@happyvertical/smrt-core 0.38.2 → 0.38.4

package/dist/vite-plugin/events-route.js

@@ -0,0 +1,155 @@
+import { AUTO_GENERATED_ROUTE_HEADER } from "./route-header.js";
+import { manifestHasTenantScopedObject, resolveAnchorClassName } from "./changes-route.js";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+//#region src/vite-plugin/events-route.ts
+/**
+* SvelteKit `_events` route generation — live change signals (issue #1763,
+* SERVER half; parent PRD #1755).
+*
+* Emits `{routesDir}/_events/+server.ts` — an auth-guarded, tenant-scoped
+* Server-Sent-Events endpoint that streams coarse change signals (no row
+* payloads). It is the push companion to the generated `_changes` route
+* (#1758). Kept in its own module so `sveltekit-generator.ts` only carries a
+* one-line registration.
+*
+* The stream lifecycle (subscribe, catch-up, heartbeat, teardown) lives in
+* core's `buildChangeEventStream`, imported by the generated file — so the
+* emitted route stays THIN and the stream logic is written and tested once.
+*
+* Design notes (mirror `changes-route.ts`):
+* - **Fail-closed auth** (#1540 posture): the handler requires an authenticated
+*   principal on `locals`. The signal stream spans every table, so per-model
+*   `api: { public }` opt-outs deliberately do not apply.
+* - **Tenant scoping**: when the project has tenant-scoped objects, the route
+*   establishes tenant context from `locals` exactly like the `_changes` route,
+*   then captures the resolved scope ONCE at connection open and passes it to
+*   the stream (delivery filters against that fixed value — it cannot
+*   re-resolve per signal outside the request's ALS context).
+* - **Database resolution**: anchors on the project's first generated
+*   collection (alphabetical) via `getCollection()`, exactly as `_changes`.
+* - Cleanup rides the generated-route sweep: the file starts with
+*   {@link AUTO_GENERATED_ROUTE_HEADER}.
+*/
+/**
+* Generate the `_events/+server.ts` route. Returns true when a route was
+* written. Disabled with `sveltekit: { eventsRoute: { enabled: false } }`;
+* skipped (with a log line) when the manifest has no objects to anchor on.
+*/
+function generateEventsRoute(projectRoot, manifest, options) {
+	if (options.eventsRoute?.enabled === false) return false;
+	const anchorClassName = resolveAnchorClassName(manifest);
+	if (!anchorClassName) {
+		console.log("[smrt] Skipping _events route - no SMRT objects to anchor the database on");
+		return false;
+	}
+	const routeDir = join(projectRoot, options.routesDir, "_events");
+	const content = generateEventsRouteTemplate(anchorClassName, manifestHasTenantScopedObject(manifest));
+	if (!existsSync(routeDir)) mkdirSync(routeDir, { recursive: true });
+	const filePath = join(routeDir, "+server.ts");
+	writeFileSync(filePath, content, "utf-8");
+	console.log(`[smrt] Generated: ${filePath}`);
+	return true;
+}
+function generateEventsRouteTemplate(anchorClassName, tenantScoped) {
+	return `${AUTO_GENERATED_ROUTE_HEADER}
+// DO NOT EDIT - changes will be overwritten
+//
+// GET /_events — Server-Sent-Events stream of coarse change signals (#1763).
+// Part of the client/mobile sync contract: each event names {table, operation,
+// rowId, tenantId} (NEVER a row payload — authorization stays on the read path)
+// and carries a seq cursor in the SSE id: field. A reconnecting EventSource
+// resends Last-Event-ID; the route replays missed changes from it, then streams
+// live. Same-origin only for this slice (no CORS).
+
+import { error } from '@sveltejs/kit';
+import {
+  buildChangeEventStream,
+  resolveDispatchTenantScope,
+} from '@happyvertical/smrt-core';
+import { getCollection } from '$lib/server/smrt';
+import type { RequestHandler } from './$types';
+
+// Fail-closed authorization (#1540): the signal stream spans every table, so
+// it is never public — an authenticated principal on \`locals\` is required.
+function hasAuthenticatedPrincipal(locals: unknown): boolean {
+  if (!locals || typeof locals !== 'object') return false;
+  const l = locals as Record<string, unknown>;
+  const isResolvedPrincipal = (v: unknown) =>
+    typeof v === 'object' && v !== null;
+  return (
+    isResolvedPrincipal(l.user) ||
+    isResolvedPrincipal(l.session) ||
+    l.smrtAuth === true
+  );
+}
+
+function requireRouteAuth(locals: unknown): void {
+  if (!hasAuthenticatedPrincipal(locals)) {
+    throw error(401, 'Authentication required');
+  }
+}
+
+// Last-Event-ID (auto-reconnect) takes precedence over ?since=; default is
+// live-forward only (no catch-up replay).
+function parseCursor(request: Request, url: URL): number | null {
+  const lastEventId = request.headers.get('Last-Event-ID');
+  if (lastEventId !== null && lastEventId.trim() !== '') {
+    const n = Number(lastEventId);
+    if (Number.isFinite(n) && n >= 0) return Math.floor(n);
+  }
+  const since = url.searchParams.get('since');
+  if (since !== null && since.trim() !== '') {
+    const n = Number(since);
+    if (Number.isFinite(n) && n >= 0) return Math.floor(n);
+  }
+  return null;
+}
+${tenantScoped ? `
+import { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenancy';
+
+function establishTenantContext(locals: unknown): void {
+  if (hasTenantContext()) return;
+  if (!locals || typeof locals !== 'object') return;
+  const l = locals as Record<string, unknown>;
+  const user = l.user as Record<string, unknown> | undefined;
+  const session = l.session as Record<string, unknown> | undefined;
+  const tenantId = l.tenantId ?? user?.tenantId ?? session?.tenantId;
+  if (typeof tenantId === 'string' && tenantId) {
+    enterTenantContext({ tenantId });
+  }
+}
+` : ""}
+export const GET: RequestHandler = async ({ locals, url, request }) => {
+  requireRouteAuth(locals);${tenantScoped ? "\n  establishTenantContext(locals);" : ""}
+
+  const cursor = parseCursor(request, url);
+  // Capture the tenant scope ONCE at connection open — signal delivery runs
+  // outside this request's tenant context and must filter against a fixed
+  // value, not a per-signal re-resolution. resolveDispatchTenantScope() reads
+  // the context established above (fail-closed: tenancy on + no tenant → global
+  // rows only; tenancy off → unenforced, all rows).
+  const tenantScope = resolveDispatchTenantScope();
+
+  // The feed lives in the project's database; anchor on the
+  // ${anchorClassName} collection to reuse its configured connection.
+  const collection = await getCollection('${anchorClassName}');
+  return new Response(
+    buildChangeEventStream(collection.db, { cursor, tenantScope }),
+    {
+      status: 200,
+      headers: {
+        'Content-Type': 'text/event-stream',
+        'Cache-Control': 'no-cache, no-transform',
+        Connection: 'keep-alive',
+        'X-Accel-Buffering': 'no',
+      },
+    },
+  );
+};
+`;
+}
+//#endregion
+export { generateEventsRoute };
+
+//# sourceMappingURL=events-route.js.map

package/dist/vite-plugin/events-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events-route.js","names":[],"sources":["../../src/vite-plugin/events-route.ts"],"sourcesContent":["/**\n * SvelteKit `_events` route generation — live change signals (issue #1763,\n * SERVER half; parent PRD #1755).\n *\n * Emits `{routesDir}/_events/+server.ts` — an auth-guarded, tenant-scoped\n * Server-Sent-Events endpoint that streams coarse change signals (no row\n * payloads). It is the push companion to the generated `_changes` route\n * (#1758). Kept in its own module so `sveltekit-generator.ts` only carries a\n * one-line registration.\n *\n * The stream lifecycle (subscribe, catch-up, heartbeat, teardown) lives in\n * core's `buildChangeEventStream`, imported by the generated file — so the\n * emitted route stays THIN and the stream logic is written and tested once.\n *\n * Design notes (mirror `changes-route.ts`):\n * - **Fail-closed auth** (#1540 posture): the handler requires an authenticated\n *   principal on `locals`. The signal stream spans every table, so per-model\n *   `api: { public }` opt-outs deliberately do not apply.\n * - **Tenant scoping**: when the project has tenant-scoped objects, the route\n *   establishes tenant context from `locals` exactly like the `_changes` route,\n *   then captures the resolved scope ONCE at connection open and passes it to\n *   the stream (delivery filters against that fixed value — it cannot\n *   re-resolve per signal outside the request's ALS context).\n * - **Database resolution**: anchors on the project's first generated\n *   collection (alphabetical) via `getCollection()`, exactly as `_changes`.\n * - Cleanup rides the generated-route sweep: the file starts with\n *   {@link AUTO_GENERATED_ROUTE_HEADER}.\n */\n\nimport { existsSync, mkdirSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport type { SmartObjectManifest } from '../scanner/types';\nimport {\n  manifestHasTenantScopedObject,\n  resolveAnchorClassName,\n} from './changes-route.js';\nimport { AUTO_GENERATED_ROUTE_HEADER } from './route-header.js';\nimport type { SvelteKitOptions } from './sveltekit-generator.js';\n\n/**\n * Generate the `_events/+server.ts` route. Returns true when a route was\n * written. Disabled with `sveltekit: { eventsRoute: { enabled: false } }`;\n * skipped (with a log line) when the manifest has no objects to anchor on.\n */\nexport function generateEventsRoute(\n  projectRoot: string,\n  manifest: SmartObjectManifest,\n  options: SvelteKitOptions,\n): boolean {\n  if (options.eventsRoute?.enabled === false) {\n    return false;\n  }\n\n  const anchorClassName = resolveAnchorClassName(manifest);\n  if (!anchorClassName) {\n    console.log(\n      '[smrt] Skipping _events route - no SMRT objects to anchor the database on',\n    );\n    return false;\n  }\n\n  const routeDir = join(projectRoot, options.routesDir, '_events');\n  const content = generateEventsRouteTemplate(\n    anchorClassName,\n    manifestHasTenantScopedObject(manifest),\n  );\n\n  if (!existsSync(routeDir)) {\n    mkdirSync(routeDir, { recursive: true });\n  }\n  const filePath = join(routeDir, '+server.ts');\n  writeFileSync(filePath, content, 'utf-8');\n  console.log(`[smrt] Generated: ${filePath}`);\n  return true;\n}\n\nfunction generateEventsRouteTemplate(\n  anchorClassName: string,\n  tenantScoped: boolean,\n): string {\n  const tenantHelper = tenantScoped\n    ? `\nimport { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenancy';\n\nfunction establishTenantContext(locals: unknown): void {\n  if (hasTenantContext()) return;\n  if (!locals || typeof locals !== 'object') return;\n  const l = locals as Record<string, unknown>;\n  const user = l.user as Record<string, unknown> | undefined;\n  const session = l.session as Record<string, unknown> | undefined;\n  const tenantId = l.tenantId ?? user?.tenantId ?? session?.tenantId;\n  if (typeof tenantId === 'string' && tenantId) {\n    enterTenantContext({ tenantId });\n  }\n}\n`\n    : '';\n  const tenantCall = tenantScoped ? '\\n  establishTenantContext(locals);' : '';\n\n  return `${AUTO_GENERATED_ROUTE_HEADER}\n// DO NOT EDIT - changes will be overwritten\n//\n// GET /_events — Server-Sent-Events stream of coarse change signals (#1763).\n// Part of the client/mobile sync contract: each event names {table, operation,\n// rowId, tenantId} (NEVER a row payload — authorization stays on the read path)\n// and carries a seq cursor in the SSE id: field. A reconnecting EventSource\n// resends Last-Event-ID; the route replays missed changes from it, then streams\n// live. Same-origin only for this slice (no CORS).\n\nimport { error } from '@sveltejs/kit';\nimport {\n  buildChangeEventStream,\n  resolveDispatchTenantScope,\n} from '@happyvertical/smrt-core';\nimport { getCollection } from '$lib/server/smrt';\nimport type { RequestHandler } from './$types';\n\n// Fail-closed authorization (#1540): the signal stream spans every table, so\n// it is never public — an authenticated principal on \\`locals\\` is required.\nfunction hasAuthenticatedPrincipal(locals: unknown): boolean {\n  if (!locals || typeof locals !== 'object') return false;\n  const l = locals as Record<string, unknown>;\n  const isResolvedPrincipal = (v: unknown) =>\n    typeof v === 'object' && v !== null;\n  return (\n    isResolvedPrincipal(l.user) ||\n    isResolvedPrincipal(l.session) ||\n    l.smrtAuth === true\n  );\n}\n\nfunction requireRouteAuth(locals: unknown): void {\n  if (!hasAuthenticatedPrincipal(locals)) {\n    throw error(401, 'Authentication required');\n  }\n}\n\n// Last-Event-ID (auto-reconnect) takes precedence over ?since=; default is\n// live-forward only (no catch-up replay).\nfunction parseCursor(request: Request, url: URL): number | null {\n  const lastEventId = request.headers.get('Last-Event-ID');\n  if (lastEventId !== null && lastEventId.trim() !== '') {\n    const n = Number(lastEventId);\n    if (Number.isFinite(n) && n >= 0) return Math.floor(n);\n  }\n  const since = url.searchParams.get('since');\n  if (since !== null && since.trim() !== '') {\n    const n = Number(since);\n    if (Number.isFinite(n) && n >= 0) return Math.floor(n);\n  }\n  return null;\n}\n${tenantHelper}\nexport const GET: RequestHandler = async ({ locals, url, request }) => {\n  requireRouteAuth(locals);${tenantCall}\n\n  const cursor = parseCursor(request, url);\n  // Capture the tenant scope ONCE at connection open — signal delivery runs\n  // outside this request's tenant context and must filter against a fixed\n  // value, not a per-signal re-resolution. resolveDispatchTenantScope() reads\n  // the context established above (fail-closed: tenancy on + no tenant → global\n  // rows only; tenancy off → unenforced, all rows).\n  const tenantScope = resolveDispatchTenantScope();\n\n  // The feed lives in the project's database; anchor on the\n  // ${anchorClassName} collection to reuse its configured connection.\n  const collection = await getCollection('${anchorClassName}');\n  return new Response(\n    buildChangeEventStream(collection.db, { cursor, tenantScope }),\n    {\n      status: 200,\n      headers: {\n        'Content-Type': 'text/event-stream',\n        'Cache-Control': 'no-cache, no-transform',\n        Connection: 'keep-alive',\n        'X-Accel-Buffering': 'no',\n      },\n    },\n  );\n};\n`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,SAAgB,oBACd,aACA,UACA,SACS;CACT,IAAI,QAAQ,aAAa,YAAY,OACnC,OAAO;CAGT,MAAM,kBAAkB,uBAAuB,QAAQ;CACvD,IAAI,CAAC,iBAAiB;EACpB,QAAQ,IACN,2EACF;EACA,OAAO;CACT;CAEA,MAAM,WAAW,KAAK,aAAa,QAAQ,WAAW,SAAS;CAC/D,MAAM,UAAU,4BACd,iBACA,8BAA8B,QAAQ,CACxC;CAEA,IAAI,CAAC,WAAW,QAAQ,GACtB,UAAU,UAAU,EAAE,WAAW,KAAK,CAAC;CAEzC,MAAM,WAAW,KAAK,UAAU,YAAY;CAC5C,cAAc,UAAU,SAAS,OAAO;CACxC,QAAQ,IAAI,qBAAqB,UAAU;CAC3C,OAAO;AACT;AAEA,SAAS,4BACP,iBACA,cACQ;CAoBR,OAAO,GAAG,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAnBjB,eACjB;;;;;;;;;;;;;;IAeA,GAwDS;;6BAvDM,eAAe,wCAAwC,GAyDpC;;;;;;;;;;;OAWjC,gBAAgB;4CACqB,gBAAgB;;;;;;;;;;;;;;;AAe5D"}

package/dist/vite-plugin/index.d.ts

@@ -53,6 +53,14 @@ export interface SmrtPluginOptions {
         changesRoute?: {
             enabled?: boolean;
         };
+        /**
+         * Live `_events` SSE route generation (#1763). Enabled by default (the
+         * route is auth-guarded fail-closed, same-origin only); `{ enabled: false }`
+         * skips it.
+         */
+        eventsRoute?: {
+            enabled?: boolean;
+        };
     };
     /** Domain-scoped agent/developer knowledge artifact generation. */
     knowledge?: DomainKnowledgeConfig | false;

package/dist/vite-plugin/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite-plugin/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAiC,MAAM,MAAM,CAAC;AAIlE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAkB5D,YAAY,EACV,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAalC,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qBAAqB;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpC;;OAEG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,8CAA8C;IAC9C,SAAS,CAAC,EAAE;QACV,yDAAyD;QACzD,OAAO,EAAE,OAAO,CAAC;QACjB,wEAAwE;QACxE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,qEAAqE;QACrE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mEAAmE;QACnE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mDAAmD;QACnD,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;WAIG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;WAGG;QACH,YAAY,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KACtC,CAAC;IACF,mEAAmE;IACnE,SAAS,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IAC1C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AA+BD,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,mBAAmB,GAC5B,MAAM,CAaR;AAED,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CAm5BlE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vite-plugin/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAiC,MAAM,MAAM,CAAC;AAIlE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAkB5D,YAAY,EACV,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAalC,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qBAAqB;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpC;;OAEG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,8CAA8C;IAC9C,SAAS,CAAC,EAAE;QACV,yDAAyD;QACzD,OAAO,EAAE,OAAO,CAAC;QACjB,wEAAwE;QACxE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,qEAAqE;QACrE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mEAAmE;QACnE,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,mDAAmD;QACnD,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;WAIG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;WAGG;QACH,YAAY,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QACrC;;;;WAIG;QACH,WAAW,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KACrC,CAAC;IACF,mEAAmE;IACnE,SAAS,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IAC1C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AA+BD,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,mBAAmB,GAC5B,MAAM,CAaR;AAED,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CAu5BlE"}

package/dist/vite-plugin/index.js

@@ -260,6 +260,7 @@ function smrtPlugin(options = {}) {
 				configFileName: svelteKit.configFileName || "smrt.ts",
 				kebabRoutes: svelteKit.kebabRoutes ?? false,
 				changesRoute: svelteKit.changesRoute,
+				eventsRoute: svelteKit.eventsRoute,
 				knowledge: await resolveKnowledgeConfig(resolvedConfig.root, manifest)
 			});
 		},
@@ -324,6 +325,7 @@ function smrtPlugin(options = {}) {
 								configFileName: svelteKit.configFileName || "smrt.ts",
 								kebabRoutes: svelteKit.kebabRoutes ?? false,
 								changesRoute: svelteKit.changesRoute,
+								eventsRoute: svelteKit.eventsRoute,
 								knowledge: await resolveKnowledgeConfig(server.config.root, manifest)
 							});
 							Object.values(VIRTUAL_MODULES).forEach((id) => {
@@ -352,6 +354,7 @@ function smrtPlugin(options = {}) {
 								configFileName: svelteKit.configFileName || "smrt.ts",
 								kebabRoutes: svelteKit.kebabRoutes ?? false,
 								changesRoute: svelteKit.changesRoute,
+								eventsRoute: svelteKit.eventsRoute,
 								knowledge: await resolveKnowledgeConfig(server.config.root, manifest)
 							});
 						}
@@ -376,6 +379,7 @@ function smrtPlugin(options = {}) {
 								configFileName: svelteKit.configFileName || "smrt.ts",
 								kebabRoutes: svelteKit.kebabRoutes ?? false,
 								changesRoute: svelteKit.changesRoute,
+								eventsRoute: svelteKit.eventsRoute,
 								knowledge: await resolveKnowledgeConfig(server.config.root, manifest)
 							});
 						}
@@ -463,10 +467,11 @@ function smrtPlugin(options = {}) {
 		try {
 			const { OxcScanner, ManifestAdapter } = await importScanner();
 			console.log(`[smrt] Using experimental OXC scanner for faster builds`);
+			const safeExclude = [...exclude || [], "**/*.svelte"];
 			const { results, resolved } = await new OxcScanner({
 				cwd: rootDir,
 				include,
-				exclude: [...exclude || [], "**/*.svelte"]
+				exclude: safeExclude
 			}).scanAndResolve();
 			if (results.errors.length > 0) {
 				console.error(`\n[smrt] ❌ Build failed: ${results.errors.length} error(s) during scanning:\n`);
@@ -626,7 +631,8 @@ export function createClient(basePath = '/api/v1') {
 			return options.kebabRoutes ? methodNameToKebab(methodName) : methodName;
 		};
 		const customMethodImpls = customMethods.map(([methodName, _method]) => {
-			return `    ${methodName}: (id, options) => __smrtFetchJson(basePath + '/${collection}/' + id + '/${segmentFor(methodName)}', {
+			const urlSegment = segmentFor(methodName);
+			return `    ${methodName}: (id, options) => __smrtFetchJson(basePath + '/${collection}/' + id + '/${urlSegment}', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(options || {})