@happyvertical/smrt-users 0.39.16 → 0.40.0

package/dist/collections/UserCollection.d.ts

@@ -66,6 +66,25 @@ export interface OidcProfileResolverContext {
  * therefore be idempotent.
  */
 export type OidcProfileResolver = (context: OidcProfileResolverContext) => Profile | null | undefined | Promise<Profile | null | undefined>;
+/** Application authorization for binding a new OIDC identity to an owner. */
+export interface OidcProfileOwnerAuthorization {
+    /** Canonical global Person selected by the application. */
+    profile: Profile;
+    /** Existing User the application authorizes as that Profile's owner. */
+    user: User;
+}
+/** Transaction-bound context supplied to the owner authorization callback. */
+export type OidcProfileOwnerAuthorizerContext = OidcProfileResolverContext;
+/**
+ * Explicitly authorize first OIDC binding to a pre-provisioned Profile/User.
+ *
+ * Return `undefined` to preserve SMRT's secure default, `null` to reject the
+ * login, or both the canonical Profile and its existing owning User. SMRT
+ * reloads and verifies both records inside the provisioning transaction; the
+ * returned objects are never trusted as proof of ownership. The callback may
+ * be retried after a concurrent unique-key race and must be idempotent.
+ */
+export type OidcProfileOwnerAuthorizer = (context: OidcProfileOwnerAuthorizerContext) => OidcProfileOwnerAuthorization | null | undefined | Promise<OidcProfileOwnerAuthorization | null | undefined>;
 export type OidcProvisioningErrorCode = 'ambiguous_identity' | 'concurrency_conflict' | 'profile_owned' | 'rejected' | 'transaction_required' | 'user_email_backfill_required' | 'user_email_conflict';
 /** Fail-closed OIDC identity provisioning error. */
 export declare class OidcProvisioningError extends Error {
@@ -95,6 +114,12 @@ export interface GetOrCreateFromOidcOptions {
      * use SMRT's secure default.
      */
     resolveProfile?: OidcProfileResolver;
+    /**
+     * Explicitly authorize a first issuer/subject binding to a pre-provisioned
+     * canonical Profile and its existing owner. A successful authorization
+     * requires `email_verified === true` and is revalidated atomically by SMRT.
+     */
+    authorizeProfileOwner?: OidcProfileOwnerAuthorizer;
 }
 /**
  * Collection for managing User objects
@@ -144,13 +169,13 @@ export declare class UserCollection extends SmrtCollection<User> {
      *
      * @param claims - Trusted OIDC token claims (sub, iss, email, name)
      * @param provider - Provider name (e.g., 'kanidm', 'keycloak', 'google')
-     * @param options - Login recording, unverified-email compatibility, and an
-     * application Profile resolver. The resolver runs inside the provisioning
-     * transaction before provisioning returns, may be retried, and must be
-     * idempotent. For a new identity, its returned Profile is still checked as
-     * the unique, global, unowned Person for the verified normalized email. For
-     * an exact existing identity, it may only confirm the already-linked Profile
-     * and cannot rebind it.
+     * @param options - Login recording, unverified-email compatibility, Profile
+     * resolution, and explicit owner authorization. Hooks run inside the
+     * provisioning transaction, may be retried, and must be idempotent. A
+     * resolver result must still be the unique, global, unowned Person. An owner
+     * authorization must select both the canonical Person and its existing sole
+     * approved User owner. Existing identities can only be confirmed, never
+     * rebound.
      * @returns User, Profile, OidcIdentity, and whether profile was created
      *
      * @example
@@ -176,6 +201,7 @@ export declare class UserCollection extends SmrtCollection<User> {
     private requireProvisioningDatabase;
     private provisionOidcIdentity;
     private findProfileOwners;
+    private validateProfileOwnerAuthorization;
     private rebindOidcProvisioningResult;
     private findUniqueOidcIdentity;
     private finishUserProvisioning;

package/dist/collections/UserCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserCollection.d.ts","sourceRoot":"","sources":["../../src/collections/UserCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAGL,YAAY,EAEZ,KAAK,OAAO,EACb,MAAM,8BAA8B,CAAC;AAStC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,KAAK,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;AAEjE;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,kFAAkF;AAClF,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE5E;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,sBAAsB;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,yBAAyB;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,YAAY,EAAE,YAAY,CAAC;IAC3B,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,EAAE,EAAE,iBAAiB,CAAC;IACtB;;;;OAIG;IACH,MAAM,EAAE,oBAAoB,CAAC;IAC7B,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,KAAK,EAAE,cAAc,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,0BAA0B,KAChC,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAEtE,MAAM,MAAM,yBAAyB,GACjC,oBAAoB,GACpB,sBAAsB,GACtB,eAAe,GACf,UAAU,GACV,sBAAsB,GACtB,8BAA8B,GAC9B,qBAAqB,CAAC;AAE1B,oDAAoD;AACpD,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,IAAI,EAAE,yBAAyB;gBAA/B,IAAI,EAAE,yBAAyB,EACxC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKhC;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,+DAA+D;IAC/D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,cAAc,CAAC,IAAI,CAAC;IACtD,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAQ;IAClC,OAAO,CAAC,yBAAyB,CAA8B;IAE/D;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQtD;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQ5D;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAOvD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAInC;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAIpC;;OAEG;IACG,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,OAAO,CAAC;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAM,GAC7C,OAAO,CAAC,IAAI,CAAC;IAehB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACG,mBAAmB,CACvB,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,kBAAkB,CAAC;IA2E9B,OAAO,CAAC,2BAA2B;YAWrB,qBAAqB;YAmLrB,iBAAiB;YAIjB,4BAA4B;YA6B5B,sBAAsB;YAoBtB,sBAAsB;YAiCtB,0BAA0B;IAsBxC,6EAA6E;YAC/D,wBAAwB;YAYxB,uBAAuB;IAWrC,OAAO,CAAC,yBAAyB;CAmBlC"}
+{"version":3,"file":"UserCollection.d.ts","sourceRoot":"","sources":["../../src/collections/UserCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAGL,YAAY,EAEZ,KAAK,OAAO,EAEb,MAAM,8BAA8B,CAAC;AAStC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,KAAK,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;AAEjE;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,kFAAkF;AAClF,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE5E;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,sBAAsB;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,yBAAyB;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,YAAY,EAAE,YAAY,CAAC;IAC3B,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,EAAE,EAAE,iBAAiB,CAAC;IACtB;;;;OAIG;IACH,MAAM,EAAE,oBAAoB,CAAC;IAC7B,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,KAAK,EAAE,cAAc,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,0BAA0B,KAChC,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAEtE,6EAA6E;AAC7E,MAAM,WAAW,6BAA6B;IAC5C,2DAA2D;IAC3D,OAAO,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,8EAA8E;AAC9E,MAAM,MAAM,iCAAiC,GAAG,0BAA0B,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAAG,CACvC,OAAO,EAAE,iCAAiC,KAExC,6BAA6B,GAC7B,IAAI,GACJ,SAAS,GACT,OAAO,CAAC,6BAA6B,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAE9D,MAAM,MAAM,yBAAyB,GACjC,oBAAoB,GACpB,sBAAsB,GACtB,eAAe,GACf,UAAU,GACV,sBAAsB,GACtB,8BAA8B,GAC9B,qBAAqB,CAAC;AAE1B,oDAAoD;AACpD,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,IAAI,EAAE,yBAAyB;gBAA/B,IAAI,EAAE,yBAAyB,EACxC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKhC;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,+DAA+D;IAC/D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,0BAA0B,CAAC;CACpD;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,cAAc,CAAC,IAAI,CAAC;IACtD,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAQ;IAClC,OAAO,CAAC,yBAAyB,CAA8B;IAE/D;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQtD;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQ5D;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAOvD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAInC;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAIpC;;OAEG;IACG,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,OAAO,CAAC;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAM,GAC7C,OAAO,CAAC,IAAI,CAAC;IAehB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACG,mBAAmB,CACvB,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,kBAAkB,CAAC;IA2E9B,OAAO,CAAC,2BAA2B;YAWrB,qBAAqB;YAqPrB,iBAAiB;YAqBjB,iCAAiC;YA6DjC,4BAA4B;YA6B5B,sBAAsB;YAoBtB,sBAAsB;YAiCtB,0BAA0B;IAsBxC,6EAA6E;YAC/D,wBAAwB;YAYxB,uBAAuB;IAWrC,OAAO,CAAC,yBAAyB;CAmBlC"}

package/dist/collections/index.d.ts

@@ -17,5 +17,5 @@ export { type CreateSessionOptions, SessionCollection, } from './SessionCollecti
 export { type CreateChildTenantOptions, TenantCollection, TenantHierarchyError, } from './TenantCollection.js';
 export { TenantIntegrationCollection } from './TenantIntegrationCollection.js';
 export { TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, } from './TenantPermissionOverrideCollection.js';
-export { type GetOrCreateFromOidcOptions, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, UserCollection, } from './UserCollection.js';
+export { type GetOrCreateFromOidcOptions, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileOwnerAuthorization, type OidcProfileOwnerAuthorizer, type OidcProfileOwnerAuthorizerContext, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, UserCollection, } from './UserCollection.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/collections/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collections/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,cAAc,EACd,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,oBAAoB,EACzB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,kCAAkC,EAClC,KAAK,8BAA8B,GACpC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,cAAc,GACf,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collections/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,cAAc,EACd,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,oBAAoB,EACzB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,kCAAkC,EAClC,KAAK,8BAA8B,GACpC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,cAAc,GACf,MAAM,qBAAqB,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { AccessRequestCollection, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, PermissionCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantIntegrationCollection, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthRequestCollection, UsersMagicLinkTokenCollection, } from './collections/index.js';
+export { AccessRequestCollection, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileOwnerAuthorization, type OidcProfileOwnerAuthorizer, type OidcProfileOwnerAuthorizerContext, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, PermissionCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantIntegrationCollection, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthRequestCollection, UsersMagicLinkTokenCollection, } from './collections/index.js';
 export { type BackfillUserEmailKeysResult, backfillUserEmailKeys, type DuplicateUserEmailKey, UserEmailKeyBackfillError, type UserEmailKeyBackfillErrorCode, } from './migrations/backfillUserEmailKeys.js';
 export { AccessRequest, type AccessRequestOptions, CliAuthRequest, type CliAuthRequestStatus, DEFAULT_SESSION_TTL, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupMember, GroupRole, generateSessionId, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkToken, Membership, MembershipOverride, Permission, Role, RolePermission, Session, Tenant, TenantIntegration, type TenantIntegrationCheckSummary, type TenantIntegrationOptions, type TenantIntegrationProvider, type TenantIntegrationStatus, TenantPermissionOverride, User, UsersCliAuthRequest, UsersMagicLinkToken, } from './models/index.js';
 export { ACCESS_REQUEST_CAPABILITIES, type AccessRequestAuthorizationContext, type AccessRequestAuthorizer, type AccessRequestCapability, AccessRequestError, type AccessRequestErrorCode, type AccessRequestEvent, type AccessRequestEventHandler, type AccessRequestEventType, AccessRequestService, type AccessRequestServiceOptions, type ApproveAccessRequestOptions, type ApproveCliAuthRequestInput, applyPostgresPermissionPolicies, assertOperationPermission, type CancelAccessRequestOptions, type CliAuthStartResult, type CliAuthTokenResult, type CreateAccessRequestInput, type CreateAuthorizationUrlOptions, checkOperationPermission, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, type DeclineAccessRequestOptions, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, type EnsureTenantResult, encodeOidcTransaction, type GeneratePostgresPermissionSqlResult, type GraduateAccessRequestOptions, type GraduateAccessRequestResult, type GraduateExistingTenantOption, type GraduateNewTenantOption, type GraduateTenantOption, generatePostgresPermissionSql, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, type ListAccessRequestsFilter, MagicLinkError, type MagicLinkResult, MagicLinkService, type MagicLinkServiceOptions, type MagicLinkVerifyResult, MobileAuthError, type MobileAuthErrorCode, MobileAuthService, type MobileAuthServiceOptions, type MobileBootstrapContext, type MobileLoginContext, type MobileLogoutResult, type MobileRequestMeta, type MobileResolvedUser, type MobileTenantContext, normalizeOperationPermissionAction, type OidcCallbackResult, OidcLoginError, type OidcLoginResult, OidcLoginService, type OidcLoginServiceOptions, type OidcProviderConfig, type OidcProviderKind, type OidcProviderMetadata, type OidcProviderResolution, type OidcProviderResolutionOptions, type OidcTokenEndpointAuthMethod, type OidcTokenSet, type OidcTransaction, type OperationPermissionAllowReason, type OperationPermissionCollectionInput, type OperationPermissionDecision, type OperationPermissionDenyReason, OperationPermissionError, type OperationPermissionOptions, type PermissionCatalog, PermissionCatalogService, type PermissionCatalogSource, type PermissionCatalogSyncResult, type PermissionDefinition, type PermissionResolutionOptions, type PermissionResolutionResult, PermissionResolver, type PostgresPermissionAction, type PostgresPermissionBinding, type PostgresPermissionPolicyReportItem, type PostgresPermissionPolicyTarget, type PrincipalPermissionRuntimeOptions, type ResolvedOidcProviderConfig, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, type SessionContext, type SessionPermissionRuntimeContext, type SessionPermissionRuntimeOptions, SessionService, type SessionServiceOptions, type SwitchTenantResult, syncPermissionCatalog, type TenantPermissionInheritanceResult, TenantService, type TenantWithOwnershipResult, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, type TerminalAuthServiceOptions, type UsersConfig, type UsersOidcConfig, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext, } from './services/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAGhC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAGhC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as PermissionCollection, A as UserEmailKeyBackfillError, B as Session, C as decodeOidcTransaction, Ct as TenantPermissionEffect, E as resolveOidcProviderConfig, F as TenantHierarchyError, G as deriveOperationPermissionCollectionName, H as DEFAULT_ROLE_PERMISSION_PATTERNS, I as MAX_TENANT_HIERARCHY_DEPTH, J as registerPermissionDefinitions, K as deriveOperationPermissionSlug, L as Tenant, M as TenantPermissionOverrideCollection, N as TenantPermissionOverride, O as OidcProvisioningError, P as TenantCollection, Q as Role, R as SessionCollection, S as OidcLoginService, St as SessionStatus, T as getUsersOidcConfig, Tt as UserStatus, U as RolePermissionCollection, V as generateSessionId, W as PermissionCatalogService, X as RolePermission, Y as syncPermissionCatalog, Z as RoleCollection, _ as readMobileBearerToken, _t as DEFAULT_ROLES, a as TerminalAuthRateLimitError, at as GroupRoleCollection, b as PermissionResolver, bt as MembershipStatus, c as assertOperationPermission, ct as GroupMember, d as getCurrentSessionPermissionContext, dt as UsersCliAuthRequestCollection, et as Permission, f as getRequestScopedDatabase, ft as UsersCliAuthRequest, g as MobileAuthService, gt as AccessRequestStatus, h as MobileAuthError, ht as normalizeEmail, i as TerminalAuthError, it as Membership, j as backfillUserEmailKeys, k as UserCollection, l as checkOperationPermission, lt as GroupCollection, m as withSessionPermissionContext, mt as isValidEmail, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as MembershipOverride, o as TerminalAuthService, ot as GroupRole, p as withPrincipalPermissionContext, pt as User, q as normalizeOperationPermissionAction, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as MembershipCollection, s as OperationPermissionError, st as GroupMemberCollection, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as MembershipOverrideCollection, u as hasOperationPermission, ut as Group, v as validateMobileRedirectUri, vt as DEFAULT_ROLE_SLUGS, w as encodeOidcTransaction, wt as TenantStatus, x as OidcLoginError, xt as OverrideEffect, y as SessionService, yt as DEFAULT_TENANT_POLICY, z as DEFAULT_SESSION_TTL } from "./chunks/TerminalAuthService-BnNKbnGB.js";
+import { $ as PermissionCollection, A as UserEmailKeyBackfillError, B as Session, C as decodeOidcTransaction, Ct as TenantPermissionEffect, E as resolveOidcProviderConfig, F as TenantHierarchyError, G as deriveOperationPermissionCollectionName, H as DEFAULT_ROLE_PERMISSION_PATTERNS, I as MAX_TENANT_HIERARCHY_DEPTH, J as registerPermissionDefinitions, K as deriveOperationPermissionSlug, L as Tenant, M as TenantPermissionOverrideCollection, N as TenantPermissionOverride, O as OidcProvisioningError, P as TenantCollection, Q as Role, R as SessionCollection, S as OidcLoginService, St as SessionStatus, T as getUsersOidcConfig, Tt as UserStatus, U as RolePermissionCollection, V as generateSessionId, W as PermissionCatalogService, X as RolePermission, Y as syncPermissionCatalog, Z as RoleCollection, _ as readMobileBearerToken, _t as DEFAULT_ROLES, a as TerminalAuthRateLimitError, at as GroupRoleCollection, b as PermissionResolver, bt as MembershipStatus, c as assertOperationPermission, ct as GroupMember, d as getCurrentSessionPermissionContext, dt as UsersCliAuthRequestCollection, et as Permission, f as getRequestScopedDatabase, ft as UsersCliAuthRequest, g as MobileAuthService, gt as AccessRequestStatus, h as MobileAuthError, ht as normalizeEmail, i as TerminalAuthError, it as Membership, j as backfillUserEmailKeys, k as UserCollection, l as checkOperationPermission, lt as GroupCollection, m as withSessionPermissionContext, mt as isValidEmail, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as MembershipOverride, o as TerminalAuthService, ot as GroupRole, p as withPrincipalPermissionContext, pt as User, q as normalizeOperationPermissionAction, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as MembershipCollection, s as OperationPermissionError, st as GroupMemberCollection, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as MembershipOverrideCollection, u as hasOperationPermission, ut as Group, v as validateMobileRedirectUri, vt as DEFAULT_ROLE_SLUGS, w as encodeOidcTransaction, wt as TenantStatus, x as OidcLoginError, xt as OverrideEffect, y as SessionService, yt as DEFAULT_TENANT_POLICY, z as DEFAULT_SESSION_TTL } from "./chunks/TerminalAuthService-BpA7-JpM.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, field, findManifestEntryByQualifiedName, smrt } from "@happyvertical/smrt-core";
 import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";
 import { createLogger } from "@happyvertical/logger";
@@ -918,7 +918,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-BnNKbnGB.js").then((n) => n.D);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-BpA7-JpM.js").then((n) => n.D);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -947,7 +947,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-BnNKbnGB.js").then((n) => n.D);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-BpA7-JpM.js").then((n) => n.D);
 		const key = await this.getSigningKey();
 		let payload;
 		try {

package/dist/manifest.json

@@ -1,15 +1,15 @@
 {
   "version": "1.0.0",
-  "timestamp": 1784065612718,
+  "timestamp": 1784095228712,
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.39.16",
+  "packageVersion": "0.40.0",
   "objects": {
     "@happyvertical/smrt-users:AccessRequestCollection": {
       "name": "accessrequestcollection",
       "className": "AccessRequestCollection",
       "qualifiedName": "@happyvertical/smrt-users:AccessRequestCollection",
       "collection": "accessrequests",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/AccessRequestCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/AccessRequestCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -125,7 +125,7 @@
       "className": "UsersCliAuthRequestCollection",
       "qualifiedName": "@happyvertical/smrt-users:UsersCliAuthRequestCollection",
       "collection": "userscliauthrequests",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/CliAuthRequestCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/CliAuthRequestCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -227,7 +227,7 @@
       "className": "GroupCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupCollection",
       "collection": "groups",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/GroupCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/GroupCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -324,7 +324,7 @@
       "className": "GroupMemberCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupMemberCollection",
       "collection": "groupmembers",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/GroupMemberCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/GroupMemberCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -520,7 +520,7 @@
       "className": "GroupRoleCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupRoleCollection",
       "collection": "grouproles",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/GroupRoleCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/GroupRoleCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -683,7 +683,7 @@
       "className": "UsersMagicLinkTokenCollection",
       "qualifiedName": "@happyvertical/smrt-users:UsersMagicLinkTokenCollection",
       "collection": "usersmagiclinktokens",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/MagicLinkTokenCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/MagicLinkTokenCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -785,7 +785,7 @@
       "className": "MembershipCollection",
       "qualifiedName": "@happyvertical/smrt-users:MembershipCollection",
       "collection": "memberships",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/MembershipCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/MembershipCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -952,7 +952,7 @@
       "className": "MembershipOverrideCollection",
       "qualifiedName": "@happyvertical/smrt-users:MembershipOverrideCollection",
       "collection": "membershipoverrides",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/MembershipOverrideCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/MembershipOverrideCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -1167,7 +1167,7 @@
       "className": "PermissionCollection",
       "qualifiedName": "@happyvertical/smrt-users:PermissionCollection",
       "collection": "permissions",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/PermissionCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/PermissionCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -1300,7 +1300,7 @@
       "className": "RoleCollection",
       "qualifiedName": "@happyvertical/smrt-users:RoleCollection",
       "collection": "roles",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/RoleCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/RoleCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -1433,7 +1433,7 @@
       "className": "RolePermissionCollection",
       "qualifiedName": "@happyvertical/smrt-users:RolePermissionCollection",
       "collection": "rolepermissions",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/RolePermissionCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/RolePermissionCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -1615,7 +1615,7 @@
       "className": "SessionCollection",
       "qualifiedName": "@happyvertical/smrt-users:SessionCollection",
       "collection": "sessions",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/SessionCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/SessionCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -1871,7 +1871,7 @@
       "className": "TenantCollection",
       "qualifiedName": "@happyvertical/smrt-users:TenantCollection",
       "collection": "tenants",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/TenantCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/TenantCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -2195,7 +2195,7 @@
       "className": "TenantIntegrationCollection",
       "qualifiedName": "@happyvertical/smrt-users:TenantIntegrationCollection",
       "collection": "tenantintegrations",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/TenantIntegrationCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/TenantIntegrationCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -2313,7 +2313,7 @@
       "className": "TenantPermissionOverrideCollection",
       "qualifiedName": "@happyvertical/smrt-users:TenantPermissionOverrideCollection",
       "collection": "tenantpermissionoverrides",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/TenantPermissionOverrideCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/TenantPermissionOverrideCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -2641,7 +2641,7 @@
       "className": "UserCollection",
       "qualifiedName": "@happyvertical/smrt-users:UserCollection",
       "collection": "users",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/collections/UserCollection.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/collections/UserCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
       "methods": {
@@ -2811,7 +2811,7 @@
       "className": "AccessRequest",
       "qualifiedName": "@happyvertical/smrt-users:AccessRequest",
       "collection": "accessrequests",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/AccessRequest.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/AccessRequest.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "email": {
@@ -3114,7 +3114,7 @@
       "className": "UsersCliAuthRequest",
       "qualifiedName": "@happyvertical/smrt-users:UsersCliAuthRequest",
       "collection": "userscliauthrequests",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/CliAuthRequest.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/CliAuthRequest.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "userCode": {
@@ -3270,7 +3270,7 @@
       "className": "Group",
       "qualifiedName": "@happyvertical/smrt-users:Group",
       "collection": "groups",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/Group.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/Group.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "tenantId": {
@@ -3390,7 +3390,7 @@
       "className": "GroupMember",
       "qualifiedName": "@happyvertical/smrt-users:GroupMember",
       "collection": "groupmembers",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/GroupMember.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/GroupMember.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "groupId": {
@@ -3507,7 +3507,7 @@
       "className": "GroupRole",
       "qualifiedName": "@happyvertical/smrt-users:GroupRole",
       "collection": "grouproles",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/GroupRole.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/GroupRole.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "groupId": {
@@ -3624,7 +3624,7 @@
       "className": "UsersMagicLinkToken",
       "qualifiedName": "@happyvertical/smrt-users:UsersMagicLinkToken",
       "collection": "usersmagiclinktokens",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/MagicLinkToken.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/MagicLinkToken.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "nonce": {
@@ -3766,7 +3766,7 @@
       "className": "Membership",
       "qualifiedName": "@happyvertical/smrt-users:Membership",
       "collection": "memberships",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/Membership.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/Membership.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "userId": {
@@ -3929,7 +3929,7 @@
       "className": "MembershipOverride",
       "qualifiedName": "@happyvertical/smrt-users:MembershipOverride",
       "collection": "membershipoverrides",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/MembershipOverride.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/MembershipOverride.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "membershipId": {
@@ -4073,7 +4073,7 @@
       "className": "Permission",
       "qualifiedName": "@happyvertical/smrt-users:Permission",
       "collection": "permissions",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/Permission.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/Permission.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "name": {
@@ -4216,7 +4216,7 @@
       "className": "Role",
       "qualifiedName": "@happyvertical/smrt-users:Role",
       "collection": "roles",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/Role.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/Role.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "tenantId": {
@@ -4384,7 +4384,7 @@
       "className": "RolePermission",
       "qualifiedName": "@happyvertical/smrt-users:RolePermission",
       "collection": "rolepermissions",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/RolePermission.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/RolePermission.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "roleId": {
@@ -4501,7 +4501,7 @@
       "className": "Session",
       "qualifiedName": "@happyvertical/smrt-users:Session",
       "collection": "sessions",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/Session.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/Session.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "userId": {
@@ -4777,7 +4777,7 @@
       "className": "Tenant",
       "qualifiedName": "@happyvertical/smrt-users:Tenant",
       "collection": "tenants",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/Tenant.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/Tenant.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "created_at": {
@@ -5498,7 +5498,7 @@
       "className": "TenantIntegration",
       "qualifiedName": "@happyvertical/smrt-users:TenantIntegration",
       "collection": "tenantintegrations",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/TenantIntegration.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/TenantIntegration.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "tenantId": {
@@ -5771,7 +5771,7 @@
       "className": "TenantPermissionOverride",
       "qualifiedName": "@happyvertical/smrt-users:TenantPermissionOverride",
       "collection": "tenantpermissionoverrides",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/TenantPermissionOverride.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/TenantPermissionOverride.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "tenantId": {
@@ -5931,7 +5931,7 @@
       "className": "User",
       "qualifiedName": "@happyvertical/smrt-users:User",
       "collection": "users",
-      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-5xldd/smrt/smrt/packages/users/src/models/User.ts",
+      "filePath": "/home/runner/.local/share/pnpm/store/.workspaces/arc-happyvertical-node-sqm7p-runner-k6895/smrt/smrt/packages/users/src/models/User.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
         "profileId": {

package/dist/services/OidcLoginService.d.ts

@@ -1,5 +1,5 @@
 import { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { OidcClaims, OidcIdentityResult, OidcProfileResolver } from '../collections/UserCollection.js';
+import { OidcClaims, OidcIdentityResult, OidcProfileOwnerAuthorizer, OidcProfileResolver } from '../collections/UserCollection.js';
 export type OidcProviderKind = 'kanidm' | 'dex' | 'generic';
 export type OidcTokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'none';
 export interface OidcProviderConfig {
@@ -103,6 +103,11 @@ export interface OidcLoginServiceOptions extends SmrtClassOptions {
      * OIDC identity, User, or session creation.
      */
     resolveProfile?: OidcProfileResolver;
+    /**
+     * Explicitly authorize first binding to a pre-provisioned canonical Profile
+     * and its existing User owner after protocol claim validation.
+     */
+    authorizeProfileOwner?: OidcProfileOwnerAuthorizer;
 }
 export declare class OidcLoginError extends Error {
     constructor(message: string);
@@ -116,6 +121,7 @@ export declare class OidcLoginService {
     private readonly clockTolerance;
     private readonly fetchImpl;
     private readonly metadataCacheTtlMs;
+    private readonly authorizeProfileOwner?;
     private readonly resolveProfile?;
     private metadataFetchedAt;
     private metadataPromise?;

package/dist/services/OidcLoginService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcLoginService.d.ts","sourceRoot":"","sources":["../../src/services/OidcLoginService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAQjE,OAAO,EACL,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EAEzB,MAAM,kCAAkC,CAAC;AAO1C,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAE5D,MAAM,MAAM,2BAA2B,GACnC,qBAAqB,GACrB,oBAAoB,GACpB,MAAM,CAAC;AAEX,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC5E;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,2BAA2B,CAAC;CACvD;AAED,MAAM,WAAW,6BAA6B;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,eAAgB,SAAQ,6BAA6B;IACpE,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA2B,SAAQ,kBAAkB;IACpE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,6BAA6B;IAC5C,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,uBAAwB,SAAQ,gBAAgB;IAC/D,uCAAuC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,EAAE,0BAA0B,CAAC;IACrC,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,0EAA0E;IAC1E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAED,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAqBD,wBAAgB,kBAAkB,IAAI,eAAe,CAGpD;AAkOD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,eAAe,GAAG,MAAM,CAG1E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAQpE;AAED,wBAAgB,yBAAyB,CACvC,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,GAAE,6BAAkC,GAC1C,sBAAsB,CAgCxB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmB;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAsB;IACtD,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,eAAe,CAAC,CAAgC;IACxD,OAAO,CAAC,UAAU,CAAC,CAAkB;IACrC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;gBAElB,OAAO,EAAE,uBAAuB;IA8B5C,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe;IAW/C,WAAW,IAAI,OAAO,CAAC,oBAAoB,CAAC;YAqBpC,aAAa;IAuCrB,sBAAsB,CAC1B,OAAO,GAAE,6BAAkC,GAC1C,OAAO,CAAC;QAAE,WAAW,EAAE,eAAe,CAAC;QAAC,GAAG,EAAE,GAAG,CAAA;KAAE,CAAC;IA2BhD,gBAAgB,CACpB,WAAW,EAAE,MAAM,GAAG,GAAG,EACzB,WAAW,EAAE,eAAe,GAC3B,OAAO,CAAC,kBAAkB,CAAC;IAYxB,aAAa,CACjB,WAAW,EAAE,MAAM,GAAG,GAAG,EACzB,WAAW,EAAE,eAAe,GAC3B,OAAO,CAAC,eAAe,CAAC;IAiB3B,OAAO,CAAC,gBAAgB;YAwCV,YAAY;YA8DZ,wBAAwB;YAsCxB,aAAa;CAuB5B"}
+{"version":3,"file":"OidcLoginService.d.ts","sourceRoot":"","sources":["../../src/services/OidcLoginService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAQjE,OAAO,EACL,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EAEzB,MAAM,kCAAkC,CAAC;AAO1C,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAE5D,MAAM,MAAM,2BAA2B,GACnC,qBAAqB,GACrB,oBAAoB,GACpB,MAAM,CAAC;AAEX,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC5E;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,2BAA2B,CAAC;CACvD;AAED,MAAM,WAAW,6BAA6B;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,eAAgB,SAAQ,6BAA6B;IACpE,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA2B,SAAQ,kBAAkB;IACpE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,6BAA6B;IAC5C,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,uBAAwB,SAAQ,gBAAgB;IAC/D,uCAAuC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,EAAE,0BAA0B,CAAC;IACrC,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,0EAA0E;IAC1E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,0BAA0B,CAAC;CACpD;AAED,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAqBD,wBAAgB,kBAAkB,IAAI,eAAe,CAGpD;AAkOD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,eAAe,GAAG,MAAM,CAG1E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAQpE;AAED,wBAAgB,yBAAyB,CACvC,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,GAAE,6BAAkC,GAC1C,sBAAsB,CAgCxB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmB;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAA6B;IACpE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAsB;IACtD,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,eAAe,CAAC,CAAgC;IACxD,OAAO,CAAC,UAAU,CAAC,CAAkB;IACrC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;gBAElB,OAAO,EAAE,uBAAuB;IAgC5C,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe;IAW/C,WAAW,IAAI,OAAO,CAAC,oBAAoB,CAAC;YAqBpC,aAAa;IAuCrB,sBAAsB,CAC1B,OAAO,GAAE,6BAAkC,GAC1C,OAAO,CAAC;QAAE,WAAW,EAAE,eAAe,CAAC;QAAC,GAAG,EAAE,GAAG,CAAA;KAAE,CAAC;IA2BhD,gBAAgB,CACpB,WAAW,EAAE,MAAM,GAAG,GAAG,EACzB,WAAW,EAAE,eAAe,GAC3B,OAAO,CAAC,kBAAkB,CAAC;IAYxB,aAAa,CACjB,WAAW,EAAE,MAAM,GAAG,GAAG,EACzB,WAAW,EAAE,eAAe,GAC3B,OAAO,CAAC,eAAe,CAAC;IAkB3B,OAAO,CAAC,gBAAgB;YAwCV,YAAY;YA8DZ,wBAAwB;YAsCxB,aAAa;CAuB5B"}