@happyvertical/smrt-users 0.54.0 → 0.54.3

package/dist/collections/PasswordCredentialCollection.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Collection for {@link UsersPasswordCredential} (#3274).
+ *
+ * @packageDocumentation
+ */
+import { SmrtCollection } from '@happyvertical/smrt-core';
+import { UsersPasswordCredential } from '../models/PasswordCredential.js';
+export interface PasswordCredentialWrite {
+    passwordHash: string;
+    mustChange: boolean;
+    rotatedAt: Date;
+    rotatedBy: string;
+}
+export declare class UsersPasswordCredentialCollection extends SmrtCollection<UsersPasswordCredential> {
+    static readonly _itemClass: typeof UsersPasswordCredential;
+    findByUserId(userId: string): Promise<UsersPasswordCredential | null>;
+    /**
+     * Insert the first credential row for `userId`. Returns null, writing
+     * nothing, when one already exists or a concurrent insert won (the unique
+     * `user_id` decides): a first password never replaces another.
+     */
+    insertIfAbsent(userId: string, write: PasswordCredentialWrite): Promise<UsersPasswordCredential | null>;
+    /**
+     * Create or replace the one credential row for `userId`, bumping `version`
+     * on replace — the administrative write, where the last writer wins.
+     * Losing a concurrent first insert is retried once as a replace.
+     */
+    upsertForUser(userId: string, write: PasswordCredentialWrite): Promise<UsersPasswordCredential>;
+    /**
+     * Replace the password only if the row is still exactly `expected` — the
+     * credential whose current password the person just proved. One guarded
+     * statement, so a reset (or any other write) that landed after the proof
+     * is never overwritten with a password chosen under the old one. Clears
+     * `mustChange` and bumps `version`. Returns false when the row had moved on.
+     */
+    replaceIfCurrent(expected: UsersPasswordCredential, write: Omit<PasswordCredentialWrite, 'mustChange'>): Promise<boolean>;
+    /**
+     * Delete the row only if it is still exactly `expected` (see
+     * {@link replaceIfCurrent}). Returns false when it had moved on.
+     */
+    deleteIfCurrent(expected: UsersPasswordCredential): Promise<boolean>;
+    /**
+     * Swap the stored hash for a stronger encoding of the SAME password — the
+     * parameter upgrade after a successful sign-in — only if the row still
+     * holds `expectedHash`. One guarded statement, so a reset or change that
+     * landed in between is never overwritten with the old password. Leaves
+     * `version`, `mustChange`, and `rotatedAt` alone: this is not a rotation.
+     * Returns false when the row had moved on.
+     */
+    replaceHashIfUnchanged(userId: string, expectedHash: string, upgradedHash: string): Promise<boolean>;
+    deleteByUserId(userId: string): Promise<boolean>;
+}
+//# sourceMappingURL=PasswordCredentialCollection.d.ts.map

package/dist/collections/PasswordCredentialCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordCredentialCollection.d.ts","sourceRoot":"","sources":["../../src/collections/PasswordCredentialCollection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,iCAAkC,SAAQ,cAAc,CAAC,uBAAuB,CAAC;IAC5F,MAAM,CAAC,QAAQ,CAAC,UAAU,iCAA2B;IAE/C,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAK3E;;;;OAIG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAkB1C;;;;OAIG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAwBnC;;;;;;OAMG;IACG,gBAAgB,CACpB,QAAQ,EAAE,uBAAuB,EACjC,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,YAAY,CAAC,GACjD,OAAO,CAAC,OAAO,CAAC;IAmBnB;;;OAGG;IACG,eAAe,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAU1E;;;;;;;OAOG;IACG,sBAAsB,CAC1B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAab,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAMvD"}

package/dist/collections/SessionCollection.d.ts

@@ -81,9 +81,14 @@ export declare class SessionCollection extends SmrtCollection<Session> {
      */
     deleteUserSessions(userId: string): Promise<number>;
     /**
-     * Revoke all sessions for a user (soft delete)
+     * Revoke all sessions for a user (soft delete), optionally sparing one —
+     * the session a person changes their password from (#3274). Ids come from
+     * the unbounded raw read, so caller list bounds can never leave a session
+     * of the user un-revoked.
      */
-    revokeUserSessions(userId: string): Promise<number>;
+    revokeUserSessions(userId: string, options?: {
+        exceptSessionId?: string;
+    }): Promise<number>;
     /**
      * Revoke a specific session
      */

package/dist/collections/SessionCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionCollection.d.ts","sourceRoot":"","sources":["../../src/collections/SessionCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAIL,OAAO,EACP,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAG9B;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,mFAAmF;IACnF,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACtC,0FAA0F;IAC1F,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,OAAO,CAAC;IAC5D,MAAM,CAAC,QAAQ,CAAC,UAAU,iBAAW;YAEvB,eAAe;IAyB7B;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBpE;;;OAGG;IACH;;;;OAIG;YACW,gBAAgB;IAexB,YAAY,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAgB/D;;;;;;OAMG;IACG,cAAc,CAClB,eAAe,EAAE,MAAM,EACvB,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO,GACzC,OAAO,CAAC,MAAM,CAAC;IAalB;;;OAGG;IACG,8BAA8B,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO,GACzC,OAAO,CAAC,MAAM,CAAC;IAalB;;;OAGG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IA8BlE;;OAEG;IACG,KAAK,CACT,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,OAAe,EAC1B,GAAG,GAAE,MAA4B,GAChC,OAAO,CAAC,OAAO,CAAC;IAOnB;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAapD;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAczD;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBzD;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxD;;;;;;;;;OASG;IACG,aAAa,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IA8BxE;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKxD;;;;;;;;OAQG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,OAAO,CAAC;IASnB;;OAEG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,OAAO,CAAC;IASnB;;OAEG;IACG,cAAc,CAAC,CAAC,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CAM1B"}
+{"version":3,"file":"SessionCollection.d.ts","sourceRoot":"","sources":["../../src/collections/SessionCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAIL,OAAO,EACP,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAG9B;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,mFAAmF;IACnF,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACtC,0FAA0F;IAC1F,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,OAAO,CAAC;IAC5D,MAAM,CAAC,QAAQ,CAAC,UAAU,iBAAW;YAEvB,eAAe;IAyB7B;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBpE;;;OAGG;IACH;;;;OAIG;YACW,gBAAgB;IAexB,YAAY,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAgB/D;;;;;;OAMG;IACG,cAAc,CAClB,eAAe,EAAE,MAAM,EACvB,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO,GACzC,OAAO,CAAC,MAAM,CAAC;IAalB;;;OAGG;IACG,8BAA8B,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO,GACzC,OAAO,CAAC,MAAM,CAAC;IAalB;;;OAGG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IA8BlE;;OAEG;IACG,KAAK,CACT,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,OAAe,EAC1B,GAAG,GAAE,MAA4B,GAChC,OAAO,CAAC,OAAO,CAAC;IAOnB;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAapD;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAczD;;;;;OAKG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAO,GACzC,OAAO,CAAC,MAAM,CAAC;IAUlB;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxD;;;;;;;;;OASG;IACG,aAAa,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IA8BxE;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKxD;;;;;;;;OAQG;IACG,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,OAAO,CAAC;IASnB;;OAEG;IACG,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,OAAO,CAAC;IASnB;;OAEG;IACG,cAAc,CAAC,CAAC,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CAM1B"}

package/dist/collections/index.d.ts

@@ -13,6 +13,7 @@ export { UsersLoginAuditEventCollection } from './LoginAuditEventCollection.js';
 export { MagicLinkTokenCollection, UsersMagicLinkTokenCollection, } from './MagicLinkTokenCollection.js';
 export { MembershipCollection } from './MembershipCollection.js';
 export { MembershipOverrideCollection } from './MembershipOverrideCollection.js';
+export { type PasswordCredentialWrite, UsersPasswordCredentialCollection, } from './PasswordCredentialCollection.js';
 export { PermissionCollection } from './PermissionCollection.js';
 export { type PinCredentialWrite, UsersPinCredentialCollection, } from './PinCredentialCollection.js';
 export { ResourceGrantCollection } from './ResourceGrantCollection.js';

package/dist/collections/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collections/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EACL,KAAK,yBAAyB,EAC9B,kCAAkC,GACnC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAEhF,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EACL,KAAK,kBAAkB,EACvB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EACL,cAAc,EACd,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,oBAAoB,EACzB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,kCAAkC,EAClC,KAAK,8BAA8B,GACpC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,cAAc,GACf,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collections/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EACL,KAAK,yBAAyB,EAC9B,kCAAkC,GACnC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAEhF,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAEjF,OAAO,EACL,KAAK,uBAAuB,EAC5B,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EACL,KAAK,kBAAkB,EACvB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EACL,cAAc,EACd,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,GAC/B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,KAAK,oBAAoB,EACzB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,kCAAkC,EAClC,KAAK,8BAA8B,GACpC,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,cAAc,GACf,MAAM,qBAAqB,CAAC"}

package/dist/index.d.ts

@@ -54,14 +54,14 @@
  * @packageDocumentation
  */
 import './__smrt-register__.js';
-export { AccessRequestCollection, type CliAuthApproveReservation, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileOwnerAuthorization, type OidcProfileOwnerAuthorizer, type OidcProfileOwnerAuthorizerContext, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, PermissionCollection, ResourceGrantCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantIntegrationCollection, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthApproveLimitCollection, UsersCliAuthRequestCollection, UsersLoginAttemptCollection, UsersLoginAuditEventCollection, UsersMagicLinkTokenCollection, UsersPinCredentialCollection, } from './collections/index.js';
+export { AccessRequestCollection, type CliAuthApproveReservation, CliAuthRequestCollection, type CreateChildTenantOptions, type CreateSessionOptions, DEFAULT_ROLE_PERMISSION_PATTERNS, type GetOrCreateFromOidcOptions, GroupCollection, GroupMemberCollection, GroupRoleCollection, MagicLinkTokenCollection, MembershipCollection, MembershipOverrideCollection, type NormalizedOidcClaims, type OidcClaims, type OidcIdentityResult, type OidcProfileOwnerAuthorization, type OidcProfileOwnerAuthorizer, type OidcProfileOwnerAuthorizerContext, type OidcProfileResolver, type OidcProfileResolverContext, OidcProvisioningError, type OidcProvisioningErrorCode, type PasswordCredentialWrite, PermissionCollection, ResourceGrantCollection, RoleCollection, RolePermissionCollection, type RolePermissionPatternMatrix, type SeedRolePermissionsOptions, type SeedRolePermissionsResult, type SeedSystemRolesOptions, SessionCollection, TenantCollection, TenantHierarchyError, TenantIntegrationCollection, TenantPermissionOverrideCollection, type TenantPermissionOverrideResult, UserCollection, UsersCliAuthApproveLimitCollection, UsersCliAuthRequestCollection, UsersLoginAttemptCollection, UsersLoginAuditEventCollection, UsersMagicLinkTokenCollection, UsersPasswordCredentialCollection, UsersPinCredentialCollection, } from './collections/index.js';
 export { type BackfillLegacyUserProfilesResult, backfillLegacyUserProfiles, LEGACY_USER_PROFILE_BACKFILL_NAME, LegacyUserProfileBackfillError, type LegacyUserProfileBackfillErrorCode, } from './migrations/backfillLegacyUserProfiles.js';
 export { type BackfillUserEmailKeysResult, backfillUserEmailKeys, type DuplicateUserEmailKey, UserEmailKeyBackfillError, type UserEmailKeyBackfillErrorCode, } from './migrations/backfillUserEmailKeys.js';
 export { type DeduplicateRolePermissionsOptions, type DeduplicateRolePermissionsResult, deduplicateRolePermissions, } from './migrations/deduplicateRolePermissions.js';
 export { type MaterializeTenantHierarchyOptions, type MaterializeTenantHierarchyResult, materializeTenantHierarchy, TenantHierarchyMaterializationError, } from './migrations/materializeTenantHierarchy.js';
-export { AccessRequest, type AccessRequestOptions, CliAuthRequest, type CliAuthRequestStatus, DEFAULT_SESSION_TTL, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupMember, GroupRole, generateSessionId, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkToken, Membership, MembershipOverride, Permission, ResourceGrant, type ResourceGrantEffect, type ResourceGrantOptions, Role, RolePermission, SESSION_DATA_KEYS, Session, type SessionAuthMethod, Tenant, TenantIntegration, type TenantIntegrationCheckSummary, type TenantIntegrationOptions, type TenantIntegrationProvider, type TenantIntegrationStatus, TenantPermissionOverride, User, UsersCliAuthApproveLimit, UsersCliAuthRequest, UsersLoginAttempt, UsersLoginAuditEvent, UsersMagicLinkToken, UsersPinCredential, } from './models/index.js';
+export { AccessRequest, type AccessRequestOptions, CliAuthRequest, type CliAuthRequestStatus, DEFAULT_SESSION_TTL, DEFAULT_TOKEN_EXPIRY_SECONDS, Group, GroupMember, GroupRole, generateSessionId, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkToken, Membership, MembershipOverride, Permission, ResourceGrant, type ResourceGrantEffect, type ResourceGrantOptions, Role, RolePermission, SESSION_DATA_KEYS, Session, type SessionAuthMethod, Tenant, TenantIntegration, type TenantIntegrationCheckSummary, type TenantIntegrationOptions, type TenantIntegrationProvider, type TenantIntegrationStatus, TenantPermissionOverride, User, UsersCliAuthApproveLimit, UsersCliAuthRequest, UsersLoginAttempt, UsersLoginAuditEvent, UsersMagicLinkToken, UsersPasswordCredential, UsersPinCredential, } from './models/index.js';
 export { planTenantHierarchy, type TenantHierarchyChange, type TenantHierarchyErrorCode, type TenantHierarchyPlan, type TenantHierarchyProblem, type TenantHierarchyRow, } from './models/tenant-hierarchy.js';
 export { CLI_AUTH_RETENTION_TASK, DEFAULT_LOGIN_AUDIT_RETENTION_DAYS, LOGIN_ATTEMPTS_RETENTION_TASK, LOGIN_AUDIT_RETENTION_TASK, MAGIC_LINK_RETENTION_TASK, registerUserRetentionTasks, SESSIONS_RETENTION_TASK, USER_RETENTION_TASKS, unregisterUserRetentionTasks, } from './retention.js';
-export { ACCESS_REQUEST_CAPABILITIES, type AccessRequestAuthorizationContext, type AccessRequestAuthorizer, type AccessRequestCapability, AccessRequestError, type AccessRequestErrorCode, type AccessRequestEvent, type AccessRequestEventHandler, type AccessRequestEventType, AccessRequestService, type AccessRequestServiceOptions, ANCESTOR_READ_ACTION, type AncestorReadPackageConfig, type AncestorReadPolicy, type ApproveAccessRequestOptions, type ApproveCliAuthRequestInput, applyPostgresPermissionPolicies, assertOperationPermission, type CancelAccessRequestOptions, type ClearPinInput, type CliAuthStartResult, type CliAuthTokenResult, type CreateAccessRequestInput, type CreateAuthorizationUrlOptions, type CreateResourceGrantOptions, checkOperationPermission, checkResourceOperationPermission, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_DEVICE_PERSON_IDLE_SECONDS, DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, DEFAULT_LOGIN_LOCKOUT_FACTOR, DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, DEFAULT_LOGIN_MAX_ATTEMPTS, DEFAULT_PIN_MANAGE_PERMISSION, type DeclineAccessRequestOptions, DeviceCredentialError, DeviceCredentialForbiddenError, DeviceCredentialPolicyError, DeviceCredentialService, type DeviceCredentialServiceOptions, type DeviceCredentialVerification, type DeviceCredentialVerifier, type DeviceSignInContext, type DeviceSignInInput, type DeviceSignInResult, DurableLoginAuditSink, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, type EnsureTenantResult, encodeOidcTransaction, ensurePinPermissionsRegistered, type GeneratePostgresPermissionSqlResult, type GraduateAccessRequestOptions, type GraduateAccessRequestResult, type GraduateExistingTenantOption, type GraduateNewTenantOption, type GraduateTenantOption, generatePostgresPermissionSql, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, InvalidCredentialsError, isAncestorReadableSlug, type ListAccessRequestsFilter, type LoginAttemptDecision, type LoginAttemptDenied, type LoginAttemptLease, LoginAttemptLimiter, type LoginAttemptLimiterOptions, type LoginAuditEntry, type LoginAuditSink, type LoginFailureOutcome, type LoginLockoutOptions, LoginRateLimitError, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MagicLinkError, type MagicLinkResult, MagicLinkService, type MagicLinkServiceOptions, type MagicLinkVerifyResult, MobileAuthError, type MobileAuthErrorCode, MobileAuthService, type MobileAuthServiceOptions, type MobileBootstrapContext, type MobileLoginContext, type MobileLogoutResult, type MobileRequestMeta, type MobileResolvedUser, type MobileTenantContext, type NormalizedAncestorReadPolicy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, type OidcCallbackResult, OidcLoginError, type OidcLoginResult, OidcLoginService, type OidcLoginServiceOptions, type OidcProviderConfig, type OidcProviderKind, type OidcProviderMetadata, type OidcProviderResolution, type OidcProviderResolutionOptions, type OidcTokenEndpointAuthMethod, type OidcTokenSet, type OidcTransaction, type OperationPermissionAllowReason, type OperationPermissionCollectionInput, type OperationPermissionDecision, type OperationPermissionDenyReason, OperationPermissionError, type OperationPermissionOptions, type PermissionCatalog, PermissionCatalogService, type PermissionCatalogSource, type PermissionCatalogSyncResult, type PermissionDefinition, type PermissionResolutionOptions, type PermissionResolutionResult, PermissionResolver, type PermissionResolverOptions, PIN_LOGIN_KIND, PIN_PERMISSION_DEFINITIONS, type PinPolicyOptions, type PinSignInInput, PinVerifier, type PostgresPermissionAction, type PostgresPermissionBinding, type PostgresPermissionPolicyReportItem, type PostgresPermissionPolicyTarget, type PrincipalPermissionRuntimeOptions, type ReserveLoginAttemptOptions, type ResetPinInput, type ResolvedOidcProviderConfig, type ResourceGrantDecision, ResourceGrantService, type ResourceIdentity, type ResourceIdentityVerifier, type ResourceOperationPermissionOptions, type RevokeResourceGrantOptions, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, type SessionContext, type SessionParentContext, type SessionPermissionRuntimeContext, type SessionPermissionRuntimeOptions, SessionService, type SessionServiceOptions, type SetPinInput, type SwitchTenantResult, syncPermissionCatalog, TERMINAL_APPROVE_LOGIN_KIND, type TenantPermissionInheritanceResult, TenantService, type TenantWithOwnershipResult, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, type TerminalAuthServiceOptions, type UsersConfig, type UsersOidcConfig, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext, } from './services/index.js';
+export { ACCESS_REQUEST_CAPABILITIES, type AccessRequestAuthorizationContext, type AccessRequestAuthorizer, type AccessRequestCapability, AccessRequestError, type AccessRequestErrorCode, type AccessRequestEvent, type AccessRequestEventHandler, type AccessRequestEventType, AccessRequestService, type AccessRequestServiceOptions, ANCESTOR_READ_ACTION, type AncestorReadPackageConfig, type AncestorReadPolicy, type ApproveAccessRequestOptions, type ApproveCliAuthRequestInput, applyPostgresPermissionPolicies, assertOperationPermission, type CancelAccessRequestOptions, type ChangePasswordInput, type ClearPasswordInput, type ClearPinInput, type CliAuthStartResult, type CliAuthTokenResult, type CreateAccessRequestInput, type CreateAuthorizationUrlOptions, type CreateResourceGrantOptions, checkOperationPermission, checkResourceOperationPermission, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_DEVICE_PERSON_IDLE_SECONDS, DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, DEFAULT_LOGIN_LOCKOUT_FACTOR, DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, DEFAULT_LOGIN_MAX_ATTEMPTS, DEFAULT_PASSWORD_DENYLIST, DEFAULT_PASSWORD_MANAGE_PERMISSION, DEFAULT_PASSWORD_MAX_LENGTH, DEFAULT_PASSWORD_MIN_LENGTH, DEFAULT_PIN_MANAGE_PERMISSION, type DeclineAccessRequestOptions, DeviceCredentialError, DeviceCredentialForbiddenError, DeviceCredentialPolicyError, DeviceCredentialService, type DeviceCredentialServiceOptions, type DeviceCredentialVerification, type DeviceCredentialVerifier, type DeviceSignInContext, type DeviceSignInInput, type DeviceSignInResult, DurableLoginAuditSink, decodeOidcTransaction, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, type EnsureTenantResult, encodeOidcTransaction, ensurePasswordPermissionsRegistered, ensurePinPermissionsRegistered, type GeneratePostgresPermissionSqlResult, type GraduateAccessRequestOptions, type GraduateAccessRequestResult, type GraduateExistingTenantOption, type GraduateNewTenantOption, type GraduateTenantOption, generatePostgresPermissionSql, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, InvalidCredentialsError, isAncestorReadableSlug, type ListAccessRequestsFilter, type LoginAttemptDecision, type LoginAttemptDenied, type LoginAttemptLease, LoginAttemptLimiter, type LoginAttemptLimiterOptions, type LoginAuditEntry, type LoginAuditSink, type LoginFailureOutcome, type LoginLockoutOptions, LoginRateLimitError, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MagicLinkError, type MagicLinkResult, MagicLinkService, type MagicLinkServiceOptions, type MagicLinkVerifyResult, MobileAuthError, type MobileAuthErrorCode, MobileAuthService, type MobileAuthServiceOptions, type MobileBootstrapContext, type MobileLoginContext, type MobileLogoutResult, type MobileRequestMeta, type MobileResolvedUser, type MobileTenantContext, type NormalizedAncestorReadPolicy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, type OidcCallbackResult, OidcLoginError, type OidcLoginResult, OidcLoginService, type OidcLoginServiceOptions, type OidcProviderConfig, type OidcProviderKind, type OidcProviderMetadata, type OidcProviderResolution, type OidcProviderResolutionOptions, type OidcTokenEndpointAuthMethod, type OidcTokenSet, type OidcTransaction, type OperationPermissionAllowReason, type OperationPermissionCollectionInput, type OperationPermissionDecision, type OperationPermissionDenyReason, OperationPermissionError, type OperationPermissionOptions, PASSWORD_LOGIN_KIND, PASSWORD_MAX_LENGTH_CEILING, PASSWORD_PERMISSION_DEFINITIONS, PasswordCredentialError, PasswordCredentialForbiddenError, PasswordCredentialService, type PasswordCredentialServiceOptions, type PasswordPolicyContext, PasswordPolicyError, type PasswordPolicyOptions, type PasswordSignInInput, type PasswordSignInResult, type PermissionCatalog, PermissionCatalogService, type PermissionCatalogSource, type PermissionCatalogSyncResult, type PermissionDefinition, type PermissionResolutionOptions, type PermissionResolutionResult, PermissionResolver, type PermissionResolverOptions, PIN_LOGIN_KIND, PIN_PERMISSION_DEFINITIONS, type PinPolicyOptions, type PinSignInInput, PinVerifier, type PostgresPermissionAction, type PostgresPermissionBinding, type PostgresPermissionPolicyReportItem, type PostgresPermissionPolicyTarget, type PrincipalPermissionRuntimeOptions, type ReserveLoginAttemptOptions, type ResetPasswordInput, type ResetPinInput, type ResolvedOidcProviderConfig, type ResourceGrantDecision, ResourceGrantService, type ResourceIdentity, type ResourceIdentityVerifier, type ResourceOperationPermissionOptions, type RevokeResourceGrantOptions, readMobileBearerToken, registerPermissionDefinitions, resolveOidcProviderConfig, type SessionContext, type SessionParentContext, type SessionPermissionRuntimeContext, type SessionPermissionRuntimeOptions, SessionService, type SessionServiceOptions, type SetPasswordInput, type SetPinInput, type SwitchTenantResult, syncPermissionCatalog, TERMINAL_APPROVE_LOGIN_KIND, type TenantPermissionInheritanceResult, TenantService, type TenantWithOwnershipResult, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, type TerminalAuthServiceOptions, type UsersConfig, type UsersOidcConfig, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext, } from './services/index.js';
 export { AccessRequestStatus, DEFAULT_ROLE_SLUGS, DEFAULT_ROLES, DEFAULT_TENANT_POLICY, type DefaultRoleSlug, MembershipStatus, OverrideEffect, SessionStatus, TenantPermissionEffect, type TenantPolicy, type TenantPolicyMode, TenantStatus, UserStatus, } from './types/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAWhC,OAAO,EACL,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,KAAK,kCAAkC,GACxC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,KAAK,iCAAiC,EACtC,KAAK,gCAAgC,EACrC,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,iCAAiC,EACtC,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,IAAI,EACJ,cAAc,EACd,iBAAiB,EACjB,OAAO,EACP,KAAK,iBAAiB,EACtB,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,wBAAwB,EACxB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,6BAA6B,EAC7B,0BAA0B,EAC1B,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,kCAAkC,EAClC,oCAAoC,EACpC,kCAAkC,EAClC,4BAA4B,EAC5B,iCAAiC,EACjC,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,8BAA8B,EAC9B,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,mCAAmC,EACnC,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,cAAc,EACd,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,WAAW,EACX,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,KAAK,aAAa,EAClB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,wBAAwB,CAAC;AAWhC,OAAO,EACL,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,8BAA8B,EACnC,cAAc,EACd,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,6BAA6B,EAC7B,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,KAAK,kCAAkC,GACxC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,yBAAyB,EACzB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,KAAK,iCAAiC,EACtC,KAAK,gCAAgC,EACrC,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,iCAAiC,EACtC,KAAK,gCAAgC,EACrC,0BAA0B,EAC1B,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,EACzB,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,KAAK,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,IAAI,EACJ,cAAc,EACd,iBAAiB,EACjB,OAAO,EACP,KAAK,iBAAiB,EACtB,MAAM,EACN,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,wBAAwB,EACxB,IAAI,EACJ,wBAAwB,EACxB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,uBAAuB,EACvB,kCAAkC,EAClC,6BAA6B,EAC7B,0BAA0B,EAC1B,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,sCAAsC,EACtC,oCAAoC,EACpC,+BAA+B,EAC/B,kCAAkC,EAClC,oCAAoC,EACpC,kCAAkC,EAClC,4BAA4B,EAC5B,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EACzB,kCAAkC,EAClC,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,8BAA8B,EAC9B,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,uCAAuC,EACvC,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,mCAAmC,EACnC,8BAA8B,EAC9B,KAAK,mCAAmC,EACxC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,6BAA6B,EAC7B,+BAA+B,EAC/B,kCAAkC,EAClC,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,mCAAmC,EACnC,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,eAAe,EACpB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,mBAAmB,EACnB,2BAA2B,EAC3B,+BAA+B,EAC/B,uBAAuB,EACvB,gCAAgC,EAChC,yBAAyB,EACzB,KAAK,gCAAgC,EACrC,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,cAAc,EACd,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,WAAW,EACX,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kCAAkC,EACvC,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,kCAAkC,EACvC,KAAK,0BAA0B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,+BAA+B,EACpC,KAAK,+BAA+B,EACpC,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,2BAA2B,EAC3B,KAAK,iCAAiC,EACtC,aAAa,EACb,KAAK,yBAAyB,EAC9B,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,KAAK,eAAe,EACpB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,YAAY,EACZ,UAAU,GACX,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as normalizeAncestorReadPolicy, $t as UsersCliAuthRequest, A as DeviceCredentialForbiddenError, At as MembershipOverrideCollection, B as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Bt as User, C as encodeOidcTransaction, Ct as RolePermission, D as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, Dt as UsersPinCredential, Et as UsersPinCredentialCollection, F as PinVerifier, Ft as GroupRole, G as InvalidCredentialsError, Gt as UsersLoginAttemptCollection, H as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, Ht as normalizeEmail, I as ensurePinPermissionsRegistered, It as GroupMemberCollection, J as withoutListBounds, Jt as SessionCollection, K as LoginAttemptLimiter, Kt as UsersLoginAttempt, L as SessionService, Lt as GroupMember, M as DeviceCredentialService, Mt as MembershipCollection, N as PIN_LOGIN_KIND, Nt as Membership, O as DEFAULT_PIN_MANAGE_PERMISSION, Ot as PermissionCollection, P as PIN_PERMISSION_DEFINITIONS, Pt as GroupRoleCollection, Q as isAncestorReadableSlug, Qt as generateSessionId, R as PermissionResolver, Rt as GroupCollection, S as decodeOidcTransaction, St as syncPermissionCatalog, T as resolveOidcProviderConfig, Tt as Role, U as DEFAULT_LOGIN_MAX_ATTEMPTS, Ut as UsersLoginAuditEventCollection, V as DEFAULT_LOGIN_LOCKOUT_FACTOR, Vt as isValidEmail, W as DurableLoginAuditSink, Wt as UsersLoginAuditEvent, X as DEFAULT_ANCESTOR_READ_MAX_DEPTH, Xt as SESSION_DATA_KEYS, Y as ANCESTOR_READ_ACTION, Yt as DEFAULT_SESSION_TTL, Z as getConfiguredAncestorReadPolicy, Zt as Session, _ as MobileAuthService, _t as PermissionCatalogService, a as TerminalAuthError, at as TenantPermissionOverrideCollection, b as OidcLoginError, bt as normalizeOperationPermissionAction, c as OperationPermissionError, ct as Tenant, d as hasOperationPermission, dt as applyTenantHierarchyUpdates, et as OidcProvisioningError, f as getCurrentSessionPermissionContext, ft as assertTenantTableName, g as MobileAuthError, gt as RolePermissionCollection, h as withSessionPermissionContext, ht as DEFAULT_ROLE_PERMISSION_PATTERNS, i as TERMINAL_APPROVE_LOGIN_KIND, it as backfillUserEmailKeys, j as DeviceCredentialPolicyError, jt as MembershipOverride, k as DeviceCredentialError, kt as Permission, l as assertOperationPermission, lt as MAX_TENANT_HIERARCHY_DEPTH, m as withPrincipalPermissionContext, mt as recordTenantHierarchyChanges, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, o as TerminalAuthRateLimitError, ot as TenantPermissionOverride, p as getRequestScopedDatabase, pt as planTenantHierarchy, q as LoginRateLimitError, qt as UsersCliAuthRequestCollection, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as UserEmailKeyBackfillError, s as TerminalAuthService, st as TenantCollection, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as UserCollection, u as checkOperationPermission, ut as TenantHierarchyError, v as readMobileBearerToken, vt as deriveOperationPermissionCollectionName, w as getUsersOidcConfig, wt as RoleCollection, x as OidcLoginService, xt as registerPermissionDefinitions, y as validateMobileRedirectUri, yt as deriveOperationPermissionSlug, z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, zt as Group } from "./chunks/TerminalAuthService-BfxG493c.js";
+import { $ as DEFAULT_LOGIN_LOCKOUT_FACTOR, $t as Group, A as readMobileBearerToken, At as deriveOperationPermissionCollectionName, B as DEFAULT_PIN_MANAGE_PERMISSION, Bt as PermissionCollection, C as hasOperationPermission, Ct as applyTenantHierarchyUpdates, D as withSessionPermissionContext, Dt as DEFAULT_ROLE_PERMISSION_PATTERNS, E as withPrincipalPermissionContext, Et as recordTenantHierarchyChanges, F as encodeOidcTransaction, Ft as RolePermission, G as PIN_LOGIN_KIND, Gt as MembershipOverride, H as DeviceCredentialForbiddenError, Ht as UsersPasswordCredentialCollection, I as getUsersOidcConfig, It as RoleCollection, J as ensurePinPermissionsRegistered, Jt as GroupRoleCollection, K as PIN_PERMISSION_DEFINITIONS, Kt as MembershipCollection, L as resolveOidcProviderConfig, Lt as Role, M as OidcLoginError, Mt as normalizeOperationPermissionAction, N as OidcLoginService, Nt as registerPermissionDefinitions, O as MobileAuthError, Ot as RolePermissionCollection, P as decodeOidcTransaction, Pt as syncPermissionCatalog, Q as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Qt as GroupCollection, Rt as UsersPinCredentialCollection, S as checkOperationPermission, St as TenantHierarchyError, T as getRequestScopedDatabase, Tt as planTenantHierarchy, U as DeviceCredentialPolicyError, Ut as UsersPasswordCredential, V as DeviceCredentialError, Vt as Permission, W as DeviceCredentialService, Wt as MembershipOverrideCollection, X as PermissionResolver, Xt as GroupMemberCollection, Y as SessionService, Yt as GroupRole, Z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, Zt as GroupMember, _ as PasswordCredentialService, _t as TenantPermissionOverrideCollection, a as TerminalAuthError, an as UsersLoginAttemptCollection, at as LoginRateLimitError, b as OperationPermissionError, bt as Tenant, c as DEFAULT_PASSWORD_DENYLIST, cn as SessionCollection, ct as DEFAULT_ANCESTOR_READ_MAX_DEPTH, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as Session, dt as normalizeAncestorReadPolicy, en as User, et as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, f as PASSWORD_LOGIN_KIND, fn as generateSessionId, ft as OidcProvisioningError, g as PasswordCredentialForbiddenError, gt as backfillUserEmailKeys, h as PasswordCredentialError, ht as UserEmailKeyBackfillError, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAuditEvent, it as LoginAttemptLimiter, j as validateMobileRedirectUri, jt as deriveOperationPermissionSlug, k as MobileAuthService, kt as PermissionCatalogService, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as DEFAULT_SESSION_TTL, lt as getConfiguredAncestorReadPolicy, m as PASSWORD_PERMISSION_DEFINITIONS, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as normalizeEmail, nt as DurableLoginAuditSink, o as TerminalAuthRateLimitError, on as UsersLoginAttempt, ot as withoutListBounds, p as PASSWORD_MAX_LENGTH_CEILING, pn as UsersCliAuthRequest, pt as UserCollection, q as PinVerifier, qt as Membership, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAuditEventCollection, rt as InvalidCredentialsError, s as TerminalAuthService, sn as UsersCliAuthRequestCollection, st as ANCESTOR_READ_ACTION, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as isValidEmail, tt as DEFAULT_LOGIN_MAX_ATTEMPTS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as SESSION_DATA_KEYS, ut as isAncestorReadableSlug, v as PasswordPolicyError, vt as TenantPermissionOverride, w as getCurrentSessionPermissionContext, wt as assertTenantTableName, x as assertOperationPermission, xt as MAX_TENANT_HIERARCHY_DEPTH, y as ensurePasswordPermissionsRegistered, yt as TenantCollection, z as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, zt as UsersPinCredential } from "./chunks/TerminalAuthService-Bc67JXJ5.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, bumpChangeFeed, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
 import { createHash, randomUUID } from "node:crypto";
@@ -9,12 +9,19 @@ import { BackfillTracker } from "@happyvertical/smrt-core/migrations";
 //#region src/models/MagicLinkToken.ts
 var __defProp$4 = Object.defineProperty;
 var __getOwnPropDesc$4 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$4 = (obj, key, value) => key in obj ? __defProp$4(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
 var __decorateClass$4 = (decorators, target, key, kind) => {
 	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$4(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
 	if (kind && result) __defProp$4(target, key, result);
 	return result;
 };
+var __publicField$4 = (obj, key, value) => __defNormalProp$4(obj, typeof key !== "symbol" ? key + "" : key, value);
 var DEFAULT_TOKEN_EXPIRY_SECONDS = 600;
 var UsersMagicLinkToken = class extends SmrtObject {
 	nonce = "";
@@ -39,6 +46,7 @@ var UsersMagicLinkToken = class extends SmrtObject {
 		return !this.used && !this.isExpired();
 	}
 };
+__publicField$4(UsersMagicLinkToken, "__smrtPackage__", "@happyvertical/smrt-users");
 __decorateClass$4([field({
 	required: true,
 	unique: true
@@ -157,12 +165,19 @@ function unregisterUserRetentionTasks() {
 //#region src/models/AccessRequest.ts
 var __defProp$3 = Object.defineProperty;
 var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
 var __decorateClass$3 = (decorators, target, key, kind) => {
 	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$3(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
 	if (kind && result) __defProp$3(target, key, result);
 	return result;
 };
+var __publicField$3 = (obj, key, value) => __defNormalProp$3(obj, typeof key !== "symbol" ? key + "" : key, value);
 var AccessRequest = class extends SmrtObject {
 	email = "";
 	name = null;
@@ -245,6 +260,7 @@ var AccessRequest = class extends SmrtObject {
 		return this.status === AccessRequestStatus.DECLINED || this.status === AccessRequestStatus.GRADUATED || this.status === AccessRequestStatus.CANCELED;
 	}
 };
+__publicField$3(AccessRequest, "__smrtPackage__", "@happyvertical/smrt-users");
 __decorateClass$3([field({
 	required: true,
 	indexed: true
@@ -318,17 +334,25 @@ var AccessRequestCollection = class extends SmrtCollection {
 //#region src/models/CliAuthApproveLimit.ts
 var __defProp$2 = Object.defineProperty;
 var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$2 = (obj, key, value) => key in obj ? __defProp$2(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
 var __decorateClass$2 = (decorators, target, key, kind) => {
 	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$2(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
 	if (kind && result) __defProp$2(target, key, result);
 	return result;
 };
+var __publicField$2 = (obj, key, value) => __defNormalProp$2(obj, typeof key !== "symbol" ? key + "" : key, value);
 var UsersCliAuthApproveLimit = class extends SmrtObject {
 	userId = "";
 	attemptCount = 0;
 	windowStartedAt = /* @__PURE__ */ new Date();
 };
+__publicField$2(UsersCliAuthApproveLimit, "__smrtPackage__", "@happyvertical/smrt-users");
 __decorateClass$2([foreignKey("User", {
 	required: true,
 	unique: true
@@ -412,12 +436,19 @@ var UsersCliAuthApproveLimitCollection = class extends SmrtCollection {
 //#region src/models/ResourceGrant.ts
 var __defProp$1 = Object.defineProperty;
 var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
 var __decorateClass$1 = (decorators, target, key, kind) => {
 	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
 	if (kind && result) __defProp$1(target, key, result);
 	return result;
 };
+var __publicField$1 = (obj, key, value) => __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
 var ResourceGrant = class extends SmrtObject {
 	tenantId;
 	userId;
@@ -444,6 +475,7 @@ var ResourceGrant = class extends SmrtObject {
 		return !this.revokedAt;
 	}
 };
+__publicField$1(ResourceGrant, "__smrtPackage__", "@happyvertical/smrt-users");
 __decorateClass$1([foreignKey("Tenant", { required: true })], ResourceGrant.prototype, "tenantId", 2);
 __decorateClass$1([foreignKey("User", { required: true })], ResourceGrant.prototype, "userId", 2);
 __decorateClass$1([field({ type: "text" })], ResourceGrant.prototype, "resourceType", 2);
@@ -483,12 +515,19 @@ var ResourceGrantCollection = class extends SmrtCollection {
 //#region src/models/TenantIntegration.ts
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
 var __decorateClass = (decorators, target, key, kind) => {
 	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
 	if (kind && result) __defProp(target, key, result);
 	return result;
 };
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 function parseExternalIds(raw) {
 	if (!raw) return {};
 	if (typeof raw === "object" && !Array.isArray(raw)) return Object.fromEntries(Object.entries(raw).filter(([, value]) => typeof value === "string"));
@@ -605,6 +644,7 @@ var TenantIntegration = class extends SmrtObject {
 		this.lastError = outcome.error ?? null;
 	}
 };
+__publicField(TenantIntegration, "__smrtPackage__", "@happyvertical/smrt-users");
 __decorateClass([tenantId()], TenantIntegration.prototype, "tenantId", 2);
 TenantIntegration = __decorateClass([TenantScoped({ mode: "required" }), smrt({
 	tableName: "tenant_integrations",
@@ -1342,7 +1382,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-BfxG493c.js").then((n) => n.E);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-Bc67JXJ5.js").then((n) => n.R);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -1371,7 +1411,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-BfxG493c.js").then((n) => n.E);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-Bc67JXJ5.js").then((n) => n.R);
 		const key = await this.getSigningKey();
 		let payload;
 		try {
@@ -1969,6 +2009,6 @@ var TenantService = class TenantService {
 //#region src/index.ts
 registerUserRetentionTasks();
 //#endregion
-export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_DEVICE_PERSON_IDLE_SECONDS, DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, DEFAULT_LOGIN_AUDIT_RETENTION_DAYS, DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, DEFAULT_LOGIN_LOCKOUT_FACTOR, DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, DEFAULT_LOGIN_MAX_ATTEMPTS, DEFAULT_PIN_MANAGE_PERMISSION, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, DeviceCredentialError, DeviceCredentialForbiddenError, DeviceCredentialPolicyError, DeviceCredentialService, DurableLoginAuditSink, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, InvalidCredentialsError, LEGACY_USER_PROFILE_BACKFILL_NAME, LOGIN_ATTEMPTS_RETENTION_TASK, LOGIN_AUDIT_RETENTION_TASK, LegacyUserProfileBackfillError, LoginAttemptLimiter, LoginRateLimitError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, PIN_LOGIN_KIND, PIN_PERMISSION_DEFINITIONS, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, PinVerifier, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, SESSION_DATA_KEYS, Session, SessionCollection, SessionService, SessionStatus, TERMINAL_APPROVE_LOGIN_KIND, Tenant, TenantCollection, TenantHierarchyError, TenantHierarchyMaterializationError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, UsersLoginAttempt, UsersLoginAttemptCollection, UsersLoginAuditEvent, UsersLoginAuditEventCollection, UsersPinCredential, UsersPinCredentialCollection, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deduplicateRolePermissions, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, ensurePinPermissionsRegistered, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, materializeTenantHierarchy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, planTenantHierarchy, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
+export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_DEVICE_PERSON_IDLE_SECONDS, DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, DEFAULT_LOGIN_AUDIT_RETENTION_DAYS, DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, DEFAULT_LOGIN_LOCKOUT_FACTOR, DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, DEFAULT_LOGIN_MAX_ATTEMPTS, DEFAULT_PASSWORD_DENYLIST, DEFAULT_PASSWORD_MANAGE_PERMISSION, DEFAULT_PASSWORD_MAX_LENGTH, DEFAULT_PASSWORD_MIN_LENGTH, DEFAULT_PIN_MANAGE_PERMISSION, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, DeviceCredentialError, DeviceCredentialForbiddenError, DeviceCredentialPolicyError, DeviceCredentialService, DurableLoginAuditSink, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, InvalidCredentialsError, LEGACY_USER_PROFILE_BACKFILL_NAME, LOGIN_ATTEMPTS_RETENTION_TASK, LOGIN_AUDIT_RETENTION_TASK, LegacyUserProfileBackfillError, LoginAttemptLimiter, LoginRateLimitError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, PASSWORD_LOGIN_KIND, PASSWORD_MAX_LENGTH_CEILING, PASSWORD_PERMISSION_DEFINITIONS, PIN_LOGIN_KIND, PIN_PERMISSION_DEFINITIONS, PasswordCredentialError, PasswordCredentialForbiddenError, PasswordCredentialService, PasswordPolicyError, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, PinVerifier, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, SESSION_DATA_KEYS, Session, SessionCollection, SessionService, SessionStatus, TERMINAL_APPROVE_LOGIN_KIND, Tenant, TenantCollection, TenantHierarchyError, TenantHierarchyMaterializationError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, UsersLoginAttempt, UsersLoginAttemptCollection, UsersLoginAuditEvent, UsersLoginAuditEventCollection, UsersPasswordCredential, UsersPasswordCredentialCollection, UsersPinCredential, UsersPinCredentialCollection, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deduplicateRolePermissions, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, ensurePasswordPermissionsRegistered, ensurePinPermissionsRegistered, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, materializeTenantHierarchy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, planTenantHierarchy, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
 
 //# sourceMappingURL=index.js.map