@happyvertical/smrt-users 0.40.69 → 0.41.0

package/AGENTS.md

@@ -2,6 +2,12 @@
 
 Multi-tenant user management with RBAC, hierarchical tenants, session handling, and SvelteKit integration.
 
+## Modules
+
+| Module | Scope | Module doc |
+|---|---|---|
+| `src/retention.ts` | expired session/token/CLI-auth reaping and its wiring into the framework retention sweep | [agents/retention.md](agents/retention.md) |
+
 ## Models (14)
 
 | Model | Key Pattern |
@@ -295,9 +301,14 @@ the package root).
   private `oidc_profile_email_reservations.email_key`, `User.emailKey`, and the
   unique `User.profileId`; local callbacks acquire exact issuer/subject and normalized
   email locks in deterministic order so changed email claims also serialize.
-  SQLite and DuckDB callbacks additionally serialize transactions per database
-  URL because one adapter cannot safely overlap unrelated root transactions;
-  owner-authorized DuckDB callbacks use that same root-handle serialization;
+  SQLite and DuckDB callbacks additionally serialize every root-handle statement
+  the coordinator owns per database URL — `_smrt_backfills` initialization, the
+  transaction, and the post-commit rebind — because one adapter multiplexes a
+  single native connection and cannot safely overlap unrelated root
+  transactions. Never overlap two statements on one such handle, inside a
+  transaction or not: rebind and owner/email candidate reads are sequential,
+  never `Promise.all`. Owner-authorized DuckDB callbacks use that same
+  root-handle serialization;
   PostgreSQL deadlock and serialization errors use a bounded transaction retry.
   Newly provisioned Profiles use non-semantic per-profile slugs so equal IdP
   display names cannot trigger a natural-key upsert;