@happyvertical/smrt-core 0.37.7 → 0.37.9

package/dist/utils/stack-frames.js

@@ -0,0 +1,64 @@
+//#region src/utils/stack-frames.ts
+/**
+* Decorator-runtime stack-frame detection (#1785).
+*
+* ObjectRegistry attributes a `@smrt()` class to its declaring package by
+* walking the registration call stack for the first frame OUTSIDE smrt-core —
+* the module that applied the decorator. Decorator *lowering* breaks that
+* assumption: the compiler inserts a runtime-helper frame between the `@smrt()`
+* decorator and the consumer module that declares the class.
+*
+* Under Vite 8, oxc's legacy-decorator lowering routes the decorator application
+* through `@oxc-project/runtime`'s helper (e.g.
+* `.../@oxc-project/runtime/src/helpers/esm/applyDecoratedDescriptor.js`), so a
+* naive walk stops at that frame and misattributes the class to
+* `@oxc-project/runtime` instead of the consumer package. `tslib` (tsc's
+* `__decorate`), `@swc/helpers`, and `@babel/runtime` insert the identical kind
+* of frame under their respective toolchains.
+*
+* These are pure plumbing packages — a class is applied THROUGH them, never
+* DECLARED in them — so both stack walks (source-file identity in
+* `registry/shared-state.ts` and package attribution in
+* `manifest/manifest-loader.ts`) skip them and continue to the real declaring
+* module. Kept as a leaf module (no smrt imports) so both walkers can share it
+* without risking an import cycle.
+*/
+/**
+* Runtime-helper packages that decorator lowering routes the decorator
+* application through. Frames from these packages are never the module that
+* declares a decorated class.
+*/
+var DECORATOR_RUNTIME_PACKAGES = [
+	"@oxc-project/runtime",
+	"@swc/helpers",
+	"@babel/runtime",
+	"tslib"
+];
+/**
+* Whether a file path (normalized to forward slashes) lives inside a
+* decorator-runtime helper package — i.e. a stack frame introduced by decorator
+* lowering rather than the module that declares the decorated class.
+*
+* Matches both the plain installed form (`.../node_modules/tslib/...`) and the
+* pnpm form (`.../node_modules/.pnpm/tslib@2/node_modules/tslib/...`) because
+* the real `/<package>/` segment appears in both. Case-insensitive.
+*
+* @param path - A file path from a stack frame (already normalized to `/`).
+*/
+function isDecoratorRuntimeFramePath(path) {
+	const lower = path.toLowerCase();
+	return DECORATOR_RUNTIME_PACKAGES.some((pkg) => lower.includes(`/${pkg}/`));
+}
+/**
+* Whether a scoped package name (as captured from a `node_modules/@scope/name`
+* stack match) is a decorator-runtime helper package.
+*
+* @param name - A scoped package name, e.g. `@oxc-project/runtime`.
+*/
+function isDecoratorRuntimePackageName(name) {
+	return DECORATOR_RUNTIME_PACKAGES.includes(name);
+}
+//#endregion
+export { DECORATOR_RUNTIME_PACKAGES, isDecoratorRuntimeFramePath, isDecoratorRuntimePackageName };
+
+//# sourceMappingURL=stack-frames.js.map

package/dist/utils/stack-frames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack-frames.js","names":[],"sources":["../../src/utils/stack-frames.ts"],"sourcesContent":["/**\n * Decorator-runtime stack-frame detection (#1785).\n *\n * ObjectRegistry attributes a `@smrt()` class to its declaring package by\n * walking the registration call stack for the first frame OUTSIDE smrt-core —\n * the module that applied the decorator. Decorator *lowering* breaks that\n * assumption: the compiler inserts a runtime-helper frame between the `@smrt()`\n * decorator and the consumer module that declares the class.\n *\n * Under Vite 8, oxc's legacy-decorator lowering routes the decorator application\n * through `@oxc-project/runtime`'s helper (e.g.\n * `.../@oxc-project/runtime/src/helpers/esm/applyDecoratedDescriptor.js`), so a\n * naive walk stops at that frame and misattributes the class to\n * `@oxc-project/runtime` instead of the consumer package. `tslib` (tsc's\n * `__decorate`), `@swc/helpers`, and `@babel/runtime` insert the identical kind\n * of frame under their respective toolchains.\n *\n * These are pure plumbing packages — a class is applied THROUGH them, never\n * DECLARED in them — so both stack walks (source-file identity in\n * `registry/shared-state.ts` and package attribution in\n * `manifest/manifest-loader.ts`) skip them and continue to the real declaring\n * module. Kept as a leaf module (no smrt imports) so both walkers can share it\n * without risking an import cycle.\n */\n\n/**\n * Runtime-helper packages that decorator lowering routes the decorator\n * application through. Frames from these packages are never the module that\n * declares a decorated class.\n */\nexport const DECORATOR_RUNTIME_PACKAGES: readonly string[] = [\n  '@oxc-project/runtime',\n  '@swc/helpers',\n  '@babel/runtime',\n  'tslib',\n];\n\n/**\n * Whether a file path (normalized to forward slashes) lives inside a\n * decorator-runtime helper package — i.e. a stack frame introduced by decorator\n * lowering rather than the module that declares the decorated class.\n *\n * Matches both the plain installed form (`.../node_modules/tslib/...`) and the\n * pnpm form (`.../node_modules/.pnpm/tslib@2/node_modules/tslib/...`) because\n * the real `/<package>/` segment appears in both. Case-insensitive.\n *\n * @param path - A file path from a stack frame (already normalized to `/`).\n */\nexport function isDecoratorRuntimeFramePath(path: string): boolean {\n  const lower = path.toLowerCase();\n  return DECORATOR_RUNTIME_PACKAGES.some((pkg) => lower.includes(`/${pkg}/`));\n}\n\n/**\n * Whether a scoped package name (as captured from a `node_modules/@scope/name`\n * stack match) is a decorator-runtime helper package.\n *\n * @param name - A scoped package name, e.g. `@oxc-project/runtime`.\n */\nexport function isDecoratorRuntimePackageName(name: string): boolean {\n  return DECORATOR_RUNTIME_PACKAGES.includes(name);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,IAAa,6BAAgD;CAC3D;CACA;CACA;CACA;AACF;;;;;;;;;;;;AAaA,SAAgB,4BAA4B,MAAuB;CACjE,MAAM,QAAQ,KAAK,YAAY;CAC/B,OAAO,2BAA2B,MAAM,QAAQ,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;AAC5E;;;;;;;AAQA,SAAgB,8BAA8B,MAAuB;CACnE,OAAO,2BAA2B,SAAS,IAAI;AACjD"}

package/dist/vite-plugin/changes-route.d.ts

@@ -0,0 +1,10 @@
+import { SmartObjectManifest } from '../scanner/types';
+import { SvelteKitOptions } from './sveltekit-generator.js';
+/**
+ * Generate the `_changes/+server.ts` route. Returns true when a route was
+ * written. Disabled with `sveltekit: { changesRoute: { enabled: false } }`;
+ * skipped (with a log line) when the manifest has no objects to anchor the
+ * database on.
+ */
+export declare function generateChangesRoute(projectRoot: string, manifest: SmartObjectManifest, options: SvelteKitOptions): boolean;
+//# sourceMappingURL=changes-route.d.ts.map

package/dist/vite-plugin/changes-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes-route.d.ts","sourceRoot":"","sources":["../../src/vite-plugin/changes-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAyCjE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CA0BT"}

package/dist/vite-plugin/changes-route.js

@@ -0,0 +1,174 @@
+import { AUTO_GENERATED_ROUTE_HEADER } from "./route-header.js";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+//#region src/vite-plugin/changes-route.ts
+/**
+* SvelteKit `_changes` route generation for the change feed (issue #1758).
+*
+* Emits `{routesDir}/_changes/+server.ts` — an auth-guarded, tenant-scoped
+* GET endpoint over the `_smrt_changes` log, part of the client/mobile sync
+* contract (PRD #1755). Kept in its own module so `sveltekit-generator.ts`
+* only carries a one-line registration.
+*
+* Design notes:
+* - **Fail-closed auth** (#1540 posture): the handler requires an
+*   authenticated principal on `locals`. The feed spans every table, so
+*   per-model `api: { public }` opt-outs deliberately do not apply.
+* - **Tenant scoping**: when the project has tenant-scoped objects, the
+*   route establishes tenant context from `locals` exactly like generated
+*   collection routes, then reads through
+*   `getTenantScopedChangesSince()` — a tenant only ever sees its own
+*   changes plus global rows.
+* - **Database resolution**: the route anchors on the project's first
+*   generated collection (alphabetical) via the consumer's existing
+*   `getCollection()` helper, inheriting its configuration, request-scoped
+*   database support and system-table bootstrap. Multi-database projects
+*   (per-object `db` overrides) see the anchor collection's feed.
+* - Cleanup rides the existing generated-route sweep: the emitted file
+*   starts with {@link AUTO_GENERATED_ROUTE_HEADER}.
+*/
+/**
+* Mirrors `isCollectionClass` in `sveltekit-generator.ts` (module-private
+* there): collection classes share route paths with their item class and
+* never anchor routes themselves.
+*/
+function isCollectionDefinition(objectDef) {
+	return objectDef.extends === "SmrtCollection" || !!objectDef.extendsTypeArg;
+}
+/**
+* Pick the class the route resolves its database through: the first
+* non-collection object by sorted manifest key, for determinism across
+* builds.
+*
+* Returns the manifest **registry key** verbatim (which may be
+* package-qualified, e.g. `@happyvertical/smrt-ledgers:Account`) — the emitted
+* route passes it straight to `getCollection()`, exactly as the generated CRUD
+* routes do. Collapsing it to a simple class name would resolve ambiguously
+* when two loaded packages declare the same simple name (mirrors the #1778
+* verbatim-key fix and the sync-apply route's `registryKey`).
+*/
+function resolveAnchorClassName(manifest) {
+	const sortedNames = Object.keys(manifest.objects).sort();
+	for (const name of sortedNames) {
+		const def = manifest.objects[name];
+		if (def && !isCollectionDefinition(def)) return name;
+	}
+	return null;
+}
+function manifestHasTenantScopedObject(manifest) {
+	return Object.values(manifest.objects).some((def) => !isCollectionDefinition(def) && !!def.decoratorConfig?.tenantScoped);
+}
+/**
+* Generate the `_changes/+server.ts` route. Returns true when a route was
+* written. Disabled with `sveltekit: { changesRoute: { enabled: false } }`;
+* skipped (with a log line) when the manifest has no objects to anchor the
+* database on.
+*/
+function generateChangesRoute(projectRoot, manifest, options) {
+	if (options.changesRoute?.enabled === false) return false;
+	const anchorClassName = resolveAnchorClassName(manifest);
+	if (!anchorClassName) {
+		console.log("[smrt] Skipping _changes route - no SMRT objects to anchor the database on");
+		return false;
+	}
+	const routeDir = join(projectRoot, options.routesDir, "_changes");
+	const content = generateChangesRouteTemplate(anchorClassName, manifestHasTenantScopedObject(manifest));
+	if (!existsSync(routeDir)) mkdirSync(routeDir, { recursive: true });
+	const filePath = join(routeDir, "+server.ts");
+	writeFileSync(filePath, content, "utf-8");
+	console.log(`[smrt] Generated: ${filePath}`);
+	return true;
+}
+function generateChangesRouteTemplate(anchorClassName, tenantScoped) {
+	return `${AUTO_GENERATED_ROUTE_HEADER}
+// DO NOT EDIT - changes will be overwritten
+//
+// GET /_changes — cursor read over the _smrt_changes change feed (#1758).
+// Part of the client/mobile sync contract: poll with the returned cursor to
+// observe every committed framework save/delete (deletes are tombstones)
+// exactly once. Query params: since (cursor, default 0), tables
+// (comma-separated), limit. A response with resyncRequired: true (still
+// HTTP 200 — protocol state, not an error) means the cursor cannot be
+// served incrementally (pruned or foreign) and the client must re-fetch
+// in full before resuming polling.
+
+import { error, json } from '@sveltejs/kit';
+import { getTenantScopedChangesSince } from '@happyvertical/smrt-core';
+import { getCollection } from '$lib/server/smrt';
+import type { RequestHandler } from './$types';
+
+// Fail-closed authorization (#1540): the change feed spans every table, so
+// it is never public — an authenticated principal on \`locals\` is required.
+function hasAuthenticatedPrincipal(locals: unknown): boolean {
+  if (!locals || typeof locals !== 'object') return false;
+  const l = locals as Record<string, unknown>;
+  const isResolvedPrincipal = (v: unknown) =>
+    typeof v === 'object' && v !== null;
+  return (
+    isResolvedPrincipal(l.user) ||
+    isResolvedPrincipal(l.session) ||
+    l.smrtAuth === true
+  );
+}
+
+function requireRouteAuth(locals: unknown): void {
+  if (!hasAuthenticatedPrincipal(locals)) {
+    throw error(401, 'Authentication required');
+  }
+}
+${tenantScoped ? `
+import { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenancy';
+
+function establishTenantContext(locals: unknown): void {
+  if (hasTenantContext()) return;
+  if (!locals || typeof locals !== 'object') return;
+  const l = locals as Record<string, unknown>;
+  const user = l.user as Record<string, unknown> | undefined;
+  const session = l.session as Record<string, unknown> | undefined;
+  const tenantId = l.tenantId ?? user?.tenantId ?? session?.tenantId;
+  if (typeof tenantId === 'string' && tenantId) {
+    enterTenantContext({ tenantId });
+  }
+}
+` : ""}
+export const GET: RequestHandler = async ({ locals, url }) => {
+  requireRouteAuth(locals);${tenantScoped ? "\n  establishTenantContext(locals);" : ""}
+
+  const since = Number(url.searchParams.get('since') ?? '0');
+  if (!Number.isFinite(since) || since < 0) {
+    throw error(400, "'since' must be a non-negative number");
+  }
+
+  let limit: number | undefined;
+  const limitParam = url.searchParams.get('limit');
+  if (limitParam !== null) {
+    limit = Number(limitParam);
+    if (!Number.isFinite(limit) || limit < 1) {
+      throw error(400, "'limit' must be a positive number");
+    }
+  }
+
+  const tablesParam = url.searchParams.get('tables');
+  const tables = tablesParam
+    ? tablesParam
+        .split(',')
+        .map((table) => table.trim())
+        .filter(Boolean)
+    : undefined;
+
+  // The feed lives in the project's database; anchor on the
+  // ${anchorClassName} collection to reuse its configured connection.
+  const collection = await getCollection('${anchorClassName}');
+  const page = await getTenantScopedChangesSince(collection.db, {
+    since,
+    tables,
+    limit,
+  });
+  return json(page);
+};
+`;
+}
+//#endregion
+export { generateChangesRoute };
+
+//# sourceMappingURL=changes-route.js.map

package/dist/vite-plugin/changes-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes-route.js","names":[],"sources":["../../src/vite-plugin/changes-route.ts"],"sourcesContent":["/**\n * SvelteKit `_changes` route generation for the change feed (issue #1758).\n *\n * Emits `{routesDir}/_changes/+server.ts` — an auth-guarded, tenant-scoped\n * GET endpoint over the `_smrt_changes` log, part of the client/mobile sync\n * contract (PRD #1755). Kept in its own module so `sveltekit-generator.ts`\n * only carries a one-line registration.\n *\n * Design notes:\n * - **Fail-closed auth** (#1540 posture): the handler requires an\n *   authenticated principal on `locals`. The feed spans every table, so\n *   per-model `api: { public }` opt-outs deliberately do not apply.\n * - **Tenant scoping**: when the project has tenant-scoped objects, the\n *   route establishes tenant context from `locals` exactly like generated\n *   collection routes, then reads through\n *   `getTenantScopedChangesSince()` — a tenant only ever sees its own\n *   changes plus global rows.\n * - **Database resolution**: the route anchors on the project's first\n *   generated collection (alphabetical) via the consumer's existing\n *   `getCollection()` helper, inheriting its configuration, request-scoped\n *   database support and system-table bootstrap. Multi-database projects\n *   (per-object `db` overrides) see the anchor collection's feed.\n * - Cleanup rides the existing generated-route sweep: the emitted file\n *   starts with {@link AUTO_GENERATED_ROUTE_HEADER}.\n */\n\nimport { existsSync, mkdirSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport type {\n  SmartObjectDefinition,\n  SmartObjectManifest,\n} from '../scanner/types';\nimport { AUTO_GENERATED_ROUTE_HEADER } from './route-header.js';\nimport type { SvelteKitOptions } from './sveltekit-generator.js';\n\n/**\n * Mirrors `isCollectionClass` in `sveltekit-generator.ts` (module-private\n * there): collection classes share route paths with their item class and\n * never anchor routes themselves.\n */\nfunction isCollectionDefinition(objectDef: SmartObjectDefinition): boolean {\n  return objectDef.extends === 'SmrtCollection' || !!objectDef.extendsTypeArg;\n}\n\n/**\n * Pick the class the route resolves its database through: the first\n * non-collection object by sorted manifest key, for determinism across\n * builds.\n *\n * Returns the manifest **registry key** verbatim (which may be\n * package-qualified, e.g. `@happyvertical/smrt-ledgers:Account`) — the emitted\n * route passes it straight to `getCollection()`, exactly as the generated CRUD\n * routes do. Collapsing it to a simple class name would resolve ambiguously\n * when two loaded packages declare the same simple name (mirrors the #1778\n * verbatim-key fix and the sync-apply route's `registryKey`).\n */\nfunction resolveAnchorClassName(manifest: SmartObjectManifest): string | null {\n  const sortedNames = Object.keys(manifest.objects).sort();\n  for (const name of sortedNames) {\n    const def = manifest.objects[name];\n    if (def && !isCollectionDefinition(def)) {\n      return name;\n    }\n  }\n  return null;\n}\n\nfunction manifestHasTenantScopedObject(manifest: SmartObjectManifest): boolean {\n  return Object.values(manifest.objects).some(\n    (def) =>\n      !isCollectionDefinition(def) && !!def.decoratorConfig?.tenantScoped,\n  );\n}\n\n/**\n * Generate the `_changes/+server.ts` route. Returns true when a route was\n * written. Disabled with `sveltekit: { changesRoute: { enabled: false } }`;\n * skipped (with a log line) when the manifest has no objects to anchor the\n * database on.\n */\nexport function generateChangesRoute(\n  projectRoot: string,\n  manifest: SmartObjectManifest,\n  options: SvelteKitOptions,\n): boolean {\n  if (options.changesRoute?.enabled === false) {\n    return false;\n  }\n\n  const anchorClassName = resolveAnchorClassName(manifest);\n  if (!anchorClassName) {\n    console.log(\n      '[smrt] Skipping _changes route - no SMRT objects to anchor the database on',\n    );\n    return false;\n  }\n\n  const routeDir = join(projectRoot, options.routesDir, '_changes');\n  const content = generateChangesRouteTemplate(\n    anchorClassName,\n    manifestHasTenantScopedObject(manifest),\n  );\n\n  if (!existsSync(routeDir)) {\n    mkdirSync(routeDir, { recursive: true });\n  }\n  const filePath = join(routeDir, '+server.ts');\n  writeFileSync(filePath, content, 'utf-8');\n  console.log(`[smrt] Generated: ${filePath}`);\n  return true;\n}\n\nfunction generateChangesRouteTemplate(\n  anchorClassName: string,\n  tenantScoped: boolean,\n): string {\n  const tenantHelper = tenantScoped\n    ? `\nimport { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenancy';\n\nfunction establishTenantContext(locals: unknown): void {\n  if (hasTenantContext()) return;\n  if (!locals || typeof locals !== 'object') return;\n  const l = locals as Record<string, unknown>;\n  const user = l.user as Record<string, unknown> | undefined;\n  const session = l.session as Record<string, unknown> | undefined;\n  const tenantId = l.tenantId ?? user?.tenantId ?? session?.tenantId;\n  if (typeof tenantId === 'string' && tenantId) {\n    enterTenantContext({ tenantId });\n  }\n}\n`\n    : '';\n  const tenantCall = tenantScoped ? '\\n  establishTenantContext(locals);' : '';\n\n  return `${AUTO_GENERATED_ROUTE_HEADER}\n// DO NOT EDIT - changes will be overwritten\n//\n// GET /_changes — cursor read over the _smrt_changes change feed (#1758).\n// Part of the client/mobile sync contract: poll with the returned cursor to\n// observe every committed framework save/delete (deletes are tombstones)\n// exactly once. Query params: since (cursor, default 0), tables\n// (comma-separated), limit. A response with resyncRequired: true (still\n// HTTP 200 — protocol state, not an error) means the cursor cannot be\n// served incrementally (pruned or foreign) and the client must re-fetch\n// in full before resuming polling.\n\nimport { error, json } from '@sveltejs/kit';\nimport { getTenantScopedChangesSince } from '@happyvertical/smrt-core';\nimport { getCollection } from '$lib/server/smrt';\nimport type { RequestHandler } from './$types';\n\n// Fail-closed authorization (#1540): the change feed spans every table, so\n// it is never public — an authenticated principal on \\`locals\\` is required.\nfunction hasAuthenticatedPrincipal(locals: unknown): boolean {\n  if (!locals || typeof locals !== 'object') return false;\n  const l = locals as Record<string, unknown>;\n  const isResolvedPrincipal = (v: unknown) =>\n    typeof v === 'object' && v !== null;\n  return (\n    isResolvedPrincipal(l.user) ||\n    isResolvedPrincipal(l.session) ||\n    l.smrtAuth === true\n  );\n}\n\nfunction requireRouteAuth(locals: unknown): void {\n  if (!hasAuthenticatedPrincipal(locals)) {\n    throw error(401, 'Authentication required');\n  }\n}\n${tenantHelper}\nexport const GET: RequestHandler = async ({ locals, url }) => {\n  requireRouteAuth(locals);${tenantCall}\n\n  const since = Number(url.searchParams.get('since') ?? '0');\n  if (!Number.isFinite(since) || since < 0) {\n    throw error(400, \"'since' must be a non-negative number\");\n  }\n\n  let limit: number | undefined;\n  const limitParam = url.searchParams.get('limit');\n  if (limitParam !== null) {\n    limit = Number(limitParam);\n    if (!Number.isFinite(limit) || limit < 1) {\n      throw error(400, \"'limit' must be a positive number\");\n    }\n  }\n\n  const tablesParam = url.searchParams.get('tables');\n  const tables = tablesParam\n    ? tablesParam\n        .split(',')\n        .map((table) => table.trim())\n        .filter(Boolean)\n    : undefined;\n\n  // The feed lives in the project's database; anchor on the\n  // ${anchorClassName} collection to reuse its configured connection.\n  const collection = await getCollection('${anchorClassName}');\n  const page = await getTenantScopedChangesSince(collection.db, {\n    since,\n    tables,\n    limit,\n  });\n  return json(page);\n};\n`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,SAAS,uBAAuB,WAA2C;CACzE,OAAO,UAAU,YAAY,oBAAoB,CAAC,CAAC,UAAU;AAC/D;;;;;;;;;;;;;AAcA,SAAS,uBAAuB,UAA8C;CAC5E,MAAM,cAAc,OAAO,KAAK,SAAS,OAAO,CAAC,CAAC,KAAK;CACvD,KAAK,MAAM,QAAQ,aAAa;EAC9B,MAAM,MAAM,SAAS,QAAQ;EAC7B,IAAI,OAAO,CAAC,uBAAuB,GAAG,GACpC,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAS,8BAA8B,UAAwC;CAC7E,OAAO,OAAO,OAAO,SAAS,OAAO,CAAC,CAAC,MACpC,QACC,CAAC,uBAAuB,GAAG,KAAK,CAAC,CAAC,IAAI,iBAAiB,YAC3D;AACF;;;;;;;AAQA,SAAgB,qBACd,aACA,UACA,SACS;CACT,IAAI,QAAQ,cAAc,YAAY,OACpC,OAAO;CAGT,MAAM,kBAAkB,uBAAuB,QAAQ;CACvD,IAAI,CAAC,iBAAiB;EACpB,QAAQ,IACN,4EACF;EACA,OAAO;CACT;CAEA,MAAM,WAAW,KAAK,aAAa,QAAQ,WAAW,UAAU;CAChE,MAAM,UAAU,6BACd,iBACA,8BAA8B,QAAQ,CACxC;CAEA,IAAI,CAAC,WAAW,QAAQ,GACtB,UAAU,UAAU,EAAE,WAAW,KAAK,CAAC;CAEzC,MAAM,WAAW,KAAK,UAAU,YAAY;CAC5C,cAAc,UAAU,SAAS,OAAO;CACxC,QAAQ,IAAI,qBAAqB,UAAU;CAC3C,OAAO;AACT;AAEA,SAAS,6BACP,iBACA,cACQ;CAoBR,OAAO,GAAG,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAnBjB,eACjB;;;;;;;;;;;;;;IAeA,GAuCS;;6BAtCM,eAAe,wCAAwC,GAwCpC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBjC,gBAAgB;4CACqB,gBAAgB;;;;;;;;;AAS5D"}

package/dist/vite-plugin/index.d.ts

@@ -46,6 +46,13 @@ export interface SmrtPluginOptions {
          * the next major. An explicit `api.routes[name].path` always wins.
          */
         kebabRoutes?: boolean;
+        /**
+         * Change-feed `_changes` route generation (#1758). Enabled by default
+         * (the route is auth-guarded fail-closed); `{ enabled: false }` skips it.
+         */
+        changesRoute?: {
+            enabled?: boolean;
+        };
     };
     /** Domain-scoped agent/developer knowledge artifact generation. */
     knowledge?: DomainKnowledgeConfig | false;

package/dist/vite-plugin/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite-plugin/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAiC,MAAM,MAAM,CAAC;AAGlE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAa5D,YAAY,EACV,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAalC,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qBAAqB;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpC;;OAEG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,8CAA8C;IAC9C,SAAS,CAAC,EAAE;QACV,yDAAyD;QACzD,OAAO,EAAE,OAAO,CAAC;QACjB,wEAAwE;QACxE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,qEAAqE;QACrE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mEAAmE;QACnE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mDAAmD;QACnD,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;WAIG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,mEAAmE;IACnE,SAAS,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IAC1C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AA8BD,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,mBAAmB,GAC5B,MAAM,CAaR;AAED,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CA04BlE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite-plugin/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAiC,MAAM,MAAM,CAAC;AAIlE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAa5D,YAAY,EACV,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAalC,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qBAAqB;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpC;;OAEG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,8CAA8C;IAC9C,SAAS,CAAC,EAAE;QACV,yDAAyD;QACzD,OAAO,EAAE,OAAO,CAAC;QACjB,wEAAwE;QACxE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,qEAAqE;QACrE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mEAAmE;QACnE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mDAAmD;QACnD,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;WAIG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;WAGG;QACH,YAAY,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KACtC,CAAC;IACF,mEAAmE;IACnE,SAAS,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IAC1C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AA8BD,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,mBAAmB,GAC5B,MAAM,CAaR;AAED,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CA84BlE"}

package/dist/vite-plugin/index.js

@@ -1,6 +1,7 @@
 import { buildDomainKnowledgeManifest } from "../knowledge.js";
 import { importWorkspaceModule } from "../utils/import-workspace-module.js";
 import { discoverSmrtPackages } from "../manifest/discover-smrt-packages.js";
+import { CLIENT_FETCH_RUNTIME } from "../generated-client-runtime.js";
 import { importBuildAwareModule } from "./import-build-aware.js";
 import { findCliApiCoherenceViolations, generateSvelteKitRoutes, methodNameToKebab, resolveApiActionSet, validateCliIncludeAgainstApi } from "./sveltekit-generator.js";
 import { existsSync, readFileSync } from "node:fs";
@@ -256,6 +257,7 @@ function smrtPlugin(options = {}) {
 				configPath: svelteKit.configPath || "src/lib/server",
 				configFileName: svelteKit.configFileName || "smrt.ts",
 				kebabRoutes: svelteKit.kebabRoutes ?? false,
+				changesRoute: svelteKit.changesRoute,
 				knowledge: await resolveKnowledgeConfig(resolvedConfig.root, manifest)
 			});
 		},
@@ -319,6 +321,7 @@ function smrtPlugin(options = {}) {
 								configPath: svelteKit.configPath || "src/lib/server",
 								configFileName: svelteKit.configFileName || "smrt.ts",
 								kebabRoutes: svelteKit.kebabRoutes ?? false,
+								changesRoute: svelteKit.changesRoute,
 								knowledge: await resolveKnowledgeConfig(server.config.root, manifest)
 							});
 							Object.values(VIRTUAL_MODULES).forEach((id) => {
@@ -346,6 +349,7 @@ function smrtPlugin(options = {}) {
 								configPath: svelteKit.configPath || "src/lib/server",
 								configFileName: svelteKit.configFileName || "smrt.ts",
 								kebabRoutes: svelteKit.kebabRoutes ?? false,
+								changesRoute: svelteKit.changesRoute,
 								knowledge: await resolveKnowledgeConfig(server.config.root, manifest)
 							});
 						}
@@ -369,6 +373,7 @@ function smrtPlugin(options = {}) {
 								configPath: svelteKit.configPath || "src/lib/server",
 								configFileName: svelteKit.configFileName || "smrt.ts",
 								kebabRoutes: svelteKit.kebabRoutes ?? false,
+								changesRoute: svelteKit.changesRoute,
 								knowledge: await resolveKnowledgeConfig(server.config.root, manifest)
 							});
 						}
@@ -600,6 +605,8 @@ function generateClientModule(manifest, options = {}) {
 // Auto-generated API client from SMRT objects
 // This file is generated automatically - do not edit
 
+${CLIENT_FETCH_RUNTIME}
+
 export function createClient(basePath = '/api/v1') {
   return {${uniqueApiClientEntries(Object.entries(manifest.objects)).map(({ obj, clientKey }) => {
 		const { collection, methods = {} } = obj;
@@ -616,45 +623,45 @@ export function createClient(basePath = '/api/v1') {
 			return options.kebabRoutes ? methodNameToKebab(methodName) : methodName;
 		};
 		const customMethodImpls = customMethods.map(([methodName, _method]) => {
-			return `    ${methodName}: (id, options) => fetch(basePath + '/${collection}/' + id + '/${segmentFor(methodName)}', {
+			return `    ${methodName}: (id, options) => __smrtFetchJson(basePath + '/${collection}/' + id + '/${segmentFor(methodName)}', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(options || {})
-    }).then(r => r.json())`;
+    })`;
 		}).join(",\n");
 		return `
   ${clientKey}: {
-    list: (params) => fetch(basePath + '/${collection}', {
+    list: (params) => __smrtFetchJson(basePath + '/${collection}', {
       method: 'GET',
       headers: { 'Content-Type': 'application/json' }
-    }).then(r => r.json()),
+    }),
 
-    get: (id) => fetch(basePath + '/${collection}/' + id, {
+    get: (id) => __smrtFetchJson(basePath + '/${collection}/' + id, {
       method: 'GET',
       headers: { 'Content-Type': 'application/json' }
-    }).then(r => r.json()),
+    }),
 
-    create: (data) => fetch(basePath + '/${collection}', {
+    create: (data) => __smrtFetchJson(basePath + '/${collection}', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(data)
-    }).then(r => r.json()),
+    }),
 
-    update: (id, data) => fetch(basePath + '/${collection}/' + id, {
+    update: (id, data) => __smrtFetchJson(basePath + '/${collection}/' + id, {
       method: 'PUT',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(data)
-    }).then(r => r.json()),
+    }),
 
-    delete: (id) => fetch(basePath + '/${collection}/' + id, {
+    delete: (id) => __smrtFetchOk(basePath + '/${collection}/' + id, {
       method: 'DELETE',
       headers: { 'Content-Type': 'application/json' }
-    }).then(r => r.ok),
+    }),
 
-    search: (query) => fetch(basePath + '/${collection}/search?q=' + encodeURIComponent(query), {
+    search: (query) => __smrtFetchJson(basePath + '/${collection}/search?q=' + encodeURIComponent(query), {
       method: 'GET',
       headers: { 'Content-Type': 'application/json' }
-    }).then(r => r.json())${customMethods.length > 0 ? `,\n${customMethodImpls}` : ""}
+    })${customMethods.length > 0 ? `,\n${customMethodImpls}` : ""}
   }`;
 	}).join(",")}
   };
@@ -835,8 +842,8 @@ async function generateTypeDeclarationFile(manifest, projectRoot, typeDeclaratio
 ${Object.entries(obj.fields).map(([fieldName, field]) => {
 				return `    ${fieldName}${field.required === false ? "?" : ""}: ${mapTypeScriptType(field.type)};`;
 			}).join("\n")}
-    createdAt?: string;
-    updatedAt?: string;
+    created_at?: string;
+    updated_at?: string;
   }`;
 		}).join("\n\n");
 		const apiClientInterface = uniqueApiClientEntries(Object.entries(manifest.objects)).map(({ obj, clientKey }) => {
@@ -922,15 +929,26 @@ declare module '@happyvertical/smrt-virt-routes' {
   export default setupRoutes;
 }
 
-// Client module - Auto-generated API client  
+// Client module - Auto-generated API client
+// Wire-shape policy (#1797): the server returns BARE JSON — a bare array for
+// list/search, a bare object for get/create/update — with snake_case field
+// names (created_at, updated_at). These declarations match that shape (no
+// envelope, no camelCase). Fetchers reject on non-2xx with a SmrtClientError
+// (#1796). This is byte-identical to the prebuild declaration path.
 declare module '@happyvertical/smrt-virt-client' {
-  export interface ApiResponse<T = any> {
-    id?: string;
-    data?: T;
+  /** Shape of a JSON error body carried by a rejected request (SmrtClientError.body). */
+  export interface ApiError {
     error?: string;
     message?: string;
   }
 
+  /** Typed error thrown by every fetcher on a non-2xx response (#1796). */
+  export interface SmrtClientError extends Error {
+    name: 'SmrtClientError';
+    status: number;
+    body?: ApiError | string;
+  }
+
   export interface CrudOperations<T = any> {
     list(params?: Record<string, any>): Promise<T[]>;
     get(id: string): Promise<T>;