@happyvertical/smrt-app-runtime 0.53.3 → 0.53.5

package/dist/sveltekit/owner-setup.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Server half of the local owner-setup page (`src/routes/setup/+page.server.ts`).
+ *
+ * Owner bootstrap is local-profile only, loopback-only, and single-use. The
+ * runtime stores only an HMAC of the short-lived token; this module never
+ * stores, logs, or returns claim errors, and it re-checks loopback custody on
+ * every request instead of trusting the bind host alone.
+ */
+import type { Cookies } from '@sveltejs/kit';
+import { type ActionFailure } from '@sveltejs/kit';
+import type { LocalOwnerClaimResult } from '../index.js';
+import type { SmrtSvelteKitRuntime } from './runtime.js';
+/** Data returned by the setup page `load`. */
+export interface OwnerSetupPageData {
+    /** False when setup is claimed, disabled (deployed), or not loopback. */
+    readonly available: boolean;
+    /** One-time token from `?token=` (empty unless available). */
+    readonly token: string;
+}
+/** Stable failure codes returned by the setup action. */
+export type OwnerSetupErrorCode = 
+/** Not the local profile (HTTP 404). */
+'setup_disabled'
+/** Request is not from a loopback client on a loopback host (HTTP 403). */
+ | 'setup_unavailable'
+/** Missing token, blank name, or email without `@` (HTTP 400). */
+ | 'setup_invalid_input'
+/** Token wrong, expired, or already used; owner already claimed (HTTP 400). */
+ | 'setup_invalid';
+/** `form` data returned with `fail(status, …)`. */
+export interface OwnerSetupFailure {
+    readonly code: OwnerSetupErrorCode;
+    /** Fixed, secret-free message; never claim error text. */
+    readonly message: string;
+}
+/** Form field names posted to the setup action. */
+export declare const OWNER_SETUP_FIELDS: Readonly<{
+    readonly token: "token";
+    readonly name: "name";
+    readonly email: "email";
+    readonly tenantName: "tenantName";
+}>;
+export declare const DEFAULT_OWNER_SETUP_MESSAGES: Readonly<Record<OwnerSetupErrorCode, string>>;
+/** The request fields the setup page reads. */
+export interface OwnerSetupEvent {
+    readonly url: URL;
+    readonly locals: unknown;
+    getClientAddress(): string;
+}
+export interface OwnerSetupActionEvent extends OwnerSetupEvent {
+    readonly request: Request;
+    readonly cookies: Pick<Cookies, 'set'>;
+}
+export interface OwnerSetupPageOptions {
+    /** Where a signed-in visitor or a successful claim is sent. Default `/`. */
+    readonly redirectTo?: string;
+    /** Replace fixed failure messages (for example app-specific recovery steps). */
+    readonly messages?: Partial<Record<OwnerSetupErrorCode, string>>;
+    /** Override where the signed-in user comes from. Defaults to `locals.user`. */
+    readonly resolveUser?: (event: OwnerSetupEvent) => unknown;
+    /**
+     * Set false to keep the `smrt app` onboarding hand-off files after a claim.
+     * By default the runtime removes `onboarding.json` and
+     * `onboarding-launch.html` from the private state root once the claim has
+     * committed, so `pnpm app:open` stops offering the spent invitation.
+     */
+    readonly removeOnboardingHandoff?: boolean;
+    /**
+     * Best-effort extra cleanup after a successful claim (the hand-off files are
+     * already removed by default). Errors are ignored: the owner and session are
+     * already authoritative and a stale token now fails closed.
+     */
+    readonly onOwnerClaimed?: (result: LocalOwnerClaimResult, event: OwnerSetupActionEvent) => void | Promise<void>;
+}
+export interface OwnerSetupPage {
+    readonly load: (event: OwnerSetupEvent) => Promise<OwnerSetupPageData>;
+    readonly actions: {
+        readonly default: (event: OwnerSetupActionEvent) => Promise<ActionFailure<OwnerSetupFailure>>;
+    };
+}
+/**
+ * Mount as `src/routes/setup/+page.server.ts`:
+ *
+ * ```ts
+ * import { createOwnerSetupPage } from '@happyvertical/smrt-app-runtime/sveltekit';
+ * import { runtime } from '../../hooks.server';
+ *
+ * export const { load, actions } = createOwnerSetupPage(runtime);
+ * ```
+ *
+ * The form posts to the `default` action with fields `token` (hidden),
+ * `name`, `email`, and optional `tenantName`. Success sets the session cookie
+ * and redirects 303; failures return `fail(status, { code, message })`.
+ */
+export declare function createOwnerSetupPage(runtime: Pick<SmrtSvelteKitRuntime, 'resolvedRuntime' | 'localRuntime' | 'sessionCookie'> & Partial<Pick<SmrtSvelteKitRuntime, 'applicationStateRoot'>>, options?: OwnerSetupPageOptions): OwnerSetupPage;
+/**
+ * True only when both the peer address and the addressed host are loopback.
+ * The host check rejects tunnels and DNS-rebinding hosts that forward to a
+ * loopback listener; a throwing `getClientAddress` is treated as remote.
+ */
+export declare function isLoopbackRequest(event: {
+    readonly url: URL;
+    getClientAddress(): string;
+}): boolean;
+/** Loopback IP literal: `127.0.0.0/8`, `::1`, or IPv4-mapped `127/8`. */
+export declare function isLoopbackAddress(value: string | null | undefined): boolean;
+/** Loopback host name as SvelteKit reports it in `url.hostname`. */
+export declare function isLoopbackHostname(hostname: string): boolean;
+//# sourceMappingURL=owner-setup.d.ts.map

package/dist/sveltekit/owner-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-setup.d.ts","sourceRoot":"","sources":["../../src/sveltekit/owner-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,KAAK,aAAa,EAAkB,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,yDAAyD;AACzD,MAAM,MAAM,mBAAmB;AAC7B,wCAAwC;AACtC,gBAAgB;AAClB,2EAA2E;GACzE,mBAAmB;AACrB,kEAAkE;GAChE,qBAAqB;AACvB,+EAA+E;GAC7E,eAAe,CAAC;AAEpB,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,mDAAmD;AACnD,eAAO,MAAM,kBAAkB;;;;;EAKpB,CAAC;AAEZ,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CACjD,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAOnC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,gBAAgB,IAAI,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC;IAC3D;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CACxB,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,qBAAqB,KACzB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,qBAAqB,KACzB,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC;KAChD,CAAC;CACH;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,IAAI,CACX,oBAAoB,EACpB,iBAAiB,GAAG,cAAc,GAAG,eAAe,CACrD,GACC,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,EAC7D,OAAO,GAAE,qBAA0B,GAClC,cAAc,CAmGhB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,gBAAgB,IAAI,MAAM,CAAC;CAC5B,GAAG,OAAO,CAQV;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAc3E;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG5D"}

package/dist/sveltekit/runtime.d.ts

@@ -0,0 +1,363 @@
+/**
+ * SvelteKit server composition for the validated runtime profiles.
+ *
+ * Request foundation, in order:
+ *
+ * 0. Wait for the fail-closed runtime startup gate (`init`).
+ * 1. Resolve a URL tenant candidate into `locals.selectedTenant*`. This is
+ *    selection only and never enters AsyncLocalStorage tenant context.
+ * 2. Load the signed session. Its tenant is accepted only for a verified
+ *    active direct or legitimately inherited membership
+ *    ({@link isSessionTenantAuthorized}, the deployed runtime's rule);
+ *    otherwise the request is unauthenticated. An accepted session enters the
+ *    tenant context and permission set for downstream code, inside the
+ *    request RLS transaction when the profile selects `database-rls`.
+ * 3. Publish the authorized context on `locals.tenantContext` only when it
+ *    matches the verified session tenant.
+ *
+ * This ordering prevents a spoofed header or hostname from becoming query
+ * authority. Membership-gated tenant switching belongs in an explicit action
+ * using `switchSessionTenant()` from `@happyvertical/smrt-users/sveltekit`.
+ */
+import { type ResolvedApplicationRuntime } from '@happyvertical/smrt-config';
+import { type SmrtClassOptions, type SmrtCollection, type SmrtObject } from '@happyvertical/smrt-core';
+import { type MinimalTenantContext } from '@happyvertical/smrt-tenancy';
+import type { SessionHandlerOptions, SessionLocals } from '@happyvertical/smrt-users/sveltekit';
+import { type DatabaseInterface } from '@happyvertical/sql';
+import type { Handle, ServerInit } from '@sveltejs/kit';
+import { type DeployedApplicationRuntime, initializeDeployedApplicationRuntime } from '../deployed-runtime.js';
+import { type TenantBindingMode } from '../direct-membership.js';
+import { initializeLocalApplicationRuntime, type LocalApplicationRuntime, type LocalMcpTokenPrincipal, type LocalOwnerBootstrapInvitation } from '../index.js';
+import { type RuntimeDiagnostics } from '../runtime-diagnostics.js';
+import { type WriterLease } from '../writer-lease.js';
+import { type TenantSelector } from './tenancy.js';
+/** `App.Locals` fields populated by the SMRT runtime `handle`. */
+export interface SmrtRuntimeLocals extends SessionLocals {
+    /**
+     * URL-selected tenant candidate. Never use this as authorization; the
+     * session-authorized tenant remains `tenantId` from {@link SessionLocals}.
+     */
+    selectedTenantId: string | null;
+    selectedTenantSlug: string | null;
+    /** Full context for the authorized session tenant, when present. */
+    tenantContext?: MinimalTenantContext;
+}
+/** Provider component whose readiness a deployed web process must prove. */
+export type ProviderReadinessComponent = 'authentication' | 'assets' | 'secrets';
+/**
+ * Build a provider-owned readiness probe. The probe must check the real
+ * backing service and must never return or log credentials.
+ */
+export type ProviderReadinessFactory = (component: ProviderReadinessComponent, context: {
+    readonly profile: string;
+    readonly provider: string;
+}) => () => Promise<void>;
+/** Context handed to an application-owned writer lease. */
+export interface WriterLeaseContext {
+    readonly appId: string;
+    readonly dataDirectory: string | undefined;
+    readonly sourceRoot: string;
+}
+/**
+ * Held for the life of the local web process; released on failed startup.
+ * The root entry's `acquireWriterLease()` returns one.
+ */
+export type { WriterLease } from '../writer-lease.js';
+/** Inputs to the public diagnostics projection that only the app can supply. */
+export interface ApplicationRuntimeDiagnosticsOptions {
+    readonly toolNames: readonly string[];
+    readonly observedAt: Date;
+    /** Application-owned schema verification seam; runtime liveness is not proof. */
+    readonly schemaStatus?: 'not-ready' | 'ready' | 'unknown';
+    /** Application-owned migration tracker seam; database liveness is not proof. */
+    readonly migrationStatus?: 'current' | 'failed' | 'pending' | 'unknown';
+    /** Bounded worker seam supplied by the deployment's lease/heartbeat adapter. */
+    readonly workerHeartbeatAt?: Date | string | null;
+    /** Stable code/timestamp pairs only; raw errors never cross this seam. */
+    readonly recentErrors?: readonly {
+        readonly code?: unknown;
+        readonly at?: unknown;
+    }[];
+}
+/** Liveness body served by the mounted health route. */
+export interface RuntimeHealthBody {
+    readonly schemaVersion: 1;
+    readonly status: 'ready';
+    readonly profile: ResolvedApplicationRuntime['profile'];
+    /** Local profile only: canonical application ID. */
+    readonly application?: string;
+    /** Local profile only: managed process instance (`SMRT_PROCESS_INSTANCE`). */
+    readonly instance?: string | null;
+    /** Local profile only: {@link runtimeConfigurationFingerprint}. */
+    readonly configuration?: string;
+}
+/** Session-handler options the application may tune. */
+export type SmrtRuntimeSessionOptions = Omit<SessionHandlerOptions, 'enterTenantContext'>;
+/** App-specific options for {@link createSmrtSvelteKitRuntime}. */
+export interface SmrtSvelteKitRuntimeOptions {
+    /**
+     * Explicit application ID. Defaults to `SMRT_APP_ID` (strictly validated)
+     * or the encoded `package.json` name under `sourceRoot`.
+     */
+    readonly appId?: string;
+    /** Application source checkout. Defaults to `process.cwd()`. */
+    readonly sourceRoot?: string;
+    /** Local data root. Defaults to `SMRT_DATA_DIR`, then the OS data directory. */
+    readonly dataDirectory?: string;
+    /** Environment to read. Defaults to `process.env`. */
+    readonly env?: NodeJS.ProcessEnv;
+    /**
+     * Resolved runtime profile. Defaults to `smrt.config` `runtime` when
+     * present, otherwise the `local` profile; a present value that is not a
+     * runtime block (`null`, `false`, `0`, `''`) fails closed.
+     */
+    readonly runtime?: ResolvedApplicationRuntime | (() => ResolvedApplicationRuntime | Promise<ResolvedApplicationRuntime>);
+    /**
+     * Explicit, idempotent application migration hook, run during `init`.
+     * The runtime never synthesizes application tables itself.
+     */
+    readonly prepareDatabase?: (db: DatabaseInterface) => Promise<void>;
+    /**
+     * Local HTTP bind host. Defaults to `HOST`, or `127.0.0.1` when
+     * `NODE_ENV=development`. Local production startup without one fails.
+     */
+    readonly bindHost?: string;
+    /** Opt in to persisted local background jobs. Default `SMRT_BACKGROUND_JOBS === 'true'`. */
+    readonly backgroundJobs?: boolean;
+    /** Opt in to application-defined paid capabilities. Default false. */
+    readonly paidCapabilities?: boolean;
+    /** Owner-bootstrap token lifetime (1..900 seconds). */
+    readonly bootstrapTtlSeconds?: number;
+    /** Session lifetime for the owner-bootstrap session cookie. Default 7 days. */
+    readonly sessionTtlSeconds?: number;
+    /**
+     * Local single-writer lease held for the web process, released when local
+     * startup fails. Defaults to the state-root writer lease shared with
+     * `smrt app` operations ({@link defaultWriterLease}: `writer.lease` under
+     * `prepareApplicationStateRoot()`, presenting `SMRT_OPERATION_INSTANCE`).
+     * Pass a factory to replace it, or `false` to hold no lease. Deployed
+     * profiles never take it.
+     */
+    readonly acquireWriterLease?: ((context: WriterLeaseContext) => WriterLease) | false;
+    /**
+     * Deployed provider readiness probes. Required by `self-hosted` and `cloud`;
+     * deployed startup fails closed without them.
+     */
+    readonly providerReadiness?: ProviderReadinessFactory;
+    /** Replace the default subdomain tenant selector. Selection only. */
+    readonly selectTenant?: TenantSelector;
+    /** Base domain for the default selector. Defaults to `TENANT_BASE_DOMAIN`. */
+    readonly tenantBaseDomain?: string;
+    /** Session handler tuning. `enterTenantContext` is always `true`. */
+    readonly session?: SmrtRuntimeSessionOptions;
+    /** Per-class overrides layered over the runtime database config. */
+    readonly classOverrides?: Readonly<Record<string, Partial<SmrtClassOptions>>>;
+    /** Call `enableTenancy()` if it is not already enabled. Default true. */
+    readonly enableTenancy?: boolean;
+    /**
+     * Receives an owner-bootstrap invitation that this process's startup newly
+     * issued (the plaintext is returned exactly once; only its HMAC is stored).
+     * Use it to show a loopback `/setup?token=` URL. Errors are ignored so a
+     * failing presenter never blocks startup. Default: not presented.
+     */
+    readonly onBootstrapInvitation?: (invitation: LocalOwnerBootstrapInvitation, context: {
+        readonly bindHost: string;
+    }) => void;
+    /** Testable clock for the local runtime. */
+    readonly now?: () => Date;
+}
+/** Cookie attributes for a session established outside the session handler. */
+export interface SmrtRuntimeSessionCookie {
+    readonly name: string;
+    readonly path: string;
+    readonly domain?: string;
+    readonly sameSite: 'strict' | 'lax' | 'none';
+    /** `undefined` means "secure when the request is HTTPS". */
+    readonly secure?: boolean;
+    readonly maxAgeSeconds: number;
+}
+export type { TenantBindingMode } from '../direct-membership.js';
+/** The composed runtime; `handle` and `init` are bound and destructurable. */
+/** A principal a route authenticated itself, for {@link SmrtSvelteKitRuntime.runAsPrincipal}. */
+export interface SmrtRuntimeBoundPrincipal {
+    readonly id: string;
+    readonly tenantId?: string | null;
+    /** Granted scopes that cap the live permission set (e.g. token scopes). */
+    readonly scopes?: readonly string[];
+    /**
+     * How tenant authority may be established, set by the authenticating
+     * adapter (never request input). `direct` (local owner tokens, the default
+     * hosted resolver) needs an active direct membership in exactly
+     * `tenantId`. `direct-or-inherited` (the default; hosted application-owned
+     * mappings) applies the session step's rule: that direct row, or with no
+     * direct row, authority inherited from an active inheritable ancestor.
+     */
+    readonly tenantBinding?: TenantBindingMode;
+}
+/** A verified hosted access-token identity (see `McpVerifiedIdentity`). */
+export interface SmrtRuntimeMcpIdentity {
+    /** Exact issuer the token was verified against. */
+    readonly issuer: string;
+    /** Verified `sub` claim. */
+    readonly subject: string;
+}
+/** The current account and tenant a hosted MCP identity maps to. */
+export interface SmrtRuntimeMcpPrincipalMapping {
+    readonly id: string;
+    readonly tenantId: string;
+    readonly kind: 'human';
+    /** The default resolver maps only direct memberships. */
+    readonly tenantBinding: 'direct';
+}
+/** `T` with every nested array and object field readonly. */
+export type SmrtRuntimeDeepReadonly<T> = T extends readonly (infer U)[] ? readonly SmrtRuntimeDeepReadonly<U>[] : T extends object ? {
+    readonly [K in keyof T]: SmrtRuntimeDeepReadonly<T[K]>;
+} : T;
+/**
+ * The frozen principal `runAsPrincipal` hands its callback: a deep, frozen
+ * snapshot of the caller's principal taken before any await, with the
+ * effective `tenantBinding` and effective (frozen) `scopes`.
+ */
+export type SmrtRuntimeBoundPrincipalSnapshot<P> = SmrtRuntimeDeepReadonly<Omit<P, 'scopes' | 'tenantBinding'>> & {
+    readonly scopes: readonly string[];
+    readonly tenantBinding: TenantBindingMode;
+};
+export interface SmrtSvelteKitRuntime {
+    /** `hooks.server.ts` `handle`. */
+    readonly handle: Handle;
+    /** `hooks.server.ts` `init`: the fail-closed startup gate. */
+    readonly init: ServerInit;
+    /** Session cookie attributes shared with owner setup. */
+    readonly sessionCookie: SmrtRuntimeSessionCookie;
+    /** Resolve the runtime profile (memoized; retried after failure). */
+    resolvedRuntime(): Promise<ResolvedApplicationRuntime>;
+    /** Await profile-specific startup (same promise as `init`). */
+    ready(): Promise<void>;
+    /** Canonical application ID. */
+    applicationId(): string;
+    /**
+     * Private state root shared with the `smrt app` operator commands (writer
+     * lease, operation lock, onboarding hand-off files). Resolves the path only;
+     * it does not create it.
+     */
+    applicationStateRoot(): string;
+    /** Secret-free configuration fingerprint. Requires a resolved runtime. */
+    configurationFingerprint(): string;
+    /**
+     * Database for SMRT collections. Requires a resolved runtime. Inside a
+     * request running in the RLS transaction (`database-rls` isolation, or
+     * `session.postgresRls`) this is the transaction-bound request database;
+     * otherwise the base configuration. Call it per request and never retain
+     * the result (or collections built from it) beyond that request.
+     */
+    databaseConfig(): SmrtClassOptions['db'];
+    /**
+     * Collection options for a class: {@link databaseConfig} plus
+     * `classOverrides`. A class whose override sets `db` keeps that database.
+     * Same per-request rule as {@link databaseConfig}.
+     */
+    classOptions(className: string): SmrtClassOptions;
+    /**
+     * The registered collection for a class, built from {@link classOptions}
+     * evaluated on this call: inside an RLS request it is bound to the request
+     * transaction. Generated API routes resolve collections through it. Call it
+     * per request and never retain the result beyond that request.
+     */
+    getCollection<T extends SmrtObject = SmrtObject>(className: string): Promise<SmrtCollection<T>>;
+    /**
+     * Run `fn` as a principal the route verified itself (for example a bearer
+     * token mapped by an MCP route), replacing the cookie session's permission
+     * context for that call. The principal's permissions are resolved live from
+     * its membership in `tenantId` and, when `scopes` is given, capped to it;
+     * under the RLS transaction rule of {@link databaseConfig} a fresh
+     * transaction publishes that user, tenant and permission set, and
+     * `databaseConfig()`/`classOptions()` return it inside `fn`. Rejects (before
+     * `fn` runs) without a user id, a tenant, or a membership its
+     * `tenantBinding` accepts: `direct` needs an active direct membership in
+     * exactly that tenant; `direct-or-inherited` (default) also accepts
+     * authority inherited from an active inheritable ancestor when no direct
+     * row exists. A suspended or pending direct row is always authoritative.
+     *
+     * `principal` is read once, before any await: `fn` receives a frozen copy
+     * of that snapshot (its effective `tenantBinding`, and `scopes` replaced by
+     * the effective, frozen permission set: live permissions capped by the
+     * given scopes), never the caller's object. Callers
+     * that authorize in code (rather than through database policy, as under
+     * `application` isolation) must authorize with these effective scopes so a
+     * revoked permission takes effect even while a token still carries it.
+     */
+    runAsPrincipal<T, P extends SmrtRuntimeBoundPrincipal = SmrtRuntimeBoundPrincipal>(principal: P, fn: (bound: SmrtRuntimeBoundPrincipalSnapshot<P>) => Promise<T>): Promise<T>;
+    /**
+     * Verify an owner-minted local MCP token (`smrt app token`). Resolves the
+     * token's owner principal with its scopes capped to the owner's live
+     * permissions, or `null` for anything else: a malformed, unknown, revoked
+     * or expired token, an inactive owner or membership, or any non-`local`
+     * profile. Pass the runtime as `createHostedMcpResourceAuth({ runtime })`
+     * so `/mcp` accepts these tokens in the local profile.
+     */
+    verifyLocalMcpToken(token: string): Promise<LocalMcpTokenPrincipal | null>;
+    /**
+     * Default membership-backed hosted MCP principal mapping: the verified
+     * issuer/subject must be linked (`oidc_identities`) to exactly one active
+     * user with exactly one active direct tenant membership. Anything else
+     * (unlinked, ambiguous, inactive, several tenants, the `local` profile)
+     * resolves `null`, which denies the request. Token claims never select the
+     * tenant. Applications with multi-tenant users pass their own
+     * `resolvePrincipal`, which takes precedence.
+     */
+    resolveMcpPrincipal(identity: SmrtRuntimeMcpIdentity): Promise<SmrtRuntimeMcpPrincipalMapping | null>;
+    /** The local runtime. Rejects outside the `local` profile. */
+    localRuntime(): Promise<LocalApplicationRuntime>;
+    /** The deployed runtime. Rejects in the `local` profile. */
+    deployedRuntime(): Promise<DeployedApplicationRuntime>;
+    /** Liveness body for the health route (awaits startup). */
+    health(): Promise<RuntimeHealthBody>;
+    /**
+     * Read private runtime state and project it onto the public allowlist.
+     * Call only after the route has authenticated and authorized its caller.
+     */
+    readDiagnostics(options: ApplicationRuntimeDiagnosticsOptions): Promise<RuntimeDiagnostics>;
+}
+/** @internal Test and composition seams; not part of the public entry. */
+export interface SmrtSvelteKitRuntimeSeams {
+    readonly initializeLocal?: typeof initializeLocalApplicationRuntime;
+    readonly initializeDeployed?: typeof initializeDeployedApplicationRuntime;
+    readonly loadRuntime?: () => Promise<ResolvedApplicationRuntime>;
+}
+/**
+ * Compose runtime startup, tenant selection, the signed session, and
+ * authorized-tenant locals into a SvelteKit `{ handle, init }` pair.
+ *
+ * @example
+ * ```ts
+ * // src/hooks.server.ts
+ * import { createSmrtSvelteKitRuntime } from '@happyvertical/smrt-app-runtime/sveltekit';
+ *
+ * export const runtime = createSmrtSvelteKitRuntime();
+ * export const { handle, init } = runtime;
+ * ```
+ */
+export declare function createSmrtSvelteKitRuntime(options?: SmrtSvelteKitRuntimeOptions): SmrtSvelteKitRuntime;
+/** @internal */
+export declare function composeSmrtSvelteKitRuntime(options: SmrtSvelteKitRuntimeOptions, seams: SmrtSvelteKitRuntimeSeams): SmrtSvelteKitRuntime;
+/**
+ * The default local writer lease: the state-root `writer.lease` shared with
+ * `smrt app` operations, presenting the managed operation instance
+ * (`SMRT_OPERATION_INSTANCE`) that `smrt app start` passes to its writer.
+ */
+export declare function defaultWriterLease(context: WriterLeaseContext, env?: NodeJS.ProcessEnv): WriterLease;
+/**
+ * Step 3: publish the authorized tenant context only when this runtime's
+ * session step verified the session tenant and it matches the active
+ * AsyncLocalStorage context. Locals populated by any other session layer are
+ * never published.
+ */
+export declare const authorizedTenantLocalsHandle: Handle;
+/**
+ * Run handles in order. Unlike `sequence()` from `@sveltejs/kit/hooks`, this
+ * needs no SvelteKit request store, so the composed handle is usable (and
+ * testable) outside the Kit server runtime. The runtime's own handles never
+ * pass resolve options; any options a handle passes are forwarded unchanged.
+ */
+export declare function composeHandles(...handles: readonly Handle[]): Handle;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/sveltekit/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/sveltekit/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,KAAK,0BAA0B,EAEhC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAIL,KAAK,oBAAoB,EAE1B,MAAM,6BAA6B,CAAC;AAarC,OAAO,KAAK,EACV,qBAAqB,EACrB,aAAa,EACd,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,KAAK,iBAAiB,EAAe,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAKxD,OAAO,EACL,KAAK,0BAA0B,EAE/B,oCAAoC,EAGrC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iCAAiC,EAEjC,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAGnC,MAAM,aAAa,CAAC;AAMrB,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAEtB,kEAAkE;AAClE,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD;;;OAGG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oEAAoE;IACpE,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAED,4EAA4E;AAC5E,MAAM,MAAM,0BAA0B,GAClC,gBAAgB,GAChB,QAAQ,GACR,SAAS,CAAC;AAEd;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,SAAS,EAAE,0BAA0B,EACrC,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAC7D,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;AAEzB,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,gFAAgF;AAChF,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,GAAG,OAAO,GAAG,SAAS,CAAC;IAC1D,gFAAgF;IAChF,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACxE,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAClD,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS;QAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;KACvB,EAAE,CAAC;CACL;AAED,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACxD,oDAAoD;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,mEAAmE;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,wDAAwD;AACxD,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAC1C,qBAAqB,EACrB,oBAAoB,CACrB,CAAC;AAEF,mEAAmE;AACnE,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EACb,0BAA0B,GAC1B,CAAC,MAAM,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAC7E;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,uDAAuD;IACvD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EACxB,CAAC,CAAC,OAAO,EAAE,kBAAkB,KAAK,WAAW,CAAC,GAC9C,KAAK,CAAC;IACV;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IACtD,qEAAqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC,8EAA8E;IAC9E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC9E,yEAAyE;IACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,UAAU,EAAE,6BAA6B,EACzC,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KACnC,IAAI,CAAC;IACV,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,+EAA+E;AAC/E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC7C,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,8EAA8E;AAC9E,iGAAiG;AACjG,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,oEAAoE;AACpE,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;CAClC;AAED,6DAA6D;AAC7D,MAAM,MAAM,uBAAuB,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GACnE,SAAS,uBAAuB,CAAC,CAAC,CAAC,EAAE,GACrC,CAAC,SAAS,MAAM,GACd;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GAC1D,CAAC,CAAC;AAER;;;;GAIG;AACH,MAAM,MAAM,iCAAiC,CAAC,CAAC,IAAI,uBAAuB,CACxE,IAAI,CAAC,CAAC,EAAE,QAAQ,GAAG,eAAe,CAAC,CACpC,GAAG;IACF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC;CAC3C,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IACjD,qEAAqE;IACrE,eAAe,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvD,+DAA+D;IAC/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,gCAAgC;IAChC,aAAa,IAAI,MAAM,CAAC;IACxB;;;;OAIG;IACH,oBAAoB,IAAI,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,wBAAwB,IAAI,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,cAAc,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAClD;;;;;OAKG;IACH,aAAa,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,EAC7C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,CACZ,CAAC,EACD,CAAC,SAAS,yBAAyB,GAAG,yBAAyB,EAE/D,SAAS,EAAE,CAAC,EACZ,EAAE,EAAE,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9D,OAAO,CAAC,CAAC,CAAC,CAAC;IACd;;;;;;;OAOG;IACH,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC3E;;;;;;;;OAQG;IACH,mBAAmB,CACjB,QAAQ,EAAE,sBAAsB,GAC/B,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAAC;IAClD,8DAA8D;IAC9D,YAAY,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACjD,4DAA4D;IAC5D,eAAe,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACvD,2DAA2D;IAC3D,MAAM,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrC;;;OAGG;IACH,eAAe,CACb,OAAO,EAAE,oCAAoC,GAC5C,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED,0EAA0E;AAC1E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,iCAAiC,CAAC;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,oCAAoC,CAAC;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAClE;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,2BAAgC,GACxC,oBAAoB,CAEtB;AAED,gBAAgB;AAChB,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,2BAA2B,EACpC,KAAK,EAAE,yBAAyB,GAC/B,oBAAoB,CAqrBtB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,kBAAkB,EAC3B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,CASb;AAyCD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAe1C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAiBpE"}

package/dist/sveltekit/tenancy.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Tenant *selection* for SvelteKit requests.
+ *
+ * Selection and authorization are deliberately separate:
+ *
+ * - a selector maps a trusted URL shape (by default the leading subdomain) to
+ *   an active tenant record and publishes it as `locals.selectedTenant*`;
+ * - the signed session (`createSessionHandler({ enterTenantContext: true })`)
+ *   authorizes the signed-in user's membership and establishes the request
+ *   tenant context.
+ *
+ * A selected tenant is useful for login and membership-gated switch flows, but
+ * it never becomes ambient query authority by itself. The default selector
+ * ignores client-provided tenant headers.
+ */
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+/** The request fields a tenant selector may read. */
+export interface TenantSelectionEvent {
+    readonly url: URL;
+    readonly request: {
+        readonly headers: Headers;
+    };
+}
+/** URL-derived tenant candidate. Never authorization. */
+export interface TenantSelection {
+    /** Database ID for an active tenant, or null when none resolves. */
+    readonly tenantId: string | null;
+    /** URL-derived slug. Informational until membership authorizes a switch. */
+    readonly tenantSlug: string | null;
+}
+/**
+ * Replaceable selection extension point. Implementations must preserve the
+ * rule that selection alone never establishes authorization context.
+ */
+export type TenantSelector = (event: TenantSelectionEvent) => TenantSelection | Promise<TenantSelection>;
+/**
+ * Pure URL parser used by the default selector.
+ *
+ * Set `TENANT_BASE_DOMAIN` (or pass `baseDomain`) in production so
+ * multi-label public suffixes are never guessed. Without it, the fallback is
+ * intended only for local domains such as `acme.demo.local`.
+ */
+export declare function selectTenantSlug(url: URL, baseDomain?: string | undefined): string | null;
+export interface SubdomainTenantSelectorOptions {
+    /** Explicit public base domain. Defaults to `TENANT_BASE_DOMAIN`. */
+    readonly baseDomain?: string;
+    /** Collection options for the `Tenant` lookup. */
+    readonly classOptions: () => SmrtClassOptions;
+}
+/**
+ * Default selector: the leading subdomain names an ACTIVE tenant.
+ *
+ * A missing `tenants` table (a fresh project before its first migration)
+ * yields no selection; the runtime never creates that table.
+ */
+export declare function createSubdomainTenantSelector(options: SubdomainTenantSelectorOptions): TenantSelector;
+/** Coerce an application selector's result into the published shape. */
+export declare function normalizeTenantSelection(selection: TenantSelection | null | undefined): TenantSelection;
+//# sourceMappingURL=tenancy.d.ts.map

package/dist/sveltekit/tenancy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../../src/sveltekit/tenancy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,qDAAqD;AACrD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CACjD;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,KAAK,EAAE,oBAAoB,KACxB,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAShD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,GAAG,EACR,UAAU,GAAE,MAAM,GAAG,SAA0C,GAC9D,MAAM,GAAG,IAAI,CA4Bf;AAYD,MAAM,WAAW,8BAA8B;IAC7C,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,gBAAgB,CAAC;CAC/C;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,cAAc,CAgBhB;AAED,wEAAwE;AACxE,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,GAC5C,eAAe,CAUjB"}

package/dist/sveltekit.d.ts

@@ -0,0 +1,2 @@
+export * from './sveltekit/index.js';
+//# sourceMappingURL=sveltekit.d.ts.map

package/dist/sveltekit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sveltekit.d.ts","sourceRoot":"","sources":["../src/sveltekit.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC"}