@happyvertical/smrt-users 0.40.70 → 0.42.0

package/dist/collections/CliAuthRequestCollection.d.ts

@@ -12,8 +12,17 @@ export declare class UsersCliAuthRequestCollection extends SmrtCollection<UsersC
     findByDeviceCodeHash(deviceCodeHash: string): Promise<UsersCliAuthRequest | null>;
     /**
      * Delete expired pending requests (cleanup job).
+     *
+     * Scheduled by the framework retention sweep (#2375); `expiresAt` carries an
+     * index for this predicate.
+     *
+     * @param options.dryRun - Count the requests the predicate selects without
+     *   deleting them.
+     * @returns Number of requests deleted (or, under `dryRun`, matched)
      */
-    deleteExpired(): Promise<number>;
+    deleteExpired(options?: {
+        dryRun?: boolean;
+    }): Promise<number>;
 }
 export { UsersCliAuthRequestCollection as CliAuthRequestCollection };
 //# sourceMappingURL=CliAuthRequestCollection.d.ts.map

package/dist/collections/CliAuthRequestCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CliAuthRequestCollection.d.ts","sourceRoot":"","sources":["../../src/collections/CliAuthRequestCollection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,qBAAa,6BAA8B,SAAQ,cAAc,CAAC,mBAAmB,CAAC;IACpF,MAAM,CAAC,QAAQ,CAAC,UAAU,6BAAuB;IAEjD;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAQ3E;;OAEG;IACG,oBAAoB,CACxB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAQtC;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;CAevC;AAED,OAAO,EAAE,6BAA6B,IAAI,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"CliAuthRequestCollection.d.ts","sourceRoot":"","sources":["../../src/collections/CliAuthRequestCollection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,qBAAa,6BAA8B,SAAQ,cAAc,CAAC,mBAAmB,CAAC;IACpF,MAAM,CAAC,QAAQ,CAAC,UAAU,6BAAuB;IAEjD;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAQ3E;;OAEG;IACG,oBAAoB,CACxB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAQtC;;;;;;;;;OASG;IACG,aAAa,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;CAwBzE;AAED,OAAO,EAAE,6BAA6B,IAAI,wBAAwB,EAAE,CAAC"}

package/dist/collections/MagicLinkTokenCollection.d.ts

@@ -19,8 +19,17 @@ export declare class UsersMagicLinkTokenCollection extends SmrtCollection<UsersM
     markUsed(nonce: string): Promise<boolean>;
     /**
      * Delete expired tokens (cleanup job)
+     *
+     * Scheduled by the framework retention sweep (#2375); `expiresAt` carries an
+     * index for this predicate.
+     *
+     * @param options.dryRun - Count the tokens the predicate selects without
+     *   deleting them.
+     * @returns Number of tokens deleted (or, under `dryRun`, matched)
      */
-    deleteExpired(): Promise<number>;
+    deleteExpired(options?: {
+        dryRun?: boolean;
+    }): Promise<number>;
 }
 export { UsersMagicLinkTokenCollection as MagicLinkTokenCollection };
 //# sourceMappingURL=MagicLinkTokenCollection.d.ts.map

package/dist/collections/MagicLinkTokenCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkTokenCollection.d.ts","sourceRoot":"","sources":["../../src/collections/MagicLinkTokenCollection.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE;;GAEG;AACH,qBAAa,6BAA8B,SAAQ,cAAc,CAAC,mBAAmB,CAAC;IACpF,MAAM,CAAC,QAAQ,CAAC,UAAU,6BAAuB;IAEjD;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAMrE;;;;;;OAMG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB/C;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;CAgBvC;AAED,OAAO,EAAE,6BAA6B,IAAI,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"MagicLinkTokenCollection.d.ts","sourceRoot":"","sources":["../../src/collections/MagicLinkTokenCollection.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE;;GAEG;AACH,qBAAa,6BAA8B,SAAQ,cAAc,CAAC,mBAAmB,CAAC;IACpF,MAAM,CAAC,QAAQ,CAAC,UAAU,6BAAuB;IAEjD;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAMrE;;;;;;OAMG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB/C;;;;;;;;;OASG;IACG,aAAa,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;CAwBzE;AAED,OAAO,EAAE,6BAA6B,IAAI,wBAAwB,EAAE,CAAC"}

package/dist/collections/SessionCollection.d.ts

@@ -53,9 +53,17 @@ export declare class SessionCollection extends SmrtCollection<Session> {
     revokeSession(sessionId: string): Promise<boolean>;
     /**
      * Delete expired sessions (cleanup job)
-     * Returns the number of deleted sessions
+     *
+     * Scheduled by the framework retention sweep (#2375); `expires_at` carries
+     * an index for this predicate.
+     *
+     * @param options.dryRun - Count the sessions the predicate selects without
+     *   deleting them.
+     * @returns Number of sessions deleted (or, under `dryRun`, matched)
      */
-    deleteExpired(): Promise<number>;
+    deleteExpired(options?: {
+        dryRun?: boolean;
+    }): Promise<number>;
     /**
      * Count active sessions for a user
      */

package/dist/collections/SessionCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionCollection.d.ts","sourceRoot":"","sources":["../../src/collections/SessionCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAGL,OAAO,EACR,MAAM,sBAAsB,CAAC;AAG9B;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,OAAO,CAAC;IAC5D,MAAM,CAAC,QAAQ,CAAC,UAAU,iBAAW;IAErC;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBpE;;;OAGG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IA8BlE;;OAEG;IACG,KAAK,CACT,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,OAAe,EAC1B,GAAG,GAAE,MAA4B,GAChC,OAAO,CAAC,OAAO,CAAC;IAYnB;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAapD;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAczD;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBzD;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASxD;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAiBtC;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKxD;;;;;;;;OAQG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,OAAO,CAAC;IASnB;;OAEG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,OAAO,CAAC;IASnB;;OAEG;IACG,cAAc,CAAC,CAAC,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CAM1B"}
+{"version":3,"file":"SessionCollection.d.ts","sourceRoot":"","sources":["../../src/collections/SessionCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAGL,OAAO,EACR,MAAM,sBAAsB,CAAC;AAG9B;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,OAAO,CAAC;IAC5D,MAAM,CAAC,QAAQ,CAAC,UAAU,iBAAW;IAErC;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBpE;;;OAGG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IA8BlE;;OAEG;IACG,KAAK,CACT,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,OAAe,EAC1B,GAAG,GAAE,MAA4B,GAChC,OAAO,CAAC,OAAO,CAAC;IAYnB;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAapD;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAczD;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBzD;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASxD;;;;;;;;;OASG;IACG,aAAa,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IA8BxE;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKxD;;;;;;;;OAQG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,OAAO,CAAC;IASnB;;OAEG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,OAAO,CAAC;IASnB;;OAEG;IACG,cAAc,CAAC,CAAC,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CAM1B"}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { AccessRequestCollection, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileOwnerAuthorization, type OidcProfileOwnerAuthorizer, type OidcProfileOwnerAuthorizerContext, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, PermissionCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantIntegrationCollection, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthRequestCollection, UsersMagicLinkTokenCollection, } from './collections/index.js';
 export { type BackfillUserEmailKeysResult, backfillUserEmailKeys, type DuplicateUserEmailKey, UserEmailKeyBackfillError, type UserEmailKeyBackfillErrorCode, } from './migrations/backfillUserEmailKeys.js';
 export { AccessRequest, type AccessRequestOptions, CliAuthRequest, type CliAuthRequestStatus, DEFAULT_SESSION_TTL, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupMember, GroupRole, generateSessionId, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkToken, Membership, MembershipOverride, Permission, Role, RolePermission, Session, Tenant, TenantIntegration, type TenantIntegrationCheckSummary, type TenantIntegrationOptions, type TenantIntegrationProvider, type TenantIntegrationStatus, TenantPermissionOverride, User, UsersCliAuthRequest, UsersMagicLinkToken, } from './models/index.js';
+export { CLI_AUTH_RETENTION_TASK, MAGIC_LINK_RETENTION_TASK, registerUserRetentionTasks, SESSIONS_RETENTION_TASK, USER_RETENTION_TASKS, unregisterUserRetentionTasks, } from './retention.js';
 export { ACCESS_REQUEST_CAPABILITIES, type AccessRequestAuthorizationContext, type AccessRequestAuthorizer, type AccessRequestCapability, AccessRequestError, type AccessRequestErrorCode, type AccessRequestEvent, type AccessRequestEventHandler, type AccessRequestEventType, AccessRequestService, type AccessRequestServiceOptions, type ApproveAccessRequestOptions, type ApproveCliAuthRequestInput, applyPostgresPermissionPolicies, assertOperationPermission, type CancelAccessRequestOptions, type CliAuthStartResult, type CliAuthTokenResult, type CreateAccessRequestInput, type CreateAuthorizationUrlOptions, checkOperationPermission, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, type DeclineAccessRequestOptions, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, type EnsureTenantResult, encodeOidcTransaction, type GeneratePostgresPermissionSqlResult, type GraduateAccessRequestOptions, type GraduateAccessRequestResult, type GraduateExistingTenantOption, type GraduateNewTenantOption, type GraduateTenantOption, generatePostgresPermissionSql, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, type ListAccessRequestsFilter, MagicLinkError, type MagicLinkResult, MagicLinkService, type MagicLinkServiceOptions, type MagicLinkVerifyResult, MobileAuthError, type MobileAuthErrorCode, MobileAuthService, type MobileAuthServiceOptions, type MobileBootstrapContext, type MobileLoginContext, type MobileLogoutResult, type MobileRequestMeta, type MobileResolvedUser, type MobileTenantContext, normalizeOperationPermissionAction, type OidcCallbackResult, OidcLoginError, type OidcLoginResult, OidcLoginService, type OidcLoginServiceOptions, type OidcProviderConfig, type OidcProviderKind, type OidcProviderMetadata, type OidcProviderResolution, type OidcProviderResolutionOptions, type OidcTokenEndpointAuthMethod, type OidcTokenSet, type OidcTransaction, type OperationPermissionAllowReason, type OperationPermissionCollectionInput, type OperationPermissionDecision, type OperationPermissionDenyReason, OperationPermissionError, type OperationPermissionOptions, type PermissionCatalog, PermissionCatalogService, type PermissionCatalogSource, type PermissionCatalogSyncResult, type PermissionDefinition, type PermissionResolutionOptions, type PermissionResolutionResult, PermissionResolver, type PostgresPermissionAction, type PostgresPermissionBinding, type PostgresPermissionPolicyReportItem, type PostgresPermissionPolicyTarget, type PrincipalPermissionRuntimeOptions, type ResolvedOidcProviderConfig, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, type SessionContext, type SessionPermissionRuntimeContext, type SessionPermissionRuntimeOptions, SessionService, type SessionServiceOptions, type SwitchTenantResult, syncPermissionCatalog, type TenantPermissionInheritanceResult, TenantService, type TenantWithOwnershipResult, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, type TerminalAuthServiceOptions, type UsersConfig, type UsersOidcConfig, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext, } from './services/index.js';
 export { AccessRequestStatus, DEFAULT_ROLE_SLUGS, DEFAULT_ROLES, DEFAULT_TENANT_POLICY, type DefaultRoleSlug, MembershipStatus, OverrideEffect, SessionStatus, TenantPermissionEffect, type TenantPolicy, type TenantPolicyMode, TenantStatus, UserStatus, } from './types/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAGhC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAWhC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,9 +1,9 @@
-import { $ as PermissionCollection, A as UserEmailKeyBackfillError, B as Session, C as decodeOidcTransaction, Ct as TenantPermissionEffect, E as resolveOidcProviderConfig, F as TenantHierarchyError, G as deriveOperationPermissionCollectionName, H as DEFAULT_ROLE_PERMISSION_PATTERNS, I as MAX_TENANT_HIERARCHY_DEPTH, J as registerPermissionDefinitions, K as deriveOperationPermissionSlug, L as Tenant, M as TenantPermissionOverrideCollection, N as TenantPermissionOverride, O as OidcProvisioningError, P as TenantCollection, Q as Role, R as SessionCollection, S as OidcLoginService, St as SessionStatus, T as getUsersOidcConfig, Tt as UserStatus, U as RolePermissionCollection, V as generateSessionId, W as PermissionCatalogService, X as RolePermission, Y as syncPermissionCatalog, Z as RoleCollection, _ as readMobileBearerToken, _t as DEFAULT_ROLES, a as TerminalAuthRateLimitError, at as GroupRoleCollection, b as PermissionResolver, bt as MembershipStatus, c as assertOperationPermission, ct as GroupMember, d as getCurrentSessionPermissionContext, dt as UsersCliAuthRequestCollection, et as Permission, f as getRequestScopedDatabase, ft as UsersCliAuthRequest, g as MobileAuthService, gt as AccessRequestStatus, h as MobileAuthError, ht as normalizeEmail, i as TerminalAuthError, it as Membership, j as backfillUserEmailKeys, k as UserCollection, l as checkOperationPermission, lt as GroupCollection, m as withSessionPermissionContext, mt as isValidEmail, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as MembershipOverride, o as TerminalAuthService, ot as GroupRole, p as withPrincipalPermissionContext, pt as User, q as normalizeOperationPermissionAction, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as MembershipCollection, s as OperationPermissionError, st as GroupMemberCollection, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as MembershipOverrideCollection, u as hasOperationPermission, ut as Group, v as validateMobileRedirectUri, vt as DEFAULT_ROLE_SLUGS, w as encodeOidcTransaction, wt as TenantStatus, x as OidcLoginError, xt as OverrideEffect, y as SessionService, yt as DEFAULT_TENANT_POLICY, z as DEFAULT_SESSION_TTL } from "./chunks/TerminalAuthService-C1PVcd6q.js";
-import { ObjectRegistry, SmrtCollection, SmrtObject, field, findManifestEntryByQualifiedName, isUniqueViolationError, smrt } from "@happyvertical/smrt-core";
+import { $ as MembershipCollection, A as UserEmailKeyBackfillError, B as PermissionCatalogService, C as decodeOidcTransaction, Ct as UserStatus, E as resolveOidcProviderConfig, F as TenantHierarchyError, G as syncPermissionCatalog, H as deriveOperationPermissionSlug, I as MAX_TENANT_HIERARCHY_DEPTH, J as Role, K as RolePermission, L as Tenant, M as TenantPermissionOverrideCollection, N as TenantPermissionOverride, O as OidcProvisioningError, P as TenantCollection, Q as MembershipOverride, R as DEFAULT_ROLE_PERMISSION_PATTERNS, S as OidcLoginService, St as TenantStatus, T as getUsersOidcConfig, Tt as UsersCliAuthRequest, U as normalizeOperationPermissionAction, V as deriveOperationPermissionCollectionName, W as registerPermissionDefinitions, X as Permission, Y as PermissionCollection, Z as MembershipOverrideCollection, _ as readMobileBearerToken, _t as DEFAULT_TENANT_POLICY, a as TerminalAuthRateLimitError, at as GroupCollection, b as PermissionResolver, bt as SessionStatus, c as assertOperationPermission, ct as isValidEmail, d as getCurrentSessionPermissionContext, dt as DEFAULT_SESSION_TTL, et as Membership, f as getRequestScopedDatabase, ft as Session, g as MobileAuthService, gt as DEFAULT_ROLE_SLUGS, h as MobileAuthError, ht as DEFAULT_ROLES, i as TerminalAuthError, it as GroupMember, j as backfillUserEmailKeys, k as UserCollection, l as checkOperationPermission, lt as normalizeEmail, m as withSessionPermissionContext, mt as AccessRequestStatus, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as GroupRole, o as TerminalAuthService, ot as Group, p as withPrincipalPermissionContext, pt as generateSessionId, q as RoleCollection, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as GroupMemberCollection, s as OperationPermissionError, st as User, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as GroupRoleCollection, u as hasOperationPermission, ut as SessionCollection, v as validateMobileRedirectUri, vt as MembershipStatus, w as encodeOidcTransaction, wt as UsersCliAuthRequestCollection, x as OidcLoginError, xt as TenantPermissionEffect, y as SessionService, yt as OverrideEffect, z as RolePermissionCollection } from "./chunks/TerminalAuthService-BfX2Ujqe.js";
+import { ObjectRegistry, SmrtCollection, SmrtObject, field, findManifestEntryByQualifiedName, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask } from "@happyvertical/smrt-core";
 import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";
 import { createLogger } from "@happyvertical/logger";
 import { createHash } from "node:crypto";
-//#region src/models/AccessRequest.ts
+//#region src/models/MagicLinkToken.ts
 var __defProp$2 = Object.defineProperty;
 var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
 var __decorateClass$2 = (decorators, target, key, kind) => {
@@ -12,6 +12,134 @@ var __decorateClass$2 = (decorators, target, key, kind) => {
 	if (kind && result) __defProp$2(target, key, result);
 	return result;
 };
+var DEFAULT_TOKEN_EXPIRY_SECONDS = 600;
+var UsersMagicLinkToken = class extends SmrtObject {
+	nonce = "";
+	/** Email address this token was generated for */
+	email = "";
+	/** Whether this token has been used */
+	used = false;
+	expiresAt = new Date(Date.now() + 600 * 1e3);
+	constructor(options = {}) {
+		super(options);
+		if (options.nonce !== void 0) this.nonce = options.nonce;
+		if (options.email !== void 0) this.email = options.email;
+		if (options.used !== void 0) this.used = options.used;
+		if (options.expiresAt !== void 0) this.expiresAt = options.expiresAt instanceof Date ? options.expiresAt : new Date(options.expiresAt);
+	}
+	/** Check if the token has expired */
+	isExpired() {
+		return /* @__PURE__ */ new Date() > this.expiresAt;
+	}
+	/** Check if the token is still valid (unused and not expired) */
+	isValid() {
+		return !this.used && !this.isExpired();
+	}
+};
+__decorateClass$2([field({
+	required: true,
+	unique: true
+})], UsersMagicLinkToken.prototype, "nonce", 2);
+__decorateClass$2([field({
+	type: "datetime",
+	indexed: true
+})], UsersMagicLinkToken.prototype, "expiresAt", 2);
+UsersMagicLinkToken = __decorateClass$2([smrt({
+	tableName: "users_magic_link_tokens",
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: true
+})], UsersMagicLinkToken);
+//#endregion
+//#region src/collections/MagicLinkTokenCollection.ts
+var UsersMagicLinkTokenCollection = class extends SmrtCollection {
+	static _itemClass = UsersMagicLinkToken;
+	/**
+	* Find a token by its nonce
+	*/
+	async findByNonce(nonce) {
+		return this.findOne({ where: { nonce } });
+	}
+	/**
+	* Atomically mark a token as used (single-use enforcement).
+	*
+	* Returns true if the nonce was successfully claimed (transitioned from
+	* unused to used). Returns false if the nonce was already used, expired,
+	* or doesn't exist — preventing race conditions in concurrent verify() calls.
+	*/
+	async markUsed(nonce) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const { rowCount } = await this.db.query(`UPDATE ${this.tableName}
+       SET used = ?, updated_at = ?
+       WHERE nonce = ? AND used = ? AND expires_at > ?`, true, now, nonce, false, now);
+		return rowCount > 0;
+	}
+	/**
+	* Delete expired tokens (cleanup job)
+	*
+	* Scheduled by the framework retention sweep (#2375); `expiresAt` carries an
+	* index for this predicate.
+	*
+	* @param options.dryRun - Count the tokens the predicate selects without
+	*   deleting them.
+	* @returns Number of tokens deleted (or, under `dryRun`, matched)
+	*/
+	async deleteExpired(options = {}) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const predicate = "expires_at < ?";
+		const counted = await this.db.query(`SELECT COUNT(*) AS total FROM ${this.tableName} WHERE ${predicate}`, now);
+		const total = Number(counted.rows?.[0]?.total ?? 0);
+		if (!Number.isFinite(total) || total <= 0) return 0;
+		if (!options.dryRun) await this.db.query(`DELETE FROM ${this.tableName} WHERE ${predicate}`, now);
+		return total;
+	}
+};
+//#endregion
+//#region src/retention.ts
+var SESSIONS_RETENTION_TASK = "users-sessions";
+var MAGIC_LINK_RETENTION_TASK = "users-magic-link-tokens";
+var CLI_AUTH_RETENTION_TASK = "users-cli-auth-requests";
+var USER_RETENTION_TASKS = [
+	SESSIONS_RETENTION_TASK,
+	MAGIC_LINK_RETENTION_TASK,
+	CLI_AUTH_RETENTION_TASK
+];
+function registerUserRetentionTasks() {
+	registerRetentionTask({
+		name: SESSIONS_RETENTION_TASK,
+		description: "Delete expired and revoked sessions",
+		run: async (db, context) => {
+			return (await SessionCollection.create({ db })).deleteExpired({ dryRun: context.dryRun });
+		}
+	});
+	registerRetentionTask({
+		name: MAGIC_LINK_RETENTION_TASK,
+		description: "Delete expired magic-link tokens",
+		run: async (db, context) => {
+			return (await UsersMagicLinkTokenCollection.create({ db })).deleteExpired({ dryRun: context.dryRun });
+		}
+	});
+	registerRetentionTask({
+		name: CLI_AUTH_RETENTION_TASK,
+		description: "Delete expired pending CLI auth requests",
+		run: async (db, context) => {
+			return (await UsersCliAuthRequestCollection.create({ db })).deleteExpired({ dryRun: context.dryRun });
+		}
+	});
+}
+function unregisterUserRetentionTasks() {
+	for (const name of USER_RETENTION_TASKS) unregisterRetentionTask(name);
+}
+//#endregion
+//#region src/models/AccessRequest.ts
+var __defProp$1 = Object.defineProperty;
+var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __decorateClass$1 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$1(target, key, result);
+	return result;
+};
 var AccessRequest = class extends SmrtObject {
 	email = "";
 	name = null;
@@ -94,24 +222,24 @@ var AccessRequest = class extends SmrtObject {
 		return this.status === AccessRequestStatus.DECLINED || this.status === AccessRequestStatus.GRADUATED || this.status === AccessRequestStatus.CANCELED;
 	}
 };
-__decorateClass$2([field({
+__decorateClass$1([field({
 	required: true,
 	indexed: true
 })], AccessRequest.prototype, "email", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "name", 2);
-__decorateClass$2([field({
+__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "name", 2);
+__decorateClass$1([field({
 	type: "text",
 	indexed: true
 })], AccessRequest.prototype, "status", 2);
-__decorateClass$2([field({ indexed: true })], AccessRequest.prototype, "source", 2);
-__decorateClass$2([field()], AccessRequest.prototype, "requestContext", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "note", 2);
-__decorateClass$2([field()], AccessRequest.prototype, "requestedAt", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "decidedAt", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "decidedBy", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "resultingUserId", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "tenantHint", 2);
-AccessRequest = __decorateClass$2([smrt({
+__decorateClass$1([field({ indexed: true })], AccessRequest.prototype, "source", 2);
+__decorateClass$1([field()], AccessRequest.prototype, "requestContext", 2);
+__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "note", 2);
+__decorateClass$1([field()], AccessRequest.prototype, "requestedAt", 2);
+__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "decidedAt", 2);
+__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "decidedBy", 2);
+__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "resultingUserId", 2);
+__decorateClass$1([field({ nullable: true })], AccessRequest.prototype, "tenantHint", 2);
+AccessRequest = __decorateClass$1([smrt({
 	tableName: "access_requests",
 	conflictColumns: ["id"],
 	api: { include: [] },
@@ -164,89 +292,6 @@ var AccessRequestCollection = class extends SmrtCollection {
 	}
 };
 //#endregion
-//#region src/models/MagicLinkToken.ts
-var __defProp$1 = Object.defineProperty;
-var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
-var __decorateClass$1 = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
-	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp$1(target, key, result);
-	return result;
-};
-var DEFAULT_TOKEN_EXPIRY_SECONDS = 600;
-var UsersMagicLinkToken = class extends SmrtObject {
-	nonce = "";
-	/** Email address this token was generated for */
-	email = "";
-	/** Whether this token has been used */
-	used = false;
-	/** When this token expires */
-	expiresAt = new Date(Date.now() + 600 * 1e3);
-	constructor(options = {}) {
-		super(options);
-		if (options.nonce !== void 0) this.nonce = options.nonce;
-		if (options.email !== void 0) this.email = options.email;
-		if (options.used !== void 0) this.used = options.used;
-		if (options.expiresAt !== void 0) this.expiresAt = options.expiresAt instanceof Date ? options.expiresAt : new Date(options.expiresAt);
-	}
-	/** Check if the token has expired */
-	isExpired() {
-		return /* @__PURE__ */ new Date() > this.expiresAt;
-	}
-	/** Check if the token is still valid (unused and not expired) */
-	isValid() {
-		return !this.used && !this.isExpired();
-	}
-};
-__decorateClass$1([field({
-	required: true,
-	unique: true
-})], UsersMagicLinkToken.prototype, "nonce", 2);
-UsersMagicLinkToken = __decorateClass$1([smrt({
-	tableName: "users_magic_link_tokens",
-	api: { include: [] },
-	mcp: { include: [] },
-	cli: true
-})], UsersMagicLinkToken);
-//#endregion
-//#region src/collections/MagicLinkTokenCollection.ts
-var UsersMagicLinkTokenCollection = class extends SmrtCollection {
-	static _itemClass = UsersMagicLinkToken;
-	/**
-	* Find a token by its nonce
-	*/
-	async findByNonce(nonce) {
-		return this.findOne({ where: { nonce } });
-	}
-	/**
-	* Atomically mark a token as used (single-use enforcement).
-	*
-	* Returns true if the nonce was successfully claimed (transitioned from
-	* unused to used). Returns false if the nonce was already used, expired,
-	* or doesn't exist — preventing race conditions in concurrent verify() calls.
-	*/
-	async markUsed(nonce) {
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const { rowCount } = await this.db.query(`UPDATE ${this.tableName}
-       SET used = ?, updated_at = ?
-       WHERE nonce = ? AND used = ? AND expires_at > ?`, true, now, nonce, false, now);
-		return rowCount > 0;
-	}
-	/**
-	* Delete expired tokens (cleanup job)
-	*/
-	async deleteExpired() {
-		const now = /* @__PURE__ */ new Date();
-		const tokens = await this.list({ where: { "expiresAt <": now.toISOString() } });
-		let count = 0;
-		for (const token of tokens) {
-			await token.delete();
-			count++;
-		}
-		return count;
-	}
-};
-//#endregion
 //#region src/models/TenantIntegration.ts
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -908,7 +953,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-C1PVcd6q.js").then((n) => n.D);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-BfX2Ujqe.js").then((n) => n.D);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -937,7 +982,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-C1PVcd6q.js").then((n) => n.D);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-BfX2Ujqe.js").then((n) => n.D);
 		const key = await this.getSigningKey();
 		let payload;
 		try {
@@ -1410,6 +1455,9 @@ var TenantService = class TenantService {
 	}
 };
 //#endregion
-export { ACCESS_REQUEST_CAPABILITIES, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, Role, RoleCollection, RolePermission, RolePermissionCollection, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, User, UserCollection, UserEmailKeyBackfillError, UserStatus, applyPostgresPermissionPolicies, assertOperationPermission, backfillUserEmailKeys, checkOperationPermission, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, normalizeOperationPermissionAction, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, syncPermissionCatalog, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
+//#region src/index.ts
+registerUserRetentionTasks();
+//#endregion
+export { ACCESS_REQUEST_CAPABILITIES, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, MAGIC_LINK_RETENTION_TASK, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, applyPostgresPermissionPolicies, assertOperationPermission, backfillUserEmailKeys, checkOperationPermission, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, normalizeOperationPermissionAction, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
 
 //# sourceMappingURL=index.js.map