@happyvertical/smrt-app-runtime 0.53.2 → 0.53.4

package/dist/sveltekit/runtime.d.ts

@@ -0,0 +1,277 @@
+/**
+ * SvelteKit server composition for the validated runtime profiles.
+ *
+ * Request foundation, in order:
+ *
+ * 0. Wait for the fail-closed runtime startup gate (`init`).
+ * 1. Resolve a URL tenant candidate into `locals.selectedTenant*`. This is
+ *    selection only and never enters AsyncLocalStorage tenant context.
+ * 2. Load the signed session. Its tenant is accepted only for a verified
+ *    active direct or legitimately inherited membership
+ *    ({@link isSessionTenantAuthorized}, the deployed runtime's rule);
+ *    otherwise the request is unauthenticated. An accepted session enters the
+ *    tenant context and permission set for downstream code, inside the
+ *    request RLS transaction when the profile selects `database-rls`.
+ * 3. Publish the authorized context on `locals.tenantContext` only when it
+ *    matches the verified session tenant.
+ *
+ * This ordering prevents a spoofed header or hostname from becoming query
+ * authority. Membership-gated tenant switching belongs in an explicit action
+ * using `switchSessionTenant()` from `@happyvertical/smrt-users/sveltekit`.
+ */
+import { type ResolvedApplicationRuntime } from '@happyvertical/smrt-config';
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+import { type MinimalTenantContext } from '@happyvertical/smrt-tenancy';
+import type { SessionHandlerOptions, SessionLocals } from '@happyvertical/smrt-users/sveltekit';
+import { type DatabaseInterface } from '@happyvertical/sql';
+import type { Handle, ServerInit } from '@sveltejs/kit';
+import { type DeployedApplicationRuntime, initializeDeployedApplicationRuntime } from '../deployed-runtime.js';
+import { initializeLocalApplicationRuntime, type LocalApplicationRuntime, type LocalOwnerBootstrapInvitation } from '../index.js';
+import { type RuntimeDiagnostics } from '../runtime-diagnostics.js';
+import type { WriterLease } from '../writer-lease.js';
+import { type TenantSelector } from './tenancy.js';
+/** `App.Locals` fields populated by the SMRT runtime `handle`. */
+export interface SmrtRuntimeLocals extends SessionLocals {
+    /**
+     * URL-selected tenant candidate. Never use this as authorization; the
+     * session-authorized tenant remains `tenantId` from {@link SessionLocals}.
+     */
+    selectedTenantId: string | null;
+    selectedTenantSlug: string | null;
+    /** Full context for the authorized session tenant, when present. */
+    tenantContext?: MinimalTenantContext;
+}
+/** Provider component whose readiness a deployed web process must prove. */
+export type ProviderReadinessComponent = 'authentication' | 'assets' | 'secrets';
+/**
+ * Build a provider-owned readiness probe. The probe must check the real
+ * backing service and must never return or log credentials.
+ */
+export type ProviderReadinessFactory = (component: ProviderReadinessComponent, context: {
+    readonly profile: string;
+    readonly provider: string;
+}) => () => Promise<void>;
+/** Context handed to an application-owned writer lease. */
+export interface WriterLeaseContext {
+    readonly appId: string;
+    readonly dataDirectory: string | undefined;
+    readonly sourceRoot: string;
+}
+/**
+ * Held for the life of the local web process; released on failed startup.
+ * The root entry's `acquireWriterLease()` returns one.
+ */
+export type { WriterLease } from '../writer-lease.js';
+/** Inputs to the public diagnostics projection that only the app can supply. */
+export interface ApplicationRuntimeDiagnosticsOptions {
+    readonly toolNames: readonly string[];
+    readonly observedAt: Date;
+    /** Application-owned schema verification seam; runtime liveness is not proof. */
+    readonly schemaStatus?: 'not-ready' | 'ready' | 'unknown';
+    /** Application-owned migration tracker seam; database liveness is not proof. */
+    readonly migrationStatus?: 'current' | 'failed' | 'pending' | 'unknown';
+    /** Bounded worker seam supplied by the deployment's lease/heartbeat adapter. */
+    readonly workerHeartbeatAt?: Date | string | null;
+    /** Stable code/timestamp pairs only; raw errors never cross this seam. */
+    readonly recentErrors?: readonly {
+        readonly code?: unknown;
+        readonly at?: unknown;
+    }[];
+}
+/** Liveness body served by the mounted health route. */
+export interface RuntimeHealthBody {
+    readonly schemaVersion: 1;
+    readonly status: 'ready';
+    readonly profile: ResolvedApplicationRuntime['profile'];
+    /** Local profile only: canonical application ID. */
+    readonly application?: string;
+    /** Local profile only: managed process instance (`SMRT_PROCESS_INSTANCE`). */
+    readonly instance?: string | null;
+    /** Local profile only: {@link runtimeConfigurationFingerprint}. */
+    readonly configuration?: string;
+}
+/** Session-handler options the application may tune. */
+export type SmrtRuntimeSessionOptions = Omit<SessionHandlerOptions, 'enterTenantContext'>;
+/** App-specific options for {@link createSmrtSvelteKitRuntime}. */
+export interface SmrtSvelteKitRuntimeOptions {
+    /**
+     * Explicit application ID. Defaults to `SMRT_APP_ID` (strictly validated)
+     * or the encoded `package.json` name under `sourceRoot`.
+     */
+    readonly appId?: string;
+    /** Application source checkout. Defaults to `process.cwd()`. */
+    readonly sourceRoot?: string;
+    /** Local data root. Defaults to `SMRT_DATA_DIR`, then the OS data directory. */
+    readonly dataDirectory?: string;
+    /** Environment to read. Defaults to `process.env`. */
+    readonly env?: NodeJS.ProcessEnv;
+    /**
+     * Resolved runtime profile. Defaults to `smrt.config` `runtime` when
+     * present, otherwise the `local` profile.
+     */
+    readonly runtime?: ResolvedApplicationRuntime | (() => ResolvedApplicationRuntime | Promise<ResolvedApplicationRuntime>);
+    /**
+     * Explicit, idempotent application migration hook, run during `init`.
+     * The runtime never synthesizes application tables itself.
+     */
+    readonly prepareDatabase?: (db: DatabaseInterface) => Promise<void>;
+    /**
+     * Local HTTP bind host. Defaults to `HOST`, or `127.0.0.1` when
+     * `NODE_ENV=development`. Local production startup without one fails.
+     */
+    readonly bindHost?: string;
+    /** Opt in to persisted local background jobs. Default `SMRT_BACKGROUND_JOBS === 'true'`. */
+    readonly backgroundJobs?: boolean;
+    /** Opt in to application-defined paid capabilities. Default false. */
+    readonly paidCapabilities?: boolean;
+    /** Owner-bootstrap token lifetime (1..900 seconds). */
+    readonly bootstrapTtlSeconds?: number;
+    /** Session lifetime for the owner-bootstrap session cookie. Default 7 days. */
+    readonly sessionTtlSeconds?: number;
+    /**
+     * Local single-writer lease held for the web process (for example the CLI's
+     * state-root writer lease). Released when local startup fails.
+     */
+    readonly acquireWriterLease?: (context: WriterLeaseContext) => WriterLease;
+    /**
+     * Deployed provider readiness probes. Required by `self-hosted` and `cloud`;
+     * deployed startup fails closed without them.
+     */
+    readonly providerReadiness?: ProviderReadinessFactory;
+    /** Replace the default subdomain tenant selector. Selection only. */
+    readonly selectTenant?: TenantSelector;
+    /** Base domain for the default selector. Defaults to `TENANT_BASE_DOMAIN`. */
+    readonly tenantBaseDomain?: string;
+    /** Session handler tuning. `enterTenantContext` is always `true`. */
+    readonly session?: SmrtRuntimeSessionOptions;
+    /** Per-class overrides layered over the runtime database config. */
+    readonly classOverrides?: Readonly<Record<string, Partial<SmrtClassOptions>>>;
+    /** Call `enableTenancy()` if it is not already enabled. Default true. */
+    readonly enableTenancy?: boolean;
+    /**
+     * Receives an owner-bootstrap invitation that this process's startup newly
+     * issued (the plaintext is returned exactly once; only its HMAC is stored).
+     * Use it to show a loopback `/setup?token=` URL. Errors are ignored so a
+     * failing presenter never blocks startup. Default: not presented.
+     */
+    readonly onBootstrapInvitation?: (invitation: LocalOwnerBootstrapInvitation, context: {
+        readonly bindHost: string;
+    }) => void;
+    /** Testable clock for the local runtime. */
+    readonly now?: () => Date;
+}
+/** Cookie attributes for a session established outside the session handler. */
+export interface SmrtRuntimeSessionCookie {
+    readonly name: string;
+    readonly path: string;
+    readonly domain?: string;
+    readonly sameSite: 'strict' | 'lax' | 'none';
+    /** `undefined` means "secure when the request is HTTPS". */
+    readonly secure?: boolean;
+    readonly maxAgeSeconds: number;
+}
+/** The composed runtime; `handle` and `init` are bound and destructurable. */
+/** A principal a route authenticated itself, for {@link SmrtSvelteKitRuntime.runAsPrincipal}. */
+export interface SmrtRuntimeBoundPrincipal {
+    readonly id: string;
+    readonly tenantId?: string | null;
+    /** Granted scopes that cap the live permission set (e.g. token scopes). */
+    readonly scopes?: readonly string[];
+}
+export interface SmrtSvelteKitRuntime {
+    /** `hooks.server.ts` `handle`. */
+    readonly handle: Handle;
+    /** `hooks.server.ts` `init`: the fail-closed startup gate. */
+    readonly init: ServerInit;
+    /** Session cookie attributes shared with owner setup. */
+    readonly sessionCookie: SmrtRuntimeSessionCookie;
+    /** Resolve the runtime profile (memoized; retried after failure). */
+    resolvedRuntime(): Promise<ResolvedApplicationRuntime>;
+    /** Await profile-specific startup (same promise as `init`). */
+    ready(): Promise<void>;
+    /** Canonical application ID. */
+    applicationId(): string;
+    /** Secret-free configuration fingerprint. Requires a resolved runtime. */
+    configurationFingerprint(): string;
+    /**
+     * Database for SMRT collections. Requires a resolved runtime. Inside a
+     * request running in the RLS transaction (`database-rls` isolation, or
+     * `session.postgresRls`) this is the transaction-bound request database;
+     * otherwise the base configuration. Call it per request and never retain
+     * the result (or collections built from it) beyond that request.
+     */
+    databaseConfig(): SmrtClassOptions['db'];
+    /**
+     * Collection options for a class: {@link databaseConfig} plus
+     * `classOverrides`. A class whose override sets `db` keeps that database.
+     * Same per-request rule as {@link databaseConfig}.
+     */
+    classOptions(className: string): SmrtClassOptions;
+    /**
+     * Run `fn` as a principal the route verified itself (for example a bearer
+     * token mapped by an MCP route), replacing the cookie session's permission
+     * context for that call. The principal's permissions are resolved live from
+     * its membership in `tenantId` and, when `scopes` is given, capped to it;
+     * under the RLS transaction rule of {@link databaseConfig} a fresh
+     * transaction publishes that user, tenant and permission set, and
+     * `databaseConfig()`/`classOptions()` return it inside `fn`. Rejects (before
+     * `fn` runs) without a user id, a tenant, or an authorized membership.
+     *
+     * `fn` receives the principal with `scopes` replaced by that effective
+     * permission set (live permissions, capped by the given scopes). Callers
+     * that authorize in code (rather than through database policy, as under
+     * `application` isolation) must authorize with these effective scopes so a
+     * revoked permission takes effect even while a token still carries it.
+     */
+    runAsPrincipal<T, P extends SmrtRuntimeBoundPrincipal = SmrtRuntimeBoundPrincipal>(principal: P, fn: (bound: P & {
+        scopes: string[];
+    }) => Promise<T>): Promise<T>;
+    /** The local runtime. Rejects outside the `local` profile. */
+    localRuntime(): Promise<LocalApplicationRuntime>;
+    /** The deployed runtime. Rejects in the `local` profile. */
+    deployedRuntime(): Promise<DeployedApplicationRuntime>;
+    /** Liveness body for the health route (awaits startup). */
+    health(): Promise<RuntimeHealthBody>;
+    /**
+     * Read private runtime state and project it onto the public allowlist.
+     * Call only after the route has authenticated and authorized its caller.
+     */
+    readDiagnostics(options: ApplicationRuntimeDiagnosticsOptions): Promise<RuntimeDiagnostics>;
+}
+/** @internal Test and composition seams; not part of the public entry. */
+export interface SmrtSvelteKitRuntimeSeams {
+    readonly initializeLocal?: typeof initializeLocalApplicationRuntime;
+    readonly initializeDeployed?: typeof initializeDeployedApplicationRuntime;
+    readonly loadRuntime?: () => Promise<ResolvedApplicationRuntime>;
+}
+/**
+ * Compose runtime startup, tenant selection, the signed session, and
+ * authorized-tenant locals into a SvelteKit `{ handle, init }` pair.
+ *
+ * @example
+ * ```ts
+ * // src/hooks.server.ts
+ * import { createSmrtSvelteKitRuntime } from '@happyvertical/smrt-app-runtime/sveltekit';
+ *
+ * export const runtime = createSmrtSvelteKitRuntime();
+ * export const { handle, init } = runtime;
+ * ```
+ */
+export declare function createSmrtSvelteKitRuntime(options?: SmrtSvelteKitRuntimeOptions): SmrtSvelteKitRuntime;
+/** @internal */
+export declare function composeSmrtSvelteKitRuntime(options: SmrtSvelteKitRuntimeOptions, seams: SmrtSvelteKitRuntimeSeams): SmrtSvelteKitRuntime;
+/**
+ * Step 3: publish the authorized tenant context only when this runtime's
+ * session step verified the session tenant and it matches the active
+ * AsyncLocalStorage context. Locals populated by any other session layer are
+ * never published.
+ */
+export declare const authorizedTenantLocalsHandle: Handle;
+/**
+ * Run handles in order. Unlike `sequence()` from `@sveltejs/kit/hooks`, this
+ * needs no SvelteKit request store, so the composed handle is usable (and
+ * testable) outside the Kit server runtime. The runtime's own handles never
+ * pass resolve options; any options a handle passes are forwarded unchanged.
+ */
+export declare function composeHandles(...handles: readonly Handle[]): Handle;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/sveltekit/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/sveltekit/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,KAAK,0BAA0B,EAGhC,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAUrC,OAAO,KAAK,EACV,qBAAqB,EACrB,aAAa,EACd,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,KAAK,iBAAiB,EAAe,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAKxD,OAAO,EACL,KAAK,0BAA0B,EAE/B,oCAAoC,EAGrC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iCAAiC,EACjC,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,EAGnC,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAEtB,kEAAkE;AAClE,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD;;;OAGG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oEAAoE;IACpE,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAED,4EAA4E;AAC5E,MAAM,MAAM,0BAA0B,GAClC,gBAAgB,GAChB,QAAQ,GACR,SAAS,CAAC;AAEd;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,SAAS,EAAE,0BAA0B,EACrC,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAC7D,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;AAEzB,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,gFAAgF;AAChF,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,GAAG,OAAO,GAAG,SAAS,CAAC;IAC1D,gFAAgF;IAChF,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACxE,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAClD,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS;QAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;KACvB,EAAE,CAAC;CACL;AAED,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACxD,oDAAoD;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mEAAmE;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,wDAAwD;AACxD,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAC1C,qBAAqB,EACrB,oBAAoB,CACrB,CAAC;AAEF,mEAAmE;AACnE,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EACb,0BAA0B,GAC1B,CAAC,MAAM,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,uDAAuD;IACvD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,WAAW,CAAC;IAC3E;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IACtD,qEAAqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC,8EAA8E;IAC9E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC9E,yEAAyE;IACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,UAAU,EAAE,6BAA6B,EACzC,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KACnC,IAAI,CAAC;IACV,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,+EAA+E;AAC/E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC7C,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,8EAA8E;AAC9E,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IACjD,qEAAqE;IACrE,eAAe,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvD,+DAA+D;IAC/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,gCAAgC;IAChC,aAAa,IAAI,MAAM,CAAC;IACxB,0EAA0E;IAC1E,wBAAwB,IAAI,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,cAAc,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAClD;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CACZ,CAAC,EACD,CAAC,SAAS,yBAAyB,GAAG,yBAAyB,EAE/D,SAAS,EAAE,CAAC,EACZ,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAClD,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,8DAA8D;IAC9D,YAAY,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACjD,4DAA4D;IAC5D,eAAe,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvD,2DAA2D;IAC3D,MAAM,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrC;;;OAGG;IACH,eAAe,CACb,OAAO,EAAE,oCAAoC,GAC5C,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED,0EAA0E;AAC1E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,iCAAiC,CAAC;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,oCAAoC,CAAC;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAClE;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,2BAAgC,GACxC,oBAAoB,CAEtB;AAED,gBAAgB;AAChB,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,2BAA2B,EACpC,KAAK,EAAE,yBAAyB,GAC/B,oBAAoB,CAyhBtB;AAyCD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAe1C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAiBpE"}

package/dist/sveltekit/tenancy.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Tenant *selection* for SvelteKit requests.
+ *
+ * Selection and authorization are deliberately separate:
+ *
+ * - a selector maps a trusted URL shape (by default the leading subdomain) to
+ *   an active tenant record and publishes it as `locals.selectedTenant*`;
+ * - the signed session (`createSessionHandler({ enterTenantContext: true })`)
+ *   authorizes the signed-in user's membership and establishes the request
+ *   tenant context.
+ *
+ * A selected tenant is useful for login and membership-gated switch flows, but
+ * it never becomes ambient query authority by itself. The default selector
+ * ignores client-provided tenant headers.
+ */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+/** The request fields a tenant selector may read. */
+export interface TenantSelectionEvent {
+    readonly url: URL;
+    readonly request: {
+        readonly headers: Headers;
+    };
+}
+/** URL-derived tenant candidate. Never authorization. */
+export interface TenantSelection {
+    /** Database ID for an active tenant, or null when none resolves. */
+    readonly tenantId: string | null;
+    /** URL-derived slug. Informational until membership authorizes a switch. */
+    readonly tenantSlug: string | null;
+}
+/**
+ * Replaceable selection extension point. Implementations must preserve the
+ * rule that selection alone never establishes authorization context.
+ */
+export type TenantSelector = (event: TenantSelectionEvent) => TenantSelection | Promise<TenantSelection>;
+/**
+ * Pure URL parser used by the default selector.
+ *
+ * Set `TENANT_BASE_DOMAIN` (or pass `baseDomain`) in production so
+ * multi-label public suffixes are never guessed. Without it, the fallback is
+ * intended only for local domains such as `acme.demo.local`.
+ */
+export declare function selectTenantSlug(url: URL, baseDomain?: string | undefined): string | null;
+export interface SubdomainTenantSelectorOptions {
+    /** Explicit public base domain. Defaults to `TENANT_BASE_DOMAIN`. */
+    readonly baseDomain?: string;
+    /** Collection options for the `Tenant` lookup. */
+    readonly classOptions: () => SmrtClassOptions;
+}
+/**
+ * Default selector: the leading subdomain names an ACTIVE tenant.
+ *
+ * A missing `tenants` table (a fresh project before its first migration)
+ * yields no selection; the runtime never creates that table.
+ */
+export declare function createSubdomainTenantSelector(options: SubdomainTenantSelectorOptions): TenantSelector;
+/** Coerce an application selector's result into the published shape. */
+export declare function normalizeTenantSelection(selection: TenantSelection | null | undefined): TenantSelection;
+//# sourceMappingURL=tenancy.d.ts.map

package/dist/sveltekit/tenancy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../../src/sveltekit/tenancy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,qDAAqD;AACrD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACjD;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,KAAK,EAAE,oBAAoB,KACxB,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAShD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,GAAG,EACR,UAAU,GAAE,MAAM,GAAG,SAA0C,GAC9D,MAAM,GAAG,IAAI,CA4Bf;AAYD,MAAM,WAAW,8BAA8B;IAC7C,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,gBAAgB,CAAC;CAC/C;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,cAAc,CAgBhB;AAED,wEAAwE;AACxE,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,GAC5C,eAAe,CAUjB"}

package/dist/sveltekit.d.ts

@@ -0,0 +1,2 @@
+export * from './sveltekit/index.js';
+//# sourceMappingURL=sveltekit.d.ts.map

package/dist/sveltekit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sveltekit.d.ts","sourceRoot":"","sources":["../src/sveltekit.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC"}