@happyvertical/smrt-users 0.55.6 → 0.55.8

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as DEFAULT_LOGIN_LOCKOUT_FACTOR, $t as Group, A as readMobileBearerToken, At as deriveOperationPermissionCollectionName, B as DEFAULT_PIN_MANAGE_PERMISSION, Bt as PermissionCollection, C as hasOperationPermission, Ct as applyTenantHierarchyUpdates, D as withSessionPermissionContext, Dt as DEFAULT_ROLE_PERMISSION_PATTERNS, E as withPrincipalPermissionContext, Et as recordTenantHierarchyChanges, F as encodeOidcTransaction, Ft as RolePermission, G as PIN_LOGIN_KIND, Gt as MembershipOverride, H as DeviceCredentialForbiddenError, Ht as UsersPasswordCredentialCollection, I as getUsersOidcConfig, It as RoleCollection, J as ensurePinPermissionsRegistered, Jt as GroupRoleCollection, K as PIN_PERMISSION_DEFINITIONS, Kt as MembershipCollection, L as resolveOidcProviderConfig, Lt as Role, M as OidcLoginError, Mt as normalizeOperationPermissionAction, N as OidcLoginService, Nt as registerPermissionDefinitions, O as MobileAuthError, Ot as RolePermissionCollection, P as decodeOidcTransaction, Pt as syncPermissionCatalog, Q as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Qt as GroupCollection, Rt as UsersPinCredentialCollection, S as checkOperationPermission, St as TenantHierarchyError, T as getRequestScopedDatabase, Tt as planTenantHierarchy, U as DeviceCredentialPolicyError, Ut as UsersPasswordCredential, V as DeviceCredentialError, Vt as Permission, W as DeviceCredentialService, Wt as MembershipOverrideCollection, X as PermissionResolver, Xt as GroupMemberCollection, Y as SessionService, Yt as GroupRole, Z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, Zt as GroupMember, _ as PasswordCredentialService, _t as TenantPermissionOverrideCollection, a as TerminalAuthError, an as UsersLoginAttemptCollection, at as LoginRateLimitError, b as OperationPermissionError, bt as Tenant, c as DEFAULT_PASSWORD_DENYLIST, cn as SessionCollection, ct as DEFAULT_ANCESTOR_READ_MAX_DEPTH, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as Session, dt as normalizeAncestorReadPolicy, en as User, et as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, f as PASSWORD_LOGIN_KIND, fn as generateSessionId, ft as OidcProvisioningError, g as PasswordCredentialForbiddenError, gt as backfillUserEmailKeys, h as PasswordCredentialError, ht as UserEmailKeyBackfillError, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAuditEvent, it as LoginAttemptLimiter, j as validateMobileRedirectUri, jt as deriveOperationPermissionSlug, k as MobileAuthService, kt as PermissionCatalogService, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as DEFAULT_SESSION_TTL, lt as getConfiguredAncestorReadPolicy, m as PASSWORD_PERMISSION_DEFINITIONS, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as normalizeEmail, nt as DurableLoginAuditSink, o as TerminalAuthRateLimitError, on as UsersLoginAttempt, ot as withoutListBounds, p as PASSWORD_MAX_LENGTH_CEILING, pn as UsersCliAuthRequest, pt as UserCollection, q as PinVerifier, qt as Membership, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAuditEventCollection, rt as InvalidCredentialsError, s as TerminalAuthService, sn as UsersCliAuthRequestCollection, st as ANCESTOR_READ_ACTION, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as isValidEmail, tt as DEFAULT_LOGIN_MAX_ATTEMPTS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as SESSION_DATA_KEYS, ut as isAncestorReadableSlug, v as PasswordPolicyError, vt as TenantPermissionOverride, w as getCurrentSessionPermissionContext, wt as assertTenantTableName, x as assertOperationPermission, xt as MAX_TENANT_HIERARCHY_DEPTH, y as ensurePasswordPermissionsRegistered, yt as TenantCollection, z as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, zt as UsersPinCredential } from "./chunks/TerminalAuthService-B89-bMKw.js";
+import { $ as DEFAULT_LOGIN_LOCKOUT_FACTOR, $t as Group, A as readMobileBearerToken, At as deriveOperationPermissionCollectionName, B as DEFAULT_PIN_MANAGE_PERMISSION, Bt as PermissionCollection, C as hasOperationPermission, Ct as applyTenantHierarchyUpdates, D as withSessionPermissionContext, Dt as DEFAULT_ROLE_PERMISSION_PATTERNS, E as withPrincipalPermissionContext, Et as recordTenantHierarchyChanges, F as encodeOidcTransaction, Ft as RolePermission, G as PIN_LOGIN_KIND, Gt as MembershipOverride, H as DeviceCredentialForbiddenError, Ht as UsersPasswordCredentialCollection, I as getUsersOidcConfig, It as RoleCollection, J as ensurePinPermissionsRegistered, Jt as GroupRoleCollection, K as PIN_PERMISSION_DEFINITIONS, Kt as MembershipCollection, L as resolveOidcProviderConfig, Lt as Role, M as OidcLoginError, Mt as normalizeOperationPermissionAction, N as OidcLoginService, Nt as registerPermissionDefinitions, O as MobileAuthError, Ot as RolePermissionCollection, P as decodeOidcTransaction, Pt as syncPermissionCatalog, Q as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, Qt as GroupCollection, Rt as UsersPinCredentialCollection, S as checkOperationPermission, St as TenantHierarchyError, T as getRequestScopedDatabase, Tt as planTenantHierarchy, U as DeviceCredentialPolicyError, Ut as UsersPasswordCredential, V as DeviceCredentialError, Vt as Permission, W as DeviceCredentialService, Wt as MembershipOverrideCollection, X as PermissionResolver, Xt as GroupMemberCollection, Y as SessionService, Yt as GroupRole, Z as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, Zt as GroupMember, _ as PasswordCredentialService, _t as TenantPermissionOverrideCollection, a as TerminalAuthError, an as UsersLoginAttemptCollection, at as LoginRateLimitError, b as OperationPermissionError, bt as Tenant, c as DEFAULT_PASSWORD_DENYLIST, cn as SessionCollection, ct as DEFAULT_ANCESTOR_READ_MAX_DEPTH, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as Session, dt as normalizeAncestorReadPolicy, en as User, et as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, f as PASSWORD_LOGIN_KIND, fn as generateSessionId, ft as OidcProvisioningError, g as PasswordCredentialForbiddenError, gt as backfillUserEmailKeys, h as PasswordCredentialError, ht as UserEmailKeyBackfillError, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAuditEvent, it as LoginAttemptLimiter, j as validateMobileRedirectUri, jt as deriveOperationPermissionSlug, k as MobileAuthService, kt as PermissionCatalogService, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as DEFAULT_SESSION_TTL, lt as getConfiguredAncestorReadPolicy, m as PASSWORD_PERMISSION_DEFINITIONS, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as normalizeEmail, nt as DurableLoginAuditSink, o as TerminalAuthRateLimitError, on as UsersLoginAttempt, ot as withoutListBounds, p as PASSWORD_MAX_LENGTH_CEILING, pn as UsersCliAuthRequest, pt as UserCollection, q as PinVerifier, qt as Membership, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAuditEventCollection, rt as InvalidCredentialsError, s as TerminalAuthService, sn as UsersCliAuthRequestCollection, st as ANCESTOR_READ_ACTION, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as isValidEmail, tt as DEFAULT_LOGIN_MAX_ATTEMPTS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as SESSION_DATA_KEYS, ut as isAncestorReadableSlug, v as PasswordPolicyError, vt as TenantPermissionOverride, w as getCurrentSessionPermissionContext, wt as assertTenantTableName, x as assertOperationPermission, xt as MAX_TENANT_HIERARCHY_DEPTH, y as ensurePasswordPermissionsRegistered, yt as TenantCollection, z as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, zt as UsersPinCredential } from "./chunks/TerminalAuthService-CNYOmaaa.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, bumpChangeFeed, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
 import { createHash, randomUUID } from "node:crypto";
@@ -1382,7 +1382,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-B89-bMKw.js").then((n) => n.R);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-CNYOmaaa.js").then((n) => n.R);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -1411,7 +1411,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-B89-bMKw.js").then((n) => n.R);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-CNYOmaaa.js").then((n) => n.R);
 		const key = await this.getSigningKey();
 		let payload;
 		try {

package/dist/manifest.json

@@ -2,13 +2,14 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.55.6",
+  "packageVersion": "0.55.8",
   "objects": {
     "@happyvertical/smrt-users:AccessRequestCollection": {
       "name": "accessrequestcollection",
       "className": "AccessRequestCollection",
       "qualifiedName": "@happyvertical/smrt-users:AccessRequestCollection",
       "collection": "accessrequests",
+      "description": "Collection for managing AccessRequest objects.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/AccessRequestCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -552,6 +553,7 @@
       "className": "GroupCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupCollection",
       "collection": "groups",
+      "description": "Collection for managing Group objects",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/GroupCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -675,6 +677,7 @@
       "className": "GroupMemberCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupMemberCollection",
       "collection": "groupmembers",
+      "description": "Collection for managing GroupMember objects",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/GroupMemberCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -908,6 +911,7 @@
       "className": "GroupRoleCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupRoleCollection",
       "collection": "grouproles",
+      "description": "Collection for managing GroupRole objects",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/GroupRoleCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -1449,6 +1453,7 @@
       "className": "UsersMagicLinkTokenCollection",
       "qualifiedName": "@happyvertical/smrt-users:UsersMagicLinkTokenCollection",
       "collection": "usersmagiclinktokens",
+      "description": "Collection for managing smrt-users magic link token records",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/MagicLinkTokenCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -1590,6 +1595,7 @@
       "className": "MembershipCollection",
       "qualifiedName": "@happyvertical/smrt-users:MembershipCollection",
       "collection": "memberships",
+      "description": "Collection for managing Membership objects",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/MembershipCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -1819,6 +1825,7 @@
       "className": "MembershipOverrideCollection",
       "qualifiedName": "@happyvertical/smrt-users:MembershipOverrideCollection",
       "collection": "membershipoverrides",
+      "description": "Collection for managing MembershipOverride objects",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/MembershipOverrideCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -2308,6 +2315,7 @@
       "className": "PermissionCollection",
       "qualifiedName": "@happyvertical/smrt-users:PermissionCollection",
       "collection": "permissions",
+      "description": "Collection for managing Permission objects",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/PermissionCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -2814,6 +2822,7 @@
       "className": "RoleCollection",
       "qualifiedName": "@happyvertical/smrt-users:RoleCollection",
       "collection": "roles",
+      "description": "Collection for managing Role objects",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/RoleCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -3000,6 +3009,7 @@
       "className": "RolePermissionCollection",
       "qualifiedName": "@happyvertical/smrt-users:RolePermissionCollection",
       "collection": "rolepermissions",
+      "description": "Collection for managing RolePermission objects",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/RolePermissionCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -3234,6 +3244,7 @@
       "className": "SessionCollection",
       "qualifiedName": "@happyvertical/smrt-users:SessionCollection",
       "collection": "sessions",
+      "description": "Collection for managing Session objects",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/SessionCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -3666,6 +3677,7 @@
       "className": "TenantCollection",
       "qualifiedName": "@happyvertical/smrt-users:TenantCollection",
       "collection": "tenants",
+      "description": "Collection for managing Tenant objects with hierarchical support.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/TenantCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -4217,6 +4229,7 @@
       "className": "TenantPermissionOverrideCollection",
       "qualifiedName": "@happyvertical/smrt-users:TenantPermissionOverrideCollection",
       "collection": "tenantpermissionoverrides",
+      "description": "Collection for managing TenantPermissionOverride objects.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/TenantPermissionOverrideCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -4586,6 +4599,7 @@
       "className": "UserCollection",
       "qualifiedName": "@happyvertical/smrt-users:UserCollection",
       "collection": "users",
+      "description": "Collection for managing User objects",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/collections/UserCollection.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {},
@@ -4793,6 +4807,7 @@
       "className": "AccessRequest",
       "qualifiedName": "@happyvertical/smrt-users:AccessRequest",
       "collection": "accessrequests",
+      "description": "A prospective user's request for access, captured before they become a User.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/AccessRequest.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -5106,6 +5121,7 @@
       "className": "UsersCliAuthApproveLimit",
       "qualifiedName": "@happyvertical/smrt-users:UsersCliAuthApproveLimit",
       "collection": "userscliauthapprovelimits",
+      "description": "Private database arbiter shared by every terminal-auth process.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/CliAuthApproveLimit.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -5479,6 +5495,7 @@
       "className": "Group",
       "qualifiedName": "@happyvertical/smrt-users:Group",
       "collection": "groups",
+      "description": "Group represents a team or department within a tenant.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/Group.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -5613,6 +5630,7 @@
       "className": "GroupMember",
       "qualifiedName": "@happyvertical/smrt-users:GroupMember",
       "collection": "groupmembers",
+      "description": "GroupMember is a join table linking Users to Groups.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/GroupMember.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -5755,6 +5773,7 @@
       "className": "GroupRole",
       "qualifiedName": "@happyvertical/smrt-users:GroupRole",
       "collection": "grouproles",
+      "description": "GroupRole is a join table linking Groups to Roles.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/GroupRole.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -5897,6 +5916,7 @@
       "className": "UsersLoginAttempt",
       "qualifiedName": "@happyvertical/smrt-users:UsersLoginAttempt",
       "collection": "usersloginattempts",
+      "description": "Private database arbiter shared by every process that authenticates.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/LoginAttempt.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -6495,6 +6515,7 @@
       "className": "Membership",
       "qualifiedName": "@happyvertical/smrt-users:Membership",
       "collection": "memberships",
+      "description": "Membership represents a user's membership in a tenant with an assigned role.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/Membership.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -6713,6 +6734,7 @@
       "className": "MembershipOverride",
       "qualifiedName": "@happyvertical/smrt-users:MembershipOverride",
       "collection": "membershipoverrides",
+      "description": "MembershipOverride allows granting or denying specific permissions to a user beyond what their role and groups provide.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/MembershipOverride.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -7065,6 +7087,7 @@
       "className": "Permission",
       "qualifiedName": "@happyvertical/smrt-users:Permission",
       "collection": "permissions",
+      "description": "Permission represents a named capability in the system.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/Permission.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -7393,6 +7416,7 @@
       "className": "ResourceGrant",
       "qualifiedName": "@happyvertical/smrt-users:ResourceGrant",
       "collection": "resourcegrants",
+      "description": "An exact tenant/resource/user/permission decision. This deliberately does not replace tenant RBAC: ResourceGrantResolver only allows after the normal operation guard has allowed the same permission.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/ResourceGrant.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -7644,6 +7668,7 @@
       "className": "Role",
       "qualifiedName": "@happyvertical/smrt-users:Role",
       "collection": "roles",
+      "description": "Role represents a permission template that can be assigned to users.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/Role.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -7829,6 +7854,7 @@
       "className": "RolePermission",
       "qualifiedName": "@happyvertical/smrt-users:RolePermission",
       "collection": "rolepermissions",
+      "description": "RolePermission is a join table linking Roles to Permissions.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/RolePermission.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -7978,6 +8004,7 @@
       "className": "Session",
       "qualifiedName": "@happyvertical/smrt-users:Session",
       "collection": "sessions",
+      "description": "Session represents an authenticated user session.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/Session.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -8385,6 +8412,7 @@
       "className": "Tenant",
       "qualifiedName": "@happyvertical/smrt-users:Tenant",
       "collection": "tenants",
+      "description": "Tenant represents an organizational boundary in the multi-tenant system.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/Tenant.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -8962,6 +8990,7 @@
       "className": "TenantPermissionOverride",
       "qualifiedName": "@happyvertical/smrt-users:TenantPermissionOverride",
       "collection": "tenantpermissionoverrides",
+      "description": "TenantPermissionOverride allows setting explicit permission values at the tenant level.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/TenantPermissionOverride.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -9149,6 +9178,7 @@
       "className": "User",
       "qualifiedName": "@happyvertical/smrt-users:User",
       "collection": "users",
+      "description": "User represents an authenticated identity in the system.",
       "filePath": "/home/runner/work/smrt/smrt/packages/users/src/models/User.ts",
       "packageName": "@happyvertical/smrt-users",
       "fields": {
@@ -9349,5 +9379,18 @@
     "@happyvertical/smrt-profiles",
     "@happyvertical/smrt-tenancy"
   ],
+  "browser": {
+    "status": "server-only",
+    "issues": [
+      "#3617",
+      "#3624",
+      "#3626"
+    ],
+    "reason": "node:crypto/async_hooks; core migrations",
+    "via": [
+      "@happyvertical/smrt-profiles",
+      "@happyvertical/smrt-tenancy"
+    ]
+  },
   "stampsConstructors": true
 }

package/dist/smrt-knowledge.json

@@ -3,12 +3,12 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.55.6",
+  "packageVersion": "0.55.8",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "55faa45af88bf2a500ddd0c04b2180f32ac7082764681af99d512d24a51be65f",
-    "packageJson": "d1918a516acf9ba04e7fd01dcd169787750a644592565af63fd28823ed0c052d",
+    "manifest": "b0ec06af72c1f9aacb73b1f51958531c069e675de3445ca1fd06a844078d60fe",
+    "packageJson": "21f4b89f1145d32b627b3cd7cff30b2f6ef89ad9d862ef84766dfb6dca36152f",
     "agents": "fa1b9005064b329b1d2387cd56307b92a79f2cd4ea951776e687f9850a428335",
     "moduleDoc:agents/permissions.md": "5f6c0afab7e1fd0887b0d29b5a5b5ab2635694207bade70145d3cbfdb62ba78c",
     "moduleDoc:agents/oidc-provisioning.md": "b73f3fdaf61136720132a614c7e14237b7bd35f7bf5d43eabb29f565485803b9",
@@ -82,6 +82,7 @@
       "name": "AccessRequestCollection",
       "qualifiedName": "@happyvertical/smrt-users:AccessRequestCollection",
       "collection": "accessrequests",
+      "description": "Collection for managing AccessRequest objects.",
       "tableName": "access_requests",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -437,6 +438,7 @@
       "name": "GroupCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupCollection",
       "collection": "groups",
+      "description": "Collection for managing Group objects",
       "tableName": "groups",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -517,6 +519,7 @@
       "name": "GroupMemberCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupMemberCollection",
       "collection": "groupmembers",
+      "description": "Collection for managing GroupMember objects",
       "tableName": "group_members",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -774,6 +777,7 @@
       "name": "GroupRoleCollection",
       "qualifiedName": "@happyvertical/smrt-users:GroupRoleCollection",
       "collection": "grouproles",
+      "description": "Collection for managing GroupRole objects",
       "tableName": "group_roles",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -1099,6 +1103,7 @@
       "name": "UsersMagicLinkTokenCollection",
       "qualifiedName": "@happyvertical/smrt-users:UsersMagicLinkTokenCollection",
       "collection": "usersmagiclinktokens",
+      "description": "Collection for managing smrt-users magic link token records",
       "tableName": "users_magic_link_tokens",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -1207,6 +1212,7 @@
       "name": "MembershipCollection",
       "qualifiedName": "@happyvertical/smrt-users:MembershipCollection",
       "collection": "memberships",
+      "description": "Collection for managing Membership objects",
       "tableName": "memberships",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -1432,6 +1438,7 @@
       "name": "MembershipOverrideCollection",
       "qualifiedName": "@happyvertical/smrt-users:MembershipOverrideCollection",
       "collection": "membershipoverrides",
+      "description": "Collection for managing MembershipOverride objects",
       "tableName": "membership_overrides",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -1858,6 +1865,7 @@
       "name": "PermissionCollection",
       "qualifiedName": "@happyvertical/smrt-users:PermissionCollection",
       "collection": "permissions",
+      "description": "Collection for managing Permission objects",
       "tableName": "permissions",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -2176,6 +2184,7 @@
       "name": "RoleCollection",
       "qualifiedName": "@happyvertical/smrt-users:RoleCollection",
       "collection": "roles",
+      "description": "Collection for managing Role objects",
       "tableName": "roles",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -2369,6 +2378,7 @@
       "name": "RolePermissionCollection",
       "qualifiedName": "@happyvertical/smrt-users:RolePermissionCollection",
       "collection": "rolepermissions",
+      "description": "Collection for managing RolePermission objects",
       "tableName": "role_permissions",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -2626,6 +2636,7 @@
       "name": "SessionCollection",
       "qualifiedName": "@happyvertical/smrt-users:SessionCollection",
       "collection": "sessions",
+      "description": "Collection for managing Session objects",
       "tableName": "sessions",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -3092,6 +3103,7 @@
       "name": "TenantCollection",
       "qualifiedName": "@happyvertical/smrt-users:TenantCollection",
       "collection": "tenants",
+      "description": "Collection for managing Tenant objects with hierarchical support.",
       "tableName": "tenants",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -3714,6 +3726,7 @@
       "name": "TenantPermissionOverrideCollection",
       "qualifiedName": "@happyvertical/smrt-users:TenantPermissionOverrideCollection",
       "collection": "tenantpermissionoverrides",
+      "description": "Collection for managing TenantPermissionOverride objects.",
       "tableName": "tenant_permission_overrides",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -4207,6 +4220,7 @@
       "name": "UserCollection",
       "qualifiedName": "@happyvertical/smrt-users:UserCollection",
       "collection": "users",
+      "description": "Collection for managing User objects",
       "tableName": "users",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtCollection",
@@ -4430,6 +4444,7 @@
       "qualifiedName": "@happyvertical/smrt-users:AccessRequest",
       "displayLabelField": "name",
       "collection": "accessrequests",
+      "description": "A prospective user's request for access, captured before they become a User.",
       "tableName": "access_requests",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -4615,6 +4630,7 @@
       "name": "UsersCliAuthApproveLimit",
       "qualifiedName": "@happyvertical/smrt-users:UsersCliAuthApproveLimit",
       "collection": "userscliauthapprovelimits",
+      "description": "Private database arbiter shared by every terminal-auth process.",
       "tableName": "users_cli_auth_approve_limits",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -4760,6 +4776,7 @@
       "qualifiedName": "@happyvertical/smrt-users:Group",
       "displayLabelField": "name",
       "collection": "groups",
+      "description": "Group represents a team or department within a tenant.",
       "tableName": "groups",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -4872,6 +4889,7 @@
       "name": "GroupMember",
       "qualifiedName": "@happyvertical/smrt-users:GroupMember",
       "collection": "groupmembers",
+      "description": "GroupMember is a join table linking Users to Groups.",
       "tableName": "group_members",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -4979,6 +4997,7 @@
       "name": "GroupRole",
       "qualifiedName": "@happyvertical/smrt-users:GroupRole",
       "collection": "grouproles",
+      "description": "GroupRole is a join table linking Groups to Roles.",
       "tableName": "group_roles",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -5086,6 +5105,7 @@
       "name": "UsersLoginAttempt",
       "qualifiedName": "@happyvertical/smrt-users:UsersLoginAttempt",
       "collection": "usersloginattempts",
+      "description": "Private database arbiter shared by every process that authenticates.",
       "tableName": "users_login_attempts",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -5363,6 +5383,7 @@
       "name": "Membership",
       "qualifiedName": "@happyvertical/smrt-users:Membership",
       "collection": "memberships",
+      "description": "Membership represents a user's membership in a tenant with an assigned role.",
       "tableName": "memberships",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -5536,6 +5557,7 @@
       "name": "MembershipOverride",
       "qualifiedName": "@happyvertical/smrt-users:MembershipOverride",
       "collection": "membershipoverrides",
+      "description": "MembershipOverride allows granting or denying specific permissions to a user beyond what their role and groups provide.",
       "tableName": "membership_overrides",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -5751,6 +5773,7 @@
       "qualifiedName": "@happyvertical/smrt-users:Permission",
       "displayLabelField": "name",
       "collection": "permissions",
+      "description": "Permission represents a named capability in the system.",
       "tableName": "permissions",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -5986,6 +6009,7 @@
       "name": "ResourceGrant",
       "qualifiedName": "@happyvertical/smrt-users:ResourceGrant",
       "collection": "resourcegrants",
+      "description": "An exact tenant/resource/user/permission decision. This deliberately does not replace tenant RBAC: ResourceGrantResolver only allows after the normal operation guard has allowed the same permission.",
       "tableName": "resource_grants",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -6150,6 +6174,7 @@
       "qualifiedName": "@happyvertical/smrt-users:Role",
       "displayLabelField": "name",
       "collection": "roles",
+      "description": "Role represents a permission template that can be assigned to users.",
       "tableName": "roles",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -6341,6 +6366,7 @@
       "name": "RolePermission",
       "qualifiedName": "@happyvertical/smrt-users:RolePermission",
       "collection": "rolepermissions",
+      "description": "RolePermission is a join table linking Roles to Permissions.",
       "tableName": "role_permissions",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -6452,6 +6478,7 @@
       "name": "Session",
       "qualifiedName": "@happyvertical/smrt-users:Session",
       "collection": "sessions",
+      "description": "Session represents an authenticated user session.",
       "tableName": "sessions",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -6894,6 +6921,7 @@
       "qualifiedName": "@happyvertical/smrt-users:Tenant",
       "displayLabelField": "name",
       "collection": "tenants",
+      "description": "Tenant represents an organizational boundary in the multi-tenant system.",
       "tableName": "tenants",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -7467,6 +7495,7 @@
       "name": "TenantPermissionOverride",
       "qualifiedName": "@happyvertical/smrt-users:TenantPermissionOverride",
       "collection": "tenantpermissionoverrides",
+      "description": "TenantPermissionOverride allows setting explicit permission values at the tenant level.",
       "tableName": "tenant_permission_overrides",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -7662,6 +7691,7 @@
       "name": "User",
       "qualifiedName": "@happyvertical/smrt-users:User",
       "collection": "users",
+      "description": "User represents an authenticated identity in the system.",
       "tableName": "users",
       "packageName": "@happyvertical/smrt-users",
       "extends": "SmrtObject",
@@ -11492,5 +11522,18 @@
       "module": "retention",
       "content": "# smrt-users/credential retention\n\nModule semantics for `src/retention.ts` and the three `deleteExpired()` paths\nit drives. Package orientation, the permission model, and the security rules\nthat apply before editing anything live in [../AGENTS.md](../AGENTS.md) — read\nthat first.\n\n## Credential retention (#2375)\n\n`SessionCollection.deleteExpired()`,\n`UsersMagicLinkTokenCollection.deleteExpired()` and\n`UsersCliAuthRequestCollection.deleteExpired()` all existed, and all waited for\nan application to remember to call them. Expired credential rows are the worst\nkind of unbounded growth: worthless the moment they expire, and exactly the\nrows an attacker would like to still find in the table.\n\n`src/retention.ts` contributes the three to the framework retention sweep in\n`@happyvertical/smrt-core`, so `smrt db:prune` and a running jobs `TaskRunner`\nreap them.\n\n- **The entry point registers on import.** `src/index.ts` calls\n  `registerUserRetentionTasks()`, so any process that loaded this package\n  contributes the tasks — including `smrt db:prune`, which imports the package\n  optionally for exactly that reason. Registering is not scheduling: nothing is\n  deleted until something runs a sweep.\n- **Task names** are `users-sessions`, `users-magic-link-tokens`,\n  `users-cli-auth-requests`, `users-login-attempts`, `users-login-audit-events`\n  — prefixed with the package's short name because the retention registry is\n  one process-global namespace. Opt one out with\n  `runRetentionSweep(db, { tasks: { 'users-sessions': false } })` or\n  `smrt db:prune --skip users-sessions`; `unregisterUserRetentionTasks()`\n  removes all of them.\n- **The credential tasks have no retention window to configure.** An expired\n  credential has nothing worth retaining, so each deletes only already-expired\n  rows. An application that keeps expired sessions for audit should opt the\n  task out and archive them itself. The two #3273 tasks differ: limiter rows\n  are pruned once past their own `retain_until` — written by the limiter from\n  its configured window and streak-forgiveness horizon, so a custom-configured\n  limiter is never swept early — and never while a lockout is live; audit\n  events are pruned after\n  `DEFAULT_LOGIN_AUDIT_RETENTION_DAYS` (90). A host that needs longer audit\n  retention opts `users-login-audit-events` out and archives.\n- **All three are a single counted DELETE**, not a hydrate-and-delete loop.\n  They now run unattended on a timer, and a per-row delete that throws part-way\n  leaves the rest of the expired rows un-reaped — the #1400 reasoning that\n  already applied to sessions, now applied to the other two. Counting first\n  also gives a usable figure where `rowCount` is not populated, and is what\n  makes `{ dryRun }` preview the same predicate rather than an estimate. The\n  count and the delete are not one transaction, so the figure is approximate\n  under concurrent writers.\n- **`expiresAt` is `@field({ indexed: true })`** on `Session`,\n  `UsersMagicLinkToken` and `UsersCliAuthRequest`: the prune predicate scans\n  that column on every pass.\n- **CLI bearer handoff is single-use.** An approved request becomes `consumed`\n  and clears its `sessionId` when one poller wins the exchange. The CLI\n  retention task deletes pending requests past their TTL, requests already\n  marked `expired` by lazy expiry, and consumed history; it retains approved\n  requests until exchange so a near-expiry approval cannot orphan its bearer\n  session.\n"
     }
-  ]
+  ],
+  "browser": {
+    "status": "server-only",
+    "issues": [
+      "#3617",
+      "#3624",
+      "#3626"
+    ],
+    "reason": "node:crypto/async_hooks; core migrations",
+    "via": [
+      "@happyvertical/smrt-profiles",
+      "@happyvertical/smrt-tenancy"
+    ]
+  }
 }

package/dist/sveltekit.js

@@ -1,4 +1,4 @@
-import { A as readMobileBearerToken, D as withSessionPermissionContext, F as encodeOidcTransaction, H as DeviceCredentialForbiddenError, I as getUsersOidcConfig, L as resolveOidcProviderConfig, M as OidcLoginError, N as OidcLoginService, O as MobileAuthError, P as decodeOidcTransaction, U as DeviceCredentialPolicyError, V as DeviceCredentialError, W as DeviceCredentialService, Y as SessionService, _ as PasswordCredentialService, a as TerminalAuthError, at as LoginRateLimitError, b as OperationPermissionError, g as PasswordCredentialForbiddenError, h as PasswordCredentialError, j as validateMobileRedirectUri, k as MobileAuthService, o as TerminalAuthRateLimitError, s as TerminalAuthService, v as PasswordPolicyError } from "./chunks/TerminalAuthService-B89-bMKw.js";
+import { A as readMobileBearerToken, D as withSessionPermissionContext, F as encodeOidcTransaction, H as DeviceCredentialForbiddenError, I as getUsersOidcConfig, L as resolveOidcProviderConfig, M as OidcLoginError, N as OidcLoginService, O as MobileAuthError, P as decodeOidcTransaction, U as DeviceCredentialPolicyError, V as DeviceCredentialError, W as DeviceCredentialService, Y as SessionService, _ as PasswordCredentialService, a as TerminalAuthError, at as LoginRateLimitError, b as OperationPermissionError, g as PasswordCredentialForbiddenError, h as PasswordCredentialError, j as validateMobileRedirectUri, k as MobileAuthService, o as TerminalAuthRateLimitError, s as TerminalAuthService, v as PasswordPolicyError } from "./chunks/TerminalAuthService-CNYOmaaa.js";
 import { DiscoveryArtifactValidationError, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, canonicalizeDiscoveryArtifact, createDiscoveryConformanceArtifact, deriveCommandRequirements, validateDiscoveryConformanceArtifact } from "./app-contract.js";
 import { ObjectRegistry, createClassNamePredicate, resolveCustomActionMetadata, resolveEffectiveActionMetadata } from "@happyvertical/smrt-core";
 import { createLogger } from "@happyvertical/logger";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-users",
-  "version": "0.55.6",
+  "version": "0.55.8",
   "smrtJsdoc": "strict",
   "description": "Multi-tenant user management for the SMRT framework - users, tenants, roles, permissions, groups",
   "type": "module",
@@ -47,19 +47,19 @@
     }
   },
   "dependencies": {
-    "@happyvertical/logger": "^0.102.4",
-    "@happyvertical/smrt-config": "0.55.6",
-    "@happyvertical/smrt-core": "0.55.6",
-    "@happyvertical/smrt-mobile-contract": "0.55.6",
-    "@happyvertical/smrt-profiles": "0.55.6",
-    "@happyvertical/smrt-tenancy": "0.55.6",
-    "@happyvertical/smrt-types": "0.55.6",
-    "@happyvertical/smrt-ui": "0.55.6",
-    "@happyvertical/sql": "^0.102.4",
+    "@happyvertical/logger": "^0.103.1",
+    "@happyvertical/smrt-config": "0.55.8",
+    "@happyvertical/smrt-core": "0.55.8",
+    "@happyvertical/smrt-mobile-contract": "0.55.8",
+    "@happyvertical/smrt-profiles": "0.55.8",
+    "@happyvertical/smrt-tenancy": "0.55.8",
+    "@happyvertical/smrt-types": "0.55.8",
+    "@happyvertical/smrt-ui": "0.55.8",
+    "@happyvertical/sql": "^0.103.1",
     "jose": "^6.2.12"
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.55.6",
+    "@happyvertical/smrt-vitest": "0.55.8",
     "@sveltejs/package": "^2.5.8",
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
     "@types/node": "24.13.6",