@happyvertical/smrt-users 0.54.3 → 0.55.2

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as DEFAULT_LOGIN_LOCKOUT_FACTOR, $t as Group, A as readMobileBearerToken, At as deriveOperationPermissionCollectionName, B as DEFAULT_PIN_MANAGE_PERMISSION, Bt as PermissionCollection, C as hasOperationPermission, Ct as applyTenantHierarchyUpdates, D as withSessionPermissionContext, Dt as DEFAULT_ROLE_PERMISSION_PATTERNS, E as withPrincipalPermissionContext, Et as recordTenantHierarchyChanges, F as encodeOidcTransaction, Ft as RolePermission, G as PIN_LOGIN_KIND, Gt as MembershipOverride, H as DeviceCredentialForbiddenError, Ht as UsersPasswordCredentialCollection, I as getUsersOidcConfig, It as RoleCollection, J as ensurePinPermissionsRegistered, Jt as GroupRoleCollection, K as PIN_PERMISSION_DEFINITIONS, Kt as MembershipCollection, L as resolveOidcProviderConfig, Lt as Role, M as OidcLoginError, Mt as normalizeOperationPermissionAction, N as OidcLoginService, Nt as registerPermissionDefinitions, O as MobileAuthError, Ot as RolePermissionCollection, P as decodeOidcTransaction, Pt as syncPermissionCatalog, Q as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Qt as GroupCollection, Rt as UsersPinCredentialCollection, S as checkOperationPermission, St as TenantHierarchyError, T as getRequestScopedDatabase, Tt as planTenantHierarchy, U as DeviceCredentialPolicyError, Ut as UsersPasswordCredential, V as DeviceCredentialError, Vt as Permission, W as DeviceCredentialService, Wt as MembershipOverrideCollection, X as PermissionResolver, Xt as GroupMemberCollection, Y as SessionService, Yt as GroupRole, Z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, Zt as GroupMember, _ as PasswordCredentialService, _t as TenantPermissionOverrideCollection, a as TerminalAuthError, an as UsersLoginAttemptCollection, at as LoginRateLimitError, b as OperationPermissionError, bt as Tenant, c as DEFAULT_PASSWORD_DENYLIST, cn as SessionCollection, ct as DEFAULT_ANCESTOR_READ_MAX_DEPTH, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as Session, dt as normalizeAncestorReadPolicy, en as User, et as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, f as PASSWORD_LOGIN_KIND, fn as generateSessionId, ft as OidcProvisioningError, g as PasswordCredentialForbiddenError, gt as backfillUserEmailKeys, h as PasswordCredentialError, ht as UserEmailKeyBackfillError, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAuditEvent, it as LoginAttemptLimiter, j as validateMobileRedirectUri, jt as deriveOperationPermissionSlug, k as MobileAuthService, kt as PermissionCatalogService, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as DEFAULT_SESSION_TTL, lt as getConfiguredAncestorReadPolicy, m as PASSWORD_PERMISSION_DEFINITIONS, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as normalizeEmail, nt as DurableLoginAuditSink, o as TerminalAuthRateLimitError, on as UsersLoginAttempt, ot as withoutListBounds, p as PASSWORD_MAX_LENGTH_CEILING, pn as UsersCliAuthRequest, pt as UserCollection, q as PinVerifier, qt as Membership, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAuditEventCollection, rt as InvalidCredentialsError, s as TerminalAuthService, sn as UsersCliAuthRequestCollection, st as ANCESTOR_READ_ACTION, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as isValidEmail, tt as DEFAULT_LOGIN_MAX_ATTEMPTS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as SESSION_DATA_KEYS, ut as isAncestorReadableSlug, v as PasswordPolicyError, vt as TenantPermissionOverride, w as getCurrentSessionPermissionContext, wt as assertTenantTableName, x as assertOperationPermission, xt as MAX_TENANT_HIERARCHY_DEPTH, y as ensurePasswordPermissionsRegistered, yt as TenantCollection, z as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, zt as UsersPinCredential } from "./chunks/TerminalAuthService-Bc67JXJ5.js";
+import { $ as DEFAULT_LOGIN_LOCKOUT_FACTOR, $t as Group, A as readMobileBearerToken, At as deriveOperationPermissionCollectionName, B as DEFAULT_PIN_MANAGE_PERMISSION, Bt as PermissionCollection, C as hasOperationPermission, Ct as applyTenantHierarchyUpdates, D as withSessionPermissionContext, Dt as DEFAULT_ROLE_PERMISSION_PATTERNS, E as withPrincipalPermissionContext, Et as recordTenantHierarchyChanges, F as encodeOidcTransaction, Ft as RolePermission, G as PIN_LOGIN_KIND, Gt as MembershipOverride, H as DeviceCredentialForbiddenError, Ht as UsersPasswordCredentialCollection, I as getUsersOidcConfig, It as RoleCollection, J as ensurePinPermissionsRegistered, Jt as GroupRoleCollection, K as PIN_PERMISSION_DEFINITIONS, Kt as MembershipCollection, L as resolveOidcProviderConfig, Lt as Role, M as OidcLoginError, Mt as normalizeOperationPermissionAction, N as OidcLoginService, Nt as registerPermissionDefinitions, O as MobileAuthError, Ot as RolePermissionCollection, P as decodeOidcTransaction, Pt as syncPermissionCatalog, Q as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Qt as GroupCollection, Rt as UsersPinCredentialCollection, S as checkOperationPermission, St as TenantHierarchyError, T as getRequestScopedDatabase, Tt as planTenantHierarchy, U as DeviceCredentialPolicyError, Ut as UsersPasswordCredential, V as DeviceCredentialError, Vt as Permission, W as DeviceCredentialService, Wt as MembershipOverrideCollection, X as PermissionResolver, Xt as GroupMemberCollection, Y as SessionService, Yt as GroupRole, Z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, Zt as GroupMember, _ as PasswordCredentialService, _t as TenantPermissionOverrideCollection, a as TerminalAuthError, an as UsersLoginAttemptCollection, at as LoginRateLimitError, b as OperationPermissionError, bt as Tenant, c as DEFAULT_PASSWORD_DENYLIST, cn as SessionCollection, ct as DEFAULT_ANCESTOR_READ_MAX_DEPTH, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as Session, dt as normalizeAncestorReadPolicy, en as User, et as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, f as PASSWORD_LOGIN_KIND, fn as generateSessionId, ft as OidcProvisioningError, g as PasswordCredentialForbiddenError, gt as backfillUserEmailKeys, h as PasswordCredentialError, ht as UserEmailKeyBackfillError, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAuditEvent, it as LoginAttemptLimiter, j as validateMobileRedirectUri, jt as deriveOperationPermissionSlug, k as MobileAuthService, kt as PermissionCatalogService, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as DEFAULT_SESSION_TTL, lt as getConfiguredAncestorReadPolicy, m as PASSWORD_PERMISSION_DEFINITIONS, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as normalizeEmail, nt as DurableLoginAuditSink, o as TerminalAuthRateLimitError, on as UsersLoginAttempt, ot as withoutListBounds, p as PASSWORD_MAX_LENGTH_CEILING, pn as UsersCliAuthRequest, pt as UserCollection, q as PinVerifier, qt as Membership, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAuditEventCollection, rt as InvalidCredentialsError, s as TerminalAuthService, sn as UsersCliAuthRequestCollection, st as ANCESTOR_READ_ACTION, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as isValidEmail, tt as DEFAULT_LOGIN_MAX_ATTEMPTS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as SESSION_DATA_KEYS, ut as isAncestorReadableSlug, v as PasswordPolicyError, vt as TenantPermissionOverride, w as getCurrentSessionPermissionContext, wt as assertTenantTableName, x as assertOperationPermission, xt as MAX_TENANT_HIERARCHY_DEPTH, y as ensurePasswordPermissionsRegistered, yt as TenantCollection, z as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, zt as UsersPinCredential } from "./chunks/TerminalAuthService-DdV-Rm4h.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, bumpChangeFeed, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
 import { createHash, randomUUID } from "node:crypto";
@@ -1382,7 +1382,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-Bc67JXJ5.js").then((n) => n.R);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-DdV-Rm4h.js").then((n) => n.R);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -1411,7 +1411,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-Bc67JXJ5.js").then((n) => n.R);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-DdV-Rm4h.js").then((n) => n.R);
 		const key = await this.getSigningKey();
 		let payload;
 		try {

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.54.3",
+  "packageVersion": "0.55.2",
   "objects": {
     "@happyvertical/smrt-users:AccessRequestCollection": {
       "name": "accessrequestcollection",
@@ -4968,6 +4968,7 @@
       "extends": "SmrtObject",
       "exportName": "AccessRequest",
       "collectionExportName": "AccessRequestCollection",
+      "displayLabelField": "name",
       "validationRules": [
         {
           "field": "email",
@@ -5261,7 +5262,13 @@
         "status": {
           "type": "text",
           "required": false,
-          "_meta": {}
+          "_meta": {},
+          "enum": [
+            "pending",
+            "approved",
+            "consumed",
+            "expired"
+          ]
         },
         "userId": {
           "type": "foreignKey",
@@ -5518,6 +5525,7 @@
       "extends": "SmrtObject",
       "exportName": "Group",
       "collectionExportName": "GroupCollection",
+      "displayLabelField": "name",
       "validationRules": [
         {
           "field": "tenantId",
@@ -5905,7 +5913,11 @@
           "required": true,
           "_meta": {
             "required": true
-          }
+          },
+          "enum": [
+            "subject",
+            "source"
+          ]
         },
         "attemptCount": {
           "type": "integer",
@@ -6123,7 +6135,14 @@
           "required": true,
           "_meta": {
             "required": true
-          }
+          },
+          "enum": [
+            "denied",
+            "failed",
+            "succeeded",
+            "locked",
+            "managed"
+          ]
         },
         "subjectKeyHash": {
           "type": "text",
@@ -7119,6 +7138,7 @@
       "extends": "SmrtObject",
       "exportName": "Permission",
       "collectionExportName": "PermissionCollection",
+      "displayLabelField": "name",
       "schema": {
         "tableName": "permissions",
         "ddl": "CREATE TABLE IF NOT EXISTS \"permissions\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"name\" TEXT DEFAULT '',\n  \"description\" TEXT DEFAULT '',\n  \"category\" TEXT DEFAULT ''\n);",
@@ -7419,7 +7439,11 @@
         "effect": {
           "type": "text",
           "required": false,
-          "_meta": {}
+          "_meta": {},
+          "enum": [
+            "grant",
+            "deny"
+          ]
         },
         "canDelegate": {
           "type": "boolean",
@@ -7711,6 +7735,7 @@
       "extends": "SmrtObject",
       "exportName": "Role",
       "collectionExportName": "RoleCollection",
+      "displayLabelField": "name",
       "schema": {
         "tableName": "roles",
         "ddl": "CREATE TABLE IF NOT EXISTS \"roles\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"tenant_id\" UUID,\n  \"name\" TEXT DEFAULT '',\n  \"description\" TEXT DEFAULT '',\n  \"is_system\" BOOLEAN DEFAULT FALSE,\n  \"inherits_to_descendants\" BOOLEAN DEFAULT FALSE\n);",
@@ -8500,6 +8525,7 @@
       "extends": "SmrtObject",
       "exportName": "Tenant",
       "collectionExportName": "TenantCollection",
+      "displayLabelField": "name",
       "schema": {
         "tableName": "tenants",
         "ddl": "CREATE TABLE IF NOT EXISTS \"tenants\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"_meta_type\" TEXT NOT NULL,\n  \"_meta_data\" JSON,\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"name\" TEXT DEFAULT '',\n  \"status\" TEXT,\n  \"description\" TEXT DEFAULT '',\n  \"parent_tenant_id\" UUID,\n  \"hierarchy_level\" INTEGER DEFAULT 0,\n  \"hierarchy_path\" TEXT DEFAULT '',\n  \"cascade_permissions\" BOOLEAN DEFAULT TRUE,\n  \"inherit_permissions\" BOOLEAN DEFAULT TRUE\n);",
@@ -8653,7 +8679,14 @@
         "status": {
           "type": "text",
           "required": false,
-          "default": "unprovisioned"
+          "default": "unprovisioned",
+          "enum": [
+            "unprovisioned",
+            "provisioning",
+            "active",
+            "drifted",
+            "failed"
+          ]
         },
         "lastCheckedAt": {
           "type": "datetime",

package/dist/smrt-knowledge.json

@@ -3,15 +3,15 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.54.3",
+  "packageVersion": "0.55.2",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "8ec5c73317366b97cec8ec93eaa78dfb59ac55446a9235918eec86f3a4ca8abb",
-    "packageJson": "023de378de6ec6fa58be39c8a5d40055b1b459d0b6fc4115fc4087f943408074",
+    "manifest": "9d030b39ff492f4ec431ae26ed48570ac667f5ee9b550d532dabf83970dbe62a",
+    "packageJson": "af07a3e664950e4f2dd890f392191880b439336b5965f5141cecbf25d7e5da1d",
     "agents": "fa1b9005064b329b1d2387cd56307b92a79f2cd4ea951776e687f9850a428335",
     "moduleDoc:agents/permissions.md": "5f6c0afab7e1fd0887b0d29b5a5b5ab2635694207bade70145d3cbfdb62ba78c",
-    "moduleDoc:agents/oidc-provisioning.md": "5efa607ff23b9a693391e0c02670324a8cea4114d4968c9718f10a763da919c6",
+    "moduleDoc:agents/oidc-provisioning.md": "b73f3fdaf61136720132a614c7e14237b7bd35f7bf5d43eabb29f565485803b9",
     "moduleDoc:agents/mobile-auth.md": "25e85e83f43e3a46383a92fa809f3a003b4545c3026e78dbe1bccbbc35161e18",
     "moduleDoc:agents/terminal-auth-testing.md": "8a84c16a19e381427aed81d3b1882344c427fe22a70e87f5ac2db836b1a6822d",
     "moduleDoc:agents/retention.md": "073874bf16ce3fbbc503157679dc7fe69800fb39a59e40299bcc713f099bf3d8"
@@ -4428,6 +4428,7 @@
     {
       "name": "AccessRequest",
       "qualifiedName": "@happyvertical/smrt-users:AccessRequest",
+      "displayLabelField": "name",
       "collection": "accessrequests",
       "tableName": "access_requests",
       "packageName": "@happyvertical/smrt-users",
@@ -4757,6 +4758,7 @@
     {
       "name": "Group",
       "qualifiedName": "@happyvertical/smrt-users:Group",
+      "displayLabelField": "name",
       "collection": "groups",
       "tableName": "groups",
       "packageName": "@happyvertical/smrt-users",
@@ -5747,6 +5749,7 @@
     {
       "name": "Permission",
       "qualifiedName": "@happyvertical/smrt-users:Permission",
+      "displayLabelField": "name",
       "collection": "permissions",
       "tableName": "permissions",
       "packageName": "@happyvertical/smrt-users",
@@ -6145,6 +6148,7 @@
     {
       "name": "Role",
       "qualifiedName": "@happyvertical/smrt-users:Role",
+      "displayLabelField": "name",
       "collection": "roles",
       "tableName": "roles",
       "packageName": "@happyvertical/smrt-users",
@@ -6888,6 +6892,7 @@
     {
       "name": "Tenant",
       "qualifiedName": "@happyvertical/smrt-users:Tenant",
+      "displayLabelField": "name",
       "collection": "tenants",
       "tableName": "tenants",
       "packageName": "@happyvertical/smrt-users",
@@ -11470,7 +11475,7 @@
     {
       "path": "agents/oidc-provisioning.md",
       "module": "oidc-provisioning",
-      "content": "# OIDC provisioning\n\nRead for changes to `src/collections/UserCollection.ts`, `src/services/OidcLoginService.ts`,\nOIDC handlers, or identity migrations. The canonical scenario matrix is\n`packages/profiles/src/testing/oidcProvisioningDecisionMatrix.ts`.\n\n- **OIDC `email_verified` is enforced.** `UserCollection.getOrCreateFromOidc`\n  refuses to provision a user when the IdP explicitly returns\n  `email_verified: false` (opt out with `{ allowUnverifiedEmail: true }`). An\n  absent claim makes no assertion and is not enforced.\n- **RFC 9207 response issuer is exact.** OIDC callbacks validate a supplied\n  `iss` against discovered metadata with exact string comparison before trusting\n  a code or error. If metadata advertises issuer-response support, `iss` is\n  required.\n- **Verified-email Profile reuse is fail-closed.** The typed canonical scenarios\n  live in\n  `packages/profiles/src/testing/oidcProvisioningDecisionMatrix.ts`; both\n  package suites execute that matrix and public docs reference it rather than\n  maintaining another behavioral table. Default provisioning reuses only one\n  unowned, global `Person`. Tenant-scoped, non-Person, duplicate-email,\n  and already-owned matches fail before User/session creation. An existing\n  issuer/subject link without a User must still be the unique global Person for\n  the current verified claim email; once owned, the stable issuer/subject link\n  reuses its canonical Person and owner.\n  Issuer and subject are opaque, case-sensitive identifiers; preserve their\n  exact value and use trim only to reject blank claims.\n- **`resolveProfile` is the application reconciliation boundary.** The\n  SvelteKit handlers, `OidcLoginService`, and `getOrCreateFromOidc` accept the\n  same hook inside the provisioning transaction. The service/handler path\n  supplies protocol-validated claims; direct collection callers must validate\n  and trust their claim source before calling `getOrCreateFromOidc`.\n  Token/userinfo merging keeps `email` and `email_verified` paired to the same\n  claim source; verification is never borrowed across sources.\n  Resolver reads/writes use the supplied `db`, and the hook must be idempotent\n  because a concurrent unique-key conflict can retry it. `undefined` chooses\n  the secure default and `null` rejects, including exact issuer/subject reuse.\n  For a new identity, a supplied Profile is still validated as the unique,\n  unowned global Person for the verified email. For an exact existing identity,\n  it must be the already-linked Profile and cannot rebind identity authority;\n  stable-link owner and canonical-Person checks still apply. The hook receives a\n  separate frozen claims snapshot; internal retry and persistence state is not\n  exposed for mutation.\n- **Owned first binding requires `authorizeProfileOwner`.** An invitation or\n  approval workflow may explicitly return both its pre-provisioned canonical\n  global `Person` and existing approved `User` from this transaction-bound\n  hook. `undefined` keeps the secure `profile_owned` default and `null`\n  rejects. SMRT treats only the selected IDs as input, reloads them in the\n  provisioning transaction, and requires `email_verified === true`, the unique\n  canonical global Person for the normalized claim email, exactly one owner,\n  that owner as the selected User, and the same normalized User email. The\n  hook runs before identity/User/session creation and may be retried, so use\n  only its supplied `db` and `users` handles and keep application authorization\n  idempotent. Never authorize from email matching alone. Existing exact\n  identities cannot be rebound; when `resolveProfile` is also present both\n  hooks must select the same Profile.\n- **OIDC first login is atomic.** The Profile, `OidcIdentity`, and User are one\n  transaction. The database arbiters are `OidcIdentity.identityKey`,\n  private `oidc_profile_email_reservations.email_key`, `User.emailKey`, and the\n  unique `User.profileId`; local callbacks acquire exact issuer/subject and normalized\n  email locks in deterministic order so changed email claims also serialize.\n  SQLite and DuckDB callbacks additionally serialize every root-handle statement\n  the coordinator owns per database URL — `_smrt_backfills` initialization, the\n  transaction, and the post-commit rebind — because one adapter multiplexes a\n  single native connection and cannot safely overlap unrelated root\n  transactions. Never overlap two statements on one such handle, inside a\n  transaction or not: rebind and owner/email candidate reads are sequential,\n  never `Promise.all`. Owner-authorized DuckDB callbacks use that same\n  root-handle serialization;\n  PostgreSQL deadlock and serialization errors use a bounded transaction retry.\n  Newly provisioned Profiles use non-semantic per-profile slugs so equal IdP\n  display names cannot trigger a natural-key upsert;\n  run\n  `smrt db:status`, `smrt db:migrate`, then `smrt db:status` before deployment.\n  Stop or upgrade old writers first. Before migration, group\n  non-null `users.profile_id` values, then reconcile duplicates. After\n  migration, run public `backfillProfileEmailKeys(db)`,\n  `backfillUserEmailKeys(db)`, then `backfillLegacyUserProfiles(db)` from one\n  deploy process. The first two use the shared\n  TypeScript `normalizeIdentityEmail()` implementation transactionally and are\n  idempotent; the User backfill fails before writes if normalized duplicates\n  remain. The legacy Profile backfill transactionally creates canonical global\n  Persons for null/blank User links without creating OIDC identities or\n  inferring ownership; reconcile any same-email Profile or reservation before\n  retrying. Its marker records a completed pass but never skips newly imported\n  legacy Users on a later run. Every OIDC path requires the Profile email-key\n  readiness marker; creating a User or checking User email uniqueness\n  additionally requires the User marker. A stable issuer/subject with an\n  existing owning User skips only the User email-key lookup and marker. Full\n  scans remain in the explicit deploy step; guarded runtime paths use indexed\n  keys and validate only returned candidates. Multiple null links remain valid.\n  Legacy race keys backfill only after canonical validation. Pass a root\n  database on adapters such as DuckDB that cannot create nested savepoints.\n  Root adapters must expose `beginTransaction`; transaction-only handles are\n  ambiguous and fail closed before provisioning writes. Caller-owned\n  transactions never run `_smrt_backfills` DDL and require that table to\n  already exist; use the root database when initialization or recovery is\n  needed.\n"
+      "content": "# OIDC provisioning\n\nRead for changes to `src/collections/UserCollection.ts`, `src/services/OidcLoginService.ts`,\nOIDC handlers, or identity migrations. The canonical scenario matrix is\n`packages/profiles/src/testing/oidcProvisioningDecisionMatrix.ts`.\n\n- **OIDC `email_verified` is enforced.** `UserCollection.getOrCreateFromOidc`\n  refuses to provision a user when the IdP explicitly returns\n  `email_verified: false` (opt out with `{ allowUnverifiedEmail: true }`). An\n  absent claim makes no assertion and is not enforced.\n- **RFC 9207 response issuer is exact.** OIDC callbacks validate a supplied\n  `iss` against discovered metadata with exact string comparison before trusting\n  a code or error. If metadata advertises issuer-response support, `iss` is\n  required.\n- **The login start route is the IdP landing URL (#3569).** Kanidm drops a\n  pending authorization after any detour through its `/ui/login` and strands the\n  user in its apps panel; the client landing URL is the only way back.\n  `getOidcClientRegistration()` derives it from `loginPath` (default\n  `/auth/<provider>/login`) alongside the callback URL; keep the login handler\n  safe to enter with no query string.\n- **Verified-email Profile reuse is fail-closed.** The typed canonical scenarios\n  live in\n  `packages/profiles/src/testing/oidcProvisioningDecisionMatrix.ts`; both\n  package suites execute that matrix and public docs reference it rather than\n  maintaining another behavioral table. Default provisioning reuses only one\n  unowned, global `Person`. Tenant-scoped, non-Person, duplicate-email,\n  and already-owned matches fail before User/session creation. An existing\n  issuer/subject link without a User must still be the unique global Person for\n  the current verified claim email; once owned, the stable issuer/subject link\n  reuses its canonical Person and owner.\n  Issuer and subject are opaque, case-sensitive identifiers; preserve their\n  exact value and use trim only to reject blank claims.\n- **`resolveProfile` is the application reconciliation boundary.** The\n  SvelteKit handlers, `OidcLoginService`, and `getOrCreateFromOidc` accept the\n  same hook inside the provisioning transaction. The service/handler path\n  supplies protocol-validated claims; direct collection callers must validate\n  and trust their claim source before calling `getOrCreateFromOidc`.\n  Token/userinfo merging keeps `email` and `email_verified` paired to the same\n  claim source; verification is never borrowed across sources.\n  Resolver reads/writes use the supplied `db`, and the hook must be idempotent\n  because a concurrent unique-key conflict can retry it. `undefined` chooses\n  the secure default and `null` rejects, including exact issuer/subject reuse.\n  For a new identity, a supplied Profile is still validated as the unique,\n  unowned global Person for the verified email. For an exact existing identity,\n  it must be the already-linked Profile and cannot rebind identity authority;\n  stable-link owner and canonical-Person checks still apply. The hook receives a\n  separate frozen claims snapshot; internal retry and persistence state is not\n  exposed for mutation.\n- **Owned first binding requires `authorizeProfileOwner`.** An invitation or\n  approval workflow may explicitly return both its pre-provisioned canonical\n  global `Person` and existing approved `User` from this transaction-bound\n  hook. `undefined` keeps the secure `profile_owned` default and `null`\n  rejects. SMRT treats only the selected IDs as input, reloads them in the\n  provisioning transaction, and requires `email_verified === true`, the unique\n  canonical global Person for the normalized claim email, exactly one owner,\n  that owner as the selected User, and the same normalized User email. The\n  hook runs before identity/User/session creation and may be retried, so use\n  only its supplied `db` and `users` handles and keep application authorization\n  idempotent. Never authorize from email matching alone. Existing exact\n  identities cannot be rebound; when `resolveProfile` is also present both\n  hooks must select the same Profile.\n- **OIDC first login is atomic.** The Profile, `OidcIdentity`, and User are one\n  transaction. The database arbiters are `OidcIdentity.identityKey`,\n  private `oidc_profile_email_reservations.email_key`, `User.emailKey`, and the\n  unique `User.profileId`; local callbacks acquire exact issuer/subject and normalized\n  email locks in deterministic order so changed email claims also serialize.\n  SQLite and DuckDB callbacks additionally serialize every root-handle statement\n  the coordinator owns per database URL — `_smrt_backfills` initialization, the\n  transaction, and the post-commit rebind — because one adapter multiplexes a\n  single native connection and cannot safely overlap unrelated root\n  transactions. Never overlap two statements on one such handle, inside a\n  transaction or not: rebind and owner/email candidate reads are sequential,\n  never `Promise.all`. Owner-authorized DuckDB callbacks use that same\n  root-handle serialization;\n  PostgreSQL deadlock and serialization errors use a bounded transaction retry.\n  Newly provisioned Profiles use non-semantic per-profile slugs so equal IdP\n  display names cannot trigger a natural-key upsert;\n  run\n  `smrt db:status`, `smrt db:migrate`, then `smrt db:status` before deployment.\n  Stop or upgrade old writers first. Before migration, group\n  non-null `users.profile_id` values, then reconcile duplicates. After\n  migration, run public `backfillProfileEmailKeys(db)`,\n  `backfillUserEmailKeys(db)`, then `backfillLegacyUserProfiles(db)` from one\n  deploy process. The first two use the shared\n  TypeScript `normalizeIdentityEmail()` implementation transactionally and are\n  idempotent; the User backfill fails before writes if normalized duplicates\n  remain. The legacy Profile backfill transactionally creates canonical global\n  Persons for null/blank User links without creating OIDC identities or\n  inferring ownership; reconcile any same-email Profile or reservation before\n  retrying. Its marker records a completed pass but never skips newly imported\n  legacy Users on a later run. Every OIDC path requires the Profile email-key\n  readiness marker; creating a User or checking User email uniqueness\n  additionally requires the User marker. A stable issuer/subject with an\n  existing owning User skips only the User email-key lookup and marker. Full\n  scans remain in the explicit deploy step; guarded runtime paths use indexed\n  keys and validate only returned candidates. Multiple null links remain valid.\n  Legacy race keys backfill only after canonical validation. Pass a root\n  database on adapters such as DuckDB that cannot create nested savepoints.\n  Root adapters must expose `beginTransaction`; transaction-only handles are\n  ambiguous and fail closed before provisioning writes. Caller-owned\n  transactions never run `_smrt_backfills` DDL and require that table to\n  already exist; use the root database when initialization or recovery is\n  needed.\n"
     },
     {
       "path": "agents/mobile-auth.md",

package/dist/sveltekit/index.d.ts

@@ -99,6 +99,12 @@ export interface OidcSvelteKitOptions extends SmrtClassOptions, OidcProviderReso
     provider?: OidcProviderResolver;
     /** Callback path used when provider.redirectUri is omitted. */
     callbackPath?: string | ((providerName: string) => string);
+    /**
+     * Path of the route that starts the login (the `createOidcLoginHandler`
+     * route). Defaults to `/auth/<provider>/login`. Only used to derive the
+     * IdP landing URL in {@link getOidcClientRegistration}.
+     */
+    loginPath?: string | ((providerName: string) => string);
     /** Query parameter used to preserve post-login redirects. */
     returnToParam?: string;
     /** Prefix for the temporary OIDC transaction cookie. */
@@ -142,6 +148,18 @@ export interface OidcSvelteKitOptions extends SmrtClassOptions, OidcProviderReso
     /** Redirect target after failed callback. If omitted, failures return 401. */
     failureRedirect?: string | ((error: unknown, event: SvelteKitRequestEvent) => string);
 }
+/** URLs to register with the IdP for one SMRT OIDC client. */
+export interface OidcClientRegistration {
+    providerName: string;
+    /** Callback URL: register as the client's allowed redirect URL. */
+    redirectUri: string;
+    /**
+     * Login start URL: register as the client's landing / initiate-login URL
+     * (Kanidm `set-landing-url`). The IdP links its app tile here, so a user
+     * whose pending authorization the IdP discarded can resume sign-in.
+     */
+    landingUrl: string;
+}
 export interface BeginOidcLoginResult {
     providerName: string;
     transaction: OidcTransaction;
@@ -314,6 +332,30 @@ export declare function beginOidcLogin(event: SvelteKitRequestEvent, options: Oi
  * the session cookie.
  */
 export declare function completeOidcLogin(event: SvelteKitRequestEvent, options: OidcSvelteKitOptions): Promise<CompleteOidcLoginResult>;
+/**
+ * Derive the URLs an IdP client registration must carry for this app, from the
+ * same options the login and callback handlers use.
+ *
+ * Register `redirectUri` as the allowed redirect URL and `landingUrl` as the
+ * client's landing URL. Kanidm discards a pending authorization whenever the
+ * user detours through its own login page (for example "Return to Login"
+ * after a mistyped password) and then lands the user in its apps panel; the
+ * landing URL is the only way back, so it must start the app's login rather
+ * than open its signed-out home page.
+ *
+ * @example
+ * ```typescript
+ * const { redirectUri, landingUrl } = getOidcClientRegistration(
+ *   'https://app.example.com',
+ *   { provider: 'kanidm' },
+ * );
+ * // kanidm system oauth2 add-redirect-url <client> <redirectUri>
+ * // kanidm system oauth2 set-landing-url <client> <landingUrl>
+ * ```
+ */
+export declare function getOidcClientRegistration(origin: string | URL, options?: Omit<OidcSvelteKitOptions, 'provider'> & {
+    provider?: string;
+}): OidcClientRegistration;
 /**
  * Create a SvelteKit GET handler that redirects to an OIDC provider.
  *
@@ -326,6 +368,9 @@ export declare function completeOidcLogin(event: SvelteKitRequestEvent, options:
  *   db: { type: 'postgres', url: process.env.DATABASE_URL! },
  * });
  * ```
+ *
+ * Register this route as the IdP client's landing URL; see
+ * {@link getOidcClientRegistration}.
  */
 export declare function createOidcLoginHandler(options: OidcSvelteKitOptions): (event: SvelteKitRequestEvent) => Promise<Response>;
 /**

package/dist/sveltekit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sveltekit/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EACV,0BAA0B,EAC1B,mBAAmB,EACpB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKL,KAAK,eAAe,EAGpB,KAAK,6BAA6B,EAClC,KAAK,eAAe,EAGrB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAEL,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,gCAAgC,EAChC,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,SAAS,EACd,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,0CAA0C,EAC1C,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,iCAAiC,EACjC,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,+BAA+B,EACpC,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,uCAAuC,EAC5C,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,gCAAgC,EACrC,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAItE;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iDAAiD;IACjD,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC3C,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sEAAsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,KAAK,WAAW,GAAG;IACjB,KAAK,EAAE;QACL,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;YAC1C,GAAG,EAAE,CACH,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC9B,IAAI,CAAC;YACV,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;SACnE,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,GAAG,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7C,OAAO,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC;KAC/B,CAAC;IACF,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChD,CAAC;AAEF,KAAK,MAAM,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAExD,KAAK,qBAAqB,GAAG;IAC3B,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAEF,KAAK,oBAAoB,GACrB,MAAM,GACN,CAAC,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC;AAE3D,KAAK,kBAAkB,CAAC,CAAC,IACrB,CAAC,GACD,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhF,MAAM,WAAW,oBACf,SAAQ,gBAAgB,EACtB,6BAA6B;IAC/B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,uEAAuE;IACvE,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3D,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6DAA6D;IAC7D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gEAAgE;IAChE,yBAAyB,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACtD,8EAA8E;IAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,4CAA4C;IAC5C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,6CAA6C;IAC7C,qBAAqB,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAClD,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,kBAAkB,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,0BAA0B,CAAC;IACnD,iDAAiD;IACjD,eAAe,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,eAAe,CAAC,EACZ,MAAM,GACN,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,eAAe,CAAC;IAC7B,GAAG,EAAE,GAAG,CAAC;CACV;AAED,MAAM,WAAW,uBAAwB,SAAQ,eAAe;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CA4E3E;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;;;;OAIG;IACH,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACtC,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,gBAAgB,GACvB,0BAA0B,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CAC5C,GACF,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAC3B,OAAO,EAAE,gBAAgB,GAAG;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GACA,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,OAAO,EAAE,gBAAgB,GAAG;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GACA,OAAO,CAAC,OAAO,CAAC,CA0ClB;AAiQD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,CAAC,CAyB/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CA2DlC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,IACpD,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAI/D;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,oBAAoB,IACvD,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAW/D;AAoCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAG5E;AAED,mDAAmD;AACnD,MAAM,WAAW,qCACf,SAAQ,0BAA0B;IAClC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC,CAAC;CAC1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,qCAAqC,IAEhC,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAU/D;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,0BAA0B,IAErB,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAe/D;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,0BAA0B,IAErB,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAY/D;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,0BAA0B,wDAIpC;AAED,qDAAqD;AACrD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,6BACf,SAAQ,0BAA0B;IAClC,0DAA0D;IAC1D,WAAW,EAAE,CACX,KAAK,EAAE,qBAAqB,KACzB;QAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IACtE,iDAAiD;IACjD,eAAe,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC7E,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvE,OAAO,EAAE,CACP,KAAK,EAAE,qBAAqB,KACzB,OAAO,CACR,2BAA2B,GAC3B;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,2BAA2B,CAAA;KAAE,CACzE,CAAC;CACH;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,6BAA6B,GACrC,wBAAwB,CAuF1B;AAuBD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sveltekit/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EACV,0BAA0B,EAC1B,mBAAmB,EACpB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKL,KAAK,eAAe,EAGpB,KAAK,6BAA6B,EAClC,KAAK,eAAe,EAGrB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAEL,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,gCAAgC,EAChC,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,SAAS,EACd,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,0CAA0C,EAC1C,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,iCAAiC,EACjC,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,+BAA+B,EACpC,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,uCAAuC,EAC5C,gCAAgC,EAChC,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,gCAAgC,EACrC,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAItE;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iDAAiD;IACjD,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC3C,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sEAAsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,KAAK,WAAW,GAAG;IACjB,KAAK,EAAE;QACL,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;YAC1C,GAAG,EAAE,CACH,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC9B,IAAI,CAAC;YACV,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;SACnE,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,GAAG,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7C,OAAO,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC;KAC/B,CAAC;IACF,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChD,CAAC;AAEF,KAAK,MAAM,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAExD,KAAK,qBAAqB,GAAG;IAC3B,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAEF,KAAK,oBAAoB,GACrB,MAAM,GACN,CAAC,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC;AAE3D,KAAK,kBAAkB,CAAC,CAAC,IACrB,CAAC,GACD,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhF,MAAM,WAAW,oBACf,SAAQ,gBAAgB,EACtB,6BAA6B;IAC/B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,uEAAuE;IACvE,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3D;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;IACxD,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6DAA6D;IAC7D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gEAAgE;IAChE,yBAAyB,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACtD,8EAA8E;IAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,4CAA4C;IAC5C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,6CAA6C;IAC7C,qBAAqB,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAClD,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,kBAAkB,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,0BAA0B,CAAC;IACnD,iDAAiD;IACjD,eAAe,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,eAAe,CAAC,EACZ,MAAM,GACN,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC,CAAC;CAChE;AAED,8DAA8D;AAC9D,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,eAAe,CAAC;IAC7B,GAAG,EAAE,GAAG,CAAC;CACV;AAED,MAAM,WAAW,uBAAwB,SAAQ,eAAe;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CA4E3E;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;;;;OAIG;IACH,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACtC,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,gBAAgB,GACvB,0BAA0B,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CAC5C,GACF,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAC3B,OAAO,EAAE,gBAAgB,GAAG;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GACA,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,OAAO,EAAE,gBAAgB,GAAG;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GACA,OAAO,CAAC,OAAO,CAAC,CA0ClB;AA4QD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,CAAC,CAyB/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CA2DlC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,GAAG,GAAG,EACpB,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3E,sBAAsB,CAiBxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,IACpD,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAI/D;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,oBAAoB,IACvD,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAW/D;AAoCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAG5E;AAED,mDAAmD;AACnD,MAAM,WAAW,qCACf,SAAQ,0BAA0B;IAClC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC,CAAC;CAC1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,qCAAqC,IAEhC,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAU/D;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,0BAA0B,IAErB,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAe/D;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,0BAA0B,IAErB,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAY/D;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,0BAA0B,wDAIpC;AAED,qDAAqD;AACrD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,6BACf,SAAQ,0BAA0B;IAClC,0DAA0D;IAC1D,WAAW,EAAE,CACX,KAAK,EAAE,qBAAqB,KACzB;QAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IACtE,iDAAiD;IACjD,eAAe,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC7E,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvE,OAAO,EAAE,CACP,KAAK,EAAE,qBAAqB,KACzB,OAAO,CACR,2BAA2B,GAC3B;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,2BAA2B,CAAA;KAAE,CACzE,CAAC;CACH;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,6BAA6B,GACrC,wBAAwB,CAuF1B;AAuBD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,CAAC"}

package/dist/sveltekit.js

@@ -1,4 +1,4 @@
-import { A as readMobileBearerToken, D as withSessionPermissionContext, F as encodeOidcTransaction, H as DeviceCredentialForbiddenError, I as getUsersOidcConfig, L as resolveOidcProviderConfig, M as OidcLoginError, N as OidcLoginService, O as MobileAuthError, P as decodeOidcTransaction, U as DeviceCredentialPolicyError, V as DeviceCredentialError, W as DeviceCredentialService, Y as SessionService, _ as PasswordCredentialService, a as TerminalAuthError, at as LoginRateLimitError, b as OperationPermissionError, g as PasswordCredentialForbiddenError, h as PasswordCredentialError, j as validateMobileRedirectUri, k as MobileAuthService, o as TerminalAuthRateLimitError, s as TerminalAuthService, v as PasswordPolicyError } from "./chunks/TerminalAuthService-Bc67JXJ5.js";
+import { A as readMobileBearerToken, D as withSessionPermissionContext, F as encodeOidcTransaction, H as DeviceCredentialForbiddenError, I as getUsersOidcConfig, L as resolveOidcProviderConfig, M as OidcLoginError, N as OidcLoginService, O as MobileAuthError, P as decodeOidcTransaction, U as DeviceCredentialPolicyError, V as DeviceCredentialError, W as DeviceCredentialService, Y as SessionService, _ as PasswordCredentialService, a as TerminalAuthError, at as LoginRateLimitError, b as OperationPermissionError, g as PasswordCredentialForbiddenError, h as PasswordCredentialError, j as validateMobileRedirectUri, k as MobileAuthService, o as TerminalAuthRateLimitError, s as TerminalAuthService, v as PasswordPolicyError } from "./chunks/TerminalAuthService-DdV-Rm4h.js";
 import { DiscoveryArtifactValidationError, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, canonicalizeDiscoveryArtifact, createDiscoveryConformanceArtifact, deriveCommandRequirements, validateDiscoveryConformanceArtifact } from "./app-contract.js";
 import { ObjectRegistry, createClassNamePredicate, resolveCustomActionMetadata, resolveEffectiveActionMetadata } from "@happyvertical/smrt-core";
 import { createLogger } from "@happyvertical/logger";
@@ -1052,6 +1052,10 @@ function resolveCallbackPath(providerName, options) {
 	if (typeof options.callbackPath === "function") return options.callbackPath(providerName);
 	return options.callbackPath ?? `/auth/${providerName}/callback`;
 }
+function resolveLoginPath(providerName, options) {
+	if (typeof options.loginPath === "function") return options.loginPath(providerName);
+	return options.loginPath ?? `/auth/${providerName}/login`;
+}
 function resolveProviderWithRedirectUri(event, providerName, provider, options) {
 	return {
 		...provider,
@@ -1203,6 +1207,15 @@ async function completeOidcLogin(event, options) {
 		event.cookies.delete(cookieName, { path: cookiePath });
 	}
 }
+function getOidcClientRegistration(origin, options = {}) {
+	const resolved = resolveOidcProviderConfig(options.provider, options);
+	const baseOrigin = new URL(origin).origin;
+	return {
+		providerName: resolved.providerName,
+		redirectUri: resolved.provider.redirectUri ?? new URL(resolveCallbackPath(resolved.providerName, options), baseOrigin).toString(),
+		landingUrl: new URL(resolveLoginPath(resolved.providerName, options), baseOrigin).toString()
+	};
+}
 function createOidcLoginHandler(options) {
 	return async (event) => {
 		const { url } = await beginOidcLogin(event, options);
@@ -1364,6 +1377,6 @@ var NO_STORE_HEADERS = {
 	pragma: "no-cache"
 };
 //#endregion
-export { DiscoveryArtifactValidationError, InvalidBearerError, MobileAuthError, MobileAuthService, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, beginOidcLogin, canonicalizeDiscoveryArtifact, completeOidcLogin, createBearerSessionDeleteHandler, createDeviceCredentialHandlers, createDiscoveryConformanceArtifact, createMobileAuthHandlers, createOidcCallbackHandler, createOidcLoginHandler, createPasswordCredentialHandlers, createResourceListHandler, createSessionCookie, createSessionHandler, createTerminalAuthStartHandler, createTerminalAuthTokenHandler, defaultSessionLocals, deriveCommandRequirements, destroySessionCookie, loadBearerSessionContext, mountTerminalLoginPage, parseBearerToken, readMobileBearerToken, resolveMobileUploadDedupKey, switchSessionTenant, validateDiscoveryConformanceArtifact, validateMobileRedirectUri };
+export { DiscoveryArtifactValidationError, InvalidBearerError, MobileAuthError, MobileAuthService, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, beginOidcLogin, canonicalizeDiscoveryArtifact, completeOidcLogin, createBearerSessionDeleteHandler, createDeviceCredentialHandlers, createDiscoveryConformanceArtifact, createMobileAuthHandlers, createOidcCallbackHandler, createOidcLoginHandler, createPasswordCredentialHandlers, createResourceListHandler, createSessionCookie, createSessionHandler, createTerminalAuthStartHandler, createTerminalAuthTokenHandler, defaultSessionLocals, deriveCommandRequirements, destroySessionCookie, getOidcClientRegistration, loadBearerSessionContext, mountTerminalLoginPage, parseBearerToken, readMobileBearerToken, resolveMobileUploadDedupKey, switchSessionTenant, validateDiscoveryConformanceArtifact, validateMobileRedirectUri };
 
 //# sourceMappingURL=sveltekit.js.map