@happyvertical/smrt-users 0.55.11 → 0.55.13

package/AGENTS.md

@@ -55,8 +55,11 @@ are not prerequisites for unrelated user-package work.
 - Generated REST/MCP operations on identity/RBAC models are list/get only.
   Route authentication does not authorize authority mutations, and these models
   are not tenant-scoped. Use permission-gated services or explicitly checked
-  consumer handlers. CLI remains a local-operator surface. Preserve the
-  registry assertions in `security-audit-1400.test.ts`.
+  consumer handlers. Generated CLI is list/get or closed (`cli: false` for
+  credential/grant models) because agents shell out to it; a `cli` without
+  `include` is full CRUD (#3742). Their catalog slugs stay full via
+  `USERS_AUTHORITY_CATALOG_MODELS`. Preserve the registry assertions in
+  `security-audit-1400.test.ts` and `issue-3742-cli-surface-lockdown.test.ts`.
 - Resource guards take the resource tenant, not the session tenant. Omit a
   session membership when targeting a different tenant; mismatches fail closed.
   `loadSessionContext().tenantAuthorization` must be checked by required-tenant

package/README.md

@@ -362,6 +362,12 @@ await createSessionCookie(event, userId, tenantId, { db }); // login
 await destroySessionCookie(event, { db });                   // logout
 ```
 
+The handler only handles its own session/context initialization failures:
+without `postgresRls` the request continues once with empty locals; with
+`postgresRls` it returns 500. Errors thrown downstream of `resolve()` —
+including SvelteKit `redirect()` from a later handle — propagate unchanged and
+the downstream chain runs exactly once.
+
 ### OIDC login with Kanidm or Dex
 
 Kanidm and Dex both work through the generic s-m-r-t OIDC flow. Configure one or