@happyvertical/smrt-users 0.55.9 → 0.55.10

package/README.md

@@ -10,6 +10,48 @@ pnpm add @happyvertical/smrt-users
 
 ## Usage
 
+### Auth component adapter
+
+The `@happyvertical/smrt-users/svelte` authentication components take a
+`UsersAuthAdapter`. Bind each callback to an application server action; the
+components never receive a session bearer, API-key value, magic-link signing
+secret, or OIDC client secret. On the server, password actions use
+`createPasswordCredentialHandlers()`, magic-link actions use
+`MagicLinkService`, and OIDC actions use `OidcLoginService`. Session and API
+key revoke actions must verify the current account owns the selected record
+before calling `SessionService.destroySession()` or the profile API-key
+service. Passkey sign-in is deliberately hidden unless the host passes a
+`passkeyCeremony` callback to `createUsersAuthAdapter()`. An endpoint alone
+cannot enable it: the callback must perform the #3275 WebAuthn browser ceremony
+and delegate its verified result to an authorized server action.
+
+Auth components display safe, registered `users.auth.*` messages when an
+adapter rejects; callback diagnostics are never rendered. Configure these
+messages through the s-m-r-t UI i18n context. Existing error and success feedback
+updates when the locale changes, preserving form drafts without repeating the
+auth action. Default English messages are registered by the auth module.
+
+```svelte
+<script lang="ts">
+  import { SignInForm, type UsersAuthAdapter } from '@happyvertical/smrt-users/svelte';
+
+  const adapter: UsersAuthAdapter = {
+    async signInWithPassword({ email, password }) {
+      await fetch('/auth/password/sign-in', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ email, password }),
+      });
+    },
+  };
+</script>
+
+<SignInForm {adapter} />
+```
+
+The endpoint in this example is application-owned. It must call the package
+handler/service on the server; it is not a generated public identity API.
+
 ### Application discovery conformance
 
 The SvelteKit `createResourceListHandler()` export produces the app CLI

package/agents/permissions.md

@@ -101,6 +101,9 @@ membership or tenant DENY to attenuate inherited role authority.
 - When a package adds built-in self-personalization permissions after role
   creation, explicitly call seedDefaultRolePersonalizationPermissions(). It
   upgrades owner/admin/member/viewer idempotently and never grants custom roles.
+  The built-in self-personalization slugs are `fields.policy.personalize`,
+  `overviews.personalize` and `shell.personalize`, each seeded only once its
+  package registered it.
 
 ## Guards and RLS