@happyvertical/smrt-users 0.52.0 → 0.53.5

package/dist/collections/CliAuthApproveLimitCollection.d.ts

@@ -12,6 +12,10 @@ export type CliAuthApproveReservation = {
     allowed: false;
     retryAfterSeconds: number;
 };
+/**
+ * @deprecated Since #3273. Use {@link UsersLoginAttemptCollection} through
+ * `LoginAttemptLimiter`. Kept for schema and cleanup compatibility only.
+ */
 export declare class UsersCliAuthApproveLimitCollection extends SmrtCollection<UsersCliAuthApproveLimit> {
     static readonly _itemClass: typeof UsersCliAuthApproveLimit;
     /**

package/dist/collections/CliAuthApproveLimitCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CliAuthApproveLimitCollection.d.ts","sourceRoot":"","sources":["../../src/collections/CliAuthApproveLimitCollection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,MAAM,MAAM,yBAAyB,GACjC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,qBAAa,kCAAmC,SAAQ,cAAc,CAAC,wBAAwB,CAAC;IAC9F,MAAM,CAAC,QAAQ,CAAC,UAAU,kCAA4B;IAEtD;;;OAGG;IACG,cAAc,CAAC,KAAK,EAAE;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAmEtC,+EAA+E;IACzE,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAoB7E"}
+{"version":3,"file":"CliAuthApproveLimitCollection.d.ts","sourceRoot":"","sources":["../../src/collections/CliAuthApproveLimitCollection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,MAAM,MAAM,yBAAyB,GACjC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD;;;GAGG;AACH,qBAAa,kCAAmC,SAAQ,cAAc,CAAC,wBAAwB,CAAC;IAC9F,MAAM,CAAC,QAAQ,CAAC,UAAU,kCAA4B;IAEtD;;;OAGG;IACG,cAAc,CAAC,KAAK,EAAE;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAmEtC,+EAA+E;IACzE,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAoB7E"}

package/dist/collections/CliAuthRequestCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CliAuthRequestCollection.d.ts","sourceRoot":"","sources":["../../src/collections/CliAuthRequestCollection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGlE,MAAM,WAAW,iCAAiC;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,8BAA8B;IAC7C,UAAU,EAAE,IAAI,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,qBAAa,6BAA8B,SAAQ,cAAc,CAAC,mBAAmB,CAAC;IACpF,MAAM,CAAC,QAAQ,CAAC,UAAU,6BAAuB;IAEjD;;;;;;;OAOG;IACG,qBAAqB,CACzB,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC;IAgEjD;;;;;;;OAOG;IACG,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAiC5E;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAQ3E;;OAEG;IACG,oBAAoB,CACxB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAQtC;;;;;;;;;OASG;IACG,aAAa,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;CAyBzE;AAED,OAAO,EAAE,6BAA6B,IAAI,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"CliAuthRequestCollection.d.ts","sourceRoot":"","sources":["../../src/collections/CliAuthRequestCollection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGlE,MAAM,WAAW,iCAAiC;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,8BAA8B;IAC7C,UAAU,EAAE,IAAI,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,qBAAa,6BAA8B,SAAQ,cAAc,CAAC,mBAAmB,CAAC;IACpF,MAAM,CAAC,QAAQ,CAAC,UAAU,6BAAuB;IAEjD;;;;;;;OAOG;IACG,qBAAqB,CACzB,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC;IAiEjD;;;;;;;OAOG;IACG,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAiC5E;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAQ3E;;OAEG;IACG,oBAAoB,CACxB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAQtC;;;;;;;;;OASG;IACG,aAAa,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;CAyBzE;AAED,OAAO,EAAE,6BAA6B,IAAI,wBAAwB,EAAE,CAAC"}

package/dist/collections/LoginAttemptCollection.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Atomic shared-storage primitives behind {@link LoginAttemptLimiter}.
+ *
+ * Every mutation here is a single conditional statement so concurrent
+ * attempts across replicas cannot all pass the budget check before any one
+ * of them records its failure. Keys arrive already hashed.
+ *
+ * @packageDocumentation
+ */
+import { SmrtCollection } from '@happyvertical/smrt-core';
+import { type LoginAttemptScope, UsersLoginAttempt } from '../models/LoginAttempt.js';
+/** Result of {@link UsersLoginAttemptCollection.reserveAttempt}. */
+export type LoginAttemptReservation = {
+    allowed: true;
+    attemptCount: number;
+    windowStartedAt: string;
+} | {
+    allowed: false;
+    retryAfterSeconds: number;
+    lockedOut: boolean;
+};
+export interface ReserveLoginAttemptInput {
+    limiterKey: string;
+    scope: LoginAttemptScope;
+    maxAttempts: number;
+    windowMs: number;
+    /**
+     * A key whose last failure is older than this has its failure streak
+     * forgiven on the next reservation, so an old lockout history does not
+     * haunt a key forever.
+     */
+    streakResetMs: number;
+    /** How long after this write the row must survive the retention sweep. */
+    retainMs: number;
+}
+export interface RecordLoginFailureInput {
+    limiterKey: string;
+    maxAttempts: number;
+    /** How long after this write the row must survive the retention sweep. */
+    retainMs: number;
+    /**
+     * When positive, one earlier failure is forgiven for each full interval of
+     * this length since the key's last failure, before this one is counted.
+     * Used for shared sources so ordinary, spaced-out mistakes never accumulate
+     * while a burst still escalates.
+     */
+    streakDecayMs?: number;
+    /** Returns the lockout length for the n-th consecutive exhausted budget (0-based), or 0 for none. */
+    lockoutMsFor: (exhaustedBudgets: number) => number;
+}
+export interface RecordedLoginFailure {
+    failureStreak: number;
+    lockedUntil: string | null;
+}
+export declare class UsersLoginAttemptCollection extends SmrtCollection<UsersLoginAttempt> {
+    static readonly _itemClass: typeof UsersLoginAttempt;
+    /**
+     * Atomically reserve one attempt for a key across every process using this
+     * database. Failed attempts retain their reservation (see
+     * {@link recordFailure}); successful or aborted attempts release it.
+     */
+    reserveAttempt(input: ReserveLoginAttemptInput): Promise<LoginAttemptReservation>;
+    /**
+     * Record that a reserved attempt failed authentication. The reservation is
+     * kept (it already counts against the window); the streak advances, and if
+     * this failure exhausted the window's budget or completed another
+     * `maxAttempts` consecutive failures the key is locked for the backoff the
+     * caller computes from how many budgets in a row have been exhausted.
+     */
+    recordFailure(input: RecordLoginFailureInput): Promise<RecordedLoginFailure>;
+    /** Count one more consecutive failure for a key. */
+    private advanceStreak;
+    /**
+     * Count one more failure after forgiving one earlier failure per full
+     * `streakDecayMs` since the key's last failure. The elapsed time is
+     * computed here rather than in SQL so it is identical on every engine. When
+     * nothing is forgiven the write is the plain atomic increment. Otherwise it
+     * is a compare-and-set on BOTH values the forgiveness was computed from —
+     * the streak and the last-failure time — so concurrent failures cannot
+     * each apply the same forgiveness: the loser re-reads, finds the last
+     * failure is now, forgives nothing and increments. (The streak alone is not
+     * a sufficient guard: forgiving one and adding one writes the same number
+     * back.) After repeated conflicts it falls back to the plain increment.
+     */
+    private advanceDecayedStreak;
+    /**
+     * Release the reservation for an attempt that did not fail authentication.
+     * Deliberately leaves in-window failures in place — a success must not
+     * refill the budget mid-window (see the terminal-auth tests).
+     */
+    releaseAttempt(limiterKey: string, windowStartedAt: string, options?: {
+        resetStreak?: boolean;
+    }): Promise<void>;
+    /**
+     * Delete rows that are not locked out and are past the horizon the limiter
+     * that last wrote them recorded in `retain_until` (retention sweep), so a
+     * limiter configured with a longer window or streak horizon than the
+     * defaults never has a live budget erased. Returns the number removed (or,
+     * under `dryRun`, matched).
+     */
+    deleteIdle(options?: {
+        dryRun?: boolean;
+    }): Promise<number>;
+}
+//# sourceMappingURL=LoginAttemptCollection.d.ts.map

package/dist/collections/LoginAttemptCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginAttemptCollection.d.ts","sourceRoot":"","sources":["../../src/collections/LoginAttemptCollection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACL,KAAK,iBAAiB,EACtB,iBAAiB,EAClB,MAAM,2BAA2B,CAAC;AAEnC,oEAAoE;AACpE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtE,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qGAAqG;IACrG,YAAY,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,MAAM,CAAC;CACpD;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAeD,qBAAa,2BAA4B,SAAQ,cAAc,CAAC,iBAAiB,CAAC;IAChF,MAAM,CAAC,QAAQ,CAAC,UAAU,2BAAqB;IAE/C;;;;OAIG;IACG,cAAc,CAClB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,uBAAuB,CAAC;IAsGnC;;;;;;OAMG;IACG,aAAa,CACjB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,oBAAoB,CAAC;IA6DhC,oDAAoD;YACtC,aAAa;IAmB3B;;;;;;;;;;;OAWG;YACW,oBAAoB;IA2ClC;;;;OAIG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,EACvB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GACtC,OAAO,CAAC,IAAI,CAAC;IA0BhB;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;CAoBtE"}

package/dist/collections/LoginAuditEventCollection.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Collection for {@link UsersLoginAuditEvent} — the default login audit sink's
+ * storage, plus the retention primitive.
+ *
+ * @packageDocumentation
+ */
+import { SmrtCollection } from '@happyvertical/smrt-core';
+import { UsersLoginAuditEvent } from '../models/LoginAuditEvent.js';
+export declare class UsersLoginAuditEventCollection extends SmrtCollection<UsersLoginAuditEvent> {
+    static readonly _itemClass: typeof UsersLoginAuditEvent;
+    /**
+     * Delete events older than `maxAgeMs` (retention sweep). Returns the number
+     * removed (or, under `dryRun`, matched).
+     */
+    deleteOlderThan(maxAgeMs: number, options?: {
+        dryRun?: boolean;
+    }): Promise<number>;
+}
+//# sourceMappingURL=LoginAuditEventCollection.d.ts.map

package/dist/collections/LoginAuditEventCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginAuditEventCollection.d.ts","sourceRoot":"","sources":["../../src/collections/LoginAuditEventCollection.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE,qBAAa,8BAA+B,SAAQ,cAAc,CAAC,oBAAoB,CAAC;IACtF,MAAM,CAAC,QAAQ,CAAC,UAAU,8BAAwB;IAElD;;;OAGG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GACjC,OAAO,CAAC,MAAM,CAAC;CAgBnB"}

package/dist/collections/PinCredentialCollection.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Collection for {@link UsersPinCredential} (#3276).
+ *
+ * @packageDocumentation
+ */
+import { SmrtCollection } from '@happyvertical/smrt-core';
+import { UsersPinCredential } from '../models/PinCredential.js';
+export interface PinCredentialWrite {
+    pinHash: string;
+    mustReset: boolean;
+    rotatedAt: Date;
+    rotatedBy: string;
+}
+export declare class UsersPinCredentialCollection extends SmrtCollection<UsersPinCredential> {
+    static readonly _itemClass: typeof UsersPinCredential;
+    findByUserId(userId: string): Promise<UsersPinCredential | null>;
+    /**
+     * Create or replace the one credential row for `userId`, bumping `version`
+     * on replace. Save conflicts from a concurrent set are retried once by
+     * re-reading; the last writer wins, which is the intended semantics for a
+     * credential rotation.
+     */
+    upsertForUser(userId: string, write: PinCredentialWrite): Promise<UsersPinCredential>;
+    deleteByUserId(userId: string): Promise<boolean>;
+}
+//# sourceMappingURL=PinCredentialCollection.d.ts.map

package/dist/collections/PinCredentialCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PinCredentialCollection.d.ts","sourceRoot":"","sources":["../../src/collections/PinCredentialCollection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,4BAA6B,SAAQ,cAAc,CAAC,kBAAkB,CAAC;IAClF,MAAM,CAAC,QAAQ,CAAC,UAAU,4BAAsB;IAE1C,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAKtE;;;;;OAKG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,kBAAkB,CAAC;IAoCxB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAMvD"}

package/dist/collections/RoleCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RoleCollection.d.ts","sourceRoot":"","sources":["../../src/collections/RoleCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC,OAAO,KAAK,EACV,2BAA2B,EAC3B,0BAA0B,EAC3B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,sBACf,SAAQ,IAAI,CAAC,0BAA0B,EAAE,SAAS,CAAC;IACnD,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,cAAc,CAAC,IAAI,CAAC;IACtD,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAQ;IAElC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAOxC;;OAEG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IASrD;;OAEG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAOxD;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAoBvE,4EAA4E;IACtE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQ9D;;OAEG;IACG,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CA2D7E"}
+{"version":3,"file":"RoleCollection.d.ts","sourceRoot":"","sources":["../../src/collections/RoleCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,cAAc,EAEf,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC,OAAO,KAAK,EACV,2BAA2B,EAC3B,0BAA0B,EAC3B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,sBACf,SAAQ,IAAI,CAAC,0BAA0B,EAAE,SAAS,CAAC;IACnD,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,cAAc,CAAC,IAAI,CAAC;IACtD,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAQ;IAElC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAOxC;;OAEG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IASrD;;OAEG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAOxD;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAoBvE,4EAA4E;IACtE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQ9D;;OAEG;IACG,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;CAmF7E"}

package/dist/collections/RolePermissionCollection.d.ts

@@ -84,6 +84,10 @@ export declare class RolePermissionCollection extends SmrtCollection<RolePermiss
      * Defaults to the system owner/admin/member/viewer matrix. Re-running is
      * idempotent: existing mappings are reported as `unchanged`, new catalog
      * slugs are added, and stale mappings are only removed when `prune` is true.
+     *
+     * Grants and revocations are planned from one read per role, then committed
+     * in batches rather than one durable commit per row (#3323). Inside a
+     * caller transaction, pass that transaction's handle.
      */
     seedRolePermissions(matrix?: RolePermissionPatternMatrix, options?: SeedRolePermissionsOptions): Promise<SeedRolePermissionsResult>;
     /**

package/dist/collections/RolePermissionCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RolePermissionCollection.d.ts","sourceRoot":"","sources":["../../src/collections/RolePermissionCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAEL,KAAK,iBAAiB,EAEvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAI7E,MAAM,MAAM,2BAA2B,GAAG,OAAO,CAC/C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAClC,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAC7C;AAED,eAAO,MAAM,gCAAgC,EAAE,MAAM,CACnD,eAAe,EACf,SAAS,MAAM,EAAE,CAMlB,CAAC;AA4GF;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAAC,cAAc,CAAC;IAC1E,MAAM,CAAC,QAAQ,CAAC,UAAU,wBAAkB;IAE5C;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAM3D;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAMvE;;OAEG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ3E;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,cAAc,CAAC;IAa1B;;;;;;;;;;;;;;OAcG;YACW,eAAe;IAO7B;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAanB;;OAEG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWzD;;;;;;OAMG;IACG,mBAAmB,CACvB,MAAM,GAAE,2BAA8D,EACtE,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,yBAAyB,CAAC;IAmHrC;;;;;OAKG;IACG,yCAAyC,CAC7C,OAAO,GAAE,IAAI,CAAC,0BAA0B,EAAE,OAAO,CAAM,GACtD,OAAO,CAAC,yBAAyB,CAAC;CAWtC"}
+{"version":3,"file":"RolePermissionCollection.d.ts","sourceRoot":"","sources":["../../src/collections/RolePermissionCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAEL,KAAK,iBAAiB,EAEvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAK7E,MAAM,MAAM,2BAA2B,GAAG,OAAO,CAC/C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAClC,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAC7C;AAED,eAAO,MAAM,gCAAgC,EAAE,MAAM,CACnD,eAAe,EACf,SAAS,MAAM,EAAE,CAMlB,CAAC;AA4GF;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,cAAc,CAAC,cAAc,CAAC;IAC1E,MAAM,CAAC,QAAQ,CAAC,UAAU,wBAAkB;IAE5C;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAM3D;;OAEG;IACG,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAMvE;;OAEG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ3E;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,cAAc,CAAC;IAa1B;;;;;;;;;;;;;;OAcG;YACW,eAAe;IAO7B;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAanB;;OAEG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWzD;;;;;;;;;;OAUG;IACG,mBAAmB,CACvB,MAAM,GAAE,2BAA8D,EACtE,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,yBAAyB,CAAC;IA0IrC;;;;;OAKG;IACG,yCAAyC,CAC7C,OAAO,GAAE,IAAI,CAAC,0BAA0B,EAAE,OAAO,CAAM,GACtD,OAAO,CAAC,yBAAyB,CAAC;CAWtC"}

package/dist/collections/SessionCollection.d.ts

@@ -3,7 +3,7 @@
  * @packageDocumentation
  */
 import { SmrtCollection } from '@happyvertical/smrt-core';
-import { Session } from '../models/Session.js';
+import { Session, type SessionAuthMethod } from '../models/Session.js';
 /**
  * Options for creating a new session
  */
@@ -20,6 +20,10 @@ export interface CreateSessionOptions {
     ipAddress?: string;
     /** Custom session data */
     data?: Record<string, unknown>;
+    /** How the session was established (server-set; see {@link SessionAuthMethod}). */
+    authMethod?: SessionAuthMethod | null;
+    /** Parent session this one is layered on; the child is valid only while the parent is. */
+    parentSessionId?: string | null;
 }
 /**
  * Collection for managing Session objects
@@ -31,6 +35,34 @@ export declare class SessionCollection extends SmrtCollection<Session> {
      * Create a new session with a secure ID
      */
     createSession(options: CreateSessionOptions): Promise<Session>;
+    /**
+     * Active sessions layered on `parentSessionId` (e.g. every person signed in
+     * on one enrolled device). Expired rows are filtered out.
+     */
+    /**
+     * Ids of ACTIVE sessions matching `column = value`, read with raw SQL so a
+     * caller's `defaultListLimit`/`maxListLimit` can never truncate a
+     * revocation sweep: a dropped row is a session left authorized.
+     */
+    private activeSessionIds;
+    findChildren(parentSessionId: string): Promise<Session[]>;
+    /**
+     * Revoke every active session layered on `parentSessionId`. Children are
+     * already invalid once the parent is gone (liveness rule), so this is a
+     * tidy-up that makes "manage sessions" views and audits truthful. With
+     * `exceptSessionId` it ends every *other* child — how a single-occupant
+     * device hands over from one person to the next.
+     */
+    revokeChildren(parentSessionId: string, options?: {
+        exceptSessionId?: string;
+    }): Promise<number>;
+    /**
+     * Revoke a user's active sessions established through one auth method
+     * (e.g. every `pin` session after an admin PIN reset).
+     */
+    revokeUserSessionsByAuthMethod(userId: string, authMethod: SessionAuthMethod, options?: {
+        exceptSessionId?: string;
+    }): Promise<number>;
     /**
      * Find a valid session by ID
      * Returns null if session doesn't exist, is expired, or is revoked

package/dist/collections/SessionCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionCollection.d.ts","sourceRoot":"","sources":["../../src/collections/SessionCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAGL,OAAO,EACR,MAAM,sBAAsB,CAAC;AAG9B;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,OAAO,CAAC;IAC5D,MAAM,CAAC,QAAQ,CAAC,UAAU,iBAAW;YAEvB,eAAe;IAyB7B;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBpE;;;OAGG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IA8BlE;;OAEG;IACG,KAAK,CACT,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,OAAe,EAC1B,GAAG,GAAE,MAA4B,GAChC,OAAO,CAAC,OAAO,CAAC;IAOnB;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAapD;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAczD;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBzD;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxD;;;;;;;;;OASG;IACG,aAAa,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IA8BxE;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKxD;;;;;;;;OAQG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,OAAO,CAAC;IASnB;;OAEG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,OAAO,CAAC;IASnB;;OAEG;IACG,cAAc,CAAC,CAAC,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CAM1B"}
+{"version":3,"file":"SessionCollection.d.ts","sourceRoot":"","sources":["../../src/collections/SessionCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAIL,OAAO,EACP,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAG9B;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,mFAAmF;IACnF,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACtC,0FAA0F;IAC1F,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,OAAO,CAAC;IAC5D,MAAM,CAAC,QAAQ,CAAC,UAAU,iBAAW;YAEvB,eAAe;IAyB7B;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBpE;;;OAGG;IACH;;;;OAIG;YACW,gBAAgB;IAexB,YAAY,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAgB/D;;;;;;OAMG;IACG,cAAc,CAClB,eAAe,EAAE,MAAM,EACvB,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO,GACzC,OAAO,CAAC,MAAM,CAAC;IAalB;;;OAGG;IACG,8BAA8B,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO,GACzC,OAAO,CAAC,MAAM,CAAC;IAalB;;;OAGG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IA8BlE;;OAEG;IACG,KAAK,CACT,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,OAAe,EAC1B,GAAG,GAAE,MAA4B,GAChC,OAAO,CAAC,OAAO,CAAC;IAOnB;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAapD;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAczD;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBzD;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxD;;;;;;;;;OASG;IACG,aAAa,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IA8BxE;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKxD;;;;;;;;OAQG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,OAAO,CAAC;IASnB;;OAEG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,OAAO,CAAC;IASnB;;OAEG;IACG,cAAc,CAAC,CAAC,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CAM1B"}

package/dist/collections/index.d.ts

@@ -8,10 +8,13 @@ export { CliAuthRequestCollection, UsersCliAuthRequestCollection, } from './CliA
 export { GroupCollection } from './GroupCollection.js';
 export { GroupMemberCollection } from './GroupMemberCollection.js';
 export { GroupRoleCollection } from './GroupRoleCollection.js';
+export { type LoginAttemptReservation, type RecordedLoginFailure, type RecordLoginFailureInput, type ReserveLoginAttemptInput, UsersLoginAttemptCollection, } from './LoginAttemptCollection.js';
+export { UsersLoginAuditEventCollection } from './LoginAuditEventCollection.js';
 export { MagicLinkTokenCollection, UsersMagicLinkTokenCollection, } from './MagicLinkTokenCollection.js';
 export { MembershipCollection } from './MembershipCollection.js';
 export { MembershipOverrideCollection } from './MembershipOverrideCollection.js';
 export { PermissionCollection } from './PermissionCollection.js';
+export { type PinCredentialWrite, UsersPinCredentialCollection, } from './PinCredentialCollection.js';
 export { ResourceGrantCollection } from './ResourceGrantCollection.js';
 export { RoleCollection, type SeedSystemRolesOptions, } from './RoleCollection.js';
 export { DEFAULT_ROLE_PERMISSION_PATTERNS, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, } from './RolePermissionCollection.js';

package/dist/collections/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collections/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EACL,KAAK,yBAAyB,EAC9B,kCAAkC,GACnC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EACL,cAAc,EACd,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,oBAAoB,EACzB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,kCAAkC,EAClC,KAAK,8BAA8B,GACpC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,cAAc,GACf,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collections/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EACL,KAAK,yBAAyB,EAC9B,kCAAkC,GACnC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAEhF,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EACL,KAAK,kBAAkB,EACvB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EACL,cAAc,EACd,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,oBAAoB,EACzB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,kCAAkC,EAClC,KAAK,8BAA8B,GACpC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,cAAc,GACf,MAAM,qBAAqB,CAAC"}

package/dist/collections/seeding-transaction.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Batched commits for permission-catalog and role-permission seeding.
+ * @packageDocumentation
+ */
+import type { DatabaseInterface } from '@happyvertical/sql';
+/**
+ * Rows a seeding pass writes per transaction (#3323).
+ *
+ * A cold seed writes every catalog permission and every default grant, each
+ * with a change-feed append: thousands of rows on a real registry. When every
+ * row autocommits, each is a separate durable commit. On a file-backed SQLite
+ * database with `synchronous = FULL` (the local runtime profile), that is an
+ * `fsync` per row, and disk flushes, not queries, set the bootstrap's wall
+ * clock. Batching cuts the commits by this factor.
+ *
+ * The batch is bounded, not the whole seed, because a transaction scope in
+ * `@happyvertical/sql` tracks every promise created while it is open and
+ * keeps each statement's rejection observation until the transaction ends,
+ * so its per-statement cost grows with the statements already issued. On the
+ * local owner claim, one catalog-wide transaction took ~17s against ~4.5s for
+ * batches of 25-100 rows (and ~30s for per-row commits on a real disk).
+ */
+export declare const SEEDING_BATCH_SIZE = 50;
+/**
+ * Write `items` in transactions of at most {@link SEEDING_BATCH_SIZE} rows.
+ *
+ * Seeding is idempotent and additive, so committing per batch keeps the
+ * semantics of the previous per-row commits: an interrupted pass leaves only
+ * complete rows behind, and re-running converges. `write` receives the handle
+ * bound to its batch's transaction and must issue every write through it.
+ *
+ * Nesting follows `@happyvertical/sql`'s rules. Given a transaction handle,
+ * SQLite and PostgreSQL re-enter it under a SAVEPOINT, and adapters without
+ * savepoints (DuckDB/JSON) reuse the caller's transaction directly. A handle
+ * with no `transaction()` keeps per-statement commits. A caller already inside
+ * a transaction must pass that transaction's handle: on a single-connection
+ * adapter the root handle waits for the open transaction instead of joining
+ * it.
+ *
+ * @internal
+ */
+export declare function writeInSeedingBatches<T>(db: DatabaseInterface, items: readonly T[], write: (database: DatabaseInterface, batch: readonly T[]) => Promise<void>): Promise<void>;
+//# sourceMappingURL=seeding-transaction.d.ts.map

package/dist/collections/seeding-transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seeding-transaction.d.ts","sourceRoot":"","sources":["../../src/collections/seeding-transaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,EAAE,EAAE,iBAAiB,EACrB,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,KAAK,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GACzE,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/index.d.ts

@@ -54,13 +54,14 @@
  * @packageDocumentation
  */
 import './__smrt-register__.js';
-export { AccessRequestCollection, type CliAuthApproveReservation, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileOwnerAuthorization, type OidcProfileOwnerAuthorizer, type OidcProfileOwnerAuthorizerContext, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, PermissionCollection, ResourceGrantCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantIntegrationCollection, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthApproveLimitCollection, UsersCliAuthRequestCollection, UsersMagicLinkTokenCollection, } from './collections/index.js';
+export { AccessRequestCollection, type CliAuthApproveReservation, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileOwnerAuthorization, type OidcProfileOwnerAuthorizer, type OidcProfileOwnerAuthorizerContext, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, PermissionCollection, ResourceGrantCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantIntegrationCollection, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthApproveLimitCollection, UsersCliAuthRequestCollection, UsersLoginAttemptCollection, UsersLoginAuditEventCollection, UsersMagicLinkTokenCollection, UsersPinCredentialCollection, } from './collections/index.js';
 export { type BackfillLegacyUserProfilesResult, backfillLegacyUserProfiles, LEGACY_USER_PROFILE_BACKFILL_NAME, LegacyUserProfileBackfillError, type LegacyUserProfileBackfillErrorCode, } from './migrations/backfillLegacyUserProfiles.js';
 export { type BackfillUserEmailKeysResult, backfillUserEmailKeys, type DuplicateUserEmailKey, UserEmailKeyBackfillError, type UserEmailKeyBackfillErrorCode, } from './migrations/backfillUserEmailKeys.js';
+export { type DeduplicateRolePermissionsOptions, type DeduplicateRolePermissionsResult, deduplicateRolePermissions, } from './migrations/deduplicateRolePermissions.js';
 export { type MaterializeTenantHierarchyOptions, type MaterializeTenantHierarchyResult, materializeTenantHierarchy, TenantHierarchyMaterializationError, } from './migrations/materializeTenantHierarchy.js';
-export { AccessRequest, type AccessRequestOptions, CliAuthRequest, type CliAuthRequestStatus, DEFAULT_SESSION_TTL, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupMember, GroupRole, generateSessionId, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkToken, Membership, MembershipOverride, Permission, ResourceGrant, type ResourceGrantEffect, type ResourceGrantOptions, Role, RolePermission, Session, Tenant, TenantIntegration, type TenantIntegrationCheckSummary, type TenantIntegrationOptions, type TenantIntegrationProvider, type TenantIntegrationStatus, TenantPermissionOverride, User, UsersCliAuthApproveLimit, UsersCliAuthRequest, UsersMagicLinkToken, } from './models/index.js';
+export { AccessRequest, type AccessRequestOptions, CliAuthRequest, type CliAuthRequestStatus, DEFAULT_SESSION_TTL, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupMember, GroupRole, generateSessionId, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkToken, Membership, MembershipOverride, Permission, ResourceGrant, type ResourceGrantEffect, type ResourceGrantOptions, Role, RolePermission, SESSION_DATA_KEYS, Session, type SessionAuthMethod, Tenant, TenantIntegration, type TenantIntegrationCheckSummary, type TenantIntegrationOptions, type TenantIntegrationProvider, type TenantIntegrationStatus, TenantPermissionOverride, User, UsersCliAuthApproveLimit, UsersCliAuthRequest, UsersLoginAttempt, UsersLoginAuditEvent, UsersMagicLinkToken, UsersPinCredential, } from './models/index.js';
 export { planTenantHierarchy, type TenantHierarchyChange, type TenantHierarchyErrorCode, type TenantHierarchyPlan, type TenantHierarchyProblem, type TenantHierarchyRow, } from './models/tenant-hierarchy.js';
-export { CLI_AUTH_RETENTION_TASK, MAGIC_LINK_RETENTION_TASK, registerUserRetentionTasks, SESSIONS_RETENTION_TASK, USER_RETENTION_TASKS, unregisterUserRetentionTasks, } from './retention.js';
-export { ACCESS_REQUEST_CAPABILITIES, type AccessRequestAuthorizationContext, type AccessRequestAuthorizer, type AccessRequestCapability, AccessRequestError, type AccessRequestErrorCode, type AccessRequestEvent, type AccessRequestEventHandler, type AccessRequestEventType, AccessRequestService, type AccessRequestServiceOptions, ANCESTOR_READ_ACTION, type AncestorReadPackageConfig, type AncestorReadPolicy, type ApproveAccessRequestOptions, type ApproveCliAuthRequestInput, applyPostgresPermissionPolicies, assertOperationPermission, type CancelAccessRequestOptions, type CliAuthStartResult, type CliAuthTokenResult, type CreateAccessRequestInput, type CreateAuthorizationUrlOptions, type CreateResourceGrantOptions, checkOperationPermission, checkResourceOperationPermission, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, type DeclineAccessRequestOptions, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, type EnsureTenantResult, encodeOidcTransaction, type GeneratePostgresPermissionSqlResult, type GraduateAccessRequestOptions, type GraduateAccessRequestResult, type GraduateExistingTenantOption, type GraduateNewTenantOption, type GraduateTenantOption, generatePostgresPermissionSql, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, type ListAccessRequestsFilter, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MagicLinkError, type MagicLinkResult, MagicLinkService, type MagicLinkServiceOptions, type MagicLinkVerifyResult, MobileAuthError, type MobileAuthErrorCode, MobileAuthService, type MobileAuthServiceOptions, type MobileBootstrapContext, type MobileLoginContext, type MobileLogoutResult, type MobileRequestMeta, type MobileResolvedUser, type MobileTenantContext, type NormalizedAncestorReadPolicy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, type OidcCallbackResult, OidcLoginError, type OidcLoginResult, OidcLoginService, type OidcLoginServiceOptions, type OidcProviderConfig, type OidcProviderKind, type OidcProviderMetadata, type OidcProviderResolution, type OidcProviderResolutionOptions, type OidcTokenEndpointAuthMethod, type OidcTokenSet, type OidcTransaction, type OperationPermissionAllowReason, type OperationPermissionCollectionInput, type OperationPermissionDecision, type OperationPermissionDenyReason, OperationPermissionError, type OperationPermissionOptions, type PermissionCatalog, PermissionCatalogService, type PermissionCatalogSource, type PermissionCatalogSyncResult, type PermissionDefinition, type PermissionResolutionOptions, type PermissionResolutionResult, PermissionResolver, type PermissionResolverOptions, type PostgresPermissionAction, type PostgresPermissionBinding, type PostgresPermissionPolicyReportItem, type PostgresPermissionPolicyTarget, type PrincipalPermissionRuntimeOptions, type ResolvedOidcProviderConfig, type ResourceGrantDecision, ResourceGrantService, type ResourceIdentity, type ResourceIdentityVerifier, type ResourceOperationPermissionOptions, type RevokeResourceGrantOptions, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, type SessionContext, type SessionPermissionRuntimeContext, type SessionPermissionRuntimeOptions, SessionService, type SessionServiceOptions, type SwitchTenantResult, syncPermissionCatalog, type TenantPermissionInheritanceResult, TenantService, type TenantWithOwnershipResult, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, type TerminalAuthServiceOptions, type UsersConfig, type UsersOidcConfig, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext, } from './services/index.js';
+export { CLI_AUTH_RETENTION_TASK, DEFAULT_LOGIN_AUDIT_RETENTION_DAYS, LOGIN_ATTEMPTS_RETENTION_TASK, LOGIN_AUDIT_RETENTION_TASK, MAGIC_LINK_RETENTION_TASK, registerUserRetentionTasks, SESSIONS_RETENTION_TASK, USER_RETENTION_TASKS, unregisterUserRetentionTasks, } from './retention.js';
+export { ACCESS_REQUEST_CAPABILITIES, type AccessRequestAuthorizationContext, type AccessRequestAuthorizer, type AccessRequestCapability, AccessRequestError, type AccessRequestErrorCode, type AccessRequestEvent, type AccessRequestEventHandler, type AccessRequestEventType, AccessRequestService, type AccessRequestServiceOptions, ANCESTOR_READ_ACTION, type AncestorReadPackageConfig, type AncestorReadPolicy, type ApproveAccessRequestOptions, type ApproveCliAuthRequestInput, applyPostgresPermissionPolicies, assertOperationPermission, type CancelAccessRequestOptions, type ClearPinInput, type CliAuthStartResult, type CliAuthTokenResult, type CreateAccessRequestInput, type CreateAuthorizationUrlOptions, type CreateResourceGrantOptions, checkOperationPermission, checkResourceOperationPermission, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_DEVICE_PERSON_IDLE_SECONDS, DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, DEFAULT_LOGIN_LOCKOUT_FACTOR, DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, DEFAULT_LOGIN_MAX_ATTEMPTS, DEFAULT_PIN_MANAGE_PERMISSION, type DeclineAccessRequestOptions, DeviceCredentialError, DeviceCredentialForbiddenError, DeviceCredentialPolicyError, DeviceCredentialService, type DeviceCredentialServiceOptions, type DeviceCredentialVerification, type DeviceCredentialVerifier, type DeviceSignInContext, type DeviceSignInInput, type DeviceSignInResult, DurableLoginAuditSink, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, type EnsureTenantResult, encodeOidcTransaction, ensurePinPermissionsRegistered, type GeneratePostgresPermissionSqlResult, type GraduateAccessRequestOptions, type GraduateAccessRequestResult, type GraduateExistingTenantOption, type GraduateNewTenantOption, type GraduateTenantOption, generatePostgresPermissionSql, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, InvalidCredentialsError, isAncestorReadableSlug, type ListAccessRequestsFilter, type LoginAttemptDecision, type LoginAttemptDenied, type LoginAttemptLease, LoginAttemptLimiter, type LoginAttemptLimiterOptions, type LoginAuditEntry, type LoginAuditSink, type LoginFailureOutcome, type LoginLockoutOptions, LoginRateLimitError, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MagicLinkError, type MagicLinkResult, MagicLinkService, type MagicLinkServiceOptions, type MagicLinkVerifyResult, MobileAuthError, type MobileAuthErrorCode, MobileAuthService, type MobileAuthServiceOptions, type MobileBootstrapContext, type MobileLoginContext, type MobileLogoutResult, type MobileRequestMeta, type MobileResolvedUser, type MobileTenantContext, type NormalizedAncestorReadPolicy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, type OidcCallbackResult, OidcLoginError, type OidcLoginResult, OidcLoginService, type OidcLoginServiceOptions, type OidcProviderConfig, type OidcProviderKind, type OidcProviderMetadata, type OidcProviderResolution, type OidcProviderResolutionOptions, type OidcTokenEndpointAuthMethod, type OidcTokenSet, type OidcTransaction, type OperationPermissionAllowReason, type OperationPermissionCollectionInput, type OperationPermissionDecision, type OperationPermissionDenyReason, OperationPermissionError, type OperationPermissionOptions, type PermissionCatalog, PermissionCatalogService, type PermissionCatalogSource, type PermissionCatalogSyncResult, type PermissionDefinition, type PermissionResolutionOptions, type PermissionResolutionResult, PermissionResolver, type PermissionResolverOptions, PIN_LOGIN_KIND, PIN_PERMISSION_DEFINITIONS, type PinPolicyOptions, type PinSignInInput, PinVerifier, type PostgresPermissionAction, type PostgresPermissionBinding, type PostgresPermissionPolicyReportItem, type PostgresPermissionPolicyTarget, type PrincipalPermissionRuntimeOptions, type ReserveLoginAttemptOptions, type ResetPinInput, type ResolvedOidcProviderConfig, type ResourceGrantDecision, ResourceGrantService, type ResourceIdentity, type ResourceIdentityVerifier, type ResourceOperationPermissionOptions, type RevokeResourceGrantOptions, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, type SessionContext, type SessionParentContext, type SessionPermissionRuntimeContext, type SessionPermissionRuntimeOptions, SessionService, type SessionServiceOptions, type SetPinInput, type SwitchTenantResult, syncPermissionCatalog, TERMINAL_APPROVE_LOGIN_KIND, type TenantPermissionInheritanceResult, TenantService, type TenantWithOwnershipResult, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, type TerminalAuthServiceOptions, type UsersConfig, type UsersOidcConfig, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext, } from './services/index.js';
 export { AccessRequestStatus, DEFAULT_ROLE_SLUGS, DEFAULT_ROLES, DEFAULT_TENANT_POLICY, type DefaultRoleSlug, MembershipStatus, OverrideEffect, SessionStatus, TenantPermissionEffect, type TenantPolicy, type TenantPolicyMode, TenantStatus, UserStatus, } from './types/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAWhC,OAAO,EACL,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,kCAAkC,EAClC,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,KAAK,kCAAkC,GACxC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,KAAK,iCAAiC,EACtC,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,IAAI,EACJ,cAAc,EACd,OAAO,EACP,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,mCAAmC,EACnC,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAWhC,OAAO,EACL,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,KAAK,kCAAkC,GACxC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,KAAK,iCAAiC,EACtC,KAAK,gCAAgC,EACrC,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,iCAAiC,EACtC,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,IAAI,EACJ,cAAc,EACd,iBAAiB,EACjB,OAAO,EACP,KAAK,iBAAiB,EACtB,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,wBAAwB,EACxB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,6BAA6B,EAC7B,0BAA0B,EAC1B,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,kCAAkC,EAClC,oCAAoC,EACpC,kCAAkC,EAClC,4BAA4B,EAC5B,iCAAiC,EACjC,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,8BAA8B,EAC9B,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,mCAAmC,EACnC,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,cAAc,EACd,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,WAAW,EACX,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,KAAK,aAAa,EAClB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}