@happyvertical/smrt-core 0.37.6 → 0.37.7

package/dist/generators/rest.js

@@ -1,4 +1,6 @@
 import { ObjectRegistry } from "../registry.js";
+import { conditionalJsonResponse, resolveReadCacheControl, warnIfSharedCacheNeutralized } from "./conditional-get.js";
+import { SYNC_APPLY_ROUTE_SEGMENTS, processSyncApplyBatch } from "../sync/apply.js";
 import http from "node:http";
 //#region src/generators/rest.ts
 /**
@@ -124,6 +126,10 @@ var APIGenerator = class {
 	async handleObjectRoute(req, url) {
 		const pathParts = url.pathname.replace(this.config.basePath || "", "").split("/").filter(Boolean);
 		if (pathParts.length === 0) return this.createErrorResponse(400, "Object type required");
+		if (pathParts.length === SYNC_APPLY_ROUTE_SEGMENTS.length && SYNC_APPLY_ROUTE_SEGMENTS.every((segment, i) => pathParts[i] === segment)) {
+			if (req.method !== "POST") return this.createErrorResponse(405, "Method not allowed");
+			return await this.handleSyncApply(req);
+		}
 		const objectType = pathParts[0];
 		const objectId = pathParts[1];
 		if (this.collections.has(objectType)) {
@@ -162,7 +168,7 @@ var APIGenerator = class {
 			if (action && !this.isApiActionEnabled(objectName, action)) return this.createErrorResponse(405, "Method not allowed");
 			if (objectId === "count" && req.method === "GET") return await this.handleCount(collection, url.searchParams);
 			switch (req.method) {
-				case "GET": return objectId ? await this.handleGet(collection, objectId) : await this.handleList(collection, url.searchParams);
+				case "GET": return objectId ? await this.handleGet(collection, objectId, req, objectName) : await this.handleList(collection, url.searchParams, req, objectName);
 				case "POST": return await this.handleCreate(collection, req, objectName);
 				case "PUT":
 				case "PATCH":
@@ -223,15 +229,15 @@ var APIGenerator = class {
 	/**
 	* Handle GET /objects/:id
 	*/
-	async handleGet(collection, id) {
+	async handleGet(collection, id, req, objectName) {
 		const object = await collection.get(id);
 		if (!object) return this.createErrorResponse(404, "Object not found");
-		return this.createJsonResponse(this.toPublicData(object));
+		return this.createReadResponse(req, objectName, this.toPublicData(object));
 	}
 	/**
 	* Handle GET /objects (list with query params)
 	*/
-	async handleList(collection, params) {
+	async handleList(collection, params, req, objectName) {
 		const limit = Number.parseInt(params.get("limit") || "50", 10);
 		const offset = Number.parseInt(params.get("offset") || "0", 10);
 		const orderBy = params.get("orderBy") || "created_at DESC";
@@ -263,7 +269,7 @@ var APIGenerator = class {
 			offset,
 			orderBy
 		});
-		return this.createJsonResponse(objects.map((object) => this.toPublicData(object)));
+		return this.createReadResponse(req, objectName, objects.map((object) => this.toPublicData(object)));
 	}
 	/**
 	* Handle GET /objects/count
@@ -323,6 +329,66 @@ var APIGenerator = class {
 		return new Response(null, { status: 204 });
 	}
 	/**
+	* Handle POST /sync/apply — the idempotent batch write contract (#1759).
+	* All processing lives in `sync/apply.ts`; this method only adapts the
+	* generator's existing collection resolution, auth, action gating, and
+	* writable policy into a {@link SyncApplyTarget} per item.
+	*/
+	async handleSyncApply(req) {
+		let rawBody;
+		let body;
+		try {
+			rawBody = await req.text();
+			body = JSON.parse(rawBody);
+		} catch {
+			return this.createErrorResponse(400, "Invalid JSON body");
+		}
+		const outcome = await processSyncApplyBatch(body, { resolveTarget: (objectSegment) => this.resolveSyncApplyTarget(objectSegment, req, rawBody) });
+		return this.createJsonResponse(outcome.body, outcome.status);
+	}
+	/**
+	* Resolve a sync item's `object` segment exactly like `handleObjectRoute`
+	* resolves a CRUD URL segment (registered collections first, then registry
+	* auto-discovery), and wrap the generator's per-object machinery.
+	*/
+	resolveSyncApplyTarget(objectSegment, req, rawBody) {
+		let collection = null;
+		let objectName = null;
+		const registered = this.collections.get(objectSegment);
+		if (registered) {
+			collection = registered;
+			objectName = this.getCollectionObjectName(registered) || objectSegment;
+		} else {
+			const pluralName = this.pluralize(objectSegment);
+			for (const [key, info] of ObjectRegistry.getAllClasses()) if (this.pluralize((info.name || key).toLowerCase()) === pluralName) {
+				collection = this.getCollection(info);
+				objectName = info.name;
+				break;
+			}
+		}
+		if (!collection || !objectName) return null;
+		const resolvedName = objectName;
+		return {
+			objectName: resolvedName,
+			collection,
+			isOpAllowed: (op) => this.isApiActionEnabled(resolvedName, op),
+			authorize: async (op) => {
+				if (this.config.authMiddleware) {
+					const verb = op === "create" ? "post" : op === "update" ? "put" : "delete";
+					const authResult = await this.config.authMiddleware(resolvedName, verb)(new Request(req.url, {
+						method: req.method,
+						headers: req.headers,
+						body: rawBody
+					}));
+					if (authResult instanceof Response) return authResult.status === 401 ? "auth_required" : "forbidden";
+					return "ok";
+				}
+				return this.isRoutePublic(resolvedName, "POST") ? "ok" : "auth_required";
+			},
+			prepare: (payload) => this.applyWritablePolicy(resolvedName, payload)
+		};
+	}
+	/**
 	* Get or create collection instance
 	*/
 	getCollection(classInfo) {
@@ -380,6 +446,21 @@ var APIGenerator = class {
 		return typeof serializable?.toPublicJSON === "function" ? serializable.toPublicJSON() : object;
 	}
 	/**
+	* Create a JSON read response with conditional-GET support (#1757): a strong
+	* body-hash ETag, `If-None-Match` → 304 with an empty body, and the
+	* Cache-Control policy resolved from the object's `@smrt({ api })` config
+	* (private + revalidatable by default; shared `s-maxage` only for public
+	* models that opt in). Tenant-scoped models are always private: their bodies
+	* vary with tenant context, which URL-keyed shared caches cannot see.
+	*/
+	createReadResponse(req, objectName, payload) {
+		const config = objectName ? ObjectRegistry.getConfig(objectName) : void 0;
+		const apiConfig = config?.api;
+		const tenantScoped = objectName ? ObjectRegistry.isTenantScoped(objectName) || !!config?.tenantScoped : false;
+		if (objectName) warnIfSharedCacheNeutralized(objectName, apiConfig, tenantScoped);
+		return conditionalJsonResponse(req, payload, resolveReadCacheControl(apiConfig, { tenantScoped }));
+	}
+	/**
 	* Create JSON response with proper headers
 	*/
 	createJsonResponse(data, status = 200) {

package/dist/generators/rest.js.map

@@ -1 +1 @@
-{"version":3,"file":"rest.js","names":[],"sources":["../../src/generators/rest.ts"],"sourcesContent":["/**\n * High-performance REST API generator for smrt objects using Node.js HTTP server\n *\n * Designed for minimal bundle size and maximum performance\n */\n\nimport http from 'node:http';\nimport type { SmrtCollection } from '../collection';\nimport type { SmrtObject } from '../object';\nimport { ObjectRegistry } from '../registry';\nimport type { RegisteredClass, SmrtObjectConstructor } from '../registry/types';\n\nexport interface APIConfig {\n  basePath?: string;\n  enableCors?: boolean;\n  /**\n   * Explicit CORS origin allowlist (#1540). Required when `enableCors` is true —\n   * the generator never emits `Access-Control-Allow-Origin: *`. A request's\n   * `Origin` is echoed only when it appears here.\n   */\n  allowedOrigins?: string[];\n  customRoutes?: Record<string, (req: Request) => Promise<Response>>;\n  authMiddleware?: (\n    objectName: string,\n    action: string,\n  ) => (req: Request) => Promise<Request | Response>;\n  port?: number;\n  hostname?: string;\n}\n\nexport interface APIContext {\n  db?: unknown;\n  ai?: unknown;\n  user?: {\n    id: string;\n    username?: string;\n    roles?: string[];\n  };\n}\n\n/**\n * High-performance API generator using native Bun\n */\nexport class APIGenerator {\n  private config: APIConfig;\n  private collections = new Map<string, SmrtCollection<SmrtObject>>();\n  private context: APIContext;\n\n  constructor(config: APIConfig = {}, context: APIContext = {}) {\n    this.config = {\n      basePath: '/api/v1',\n      // Security defaults (#1540): bind to loopback and keep CORS off unless an\n      // explicit origin allowlist is supplied. No `Access-Control-Allow-Origin: *`.\n      enableCors: false,\n      port: 3000,\n      hostname: '127.0.0.1',\n      ...config,\n    };\n    this.context = context;\n  }\n\n  /**\n   * Register a pre-configured collection instance for API exposure\n   *\n   * @param name - URL path segment for the collection (e.g., 'products' for /api/products)\n   * @param collection - Pre-initialized SmrtCollection instance\n   */\n  registerCollection(\n    name: string,\n    collection: SmrtCollection<SmrtObject>,\n  ): void {\n    this.collections.set(name, collection);\n  }\n\n  /**\n   * Create Node.js HTTP server with all routes\n   */\n  createServer(): { server: http.Server; url: string } {\n    const server = http.createServer(async (req, res) => {\n      try {\n        const request = await this.nodeRequestToWebRequest(req);\n        const response = await this.handleRequest(request);\n        await this.webResponseToNodeResponse(response, res);\n      } catch (_error) {\n        res.statusCode = 500;\n        res.end('Internal Server Error');\n      }\n    });\n\n    server.listen(this.config.port, this.config.hostname);\n\n    return {\n      server,\n      url: `http://${this.config.hostname}:${this.config.port}`,\n    };\n  }\n\n  /**\n   * Convert stream to string\n   */\n  private async streamToString(stream: http.IncomingMessage): Promise<string> {\n    const chunks: Buffer[] = [];\n    for await (const chunk of stream) {\n      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n    }\n    return Buffer.concat(chunks).toString('utf-8');\n  }\n\n  /**\n   * Convert Node.js IncomingMessage to Web Request\n   */\n  private async nodeRequestToWebRequest(\n    req: http.IncomingMessage,\n  ): Promise<Request> {\n    const url = `http://${this.config.hostname}:${this.config.port}${req.url}`;\n    const method = req.method || 'GET';\n    const headers = new Headers();\n\n    for (const [key, value] of Object.entries(req.headers)) {\n      if (value) {\n        headers.set(key, Array.isArray(value) ? value[0] : value);\n      }\n    }\n\n    let body: string | undefined;\n    if (method !== 'GET' && method !== 'HEAD') {\n      body = await this.streamToString(req);\n    }\n\n    return new Request(url, {\n      method,\n      headers,\n      body,\n    });\n  }\n\n  /**\n   * Convert Web Response to Node.js ServerResponse\n   */\n  private async webResponseToNodeResponse(\n    webResponse: Response,\n    res: http.ServerResponse,\n  ): Promise<void> {\n    res.statusCode = webResponse.status;\n\n    // Set headers\n    webResponse.headers.forEach((value, key) => {\n      res.setHeader(key, value);\n    });\n\n    // Send body\n    if (webResponse.body) {\n      const reader = webResponse.body.getReader();\n      while (true) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        res.write(value);\n      }\n    }\n\n    res.end();\n  }\n\n  /**\n   * Generate fetch handler function (for serverless environments)\n   */\n  generateHandler(): (req: Request) => Promise<Response> {\n    return (req) => this.handleRequest(req);\n  }\n\n  /**\n   * Main request handler using native Bun APIs\n   */\n  private async handleRequest(req: Request): Promise<Response> {\n    const url = new URL(req.url);\n\n    // Handle CORS preflight\n    if (req.method === 'OPTIONS' && this.config.enableCors) {\n      return this.createCorsResponse(req);\n    }\n\n    // Handle custom routes first\n    if (this.config.customRoutes) {\n      for (const [path, handler] of Object.entries(this.config.customRoutes)) {\n        if (url.pathname === `${this.config.basePath}${path}`) {\n          const response = await handler(req);\n          return this.addCorsHeaders(response, req);\n        }\n      }\n    }\n\n    // Handle object routes\n    if (url.pathname.startsWith(this.config.basePath || '')) {\n      const response = await this.handleObjectRoute(req, url);\n      return this.addCorsHeaders(response, req);\n    }\n\n    // Not found\n    return this.createErrorResponse(404, 'Not found');\n  }\n\n  /**\n   * Handle CRUD routes for SMRT objects\n   */\n  private async handleObjectRoute(req: Request, url: URL): Promise<Response> {\n    const pathParts = url.pathname\n      .replace(this.config.basePath || '', '')\n      .split('/')\n      .filter(Boolean);\n\n    if (pathParts.length === 0) {\n      return this.createErrorResponse(400, 'Object type required');\n    }\n\n    const objectType = pathParts[0];\n    const objectId = pathParts[1];\n\n    // Check for explicitly registered collection first\n    if (this.collections.has(objectType)) {\n      const collection = this.collections.get(objectType);\n      if (!collection) throw new Error(`Collection ${objectType} not found`);\n\n      const objectName = this.getCollectionObjectName(collection) || objectType;\n\n      // Apply auth middleware if configured\n      if (this.config.authMiddleware) {\n        const authCheck = this.config.authMiddleware(\n          objectName,\n          req.method.toLowerCase(),\n        );\n        const authResult = await authCheck(req);\n        if (authResult instanceof Response) {\n          return authResult; // Auth failed\n        }\n        // Auth passed, use the potentially modified request\n        req = authResult;\n      } else if (!this.isRoutePublic(objectName, req.method)) {\n        // Fail-closed (#1540): no auth middleware wired and the object isn't\n        // marked `@smrt({ api: { public } })` → refuse rather than serve open.\n        return this.createErrorResponse(401, 'Authentication required');\n      }\n\n      // Use registered collection directly\n      return await this.executeCrudOperation(\n        req,\n        collection,\n        objectId,\n        url,\n        objectName,\n      );\n    }\n\n    // Fall back to auto-discovery via ObjectRegistry\n    const registeredClasses = ObjectRegistry.getAllClasses();\n    const pluralName = this.pluralize(objectType);\n\n    let classInfo: RegisteredClass | null = null;\n    for (const [_key, info] of registeredClasses) {\n      // Issue #951: Use simple name (info.name) for URL matching, not the map key\n      // which may be a qualified name like '@happyvertical/smrt-events:Event'\n      if (this.pluralize((info.name || _key).toLowerCase()) === pluralName) {\n        classInfo = info;\n        break;\n      }\n    }\n\n    if (!classInfo) {\n      return this.createErrorResponse(\n        404,\n        `Object type '${objectType}' not found`,\n      );\n    }\n\n    // Apply auth middleware if configured\n    if (this.config.authMiddleware) {\n      const authCheck = this.config.authMiddleware(\n        classInfo.name,\n        req.method.toLowerCase(),\n      );\n      const authResult = await authCheck(req);\n      if (authResult instanceof Response) {\n        return authResult; // Auth failed\n      }\n      // Auth passed, use the potentially modified request\n      req = authResult;\n    } else if (!this.isRoutePublic(classInfo.name, req.method)) {\n      // Fail-closed (#1540): see registered-collection branch above.\n      return this.createErrorResponse(401, 'Authentication required');\n    }\n\n    // Get or create collection\n    const collection = this.getCollection(classInfo);\n\n    return await this.executeCrudOperation(\n      req,\n      collection,\n      objectId,\n      url,\n      classInfo.name,\n    );\n  }\n\n  /**\n   * Execute CRUD operation on a collection\n   */\n  private async executeCrudOperation(\n    req: Request,\n    collection: SmrtCollection<SmrtObject>,\n    objectId: string | undefined,\n    url: URL,\n    objectName?: string,\n  ): Promise<Response> {\n    try {\n      const action = this.getCrudAction(req.method, objectId);\n      if (action && !this.isApiActionEnabled(objectName, action)) {\n        return this.createErrorResponse(405, 'Method not allowed');\n      }\n\n      // Handle special /count endpoint\n      if (objectId === 'count' && req.method === 'GET') {\n        return await this.handleCount(collection, url.searchParams);\n      }\n\n      // Route to appropriate CRUD operation\n      switch (req.method) {\n        case 'GET':\n          return objectId\n            ? await this.handleGet(collection, objectId)\n            : await this.handleList(collection, url.searchParams);\n\n        case 'POST':\n          return await this.handleCreate(collection, req, objectName);\n\n        case 'PUT':\n        case 'PATCH':\n          if (!objectId) {\n            return this.createErrorResponse(\n              400,\n              'Object ID required for update',\n            );\n          }\n          return await this.handleUpdate(collection, objectId, req, objectName);\n\n        case 'DELETE':\n          if (!objectId) {\n            return this.createErrorResponse(\n              400,\n              'Object ID required for delete',\n            );\n          }\n          return await this.handleDelete(collection, objectId);\n\n        default:\n          return this.createErrorResponse(405, 'Method not allowed');\n      }\n    } catch (error) {\n      console.error('API Error:', error);\n      return this.createErrorResponse(500, 'Internal server error');\n    }\n  }\n\n  private getCrudAction(\n    method: string,\n    objectId: string | undefined,\n  ): 'list' | 'get' | 'create' | 'update' | 'delete' | null {\n    switch (method) {\n      case 'GET':\n        return objectId && objectId !== 'count' ? 'get' : 'list';\n      case 'POST':\n        return 'create';\n      case 'PUT':\n      case 'PATCH':\n        return 'update';\n      case 'DELETE':\n        return 'delete';\n      default:\n        return null;\n    }\n  }\n\n  /**\n   * Fail-closed authorization posture (#1540). Returns true only when the\n   * object opts out of auth via `@smrt({ api: { public } })`:\n   * - `public: true` → all methods are public.\n   * - `public: 'read'` → only safe (GET) methods are public.\n   * Everything else requires an `authMiddleware` to be configured.\n   */\n  private isRoutePublic(\n    objectName: string | undefined,\n    method: string,\n  ): boolean {\n    if (!objectName) return false;\n    const apiConfig = ObjectRegistry.getConfig(objectName)?.api;\n    if (!apiConfig || typeof apiConfig !== 'object') return false;\n    const publicAccess = (apiConfig as { public?: boolean | 'read' }).public;\n    if (publicAccess === true) return true;\n    if (publicAccess === 'read') return method.toUpperCase() === 'GET';\n    return false;\n  }\n\n  private isApiActionEnabled(\n    objectName: string | undefined,\n    action: 'list' | 'get' | 'create' | 'update' | 'delete',\n  ): boolean {\n    if (!objectName) {\n      return true;\n    }\n\n    const config = ObjectRegistry.getConfig(objectName);\n    const apiConfig = config.api;\n\n    if (apiConfig === false) {\n      return false;\n    }\n\n    if (apiConfig && typeof apiConfig === 'object') {\n      if (apiConfig.include && !apiConfig.include.includes(action)) {\n        return false;\n      }\n\n      if (apiConfig.exclude?.includes(action)) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  private getCollectionObjectName(\n    collection: SmrtCollection<SmrtObject>,\n  ): string | undefined {\n    // `_itemClass` lives on the instance (protected getter) or the collection\n    // constructor (static). Read it through a structural shape rather than the\n    // class's private surface; behavior is unchanged.\n    const itemClass: SmrtObjectConstructor | undefined =\n      (collection as unknown as { _itemClass?: SmrtObjectConstructor })\n        ._itemClass ||\n      (\n        collection.constructor as unknown as {\n          _itemClass?: SmrtObjectConstructor;\n        }\n      )?._itemClass;\n\n    if (!itemClass) {\n      return undefined;\n    }\n\n    const registered = ObjectRegistry.getClassByConstructor(itemClass);\n    return registered?.qualifiedName || registered?.name || itemClass.name;\n  }\n\n  /**\n   * Handle GET /objects/:id\n   */\n  private async handleGet(\n    collection: SmrtCollection<SmrtObject>,\n    id: string,\n  ): Promise<Response> {\n    const object = await collection.get(id);\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n    return this.createJsonResponse(this.toPublicData(object));\n  }\n\n  /**\n   * Handle GET /objects (list with query params)\n   */\n  private async handleList(\n    collection: SmrtCollection<SmrtObject>,\n    params: URLSearchParams,\n  ): Promise<Response> {\n    const limit = Number.parseInt(params.get('limit') || '50', 10);\n    const offset = Number.parseInt(params.get('offset') || '0', 10);\n    const orderBy = params.get('orderBy') || 'created_at DESC';\n\n    // Build where clause from query params\n    // Convert REST-style operators (price[gt]) to SQL-style (price >)\n    const where: Record<string, string | string[]> = {};\n    for (const [key, value] of params.entries()) {\n      if (!['limit', 'offset', 'orderBy'].includes(key)) {\n        // Parse REST operator format: field[operator]\n        const match = key.match(/^(.+)\\[(.+)\\]$/);\n        if (match) {\n          const field = match[1];\n          const operator = match[2];\n          // Map REST operators to SQL operators\n          const operatorMap: Record<string, string> = {\n            gt: '>',\n            gte: '>=',\n            lt: '<',\n            lte: '<=',\n            ne: '!=',\n            in: 'in',\n            like: 'like',\n          };\n          const sqlOperator = operatorMap[operator] || operator;\n          const sqlKey = `${field} ${sqlOperator}`;\n          // Handle 'in' operator - convert comma-separated string to array\n          where[sqlKey] = operator === 'in' ? value.split(',') : value;\n        } else {\n          where[key] = value;\n        }\n      }\n    }\n\n    const objects = await collection.list({\n      where: Object.keys(where).length > 0 ? where : undefined,\n      limit,\n      offset,\n      orderBy,\n    });\n\n    return this.createJsonResponse(\n      objects.map((object: SmrtObject) => this.toPublicData(object)),\n    );\n  }\n\n  /**\n   * Handle GET /objects/count\n   */\n  private async handleCount(\n    collection: SmrtCollection<SmrtObject>,\n    params: URLSearchParams,\n  ): Promise<Response> {\n    // Build where clause from query params (same logic as handleList)\n    const where: Record<string, string | string[]> = {};\n    for (const [key, value] of params.entries()) {\n      // Parse REST operator format: field[operator]\n      const match = key.match(/^(.+)\\[(.+)\\]$/);\n      if (match) {\n        const field = match[1];\n        const operator = match[2];\n        // Map REST operators to SQL operators\n        const operatorMap: Record<string, string> = {\n          gt: '>',\n          gte: '>=',\n          lt: '<',\n          lte: '<=',\n          ne: '!=',\n          in: 'in',\n          like: 'like',\n        };\n        const sqlOperator = operatorMap[operator] || operator;\n        const sqlKey = `${field} ${sqlOperator}`;\n        // Handle 'in' operator - convert comma-separated string to array\n        where[sqlKey] = operator === 'in' ? value.split(',') : value;\n      } else {\n        where[key] = value;\n      }\n    }\n\n    const count = await collection.count({\n      where: Object.keys(where).length > 0 ? where : undefined,\n    });\n\n    return this.createJsonResponse({ count });\n  }\n\n  /**\n   * Handle POST /objects\n   */\n  private async handleCreate(\n    collection: SmrtCollection<SmrtObject>,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const data = this.applyWritablePolicy(objectName, await req.json());\n    const object = await collection.create({ ...data, _skipLoad: true });\n    await object.save();\n    return this.createJsonResponse(this.toPublicData(object), 201);\n  }\n\n  /**\n   * Handle PUT/PATCH /objects/:id\n   */\n  private async handleUpdate(\n    collection: SmrtCollection<SmrtObject>,\n    id: string,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const data = this.applyWritablePolicy(objectName, await req.json());\n    const object = await collection.get(id);\n\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n\n    // Update object properties\n    Object.assign(object, data);\n    await object.save();\n\n    return this.createJsonResponse(this.toPublicData(object));\n  }\n\n  /**\n   * Handle DELETE /objects/:id\n   */\n  private async handleDelete(\n    collection: SmrtCollection<SmrtObject>,\n    id: string,\n  ): Promise<Response> {\n    const object = await collection.get(id);\n\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n\n    await object.delete();\n    return new Response(null, { status: 204 });\n  }\n\n  /**\n   * Get or create collection instance\n   */\n  private getCollection(\n    classInfo: RegisteredClass,\n  ): SmrtCollection<SmrtObject> {\n    if (!this.collections.has(classInfo.name)) {\n      // `collectionConstructor` is typed optional on RegisteredClass, but the\n      // auto-discovery path only reaches here for classes that declare one.\n      // Narrow to the non-optional constructor type before instantiating.\n      const ctor = classInfo.collectionConstructor as NonNullable<\n        RegisteredClass['collectionConstructor']\n      >;\n      const collection = new ctor({\n        ai: this.context.ai,\n        db: this.context.db,\n      });\n      this.collections.set(classInfo.name, collection);\n    }\n    const collection = this.collections.get(classInfo.name);\n    if (!collection) throw new Error(`Collection ${classInfo.name} not found`);\n    return collection;\n  }\n\n  /**\n   * Mass-assignment guard (#1540): strip framework/server-managed and\n   * `@field({ readonly: true })` fields from a create/update body, and — when an\n   * `@smrt({ api: { writable: [...] } })` allowlist is set — intersect with it.\n   */\n  private applyWritablePolicy(\n    objectName: string | undefined,\n    data: unknown,\n  ): Record<string, unknown> {\n    if (!data || typeof data !== 'object') {\n      return {};\n    }\n\n    const serverManaged = new Set([\n      'id',\n      'tenantId',\n      'tenant_id',\n      'createdAt',\n      'created_at',\n      'updatedAt',\n      'updated_at',\n    ]);\n\n    const readonly = new Set<string>();\n    let writable: string[] | null = null;\n\n    if (objectName) {\n      const apiConfig = ObjectRegistry.getConfig(objectName)?.api;\n      if (\n        apiConfig &&\n        typeof apiConfig === 'object' &&\n        Array.isArray((apiConfig as { writable?: unknown }).writable)\n      ) {\n        writable = (apiConfig as { writable: string[] }).writable;\n      }\n\n      for (const [name, def] of ObjectRegistry.getFields(objectName)) {\n        if (def && (def.readonly === true || def._meta?.readonly === true)) {\n          readonly.add(name);\n        }\n      }\n    }\n\n    const result: Record<string, unknown> = {};\n    for (const [key, value] of Object.entries(data)) {\n      if (key.startsWith('_')) continue;\n      if (serverManaged.has(key)) continue;\n      if (readonly.has(key)) continue;\n      if (writable && !writable.includes(key)) continue;\n      result[key] = value;\n    }\n    return result;\n  }\n\n  /**\n   * Serialize a SmrtObject for a network response, excluding sensitive fields\n   * (#1540). Falls back to the value unchanged for non-SmrtObject payloads.\n   */\n  private toPublicData(object: unknown): unknown {\n    const serializable = object as { toPublicJSON?: () => unknown } | null;\n    return typeof serializable?.toPublicJSON === 'function'\n      ? serializable.toPublicJSON()\n      : object;\n  }\n\n  /**\n   * Create JSON response with proper headers\n   */\n  private createJsonResponse(data: unknown, status = 200): Response {\n    return new Response(JSON.stringify(data), {\n      status,\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  }\n\n  /**\n   * Create error response\n   */\n  private createErrorResponse(status: number, message: string): Response {\n    return new Response(JSON.stringify({ error: message }), {\n      status,\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  }\n\n  /**\n   * Resolve the allowed `Access-Control-Allow-Origin` for a request (#1540).\n   * Returns the request's `Origin` only when it is in the configured allowlist;\n   * never `*`. Returns null when CORS should not be applied.\n   */\n  private resolveAllowedOrigin(req: Request): string | null {\n    if (!this.config.enableCors) return null;\n    const allowed = this.config.allowedOrigins;\n    if (!allowed || allowed.length === 0) return null;\n    const origin = req.headers.get('origin');\n    return origin && allowed.includes(origin) ? origin : null;\n  }\n\n  /**\n   * Create CORS preflight response\n   */\n  private createCorsResponse(req: Request): Response {\n    const headers: Record<string, string> = {\n      'Access-Control-Allow-Methods': 'GET,POST,PUT,PATCH,DELETE,OPTIONS',\n      'Access-Control-Allow-Headers': 'Content-Type,Authorization',\n      'Access-Control-Max-Age': '86400',\n    };\n    const origin = this.resolveAllowedOrigin(req);\n    if (origin) {\n      headers['Access-Control-Allow-Origin'] = origin;\n      headers.Vary = 'Origin';\n    }\n    return new Response(null, { status: 200, headers });\n  }\n\n  /**\n   * Add CORS headers to response\n   */\n  private addCorsHeaders(response: Response, req: Request): Response {\n    const origin = this.resolveAllowedOrigin(req);\n    if (!origin) return response;\n\n    const headers = new Headers(response.headers);\n    headers.set('Access-Control-Allow-Origin', origin);\n    headers.set('Vary', 'Origin');\n    headers.set(\n      'Access-Control-Allow-Methods',\n      'GET,POST,PUT,PATCH,DELETE,OPTIONS',\n    );\n    headers.set('Access-Control-Allow-Headers', 'Content-Type,Authorization');\n\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n\n  /**\n   * Simple pluralization (basic implementation)\n   */\n  private pluralize(word: string): string {\n    if (word.endsWith('y')) {\n      return `${word.slice(0, -1)}ies`;\n    }\n    if (word.endsWith('s') || word.endsWith('sh') || word.endsWith('ch')) {\n      return `${word}es`;\n    }\n    return `${word}s`;\n  }\n}\n\n// REST Server Utilities\n\nexport interface RestServerConfig extends APIConfig {\n  healthCheck?: {\n    enabled?: boolean;\n    path?: string;\n    customChecks?: (() => Promise<boolean>)[];\n  };\n}\n\n/**\n * Create REST server with health checks using Bun\n */\nexport function createRestServer(\n  objects: (typeof SmrtObject)[],\n  context: APIContext = {},\n  config: RestServerConfig = {},\n): { server: http.Server; url: string } {\n  // Register objects if not already registered\n  objects.forEach((obj) => {\n    if (!ObjectRegistry.hasClass(obj.name)) {\n      console.warn(`Object ${obj.name} not registered with @smrt decorator`);\n    }\n  });\n\n  const generator = new APIGenerator(config, context);\n  const { server, url } = generator.createServer();\n\n  console.log(`🚀 smrt REST API server running at ${url}`);\n\n  return { server, url };\n}\n\n/**\n * Start server with graceful shutdown\n */\nexport function startRestServer(\n  objects: (typeof SmrtObject)[],\n  context: APIContext = {},\n  config: RestServerConfig = {},\n): Promise<() => Promise<void>> {\n  return new Promise((resolve) => {\n    const { server, url } = createRestServer(objects, context, config);\n\n    // Graceful shutdown function\n    const shutdown = (): Promise<void> => {\n      return new Promise((shutdownResolve) => {\n        console.log('🛑 Shutting down server gracefully...');\n        // Node's http.Server#close stops accepting new connections and invokes\n        // the callback once in-flight ones drain. (The prior `.stop()` was a\n        // Bun-era API absent on http.Server — it would have thrown.)\n        server.close(() => {\n          console.log('✅ Server shut down complete');\n          shutdownResolve();\n        });\n      });\n    };\n\n    // Handle shutdown signals\n    process.on('SIGTERM', shutdown);\n    process.on('SIGINT', shutdown);\n\n    resolve(shutdown);\n  });\n}\n"],"mappings":";;;;;;;;;;;AA2CA,IAAa,eAAb,MAA0B;CACxB;CACA,8BAAsB,IAAI,IAAwC;CAClE;CAEA,YAAY,SAAoB,CAAC,GAAG,UAAsB,CAAC,GAAG;EAC5D,KAAK,SAAS;GACZ,UAAU;GAGV,YAAY;GACZ,MAAM;GACN,UAAU;GACV,GAAG;EACL;EACA,KAAK,UAAU;CACjB;;;;;;;CAQA,mBACE,MACA,YACM;EACN,KAAK,YAAY,IAAI,MAAM,UAAU;CACvC;;;;CAKA,eAAqD;EACnD,MAAM,SAAS,KAAK,aAAa,OAAO,KAAK,QAAQ;GACnD,IAAI;IACF,MAAM,UAAU,MAAM,KAAK,wBAAwB,GAAG;IACtD,MAAM,WAAW,MAAM,KAAK,cAAc,OAAO;IACjD,MAAM,KAAK,0BAA0B,UAAU,GAAG;GACpD,SAAS,QAAQ;IACf,IAAI,aAAa;IACjB,IAAI,IAAI,uBAAuB;GACjC;EACF,CAAC;EAED,OAAO,OAAO,KAAK,OAAO,MAAM,KAAK,OAAO,QAAQ;EAEpD,OAAO;GACL;GACA,KAAK,UAAU,KAAK,OAAO,SAAS,GAAG,KAAK,OAAO;EACrD;CACF;;;;CAKA,MAAc,eAAe,QAA+C;EAC1E,MAAM,SAAmB,CAAC;EAC1B,WAAW,MAAM,SAAS,QACxB,OAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;EAEjE,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,OAAO;CAC/C;;;;CAKA,MAAc,wBACZ,KACkB;EAClB,MAAM,MAAM,UAAU,KAAK,OAAO,SAAS,GAAG,KAAK,OAAO,OAAO,IAAI;EACrE,MAAM,SAAS,IAAI,UAAU;EAC7B,MAAM,UAAU,IAAI,QAAQ;EAE5B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,OAAO,GACnD,IAAI,OACF,QAAQ,IAAI,KAAK,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,KAAK;EAI5D,IAAI;EACJ,IAAI,WAAW,SAAS,WAAW,QACjC,OAAO,MAAM,KAAK,eAAe,GAAG;EAGtC,OAAO,IAAI,QAAQ,KAAK;GACtB;GACA;GACA;EACF,CAAC;CACH;;;;CAKA,MAAc,0BACZ,aACA,KACe;EACf,IAAI,aAAa,YAAY;EAG7B,YAAY,QAAQ,SAAS,OAAO,QAAQ;GAC1C,IAAI,UAAU,KAAK,KAAK;EAC1B,CAAC;EAGD,IAAI,YAAY,MAAM;GACpB,MAAM,SAAS,YAAY,KAAK,UAAU;GAC1C,OAAO,MAAM;IACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;IAC1C,IAAI,MAAM;IACV,IAAI,MAAM,KAAK;GACjB;EACF;EAEA,IAAI,IAAI;CACV;;;;CAKA,kBAAuD;EACrD,QAAQ,QAAQ,KAAK,cAAc,GAAG;CACxC;;;;CAKA,MAAc,cAAc,KAAiC;EAC3D,MAAM,MAAM,IAAI,IAAI,IAAI,GAAG;EAG3B,IAAI,IAAI,WAAW,aAAa,KAAK,OAAO,YAC1C,OAAO,KAAK,mBAAmB,GAAG;EAIpC,IAAI,KAAK,OAAO;QACT,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,KAAK,OAAO,YAAY,GACnE,IAAI,IAAI,aAAa,GAAG,KAAK,OAAO,WAAW,QAAQ;IACrD,MAAM,WAAW,MAAM,QAAQ,GAAG;IAClC,OAAO,KAAK,eAAe,UAAU,GAAG;GAC1C;;EAKJ,IAAI,IAAI,SAAS,WAAW,KAAK,OAAO,YAAY,EAAE,GAAG;GACvD,MAAM,WAAW,MAAM,KAAK,kBAAkB,KAAK,GAAG;GACtD,OAAO,KAAK,eAAe,UAAU,GAAG;EAC1C;EAGA,OAAO,KAAK,oBAAoB,KAAK,WAAW;CAClD;;;;CAKA,MAAc,kBAAkB,KAAc,KAA6B;EACzE,MAAM,YAAY,IAAI,SACnB,QAAQ,KAAK,OAAO,YAAY,IAAI,EAAE,CAAC,CACvC,MAAM,GAAG,CAAC,CACV,OAAO,OAAO;EAEjB,IAAI,UAAU,WAAW,GACvB,OAAO,KAAK,oBAAoB,KAAK,sBAAsB;EAG7D,MAAM,aAAa,UAAU;EAC7B,MAAM,WAAW,UAAU;EAG3B,IAAI,KAAK,YAAY,IAAI,UAAU,GAAG;GACpC,MAAM,aAAa,KAAK,YAAY,IAAI,UAAU;GAClD,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,cAAc,WAAW,WAAW;GAErE,MAAM,aAAa,KAAK,wBAAwB,UAAU,KAAK;GAG/D,IAAI,KAAK,OAAO,gBAAgB;IAK9B,MAAM,aAAa,MAJD,KAAK,OAAO,eAC5B,YACA,IAAI,OAAO,YAAY,CAEA,CAAA,CAAU,GAAG;IACtC,IAAI,sBAAsB,UACxB,OAAO;IAGT,MAAM;GACR,OAAO,IAAI,CAAC,KAAK,cAAc,YAAY,IAAI,MAAM,GAGnD,OAAO,KAAK,oBAAoB,KAAK,yBAAyB;GAIhE,OAAO,MAAM,KAAK,qBAChB,KACA,YACA,UACA,KACA,UACF;EACF;EAGA,MAAM,oBAAoB,eAAe,cAAc;EACvD,MAAM,aAAa,KAAK,UAAU,UAAU;EAE5C,IAAI,YAAoC;EACxC,KAAK,MAAM,CAAC,MAAM,SAAS,mBAGzB,IAAI,KAAK,WAAW,KAAK,QAAQ,KAAA,CAAM,YAAY,CAAC,MAAM,YAAY;GACpE,YAAY;GACZ;EACF;EAGF,IAAI,CAAC,WACH,OAAO,KAAK,oBACV,KACA,gBAAgB,WAAW,YAC7B;EAIF,IAAI,KAAK,OAAO,gBAAgB;GAK9B,MAAM,aAAa,MAJD,KAAK,OAAO,eAC5B,UAAU,MACV,IAAI,OAAO,YAAY,CAEA,CAAA,CAAU,GAAG;GACtC,IAAI,sBAAsB,UACxB,OAAO;GAGT,MAAM;EACR,OAAO,IAAI,CAAC,KAAK,cAAc,UAAU,MAAM,IAAI,MAAM,GAEvD,OAAO,KAAK,oBAAoB,KAAK,yBAAyB;EAIhE,MAAM,aAAa,KAAK,cAAc,SAAS;EAE/C,OAAO,MAAM,KAAK,qBAChB,KACA,YACA,UACA,KACA,UAAU,IACZ;CACF;;;;CAKA,MAAc,qBACZ,KACA,YACA,UACA,KACA,YACmB;EACnB,IAAI;GACF,MAAM,SAAS,KAAK,cAAc,IAAI,QAAQ,QAAQ;GACtD,IAAI,UAAU,CAAC,KAAK,mBAAmB,YAAY,MAAM,GACvD,OAAO,KAAK,oBAAoB,KAAK,oBAAoB;GAI3D,IAAI,aAAa,WAAW,IAAI,WAAW,OACzC,OAAO,MAAM,KAAK,YAAY,YAAY,IAAI,YAAY;GAI5D,QAAQ,IAAI,QAAZ;IACE,KAAK,OACH,OAAO,WACH,MAAM,KAAK,UAAU,YAAY,QAAQ,IACzC,MAAM,KAAK,WAAW,YAAY,IAAI,YAAY;IAExD,KAAK,QACH,OAAO,MAAM,KAAK,aAAa,YAAY,KAAK,UAAU;IAE5D,KAAK;IACL,KAAK;KACH,IAAI,CAAC,UACH,OAAO,KAAK,oBACV,KACA,+BACF;KAEF,OAAO,MAAM,KAAK,aAAa,YAAY,UAAU,KAAK,UAAU;IAEtE,KAAK;KACH,IAAI,CAAC,UACH,OAAO,KAAK,oBACV,KACA,+BACF;KAEF,OAAO,MAAM,KAAK,aAAa,YAAY,QAAQ;IAErD,SACE,OAAO,KAAK,oBAAoB,KAAK,oBAAoB;GAC7D;EACF,SAAS,OAAO;GACd,QAAQ,MAAM,cAAc,KAAK;GACjC,OAAO,KAAK,oBAAoB,KAAK,uBAAuB;EAC9D;CACF;CAEA,cACE,QACA,UACwD;EACxD,QAAQ,QAAR;GACE,KAAK,OACH,OAAO,YAAY,aAAa,UAAU,QAAQ;GACpD,KAAK,QACH,OAAO;GACT,KAAK;GACL,KAAK,SACH,OAAO;GACT,KAAK,UACH,OAAO;GACT,SACE,OAAO;EACX;CACF;;;;;;;;CASA,cACE,YACA,QACS;EACT,IAAI,CAAC,YAAY,OAAO;EACxB,MAAM,YAAY,eAAe,UAAU,UAAU,CAAC,EAAE;EACxD,IAAI,CAAC,aAAa,OAAO,cAAc,UAAU,OAAO;EACxD,MAAM,eAAgB,UAA4C;EAClE,IAAI,iBAAiB,MAAM,OAAO;EAClC,IAAI,iBAAiB,QAAQ,OAAO,OAAO,YAAY,MAAM;EAC7D,OAAO;CACT;CAEA,mBACE,YACA,QACS;EACT,IAAI,CAAC,YACH,OAAO;EAIT,MAAM,YADS,eAAe,UAAU,UACtB,CAAA,CAAO;EAEzB,IAAI,cAAc,OAChB,OAAO;EAGT,IAAI,aAAa,OAAO,cAAc,UAAU;GAC9C,IAAI,UAAU,WAAW,CAAC,UAAU,QAAQ,SAAS,MAAM,GACzD,OAAO;GAGT,IAAI,UAAU,SAAS,SAAS,MAAM,GACpC,OAAO;EAEX;EAEA,OAAO;CACT;CAEA,wBACE,YACoB;EAIpB,MAAM,YACH,WACE,cAED,WAAW,aAGV;EAEL,IAAI,CAAC,WACH;EAGF,MAAM,aAAa,eAAe,sBAAsB,SAAS;EACjE,OAAO,YAAY,iBAAiB,YAAY,QAAQ,UAAU;CACpE;;;;CAKA,MAAc,UACZ,YACA,IACmB;EACnB,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;EACtC,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;EAEzD,OAAO,KAAK,mBAAmB,KAAK,aAAa,MAAM,CAAC;CAC1D;;;;CAKA,MAAc,WACZ,YACA,QACmB;EACnB,MAAM,QAAQ,OAAO,SAAS,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE;EAC7D,MAAM,SAAS,OAAO,SAAS,OAAO,IAAI,QAAQ,KAAK,KAAK,EAAE;EAC9D,MAAM,UAAU,OAAO,IAAI,SAAS,KAAK;EAIzC,MAAM,QAA2C,CAAC;EAClD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GACxC,IAAI,CAAC;GAAC;GAAS;GAAU;EAAS,CAAC,CAAC,SAAS,GAAG,GAAG;GAEjD,MAAM,QAAQ,IAAI,MAAM,gBAAgB;GACxC,IAAI,OAAO;IACT,MAAM,QAAQ,MAAM;IACpB,MAAM,WAAW,MAAM;IAYvB,MAAM,SAAS,GAAG,MAAM,GADJ;KARlB,IAAI;KACJ,KAAK;KACL,IAAI;KACJ,KAAK;KACL,IAAI;KACJ,IAAI;KACJ,MAAM;IAEY,EAAY,aAAa;IAG7C,MAAM,UAAU,aAAa,OAAO,MAAM,MAAM,GAAG,IAAI;GACzD,OACE,MAAM,OAAO;EAEjB;EAGF,MAAM,UAAU,MAAM,WAAW,KAAK;GACpC,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAA;GAC/C;GACA;GACA;EACF,CAAC;EAED,OAAO,KAAK,mBACV,QAAQ,KAAK,WAAuB,KAAK,aAAa,MAAM,CAAC,CAC/D;CACF;;;;CAKA,MAAc,YACZ,YACA,QACmB;EAEnB,MAAM,QAA2C,CAAC;EAClD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GAAG;GAE3C,MAAM,QAAQ,IAAI,MAAM,gBAAgB;GACxC,IAAI,OAAO;IACT,MAAM,QAAQ,MAAM;IACpB,MAAM,WAAW,MAAM;IAYvB,MAAM,SAAS,GAAG,MAAM,GADJ;KARlB,IAAI;KACJ,KAAK;KACL,IAAI;KACJ,KAAK;KACL,IAAI;KACJ,IAAI;KACJ,MAAM;IAEY,EAAY,aAAa;IAG7C,MAAM,UAAU,aAAa,OAAO,MAAM,MAAM,GAAG,IAAI;GACzD,OACE,MAAM,OAAO;EAEjB;EAEA,MAAM,QAAQ,MAAM,WAAW,MAAM,EACnC,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAA,EACjD,CAAC;EAED,OAAO,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC1C;;;;CAKA,MAAc,aACZ,YACA,KACA,YACmB;EACnB,MAAM,OAAO,KAAK,oBAAoB,YAAY,MAAM,IAAI,KAAK,CAAC;EAClE,MAAM,SAAS,MAAM,WAAW,OAAO;GAAE,GAAG;GAAM,WAAW;EAAK,CAAC;EACnE,MAAM,OAAO,KAAK;EAClB,OAAO,KAAK,mBAAmB,KAAK,aAAa,MAAM,GAAG,GAAG;CAC/D;;;;CAKA,MAAc,aACZ,YACA,IACA,KACA,YACmB;EACnB,MAAM,OAAO,KAAK,oBAAoB,YAAY,MAAM,IAAI,KAAK,CAAC;EAClE,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;EAEtC,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;EAIzD,OAAO,OAAO,QAAQ,IAAI;EAC1B,MAAM,OAAO,KAAK;EAElB,OAAO,KAAK,mBAAmB,KAAK,aAAa,MAAM,CAAC;CAC1D;;;;CAKA,MAAc,aACZ,YACA,IACmB;EACnB,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;EAEtC,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;EAGzD,MAAM,OAAO,OAAO;EACpB,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;CAC3C;;;;CAKA,cACE,WAC4B;EAC5B,IAAI,CAAC,KAAK,YAAY,IAAI,UAAU,IAAI,GAAG;GAIzC,MAAM,OAAO,UAAU;GAGvB,MAAM,aAAa,IAAI,KAAK;IAC1B,IAAI,KAAK,QAAQ;IACjB,IAAI,KAAK,QAAQ;GACnB,CAAC;GACD,KAAK,YAAY,IAAI,UAAU,MAAM,UAAU;EACjD;EACA,MAAM,aAAa,KAAK,YAAY,IAAI,UAAU,IAAI;EACtD,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,cAAc,UAAU,KAAK,WAAW;EACzE,OAAO;CACT;;;;;;CAOA,oBACE,YACA,MACyB;EACzB,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B,OAAO,CAAC;EAGV,MAAM,gCAAgB,IAAI,IAAI;GAC5B;GACA;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;EAED,MAAM,2BAAW,IAAI,IAAY;EACjC,IAAI,WAA4B;EAEhC,IAAI,YAAY;GACd,MAAM,YAAY,eAAe,UAAU,UAAU,CAAC,EAAE;GACxD,IACE,aACA,OAAO,cAAc,YACrB,MAAM,QAAS,UAAqC,QAAQ,GAE5D,WAAY,UAAqC;GAGnD,KAAK,MAAM,CAAC,MAAM,QAAQ,eAAe,UAAU,UAAU,GAC3D,IAAI,QAAQ,IAAI,aAAa,QAAQ,IAAI,OAAO,aAAa,OAC3D,SAAS,IAAI,IAAI;EAGvB;EAEA,MAAM,SAAkC,CAAC;EACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;GAC/C,IAAI,IAAI,WAAW,GAAG,GAAG;GACzB,IAAI,cAAc,IAAI,GAAG,GAAG;GAC5B,IAAI,SAAS,IAAI,GAAG,GAAG;GACvB,IAAI,YAAY,CAAC,SAAS,SAAS,GAAG,GAAG;GACzC,OAAO,OAAO;EAChB;EACA,OAAO;CACT;;;;;CAMA,aAAqB,QAA0B;EAC7C,MAAM,eAAe;EACrB,OAAO,OAAO,cAAc,iBAAiB,aACzC,aAAa,aAAa,IAC1B;CACN;;;;CAKA,mBAA2B,MAAe,SAAS,KAAe;EAChE,OAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;GACxC;GACA,SAAS,EACP,gBAAgB,mBAClB;EACF,CAAC;CACH;;;;CAKA,oBAA4B,QAAgB,SAA2B;EACrE,OAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC,GAAG;GACtD;GACA,SAAS,EACP,gBAAgB,mBAClB;EACF,CAAC;CACH;;;;;;CAOA,qBAA6B,KAA6B;EACxD,IAAI,CAAC,KAAK,OAAO,YAAY,OAAO;EACpC,MAAM,UAAU,KAAK,OAAO;EAC5B,IAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,OAAO;EAC7C,MAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ;EACvC,OAAO,UAAU,QAAQ,SAAS,MAAM,IAAI,SAAS;CACvD;;;;CAKA,mBAA2B,KAAwB;EACjD,MAAM,UAAkC;GACtC,gCAAgC;GAChC,gCAAgC;GAChC,0BAA0B;EAC5B;EACA,MAAM,SAAS,KAAK,qBAAqB,GAAG;EAC5C,IAAI,QAAQ;GACV,QAAQ,iCAAiC;GACzC,QAAQ,OAAO;EACjB;EACA,OAAO,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK;EAAQ,CAAC;CACpD;;;;CAKA,eAAuB,UAAoB,KAAwB;EACjE,MAAM,SAAS,KAAK,qBAAqB,GAAG;EAC5C,IAAI,CAAC,QAAQ,OAAO;EAEpB,MAAM,UAAU,IAAI,QAAQ,SAAS,OAAO;EAC5C,QAAQ,IAAI,+BAA+B,MAAM;EACjD,QAAQ,IAAI,QAAQ,QAAQ;EAC5B,QAAQ,IACN,gCACA,mCACF;EACA,QAAQ,IAAI,gCAAgC,4BAA4B;EAExE,OAAO,IAAI,SAAS,SAAS,MAAM;GACjC,QAAQ,SAAS;GACjB,YAAY,SAAS;GACrB;EACF,CAAC;CACH;;;;CAKA,UAAkB,MAAsB;EACtC,IAAI,KAAK,SAAS,GAAG,GACnB,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,EAAE;EAE9B,IAAI,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,GACjE,OAAO,GAAG,KAAK;EAEjB,OAAO,GAAG,KAAK;CACjB;AACF;;;;AAeA,SAAgB,iBACd,SACA,UAAsB,CAAC,GACvB,SAA2B,CAAC,GACU;CAEtC,QAAQ,SAAS,QAAQ;EACvB,IAAI,CAAC,eAAe,SAAS,IAAI,IAAI,GACnC,QAAQ,KAAK,UAAU,IAAI,KAAK,qCAAqC;CAEzE,CAAC;CAGD,MAAM,EAAE,QAAQ,QAAQ,IADF,aAAa,QAAQ,OACnB,CAAA,CAAU,aAAa;CAE/C,QAAQ,IAAI,sCAAsC,KAAK;CAEvD,OAAO;EAAE;EAAQ;CAAI;AACvB;;;;AAKA,SAAgB,gBACd,SACA,UAAsB,CAAC,GACvB,SAA2B,CAAC,GACE;CAC9B,OAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,EAAE,QAAQ,QAAQ,iBAAiB,SAAS,SAAS,MAAM;EAGjE,MAAM,iBAAgC;GACpC,OAAO,IAAI,SAAS,oBAAoB;IACtC,QAAQ,IAAI,uCAAuC;IAInD,OAAO,YAAY;KACjB,QAAQ,IAAI,6BAA6B;KACzC,gBAAgB;IAClB,CAAC;GACH,CAAC;EACH;EAGA,QAAQ,GAAG,WAAW,QAAQ;EAC9B,QAAQ,GAAG,UAAU,QAAQ;EAE7B,QAAQ,QAAQ;CAClB,CAAC;AACH"}
+{"version":3,"file":"rest.js","names":[],"sources":["../../src/generators/rest.ts"],"sourcesContent":["/**\n * High-performance REST API generator for smrt objects using Node.js HTTP server\n *\n * Designed for minimal bundle size and maximum performance\n */\n\nimport http from 'node:http';\nimport type { SmrtCollection } from '../collection';\nimport type { SmrtObject } from '../object';\nimport { ObjectRegistry } from '../registry';\nimport type { RegisteredClass, SmrtObjectConstructor } from '../registry/types';\nimport {\n  conditionalJsonResponse,\n  resolveReadCacheControl,\n  warnIfSharedCacheNeutralized,\n} from './conditional-get';\nimport {\n  processSyncApplyBatch,\n  SYNC_APPLY_ROUTE_SEGMENTS,\n  type SyncApplyOp,\n  type SyncApplyTarget,\n} from '../sync/apply';\n\nexport interface APIConfig {\n  basePath?: string;\n  enableCors?: boolean;\n  /**\n   * Explicit CORS origin allowlist (#1540). Required when `enableCors` is true —\n   * the generator never emits `Access-Control-Allow-Origin: *`. A request's\n   * `Origin` is echoed only when it appears here.\n   */\n  allowedOrigins?: string[];\n  customRoutes?: Record<string, (req: Request) => Promise<Response>>;\n  authMiddleware?: (\n    objectName: string,\n    action: string,\n  ) => (req: Request) => Promise<Request | Response>;\n  port?: number;\n  hostname?: string;\n}\n\nexport interface APIContext {\n  db?: unknown;\n  ai?: unknown;\n  user?: {\n    id: string;\n    username?: string;\n    roles?: string[];\n  };\n}\n\n/**\n * High-performance API generator using native Bun\n */\nexport class APIGenerator {\n  private config: APIConfig;\n  private collections = new Map<string, SmrtCollection<SmrtObject>>();\n  private context: APIContext;\n\n  constructor(config: APIConfig = {}, context: APIContext = {}) {\n    this.config = {\n      basePath: '/api/v1',\n      // Security defaults (#1540): bind to loopback and keep CORS off unless an\n      // explicit origin allowlist is supplied. No `Access-Control-Allow-Origin: *`.\n      enableCors: false,\n      port: 3000,\n      hostname: '127.0.0.1',\n      ...config,\n    };\n    this.context = context;\n  }\n\n  /**\n   * Register a pre-configured collection instance for API exposure\n   *\n   * @param name - URL path segment for the collection (e.g., 'products' for /api/products)\n   * @param collection - Pre-initialized SmrtCollection instance\n   */\n  registerCollection(\n    name: string,\n    collection: SmrtCollection<SmrtObject>,\n  ): void {\n    this.collections.set(name, collection);\n  }\n\n  /**\n   * Create Node.js HTTP server with all routes\n   */\n  createServer(): { server: http.Server; url: string } {\n    const server = http.createServer(async (req, res) => {\n      try {\n        const request = await this.nodeRequestToWebRequest(req);\n        const response = await this.handleRequest(request);\n        await this.webResponseToNodeResponse(response, res);\n      } catch (_error) {\n        res.statusCode = 500;\n        res.end('Internal Server Error');\n      }\n    });\n\n    server.listen(this.config.port, this.config.hostname);\n\n    return {\n      server,\n      url: `http://${this.config.hostname}:${this.config.port}`,\n    };\n  }\n\n  /**\n   * Convert stream to string\n   */\n  private async streamToString(stream: http.IncomingMessage): Promise<string> {\n    const chunks: Buffer[] = [];\n    for await (const chunk of stream) {\n      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n    }\n    return Buffer.concat(chunks).toString('utf-8');\n  }\n\n  /**\n   * Convert Node.js IncomingMessage to Web Request\n   */\n  private async nodeRequestToWebRequest(\n    req: http.IncomingMessage,\n  ): Promise<Request> {\n    const url = `http://${this.config.hostname}:${this.config.port}${req.url}`;\n    const method = req.method || 'GET';\n    const headers = new Headers();\n\n    for (const [key, value] of Object.entries(req.headers)) {\n      if (value) {\n        headers.set(key, Array.isArray(value) ? value[0] : value);\n      }\n    }\n\n    let body: string | undefined;\n    if (method !== 'GET' && method !== 'HEAD') {\n      body = await this.streamToString(req);\n    }\n\n    return new Request(url, {\n      method,\n      headers,\n      body,\n    });\n  }\n\n  /**\n   * Convert Web Response to Node.js ServerResponse\n   */\n  private async webResponseToNodeResponse(\n    webResponse: Response,\n    res: http.ServerResponse,\n  ): Promise<void> {\n    res.statusCode = webResponse.status;\n\n    // Set headers\n    webResponse.headers.forEach((value, key) => {\n      res.setHeader(key, value);\n    });\n\n    // Send body\n    if (webResponse.body) {\n      const reader = webResponse.body.getReader();\n      while (true) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        res.write(value);\n      }\n    }\n\n    res.end();\n  }\n\n  /**\n   * Generate fetch handler function (for serverless environments)\n   */\n  generateHandler(): (req: Request) => Promise<Response> {\n    return (req) => this.handleRequest(req);\n  }\n\n  /**\n   * Main request handler using native Bun APIs\n   */\n  private async handleRequest(req: Request): Promise<Response> {\n    const url = new URL(req.url);\n\n    // Handle CORS preflight\n    if (req.method === 'OPTIONS' && this.config.enableCors) {\n      return this.createCorsResponse(req);\n    }\n\n    // Handle custom routes first\n    if (this.config.customRoutes) {\n      for (const [path, handler] of Object.entries(this.config.customRoutes)) {\n        if (url.pathname === `${this.config.basePath}${path}`) {\n          const response = await handler(req);\n          return this.addCorsHeaders(response, req);\n        }\n      }\n    }\n\n    // Handle object routes\n    if (url.pathname.startsWith(this.config.basePath || '')) {\n      const response = await this.handleObjectRoute(req, url);\n      return this.addCorsHeaders(response, req);\n    }\n\n    // Not found\n    return this.createErrorResponse(404, 'Not found');\n  }\n\n  /**\n   * Handle CRUD routes for SMRT objects\n   */\n  private async handleObjectRoute(req: Request, url: URL): Promise<Response> {\n    const pathParts = url.pathname\n      .replace(this.config.basePath || '', '')\n      .split('/')\n      .filter(Boolean);\n\n    if (pathParts.length === 0) {\n      return this.createErrorResponse(400, 'Object type required');\n    }\n\n    // Reserved batch write contract route (#1759): POST {basePath}/sync/apply.\n    if (\n      pathParts.length === SYNC_APPLY_ROUTE_SEGMENTS.length &&\n      SYNC_APPLY_ROUTE_SEGMENTS.every((segment, i) => pathParts[i] === segment)\n    ) {\n      if (req.method !== 'POST') {\n        return this.createErrorResponse(405, 'Method not allowed');\n      }\n      return await this.handleSyncApply(req);\n    }\n\n    const objectType = pathParts[0];\n    const objectId = pathParts[1];\n\n    // Check for explicitly registered collection first\n    if (this.collections.has(objectType)) {\n      const collection = this.collections.get(objectType);\n      if (!collection) throw new Error(`Collection ${objectType} not found`);\n\n      const objectName = this.getCollectionObjectName(collection) || objectType;\n\n      // Apply auth middleware if configured\n      if (this.config.authMiddleware) {\n        const authCheck = this.config.authMiddleware(\n          objectName,\n          req.method.toLowerCase(),\n        );\n        const authResult = await authCheck(req);\n        if (authResult instanceof Response) {\n          return authResult; // Auth failed\n        }\n        // Auth passed, use the potentially modified request\n        req = authResult;\n      } else if (!this.isRoutePublic(objectName, req.method)) {\n        // Fail-closed (#1540): no auth middleware wired and the object isn't\n        // marked `@smrt({ api: { public } })` → refuse rather than serve open.\n        return this.createErrorResponse(401, 'Authentication required');\n      }\n\n      // Use registered collection directly\n      return await this.executeCrudOperation(\n        req,\n        collection,\n        objectId,\n        url,\n        objectName,\n      );\n    }\n\n    // Fall back to auto-discovery via ObjectRegistry\n    const registeredClasses = ObjectRegistry.getAllClasses();\n    const pluralName = this.pluralize(objectType);\n\n    let classInfo: RegisteredClass | null = null;\n    for (const [_key, info] of registeredClasses) {\n      // Issue #951: Use simple name (info.name) for URL matching, not the map key\n      // which may be a qualified name like '@happyvertical/smrt-events:Event'\n      if (this.pluralize((info.name || _key).toLowerCase()) === pluralName) {\n        classInfo = info;\n        break;\n      }\n    }\n\n    if (!classInfo) {\n      return this.createErrorResponse(\n        404,\n        `Object type '${objectType}' not found`,\n      );\n    }\n\n    // Apply auth middleware if configured\n    if (this.config.authMiddleware) {\n      const authCheck = this.config.authMiddleware(\n        classInfo.name,\n        req.method.toLowerCase(),\n      );\n      const authResult = await authCheck(req);\n      if (authResult instanceof Response) {\n        return authResult; // Auth failed\n      }\n      // Auth passed, use the potentially modified request\n      req = authResult;\n    } else if (!this.isRoutePublic(classInfo.name, req.method)) {\n      // Fail-closed (#1540): see registered-collection branch above.\n      return this.createErrorResponse(401, 'Authentication required');\n    }\n\n    // Get or create collection\n    const collection = this.getCollection(classInfo);\n\n    return await this.executeCrudOperation(\n      req,\n      collection,\n      objectId,\n      url,\n      classInfo.name,\n    );\n  }\n\n  /**\n   * Execute CRUD operation on a collection\n   */\n  private async executeCrudOperation(\n    req: Request,\n    collection: SmrtCollection<SmrtObject>,\n    objectId: string | undefined,\n    url: URL,\n    objectName?: string,\n  ): Promise<Response> {\n    try {\n      const action = this.getCrudAction(req.method, objectId);\n      if (action && !this.isApiActionEnabled(objectName, action)) {\n        return this.createErrorResponse(405, 'Method not allowed');\n      }\n\n      // Handle special /count endpoint\n      if (objectId === 'count' && req.method === 'GET') {\n        return await this.handleCount(collection, url.searchParams);\n      }\n\n      // Route to appropriate CRUD operation\n      switch (req.method) {\n        case 'GET':\n          return objectId\n            ? await this.handleGet(collection, objectId, req, objectName)\n            : await this.handleList(\n                collection,\n                url.searchParams,\n                req,\n                objectName,\n              );\n\n        case 'POST':\n          return await this.handleCreate(collection, req, objectName);\n\n        case 'PUT':\n        case 'PATCH':\n          if (!objectId) {\n            return this.createErrorResponse(\n              400,\n              'Object ID required for update',\n            );\n          }\n          return await this.handleUpdate(collection, objectId, req, objectName);\n\n        case 'DELETE':\n          if (!objectId) {\n            return this.createErrorResponse(\n              400,\n              'Object ID required for delete',\n            );\n          }\n          return await this.handleDelete(collection, objectId);\n\n        default:\n          return this.createErrorResponse(405, 'Method not allowed');\n      }\n    } catch (error) {\n      console.error('API Error:', error);\n      return this.createErrorResponse(500, 'Internal server error');\n    }\n  }\n\n  private getCrudAction(\n    method: string,\n    objectId: string | undefined,\n  ): 'list' | 'get' | 'create' | 'update' | 'delete' | null {\n    switch (method) {\n      case 'GET':\n        return objectId && objectId !== 'count' ? 'get' : 'list';\n      case 'POST':\n        return 'create';\n      case 'PUT':\n      case 'PATCH':\n        return 'update';\n      case 'DELETE':\n        return 'delete';\n      default:\n        return null;\n    }\n  }\n\n  /**\n   * Fail-closed authorization posture (#1540). Returns true only when the\n   * object opts out of auth via `@smrt({ api: { public } })`:\n   * - `public: true` → all methods are public.\n   * - `public: 'read'` → only safe (GET) methods are public.\n   * Everything else requires an `authMiddleware` to be configured.\n   */\n  private isRoutePublic(\n    objectName: string | undefined,\n    method: string,\n  ): boolean {\n    if (!objectName) return false;\n    const apiConfig = ObjectRegistry.getConfig(objectName)?.api;\n    if (!apiConfig || typeof apiConfig !== 'object') return false;\n    const publicAccess = (apiConfig as { public?: boolean | 'read' }).public;\n    if (publicAccess === true) return true;\n    if (publicAccess === 'read') return method.toUpperCase() === 'GET';\n    return false;\n  }\n\n  private isApiActionEnabled(\n    objectName: string | undefined,\n    action: 'list' | 'get' | 'create' | 'update' | 'delete',\n  ): boolean {\n    if (!objectName) {\n      return true;\n    }\n\n    const config = ObjectRegistry.getConfig(objectName);\n    const apiConfig = config.api;\n\n    if (apiConfig === false) {\n      return false;\n    }\n\n    if (apiConfig && typeof apiConfig === 'object') {\n      if (apiConfig.include && !apiConfig.include.includes(action)) {\n        return false;\n      }\n\n      if (apiConfig.exclude?.includes(action)) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  private getCollectionObjectName(\n    collection: SmrtCollection<SmrtObject>,\n  ): string | undefined {\n    // `_itemClass` lives on the instance (protected getter) or the collection\n    // constructor (static). Read it through a structural shape rather than the\n    // class's private surface; behavior is unchanged.\n    const itemClass: SmrtObjectConstructor | undefined =\n      (collection as unknown as { _itemClass?: SmrtObjectConstructor })\n        ._itemClass ||\n      (\n        collection.constructor as unknown as {\n          _itemClass?: SmrtObjectConstructor;\n        }\n      )?._itemClass;\n\n    if (!itemClass) {\n      return undefined;\n    }\n\n    const registered = ObjectRegistry.getClassByConstructor(itemClass);\n    return registered?.qualifiedName || registered?.name || itemClass.name;\n  }\n\n  /**\n   * Handle GET /objects/:id\n   */\n  private async handleGet(\n    collection: SmrtCollection<SmrtObject>,\n    id: string,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const object = await collection.get(id);\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n    return this.createReadResponse(req, objectName, this.toPublicData(object));\n  }\n\n  /**\n   * Handle GET /objects (list with query params)\n   */\n  private async handleList(\n    collection: SmrtCollection<SmrtObject>,\n    params: URLSearchParams,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const limit = Number.parseInt(params.get('limit') || '50', 10);\n    const offset = Number.parseInt(params.get('offset') || '0', 10);\n    const orderBy = params.get('orderBy') || 'created_at DESC';\n\n    // Build where clause from query params\n    // Convert REST-style operators (price[gt]) to SQL-style (price >)\n    const where: Record<string, string | string[]> = {};\n    for (const [key, value] of params.entries()) {\n      if (!['limit', 'offset', 'orderBy'].includes(key)) {\n        // Parse REST operator format: field[operator]\n        const match = key.match(/^(.+)\\[(.+)\\]$/);\n        if (match) {\n          const field = match[1];\n          const operator = match[2];\n          // Map REST operators to SQL operators\n          const operatorMap: Record<string, string> = {\n            gt: '>',\n            gte: '>=',\n            lt: '<',\n            lte: '<=',\n            ne: '!=',\n            in: 'in',\n            like: 'like',\n          };\n          const sqlOperator = operatorMap[operator] || operator;\n          const sqlKey = `${field} ${sqlOperator}`;\n          // Handle 'in' operator - convert comma-separated string to array\n          where[sqlKey] = operator === 'in' ? value.split(',') : value;\n        } else {\n          where[key] = value;\n        }\n      }\n    }\n\n    const objects = await collection.list({\n      where: Object.keys(where).length > 0 ? where : undefined,\n      limit,\n      offset,\n      orderBy,\n    });\n\n    return this.createReadResponse(\n      req,\n      objectName,\n      objects.map((object: SmrtObject) => this.toPublicData(object)),\n    );\n  }\n\n  /**\n   * Handle GET /objects/count\n   */\n  private async handleCount(\n    collection: SmrtCollection<SmrtObject>,\n    params: URLSearchParams,\n  ): Promise<Response> {\n    // Build where clause from query params (same logic as handleList)\n    const where: Record<string, string | string[]> = {};\n    for (const [key, value] of params.entries()) {\n      // Parse REST operator format: field[operator]\n      const match = key.match(/^(.+)\\[(.+)\\]$/);\n      if (match) {\n        const field = match[1];\n        const operator = match[2];\n        // Map REST operators to SQL operators\n        const operatorMap: Record<string, string> = {\n          gt: '>',\n          gte: '>=',\n          lt: '<',\n          lte: '<=',\n          ne: '!=',\n          in: 'in',\n          like: 'like',\n        };\n        const sqlOperator = operatorMap[operator] || operator;\n        const sqlKey = `${field} ${sqlOperator}`;\n        // Handle 'in' operator - convert comma-separated string to array\n        where[sqlKey] = operator === 'in' ? value.split(',') : value;\n      } else {\n        where[key] = value;\n      }\n    }\n\n    const count = await collection.count({\n      where: Object.keys(where).length > 0 ? where : undefined,\n    });\n\n    return this.createJsonResponse({ count });\n  }\n\n  /**\n   * Handle POST /objects\n   */\n  private async handleCreate(\n    collection: SmrtCollection<SmrtObject>,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const data = this.applyWritablePolicy(objectName, await req.json());\n    const object = await collection.create({ ...data, _skipLoad: true });\n    await object.save();\n    return this.createJsonResponse(this.toPublicData(object), 201);\n  }\n\n  /**\n   * Handle PUT/PATCH /objects/:id\n   */\n  private async handleUpdate(\n    collection: SmrtCollection<SmrtObject>,\n    id: string,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const data = this.applyWritablePolicy(objectName, await req.json());\n    const object = await collection.get(id);\n\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n\n    // Update object properties\n    Object.assign(object, data);\n    await object.save();\n\n    return this.createJsonResponse(this.toPublicData(object));\n  }\n\n  /**\n   * Handle DELETE /objects/:id\n   */\n  private async handleDelete(\n    collection: SmrtCollection<SmrtObject>,\n    id: string,\n  ): Promise<Response> {\n    const object = await collection.get(id);\n\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n\n    await object.delete();\n    return new Response(null, { status: 204 });\n  }\n\n  /**\n   * Handle POST /sync/apply — the idempotent batch write contract (#1759).\n   * All processing lives in `sync/apply.ts`; this method only adapts the\n   * generator's existing collection resolution, auth, action gating, and\n   * writable policy into a {@link SyncApplyTarget} per item.\n   */\n  private async handleSyncApply(req: Request): Promise<Response> {\n    // Buffer the body once. Request bodies are single-read streams, and the\n    // per-item auth middleware below must receive a readable body exactly as\n    // it does on CRUD routes (where auth runs before parsing) — so each\n    // middleware invocation gets a fresh Request rebuilt from this buffer.\n    let rawBody: string;\n    let body: unknown;\n    try {\n      rawBody = await req.text();\n      body = JSON.parse(rawBody);\n    } catch {\n      return this.createErrorResponse(400, 'Invalid JSON body');\n    }\n\n    const outcome = await processSyncApplyBatch(body, {\n      resolveTarget: (objectSegment) =>\n        this.resolveSyncApplyTarget(objectSegment, req, rawBody),\n    });\n    return this.createJsonResponse(outcome.body, outcome.status);\n  }\n\n  /**\n   * Resolve a sync item's `object` segment exactly like `handleObjectRoute`\n   * resolves a CRUD URL segment (registered collections first, then registry\n   * auto-discovery), and wrap the generator's per-object machinery.\n   */\n  private resolveSyncApplyTarget(\n    objectSegment: string,\n    req: Request,\n    rawBody: string,\n  ): SyncApplyTarget | null {\n    let collection: SmrtCollection<SmrtObject> | null = null;\n    let objectName: string | null = null;\n\n    const registered = this.collections.get(objectSegment);\n    if (registered) {\n      collection = registered;\n      objectName = this.getCollectionObjectName(registered) || objectSegment;\n    } else {\n      const pluralName = this.pluralize(objectSegment);\n      for (const [key, info] of ObjectRegistry.getAllClasses()) {\n        if (this.pluralize((info.name || key).toLowerCase()) === pluralName) {\n          collection = this.getCollection(info);\n          objectName = info.name;\n          break;\n        }\n      }\n    }\n\n    if (!collection || !objectName) {\n      return null;\n    }\n\n    const resolvedName = objectName;\n    const resolvedCollection = collection;\n    return {\n      objectName: resolvedName,\n      collection: resolvedCollection,\n      isOpAllowed: (op: SyncApplyOp) =>\n        this.isApiActionEnabled(resolvedName, op),\n      authorize: async (op: SyncApplyOp) => {\n        if (this.config.authMiddleware) {\n          const verb =\n            op === 'create' ? 'post' : op === 'update' ? 'put' : 'delete';\n          const authCheck = this.config.authMiddleware(resolvedName, verb);\n          // Fresh Request per invocation: the batch handler already consumed\n          // the original body, and middleware may read it (body-based auth,\n          // request signing) exactly as it can on CRUD routes.\n          const authResult = await authCheck(\n            new Request(req.url, {\n              method: req.method,\n              headers: req.headers,\n              body: rawBody,\n            }),\n          );\n          if (authResult instanceof Response) {\n            return authResult.status === 401 ? 'auth_required' : 'forbidden';\n          }\n          return 'ok';\n        }\n        // Fail-closed (#1540): every sync op is mutating, so only\n        // `@smrt({ api: { public: true } })` objects apply without auth.\n        return this.isRoutePublic(resolvedName, 'POST')\n          ? 'ok'\n          : 'auth_required';\n      },\n      prepare: (payload) => this.applyWritablePolicy(resolvedName, payload),\n    };\n  }\n\n  /**\n   * Get or create collection instance\n   */\n  private getCollection(\n    classInfo: RegisteredClass,\n  ): SmrtCollection<SmrtObject> {\n    if (!this.collections.has(classInfo.name)) {\n      // `collectionConstructor` is typed optional on RegisteredClass, but the\n      // auto-discovery path only reaches here for classes that declare one.\n      // Narrow to the non-optional constructor type before instantiating.\n      const ctor = classInfo.collectionConstructor as NonNullable<\n        RegisteredClass['collectionConstructor']\n      >;\n      const collection = new ctor({\n        ai: this.context.ai,\n        db: this.context.db,\n      });\n      this.collections.set(classInfo.name, collection);\n    }\n    const collection = this.collections.get(classInfo.name);\n    if (!collection) throw new Error(`Collection ${classInfo.name} not found`);\n    return collection;\n  }\n\n  /**\n   * Mass-assignment guard (#1540): strip framework/server-managed and\n   * `@field({ readonly: true })` fields from a create/update body, and — when an\n   * `@smrt({ api: { writable: [...] } })` allowlist is set — intersect with it.\n   */\n  private applyWritablePolicy(\n    objectName: string | undefined,\n    data: unknown,\n  ): Record<string, unknown> {\n    if (!data || typeof data !== 'object') {\n      return {};\n    }\n\n    const serverManaged = new Set([\n      'id',\n      'tenantId',\n      'tenant_id',\n      'createdAt',\n      'created_at',\n      'updatedAt',\n      'updated_at',\n    ]);\n\n    const readonly = new Set<string>();\n    let writable: string[] | null = null;\n\n    if (objectName) {\n      const apiConfig = ObjectRegistry.getConfig(objectName)?.api;\n      if (\n        apiConfig &&\n        typeof apiConfig === 'object' &&\n        Array.isArray((apiConfig as { writable?: unknown }).writable)\n      ) {\n        writable = (apiConfig as { writable: string[] }).writable;\n      }\n\n      for (const [name, def] of ObjectRegistry.getFields(objectName)) {\n        if (def && (def.readonly === true || def._meta?.readonly === true)) {\n          readonly.add(name);\n        }\n      }\n    }\n\n    const result: Record<string, unknown> = {};\n    for (const [key, value] of Object.entries(data)) {\n      if (key.startsWith('_')) continue;\n      if (serverManaged.has(key)) continue;\n      if (readonly.has(key)) continue;\n      if (writable && !writable.includes(key)) continue;\n      result[key] = value;\n    }\n    return result;\n  }\n\n  /**\n   * Serialize a SmrtObject for a network response, excluding sensitive fields\n   * (#1540). Falls back to the value unchanged for non-SmrtObject payloads.\n   */\n  private toPublicData(object: unknown): unknown {\n    const serializable = object as { toPublicJSON?: () => unknown } | null;\n    return typeof serializable?.toPublicJSON === 'function'\n      ? serializable.toPublicJSON()\n      : object;\n  }\n\n  /**\n   * Create a JSON read response with conditional-GET support (#1757): a strong\n   * body-hash ETag, `If-None-Match` → 304 with an empty body, and the\n   * Cache-Control policy resolved from the object's `@smrt({ api })` config\n   * (private + revalidatable by default; shared `s-maxage` only for public\n   * models that opt in). Tenant-scoped models are always private: their bodies\n   * vary with tenant context, which URL-keyed shared caches cannot see.\n   */\n  private createReadResponse(\n    req: Request,\n    objectName: string | undefined,\n    payload: unknown,\n  ): Response {\n    const config = objectName\n      ? ObjectRegistry.getConfig(objectName)\n      : undefined;\n    const apiConfig = config?.api;\n    // Canonical accessor covers both `@smrt({ tenantScoped })` and the\n    // manifest-merged `@TenantScoped()` decorator form; the raw config flag is\n    // a belt-and-braces fallback for registrations not yet normalized.\n    const tenantScoped = objectName\n      ? ObjectRegistry.isTenantScoped(objectName) || !!config?.tenantScoped\n      : false;\n    if (objectName) {\n      warnIfSharedCacheNeutralized(objectName, apiConfig, tenantScoped);\n    }\n    return conditionalJsonResponse(\n      req,\n      payload,\n      resolveReadCacheControl(apiConfig, { tenantScoped }),\n    );\n  }\n\n  /**\n   * Create JSON response with proper headers\n   */\n  private createJsonResponse(data: unknown, status = 200): Response {\n    return new Response(JSON.stringify(data), {\n      status,\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  }\n\n  /**\n   * Create error response\n   */\n  private createErrorResponse(status: number, message: string): Response {\n    return new Response(JSON.stringify({ error: message }), {\n      status,\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  }\n\n  /**\n   * Resolve the allowed `Access-Control-Allow-Origin` for a request (#1540).\n   * Returns the request's `Origin` only when it is in the configured allowlist;\n   * never `*`. Returns null when CORS should not be applied.\n   */\n  private resolveAllowedOrigin(req: Request): string | null {\n    if (!this.config.enableCors) return null;\n    const allowed = this.config.allowedOrigins;\n    if (!allowed || allowed.length === 0) return null;\n    const origin = req.headers.get('origin');\n    return origin && allowed.includes(origin) ? origin : null;\n  }\n\n  /**\n   * Create CORS preflight response\n   */\n  private createCorsResponse(req: Request): Response {\n    const headers: Record<string, string> = {\n      'Access-Control-Allow-Methods': 'GET,POST,PUT,PATCH,DELETE,OPTIONS',\n      'Access-Control-Allow-Headers': 'Content-Type,Authorization',\n      'Access-Control-Max-Age': '86400',\n    };\n    const origin = this.resolveAllowedOrigin(req);\n    if (origin) {\n      headers['Access-Control-Allow-Origin'] = origin;\n      headers.Vary = 'Origin';\n    }\n    return new Response(null, { status: 200, headers });\n  }\n\n  /**\n   * Add CORS headers to response\n   */\n  private addCorsHeaders(response: Response, req: Request): Response {\n    const origin = this.resolveAllowedOrigin(req);\n    if (!origin) return response;\n\n    const headers = new Headers(response.headers);\n    headers.set('Access-Control-Allow-Origin', origin);\n    headers.set('Vary', 'Origin');\n    headers.set(\n      'Access-Control-Allow-Methods',\n      'GET,POST,PUT,PATCH,DELETE,OPTIONS',\n    );\n    headers.set('Access-Control-Allow-Headers', 'Content-Type,Authorization');\n\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n\n  /**\n   * Simple pluralization (basic implementation)\n   */\n  private pluralize(word: string): string {\n    if (word.endsWith('y')) {\n      return `${word.slice(0, -1)}ies`;\n    }\n    if (word.endsWith('s') || word.endsWith('sh') || word.endsWith('ch')) {\n      return `${word}es`;\n    }\n    return `${word}s`;\n  }\n}\n\n// REST Server Utilities\n\nexport interface RestServerConfig extends APIConfig {\n  healthCheck?: {\n    enabled?: boolean;\n    path?: string;\n    customChecks?: (() => Promise<boolean>)[];\n  };\n}\n\n/**\n * Create REST server with health checks using Bun\n */\nexport function createRestServer(\n  objects: (typeof SmrtObject)[],\n  context: APIContext = {},\n  config: RestServerConfig = {},\n): { server: http.Server; url: string } {\n  // Register objects if not already registered\n  objects.forEach((obj) => {\n    if (!ObjectRegistry.hasClass(obj.name)) {\n      console.warn(`Object ${obj.name} not registered with @smrt decorator`);\n    }\n  });\n\n  const generator = new APIGenerator(config, context);\n  const { server, url } = generator.createServer();\n\n  console.log(`🚀 smrt REST API server running at ${url}`);\n\n  return { server, url };\n}\n\n/**\n * Start server with graceful shutdown\n */\nexport function startRestServer(\n  objects: (typeof SmrtObject)[],\n  context: APIContext = {},\n  config: RestServerConfig = {},\n): Promise<() => Promise<void>> {\n  return new Promise((resolve) => {\n    const { server, url } = createRestServer(objects, context, config);\n\n    // Graceful shutdown function\n    const shutdown = (): Promise<void> => {\n      return new Promise((shutdownResolve) => {\n        console.log('🛑 Shutting down server gracefully...');\n        // Node's http.Server#close stops accepting new connections and invokes\n        // the callback once in-flight ones drain. (The prior `.stop()` was a\n        // Bun-era API absent on http.Server — it would have thrown.)\n        server.close(() => {\n          console.log('✅ Server shut down complete');\n          shutdownResolve();\n        });\n      });\n    };\n\n    // Handle shutdown signals\n    process.on('SIGTERM', shutdown);\n    process.on('SIGINT', shutdown);\n\n    resolve(shutdown);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;AAsDA,IAAa,eAAb,MAA0B;CACxB;CACA,8BAAsB,IAAI,IAAwC;CAClE;CAEA,YAAY,SAAoB,CAAC,GAAG,UAAsB,CAAC,GAAG;EAC5D,KAAK,SAAS;GACZ,UAAU;GAGV,YAAY;GACZ,MAAM;GACN,UAAU;GACV,GAAG;EACL;EACA,KAAK,UAAU;CACjB;;;;;;;CAQA,mBACE,MACA,YACM;EACN,KAAK,YAAY,IAAI,MAAM,UAAU;CACvC;;;;CAKA,eAAqD;EACnD,MAAM,SAAS,KAAK,aAAa,OAAO,KAAK,QAAQ;GACnD,IAAI;IACF,MAAM,UAAU,MAAM,KAAK,wBAAwB,GAAG;IACtD,MAAM,WAAW,MAAM,KAAK,cAAc,OAAO;IACjD,MAAM,KAAK,0BAA0B,UAAU,GAAG;GACpD,SAAS,QAAQ;IACf,IAAI,aAAa;IACjB,IAAI,IAAI,uBAAuB;GACjC;EACF,CAAC;EAED,OAAO,OAAO,KAAK,OAAO,MAAM,KAAK,OAAO,QAAQ;EAEpD,OAAO;GACL;GACA,KAAK,UAAU,KAAK,OAAO,SAAS,GAAG,KAAK,OAAO;EACrD;CACF;;;;CAKA,MAAc,eAAe,QAA+C;EAC1E,MAAM,SAAmB,CAAC;EAC1B,WAAW,MAAM,SAAS,QACxB,OAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;EAEjE,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,OAAO;CAC/C;;;;CAKA,MAAc,wBACZ,KACkB;EAClB,MAAM,MAAM,UAAU,KAAK,OAAO,SAAS,GAAG,KAAK,OAAO,OAAO,IAAI;EACrE,MAAM,SAAS,IAAI,UAAU;EAC7B,MAAM,UAAU,IAAI,QAAQ;EAE5B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,OAAO,GACnD,IAAI,OACF,QAAQ,IAAI,KAAK,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,KAAK;EAI5D,IAAI;EACJ,IAAI,WAAW,SAAS,WAAW,QACjC,OAAO,MAAM,KAAK,eAAe,GAAG;EAGtC,OAAO,IAAI,QAAQ,KAAK;GACtB;GACA;GACA;EACF,CAAC;CACH;;;;CAKA,MAAc,0BACZ,aACA,KACe;EACf,IAAI,aAAa,YAAY;EAG7B,YAAY,QAAQ,SAAS,OAAO,QAAQ;GAC1C,IAAI,UAAU,KAAK,KAAK;EAC1B,CAAC;EAGD,IAAI,YAAY,MAAM;GACpB,MAAM,SAAS,YAAY,KAAK,UAAU;GAC1C,OAAO,MAAM;IACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;IAC1C,IAAI,MAAM;IACV,IAAI,MAAM,KAAK;GACjB;EACF;EAEA,IAAI,IAAI;CACV;;;;CAKA,kBAAuD;EACrD,QAAQ,QAAQ,KAAK,cAAc,GAAG;CACxC;;;;CAKA,MAAc,cAAc,KAAiC;EAC3D,MAAM,MAAM,IAAI,IAAI,IAAI,GAAG;EAG3B,IAAI,IAAI,WAAW,aAAa,KAAK,OAAO,YAC1C,OAAO,KAAK,mBAAmB,GAAG;EAIpC,IAAI,KAAK,OAAO;QACT,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,KAAK,OAAO,YAAY,GACnE,IAAI,IAAI,aAAa,GAAG,KAAK,OAAO,WAAW,QAAQ;IACrD,MAAM,WAAW,MAAM,QAAQ,GAAG;IAClC,OAAO,KAAK,eAAe,UAAU,GAAG;GAC1C;;EAKJ,IAAI,IAAI,SAAS,WAAW,KAAK,OAAO,YAAY,EAAE,GAAG;GACvD,MAAM,WAAW,MAAM,KAAK,kBAAkB,KAAK,GAAG;GACtD,OAAO,KAAK,eAAe,UAAU,GAAG;EAC1C;EAGA,OAAO,KAAK,oBAAoB,KAAK,WAAW;CAClD;;;;CAKA,MAAc,kBAAkB,KAAc,KAA6B;EACzE,MAAM,YAAY,IAAI,SACnB,QAAQ,KAAK,OAAO,YAAY,IAAI,EAAE,CAAC,CACvC,MAAM,GAAG,CAAC,CACV,OAAO,OAAO;EAEjB,IAAI,UAAU,WAAW,GACvB,OAAO,KAAK,oBAAoB,KAAK,sBAAsB;EAI7D,IACE,UAAU,WAAW,0BAA0B,UAC/C,0BAA0B,OAAO,SAAS,MAAM,UAAU,OAAO,OAAO,GACxE;GACA,IAAI,IAAI,WAAW,QACjB,OAAO,KAAK,oBAAoB,KAAK,oBAAoB;GAE3D,OAAO,MAAM,KAAK,gBAAgB,GAAG;EACvC;EAEA,MAAM,aAAa,UAAU;EAC7B,MAAM,WAAW,UAAU;EAG3B,IAAI,KAAK,YAAY,IAAI,UAAU,GAAG;GACpC,MAAM,aAAa,KAAK,YAAY,IAAI,UAAU;GAClD,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,cAAc,WAAW,WAAW;GAErE,MAAM,aAAa,KAAK,wBAAwB,UAAU,KAAK;GAG/D,IAAI,KAAK,OAAO,gBAAgB;IAK9B,MAAM,aAAa,MAJD,KAAK,OAAO,eAC5B,YACA,IAAI,OAAO,YAAY,CAEA,CAAA,CAAU,GAAG;IACtC,IAAI,sBAAsB,UACxB,OAAO;IAGT,MAAM;GACR,OAAO,IAAI,CAAC,KAAK,cAAc,YAAY,IAAI,MAAM,GAGnD,OAAO,KAAK,oBAAoB,KAAK,yBAAyB;GAIhE,OAAO,MAAM,KAAK,qBAChB,KACA,YACA,UACA,KACA,UACF;EACF;EAGA,MAAM,oBAAoB,eAAe,cAAc;EACvD,MAAM,aAAa,KAAK,UAAU,UAAU;EAE5C,IAAI,YAAoC;EACxC,KAAK,MAAM,CAAC,MAAM,SAAS,mBAGzB,IAAI,KAAK,WAAW,KAAK,QAAQ,KAAA,CAAM,YAAY,CAAC,MAAM,YAAY;GACpE,YAAY;GACZ;EACF;EAGF,IAAI,CAAC,WACH,OAAO,KAAK,oBACV,KACA,gBAAgB,WAAW,YAC7B;EAIF,IAAI,KAAK,OAAO,gBAAgB;GAK9B,MAAM,aAAa,MAJD,KAAK,OAAO,eAC5B,UAAU,MACV,IAAI,OAAO,YAAY,CAEA,CAAA,CAAU,GAAG;GACtC,IAAI,sBAAsB,UACxB,OAAO;GAGT,MAAM;EACR,OAAO,IAAI,CAAC,KAAK,cAAc,UAAU,MAAM,IAAI,MAAM,GAEvD,OAAO,KAAK,oBAAoB,KAAK,yBAAyB;EAIhE,MAAM,aAAa,KAAK,cAAc,SAAS;EAE/C,OAAO,MAAM,KAAK,qBAChB,KACA,YACA,UACA,KACA,UAAU,IACZ;CACF;;;;CAKA,MAAc,qBACZ,KACA,YACA,UACA,KACA,YACmB;EACnB,IAAI;GACF,MAAM,SAAS,KAAK,cAAc,IAAI,QAAQ,QAAQ;GACtD,IAAI,UAAU,CAAC,KAAK,mBAAmB,YAAY,MAAM,GACvD,OAAO,KAAK,oBAAoB,KAAK,oBAAoB;GAI3D,IAAI,aAAa,WAAW,IAAI,WAAW,OACzC,OAAO,MAAM,KAAK,YAAY,YAAY,IAAI,YAAY;GAI5D,QAAQ,IAAI,QAAZ;IACE,KAAK,OACH,OAAO,WACH,MAAM,KAAK,UAAU,YAAY,UAAU,KAAK,UAAU,IAC1D,MAAM,KAAK,WACT,YACA,IAAI,cACJ,KACA,UACF;IAEN,KAAK,QACH,OAAO,MAAM,KAAK,aAAa,YAAY,KAAK,UAAU;IAE5D,KAAK;IACL,KAAK;KACH,IAAI,CAAC,UACH,OAAO,KAAK,oBACV,KACA,+BACF;KAEF,OAAO,MAAM,KAAK,aAAa,YAAY,UAAU,KAAK,UAAU;IAEtE,KAAK;KACH,IAAI,CAAC,UACH,OAAO,KAAK,oBACV,KACA,+BACF;KAEF,OAAO,MAAM,KAAK,aAAa,YAAY,QAAQ;IAErD,SACE,OAAO,KAAK,oBAAoB,KAAK,oBAAoB;GAC7D;EACF,SAAS,OAAO;GACd,QAAQ,MAAM,cAAc,KAAK;GACjC,OAAO,KAAK,oBAAoB,KAAK,uBAAuB;EAC9D;CACF;CAEA,cACE,QACA,UACwD;EACxD,QAAQ,QAAR;GACE,KAAK,OACH,OAAO,YAAY,aAAa,UAAU,QAAQ;GACpD,KAAK,QACH,OAAO;GACT,KAAK;GACL,KAAK,SACH,OAAO;GACT,KAAK,UACH,OAAO;GACT,SACE,OAAO;EACX;CACF;;;;;;;;CASA,cACE,YACA,QACS;EACT,IAAI,CAAC,YAAY,OAAO;EACxB,MAAM,YAAY,eAAe,UAAU,UAAU,CAAC,EAAE;EACxD,IAAI,CAAC,aAAa,OAAO,cAAc,UAAU,OAAO;EACxD,MAAM,eAAgB,UAA4C;EAClE,IAAI,iBAAiB,MAAM,OAAO;EAClC,IAAI,iBAAiB,QAAQ,OAAO,OAAO,YAAY,MAAM;EAC7D,OAAO;CACT;CAEA,mBACE,YACA,QACS;EACT,IAAI,CAAC,YACH,OAAO;EAIT,MAAM,YADS,eAAe,UAAU,UACtB,CAAA,CAAO;EAEzB,IAAI,cAAc,OAChB,OAAO;EAGT,IAAI,aAAa,OAAO,cAAc,UAAU;GAC9C,IAAI,UAAU,WAAW,CAAC,UAAU,QAAQ,SAAS,MAAM,GACzD,OAAO;GAGT,IAAI,UAAU,SAAS,SAAS,MAAM,GACpC,OAAO;EAEX;EAEA,OAAO;CACT;CAEA,wBACE,YACoB;EAIpB,MAAM,YACH,WACE,cAED,WAAW,aAGV;EAEL,IAAI,CAAC,WACH;EAGF,MAAM,aAAa,eAAe,sBAAsB,SAAS;EACjE,OAAO,YAAY,iBAAiB,YAAY,QAAQ,UAAU;CACpE;;;;CAKA,MAAc,UACZ,YACA,IACA,KACA,YACmB;EACnB,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;EACtC,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;EAEzD,OAAO,KAAK,mBAAmB,KAAK,YAAY,KAAK,aAAa,MAAM,CAAC;CAC3E;;;;CAKA,MAAc,WACZ,YACA,QACA,KACA,YACmB;EACnB,MAAM,QAAQ,OAAO,SAAS,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE;EAC7D,MAAM,SAAS,OAAO,SAAS,OAAO,IAAI,QAAQ,KAAK,KAAK,EAAE;EAC9D,MAAM,UAAU,OAAO,IAAI,SAAS,KAAK;EAIzC,MAAM,QAA2C,CAAC;EAClD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GACxC,IAAI,CAAC;GAAC;GAAS;GAAU;EAAS,CAAC,CAAC,SAAS,GAAG,GAAG;GAEjD,MAAM,QAAQ,IAAI,MAAM,gBAAgB;GACxC,IAAI,OAAO;IACT,MAAM,QAAQ,MAAM;IACpB,MAAM,WAAW,MAAM;IAYvB,MAAM,SAAS,GAAG,MAAM,GADJ;KARlB,IAAI;KACJ,KAAK;KACL,IAAI;KACJ,KAAK;KACL,IAAI;KACJ,IAAI;KACJ,MAAM;IAEY,EAAY,aAAa;IAG7C,MAAM,UAAU,aAAa,OAAO,MAAM,MAAM,GAAG,IAAI;GACzD,OACE,MAAM,OAAO;EAEjB;EAGF,MAAM,UAAU,MAAM,WAAW,KAAK;GACpC,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAA;GAC/C;GACA;GACA;EACF,CAAC;EAED,OAAO,KAAK,mBACV,KACA,YACA,QAAQ,KAAK,WAAuB,KAAK,aAAa,MAAM,CAAC,CAC/D;CACF;;;;CAKA,MAAc,YACZ,YACA,QACmB;EAEnB,MAAM,QAA2C,CAAC;EAClD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GAAG;GAE3C,MAAM,QAAQ,IAAI,MAAM,gBAAgB;GACxC,IAAI,OAAO;IACT,MAAM,QAAQ,MAAM;IACpB,MAAM,WAAW,MAAM;IAYvB,MAAM,SAAS,GAAG,MAAM,GADJ;KARlB,IAAI;KACJ,KAAK;KACL,IAAI;KACJ,KAAK;KACL,IAAI;KACJ,IAAI;KACJ,MAAM;IAEY,EAAY,aAAa;IAG7C,MAAM,UAAU,aAAa,OAAO,MAAM,MAAM,GAAG,IAAI;GACzD,OACE,MAAM,OAAO;EAEjB;EAEA,MAAM,QAAQ,MAAM,WAAW,MAAM,EACnC,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAA,EACjD,CAAC;EAED,OAAO,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC1C;;;;CAKA,MAAc,aACZ,YACA,KACA,YACmB;EACnB,MAAM,OAAO,KAAK,oBAAoB,YAAY,MAAM,IAAI,KAAK,CAAC;EAClE,MAAM,SAAS,MAAM,WAAW,OAAO;GAAE,GAAG;GAAM,WAAW;EAAK,CAAC;EACnE,MAAM,OAAO,KAAK;EAClB,OAAO,KAAK,mBAAmB,KAAK,aAAa,MAAM,GAAG,GAAG;CAC/D;;;;CAKA,MAAc,aACZ,YACA,IACA,KACA,YACmB;EACnB,MAAM,OAAO,KAAK,oBAAoB,YAAY,MAAM,IAAI,KAAK,CAAC;EAClE,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;EAEtC,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;EAIzD,OAAO,OAAO,QAAQ,IAAI;EAC1B,MAAM,OAAO,KAAK;EAElB,OAAO,KAAK,mBAAmB,KAAK,aAAa,MAAM,CAAC;CAC1D;;;;CAKA,MAAc,aACZ,YACA,IACmB;EACnB,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;EAEtC,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;EAGzD,MAAM,OAAO,OAAO;EACpB,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;CAC3C;;;;;;;CAQA,MAAc,gBAAgB,KAAiC;EAK7D,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,IAAI,KAAK;GACzB,OAAO,KAAK,MAAM,OAAO;EAC3B,QAAQ;GACN,OAAO,KAAK,oBAAoB,KAAK,mBAAmB;EAC1D;EAEA,MAAM,UAAU,MAAM,sBAAsB,MAAM,EAChD,gBAAgB,kBACd,KAAK,uBAAuB,eAAe,KAAK,OAAO,EAC3D,CAAC;EACD,OAAO,KAAK,mBAAmB,QAAQ,MAAM,QAAQ,MAAM;CAC7D;;;;;;CAOA,uBACE,eACA,KACA,SACwB;EACxB,IAAI,aAAgD;EACpD,IAAI,aAA4B;EAEhC,MAAM,aAAa,KAAK,YAAY,IAAI,aAAa;EACrD,IAAI,YAAY;GACd,aAAa;GACb,aAAa,KAAK,wBAAwB,UAAU,KAAK;EAC3D,OAAO;GACL,MAAM,aAAa,KAAK,UAAU,aAAa;GAC/C,KAAK,MAAM,CAAC,KAAK,SAAS,eAAe,cAAc,GACrD,IAAI,KAAK,WAAW,KAAK,QAAQ,IAAA,CAAK,YAAY,CAAC,MAAM,YAAY;IACnE,aAAa,KAAK,cAAc,IAAI;IACpC,aAAa,KAAK;IAClB;GACF;EAEJ;EAEA,IAAI,CAAC,cAAc,CAAC,YAClB,OAAO;EAGT,MAAM,eAAe;EAErB,OAAO;GACL,YAAY;GACA;GACZ,cAAc,OACZ,KAAK,mBAAmB,cAAc,EAAE;GAC1C,WAAW,OAAO,OAAoB;IACpC,IAAI,KAAK,OAAO,gBAAgB;KAC9B,MAAM,OACJ,OAAO,WAAW,SAAS,OAAO,WAAW,QAAQ;KAKvD,MAAM,aAAa,MAJD,KAAK,OAAO,eAAe,cAAc,IAIlC,CAAA,CACvB,IAAI,QAAQ,IAAI,KAAK;MACnB,QAAQ,IAAI;MACZ,SAAS,IAAI;MACb,MAAM;KACR,CAAC,CACH;KACA,IAAI,sBAAsB,UACxB,OAAO,WAAW,WAAW,MAAM,kBAAkB;KAEvD,OAAO;IACT;IAGA,OAAO,KAAK,cAAc,cAAc,MAAM,IAC1C,OACA;GACN;GACA,UAAU,YAAY,KAAK,oBAAoB,cAAc,OAAO;EACtE;CACF;;;;CAKA,cACE,WAC4B;EAC5B,IAAI,CAAC,KAAK,YAAY,IAAI,UAAU,IAAI,GAAG;GAIzC,MAAM,OAAO,UAAU;GAGvB,MAAM,aAAa,IAAI,KAAK;IAC1B,IAAI,KAAK,QAAQ;IACjB,IAAI,KAAK,QAAQ;GACnB,CAAC;GACD,KAAK,YAAY,IAAI,UAAU,MAAM,UAAU;EACjD;EACA,MAAM,aAAa,KAAK,YAAY,IAAI,UAAU,IAAI;EACtD,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,cAAc,UAAU,KAAK,WAAW;EACzE,OAAO;CACT;;;;;;CAOA,oBACE,YACA,MACyB;EACzB,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B,OAAO,CAAC;EAGV,MAAM,gCAAgB,IAAI,IAAI;GAC5B;GACA;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;EAED,MAAM,2BAAW,IAAI,IAAY;EACjC,IAAI,WAA4B;EAEhC,IAAI,YAAY;GACd,MAAM,YAAY,eAAe,UAAU,UAAU,CAAC,EAAE;GACxD,IACE,aACA,OAAO,cAAc,YACrB,MAAM,QAAS,UAAqC,QAAQ,GAE5D,WAAY,UAAqC;GAGnD,KAAK,MAAM,CAAC,MAAM,QAAQ,eAAe,UAAU,UAAU,GAC3D,IAAI,QAAQ,IAAI,aAAa,QAAQ,IAAI,OAAO,aAAa,OAC3D,SAAS,IAAI,IAAI;EAGvB;EAEA,MAAM,SAAkC,CAAC;EACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;GAC/C,IAAI,IAAI,WAAW,GAAG,GAAG;GACzB,IAAI,cAAc,IAAI,GAAG,GAAG;GAC5B,IAAI,SAAS,IAAI,GAAG,GAAG;GACvB,IAAI,YAAY,CAAC,SAAS,SAAS,GAAG,GAAG;GACzC,OAAO,OAAO;EAChB;EACA,OAAO;CACT;;;;;CAMA,aAAqB,QAA0B;EAC7C,MAAM,eAAe;EACrB,OAAO,OAAO,cAAc,iBAAiB,aACzC,aAAa,aAAa,IAC1B;CACN;;;;;;;;;CAUA,mBACE,KACA,YACA,SACU;EACV,MAAM,SAAS,aACX,eAAe,UAAU,UAAU,IACnC,KAAA;EACJ,MAAM,YAAY,QAAQ;EAI1B,MAAM,eAAe,aACjB,eAAe,eAAe,UAAU,KAAK,CAAC,CAAC,QAAQ,eACvD;EACJ,IAAI,YACF,6BAA6B,YAAY,WAAW,YAAY;EAElE,OAAO,wBACL,KACA,SACA,wBAAwB,WAAW,EAAE,aAAa,CAAC,CACrD;CACF;;;;CAKA,mBAA2B,MAAe,SAAS,KAAe;EAChE,OAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;GACxC;GACA,SAAS,EACP,gBAAgB,mBAClB;EACF,CAAC;CACH;;;;CAKA,oBAA4B,QAAgB,SAA2B;EACrE,OAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC,GAAG;GACtD;GACA,SAAS,EACP,gBAAgB,mBAClB;EACF,CAAC;CACH;;;;;;CAOA,qBAA6B,KAA6B;EACxD,IAAI,CAAC,KAAK,OAAO,YAAY,OAAO;EACpC,MAAM,UAAU,KAAK,OAAO;EAC5B,IAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,OAAO;EAC7C,MAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ;EACvC,OAAO,UAAU,QAAQ,SAAS,MAAM,IAAI,SAAS;CACvD;;;;CAKA,mBAA2B,KAAwB;EACjD,MAAM,UAAkC;GACtC,gCAAgC;GAChC,gCAAgC;GAChC,0BAA0B;EAC5B;EACA,MAAM,SAAS,KAAK,qBAAqB,GAAG;EAC5C,IAAI,QAAQ;GACV,QAAQ,iCAAiC;GACzC,QAAQ,OAAO;EACjB;EACA,OAAO,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK;EAAQ,CAAC;CACpD;;;;CAKA,eAAuB,UAAoB,KAAwB;EACjE,MAAM,SAAS,KAAK,qBAAqB,GAAG;EAC5C,IAAI,CAAC,QAAQ,OAAO;EAEpB,MAAM,UAAU,IAAI,QAAQ,SAAS,OAAO;EAC5C,QAAQ,IAAI,+BAA+B,MAAM;EACjD,QAAQ,IAAI,QAAQ,QAAQ;EAC5B,QAAQ,IACN,gCACA,mCACF;EACA,QAAQ,IAAI,gCAAgC,4BAA4B;EAExE,OAAO,IAAI,SAAS,SAAS,MAAM;GACjC,QAAQ,SAAS;GACjB,YAAY,SAAS;GACrB;EACF,CAAC;CACH;;;;CAKA,UAAkB,MAAsB;EACtC,IAAI,KAAK,SAAS,GAAG,GACnB,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,EAAE;EAE9B,IAAI,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,GACjE,OAAO,GAAG,KAAK;EAEjB,OAAO,GAAG,KAAK;CACjB;AACF;;;;AAeA,SAAgB,iBACd,SACA,UAAsB,CAAC,GACvB,SAA2B,CAAC,GACU;CAEtC,QAAQ,SAAS,QAAQ;EACvB,IAAI,CAAC,eAAe,SAAS,IAAI,IAAI,GACnC,QAAQ,KAAK,UAAU,IAAI,KAAK,qCAAqC;CAEzE,CAAC;CAGD,MAAM,EAAE,QAAQ,QAAQ,IADF,aAAa,QAAQ,OACnB,CAAA,CAAU,aAAa;CAE/C,QAAQ,IAAI,sCAAsC,KAAK;CAEvD,OAAO;EAAE;EAAQ;CAAI;AACvB;;;;AAKA,SAAgB,gBACd,SACA,UAAsB,CAAC,GACvB,SAA2B,CAAC,GACE;CAC9B,OAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,EAAE,QAAQ,QAAQ,iBAAiB,SAAS,SAAS,MAAM;EAGjE,MAAM,iBAAgC;GACpC,OAAO,IAAI,SAAS,oBAAoB;IACtC,QAAQ,IAAI,uCAAuC;IAInD,OAAO,YAAY;KACjB,QAAQ,IAAI,6BAA6B;KACzC,gBAAgB;IAClB,CAAC;GACH,CAAC;EACH;EAGA,QAAQ,GAAG,WAAW,QAAQ;EAC9B,QAAQ,GAAG,UAAU,QAAQ;EAE7B,QAAQ,QAAQ;CAClB,CAAC;AACH"}

package/dist/generators.js

@@ -1,7 +1,8 @@
 import { runWithTenantGate, setTenantEntryPointRunner } from "./generators/tenant-gate.js";
 import { CLIGenerator, getCLIHandler, setupCLI } from "./generators/cli.js";
+import { PRIVATE_READ_CACHE_CONTROL, computeBodyEtag, conditionalJsonResponse, ifNoneMatchSatisfied, resolveReadCacheControl, warnIfSharedCacheNeutralized } from "./generators/conditional-get.js";
 import { MCPGenerator } from "./generators/mcp.js";
 import { APIGenerator, createRestServer, startRestServer } from "./generators/rest.js";
 import { generateOpenAPISpec, setupSwaggerUI } from "./generators/swagger.js";
 import "./generators/index.js";
-export { APIGenerator, CLIGenerator, MCPGenerator, createRestServer, generateOpenAPISpec, getCLIHandler, runWithTenantGate, setTenantEntryPointRunner, setupCLI, setupSwaggerUI, startRestServer };
+export { APIGenerator, CLIGenerator, MCPGenerator, PRIVATE_READ_CACHE_CONTROL, computeBodyEtag, conditionalJsonResponse, createRestServer, generateOpenAPISpec, getCLIHandler, ifNoneMatchSatisfied, resolveReadCacheControl, runWithTenantGate, setTenantEntryPointRunner, setupCLI, setupSwaggerUI, startRestServer, warnIfSharedCacheNeutralized };

package/dist/index.d.ts

@@ -46,6 +46,7 @@ export * from './runtime/index';
 export { detectEngine, generateDDLForEngine } from './schema/ddl';
 export type { SchemaDefinition } from './schema/types';
 export * from './signals/index';
+export * from './sync/apply';
 export * from './system/index';
 export type { DiscoveryStrategy, ForgetOptions, ForgetScopeOptions, NoteMetadata, NoteOptions, RecallAllOptions, RecallOptions, SystemTableConfig, } from './system/types';
 export { resetVerifiedTables } from './table-cache';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,cAAc,kBAAkB,CAAC;AAEjC,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,qBAAqB,EAC1B,+BAA+B,EAC/B,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,GACb,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,OAAO,EACL,KAAK,cAAc,EACnB,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,kCAAkC,EAClC,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,6BAA6B,EAClC,gCAAgC,GACjC,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,KAAK,sBAAsB,EAC3B,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,EACL,UAAU,EACV,KAAK,IAAI,EACT,UAAU,EACV,IAAI,EACJ,KAAK,mBAAmB,EACxB,SAAS,EACT,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,UAAU,CAAC;AAEzB,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,KAAK,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEtE,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,cAAc,aAAa,CAAC;AAG5B,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB,cAAc,kBAAkB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,KAAK,iCAAiC,GACvC,MAAM,2BAA2B,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAElD,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAElE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,cAAc,iBAAiB,CAAC;AAEhC,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,cAAc,eAAe,CAAC;AAE9B,OAAO,EACL,KAAK,EACL,cAAc,EACd,OAAO,EACP,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,EACL,KAAK,MAAM,EACX,KAAK,cAAc,EACnB,SAAS,EACT,aAAa,EACb,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,2BAA2B,EAC3B,aAAa,EACb,eAAe,EACf,MAAM,EACN,KAAK,mBAAmB,EACxB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,cAAc,kBAAkB,CAAC;AAEjC,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,qBAAqB,EAC1B,+BAA+B,EAC/B,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,GACb,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,OAAO,EACL,KAAK,cAAc,EACnB,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,kCAAkC,EAClC,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,6BAA6B,EAClC,gCAAgC,GACjC,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,KAAK,sBAAsB,EAC3B,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,EACL,UAAU,EACV,KAAK,IAAI,EACT,UAAU,EACV,IAAI,EACJ,KAAK,mBAAmB,EACxB,SAAS,EACT,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,cAAc,kBAAkB,CAAC;AAEjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,UAAU,CAAC;AAEzB,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,KAAK,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEtE,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,cAAc,aAAa,CAAC;AAG5B,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB,cAAc,kBAAkB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,KAAK,iCAAiC,GACvC,MAAM,2BAA2B,CAAC;AACnC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAElD,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAElE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,cAAc,iBAAiB,CAAC;AAGhC,cAAc,cAAc,CAAC;AAE7B,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,cAAc,eAAe,CAAC;AAE9B,OAAO,EACL,KAAK,EACL,cAAc,EACd,OAAO,EACP,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,EACL,KAAK,MAAM,EACX,KAAK,cAAc,EACnB,SAAS,EACT,aAAa,EACb,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,2BAA2B,EAC3B,aAAa,EACb,eAAe,EACf,MAAM,EACN,KAAK,mBAAmB,EACxB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -42,7 +42,9 @@ import "./dispatch/index.js";
 import "./embeddings/index.js";
 import { runWithTenantGate, setTenantEntryPointRunner } from "./generators/tenant-gate.js";
 import { CLIGenerator, getCLIHandler, setupCLI } from "./generators/cli.js";
+import { PRIVATE_READ_CACHE_CONTROL, computeBodyEtag, conditionalJsonResponse, ifNoneMatchSatisfied, resolveReadCacheControl, warnIfSharedCacheNeutralized } from "./generators/conditional-get.js";
 import { MCPGenerator } from "./generators/mcp.js";
+import { MAX_SYNC_APPLY_BATCH_SIZE, SYNC_APPLY_ROUTE_SEGMENTS, SYNC_APPLY_UUID_PATTERN, applySyncWritablePolicy, isStaleWrite, parseSyncApplyBatch, payloadMatchesRow, processSyncApplyBatch, validateSyncApplyItem } from "./sync/apply.js";
 import { APIGenerator, createRestServer, startRestServer } from "./generators/rest.js";
 import { generateOpenAPISpec, setupSwaggerUI } from "./generators/swagger.js";
 import "./generators/index.js";
@@ -63,4 +65,4 @@ import "./system/index.js";
 import { getTestDatabase } from "./testing/database.js";
 import "./tools/index.js";
 import { smrtPlugin } from "./vite-plugin/index.js";
-export { AIError, APIGenerator, AiUsageCollector, AiUsagePersistenceHandler, CACHE_INVALIDATION_CHANNEL, CLIGenerator, ConfigurationError, ContentHasher, CosineSimilarity, DEFAULT_AI_COST_RATES, DEFAULT_EMBEDDING_CONFIG, DatabaseError, Dispatch, DispatchBus, DispatchCollection, DispatchSubscription, DispatchSubscriptionCollection, EmbeddingProvider, EmbeddingStorage, ErrorUtils, FilesystemError, GlobalInterceptors, MCPGenerator, ManifestBuilder, ManifestGenerator, ManifestManager, MetricsAdapter, NetworkError, ObjectRegistry, PubSubAdapter, RuntimeError, SMRT_COLLECTION_BASE_NAMES, SchemaComparer, SignalBus, SignalSanitizer, SmrtClass, SmrtCollection, SmrtError, SmrtHierarchical, SmrtJunction, SmrtMCPServer, SmrtObject, SmrtPolymorphicAssociation, TenantIsolationError, ValidationError, ValidationReport, ValidationUtils, applyOneToManyChildAccessors, applyPendingDecoratorRegistrations, broadcastCacheInvalidation, buildDomainKnowledgeManifest, childAccessorName, clone, config, convertTypeToJsonSchema, createDispatchBus, createInterceptorContext, createMCPServer, createQualifiedName, createRestServer, createSmrtClient, createSmrtServer, crossPackageRef, detectEngine, discoverManifestEntry, ensureCacheInvalidationListener, ensureDispatchSubscriptionsSystemTableCompatibility, ensureDispatchSystemTableCompatibility, ensureJobEventsSystemTableCompatibility, ensureJobsSystemTableCompatibility, ensureLegacySystemTableCompatibility, estimateAiUsageCost, executeToolCall, executeToolCalls, field, findManifestEntryByQualifiedName, foreignKey, formatToolResults, generateDDLForEngine, generateOpenAPISpec, generateSchemaDiff, generateToolFromMethod, generateToolManifest, getAdapterInfo, getCLIHandler, getCacheGeneration, getClassConfigResolvers, getClassName, getConfigResolver, getManifest, getPackageFromQualifiedName, getSQLFromDiff, getTestDatabase, hasActionableChanges, invalidateCollectionCache, isDatabaseInterface, isFromPackage, isLazyConfigSentinel, isQualifiedName, isSmrtCollectionExtendsName, isType, isValid, listConfigResolvers, loadExternalManifest, loadExternalManifestSync, loadLocalTestManifestSync, loadManifestFromPathSync, manifest, manyToMany, meta, oneToMany, parse, parseQualifiedName, qualifiedNamesEqual, registerCompatibleFieldDecorator, registerConfigResolver, resetCollectionCache, resetConfigResolvers, resetVerifiedTables, resolveDatabase, resolveDbCacheKey, resolveDispatchTenantId, resolveDispatchTenantScope, resolveLazyConfig, runWithTenantGate, safeParse, safeStringify, setDispatchTenantResolver, setTenantEntryPointRunner, setupCLI, setupSwaggerUI, shouldIncludeMethod, smrt, smrtPlugin, smrt as smrtRegistry, startRestServer, staticManifest, stopCacheInvalidationListeners, stringify, tableExists, unregisterConfigResolver, validateToolCall };
+export { AIError, APIGenerator, AiUsageCollector, AiUsagePersistenceHandler, CACHE_INVALIDATION_CHANNEL, CLIGenerator, ConfigurationError, ContentHasher, CosineSimilarity, DEFAULT_AI_COST_RATES, DEFAULT_EMBEDDING_CONFIG, DatabaseError, Dispatch, DispatchBus, DispatchCollection, DispatchSubscription, DispatchSubscriptionCollection, EmbeddingProvider, EmbeddingStorage, ErrorUtils, FilesystemError, GlobalInterceptors, MAX_SYNC_APPLY_BATCH_SIZE, MCPGenerator, ManifestBuilder, ManifestGenerator, ManifestManager, MetricsAdapter, NetworkError, ObjectRegistry, PRIVATE_READ_CACHE_CONTROL, PubSubAdapter, RuntimeError, SMRT_COLLECTION_BASE_NAMES, SYNC_APPLY_ROUTE_SEGMENTS, SYNC_APPLY_UUID_PATTERN, SchemaComparer, SignalBus, SignalSanitizer, SmrtClass, SmrtCollection, SmrtError, SmrtHierarchical, SmrtJunction, SmrtMCPServer, SmrtObject, SmrtPolymorphicAssociation, TenantIsolationError, ValidationError, ValidationReport, ValidationUtils, applyOneToManyChildAccessors, applyPendingDecoratorRegistrations, applySyncWritablePolicy, broadcastCacheInvalidation, buildDomainKnowledgeManifest, childAccessorName, clone, computeBodyEtag, conditionalJsonResponse, config, convertTypeToJsonSchema, createDispatchBus, createInterceptorContext, createMCPServer, createQualifiedName, createRestServer, createSmrtClient, createSmrtServer, crossPackageRef, detectEngine, discoverManifestEntry, ensureCacheInvalidationListener, ensureDispatchSubscriptionsSystemTableCompatibility, ensureDispatchSystemTableCompatibility, ensureJobEventsSystemTableCompatibility, ensureJobsSystemTableCompatibility, ensureLegacySystemTableCompatibility, estimateAiUsageCost, executeToolCall, executeToolCalls, field, findManifestEntryByQualifiedName, foreignKey, formatToolResults, generateDDLForEngine, generateOpenAPISpec, generateSchemaDiff, generateToolFromMethod, generateToolManifest, getAdapterInfo, getCLIHandler, getCacheGeneration, getClassConfigResolvers, getClassName, getConfigResolver, getManifest, getPackageFromQualifiedName, getSQLFromDiff, getTestDatabase, hasActionableChanges, ifNoneMatchSatisfied, invalidateCollectionCache, isDatabaseInterface, isFromPackage, isLazyConfigSentinel, isQualifiedName, isSmrtCollectionExtendsName, isStaleWrite, isType, isValid, listConfigResolvers, loadExternalManifest, loadExternalManifestSync, loadLocalTestManifestSync, loadManifestFromPathSync, manifest, manyToMany, meta, oneToMany, parse, parseQualifiedName, parseSyncApplyBatch, payloadMatchesRow, processSyncApplyBatch, qualifiedNamesEqual, registerCompatibleFieldDecorator, registerConfigResolver, resetCollectionCache, resetConfigResolvers, resetVerifiedTables, resolveDatabase, resolveDbCacheKey, resolveDispatchTenantId, resolveDispatchTenantScope, resolveLazyConfig, resolveReadCacheControl, runWithTenantGate, safeParse, safeStringify, setDispatchTenantResolver, setTenantEntryPointRunner, setupCLI, setupSwaggerUI, shouldIncludeMethod, smrt, smrtPlugin, smrt as smrtRegistry, startRestServer, staticManifest, stopCacheInvalidationListeners, stringify, tableExists, unregisterConfigResolver, validateSyncApplyItem, validateToolCall, warnIfSharedCacheNeutralized };

package/dist/manifest/static-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static-manifest.d.ts","sourceRoot":"","sources":["../../src/manifest/static-manifest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,eAAO,MAAM,cAAc,EAAE,mBAy0CnB,CAAC;AAEX,eAAe,cAAc,CAAC"}
+{"version":3,"file":"static-manifest.d.ts","sourceRoot":"","sources":["../../src/manifest/static-manifest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,eAAO,MAAM,cAAc,EAAE,mBAi1CnB,CAAC;AAEX,eAAe,cAAc,CAAC"}

package/dist/manifest/static-manifest.js

@@ -1,9 +1,9 @@
 //#region src/manifest/static-manifest.ts
 var staticManifest = {
 	"version": "1.0.0",
-	"timestamp": 1782959836605,
+	"timestamp": 1783048762765,
 	"packageName": "@happyvertical/smrt-core",
-	"packageVersion": "0.37.6",
+	"packageVersion": "0.37.7",
 	"objects": {
 		"@happyvertical/smrt-core:SmrtClass": {
 			"name": "smrtclass",
@@ -738,6 +738,14 @@ var staticManifest = {
 					"isStatic": false,
 					"isPublic": true
 				},
+				"requireInsertOnSave": {
+					"name": "requireInsertOnSave",
+					"async": false,
+					"parameters": [],
+					"returnType": "void",
+					"isStatic": false,
+					"isPublic": true
+				},
 				"initialize": {
 					"name": "initialize",
 					"async": true,