@happyvertical/smrt-core 0.37.8 → 0.37.9

package/dist/generated-client-runtime.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Shared runtime source injected into every generated API client
+ * (`smrtPlugin`'s `@happyvertical/smrt-virt-client` and `smrtConsumer`'s
+ * `@smrt/client` fallback).
+ *
+ * The generated fetchers MUST reject on `!response.ok` (#1796): before this,
+ * every fetcher resolved `r.json()` regardless of HTTP status, so a 500 (or any
+ * error response) resolved successfully with the error payload. Mutation
+ * failures were therefore invisible to callers — an optimistic-update layer
+ * (e.g. TanStack DB `onInsert`) could never observe the failure and roll back.
+ *
+ * `SmrtClientError` carries the HTTP `status` and the parsed error `body` (when
+ * the response was JSON), so callers can branch on status and surface server
+ * messages. Both helpers are emitted with a `__smrt` prefix so they cannot
+ * collide with a collection key in the generated module.
+ *
+ * WIRE-SHAPE POLICY (#1797, ADR 0001): the server returns BARE JSON — a bare
+ * array for list, a bare object for get/create/update — with snake_case field
+ * names (`created_at`, `updated_at`) exactly as `SmrtObject.toJSON()` emits
+ * them. These helpers pass that JSON through unchanged; they do NOT wrap it in
+ * an envelope or camelCase the keys. The generated `.d.ts` declarations
+ * (vite-plugin + prebuild) are written to match this shape. This same
+ * snake_case wire feeds the mobile DTO codegen; do not change the wire here.
+ */
+export declare const CLIENT_FETCH_RUNTIME = "class SmrtClientError extends Error {\n  constructor(message, status, body) {\n    super(message);\n    this.name = 'SmrtClientError';\n    this.status = status;\n    this.body = body;\n  }\n}\n\nasync function __smrtParseBody(response) {\n  const contentType = response.headers.get('content-type') || '';\n  if (contentType.includes('application/json')) {\n    try {\n      return await response.json();\n    } catch {\n      return undefined;\n    }\n  }\n  try {\n    return await response.text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Rejects on !response.ok with a typed SmrtClientError; otherwise resolves the\n// parsed JSON body exactly as the server sent it (bare array/object, snake_case\n// fields).\nasync function __smrtFetchJson(url, init) {\n  const response = await fetch(url, init);\n  const body = await __smrtParseBody(response);\n  if (!response.ok) {\n    const detail =\n      body && typeof body === 'object' && body.error ? ': ' + body.error : '';\n    throw new SmrtClientError(\n      'Request failed with status ' + response.status + detail,\n      response.status,\n      body,\n    );\n  }\n  return body;\n}\n\n// DELETE variant: rejects on !response.ok (so a failed delete is observable),\n// otherwise resolves true.\nasync function __smrtFetchOk(url, init) {\n  const response = await fetch(url, init);\n  if (!response.ok) {\n    const body = await __smrtParseBody(response);\n    const detail =\n      body && typeof body === 'object' && body.error ? ': ' + body.error : '';\n    throw new SmrtClientError(\n      'Request failed with status ' + response.status + detail,\n      response.status,\n      body,\n    );\n  }\n  return true;\n}";
+//# sourceMappingURL=generated-client-runtime.d.ts.map

package/dist/generated-client-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-client-runtime.d.ts","sourceRoot":"","sources":["../src/generated-client-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,oBAAoB,4pDA0D/B,CAAC"}

package/dist/generated-client-runtime.js

@@ -0,0 +1,88 @@
+//#region src/generated-client-runtime.ts
+/**
+* Shared runtime source injected into every generated API client
+* (`smrtPlugin`'s `@happyvertical/smrt-virt-client` and `smrtConsumer`'s
+* `@smrt/client` fallback).
+*
+* The generated fetchers MUST reject on `!response.ok` (#1796): before this,
+* every fetcher resolved `r.json()` regardless of HTTP status, so a 500 (or any
+* error response) resolved successfully with the error payload. Mutation
+* failures were therefore invisible to callers — an optimistic-update layer
+* (e.g. TanStack DB `onInsert`) could never observe the failure and roll back.
+*
+* `SmrtClientError` carries the HTTP `status` and the parsed error `body` (when
+* the response was JSON), so callers can branch on status and surface server
+* messages. Both helpers are emitted with a `__smrt` prefix so they cannot
+* collide with a collection key in the generated module.
+*
+* WIRE-SHAPE POLICY (#1797, ADR 0001): the server returns BARE JSON — a bare
+* array for list, a bare object for get/create/update — with snake_case field
+* names (`created_at`, `updated_at`) exactly as `SmrtObject.toJSON()` emits
+* them. These helpers pass that JSON through unchanged; they do NOT wrap it in
+* an envelope or camelCase the keys. The generated `.d.ts` declarations
+* (vite-plugin + prebuild) are written to match this shape. This same
+* snake_case wire feeds the mobile DTO codegen; do not change the wire here.
+*/
+var CLIENT_FETCH_RUNTIME = `class SmrtClientError extends Error {
+  constructor(message, status, body) {
+    super(message);
+    this.name = 'SmrtClientError';
+    this.status = status;
+    this.body = body;
+  }
+}
+
+async function __smrtParseBody(response) {
+  const contentType = response.headers.get('content-type') || '';
+  if (contentType.includes('application/json')) {
+    try {
+      return await response.json();
+    } catch {
+      return undefined;
+    }
+  }
+  try {
+    return await response.text();
+  } catch {
+    return undefined;
+  }
+}
+
+// Rejects on !response.ok with a typed SmrtClientError; otherwise resolves the
+// parsed JSON body exactly as the server sent it (bare array/object, snake_case
+// fields).
+async function __smrtFetchJson(url, init) {
+  const response = await fetch(url, init);
+  const body = await __smrtParseBody(response);
+  if (!response.ok) {
+    const detail =
+      body && typeof body === 'object' && body.error ? ': ' + body.error : '';
+    throw new SmrtClientError(
+      'Request failed with status ' + response.status + detail,
+      response.status,
+      body,
+    );
+  }
+  return body;
+}
+
+// DELETE variant: rejects on !response.ok (so a failed delete is observable),
+// otherwise resolves true.
+async function __smrtFetchOk(url, init) {
+  const response = await fetch(url, init);
+  if (!response.ok) {
+    const body = await __smrtParseBody(response);
+    const detail =
+      body && typeof body === 'object' && body.error ? ': ' + body.error : '';
+    throw new SmrtClientError(
+      'Request failed with status ' + response.status + detail,
+      response.status,
+      body,
+    );
+  }
+  return true;
+}`;
+//#endregion
+export { CLIENT_FETCH_RUNTIME };
+
+//# sourceMappingURL=generated-client-runtime.js.map

package/dist/generated-client-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-client-runtime.js","names":[],"sources":["../src/generated-client-runtime.ts"],"sourcesContent":["/**\n * Shared runtime source injected into every generated API client\n * (`smrtPlugin`'s `@happyvertical/smrt-virt-client` and `smrtConsumer`'s\n * `@smrt/client` fallback).\n *\n * The generated fetchers MUST reject on `!response.ok` (#1796): before this,\n * every fetcher resolved `r.json()` regardless of HTTP status, so a 500 (or any\n * error response) resolved successfully with the error payload. Mutation\n * failures were therefore invisible to callers — an optimistic-update layer\n * (e.g. TanStack DB `onInsert`) could never observe the failure and roll back.\n *\n * `SmrtClientError` carries the HTTP `status` and the parsed error `body` (when\n * the response was JSON), so callers can branch on status and surface server\n * messages. Both helpers are emitted with a `__smrt` prefix so they cannot\n * collide with a collection key in the generated module.\n *\n * WIRE-SHAPE POLICY (#1797, ADR 0001): the server returns BARE JSON — a bare\n * array for list, a bare object for get/create/update — with snake_case field\n * names (`created_at`, `updated_at`) exactly as `SmrtObject.toJSON()` emits\n * them. These helpers pass that JSON through unchanged; they do NOT wrap it in\n * an envelope or camelCase the keys. The generated `.d.ts` declarations\n * (vite-plugin + prebuild) are written to match this shape. This same\n * snake_case wire feeds the mobile DTO codegen; do not change the wire here.\n */\nexport const CLIENT_FETCH_RUNTIME = `class SmrtClientError extends Error {\n  constructor(message, status, body) {\n    super(message);\n    this.name = 'SmrtClientError';\n    this.status = status;\n    this.body = body;\n  }\n}\n\nasync function __smrtParseBody(response) {\n  const contentType = response.headers.get('content-type') || '';\n  if (contentType.includes('application/json')) {\n    try {\n      return await response.json();\n    } catch {\n      return undefined;\n    }\n  }\n  try {\n    return await response.text();\n  } catch {\n    return undefined;\n  }\n}\n\n// Rejects on !response.ok with a typed SmrtClientError; otherwise resolves the\n// parsed JSON body exactly as the server sent it (bare array/object, snake_case\n// fields).\nasync function __smrtFetchJson(url, init) {\n  const response = await fetch(url, init);\n  const body = await __smrtParseBody(response);\n  if (!response.ok) {\n    const detail =\n      body && typeof body === 'object' && body.error ? ': ' + body.error : '';\n    throw new SmrtClientError(\n      'Request failed with status ' + response.status + detail,\n      response.status,\n      body,\n    );\n  }\n  return body;\n}\n\n// DELETE variant: rejects on !response.ok (so a failed delete is observable),\n// otherwise resolves true.\nasync function __smrtFetchOk(url, init) {\n  const response = await fetch(url, init);\n  if (!response.ok) {\n    const body = await __smrtParseBody(response);\n    const detail =\n      body && typeof body === 'object' && body.error ? ': ' + body.error : '';\n    throw new SmrtClientError(\n      'Request failed with status ' + response.status + detail,\n      response.status,\n      body,\n    );\n  }\n  return true;\n}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAa,uBAAuB"}

package/dist/generators/changes-route.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Generated `_changes` HTTP route for the change feed (issue #1758).
+ *
+ * Handles `GET {basePath}/_changes` in the REST generator: an auth-guarded,
+ * tenant-scoped cursor read over the `_smrt_changes` log. This module keeps
+ * the feed logic out of `rest.ts` (which only registers the path) so
+ * sibling generator changes stay conflict-free.
+ *
+ * Contract (part of the client/mobile sync contract, PRD #1755):
+ * - `GET {basePath}/_changes?since=<cursor>&tables=<a,b>&limit=<n>` returns
+ *   `{ changes, cursor, resyncRequired? }` — see `getChangesSince` for the
+ *   exact cursor guarantee (strictly monotonic; reads miss no committed
+ *   changes under concurrent writers). `resyncRequired: true` — served as
+ *   HTTP 200, it is protocol state rather than an error — means the cursor
+ *   cannot be served incrementally (pruned out of the retained window, or
+ *   foreign/reset) and the client must re-fetch its data in full.
+ * - **Auth is fail-closed** (#1540 posture): the route requires the
+ *   generator's `authMiddleware`. Without one configured, every request is
+ *   refused with 401 — the feed spans all tables, so per-model
+ *   `api: { public }` opt-outs deliberately do NOT apply to it.
+ * - **Tenant scoping** follows the active tenant context through the same
+ *   dependency-inversion hook the DispatchBus uses: with tenancy enabled, a
+ *   request only ever sees its own tenant's changes plus global rows; with
+ *   tenancy enabled but no active tenant, only global rows (fail-closed).
+ */
+/**
+ * Structural copy of `APIConfig['authMiddleware']` (from `rest.ts`) so this
+ * module never imports the generator back (keeps the dependency one-way).
+ */
+type ChangesAuthMiddleware = (objectName: string, action: string) => (req: Request) => Promise<Request | Response>;
+export interface ChangesRouteOptions {
+    /** The generator's configured auth middleware, if any. */
+    authMiddleware?: ChangesAuthMiddleware;
+    /** The generator's `APIContext.db` (instance, config object, or URL string). */
+    db?: unknown;
+}
+/**
+ * Pseudo object name passed to the auth middleware for the feed route, so
+ * middlewares can recognize and specially authorize it if they want to.
+ */
+export declare const CHANGES_ROUTE_OBJECT_NAME = "_changes";
+/**
+ * Handle a request against the generated `_changes` route.
+ *
+ * Returns 401 when no auth middleware is configured (fail-closed) or the
+ * middleware rejects; 405 for non-GET methods; 400 for malformed `since`/
+ * `limit`; 503 when the generator has no database; otherwise a
+ * `{ changes, cursor }` page scoped to the active tenant context.
+ */
+export declare function handleChangesRoute(req: Request, options: ChangesRouteOptions): Promise<Response>;
+export {};
+//# sourceMappingURL=changes-route.d.ts.map

package/dist/generators/changes-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes-route.d.ts","sourceRoot":"","sources":["../../src/generators/changes-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAYH;;;GAGG;AACH,KAAK,qBAAqB,GAAG,CAC3B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,KACX,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,gFAAgF;IAChF,EAAE,CAAC,EAAE,OAAO,CAAC;CACd;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,aAAa,CAAC;AAwDpD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAmEnB"}

package/dist/generators/changes-route.js

@@ -0,0 +1,111 @@
+import { ensureChangeFeedTable, getTenantScopedChangesSince } from "../change-feed.js";
+import { createLogger } from "@happyvertical/logger";
+import { getDatabase } from "@happyvertical/sql";
+//#region src/generators/changes-route.ts
+/**
+* Generated `_changes` HTTP route for the change feed (issue #1758).
+*
+* Handles `GET {basePath}/_changes` in the REST generator: an auth-guarded,
+* tenant-scoped cursor read over the `_smrt_changes` log. This module keeps
+* the feed logic out of `rest.ts` (which only registers the path) so
+* sibling generator changes stay conflict-free.
+*
+* Contract (part of the client/mobile sync contract, PRD #1755):
+* - `GET {basePath}/_changes?since=<cursor>&tables=<a,b>&limit=<n>` returns
+*   `{ changes, cursor, resyncRequired? }` — see `getChangesSince` for the
+*   exact cursor guarantee (strictly monotonic; reads miss no committed
+*   changes under concurrent writers). `resyncRequired: true` — served as
+*   HTTP 200, it is protocol state rather than an error — means the cursor
+*   cannot be served incrementally (pruned out of the retained window, or
+*   foreign/reset) and the client must re-fetch its data in full.
+* - **Auth is fail-closed** (#1540 posture): the route requires the
+*   generator's `authMiddleware`. Without one configured, every request is
+*   refused with 401 — the feed spans all tables, so per-model
+*   `api: { public }` opt-outs deliberately do NOT apply to it.
+* - **Tenant scoping** follows the active tenant context through the same
+*   dependency-inversion hook the DispatchBus uses: with tenancy enabled, a
+*   request only ever sees its own tenant's changes plus global rows; with
+*   tenancy enabled but no active tenant, only global rows (fail-closed).
+*/
+var logger = createLogger({ level: "info" });
+/**
+* Pseudo object name passed to the auth middleware for the feed route, so
+* middlewares can recognize and specially authorize it if they want to.
+*/
+var CHANGES_ROUTE_OBJECT_NAME = "_changes";
+var resolvedInstanceDbs = /* @__PURE__ */ new WeakMap();
+var resolvedUrlDbs = /* @__PURE__ */ new Map();
+function resolveChangesDb(dbOption) {
+	if (dbOption && typeof dbOption === "object") {
+		if ("query" in dbOption && typeof dbOption.query === "function") return Promise.resolve(dbOption);
+		let resolved = resolvedInstanceDbs.get(dbOption);
+		if (!resolved) {
+			resolved = getDatabase(dbOption);
+			resolvedInstanceDbs.set(dbOption, resolved);
+		}
+		return resolved;
+	}
+	if (typeof dbOption === "string" && dbOption) {
+		let resolved = resolvedUrlDbs.get(dbOption);
+		if (!resolved) {
+			resolved = getDatabase({
+				url: dbOption,
+				...dbOption === ":memory:" ? {} : { dbid: `smrt:${dbOption}` }
+			});
+			resolvedUrlDbs.set(dbOption, resolved);
+		}
+		return resolved;
+	}
+	return Promise.reject(/* @__PURE__ */ new Error("The _changes route requires a database in APIContext"));
+}
+function jsonResponse(data, status = 200) {
+	return new Response(JSON.stringify(data), {
+		status,
+		headers: { "Content-Type": "application/json" }
+	});
+}
+function errorResponse(status, message) {
+	return jsonResponse({ error: message }, status);
+}
+/**
+* Handle a request against the generated `_changes` route.
+*
+* Returns 401 when no auth middleware is configured (fail-closed) or the
+* middleware rejects; 405 for non-GET methods; 400 for malformed `since`/
+* `limit`; 503 when the generator has no database; otherwise a
+* `{ changes, cursor }` page scoped to the active tenant context.
+*/
+async function handleChangesRoute(req, options) {
+	if (req.method !== "GET") return errorResponse(405, "Method not allowed");
+	if (!options.authMiddleware) return errorResponse(401, "Authentication required");
+	const authResult = await options.authMiddleware(CHANGES_ROUTE_OBJECT_NAME, req.method.toLowerCase())(req);
+	if (authResult instanceof Response) return authResult;
+	if (options.db == null) return errorResponse(503, "Change feed unavailable: no database configured for the API generator");
+	const url = new URL(authResult.url);
+	const since = Number(url.searchParams.get("since") ?? "0");
+	if (!Number.isFinite(since) || since < 0) return errorResponse(400, "'since' must be a non-negative number");
+	let limit;
+	const limitParam = url.searchParams.get("limit");
+	if (limitParam !== null) {
+		limit = Number(limitParam);
+		if (!Number.isFinite(limit) || limit < 1) return errorResponse(400, "'limit' must be a positive number");
+	}
+	const tablesParam = url.searchParams.get("tables");
+	const tables = tablesParam ? tablesParam.split(",").map((table) => table.trim()).filter(Boolean) : void 0;
+	try {
+		const db = await resolveChangesDb(options.db);
+		await ensureChangeFeedTable(db);
+		return jsonResponse(await getTenantScopedChangesSince(db, {
+			since,
+			tables,
+			limit
+		}));
+	} catch (error) {
+		logger.error("Change feed route failed", { error: error instanceof Error ? error.message : String(error) });
+		return errorResponse(500, "Internal server error");
+	}
+}
+//#endregion
+export { CHANGES_ROUTE_OBJECT_NAME, handleChangesRoute };
+
+//# sourceMappingURL=changes-route.js.map

package/dist/generators/changes-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes-route.js","names":[],"sources":["../../src/generators/changes-route.ts"],"sourcesContent":["/**\n * Generated `_changes` HTTP route for the change feed (issue #1758).\n *\n * Handles `GET {basePath}/_changes` in the REST generator: an auth-guarded,\n * tenant-scoped cursor read over the `_smrt_changes` log. This module keeps\n * the feed logic out of `rest.ts` (which only registers the path) so\n * sibling generator changes stay conflict-free.\n *\n * Contract (part of the client/mobile sync contract, PRD #1755):\n * - `GET {basePath}/_changes?since=<cursor>&tables=<a,b>&limit=<n>` returns\n *   `{ changes, cursor, resyncRequired? }` — see `getChangesSince` for the\n *   exact cursor guarantee (strictly monotonic; reads miss no committed\n *   changes under concurrent writers). `resyncRequired: true` — served as\n *   HTTP 200, it is protocol state rather than an error — means the cursor\n *   cannot be served incrementally (pruned out of the retained window, or\n *   foreign/reset) and the client must re-fetch its data in full.\n * - **Auth is fail-closed** (#1540 posture): the route requires the\n *   generator's `authMiddleware`. Without one configured, every request is\n *   refused with 401 — the feed spans all tables, so per-model\n *   `api: { public }` opt-outs deliberately do NOT apply to it.\n * - **Tenant scoping** follows the active tenant context through the same\n *   dependency-inversion hook the DispatchBus uses: with tenancy enabled, a\n *   request only ever sees its own tenant's changes plus global rows; with\n *   tenancy enabled but no active tenant, only global rows (fail-closed).\n */\n\nimport { createLogger } from '@happyvertical/logger';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { getDatabase } from '@happyvertical/sql';\nimport {\n  ensureChangeFeedTable,\n  getTenantScopedChangesSince,\n} from '../change-feed.js';\n\nconst logger = createLogger({ level: 'info' });\n\n/**\n * Structural copy of `APIConfig['authMiddleware']` (from `rest.ts`) so this\n * module never imports the generator back (keeps the dependency one-way).\n */\ntype ChangesAuthMiddleware = (\n  objectName: string,\n  action: string,\n) => (req: Request) => Promise<Request | Response>;\n\nexport interface ChangesRouteOptions {\n  /** The generator's configured auth middleware, if any. */\n  authMiddleware?: ChangesAuthMiddleware;\n  /** The generator's `APIContext.db` (instance, config object, or URL string). */\n  db?: unknown;\n}\n\n/**\n * Pseudo object name passed to the auth middleware for the feed route, so\n * middlewares can recognize and specially authorize it if they want to.\n */\nexport const CHANGES_ROUTE_OBJECT_NAME = '_changes';\n\n// Resolve the APIContext db option once per distinct option value so every\n// request reads the same underlying database (getDatabase() would otherwise\n// mint a fresh instance per call for config objects / `:memory:` URLs).\nconst resolvedInstanceDbs = new WeakMap<object, Promise<DatabaseInterface>>();\nconst resolvedUrlDbs = new Map<string, Promise<DatabaseInterface>>();\n\nfunction resolveChangesDb(dbOption: unknown): Promise<DatabaseInterface> {\n  if (dbOption && typeof dbOption === 'object') {\n    if (\n      'query' in dbOption &&\n      typeof (dbOption as { query?: unknown }).query === 'function'\n    ) {\n      return Promise.resolve(dbOption as DatabaseInterface);\n    }\n    let resolved = resolvedInstanceDbs.get(dbOption);\n    if (!resolved) {\n      resolved = getDatabase(\n        dbOption as Parameters<typeof getDatabase>[0],\n      ) as Promise<DatabaseInterface>;\n      resolvedInstanceDbs.set(dbOption, resolved);\n    }\n    return resolved;\n  }\n\n  if (typeof dbOption === 'string' && dbOption) {\n    let resolved = resolvedUrlDbs.get(dbOption);\n    if (!resolved) {\n      // Match SmrtClass's connection-sharing convention for file-backed URLs.\n      const isMemoryDb = dbOption === ':memory:';\n      resolved = getDatabase({\n        url: dbOption,\n        ...(isMemoryDb ? {} : { dbid: `smrt:${dbOption}` }),\n      }) as Promise<DatabaseInterface>;\n      resolvedUrlDbs.set(dbOption, resolved);\n    }\n    return resolved;\n  }\n\n  return Promise.reject(\n    new Error('The _changes route requires a database in APIContext'),\n  );\n}\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  });\n}\n\nfunction errorResponse(status: number, message: string): Response {\n  return jsonResponse({ error: message }, status);\n}\n\n/**\n * Handle a request against the generated `_changes` route.\n *\n * Returns 401 when no auth middleware is configured (fail-closed) or the\n * middleware rejects; 405 for non-GET methods; 400 for malformed `since`/\n * `limit`; 503 when the generator has no database; otherwise a\n * `{ changes, cursor }` page scoped to the active tenant context.\n */\nexport async function handleChangesRoute(\n  req: Request,\n  options: ChangesRouteOptions,\n): Promise<Response> {\n  if (req.method !== 'GET') {\n    return errorResponse(405, 'Method not allowed');\n  }\n\n  // Fail-closed (#1540): the change feed spans every table, so it is never\n  // public — an auth middleware must be configured and must pass. The action\n  // is the lowercased HTTP method, matching the generator's other call sites.\n  if (!options.authMiddleware) {\n    return errorResponse(401, 'Authentication required');\n  }\n  const authCheck = options.authMiddleware(\n    CHANGES_ROUTE_OBJECT_NAME,\n    req.method.toLowerCase(),\n  );\n  const authResult = await authCheck(req);\n  if (authResult instanceof Response) {\n    return authResult;\n  }\n\n  if (options.db == null) {\n    return errorResponse(\n      503,\n      'Change feed unavailable: no database configured for the API generator',\n    );\n  }\n\n  const url = new URL(authResult.url);\n  const since = Number(url.searchParams.get('since') ?? '0');\n  if (!Number.isFinite(since) || since < 0) {\n    return errorResponse(400, \"'since' must be a non-negative number\");\n  }\n\n  let limit: number | undefined;\n  const limitParam = url.searchParams.get('limit');\n  if (limitParam !== null) {\n    limit = Number(limitParam);\n    if (!Number.isFinite(limit) || limit < 1) {\n      return errorResponse(400, \"'limit' must be a positive number\");\n    }\n  }\n\n  const tablesParam = url.searchParams.get('tables');\n  const tables = tablesParam\n    ? tablesParam\n        .split(',')\n        .map((table) => table.trim())\n        .filter(Boolean)\n    : undefined;\n\n  try {\n    const db = await resolveChangesDb(options.db);\n    // System tables are runtime-ensured; a raw handle passed straight to the\n    // generator may not have gone through framework init yet.\n    await ensureChangeFeedTable(db);\n    const page = await getTenantScopedChangesSince(db, {\n      since,\n      tables,\n      limit,\n    });\n    return jsonResponse(page);\n  } catch (error) {\n    logger.error('Change feed route failed', {\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return errorResponse(500, 'Internal server error');\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,IAAM,SAAS,aAAa,EAAE,OAAO,OAAO,CAAC;;;;;AAsB7C,IAAa,4BAA4B;AAKzC,IAAM,sCAAsB,IAAI,QAA4C;AAC5E,IAAM,iCAAiB,IAAI,IAAwC;AAEnE,SAAS,iBAAiB,UAA+C;CACvE,IAAI,YAAY,OAAO,aAAa,UAAU;EAC5C,IACE,WAAW,YACX,OAAQ,SAAiC,UAAU,YAEnD,OAAO,QAAQ,QAAQ,QAA6B;EAEtD,IAAI,WAAW,oBAAoB,IAAI,QAAQ;EAC/C,IAAI,CAAC,UAAU;GACb,WAAW,YACT,QACF;GACA,oBAAoB,IAAI,UAAU,QAAQ;EAC5C;EACA,OAAO;CACT;CAEA,IAAI,OAAO,aAAa,YAAY,UAAU;EAC5C,IAAI,WAAW,eAAe,IAAI,QAAQ;EAC1C,IAAI,CAAC,UAAU;GAGb,WAAW,YAAY;IACrB,KAAK;IACL,GAHiB,aAAa,aAGb,CAAC,IAAI,EAAE,MAAM,QAAQ,WAAW;GACnD,CAAC;GACD,eAAe,IAAI,UAAU,QAAQ;EACvC;EACA,OAAO;CACT;CAEA,OAAO,QAAQ,uBACb,IAAI,MAAM,sDAAsD,CAClE;AACF;AAEA,SAAS,aAAa,MAAe,SAAS,KAAe;CAC3D,OAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EACxC;EACA,SAAS,EAAE,gBAAgB,mBAAmB;CAChD,CAAC;AACH;AAEA,SAAS,cAAc,QAAgB,SAA2B;CAChE,OAAO,aAAa,EAAE,OAAO,QAAQ,GAAG,MAAM;AAChD;;;;;;;;;AAUA,eAAsB,mBACpB,KACA,SACmB;CACnB,IAAI,IAAI,WAAW,OACjB,OAAO,cAAc,KAAK,oBAAoB;CAMhD,IAAI,CAAC,QAAQ,gBACX,OAAO,cAAc,KAAK,yBAAyB;CAMrD,MAAM,aAAa,MAJD,QAAQ,eACxB,2BACA,IAAI,OAAO,YAAY,CAEA,CAAA,CAAU,GAAG;CACtC,IAAI,sBAAsB,UACxB,OAAO;CAGT,IAAI,QAAQ,MAAM,MAChB,OAAO,cACL,KACA,uEACF;CAGF,MAAM,MAAM,IAAI,IAAI,WAAW,GAAG;CAClC,MAAM,QAAQ,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK,GAAG;CACzD,IAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GACrC,OAAO,cAAc,KAAK,uCAAuC;CAGnE,IAAI;CACJ,MAAM,aAAa,IAAI,aAAa,IAAI,OAAO;CAC/C,IAAI,eAAe,MAAM;EACvB,QAAQ,OAAO,UAAU;EACzB,IAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GACrC,OAAO,cAAc,KAAK,mCAAmC;CAEjE;CAEA,MAAM,cAAc,IAAI,aAAa,IAAI,QAAQ;CACjD,MAAM,SAAS,cACX,YACG,MAAM,GAAG,CAAC,CACV,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,OAAO,OAAO,IACjB,KAAA;CAEJ,IAAI;EACF,MAAM,KAAK,MAAM,iBAAiB,QAAQ,EAAE;EAG5C,MAAM,sBAAsB,EAAE;EAM9B,OAAO,aAAa,MALD,4BAA4B,IAAI;GACjD;GACA;GACA;EACF,CAAC,CACuB;CAC1B,SAAS,OAAO;EACd,OAAO,MAAM,4BAA4B,EACvC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAC9D,CAAC;EACD,OAAO,cAAc,KAAK,uBAAuB;CACnD;AACF"}

package/dist/generators/rest.d.ts

@@ -39,6 +39,17 @@ export declare class APIGenerator {
      * @param collection - Pre-initialized SmrtCollection instance
      */
     registerCollection(name: string, collection: SmrtCollection<SmrtObject>): void;
+    /**
+     * Resolve the database for generator-level routes that are not object-scoped
+     * (currently the `_changes` feed, #1758).
+     *
+     * Prefers the explicit `APIContext.db`, but falls back to the first
+     * registered collection's live handle so the feed works under the documented
+     * `registerCollection()` wiring, where callers configure collections with a
+     * database but never populate `APIContext.db`. Without the fallback the feed
+     * would 503 even though the database is reachable.
+     */
+    private resolveContextDb;
     /**
      * Create Node.js HTTP server with all routes
      */
@@ -198,6 +209,23 @@ export declare class APIGenerator {
      * Add CORS headers to response
      */
     private addCorsHeaders;
+    /**
+     * Resolve a URL/collection segment to a registered class via auto-discovery.
+     *
+     * The segment IS the canonical `collection` value from the manifest
+     * (`RegisteredClass.collection`, e.g. `products` for `Product`) — the same
+     * value the generated client, the SvelteKit route generator, and the registry
+     * all derive. Match it VERBATIM; do not re-pluralize. The previous
+     * implementation pluralized both the URL segment and the class name and
+     * compared them, turning an already-plural client URL (`/products`) into
+     * `productses`, so the generated client 404'd against auto-discovered routes
+     * (#1794). Shared by the CRUD path and the `sync/apply` batch path so they can
+     * never drift.
+     *
+     * @param segment - The URL/collection path segment (e.g. `products`).
+     * @returns The matching registered class, or null if none matches.
+     */
+    private findClassByCollectionSegment;
     /**
      * Simple pluralization (basic implementation)
      */

package/dist/generators/rest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../../src/generators/rest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAgB5C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,cAAc,CAAC,EAAE,CACf,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,KACX,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,WAAW,CAAiD;IACpE,OAAO,CAAC,OAAO,CAAa;gBAEhB,MAAM,GAAE,SAAc,EAAE,OAAO,GAAE,UAAe;IAa5D;;;;;OAKG;IACH,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,GACrC,IAAI;IAIP;;OAEG;IACH,YAAY,IAAI;QAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAoBpD;;OAEG;YACW,cAAc;IAQ5B;;OAEG;YACW,uBAAuB;IAyBrC;;OAEG;YACW,yBAAyB;IAwBvC;;OAEG;IACH,eAAe,IAAI,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC;IAItD;;OAEG;YACW,aAAa;IA4B3B;;OAEG;YACW,iBAAiB;IA6G/B;;OAEG;YACW,oBAAoB;IA6DlC,OAAO,CAAC,aAAa;IAmBrB;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,kBAAkB;IA4B1B,OAAO,CAAC,uBAAuB;IAuB/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,sBAAsB;IAmB9B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;OAEG;YACW,SAAS;IAkBvB;;OAEG;YACW,UAAU;IA6DxB;;OAEG;YACW,WAAW;IA8CzB;;OAEG;YACW,YAAY;IAW1B;;OAEG;YACW,YAAY;IAoB1B;;OAEG;YACW,YAAY;IAc1B;;;;;OAKG;YACW,eAAe;IAqB7B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAgE9B;;OAEG;IACH,OAAO,CAAC,aAAa;IAqBrB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAiD3B;;;OAGG;IACH,OAAO,CAAC,YAAY;IAOpB;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IA0B1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAS3B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAQ5B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAc1B;;OAEG;IACH,OAAO,CAAC,cAAc;IAoBtB;;OAEG;IACH,OAAO,CAAC,SAAS;CASlB;AAID,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,CAAC,OAAO,UAAU,CAAC,EAAE,EAC9B,OAAO,GAAE,UAAe,EACxB,MAAM,GAAE,gBAAqB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CActC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,CAAC,OAAO,UAAU,CAAC,EAAE,EAC9B,OAAO,GAAE,UAAe,EACxB,MAAM,GAAE,gBAAqB,GAC5B,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAwB9B"}
+{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../../src/generators/rest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAiB5C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,cAAc,CAAC,EAAE,CACf,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,KACX,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,WAAW,CAAiD;IACpE,OAAO,CAAC,OAAO,CAAa;gBAEhB,MAAM,GAAE,SAAc,EAAE,OAAO,GAAE,UAAe;IAa5D;;;;;OAKG;IACH,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,GACrC,IAAI;IAIP;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;OAEG;IACH,YAAY,IAAI;QAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAoBpD;;OAEG;YACW,cAAc;IAQ5B;;OAEG;YACW,uBAAuB;IAyBrC;;OAEG;YACW,yBAAyB;IAwBvC;;OAEG;IACH,eAAe,IAAI,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC;IAItD;;OAEG;YACW,aAAa;IAsC3B;;OAEG;YACW,iBAAiB;IAmG/B;;OAEG;YACW,oBAAoB;IA6DlC,OAAO,CAAC,aAAa;IAmBrB;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,kBAAkB;IA4B1B,OAAO,CAAC,uBAAuB;IAuB/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,sBAAsB;IAmB9B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;OAEG;YACW,SAAS;IAkBvB;;OAEG;YACW,UAAU;IA6DxB;;OAEG;YACW,WAAW;IA8CzB;;OAEG;YACW,YAAY;IAW1B;;OAEG;YACW,YAAY;IAoB1B;;OAEG;YACW,YAAY;IAc1B;;;;;OAKG;YACW,eAAe;IAqB7B;;;;OAIG;YACW,sBAAsB;IA+DpC;;OAEG;YACW,aAAa;IA6B3B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAiD3B;;;OAGG;IACH,OAAO,CAAC,YAAY;IAOpB;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IA0B1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAS3B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAQ5B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAc1B;;OAEG;IACH,OAAO,CAAC,cAAc;IAoBtB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,4BAA4B;IAsBpC;;OAEG;IACH,OAAO,CAAC,SAAS;CASlB;AAID,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,CAAC,OAAO,UAAU,CAAC,EAAE,EAC9B,OAAO,GAAE,UAAe,EACxB,MAAM,GAAE,gBAAqB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CActC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,CAAC,OAAO,UAAU,CAAC,EAAE,EAC9B,OAAO,GAAE,UAAe,EACxB,MAAM,GAAE,gBAAqB,GAC5B,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAwB9B"}

package/dist/generators/rest.js

@@ -1,8 +1,9 @@
-import { ObjectRegistry } from "../registry.js";
 import { isTenantScopedClassResolved, resolveDispatchTenantScope } from "../dispatch/tenant-resolver.js";
+import { ObjectRegistry } from "../registry.js";
 import "../dispatch/index.js";
 import { conditionalJsonResponse, resolveReadCacheControl, warnIfSharedCacheNeutralized, warnIfTenantScopedPublicRead } from "./conditional-get.js";
 import { SYNC_APPLY_ROUTE_SEGMENTS, processSyncApplyBatch } from "../sync/apply.js";
+import { handleChangesRoute } from "./changes-route.js";
 import http from "node:http";
 //#region src/generators/rest.ts
 /**
@@ -37,6 +38,19 @@ var APIGenerator = class {
 		this.collections.set(name, collection);
 	}
 	/**
+	* Resolve the database for generator-level routes that are not object-scoped
+	* (currently the `_changes` feed, #1758).
+	*
+	* Prefers the explicit `APIContext.db`, but falls back to the first
+	* registered collection's live handle so the feed works under the documented
+	* `registerCollection()` wiring, where callers configure collections with a
+	* database but never populate `APIContext.db`. Without the fallback the feed
+	* would 503 even though the database is reachable.
+	*/
+	resolveContextDb() {
+		return this.context.db ?? this.collections.values().next().value?.db ?? void 0;
+	}
+	/**
 	* Create Node.js HTTP server with all routes
 	*/
 	createServer() {
@@ -116,6 +130,13 @@ var APIGenerator = class {
 				return this.addCorsHeaders(response, req);
 			}
 		}
+		if (url.pathname === `${this.config.basePath}/_changes`) {
+			const response = await handleChangesRoute(req, {
+				authMiddleware: this.config.authMiddleware,
+				db: this.resolveContextDb()
+			});
+			return this.addCorsHeaders(response, req);
+		}
 		if (url.pathname.startsWith(this.config.basePath || "")) {
 			const response = await this.handleObjectRoute(req, url);
 			return this.addCorsHeaders(response, req);
@@ -145,20 +166,14 @@ var APIGenerator = class {
 			} else if (!this.isRoutePublic(objectName, req.method)) return this.createErrorResponse(401, "Authentication required");
 			return await this.executeCrudOperation(req, collection, objectId, url, objectName);
 		}
-		const registeredClasses = ObjectRegistry.getAllClasses();
-		const pluralName = this.pluralize(objectType);
-		let classInfo = null;
-		for (const [_key, info] of registeredClasses) if (this.pluralize((info.name || _key).toLowerCase()) === pluralName) {
-			classInfo = info;
-			break;
-		}
+		const classInfo = this.findClassByCollectionSegment(objectType);
 		if (!classInfo) return this.createErrorResponse(404, `Object type '${objectType}' not found`);
 		if (this.config.authMiddleware) {
 			const authResult = await this.config.authMiddleware(classInfo.name, req.method.toLowerCase())(req);
 			if (authResult instanceof Response) return authResult;
 			req = authResult;
 		} else if (!this.isRoutePublic(classInfo.name, req.method)) return this.createErrorResponse(401, "Authentication required");
-		const collection = this.getCollection(classInfo);
+		const collection = await this.getCollection(classInfo);
 		return await this.executeCrudOperation(req, collection, objectId, url, classInfo.name);
 	}
 	/**
@@ -403,7 +418,7 @@ var APIGenerator = class {
 	* resolves a CRUD URL segment (registered collections first, then registry
 	* auto-discovery), and wrap the generator's per-object machinery.
 	*/
-	resolveSyncApplyTarget(objectSegment, req, rawBody) {
+	async resolveSyncApplyTarget(objectSegment, req, rawBody) {
 		let collection = null;
 		let objectName = null;
 		const registered = this.collections.get(objectSegment);
@@ -411,11 +426,10 @@ var APIGenerator = class {
 			collection = registered;
 			objectName = this.getCollectionObjectName(registered) || objectSegment;
 		} else {
-			const pluralName = this.pluralize(objectSegment);
-			for (const [key, info] of ObjectRegistry.getAllClasses()) if (this.pluralize((info.name || key).toLowerCase()) === pluralName) {
-				collection = this.getCollection(info);
+			const info = this.findClassByCollectionSegment(objectSegment);
+			if (info) {
+				collection = await this.getCollection(info);
 				objectName = info.name;
-				break;
 			}
 		}
 		if (!collection || !objectName) return null;
@@ -443,13 +457,14 @@ var APIGenerator = class {
 	/**
 	* Get or create collection instance
 	*/
-	getCollection(classInfo) {
+	async getCollection(classInfo) {
 		if (!this.collections.has(classInfo.name)) {
 			const ctor = classInfo.collectionConstructor;
 			const collection = new ctor({
 				ai: this.context.ai,
 				db: this.context.db
 			});
+			await collection.initialize();
 			this.collections.set(classInfo.name, collection);
 		}
 		const collection = this.collections.get(classInfo.name);
@@ -582,6 +597,29 @@ var APIGenerator = class {
 		});
 	}
 	/**
+	* Resolve a URL/collection segment to a registered class via auto-discovery.
+	*
+	* The segment IS the canonical `collection` value from the manifest
+	* (`RegisteredClass.collection`, e.g. `products` for `Product`) — the same
+	* value the generated client, the SvelteKit route generator, and the registry
+	* all derive. Match it VERBATIM; do not re-pluralize. The previous
+	* implementation pluralized both the URL segment and the class name and
+	* compared them, turning an already-plural client URL (`/products`) into
+	* `productses`, so the generated client 404'd against auto-discovered routes
+	* (#1794). Shared by the CRUD path and the `sync/apply` batch path so they can
+	* never drift.
+	*
+	* @param segment - The URL/collection path segment (e.g. `products`).
+	* @returns The matching registered class, or null if none matches.
+	*/
+	findClassByCollectionSegment(segment) {
+		for (const [key, info] of ObjectRegistry.getAllClasses()) {
+			if (info.collection === segment) return info;
+			if (!info.collection && this.pluralize((info.name || key).toLowerCase()) === segment) return info;
+		}
+		return null;
+	}
+	/**
 	* Simple pluralization (basic implementation)
 	*/
 	pluralize(word) {