@happyvertical/smrt-users 0.57.2 → 0.57.4

package/dist/index.js

@@ -1,13 +1,617 @@
-import { $ as PermissionResolver, $t as GroupCollection, A as withSessionPermissionContext, At as recordTenantHierarchyChanges, B as resolveOidcProviderConfig, Bt as RoleCollection, C as OperationPermissionError, Ct as TenantCollection, D as getCurrentSessionPermissionContext, Dt as applyTenantHierarchyUpdates, E as hasOperationPermission, Et as TenantHierarchyError, F as OidcLoginError, Ft as deriveOperationPermissionSlug, G as DeviceCredentialForbiddenError, Gt as UsersPasswordCredential, H as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, Ht as UsersPinCredential, I as OidcLoginService, It as normalizeOperationPermissionAction, J as PIN_LOGIN_KIND, Jt as MembershipCollection, K as DeviceCredentialPolicyError, Kt as MembershipOverrideCollection, L as decodeOidcTransaction, Lt as registerPermissionDefinitions, M as MobileAuthService, Mt as RolePermissionCollection, N as readMobileBearerToken, Nt as PermissionCatalogService, O as getRequestScopedDatabase, Ot as assertTenantTableName, P as validateMobileRedirectUri, Pt as deriveOperationPermissionCollectionName, Q as SessionService, Qt as GroupMember, R as encodeOidcTransaction, Rt as syncPermissionCatalog, S as outOfBandProofSessionData, St as TenantPermissionOverride, T as checkOperationPermission, Tt as MAX_TENANT_HIERARCHY_DEPTH, U as DEFAULT_PIN_MANAGE_PERMISSION, Ut as PermissionCollection, Vt as UsersPinCredentialCollection, W as DeviceCredentialError, Wt as UsersPasswordCredentialCollection, X as PinVerifier, Xt as GroupRole, Y as PIN_PERMISSION_DEFINITIONS, Yt as GroupRoleCollection, Z as ensurePinPermissionsRegistered, Zt as GroupMemberCollection, _ as PasswordCredentialError, _n as Membership, _t as UserCollection, a as TerminalAuthError, an as UsersCliAuthRequestCollection, at as DEFAULT_SOURCE_LOCKOUT_AUDIT_SECONDS, b as PasswordPolicyError, bt as backfillUserEmailKeys, c as DEFAULT_PASSWORD_DENYLIST, cn as User, ct as LoginAttemptLimiter, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as DEFAULT_SESSION_TTL, dt as ANCESTOR_READ_ACTION, en as Group, et as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, f as DEFAULT_PASSWORD_RECOVERY_MAX_AGE_SECONDS, fn as SESSION_DATA_KEYS, ft as DEFAULT_ANCESTOR_READ_MAX_DEPTH, g as PASSWORD_RECOVERY_MAX_AGE_CEILING_SECONDS, gn as Permission, gt as OidcProvisioningError, h as PASSWORD_PERMISSION_DEFINITIONS, hn as Role, ht as normalizeAncestorReadPolicy, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAttempt, it as DEFAULT_LOGIN_MAX_ATTEMPTS, j as MobileAuthError, jt as DEFAULT_ROLE_PERMISSION_PATTERNS, k as withPrincipalPermissionContext, kt as planTenantHierarchy, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as isValidEmail, lt as LoginRateLimitError, m as PASSWORD_MAX_LENGTH_CEILING, mn as generateSessionId, mt as isAncestorReadableSlug, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as UsersLoginAuditEvent, nt as DEFAULT_LOGIN_LOCKOUT_FACTOR, o as TerminalAuthRateLimitError, on as SessionCollection, ot as DurableLoginAuditSink, p as PASSWORD_LOGIN_KIND, pn as Session, pt as getConfiguredAncestorReadPolicy, q as DeviceCredentialService, qt as MembershipOverride, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAttemptCollection, rt as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, s as TerminalAuthService, sn as UsersCliAuthRequest, st as InvalidCredentialsError, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as UsersLoginAuditEventCollection, tt as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as normalizeEmail, ut as withoutListBounds, v as PasswordCredentialForbiddenError, w as assertOperationPermission, wt as Tenant, x as ensurePasswordPermissionsRegistered, xt as TenantPermissionOverrideCollection, y as PasswordCredentialService, yt as UserEmailKeyBackfillError, z as getUsersOidcConfig, zt as RolePermission } from "./chunks/TerminalAuthService-DUJYJWPP.js";
+import { $ as PermissionResolver, $t as GroupCollection, A as withSessionPermissionContext, At as recordTenantHierarchyChanges, B as resolveOidcProviderConfig, Bt as RoleCollection, C as OperationPermissionError, Ct as TenantCollection, D as getCurrentSessionPermissionContext, Dt as applyTenantHierarchyUpdates, E as hasOperationPermission, Et as TenantHierarchyError, F as OidcLoginError, Ft as deriveOperationPermissionSlug, G as DeviceCredentialForbiddenError, Gt as UsersPasswordCredential, H as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, Ht as UsersPinCredential, I as OidcLoginService, It as normalizeOperationPermissionAction, J as PIN_LOGIN_KIND, Jt as MembershipCollection, K as DeviceCredentialPolicyError, Kt as MembershipOverrideCollection, L as decodeOidcTransaction, Lt as registerPermissionDefinitions, M as MobileAuthService, Mt as RolePermissionCollection, N as readMobileBearerToken, Nt as PermissionCatalogService, O as getRequestScopedDatabase, Ot as assertTenantTableName, P as validateMobileRedirectUri, Pt as deriveOperationPermissionCollectionName, Q as SessionService, Qt as GroupMember, R as encodeOidcTransaction, Rt as syncPermissionCatalog, S as outOfBandProofSessionData, St as TenantPermissionOverride, T as checkOperationPermission, Tt as MAX_TENANT_HIERARCHY_DEPTH, U as DEFAULT_PIN_MANAGE_PERMISSION, Ut as PermissionCollection, Vt as UsersPinCredentialCollection, W as DeviceCredentialError, Wt as UsersPasswordCredentialCollection, X as PinVerifier, Xt as GroupRole, Y as PIN_PERMISSION_DEFINITIONS, Yt as GroupRoleCollection, Z as ensurePinPermissionsRegistered, Zt as GroupMemberCollection, _ as PasswordCredentialError, _n as Membership, _t as UserCollection, a as TerminalAuthError, an as UsersCliAuthRequestCollection, at as DEFAULT_SOURCE_LOCKOUT_AUDIT_SECONDS, b as PasswordPolicyError, bt as backfillUserEmailKeys, c as DEFAULT_PASSWORD_DENYLIST, cn as User, ct as LoginAttemptLimiter, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as DEFAULT_SESSION_TTL, dt as ANCESTOR_READ_ACTION, en as Group, et as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, f as DEFAULT_PASSWORD_RECOVERY_MAX_AGE_SECONDS, fn as SESSION_DATA_KEYS, ft as DEFAULT_ANCESTOR_READ_MAX_DEPTH, g as PASSWORD_RECOVERY_MAX_AGE_CEILING_SECONDS, gn as Permission, gt as OidcProvisioningError, h as PASSWORD_PERMISSION_DEFINITIONS, hn as Role, ht as normalizeAncestorReadPolicy, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAttempt, it as DEFAULT_LOGIN_MAX_ATTEMPTS, j as MobileAuthError, jt as DEFAULT_ROLE_PERMISSION_PATTERNS, k as withPrincipalPermissionContext, kt as planTenantHierarchy, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as isValidEmail, lt as LoginRateLimitError, m as PASSWORD_MAX_LENGTH_CEILING, mn as generateSessionId, mt as isAncestorReadableSlug, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as UsersLoginAuditEvent, nt as DEFAULT_LOGIN_LOCKOUT_FACTOR, o as TerminalAuthRateLimitError, on as SessionCollection, ot as DurableLoginAuditSink, p as PASSWORD_LOGIN_KIND, pn as Session, pt as getConfiguredAncestorReadPolicy, q as DeviceCredentialService, qt as MembershipOverride, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAttemptCollection, rt as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, s as TerminalAuthService, sn as UsersCliAuthRequest, st as InvalidCredentialsError, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as UsersLoginAuditEventCollection, tt as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as normalizeEmail, ut as withoutListBounds, v as PasswordCredentialForbiddenError, w as assertOperationPermission, wt as Tenant, x as ensurePasswordPermissionsRegistered, xt as TenantPermissionOverrideCollection, y as PasswordCredentialService, yt as UserEmailKeyBackfillError, z as getUsersOidcConfig, zt as RolePermission } from "./chunks/TerminalAuthService-4g2zNk0B.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
-import { ObjectRegistry, SmrtCollection, SmrtObject, SmrtRecipe, bumpChangeFeed, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
+import { ObjectRegistry, SmrtCollection, SmrtObject, SmrtRecipe, bumpChangeFeed, crossPackageRef, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
+import { TenantScoped, getTenantId, tenantId, withSystemContext, withTenant, withTenantGlobalRead } from "@happyvertical/smrt-tenancy";
 import { PROFILE_EMAIL_KEY_BACKFILL_NAME, Person, ProfileCollection, ProfileTypeCollection, normalizeIdentityEmail } from "@happyvertical/smrt-profiles";
 import { createHash, randomUUID } from "node:crypto";
 import { setTimeout } from "node:timers/promises";
-import { TenantScoped, tenantId, withSystemContext } from "@happyvertical/smrt-tenancy";
 import { createLogger } from "@happyvertical/logger";
 import { BackfillTracker } from "@happyvertical/smrt-core/migrations";
 import { OAuthServerError } from "@happyvertical/auth/server";
+//#region src/member-register/models.ts
+var __defProp$6 = Object.defineProperty;
+var __getOwnPropDesc$6 = Object.getOwnPropertyDescriptor;
+var __defNormalProp$6 = (obj, key, value) => key in obj ? __defProp$6(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass$6 = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$6(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp$6(target, key, result);
+	return result;
+};
+var __publicField$6 = (obj, key, value) => __defNormalProp$6(obj, typeof key !== "symbol" ? key + "" : key, value);
+var MemberClass = class extends SmrtObject {
+	tenantId = "";
+	key = "";
+	name = "";
+	description = "";
+	policyMetadata = null;
+};
+__publicField$6(MemberClass, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$6([tenantId()], MemberClass.prototype, "tenantId", 2);
+__decorateClass$6([field({ type: "text" })], MemberClass.prototype, "key", 2);
+__decorateClass$6([field({
+	type: "json",
+	nullable: true
+})], MemberClass.prototype, "policyMetadata", 2);
+MemberClass = __decorateClass$6([TenantScoped({ mode: "required" }), smrt({
+	tableName: "member_classes",
+	sensitive: true,
+	indexes: [{
+		name: "member_classes_tenant_key_uq",
+		columns: ["tenantId", "key"],
+		unique: true
+	}],
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], MemberClass);
+var LegalMember = class extends SmrtObject {
+	tenantId = "";
+	memberClassId = "";
+	kind = "individual";
+	displayName = "";
+	userId = null;
+	profileId = null;
+	externalPartyRef = null;
+	joinedOn = "";
+	leftOn = null;
+	status = "active";
+};
+__publicField$6(LegalMember, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$6([tenantId()], LegalMember.prototype, "tenantId", 2);
+__decorateClass$6([foreignKey("MemberClass", { onDelete: "RESTRICT" })], LegalMember.prototype, "memberClassId", 2);
+__decorateClass$6([field({ type: "text" })], LegalMember.prototype, "kind", 2);
+__decorateClass$6([foreignKey("User", {
+	nullable: true,
+	onDelete: "RESTRICT"
+})], LegalMember.prototype, "userId", 2);
+__decorateClass$6([crossPackageRef("@happyvertical/smrt-profiles:Profile", {
+	nullable: true,
+	onDelete: "RESTRICT"
+})], LegalMember.prototype, "profileId", 2);
+__decorateClass$6([field({
+	type: "text",
+	nullable: true
+})], LegalMember.prototype, "externalPartyRef", 2);
+__decorateClass$6([field({ type: "text" })], LegalMember.prototype, "joinedOn", 2);
+__decorateClass$6([field({
+	type: "text",
+	nullable: true
+})], LegalMember.prototype, "leftOn", 2);
+__decorateClass$6([field({ type: "text" })], LegalMember.prototype, "status", 2);
+LegalMember = __decorateClass$6([TenantScoped({ mode: "required" }), smrt({
+	tableName: "legal_members",
+	sensitive: true,
+	indexes: [{
+		name: "legal_members_tenant_class_status_idx",
+		columns: [
+			"tenantId",
+			"memberClassId",
+			"status"
+		]
+	}, {
+		name: "legal_members_tenant_user_idx",
+		columns: ["tenantId", "userId"]
+	}],
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], LegalMember);
+var LegalMemberStatusHistory = class extends SmrtObject {
+	tenantId = "";
+	memberId = "";
+	status = "active";
+	effectiveOn = "";
+	sequence = 0;
+	reason = "";
+	actorRef = null;
+	/** History is corrected by appending another effective entry, never rewriting it. */
+	async save() {
+		if (this.id && await this.db.get(this.tableName, { id: this.id })) throw new Error("Legal member status history is append-only.");
+		this.requireInsertOnSave();
+		return super.save();
+	}
+	async delete() {
+		throw new Error("Legal member status history cannot be deleted.");
+	}
+};
+__publicField$6(LegalMemberStatusHistory, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$6([tenantId()], LegalMemberStatusHistory.prototype, "tenantId", 2);
+__decorateClass$6([foreignKey("LegalMember", { onDelete: "RESTRICT" })], LegalMemberStatusHistory.prototype, "memberId", 2);
+__decorateClass$6([field({ type: "text" })], LegalMemberStatusHistory.prototype, "status", 2);
+__decorateClass$6([field({ type: "text" })], LegalMemberStatusHistory.prototype, "effectiveOn", 2);
+__decorateClass$6([field({ type: "integer" })], LegalMemberStatusHistory.prototype, "sequence", 2);
+__decorateClass$6([field({
+	type: "text",
+	nullable: true
+})], LegalMemberStatusHistory.prototype, "actorRef", 2);
+LegalMemberStatusHistory = __decorateClass$6([TenantScoped({ mode: "required" }), smrt({
+	tableName: "legal_member_status_history",
+	sensitive: true,
+	indexes: [{
+		name: "legal_member_status_history_member_on_idx",
+		columns: [
+			"tenantId",
+			"memberId",
+			"effectiveOn"
+		]
+	}],
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], LegalMemberStatusHistory);
+var LegalMemberReference = class extends SmrtObject {
+	tenantId = "";
+	memberId = "";
+	kind = "share";
+	/** Qualified external model name or host namespace, e.g. @happyvertical/smrt-ledgers:JournalEntry. */
+	sourceType = "";
+	sourceId = "";
+	authoritative = false;
+	effectiveFrom = "";
+	effectiveTo = null;
+	revokesId = null;
+	async save() {
+		if (this.id && await this.db.get(this.tableName, { id: this.id })) throw new Error("Legal member references are append-only.");
+		this.requireInsertOnSave();
+		return super.save();
+	}
+	async delete() {
+		throw new Error("Legal member references cannot be deleted.");
+	}
+};
+__publicField$6(LegalMemberReference, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$6([tenantId()], LegalMemberReference.prototype, "tenantId", 2);
+__decorateClass$6([foreignKey("LegalMember", { onDelete: "RESTRICT" })], LegalMemberReference.prototype, "memberId", 2);
+__decorateClass$6([field({ type: "text" })], LegalMemberReference.prototype, "kind", 2);
+__decorateClass$6([field({ type: "boolean" })], LegalMemberReference.prototype, "authoritative", 2);
+__decorateClass$6([field({ type: "text" })], LegalMemberReference.prototype, "effectiveFrom", 2);
+__decorateClass$6([field({
+	type: "text",
+	nullable: true
+})], LegalMemberReference.prototype, "effectiveTo", 2);
+__decorateClass$6([foreignKey("LegalMemberReference", {
+	nullable: true,
+	onDelete: "RESTRICT"
+})], LegalMemberReference.prototype, "revokesId", 2);
+LegalMemberReference = __decorateClass$6([TenantScoped({ mode: "required" }), smrt({
+	tableName: "legal_member_references",
+	sensitive: true,
+	indexes: [{
+		name: "legal_member_references_member_kind_idx",
+		columns: [
+			"tenantId",
+			"memberId",
+			"kind"
+		]
+	}],
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], LegalMemberReference);
+var MemberOfficerAppointment = class extends SmrtObject {
+	tenantId = "";
+	memberId = "";
+	role = "";
+	effectiveFrom = "";
+	effectiveTo = null;
+	authority = null;
+};
+__publicField$6(MemberOfficerAppointment, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$6([tenantId()], MemberOfficerAppointment.prototype, "tenantId", 2);
+__decorateClass$6([foreignKey("LegalMember", { onDelete: "RESTRICT" })], MemberOfficerAppointment.prototype, "memberId", 2);
+__decorateClass$6([field({ type: "text" })], MemberOfficerAppointment.prototype, "role", 2);
+__decorateClass$6([field({ type: "text" })], MemberOfficerAppointment.prototype, "effectiveFrom", 2);
+__decorateClass$6([field({
+	type: "text",
+	nullable: true
+})], MemberOfficerAppointment.prototype, "effectiveTo", 2);
+__decorateClass$6([field({
+	type: "json",
+	nullable: true
+})], MemberOfficerAppointment.prototype, "authority", 2);
+MemberOfficerAppointment = __decorateClass$6([TenantScoped({ mode: "required" }), smrt({
+	tableName: "member_officer_appointments",
+	sensitive: true,
+	indexes: [{
+		name: "member_officer_appointments_member_term_idx",
+		columns: [
+			"tenantId",
+			"memberId",
+			"effectiveFrom"
+		]
+	}],
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], MemberOfficerAppointment);
+var MemberEligibilitySnapshot = class extends SmrtObject {
+	tenantId = "";
+	memberId = "";
+	recordDate = "";
+	eligible = false;
+	reason = "";
+	evidence = null;
+	/** Record-date evidence is immutable; a later request creates a new snapshot. */
+	async save() {
+		if (this.id && await this.db.get(this.tableName, { id: this.id })) throw new Error("Member eligibility snapshots are immutable.");
+		this.requireInsertOnSave();
+		return super.save();
+	}
+	async delete() {
+		throw new Error("Member eligibility snapshots cannot be deleted.");
+	}
+};
+__publicField$6(MemberEligibilitySnapshot, "__smrtPackage__", "@happyvertical/smrt-users");
+__decorateClass$6([tenantId()], MemberEligibilitySnapshot.prototype, "tenantId", 2);
+__decorateClass$6([foreignKey("LegalMember", { onDelete: "RESTRICT" })], MemberEligibilitySnapshot.prototype, "memberId", 2);
+__decorateClass$6([field({ type: "text" })], MemberEligibilitySnapshot.prototype, "recordDate", 2);
+__decorateClass$6([field({ type: "boolean" })], MemberEligibilitySnapshot.prototype, "eligible", 2);
+__decorateClass$6([field({
+	type: "json",
+	nullable: true
+})], MemberEligibilitySnapshot.prototype, "evidence", 2);
+MemberEligibilitySnapshot = __decorateClass$6([TenantScoped({ mode: "required" }), smrt({
+	tableName: "member_eligibility_snapshots",
+	sensitive: true,
+	indexes: [{
+		name: "member_eligibility_snapshots_tenant_date_idx",
+		columns: ["tenantId", "recordDate"]
+	}],
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], MemberEligibilitySnapshot);
+var MemberClassCollection = class extends SmrtCollection {};
+__publicField$6(MemberClassCollection, "__smrtPackage__", "@happyvertical/smrt-users");
+__publicField$6(MemberClassCollection, "_itemClass", MemberClass);
+MemberClassCollection = __decorateClass$6([smrt({
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], MemberClassCollection);
+var LegalMemberCollection = class extends SmrtCollection {};
+__publicField$6(LegalMemberCollection, "__smrtPackage__", "@happyvertical/smrt-users");
+__publicField$6(LegalMemberCollection, "_itemClass", LegalMember);
+LegalMemberCollection = __decorateClass$6([smrt({
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], LegalMemberCollection);
+var LegalMemberStatusHistoryCollection = class extends SmrtCollection {};
+__publicField$6(LegalMemberStatusHistoryCollection, "__smrtPackage__", "@happyvertical/smrt-users");
+__publicField$6(LegalMemberStatusHistoryCollection, "_itemClass", LegalMemberStatusHistory);
+LegalMemberStatusHistoryCollection = __decorateClass$6([smrt({
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], LegalMemberStatusHistoryCollection);
+var LegalMemberReferenceCollection = class extends SmrtCollection {};
+__publicField$6(LegalMemberReferenceCollection, "__smrtPackage__", "@happyvertical/smrt-users");
+__publicField$6(LegalMemberReferenceCollection, "_itemClass", LegalMemberReference);
+LegalMemberReferenceCollection = __decorateClass$6([smrt({
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], LegalMemberReferenceCollection);
+var MemberOfficerAppointmentCollection = class extends SmrtCollection {};
+__publicField$6(MemberOfficerAppointmentCollection, "__smrtPackage__", "@happyvertical/smrt-users");
+__publicField$6(MemberOfficerAppointmentCollection, "_itemClass", MemberOfficerAppointment);
+MemberOfficerAppointmentCollection = __decorateClass$6([smrt({
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], MemberOfficerAppointmentCollection);
+var MemberEligibilitySnapshotCollection = class extends SmrtCollection {};
+__publicField$6(MemberEligibilitySnapshotCollection, "__smrtPackage__", "@happyvertical/smrt-users");
+__publicField$6(MemberEligibilitySnapshotCollection, "_itemClass", MemberEligibilitySnapshot);
+MemberEligibilitySnapshotCollection = __decorateClass$6([smrt({
+	api: { include: [] },
+	mcp: { include: [] },
+	cli: false
+})], MemberEligibilitySnapshotCollection);
+//#endregion
+//#region src/member-register/service.ts
+var ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+var MEMBER_STATUSES = [
+	"active",
+	"suspended",
+	"resigned",
+	"ceased"
+];
+var REFERENCE_KINDS = [
+	"share",
+	"dues",
+	"subscription",
+	"agreement",
+	"ledger"
+];
+function compareHistory(a, b) {
+	return a.effectiveOn.localeCompare(b.effectiveOn) || a.sequence - b.sequence;
+}
+function date(value, field) {
+	if (typeof value !== "string" || !ISO_DATE.test(value) || Number.isNaN(Date.parse(`${value}T00:00:00Z`))) throw new MemberRegisterError("MEMBER_REGISTER_INVALID", `${field} must be YYYY-MM-DD.`);
+	if ((/* @__PURE__ */ new Date(`${value}T00:00:00.000Z`)).toISOString().slice(0, 10) !== value) throw new MemberRegisterError("MEMBER_REGISTER_INVALID", `${field} must be a calendar date.`);
+	return value;
+}
+function text(value, field) {
+	if (typeof value !== "string" || !value.trim()) throw new MemberRegisterError("MEMBER_REGISTER_INVALID", `${field} is required.`);
+	return value.trim();
+}
+var MemberRegisterError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "MemberRegisterError";
+	}
+	code;
+};
+var MemberRegisterService = class MemberRegisterService {
+	constructor(db, actor, transactionBound) {
+		this.db = db;
+		this.actor = actor;
+		this.transactionBound = transactionBound;
+		text(actor?.tenantId, "tenantId");
+	}
+	db;
+	actor;
+	transactionBound;
+	static transactionToken = /* @__PURE__ */ Symbol("member-register-transaction");
+	transaction(operation) {
+		if (!this.db.transaction) throw new MemberRegisterError("MEMBER_REGISTER_INVALID", "Member register writes require transaction support.");
+		return this.db.transaction((db) => operation(new MemberRegisterService(db, this.actor, MemberRegisterService.transactionToken)));
+	}
+	scope(run) {
+		const active = getTenantId();
+		if (active && active !== this.actor.tenantId) throw new MemberRegisterError("MEMBER_REGISTER_TENANT_MISMATCH", "Actor differs from active tenant.");
+		return withTenant({ tenantId: this.actor.tenantId }, run);
+	}
+	async member(memberId) {
+		const member = await (await LegalMemberCollection.create({ db: this.db })).get({
+			id: text(memberId, "memberId"),
+			tenantId: this.actor.tenantId
+		});
+		if (!member) throw new MemberRegisterError("MEMBER_REGISTER_NOT_FOUND", "Member not found in this tenant.");
+		return member;
+	}
+	assertReferenceKind(kind) {
+		if (!REFERENCE_KINDS.includes(kind)) throw new MemberRegisterError("MEMBER_REGISTER_INVALID", "Unknown member reference kind.");
+	}
+	async addClass(input) {
+		return this.scope(async () => {
+			return await (await MemberClassCollection.create({ db: this.db })).create({
+				tenantId: this.actor.tenantId,
+				key: text(input.key, "key"),
+				name: text(input.name, "name"),
+				description: input.description?.trim() ?? "",
+				policyMetadata: input.policyMetadata ?? null
+			});
+		});
+	}
+	async enroll(input) {
+		if (this.transactionBound !== MemberRegisterService.transactionToken) {
+			const member = await this.transaction((service) => service.enroll(input));
+			return this.scope(() => this.member(member.id));
+		}
+		return this.scope(async () => {
+			const joinedOn = date(input.joinedOn, "joinedOn");
+			if (input.kind !== "individual" && input.kind !== "organisation") throw new MemberRegisterError("MEMBER_REGISTER_INVALID", "kind must be individual or organisation.");
+			const klass = await (await MemberClassCollection.create({ db: this.db })).get({
+				id: text(input.memberClassId, "memberClassId"),
+				tenantId: this.actor.tenantId
+			});
+			if (!klass) throw new MemberRegisterError("MEMBER_REGISTER_NOT_FOUND", "Member class not found in this tenant.");
+			if (input.profileId != null) {
+				const profiles = await ProfileCollection.create({ db: this.db });
+				const profile = (await withTenantGlobalRead(this.actor.tenantId, () => profiles.list({
+					where: { id: text(input.profileId, "profileId") },
+					limit: 1
+				})))[0];
+				if (!profile || profile.tenantId !== null && profile.tenantId !== this.actor.tenantId) throw new MemberRegisterError("MEMBER_REGISTER_NOT_FOUND", "Profile not found in this tenant or global scope.");
+			}
+			const member = await (await LegalMemberCollection.create({ db: this.db })).create({
+				tenantId: this.actor.tenantId,
+				memberClassId: klass.id,
+				kind: input.kind,
+				displayName: text(input.displayName, "displayName"),
+				joinedOn,
+				userId: input.userId ?? null,
+				profileId: input.profileId ?? null,
+				externalPartyRef: input.externalPartyRef?.trim() || null,
+				status: "active"
+			});
+			await (await LegalMemberStatusHistoryCollection.create({ db: this.db })).create({
+				tenantId: this.actor.tenantId,
+				memberId: member.id,
+				status: "active",
+				effectiveOn: joinedOn,
+				sequence: 1,
+				reason: "joined",
+				actorRef: this.actor.actorRef ?? null
+			});
+			return member;
+		});
+	}
+	async setStatus(memberId, input) {
+		if (this.transactionBound !== MemberRegisterService.transactionToken) {
+			const member = await this.transaction((service) => service.setStatus(memberId, input));
+			return this.scope(() => this.member(member.id));
+		}
+		return this.scope(async () => {
+			const member = await this.member(memberId);
+			const effectiveOn = date(input.effectiveOn, "effectiveOn");
+			if (!MEMBER_STATUSES.includes(input.status)) throw new MemberRegisterError("MEMBER_REGISTER_INVALID", "Unknown member status.");
+			const histories = await LegalMemberStatusHistoryCollection.create({ db: this.db });
+			const prior = await histories.list({ where: {
+				tenantId: this.actor.tenantId,
+				memberId: member.id
+			} });
+			await histories.create({
+				tenantId: this.actor.tenantId,
+				memberId: member.id,
+				status: input.status,
+				effectiveOn,
+				sequence: Math.max(0, ...prior.map((entry) => entry.sequence ?? 0)) + 1,
+				reason: input.reason?.trim() ?? "",
+				actorRef: this.actor.actorRef ?? null
+			});
+			const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+			const current = (await histories.list({ where: {
+				tenantId: this.actor.tenantId,
+				memberId: member.id
+			} })).filter((entry) => entry.effectiveOn <= today).sort(compareHistory).at(-1);
+			member.status = current?.status ?? "active";
+			member.leftOn = current?.status === "resigned" || current?.status === "ceased" ? current.effectiveOn : null;
+			await member.save();
+			return member;
+		});
+	}
+	async addReference(memberId, input) {
+		return this.scope(async () => {
+			const member = await this.member(memberId);
+			this.assertReferenceKind(input.kind);
+			const effectiveFrom = date(input.effectiveFrom, "effectiveFrom");
+			const effectiveTo = input.effectiveTo == null ? null : date(input.effectiveTo, "effectiveTo");
+			if (effectiveTo && effectiveTo < effectiveFrom) throw new MemberRegisterError("MEMBER_REGISTER_INVALID", "effectiveTo must not precede effectiveFrom.");
+			return await (await LegalMemberReferenceCollection.create({ db: this.db })).create({
+				tenantId: this.actor.tenantId,
+				memberId: member.id,
+				kind: input.kind,
+				sourceType: text(input.sourceType, "sourceType"),
+				sourceId: text(input.sourceId, "sourceId"),
+				authoritative: input.authoritative === true,
+				effectiveFrom,
+				effectiveTo
+			});
+		});
+	}
+	/** Append a dated withdrawal without changing past evidence or snapshots. */
+	async revokeReference(referenceId, input) {
+		return this.scope(async () => {
+			const refs = await LegalMemberReferenceCollection.create({ db: this.db });
+			const reference = await refs.get({
+				id: text(referenceId, "referenceId"),
+				tenantId: this.actor.tenantId
+			});
+			if (!reference) throw new MemberRegisterError("MEMBER_REGISTER_NOT_FOUND", "Reference not found in this tenant.");
+			const effectiveFrom = date(input.effectiveOn, "effectiveOn");
+			if (reference.revokesId || effectiveFrom < reference.effectiveFrom) throw new MemberRegisterError("MEMBER_REGISTER_INVALID", "Revoke original evidence on or after its effectiveFrom date.");
+			return refs.create({
+				tenantId: this.actor.tenantId,
+				memberId: reference.memberId,
+				kind: reference.kind,
+				sourceType: reference.sourceType,
+				sourceId: reference.sourceId,
+				authoritative: false,
+				effectiveFrom,
+				revokesId: reference.id
+			});
+		});
+	}
+	async appoint(memberId, input) {
+		return this.scope(async () => {
+			const member = await this.member(memberId);
+			const from = date(input.effectiveFrom, "effectiveFrom");
+			const to = input.effectiveTo == null ? null : date(input.effectiveTo, "effectiveTo");
+			if (to && to < from) throw new MemberRegisterError("MEMBER_REGISTER_INVALID", "effectiveTo must not precede effectiveFrom.");
+			return await (await MemberOfficerAppointmentCollection.create({ db: this.db })).create({
+				tenantId: this.actor.tenantId,
+				memberId: member.id,
+				role: text(input.role, "role"),
+				effectiveFrom: from,
+				effectiveTo: to,
+				authority: input.authority ?? null
+			});
+		});
+	}
+	async asOf(recordDate, policy = {}) {
+		if (this.transactionBound !== MemberRegisterService.transactionToken) return this.transaction((service) => service.asOf(recordDate, policy));
+		return this.scope(async () => {
+			const on = date(recordDate, "recordDate");
+			const memberClassKeys = policy.memberClassKeys === void 0 ? null : [...policy.memberClassKeys];
+			const statuses = [...policy.statuses ?? ["active"]];
+			const requiredAuthoritativeKinds = [...policy.requireAuthoritativeKinds ?? []];
+			const members = await LegalMemberCollection.create({ db: this.db });
+			const classes = await MemberClassCollection.create({ db: this.db });
+			const histories = await LegalMemberStatusHistoryCollection.create({ db: this.db });
+			const refs = await LegalMemberReferenceCollection.create({ db: this.db });
+			const snapshots = await MemberEligibilitySnapshotCollection.create({ db: this.db });
+			const rows = [];
+			for (const member of await members.list({ where: { tenantId: this.actor.tenantId } })) {
+				const klass = await classes.get({
+					id: member.memberClassId,
+					tenantId: this.actor.tenantId
+				});
+				const status = (await histories.list({ where: {
+					tenantId: this.actor.tenantId,
+					memberId: member.id
+				} })).filter((entry) => entry.effectiveOn <= on).sort(compareHistory).at(-1)?.status;
+				const allRefs = await refs.list({ where: {
+					tenantId: this.actor.tenantId,
+					memberId: member.id
+				} });
+				const revoked = new Set(allRefs.filter((reference) => reference.revokesId && reference.effectiveFrom <= on).map((reference) => reference.revokesId));
+				const memberRefs = allRefs.filter((reference) => !reference.revokesId && !revoked.has(reference.id) && reference.effectiveFrom <= on && (reference.effectiveTo === null || reference.effectiveTo >= on));
+				const missing = requiredAuthoritativeKinds.filter((kind) => !memberRefs.some((reference) => reference.kind === kind && reference.authoritative));
+				const classOK = memberClassKeys === null || !!klass && memberClassKeys.includes(klass.key);
+				const statusOK = !!status && statuses.includes(status);
+				const eligible = member.joinedOn <= on && classOK && statusOK && missing.length === 0;
+				const reason = missing.length ? `authoritative evidence unavailable: ${missing.join(", ")}` : !classOK ? "member class excluded by policy" : !statusOK ? `status ${status ?? "unrecorded"} excluded by policy` : member.joinedOn > on ? "joined after record date" : "eligible";
+				const evidence = {
+					status,
+					memberClassKeys,
+					statuses,
+					requiredAuthoritativeKinds,
+					missingAuthoritativeKinds: missing,
+					referenceCount: memberRefs.length
+				};
+				const row = {
+					memberId: member.id,
+					displayName: member.displayName,
+					memberClassKey: klass?.key ?? "",
+					recordDate: on,
+					eligible,
+					reason,
+					evidence
+				};
+				await snapshots.create({
+					tenantId: this.actor.tenantId,
+					memberId: row.memberId,
+					recordDate: on,
+					eligible,
+					reason,
+					evidence
+				});
+				rows.push(row);
+			}
+			return rows;
+		});
+	}
+	static exportJson(rows) {
+		return JSON.stringify(rows);
+	}
+	static exportCsv(rows) {
+		const q = (value) => {
+			const text2 = String(value ?? "");
+			return `"${(/^[=+\-@]/.test(text2) ? `'${text2}` : text2).replaceAll("\"", "\"\"")}"`;
+		};
+		return `${["memberId,displayName,memberClassKey,recordDate,eligible,reason", ...rows.map((row) => [
+			row.memberId,
+			row.displayName,
+			row.memberClassKey,
+			row.recordDate,
+			row.eligible,
+			row.reason
+		].map(q).join(","))].join("\n")}
+`;
+	}
+};
+//#endregion
 //#region src/models/ResourceGrant.ts
 var __defProp$5 = Object.defineProperty;
 var __getOwnPropDesc$5 = Object.getOwnPropertyDescriptor;
@@ -1948,7 +2552,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-DUJYJWPP.js").then((n) => n.V);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-4g2zNk0B.js").then((n) => n.V);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -1977,7 +2581,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-DUJYJWPP.js").then((n) => n.V);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-4g2zNk0B.js").then((n) => n.V);
 		const key = await this.getSigningKey();
 		let payload;
 		try {
@@ -2973,6 +3577,6 @@ var TenantService = class TenantService {
 //#region src/index.ts
 registerUserRetentionTasks();
 //#endregion
-export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_DEVICE_PERSON_IDLE_SECONDS, DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, DEFAULT_LOGIN_AUDIT_RETENTION_DAYS, DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, DEFAULT_LOGIN_LOCKOUT_FACTOR, DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, DEFAULT_LOGIN_MAX_ATTEMPTS, DEFAULT_PASSWORD_DENYLIST, DEFAULT_PASSWORD_MANAGE_PERMISSION, DEFAULT_PASSWORD_MAX_LENGTH, DEFAULT_PASSWORD_MIN_LENGTH, DEFAULT_PASSWORD_RECOVERY_MAX_AGE_SECONDS, DEFAULT_PIN_MANAGE_PERMISSION, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_SOURCE_LOCKOUT_AUDIT_SECONDS, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, DeviceCredentialError, DeviceCredentialForbiddenError, DeviceCredentialPolicyError, DeviceCredentialService, DurableLoginAuditSink, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, InvalidCredentialsError, LEGACY_USER_PROFILE_BACKFILL_NAME, LOGIN_ATTEMPTS_RETENTION_TASK, LOGIN_AUDIT_RETENTION_TASK, LegacyUserProfileBackfillError, LoginAttemptLimiter, LoginRateLimitError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OAUTH_CREDENTIALS_RETENTION_TASK, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, PASSWORD_LOGIN_KIND, PASSWORD_MAX_LENGTH_CEILING, PASSWORD_PERMISSION_DEFINITIONS, PASSWORD_RECOVERY_MAX_AGE_CEILING_SECONDS, PIN_LOGIN_KIND, PIN_PERMISSION_DEFINITIONS, PasswordCredentialError, PasswordCredentialForbiddenError, PasswordCredentialService, PasswordPolicyError, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, PinVerifier, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, SESSION_DATA_KEYS, SMRT_OAUTH_GRANT_CLAIM, Session, SessionCollection, SessionService, SessionStatus, SmrtOAuthAuthorizationService, SmrtOAuthAuthorizationStorage, TERMINAL_APPROVE_LOGIN_KIND, Tenant, TenantCollection, TenantHierarchyError, TenantHierarchyMaterializationError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, UsersLoginAttempt, UsersLoginAttemptCollection, UsersLoginAuditEvent, UsersLoginAuditEventCollection, UsersOAuthAccessTokenRevocation, UsersOAuthAccessTokenRevocationCollection, UsersOAuthAuthorization, UsersOAuthAuthorizationCode, UsersOAuthAuthorizationCodeCollection, UsersOAuthAuthorizationCollection, UsersOAuthClient, UsersOAuthClientCollection, UsersOAuthRefreshFamily, UsersOAuthRefreshFamilyCollection, UsersOAuthRefreshGrant, UsersOAuthRefreshGrantCollection, UsersPasswordCredential, UsersPasswordCredentialCollection, UsersPinCredential, UsersPinCredentialCollection, UsersRolesAndPermissionsRecipe, UsersSignInRecipe, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deduplicateAuthorityPairs, deduplicateRolePermissions, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, ensurePasswordPermissionsRegistered, ensurePinPermissionsRegistered, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, materializeTenantHierarchy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, outOfBandProofSessionData, planTenantHierarchy, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
+export { ACCESS_REQUEST_CAPABILITIES, ANCESTOR_READ_ACTION, AccessRequest, AccessRequestCollection, AccessRequestError, AccessRequestService, AccessRequestStatus, CLI_AUTH_RETENTION_TASK, UsersCliAuthRequest as CliAuthRequest, UsersCliAuthRequest, UsersCliAuthRequestCollection as CliAuthRequestCollection, UsersCliAuthRequestCollection, DEFAULT_ANCESTOR_READ_MAX_DEPTH, DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, DEFAULT_CLI_SESSION_TTL_SECONDS, DEFAULT_DEVICE_PERSON_IDLE_SECONDS, DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, DEFAULT_LOGIN_AUDIT_RETENTION_DAYS, DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, DEFAULT_LOGIN_LOCKOUT_FACTOR, DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, DEFAULT_LOGIN_MAX_ATTEMPTS, DEFAULT_PASSWORD_DENYLIST, DEFAULT_PASSWORD_MANAGE_PERMISSION, DEFAULT_PASSWORD_MAX_LENGTH, DEFAULT_PASSWORD_MIN_LENGTH, DEFAULT_PASSWORD_RECOVERY_MAX_AGE_SECONDS, DEFAULT_PIN_MANAGE_PERMISSION, DEFAULT_ROLES, DEFAULT_ROLE_PERMISSION_PATTERNS, DEFAULT_ROLE_SLUGS, DEFAULT_SESSION_TTL, DEFAULT_SOURCE_LOCKOUT_AUDIT_SECONDS, DEFAULT_TENANT_POLICY, DEFAULT_TOKEN_EXPIRY_SECONDS, DeviceCredentialError, DeviceCredentialForbiddenError, DeviceCredentialPolicyError, DeviceCredentialService, DurableLoginAuditSink, Group, GroupCollection, GroupMember, GroupMemberCollection, GroupRole, GroupRoleCollection, InvalidCredentialsError, LEGACY_USER_PROFILE_BACKFILL_NAME, LOGIN_ATTEMPTS_RETENTION_TASK, LOGIN_AUDIT_RETENTION_TASK, LegacyUserProfileBackfillError, LegalMember, LegalMemberCollection, LegalMemberReference, LegalMemberReferenceCollection, LegalMemberStatusHistory, LegalMemberStatusHistoryCollection, LoginAttemptLimiter, LoginRateLimitError, MAGIC_LINK_RETENTION_TASK, MAX_RESOURCE_GRANT_DELEGATION_DEPTH, MAX_TENANT_HIERARCHY_DEPTH, MagicLinkError, MagicLinkService, UsersMagicLinkToken as MagicLinkToken, UsersMagicLinkToken, UsersMagicLinkTokenCollection as MagicLinkTokenCollection, UsersMagicLinkTokenCollection, MemberClass, MemberClassCollection, MemberEligibilitySnapshot, MemberEligibilitySnapshotCollection, MemberOfficerAppointment, MemberOfficerAppointmentCollection, MemberRegisterError, MemberRegisterService, Membership, MembershipCollection, MembershipOverride, MembershipOverrideCollection, MembershipStatus, MobileAuthError, MobileAuthService, OAUTH_CREDENTIALS_RETENTION_TASK, OidcLoginError, OidcLoginService, OidcProvisioningError, OperationPermissionError, OverrideEffect, PASSWORD_LOGIN_KIND, PASSWORD_MAX_LENGTH_CEILING, PASSWORD_PERMISSION_DEFINITIONS, PASSWORD_RECOVERY_MAX_AGE_CEILING_SECONDS, PIN_LOGIN_KIND, PIN_PERMISSION_DEFINITIONS, PasswordCredentialError, PasswordCredentialForbiddenError, PasswordCredentialService, PasswordPolicyError, Permission, PermissionCatalogService, PermissionCollection, PermissionResolver, PinVerifier, ResourceGrant, ResourceGrantCollection, ResourceGrantService, Role, RoleCollection, RolePermission, RolePermissionCollection, SESSIONS_RETENTION_TASK, SESSION_DATA_KEYS, SMRT_OAUTH_GRANT_CLAIM, Session, SessionCollection, SessionService, SessionStatus, SmrtOAuthAuthorizationService, SmrtOAuthAuthorizationStorage, TERMINAL_APPROVE_LOGIN_KIND, Tenant, TenantCollection, TenantHierarchyError, TenantHierarchyMaterializationError, TenantIntegration, TenantIntegrationCollection, TenantPermissionEffect, TenantPermissionOverride, TenantPermissionOverrideCollection, TenantService, TenantStatus, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, USER_RETENTION_TASKS, User, UserCollection, UserEmailKeyBackfillError, UserStatus, UsersCliAuthApproveLimit, UsersCliAuthApproveLimitCollection, UsersLoginAttempt, UsersLoginAttemptCollection, UsersLoginAuditEvent, UsersLoginAuditEventCollection, UsersOAuthAccessTokenRevocation, UsersOAuthAccessTokenRevocationCollection, UsersOAuthAuthorization, UsersOAuthAuthorizationCode, UsersOAuthAuthorizationCodeCollection, UsersOAuthAuthorizationCollection, UsersOAuthClient, UsersOAuthClientCollection, UsersOAuthRefreshFamily, UsersOAuthRefreshFamilyCollection, UsersOAuthRefreshGrant, UsersOAuthRefreshGrantCollection, UsersPasswordCredential, UsersPasswordCredentialCollection, UsersPinCredential, UsersPinCredentialCollection, UsersRolesAndPermissionsRecipe, UsersSignInRecipe, applyPostgresPermissionPolicies, assertOperationPermission, backfillLegacyUserProfiles, backfillUserEmailKeys, checkOperationPermission, checkResourceOperationPermission, decodeOidcTransaction, deduplicateAuthorityPairs, deduplicateRolePermissions, deriveOperationPermissionCollectionName, deriveOperationPermissionSlug, encodeOidcTransaction, ensurePasswordPermissionsRegistered, ensurePinPermissionsRegistered, generatePostgresPermissionSql, generateSessionId, getConfiguredAncestorReadPolicy, getCurrentSessionPermissionContext, getRequestScopedDatabase, getUsersOidcConfig, hasOperationPermission, isAncestorReadableSlug, materializeTenantHierarchy, normalizeAncestorReadPolicy, normalizeOperationPermissionAction, outOfBandProofSessionData, planTenantHierarchy, readMobileBearerToken, registerPermissionDefinitions, registerUserRetentionTasks, resolveOidcProviderConfig, syncPermissionCatalog, unregisterUserRetentionTasks, validateMobileRedirectUri, withPrincipalPermissionContext, withSessionPermissionContext };
 
 //# sourceMappingURL=index.js.map