@happyvertical/smrt-app-runtime 0.57.8 → 0.57.10

package/AGENTS.md

@@ -116,6 +116,11 @@ Application infrastructure composition for the validated runtime profiles in
 
 - Server-only subpath; `@sveltejs/kit` is an optional peer and is externalized
   in `vite.config.ts` (kit recognizes `redirect`/`fail` by class identity).
+  Consumer apps use core's `smrt()` preset to bundle the Kit-facing entry into
+  their SSR output and dedupe Kit; `./sveltekit-runtime` and the root stay external
+  to preserve native dependency loading. The implementation subpath is for
+  build composition; apps keep importing `./sveltekit`.
+  Package-build externalization alone does not preserve class identity through adapter-node's final production bundle.
   The root entry must never import kit or Svelte.
 - Without a `runtime` option the profile comes from smrt-config's
   `resolveEffectiveApplicationRuntime(await loadConfig())`, the same rule as
@@ -210,8 +215,11 @@ Application infrastructure composition for the validated runtime profiles in
 
 ## Validation
 
+Build first: `sveltekit-production.test.ts` copies the published `dist` entry
+and exercises the final adapter-node HTTP handler in a separate process.
+
 ```bash
+pnpm --filter @happyvertical/smrt-app-runtime build
 pnpm --filter @happyvertical/smrt-app-runtime test
 pnpm --filter @happyvertical/smrt-app-runtime typecheck
-pnpm --filter @happyvertical/smrt-app-runtime build
 ```

package/dist/chunks/tenancy-BzdIxH2M.js

@@ -0,0 +1,67 @@
+import { TenantCollection, TenantStatus } from "@happyvertical/smrt-users";
+//#region src/sveltekit/tenancy.ts
+var ROOT_LIKE_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1",
+	"[::1]"
+]);
+var RESERVED_SUBDOMAINS = /* @__PURE__ */ new Set([
+	"www",
+	"api",
+	"app",
+	"admin"
+]);
+var NO_SELECTION = Object.freeze({
+	tenantId: null,
+	tenantSlug: null
+});
+function selectTenantSlug(url, baseDomain = process.env.TENANT_BASE_DOMAIN) {
+	const hostname = url.hostname.toLowerCase();
+	if (ROOT_LIKE_HOSTS.has(hostname) || hostname.startsWith("[") || /^\d{1,3}(\.\d{1,3}){3}$/.test(hostname)) return null;
+	const normalizedBase = baseDomain?.trim().toLowerCase().replace(/^\.+|\.+$/g, "");
+	let candidate;
+	if (normalizedBase) {
+		if (hostname === normalizedBase) return null;
+		const suffix = `.${normalizedBase}`;
+		if (!hostname.endsWith(suffix)) return null;
+		candidate = hostname.slice(0, -suffix.length).split(".")[0];
+	} else {
+		const labels = hostname.split(".");
+		if (labels.length < 3) return null;
+		candidate = labels[0];
+	}
+	return candidate && !RESERVED_SUBDOMAINS.has(candidate) ? candidate : null;
+}
+function isMissingTenantTable(error) {
+	if (!(error instanceof Error)) return false;
+	return error.code === "42P01" || error.message.includes("relation \"tenants\" does not exist") || error.message.includes("no such table: tenants");
+}
+function createSubdomainTenantSelector(options) {
+	return async (event) => {
+		const tenantSlug = selectTenantSlug(event.url, options.baseDomain);
+		if (!tenantSlug) return NO_SELECTION;
+		let tenantId;
+		try {
+			const tenant = await (await TenantCollection.create(options.classOptions())).findBySlug(tenantSlug);
+			tenantId = tenant?.status === TenantStatus.ACTIVE ? tenant.id ?? null : null;
+		} catch (error) {
+			if (!isMissingTenantTable(error)) throw error;
+			tenantId = null;
+		}
+		return {
+			tenantId,
+			tenantSlug
+		};
+	};
+}
+function normalizeTenantSelection(selection) {
+	return {
+		tenantId: typeof selection?.tenantId === "string" && selection.tenantId ? selection.tenantId : null,
+		tenantSlug: typeof selection?.tenantSlug === "string" && selection.tenantSlug ? selection.tenantSlug : null
+	};
+}
+//#endregion
+export { normalizeTenantSelection as n, selectTenantSlug as r, createSubdomainTenantSelector as t };
+
+//# sourceMappingURL=tenancy-BzdIxH2M.js.map

package/dist/chunks/tenancy-BzdIxH2M.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenancy-BzdIxH2M.js","names":[],"sources":["../../src/sveltekit/tenancy.ts"],"sourcesContent":["/**\n * Tenant *selection* for SvelteKit requests.\n *\n * Selection and authorization are deliberately separate:\n *\n * - a selector maps a trusted URL shape (by default the leading subdomain) to\n *   an active tenant record and publishes it as `locals.selectedTenant*`;\n * - the signed session (`createSessionHandler({ enterTenantContext: true })`)\n *   authorizes the signed-in user's membership and establishes the request\n *   tenant context.\n *\n * A selected tenant is useful for login and membership-gated switch flows, but\n * it never becomes ambient query authority by itself. The default selector\n * ignores client-provided tenant headers.\n */\n\nimport type { SmrtClassOptions } from '@happyvertical/smrt-core';\nimport { TenantCollection, TenantStatus } from '@happyvertical/smrt-users';\n\n/** The request fields a tenant selector may read. */\nexport interface TenantSelectionEvent {\n  readonly url: URL;\n  readonly request: { readonly headers: Headers };\n}\n\n/** URL-derived tenant candidate. Never authorization. */\nexport interface TenantSelection {\n  /** Database ID for an active tenant, or null when none resolves. */\n  readonly tenantId: string | null;\n  /** URL-derived slug. Informational until membership authorizes a switch. */\n  readonly tenantSlug: string | null;\n}\n\n/**\n * Replaceable selection extension point. Implementations must preserve the\n * rule that selection alone never establishes authorization context.\n */\nexport type TenantSelector = (\n  event: TenantSelectionEvent,\n) => TenantSelection | Promise<TenantSelection>;\n\nconst ROOT_LIKE_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);\nconst RESERVED_SUBDOMAINS = new Set(['www', 'api', 'app', 'admin']);\nconst NO_SELECTION: TenantSelection = Object.freeze({\n  tenantId: null,\n  tenantSlug: null,\n});\n\n/**\n * Pure URL parser used by the default selector.\n *\n * Set `TENANT_BASE_DOMAIN` (or pass `baseDomain`) in production so\n * multi-label public suffixes are never guessed. Without it, the fallback is\n * intended only for local domains such as `acme.demo.local`.\n */\nexport function selectTenantSlug(\n  url: URL,\n  baseDomain: string | undefined = process.env.TENANT_BASE_DOMAIN,\n): string | null {\n  const hostname = url.hostname.toLowerCase();\n  if (\n    ROOT_LIKE_HOSTS.has(hostname) ||\n    hostname.startsWith('[') ||\n    /^\\d{1,3}(\\.\\d{1,3}){3}$/.test(hostname)\n  ) {\n    return null;\n  }\n\n  const normalizedBase = baseDomain\n    ?.trim()\n    .toLowerCase()\n    .replace(/^\\.+|\\.+$/g, '');\n\n  let candidate: string | undefined;\n  if (normalizedBase) {\n    if (hostname === normalizedBase) return null;\n    const suffix = `.${normalizedBase}`;\n    if (!hostname.endsWith(suffix)) return null;\n    candidate = hostname.slice(0, -suffix.length).split('.')[0];\n  } else {\n    const labels = hostname.split('.');\n    if (labels.length < 3) return null;\n    candidate = labels[0];\n  }\n\n  return candidate && !RESERVED_SUBDOMAINS.has(candidate) ? candidate : null;\n}\n\nfunction isMissingTenantTable(error: unknown): boolean {\n  if (!(error instanceof Error)) return false;\n  const code = (error as Error & { code?: string }).code;\n  return (\n    code === '42P01' ||\n    error.message.includes('relation \"tenants\" does not exist') ||\n    error.message.includes('no such table: tenants')\n  );\n}\n\nexport interface SubdomainTenantSelectorOptions {\n  /** Explicit public base domain. Defaults to `TENANT_BASE_DOMAIN`. */\n  readonly baseDomain?: string;\n  /** Collection options for the `Tenant` lookup. */\n  readonly classOptions: () => SmrtClassOptions;\n}\n\n/**\n * Default selector: the leading subdomain names an ACTIVE tenant.\n *\n * A missing `tenants` table (a fresh project before its first migration)\n * yields no selection; the runtime never creates that table.\n */\nexport function createSubdomainTenantSelector(\n  options: SubdomainTenantSelectorOptions,\n): TenantSelector {\n  return async (event) => {\n    const tenantSlug = selectTenantSlug(event.url, options.baseDomain);\n    if (!tenantSlug) return NO_SELECTION;\n    let tenantId: string | null;\n    try {\n      const tenants = await TenantCollection.create(options.classOptions());\n      const tenant = await tenants.findBySlug(tenantSlug);\n      tenantId =\n        tenant?.status === TenantStatus.ACTIVE ? (tenant.id ?? null) : null;\n    } catch (error) {\n      if (!isMissingTenantTable(error)) throw error;\n      tenantId = null;\n    }\n    return { tenantId, tenantSlug };\n  };\n}\n\n/** Coerce an application selector's result into the published shape. */\nexport function normalizeTenantSelection(\n  selection: TenantSelection | null | undefined,\n): TenantSelection {\n  const tenantId =\n    typeof selection?.tenantId === 'string' && selection.tenantId\n      ? selection.tenantId\n      : null;\n  const tenantSlug =\n    typeof selection?.tenantSlug === 'string' && selection.tenantSlug\n      ? selection.tenantSlug\n      : null;\n  return { tenantId, tenantSlug };\n}\n"],"mappings":";;AAyCA,IAAM,kCAAkB,IAAI,IAAI;CAAC;CAAa;CAAa;CAAO;AAAO,CAAC;AAC1E,IAAM,sCAAsB,IAAI,IAAI;CAAC;CAAO;CAAO;CAAO;AAAO,CAAC;AAClE,IAAM,eAAgC,OAAO,OAAO;CAClD,UAAU;CACV,YAAY;AACd,CAAC;AASM,SAAS,iBACd,KACA,aAAiC,QAAQ,IAAI,oBAC9B;CACf,MAAM,WAAW,IAAI,SAAS,YAAY;CAC1C,IACE,gBAAgB,IAAI,QAAQ,KAC5B,SAAS,WAAW,GAAG,KACvB,0BAA0B,KAAK,QAAQ,GAEvC,OAAO;CAGT,MAAM,iBAAiB,YACnB,KAAK,CAAA,CACN,YAAY,CAAA,CACZ,QAAQ,cAAc,EAAE;CAE3B,IAAI;CACJ,IAAI,gBAAgB;EAClB,IAAI,aAAa,gBAAgB,OAAO;EACxC,MAAM,SAAS,IAAI;EACnB,IAAI,CAAC,SAAS,SAAS,MAAM,GAAG,OAAO;EACvC,YAAY,SAAS,MAAM,GAAG,CAAC,OAAO,MAAM,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE;CAC3D,OAAO;EACL,MAAM,SAAS,SAAS,MAAM,GAAG;EACjC,IAAI,OAAO,SAAS,GAAG,OAAO;EAC9B,YAAY,OAAO;CACrB;CAEA,OAAO,aAAa,CAAC,oBAAoB,IAAI,SAAS,IAAI,YAAY;AACxE;AAEA,SAAS,qBAAqB,OAAyB;CACrD,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CAEtC,OADc,MAAoC,SAEvC,WACT,MAAM,QAAQ,SAAS,qCAAmC,KAC1D,MAAM,QAAQ,SAAS,wBAAwB;AAEnD;AAeO,SAAS,8BACd,SACgB;CAChB,OAAO,OAAO,UAAU;EACtB,MAAM,aAAa,iBAAiB,MAAM,KAAK,QAAQ,UAAU;EACjE,IAAI,CAAC,YAAY,OAAO;EACxB,IAAI;EACJ,IAAI;GAEF,MAAM,SAAS,OAAM,MADC,iBAAiB,OAAO,QAAQ,aAAa,CAAC,EAAA,CACvC,WAAW,UAAU;GAClD,WACE,QAAQ,WAAW,aAAa,SAAU,OAAO,MAAM,OAAQ;EACnE,SAAS,OAAO;GACd,IAAI,CAAC,qBAAqB,KAAK,GAAG,MAAM;GACxC,WAAW;EACb;EACA,OAAO;GAAE;GAAU;EAAW;CAChC;AACF;AAGO,SAAS,yBACd,WACiB;CASjB,OAAO;EAAE,UAPP,OAAO,WAAW,aAAa,YAAY,UAAU,WACjD,UAAU,WACV;EAKa,YAHjB,OAAO,WAAW,eAAe,YAAY,UAAU,aACnD,UAAU,aACV;CACwB;AAChC"}

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-app-runtime",
-  "packageVersion": "0.57.8",
+  "packageVersion": "0.57.10",
   "objects": {},
   "moduleType": "smrt",
   "smrtDependencies": [

package/dist/smrt-knowledge.json

@@ -3,17 +3,18 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-app-runtime",
-  "packageVersion": "0.57.8",
+  "packageVersion": "0.57.10",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "ea1a5afa868f726a8ba4ef80a2238cf7432a5dd81f6ee298427bd9fe0f8bd27c",
-    "packageJson": "6ec4b98956d8136d5bb26d761120a305812415c6575d0dc8b86e1f7fc542a819",
-    "agents": "d428074160d0aea732efe70fb34f8035e4e968ab9bcb2e205a5a50b857eae656"
+    "manifest": "0752ac34af9a88c646fde59306cc180cd14c2c58894f8b4c827a2a9f798ec286",
+    "packageJson": "1fba7ecf6f188da0ce0c0d2b01c5798197f298922247983d348b77a94777df9c",
+    "agents": "4650832b5cfbae9cb4d4b92b222d1830b2fcab57320dc322a6df6ff6649d5af8"
   },
   "exports": [
     ".",
-    "./sveltekit"
+    "./sveltekit",
+    "./sveltekit-runtime"
   ],
   "dependencies": {
     "@happyvertical/smrt-config": "workspace:*",
@@ -66,5 +67,5 @@
     "polymorphicAssociations": 0,
     "uuidColumns": 0
   },
-  "agentDoc": "# @happyvertical/smrt-app-runtime\n\nApplication infrastructure composition for the validated runtime profiles in\n`@happyvertical/smrt-config`.\n\n## Local profile\n\n- `validateApplicationId()` is the canonical strict validator for explicit app\n  IDs. `encodeApplicationId()` derives a length-bounded, collision-resistant\n  ID from package names; generated operational surfaces must share these APIs.\n- `initializeLocalApplicationRuntime()` owns user data paths, SQLite tuning,\n  local application-secret creation, and the single-use owner bootstrap flow.\n- SQLite is acquired through `@happyvertical/sql`'s explicit\n  `{ driver: 'node:sqlite', custody: 'trusted-parent' }` boundary after the\n  runtime establishes its user-owned mode-0700 data root.\n- The initialization lease lives beside the data root\n  (`<parent>/.smrt-lease-<key>/initialization.sqlite`, #3877), then the legacy\n  `/tmp/.smrt-<uid>/<key>` lease, which older releases take alone: secure when\n  its ancestry is trusted, else lock-only (owner check on unmapped ancestors\n  relaxed, nothing written; skipped only if its directory cannot be created\n  and no lock file exists). It is required (secure) when the parent cannot hold\n  a lease. Legacy candidates, deduplicated and in this order: the in-namespace\n  uid, then that uid mapped through `/proc/self/uid_map` (identity when absent;\n  unparseable/non-covering fails closed); ownership checks still use the\n  in-namespace uid. The beside-data lease taken first keeps that order\n  deadlock-free. Only the in-namespace candidate (when it differs) is skipped\n  if its root is an existing real directory owned by another uid. Acquire in that order; never make the\n  lease location configurable per process — every process sharing a data root\n  must derive the same lease.\n- Application migrations are explicit through `prepareDatabase`; runtime never\n  creates application model tables implicitly. A rejected `prepareDatabase` is\n  normalized into `LocalRuntimeError` with the stable `migration_failed` code\n  and the fixed recovery message `MIGRATION_FAILED_MESSAGE` (\"run pnpm\n  app:setup and inspect the private migration logs\"). The caller's error text\n  is never surfaced — it is retained only as a non-enumerable `cause` for\n  private logs — and the same application root stays retryable.\n- Standalone migration commands must call `prepareLocalDatabaseStorage()`\n  before opening SQLite so custody is established without creating schema or\n  bootstrap records.\n- Read-only/copy/import operator commands must call\n  `validateLocalDatabaseStorage()` before opening SQLite; it verifies the\n  app-bound marker, source separation, real path chain, ownership, and mode\n  without creating or repairing storage.\n- Owner bootstrap creates normal `Person`, `User`, `Tenant`, owner `Role` /\n  `Membership`, and `Session` records in one transaction. `ownerTenant`\n  selects the tenant slug (default `default`); because `Tenant` upserts on\n  slug, the claim must look the slug up first and fail closed\n  (`owner_tenant_conflict`) rather than save over it. `adoptExisting` adopts\n  only an active root tenant with zero memberships (#3032).\n- Bootstrap is loopback-only. Only an HMAC of the short-lived token is stored.\n  A token that cannot claim fails a read-only preflight before role/catalog\n  seeding (#3323); the claim transaction's conditional UPDATE stays the\n  authority for single use, expiry, and concurrency.\n- Local MCP tokens (`mcpTokens`, `openLocalMcpTokenStore`, `smrt app token`):\n  owner-bound, scoped, expiring (default 30 d, max 365 d), revocable. Only a\n  domain-separated HMAC (application secret) is stored, in the runtime-owned\n  `_smrt_local_mcp_tokens` system table (created like the bootstrap table;\n  never application schema). Issue refuses scopes the owner lacks; verify\n  returns token scopes ∩ live permissions and `null` for anything else.\n- Bearer binding is explicit (`tenantBinding`, set by the auth adapter;\n  `direct-membership.ts`): `direct` (local tokens, default hosted resolver)\n  needs an active direct membership in exactly the tenant; the default\n  `direct-or-inherited` (hosted app mappings) applies\n  `isSessionTenantAuthorized`'s rule. The direct row, when present, is pinned\n  into `PermissionResolver`, so inheritance never substitutes for it.\n  `verify()` principals (and their `scopes` arrays) are frozen;\n  `runAsPrincipal` takes a validated, deep-frozen, null-prototype copy of\n  the principal before any await (`plain-data.ts`: own data only; poison\n  keys `__proto__`/`constructor`/`prototype`, accessors, inherited or\n  non-plain data, sparse arrays and functions rejected), authorizes from it,\n  and hands `fn` that snapshot. Token `issue()` input is read the same way.\n  They carry\n  `tenantBinding: 'direct'` and the\n  `LOCAL_MCP_TOKEN_PRINCIPAL` brand; `runAsPrincipal` rejects a copy that\n  widens the binding, so the two public APIs compose safely.\n  Never log or return the token outside `issue()`. The operator store opens an\n  uncached connection and takes no writer lease (revocation is per request).\n- Background jobs and application-defined paid capabilities are default-off.\n- The embedded runner reuses `TaskRunner`; it is not a second job contract.\n\n## Deployed profiles\n\n- `initializeDeployedApplicationRuntime()` composes only `self-hosted` and\n  `cloud`; it rejects local initialization and provider/binding mismatches.\n- Provider bindings own credentials, vendor clients, and readiness checks.\n  Runtime diagnostics contain selectors and status only.\n- The database binding must expose a provider-owned `close` callback before\n  `connect` can run. The runtime owns that cleanup boundary and runs the\n  application's explicit, idempotent `prepareDatabase` hook.\n- A failed startup cleanup throws `DeployedRuntimeCleanupError`; callers retain\n  and retry its idempotent `retryCleanup()` boundary until it succeeds.\n- Public authentication, asset storage, and secret bindings are mandatory and\n  readiness-checked before startup succeeds.\n- `createTaskWorker()` and `createScheduleWorker()` initialize the normal jobs\n  package runners against the shared PostgreSQL database. They are intended for\n  separate processes; the web process does not start them automatically. A\n  task worker polls `default` plus `SCHEDULED_JOB_QUEUE` (`agents`, where\n  `ScheduleRunner` enqueues) unless `queues` is passed (#3141). The\n  worker process must import the app's compiled registration\n  (`.smrt/runtime/register.js`, #3117) first; runners resolve `objectType`\n  through the registry and never load application source themselves.\n- `close()` drains in-flight readiness/session/worker initialization and\n  serialized runner start/stop operations, stops every runner returned by the\n  runtime, and then closes PostgreSQL. Returned runners must not be restarted\n  after runtime shutdown begins.\n- A tracked operation may await a re-entrant `close()` request without\n  deadlocking; external `close()` callers still await complete cleanup.\n- `health()` is process liveness. `readiness()` probes database/auth/assets/\n  secrets; it does not claim that an external worker fleet is running.\n- Database-provider readiness is additive; a PostgreSQL-specific server-version\n  probe always gates startup and live readiness.\n- Cloud must keep required tenant context and must never introduce a root or\n  unscoped tenant fallback. RLS remains an explicit deployment/migration choice.\n\n## SvelteKit entry (`./sveltekit`)\n\n- Server-only subpath; `@sveltejs/kit` is an optional peer and is externalized\n  in `vite.config.ts` (kit recognizes `redirect`/`fail` by class identity).\n  The root entry must never import kit or Svelte.\n- Without a `runtime` option the profile comes from smrt-config's\n  `resolveEffectiveApplicationRuntime(await loadConfig())`, the same rule as\n  `smrt app` (#3446): no block → `local`; `null`/`false`/`0`/`''` fail closed.\n- `createSmrtSvelteKitRuntime()` order is fixed: readiness gate → URL tenant\n  selection (`locals.selectedTenant*`, never tenant context, headers ignored) →\n  verified session (tenant context entered only when\n  `isSessionTenantAuthorized()` accepts it, else unauthenticated; never via\n  `createSessionHandler`, which re-runs `resolve` on downstream errors) →\n  publish `locals.tenantContext` only for that verified tenant.\n- `database-rls` isolation forces `postgresRls: true`, including on\n  `skipPaths` (anonymous principal). `resolve` runs at most once;\n  session-layer failure before it is a 500 with cleared locals.\n- In an RLS request `classOptions()`/`databaseConfig()` return the\n  transaction-bound request db (class `db` overrides win). Anything that\n  outlives a request (session service, tenant selector) must use the base\n  config, never these.\n- The local writer lease defaults to `defaultWriterLease()` (root\n  `acquireWriterLease` over `prepareApplicationStateRoot`, presenting\n  `SMRT_OPERATION_INSTANCE`); `acquireWriterLease` replaces it, `false` opts\n  out, deployed profiles never take it. Provider readiness stays injected:\n  apps pass `createProviderReadinessProbe`; deployed startup fails closed\n  without `providerReadiness`.\n- `getCollection()` builds from `classOptions()` on every call (RLS request db\n  inside a request); each generated route's embedded prelude imports the\n  app's `smrt.ts` and reaches it through core's\n  `createGeneratedCollectionAccess()` (a legacy accessor export wins,\n  deprecated for one release).\n- Owner setup removes the `smrt app` onboarding hand-off files by default,\n  immediately after the claim commits (before cookie serialization or hooks);\n  `onOwnerClaimed` is for additional cleanup and\n  `removeOnboardingHandoff: false` is the explicit opt-out.\n- `createSessionLayoutLoad()` adds `session.user` (`{ id, email, name? }`\n  copied from `locals.user`, else `null`). `createSignOutHandler(runtime)` is\n  the `POST` handler for `src/routes/sign-out/+server.ts`: 405 for other\n  methods, 403 unless `Sec-Fetch-Site: same-origin` or `Origin` equals the\n  request origin, then `destroySessionCookie` with the runtime's cookie\n  name/path/domain (cookie cleared even if the session row is gone); 204, or\n  303 to `/` when the request accepts HTML.\n- Owner setup re-checks loopback peer and loopback URL host per request and\n  returns only fixed `{ code, message }` failures.\n- `verifyLocalMcpToken` (local only) and `resolveMcpPrincipal` (hosted only:\n  issuer/subject → `oidc_identities` → exactly one active user with exactly\n  one active direct membership, else `null`) are the runtime's MCP credential\n  bindings; pass the runtime as `mountMcpAppRoute({ runtime })` (or\n  `createHostedMcpResourceAuth({ runtime })`).\n  Token claims never select a tenant.\n- `resolveApplicationId()` / `runtimeConfigurationFingerprint()` must stay\n  byte-compatible with process managers (golden vectors in tests).\n\n## Operator state (root entry)\n\n- One owner for the state shared by the web process and `smrt app`\n  (`@happyvertical/smrt-cli/app` re-exports these): `resolveApplicationStateRoot`\n  / `prepareApplicationStateRoot` (private app-bound mode-0700 root and\n  marker), `withOperationLock` (`operation.lock`), `acquireWriterLease` /\n  `readActiveWriterLease` (`writer.lease`), `reclaimStaleRecord`, and\n  `createProviderReadinessProbe` (`SMRT_*_READINESS_MODULE`, resolved from the\n  app root with Node's own ESM rules). File names, record formats, and\n  messages are a cross-process contract; never change them unilaterally.\n- Tests that hook `node:fs` interleavings must live in this package: from a\n  consumer the package is an externalized dependency a mock cannot reach.\n\n## Public runtime diagnostics\n\n- `projectRuntimeDiagnostics()` is the only public diagnostic projection. It\n  constructs the schema-version-1 allowlist and never serializes the private\n  local or deployed diagnostics objects.\n- The allowlist is limited to active profile/coarse health, schema and\n  migration readiness, six fixed capability statuses, a sorted/capped public\n  tool inventory plus digest, explicit operational topology differences,\n  coarse worker heartbeat state, and eight stable code/timestamp errors.\n- Callers supply an explicit clock and worker-heartbeat seam. A missing\n  heartbeat is `unknown`; web-process liveness never proves worker liveness.\n- Error ingestion maps unknown codes to `runtime_error`, truncates timestamps\n  to the minute, and ignores messages, stacks, logs, records, and nested state.\n- Authentication and diagnostics-read authorization belong before every call\n  to the projector or its runtime probes.\n\n## Invariants\n\n- Never expose application-secret bytes or bootstrap token hashes in diagnostics.\n- Never include migration or provider error text in a local or deployed startup\n  error message; migration driver text is a likely credential carrier.\n- Never include provider error text, URLs, tokens, or credentials in deployed\n  errors, diagnostics, health, or readiness payloads.\n- Keep local data, assets, database, and secrets outside the source tree.\n- Do not reach into collection/database private fields. Add an upstream public\n  API if composition cannot be expressed through exported surfaces.\n- Keep profile selection out of domain models, generated APIs, MCP/WebMCP\n  surfaces, effects, approvals, and authorization records.\n\n## Validation\n\n```bash\npnpm --filter @happyvertical/smrt-app-runtime test\npnpm --filter @happyvertical/smrt-app-runtime typecheck\npnpm --filter @happyvertical/smrt-app-runtime build\n```\n"
+  "agentDoc": "# @happyvertical/smrt-app-runtime\n\nApplication infrastructure composition for the validated runtime profiles in\n`@happyvertical/smrt-config`.\n\n## Local profile\n\n- `validateApplicationId()` is the canonical strict validator for explicit app\n  IDs. `encodeApplicationId()` derives a length-bounded, collision-resistant\n  ID from package names; generated operational surfaces must share these APIs.\n- `initializeLocalApplicationRuntime()` owns user data paths, SQLite tuning,\n  local application-secret creation, and the single-use owner bootstrap flow.\n- SQLite is acquired through `@happyvertical/sql`'s explicit\n  `{ driver: 'node:sqlite', custody: 'trusted-parent' }` boundary after the\n  runtime establishes its user-owned mode-0700 data root.\n- The initialization lease lives beside the data root\n  (`<parent>/.smrt-lease-<key>/initialization.sqlite`, #3877), then the legacy\n  `/tmp/.smrt-<uid>/<key>` lease, which older releases take alone: secure when\n  its ancestry is trusted, else lock-only (owner check on unmapped ancestors\n  relaxed, nothing written; skipped only if its directory cannot be created\n  and no lock file exists). It is required (secure) when the parent cannot hold\n  a lease. Legacy candidates, deduplicated and in this order: the in-namespace\n  uid, then that uid mapped through `/proc/self/uid_map` (identity when absent;\n  unparseable/non-covering fails closed); ownership checks still use the\n  in-namespace uid. The beside-data lease taken first keeps that order\n  deadlock-free. Only the in-namespace candidate (when it differs) is skipped\n  if its root is an existing real directory owned by another uid. Acquire in that order; never make the\n  lease location configurable per process — every process sharing a data root\n  must derive the same lease.\n- Application migrations are explicit through `prepareDatabase`; runtime never\n  creates application model tables implicitly. A rejected `prepareDatabase` is\n  normalized into `LocalRuntimeError` with the stable `migration_failed` code\n  and the fixed recovery message `MIGRATION_FAILED_MESSAGE` (\"run pnpm\n  app:setup and inspect the private migration logs\"). The caller's error text\n  is never surfaced — it is retained only as a non-enumerable `cause` for\n  private logs — and the same application root stays retryable.\n- Standalone migration commands must call `prepareLocalDatabaseStorage()`\n  before opening SQLite so custody is established without creating schema or\n  bootstrap records.\n- Read-only/copy/import operator commands must call\n  `validateLocalDatabaseStorage()` before opening SQLite; it verifies the\n  app-bound marker, source separation, real path chain, ownership, and mode\n  without creating or repairing storage.\n- Owner bootstrap creates normal `Person`, `User`, `Tenant`, owner `Role` /\n  `Membership`, and `Session` records in one transaction. `ownerTenant`\n  selects the tenant slug (default `default`); because `Tenant` upserts on\n  slug, the claim must look the slug up first and fail closed\n  (`owner_tenant_conflict`) rather than save over it. `adoptExisting` adopts\n  only an active root tenant with zero memberships (#3032).\n- Bootstrap is loopback-only. Only an HMAC of the short-lived token is stored.\n  A token that cannot claim fails a read-only preflight before role/catalog\n  seeding (#3323); the claim transaction's conditional UPDATE stays the\n  authority for single use, expiry, and concurrency.\n- Local MCP tokens (`mcpTokens`, `openLocalMcpTokenStore`, `smrt app token`):\n  owner-bound, scoped, expiring (default 30 d, max 365 d), revocable. Only a\n  domain-separated HMAC (application secret) is stored, in the runtime-owned\n  `_smrt_local_mcp_tokens` system table (created like the bootstrap table;\n  never application schema). Issue refuses scopes the owner lacks; verify\n  returns token scopes ∩ live permissions and `null` for anything else.\n- Bearer binding is explicit (`tenantBinding`, set by the auth adapter;\n  `direct-membership.ts`): `direct` (local tokens, default hosted resolver)\n  needs an active direct membership in exactly the tenant; the default\n  `direct-or-inherited` (hosted app mappings) applies\n  `isSessionTenantAuthorized`'s rule. The direct row, when present, is pinned\n  into `PermissionResolver`, so inheritance never substitutes for it.\n  `verify()` principals (and their `scopes` arrays) are frozen;\n  `runAsPrincipal` takes a validated, deep-frozen, null-prototype copy of\n  the principal before any await (`plain-data.ts`: own data only; poison\n  keys `__proto__`/`constructor`/`prototype`, accessors, inherited or\n  non-plain data, sparse arrays and functions rejected), authorizes from it,\n  and hands `fn` that snapshot. Token `issue()` input is read the same way.\n  They carry\n  `tenantBinding: 'direct'` and the\n  `LOCAL_MCP_TOKEN_PRINCIPAL` brand; `runAsPrincipal` rejects a copy that\n  widens the binding, so the two public APIs compose safely.\n  Never log or return the token outside `issue()`. The operator store opens an\n  uncached connection and takes no writer lease (revocation is per request).\n- Background jobs and application-defined paid capabilities are default-off.\n- The embedded runner reuses `TaskRunner`; it is not a second job contract.\n\n## Deployed profiles\n\n- `initializeDeployedApplicationRuntime()` composes only `self-hosted` and\n  `cloud`; it rejects local initialization and provider/binding mismatches.\n- Provider bindings own credentials, vendor clients, and readiness checks.\n  Runtime diagnostics contain selectors and status only.\n- The database binding must expose a provider-owned `close` callback before\n  `connect` can run. The runtime owns that cleanup boundary and runs the\n  application's explicit, idempotent `prepareDatabase` hook.\n- A failed startup cleanup throws `DeployedRuntimeCleanupError`; callers retain\n  and retry its idempotent `retryCleanup()` boundary until it succeeds.\n- Public authentication, asset storage, and secret bindings are mandatory and\n  readiness-checked before startup succeeds.\n- `createTaskWorker()` and `createScheduleWorker()` initialize the normal jobs\n  package runners against the shared PostgreSQL database. They are intended for\n  separate processes; the web process does not start them automatically. A\n  task worker polls `default` plus `SCHEDULED_JOB_QUEUE` (`agents`, where\n  `ScheduleRunner` enqueues) unless `queues` is passed (#3141). The\n  worker process must import the app's compiled registration\n  (`.smrt/runtime/register.js`, #3117) first; runners resolve `objectType`\n  through the registry and never load application source themselves.\n- `close()` drains in-flight readiness/session/worker initialization and\n  serialized runner start/stop operations, stops every runner returned by the\n  runtime, and then closes PostgreSQL. Returned runners must not be restarted\n  after runtime shutdown begins.\n- A tracked operation may await a re-entrant `close()` request without\n  deadlocking; external `close()` callers still await complete cleanup.\n- `health()` is process liveness. `readiness()` probes database/auth/assets/\n  secrets; it does not claim that an external worker fleet is running.\n- Database-provider readiness is additive; a PostgreSQL-specific server-version\n  probe always gates startup and live readiness.\n- Cloud must keep required tenant context and must never introduce a root or\n  unscoped tenant fallback. RLS remains an explicit deployment/migration choice.\n\n## SvelteKit entry (`./sveltekit`)\n\n- Server-only subpath; `@sveltejs/kit` is an optional peer and is externalized\n  in `vite.config.ts` (kit recognizes `redirect`/`fail` by class identity).\n  Consumer apps use core's `smrt()` preset to bundle the Kit-facing entry into\n  their SSR output and dedupe Kit; `./sveltekit-runtime` and the root stay external\n  to preserve native dependency loading. The implementation subpath is for\n  build composition; apps keep importing `./sveltekit`.\n  Package-build externalization alone does not preserve class identity through adapter-node's final production bundle.\n  The root entry must never import kit or Svelte.\n- Without a `runtime` option the profile comes from smrt-config's\n  `resolveEffectiveApplicationRuntime(await loadConfig())`, the same rule as\n  `smrt app` (#3446): no block → `local`; `null`/`false`/`0`/`''` fail closed.\n- `createSmrtSvelteKitRuntime()` order is fixed: readiness gate → URL tenant\n  selection (`locals.selectedTenant*`, never tenant context, headers ignored) →\n  verified session (tenant context entered only when\n  `isSessionTenantAuthorized()` accepts it, else unauthenticated; never via\n  `createSessionHandler`, which re-runs `resolve` on downstream errors) →\n  publish `locals.tenantContext` only for that verified tenant.\n- `database-rls` isolation forces `postgresRls: true`, including on\n  `skipPaths` (anonymous principal). `resolve` runs at most once;\n  session-layer failure before it is a 500 with cleared locals.\n- In an RLS request `classOptions()`/`databaseConfig()` return the\n  transaction-bound request db (class `db` overrides win). Anything that\n  outlives a request (session service, tenant selector) must use the base\n  config, never these.\n- The local writer lease defaults to `defaultWriterLease()` (root\n  `acquireWriterLease` over `prepareApplicationStateRoot`, presenting\n  `SMRT_OPERATION_INSTANCE`); `acquireWriterLease` replaces it, `false` opts\n  out, deployed profiles never take it. Provider readiness stays injected:\n  apps pass `createProviderReadinessProbe`; deployed startup fails closed\n  without `providerReadiness`.\n- `getCollection()` builds from `classOptions()` on every call (RLS request db\n  inside a request); each generated route's embedded prelude imports the\n  app's `smrt.ts` and reaches it through core's\n  `createGeneratedCollectionAccess()` (a legacy accessor export wins,\n  deprecated for one release).\n- Owner setup removes the `smrt app` onboarding hand-off files by default,\n  immediately after the claim commits (before cookie serialization or hooks);\n  `onOwnerClaimed` is for additional cleanup and\n  `removeOnboardingHandoff: false` is the explicit opt-out.\n- `createSessionLayoutLoad()` adds `session.user` (`{ id, email, name? }`\n  copied from `locals.user`, else `null`). `createSignOutHandler(runtime)` is\n  the `POST` handler for `src/routes/sign-out/+server.ts`: 405 for other\n  methods, 403 unless `Sec-Fetch-Site: same-origin` or `Origin` equals the\n  request origin, then `destroySessionCookie` with the runtime's cookie\n  name/path/domain (cookie cleared even if the session row is gone); 204, or\n  303 to `/` when the request accepts HTML.\n- Owner setup re-checks loopback peer and loopback URL host per request and\n  returns only fixed `{ code, message }` failures.\n- `verifyLocalMcpToken` (local only) and `resolveMcpPrincipal` (hosted only:\n  issuer/subject → `oidc_identities` → exactly one active user with exactly\n  one active direct membership, else `null`) are the runtime's MCP credential\n  bindings; pass the runtime as `mountMcpAppRoute({ runtime })` (or\n  `createHostedMcpResourceAuth({ runtime })`).\n  Token claims never select a tenant.\n- `resolveApplicationId()` / `runtimeConfigurationFingerprint()` must stay\n  byte-compatible with process managers (golden vectors in tests).\n\n## Operator state (root entry)\n\n- One owner for the state shared by the web process and `smrt app`\n  (`@happyvertical/smrt-cli/app` re-exports these): `resolveApplicationStateRoot`\n  / `prepareApplicationStateRoot` (private app-bound mode-0700 root and\n  marker), `withOperationLock` (`operation.lock`), `acquireWriterLease` /\n  `readActiveWriterLease` (`writer.lease`), `reclaimStaleRecord`, and\n  `createProviderReadinessProbe` (`SMRT_*_READINESS_MODULE`, resolved from the\n  app root with Node's own ESM rules). File names, record formats, and\n  messages are a cross-process contract; never change them unilaterally.\n- Tests that hook `node:fs` interleavings must live in this package: from a\n  consumer the package is an externalized dependency a mock cannot reach.\n\n## Public runtime diagnostics\n\n- `projectRuntimeDiagnostics()` is the only public diagnostic projection. It\n  constructs the schema-version-1 allowlist and never serializes the private\n  local or deployed diagnostics objects.\n- The allowlist is limited to active profile/coarse health, schema and\n  migration readiness, six fixed capability statuses, a sorted/capped public\n  tool inventory plus digest, explicit operational topology differences,\n  coarse worker heartbeat state, and eight stable code/timestamp errors.\n- Callers supply an explicit clock and worker-heartbeat seam. A missing\n  heartbeat is `unknown`; web-process liveness never proves worker liveness.\n- Error ingestion maps unknown codes to `runtime_error`, truncates timestamps\n  to the minute, and ignores messages, stacks, logs, records, and nested state.\n- Authentication and diagnostics-read authorization belong before every call\n  to the projector or its runtime probes.\n\n## Invariants\n\n- Never expose application-secret bytes or bootstrap token hashes in diagnostics.\n- Never include migration or provider error text in a local or deployed startup\n  error message; migration driver text is a likely credential carrier.\n- Never include provider error text, URLs, tokens, or credentials in deployed\n  errors, diagnostics, health, or readiness payloads.\n- Keep local data, assets, database, and secrets outside the source tree.\n- Do not reach into collection/database private fields. Add an upstream public\n  API if composition cannot be expressed through exported surfaces.\n- Keep profile selection out of domain models, generated APIs, MCP/WebMCP\n  surfaces, effects, approvals, and authorization records.\n\n## Validation\n\nBuild first: `sveltekit-production.test.ts` copies the published `dist` entry\nand exercises the final adapter-node HTTP handler in a separate process.\n\n```bash\npnpm --filter @happyvertical/smrt-app-runtime build\npnpm --filter @happyvertical/smrt-app-runtime test\npnpm --filter @happyvertical/smrt-app-runtime typecheck\n```\n"
 }

package/dist/sveltekit/index.d.ts

@@ -13,9 +13,9 @@
  * export const { handle, init } = runtime;
  * ```
  */
+export { type ApplicationRuntimeDiagnosticsOptions, authorizedTenantLocalsHandle, composeHandles, createSmrtSvelteKitRuntime, defaultWriterLease, type ProviderReadinessComponent, type ProviderReadinessFactory, type RuntimeHealthBody, type SmrtRuntimeBoundPrincipal, type SmrtRuntimeBoundPrincipalSnapshot, type SmrtRuntimeDeepReadonly, type SmrtRuntimeLocals, type SmrtRuntimeMcpIdentity, type SmrtRuntimeMcpPrincipalMapping, type SmrtRuntimeSessionCookie, type SmrtRuntimeSessionOptions, type SmrtSvelteKitRuntime, type SmrtSvelteKitRuntimeOptions, type TenantBindingMode, type WriterLease, type WriterLeaseContext, } from '@happyvertical/smrt-app-runtime/sveltekit-runtime';
 export { createRuntimeDiagnosticsHandler, createRuntimeHealthHandler, createSessionLayoutLoad, type DiagnosticsPrincipalLocals, RUNTIME_DIAGNOSTICS_READ_PERMISSION, type RuntimeDiagnosticsHandlerOptions, type SessionLayoutData, type SessionLayoutUser, } from './handlers.js';
 export { createOwnerSetupPage, DEFAULT_OWNER_SETUP_MESSAGES, isLoopbackAddress, isLoopbackHostname, isLoopbackRequest, OWNER_SETUP_FIELDS, type OwnerSetupActionEvent, type OwnerSetupErrorCode, type OwnerSetupEvent, type OwnerSetupFailure, type OwnerSetupLinkState, type OwnerSetupPage, type OwnerSetupPageData, type OwnerSetupPageOptions, } from './owner-setup.js';
-export { type ApplicationRuntimeDiagnosticsOptions, authorizedTenantLocalsHandle, composeHandles, createSmrtSvelteKitRuntime, defaultWriterLease, type ProviderReadinessComponent, type ProviderReadinessFactory, type RuntimeHealthBody, type SmrtRuntimeBoundPrincipal, type SmrtRuntimeBoundPrincipalSnapshot, type SmrtRuntimeDeepReadonly, type SmrtRuntimeLocals, type SmrtRuntimeMcpIdentity, type SmrtRuntimeMcpPrincipalMapping, type SmrtRuntimeSessionCookie, type SmrtRuntimeSessionOptions, type SmrtSvelteKitRuntime, type SmrtSvelteKitRuntimeOptions, type TenantBindingMode, type WriterLease, type WriterLeaseContext, } from './runtime.js';
 export { createSignOutHandler } from './sign-out.js';
 export { createSubdomainTenantSelector, normalizeTenantSelection, type SubdomainTenantSelectorOptions, selectTenantSlug, type TenantSelection, type TenantSelectionEvent, type TenantSelector, } from './tenancy.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/sveltekit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sveltekit/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,0BAA0B,EAC/B,mCAAmC,EACnC,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,oCAAoC,EACzC,4BAA4B,EAC5B,cAAc,EACd,0BAA0B,EAC1B,kBAAkB,EAClB,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,8BAA8B,EACnC,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sveltekit/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,KAAK,oCAAoC,EACzC,4BAA4B,EAC5B,cAAc,EACd,0BAA0B,EAC1B,kBAAkB,EAClB,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,0BAA0B,EAC/B,mCAAmC,EACnC,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,8BAA8B,EACnC,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAC"}

package/dist/sveltekit/owner-setup.d.ts

@@ -6,9 +6,9 @@
  * stores, logs, or returns claim errors, and it re-checks loopback custody on
  * every request instead of trusting the bind host alone.
  */
+import { type LocalOwnerClaimResult } from '@happyvertical/smrt-app-runtime';
 import type { Cookies } from '@sveltejs/kit';
 import { type ActionFailure } from '@sveltejs/kit';
-import { type LocalOwnerClaimResult } from '../index.js';
 import type { SmrtSvelteKitRuntime } from './runtime.js';
 /** Data returned by the setup page `load`. */
 export interface OwnerSetupPageData {

package/dist/sveltekit/owner-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-setup.d.ts","sourceRoot":"","sources":["../../src/sveltekit/owner-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,KAAK,aAAa,EAAkB,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,KAAK,qBAAqB,EAAqB,MAAM,aAAa,CAAC;AAE5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC;AAED,MAAM,MAAM,mBAAmB,GAC3B,OAAO,GACP,SAAS,GACT,SAAS,GACT,aAAa,CAAC;AAElB,yDAAyD;AACzD,MAAM,MAAM,mBAAmB;AAC7B,wCAAwC;AACtC,gBAAgB;AAClB,2EAA2E;GACzE,mBAAmB;AACrB,kEAAkE;GAChE,qBAAqB;AACvB,+EAA+E;GAC7E,eAAe;AACjB,2DAA2D;GACzD,gBAAgB,CAAC;AAErB,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,mDAAmD;AACnD,eAAO,MAAM,kBAAkB;;;;;;EAMpB,CAAC;AAEZ,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CACjD,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CASnC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,gBAAgB,IAAI,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,yFAAyF;IACzF,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC;IAC3D;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CACxB,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,qBAAqB,KACzB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,qBAAqB,KACzB,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC;KAChD,CAAC;CACH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,IAAI,CACX,oBAAoB,EACpB,iBAAiB,GAAG,cAAc,GAAG,eAAe,CACrD,GACC,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,EAC7D,OAAO,GAAE,qBAA0B,GAClC,cAAc,CAkHhB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,gBAAgB,IAAI,MAAM,CAAC;CAC5B,GAAG,OAAO,CAQV;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAc3E;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG5D"}
+{"version":3,"file":"owner-setup.d.ts","sourceRoot":"","sources":["../../src/sveltekit/owner-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,KAAK,qBAAqB,EAG3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,KAAK,aAAa,EAAkB,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;CACpC;AAED,MAAM,MAAM,mBAAmB,GAC3B,OAAO,GACP,SAAS,GACT,SAAS,GACT,aAAa,CAAC;AAElB,yDAAyD;AACzD,MAAM,MAAM,mBAAmB;AAC7B,wCAAwC;AACtC,gBAAgB;AAClB,2EAA2E;GACzE,mBAAmB;AACrB,kEAAkE;GAChE,qBAAqB;AACvB,+EAA+E;GAC7E,eAAe;AACjB,2DAA2D;GACzD,gBAAgB,CAAC;AAErB,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,mDAAmD;AACnD,eAAO,MAAM,kBAAkB;;;;;;EAMpB,CAAC;AAEZ,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CACjD,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CASnC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,gBAAgB,IAAI,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,yFAAyF;IACzF,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC;IAC3D;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CACxB,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,qBAAqB,KACzB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,qBAAqB,KACzB,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC;KAChD,CAAC;CACH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,IAAI,CACX,oBAAoB,EACpB,iBAAiB,GAAG,cAAc,GAAG,eAAe,CACrD,GACC,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,EAC7D,OAAO,GAAE,qBAA0B,GAClC,cAAc,CAkHhB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,gBAAgB,IAAI,MAAM,CAAC;CAC5B,GAAG,OAAO,CAQV;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAc3E;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG5D"}

package/dist/sveltekit-runtime.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Server implementation boundary for the SvelteKit adapter. Applications use
+ * ./sveltekit; this entry stays external while its Kit-facing wrappers bundle.
+ * Keep value imports from @sveltejs/kit out of this dependency graph.
+ */
+export * from './sveltekit/runtime.js';
+//# sourceMappingURL=sveltekit-runtime.d.ts.map

package/dist/sveltekit-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sveltekit-runtime.d.ts","sourceRoot":"","sources":["../src/sveltekit-runtime.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,wBAAwB,CAAC"}