npm - @happyvertical/smrt-users - Versions diffs - 0.55.11 → 0.55.13 - Mend

@happyvertical/smrt-users 0.55.11 → 0.55.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (29) hide show

package/AGENTS.md +5 -2
package/README.md +6 -0
package/dist/chunks/{TerminalAuthService-C18-gEUt.js → TerminalAuthService-D7ub2Snn.js} +71 -68
package/dist/chunks/TerminalAuthService-D7ub2Snn.js.map +1 -0
package/dist/index.js +30 -14
package/dist/index.js.map +1 -1
package/dist/manifest.json +200 -60
package/dist/models/Group.d.ts.map +1 -1
package/dist/models/GroupMember.d.ts.map +1 -1
package/dist/models/GroupRole.d.ts.map +1 -1
package/dist/models/MagicLinkToken.d.ts.map +1 -1
package/dist/models/Membership.d.ts.map +1 -1
package/dist/models/MembershipOverride.d.ts.map +1 -1
package/dist/models/Permission.d.ts.map +1 -1
package/dist/models/ResourceGrant.d.ts.map +1 -1
package/dist/models/Role.d.ts.map +1 -1
package/dist/models/RolePermission.d.ts.map +1 -1
package/dist/models/Session.d.ts.map +1 -1
package/dist/models/Tenant.d.ts.map +1 -1
package/dist/models/TenantIntegration.d.ts.map +1 -1
package/dist/models/TenantPermissionOverride.d.ts.map +1 -1
package/dist/models/User.d.ts.map +1 -1
package/dist/services/PermissionCatalogService.d.ts.map +1 -1
package/dist/smrt-knowledge.json +146 -1690
package/dist/sveltekit/index.d.ts.map +1 -1
package/dist/sveltekit.js +4 -1
package/dist/sveltekit.js.map +1 -1
package/package.json +11 -11
package/dist/chunks/TerminalAuthService-C18-gEUt.js.map +0 -1

package/dist/smrt-knowledge.json CHANGED Viewed

@@ -3,13 +3,13 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.55.11",
+  "packageVersion": "0.55.13",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "b7581fe757a6a943006577956b5759458ec5c7c1587d08fd663943e29b035a73",
-    "packageJson": "5af7cea452454722111ca022c38d29665c5dafbe4170ec021de040bb6957a7bc",
-    "agents": "fa1b9005064b329b1d2387cd56307b92a79f2cd4ea951776e687f9850a428335",
+    "manifest": "c485b50c1ed1c9b85b0cf3596970efd84850e9a4c3ca14a89ca9963fc7dd82f4",
+    "packageJson": "c150f0e7ca9b4017f9c069e5eea26dca31de632298612708d33b9b05dd3187f9",
+    "agents": "eb74cdf8186c27e8721515cff653c688567284015ce9845a9b7714ac898620bc",
     "moduleDoc:agents/permissions.md": "832a684513d831d3cb9bd8d0c73295d756ca7cf9bc32de1ca3254691160371b1",
     "moduleDoc:agents/oidc-provisioning.md": "b73f3fdaf61136720132a614c7e14237b7bd35f7bf5d43eabb29f565485803b9",
     "moduleDoc:agents/mobile-auth.md": "25e85e83f43e3a46383a92fa809f3a003b4545c3026e78dbe1bccbbc35161e18",
@@ -158,30 +158,6 @@
           "path": "/accessrequests/findOpen",
           "method": "POST"
         },
-        {
-          "kind": "cli",
-          "name": "accessrequestcollection_findByEmail",
-          "operation": "findByEmail",
-          "objectName": "@happyvertical/smrt-users:AccessRequestCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "accessrequestcollection_findOpenByEmail",
-          "operation": "findOpenByEmail",
-          "objectName": "@happyvertical/smrt-users:AccessRequestCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "accessrequestcollection_findByStatus",
-          "operation": "findByStatus",
-          "objectName": "@happyvertical/smrt-users:AccessRequestCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "accessrequestcollection_findOpen",
-          "operation": "findOpen",
-          "objectName": "@happyvertical/smrt-users:AccessRequestCollection"
-        },
         {
           "kind": "mcp",
           "name": "accessrequestcollection_findbyemail",
@@ -367,36 +343,6 @@
           "path": "/userscliauthrequests/deleteExpired",
           "method": "POST"
         },
-        {
-          "kind": "cli",
-          "name": "userscliauthrequestcollection_approvePendingRequest",
-          "operation": "approvePendingRequest",
-          "objectName": "@happyvertical/smrt-users:UsersCliAuthRequestCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "userscliauthrequestcollection_consumeApprovedSession",
-          "operation": "consumeApprovedSession",
-          "objectName": "@happyvertical/smrt-users:UsersCliAuthRequestCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "userscliauthrequestcollection_findByUserCode",
-          "operation": "findByUserCode",
-          "objectName": "@happyvertical/smrt-users:UsersCliAuthRequestCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "userscliauthrequestcollection_findByDeviceCodeHash",
-          "operation": "findByDeviceCodeHash",
-          "objectName": "@happyvertical/smrt-users:UsersCliAuthRequestCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "userscliauthrequestcollection_deleteExpired",
-          "operation": "deleteExpired",
-          "objectName": "@happyvertical/smrt-users:UsersCliAuthRequestCollection"
-        },
         {
           "kind": "mcp",
           "name": "userscliauthrequestcollection_approvependingrequest",
@@ -1165,24 +1111,6 @@
           "path": "/usersmagiclinktokens/deleteExpired",
           "method": "POST"
         },
-        {
-          "kind": "cli",
-          "name": "usersmagiclinktokencollection_findByNonce",
-          "operation": "findByNonce",
-          "objectName": "@happyvertical/smrt-users:UsersMagicLinkTokenCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "usersmagiclinktokencollection_markUsed",
-          "operation": "markUsed",
-          "objectName": "@happyvertical/smrt-users:UsersMagicLinkTokenCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "usersmagiclinktokencollection_deleteExpired",
-          "operation": "deleteExpired",
-          "objectName": "@happyvertical/smrt-users:UsersMagicLinkTokenCollection"
-        },
         {
           "kind": "mcp",
           "name": "usersmagiclinktokencollection_findbynonce",
@@ -2149,18 +2077,6 @@
           "path": "/resourcegrants/findChildren",
           "method": "POST"
         },
-        {
-          "kind": "cli",
-          "name": "resourcegrantcollection_findExact",
-          "operation": "findExact",
-          "objectName": "@happyvertical/smrt-users:ResourceGrantCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "resourcegrantcollection_findChildren",
-          "operation": "findChildren",
-          "objectName": "@happyvertical/smrt-users:ResourceGrantCollection"
-        },
         {
           "kind": "mcp",
           "name": "resourcegrantcollection_findexact",
@@ -2912,96 +2828,6 @@
           "path": "/sessions/getSessionData",
           "method": "POST"
         },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_createSession",
-          "operation": "createSession",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_findChildren",
-          "operation": "findChildren",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_revokeChildren",
-          "operation": "revokeChildren",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_revokeUserSessionsByAuthMethod",
-          "operation": "revokeUserSessionsByAuthMethod",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_findValidSession",
-          "operation": "findValidSession",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_touch",
-          "operation": "touch",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_findByUser",
-          "operation": "findByUser",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_deleteUserSessions",
-          "operation": "deleteUserSessions",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_revokeUserSessions",
-          "operation": "revokeUserSessions",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_revokeSession",
-          "operation": "revokeSession",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_deleteExpired",
-          "operation": "deleteExpired",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_countUserSessions",
-          "operation": "countUserSessions",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_setSessionTenant",
-          "operation": "setSessionTenant",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_setSessionData",
-          "operation": "setSessionData",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
-        {
-          "kind": "cli",
-          "name": "sessioncollection_getSessionData",
-          "operation": "getSessionData",
-          "objectName": "@happyvertical/smrt-users:SessionCollection"
-        },
         {
           "kind": "mcp",
           "name": "sessioncollection_createsession",
@@ -4847,24 +4673,6 @@
           "operation": "get",
           "objectName": "@happyvertical/smrt-users:Group"
         },
-        {
-          "kind": "cli",
-          "name": "group_create",
-          "operation": "create",
-          "objectName": "@happyvertical/smrt-users:Group"
-        },
-        {
-          "kind": "cli",
-          "name": "group_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:Group"
-        },
-        {
-          "kind": "cli",
-          "name": "group_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:Group"
-        },
         {
           "kind": "mcp",
           "name": "group_list",
@@ -4955,24 +4763,6 @@
           "operation": "get",
           "objectName": "@happyvertical/smrt-users:GroupMember"
         },
-        {
-          "kind": "cli",
-          "name": "groupmember_create",
-          "operation": "create",
-          "objectName": "@happyvertical/smrt-users:GroupMember"
-        },
-        {
-          "kind": "cli",
-          "name": "groupmember_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:GroupMember"
-        },
-        {
-          "kind": "cli",
-          "name": "groupmember_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:GroupMember"
-        },
         {
           "kind": "mcp",
           "name": "groupmember_list",
@@ -5063,24 +4853,6 @@
           "operation": "get",
           "objectName": "@happyvertical/smrt-users:GroupRole"
         },
-        {
-          "kind": "cli",
-          "name": "grouprole_create",
-          "operation": "create",
-          "objectName": "@happyvertical/smrt-users:GroupRole"
-        },
-        {
-          "kind": "cli",
-          "name": "grouprole_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:GroupRole"
-        },
-        {
-          "kind": "cli",
-          "name": "grouprole_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:GroupRole"
-        },
         {
           "kind": "mcp",
           "name": "grouprole_list",
@@ -5313,50 +5085,7 @@
           "returns": "boolean"
         }
       ],
-      "surfaces": [
-        {
-          "kind": "cli",
-          "name": "usersmagiclinktoken_list",
-          "operation": "list",
-          "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-        },
-        {
-          "kind": "cli",
-          "name": "usersmagiclinktoken_get",
-          "operation": "get",
-          "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-        },
-        {
-          "kind": "cli",
-          "name": "usersmagiclinktoken_create",
-          "operation": "create",
-          "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-        },
-        {
-          "kind": "cli",
-          "name": "usersmagiclinktoken_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-        },
-        {
-          "kind": "cli",
-          "name": "usersmagiclinktoken_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-        },
-        {
-          "kind": "cli",
-          "name": "usersmagiclinktoken_isExpired",
-          "operation": "isExpired",
-          "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-        },
-        {
-          "kind": "cli",
-          "name": "usersmagiclinktoken_isValid",
-          "operation": "isValid",
-          "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-        }
-      ],
+      "surfaces": [],
       "withheldSurfaces": [
         {
           "kind": "api",
@@ -5393,7 +5122,8 @@
           "type": "foreignKey",
           "required": true,
           "related": "User",
-          "columnType": "UUID"
+          "columnType": "UUID",
+          "description": "The person who belongs to this organization."
         },
         {
           "name": "tenantId",
@@ -5407,13 +5137,15 @@
           "type": "foreignKey",
           "required": true,
           "related": "Role",
-          "columnType": "UUID"
+          "columnType": "UUID",
+          "description": "The role that determines this member's permissions."
         },
         {
           "name": "status",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "description": "Whether this membership is active, pending, or inactive."
         }
       ],
       "relationships": [
@@ -5487,36 +5219,6 @@
           "operation": "get",
           "objectName": "@happyvertical/smrt-users:Membership"
         },
-        {
-          "kind": "cli",
-          "name": "membership_create",
-          "operation": "create",
-          "objectName": "@happyvertical/smrt-users:Membership"
-        },
-        {
-          "kind": "cli",
-          "name": "membership_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:Membership"
-        },
-        {
-          "kind": "cli",
-          "name": "membership_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:Membership"
-        },
-        {
-          "kind": "cli",
-          "name": "membership_isActive",
-          "operation": "isActive",
-          "objectName": "@happyvertical/smrt-users:Membership"
-        },
-        {
-          "kind": "cli",
-          "name": "membership_isPending",
-          "operation": "isPending",
-          "objectName": "@happyvertical/smrt-users:Membership"
-        },
         {
           "kind": "mcp",
           "name": "membership_list",
@@ -5643,45 +5345,15 @@
           "objectName": "@happyvertical/smrt-users:MembershipOverride"
         },
         {
-          "kind": "cli",
-          "name": "membershipoverride_create",
-          "operation": "create",
+          "kind": "mcp",
+          "name": "membershipoverride_list",
+          "operation": "list",
           "objectName": "@happyvertical/smrt-users:MembershipOverride"
         },
         {
-          "kind": "cli",
-          "name": "membershipoverride_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:MembershipOverride"
-        },
-        {
-          "kind": "cli",
-          "name": "membershipoverride_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:MembershipOverride"
-        },
-        {
-          "kind": "cli",
-          "name": "membershipoverride_isGrant",
-          "operation": "isGrant",
-          "objectName": "@happyvertical/smrt-users:MembershipOverride"
-        },
-        {
-          "kind": "cli",
-          "name": "membershipoverride_isDeny",
-          "operation": "isDeny",
-          "objectName": "@happyvertical/smrt-users:MembershipOverride"
-        },
-        {
-          "kind": "mcp",
-          "name": "membershipoverride_list",
-          "operation": "list",
-          "objectName": "@happyvertical/smrt-users:MembershipOverride"
-        },
-        {
-          "kind": "mcp",
-          "name": "membershipoverride_get",
-          "operation": "get",
+          "kind": "mcp",
+          "name": "membershipoverride_get",
+          "operation": "get",
           "objectName": "@happyvertical/smrt-users:MembershipOverride"
         }
       ],
@@ -5783,21 +5455,24 @@
           "type": "text",
           "required": false,
           "columnType": "TEXT",
-          "default": ""
+          "default": "",
+          "description": "The name of an action people can be allowed to perform."
         },
         {
           "name": "description",
           "type": "text",
           "required": false,
           "columnType": "TEXT",
-          "default": ""
+          "default": "",
+          "description": "What this permission allows someone to do."
         },
         {
           "name": "category",
           "type": "text",
           "required": false,
           "columnType": "TEXT",
-          "default": ""
+          "default": "",
+          "description": "The area of the application this permission belongs to."
         }
       ],
       "relationships": [],
@@ -5854,48 +5529,6 @@
           "operation": "get",
           "objectName": "@happyvertical/smrt-users:Permission"
         },
-        {
-          "kind": "cli",
-          "name": "permission_create",
-          "operation": "create",
-          "objectName": "@happyvertical/smrt-users:Permission"
-        },
-        {
-          "kind": "cli",
-          "name": "permission_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:Permission"
-        },
-        {
-          "kind": "cli",
-          "name": "permission_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:Permission"
-        },
-        {
-          "kind": "cli",
-          "name": "permission_parseSlug",
-          "operation": "parseSlug",
-          "objectName": "@happyvertical/smrt-users:Permission"
-        },
-        {
-          "kind": "cli",
-          "name": "permission_getResource",
-          "operation": "getResource",
-          "objectName": "@happyvertical/smrt-users:Permission"
-        },
-        {
-          "kind": "cli",
-          "name": "permission_getAction",
-          "operation": "getAction",
-          "objectName": "@happyvertical/smrt-users:Permission"
-        },
-        {
-          "kind": "cli",
-          "name": "permission_isValidSlug",
-          "operation": "isValidSlug",
-          "objectName": "@happyvertical/smrt-users:Permission"
-        },
         {
           "kind": "mcp",
           "name": "permission_list",
@@ -6026,51 +5659,59 @@
           "type": "foreignKey",
           "required": true,
           "related": "User",
-          "columnType": "UUID"
+          "columnType": "UUID",
+          "description": "The person receiving this record-specific access rule."
         },
         {
           "name": "resourceType",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "description": "The kind of record this access rule applies to."
         },
         {
           "name": "resourceId",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "description": "The specific record covered by this access rule."
         },
         {
           "name": "permission",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "description": "The action this rule allows or denies for the record."
         },
         {
           "name": "effect",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "description": "Whether this rule grants access or denies it. Denies take precedence."
         },
         {
           "name": "canDelegate",
           "type": "boolean",
           "required": false,
           "columnType": "BOOLEAN",
-          "default": false
+          "default": false,
+          "description": "Whether the recipient may pass this grant on to another person."
         },
         {
           "name": "parentGrantId",
           "type": "foreignKey",
           "required": false,
           "related": "ResourceGrant",
-          "columnType": "UUID"
+          "columnType": "UUID",
+          "description": "The earlier grant from which this access was delegated."
         },
         {
           "name": "revokedAt",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "description": "When this access rule was revoked, if it has ended."
         }
       ],
       "relationships": [
@@ -6115,44 +5756,7 @@
         "slug",
         "context"
       ],
-      "surfaces": [
-        {
-          "kind": "cli",
-          "name": "resourcegrant_list",
-          "operation": "list",
-          "objectName": "@happyvertical/smrt-users:ResourceGrant"
-        },
-        {
-          "kind": "cli",
-          "name": "resourcegrant_get",
-          "operation": "get",
-          "objectName": "@happyvertical/smrt-users:ResourceGrant"
-        },
-        {
-          "kind": "cli",
-          "name": "resourcegrant_create",
-          "operation": "create",
-          "objectName": "@happyvertical/smrt-users:ResourceGrant"
-        },
-        {
-          "kind": "cli",
-          "name": "resourcegrant_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:ResourceGrant"
-        },
-        {
-          "kind": "cli",
-          "name": "resourcegrant_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:ResourceGrant"
-        },
-        {
-          "kind": "cli",
-          "name": "resourcegrant_isActive",
-          "operation": "isActive",
-          "objectName": "@happyvertical/smrt-users:ResourceGrant"
-        }
-      ],
+      "surfaces": [],
       "withheldSurfaces": [
         {
           "kind": "api",
@@ -6191,28 +5795,32 @@
           "type": "text",
           "required": false,
           "columnType": "TEXT",
-          "default": ""
+          "default": "",
+          "description": "The name of this set of permissions."
         },
         {
           "name": "description",
           "type": "text",
           "required": false,
           "columnType": "TEXT",
-          "default": ""
+          "default": "",
+          "description": "What this role allows and who should receive it."
         },
         {
           "name": "isSystem",
           "type": "boolean",
           "required": false,
           "columnType": "BOOLEAN",
-          "default": false
+          "default": false,
+          "description": "Whether this is a built-in role protected from deletion."
         },
         {
           "name": "inheritsToDescendants",
           "type": "boolean",
           "required": false,
           "columnType": "BOOLEAN",
-          "default": false
+          "default": false,
+          "description": "Whether this role can give members access to organizations below theirs."
         }
       ],
       "relationships": [
@@ -6283,42 +5891,6 @@
           "operation": "get",
           "objectName": "@happyvertical/smrt-users:Role"
         },
-        {
-          "kind": "cli",
-          "name": "role_create",
-          "operation": "create",
-          "objectName": "@happyvertical/smrt-users:Role"
-        },
-        {
-          "kind": "cli",
-          "name": "role_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:Role"
-        },
-        {
-          "kind": "cli",
-          "name": "role_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:Role"
-        },
-        {
-          "kind": "cli",
-          "name": "role_isSystemRole",
-          "operation": "isSystemRole",
-          "objectName": "@happyvertical/smrt-users:Role"
-        },
-        {
-          "kind": "cli",
-          "name": "role_isTenantRole",
-          "operation": "isTenantRole",
-          "objectName": "@happyvertical/smrt-users:Role"
-        },
-        {
-          "kind": "cli",
-          "name": "role_canDelete",
-          "operation": "canDelete",
-          "objectName": "@happyvertical/smrt-users:Role"
-        },
         {
           "kind": "mcp",
           "name": "role_list",
@@ -6436,24 +6008,6 @@
           "operation": "get",
           "objectName": "@happyvertical/smrt-users:RolePermission"
         },
-        {
-          "kind": "cli",
-          "name": "rolepermission_create",
-          "operation": "create",
-          "objectName": "@happyvertical/smrt-users:RolePermission"
-        },
-        {
-          "kind": "cli",
-          "name": "rolepermission_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:RolePermission"
-        },
-        {
-          "kind": "cli",
-          "name": "rolepermission_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:RolePermission"
-        },
         {
           "kind": "mcp",
           "name": "rolepermission_list",
@@ -6488,7 +6042,8 @@
           "type": "foreignKey",
           "required": false,
           "related": "User",
-          "columnType": "UUID"
+          "columnType": "UUID",
+          "description": "The person signed in through this session."
         },
         {
           "name": "tenantId",
@@ -6501,46 +6056,53 @@
           "name": "status",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "description": "Whether this sign-in session is active or has ended."
         },
         {
           "name": "expiresAt",
           "type": "datetime",
           "required": false,
-          "columnType": "TIMESTAMP"
+          "columnType": "TIMESTAMP",
+          "description": "When this session expires unless renewed within its allowed limits."
         },
         {
           "name": "userAgent",
           "type": "text",
           "required": false,
           "columnType": "TEXT",
-          "default": ""
+          "default": "",
+          "description": "The browser or device reported when this session was created."
         },
         {
           "name": "ipAddress",
           "type": "text",
           "required": false,
           "columnType": "TEXT",
-          "default": ""
+          "default": "",
+          "description": "The network address reported for this session."
         },
         {
           "name": "lastAccessedAt",
           "type": "datetime",
           "required": false,
-          "columnType": "TIMESTAMP"
+          "columnType": "TIMESTAMP",
+          "description": "When this session was last used."
         },
         {
           "name": "data",
           "type": "json",
           "required": false,
           "columnType": "JSON",
-          "default": {}
+          "default": {},
+          "description": "Additional session details maintained by your application."
         },
         {
           "name": "authMethod",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "description": "The sign-in method used to establish this session."
         }
       ],
       "relationships": [
@@ -6680,232 +6242,112 @@
           "objectName": "@happyvertical/smrt-users:Session",
           "path": "/sessions/[id]",
           "method": "DELETE"
-        },
-        {
-          "kind": "cli",
-          "name": "session_list",
-          "operation": "list",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
+        }
+      ],
+      "withheldSurfaces": [
         {
-          "kind": "cli",
-          "name": "session_get",
-          "operation": "get",
+          "kind": "api",
+          "operation": "extend",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_create",
-          "operation": "create",
+          "kind": "api",
+          "operation": "getAbsoluteExpiry",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_update",
-          "operation": "update",
+          "kind": "api",
+          "operation": "getData",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_delete",
-          "operation": "delete",
+          "kind": "api",
+          "operation": "getIdleSeconds",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_isLayered",
-          "operation": "isLayered",
+          "kind": "api",
+          "operation": "getPermissionCeiling",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_getAbsoluteExpiry",
-          "operation": "getAbsoluteExpiry",
+          "kind": "api",
+          "operation": "isExpired",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_getIdleSeconds",
-          "operation": "getIdleSeconds",
+          "kind": "api",
+          "operation": "isLayered",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_getPermissionCeiling",
-          "operation": "getPermissionCeiling",
+          "kind": "api",
+          "operation": "isRevoked",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_isValid",
+          "kind": "api",
           "operation": "isValid",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_isExpired",
-          "operation": "isExpired",
+          "kind": "api",
+          "operation": "recordActivity",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_isRevoked",
-          "operation": "isRevoked",
+          "kind": "api",
+          "operation": "removeData",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_touch",
-          "operation": "touch",
+          "kind": "api",
+          "operation": "revoke",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_extend",
-          "operation": "extend",
+          "kind": "api",
+          "operation": "setData",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_recordActivity",
-          "operation": "recordActivity",
+          "kind": "api",
+          "operation": "setTenant",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         },
         {
-          "kind": "cli",
-          "name": "session_revoke",
-          "operation": "revoke",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "cli",
-          "name": "session_setTenant",
-          "operation": "setTenant",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "cli",
-          "name": "session_getData",
-          "operation": "getData",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "cli",
-          "name": "session_setData",
-          "operation": "setData",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "cli",
-          "name": "session_removeData",
-          "operation": "removeData",
-          "objectName": "@happyvertical/smrt-users:Session"
-        }
-      ],
-      "withheldSurfaces": [
-        {
-          "kind": "api",
-          "operation": "extend",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "getAbsoluteExpiry",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "getData",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "getIdleSeconds",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "getPermissionCeiling",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "isExpired",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "isLayered",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "isRevoked",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "isValid",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "recordActivity",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "removeData",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "revoke",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "setData",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "setTenant",
-          "code": "not-included",
-          "reason": "not listed in api.include",
-          "objectName": "@happyvertical/smrt-users:Session"
-        },
-        {
-          "kind": "api",
-          "operation": "touch",
-          "code": "not-included",
-          "reason": "not listed in api.include",
+          "kind": "api",
+          "operation": "touch",
+          "code": "not-included",
+          "reason": "not listed in api.include",
           "objectName": "@happyvertical/smrt-users:Session"
         }
       ],
@@ -7076,60 +6518,6 @@
           "operation": "get",
           "objectName": "@happyvertical/smrt-users:Tenant"
         },
-        {
-          "kind": "cli",
-          "name": "tenant_create",
-          "operation": "create",
-          "objectName": "@happyvertical/smrt-users:Tenant"
-        },
-        {
-          "kind": "cli",
-          "name": "tenant_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:Tenant"
-        },
-        {
-          "kind": "cli",
-          "name": "tenant_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:Tenant"
-        },
-        {
-          "kind": "cli",
-          "name": "tenant_isActive",
-          "operation": "isActive",
-          "objectName": "@happyvertical/smrt-users:Tenant"
-        },
-        {
-          "kind": "cli",
-          "name": "tenant_isSuspended",
-          "operation": "isSuspended",
-          "objectName": "@happyvertical/smrt-users:Tenant"
-        },
-        {
-          "kind": "cli",
-          "name": "tenant_isRoot",
-          "operation": "isRoot",
-          "objectName": "@happyvertical/smrt-users:Tenant"
-        },
-        {
-          "kind": "cli",
-          "name": "tenant_canCascadeToChildren",
-          "operation": "canCascadeToChildren",
-          "objectName": "@happyvertical/smrt-users:Tenant"
-        },
-        {
-          "kind": "cli",
-          "name": "tenant_acceptsInheritance",
-          "operation": "acceptsInheritance",
-          "objectName": "@happyvertical/smrt-users:Tenant"
-        },
-        {
-          "kind": "cli",
-          "name": "tenant_getAncestorIds",
-          "operation": "getAncestorIds",
-          "objectName": "@happyvertical/smrt-users:Tenant"
-        },
         {
           "kind": "mcp",
           "name": "tenant_list",
@@ -7354,66 +6742,6 @@
           "operation": "get",
           "objectName": "@happyvertical/smrt-users:TenantIntegration"
         },
-        {
-          "kind": "cli",
-          "name": "tenantintegration_create",
-          "operation": "create",
-          "objectName": "@happyvertical/smrt-users:TenantIntegration"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantintegration_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:TenantIntegration"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantintegration_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:TenantIntegration"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantintegration_getExternalIds",
-          "operation": "getExternalIds",
-          "objectName": "@happyvertical/smrt-users:TenantIntegration"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantintegration_setExternalIds",
-          "operation": "setExternalIds",
-          "objectName": "@happyvertical/smrt-users:TenantIntegration"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantintegration_getExternalId",
-          "operation": "getExternalId",
-          "objectName": "@happyvertical/smrt-users:TenantIntegration"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantintegration_setExternalId",
-          "operation": "setExternalId",
-          "objectName": "@happyvertical/smrt-users:TenantIntegration"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantintegration_getLastCheckSummary",
-          "operation": "getLastCheckSummary",
-          "objectName": "@happyvertical/smrt-users:TenantIntegration"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantintegration_setLastCheckSummary",
-          "operation": "setLastCheckSummary",
-          "objectName": "@happyvertical/smrt-users:TenantIntegration"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantintegration_recordDoctorRun",
-          "operation": "recordDoctorRun",
-          "objectName": "@happyvertical/smrt-users:TenantIntegration"
-        },
         {
           "kind": "mcp",
           "name": "tenantintegration_list",
@@ -7595,48 +6923,6 @@
           "operation": "get",
           "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
         },
-        {
-          "kind": "cli",
-          "name": "tenantpermissionoverride_create",
-          "operation": "create",
-          "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantpermissionoverride_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantpermissionoverride_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantpermissionoverride_isInherit",
-          "operation": "isInherit",
-          "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantpermissionoverride_isGrant",
-          "operation": "isGrant",
-          "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantpermissionoverride_isDeny",
-          "operation": "isDeny",
-          "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-        },
-        {
-          "kind": "cli",
-          "name": "tenantpermissionoverride_hasExplicitEffect",
-          "operation": "hasExplicitEffect",
-          "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-        },
         {
           "kind": "mcp",
           "name": "tenantpermissionoverride_list",
@@ -7701,33 +6987,38 @@
           "type": "crossPackageRef",
           "required": false,
           "related": "@happyvertical/smrt-profiles:Profile",
-          "columnType": "UUID"
+          "columnType": "UUID",
+          "description": "The personal profile linked to this account."
         },
         {
           "name": "email",
           "type": "text",
           "required": false,
           "columnType": "TEXT",
-          "default": ""
+          "default": "",
+          "description": "The email address used for this account."
         },
         {
           "name": "emailKey",
           "type": "text",
           "required": false,
           "columnType": "TEXT",
-          "readonly": true
+          "readonly": true,
+          "description": "The standardized email address used to recognize this account; maintained automatically."
         },
         {
           "name": "status",
           "type": "text",
           "required": false,
-          "columnType": "TEXT"
+          "columnType": "TEXT",
+          "description": "Whether this account is active, inactive, pending, or suspended."
         },
         {
           "name": "lastLoginAt",
           "type": "datetime",
           "required": false,
-          "columnType": "TIMESTAMP"
+          "columnType": "TIMESTAMP",
+          "description": "When this person most recently signed in."
         }
       ],
       "relationships": [
@@ -7803,54 +7094,6 @@
           "operation": "get",
           "objectName": "@happyvertical/smrt-users:User"
         },
-        {
-          "kind": "cli",
-          "name": "user_create",
-          "operation": "create",
-          "objectName": "@happyvertical/smrt-users:User"
-        },
-        {
-          "kind": "cli",
-          "name": "user_update",
-          "operation": "update",
-          "objectName": "@happyvertical/smrt-users:User"
-        },
-        {
-          "kind": "cli",
-          "name": "user_delete",
-          "operation": "delete",
-          "objectName": "@happyvertical/smrt-users:User"
-        },
-        {
-          "kind": "cli",
-          "name": "user_hasValidEmail",
-          "operation": "hasValidEmail",
-          "objectName": "@happyvertical/smrt-users:User"
-        },
-        {
-          "kind": "cli",
-          "name": "user_isActive",
-          "operation": "isActive",
-          "objectName": "@happyvertical/smrt-users:User"
-        },
-        {
-          "kind": "cli",
-          "name": "user_isSuspended",
-          "operation": "isSuspended",
-          "objectName": "@happyvertical/smrt-users:User"
-        },
-        {
-          "kind": "cli",
-          "name": "user_isPending",
-          "operation": "isPending",
-          "objectName": "@happyvertical/smrt-users:User"
-        },
-        {
-          "kind": "cli",
-          "name": "user_recordLogin",
-          "operation": "recordLogin",
-          "objectName": "@happyvertical/smrt-users:User"
-        },
         {
           "kind": "mcp",
           "name": "user_list",
@@ -7949,30 +7192,6 @@
       "path": "/accessrequests/findOpen",
       "method": "POST"
     },
-    {
-      "kind": "cli",
-      "name": "accessrequestcollection_findByEmail",
-      "operation": "findByEmail",
-      "objectName": "@happyvertical/smrt-users:AccessRequestCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "accessrequestcollection_findOpenByEmail",
-      "operation": "findOpenByEmail",
-      "objectName": "@happyvertical/smrt-users:AccessRequestCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "accessrequestcollection_findByStatus",
-      "operation": "findByStatus",
-      "objectName": "@happyvertical/smrt-users:AccessRequestCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "accessrequestcollection_findOpen",
-      "operation": "findOpen",
-      "objectName": "@happyvertical/smrt-users:AccessRequestCollection"
-    },
     {
       "kind": "mcp",
       "name": "accessrequestcollection_findbyemail",
@@ -8037,36 +7256,6 @@
       "path": "/userscliauthrequests/deleteExpired",
       "method": "POST"
     },
-    {
-      "kind": "cli",
-      "name": "userscliauthrequestcollection_approvePendingRequest",
-      "operation": "approvePendingRequest",
-      "objectName": "@happyvertical/smrt-users:UsersCliAuthRequestCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "userscliauthrequestcollection_consumeApprovedSession",
-      "operation": "consumeApprovedSession",
-      "objectName": "@happyvertical/smrt-users:UsersCliAuthRequestCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "userscliauthrequestcollection_findByUserCode",
-      "operation": "findByUserCode",
-      "objectName": "@happyvertical/smrt-users:UsersCliAuthRequestCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "userscliauthrequestcollection_findByDeviceCodeHash",
-      "operation": "findByDeviceCodeHash",
-      "objectName": "@happyvertical/smrt-users:UsersCliAuthRequestCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "userscliauthrequestcollection_deleteExpired",
-      "operation": "deleteExpired",
-      "objectName": "@happyvertical/smrt-users:UsersCliAuthRequestCollection"
-    },
     {
       "kind": "mcp",
       "name": "userscliauthrequestcollection_approvependingrequest",
@@ -8441,24 +7630,6 @@
       "path": "/usersmagiclinktokens/deleteExpired",
       "method": "POST"
     },
-    {
-      "kind": "cli",
-      "name": "usersmagiclinktokencollection_findByNonce",
-      "operation": "findByNonce",
-      "objectName": "@happyvertical/smrt-users:UsersMagicLinkTokenCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "usersmagiclinktokencollection_markUsed",
-      "operation": "markUsed",
-      "objectName": "@happyvertical/smrt-users:UsersMagicLinkTokenCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "usersmagiclinktokencollection_deleteExpired",
-      "operation": "deleteExpired",
-      "objectName": "@happyvertical/smrt-users:UsersMagicLinkTokenCollection"
-    },
     {
       "kind": "mcp",
       "name": "usersmagiclinktokencollection_findbynonce",
@@ -8913,18 +8084,6 @@
       "path": "/resourcegrants/findChildren",
       "method": "POST"
     },
-    {
-      "kind": "cli",
-      "name": "resourcegrantcollection_findExact",
-      "operation": "findExact",
-      "objectName": "@happyvertical/smrt-users:ResourceGrantCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "resourcegrantcollection_findChildren",
-      "operation": "findChildren",
-      "objectName": "@happyvertical/smrt-users:ResourceGrantCollection"
-    },
     {
       "kind": "mcp",
       "name": "resourcegrantcollection_findexact",
@@ -9337,96 +8496,6 @@
       "path": "/sessions/getSessionData",
       "method": "POST"
     },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_createSession",
-      "operation": "createSession",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_findChildren",
-      "operation": "findChildren",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_revokeChildren",
-      "operation": "revokeChildren",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_revokeUserSessionsByAuthMethod",
-      "operation": "revokeUserSessionsByAuthMethod",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_findValidSession",
-      "operation": "findValidSession",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_touch",
-      "operation": "touch",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_findByUser",
-      "operation": "findByUser",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_deleteUserSessions",
-      "operation": "deleteUserSessions",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_revokeUserSessions",
-      "operation": "revokeUserSessions",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_revokeSession",
-      "operation": "revokeSession",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_deleteExpired",
-      "operation": "deleteExpired",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_countUserSessions",
-      "operation": "countUserSessions",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_setSessionTenant",
-      "operation": "setSessionTenant",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_setSessionData",
-      "operation": "setSessionData",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
-    {
-      "kind": "cli",
-      "name": "sessioncollection_getSessionData",
-      "operation": "getSessionData",
-      "objectName": "@happyvertical/smrt-users:SessionCollection"
-    },
     {
       "kind": "mcp",
       "name": "sessioncollection_createsession",
@@ -10405,24 +9474,6 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:Group"
     },
-    {
-      "kind": "cli",
-      "name": "group_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:Group"
-    },
-    {
-      "kind": "cli",
-      "name": "group_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:Group"
-    },
-    {
-      "kind": "cli",
-      "name": "group_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:Group"
-    },
     {
       "kind": "mcp",
       "name": "group_list",
@@ -10463,24 +9514,6 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:GroupMember"
     },
-    {
-      "kind": "cli",
-      "name": "groupmember_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:GroupMember"
-    },
-    {
-      "kind": "cli",
-      "name": "groupmember_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:GroupMember"
-    },
-    {
-      "kind": "cli",
-      "name": "groupmember_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:GroupMember"
-    },
     {
       "kind": "mcp",
       "name": "groupmember_list",
@@ -10521,24 +9554,6 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:GroupRole"
     },
-    {
-      "kind": "cli",
-      "name": "grouprole_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:GroupRole"
-    },
-    {
-      "kind": "cli",
-      "name": "grouprole_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:GroupRole"
-    },
-    {
-      "kind": "cli",
-      "name": "grouprole_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:GroupRole"
-    },
     {
       "kind": "mcp",
       "name": "grouprole_list",
@@ -10551,48 +9566,6 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:GroupRole"
     },
-    {
-      "kind": "cli",
-      "name": "usersmagiclinktoken_list",
-      "operation": "list",
-      "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-    },
-    {
-      "kind": "cli",
-      "name": "usersmagiclinktoken_get",
-      "operation": "get",
-      "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-    },
-    {
-      "kind": "cli",
-      "name": "usersmagiclinktoken_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-    },
-    {
-      "kind": "cli",
-      "name": "usersmagiclinktoken_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-    },
-    {
-      "kind": "cli",
-      "name": "usersmagiclinktoken_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-    },
-    {
-      "kind": "cli",
-      "name": "usersmagiclinktoken_isExpired",
-      "operation": "isExpired",
-      "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-    },
-    {
-      "kind": "cli",
-      "name": "usersmagiclinktoken_isValid",
-      "operation": "isValid",
-      "objectName": "@happyvertical/smrt-users:UsersMagicLinkToken"
-    },
     {
       "kind": "api",
       "name": "memberships.list",
@@ -10622,45 +9595,15 @@
       "objectName": "@happyvertical/smrt-users:Membership"
     },
     {
-      "kind": "cli",
-      "name": "membership_create",
-      "operation": "create",
+      "kind": "mcp",
+      "name": "membership_list",
+      "operation": "list",
       "objectName": "@happyvertical/smrt-users:Membership"
     },
     {
-      "kind": "cli",
-      "name": "membership_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:Membership"
-    },
-    {
-      "kind": "cli",
-      "name": "membership_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:Membership"
-    },
-    {
-      "kind": "cli",
-      "name": "membership_isActive",
-      "operation": "isActive",
-      "objectName": "@happyvertical/smrt-users:Membership"
-    },
-    {
-      "kind": "cli",
-      "name": "membership_isPending",
-      "operation": "isPending",
-      "objectName": "@happyvertical/smrt-users:Membership"
-    },
-    {
-      "kind": "mcp",
-      "name": "membership_list",
-      "operation": "list",
-      "objectName": "@happyvertical/smrt-users:Membership"
-    },
-    {
-      "kind": "mcp",
-      "name": "membership_get",
-      "operation": "get",
+      "kind": "mcp",
+      "name": "membership_get",
+      "operation": "get",
       "objectName": "@happyvertical/smrt-users:Membership"
     },
     {
@@ -10691,36 +9634,6 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:MembershipOverride"
     },
-    {
-      "kind": "cli",
-      "name": "membershipoverride_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:MembershipOverride"
-    },
-    {
-      "kind": "cli",
-      "name": "membershipoverride_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:MembershipOverride"
-    },
-    {
-      "kind": "cli",
-      "name": "membershipoverride_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:MembershipOverride"
-    },
-    {
-      "kind": "cli",
-      "name": "membershipoverride_isGrant",
-      "operation": "isGrant",
-      "objectName": "@happyvertical/smrt-users:MembershipOverride"
-    },
-    {
-      "kind": "cli",
-      "name": "membershipoverride_isDeny",
-      "operation": "isDeny",
-      "objectName": "@happyvertical/smrt-users:MembershipOverride"
-    },
     {
       "kind": "mcp",
       "name": "membershipoverride_list",
@@ -10761,48 +9674,6 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:Permission"
     },
-    {
-      "kind": "cli",
-      "name": "permission_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:Permission"
-    },
-    {
-      "kind": "cli",
-      "name": "permission_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:Permission"
-    },
-    {
-      "kind": "cli",
-      "name": "permission_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:Permission"
-    },
-    {
-      "kind": "cli",
-      "name": "permission_parseSlug",
-      "operation": "parseSlug",
-      "objectName": "@happyvertical/smrt-users:Permission"
-    },
-    {
-      "kind": "cli",
-      "name": "permission_getResource",
-      "operation": "getResource",
-      "objectName": "@happyvertical/smrt-users:Permission"
-    },
-    {
-      "kind": "cli",
-      "name": "permission_getAction",
-      "operation": "getAction",
-      "objectName": "@happyvertical/smrt-users:Permission"
-    },
-    {
-      "kind": "cli",
-      "name": "permission_isValidSlug",
-      "operation": "isValidSlug",
-      "objectName": "@happyvertical/smrt-users:Permission"
-    },
     {
       "kind": "mcp",
       "name": "permission_list",
@@ -10815,42 +9686,6 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:Permission"
     },
-    {
-      "kind": "cli",
-      "name": "resourcegrant_list",
-      "operation": "list",
-      "objectName": "@happyvertical/smrt-users:ResourceGrant"
-    },
-    {
-      "kind": "cli",
-      "name": "resourcegrant_get",
-      "operation": "get",
-      "objectName": "@happyvertical/smrt-users:ResourceGrant"
-    },
-    {
-      "kind": "cli",
-      "name": "resourcegrant_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:ResourceGrant"
-    },
-    {
-      "kind": "cli",
-      "name": "resourcegrant_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:ResourceGrant"
-    },
-    {
-      "kind": "cli",
-      "name": "resourcegrant_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:ResourceGrant"
-    },
-    {
-      "kind": "cli",
-      "name": "resourcegrant_isActive",
-      "operation": "isActive",
-      "objectName": "@happyvertical/smrt-users:ResourceGrant"
-    },
     {
       "kind": "api",
       "name": "roles.list",
@@ -10879,42 +9714,6 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:Role"
     },
-    {
-      "kind": "cli",
-      "name": "role_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:Role"
-    },
-    {
-      "kind": "cli",
-      "name": "role_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:Role"
-    },
-    {
-      "kind": "cli",
-      "name": "role_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:Role"
-    },
-    {
-      "kind": "cli",
-      "name": "role_isSystemRole",
-      "operation": "isSystemRole",
-      "objectName": "@happyvertical/smrt-users:Role"
-    },
-    {
-      "kind": "cli",
-      "name": "role_isTenantRole",
-      "operation": "isTenantRole",
-      "objectName": "@happyvertical/smrt-users:Role"
-    },
-    {
-      "kind": "cli",
-      "name": "role_canDelete",
-      "operation": "canDelete",
-      "objectName": "@happyvertical/smrt-users:Role"
-    },
     {
       "kind": "mcp",
       "name": "role_list",
@@ -10955,24 +9754,6 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:RolePermission"
     },
-    {
-      "kind": "cli",
-      "name": "rolepermission_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:RolePermission"
-    },
-    {
-      "kind": "cli",
-      "name": "rolepermission_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:RolePermission"
-    },
-    {
-      "kind": "cli",
-      "name": "rolepermission_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:RolePermission"
-    },
     {
       "kind": "mcp",
       "name": "rolepermission_list",
@@ -11001,126 +9782,6 @@
       "path": "/sessions/[id]",
       "method": "DELETE"
     },
-    {
-      "kind": "cli",
-      "name": "session_list",
-      "operation": "list",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_get",
-      "operation": "get",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_isLayered",
-      "operation": "isLayered",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_getAbsoluteExpiry",
-      "operation": "getAbsoluteExpiry",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_getIdleSeconds",
-      "operation": "getIdleSeconds",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_getPermissionCeiling",
-      "operation": "getPermissionCeiling",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_isValid",
-      "operation": "isValid",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_isExpired",
-      "operation": "isExpired",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_isRevoked",
-      "operation": "isRevoked",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_touch",
-      "operation": "touch",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_extend",
-      "operation": "extend",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_recordActivity",
-      "operation": "recordActivity",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_revoke",
-      "operation": "revoke",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_setTenant",
-      "operation": "setTenant",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_getData",
-      "operation": "getData",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_setData",
-      "operation": "setData",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
-    {
-      "kind": "cli",
-      "name": "session_removeData",
-      "operation": "removeData",
-      "objectName": "@happyvertical/smrt-users:Session"
-    },
     {
       "kind": "api",
       "name": "tenants.list",
@@ -11149,60 +9810,6 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:Tenant"
     },
-    {
-      "kind": "cli",
-      "name": "tenant_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:Tenant"
-    },
-    {
-      "kind": "cli",
-      "name": "tenant_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:Tenant"
-    },
-    {
-      "kind": "cli",
-      "name": "tenant_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:Tenant"
-    },
-    {
-      "kind": "cli",
-      "name": "tenant_isActive",
-      "operation": "isActive",
-      "objectName": "@happyvertical/smrt-users:Tenant"
-    },
-    {
-      "kind": "cli",
-      "name": "tenant_isSuspended",
-      "operation": "isSuspended",
-      "objectName": "@happyvertical/smrt-users:Tenant"
-    },
-    {
-      "kind": "cli",
-      "name": "tenant_isRoot",
-      "operation": "isRoot",
-      "objectName": "@happyvertical/smrt-users:Tenant"
-    },
-    {
-      "kind": "cli",
-      "name": "tenant_canCascadeToChildren",
-      "operation": "canCascadeToChildren",
-      "objectName": "@happyvertical/smrt-users:Tenant"
-    },
-    {
-      "kind": "cli",
-      "name": "tenant_acceptsInheritance",
-      "operation": "acceptsInheritance",
-      "objectName": "@happyvertical/smrt-users:Tenant"
-    },
-    {
-      "kind": "cli",
-      "name": "tenant_getAncestorIds",
-      "operation": "getAncestorIds",
-      "objectName": "@happyvertical/smrt-users:Tenant"
-    },
     {
       "kind": "mcp",
       "name": "tenant_list",
@@ -11243,66 +9850,6 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:TenantIntegration"
     },
-    {
-      "kind": "cli",
-      "name": "tenantintegration_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:TenantIntegration"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantintegration_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:TenantIntegration"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantintegration_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:TenantIntegration"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantintegration_getExternalIds",
-      "operation": "getExternalIds",
-      "objectName": "@happyvertical/smrt-users:TenantIntegration"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantintegration_setExternalIds",
-      "operation": "setExternalIds",
-      "objectName": "@happyvertical/smrt-users:TenantIntegration"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantintegration_getExternalId",
-      "operation": "getExternalId",
-      "objectName": "@happyvertical/smrt-users:TenantIntegration"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantintegration_setExternalId",
-      "operation": "setExternalId",
-      "objectName": "@happyvertical/smrt-users:TenantIntegration"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantintegration_getLastCheckSummary",
-      "operation": "getLastCheckSummary",
-      "objectName": "@happyvertical/smrt-users:TenantIntegration"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantintegration_setLastCheckSummary",
-      "operation": "setLastCheckSummary",
-      "objectName": "@happyvertical/smrt-users:TenantIntegration"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantintegration_recordDoctorRun",
-      "operation": "recordDoctorRun",
-      "objectName": "@happyvertical/smrt-users:TenantIntegration"
-    },
     {
       "kind": "mcp",
       "name": "tenantintegration_list",
@@ -11343,48 +9890,6 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
     },
-    {
-      "kind": "cli",
-      "name": "tenantpermissionoverride_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantpermissionoverride_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantpermissionoverride_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantpermissionoverride_isInherit",
-      "operation": "isInherit",
-      "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantpermissionoverride_isGrant",
-      "operation": "isGrant",
-      "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantpermissionoverride_isDeny",
-      "operation": "isDeny",
-      "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-    },
-    {
-      "kind": "cli",
-      "name": "tenantpermissionoverride_hasExplicitEffect",
-      "operation": "hasExplicitEffect",
-      "objectName": "@happyvertical/smrt-users:TenantPermissionOverride"
-    },
     {
       "kind": "mcp",
       "name": "tenantpermissionoverride_list",
@@ -11425,54 +9930,6 @@
       "operation": "get",
       "objectName": "@happyvertical/smrt-users:User"
     },
-    {
-      "kind": "cli",
-      "name": "user_create",
-      "operation": "create",
-      "objectName": "@happyvertical/smrt-users:User"
-    },
-    {
-      "kind": "cli",
-      "name": "user_update",
-      "operation": "update",
-      "objectName": "@happyvertical/smrt-users:User"
-    },
-    {
-      "kind": "cli",
-      "name": "user_delete",
-      "operation": "delete",
-      "objectName": "@happyvertical/smrt-users:User"
-    },
-    {
-      "kind": "cli",
-      "name": "user_hasValidEmail",
-      "operation": "hasValidEmail",
-      "objectName": "@happyvertical/smrt-users:User"
-    },
-    {
-      "kind": "cli",
-      "name": "user_isActive",
-      "operation": "isActive",
-      "objectName": "@happyvertical/smrt-users:User"
-    },
-    {
-      "kind": "cli",
-      "name": "user_isSuspended",
-      "operation": "isSuspended",
-      "objectName": "@happyvertical/smrt-users:User"
-    },
-    {
-      "kind": "cli",
-      "name": "user_isPending",
-      "operation": "isPending",
-      "objectName": "@happyvertical/smrt-users:User"
-    },
-    {
-      "kind": "cli",
-      "name": "user_recordLogin",
-      "operation": "recordLogin",
-      "objectName": "@happyvertical/smrt-users:User"
-    },
     {
       "kind": "mcp",
       "name": "user_list",
@@ -11495,7 +9952,7 @@
     "polymorphicAssociations": 0,
     "uuidColumns": 104
   },
-  "agentDoc": "# @happyvertical/smrt-users\n\nMulti-tenant identity, RBAC, hierarchical tenants, sessions, and SvelteKit auth.\n\n## Modules\n\nRead only the module relevant to the change; protocol and provisioning details\nare not prerequisites for unrelated user-package work.\n\n| Module | Scope | Module doc |\n|---|---|---|\n| `src/services/PermissionResolver.ts` | permission precedence, inherited memberships, guards, RLS, role seeding | [agents/permissions.md](agents/permissions.md) |\n| `src/services/OidcLoginService.ts`, collections and OIDC handlers | identity reconciliation, transaction boundaries, migration readiness | [agents/oidc-provisioning.md](agents/oidc-provisioning.md) |\n| `src/services/MobileAuthService.ts` | mobile handshake, bearer sessions, bootstrap extension boundary | [agents/mobile-auth.md](agents/mobile-auth.md) |\n| `src/services/TerminalAuthService.ts`, `src/services/LoginAttemptLimiter.ts`, `src/collections/LoginAttemptCollection.ts` | terminal approval concurrency, shared login budget and lockout (#3273), retry-safe database fixtures | [agents/terminal-auth-testing.md](agents/terminal-auth-testing.md) |\n| `src/services/DeviceCredentialService.ts` | per-person PIN layered on a device session (#3276), verifier seam for other credential kinds | this file, \"Security boundaries\" |\n| `src/services/PasswordCredentialService.ts`, `src/sveltekit/password-handlers.ts` | email + password sign-in and password lifecycle (#3274); shared scrypt in `credential-hash.ts` | this file, \"Security boundaries\"; README \"Password sign-in\" |\n| `src/retention.ts` | expired session/token/CLI-auth reaping and retention sweep wiring | [agents/retention.md](agents/retention.md) |\n\n## Models and authority\n\n- Users are global; tenant access comes through Membership (unique user/tenant).\n  User email is normalized and globally unique through readonly nullable\n  `emailKey`. `profileId` is a unique cross-package reference: at most one User\n  owns each non-null Profile.\n- Tenant uses STI and a materialized hierarchy, maximum depth 10.\n  `hierarchyPath`/`hierarchyLevel` are derived from `parentTenantId` by\n  `Tenant.save()` on every save (any caller-supplied value is recomputed) and\n  descendants are re-materialized when they change; never hand-maintain them.\n  Legacy rows are backfilled with `smrt db:materialize-tenant-hierarchy`\n  (`materializeTenantHierarchy()`). Tests that need a corrupt path must write it\n  with raw SQL (#3036).\n- Role with `tenantId = null` is available to all tenants; `isSystem` prevents\n  deletion. `inheritsToDescendants` is opt-in. Seed owner/admin/member/viewer\n  through `RoleCollection.seedSystemRoles()` at application initialization.\n- Group roles apply only in their own tenant. Use `getGroupIdsForTenant()`,\n  never cross-tenant `getGroupIds()`, for authorization.\n- Upward visibility is opt-in and read-only: `permissions.ancestorRead`\n  ({ roles, collections, maxDepth? }) lets a DESCENDANT membership contribute\n  declared `<collection>.read` at an ancestor, only when no membership resolved\n  there, intersected with BOTH the role's own catalog grants and the\n  principal's effective permissions in that descendant, and only for SYSTEM\n  roles (a tenant-scoped role sharing a declared slug is ignored). Off by default, never\n  write, never lateral, and never row visibility — sibling rows stay scoped by\n  tenancy/RLS. Read the permissions module before changing it.\n- Membership DENY always wins. Direct inactive membership blocks inherited\n  authority; a direct active membership pins resolution instead of unioning it\n  with ancestors. Read the permissions module before changing these rules.\n- AccessRequest has no generated API/MCP/CLI operations; access it through\n  `AccessRequestService`. Its JSON field is `requestContext`, not reserved\n  slug-scoping `context`.\n\n## Security boundaries\n\n- Generated REST/MCP operations on identity/RBAC models are list/get only.\n  Route authentication does not authorize authority mutations, and these models\n  are not tenant-scoped. Use permission-gated services or explicitly checked\n  consumer handlers. CLI remains a local-operator surface. Preserve the\n  registry assertions in `security-audit-1400.test.ts`.\n- Resource guards take the resource tenant, not the session tenant. Omit a\n  session membership when targeting a different tenant; mismatches fail closed.\n  `loadSessionContext().tenantAuthorization` must be checked by required-tenant\n  consumers: null membership can represent inherited authority.\n- Sessions use secure UUIDs; TTL is seconds (default seven days). Access marks\n  expired sessions EXPIRED. Magic-link tokens are single use.\n- `Session.authMethod` is server-set at mint time and never read from the\n  client; every mint site in this package sets it. A session with\n  `parentSessionId` is valid only while its parent validates\n  (`loadSessionContext` enforces this; there is no FK cascade by design), may\n  not switch to a tenant other than the parent's, and is revoked with its\n  parent by `destroySession`.\n- Credential sign-ins reserve through `LoginAttemptLimiter` BEFORE credential\n  work and key the subject on the submitted identifier, never a resolved user,\n  so unknown and wrong take the same path. Reservations are fail-closed: keep\n  them on failure, release on success or abort, never skip the reserve.\n  Limiter writes are raw SQL and bypass the change feed; the audit sink is the\n  observability seam, and it must never throw into the sign-in path.\n- `DeviceCredentialService` accepts a person credential only from a\n  first-class session whose `authMethod` is a device-enrollment method\n  (`terminal` by default) and that the host's `assertEnrolledDevice` confirms.\n  A layered or PIN session can never administer PINs regardless of\n  permissions. PIN hashes carry a per-row salt and the configured pepper;\n  treat an unset pepper as a production misconfiguration.\n- A person session carries the PERSON's authority (resolved from their own\n  membership on every load), never the device account's. `Session.data` keys\n  in `SESSION_DATA_KEYS` are server-set controls enforced by the model:\n  `permissionCeiling` only ever intersects (malformed fails closed to none)\n  and suppresses `superAdminBypass`/`systemContext`; `absoluteExpiresAt`\n  bounds `extend()` and `isValid()`; `idleSeconds` overrides the resolving\n  service's TTL policy. Never write them from client input. The ceiling is a\n  sign-in snapshot; `singleOccupant` revokes other children only AFTER a\n  successful mint. A `mustReset` sign-in mints with an empty ceiling and\n  `setPin` ends that session; do not grant it authority another way.\n- `UsersPasswordCredential` is one row per person, sensitive, with no\n  generated surface; `PasswordCredentialService` and its handlers are its only\n  read/write paths. Sign-in normalizes the email like `emailKey`, reserves\n  before work, always runs one scrypt verify (dummy hash when absent), never\n  creates a user, and maps every non-rate-limit refusal to one\n  `PasswordCredentialError`. It re-checks the credential after the mint (a\n  rehash that keeps row and version is confirmed by re-verifying); the\n  parameter-upgrade write is a guarded UPDATE that must never replace a\n  rotated password, and verification against a weaker stored hash is padded\n  to the policy's scrypt cost. Self-service writes are guarded on the proven\n  credential (first set insert-only); session sweeps run before and after\n  each write. Self-service needs the current password except for a first\n  set; `users.password.manage` follows the PIN's single-tenant target\n  rule and never resets the actor's own. Layered sessions never manage\n  passwords; a `mustChange` sign-in mints an empty ceiling.\n- A layered session whose tenant differs from its parent's never loads (null\n  is allowed: narrower). Limiter rows carry `retain_until`; retention must\n  not fall back to a process-wide horizon.\n- `Session.parentSessionId` is the parent's bearer: sensitive, never a\n  `list()` filter (raw-SQL id reads, which also keep revocation sweeps free of\n  caller list bounds), never serialized to clients. `users.pin.manage` reaches\n  only people whose every active membership is in the actor's tenant (the PIN\n  is global per person). A sign-in re-checks the verified\n  credential generation AFTER the mint (`stillValid`); keep that ordering.\n  Operation guards deny outside a session's ceiling; `loadPersonSession`\n  re-checks device enrollment.\n- Tenant switching verifies active membership before writing and rotates the\n  session ID for non-null targets, revoking the old session. Persist the returned\n  `SwitchTenantResult.sessionId`; `switchSessionTenant()` updates the cookie and\n  preserves its security settings. Failed switches mutate nothing; null clears\n  do not rotate, and layered sessions never rotate (a replacement would escape\n  the revocation sweeps they depend on). Layers do not nest. `SessionCollection.setSessionTenant()` is unguarded and must\n  never receive an untrusted tenant ID.\n- OIDC provisioning is atomic and fail-closed. Preserve exact issuer/subject\n  identifiers, claim-source email verification, unique global Person ownership,\n  and transaction-bound reconciliation. Read the OIDC module and canonical\n  scenario matrix before changing any provisioning path.\n\n## Entry points and validation\n\n`src/sveltekit/` owns `createSessionHandler`, `createSessionCookie`,\n`destroySessionCookie`, and `switchSessionTenant`. Use README integration examples\nrather than copying application setup into these instructions.\n\nFrom the repository root:\n\n```bash\npnpm --filter @happyvertical/smrt-users test\npnpm --filter @happyvertical/smrt-users typecheck\npnpm --filter @happyvertical/smrt-users test:postgres\n```\n\nStart with the relevant test file via `test -- src/__tests__/<file>.test.ts`.\nRun `test:postgres` for RLS, principal context, OIDC, or terminal-auth database\nchanges. `typecheck` includes Svelte accessibility checks; plain `tsc` is\ninsufficient. Follow root knowledge freshness checks before shipping.\n",
+  "agentDoc": "# @happyvertical/smrt-users\n\nMulti-tenant identity, RBAC, hierarchical tenants, sessions, and SvelteKit auth.\n\n## Modules\n\nRead only the module relevant to the change; protocol and provisioning details\nare not prerequisites for unrelated user-package work.\n\n| Module | Scope | Module doc |\n|---|---|---|\n| `src/services/PermissionResolver.ts` | permission precedence, inherited memberships, guards, RLS, role seeding | [agents/permissions.md](agents/permissions.md) |\n| `src/services/OidcLoginService.ts`, collections and OIDC handlers | identity reconciliation, transaction boundaries, migration readiness | [agents/oidc-provisioning.md](agents/oidc-provisioning.md) |\n| `src/services/MobileAuthService.ts` | mobile handshake, bearer sessions, bootstrap extension boundary | [agents/mobile-auth.md](agents/mobile-auth.md) |\n| `src/services/TerminalAuthService.ts`, `src/services/LoginAttemptLimiter.ts`, `src/collections/LoginAttemptCollection.ts` | terminal approval concurrency, shared login budget and lockout (#3273), retry-safe database fixtures | [agents/terminal-auth-testing.md](agents/terminal-auth-testing.md) |\n| `src/services/DeviceCredentialService.ts` | per-person PIN layered on a device session (#3276), verifier seam for other credential kinds | this file, \"Security boundaries\" |\n| `src/services/PasswordCredentialService.ts`, `src/sveltekit/password-handlers.ts` | email + password sign-in and password lifecycle (#3274); shared scrypt in `credential-hash.ts` | this file, \"Security boundaries\"; README \"Password sign-in\" |\n| `src/retention.ts` | expired session/token/CLI-auth reaping and retention sweep wiring | [agents/retention.md](agents/retention.md) |\n\n## Models and authority\n\n- Users are global; tenant access comes through Membership (unique user/tenant).\n  User email is normalized and globally unique through readonly nullable\n  `emailKey`. `profileId` is a unique cross-package reference: at most one User\n  owns each non-null Profile.\n- Tenant uses STI and a materialized hierarchy, maximum depth 10.\n  `hierarchyPath`/`hierarchyLevel` are derived from `parentTenantId` by\n  `Tenant.save()` on every save (any caller-supplied value is recomputed) and\n  descendants are re-materialized when they change; never hand-maintain them.\n  Legacy rows are backfilled with `smrt db:materialize-tenant-hierarchy`\n  (`materializeTenantHierarchy()`). Tests that need a corrupt path must write it\n  with raw SQL (#3036).\n- Role with `tenantId = null` is available to all tenants; `isSystem` prevents\n  deletion. `inheritsToDescendants` is opt-in. Seed owner/admin/member/viewer\n  through `RoleCollection.seedSystemRoles()` at application initialization.\n- Group roles apply only in their own tenant. Use `getGroupIdsForTenant()`,\n  never cross-tenant `getGroupIds()`, for authorization.\n- Upward visibility is opt-in and read-only: `permissions.ancestorRead`\n  ({ roles, collections, maxDepth? }) lets a DESCENDANT membership contribute\n  declared `<collection>.read` at an ancestor, only when no membership resolved\n  there, intersected with BOTH the role's own catalog grants and the\n  principal's effective permissions in that descendant, and only for SYSTEM\n  roles (a tenant-scoped role sharing a declared slug is ignored). Off by default, never\n  write, never lateral, and never row visibility — sibling rows stay scoped by\n  tenancy/RLS. Read the permissions module before changing it.\n- Membership DENY always wins. Direct inactive membership blocks inherited\n  authority; a direct active membership pins resolution instead of unioning it\n  with ancestors. Read the permissions module before changing these rules.\n- AccessRequest has no generated API/MCP/CLI operations; access it through\n  `AccessRequestService`. Its JSON field is `requestContext`, not reserved\n  slug-scoping `context`.\n\n## Security boundaries\n\n- Generated REST/MCP operations on identity/RBAC models are list/get only.\n  Route authentication does not authorize authority mutations, and these models\n  are not tenant-scoped. Use permission-gated services or explicitly checked\n  consumer handlers. Generated CLI is list/get or closed (`cli: false` for\n  credential/grant models) because agents shell out to it; a `cli` without\n  `include` is full CRUD (#3742). Their catalog slugs stay full via\n  `USERS_AUTHORITY_CATALOG_MODELS`. Preserve the registry assertions in\n  `security-audit-1400.test.ts` and `issue-3742-cli-surface-lockdown.test.ts`.\n- Resource guards take the resource tenant, not the session tenant. Omit a\n  session membership when targeting a different tenant; mismatches fail closed.\n  `loadSessionContext().tenantAuthorization` must be checked by required-tenant\n  consumers: null membership can represent inherited authority.\n- Sessions use secure UUIDs; TTL is seconds (default seven days). Access marks\n  expired sessions EXPIRED. Magic-link tokens are single use.\n- `Session.authMethod` is server-set at mint time and never read from the\n  client; every mint site in this package sets it. A session with\n  `parentSessionId` is valid only while its parent validates\n  (`loadSessionContext` enforces this; there is no FK cascade by design), may\n  not switch to a tenant other than the parent's, and is revoked with its\n  parent by `destroySession`.\n- Credential sign-ins reserve through `LoginAttemptLimiter` BEFORE credential\n  work and key the subject on the submitted identifier, never a resolved user,\n  so unknown and wrong take the same path. Reservations are fail-closed: keep\n  them on failure, release on success or abort, never skip the reserve.\n  Limiter writes are raw SQL and bypass the change feed; the audit sink is the\n  observability seam, and it must never throw into the sign-in path.\n- `DeviceCredentialService` accepts a person credential only from a\n  first-class session whose `authMethod` is a device-enrollment method\n  (`terminal` by default) and that the host's `assertEnrolledDevice` confirms.\n  A layered or PIN session can never administer PINs regardless of\n  permissions. PIN hashes carry a per-row salt and the configured pepper;\n  treat an unset pepper as a production misconfiguration.\n- A person session carries the PERSON's authority (resolved from their own\n  membership on every load), never the device account's. `Session.data` keys\n  in `SESSION_DATA_KEYS` are server-set controls enforced by the model:\n  `permissionCeiling` only ever intersects (malformed fails closed to none)\n  and suppresses `superAdminBypass`/`systemContext`; `absoluteExpiresAt`\n  bounds `extend()` and `isValid()`; `idleSeconds` overrides the resolving\n  service's TTL policy. Never write them from client input. The ceiling is a\n  sign-in snapshot; `singleOccupant` revokes other children only AFTER a\n  successful mint. A `mustReset` sign-in mints with an empty ceiling and\n  `setPin` ends that session; do not grant it authority another way.\n- `UsersPasswordCredential` is one row per person, sensitive, with no\n  generated surface; `PasswordCredentialService` and its handlers are its only\n  read/write paths. Sign-in normalizes the email like `emailKey`, reserves\n  before work, always runs one scrypt verify (dummy hash when absent), never\n  creates a user, and maps every non-rate-limit refusal to one\n  `PasswordCredentialError`. It re-checks the credential after the mint (a\n  rehash that keeps row and version is confirmed by re-verifying); the\n  parameter-upgrade write is a guarded UPDATE that must never replace a\n  rotated password, and verification against a weaker stored hash is padded\n  to the policy's scrypt cost. Self-service writes are guarded on the proven\n  credential (first set insert-only); session sweeps run before and after\n  each write. Self-service needs the current password except for a first\n  set; `users.password.manage` follows the PIN's single-tenant target\n  rule and never resets the actor's own. Layered sessions never manage\n  passwords; a `mustChange` sign-in mints an empty ceiling.\n- A layered session whose tenant differs from its parent's never loads (null\n  is allowed: narrower). Limiter rows carry `retain_until`; retention must\n  not fall back to a process-wide horizon.\n- `Session.parentSessionId` is the parent's bearer: sensitive, never a\n  `list()` filter (raw-SQL id reads, which also keep revocation sweeps free of\n  caller list bounds), never serialized to clients. `users.pin.manage` reaches\n  only people whose every active membership is in the actor's tenant (the PIN\n  is global per person). A sign-in re-checks the verified\n  credential generation AFTER the mint (`stillValid`); keep that ordering.\n  Operation guards deny outside a session's ceiling; `loadPersonSession`\n  re-checks device enrollment.\n- Tenant switching verifies active membership before writing and rotates the\n  session ID for non-null targets, revoking the old session. Persist the returned\n  `SwitchTenantResult.sessionId`; `switchSessionTenant()` updates the cookie and\n  preserves its security settings. Failed switches mutate nothing; null clears\n  do not rotate, and layered sessions never rotate (a replacement would escape\n  the revocation sweeps they depend on). Layers do not nest. `SessionCollection.setSessionTenant()` is unguarded and must\n  never receive an untrusted tenant ID.\n- OIDC provisioning is atomic and fail-closed. Preserve exact issuer/subject\n  identifiers, claim-source email verification, unique global Person ownership,\n  and transaction-bound reconciliation. Read the OIDC module and canonical\n  scenario matrix before changing any provisioning path.\n\n## Entry points and validation\n\n`src/sveltekit/` owns `createSessionHandler`, `createSessionCookie`,\n`destroySessionCookie`, and `switchSessionTenant`. Use README integration examples\nrather than copying application setup into these instructions.\n\nFrom the repository root:\n\n```bash\npnpm --filter @happyvertical/smrt-users test\npnpm --filter @happyvertical/smrt-users typecheck\npnpm --filter @happyvertical/smrt-users test:postgres\n```\n\nStart with the relevant test file via `test -- src/__tests__/<file>.test.ts`.\nRun `test:postgres` for RLS, principal context, OIDC, or terminal-auth database\nchanges. `typecheck` includes Svelte accessibility checks; plain `tsc` is\ninsufficient. Follow root knowledge freshness checks before shipping.\n",
   "moduleDocs": [
     {
       "path": "agents/permissions.md",
@@ -11578,10 +10035,9 @@
         }
       },
       "help": {
-        "markdown": "## Overview\n\nRoles and permissions control tenant access. Denies take precedence, and role changes should be reviewed before they are applied.\n\n## Tasks\n\n- Create a role and assign only the permissions required for its work.\n- Add a member to the correct tenant through {field:Membership.tenantId} and assign a role through {field:Membership.roleId}.\n- Use a resource grant only when a record needs a reviewed exception to its ordinary role rules.\n",
+        "markdown": "## Overview\n\nRoles and permissions control access to your organization. Denies take precedence, and role changes should be reviewed before they are applied.\n\n## Tasks\n\n- Ask an authorized administrator to create a role and assign only the permissions required for its work.\n- Add a member to the correct organization through your approved membership settings and assign a role through {field:Membership.roleId}.\n- Use a resource grant only when a record needs a reviewed exception to its ordinary role rules.\n",
         "fieldRefs": [
-          "Membership.roleId",
-          "Membership.tenantId"
+          "Membership.roleId"
         ]
       },
       "demo": {
@@ -11636,7 +10092,7 @@
         }
       },
       "help": {
-        "markdown": "## Overview\n\nUse your organization’s approved sign-in method. Sessions are managed on the server and are never shared through API or MCP tools.\n\n## Tasks\n\n- Review active sign-in sessions from your account security page and end sessions you no longer recognize.\n- Ask an administrator for recovery help if you lose access to every available credential.\n",
+        "markdown": "## Overview\n\nUse your organization’s approved sign-in method. Review your signed-in devices on your account security page.\n\n## Tasks\n\n- Review active sign-in sessions from your account security page and end sessions you no longer recognize.\n- Ask an administrator for recovery help if you lose access to every available credential.\n",
         "fieldRefs": []
       },
       "surfaces": [