@happyvertical/smrt-users 0.57.6 → 0.57.8

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as PermissionResolver, $t as GroupCollection, A as withSessionPermissionContext, At as recordTenantHierarchyChanges, B as resolveOidcProviderConfig, Bt as RoleCollection, C as OperationPermissionError, Ct as TenantCollection, D as getCurrentSessionPermissionContext, Dt as applyTenantHierarchyUpdates, E as hasOperationPermission, Et as TenantHierarchyError, F as OidcLoginError, Ft as deriveOperationPermissionSlug, G as DeviceCredentialForbiddenError, Gt as UsersPasswordCredential, H as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, Ht as UsersPinCredential, I as OidcLoginService, It as normalizeOperationPermissionAction, J as PIN_LOGIN_KIND, Jt as MembershipCollection, K as DeviceCredentialPolicyError, Kt as MembershipOverrideCollection, L as decodeOidcTransaction, Lt as registerPermissionDefinitions, M as MobileAuthService, Mt as RolePermissionCollection, N as readMobileBearerToken, Nt as PermissionCatalogService, O as getRequestScopedDatabase, Ot as assertTenantTableName, P as validateMobileRedirectUri, Pt as deriveOperationPermissionCollectionName, Q as SessionService, Qt as GroupMember, R as encodeOidcTransaction, Rt as syncPermissionCatalog, S as outOfBandProofSessionData, St as TenantPermissionOverride, T as checkOperationPermission, Tt as MAX_TENANT_HIERARCHY_DEPTH, U as DEFAULT_PIN_MANAGE_PERMISSION, Ut as PermissionCollection, Vt as UsersPinCredentialCollection, W as DeviceCredentialError, Wt as UsersPasswordCredentialCollection, X as PinVerifier, Xt as GroupRole, Y as PIN_PERMISSION_DEFINITIONS, Yt as GroupRoleCollection, Z as ensurePinPermissionsRegistered, Zt as GroupMemberCollection, _ as PasswordCredentialError, _n as Membership, _t as UserCollection, a as TerminalAuthError, an as UsersCliAuthRequestCollection, at as DEFAULT_SOURCE_LOCKOUT_AUDIT_SECONDS, b as PasswordPolicyError, bt as backfillUserEmailKeys, c as DEFAULT_PASSWORD_DENYLIST, cn as User, ct as LoginAttemptLimiter, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as DEFAULT_SESSION_TTL, dt as ANCESTOR_READ_ACTION, en as Group, et as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, f as DEFAULT_PASSWORD_RECOVERY_MAX_AGE_SECONDS, fn as SESSION_DATA_KEYS, ft as DEFAULT_ANCESTOR_READ_MAX_DEPTH, g as PASSWORD_RECOVERY_MAX_AGE_CEILING_SECONDS, gn as Permission, gt as OidcProvisioningError, h as PASSWORD_PERMISSION_DEFINITIONS, hn as Role, ht as normalizeAncestorReadPolicy, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAttempt, it as DEFAULT_LOGIN_MAX_ATTEMPTS, j as MobileAuthError, jt as DEFAULT_ROLE_PERMISSION_PATTERNS, k as withPrincipalPermissionContext, kt as planTenantHierarchy, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as isValidEmail, lt as LoginRateLimitError, m as PASSWORD_MAX_LENGTH_CEILING, mn as generateSessionId, mt as isAncestorReadableSlug, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as UsersLoginAuditEvent, nt as DEFAULT_LOGIN_LOCKOUT_FACTOR, o as TerminalAuthRateLimitError, on as SessionCollection, ot as DurableLoginAuditSink, p as PASSWORD_LOGIN_KIND, pn as Session, pt as getConfiguredAncestorReadPolicy, q as DeviceCredentialService, qt as MembershipOverride, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAttemptCollection, rt as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, s as TerminalAuthService, sn as UsersCliAuthRequest, st as InvalidCredentialsError, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as UsersLoginAuditEventCollection, tt as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as normalizeEmail, ut as withoutListBounds, v as PasswordCredentialForbiddenError, w as assertOperationPermission, wt as Tenant, x as ensurePasswordPermissionsRegistered, xt as TenantPermissionOverrideCollection, y as PasswordCredentialService, yt as UserEmailKeyBackfillError, z as getUsersOidcConfig, zt as RolePermission } from "./chunks/TerminalAuthService-BqdDnJ4T.js";
+import { $ as PermissionResolver, $t as GroupCollection, A as withSessionPermissionContext, At as recordTenantHierarchyChanges, B as resolveOidcProviderConfig, Bt as RoleCollection, C as OperationPermissionError, Ct as TenantCollection, D as getCurrentSessionPermissionContext, Dt as applyTenantHierarchyUpdates, E as hasOperationPermission, Et as TenantHierarchyError, F as OidcLoginError, Ft as deriveOperationPermissionSlug, G as DeviceCredentialForbiddenError, Gt as UsersPasswordCredential, H as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, Ht as UsersPinCredential, I as OidcLoginService, It as normalizeOperationPermissionAction, J as PIN_LOGIN_KIND, Jt as MembershipCollection, K as DeviceCredentialPolicyError, Kt as MembershipOverrideCollection, L as decodeOidcTransaction, Lt as registerPermissionDefinitions, M as MobileAuthService, Mt as RolePermissionCollection, N as readMobileBearerToken, Nt as PermissionCatalogService, O as getRequestScopedDatabase, Ot as assertTenantTableName, P as validateMobileRedirectUri, Pt as deriveOperationPermissionCollectionName, Q as SessionService, Qt as GroupMember, R as encodeOidcTransaction, Rt as syncPermissionCatalog, S as outOfBandProofSessionData, St as TenantPermissionOverride, T as checkOperationPermission, Tt as MAX_TENANT_HIERARCHY_DEPTH, U as DEFAULT_PIN_MANAGE_PERMISSION, Ut as PermissionCollection, Vt as UsersPinCredentialCollection, W as DeviceCredentialError, Wt as UsersPasswordCredentialCollection, X as PinVerifier, Xt as GroupRole, Y as PIN_PERMISSION_DEFINITIONS, Yt as GroupRoleCollection, Z as ensurePinPermissionsRegistered, Zt as GroupMemberCollection, _ as PasswordCredentialError, _n as Membership, _t as UserCollection, a as TerminalAuthError, an as UsersCliAuthRequestCollection, at as DEFAULT_SOURCE_LOCKOUT_AUDIT_SECONDS, b as PasswordPolicyError, bt as backfillUserEmailKeys, c as DEFAULT_PASSWORD_DENYLIST, cn as User, ct as LoginAttemptLimiter, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as DEFAULT_SESSION_TTL, dt as ANCESTOR_READ_ACTION, en as Group, et as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, f as DEFAULT_PASSWORD_RECOVERY_MAX_AGE_SECONDS, fn as SESSION_DATA_KEYS, ft as DEFAULT_ANCESTOR_READ_MAX_DEPTH, g as PASSWORD_RECOVERY_MAX_AGE_CEILING_SECONDS, gn as Permission, gt as OidcProvisioningError, h as PASSWORD_PERMISSION_DEFINITIONS, hn as Role, ht as normalizeAncestorReadPolicy, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAttempt, it as DEFAULT_LOGIN_MAX_ATTEMPTS, j as MobileAuthError, jt as DEFAULT_ROLE_PERMISSION_PATTERNS, k as withPrincipalPermissionContext, kt as planTenantHierarchy, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as isValidEmail, lt as LoginRateLimitError, m as PASSWORD_MAX_LENGTH_CEILING, mn as generateSessionId, mt as isAncestorReadableSlug, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as UsersLoginAuditEvent, nt as DEFAULT_LOGIN_LOCKOUT_FACTOR, o as TerminalAuthRateLimitError, on as SessionCollection, ot as DurableLoginAuditSink, p as PASSWORD_LOGIN_KIND, pn as Session, pt as getConfiguredAncestorReadPolicy, q as DeviceCredentialService, qt as MembershipOverride, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAttemptCollection, rt as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, s as TerminalAuthService, sn as UsersCliAuthRequest, st as InvalidCredentialsError, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as UsersLoginAuditEventCollection, tt as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as normalizeEmail, ut as withoutListBounds, v as PasswordCredentialForbiddenError, w as assertOperationPermission, wt as Tenant, x as ensurePasswordPermissionsRegistered, xt as TenantPermissionOverrideCollection, y as PasswordCredentialService, yt as UserEmailKeyBackfillError, z as getUsersOidcConfig, zt as RolePermission } from "./chunks/TerminalAuthService-BpRwohDW.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, SmrtRecipe, bumpChangeFeed, crossPackageRef, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
 import { TenantScoped, getTenantId, tenantId, withSystemContext, withTenant, withTenantGlobalRead } from "@happyvertical/smrt-tenancy";
@@ -2552,7 +2552,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-BqdDnJ4T.js").then((n) => n.V);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-BpRwohDW.js").then((n) => n.V);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -2581,7 +2581,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-BqdDnJ4T.js").then((n) => n.V);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-BpRwohDW.js").then((n) => n.V);
 		const key = await this.getSigningKey();
 		let payload;
 		try {

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.57.6",
+  "packageVersion": "0.57.8",
   "objects": {
     "@happyvertical/smrt-users:AccessRequestCollection": {
       "name": "accessrequestcollection",
@@ -6018,7 +6018,7 @@
       "collectionExportName": "UserCollectionCollection",
       "schema": {
         "tableName": "users",
-        "ddl": "CREATE TABLE IF NOT EXISTS \"users\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"profile_id\" UUID UNIQUE,\n  \"email\" TEXT DEFAULT '',\n  \"email_key\" TEXT UNIQUE,\n  \"status\" TEXT,\n  \"last_login_at\" TIMESTAMP\n);",
+        "ddl": "CREATE TABLE IF NOT EXISTS \"users\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"profile_id\" UUID UNIQUE,\n  \"email\" TEXT DEFAULT '',\n  \"email_key\" TEXT UNIQUE,\n  \"username\" TEXT,\n  \"username_key\" TEXT UNIQUE,\n  \"status\" TEXT,\n  \"last_login_at\" TIMESTAMP\n);",
         "columns": {
           "id": {
             "type": "UUID",
@@ -6062,6 +6062,16 @@
             "notNull": false,
             "unique": true
           },
+          "username": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false
+          },
+          "username_key": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": true
+          },
           "status": {
             "type": "TEXT",
             "notNull": false,
@@ -6088,6 +6098,12 @@
               "email"
             ]
           },
+          {
+            "name": "users_username_idx",
+            "columns": [
+              "username"
+            ]
+          },
           {
             "name": "users_created_at_idx",
             "columns": [
@@ -6095,7 +6111,7 @@
             ]
           }
         ],
-        "version": "38fd1677"
+        "version": "3ee8f0f4"
       },
       "importPath": "@happyvertical/smrt-users"
     },
@@ -13991,6 +14007,28 @@
           },
           "readonly": true
         },
+        "username": {
+          "type": "text",
+          "required": false,
+          "description": "Optional username used to sign in; lowercase and globally unique.",
+          "_meta": {
+            "description": "Optional username used to sign in; lowercase and globally unique.",
+            "nullable": true,
+            "indexed": true
+          }
+        },
+        "usernameKey": {
+          "type": "text",
+          "required": false,
+          "description": "The standardized username used to recognize this account; maintained automatically.",
+          "_meta": {
+            "description": "The standardized username used to recognize this account; maintained automatically.",
+            "nullable": true,
+            "unique": true,
+            "readonly": true
+          },
+          "readonly": true
+        },
         "status": {
           "type": "text",
           "required": false,
@@ -14083,7 +14121,7 @@
       "collectionExportName": "UserCollection",
       "schema": {
         "tableName": "users",
-        "ddl": "CREATE TABLE IF NOT EXISTS \"users\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"profile_id\" UUID UNIQUE,\n  \"email\" TEXT DEFAULT '',\n  \"email_key\" TEXT UNIQUE,\n  \"status\" TEXT,\n  \"last_login_at\" TIMESTAMP\n);",
+        "ddl": "CREATE TABLE IF NOT EXISTS \"users\" (\n  \"id\" UUID PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"profile_id\" UUID UNIQUE,\n  \"email\" TEXT DEFAULT '',\n  \"email_key\" TEXT UNIQUE,\n  \"username\" TEXT,\n  \"username_key\" TEXT UNIQUE,\n  \"status\" TEXT,\n  \"last_login_at\" TIMESTAMP\n);",
         "columns": {
           "id": {
             "type": "UUID",
@@ -14127,6 +14165,16 @@
             "notNull": false,
             "unique": true
           },
+          "username": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": false
+          },
+          "username_key": {
+            "type": "TEXT",
+            "notNull": false,
+            "unique": true
+          },
           "status": {
             "type": "TEXT",
             "notNull": false,
@@ -14153,6 +14201,12 @@
               "email"
             ]
           },
+          {
+            "name": "users_username_idx",
+            "columns": [
+              "username"
+            ]
+          },
           {
             "name": "users_created_at_idx",
             "columns": [
@@ -14160,7 +14214,7 @@
             ]
           }
         ],
-        "version": "38fd1677"
+        "version": "3ee8f0f4"
       },
       "importPath": "@happyvertical/smrt-users"
     }

package/dist/models/User.d.ts

@@ -11,6 +11,7 @@ import { UserStatus } from '../types/index.js';
 export interface UserOptions extends SmrtObjectOptions {
     profileId?: string;
     email?: string;
+    username?: string | null;
     status?: UserStatus;
     lastLoginAt?: Date | null;
 }
@@ -26,6 +27,8 @@ export declare function isValidEmail(email: string): boolean;
  * @returns Normalized email
  */
 export declare function normalizeEmail(email: string): string;
+/** Normalize a username into its globally unique login identity. */
+export declare function normalizeUsername(username: string | null | undefined): string;
 /**
  * User represents an authenticated identity in the system.
  *
@@ -59,6 +62,10 @@ export declare class User extends SmrtObject implements UserContract {
     email: string;
     /** Durable normalized key for cross-connection email uniqueness. */
     emailKey: string | null;
+    /** Optional globally unique username login identity. */
+    username: string | null;
+    /** Durable canonical username key used for cross-connection uniqueness. */
+    usernameKey: string | null;
     /**
      * User account status
      */

package/dist/models/User.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../src/models/User.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,WAAY,SAAQ,iBAAiB;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC3B;AAQD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAQa,IAAK,SAAQ,UAAW,YAAW,YAAY;IAC1D;;OAEG;IAGH,SAAS,EAAE,MAAM,CAAM;IAEvB;;;;;;;;OAQG;IAKH,KAAK,EAAE,MAAM,CAAM;IAEnB,oEAAoE;IASpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE/B;;OAEG;IAMH,MAAM,EAAE,UAAU,CAAqB;IAEvC;;OAEG;IAEH,WAAW,EAAE,IAAI,GAAG,IAAI,CAAQ;gBAEpB,OAAO,GAAE,WAAgB;IASrC;;;OAGG;IACH,aAAa,IAAI,OAAO;IAIxB;;OAEG;IACH,QAAQ,IAAI,OAAO;IAInB;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,WAAW,IAAI,IAAI;IAInB,sEAAsE;IACvD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAKrC"}
+{"version":3,"file":"User.d.ts","sourceRoot":"","sources":["../../src/models/User.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,WAAY,SAAQ,iBAAiB;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC3B;AASD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAI7E;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAQa,IAAK,SAAQ,UAAW,YAAW,YAAY;IAC1D;;OAEG;IAGH,SAAS,EAAE,MAAM,CAAM;IAEvB;;;;;;;;OAQG;IAKH,KAAK,EAAE,MAAM,CAAM;IAEnB,oEAAoE;IASpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE/B,wDAAwD;IAQxD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE/B,2EAA2E;IAS3E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAQ;IAElC;;OAEG;IAMH,MAAM,EAAE,UAAU,CAAqB;IAEvC;;OAEG;IAEH,WAAW,EAAE,IAAI,GAAG,IAAI,CAAQ;gBAEpB,OAAO,GAAE,WAAgB;IAWrC;;;OAGG;IACH,aAAa,IAAI,OAAO;IAIxB;;OAEG;IACH,QAAQ,IAAI,OAAO;IAInB;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,WAAW,IAAI,IAAI;IAInB,sEAAsE;IACvD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAOrC"}

package/dist/services/PasswordCredentialService.d.ts

@@ -98,6 +98,8 @@ export interface PasswordPolicyContext {
     userId: string;
     /** Their normalized email, when they have one. */
     email: string | null;
+    /** Their canonical username, when they have one. */
+    username: string | null;
 }
 export interface PasswordPolicyOptions {
     /** Minimum length in characters (Unicode code points, after NFKC). Default 10. */
@@ -196,7 +198,7 @@ export interface PasswordCredentialServiceOptions extends SmrtClassOptions {
     recovery?: PasswordRecoveryOptions;
 }
 export interface PasswordSignInInput {
-    /** What the person typed as their email; normalized like `User.emailKey`. */
+    /** What the person typed as an email or username. */
     identifier: string;
     password: string;
     /**
@@ -204,7 +206,7 @@ export interface PasswordSignInInput {
      * in it; when null/omitted the session carries no tenant context (and so
      * no tenant permissions) until `switchSessionTenant`.
      */
-    tenantId?: string | null;
+    tenantId?: string | null | 'unique-active-membership';
     ipAddress?: string;
     userAgent?: string;
     /**
@@ -350,7 +352,14 @@ export declare class PasswordCredentialService {
      * {@link PasswordPolicyError}.
      */
     validatePassword(password: string, userId: string): Promise<void>;
-    private findUserByEmailKey;
+    private findUserByIdentity;
+    /**
+     * Select a tenant only when a password-authenticated person has exactly one
+     * active direct membership. This is resolved after credential verification:
+     * callers never need a tenant locator before sign-in, and ambiguity cannot
+     * turn a successful password check into an unscoped session.
+     */
+    private resolveUniqueActiveMembershipTenant;
     private requireUser;
     /**
      * Prove the current password for a self-service change or clear, through

package/dist/services/PasswordCredentialService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordCredentialService.d.ts","sourceRoot":"","sources":["../../src/services/PasswordCredentialService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAGH,OAAO,EAEL,KAAK,gBAAgB,EAEtB,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAIL,KAAK,YAAY,EAGlB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,0BAA0B,EAEhC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAE1E,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAC9C,qFAAqF;AACrF,eAAO,MAAM,kCAAkC,0BAA0B,CAAC;AAC1E,sDAAsD;AACtD,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,sDAAsD;AACtD,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,8EAA8E;AAC9E,eAAO,MAAM,yCAAyC,QAAU,CAAC;AACjE,iFAAiF;AACjF,eAAO,MAAM,yCAAyC,QAAU,CAAC;AAWjE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAwBrD,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,+BAA+B,EAAE,oBAAoB,EAOjE,CAAC;AAIF,iFAAiF;AACjF,wBAAgB,mCAAmC,IAAI,IAAI,CAI1D;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,uBAAuB;gBACtD,OAAO,SAAyB;CAI7C;AAED,mFAAmF;AACnF,qBAAa,gCAAiC,SAAQ,KAAK;gBAC7C,OAAO,SAA2C;CAI/D;AAED,qEAAqE;AACrE,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,CACP,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,qBAAqB,KAC3B,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACpE;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,GAAE,IAAiB,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKxB;AAED,mDAAmD;AACnD,MAAM,WAAW,4BAA4B;IAC3C,wFAAwF;IACxF,KAAK,EAAE,cAAc,CAAC;IACtB,qEAAqE;IACrE,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,WAAW,CAAC,EAAE,CACZ,OAAO,EAAE,4BAA4B,KAClC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,gCAAiC,SAAQ,gBAAgB;IACxE,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,IAAI,CAAC,0BAA0B,EAAE,MAAM,gBAAgB,CAAC,CAAC;IACnE,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,KAAK,EAAE,cAAc,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B;IAC5C,oEAAoE;IACpE,KAAK,EAAE,cAAc,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkBD,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAOrB;IACF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAIhB;IACT,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,KAAK,CAAkB;IAC/B,OAAO,CAAC,WAAW,CAAqC;IACxD,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,SAAS,CAAU;gBAEf,OAAO,EAAE,gCAAgC;IAqDrD,OAAO,CAAC,MAAM,CAAC,eAAe;WA0CjB,MAAM,CACjB,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,yBAAyB,CAAC;IAM/B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BjC,8CAA8C;IAC9C,IAAI,YAAY,IAAI,mBAAmB,CAEtC;IAMD;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmJvE;;;;;;;OAOG;IACG,WAAW,CACf,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IA8CvC;;;;;OAKG;IACG,cAAc,CAClB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,OAAO,CAAA;KAAE,CAAC;IA8CrE;;;;OAIG;IACG,aAAa,CACjB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAoCvC;;;;OAIG;IACG,aAAa,CACjB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAwCvC;;;;;;;;;;;;OAYG;IACG,wBAAwB,CAC5B,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,IAAI,CAAA;KAAE,CAAC;IAkHlE,sFAAsF;IAChF,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKnD;;;;OAIG;IACG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAQzD,kBAAkB;YAKlB,WAAW;IAQzB;;;;OAIG;YACW,aAAa;IAqC3B,OAAO,CAAC,gBAAgB;YAQV,eAAe;IA8B7B,sFAAsF;YACxE,YAAY;IAoC1B,OAAO,CAAC,YAAY;IAIpB;;;;;;;OAOG;YACW,eAAe;IAU7B;;;;;OAKG;YACW,mBAAmB;YAwBnB,gBAAgB;CAY/B"}
+{"version":3,"file":"PasswordCredentialService.d.ts","sourceRoot":"","sources":["../../src/services/PasswordCredentialService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAGH,OAAO,EAEL,KAAK,gBAAgB,EAEtB,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,EAIL,KAAK,YAAY,EAGlB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,0BAA0B,EAEhC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AAE1E,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAC9C,qFAAqF;AACrF,eAAO,MAAM,kCAAkC,0BAA0B,CAAC;AAC1E,sDAAsD;AACtD,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,sDAAsD;AACtD,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,8EAA8E;AAC9E,eAAO,MAAM,yCAAyC,QAAU,CAAC;AACjE,iFAAiF;AACjF,eAAO,MAAM,yCAAyC,QAAU,CAAC;AA8BjE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAwBrD,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,+BAA+B,EAAE,oBAAoB,EAOjE,CAAC;AAIF,iFAAiF;AACjF,wBAAgB,mCAAmC,IAAI,IAAI,CAI1D;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,uBAAuB;gBACtD,OAAO,SAAyB;CAI7C;AAED,mFAAmF;AACnF,qBAAa,gCAAiC,SAAQ,KAAK;gBAC7C,OAAO,SAA2C;CAI/D;AAED,qEAAqE;AACrE,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,CACP,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,qBAAqB,KAC3B,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACpE;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,GAAE,IAAiB,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKxB;AAED,mDAAmD;AACnD,MAAM,WAAW,4BAA4B;IAC3C,wFAAwF;IACxF,KAAK,EAAE,cAAc,CAAC;IACtB,qEAAqE;IACrE,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,WAAW,CAAC,EAAE,CACZ,OAAO,EAAE,4BAA4B,KAClC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,gCAAiC,SAAQ,gBAAgB;IACxE,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,IAAI,CAAC,0BAA0B,EAAE,MAAM,gBAAgB,CAAC,CAAC;IACnE,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,0BAA0B,CAAC;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,KAAK,EAAE,cAAc,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B;IAC5C,oEAAoE;IACpE,KAAK,EAAE,cAAc,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkBD,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAOrB;IACF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAIhB;IACT,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,KAAK,CAAkB;IAC/B,OAAO,CAAC,WAAW,CAAqC;IACxD,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,SAAS,CAAU;gBAEf,OAAO,EAAE,gCAAgC;IAqDrD,OAAO,CAAC,MAAM,CAAC,eAAe;WA0CjB,MAAM,CACjB,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,yBAAyB,CAAC;IAM/B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BjC,8CAA8C;IAC9C,IAAI,YAAY,IAAI,mBAAmB,CAEtC;IAMD;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgKvE;;;;;;;OAOG;IACG,WAAW,CACf,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IA8CvC;;;;;OAKG;IACG,cAAc,CAClB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,OAAO,CAAA;KAAE,CAAC;IA8CrE;;;;OAIG;IACG,aAAa,CACjB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAoCvC;;;;OAIG;IACG,aAAa,CACjB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAwCvC;;;;;;;;;;;;OAYG;IACG,wBAAwB,CAC5B,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,IAAI,CAAA;KAAE,CAAC;IAkHlE,sFAAsF;IAChF,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKnD;;;;OAIG;IACG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAQzD,kBAAkB;IAahC;;;;;OAKG;YACW,mCAAmC;YAWnC,WAAW;IAQzB;;;;OAIG;YACW,aAAa;IAqC3B,OAAO,CAAC,gBAAgB;YAQV,eAAe;IA8B7B,sFAAsF;YACxE,YAAY;IA0C1B,OAAO,CAAC,YAAY;IAIpB;;;;;;;OAOG;YACW,eAAe;IAU7B;;;;;OAKG;YACW,mBAAmB;YAwBnB,gBAAgB;CAY/B"}

package/dist/smrt-knowledge.json

@@ -3,12 +3,12 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.57.6",
+  "packageVersion": "0.57.8",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "86561cc96aaa8ebf11f23cc4a8245d1a8460775db8577d66c3456d4ca3aa9867",
-    "packageJson": "99b5503dbc612740491b60a5d6281e7992bbc1ecb38c661716f6748e95a9100d",
+    "manifest": "6c9cbd0e9c74b8343090b38a49a93f94540f8dac86209264a4a9a484e0f14d1f",
+    "packageJson": "ac6df029fa84df8047004537889d034b050ea8beb97c99fc16f0b78b88eebb2e",
     "agents": "c4ab6a1aae24c0fb687d4d02ef25dcb5e6942ad7e8318e9d0dd8d03d5750b788",
     "moduleDoc:agents/permissions.md": "02b2f03f0e057721369d9c693a624a6fdb3df4935401531a4373ff18229a64be",
     "moduleDoc:agents/oidc-provisioning.md": "b73f3fdaf61136720132a614c7e14237b7bd35f7bf5d43eabb29f565485803b9",
@@ -7105,6 +7105,21 @@
           "readonly": true,
           "description": "The standardized email address used to recognize this account; maintained automatically."
         },
+        {
+          "name": "username",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT",
+          "description": "Optional username used to sign in; lowercase and globally unique."
+        },
+        {
+          "name": "usernameKey",
+          "type": "text",
+          "required": false,
+          "columnType": "TEXT",
+          "readonly": true,
+          "description": "The standardized username used to recognize this account; maintained automatically."
+        },
         {
           "name": "status",
           "type": "text",

package/dist/sveltekit/password-handlers.d.ts

@@ -50,16 +50,28 @@
  */
 import '../__smrt-register__.js';
 import { PasswordCredentialService, type PasswordCredentialServiceOptions } from '../services/PasswordCredentialService.js';
+/**
+ * Structural cookie subset. Options are always supplied by this module and
+ * match SvelteKit's required cookie path without making it a root dependency.
+ */
+type CookieOptions = {
+    path: string;
+    domain?: string;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+    maxAge?: number;
+};
 type Cookies = {
     get: (name: string) => string | undefined;
-    set: (name: string, value: string, options?: Record<string, unknown>) => void;
-    delete: (name: string, options?: Record<string, unknown>) => void;
+    set: (name: string, value: string, options: CookieOptions) => void;
+    delete: (name: string, options: CookieOptions) => void;
 };
 /** The parts of a SvelteKit `RequestEvent` these handlers use. */
 export type PasswordRequestEvent = {
     cookies: Cookies;
     getClientAddress?: () => string;
-    locals?: Record<string, unknown>;
+    locals?: object;
     request: Request;
     url: URL;
 };
@@ -69,7 +81,7 @@ export interface CreatePasswordCredentialHandlersOptions extends PasswordCredent
      * it. A value or a per-request resolver. Null/omitted signs in with no
      * tenant context.
      */
-    tenantId?: string | null | ((event: PasswordRequestEvent) => string | null | undefined | Promise<string | null | undefined>);
+    tenantId?: string | null | 'unique-active-membership' | ((event: PasswordRequestEvent) => string | null | undefined | 'unique-active-membership' | Promise<string | null | undefined | 'unique-active-membership'>);
     /** Session cookie name; must match `createSessionHandler`. Default `sid`. */
     cookieName?: string;
     cookiePath?: string;

package/dist/sveltekit/password-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-handlers.d.ts","sourceRoot":"","sources":["../../src/sveltekit/password-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAGH,OAAO,yBAAyB,CAAC;AAIjC,OAAO,EAGL,yBAAyB,EACzB,KAAK,gCAAgC,EAEtC,MAAM,0CAA0C,CAAC;AAKlD,KAAK,OAAO,GAAG;IACb,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC9E,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACnE,CAAC;AAEF,kEAAkE;AAClE,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAEF,MAAM,WAAW,uCACf,SAAQ,gCAAgC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,EACL,MAAM,GACN,IAAI,GACJ,CAAC,CACC,KAAK,EAAE,oBAAoB,KACxB,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC;IACzE,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CAC5C;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,WAAW,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,cAAc,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,aAAa,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,aAAa,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE;;;;OAIG;IACH,wBAAwB,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7E,sEAAsE;IACtE,OAAO,EAAE,MAAM,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnD;AAuHD,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,uCAAuC,GAC/C,0BAA0B,CAmJ5B"}
+{"version":3,"file":"password-handlers.d.ts","sourceRoot":"","sources":["../../src/sveltekit/password-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAGH,OAAO,yBAAyB,CAAC;AAIjC,OAAO,EAGL,yBAAyB,EACzB,KAAK,gCAAgC,EAEtC,MAAM,0CAA0C,CAAC;AAKlD;;;GAGG;AACH,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AACF,KAAK,OAAO,GAAG;IACb,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;IACnE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;CACxD,CAAC;AAEF,kEAAkE;AAClE,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAEF,MAAM,WAAW,uCACf,SAAQ,gCAAgC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,EACL,MAAM,GACN,IAAI,GACJ,0BAA0B,GAC1B,CAAC,CACC,KAAK,EAAE,oBAAoB,KAEzB,MAAM,GACN,IAAI,GACJ,SAAS,GACT,0BAA0B,GAC1B,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,0BAA0B,CAAC,CAAC,CAAC;IACzE,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CAC5C;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,WAAW,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,cAAc,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,aAAa,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,aAAa,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE;;;;OAIG;IACH,wBAAwB,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7E,sEAAsE;IACtE,OAAO,EAAE,MAAM,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnD;AAuHD,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,uCAAuC,GAC/C,0BAA0B,CAmJ5B"}

package/dist/sveltekit.js

@@ -1,4 +1,4 @@
-import { A as withSessionPermissionContext, B as resolveOidcProviderConfig, C as OperationPermissionError, F as OidcLoginError, G as DeviceCredentialForbiddenError, I as OidcLoginService, K as DeviceCredentialPolicyError, L as decodeOidcTransaction, M as MobileAuthService, N as readMobileBearerToken, P as validateMobileRedirectUri, Q as SessionService, R as encodeOidcTransaction, W as DeviceCredentialError, _ as PasswordCredentialError, a as TerminalAuthError, b as PasswordPolicyError, j as MobileAuthError, lt as LoginRateLimitError, o as TerminalAuthRateLimitError, q as DeviceCredentialService, s as TerminalAuthService, v as PasswordCredentialForbiddenError, y as PasswordCredentialService, z as getUsersOidcConfig } from "./chunks/TerminalAuthService-BqdDnJ4T.js";
+import { A as withSessionPermissionContext, B as resolveOidcProviderConfig, C as OperationPermissionError, F as OidcLoginError, G as DeviceCredentialForbiddenError, I as OidcLoginService, K as DeviceCredentialPolicyError, L as decodeOidcTransaction, M as MobileAuthService, N as readMobileBearerToken, P as validateMobileRedirectUri, Q as SessionService, R as encodeOidcTransaction, W as DeviceCredentialError, _ as PasswordCredentialError, a as TerminalAuthError, b as PasswordPolicyError, j as MobileAuthError, lt as LoginRateLimitError, o as TerminalAuthRateLimitError, q as DeviceCredentialService, s as TerminalAuthService, v as PasswordCredentialForbiddenError, y as PasswordCredentialService, z as getUsersOidcConfig } from "./chunks/TerminalAuthService-BpRwohDW.js";
 import { DiscoveryArtifactValidationError, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, canonicalizeDiscoveryArtifact, createDiscoveryConformanceArtifact, deriveCommandRequirements, validateDiscoveryConformanceArtifact } from "./app-contract.js";
 import { ObjectRegistry, createClassNamePredicate, resolveCustomActionMetadata, resolveEffectiveActionMetadata } from "@happyvertical/smrt-core";
 import { createLogger } from "@happyvertical/logger";