@happyvertical/smrt-users 0.49.3 → 0.49.4

package/dist/smrt-knowledge.json

@@ -3,12 +3,12 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.49.3",
+  "packageVersion": "0.49.4",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "111c0f9ab4fc7b98815a5d372838d88cbf1c14772a6e7a287e06e2736eeee1af",
-    "packageJson": "5e119ad06ae738e3a3b453c2e25a597efa9c078a0106cf5cc40d50307045a0c0",
+    "manifest": "b6818d9adf076e7c783abbdeb0edca091d0691f2971782c9ac1d6dcb907821ae",
+    "packageJson": "11c1d92f6c815c4bd35bfe70f2d1675c4f34d078900d20486eae31fd04a06c5a",
     "agents": "ec09e41d9c5e1b55abf454eb5b88a98637094e2aa67bffce2f11db0dcb68b441",
     "moduleDoc:agents/permissions.md": "f801411ae51fc625ad99054e284fd1abc6e7b2a5555dd8797a83dfd30273db68",
     "moduleDoc:agents/oidc-provisioning.md": "5efa607ff23b9a693391e0c02670324a8cea4114d4968c9718f10a763da919c6",
@@ -422,7 +422,7 @@
       "name": "GroupCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupCollection",
       "collection": "groups",
-      "tableName": "group_collections",
+      "tableName": "groups",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
       "fields": [],
@@ -502,7 +502,7 @@
       "name": "GroupMemberCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupMemberCollection",
       "collection": "groupmembers",
-      "tableName": "group_member_collections",
+      "tableName": "group_members",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
       "fields": [],
@@ -759,7 +759,7 @@
       "name": "GroupRoleCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupRoleCollection",
       "collection": "grouproles",
-      "tableName": "group_role_collections",
+      "tableName": "group_roles",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
       "fields": [],
@@ -1065,7 +1065,7 @@
       "name": "MembershipCollection",
       "qualifiedName": "@happyvertical/smrt-users:MembershipCollection",
       "collection": "memberships",
-      "tableName": "membership_collections",
+      "tableName": "memberships",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
       "fields": [],
@@ -1290,7 +1290,7 @@
       "name": "MembershipOverrideCollection",
       "qualifiedName": "@happyvertical/smrt-users:MembershipOverrideCollection",
       "collection": "membershipoverrides",
-      "tableName": "membership_override_collections",
+      "tableName": "membership_overrides",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
       "fields": [],
@@ -1577,7 +1577,7 @@
       "name": "PermissionCollection",
       "qualifiedName": "@happyvertical/smrt-users:PermissionCollection",
       "collection": "permissions",
-      "tableName": "permission_collections",
+      "tableName": "permissions",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
       "fields": [],
@@ -1741,7 +1741,7 @@
       "name": "RoleCollection",
       "qualifiedName": "@happyvertical/smrt-users:RoleCollection",
       "collection": "roles",
-      "tableName": "role_collections",
+      "tableName": "roles",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
       "fields": [],
@@ -1934,7 +1934,7 @@
       "name": "RolePermissionCollection",
       "qualifiedName": "@happyvertical/smrt-users:RolePermissionCollection",
       "collection": "rolepermissions",
-      "tableName": "role_permission_collections",
+      "tableName": "role_permissions",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
       "fields": [],
@@ -2191,7 +2191,7 @@
       "name": "SessionCollection",
       "qualifiedName": "@happyvertical/smrt-users:SessionCollection",
       "collection": "sessions",
-      "tableName": "session_collections",
+      "tableName": "sessions",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
       "fields": [],
@@ -2566,7 +2566,7 @@
       "name": "TenantCollection",
       "qualifiedName": "@happyvertical/smrt-users:TenantCollection",
       "collection": "tenants",
-      "tableName": "tenant_collections",
+      "tableName": "tenants",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
       "fields": [],
@@ -3197,7 +3197,7 @@
       "name": "TenantPermissionOverrideCollection",
       "qualifiedName": "@happyvertical/smrt-users:TenantPermissionOverrideCollection",
       "collection": "tenantpermissionoverrides",
-      "tableName": "tenant_permission_override_collections",
+      "tableName": "tenant_permission_overrides",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
       "fields": [],
@@ -3690,7 +3690,7 @@
       "name": "UserCollection",
       "qualifiedName": "@happyvertical/smrt-users:UserCollection",
       "collection": "users",
-      "tableName": "user_collections",
+      "tableName": "users",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
       "fields": [],
@@ -10210,7 +10210,7 @@
     "junctionCollections": 0,
     "hierarchicalObjects": 0,
     "polymorphicAssociations": 0,
-    "uuidColumns": 58
+    "uuidColumns": 82
   },
   "agentDoc": "# @happyvertical/smrt-users\n\nMulti-tenant identity, RBAC, hierarchical tenants, sessions, and SvelteKit auth.\n\n## Modules\n\nRead only the module relevant to the change; protocol and provisioning details\nare not prerequisites for unrelated user-package work.\n\n| Module | Scope | Module doc |\n|---|---|---|\n| `src/services/PermissionResolver.ts` | permission precedence, inherited memberships, guards, RLS, role seeding | [agents/permissions.md](agents/permissions.md) |\n| `src/services/OidcLoginService.ts`, collections and OIDC handlers | identity reconciliation, transaction boundaries, migration readiness | [agents/oidc-provisioning.md](agents/oidc-provisioning.md) |\n| `src/services/MobileAuthService.ts` | mobile handshake, bearer sessions, bootstrap extension boundary | [agents/mobile-auth.md](agents/mobile-auth.md) |\n| `src/retention.ts` | expired session/token/CLI-auth reaping and retention sweep wiring | [agents/retention.md](agents/retention.md) |\n\n## Models and authority\n\n- Users are global; tenant access comes through Membership (unique user/tenant).\n  User email is normalized and globally unique through readonly nullable\n  `emailKey`. `profileId` is a unique cross-package reference: at most one User\n  owns each non-null Profile.\n- Tenant uses STI and a materialized hierarchy, maximum depth 10.\n  `createChild()` calculates paths; `moveToParent()` updates all descendants.\n- Role with `tenantId = null` is available to all tenants; `isSystem` prevents\n  deletion. `inheritsToDescendants` is opt-in. Seed owner/admin/member/viewer\n  through `RoleCollection.seedSystemRoles()` at application initialization.\n- Group roles apply only in their own tenant. Use `getGroupIdsForTenant()`,\n  never cross-tenant `getGroupIds()`, for authorization.\n- Membership DENY always wins. Direct inactive membership blocks inherited\n  authority; a direct active membership pins resolution instead of unioning it\n  with ancestors. Read the permissions module before changing these rules.\n- AccessRequest has no generated API/MCP/CLI operations; access it through\n  `AccessRequestService`. Its JSON field is `requestContext`, not reserved\n  slug-scoping `context`.\n\n## Security boundaries\n\n- Generated REST/MCP operations on identity/RBAC models are list/get only.\n  Route authentication does not authorize authority mutations, and these models\n  are not tenant-scoped. Use permission-gated services or explicitly checked\n  consumer handlers. CLI remains a local-operator surface. Preserve the\n  registry assertions in `security-audit-1400.test.ts`.\n- Resource guards take the resource tenant, not the session tenant. Omit a\n  session membership when targeting a different tenant; mismatches fail closed.\n  `loadSessionContext().tenantAuthorization` must be checked by required-tenant\n  consumers: null membership can represent inherited authority.\n- Sessions use secure UUIDs; TTL is seconds (default seven days). Access marks\n  expired sessions EXPIRED. Magic-link tokens are single use.\n- Tenant switching verifies active membership before writing and rotates the\n  session ID for non-null targets, revoking the old session. Persist the returned\n  `SwitchTenantResult.sessionId`; `switchSessionTenant()` updates the cookie and\n  preserves its security settings. Failed switches mutate nothing; null clears\n  do not rotate. `SessionCollection.setSessionTenant()` is unguarded and must\n  never receive an untrusted tenant ID.\n- OIDC provisioning is atomic and fail-closed. Preserve exact issuer/subject\n  identifiers, claim-source email verification, unique global Person ownership,\n  and transaction-bound reconciliation. Read the OIDC module and canonical\n  scenario matrix before changing any provisioning path.\n\n## Entry points and validation\n\n`src/sveltekit/` owns `createSessionHandler`, `createSessionCookie`,\n`destroySessionCookie`, and `switchSessionTenant`. Use README integration examples\nrather than copying application setup into these instructions.\n\nFrom the repository root:\n\n```bash\npnpm --filter @happyvertical/smrt-users test\npnpm --filter @happyvertical/smrt-users typecheck\npnpm --filter @happyvertical/smrt-users test:postgres\n```\n\nStart with the relevant test file via `test -- src/__tests__/<file>.test.ts`.\nRun `test:postgres` for RLS, principal context, OIDC, or terminal-auth database\nchanges. `typecheck` includes Svelte accessibility checks; plain `tsc` is\ninsufficient. Follow root knowledge freshness checks before shipping.\n",
   "moduleDocs": [

package/dist/sveltekit.js

@@ -1,4 +1,4 @@
-import { C as decodeOidcTransaction, E as resolveOidcProviderConfig, S as OidcLoginService, T as getUsersOidcConfig, _ as readMobileBearerToken, a as TerminalAuthRateLimitError, g as MobileAuthService, h as MobileAuthError, i as TerminalAuthError, m as withSessionPermissionContext, o as TerminalAuthService, s as OperationPermissionError, v as validateMobileRedirectUri, w as encodeOidcTransaction, x as OidcLoginError, y as SessionService } from "./chunks/TerminalAuthService-D6i0WoaZ.js";
+import { C as decodeOidcTransaction, E as resolveOidcProviderConfig, S as OidcLoginService, T as getUsersOidcConfig, _ as readMobileBearerToken, a as TerminalAuthRateLimitError, g as MobileAuthService, h as MobileAuthError, i as TerminalAuthError, m as withSessionPermissionContext, o as TerminalAuthService, s as OperationPermissionError, v as validateMobileRedirectUri, w as encodeOidcTransaction, x as OidcLoginError, y as SessionService } from "./chunks/TerminalAuthService-BuOM9zbU.js";
 import { DiscoveryArtifactValidationError, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, canonicalizeDiscoveryArtifact, createDiscoveryConformanceArtifact, deriveCommandRequirements, validateDiscoveryConformanceArtifact } from "./app-contract.js";
 import { ObjectRegistry, createClassNamePredicate, resolveCustomActionMetadata, resolveEffectiveActionMetadata } from "@happyvertical/smrt-core";
 import { createLogger } from "@happyvertical/logger";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-users",
-  "version": "0.49.3",
+  "version": "0.49.4",
   "smrtJsdoc": "strict",
   "description": "Multi-tenant user management for the SMRT framework - users, tenants, roles, permissions, groups",
   "type": "module",
@@ -47,18 +47,18 @@
   },
   "dependencies": {
     "@happyvertical/logger": "^0.89.6",
-    "@happyvertical/smrt-config": "0.49.3",
-    "@happyvertical/smrt-core": "0.49.3",
-    "@happyvertical/smrt-mobile-contract": "0.49.3",
-    "@happyvertical/smrt-profiles": "0.49.3",
-    "@happyvertical/smrt-tenancy": "0.49.3",
-    "@happyvertical/smrt-types": "0.49.3",
-    "@happyvertical/smrt-ui": "0.49.3",
+    "@happyvertical/smrt-config": "0.49.4",
+    "@happyvertical/smrt-core": "0.49.4",
+    "@happyvertical/smrt-mobile-contract": "0.49.4",
+    "@happyvertical/smrt-profiles": "0.49.4",
+    "@happyvertical/smrt-tenancy": "0.49.4",
+    "@happyvertical/smrt-types": "0.49.4",
+    "@happyvertical/smrt-ui": "0.49.4",
     "@happyvertical/sql": "^0.89.6",
     "jose": "^6.2.3"
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.49.3",
+    "@happyvertical/smrt-vitest": "0.49.4",
     "@sveltejs/package": "^2.5.8",
     "@sveltejs/vite-plugin-svelte": "^7.1.2",
     "@types/node": "24.13.2",