@happyvertical/smrt-core 0.45.2 → 0.46.0

package/dist/generators/tenant-gate.d.ts

@@ -1,13 +1,26 @@
 /**
- * Tenant entry-point gate — dependency-inversion hook for generated CLI/MCP
+ * Tenant entry-point gate — dependency-inversion hook for generated in-process
  * execution (#1554).
  *
  * `@happyvertical/smrt-core` cannot depend on `@happyvertical/smrt-tenancy`
  * (tenancy depends on core, not the other way around). The generated SvelteKit
- * routes establish tenant context from the request principal, but the in-process
- * CLI/MCP generators have no principal — without a gate a tenant-scoped read
- * with no active context would fall through the interceptor's optional-mode
- * pass-through and return rows across **all** tenants.
+ * routes establish tenant context from the request principal, but an in-process
+ * generator with no principal of its own needs the same fail-closed guarantee —
+ * without a gate a tenant-scoped read with no active context would fall
+ * through the interceptor's optional-mode pass-through and return rows across
+ * **all** tenants.
+ *
+ * `MCPGenerator` (`generators/mcp.ts`) is the ONLY in-repo caller of
+ * {@link runWithTenantGate} today, passing `surface: 'MCP'`. Core's
+ * `CLIGenerator`, which used to call this with `surface: 'CLI'` and the
+ * `--tenant`/`--all-tenants` flags documented on {@link TenantGateOptions}
+ * below, was retired as unused public API (#2664). The live local CLI
+ * transport (`packages/cli/src/cli-generator.ts`, the shipped `smrt
+ * <object>:<action>` binary) has never called this gate and has no
+ * `--tenant`/`--all-tenants` flags of its own — it is NOT tenant-isolation
+ * fail-closed today. Do not read this module as evidence that it is; see
+ * `packages/tenancy/src/__tests__/cli-mcp-tenant-context.spec.ts` for the
+ * MCP-only coverage this leaves in place.
  *
  * Core exposes an injectable runner slot that tenancy fills at `enableTenancy()`
  * time (the same inversion pattern as the DispatchBus tenant resolver and
@@ -29,11 +42,21 @@ export interface TenantGateOptions {
     className?: string;
     /** Explicit tenant-scoping decision; overrides `className` resolution. */
     tenantScoped?: boolean;
-    /** Explicit operator-provided tenant selector (`--tenant` / `context.tenantId`). */
+    /**
+     * Explicit operator-provided tenant selector (`context.tenantId` for
+     * MCPGenerator, today's only caller; core's retired `CLIGenerator` used to
+     * pass this from a `--tenant` flag the shipped local CLI does not have,
+     * #2664).
+     */
     tenantId?: string | null;
-    /** Explicit operator opt-in to cross-tenant/system access (`--all-tenants`). */
+    /**
+     * Explicit operator opt-in to cross-tenant/system access
+     * (`context.allowCrossTenant` for MCPGenerator; core's retired
+     * `CLIGenerator` used to pass this from a `--all-tenants` flag the shipped
+     * local CLI does not have, #2664).
+     */
     allowCrossTenant?: boolean;
-    /** Surface name for the fail-closed error message, e.g. `'CLI'` / `'MCP'`. */
+    /** Surface name for the fail-closed error message, e.g. `'MCP'`. */
     surface?: string;
 }
 /**
@@ -46,7 +69,8 @@ declare global {
     var __smrtTenantEntryPointRunner: TenantEntryPointRunner | undefined;
 }
 /**
- * Register the tenant entry-point runner used by generated CLI/MCP execution.
+ * Register the tenant entry-point runner used by generated in-process
+ * execution (`MCPGenerator` today; see the module docblock above).
  *
  * Called by `@happyvertical/smrt-tenancy`'s `enableTenancy()`; application code
  * never calls this directly. Passing `undefined` clears the runner (restoring

package/dist/generators/tenant-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-gate.d.ts","sourceRoot":"","sources":["../../src/generators/tenant-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,EACrC,OAAO,EAAE,iBAAiB,EAC1B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KACjB,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,OAAO,CAAC,MAAM,CAAC;IAEb,IAAI,4BAA4B,EAAE,sBAAsB,GAAG,SAAS,CAAC;CACtE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACzC,IAAI,CAEN;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,iBAAiB,EAC1B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAOZ"}
+{"version":3,"file":"tenant-gate.d.ts","sourceRoot":"","sources":["../../src/generators/tenant-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,EACrC,OAAO,EAAE,iBAAiB,EAC1B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KACjB,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,OAAO,CAAC,MAAM,CAAC;IAEb,IAAI,4BAA4B,EAAE,sBAAsB,GAAG,SAAS,CAAC;CACtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACzC,IAAI,CAEN;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,iBAAiB,EAC1B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAOZ"}

package/dist/generators/tenant-gate.js

@@ -1,6 +1,7 @@
 //#region src/generators/tenant-gate.ts
 /**
-* Register the tenant entry-point runner used by generated CLI/MCP execution.
+* Register the tenant entry-point runner used by generated in-process
+* execution (`MCPGenerator` today; see the module docblock above).
 *
 * Called by `@happyvertical/smrt-tenancy`'s `enableTenancy()`; application code
 * never calls this directly. Passing `undefined` clears the runner (restoring

package/dist/generators/tenant-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-gate.js","names":[],"sources":["../../src/generators/tenant-gate.ts"],"sourcesContent":["/**\n * Tenant entry-point gate — dependency-inversion hook for generated CLI/MCP\n * execution (#1554).\n *\n * `@happyvertical/smrt-core` cannot depend on `@happyvertical/smrt-tenancy`\n * (tenancy depends on core, not the other way around). The generated SvelteKit\n * routes establish tenant context from the request principal, but the in-process\n * CLI/MCP generators have no principal — without a gate a tenant-scoped read\n * with no active context would fall through the interceptor's optional-mode\n * pass-through and return rows across **all** tenants.\n *\n * Core exposes an injectable runner slot that tenancy fills at `enableTenancy()`\n * time (the same inversion pattern as the DispatchBus tenant resolver and\n * `GlobalInterceptors`). When tenancy is not enabled (non-tenant deployments,\n * existing tests), the slot is empty and {@link runWithTenantGate} simply runs\n * the body — identical to pre-#1554 behavior.\n *\n * Stored on `globalThis` so all module instances share one runner, which\n * matters in the monorepo where the same package can be loaded from multiple\n * paths.\n */\n\n/** Options forwarded to the registered tenancy runner. */\nexport interface TenantGateOptions {\n  /**\n   * Class name of the target model. Tenant-scoping is resolved authoritatively\n   * inside tenancy (`isTenantScopedClass`) — the same source the interceptor\n   * uses, so it covers both `@TenantScoped` and `@smrt({ tenantScoped })`.\n   */\n  className?: string;\n  /** Explicit tenant-scoping decision; overrides `className` resolution. */\n  tenantScoped?: boolean;\n  /** Explicit operator-provided tenant selector (`--tenant` / `context.tenantId`). */\n  tenantId?: string | null;\n  /** Explicit operator opt-in to cross-tenant/system access (`--all-tenants`). */\n  allowCrossTenant?: boolean;\n  /** Surface name for the fail-closed error message, e.g. `'CLI'` / `'MCP'`. */\n  surface?: string;\n}\n\n/**\n * Runner that establishes (or fail-closes) tenant context around `fn` for a\n * tenant-scoped model. Registered by tenancy; see\n * `runTenantScopedEntryPoint` in `@happyvertical/smrt-tenancy`.\n */\nexport type TenantEntryPointRunner = <T>(\n  options: TenantGateOptions,\n  fn: () => Promise<T>,\n) => Promise<T>;\n\ndeclare global {\n  // eslint-disable-next-line no-var\n  var __smrtTenantEntryPointRunner: TenantEntryPointRunner | undefined;\n}\n\n/**\n * Register the tenant entry-point runner used by generated CLI/MCP execution.\n *\n * Called by `@happyvertical/smrt-tenancy`'s `enableTenancy()`; application code\n * never calls this directly. Passing `undefined` clears the runner (restoring\n * the no-op default), which `disableTenancy()` does.\n *\n * @param runner - The tenancy runner, or `undefined` to clear it.\n */\nexport function setTenantEntryPointRunner(\n  runner: TenantEntryPointRunner | undefined,\n): void {\n  globalThis.__smrtTenantEntryPointRunner = runner;\n}\n\n/**\n * Run `fn` through the registered tenant entry-point runner (when tenancy is\n * enabled), or directly when no runner is registered.\n *\n * For tenant-scoped models the runner establishes tenant context from\n * `options.tenantId` / `options.allowCrossTenant`, or fails closed (throws) when\n * neither is available — never silently reading across tenants. Non-scoped\n * models and tenancy-off deployments pass straight through.\n *\n * @param options - {@link TenantGateOptions}.\n * @param fn - The command/tool body to execute.\n * @returns The resolved value of `fn`.\n * @throws Propagates the tenancy runner's `TenantContextError` on the\n *   fail-closed branch.\n */\nexport async function runWithTenantGate<T>(\n  options: TenantGateOptions,\n  fn: () => Promise<T>,\n): Promise<T> {\n  const runner = globalThis.__smrtTenantEntryPointRunner;\n  if (!runner) {\n    // Tenancy not enabled → single-/no-tenant deployment, pass through.\n    return fn();\n  }\n  return runner(options, fn);\n}\n"],"mappings":";;;;;;;;;;AAgEA,SAAgB,0BACd,QACM;CACN,WAAW,+BAA+B;AAC5C;;;;;;;;;;;;;;;;AAiBA,eAAsB,kBACpB,SACA,IACY;CACZ,MAAM,SAAS,WAAW;CAC1B,IAAI,CAAC,QAEH,OAAO,GAAG;CAEZ,OAAO,OAAO,SAAS,EAAE;AAC3B"}
+{"version":3,"file":"tenant-gate.js","names":[],"sources":["../../src/generators/tenant-gate.ts"],"sourcesContent":["/**\n * Tenant entry-point gate — dependency-inversion hook for generated in-process\n * execution (#1554).\n *\n * `@happyvertical/smrt-core` cannot depend on `@happyvertical/smrt-tenancy`\n * (tenancy depends on core, not the other way around). The generated SvelteKit\n * routes establish tenant context from the request principal, but an in-process\n * generator with no principal of its own needs the same fail-closed guarantee —\n * without a gate a tenant-scoped read with no active context would fall\n * through the interceptor's optional-mode pass-through and return rows across\n * **all** tenants.\n *\n * `MCPGenerator` (`generators/mcp.ts`) is the ONLY in-repo caller of\n * {@link runWithTenantGate} today, passing `surface: 'MCP'`. Core's\n * `CLIGenerator`, which used to call this with `surface: 'CLI'` and the\n * `--tenant`/`--all-tenants` flags documented on {@link TenantGateOptions}\n * below, was retired as unused public API (#2664). The live local CLI\n * transport (`packages/cli/src/cli-generator.ts`, the shipped `smrt\n * <object>:<action>` binary) has never called this gate and has no\n * `--tenant`/`--all-tenants` flags of its own — it is NOT tenant-isolation\n * fail-closed today. Do not read this module as evidence that it is; see\n * `packages/tenancy/src/__tests__/cli-mcp-tenant-context.spec.ts` for the\n * MCP-only coverage this leaves in place.\n *\n * Core exposes an injectable runner slot that tenancy fills at `enableTenancy()`\n * time (the same inversion pattern as the DispatchBus tenant resolver and\n * `GlobalInterceptors`). When tenancy is not enabled (non-tenant deployments,\n * existing tests), the slot is empty and {@link runWithTenantGate} simply runs\n * the body — identical to pre-#1554 behavior.\n *\n * Stored on `globalThis` so all module instances share one runner, which\n * matters in the monorepo where the same package can be loaded from multiple\n * paths.\n */\n\n/** Options forwarded to the registered tenancy runner. */\nexport interface TenantGateOptions {\n  /**\n   * Class name of the target model. Tenant-scoping is resolved authoritatively\n   * inside tenancy (`isTenantScopedClass`) — the same source the interceptor\n   * uses, so it covers both `@TenantScoped` and `@smrt({ tenantScoped })`.\n   */\n  className?: string;\n  /** Explicit tenant-scoping decision; overrides `className` resolution. */\n  tenantScoped?: boolean;\n  /**\n   * Explicit operator-provided tenant selector (`context.tenantId` for\n   * MCPGenerator, today's only caller; core's retired `CLIGenerator` used to\n   * pass this from a `--tenant` flag the shipped local CLI does not have,\n   * #2664).\n   */\n  tenantId?: string | null;\n  /**\n   * Explicit operator opt-in to cross-tenant/system access\n   * (`context.allowCrossTenant` for MCPGenerator; core's retired\n   * `CLIGenerator` used to pass this from a `--all-tenants` flag the shipped\n   * local CLI does not have, #2664).\n   */\n  allowCrossTenant?: boolean;\n  /** Surface name for the fail-closed error message, e.g. `'MCP'`. */\n  surface?: string;\n}\n\n/**\n * Runner that establishes (or fail-closes) tenant context around `fn` for a\n * tenant-scoped model. Registered by tenancy; see\n * `runTenantScopedEntryPoint` in `@happyvertical/smrt-tenancy`.\n */\nexport type TenantEntryPointRunner = <T>(\n  options: TenantGateOptions,\n  fn: () => Promise<T>,\n) => Promise<T>;\n\ndeclare global {\n  // eslint-disable-next-line no-var\n  var __smrtTenantEntryPointRunner: TenantEntryPointRunner | undefined;\n}\n\n/**\n * Register the tenant entry-point runner used by generated in-process\n * execution (`MCPGenerator` today; see the module docblock above).\n *\n * Called by `@happyvertical/smrt-tenancy`'s `enableTenancy()`; application code\n * never calls this directly. Passing `undefined` clears the runner (restoring\n * the no-op default), which `disableTenancy()` does.\n *\n * @param runner - The tenancy runner, or `undefined` to clear it.\n */\nexport function setTenantEntryPointRunner(\n  runner: TenantEntryPointRunner | undefined,\n): void {\n  globalThis.__smrtTenantEntryPointRunner = runner;\n}\n\n/**\n * Run `fn` through the registered tenant entry-point runner (when tenancy is\n * enabled), or directly when no runner is registered.\n *\n * For tenant-scoped models the runner establishes tenant context from\n * `options.tenantId` / `options.allowCrossTenant`, or fails closed (throws) when\n * neither is available — never silently reading across tenants. Non-scoped\n * models and tenancy-off deployments pass straight through.\n *\n * @param options - {@link TenantGateOptions}.\n * @param fn - The command/tool body to execute.\n * @returns The resolved value of `fn`.\n * @throws Propagates the tenancy runner's `TenantContextError` on the\n *   fail-closed branch.\n */\nexport async function runWithTenantGate<T>(\n  options: TenantGateOptions,\n  fn: () => Promise<T>,\n): Promise<T> {\n  const runner = globalThis.__smrtTenantEntryPointRunner;\n  if (!runner) {\n    // Tenancy not enabled → single-/no-tenant deployment, pass through.\n    return fn();\n  }\n  return runner(options, fn);\n}\n"],"mappings":";;;;;;;;;;;AAwFA,SAAgB,0BACd,QACM;CACN,WAAW,+BAA+B;AAC5C;;;;;;;;;;;;;;;;AAiBA,eAAsB,kBACpB,SACA,IACY;CACZ,MAAM,SAAS,WAAW;CAC1B,IAAI,CAAC,QAEH,OAAO,GAAG;CAEZ,OAAO,OAAO,SAAS,EAAE;AAC3B"}

package/dist/generators.js

@@ -1,12 +1,11 @@
 import { CRUD_OPERATIONS, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY, buildCustomActionInputSchema, buildCustomActionInvocationArgs, customActionParameterInputName, isCrudOperation, isCrudToolAction, normalizeCustomActionFailure, resolveCustomActionMetadata } from "./generators/custom-action.js";
-import { runWithTenantGate, setTenantEntryPointRunner } from "./generators/tenant-gate.js";
-import { CLIGenerator, getCLIHandler, setupCLI } from "./generators/cli.js";
 import { PRIVATE_READ_CACHE_CONTROL, canonicalReadRepresentation, computeBodyEtag, computeTableVersionEtag, conditionalJsonResponse, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, resolveReadCacheControl, resolveTenantEtagDiscriminator, versionConditionalResponse, warnIfSharedCacheNeutralized } from "./generators/conditional-get.js";
 import { DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, buildChangeEventStream, changeEventSubscribersAtCapacity, eventStreamCapacityExceededResponse, normalizeEventsMaxSubscribers, signalVisibleToTenant, tryReserveChangeEventSubscriberSlot } from "./generators/events-route.js";
+import { runWithTenantGate, setTenantEntryPointRunner } from "./generators/tenant-gate.js";
 import { MCPGenerator, MCP_STABLE_CATALOG_TTL_MS, resolveMCPToolListCacheHint, sortMCPTools } from "./generators/mcp.js";
 import { PLAYBOOK_PREFLIGHT_CAPABILITY, PLAYBOOK_PREFLIGHT_ROUTE_SEGMENT, handlePlaybookPreflightRoute, isApiActionEnabledForObject, isRestActionRoutable, isRestRoutePublic, resolveRegisteredObjectName, restFieldReadPermissions, restMethodForApiAction } from "./generators/preflight-route.js";
 import { normalizeTypedHttpError } from "./generators/typed-http-error.js";
 import { APIGenerator, computeRuntimeWebManifestHash, createRestServer, startRestServer } from "./generators/rest.js";
 import { generateOpenAPISpec, setupSwaggerUI } from "./generators/swagger.js";
 import "./generators/index.js";
-export { APIGenerator, CLIGenerator, CRUD_OPERATIONS, DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, MCPGenerator, MCP_STABLE_CATALOG_TTL_MS, PLAYBOOK_PREFLIGHT_CAPABILITY, PLAYBOOK_PREFLIGHT_ROUTE_SEGMENT, PRIVATE_READ_CACHE_CONTROL, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY, buildChangeEventStream, buildCustomActionInputSchema, buildCustomActionInvocationArgs, canonicalReadRepresentation, changeEventSubscribersAtCapacity, computeBodyEtag, computeRuntimeWebManifestHash, computeTableVersionEtag, conditionalJsonResponse, createRestServer, customActionParameterInputName, eventStreamCapacityExceededResponse, generateOpenAPISpec, getCLIHandler, handlePlaybookPreflightRoute, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, isApiActionEnabledForObject, isCrudOperation, isCrudToolAction, isRestActionRoutable, isRestRoutePublic, normalizeCustomActionFailure, normalizeEventsMaxSubscribers, normalizeTypedHttpError, resolveCustomActionMetadata, resolveMCPToolListCacheHint, resolveReadCacheControl, resolveRegisteredObjectName, resolveTenantEtagDiscriminator, restFieldReadPermissions, restMethodForApiAction, runWithTenantGate, setTenantEntryPointRunner, setupCLI, setupSwaggerUI, signalVisibleToTenant, sortMCPTools, startRestServer, tryReserveChangeEventSubscriberSlot, versionConditionalResponse, warnIfSharedCacheNeutralized };
+export { APIGenerator, CRUD_OPERATIONS, DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, MCPGenerator, MCP_STABLE_CATALOG_TTL_MS, PLAYBOOK_PREFLIGHT_CAPABILITY, PLAYBOOK_PREFLIGHT_ROUTE_SEGMENT, PRIVATE_READ_CACHE_CONTROL, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY, buildChangeEventStream, buildCustomActionInputSchema, buildCustomActionInvocationArgs, canonicalReadRepresentation, changeEventSubscribersAtCapacity, computeBodyEtag, computeRuntimeWebManifestHash, computeTableVersionEtag, conditionalJsonResponse, createRestServer, customActionParameterInputName, eventStreamCapacityExceededResponse, generateOpenAPISpec, handlePlaybookPreflightRoute, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, isApiActionEnabledForObject, isCrudOperation, isCrudToolAction, isRestActionRoutable, isRestRoutePublic, normalizeCustomActionFailure, normalizeEventsMaxSubscribers, normalizeTypedHttpError, resolveCustomActionMetadata, resolveMCPToolListCacheHint, resolveReadCacheControl, resolveRegisteredObjectName, resolveTenantEtagDiscriminator, restFieldReadPermissions, restMethodForApiAction, runWithTenantGate, setTenantEntryPointRunner, setupSwaggerUI, signalVisibleToTenant, sortMCPTools, startRestServer, tryReserveChangeEventSubscriberSlot, versionConditionalResponse, warnIfSharedCacheNeutralized };

package/dist/index.d.ts

@@ -11,8 +11,9 @@
  * - SmrtCollection: Collection interface for managing sets of SmrtObjects
  *
  * Generators:
- * - CLIGenerator: Create admin CLI tools from SMRT objects
  * - APIGenerator: Generate REST APIs for SMRT objects
+ * - CLI: local `smrt` binary transport lives in `@happyvertical/smrt-cli`
+ *   (`packages/cli/src/cli-generator.ts`), not in this package.
  * - MCPGenerator: Create MCP servers for AI model integration
  */
 export * from './adapters/index';
@@ -50,6 +51,7 @@ export type { DiffOptions } from './migrations/differ';
 export { generateSchemaDiff, getSQLFromDiff, hasActionableChanges, isAdvisoryOnlyChange, isManualOrAdvisoryChange, SchemaComparer, } from './migrations/differ';
 export * from './object';
 export { SmrtPolymorphicAssociation, type SmrtPolymorphicAssociationOptions, } from './polymorphic-association';
+export { applyPostgresPermissions, type PostgresPermissionContract, type PostgresPermissionDiagnostic, type PostgresPermissionPlan, planPostgresPermissions, validatePostgresPermissionContract, } from './postgres-permissions.js';
 export { applyPostgresRuntimeTimeouts, DEFAULT_POSTGRES_TIMEOUTS, POSTGRES_TIMEOUT_ENV_VARS, type PostgresTimeoutConfig, type ResolvedPostgresTimeouts, resolvePostgresTimeouts, } from './postgres-timeouts';
 export { buildDefaultListOrderBy, DEFAULT_LIST_LIMIT, DEFAULT_LIST_ORDER_BY, type ListBoundOptions, MAX_LIST_LIMIT, QueryBoundsError, QueryOrderByError, resolveListLimit, resolveListOffset, } from './query-bounds';
 export * from './registry';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,cAAc,kBAAkB,CAAC;AAEjC,OAAO,EACL,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,cAAc,EACnB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,KAAK,iBAAiB,EACtB,YAAY,EACZ,cAAc,EACd,4BAA4B,EAC5B,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,eAAe,EACf,eAAe,EACf,2BAA2B,EAC3B,iBAAiB,EACjB,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,qBAAqB,EAC1B,+BAA+B,EAC/B,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,cAAc,wBAAwB,CAAC;AACvC,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,GACb,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAGlC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,cAAc,EACnB,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACtB,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kCAAkC,EAClC,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,6BAA6B,EAClC,gCAAgC,GACjC,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,KAAK,sBAAsB,EAC3B,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,EACL,UAAU,EACV,KAAK,IAAI,EACT,UAAU,EACV,IAAI,EACJ,KAAK,mBAAmB,EACxB,SAAS,EACT,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,cAAc,kBAAkB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAEhC,cAAc,oBAAoB,CAAC;AACnC,cAAc,UAAU,CAAC;AAEzB,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,gCAAgC,GACjC,MAAM,qBAAqB,CAAC;AAE7B,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,KAAK,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEtE,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,cAAc,aAAa,CAAC;AAG5B,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,uBAAuB,EACvB,KAAK,eAAe,EACpB,cAAc,EACd,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAE1B,cAAc,kBAAkB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,KAAK,iCAAiC,GACvC,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EACL,kCAAkC,EAClC,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAGtE,OAAO,EACL,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,gBAAgB,GACtB,MAAM,8BAA8B,CAAC;AAEtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,cAAc,iBAAiB,CAAC;AAGhC,cAAc,cAAc,CAAC;AAE7B,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,cAAc,eAAe,CAAC;AAE9B,OAAO,EACL,KAAK,EACL,cAAc,EACd,OAAO,EACP,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,EACL,KAAK,MAAM,EACX,KAAK,cAAc,EACnB,SAAS,EACT,aAAa,EACb,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,2BAA2B,EAC3B,aAAa,EACb,eAAe,EACf,MAAM,EACN,KAAK,mBAAmB,EACxB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,cAAc,kBAAkB,CAAC;AAEjC,OAAO,EACL,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,cAAc,EACnB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,KAAK,iBAAiB,EACtB,YAAY,EACZ,cAAc,EACd,4BAA4B,EAC5B,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,eAAe,EACf,eAAe,EACf,2BAA2B,EAC3B,iBAAiB,EACjB,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,KAAK,qBAAqB,EAC1B,+BAA+B,EAC/B,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EACjB,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,cAAc,wBAAwB,CAAC;AACvC,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,YAAY,GACb,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAGlC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,cAAc,EACnB,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACtB,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kCAAkC,EAClC,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,6BAA6B,EAClC,gCAAgC,GACjC,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,KAAK,sBAAsB,EAC3B,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,EACL,UAAU,EACV,KAAK,IAAI,EACT,UAAU,EACV,IAAI,EACJ,KAAK,mBAAmB,EACxB,SAAS,EACT,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,cAAc,kBAAkB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAEhC,cAAc,oBAAoB,CAAC;AACnC,cAAc,UAAU,CAAC;AAEzB,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,gCAAgC,GACjC,MAAM,qBAAqB,CAAC;AAE7B,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,KAAK,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEtE,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,cAAc,aAAa,CAAC;AAG5B,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,uBAAuB,EACvB,KAAK,eAAe,EACpB,cAAc,EACd,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAE1B,cAAc,kBAAkB,CAAC;AACjC,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,KAAK,iCAAiC,GACvC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,sBAAsB,EAC3B,uBAAuB,EACvB,kCAAkC,GACnC,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EACL,kCAAkC,EAClC,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAGtE,OAAO,EACL,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,gBAAgB,GACtB,MAAM,8BAA8B,CAAC;AAEtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,cAAc,iBAAiB,CAAC;AAGhC,cAAc,cAAc,CAAC;AAE7B,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,cAAc,eAAe,CAAC;AAE9B,OAAO,EACL,KAAK,EACL,cAAc,EACd,OAAO,EACP,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,EACL,KAAK,MAAM,EACX,KAAK,cAAc,EACnB,SAAS,EACT,aAAa,EACb,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,2BAA2B,EAC3B,aAAa,EACb,eAAe,EACf,MAAM,EACN,KAAK,mBAAmB,EACxB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -56,10 +56,9 @@ import { DispatchSubscriptionCollection } from "./dispatch/collections/DispatchS
 import { DispatchBus, createDispatchBus } from "./dispatch/bus.js";
 import "./dispatch/index.js";
 import "./embeddings/index.js";
-import { runWithTenantGate, setTenantEntryPointRunner } from "./generators/tenant-gate.js";
-import { CLIGenerator, getCLIHandler, setupCLI } from "./generators/cli.js";
 import { PRIVATE_READ_CACHE_CONTROL, canonicalReadRepresentation, computeBodyEtag, computeTableVersionEtag, conditionalJsonResponse, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, resolveReadCacheControl, resolveTenantEtagDiscriminator, versionConditionalResponse, warnIfSharedCacheNeutralized } from "./generators/conditional-get.js";
 import { DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, buildChangeEventStream, changeEventSubscribersAtCapacity, eventStreamCapacityExceededResponse, normalizeEventsMaxSubscribers, signalVisibleToTenant, tryReserveChangeEventSubscriberSlot } from "./generators/events-route.js";
+import { runWithTenantGate, setTenantEntryPointRunner } from "./generators/tenant-gate.js";
 import { MCPGenerator, MCP_STABLE_CATALOG_TTL_MS, resolveMCPToolListCacheHint, sortMCPTools } from "./generators/mcp.js";
 import { PLAYBOOK_PREFLIGHT_CAPABILITY, PLAYBOOK_PREFLIGHT_ROUTE_SEGMENT, handlePlaybookPreflightRoute, isApiActionEnabledForObject, isRestActionRoutable, isRestRoutePublic, resolveRegisteredObjectName, restFieldReadPermissions, restMethodForApiAction } from "./generators/preflight-route.js";
 import { MAX_SYNC_APPLY_BATCH_SIZE, SYNC_APPLY_ROUTE_SEGMENTS, SYNC_APPLY_UUID_PATTERN, applySyncWritablePolicy, isStaleWrite, parseSyncApplyBatch, payloadMatchesRow, processSyncApplyBatch, validateSyncApplyItem } from "./sync/apply.js";
@@ -78,6 +77,7 @@ import manifest, { getManifest, staticManifest } from "./manifest/index.js";
 import { planForeignKeyCreation } from "./schema/foreign-key-planner.js";
 import { SchemaComparer, generateSchemaDiff, getSQLFromDiff, hasActionableChanges, isAdvisoryOnlyChange, isManualOrAdvisoryChange } from "./migrations/differ.js";
 import { SmrtPolymorphicAssociation } from "./polymorphic-association.js";
+import { applyPostgresPermissions, planPostgresPermissions, validatePostgresPermissionContract } from "./postgres-permissions.js";
 import { createSmrtClient } from "./runtime/client.js";
 import { SmrtMCPServer, createMCPServer } from "./runtime/mcp.js";
 import { createSmrtServer } from "./runtime/server.js";
@@ -89,4 +89,4 @@ import "./system/index.js";
 import { getTestDatabase } from "./testing/database.js";
 import "./tools/index.js";
 import { smrtPlugin } from "./vite-plugin/index.js";
-export { AGENT_SURFACE_HASH_PREFIX, AIError, APIGenerator, AiUsageCollector, AiUsagePersistenceHandler, CACHE_INVALIDATION_CHANNEL, CHANGE_FEED_INTERCEPTOR_NAME, CHANGE_FEED_TABLE, CHANGE_SIGNAL_CHANNEL, CLIGenerator, CRUD_OPERATIONS, ConfigurationError, ContentHasher, CosineSimilarity, DEFAULT_AI_COST_RATES, DEFAULT_CHANGES_LIMIT, DEFAULT_DATA_QUERY_PAGE_LIMIT, DEFAULT_DATA_QUERY_RESULT_BYTES, DEFAULT_EMBEDDING_CONFIG, DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, DEFAULT_FACET_LIMIT, DEFAULT_LEARNING_CONFIG, DEFAULT_LIST_LIMIT, DEFAULT_LIST_ORDER_BY, DEFAULT_POSTGRES_TIMEOUTS, DEFAULT_RETENTION_POLICY, DataQueryValidationError, DatabaseError, Dispatch, DispatchBus, DispatchCollection, DispatchSubscription, DispatchSubscriptionCollection, EmbeddingProvider, EmbeddingStorage, ErrorUtils, FilesystemError, GlobalInterceptors, LearningMemory, LiveSchemaParityError, MAX_CHANGES_LIMIT, MAX_DATA_QUERY_CURSOR_LENGTH, MAX_DATA_QUERY_FACETS, MAX_DATA_QUERY_FILTERS, MAX_DATA_QUERY_FILTER_DEPTH, MAX_DATA_QUERY_IN_VALUES, MAX_DATA_QUERY_OFFSET, MAX_DATA_QUERY_PAGE_LIMIT, MAX_DATA_QUERY_REQUEST_BYTES, MAX_DATA_QUERY_RESULT_BYTES, MAX_DATA_QUERY_WARNINGS, MAX_FACET_FIELDS, MAX_FACET_LIMIT, MAX_LIST_LIMIT, MAX_STI_READ_SCOPE_TYPES, MAX_SYNC_APPLY_BATCH_SIZE, MCPGenerator, MCP_STABLE_CATALOG_TTL_MS, MODULE_DOC_HASH_PREFIX, ManifestBuilder, ManifestGenerator, ManifestManager, MetricsAdapter, NetworkError, ObjectRegistry, PLAYBOOK_PREFLIGHT_CAPABILITY, PLAYBOOK_PREFLIGHT_ROUTE_SEGMENT, POSTGRES_REVISION_GUARD_EXPRESSION, POSTGRES_TIMEOUT_ENV_VARS, PRIVATE_READ_CACHE_CONTROL, PubSubAdapter, QueryBoundsError, QueryOrderByError, RuntimeError, SMRT_COLLECTION_BASE_NAMES, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY, SYNC_APPLY_ROUTE_SEGMENTS, SYNC_APPLY_UUID_PATTERN, SYSTEM_TABLE_NAMES, SchemaComparer, SignalBus, SignalSanitizer, SmrtClass, SmrtCollection, SmrtError, SmrtHierarchical, SmrtJunction, SmrtMCPServer, SmrtObject, SmrtPolymorphicAssociation, TenantIsolationError, ValidationError, ValidationReport, ValidationUtils, appendChange, applyOneToManyChildAccessors, applyPendingDecoratorRegistrations, applyPostgresRuntimeTimeouts, applySyncWritablePolicy, assertPostgresSystemTimestampsCurrent, broadcastCacheInvalidation, buildCascadePlan, buildChangeEventStream, buildCustomActionInputSchema, buildCustomActionInvocationArgs, buildDefaultListOrderBy, buildDomainKnowledgeManifest, bumpChangeFeed, canonicalReadRepresentation, canonicalizeDataQuery, cascadeReferencesTo, changeEventSubscribersAtCapacity, checkLiveSchemaParity, childAccessorName, classifyDatabaseError, classifyDialectMessage, clearRetentionTasks, clone, computeBodyEtag, computeRuntimeWebManifestHash, computeTableVersionEtag, conditionalJsonResponse, config, convertTypeToJsonSchema, createDataQueryFingerprint, createDispatchBus, createFilesystemAdapter, createInterceptorContext, createMCPServer, createQualifiedName, createRestServer, createSmrtClient, createSmrtServer, crossPackageRef, customActionParameterInputName, detectEngine, discoverManifestEntry, discoverScopedPackageDirectories, drainChangeFeed, ensureBootstrapSystemTableCompatibility, ensureCacheInvalidationListener, ensureChangeFeedTable, ensureDeferredSystemTableCompatibility, ensureDispatchSubscriptionsSystemTableCompatibility, ensureDispatchSystemTableCompatibility, ensureJobEventsSystemTableCompatibility, ensureJobsSystemTableCompatibility, ensureLegacySystemTableCompatibility, ensureSystemTables, estimateAiUsageCost, eventStreamCapacityExceededResponse, executeCollectionReadPlan, executeToolCall, executeToolCalls, field, findManifestEntryByQualifiedName, foreignKey, formatToolResults, generateDDLForEngine, generateOpenAPISpec, generateSchemaDiff, generateToolFromMethod, generateToolManifest, getAdapterInfo, getCLIHandler, getCacheGeneration, getChangesSince, getClassConfigResolvers, getClassName, getConfigResolver, getDatabaseEngine, getManifest, getPackageFromQualifiedName, getRetentionTasks, getSQLFromDiff, getSystemTableShapes, getTableVersion, getTenantScopedChangesSince, getTestDatabase, handlePlaybookPreflightRoute, hasActionableChanges, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, importOptionalDependency, invalidateCollectionCache, isAbortedTransactionError, isAdvisoryOnlyChange, isApiActionEnabledForObject, isCrudOperation, isCrudToolAction, isDatabaseInterface, isDeterministicDatabaseError, isEmbeddedDatabase, isFrameworkBaseClass, isFromPackage, isLazyConfigSentinel, isManualOrAdvisoryChange, isNotNullViolationError, isPostgresDatabase, isQualifiedName, isRestActionRoutable, isRestRoutePublic, isSmrtCollectionExtendsName, isStaleWrite, isTenantScopedClassResolved, isTransientDatabaseError, isType, isUniqueViolationError, isValid, listConfigResolvers, loadExternalManifest, loadExternalManifestSync, loadLocalTestManifestSync, loadManifestFromPathSync, manifest, manyToMany, meta, migratePostgresSystemTimestamps, normalizeCustomActionFailure, normalizeDataQueryRequest, normalizeDataQueryResult, normalizeDataQuerySchema, normalizeEventsMaxSubscribers, normalizeOnDelete, normalizeTypedHttpError, oneToMany, parse, parseQualifiedName, parseSyncApplyBatch, payloadMatchesRow, planForeignKeyCreation, planPostgresSystemTimestampMigrations, postgresRevisionCandidates, postgresRevisionCondition, processSyncApplyBatch, pruneAiUsage, pruneChangeFeed, pruneExpiredContexts, qualifiedNamesEqual, readAgentModuleDocs, readPackageAgentDoc, registerChangeFeedWriter, registerCompatibleFieldDecorator, registerConfigResolver, registerFilesystemAdapterFactory, registerOptionalDependency, registerRetentionTask, resetChangeFeedWarnings, resetChangeSignals, resetCollectionCache, resetConfigResolvers, resetVerifiedTables, resolveAgentModuleDocPaths, resolveCustomActionMetadata, resolveDatabase, resolveDbCacheKey, resolveDispatchTenantId, resolveDispatchTenantScope, resolveGetStringFilter, resolveLazyConfig, resolveListLimit, resolveListOffset, resolveMCPToolListCacheHint, resolvePostgresTimeouts, resolveReadCacheControl, resolveRegisteredObjectName, resolveTenantEtagDiscriminator, restFieldReadPermissions, restMethodForApiAction, runCascadeDelete, runRetentionSweep, runWithTenantGate, safeParse, safeStringify, setDispatchTenantResolver, setTenantEntryPointRunner, setTenantScopedClassResolver, setupCLI, setupSwaggerUI, shouldIncludeMethod, signalVisibleToTenant, smrt, smrtPlugin, smrt as smrtRegistry, sortMCPTools, startRestServer, staticManifest, stopCacheInvalidationListeners, stopChangeSignalListeners, stringify, subscribeToChangeSignals, tableExists, tryReserveChangeEventSubscriberSlot, unregisterChangeFeedWriter, unregisterConfigResolver, unregisterRetentionTask, usesEmbeddedRevisionFallback, validateSyncApplyItem, validateToolCall, versionConditionalResponse, warnIfSharedCacheNeutralized, withEmbeddedWriteQueue, withEmbeddedWriteTransaction };
+export { AGENT_SURFACE_HASH_PREFIX, AIError, APIGenerator, AiUsageCollector, AiUsagePersistenceHandler, CACHE_INVALIDATION_CHANNEL, CHANGE_FEED_INTERCEPTOR_NAME, CHANGE_FEED_TABLE, CHANGE_SIGNAL_CHANNEL, CRUD_OPERATIONS, ConfigurationError, ContentHasher, CosineSimilarity, DEFAULT_AI_COST_RATES, DEFAULT_CHANGES_LIMIT, DEFAULT_DATA_QUERY_PAGE_LIMIT, DEFAULT_DATA_QUERY_RESULT_BYTES, DEFAULT_EMBEDDING_CONFIG, DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, DEFAULT_FACET_LIMIT, DEFAULT_LEARNING_CONFIG, DEFAULT_LIST_LIMIT, DEFAULT_LIST_ORDER_BY, DEFAULT_POSTGRES_TIMEOUTS, DEFAULT_RETENTION_POLICY, DataQueryValidationError, DatabaseError, Dispatch, DispatchBus, DispatchCollection, DispatchSubscription, DispatchSubscriptionCollection, EmbeddingProvider, EmbeddingStorage, ErrorUtils, FilesystemError, GlobalInterceptors, LearningMemory, LiveSchemaParityError, MAX_CHANGES_LIMIT, MAX_DATA_QUERY_CURSOR_LENGTH, MAX_DATA_QUERY_FACETS, MAX_DATA_QUERY_FILTERS, MAX_DATA_QUERY_FILTER_DEPTH, MAX_DATA_QUERY_IN_VALUES, MAX_DATA_QUERY_OFFSET, MAX_DATA_QUERY_PAGE_LIMIT, MAX_DATA_QUERY_REQUEST_BYTES, MAX_DATA_QUERY_RESULT_BYTES, MAX_DATA_QUERY_WARNINGS, MAX_FACET_FIELDS, MAX_FACET_LIMIT, MAX_LIST_LIMIT, MAX_STI_READ_SCOPE_TYPES, MAX_SYNC_APPLY_BATCH_SIZE, MCPGenerator, MCP_STABLE_CATALOG_TTL_MS, MODULE_DOC_HASH_PREFIX, ManifestBuilder, ManifestGenerator, ManifestManager, MetricsAdapter, NetworkError, ObjectRegistry, PLAYBOOK_PREFLIGHT_CAPABILITY, PLAYBOOK_PREFLIGHT_ROUTE_SEGMENT, POSTGRES_REVISION_GUARD_EXPRESSION, POSTGRES_TIMEOUT_ENV_VARS, PRIVATE_READ_CACHE_CONTROL, PubSubAdapter, QueryBoundsError, QueryOrderByError, RuntimeError, SMRT_COLLECTION_BASE_NAMES, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY, SYNC_APPLY_ROUTE_SEGMENTS, SYNC_APPLY_UUID_PATTERN, SYSTEM_TABLE_NAMES, SchemaComparer, SignalBus, SignalSanitizer, SmrtClass, SmrtCollection, SmrtError, SmrtHierarchical, SmrtJunction, SmrtMCPServer, SmrtObject, SmrtPolymorphicAssociation, TenantIsolationError, ValidationError, ValidationReport, ValidationUtils, appendChange, applyOneToManyChildAccessors, applyPendingDecoratorRegistrations, applyPostgresPermissions, applyPostgresRuntimeTimeouts, applySyncWritablePolicy, assertPostgresSystemTimestampsCurrent, broadcastCacheInvalidation, buildCascadePlan, buildChangeEventStream, buildCustomActionInputSchema, buildCustomActionInvocationArgs, buildDefaultListOrderBy, buildDomainKnowledgeManifest, bumpChangeFeed, canonicalReadRepresentation, canonicalizeDataQuery, cascadeReferencesTo, changeEventSubscribersAtCapacity, checkLiveSchemaParity, childAccessorName, classifyDatabaseError, classifyDialectMessage, clearRetentionTasks, clone, computeBodyEtag, computeRuntimeWebManifestHash, computeTableVersionEtag, conditionalJsonResponse, config, convertTypeToJsonSchema, createDataQueryFingerprint, createDispatchBus, createFilesystemAdapter, createInterceptorContext, createMCPServer, createQualifiedName, createRestServer, createSmrtClient, createSmrtServer, crossPackageRef, customActionParameterInputName, detectEngine, discoverManifestEntry, discoverScopedPackageDirectories, drainChangeFeed, ensureBootstrapSystemTableCompatibility, ensureCacheInvalidationListener, ensureChangeFeedTable, ensureDeferredSystemTableCompatibility, ensureDispatchSubscriptionsSystemTableCompatibility, ensureDispatchSystemTableCompatibility, ensureJobEventsSystemTableCompatibility, ensureJobsSystemTableCompatibility, ensureLegacySystemTableCompatibility, ensureSystemTables, estimateAiUsageCost, eventStreamCapacityExceededResponse, executeCollectionReadPlan, executeToolCall, executeToolCalls, field, findManifestEntryByQualifiedName, foreignKey, formatToolResults, generateDDLForEngine, generateOpenAPISpec, generateSchemaDiff, generateToolFromMethod, generateToolManifest, getAdapterInfo, getCacheGeneration, getChangesSince, getClassConfigResolvers, getClassName, getConfigResolver, getDatabaseEngine, getManifest, getPackageFromQualifiedName, getRetentionTasks, getSQLFromDiff, getSystemTableShapes, getTableVersion, getTenantScopedChangesSince, getTestDatabase, handlePlaybookPreflightRoute, hasActionableChanges, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, importOptionalDependency, invalidateCollectionCache, isAbortedTransactionError, isAdvisoryOnlyChange, isApiActionEnabledForObject, isCrudOperation, isCrudToolAction, isDatabaseInterface, isDeterministicDatabaseError, isEmbeddedDatabase, isFrameworkBaseClass, isFromPackage, isLazyConfigSentinel, isManualOrAdvisoryChange, isNotNullViolationError, isPostgresDatabase, isQualifiedName, isRestActionRoutable, isRestRoutePublic, isSmrtCollectionExtendsName, isStaleWrite, isTenantScopedClassResolved, isTransientDatabaseError, isType, isUniqueViolationError, isValid, listConfigResolvers, loadExternalManifest, loadExternalManifestSync, loadLocalTestManifestSync, loadManifestFromPathSync, manifest, manyToMany, meta, migratePostgresSystemTimestamps, normalizeCustomActionFailure, normalizeDataQueryRequest, normalizeDataQueryResult, normalizeDataQuerySchema, normalizeEventsMaxSubscribers, normalizeOnDelete, normalizeTypedHttpError, oneToMany, parse, parseQualifiedName, parseSyncApplyBatch, payloadMatchesRow, planForeignKeyCreation, planPostgresPermissions, planPostgresSystemTimestampMigrations, postgresRevisionCandidates, postgresRevisionCondition, processSyncApplyBatch, pruneAiUsage, pruneChangeFeed, pruneExpiredContexts, qualifiedNamesEqual, readAgentModuleDocs, readPackageAgentDoc, registerChangeFeedWriter, registerCompatibleFieldDecorator, registerConfigResolver, registerFilesystemAdapterFactory, registerOptionalDependency, registerRetentionTask, resetChangeFeedWarnings, resetChangeSignals, resetCollectionCache, resetConfigResolvers, resetVerifiedTables, resolveAgentModuleDocPaths, resolveCustomActionMetadata, resolveDatabase, resolveDbCacheKey, resolveDispatchTenantId, resolveDispatchTenantScope, resolveGetStringFilter, resolveLazyConfig, resolveListLimit, resolveListOffset, resolveMCPToolListCacheHint, resolvePostgresTimeouts, resolveReadCacheControl, resolveRegisteredObjectName, resolveTenantEtagDiscriminator, restFieldReadPermissions, restMethodForApiAction, runCascadeDelete, runRetentionSweep, runWithTenantGate, safeParse, safeStringify, setDispatchTenantResolver, setTenantEntryPointRunner, setTenantScopedClassResolver, setupSwaggerUI, shouldIncludeMethod, signalVisibleToTenant, smrt, smrtPlugin, smrt as smrtRegistry, sortMCPTools, startRestServer, staticManifest, stopCacheInvalidationListeners, stopChangeSignalListeners, stringify, subscribeToChangeSignals, tableExists, tryReserveChangeEventSubscriberSlot, unregisterChangeFeedWriter, unregisterConfigResolver, unregisterRetentionTask, usesEmbeddedRevisionFallback, validatePostgresPermissionContract, validateSyncApplyItem, validateToolCall, versionConditionalResponse, warnIfSharedCacheNeutralized, withEmbeddedWriteQueue, withEmbeddedWriteTransaction };

package/dist/knowledge.js

@@ -314,7 +314,8 @@ function configuredSurfaces(kind, object, manifest) {
 * joined string, not just the object-name prefix. A CRUD verb is already
 * lowercase so this is a no-op there, but a camelCase custom method name
 * (`findByDimensions`) would otherwise report a surface `name` the real tool
-* is never registered under. `CLIGenerator.listCommands()` does not
+* is never registered under. `packages/cli/src/cli-generator.ts`'s command
+* builder (`CLIGenerator`'s private `generateObjectCommands()`) does not
 * lowercase the method half of its command string, so `cli` keeps the
 * operation as-authored.
 *
@@ -331,12 +332,20 @@ function surfaceName(kind, object, operation) {
 * A hand-written `SmrtCollection` subclass (`class WidgetCollection extends
 * SmrtCollection<Widget>`) is discovered structurally by the scanner and
 * lands in the manifest even without its own `@smrt()` decorator, so it never
-* registers with `ObjectRegistry`. `MCPGenerator`/`CLIGenerator` iterate
-* `ObjectRegistry`, not the manifest, so such a class never gets its own
-* MCP tools or CLI commands — only its collection-scoped custom actions get
-* REST routes. Reporting full CRUD for it here would over-report a surface
-* that does not exist, trading the #2619 under-report for a new false
-* positive.
+* registers with `ObjectRegistry` by decoration. `MCPGenerator` (and,
+* historically, core's now-retired `CLIGenerator`, #2664) iterate the
+* decoration-populated `ObjectRegistry` directly, not the manifest, so such a
+* class never gets its own MCP tools there — only its collection-scoped
+* custom actions get REST routes. The shipped local CLI
+* (`packages/cli/src/cli-generator.ts`) is a documented exception: its
+* `ensureManifestLoaded()` pre-registers every manifest entry into
+* `ObjectRegistry` via `registerFromManifest()` before generating commands,
+* with no collection-class filter, so a manifest-only collection class IS
+* reachable there (e.g. `smrt itemcollection:list`) even though this
+* projection reports none. Reporting full CRUD for it here would over-report
+* the projection's own (registry-scoped) surface, trading the #2619
+* under-report for a new false positive there -- it does not claim the
+* shipped CLI binary lacks the surface too.
 *
 * A deeper subclass (`SpecialCollection extends WidgetCollection`) carries no
 * `extendsTypeArg` of its own, so this walks the extends chain through the
@@ -387,7 +396,8 @@ function manifestObjectPackage(object, manifestKey) {
 }
 /**
 * Operations exposed for one object's `api`/`cli`/`mcp` surface, derived from
-* the same defaults `APIGenerator`/`CLIGenerator`/`MCPGenerator` apply rather
+* the same defaults `APIGenerator`/core's retired `CLIGenerator`
+* (#2664)/`MCPGenerator` apply rather
 * than from the presence of a config key (#2619): an omitted config is full
 * CRUD, not a closed surface — an `include` list, when present, is the
 * COMPLETE allowlist for custom methods too; without one, every public
@@ -395,7 +405,8 @@ function manifestObjectPackage(object, manifestKey) {
 * false` closes the surface entirely.
 *
 * Custom (non-CRUD, public) method gating is NOT identical across the three
-* kinds. `CLIGenerator.listCommands()`/`assertCommandExposed()` and
+* kinds. Core's retired `CLIGenerator.listCommands()`/`assertCommandExposed()`
+* (#2664) and
 * `MCPGenerator.generateTools()` both refuse a framework lifecycle method
 * (`save`, `initialize`, ...) even when a class declares its own override —
 * it is the mechanism behind generated CRUD, not a distinct action (#2638) —
@@ -415,13 +426,14 @@ function manifestObjectPackage(object, manifestKey) {
 * keep declared casing in their command/route names, so neither behavior
 * applies to them.
 *
-* This `cli` projection models `CLIGenerator` (`generators/cli.ts`), not the
-* shipped local CLI transport (`@happyvertical/smrt-cli`'s
-* `cli-generator.ts`, the `smrt <object>:<action>` binary): that generator
-* does not gate on `isFrameworkLifecycleMethod()` today, so a locally
-* overridden lifecycle method the artifact now reports as absent can still
-* be invoked there. Retargeting this projection at the shipped binary is a
-* contract change tracked on #2664, not part of this fix.
+* This `cli` projection models the reservation rule core's `CLIGenerator`
+* used to apply (`generators/cli.ts`, retired by #2664), not the shipped
+* local CLI transport (`packages/cli/src/cli-generator.ts`, the
+* `smrt <object>:<action>` binary): that generator does not gate on
+* `isFrameworkLifecycleMethod()` today, so a locally overridden lifecycle
+* method the artifact now reports as absent can still be invoked there.
+* Retargeting this projection at the shipped binary is a contract change
+* tracked on #2692, not part of this fix.
 */
 function configuredOperations(kind, object, config, manifest) {
 	if (config === false) return [];