@happyvertical/smrt-users 0.51.39 → 0.53.3

package/dist/collections/RoleCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RoleCollection.d.ts","sourceRoot":"","sources":["../../src/collections/RoleCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC,OAAO,KAAK,EACV,2BAA2B,EAC3B,0BAA0B,EAC3B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,sBACf,SAAQ,IAAI,CAAC,0BAA0B,EAAE,SAAS,CAAC;IACnD,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,cAAc,CAAC,IAAI,CAAC;IACtD,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAQ;IAElC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAOxC;;OAEG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IASrD;;OAEG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAOxD;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAoBvE,4EAA4E;IACtE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQ9D;;OAEG;IACG,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CA2D7E"}
+{"version":3,"file":"RoleCollection.d.ts","sourceRoot":"","sources":["../../src/collections/RoleCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,cAAc,EAEf,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC,OAAO,KAAK,EACV,2BAA2B,EAC3B,0BAA0B,EAC3B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,sBACf,SAAQ,IAAI,CAAC,0BAA0B,EAAE,SAAS,CAAC;IACnD,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,cAAc,CAAC,IAAI,CAAC;IACtD,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAQ;IAElC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAOxC;;OAEG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IASrD;;OAEG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAOxD;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAoBvE,4EAA4E;IACtE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQ9D;;OAEG;IACG,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAmF7E"}

package/dist/collections/RolePermissionCollection.d.ts

@@ -84,6 +84,10 @@ export declare class RolePermissionCollection extends SmrtCollection<RolePermiss
      * Defaults to the system owner/admin/member/viewer matrix. Re-running is
      * idempotent: existing mappings are reported as `unchanged`, new catalog
      * slugs are added, and stale mappings are only removed when `prune` is true.
+     *
+     * Grants and revocations are planned from one read per role, then committed
+     * in batches rather than one durable commit per row (#3323). Inside a
+     * caller transaction, pass that transaction's handle.
      */
     seedRolePermissions(matrix?: RolePermissionPatternMatrix, options?: SeedRolePermissionsOptions): Promise<SeedRolePermissionsResult>;
     /**

package/dist/collections/RolePermissionCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RolePermissionCollection.d.ts","sourceRoot":"","sources":["../../src/collections/RolePermissionCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAEL,KAAK,iBAAiB,EAEvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAI7E,MAAM,MAAM,2BAA2B,GAAG,OAAO,CAC/C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAClC,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAC7C;AAED,eAAO,MAAM,gCAAgC,EAAE,MAAM,CACnD,eAAe,EACf,SAAS,MAAM,EAAE,CAMlB,CAAC;AA4GF;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAAC,cAAc,CAAC;IAC1E,MAAM,CAAC,QAAQ,CAAC,UAAU,wBAAkB;IAE5C;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAM3D;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAMvE;;OAEG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ3E;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,cAAc,CAAC;IAa1B;;;;;;;;;;;;;;OAcG;YACW,eAAe;IAO7B;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAanB;;OAEG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWzD;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,GAAE,2BAA8D,EACtE,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,yBAAyB,CAAC;IAmHrC;;;;;OAKG;IACG,yCAAyC,CAC7C,OAAO,GAAE,IAAI,CAAC,0BAA0B,EAAE,OAAO,CAAM,GACtD,OAAO,CAAC,yBAAyB,CAAC;CAWtC"}
+{"version":3,"file":"RolePermissionCollection.d.ts","sourceRoot":"","sources":["../../src/collections/RolePermissionCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAEL,KAAK,iBAAiB,EAEvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAK7E,MAAM,MAAM,2BAA2B,GAAG,OAAO,CAC/C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAClC,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAC7C;AAED,eAAO,MAAM,gCAAgC,EAAE,MAAM,CACnD,eAAe,EACf,SAAS,MAAM,EAAE,CAMlB,CAAC;AA4GF;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAAC,cAAc,CAAC;IAC1E,MAAM,CAAC,QAAQ,CAAC,UAAU,wBAAkB;IAE5C;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAM3D;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAMvE;;OAEG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ3E;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,cAAc,CAAC;IAa1B;;;;;;;;;;;;;;OAcG;YACW,eAAe;IAO7B;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAanB;;OAEG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWzD;;;;;;;;;;OAUG;IACG,mBAAmB,CACvB,MAAM,GAAE,2BAA8D,EACtE,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,yBAAyB,CAAC;IA0IrC;;;;;OAKG;IACG,yCAAyC,CAC7C,OAAO,GAAE,IAAI,CAAC,0BAA0B,EAAE,OAAO,CAAM,GACtD,OAAO,CAAC,yBAAyB,CAAC;CAWtC"}

package/dist/collections/seeding-transaction.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Batched commits for permission-catalog and role-permission seeding.
+ * @packageDocumentation
+ */
+import type { DatabaseInterface } from '@happyvertical/sql';
+/**
+ * Rows a seeding pass writes per transaction (#3323).
+ *
+ * A cold seed writes every catalog permission and every default grant, each
+ * with a change-feed append: thousands of rows on a real registry. When every
+ * row autocommits, each is a separate durable commit. On a file-backed SQLite
+ * database with `synchronous = FULL` (the local runtime profile), that is an
+ * `fsync` per row, and disk flushes, not queries, set the bootstrap's wall
+ * clock. Batching cuts the commits by this factor.
+ *
+ * The batch is bounded, not the whole seed, because a transaction scope in
+ * `@happyvertical/sql` tracks every promise created while it is open and
+ * keeps each statement's rejection observation until the transaction ends,
+ * so its per-statement cost grows with the statements already issued. On the
+ * local owner claim, one catalog-wide transaction took ~17s against ~4.5s for
+ * batches of 25-100 rows (and ~30s for per-row commits on a real disk).
+ */
+export declare const SEEDING_BATCH_SIZE = 50;
+/**
+ * Write `items` in transactions of at most {@link SEEDING_BATCH_SIZE} rows.
+ *
+ * Seeding is idempotent and additive, so committing per batch keeps the
+ * semantics of the previous per-row commits: an interrupted pass leaves only
+ * complete rows behind, and re-running converges. `write` receives the handle
+ * bound to its batch's transaction and must issue every write through it.
+ *
+ * Nesting follows `@happyvertical/sql`'s rules. Given a transaction handle,
+ * SQLite and PostgreSQL re-enter it under a SAVEPOINT, and adapters without
+ * savepoints (DuckDB/JSON) reuse the caller's transaction directly. A handle
+ * with no `transaction()` keeps per-statement commits. A caller already inside
+ * a transaction must pass that transaction's handle: on a single-connection
+ * adapter the root handle waits for the open transaction instead of joining
+ * it.
+ *
+ * @internal
+ */
+export declare function writeInSeedingBatches<T>(db: DatabaseInterface, items: readonly T[], write: (database: DatabaseInterface, batch: readonly T[]) => Promise<void>): Promise<void>;
+//# sourceMappingURL=seeding-transaction.d.ts.map

package/dist/collections/seeding-transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seeding-transaction.d.ts","sourceRoot":"","sources":["../../src/collections/seeding-transaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,KAAK,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GACzE,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/index.d.ts

@@ -57,6 +57,7 @@ import './__smrt-register__.js';
 export { AccessRequestCollection, type CliAuthApproveReservation, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileOwnerAuthorization, type OidcProfileOwnerAuthorizer, type OidcProfileOwnerAuthorizerContext, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, PermissionCollection, ResourceGrantCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantIntegrationCollection, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthApproveLimitCollection, UsersCliAuthRequestCollection, UsersMagicLinkTokenCollection, } from './collections/index.js';
 export { type BackfillLegacyUserProfilesResult, backfillLegacyUserProfiles, LEGACY_USER_PROFILE_BACKFILL_NAME, LegacyUserProfileBackfillError, type LegacyUserProfileBackfillErrorCode, } from './migrations/backfillLegacyUserProfiles.js';
 export { type BackfillUserEmailKeysResult, backfillUserEmailKeys, type DuplicateUserEmailKey, UserEmailKeyBackfillError, type UserEmailKeyBackfillErrorCode, } from './migrations/backfillUserEmailKeys.js';
+export { type DeduplicateRolePermissionsOptions, type DeduplicateRolePermissionsResult, deduplicateRolePermissions, } from './migrations/deduplicateRolePermissions.js';
 export { type MaterializeTenantHierarchyOptions, type MaterializeTenantHierarchyResult, materializeTenantHierarchy, TenantHierarchyMaterializationError, } from './migrations/materializeTenantHierarchy.js';
 export { AccessRequest, type AccessRequestOptions, CliAuthRequest, type CliAuthRequestStatus, DEFAULT_SESSION_TTL, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupMember, GroupRole, generateSessionId, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkToken, Membership, MembershipOverride, Permission, ResourceGrant, type ResourceGrantEffect, type ResourceGrantOptions, Role, RolePermission, Session, Tenant, TenantIntegration, type TenantIntegrationCheckSummary, type TenantIntegrationOptions, type TenantIntegrationProvider, type TenantIntegrationStatus, TenantPermissionOverride, User, UsersCliAuthApproveLimit, UsersCliAuthRequest, UsersMagicLinkToken, } from './models/index.js';
 export { planTenantHierarchy, type TenantHierarchyChange, type TenantHierarchyErrorCode, type TenantHierarchyPlan, type TenantHierarchyProblem, type TenantHierarchyRow, } from './models/tenant-hierarchy.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAWhC,OAAO,EACL,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,kCAAkC,EAClC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,KAAK,kCAAkC,GACxC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,KAAK,iCAAiC,EACtC,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,mCAAmC,EACnC,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAWhC,OAAO,EACL,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,kCAAkC,EAClC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,KAAK,kCAAkC,GACxC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,KAAK,iCAAiC,EACtC,KAAK,gCAAgC,EACrC,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,iCAAiC,EACtC,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,mCAAmC,EACnC,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
-import { $ as deriveOperationPermissionSlug, A as DEFAULT_ANCESTOR_READ_MAX_DEPTH, B as TenantPermissionOverride, C as OidcLoginService, Ct as UsersCliAuthRequestCollection, D as resolveOidcProviderConfig, Dt as generateSessionId, E as getUsersOidcConfig, Et as Session, F as UserCollection, G as applyTenantHierarchyUpdates, H as Tenant, J as recordTenantHierarchyChanges, K as assertTenantTableName, L as UserEmailKeyBackfillError, M as isAncestorReadableSlug, N as normalizeAncestorReadPolicy, Ot as UsersCliAuthRequest, P as OidcProvisioningError, Q as deriveOperationPermissionCollectionName, R as backfillUserEmailKeys, S as OidcLoginError, St as normalizeEmail, T as encodeOidcTransaction, Tt as DEFAULT_SESSION_TTL, U as MAX_TENANT_HIERARCHY_DEPTH, V as TenantCollection, W as TenantHierarchyError, X as RolePermissionCollection, Y as DEFAULT_ROLE_PERMISSION_PATTERNS, Z as PermissionCatalogService, _ as readMobileBearerToken, _t as Group, a as TerminalAuthRateLimitError, at as Role, b as PermissionResolver, bt as User, c as assertOperationPermission, ct as MembershipOverrideCollection, d as getCurrentSessionPermissionContext, dt as Membership, et as normalizeOperationPermissionAction, f as getRequestScopedDatabase, ft as GroupRoleCollection, g as MobileAuthService, gt as GroupCollection, h as MobileAuthError, ht as GroupMember, i as TerminalAuthError, it as RoleCollection, j as getConfiguredAncestorReadPolicy, k as ANCESTOR_READ_ACTION, l as checkOperationPermission, lt as MembershipOverride, m as withSessionPermissionContext, mt as GroupMemberCollection, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as syncPermissionCatalog, o as TerminalAuthService, ot as PermissionCollection, p as withPrincipalPermissionContext, pt as GroupRole, q as planTenantHierarchy, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as RolePermission, s as OperationPermissionError, st as Permission, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as registerPermissionDefinitions, u as hasOperationPermission, ut as MembershipCollection, v as validateMobileRedirectUri, vt as UsersCliAuthApproveLimitCollection, w as decodeOidcTransaction, wt as SessionCollection, x as withoutListBounds, xt as isValidEmail, y as SessionService, yt as UsersCliAuthApproveLimit, z as TenantPermissionOverrideCollection } from "./chunks/TerminalAuthService-BDKUbg4N.js";
+import { $ as deriveOperationPermissionSlug, A as DEFAULT_ANCESTOR_READ_MAX_DEPTH, B as TenantPermissionOverride, C as OidcLoginService, Ct as UsersCliAuthRequestCollection, D as resolveOidcProviderConfig, Dt as generateSessionId, E as getUsersOidcConfig, Et as Session, F as UserCollection, G as applyTenantHierarchyUpdates, H as Tenant, J as recordTenantHierarchyChanges, K as assertTenantTableName, L as UserEmailKeyBackfillError, M as isAncestorReadableSlug, N as normalizeAncestorReadPolicy, Ot as UsersCliAuthRequest, P as OidcProvisioningError, Q as deriveOperationPermissionCollectionName, R as backfillUserEmailKeys, S as OidcLoginError, St as normalizeEmail, T as encodeOidcTransaction, Tt as DEFAULT_SESSION_TTL, U as MAX_TENANT_HIERARCHY_DEPTH, V as TenantCollection, W as TenantHierarchyError, X as RolePermissionCollection, Y as DEFAULT_ROLE_PERMISSION_PATTERNS, Z as PermissionCatalogService, _ as readMobileBearerToken, _t as Group, a as TerminalAuthRateLimitError, at as Role, b as PermissionResolver, bt as User, c as assertOperationPermission, ct as MembershipOverrideCollection, d as getCurrentSessionPermissionContext, dt as Membership, et as normalizeOperationPermissionAction, f as getRequestScopedDatabase, ft as GroupRoleCollection, g as MobileAuthService, gt as GroupCollection, h as MobileAuthError, ht as GroupMember, i as TerminalAuthError, it as RoleCollection, j as getConfiguredAncestorReadPolicy, k as ANCESTOR_READ_ACTION, l as checkOperationPermission, lt as MembershipOverride, m as withSessionPermissionContext, mt as GroupMemberCollection, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as syncPermissionCatalog, o as TerminalAuthService, ot as PermissionCollection, p as withPrincipalPermissionContext, pt as GroupRole, q as planTenantHierarchy, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as RolePermission, s as OperationPermissionError, st as Permission, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as registerPermissionDefinitions, u as hasOperationPermission, ut as MembershipCollection, v as validateMobileRedirectUri, vt as UsersCliAuthApproveLimitCollection, w as decodeOidcTransaction, wt as SessionCollection, x as withoutListBounds, xt as isValidEmail, y as SessionService, yt as UsersCliAuthApproveLimit, z as TenantPermissionOverrideCollection } from "./chunks/TerminalAuthService-DoadwiqV.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
-import { ObjectRegistry, SmrtCollection, SmrtObject, field, findManifestEntryByQualifiedName, foreignKey, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask } from "@happyvertical/smrt-core";
+import { ObjectRegistry, SmrtCollection, SmrtObject, bumpChangeFeed, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
 import { PROFILE_EMAIL_KEY_BACKFILL_NAME, Person, ProfileCollection, ProfileTypeCollection, normalizeIdentityEmail } from "@happyvertical/smrt-profiles";
 import { createHash } from "node:crypto";
 import { createLogger } from "@happyvertical/logger";
@@ -658,6 +658,41 @@ function readRequiredString(value, label) {
 	return stringValue;
 }
 //#endregion
+//#region src/migrations/deduplicateRolePermissions.ts
+var duplicateIds = `SELECT id FROM (
+  SELECT id, ROW_NUMBER() OVER (
+    PARTITION BY role_id, permission_id
+    ORDER BY created_at ASC NULLS LAST, id ASC
+  ) AS duplicate_rank FROM role_permissions
+) AS ranked WHERE duplicate_rank > 1`;
+async function deduplicateRolePermissions(db, options = {}) {
+	const count = async (handle) => {
+		const result = await handle.query(`SELECT COUNT(*) AS count FROM (${duplicateIds}) AS duplicates`);
+		return Number(result.rows[0].count);
+	};
+	if (options.dryRun) return {
+		duplicates: await count(db),
+		removed: 0
+	};
+	if (!options.maintenanceConfirmed) throw new Error("Stop all writers and seeders, then set maintenanceConfirmed: true.");
+	if (!db.transaction) throw new Error("Grant deduplication requires a root transaction handle.");
+	await ensureChangeFeedTable(db);
+	return withEmbeddedWriteTransaction(db, isEmbeddedDatabase(db), async (tx) => {
+		if (!isEmbeddedDatabase(db)) await tx.query("LOCK TABLE role_permissions IN EXCLUSIVE MODE");
+		const duplicates = await count(tx);
+		if (duplicates > 0) await tx.query(`DELETE FROM role_permissions WHERE id IN (${duplicateIds})`);
+		await tx.query("CREATE UNIQUE INDEX IF NOT EXISTS role_permissions_role_id_permission_id_idx ON role_permissions (role_id, permission_id)");
+		if (duplicates > 0) await bumpChangeFeed(tx, {
+			table: "role_permissions",
+			operation: "delete"
+		});
+		return {
+			duplicates,
+			removed: duplicates
+		};
+	});
+}
+//#endregion
 //#region src/migrations/materializeTenantHierarchy.ts
 var TenantHierarchyMaterializationError = class extends Error {
 	constructor(problems) {
@@ -1194,7 +1229,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-BDKUbg4N.js").then((n) => n.O);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-DoadwiqV.js").then((n) => n.O);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -1223,7 +1258,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-BDKUbg4N.js").then((n) => n.O);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-DoadwiqV.js").then((n) => n.O);
 		const key = await this.getSigningKey();
 		let payload;
 		try {
@@ -1821,6 +1856,6 @@ var TenantService = class TenantService {
 //#region src/index.ts
 registerUserRetentionTasks();
 //#endregion
-export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, LEGACY_USER_PROFILE_BACKFILL_NAME, LegacyUserProfileBackfillError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantHierarchyMaterializationError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, materializeTenantHierarchy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, planTenantHierarchy, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
+export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, LEGACY_USER_PROFILE_BACKFILL_NAME, LegacyUserProfileBackfillError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantHierarchyMaterializationError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deduplicateRolePermissions, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, materializeTenantHierarchy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, planTenantHierarchy, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
 
 //# sourceMappingURL=index.js.map