@happyvertical/smrt-cli 0.57.30 → 0.57.31

package/dist/index.js

@@ -51,77 +51,77 @@ var _cookbookCommands = null;
 var _kitchenCommands = null;
 async function getGnodeCommands() {
 	if (!_gnodeCommands) {
-		const { gnodeCommands } = await import("./commands-DaTvrJwY.js");
+		const { gnodeCommands } = await import("./commands-CGjKkRkb.js");
 		_gnodeCommands = gnodeCommands;
 	}
 	return _gnodeCommands;
 }
 async function getGitCommands() {
 	if (!_gitCommands) {
-		const { gitCommands } = await import("./commands-DaTvrJwY.js");
+		const { gitCommands } = await import("./commands-CGjKkRkb.js");
 		_gitCommands = gitCommands;
 	}
 	return _gitCommands;
 }
 async function getGenerateCommands() {
 	if (!_generateCommands) {
-		const { generateCommands } = await import("./commands-DaTvrJwY.js");
+		const { generateCommands } = await import("./commands-CGjKkRkb.js");
 		_generateCommands = generateCommands;
 	}
 	return _generateCommands;
 }
 async function getInitCommands() {
 	if (!_initCommands) {
-		const { initCommands } = await import("./commands-DaTvrJwY.js");
+		const { initCommands } = await import("./commands-CGjKkRkb.js");
 		_initCommands = initCommands;
 	}
 	return _initCommands;
 }
 async function getUtilityCommands() {
 	if (!_utilityCommands) {
-		const { utilityCommands } = await import("./commands-DaTvrJwY.js");
+		const { utilityCommands } = await import("./commands-CGjKkRkb.js");
 		_utilityCommands = utilityCommands;
 	}
 	return _utilityCommands;
 }
 async function getDispatchCommands() {
 	if (!_dispatchCommands) {
-		const { dispatchCommands } = await import("./commands-DaTvrJwY.js");
+		const { dispatchCommands } = await import("./commands-CGjKkRkb.js");
 		_dispatchCommands = dispatchCommands;
 	}
 	return _dispatchCommands;
 }
 async function getDocsCommands() {
 	if (!_docsCommands) {
-		const { docsCommands } = await import("./commands-DaTvrJwY.js");
+		const { docsCommands } = await import("./commands-CGjKkRkb.js");
 		_docsCommands = docsCommands;
 	}
 	return _docsCommands;
 }
 async function getPlaygroundCommands() {
 	if (!_playgroundCommands) {
-		const { playgroundCommands } = await import("./commands-DaTvrJwY.js");
+		const { playgroundCommands } = await import("./commands-CGjKkRkb.js");
 		_playgroundCommands = playgroundCommands;
 	}
 	return _playgroundCommands;
 }
 async function getCookbookCommands() {
 	if (!_cookbookCommands) {
-		const { cookbookCommands } = await import("./commands-DaTvrJwY.js");
+		const { cookbookCommands } = await import("./commands-CGjKkRkb.js");
 		_cookbookCommands = cookbookCommands;
 	}
 	return _cookbookCommands;
 }
 async function getKitchenCommands() {
 	if (!_kitchenCommands) {
-		const { kitchenCommands } = await import("./commands-DaTvrJwY.js");
+		const { kitchenCommands } = await import("./commands-CGjKkRkb.js");
 		_kitchenCommands = kitchenCommands;
 	}
 	return _kitchenCommands;
 }
 async function getWorkbenchCommands() {
 	if (!_workbenchCommands) {
-		const { workbenchCommands } = await import("./commands-DaTvrJwY.js");
+		const { workbenchCommands } = await import("./commands-CGjKkRkb.js");
 		_workbenchCommands = workbenchCommands;
 	}
 	return _workbenchCommands;

package/dist/{oidcProvisioningPrimitives-Dl9qIcYS-7jvRd7kv.js → oidcProvisioningPrimitives-Dl9qIcYS-CPuL4amA.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { n as __exportAll$1 } from "./NostrIdentity-RJaATTCt-BbRHWyee.js";
-import { t as OidcIdentity } from "./OidcIdentity-MVVO3MfG-CXnXDsp2.js";
-import { c as saveOidcRaceArbiter, n as ProfileCollection, t as Profile } from "./ProfileCollection-CMS9dFc0-Cz90ifOo.js";
-import { t as ProfileTypeCollection } from "./ProfileTypeCollection-B7m698Bl-Rb0BPlH7.js";
+import { t as OidcIdentity } from "./OidcIdentity-MVVO3MfG-CW0gRjHH.js";
+import { c as saveOidcRaceArbiter, n as ProfileCollection, t as Profile } from "./ProfileCollection-CMS9dFc0-ou6DCuSN.js";
+import { t as ProfileTypeCollection } from "./ProfileTypeCollection-B7m698Bl-DxyyJbnp.js";
 import { smrt } from "@happyvertical/smrt-core";
 //#region ../profiles/dist/chunks/oidcProvisioningPrimitives-Dl9qIcYS.js
 var oidcProvisioningPrimitives_Dl9qIcYS_exports = /* @__PURE__ */ __exportAll({

package/dist/{operator-B-FL7iax.js → operator-XENg78bg.js}

@@ -1,5 +1,5 @@
-import { m as withSystemContext } from "./dist-PrNuW-bX.js";
-import { Ct as TenantStatus, E as PasswordCredentialService, K as UserCollection, N as RoleCollection, Q as UsersPasswordCredentialCollection, V as TenantCollection, dt as normalizeUsername, g as MembershipCollection, ht as verifySecretHash, j as PermissionResolver, lt as normalizeEmail, st as isValidEmail, wt as UserStatus, yt as MembershipStatus } from "./PasswordCredentialService-DA2Y6H2X-H6lIWMpQ.js";
+import { m as withSystemContext } from "./dist-Cl_Woozo.js";
+import { Ct as TenantStatus, E as PasswordCredentialService, K as UserCollection, N as RoleCollection, Q as UsersPasswordCredentialCollection, V as TenantCollection, dt as normalizeUsername, g as MembershipCollection, ht as verifySecretHash, j as PermissionResolver, lt as normalizeEmail, st as isValidEmail, wt as UserStatus, yt as MembershipStatus } from "./PasswordCredentialService-DA2Y6H2X-C1wDQMMz.js";
 import { isPostgresDatabase, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
 //#region ../users/dist/operator.js
 var OperatorProvisioningError = class extends Error {

package/dist/{resolveIdentity-CR5p_g7K-Cvw10KZP.js → resolveIdentity-CR5p_g7K-XIGHZpkd.js}

@@ -1,10 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { m as withSystemContext } from "./dist-PrNuW-bX.js";
+import { m as withSystemContext } from "./dist-Cl_Woozo.js";
 import { a as verifyAuthEvent, n as __exportAll$1, t as NostrIdentity } from "./NostrIdentity-RJaATTCt-BbRHWyee.js";
 import { t as ApiKey } from "./ApiKey-9YuYcpWy-BdrXOe-N.js";
-import { t as OidcIdentity } from "./OidcIdentity-MVVO3MfG-CXnXDsp2.js";
-import { a as coordinateOidcProvisioning, o as isOidcProvisioningRaceConflict, s as normalizeIdentityEmail } from "./ProfileCollection-CMS9dFc0-Cz90ifOo.js";
-import { n as insertOidcProvisioningIdentity, t as createOidcProvisioningPerson } from "./oidcProvisioningPrimitives-Dl9qIcYS-7jvRd7kv.js";
+import { t as OidcIdentity } from "./OidcIdentity-MVVO3MfG-CW0gRjHH.js";
+import { a as coordinateOidcProvisioning, o as isOidcProvisioningRaceConflict, s as normalizeIdentityEmail } from "./ProfileCollection-CMS9dFc0-ou6DCuSN.js";
+import { n as insertOidcProvisioningIdentity, t as createOidcProvisioningPerson } from "./oidcProvisioningPrimitives-Dl9qIcYS-CPuL4amA.js";
 import { resolveDatabase } from "@happyvertical/smrt-core";
 //#region ../profiles/dist/chunks/resolveIdentity-CR5p_g7K.js
 var resolveIdentity_CR5p_g7K_exports = /* @__PURE__ */ __exportAll({
@@ -72,13 +72,13 @@ async function resolveIdentity(context) {
 	};
 }
 async function findProfileByExternalId(provider, externalId, options) {
-	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-s4mp3n62-BRCES4zy.js").then((n) => n.r).then((n) => n.r);
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-s4mp3n62-DTnGCBp_.js").then((n) => n.r).then((n) => n.r);
 	const identities = await (await OidcIdentityCollection.create(options)).findByProvider(provider);
 	for (const identity of identities) if (identity.subject === externalId || identity.email?.includes(externalId)) {
 		const profile = await identity.getProfile();
 		if (profile) return profile;
 	}
-	const { ProfileCollection } = await import("./ProfileCollection-CMS9dFc0-Cz90ifOo.js").then((n) => n.r).then((n) => n.r);
+	const { ProfileCollection } = await import("./ProfileCollection-CMS9dFc0-ou6DCuSN.js").then((n) => n.r).then((n) => n.r);
 	const profiles = await (await ProfileCollection.create(options)).list({
 		where: { email: `${externalId}@users.noreply.github.com` },
 		limit: 1
@@ -99,7 +99,7 @@ async function reuseExistingOidcIdentityForProfile(profileId, claims, provider,
 		createConcurrencyError: (cause) => new Error("Concurrent exact OIDC identity reuse did not converge.", cause === void 0 ? void 0 : { cause }),
 		rebindRootResult: rebindOidcProfileResult,
 		provision: (tx) => withSystemContext(async () => {
-			const { OidcIdentityCollection } = await import("./OidcIdentityCollection-s4mp3n62-BRCES4zy.js").then((n) => n.r).then((n) => n.r);
+			const { OidcIdentityCollection } = await import("./OidcIdentityCollection-s4mp3n62-DTnGCBp_.js").then((n) => n.r).then((n) => n.r);
 			const identity = await (await OidcIdentityCollection.create({ db: tx })).findBySubject(normalizedClaims.iss, normalizedClaims.sub);
 			if (!identity) throw new Error("OidcIdentity.findOrCreate() no longer creates authentication links; use UserCollection.getOrCreateFromOidc() or createProfileFromOidc().");
 			if (identity.profileId !== profileId) throw new Error(`OIDC identity ${normalizedClaims.iss} subject ${normalizedClaims.sub} belongs to a different Profile.`);
@@ -133,7 +133,7 @@ async function coordinateProfileOidcProvisioning(claims, provider, options) {
 	});
 }
 async function provisionOidcProfile(claims, provider, options) {
-	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-s4mp3n62-BRCES4zy.js").then((n) => n.r).then((n) => n.r);
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-s4mp3n62-DTnGCBp_.js").then((n) => n.r).then((n) => n.r);
 	const existingIdentity = await (await OidcIdentityCollection.create(options)).findBySubject(claims.iss, claims.sub);
 	if (existingIdentity) {
 		const profile2 = await existingIdentity.getProfile();
@@ -148,7 +148,7 @@ async function provisionOidcProfile(claims, provider, options) {
 			created: false
 		};
 	}
-	const { ProfileCollection } = await import("./ProfileCollection-CMS9dFc0-Cz90ifOo.js").then((n) => n.r).then((n) => n.r);
+	const { ProfileCollection } = await import("./ProfileCollection-CMS9dFc0-ou6DCuSN.js").then((n) => n.r).then((n) => n.r);
 	const profileCollection = await ProfileCollection.create(options);
 	if (claims.email) {
 		if (await profileCollection.findUniqueGlobalPersonByEmail(claims.email)) {
@@ -175,8 +175,8 @@ async function provisionOidcProfile(claims, provider, options) {
 	};
 }
 async function rebindOidcProfileResult(result, rootDb) {
-	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-s4mp3n62-BRCES4zy.js").then((n) => n.r).then((n) => n.r);
-	const { ProfileCollection } = await import("./ProfileCollection-CMS9dFc0-Cz90ifOo.js").then((n) => n.r).then((n) => n.r);
+	const { OidcIdentityCollection } = await import("./OidcIdentityCollection-s4mp3n62-DTnGCBp_.js").then((n) => n.r).then((n) => n.r);
+	const { ProfileCollection } = await import("./ProfileCollection-CMS9dFc0-ou6DCuSN.js").then((n) => n.r).then((n) => n.r);
 	const profileId = requireOidcProfileId(result.profile.id);
 	const identityId = requireOidcProfileId(result.oidcIdentity.id);
 	const [profile, oidcIdentity] = await withSystemContext(async () => {
@@ -225,11 +225,11 @@ async function createProfileFromNostr(email, nostrData, options) {
 			created: false
 		};
 	}
-	const { Person } = await import("./oidcProvisioningPrimitives-Dl9qIcYS-7jvRd7kv.js").then((n) => n.r).then((n) => n.o);
-	const { ProfileTypeCollection } = await import("./ProfileTypeCollection-B7m698Bl-Rb0BPlH7.js").then((n) => n.n).then((n) => n.n);
+	const { Person } = await import("./oidcProvisioningPrimitives-Dl9qIcYS-CPuL4amA.js").then((n) => n.r).then((n) => n.o);
+	const { ProfileTypeCollection } = await import("./ProfileTypeCollection-B7m698Bl-DxyyJbnp.js").then((n) => n.n).then((n) => n.n);
 	let personType = await (await ProfileTypeCollection.create(options)).getBySlug("person");
 	if (!personType) {
-		const { ProfileType } = await import("./ProfileCollection-CMS9dFc0-Cz90ifOo.js").then((n) => n.r).then((n) => n.h);
+		const { ProfileType } = await import("./ProfileCollection-CMS9dFc0-ou6DCuSN.js").then((n) => n.r).then((n) => n.h);
 		personType = new ProfileType({
 			...options,
 			slug: "person",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-cli",
-  "version": "0.57.30",
+  "version": "0.57.31",
   "description": "Developer CLI for SMRT framework - introspection, testing, and project management",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,15 +33,15 @@
     "@happyvertical/ai": "^0.108.0",
     "@happyvertical/files": "^0.108.0",
     "@happyvertical/logger": "^0.108.0",
-    "@happyvertical/smrt-agents": "0.57.30",
-    "@happyvertical/smrt-app-runtime": "0.57.30",
-    "@happyvertical/smrt-config": "0.57.30",
-    "@happyvertical/smrt-core": "0.57.30",
-    "@happyvertical/smrt-dev-mcp": "0.57.30",
-    "@happyvertical/smrt-ledgers": "0.57.30",
-    "@happyvertical/smrt-playground": "0.57.30",
-    "@happyvertical/smrt-types": "0.57.30",
-    "@happyvertical/smrt-users": "0.57.30",
+    "@happyvertical/smrt-agents": "0.57.31",
+    "@happyvertical/smrt-app-runtime": "0.57.31",
+    "@happyvertical/smrt-config": "0.57.31",
+    "@happyvertical/smrt-core": "0.57.31",
+    "@happyvertical/smrt-dev-mcp": "0.57.31",
+    "@happyvertical/smrt-ledgers": "0.57.31",
+    "@happyvertical/smrt-playground": "0.57.31",
+    "@happyvertical/smrt-types": "0.57.31",
+    "@happyvertical/smrt-users": "0.57.31",
     "@happyvertical/sql": "^0.108.0",
     "@happyvertical/utils": "^0.108.0",
     "@modelcontextprotocol/server": "2.3.1",

package/scripts/verify-package-types-exports.js

@@ -1,7 +1,13 @@
 #!/usr/bin/env node
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import {
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+} from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, relative, resolve, sep } from 'node:path';
 import { parse } from 'acorn';
@@ -67,7 +73,7 @@ function collectTypePaths(packageJson) {
   return [...typePaths].map((filePath) => filePath.replace(/^\.\//, ''));
 }
 
-function collectRuntimePaths(packageJson) {
+function collectRuntimePaths(packageJson, resourceExports) {
   const runtimePaths = new Set();
 
   const addPath = (filePath) => {
@@ -104,7 +110,7 @@ function collectRuntimePaths(packageJson) {
     }
 
     for (const [key, child] of Object.entries(value)) {
-      visit(child, key);
+      if (!resourceExports.has(key)) visit(child, key);
     }
   };
 
@@ -131,6 +137,41 @@ function archiveHasPath(archiveEntries, relativePath) {
   return [...archiveEntries].some((entry) => pattern.test(entry));
 }
 
+/** Resource declarations classify copied files, never runtime import edges. */
+function collectResourceExports(packageJson, archiveEntries) {
+  const declared = packageJson.smrt?.resourceExports;
+  if (declared === undefined) return new Set();
+  if (!Array.isArray(declared))
+    fail(
+      'smrt.resourceExports must be an array of literal-directory export patterns',
+    );
+  const resources = new Set();
+  for (const subpath of declared) {
+    // Require a non-root directory and one terminal wildcard. An exact,
+    // unconditioned mapping prevents a declaration from hiding other branches.
+    if (
+      typeof subpath !== 'string' ||
+      !/^\.\/(?:[a-zA-Z0-9_-][a-zA-Z0-9._-]*\/)+\*$/.test(subpath) ||
+      resources.has(subpath) ||
+      packageJson.exports?.[subpath] !== subpath
+    ) {
+      fail(
+        `Invalid smrt.resourceExports declaration: ${JSON.stringify(subpath)}; use a unique directory pattern such as "./template/*" with an identical unconditioned export target`,
+      );
+    }
+    const prefix = `package/${subpath.slice(2, -1)}`;
+    if (
+      ![...archiveEntries].some(
+        (entry) => entry.startsWith(prefix) && !entry.endsWith('/'),
+      )
+    ) {
+      fail(`smrt.resourceExports ${subpath} has no packed files`);
+    }
+    resources.add(subpath);
+  }
+  return resources;
+}
+
 function stripComments(source) {
   return source
     .replace(/\/\*[\s\S]*?\*\//g, '')
@@ -412,6 +453,191 @@ function collectMissingRelativeRuntimeImports(packageRoot, runtimeEntryFiles) {
   return missing;
 }
 
+/** Inspect each exported runtime closure, never infer Svelte from its package. */
+function verifySvelteExportConditions(
+  packageRoot,
+  packageJson,
+  archiveEntries,
+  resourceExports,
+) {
+  const display = (path) => relative(packageRoot, path);
+  const reachesSvelte = (entryPath) => {
+    const pending = [entryPath];
+    const seen = new Set();
+    let marker;
+    while (pending.length) {
+      const filePath = pending.pop();
+      if (seen.has(filePath)) continue;
+      seen.add(filePath);
+      if (
+        !isWithinPackageRoot(packageRoot, filePath) ||
+        !existsSync(filePath) ||
+        !statSync(filePath).isFile()
+      ) {
+        fail(
+          `Svelte export inspection cannot read packed target ${display(filePath)}`,
+        );
+      }
+      if (filePath.endsWith('.svelte')) {
+        marker ??= display(filePath);
+        continue;
+      }
+      if (!/\.[cm]?js$/.test(filePath)) continue;
+      let program;
+      try {
+        program = parse(readFileSync(filePath, 'utf8'), {
+          ecmaVersion: 'latest',
+          sourceType: 'module',
+        });
+      } catch (error) {
+        fail(
+          `Svelte export inspection cannot parse packed JavaScript ${display(filePath)}: ${error.message}`,
+        );
+      }
+      // Only static runtime edges. JS has no type-only imports; .d.ts targets
+      // and component script types never enter this parser.
+      for (const statement of program.body) {
+        if (
+          ![
+            'ImportDeclaration',
+            'ExportNamedDeclaration',
+            'ExportAllDeclaration',
+          ].includes(statement.type)
+        )
+          continue;
+        const specifier = statement.source?.value;
+        if (typeof specifier !== 'string') continue;
+        if (specifier === 'svelte' || specifier.startsWith('svelte/')) {
+          marker ??= `${display(filePath)} -> ${specifier}`;
+        }
+        if (!specifier.startsWith('.')) continue;
+        const target = resolve(
+          dirname(filePath),
+          specifier.replace(/[?#].*$/, ''),
+        );
+        if (!isWithinPackageRoot(packageRoot, target)) {
+          fail(
+            `Svelte export inspection found an escaping packed import: ${display(filePath)} -> ${specifier}`,
+          );
+        }
+        // Require exact emitted targets for explicit extensions. Do not silently
+        // substitute a neighbouring .js for a missing .mjs or component.
+        const resolved = /\.[^/]+$/.test(target)
+          ? target
+          : findExistingPackageCandidate(
+              packageRoot,
+              target,
+              resolveRuntimeCandidates,
+            );
+        if (
+          !resolved ||
+          !existsSync(resolved) ||
+          !statSync(resolved).isFile()
+        ) {
+          fail(
+            `Svelte export inspection missing packed import target: ${display(filePath)} -> ${specifier}`,
+          );
+        }
+        if (isRuntimeSourceFile(resolved)) pending.push(resolved);
+      }
+    }
+    return marker;
+  };
+  const packedTargets = (value) => {
+    const pattern = new RegExp(
+      `^${escapeRegex(`package/${value.slice(2)}`).replaceAll('*', '.*')}$`,
+    );
+    return value.includes('*')
+      ? [...archiveEntries]
+          .filter((entry) => pattern.test(entry) && !entry.endsWith('/'))
+          .map((entry) => entry.slice(8))
+      : [value.slice(2)];
+  };
+  const validatedConditions = new WeakSet();
+  const validateSvelteTargets = (value, subpath) => {
+    if (value === null) return 0;
+    if (typeof value === 'string') {
+      if (!value.startsWith('./'))
+        fail(`Export ${subpath} has a non-relative svelte target: ${value}`);
+      const targets = packedTargets(value);
+      if (
+        !targets.length ||
+        targets.some((target) => !isRuntimeSourceFile(target))
+      )
+        fail(`Export ${subpath} has no usable packed svelte target: ${value}`);
+      for (const target of targets) reachesSvelte(resolve(packageRoot, target));
+      return targets.length;
+    }
+    const children = Array.isArray(value)
+      ? value
+      : value && typeof value === 'object'
+        ? Object.entries(value)
+            .filter(([key]) => key !== 'types' && !key.startsWith('types@'))
+            .map(([, child]) => child)
+        : [];
+    return children.reduce(
+      (count, child) => count + validateSvelteTargets(child, subpath),
+      0,
+    );
+  };
+  const inspect = (value, subpath, scopes = []) => {
+    if (typeof value === 'string') {
+      if (!value.startsWith('./'))
+        fail(
+          `Export ${subpath} must name a package-relative packed target: ${value}`,
+        );
+      const targets = packedTargets(value);
+      for (const target of targets) {
+        if (!isRuntimeSourceFile(target)) continue;
+        const marker = reachesSvelte(resolve(packageRoot, target));
+        if (!marker) continue;
+        const effective = scopes.find(
+          ({ conditions }) =>
+            conditions.svelte !== undefined && conditions.svelte !== null,
+        );
+        if (!effective) {
+          fail(
+            `Export ${subpath} (${value}) reaches Svelte runtime via ${marker}; add an effective "svelte" condition with a packaged runtime target before fallback runtime conditions (types first)`,
+          );
+        }
+        const keys = Object.keys(effective.conditions);
+        const svelteIndex = keys.indexOf('svelte');
+        if (
+          (keys.includes('types') && keys[0] !== 'types') ||
+          keys.slice(0, svelteIndex).some((key) => key !== 'types')
+        ) {
+          fail(
+            `Export ${subpath} (${value}) has unusable condition order; put types first, then svelte before import/default and other runtime conditions`,
+          );
+        }
+        // Svelte-aware bundlers may consume raw source while other consumers
+        // use a separate compiled entry. Presence, order and packaged targets
+        // are statically checkable; API equivalence needs consumer tests.
+        if (!validatedConditions.has(effective.conditions)) {
+          if (!validateSvelteTargets(effective.conditions.svelte, subpath))
+            fail(`Export ${subpath} has no effective packed svelte target`);
+          validatedConditions.add(effective.conditions);
+        }
+      }
+      return;
+    }
+    if (value === null) return;
+    if (Array.isArray(value)) {
+      for (const child of value) inspect(child, subpath, scopes);
+      return;
+    }
+    if (!value || typeof value !== 'object')
+      fail(`Invalid export map for ${subpath}`);
+    for (const [condition, child] of Object.entries(value)) {
+      if (condition === 'types' || condition.startsWith('types@')) continue;
+      if (condition.startsWith('.')) {
+        if (!resourceExports.has(condition)) inspect(child, condition, []);
+      } else inspect(child, subpath, [{ conditions: value }, ...scopes]);
+    }
+  };
+  if (packageJson.exports !== undefined) inspect(packageJson.exports, '.');
+}
+
 function collectMissingTypeImports(packageRoot, typeEntryFiles) {
   const missing = [];
   const importPattern =
@@ -484,18 +710,9 @@ const packageArgument = args.find(
 const packageDir = resolve(process.cwd(), packageArgument ?? '.');
 const packageJsonPath = join(packageDir, 'package.json');
 const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
-const typePaths = collectTypePaths(packageJson);
-const runtimePaths = collectRuntimePaths(packageJson);
 const npmConfigDryRunKey = 'npm_config_dry_run';
 const npmConfigDryRunUpperKey = 'NPM_CONFIG_DRY_RUN';
 
-if (typePaths.length === 0 && runtimePaths.length === 0) {
-  console.log(
-    `ℹ️ No exported pack verification paths declared for ${packageJson.name}`,
-  );
-  process.exit(0);
-}
-
 const tempDir = mkdtempSync(join(tmpdir(), 'smrt-pack-'));
 
 try {
@@ -537,6 +754,17 @@ try {
       .filter(Boolean),
   );
 
+  run('tar', ['-xf', tarballPath, '-C', tempDir]);
+  const packageRoot = join(tempDir, 'package');
+  const packedPackageJson = JSON.parse(
+    readFileSync(join(packageRoot, 'package.json'), 'utf8'),
+  );
+  const resourceExports = collectResourceExports(
+    packedPackageJson,
+    archiveEntries,
+  );
+  const typePaths = collectTypePaths(packedPackageJson);
+  const runtimePaths = collectRuntimePaths(packedPackageJson, resourceExports);
   const missing = typePaths.filter(
     (typePath) => !archiveHasPath(archiveEntries, typePath),
   );
@@ -545,8 +773,12 @@ try {
     (runtimePath) => !archiveHasPath(archiveEntries, runtimePath),
   );
 
-  run('tar', ['-xf', tarballPath, '-C', tempDir]);
-  const packageRoot = join(tempDir, 'package');
+  verifySvelteExportConditions(
+    packageRoot,
+    packedPackageJson,
+    archiveEntries,
+    resourceExports,
+  );
   const runtimeEntryFiles = collectPackageEntryFiles(
     packageRoot,
     runtimePaths,
@@ -590,6 +822,7 @@ try {
     `✅ Verified packed exports for ${packageJson.name}: ${[
       ...typePaths.map((typePath) => `types=${typePath}`),
       ...runtimePaths.map((runtimePath) => `runtime=${runtimePath}`),
+      ...[...resourceExports].map((subpath) => `resource=${subpath}`),
     ].join(', ')}`,
   );
 } catch (error) {