@happyvertical/smrt-app-runtime 0.53.3 → 0.53.4

package/dist/sveltekit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sveltekit.js","names":["name","resolved"],"sources":["../src/sveltekit/handlers.ts","../src/sveltekit/owner-setup.ts","../src/sveltekit/tenancy.ts","../src/sveltekit/runtime.ts"],"sourcesContent":["/**\n * Mountable runtime routes: liveness health, authorized diagnostics, and the\n * server-owned session summary for the root layout.\n */\n\nimport {\n  getRequestScopedDatabase,\n  RoleCollection,\n} from '@happyvertical/smrt-users';\nimport { json, type RequestHandler } from '@sveltejs/kit';\nimport type { RuntimeDiagnostics } from '../runtime-diagnostics.js';\nimport type {\n  ApplicationRuntimeDiagnosticsOptions,\n  SmrtSvelteKitRuntime,\n} from './runtime.js';\n\n/** Explicit permission that grants diagnostics read without the owner role. */\nexport const RUNTIME_DIAGNOSTICS_READ_PERMISSION = 'runtime_diagnostics.read';\n\n/**\n * Mount as `src/routes/api/_runtime/health/+server.ts`:\n * `export const GET = createRuntimeHealthHandler(runtime);`\n *\n * Local responses add the application ID, managed process instance, and the\n * secret-free configuration fingerprint that process managers compare.\n * Deployed responses expose only schema version, status, and profile.\n */\nexport function createRuntimeHealthHandler(\n  runtime: Pick<SmrtSvelteKitRuntime, 'health'>,\n): RequestHandler {\n  return async () => json(await runtime.health());\n}\n\n/** The locals the diagnostics route authorizes against. */\nexport interface DiagnosticsPrincipalLocals {\n  readonly user?: { readonly id?: unknown } | null;\n  readonly membership?: {\n    readonly userId?: unknown;\n    readonly tenantId?: unknown;\n    readonly roleId?: unknown;\n    isActive?: () => boolean;\n  } | null;\n  readonly permissions?: readonly string[];\n  readonly tenantId?: unknown;\n  readonly sessionId?: unknown;\n}\n\ntype DiagnosticsInputValue<T> = T | (() => T);\n\nexport interface RuntimeDiagnosticsHandlerOptions {\n  /** Supplies default diagnostics reading and owner-role lookup. */\n  readonly runtime?: Pick<\n    SmrtSvelteKitRuntime,\n    'readDiagnostics' | 'classOptions'\n  >;\n  /** Replace the runtime projection (must already be the public allowlist). */\n  readonly readDiagnostics?: () => Promise<RuntimeDiagnostics>;\n  /** Replace the owner-role lookup. Thrown errors deny. */\n  readonly resolveRoleSlug?: (roleId: string) => Promise<string | null>;\n  /** Override where the principal comes from. Defaults to `event.locals`. */\n  readonly resolveLocals?: (event: {\n    readonly locals: unknown;\n  }) => DiagnosticsPrincipalLocals;\n  /** Public tool inventory (sorted/capped by the projector). */\n  readonly toolNames?: DiagnosticsInputValue<readonly string[]>;\n  readonly schemaStatus?: DiagnosticsInputValue<\n    ApplicationRuntimeDiagnosticsOptions['schemaStatus']\n  >;\n  readonly migrationStatus?: DiagnosticsInputValue<\n    ApplicationRuntimeDiagnosticsOptions['migrationStatus']\n  >;\n  readonly workerHeartbeatAt?: () => Date | string | null | undefined;\n  readonly recentErrors?: () => ApplicationRuntimeDiagnosticsOptions['recentErrors'];\n  /** Testable clock. */\n  readonly now?: () => Date;\n}\n\nfunction resolveInputValue<T>(\n  value: DiagnosticsInputValue<T> | undefined,\n): T | undefined {\n  return typeof value === 'function' ? (value as () => T)() : value;\n}\n\n/**\n * Mount as `src/routes/api/_runtime/diagnostics/+server.ts`:\n * `export const GET = createRuntimeDiagnosticsHandler({ runtime });`\n *\n * Authentication and authorization always complete before the private runtime\n * is read. Authorized callers hold `runtime_diagnostics.read` or the `owner`\n * role of their active, session-matching membership. Every failure is a\n * stable `{ schemaVersion: 1, error: { code } }` body.\n */\nexport function createRuntimeDiagnosticsHandler(\n  options: RuntimeDiagnosticsHandlerOptions,\n): RequestHandler {\n  const runtime = options.runtime;\n  const readDiagnostics =\n    options.readDiagnostics ??\n    (runtime\n      ? () =>\n          runtime.readDiagnostics({\n            toolNames: resolveInputValue(options.toolNames) ?? [],\n            observedAt: options.now?.() ?? new Date(),\n            schemaStatus: resolveInputValue(options.schemaStatus) ?? 'unknown',\n            migrationStatus:\n              resolveInputValue(options.migrationStatus) ?? 'unknown',\n            workerHeartbeatAt: options.workerHeartbeatAt?.() ?? null,\n            recentErrors: options.recentErrors?.() ?? [],\n          })\n      : undefined);\n  const resolveRoleSlug =\n    options.resolveRoleSlug ??\n    (runtime\n      ? async (roleId: string) => {\n          const config = runtime.classOptions('Role');\n          const requestDb = getRequestScopedDatabase();\n          const roles = await RoleCollection.create(\n            requestDb\n              ? { ...config, db: requestDb as typeof config.db }\n              : config,\n          );\n          return (await roles.findById(roleId))?.slug ?? null;\n        }\n      : undefined);\n  if (!readDiagnostics || !resolveRoleSlug) {\n    throw new TypeError(\n      'createRuntimeDiagnosticsHandler requires `runtime`, or both `readDiagnostics` and `resolveRoleSlug`.',\n    );\n  }\n  const resolveLocals =\n    options.resolveLocals ??\n    ((event: { readonly locals: unknown }) =>\n      event.locals as DiagnosticsPrincipalLocals);\n\n  return async (event) => {\n    const locals = resolveLocals(event);\n    const principal = authenticatedPrincipal(locals);\n    if (!principal) return stableError(401, 'authentication_required');\n\n    let authorized =\n      locals.permissions?.includes(RUNTIME_DIAGNOSTICS_READ_PERMISSION) ===\n      true;\n    if (!authorized) {\n      try {\n        authorized = (await resolveRoleSlug(principal.roleId)) === 'owner';\n      } catch {\n        authorized = false;\n      }\n    }\n    if (!authorized) return stableError(403, 'authorization_denied');\n\n    try {\n      return json(await readDiagnostics());\n    } catch {\n      return stableError(503, 'diagnostics_unavailable');\n    }\n  };\n}\n\nfunction authenticatedPrincipal(\n  locals: DiagnosticsPrincipalLocals | null | undefined,\n): { roleId: string } | null {\n  const userId = locals?.user?.id;\n  const tenantId = locals?.tenantId;\n  const sessionId = locals?.sessionId;\n  const membership = locals?.membership;\n  if (\n    typeof userId !== 'string' ||\n    !userId ||\n    typeof tenantId !== 'string' ||\n    !tenantId ||\n    typeof sessionId !== 'string' ||\n    !sessionId ||\n    !membership ||\n    membership.userId !== userId ||\n    membership.tenantId !== tenantId ||\n    typeof membership.roleId !== 'string' ||\n    !membership.roleId\n  ) {\n    return null;\n  }\n  try {\n    if (membership.isActive?.() !== true) return null;\n  } catch {\n    return null;\n  }\n  return { roleId: membership.roleId };\n}\n\nfunction stableError(status: number, code: string): Response {\n  return json({ schemaVersion: 1, error: { code } }, { status });\n}\n\n/** Server-owned session summary for the root layout. */\nexport interface SessionLayoutData {\n  readonly session: {\n    readonly authenticated: boolean;\n    /** Tenant authorized by the active session. */\n    readonly activeTenantId: string | null;\n    /** URL-selected tenant candidate; display only, never authorization. */\n    readonly selectedTenantSlug: string | null;\n  };\n}\n\n/**\n * Mount as `src/routes/+layout.server.ts`:\n * `export const load = createSessionLayoutLoad();`\n */\nexport function createSessionLayoutLoad(): (event: {\n  readonly locals: unknown;\n}) => SessionLayoutData {\n  return ({ locals }) => {\n    const value = locals as {\n      user?: unknown;\n      tenantId?: string | null;\n      selectedTenantSlug?: string | null;\n    };\n    return {\n      session: {\n        authenticated: Boolean(value.user),\n        activeTenantId: value.tenantId ?? null,\n        selectedTenantSlug: value.selectedTenantSlug ?? null,\n      },\n    };\n  };\n}\n","/**\n * Server half of the local owner-setup page (`src/routes/setup/+page.server.ts`).\n *\n * Owner bootstrap is local-profile only, loopback-only, and single-use. The\n * runtime stores only an HMAC of the short-lived token; this module never\n * stores, logs, or returns claim errors, and it re-checks loopback custody on\n * every request instead of trusting the bind host alone.\n */\n\nimport type { Cookies } from '@sveltejs/kit';\nimport { type ActionFailure, fail, redirect } from '@sveltejs/kit';\nimport type { LocalOwnerClaimResult } from '../index.js';\nimport type { SmrtSvelteKitRuntime } from './runtime.js';\n\n/** Data returned by the setup page `load`. */\nexport interface OwnerSetupPageData {\n  /** False when setup is claimed, disabled (deployed), or not loopback. */\n  readonly available: boolean;\n  /** One-time token from `?token=` (empty unless available). */\n  readonly token: string;\n}\n\n/** Stable failure codes returned by the setup action. */\nexport type OwnerSetupErrorCode =\n  /** Not the local profile (HTTP 404). */\n  | 'setup_disabled'\n  /** Request is not from a loopback client on a loopback host (HTTP 403). */\n  | 'setup_unavailable'\n  /** Missing token, blank name, or email without `@` (HTTP 400). */\n  | 'setup_invalid_input'\n  /** Token wrong, expired, or already used; owner already claimed (HTTP 400). */\n  | 'setup_invalid';\n\n/** `form` data returned with `fail(status, …)`. */\nexport interface OwnerSetupFailure {\n  readonly code: OwnerSetupErrorCode;\n  /** Fixed, secret-free message; never claim error text. */\n  readonly message: string;\n}\n\n/** Form field names posted to the setup action. */\nexport const OWNER_SETUP_FIELDS = Object.freeze({\n  token: 'token',\n  name: 'name',\n  email: 'email',\n  tenantName: 'tenantName',\n} as const);\n\nexport const DEFAULT_OWNER_SETUP_MESSAGES: Readonly<\n  Record<OwnerSetupErrorCode, string>\n> = Object.freeze({\n  setup_disabled: 'Local owner setup is disabled.',\n  setup_unavailable: 'Local owner setup is available only from this device.',\n  setup_invalid_input: 'Name, email, and a valid setup token are required.',\n  setup_invalid:\n    'The setup invitation is invalid, expired, or already used. Run pnpm app:stop, pnpm app:recover, pnpm app:start, then pnpm app:open.',\n});\n\n/** The request fields the setup page reads. */\nexport interface OwnerSetupEvent {\n  readonly url: URL;\n  readonly locals: unknown;\n  getClientAddress(): string;\n}\n\nexport interface OwnerSetupActionEvent extends OwnerSetupEvent {\n  readonly request: Request;\n  readonly cookies: Pick<Cookies, 'set'>;\n}\n\nexport interface OwnerSetupPageOptions {\n  /** Where a signed-in visitor or a successful claim is sent. Default `/`. */\n  readonly redirectTo?: string;\n  /** Replace fixed failure messages (for example app-specific recovery steps). */\n  readonly messages?: Partial<Record<OwnerSetupErrorCode, string>>;\n  /** Override where the signed-in user comes from. Defaults to `locals.user`. */\n  readonly resolveUser?: (event: OwnerSetupEvent) => unknown;\n  /**\n   * Best-effort cleanup after a successful claim (for example removing local\n   * onboarding handoff files). Errors are ignored: the owner and session are\n   * already authoritative and a stale token now fails closed.\n   */\n  readonly onOwnerClaimed?: (\n    result: LocalOwnerClaimResult,\n    event: OwnerSetupActionEvent,\n  ) => void | Promise<void>;\n}\n\nexport interface OwnerSetupPage {\n  readonly load: (event: OwnerSetupEvent) => Promise<OwnerSetupPageData>;\n  readonly actions: {\n    readonly default: (\n      event: OwnerSetupActionEvent,\n    ) => Promise<ActionFailure<OwnerSetupFailure>>;\n  };\n}\n\n/**\n * Mount as `src/routes/setup/+page.server.ts`:\n *\n * ```ts\n * import { createOwnerSetupPage } from '@happyvertical/smrt-app-runtime/sveltekit';\n * import { runtime } from '../../hooks.server';\n *\n * export const { load, actions } = createOwnerSetupPage(runtime);\n * ```\n *\n * The form posts to the `default` action with fields `token` (hidden),\n * `name`, `email`, and optional `tenantName`. Success sets the session cookie\n * and redirects 303; failures return `fail(status, { code, message })`.\n */\nexport function createOwnerSetupPage(\n  runtime: Pick<\n    SmrtSvelteKitRuntime,\n    'resolvedRuntime' | 'localRuntime' | 'sessionCookie'\n  >,\n  options: OwnerSetupPageOptions = {},\n): OwnerSetupPage {\n  const redirectTo = options.redirectTo ?? '/';\n  const messages = { ...DEFAULT_OWNER_SETUP_MESSAGES, ...options.messages };\n  const failure = (status: number, code: OwnerSetupErrorCode) =>\n    fail(status, { code, message: messages[code] } as OwnerSetupFailure);\n  const resolveUser =\n    options.resolveUser ??\n    ((event: OwnerSetupEvent) => (event.locals as { user?: unknown }).user);\n\n  const load = async (event: OwnerSetupEvent): Promise<OwnerSetupPageData> => {\n    if (resolveUser(event)) redirect(303, redirectTo);\n    const resolved = await runtime.resolvedRuntime();\n    if (resolved.profile !== 'local' || !isLoopbackRequest(event)) {\n      return { available: false, token: '' };\n    }\n    const local = await runtime.localRuntime();\n    const diagnostics = await local.diagnostics();\n    const available = diagnostics.bootstrap.status !== 'claimed';\n    return {\n      available,\n      token: available\n        ? event.url.searchParams.get(OWNER_SETUP_FIELDS.token) || ''\n        : '',\n    };\n  };\n\n  const claim = async (\n    event: OwnerSetupActionEvent,\n  ): Promise<ActionFailure<OwnerSetupFailure>> => {\n    const resolved = await runtime.resolvedRuntime();\n    if (resolved.profile !== 'local') return failure(404, 'setup_disabled');\n    if (!isLoopbackRequest(event)) return failure(403, 'setup_unavailable');\n\n    let form: FormData;\n    try {\n      form = await event.request.formData();\n    } catch {\n      return failure(400, 'setup_invalid_input');\n    }\n    const field = (name: string) => {\n      const value = form.get(name);\n      return typeof value === 'string' ? value : '';\n    };\n    const token = field(OWNER_SETUP_FIELDS.token);\n    const name = field(OWNER_SETUP_FIELDS.name);\n    const email = field(OWNER_SETUP_FIELDS.email);\n    const tenantName = field(OWNER_SETUP_FIELDS.tenantName).trim();\n    if (!token || !name.trim() || !email.includes('@')) {\n      return failure(400, 'setup_invalid_input');\n    }\n\n    const local = await runtime.localRuntime();\n    let result: LocalOwnerClaimResult;\n    try {\n      result = await local.claimOwner({\n        token,\n        name,\n        email,\n        ...(tenantName ? { tenantName } : {}),\n        userAgent: event.request.headers.get('user-agent') || undefined,\n        ipAddress: event.getClientAddress(),\n      });\n    } catch {\n      return failure(400, 'setup_invalid');\n    }\n\n    const cookie = runtime.sessionCookie;\n    event.cookies.set(cookie.name, result.sessionId, {\n      path: cookie.path,\n      ...(cookie.domain ? { domain: cookie.domain } : {}),\n      httpOnly: true,\n      secure: cookie.secure ?? event.url.protocol === 'https:',\n      sameSite: cookie.sameSite,\n      maxAge: cookie.maxAgeSeconds,\n    });\n    try {\n      await options.onOwnerClaimed?.(result, event);\n    } catch {\n      // Best effort only; see OwnerSetupPageOptions.onOwnerClaimed.\n    }\n    redirect(303, redirectTo);\n  };\n\n  return Object.freeze({\n    load,\n    actions: Object.freeze({ default: claim }),\n  });\n}\n\n/**\n * True only when both the peer address and the addressed host are loopback.\n * The host check rejects tunnels and DNS-rebinding hosts that forward to a\n * loopback listener; a throwing `getClientAddress` is treated as remote.\n */\nexport function isLoopbackRequest(event: {\n  readonly url: URL;\n  getClientAddress(): string;\n}): boolean {\n  let address: string;\n  try {\n    address = event.getClientAddress();\n  } catch {\n    return false;\n  }\n  return isLoopbackAddress(address) && isLoopbackHostname(event.url.hostname);\n}\n\n/** Loopback IP literal: `127.0.0.0/8`, `::1`, or IPv4-mapped `127/8`. */\nexport function isLoopbackAddress(value: string | null | undefined): boolean {\n  if (typeof value !== 'string') return false;\n  let host = value\n    .trim()\n    .toLowerCase()\n    .replace(/^\\[|\\]$/g, '');\n  if (host === '::1' || host === '0:0:0:0:0:0:0:1') return true;\n  if (host.startsWith('::ffff:')) host = host.slice('::ffff:'.length);\n  const octets = host.split('.');\n  return (\n    octets.length === 4 &&\n    octets.every((part) => /^\\d{1,3}$/.test(part) && Number(part) <= 255) &&\n    Number(octets[0]) === 127\n  );\n}\n\n/** Loopback host name as SvelteKit reports it in `url.hostname`. */\nexport function isLoopbackHostname(hostname: string): boolean {\n  const host = hostname.trim().toLowerCase().replace(/\\.$/, '');\n  return host === 'localhost' || isLoopbackAddress(host);\n}\n","/**\n * Tenant *selection* for SvelteKit requests.\n *\n * Selection and authorization are deliberately separate:\n *\n * - a selector maps a trusted URL shape (by default the leading subdomain) to\n *   an active tenant record and publishes it as `locals.selectedTenant*`;\n * - the signed session (`createSessionHandler({ enterTenantContext: true })`)\n *   authorizes the signed-in user's membership and establishes the request\n *   tenant context.\n *\n * A selected tenant is useful for login and membership-gated switch flows, but\n * it never becomes ambient query authority by itself. The default selector\n * ignores client-provided tenant headers.\n */\n\nimport type { SmrtClassOptions } from '@happyvertical/smrt-core';\nimport { TenantCollection, TenantStatus } from '@happyvertical/smrt-users';\n\n/** The request fields a tenant selector may read. */\nexport interface TenantSelectionEvent {\n  readonly url: URL;\n  readonly request: { readonly headers: Headers };\n}\n\n/** URL-derived tenant candidate. Never authorization. */\nexport interface TenantSelection {\n  /** Database ID for an active tenant, or null when none resolves. */\n  readonly tenantId: string | null;\n  /** URL-derived slug. Informational until membership authorizes a switch. */\n  readonly tenantSlug: string | null;\n}\n\n/**\n * Replaceable selection extension point. Implementations must preserve the\n * rule that selection alone never establishes authorization context.\n */\nexport type TenantSelector = (\n  event: TenantSelectionEvent,\n) => TenantSelection | Promise<TenantSelection>;\n\nconst ROOT_LIKE_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);\nconst RESERVED_SUBDOMAINS = new Set(['www', 'api', 'app', 'admin']);\nconst NO_SELECTION: TenantSelection = Object.freeze({\n  tenantId: null,\n  tenantSlug: null,\n});\n\n/**\n * Pure URL parser used by the default selector.\n *\n * Set `TENANT_BASE_DOMAIN` (or pass `baseDomain`) in production so\n * multi-label public suffixes are never guessed. Without it, the fallback is\n * intended only for local domains such as `acme.demo.local`.\n */\nexport function selectTenantSlug(\n  url: URL,\n  baseDomain: string | undefined = process.env.TENANT_BASE_DOMAIN,\n): string | null {\n  const hostname = url.hostname.toLowerCase();\n  if (\n    ROOT_LIKE_HOSTS.has(hostname) ||\n    hostname.startsWith('[') ||\n    /^\\d{1,3}(\\.\\d{1,3}){3}$/.test(hostname)\n  ) {\n    return null;\n  }\n\n  const normalizedBase = baseDomain\n    ?.trim()\n    .toLowerCase()\n    .replace(/^\\.+|\\.+$/g, '');\n\n  let candidate: string | undefined;\n  if (normalizedBase) {\n    if (hostname === normalizedBase) return null;\n    const suffix = `.${normalizedBase}`;\n    if (!hostname.endsWith(suffix)) return null;\n    candidate = hostname.slice(0, -suffix.length).split('.')[0];\n  } else {\n    const labels = hostname.split('.');\n    if (labels.length < 3) return null;\n    candidate = labels[0];\n  }\n\n  return candidate && !RESERVED_SUBDOMAINS.has(candidate) ? candidate : null;\n}\n\nfunction isMissingTenantTable(error: unknown): boolean {\n  if (!(error instanceof Error)) return false;\n  const code = (error as Error & { code?: string }).code;\n  return (\n    code === '42P01' ||\n    error.message.includes('relation \"tenants\" does not exist') ||\n    error.message.includes('no such table: tenants')\n  );\n}\n\nexport interface SubdomainTenantSelectorOptions {\n  /** Explicit public base domain. Defaults to `TENANT_BASE_DOMAIN`. */\n  readonly baseDomain?: string;\n  /** Collection options for the `Tenant` lookup. */\n  readonly classOptions: () => SmrtClassOptions;\n}\n\n/**\n * Default selector: the leading subdomain names an ACTIVE tenant.\n *\n * A missing `tenants` table (a fresh project before its first migration)\n * yields no selection; the runtime never creates that table.\n */\nexport function createSubdomainTenantSelector(\n  options: SubdomainTenantSelectorOptions,\n): TenantSelector {\n  return async (event) => {\n    const tenantSlug = selectTenantSlug(event.url, options.baseDomain);\n    if (!tenantSlug) return NO_SELECTION;\n    let tenantId: string | null;\n    try {\n      const tenants = await TenantCollection.create(options.classOptions());\n      const tenant = await tenants.findBySlug(tenantSlug);\n      tenantId =\n        tenant?.status === TenantStatus.ACTIVE ? (tenant.id ?? null) : null;\n    } catch (error) {\n      if (!isMissingTenantTable(error)) throw error;\n      tenantId = null;\n    }\n    return { tenantId, tenantSlug };\n  };\n}\n\n/** Coerce an application selector's result into the published shape. */\nexport function normalizeTenantSelection(\n  selection: TenantSelection | null | undefined,\n): TenantSelection {\n  const tenantId =\n    typeof selection?.tenantId === 'string' && selection.tenantId\n      ? selection.tenantId\n      : null;\n  const tenantSlug =\n    typeof selection?.tenantSlug === 'string' && selection.tenantSlug\n      ? selection.tenantSlug\n      : null;\n  return { tenantId, tenantSlug };\n}\n","/**\n * SvelteKit server composition for the validated runtime profiles.\n *\n * Request foundation, in order:\n *\n * 0. Wait for the fail-closed runtime startup gate (`init`).\n * 1. Resolve a URL tenant candidate into `locals.selectedTenant*`. This is\n *    selection only and never enters AsyncLocalStorage tenant context.\n * 2. Load the signed session. Its tenant is accepted only for a verified\n *    active direct or legitimately inherited membership\n *    ({@link isSessionTenantAuthorized}, the deployed runtime's rule);\n *    otherwise the request is unauthenticated. An accepted session enters the\n *    tenant context and permission set for downstream code, inside the\n *    request RLS transaction when the profile selects `database-rls`.\n * 3. Publish the authorized context on `locals.tenantContext` only when it\n *    matches the verified session tenant.\n *\n * This ordering prevents a spoofed header or hostname from becoming query\n * authority. Membership-gated tenant switching belongs in an explicit action\n * using `switchSessionTenant()` from `@happyvertical/smrt-users/sveltekit`.\n */\n\nimport {\n  loadConfig,\n  type ResolvedApplicationRuntime,\n  resolveApplicationRuntime,\n  resolveConfiguredApplicationRuntime,\n} from '@happyvertical/smrt-config';\nimport type { SmrtClassOptions } from '@happyvertical/smrt-core';\nimport {\n  enableTenancy,\n  getCurrentTenant,\n  isTenancyEnabled,\n  type MinimalTenantContext,\n} from '@happyvertical/smrt-tenancy';\nimport {\n  getCurrentSessionPermissionContext,\n  getRequestScopedDatabase,\n  PermissionResolver,\n  SessionService,\n  type SessionServiceOptions,\n  withPrincipalPermissionContext,\n  withSessionPermissionContext,\n} from '@happyvertical/smrt-users';\nimport type {\n  SessionHandlerOptions,\n  SessionLocals,\n} from '@happyvertical/smrt-users/sveltekit';\nimport { type DatabaseInterface, getDatabase } from '@happyvertical/sql';\nimport type { Handle, ServerInit } from '@sveltejs/kit';\nimport {\n  resolveApplicationId,\n  runtimeConfigurationFingerprint,\n} from '../application-identity.js';\nimport {\n  type DeployedApplicationRuntime,\n  type DeployedApplicationRuntimeProfile,\n  initializeDeployedApplicationRuntime,\n  isSessionTenantAuthorized,\n  type PublicAuthenticationProvider,\n} from '../deployed-runtime.js';\nimport {\n  initializeLocalApplicationRuntime,\n  type LocalApplicationRuntime,\n  type LocalOwnerBootstrapInvitation,\n  resolveLocalRuntimePaths,\n  validateApplicationId,\n} from '../index.js';\nimport {\n  projectRuntimeDiagnostics,\n  type RuntimeDiagnostics,\n  type RuntimeDiagnosticsProjectionInput,\n} from '../runtime-diagnostics.js';\nimport type { WriterLease } from '../writer-lease.js';\nimport {\n  createSubdomainTenantSelector,\n  normalizeTenantSelection,\n  type TenantSelector,\n} from './tenancy.js';\n\n/** `App.Locals` fields populated by the SMRT runtime `handle`. */\nexport interface SmrtRuntimeLocals extends SessionLocals {\n  /**\n   * URL-selected tenant candidate. Never use this as authorization; the\n   * session-authorized tenant remains `tenantId` from {@link SessionLocals}.\n   */\n  selectedTenantId: string | null;\n  selectedTenantSlug: string | null;\n  /** Full context for the authorized session tenant, when present. */\n  tenantContext?: MinimalTenantContext;\n}\n\n/** Provider component whose readiness a deployed web process must prove. */\nexport type ProviderReadinessComponent =\n  | 'authentication'\n  | 'assets'\n  | 'secrets';\n\n/**\n * Build a provider-owned readiness probe. The probe must check the real\n * backing service and must never return or log credentials.\n */\nexport type ProviderReadinessFactory = (\n  component: ProviderReadinessComponent,\n  context: { readonly profile: string; readonly provider: string },\n) => () => Promise<void>;\n\n/** Context handed to an application-owned writer lease. */\nexport interface WriterLeaseContext {\n  readonly appId: string;\n  readonly dataDirectory: string | undefined;\n  readonly sourceRoot: string;\n}\n\n/**\n * Held for the life of the local web process; released on failed startup.\n * The root entry's `acquireWriterLease()` returns one.\n */\nexport type { WriterLease } from '../writer-lease.js';\n\n/** Inputs to the public diagnostics projection that only the app can supply. */\nexport interface ApplicationRuntimeDiagnosticsOptions {\n  readonly toolNames: readonly string[];\n  readonly observedAt: Date;\n  /** Application-owned schema verification seam; runtime liveness is not proof. */\n  readonly schemaStatus?: 'not-ready' | 'ready' | 'unknown';\n  /** Application-owned migration tracker seam; database liveness is not proof. */\n  readonly migrationStatus?: 'current' | 'failed' | 'pending' | 'unknown';\n  /** Bounded worker seam supplied by the deployment's lease/heartbeat adapter. */\n  readonly workerHeartbeatAt?: Date | string | null;\n  /** Stable code/timestamp pairs only; raw errors never cross this seam. */\n  readonly recentErrors?: readonly {\n    readonly code?: unknown;\n    readonly at?: unknown;\n  }[];\n}\n\n/** Liveness body served by the mounted health route. */\nexport interface RuntimeHealthBody {\n  readonly schemaVersion: 1;\n  readonly status: 'ready';\n  readonly profile: ResolvedApplicationRuntime['profile'];\n  /** Local profile only: canonical application ID. */\n  readonly application?: string;\n  /** Local profile only: managed process instance (`SMRT_PROCESS_INSTANCE`). */\n  readonly instance?: string | null;\n  /** Local profile only: {@link runtimeConfigurationFingerprint}. */\n  readonly configuration?: string;\n}\n\n/** Session-handler options the application may tune. */\nexport type SmrtRuntimeSessionOptions = Omit<\n  SessionHandlerOptions,\n  'enterTenantContext'\n>;\n\n/** App-specific options for {@link createSmrtSvelteKitRuntime}. */\nexport interface SmrtSvelteKitRuntimeOptions {\n  /**\n   * Explicit application ID. Defaults to `SMRT_APP_ID` (strictly validated)\n   * or the encoded `package.json` name under `sourceRoot`.\n   */\n  readonly appId?: string;\n  /** Application source checkout. Defaults to `process.cwd()`. */\n  readonly sourceRoot?: string;\n  /** Local data root. Defaults to `SMRT_DATA_DIR`, then the OS data directory. */\n  readonly dataDirectory?: string;\n  /** Environment to read. Defaults to `process.env`. */\n  readonly env?: NodeJS.ProcessEnv;\n  /**\n   * Resolved runtime profile. Defaults to `smrt.config` `runtime` when\n   * present, otherwise the `local` profile.\n   */\n  readonly runtime?:\n    | ResolvedApplicationRuntime\n    | (() => ResolvedApplicationRuntime | Promise<ResolvedApplicationRuntime>);\n  /**\n   * Explicit, idempotent application migration hook, run during `init`.\n   * The runtime never synthesizes application tables itself.\n   */\n  readonly prepareDatabase?: (db: DatabaseInterface) => Promise<void>;\n  /**\n   * Local HTTP bind host. Defaults to `HOST`, or `127.0.0.1` when\n   * `NODE_ENV=development`. Local production startup without one fails.\n   */\n  readonly bindHost?: string;\n  /** Opt in to persisted local background jobs. Default `SMRT_BACKGROUND_JOBS === 'true'`. */\n  readonly backgroundJobs?: boolean;\n  /** Opt in to application-defined paid capabilities. Default false. */\n  readonly paidCapabilities?: boolean;\n  /** Owner-bootstrap token lifetime (1..900 seconds). */\n  readonly bootstrapTtlSeconds?: number;\n  /** Session lifetime for the owner-bootstrap session cookie. Default 7 days. */\n  readonly sessionTtlSeconds?: number;\n  /**\n   * Local single-writer lease held for the web process (for example the CLI's\n   * state-root writer lease). Released when local startup fails.\n   */\n  readonly acquireWriterLease?: (context: WriterLeaseContext) => WriterLease;\n  /**\n   * Deployed provider readiness probes. Required by `self-hosted` and `cloud`;\n   * deployed startup fails closed without them.\n   */\n  readonly providerReadiness?: ProviderReadinessFactory;\n  /** Replace the default subdomain tenant selector. Selection only. */\n  readonly selectTenant?: TenantSelector;\n  /** Base domain for the default selector. Defaults to `TENANT_BASE_DOMAIN`. */\n  readonly tenantBaseDomain?: string;\n  /** Session handler tuning. `enterTenantContext` is always `true`. */\n  readonly session?: SmrtRuntimeSessionOptions;\n  /** Per-class overrides layered over the runtime database config. */\n  readonly classOverrides?: Readonly<Record<string, Partial<SmrtClassOptions>>>;\n  /** Call `enableTenancy()` if it is not already enabled. Default true. */\n  readonly enableTenancy?: boolean;\n  /**\n   * Receives an owner-bootstrap invitation that this process's startup newly\n   * issued (the plaintext is returned exactly once; only its HMAC is stored).\n   * Use it to show a loopback `/setup?token=` URL. Errors are ignored so a\n   * failing presenter never blocks startup. Default: not presented.\n   */\n  readonly onBootstrapInvitation?: (\n    invitation: LocalOwnerBootstrapInvitation,\n    context: { readonly bindHost: string },\n  ) => void;\n  /** Testable clock for the local runtime. */\n  readonly now?: () => Date;\n}\n\n/** Cookie attributes for a session established outside the session handler. */\nexport interface SmrtRuntimeSessionCookie {\n  readonly name: string;\n  readonly path: string;\n  readonly domain?: string;\n  readonly sameSite: 'strict' | 'lax' | 'none';\n  /** `undefined` means \"secure when the request is HTTPS\". */\n  readonly secure?: boolean;\n  readonly maxAgeSeconds: number;\n}\n\n/** The composed runtime; `handle` and `init` are bound and destructurable. */\n/** A principal a route authenticated itself, for {@link SmrtSvelteKitRuntime.runAsPrincipal}. */\nexport interface SmrtRuntimeBoundPrincipal {\n  readonly id: string;\n  readonly tenantId?: string | null;\n  /** Granted scopes that cap the live permission set (e.g. token scopes). */\n  readonly scopes?: readonly string[];\n}\n\nexport interface SmrtSvelteKitRuntime {\n  /** `hooks.server.ts` `handle`. */\n  readonly handle: Handle;\n  /** `hooks.server.ts` `init`: the fail-closed startup gate. */\n  readonly init: ServerInit;\n  /** Session cookie attributes shared with owner setup. */\n  readonly sessionCookie: SmrtRuntimeSessionCookie;\n  /** Resolve the runtime profile (memoized; retried after failure). */\n  resolvedRuntime(): Promise<ResolvedApplicationRuntime>;\n  /** Await profile-specific startup (same promise as `init`). */\n  ready(): Promise<void>;\n  /** Canonical application ID. */\n  applicationId(): string;\n  /** Secret-free configuration fingerprint. Requires a resolved runtime. */\n  configurationFingerprint(): string;\n  /**\n   * Database for SMRT collections. Requires a resolved runtime. Inside a\n   * request running in the RLS transaction (`database-rls` isolation, or\n   * `session.postgresRls`) this is the transaction-bound request database;\n   * otherwise the base configuration. Call it per request and never retain\n   * the result (or collections built from it) beyond that request.\n   */\n  databaseConfig(): SmrtClassOptions['db'];\n  /**\n   * Collection options for a class: {@link databaseConfig} plus\n   * `classOverrides`. A class whose override sets `db` keeps that database.\n   * Same per-request rule as {@link databaseConfig}.\n   */\n  classOptions(className: string): SmrtClassOptions;\n  /**\n   * Run `fn` as a principal the route verified itself (for example a bearer\n   * token mapped by an MCP route), replacing the cookie session's permission\n   * context for that call. The principal's permissions are resolved live from\n   * its membership in `tenantId` and, when `scopes` is given, capped to it;\n   * under the RLS transaction rule of {@link databaseConfig} a fresh\n   * transaction publishes that user, tenant and permission set, and\n   * `databaseConfig()`/`classOptions()` return it inside `fn`. Rejects (before\n   * `fn` runs) without a user id, a tenant, or an authorized membership.\n   *\n   * `fn` receives the principal with `scopes` replaced by that effective\n   * permission set (live permissions, capped by the given scopes). Callers\n   * that authorize in code (rather than through database policy, as under\n   * `application` isolation) must authorize with these effective scopes so a\n   * revoked permission takes effect even while a token still carries it.\n   */\n  runAsPrincipal<\n    T,\n    P extends SmrtRuntimeBoundPrincipal = SmrtRuntimeBoundPrincipal,\n  >(\n    principal: P,\n    fn: (bound: P & { scopes: string[] }) => Promise<T>,\n  ): Promise<T>;\n  /** The local runtime. Rejects outside the `local` profile. */\n  localRuntime(): Promise<LocalApplicationRuntime>;\n  /** The deployed runtime. Rejects in the `local` profile. */\n  deployedRuntime(): Promise<DeployedApplicationRuntime>;\n  /** Liveness body for the health route (awaits startup). */\n  health(): Promise<RuntimeHealthBody>;\n  /**\n   * Read private runtime state and project it onto the public allowlist.\n   * Call only after the route has authenticated and authorized its caller.\n   */\n  readDiagnostics(\n    options: ApplicationRuntimeDiagnosticsOptions,\n  ): Promise<RuntimeDiagnostics>;\n}\n\n/** @internal Test and composition seams; not part of the public entry. */\nexport interface SmrtSvelteKitRuntimeSeams {\n  readonly initializeLocal?: typeof initializeLocalApplicationRuntime;\n  readonly initializeDeployed?: typeof initializeDeployedApplicationRuntime;\n  readonly loadRuntime?: () => Promise<ResolvedApplicationRuntime>;\n}\n\nconst DEFAULT_SESSION_TTL_SECONDS = 7 * 24 * 60 * 60;\n\n/**\n * Compose runtime startup, tenant selection, the signed session, and\n * authorized-tenant locals into a SvelteKit `{ handle, init }` pair.\n *\n * @example\n * ```ts\n * // src/hooks.server.ts\n * import { createSmrtSvelteKitRuntime } from '@happyvertical/smrt-app-runtime/sveltekit';\n *\n * export const runtime = createSmrtSvelteKitRuntime();\n * export const { handle, init } = runtime;\n * ```\n */\nexport function createSmrtSvelteKitRuntime(\n  options: SmrtSvelteKitRuntimeOptions = {},\n): SmrtSvelteKitRuntime {\n  return composeSmrtSvelteKitRuntime(options, {});\n}\n\n/** @internal */\nexport function composeSmrtSvelteKitRuntime(\n  options: SmrtSvelteKitRuntimeOptions,\n  seams: SmrtSvelteKitRuntimeSeams,\n): SmrtSvelteKitRuntime {\n  const env = options.env ?? process.env;\n  const sourceRoot = options.sourceRoot ?? process.cwd();\n  const dataDirectory = options.dataDirectory ?? env.SMRT_DATA_DIR;\n  const initializeLocal =\n    seams.initializeLocal ?? initializeLocalApplicationRuntime;\n  const initializeDeployed =\n    seams.initializeDeployed ?? initializeDeployedApplicationRuntime;\n\n  if (options.enableTenancy !== false && !isTenancyEnabled()) {\n    enableTenancy();\n  }\n\n  let appId: string | undefined;\n  const applicationId = (): string => {\n    appId ??= options.appId\n      ? validateApplicationId(options.appId)\n      : resolveApplicationId({ sourceRoot, explicitId: env.SMRT_APP_ID });\n    return appId;\n  };\n\n  let resolved: ResolvedApplicationRuntime | undefined;\n  let resolvedPromise: Promise<ResolvedApplicationRuntime> | undefined;\n  const resolvedRuntime = (): Promise<ResolvedApplicationRuntime> => {\n    resolvedPromise ??= (async () => {\n      const value =\n        typeof options.runtime === 'function'\n          ? await options.runtime()\n          : (options.runtime ??\n            (await (seams.loadRuntime ?? loadConfiguredRuntime)()));\n      resolved = value;\n      return value;\n    })().catch((error: unknown) => {\n      resolvedPromise = undefined;\n      throw error;\n    });\n    return resolvedPromise;\n  };\n\n  const requireResolved = (): ResolvedApplicationRuntime => {\n    if (!resolved) {\n      throw new Error(\n        'The SMRT application runtime is not resolved yet; await init() first.',\n      );\n    }\n    return resolved;\n  };\n\n  /** Base (connection-level) database config; never request-scoped. */\n  const baseDatabaseConfig = (): SmrtClassOptions['db'] => {\n    const runtime = requireResolved();\n    if (runtime.profile === 'local') {\n      const paths = resolveLocalRuntimePaths({\n        appId: applicationId(),\n        dataDirectory,\n        sourceRoot,\n        env,\n      });\n      return { type: 'sqlite', url: paths.database };\n    }\n    const databaseUrl = env.DATABASE_URL;\n    if (!databaseUrl) {\n      throw new Error(`${runtime.profile} requires DATABASE_URL.`);\n    }\n    return { type: 'postgres', url: databaseUrl };\n  };\n\n  /** Base collection options; used for anything that outlives a request. */\n  const baseClassOptions = (className: string): SmrtClassOptions => {\n    const defaults: SmrtClassOptions = { db: baseDatabaseConfig() };\n    const override = options.classOverrides?.[className];\n    return override ? { ...defaults, ...override } : defaults;\n  };\n\n  /**\n   * Inside a request running in the RLS transaction, the transaction-bound\n   * request database (it carries the `smrt.*` session variables); otherwise\n   * undefined. Never cache the returned handle beyond the request.\n   */\n  const rlsRequestDatabase = (): SmrtClassOptions['db'] | undefined => {\n    const context = getCurrentSessionPermissionContext();\n    if (context?.postgresRls !== true) return undefined;\n    return (getRequestScopedDatabase() ?? undefined) as\n      | SmrtClassOptions['db']\n      | undefined;\n  };\n\n  const databaseConfig = (): SmrtClassOptions['db'] =>\n    rlsRequestDatabase() ?? baseDatabaseConfig();\n\n  const classOptions = (className: string): SmrtClassOptions => {\n    const base = baseClassOptions(className);\n    if (options.classOverrides?.[className]?.db !== undefined) return base;\n    const requestDb = rlsRequestDatabase();\n    return requestDb ? { ...base, db: requestDb } : base;\n  };\n\n  let localPromise: Promise<LocalApplicationRuntime> | undefined;\n  let localLease: WriterLease | undefined;\n  const localRuntime = async (): Promise<LocalApplicationRuntime> => {\n    const runtime = await resolvedRuntime();\n    if (runtime.profile !== 'local') {\n      throw new Error(\n        'Owner bootstrap is available only in the local profile.',\n      );\n    }\n    if (localPromise) return localPromise;\n    const bindHost =\n      options.bindHost ||\n      env.HOST ||\n      (env.NODE_ENV === 'development' ? '127.0.0.1' : null);\n    if (!bindHost) {\n      throw new Error(\n        'Local production startup requires an explicit loopback HOST; use pnpm app:start.',\n      );\n    }\n    const id = applicationId();\n    localLease ??= options.acquireWriterLease?.({\n      appId: id,\n      dataDirectory,\n      sourceRoot,\n    });\n    localPromise = initializeLocal({\n      appId: id,\n      dataDirectory,\n      sourceRoot,\n      env,\n      bindHost,\n      providers: {\n        database: runtime.providers.database,\n        authentication: runtime.providers.authentication,\n        tenancy: runtime.providers.tenancy,\n        assets: runtime.providers.assets,\n        secrets: runtime.providers.secrets,\n        jobs: runtime.providers.jobs,\n        network: runtime.providers.network,\n      },\n      backgroundJobs:\n        options.backgroundJobs ?? env.SMRT_BACKGROUND_JOBS === 'true',\n      paidCapabilities: options.paidCapabilities,\n      bootstrapTtlSeconds: options.bootstrapTtlSeconds,\n      sessionTtlSeconds: options.sessionTtlSeconds,\n      prepareDatabase: options.prepareDatabase,\n      now: options.now,\n    })\n      .then(({ runtime: initialized, bootstrap }) => {\n        if (bootstrap) {\n          try {\n            options.onBootstrapInvitation?.(bootstrap, { bindHost });\n          } catch {\n            // Presentation is best effort; the invitation stays claimable.\n          }\n        }\n        return initialized;\n      })\n      .catch((error: unknown) => {\n        localLease?.release();\n        localLease = undefined;\n        localPromise = undefined;\n        throw error;\n      });\n    return localPromise;\n  };\n\n  let deployedPromise: Promise<DeployedApplicationRuntime> | undefined;\n  const deployedRuntime = async (): Promise<DeployedApplicationRuntime> => {\n    const runtime = await resolvedRuntime();\n    if (runtime.profile === 'local') {\n      throw new Error('deployed_runtime_unavailable');\n    }\n    const profile = runtime.profile as DeployedApplicationRuntimeProfile;\n    const databaseUrl = env.DATABASE_URL;\n    if (!databaseUrl) {\n      throw new Error(`${profile} requires DATABASE_URL.`);\n    }\n    const authenticationProvider = runtime.providers.authentication.provider;\n    if (authenticationProvider === 'owner-bootstrap') {\n      throw new Error('Deployed profiles require public authentication.');\n    }\n    const readiness = options.providerReadiness;\n    if (!readiness) {\n      throw new Error(\n        `${profile} requires providerReadiness probes for authentication, assets, and secrets.`,\n      );\n    }\n    deployedPromise ??= initializeDeployed({\n      profile,\n      providers: {\n        database: runtime.providers.database,\n        authentication: runtime.providers.authentication,\n        tenancy: runtime.providers.tenancy,\n        assets: runtime.providers.assets,\n        secrets: runtime.providers.secrets,\n        jobs: runtime.providers.jobs,\n        network: runtime.providers.network,\n      },\n      database: {\n        engine: 'postgres',\n        connect: () => getDatabase({ type: 'postgres', url: databaseUrl }),\n        close: async (db) => {\n          await db.close?.();\n        },\n      },\n      authentication: {\n        provider: authenticationProvider as PublicAuthenticationProvider,\n        readiness: readiness('authentication', {\n          profile,\n          provider: authenticationProvider,\n        }),\n      },\n      assets: {\n        provider: runtime.providers.assets.provider,\n        readiness: readiness('assets', {\n          profile,\n          provider: runtime.providers.assets.provider,\n        }),\n      },\n      secrets: {\n        provider: runtime.providers.secrets.provider,\n        readiness: readiness('secrets', {\n          profile,\n          provider: runtime.providers.secrets.provider,\n        }),\n      },\n      prepareDatabase: options.prepareDatabase,\n    });\n    return deployedPromise;\n  };\n\n  const ready = async (): Promise<void> => {\n    const runtime = await resolvedRuntime();\n    if (runtime.profile === 'local') {\n      await localRuntime();\n      return;\n    }\n    await deployedRuntime();\n  };\n\n  const configurationFingerprint = (): string =>\n    runtimeConfigurationFingerprint(requireResolved(), env);\n\n  const health = async (): Promise<RuntimeHealthBody> => {\n    await ready();\n    const runtime = requireResolved();\n    const publicHealth = {\n      schemaVersion: 1 as const,\n      status: 'ready' as const,\n      profile: runtime.profile,\n    };\n    return runtime.profile === 'local'\n      ? {\n          ...publicHealth,\n          application: applicationId(),\n          instance: env.SMRT_PROCESS_INSTANCE || null,\n          configuration: configurationFingerprint(),\n        }\n      : publicHealth;\n  };\n\n  const readDiagnostics = async (\n    diagnosticsOptions: ApplicationRuntimeDiagnosticsOptions,\n  ): Promise<RuntimeDiagnostics> => {\n    await ready();\n    const runtime = requireResolved();\n    const schema = {\n      status: diagnosticsOptions.schemaStatus ?? 'unknown',\n      migrations: diagnosticsOptions.migrationStatus ?? 'unknown',\n    } as const;\n\n    if (runtime.profile === 'local') {\n      const local = await localRuntime();\n      const diagnostics = await local.diagnostics();\n      return projectRuntimeDiagnostics({\n        profile: 'local',\n        health: 'healthy',\n        schema,\n        capabilities: {\n          'asset-storage': 'available',\n          authentication: 'available',\n          'background-jobs': diagnostics.jobs.backgroundEnabled\n            ? 'available'\n            : 'disabled',\n          database: 'available',\n          'paid-capabilities': diagnostics.paidCapabilitiesEnabled\n            ? 'available'\n            : 'disabled',\n          'secret-storage': 'available',\n        },\n        toolNames: diagnosticsOptions.toolNames,\n        worker: {\n          topology: diagnostics.jobs.topology,\n          required: diagnostics.jobs.backgroundEnabled,\n          heartbeatAt: diagnosticsOptions.workerHeartbeatAt,\n        },\n        recentErrors: diagnosticsOptions.recentErrors,\n        observedAt: diagnosticsOptions.observedAt,\n      });\n    }\n\n    const deployed = await deployedPromise;\n    if (!deployed) throw new Error('deployed_runtime_unavailable');\n    const readiness = await deployed.readiness();\n    const componentStatus = (\n      component: keyof typeof readiness.components,\n    ): 'available' | 'unavailable' =>\n      readiness.components[component].status === 'ready'\n        ? 'available'\n        : 'unavailable';\n    const input: RuntimeDiagnosticsProjectionInput = {\n      profile: runtime.profile,\n      health:\n        deployed.health().status === 'healthy'\n          ? readiness.status === 'ready'\n            ? 'healthy'\n            : 'degraded'\n          : 'stopped',\n      schema,\n      capabilities: {\n        'asset-storage': componentStatus('assets'),\n        authentication: componentStatus('authentication'),\n        'background-jobs': 'available',\n        database: componentStatus('database'),\n        'paid-capabilities': 'unknown',\n        'secret-storage': componentStatus('secrets'),\n      },\n      toolNames: diagnosticsOptions.toolNames,\n      worker: {\n        topology: deployed.resolvedRuntime.providers.jobs.topology,\n        required: true,\n        heartbeatAt: diagnosticsOptions.workerHeartbeatAt,\n      },\n      recentErrors: diagnosticsOptions.recentErrors,\n      observedAt: diagnosticsOptions.observedAt,\n    };\n    return projectRuntimeDiagnostics(input);\n  };\n\n  const selectTenant: TenantSelector =\n    options.selectTenant ??\n    createSubdomainTenantSelector({\n      baseDomain: options.tenantBaseDomain ?? env.TENANT_BASE_DOMAIN,\n      classOptions: () => baseClassOptions('Tenant'),\n    });\n\n  const readinessHandle: Handle = async ({ event, resolve }) => {\n    await ready();\n    return resolve(event);\n  };\n\n  const tenantSelectionHandle: Handle = async ({ event, resolve }) => {\n    const locals = runtimeLocals(event.locals);\n    const selection = normalizeTenantSelection(\n      await selectTenant({ url: event.url, request: event.request }),\n    );\n    locals.selectedTenantId = selection.tenantId;\n    locals.selectedTenantSlug = selection.tenantSlug;\n    return resolve(event);\n  };\n\n  const sessionCookieName = options.session?.cookieName ?? 'sid';\n  const sessionSkipPaths = options.session?.skipPaths ?? [];\n  const sessionServiceOptions = (): SessionServiceOptions => ({\n    ...baseClassOptions('Session'),\n    ...options.session,\n    defaultTTL: options.session?.ttl ?? DEFAULT_SESSION_TTL_SECONDS,\n    autoExtend: options.session?.autoExtend ?? false,\n  });\n  /** `database-rls` isolation always runs the request RLS transaction. */\n  const postgresRls = (): boolean | undefined =>\n    requireResolved().providers.tenancy.isolation === 'database-rls'\n      ? true\n      : options.session?.postgresRls;\n  let permissionResolverPromise: Promise<PermissionResolver> | undefined;\n  const permissionResolver = (): Promise<PermissionResolver> => {\n    permissionResolverPromise ??= PermissionResolver.create(\n      baseClassOptions('Permission'),\n    ).catch((error: unknown) => {\n      permissionResolverPromise = undefined;\n      throw error;\n    });\n    return permissionResolverPromise;\n  };\n\n  const runAsPrincipal = async <\n    T,\n    P extends SmrtRuntimeBoundPrincipal = SmrtRuntimeBoundPrincipal,\n  >(\n    principal: P,\n    fn: (bound: P & { scopes: string[] }) => Promise<T>,\n  ): Promise<T> => {\n    const userId = principal?.id;\n    const tenantId = principal?.tenantId;\n    if (typeof userId !== 'string' || userId.length === 0) {\n      throw new Error('A bound principal requires a user id.');\n    }\n    if (typeof tenantId !== 'string' || tenantId.length === 0) {\n      throw new Error('A bound principal requires a tenant.');\n    }\n    // Resolution reads the base connection, before any RLS transaction opens.\n    const resolved = await (await permissionResolver()).resolvePermissions(\n      userId,\n      tenantId,\n    );\n    if (!resolved.membershipId) {\n      throw new Error('The bound principal has no membership in its tenant.');\n    }\n    const cap = principal.scopes ? new Set(principal.scopes) : undefined;\n    const permissions = [...resolved.permissions].filter(\n      (permission) => !cap || cap.has(permission),\n    );\n    return withPrincipalPermissionContext(\n      {\n        ...baseClassOptions('Session'),\n        userId,\n        tenantId,\n        permissions,\n        enterTenantContext: true,\n        postgresRls: postgresRls(),\n      },\n      () => fn({ ...principal, scopes: [...permissions] }),\n    );\n  };\n\n  let sessionServicePromise: Promise<SessionService> | undefined;\n  const sessionService = (): Promise<SessionService> => {\n    sessionServicePromise ??= (async () => {\n      const service = new TenantAuthorizingSessionService(\n        sessionServiceOptions(),\n        requireResolved().providers.tenancy.context === 'required',\n      );\n      await service.initialize();\n      return service;\n    })().catch((error: unknown) => {\n      sessionServicePromise = undefined;\n      throw error;\n    });\n    return sessionServicePromise;\n  };\n\n  /**\n   * Step 2. Downstream code runs at most once: a downstream throw (or a\n   * failure after `resolve` was entered, such as an RLS commit) propagates\n   * unchanged and `resolve` is never re-entered. A session-layer failure\n   * before `resolve` fails closed with 500 and no authenticated locals, for\n   * both RLS and non-RLS isolation.\n   */\n  const sessionStep: Handle = async ({ event, resolve }) => {\n    const locals = runtimeLocals(event.locals);\n    clearSessionLocals(locals);\n    const rls = postgresRls();\n    // A skipped path skips session loading only. Under RLS it still runs in\n    // the request transaction, as an anonymous principal.\n    const skipped = sessionSkipPaths.some((path) =>\n      event.url.pathname.startsWith(path),\n    );\n    if (skipped && !rls) return resolve(event);\n    const sessionId = skipped\n      ? undefined\n      : event.cookies.get(sessionCookieName);\n    if (!sessionId && !rls) return resolve(event);\n\n    let resolveEntered = false;\n    let downstream: { error: unknown } | undefined;\n    try {\n      const service = await sessionService();\n      return await withSessionPermissionContext(\n        {\n          ...sessionServiceOptions(),\n          enterTenantContext: true,\n          postgresRls: rls,\n          sessionId: sessionId ?? null,\n          sessionService: service,\n        },\n        async (context) => {\n          if (context.session) {\n            locals.user = context.user;\n            locals.membership = context.membership ?? null;\n            locals.permissions = context.permissions;\n            locals.tenantId = context.tenantId;\n            locals.sessionId = context.sessionId;\n            if (context.tenantId) {\n              verifiedSessionTenants.set(locals, context.tenantId);\n            }\n          }\n          resolveEntered = true;\n          try {\n            return await resolve(event);\n          } catch (error) {\n            downstream = { error };\n            throw error;\n          }\n        },\n      );\n    } catch (error) {\n      if (downstream) throw downstream.error;\n      if (resolveEntered) throw error;\n      clearSessionLocals(locals);\n      return new Response('Internal Server Error', { status: 500 });\n    }\n  };\n\n  const sessionCookie: SmrtRuntimeSessionCookie = Object.freeze({\n    name: options.session?.cookieName ?? 'sid',\n    path: options.session?.cookiePath ?? '/',\n    ...(options.session?.cookieDomain\n      ? { domain: options.session.cookieDomain }\n      : {}),\n    sameSite: options.session?.cookieSameSite ?? 'lax',\n    ...(options.session?.cookieSecure !== undefined\n      ? { secure: options.session.cookieSecure }\n      : {}),\n    maxAgeSeconds: options.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS,\n  });\n\n  const init: ServerInit = () => ready();\n\n  return Object.freeze({\n    handle: composeHandles(\n      readinessHandle,\n      tenantSelectionHandle,\n      sessionStep,\n      authorizedTenantLocalsHandle,\n    ),\n    init,\n    sessionCookie,\n    resolvedRuntime,\n    ready,\n    applicationId,\n    configurationFingerprint,\n    databaseConfig,\n    classOptions,\n    runAsPrincipal,\n    localRuntime,\n    deployedRuntime,\n    health,\n    readDiagnostics,\n  });\n}\n\n/** Locals whose session tenant passed {@link isSessionTenantAuthorized}. */\nconst verifiedSessionTenants = new WeakMap<object, string>();\n\n/**\n * Session service whose loaded context carries a tenant only when that\n * tenant passed {@link isSessionTenantAuthorized}. A session bound to an\n * unauthorized tenant (or missing a required tenant) loads as no session, so\n * no identity, permissions, or tenant context is established for it.\n */\nclass TenantAuthorizingSessionService extends SessionService {\n  private readonly tenantRequired: boolean;\n\n  constructor(options: SessionServiceOptions, tenantRequired: boolean) {\n    super(options);\n    this.tenantRequired = tenantRequired;\n  }\n\n  override async loadSessionContext(\n    sessionId: string,\n  ): ReturnType<SessionService['loadSessionContext']> {\n    const context = await super.loadSessionContext(sessionId);\n    if (!context) return null;\n    if (typeof context.tenantId === 'string' && context.tenantId.length > 0) {\n      return isSessionTenantAuthorized(context) ? context : null;\n    }\n    return this.tenantRequired ? null : context;\n  }\n}\n\nfunction clearSessionLocals(locals: SmrtRuntimeLocals): void {\n  locals.user = null;\n  locals.membership = null;\n  locals.permissions = [];\n  locals.tenantId = null;\n  locals.sessionId = null;\n  locals.tenantContext = undefined;\n  verifiedSessionTenants.delete(locals);\n}\n\n/**\n * Step 3: publish the authorized tenant context only when this runtime's\n * session step verified the session tenant and it matches the active\n * AsyncLocalStorage context. Locals populated by any other session layer are\n * never published.\n */\nexport const authorizedTenantLocalsHandle: Handle = async ({\n  event,\n  resolve,\n}) => {\n  const locals = runtimeLocals(event.locals);\n  const activeContext = getCurrentTenant();\n  if (\n    locals.user &&\n    locals.tenantId &&\n    verifiedSessionTenants.get(locals) === locals.tenantId &&\n    activeContext?.tenantId === locals.tenantId\n  ) {\n    locals.tenantContext = activeContext;\n  }\n  return resolve(event);\n};\n\n/**\n * Run handles in order. Unlike `sequence()` from `@sveltejs/kit/hooks`, this\n * needs no SvelteKit request store, so the composed handle is usable (and\n * testable) outside the Kit server runtime. The runtime's own handles never\n * pass resolve options; any options a handle passes are forwarded unchanged.\n */\nexport function composeHandles(...handles: readonly Handle[]): Handle {\n  return ({ event, resolve }) => {\n    const run: (\n      index: number,\n      current: Parameters<Handle>[0]['event'],\n      resolveOptions?: Parameters<Parameters<Handle>[0]['resolve']>[1],\n    ) => ReturnType<Handle> = (index, current, resolveOptions) => {\n      const next = handles[index];\n      if (!next) return resolve(current, resolveOptions);\n      return next({\n        event: current,\n        resolve: (nextEvent, nextOptions) =>\n          run(index + 1, nextEvent, nextOptions ?? resolveOptions),\n      });\n    };\n    return run(0, event);\n  };\n}\n\nfunction runtimeLocals(locals: unknown): SmrtRuntimeLocals {\n  return locals as SmrtRuntimeLocals;\n}\n\nasync function loadConfiguredRuntime(): Promise<ResolvedApplicationRuntime> {\n  const loaded = await loadConfig();\n  return loaded.runtime\n    ? resolveConfiguredApplicationRuntime()\n    : resolveApplicationRuntime({ profile: 'local' });\n}\n"],"mappings":";;;;;;;AAiBO,IAAM,sCAAsC;AAU5C,SAAS,2BACd,SACgB;CAChB,OAAO,YAAY,KAAK,MAAM,QAAQ,OAAO,CAAC;AAChD;AA8CA,SAAS,kBACP,OACe;CACf,OAAO,OAAO,UAAU,aAAc,MAAkB,IAAI;AAC9D;AAWO,SAAS,gCACd,SACgB;CAChB,MAAM,UAAU,QAAQ;CACxB,MAAM,kBACJ,QAAQ,oBACP,gBAEK,QAAQ,gBAAgB;EACtB,WAAW,kBAAkB,QAAQ,SAAS,KAAK,CAAC;EACpD,YAAY,QAAQ,MAAM,qBAAK,IAAI,KAAK;EACxC,cAAc,kBAAkB,QAAQ,YAAY,KAAK;EACzD,iBACE,kBAAkB,QAAQ,eAAe,KAAK;EAChD,mBAAmB,QAAQ,oBAAoB,KAAK;EACpD,cAAc,QAAQ,eAAe,KAAK,CAAC;CAC7C,CAAC,IACH,KAAA;CACN,MAAM,kBACJ,QAAQ,oBACP,UACG,OAAO,WAAmB;EACxB,MAAM,SAAS,QAAQ,aAAa,MAAM;EAC1C,MAAM,YAAY,yBAAyB;EAM3C,QAAQ,OAAM,MALM,eAAe,OACjC,YACI;GAAE,GAAG;GAAQ,IAAI;EAA8B,IAC/C,MACN,EAAA,CACoB,SAAS,MAAM,EAAA,EAAI,QAAQ;CACjD,IACA,KAAA;CACN,IAAI,CAAC,mBAAmB,CAAC,iBACvB,MAAM,IAAI,UACR,sGACF;CAEF,MAAM,gBACJ,QAAQ,mBACN,UACA,MAAM;CAEV,OAAO,OAAO,UAAU;EACtB,MAAM,SAAS,cAAc,KAAK;EAClC,MAAM,YAAY,uBAAuB,MAAM;EAC/C,IAAI,CAAC,WAAW,OAAO,YAAY,KAAK,yBAAyB;EAEjE,IAAI,aACF,OAAO,aAAa,SAAS,mCAAmC,MAChE;EACF,IAAI,CAAC,YACH,IAAI;GACF,aAAc,MAAM,gBAAgB,UAAU,MAAM,MAAO;EAC7D,QAAQ;GACN,aAAa;EACf;EAEF,IAAI,CAAC,YAAY,OAAO,YAAY,KAAK,sBAAsB;EAE/D,IAAI;GACF,OAAO,KAAK,MAAM,gBAAgB,CAAC;EACrC,QAAQ;GACN,OAAO,YAAY,KAAK,yBAAyB;EACnD;CACF;AACF;AAEA,SAAS,uBACP,QAC2B;CAC3B,MAAM,SAAS,QAAQ,MAAM;CAC7B,MAAM,WAAW,QAAQ;CACzB,MAAM,YAAY,QAAQ;CAC1B,MAAM,aAAa,QAAQ;CAC3B,IACE,OAAO,WAAW,YAClB,CAAC,UACD,OAAO,aAAa,YACpB,CAAC,YACD,OAAO,cAAc,YACrB,CAAC,aACD,CAAC,cACD,WAAW,WAAW,UACtB,WAAW,aAAa,YACxB,OAAO,WAAW,WAAW,YAC7B,CAAC,WAAW,QAEZ,OAAO;CAET,IAAI;EACF,IAAI,WAAW,WAAW,MAAM,MAAM,OAAO;CAC/C,QAAQ;EACN,OAAO;CACT;CACA,OAAO,EAAE,QAAQ,WAAW,OAAO;AACrC;AAEA,SAAS,YAAY,QAAgB,MAAwB;CAC3D,OAAO,KAAK;EAAE,eAAe;EAAG,OAAO,EAAE,KAAK;CAAE,GAAG,EAAE,OAAO,CAAC;AAC/D;AAiBO,SAAS,0BAEQ;CACtB,QAAQ,EAAE,aAAa;EACrB,MAAM,QAAQ;EAKd,OAAO,EACL,SAAS;GACP,eAAe,QAAQ,MAAM,IAAI;GACjC,gBAAgB,MAAM,YAAY;GAClC,oBAAoB,MAAM,sBAAsB;EAClD,EACF;CACF;AACF;;;ACxLO,IAAM,qBAAqB,OAAO,OAAO;CAC9C,OAAO;CACP,MAAM;CACN,OAAO;CACP,YAAY;AACd,CAAU;AAEH,IAAM,+BAET,OAAO,OAAO;CAChB,gBAAgB;CAChB,mBAAmB;CACnB,qBAAqB;CACrB,eACE;AACJ,CAAC;AAuDM,SAAS,qBACd,SAIA,UAAiC,CAAC,GAClB;CAChB,MAAM,aAAa,QAAQ,cAAc;CACzC,MAAM,WAAW;EAAE,GAAG;EAA8B,GAAG,QAAQ;CAAS;CACxE,MAAM,WAAW,QAAgB,SAC/B,KAAK,QAAQ;EAAE;EAAM,SAAS,SAAS;CAAM,CAAsB;CACrE,MAAM,cACJ,QAAQ,iBACN,UAA4B,MAAM,OAA8B;CAEpE,MAAM,OAAO,OAAO,UAAwD;EAC1E,IAAI,YAAY,KAAK,GAAG,SAAS,KAAK,UAAU;EAEhD,KAAI,MADmB,QAAQ,gBAAgB,EAAA,CAClC,YAAY,WAAW,CAAC,kBAAkB,KAAK,GAC1D,OAAO;GAAE,WAAW;GAAO,OAAO;EAAG;EAIvC,MAAM,aAAY,OADQ,MADN,QAAQ,aAAa,EAAA,CACT,YAAY,EAAA,CACd,UAAU,WAAW;EACnD,OAAO;GACL;GACA,OAAO,YACH,MAAM,IAAI,aAAa,IAAI,mBAAmB,KAAK,KAAK,KACxD;EACN;CACF;CAEA,MAAM,QAAQ,OACZ,UAC8C;EAE9C,KAAI,MADmB,QAAQ,gBAAgB,EAAA,CAClC,YAAY,SAAS,OAAO,QAAQ,KAAK,gBAAgB;EACtE,IAAI,CAAC,kBAAkB,KAAK,GAAG,OAAO,QAAQ,KAAK,mBAAmB;EAEtE,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,MAAM,QAAQ,SAAS;EACtC,QAAQ;GACN,OAAO,QAAQ,KAAK,qBAAqB;EAC3C;EACA,MAAM,SAASA,UAAiB;GAC9B,MAAM,QAAQ,KAAK,IAAIA,KAAI;GAC3B,OAAO,OAAO,UAAU,WAAW,QAAQ;EAC7C;EACA,MAAM,QAAQ,MAAM,mBAAmB,KAAK;EAC5C,MAAM,OAAO,MAAM,mBAAmB,IAAI;EAC1C,MAAM,QAAQ,MAAM,mBAAmB,KAAK;EAC5C,MAAM,aAAa,MAAM,mBAAmB,UAAU,CAAA,CAAE,KAAK;EAC7D,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,SAAS,GAAG,GAC/C,OAAO,QAAQ,KAAK,qBAAqB;EAG3C,MAAM,QAAQ,MAAM,QAAQ,aAAa;EACzC,IAAI;EACJ,IAAI;GACF,SAAS,MAAM,MAAM,WAAW;IAC9B;IACA;IACA;IACA,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;IACnC,WAAW,MAAM,QAAQ,QAAQ,IAAI,YAAY,KAAK,KAAA;IACtD,WAAW,MAAM,iBAAiB;GACpC,CAAC;EACH,QAAQ;GACN,OAAO,QAAQ,KAAK,eAAe;EACrC;EAEA,MAAM,SAAS,QAAQ;EACvB,MAAM,QAAQ,IAAI,OAAO,MAAM,OAAO,WAAW;GAC/C,MAAM,OAAO;GACb,GAAI,OAAO,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;GACjD,UAAU;GACV,QAAQ,OAAO,UAAU,MAAM,IAAI,aAAa;GAChD,UAAU,OAAO;GACjB,QAAQ,OAAO;EACjB,CAAC;EACD,IAAI;GACF,MAAM,QAAQ,iBAAiB,QAAQ,KAAK;EAC9C,QAAQ,CAER;EACA,SAAS,KAAK,UAAU;CAC1B;CAEA,OAAO,OAAO,OAAO;EACnB;EACA,SAAS,OAAO,OAAO,EAAE,SAAS,MAAM,CAAC;CAC3C,CAAC;AACH;AAOO,SAAS,kBAAkB,OAGtB;CACV,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,iBAAiB;CACnC,QAAQ;EACN,OAAO;CACT;CACA,OAAO,kBAAkB,OAAO,KAAK,mBAAmB,MAAM,IAAI,QAAQ;AAC5E;AAGO,SAAS,kBAAkB,OAA2C;CAC3E,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,OAAO,MACR,KAAK,CAAA,CACL,YAAY,CAAA,CACZ,QAAQ,YAAY,EAAE;CACzB,IAAI,SAAS,SAAS,SAAS,mBAAmB,OAAO;CACzD,IAAI,KAAK,WAAW,SAAS,GAAG,OAAO,KAAK,MAAM,CAAgB;CAClE,MAAM,SAAS,KAAK,MAAM,GAAG;CAC7B,OACE,OAAO,WAAW,KAClB,OAAO,OAAO,SAAS,YAAY,KAAK,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG,KACpE,OAAO,OAAO,EAAE,MAAM;AAE1B;AAGO,SAAS,mBAAmB,UAA2B;CAC5D,MAAM,OAAO,SAAS,KAAK,CAAA,CAAE,YAAY,CAAA,CAAE,QAAQ,OAAO,EAAE;CAC5D,OAAO,SAAS,eAAe,kBAAkB,IAAI;AACvD;;;AC5MA,IAAM,kCAAkB,IAAI,IAAI;CAAC;CAAa;CAAa;CAAO;AAAO,CAAC;AAC1E,IAAM,sCAAsB,IAAI,IAAI;CAAC;CAAO;CAAO;CAAO;AAAO,CAAC;AAClE,IAAM,eAAgC,OAAO,OAAO;CAClD,UAAU;CACV,YAAY;AACd,CAAC;AASM,SAAS,iBACd,KACA,aAAiC,QAAQ,IAAI,oBAC9B;CACf,MAAM,WAAW,IAAI,SAAS,YAAY;CAC1C,IACE,gBAAgB,IAAI,QAAQ,KAC5B,SAAS,WAAW,GAAG,KACvB,0BAA0B,KAAK,QAAQ,GAEvC,OAAO;CAGT,MAAM,iBAAiB,YACnB,KAAK,CAAA,CACN,YAAY,CAAA,CACZ,QAAQ,cAAc,EAAE;CAE3B,IAAI;CACJ,IAAI,gBAAgB;EAClB,IAAI,aAAa,gBAAgB,OAAO;EACxC,MAAM,SAAS,IAAI;EACnB,IAAI,CAAC,SAAS,SAAS,MAAM,GAAG,OAAO;EACvC,YAAY,SAAS,MAAM,GAAG,CAAC,OAAO,MAAM,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE;CAC3D,OAAO;EACL,MAAM,SAAS,SAAS,MAAM,GAAG;EACjC,IAAI,OAAO,SAAS,GAAG,OAAO;EAC9B,YAAY,OAAO;CACrB;CAEA,OAAO,aAAa,CAAC,oBAAoB,IAAI,SAAS,IAAI,YAAY;AACxE;AAEA,SAAS,qBAAqB,OAAyB;CACrD,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CAEtC,OADc,MAAoC,SAEvC,WACT,MAAM,QAAQ,SAAS,qCAAmC,KAC1D,MAAM,QAAQ,SAAS,wBAAwB;AAEnD;AAeO,SAAS,8BACd,SACgB;CAChB,OAAO,OAAO,UAAU;EACtB,MAAM,aAAa,iBAAiB,MAAM,KAAK,QAAQ,UAAU;EACjE,IAAI,CAAC,YAAY,OAAO;EACxB,IAAI;EACJ,IAAI;GAEF,MAAM,SAAS,OAAM,MADC,iBAAiB,OAAO,QAAQ,aAAa,CAAC,EAAA,CACvC,WAAW,UAAU;GAClD,WACE,QAAQ,WAAW,aAAa,SAAU,OAAO,MAAM,OAAQ;EACnE,SAAS,OAAO;GACd,IAAI,CAAC,qBAAqB,KAAK,GAAG,MAAM;GACxC,WAAW;EACb;EACA,OAAO;GAAE;GAAU;EAAW;CAChC;AACF;AAGO,SAAS,yBACd,WACiB;CASjB,OAAO;EAAE,UAPP,OAAO,WAAW,aAAa,YAAY,UAAU,WACjD,UAAU,WACV;EAKa,YAHjB,OAAO,WAAW,eAAe,YAAY,UAAU,aACnD,UAAU,aACV;CACwB;AAChC;;;ACkLA,IAAM,8BAA8B,QAAc;AAe3C,SAAS,2BACd,UAAuC,CAAC,GAClB;CACtB,OAAO,4BAA4B,SAAS,CAAC,CAAC;AAChD;AAGO,SAAS,4BACd,SACA,OACsB;CACtB,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,aAAa,QAAQ,cAAc,QAAQ,IAAI;CACrD,MAAM,gBAAgB,QAAQ,iBAAiB,IAAI;CACnD,MAAM,kBACJ,MAAM,mBAAmB;CAC3B,MAAM,qBACJ,MAAM,sBAAsB;CAE9B,IAAI,QAAQ,kBAAkB,SAAS,CAAC,iBAAiB,GACvD,cAAc;CAGhB,IAAI;CACJ,MAAM,sBAA8B;EAClC,UAAU,QAAQ,QACd,sBAAsB,QAAQ,KAAK,IACnC,qBAAqB;GAAE;GAAY,YAAY,IAAI;EAAY,CAAC;EACpE,OAAO;CACT;CAEA,IAAI;CACJ,IAAI;CACJ,MAAM,wBAA6D;EACjE,qBAAqB,YAAY;GAC/B,MAAM,QACJ,OAAO,QAAQ,YAAY,aACvB,MAAM,QAAQ,QAAQ,IACrB,QAAQ,WACR,OAAO,MAAM,eAAe,sBAAA,CAAuB;GAC1D,WAAW;GACX,OAAO;EACT,EAAA,CAAG,CAAA,CAAE,OAAO,UAAmB;GAC7B,kBAAkB,KAAA;GAClB,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,MAAM,wBAAoD;EACxD,IAAI,CAAC,UACH,MAAM,IAAI,MACR,uEACF;EAEF,OAAO;CACT;CAGA,MAAM,2BAAmD;EACvD,MAAM,UAAU,gBAAgB;EAChC,IAAI,QAAQ,YAAY,SAOtB,OAAO;GAAE,MAAM;GAAU,KANX,yBAAyB;IACrC,OAAO,cAAc;IACrB;IACA;IACA;GACF,CAC8B,CAAA,CAAM;EAAS;EAE/C,MAAM,cAAc,IAAI;EACxB,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,GAAG,QAAQ,QAAO,wBAAyB;EAE7D,OAAO;GAAE,MAAM;GAAY,KAAK;EAAY;CAC9C;CAGA,MAAM,oBAAoB,cAAwC;EAChE,MAAM,WAA6B,EAAE,IAAI,mBAAmB,EAAE;EAC9D,MAAM,WAAW,QAAQ,iBAAiB;EAC1C,OAAO,WAAW;GAAE,GAAG;GAAU,GAAG;EAAS,IAAI;CACnD;CAOA,MAAM,2BAA+D;EAEnE,IADgB,mCACZ,CAAA,EAAS,gBAAgB,MAAM,OAAO,KAAA;EAC1C,OAAQ,yBAAyB,KAAK,KAAA;CAGxC;CAEA,MAAM,uBACJ,mBAAmB,KAAK,mBAAmB;CAE7C,MAAM,gBAAgB,cAAwC;EAC5D,MAAM,OAAO,iBAAiB,SAAS;EACvC,IAAI,QAAQ,iBAAiB,UAAS,EAAG,OAAO,KAAA,GAAW,OAAO;EAClE,MAAM,YAAY,mBAAmB;EACrC,OAAO,YAAY;GAAE,GAAG;GAAM,IAAI;EAAU,IAAI;CAClD;CAEA,IAAI;CACJ,IAAI;CACJ,MAAM,eAAe,YAA8C;EACjE,MAAM,UAAU,MAAM,gBAAgB;EACtC,IAAI,QAAQ,YAAY,SACtB,MAAM,IAAI,MACR,yDACF;EAEF,IAAI,cAAc,OAAO;EACzB,MAAM,WACJ,QAAQ,YACR,IAAI,SACH,IAAI,aAAa,gBAAgB,cAAc;EAClD,IAAI,CAAC,UACH,MAAM,IAAI,MACR,kFACF;EAEF,MAAM,KAAK,cAAc;EACzB,eAAe,QAAQ,qBAAqB;GAC1C,OAAO;GACP;GACA;EACF,CAAC;EACD,eAAe,gBAAgB;GAC7B,OAAO;GACP;GACA;GACA;GACA;GACA,WAAW;IACT,UAAU,QAAQ,UAAU;IAC5B,gBAAgB,QAAQ,UAAU;IAClC,SAAS,QAAQ,UAAU;IAC3B,QAAQ,QAAQ,UAAU;IAC1B,SAAS,QAAQ,UAAU;IAC3B,MAAM,QAAQ,UAAU;IACxB,SAAS,QAAQ,UAAU;GAC7B;GACA,gBACE,QAAQ,kBAAkB,IAAI,yBAAyB;GACzD,kBAAkB,QAAQ;GAC1B,qBAAqB,QAAQ;GAC7B,mBAAmB,QAAQ;GAC3B,iBAAiB,QAAQ;GACzB,KAAK,QAAQ;EACf,CAAC,CAAA,CACE,MAAM,EAAE,SAAS,aAAa,gBAAgB;GAC7C,IAAI,WACF,IAAI;IACF,QAAQ,wBAAwB,WAAW,EAAE,SAAS,CAAC;GACzD,QAAQ,CAER;GAEF,OAAO;EACT,CAAC,CAAA,CACA,OAAO,UAAmB;GACzB,YAAY,QAAQ;GACpB,aAAa,KAAA;GACb,eAAe,KAAA;GACf,MAAM;EACR,CAAC;EACH,OAAO;CACT;CAEA,IAAI;CACJ,MAAM,kBAAkB,YAAiD;EACvE,MAAM,UAAU,MAAM,gBAAgB;EACtC,IAAI,QAAQ,YAAY,SACtB,MAAM,IAAI,MAAM,8BAA8B;EAEhD,MAAM,UAAU,QAAQ;EACxB,MAAM,cAAc,IAAI;EACxB,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,GAAG,QAAO,wBAAyB;EAErD,MAAM,yBAAyB,QAAQ,UAAU,eAAe;EAChE,IAAI,2BAA2B,mBAC7B,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,YAAY,QAAQ;EAC1B,IAAI,CAAC,WACH,MAAM,IAAI,MACR,GAAG,QAAO,4EACZ;EAEF,oBAAoB,mBAAmB;GACrC;GACA,WAAW;IACT,UAAU,QAAQ,UAAU;IAC5B,gBAAgB,QAAQ,UAAU;IAClC,SAAS,QAAQ,UAAU;IAC3B,QAAQ,QAAQ,UAAU;IAC1B,SAAS,QAAQ,UAAU;IAC3B,MAAM,QAAQ,UAAU;IACxB,SAAS,QAAQ,UAAU;GAC7B;GACA,UAAU;IACR,QAAQ;IACR,eAAe,YAAY;KAAE,MAAM;KAAY,KAAK;IAAY,CAAC;IACjE,OAAO,OAAO,OAAO;KACnB,MAAM,GAAG,QAAQ;IACnB;GACF;GACA,gBAAgB;IACd,UAAU;IACV,WAAW,UAAU,kBAAkB;KACrC;KACA,UAAU;IACZ,CAAC;GACH;GACA,QAAQ;IACN,UAAU,QAAQ,UAAU,OAAO;IACnC,WAAW,UAAU,UAAU;KAC7B;KACA,UAAU,QAAQ,UAAU,OAAO;IACrC,CAAC;GACH;GACA,SAAS;IACP,UAAU,QAAQ,UAAU,QAAQ;IACpC,WAAW,UAAU,WAAW;KAC9B;KACA,UAAU,QAAQ,UAAU,QAAQ;IACtC,CAAC;GACH;GACA,iBAAiB,QAAQ;EAC3B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,QAAQ,YAA2B;EAEvC,KAAI,MADkB,gBAAgB,EAAA,CAC1B,YAAY,SAAS;GAC/B,MAAM,aAAa;GACnB;EACF;EACA,MAAM,gBAAgB;CACxB;CAEA,MAAM,iCACJ,gCAAgC,gBAAgB,GAAG,GAAG;CAExD,MAAM,SAAS,YAAwC;EACrD,MAAM,MAAM;EACZ,MAAM,UAAU,gBAAgB;EAChC,MAAM,eAAe;GACnB,eAAe;GACf,QAAQ;GACR,SAAS,QAAQ;EACnB;EACA,OAAO,QAAQ,YAAY,UACvB;GACE,GAAG;GACH,aAAa,cAAc;GAC3B,UAAU,IAAI,yBAAyB;GACvC,eAAe,yBAAyB;EAC1C,IACA;CACN;CAEA,MAAM,kBAAkB,OACtB,uBACgC;EAChC,MAAM,MAAM;EACZ,MAAM,UAAU,gBAAgB;EAChC,MAAM,SAAS;GACb,QAAQ,mBAAmB,gBAAgB;GAC3C,YAAY,mBAAmB,mBAAmB;EACpD;EAEA,IAAI,QAAQ,YAAY,SAAS;GAE/B,MAAM,cAAc,OAAM,MADN,aAAa,EAAA,CACD,YAAY;GAC5C,OAAO,0BAA0B;IAC/B,SAAS;IACT,QAAQ;IACR;IACA,cAAc;KACZ,iBAAiB;KACjB,gBAAgB;KAChB,mBAAmB,YAAY,KAAK,oBAChC,cACA;KACJ,UAAU;KACV,qBAAqB,YAAY,0BAC7B,cACA;KACJ,kBAAkB;IACpB;IACA,WAAW,mBAAmB;IAC9B,QAAQ;KACN,UAAU,YAAY,KAAK;KAC3B,UAAU,YAAY,KAAK;KAC3B,aAAa,mBAAmB;IAClC;IACA,cAAc,mBAAmB;IACjC,YAAY,mBAAmB;GACjC,CAAC;EACH;EAEA,MAAM,WAAW,MAAM;EACvB,IAAI,CAAC,UAAU,MAAM,IAAI,MAAM,8BAA8B;EAC7D,MAAM,YAAY,MAAM,SAAS,UAAU;EAC3C,MAAM,mBACJ,cAEA,UAAU,WAAW,UAAS,CAAE,WAAW,UACvC,cACA;EA2BN,OAAO,0BAA0B;GAzB/B,SAAS,QAAQ;GACjB,QACE,SAAS,OAAO,CAAA,CAAE,WAAW,YACzB,UAAU,WAAW,UACnB,YACA,aACF;GACN;GACA,cAAc;IACZ,iBAAiB,gBAAgB,QAAQ;IACzC,gBAAgB,gBAAgB,gBAAgB;IAChD,mBAAmB;IACnB,UAAU,gBAAgB,UAAU;IACpC,qBAAqB;IACrB,kBAAkB,gBAAgB,SAAS;GAC7C;GACA,WAAW,mBAAmB;GAC9B,QAAQ;IACN,UAAU,SAAS,gBAAgB,UAAU,KAAK;IAClD,UAAU;IACV,aAAa,mBAAmB;GAClC;GACA,cAAc,mBAAmB;GACjC,YAAY,mBAAmB;EAEA,CAAK;CACxC;CAEA,MAAM,eACJ,QAAQ,gBACR,8BAA8B;EAC5B,YAAY,QAAQ,oBAAoB,IAAI;EAC5C,oBAAoB,iBAAiB,QAAQ;CAC/C,CAAC;CAEH,MAAM,kBAA0B,OAAO,EAAE,OAAO,cAAc;EAC5D,MAAM,MAAM;EACZ,OAAO,QAAQ,KAAK;CACtB;CAEA,MAAM,wBAAgC,OAAO,EAAE,OAAO,cAAc;EAClE,MAAM,SAAS,cAAc,MAAM,MAAM;EACzC,MAAM,YAAY,yBAChB,MAAM,aAAa;GAAE,KAAK,MAAM;GAAK,SAAS,MAAM;EAAQ,CAAC,CAC/D;EACA,OAAO,mBAAmB,UAAU;EACpC,OAAO,qBAAqB,UAAU;EACtC,OAAO,QAAQ,KAAK;CACtB;CAEA,MAAM,oBAAoB,QAAQ,SAAS,cAAc;CACzD,MAAM,mBAAmB,QAAQ,SAAS,aAAa,CAAC;CACxD,MAAM,+BAAsD;EAC1D,GAAG,iBAAiB,SAAS;EAC7B,GAAG,QAAQ;EACX,YAAY,QAAQ,SAAS,OAAO;EACpC,YAAY,QAAQ,SAAS,cAAc;CAC7C;CAEA,MAAM,oBACJ,gBAAgB,CAAA,CAAE,UAAU,QAAQ,cAAc,iBAC9C,OACA,QAAQ,SAAS;CACvB,IAAI;CACJ,MAAM,2BAAwD;EAC5D,8BAA8B,mBAAmB,OAC/C,iBAAiB,YAAY,CAC/B,CAAA,CAAE,OAAO,UAAmB;GAC1B,4BAA4B,KAAA;GAC5B,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,MAAM,iBAAiB,OAIrB,WACA,OACe;EACf,MAAM,SAAS,WAAW;EAC1B,MAAM,WAAW,WAAW;EAC5B,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAClD,MAAM,IAAI,MAAM,uCAAuC;EAEzD,IAAI,OAAO,aAAa,YAAY,SAAS,WAAW,GACtD,MAAM,IAAI,MAAM,sCAAsC;EAGxD,MAAMC,YAAW,OAAO,MAAM,mBAAmB,EAAA,CAAG,mBAClD,QACA,QACF;EACA,IAAI,CAACA,UAAS,cACZ,MAAM,IAAI,MAAM,sDAAsD;EAExE,MAAM,MAAM,UAAU,SAAS,IAAI,IAAI,UAAU,MAAM,IAAI,KAAA;EAC3D,MAAM,cAAc,CAAC,GAAGA,UAAS,WAAW,CAAA,CAAE,QAC3C,eAAe,CAAC,OAAO,IAAI,IAAI,UAAU,CAC5C;EACA,OAAO,+BACL;GACE,GAAG,iBAAiB,SAAS;GAC7B;GACA;GACA;GACA,oBAAoB;GACpB,aAAa,YAAY;EAC3B,SACM,GAAG;GAAE,GAAG;GAAW,QAAQ,CAAC,GAAG,WAAW;EAAE,CAAC,CACrD;CACF;CAEA,IAAI;CACJ,MAAM,uBAAgD;EACpD,2BAA2B,YAAY;GACrC,MAAM,UAAU,IAAI,gCAClB,sBAAsB,GACtB,gBAAgB,CAAA,CAAE,UAAU,QAAQ,YAAY,UAClD;GACA,MAAM,QAAQ,WAAW;GACzB,OAAO;EACT,EAAA,CAAG,CAAA,CAAE,OAAO,UAAmB;GAC7B,wBAAwB,KAAA;GACxB,MAAM;EACR,CAAC;EACD,OAAO;CACT;CASA,MAAM,cAAsB,OAAO,EAAE,OAAO,cAAc;EACxD,MAAM,SAAS,cAAc,MAAM,MAAM;EACzC,mBAAmB,MAAM;EACzB,MAAM,MAAM,YAAY;EAGxB,MAAM,UAAU,iBAAiB,MAAM,SACrC,MAAM,IAAI,SAAS,WAAW,IAAI,CACpC;EACA,IAAI,WAAW,CAAC,KAAK,OAAO,QAAQ,KAAK;EACzC,MAAM,YAAY,UACd,KAAA,IACA,MAAM,QAAQ,IAAI,iBAAiB;EACvC,IAAI,CAAC,aAAa,CAAC,KAAK,OAAO,QAAQ,KAAK;EAE5C,IAAI,iBAAiB;EACrB,IAAI;EACJ,IAAI;GACF,MAAM,UAAU,MAAM,eAAe;GACrC,OAAO,MAAM,6BACX;IACE,GAAG,sBAAsB;IACzB,oBAAoB;IACpB,aAAa;IACb,WAAW,aAAa;IACxB,gBAAgB;GAClB,GACA,OAAO,YAAY;IACjB,IAAI,QAAQ,SAAS;KACnB,OAAO,OAAO,QAAQ;KACtB,OAAO,aAAa,QAAQ,cAAc;KAC1C,OAAO,cAAc,QAAQ;KAC7B,OAAO,WAAW,QAAQ;KAC1B,OAAO,YAAY,QAAQ;KAC3B,IAAI,QAAQ,UACV,uBAAuB,IAAI,QAAQ,QAAQ,QAAQ;IAEvD;IACA,iBAAiB;IACjB,IAAI;KACF,OAAO,MAAM,QAAQ,KAAK;IAC5B,SAAS,OAAO;KACd,aAAa,EAAE,MAAM;KACrB,MAAM;IACR;GACF,CACF;EACF,SAAS,OAAO;GACd,IAAI,YAAY,MAAM,WAAW;GACjC,IAAI,gBAAgB,MAAM;GAC1B,mBAAmB,MAAM;GACzB,OAAO,IAAI,SAAS,yBAAyB,EAAE,QAAQ,IAAI,CAAC;EAC9D;CACF;CAEA,MAAM,gBAA0C,OAAO,OAAO;EAC5D,MAAM,QAAQ,SAAS,cAAc;EACrC,MAAM,QAAQ,SAAS,cAAc;EACrC,GAAI,QAAQ,SAAS,eACjB,EAAE,QAAQ,QAAQ,QAAQ,aAAa,IACvC,CAAC;EACL,UAAU,QAAQ,SAAS,kBAAkB;EAC7C,GAAI,QAAQ,SAAS,iBAAiB,KAAA,IAClC,EAAE,QAAQ,QAAQ,QAAQ,aAAa,IACvC,CAAC;EACL,eAAe,QAAQ,qBAAqB;CAC9C,CAAC;CAED,MAAM,aAAyB,MAAM;CAErC,OAAO,OAAO,OAAO;EACnB,QAAQ,eACN,iBACA,uBACA,aACA,4BACF;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;AACH;AAGA,IAAM,yCAAyB,IAAI,QAAwB;AAQ3D,IAAM,kCAAN,cAA8C,eAAe;CAC1C;CAEjB,YAAY,SAAgC,gBAAyB;EACnE,MAAM,OAAO;EACb,KAAK,iBAAiB;CACxB;CAEA,MAAe,mBACb,WACkD;EAClD,MAAM,UAAU,MAAM,MAAM,mBAAmB,SAAS;EACxD,IAAI,CAAC,SAAS,OAAO;EACrB,IAAI,OAAO,QAAQ,aAAa,YAAY,QAAQ,SAAS,SAAS,GACpE,OAAO,0BAA0B,OAAO,IAAI,UAAU;EAExD,OAAO,KAAK,iBAAiB,OAAO;CACtC;AACF;AAEA,SAAS,mBAAmB,QAAiC;CAC3D,OAAO,OAAO;CACd,OAAO,aAAa;CACpB,OAAO,cAAc,CAAC;CACtB,OAAO,WAAW;CAClB,OAAO,YAAY;CACnB,OAAO,gBAAgB,KAAA;CACvB,uBAAuB,OAAO,MAAM;AACtC;AAQO,IAAM,+BAAuC,OAAO,EACzD,OACA,cACI;CACJ,MAAM,SAAS,cAAc,MAAM,MAAM;CACzC,MAAM,gBAAgB,iBAAiB;CACvC,IACE,OAAO,QACP,OAAO,YACP,uBAAuB,IAAI,MAAM,MAAM,OAAO,YAC9C,eAAe,aAAa,OAAO,UAEnC,OAAO,gBAAgB;CAEzB,OAAO,QAAQ,KAAK;AACtB;AAQO,SAAS,eAAA,GAAkB,SAAoC;CACpE,QAAQ,EAAE,OAAO,cAAc;EAC7B,MAAM,OAIqB,OAAO,SAAS,mBAAmB;GAC5D,MAAM,OAAO,QAAQ;GACrB,IAAI,CAAC,MAAM,OAAO,QAAQ,SAAS,cAAc;GACjD,OAAO,KAAK;IACV,OAAO;IACP,UAAU,WAAW,gBACnB,IAAI,QAAQ,GAAG,WAAW,eAAe,cAAc;GAC3D,CAAC;EACH;EACA,OAAO,IAAI,GAAG,KAAK;CACrB;AACF;AAEA,SAAS,cAAc,QAAoC;CACzD,OAAO;AACT;AAEA,eAAe,wBAA6D;CAE1E,QAAO,MADc,WAAW,EAAA,CAClB,UACV,oCAAoC,IACpC,0BAA0B,EAAE,SAAS,QAAQ,CAAC;AACpD"}

package/dist/writer-lease.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Single-writer lease (`<state>/writer.lease`).
+ *
+ * Ported from the template's `scripts/smrt-writer-lease.mjs`. The running web
+ * server takes the same lease, so the file, record shape, and operation-lock
+ * admission rule stay byte-compatible. Stale-owner reclamation (of the lease
+ * and of a dead operation lock) is serialized through `stale-reclaim.ts`.
+ */
+/** Persisted writer-lease record. */
+export interface WriterLeaseRecord {
+    schemaVersion: 1;
+    pid: number;
+    instance: string;
+}
+/** Held writer lease. `release()` is idempotent. */
+export interface WriterLease {
+    release(): void;
+}
+/** Options for {@link acquireWriterLease}. */
+export interface AcquireWriterLeaseOptions {
+    /** Instance of the operation lock this writer was started under, if any. */
+    operationInstance?: string;
+}
+/**
+ * Return the live writer lease, removing a lease whose owner is gone.
+ */
+export declare function readActiveWriterLease(stateRoot: string): WriterLeaseRecord | null;
+/**
+ * Acquire the application's single-writer lease.
+ *
+ * A live operator operation blocks the writer unless the writer presents that
+ * operation's own lock instance (a managed `start`); a dead operation lock is
+ * reclaimed.
+ */
+export declare function acquireWriterLease(stateRoot: string, options?: AcquireWriterLeaseOptions): WriterLease;
+//# sourceMappingURL=writer-lease.d.ts.map

package/dist/writer-lease.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writer-lease.d.ts","sourceRoot":"","sources":["../src/writer-lease.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH,qCAAqC;AACrC,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,CAAC,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,8CAA8C;AAC9C,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AA6BD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAChB,iBAAiB,GAAG,IAAI,CAuB1B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,yBAA8B,GACtC,WAAW,CAyGb"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-app-runtime",
-  "version": "0.53.3",
+  "version": "0.53.4",
   "description": "Validated local, self-hosted, and cloud runtime composition for s-m-r-t applications",
   "type": "module",
   "main": "./dist/index.js",
@@ -9,6 +9,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./sveltekit": {
+      "types": "./dist/sveltekit/index.d.ts",
+      "import": "./dist/sveltekit.js"
     }
   },
   "files": [
@@ -16,18 +20,28 @@
     "CLAUDE.md",
     "AGENTS.md"
   ],
+  "peerDependencies": {
+    "@sveltejs/kit": "^2.20.0"
+  },
+  "peerDependenciesMeta": {
+    "@sveltejs/kit": {
+      "optional": true
+    }
+  },
   "dependencies": {
-    "@happyvertical/smrt-config": "0.53.3",
-    "@happyvertical/smrt-core": "0.53.3",
-    "@happyvertical/smrt-jobs": "0.53.3",
-    "@happyvertical/smrt-profiles": "0.53.3",
-    "@happyvertical/smrt-tenancy": "0.53.3",
-    "@happyvertical/smrt-users": "0.53.3",
+    "@happyvertical/smrt-config": "0.53.4",
+    "@happyvertical/smrt-core": "0.53.4",
+    "@happyvertical/smrt-jobs": "0.53.4",
+    "@happyvertical/smrt-profiles": "0.53.4",
+    "@happyvertical/smrt-tenancy": "0.53.4",
+    "@happyvertical/smrt-users": "0.53.4",
     "@happyvertical/sql": "^0.98.0"
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.53.3",
+    "@happyvertical/smrt-vitest": "0.53.4",
+    "@sveltejs/kit": "2.70.3",
     "@types/node": "24.13.6",
+    "tsx": "^4.23.13",
     "typescript": "6.0.3",
     "vite": "8.1.4",
     "vitest": "4.1.10"