@happyvertical/smrt-users 0.39.13 → 0.39.15

package/dist/collections/UserCollection.d.ts

@@ -1,7 +1,9 @@
 import { SmrtCollection } from '@happyvertical/smrt-core';
 import { OidcIdentity, Profile } from '@happyvertical/smrt-profiles';
+import { getDatabase } from '@happyvertical/sql';
 import { User } from '../models/User.js';
 import { UserStatus } from '../types/index.js';
+type DatabaseInterface = Awaited<ReturnType<typeof getDatabase>>;
 /**
  * OIDC claims used for identity resolution
  */
@@ -19,6 +21,10 @@ export interface OidcClaims {
     /** Preferred username */
     preferred_username?: string;
 }
+/** OIDC claims after the provisioning boundary validates and normalizes email. */
+export type NormalizedOidcClaims = Readonly<OidcClaims & {
+    email: string;
+}>;
 /**
  * Result of OIDC identity resolution
  */
@@ -32,6 +38,42 @@ export interface OidcIdentityResult {
     /** Whether the profile was newly created */
     created: boolean;
 }
+/** Context passed after OIDC claims are validated and before provisioning. */
+export interface OidcProfileResolverContext {
+    /** Transaction-bound database; use this for every resolver read/write. */
+    db: DatabaseInterface;
+    /**
+     * Frozen normalized claim snapshot. OidcLoginService supplies
+     * protocol-validated claims; direct collection callers must provide claims
+     * from a trusted boundary.
+     */
+    claims: NormalizedOidcClaims;
+    /** Configured provider key. */
+    provider: string;
+    /** Transaction-bound User collection. */
+    users: UserCollection;
+}
+/**
+ * Resolve a consumer-owned canonical Profile before User/session creation.
+ *
+ * Return `undefined` for the secure default, `null` to reject login, or a
+ * Profile to select it explicitly. For a new issuer/subject, a supplied Profile
+ * is still required to be the unique, unowned global Person for the verified
+ * email. For an exact existing issuer/subject, `null` still rejects login and a
+ * supplied Profile must be the already-linked Profile; the hook cannot rebind
+ * identity authority. Stable-link owner and canonical-Person checks still
+ * apply. The hook may be retried after a concurrent unique-key race and must
+ * therefore be idempotent.
+ */
+export type OidcProfileResolver = (context: OidcProfileResolverContext) => Profile | null | undefined | Promise<Profile | null | undefined>;
+export type OidcProvisioningErrorCode = 'ambiguous_identity' | 'concurrency_conflict' | 'profile_owned' | 'rejected' | 'transaction_required' | 'user_email_backfill_required' | 'user_email_conflict';
+/** Fail-closed OIDC identity provisioning error. */
+export declare class OidcProvisioningError extends Error {
+    readonly code: OidcProvisioningErrorCode;
+    constructor(code: OidcProvisioningErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
 /**
  * Options for getOrCreateFromOidc
  */
@@ -46,12 +88,20 @@ export interface GetOrCreateFromOidcOptions {
      * assertion, so it cannot be enforced.
      */
     allowUnverifiedEmail?: boolean;
+    /**
+     * Optional application resolver invoked inside the provisioning transaction
+     * after token/claim validation and before OIDC identity, User, or session
+     * creation. Return a canonical Profile, `null` to reject, or `undefined` to
+     * use SMRT's secure default.
+     */
+    resolveProfile?: OidcProfileResolver;
 }
 /**
  * Collection for managing User objects
  */
 export declare class UserCollection extends SmrtCollection<User> {
     static readonly _itemClass: typeof User;
+    private userEmailKeysReadyPromise;
     /**
      * Find user by email address
      */
@@ -87,9 +137,20 @@ export declare class UserCollection extends SmrtCollection<User> {
      * 2. Link OidcIdentity to the Profile
      * 3. Find or create User linked to the Profile
      *
-     * @param claims - OIDC token claims (sub, iss, email, name)
+     * Direct callers must supply claims from a trusted, already validated token
+     * boundary. OidcLoginService performs discovery, token exchange, issuer and
+     * subject validation, and verified-email source pairing before calling this
+     * collection method.
+     *
+     * @param claims - Trusted OIDC token claims (sub, iss, email, name)
      * @param provider - Provider name (e.g., 'kanidm', 'keycloak', 'google')
-     * @param options - Optional settings (recordLogin)
+     * @param options - Login recording, unverified-email compatibility, and an
+     * application Profile resolver. The resolver runs inside the provisioning
+     * transaction before provisioning returns, may be retried, and must be
+     * idempotent. For a new identity, its returned Profile is still checked as
+     * the unique, global, unowned Person for the verified normalized email. For
+     * an exact existing identity, it may only confirm the already-linked Profile
+     * and cannot rebind it.
      * @returns User, Profile, OidcIdentity, and whether profile was created
      *
      * @example
@@ -112,5 +173,17 @@ export declare class UserCollection extends SmrtCollection<User> {
      * ```
      */
     getOrCreateFromOidc(claims: OidcClaims, provider: string, options?: GetOrCreateFromOidcOptions): Promise<OidcIdentityResult>;
+    private requireProvisioningDatabase;
+    private provisionOidcIdentity;
+    private findProfileOwners;
+    private rebindOidcProvisioningResult;
+    private findUniqueOidcIdentity;
+    private finishUserProvisioning;
+    private findUsersByNormalizedEmail;
+    /** Require the deploy-time backfill marker before indexed identity reads. */
+    private ensureUserEmailKeysReady;
+    private checkUserEmailKeysReady;
+    private assertUserEmailKeyCurrent;
 }
+export {};
 //# sourceMappingURL=UserCollection.d.ts.map

package/dist/collections/UserCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserCollection.d.ts","sourceRoot":"","sources":["../../src/collections/UserCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,sBAAsB;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,yBAAyB;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,YAAY,EAAE,YAAY,CAAC;IAC3B,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,+DAA+D;IAC/D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,cAAc,CAAC,IAAI,CAAC;IACtD,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAQ;IAElC;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQtD;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQ5D;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAOvD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAInC;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAIpC;;OAEG;IACG,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,OAAO,CAAC;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAM,GAC7C,OAAO,CAAC,IAAI,CAAC;IAehB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACG,mBAAmB,CACvB,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,kBAAkB,CAAC;CAqE/B"}
+{"version":3,"file":"UserCollection.d.ts","sourceRoot":"","sources":["../../src/collections/UserCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAGL,YAAY,EAEZ,KAAK,OAAO,EACb,MAAM,8BAA8B,CAAC;AAStC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,KAAK,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;AAEjE;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,kFAAkF;AAClF,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE5E;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,sBAAsB;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,yBAAyB;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,YAAY,EAAE,YAAY,CAAC;IAC3B,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,EAAE,EAAE,iBAAiB,CAAC;IACtB;;;;OAIG;IACH,MAAM,EAAE,oBAAoB,CAAC;IAC7B,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,KAAK,EAAE,cAAc,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,0BAA0B,KAChC,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GACjC,oBAAoB,GACpB,sBAAsB,GACtB,eAAe,GACf,UAAU,GACV,sBAAsB,GACtB,8BAA8B,GAC9B,qBAAqB,CAAC;AAE1B,oDAAoD;AACpD,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,IAAI,EAAE,yBAAyB;gBAA/B,IAAI,EAAE,yBAAyB,EACxC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKhC;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,+DAA+D;IAC/D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,cAAc,CAAC,IAAI,CAAC;IACtD,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAQ;IAClC,OAAO,CAAC,yBAAyB,CAA8B;IAE/D;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQtD;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQ5D;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAOvD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAInC;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAIpC;;OAEG;IACG,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,OAAO,CAAC;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAM,GAC7C,OAAO,CAAC,IAAI,CAAC;IAehB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACG,mBAAmB,CACvB,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,kBAAkB,CAAC;IA2E9B,OAAO,CAAC,2BAA2B;YAWrB,qBAAqB;YAmLrB,iBAAiB;YAIjB,4BAA4B;YA6B5B,sBAAsB;YAoBtB,sBAAsB;YAiCtB,0BAA0B;IAsBxC,6EAA6E;YAC/D,wBAAwB;YAYxB,uBAAuB;IAWrC,OAAO,CAAC,yBAAyB;CAmBlC"}

package/dist/collections/index.d.ts

@@ -17,5 +17,5 @@ export { type CreateSessionOptions, SessionCollection, } from './SessionCollecti
 export { type CreateChildTenantOptions, TenantCollection, TenantHierarchyError, } from './TenantCollection.js';
 export { TenantIntegrationCollection } from './TenantIntegrationCollection.js';
 export { TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, } from './TenantPermissionOverrideCollection.js';
-export { type GetOrCreateFromOidcOptions, type OidcClaims, type OidcIdentityResult, UserCollection, } from './UserCollection.js';
+export { type GetOrCreateFromOidcOptions, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, UserCollection, } from './UserCollection.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/collections/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collections/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,cAAc,EACd,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,oBAAoB,EACzB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,kCAAkC,EAClC,KAAK,8BAA8B,GACpC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,cAAc,GACf,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collections/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,cAAc,EACd,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,oBAAoB,EACzB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,kCAAkC,EAClC,KAAK,8BAA8B,GACpC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,cAAc,GACf,MAAM,qBAAqB,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-export { AccessRequestCollection, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type OidcClaims, type OidcIdentityResult, PermissionCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantIntegrationCollection, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthRequestCollection, UsersMagicLinkTokenCollection, } from './collections/index.js';
+export { AccessRequestCollection, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, PermissionCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantIntegrationCollection, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthRequestCollection, UsersMagicLinkTokenCollection, } from './collections/index.js';
+export { type BackfillUserEmailKeysResult, backfillUserEmailKeys, type DuplicateUserEmailKey, UserEmailKeyBackfillError, type UserEmailKeyBackfillErrorCode, } from './migrations/backfillUserEmailKeys.js';
 export { AccessRequest, type AccessRequestOptions, CliAuthRequest, type CliAuthRequestStatus, DEFAULT_SESSION_TTL, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupMember, GroupRole, generateSessionId, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkToken, Membership, MembershipOverride, Permission, Role, RolePermission, Session, Tenant, TenantIntegration, type TenantIntegrationCheckSummary, type TenantIntegrationOptions, type TenantIntegrationProvider, type TenantIntegrationStatus, TenantPermissionOverride, User, UsersCliAuthRequest, UsersMagicLinkToken, } from './models/index.js';
 export { ACCESS_REQUEST_CAPABILITIES, type AccessRequestAuthorizationContext, type AccessRequestAuthorizer, type AccessRequestCapability, AccessRequestError, type AccessRequestErrorCode, type AccessRequestEvent, type AccessRequestEventHandler, type AccessRequestEventType, AccessRequestService, type AccessRequestServiceOptions, type ApproveAccessRequestOptions, type ApproveCliAuthRequestInput, applyPostgresPermissionPolicies, assertOperationPermission, type CancelAccessRequestOptions, type CliAuthStartResult, type CliAuthTokenResult, type CreateAccessRequestInput, type CreateAuthorizationUrlOptions, checkOperationPermission, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, type DeclineAccessRequestOptions, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, type EnsureTenantResult, encodeOidcTransaction, type GeneratePostgresPermissionSqlResult, type GraduateAccessRequestOptions, type GraduateAccessRequestResult, type GraduateExistingTenantOption, type GraduateNewTenantOption, type GraduateTenantOption, generatePostgresPermissionSql, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, type ListAccessRequestsFilter, MagicLinkError, type MagicLinkResult, MagicLinkService, type MagicLinkServiceOptions, type MagicLinkVerifyResult, MobileAuthError, type MobileAuthErrorCode, MobileAuthService, type MobileAuthServiceOptions, type MobileBootstrapContext, type MobileLoginContext, type MobileLogoutResult, type MobileRequestMeta, type MobileResolvedUser, type MobileTenantContext, normalizeOperationPermissionAction, type OidcCallbackResult, OidcLoginError, type OidcLoginResult, OidcLoginService, type OidcLoginServiceOptions, type OidcProviderConfig, type OidcProviderKind, type OidcProviderMetadata, type OidcProviderResolution, type OidcProviderResolutionOptions, type OidcTokenEndpointAuthMethod, type OidcTokenSet, type OidcTransaction, type OperationPermissionAllowReason, type OperationPermissionCollectionInput, type OperationPermissionDecision, type OperationPermissionDenyReason, OperationPermissionError, type OperationPermissionOptions, type PermissionCatalog, PermissionCatalogService, type PermissionCatalogSource, type PermissionCatalogSyncResult, type PermissionDefinition, type PermissionResolutionOptions, type PermissionResolutionResult, PermissionResolver, type PostgresPermissionAction, type PostgresPermissionBinding, type PostgresPermissionPolicyReportItem, type PostgresPermissionPolicyTarget, type PrincipalPermissionRuntimeOptions, type ResolvedOidcProviderConfig, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, type SessionContext, type SessionPermissionRuntimeContext, type SessionPermissionRuntimeOptions, SessionService, type SessionServiceOptions, type SwitchTenantResult, syncPermissionCatalog, type TenantPermissionInheritanceResult, TenantService, type TenantWithOwnershipResult, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, type TerminalAuthServiceOptions, type UsersConfig, type UsersOidcConfig, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext, } from './services/index.js';
 export { AccessRequestStatus, DEFAULT_ROLE_SLUGS, DEFAULT_ROLES, DEFAULT_TENANT_POLICY, type DefaultRoleSlug, MembershipStatus, OverrideEffect, SessionStatus, TenantPermissionEffect, type TenantPolicy, type TenantPolicyMode, TenantStatus, UserStatus, } from './types/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAGhC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAGhC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as MembershipOverride, A as TenantPermissionOverride, B as RolePermissionCollection, C as decodeOidcTransaction, E as resolveOidcProviderConfig, F as SessionCollection, G as registerPermissionDefinitions, H as deriveOperationPermissionCollectionName, I as DEFAULT_SESSION_TTL, J as RoleCollection, K as syncPermissionCatalog, L as Session, M as TenantHierarchyError, N as MAX_TENANT_HIERARCHY_DEPTH, O as UserCollection, P as Tenant, Q as MembershipOverrideCollection, R as generateSessionId, S as OidcLoginService, St as UserStatus, T as getUsersOidcConfig, U as deriveOperationPermissionSlug, V as PermissionCatalogService, W as normalizeOperationPermissionAction, X as PermissionCollection, Y as Role, Z as Permission, _ as readMobileBearerToken, _t as MembershipStatus, a as TerminalAuthRateLimitError, at as GroupMember, b as PermissionResolver, bt as TenantPermissionEffect, c as assertOperationPermission, ct as UsersCliAuthRequestCollection, d as getCurrentSessionPermissionContext, dt as isValidEmail, et as MembershipCollection, f as getRequestScopedDatabase, ft as normalizeEmail, g as MobileAuthService, gt as DEFAULT_TENANT_POLICY, h as MobileAuthError, ht as DEFAULT_ROLE_SLUGS, i as TerminalAuthError, it as GroupMemberCollection, j as TenantCollection, k as TenantPermissionOverrideCollection, l as checkOperationPermission, lt as UsersCliAuthRequest, m as withSessionPermissionContext, mt as DEFAULT_ROLES, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as GroupRoleCollection, o as TerminalAuthService, ot as GroupCollection, p as withPrincipalPermissionContext, pt as AccessRequestStatus, q as RolePermission, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as GroupRole, s as OperationPermissionError, st as Group, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as Membership, u as hasOperationPermission, ut as User, v as validateMobileRedirectUri, vt as OverrideEffect, w as encodeOidcTransaction, x as OidcLoginError, xt as TenantStatus, y as SessionService, yt as SessionStatus, z as DEFAULT_ROLE_PERMISSION_PATTERNS } from "./chunks/TerminalAuthService-B5U0hvzu.js";
+import { $ as PermissionCollection, A as UserEmailKeyBackfillError, B as Session, C as decodeOidcTransaction, Ct as TenantPermissionEffect, E as resolveOidcProviderConfig, F as TenantHierarchyError, G as deriveOperationPermissionCollectionName, H as DEFAULT_ROLE_PERMISSION_PATTERNS, I as MAX_TENANT_HIERARCHY_DEPTH, J as registerPermissionDefinitions, K as deriveOperationPermissionSlug, L as Tenant, M as TenantPermissionOverrideCollection, N as TenantPermissionOverride, O as OidcProvisioningError, P as TenantCollection, Q as Role, R as SessionCollection, S as OidcLoginService, St as SessionStatus, T as getUsersOidcConfig, Tt as UserStatus, U as RolePermissionCollection, V as generateSessionId, W as PermissionCatalogService, X as RolePermission, Y as syncPermissionCatalog, Z as RoleCollection, _ as readMobileBearerToken, _t as DEFAULT_ROLES, a as TerminalAuthRateLimitError, at as GroupRoleCollection, b as PermissionResolver, bt as MembershipStatus, c as assertOperationPermission, ct as GroupMember, d as getCurrentSessionPermissionContext, dt as UsersCliAuthRequestCollection, et as Permission, f as getRequestScopedDatabase, ft as UsersCliAuthRequest, g as MobileAuthService, gt as AccessRequestStatus, h as MobileAuthError, ht as normalizeEmail, i as TerminalAuthError, it as Membership, j as backfillUserEmailKeys, k as UserCollection, l as checkOperationPermission, lt as GroupCollection, m as withSessionPermissionContext, mt as isValidEmail, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as MembershipOverride, o as TerminalAuthService, ot as GroupRole, p as withPrincipalPermissionContext, pt as User, q as normalizeOperationPermissionAction, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as MembershipCollection, s as OperationPermissionError, st as GroupMemberCollection, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as MembershipOverrideCollection, u as hasOperationPermission, ut as Group, v as validateMobileRedirectUri, vt as DEFAULT_ROLE_SLUGS, w as encodeOidcTransaction, wt as TenantStatus, x as OidcLoginError, xt as OverrideEffect, y as SessionService, yt as DEFAULT_TENANT_POLICY, z as DEFAULT_SESSION_TTL } from "./chunks/TerminalAuthService-CpLKHLl5.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, field, findManifestEntryByQualifiedName, smrt } from "@happyvertical/smrt-core";
 import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";
 import { createLogger } from "@happyvertical/logger";
@@ -918,7 +918,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-B5U0hvzu.js").then((n) => n.D);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-CpLKHLl5.js").then((n) => n.D);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -947,7 +947,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-B5U0hvzu.js").then((n) => n.D);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-CpLKHLl5.js").then((n) => n.D);
 		const key = await this.getSigningKey();
 		let payload;
 		try {
@@ -1420,6 +1420,6 @@ var TenantService = class TenantService {
 	}
 };
 //#endregion
-export { ACCESS_REQUEST_CAPABILITIES, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, Role, RoleCollection, RolePermission, RolePermissionCollection, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, User, UserCollection, UserStatus, applyPostgresPermissionPolicies, assertOperationPermission, checkOperationPermission, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, normalizeOperationPermissionAction, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, syncPermissionCatalog, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
+export { ACCESS_REQUEST_CAPABILITIES, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, Role, RoleCollection, RolePermission, RolePermissionCollection, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, User, UserCollection, UserEmailKeyBackfillError, UserStatus, applyPostgresPermissionPolicies, assertOperationPermission, backfillUserEmailKeys, checkOperationPermission, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, normalizeOperationPermissionAction, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, syncPermissionCatalog, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
 
 //# sourceMappingURL=index.js.map

package/dist/manifest.json

@@ -1,15 +1,15 @@
 {
   "version": "1.0.0",
-  "timestamp": 1783987332169,
+  "timestamp": 1784008223414,
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.39.13",
+  "packageVersion": "0.39.15",
   "objects": {
     "@happyvertical/smrt-users:AccessRequestCollection": {
       "name": "accessrequestcollection",
       "className": "AccessRequestCollection",
       "qualifiedName": "@happyvertical/smrt-users:AccessRequestCollection",
       "collection": "accessrequests",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/AccessRequestCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/AccessRequestCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -125,7 +125,7 @@
       "className": "UsersCliAuthRequestCollection",
       "qualifiedName": "@happyvertical/smrt-users:UsersCliAuthRequestCollection",
       "collection": "userscliauthrequests",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/CliAuthRequestCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/CliAuthRequestCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -227,7 +227,7 @@
       "className": "GroupCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupCollection",
       "collection": "groups",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/GroupCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/GroupCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -324,7 +324,7 @@
       "className": "GroupMemberCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupMemberCollection",
       "collection": "groupmembers",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/GroupMemberCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/GroupMemberCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -520,7 +520,7 @@
       "className": "GroupRoleCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupRoleCollection",
       "collection": "grouproles",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/GroupRoleCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/GroupRoleCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -683,7 +683,7 @@
       "className": "UsersMagicLinkTokenCollection",
       "qualifiedName": "@happyvertical/smrt-users:UsersMagicLinkTokenCollection",
       "collection": "usersmagiclinktokens",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/MagicLinkTokenCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/MagicLinkTokenCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -785,7 +785,7 @@
       "className": "MembershipCollection",
       "qualifiedName": "@happyvertical/smrt-users:MembershipCollection",
       "collection": "memberships",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/MembershipCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/MembershipCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -952,7 +952,7 @@
       "className": "MembershipOverrideCollection",
       "qualifiedName": "@happyvertical/smrt-users:MembershipOverrideCollection",
       "collection": "membershipoverrides",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/MembershipOverrideCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/MembershipOverrideCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -1167,7 +1167,7 @@
       "className": "PermissionCollection",
       "qualifiedName": "@happyvertical/smrt-users:PermissionCollection",
       "collection": "permissions",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/PermissionCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/PermissionCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -1300,7 +1300,7 @@
       "className": "RoleCollection",
       "qualifiedName": "@happyvertical/smrt-users:RoleCollection",
       "collection": "roles",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/RoleCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/RoleCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -1433,7 +1433,7 @@
       "className": "RolePermissionCollection",
       "qualifiedName": "@happyvertical/smrt-users:RolePermissionCollection",
       "collection": "rolepermissions",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/RolePermissionCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/RolePermissionCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -1615,7 +1615,7 @@
       "className": "SessionCollection",
       "qualifiedName": "@happyvertical/smrt-users:SessionCollection",
       "collection": "sessions",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/SessionCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/SessionCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -1871,7 +1871,7 @@
       "className": "TenantCollection",
       "qualifiedName": "@happyvertical/smrt-users:TenantCollection",
       "collection": "tenants",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/TenantCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/TenantCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -2195,7 +2195,7 @@
       "className": "TenantIntegrationCollection",
       "qualifiedName": "@happyvertical/smrt-users:TenantIntegrationCollection",
       "collection": "tenantintegrations",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/TenantIntegrationCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/TenantIntegrationCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -2313,7 +2313,7 @@
       "className": "TenantPermissionOverrideCollection",
       "qualifiedName": "@happyvertical/smrt-users:TenantPermissionOverrideCollection",
       "collection": "tenantpermissionoverrides",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/TenantPermissionOverrideCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/TenantPermissionOverrideCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -2641,7 +2641,7 @@
       "className": "UserCollection",
       "qualifiedName": "@happyvertical/smrt-users:UserCollection",
       "collection": "users",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/collections/UserCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/collections/UserCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -2811,7 +2811,7 @@
       "className": "AccessRequest",
       "qualifiedName": "@happyvertical/smrt-users:AccessRequest",
       "collection": "accessrequests",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/AccessRequest.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/AccessRequest.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "email": {
@@ -3114,7 +3114,7 @@
       "className": "UsersCliAuthRequest",
       "qualifiedName": "@happyvertical/smrt-users:UsersCliAuthRequest",
       "collection": "userscliauthrequests",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/CliAuthRequest.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/CliAuthRequest.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "userCode": {
@@ -3270,7 +3270,7 @@
       "className": "Group",
       "qualifiedName": "@happyvertical/smrt-users:Group",
       "collection": "groups",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/Group.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/Group.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "tenantId": {
@@ -3390,7 +3390,7 @@
       "className": "GroupMember",
       "qualifiedName": "@happyvertical/smrt-users:GroupMember",
       "collection": "groupmembers",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/GroupMember.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/GroupMember.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "groupId": {
@@ -3507,7 +3507,7 @@
       "className": "GroupRole",
       "qualifiedName": "@happyvertical/smrt-users:GroupRole",
       "collection": "grouproles",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/GroupRole.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/GroupRole.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "groupId": {
@@ -3624,7 +3624,7 @@
       "className": "UsersMagicLinkToken",
       "qualifiedName": "@happyvertical/smrt-users:UsersMagicLinkToken",
       "collection": "usersmagiclinktokens",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/MagicLinkToken.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/MagicLinkToken.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "nonce": {
@@ -3766,7 +3766,7 @@
       "className": "Membership",
       "qualifiedName": "@happyvertical/smrt-users:Membership",
       "collection": "memberships",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/Membership.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/Membership.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "userId": {
@@ -3929,7 +3929,7 @@
       "className": "MembershipOverride",
       "qualifiedName": "@happyvertical/smrt-users:MembershipOverride",
       "collection": "membershipoverrides",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/MembershipOverride.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/MembershipOverride.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "membershipId": {
@@ -4073,7 +4073,7 @@
       "className": "Permission",
       "qualifiedName": "@happyvertical/smrt-users:Permission",
       "collection": "permissions",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/Permission.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/Permission.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "name": {
@@ -4216,7 +4216,7 @@
       "className": "Role",
       "qualifiedName": "@happyvertical/smrt-users:Role",
       "collection": "roles",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/Role.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/Role.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "tenantId": {
@@ -4384,7 +4384,7 @@
       "className": "RolePermission",
       "qualifiedName": "@happyvertical/smrt-users:RolePermission",
       "collection": "rolepermissions",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/RolePermission.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/RolePermission.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "roleId": {
@@ -4501,7 +4501,7 @@
       "className": "Session",
       "qualifiedName": "@happyvertical/smrt-users:Session",
       "collection": "sessions",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/Session.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/Session.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "userId": {
@@ -4777,7 +4777,7 @@
       "className": "Tenant",
       "qualifiedName": "@happyvertical/smrt-users:Tenant",
       "collection": "tenants",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/Tenant.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/Tenant.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "created_at": {
@@ -5498,7 +5498,7 @@
       "className": "TenantIntegration",
       "qualifiedName": "@happyvertical/smrt-users:TenantIntegration",
       "collection": "tenantintegrations",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/TenantIntegration.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/TenantIntegration.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "tenantId": {
@@ -5771,7 +5771,7 @@
       "className": "TenantPermissionOverride",
       "qualifiedName": "@happyvertical/smrt-users:TenantPermissionOverride",
       "collection": "tenantpermissionoverrides",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/TenantPermissionOverride.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/TenantPermissionOverride.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "tenantId": {
@@ -5931,19 +5931,32 @@
       "className": "User",
       "qualifiedName": "@happyvertical/smrt-users:User",
       "collection": "users",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-ks2xb/smrt/smrt/packages/users/src/models/User.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-8l5wt-runner-5hwvc/smrt/smrt/packages/users/src/models/User.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "profileId": {
           "type": "crossPackageRef",
           "required": false,
-          "related": "@happyvertical/smrt-profiles:Profile"
+          "related": "@happyvertical/smrt-profiles:Profile",
+          "_meta": {
+            "unique": true
+          }
         },
         "email": {
           "type": "text",
           "required": false,
           "default": ""
         },
+        "emailKey": {
+          "type": "text",
+          "required": false,
+          "_meta": {
+            "nullable": true,
+            "unique": true,
+            "readonly": true
+          },
+          "readonly": true
+        },
         "status": {
           "type": "text",
           "required": false,
@@ -5994,6 +6007,14 @@
           "returnType": "void",
           "isStatic": false,
           "isPublic": true
+        },
+        "save": {
+          "name": "save",
+          "async": true,
+          "parameters": [],
+          "returnType": "Promise",
+          "isStatic": false,
+          "isPublic": true
         }
       },
       "decoratorConfig": {
@@ -6016,7 +6037,7 @@
       "collectionExportName": "UserCollection",
       "schema": {
         "tableName": "users",
-        "ddl": "CREATE TABLE IF NOT EXISTS \"users\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"profile_id\" UUID,\n  \"email\" TEXT DEFAULT '',\n  \"status\" TEXT,\n  \"last_login_at\" TIMESTAMP\n);",
+        "ddl": "CREATE TABLE IF NOT EXISTS \"users\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"profile_id\" UUID UNIQUE,\n  \"email\" TEXT DEFAULT '',\n  \"email_key\" TEXT UNIQUE,\n  \"status\" TEXT,\n  \"last_login_at\" TIMESTAMP\n);",
         "columns": {
           "id": {
             "type": "UUID",
@@ -6047,7 +6068,7 @@
             "type": "UUID",
             "referenceKind": "crossPackageRef",
             "notNull": false,
-            "unique": false
+            "unique": true
           },
           "email": {
             "type": "TEXT",
@@ -6055,6 +6076,11 @@
             "unique": false,
             "default": ""
           },
+          "email_key": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": true
+          },
           "status": {
             "type": "TEXT",
             "notNull": false,
@@ -6082,7 +6108,7 @@
             "unique": true
           }
         ],
-        "version": "dda929da"
+        "version": "38fd1677"
       }
     }
   },