@happyvertical/smrt-users 0.55.12 → 0.55.13

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as DEFAULT_LOGIN_LOCKOUT_FACTOR, $t as UsersLoginAttemptCollection, A as readMobileBearerToken, At as deriveOperationPermissionCollectionName, B as DEFAULT_PIN_MANAGE_PERMISSION, Bt as UsersPasswordCredentialCollection, C as hasOperationPermission, Ct as applyTenantHierarchyUpdates, D as withSessionPermissionContext, Dt as DEFAULT_ROLE_PERMISSION_PATTERNS, E as withPrincipalPermissionContext, Et as recordTenantHierarchyChanges, F as encodeOidcTransaction, Ft as RolePermission, G as PIN_LOGIN_KIND, Gt as GroupRoleCollection, H as DeviceCredentialForbiddenError, Ht as MembershipOverrideCollection, I as getUsersOidcConfig, It as RoleCollection, J as ensurePinPermissionsRegistered, Jt as GroupMember, K as PIN_PERMISSION_DEFINITIONS, Kt as GroupRole, L as resolveOidcProviderConfig, Lt as UsersPinCredentialCollection, M as OidcLoginError, Mt as normalizeOperationPermissionAction, N as OidcLoginService, Nt as registerPermissionDefinitions, O as MobileAuthError, Ot as RolePermissionCollection, P as decodeOidcTransaction, Pt as syncPermissionCatalog, Q as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Qt as UsersLoginAuditEvent, Rt as UsersPinCredential, S as checkOperationPermission, St as TenantHierarchyError, T as getRequestScopedDatabase, Tt as planTenantHierarchy, U as DeviceCredentialPolicyError, Ut as MembershipOverride, V as DeviceCredentialError, Vt as UsersPasswordCredential, W as DeviceCredentialService, Wt as MembershipCollection, X as PermissionResolver, Xt as Group, Y as SessionService, Yt as GroupCollection, Z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, Zt as UsersLoginAuditEventCollection, _ as PasswordCredentialService, _t as TenantPermissionOverrideCollection, a as TerminalAuthError, an as isValidEmail, at as LoginRateLimitError, b as OperationPermissionError, bt as Tenant, c as DEFAULT_PASSWORD_DENYLIST, cn as SESSION_DATA_KEYS, ct as DEFAULT_ANCESTOR_READ_MAX_DEPTH, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as Role, dt as normalizeAncestorReadPolicy, en as UsersLoginAttempt, et as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, f as PASSWORD_LOGIN_KIND, fn as Permission, ft as OidcProvisioningError, g as PasswordCredentialForbiddenError, gt as backfillUserEmailKeys, h as PasswordCredentialError, ht as UserEmailKeyBackfillError, i as TERMINAL_APPROVE_LOGIN_KIND, in as User, it as LoginAttemptLimiter, j as validateMobileRedirectUri, jt as deriveOperationPermissionSlug, k as MobileAuthService, kt as PermissionCatalogService, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as Session, lt as getConfiguredAncestorReadPolicy, m as PASSWORD_PERMISSION_DEFINITIONS, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as SessionCollection, nt as DurableLoginAuditSink, o as TerminalAuthRateLimitError, on as normalizeEmail, ot as withoutListBounds, p as PASSWORD_MAX_LENGTH_CEILING, pn as Membership, pt as UserCollection, q as PinVerifier, qt as GroupMemberCollection, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersCliAuthRequest, rt as InvalidCredentialsError, s as TerminalAuthService, sn as DEFAULT_SESSION_TTL, st as ANCESTOR_READ_ACTION, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as UsersCliAuthRequestCollection, tt as DEFAULT_LOGIN_MAX_ATTEMPTS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as generateSessionId, ut as isAncestorReadableSlug, v as PasswordPolicyError, vt as TenantPermissionOverride, w as getCurrentSessionPermissionContext, wt as assertTenantTableName, x as assertOperationPermission, xt as MAX_TENANT_HIERARCHY_DEPTH, y as ensurePasswordPermissionsRegistered, yt as TenantCollection, z as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, zt as PermissionCollection } from "./chunks/TerminalAuthService-45O05z-G.js";
+import { $ as DEFAULT_LOGIN_LOCKOUT_FACTOR, $t as UsersLoginAttemptCollection, A as readMobileBearerToken, At as deriveOperationPermissionCollectionName, B as DEFAULT_PIN_MANAGE_PERMISSION, Bt as UsersPasswordCredentialCollection, C as hasOperationPermission, Ct as applyTenantHierarchyUpdates, D as withSessionPermissionContext, Dt as DEFAULT_ROLE_PERMISSION_PATTERNS, E as withPrincipalPermissionContext, Et as recordTenantHierarchyChanges, F as encodeOidcTransaction, Ft as RolePermission, G as PIN_LOGIN_KIND, Gt as GroupRoleCollection, H as DeviceCredentialForbiddenError, Ht as MembershipOverrideCollection, I as getUsersOidcConfig, It as RoleCollection, J as ensurePinPermissionsRegistered, Jt as GroupMember, K as PIN_PERMISSION_DEFINITIONS, Kt as GroupRole, L as resolveOidcProviderConfig, Lt as UsersPinCredentialCollection, M as OidcLoginError, Mt as normalizeOperationPermissionAction, N as OidcLoginService, Nt as registerPermissionDefinitions, O as MobileAuthError, Ot as RolePermissionCollection, P as decodeOidcTransaction, Pt as syncPermissionCatalog, Q as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Qt as UsersLoginAuditEvent, Rt as UsersPinCredential, S as checkOperationPermission, St as TenantHierarchyError, T as getRequestScopedDatabase, Tt as planTenantHierarchy, U as DeviceCredentialPolicyError, Ut as MembershipOverride, V as DeviceCredentialError, Vt as UsersPasswordCredential, W as DeviceCredentialService, Wt as MembershipCollection, X as PermissionResolver, Xt as Group, Y as SessionService, Yt as GroupCollection, Z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, Zt as UsersLoginAuditEventCollection, _ as PasswordCredentialService, _t as TenantPermissionOverrideCollection, a as TerminalAuthError, an as isValidEmail, at as LoginRateLimitError, b as OperationPermissionError, bt as Tenant, c as DEFAULT_PASSWORD_DENYLIST, cn as SESSION_DATA_KEYS, ct as DEFAULT_ANCESTOR_READ_MAX_DEPTH, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as Role, dt as normalizeAncestorReadPolicy, en as UsersLoginAttempt, et as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, f as PASSWORD_LOGIN_KIND, fn as Permission, ft as OidcProvisioningError, g as PasswordCredentialForbiddenError, gt as backfillUserEmailKeys, h as PasswordCredentialError, ht as UserEmailKeyBackfillError, i as TERMINAL_APPROVE_LOGIN_KIND, in as User, it as LoginAttemptLimiter, j as validateMobileRedirectUri, jt as deriveOperationPermissionSlug, k as MobileAuthService, kt as PermissionCatalogService, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as Session, lt as getConfiguredAncestorReadPolicy, m as PASSWORD_PERMISSION_DEFINITIONS, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as SessionCollection, nt as DurableLoginAuditSink, o as TerminalAuthRateLimitError, on as normalizeEmail, ot as withoutListBounds, p as PASSWORD_MAX_LENGTH_CEILING, pn as Membership, pt as UserCollection, q as PinVerifier, qt as GroupMemberCollection, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersCliAuthRequest, rt as InvalidCredentialsError, s as TerminalAuthService, sn as DEFAULT_SESSION_TTL, st as ANCESTOR_READ_ACTION, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as UsersCliAuthRequestCollection, tt as DEFAULT_LOGIN_MAX_ATTEMPTS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as generateSessionId, ut as isAncestorReadableSlug, v as PasswordPolicyError, vt as TenantPermissionOverride, w as getCurrentSessionPermissionContext, wt as assertTenantTableName, x as assertOperationPermission, xt as MAX_TENANT_HIERARCHY_DEPTH, y as ensurePasswordPermissionsRegistered, yt as TenantCollection, z as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, zt as PermissionCollection } from "./chunks/TerminalAuthService-D7ub2Snn.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, SmrtRecipe, bumpChangeFeed, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
 import { PROFILE_EMAIL_KEY_BACKFILL_NAME, Person, ProfileCollection, ProfileTypeCollection, normalizeIdentityEmail } from "@happyvertical/smrt-profiles";
@@ -50,18 +50,34 @@ var ResourceGrant = class extends SmrtObject {
 };
 __publicField$4(ResourceGrant, "__smrtPackage__", "@happyvertical/smrt-users");
 __decorateClass$4([foreignKey("Tenant", { required: true })], ResourceGrant.prototype, "tenantId", 2);
-__decorateClass$4([foreignKey("User", { required: true })], ResourceGrant.prototype, "userId", 2);
-__decorateClass$4([field({ type: "text" })], ResourceGrant.prototype, "resourceType", 2);
-__decorateClass$4([field({ type: "text" })], ResourceGrant.prototype, "resourceId", 2);
-__decorateClass$4([field({ type: "text" })], ResourceGrant.prototype, "permission", 2);
-__decorateClass$4([field({ type: "text" })], ResourceGrant.prototype, "effect", 2);
-__decorateClass$4([foreignKey("ResourceGrant")], ResourceGrant.prototype, "parentGrantId", 2);
-__decorateClass$4([field({ type: "text" })], ResourceGrant.prototype, "revokedAt", 2);
+__decorateClass$4([field({ description: "The person receiving this record-specific access rule." }), foreignKey("User", { required: true })], ResourceGrant.prototype, "userId", 2);
+__decorateClass$4([field({
+	description: "The kind of record this access rule applies to.",
+	type: "text"
+})], ResourceGrant.prototype, "resourceType", 2);
+__decorateClass$4([field({
+	description: "The specific record covered by this access rule.",
+	type: "text"
+})], ResourceGrant.prototype, "resourceId", 2);
+__decorateClass$4([field({
+	description: "The action this rule allows or denies for the record.",
+	type: "text"
+})], ResourceGrant.prototype, "permission", 2);
+__decorateClass$4([field({
+	description: "Whether this rule grants access or denies it. Denies take precedence.",
+	type: "text"
+})], ResourceGrant.prototype, "effect", 2);
+__decorateClass$4([field({ description: "Whether the recipient may pass this grant on to another person." })], ResourceGrant.prototype, "canDelegate", 2);
+__decorateClass$4([field({ description: "The earlier grant from which this access was delegated." }), foreignKey("ResourceGrant")], ResourceGrant.prototype, "parentGrantId", 2);
+__decorateClass$4([field({
+	description: "When this access rule was revoked, if it has ended.",
+	type: "text"
+})], ResourceGrant.prototype, "revokedAt", 2);
 ResourceGrant = __decorateClass$4([smrt({
 	tenantScoped: true,
 	api: { include: [] },
 	mcp: { include: [] },
-	cli: { skipApiCheck: true },
+	cli: false,
 	indexes: [{
 		name: "resource_grants_lookup_idx",
 		columns: ["tenantId", "userId"]
@@ -216,7 +232,7 @@ UsersMagicLinkToken = __decorateClass$3([smrt({
 	sensitive: true,
 	api: { include: [] },
 	mcp: { include: [] },
-	cli: { skipApiCheck: true }
+	cli: false
 })], UsersMagicLinkToken);
 //#endregion
 //#region src/collections/MagicLinkTokenCollection.ts
@@ -439,7 +455,7 @@ AccessRequest = __decorateClass$2([smrt({
 	conflictColumns: ["id"],
 	api: { include: [] },
 	mcp: { include: [] },
-	cli: { include: [] }
+	cli: false
 })], AccessRequest);
 //#endregion
 //#region src/collections/AccessRequestCollection.ts
@@ -745,7 +761,7 @@ TenantIntegration = __decorateClass([TenantScoped({ mode: "required" }), smrt({
 	conflictColumns: ["tenant_id", "provider"],
 	api: { include: ["list", "get"] },
 	mcp: { include: ["list", "get"] },
-	cli: { skipApiCheck: true }
+	cli: { include: ["list", "get"] }
 })], TenantIntegration);
 //#endregion
 //#region src/collections/TenantIntegrationCollection.ts
@@ -1476,7 +1492,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-45O05z-G.js").then((n) => n.R);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-D7ub2Snn.js").then((n) => n.R);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -1505,7 +1521,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-45O05z-G.js").then((n) => n.R);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-D7ub2Snn.js").then((n) => n.R);
 		const key = await this.getSigningKey();
 		let payload;
 		try {