@happyvertical/smrt-core 0.51.10 → 0.51.14

package/dist/vite-plugin/sync-apply-route.d.ts

@@ -13,6 +13,13 @@ interface SyncTargetSpec {
      * simple name.
      */
     registryKey: string;
+    /**
+     * `<collection>` prefix of the `<collection>.<action>` operation permission
+     * the mirrored generated write routes require (#2977) — the same
+     * `decoratorConfig.collection ?? collection` resolution as
+     * sveltekit-generator.ts `resolvePermissionCollection`.
+     */
+    permissionCollection: string;
     ops: MutatingAction[];
     readonlyFields: string[];
     writableAllowlist: string[] | null;

package/dist/vite-plugin/sync-apply-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync-apply-route.d.ts","sourceRoot":"","sources":["../../src/vite-plugin/sync-apply-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,QAAA,MAAM,gBAAgB,yCAA0C,CAAC;AAEjE,KAAK,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD,wDAAwD;AACxD,UAAU,cAAc;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,cAAc,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,YAAY,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B,YAAY,EAAE,OAAO,CAAC;CACvB;AAmED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,mBAAmB,GAC5B,cAAc,EAAE,CAgClB;AAgBD;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,cAAc,EAAE,EACzB,YAAY,EAAE,MAAM,GACnB,MAAM,CA0GR;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAiCT"}
+{"version":3,"file":"sync-apply-route.d.ts","sourceRoot":"","sources":["../../src/vite-plugin/sync-apply-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,QAAA,MAAM,gBAAgB,yCAA0C,CAAC;AAEjE,KAAK,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD,wDAAwD;AACxD,UAAU,cAAc;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,GAAG,EAAE,cAAc,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,YAAY,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B,YAAY,EAAE,OAAO,CAAC;CACvB;AA6ED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,mBAAmB,GAC5B,cAAc,EAAE,CAiClB;AAiBD;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,cAAc,EAAE,EACzB,YAAY,EAAE,MAAM,GACnB,MAAM,CAkJR;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAiCT"}

package/dist/vite-plugin/sync-apply-route.js

@@ -68,6 +68,11 @@ function getApiWritableAllowlist(apiConfig) {
 	const config = getApiConfigObject(apiConfig);
 	return Array.isArray(config?.writable) ? config.writable : null;
 }
+/** Mirror of sveltekit-generator.ts `resolvePermissionCollection` (#2977). */
+function resolvePermissionCollection(objectDef) {
+	const configured = objectDef.decoratorConfig?.collection;
+	return typeof configured === "string" && configured.length > 0 ? configured : objectDef.collection;
+}
 /**
 * Collect the syncable targets from a manifest: non-collection objects whose
 * API config is enabled and exposes at least one mutating action.
@@ -85,6 +90,7 @@ function collectSyncApplyTargets(manifest) {
 		targets.push({
 			segment: objectDef.collection,
 			registryKey: className,
+			permissionCollection: resolvePermissionCollection(objectDef),
 			ops,
 			readonlyFields: collectReadonlyFieldNames(objectDef),
 			writableAllowlist: getApiWritableAllowlist(apiConfig),
@@ -98,6 +104,7 @@ function serializeTargets(targets) {
 	return `{\n${targets.map((target) => {
 		const fields = [
 			`registryKey: ${JSON.stringify(target.registryKey)}`,
+			`permissionCollection: ${JSON.stringify(target.permissionCollection)}`,
 			`ops: ${JSON.stringify(target.ops)}`,
 			`readonlyFields: ${JSON.stringify(target.readonlyFields)}`,
 			`writableAllowlist: ${JSON.stringify(target.writableAllowlist)}`,
@@ -146,6 +153,8 @@ function establishTenantContext(locals: unknown): void {
 interface SyncTargetConfig {
   /** Manifest registry key (may be package-qualified), as CRUD routes use. */
   registryKey: string;
+  /** \`<collection>\` prefix of the required \`<collection>.<op>\` permission. */
+  permissionCollection: string;
   ops: SyncApplyOp[];
   readonlyFields: string[];
   writableAllowlist: string[] | null;
@@ -170,6 +179,39 @@ function hasAuthenticatedPrincipal(locals: unknown): boolean {
   );
 }
 
+function readRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object'
+    ? (value as Record<string, unknown>)
+    : {};
+}
+
+function hasGrantedPermission(value: unknown, permission: string): boolean {
+  if (Array.isArray(value)) return value.includes(permission);
+  if (value instanceof Set) return value.has(permission);
+  return false;
+}
+
+// Fail-closed operation permission (#2977, #3011): each applied op requires
+// the same \`<collection>.<op>\` permission the mirrored generated write route
+// enforces, read from the principal's session permission snapshot. A missing
+// snapshot denies; only an explicit tenancy super-admin bypass skips it.
+function hasOperationPermission(
+  locals: unknown,
+  permissionCollection: string,
+  op: SyncApplyOp,
+): boolean {
+  const l = readRecord(locals);
+  const tenantContext = readRecord(l.tenantContext);
+  if (tenantContext.superAdminBypass === true) return true;
+  const permission = \`\${permissionCollection}.\${op}\`;
+  return (
+    hasGrantedPermission(l.permissions, permission) ||
+    hasGrantedPermission(l.permissionSet, permission) ||
+    hasGrantedPermission(l.smrtPermissions, permission) ||
+    hasGrantedPermission(tenantContext.permissions, permission)
+  );
+}
+
 export const POST: RequestHandler = async ({ locals, request }) => {
   const authenticated = hasAuthenticatedPrincipal(locals);
 ${anyTenantScoped ? "  establishTenantContext(locals);\n" : ""}
@@ -195,10 +237,15 @@ ${anyTenantScoped ? "  establishTenantContext(locals);\n" : ""}
         objectName: target.registryKey,
         collection,
         isOpAllowed: (op: SyncApplyOp) => target.ops.includes(op),
-        authorize: () =>
-          authenticated || target.publicAccess === true
+        authorize: (op: SyncApplyOp) => {
+          // \`public: true\` keeps its unauthenticated write semantics, as on
+          // the generated CRUD routes.
+          if (target.publicAccess === true) return 'ok' as const;
+          if (!authenticated) return 'auth_required' as const;
+          return hasOperationPermission(locals, target.permissionCollection, op)
             ? ('ok' as const)
-            : ('auth_required' as const),
+            : ('forbidden' as const);
+        },
         prepare: (payload: Record<string, unknown>) =>
           applySyncWritablePolicy(payload, {
             readonlyFields: target.readonlyFields,

package/dist/vite-plugin/sync-apply-route.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync-apply-route.js","names":[],"sources":["../../src/vite-plugin/sync-apply-route.ts"],"sourcesContent":["/**\n * SvelteKit generator for the sync-apply batch write route (#1759).\n *\n * Emits ONE route — `{routesDir}/sync/apply/+server.ts` — implementing the\n * shared web/mobile write contract for every syncable model in the manifest\n * (models whose API config exposes at least one of create/update/delete). The\n * generated file is deliberately thin: it maps `object` segments to\n * collections plus per-model policy data, and delegates all batch processing\n * to `processSyncApplyBatch` from `@happyvertical/smrt-core` — the same\n * engine the runtime REST generator uses, so the two transports cannot drift.\n *\n * This lives in its own module (rather than sveltekit-generator.ts) so the\n * shared generator file only needs a one-line registration hook; sibling\n * work (#1757, #1758) touches the same generator files in parallel.\n *\n * Contract documentation: docs/content/architecture/sync-apply-contract.md\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { isFrameworkBaseClass } from '../registry/framework-base-classes.js';\nimport type { ApiConfig } from '../registry/types.js';\nimport type {\n  SmartObjectDefinition,\n  SmartObjectManifest,\n} from '../scanner/types';\nimport { AUTO_GENERATED_ROUTE_HEADER } from './route-header.js';\nimport { resolveSvelteKitConfigImport } from './sveltekit-config-import.js';\nimport type { SvelteKitOptions } from './sveltekit-generator.js';\nimport { isCollectionManifestClass } from './web-collections.js';\n\nconst MUTATING_ACTIONS = ['create', 'update', 'delete'] as const;\n\ntype MutatingAction = (typeof MUTATING_ACTIONS)[number];\n\n/** Per-model data embedded into the generated route. */\ninterface SyncTargetSpec {\n  segment: string;\n  /**\n   * The manifest registry key, passed VERBATIM to `getCollection()` exactly\n   * as the generated CRUD routes do. May be package-qualified\n   * (`@happyvertical/smrt-ledgers:Account`) — collapsing it to a simple class\n   * name would resolve ambiguously when two loaded packages declare the same\n   * simple name.\n   */\n  registryKey: string;\n  ops: MutatingAction[];\n  readonlyFields: string[];\n  writableAllowlist: string[] | null;\n  publicAccess: boolean | 'read';\n  tenantScoped: boolean;\n}\n\nfunction getApiConfigObject(apiConfig: unknown): ApiConfig | null {\n  if (!apiConfig || typeof apiConfig !== 'object') {\n    return null;\n  }\n  return apiConfig as ApiConfig;\n}\n\n/**\n * Mirror of sveltekit-generator.ts `resolveStandardCrudActions`, narrowed to\n * the mutating subset the sync contract can carry. Kept local so this module\n * needs no exports added to the (parallel-edited) shared generator file.\n */\nfunction resolveMutatingActions(apiConfig: unknown): MutatingAction[] {\n  if (apiConfig === false) return [];\n  if (\n    apiConfig === true ||\n    apiConfig === undefined ||\n    typeof apiConfig !== 'object'\n  ) {\n    return [...MUTATING_ACTIONS];\n  }\n\n  const config = apiConfig as { include?: string[]; exclude?: string[] };\n  let actions: MutatingAction[] = Array.isArray(config.include)\n    ? MUTATING_ACTIONS.filter((action) => config.include?.includes(action))\n    : [...MUTATING_ACTIONS];\n  if (Array.isArray(config.exclude)) {\n    const excluded = config.exclude;\n    actions = actions.filter((action) => !excluded.includes(action));\n  }\n  return actions;\n}\n\n/** Mirror of sveltekit-generator.ts `getApiPublicAccess` (fail-closed). */\nfunction getApiPublicAccess(apiConfig: unknown): boolean | 'read' {\n  const config = getApiConfigObject(apiConfig);\n  const value = config?.public;\n  if (value === true || value === 'read') {\n    return value;\n  }\n  return false;\n}\n\n/** Mirror of sveltekit-generator.ts `collectReadonlyFieldNames` (#1540, 2b). */\nfunction collectReadonlyFieldNames(objectDef: SmartObjectDefinition): string[] {\n  const fields = objectDef.fields || {};\n  const names: string[] = [];\n  for (const [name, def] of Object.entries(fields)) {\n    const meta = (def as { _meta?: Record<string, unknown> })._meta;\n    if (\n      (def as { readonly?: boolean }).readonly === true ||\n      meta?.readonly === true\n    ) {\n      names.push(name);\n    }\n  }\n  return names;\n}\n\n/** Mirror of sveltekit-generator.ts `getApiWritableAllowlist`. */\nfunction getApiWritableAllowlist(apiConfig: unknown): string[] | null {\n  const config = getApiConfigObject(apiConfig);\n  return Array.isArray(config?.writable) ? config.writable : null;\n}\n\n/**\n * Collect the syncable targets from a manifest: non-collection objects whose\n * API config is enabled and exposes at least one mutating action.\n */\nexport function collectSyncApplyTargets(\n  manifest: SmartObjectManifest,\n): SyncTargetSpec[] {\n  const targets: SyncTargetSpec[] = [];\n\n  for (const [className, objectDef] of Object.entries(manifest.objects)) {\n    if (isCollectionManifestClass(manifest, objectDef)) continue;\n    // The framework's own abstract base classes are scaffolding, not\n    // resources — never make them a sync-apply target, regardless of\n    // config (#2642).\n    if (isFrameworkBaseClass(objectDef.className, objectDef.packageName)) {\n      continue;\n    }\n\n    const apiConfig = objectDef.decoratorConfig?.api;\n    if (apiConfig === false) continue;\n\n    const ops = resolveMutatingActions(apiConfig);\n    if (ops.length === 0) continue;\n\n    if (!objectDef.collection) continue;\n\n    targets.push({\n      segment: objectDef.collection,\n      registryKey: className,\n      ops,\n      readonlyFields: collectReadonlyFieldNames(objectDef),\n      writableAllowlist: getApiWritableAllowlist(apiConfig),\n      publicAccess: getApiPublicAccess(apiConfig),\n      tenantScoped: !!objectDef.decoratorConfig?.tenantScoped,\n    });\n  }\n\n  return targets.sort((a, b) => a.segment.localeCompare(b.segment));\n}\n\nfunction serializeTargets(targets: SyncTargetSpec[]): string {\n  const entries = targets.map((target) => {\n    const fields = [\n      `registryKey: ${JSON.stringify(target.registryKey)}`,\n      `ops: ${JSON.stringify(target.ops)}`,\n      `readonlyFields: ${JSON.stringify(target.readonlyFields)}`,\n      `writableAllowlist: ${JSON.stringify(target.writableAllowlist)}`,\n      `publicAccess: ${JSON.stringify(target.publicAccess)}`,\n    ];\n    return `  ${JSON.stringify(target.segment)}: {\\n    ${fields.join(',\\n    ')},\\n  },`;\n  });\n  return `{\\n${entries.join('\\n')}\\n}`;\n}\n\n/**\n * Render the generated `+server.ts` content for the sync-apply route.\n * Exported for tests.\n */\nexport function generateSyncApplyRouteTemplate(\n  targets: SyncTargetSpec[],\n  configImport: string,\n): string {\n  const anyTenantScoped = targets.some((target) => target.tenantScoped);\n\n  const tenantHelper = anyTenantScoped\n    ? `\nimport { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenancy';\n\nfunction establishTenantContext(locals: unknown): void {\n  if (hasTenantContext()) return;\n  if (!locals || typeof locals !== 'object') return;\n  const l = locals as Record<string, unknown>;\n  const user = l.user as Record<string, unknown> | undefined;\n  const session = l.session as Record<string, unknown> | undefined;\n  const tenantId = l.tenantId ?? user?.tenantId ?? session?.tenantId;\n  if (typeof tenantId === 'string' && tenantId) {\n    enterTenantContext({ tenantId });\n  }\n}\n`\n    : '';\n\n  return `${AUTO_GENERATED_ROUTE_HEADER}\n// DO NOT EDIT - changes will be overwritten\n//\n// Idempotent sync-apply batch write contract (#1759) — the shared write path\n// for the web offline outbox (#1762) and the KMP mobile write queue (#1739).\n// Contract: docs/content/architecture/sync-apply-contract.md\n\nimport {\n  applySyncWritablePolicy,\n  processSyncApplyBatch,\n  type SyncApplyOp,\n  type SyncApplyTarget,\n} from '@happyvertical/smrt-core';\nimport { json } from '@sveltejs/kit';\nimport { getCollection } from '${configImport}';\nimport type { RequestHandler } from './$types';\n${tenantHelper}\ninterface SyncTargetConfig {\n  /** Manifest registry key (may be package-qualified), as CRUD routes use. */\n  registryKey: string;\n  ops: SyncApplyOp[];\n  readonlyFields: string[];\n  writableAllowlist: string[] | null;\n  publicAccess: boolean | 'read';\n}\n\n// One entry per syncable model, keyed by the collection route segment its\n// generated CRUD routes use.\nconst SYNC_TARGETS: Record<string, SyncTargetConfig> = ${serializeTargets(targets)};\n\n// Fail-closed authorization (#1540): sync mutations require an authenticated\n// principal on \\`locals\\` unless the target model is \\`api: { public: true }\\`.\nfunction hasAuthenticatedPrincipal(locals: unknown): boolean {\n  if (!locals || typeof locals !== 'object') return false;\n  const l = locals as Record<string, unknown>;\n  const isResolvedPrincipal = (v: unknown) =>\n    typeof v === 'object' && v !== null;\n  return (\n    isResolvedPrincipal(l.user) ||\n    isResolvedPrincipal(l.session) ||\n    l.smrtAuth === true\n  );\n}\n\nexport const POST: RequestHandler = async ({ locals, request }) => {\n  const authenticated = hasAuthenticatedPrincipal(locals);\n${anyTenantScoped ? '  establishTenantContext(locals);\\n' : ''}\n  let body: unknown;\n  try {\n    body = await request.json();\n  } catch {\n    return json(\n      { error: { code: 'invalid_batch', message: 'Invalid JSON body' } },\n      { status: 400 },\n    );\n  }\n\n  const outcome = await processSyncApplyBatch(body, {\n    resolveTarget: async (segment: string): Promise<SyncApplyTarget | null> => {\n      const target = SYNC_TARGETS[segment];\n      if (!target) return null;\n      // The verbatim manifest key, exactly as the generated CRUD routes pass\n      // it — package-qualified keys stay qualified so same-simple-name\n      // classes across packages resolve unambiguously.\n      const collection = await getCollection(target.registryKey);\n      return {\n        objectName: target.registryKey,\n        collection,\n        isOpAllowed: (op: SyncApplyOp) => target.ops.includes(op),\n        authorize: () =>\n          authenticated || target.publicAccess === true\n            ? ('ok' as const)\n            : ('auth_required' as const),\n        prepare: (payload: Record<string, unknown>) =>\n          applySyncWritablePolicy(payload, {\n            readonlyFields: target.readonlyFields,\n            writableAllowlist: target.writableAllowlist,\n          }),\n      };\n    },\n  });\n\n  return json(outcome.body, { status: outcome.status });\n};\n`;\n}\n\n/**\n * Generate `{routesDir}/sync/apply/+server.ts` for the manifest's syncable\n * models. Returns true when a route was written. Skips generation (with a\n * warning) if a non-generated file already occupies the path, and writes\n * nothing when the manifest has no syncable models.\n */\nexport function generateSyncApplyRoute(\n  projectRoot: string,\n  manifest: SmartObjectManifest,\n  options: SvelteKitOptions,\n): boolean {\n  const targets = collectSyncApplyTargets(manifest);\n  if (targets.length === 0) {\n    return false;\n  }\n\n  const routeDir = join(projectRoot, options.routesDir, 'sync', 'apply');\n  const routePath = join(routeDir, '+server.ts');\n\n  if (existsSync(routePath)) {\n    const existing = readFileSync(routePath, 'utf-8');\n    if (!existing.startsWith(AUTO_GENERATED_ROUTE_HEADER)) {\n      console.warn(\n        `[smrt] Skipping sync-apply route - ${routePath} exists and is not generated`,\n      );\n      return false;\n    }\n  }\n\n  if (!existsSync(routeDir)) {\n    mkdirSync(routeDir, { recursive: true });\n  }\n\n  writeFileSync(\n    routePath,\n    generateSyncApplyRouteTemplate(\n      targets,\n      resolveSvelteKitConfigImport(projectRoot, routeDir, options),\n    ),\n    'utf-8',\n  );\n  console.log(`[smrt] Generated: ${routePath}`);\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAM,mBAAmB;CAAC;CAAU;CAAU;AAAQ;AAsBtD,SAAS,mBAAmB,WAAsC;CAChE,IAAI,CAAC,aAAa,OAAO,cAAc,UACrC,OAAO;CAET,OAAO;AACT;;;;;;AAOA,SAAS,uBAAuB,WAAsC;CACpE,IAAI,cAAc,OAAO,OAAO,CAAC;CACjC,IACE,cAAc,QACd,cAAc,KAAA,KACd,OAAO,cAAc,UAErB,OAAO,CAAC,GAAG,gBAAgB;CAG7B,MAAM,SAAS;CACf,IAAI,UAA4B,MAAM,QAAQ,OAAO,OAAO,IACxD,iBAAiB,QAAQ,WAAW,OAAO,SAAS,SAAS,MAAM,CAAC,IACpE,CAAC,GAAG,gBAAgB;CACxB,IAAI,MAAM,QAAQ,OAAO,OAAO,GAAG;EACjC,MAAM,WAAW,OAAO;EACxB,UAAU,QAAQ,QAAQ,WAAW,CAAC,SAAS,SAAS,MAAM,CAAC;CACjE;CACA,OAAO;AACT;;AAGA,SAAS,mBAAmB,WAAsC;CAEhE,MAAM,QADS,mBAAmB,SACpB,CAAA,EAAQ;CACtB,IAAI,UAAU,QAAQ,UAAU,QAC9B,OAAO;CAET,OAAO;AACT;;AAGA,SAAS,0BAA0B,WAA4C;CAC7E,MAAM,SAAS,UAAU,UAAU,CAAC;CACpC,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,MAAM,GAAG;EAChD,MAAM,OAAQ,IAA4C;EAC1D,IACG,IAA+B,aAAa,QAC7C,MAAM,aAAa,MAEnB,MAAM,KAAK,IAAI;CAEnB;CACA,OAAO;AACT;;AAGA,SAAS,wBAAwB,WAAqC;CACpE,MAAM,SAAS,mBAAmB,SAAS;CAC3C,OAAO,MAAM,QAAQ,QAAQ,QAAQ,IAAI,OAAO,WAAW;AAC7D;;;;;AAMA,SAAgB,wBACd,UACkB;CAClB,MAAM,UAA4B,CAAC;CAEnC,KAAK,MAAM,CAAC,WAAW,cAAc,OAAO,QAAQ,SAAS,OAAO,GAAG;EACrE,IAAI,0BAA0B,UAAU,SAAS,GAAG;EAIpD,IAAI,qBAAqB,UAAU,WAAW,UAAU,WAAW,GACjE;EAGF,MAAM,YAAY,UAAU,iBAAiB;EAC7C,IAAI,cAAc,OAAO;EAEzB,MAAM,MAAM,uBAAuB,SAAS;EAC5C,IAAI,IAAI,WAAW,GAAG;EAEtB,IAAI,CAAC,UAAU,YAAY;EAE3B,QAAQ,KAAK;GACX,SAAS,UAAU;GACnB,aAAa;GACb;GACA,gBAAgB,0BAA0B,SAAS;GACnD,mBAAmB,wBAAwB,SAAS;GACpD,cAAc,mBAAmB,SAAS;GAC1C,cAAc,CAAC,CAAC,UAAU,iBAAiB;EAC7C,CAAC;CACH;CAEA,OAAO,QAAQ,MAAM,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;AAClE;AAEA,SAAS,iBAAiB,SAAmC;CAW3D,OAAO,MAVS,QAAQ,KAAK,WAAW;EACtC,MAAM,SAAS;GACb,gBAAgB,KAAK,UAAU,OAAO,WAAW;GACjD,QAAQ,KAAK,UAAU,OAAO,GAAG;GACjC,mBAAmB,KAAK,UAAU,OAAO,cAAc;GACvD,sBAAsB,KAAK,UAAU,OAAO,iBAAiB;GAC7D,iBAAiB,KAAK,UAAU,OAAO,YAAY;EACrD;EACA,OAAO,KAAK,KAAK,UAAU,OAAO,OAAO,EAAE,WAAW,OAAO,KAAK,SAAS,EAAE;CAC/E,CACa,CAAA,CAAQ,KAAK,IAAI,EAAE;AAClC;;;;;AAMA,SAAgB,+BACd,SACA,cACQ;CACR,MAAM,kBAAkB,QAAQ,MAAM,WAAW,OAAO,YAAY;CAoBpE,OAAO,GAAG,4BAA4B;;;;;;;;;;;;;;iCAcP,aAAa;;EAhCvB,kBACjB;;;;;;;;;;;;;;IAeA,GAkBS;;;;;;;;;;;;yDAY0C,iBAAiB,OAAO,EAAE;;;;;;;;;;;;;;;;;;EAkBjF,kBAAkB,wCAAwC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuC/D;;;;;;;AAQA,SAAgB,uBACd,aACA,UACA,SACS;CACT,MAAM,UAAU,wBAAwB,QAAQ;CAChD,IAAI,QAAQ,WAAW,GACrB,OAAO;CAGT,MAAM,WAAW,KAAK,aAAa,QAAQ,WAAW,QAAQ,OAAO;CACrE,MAAM,YAAY,KAAK,UAAU,YAAY;CAE7C,IAAI,WAAW,SAAS;MAElB,CADa,aAAa,WAAW,OACpC,CAAA,CAAS,WAAA,6CAAsC,GAAG;GACrD,QAAQ,KACN,sCAAsC,UAAU,6BAClD;GACA,OAAO;EACT;;CAGF,IAAI,CAAC,WAAW,QAAQ,GACtB,UAAU,UAAU,EAAE,WAAW,KAAK,CAAC;CAGzC,cACE,WACA,+BACE,SACA,6BAA6B,aAAa,UAAU,OAAO,CAC7D,GACA,OACF;CACA,QAAQ,IAAI,qBAAqB,WAAW;CAC5C,OAAO;AACT"}
+{"version":3,"file":"sync-apply-route.js","names":[],"sources":["../../src/vite-plugin/sync-apply-route.ts"],"sourcesContent":["/**\n * SvelteKit generator for the sync-apply batch write route (#1759).\n *\n * Emits ONE route — `{routesDir}/sync/apply/+server.ts` — implementing the\n * shared web/mobile write contract for every syncable model in the manifest\n * (models whose API config exposes at least one of create/update/delete). The\n * generated file is deliberately thin: it maps `object` segments to\n * collections plus per-model policy data, and delegates all batch processing\n * to `processSyncApplyBatch` from `@happyvertical/smrt-core` — the same\n * engine the runtime REST generator uses, so the two transports cannot drift.\n *\n * This lives in its own module (rather than sveltekit-generator.ts) so the\n * shared generator file only needs a one-line registration hook; sibling\n * work (#1757, #1758) touches the same generator files in parallel.\n *\n * Contract documentation: docs/content/architecture/sync-apply-contract.md\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { isFrameworkBaseClass } from '../registry/framework-base-classes.js';\nimport type { ApiConfig } from '../registry/types.js';\nimport type {\n  SmartObjectDefinition,\n  SmartObjectManifest,\n} from '../scanner/types';\nimport { AUTO_GENERATED_ROUTE_HEADER } from './route-header.js';\nimport { resolveSvelteKitConfigImport } from './sveltekit-config-import.js';\nimport type { SvelteKitOptions } from './sveltekit-generator.js';\nimport { isCollectionManifestClass } from './web-collections.js';\n\nconst MUTATING_ACTIONS = ['create', 'update', 'delete'] as const;\n\ntype MutatingAction = (typeof MUTATING_ACTIONS)[number];\n\n/** Per-model data embedded into the generated route. */\ninterface SyncTargetSpec {\n  segment: string;\n  /**\n   * The manifest registry key, passed VERBATIM to `getCollection()` exactly\n   * as the generated CRUD routes do. May be package-qualified\n   * (`@happyvertical/smrt-ledgers:Account`) — collapsing it to a simple class\n   * name would resolve ambiguously when two loaded packages declare the same\n   * simple name.\n   */\n  registryKey: string;\n  /**\n   * `<collection>` prefix of the `<collection>.<action>` operation permission\n   * the mirrored generated write routes require (#2977) — the same\n   * `decoratorConfig.collection ?? collection` resolution as\n   * sveltekit-generator.ts `resolvePermissionCollection`.\n   */\n  permissionCollection: string;\n  ops: MutatingAction[];\n  readonlyFields: string[];\n  writableAllowlist: string[] | null;\n  publicAccess: boolean | 'read';\n  tenantScoped: boolean;\n}\n\nfunction getApiConfigObject(apiConfig: unknown): ApiConfig | null {\n  if (!apiConfig || typeof apiConfig !== 'object') {\n    return null;\n  }\n  return apiConfig as ApiConfig;\n}\n\n/**\n * Mirror of sveltekit-generator.ts `resolveStandardCrudActions`, narrowed to\n * the mutating subset the sync contract can carry. Kept local so this module\n * needs no exports added to the (parallel-edited) shared generator file.\n */\nfunction resolveMutatingActions(apiConfig: unknown): MutatingAction[] {\n  if (apiConfig === false) return [];\n  if (\n    apiConfig === true ||\n    apiConfig === undefined ||\n    typeof apiConfig !== 'object'\n  ) {\n    return [...MUTATING_ACTIONS];\n  }\n\n  const config = apiConfig as { include?: string[]; exclude?: string[] };\n  let actions: MutatingAction[] = Array.isArray(config.include)\n    ? MUTATING_ACTIONS.filter((action) => config.include?.includes(action))\n    : [...MUTATING_ACTIONS];\n  if (Array.isArray(config.exclude)) {\n    const excluded = config.exclude;\n    actions = actions.filter((action) => !excluded.includes(action));\n  }\n  return actions;\n}\n\n/** Mirror of sveltekit-generator.ts `getApiPublicAccess` (fail-closed). */\nfunction getApiPublicAccess(apiConfig: unknown): boolean | 'read' {\n  const config = getApiConfigObject(apiConfig);\n  const value = config?.public;\n  if (value === true || value === 'read') {\n    return value;\n  }\n  return false;\n}\n\n/** Mirror of sveltekit-generator.ts `collectReadonlyFieldNames` (#1540, 2b). */\nfunction collectReadonlyFieldNames(objectDef: SmartObjectDefinition): string[] {\n  const fields = objectDef.fields || {};\n  const names: string[] = [];\n  for (const [name, def] of Object.entries(fields)) {\n    const meta = (def as { _meta?: Record<string, unknown> })._meta;\n    if (\n      (def as { readonly?: boolean }).readonly === true ||\n      meta?.readonly === true\n    ) {\n      names.push(name);\n    }\n  }\n  return names;\n}\n\n/** Mirror of sveltekit-generator.ts `getApiWritableAllowlist`. */\nfunction getApiWritableAllowlist(apiConfig: unknown): string[] | null {\n  const config = getApiConfigObject(apiConfig);\n  return Array.isArray(config?.writable) ? config.writable : null;\n}\n\n/** Mirror of sveltekit-generator.ts `resolvePermissionCollection` (#2977). */\nfunction resolvePermissionCollection(objectDef: SmartObjectDefinition): string {\n  const configured = (\n    objectDef.decoratorConfig as { collection?: unknown } | undefined\n  )?.collection;\n  return typeof configured === 'string' && configured.length > 0\n    ? configured\n    : objectDef.collection;\n}\n\n/**\n * Collect the syncable targets from a manifest: non-collection objects whose\n * API config is enabled and exposes at least one mutating action.\n */\nexport function collectSyncApplyTargets(\n  manifest: SmartObjectManifest,\n): SyncTargetSpec[] {\n  const targets: SyncTargetSpec[] = [];\n\n  for (const [className, objectDef] of Object.entries(manifest.objects)) {\n    if (isCollectionManifestClass(manifest, objectDef)) continue;\n    // The framework's own abstract base classes are scaffolding, not\n    // resources — never make them a sync-apply target, regardless of\n    // config (#2642).\n    if (isFrameworkBaseClass(objectDef.className, objectDef.packageName)) {\n      continue;\n    }\n\n    const apiConfig = objectDef.decoratorConfig?.api;\n    if (apiConfig === false) continue;\n\n    const ops = resolveMutatingActions(apiConfig);\n    if (ops.length === 0) continue;\n\n    if (!objectDef.collection) continue;\n\n    targets.push({\n      segment: objectDef.collection,\n      registryKey: className,\n      permissionCollection: resolvePermissionCollection(objectDef),\n      ops,\n      readonlyFields: collectReadonlyFieldNames(objectDef),\n      writableAllowlist: getApiWritableAllowlist(apiConfig),\n      publicAccess: getApiPublicAccess(apiConfig),\n      tenantScoped: !!objectDef.decoratorConfig?.tenantScoped,\n    });\n  }\n\n  return targets.sort((a, b) => a.segment.localeCompare(b.segment));\n}\n\nfunction serializeTargets(targets: SyncTargetSpec[]): string {\n  const entries = targets.map((target) => {\n    const fields = [\n      `registryKey: ${JSON.stringify(target.registryKey)}`,\n      `permissionCollection: ${JSON.stringify(target.permissionCollection)}`,\n      `ops: ${JSON.stringify(target.ops)}`,\n      `readonlyFields: ${JSON.stringify(target.readonlyFields)}`,\n      `writableAllowlist: ${JSON.stringify(target.writableAllowlist)}`,\n      `publicAccess: ${JSON.stringify(target.publicAccess)}`,\n    ];\n    return `  ${JSON.stringify(target.segment)}: {\\n    ${fields.join(',\\n    ')},\\n  },`;\n  });\n  return `{\\n${entries.join('\\n')}\\n}`;\n}\n\n/**\n * Render the generated `+server.ts` content for the sync-apply route.\n * Exported for tests.\n */\nexport function generateSyncApplyRouteTemplate(\n  targets: SyncTargetSpec[],\n  configImport: string,\n): string {\n  const anyTenantScoped = targets.some((target) => target.tenantScoped);\n\n  const tenantHelper = anyTenantScoped\n    ? `\nimport { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenancy';\n\nfunction establishTenantContext(locals: unknown): void {\n  if (hasTenantContext()) return;\n  if (!locals || typeof locals !== 'object') return;\n  const l = locals as Record<string, unknown>;\n  const user = l.user as Record<string, unknown> | undefined;\n  const session = l.session as Record<string, unknown> | undefined;\n  const tenantId = l.tenantId ?? user?.tenantId ?? session?.tenantId;\n  if (typeof tenantId === 'string' && tenantId) {\n    enterTenantContext({ tenantId });\n  }\n}\n`\n    : '';\n\n  return `${AUTO_GENERATED_ROUTE_HEADER}\n// DO NOT EDIT - changes will be overwritten\n//\n// Idempotent sync-apply batch write contract (#1759) — the shared write path\n// for the web offline outbox (#1762) and the KMP mobile write queue (#1739).\n// Contract: docs/content/architecture/sync-apply-contract.md\n\nimport {\n  applySyncWritablePolicy,\n  processSyncApplyBatch,\n  type SyncApplyOp,\n  type SyncApplyTarget,\n} from '@happyvertical/smrt-core';\nimport { json } from '@sveltejs/kit';\nimport { getCollection } from '${configImport}';\nimport type { RequestHandler } from './$types';\n${tenantHelper}\ninterface SyncTargetConfig {\n  /** Manifest registry key (may be package-qualified), as CRUD routes use. */\n  registryKey: string;\n  /** \\`<collection>\\` prefix of the required \\`<collection>.<op>\\` permission. */\n  permissionCollection: string;\n  ops: SyncApplyOp[];\n  readonlyFields: string[];\n  writableAllowlist: string[] | null;\n  publicAccess: boolean | 'read';\n}\n\n// One entry per syncable model, keyed by the collection route segment its\n// generated CRUD routes use.\nconst SYNC_TARGETS: Record<string, SyncTargetConfig> = ${serializeTargets(targets)};\n\n// Fail-closed authorization (#1540): sync mutations require an authenticated\n// principal on \\`locals\\` unless the target model is \\`api: { public: true }\\`.\nfunction hasAuthenticatedPrincipal(locals: unknown): boolean {\n  if (!locals || typeof locals !== 'object') return false;\n  const l = locals as Record<string, unknown>;\n  const isResolvedPrincipal = (v: unknown) =>\n    typeof v === 'object' && v !== null;\n  return (\n    isResolvedPrincipal(l.user) ||\n    isResolvedPrincipal(l.session) ||\n    l.smrtAuth === true\n  );\n}\n\nfunction readRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object'\n    ? (value as Record<string, unknown>)\n    : {};\n}\n\nfunction hasGrantedPermission(value: unknown, permission: string): boolean {\n  if (Array.isArray(value)) return value.includes(permission);\n  if (value instanceof Set) return value.has(permission);\n  return false;\n}\n\n// Fail-closed operation permission (#2977, #3011): each applied op requires\n// the same \\`<collection>.<op>\\` permission the mirrored generated write route\n// enforces, read from the principal's session permission snapshot. A missing\n// snapshot denies; only an explicit tenancy super-admin bypass skips it.\nfunction hasOperationPermission(\n  locals: unknown,\n  permissionCollection: string,\n  op: SyncApplyOp,\n): boolean {\n  const l = readRecord(locals);\n  const tenantContext = readRecord(l.tenantContext);\n  if (tenantContext.superAdminBypass === true) return true;\n  const permission = \\`\\${permissionCollection}.\\${op}\\`;\n  return (\n    hasGrantedPermission(l.permissions, permission) ||\n    hasGrantedPermission(l.permissionSet, permission) ||\n    hasGrantedPermission(l.smrtPermissions, permission) ||\n    hasGrantedPermission(tenantContext.permissions, permission)\n  );\n}\n\nexport const POST: RequestHandler = async ({ locals, request }) => {\n  const authenticated = hasAuthenticatedPrincipal(locals);\n${anyTenantScoped ? '  establishTenantContext(locals);\\n' : ''}\n  let body: unknown;\n  try {\n    body = await request.json();\n  } catch {\n    return json(\n      { error: { code: 'invalid_batch', message: 'Invalid JSON body' } },\n      { status: 400 },\n    );\n  }\n\n  const outcome = await processSyncApplyBatch(body, {\n    resolveTarget: async (segment: string): Promise<SyncApplyTarget | null> => {\n      const target = SYNC_TARGETS[segment];\n      if (!target) return null;\n      // The verbatim manifest key, exactly as the generated CRUD routes pass\n      // it — package-qualified keys stay qualified so same-simple-name\n      // classes across packages resolve unambiguously.\n      const collection = await getCollection(target.registryKey);\n      return {\n        objectName: target.registryKey,\n        collection,\n        isOpAllowed: (op: SyncApplyOp) => target.ops.includes(op),\n        authorize: (op: SyncApplyOp) => {\n          // \\`public: true\\` keeps its unauthenticated write semantics, as on\n          // the generated CRUD routes.\n          if (target.publicAccess === true) return 'ok' as const;\n          if (!authenticated) return 'auth_required' as const;\n          return hasOperationPermission(locals, target.permissionCollection, op)\n            ? ('ok' as const)\n            : ('forbidden' as const);\n        },\n        prepare: (payload: Record<string, unknown>) =>\n          applySyncWritablePolicy(payload, {\n            readonlyFields: target.readonlyFields,\n            writableAllowlist: target.writableAllowlist,\n          }),\n      };\n    },\n  });\n\n  return json(outcome.body, { status: outcome.status });\n};\n`;\n}\n\n/**\n * Generate `{routesDir}/sync/apply/+server.ts` for the manifest's syncable\n * models. Returns true when a route was written. Skips generation (with a\n * warning) if a non-generated file already occupies the path, and writes\n * nothing when the manifest has no syncable models.\n */\nexport function generateSyncApplyRoute(\n  projectRoot: string,\n  manifest: SmartObjectManifest,\n  options: SvelteKitOptions,\n): boolean {\n  const targets = collectSyncApplyTargets(manifest);\n  if (targets.length === 0) {\n    return false;\n  }\n\n  const routeDir = join(projectRoot, options.routesDir, 'sync', 'apply');\n  const routePath = join(routeDir, '+server.ts');\n\n  if (existsSync(routePath)) {\n    const existing = readFileSync(routePath, 'utf-8');\n    if (!existing.startsWith(AUTO_GENERATED_ROUTE_HEADER)) {\n      console.warn(\n        `[smrt] Skipping sync-apply route - ${routePath} exists and is not generated`,\n      );\n      return false;\n    }\n  }\n\n  if (!existsSync(routeDir)) {\n    mkdirSync(routeDir, { recursive: true });\n  }\n\n  writeFileSync(\n    routePath,\n    generateSyncApplyRouteTemplate(\n      targets,\n      resolveSvelteKitConfigImport(projectRoot, routeDir, options),\n    ),\n    'utf-8',\n  );\n  console.log(`[smrt] Generated: ${routePath}`);\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAM,mBAAmB;CAAC;CAAU;CAAU;AAAQ;AA6BtD,SAAS,mBAAmB,WAAsC;CAChE,IAAI,CAAC,aAAa,OAAO,cAAc,UACrC,OAAO;CAET,OAAO;AACT;;;;;;AAOA,SAAS,uBAAuB,WAAsC;CACpE,IAAI,cAAc,OAAO,OAAO,CAAC;CACjC,IACE,cAAc,QACd,cAAc,KAAA,KACd,OAAO,cAAc,UAErB,OAAO,CAAC,GAAG,gBAAgB;CAG7B,MAAM,SAAS;CACf,IAAI,UAA4B,MAAM,QAAQ,OAAO,OAAO,IACxD,iBAAiB,QAAQ,WAAW,OAAO,SAAS,SAAS,MAAM,CAAC,IACpE,CAAC,GAAG,gBAAgB;CACxB,IAAI,MAAM,QAAQ,OAAO,OAAO,GAAG;EACjC,MAAM,WAAW,OAAO;EACxB,UAAU,QAAQ,QAAQ,WAAW,CAAC,SAAS,SAAS,MAAM,CAAC;CACjE;CACA,OAAO;AACT;;AAGA,SAAS,mBAAmB,WAAsC;CAEhE,MAAM,QADS,mBAAmB,SACpB,CAAA,EAAQ;CACtB,IAAI,UAAU,QAAQ,UAAU,QAC9B,OAAO;CAET,OAAO;AACT;;AAGA,SAAS,0BAA0B,WAA4C;CAC7E,MAAM,SAAS,UAAU,UAAU,CAAC;CACpC,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,MAAM,GAAG;EAChD,MAAM,OAAQ,IAA4C;EAC1D,IACG,IAA+B,aAAa,QAC7C,MAAM,aAAa,MAEnB,MAAM,KAAK,IAAI;CAEnB;CACA,OAAO;AACT;;AAGA,SAAS,wBAAwB,WAAqC;CACpE,MAAM,SAAS,mBAAmB,SAAS;CAC3C,OAAO,MAAM,QAAQ,QAAQ,QAAQ,IAAI,OAAO,WAAW;AAC7D;;AAGA,SAAS,4BAA4B,WAA0C;CAC7E,MAAM,aACJ,UAAU,iBACT;CACH,OAAO,OAAO,eAAe,YAAY,WAAW,SAAS,IACzD,aACA,UAAU;AAChB;;;;;AAMA,SAAgB,wBACd,UACkB;CAClB,MAAM,UAA4B,CAAC;CAEnC,KAAK,MAAM,CAAC,WAAW,cAAc,OAAO,QAAQ,SAAS,OAAO,GAAG;EACrE,IAAI,0BAA0B,UAAU,SAAS,GAAG;EAIpD,IAAI,qBAAqB,UAAU,WAAW,UAAU,WAAW,GACjE;EAGF,MAAM,YAAY,UAAU,iBAAiB;EAC7C,IAAI,cAAc,OAAO;EAEzB,MAAM,MAAM,uBAAuB,SAAS;EAC5C,IAAI,IAAI,WAAW,GAAG;EAEtB,IAAI,CAAC,UAAU,YAAY;EAE3B,QAAQ,KAAK;GACX,SAAS,UAAU;GACnB,aAAa;GACb,sBAAsB,4BAA4B,SAAS;GAC3D;GACA,gBAAgB,0BAA0B,SAAS;GACnD,mBAAmB,wBAAwB,SAAS;GACpD,cAAc,mBAAmB,SAAS;GAC1C,cAAc,CAAC,CAAC,UAAU,iBAAiB;EAC7C,CAAC;CACH;CAEA,OAAO,QAAQ,MAAM,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;AAClE;AAEA,SAAS,iBAAiB,SAAmC;CAY3D,OAAO,MAXS,QAAQ,KAAK,WAAW;EACtC,MAAM,SAAS;GACb,gBAAgB,KAAK,UAAU,OAAO,WAAW;GACjD,yBAAyB,KAAK,UAAU,OAAO,oBAAoB;GACnE,QAAQ,KAAK,UAAU,OAAO,GAAG;GACjC,mBAAmB,KAAK,UAAU,OAAO,cAAc;GACvD,sBAAsB,KAAK,UAAU,OAAO,iBAAiB;GAC7D,iBAAiB,KAAK,UAAU,OAAO,YAAY;EACrD;EACA,OAAO,KAAK,KAAK,UAAU,OAAO,OAAO,EAAE,WAAW,OAAO,KAAK,SAAS,EAAE;CAC/E,CACa,CAAA,CAAQ,KAAK,IAAI,EAAE;AAClC;;;;;AAMA,SAAgB,+BACd,SACA,cACQ;CACR,MAAM,kBAAkB,QAAQ,MAAM,WAAW,OAAO,YAAY;CAoBpE,OAAO,GAAG,4BAA4B;;;;;;;;;;;;;;iCAcP,aAAa;;EAhCvB,kBACjB;;;;;;;;;;;;;;IAeA,GAkBS;;;;;;;;;;;;;;yDAc0C,iBAAiB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmDjF,kBAAkB,wCAAwC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4C/D;;;;;;;AAQA,SAAgB,uBACd,aACA,UACA,SACS;CACT,MAAM,UAAU,wBAAwB,QAAQ;CAChD,IAAI,QAAQ,WAAW,GACrB,OAAO;CAGT,MAAM,WAAW,KAAK,aAAa,QAAQ,WAAW,QAAQ,OAAO;CACrE,MAAM,YAAY,KAAK,UAAU,YAAY;CAE7C,IAAI,WAAW,SAAS;MAElB,CADa,aAAa,WAAW,OACpC,CAAA,CAAS,WAAA,6CAAsC,GAAG;GACrD,QAAQ,KACN,sCAAsC,UAAU,6BAClD;GACA,OAAO;EACT;;CAGF,IAAI,CAAC,WAAW,QAAQ,GACtB,UAAU,UAAU,EAAE,WAAW,KAAK,CAAC;CAGzC,cACE,WACA,+BACE,SACA,6BAA6B,aAAa,UAAU,OAAO,CAC7D,GACA,OACF;CACA,QAAQ,IAAI,qBAAqB,WAAW;CAC5C,OAAO;AACT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-core",
-  "version": "0.51.10",
+  "version": "0.51.14",
   "description": "Core AI agent framework with standardized collections, object-relational mapping, and code generators",
   "author": "HappyVertical",
   "type": "module",
@@ -150,26 +150,26 @@
     }
   },
   "dependencies": {
-    "@happyvertical/ai": "^0.89.11",
-    "@happyvertical/files": "^0.89.11",
-    "@happyvertical/json": "^0.89.11",
-    "@happyvertical/logger": "^0.89.11",
-    "@happyvertical/smrt-config": "0.51.10",
-    "@happyvertical/smrt-scanner": "0.51.10",
-    "@happyvertical/smrt-types": "0.51.10",
-    "@happyvertical/sql": "^0.89.11",
-    "@happyvertical/utils": "^0.89.11",
-    "@oxc-project/runtime": "^0.138.0",
+    "@happyvertical/ai": "^0.89.12",
+    "@happyvertical/files": "^0.89.12",
+    "@happyvertical/json": "^0.89.12",
+    "@happyvertical/logger": "^0.89.12",
+    "@happyvertical/smrt-config": "0.51.14",
+    "@happyvertical/smrt-scanner": "0.51.14",
+    "@happyvertical/smrt-types": "0.51.14",
+    "@happyvertical/sql": "^0.89.12",
+    "@happyvertical/utils": "^0.89.12",
+    "@oxc-project/runtime": "^0.150.0",
     "cheerio": "^1.2.0",
     "fast-glob": "3.3.3",
-    "minimatch": "10.2.5",
-    "oxc-transform": "0.138.0",
+    "minimatch": "10.2.6",
+    "oxc-transform": "0.150.0",
     "pluralize": "^8.0.0",
-    "tsx": "^4.23.0",
-    "yaml": "^2.9.0"
+    "tsx": "^4.23.13",
+    "yaml": "^2.9.1"
   },
   "peerDependencies": {
-    "@huggingface/transformers": ">=3.0.0 <4.0.0",
+    "@huggingface/transformers": ">=3.0.0 <5.0.0",
     "@xenova/transformers": "^2.17.2"
   },
   "peerDependenciesMeta": {
@@ -181,18 +181,18 @@
     }
   },
   "devDependencies": {
-    "@faker-js/faker": "^10.5.0",
-    "@huggingface/transformers": "^3.8.1",
-    "@sveltejs/kit": "^2.69.3",
-    "@sveltejs/vite-plugin-svelte": "^7.1.2",
-    "@types/node": "24.13.2",
+    "@faker-js/faker": "^10.6.0",
+    "@huggingface/transformers": "^4.3.0",
+    "@sveltejs/kit": "2.69.3",
+    "@sveltejs/vite-plugin-svelte": "^7.3.0",
+    "@types/node": "24.13.6",
     "@types/pluralize": "^0.0.33",
     "@xenova/transformers": "^2.17.2",
-    "svelte": "^5.56.4",
+    "svelte": "^5.57.1",
     "svelte-check": "4.7.6",
     "typescript": "5.9.3",
     "vite": "8.1.4",
-    "vite-plugin-dts": "4.5.4",
+    "vite-plugin-dts": "5.1.0",
     "vitest": "4.1.10"
   },
   "publishConfig": {