@happyvertical/smrt-users 0.51.14 → 0.51.16

package/dist/chunks/types-DFqeph0R.js

@@ -0,0 +1,39 @@
+import { AccessRequestStatus, MembershipStatus, OverrideEffect, SessionStatus, TenantPermissionEffect, TenantStatus, UserStatus } from "@happyvertical/smrt-types";
+//#region src/types/index.ts
+var DEFAULT_ROLE_SLUGS = {
+	OWNER: "owner",
+	ADMIN: "admin",
+	MEMBER: "member",
+	VIEWER: "viewer"
+};
+var DEFAULT_ROLES = [
+	{
+		slug: DEFAULT_ROLE_SLUGS.OWNER,
+		name: "Owner",
+		description: "Full access to all resources"
+	},
+	{
+		slug: DEFAULT_ROLE_SLUGS.ADMIN,
+		name: "Administrator",
+		description: "Manage users and settings"
+	},
+	{
+		slug: DEFAULT_ROLE_SLUGS.MEMBER,
+		name: "Member",
+		description: "Standard access"
+	},
+	{
+		slug: DEFAULT_ROLE_SLUGS.VIEWER,
+		name: "Viewer",
+		description: "Read-only access"
+	}
+];
+var DEFAULT_TENANT_POLICY = {
+	mode: "flexible",
+	maxTenants: 0,
+	defaultName: "Default Workspace"
+};
+//#endregion
+export { MembershipStatus as a, TenantPermissionEffect as c, DEFAULT_TENANT_POLICY as i, TenantStatus as l, DEFAULT_ROLES as n, OverrideEffect as o, DEFAULT_ROLE_SLUGS as r, SessionStatus as s, AccessRequestStatus as t, UserStatus as u };
+
+//# sourceMappingURL=types-DFqeph0R.js.map

package/dist/chunks/types-DFqeph0R.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-DFqeph0R.js","names":[],"sources":["../../src/types/index.ts"],"sourcesContent":["/**\n * Type definitions for smrt-users\n * @packageDocumentation\n */\n\n// Re-export status enums from smrt-types for backwards compatibility\n// These are defined in smrt-types to allow browser-safe packages to import them\nexport {\n  AccessRequestStatus,\n  MembershipStatus,\n  OverrideEffect,\n  SessionStatus,\n  TenantPermissionEffect,\n  TenantStatus,\n  UserStatus,\n} from '@happyvertical/smrt-types';\n\n// ============= Default System Roles =============\n\n/**\n * Default system role slugs\n */\nexport const DEFAULT_ROLE_SLUGS = {\n  OWNER: 'owner',\n  ADMIN: 'admin',\n  MEMBER: 'member',\n  VIEWER: 'viewer',\n} as const;\n\n/**\n * Default system roles configuration\n */\nexport const DEFAULT_ROLES = [\n  {\n    slug: DEFAULT_ROLE_SLUGS.OWNER,\n    name: 'Owner',\n    description: 'Full access to all resources',\n  },\n  {\n    slug: DEFAULT_ROLE_SLUGS.ADMIN,\n    name: 'Administrator',\n    description: 'Manage users and settings',\n  },\n  {\n    slug: DEFAULT_ROLE_SLUGS.MEMBER,\n    name: 'Member',\n    description: 'Standard access',\n  },\n  {\n    slug: DEFAULT_ROLE_SLUGS.VIEWER,\n    name: 'Viewer',\n    description: 'Read-only access',\n  },\n] as const;\n\nexport type DefaultRoleSlug =\n  (typeof DEFAULT_ROLE_SLUGS)[keyof typeof DEFAULT_ROLE_SLUGS];\n\n// ============= Tenant Policy =============\n\n/**\n * Tenant policy mode\n *\n * - `flexible`: No tenant created on signup, user can have zero tenants\n * - `personal`: Auto-create personal tenant on first login, can delete all\n * - `required`: Auto-create personal tenant, must keep at least one\n */\nexport type TenantPolicyMode = 'flexible' | 'personal' | 'required';\n\n/**\n * Tenant policy configuration\n *\n * Set in smrt.config.js to control tenant creation behavior\n */\nexport interface TenantPolicy {\n  /** Policy mode */\n  mode: TenantPolicyMode;\n\n  /** Maximum tenants per user (0 = unlimited) */\n  maxTenants: number;\n\n  /** Name for auto-created default tenant */\n  defaultName: string;\n}\n\n/**\n * Default tenant policy (flexible, unlimited)\n */\nexport const DEFAULT_TENANT_POLICY: TenantPolicy = {\n  mode: 'flexible',\n  maxTenants: 0,\n  defaultName: 'Default Workspace',\n};\n"],"mappings":";;AAsBO,IAAM,qBAAqB;CAChC,OAAO;CACP,OAAO;CACP,QAAQ;CACR,QAAQ;AACV;AAKO,IAAM,gBAAgB;CAC3B;EACE,MAAM,mBAAmB;EACzB,MAAM;EACN,aAAa;CACf;CACA;EACE,MAAM,mBAAmB;EACzB,MAAM;EACN,aAAa;CACf;CACA;EACE,MAAM,mBAAmB;EACzB,MAAM;EACN,aAAa;CACf;CACA;EACE,MAAM,mBAAmB;EACzB,MAAM;EACN,aAAa;CACf;AACF;AAmCO,IAAM,wBAAsC;CACjD,MAAM;CACN,YAAY;CACZ,aAAa;AACf"}

package/dist/collections/TenantCollection.d.ts

@@ -1,13 +1,8 @@
-import { SmrtCollection, SmrtCreateInput } from '@happyvertical/smrt-core';
+import { SmrtCollection } from '@happyvertical/smrt-core';
 import { Tenant } from '../models/Tenant.js';
+import { TenantHierarchyError } from '../models/tenant-hierarchy.js';
 import { TenantStatus } from '../types/index.js';
-/**
- * Error thrown when tenant hierarchy operations fail
- */
-export declare class TenantHierarchyError extends Error {
-    readonly code: 'CIRCULAR_REFERENCE' | 'MAX_DEPTH_EXCEEDED' | 'PARENT_NOT_FOUND' | 'INVALID_OPERATION';
-    constructor(message: string, code: 'CIRCULAR_REFERENCE' | 'MAX_DEPTH_EXCEEDED' | 'PARENT_NOT_FOUND' | 'INVALID_OPERATION');
-}
+export { TenantHierarchyError };
 /**
  * Options for creating a child tenant
  */
@@ -28,7 +23,12 @@ export interface CreateChildTenantOptions {
  * - Basic CRUD operations
  * - Hierarchy management (parent/child relationships)
  * - Tree traversal (ancestors, descendants, siblings)
- * - Hierarchy path maintenance
+ * - Hierarchy validation
+ *
+ * `hierarchyLevel` / `hierarchyPath` are derived from `parentTenantId` by
+ * {@link Tenant.save} on every create, update, and move — any value supplied
+ * in a create input is recomputed, because both are an authorization source
+ * (smrt#3036).
  */
 export declare class TenantCollection extends SmrtCollection<Tenant> {
     static readonly _itemClass: typeof Tenant;
@@ -85,12 +85,19 @@ export declare class TenantCollection extends SmrtCollection<Tenant> {
     isDescendantOf(potentialDescendantId: string, tenantId: string): Promise<boolean>;
     /**
      * Create a child tenant under a parent.
-     * Automatically sets hierarchyLevel and hierarchyPath.
+     * `hierarchyLevel` and `hierarchyPath` are derived by {@link Tenant.save}.
+     *
+     * @throws {TenantHierarchyError} `PARENT_NOT_FOUND` or `MAX_DEPTH_EXCEEDED`.
      */
     createChild(parentTenantId: string, options: CreateChildTenantOptions): Promise<Tenant>;
     /**
-     * Move a tenant to a new parent.
-     * Updates hierarchyLevel and hierarchyPath for the tenant and all descendants.
+     * Move a tenant to a new parent (or to the root with `null`).
+     *
+     * {@link Tenant.save} checks the new parent is visible under the caller's
+     * tenancy scope, recomputes the tenant's hierarchy fields from the real
+     * parent chain and re-materializes every descendant, refusing the move
+     * before writing anything when it would create a cycle or push any
+     * descendant past `MAX_TENANT_HIERARCHY_DEPTH`.
      */
     moveToParent(tenantId: string, newParentId: string | null): Promise<Tenant>;
     /**
@@ -109,12 +116,5 @@ export declare class TenantCollection extends SmrtCollection<Tenant> {
     getTree(rootTenantId?: string): Promise<Array<Tenant & {
         children: Tenant[];
     }>>;
-    /**
-     * Override create to automatically set hierarchy fields for new tenants.
-     * Only calculates them when the caller hasn't already supplied
-     * `hierarchyLevel`/`hierarchyPath` in the create input — an explicitly
-     * provided value is preserved as-is.
-     */
-    create(options: SmrtCreateInput<Tenant>): Promise<Tenant>;
 }
 //# sourceMappingURL=TenantCollection.d.ts.map

package/dist/collections/TenantCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TenantCollection.d.ts","sourceRoot":"","sources":["../../src/collections/TenantCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAA8B,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aAG3B,IAAI,EAChB,oBAAoB,GACpB,oBAAoB,GACpB,kBAAkB,GAClB,mBAAmB;gBALvB,OAAO,EAAE,MAAM,EACC,IAAI,EAChB,oBAAoB,GACpB,oBAAoB,GACpB,kBAAkB,GAClB,mBAAmB;CAK1B;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,6EAA6E;IAC7E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,MAAM,CAAC;IAC1D,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAU;IAIpC;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAO3D;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIrC;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUtD;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAOpC;;OAEG;IACG,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAO7D;;OAEG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQ1D;;;OAGG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA2BvD;;;OAGG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK/D;;;OAGG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA4BzD;;OAEG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAetD;;OAEG;IACG,YAAY,CAChB,mBAAmB,EAAE,MAAM,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAUnB;;OAEG;IACG,cAAc,CAClB,qBAAqB,EAAE,MAAM,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAMnB;;;OAGG;IACG,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,CAAC;IAuClB;;;OAGG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,OAAO,CAAC,MAAM,CAAC;IAiHlB;;OAEG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIjD;;;OAGG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAwD5D;;;OAGG;IACG,OAAO,CACX,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IA4BlD;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CA2ChE"}
+{"version":3,"file":"TenantCollection.d.ts","sourceRoot":"","sources":["../../src/collections/TenantCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,6EAA6E;IAC7E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,MAAM,CAAC;IAC1D,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAU;IAIpC;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAO3D;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIrC;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUtD;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAOpC;;OAEG;IACG,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAO7D;;OAEG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQ1D;;;OAGG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA2BvD;;;OAGG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK/D;;;OAGG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA4BzD;;OAEG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAetD;;OAEG;IACG,YAAY,CAChB,mBAAmB,EAAE,MAAM,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAUnB;;OAEG;IACG,cAAc,CAClB,qBAAqB,EAAE,MAAM,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAMnB;;;;;OAKG;IACG,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,CAAC;IAYlB;;;;;;;;OAQG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,OAAO,CAAC,MAAM,CAAC;IAqBlB;;OAEG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIjD;;;OAGG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAwD5D;;;OAGG;IACG,OAAO,CACX,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAyBnD"}

package/dist/index.d.ts

@@ -1,7 +1,9 @@
 export { AccessRequestCollection, type CliAuthApproveReservation, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileOwnerAuthorization, type OidcProfileOwnerAuthorizer, type OidcProfileOwnerAuthorizerContext, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, PermissionCollection, ResourceGrantCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantIntegrationCollection, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthApproveLimitCollection, UsersCliAuthRequestCollection, UsersMagicLinkTokenCollection, } from './collections/index.js';
 export { type BackfillLegacyUserProfilesResult, backfillLegacyUserProfiles, LEGACY_USER_PROFILE_BACKFILL_NAME, LegacyUserProfileBackfillError, type LegacyUserProfileBackfillErrorCode, } from './migrations/backfillLegacyUserProfiles.js';
 export { type BackfillUserEmailKeysResult, backfillUserEmailKeys, type DuplicateUserEmailKey, UserEmailKeyBackfillError, type UserEmailKeyBackfillErrorCode, } from './migrations/backfillUserEmailKeys.js';
+export { type MaterializeTenantHierarchyOptions, type MaterializeTenantHierarchyResult, materializeTenantHierarchy, TenantHierarchyMaterializationError, } from './migrations/materializeTenantHierarchy.js';
 export { AccessRequest, type AccessRequestOptions, CliAuthRequest, type CliAuthRequestStatus, DEFAULT_SESSION_TTL, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupMember, GroupRole, generateSessionId, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkToken, Membership, MembershipOverride, Permission, ResourceGrant, type ResourceGrantEffect, type ResourceGrantOptions, Role, RolePermission, Session, Tenant, TenantIntegration, type TenantIntegrationCheckSummary, type TenantIntegrationOptions, type TenantIntegrationProvider, type TenantIntegrationStatus, TenantPermissionOverride, User, UsersCliAuthApproveLimit, UsersCliAuthRequest, UsersMagicLinkToken, } from './models/index.js';
+export { planTenantHierarchy, type TenantHierarchyChange, type TenantHierarchyErrorCode, type TenantHierarchyPlan, type TenantHierarchyProblem, type TenantHierarchyRow, } from './models/tenant-hierarchy.js';
 export { CLI_AUTH_RETENTION_TASK, MAGIC_LINK_RETENTION_TASK, registerUserRetentionTasks, SESSIONS_RETENTION_TASK, USER_RETENTION_TASKS, unregisterUserRetentionTasks, } from './retention.js';
 export { ACCESS_REQUEST_CAPABILITIES, type AccessRequestAuthorizationContext, type AccessRequestAuthorizer, type AccessRequestCapability, AccessRequestError, type AccessRequestErrorCode, type AccessRequestEvent, type AccessRequestEventHandler, type AccessRequestEventType, AccessRequestService, type AccessRequestServiceOptions, ANCESTOR_READ_ACTION, type AncestorReadPackageConfig, type AncestorReadPolicy, type ApproveAccessRequestOptions, type ApproveCliAuthRequestInput, applyPostgresPermissionPolicies, assertOperationPermission, type CancelAccessRequestOptions, type CliAuthStartResult, type CliAuthTokenResult, type CreateAccessRequestInput, type CreateAuthorizationUrlOptions, type CreateResourceGrantOptions, checkOperationPermission, checkResourceOperationPermission, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, type DeclineAccessRequestOptions, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, type EnsureTenantResult, encodeOidcTransaction, type GeneratePostgresPermissionSqlResult, type GraduateAccessRequestOptions, type GraduateAccessRequestResult, type GraduateExistingTenantOption, type GraduateNewTenantOption, type GraduateTenantOption, generatePostgresPermissionSql, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, type ListAccessRequestsFilter, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MagicLinkError, type MagicLinkResult, MagicLinkService, type MagicLinkServiceOptions, type MagicLinkVerifyResult, MobileAuthError, type MobileAuthErrorCode, MobileAuthService, type MobileAuthServiceOptions, type MobileBootstrapContext, type MobileLoginContext, type MobileLogoutResult, type MobileRequestMeta, type MobileResolvedUser, type MobileTenantContext, type NormalizedAncestorReadPolicy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, type OidcCallbackResult, OidcLoginError, type OidcLoginResult, OidcLoginService, type OidcLoginServiceOptions, type OidcProviderConfig, type OidcProviderKind, type OidcProviderMetadata, type OidcProviderResolution, type OidcProviderResolutionOptions, type OidcTokenEndpointAuthMethod, type OidcTokenSet, type OidcTransaction, type OperationPermissionAllowReason, type OperationPermissionCollectionInput, type OperationPermissionDecision, type OperationPermissionDenyReason, OperationPermissionError, type OperationPermissionOptions, type PermissionCatalog, PermissionCatalogService, type PermissionCatalogSource, type PermissionCatalogSyncResult, type PermissionDefinition, type PermissionResolutionOptions, type PermissionResolutionResult, PermissionResolver, type PermissionResolverOptions, type PostgresPermissionAction, type PostgresPermissionBinding, type PostgresPermissionPolicyReportItem, type PostgresPermissionPolicyTarget, type PrincipalPermissionRuntimeOptions, type ResolvedOidcProviderConfig, type ResourceGrantDecision, ResourceGrantService, type ResourceIdentity, type ResourceIdentityVerifier, type ResourceOperationPermissionOptions, type RevokeResourceGrantOptions, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, type SessionContext, type SessionPermissionRuntimeContext, type SessionPermissionRuntimeOptions, SessionService, type SessionServiceOptions, type SwitchTenantResult, syncPermissionCatalog, type TenantPermissionInheritanceResult, TenantService, type TenantWithOwnershipResult, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, type TerminalAuthServiceOptions, type UsersConfig, type UsersOidcConfig, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext, } from './services/index.js';
 export { AccessRequestStatus, DEFAULT_ROLE_SLUGS, DEFAULT_ROLES, DEFAULT_TENANT_POLICY, type DefaultRoleSlug, MembershipStatus, OverrideEffect, SessionStatus, TenantPermissionEffect, type TenantPolicy, type TenantPolicyMode, TenantStatus, UserStatus, } from './types/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAWhC,OAAO,EACL,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,kCAAkC,EAClC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,KAAK,kCAAkC,GACxC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,mCAAmC,EACnC,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAWhC,OAAO,EACL,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,kCAAkC,EAClC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,KAAK,kCAAkC,GACxC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,KAAK,iCAAiC,EACtC,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,mCAAmC,EACnC,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,10 +1,11 @@
-import { $ as RoleCollection, A as getConfiguredAncestorReadPolicy, At as TenantPermissionEffect, B as TenantCollection, C as decodeOidcTransaction, Ct as AccessRequestStatus, Dt as MembershipStatus, E as resolveOidcProviderConfig, Et as DEFAULT_TENANT_POLICY, G as RolePermissionCollection, H as MAX_TENANT_HIERARCHY_DEPTH, I as UserEmailKeyBackfillError, J as deriveOperationPermissionSlug, K as PermissionCatalogService, L as backfillUserEmailKeys, M as normalizeAncestorReadPolicy, Mt as UserStatus, N as OidcProvisioningError, Nt as UsersCliAuthRequest, O as ANCESTOR_READ_ACTION, Ot as OverrideEffect, P as UserCollection, Q as RolePermission, R as TenantPermissionOverrideCollection, S as OidcLoginService, St as generateSessionId, T as getUsersOidcConfig, Tt as DEFAULT_ROLE_SLUGS, U as Tenant, V as TenantHierarchyError, W as DEFAULT_ROLE_PERMISSION_PATTERNS, X as registerPermissionDefinitions, Y as normalizeOperationPermissionAction, Z as syncPermissionCatalog, _ as readMobileBearerToken, _t as normalizeEmail, a as TerminalAuthRateLimitError, at as MembershipCollection, b as PermissionResolver, bt as DEFAULT_SESSION_TTL, c as assertOperationPermission, ct as GroupRole, d as getCurrentSessionPermissionContext, dt as GroupCollection, et as Role, f as getRequestScopedDatabase, ft as Group, g as MobileAuthService, gt as isValidEmail, h as MobileAuthError, ht as User, i as TerminalAuthError, it as MembershipOverride, j as isAncestorReadableSlug, jt as TenantStatus, k as DEFAULT_ANCESTOR_READ_MAX_DEPTH, kt as SessionStatus, l as checkOperationPermission, lt as GroupMemberCollection, m as withSessionPermissionContext, mt as UsersCliAuthApproveLimit, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as Permission, o as TerminalAuthService, ot as Membership, p as withPrincipalPermissionContext, pt as UsersCliAuthApproveLimitCollection, q as deriveOperationPermissionCollectionName, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as MembershipOverrideCollection, s as OperationPermissionError, st as GroupRoleCollection, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as PermissionCollection, u as hasOperationPermission, ut as GroupMember, v as validateMobileRedirectUri, vt as UsersCliAuthRequestCollection, w as encodeOidcTransaction, wt as DEFAULT_ROLES, x as OidcLoginError, xt as Session, y as SessionService, yt as SessionCollection, z as TenantPermissionOverride } from "./chunks/TerminalAuthService-DgAU4Fz1.js";
+import { $ as normalizeOperationPermissionAction, A as getConfiguredAncestorReadPolicy, B as TenantCollection, C as decodeOidcTransaction, Ct as SessionCollection, Dt as UsersCliAuthRequest, E as resolveOidcProviderConfig, Et as generateSessionId, G as assertTenantTableName, H as MAX_TENANT_HIERARCHY_DEPTH, I as UserEmailKeyBackfillError, J as DEFAULT_ROLE_PERMISSION_PATTERNS, K as planTenantHierarchy, L as backfillUserEmailKeys, M as normalizeAncestorReadPolicy, N as OidcProvisioningError, O as ANCESTOR_READ_ACTION, P as UserCollection, Q as deriveOperationPermissionSlug, R as TenantPermissionOverrideCollection, S as OidcLoginService, St as UsersCliAuthRequestCollection, T as getUsersOidcConfig, Tt as Session, U as TenantHierarchyError, V as Tenant, W as applyTenantHierarchyUpdates, X as PermissionCatalogService, Y as RolePermissionCollection, Z as deriveOperationPermissionCollectionName, _ as readMobileBearerToken, _t as UsersCliAuthApproveLimitCollection, a as TerminalAuthRateLimitError, at as PermissionCollection, b as PermissionResolver, bt as isValidEmail, c as assertOperationPermission, ct as MembershipOverride, d as getCurrentSessionPermissionContext, dt as GroupRoleCollection, et as registerPermissionDefinitions, f as getRequestScopedDatabase, ft as GroupRole, g as MobileAuthService, gt as Group, h as MobileAuthError, ht as GroupCollection, i as TerminalAuthError, it as Role, j as isAncestorReadableSlug, k as DEFAULT_ANCESTOR_READ_MAX_DEPTH, l as checkOperationPermission, lt as MembershipCollection, m as withSessionPermissionContext, mt as GroupMember, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as RolePermission, o as TerminalAuthService, ot as Permission, p as withPrincipalPermissionContext, pt as GroupMemberCollection, q as recordTenantHierarchyChanges, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as RoleCollection, s as OperationPermissionError, st as MembershipOverrideCollection, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as syncPermissionCatalog, u as hasOperationPermission, ut as Membership, v as validateMobileRedirectUri, vt as UsersCliAuthApproveLimit, w as encodeOidcTransaction, wt as DEFAULT_SESSION_TTL, x as OidcLoginError, xt as normalizeEmail, y as SessionService, yt as User, z as TenantPermissionOverride } from "./chunks/TerminalAuthService-BBxkYCOG.js";
+import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, field, findManifestEntryByQualifiedName, foreignKey, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask } from "@happyvertical/smrt-core";
 import { PROFILE_EMAIL_KEY_BACKFILL_NAME, Person, ProfileCollection, ProfileTypeCollection, normalizeIdentityEmail } from "@happyvertical/smrt-profiles";
 import { createHash } from "node:crypto";
+import { createLogger } from "@happyvertical/logger";
 import { TenantScoped, tenantId, withSystemContext } from "@happyvertical/smrt-tenancy";
 import { BackfillTracker } from "@happyvertical/smrt-core/migrations";
-import { createLogger } from "@happyvertical/logger";
 //#region src/models/MagicLinkToken.ts
 var __defProp$3 = Object.defineProperty;
 var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
@@ -657,6 +658,52 @@ function readRequiredString(value, label) {
 	return stringValue;
 }
 //#endregion
+//#region src/migrations/materializeTenantHierarchy.ts
+var TenantHierarchyMaterializationError = class extends Error {
+	constructor(problems) {
+		super(`Cannot materialize the tenant hierarchy: ${problems.length} tenant(s) have a broken parent chain. ` + problems.map((problem) => problem.message).join(" "));
+		this.problems = problems;
+		this.name = "TenantHierarchyMaterializationError";
+	}
+	problems;
+};
+function toRow(row) {
+	const id = row.id === null || row.id === void 0 ? "" : String(row.id);
+	if (!id) throw new Error("Tenant hierarchy backfill found a row without an id.");
+	const parent = row.parent_tenant_id === null || row.parent_tenant_id === void 0 ? null : String(row.parent_tenant_id);
+	const level = row.hierarchy_level === null || row.hierarchy_level === void 0 ? null : Number(row.hierarchy_level);
+	return {
+		id,
+		parentTenantId: parent === "" ? null : parent,
+		hierarchyPath: row.hierarchy_path === null || row.hierarchy_path === void 0 ? null : String(row.hierarchy_path),
+		hierarchyLevel: Number.isFinite(level) ? level : null
+	};
+}
+async function planFrom(db, table) {
+	const { rows } = await db.query(`SELECT id, parent_tenant_id, hierarchy_path, hierarchy_level FROM ${table} ORDER BY id`);
+	return planTenantHierarchy(rows.map(toRow));
+}
+async function materializeTenantHierarchy(db, options = {}) {
+	const table = assertTenantTableName(options.tableName ?? "tenants");
+	if (options.dryRun) return {
+		...await planFrom(db, table),
+		applied: false
+	};
+	const run = async (handle) => {
+		const plan = await planFrom(handle, table);
+		if (plan.problems.length > 0) throw new TenantHierarchyMaterializationError(plan.problems);
+		await applyTenantHierarchyUpdates(handle, table, plan.changes);
+		return {
+			...plan,
+			applied: true
+		};
+	};
+	if (!db.transaction) throw new Error("Tenant hierarchy materialization requires a database with transaction(); no changes were made.");
+	const result = await db.transaction((tx) => run(tx));
+	if (result.changes.length > 0) await recordTenantHierarchyChanges(db, table);
+	return result;
+}
+//#endregion
 //#region src/services/AccessRequestService.ts
 var logger = createLogger({ level: "info" });
 var ACCESS_REQUEST_CAPABILITIES = {
@@ -1147,7 +1194,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-DgAU4Fz1.js").then((n) => n.D);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-BBxkYCOG.js").then((n) => n.D);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -1176,7 +1223,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-DgAU4Fz1.js").then((n) => n.D);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-BBxkYCOG.js").then((n) => n.D);
 		const key = await this.getSigningKey();
 		let payload;
 		try {
@@ -1773,6 +1820,6 @@ var TenantService = class TenantService {
 //#region src/index.ts
 registerUserRetentionTasks();
 //#endregion
-export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, LEGACY_USER_PROFILE_BACKFILL_NAME, LegacyUserProfileBackfillError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
+export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, LEGACY_USER_PROFILE_BACKFILL_NAME, LegacyUserProfileBackfillError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantHierarchyMaterializationError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, materializeTenantHierarchy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, planTenantHierarchy, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
 
 //# sourceMappingURL=index.js.map