@happyvertical/smrt-users 0.52.0 → 0.53.5

package/dist/index.js

@@ -1,18 +1,18 @@
-import { $ as deriveOperationPermissionSlug, A as DEFAULT_ANCESTOR_READ_MAX_DEPTH, B as TenantPermissionOverride, C as OidcLoginService, Ct as UsersCliAuthRequestCollection, D as resolveOidcProviderConfig, Dt as generateSessionId, E as getUsersOidcConfig, Et as Session, F as UserCollection, G as applyTenantHierarchyUpdates, H as Tenant, J as recordTenantHierarchyChanges, K as assertTenantTableName, L as UserEmailKeyBackfillError, M as isAncestorReadableSlug, N as normalizeAncestorReadPolicy, Ot as UsersCliAuthRequest, P as OidcProvisioningError, Q as deriveOperationPermissionCollectionName, R as backfillUserEmailKeys, S as OidcLoginError, St as normalizeEmail, T as encodeOidcTransaction, Tt as DEFAULT_SESSION_TTL, U as MAX_TENANT_HIERARCHY_DEPTH, V as TenantCollection, W as TenantHierarchyError, X as RolePermissionCollection, Y as DEFAULT_ROLE_PERMISSION_PATTERNS, Z as PermissionCatalogService, _ as readMobileBearerToken, _t as Group, a as TerminalAuthRateLimitError, at as Role, b as PermissionResolver, bt as User, c as assertOperationPermission, ct as MembershipOverrideCollection, d as getCurrentSessionPermissionContext, dt as Membership, et as normalizeOperationPermissionAction, f as getRequestScopedDatabase, ft as GroupRoleCollection, g as MobileAuthService, gt as GroupCollection, h as MobileAuthError, ht as GroupMember, i as TerminalAuthError, it as RoleCollection, j as getConfiguredAncestorReadPolicy, k as ANCESTOR_READ_ACTION, l as checkOperationPermission, lt as MembershipOverride, m as withSessionPermissionContext, mt as GroupMemberCollection, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as syncPermissionCatalog, o as TerminalAuthService, ot as PermissionCollection, p as withPrincipalPermissionContext, pt as GroupRole, q as planTenantHierarchy, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as RolePermission, s as OperationPermissionError, st as Permission, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as registerPermissionDefinitions, u as hasOperationPermission, ut as MembershipCollection, v as validateMobileRedirectUri, vt as UsersCliAuthApproveLimitCollection, w as decodeOidcTransaction, wt as SessionCollection, x as withoutListBounds, xt as isValidEmail, y as SessionService, yt as UsersCliAuthApproveLimit, z as TenantPermissionOverrideCollection } from "./chunks/TerminalAuthService-Br64vHtd.js";
+import { $ as normalizeAncestorReadPolicy, $t as UsersCliAuthRequest, A as DeviceCredentialForbiddenError, At as MembershipOverrideCollection, B as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Bt as User, C as encodeOidcTransaction, Ct as RolePermission, D as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, Dt as UsersPinCredential, Et as UsersPinCredentialCollection, F as PinVerifier, Ft as GroupRole, G as InvalidCredentialsError, Gt as UsersLoginAttemptCollection, H as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, Ht as normalizeEmail, I as ensurePinPermissionsRegistered, It as GroupMemberCollection, J as withoutListBounds, Jt as SessionCollection, K as LoginAttemptLimiter, Kt as UsersLoginAttempt, L as SessionService, Lt as GroupMember, M as DeviceCredentialService, Mt as MembershipCollection, N as PIN_LOGIN_KIND, Nt as Membership, O as DEFAULT_PIN_MANAGE_PERMISSION, Ot as PermissionCollection, P as PIN_PERMISSION_DEFINITIONS, Pt as GroupRoleCollection, Q as isAncestorReadableSlug, Qt as generateSessionId, R as PermissionResolver, Rt as GroupCollection, S as decodeOidcTransaction, St as syncPermissionCatalog, T as resolveOidcProviderConfig, Tt as Role, U as DEFAULT_LOGIN_MAX_ATTEMPTS, Ut as UsersLoginAuditEventCollection, V as DEFAULT_LOGIN_LOCKOUT_FACTOR, Vt as isValidEmail, W as DurableLoginAuditSink, Wt as UsersLoginAuditEvent, X as DEFAULT_ANCESTOR_READ_MAX_DEPTH, Xt as SESSION_DATA_KEYS, Y as ANCESTOR_READ_ACTION, Yt as DEFAULT_SESSION_TTL, Z as getConfiguredAncestorReadPolicy, Zt as Session, _ as MobileAuthService, _t as PermissionCatalogService, a as TerminalAuthError, at as TenantPermissionOverrideCollection, b as OidcLoginError, bt as normalizeOperationPermissionAction, c as OperationPermissionError, ct as Tenant, d as hasOperationPermission, dt as applyTenantHierarchyUpdates, et as OidcProvisioningError, f as getCurrentSessionPermissionContext, ft as assertTenantTableName, g as MobileAuthError, gt as RolePermissionCollection, h as withSessionPermissionContext, ht as DEFAULT_ROLE_PERMISSION_PATTERNS, i as TERMINAL_APPROVE_LOGIN_KIND, it as backfillUserEmailKeys, j as DeviceCredentialPolicyError, jt as MembershipOverride, k as DeviceCredentialError, kt as Permission, l as assertOperationPermission, lt as MAX_TENANT_HIERARCHY_DEPTH, m as withPrincipalPermissionContext, mt as recordTenantHierarchyChanges, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, o as TerminalAuthRateLimitError, ot as TenantPermissionOverride, p as getRequestScopedDatabase, pt as planTenantHierarchy, q as LoginRateLimitError, qt as UsersCliAuthRequestCollection, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as UserEmailKeyBackfillError, s as TerminalAuthService, st as TenantCollection, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as UserCollection, u as checkOperationPermission, ut as TenantHierarchyError, v as readMobileBearerToken, vt as deriveOperationPermissionCollectionName, w as getUsersOidcConfig, wt as RoleCollection, x as OidcLoginService, xt as registerPermissionDefinitions, y as validateMobileRedirectUri, yt as deriveOperationPermissionSlug, z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, zt as Group } from "./chunks/TerminalAuthService-BdB_0vDA.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
-import { ObjectRegistry, SmrtCollection, SmrtObject, field, findManifestEntryByQualifiedName, foreignKey, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask } from "@happyvertical/smrt-core";
+import { ObjectRegistry, SmrtCollection, SmrtObject, bumpChangeFeed, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
+import { createHash, randomUUID } from "node:crypto";
 import { PROFILE_EMAIL_KEY_BACKFILL_NAME, Person, ProfileCollection, ProfileTypeCollection, normalizeIdentityEmail } from "@happyvertical/smrt-profiles";
-import { createHash } from "node:crypto";
 import { createLogger } from "@happyvertical/logger";
 import { TenantScoped, tenantId, withSystemContext } from "@happyvertical/smrt-tenancy";
 import { BackfillTracker } from "@happyvertical/smrt-core/migrations";
 //#region src/models/MagicLinkToken.ts
-var __defProp$3 = Object.defineProperty;
-var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
-var __decorateClass$3 = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$3(target, key) : target;
+var __defProp$4 = Object.defineProperty;
+var __getOwnPropDesc$4 = Object.getOwnPropertyDescriptor;
+var __decorateClass$4 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$4(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp$3(target, key, result);
+	if (kind && result) __defProp$4(target, key, result);
 	return result;
 };
 var DEFAULT_TOKEN_EXPIRY_SECONDS = 600;
@@ -39,15 +39,15 @@ var UsersMagicLinkToken = class extends SmrtObject {
 		return !this.used && !this.isExpired();
 	}
 };
-__decorateClass$3([field({
+__decorateClass$4([field({
 	required: true,
 	unique: true
 })], UsersMagicLinkToken.prototype, "nonce", 2);
-__decorateClass$3([field({
+__decorateClass$4([field({
 	type: "datetime",
 	indexed: true
 })], UsersMagicLinkToken.prototype, "expiresAt", 2);
-UsersMagicLinkToken = __decorateClass$3([smrt({
+UsersMagicLinkToken = __decorateClass$4([smrt({
 	tableName: "users_magic_link_tokens",
 	sensitive: true,
 	api: { include: [] },
@@ -103,10 +103,15 @@ var UsersMagicLinkTokenCollection = class extends SmrtCollection {
 var SESSIONS_RETENTION_TASK = "users-sessions";
 var MAGIC_LINK_RETENTION_TASK = "users-magic-link-tokens";
 var CLI_AUTH_RETENTION_TASK = "users-cli-auth-requests";
+var LOGIN_ATTEMPTS_RETENTION_TASK = "users-login-attempts";
+var LOGIN_AUDIT_RETENTION_TASK = "users-login-audit-events";
+var DEFAULT_LOGIN_AUDIT_RETENTION_DAYS = 90;
 var USER_RETENTION_TASKS = [
 	SESSIONS_RETENTION_TASK,
 	MAGIC_LINK_RETENTION_TASK,
-	CLI_AUTH_RETENTION_TASK
+	CLI_AUTH_RETENTION_TASK,
+	LOGIN_ATTEMPTS_RETENTION_TASK,
+	LOGIN_AUDIT_RETENTION_TASK
 ];
 function registerUserRetentionTasks() {
 	registerRetentionTask({
@@ -130,18 +135,32 @@ function registerUserRetentionTasks() {
 			return (await UsersCliAuthRequestCollection.create({ db })).deleteExpired({ dryRun: context.dryRun });
 		}
 	});
+	registerRetentionTask({
+		name: LOGIN_ATTEMPTS_RETENTION_TASK,
+		description: "Delete idle login-attempt limiter rows",
+		run: async (db, context) => {
+			return (await UsersLoginAttemptCollection.create({ db })).deleteIdle({ dryRun: context.dryRun });
+		}
+	});
+	registerRetentionTask({
+		name: LOGIN_AUDIT_RETENTION_TASK,
+		description: `Delete login audit events older than 90 days`,
+		run: async (db, context) => {
+			return (await UsersLoginAuditEventCollection.create({ db })).deleteOlderThan(2160 * 60 * 60 * 1e3, { dryRun: context.dryRun });
+		}
+	});
 }
 function unregisterUserRetentionTasks() {
 	for (const name of USER_RETENTION_TASKS) unregisterRetentionTask(name);
 }
 //#endregion
 //#region src/models/AccessRequest.ts
-var __defProp$2 = Object.defineProperty;
-var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
-var __decorateClass$2 = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$2(target, key) : target;
+var __defProp$3 = Object.defineProperty;
+var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
+var __decorateClass$3 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$3(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp$2(target, key, result);
+	if (kind && result) __defProp$3(target, key, result);
 	return result;
 };
 var AccessRequest = class extends SmrtObject {
@@ -226,24 +245,24 @@ var AccessRequest = class extends SmrtObject {
 		return this.status === AccessRequestStatus.DECLINED || this.status === AccessRequestStatus.GRADUATED || this.status === AccessRequestStatus.CANCELED;
 	}
 };
-__decorateClass$2([field({
+__decorateClass$3([field({
 	required: true,
 	indexed: true
 })], AccessRequest.prototype, "email", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "name", 2);
-__decorateClass$2([field({
+__decorateClass$3([field({ nullable: true })], AccessRequest.prototype, "name", 2);
+__decorateClass$3([field({
 	type: "text",
 	indexed: true
 })], AccessRequest.prototype, "status", 2);
-__decorateClass$2([field({ indexed: true })], AccessRequest.prototype, "source", 2);
-__decorateClass$2([field()], AccessRequest.prototype, "requestContext", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "note", 2);
-__decorateClass$2([field()], AccessRequest.prototype, "requestedAt", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "decidedAt", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "decidedBy", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "resultingUserId", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "tenantHint", 2);
-AccessRequest = __decorateClass$2([smrt({
+__decorateClass$3([field({ indexed: true })], AccessRequest.prototype, "source", 2);
+__decorateClass$3([field()], AccessRequest.prototype, "requestContext", 2);
+__decorateClass$3([field({ nullable: true })], AccessRequest.prototype, "note", 2);
+__decorateClass$3([field()], AccessRequest.prototype, "requestedAt", 2);
+__decorateClass$3([field({ nullable: true })], AccessRequest.prototype, "decidedAt", 2);
+__decorateClass$3([field({ nullable: true })], AccessRequest.prototype, "decidedBy", 2);
+__decorateClass$3([field({ nullable: true })], AccessRequest.prototype, "resultingUserId", 2);
+__decorateClass$3([field({ nullable: true })], AccessRequest.prototype, "tenantHint", 2);
+AccessRequest = __decorateClass$3([smrt({
 	tableName: "access_requests",
 	conflictColumns: ["id"],
 	api: { include: [] },
@@ -296,6 +315,100 @@ var AccessRequestCollection = class extends SmrtCollection {
 	}
 };
 //#endregion
+//#region src/models/CliAuthApproveLimit.ts
+var __defProp$2 = Object.defineProperty;
+var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
+var __decorateClass$2 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$2(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$2(target, key, result);
+	return result;
+};
+var UsersCliAuthApproveLimit = class extends SmrtObject {
+	userId = "";
+	attemptCount = 0;
+	windowStartedAt = /* @__PURE__ */ new Date();
+};
+__decorateClass$2([foreignKey("User", {
+	required: true,
+	unique: true
+})], UsersCliAuthApproveLimit.prototype, "userId", 2);
+__decorateClass$2([field({
+	type: "integer",
+	required: true,
+	default: 0
+})], UsersCliAuthApproveLimit.prototype, "attemptCount", 2);
+__decorateClass$2([field({
+	type: "datetime",
+	required: true
+})], UsersCliAuthApproveLimit.prototype, "windowStartedAt", 2);
+UsersCliAuthApproveLimit = __decorateClass$2([smrt({
+	tableName: "users_cli_auth_approve_limits",
+	api: false,
+	cli: false,
+	mcp: false
+})], UsersCliAuthApproveLimit);
+//#endregion
+//#region src/collections/CliAuthApproveLimitCollection.ts
+var UsersCliAuthApproveLimitCollection = class extends SmrtCollection {
+	static _itemClass = UsersCliAuthApproveLimit;
+	/**
+	* Atomically reserve one attempt across every process using this database.
+	* Failed attempts retain their reservation; successful attempts release it.
+	*/
+	async reserveAttempt(input) {
+		const now = /* @__PURE__ */ new Date();
+		const nowIso = now.toISOString();
+		const windowFloorIso = new Date(now.getTime() - input.windowMs).toISOString();
+		const id = randomUUID();
+		const reserved = await this.db.query(`INSERT INTO ${this.tableName} (
+         id, slug, context, user_id, attempt_count, window_started_at,
+         created_at, updated_at
+       ) VALUES (?, ?, '', ?, 1, ?, ?, ?)
+       ON CONFLICT (user_id) DO UPDATE SET
+         attempt_count = CASE
+           WHEN ${this.tableName}.window_started_at <= ? THEN 1
+           ELSE ${this.tableName}.attempt_count + 1
+         END,
+         window_started_at = CASE
+           WHEN ${this.tableName}.window_started_at <= ?
+             THEN excluded.window_started_at
+           ELSE ${this.tableName}.window_started_at
+         END,
+         updated_at = excluded.updated_at
+       WHERE ${this.tableName}.window_started_at <= ?
+          OR ${this.tableName}.attempt_count < ?
+       RETURNING attempt_count, window_started_at`, id, `terminal-auth-${id}`, input.userId, nowIso, nowIso, nowIso, windowFloorIso, windowFloorIso, windowFloorIso, input.maxAttempts);
+		if (reserved.rows.length === 1) {
+			const reservedWindow = reserved.rows[0]?.window_started_at;
+			return {
+				allowed: true,
+				windowStartedAt: reservedWindow instanceof Date ? reservedWindow.toISOString() : new Date(String(reservedWindow)).toISOString()
+			};
+		}
+		const windowStartedAt = (await this.db.query(`SELECT window_started_at FROM ${this.tableName}
+        WHERE user_id = ? LIMIT 1`, input.userId)).rows[0]?.window_started_at;
+		const startedMs = windowStartedAt instanceof Date ? windowStartedAt.getTime() : new Date(String(windowStartedAt)).getTime();
+		const remainingMs = Number.isFinite(startedMs) ? startedMs + input.windowMs - now.getTime() : input.windowMs;
+		return {
+			allowed: false,
+			retryAfterSeconds: Math.max(1, Math.ceil(remainingMs / 1e3))
+		};
+	}
+	/** Release the reservation for an attempt that did not fail authentication. */
+	async releaseAttempt(userId, windowStartedAt) {
+		await this.db.query(`UPDATE ${this.tableName}
+          SET attempt_count = CASE
+                WHEN attempt_count > 0 THEN attempt_count - 1
+                ELSE 0
+              END,
+              updated_at = ?
+        WHERE user_id = ? AND window_started_at = ?`, (/* @__PURE__ */ new Date()).toISOString(), userId, windowStartedAt);
+		await this.db.query(`DELETE FROM ${this.tableName}
+        WHERE user_id = ? AND window_started_at = ? AND attempt_count = 0`, userId, windowStartedAt);
+	}
+};
+//#endregion
 //#region src/models/ResourceGrant.ts
 var __defProp$1 = Object.defineProperty;
 var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
@@ -658,6 +771,41 @@ function readRequiredString(value, label) {
 	return stringValue;
 }
 //#endregion
+//#region src/migrations/deduplicateRolePermissions.ts
+var duplicateIds = `SELECT id FROM (
+  SELECT id, ROW_NUMBER() OVER (
+    PARTITION BY role_id, permission_id
+    ORDER BY created_at ASC NULLS LAST, id ASC
+  ) AS duplicate_rank FROM role_permissions
+) AS ranked WHERE duplicate_rank > 1`;
+async function deduplicateRolePermissions(db, options = {}) {
+	const count = async (handle) => {
+		const result = await handle.query(`SELECT COUNT(*) AS count FROM (${duplicateIds}) AS duplicates`);
+		return Number(result.rows[0].count);
+	};
+	if (options.dryRun) return {
+		duplicates: await count(db),
+		removed: 0
+	};
+	if (!options.maintenanceConfirmed) throw new Error("Stop all writers and seeders, then set maintenanceConfirmed: true.");
+	if (!db.transaction) throw new Error("Grant deduplication requires a root transaction handle.");
+	await ensureChangeFeedTable(db);
+	return withEmbeddedWriteTransaction(db, isEmbeddedDatabase(db), async (tx) => {
+		if (!isEmbeddedDatabase(db)) await tx.query("LOCK TABLE role_permissions IN EXCLUSIVE MODE");
+		const duplicates = await count(tx);
+		if (duplicates > 0) await tx.query(`DELETE FROM role_permissions WHERE id IN (${duplicateIds})`);
+		await tx.query("CREATE UNIQUE INDEX IF NOT EXISTS role_permissions_role_id_permission_id_idx ON role_permissions (role_id, permission_id)");
+		if (duplicates > 0) await bumpChangeFeed(tx, {
+			table: "role_permissions",
+			operation: "delete"
+		});
+		return {
+			duplicates,
+			removed: duplicates
+		};
+	});
+}
+//#endregion
 //#region src/migrations/materializeTenantHierarchy.ts
 var TenantHierarchyMaterializationError = class extends Error {
 	constructor(problems) {
@@ -1194,7 +1342,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-Br64vHtd.js").then((n) => n.O);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-BdB_0vDA.js").then((n) => n.E);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -1223,7 +1371,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-Br64vHtd.js").then((n) => n.O);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-BdB_0vDA.js").then((n) => n.E);
 		const key = await this.getSigningKey();
 		let payload;
 		try {
@@ -1821,6 +1969,6 @@ var TenantService = class TenantService {
 //#region src/index.ts
 registerUserRetentionTasks();
 //#endregion
-export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, LEGACY_USER_PROFILE_BACKFILL_NAME, LegacyUserProfileBackfillError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantHierarchyMaterializationError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, materializeTenantHierarchy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, planTenantHierarchy, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
+export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_DEVICE_PERSON_IDLE_SECONDS, DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, DEFAULT_LOGIN_AUDIT_RETENTION_DAYS, DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, DEFAULT_LOGIN_LOCKOUT_FACTOR, DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, DEFAULT_LOGIN_MAX_ATTEMPTS, DEFAULT_PIN_MANAGE_PERMISSION, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, DeviceCredentialError, DeviceCredentialForbiddenError, DeviceCredentialPolicyError, DeviceCredentialService, DurableLoginAuditSink, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, InvalidCredentialsError, LEGACY_USER_PROFILE_BACKFILL_NAME, LOGIN_ATTEMPTS_RETENTION_TASK, LOGIN_AUDIT_RETENTION_TASK, LegacyUserProfileBackfillError, LoginAttemptLimiter, LoginRateLimitError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, PIN_LOGIN_KIND, PIN_PERMISSION_DEFINITIONS, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, PinVerifier, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, SESSION_DATA_KEYS, Session, SessionCollection, SessionService, SessionStatus, TERMINAL_APPROVE_LOGIN_KIND, Tenant, TenantCollection, TenantHierarchyError, TenantHierarchyMaterializationError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, UsersLoginAttempt, UsersLoginAttemptCollection, UsersLoginAuditEvent, UsersLoginAuditEventCollection, UsersPinCredential, UsersPinCredentialCollection, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deduplicateRolePermissions, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, ensurePinPermissionsRegistered, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, materializeTenantHierarchy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, planTenantHierarchy, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
 
 //# sourceMappingURL=index.js.map