@happyvertical/smrt-core 0.40.56 → 0.40.58

package/dist/generators/rest.d.ts

@@ -137,6 +137,45 @@ export declare class APIGenerator {
     private isRoutePublic;
     private isApiActionEnabled;
     private getCollectionObjectName;
+    /**
+     * Dispatch a decorator-declared custom COLLECTION-scoped action —
+     * `@smrt({ api: { include: [...], routes: { action: { scope: 'collection',
+     * method, path } } } })` — on the runtime transport (#2047). The generated
+     * SvelteKit transport already dispatches these routes; this keeps the two
+     * transports coherent for the same decorator metadata.
+     *
+     * Deliberately narrow, matching this router's URL shape: single-segment
+     * collection-scoped paths only (multi-segment custom paths remain a
+     * SvelteKit-transport feature), the action must be exposed by `api.include`
+     * (and not excluded), and the HTTP method must match the route metadata.
+     * Non-matching requests fall through to CRUD handling unchanged.
+     *
+     * Scope is resolved through the shared `resolveCustomActionMetadata`
+     * contract, not read off the route alone: `scope` is OPTIONAL and defaults
+     * to `collection` for statics and `item` for instance methods, so requiring
+     * a literal `scope: 'collection'` would skip a valid static action and let
+     * `POST /<collection>/<action>` fall through into `create`. The receiver
+     * decides — a route-only scope cannot manufacture one — so an action with no
+     * collection-hosted receiver falls through unless the route explicitly
+     * declared `scope: 'collection'`, in which case it is declared-but-missing
+     * and returns 501 rather than degrading into a malformed CRUD write.
+     *
+     * Arguments, failures, and result shaping all reuse the shared custom-action
+     * helpers so this transport matches generated REST/CLI/MCP exactly: declared
+     * parameters are projected (a zero-parameter action takes no body at all, an
+     * `options` bag is passed through, named parameters are read off the body),
+     * a returned `{ ok: false, ... }` failure becomes its requested non-2xx
+     * status with a redacted payload, and success wraps as `{ action, result }`.
+     */
+    private dispatchCustomCollectionAction;
+    /**
+     * Public-safe projection for custom-action results, mirroring the generated
+     * SvelteKit routes' `toPublicResult`: a `SmrtObject` (anything exposing
+     * `toPublicJSON`) becomes its public projection with the caller's
+     * permissions, arrays and plain objects are walked, non-plain instances and
+     * primitives pass through, and a cycle guard breaks reference loops.
+     */
+    private sanitizeActionResult;
     /**
      * Fail-closed tenant read scope (#1782).
      *

package/dist/generators/rest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../../src/generators/rest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,KAAK,EAAqB,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,KAAK,EACV,eAAe,EAGhB,MAAM,mBAAmB,CAAC;AA6B3B,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,cAAc,CAAC,EAAE,CACf,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,KACX,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE;QACZ,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,oDAAoD;IACpD,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAChC;AAiED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAkC,GAC5E,MAAM,CAcR;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,WAAW,CAAiD;IACpE,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,mBAAmB,CAAqB;gBAEpC,MAAM,GAAE,SAAc,EAAE,OAAO,GAAE,UAAe;IAa5D;;;;;OAKG;IACH,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,GACrC,IAAI;IAKP;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;OAEG;IACH,YAAY,IAAI;QAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAoBpD;;OAEG;YACW,cAAc;IAQ5B;;OAEG;YACW,uBAAuB;IAyBrC;;OAEG;YACW,yBAAyB;IAkEvC;;OAEG;IACH,eAAe,IAAI,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC;IAItD;;OAEG;YACW,aAAa;IAyD3B;;OAEG;YACW,iBAAiB;IAmG/B;;OAEG;YACW,oBAAoB;IA6DlC,OAAO,CAAC,aAAa;IAmBrB;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,kBAAkB;IA4B1B,OAAO,CAAC,uBAAuB;IAuB/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,sBAAsB;IAmB9B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;OAEG;YACW,SAAS;IAkEvB;;OAEG;YACW,UAAU;IA0ExB;;OAEG;YACW,WAAW;IA8CzB;;OAEG;YACW,YAAY;IAW1B;;OAEG;YACW,YAAY;IAoB1B;;OAEG;YACW,YAAY;IAc1B;;;;;OAKG;YACW,eAAe;IAqB7B;;;;OAIG;YACW,sBAAsB;IA+DpC;;OAEG;YACW,aAAa;IA6B3B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAiD3B;;;OAGG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,oBAAoB;IAI5B;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IA2B9B,OAAO,CAAC,uBAAuB;IAe/B,OAAO,CAAC,2BAA2B;IAyBnC;;;;;;;;;;OAUG;YACW,eAAe;IAqB7B,OAAO,CAAC,mBAAmB;IAQ3B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAS3B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAQ5B;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAI9B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAsB1B;;OAEG;IACH,OAAO,CAAC,cAAc;IA+BtB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,4BAA4B;IAsBpC;;OAEG;IACH,OAAO,CAAC,SAAS;CASlB;AAID,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,CAAC,OAAO,UAAU,CAAC,EAAE,EAC9B,OAAO,GAAE,UAAe,EACxB,MAAM,GAAE,gBAAqB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CActC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,CAAC,OAAO,UAAU,CAAC,EAAE,EAC9B,OAAO,GAAE,UAAe,EACxB,MAAM,GAAE,gBAAqB,GAC5B,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAwB9B"}
+{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../../src/generators/rest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,KAAK,EAAqB,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,KAAK,EAEV,eAAe,EAGhB,MAAM,mBAAmB,CAAC;AAkC3B,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,cAAc,CAAC,EAAE,CACf,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,KACX,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE;QACZ,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,oDAAoD;IACpD,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAChC;AAiED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAkC,GAC5E,MAAM,CAcR;AAED;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,WAAW,CAAiD;IACpE,OAAO,CAAC,OAAO,CAAa;IAC5B,OAAO,CAAC,mBAAmB,CAAqB;gBAEpC,MAAM,GAAE,SAAc,EAAE,OAAO,GAAE,UAAe;IAa5D;;;;;OAKG;IACH,kBAAkB,CAChB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,GACrC,IAAI;IAKP;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;OAEG;IACH,YAAY,IAAI;QAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE;IAoBpD;;OAEG;YACW,cAAc;IAQ5B;;OAEG;YACW,uBAAuB;IAyBrC;;OAEG;YACW,yBAAyB;IAkEvC;;OAEG;IACH,eAAe,IAAI,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC;IAItD;;OAEG;YACW,aAAa;IAyD3B;;OAEG;YACW,iBAAiB;IAmG/B;;OAEG;YACW,oBAAoB;IA6ElC,OAAO,CAAC,aAAa;IAmBrB;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,kBAAkB;IA4B1B,OAAO,CAAC,uBAAuB;IAuB/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,8BAA8B;IAyI5C;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAoC5B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,sBAAsB;IAmB9B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;OAEG;YACW,SAAS;IAkEvB;;OAEG;YACW,UAAU;IA0ExB;;OAEG;YACW,WAAW;IA8CzB;;OAEG;YACW,YAAY;IAW1B;;OAEG;YACW,YAAY;IAoB1B;;OAEG;YACW,YAAY;IAc1B;;;;;OAKG;YACW,eAAe;IAqB7B;;;;OAIG;YACW,sBAAsB;IA+DpC;;OAEG;YACW,aAAa;IA6B3B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAiD3B;;;OAGG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,oBAAoB;IAI5B;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IA2B9B,OAAO,CAAC,uBAAuB;IAe/B,OAAO,CAAC,2BAA2B;IAyBnC;;;;;;;;;;OAUG;YACW,eAAe;IAqB7B,OAAO,CAAC,mBAAmB;IAQ3B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAY/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAS3B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAQ5B;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAI9B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAsB1B;;OAEG;IACH,OAAO,CAAC,cAAc;IA+BtB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,4BAA4B;IAsBpC;;OAEG;IACH,OAAO,CAAC,SAAS;CASlB;AAID,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;CACH;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,CAAC,OAAO,UAAU,CAAC,EAAE,EAC9B,OAAO,GAAE,UAAe,EACxB,MAAM,GAAE,gBAAqB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CActC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,CAAC,OAAO,UAAU,CAAC,EAAE,EAC9B,OAAO,GAAE,UAAe,EACxB,MAAM,GAAE,gBAAqB,GAC5B,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAwB9B"}

package/dist/generators/rest.js

@@ -1,5 +1,6 @@
 import { isTenantScopedClassResolved, resolveDispatchTenantScope } from "../dispatch/tenant-resolver.js";
 import { getTableVersion } from "../change-feed.js";
+import { buildCustomActionInvocationArgs, normalizeCustomActionFailure, resolveCustomActionMetadata } from "./custom-action.js";
 import { ObjectRegistry } from "../registry.js";
 import "../dispatch/index.js";
 import { canonicalReadRepresentation, computeTableVersionEtag, conditionalJsonResponse, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, resolveReadCacheControl, resolveTenantEtagDiscriminator, versionConditionalResponse, warnIfSharedCacheNeutralized, warnIfTenantScopedPublicRead } from "./conditional-get.js";
@@ -286,6 +287,10 @@ var APIGenerator = class {
 	*/
 	async executeCrudOperation(req, collection, objectId, url, objectName) {
 		try {
+			if (objectId && objectName) {
+				const customResponse = await this.dispatchCustomCollectionAction(req, collection, objectId, url, objectName);
+				if (customResponse) return customResponse;
+			}
 			const action = this.getCrudAction(req.method, objectId);
 			if (action && !this.isApiActionEnabled(objectName, action)) return this.createErrorResponse(405, "Method not allowed");
 			if (objectId === "count" && req.method === "GET") return await this.handleCount(collection, url.searchParams, objectName);
@@ -349,6 +354,116 @@ var APIGenerator = class {
 		return registered?.qualifiedName || registered?.name || itemClass.name;
 	}
 	/**
+	* Dispatch a decorator-declared custom COLLECTION-scoped action —
+	* `@smrt({ api: { include: [...], routes: { action: { scope: 'collection',
+	* method, path } } } })` — on the runtime transport (#2047). The generated
+	* SvelteKit transport already dispatches these routes; this keeps the two
+	* transports coherent for the same decorator metadata.
+	*
+	* Deliberately narrow, matching this router's URL shape: single-segment
+	* collection-scoped paths only (multi-segment custom paths remain a
+	* SvelteKit-transport feature), the action must be exposed by `api.include`
+	* (and not excluded), and the HTTP method must match the route metadata.
+	* Non-matching requests fall through to CRUD handling unchanged.
+	*
+	* Scope is resolved through the shared `resolveCustomActionMetadata`
+	* contract, not read off the route alone: `scope` is OPTIONAL and defaults
+	* to `collection` for statics and `item` for instance methods, so requiring
+	* a literal `scope: 'collection'` would skip a valid static action and let
+	* `POST /<collection>/<action>` fall through into `create`. The receiver
+	* decides — a route-only scope cannot manufacture one — so an action with no
+	* collection-hosted receiver falls through unless the route explicitly
+	* declared `scope: 'collection'`, in which case it is declared-but-missing
+	* and returns 501 rather than degrading into a malformed CRUD write.
+	*
+	* Arguments, failures, and result shaping all reuse the shared custom-action
+	* helpers so this transport matches generated REST/CLI/MCP exactly: declared
+	* parameters are projected (a zero-parameter action takes no body at all, an
+	* `options` bag is passed through, named parameters are read off the body),
+	* a returned `{ ok: false, ... }` failure becomes its requested non-2xx
+	* status with a redacted payload, and success wraps as `{ action, result }`.
+	*/
+	async dispatchCustomCollectionAction(req, collection, pathSegment, url, objectName) {
+		const apiConfig = ObjectRegistry.getConfig(objectName)?.api;
+		if (!apiConfig || typeof apiConfig !== "object" || !apiConfig.routes) return null;
+		for (const [actionName, routeConfig] of Object.entries(apiConfig.routes)) {
+			const routePath = routeConfig?.path || actionName;
+			if (routePath.includes("/") || routePath !== pathSegment) continue;
+			const routeMethod = (routeConfig?.method || "POST").toUpperCase();
+			if (routeMethod !== req.method.toUpperCase()) continue;
+			if (apiConfig.include && !apiConfig.include.includes(actionName)) continue;
+			if (apiConfig.exclude?.includes(actionName)) continue;
+			const collectionMethod = collection[actionName];
+			const itemConstructor = ObjectRegistry.getClass(objectName)?.constructor;
+			const staticMethod = itemConstructor?.[actionName];
+			const isCollectionHosted = typeof collectionMethod === "function";
+			if (!isCollectionHosted && !(!isCollectionHosted && typeof staticMethod === "function")) {
+				if (routeConfig?.scope === "collection") return this.createErrorResponse(501, `Custom action '${actionName}' is declared but not implemented`);
+				continue;
+			}
+			const metadata = resolveCustomActionMetadata({
+				actionName,
+				apiConfig,
+				method: ObjectRegistry.getMethods(objectName)?.get(actionName),
+				defaultScope: "collection"
+			});
+			if (metadata.scope !== "collection") continue;
+			const invoke = isCollectionHosted ? (args) => collectionMethod.apply(collection, args) : (args) => staticMethod.apply(itemConstructor, args);
+			let options;
+			if (routeMethod === "GET") options = Object.fromEntries(url.searchParams.entries());
+			else {
+				let rawBody = "";
+				try {
+					rawBody = await req.text();
+				} catch {
+					rawBody = "";
+				}
+				if (rawBody.trim() !== "") try {
+					options = JSON.parse(rawBody);
+				} catch {
+					return this.createErrorResponse(400, "Invalid JSON body");
+				}
+			}
+			const result = await invoke(metadata.parameters ? buildCustomActionInvocationArgs(metadata, {
+				...options && typeof options === "object" && !Array.isArray(options) ? options : {},
+				options
+			}) : [options]);
+			const failure = normalizeCustomActionFailure(result);
+			if (failure) return this.createJsonResponse({ error: failure }, failure.status);
+			return this.createJsonResponse({
+				action: actionName,
+				result: this.sanitizeActionResult(result)
+			});
+		}
+		return null;
+	}
+	/**
+	* Public-safe projection for custom-action results, mirroring the generated
+	* SvelteKit routes' `toPublicResult`: a `SmrtObject` (anything exposing
+	* `toPublicJSON`) becomes its public projection with the caller's
+	* permissions, arrays and plain objects are walked, non-plain instances and
+	* primitives pass through, and a cycle guard breaks reference loops.
+	*/
+	sanitizeActionResult(value, seen = /* @__PURE__ */ new WeakSet()) {
+		if (value === null || typeof value !== "object") return value;
+		if (seen.has(value)) return null;
+		const serializable = value;
+		if (typeof serializable.toPublicJSON === "function") {
+			seen.add(value);
+			return this.sanitizeActionResult(serializable.toPublicJSON(this.getPublicJsonOptions()), seen);
+		}
+		if (Array.isArray(value)) {
+			seen.add(value);
+			return value.map((entry) => this.sanitizeActionResult(entry, seen));
+		}
+		const proto = Object.getPrototypeOf(value);
+		if (proto !== Object.prototype && proto !== null) return value;
+		seen.add(value);
+		const out = {};
+		for (const [key, entry] of Object.entries(value)) out[key] = this.sanitizeActionResult(entry, seen);
+		return out;
+	}
+	/**
 	* Fail-closed tenant read scope (#1782).
 	*
 	* A `@TenantScoped` model served over a public/anonymous read has no ambient

package/dist/generators/rest.js.map

@@ -1 +1 @@
-{"version":3,"file":"rest.js","names":[],"sources":["../../src/generators/rest.ts"],"sourcesContent":["/**\n * High-performance REST API generator for smrt objects using Node.js HTTP server\n *\n * Designed for minimal bundle size and maximum performance\n */\n\nimport http from 'node:http';\nimport { getTableVersion } from '../change-feed';\nimport type { SmrtCollection } from '../collection';\nimport {\n  isTenantScopedClassResolved,\n  resolveDispatchTenantScope,\n} from '../dispatch';\nimport type { PublicJsonOptions, SmrtObject } from '../object';\nimport { ObjectRegistry } from '../registry';\nimport type {\n  RegisteredClass,\n  RegisteredField,\n  SmrtObjectConstructor,\n} from '../registry/types';\nimport type {\n  FieldDefinition,\n  MethodDefinition,\n  SmartObjectDefinition,\n  SmartObjectManifest,\n} from '../scanner/types';\nimport {\n  processSyncApplyBatch,\n  SYNC_APPLY_ROUTE_SEGMENTS,\n  type SyncApplyOp,\n  type SyncApplyTarget,\n} from '../sync/apply';\nimport { computeWebManifestHash } from '../vite-plugin/web-collections';\nimport { handleChangesRoute } from './changes-route';\nimport {\n  canonicalReadRepresentation,\n  computeTableVersionEtag,\n  conditionalJsonResponse,\n  ifNoneMatchHasConcreteMatch,\n  ifNoneMatchSatisfied,\n  resolveReadCacheControl,\n  resolveTenantEtagDiscriminator,\n  versionConditionalResponse,\n  warnIfSharedCacheNeutralized,\n  warnIfTenantScopedPublicRead,\n} from './conditional-get';\nimport { handleEventsRoute } from './events-route';\n\nexport interface APIConfig {\n  basePath?: string;\n  enableCors?: boolean;\n  /**\n   * Explicit CORS origin allowlist (#1540). Required when `enableCors` is true —\n   * the generator never emits `Access-Control-Allow-Origin: *`. A request's\n   * `Origin` is echoed only when it appears here.\n   */\n  allowedOrigins?: string[];\n  /**\n   * Opt into credentialed CORS (#1861). When true, CORS responses to an\n   * allow-listed origin also carry `Access-Control-Allow-Credentials: true`, so\n   * a cross-origin browser client may send cookies (the only auth an\n   * `EventSource` can carry — it cannot set an `Authorization` header). Requires\n   * `enableCors` + a non-empty `allowedOrigins`: credentials are NEVER paired\n   * with a wildcard origin, and the origin is still echoed only when it is\n   * explicitly allow-listed. Fail-closed default (`false`): same-origin only,\n   * even when CORS is otherwise enabled, so a plain `enableCors` never silently\n   * starts flowing cookies cross-origin.\n   */\n  allowCredentials?: boolean;\n  customRoutes?: Record<string, (req: Request) => Promise<Response>>;\n  authMiddleware?: (\n    objectName: string,\n    action: string,\n  ) => (req: Request) => Promise<Request | Response>;\n  port?: number;\n  hostname?: string;\n  /**\n   * Live `_events` route options. `maxSubscribers` caps active SSE streams per\n   * process (#1860); over-cap connections receive a retryable 503. Set to 0\n   * for no cap.\n   */\n  eventsRoute?: {\n    maxSubscribers?: number;\n  };\n  /**\n   * The build's web-collection SHAPE digest (#1764) — the same value the\n   * generated `@happyvertical/smrt-virt-web` module exports. When supplied it is\n   * folded into every read ETag via {@link computeTableVersionEtag}, so a\n   * shape-only deploy (no table write) busts every read validator, closing\n   * the documented v2 staleness gap. When omitted, APIGenerator computes the\n   * same digest from the runtime registry on first read (#1862). The generated\n   * SvelteKit routes bake the same constant in directly rather than going\n   * through this runtime server.\n   */\n  manifestHash?: string;\n}\n\nexport interface APIContext {\n  db?: unknown;\n  ai?: unknown;\n  user?: {\n    id: string;\n    username?: string;\n    roles?: string[];\n  };\n  /** Resolved permission slugs held by the caller. */\n  permissions?: Iterable<string>;\n}\n\nfunction registeredFieldsToManifest(\n  fields: Map<string, RegisteredField>,\n): Record<string, FieldDefinition> {\n  const result: Record<string, FieldDefinition> = {};\n  for (const [name, field] of fields) {\n    if (!field || typeof field.type !== 'string') continue;\n    const defaultValue =\n      field.default !== undefined ? field.default : field._meta?.default;\n    result[name] = {\n      type: field.type as FieldDefinition['type'],\n      ...(field.required !== undefined ? { required: field.required } : {}),\n      ...(defaultValue !== undefined ? { default: defaultValue } : {}),\n      ...(field.related !== undefined ? { related: field.related } : {}),\n      ...(field.transient !== undefined ? { transient: field.transient } : {}),\n      ...(field.sensitive !== undefined ? { sensitive: field.sensitive } : {}),\n      ...(field.readonly !== undefined ? { readonly: field.readonly } : {}),\n      ...(field.readPermission !== undefined\n        ? { readPermission: field.readPermission }\n        : {}),\n      ...(field._meta !== undefined ? { _meta: field._meta } : {}),\n    };\n  }\n  return result;\n}\n\nfunction registeredMethodsToManifest(\n  methods: Map<string, MethodDefinition> | undefined,\n): Record<string, MethodDefinition> {\n  return Object.fromEntries(methods ?? []);\n}\n\nfunction pluralizeRuntimeCollectionName(className: string): string {\n  const lower = className.toLowerCase();\n  if (lower.endsWith('y')) return `${lower.slice(0, -1)}ies`;\n  if (lower.endsWith('s') || lower.endsWith('x') || lower.endsWith('z')) {\n    return `${lower}es`;\n  }\n  if (lower.endsWith('ch') || lower.endsWith('sh')) return `${lower}es`;\n  return `${lower}s`;\n}\n\nfunction runtimeObjectDefinition(\n  key: string,\n  info: RegisteredClass,\n): SmartObjectDefinition {\n  const className = info.name || key;\n  return {\n    className,\n    name: className.toLowerCase(),\n    collection: info.collection || pluralizeRuntimeCollectionName(className),\n    filePath: info.sourceFilePath || '',\n    fields: registeredFieldsToManifest(info.inheritedFields || info.fields),\n    methods: registeredMethodsToManifest(info.inheritedMethods || info.methods),\n    decoratorConfig: info.config || {},\n    ...(info.qualifiedName ? { qualifiedName: info.qualifiedName } : {}),\n    ...(info.packageName ? { packageName: info.packageName } : {}),\n    ...(info.visibility ? { visibility: info.visibility } : {}),\n    ...(info.extends ? { extends: info.extends } : {}),\n    ...(info.extendsTypeArg ? { extendsTypeArg: info.extendsTypeArg } : {}),\n    ...(info.tools ? { tools: info.tools } : {}),\n  };\n}\n\n/**\n * Compute the runtime REST web-manifest hash from the registered object graph\n * (#1862). This mirrors the Vite/SvelteKit source (`computeWebManifestHash`)\n * but builds the manifest from `ObjectRegistry` for APIGenerator deployments.\n */\nexport function computeRuntimeWebManifestHash(\n  classes: Iterable<[string, RegisteredClass]> = ObjectRegistry.getAllClasses(),\n): string {\n  const objects: SmartObjectManifest['objects'] = {};\n  const seen = new Set<RegisteredClass>();\n  for (const [key, info] of classes) {\n    if (seen.has(info)) continue;\n    seen.add(info);\n    const manifestKey = info.qualifiedName || key;\n    objects[manifestKey] = runtimeObjectDefinition(key, info);\n  }\n  return computeWebManifestHash({\n    version: 'runtime',\n    timestamp: 0,\n    objects,\n  });\n}\n\n/**\n * High-performance API generator using native Bun\n */\nexport class APIGenerator {\n  private config: APIConfig;\n  private collections = new Map<string, SmrtCollection<SmrtObject>>();\n  private context: APIContext;\n  private runtimeManifestHash: string | undefined;\n\n  constructor(config: APIConfig = {}, context: APIContext = {}) {\n    this.config = {\n      basePath: '/api/v1',\n      // Security defaults (#1540): bind to loopback and keep CORS off unless an\n      // explicit origin allowlist is supplied. No `Access-Control-Allow-Origin: *`.\n      enableCors: false,\n      port: 3000,\n      hostname: '127.0.0.1',\n      ...config,\n    };\n    this.context = context;\n  }\n\n  /**\n   * Register a pre-configured collection instance for API exposure\n   *\n   * @param name - URL path segment for the collection (e.g., 'products' for /api/products)\n   * @param collection - Pre-initialized SmrtCollection instance\n   */\n  registerCollection(\n    name: string,\n    collection: SmrtCollection<SmrtObject>,\n  ): void {\n    this.collections.set(name, collection);\n    this.runtimeManifestHash = undefined;\n  }\n\n  /**\n   * Resolve the database for generator-level routes that are not object-scoped\n   * (currently the `_changes` feed, #1758).\n   *\n   * Prefers the explicit `APIContext.db`, but falls back to the first\n   * registered collection's live handle so the feed works under the documented\n   * `registerCollection()` wiring, where callers configure collections with a\n   * database but never populate `APIContext.db`. Without the fallback the feed\n   * would 503 even though the database is reachable.\n   */\n  private resolveContextDb(): unknown {\n    return (\n      this.context.db ?? this.collections.values().next().value?.db ?? undefined\n    );\n  }\n\n  /**\n   * Create Node.js HTTP server with all routes\n   */\n  createServer(): { server: http.Server; url: string } {\n    const server = http.createServer(async (req, res) => {\n      try {\n        const request = await this.nodeRequestToWebRequest(req);\n        const response = await this.handleRequest(request);\n        await this.webResponseToNodeResponse(response, res);\n      } catch (_error) {\n        res.statusCode = 500;\n        res.end('Internal Server Error');\n      }\n    });\n\n    server.listen(this.config.port, this.config.hostname);\n\n    return {\n      server,\n      url: `http://${this.config.hostname}:${this.config.port}`,\n    };\n  }\n\n  /**\n   * Convert stream to string\n   */\n  private async streamToString(stream: http.IncomingMessage): Promise<string> {\n    const chunks: Buffer[] = [];\n    for await (const chunk of stream) {\n      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n    }\n    return Buffer.concat(chunks).toString('utf-8');\n  }\n\n  /**\n   * Convert Node.js IncomingMessage to Web Request\n   */\n  private async nodeRequestToWebRequest(\n    req: http.IncomingMessage,\n  ): Promise<Request> {\n    const url = `http://${this.config.hostname}:${this.config.port}${req.url}`;\n    const method = req.method || 'GET';\n    const headers = new Headers();\n\n    for (const [key, value] of Object.entries(req.headers)) {\n      if (value) {\n        headers.set(key, Array.isArray(value) ? value[0] : value);\n      }\n    }\n\n    let body: string | undefined;\n    if (method !== 'GET' && method !== 'HEAD') {\n      body = await this.streamToString(req);\n    }\n\n    return new Request(url, {\n      method,\n      headers,\n      body,\n    });\n  }\n\n  /**\n   * Convert Web Response to Node.js ServerResponse\n   */\n  private async webResponseToNodeResponse(\n    webResponse: Response,\n    res: http.ServerResponse,\n  ): Promise<void> {\n    res.statusCode = webResponse.status;\n\n    // Set headers\n    webResponse.headers.forEach((value, key) => {\n      res.setHeader(key, value);\n    });\n\n    // Send body\n    if (webResponse.body) {\n      const reader = webResponse.body.getReader();\n\n      // Client disconnect handling — essential for the long-lived `_events` SSE\n      // stream (#1763): a never-ending stream is only torn down when its reader\n      // is cancelled, and nothing cancels it unless we detect the socket close.\n      // On `res`/socket 'close' before the response finished, cancel the reader\n      // so the source stream's `cancel()` fires (unsubscribe + clear heartbeat).\n      let clientGone = false;\n      const onClose = () => {\n        if (res.writableFinished) return; // normal completion, not a disconnect\n        clientGone = true;\n        void reader.cancel().catch(() => {});\n      };\n      res.on('close', onClose);\n\n      try {\n        while (true) {\n          const { done, value } = await reader.read();\n          if (done || clientGone) break;\n          if (!res.write(value)) {\n            // Respect back-pressure so a slow/absent consumer can't unbounded-\n            // buffer in the Node socket. Resolve on 'drain' OR on 'close'/\n            // 'error' — a disconnect while back-pressured never fires 'drain',\n            // so waiting only for it would hang this frame forever (leaking it\n            // and pinning the reader for the long-lived `_events` stream). Race\n            // the three and remove the losers so one-shot listeners don't pile\n            // up across many drains.\n            await new Promise<void>((resolve) => {\n              const settle = () => {\n                res.off('drain', settle);\n                res.off('close', settle);\n                res.off('error', settle);\n                resolve();\n              };\n              res.once('drain', settle);\n              res.once('close', settle);\n              res.once('error', settle);\n            });\n            if (clientGone) break;\n          }\n        }\n      } catch {\n        // Reader cancelled (client gone) or write failed — stop streaming.\n      } finally {\n        res.off('close', onClose);\n      }\n    }\n\n    if (!res.writableEnded) {\n      res.end();\n    }\n  }\n\n  /**\n   * Generate fetch handler function (for serverless environments)\n   */\n  generateHandler(): (req: Request) => Promise<Response> {\n    return (req) => this.handleRequest(req);\n  }\n\n  /**\n   * Main request handler using native Bun APIs\n   */\n  private async handleRequest(req: Request): Promise<Response> {\n    const url = new URL(req.url);\n\n    // Handle CORS preflight\n    if (req.method === 'OPTIONS' && this.config.enableCors) {\n      return this.createCorsResponse(req);\n    }\n\n    // Handle custom routes first\n    if (this.config.customRoutes) {\n      for (const [path, handler] of Object.entries(this.config.customRoutes)) {\n        if (url.pathname === `${this.config.basePath}${path}`) {\n          const response = await handler(req);\n          return this.addCorsHeaders(response, req);\n        }\n      }\n    }\n\n    // Change-feed route (#1758): auth-guarded, tenant-scoped cursor read\n    // over the _smrt_changes log. Logic lives in ./changes-route.ts.\n    if (url.pathname === `${this.config.basePath}/_changes`) {\n      const response = await handleChangesRoute(req, {\n        authMiddleware: this.config.authMiddleware,\n        db: this.resolveContextDb(),\n      });\n      return this.addCorsHeaders(response, req);\n    }\n\n    // Live change-signal SSE route (#1763): auth-guarded, tenant-scoped\n    // Server-Sent-Events stream of coarse signals (no row payloads). Logic\n    // lives in ./events-route.ts. Wrapped in addCorsHeaders so a cross-origin\n    // credentialed EventSource can subscribe when `allowCredentials` + an\n    // allow-listed origin are configured (#1861); with the fail-closed default\n    // (`allowCredentials: false`) this stays same-origin only, exactly as\n    // before. The stream body passes through untouched — addCorsHeaders only\n    // re-wraps headers. Fail-closed auth is unchanged: the CORS layer never\n    // authorizes; it only lets an already-authorized cookie reach the guard.\n    if (url.pathname === `${this.config.basePath}/_events`) {\n      const response = await handleEventsRoute(req, {\n        authMiddleware: this.config.authMiddleware,\n        db: this.resolveContextDb(),\n        manifestHash: this.resolveManifestHash(),\n        maxSubscribers: this.config.eventsRoute?.maxSubscribers,\n      });\n      return this.addCorsHeaders(response, req);\n    }\n\n    // Handle object routes\n    if (url.pathname.startsWith(this.config.basePath || '')) {\n      const response = await this.handleObjectRoute(req, url);\n      return this.addCorsHeaders(response, req);\n    }\n\n    // Not found\n    return this.createErrorResponse(404, 'Not found');\n  }\n\n  /**\n   * Handle CRUD routes for SMRT objects\n   */\n  private async handleObjectRoute(req: Request, url: URL): Promise<Response> {\n    const pathParts = url.pathname\n      .replace(this.config.basePath || '', '')\n      .split('/')\n      .filter(Boolean);\n\n    if (pathParts.length === 0) {\n      return this.createErrorResponse(400, 'Object type required');\n    }\n\n    // Reserved batch write contract route (#1759): POST {basePath}/sync/apply.\n    if (\n      pathParts.length === SYNC_APPLY_ROUTE_SEGMENTS.length &&\n      SYNC_APPLY_ROUTE_SEGMENTS.every((segment, i) => pathParts[i] === segment)\n    ) {\n      if (req.method !== 'POST') {\n        return this.createErrorResponse(405, 'Method not allowed');\n      }\n      return await this.handleSyncApply(req);\n    }\n\n    const objectType = pathParts[0];\n    const objectId = pathParts[1];\n\n    // Check for explicitly registered collection first\n    if (this.collections.has(objectType)) {\n      const collection = this.collections.get(objectType);\n      if (!collection) throw new Error(`Collection ${objectType} not found`);\n\n      const objectName = this.getCollectionObjectName(collection) || objectType;\n\n      // Apply auth middleware if configured\n      if (this.config.authMiddleware) {\n        const authCheck = this.config.authMiddleware(\n          objectName,\n          req.method.toLowerCase(),\n        );\n        const authResult = await authCheck(req);\n        if (authResult instanceof Response) {\n          return authResult; // Auth failed\n        }\n        // Auth passed, use the potentially modified request\n        req = authResult;\n      } else if (!this.isRoutePublic(objectName, req.method)) {\n        // Fail-closed (#1540): no auth middleware wired and the object isn't\n        // marked `@smrt({ api: { public } })` → refuse rather than serve open.\n        return this.createErrorResponse(401, 'Authentication required');\n      }\n\n      // Use registered collection directly\n      return await this.executeCrudOperation(\n        req,\n        collection,\n        objectId,\n        url,\n        objectName,\n      );\n    }\n\n    // Fall back to auto-discovery via ObjectRegistry, matching the URL segment\n    // against the canonical manifest `collection` value (#1794).\n    const classInfo = this.findClassByCollectionSegment(objectType);\n\n    if (!classInfo) {\n      return this.createErrorResponse(\n        404,\n        `Object type '${objectType}' not found`,\n      );\n    }\n\n    // Apply auth middleware if configured\n    if (this.config.authMiddleware) {\n      const authCheck = this.config.authMiddleware(\n        classInfo.name,\n        req.method.toLowerCase(),\n      );\n      const authResult = await authCheck(req);\n      if (authResult instanceof Response) {\n        return authResult; // Auth failed\n      }\n      // Auth passed, use the potentially modified request\n      req = authResult;\n    } else if (!this.isRoutePublic(classInfo.name, req.method)) {\n      // Fail-closed (#1540): see registered-collection branch above.\n      return this.createErrorResponse(401, 'Authentication required');\n    }\n\n    // Get or create collection\n    const collection = await this.getCollection(classInfo);\n\n    return await this.executeCrudOperation(\n      req,\n      collection,\n      objectId,\n      url,\n      classInfo.name,\n    );\n  }\n\n  /**\n   * Execute CRUD operation on a collection\n   */\n  private async executeCrudOperation(\n    req: Request,\n    collection: SmrtCollection<SmrtObject>,\n    objectId: string | undefined,\n    url: URL,\n    objectName?: string,\n  ): Promise<Response> {\n    try {\n      const action = this.getCrudAction(req.method, objectId);\n      if (action && !this.isApiActionEnabled(objectName, action)) {\n        return this.createErrorResponse(405, 'Method not allowed');\n      }\n\n      // Handle special /count endpoint\n      if (objectId === 'count' && req.method === 'GET') {\n        return await this.handleCount(collection, url.searchParams, objectName);\n      }\n\n      // Route to appropriate CRUD operation\n      switch (req.method) {\n        case 'GET':\n          return objectId\n            ? await this.handleGet(collection, objectId, req, objectName)\n            : await this.handleList(\n                collection,\n                url.searchParams,\n                req,\n                objectName,\n              );\n\n        case 'POST':\n          return await this.handleCreate(collection, req, objectName);\n\n        case 'PUT':\n        case 'PATCH':\n          if (!objectId) {\n            return this.createErrorResponse(\n              400,\n              'Object ID required for update',\n            );\n          }\n          return await this.handleUpdate(collection, objectId, req, objectName);\n\n        case 'DELETE':\n          if (!objectId) {\n            return this.createErrorResponse(\n              400,\n              'Object ID required for delete',\n            );\n          }\n          return await this.handleDelete(collection, objectId);\n\n        default:\n          return this.createErrorResponse(405, 'Method not allowed');\n      }\n    } catch (error) {\n      console.error('API Error:', error);\n      return this.createErrorResponse(500, 'Internal server error');\n    }\n  }\n\n  private getCrudAction(\n    method: string,\n    objectId: string | undefined,\n  ): 'list' | 'get' | 'create' | 'update' | 'delete' | null {\n    switch (method) {\n      case 'GET':\n        return objectId && objectId !== 'count' ? 'get' : 'list';\n      case 'POST':\n        return 'create';\n      case 'PUT':\n      case 'PATCH':\n        return 'update';\n      case 'DELETE':\n        return 'delete';\n      default:\n        return null;\n    }\n  }\n\n  /**\n   * Fail-closed authorization posture (#1540). Returns true only when the\n   * object opts out of auth via `@smrt({ api: { public } })`:\n   * - `public: true` → all methods are public.\n   * - `public: 'read'` → only safe (GET) methods are public.\n   * Everything else requires an `authMiddleware` to be configured.\n   */\n  private isRoutePublic(\n    objectName: string | undefined,\n    method: string,\n  ): boolean {\n    if (!objectName) return false;\n    const apiConfig = ObjectRegistry.getConfig(objectName)?.api;\n    if (!apiConfig || typeof apiConfig !== 'object') return false;\n    const publicAccess = (apiConfig as { public?: boolean | 'read' }).public;\n    if (publicAccess === true) return true;\n    if (publicAccess === 'read') return method.toUpperCase() === 'GET';\n    return false;\n  }\n\n  private isApiActionEnabled(\n    objectName: string | undefined,\n    action: 'list' | 'get' | 'create' | 'update' | 'delete',\n  ): boolean {\n    if (!objectName) {\n      return true;\n    }\n\n    const config = ObjectRegistry.getConfig(objectName);\n    const apiConfig = config.api;\n\n    if (apiConfig === false) {\n      return false;\n    }\n\n    if (apiConfig && typeof apiConfig === 'object') {\n      if (apiConfig.include && !apiConfig.include.includes(action)) {\n        return false;\n      }\n\n      if (apiConfig.exclude?.includes(action)) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  private getCollectionObjectName(\n    collection: SmrtCollection<SmrtObject>,\n  ): string | undefined {\n    // `_itemClass` lives on the instance (protected getter) or the collection\n    // constructor (static). Read it through a structural shape rather than the\n    // class's private surface; behavior is unchanged.\n    const itemClass: SmrtObjectConstructor | undefined =\n      (collection as unknown as { _itemClass?: SmrtObjectConstructor })\n        ._itemClass ||\n      (\n        collection.constructor as unknown as {\n          _itemClass?: SmrtObjectConstructor;\n        }\n      )?._itemClass;\n\n    if (!itemClass) {\n      return undefined;\n    }\n\n    const registered = ObjectRegistry.getClassByConstructor(itemClass);\n    return registered?.qualifiedName || registered?.name || itemClass.name;\n  }\n\n  /**\n   * Fail-closed tenant read scope (#1782).\n   *\n   * A `@TenantScoped` model served over a public/anonymous read has no ambient\n   * tenant context, so the tenancy interceptor (optional mode) passes the query\n   * through UNFILTERED and returns every tenant's rows. When tenancy is enabled\n   * but no tenant is active, this returns a `{ tenantId: null }` filter so reads\n   * fail closed to NULL-tenant (global) rows only — mirroring the dispatch\n   * resolver's \"enforced, no active tenant → global rows only\" convention\n   * (`resolveDispatchTenantScope` is the core-level trust anchor tenancy fills\n   * in; core cannot import tenancy directly). Returns undefined when a tenant IS\n   * active (the interceptor filters by it) or tenancy is disabled (no isolation\n   * to enforce).\n   *\n   * Tenant scoping is recognized across BOTH registration forms (#1782): the\n   * `@smrt({ tenantScoped })` config / manifest-merged form via\n   * `ObjectRegistry.isTenantScoped`, and the standalone `@TenantScoped()`\n   * decorator via the tenancy-filled `isTenantScopedClassResolved` hook — so a\n   * `@TenantScoped()`-only public model can't slip past the guard regardless of\n   * manifest timing.\n   */\n  private resolveTenantReadScope(\n    objectName?: string,\n  ): { tenantId: null } | undefined {\n    if (\n      !objectName ||\n      !(\n        ObjectRegistry.isTenantScoped(objectName) ||\n        !!ObjectRegistry.getConfig(objectName)?.tenantScoped ||\n        isTenantScopedClassResolved(objectName)\n      )\n    ) {\n      return undefined;\n    }\n    const scope = resolveDispatchTenantScope();\n    return scope.enforced && scope.tenantId === null\n      ? { tenantId: null }\n      : undefined;\n  }\n\n  /**\n   * Merge the fail-closed tenant read scope (#1782) into a query's WHERE clause.\n   * When the scope is active (global-only), any client-supplied tenant filter is\n   * dropped first so a `?tenantId=...` / `?tenant_id[ne]=...` query param can\n   * never widen the scope, then NULL-tenant is forced. Returns the original\n   * `where` untouched when the scope is inactive.\n   */\n  private applyTenantReadScope(\n    objectName: string | undefined,\n    where: Record<string, string | string[]> | undefined,\n  ): Record<string, unknown> | undefined {\n    const scope = this.resolveTenantReadScope(objectName);\n    if (!scope) {\n      return where;\n    }\n    const cleaned: Record<string, unknown> = {};\n    for (const [key, value] of Object.entries(where ?? {})) {\n      // A key may carry an operator suffix, e.g. \"tenant_id !=\" — match on the\n      // field portion so no operator variant slips a client tenant filter past.\n      const field = key.split(/\\s+/)[0];\n      if (field === 'tenantId' || field === 'tenant_id') {\n        continue;\n      }\n      cleaned[key] = value;\n    }\n    cleaned.tenantId = null;\n    return cleaned;\n  }\n\n  /**\n   * Handle GET /objects/:id\n   */\n  private async handleGet(\n    collection: SmrtCollection<SmrtObject>,\n    id: string,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const cacheControl = this.resolveReadCachePolicy(objectName);\n\n    if (this.hasReadPermissionFields(objectName)) {\n      // Field-level read permissions make the response body vary by caller\n      // permissions, so the validator must cover the redacted body returned to\n      // this caller rather than only the table version.\n      const scope = this.resolveTenantReadScope(objectName);\n      const object = scope\n        ? await collection.get({ id, ...scope })\n        : await collection.get(id);\n      if (!object) {\n        return this.createErrorResponse(404, 'Object not found');\n      }\n      return conditionalJsonResponse(\n        req,\n        this.toPublicData(object),\n        cacheControl,\n      );\n    }\n\n    // ETag v2 (#1765): compute the table-version ETag first. A CONCRETE\n    // If-None-Match short-circuits into a 304 BEFORE the row is fetched — a\n    // delete advances the table version (tombstone), so a stale cached\n    // representation of a since-deleted row can never concretely match. A\n    // wildcard `*` is deferred until AFTER the fetch confirms the row exists,\n    // so a missing row still returns 404 (not a false 304).\n    const etag = await this.computeReadEtag(collection, req, objectName);\n    const ifNoneMatch = req.headers.get('if-none-match');\n    const notModified = (): Response =>\n      new Response(null, {\n        status: 304,\n        headers: { 'Cache-Control': cacheControl, ETag: etag },\n      });\n    if (ifNoneMatchHasConcreteMatch(ifNoneMatch, etag)) {\n      return notModified();\n    }\n\n    // #1782: scope a public/anonymous read of a tenant-scoped model to global\n    // (NULL-tenant) rows when no tenant context is active.\n    const scope = this.resolveTenantReadScope(objectName);\n    const object = scope\n      ? await collection.get({ id, ...scope })\n      : await collection.get(id);\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n    // Row exists → a wildcard `*` may now be honored as a 304.\n    if (ifNoneMatchSatisfied(ifNoneMatch, etag)) {\n      return notModified();\n    }\n    return new Response(JSON.stringify(this.toPublicData(object)), {\n      status: 200,\n      headers: {\n        'Cache-Control': cacheControl,\n        'Content-Type': 'application/json',\n        ETag: etag,\n      },\n    });\n  }\n\n  /**\n   * Handle GET /objects (list with query params)\n   */\n  private async handleList(\n    collection: SmrtCollection<SmrtObject>,\n    params: URLSearchParams,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const cacheControl = this.resolveReadCachePolicy(objectName);\n\n    const buildPayload = async () => {\n      const limit = Number.parseInt(params.get('limit') || '50', 10);\n      const offset = Number.parseInt(params.get('offset') || '0', 10);\n      const orderBy = params.get('orderBy') || 'created_at DESC';\n\n      // Build where clause from query params\n      // Convert REST-style operators (price[gt]) to SQL-style (price >)\n      const where: Record<string, string | string[]> = {};\n      for (const [key, value] of params.entries()) {\n        if (!['limit', 'offset', 'orderBy'].includes(key)) {\n          // Parse REST operator format: field[operator]\n          const match = key.match(/^(.+)\\[(.+)\\]$/);\n          if (match) {\n            const field = match[1];\n            const operator = match[2];\n            // Map REST operators to SQL operators\n            const operatorMap: Record<string, string> = {\n              gt: '>',\n              gte: '>=',\n              lt: '<',\n              lte: '<=',\n              ne: '!=',\n              in: 'in',\n              like: 'like',\n            };\n            const sqlOperator = operatorMap[operator] || operator;\n            const sqlKey = `${field} ${sqlOperator}`;\n            // Handle 'in' operator - convert comma-separated string to array\n            where[sqlKey] = operator === 'in' ? value.split(',') : value;\n          } else {\n            where[key] = value;\n          }\n        }\n      }\n\n      // #1782: fail closed to global (NULL-tenant) rows for a public/anonymous\n      // read of a tenant-scoped model with no active tenant context.\n      const scopedWhere = this.applyTenantReadScope(objectName, where);\n\n      const objects = await collection.list({\n        where:\n          scopedWhere && Object.keys(scopedWhere).length > 0\n            ? scopedWhere\n            : undefined,\n        limit,\n        offset,\n        orderBy,\n      });\n\n      return objects.map((object: SmrtObject) => this.toPublicData(object));\n    };\n\n    if (this.hasReadPermissionFields(objectName)) {\n      // Field-level read permissions make the response body vary by caller\n      // permissions, so use the v1 body-hash path over the redacted payload.\n      return conditionalJsonResponse(req, await buildPayload(), cacheControl);\n    }\n\n    // ETag v2 (#1765): resolve the policy + table-version ETag first, then\n    // hand the list query to versionConditionalResponse as a thunk. On a\n    // matching If-None-Match it returns a 304 and the thunk — the collection\n    // query — never runs, so an unchanged table revalidates with no table scan.\n    const etag = await this.computeReadEtag(collection, req, objectName);\n    return versionConditionalResponse(req, etag, cacheControl, buildPayload);\n  }\n\n  /**\n   * Handle GET /objects/count\n   */\n  private async handleCount(\n    collection: SmrtCollection<SmrtObject>,\n    params: URLSearchParams,\n    objectName?: string,\n  ): Promise<Response> {\n    // Build where clause from query params (same logic as handleList)\n    const where: Record<string, string | string[]> = {};\n    for (const [key, value] of params.entries()) {\n      // Parse REST operator format: field[operator]\n      const match = key.match(/^(.+)\\[(.+)\\]$/);\n      if (match) {\n        const field = match[1];\n        const operator = match[2];\n        // Map REST operators to SQL operators\n        const operatorMap: Record<string, string> = {\n          gt: '>',\n          gte: '>=',\n          lt: '<',\n          lte: '<=',\n          ne: '!=',\n          in: 'in',\n          like: 'like',\n        };\n        const sqlOperator = operatorMap[operator] || operator;\n        const sqlKey = `${field} ${sqlOperator}`;\n        // Handle 'in' operator - convert comma-separated string to array\n        where[sqlKey] = operator === 'in' ? value.split(',') : value;\n      } else {\n        where[key] = value;\n      }\n    }\n\n    // #1782: a count leaks cross-tenant cardinality just as a list leaks rows,\n    // so apply the same fail-closed global scope for anonymous tenant reads.\n    const scopedWhere = this.applyTenantReadScope(objectName, where);\n\n    const count = await collection.count({\n      where:\n        scopedWhere && Object.keys(scopedWhere).length > 0\n          ? scopedWhere\n          : undefined,\n    });\n\n    return this.createJsonResponse({ count });\n  }\n\n  /**\n   * Handle POST /objects\n   */\n  private async handleCreate(\n    collection: SmrtCollection<SmrtObject>,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const data = this.applyWritablePolicy(objectName, await req.json());\n    const object = await collection.create({ ...data, _skipLoad: true });\n    await object.save();\n    return this.createJsonResponse(this.toPublicData(object), 201);\n  }\n\n  /**\n   * Handle PUT/PATCH /objects/:id\n   */\n  private async handleUpdate(\n    collection: SmrtCollection<SmrtObject>,\n    id: string,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const data = this.applyWritablePolicy(objectName, await req.json());\n    const object = await collection.get(id);\n\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n\n    // Update object properties\n    Object.assign(object, data);\n    await object.save();\n\n    return this.createJsonResponse(this.toPublicData(object));\n  }\n\n  /**\n   * Handle DELETE /objects/:id\n   */\n  private async handleDelete(\n    collection: SmrtCollection<SmrtObject>,\n    id: string,\n  ): Promise<Response> {\n    const object = await collection.get(id);\n\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n\n    await object.delete();\n    return new Response(null, { status: 204 });\n  }\n\n  /**\n   * Handle POST /sync/apply — the idempotent batch write contract (#1759).\n   * All processing lives in `sync/apply.ts`; this method only adapts the\n   * generator's existing collection resolution, auth, action gating, and\n   * writable policy into a {@link SyncApplyTarget} per item.\n   */\n  private async handleSyncApply(req: Request): Promise<Response> {\n    // Buffer the body once. Request bodies are single-read streams, and the\n    // per-item auth middleware below must receive a readable body exactly as\n    // it does on CRUD routes (where auth runs before parsing) — so each\n    // middleware invocation gets a fresh Request rebuilt from this buffer.\n    let rawBody: string;\n    let body: unknown;\n    try {\n      rawBody = await req.text();\n      body = JSON.parse(rawBody);\n    } catch {\n      return this.createErrorResponse(400, 'Invalid JSON body');\n    }\n\n    const outcome = await processSyncApplyBatch(body, {\n      resolveTarget: (objectSegment) =>\n        this.resolveSyncApplyTarget(objectSegment, req, rawBody),\n    });\n    return this.createJsonResponse(outcome.body, outcome.status);\n  }\n\n  /**\n   * Resolve a sync item's `object` segment exactly like `handleObjectRoute`\n   * resolves a CRUD URL segment (registered collections first, then registry\n   * auto-discovery), and wrap the generator's per-object machinery.\n   */\n  private async resolveSyncApplyTarget(\n    objectSegment: string,\n    req: Request,\n    rawBody: string,\n  ): Promise<SyncApplyTarget | null> {\n    let collection: SmrtCollection<SmrtObject> | null = null;\n    let objectName: string | null = null;\n\n    const registered = this.collections.get(objectSegment);\n    if (registered) {\n      collection = registered;\n      objectName = this.getCollectionObjectName(registered) || objectSegment;\n    } else {\n      // Same canonical-`collection` match as the CRUD path so a client and the\n      // batch contract resolve identical segments (#1794).\n      const info = this.findClassByCollectionSegment(objectSegment);\n      if (info) {\n        collection = await this.getCollection(info);\n        objectName = info.name;\n      }\n    }\n\n    if (!collection || !objectName) {\n      return null;\n    }\n\n    const resolvedName = objectName;\n    const resolvedCollection = collection;\n    return {\n      objectName: resolvedName,\n      collection: resolvedCollection,\n      isOpAllowed: (op: SyncApplyOp) =>\n        this.isApiActionEnabled(resolvedName, op),\n      authorize: async (op: SyncApplyOp) => {\n        if (this.config.authMiddleware) {\n          const verb =\n            op === 'create' ? 'post' : op === 'update' ? 'put' : 'delete';\n          const authCheck = this.config.authMiddleware(resolvedName, verb);\n          // Fresh Request per invocation: the batch handler already consumed\n          // the original body, and middleware may read it (body-based auth,\n          // request signing) exactly as it can on CRUD routes.\n          const authResult = await authCheck(\n            new Request(req.url, {\n              method: req.method,\n              headers: req.headers,\n              body: rawBody,\n            }),\n          );\n          if (authResult instanceof Response) {\n            return authResult.status === 401 ? 'auth_required' : 'forbidden';\n          }\n          return 'ok';\n        }\n        // Fail-closed (#1540): every sync op is mutating, so only\n        // `@smrt({ api: { public: true } })` objects apply without auth.\n        return this.isRoutePublic(resolvedName, 'POST')\n          ? 'ok'\n          : 'auth_required';\n      },\n      prepare: (payload) => this.applyWritablePolicy(resolvedName, payload),\n    };\n  }\n\n  /**\n   * Get or create collection instance\n   */\n  private async getCollection(\n    classInfo: RegisteredClass,\n  ): Promise<SmrtCollection<SmrtObject>> {\n    if (!this.collections.has(classInfo.name)) {\n      // `collectionConstructor` is typed optional on RegisteredClass, but the\n      // auto-discovery path only reaches here for classes that declare one.\n      // Narrow to the non-optional constructor type before instantiating.\n      const ctor = classInfo.collectionConstructor as NonNullable<\n        RegisteredClass['collectionConstructor']\n      >;\n      const collection = new ctor({\n        ai: this.context.ai,\n        db: this.context.db,\n      });\n      // Await initialize() so the auto-discovered collection is actually usable\n      // (its DB is wired). Without this, list()/get() throw \"Database accessed\n      // before initialization\" — a latent bug that was masked while the\n      // generated client's plural URLs never matched the singular-only\n      // auto-discovery segment (#1794). The explicit-registerCollection() path\n      // receives an already-initialized collection from the caller, so this\n      // only affects the auto-discovery factory.\n      await collection.initialize();\n      this.collections.set(classInfo.name, collection);\n    }\n    const collection = this.collections.get(classInfo.name);\n    if (!collection) throw new Error(`Collection ${classInfo.name} not found`);\n    return collection;\n  }\n\n  /**\n   * Mass-assignment guard (#1540): strip framework/server-managed and\n   * `@field({ readonly: true })` fields from a create/update body, and — when an\n   * `@smrt({ api: { writable: [...] } })` allowlist is set — intersect with it.\n   */\n  private applyWritablePolicy(\n    objectName: string | undefined,\n    data: unknown,\n  ): Record<string, unknown> {\n    if (!data || typeof data !== 'object') {\n      return {};\n    }\n\n    const serverManaged = new Set([\n      'id',\n      'tenantId',\n      'tenant_id',\n      'createdAt',\n      'created_at',\n      'updatedAt',\n      'updated_at',\n    ]);\n\n    const readonly = new Set<string>();\n    let writable: string[] | null = null;\n\n    if (objectName) {\n      const apiConfig = ObjectRegistry.getConfig(objectName)?.api;\n      if (\n        apiConfig &&\n        typeof apiConfig === 'object' &&\n        Array.isArray((apiConfig as { writable?: unknown }).writable)\n      ) {\n        writable = (apiConfig as { writable: string[] }).writable;\n      }\n\n      for (const [name, def] of ObjectRegistry.getFields(objectName)) {\n        if (def && (def.readonly === true || def._meta?.readonly === true)) {\n          readonly.add(name);\n        }\n      }\n    }\n\n    const result: Record<string, unknown> = {};\n    for (const [key, value] of Object.entries(data)) {\n      if (key.startsWith('_')) continue;\n      if (serverManaged.has(key)) continue;\n      if (readonly.has(key)) continue;\n      if (writable && !writable.includes(key)) continue;\n      result[key] = value;\n    }\n    return result;\n  }\n\n  /**\n   * Serialize a SmrtObject for a network response, excluding sensitive fields\n   * (#1540). Falls back to the value unchanged for non-SmrtObject payloads.\n   */\n  private toPublicData(object: unknown): unknown {\n    const serializable = object as {\n      toPublicJSON?: (options?: PublicJsonOptions) => unknown;\n    } | null;\n    return typeof serializable?.toPublicJSON === 'function'\n      ? serializable.toPublicJSON(this.getPublicJsonOptions())\n      : object;\n  }\n\n  private getPublicJsonOptions(): PublicJsonOptions {\n    return { permissions: this.context.permissions };\n  }\n\n  /**\n   * Resolve the Cache-Control policy for a generated read and fire the\n   * one-time policy warnings (#1757): private + revalidatable by default;\n   * shared `s-maxage` only for public models that opt in; always private for\n   * tenant-scoped models, whose bodies vary with tenant context that URL-keyed\n   * shared caches cannot see. Field read-permission models are also private\n   * because the body varies by caller permissions.\n   */\n  private resolveReadCachePolicy(objectName: string | undefined): string {\n    const config = objectName\n      ? ObjectRegistry.getConfig(objectName)\n      : undefined;\n    const apiConfig = config?.api;\n    // Canonical accessor covers both `@smrt({ tenantScoped })` and the\n    // manifest-merged `@TenantScoped()` decorator form; the raw config flag is\n    // a belt-and-braces fallback for registrations not yet normalized.\n    const tenantScoped = objectName\n      ? ObjectRegistry.isTenantScoped(objectName) || !!config?.tenantScoped\n      : false;\n    const permissionScoped = this.hasReadPermissionFields(objectName);\n    if (objectName) {\n      warnIfSharedCacheNeutralized(\n        objectName,\n        apiConfig,\n        tenantScoped,\n        permissionScoped,\n      );\n      warnIfTenantScopedPublicRead(objectName, apiConfig, tenantScoped);\n    }\n    return resolveReadCacheControl(apiConfig, {\n      tenantScoped,\n      permissionScoped,\n    });\n  }\n\n  private hasReadPermissionFields(objectName: string | undefined): boolean {\n    if (!objectName) return false;\n    for (const fields of this.getFieldMapsForPublicPolicy(objectName)) {\n      for (const [, def] of fields) {\n        if (\n          typeof def?.readPermission === 'string' ||\n          typeof def?._meta?.readPermission === 'string'\n        ) {\n          return true;\n        }\n      }\n    }\n    return false;\n  }\n\n  private getFieldMapsForPublicPolicy(\n    objectName: string,\n  ): Array<ReturnType<typeof ObjectRegistry.getFields>> {\n    const registered = ObjectRegistry.getClass(objectName);\n    const className =\n      registered?.qualifiedName ?? registered?.name ?? objectName;\n    const fieldMaps: Array<ReturnType<typeof ObjectRegistry.getFields>> = [\n      registered?.inheritedFields || ObjectRegistry.getFields(className),\n    ];\n    const stiBase = ObjectRegistry.getSTIBase(className);\n    if (stiBase) {\n      fieldMaps.push(\n        ObjectRegistry.getClass(stiBase)?.inheritedFields ||\n          ObjectRegistry.getFields(stiBase),\n      );\n      for (const descendant of ObjectRegistry.getDescendants(stiBase)) {\n        fieldMaps.push(\n          ObjectRegistry.getClass(descendant)?.inheritedFields ||\n            ObjectRegistry.getFields(descendant),\n        );\n      }\n    }\n    return fieldMaps;\n  }\n\n  /**\n   * Compute the ETag v2 (#1765) for a generated read: the table's change-feed\n   * version ({@link getTableVersion}) keyed by the request representation, so a\n   * matching `If-None-Match` can short-circuit into a 304 BEFORE the collection\n   * query runs. The representation folds in the active tenant for tenant-scoped\n   * models so one tenant's cached ETag never satisfies another's read. When an\n   * web-collection manifest hash is folded into the digest (#1764), so a\n   * shape-only deploy busts every read validator. An explicit\n   * `APIConfig.manifestHash` wins; otherwise the hash is computed from the\n   * runtime registry on first use (#1862).\n   */\n  private async computeReadEtag(\n    collection: SmrtCollection<SmrtObject>,\n    req: Request,\n    objectName: string | undefined,\n  ): Promise<string> {\n    const version = await getTableVersion(collection.db, collection.tableName);\n    const representation = canonicalReadRepresentation(\n      req,\n      this.readTenantDiscriminator(objectName),\n    );\n    // Salt the ETag with the web-collection shape digest (#1764) so a\n    // shape-only deploy busts every read validator. Runtime APIGenerator\n    // deployments compute the hash from ObjectRegistry when no explicit override\n    // is configured (#1862).\n    return computeTableVersionEtag(\n      version,\n      representation,\n      this.resolveManifestHash(),\n    );\n  }\n\n  private resolveManifestHash(): string {\n    if (this.config.manifestHash !== undefined) {\n      return this.config.manifestHash;\n    }\n    this.runtimeManifestHash ??= computeRuntimeWebManifestHash();\n    return this.runtimeManifestHash;\n  }\n\n  /**\n   * A per-tenant ETag discriminator for tenant-scoped models: the active tenant\n   * id (or `global`) so tenant A's cached ETag never satisfies tenant B's read\n   * of the same table and params. `undefined` for non-tenant-scoped models,\n   * whose bodies do not vary by tenant.\n   */\n  private readTenantDiscriminator(objectName?: string): string | undefined {\n    if (!objectName) return undefined;\n    const tenantScoped =\n      ObjectRegistry.isTenantScoped(objectName) ||\n      !!ObjectRegistry.getConfig(objectName)?.tenantScoped ||\n      isTenantScopedClassResolved(objectName);\n    if (!tenantScoped) return undefined;\n    // Shared with the generated SvelteKit route so both transports key the ETag\n    // on the active tenant identically (cross-tenant false-304 guard).\n    return resolveTenantEtagDiscriminator();\n  }\n\n  /**\n   * Create JSON response with proper headers\n   */\n  private createJsonResponse(data: unknown, status = 200): Response {\n    return new Response(JSON.stringify(data), {\n      status,\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  }\n\n  /**\n   * Create error response\n   */\n  private createErrorResponse(status: number, message: string): Response {\n    return new Response(JSON.stringify({ error: message }), {\n      status,\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  }\n\n  /**\n   * Resolve the allowed `Access-Control-Allow-Origin` for a request (#1540).\n   * Returns the request's `Origin` only when it is in the configured allowlist;\n   * never `*`. Returns null when CORS should not be applied.\n   */\n  private resolveAllowedOrigin(req: Request): string | null {\n    if (!this.config.enableCors) return null;\n    const allowed = this.config.allowedOrigins;\n    if (!allowed || allowed.length === 0) return null;\n    const origin = req.headers.get('origin');\n    return origin && allowed.includes(origin) ? origin : null;\n  }\n\n  /**\n   * Whether to emit `Access-Control-Allow-Credentials: true` (#1861). Only when\n   * explicitly opted in AND an origin actually resolved — credentials are never\n   * paired with a wildcard/absent origin (`resolveAllowedOrigin` already never\n   * returns `*`).\n   */\n  private shouldAllowCredentials(): boolean {\n    return this.config.allowCredentials === true;\n  }\n\n  /**\n   * Create CORS preflight response\n   */\n  private createCorsResponse(req: Request): Response {\n    const headers: Record<string, string> = {\n      'Access-Control-Allow-Methods': 'GET,POST,PUT,PATCH,DELETE,OPTIONS',\n      // `Last-Event-ID` is allow-listed for the `_events` SSE route (#1861): a\n      // fetch-based cross-origin SSE client that resumes from a cursor sends it\n      // as a request header, which is not CORS-safelisted and would otherwise\n      // fail preflight. Harmless on the other routes, which ignore it.\n      'Access-Control-Allow-Headers':\n        'Content-Type,Authorization,Last-Event-ID',\n      'Access-Control-Max-Age': '86400',\n    };\n    const origin = this.resolveAllowedOrigin(req);\n    if (origin) {\n      headers['Access-Control-Allow-Origin'] = origin;\n      headers.Vary = 'Origin';\n      if (this.shouldAllowCredentials()) {\n        headers['Access-Control-Allow-Credentials'] = 'true';\n      }\n    }\n    return new Response(null, { status: 200, headers });\n  }\n\n  /**\n   * Add CORS headers to response\n   */\n  private addCorsHeaders(response: Response, req: Request): Response {\n    const origin = this.resolveAllowedOrigin(req);\n    if (!origin) return response;\n\n    const headers = new Headers(response.headers);\n    headers.set('Access-Control-Allow-Origin', origin);\n    headers.set('Vary', 'Origin');\n    headers.set(\n      'Access-Control-Allow-Methods',\n      'GET,POST,PUT,PATCH,DELETE,OPTIONS',\n    );\n    // `Last-Event-ID` so a fetch-based cross-origin SSE client can resume the\n    // `_events` stream from a cursor (#1861); see createCorsResponse.\n    headers.set(\n      'Access-Control-Allow-Headers',\n      'Content-Type,Authorization,Last-Event-ID',\n    );\n    // Credentialed CORS (#1861): only when opted in, and only alongside a\n    // concrete echoed origin (never `*`) so cookies can flow to an allow-listed\n    // cross-origin client (e.g. a credentialed EventSource on `_events`).\n    if (this.shouldAllowCredentials()) {\n      headers.set('Access-Control-Allow-Credentials', 'true');\n    }\n\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n\n  /**\n   * Resolve a URL/collection segment to a registered class via auto-discovery.\n   *\n   * The segment IS the canonical `collection` value from the manifest\n   * (`RegisteredClass.collection`, e.g. `products` for `Product`) — the same\n   * value the generated client, the SvelteKit route generator, and the registry\n   * all derive. Match it VERBATIM; do not re-pluralize. The previous\n   * implementation pluralized both the URL segment and the class name and\n   * compared them, turning an already-plural client URL (`/products`) into\n   * `productses`, so the generated client 404'd against auto-discovered routes\n   * (#1794). Shared by the CRUD path and the `sync/apply` batch path so they can\n   * never drift.\n   *\n   * @param segment - The URL/collection path segment (e.g. `products`).\n   * @returns The matching registered class, or null if none matches.\n   */\n  private findClassByCollectionSegment(\n    segment: string,\n  ): RegisteredClass | null {\n    for (const [key, info] of ObjectRegistry.getAllClasses()) {\n      // Primary match: the canonical manifest `collection` segment.\n      if (info.collection === segment) {\n        return info;\n      }\n      // Back-compat fallback for classes registered without a `collection`\n      // (inline/test stubs): derive the plural segment from the simple name and\n      // compare to the raw URL segment. Issue #951: use the simple name\n      // (info.name), not the qualified map key.\n      if (\n        !info.collection &&\n        this.pluralize((info.name || key).toLowerCase()) === segment\n      ) {\n        return info;\n      }\n    }\n    return null;\n  }\n\n  /**\n   * Simple pluralization (basic implementation)\n   */\n  private pluralize(word: string): string {\n    if (word.endsWith('y')) {\n      return `${word.slice(0, -1)}ies`;\n    }\n    if (word.endsWith('s') || word.endsWith('sh') || word.endsWith('ch')) {\n      return `${word}es`;\n    }\n    return `${word}s`;\n  }\n}\n\n// REST Server Utilities\n\nexport interface RestServerConfig extends APIConfig {\n  healthCheck?: {\n    enabled?: boolean;\n    path?: string;\n    customChecks?: (() => Promise<boolean>)[];\n  };\n}\n\n/**\n * Create REST server with health checks using Bun\n */\nexport function createRestServer(\n  objects: (typeof SmrtObject)[],\n  context: APIContext = {},\n  config: RestServerConfig = {},\n): { server: http.Server; url: string } {\n  // Register objects if not already registered\n  objects.forEach((obj) => {\n    if (!ObjectRegistry.hasClass(obj.name)) {\n      console.warn(`Object ${obj.name} not registered with @smrt decorator`);\n    }\n  });\n\n  const generator = new APIGenerator(config, context);\n  const { server, url } = generator.createServer();\n\n  console.log(`🚀 smrt REST API server running at ${url}`);\n\n  return { server, url };\n}\n\n/**\n * Start server with graceful shutdown\n */\nexport function startRestServer(\n  objects: (typeof SmrtObject)[],\n  context: APIContext = {},\n  config: RestServerConfig = {},\n): Promise<() => Promise<void>> {\n  return new Promise((resolve) => {\n    const { server, url } = createRestServer(objects, context, config);\n\n    // Graceful shutdown function\n    const shutdown = (): Promise<void> => {\n      return new Promise((shutdownResolve) => {\n        console.log('🛑 Shutting down server gracefully...');\n        // Node's http.Server#close stops accepting new connections and invokes\n        // the callback once in-flight ones drain. (The prior `.stop()` was a\n        // Bun-era API absent on http.Server — it would have thrown.)\n        server.close(() => {\n          console.log('✅ Server shut down complete');\n          shutdownResolve();\n        });\n      });\n    };\n\n    // Handle shutdown signals\n    process.on('SIGTERM', shutdown);\n    process.on('SIGINT', shutdown);\n\n    resolve(shutdown);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6GA,SAAS,2BACP,QACiC;CACjC,MAAM,SAA0C,CAAC;CACjD,KAAK,MAAM,CAAC,MAAM,UAAU,QAAQ;EAClC,IAAI,CAAC,SAAS,OAAO,MAAM,SAAS,UAAU;EAC9C,MAAM,eACJ,MAAM,YAAY,KAAA,IAAY,MAAM,UAAU,MAAM,OAAO;EAC7D,OAAO,QAAQ;GACb,MAAM,MAAM;GACZ,GAAI,MAAM,aAAa,KAAA,IAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;GACnE,GAAI,iBAAiB,KAAA,IAAY,EAAE,SAAS,aAAa,IAAI,CAAC;GAC9D,GAAI,MAAM,YAAY,KAAA,IAAY,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;GAChE,GAAI,MAAM,cAAc,KAAA,IAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;GACtE,GAAI,MAAM,cAAc,KAAA,IAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;GACtE,GAAI,MAAM,aAAa,KAAA,IAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;GACnE,GAAI,MAAM,mBAAmB,KAAA,IACzB,EAAE,gBAAgB,MAAM,eAAe,IACvC,CAAC;GACL,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5D;CACF;CACA,OAAO;AACT;AAEA,SAAS,4BACP,SACkC;CAClC,OAAO,OAAO,YAAY,WAAW,CAAC,CAAC;AACzC;AAEA,SAAS,+BAA+B,WAA2B;CACjE,MAAM,QAAQ,UAAU,YAAY;CACpC,IAAI,MAAM,SAAS,GAAG,GAAG,OAAO,GAAG,MAAM,MAAM,GAAG,EAAE,EAAE;CACtD,IAAI,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,GAClE,OAAO,GAAG,MAAM;CAElB,IAAI,MAAM,SAAS,IAAI,KAAK,MAAM,SAAS,IAAI,GAAG,OAAO,GAAG,MAAM;CAClE,OAAO,GAAG,MAAM;AAClB;AAEA,SAAS,wBACP,KACA,MACuB;CACvB,MAAM,YAAY,KAAK,QAAQ;CAC/B,OAAO;EACL;EACA,MAAM,UAAU,YAAY;EAC5B,YAAY,KAAK,cAAc,+BAA+B,SAAS;EACvE,UAAU,KAAK,kBAAkB;EACjC,QAAQ,2BAA2B,KAAK,mBAAmB,KAAK,MAAM;EACtE,SAAS,4BAA4B,KAAK,oBAAoB,KAAK,OAAO;EAC1E,iBAAiB,KAAK,UAAU,CAAC;EACjC,GAAI,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;EAClE,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;EAC5D,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;EACzD,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;EAChD,GAAI,KAAK,iBAAiB,EAAE,gBAAgB,KAAK,eAAe,IAAI,CAAC;EACrE,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;CAC5C;AACF;;;;;;AAOA,SAAgB,8BACd,UAA+C,eAAe,cAAc,GACpE;CACR,MAAM,UAA0C,CAAC;CACjD,MAAM,uBAAO,IAAI,IAAqB;CACtC,KAAK,MAAM,CAAC,KAAK,SAAS,SAAS;EACjC,IAAI,KAAK,IAAI,IAAI,GAAG;EACpB,KAAK,IAAI,IAAI;EACb,MAAM,cAAc,KAAK,iBAAiB;EAC1C,QAAQ,eAAe,wBAAwB,KAAK,IAAI;CAC1D;CACA,OAAO,uBAAuB;EAC5B,SAAS;EACT,WAAW;EACX;CACF,CAAC;AACH;;;;AAKA,IAAa,eAAb,MAA0B;CACxB;CACA,8BAAsB,IAAI,IAAwC;CAClE;CACA;CAEA,YAAY,SAAoB,CAAC,GAAG,UAAsB,CAAC,GAAG;EAC5D,KAAK,SAAS;GACZ,UAAU;GAGV,YAAY;GACZ,MAAM;GACN,UAAU;GACV,GAAG;EACL;EACA,KAAK,UAAU;CACjB;;;;;;;CAQA,mBACE,MACA,YACM;EACN,KAAK,YAAY,IAAI,MAAM,UAAU;EACrC,KAAK,sBAAsB,KAAA;CAC7B;;;;;;;;;;;CAYA,mBAAoC;EAClC,OACE,KAAK,QAAQ,MAAM,KAAK,YAAY,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,MAAM,KAAA;CAErE;;;;CAKA,eAAqD;EACnD,MAAM,SAAS,KAAK,aAAa,OAAO,KAAK,QAAQ;GACnD,IAAI;IACF,MAAM,UAAU,MAAM,KAAK,wBAAwB,GAAG;IACtD,MAAM,WAAW,MAAM,KAAK,cAAc,OAAO;IACjD,MAAM,KAAK,0BAA0B,UAAU,GAAG;GACpD,SAAS,QAAQ;IACf,IAAI,aAAa;IACjB,IAAI,IAAI,uBAAuB;GACjC;EACF,CAAC;EAED,OAAO,OAAO,KAAK,OAAO,MAAM,KAAK,OAAO,QAAQ;EAEpD,OAAO;GACL;GACA,KAAK,UAAU,KAAK,OAAO,SAAS,GAAG,KAAK,OAAO;EACrD;CACF;;;;CAKA,MAAc,eAAe,QAA+C;EAC1E,MAAM,SAAmB,CAAC;EAC1B,WAAW,MAAM,SAAS,QACxB,OAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;EAEjE,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,OAAO;CAC/C;;;;CAKA,MAAc,wBACZ,KACkB;EAClB,MAAM,MAAM,UAAU,KAAK,OAAO,SAAS,GAAG,KAAK,OAAO,OAAO,IAAI;EACrE,MAAM,SAAS,IAAI,UAAU;EAC7B,MAAM,UAAU,IAAI,QAAQ;EAE5B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,OAAO,GACnD,IAAI,OACF,QAAQ,IAAI,KAAK,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,KAAK;EAI5D,IAAI;EACJ,IAAI,WAAW,SAAS,WAAW,QACjC,OAAO,MAAM,KAAK,eAAe,GAAG;EAGtC,OAAO,IAAI,QAAQ,KAAK;GACtB;GACA;GACA;EACF,CAAC;CACH;;;;CAKA,MAAc,0BACZ,aACA,KACe;EACf,IAAI,aAAa,YAAY;EAG7B,YAAY,QAAQ,SAAS,OAAO,QAAQ;GAC1C,IAAI,UAAU,KAAK,KAAK;EAC1B,CAAC;EAGD,IAAI,YAAY,MAAM;GACpB,MAAM,SAAS,YAAY,KAAK,UAAU;GAO1C,IAAI,aAAa;GACjB,MAAM,gBAAgB;IACpB,IAAI,IAAI,kBAAkB;IAC1B,aAAa;IACb,OAAY,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC;GACrC;GACA,IAAI,GAAG,SAAS,OAAO;GAEvB,IAAI;IACF,OAAO,MAAM;KACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;KAC1C,IAAI,QAAQ,YAAY;KACxB,IAAI,CAAC,IAAI,MAAM,KAAK,GAAG;MAQrB,MAAM,IAAI,SAAe,YAAY;OACnC,MAAM,eAAe;QACnB,IAAI,IAAI,SAAS,MAAM;QACvB,IAAI,IAAI,SAAS,MAAM;QACvB,IAAI,IAAI,SAAS,MAAM;QACvB,QAAQ;OACV;OACA,IAAI,KAAK,SAAS,MAAM;OACxB,IAAI,KAAK,SAAS,MAAM;OACxB,IAAI,KAAK,SAAS,MAAM;MAC1B,CAAC;MACD,IAAI,YAAY;KAClB;IACF;GACF,QAAQ,CAER,UAAU;IACR,IAAI,IAAI,SAAS,OAAO;GAC1B;EACF;EAEA,IAAI,CAAC,IAAI,eACP,IAAI,IAAI;CAEZ;;;;CAKA,kBAAuD;EACrD,QAAQ,QAAQ,KAAK,cAAc,GAAG;CACxC;;;;CAKA,MAAc,cAAc,KAAiC;EAC3D,MAAM,MAAM,IAAI,IAAI,IAAI,GAAG;EAG3B,IAAI,IAAI,WAAW,aAAa,KAAK,OAAO,YAC1C,OAAO,KAAK,mBAAmB,GAAG;EAIpC,IAAI,KAAK,OAAO;QACT,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,KAAK,OAAO,YAAY,GACnE,IAAI,IAAI,aAAa,GAAG,KAAK,OAAO,WAAW,QAAQ;IACrD,MAAM,WAAW,MAAM,QAAQ,GAAG;IAClC,OAAO,KAAK,eAAe,UAAU,GAAG;GAC1C;;EAMJ,IAAI,IAAI,aAAa,GAAG,KAAK,OAAO,SAAS,YAAY;GACvD,MAAM,WAAW,MAAM,mBAAmB,KAAK;IAC7C,gBAAgB,KAAK,OAAO;IAC5B,IAAI,KAAK,iBAAiB;GAC5B,CAAC;GACD,OAAO,KAAK,eAAe,UAAU,GAAG;EAC1C;EAWA,IAAI,IAAI,aAAa,GAAG,KAAK,OAAO,SAAS,WAAW;GACtD,MAAM,WAAW,MAAM,kBAAkB,KAAK;IAC5C,gBAAgB,KAAK,OAAO;IAC5B,IAAI,KAAK,iBAAiB;IAC1B,cAAc,KAAK,oBAAoB;IACvC,gBAAgB,KAAK,OAAO,aAAa;GAC3C,CAAC;GACD,OAAO,KAAK,eAAe,UAAU,GAAG;EAC1C;EAGA,IAAI,IAAI,SAAS,WAAW,KAAK,OAAO,YAAY,EAAE,GAAG;GACvD,MAAM,WAAW,MAAM,KAAK,kBAAkB,KAAK,GAAG;GACtD,OAAO,KAAK,eAAe,UAAU,GAAG;EAC1C;EAGA,OAAO,KAAK,oBAAoB,KAAK,WAAW;CAClD;;;;CAKA,MAAc,kBAAkB,KAAc,KAA6B;EACzE,MAAM,YAAY,IAAI,SACnB,QAAQ,KAAK,OAAO,YAAY,IAAI,EAAE,CAAC,CACvC,MAAM,GAAG,CAAC,CACV,OAAO,OAAO;EAEjB,IAAI,UAAU,WAAW,GACvB,OAAO,KAAK,oBAAoB,KAAK,sBAAsB;EAI7D,IACE,UAAU,WAAW,0BAA0B,UAC/C,0BAA0B,OAAO,SAAS,MAAM,UAAU,OAAO,OAAO,GACxE;GACA,IAAI,IAAI,WAAW,QACjB,OAAO,KAAK,oBAAoB,KAAK,oBAAoB;GAE3D,OAAO,MAAM,KAAK,gBAAgB,GAAG;EACvC;EAEA,MAAM,aAAa,UAAU;EAC7B,MAAM,WAAW,UAAU;EAG3B,IAAI,KAAK,YAAY,IAAI,UAAU,GAAG;GACpC,MAAM,aAAa,KAAK,YAAY,IAAI,UAAU;GAClD,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,cAAc,WAAW,WAAW;GAErE,MAAM,aAAa,KAAK,wBAAwB,UAAU,KAAK;GAG/D,IAAI,KAAK,OAAO,gBAAgB;IAK9B,MAAM,aAAa,MAJD,KAAK,OAAO,eAC5B,YACA,IAAI,OAAO,YAAY,CAEA,CAAA,CAAU,GAAG;IACtC,IAAI,sBAAsB,UACxB,OAAO;IAGT,MAAM;GACR,OAAO,IAAI,CAAC,KAAK,cAAc,YAAY,IAAI,MAAM,GAGnD,OAAO,KAAK,oBAAoB,KAAK,yBAAyB;GAIhE,OAAO,MAAM,KAAK,qBAChB,KACA,YACA,UACA,KACA,UACF;EACF;EAIA,MAAM,YAAY,KAAK,6BAA6B,UAAU;EAE9D,IAAI,CAAC,WACH,OAAO,KAAK,oBACV,KACA,gBAAgB,WAAW,YAC7B;EAIF,IAAI,KAAK,OAAO,gBAAgB;GAK9B,MAAM,aAAa,MAJD,KAAK,OAAO,eAC5B,UAAU,MACV,IAAI,OAAO,YAAY,CAEA,CAAA,CAAU,GAAG;GACtC,IAAI,sBAAsB,UACxB,OAAO;GAGT,MAAM;EACR,OAAO,IAAI,CAAC,KAAK,cAAc,UAAU,MAAM,IAAI,MAAM,GAEvD,OAAO,KAAK,oBAAoB,KAAK,yBAAyB;EAIhE,MAAM,aAAa,MAAM,KAAK,cAAc,SAAS;EAErD,OAAO,MAAM,KAAK,qBAChB,KACA,YACA,UACA,KACA,UAAU,IACZ;CACF;;;;CAKA,MAAc,qBACZ,KACA,YACA,UACA,KACA,YACmB;EACnB,IAAI;GACF,MAAM,SAAS,KAAK,cAAc,IAAI,QAAQ,QAAQ;GACtD,IAAI,UAAU,CAAC,KAAK,mBAAmB,YAAY,MAAM,GACvD,OAAO,KAAK,oBAAoB,KAAK,oBAAoB;GAI3D,IAAI,aAAa,WAAW,IAAI,WAAW,OACzC,OAAO,MAAM,KAAK,YAAY,YAAY,IAAI,cAAc,UAAU;GAIxE,QAAQ,IAAI,QAAZ;IACE,KAAK,OACH,OAAO,WACH,MAAM,KAAK,UAAU,YAAY,UAAU,KAAK,UAAU,IAC1D,MAAM,KAAK,WACT,YACA,IAAI,cACJ,KACA,UACF;IAEN,KAAK,QACH,OAAO,MAAM,KAAK,aAAa,YAAY,KAAK,UAAU;IAE5D,KAAK;IACL,KAAK;KACH,IAAI,CAAC,UACH,OAAO,KAAK,oBACV,KACA,+BACF;KAEF,OAAO,MAAM,KAAK,aAAa,YAAY,UAAU,KAAK,UAAU;IAEtE,KAAK;KACH,IAAI,CAAC,UACH,OAAO,KAAK,oBACV,KACA,+BACF;KAEF,OAAO,MAAM,KAAK,aAAa,YAAY,QAAQ;IAErD,SACE,OAAO,KAAK,oBAAoB,KAAK,oBAAoB;GAC7D;EACF,SAAS,OAAO;GACd,QAAQ,MAAM,cAAc,KAAK;GACjC,OAAO,KAAK,oBAAoB,KAAK,uBAAuB;EAC9D;CACF;CAEA,cACE,QACA,UACwD;EACxD,QAAQ,QAAR;GACE,KAAK,OACH,OAAO,YAAY,aAAa,UAAU,QAAQ;GACpD,KAAK,QACH,OAAO;GACT,KAAK;GACL,KAAK,SACH,OAAO;GACT,KAAK,UACH,OAAO;GACT,SACE,OAAO;EACX;CACF;;;;;;;;CASA,cACE,YACA,QACS;EACT,IAAI,CAAC,YAAY,OAAO;EACxB,MAAM,YAAY,eAAe,UAAU,UAAU,CAAC,EAAE;EACxD,IAAI,CAAC,aAAa,OAAO,cAAc,UAAU,OAAO;EACxD,MAAM,eAAgB,UAA4C;EAClE,IAAI,iBAAiB,MAAM,OAAO;EAClC,IAAI,iBAAiB,QAAQ,OAAO,OAAO,YAAY,MAAM;EAC7D,OAAO;CACT;CAEA,mBACE,YACA,QACS;EACT,IAAI,CAAC,YACH,OAAO;EAIT,MAAM,YADS,eAAe,UAAU,UACtB,CAAA,CAAO;EAEzB,IAAI,cAAc,OAChB,OAAO;EAGT,IAAI,aAAa,OAAO,cAAc,UAAU;GAC9C,IAAI,UAAU,WAAW,CAAC,UAAU,QAAQ,SAAS,MAAM,GACzD,OAAO;GAGT,IAAI,UAAU,SAAS,SAAS,MAAM,GACpC,OAAO;EAEX;EAEA,OAAO;CACT;CAEA,wBACE,YACoB;EAIpB,MAAM,YACH,WACE,cAED,WAAW,aAGV;EAEL,IAAI,CAAC,WACH;EAGF,MAAM,aAAa,eAAe,sBAAsB,SAAS;EACjE,OAAO,YAAY,iBAAiB,YAAY,QAAQ,UAAU;CACpE;;;;;;;;;;;;;;;;;;;;;;CAuBA,uBACE,YACgC;EAChC,IACE,CAAC,cACD,EACE,eAAe,eAAe,UAAU,KACxC,CAAC,CAAC,eAAe,UAAU,UAAU,CAAC,EAAE,gBACxC,4BAA4B,UAAU,IAGxC;EAEF,MAAM,QAAQ,2BAA2B;EACzC,OAAO,MAAM,YAAY,MAAM,aAAa,OACxC,EAAE,UAAU,KAAK,IACjB,KAAA;CACN;;;;;;;;CASA,qBACE,YACA,OACqC;EAErC,IAAI,CADU,KAAK,uBAAuB,UACrC,GACH,OAAO;EAET,MAAM,UAAmC,CAAC;EAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,CAAC,CAAC,GAAG;GAGtD,MAAM,QAAQ,IAAI,MAAM,KAAK,CAAC,CAAC;GAC/B,IAAI,UAAU,cAAc,UAAU,aACpC;GAEF,QAAQ,OAAO;EACjB;EACA,QAAQ,WAAW;EACnB,OAAO;CACT;;;;CAKA,MAAc,UACZ,YACA,IACA,KACA,YACmB;EACnB,MAAM,eAAe,KAAK,uBAAuB,UAAU;EAE3D,IAAI,KAAK,wBAAwB,UAAU,GAAG;GAI5C,MAAM,QAAQ,KAAK,uBAAuB,UAAU;GACpD,MAAM,SAAS,QACX,MAAM,WAAW,IAAI;IAAE;IAAI,GAAG;GAAM,CAAC,IACrC,MAAM,WAAW,IAAI,EAAE;GAC3B,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;GAEzD,OAAO,wBACL,KACA,KAAK,aAAa,MAAM,GACxB,YACF;EACF;EAQA,MAAM,OAAO,MAAM,KAAK,gBAAgB,YAAY,KAAK,UAAU;EACnE,MAAM,cAAc,IAAI,QAAQ,IAAI,eAAe;EACnD,MAAM,oBACJ,IAAI,SAAS,MAAM;GACjB,QAAQ;GACR,SAAS;IAAE,iBAAiB;IAAc,MAAM;GAAK;EACvD,CAAC;EACH,IAAI,4BAA4B,aAAa,IAAI,GAC/C,OAAO,YAAY;EAKrB,MAAM,QAAQ,KAAK,uBAAuB,UAAU;EACpD,MAAM,SAAS,QACX,MAAM,WAAW,IAAI;GAAE;GAAI,GAAG;EAAM,CAAC,IACrC,MAAM,WAAW,IAAI,EAAE;EAC3B,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;EAGzD,IAAI,qBAAqB,aAAa,IAAI,GACxC,OAAO,YAAY;EAErB,OAAO,IAAI,SAAS,KAAK,UAAU,KAAK,aAAa,MAAM,CAAC,GAAG;GAC7D,QAAQ;GACR,SAAS;IACP,iBAAiB;IACjB,gBAAgB;IAChB,MAAM;GACR;EACF,CAAC;CACH;;;;CAKA,MAAc,WACZ,YACA,QACA,KACA,YACmB;EACnB,MAAM,eAAe,KAAK,uBAAuB,UAAU;EAE3D,MAAM,eAAe,YAAY;GAC/B,MAAM,QAAQ,OAAO,SAAS,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE;GAC7D,MAAM,SAAS,OAAO,SAAS,OAAO,IAAI,QAAQ,KAAK,KAAK,EAAE;GAC9D,MAAM,UAAU,OAAO,IAAI,SAAS,KAAK;GAIzC,MAAM,QAA2C,CAAC;GAClD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GACxC,IAAI,CAAC;IAAC;IAAS;IAAU;GAAS,CAAC,CAAC,SAAS,GAAG,GAAG;IAEjD,MAAM,QAAQ,IAAI,MAAM,gBAAgB;IACxC,IAAI,OAAO;KACT,MAAM,QAAQ,MAAM;KACpB,MAAM,WAAW,MAAM;KAYvB,MAAM,SAAS,GAAG,MAAM,GADJ;MARlB,IAAI;MACJ,KAAK;MACL,IAAI;MACJ,KAAK;MACL,IAAI;MACJ,IAAI;MACJ,MAAM;KAEY,EAAY,aAAa;KAG7C,MAAM,UAAU,aAAa,OAAO,MAAM,MAAM,GAAG,IAAI;IACzD,OACE,MAAM,OAAO;GAEjB;GAKF,MAAM,cAAc,KAAK,qBAAqB,YAAY,KAAK;GAY/D,QAAO,MAVe,WAAW,KAAK;IACpC,OACE,eAAe,OAAO,KAAK,WAAW,CAAC,CAAC,SAAS,IAC7C,cACA,KAAA;IACN;IACA;IACA;GACF,CAAC,EAAA,CAEc,KAAK,WAAuB,KAAK,aAAa,MAAM,CAAC;EACtE;EAEA,IAAI,KAAK,wBAAwB,UAAU,GAGzC,OAAO,wBAAwB,KAAK,MAAM,aAAa,GAAG,YAAY;EAQxE,OAAO,2BAA2B,KAAK,MADpB,KAAK,gBAAgB,YAAY,KAAK,UAAU,GACtB,cAAc,YAAY;CACzE;;;;CAKA,MAAc,YACZ,YACA,QACA,YACmB;EAEnB,MAAM,QAA2C,CAAC;EAClD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GAAG;GAE3C,MAAM,QAAQ,IAAI,MAAM,gBAAgB;GACxC,IAAI,OAAO;IACT,MAAM,QAAQ,MAAM;IACpB,MAAM,WAAW,MAAM;IAYvB,MAAM,SAAS,GAAG,MAAM,GADJ;KARlB,IAAI;KACJ,KAAK;KACL,IAAI;KACJ,KAAK;KACL,IAAI;KACJ,IAAI;KACJ,MAAM;IAEY,EAAY,aAAa;IAG7C,MAAM,UAAU,aAAa,OAAO,MAAM,MAAM,GAAG,IAAI;GACzD,OACE,MAAM,OAAO;EAEjB;EAIA,MAAM,cAAc,KAAK,qBAAqB,YAAY,KAAK;EAE/D,MAAM,QAAQ,MAAM,WAAW,MAAM,EACnC,OACE,eAAe,OAAO,KAAK,WAAW,CAAC,CAAC,SAAS,IAC7C,cACA,KAAA,EACR,CAAC;EAED,OAAO,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC1C;;;;CAKA,MAAc,aACZ,YACA,KACA,YACmB;EACnB,MAAM,OAAO,KAAK,oBAAoB,YAAY,MAAM,IAAI,KAAK,CAAC;EAClE,MAAM,SAAS,MAAM,WAAW,OAAO;GAAE,GAAG;GAAM,WAAW;EAAK,CAAC;EACnE,MAAM,OAAO,KAAK;EAClB,OAAO,KAAK,mBAAmB,KAAK,aAAa,MAAM,GAAG,GAAG;CAC/D;;;;CAKA,MAAc,aACZ,YACA,IACA,KACA,YACmB;EACnB,MAAM,OAAO,KAAK,oBAAoB,YAAY,MAAM,IAAI,KAAK,CAAC;EAClE,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;EAEtC,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;EAIzD,OAAO,OAAO,QAAQ,IAAI;EAC1B,MAAM,OAAO,KAAK;EAElB,OAAO,KAAK,mBAAmB,KAAK,aAAa,MAAM,CAAC;CAC1D;;;;CAKA,MAAc,aACZ,YACA,IACmB;EACnB,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;EAEtC,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;EAGzD,MAAM,OAAO,OAAO;EACpB,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;CAC3C;;;;;;;CAQA,MAAc,gBAAgB,KAAiC;EAK7D,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,IAAI,KAAK;GACzB,OAAO,KAAK,MAAM,OAAO;EAC3B,QAAQ;GACN,OAAO,KAAK,oBAAoB,KAAK,mBAAmB;EAC1D;EAEA,MAAM,UAAU,MAAM,sBAAsB,MAAM,EAChD,gBAAgB,kBACd,KAAK,uBAAuB,eAAe,KAAK,OAAO,EAC3D,CAAC;EACD,OAAO,KAAK,mBAAmB,QAAQ,MAAM,QAAQ,MAAM;CAC7D;;;;;;CAOA,MAAc,uBACZ,eACA,KACA,SACiC;EACjC,IAAI,aAAgD;EACpD,IAAI,aAA4B;EAEhC,MAAM,aAAa,KAAK,YAAY,IAAI,aAAa;EACrD,IAAI,YAAY;GACd,aAAa;GACb,aAAa,KAAK,wBAAwB,UAAU,KAAK;EAC3D,OAAO;GAGL,MAAM,OAAO,KAAK,6BAA6B,aAAa;GAC5D,IAAI,MAAM;IACR,aAAa,MAAM,KAAK,cAAc,IAAI;IAC1C,aAAa,KAAK;GACpB;EACF;EAEA,IAAI,CAAC,cAAc,CAAC,YAClB,OAAO;EAGT,MAAM,eAAe;EAErB,OAAO;GACL,YAAY;GACA;GACZ,cAAc,OACZ,KAAK,mBAAmB,cAAc,EAAE;GAC1C,WAAW,OAAO,OAAoB;IACpC,IAAI,KAAK,OAAO,gBAAgB;KAC9B,MAAM,OACJ,OAAO,WAAW,SAAS,OAAO,WAAW,QAAQ;KAKvD,MAAM,aAAa,MAJD,KAAK,OAAO,eAAe,cAAc,IAIlC,CAAA,CACvB,IAAI,QAAQ,IAAI,KAAK;MACnB,QAAQ,IAAI;MACZ,SAAS,IAAI;MACb,MAAM;KACR,CAAC,CACH;KACA,IAAI,sBAAsB,UACxB,OAAO,WAAW,WAAW,MAAM,kBAAkB;KAEvD,OAAO;IACT;IAGA,OAAO,KAAK,cAAc,cAAc,MAAM,IAC1C,OACA;GACN;GACA,UAAU,YAAY,KAAK,oBAAoB,cAAc,OAAO;EACtE;CACF;;;;CAKA,MAAc,cACZ,WACqC;EACrC,IAAI,CAAC,KAAK,YAAY,IAAI,UAAU,IAAI,GAAG;GAIzC,MAAM,OAAO,UAAU;GAGvB,MAAM,aAAa,IAAI,KAAK;IAC1B,IAAI,KAAK,QAAQ;IACjB,IAAI,KAAK,QAAQ;GACnB,CAAC;GAQD,MAAM,WAAW,WAAW;GAC5B,KAAK,YAAY,IAAI,UAAU,MAAM,UAAU;EACjD;EACA,MAAM,aAAa,KAAK,YAAY,IAAI,UAAU,IAAI;EACtD,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,cAAc,UAAU,KAAK,WAAW;EACzE,OAAO;CACT;;;;;;CAOA,oBACE,YACA,MACyB;EACzB,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B,OAAO,CAAC;EAGV,MAAM,gCAAgB,IAAI,IAAI;GAC5B;GACA;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;EAED,MAAM,2BAAW,IAAI,IAAY;EACjC,IAAI,WAA4B;EAEhC,IAAI,YAAY;GACd,MAAM,YAAY,eAAe,UAAU,UAAU,CAAC,EAAE;GACxD,IACE,aACA,OAAO,cAAc,YACrB,MAAM,QAAS,UAAqC,QAAQ,GAE5D,WAAY,UAAqC;GAGnD,KAAK,MAAM,CAAC,MAAM,QAAQ,eAAe,UAAU,UAAU,GAC3D,IAAI,QAAQ,IAAI,aAAa,QAAQ,IAAI,OAAO,aAAa,OAC3D,SAAS,IAAI,IAAI;EAGvB;EAEA,MAAM,SAAkC,CAAC;EACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;GAC/C,IAAI,IAAI,WAAW,GAAG,GAAG;GACzB,IAAI,cAAc,IAAI,GAAG,GAAG;GAC5B,IAAI,SAAS,IAAI,GAAG,GAAG;GACvB,IAAI,YAAY,CAAC,SAAS,SAAS,GAAG,GAAG;GACzC,OAAO,OAAO;EAChB;EACA,OAAO;CACT;;;;;CAMA,aAAqB,QAA0B;EAC7C,MAAM,eAAe;EAGrB,OAAO,OAAO,cAAc,iBAAiB,aACzC,aAAa,aAAa,KAAK,qBAAqB,CAAC,IACrD;CACN;CAEA,uBAAkD;EAChD,OAAO,EAAE,aAAa,KAAK,QAAQ,YAAY;CACjD;;;;;;;;;CAUA,uBAA+B,YAAwC;EACrE,MAAM,SAAS,aACX,eAAe,UAAU,UAAU,IACnC,KAAA;EACJ,MAAM,YAAY,QAAQ;EAI1B,MAAM,eAAe,aACjB,eAAe,eAAe,UAAU,KAAK,CAAC,CAAC,QAAQ,eACvD;EACJ,MAAM,mBAAmB,KAAK,wBAAwB,UAAU;EAChE,IAAI,YAAY;GACd,6BACE,YACA,WACA,cACA,gBACF;GACA,6BAA6B,YAAY,WAAW,YAAY;EAClE;EACA,OAAO,wBAAwB,WAAW;GACxC;GACA;EACF,CAAC;CACH;CAEA,wBAAgC,YAAyC;EACvE,IAAI,CAAC,YAAY,OAAO;EACxB,KAAK,MAAM,UAAU,KAAK,4BAA4B,UAAU,GAC9D,KAAK,MAAM,GAAG,QAAQ,QACpB,IACE,OAAO,KAAK,mBAAmB,YAC/B,OAAO,KAAK,OAAO,mBAAmB,UAEtC,OAAO;EAIb,OAAO;CACT;CAEA,4BACE,YACoD;EACpD,MAAM,aAAa,eAAe,SAAS,UAAU;EACrD,MAAM,YACJ,YAAY,iBAAiB,YAAY,QAAQ;EACnD,MAAM,YAAgE,CACpE,YAAY,mBAAmB,eAAe,UAAU,SAAS,CACnE;EACA,MAAM,UAAU,eAAe,WAAW,SAAS;EACnD,IAAI,SAAS;GACX,UAAU,KACR,eAAe,SAAS,OAAO,CAAC,EAAE,mBAChC,eAAe,UAAU,OAAO,CACpC;GACA,KAAK,MAAM,cAAc,eAAe,eAAe,OAAO,GAC5D,UAAU,KACR,eAAe,SAAS,UAAU,CAAC,EAAE,mBACnC,eAAe,UAAU,UAAU,CACvC;EAEJ;EACA,OAAO;CACT;;;;;;;;;;;;CAaA,MAAc,gBACZ,YACA,KACA,YACiB;EAUjB,OAAO,wBACL,MAVoB,gBAAgB,WAAW,IAAI,WAAW,SAAS,GAClD,4BACrB,KACA,KAAK,wBAAwB,UAAU,CAQvC,GACA,KAAK,oBAAoB,CAC3B;CACF;CAEA,sBAAsC;EACpC,IAAI,KAAK,OAAO,iBAAiB,KAAA,GAC/B,OAAO,KAAK,OAAO;EAErB,KAAK,wBAAwB,8BAA8B;EAC3D,OAAO,KAAK;CACd;;;;;;;CAQA,wBAAgC,YAAyC;EACvE,IAAI,CAAC,YAAY,OAAO,KAAA;EAKxB,IAAI,EAHF,eAAe,eAAe,UAAU,KACxC,CAAC,CAAC,eAAe,UAAU,UAAU,CAAC,EAAE,gBACxC,4BAA4B,UAAU,IACrB,OAAO,KAAA;EAG1B,OAAO,+BAA+B;CACxC;;;;CAKA,mBAA2B,MAAe,SAAS,KAAe;EAChE,OAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;GACxC;GACA,SAAS,EACP,gBAAgB,mBAClB;EACF,CAAC;CACH;;;;CAKA,oBAA4B,QAAgB,SAA2B;EACrE,OAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC,GAAG;GACtD;GACA,SAAS,EACP,gBAAgB,mBAClB;EACF,CAAC;CACH;;;;;;CAOA,qBAA6B,KAA6B;EACxD,IAAI,CAAC,KAAK,OAAO,YAAY,OAAO;EACpC,MAAM,UAAU,KAAK,OAAO;EAC5B,IAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,OAAO;EAC7C,MAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ;EACvC,OAAO,UAAU,QAAQ,SAAS,MAAM,IAAI,SAAS;CACvD;;;;;;;CAQA,yBAA0C;EACxC,OAAO,KAAK,OAAO,qBAAqB;CAC1C;;;;CAKA,mBAA2B,KAAwB;EACjD,MAAM,UAAkC;GACtC,gCAAgC;GAKhC,gCACE;GACF,0BAA0B;EAC5B;EACA,MAAM,SAAS,KAAK,qBAAqB,GAAG;EAC5C,IAAI,QAAQ;GACV,QAAQ,iCAAiC;GACzC,QAAQ,OAAO;GACf,IAAI,KAAK,uBAAuB,GAC9B,QAAQ,sCAAsC;EAElD;EACA,OAAO,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK;EAAQ,CAAC;CACpD;;;;CAKA,eAAuB,UAAoB,KAAwB;EACjE,MAAM,SAAS,KAAK,qBAAqB,GAAG;EAC5C,IAAI,CAAC,QAAQ,OAAO;EAEpB,MAAM,UAAU,IAAI,QAAQ,SAAS,OAAO;EAC5C,QAAQ,IAAI,+BAA+B,MAAM;EACjD,QAAQ,IAAI,QAAQ,QAAQ;EAC5B,QAAQ,IACN,gCACA,mCACF;EAGA,QAAQ,IACN,gCACA,0CACF;EAIA,IAAI,KAAK,uBAAuB,GAC9B,QAAQ,IAAI,oCAAoC,MAAM;EAGxD,OAAO,IAAI,SAAS,SAAS,MAAM;GACjC,QAAQ,SAAS;GACjB,YAAY,SAAS;GACrB;EACF,CAAC;CACH;;;;;;;;;;;;;;;;;CAkBA,6BACE,SACwB;EACxB,KAAK,MAAM,CAAC,KAAK,SAAS,eAAe,cAAc,GAAG;GAExD,IAAI,KAAK,eAAe,SACtB,OAAO;GAMT,IACE,CAAC,KAAK,cACN,KAAK,WAAW,KAAK,QAAQ,IAAA,CAAK,YAAY,CAAC,MAAM,SAErD,OAAO;EAEX;EACA,OAAO;CACT;;;;CAKA,UAAkB,MAAsB;EACtC,IAAI,KAAK,SAAS,GAAG,GACnB,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,EAAE;EAE9B,IAAI,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,GACjE,OAAO,GAAG,KAAK;EAEjB,OAAO,GAAG,KAAK;CACjB;AACF;;;;AAeA,SAAgB,iBACd,SACA,UAAsB,CAAC,GACvB,SAA2B,CAAC,GACU;CAEtC,QAAQ,SAAS,QAAQ;EACvB,IAAI,CAAC,eAAe,SAAS,IAAI,IAAI,GACnC,QAAQ,KAAK,UAAU,IAAI,KAAK,qCAAqC;CAEzE,CAAC;CAGD,MAAM,EAAE,QAAQ,QAAQ,IADF,aAAa,QAAQ,OACnB,CAAA,CAAU,aAAa;CAE/C,QAAQ,IAAI,sCAAsC,KAAK;CAEvD,OAAO;EAAE;EAAQ;CAAI;AACvB;;;;AAKA,SAAgB,gBACd,SACA,UAAsB,CAAC,GACvB,SAA2B,CAAC,GACE;CAC9B,OAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,EAAE,QAAQ,QAAQ,iBAAiB,SAAS,SAAS,MAAM;EAGjE,MAAM,iBAAgC;GACpC,OAAO,IAAI,SAAS,oBAAoB;IACtC,QAAQ,IAAI,uCAAuC;IAInD,OAAO,YAAY;KACjB,QAAQ,IAAI,6BAA6B;KACzC,gBAAgB;IAClB,CAAC;GACH,CAAC;EACH;EAGA,QAAQ,GAAG,WAAW,QAAQ;EAC9B,QAAQ,GAAG,UAAU,QAAQ;EAE7B,QAAQ,QAAQ;CAClB,CAAC;AACH"}
+{"version":3,"file":"rest.js","names":[],"sources":["../../src/generators/rest.ts"],"sourcesContent":["/**\n * High-performance REST API generator for smrt objects using Node.js HTTP server\n *\n * Designed for minimal bundle size and maximum performance\n */\n\nimport http from 'node:http';\nimport { getTableVersion } from '../change-feed';\nimport type { SmrtCollection } from '../collection';\nimport {\n  isTenantScopedClassResolved,\n  resolveDispatchTenantScope,\n} from '../dispatch';\nimport type { PublicJsonOptions, SmrtObject } from '../object';\nimport { ObjectRegistry } from '../registry';\nimport type {\n  ApiCustomRouteConfig,\n  RegisteredClass,\n  RegisteredField,\n  SmrtObjectConstructor,\n} from '../registry/types';\nimport type {\n  FieldDefinition,\n  MethodDefinition,\n  SmartObjectDefinition,\n  SmartObjectManifest,\n} from '../scanner/types';\nimport {\n  processSyncApplyBatch,\n  SYNC_APPLY_ROUTE_SEGMENTS,\n  type SyncApplyOp,\n  type SyncApplyTarget,\n} from '../sync/apply';\nimport { computeWebManifestHash } from '../vite-plugin/web-collections';\nimport { handleChangesRoute } from './changes-route';\nimport {\n  canonicalReadRepresentation,\n  computeTableVersionEtag,\n  conditionalJsonResponse,\n  ifNoneMatchHasConcreteMatch,\n  ifNoneMatchSatisfied,\n  resolveReadCacheControl,\n  resolveTenantEtagDiscriminator,\n  versionConditionalResponse,\n  warnIfSharedCacheNeutralized,\n  warnIfTenantScopedPublicRead,\n} from './conditional-get';\nimport {\n  buildCustomActionInvocationArgs,\n  normalizeCustomActionFailure,\n  resolveCustomActionMetadata,\n} from './custom-action';\nimport { handleEventsRoute } from './events-route';\n\nexport interface APIConfig {\n  basePath?: string;\n  enableCors?: boolean;\n  /**\n   * Explicit CORS origin allowlist (#1540). Required when `enableCors` is true —\n   * the generator never emits `Access-Control-Allow-Origin: *`. A request's\n   * `Origin` is echoed only when it appears here.\n   */\n  allowedOrigins?: string[];\n  /**\n   * Opt into credentialed CORS (#1861). When true, CORS responses to an\n   * allow-listed origin also carry `Access-Control-Allow-Credentials: true`, so\n   * a cross-origin browser client may send cookies (the only auth an\n   * `EventSource` can carry — it cannot set an `Authorization` header). Requires\n   * `enableCors` + a non-empty `allowedOrigins`: credentials are NEVER paired\n   * with a wildcard origin, and the origin is still echoed only when it is\n   * explicitly allow-listed. Fail-closed default (`false`): same-origin only,\n   * even when CORS is otherwise enabled, so a plain `enableCors` never silently\n   * starts flowing cookies cross-origin.\n   */\n  allowCredentials?: boolean;\n  customRoutes?: Record<string, (req: Request) => Promise<Response>>;\n  authMiddleware?: (\n    objectName: string,\n    action: string,\n  ) => (req: Request) => Promise<Request | Response>;\n  port?: number;\n  hostname?: string;\n  /**\n   * Live `_events` route options. `maxSubscribers` caps active SSE streams per\n   * process (#1860); over-cap connections receive a retryable 503. Set to 0\n   * for no cap.\n   */\n  eventsRoute?: {\n    maxSubscribers?: number;\n  };\n  /**\n   * The build's web-collection SHAPE digest (#1764) — the same value the\n   * generated `@happyvertical/smrt-virt-web` module exports. When supplied it is\n   * folded into every read ETag via {@link computeTableVersionEtag}, so a\n   * shape-only deploy (no table write) busts every read validator, closing\n   * the documented v2 staleness gap. When omitted, APIGenerator computes the\n   * same digest from the runtime registry on first read (#1862). The generated\n   * SvelteKit routes bake the same constant in directly rather than going\n   * through this runtime server.\n   */\n  manifestHash?: string;\n}\n\nexport interface APIContext {\n  db?: unknown;\n  ai?: unknown;\n  user?: {\n    id: string;\n    username?: string;\n    roles?: string[];\n  };\n  /** Resolved permission slugs held by the caller. */\n  permissions?: Iterable<string>;\n}\n\nfunction registeredFieldsToManifest(\n  fields: Map<string, RegisteredField>,\n): Record<string, FieldDefinition> {\n  const result: Record<string, FieldDefinition> = {};\n  for (const [name, field] of fields) {\n    if (!field || typeof field.type !== 'string') continue;\n    const defaultValue =\n      field.default !== undefined ? field.default : field._meta?.default;\n    result[name] = {\n      type: field.type as FieldDefinition['type'],\n      ...(field.required !== undefined ? { required: field.required } : {}),\n      ...(defaultValue !== undefined ? { default: defaultValue } : {}),\n      ...(field.related !== undefined ? { related: field.related } : {}),\n      ...(field.transient !== undefined ? { transient: field.transient } : {}),\n      ...(field.sensitive !== undefined ? { sensitive: field.sensitive } : {}),\n      ...(field.readonly !== undefined ? { readonly: field.readonly } : {}),\n      ...(field.readPermission !== undefined\n        ? { readPermission: field.readPermission }\n        : {}),\n      ...(field._meta !== undefined ? { _meta: field._meta } : {}),\n    };\n  }\n  return result;\n}\n\nfunction registeredMethodsToManifest(\n  methods: Map<string, MethodDefinition> | undefined,\n): Record<string, MethodDefinition> {\n  return Object.fromEntries(methods ?? []);\n}\n\nfunction pluralizeRuntimeCollectionName(className: string): string {\n  const lower = className.toLowerCase();\n  if (lower.endsWith('y')) return `${lower.slice(0, -1)}ies`;\n  if (lower.endsWith('s') || lower.endsWith('x') || lower.endsWith('z')) {\n    return `${lower}es`;\n  }\n  if (lower.endsWith('ch') || lower.endsWith('sh')) return `${lower}es`;\n  return `${lower}s`;\n}\n\nfunction runtimeObjectDefinition(\n  key: string,\n  info: RegisteredClass,\n): SmartObjectDefinition {\n  const className = info.name || key;\n  return {\n    className,\n    name: className.toLowerCase(),\n    collection: info.collection || pluralizeRuntimeCollectionName(className),\n    filePath: info.sourceFilePath || '',\n    fields: registeredFieldsToManifest(info.inheritedFields || info.fields),\n    methods: registeredMethodsToManifest(info.inheritedMethods || info.methods),\n    decoratorConfig: info.config || {},\n    ...(info.qualifiedName ? { qualifiedName: info.qualifiedName } : {}),\n    ...(info.packageName ? { packageName: info.packageName } : {}),\n    ...(info.visibility ? { visibility: info.visibility } : {}),\n    ...(info.extends ? { extends: info.extends } : {}),\n    ...(info.extendsTypeArg ? { extendsTypeArg: info.extendsTypeArg } : {}),\n    ...(info.tools ? { tools: info.tools } : {}),\n  };\n}\n\n/**\n * Compute the runtime REST web-manifest hash from the registered object graph\n * (#1862). This mirrors the Vite/SvelteKit source (`computeWebManifestHash`)\n * but builds the manifest from `ObjectRegistry` for APIGenerator deployments.\n */\nexport function computeRuntimeWebManifestHash(\n  classes: Iterable<[string, RegisteredClass]> = ObjectRegistry.getAllClasses(),\n): string {\n  const objects: SmartObjectManifest['objects'] = {};\n  const seen = new Set<RegisteredClass>();\n  for (const [key, info] of classes) {\n    if (seen.has(info)) continue;\n    seen.add(info);\n    const manifestKey = info.qualifiedName || key;\n    objects[manifestKey] = runtimeObjectDefinition(key, info);\n  }\n  return computeWebManifestHash({\n    version: 'runtime',\n    timestamp: 0,\n    objects,\n  });\n}\n\n/**\n * High-performance API generator using native Bun\n */\nexport class APIGenerator {\n  private config: APIConfig;\n  private collections = new Map<string, SmrtCollection<SmrtObject>>();\n  private context: APIContext;\n  private runtimeManifestHash: string | undefined;\n\n  constructor(config: APIConfig = {}, context: APIContext = {}) {\n    this.config = {\n      basePath: '/api/v1',\n      // Security defaults (#1540): bind to loopback and keep CORS off unless an\n      // explicit origin allowlist is supplied. No `Access-Control-Allow-Origin: *`.\n      enableCors: false,\n      port: 3000,\n      hostname: '127.0.0.1',\n      ...config,\n    };\n    this.context = context;\n  }\n\n  /**\n   * Register a pre-configured collection instance for API exposure\n   *\n   * @param name - URL path segment for the collection (e.g., 'products' for /api/products)\n   * @param collection - Pre-initialized SmrtCollection instance\n   */\n  registerCollection(\n    name: string,\n    collection: SmrtCollection<SmrtObject>,\n  ): void {\n    this.collections.set(name, collection);\n    this.runtimeManifestHash = undefined;\n  }\n\n  /**\n   * Resolve the database for generator-level routes that are not object-scoped\n   * (currently the `_changes` feed, #1758).\n   *\n   * Prefers the explicit `APIContext.db`, but falls back to the first\n   * registered collection's live handle so the feed works under the documented\n   * `registerCollection()` wiring, where callers configure collections with a\n   * database but never populate `APIContext.db`. Without the fallback the feed\n   * would 503 even though the database is reachable.\n   */\n  private resolveContextDb(): unknown {\n    return (\n      this.context.db ?? this.collections.values().next().value?.db ?? undefined\n    );\n  }\n\n  /**\n   * Create Node.js HTTP server with all routes\n   */\n  createServer(): { server: http.Server; url: string } {\n    const server = http.createServer(async (req, res) => {\n      try {\n        const request = await this.nodeRequestToWebRequest(req);\n        const response = await this.handleRequest(request);\n        await this.webResponseToNodeResponse(response, res);\n      } catch (_error) {\n        res.statusCode = 500;\n        res.end('Internal Server Error');\n      }\n    });\n\n    server.listen(this.config.port, this.config.hostname);\n\n    return {\n      server,\n      url: `http://${this.config.hostname}:${this.config.port}`,\n    };\n  }\n\n  /**\n   * Convert stream to string\n   */\n  private async streamToString(stream: http.IncomingMessage): Promise<string> {\n    const chunks: Buffer[] = [];\n    for await (const chunk of stream) {\n      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n    }\n    return Buffer.concat(chunks).toString('utf-8');\n  }\n\n  /**\n   * Convert Node.js IncomingMessage to Web Request\n   */\n  private async nodeRequestToWebRequest(\n    req: http.IncomingMessage,\n  ): Promise<Request> {\n    const url = `http://${this.config.hostname}:${this.config.port}${req.url}`;\n    const method = req.method || 'GET';\n    const headers = new Headers();\n\n    for (const [key, value] of Object.entries(req.headers)) {\n      if (value) {\n        headers.set(key, Array.isArray(value) ? value[0] : value);\n      }\n    }\n\n    let body: string | undefined;\n    if (method !== 'GET' && method !== 'HEAD') {\n      body = await this.streamToString(req);\n    }\n\n    return new Request(url, {\n      method,\n      headers,\n      body,\n    });\n  }\n\n  /**\n   * Convert Web Response to Node.js ServerResponse\n   */\n  private async webResponseToNodeResponse(\n    webResponse: Response,\n    res: http.ServerResponse,\n  ): Promise<void> {\n    res.statusCode = webResponse.status;\n\n    // Set headers\n    webResponse.headers.forEach((value, key) => {\n      res.setHeader(key, value);\n    });\n\n    // Send body\n    if (webResponse.body) {\n      const reader = webResponse.body.getReader();\n\n      // Client disconnect handling — essential for the long-lived `_events` SSE\n      // stream (#1763): a never-ending stream is only torn down when its reader\n      // is cancelled, and nothing cancels it unless we detect the socket close.\n      // On `res`/socket 'close' before the response finished, cancel the reader\n      // so the source stream's `cancel()` fires (unsubscribe + clear heartbeat).\n      let clientGone = false;\n      const onClose = () => {\n        if (res.writableFinished) return; // normal completion, not a disconnect\n        clientGone = true;\n        void reader.cancel().catch(() => {});\n      };\n      res.on('close', onClose);\n\n      try {\n        while (true) {\n          const { done, value } = await reader.read();\n          if (done || clientGone) break;\n          if (!res.write(value)) {\n            // Respect back-pressure so a slow/absent consumer can't unbounded-\n            // buffer in the Node socket. Resolve on 'drain' OR on 'close'/\n            // 'error' — a disconnect while back-pressured never fires 'drain',\n            // so waiting only for it would hang this frame forever (leaking it\n            // and pinning the reader for the long-lived `_events` stream). Race\n            // the three and remove the losers so one-shot listeners don't pile\n            // up across many drains.\n            await new Promise<void>((resolve) => {\n              const settle = () => {\n                res.off('drain', settle);\n                res.off('close', settle);\n                res.off('error', settle);\n                resolve();\n              };\n              res.once('drain', settle);\n              res.once('close', settle);\n              res.once('error', settle);\n            });\n            if (clientGone) break;\n          }\n        }\n      } catch {\n        // Reader cancelled (client gone) or write failed — stop streaming.\n      } finally {\n        res.off('close', onClose);\n      }\n    }\n\n    if (!res.writableEnded) {\n      res.end();\n    }\n  }\n\n  /**\n   * Generate fetch handler function (for serverless environments)\n   */\n  generateHandler(): (req: Request) => Promise<Response> {\n    return (req) => this.handleRequest(req);\n  }\n\n  /**\n   * Main request handler using native Bun APIs\n   */\n  private async handleRequest(req: Request): Promise<Response> {\n    const url = new URL(req.url);\n\n    // Handle CORS preflight\n    if (req.method === 'OPTIONS' && this.config.enableCors) {\n      return this.createCorsResponse(req);\n    }\n\n    // Handle custom routes first\n    if (this.config.customRoutes) {\n      for (const [path, handler] of Object.entries(this.config.customRoutes)) {\n        if (url.pathname === `${this.config.basePath}${path}`) {\n          const response = await handler(req);\n          return this.addCorsHeaders(response, req);\n        }\n      }\n    }\n\n    // Change-feed route (#1758): auth-guarded, tenant-scoped cursor read\n    // over the _smrt_changes log. Logic lives in ./changes-route.ts.\n    if (url.pathname === `${this.config.basePath}/_changes`) {\n      const response = await handleChangesRoute(req, {\n        authMiddleware: this.config.authMiddleware,\n        db: this.resolveContextDb(),\n      });\n      return this.addCorsHeaders(response, req);\n    }\n\n    // Live change-signal SSE route (#1763): auth-guarded, tenant-scoped\n    // Server-Sent-Events stream of coarse signals (no row payloads). Logic\n    // lives in ./events-route.ts. Wrapped in addCorsHeaders so a cross-origin\n    // credentialed EventSource can subscribe when `allowCredentials` + an\n    // allow-listed origin are configured (#1861); with the fail-closed default\n    // (`allowCredentials: false`) this stays same-origin only, exactly as\n    // before. The stream body passes through untouched — addCorsHeaders only\n    // re-wraps headers. Fail-closed auth is unchanged: the CORS layer never\n    // authorizes; it only lets an already-authorized cookie reach the guard.\n    if (url.pathname === `${this.config.basePath}/_events`) {\n      const response = await handleEventsRoute(req, {\n        authMiddleware: this.config.authMiddleware,\n        db: this.resolveContextDb(),\n        manifestHash: this.resolveManifestHash(),\n        maxSubscribers: this.config.eventsRoute?.maxSubscribers,\n      });\n      return this.addCorsHeaders(response, req);\n    }\n\n    // Handle object routes\n    if (url.pathname.startsWith(this.config.basePath || '')) {\n      const response = await this.handleObjectRoute(req, url);\n      return this.addCorsHeaders(response, req);\n    }\n\n    // Not found\n    return this.createErrorResponse(404, 'Not found');\n  }\n\n  /**\n   * Handle CRUD routes for SMRT objects\n   */\n  private async handleObjectRoute(req: Request, url: URL): Promise<Response> {\n    const pathParts = url.pathname\n      .replace(this.config.basePath || '', '')\n      .split('/')\n      .filter(Boolean);\n\n    if (pathParts.length === 0) {\n      return this.createErrorResponse(400, 'Object type required');\n    }\n\n    // Reserved batch write contract route (#1759): POST {basePath}/sync/apply.\n    if (\n      pathParts.length === SYNC_APPLY_ROUTE_SEGMENTS.length &&\n      SYNC_APPLY_ROUTE_SEGMENTS.every((segment, i) => pathParts[i] === segment)\n    ) {\n      if (req.method !== 'POST') {\n        return this.createErrorResponse(405, 'Method not allowed');\n      }\n      return await this.handleSyncApply(req);\n    }\n\n    const objectType = pathParts[0];\n    const objectId = pathParts[1];\n\n    // Check for explicitly registered collection first\n    if (this.collections.has(objectType)) {\n      const collection = this.collections.get(objectType);\n      if (!collection) throw new Error(`Collection ${objectType} not found`);\n\n      const objectName = this.getCollectionObjectName(collection) || objectType;\n\n      // Apply auth middleware if configured\n      if (this.config.authMiddleware) {\n        const authCheck = this.config.authMiddleware(\n          objectName,\n          req.method.toLowerCase(),\n        );\n        const authResult = await authCheck(req);\n        if (authResult instanceof Response) {\n          return authResult; // Auth failed\n        }\n        // Auth passed, use the potentially modified request\n        req = authResult;\n      } else if (!this.isRoutePublic(objectName, req.method)) {\n        // Fail-closed (#1540): no auth middleware wired and the object isn't\n        // marked `@smrt({ api: { public } })` → refuse rather than serve open.\n        return this.createErrorResponse(401, 'Authentication required');\n      }\n\n      // Use registered collection directly\n      return await this.executeCrudOperation(\n        req,\n        collection,\n        objectId,\n        url,\n        objectName,\n      );\n    }\n\n    // Fall back to auto-discovery via ObjectRegistry, matching the URL segment\n    // against the canonical manifest `collection` value (#1794).\n    const classInfo = this.findClassByCollectionSegment(objectType);\n\n    if (!classInfo) {\n      return this.createErrorResponse(\n        404,\n        `Object type '${objectType}' not found`,\n      );\n    }\n\n    // Apply auth middleware if configured\n    if (this.config.authMiddleware) {\n      const authCheck = this.config.authMiddleware(\n        classInfo.name,\n        req.method.toLowerCase(),\n      );\n      const authResult = await authCheck(req);\n      if (authResult instanceof Response) {\n        return authResult; // Auth failed\n      }\n      // Auth passed, use the potentially modified request\n      req = authResult;\n    } else if (!this.isRoutePublic(classInfo.name, req.method)) {\n      // Fail-closed (#1540): see registered-collection branch above.\n      return this.createErrorResponse(401, 'Authentication required');\n    }\n\n    // Get or create collection\n    const collection = await this.getCollection(classInfo);\n\n    return await this.executeCrudOperation(\n      req,\n      collection,\n      objectId,\n      url,\n      classInfo.name,\n    );\n  }\n\n  /**\n   * Execute CRUD operation on a collection\n   */\n  private async executeCrudOperation(\n    req: Request,\n    collection: SmrtCollection<SmrtObject>,\n    objectId: string | undefined,\n    url: URL,\n    objectName?: string,\n  ): Promise<Response> {\n    try {\n      // Decorator-declared custom collection actions dispatch BEFORE CRUD\n      // routing: without this, `POST /<collection>/<action>` would fall into\n      // `handleCreate` with the action segment silently discarded (#2047).\n      if (objectId && objectName) {\n        const customResponse = await this.dispatchCustomCollectionAction(\n          req,\n          collection,\n          objectId,\n          url,\n          objectName,\n        );\n        if (customResponse) {\n          return customResponse;\n        }\n      }\n\n      const action = this.getCrudAction(req.method, objectId);\n      if (action && !this.isApiActionEnabled(objectName, action)) {\n        return this.createErrorResponse(405, 'Method not allowed');\n      }\n\n      // Handle special /count endpoint\n      if (objectId === 'count' && req.method === 'GET') {\n        return await this.handleCount(collection, url.searchParams, objectName);\n      }\n\n      // Route to appropriate CRUD operation\n      switch (req.method) {\n        case 'GET':\n          return objectId\n            ? await this.handleGet(collection, objectId, req, objectName)\n            : await this.handleList(\n                collection,\n                url.searchParams,\n                req,\n                objectName,\n              );\n\n        case 'POST':\n          return await this.handleCreate(collection, req, objectName);\n\n        case 'PUT':\n        case 'PATCH':\n          if (!objectId) {\n            return this.createErrorResponse(\n              400,\n              'Object ID required for update',\n            );\n          }\n          return await this.handleUpdate(collection, objectId, req, objectName);\n\n        case 'DELETE':\n          if (!objectId) {\n            return this.createErrorResponse(\n              400,\n              'Object ID required for delete',\n            );\n          }\n          return await this.handleDelete(collection, objectId);\n\n        default:\n          return this.createErrorResponse(405, 'Method not allowed');\n      }\n    } catch (error) {\n      console.error('API Error:', error);\n      return this.createErrorResponse(500, 'Internal server error');\n    }\n  }\n\n  private getCrudAction(\n    method: string,\n    objectId: string | undefined,\n  ): 'list' | 'get' | 'create' | 'update' | 'delete' | null {\n    switch (method) {\n      case 'GET':\n        return objectId && objectId !== 'count' ? 'get' : 'list';\n      case 'POST':\n        return 'create';\n      case 'PUT':\n      case 'PATCH':\n        return 'update';\n      case 'DELETE':\n        return 'delete';\n      default:\n        return null;\n    }\n  }\n\n  /**\n   * Fail-closed authorization posture (#1540). Returns true only when the\n   * object opts out of auth via `@smrt({ api: { public } })`:\n   * - `public: true` → all methods are public.\n   * - `public: 'read'` → only safe (GET) methods are public.\n   * Everything else requires an `authMiddleware` to be configured.\n   */\n  private isRoutePublic(\n    objectName: string | undefined,\n    method: string,\n  ): boolean {\n    if (!objectName) return false;\n    const apiConfig = ObjectRegistry.getConfig(objectName)?.api;\n    if (!apiConfig || typeof apiConfig !== 'object') return false;\n    const publicAccess = (apiConfig as { public?: boolean | 'read' }).public;\n    if (publicAccess === true) return true;\n    if (publicAccess === 'read') return method.toUpperCase() === 'GET';\n    return false;\n  }\n\n  private isApiActionEnabled(\n    objectName: string | undefined,\n    action: 'list' | 'get' | 'create' | 'update' | 'delete',\n  ): boolean {\n    if (!objectName) {\n      return true;\n    }\n\n    const config = ObjectRegistry.getConfig(objectName);\n    const apiConfig = config.api;\n\n    if (apiConfig === false) {\n      return false;\n    }\n\n    if (apiConfig && typeof apiConfig === 'object') {\n      if (apiConfig.include && !apiConfig.include.includes(action)) {\n        return false;\n      }\n\n      if (apiConfig.exclude?.includes(action)) {\n        return false;\n      }\n    }\n\n    return true;\n  }\n\n  private getCollectionObjectName(\n    collection: SmrtCollection<SmrtObject>,\n  ): string | undefined {\n    // `_itemClass` lives on the instance (protected getter) or the collection\n    // constructor (static). Read it through a structural shape rather than the\n    // class's private surface; behavior is unchanged.\n    const itemClass: SmrtObjectConstructor | undefined =\n      (collection as unknown as { _itemClass?: SmrtObjectConstructor })\n        ._itemClass ||\n      (\n        collection.constructor as unknown as {\n          _itemClass?: SmrtObjectConstructor;\n        }\n      )?._itemClass;\n\n    if (!itemClass) {\n      return undefined;\n    }\n\n    const registered = ObjectRegistry.getClassByConstructor(itemClass);\n    return registered?.qualifiedName || registered?.name || itemClass.name;\n  }\n\n  /**\n   * Dispatch a decorator-declared custom COLLECTION-scoped action —\n   * `@smrt({ api: { include: [...], routes: { action: { scope: 'collection',\n   * method, path } } } })` — on the runtime transport (#2047). The generated\n   * SvelteKit transport already dispatches these routes; this keeps the two\n   * transports coherent for the same decorator metadata.\n   *\n   * Deliberately narrow, matching this router's URL shape: single-segment\n   * collection-scoped paths only (multi-segment custom paths remain a\n   * SvelteKit-transport feature), the action must be exposed by `api.include`\n   * (and not excluded), and the HTTP method must match the route metadata.\n   * Non-matching requests fall through to CRUD handling unchanged.\n   *\n   * Scope is resolved through the shared `resolveCustomActionMetadata`\n   * contract, not read off the route alone: `scope` is OPTIONAL and defaults\n   * to `collection` for statics and `item` for instance methods, so requiring\n   * a literal `scope: 'collection'` would skip a valid static action and let\n   * `POST /<collection>/<action>` fall through into `create`. The receiver\n   * decides — a route-only scope cannot manufacture one — so an action with no\n   * collection-hosted receiver falls through unless the route explicitly\n   * declared `scope: 'collection'`, in which case it is declared-but-missing\n   * and returns 501 rather than degrading into a malformed CRUD write.\n   *\n   * Arguments, failures, and result shaping all reuse the shared custom-action\n   * helpers so this transport matches generated REST/CLI/MCP exactly: declared\n   * parameters are projected (a zero-parameter action takes no body at all, an\n   * `options` bag is passed through, named parameters are read off the body),\n   * a returned `{ ok: false, ... }` failure becomes its requested non-2xx\n   * status with a redacted payload, and success wraps as `{ action, result }`.\n   */\n  private async dispatchCustomCollectionAction(\n    req: Request,\n    collection: SmrtCollection<SmrtObject>,\n    pathSegment: string,\n    url: URL,\n    objectName: string,\n  ): Promise<Response | null> {\n    const apiConfig = ObjectRegistry.getConfig(objectName)?.api;\n    if (!apiConfig || typeof apiConfig !== 'object' || !apiConfig.routes) {\n      return null;\n    }\n\n    for (const [actionName, routeConfig] of Object.entries(\n      apiConfig.routes as Record<string, ApiCustomRouteConfig>,\n    )) {\n      const routePath = routeConfig?.path || actionName;\n      if (routePath.includes('/') || routePath !== pathSegment) {\n        continue;\n      }\n      const routeMethod = (routeConfig?.method || 'POST').toUpperCase();\n      if (routeMethod !== req.method.toUpperCase()) {\n        continue;\n      }\n      // Explicit exposure only: same include/exclude gating as the SvelteKit\n      // generator applies to custom actions.\n      if (apiConfig.include && !apiConfig.include.includes(actionName)) {\n        continue;\n      }\n      if (apiConfig.exclude?.includes(actionName)) {\n        continue;\n      }\n\n      // Receiver: an instance method on the registered collection, or a\n      // static on the item class (the two hosts the generators support).\n      const collectionMethod = (\n        collection as unknown as Record<string, unknown>\n      )[actionName];\n      const itemConstructor = ObjectRegistry.getClass(objectName)\n        ?.constructor as unknown as Record<string, unknown> | undefined;\n      const staticMethod = itemConstructor?.[actionName];\n      const isCollectionHosted = typeof collectionMethod === 'function';\n      const isStaticHosted =\n        !isCollectionHosted && typeof staticMethod === 'function';\n\n      if (!isCollectionHosted && !isStaticHosted) {\n        // Declared collection routes must not degrade into a CRUD write;\n        // anything else (an item-scoped action reached at the collection URL,\n        // or an unrelated segment) falls through unchanged.\n        if (routeConfig?.scope === 'collection') {\n          return this.createErrorResponse(\n            501,\n            `Custom action '${actionName}' is declared but not implemented`,\n          );\n        }\n        continue;\n      }\n\n      const metadata = resolveCustomActionMetadata({\n        actionName,\n        apiConfig,\n        method: ObjectRegistry.getMethods(objectName)?.get(actionName),\n        // A collection instance method is collection-hosted even when it is\n        // not static; a static on the item class already defaults the same\n        // way. Either receiver makes this route collection-targeted.\n        defaultScope: 'collection',\n      });\n      if (metadata.scope !== 'collection') {\n        continue;\n      }\n\n      const invoke = isCollectionHosted\n        ? (args: unknown[]) =>\n            (collectionMethod as (...a: unknown[]) => unknown).apply(\n              collection,\n              args,\n            )\n        : (args: unknown[]) =>\n            (staticMethod as (...a: unknown[]) => unknown).apply(\n              itemConstructor,\n              args,\n            );\n\n      // An ABSENT body is \"no input\", not a malformed one — a zero-parameter\n      // action is legitimately called with no body at all. A body that is\n      // present but unparseable stays a 400 rather than degrading into a CRUD\n      // write. GET reads the query string instead.\n      let options: unknown;\n      if (routeMethod === 'GET') {\n        options = Object.fromEntries(url.searchParams.entries());\n      } else {\n        let rawBody = '';\n        try {\n          rawBody = await req.text();\n        } catch {\n          rawBody = '';\n        }\n        if (rawBody.trim() !== '') {\n          try {\n            options = JSON.parse(rawBody);\n          } catch {\n            return this.createErrorResponse(400, 'Invalid JSON body');\n          }\n        }\n      }\n\n      // Project declared parameters only when the registry actually knows\n      // them. Without metadata the historical single-options call is kept\n      // verbatim, so an opaque body (an array, or any non-record payload an\n      // existing action already accepts) still arrives unchanged rather than\n      // being silently normalized away.\n      const invocationArgs = metadata.parameters\n        ? buildCustomActionInvocationArgs(metadata, {\n            ...(options &&\n            typeof options === 'object' &&\n            !Array.isArray(options)\n              ? (options as Record<string, unknown>)\n              : {}),\n            options,\n          })\n        : [options];\n\n      const result = await invoke(invocationArgs);\n\n      const failure = normalizeCustomActionFailure(result);\n      if (failure) {\n        return this.createJsonResponse({ error: failure }, failure.status);\n      }\n\n      return this.createJsonResponse({\n        action: actionName,\n        result: this.sanitizeActionResult(result),\n      });\n    }\n\n    return null;\n  }\n\n  /**\n   * Public-safe projection for custom-action results, mirroring the generated\n   * SvelteKit routes' `toPublicResult`: a `SmrtObject` (anything exposing\n   * `toPublicJSON`) becomes its public projection with the caller's\n   * permissions, arrays and plain objects are walked, non-plain instances and\n   * primitives pass through, and a cycle guard breaks reference loops.\n   */\n  private sanitizeActionResult(\n    value: unknown,\n    seen: WeakSet<object> = new WeakSet(),\n  ): unknown {\n    if (value === null || typeof value !== 'object') {\n      return value;\n    }\n    if (seen.has(value)) {\n      return null;\n    }\n    const serializable = value as {\n      toPublicJSON?: (options?: PublicJsonOptions) => unknown;\n    };\n    if (typeof serializable.toPublicJSON === 'function') {\n      seen.add(value);\n      return this.sanitizeActionResult(\n        serializable.toPublicJSON(this.getPublicJsonOptions()),\n        seen,\n      );\n    }\n    if (Array.isArray(value)) {\n      seen.add(value);\n      return value.map((entry) => this.sanitizeActionResult(entry, seen));\n    }\n    const proto = Object.getPrototypeOf(value);\n    if (proto !== Object.prototype && proto !== null) {\n      return value;\n    }\n    seen.add(value);\n    const out: Record<string, unknown> = {};\n    for (const [key, entry] of Object.entries(value)) {\n      out[key] = this.sanitizeActionResult(entry, seen);\n    }\n    return out;\n  }\n\n  /**\n   * Fail-closed tenant read scope (#1782).\n   *\n   * A `@TenantScoped` model served over a public/anonymous read has no ambient\n   * tenant context, so the tenancy interceptor (optional mode) passes the query\n   * through UNFILTERED and returns every tenant's rows. When tenancy is enabled\n   * but no tenant is active, this returns a `{ tenantId: null }` filter so reads\n   * fail closed to NULL-tenant (global) rows only — mirroring the dispatch\n   * resolver's \"enforced, no active tenant → global rows only\" convention\n   * (`resolveDispatchTenantScope` is the core-level trust anchor tenancy fills\n   * in; core cannot import tenancy directly). Returns undefined when a tenant IS\n   * active (the interceptor filters by it) or tenancy is disabled (no isolation\n   * to enforce).\n   *\n   * Tenant scoping is recognized across BOTH registration forms (#1782): the\n   * `@smrt({ tenantScoped })` config / manifest-merged form via\n   * `ObjectRegistry.isTenantScoped`, and the standalone `@TenantScoped()`\n   * decorator via the tenancy-filled `isTenantScopedClassResolved` hook — so a\n   * `@TenantScoped()`-only public model can't slip past the guard regardless of\n   * manifest timing.\n   */\n  private resolveTenantReadScope(\n    objectName?: string,\n  ): { tenantId: null } | undefined {\n    if (\n      !objectName ||\n      !(\n        ObjectRegistry.isTenantScoped(objectName) ||\n        !!ObjectRegistry.getConfig(objectName)?.tenantScoped ||\n        isTenantScopedClassResolved(objectName)\n      )\n    ) {\n      return undefined;\n    }\n    const scope = resolveDispatchTenantScope();\n    return scope.enforced && scope.tenantId === null\n      ? { tenantId: null }\n      : undefined;\n  }\n\n  /**\n   * Merge the fail-closed tenant read scope (#1782) into a query's WHERE clause.\n   * When the scope is active (global-only), any client-supplied tenant filter is\n   * dropped first so a `?tenantId=...` / `?tenant_id[ne]=...` query param can\n   * never widen the scope, then NULL-tenant is forced. Returns the original\n   * `where` untouched when the scope is inactive.\n   */\n  private applyTenantReadScope(\n    objectName: string | undefined,\n    where: Record<string, string | string[]> | undefined,\n  ): Record<string, unknown> | undefined {\n    const scope = this.resolveTenantReadScope(objectName);\n    if (!scope) {\n      return where;\n    }\n    const cleaned: Record<string, unknown> = {};\n    for (const [key, value] of Object.entries(where ?? {})) {\n      // A key may carry an operator suffix, e.g. \"tenant_id !=\" — match on the\n      // field portion so no operator variant slips a client tenant filter past.\n      const field = key.split(/\\s+/)[0];\n      if (field === 'tenantId' || field === 'tenant_id') {\n        continue;\n      }\n      cleaned[key] = value;\n    }\n    cleaned.tenantId = null;\n    return cleaned;\n  }\n\n  /**\n   * Handle GET /objects/:id\n   */\n  private async handleGet(\n    collection: SmrtCollection<SmrtObject>,\n    id: string,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const cacheControl = this.resolveReadCachePolicy(objectName);\n\n    if (this.hasReadPermissionFields(objectName)) {\n      // Field-level read permissions make the response body vary by caller\n      // permissions, so the validator must cover the redacted body returned to\n      // this caller rather than only the table version.\n      const scope = this.resolveTenantReadScope(objectName);\n      const object = scope\n        ? await collection.get({ id, ...scope })\n        : await collection.get(id);\n      if (!object) {\n        return this.createErrorResponse(404, 'Object not found');\n      }\n      return conditionalJsonResponse(\n        req,\n        this.toPublicData(object),\n        cacheControl,\n      );\n    }\n\n    // ETag v2 (#1765): compute the table-version ETag first. A CONCRETE\n    // If-None-Match short-circuits into a 304 BEFORE the row is fetched — a\n    // delete advances the table version (tombstone), so a stale cached\n    // representation of a since-deleted row can never concretely match. A\n    // wildcard `*` is deferred until AFTER the fetch confirms the row exists,\n    // so a missing row still returns 404 (not a false 304).\n    const etag = await this.computeReadEtag(collection, req, objectName);\n    const ifNoneMatch = req.headers.get('if-none-match');\n    const notModified = (): Response =>\n      new Response(null, {\n        status: 304,\n        headers: { 'Cache-Control': cacheControl, ETag: etag },\n      });\n    if (ifNoneMatchHasConcreteMatch(ifNoneMatch, etag)) {\n      return notModified();\n    }\n\n    // #1782: scope a public/anonymous read of a tenant-scoped model to global\n    // (NULL-tenant) rows when no tenant context is active.\n    const scope = this.resolveTenantReadScope(objectName);\n    const object = scope\n      ? await collection.get({ id, ...scope })\n      : await collection.get(id);\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n    // Row exists → a wildcard `*` may now be honored as a 304.\n    if (ifNoneMatchSatisfied(ifNoneMatch, etag)) {\n      return notModified();\n    }\n    return new Response(JSON.stringify(this.toPublicData(object)), {\n      status: 200,\n      headers: {\n        'Cache-Control': cacheControl,\n        'Content-Type': 'application/json',\n        ETag: etag,\n      },\n    });\n  }\n\n  /**\n   * Handle GET /objects (list with query params)\n   */\n  private async handleList(\n    collection: SmrtCollection<SmrtObject>,\n    params: URLSearchParams,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const cacheControl = this.resolveReadCachePolicy(objectName);\n\n    const buildPayload = async () => {\n      const limit = Number.parseInt(params.get('limit') || '50', 10);\n      const offset = Number.parseInt(params.get('offset') || '0', 10);\n      const orderBy = params.get('orderBy') || 'created_at DESC';\n\n      // Build where clause from query params\n      // Convert REST-style operators (price[gt]) to SQL-style (price >)\n      const where: Record<string, string | string[]> = {};\n      for (const [key, value] of params.entries()) {\n        if (!['limit', 'offset', 'orderBy'].includes(key)) {\n          // Parse REST operator format: field[operator]\n          const match = key.match(/^(.+)\\[(.+)\\]$/);\n          if (match) {\n            const field = match[1];\n            const operator = match[2];\n            // Map REST operators to SQL operators\n            const operatorMap: Record<string, string> = {\n              gt: '>',\n              gte: '>=',\n              lt: '<',\n              lte: '<=',\n              ne: '!=',\n              in: 'in',\n              like: 'like',\n            };\n            const sqlOperator = operatorMap[operator] || operator;\n            const sqlKey = `${field} ${sqlOperator}`;\n            // Handle 'in' operator - convert comma-separated string to array\n            where[sqlKey] = operator === 'in' ? value.split(',') : value;\n          } else {\n            where[key] = value;\n          }\n        }\n      }\n\n      // #1782: fail closed to global (NULL-tenant) rows for a public/anonymous\n      // read of a tenant-scoped model with no active tenant context.\n      const scopedWhere = this.applyTenantReadScope(objectName, where);\n\n      const objects = await collection.list({\n        where:\n          scopedWhere && Object.keys(scopedWhere).length > 0\n            ? scopedWhere\n            : undefined,\n        limit,\n        offset,\n        orderBy,\n      });\n\n      return objects.map((object: SmrtObject) => this.toPublicData(object));\n    };\n\n    if (this.hasReadPermissionFields(objectName)) {\n      // Field-level read permissions make the response body vary by caller\n      // permissions, so use the v1 body-hash path over the redacted payload.\n      return conditionalJsonResponse(req, await buildPayload(), cacheControl);\n    }\n\n    // ETag v2 (#1765): resolve the policy + table-version ETag first, then\n    // hand the list query to versionConditionalResponse as a thunk. On a\n    // matching If-None-Match it returns a 304 and the thunk — the collection\n    // query — never runs, so an unchanged table revalidates with no table scan.\n    const etag = await this.computeReadEtag(collection, req, objectName);\n    return versionConditionalResponse(req, etag, cacheControl, buildPayload);\n  }\n\n  /**\n   * Handle GET /objects/count\n   */\n  private async handleCount(\n    collection: SmrtCollection<SmrtObject>,\n    params: URLSearchParams,\n    objectName?: string,\n  ): Promise<Response> {\n    // Build where clause from query params (same logic as handleList)\n    const where: Record<string, string | string[]> = {};\n    for (const [key, value] of params.entries()) {\n      // Parse REST operator format: field[operator]\n      const match = key.match(/^(.+)\\[(.+)\\]$/);\n      if (match) {\n        const field = match[1];\n        const operator = match[2];\n        // Map REST operators to SQL operators\n        const operatorMap: Record<string, string> = {\n          gt: '>',\n          gte: '>=',\n          lt: '<',\n          lte: '<=',\n          ne: '!=',\n          in: 'in',\n          like: 'like',\n        };\n        const sqlOperator = operatorMap[operator] || operator;\n        const sqlKey = `${field} ${sqlOperator}`;\n        // Handle 'in' operator - convert comma-separated string to array\n        where[sqlKey] = operator === 'in' ? value.split(',') : value;\n      } else {\n        where[key] = value;\n      }\n    }\n\n    // #1782: a count leaks cross-tenant cardinality just as a list leaks rows,\n    // so apply the same fail-closed global scope for anonymous tenant reads.\n    const scopedWhere = this.applyTenantReadScope(objectName, where);\n\n    const count = await collection.count({\n      where:\n        scopedWhere && Object.keys(scopedWhere).length > 0\n          ? scopedWhere\n          : undefined,\n    });\n\n    return this.createJsonResponse({ count });\n  }\n\n  /**\n   * Handle POST /objects\n   */\n  private async handleCreate(\n    collection: SmrtCollection<SmrtObject>,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const data = this.applyWritablePolicy(objectName, await req.json());\n    const object = await collection.create({ ...data, _skipLoad: true });\n    await object.save();\n    return this.createJsonResponse(this.toPublicData(object), 201);\n  }\n\n  /**\n   * Handle PUT/PATCH /objects/:id\n   */\n  private async handleUpdate(\n    collection: SmrtCollection<SmrtObject>,\n    id: string,\n    req: Request,\n    objectName?: string,\n  ): Promise<Response> {\n    const data = this.applyWritablePolicy(objectName, await req.json());\n    const object = await collection.get(id);\n\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n\n    // Update object properties\n    Object.assign(object, data);\n    await object.save();\n\n    return this.createJsonResponse(this.toPublicData(object));\n  }\n\n  /**\n   * Handle DELETE /objects/:id\n   */\n  private async handleDelete(\n    collection: SmrtCollection<SmrtObject>,\n    id: string,\n  ): Promise<Response> {\n    const object = await collection.get(id);\n\n    if (!object) {\n      return this.createErrorResponse(404, 'Object not found');\n    }\n\n    await object.delete();\n    return new Response(null, { status: 204 });\n  }\n\n  /**\n   * Handle POST /sync/apply — the idempotent batch write contract (#1759).\n   * All processing lives in `sync/apply.ts`; this method only adapts the\n   * generator's existing collection resolution, auth, action gating, and\n   * writable policy into a {@link SyncApplyTarget} per item.\n   */\n  private async handleSyncApply(req: Request): Promise<Response> {\n    // Buffer the body once. Request bodies are single-read streams, and the\n    // per-item auth middleware below must receive a readable body exactly as\n    // it does on CRUD routes (where auth runs before parsing) — so each\n    // middleware invocation gets a fresh Request rebuilt from this buffer.\n    let rawBody: string;\n    let body: unknown;\n    try {\n      rawBody = await req.text();\n      body = JSON.parse(rawBody);\n    } catch {\n      return this.createErrorResponse(400, 'Invalid JSON body');\n    }\n\n    const outcome = await processSyncApplyBatch(body, {\n      resolveTarget: (objectSegment) =>\n        this.resolveSyncApplyTarget(objectSegment, req, rawBody),\n    });\n    return this.createJsonResponse(outcome.body, outcome.status);\n  }\n\n  /**\n   * Resolve a sync item's `object` segment exactly like `handleObjectRoute`\n   * resolves a CRUD URL segment (registered collections first, then registry\n   * auto-discovery), and wrap the generator's per-object machinery.\n   */\n  private async resolveSyncApplyTarget(\n    objectSegment: string,\n    req: Request,\n    rawBody: string,\n  ): Promise<SyncApplyTarget | null> {\n    let collection: SmrtCollection<SmrtObject> | null = null;\n    let objectName: string | null = null;\n\n    const registered = this.collections.get(objectSegment);\n    if (registered) {\n      collection = registered;\n      objectName = this.getCollectionObjectName(registered) || objectSegment;\n    } else {\n      // Same canonical-`collection` match as the CRUD path so a client and the\n      // batch contract resolve identical segments (#1794).\n      const info = this.findClassByCollectionSegment(objectSegment);\n      if (info) {\n        collection = await this.getCollection(info);\n        objectName = info.name;\n      }\n    }\n\n    if (!collection || !objectName) {\n      return null;\n    }\n\n    const resolvedName = objectName;\n    const resolvedCollection = collection;\n    return {\n      objectName: resolvedName,\n      collection: resolvedCollection,\n      isOpAllowed: (op: SyncApplyOp) =>\n        this.isApiActionEnabled(resolvedName, op),\n      authorize: async (op: SyncApplyOp) => {\n        if (this.config.authMiddleware) {\n          const verb =\n            op === 'create' ? 'post' : op === 'update' ? 'put' : 'delete';\n          const authCheck = this.config.authMiddleware(resolvedName, verb);\n          // Fresh Request per invocation: the batch handler already consumed\n          // the original body, and middleware may read it (body-based auth,\n          // request signing) exactly as it can on CRUD routes.\n          const authResult = await authCheck(\n            new Request(req.url, {\n              method: req.method,\n              headers: req.headers,\n              body: rawBody,\n            }),\n          );\n          if (authResult instanceof Response) {\n            return authResult.status === 401 ? 'auth_required' : 'forbidden';\n          }\n          return 'ok';\n        }\n        // Fail-closed (#1540): every sync op is mutating, so only\n        // `@smrt({ api: { public: true } })` objects apply without auth.\n        return this.isRoutePublic(resolvedName, 'POST')\n          ? 'ok'\n          : 'auth_required';\n      },\n      prepare: (payload) => this.applyWritablePolicy(resolvedName, payload),\n    };\n  }\n\n  /**\n   * Get or create collection instance\n   */\n  private async getCollection(\n    classInfo: RegisteredClass,\n  ): Promise<SmrtCollection<SmrtObject>> {\n    if (!this.collections.has(classInfo.name)) {\n      // `collectionConstructor` is typed optional on RegisteredClass, but the\n      // auto-discovery path only reaches here for classes that declare one.\n      // Narrow to the non-optional constructor type before instantiating.\n      const ctor = classInfo.collectionConstructor as NonNullable<\n        RegisteredClass['collectionConstructor']\n      >;\n      const collection = new ctor({\n        ai: this.context.ai,\n        db: this.context.db,\n      });\n      // Await initialize() so the auto-discovered collection is actually usable\n      // (its DB is wired). Without this, list()/get() throw \"Database accessed\n      // before initialization\" — a latent bug that was masked while the\n      // generated client's plural URLs never matched the singular-only\n      // auto-discovery segment (#1794). The explicit-registerCollection() path\n      // receives an already-initialized collection from the caller, so this\n      // only affects the auto-discovery factory.\n      await collection.initialize();\n      this.collections.set(classInfo.name, collection);\n    }\n    const collection = this.collections.get(classInfo.name);\n    if (!collection) throw new Error(`Collection ${classInfo.name} not found`);\n    return collection;\n  }\n\n  /**\n   * Mass-assignment guard (#1540): strip framework/server-managed and\n   * `@field({ readonly: true })` fields from a create/update body, and — when an\n   * `@smrt({ api: { writable: [...] } })` allowlist is set — intersect with it.\n   */\n  private applyWritablePolicy(\n    objectName: string | undefined,\n    data: unknown,\n  ): Record<string, unknown> {\n    if (!data || typeof data !== 'object') {\n      return {};\n    }\n\n    const serverManaged = new Set([\n      'id',\n      'tenantId',\n      'tenant_id',\n      'createdAt',\n      'created_at',\n      'updatedAt',\n      'updated_at',\n    ]);\n\n    const readonly = new Set<string>();\n    let writable: string[] | null = null;\n\n    if (objectName) {\n      const apiConfig = ObjectRegistry.getConfig(objectName)?.api;\n      if (\n        apiConfig &&\n        typeof apiConfig === 'object' &&\n        Array.isArray((apiConfig as { writable?: unknown }).writable)\n      ) {\n        writable = (apiConfig as { writable: string[] }).writable;\n      }\n\n      for (const [name, def] of ObjectRegistry.getFields(objectName)) {\n        if (def && (def.readonly === true || def._meta?.readonly === true)) {\n          readonly.add(name);\n        }\n      }\n    }\n\n    const result: Record<string, unknown> = {};\n    for (const [key, value] of Object.entries(data)) {\n      if (key.startsWith('_')) continue;\n      if (serverManaged.has(key)) continue;\n      if (readonly.has(key)) continue;\n      if (writable && !writable.includes(key)) continue;\n      result[key] = value;\n    }\n    return result;\n  }\n\n  /**\n   * Serialize a SmrtObject for a network response, excluding sensitive fields\n   * (#1540). Falls back to the value unchanged for non-SmrtObject payloads.\n   */\n  private toPublicData(object: unknown): unknown {\n    const serializable = object as {\n      toPublicJSON?: (options?: PublicJsonOptions) => unknown;\n    } | null;\n    return typeof serializable?.toPublicJSON === 'function'\n      ? serializable.toPublicJSON(this.getPublicJsonOptions())\n      : object;\n  }\n\n  private getPublicJsonOptions(): PublicJsonOptions {\n    return { permissions: this.context.permissions };\n  }\n\n  /**\n   * Resolve the Cache-Control policy for a generated read and fire the\n   * one-time policy warnings (#1757): private + revalidatable by default;\n   * shared `s-maxage` only for public models that opt in; always private for\n   * tenant-scoped models, whose bodies vary with tenant context that URL-keyed\n   * shared caches cannot see. Field read-permission models are also private\n   * because the body varies by caller permissions.\n   */\n  private resolveReadCachePolicy(objectName: string | undefined): string {\n    const config = objectName\n      ? ObjectRegistry.getConfig(objectName)\n      : undefined;\n    const apiConfig = config?.api;\n    // Canonical accessor covers both `@smrt({ tenantScoped })` and the\n    // manifest-merged `@TenantScoped()` decorator form; the raw config flag is\n    // a belt-and-braces fallback for registrations not yet normalized.\n    const tenantScoped = objectName\n      ? ObjectRegistry.isTenantScoped(objectName) || !!config?.tenantScoped\n      : false;\n    const permissionScoped = this.hasReadPermissionFields(objectName);\n    if (objectName) {\n      warnIfSharedCacheNeutralized(\n        objectName,\n        apiConfig,\n        tenantScoped,\n        permissionScoped,\n      );\n      warnIfTenantScopedPublicRead(objectName, apiConfig, tenantScoped);\n    }\n    return resolveReadCacheControl(apiConfig, {\n      tenantScoped,\n      permissionScoped,\n    });\n  }\n\n  private hasReadPermissionFields(objectName: string | undefined): boolean {\n    if (!objectName) return false;\n    for (const fields of this.getFieldMapsForPublicPolicy(objectName)) {\n      for (const [, def] of fields) {\n        if (\n          typeof def?.readPermission === 'string' ||\n          typeof def?._meta?.readPermission === 'string'\n        ) {\n          return true;\n        }\n      }\n    }\n    return false;\n  }\n\n  private getFieldMapsForPublicPolicy(\n    objectName: string,\n  ): Array<ReturnType<typeof ObjectRegistry.getFields>> {\n    const registered = ObjectRegistry.getClass(objectName);\n    const className =\n      registered?.qualifiedName ?? registered?.name ?? objectName;\n    const fieldMaps: Array<ReturnType<typeof ObjectRegistry.getFields>> = [\n      registered?.inheritedFields || ObjectRegistry.getFields(className),\n    ];\n    const stiBase = ObjectRegistry.getSTIBase(className);\n    if (stiBase) {\n      fieldMaps.push(\n        ObjectRegistry.getClass(stiBase)?.inheritedFields ||\n          ObjectRegistry.getFields(stiBase),\n      );\n      for (const descendant of ObjectRegistry.getDescendants(stiBase)) {\n        fieldMaps.push(\n          ObjectRegistry.getClass(descendant)?.inheritedFields ||\n            ObjectRegistry.getFields(descendant),\n        );\n      }\n    }\n    return fieldMaps;\n  }\n\n  /**\n   * Compute the ETag v2 (#1765) for a generated read: the table's change-feed\n   * version ({@link getTableVersion}) keyed by the request representation, so a\n   * matching `If-None-Match` can short-circuit into a 304 BEFORE the collection\n   * query runs. The representation folds in the active tenant for tenant-scoped\n   * models so one tenant's cached ETag never satisfies another's read. When an\n   * web-collection manifest hash is folded into the digest (#1764), so a\n   * shape-only deploy busts every read validator. An explicit\n   * `APIConfig.manifestHash` wins; otherwise the hash is computed from the\n   * runtime registry on first use (#1862).\n   */\n  private async computeReadEtag(\n    collection: SmrtCollection<SmrtObject>,\n    req: Request,\n    objectName: string | undefined,\n  ): Promise<string> {\n    const version = await getTableVersion(collection.db, collection.tableName);\n    const representation = canonicalReadRepresentation(\n      req,\n      this.readTenantDiscriminator(objectName),\n    );\n    // Salt the ETag with the web-collection shape digest (#1764) so a\n    // shape-only deploy busts every read validator. Runtime APIGenerator\n    // deployments compute the hash from ObjectRegistry when no explicit override\n    // is configured (#1862).\n    return computeTableVersionEtag(\n      version,\n      representation,\n      this.resolveManifestHash(),\n    );\n  }\n\n  private resolveManifestHash(): string {\n    if (this.config.manifestHash !== undefined) {\n      return this.config.manifestHash;\n    }\n    this.runtimeManifestHash ??= computeRuntimeWebManifestHash();\n    return this.runtimeManifestHash;\n  }\n\n  /**\n   * A per-tenant ETag discriminator for tenant-scoped models: the active tenant\n   * id (or `global`) so tenant A's cached ETag never satisfies tenant B's read\n   * of the same table and params. `undefined` for non-tenant-scoped models,\n   * whose bodies do not vary by tenant.\n   */\n  private readTenantDiscriminator(objectName?: string): string | undefined {\n    if (!objectName) return undefined;\n    const tenantScoped =\n      ObjectRegistry.isTenantScoped(objectName) ||\n      !!ObjectRegistry.getConfig(objectName)?.tenantScoped ||\n      isTenantScopedClassResolved(objectName);\n    if (!tenantScoped) return undefined;\n    // Shared with the generated SvelteKit route so both transports key the ETag\n    // on the active tenant identically (cross-tenant false-304 guard).\n    return resolveTenantEtagDiscriminator();\n  }\n\n  /**\n   * Create JSON response with proper headers\n   */\n  private createJsonResponse(data: unknown, status = 200): Response {\n    return new Response(JSON.stringify(data), {\n      status,\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  }\n\n  /**\n   * Create error response\n   */\n  private createErrorResponse(status: number, message: string): Response {\n    return new Response(JSON.stringify({ error: message }), {\n      status,\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  }\n\n  /**\n   * Resolve the allowed `Access-Control-Allow-Origin` for a request (#1540).\n   * Returns the request's `Origin` only when it is in the configured allowlist;\n   * never `*`. Returns null when CORS should not be applied.\n   */\n  private resolveAllowedOrigin(req: Request): string | null {\n    if (!this.config.enableCors) return null;\n    const allowed = this.config.allowedOrigins;\n    if (!allowed || allowed.length === 0) return null;\n    const origin = req.headers.get('origin');\n    return origin && allowed.includes(origin) ? origin : null;\n  }\n\n  /**\n   * Whether to emit `Access-Control-Allow-Credentials: true` (#1861). Only when\n   * explicitly opted in AND an origin actually resolved — credentials are never\n   * paired with a wildcard/absent origin (`resolveAllowedOrigin` already never\n   * returns `*`).\n   */\n  private shouldAllowCredentials(): boolean {\n    return this.config.allowCredentials === true;\n  }\n\n  /**\n   * Create CORS preflight response\n   */\n  private createCorsResponse(req: Request): Response {\n    const headers: Record<string, string> = {\n      'Access-Control-Allow-Methods': 'GET,POST,PUT,PATCH,DELETE,OPTIONS',\n      // `Last-Event-ID` is allow-listed for the `_events` SSE route (#1861): a\n      // fetch-based cross-origin SSE client that resumes from a cursor sends it\n      // as a request header, which is not CORS-safelisted and would otherwise\n      // fail preflight. Harmless on the other routes, which ignore it.\n      'Access-Control-Allow-Headers':\n        'Content-Type,Authorization,Last-Event-ID',\n      'Access-Control-Max-Age': '86400',\n    };\n    const origin = this.resolveAllowedOrigin(req);\n    if (origin) {\n      headers['Access-Control-Allow-Origin'] = origin;\n      headers.Vary = 'Origin';\n      if (this.shouldAllowCredentials()) {\n        headers['Access-Control-Allow-Credentials'] = 'true';\n      }\n    }\n    return new Response(null, { status: 200, headers });\n  }\n\n  /**\n   * Add CORS headers to response\n   */\n  private addCorsHeaders(response: Response, req: Request): Response {\n    const origin = this.resolveAllowedOrigin(req);\n    if (!origin) return response;\n\n    const headers = new Headers(response.headers);\n    headers.set('Access-Control-Allow-Origin', origin);\n    headers.set('Vary', 'Origin');\n    headers.set(\n      'Access-Control-Allow-Methods',\n      'GET,POST,PUT,PATCH,DELETE,OPTIONS',\n    );\n    // `Last-Event-ID` so a fetch-based cross-origin SSE client can resume the\n    // `_events` stream from a cursor (#1861); see createCorsResponse.\n    headers.set(\n      'Access-Control-Allow-Headers',\n      'Content-Type,Authorization,Last-Event-ID',\n    );\n    // Credentialed CORS (#1861): only when opted in, and only alongside a\n    // concrete echoed origin (never `*`) so cookies can flow to an allow-listed\n    // cross-origin client (e.g. a credentialed EventSource on `_events`).\n    if (this.shouldAllowCredentials()) {\n      headers.set('Access-Control-Allow-Credentials', 'true');\n    }\n\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n\n  /**\n   * Resolve a URL/collection segment to a registered class via auto-discovery.\n   *\n   * The segment IS the canonical `collection` value from the manifest\n   * (`RegisteredClass.collection`, e.g. `products` for `Product`) — the same\n   * value the generated client, the SvelteKit route generator, and the registry\n   * all derive. Match it VERBATIM; do not re-pluralize. The previous\n   * implementation pluralized both the URL segment and the class name and\n   * compared them, turning an already-plural client URL (`/products`) into\n   * `productses`, so the generated client 404'd against auto-discovered routes\n   * (#1794). Shared by the CRUD path and the `sync/apply` batch path so they can\n   * never drift.\n   *\n   * @param segment - The URL/collection path segment (e.g. `products`).\n   * @returns The matching registered class, or null if none matches.\n   */\n  private findClassByCollectionSegment(\n    segment: string,\n  ): RegisteredClass | null {\n    for (const [key, info] of ObjectRegistry.getAllClasses()) {\n      // Primary match: the canonical manifest `collection` segment.\n      if (info.collection === segment) {\n        return info;\n      }\n      // Back-compat fallback for classes registered without a `collection`\n      // (inline/test stubs): derive the plural segment from the simple name and\n      // compare to the raw URL segment. Issue #951: use the simple name\n      // (info.name), not the qualified map key.\n      if (\n        !info.collection &&\n        this.pluralize((info.name || key).toLowerCase()) === segment\n      ) {\n        return info;\n      }\n    }\n    return null;\n  }\n\n  /**\n   * Simple pluralization (basic implementation)\n   */\n  private pluralize(word: string): string {\n    if (word.endsWith('y')) {\n      return `${word.slice(0, -1)}ies`;\n    }\n    if (word.endsWith('s') || word.endsWith('sh') || word.endsWith('ch')) {\n      return `${word}es`;\n    }\n    return `${word}s`;\n  }\n}\n\n// REST Server Utilities\n\nexport interface RestServerConfig extends APIConfig {\n  healthCheck?: {\n    enabled?: boolean;\n    path?: string;\n    customChecks?: (() => Promise<boolean>)[];\n  };\n}\n\n/**\n * Create REST server with health checks using Bun\n */\nexport function createRestServer(\n  objects: (typeof SmrtObject)[],\n  context: APIContext = {},\n  config: RestServerConfig = {},\n): { server: http.Server; url: string } {\n  // Register objects if not already registered\n  objects.forEach((obj) => {\n    if (!ObjectRegistry.hasClass(obj.name)) {\n      console.warn(`Object ${obj.name} not registered with @smrt decorator`);\n    }\n  });\n\n  const generator = new APIGenerator(config, context);\n  const { server, url } = generator.createServer();\n\n  console.log(`🚀 smrt REST API server running at ${url}`);\n\n  return { server, url };\n}\n\n/**\n * Start server with graceful shutdown\n */\nexport function startRestServer(\n  objects: (typeof SmrtObject)[],\n  context: APIContext = {},\n  config: RestServerConfig = {},\n): Promise<() => Promise<void>> {\n  return new Promise((resolve) => {\n    const { server, url } = createRestServer(objects, context, config);\n\n    // Graceful shutdown function\n    const shutdown = (): Promise<void> => {\n      return new Promise((shutdownResolve) => {\n        console.log('🛑 Shutting down server gracefully...');\n        // Node's http.Server#close stops accepting new connections and invokes\n        // the callback once in-flight ones drain. (The prior `.stop()` was a\n        // Bun-era API absent on http.Server — it would have thrown.)\n        server.close(() => {\n          console.log('✅ Server shut down complete');\n          shutdownResolve();\n        });\n      });\n    };\n\n    // Handle shutdown signals\n    process.on('SIGTERM', shutdown);\n    process.on('SIGINT', shutdown);\n\n    resolve(shutdown);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAmHA,SAAS,2BACP,QACiC;CACjC,MAAM,SAA0C,CAAC;CACjD,KAAK,MAAM,CAAC,MAAM,UAAU,QAAQ;EAClC,IAAI,CAAC,SAAS,OAAO,MAAM,SAAS,UAAU;EAC9C,MAAM,eACJ,MAAM,YAAY,KAAA,IAAY,MAAM,UAAU,MAAM,OAAO;EAC7D,OAAO,QAAQ;GACb,MAAM,MAAM;GACZ,GAAI,MAAM,aAAa,KAAA,IAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;GACnE,GAAI,iBAAiB,KAAA,IAAY,EAAE,SAAS,aAAa,IAAI,CAAC;GAC9D,GAAI,MAAM,YAAY,KAAA,IAAY,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;GAChE,GAAI,MAAM,cAAc,KAAA,IAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;GACtE,GAAI,MAAM,cAAc,KAAA,IAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;GACtE,GAAI,MAAM,aAAa,KAAA,IAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;GACnE,GAAI,MAAM,mBAAmB,KAAA,IACzB,EAAE,gBAAgB,MAAM,eAAe,IACvC,CAAC;GACL,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5D;CACF;CACA,OAAO;AACT;AAEA,SAAS,4BACP,SACkC;CAClC,OAAO,OAAO,YAAY,WAAW,CAAC,CAAC;AACzC;AAEA,SAAS,+BAA+B,WAA2B;CACjE,MAAM,QAAQ,UAAU,YAAY;CACpC,IAAI,MAAM,SAAS,GAAG,GAAG,OAAO,GAAG,MAAM,MAAM,GAAG,EAAE,EAAE;CACtD,IAAI,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,GAClE,OAAO,GAAG,MAAM;CAElB,IAAI,MAAM,SAAS,IAAI,KAAK,MAAM,SAAS,IAAI,GAAG,OAAO,GAAG,MAAM;CAClE,OAAO,GAAG,MAAM;AAClB;AAEA,SAAS,wBACP,KACA,MACuB;CACvB,MAAM,YAAY,KAAK,QAAQ;CAC/B,OAAO;EACL;EACA,MAAM,UAAU,YAAY;EAC5B,YAAY,KAAK,cAAc,+BAA+B,SAAS;EACvE,UAAU,KAAK,kBAAkB;EACjC,QAAQ,2BAA2B,KAAK,mBAAmB,KAAK,MAAM;EACtE,SAAS,4BAA4B,KAAK,oBAAoB,KAAK,OAAO;EAC1E,iBAAiB,KAAK,UAAU,CAAC;EACjC,GAAI,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;EAClE,GAAI,KAAK,cAAc,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;EAC5D,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;EACzD,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;EAChD,GAAI,KAAK,iBAAiB,EAAE,gBAAgB,KAAK,eAAe,IAAI,CAAC;EACrE,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;CAC5C;AACF;;;;;;AAOA,SAAgB,8BACd,UAA+C,eAAe,cAAc,GACpE;CACR,MAAM,UAA0C,CAAC;CACjD,MAAM,uBAAO,IAAI,IAAqB;CACtC,KAAK,MAAM,CAAC,KAAK,SAAS,SAAS;EACjC,IAAI,KAAK,IAAI,IAAI,GAAG;EACpB,KAAK,IAAI,IAAI;EACb,MAAM,cAAc,KAAK,iBAAiB;EAC1C,QAAQ,eAAe,wBAAwB,KAAK,IAAI;CAC1D;CACA,OAAO,uBAAuB;EAC5B,SAAS;EACT,WAAW;EACX;CACF,CAAC;AACH;;;;AAKA,IAAa,eAAb,MAA0B;CACxB;CACA,8BAAsB,IAAI,IAAwC;CAClE;CACA;CAEA,YAAY,SAAoB,CAAC,GAAG,UAAsB,CAAC,GAAG;EAC5D,KAAK,SAAS;GACZ,UAAU;GAGV,YAAY;GACZ,MAAM;GACN,UAAU;GACV,GAAG;EACL;EACA,KAAK,UAAU;CACjB;;;;;;;CAQA,mBACE,MACA,YACM;EACN,KAAK,YAAY,IAAI,MAAM,UAAU;EACrC,KAAK,sBAAsB,KAAA;CAC7B;;;;;;;;;;;CAYA,mBAAoC;EAClC,OACE,KAAK,QAAQ,MAAM,KAAK,YAAY,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,MAAM,KAAA;CAErE;;;;CAKA,eAAqD;EACnD,MAAM,SAAS,KAAK,aAAa,OAAO,KAAK,QAAQ;GACnD,IAAI;IACF,MAAM,UAAU,MAAM,KAAK,wBAAwB,GAAG;IACtD,MAAM,WAAW,MAAM,KAAK,cAAc,OAAO;IACjD,MAAM,KAAK,0BAA0B,UAAU,GAAG;GACpD,SAAS,QAAQ;IACf,IAAI,aAAa;IACjB,IAAI,IAAI,uBAAuB;GACjC;EACF,CAAC;EAED,OAAO,OAAO,KAAK,OAAO,MAAM,KAAK,OAAO,QAAQ;EAEpD,OAAO;GACL;GACA,KAAK,UAAU,KAAK,OAAO,SAAS,GAAG,KAAK,OAAO;EACrD;CACF;;;;CAKA,MAAc,eAAe,QAA+C;EAC1E,MAAM,SAAmB,CAAC;EAC1B,WAAW,MAAM,SAAS,QACxB,OAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;EAEjE,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,OAAO;CAC/C;;;;CAKA,MAAc,wBACZ,KACkB;EAClB,MAAM,MAAM,UAAU,KAAK,OAAO,SAAS,GAAG,KAAK,OAAO,OAAO,IAAI;EACrE,MAAM,SAAS,IAAI,UAAU;EAC7B,MAAM,UAAU,IAAI,QAAQ;EAE5B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,OAAO,GACnD,IAAI,OACF,QAAQ,IAAI,KAAK,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,KAAK;EAI5D,IAAI;EACJ,IAAI,WAAW,SAAS,WAAW,QACjC,OAAO,MAAM,KAAK,eAAe,GAAG;EAGtC,OAAO,IAAI,QAAQ,KAAK;GACtB;GACA;GACA;EACF,CAAC;CACH;;;;CAKA,MAAc,0BACZ,aACA,KACe;EACf,IAAI,aAAa,YAAY;EAG7B,YAAY,QAAQ,SAAS,OAAO,QAAQ;GAC1C,IAAI,UAAU,KAAK,KAAK;EAC1B,CAAC;EAGD,IAAI,YAAY,MAAM;GACpB,MAAM,SAAS,YAAY,KAAK,UAAU;GAO1C,IAAI,aAAa;GACjB,MAAM,gBAAgB;IACpB,IAAI,IAAI,kBAAkB;IAC1B,aAAa;IACb,OAAY,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC;GACrC;GACA,IAAI,GAAG,SAAS,OAAO;GAEvB,IAAI;IACF,OAAO,MAAM;KACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;KAC1C,IAAI,QAAQ,YAAY;KACxB,IAAI,CAAC,IAAI,MAAM,KAAK,GAAG;MAQrB,MAAM,IAAI,SAAe,YAAY;OACnC,MAAM,eAAe;QACnB,IAAI,IAAI,SAAS,MAAM;QACvB,IAAI,IAAI,SAAS,MAAM;QACvB,IAAI,IAAI,SAAS,MAAM;QACvB,QAAQ;OACV;OACA,IAAI,KAAK,SAAS,MAAM;OACxB,IAAI,KAAK,SAAS,MAAM;OACxB,IAAI,KAAK,SAAS,MAAM;MAC1B,CAAC;MACD,IAAI,YAAY;KAClB;IACF;GACF,QAAQ,CAER,UAAU;IACR,IAAI,IAAI,SAAS,OAAO;GAC1B;EACF;EAEA,IAAI,CAAC,IAAI,eACP,IAAI,IAAI;CAEZ;;;;CAKA,kBAAuD;EACrD,QAAQ,QAAQ,KAAK,cAAc,GAAG;CACxC;;;;CAKA,MAAc,cAAc,KAAiC;EAC3D,MAAM,MAAM,IAAI,IAAI,IAAI,GAAG;EAG3B,IAAI,IAAI,WAAW,aAAa,KAAK,OAAO,YAC1C,OAAO,KAAK,mBAAmB,GAAG;EAIpC,IAAI,KAAK,OAAO;QACT,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,KAAK,OAAO,YAAY,GACnE,IAAI,IAAI,aAAa,GAAG,KAAK,OAAO,WAAW,QAAQ;IACrD,MAAM,WAAW,MAAM,QAAQ,GAAG;IAClC,OAAO,KAAK,eAAe,UAAU,GAAG;GAC1C;;EAMJ,IAAI,IAAI,aAAa,GAAG,KAAK,OAAO,SAAS,YAAY;GACvD,MAAM,WAAW,MAAM,mBAAmB,KAAK;IAC7C,gBAAgB,KAAK,OAAO;IAC5B,IAAI,KAAK,iBAAiB;GAC5B,CAAC;GACD,OAAO,KAAK,eAAe,UAAU,GAAG;EAC1C;EAWA,IAAI,IAAI,aAAa,GAAG,KAAK,OAAO,SAAS,WAAW;GACtD,MAAM,WAAW,MAAM,kBAAkB,KAAK;IAC5C,gBAAgB,KAAK,OAAO;IAC5B,IAAI,KAAK,iBAAiB;IAC1B,cAAc,KAAK,oBAAoB;IACvC,gBAAgB,KAAK,OAAO,aAAa;GAC3C,CAAC;GACD,OAAO,KAAK,eAAe,UAAU,GAAG;EAC1C;EAGA,IAAI,IAAI,SAAS,WAAW,KAAK,OAAO,YAAY,EAAE,GAAG;GACvD,MAAM,WAAW,MAAM,KAAK,kBAAkB,KAAK,GAAG;GACtD,OAAO,KAAK,eAAe,UAAU,GAAG;EAC1C;EAGA,OAAO,KAAK,oBAAoB,KAAK,WAAW;CAClD;;;;CAKA,MAAc,kBAAkB,KAAc,KAA6B;EACzE,MAAM,YAAY,IAAI,SACnB,QAAQ,KAAK,OAAO,YAAY,IAAI,EAAE,CAAC,CACvC,MAAM,GAAG,CAAC,CACV,OAAO,OAAO;EAEjB,IAAI,UAAU,WAAW,GACvB,OAAO,KAAK,oBAAoB,KAAK,sBAAsB;EAI7D,IACE,UAAU,WAAW,0BAA0B,UAC/C,0BAA0B,OAAO,SAAS,MAAM,UAAU,OAAO,OAAO,GACxE;GACA,IAAI,IAAI,WAAW,QACjB,OAAO,KAAK,oBAAoB,KAAK,oBAAoB;GAE3D,OAAO,MAAM,KAAK,gBAAgB,GAAG;EACvC;EAEA,MAAM,aAAa,UAAU;EAC7B,MAAM,WAAW,UAAU;EAG3B,IAAI,KAAK,YAAY,IAAI,UAAU,GAAG;GACpC,MAAM,aAAa,KAAK,YAAY,IAAI,UAAU;GAClD,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,cAAc,WAAW,WAAW;GAErE,MAAM,aAAa,KAAK,wBAAwB,UAAU,KAAK;GAG/D,IAAI,KAAK,OAAO,gBAAgB;IAK9B,MAAM,aAAa,MAJD,KAAK,OAAO,eAC5B,YACA,IAAI,OAAO,YAAY,CAEA,CAAA,CAAU,GAAG;IACtC,IAAI,sBAAsB,UACxB,OAAO;IAGT,MAAM;GACR,OAAO,IAAI,CAAC,KAAK,cAAc,YAAY,IAAI,MAAM,GAGnD,OAAO,KAAK,oBAAoB,KAAK,yBAAyB;GAIhE,OAAO,MAAM,KAAK,qBAChB,KACA,YACA,UACA,KACA,UACF;EACF;EAIA,MAAM,YAAY,KAAK,6BAA6B,UAAU;EAE9D,IAAI,CAAC,WACH,OAAO,KAAK,oBACV,KACA,gBAAgB,WAAW,YAC7B;EAIF,IAAI,KAAK,OAAO,gBAAgB;GAK9B,MAAM,aAAa,MAJD,KAAK,OAAO,eAC5B,UAAU,MACV,IAAI,OAAO,YAAY,CAEA,CAAA,CAAU,GAAG;GACtC,IAAI,sBAAsB,UACxB,OAAO;GAGT,MAAM;EACR,OAAO,IAAI,CAAC,KAAK,cAAc,UAAU,MAAM,IAAI,MAAM,GAEvD,OAAO,KAAK,oBAAoB,KAAK,yBAAyB;EAIhE,MAAM,aAAa,MAAM,KAAK,cAAc,SAAS;EAErD,OAAO,MAAM,KAAK,qBAChB,KACA,YACA,UACA,KACA,UAAU,IACZ;CACF;;;;CAKA,MAAc,qBACZ,KACA,YACA,UACA,KACA,YACmB;EACnB,IAAI;GAIF,IAAI,YAAY,YAAY;IAC1B,MAAM,iBAAiB,MAAM,KAAK,+BAChC,KACA,YACA,UACA,KACA,UACF;IACA,IAAI,gBACF,OAAO;GAEX;GAEA,MAAM,SAAS,KAAK,cAAc,IAAI,QAAQ,QAAQ;GACtD,IAAI,UAAU,CAAC,KAAK,mBAAmB,YAAY,MAAM,GACvD,OAAO,KAAK,oBAAoB,KAAK,oBAAoB;GAI3D,IAAI,aAAa,WAAW,IAAI,WAAW,OACzC,OAAO,MAAM,KAAK,YAAY,YAAY,IAAI,cAAc,UAAU;GAIxE,QAAQ,IAAI,QAAZ;IACE,KAAK,OACH,OAAO,WACH,MAAM,KAAK,UAAU,YAAY,UAAU,KAAK,UAAU,IAC1D,MAAM,KAAK,WACT,YACA,IAAI,cACJ,KACA,UACF;IAEN,KAAK,QACH,OAAO,MAAM,KAAK,aAAa,YAAY,KAAK,UAAU;IAE5D,KAAK;IACL,KAAK;KACH,IAAI,CAAC,UACH,OAAO,KAAK,oBACV,KACA,+BACF;KAEF,OAAO,MAAM,KAAK,aAAa,YAAY,UAAU,KAAK,UAAU;IAEtE,KAAK;KACH,IAAI,CAAC,UACH,OAAO,KAAK,oBACV,KACA,+BACF;KAEF,OAAO,MAAM,KAAK,aAAa,YAAY,QAAQ;IAErD,SACE,OAAO,KAAK,oBAAoB,KAAK,oBAAoB;GAC7D;EACF,SAAS,OAAO;GACd,QAAQ,MAAM,cAAc,KAAK;GACjC,OAAO,KAAK,oBAAoB,KAAK,uBAAuB;EAC9D;CACF;CAEA,cACE,QACA,UACwD;EACxD,QAAQ,QAAR;GACE,KAAK,OACH,OAAO,YAAY,aAAa,UAAU,QAAQ;GACpD,KAAK,QACH,OAAO;GACT,KAAK;GACL,KAAK,SACH,OAAO;GACT,KAAK,UACH,OAAO;GACT,SACE,OAAO;EACX;CACF;;;;;;;;CASA,cACE,YACA,QACS;EACT,IAAI,CAAC,YAAY,OAAO;EACxB,MAAM,YAAY,eAAe,UAAU,UAAU,CAAC,EAAE;EACxD,IAAI,CAAC,aAAa,OAAO,cAAc,UAAU,OAAO;EACxD,MAAM,eAAgB,UAA4C;EAClE,IAAI,iBAAiB,MAAM,OAAO;EAClC,IAAI,iBAAiB,QAAQ,OAAO,OAAO,YAAY,MAAM;EAC7D,OAAO;CACT;CAEA,mBACE,YACA,QACS;EACT,IAAI,CAAC,YACH,OAAO;EAIT,MAAM,YADS,eAAe,UAAU,UACtB,CAAA,CAAO;EAEzB,IAAI,cAAc,OAChB,OAAO;EAGT,IAAI,aAAa,OAAO,cAAc,UAAU;GAC9C,IAAI,UAAU,WAAW,CAAC,UAAU,QAAQ,SAAS,MAAM,GACzD,OAAO;GAGT,IAAI,UAAU,SAAS,SAAS,MAAM,GACpC,OAAO;EAEX;EAEA,OAAO;CACT;CAEA,wBACE,YACoB;EAIpB,MAAM,YACH,WACE,cAED,WAAW,aAGV;EAEL,IAAI,CAAC,WACH;EAGF,MAAM,aAAa,eAAe,sBAAsB,SAAS;EACjE,OAAO,YAAY,iBAAiB,YAAY,QAAQ,UAAU;CACpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCA,MAAc,+BACZ,KACA,YACA,aACA,KACA,YAC0B;EAC1B,MAAM,YAAY,eAAe,UAAU,UAAU,CAAC,EAAE;EACxD,IAAI,CAAC,aAAa,OAAO,cAAc,YAAY,CAAC,UAAU,QAC5D,OAAO;EAGT,KAAK,MAAM,CAAC,YAAY,gBAAgB,OAAO,QAC7C,UAAU,MACZ,GAAG;GACD,MAAM,YAAY,aAAa,QAAQ;GACvC,IAAI,UAAU,SAAS,GAAG,KAAK,cAAc,aAC3C;GAEF,MAAM,eAAe,aAAa,UAAU,OAAA,CAAQ,YAAY;GAChE,IAAI,gBAAgB,IAAI,OAAO,YAAY,GACzC;GAIF,IAAI,UAAU,WAAW,CAAC,UAAU,QAAQ,SAAS,UAAU,GAC7D;GAEF,IAAI,UAAU,SAAS,SAAS,UAAU,GACxC;GAKF,MAAM,mBACJ,WACA;GACF,MAAM,kBAAkB,eAAe,SAAS,UAAU,CAAC,EACvD;GACJ,MAAM,eAAe,kBAAkB;GACvC,MAAM,qBAAqB,OAAO,qBAAqB;GAIvD,IAAI,CAAC,sBAAsB,EAFzB,CAAC,sBAAsB,OAAO,iBAAiB,aAEL;IAI1C,IAAI,aAAa,UAAU,cACzB,OAAO,KAAK,oBACV,KACA,kBAAkB,WAAW,kCAC/B;IAEF;GACF;GAEA,MAAM,WAAW,4BAA4B;IAC3C;IACA;IACA,QAAQ,eAAe,WAAW,UAAU,CAAC,EAAE,IAAI,UAAU;IAI7D,cAAc;GAChB,CAAC;GACD,IAAI,SAAS,UAAU,cACrB;GAGF,MAAM,SAAS,sBACV,SACE,iBAAkD,MACjD,YACA,IACF,KACD,SACE,aAA8C,MAC7C,iBACA,IACF;GAMN,IAAI;GACJ,IAAI,gBAAgB,OAClB,UAAU,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC;QAClD;IACL,IAAI,UAAU;IACd,IAAI;KACF,UAAU,MAAM,IAAI,KAAK;IAC3B,QAAQ;KACN,UAAU;IACZ;IACA,IAAI,QAAQ,KAAK,MAAM,IACrB,IAAI;KACF,UAAU,KAAK,MAAM,OAAO;IAC9B,QAAQ;KACN,OAAO,KAAK,oBAAoB,KAAK,mBAAmB;IAC1D;GAEJ;GAkBA,MAAM,SAAS,MAAM,OAXE,SAAS,aAC5B,gCAAgC,UAAU;IACxC,GAAI,WACJ,OAAO,YAAY,YACnB,CAAC,MAAM,QAAQ,OAAO,IACjB,UACD,CAAC;IACL;GACF,CAAC,IACD,CAAC,OAAO,CAE8B;GAE1C,MAAM,UAAU,6BAA6B,MAAM;GACnD,IAAI,SACF,OAAO,KAAK,mBAAmB,EAAE,OAAO,QAAQ,GAAG,QAAQ,MAAM;GAGnE,OAAO,KAAK,mBAAmB;IAC7B,QAAQ;IACR,QAAQ,KAAK,qBAAqB,MAAM;GAC1C,CAAC;EACH;EAEA,OAAO;CACT;;;;;;;;CASA,qBACE,OACA,uBAAwB,IAAI,QAAQ,GAC3B;EACT,IAAI,UAAU,QAAQ,OAAO,UAAU,UACrC,OAAO;EAET,IAAI,KAAK,IAAI,KAAK,GAChB,OAAO;EAET,MAAM,eAAe;EAGrB,IAAI,OAAO,aAAa,iBAAiB,YAAY;GACnD,KAAK,IAAI,KAAK;GACd,OAAO,KAAK,qBACV,aAAa,aAAa,KAAK,qBAAqB,CAAC,GACrD,IACF;EACF;EACA,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,KAAK,IAAI,KAAK;GACd,OAAO,MAAM,KAAK,UAAU,KAAK,qBAAqB,OAAO,IAAI,CAAC;EACpE;EACA,MAAM,QAAQ,OAAO,eAAe,KAAK;EACzC,IAAI,UAAU,OAAO,aAAa,UAAU,MAC1C,OAAO;EAET,KAAK,IAAI,KAAK;EACd,MAAM,MAA+B,CAAC;EACtC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAC7C,IAAI,OAAO,KAAK,qBAAqB,OAAO,IAAI;EAElD,OAAO;CACT;;;;;;;;;;;;;;;;;;;;;;CAuBA,uBACE,YACgC;EAChC,IACE,CAAC,cACD,EACE,eAAe,eAAe,UAAU,KACxC,CAAC,CAAC,eAAe,UAAU,UAAU,CAAC,EAAE,gBACxC,4BAA4B,UAAU,IAGxC;EAEF,MAAM,QAAQ,2BAA2B;EACzC,OAAO,MAAM,YAAY,MAAM,aAAa,OACxC,EAAE,UAAU,KAAK,IACjB,KAAA;CACN;;;;;;;;CASA,qBACE,YACA,OACqC;EAErC,IAAI,CADU,KAAK,uBAAuB,UACrC,GACH,OAAO;EAET,MAAM,UAAmC,CAAC;EAC1C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,CAAC,CAAC,GAAG;GAGtD,MAAM,QAAQ,IAAI,MAAM,KAAK,CAAC,CAAC;GAC/B,IAAI,UAAU,cAAc,UAAU,aACpC;GAEF,QAAQ,OAAO;EACjB;EACA,QAAQ,WAAW;EACnB,OAAO;CACT;;;;CAKA,MAAc,UACZ,YACA,IACA,KACA,YACmB;EACnB,MAAM,eAAe,KAAK,uBAAuB,UAAU;EAE3D,IAAI,KAAK,wBAAwB,UAAU,GAAG;GAI5C,MAAM,QAAQ,KAAK,uBAAuB,UAAU;GACpD,MAAM,SAAS,QACX,MAAM,WAAW,IAAI;IAAE;IAAI,GAAG;GAAM,CAAC,IACrC,MAAM,WAAW,IAAI,EAAE;GAC3B,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;GAEzD,OAAO,wBACL,KACA,KAAK,aAAa,MAAM,GACxB,YACF;EACF;EAQA,MAAM,OAAO,MAAM,KAAK,gBAAgB,YAAY,KAAK,UAAU;EACnE,MAAM,cAAc,IAAI,QAAQ,IAAI,eAAe;EACnD,MAAM,oBACJ,IAAI,SAAS,MAAM;GACjB,QAAQ;GACR,SAAS;IAAE,iBAAiB;IAAc,MAAM;GAAK;EACvD,CAAC;EACH,IAAI,4BAA4B,aAAa,IAAI,GAC/C,OAAO,YAAY;EAKrB,MAAM,QAAQ,KAAK,uBAAuB,UAAU;EACpD,MAAM,SAAS,QACX,MAAM,WAAW,IAAI;GAAE;GAAI,GAAG;EAAM,CAAC,IACrC,MAAM,WAAW,IAAI,EAAE;EAC3B,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;EAGzD,IAAI,qBAAqB,aAAa,IAAI,GACxC,OAAO,YAAY;EAErB,OAAO,IAAI,SAAS,KAAK,UAAU,KAAK,aAAa,MAAM,CAAC,GAAG;GAC7D,QAAQ;GACR,SAAS;IACP,iBAAiB;IACjB,gBAAgB;IAChB,MAAM;GACR;EACF,CAAC;CACH;;;;CAKA,MAAc,WACZ,YACA,QACA,KACA,YACmB;EACnB,MAAM,eAAe,KAAK,uBAAuB,UAAU;EAE3D,MAAM,eAAe,YAAY;GAC/B,MAAM,QAAQ,OAAO,SAAS,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE;GAC7D,MAAM,SAAS,OAAO,SAAS,OAAO,IAAI,QAAQ,KAAK,KAAK,EAAE;GAC9D,MAAM,UAAU,OAAO,IAAI,SAAS,KAAK;GAIzC,MAAM,QAA2C,CAAC;GAClD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GACxC,IAAI,CAAC;IAAC;IAAS;IAAU;GAAS,CAAC,CAAC,SAAS,GAAG,GAAG;IAEjD,MAAM,QAAQ,IAAI,MAAM,gBAAgB;IACxC,IAAI,OAAO;KACT,MAAM,QAAQ,MAAM;KACpB,MAAM,WAAW,MAAM;KAYvB,MAAM,SAAS,GAAG,MAAM,GADJ;MARlB,IAAI;MACJ,KAAK;MACL,IAAI;MACJ,KAAK;MACL,IAAI;MACJ,IAAI;MACJ,MAAM;KAEY,EAAY,aAAa;KAG7C,MAAM,UAAU,aAAa,OAAO,MAAM,MAAM,GAAG,IAAI;IACzD,OACE,MAAM,OAAO;GAEjB;GAKF,MAAM,cAAc,KAAK,qBAAqB,YAAY,KAAK;GAY/D,QAAO,MAVe,WAAW,KAAK;IACpC,OACE,eAAe,OAAO,KAAK,WAAW,CAAC,CAAC,SAAS,IAC7C,cACA,KAAA;IACN;IACA;IACA;GACF,CAAC,EAAA,CAEc,KAAK,WAAuB,KAAK,aAAa,MAAM,CAAC;EACtE;EAEA,IAAI,KAAK,wBAAwB,UAAU,GAGzC,OAAO,wBAAwB,KAAK,MAAM,aAAa,GAAG,YAAY;EAQxE,OAAO,2BAA2B,KAAK,MADpB,KAAK,gBAAgB,YAAY,KAAK,UAAU,GACtB,cAAc,YAAY;CACzE;;;;CAKA,MAAc,YACZ,YACA,QACA,YACmB;EAEnB,MAAM,QAA2C,CAAC;EAClD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GAAG;GAE3C,MAAM,QAAQ,IAAI,MAAM,gBAAgB;GACxC,IAAI,OAAO;IACT,MAAM,QAAQ,MAAM;IACpB,MAAM,WAAW,MAAM;IAYvB,MAAM,SAAS,GAAG,MAAM,GADJ;KARlB,IAAI;KACJ,KAAK;KACL,IAAI;KACJ,KAAK;KACL,IAAI;KACJ,IAAI;KACJ,MAAM;IAEY,EAAY,aAAa;IAG7C,MAAM,UAAU,aAAa,OAAO,MAAM,MAAM,GAAG,IAAI;GACzD,OACE,MAAM,OAAO;EAEjB;EAIA,MAAM,cAAc,KAAK,qBAAqB,YAAY,KAAK;EAE/D,MAAM,QAAQ,MAAM,WAAW,MAAM,EACnC,OACE,eAAe,OAAO,KAAK,WAAW,CAAC,CAAC,SAAS,IAC7C,cACA,KAAA,EACR,CAAC;EAED,OAAO,KAAK,mBAAmB,EAAE,MAAM,CAAC;CAC1C;;;;CAKA,MAAc,aACZ,YACA,KACA,YACmB;EACnB,MAAM,OAAO,KAAK,oBAAoB,YAAY,MAAM,IAAI,KAAK,CAAC;EAClE,MAAM,SAAS,MAAM,WAAW,OAAO;GAAE,GAAG;GAAM,WAAW;EAAK,CAAC;EACnE,MAAM,OAAO,KAAK;EAClB,OAAO,KAAK,mBAAmB,KAAK,aAAa,MAAM,GAAG,GAAG;CAC/D;;;;CAKA,MAAc,aACZ,YACA,IACA,KACA,YACmB;EACnB,MAAM,OAAO,KAAK,oBAAoB,YAAY,MAAM,IAAI,KAAK,CAAC;EAClE,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;EAEtC,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;EAIzD,OAAO,OAAO,QAAQ,IAAI;EAC1B,MAAM,OAAO,KAAK;EAElB,OAAO,KAAK,mBAAmB,KAAK,aAAa,MAAM,CAAC;CAC1D;;;;CAKA,MAAc,aACZ,YACA,IACmB;EACnB,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;EAEtC,IAAI,CAAC,QACH,OAAO,KAAK,oBAAoB,KAAK,kBAAkB;EAGzD,MAAM,OAAO,OAAO;EACpB,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;CAC3C;;;;;;;CAQA,MAAc,gBAAgB,KAAiC;EAK7D,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,IAAI,KAAK;GACzB,OAAO,KAAK,MAAM,OAAO;EAC3B,QAAQ;GACN,OAAO,KAAK,oBAAoB,KAAK,mBAAmB;EAC1D;EAEA,MAAM,UAAU,MAAM,sBAAsB,MAAM,EAChD,gBAAgB,kBACd,KAAK,uBAAuB,eAAe,KAAK,OAAO,EAC3D,CAAC;EACD,OAAO,KAAK,mBAAmB,QAAQ,MAAM,QAAQ,MAAM;CAC7D;;;;;;CAOA,MAAc,uBACZ,eACA,KACA,SACiC;EACjC,IAAI,aAAgD;EACpD,IAAI,aAA4B;EAEhC,MAAM,aAAa,KAAK,YAAY,IAAI,aAAa;EACrD,IAAI,YAAY;GACd,aAAa;GACb,aAAa,KAAK,wBAAwB,UAAU,KAAK;EAC3D,OAAO;GAGL,MAAM,OAAO,KAAK,6BAA6B,aAAa;GAC5D,IAAI,MAAM;IACR,aAAa,MAAM,KAAK,cAAc,IAAI;IAC1C,aAAa,KAAK;GACpB;EACF;EAEA,IAAI,CAAC,cAAc,CAAC,YAClB,OAAO;EAGT,MAAM,eAAe;EAErB,OAAO;GACL,YAAY;GACA;GACZ,cAAc,OACZ,KAAK,mBAAmB,cAAc,EAAE;GAC1C,WAAW,OAAO,OAAoB;IACpC,IAAI,KAAK,OAAO,gBAAgB;KAC9B,MAAM,OACJ,OAAO,WAAW,SAAS,OAAO,WAAW,QAAQ;KAKvD,MAAM,aAAa,MAJD,KAAK,OAAO,eAAe,cAAc,IAIlC,CAAA,CACvB,IAAI,QAAQ,IAAI,KAAK;MACnB,QAAQ,IAAI;MACZ,SAAS,IAAI;MACb,MAAM;KACR,CAAC,CACH;KACA,IAAI,sBAAsB,UACxB,OAAO,WAAW,WAAW,MAAM,kBAAkB;KAEvD,OAAO;IACT;IAGA,OAAO,KAAK,cAAc,cAAc,MAAM,IAC1C,OACA;GACN;GACA,UAAU,YAAY,KAAK,oBAAoB,cAAc,OAAO;EACtE;CACF;;;;CAKA,MAAc,cACZ,WACqC;EACrC,IAAI,CAAC,KAAK,YAAY,IAAI,UAAU,IAAI,GAAG;GAIzC,MAAM,OAAO,UAAU;GAGvB,MAAM,aAAa,IAAI,KAAK;IAC1B,IAAI,KAAK,QAAQ;IACjB,IAAI,KAAK,QAAQ;GACnB,CAAC;GAQD,MAAM,WAAW,WAAW;GAC5B,KAAK,YAAY,IAAI,UAAU,MAAM,UAAU;EACjD;EACA,MAAM,aAAa,KAAK,YAAY,IAAI,UAAU,IAAI;EACtD,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,cAAc,UAAU,KAAK,WAAW;EACzE,OAAO;CACT;;;;;;CAOA,oBACE,YACA,MACyB;EACzB,IAAI,CAAC,QAAQ,OAAO,SAAS,UAC3B,OAAO,CAAC;EAGV,MAAM,gCAAgB,IAAI,IAAI;GAC5B;GACA;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;EAED,MAAM,2BAAW,IAAI,IAAY;EACjC,IAAI,WAA4B;EAEhC,IAAI,YAAY;GACd,MAAM,YAAY,eAAe,UAAU,UAAU,CAAC,EAAE;GACxD,IACE,aACA,OAAO,cAAc,YACrB,MAAM,QAAS,UAAqC,QAAQ,GAE5D,WAAY,UAAqC;GAGnD,KAAK,MAAM,CAAC,MAAM,QAAQ,eAAe,UAAU,UAAU,GAC3D,IAAI,QAAQ,IAAI,aAAa,QAAQ,IAAI,OAAO,aAAa,OAC3D,SAAS,IAAI,IAAI;EAGvB;EAEA,MAAM,SAAkC,CAAC;EACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;GAC/C,IAAI,IAAI,WAAW,GAAG,GAAG;GACzB,IAAI,cAAc,IAAI,GAAG,GAAG;GAC5B,IAAI,SAAS,IAAI,GAAG,GAAG;GACvB,IAAI,YAAY,CAAC,SAAS,SAAS,GAAG,GAAG;GACzC,OAAO,OAAO;EAChB;EACA,OAAO;CACT;;;;;CAMA,aAAqB,QAA0B;EAC7C,MAAM,eAAe;EAGrB,OAAO,OAAO,cAAc,iBAAiB,aACzC,aAAa,aAAa,KAAK,qBAAqB,CAAC,IACrD;CACN;CAEA,uBAAkD;EAChD,OAAO,EAAE,aAAa,KAAK,QAAQ,YAAY;CACjD;;;;;;;;;CAUA,uBAA+B,YAAwC;EACrE,MAAM,SAAS,aACX,eAAe,UAAU,UAAU,IACnC,KAAA;EACJ,MAAM,YAAY,QAAQ;EAI1B,MAAM,eAAe,aACjB,eAAe,eAAe,UAAU,KAAK,CAAC,CAAC,QAAQ,eACvD;EACJ,MAAM,mBAAmB,KAAK,wBAAwB,UAAU;EAChE,IAAI,YAAY;GACd,6BACE,YACA,WACA,cACA,gBACF;GACA,6BAA6B,YAAY,WAAW,YAAY;EAClE;EACA,OAAO,wBAAwB,WAAW;GACxC;GACA;EACF,CAAC;CACH;CAEA,wBAAgC,YAAyC;EACvE,IAAI,CAAC,YAAY,OAAO;EACxB,KAAK,MAAM,UAAU,KAAK,4BAA4B,UAAU,GAC9D,KAAK,MAAM,GAAG,QAAQ,QACpB,IACE,OAAO,KAAK,mBAAmB,YAC/B,OAAO,KAAK,OAAO,mBAAmB,UAEtC,OAAO;EAIb,OAAO;CACT;CAEA,4BACE,YACoD;EACpD,MAAM,aAAa,eAAe,SAAS,UAAU;EACrD,MAAM,YACJ,YAAY,iBAAiB,YAAY,QAAQ;EACnD,MAAM,YAAgE,CACpE,YAAY,mBAAmB,eAAe,UAAU,SAAS,CACnE;EACA,MAAM,UAAU,eAAe,WAAW,SAAS;EACnD,IAAI,SAAS;GACX,UAAU,KACR,eAAe,SAAS,OAAO,CAAC,EAAE,mBAChC,eAAe,UAAU,OAAO,CACpC;GACA,KAAK,MAAM,cAAc,eAAe,eAAe,OAAO,GAC5D,UAAU,KACR,eAAe,SAAS,UAAU,CAAC,EAAE,mBACnC,eAAe,UAAU,UAAU,CACvC;EAEJ;EACA,OAAO;CACT;;;;;;;;;;;;CAaA,MAAc,gBACZ,YACA,KACA,YACiB;EAUjB,OAAO,wBACL,MAVoB,gBAAgB,WAAW,IAAI,WAAW,SAAS,GAClD,4BACrB,KACA,KAAK,wBAAwB,UAAU,CAQvC,GACA,KAAK,oBAAoB,CAC3B;CACF;CAEA,sBAAsC;EACpC,IAAI,KAAK,OAAO,iBAAiB,KAAA,GAC/B,OAAO,KAAK,OAAO;EAErB,KAAK,wBAAwB,8BAA8B;EAC3D,OAAO,KAAK;CACd;;;;;;;CAQA,wBAAgC,YAAyC;EACvE,IAAI,CAAC,YAAY,OAAO,KAAA;EAKxB,IAAI,EAHF,eAAe,eAAe,UAAU,KACxC,CAAC,CAAC,eAAe,UAAU,UAAU,CAAC,EAAE,gBACxC,4BAA4B,UAAU,IACrB,OAAO,KAAA;EAG1B,OAAO,+BAA+B;CACxC;;;;CAKA,mBAA2B,MAAe,SAAS,KAAe;EAChE,OAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;GACxC;GACA,SAAS,EACP,gBAAgB,mBAClB;EACF,CAAC;CACH;;;;CAKA,oBAA4B,QAAgB,SAA2B;EACrE,OAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC,GAAG;GACtD;GACA,SAAS,EACP,gBAAgB,mBAClB;EACF,CAAC;CACH;;;;;;CAOA,qBAA6B,KAA6B;EACxD,IAAI,CAAC,KAAK,OAAO,YAAY,OAAO;EACpC,MAAM,UAAU,KAAK,OAAO;EAC5B,IAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,OAAO;EAC7C,MAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ;EACvC,OAAO,UAAU,QAAQ,SAAS,MAAM,IAAI,SAAS;CACvD;;;;;;;CAQA,yBAA0C;EACxC,OAAO,KAAK,OAAO,qBAAqB;CAC1C;;;;CAKA,mBAA2B,KAAwB;EACjD,MAAM,UAAkC;GACtC,gCAAgC;GAKhC,gCACE;GACF,0BAA0B;EAC5B;EACA,MAAM,SAAS,KAAK,qBAAqB,GAAG;EAC5C,IAAI,QAAQ;GACV,QAAQ,iCAAiC;GACzC,QAAQ,OAAO;GACf,IAAI,KAAK,uBAAuB,GAC9B,QAAQ,sCAAsC;EAElD;EACA,OAAO,IAAI,SAAS,MAAM;GAAE,QAAQ;GAAK;EAAQ,CAAC;CACpD;;;;CAKA,eAAuB,UAAoB,KAAwB;EACjE,MAAM,SAAS,KAAK,qBAAqB,GAAG;EAC5C,IAAI,CAAC,QAAQ,OAAO;EAEpB,MAAM,UAAU,IAAI,QAAQ,SAAS,OAAO;EAC5C,QAAQ,IAAI,+BAA+B,MAAM;EACjD,QAAQ,IAAI,QAAQ,QAAQ;EAC5B,QAAQ,IACN,gCACA,mCACF;EAGA,QAAQ,IACN,gCACA,0CACF;EAIA,IAAI,KAAK,uBAAuB,GAC9B,QAAQ,IAAI,oCAAoC,MAAM;EAGxD,OAAO,IAAI,SAAS,SAAS,MAAM;GACjC,QAAQ,SAAS;GACjB,YAAY,SAAS;GACrB;EACF,CAAC;CACH;;;;;;;;;;;;;;;;;CAkBA,6BACE,SACwB;EACxB,KAAK,MAAM,CAAC,KAAK,SAAS,eAAe,cAAc,GAAG;GAExD,IAAI,KAAK,eAAe,SACtB,OAAO;GAMT,IACE,CAAC,KAAK,cACN,KAAK,WAAW,KAAK,QAAQ,IAAA,CAAK,YAAY,CAAC,MAAM,SAErD,OAAO;EAEX;EACA,OAAO;CACT;;;;CAKA,UAAkB,MAAsB;EACtC,IAAI,KAAK,SAAS,GAAG,GACnB,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,EAAE;EAE9B,IAAI,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,GACjE,OAAO,GAAG,KAAK;EAEjB,OAAO,GAAG,KAAK;CACjB;AACF;;;;AAeA,SAAgB,iBACd,SACA,UAAsB,CAAC,GACvB,SAA2B,CAAC,GACU;CAEtC,QAAQ,SAAS,QAAQ;EACvB,IAAI,CAAC,eAAe,SAAS,IAAI,IAAI,GACnC,QAAQ,KAAK,UAAU,IAAI,KAAK,qCAAqC;CAEzE,CAAC;CAGD,MAAM,EAAE,QAAQ,QAAQ,IADF,aAAa,QAAQ,OACnB,CAAA,CAAU,aAAa;CAE/C,QAAQ,IAAI,sCAAsC,KAAK;CAEvD,OAAO;EAAE;EAAQ;CAAI;AACvB;;;;AAKA,SAAgB,gBACd,SACA,UAAsB,CAAC,GACvB,SAA2B,CAAC,GACE;CAC9B,OAAO,IAAI,SAAS,YAAY;EAC9B,MAAM,EAAE,QAAQ,QAAQ,iBAAiB,SAAS,SAAS,MAAM;EAGjE,MAAM,iBAAgC;GACpC,OAAO,IAAI,SAAS,oBAAoB;IACtC,QAAQ,IAAI,uCAAuC;IAInD,OAAO,YAAY;KACjB,QAAQ,IAAI,6BAA6B;KACzC,gBAAgB;IAClB,CAAC;GACH,CAAC;EACH;EAGA,QAAQ,GAAG,WAAW,QAAQ;EAC9B,QAAQ,GAAG,UAAU,QAAQ;EAE7B,QAAQ,QAAQ;CAClB,CAAC;AACH"}

package/dist/manifest/static-manifest.js

@@ -3,7 +3,7 @@ var staticManifest = {
 	"version": "1.0.0",
 	"timestamp": 0,
 	"packageName": "@happyvertical/smrt-core",
-	"packageVersion": "0.40.56",
+	"packageVersion": "0.40.58",
 	"objects": {
 		"@happyvertical/smrt-core:SmrtClass": {
 			"name": "smrtclass",