@happyvertical/smrt-users 0.54.2 → 0.54.4

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as DEFAULT_LOGIN_LOCKOUT_FACTOR, $t as Group, A as readMobileBearerToken, At as deriveOperationPermissionCollectionName, B as DEFAULT_PIN_MANAGE_PERMISSION, Bt as PermissionCollection, C as hasOperationPermission, Ct as applyTenantHierarchyUpdates, D as withSessionPermissionContext, Dt as DEFAULT_ROLE_PERMISSION_PATTERNS, E as withPrincipalPermissionContext, Et as recordTenantHierarchyChanges, F as encodeOidcTransaction, Ft as RolePermission, G as PIN_LOGIN_KIND, Gt as MembershipOverride, H as DeviceCredentialForbiddenError, Ht as UsersPasswordCredentialCollection, I as getUsersOidcConfig, It as RoleCollection, J as ensurePinPermissionsRegistered, Jt as GroupRoleCollection, K as PIN_PERMISSION_DEFINITIONS, Kt as MembershipCollection, L as resolveOidcProviderConfig, Lt as Role, M as OidcLoginError, Mt as normalizeOperationPermissionAction, N as OidcLoginService, Nt as registerPermissionDefinitions, O as MobileAuthError, Ot as RolePermissionCollection, P as decodeOidcTransaction, Pt as syncPermissionCatalog, Q as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Qt as GroupCollection, Rt as UsersPinCredentialCollection, S as checkOperationPermission, St as TenantHierarchyError, T as getRequestScopedDatabase, Tt as planTenantHierarchy, U as DeviceCredentialPolicyError, Ut as UsersPasswordCredential, V as DeviceCredentialError, Vt as Permission, W as DeviceCredentialService, Wt as MembershipOverrideCollection, X as PermissionResolver, Xt as GroupMemberCollection, Y as SessionService, Yt as GroupRole, Z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, Zt as GroupMember, _ as PasswordCredentialService, _t as TenantPermissionOverrideCollection, a as TerminalAuthError, an as UsersLoginAttemptCollection, at as LoginRateLimitError, b as OperationPermissionError, bt as Tenant, c as DEFAULT_PASSWORD_DENYLIST, cn as SessionCollection, ct as DEFAULT_ANCESTOR_READ_MAX_DEPTH, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as Session, dt as normalizeAncestorReadPolicy, en as User, et as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, f as PASSWORD_LOGIN_KIND, fn as generateSessionId, ft as OidcProvisioningError, g as PasswordCredentialForbiddenError, gt as backfillUserEmailKeys, h as PasswordCredentialError, ht as UserEmailKeyBackfillError, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAuditEvent, it as LoginAttemptLimiter, j as validateMobileRedirectUri, jt as deriveOperationPermissionSlug, k as MobileAuthService, kt as PermissionCatalogService, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as DEFAULT_SESSION_TTL, lt as getConfiguredAncestorReadPolicy, m as PASSWORD_PERMISSION_DEFINITIONS, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as normalizeEmail, nt as DurableLoginAuditSink, o as TerminalAuthRateLimitError, on as UsersLoginAttempt, ot as withoutListBounds, p as PASSWORD_MAX_LENGTH_CEILING, pn as UsersCliAuthRequest, pt as UserCollection, q as PinVerifier, qt as Membership, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAuditEventCollection, rt as InvalidCredentialsError, s as TerminalAuthService, sn as UsersCliAuthRequestCollection, st as ANCESTOR_READ_ACTION, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as isValidEmail, tt as DEFAULT_LOGIN_MAX_ATTEMPTS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as SESSION_DATA_KEYS, ut as isAncestorReadableSlug, v as PasswordPolicyError, vt as TenantPermissionOverride, w as getCurrentSessionPermissionContext, wt as assertTenantTableName, x as assertOperationPermission, xt as MAX_TENANT_HIERARCHY_DEPTH, y as ensurePasswordPermissionsRegistered, yt as TenantCollection, z as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, zt as UsersPinCredential } from "./chunks/TerminalAuthService-B2cazTEg.js";
+import { $ as DEFAULT_LOGIN_LOCKOUT_FACTOR, $t as Group, A as readMobileBearerToken, At as deriveOperationPermissionCollectionName, B as DEFAULT_PIN_MANAGE_PERMISSION, Bt as PermissionCollection, C as hasOperationPermission, Ct as applyTenantHierarchyUpdates, D as withSessionPermissionContext, Dt as DEFAULT_ROLE_PERMISSION_PATTERNS, E as withPrincipalPermissionContext, Et as recordTenantHierarchyChanges, F as encodeOidcTransaction, Ft as RolePermission, G as PIN_LOGIN_KIND, Gt as MembershipOverride, H as DeviceCredentialForbiddenError, Ht as UsersPasswordCredentialCollection, I as getUsersOidcConfig, It as RoleCollection, J as ensurePinPermissionsRegistered, Jt as GroupRoleCollection, K as PIN_PERMISSION_DEFINITIONS, Kt as MembershipCollection, L as resolveOidcProviderConfig, Lt as Role, M as OidcLoginError, Mt as normalizeOperationPermissionAction, N as OidcLoginService, Nt as registerPermissionDefinitions, O as MobileAuthError, Ot as RolePermissionCollection, P as decodeOidcTransaction, Pt as syncPermissionCatalog, Q as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Qt as GroupCollection, Rt as UsersPinCredentialCollection, S as checkOperationPermission, St as TenantHierarchyError, T as getRequestScopedDatabase, Tt as planTenantHierarchy, U as DeviceCredentialPolicyError, Ut as UsersPasswordCredential, V as DeviceCredentialError, Vt as Permission, W as DeviceCredentialService, Wt as MembershipOverrideCollection, X as PermissionResolver, Xt as GroupMemberCollection, Y as SessionService, Yt as GroupRole, Z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, Zt as GroupMember, _ as PasswordCredentialService, _t as TenantPermissionOverrideCollection, a as TerminalAuthError, an as UsersLoginAttemptCollection, at as LoginRateLimitError, b as OperationPermissionError, bt as Tenant, c as DEFAULT_PASSWORD_DENYLIST, cn as SessionCollection, ct as DEFAULT_ANCESTOR_READ_MAX_DEPTH, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as Session, dt as normalizeAncestorReadPolicy, en as User, et as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, f as PASSWORD_LOGIN_KIND, fn as generateSessionId, ft as OidcProvisioningError, g as PasswordCredentialForbiddenError, gt as backfillUserEmailKeys, h as PasswordCredentialError, ht as UserEmailKeyBackfillError, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAuditEvent, it as LoginAttemptLimiter, j as validateMobileRedirectUri, jt as deriveOperationPermissionSlug, k as MobileAuthService, kt as PermissionCatalogService, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as DEFAULT_SESSION_TTL, lt as getConfiguredAncestorReadPolicy, m as PASSWORD_PERMISSION_DEFINITIONS, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as normalizeEmail, nt as DurableLoginAuditSink, o as TerminalAuthRateLimitError, on as UsersLoginAttempt, ot as withoutListBounds, p as PASSWORD_MAX_LENGTH_CEILING, pn as UsersCliAuthRequest, pt as UserCollection, q as PinVerifier, qt as Membership, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAuditEventCollection, rt as InvalidCredentialsError, s as TerminalAuthService, sn as UsersCliAuthRequestCollection, st as ANCESTOR_READ_ACTION, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as isValidEmail, tt as DEFAULT_LOGIN_MAX_ATTEMPTS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as SESSION_DATA_KEYS, ut as isAncestorReadableSlug, v as PasswordPolicyError, vt as TenantPermissionOverride, w as getCurrentSessionPermissionContext, wt as assertTenantTableName, x as assertOperationPermission, xt as MAX_TENANT_HIERARCHY_DEPTH, y as ensurePasswordPermissionsRegistered, yt as TenantCollection, z as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, zt as UsersPinCredential } from "./chunks/TerminalAuthService-GL2iWF_Q.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, bumpChangeFeed, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
 import { createHash, randomUUID } from "node:crypto";
@@ -9,12 +9,19 @@ import { BackfillTracker } from "@happyvertical/smrt-core/migrations";
 //#region src/models/MagicLinkToken.ts
 var __defProp$4 = Object.defineProperty;
 var __getOwnPropDesc$4 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$4 = (obj, key, value) => key in obj ? __defProp$4(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
 var __decorateClass$4 = (decorators, target, key, kind) => {
 	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$4(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
 	if (kind && result) __defProp$4(target, key, result);
 	return result;
 };
+var __publicField$4 = (obj, key, value) => __defNormalProp$4(obj, typeof key !== "symbol" ? key + "" : key, value);
 var DEFAULT_TOKEN_EXPIRY_SECONDS = 600;
 var UsersMagicLinkToken = class extends SmrtObject {
 	nonce = "";
@@ -39,6 +46,7 @@ var UsersMagicLinkToken = class extends SmrtObject {
 		return !this.used && !this.isExpired();
 	}
 };
+__publicField$4(UsersMagicLinkToken, "__smrtPackage__", "@happyvertical/smrt-users");
 __decorateClass$4([field({
 	required: true,
 	unique: true
@@ -157,12 +165,19 @@ function unregisterUserRetentionTasks() {
 //#region src/models/AccessRequest.ts
 var __defProp$3 = Object.defineProperty;
 var __getOwnPropDesc$3 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
 var __decorateClass$3 = (decorators, target, key, kind) => {
 	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$3(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
 	if (kind && result) __defProp$3(target, key, result);
 	return result;
 };
+var __publicField$3 = (obj, key, value) => __defNormalProp$3(obj, typeof key !== "symbol" ? key + "" : key, value);
 var AccessRequest = class extends SmrtObject {
 	email = "";
 	name = null;
@@ -245,6 +260,7 @@ var AccessRequest = class extends SmrtObject {
 		return this.status === AccessRequestStatus.DECLINED || this.status === AccessRequestStatus.GRADUATED || this.status === AccessRequestStatus.CANCELED;
 	}
 };
+__publicField$3(AccessRequest, "__smrtPackage__", "@happyvertical/smrt-users");
 __decorateClass$3([field({
 	required: true,
 	indexed: true
@@ -318,17 +334,25 @@ var AccessRequestCollection = class extends SmrtCollection {
 //#region src/models/CliAuthApproveLimit.ts
 var __defProp$2 = Object.defineProperty;
 var __getOwnPropDesc$2 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$2 = (obj, key, value) => key in obj ? __defProp$2(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
 var __decorateClass$2 = (decorators, target, key, kind) => {
 	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$2(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
 	if (kind && result) __defProp$2(target, key, result);
 	return result;
 };
+var __publicField$2 = (obj, key, value) => __defNormalProp$2(obj, typeof key !== "symbol" ? key + "" : key, value);
 var UsersCliAuthApproveLimit = class extends SmrtObject {
 	userId = "";
 	attemptCount = 0;
 	windowStartedAt = /* @__PURE__ */ new Date();
 };
+__publicField$2(UsersCliAuthApproveLimit, "__smrtPackage__", "@happyvertical/smrt-users");
 __decorateClass$2([foreignKey("User", {
 	required: true,
 	unique: true
@@ -412,12 +436,19 @@ var UsersCliAuthApproveLimitCollection = class extends SmrtCollection {
 //#region src/models/ResourceGrant.ts
 var __defProp$1 = Object.defineProperty;
 var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
 var __decorateClass$1 = (decorators, target, key, kind) => {
 	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
 	if (kind && result) __defProp$1(target, key, result);
 	return result;
 };
+var __publicField$1 = (obj, key, value) => __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
 var ResourceGrant = class extends SmrtObject {
 	tenantId;
 	userId;
@@ -444,6 +475,7 @@ var ResourceGrant = class extends SmrtObject {
 		return !this.revokedAt;
 	}
 };
+__publicField$1(ResourceGrant, "__smrtPackage__", "@happyvertical/smrt-users");
 __decorateClass$1([foreignKey("Tenant", { required: true })], ResourceGrant.prototype, "tenantId", 2);
 __decorateClass$1([foreignKey("User", { required: true })], ResourceGrant.prototype, "userId", 2);
 __decorateClass$1([field({ type: "text" })], ResourceGrant.prototype, "resourceType", 2);
@@ -483,12 +515,19 @@ var ResourceGrantCollection = class extends SmrtCollection {
 //#region src/models/TenantIntegration.ts
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
 var __decorateClass = (decorators, target, key, kind) => {
 	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
 	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
 	if (kind && result) __defProp(target, key, result);
 	return result;
 };
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 function parseExternalIds(raw) {
 	if (!raw) return {};
 	if (typeof raw === "object" && !Array.isArray(raw)) return Object.fromEntries(Object.entries(raw).filter(([, value]) => typeof value === "string"));
@@ -605,6 +644,7 @@ var TenantIntegration = class extends SmrtObject {
 		this.lastError = outcome.error ?? null;
 	}
 };
+__publicField(TenantIntegration, "__smrtPackage__", "@happyvertical/smrt-users");
 __decorateClass([tenantId()], TenantIntegration.prototype, "tenantId", 2);
 TenantIntegration = __decorateClass([TenantScoped({ mode: "required" }), smrt({
 	tableName: "tenant_integrations",
@@ -1342,7 +1382,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-B2cazTEg.js").then((n) => n.R);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-GL2iWF_Q.js").then((n) => n.R);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -1371,7 +1411,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-B2cazTEg.js").then((n) => n.R);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-GL2iWF_Q.js").then((n) => n.R);
 		const key = await this.getSigningKey();
 		let payload;
 		try {