@happyvertical/smrt-core 0.30.0

package/dist/vite-plugin/sveltekit-generator.js

@@ -0,0 +1,1375 @@
+import { existsSync, readdirSync, readFileSync, unlinkSync, mkdirSync, writeFileSync } from "node:fs";
+import { join, relative } from "node:path";
+const BIOME_LINE_WIDTH = 80;
+const AUTO_GENERATED_ROUTE_HEADER = "// Auto-generated by @smrt/core vite plugin";
+const STANDARD_API_ACTIONS = ["list", "get", "create", "update", "delete"];
+function extractSimpleClassName(qualifiedName) {
+  const colonIndex = qualifiedName.indexOf(":");
+  if (colonIndex !== -1) {
+    return qualifiedName.substring(colonIndex + 1);
+  }
+  return qualifiedName;
+}
+function isCollectionClass(objectDef) {
+  return objectDef.extends === "SmrtCollection" || !!objectDef.extendsTypeArg;
+}
+function getRegistrationPackageName(manifest, objectDef, isLocal) {
+  if (isLocal) {
+    return manifest.packageName ?? objectDef.packageName;
+  }
+  return objectDef.packageName;
+}
+function toSingleQuotedStringLiteral(value) {
+  const jsonLiteral = JSON.stringify(value);
+  const jsonContent = jsonLiteral.slice(1, -1).replaceAll("'", "\\'");
+  return `'${jsonContent}'`;
+}
+function getApiConfigObject(apiConfig) {
+  if (!apiConfig || typeof apiConfig !== "object") {
+    return null;
+  }
+  return apiConfig;
+}
+function isSameSerializerReference(left, right) {
+  return !!left && !!right && left.importPath === right.importPath && left.exportName === right.exportName;
+}
+function resolveStandardRouteSerializers(apiConfig) {
+  const config = getApiConfigObject(apiConfig);
+  const itemSerializer = config?.serializers?.item;
+  const listItemSerializer = config?.serializers?.listItem || config?.serializers?.item;
+  const importStatements = [];
+  let itemSerializerName;
+  let listItemSerializerName;
+  if (itemSerializer) {
+    itemSerializerName = "serializeItemResponse";
+    importStatements.push(
+      `import { ${itemSerializer.exportName} as ${itemSerializerName} } from '${itemSerializer.importPath}';`
+    );
+  }
+  if (listItemSerializer) {
+    if (isSameSerializerReference(listItemSerializer, itemSerializer)) {
+      listItemSerializerName = itemSerializerName;
+    } else {
+      listItemSerializerName = "serializeListItemResponse";
+      importStatements.push(
+        `import { ${listItemSerializer.exportName} as ${listItemSerializerName} } from '${listItemSerializer.importPath}';`
+      );
+    }
+  }
+  return {
+    importStatements,
+    itemSerializerName,
+    listItemSerializerName
+  };
+}
+function collectReadonlyFieldNames(objectDef) {
+  const fields = objectDef.fields || {};
+  const names = [];
+  for (const [name, def] of Object.entries(fields)) {
+    const meta = def._meta;
+    if (def.readonly === true || meta?.readonly === true) {
+      names.push(name);
+    }
+  }
+  return names;
+}
+function getApiWritableAllowlist(apiConfig) {
+  const config = getApiConfigObject(apiConfig);
+  return Array.isArray(config?.writable) ? config.writable : null;
+}
+function generateWritablePolicyHelper(objectDef) {
+  const readonly = collectReadonlyFieldNames(objectDef);
+  const writable = getApiWritableAllowlist(objectDef.decoratorConfig?.api);
+  return `
+// Mass-assignment guard (#1540): strip framework/server-managed + read-only
+// fields from create/update request bodies before they reach the model.
+const WRITABLE_ALLOWLIST: string[] | null = ${writable ? JSON.stringify(writable) : "null"};
+const READONLY_FIELDS: string[] = ${JSON.stringify(readonly)};
+const SERVER_MANAGED_FIELDS = [
+  'id',
+  'tenantId',
+  'tenant_id',
+  'createdAt',
+  'created_at',
+  'updatedAt',
+  'updated_at',
+];
+
+function applyWritablePolicy(data: unknown): Record<string, unknown> {
+  if (!data || typeof data !== 'object') return {};
+  const result: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(data as Record<string, unknown>)) {
+    if (key.startsWith('_')) continue;
+    if (SERVER_MANAGED_FIELDS.includes(key)) continue;
+    if (READONLY_FIELDS.includes(key)) continue;
+    if (WRITABLE_ALLOWLIST && !WRITABLE_ALLOWLIST.includes(key)) continue;
+    result[key] = value;
+  }
+  return result;
+}
+`;
+}
+function getApiPublicAccess(apiConfig) {
+  const config = getApiConfigObject(apiConfig);
+  const value = config?.public;
+  if (value === true || value === "read") {
+    return value;
+  }
+  return false;
+}
+function generateAuthGuardHelper(objectDef) {
+  const publicAccess = getApiPublicAccess(objectDef.decoratorConfig?.api);
+  return `
+// Fail-closed authorization (#1540): generated routes require an authenticated
+// principal on \`locals\` unless explicitly marked \`@smrt({ api: { public } })\`.
+const PUBLIC_ACCESS: boolean | 'read' = ${JSON.stringify(publicAccess)};
+
+function hasAuthenticatedPrincipal(locals: unknown): boolean {
+  if (!locals || typeof locals !== 'object') return false;
+  const l = locals as Record<string, unknown>;
+  // Only a resolved, object-shaped principal counts. We intentionally do NOT
+  // treat \`locals.auth\` as a signal: Auth.js/SvelteKit put a callable
+  // \`auth()\` helper on every request (including anonymous ones), so honoring
+  // it would fail OPEN. Booleans don't count either (no convention sets
+  // \`locals.user = true\`); the only boolean accepted is the explicit
+  // \`smrtAuth\` opt-in marker.
+  const isResolvedPrincipal = (v: unknown) =>
+    typeof v === 'object' && v !== null;
+  return (
+    isResolvedPrincipal(l.user) ||
+    isResolvedPrincipal(l.session) ||
+    l.smrtAuth === true
+  );
+}
+
+function requireRouteAuth(locals: unknown, mutating: boolean): void {
+  if (PUBLIC_ACCESS === true) return;
+  if (PUBLIC_ACCESS === 'read' && !mutating) return;
+  if (!hasAuthenticatedPrincipal(locals)) {
+    throw error(401, 'Authentication required');
+  }
+}
+
+// Sensitive-field-safe serialization for custom-action results (#1540): a
+// custom method may return a SmrtObject (or one nested in an array/plain
+// object), so recurse and route each through toPublicJSON() rather than letting
+// JSON.stringify call toJSON(). Non-plain instances (Date, etc.) and primitives
+// pass through; a cycle guard prevents infinite loops.
+function toPublicResult(value: any, seen: WeakSet<object> = new WeakSet()): any {
+  if (value === null || typeof value !== 'object') return value;
+  if (typeof value.toPublicJSON === 'function') return value.toPublicJSON();
+  if (Array.isArray(value)) {
+    if (seen.has(value)) return value;
+    seen.add(value);
+    return value.map((entry: any) => toPublicResult(entry, seen));
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) return value;
+  if (seen.has(value)) return value;
+  seen.add(value);
+  const out: Record<string, any> = {};
+  for (const [key, entry] of Object.entries(value)) {
+    out[key] = toPublicResult(entry, seen);
+  }
+  return out;
+}
+`;
+}
+function isTenantScoped(objectDef) {
+  return !!objectDef.decoratorConfig?.tenantScoped;
+}
+function generateTenantContextHelper() {
+  return `
+import { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenancy';
+
+function establishTenantContext(locals: unknown): void {
+  if (hasTenantContext()) return;
+  if (!locals || typeof locals !== 'object') return;
+  const l = locals as Record<string, any>;
+  const tenantId = l.tenantId ?? l.user?.tenantId ?? l.session?.tenantId;
+  if (typeof tenantId === 'string' && tenantId) {
+    enterTenantContext({ tenantId });
+  }
+}
+`;
+}
+function routeGuardPreamble(objectDef, mutating) {
+  const lines = [`  requireRouteAuth(locals, ${mutating});`];
+  if (isTenantScoped(objectDef)) {
+    lines.push("  establishTenantContext(locals);");
+  }
+  return lines.join("\n");
+}
+function normalizeApiHttpMethod(method) {
+  switch (method?.toUpperCase()) {
+    case "GET":
+    case "POST":
+    case "PUT":
+    case "PATCH":
+    case "DELETE":
+      return method.toUpperCase();
+    default:
+      return "POST";
+  }
+}
+function methodNameToKebab(name) {
+  return name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").toLowerCase();
+}
+function normalizeCustomRoutePath(actionName, path, options = {}) {
+  if (path) {
+    const segments = path.split("/").map((segment2) => segment2.trim()).filter(Boolean);
+    if (segments.length > 0) {
+      return segments;
+    }
+  }
+  const segment = options.kebabRoutes ? methodNameToKebab(actionName) : actionName;
+  return [segment];
+}
+function extractRoutePathParamNames(pathSegments) {
+  return pathSegments.filter((segment) => /^\[[^\]]+\]$/.test(segment)).map((segment) => segment.slice(1, -1)).filter(Boolean);
+}
+function resolveApiActionRouteConfig(actionName, actionDef, apiConfig, routeOptions = {}, defaultScope = actionDef.isStatic ? "collection" : "item") {
+  const config = getApiConfigObject(apiConfig);
+  const routeConfig = config?.routes?.[actionName];
+  const pathSegments = normalizeCustomRoutePath(
+    actionName,
+    routeConfig?.path,
+    routeOptions
+  );
+  return {
+    scope: routeConfig?.scope || defaultScope,
+    method: normalizeApiHttpMethod(routeConfig?.method),
+    pathSegments,
+    pathParamNames: extractRoutePathParamNames(pathSegments)
+  };
+}
+function buildRouteHandlerArgs(includeParams, includeRequest) {
+  const args = ["locals"];
+  if (includeParams) {
+    args.push("params");
+  }
+  if (includeRequest) {
+    args.push("request");
+  }
+  return `{ ${args.join(", ")} }`;
+}
+function buildPathParamsObjectLiteral(pathParamNames) {
+  if (pathParamNames.length === 0) {
+    return "{}";
+  }
+  return `{
+${pathParamNames.map(
+    (paramName) => `    ${JSON.stringify(paramName)}: params[${JSON.stringify(paramName)}],`
+  ).join("\n")}
+  }`;
+}
+function buildActionInvocationArgs(actionDef) {
+  const parameters = Array.isArray(actionDef.parameters) ? actionDef.parameters : [];
+  if (parameters.length === 0) {
+    return [];
+  }
+  if (parameters.length === 1 && parameters[0]?.name === "options") {
+    return ["options"];
+  }
+  return parameters.map(
+    (parameter) => buildOptionsPropertyAccess(parameter.name)
+  );
+}
+function buildOptionsPropertyAccess(propertyName) {
+  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(propertyName)) {
+    return `options.${propertyName}`;
+  }
+  const escapedPropertyName = propertyName.replaceAll("\\", "\\\\").replaceAll("'", "\\'");
+  return `options['${escapedPropertyName}']`;
+}
+function buildActionInvocationExpression(receiverExpression, actionName, invocationArgs) {
+  const singleLineInvocation = `await ${receiverExpression}.${actionName}(${invocationArgs.join(", ")})`;
+  const singleLineResultAssignment = `  const result = ${singleLineInvocation};`;
+  if (singleLineResultAssignment.length <= 100) {
+    return singleLineInvocation;
+  }
+  return [
+    `await ${receiverExpression}.${actionName}(`,
+    ...invocationArgs.map((argument) => `    ${argument},`),
+    "  )"
+  ].join("\n");
+}
+function findItemClassRegistryKey(className, objectDef, manifest) {
+  const itemClassName = objectDef.extendsTypeArg || (className.endsWith("Collection") ? className.slice(0, -"Collection".length) : void 0);
+  if (!itemClassName) {
+    return className;
+  }
+  const manifestMatch = Object.entries(manifest.objects).find(
+    ([manifestKey, candidate]) => manifestKey === itemClassName || candidate.className === itemClassName
+  );
+  return manifestMatch?.[0] || itemClassName;
+}
+function groupCustomActionRoutes(actionSpecs) {
+  const groupedRoutes = /* @__PURE__ */ new Map();
+  for (const { routeDir, spec } of actionSpecs) {
+    const existing = groupedRoutes.get(routeDir) || [];
+    const duplicateMethod = existing.find(
+      (candidate) => candidate.routeConfig.method === spec.routeConfig.method
+    );
+    if (duplicateMethod) {
+      throw new Error(
+        `Duplicate custom API route handler for ${routeDir} (${spec.routeConfig.method}). Methods ${duplicateMethod.actionName} and ${spec.actionName} resolve to the same generated route.`
+      );
+    }
+    existing.push(spec);
+    groupedRoutes.set(routeDir, existing);
+  }
+  return groupedRoutes;
+}
+async function generateSvelteKitRoutes(projectRoot, manifest, options) {
+  if (!options.enabled) return;
+  console.log("[smrt] Generating SvelteKit routes...");
+  clearGeneratedRouteFiles(join(projectRoot, options.routesDir));
+  clearGeneratedKnowledgeRoute(projectRoot, options);
+  await generateSmrtConfigFile(projectRoot, manifest, options);
+  let generatedCount = 0;
+  let skippedCollections = 0;
+  for (const [className, objectDef] of Object.entries(manifest.objects)) {
+    if (isCollectionClass(objectDef)) {
+      const generatedCollectionRoutes = await generateCollectionRoutesForObject(
+        projectRoot,
+        className,
+        objectDef,
+        manifest,
+        options
+      );
+      if (generatedCollectionRoutes) {
+        generatedCount++;
+      } else {
+        console.log(
+          `[smrt] Skipping ${className} - no collection API routes to generate`
+        );
+        skippedCollections++;
+      }
+      continue;
+    }
+    await generateRoutesForObject(projectRoot, className, objectDef, options);
+    generatedCount++;
+  }
+  if (options.knowledge?.api?.enabled) {
+    generateKnowledgeRoute(projectRoot, options);
+  }
+  updateGitignore(projectRoot, options);
+  const skippedMsg = skippedCollections > 0 ? ` (skipped ${skippedCollections} collection classes)` : "";
+  console.log(
+    `[smrt] Generated routes for ${generatedCount} SMRT objects${skippedMsg}`
+  );
+}
+function clearGeneratedRouteFiles(routesRoot) {
+  if (!existsSync(routesRoot)) {
+    return;
+  }
+  for (const entry of readdirSync(routesRoot, { withFileTypes: true })) {
+    const entryPath = join(routesRoot, entry.name);
+    if (entry.isDirectory()) {
+      clearGeneratedRouteFiles(entryPath);
+      continue;
+    }
+    if (!entry.isFile() || entry.name !== "+server.ts") {
+      continue;
+    }
+    const fileContent = readFileSync(entryPath, "utf-8");
+    if (fileContent.startsWith(AUTO_GENERATED_ROUTE_HEADER)) {
+      unlinkSync(entryPath);
+    }
+  }
+}
+function knowledgeRouteDir(projectRoot, options) {
+  const basePath = options.knowledge?.api?.basePath || "/__smrt/knowledge";
+  const routeRoot = svelteKitRouteRoot(options.routesDir);
+  const segments = basePath.split("/").map((segment) => segment.trim()).filter(Boolean);
+  return join(projectRoot, routeRoot, ...segments);
+}
+function svelteKitRouteRoot(routesDir) {
+  const normalized = routesDir.replaceAll("\\", "/").replace(/\/+$/, "");
+  const marker = "/routes";
+  const markerIndex = normalized.indexOf(marker);
+  if (normalized === "src/routes" || normalized.endsWith("/routes")) {
+    return normalized;
+  }
+  if (markerIndex !== -1) {
+    return normalized.slice(0, markerIndex + marker.length);
+  }
+  return "src/routes";
+}
+function clearGeneratedKnowledgeRoute(projectRoot, options) {
+  const routeDir = knowledgeRouteDir(projectRoot, options);
+  const routePath = join(routeDir, "+server.ts");
+  if (!existsSync(routePath)) return;
+  const content = readFileSync(routePath, "utf-8");
+  if (content.startsWith(AUTO_GENERATED_ROUTE_HEADER)) {
+    unlinkSync(routePath);
+  }
+}
+function generateKnowledgeRoute(projectRoot, options) {
+  const routeDir = knowledgeRouteDir(projectRoot, options);
+  const route = generateKnowledgeRouteTemplate(
+    options.knowledge ?? {},
+    readKnowledgeRouteArtifact(projectRoot)
+  );
+  writeRoute(routeDir, "+server.ts", route);
+}
+function readKnowledgeRouteArtifact(projectRoot) {
+  for (const relativePath of [
+    ".smrt/smrt-knowledge.json",
+    "dist/smrt-knowledge.json"
+  ]) {
+    const fullPath = join(projectRoot, relativePath);
+    if (!existsSync(fullPath)) continue;
+    try {
+      return JSON.parse(readFileSync(fullPath, "utf-8"));
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+async function generateRegistrationFile(projectRoot, manifest, options) {
+  const configPath = options.configPath || "src/lib/server";
+  const configDir = join(projectRoot, configPath);
+  const registrationFilePath = join(configDir, "smrt-register.ts");
+  const localObjects = [];
+  const packageObjects = /* @__PURE__ */ new Map();
+  for (const [className, objectDef] of Object.entries(manifest.objects)) {
+    if (isLocalObject(projectRoot, objectDef)) {
+      localObjects.push([className, objectDef]);
+    } else if (objectDef.packageName) {
+      const packageEntry = packageObjects.get(objectDef.packageName) || {
+        classNames: [],
+        hasCollectionImport: false
+      };
+      if (isCollectionClass(objectDef)) {
+        packageEntry.hasCollectionImport = true;
+      } else {
+        packageEntry.classNames.push(className);
+      }
+      packageObjects.set(objectDef.packageName, packageEntry);
+    } else {
+      localObjects.push([className, objectDef]);
+    }
+  }
+  const localNamedImports = /* @__PURE__ */ new Map();
+  const localSideEffectImports = /* @__PURE__ */ new Set();
+  for (const [className, objectDef] of localObjects) {
+    const simpleClassName = extractSimpleClassName(className);
+    let importPath = "";
+    if (objectDef.filePath) {
+      const relativeToConfig = relative(configDir, objectDef.filePath);
+      const normalized = relativeToConfig.replace(/\\/g, "/").replace(/\.(ts|js|tsx|jsx)$/, "");
+      importPath = normalized.startsWith(".") ? normalized : `./${normalized}`;
+    } else {
+      importPath = getSvelteKitImportPath(
+        projectRoot,
+        void 0,
+        options.objectsDir,
+        simpleClassName
+      );
+    }
+    if (isCollectionClass(objectDef)) {
+      localSideEffectImports.add(importPath);
+      continue;
+    }
+    const existing = localNamedImports.get(importPath) ?? [];
+    existing.push(simpleClassName);
+    localNamedImports.set(importPath, existing);
+  }
+  const localImports = [
+    ...Array.from(localNamedImports.entries()).sort(([left], [right]) => left.localeCompare(right)).map(([importPath, simpleNames]) => {
+      const sortedNames = simpleNames.sort((a, b) => a.localeCompare(b));
+      return `import { ${sortedNames.join(", ")} } from '${importPath}';`;
+    }),
+    ...Array.from(localSideEffectImports.values()).sort((a, b) => a.localeCompare(b)).map((importPath) => `import '${importPath}';`)
+  ].join("\n");
+  const packageImports = Array.from(packageObjects.entries()).sort(([left], [right]) => left.localeCompare(right)).flatMap(([packageName, packageEntry]) => {
+    const imports2 = [];
+    if (packageEntry.hasCollectionImport) {
+      imports2.push(`import '${packageName}';`);
+    }
+    if (packageEntry.classNames.length > 0) {
+      const simpleNames = packageEntry.classNames.map(extractSimpleClassName).sort((a, b) => a.localeCompare(b));
+      imports2.push(
+        `import { ${simpleNames.join(", ")} } from '${packageName}';`
+      );
+    }
+    return imports2;
+  }).join("\n");
+  const imports = [packageImports, localImports].filter(Boolean).join("\n");
+  const registrations = Object.entries(manifest.objects).map(([className, objectDef]) => {
+    if (isCollectionClass(objectDef)) {
+      return null;
+    }
+    const simpleClassName = extractSimpleClassName(className);
+    const localObject = isLocalObject(projectRoot, objectDef);
+    const packageName = getRegistrationPackageName(
+      manifest,
+      objectDef,
+      localObject
+    );
+    if (!packageName) {
+      return null;
+    }
+    const packageNameLiteral = toSingleQuotedStringLiteral(packageName);
+    const singleLineRegistration = `ObjectRegistry.register(${simpleClassName}, { name: '${simpleClassName}', packageName: ${packageNameLiteral} });`;
+    if (singleLineRegistration.length <= BIOME_LINE_WIDTH) {
+      return singleLineRegistration;
+    }
+    return [
+      `ObjectRegistry.register(${simpleClassName}, {`,
+      `  name: '${simpleClassName}',`,
+      `  packageName: ${packageNameLiteral},`,
+      `});`
+    ].join("\n");
+  }).filter((registration) => registration !== null).join("\n");
+  const registrationContent = `/**
+ * Auto-generated SMRT object registration
+ * DO NOT EDIT - changes will be overwritten
+ *
+ * Importing these modules triggers their @smrt() decorators, which perform
+ * the initial registration. The explicit re-registration below is intentional:
+ * it upgrades bundled runtimes to deterministic qualified registrations.
+ */
+
+import { ObjectRegistry } from '@happyvertical/smrt-core';
+
+${imports}
+
+// Re-register imported objects with explicit package names for bundled runtimes
+${registrations}
+`;
+  if (!existsSync(configDir)) {
+    mkdirSync(configDir, { recursive: true });
+  }
+  writeFileSync(registrationFilePath, registrationContent, "utf-8");
+  console.log(`[smrt] Generated registration file: ${registrationFilePath}`);
+}
+async function generateSmrtConfigFile(projectRoot, manifest, options) {
+  const configPath = options.configPath || "src/lib/server";
+  const configFileName = options.configFileName || "smrt.ts";
+  const configDir = join(projectRoot, configPath);
+  const configFilePath = join(configDir, configFileName);
+  await generateRegistrationFile(projectRoot, manifest, options);
+  if (existsSync(configFilePath)) {
+    console.log("[smrt] Config file already exists, skipping generation");
+    return;
+  }
+  const configContent = `/**
+ * Centralized SMRT configuration with per-object overrides
+ * Generated by @smrt/core vite plugin
+ *
+ * Most objects will use the default configuration.
+ * Add entries to \`objectOverrides\` for objects that need different backends.
+ */
+
+// Import SMRT objects to register them via @smrt() decorators
+import './smrt-register.js';
+
+import { ObjectRegistry } from '@happyvertical/smrt-core';
+import type { SmrtClassOptions } from '@happyvertical/smrt-core';
+
+declare global {
+  // eslint-disable-next-line no-var
+  var __smrtGetRequestScopedDatabase:
+    | (() => SmrtClassOptions['db'] | undefined)
+    | undefined;
+}
+
+/**
+ * Per-object configuration overrides
+ * Define specific backends for objects that differ from project defaults
+ *
+ * @example
+ * const objectOverrides: Record<string, Partial<SmrtClassOptions>> = {
+ *   // Analytics uses a separate PostgreSQL database
+ *   Analytics: {
+ *     db: {
+ *       url: process.env.ANALYTICS_DATABASE_URL!,
+ *       type: 'postgres'
+ *     }
+ *   },
+ *
+ *   // AuditLog uses dedicated database with no AI
+ *   AuditLog: {
+ *     db: {
+ *       url: process.env.AUDIT_DATABASE_URL!,
+ *       type: 'postgres'
+ *     },
+ *     ai: undefined
+ *   },
+ *
+ *   // Cache uses REST adapter (e.g., Redis)
+ *   Cache: {
+ *     persistence: {
+ *       type: 'rest',
+ *       baseUrl: process.env.REDIS_URL!
+ *     }
+ *   }
+ * };
+ */
+const objectOverrides: Record<string, Partial<SmrtClassOptions>> = {
+  // Add your per-object configuration overrides here
+};
+
+/**
+ * Default configuration for most SMRT objects
+ * Customize this to change project-wide defaults
+ */
+function getDefaultConfig(): SmrtClassOptions {
+  return {
+    db: {
+      url: process.env.DATABASE_URL || ':memory:',
+      type: (process.env.DATABASE_TYPE as 'sqlite' | 'postgres') || 'sqlite'
+    },
+    ai: process.env.OPENAI_API_KEY ? {
+      type: 'openai',
+      apiKey: process.env.OPENAI_API_KEY
+    } : process.env.ANTHROPIC_API_KEY ? {
+      type: 'anthropic',
+      apiKey: process.env.ANTHROPIC_API_KEY
+    } : undefined
+  };
+}
+
+function getRequestScopedDatabase(): SmrtClassOptions['db'] | undefined {
+  const getter = globalThis.__smrtGetRequestScopedDatabase;
+  return typeof getter === 'function' ? getter() : undefined;
+}
+
+/**
+ * Get configuration for a specific SMRT object
+ * Merges project defaults with per-object overrides if defined
+ */
+export function getSmrtConfig(className: string): SmrtClassOptions {
+  const defaults = getDefaultConfig();
+  const override = objectOverrides[className];
+
+  if (override) {
+    // Deep merge: override specific properties while keeping defaults
+    return {
+      ...defaults,
+      ...override,
+      // Ensure nested objects are merged properly
+      db: override.db
+        ? { ...(defaults.db as any), ...(override.db as any) }
+        : defaults.db,
+      ai: override.ai !== undefined ? override.ai : defaults.ai
+    };
+  }
+
+  return defaults;
+}
+
+/**
+ * Helper to get a collection with centralized configuration
+ * Automatically applies project defaults or object-specific overrides
+ */
+export async function getCollection<
+  T extends import('@happyvertical/smrt-core').SmrtObject,
+>(className: string, overrides: Partial<SmrtClassOptions> = {}) {
+  const config = getSmrtConfig(className);
+  const objectOverride = objectOverrides[className];
+  const requestScopedDb =
+    !overrides.db && !objectOverride?.db
+      ? getRequestScopedDatabase()
+      : undefined;
+
+  return await ObjectRegistry.getCollection<T>(
+    className,
+    {
+      ...config,
+      ...overrides,
+      db: overrides.db
+        ? { ...(config.db as any), ...(overrides.db as any) }
+        : requestScopedDb ?? config.db,
+      ai: overrides.ai !== undefined ? overrides.ai : config.ai
+    }
+  );
+}
+`;
+  if (!existsSync(configDir)) {
+    mkdirSync(configDir, { recursive: true });
+  }
+  writeFileSync(configFilePath, configContent, "utf-8");
+  console.log(`[smrt] Generated configuration file: ${configFilePath}`);
+}
+async function generateRoutesForObject(projectRoot, className, objectDef, options) {
+  const collectionName = objectDef.collection;
+  const routeDir = join(projectRoot, options.routesDir, collectionName);
+  const apiConfig = objectDef.decoratorConfig?.api;
+  if (apiConfig === false) {
+    console.log(`[smrt] Skipping ${className} - API disabled`);
+    return;
+  }
+  const includedActions = resolveStandardCrudActions(apiConfig);
+  if (includedActions.includes("list") || includedActions.includes("create")) {
+    const collectionRoute = generateCollectionRouteTemplate(
+      projectRoot,
+      className,
+      objectDef,
+      includedActions
+    );
+    writeRoute(routeDir, "+server.ts", collectionRoute);
+  }
+  if (includedActions.includes("get") || includedActions.includes("update") || includedActions.includes("delete")) {
+    const itemRoute = generateItemRouteTemplate(
+      projectRoot,
+      className,
+      objectDef,
+      includedActions
+    );
+    writeRoute(join(routeDir, "[id]"), "+server.ts", itemRoute);
+  }
+  const customActions = Object.entries(objectDef.methods).filter(
+    ([name, method]) => !STANDARD_API_ACTIONS.includes(name) && method.isPublic && shouldIncludeInApi(name, apiConfig)
+  );
+  const actionSpecs = [];
+  for (const [actionName, actionDef] of customActions) {
+    const routeConfig = resolveApiActionRouteConfig(
+      actionName,
+      actionDef,
+      apiConfig,
+      { kebabRoutes: options.kebabRoutes }
+    );
+    if (routeConfig.scope === "collection" && !actionDef.isStatic) {
+      console.warn(
+        `[smrt] Skipping ${className}.${actionName} - collection API routes require a static method`
+      );
+      continue;
+    }
+    const actionBaseDir = routeConfig.scope === "collection" ? routeDir : join(routeDir, "[id]");
+    actionSpecs.push({
+      routeDir: join(actionBaseDir, ...routeConfig.pathSegments),
+      spec: {
+        lookupClassName: className,
+        actionName,
+        actionDef,
+        routeConfig,
+        hostType: "item"
+      }
+    });
+  }
+  for (const [actionRouteDir, routeSpecs] of groupCustomActionRoutes(
+    actionSpecs
+  )) {
+    const actionRoute = generateActionRouteTemplate(
+      projectRoot,
+      routeSpecs,
+      objectDef
+    );
+    writeRoute(actionRouteDir, "+server.ts", actionRoute);
+  }
+}
+async function generateCollectionRoutesForObject(projectRoot, className, objectDef, manifest, options) {
+  const apiConfig = objectDef.decoratorConfig?.api;
+  if (apiConfig === false) {
+    console.log(`[smrt] Skipping ${className} - API disabled`);
+    return false;
+  }
+  const routeDir = join(projectRoot, options.routesDir, objectDef.collection);
+  const lookupClassName = findItemClassRegistryKey(
+    className,
+    objectDef,
+    manifest
+  );
+  const customActions = Object.entries(objectDef.methods).filter(
+    ([name, method]) => !STANDARD_API_ACTIONS.includes(name) && method.isPublic && shouldIncludeInApi(name, apiConfig)
+  );
+  if (customActions.length === 0) {
+    return false;
+  }
+  let generatedAnyRoutes = false;
+  const actionSpecs = [];
+  for (const [actionName, actionDef] of customActions) {
+    const routeConfig = resolveApiActionRouteConfig(
+      actionName,
+      actionDef,
+      apiConfig,
+      { kebabRoutes: options.kebabRoutes },
+      "collection"
+    );
+    if (routeConfig.scope !== "collection") {
+      console.warn(
+        `[smrt] Skipping ${className}.${actionName} - collection class methods only support collection-scoped API routes`
+      );
+      continue;
+    }
+    actionSpecs.push({
+      routeDir: join(routeDir, ...routeConfig.pathSegments),
+      spec: {
+        lookupClassName,
+        actionName,
+        actionDef,
+        routeConfig,
+        hostType: "collection"
+      }
+    });
+  }
+  for (const [actionRouteDir, routeSpecs] of groupCustomActionRoutes(
+    actionSpecs
+  )) {
+    const actionRoute = generateActionRouteTemplate(
+      projectRoot,
+      routeSpecs,
+      objectDef
+    );
+    writeRoute(actionRouteDir, "+server.ts", actionRoute);
+    generatedAnyRoutes = true;
+  }
+  return generatedAnyRoutes;
+}
+function resolveStandardCrudActions(apiConfig) {
+  if (apiConfig === false) return [];
+  if (apiConfig === true || apiConfig === void 0) {
+    return [...STANDARD_API_ACTIONS];
+  }
+  if (typeof apiConfig !== "object") return [...STANDARD_API_ACTIONS];
+  const config = apiConfig;
+  let crud = config.include ? config.include.filter((a) => STANDARD_API_ACTIONS.includes(a)) : [...STANDARD_API_ACTIONS];
+  if (Array.isArray(config.exclude)) {
+    const exclude = config.exclude;
+    crud = crud.filter((a) => !exclude.includes(a));
+  }
+  return crud;
+}
+function shouldIncludeInApi(actionName, apiConfig) {
+  if (apiConfig === false) return false;
+  if (apiConfig === true || apiConfig === void 0) return true;
+  if (typeof apiConfig === "object") {
+    const included = apiConfig.include ? apiConfig.include.includes(actionName) : true;
+    const excluded = apiConfig.exclude ? apiConfig.exclude.includes(actionName) : false;
+    return included && !excluded;
+  }
+  return true;
+}
+function resolveApiActionSet(objectDef) {
+  const apiConfig = objectDef.decoratorConfig?.api;
+  if (apiConfig === false) return /* @__PURE__ */ new Set();
+  const actions = new Set(resolveStandardCrudActions(apiConfig));
+  const objectIsCollectionClass = isCollectionClass(objectDef);
+  const config = getApiConfigObject(apiConfig);
+  for (const [name, method] of Object.entries(objectDef.methods || {})) {
+    if (STANDARD_API_ACTIONS.includes(name)) continue;
+    if (!method.isPublic) continue;
+    if (!shouldIncludeInApi(name, apiConfig)) continue;
+    const routeConfig = config?.routes?.[name];
+    const defaultScope = objectIsCollectionClass ? "collection" : method.isStatic ? "collection" : "item";
+    const scope = routeConfig?.scope || defaultScope;
+    if (objectIsCollectionClass) {
+      if (scope !== "collection") continue;
+    } else {
+      if (scope === "collection" && !method.isStatic) continue;
+    }
+    actions.add(name);
+  }
+  return actions;
+}
+function findCliApiCoherenceViolations(manifest) {
+  const violations = [];
+  for (const [className, objectDef] of Object.entries(manifest.objects)) {
+    const cliConfig = objectDef.decoratorConfig?.cli;
+    if (!cliConfig || typeof cliConfig !== "object") continue;
+    if (cliConfig.skipApiCheck) continue;
+    if (!cliConfig.include || cliConfig.include.length === 0) continue;
+    const cliExclude = Array.isArray(cliConfig.exclude) ? cliConfig.exclude : [];
+    const effectiveCliCommands = cliConfig.include.filter(
+      (cmd) => !cliExclude.includes(cmd)
+    );
+    if (effectiveCliCommands.length === 0) continue;
+    const apiActionSet = resolveApiActionSet(objectDef);
+    const unreachable = effectiveCliCommands.filter(
+      (action) => !apiActionSet.has(action)
+    );
+    if (unreachable.length > 0) {
+      violations.push({ className, unreachable });
+    }
+  }
+  return violations;
+}
+function validateCliIncludeAgainstApi(manifest) {
+  const violations = findCliApiCoherenceViolations(manifest);
+  if (violations.length === 0) return;
+  const messages = violations.flatMap(
+    ({ className, unreachable }) => unreachable.map(
+      (action) => `[smrt] ${className}.${action} is declared in cli.include but is not exposed via the api.
+  Either:
+    - Add '${action}' to api.include, or
+    - Remove '${action}' from cli.include.
+  The CLI invokes methods over HTTP; methods without API routes are unreachable.
+  If this CLI is intentionally invoked in-process (no HTTP), set
+  \`cli: { skipApiCheck: true }\` on the @smrt() decorator to acknowledge.`
+    )
+  );
+  throw new Error(messages.join("\n\n"));
+}
+function writeRoute(dir, filename, content) {
+  try {
+    if (!existsSync(dir)) {
+      mkdirSync(dir, { recursive: true });
+    }
+    const filePath = join(dir, filename);
+    writeFileSync(filePath, content, "utf-8");
+    console.log(`[smrt] Generated: ${filePath}`);
+  } catch (error) {
+    console.error(`[smrt] [ERROR] Failed to write route file:`);
+    console.error(`[smrt] [ERROR]   Directory: ${dir}`);
+    console.error(`[smrt] [ERROR]   Filename: ${filename}`);
+    console.error(`[smrt] [ERROR]   Error:`, error);
+    throw error;
+  }
+}
+function getSvelteKitImportPath(projectRoot, objectFilePath, objectsDir, className) {
+  const filePath = join(projectRoot, objectsDir, `${className || "Object"}.ts`);
+  const absoluteObjectsDir = objectsDir.startsWith("/") ? objectsDir : join(projectRoot, objectsDir);
+  const relativePath = relative(absoluteObjectsDir, filePath);
+  const normalizedPath = relativePath.replace(/\\/g, "/");
+  const withoutExtension = normalizedPath.replace(/\.(ts|js|tsx|jsx)$/, "");
+  if (objectsDir.includes("src/lib")) {
+    const libSubpath = objectsDir.split("src/lib")[1] || "";
+    const fullPath = libSubpath ? `${libSubpath}/${withoutExtension}` : withoutExtension;
+    return `$lib${fullPath}`.replace(/\/+/g, "/");
+  }
+  return withoutExtension.startsWith(".") ? withoutExtension : `./${withoutExtension}`;
+}
+function isLocalObject(projectRoot, objectDef) {
+  if (!objectDef.filePath) return false;
+  return objectDef.filePath.startsWith(projectRoot) && !objectDef.filePath.includes("/node_modules/");
+}
+function generateCollectionRouteTemplate(_projectRoot, className, objectDef, includedActions, _options) {
+  const hasGet = includedActions.includes("list");
+  const hasPost = includedActions.includes("create");
+  const serializers = resolveStandardRouteSerializers(
+    objectDef.decoratorConfig?.api
+  );
+  const serializerImports = serializers.importStatements.join("\n");
+  const imports = `${AUTO_GENERATED_ROUTE_HEADER}
+// DO NOT EDIT - changes will be overwritten
+
+import { error, json } from '@sveltejs/kit';
+${serializerImports ? `${serializerImports}
+` : ""}import { getCollection } from '$lib/server/smrt';
+import type { RequestHandler } from './$types';
+// Note: ${className} is auto-registered by the Vite plugin scanner
+${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPost ? generateWritablePolicyHelper(objectDef) : ""}`;
+  const getHandler = hasGet ? `
+// List all ${className.toLowerCase()}s
+export const GET: RequestHandler = async ({ locals, url }) => {
+${routeGuardPreamble(objectDef, false)}
+  const limit = Number(url.searchParams.get('limit')) || 50;
+  const offset = Number(url.searchParams.get('offset')) || 0;
+
+${generateCollectionLoad(className)}
+  const items = await collection.list({ limit, offset });
+  const count = await collection.count();
+${serializers.listItemSerializerName ? `
+  const serializedItems = await Promise.all(
+    items.map((item) => ${serializers.listItemSerializerName}(item)),
+  );
+
+  return json({ items: serializedItems, count, limit, offset });` : `
+  const items_public = items.map((item) => item.toPublicJSON());
+  return json({ items: items_public, count, limit, offset });`}
+};
+` : "";
+  const postHandler = hasPost ? `
+// Create new ${className.toLowerCase()}
+export const POST: RequestHandler = async ({ locals, request }) => {
+${routeGuardPreamble(objectDef, true)}
+  const data = applyWritablePolicy(await request.json());
+
+${generateCollectionLoad(className)}
+  const item = await collection.create(data);
+  await item.save();
+${serializers.itemSerializerName ? `
+  const serializedItem = await ${serializers.itemSerializerName}(item);
+
+  return json(serializedItem, { status: 201 });` : `
+  return json(item.toPublicJSON(), { status: 201 });`}
+};
+` : "";
+  return imports + getHandler + postHandler;
+}
+function generateCollectionLoad(className, options = {}) {
+  const genericSuffix = options.generic ? "<any>" : "";
+  return [
+    `  const collection = await getCollection${genericSuffix}(`,
+    `    '${className}',`,
+    "  );"
+  ].join("\n");
+}
+function generateNotFoundError(className) {
+  const singleLineNotFoundError = `  if (!item) throw error(404, '${className} not found');`;
+  if (singleLineNotFoundError.length <= 100) {
+    return singleLineNotFoundError;
+  }
+  return [
+    "  if (!item)",
+    "    throw error(",
+    "      404,",
+    `      '${className} not found',`,
+    "    );"
+  ].join("\n");
+}
+function generateCollectionNotRegisteredError(className) {
+  return [
+    "  if (!collection)",
+    "    throw error(",
+    "      500,",
+    `      '${className} collection is not registered',`,
+    "    );"
+  ].join("\n");
+}
+function generateClassNotRegisteredError(className) {
+  return [
+    "  if (!registered)",
+    "    throw error(",
+    "      500,",
+    `      '${className} is not registered',`,
+    "    );"
+  ].join("\n");
+}
+function generateItemRouteTemplate(_projectRoot, className, objectDef, includedActions, _options) {
+  const hasGet = includedActions.includes("get");
+  const hasPut = includedActions.includes("update");
+  const hasDelete = includedActions.includes("delete");
+  const simpleClassName = extractSimpleClassName(className);
+  const serializers = resolveStandardRouteSerializers(
+    objectDef.decoratorConfig?.api
+  );
+  const serializerImports = serializers.importStatements.join("\n");
+  const imports = `${AUTO_GENERATED_ROUTE_HEADER}
+// DO NOT EDIT - changes will be overwritten
+
+import { error, json } from '@sveltejs/kit';
+${serializerImports ? `${serializerImports}
+` : ""}import { getCollection } from '$lib/server/smrt';
+import type { RequestHandler } from './$types';
+${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPut ? generateWritablePolicyHelper(objectDef) : ""}`;
+  const getHandler = hasGet ? `
+// Get single ${simpleClassName.toLowerCase()}
+export const GET: RequestHandler = async ({ locals, params }) => {
+${routeGuardPreamble(objectDef, false)}
+${generateCollectionLoad(className, { generic: true })}
+  const item = await collection.get(params.id);
+${generateNotFoundError(className)}
+${serializers.itemSerializerName ? `
+  const serializedItem = await ${serializers.itemSerializerName}(item);
+
+  return json(serializedItem);` : `
+  return json(item.toPublicJSON());`}
+};
+` : "";
+  const putHandler = hasPut ? `
+// Update ${simpleClassName.toLowerCase()}
+export const PUT: RequestHandler = async ({ locals, params, request }) => {
+${routeGuardPreamble(objectDef, true)}
+${generateCollectionLoad(className, { generic: true })}
+  const item = await collection.get(params.id);
+${generateNotFoundError(className)}
+
+  const data = applyWritablePolicy(await request.json());
+  Object.assign(item, data);
+  await item.save();
+${serializers.itemSerializerName ? `
+  const serializedItem = await ${serializers.itemSerializerName}(item);
+
+  return json(serializedItem);` : `
+  return json(item.toPublicJSON());`}
+};
+` : "";
+  const deleteHandler = hasDelete ? `
+// Delete ${simpleClassName.toLowerCase()}
+export const DELETE: RequestHandler = async ({ locals, params }) => {
+${routeGuardPreamble(objectDef, true)}
+${generateCollectionLoad(className, { generic: true })}
+  const item = await collection.get(params.id);
+${generateNotFoundError(className)}
+
+  await item.delete();
+  return json({ success: true });
+};
+` : "";
+  return imports + getHandler + putHandler + deleteHandler;
+}
+function generateActionRouteTemplate(_projectRoot, routeSpecs, objectDef, _options) {
+  if (routeSpecs.length === 0) {
+    throw new Error("Cannot generate a custom action route without handlers");
+  }
+  const [firstSpec] = routeSpecs;
+  const { lookupClassName, routeConfig, hostType } = firstSpec;
+  const hasMixedHosts = routeSpecs.some(
+    (spec) => spec.hostType !== hostType || spec.lookupClassName !== lookupClassName || spec.routeConfig.scope !== routeConfig.scope
+  );
+  if (hasMixedHosts) {
+    throw new Error(
+      `Cannot generate mixed custom route handlers for ${lookupClassName}. All handlers sharing a route path must target the same host type and scope.`
+    );
+  }
+  const importBlock = hostType === "collection" ? `import { error, json } from '@sveltejs/kit';
+import { getCollection } from '$lib/server/smrt';
+import type { RequestHandler } from './$types';` : routeConfig.scope === "collection" ? `import { error, json } from '@sveltejs/kit';
+import { ObjectRegistry } from '@happyvertical/smrt-core';
+import type { RequestHandler } from './$types';` : `import { error, json } from '@sveltejs/kit';
+import { getCollection } from '$lib/server/smrt';
+import type { RequestHandler } from './$types';`;
+  const tenantScoped = isTenantScoped(objectDef);
+  const handlers = routeSpecs.map(
+    (spec) => generateActionRouteHandler(
+      spec.lookupClassName,
+      spec.actionName,
+      spec.actionDef,
+      spec.routeConfig,
+      spec.hostType,
+      tenantScoped
+    )
+  ).join("\n");
+  return `${AUTO_GENERATED_ROUTE_HEADER}
+// DO NOT EDIT - changes will be overwritten
+
+${importBlock}
+${generateAuthGuardHelper(objectDef)}${tenantScoped ? generateTenantContextHelper() : ""}
+${handlers}`;
+}
+function generateActionRouteHandler(lookupClassName, actionName, actionDef, routeConfig, hostType, tenantScoped) {
+  const handlerName = routeConfig.method;
+  const guardLines = [
+    `  requireRouteAuth(locals, ${routeConfig.method !== "GET"});`
+  ];
+  if (tenantScoped) {
+    guardLines.push("  establishTenantContext(locals);");
+  }
+  const authGuardLine = guardLines.join("\n");
+  const hasInput = actionDef.parameters.length > 0;
+  const needsRequest = hasInput;
+  const invocationArgs = buildActionInvocationArgs(actionDef);
+  const hasPathParams = routeConfig.pathParamNames.length > 0;
+  const pathParamsObjectLiteral = buildPathParamsObjectLiteral(
+    routeConfig.pathParamNames
+  );
+  const optionsLoad = hasInput && routeConfig.method === "GET" ? hasPathParams ? [
+    `  const pathParams = ${pathParamsObjectLiteral};`,
+    "  const options = {",
+    "    ...Object.fromEntries(new URL(request.url).searchParams.entries()),",
+    "    ...pathParams,",
+    "  };",
+    ""
+  ].join("\n") : [
+    "  const options = Object.fromEntries(",
+    "    new URL(request.url).searchParams.entries(),",
+    "  );",
+    ""
+  ].join("\n") : hasInput ? hasPathParams ? [
+    `  const pathParams = ${pathParamsObjectLiteral};`,
+    "  const options = {",
+    "    ...(await request.json()),",
+    "    ...pathParams,",
+    "  };",
+    ""
+  ].join("\n") : "  const options = await request.json();\n" : "";
+  const collectionHandlerArgs = buildRouteHandlerArgs(
+    hasPathParams,
+    needsRequest
+  );
+  const itemHandlerArgs = buildRouteHandlerArgs(true, needsRequest);
+  if (hostType === "collection") {
+    return `// Custom collection method: ${actionName}
+export const ${handlerName}: RequestHandler = async (${collectionHandlerArgs}) => {
+${authGuardLine}
+${generateCollectionLoad(lookupClassName, { generic: true })}
+  const typedCollection = collection as any;
+${generateCollectionNotRegisteredError(lookupClassName)}
+
+${optionsLoad}  const result = ${buildActionInvocationExpression(
+      actionDef.isStatic ? "(typedCollection.constructor as any)" : "typedCollection",
+      actionName,
+      invocationArgs
+    )};
+
+  return json({ action: '${actionName}', result: toPublicResult(result) });
+};
+`;
+  }
+  if (routeConfig.scope === "collection") {
+    return `// Custom collection action: ${actionName}
+export const ${handlerName}: RequestHandler = async (${collectionHandlerArgs}) => {
+${authGuardLine}
+  const registered = ObjectRegistry.getClass('${lookupClassName}');
+${generateClassNotRegisteredError(lookupClassName)}
+
+${optionsLoad}  const ClassRef = registered.constructor as any;
+  const result = ${buildActionInvocationExpression(
+      "ClassRef",
+      actionName,
+      invocationArgs
+    )};
+
+  return json({ action: '${actionName}', result: toPublicResult(result) });
+};
+`;
+  }
+  return `// Custom action: ${actionName}
+export const ${handlerName}: RequestHandler = async (${itemHandlerArgs}) => {
+${authGuardLine}
+${generateCollectionLoad(lookupClassName, { generic: true })}
+  const item = await collection.get(params.id);
+${generateNotFoundError(lookupClassName)}
+
+${optionsLoad}  const result = ${buildActionInvocationExpression(
+    "item",
+    actionName,
+    invocationArgs
+  )};
+
+  return json({ action: '${actionName}', result: toPublicResult(result) });
+};
+`;
+}
+function generateKnowledgeRouteTemplate(knowledge, artifact) {
+  const api = knowledge.api ?? {};
+  const includeDocs = api.includeDocs === true;
+  const includePrompts = api.includePrompts === true;
+  const requireAdmin = api.requireAdmin !== false;
+  const artifactLiteral = artifact ? JSON.stringify(artifact) : "null";
+  return `${AUTO_GENERATED_ROUTE_HEADER}
+// DO NOT EDIT - changes will be overwritten
+
+import { dev } from '$app/environment';
+import { error, json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+
+const INCLUDE_DOCS_BY_DEFAULT = ${JSON.stringify(includeDocs)};
+const INCLUDE_PROMPTS_BY_DEFAULT = ${JSON.stringify(includePrompts)};
+const REQUIRE_ADMIN = ${JSON.stringify(requireAdmin)};
+const KNOWLEDGE_ARTIFACT: Record<string, any> | null = ${artifactLiteral};
+
+if (!dev && !REQUIRE_ADMIN) {
+  console.warn('[smrt] PUBLIC knowledge API route enabled; unauthenticated responses are sanitized.');
+}
+
+export const GET: RequestHandler = async ({ locals, url, setHeaders }) => {
+  setHeaders({ 'cache-control': 'private, no-store' });
+
+  if (!dev && REQUIRE_ADMIN && !isKnowledgeAdmin(locals as Record<string, any>)) {
+    throw error(403, 'SMRT knowledge requires dev mode or admin access');
+  }
+
+  const artifact = readKnowledgeArtifact();
+  const includeDocs = queryBoolean(url, 'includeDocs', INCLUDE_DOCS_BY_DEFAULT);
+  const includePrompts = queryBoolean(
+    url,
+    'includePrompts',
+    INCLUDE_PROMPTS_BY_DEFAULT,
+  );
+
+  return json(sanitizeKnowledgeArtifact(artifact, {
+    includeDocs,
+    includePrompts,
+    publicAccess: !REQUIRE_ADMIN,
+  }));
+};
+
+function readKnowledgeArtifact(): Record<string, any> {
+  if (!KNOWLEDGE_ARTIFACT) throw error(404, 'SMRT knowledge artifact not found');
+  return KNOWLEDGE_ARTIFACT;
+}
+
+function queryBoolean(url: URL, name: string, defaultValue: boolean): boolean {
+  const value = url.searchParams.get(name);
+  if (value === null) return defaultValue;
+  return value === 'true';
+}
+
+function sanitizeKnowledgeArtifact(
+  artifact: Record<string, any>,
+  options: { includeDocs: boolean; includePrompts: boolean; publicAccess: boolean },
+): Record<string, any> {
+  const sanitized = { ...artifact };
+
+  if (!options.includeDocs) {
+    delete sanitized.agentDoc;
+  }
+
+  if (!options.includePrompts) {
+    sanitized.prompts = [];
+  }
+
+  if (options.publicAccess) {
+    delete sanitized.dependencies;
+    delete sanitized.sourceHashes;
+    delete sanitized.sourceManifestPath;
+    delete sanitized.agentDocPath;
+  }
+
+  return sanitized;
+}
+
+function isKnowledgeAdmin(locals: Record<string, any>): boolean {
+  if (locals.smrtKnowledgeAdmin === true || locals.smrtAdmin === true) {
+    return true;
+  }
+
+  const userRoles = rolesFrom(locals.user);
+  const sessionRoles = rolesFrom(locals.session?.user);
+  return [...userRoles, ...sessionRoles].some((role) =>
+    ['admin', 'owner', 'superadmin'].includes(role),
+  );
+}
+
+function rolesFrom(value: any): string[] {
+  if (!value || typeof value !== 'object') return [];
+  const roles = Array.isArray(value.roles) ? value.roles : [value.role];
+  return roles
+    .filter((role): role is string => typeof role === 'string')
+    .map((role) => role.toLowerCase());
+}
+`;
+}
+function updateGitignore(projectRoot, options) {
+  const gitignorePath = join(projectRoot, ".gitignore");
+  const patternsToAdd = [
+    "# SMRT auto-generated routes (from Vite plugin)",
+    `${options.routesDir}/**/+server.ts`
+  ];
+  if (options.knowledge?.api?.enabled) {
+    const knowledgeRoute = relative(
+      projectRoot,
+      join(knowledgeRouteDir(projectRoot, options), "+server.ts")
+    ).replaceAll("\\", "/");
+    patternsToAdd.push(knowledgeRoute);
+  }
+  let gitignoreContent = "";
+  if (existsSync(gitignorePath)) {
+    gitignoreContent = readFileSync(gitignorePath, "utf-8");
+  }
+  let needsUpdate = false;
+  const linesToAdd = [];
+  for (const pattern of patternsToAdd) {
+    if (!gitignoreContent.includes(pattern)) {
+      linesToAdd.push(pattern);
+      needsUpdate = true;
+    }
+  }
+  if (needsUpdate) {
+    if (gitignoreContent.length > 0 && !gitignoreContent.endsWith("\n")) {
+      gitignoreContent += "\n";
+    }
+    if (gitignoreContent.length > 0 && !gitignoreContent.endsWith("\n\n")) {
+      gitignoreContent += "\n";
+    }
+    gitignoreContent += `${linesToAdd.join("\n")}
+`;
+    writeFileSync(gitignorePath, gitignoreContent, "utf-8");
+    console.log("[smrt] Updated .gitignore with generated route patterns");
+  }
+}
+export {
+  findCliApiCoherenceViolations,
+  generateSvelteKitRoutes,
+  methodNameToKebab,
+  resolveApiActionSet,
+  validateCliIncludeAgainstApi
+};
+//# sourceMappingURL=sveltekit-generator.js.map