@happyvertical/smrt-users 0.51.13 → 0.51.14

package/dist/smrt-knowledge.json

@@ -3,12 +3,12 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.51.13",
+  "packageVersion": "0.51.14",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "b6f7f963e98cbbe554148b5176db34a34d002efed710f97b92a9aaf35b0d52fc",
-    "packageJson": "d69a2d90d404a1bffd7a895b5951eaf4917a25e403b38dcb1623ad68f1b90264",
+    "manifest": "34d2639c51bf646327afea4470649ddf41515beed335a9c185039cc6978b69ab",
+    "packageJson": "908695fd991f1415e6bce60bc449775393195b3d0c4c610b52ec9917e8408a18",
     "agents": "0d011d9fe314ca90141f2fa45a97cdbb34dc34d0bb046357dd6d159c686bc41e",
     "moduleDoc:agents/permissions.md": "165fd67e4ff87d2e4c810ec8f6d9ef4d1bd7d4acc7e9ee0510020625fe2f5153",
     "moduleDoc:agents/oidc-provisioning.md": "5efa607ff23b9a693391e0c02670324a8cea4114d4968c9718f10a763da919c6",
@@ -34,14 +34,14 @@
     "@happyvertical/smrt-types": "workspace:*",
     "@happyvertical/smrt-ui": "workspace:*",
     "@happyvertical/sql": "catalog:",
-    "jose": "^6.2.3",
+    "jose": "^6.2.12",
     "@happyvertical/smrt-vitest": "workspace:*",
     "@sveltejs/package": "^2.5.8",
-    "@sveltejs/vite-plugin-svelte": "^7.1.2",
-    "@types/node": "24.13.2",
+    "@sveltejs/vite-plugin-svelte": "^7.3.0",
+    "@types/node": "24.13.6",
     "fast-glob": "^3.3.3",
-    "svelte": "^5.56.4",
-    "svelte-check": "^4.7.1",
+    "svelte": "^5.57.1",
+    "svelte-check": "^4.7.6",
     "typescript": "5.9.3",
     "vite": "8.1.4",
     "vitest": "4.1.10"
@@ -1751,6 +1751,89 @@
       "tags": [],
       "risks": []
     },
+    {
+      "name": "ResourceGrantCollection",
+      "qualifiedName": "@happyvertical/smrt-users:ResourceGrantCollection",
+      "collection": "resourcegrants",
+      "tableName": "resource_grants",
+      "packageName": "@happyvertical/smrt-users",
+      "extends": "SmrtCollection",
+      "fields": [],
+      "relationships": [],
+      "methods": [
+        "findChildren",
+        "findExact"
+      ],
+      "methodSignatures": [
+        {
+          "name": "findChildren",
+          "async": true,
+          "params": [
+            "parentGrantId: string"
+          ],
+          "returns": "Promise<ResourceGrant[]>"
+        },
+        {
+          "name": "findExact",
+          "async": true,
+          "params": [
+            "tenantId: string",
+            "userId: string",
+            "resourceType: string",
+            "resourceId: string",
+            "permission: string"
+          ],
+          "returns": "Promise<ResourceGrant[]>"
+        }
+      ],
+      "surfaces": [
+        {
+          "kind": "api",
+          "name": "resourcegrants.findExact",
+          "operation": "findExact",
+          "objectName": "@happyvertical/smrt-users:ResourceGrantCollection",
+          "path": "/resourcegrants/findExact",
+          "method": "POST"
+        },
+        {
+          "kind": "api",
+          "name": "resourcegrants.findChildren",
+          "operation": "findChildren",
+          "objectName": "@happyvertical/smrt-users:ResourceGrantCollection",
+          "path": "/resourcegrants/findChildren",
+          "method": "POST"
+        },
+        {
+          "kind": "cli",
+          "name": "resourcegrantcollection_findExact",
+          "operation": "findExact",
+          "objectName": "@happyvertical/smrt-users:ResourceGrantCollection"
+        },
+        {
+          "kind": "cli",
+          "name": "resourcegrantcollection_findChildren",
+          "operation": "findChildren",
+          "objectName": "@happyvertical/smrt-users:ResourceGrantCollection"
+        },
+        {
+          "kind": "mcp",
+          "name": "resourcegrantcollection_findexact",
+          "operation": "findExact",
+          "objectName": "@happyvertical/smrt-users:ResourceGrantCollection"
+        },
+        {
+          "kind": "mcp",
+          "name": "resourcegrantcollection_findchildren",
+          "operation": "findChildren",
+          "objectName": "@happyvertical/smrt-users:ResourceGrantCollection"
+        }
+      ],
+      "relationshipFeatures": [
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
     {
       "name": "RoleCollection",
       "qualifiedName": "@happyvertical/smrt-users:RoleCollection",
@@ -5181,6 +5264,169 @@
       "tags": [],
       "risks": []
     },
+    {
+      "name": "ResourceGrant",
+      "qualifiedName": "@happyvertical/smrt-users:ResourceGrant",
+      "collection": "resourcegrants",
+      "tableName": "resource_grants",
+      "packageName": "@happyvertical/smrt-users",
+      "extends": "SmrtObject",
+      "fields": [
+        {
+          "name": "tenantId",
+          "type": "foreignKey",
+          "required": true,
+          "related": "Tenant",
+          "columnType": "UUID"
+        },
+        {
+          "name": "userId",
+          "type": "foreignKey",
+          "required": true,
+          "related": "User",
+          "columnType": "UUID"
+        },
+        {
+          "name": "resourceType",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "resourceId",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "permission",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "effect",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        },
+        {
+          "name": "canDelegate",
+          "type": "boolean",
+          "required": false,
+          "columnType": "BOOLEAN",
+          "default": false
+        },
+        {
+          "name": "parentGrantId",
+          "type": "foreignKey",
+          "required": false,
+          "related": "ResourceGrant",
+          "columnType": "UUID"
+        },
+        {
+          "name": "revokedAt",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT"
+        }
+      ],
+      "relationships": [
+        {
+          "name": "tenantId",
+          "type": "foreignKey",
+          "required": true,
+          "related": "Tenant",
+          "columnType": "UUID"
+        },
+        {
+          "name": "userId",
+          "type": "foreignKey",
+          "required": true,
+          "related": "User",
+          "columnType": "UUID"
+        },
+        {
+          "name": "parentGrantId",
+          "type": "foreignKey",
+          "required": false,
+          "related": "ResourceGrant",
+          "columnType": "UUID"
+        }
+      ],
+      "methods": [
+        "isActive"
+      ],
+      "methodSignatures": [
+        {
+          "name": "isActive",
+          "returns": "boolean"
+        }
+      ],
+      "tenant": {
+        "scoped": true,
+        "mode": "required",
+        "field": "tenantId"
+      },
+      "conflictColumns": [
+        "tenant_id",
+        "slug",
+        "context"
+      ],
+      "surfaces": [
+        {
+          "kind": "cli",
+          "name": "resourcegrant_list",
+          "operation": "list",
+          "objectName": "@happyvertical/smrt-users:ResourceGrant"
+        },
+        {
+          "kind": "cli",
+          "name": "resourcegrant_get",
+          "operation": "get",
+          "objectName": "@happyvertical/smrt-users:ResourceGrant"
+        },
+        {
+          "kind": "cli",
+          "name": "resourcegrant_create",
+          "operation": "create",
+          "objectName": "@happyvertical/smrt-users:ResourceGrant"
+        },
+        {
+          "kind": "cli",
+          "name": "resourcegrant_update",
+          "operation": "update",
+          "objectName": "@happyvertical/smrt-users:ResourceGrant"
+        },
+        {
+          "kind": "cli",
+          "name": "resourcegrant_delete",
+          "operation": "delete",
+          "objectName": "@happyvertical/smrt-users:ResourceGrant"
+        },
+        {
+          "kind": "cli",
+          "name": "resourcegrant_isActive",
+          "operation": "isActive",
+          "objectName": "@happyvertical/smrt-users:ResourceGrant"
+        }
+      ],
+      "withheldSurfaces": [
+        {
+          "kind": "api",
+          "operation": "isActive",
+          "code": "not-included",
+          "reason": "not listed in api.include",
+          "objectName": "@happyvertical/smrt-users:ResourceGrant"
+        }
+      ],
+      "relationshipFeatures": [
+        "foreignKey",
+        "uuidColumns"
+      ],
+      "tags": [],
+      "risks": []
+    },
     {
       "name": "Role",
       "qualifiedName": "@happyvertical/smrt-users:Role",
@@ -7788,6 +8034,46 @@
       "operation": "findOrCreate",
       "objectName": "@happyvertical/smrt-users:PermissionCollection"
     },
+    {
+      "kind": "api",
+      "name": "resourcegrants.findExact",
+      "operation": "findExact",
+      "objectName": "@happyvertical/smrt-users:ResourceGrantCollection",
+      "path": "/resourcegrants/findExact",
+      "method": "POST"
+    },
+    {
+      "kind": "api",
+      "name": "resourcegrants.findChildren",
+      "operation": "findChildren",
+      "objectName": "@happyvertical/smrt-users:ResourceGrantCollection",
+      "path": "/resourcegrants/findChildren",
+      "method": "POST"
+    },
+    {
+      "kind": "cli",
+      "name": "resourcegrantcollection_findExact",
+      "operation": "findExact",
+      "objectName": "@happyvertical/smrt-users:ResourceGrantCollection"
+    },
+    {
+      "kind": "cli",
+      "name": "resourcegrantcollection_findChildren",
+      "operation": "findChildren",
+      "objectName": "@happyvertical/smrt-users:ResourceGrantCollection"
+    },
+    {
+      "kind": "mcp",
+      "name": "resourcegrantcollection_findexact",
+      "operation": "findExact",
+      "objectName": "@happyvertical/smrt-users:ResourceGrantCollection"
+    },
+    {
+      "kind": "mcp",
+      "name": "resourcegrantcollection_findchildren",
+      "operation": "findChildren",
+      "objectName": "@happyvertical/smrt-users:ResourceGrantCollection"
+    },
     {
       "kind": "api",
       "name": "roles.findSystemRoles",
@@ -9606,6 +9892,42 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:Permission"
     },
+    {
+      "kind": "cli",
+      "name": "resourcegrant_list",
+      "operation": "list",
+      "objectName": "@happyvertical/smrt-users:ResourceGrant"
+    },
+    {
+      "kind": "cli",
+      "name": "resourcegrant_get",
+      "operation": "get",
+      "objectName": "@happyvertical/smrt-users:ResourceGrant"
+    },
+    {
+      "kind": "cli",
+      "name": "resourcegrant_create",
+      "operation": "create",
+      "objectName": "@happyvertical/smrt-users:ResourceGrant"
+    },
+    {
+      "kind": "cli",
+      "name": "resourcegrant_update",
+      "operation": "update",
+      "objectName": "@happyvertical/smrt-users:ResourceGrant"
+    },
+    {
+      "kind": "cli",
+      "name": "resourcegrant_delete",
+      "operation": "delete",
+      "objectName": "@happyvertical/smrt-users:ResourceGrant"
+    },
+    {
+      "kind": "cli",
+      "name": "resourcegrant_isActive",
+      "operation": "isActive",
+      "objectName": "@happyvertical/smrt-users:ResourceGrant"
+    },
     {
       "kind": "api",
       "name": "roles.list",
@@ -10219,12 +10541,12 @@
   ],
   "prompts": [],
   "relationshipsV2": {
-    "foreignKeyFields": 22,
+    "foreignKeyFields": 25,
     "crossPackageRefFields": 1,
     "junctionCollections": 0,
     "hierarchicalObjects": 0,
     "polymorphicAssociations": 0,
-    "uuidColumns": 82
+    "uuidColumns": 90
   },
   "agentDoc": "# @happyvertical/smrt-users\n\nMulti-tenant identity, RBAC, hierarchical tenants, sessions, and SvelteKit auth.\n\n## Modules\n\nRead only the module relevant to the change; protocol and provisioning details\nare not prerequisites for unrelated user-package work.\n\n| Module | Scope | Module doc |\n|---|---|---|\n| `src/services/PermissionResolver.ts` | permission precedence, inherited memberships, guards, RLS, role seeding | [agents/permissions.md](agents/permissions.md) |\n| `src/services/OidcLoginService.ts`, collections and OIDC handlers | identity reconciliation, transaction boundaries, migration readiness | [agents/oidc-provisioning.md](agents/oidc-provisioning.md) |\n| `src/services/MobileAuthService.ts` | mobile handshake, bearer sessions, bootstrap extension boundary | [agents/mobile-auth.md](agents/mobile-auth.md) |\n| `src/retention.ts` | expired session/token/CLI-auth reaping and retention sweep wiring | [agents/retention.md](agents/retention.md) |\n\n## Models and authority\n\n- Users are global; tenant access comes through Membership (unique user/tenant).\n  User email is normalized and globally unique through readonly nullable\n  `emailKey`. `profileId` is a unique cross-package reference: at most one User\n  owns each non-null Profile.\n- Tenant uses STI and a materialized hierarchy, maximum depth 10.\n  `createChild()` calculates paths; `moveToParent()` updates all descendants.\n- Role with `tenantId = null` is available to all tenants; `isSystem` prevents\n  deletion. `inheritsToDescendants` is opt-in. Seed owner/admin/member/viewer\n  through `RoleCollection.seedSystemRoles()` at application initialization.\n- Group roles apply only in their own tenant. Use `getGroupIdsForTenant()`,\n  never cross-tenant `getGroupIds()`, for authorization.\n- Upward visibility is opt-in and read-only: `permissions.ancestorRead`\n  ({ roles, collections, maxDepth? }) lets a DESCENDANT membership contribute\n  declared `<collection>.read` at an ancestor, only when no membership resolved\n  there, intersected with BOTH the role's own catalog grants and the\n  principal's effective permissions in that descendant, and only for SYSTEM\n  roles (a tenant-scoped role sharing a declared slug is ignored). Off by default, never\n  write, never lateral, and never row visibility — sibling rows stay scoped by\n  tenancy/RLS. Read the permissions module before changing it.\n- Membership DENY always wins. Direct inactive membership blocks inherited\n  authority; a direct active membership pins resolution instead of unioning it\n  with ancestors. Read the permissions module before changing these rules.\n- AccessRequest has no generated API/MCP/CLI operations; access it through\n  `AccessRequestService`. Its JSON field is `requestContext`, not reserved\n  slug-scoping `context`.\n\n## Security boundaries\n\n- Generated REST/MCP operations on identity/RBAC models are list/get only.\n  Route authentication does not authorize authority mutations, and these models\n  are not tenant-scoped. Use permission-gated services or explicitly checked\n  consumer handlers. CLI remains a local-operator surface. Preserve the\n  registry assertions in `security-audit-1400.test.ts`.\n- Resource guards take the resource tenant, not the session tenant. Omit a\n  session membership when targeting a different tenant; mismatches fail closed.\n  `loadSessionContext().tenantAuthorization` must be checked by required-tenant\n  consumers: null membership can represent inherited authority.\n- Sessions use secure UUIDs; TTL is seconds (default seven days). Access marks\n  expired sessions EXPIRED. Magic-link tokens are single use.\n- Tenant switching verifies active membership before writing and rotates the\n  session ID for non-null targets, revoking the old session. Persist the returned\n  `SwitchTenantResult.sessionId`; `switchSessionTenant()` updates the cookie and\n  preserves its security settings. Failed switches mutate nothing; null clears\n  do not rotate. `SessionCollection.setSessionTenant()` is unguarded and must\n  never receive an untrusted tenant ID.\n- OIDC provisioning is atomic and fail-closed. Preserve exact issuer/subject\n  identifiers, claim-source email verification, unique global Person ownership,\n  and transaction-bound reconciliation. Read the OIDC module and canonical\n  scenario matrix before changing any provisioning path.\n\n## Entry points and validation\n\n`src/sveltekit/` owns `createSessionHandler`, `createSessionCookie`,\n`destroySessionCookie`, and `switchSessionTenant`. Use README integration examples\nrather than copying application setup into these instructions.\n\nFrom the repository root:\n\n```bash\npnpm --filter @happyvertical/smrt-users test\npnpm --filter @happyvertical/smrt-users typecheck\npnpm --filter @happyvertical/smrt-users test:postgres\n```\n\nStart with the relevant test file via `test -- src/__tests__/<file>.test.ts`.\nRun `test:postgres` for RLS, principal context, OIDC, or terminal-auth database\nchanges. `typecheck` includes Svelte accessibility checks; plain `tsc` is\ninsufficient. Follow root knowledge freshness checks before shipping.\n",
   "moduleDocs": [

package/dist/sveltekit.js

@@ -1,4 +1,4 @@
-import { C as decodeOidcTransaction, E as resolveOidcProviderConfig, S as OidcLoginService, T as getUsersOidcConfig, _ as readMobileBearerToken, a as TerminalAuthRateLimitError, g as MobileAuthService, h as MobileAuthError, i as TerminalAuthError, m as withSessionPermissionContext, o as TerminalAuthService, s as OperationPermissionError, v as validateMobileRedirectUri, w as encodeOidcTransaction, x as OidcLoginError, y as SessionService } from "./chunks/TerminalAuthService-jJc-uqDc.js";
+import { C as decodeOidcTransaction, E as resolveOidcProviderConfig, S as OidcLoginService, T as getUsersOidcConfig, _ as readMobileBearerToken, a as TerminalAuthRateLimitError, g as MobileAuthService, h as MobileAuthError, i as TerminalAuthError, m as withSessionPermissionContext, o as TerminalAuthService, s as OperationPermissionError, v as validateMobileRedirectUri, w as encodeOidcTransaction, x as OidcLoginError, y as SessionService } from "./chunks/TerminalAuthService-DgAU4Fz1.js";
 import { DiscoveryArtifactValidationError, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, canonicalizeDiscoveryArtifact, createDiscoveryConformanceArtifact, deriveCommandRequirements, validateDiscoveryConformanceArtifact } from "./app-contract.js";
 import { ObjectRegistry, createClassNamePredicate, resolveCustomActionMetadata, resolveEffectiveActionMetadata } from "@happyvertical/smrt-core";
 import { createLogger } from "@happyvertical/logger";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-users",
-  "version": "0.51.13",
+  "version": "0.51.14",
   "smrtJsdoc": "strict",
   "description": "Multi-tenant user management for the SMRT framework - users, tenants, roles, permissions, groups",
   "type": "module",
@@ -38,7 +38,7 @@
     "AGENTS.md"
   ],
   "peerDependencies": {
-    "svelte": "^5.56.4"
+    "svelte": "^5.57.1"
   },
   "peerDependenciesMeta": {
     "svelte": {
@@ -47,24 +47,24 @@
   },
   "dependencies": {
     "@happyvertical/logger": "^0.89.12",
-    "@happyvertical/smrt-config": "0.51.13",
-    "@happyvertical/smrt-core": "0.51.13",
-    "@happyvertical/smrt-mobile-contract": "0.51.13",
-    "@happyvertical/smrt-profiles": "0.51.13",
-    "@happyvertical/smrt-tenancy": "0.51.13",
-    "@happyvertical/smrt-types": "0.51.13",
-    "@happyvertical/smrt-ui": "0.51.13",
+    "@happyvertical/smrt-config": "0.51.14",
+    "@happyvertical/smrt-core": "0.51.14",
+    "@happyvertical/smrt-mobile-contract": "0.51.14",
+    "@happyvertical/smrt-profiles": "0.51.14",
+    "@happyvertical/smrt-tenancy": "0.51.14",
+    "@happyvertical/smrt-types": "0.51.14",
+    "@happyvertical/smrt-ui": "0.51.14",
     "@happyvertical/sql": "^0.89.12",
-    "jose": "^6.2.3"
+    "jose": "^6.2.12"
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.51.13",
+    "@happyvertical/smrt-vitest": "0.51.14",
     "@sveltejs/package": "^2.5.8",
-    "@sveltejs/vite-plugin-svelte": "^7.1.2",
-    "@types/node": "24.13.2",
+    "@sveltejs/vite-plugin-svelte": "^7.3.0",
+    "@types/node": "24.13.6",
     "fast-glob": "^3.3.3",
-    "svelte": "^5.56.4",
-    "svelte-check": "^4.7.1",
+    "svelte": "^5.57.1",
+    "svelte-check": "^4.7.6",
     "typescript": "5.9.3",
     "vite": "8.1.4",
     "vitest": "4.1.10"
@@ -96,7 +96,7 @@
     "clean": "rm -rf dist",
     "dev": "npm run build:watch",
     "test": "vitest run",
-    "test:postgres": "node ../../scripts/run-with-ci-postgres.mjs -- pnpm exec vitest run src/__tests__/permission-postgres-rls.test.ts src/__tests__/principal-permission-context-postgres.test.ts src/__tests__/oidc-provisioning-postgres.test.ts src/__tests__/legacy-user-profile-backfill-postgres.test.ts src/__tests__/terminal-auth-postgres.test.ts",
+    "test:postgres": "node ../../scripts/run-with-ci-postgres.mjs -- pnpm exec vitest run src/__tests__/permission-postgres-rls.test.ts src/__tests__/principal-permission-context-postgres.test.ts src/__tests__/oidc-provisioning-postgres.test.ts src/__tests__/legacy-user-profile-backfill-postgres.test.ts src/__tests__/terminal-auth-postgres.test.ts src/__tests__/resource-grant-postgres.test.ts",
     "typecheck": "tsc --noEmit && node ../../scripts/svelte-check-a11y.mjs --tsconfig ./tsconfig.svelte.json",
     "check": "pnpm exec svelte-check --tsconfig ./tsconfig.svelte.json",
     "verify:pack": "node ../../scripts/verify-package-types-exports.js ."