposureNames(objectConfig.cli, publicCustomMethodNames);
-			const customMcpMethods = getCustomMethodExposureNames(objectConfig.mcp, publicCustomMethodNames);
-			for (const methodName of publicCustomMethodNames) if (isOperationEnabled(objectConfig.api, methodName)) customApiMethods.add(methodName);
-			const customMethods = /* @__PURE__ */ new Set([
-				...customApiMethods,
-				...customCliMethods,
-				...customMcpMethods
-			]);
-			for (const methodName of customMethods) definitions.set(`${collection}.${methodName}`, {
-				className,
-				collection,
-				description: `Allows ${methodName} on ${humanizeResource(collection).toLowerCase()}`,
-				name: `${capitalize(methodName)} ${humanizeResource(collection)}`,
-				qualifiedName,
-				slug: `${collection}.${methodName}`
-			});
-		}
-		return Array.from(definitions.values()).sort((left, right) => left.slug.localeCompare(right.slug));
+async function checkOperationPermission(options) {
+	let permission;
+	try {
+		permission = deriveOperationPermissionSlug(options.collection, options.action);
+	} catch (error) {
+		return deny(null, "invalid_operation", error);
 	}
-	static create(options = {}) {
-		return new PermissionCatalogService(options);
+	if (!hasCatalogSlug(options.catalog ?? PermissionCatalogService.create(options).getCatalog(), permission)) return deny(permission, "unknown_permission");
+	const sessionContext = getCurrentSessionPermissionContext();
+	let tenancyContext;
+	try {
+		tenancyContext = await readTenancyBypassContext();
+	} catch (error) {
+		return deny(permission, "resolution_error", error);
+	}
+	const systemContext = sessionContext?.systemContext === true || tenancyContext.systemContext;
+	const superAdminBypass = sessionContext?.superAdminBypass === true || tenancyContext.superAdminBypass;
+	if (systemContext && options.allowSystemContextBypass !== false) return allow(permission, "system_context_bypass");
+	if (superAdminBypass && options.allowSuperAdminBypass !== false) return allow(permission, "super_admin_bypass");
+	const userId = options.userId ?? sessionContext?.userId ?? null;
+	const tenantId = options.tenantId ?? sessionContext?.tenantId ?? null;
+	if (!userId || !tenantId) return deny(permission, "missing_principal");
+	try {
+		return await (options.resolver ?? await PermissionResolver.create(options)).hasPermission(userId, tenantId, permission, { membership: options.membership }) ? allow(permission, "permission_granted") : deny(permission, "permission_denied");
+	} catch (error) {
+		return deny(permission, "resolution_error", error);
 	}
-};
-async function syncPermissionCatalog(options = {}) {
-	return PermissionCatalogService.create(options).syncPermissionCatalog();
+}
+async function hasOperationPermission(options) {
+	return (await checkOperationPermission(options)).allowed;
+}
+async function assertOperationPermission(options) {
+	const decision = await checkOperationPermission(options);
+	if (decision.allowed || options.onDeny === "return") return decision;
+	throw new OperationPermissionError(decision);
 }
 //#endregion
 //#region src/services/PostgresPermissionPolicies.ts
@@ -1658,6 +1323,6 @@ var TenantService = class TenantService {
 	}
 };
 //#endregion
-export { ACCESS_REQUEST_CAPABILITIES, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, OidcLoginError, OidcLoginService, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, Role, RoleCollection, RolePermission, RolePermissionCollection, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, User, UserCollection, UserStatus, applyPostgresPermissionPolicies, decodeOidcTransaction, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, registerPermissionDefinitions, resolveOidcProviderConfig, syncPermissionCatalog, withSessionPermissionContext };
+export { ACCESS_REQUEST_CAPABILITIES, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, OidcLoginError, OidcLoginService, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, Role, RoleCollection, RolePermission, RolePermissionCollection, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, User, UserCollection, UserStatus, applyPostgresPermissionPolicies, assertOperationPermission, checkOperationPermission, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, normalizeOperationPermissionAction, registerPermissionDefinitions, resolveOidcProviderConfig, syncPermissionCatalog, withSessionPermissionContext };
 
 //# sourceMappingURL=index.js.map