@happyvertical/smrt-core 0.37.8 → 0.37.10

package/dist/vite-plugin/changes-route.js

@@ -0,0 +1,174 @@
+import { AUTO_GENERATED_ROUTE_HEADER } from "./route-header.js";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+//#region src/vite-plugin/changes-route.ts
+/**
+* SvelteKit `_changes` route generation for the change feed (issue #1758).
+*
+* Emits `{routesDir}/_changes/+server.ts` — an auth-guarded, tenant-scoped
+* GET endpoint over the `_smrt_changes` log, part of the client/mobile sync
+* contract (PRD #1755). Kept in its own module so `sveltekit-generator.ts`
+* only carries a one-line registration.
+*
+* Design notes:
+* - **Fail-closed auth** (#1540 posture): the handler requires an
+*   authenticated principal on `locals`. The feed spans every table, so
+*   per-model `api: { public }` opt-outs deliberately do not apply.
+* - **Tenant scoping**: when the project has tenant-scoped objects, the
+*   route establishes tenant context from `locals` exactly like generated
+*   collection routes, then reads through
+*   `getTenantScopedChangesSince()` — a tenant only ever sees its own
+*   changes plus global rows.
+* - **Database resolution**: the route anchors on the project's first
+*   generated collection (alphabetical) via the consumer's existing
+*   `getCollection()` helper, inheriting its configuration, request-scoped
+*   database support and system-table bootstrap. Multi-database projects
+*   (per-object `db` overrides) see the anchor collection's feed.
+* - Cleanup rides the existing generated-route sweep: the emitted file
+*   starts with {@link AUTO_GENERATED_ROUTE_HEADER}.
+*/
+/**
+* Mirrors `isCollectionClass` in `sveltekit-generator.ts` (module-private
+* there): collection classes share route paths with their item class and
+* never anchor routes themselves.
+*/
+function isCollectionDefinition(objectDef) {
+	return objectDef.extends === "SmrtCollection" || !!objectDef.extendsTypeArg;
+}
+/**
+* Pick the class the route resolves its database through: the first
+* non-collection object by sorted manifest key, for determinism across
+* builds.
+*
+* Returns the manifest **registry key** verbatim (which may be
+* package-qualified, e.g. `@happyvertical/smrt-ledgers:Account`) — the emitted
+* route passes it straight to `getCollection()`, exactly as the generated CRUD
+* routes do. Collapsing it to a simple class name would resolve ambiguously
+* when two loaded packages declare the same simple name (mirrors the #1778
+* verbatim-key fix and the sync-apply route's `registryKey`).
+*/
+function resolveAnchorClassName(manifest) {
+	const sortedNames = Object.keys(manifest.objects).sort();
+	for (const name of sortedNames) {
+		const def = manifest.objects[name];
+		if (def && !isCollectionDefinition(def)) return name;
+	}
+	return null;
+}
+function manifestHasTenantScopedObject(manifest) {
+	return Object.values(manifest.objects).some((def) => !isCollectionDefinition(def) && !!def.decoratorConfig?.tenantScoped);
+}
+/**
+* Generate the `_changes/+server.ts` route. Returns true when a route was
+* written. Disabled with `sveltekit: { changesRoute: { enabled: false } }`;
+* skipped (with a log line) when the manifest has no objects to anchor the
+* database on.
+*/
+function generateChangesRoute(projectRoot, manifest, options) {
+	if (options.changesRoute?.enabled === false) return false;
+	const anchorClassName = resolveAnchorClassName(manifest);
+	if (!anchorClassName) {
+		console.log("[smrt] Skipping _changes route - no SMRT objects to anchor the database on");
+		return false;
+	}
+	const routeDir = join(projectRoot, options.routesDir, "_changes");
+	const content = generateChangesRouteTemplate(anchorClassName, manifestHasTenantScopedObject(manifest));
+	if (!existsSync(routeDir)) mkdirSync(routeDir, { recursive: true });
+	const filePath = join(routeDir, "+server.ts");
+	writeFileSync(filePath, content, "utf-8");
+	console.log(`[smrt] Generated: ${filePath}`);
+	return true;
+}
+function generateChangesRouteTemplate(anchorClassName, tenantScoped) {
+	return `${AUTO_GENERATED_ROUTE_HEADER}
+// DO NOT EDIT - changes will be overwritten
+//
+// GET /_changes — cursor read over the _smrt_changes change feed (#1758).
+// Part of the client/mobile sync contract: poll with the returned cursor to
+// observe every committed framework save/delete (deletes are tombstones)
+// exactly once. Query params: since (cursor, default 0), tables
+// (comma-separated), limit. A response with resyncRequired: true (still
+// HTTP 200 — protocol state, not an error) means the cursor cannot be
+// served incrementally (pruned or foreign) and the client must re-fetch
+// in full before resuming polling.
+
+import { error, json } from '@sveltejs/kit';
+import { getTenantScopedChangesSince } from '@happyvertical/smrt-core';
+import { getCollection } from '$lib/server/smrt';
+import type { RequestHandler } from './$types';
+
+// Fail-closed authorization (#1540): the change feed spans every table, so
+// it is never public — an authenticated principal on \`locals\` is required.
+function hasAuthenticatedPrincipal(locals: unknown): boolean {
+  if (!locals || typeof locals !== 'object') return false;
+  const l = locals as Record<string, unknown>;
+  const isResolvedPrincipal = (v: unknown) =>
+    typeof v === 'object' && v !== null;
+  return (
+    isResolvedPrincipal(l.user) ||
+    isResolvedPrincipal(l.session) ||
+    l.smrtAuth === true
+  );
+}
+
+function requireRouteAuth(locals: unknown): void {
+  if (!hasAuthenticatedPrincipal(locals)) {
+    throw error(401, 'Authentication required');
+  }
+}
+${tenantScoped ? `
+import { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenancy';
+
+function establishTenantContext(locals: unknown): void {
+  if (hasTenantContext()) return;
+  if (!locals || typeof locals !== 'object') return;
+  const l = locals as Record<string, unknown>;
+  const user = l.user as Record<string, unknown> | undefined;
+  const session = l.session as Record<string, unknown> | undefined;
+  const tenantId = l.tenantId ?? user?.tenantId ?? session?.tenantId;
+  if (typeof tenantId === 'string' && tenantId) {
+    enterTenantContext({ tenantId });
+  }
+}
+` : ""}
+export const GET: RequestHandler = async ({ locals, url }) => {
+  requireRouteAuth(locals);${tenantScoped ? "\n  establishTenantContext(locals);" : ""}
+
+  const since = Number(url.searchParams.get('since') ?? '0');
+  if (!Number.isFinite(since) || since < 0) {
+    throw error(400, "'since' must be a non-negative number");
+  }
+
+  let limit: number | undefined;
+  const limitParam = url.searchParams.get('limit');
+  if (limitParam !== null) {
+    limit = Number(limitParam);
+    if (!Number.isFinite(limit) || limit < 1) {
+      throw error(400, "'limit' must be a positive number");
+    }
+  }
+
+  const tablesParam = url.searchParams.get('tables');
+  const tables = tablesParam
+    ? tablesParam
+        .split(',')
+        .map((table) => table.trim())
+        .filter(Boolean)
+    : undefined;
+
+  // The feed lives in the project's database; anchor on the
+  // ${anchorClassName} collection to reuse its configured connection.
+  const collection = await getCollection('${anchorClassName}');
+  const page = await getTenantScopedChangesSince(collection.db, {
+    since,
+    tables,
+    limit,
+  });
+  return json(page);
+};
+`;
+}
+//#endregion
+export { generateChangesRoute };
+
+//# sourceMappingURL=changes-route.js.map

package/dist/vite-plugin/changes-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes-route.js","names":[],"sources":["../../src/vite-plugin/changes-route.ts"],"sourcesContent":["/**\n * SvelteKit `_changes` route generation for the change feed (issue #1758).\n *\n * Emits `{routesDir}/_changes/+server.ts` — an auth-guarded, tenant-scoped\n * GET endpoint over the `_smrt_changes` log, part of the client/mobile sync\n * contract (PRD #1755). Kept in its own module so `sveltekit-generator.ts`\n * only carries a one-line registration.\n *\n * Design notes:\n * - **Fail-closed auth** (#1540 posture): the handler requires an\n *   authenticated principal on `locals`. The feed spans every table, so\n *   per-model `api: { public }` opt-outs deliberately do not apply.\n * - **Tenant scoping**: when the project has tenant-scoped objects, the\n *   route establishes tenant context from `locals` exactly like generated\n *   collection routes, then reads through\n *   `getTenantScopedChangesSince()` — a tenant only ever sees its own\n *   changes plus global rows.\n * - **Database resolution**: the route anchors on the project's first\n *   generated collection (alphabetical) via the consumer's existing\n *   `getCollection()` helper, inheriting its configuration, request-scoped\n *   database support and system-table bootstrap. Multi-database projects\n *   (per-object `db` overrides) see the anchor collection's feed.\n * - Cleanup rides the existing generated-route sweep: the emitted file\n *   starts with {@link AUTO_GENERATED_ROUTE_HEADER}.\n */\n\nimport { existsSync, mkdirSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport type {\n  SmartObjectDefinition,\n  SmartObjectManifest,\n} from '../scanner/types';\nimport { AUTO_GENERATED_ROUTE_HEADER } from './route-header.js';\nimport type { SvelteKitOptions } from './sveltekit-generator.js';\n\n/**\n * Mirrors `isCollectionClass` in `sveltekit-generator.ts` (module-private\n * there): collection classes share route paths with their item class and\n * never anchor routes themselves.\n */\nfunction isCollectionDefinition(objectDef: SmartObjectDefinition): boolean {\n  return objectDef.extends === 'SmrtCollection' || !!objectDef.extendsTypeArg;\n}\n\n/**\n * Pick the class the route resolves its database through: the first\n * non-collection object by sorted manifest key, for determinism across\n * builds.\n *\n * Returns the manifest **registry key** verbatim (which may be\n * package-qualified, e.g. `@happyvertical/smrt-ledgers:Account`) — the emitted\n * route passes it straight to `getCollection()`, exactly as the generated CRUD\n * routes do. Collapsing it to a simple class name would resolve ambiguously\n * when two loaded packages declare the same simple name (mirrors the #1778\n * verbatim-key fix and the sync-apply route's `registryKey`).\n */\nfunction resolveAnchorClassName(manifest: SmartObjectManifest): string | null {\n  const sortedNames = Object.keys(manifest.objects).sort();\n  for (const name of sortedNames) {\n    const def = manifest.objects[name];\n    if (def && !isCollectionDefinition(def)) {\n      return name;\n    }\n  }\n  return null;\n}\n\nfunction manifestHasTenantScopedObject(manifest: SmartObjectManifest): boolean {\n  return Object.values(manifest.objects).some(\n    (def) =>\n      !isCollectionDefinition(def) && !!def.decoratorConfig?.tenantScoped,\n  );\n}\n\n/**\n * Generate the `_changes/+server.ts` route. Returns true when a route was\n * written. Disabled with `sveltekit: { changesRoute: { enabled: false } }`;\n * skipped (with a log line) when the manifest has no objects to anchor the\n * database on.\n */\nexport function generateChangesRoute(\n  projectRoot: string,\n  manifest: SmartObjectManifest,\n  options: SvelteKitOptions,\n): boolean {\n  if (options.changesRoute?.enabled === false) {\n    return false;\n  }\n\n  const anchorClassName = resolveAnchorClassName(manifest);\n  if (!anchorClassName) {\n    console.log(\n      '[smrt] Skipping _changes route - no SMRT objects to anchor the database on',\n    );\n    return false;\n  }\n\n  const routeDir = join(projectRoot, options.routesDir, '_changes');\n  const content = generateChangesRouteTemplate(\n    anchorClassName,\n    manifestHasTenantScopedObject(manifest),\n  );\n\n  if (!existsSync(routeDir)) {\n    mkdirSync(routeDir, { recursive: true });\n  }\n  const filePath = join(routeDir, '+server.ts');\n  writeFileSync(filePath, content, 'utf-8');\n  console.log(`[smrt] Generated: ${filePath}`);\n  return true;\n}\n\nfunction generateChangesRouteTemplate(\n  anchorClassName: string,\n  tenantScoped: boolean,\n): string {\n  const tenantHelper = tenantScoped\n    ? `\nimport { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenancy';\n\nfunction establishTenantContext(locals: unknown): void {\n  if (hasTenantContext()) return;\n  if (!locals || typeof locals !== 'object') return;\n  const l = locals as Record<string, unknown>;\n  const user = l.user as Record<string, unknown> | undefined;\n  const session = l.session as Record<string, unknown> | undefined;\n  const tenantId = l.tenantId ?? user?.tenantId ?? session?.tenantId;\n  if (typeof tenantId === 'string' && tenantId) {\n    enterTenantContext({ tenantId });\n  }\n}\n`\n    : '';\n  const tenantCall = tenantScoped ? '\\n  establishTenantContext(locals);' : '';\n\n  return `${AUTO_GENERATED_ROUTE_HEADER}\n// DO NOT EDIT - changes will be overwritten\n//\n// GET /_changes — cursor read over the _smrt_changes change feed (#1758).\n// Part of the client/mobile sync contract: poll with the returned cursor to\n// observe every committed framework save/delete (deletes are tombstones)\n// exactly once. Query params: since (cursor, default 0), tables\n// (comma-separated), limit. A response with resyncRequired: true (still\n// HTTP 200 — protocol state, not an error) means the cursor cannot be\n// served incrementally (pruned or foreign) and the client must re-fetch\n// in full before resuming polling.\n\nimport { error, json } from '@sveltejs/kit';\nimport { getTenantScopedChangesSince } from '@happyvertical/smrt-core';\nimport { getCollection } from '$lib/server/smrt';\nimport type { RequestHandler } from './$types';\n\n// Fail-closed authorization (#1540): the change feed spans every table, so\n// it is never public — an authenticated principal on \\`locals\\` is required.\nfunction hasAuthenticatedPrincipal(locals: unknown): boolean {\n  if (!locals || typeof locals !== 'object') return false;\n  const l = locals as Record<string, unknown>;\n  const isResolvedPrincipal = (v: unknown) =>\n    typeof v === 'object' && v !== null;\n  return (\n    isResolvedPrincipal(l.user) ||\n    isResolvedPrincipal(l.session) ||\n    l.smrtAuth === true\n  );\n}\n\nfunction requireRouteAuth(locals: unknown): void {\n  if (!hasAuthenticatedPrincipal(locals)) {\n    throw error(401, 'Authentication required');\n  }\n}\n${tenantHelper}\nexport const GET: RequestHandler = async ({ locals, url }) => {\n  requireRouteAuth(locals);${tenantCall}\n\n  const since = Number(url.searchParams.get('since') ?? '0');\n  if (!Number.isFinite(since) || since < 0) {\n    throw error(400, \"'since' must be a non-negative number\");\n  }\n\n  let limit: number | undefined;\n  const limitParam = url.searchParams.get('limit');\n  if (limitParam !== null) {\n    limit = Number(limitParam);\n    if (!Number.isFinite(limit) || limit < 1) {\n      throw error(400, \"'limit' must be a positive number\");\n    }\n  }\n\n  const tablesParam = url.searchParams.get('tables');\n  const tables = tablesParam\n    ? tablesParam\n        .split(',')\n        .map((table) => table.trim())\n        .filter(Boolean)\n    : undefined;\n\n  // The feed lives in the project's database; anchor on the\n  // ${anchorClassName} collection to reuse its configured connection.\n  const collection = await getCollection('${anchorClassName}');\n  const page = await getTenantScopedChangesSince(collection.db, {\n    since,\n    tables,\n    limit,\n  });\n  return json(page);\n};\n`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,SAAS,uBAAuB,WAA2C;CACzE,OAAO,UAAU,YAAY,oBAAoB,CAAC,CAAC,UAAU;AAC/D;;;;;;;;;;;;;AAcA,SAAS,uBAAuB,UAA8C;CAC5E,MAAM,cAAc,OAAO,KAAK,SAAS,OAAO,CAAC,CAAC,KAAK;CACvD,KAAK,MAAM,QAAQ,aAAa;EAC9B,MAAM,MAAM,SAAS,QAAQ;EAC7B,IAAI,OAAO,CAAC,uBAAuB,GAAG,GACpC,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAS,8BAA8B,UAAwC;CAC7E,OAAO,OAAO,OAAO,SAAS,OAAO,CAAC,CAAC,MACpC,QACC,CAAC,uBAAuB,GAAG,KAAK,CAAC,CAAC,IAAI,iBAAiB,YAC3D;AACF;;;;;;;AAQA,SAAgB,qBACd,aACA,UACA,SACS;CACT,IAAI,QAAQ,cAAc,YAAY,OACpC,OAAO;CAGT,MAAM,kBAAkB,uBAAuB,QAAQ;CACvD,IAAI,CAAC,iBAAiB;EACpB,QAAQ,IACN,4EACF;EACA,OAAO;CACT;CAEA,MAAM,WAAW,KAAK,aAAa,QAAQ,WAAW,UAAU;CAChE,MAAM,UAAU,6BACd,iBACA,8BAA8B,QAAQ,CACxC;CAEA,IAAI,CAAC,WAAW,QAAQ,GACtB,UAAU,UAAU,EAAE,WAAW,KAAK,CAAC;CAEzC,MAAM,WAAW,KAAK,UAAU,YAAY;CAC5C,cAAc,UAAU,SAAS,OAAO;CACxC,QAAQ,IAAI,qBAAqB,UAAU;CAC3C,OAAO;AACT;AAEA,SAAS,6BACP,iBACA,cACQ;CAoBR,OAAO,GAAG,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAnBjB,eACjB;;;;;;;;;;;;;;IAeA,GAuCS;;6BAtCM,eAAe,wCAAwC,GAwCpC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBjC,gBAAgB;4CACqB,gBAAgB;;;;;;;;;AAS5D"}

package/dist/vite-plugin/index.d.ts

@@ -46,6 +46,13 @@ export interface SmrtPluginOptions {
          * the next major. An explicit `api.routes[name].path` always wins.
          */
         kebabRoutes?: boolean;
+        /**
+         * Change-feed `_changes` route generation (#1758). Enabled by default
+         * (the route is auth-guarded fail-closed); `{ enabled: false }` skips it.
+         */
+        changesRoute?: {
+            enabled?: boolean;
+        };
     };
     /** Domain-scoped agent/developer knowledge artifact generation. */
     knowledge?: DomainKnowledgeConfig | false;

package/dist/vite-plugin/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite-plugin/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAiC,MAAM,MAAM,CAAC;AAGlE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAa5D,YAAY,EACV,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAalC,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qBAAqB;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpC;;OAEG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,8CAA8C;IAC9C,SAAS,CAAC,EAAE;QACV,yDAAyD;QACzD,OAAO,EAAE,OAAO,CAAC;QACjB,wEAAwE;QACxE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,qEAAqE;QACrE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mEAAmE;QACnE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mDAAmD;QACnD,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;WAIG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF,mEAAmE;IACnE,SAAS,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IAC1C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AA8BD,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,mBAAmB,GAC5B,MAAM,CAaR;AAED,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CA04BlE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite-plugin/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAiC,MAAM,MAAM,CAAC;AAIlE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAkB5D,YAAY,EACV,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAalC,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qBAAqB;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpC;;OAEG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,8CAA8C;IAC9C,SAAS,CAAC,EAAE;QACV,yDAAyD;QACzD,OAAO,EAAE,OAAO,CAAC;QACjB,wEAAwE;QACxE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,qEAAqE;QACrE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mEAAmE;QACnE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mDAAmD;QACnD,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;WAIG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;WAGG;QACH,YAAY,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KACtC,CAAC;IACF,mEAAmE;IACnE,SAAS,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IAC1C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AA+BD,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,mBAAmB,GAC5B,MAAM,CAaR;AAED,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CAm5BlE"}

package/dist/vite-plugin/index.js

@@ -1,8 +1,10 @@
 import { buildDomainKnowledgeManifest } from "../knowledge.js";
 import { importWorkspaceModule } from "../utils/import-workspace-module.js";
 import { discoverSmrtPackages } from "../manifest/discover-smrt-packages.js";
+import { CLIENT_FETCH_RUNTIME } from "../generated-client-runtime.js";
 import { importBuildAwareModule } from "./import-build-aware.js";
 import { findCliApiCoherenceViolations, generateSvelteKitRoutes, methodNameToKebab, resolveApiActionSet, validateCliIncludeAgainstApi } from "./sveltekit-generator.js";
+import { buildWebFieldDefinitions, buildWebRelationships, selectWebCollectionEntries } from "./web-collections.js";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -19,7 +21,8 @@ var VIRTUAL_MODULES = {
 	"@happyvertical/smrt-virt-manifest": "smrt:manifest",
 	"@happyvertical/smrt-virt-schema": "smrt:schema",
 	"@happyvertical/smrt-virt-ui": "smrt:ui",
-	"@happyvertical/smrt-virt-cli": "smrt:cli"
+	"@happyvertical/smrt-virt-cli": "smrt:cli",
+	"@happyvertical/smrt-virt-web": "smrt:web"
 };
 async function importScanner() {
 	return importWorkspaceModule({
@@ -256,6 +259,7 @@ function smrtPlugin(options = {}) {
 				configPath: svelteKit.configPath || "src/lib/server",
 				configFileName: svelteKit.configFileName || "smrt.ts",
 				kebabRoutes: svelteKit.kebabRoutes ?? false,
+				changesRoute: svelteKit.changesRoute,
 				knowledge: await resolveKnowledgeConfig(resolvedConfig.root, manifest)
 			});
 		},
@@ -319,6 +323,7 @@ function smrtPlugin(options = {}) {
 								configPath: svelteKit.configPath || "src/lib/server",
 								configFileName: svelteKit.configFileName || "smrt.ts",
 								kebabRoutes: svelteKit.kebabRoutes ?? false,
+								changesRoute: svelteKit.changesRoute,
 								knowledge: await resolveKnowledgeConfig(server.config.root, manifest)
 							});
 							Object.values(VIRTUAL_MODULES).forEach((id) => {
@@ -346,6 +351,7 @@ function smrtPlugin(options = {}) {
 								configPath: svelteKit.configPath || "src/lib/server",
 								configFileName: svelteKit.configFileName || "smrt.ts",
 								kebabRoutes: svelteKit.kebabRoutes ?? false,
+								changesRoute: svelteKit.changesRoute,
 								knowledge: await resolveKnowledgeConfig(server.config.root, manifest)
 							});
 						}
@@ -369,6 +375,7 @@ function smrtPlugin(options = {}) {
 								configPath: svelteKit.configPath || "src/lib/server",
 								configFileName: svelteKit.configFileName || "smrt.ts",
 								kebabRoutes: svelteKit.kebabRoutes ?? false,
+								changesRoute: svelteKit.changesRoute,
 								knowledge: await resolveKnowledgeConfig(server.config.root, manifest)
 							});
 						}
@@ -396,6 +403,7 @@ function smrtPlugin(options = {}) {
 				case "smrt:ui": return await loadDefaultUI();
 				case "smrt:index-html": return await loadDefaultHTML();
 				case "smrt:cli": return await generateCLIModule(manifest);
+				case "smrt:web": return generateWebModule(manifest);
 				default: return null;
 			}
 		},
@@ -600,6 +608,8 @@ function generateClientModule(manifest, options = {}) {
 // Auto-generated API client from SMRT objects
 // This file is generated automatically - do not edit
 
+${CLIENT_FETCH_RUNTIME}
+
 export function createClient(basePath = '/api/v1') {
   return {${uniqueApiClientEntries(Object.entries(manifest.objects)).map(({ obj, clientKey }) => {
 		const { collection, methods = {} } = obj;
@@ -616,45 +626,45 @@ export function createClient(basePath = '/api/v1') {
 			return options.kebabRoutes ? methodNameToKebab(methodName) : methodName;
 		};
 		const customMethodImpls = customMethods.map(([methodName, _method]) => {
-			return `    ${methodName}: (id, options) => fetch(basePath + '/${collection}/' + id + '/${segmentFor(methodName)}', {
+			return `    ${methodName}: (id, options) => __smrtFetchJson(basePath + '/${collection}/' + id + '/${segmentFor(methodName)}', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(options || {})
-    }).then(r => r.json())`;
+    })`;
 		}).join(",\n");
 		return `
   ${clientKey}: {
-    list: (params) => fetch(basePath + '/${collection}', {
+    list: (params) => __smrtFetchJson(basePath + '/${collection}', {
       method: 'GET',
       headers: { 'Content-Type': 'application/json' }
-    }).then(r => r.json()),
+    }),
 
-    get: (id) => fetch(basePath + '/${collection}/' + id, {
+    get: (id) => __smrtFetchJson(basePath + '/${collection}/' + id, {
       method: 'GET',
       headers: { 'Content-Type': 'application/json' }
-    }).then(r => r.json()),
+    }),
 
-    create: (data) => fetch(basePath + '/${collection}', {
+    create: (data) => __smrtFetchJson(basePath + '/${collection}', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(data)
-    }).then(r => r.json()),
+    }),
 
-    update: (id, data) => fetch(basePath + '/${collection}/' + id, {
+    update: (id, data) => __smrtFetchJson(basePath + '/${collection}/' + id, {
       method: 'PUT',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(data)
-    }).then(r => r.json()),
+    }),
 
-    delete: (id) => fetch(basePath + '/${collection}/' + id, {
+    delete: (id) => __smrtFetchOk(basePath + '/${collection}/' + id, {
       method: 'DELETE',
       headers: { 'Content-Type': 'application/json' }
-    }).then(r => r.ok),
+    }),
 
-    search: (query) => fetch(basePath + '/${collection}/search?q=' + encodeURIComponent(query), {
+    search: (query) => __smrtFetchJson(basePath + '/${collection}/search?q=' + encodeURIComponent(query), {
       method: 'GET',
       headers: { 'Content-Type': 'application/json' }
-    }).then(r => r.json())${customMethods.length > 0 ? `,\n${customMethodImpls}` : ""}
+    })${customMethods.length > 0 ? `,\n${customMethodImpls}` : ""}
   }`;
 	}).join(",")}
   };
@@ -664,6 +674,50 @@ export { createClient as default };
 `;
 }
 /**
+* Generate the virtual web-collection definition module
+* (`@happyvertical/smrt-virt-web`, #1761).
+*
+* Emits typed per-collection metadata — REST collection name, endpoint path,
+* id field, exposed CRUD actions, and persisted field definitions — for every
+* API-exposed model in the manifest. This is the codegen contract consumed by
+* `@happyvertical/smrt-web` to construct client collections over the generated
+* REST surface. Deliberately data-only: no fetch code is emitted here, so the
+* runtime wrapper owns all HTTP/error semantics in one place. Selection and
+* field rules live in {@link selectWebCollectionEntries} /
+* {@link buildWebFieldDefinitions} so this value emission and the matching
+* d.ts type emission cannot drift.
+*/
+function generateWebModule(manifest) {
+	const definitions = {};
+	for (const { collection, obj, actions } of selectWebCollectionEntries(manifest)) definitions[collection] = {
+		name: collection,
+		className: obj.className,
+		endpoint: `/${collection}`,
+		idField: "id",
+		actions,
+		fields: buildWebFieldDefinitions(obj),
+		relationships: buildWebRelationships(obj, manifest)
+	};
+	return `
+// Auto-generated web collection definitions from SMRT objects (#1761)
+// This file is generated automatically - do not edit
+
+export const collectionDefinitions = ${JSON.stringify(definitions, null, 2)};
+
+export function getCollectionDefinition(name) {
+  const definition = collectionDefinitions[name];
+  if (!definition) {
+    throw new Error(
+      \`[smrt] Unknown web collection definition: \${name}. Known: \${Object.keys(collectionDefinitions).join(', ')}\`,
+    );
+  }
+  return definition;
+}
+
+export { collectionDefinitions as default };
+`;
+}
+/**
 * Generate virtual MCP module
 */
 async function generateMCPModule(manifest) {
@@ -835,8 +889,8 @@ async function generateTypeDeclarationFile(manifest, projectRoot, typeDeclaratio
 ${Object.entries(obj.fields).map(([fieldName, field]) => {
 				return `    ${fieldName}${field.required === false ? "?" : ""}: ${mapTypeScriptType(field.type)};`;
 			}).join("\n")}
-    createdAt?: string;
-    updatedAt?: string;
+    created_at?: string;
+    updated_at?: string;
   }`;
 		}).join("\n\n");
 		const apiClientInterface = uniqueApiClientEntries(Object.entries(manifest.objects)).map(({ obj, clientKey }) => {
@@ -851,6 +905,7 @@ ${Object.entries(obj.fields).map(([fieldName, field]) => {
 			if (customMethods.length > 0) return `    ${clientKey}: CrudOperations<${interfaceName}> & {\n${customMethodSignatures}\n    };`;
 			else return `    ${clientKey}: CrudOperations<${interfaceName}>;`;
 		}).join("\n");
+		const webCollectionInterface = selectWebCollectionEntries(manifest).map(({ collection, obj }) => `    ${collection}: SmrtWebCollectionDefinition<import('@happyvertical/smrt-virt-types').${obj.className}Data>;`).join("\n");
 		Object.entries(manifest.objects).flatMap(([_name, obj]) => Object.entries(obj.methods).map(([methodName, method]) => ({
 			name: `${methodName}_${obj.collection}`,
 			description: `${method.name} operation on ${obj.collection}`,
@@ -922,15 +977,26 @@ declare module '@happyvertical/smrt-virt-routes' {
   export default setupRoutes;
 }
 
-// Client module - Auto-generated API client  
+// Client module - Auto-generated API client
+// Wire-shape policy (#1797): the server returns BARE JSON — a bare array for
+// list/search, a bare object for get/create/update — with snake_case field
+// names (created_at, updated_at). These declarations match that shape (no
+// envelope, no camelCase). Fetchers reject on non-2xx with a SmrtClientError
+// (#1796). This is byte-identical to the prebuild declaration path.
 declare module '@happyvertical/smrt-virt-client' {
-  export interface ApiResponse<T = any> {
-    id?: string;
-    data?: T;
+  /** Shape of a JSON error body carried by a rejected request (SmrtClientError.body). */
+  export interface ApiError {
     error?: string;
     message?: string;
   }
 
+  /** Typed error thrown by every fetcher on a non-2xx response (#1796). */
+  export interface SmrtClientError extends Error {
+    name: 'SmrtClientError';
+    status: number;
+    body?: ApiError | string;
+  }
+
   export interface CrudOperations<T = any> {
     list(params?: Record<string, any>): Promise<T[]>;
     get(id: string): Promise<T>;
@@ -977,6 +1043,67 @@ ${objectInterfaces}
   export default types;
 }
 
+// Web module - Typed collection definitions for the browser client data
+// runtime (@happyvertical/smrt-web, #1761)
+declare module '@happyvertical/smrt-virt-web' {
+  export type SmrtWebFieldType =
+    | 'text'
+    | 'decimal'
+    | 'boolean'
+    | 'integer'
+    | 'datetime'
+    | 'json'
+    | 'foreignKey'
+    | 'crossPackageRef'
+    | 'meta';
+
+  export interface SmrtWebFieldDefinition {
+    type: SmrtWebFieldType;
+    required?: boolean;
+    default?: unknown;
+  }
+
+  export type SmrtWebRelationshipKind =
+    | 'foreignKey'
+    | 'crossPackageRef'
+    | 'oneToMany'
+    | 'manyToMany';
+
+  /**
+   * A manifest-derived edge to a sibling REST collection. Mutating this
+   * collection invalidates the caches of the collections named by these edges
+   * (#1761 relationship-derived invalidation).
+   */
+  export interface SmrtWebRelationship {
+    field: string;
+    kind: SmrtWebRelationshipKind;
+    relatedCollection: string;
+  }
+
+  export interface SmrtWebCollectionDefinition<TData = Record<string, unknown>> {
+    name: string;
+    className: string;
+    endpoint: string;
+    idField: string;
+    actions: string[];
+    fields: Record<string, SmrtWebFieldDefinition>;
+    /** Manifest-derived relationship edges to sibling REST collections. */
+    relationships: SmrtWebRelationship[];
+    /** Phantom row-type carrier for inference — never present at runtime. */
+    _row?: TData;
+  }
+
+  export interface SmrtWebCollectionDefinitions {
+${webCollectionInterface}
+  }
+
+  export const collectionDefinitions: SmrtWebCollectionDefinitions;
+  export function getCollectionDefinition<
+    K extends keyof SmrtWebCollectionDefinitions,
+  >(name: K): SmrtWebCollectionDefinitions[K];
+  export default collectionDefinitions;
+}
+
 // CLI module - Auto-generated command-line interface
 declare module '@happyvertical/smrt-virt-cli' {
   export interface CLIConfig {