@happyvertical/smrt-core 0.57.46 → 0.57.48

package/dist/vite-plugin/sync-apply-route.d.ts

@@ -46,6 +46,22 @@ interface SyncTargetSpec {
 /**
  * Collect the syncable targets from a manifest: non-collection objects whose
  * API config is enabled and exposes at least one mutating action.
+ *
+ * `SYNC_TARGETS` is keyed by segment, so exactly ONE model owns each segment
+ * (#2807). Several models can share a `collection` (an STI family, or two
+ * unrelated models); emitting one entry per model made the generated object
+ * literal's last duplicate key win, i.e. manifest scan order. The owner uses
+ * the tie rule of the web collection definitions (`selectWebCollectionEntries`)
+ * over models that expose a mutating op: the STI base model beats its
+ * children, and otherwise the first candidate in deterministic
+ * qualified-identity order ({@link orderedManifestObjectEntries}) wins.
+ *
+ * An STI child never owns a segment whose API-enabled base shares it, even
+ * when that base exposes no mutating op: the base's (narrower) policy decides,
+ * so the segment then has no sync target (fail closed). Candidate sets differ
+ * from the web selector's (`list`) and from CRUD route emission (last writer
+ * per route file, #2754), so with unrelated models sharing a segment the sync
+ * owner can differ from those owners; it is deterministic either way.
  */
 export declare function collectSyncApplyTargets(manifest: SmartObjectManifest): SyncTargetSpec[];
 /**

package/dist/vite-plugin/sync-apply-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync-apply-route.d.ts","sourceRoot":"","sources":["../../src/vite-plugin/sync-apply-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,qBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,QAAA,MAAM,gBAAgB,yCAA0C,CAAC;AAEjE,KAAK,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD,wDAAwD;AACxD,UAAU,cAAc;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,GAAG,EAAE,cAAc,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,YAAY,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B,YAAY,EAAE,OAAO,CAAC;CACvB;AA8ED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,mBAAmB,GAC5B,cAAc,EAAE,CAiClB;AAiBD;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,cAAc,EAAE,EACzB,uBAAuB,EAAE,MAAM,GAC9B,MAAM,CA4JR;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAmCT"}
+{"version":3,"file":"sync-apply-route.d.ts","sourceRoot":"","sources":["../../src/vite-plugin/sync-apply-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,qBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AASjE,QAAA,MAAM,gBAAgB,yCAA0C,CAAC;AAEjE,KAAK,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD,wDAAwD;AACxD,UAAU,cAAc;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,GAAG,EAAE,cAAc,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,YAAY,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B,YAAY,EAAE,OAAO,CAAC;CACvB;AAyGD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,mBAAmB,GAC5B,cAAc,EAAE,CA4ClB;AAiBD;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,cAAc,EAAE,EACzB,uBAAuB,EAAE,MAAM,GAC9B,MAAM,CA4JR;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAmCT"}

package/dist/vite-plugin/sync-apply-route.js

@@ -1,7 +1,7 @@
 import { isFrameworkBaseClass } from "../registry/framework-base-classes.js";
 import { AUTO_GENERATED_ROUTE_HEADER } from "./route-header.js";
 import { generateCollectionAccessImports } from "./sveltekit-config-import.js";
-import { isCollectionManifestClass } from "./web-collections.js";
+import { compareText, findManifestObjectByName, isCollectionManifestClass, isStiChildModel, orderedManifestObjectEntries } from "./web-collections.js";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 //#region src/vite-plugin/sync-apply-route.ts
@@ -75,20 +75,58 @@ function resolvePermissionCollection(objectDef) {
 	return typeof configured === "string" && configured.length > 0 ? configured : objectDef.collection;
 }
 /**
+* True when an ancestor sharing `objectDef`'s collection (its STI base) is in
+* the manifest with its API enabled. Such a base owns the segment.
+*/
+function hasApiEnabledStiBase(manifest, objectDef) {
+	const seen = /* @__PURE__ */ new Set();
+	let child = objectDef;
+	let parentName = child.extendsQualified || child.extends;
+	while (parentName && !seen.has(parentName)) {
+		seen.add(parentName);
+		const parent = findManifestObjectByName(manifest, parentName, child);
+		if (!parent || parent.collection !== objectDef.collection) return false;
+		if (parent.decoratorConfig?.api !== false && !isFrameworkBaseClass(parent.className, parent.packageName)) return true;
+		child = parent;
+		parentName = parent.extendsQualified || parent.extends;
+	}
+	return false;
+}
+/**
 * Collect the syncable targets from a manifest: non-collection objects whose
 * API config is enabled and exposes at least one mutating action.
+*
+* `SYNC_TARGETS` is keyed by segment, so exactly ONE model owns each segment
+* (#2807). Several models can share a `collection` (an STI family, or two
+* unrelated models); emitting one entry per model made the generated object
+* literal's last duplicate key win, i.e. manifest scan order. The owner uses
+* the tie rule of the web collection definitions (`selectWebCollectionEntries`)
+* over models that expose a mutating op: the STI base model beats its
+* children, and otherwise the first candidate in deterministic
+* qualified-identity order ({@link orderedManifestObjectEntries}) wins.
+*
+* An STI child never owns a segment whose API-enabled base shares it, even
+* when that base exposes no mutating op: the base's (narrower) policy decides,
+* so the segment then has no sync target (fail closed). Candidate sets differ
+* from the web selector's (`list`) and from CRUD route emission (last writer
+* per route file, #2754), so with unrelated models sharing a segment the sync
+* owner can differ from those owners; it is deterministic either way.
 */
 function collectSyncApplyTargets(manifest) {
-	const targets = [];
-	for (const [className, objectDef] of Object.entries(manifest.objects)) {
+	const bySegment = /* @__PURE__ */ new Map();
+	for (const [className, objectDef] of orderedManifestObjectEntries(manifest)) {
 		if (isCollectionManifestClass(manifest, objectDef)) continue;
 		if (isFrameworkBaseClass(objectDef.className, objectDef.packageName)) continue;
 		const apiConfig = objectDef.decoratorConfig?.api;
 		if (apiConfig === false) continue;
+		if (!objectDef.collection) continue;
+		if (hasApiEnabledStiBase(manifest, objectDef)) continue;
 		const ops = resolveMutatingActions(apiConfig);
 		if (ops.length === 0) continue;
-		if (!objectDef.collection) continue;
-		targets.push({
+		const isStiChild = isStiChildModel(manifest, objectDef);
+		const existing = bySegment.get(objectDef.collection);
+		if (existing && !(existing.isStiChild && !isStiChild)) continue;
+		const target = {
 			segment: objectDef.collection,
 			registryKey: className,
 			permissionCollection: resolvePermissionCollection(objectDef),
@@ -97,9 +135,13 @@ function collectSyncApplyTargets(manifest) {
 			writableAllowlist: getApiWritableAllowlist(apiConfig),
 			publicAccess: getApiPublicAccess(apiConfig),
 			tenantScoped: !!objectDef.decoratorConfig?.tenantScoped
+		};
+		bySegment.set(objectDef.collection, {
+			target,
+			isStiChild
 		});
 	}
-	return targets.sort((a, b) => a.segment.localeCompare(b.segment));
+	return [...bySegment.values()].map(({ target }) => target).sort((a, b) => compareText(a.segment, b.segment));
 }
 function serializeTargets(targets) {
 	return `{\n${targets.map((target) => {

package/dist/vite-plugin/sync-apply-route.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync-apply-route.js","names":[],"sources":["../../src/vite-plugin/sync-apply-route.ts"],"sourcesContent":["/**\n * SvelteKit generator for the sync-apply batch write route (#1759).\n *\n * Emits ONE route — `{routesDir}/sync/apply/+server.ts` — implementing the\n * shared web/mobile write contract for every syncable model in the manifest\n * (models whose API config exposes at least one of create/update/delete). The\n * generated file is deliberately thin: it maps `object` segments to\n * collections plus per-model policy data, and delegates all batch processing\n * to `processSyncApplyBatch` from `@happyvertical/smrt-core` — the same\n * engine the runtime REST generator uses, so the two transports cannot drift.\n *\n * This lives in its own module (rather than sveltekit-generator.ts) so the\n * shared generator file only needs a one-line registration hook; sibling\n * work (#1757, #1758) touches the same generator files in parallel.\n *\n * Contract documentation: docs/content/architecture/sync-apply-contract.md\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { isFrameworkBaseClass } from '../registry/framework-base-classes.js';\nimport type { ApiConfig } from '../registry/types.js';\nimport type {\n  SmartObjectDefinition,\n  SmartObjectManifest,\n} from '../scanner/types';\nimport { AUTO_GENERATED_ROUTE_HEADER } from './route-header.js';\nimport { generateCollectionAccessImports } from './sveltekit-config-import.js';\nimport type { SvelteKitOptions } from './sveltekit-generator.js';\nimport { isCollectionManifestClass } from './web-collections.js';\n\nconst MUTATING_ACTIONS = ['create', 'update', 'delete'] as const;\n\ntype MutatingAction = (typeof MUTATING_ACTIONS)[number];\n\n/** Per-model data embedded into the generated route. */\ninterface SyncTargetSpec {\n  segment: string;\n  /**\n   * The manifest registry key, passed VERBATIM to `getCollection()` exactly\n   * as the generated CRUD routes do. May be package-qualified\n   * (`@happyvertical/smrt-ledgers:Account`) — collapsing it to a simple class\n   * name would resolve ambiguously when two loaded packages declare the same\n   * simple name.\n   */\n  registryKey: string;\n  /**\n   * `<collection>` prefix of the `<collection>.<action>` operation permission\n   * the mirrored generated write routes require (#2977) — the same\n   * `decoratorConfig.collection ?? collection` resolution as\n   * sveltekit-generator.ts `resolvePermissionCollection`.\n   */\n  permissionCollection: string;\n  ops: MutatingAction[];\n  readonlyFields: string[];\n  writableAllowlist: string[] | null;\n  publicAccess: boolean | 'read';\n  tenantScoped: boolean;\n}\n\nfunction getApiConfigObject(apiConfig: unknown): ApiConfig | null {\n  if (!apiConfig || typeof apiConfig !== 'object') {\n    return null;\n  }\n  return apiConfig as ApiConfig;\n}\n\n/**\n * Mirror of sveltekit-generator.ts `resolveStandardCrudActions`, narrowed to\n * the mutating subset the sync contract can carry. Kept local so this module\n * needs no exports added to the (parallel-edited) shared generator file.\n */\nfunction resolveMutatingActions(apiConfig: unknown): MutatingAction[] {\n  if (apiConfig === false) return [];\n  if (\n    apiConfig === true ||\n    apiConfig === undefined ||\n    typeof apiConfig !== 'object'\n  ) {\n    return [...MUTATING_ACTIONS];\n  }\n\n  const config = apiConfig as { include?: string[]; exclude?: string[] };\n  let actions: MutatingAction[] = Array.isArray(config.include)\n    ? MUTATING_ACTIONS.filter((action) => config.include?.includes(action))\n    : [...MUTATING_ACTIONS];\n  if (Array.isArray(config.exclude)) {\n    const excluded = config.exclude;\n    actions = actions.filter((action) => !excluded.includes(action));\n  }\n  return actions;\n}\n\n/** Mirror of sveltekit-generator.ts `getApiPublicAccess` (fail-closed). */\nfunction getApiPublicAccess(apiConfig: unknown): boolean | 'read' {\n  const config = getApiConfigObject(apiConfig);\n  const value = config?.public;\n  if (value === true || value === 'read') {\n    return value;\n  }\n  return false;\n}\n\n/** Mirror of sveltekit-generator.ts `collectReadonlyFieldNames` (#1540, 2b). */\nfunction collectReadonlyFieldNames(objectDef: SmartObjectDefinition): string[] {\n  const fields = objectDef.fields || {};\n  const names: string[] = [];\n  for (const [name, def] of Object.entries(fields)) {\n    const meta = (def as { _meta?: Record<string, unknown> })._meta;\n    if (\n      (def as { readonly?: boolean }).readonly === true ||\n      meta?.readonly === true\n    ) {\n      names.push(name);\n    }\n  }\n  return names;\n}\n\n/** Mirror of sveltekit-generator.ts `getApiWritableAllowlist`. */\nfunction getApiWritableAllowlist(apiConfig: unknown): string[] | null {\n  const config = getApiConfigObject(apiConfig);\n  return Array.isArray(config?.writable) ? config.writable : null;\n}\n\n/** Mirror of sveltekit-generator.ts `resolvePermissionCollection` (#2977). */\nfunction resolvePermissionCollection(objectDef: SmartObjectDefinition): string {\n  if (objectDef.permissionCollection) return objectDef.permissionCollection;\n  const configured = (\n    objectDef.decoratorConfig as { collection?: unknown } | undefined\n  )?.collection;\n  return typeof configured === 'string' && configured.length > 0\n    ? configured\n    : objectDef.collection;\n}\n\n/**\n * Collect the syncable targets from a manifest: non-collection objects whose\n * API config is enabled and exposes at least one mutating action.\n */\nexport function collectSyncApplyTargets(\n  manifest: SmartObjectManifest,\n): SyncTargetSpec[] {\n  const targets: SyncTargetSpec[] = [];\n\n  for (const [className, objectDef] of Object.entries(manifest.objects)) {\n    if (isCollectionManifestClass(manifest, objectDef)) continue;\n    // The framework's own abstract base classes are scaffolding, not\n    // resources — never make them a sync-apply target, regardless of\n    // config (#2642).\n    if (isFrameworkBaseClass(objectDef.className, objectDef.packageName)) {\n      continue;\n    }\n\n    const apiConfig = objectDef.decoratorConfig?.api;\n    if (apiConfig === false) continue;\n\n    const ops = resolveMutatingActions(apiConfig);\n    if (ops.length === 0) continue;\n\n    if (!objectDef.collection) continue;\n\n    targets.push({\n      segment: objectDef.collection,\n      registryKey: className,\n      permissionCollection: resolvePermissionCollection(objectDef),\n      ops,\n      readonlyFields: collectReadonlyFieldNames(objectDef),\n      writableAllowlist: getApiWritableAllowlist(apiConfig),\n      publicAccess: getApiPublicAccess(apiConfig),\n      tenantScoped: !!objectDef.decoratorConfig?.tenantScoped,\n    });\n  }\n\n  return targets.sort((a, b) => a.segment.localeCompare(b.segment));\n}\n\nfunction serializeTargets(targets: SyncTargetSpec[]): string {\n  const entries = targets.map((target) => {\n    const fields = [\n      `registryKey: ${JSON.stringify(target.registryKey)}`,\n      `permissionCollection: ${JSON.stringify(target.permissionCollection)}`,\n      `ops: ${JSON.stringify(target.ops)}`,\n      `readonlyFields: ${JSON.stringify(target.readonlyFields)}`,\n      `writableAllowlist: ${JSON.stringify(target.writableAllowlist)}`,\n      `publicAccess: ${JSON.stringify(target.publicAccess)}`,\n    ];\n    return `  ${JSON.stringify(target.segment)}: {\\n    ${fields.join(',\\n    ')},\\n  },`;\n  });\n  return `{\\n${entries.join('\\n')}\\n}`;\n}\n\n/**\n * Render the generated `+server.ts` content for the sync-apply route.\n * Exported for tests.\n */\nexport function generateSyncApplyRouteTemplate(\n  targets: SyncTargetSpec[],\n  collectionAccessImports: string,\n): string {\n  const anyTenantScoped = targets.some((target) => target.tenantScoped);\n\n  const tenantHelper = anyTenantScoped\n    ? `\nimport { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenancy';\n\nfunction establishTenantContext(locals: unknown): void {\n  if (hasTenantContext()) return;\n  if (!locals || typeof locals !== 'object') return;\n  const l = locals as Record<string, unknown>;\n  const user = l.user as Record<string, unknown> | undefined;\n  const session = l.session as Record<string, unknown> | undefined;\n  const tenantId = l.tenantId ?? user?.tenantId ?? session?.tenantId;\n  if (typeof tenantId === 'string' && tenantId) {\n    enterTenantContext({ tenantId });\n  }\n}\n`\n    : '';\n\n  return `${AUTO_GENERATED_ROUTE_HEADER}\n// DO NOT EDIT - changes will be overwritten\n//\n// Idempotent sync-apply batch write contract (#1759) — the shared write path\n// for the web offline outbox (#1762) and the KMP mobile write queue (#1739).\n// Contract: docs/content/architecture/sync-apply-contract.md\n\nimport {\n  applySyncWritablePolicy,\n  processSyncApplyBatch,\n  type SyncApplyOp,\n  type SyncApplyTarget,\n} from '@happyvertical/smrt-core';\nimport { json } from '@sveltejs/kit';\nimport type { RequestHandler } from './$types';\n${collectionAccessImports}\n${tenantHelper}\ninterface SyncTargetConfig {\n  /** Manifest registry key (may be package-qualified), as CRUD routes use. */\n  registryKey: string;\n  /** \\`<collection>\\` prefix of the required \\`<collection>.<op>\\` permission. */\n  permissionCollection: string;\n  ops: SyncApplyOp[];\n  readonlyFields: string[];\n  writableAllowlist: string[] | null;\n  publicAccess: boolean | 'read';\n}\n\n// One entry per syncable model, keyed by the collection route segment its\n// generated CRUD routes use.\nconst SYNC_TARGETS: Record<string, SyncTargetConfig> = ${serializeTargets(targets)};\n\n// Fail-closed authorization (#1540): sync mutations require an authenticated\n// principal on \\`locals\\` unless the target model is \\`api: { public: true }\\`.\nfunction hasAuthenticatedPrincipal(locals: unknown): boolean {\n  if (!locals || typeof locals !== 'object') return false;\n  const l = locals as Record<string, unknown>;\n  const isResolvedPrincipal = (v: unknown) =>\n    typeof v === 'object' && v !== null;\n  return (\n    isResolvedPrincipal(l.user) ||\n    isResolvedPrincipal(l.session) ||\n    l.smrtAuth === true\n  );\n}\n\nfunction readRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object'\n    ? (value as Record<string, unknown>)\n    : {};\n}\n\nfunction hasGrantedPermission(value: unknown, permission: string): boolean {\n  if (Array.isArray(value)) return value.includes(permission);\n  if (value instanceof Set) return value.has(permission);\n  return false;\n}\n\n// Fail-closed operation permission (#2977, #3011): each applied op requires\n// the same \\`<collection>.<op>\\` permission the mirrored generated write route\n// enforces, read from the principal's session permission snapshot. A missing\n// snapshot denies; only an explicit tenancy super-admin bypass skips it.\nfunction hasOperationPermission(\n  locals: unknown,\n  permissionCollection: string,\n  op: SyncApplyOp,\n): boolean {\n  const l = readRecord(locals);\n  const tenantContext = readRecord(l.tenantContext);\n  if (tenantContext.superAdminBypass === true) return true;\n  const permission = \\`\\${permissionCollection}.\\${op}\\`;\n  return (\n    hasGrantedPermission(l.permissions, permission) ||\n    hasGrantedPermission(l.permissionSet, permission) ||\n    hasGrantedPermission(l.smrtPermissions, permission) ||\n    hasGrantedPermission(tenantContext.permissions, permission)\n  );\n}\n\nexport const POST: RequestHandler = async ({ locals, request }) => {\n  const authenticated = hasAuthenticatedPrincipal(locals);\n${anyTenantScoped ? '  establishTenantContext(locals);\\n' : ''}\n  let body: unknown;\n  try {\n    body = await request.json();\n  } catch {\n    return json(\n      { error: { code: 'invalid_batch', message: 'Invalid JSON body' } },\n      { status: 400 },\n    );\n  }\n\n  const outcome = await processSyncApplyBatch(body, {\n    resolveTarget: async (segment: string): Promise<SyncApplyTarget | null> => {\n      const target = SYNC_TARGETS[segment];\n      if (!target) return null;\n      // The verbatim manifest key, exactly as the generated CRUD routes pass\n      // it — package-qualified keys stay qualified so same-simple-name\n      // classes across packages resolve unambiguously.\n      const collection = await getCollection(target.registryKey);\n      return {\n        objectName: target.registryKey,\n        collection,\n        mutate: async (row, op, data) => {\n          await collection.withAuditMutation(row as import('@happyvertical/smrt-core').SmrtObject, op === 'update' ? 'updated' : 'deleted', async (bound) => {\n            if (op === 'update') {\n              Object.assign(bound, data);\n              await bound.save();\n            } else {\n              await bound.delete({ expectedUpdatedAt: bound.updated_at ?? undefined });\n            }\n          });\n        },\n        isOpAllowed: (op: SyncApplyOp) => target.ops.includes(op),\n        authorize: (op: SyncApplyOp) => {\n          // \\`public: true\\` keeps its unauthenticated write semantics, as on\n          // the generated CRUD routes.\n          if (target.publicAccess === true) return 'ok' as const;\n          if (!authenticated) return 'auth_required' as const;\n          return hasOperationPermission(locals, target.permissionCollection, op)\n            ? ('ok' as const)\n            : ('forbidden' as const);\n        },\n        prepare: (payload: Record<string, unknown>) =>\n          applySyncWritablePolicy(payload, {\n            readonlyFields: target.readonlyFields,\n            writableAllowlist: target.writableAllowlist,\n          }),\n      };\n    },\n  });\n\n  return json(outcome.body, { status: outcome.status });\n};\n`;\n}\n\n/**\n * Generate `{routesDir}/sync/apply/+server.ts` for the manifest's syncable\n * models. Returns true when a route was written. Skips generation (with a\n * warning) if a non-generated file already occupies the path, and writes\n * nothing when the manifest has no syncable models.\n */\nexport function generateSyncApplyRoute(\n  projectRoot: string,\n  manifest: SmartObjectManifest,\n  options: SvelteKitOptions,\n): boolean {\n  const targets = collectSyncApplyTargets(manifest);\n  if (targets.length === 0) {\n    return false;\n  }\n\n  const routeDir = join(projectRoot, options.routesDir, 'sync', 'apply');\n  const routePath = join(routeDir, '+server.ts');\n\n  if (existsSync(routePath)) {\n    const existing = readFileSync(routePath, 'utf-8');\n    if (!existing.startsWith(AUTO_GENERATED_ROUTE_HEADER)) {\n      console.warn(\n        `[smrt] Skipping sync-apply route - ${routePath} exists and is not generated`,\n      );\n      return false;\n    }\n  }\n\n  if (!existsSync(routeDir)) {\n    mkdirSync(routeDir, { recursive: true });\n  }\n\n  writeFileSync(\n    routePath,\n    generateSyncApplyRouteTemplate(\n      targets,\n      generateCollectionAccessImports(projectRoot, routeDir, options, [\n        'getCollection',\n      ]),\n    ),\n    'utf-8',\n  );\n  console.log(`[smrt] Generated: ${routePath}`);\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA+BA,IAAM,mBAAmB;CAAC;CAAU;CAAU;AAAQ;AA6BtD,SAAS,mBAAmB,WAAsC;CAChE,IAAI,CAAC,aAAa,OAAO,cAAc,UACrC,OAAO;CAET,OAAO;AACT;;;;;;AAOA,SAAS,uBAAuB,WAAsC;CACpE,IAAI,cAAc,OAAO,OAAO,CAAC;CACjC,IACE,cAAc,QACd,cAAc,KAAA,KACd,OAAO,cAAc,UAErB,OAAO,CAAC,GAAG,gBAAgB;CAG7B,MAAM,SAAS;CACf,IAAI,UAA4B,MAAM,QAAQ,OAAO,OAAO,IACxD,iBAAiB,QAAQ,WAAW,OAAO,SAAS,SAAS,MAAM,CAAC,IACpE,CAAC,GAAG,gBAAgB;CACxB,IAAI,MAAM,QAAQ,OAAO,OAAO,GAAG;EACjC,MAAM,WAAW,OAAO;EACxB,UAAU,QAAQ,QAAQ,WAAW,CAAC,SAAS,SAAS,MAAM,CAAC;CACjE;CACA,OAAO;AACT;;AAGA,SAAS,mBAAmB,WAAsC;CAEhE,MAAM,QADS,mBAAmB,SACpB,CAAA,EAAQ;CACtB,IAAI,UAAU,QAAQ,UAAU,QAC9B,OAAO;CAET,OAAO;AACT;;AAGA,SAAS,0BAA0B,WAA4C;CAC7E,MAAM,SAAS,UAAU,UAAU,CAAC;CACpC,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,MAAM,GAAG;EAChD,MAAM,OAAQ,IAA4C;EAC1D,IACG,IAA+B,aAAa,QAC7C,MAAM,aAAa,MAEnB,MAAM,KAAK,IAAI;CAEnB;CACA,OAAO;AACT;;AAGA,SAAS,wBAAwB,WAAqC;CACpE,MAAM,SAAS,mBAAmB,SAAS;CAC3C,OAAO,MAAM,QAAQ,QAAQ,QAAQ,IAAI,OAAO,WAAW;AAC7D;;AAGA,SAAS,4BAA4B,WAA0C;CAC7E,IAAI,UAAU,sBAAsB,OAAO,UAAU;CACrD,MAAM,aACJ,UAAU,iBACT;CACH,OAAO,OAAO,eAAe,YAAY,WAAW,SAAS,IACzD,aACA,UAAU;AAChB;;;;;AAMA,SAAgB,wBACd,UACkB;CAClB,MAAM,UAA4B,CAAC;CAEnC,KAAK,MAAM,CAAC,WAAW,cAAc,OAAO,QAAQ,SAAS,OAAO,GAAG;EACrE,IAAI,0BAA0B,UAAU,SAAS,GAAG;EAIpD,IAAI,qBAAqB,UAAU,WAAW,UAAU,WAAW,GACjE;EAGF,MAAM,YAAY,UAAU,iBAAiB;EAC7C,IAAI,cAAc,OAAO;EAEzB,MAAM,MAAM,uBAAuB,SAAS;EAC5C,IAAI,IAAI,WAAW,GAAG;EAEtB,IAAI,CAAC,UAAU,YAAY;EAE3B,QAAQ,KAAK;GACX,SAAS,UAAU;GACnB,aAAa;GACb,sBAAsB,4BAA4B,SAAS;GAC3D;GACA,gBAAgB,0BAA0B,SAAS;GACnD,mBAAmB,wBAAwB,SAAS;GACpD,cAAc,mBAAmB,SAAS;GAC1C,cAAc,CAAC,CAAC,UAAU,iBAAiB;EAC7C,CAAC;CACH;CAEA,OAAO,QAAQ,MAAM,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,CAAC;AAClE;AAEA,SAAS,iBAAiB,SAAmC;CAY3D,OAAO,MAXS,QAAQ,KAAK,WAAW;EACtC,MAAM,SAAS;GACb,gBAAgB,KAAK,UAAU,OAAO,WAAW;GACjD,yBAAyB,KAAK,UAAU,OAAO,oBAAoB;GACnE,QAAQ,KAAK,UAAU,OAAO,GAAG;GACjC,mBAAmB,KAAK,UAAU,OAAO,cAAc;GACvD,sBAAsB,KAAK,UAAU,OAAO,iBAAiB;GAC7D,iBAAiB,KAAK,UAAU,OAAO,YAAY;EACrD;EACA,OAAO,KAAK,KAAK,UAAU,OAAO,OAAO,EAAE,WAAW,OAAO,KAAK,SAAS,EAAE;CAC/E,CACa,CAAA,CAAQ,KAAK,IAAI,EAAE;AAClC;;;;;AAMA,SAAgB,+BACd,SACA,yBACQ;CACR,MAAM,kBAAkB,QAAQ,MAAM,WAAW,OAAO,YAAY;CAoBpE,OAAO,GAAG,4BAA4B;;;;;;;;;;;;;;;EAetC,wBAAwB;EAjCH,kBACjB;;;;;;;;;;;;;;IAeA,GAkBS;;;;;;;;;;;;;;yDAc0C,iBAAiB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmDjF,kBAAkB,wCAAwC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsD/D;;;;;;;AAQA,SAAgB,uBACd,aACA,UACA,SACS;CACT,MAAM,UAAU,wBAAwB,QAAQ;CAChD,IAAI,QAAQ,WAAW,GACrB,OAAO;CAGT,MAAM,WAAW,KAAK,aAAa,QAAQ,WAAW,QAAQ,OAAO;CACrE,MAAM,YAAY,KAAK,UAAU,YAAY;CAE7C,IAAI,WAAW,SAAS;MAElB,CADa,aAAa,WAAW,OACpC,CAAA,CAAS,WAAA,6CAAsC,GAAG;GACrD,QAAQ,KACN,sCAAsC,UAAU,6BAClD;GACA,OAAO;EACT;;CAGF,IAAI,CAAC,WAAW,QAAQ,GACtB,UAAU,UAAU,EAAE,WAAW,KAAK,CAAC;CAGzC,cACE,WACA,+BACE,SACA,gCAAgC,aAAa,UAAU,SAAS,CAC9D,eACF,CAAC,CACH,GACA,OACF;CACA,QAAQ,IAAI,qBAAqB,WAAW;CAC5C,OAAO;AACT"}
+{"version":3,"file":"sync-apply-route.js","names":[],"sources":["../../src/vite-plugin/sync-apply-route.ts"],"sourcesContent":["/**\n * SvelteKit generator for the sync-apply batch write route (#1759).\n *\n * Emits ONE route — `{routesDir}/sync/apply/+server.ts` — implementing the\n * shared web/mobile write contract for every syncable model in the manifest\n * (models whose API config exposes at least one of create/update/delete). The\n * generated file is deliberately thin: it maps `object` segments to\n * collections plus per-model policy data, and delegates all batch processing\n * to `processSyncApplyBatch` from `@happyvertical/smrt-core` — the same\n * engine the runtime REST generator uses, so the two transports cannot drift.\n *\n * This lives in its own module (rather than sveltekit-generator.ts) so the\n * shared generator file only needs a one-line registration hook; sibling\n * work (#1757, #1758) touches the same generator files in parallel.\n *\n * Contract documentation: docs/content/architecture/sync-apply-contract.md\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { isFrameworkBaseClass } from '../registry/framework-base-classes.js';\nimport type { ApiConfig } from '../registry/types.js';\nimport type {\n  SmartObjectDefinition,\n  SmartObjectManifest,\n} from '../scanner/types';\nimport { AUTO_GENERATED_ROUTE_HEADER } from './route-header.js';\nimport { generateCollectionAccessImports } from './sveltekit-config-import.js';\nimport type { SvelteKitOptions } from './sveltekit-generator.js';\nimport {\n  compareText,\n  findManifestObjectByName,\n  isCollectionManifestClass,\n  isStiChildModel,\n  orderedManifestObjectEntries,\n} from './web-collections.js';\n\nconst MUTATING_ACTIONS = ['create', 'update', 'delete'] as const;\n\ntype MutatingAction = (typeof MUTATING_ACTIONS)[number];\n\n/** Per-model data embedded into the generated route. */\ninterface SyncTargetSpec {\n  segment: string;\n  /**\n   * The manifest registry key, passed VERBATIM to `getCollection()` exactly\n   * as the generated CRUD routes do. May be package-qualified\n   * (`@happyvertical/smrt-ledgers:Account`) — collapsing it to a simple class\n   * name would resolve ambiguously when two loaded packages declare the same\n   * simple name.\n   */\n  registryKey: string;\n  /**\n   * `<collection>` prefix of the `<collection>.<action>` operation permission\n   * the mirrored generated write routes require (#2977) — the same\n   * `decoratorConfig.collection ?? collection` resolution as\n   * sveltekit-generator.ts `resolvePermissionCollection`.\n   */\n  permissionCollection: string;\n  ops: MutatingAction[];\n  readonlyFields: string[];\n  writableAllowlist: string[] | null;\n  publicAccess: boolean | 'read';\n  tenantScoped: boolean;\n}\n\nfunction getApiConfigObject(apiConfig: unknown): ApiConfig | null {\n  if (!apiConfig || typeof apiConfig !== 'object') {\n    return null;\n  }\n  return apiConfig as ApiConfig;\n}\n\n/**\n * Mirror of sveltekit-generator.ts `resolveStandardCrudActions`, narrowed to\n * the mutating subset the sync contract can carry. Kept local so this module\n * needs no exports added to the (parallel-edited) shared generator file.\n */\nfunction resolveMutatingActions(apiConfig: unknown): MutatingAction[] {\n  if (apiConfig === false) return [];\n  if (\n    apiConfig === true ||\n    apiConfig === undefined ||\n    typeof apiConfig !== 'object'\n  ) {\n    return [...MUTATING_ACTIONS];\n  }\n\n  const config = apiConfig as { include?: string[]; exclude?: string[] };\n  let actions: MutatingAction[] = Array.isArray(config.include)\n    ? MUTATING_ACTIONS.filter((action) => config.include?.includes(action))\n    : [...MUTATING_ACTIONS];\n  if (Array.isArray(config.exclude)) {\n    const excluded = config.exclude;\n    actions = actions.filter((action) => !excluded.includes(action));\n  }\n  return actions;\n}\n\n/** Mirror of sveltekit-generator.ts `getApiPublicAccess` (fail-closed). */\nfunction getApiPublicAccess(apiConfig: unknown): boolean | 'read' {\n  const config = getApiConfigObject(apiConfig);\n  const value = config?.public;\n  if (value === true || value === 'read') {\n    return value;\n  }\n  return false;\n}\n\n/** Mirror of sveltekit-generator.ts `collectReadonlyFieldNames` (#1540, 2b). */\nfunction collectReadonlyFieldNames(objectDef: SmartObjectDefinition): string[] {\n  const fields = objectDef.fields || {};\n  const names: string[] = [];\n  for (const [name, def] of Object.entries(fields)) {\n    const meta = (def as { _meta?: Record<string, unknown> })._meta;\n    if (\n      (def as { readonly?: boolean }).readonly === true ||\n      meta?.readonly === true\n    ) {\n      names.push(name);\n    }\n  }\n  return names;\n}\n\n/** Mirror of sveltekit-generator.ts `getApiWritableAllowlist`. */\nfunction getApiWritableAllowlist(apiConfig: unknown): string[] | null {\n  const config = getApiConfigObject(apiConfig);\n  return Array.isArray(config?.writable) ? config.writable : null;\n}\n\n/** Mirror of sveltekit-generator.ts `resolvePermissionCollection` (#2977). */\nfunction resolvePermissionCollection(objectDef: SmartObjectDefinition): string {\n  if (objectDef.permissionCollection) return objectDef.permissionCollection;\n  const configured = (\n    objectDef.decoratorConfig as { collection?: unknown } | undefined\n  )?.collection;\n  return typeof configured === 'string' && configured.length > 0\n    ? configured\n    : objectDef.collection;\n}\n\n/**\n * True when an ancestor sharing `objectDef`'s collection (its STI base) is in\n * the manifest with its API enabled. Such a base owns the segment.\n */\nfunction hasApiEnabledStiBase(\n  manifest: SmartObjectManifest,\n  objectDef: SmartObjectDefinition,\n): boolean {\n  const seen = new Set<string>();\n  let child = objectDef;\n  let parentName = child.extendsQualified || child.extends;\n  while (parentName && !seen.has(parentName)) {\n    seen.add(parentName);\n    const parent = findManifestObjectByName(manifest, parentName, child);\n    if (!parent || parent.collection !== objectDef.collection) return false;\n    if (\n      parent.decoratorConfig?.api !== false &&\n      !isFrameworkBaseClass(parent.className, parent.packageName)\n    ) {\n      return true;\n    }\n    child = parent;\n    parentName = parent.extendsQualified || parent.extends;\n  }\n  return false;\n}\n\n/**\n * Collect the syncable targets from a manifest: non-collection objects whose\n * API config is enabled and exposes at least one mutating action.\n *\n * `SYNC_TARGETS` is keyed by segment, so exactly ONE model owns each segment\n * (#2807). Several models can share a `collection` (an STI family, or two\n * unrelated models); emitting one entry per model made the generated object\n * literal's last duplicate key win, i.e. manifest scan order. The owner uses\n * the tie rule of the web collection definitions (`selectWebCollectionEntries`)\n * over models that expose a mutating op: the STI base model beats its\n * children, and otherwise the first candidate in deterministic\n * qualified-identity order ({@link orderedManifestObjectEntries}) wins.\n *\n * An STI child never owns a segment whose API-enabled base shares it, even\n * when that base exposes no mutating op: the base's (narrower) policy decides,\n * so the segment then has no sync target (fail closed). Candidate sets differ\n * from the web selector's (`list`) and from CRUD route emission (last writer\n * per route file, #2754), so with unrelated models sharing a segment the sync\n * owner can differ from those owners; it is deterministic either way.\n */\nexport function collectSyncApplyTargets(\n  manifest: SmartObjectManifest,\n): SyncTargetSpec[] {\n  const bySegment = new Map<\n    string,\n    { target: SyncTargetSpec; isStiChild: boolean }\n  >();\n\n  for (const [className, objectDef] of orderedManifestObjectEntries(manifest)) {\n    if (isCollectionManifestClass(manifest, objectDef)) continue;\n    // The framework's own abstract base classes are scaffolding, not\n    // resources — never make them a sync-apply target, regardless of\n    // config (#2642).\n    if (isFrameworkBaseClass(objectDef.className, objectDef.packageName)) {\n      continue;\n    }\n\n    const apiConfig = objectDef.decoratorConfig?.api;\n    if (apiConfig === false) continue;\n\n    if (!objectDef.collection) continue;\n    if (hasApiEnabledStiBase(manifest, objectDef)) continue;\n\n    const ops = resolveMutatingActions(apiConfig);\n    if (ops.length === 0) continue;\n\n    const isStiChild = isStiChildModel(manifest, objectDef);\n    const existing = bySegment.get(objectDef.collection);\n    if (existing && !(existing.isStiChild && !isStiChild)) continue;\n\n    const target: SyncTargetSpec = {\n      segment: objectDef.collection,\n      registryKey: className,\n      permissionCollection: resolvePermissionCollection(objectDef),\n      ops,\n      readonlyFields: collectReadonlyFieldNames(objectDef),\n      writableAllowlist: getApiWritableAllowlist(apiConfig),\n      publicAccess: getApiPublicAccess(apiConfig),\n      tenantScoped: !!objectDef.decoratorConfig?.tenantScoped,\n    };\n    bySegment.set(objectDef.collection, { target, isStiChild });\n  }\n\n  return [...bySegment.values()]\n    .map(({ target }) => target)\n    .sort((a, b) => compareText(a.segment, b.segment));\n}\n\nfunction serializeTargets(targets: SyncTargetSpec[]): string {\n  const entries = targets.map((target) => {\n    const fields = [\n      `registryKey: ${JSON.stringify(target.registryKey)}`,\n      `permissionCollection: ${JSON.stringify(target.permissionCollection)}`,\n      `ops: ${JSON.stringify(target.ops)}`,\n      `readonlyFields: ${JSON.stringify(target.readonlyFields)}`,\n      `writableAllowlist: ${JSON.stringify(target.writableAllowlist)}`,\n      `publicAccess: ${JSON.stringify(target.publicAccess)}`,\n    ];\n    return `  ${JSON.stringify(target.segment)}: {\\n    ${fields.join(',\\n    ')},\\n  },`;\n  });\n  return `{\\n${entries.join('\\n')}\\n}`;\n}\n\n/**\n * Render the generated `+server.ts` content for the sync-apply route.\n * Exported for tests.\n */\nexport function generateSyncApplyRouteTemplate(\n  targets: SyncTargetSpec[],\n  collectionAccessImports: string,\n): string {\n  const anyTenantScoped = targets.some((target) => target.tenantScoped);\n\n  const tenantHelper = anyTenantScoped\n    ? `\nimport { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenancy';\n\nfunction establishTenantContext(locals: unknown): void {\n  if (hasTenantContext()) return;\n  if (!locals || typeof locals !== 'object') return;\n  const l = locals as Record<string, unknown>;\n  const user = l.user as Record<string, unknown> | undefined;\n  const session = l.session as Record<string, unknown> | undefined;\n  const tenantId = l.tenantId ?? user?.tenantId ?? session?.tenantId;\n  if (typeof tenantId === 'string' && tenantId) {\n    enterTenantContext({ tenantId });\n  }\n}\n`\n    : '';\n\n  return `${AUTO_GENERATED_ROUTE_HEADER}\n// DO NOT EDIT - changes will be overwritten\n//\n// Idempotent sync-apply batch write contract (#1759) — the shared write path\n// for the web offline outbox (#1762) and the KMP mobile write queue (#1739).\n// Contract: docs/content/architecture/sync-apply-contract.md\n\nimport {\n  applySyncWritablePolicy,\n  processSyncApplyBatch,\n  type SyncApplyOp,\n  type SyncApplyTarget,\n} from '@happyvertical/smrt-core';\nimport { json } from '@sveltejs/kit';\nimport type { RequestHandler } from './$types';\n${collectionAccessImports}\n${tenantHelper}\ninterface SyncTargetConfig {\n  /** Manifest registry key (may be package-qualified), as CRUD routes use. */\n  registryKey: string;\n  /** \\`<collection>\\` prefix of the required \\`<collection>.<op>\\` permission. */\n  permissionCollection: string;\n  ops: SyncApplyOp[];\n  readonlyFields: string[];\n  writableAllowlist: string[] | null;\n  publicAccess: boolean | 'read';\n}\n\n// One entry per syncable model, keyed by the collection route segment its\n// generated CRUD routes use.\nconst SYNC_TARGETS: Record<string, SyncTargetConfig> = ${serializeTargets(targets)};\n\n// Fail-closed authorization (#1540): sync mutations require an authenticated\n// principal on \\`locals\\` unless the target model is \\`api: { public: true }\\`.\nfunction hasAuthenticatedPrincipal(locals: unknown): boolean {\n  if (!locals || typeof locals !== 'object') return false;\n  const l = locals as Record<string, unknown>;\n  const isResolvedPrincipal = (v: unknown) =>\n    typeof v === 'object' && v !== null;\n  return (\n    isResolvedPrincipal(l.user) ||\n    isResolvedPrincipal(l.session) ||\n    l.smrtAuth === true\n  );\n}\n\nfunction readRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object'\n    ? (value as Record<string, unknown>)\n    : {};\n}\n\nfunction hasGrantedPermission(value: unknown, permission: string): boolean {\n  if (Array.isArray(value)) return value.includes(permission);\n  if (value instanceof Set) return value.has(permission);\n  return false;\n}\n\n// Fail-closed operation permission (#2977, #3011): each applied op requires\n// the same \\`<collection>.<op>\\` permission the mirrored generated write route\n// enforces, read from the principal's session permission snapshot. A missing\n// snapshot denies; only an explicit tenancy super-admin bypass skips it.\nfunction hasOperationPermission(\n  locals: unknown,\n  permissionCollection: string,\n  op: SyncApplyOp,\n): boolean {\n  const l = readRecord(locals);\n  const tenantContext = readRecord(l.tenantContext);\n  if (tenantContext.superAdminBypass === true) return true;\n  const permission = \\`\\${permissionCollection}.\\${op}\\`;\n  return (\n    hasGrantedPermission(l.permissions, permission) ||\n    hasGrantedPermission(l.permissionSet, permission) ||\n    hasGrantedPermission(l.smrtPermissions, permission) ||\n    hasGrantedPermission(tenantContext.permissions, permission)\n  );\n}\n\nexport const POST: RequestHandler = async ({ locals, request }) => {\n  const authenticated = hasAuthenticatedPrincipal(locals);\n${anyTenantScoped ? '  establishTenantContext(locals);\\n' : ''}\n  let body: unknown;\n  try {\n    body = await request.json();\n  } catch {\n    return json(\n      { error: { code: 'invalid_batch', message: 'Invalid JSON body' } },\n      { status: 400 },\n    );\n  }\n\n  const outcome = await processSyncApplyBatch(body, {\n    resolveTarget: async (segment: string): Promise<SyncApplyTarget | null> => {\n      const target = SYNC_TARGETS[segment];\n      if (!target) return null;\n      // The verbatim manifest key, exactly as the generated CRUD routes pass\n      // it — package-qualified keys stay qualified so same-simple-name\n      // classes across packages resolve unambiguously.\n      const collection = await getCollection(target.registryKey);\n      return {\n        objectName: target.registryKey,\n        collection,\n        mutate: async (row, op, data) => {\n          await collection.withAuditMutation(row as import('@happyvertical/smrt-core').SmrtObject, op === 'update' ? 'updated' : 'deleted', async (bound) => {\n            if (op === 'update') {\n              Object.assign(bound, data);\n              await bound.save();\n            } else {\n              await bound.delete({ expectedUpdatedAt: bound.updated_at ?? undefined });\n            }\n          });\n        },\n        isOpAllowed: (op: SyncApplyOp) => target.ops.includes(op),\n        authorize: (op: SyncApplyOp) => {\n          // \\`public: true\\` keeps its unauthenticated write semantics, as on\n          // the generated CRUD routes.\n          if (target.publicAccess === true) return 'ok' as const;\n          if (!authenticated) return 'auth_required' as const;\n          return hasOperationPermission(locals, target.permissionCollection, op)\n            ? ('ok' as const)\n            : ('forbidden' as const);\n        },\n        prepare: (payload: Record<string, unknown>) =>\n          applySyncWritablePolicy(payload, {\n            readonlyFields: target.readonlyFields,\n            writableAllowlist: target.writableAllowlist,\n          }),\n      };\n    },\n  });\n\n  return json(outcome.body, { status: outcome.status });\n};\n`;\n}\n\n/**\n * Generate `{routesDir}/sync/apply/+server.ts` for the manifest's syncable\n * models. Returns true when a route was written. Skips generation (with a\n * warning) if a non-generated file already occupies the path, and writes\n * nothing when the manifest has no syncable models.\n */\nexport function generateSyncApplyRoute(\n  projectRoot: string,\n  manifest: SmartObjectManifest,\n  options: SvelteKitOptions,\n): boolean {\n  const targets = collectSyncApplyTargets(manifest);\n  if (targets.length === 0) {\n    return false;\n  }\n\n  const routeDir = join(projectRoot, options.routesDir, 'sync', 'apply');\n  const routePath = join(routeDir, '+server.ts');\n\n  if (existsSync(routePath)) {\n    const existing = readFileSync(routePath, 'utf-8');\n    if (!existing.startsWith(AUTO_GENERATED_ROUTE_HEADER)) {\n      console.warn(\n        `[smrt] Skipping sync-apply route - ${routePath} exists and is not generated`,\n      );\n      return false;\n    }\n  }\n\n  if (!existsSync(routeDir)) {\n    mkdirSync(routeDir, { recursive: true });\n  }\n\n  writeFileSync(\n    routePath,\n    generateSyncApplyRouteTemplate(\n      targets,\n      generateCollectionAccessImports(projectRoot, routeDir, options, [\n        'getCollection',\n      ]),\n    ),\n    'utf-8',\n  );\n  console.log(`[smrt] Generated: ${routePath}`);\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAqCA,IAAM,mBAAmB;CAAC;CAAU;CAAU;AAAQ;AA6BtD,SAAS,mBAAmB,WAAsC;CAChE,IAAI,CAAC,aAAa,OAAO,cAAc,UACrC,OAAO;CAET,OAAO;AACT;;;;;;AAOA,SAAS,uBAAuB,WAAsC;CACpE,IAAI,cAAc,OAAO,OAAO,CAAC;CACjC,IACE,cAAc,QACd,cAAc,KAAA,KACd,OAAO,cAAc,UAErB,OAAO,CAAC,GAAG,gBAAgB;CAG7B,MAAM,SAAS;CACf,IAAI,UAA4B,MAAM,QAAQ,OAAO,OAAO,IACxD,iBAAiB,QAAQ,WAAW,OAAO,SAAS,SAAS,MAAM,CAAC,IACpE,CAAC,GAAG,gBAAgB;CACxB,IAAI,MAAM,QAAQ,OAAO,OAAO,GAAG;EACjC,MAAM,WAAW,OAAO;EACxB,UAAU,QAAQ,QAAQ,WAAW,CAAC,SAAS,SAAS,MAAM,CAAC;CACjE;CACA,OAAO;AACT;;AAGA,SAAS,mBAAmB,WAAsC;CAEhE,MAAM,QADS,mBAAmB,SACpB,CAAA,EAAQ;CACtB,IAAI,UAAU,QAAQ,UAAU,QAC9B,OAAO;CAET,OAAO;AACT;;AAGA,SAAS,0BAA0B,WAA4C;CAC7E,MAAM,SAAS,UAAU,UAAU,CAAC;CACpC,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,MAAM,GAAG;EAChD,MAAM,OAAQ,IAA4C;EAC1D,IACG,IAA+B,aAAa,QAC7C,MAAM,aAAa,MAEnB,MAAM,KAAK,IAAI;CAEnB;CACA,OAAO;AACT;;AAGA,SAAS,wBAAwB,WAAqC;CACpE,MAAM,SAAS,mBAAmB,SAAS;CAC3C,OAAO,MAAM,QAAQ,QAAQ,QAAQ,IAAI,OAAO,WAAW;AAC7D;;AAGA,SAAS,4BAA4B,WAA0C;CAC7E,IAAI,UAAU,sBAAsB,OAAO,UAAU;CACrD,MAAM,aACJ,UAAU,iBACT;CACH,OAAO,OAAO,eAAe,YAAY,WAAW,SAAS,IACzD,aACA,UAAU;AAChB;;;;;AAMA,SAAS,qBACP,UACA,WACS;CACT,MAAM,uBAAO,IAAI,IAAY;CAC7B,IAAI,QAAQ;CACZ,IAAI,aAAa,MAAM,oBAAoB,MAAM;CACjD,OAAO,cAAc,CAAC,KAAK,IAAI,UAAU,GAAG;EAC1C,KAAK,IAAI,UAAU;EACnB,MAAM,SAAS,yBAAyB,UAAU,YAAY,KAAK;EACnE,IAAI,CAAC,UAAU,OAAO,eAAe,UAAU,YAAY,OAAO;EAClE,IACE,OAAO,iBAAiB,QAAQ,SAChC,CAAC,qBAAqB,OAAO,WAAW,OAAO,WAAW,GAE1D,OAAO;EAET,QAAQ;EACR,aAAa,OAAO,oBAAoB,OAAO;CACjD;CACA,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,wBACd,UACkB;CAClB,MAAM,4BAAY,IAAI,IAGpB;CAEF,KAAK,MAAM,CAAC,WAAW,cAAc,6BAA6B,QAAQ,GAAG;EAC3E,IAAI,0BAA0B,UAAU,SAAS,GAAG;EAIpD,IAAI,qBAAqB,UAAU,WAAW,UAAU,WAAW,GACjE;EAGF,MAAM,YAAY,UAAU,iBAAiB;EAC7C,IAAI,cAAc,OAAO;EAEzB,IAAI,CAAC,UAAU,YAAY;EAC3B,IAAI,qBAAqB,UAAU,SAAS,GAAG;EAE/C,MAAM,MAAM,uBAAuB,SAAS;EAC5C,IAAI,IAAI,WAAW,GAAG;EAEtB,MAAM,aAAa,gBAAgB,UAAU,SAAS;EACtD,MAAM,WAAW,UAAU,IAAI,UAAU,UAAU;EACnD,IAAI,YAAY,EAAE,SAAS,cAAc,CAAC,aAAa;EAEvD,MAAM,SAAyB;GAC7B,SAAS,UAAU;GACnB,aAAa;GACb,sBAAsB,4BAA4B,SAAS;GAC3D;GACA,gBAAgB,0BAA0B,SAAS;GACnD,mBAAmB,wBAAwB,SAAS;GACpD,cAAc,mBAAmB,SAAS;GAC1C,cAAc,CAAC,CAAC,UAAU,iBAAiB;EAC7C;EACA,UAAU,IAAI,UAAU,YAAY;GAAE;GAAQ;EAAW,CAAC;CAC5D;CAEA,OAAO,CAAC,GAAG,UAAU,OAAO,CAAC,CAAC,CAC3B,KAAK,EAAE,aAAa,MAAM,CAAC,CAC3B,MAAM,GAAG,MAAM,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC;AACrD;AAEA,SAAS,iBAAiB,SAAmC;CAY3D,OAAO,MAXS,QAAQ,KAAK,WAAW;EACtC,MAAM,SAAS;GACb,gBAAgB,KAAK,UAAU,OAAO,WAAW;GACjD,yBAAyB,KAAK,UAAU,OAAO,oBAAoB;GACnE,QAAQ,KAAK,UAAU,OAAO,GAAG;GACjC,mBAAmB,KAAK,UAAU,OAAO,cAAc;GACvD,sBAAsB,KAAK,UAAU,OAAO,iBAAiB;GAC7D,iBAAiB,KAAK,UAAU,OAAO,YAAY;EACrD;EACA,OAAO,KAAK,KAAK,UAAU,OAAO,OAAO,EAAE,WAAW,OAAO,KAAK,SAAS,EAAE;CAC/E,CACa,CAAA,CAAQ,KAAK,IAAI,EAAE;AAClC;;;;;AAMA,SAAgB,+BACd,SACA,yBACQ;CACR,MAAM,kBAAkB,QAAQ,MAAM,WAAW,OAAO,YAAY;CAoBpE,OAAO,GAAG,4BAA4B;;;;;;;;;;;;;;;EAetC,wBAAwB;EAjCH,kBACjB;;;;;;;;;;;;;;IAeA,GAkBS;;;;;;;;;;;;;;yDAc0C,iBAAiB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmDjF,kBAAkB,wCAAwC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsD/D;;;;;;;AAQA,SAAgB,uBACd,aACA,UACA,SACS;CACT,MAAM,UAAU,wBAAwB,QAAQ;CAChD,IAAI,QAAQ,WAAW,GACrB,OAAO;CAGT,MAAM,WAAW,KAAK,aAAa,QAAQ,WAAW,QAAQ,OAAO;CACrE,MAAM,YAAY,KAAK,UAAU,YAAY;CAE7C,IAAI,WAAW,SAAS;MAElB,CADa,aAAa,WAAW,OACpC,CAAA,CAAS,WAAA,6CAAsC,GAAG;GACrD,QAAQ,KACN,sCAAsC,UAAU,6BAClD;GACA,OAAO;EACT;;CAGF,IAAI,CAAC,WAAW,QAAQ,GACtB,UAAU,UAAU,EAAE,WAAW,KAAK,CAAC;CAGzC,cACE,WACA,+BACE,SACA,gCAAgC,aAAa,UAAU,SAAS,CAC9D,eACF,CAAC,CACH,GACA,OACF;CACA,QAAQ,IAAI,qBAAqB,WAAW;CAC5C,OAAO;AACT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-core",
-  "version": "0.57.46",
+  "version": "0.57.48",
   "description": "Core SMRT framework for business objects, persistence, and generated REST, CLI, MCP, and AI interfaces",
   "author": "HappyVertical",
   "type": "module",
@@ -195,22 +195,21 @@
     "./dist/utils/json.js": "./dist/utils/json.browser.js"
   },
   "dependencies": {
-    "@happyvertical/ai": "^0.111.0",
-    "@happyvertical/files": "^0.111.0",
-    "@happyvertical/json": "^0.111.0",
-    "@happyvertical/logger": "^0.111.0",
-    "@happyvertical/smrt-config": "0.57.46",
-    "@happyvertical/smrt-scanner": "0.57.46",
-    "@happyvertical/smrt-types": "0.57.46",
-    "@happyvertical/sql": "^0.111.0",
-    "@happyvertical/utils": "^0.111.0",
+    "@happyvertical/ai": "^0.111.3",
+    "@happyvertical/files": "^0.111.3",
+    "@happyvertical/json": "^0.111.3",
+    "@happyvertical/logger": "^0.111.3",
+    "@happyvertical/smrt-config": "0.57.48",
+    "@happyvertical/smrt-scanner": "0.57.48",
+    "@happyvertical/smrt-types": "0.57.48",
+    "@happyvertical/sql": "^0.111.3",
+    "@happyvertical/utils": "^0.111.3",
     "@noble/hashes": "^2.4.0",
     "@oxc-project/runtime": "^0.150.0",
     "cheerio": "^1.2.0",
     "import-meta-resolve": "4.2.0",
     "minimatch": "10.2.6",
     "oxc-transform": "0.150.0",
-    "pluralize": "^8.0.0",
     "tsx": "^4.23.13",
     "yaml": "^2.9.1"
   },
@@ -235,6 +234,7 @@
     "@types/pluralize": "^0.0.33",
     "@xenova/transformers": "^2.17.2",
     "ajv": "8.20.0",
+    "pluralize": "^8.0.0",
     "reflect-metadata": "0.2.2",
     "svelte": "^5.57.1",
     "svelte-check": "^4.7.6",
@@ -256,7 +256,7 @@
     "generate": "node scripts/generate-manifest.js",
     "generate:test": "node scripts/generate-test-manifest.js",
     "test": "node scripts/generate-test-manifest.js && vitest run",
-    "test:browser": "node scripts/browser-plain-json-regression.mjs && node scripts/browser-entry-evaluation.mjs",
+    "test:browser": "node scripts/browser-plain-json-regression.mjs && node scripts/browser-entry-evaluation.mjs && node scripts/browser-unbundled-dev.mjs",
     "test:postgres": "node scripts/generate-test-manifest.js && NODE_OPTIONS=--trace-deprecation node ../../scripts/run-with-ci-postgres.mjs -- pnpm exec vitest run optional.test.ts",
     "test:integration": "TEST_INTEGRATION=1 vitest run src/__tests__/full-registry-integration.test.ts src/__tests__/manifest-no-leak.test.ts",
     "test:watch": "node scripts/generate-test-manifest.js && vitest",