@happyvertical/smrt-users 0.53.3 → 0.53.5

package/dist/index.js

@@ -1,18 +1,18 @@
-import { $ as deriveOperationPermissionSlug, A as DEFAULT_ANCESTOR_READ_MAX_DEPTH, B as TenantPermissionOverride, C as OidcLoginService, Ct as UsersCliAuthRequestCollection, D as resolveOidcProviderConfig, Dt as generateSessionId, E as getUsersOidcConfig, Et as Session, F as UserCollection, G as applyTenantHierarchyUpdates, H as Tenant, J as recordTenantHierarchyChanges, K as assertTenantTableName, L as UserEmailKeyBackfillError, M as isAncestorReadableSlug, N as normalizeAncestorReadPolicy, Ot as UsersCliAuthRequest, P as OidcProvisioningError, Q as deriveOperationPermissionCollectionName, R as backfillUserEmailKeys, S as OidcLoginError, St as normalizeEmail, T as encodeOidcTransaction, Tt as DEFAULT_SESSION_TTL, U as MAX_TENANT_HIERARCHY_DEPTH, V as TenantCollection, W as TenantHierarchyError, X as RolePermissionCollection, Y as DEFAULT_ROLE_PERMISSION_PATTERNS, Z as PermissionCatalogService, _ as readMobileBearerToken, _t as Group, a as TerminalAuthRateLimitError, at as Role, b as PermissionResolver, bt as User, c as assertOperationPermission, ct as MembershipOverrideCollection, d as getCurrentSessionPermissionContext, dt as Membership, et as normalizeOperationPermissionAction, f as getRequestScopedDatabase, ft as GroupRoleCollection, g as MobileAuthService, gt as GroupCollection, h as MobileAuthError, ht as GroupMember, i as TerminalAuthError, it as RoleCollection, j as getConfiguredAncestorReadPolicy, k as ANCESTOR_READ_ACTION, l as checkOperationPermission, lt as MembershipOverride, m as withSessionPermissionContext, mt as GroupMemberCollection, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as syncPermissionCatalog, o as TerminalAuthService, ot as PermissionCollection, p as withPrincipalPermissionContext, pt as GroupRole, q as planTenantHierarchy, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as RolePermission, s as OperationPermissionError, st as Permission, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as registerPermissionDefinitions, u as hasOperationPermission, ut as MembershipCollection, v as validateMobileRedirectUri, vt as UsersCliAuthApproveLimitCollection, w as decodeOidcTransaction, wt as SessionCollection, x as withoutListBounds, xt as isValidEmail, y as SessionService, yt as UsersCliAuthApproveLimit, z as TenantPermissionOverrideCollection } from "./chunks/TerminalAuthService-DoadwiqV.js";
+import { $ as normalizeAncestorReadPolicy, $t as UsersCliAuthRequest, A as DeviceCredentialForbiddenError, At as MembershipOverrideCollection, B as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Bt as User, C as encodeOidcTransaction, Ct as RolePermission, D as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, Dt as UsersPinCredential, Et as UsersPinCredentialCollection, F as PinVerifier, Ft as GroupRole, G as InvalidCredentialsError, Gt as UsersLoginAttemptCollection, H as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, Ht as normalizeEmail, I as ensurePinPermissionsRegistered, It as GroupMemberCollection, J as withoutListBounds, Jt as SessionCollection, K as LoginAttemptLimiter, Kt as UsersLoginAttempt, L as SessionService, Lt as GroupMember, M as DeviceCredentialService, Mt as MembershipCollection, N as PIN_LOGIN_KIND, Nt as Membership, O as DEFAULT_PIN_MANAGE_PERMISSION, Ot as PermissionCollection, P as PIN_PERMISSION_DEFINITIONS, Pt as GroupRoleCollection, Q as isAncestorReadableSlug, Qt as generateSessionId, R as PermissionResolver, Rt as GroupCollection, S as decodeOidcTransaction, St as syncPermissionCatalog, T as resolveOidcProviderConfig, Tt as Role, U as DEFAULT_LOGIN_MAX_ATTEMPTS, Ut as UsersLoginAuditEventCollection, V as DEFAULT_LOGIN_LOCKOUT_FACTOR, Vt as isValidEmail, W as DurableLoginAuditSink, Wt as UsersLoginAuditEvent, X as DEFAULT_ANCESTOR_READ_MAX_DEPTH, Xt as SESSION_DATA_KEYS, Y as ANCESTOR_READ_ACTION, Yt as DEFAULT_SESSION_TTL, Z as getConfiguredAncestorReadPolicy, Zt as Session, _ as MobileAuthService, _t as PermissionCatalogService, a as TerminalAuthError, at as TenantPermissionOverrideCollection, b as OidcLoginError, bt as normalizeOperationPermissionAction, c as OperationPermissionError, ct as Tenant, d as hasOperationPermission, dt as applyTenantHierarchyUpdates, et as OidcProvisioningError, f as getCurrentSessionPermissionContext, ft as assertTenantTableName, g as MobileAuthError, gt as RolePermissionCollection, h as withSessionPermissionContext, ht as DEFAULT_ROLE_PERMISSION_PATTERNS, i as TERMINAL_APPROVE_LOGIN_KIND, it as backfillUserEmailKeys, j as DeviceCredentialPolicyError, jt as MembershipOverride, k as DeviceCredentialError, kt as Permission, l as assertOperationPermission, lt as MAX_TENANT_HIERARCHY_DEPTH, m as withPrincipalPermissionContext, mt as recordTenantHierarchyChanges, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, o as TerminalAuthRateLimitError, ot as TenantPermissionOverride, p as getRequestScopedDatabase, pt as planTenantHierarchy, q as LoginRateLimitError, qt as UsersCliAuthRequestCollection, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as UserEmailKeyBackfillError, s as TerminalAuthService, st as TenantCollection, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as UserCollection, u as checkOperationPermission, ut as TenantHierarchyError, v as readMobileBearerToken, vt as deriveOperationPermissionCollectionName, w as getUsersOidcConfig, wt as RoleCollection, x as OidcLoginService, xt as registerPermissionDefinitions, y as validateMobileRedirectUri, yt as deriveOperationPermissionSlug, z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, zt as Group } from "./chunks/TerminalAuthService-BdB_0vDA.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, bumpChangeFeed, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
+import { createHash, randomUUID } from "node:crypto";
 import { PROFILE_EMAIL_KEY_BACKFILL_NAME, Person, ProfileCollection, ProfileTypeCollection, normalizeIdentityEmail } from "@happyvertical/smrt-profiles";
-import { createHash } from "node:crypto";
 import { createLogger } from "@happyvertical/logger";
 import { TenantScoped, tenantId, withSystemContext } from "@happyvertical/smrt-tenancy";
 import { BackfillTracker } from "@happyvertical/smrt-core/migrations";
 //#region src/models/MagicLinkToken.ts
-var __defProp$3 = Object.defineProperty;
-var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
-var __decorateClass$3 = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$3(target, key) : target;
+var __defProp$4 = Object.defineProperty;
+var __getOwnPropDesc$4 = Object.getOwnPropertyDescriptor;
+var __decorateClass$4 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$4(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp$3(target, key, result);
+	if (kind && result) __defProp$4(target, key, result);
 	return result;
 };
 var DEFAULT_TOKEN_EXPIRY_SECONDS = 600;
@@ -39,15 +39,15 @@ var UsersMagicLinkToken = class extends SmrtObject {
 		return !this.used && !this.isExpired();
 	}
 };
-__decorateClass$3([field({
+__decorateClass$4([field({
 	required: true,
 	unique: true
 })], UsersMagicLinkToken.prototype, "nonce", 2);
-__decorateClass$3([field({
+__decorateClass$4([field({
 	type: "datetime",
 	indexed: true
 })], UsersMagicLinkToken.prototype, "expiresAt", 2);
-UsersMagicLinkToken = __decorateClass$3([smrt({
+UsersMagicLinkToken = __decorateClass$4([smrt({
 	tableName: "users_magic_link_tokens",
 	sensitive: true,
 	api: { include: [] },
@@ -103,10 +103,15 @@ var UsersMagicLinkTokenCollection = class extends SmrtCollection {
 var SESSIONS_RETENTION_TASK = "users-sessions";
 var MAGIC_LINK_RETENTION_TASK = "users-magic-link-tokens";
 var CLI_AUTH_RETENTION_TASK = "users-cli-auth-requests";
+var LOGIN_ATTEMPTS_RETENTION_TASK = "users-login-attempts";
+var LOGIN_AUDIT_RETENTION_TASK = "users-login-audit-events";
+var DEFAULT_LOGIN_AUDIT_RETENTION_DAYS = 90;
 var USER_RETENTION_TASKS = [
 	SESSIONS_RETENTION_TASK,
 	MAGIC_LINK_RETENTION_TASK,
-	CLI_AUTH_RETENTION_TASK
+	CLI_AUTH_RETENTION_TASK,
+	LOGIN_ATTEMPTS_RETENTION_TASK,
+	LOGIN_AUDIT_RETENTION_TASK
 ];
 function registerUserRetentionTasks() {
 	registerRetentionTask({
@@ -130,18 +135,32 @@ function registerUserRetentionTasks() {
 			return (await UsersCliAuthRequestCollection.create({ db })).deleteExpired({ dryRun: context.dryRun });
 		}
 	});
+	registerRetentionTask({
+		name: LOGIN_ATTEMPTS_RETENTION_TASK,
+		description: "Delete idle login-attempt limiter rows",
+		run: async (db, context) => {
+			return (await UsersLoginAttemptCollection.create({ db })).deleteIdle({ dryRun: context.dryRun });
+		}
+	});
+	registerRetentionTask({
+		name: LOGIN_AUDIT_RETENTION_TASK,
+		description: `Delete login audit events older than 90 days`,
+		run: async (db, context) => {
+			return (await UsersLoginAuditEventCollection.create({ db })).deleteOlderThan(2160 * 60 * 60 * 1e3, { dryRun: context.dryRun });
+		}
+	});
 }
 function unregisterUserRetentionTasks() {
 	for (const name of USER_RETENTION_TASKS) unregisterRetentionTask(name);
 }
 //#endregion
 //#region src/models/AccessRequest.ts
-var __defProp$2 = Object.defineProperty;
-var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
-var __decorateClass$2 = (decorators, target, key, kind) => {
-	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$2(target, key) : target;
+var __defProp$3 = Object.defineProperty;
+var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
+var __decorateClass$3 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$3(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-	if (kind && result) __defProp$2(target, key, result);
+	if (kind && result) __defProp$3(target, key, result);
 	return result;
 };
 var AccessRequest = class extends SmrtObject {
@@ -226,24 +245,24 @@ var AccessRequest = class extends SmrtObject {
 		return this.status === AccessRequestStatus.DECLINED || this.status === AccessRequestStatus.GRADUATED || this.status === AccessRequestStatus.CANCELED;
 	}
 };
-__decorateClass$2([field({
+__decorateClass$3([field({
 	required: true,
 	indexed: true
 })], AccessRequest.prototype, "email", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "name", 2);
-__decorateClass$2([field({
+__decorateClass$3([field({ nullable: true })], AccessRequest.prototype, "name", 2);
+__decorateClass$3([field({
 	type: "text",
 	indexed: true
 })], AccessRequest.prototype, "status", 2);
-__decorateClass$2([field({ indexed: true })], AccessRequest.prototype, "source", 2);
-__decorateClass$2([field()], AccessRequest.prototype, "requestContext", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "note", 2);
-__decorateClass$2([field()], AccessRequest.prototype, "requestedAt", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "decidedAt", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "decidedBy", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "resultingUserId", 2);
-__decorateClass$2([field({ nullable: true })], AccessRequest.prototype, "tenantHint", 2);
-AccessRequest = __decorateClass$2([smrt({
+__decorateClass$3([field({ indexed: true })], AccessRequest.prototype, "source", 2);
+__decorateClass$3([field()], AccessRequest.prototype, "requestContext", 2);
+__decorateClass$3([field({ nullable: true })], AccessRequest.prototype, "note", 2);
+__decorateClass$3([field()], AccessRequest.prototype, "requestedAt", 2);
+__decorateClass$3([field({ nullable: true })], AccessRequest.prototype, "decidedAt", 2);
+__decorateClass$3([field({ nullable: true })], AccessRequest.prototype, "decidedBy", 2);
+__decorateClass$3([field({ nullable: true })], AccessRequest.prototype, "resultingUserId", 2);
+__decorateClass$3([field({ nullable: true })], AccessRequest.prototype, "tenantHint", 2);
+AccessRequest = __decorateClass$3([smrt({
 	tableName: "access_requests",
 	conflictColumns: ["id"],
 	api: { include: [] },
@@ -296,6 +315,100 @@ var AccessRequestCollection = class extends SmrtCollection {
 	}
 };
 //#endregion
+//#region src/models/CliAuthApproveLimit.ts
+var __defProp$2 = Object.defineProperty;
+var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
+var __decorateClass$2 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$2(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$2(target, key, result);
+	return result;
+};
+var UsersCliAuthApproveLimit = class extends SmrtObject {
+	userId = "";
+	attemptCount = 0;
+	windowStartedAt = /* @__PURE__ */ new Date();
+};
+__decorateClass$2([foreignKey("User", {
+	required: true,
+	unique: true
+})], UsersCliAuthApproveLimit.prototype, "userId", 2);
+__decorateClass$2([field({
+	type: "integer",
+	required: true,
+	default: 0
+})], UsersCliAuthApproveLimit.prototype, "attemptCount", 2);
+__decorateClass$2([field({
+	type: "datetime",
+	required: true
+})], UsersCliAuthApproveLimit.prototype, "windowStartedAt", 2);
+UsersCliAuthApproveLimit = __decorateClass$2([smrt({
+	tableName: "users_cli_auth_approve_limits",
+	api: false,
+	cli: false,
+	mcp: false
+})], UsersCliAuthApproveLimit);
+//#endregion
+//#region src/collections/CliAuthApproveLimitCollection.ts
+var UsersCliAuthApproveLimitCollection = class extends SmrtCollection {
+	static _itemClass = UsersCliAuthApproveLimit;
+	/**
+	* Atomically reserve one attempt across every process using this database.
+	* Failed attempts retain their reservation; successful attempts release it.
+	*/
+	async reserveAttempt(input) {
+		const now = /* @__PURE__ */ new Date();
+		const nowIso = now.toISOString();
+		const windowFloorIso = new Date(now.getTime() - input.windowMs).toISOString();
+		const id = randomUUID();
+		const reserved = await this.db.query(`INSERT INTO ${this.tableName} (
+         id, slug, context, user_id, attempt_count, window_started_at,
+         created_at, updated_at
+       ) VALUES (?, ?, '', ?, 1, ?, ?, ?)
+       ON CONFLICT (user_id) DO UPDATE SET
+         attempt_count = CASE
+           WHEN ${this.tableName}.window_started_at <= ? THEN 1
+           ELSE ${this.tableName}.attempt_count + 1
+         END,
+         window_started_at = CASE
+           WHEN ${this.tableName}.window_started_at <= ?
+             THEN excluded.window_started_at
+           ELSE ${this.tableName}.window_started_at
+         END,
+         updated_at = excluded.updated_at
+       WHERE ${this.tableName}.window_started_at <= ?
+          OR ${this.tableName}.attempt_count < ?
+       RETURNING attempt_count, window_started_at`, id, `terminal-auth-${id}`, input.userId, nowIso, nowIso, nowIso, windowFloorIso, windowFloorIso, windowFloorIso, input.maxAttempts);
+		if (reserved.rows.length === 1) {
+			const reservedWindow = reserved.rows[0]?.window_started_at;
+			return {
+				allowed: true,
+				windowStartedAt: reservedWindow instanceof Date ? reservedWindow.toISOString() : new Date(String(reservedWindow)).toISOString()
+			};
+		}
+		const windowStartedAt = (await this.db.query(`SELECT window_started_at FROM ${this.tableName}
+        WHERE user_id = ? LIMIT 1`, input.userId)).rows[0]?.window_started_at;
+		const startedMs = windowStartedAt instanceof Date ? windowStartedAt.getTime() : new Date(String(windowStartedAt)).getTime();
+		const remainingMs = Number.isFinite(startedMs) ? startedMs + input.windowMs - now.getTime() : input.windowMs;
+		return {
+			allowed: false,
+			retryAfterSeconds: Math.max(1, Math.ceil(remainingMs / 1e3))
+		};
+	}
+	/** Release the reservation for an attempt that did not fail authentication. */
+	async releaseAttempt(userId, windowStartedAt) {
+		await this.db.query(`UPDATE ${this.tableName}
+          SET attempt_count = CASE
+                WHEN attempt_count > 0 THEN attempt_count - 1
+                ELSE 0
+              END,
+              updated_at = ?
+        WHERE user_id = ? AND window_started_at = ?`, (/* @__PURE__ */ new Date()).toISOString(), userId, windowStartedAt);
+		await this.db.query(`DELETE FROM ${this.tableName}
+        WHERE user_id = ? AND window_started_at = ? AND attempt_count = 0`, userId, windowStartedAt);
+	}
+};
+//#endregion
 //#region src/models/ResourceGrant.ts
 var __defProp$1 = Object.defineProperty;
 var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
@@ -1229,7 +1342,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-DoadwiqV.js").then((n) => n.O);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-BdB_0vDA.js").then((n) => n.E);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -1258,7 +1371,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-DoadwiqV.js").then((n) => n.O);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-BdB_0vDA.js").then((n) => n.E);
 		const key = await this.getSigningKey();
 		let payload;
 		try {
@@ -1856,6 +1969,6 @@ var TenantService = class TenantService {
 //#region src/index.ts
 registerUserRetentionTasks();
 //#endregion
-export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, LEGACY_USER_PROFILE_BACKFILL_NAME, LegacyUserProfileBackfillError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, Session, SessionCollection, SessionService, SessionStatus, Tenant, TenantCollection, TenantHierarchyError, TenantHierarchyMaterializationError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deduplicateRolePermissions, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, materializeTenantHierarchy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, planTenantHierarchy, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
+export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_DEVICE_PERSON_IDLE_SECONDS, DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, DEFAULT_LOGIN_AUDIT_RETENTION_DAYS, DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, DEFAULT_LOGIN_LOCKOUT_FACTOR, DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, DEFAULT_LOGIN_MAX_ATTEMPTS, DEFAULT_PIN_MANAGE_PERMISSION, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, DeviceCredentialError, DeviceCredentialForbiddenError, DeviceCredentialPolicyError, DeviceCredentialService, DurableLoginAuditSink, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, InvalidCredentialsError, LEGACY_USER_PROFILE_BACKFILL_NAME, LOGIN_ATTEMPTS_RETENTION_TASK, LOGIN_AUDIT_RETENTION_TASK, LegacyUserProfileBackfillError, LoginAttemptLimiter, LoginRateLimitError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, PIN_LOGIN_KIND, PIN_PERMISSION_DEFINITIONS, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, PinVerifier, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, SESSION_DATA_KEYS, Session, SessionCollection, SessionService, SessionStatus, TERMINAL_APPROVE_LOGIN_KIND, Tenant, TenantCollection, TenantHierarchyError, TenantHierarchyMaterializationError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, UsersLoginAttempt, UsersLoginAttemptCollection, UsersLoginAuditEvent, UsersLoginAuditEventCollection, UsersPinCredential, UsersPinCredentialCollection, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deduplicateRolePermissions, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, ensurePinPermissionsRegistered, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, materializeTenantHierarchy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, planTenantHierarchy, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
 
 //# sourceMappingURL=index.js.map