@happyvertical/smrt-users 0.51.14 → 0.51.16

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.51.14",
+  "packageVersion": "0.51.16",
   "objects": {
     "@happyvertical/smrt-users:AccessRequestCollection": {
       "name": "accessrequestcollection",
@@ -3122,20 +3122,6 @@
           "returnType": "any",
           "isStatic": false,
           "isPublic": true
-        },
-        "create": {
-          "name": "create",
-          "async": true,
-          "parameters": [
-            {
-              "name": "options",
-              "type": "SmrtCreateInput<Tenant>",
-              "optional": false
-            }
-          ],
-          "returnType": "Promise<Tenant>",
-          "isStatic": false,
-          "isPublic": true
         }
       },
       "decoratorConfig": {},
@@ -6798,6 +6784,20 @@
           "isStatic": false,
           "isPublic": true
         },
+        "save": {
+          "name": "save",
+          "async": true,
+          "parameters": [
+            {
+              "name": "options",
+              "type": "SmrtSaveOptions",
+              "optional": true
+            }
+          ],
+          "returnType": "Promise<this>",
+          "isStatic": false,
+          "isPublic": true
+        },
         "getAncestorIds": {
           "name": "getAncestorIds",
           "async": false,

package/dist/migrations/materializeTenantHierarchy.d.ts

@@ -0,0 +1,52 @@
+import { getDatabase } from '@happyvertical/sql';
+import { TenantHierarchyPlan, TenantHierarchyProblem } from '../models/tenant-hierarchy.js';
+type DatabaseInterface = Awaited<ReturnType<typeof getDatabase>>;
+/** Options for {@link materializeTenantHierarchy}. */
+export interface MaterializeTenantHierarchyOptions {
+    /** Report what would change without writing. Default `false`. */
+    dryRun?: boolean;
+    /** The Tenant STI table. Default `'tenants'`. */
+    tableName?: string;
+}
+/** Result of {@link materializeTenantHierarchy}. */
+export interface MaterializeTenantHierarchyResult extends TenantHierarchyPlan {
+    /** `true` when the planned changes were written. */
+    applied: boolean;
+}
+/**
+ * Raised before any row is changed when a tenant's parent chain is broken
+ * (missing parent, cycle, or too deep), so an operator can repair
+ * `parent_tenant_id` explicitly instead of the backfill guessing at an
+ * authorization source.
+ */
+export declare class TenantHierarchyMaterializationError extends Error {
+    readonly problems: TenantHierarchyProblem[];
+    constructor(problems: TenantHierarchyProblem[]);
+}
+/**
+ * Backfill `hierarchy_path` / `hierarchy_level` for every tenant from its
+ * `parent_tenant_id` chain (smrt#3036).
+ *
+ * `Tenant.save()` keeps these current from now on; this repairs rows written
+ * before the framework maintained them — typically every row created through
+ * a path other than `TenantCollection.createChild()`, which left an empty path
+ * and level 0 even with a correct parent. Until repaired, both
+ * `inheritsToDescendants` and the declared ancestor-read policy fail closed on
+ * those tenants.
+ *
+ * Idempotent: it writes only rows that differ, so a second run reports zero
+ * changes. It refuses (writing nothing) when any tenant's chain is broken;
+ * `dryRun` reports the same plan, problems included, without throwing.
+ * Runs in one transaction and refuses an adapter without `transaction()`
+ * (dry runs excepted). Touches only the two
+ * derived columns (not `updated_at`) and records one table-level change-feed
+ * entry after commit.
+ *
+ * Exposed as `smrt db:materialize-tenant-hierarchy [--dry-run]`.
+ *
+ * @throws {TenantHierarchyMaterializationError} when not a dry run and any
+ *   tenant's parent chain is broken.
+ */
+export declare function materializeTenantHierarchy(db: DatabaseInterface, options?: MaterializeTenantHierarchyOptions): Promise<MaterializeTenantHierarchyResult>;
+export {};
+//# sourceMappingURL=materializeTenantHierarchy.d.ts.map

package/dist/migrations/materializeTenantHierarchy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"materializeTenantHierarchy.d.ts","sourceRoot":"","sources":["../../src/migrations/materializeTenantHierarchy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAML,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAE5B,MAAM,+BAA+B,CAAC;AAEvC,KAAK,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;AAEjE,sDAAsD;AACtD,MAAM,WAAW,iCAAiC;IAChD,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,gCAAiC,SAAQ,mBAAmB;IAC3E,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,mCAAoC,SAAQ,KAAK;IAChD,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,EAAE;gBAAlC,QAAQ,EAAE,sBAAsB,EAAE;CAOxD;AAoCD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,gCAAgC,CAAC,CAiC3C"}

package/dist/models/Tenant.d.ts

@@ -1,4 +1,4 @@
-import { SmrtObject, SmrtObjectOptions } from '@happyvertical/smrt-core';
+import { SmrtObject, SmrtObjectOptions, SmrtSaveOptions } from '@happyvertical/smrt-core';
 import { Tenant as TenantContract } from '@happyvertical/smrt-types';
 import { TenantStatus } from '../types/index.js';
 /**
@@ -14,11 +14,7 @@ export interface TenantOptions extends SmrtObjectOptions {
     cascadePermissions?: boolean;
     inheritPermissions?: boolean;
 }
-/**
- * Maximum allowed depth for tenant hierarchy.
- * Prevents excessively deep trees that could cause performance issues.
- */
-export declare const MAX_TENANT_HIERARCHY_DEPTH = 10;
+export { MAX_TENANT_HIERARCHY_DEPTH } from './tenant-hierarchy.js';
 /**
  * Tenant represents an organizational boundary in the multi-tenant system.
  *
@@ -88,14 +84,18 @@ export declare class Tenant extends SmrtObject implements TenantContract {
     parentTenantId?: string | null;
     /**
      * Depth in the hierarchy tree (0 = root, 1 = first level child, etc.)
-     * Automatically managed by TenantCollection methods.
+     * Derived from `parentTenantId` and maintained by {@link Tenant.save};
+     * any value assigned directly is recomputed on save.
      */
     hierarchyLevel: number;
     /**
      * Materialized path for efficient tree traversal.
      * Format: "ancestor-id/parent-id" (path to parent; does not include this tenant's id)
      * Empty string for root tenants.
-     * Automatically managed by TenantCollection methods.
+     * Derived from `parentTenantId` and maintained by {@link Tenant.save};
+     * any value assigned directly is recomputed on save. Rows written before
+     * the framework maintained it are backfilled with
+     * `smrt db:materialize-tenant-hierarchy` (smrt#3036).
      */
     hierarchyPath: string;
     /**
@@ -141,6 +141,38 @@ export declare class Tenant extends SmrtObject implements TenantContract {
      * for accurate permission calculation.
      */
     acceptsInheritance(): boolean;
+    /**
+     * Persist the tenant, keeping the derived hierarchy fields true (smrt#3036).
+     *
+     * `hierarchyPath` / `hierarchyLevel` are recomputed from the real
+     * `parentTenantId` chain on EVERY save — whichever collection, subclass, or
+     * code path produced the object — so a consumer never hand-maintains them.
+     * When they change (a reparent, or healing a stale row), every descendant is
+     * re-materialized too. Both columns are an authorization source for
+     * `inheritsToDescendants` and the declared ancestor-read policy.
+     *
+     * @throws {TenantHierarchyError} before anything is written, when the new
+     *   parent is missing, would create a cycle, or would put this tenant or one
+     *   of its descendants at or below `MAX_TENANT_HIERARCHY_DEPTH`.
+     */
+    save(options?: SmrtSaveOptions): Promise<this>;
+    /**
+     * Refuse to link this tenant under a parent the caller cannot see.
+     *
+     * A parent link is authority-bearing: ancestor tenant overrides cascade down
+     * it and `inheritsToDescendants` roles flow along it. The chain itself is
+     * resolved with raw reads (so paths can be derived for any row), so this is
+     * the check that keeps a NEW or CHANGED link subject to the caller's own
+     * tenancy scope, whichever path made it — `createChild`, `moveToParent`,
+     * `create({ parentTenantId })`, or a plain `parentTenantId` assignment and
+     * `save()`. The parent is loaded through `TenantCollection`, i.e. through
+     * the tenancy interceptor: a refused or filtered read fails the save before
+     * anything is written. System context (migrations, backfills, platform
+     * administration) bypasses the interceptor as everywhere else. An unchanged
+     * link is not re-checked, so a tenant can still save itself under its own
+     * scope when its parent is not visible there.
+     */
+    private assertNewParentVisible;
     /**
      * Get ancestor IDs from the hierarchy path.
      * Returns an array of tenant IDs from root to immediate parent.

package/dist/models/Tenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Tenant.d.ts","sourceRoot":"","sources":["../../src/models/Tenant.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,qBASa,MAAO,SAAQ,UAAW,YAAW,cAAc;IAC9D;;OAEG;IACH,IAAI,EAAE,MAAM,CAAM;IAElB;;OAEG;IAEH,MAAM,EAAE,YAAY,CAAuB;IAE3C;;OAEG;IACH,WAAW,EAAE,MAAM,CAAM;IAIzB;;;OAGG;IAEH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAK;IAE3B;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAM;IAI3B;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAQ;IAEnC;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAQ;gBAEvB,OAAO,GAAE,aAAkB;IAkBvC;;OAEG;IACH,QAAQ,IAAI,OAAO;IAInB;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,MAAM,IAAI,OAAO;IAIjB;;;;;OAKG;IACH,oBAAoB,IAAI,OAAO;IAI/B;;;;;;;;;OASG;IACH,kBAAkB,IAAI,OAAO;IAI7B;;;;OAIG;IACH,cAAc,IAAI,MAAM,EAAE;CAI3B"}
+{"version":3,"file":"Tenant.d.ts","sourceRoot":"","sources":["../../src/models/Tenant.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAUjD;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,qBASa,MAAO,SAAQ,UAAW,YAAW,cAAc;IAC9D;;OAEG;IACH,IAAI,EAAE,MAAM,CAAM;IAElB;;OAEG;IAEH,MAAM,EAAE,YAAY,CAAuB;IAE3C;;OAEG;IACH,WAAW,EAAE,MAAM,CAAM;IAIzB;;;OAGG;IAEH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAK;IAE3B;;;;;;;;OAQG;IACH,aAAa,EAAE,MAAM,CAAM;IAI3B;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAQ;IAEnC;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAQ;gBAEvB,OAAO,GAAE,aAAkB;IAkBvC;;OAEG;IACH,QAAQ,IAAI,OAAO;IAInB;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,MAAM,IAAI,OAAO;IAIjB;;;;;OAKG;IACH,oBAAoB,IAAI,OAAO;IAI/B;;;;;;;;;OASG;IACH,kBAAkB,IAAI,OAAO;IAI7B;;;;;;;;;;;;;OAaG;IACY,IAAI,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCjE;;;;;;;;;;;;;;;OAeG;YACW,sBAAsB;IAoCpC;;;;OAIG;IACH,cAAc,IAAI,MAAM,EAAE;CAI3B"}

package/dist/models/tenant-hierarchy.d.ts

@@ -0,0 +1,105 @@
+import { bumpChangeFeed } from '@happyvertical/smrt-core';
+/**
+ * Maximum allowed depth for tenant hierarchy.
+ * Prevents excessively deep trees that could cause performance issues.
+ */
+export declare const MAX_TENANT_HIERARCHY_DEPTH = 10;
+/** Reasons a tenant hierarchy cannot be (re)materialized. */
+export type TenantHierarchyErrorCode = 'CIRCULAR_REFERENCE' | 'MAX_DEPTH_EXCEEDED' | 'PARENT_NOT_FOUND' | 'INVALID_OPERATION';
+/**
+ * Error thrown when tenant hierarchy operations fail
+ */
+export declare class TenantHierarchyError extends Error {
+    readonly code: TenantHierarchyErrorCode;
+    constructor(message: string, code: TenantHierarchyErrorCode);
+}
+/** The derived hierarchy columns of one tenant row. */
+export interface TenantHierarchyFields {
+    hierarchyPath: string;
+    hierarchyLevel: number;
+}
+/**
+ * The minimal database surface these helpers need — satisfied by every
+ * `@happyvertical/sql` adapter and transaction handle.
+ */
+export interface TenantHierarchyDatabase {
+    query: (sql: string, ...vars: unknown[]) => Promise<{
+        rows: Array<Record<string, unknown>>;
+    }>;
+}
+/** Quote-free guard: the table name is interpolated, so it must be a plain identifier. */
+export declare function assertTenantTableName(tableName: string): string;
+/** The path a child of `parent` must carry. */
+export declare function childHierarchyFields(parentId: string, parent: TenantHierarchyFields): TenantHierarchyFields;
+/**
+ * Compute a tenant's hierarchy fields from the REAL `parentTenantId` chain,
+ * never from any ancestor's materialized path (which may itself be stale).
+ *
+ * @throws {TenantHierarchyError} `PARENT_NOT_FOUND` when a link is missing,
+ *   `CIRCULAR_REFERENCE` when the chain loops or reaches `tenantId`,
+ *   `MAX_DEPTH_EXCEEDED` when the tenant would sit at or below
+ *   {@link MAX_TENANT_HIERARCHY_DEPTH}.
+ */
+export declare function computeTenantHierarchyFields(db: TenantHierarchyDatabase, tableName: string, tenantId: string | null | undefined, parentTenantId: string | null | undefined): Promise<TenantHierarchyFields>;
+/** One pending descendant rewrite. */
+export interface TenantHierarchyUpdate extends TenantHierarchyFields {
+    id: string;
+}
+/**
+ * Plan the descendant rewrites implied by `rootId` now carrying `root`.
+ * Read-only; walks `parent_tenant_id` links breadth-first, so it works even
+ * when descendants were never materialized.
+ *
+ * @throws {TenantHierarchyError} `MAX_DEPTH_EXCEEDED` when a descendant would
+ *   end up too deep, `CIRCULAR_REFERENCE` when the subtree loops.
+ */
+export declare function planDescendantHierarchy(db: TenantHierarchyDatabase, tableName: string, rootId: string, root: TenantHierarchyFields): Promise<TenantHierarchyUpdate[]>;
+/** Write planned hierarchy fields. Touches only the two derived columns. */
+export declare function applyTenantHierarchyUpdates(db: TenantHierarchyDatabase, tableName: string, updates: readonly TenantHierarchyUpdate[]): Promise<void>;
+/** A stored tenant row, as the backfill planner sees it. */
+export interface TenantHierarchyRow {
+    id: string;
+    parentTenantId: string | null;
+    hierarchyPath: string | null;
+    hierarchyLevel: number | null;
+}
+/** A row the planner refuses to materialize, and why. */
+export interface TenantHierarchyProblem {
+    id: string;
+    code: Exclude<TenantHierarchyErrorCode, 'INVALID_OPERATION'>;
+    message: string;
+}
+/** A single planned change: what is stored, and what it must become. */
+export interface TenantHierarchyChange extends TenantHierarchyUpdate {
+    previousPath: string | null;
+    previousLevel: number | null;
+}
+/** Result of {@link planTenantHierarchy}. */
+export interface TenantHierarchyPlan {
+    /** Rows examined. */
+    total: number;
+    /** Rows whose stored fields differ from the parent chain. */
+    changes: TenantHierarchyChange[];
+    /** Rows whose parent chain is broken; nothing is written while any exist. */
+    problems: TenantHierarchyProblem[];
+}
+/**
+ * Pure planner: compute every tenant's hierarchy fields from the
+ * `parentTenantId` graph of `rows` and report what differs. Rows whose chain
+ * is broken (missing parent, cycle, too deep) are reported as problems rather
+ * than guessed at, because the result is an authorization source.
+ */
+export declare function planTenantHierarchy(rows: readonly TenantHierarchyRow[]): TenantHierarchyPlan;
+/**
+ * Record raw hierarchy rewrites in the change feed through core's documented
+ * out-of-band escape hatch, so feed consumers observe that a row's ancestry
+ * changed. `rowIds` omitted records one table-level change.
+ *
+ * Mirrors the framework writer's failure policy: the write already succeeded
+ * and must not be un-succeeded by feed bookkeeping, so failures are logged and
+ * swallowed. `updated_at` is deliberately NOT bumped — the two columns are
+ * derived, and every `Tenant.save()` recomputes them, so a concurrent holder
+ * of a stale instance heals rather than conflicts.
+ */
+export declare function recordTenantHierarchyChanges(db: Parameters<typeof bumpChangeFeed>[0], tableName: string, rowIds?: readonly string[]): Promise<void>;
+//# sourceMappingURL=tenant-hierarchy.d.ts.map

package/dist/models/tenant-hierarchy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-hierarchy.d.ts","sourceRoot":"","sources":["../../src/models/tenant-hierarchy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAI1D;;;GAGG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,6DAA6D;AAC7D,MAAM,MAAM,wBAAwB,GAChC,oBAAoB,GACpB,oBAAoB,GACpB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aAG3B,IAAI,EAAE,wBAAwB;gBAD9C,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,wBAAwB;CAKjD;AAED,uDAAuD;AACvD,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,CACL,GAAG,EAAE,MAAM,EACX,GAAG,IAAI,EAAE,OAAO,EAAE,KACf,OAAO,CAAC;QAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC,CAAC;CACxD;AAID,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAQ/D;AAQD,+CAA+C;AAC/C,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,qBAAqB,GAC5B,qBAAqB,CAOvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,uBAAuB,EAC3B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACxC,OAAO,CAAC,qBAAqB,CAAC,CAwChC;AAED,sCAAsC;AACtC,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,uBAAuB,EAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,qBAAqB,EAAE,CAAC,CA6ClC;AAED,4EAA4E;AAC5E,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,uBAAuB,EAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,SAAS,qBAAqB,EAAE,GACxC,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wEAAwE;AACxE,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IAClC,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,SAAS,kBAAkB,EAAE,GAClC,mBAAmB,CA0GrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,EACxC,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/services/PermissionResolver.d.ts

@@ -196,6 +196,27 @@ export declare class PermissionResolver {
      * 4. Return the final effective permission set
      */
     resolveTenantPermissions(tenantId: string): Promise<TenantPermissionInheritanceResult>;
+    private resolveTenantPermissionsInternal;
+    /**
+     * The tenant's ancestors, root first, proven against real `parentTenantId`
+     * links (smrt#3036).
+     *
+     * The materialized `hierarchyPath` is used when it agrees link-by-link with
+     * the parent chain. When it does not — a legacy row with a correct parent
+     * and an empty path, or a stale or forged path — the chain is rebuilt by
+     * walking `parentTenantId`, so a path can never make an unrelated tenant's
+     * overrides cascade in, and a never-materialized row still receives its
+     * real ancestors' DENYs. A parent chain that is itself broken (missing
+     * parent, cycle, or deeper than `MAX_TENANT_HIERARCHY_DEPTH`) throws
+     * {@link TenantHierarchyError}: the resolution fails closed rather than
+     * guessing which overrides apply.
+     *
+     * `unreadableAncestor: 'truncate'` is for callers outside system context
+     * (the display chain), where an ancestor the caller cannot read is
+     * indistinguishable from a missing one: the chain then ends at the nearest
+     * readable ancestor instead of throwing `PARENT_NOT_FOUND`.
+     */
+    private loadVerifiedAncestorChain;
     /**
      * Get the inheritance chain for a tenant (for debugging/display purposes)
      */
@@ -245,6 +266,7 @@ export declare class PermissionResolver {
      * 6. Subtract membership DENY overrides (absolute precedence)
      */
     resolvePermissions(userId: string, tenantId: string, options?: PermissionResolutionOptions): Promise<PermissionResolutionResult>;
+    private resolvePermissionsInternal;
     /**
      * The permission slugs a role grants through the role-permission catalog,
      * excluding every per-tenant, per-group, and per-membership override.

package/dist/services/PermissionResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionResolver.d.ts","sourceRoot":"","sources":["../../src/services/PermissionResolver.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAUjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAA8B,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EACL,KAAK,kBAAkB,EAKxB,MAAM,yBAAyB,CAAC;AAEjC;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,sCAAsC;IACtC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,wCAAwC;IACxC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,8BAA8B;IAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,uCAAuC;IACvC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;;;;;;;;OAUG;IACH,yBAAyB,EAAE,MAAM,EAAE,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD,wEAAwE;IACxE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,2DAA2D;IAC3D,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,iGAAiG;IACjG,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,OAAO,CAAmB;IAClC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAG7B;IACd,OAAO,CAAC,oBAAoB,CAAwB;IACpD,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,wBAAwB,CAA4B;IAC5D,OAAO,CAAC,4BAA4B,CAAgC;IACpE,OAAO,CAAC,qBAAqB,CAAyB;IACtD,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,oBAAoB,CAAwB;IACpD,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,kCAAkC,CAAsC;gBAG9E,OAAO,EAAE,gBAAgB,EACzB,eAAe,GAAE,yBAA8B;IAMjD;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB;IAU7B;;;;;OAKG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBjC;;;;;;;;;;;;OAYG;IACG,wBAAwB,CAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,iCAAiC,CAAC;IAqI7C;;OAEG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAmC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,0BAA0B,CAAC;IA2KtC;;;OAGG;YACW,sBAAsB;IAoBpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;YACW,uBAAuB;IAyKrC;;;;;;;;OAQG;YACW,sBAAsB;IAkDpC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,0BAA0B;IAkGxC;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,OAAO,CAAC;IAKnB;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,OAAO,CAAC;IAKnB;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,OAAO,CAAC;IAKnB;;OAEG;WACU,MAAM,CACjB,OAAO,EAAE,gBAAgB,EACzB,eAAe,GAAE,yBAA8B,GAC9C,OAAO,CAAC,kBAAkB,CAAC;CAK/B"}
+{"version":3,"file":"PermissionResolver.d.ts","sourceRoot":"","sources":["../../src/services/PermissionResolver.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAWjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAA8B,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,EACL,KAAK,kBAAkB,EAKxB,MAAM,yBAAyB,CAAC;AAEjC;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,sCAAsC;IACtC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,wCAAwC;IACxC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,8BAA8B;IAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,uCAAuC;IACvC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;;;;;;;;OAUG;IACH,yBAAyB,EAAE,MAAM,EAAE,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD,wEAAwE;IACxE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,2DAA2D;IAC3D,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,iGAAiG;IACjG,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC;AAuCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,OAAO,CAAmB;IAClC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAG7B;IACd,OAAO,CAAC,oBAAoB,CAAwB;IACpD,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,wBAAwB,CAA4B;IAC5D,OAAO,CAAC,4BAA4B,CAAgC;IACpE,OAAO,CAAC,qBAAqB,CAAyB;IACtD,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,oBAAoB,CAAwB;IACpD,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,kCAAkC,CAAsC;gBAG9E,OAAO,EAAE,gBAAgB,EACzB,eAAe,GAAE,yBAA8B;IAMjD;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB;IAU7B;;;;;OAKG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBjC;;;;;;;;;;;;OAYG;IACG,wBAAwB,CAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,iCAAiC,CAAC;YAM/B,gCAAgC;IAuI9C;;;;;;;;;;;;;;;;;;OAkBG;YACW,yBAAyB;IA0EvC;;OAEG;IACG,yBAAyB,CAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IA2C3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACG,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,0BAA0B,CAAC;YAMxB,0BAA0B;IAgLxC;;;OAGG;YACW,sBAAsB;IAoBpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;YACW,uBAAuB;IA4KrC;;;;;;;;OAQG;YACW,sBAAsB;IAkDpC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,0BAA0B;IAkGxC;;OAEG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,OAAO,CAAC;IAKnB;;OAEG;IACG,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,OAAO,CAAC;IAKnB;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,OAAO,CAAC;IAKnB;;OAEG;WACU,MAAM,CACjB,OAAO,EAAE,gBAAgB,EACzB,eAAe,GAAE,yBAA8B,GAC9C,OAAO,CAAC,kBAAkB,CAAC;CAK/B"}

package/dist/smrt-knowledge.json

@@ -3,14 +3,14 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.51.14",
+  "packageVersion": "0.51.16",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "34d2639c51bf646327afea4470649ddf41515beed335a9c185039cc6978b69ab",
-    "packageJson": "908695fd991f1415e6bce60bc449775393195b3d0c4c610b52ec9917e8408a18",
-    "agents": "0d011d9fe314ca90141f2fa45a97cdbb34dc34d0bb046357dd6d159c686bc41e",
-    "moduleDoc:agents/permissions.md": "165fd67e4ff87d2e4c810ec8f6d9ef4d1bd7d4acc7e9ee0510020625fe2f5153",
+    "manifest": "b6882674446eda5d6f38704b8029ac78a24cd2daadaf0f35a62629c56a103a2e",
+    "packageJson": "1cc836cd453f30426095c1d379325bffef78c8c0470f7de232f613d6e119af0f",
+    "agents": "d7f1bb57f7bbbc1b750ab87c33592a53622236d17f49f8c04b15c4745b5c2ab2",
+    "moduleDoc:agents/permissions.md": "9d061473b4da77aa853a34d7adf1e4cfbaf5984a3ba3f7408df91db75e9e0c73",
     "moduleDoc:agents/oidc-provisioning.md": "5efa607ff23b9a693391e0c02670324a8cea4114d4968c9718f10a763da919c6",
     "moduleDoc:agents/mobile-auth.md": "25e85e83f43e3a46383a92fa809f3a003b4545c3026e78dbe1bccbbc35161e18",
     "moduleDoc:agents/retention.md": "425c0a34ed33969badfef699751bfa670bdf618eda65e079e00815620aabed68"
@@ -2669,7 +2669,6 @@
       "fields": [],
       "relationships": [],
       "methods": [
-        "create",
         "createChild",
         "findActive",
         "findBySlug",
@@ -2689,14 +2688,6 @@
         "validateHierarchy"
       ],
       "methodSignatures": [
-        {
-          "name": "create",
-          "async": true,
-          "params": [
-            "options: SmrtCreateInput<Tenant>"
-          ],
-          "returns": "Promise<Tenant>"
-        },
         {
           "name": "createChild",
           "async": true,
@@ -6169,7 +6160,8 @@
         "getAncestorIds",
         "isActive",
         "isRoot",
-        "isSuspended"
+        "isSuspended",
+        "save"
       ],
       "methodSignatures": [
         {
@@ -6195,6 +6187,14 @@
         {
           "name": "isSuspended",
           "returns": "boolean"
+        },
+        {
+          "name": "save",
+          "async": true,
+          "params": [
+            "options?: SmrtSaveOptions"
+          ],
+          "returns": "Promise<this>"
         }
       ],
       "tableStrategy": "sti",
@@ -6336,6 +6336,13 @@
           "code": "not-included",
           "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Tenant"
+        },
+        {
+          "kind": "api",
+          "operation": "save",
+          "code": "lifecycle-method",
+          "reason": "`save` is a framework lifecycle method, not a distinct operation",
+          "objectName": "@happyvertical/smrt-users:Tenant"
         }
       ],
       "relationshipFeatures": [
@@ -10548,12 +10555,12 @@
     "polymorphicAssociations": 0,
     "uuidColumns": 90
   },
-  "agentDoc": "# @happyvertical/smrt-users\n\nMulti-tenant identity, RBAC, hierarchical tenants, sessions, and SvelteKit auth.\n\n## Modules\n\nRead only the module relevant to the change; protocol and provisioning details\nare not prerequisites for unrelated user-package work.\n\n| Module | Scope | Module doc |\n|---|---|---|\n| `src/services/PermissionResolver.ts` | permission precedence, inherited memberships, guards, RLS, role seeding | [agents/permissions.md](agents/permissions.md) |\n| `src/services/OidcLoginService.ts`, collections and OIDC handlers | identity reconciliation, transaction boundaries, migration readiness | [agents/oidc-provisioning.md](agents/oidc-provisioning.md) |\n| `src/services/MobileAuthService.ts` | mobile handshake, bearer sessions, bootstrap extension boundary | [agents/mobile-auth.md](agents/mobile-auth.md) |\n| `src/retention.ts` | expired session/token/CLI-auth reaping and retention sweep wiring | [agents/retention.md](agents/retention.md) |\n\n## Models and authority\n\n- Users are global; tenant access comes through Membership (unique user/tenant).\n  User email is normalized and globally unique through readonly nullable\n  `emailKey`. `profileId` is a unique cross-package reference: at most one User\n  owns each non-null Profile.\n- Tenant uses STI and a materialized hierarchy, maximum depth 10.\n  `createChild()` calculates paths; `moveToParent()` updates all descendants.\n- Role with `tenantId = null` is available to all tenants; `isSystem` prevents\n  deletion. `inheritsToDescendants` is opt-in. Seed owner/admin/member/viewer\n  through `RoleCollection.seedSystemRoles()` at application initialization.\n- Group roles apply only in their own tenant. Use `getGroupIdsForTenant()`,\n  never cross-tenant `getGroupIds()`, for authorization.\n- Upward visibility is opt-in and read-only: `permissions.ancestorRead`\n  ({ roles, collections, maxDepth? }) lets a DESCENDANT membership contribute\n  declared `<collection>.read` at an ancestor, only when no membership resolved\n  there, intersected with BOTH the role's own catalog grants and the\n  principal's effective permissions in that descendant, and only for SYSTEM\n  roles (a tenant-scoped role sharing a declared slug is ignored). Off by default, never\n  write, never lateral, and never row visibility — sibling rows stay scoped by\n  tenancy/RLS. Read the permissions module before changing it.\n- Membership DENY always wins. Direct inactive membership blocks inherited\n  authority; a direct active membership pins resolution instead of unioning it\n  with ancestors. Read the permissions module before changing these rules.\n- AccessRequest has no generated API/MCP/CLI operations; access it through\n  `AccessRequestService`. Its JSON field is `requestContext`, not reserved\n  slug-scoping `context`.\n\n## Security boundaries\n\n- Generated REST/MCP operations on identity/RBAC models are list/get only.\n  Route authentication does not authorize authority mutations, and these models\n  are not tenant-scoped. Use permission-gated services or explicitly checked\n  consumer handlers. CLI remains a local-operator surface. Preserve the\n  registry assertions in `security-audit-1400.test.ts`.\n- Resource guards take the resource tenant, not the session tenant. Omit a\n  session membership when targeting a different tenant; mismatches fail closed.\n  `loadSessionContext().tenantAuthorization` must be checked by required-tenant\n  consumers: null membership can represent inherited authority.\n- Sessions use secure UUIDs; TTL is seconds (default seven days). Access marks\n  expired sessions EXPIRED. Magic-link tokens are single use.\n- Tenant switching verifies active membership before writing and rotates the\n  session ID for non-null targets, revoking the old session. Persist the returned\n  `SwitchTenantResult.sessionId`; `switchSessionTenant()` updates the cookie and\n  preserves its security settings. Failed switches mutate nothing; null clears\n  do not rotate. `SessionCollection.setSessionTenant()` is unguarded and must\n  never receive an untrusted tenant ID.\n- OIDC provisioning is atomic and fail-closed. Preserve exact issuer/subject\n  identifiers, claim-source email verification, unique global Person ownership,\n  and transaction-bound reconciliation. Read the OIDC module and canonical\n  scenario matrix before changing any provisioning path.\n\n## Entry points and validation\n\n`src/sveltekit/` owns `createSessionHandler`, `createSessionCookie`,\n`destroySessionCookie`, and `switchSessionTenant`. Use README integration examples\nrather than copying application setup into these instructions.\n\nFrom the repository root:\n\n```bash\npnpm --filter @happyvertical/smrt-users test\npnpm --filter @happyvertical/smrt-users typecheck\npnpm --filter @happyvertical/smrt-users test:postgres\n```\n\nStart with the relevant test file via `test -- src/__tests__/<file>.test.ts`.\nRun `test:postgres` for RLS, principal context, OIDC, or terminal-auth database\nchanges. `typecheck` includes Svelte accessibility checks; plain `tsc` is\ninsufficient. Follow root knowledge freshness checks before shipping.\n",
+  "agentDoc": "# @happyvertical/smrt-users\n\nMulti-tenant identity, RBAC, hierarchical tenants, sessions, and SvelteKit auth.\n\n## Modules\n\nRead only the module relevant to the change; protocol and provisioning details\nare not prerequisites for unrelated user-package work.\n\n| Module | Scope | Module doc |\n|---|---|---|\n| `src/services/PermissionResolver.ts` | permission precedence, inherited memberships, guards, RLS, role seeding | [agents/permissions.md](agents/permissions.md) |\n| `src/services/OidcLoginService.ts`, collections and OIDC handlers | identity reconciliation, transaction boundaries, migration readiness | [agents/oidc-provisioning.md](agents/oidc-provisioning.md) |\n| `src/services/MobileAuthService.ts` | mobile handshake, bearer sessions, bootstrap extension boundary | [agents/mobile-auth.md](agents/mobile-auth.md) |\n| `src/retention.ts` | expired session/token/CLI-auth reaping and retention sweep wiring | [agents/retention.md](agents/retention.md) |\n\n## Models and authority\n\n- Users are global; tenant access comes through Membership (unique user/tenant).\n  User email is normalized and globally unique through readonly nullable\n  `emailKey`. `profileId` is a unique cross-package reference: at most one User\n  owns each non-null Profile.\n- Tenant uses STI and a materialized hierarchy, maximum depth 10.\n  `hierarchyPath`/`hierarchyLevel` are derived from `parentTenantId` by\n  `Tenant.save()` on every save (any caller-supplied value is recomputed) and\n  descendants are re-materialized when they change; never hand-maintain them.\n  Legacy rows are backfilled with `smrt db:materialize-tenant-hierarchy`\n  (`materializeTenantHierarchy()`). Tests that need a corrupt path must write it\n  with raw SQL (#3036).\n- Role with `tenantId = null` is available to all tenants; `isSystem` prevents\n  deletion. `inheritsToDescendants` is opt-in. Seed owner/admin/member/viewer\n  through `RoleCollection.seedSystemRoles()` at application initialization.\n- Group roles apply only in their own tenant. Use `getGroupIdsForTenant()`,\n  never cross-tenant `getGroupIds()`, for authorization.\n- Upward visibility is opt-in and read-only: `permissions.ancestorRead`\n  ({ roles, collections, maxDepth? }) lets a DESCENDANT membership contribute\n  declared `<collection>.read` at an ancestor, only when no membership resolved\n  there, intersected with BOTH the role's own catalog grants and the\n  principal's effective permissions in that descendant, and only for SYSTEM\n  roles (a tenant-scoped role sharing a declared slug is ignored). Off by default, never\n  write, never lateral, and never row visibility — sibling rows stay scoped by\n  tenancy/RLS. Read the permissions module before changing it.\n- Membership DENY always wins. Direct inactive membership blocks inherited\n  authority; a direct active membership pins resolution instead of unioning it\n  with ancestors. Read the permissions module before changing these rules.\n- AccessRequest has no generated API/MCP/CLI operations; access it through\n  `AccessRequestService`. Its JSON field is `requestContext`, not reserved\n  slug-scoping `context`.\n\n## Security boundaries\n\n- Generated REST/MCP operations on identity/RBAC models are list/get only.\n  Route authentication does not authorize authority mutations, and these models\n  are not tenant-scoped. Use permission-gated services or explicitly checked\n  consumer handlers. CLI remains a local-operator surface. Preserve the\n  registry assertions in `security-audit-1400.test.ts`.\n- Resource guards take the resource tenant, not the session tenant. Omit a\n  session membership when targeting a different tenant; mismatches fail closed.\n  `loadSessionContext().tenantAuthorization` must be checked by required-tenant\n  consumers: null membership can represent inherited authority.\n- Sessions use secure UUIDs; TTL is seconds (default seven days). Access marks\n  expired sessions EXPIRED. Magic-link tokens are single use.\n- Tenant switching verifies active membership before writing and rotates the\n  session ID for non-null targets, revoking the old session. Persist the returned\n  `SwitchTenantResult.sessionId`; `switchSessionTenant()` updates the cookie and\n  preserves its security settings. Failed switches mutate nothing; null clears\n  do not rotate. `SessionCollection.setSessionTenant()` is unguarded and must\n  never receive an untrusted tenant ID.\n- OIDC provisioning is atomic and fail-closed. Preserve exact issuer/subject\n  identifiers, claim-source email verification, unique global Person ownership,\n  and transaction-bound reconciliation. Read the OIDC module and canonical\n  scenario matrix before changing any provisioning path.\n\n## Entry points and validation\n\n`src/sveltekit/` owns `createSessionHandler`, `createSessionCookie`,\n`destroySessionCookie`, and `switchSessionTenant`. Use README integration examples\nrather than copying application setup into these instructions.\n\nFrom the repository root:\n\n```bash\npnpm --filter @happyvertical/smrt-users test\npnpm --filter @happyvertical/smrt-users typecheck\npnpm --filter @happyvertical/smrt-users test:postgres\n```\n\nStart with the relevant test file via `test -- src/__tests__/<file>.test.ts`.\nRun `test:postgres` for RLS, principal context, OIDC, or terminal-auth database\nchanges. `typecheck` includes Svelte accessibility checks; plain `tsc` is\ninsufficient. Follow root knowledge freshness checks before shipping.\n",
   "moduleDocs": [
     {
       "path": "agents/permissions.md",
       "module": "permissions",
-      "content": "# Permissions and tenant inheritance\n\nRead for `src/services/PermissionResolver.ts`, operation guards, role seeding,\nRLS, and tenant-hierarchy changes. Integration examples live in README's\nmanifest-derived permission catalog and PostgreSQL RLS sections.\n\n## Membership selection\n\n1. A direct target-tenant membership pins resolution: active resolves normally;\n   pending/suspended returns empty. Never union direct and ancestor roles.\n2. Otherwise walk hierarchyPath nearest-first for the nearest active ancestor\n   membership whose role has inheritsToDescendants. Skip inactive/unflagged\n   ancestors; they neither grant nor block. No qualifying ancestor means empty.\n3. Run later layers against the target tenant. Only target-tenant groups apply;\n   membership overrides travel with the chosen ancestor membership.\n   inheritedFromTenantId reports that ancestor, null for direct resolution.\n\nVerify hierarchyPath link-by-link against loaded parentTenantId rows before\ntrusting it: excess depth, self-reference, duplicates or inconsistent paths\nfail closed. Bound traversal by MAX_TENANT_HIERARCHY_DEPTH. Tenant status is not\nconsulted, matching direct resolution. Long-lived user/tenant caches must\ninvalidate ancestor membership changes and inheritsToDescendants flips;\nrequest-scoped caches do not survive those requests.\n\n`loadSessionContext().tenantAuthorization` is authoritative for required-tenant\nconsumers; membership null can mean inherited authority.\n\n4. If no membership resolved at all, apply the opt-in ancestor-read policy\n   (smrt#2939): the user's ACTIVE memberships on VERIFIED DESCENDANTS of the\n   target, whose role slug is declared in `permissions.ancestorRead.roles` and\n   within `maxDepth` hops, contribute `<collection>.read` for declared\n   collections, intersected with BOTH that role's own catalog grants (so a\n   descendant-side tenant GRANT, group role, or membership GRANT cannot widen\n   it) AND the principal's effective permissions in that descendant (so its\n   DENY cascade and membership DENY apply). Only a SYSTEM\n   role (`tenantId` null, `isSystem: true`) matches a declared slug: slugs are\n   not unique across a hierarchy, so a tenant-scoped custom role of the same\n   name must not opt its tenant in. Off by default;\n   read-only; never lateral; never reached when a direct or inherited\n   membership already decided. The target tenant's DENY still subtracts.\n   `ancestorReadFromTenantIds` reports the contributing descendants. The grant\n   carries no membership, so `membershipId`/`tenantAuthorization.membershipId`\n   stay null and a consumer requiring a non-empty membership still refuses.\n\n## Permission precedence\n\nApply these layers in order, later layers overriding earlier ones:\n\n1. Ancestor TenantPermissionOverride cascade (GRANT adds, DENY removes).\n2. Selected membership role permissions.\n3. Target-tenant group-role permissions.\n4. Tenant cascade's net DENY removes role/group grants.\n5. Membership GRANT may re-add a tenant-denied slug.\n6. Membership DENY removes last and always wins.\n\nThe tenant block is the cascade's net result, not the union of historical DENYs:\na child's more-specific GRANT can override a parent DENY. Use a direct child\nmembership or tenant DENY to attenuate inherited role authority.\n`getGroupIdsForTenant(userId, tenantId)` is required; getGroupIds is cross-tenant.\n\n## Hierarchies and seeding\n\n- createChild calculates paths/depth; moveToParent updates all descendants;\n  getTree(rootId?) returns UI structure. Maximum depth is 10.\n- Tenant override cascade requires parent cascadePermissions and child\n  inheritPermissions. These flags do not gate the independent, per-role\n  inheritsToDescendants membership flow.\n- `permissions.ancestorRead` in the `users` package config declares upward,\n  read-only visibility: `{ roles, collections, maxDepth? }`. Both lists are\n  required and non-empty and `maxDepth >= 1`, else the policy is OFF — there is\n  no partially valid declaration. `isAncestorReadableSlug()` is the single place\n  the read-only bound is enforced; only a two-segment `<collection>.<action>`\n  slug whose action normalizes to `read` on a declared collection passes.\n  `PermissionResolver.create(options, { ancestorReadPolicy })` binds one\n  resolver; `null` forces it off. It grants the OPERATION at the ancestor, never\n  row visibility — sibling rows stay scoped by the tenancy interceptor and RLS.\n- seedSystemRoles({ inheritsToDescendants: ['owner', 'admin'] }) flags listed\n  slugs additively, never unflags omitted ones, and rejects unknown slugs.\n  Default seeds are exact-tenant.\n- RolePermissionCollection.seedRolePermissions() or\n  seedSystemRoles({ seedPermissions: true }) maps owner/admin to all catalog\n  permissions, member to ordinary-resource read/create, viewer to read. Member\n  create excludes identity/RBAC/security resources and their joins/overrides.\n  Seeding is additive/idempotent; removal requires prune: true.\n- When a package adds built-in self-personalization permissions after role\n  creation, explicitly call seedDefaultRolePersonalizationPermissions(). It\n  upgrades owner/admin/member/viewer idempotently and never grants custom roles.\n\n## Guards and RLS\n\nPermissionCatalogService derives collection.action slugs from manifests,\nincluding custom actions; list/get map to read. Hand-written mutations in form\nhandlers, endpoints, CLI and jobs use assertOperationPermission(). It requires\ncatalog presence then resolves permissions, throwing fail-closed by default.\nUse onDeny: 'return', checkOperationPermission or hasOperationPermission only\nwhen the caller handles a structured/boolean denial.\n\nGenerated SvelteKit write routes (POST/PUT/PATCH/DELETE CRUD and mutating\ncustom actions) enforce the same `collection.action` slug (custom actions use\n`collection.<method>`; actions hosted on a collection class use the item collection, which the catalog now emits) after authentication: the slug must be in the request's\nsession permission snapshot (`locals.permissions`/`permissionSet`/\n`smrtPermissions` or `locals.tenantContext.permissions`), otherwise 403. Only\n`locals.tenantContext.superAdminBypass` skips it; `api.public: true` stays open.\n\nResource-anchored guards receive the resource tenant ID. When it differs from\nthe session tenant, omit the session membership so the resolver selects the\nappropriate authority; mismatched supplied membership/tenant fails closed.\nInherited root-admin authority can then authorize descendant resources without\napplication-side membership fan-out.\n\nSystem context and super-admin bypass are honored. Pass\nallowSuperAdminBypass: false for money or separation-of-duties operations that\nrequire an explicit grant.\n\ngeneratePostgresPermissionSql/applyPostgresPermissionPolicies enforce generated\nRLS using smrt.permissions and smrt.tenant_id, installed with set_config by\nwithSessionPermissionContext. This bounds REST, MCP and in-process database\naccess once principal context is set. Child-tenant sessions receive resolved\ninherited permissions automatically, but RLS row filtering remains bound to the\nsession tenant: a root session's app-level guard authorization does not itself\npermit child rows through RLS. Preserve this distinction.\n"
+      "content": "# Permissions and tenant inheritance\n\nRead for `src/services/PermissionResolver.ts`, operation guards, role seeding,\nRLS, and tenant-hierarchy changes. Integration examples live in README's\nmanifest-derived permission catalog and PostgreSQL RLS sections.\n\n## Membership selection\n\n1. A direct target-tenant membership pins resolution: active resolves normally;\n   pending/suspended returns empty. Never union direct and ancestor roles.\n2. Otherwise walk hierarchyPath nearest-first for the nearest active ancestor\n   membership whose role has inheritsToDescendants. Skip inactive/unflagged\n   ancestors; they neither grant nor block. No qualifying ancestor means empty.\n3. Run later layers against the target tenant. Only target-tenant groups apply;\n   membership overrides travel with the chosen ancestor membership.\n   inheritedFromTenantId reports that ancestor, null for direct resolution.\n\nVerify hierarchyPath link-by-link against loaded parentTenantId rows before\ntrusting it: excess depth, self-reference, duplicates or inconsistent paths\nfail closed. Bound traversal by MAX_TENANT_HIERARCHY_DEPTH. Tenant status is not\nconsulted, matching direct resolution. Long-lived user/tenant caches must\ninvalidate ancestor membership changes and inheritsToDescendants flips;\nrequest-scoped caches do not survive those requests.\n\n`loadSessionContext().tenantAuthorization` is authoritative for required-tenant\nconsumers; membership null can mean inherited authority.\n\n4. If no membership resolved at all, apply the opt-in ancestor-read policy\n   (smrt#2939): the user's ACTIVE memberships on VERIFIED DESCENDANTS of the\n   target, whose role slug is declared in `permissions.ancestorRead.roles` and\n   within `maxDepth` hops, contribute `<collection>.read` for declared\n   collections, intersected with BOTH that role's own catalog grants (so a\n   descendant-side tenant GRANT, group role, or membership GRANT cannot widen\n   it) AND the principal's effective permissions in that descendant (so its\n   DENY cascade and membership DENY apply). Only a SYSTEM\n   role (`tenantId` null, `isSystem: true`) matches a declared slug: slugs are\n   not unique across a hierarchy, so a tenant-scoped custom role of the same\n   name must not opt its tenant in. Off by default;\n   read-only; never lateral; never reached when a direct or inherited\n   membership already decided. The target tenant's DENY still subtracts.\n   `ancestorReadFromTenantIds` reports the contributing descendants. The grant\n   carries no membership, so `membershipId`/`tenantAuthorization.membershipId`\n   stay null and a consumer requiring a non-empty membership still refuses.\n\n## Permission precedence\n\nApply these layers in order, later layers overriding earlier ones:\n\n1. Ancestor TenantPermissionOverride cascade (GRANT adds, DENY removes).\n2. Selected membership role permissions.\n3. Target-tenant group-role permissions.\n4. Tenant cascade's net DENY removes role/group grants.\n5. Membership GRANT may re-add a tenant-denied slug.\n6. Membership DENY removes last and always wins.\n\nThe tenant block is the cascade's net result, not the union of historical DENYs:\na child's more-specific GRANT can override a parent DENY. Use a direct child\nmembership or tenant DENY to attenuate inherited role authority.\n`getGroupIdsForTenant(userId, tenantId)` is required; getGroupIds is cross-tenant.\n\n## Hierarchies and seeding\n\n- `Tenant.save()` derives hierarchyPath/hierarchyLevel from the REAL\n  parentTenantId chain on every save (never from an ancestor's stored path),\n  refuses missing parents, cycles and over-depth before writing, and\n  re-materializes descendants by raw column update (so STI subclass columns\n  are never clobbered). createChild/moveToParent/makeRoot are thin wrappers.\n  `materializeTenantHierarchy(db, { dryRun })` / `smrt\n  db:materialize-tenant-hierarchy` backfills legacy rows: idempotent, one\n  transaction, refuses a broken chain without writing (#3036). A NEW or\n  CHANGED parent link is authority-bearing, so `Tenant.save()` first loads the\n  parent through TenantCollection (the caller's tenancy scope) and refuses an\n  invisible one on every path — helpers, `create({ parentTenantId })`, or a\n  plain assignment + save; system context bypasses as usual, and an unchanged\n  link is never re-checked. getTree(rootId?)\n  returns UI structure. Maximum depth is 10.\n- Tenant override cascade requires parent cascadePermissions and child\n  inheritPermissions. These flags do not gate the independent, per-role\n  inheritsToDescendants membership flow.\n- `permissions.ancestorRead` in the `users` package config declares upward,\n  read-only visibility: `{ roles, collections, maxDepth? }`. Both lists are\n  required and non-empty and `maxDepth >= 1`, else the policy is OFF — there is\n  no partially valid declaration. `isAncestorReadableSlug()` is the single place\n  the read-only bound is enforced; only a two-segment `<collection>.<action>`\n  slug whose action normalizes to `read` on a declared collection passes.\n  `PermissionResolver.create(options, { ancestorReadPolicy })` binds one\n  resolver; `null` forces it off. It grants the OPERATION at the ancestor, never\n  row visibility — sibling rows stay scoped by the tenancy interceptor and RLS.\n- seedSystemRoles({ inheritsToDescendants: ['owner', 'admin'] }) flags listed\n  slugs additively, never unflags omitted ones, and rejects unknown slugs.\n  Default seeds are exact-tenant.\n- RolePermissionCollection.seedRolePermissions() or\n  seedSystemRoles({ seedPermissions: true }) maps owner/admin to all catalog\n  permissions, member to ordinary-resource read/create, viewer to read. Member\n  create excludes identity/RBAC/security resources and their joins/overrides.\n  Seeding is additive/idempotent; removal requires prune: true.\n- When a package adds built-in self-personalization permissions after role\n  creation, explicitly call seedDefaultRolePersonalizationPermissions(). It\n  upgrades owner/admin/member/viewer idempotently and never grants custom roles.\n\n## Guards and RLS\n\nPermissionCatalogService derives collection.action slugs from manifests,\nincluding custom actions; list/get map to read. Hand-written mutations in form\nhandlers, endpoints, CLI and jobs use assertOperationPermission(). It requires\ncatalog presence then resolves permissions, throwing fail-closed by default.\nUse onDeny: 'return', checkOperationPermission or hasOperationPermission only\nwhen the caller handles a structured/boolean denial.\n\nGenerated SvelteKit write routes (POST/PUT/PATCH/DELETE CRUD and mutating\ncustom actions) enforce the same `collection.action` slug (custom actions use\n`collection.<method>`; actions hosted on a collection class use the item collection, which the catalog now emits) after authentication: the slug must be in the request's\nsession permission snapshot (`locals.permissions`/`permissionSet`/\n`smrtPermissions` or `locals.tenantContext.permissions`), otherwise 403. Only\n`locals.tenantContext.superAdminBypass` skips it; `api.public: true` stays open.\n\nResource-anchored guards receive the resource tenant ID. When it differs from\nthe session tenant, omit the session membership so the resolver selects the\nappropriate authority; mismatched supplied membership/tenant fails closed.\nInherited root-admin authority can then authorize descendant resources without\napplication-side membership fan-out.\n\nPermissionResolver runs every resolution inside smrt-tenancy's system context\n(#3036). Its reads are deliberately cross-tenant and framework-owned — the\nancestor TenantPermissionOverride batch, ancestor memberships for\ninheritsToDescendants, descendant memberships for ancestor-read — and are keyed\nby the explicit (userId, tenantId); with those classes registered tenant-scoped\n(`autoFilter`) the consumer's filter otherwise threw TenantIsolationError or\nsilently narrowed them. It returns slugs and ids only, never rows, and the\ncaller's own reads stay filtered. Do not move a resolver read back under the\nambient tenant; the Postgres regression suite\n`issue-3036-hierarchy-resolution-postgres.test.ts` pins this. Because nothing\nbackstops those reads any more, the tenant-override cascade verifies its chain\ntoo: it uses hierarchyPath only when it agrees link-by-link with\nparentTenantId, otherwise walks the real parent links (so a forged path cannot\ncascade an unrelated tenant in, and a never-materialized row still gets its real\nancestors' DENYs — and GRANTs), and throws TenantHierarchyError on a broken\nreal chain: a per-request failure for that tenant's whole subtree, which\n`smrt db:materialize-tenant-hierarchy --dry-run` reports ahead of time (see\nREADME \"Upgrading an existing fleet\").\n`getTenantInheritanceChain()` returns Tenant rows, so it is NOT run in system\ncontext; it reports the same verified chain the cascade applies when the\ncaller can read every ancestor. Otherwise it never reports PARENT_NOT_FOUND\nfor a row the caller simply cannot see: an interceptor refusal surfaces as\nTenantIsolationError, and a silently filtered row (e.g. RLS) ends the chain at\nthe nearest readable ancestor. Descendant path rewrites are raw column updates recorded through\n`bumpChangeFeed`; `updated_at` is intentionally not bumped (derived columns;\nevery save recomputes them). They are not atomic with the moving row's save —\nan interrupted subtree fails closed until re-saved or backfilled.\n\nSystem context and super-admin bypass are honored. Pass\nallowSuperAdminBypass: false for money or separation-of-duties operations that\nrequire an explicit grant.\n\ngeneratePostgresPermissionSql/applyPostgresPermissionPolicies enforce generated\nRLS using smrt.permissions and smrt.tenant_id, installed with set_config by\nwithSessionPermissionContext. This bounds REST, MCP and in-process database\naccess once principal context is set. Child-tenant sessions receive resolved\ninherited permissions automatically, but RLS row filtering remains bound to the\nsession tenant: a root session's app-level guard authorization does not itself\npermit child rows through RLS. Preserve this distinction.\n"
     },
     {
       "path": "agents/oidc-provisioning.md",

package/dist/sveltekit.js

@@ -1,4 +1,4 @@
-import { C as decodeOidcTransaction, E as resolveOidcProviderConfig, S as OidcLoginService, T as getUsersOidcConfig, _ as readMobileBearerToken, a as TerminalAuthRateLimitError, g as MobileAuthService, h as MobileAuthError, i as TerminalAuthError, m as withSessionPermissionContext, o as TerminalAuthService, s as OperationPermissionError, v as validateMobileRedirectUri, w as encodeOidcTransaction, x as OidcLoginError, y as SessionService } from "./chunks/TerminalAuthService-DgAU4Fz1.js";
+import { C as decodeOidcTransaction, E as resolveOidcProviderConfig, S as OidcLoginService, T as getUsersOidcConfig, _ as readMobileBearerToken, a as TerminalAuthRateLimitError, g as MobileAuthService, h as MobileAuthError, i as TerminalAuthError, m as withSessionPermissionContext, o as TerminalAuthService, s as OperationPermissionError, v as validateMobileRedirectUri, w as encodeOidcTransaction, x as OidcLoginError, y as SessionService } from "./chunks/TerminalAuthService-BBxkYCOG.js";
 import { DiscoveryArtifactValidationError, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, canonicalizeDiscoveryArtifact, createDiscoveryConformanceArtifact, deriveCommandRequirements, validateDiscoveryConformanceArtifact } from "./app-contract.js";
 import { ObjectRegistry, createClassNamePredicate, resolveCustomActionMetadata, resolveEffectiveActionMetadata } from "@happyvertical/smrt-core";
 import { createLogger } from "@happyvertical/logger";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-users",
-  "version": "0.51.14",
+  "version": "0.51.16",
   "smrtJsdoc": "strict",
   "description": "Multi-tenant user management for the SMRT framework - users, tenants, roles, permissions, groups",
   "type": "module",
@@ -47,18 +47,18 @@
   },
   "dependencies": {
     "@happyvertical/logger": "^0.89.12",
-    "@happyvertical/smrt-config": "0.51.14",
-    "@happyvertical/smrt-core": "0.51.14",
-    "@happyvertical/smrt-mobile-contract": "0.51.14",
-    "@happyvertical/smrt-profiles": "0.51.14",
-    "@happyvertical/smrt-tenancy": "0.51.14",
-    "@happyvertical/smrt-types": "0.51.14",
-    "@happyvertical/smrt-ui": "0.51.14",
+    "@happyvertical/smrt-config": "0.51.16",
+    "@happyvertical/smrt-core": "0.51.16",
+    "@happyvertical/smrt-mobile-contract": "0.51.16",
+    "@happyvertical/smrt-profiles": "0.51.16",
+    "@happyvertical/smrt-tenancy": "0.51.16",
+    "@happyvertical/smrt-types": "0.51.16",
+    "@happyvertical/smrt-ui": "0.51.16",
     "@happyvertical/sql": "^0.89.12",
     "jose": "^6.2.12"
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.51.14",
+    "@happyvertical/smrt-vitest": "0.51.16",
     "@sveltejs/package": "^2.5.8",
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
     "@types/node": "24.13.6",
@@ -96,7 +96,7 @@
     "clean": "rm -rf dist",
     "dev": "npm run build:watch",
     "test": "vitest run",
-    "test:postgres": "node ../../scripts/run-with-ci-postgres.mjs -- pnpm exec vitest run src/__tests__/permission-postgres-rls.test.ts src/__tests__/principal-permission-context-postgres.test.ts src/__tests__/oidc-provisioning-postgres.test.ts src/__tests__/legacy-user-profile-backfill-postgres.test.ts src/__tests__/terminal-auth-postgres.test.ts src/__tests__/resource-grant-postgres.test.ts",
+    "test:postgres": "node ../../scripts/run-with-ci-postgres.mjs -- pnpm exec vitest run src/__tests__/permission-postgres-rls.test.ts src/__tests__/principal-permission-context-postgres.test.ts src/__tests__/oidc-provisioning-postgres.test.ts src/__tests__/legacy-user-profile-backfill-postgres.test.ts src/__tests__/terminal-auth-postgres.test.ts src/__tests__/resource-grant-postgres.test.ts src/__tests__/issue-3036-hierarchy-resolution-postgres.test.ts",
     "typecheck": "tsc --noEmit && node ../../scripts/svelte-check-a11y.mjs --tsconfig ./tsconfig.svelte.json",
     "check": "pnpm exec svelte-check --tsconfig ./tsconfig.svelte.json",
     "verify:pack": "node ../../scripts/verify-package-types-exports.js ."