@happyvertical/smrt-users 0.56.1 → 0.56.2

package/dist/collections/TenantCollection.d.ts

@@ -20,6 +20,21 @@ export interface CreateChildTenantOptions {
     /** Whether this child cascades permissions to its children. Default: true */
     cascadePermissions?: boolean;
 }
+/** The verified actor supplied to a hierarchy read-scope authorizer. */
+export interface TenantReadScopeAuthorizationContext {
+    actorTenantId: string;
+    actorUserId: string;
+    rootTenantId: string;
+    mode: 'catalog' | 'subtree';
+}
+/** Authorization must return exactly `true`; every other result fails closed. */
+export type TenantReadScopeAuthorizer = (context: TenantReadScopeAuthorizationContext) => boolean | Promise<boolean>;
+export interface TenantReadScopeOptions {
+    /** Qualified tenant-scoped model identities whose list reads may widen. */
+    collections: readonly string[];
+    /** Owning service's affirmative permission decision for this scope. */
+    authorize: TenantReadScopeAuthorizer;
+}
 /**
  * Collection for managing Tenant objects with hierarchical support.
  *
@@ -65,6 +80,8 @@ export declare class TenantCollection extends SmrtCollection<Tenant> {
      * Uses the hierarchyPath for efficient lookup.
      */
     getAncestors(tenantId: string): Promise<Tenant[]>;
+    /** Return ancestor IDs in the model's canonical root-to-parent order. */
+    getAncestorIds(tenantId: string): Promise<string[]>;
     /**
      * Get all ancestors in order from root to immediate parent.
      * Reverse of getAncestors.
@@ -75,6 +92,8 @@ export declare class TenantCollection extends SmrtCollection<Tenant> {
      * Uses hierarchyPath prefix matching for efficient lookup.
      */
     getDescendants(tenantId: string): Promise<Tenant[]>;
+    /** Return descendant IDs without reimplementing materialized-path traversal. */
+    getDescendantIds(tenantId: string): Promise<string[]>;
     /**
      * Get siblings of a tenant (other tenants with the same parent)
      */
@@ -87,6 +106,21 @@ export declare class TenantCollection extends SmrtCollection<Tenant> {
      * Check if a tenant is a descendant of another tenant
      */
     isDescendantOf(potentialDescendantId: string, tenantId: string): Promise<boolean>;
+    /** Require `childId` to sit below `parentId`, failing closed otherwise. */
+    requireChildOf(parentId: string, childId: string): Promise<void>;
+    /**
+     * Allow list reads for the active family's catalog rows, its ancestors, and
+     * global rows. This never includes descendants or siblings.
+     */
+    withTenantCatalogReadScope<T>(options: TenantReadScopeOptions, callback: () => Promise<T>): Promise<T>;
+    /**
+     * Allow list reads for one authorized root and its descendants. Global and
+     * ancestor rows remain unavailable so aggregate views cannot become catalog
+     * lookups by accident.
+     */
+    withTenantHierarchyContext<T>(rootTenantId: string, options: TenantReadScopeOptions, callback: () => Promise<T>): Promise<T>;
+    private requireReadScopeActor;
+    private runAuthorizedReadScope;
     /**
      * Create a child tenant under a parent.
      * `hierarchyLevel` and `hierarchyPath` are derived by {@link Tenant.save}.

package/dist/collections/TenantCollection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TenantCollection.d.ts","sourceRoot":"","sources":["../../src/collections/TenantCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,6EAA6E;IAC7E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,MAAM,CAAC;IAC1D,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAU;IAIpC;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAO3D;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIrC;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUtD;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAOpC;;OAEG;IACG,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAO7D;;OAEG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQ1D;;;OAGG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA2BvD;;;OAGG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK/D;;;OAGG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA4BzD;;OAEG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAetD;;OAEG;IACG,YAAY,CAChB,mBAAmB,EAAE,MAAM,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAUnB;;OAEG;IACG,cAAc,CAClB,qBAAqB,EAAE,MAAM,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAMnB;;;;;OAKG;IACG,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,CAAC;IAYlB;;;;;;;;OAQG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,OAAO,CAAC,MAAM,CAAC;IAqBlB;;OAEG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIjD;;;OAGG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAwD5D;;;OAGG;IACG,OAAO,CACX,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAyBnD"}
+{"version":3,"file":"TenantCollection.d.ts","sourceRoot":"","sources":["../../src/collections/TenantCollection.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAK1D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,6EAA6E;IAC7E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,wEAAwE;AACxE,MAAM,WAAW,mCAAmC;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;CAC7B;AAED,iFAAiF;AACjF,MAAM,MAAM,yBAAyB,GAAG,CACtC,OAAO,EAAE,mCAAmC,KACzC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,MAAM,WAAW,sBAAsB;IACrC,2EAA2E;IAC3E,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,uEAAuE;IACvE,SAAS,EAAE,yBAAyB,CAAC;CACtC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,MAAM,CAAC;IAC1D,MAAM,CAAC,QAAQ,CAAC,UAAU,gBAAU;IAIpC;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAO3D;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIrC;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUtD;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAOpC;;OAEG;IACG,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAO7D;;OAEG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQ1D;;;OAGG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA2BvD,yEAAyE;IACnE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAKzD;;;OAGG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK/D;;;OAGG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA4BzD,gFAAgF;IAC1E,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAM3D;;OAEG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAetD;;OAEG;IACG,YAAY,CAChB,mBAAmB,EAAE,MAAM,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAUnB;;OAEG;IACG,cAAc,CAClB,qBAAqB,EAAE,MAAM,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC;IAInB,2EAA2E;IACrE,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAStE;;;OAGG;IACG,0BAA0B,CAAC,CAAC,EAChC,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACzB,OAAO,CAAC,CAAC,CAAC;IAqBb;;;;OAIG;IACG,0BAA0B,CAAC,CAAC,EAChC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACzB,OAAO,CAAC,CAAC,CAAC;IAoBb,OAAO,CAAC,qBAAqB;YAWf,sBAAsB;IA8CpC;;;;;OAKG;IACG,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,CAAC;IAYlB;;;;;;;;OAQG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,OAAO,CAAC,MAAM,CAAC;IAqBlB;;OAEG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIjD;;;OAGG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAwD5D;;;OAGG;IACG,OAAO,CACX,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAyBnD"}

package/dist/index.js

@@ -1,11 +1,11 @@
-import { $ as PermissionResolver, $t as GroupCollection, A as withSessionPermissionContext, At as recordTenantHierarchyChanges, B as resolveOidcProviderConfig, Bt as RoleCollection, C as OperationPermissionError, Ct as TenantCollection, D as getCurrentSessionPermissionContext, Dt as applyTenantHierarchyUpdates, E as hasOperationPermission, Et as TenantHierarchyError, F as OidcLoginError, Ft as deriveOperationPermissionSlug, G as DeviceCredentialForbiddenError, Gt as UsersPasswordCredential, H as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, Ht as UsersPinCredential, I as OidcLoginService, It as normalizeOperationPermissionAction, J as PIN_LOGIN_KIND, Jt as MembershipCollection, K as DeviceCredentialPolicyError, Kt as MembershipOverrideCollection, L as decodeOidcTransaction, Lt as registerPermissionDefinitions, M as MobileAuthService, Mt as RolePermissionCollection, N as readMobileBearerToken, Nt as PermissionCatalogService, O as getRequestScopedDatabase, Ot as assertTenantTableName, P as validateMobileRedirectUri, Pt as deriveOperationPermissionCollectionName, Q as SessionService, Qt as GroupMember, R as encodeOidcTransaction, Rt as syncPermissionCatalog, S as outOfBandProofSessionData, St as TenantPermissionOverride, T as checkOperationPermission, Tt as MAX_TENANT_HIERARCHY_DEPTH, U as DEFAULT_PIN_MANAGE_PERMISSION, Ut as PermissionCollection, Vt as UsersPinCredentialCollection, W as DeviceCredentialError, Wt as UsersPasswordCredentialCollection, X as PinVerifier, Xt as GroupRole, Y as PIN_PERMISSION_DEFINITIONS, Yt as GroupRoleCollection, Z as ensurePinPermissionsRegistered, Zt as GroupMemberCollection, _ as PasswordCredentialError, _n as Membership, _t as UserCollection, a as TerminalAuthError, an as UsersCliAuthRequestCollection, at as DEFAULT_SOURCE_LOCKOUT_AUDIT_SECONDS, b as PasswordPolicyError, bt as backfillUserEmailKeys, c as DEFAULT_PASSWORD_DENYLIST, cn as User, ct as LoginAttemptLimiter, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as DEFAULT_SESSION_TTL, dt as ANCESTOR_READ_ACTION, en as Group, et as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, f as DEFAULT_PASSWORD_RECOVERY_MAX_AGE_SECONDS, fn as SESSION_DATA_KEYS, ft as DEFAULT_ANCESTOR_READ_MAX_DEPTH, g as PASSWORD_RECOVERY_MAX_AGE_CEILING_SECONDS, gn as Permission, gt as OidcProvisioningError, h as PASSWORD_PERMISSION_DEFINITIONS, hn as Role, ht as normalizeAncestorReadPolicy, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAttempt, it as DEFAULT_LOGIN_MAX_ATTEMPTS, j as MobileAuthError, jt as DEFAULT_ROLE_PERMISSION_PATTERNS, k as withPrincipalPermissionContext, kt as planTenantHierarchy, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as isValidEmail, lt as LoginRateLimitError, m as PASSWORD_MAX_LENGTH_CEILING, mn as generateSessionId, mt as isAncestorReadableSlug, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as UsersLoginAuditEvent, nt as DEFAULT_LOGIN_LOCKOUT_FACTOR, o as TerminalAuthRateLimitError, on as SessionCollection, ot as DurableLoginAuditSink, p as PASSWORD_LOGIN_KIND, pn as Session, pt as getConfiguredAncestorReadPolicy, q as DeviceCredentialService, qt as MembershipOverride, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAttemptCollection, rt as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, s as TerminalAuthService, sn as UsersCliAuthRequest, st as InvalidCredentialsError, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as UsersLoginAuditEventCollection, tt as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as normalizeEmail, ut as withoutListBounds, v as PasswordCredentialForbiddenError, w as assertOperationPermission, wt as Tenant, x as ensurePasswordPermissionsRegistered, xt as TenantPermissionOverrideCollection, y as PasswordCredentialService, yt as UserEmailKeyBackfillError, z as getUsersOidcConfig, zt as RolePermission } from "./chunks/TerminalAuthService-qeDjch8C.js";
+import { $ as PermissionResolver, $t as GroupCollection, A as withSessionPermissionContext, At as recordTenantHierarchyChanges, B as resolveOidcProviderConfig, Bt as RoleCollection, C as OperationPermissionError, Ct as TenantCollection, D as getCurrentSessionPermissionContext, Dt as applyTenantHierarchyUpdates, E as hasOperationPermission, Et as TenantHierarchyError, F as OidcLoginError, Ft as deriveOperationPermissionSlug, G as DeviceCredentialForbiddenError, Gt as UsersPasswordCredential, H as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, Ht as UsersPinCredential, I as OidcLoginService, It as normalizeOperationPermissionAction, J as PIN_LOGIN_KIND, Jt as MembershipCollection, K as DeviceCredentialPolicyError, Kt as MembershipOverrideCollection, L as decodeOidcTransaction, Lt as registerPermissionDefinitions, M as MobileAuthService, Mt as RolePermissionCollection, N as readMobileBearerToken, Nt as PermissionCatalogService, O as getRequestScopedDatabase, Ot as assertTenantTableName, P as validateMobileRedirectUri, Pt as deriveOperationPermissionCollectionName, Q as SessionService, Qt as GroupMember, R as encodeOidcTransaction, Rt as syncPermissionCatalog, S as outOfBandProofSessionData, St as TenantPermissionOverride, T as checkOperationPermission, Tt as MAX_TENANT_HIERARCHY_DEPTH, U as DEFAULT_PIN_MANAGE_PERMISSION, Ut as PermissionCollection, Vt as UsersPinCredentialCollection, W as DeviceCredentialError, Wt as UsersPasswordCredentialCollection, X as PinVerifier, Xt as GroupRole, Y as PIN_PERMISSION_DEFINITIONS, Yt as GroupRoleCollection, Z as ensurePinPermissionsRegistered, Zt as GroupMemberCollection, _ as PasswordCredentialError, _n as Membership, _t as UserCollection, a as TerminalAuthError, an as UsersCliAuthRequestCollection, at as DEFAULT_SOURCE_LOCKOUT_AUDIT_SECONDS, b as PasswordPolicyError, bt as backfillUserEmailKeys, c as DEFAULT_PASSWORD_DENYLIST, cn as User, ct as LoginAttemptLimiter, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as DEFAULT_SESSION_TTL, dt as ANCESTOR_READ_ACTION, en as Group, et as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, f as DEFAULT_PASSWORD_RECOVERY_MAX_AGE_SECONDS, fn as SESSION_DATA_KEYS, ft as DEFAULT_ANCESTOR_READ_MAX_DEPTH, g as PASSWORD_RECOVERY_MAX_AGE_CEILING_SECONDS, gn as Permission, gt as OidcProvisioningError, h as PASSWORD_PERMISSION_DEFINITIONS, hn as Role, ht as normalizeAncestorReadPolicy, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAttempt, it as DEFAULT_LOGIN_MAX_ATTEMPTS, j as MobileAuthError, jt as DEFAULT_ROLE_PERMISSION_PATTERNS, k as withPrincipalPermissionContext, kt as planTenantHierarchy, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as isValidEmail, lt as LoginRateLimitError, m as PASSWORD_MAX_LENGTH_CEILING, mn as generateSessionId, mt as isAncestorReadableSlug, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as UsersLoginAuditEvent, nt as DEFAULT_LOGIN_LOCKOUT_FACTOR, o as TerminalAuthRateLimitError, on as SessionCollection, ot as DurableLoginAuditSink, p as PASSWORD_LOGIN_KIND, pn as Session, pt as getConfiguredAncestorReadPolicy, q as DeviceCredentialService, qt as MembershipOverride, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAttemptCollection, rt as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, s as TerminalAuthService, sn as UsersCliAuthRequest, st as InvalidCredentialsError, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as UsersLoginAuditEventCollection, tt as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as normalizeEmail, ut as withoutListBounds, v as PasswordCredentialForbiddenError, w as assertOperationPermission, wt as Tenant, x as ensurePasswordPermissionsRegistered, xt as TenantPermissionOverrideCollection, y as PasswordCredentialService, yt as UserEmailKeyBackfillError, z as getUsersOidcConfig, zt as RolePermission } from "./chunks/TerminalAuthService-bCA7skXS.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, SmrtRecipe, bumpChangeFeed, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
 import { PROFILE_EMAIL_KEY_BACKFILL_NAME, Person, ProfileCollection, ProfileTypeCollection, normalizeIdentityEmail } from "@happyvertical/smrt-profiles";
 import { createHash, randomUUID } from "node:crypto";
 import { setTimeout } from "node:timers/promises";
-import { createLogger } from "@happyvertical/logger";
 import { TenantScoped, tenantId, withSystemContext } from "@happyvertical/smrt-tenancy";
+import { createLogger } from "@happyvertical/logger";
 import { BackfillTracker } from "@happyvertical/smrt-core/migrations";
 import { OAuthServerError } from "@happyvertical/auth/server";
 //#region src/models/ResourceGrant.ts
@@ -1948,7 +1948,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-qeDjch8C.js").then((n) => n.V);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-bCA7skXS.js").then((n) => n.V);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -1977,7 +1977,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-qeDjch8C.js").then((n) => n.V);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-bCA7skXS.js").then((n) => n.V);
 		const key = await this.getSigningKey();
 		let payload;
 		try {