@happyvertical/smrt-users 0.51.32 → 0.51.33

package/dist/services/AccessRequestService.d.ts

@@ -1,10 +1,46 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
+/**
+ * AccessRequestService — the mechanism behind the "request access / waitlist"
+ * identity primitive, plus graduation of an approved request into a `User`.
+ *
+ * ## Responsibilities
+ *
+ * - **Public-safe creation** ({@link AccessRequestService.createAccessRequest}):
+ *   validates + normalizes the email and de-duplicates against any open request
+ *   for the same email. Intended to be called *unauthenticated* by consuming
+ *   apps from their own rate-limited endpoint (the app owns rate-limiting).
+ * - **Operator triage** (`list` / `get` / `approve` / `decline` / `cancel`):
+ *   gated behind capabilities (see {@link AccessRequestAuthorizer}).
+ * - **Graduation** ({@link AccessRequestService.graduateAccessRequest}): creates
+ *   or links a `User` from the request — reusing the existing user / membership
+ *   / tenant collections rather than duplicating them — and (optionally)
+ *   attaches the user to a brand-new tenant (requester as owner), an existing
+ *   tenant, or no tenant at all. Idempotent.
+ * - **Events** ({@link AccessRequestEventHandler}): emits
+ *   `access-request.created | approved | declined | canceled | graduated` so
+ *   apps can react (send a magic-link/invite on `graduated`, notify ops on
+ *   `created`, …). This service deliberately does **not** own email/notification
+ *   delivery — bridge the event hook to your delivery channel (a function, an
+ *   `EventEmitter`, the core `DispatchBus`, …).
+ *
+ * @remarks
+ * **Security.** Operator methods are gated only when an {@link AccessRequestAuthorizer}
+ * is supplied via {@link AccessRequestServiceOptions.authorize}; without one
+ * they are ungated, exactly like {@link TerminalAuthService.approveRequest}
+ * trusts its caller to authenticate first. Production apps that expose these
+ * methods MUST either provide an `authorize` hook or perform their own
+ * capability checks at the route layer. `createAccessRequest` is *always*
+ * ungated by design (public-safe). The model's generated REST/MCP/CLI surface
+ * is closed, so there is no unauthenticated network route by default.
+ *
+ * @packageDocumentation
+ */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
 import { AccessRequestCollection } from '../collections/AccessRequestCollection.js';
-import { AccessRequest } from '../models/AccessRequest.js';
-import { Membership } from '../models/Membership.js';
-import { Tenant } from '../models/Tenant.js';
-import { User } from '../models/User.js';
-import { AccessRequestStatus, TenantStatus, UserStatus } from '../types/index.js';
+import type { AccessRequest } from '../models/AccessRequest.js';
+import type { Membership } from '../models/Membership.js';
+import type { Tenant } from '../models/Tenant.js';
+import type { User } from '../models/User.js';
+import { AccessRequestStatus, type TenantStatus, UserStatus } from '../types/index.js';
 /**
  * Capabilities that gate the operator-facing methods of
  * {@link AccessRequestService}.

package/dist/services/MagicLinkService.d.ts

@@ -1,4 +1,33 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
+/**
+ * MagicLinkService - Passwordless email authentication via signed magic link tokens
+ *
+ * This service handles token generation and verification for magic link
+ * authentication. It is framework-agnostic: it returns tokens and verification
+ * results, leaving email delivery and cookie management to the caller.
+ *
+ * Flow:
+ * 1. User enters email → generate(email) → token + expiresAt
+ * 2. Caller sends email with link containing the token
+ * 3. User clicks link → verify(token) → { email, nonce }
+ * 4. Caller creates session (via SessionService or createSessionCookie)
+ *
+ * @packageDocumentation
+ *
+ * @example
+ * ```typescript
+ * const magicLink = await MagicLinkService.create({
+ *   db: { type: 'postgres', url: process.env.DATABASE_URL },
+ *   secret: process.env.AUTH_SECRET,
+ * });
+ *
+ * // Generate a magic link token
+ * const { token, expiresAt } = await magicLink.generate('user@example.com');
+ *
+ * // Verify a magic link token (single-use)
+ * const { email, nonce } = await magicLink.verify(token);
+ * ```
+ */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
 /**
  * Options for MagicLinkService
  */

package/dist/services/MobileAuthService.d.ts

@@ -1,8 +1,46 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { MobileAuthCompleteRequest, MobileAuthSession, MobileAuthStartRequest, MobileAuthStartResponse, MobileSessionBootstrap, MobileTenantOption } from '@happyvertical/smrt-mobile-contract';
-import { OidcClaims } from '../collections/UserCollection.js';
-import { OidcProviderResolutionOptions, OidcTokenSet } from './OidcLoginService.js';
-import { SessionContext, SessionService } from './SessionService.js';
+/**
+ * MobileAuthService — server side of the SMRT mobile `/api/mobile` contract
+ * (ADR 0001 Phase 3.5, issue #1748).
+ *
+ * Implements server-brokered OIDC/PKCE for native mobile clients on top of
+ * the existing building blocks: {@link OidcLoginService} for the protocol
+ * work, {@link SessionService} for the opaque bearer session (the session id
+ * IS the bearer token — the same convention `TerminalAuthService` ships), and
+ * the membership/role/tenant collections for the session bootstrap.
+ *
+ * Wire DTOs come from `@happyvertical/smrt-mobile-contract` — the owning
+ * package for both the Kotlin client contract and these TypeScript types.
+ *
+ * ## Stateless completion: the state token
+ *
+ * The mobile flow has no cookie jar, so the web flow's HMAC-signed
+ * transaction cookie cannot carry `state`/`nonce`/`codeVerifier` across the
+ * redirect. Instead (per the frozen contract) the CLIENT persists and echoes
+ * `state` + `codeVerifier`, and the server stays stateless by making the
+ * OAuth `state` value itself a signed token: base64url JSON carrying the
+ * nonce, provider, and creation time, plus an HMAC-SHA256 signature when a
+ * secret is available (`stateSecret` option, defaulting to the provider's
+ * `clientSecret` — the same fallback the web transaction cookie uses). The
+ * client treats `state` as opaque; `MobileSessionManager` just compares the
+ * redirect's `state` to the persisted one and echoes it back.
+ *
+ * The `codeVerifier` deliberately NEVER rides inside the state token: state
+ * appears in the authorization URL (browser history, proxy logs), and a
+ * verifier there would defeat PKCE. It stays client-held — returned once in
+ * the `auth/start` response body and echoed once in the `auth/complete`
+ * request body, both over TLS POSTs. The nonce, by contrast, is already a
+ * query parameter of the authorization URL, so embedding it in `state`
+ * leaks nothing while letting the server enforce full ID-token nonce
+ * verification without server-side pending state.
+ *
+ * @packageDocumentation
+ */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import type { MobileAuthCompleteRequest, MobileAuthSession, MobileAuthStartRequest, MobileAuthStartResponse, MobileSessionBootstrap, MobileTenantOption } from '@happyvertical/smrt-mobile-contract';
+import { type OidcClaims } from '../collections/UserCollection.js';
+import { type OidcProviderResolutionOptions, type OidcTokenSet } from './OidcLoginService.js';
+import type { SessionContext } from './SessionService.js';
+import { SessionService } from './SessionService.js';
 /**
  * Machine-readable error codes carried on {@link MobileAuthError} and in the
  * JSON error body (`{ error, code }`) the SvelteKit handlers emit.

package/dist/services/OidcLoginService.d.ts

@@ -1,5 +1,15 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { OidcClaims, OidcIdentityResult, OidcProfileOwnerAuthorizer, OidcProfileResolver } from '../collections/UserCollection.js';
+/**
+ * OidcLoginService - OAuth2/OIDC authorization-code login with PKCE.
+ *
+ * The service is provider-generic and works with standards-compliant IdPs such
+ * as Kanidm, Dex, Keycloak, Authentik, Google, and others. It handles provider
+ * discovery, authorization URL construction, token exchange, ID token
+ * verification, and SMRT User/Profile creation.
+ *
+ * @packageDocumentation
+ */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import { type OidcClaims, type OidcIdentityResult, type OidcProfileOwnerAuthorizer, type OidcProfileResolver } from '../collections/UserCollection.js';
 export type OidcProviderKind = 'kanidm' | 'dex' | 'generic';
 export type OidcTokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'none';
 export interface OidcProviderConfig {

package/dist/services/OperationPermissionService.d.ts

@@ -1,6 +1,10 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { OperationPermissionCollectionInput, PermissionCatalog } from './PermissionCatalogService.js';
-import { PermissionResolutionOptions, PermissionResolver } from './PermissionResolver.js';
+/**
+ * Reusable operation-level permission guard for hand-written server surfaces.
+ * @packageDocumentation
+ */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import { type OperationPermissionCollectionInput, type PermissionCatalog } from './PermissionCatalogService.js';
+import { type PermissionResolutionOptions, PermissionResolver } from './PermissionResolver.js';
 export type OperationPermissionDenyReason = 'invalid_operation' | 'missing_principal' | 'resolution_error' | 'unknown_permission' | 'permission_denied';
 export type OperationPermissionAllowReason = 'permission_granted' | 'super_admin_bypass' | 'system_context_bypass';
 export interface OperationPermissionDecision {

package/dist/services/PermissionCatalogService.d.ts

@@ -1,4 +1,8 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
+/**
+ * Manifest-derived permission cataloging and syncing
+ * @packageDocumentation
+ */
+import { type SmrtClassOptions } from '@happyvertical/smrt-core';
 export type PermissionCatalogSource = 'manifest' | 'config' | 'runtime';
 export type PostgresPermissionAction = 'SELECT' | 'INSERT' | 'UPDATE' | 'DELETE';
 export interface PostgresPermissionBinding {

package/dist/services/PermissionResolver.d.ts

@@ -1,7 +1,11 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { Membership } from '../models/Membership.js';
-import { Tenant } from '../models/Tenant.js';
-import { AncestorReadPolicy } from './AncestorReadPolicy.js';
+/**
+ * PermissionResolver - Resolves effective permissions for a user in a tenant
+ * @packageDocumentation
+ */
+import { type SmrtClassOptions } from '@happyvertical/smrt-core';
+import type { Membership } from '../models/Membership.js';
+import { type Tenant } from '../models/Tenant.js';
+import { type AncestorReadPolicy } from './AncestorReadPolicy.js';
 /**
  * Permission resolution result
  */

package/dist/services/PostgresPermissionPolicies.d.ts

@@ -1,5 +1,9 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { PostgresPermissionAction, PostgresPermissionBinding } from './PermissionCatalogService.js';
+/**
+ * Postgres policy generation and application for SMRT permissions
+ * @packageDocumentation
+ */
+import { type SmrtClassOptions } from '@happyvertical/smrt-core';
+import { type PostgresPermissionAction, type PostgresPermissionBinding } from './PermissionCatalogService.js';
 export interface PostgresPermissionPolicyReportItem {
     className?: string;
     collection?: string;

package/dist/services/ResourceGrantService.d.ts

@@ -1,6 +1,7 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { ResourceGrant, ResourceGrantEffect } from '../models/ResourceGrant.js';
-import { OperationPermissionOptions } from './OperationPermissionService.js';
+/** Composition of tenant operation permissions with exact resource grants. @packageDocumentation */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import type { ResourceGrant, ResourceGrantEffect } from '../models/ResourceGrant.js';
+import { type OperationPermissionOptions } from './OperationPermissionService.js';
 export declare const MAX_RESOURCE_GRANT_DELEGATION_DEPTH = 8;
 export interface ResourceIdentity {
     tenantId: string;

package/dist/services/SessionPermissionContext.d.ts

@@ -1,8 +1,12 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { DatabaseInterface } from '@happyvertical/sql';
-import { Membership } from '../models/Membership.js';
+/**
+ * Request-scoped session permission context helpers
+ * @packageDocumentation
+ */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import type { DatabaseInterface } from '@happyvertical/sql';
+import type { Membership } from '../models/Membership.js';
 import { PermissionResolver } from './PermissionResolver.js';
-import { SessionContext, SessionService } from './SessionService.js';
+import { type SessionContext, SessionService } from './SessionService.js';
 interface QueryableDatabase extends DatabaseInterface {
     beginTransaction?: () => Promise<TransactionDatabase>;
     url: string;

package/dist/services/SessionService.d.ts

@@ -1,8 +1,12 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { CreateSessionOptions } from '../collections/SessionCollection.js';
-import { Membership } from '../models/Membership.js';
-import { Session } from '../models/Session.js';
-import { User } from '../models/User.js';
+/**
+ * SessionService - Higher-level session management combining sessions with user/permission loading
+ * @packageDocumentation
+ */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import { type CreateSessionOptions } from '../collections/SessionCollection.js';
+import type { Membership } from '../models/Membership.js';
+import { type Session } from '../models/Session.js';
+import type { User } from '../models/User.js';
 /**
  * Session context with user and permissions
  */
@@ -118,7 +122,7 @@ export declare class SessionService {
     /**
      * Get the initialized database connection backing this session service.
      */
-    getDatabase(): import('@happyvertical/sql').DatabaseInterface;
+    getDatabase(): import("@happyvertical/sql").DatabaseInterface;
     /**
      * Refresh session (extend expiry, update lastAccessed)
      */

package/dist/services/TenantService.d.ts

@@ -1,7 +1,11 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { Membership } from '../models/Membership.js';
-import { Tenant } from '../models/Tenant.js';
-import { TenantPolicy } from '../types/index.js';
+/**
+ * TenantService - Manages tenant creation with configurable policies
+ * @packageDocumentation
+ */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import type { Membership } from '../models/Membership.js';
+import type { Tenant } from '../models/Tenant.js';
+import { type TenantPolicy } from '../types/index.js';
 /**
  * Result of tenant creation with ownership
  */

package/dist/services/TerminalAuthService.d.ts

@@ -1,7 +1,26 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { CliAuthRequestStatus, UsersCliAuthRequest } from '../models/CliAuthRequest.js';
-import { User } from '../models/User.js';
-import { SessionContext } from './SessionService.js';
+/**
+ * TerminalAuthService — device-code grant for terminal/CLI logins.
+ *
+ * Flow:
+ * 1. CLI calls `createRequest(origin)` → user code (short, displayed) + device
+ *    code (long, kept secret) + verification URL.
+ * 2. User opens the verification URL in a browser, signs in normally, and
+ *    POSTs the user code via `approveRequest({ user, tenantId, userCode })`.
+ * 3. CLI polls `exchangeDeviceCode(deviceCode)`; once approved, gets back the
+ *    bearer session id (an opaque token usable as `Authorization: Bearer …`).
+ * 4. Server-side request handlers resolve incoming bearer tokens via
+ *    `loadBearerSession(token)`, and revoke them via `destroyBearerSession`.
+ *
+ * The service is framework-agnostic: it does not set cookies, parse Request
+ * objects, or render pages. SvelteKit glue lives in the package's
+ * `./sveltekit` subpath.
+ *
+ * @packageDocumentation
+ */
+import { type SmrtClassOptions } from '@happyvertical/smrt-core';
+import type { CliAuthRequestStatus, UsersCliAuthRequest } from '../models/CliAuthRequest.js';
+import type { User } from '../models/User.js';
+import { type SessionContext } from './SessionService.js';
 /** Default polling interval the CLI should honour while waiting for approval. */
 export declare const DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS = 2;
 /** Default lifetime of a pending request (10 minutes). */

package/dist/services/authorization-read-options.d.ts

@@ -1,4 +1,5 @@
-import { SmrtClassOptions, SmrtCollectionOptions } from '@happyvertical/smrt-core';
+/** Collection options for framework-internal authorization reads. @packageDocumentation */
+import type { SmrtClassOptions, SmrtCollectionOptions } from '@happyvertical/smrt-core';
 /**
  * The caller's options with its list bounds removed.
  *

package/dist/smrt-knowledge.json

@@ -3,12 +3,12 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.51.32",
+  "packageVersion": "0.51.33",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "358196fa635cc60106ef173c00e0d3e61ea14a2eb17441d31bf4adcb7f15f431",
-    "packageJson": "5a942dfc1426453e80213e3363b725a2cdf481a5faf849f4078654043fcc2186",
+    "manifest": "95729b83fe3c813331a3c4ad1d1544509a4392f6c43fc87ba9289d4b266f46b6",
+    "packageJson": "1bd7002e7a0d25a1eae0b5113d091d756e8afd0420d738fc3594f5546de9c6f3",
     "agents": "d7f1bb57f7bbbc1b750ab87c33592a53622236d17f49f8c04b15c4745b5c2ab2",
     "moduleDoc:agents/permissions.md": "b5be3f5b84b409cb6e62080e2d7a75b67e0763266c11054045c5c401b84f8dd6",
     "moduleDoc:agents/oidc-provisioning.md": "5efa607ff23b9a693391e0c02670324a8cea4114d4968c9718f10a763da919c6",
@@ -42,7 +42,7 @@
     "fast-glob": "^3.3.3",
     "svelte": "^5.57.1",
     "svelte-check": "^4.7.6",
-    "typescript": "5.9.3",
+    "typescript": "6.0.3",
     "vite": "8.1.4",
     "vitest": "4.1.10"
   },

package/dist/sveltekit/index.d.ts

@@ -1,7 +1,25 @@
-import { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { OidcProfileOwnerAuthorizer, OidcProfileResolver } from '../collections/UserCollection.js';
-import { OidcLoginResult, OidcProviderResolutionOptions, OidcTransaction } from '../services/OidcLoginService.js';
-import { TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, TerminalAuthServiceOptions } from '../services/TerminalAuthService.js';
+/**
+ * SvelteKit integration for session management
+ * @packageDocumentation
+ *
+ * @example
+ * ```typescript
+ * // hooks.server.ts
+ * import { createSessionHandler } from '@happyvertical/smrt-users/sveltekit';
+ * import { sequence } from '@sveltejs/kit/hooks';
+ *
+ * const sessionHandler = createSessionHandler({
+ *   db: { type: 'postgres', url: process.env.DATABASE_URL }
+ * });
+ *
+ * export const handle = sequence(sessionHandler);
+ * ```
+ */
+import '../__smrt-register__.js';
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import type { OidcProfileOwnerAuthorizer, OidcProfileResolver } from '../collections/UserCollection.js';
+import { type OidcLoginResult, type OidcProviderResolutionOptions, type OidcTransaction } from '../services/OidcLoginService.js';
+import { TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, type TerminalAuthServiceOptions } from '../services/TerminalAuthService.js';
 export { type AppResultContract, type AppResultMetadata, type CommandRequirements, canonicalizeDiscoveryArtifact, createDiscoveryConformanceArtifact, type DeclaredActionField, type DiscoveryArtifactIntegrity, DiscoveryArtifactValidationError, type DiscoveryConformanceArtifact, type DiscoveryPayload, deriveCommandRequirements, type JsonValue, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, validateDiscoveryConformanceArtifact, } from '../app-contract.js';
 export type { NormalizedOidcClaims, OidcProfileOwnerAuthorization, OidcProfileOwnerAuthorizer, OidcProfileOwnerAuthorizerContext, OidcProfileResolver, OidcProfileResolverContext, } from '../collections/UserCollection.js';
 export { MobileAuthError, type MobileAuthErrorCode, MobileAuthService, type MobileAuthServiceOptions, type MobileBootstrapContext, type MobileLoginContext, type MobileLogoutResult, type MobileRequestMeta, type MobileResolvedUser, type MobileTenantContext, readMobileBearerToken, validateMobileRedirectUri, } from '../services/MobileAuthService.js';
@@ -346,7 +364,7 @@ export declare function createBearerSessionDeleteHandler(options: TerminalAuthSe
  * `hooks.server.ts` to resolve `Authorization: Bearer <sid>` headers
  * alongside cookie-based sessions.
  */
-export declare function loadBearerSessionContext(token: string, options: TerminalAuthServiceOptions): Promise<import('../index.js').SessionContext | null>;
+export declare function loadBearerSessionContext(token: string, options: TerminalAuthServiceOptions): Promise<import("../index.js").SessionContext | null>;
 /** Shape passed back to `+page.server.ts` `load`. */
 export interface TerminalLoginPageData {
     userCode: string;

package/dist/sveltekit/mobile-handlers.d.ts

@@ -1,5 +1,45 @@
-import { MobileAuthService, MobileAuthServiceOptions } from '../services/MobileAuthService.js';
-import { SessionPermissionRuntimeContext } from '../services/SessionPermissionContext.js';
+/**
+ * SvelteKit handlers for the SMRT mobile `/api/mobile` contract (issue
+ * #1748). Thin adapters over {@link MobileAuthService} — parsing, error
+ * mapping, and cache headers live here; protocol and session logic live in
+ * the service.
+ *
+ * @packageDocumentation
+ *
+ * @example
+ * ```ts
+ * // src/lib/server/mobile.ts
+ * import { createMobileAuthHandlers } from '@happyvertical/smrt-users/sveltekit';
+ *
+ * export const mobile = createMobileAuthHandlers({
+ *   db: { type: 'postgres', url: process.env.DATABASE_URL! },
+ *   defaultProvider: 'kanidm',
+ *   providers: { kanidm: { issuer: '...', clientId: '...', clientSecret: '...' } },
+ *   redirectUris: ['com.example.app://auth/callback'],
+ * });
+ *
+ * // src/routes/api/mobile/auth/start/+server.ts
+ * //   export const POST = mobile.authStart;
+ * // src/routes/api/mobile/auth/complete/+server.ts
+ * //   export const POST = mobile.authComplete;
+ * // src/routes/api/mobile/session/+server.ts
+ * //   export const GET = mobile.session.GET;
+ * //   export const DELETE = mobile.session.DELETE;
+ *
+ * // src/routes/api/mobile/captures/+server.ts — an app route behind the guard.
+ * // `db` is the app's own database config (the same one passed to
+ * // createMobileAuthHandlers); the guard resolves ctx.userId/ctx.tenantId.
+ * // export const POST = mobile.guard(async (event, ctx) => {
+ * //   await assertOperationPermission({
+ * //     db, collection: 'captures', action: 'create',
+ * //   });
+ * //   ... // domain ingestion stays app-side
+ * // });
+ * ```
+ */
+import '../__smrt-register__.js';
+import { MobileAuthService, type MobileAuthServiceOptions } from '../services/MobileAuthService.js';
+import { type SessionPermissionRuntimeContext } from '../services/SessionPermissionContext.js';
 /**
  * Minimal structural slice of SvelteKit's `RequestEvent` these handlers
  * touch (kept structural so `@sveltejs/kit` stays out of the dependency

package/dist/sveltekit/resource-list-handler.d.ts

@@ -1,7 +1,33 @@
-import { SmartObjectConfig } from '@happyvertical/smrt-core';
-import { CommandRequirements, DiscoveryConformanceArtifact } from '../app-contract.js';
-import { TerminalAuthServiceOptions } from '../services/TerminalAuthService.js';
-import { SessionLocals } from './types.js';
+/**
+ * Resource-list handler for `GET /api/_resources`.
+ *
+ * Returns the auth-aware list of resources and commands that an HTTP-based
+ * CLI client (e.g. `@happyvertical/smrt-app-cli`) can invoke. Walks the
+ * `ObjectRegistry` to find classes whose `@smrt({ cli: ... })` decorator
+ * exposes commands, resolves each command's URL shape (scope, http method,
+ * path segments) the same way the SvelteKit route generator does, and
+ * filters the result through a caller-supplied `commandPolicy`.
+ *
+ * @packageDocumentation
+ *
+ * @example
+ * ```ts
+ * // apps/<app>/src/routes/api/_resources/+server.ts
+ * import { createResourceListHandler } from '@happyvertical/smrt-users/sveltekit';
+ * import './smrt-register';
+ *
+ * export const GET = createResourceListHandler({
+ *   ensureRegistry: async () => { await import('./smrt-register'); },
+ *   commandPolicy: ({ command, session }) => session.user != null,
+ *   kebabRoutes: true, // match the vite-plugin setting
+ * });
+ * ```
+ */
+import '../__smrt-register__.js';
+import { type SmartObjectConfig } from '@happyvertical/smrt-core';
+import { type CommandRequirements, type DiscoveryConformanceArtifact } from '../app-contract.js';
+import type { TerminalAuthServiceOptions } from '../services/TerminalAuthService.js';
+import type { SessionLocals } from './types.js';
 type ApiHttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
 export type CommandKind = 'crud' | 'custom';
 export type CommandScope = 'item' | 'collection';

package/dist/sveltekit/types.d.ts

@@ -1,5 +1,9 @@
-import { Membership } from '../models/Membership.js';
-import { User } from '../models/User.js';
+/**
+ * SvelteKit-specific type definitions for session management
+ * @packageDocumentation
+ */
+import type { Membership } from '../models/Membership.js';
+import type { User } from '../models/User.js';
 /**
  * Extended locals interface for SvelteKit
  *

package/dist/sveltekit.js

@@ -1,4 +1,4 @@
-import { C as OidcLoginService, D as resolveOidcProviderConfig, E as getUsersOidcConfig, S as OidcLoginError, T as encodeOidcTransaction, _ as readMobileBearerToken, a as TerminalAuthRateLimitError, g as MobileAuthService, h as MobileAuthError, i as TerminalAuthError, m as withSessionPermissionContext, o as TerminalAuthService, s as OperationPermissionError, v as validateMobileRedirectUri, w as decodeOidcTransaction, y as SessionService } from "./chunks/TerminalAuthService-Mj7kASo7.js";
+import { C as OidcLoginService, D as resolveOidcProviderConfig, E as getUsersOidcConfig, S as OidcLoginError, T as encodeOidcTransaction, _ as readMobileBearerToken, a as TerminalAuthRateLimitError, g as MobileAuthService, h as MobileAuthError, i as TerminalAuthError, m as withSessionPermissionContext, o as TerminalAuthService, s as OperationPermissionError, v as validateMobileRedirectUri, w as decodeOidcTransaction, y as SessionService } from "./chunks/TerminalAuthService-CLDmxYuC.js";
 import { DiscoveryArtifactValidationError, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, canonicalizeDiscoveryArtifact, createDiscoveryConformanceArtifact, deriveCommandRequirements, validateDiscoveryConformanceArtifact } from "./app-contract.js";
 import { ObjectRegistry, createClassNamePredicate, resolveCustomActionMetadata, resolveEffectiveActionMetadata } from "@happyvertical/smrt-core";
 import { createLogger } from "@happyvertical/logger";

package/dist/ui.d.ts

@@ -1,4 +1,10 @@
-import { ModuleUISlot, SmrtModuleMeta } from '@happyvertical/smrt-types';
+/**
+ * Users Module UI Slot Declarations
+ *
+ * This file defines the UI extension points for the users module.
+ * UI components are implemented in the ./svelte subpath.
+ */
+import type { ModuleUISlot, SmrtModuleMeta } from '@happyvertical/smrt-types';
 /**
  * Users module UI slots
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-users",
-  "version": "0.51.32",
+  "version": "0.51.33",
   "smrtJsdoc": "strict",
   "description": "Multi-tenant user management for the SMRT framework - users, tenants, roles, permissions, groups",
   "type": "module",
@@ -47,25 +47,25 @@
   },
   "dependencies": {
     "@happyvertical/logger": "^0.94.1",
-    "@happyvertical/smrt-config": "0.51.32",
-    "@happyvertical/smrt-core": "0.51.32",
-    "@happyvertical/smrt-mobile-contract": "0.51.32",
-    "@happyvertical/smrt-profiles": "0.51.32",
-    "@happyvertical/smrt-tenancy": "0.51.32",
-    "@happyvertical/smrt-types": "0.51.32",
-    "@happyvertical/smrt-ui": "0.51.32",
+    "@happyvertical/smrt-config": "0.51.33",
+    "@happyvertical/smrt-core": "0.51.33",
+    "@happyvertical/smrt-mobile-contract": "0.51.33",
+    "@happyvertical/smrt-profiles": "0.51.33",
+    "@happyvertical/smrt-tenancy": "0.51.33",
+    "@happyvertical/smrt-types": "0.51.33",
+    "@happyvertical/smrt-ui": "0.51.33",
     "@happyvertical/sql": "^0.94.1",
     "jose": "^6.2.12"
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.51.32",
+    "@happyvertical/smrt-vitest": "0.51.33",
     "@sveltejs/package": "^2.5.8",
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
     "@types/node": "24.13.6",
     "fast-glob": "^3.3.3",
     "svelte": "^5.57.1",
     "svelte-check": "^4.7.6",
-    "typescript": "5.9.3",
+    "typescript": "6.0.3",
     "vite": "8.1.4",
     "vitest": "4.1.10"
   },