@happyvertical/smrt-preferences 0.0.0-stage → 0.55.10

package/AGENTS.md

@@ -0,0 +1,133 @@
+# smrt-preferences
+
+User-interface preferences (#3727): one `_smrt_ui_preferences` system table
+for tenant defaults and per-user preferences of any registered **kind**, the
+kind registry, the generic store, and two built-in kinds: `overview`
+(customizable overview pages of `@happyvertical/smrt-svelte/overview`, with an
+overview-shaped layer on top) and `shell-layout` (the AdminShell
+`ShellSettingsDelta`). The kind contract is in
+[agents/preference-kinds.md](agents/preference-kinds.md); the overview
+surface itself is in
+[smrt-svelte overview-surfaces.md](../smrt-svelte/agents/overview-surfaces.md).
+
+## Why a package of its own
+
+The repo puts each layered-override table in the package that owns its
+resolution (`smrt-prompts`, `smrt-playbooks`, `smrt-features`,
+`smrt-fields`). `smrt-svelte` has no runtime dependency on core, tenancy or
+users and holds no tables. This package imports only smrt-svelte's
+Svelte-free entries (`./overview/server`, `./workspace/server`).
+
+## Pieces
+
+| File | Contents |
+| --- | --- |
+| `src/models/UiPreferenceRecord.ts` | The row; owns identity, scope shape and authorization; refuses unregistered kinds |
+| `src/collections/UiPreferenceRecordCollection.ts` | Undecorated reads (`findTier`); internal, not exported; no generated surface |
+| `src/write-capability.ts` | The store-only write capability (internal) |
+| `src/read-guard.ts` | The owner-read interceptor (internal) |
+| `src/kinds.ts` | `registerPreferenceKind`, `requirePreferenceKind`, `UnknownPreferenceKindError`, the validation contract |
+| `src/store.ts` | `createPreferenceStore({ db })`: generic `load` / `save` / `reset(kind, surfaceId, ...)` |
+| `src/kinds/overview.ts`, `src/overview.ts` | The `overview` kind and `createOverviewStore` (`load`, `save`, `reset`, `loadPage`, `loadWidget`, `withTenantDefaults`) |
+| `src/kinds/shell-layout.ts` | The `shell-layout` kind and `createShellSettingsPreferences` (the server half of a `ShellSettingsAdapter`) |
+| `src/kinds/builtin.ts` | Registers the two built-in kinds (imported by the entry and the store) |
+| `src/context.ts` | The ambient principal and `PreferenceAccessError` |
+| `src/permissions.ts` | `overviews.customize` / `overviews.personalize`, `shell.customize` / `shell.personalize` |
+
+## Table
+
+`_smrt_ui_preferences`: `tenant_id` (UUID), `kind`, `surface_id`,
+`scope_type` (`tenant` | `user`), `user_id` (UUID, NULL on tenant rows),
+`scope_key` (`__tenant__` or the user id), `payload_json` (the kind's
+canonical payload), `format_version`, `updated_by`, plus the SmrtObject
+columns. Unique key `(tenant_id, kind, surface_id, scope_type, scope_key)`;
+every key column is NOT NULL, so the index is total on every engine. It ships
+through manifest-driven migrations (`smrt db:migrate`), never runtime DDL;
+`src/__tests__/migration.test.ts` applies it with `migrateSmrtSchemas` on
+SQLite and DuckDB and asserts parity afterwards. On DuckDB only this table is
+migrated in tests: smrt-users' tables carry ON UPDATE CASCADE foreign keys
+DuckDB cannot create.
+
+## Invariants
+
+- **Kinds gate everything.** The store and the model refuse a kind that is
+  not registered (`UnknownPreferenceKindError`), so no row exists that no code
+  can validate. A kind's `validate` runs strictly on save (refuse unless `ok`,
+  store only `canonical`, `null` deletes the row) and leniently on load (use
+  `canonical`, report `issues`, never rewrite the row). A row written at a
+  newer `format_version` than the kind's is dropped and reported.
+- **Store-only writes.** Only the store writes rows: it passes a
+  module-private symbol capability (`src/write-capability.ts`, not exported;
+  the smrt-approvals pattern) bound to the exact `payloadJson` the kind
+  validated, single-use, and grants each delete the same way. The model
+  refuses any insert, update (also in `validateBeforeSave`, so bulk creates
+  are covered) or delete without it, so `new UiPreferenceRecord(...).save()`,
+  a collection `create()` or `row.setPayload(); row.save()` never store an
+  unvalidated payload. Tests seed corrupt storage with raw SQL
+  (`src/__tests__/raw-rows.ts`). This guards in-process callers, not raw SQL.
+- **Owner-safe reads, in the predicate.** A principal never reads another
+  user's row. `src/read-guard.ts` (registered when the model loads and again
+  before every store read) adds `scope_key IN ('__tenant__', <own user id>)`
+  (tenant rows only without a user id) to the read predicate BEFORE SQL
+  runs, intersecting any caller `scopeKey in`. Core's read entry points and
+  the hook each runs: `list`, `listByIds`, `findAll`, `listWithLatestRelated`
+  (`beforeList` + `afterList`); `get`, `findById`, `findOne`, `getOrUpsert`,
+  `update` / `delete` lookups, and model hydration `loadFromId` /
+  `loadFromSlug` (`beforeGet`; collection `get` also `afterGet`); `count`,
+  `counts`, `facets` (`beforeList` only, so ownership must be in the
+  predicate); `semanticSearch*`, `findSimilar*` (`beforeList`, some also
+  `afterList`); `query` (`beforeQuery` + `afterQuery`; raw SQL cannot carry
+  the predicate, so the guard refuses it). Every read path runs at least one
+  hook. The after-read hooks re-check hydrated rows as defence in depth (a
+  row whose scope cannot be told is dropped), and hydration also re-checks in
+  the model. `count()` and `facets()` therefore count only visible rows.
+- **Not an app API.** `UiPreferenceRecord` stays a root export only because
+  generated consumer registration imports every public manifest object from
+  the root; the collection is not exported. Apps use `createPreferenceStore`,
+  `createOverviewStore` and `createShellSettingsPreferences`.
+- **Tiers.** The tenant row is the default; the user row applies on top, and
+  `validate` for the user tier receives the tenant tier's canonical payload
+  (`ctx.tenant`). User rows are per tenant: preferences name tenant data.
+- **Identity is ambient.** No API takes a tenant or user id. A missing
+  principal throws `PreferenceAccessError`; a principal without a user id has
+  no user tier and cannot write one. A session-only principal (users
+  `createSessionHandler()` without `enterTenantContext`) is entered as a
+  tenant context with the same identity before any table access.
+- **Tenancy.** The model is `@TenantScoped({ mode: 'required' })`, and every
+  store read also names the tenant explicitly (a super-admin bypass context
+  does not filter reads). `save()`/`delete()` refuse a row whose stored
+  tenant, kind, surface or tier differs from memory (matched by predicate:
+  DuckDB returns raw UUID columns as lossy HUGEINTs), a foreign tenant, and a
+  user row that is not the principal's.
+- **Permissions are per kind.** Each kind names `{ tenant, user }` slugs;
+  the model asserts them (`assertOperationPermission`, fail closed) and the
+  store reports them as `canCustomize` (`checkOperationPermission`). A slug
+  must be in the users catalog or it never grants. The users resolver denies
+  a principal with no user id even with the slug in its set. The built-in
+  `personalize` slugs are in users' self-personalization list (seeded for
+  owner/admin/member/viewer once registered).
+- **Permission source.** The principal's permission set is authoritative,
+  including an explicit empty set: a tenancy adapter without
+  `resolvePermissions` refuses everyone (fails closed). Hosts must configure
+  it, or enter identity through users' `enterTenantContext`; never widen it
+  here.
+- **Concurrency.** Optimistic: a save passes the `revision` (ISO
+  `updated_at`) it loaded, `null` meaning "no row". Updates use core's
+  revision CAS (`save({ expectedUpdatedAt })`), a first write is a strict
+  insert (`_insertOnly`) so a racing first write hits the unique index, and
+  a delete is guarded the same way. `reset` treats `revision: null` like
+  save does (a row that exists now conflicts); only an omitted revision
+  resets unguarded. Mismatch: `{ ok: false, reason: 'conflict' }`. Exception, documented: `createShellSettingsPreferences().write`
+  without a revision reads the current one first, i.e. last-writer-wins,
+  because the shell's `ShellSettingsAdapter.write(delta)` carries none.
+- **Overview `loadWidget`** lets a principal without either customize
+  permission load only a widget on their resolved overview; anything else is
+  `not_allowed`. The widget is sanitized against the page definition first.
+- **No generated surface** (`api: { include: [] }`, `cli: false`,
+  `mcp: { include: [] }`): a generated route would skip kind validation.
+
+## Tests
+
+`pnpm test` runs the overview suite and the kinds suite on SQLite and DuckDB
+plus the migration suite; `pnpm test:postgres` runs both suites on PostgreSQL
+(`*.optional.test.ts`, skipped without a database).

package/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/LICENSE

@@ -0,0 +1,7 @@
+Copyright <2025> <Happy Vertical Corporation>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,135 @@
-# Temporary Holding Version
+# @happyvertical/smrt-preferences
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Saved user-interface preferences for s-m-r-t apps: how a page or the app
+frame is arranged. An organization sets the default; each person can keep
+their own version on top of it. Reset returns either one to the layer below.
+
+Two kinds of preference ship with the package:
+
+- **`overview`**: the layout of a customizable overview page from
+  [`smrt-svelte/overview`](../smrt-svelte/agents/overview-surfaces.md)
+  (which widgets, in what order, how wide, with which options).
+- **`shell-layout`**: the app frame's settings from the AdminShell
+  (navigation order and visibility, panel states and widths, keyboard
+  shortcuts).
+
+An app can register more kinds. Every kind checks its own data when it is
+saved (anything invalid is refused) and again when it is loaded (anything
+that no longer fits is dropped and reported, the rest still applies).
+
+Use the stores below; the table's model is not an application API (it
+refuses writes that do not come from the store and never returns another
+person's preferences).
+
+See [AGENTS.md](./AGENTS.md) for the storage rules and
+[agents/preference-kinds.md](./agents/preference-kinds.md) for the kind
+contract.
+
+## Installation
+
+```bash
+pnpm add @happyvertical/smrt-preferences
+```
+
+Preferences live in the `_smrt_ui_preferences` table. Create it with your
+normal migration (`smrt db:migrate`); the package never creates tables at
+runtime. `smrt db:status --parity` reports it like any other table.
+
+## Permissions
+
+| Permission | Lets a person |
+| --- | --- |
+| `overviews.customize` | Change or reset the organization's default layout of a page |
+| `overviews.personalize` | Keep and reset their own layout of a page |
+| `shell.customize` | Change or reset the organization's default app frame |
+| `shell.personalize` | Keep and reset their own app frame settings |
+
+The store reads these from the signed-in person's permission set in the
+request context. If your app enters the tenant context through the tenancy
+SvelteKit or Express adapter, configure its `resolvePermissions` (or let
+`createSessionHandler()` from `@happyvertical/smrt-users` enter the context
+with `enterTenantContext`); without it the adapter supplies an empty
+permission set, and everyone, owners included, is refused.
+
+Owners and admins receive all four when role permissions are seeded. Members
+and viewers receive the two `personalize` permissions; for roles created
+before this package was installed, run
+`seedDefaultRolePersonalizationPermissions()` from `@happyvertical/smrt-users`
+once.
+
+## Overview pages
+
+```ts
+// +page.server.ts
+import { createOverviewStore } from '@happyvertical/smrt-preferences';
+import { eventsHome, widgets } from '$lib/overviews';
+
+export const load = async ({ locals }) => {
+  const overviews = createOverviewStore({ db: locals.db });
+  // Runs inside the request's tenant context; each widget loader receives
+  // the capabilities passed here and must authorize through them.
+  const overview = await overviews.loadPage(eventsHome, widgets, {
+    locale: locals.locale,
+    db: locals.db,
+  });
+  return { overview };
+};
+```
+
+Save with the revision the page loaded; a stale revision returns `conflict`
+instead of overwriting someone else's change:
+
+```ts
+const saved = await overviews.save(eventsHome, widgets, {
+  scope: 'user',
+  override,
+  revision,
+});
+// saved.ok, or saved.reason: 'invalid' (with issues), 'conflict', 'not_allowed'
+await overviews.reset(eventsHome, { scope: 'user', revision });
+const result = await overviews.loadWidget(eventsHome, widgets, widget, ctx);
+```
+
+## App frame (shell layout)
+
+```ts
+import {
+  createPreferenceStore,
+  createShellSettingsPreferences,
+} from '@happyvertical/smrt-preferences';
+
+const shell = createShellSettingsPreferences(createPreferenceStore({ db }));
+
+// Remote functions the browser's ShellSettingsAdapter calls.
+export const readShellSettings = async () => (await shell.read('admin')).delta;
+export const writeShellSettings = (delta: unknown) =>
+  shell.write('admin', delta);
+```
+
+`read` merges the organization default with the person's own settings.
+`write` without a revision writes over the latest stored value, because the
+shell's adapter does not carry one; pass `{ revision }` to guard it.
+
+## Other kinds
+
+```ts
+import {
+  createPreferenceStore,
+  registerPreferenceKind,
+} from '@happyvertical/smrt-preferences';
+
+registerPreferenceKind({
+  kind: 'board-columns',
+  formatVersion: 1,
+  permissions: { tenant: 'boards.customize', user: 'boards.personalize' },
+  validate: (payload, ctx) => checkColumns(payload, ctx),
+});
+
+const preferences = createPreferenceStore({ db });
+const state = await preferences.load('board-columns', 'projects.board');
+await preferences.save('board-columns', 'projects.board', {
+  scope: 'user',
+  payload,
+  revision: state.user?.revision ?? null,
+});
+```

package/agents/preference-kinds.md

@@ -0,0 +1,79 @@
+# Preference kinds
+
+The contract between `_smrt_ui_preferences` and the code that owns a
+preference's meaning (#3727). Package rules are in [../AGENTS.md](../AGENTS.md).
+
+## Registering a kind
+
+```ts
+registerPreferenceKind({
+  kind: 'board-columns',            // /^[a-z][a-z0-9-]{0,47}$/
+  formatVersion: 1,                 // positive integer, stored per row
+  permissions: { tenant: 'boards.customize', user: 'boards.personalize' },
+  validate(payload, ctx) {          // never throws
+    return { ok, canonical, issues };
+  },
+}, { replace? }) // -> dispose()
+```
+
+Registration is code at module scope, process-wide (one registry per
+process). Registering a kind twice throws unless `{ replace: true }`. Both
+slugs must be `collection.action` and registered in the users catalog
+(`registerPermissionDefinitions`), or they never grant; add a `personalize`
+slug to users' built-in self-personalization list only when every built-in
+role should hold it.
+
+The store authorizes against the principal's permission set from the
+ambient context and never widens it. A tenancy adapter (SvelteKit, Express)
+without `resolvePermissions` supplies an explicit empty set, which the store
+treats as authoritative: every write is `not_allowed` and `canCustomize` is
+false for everyone, owners included. Configure `resolvePermissions`, or let
+users' `createSessionHandler({ enterTenantContext: true })` enter the context.
+
+## `validate(payload, ctx)`
+
+| `ctx` field | Meaning |
+| --- | --- |
+| `kind`, `surfaceId` | What is being validated (`surfaceId` matches `PREFERENCE_SURFACE_PATTERN`) |
+| `scope` | `tenant` or `user` |
+| `phase` | `save` (strict) or `load` (lenient) |
+| `formatVersion` | The version the payload was written at (the kind's own on save); migrate older payloads here |
+| `tenant` | User tier only: the tenant tier's canonical payload, or `null` |
+| `options` | Host-supplied, kind-specific inputs, passed through from `load` / `save` |
+
+Return `canonical`: the payload with every invalid part removed (`null` means
+no preference), `issues`: what was removed and why (`{ path, code, message,
+detail? }`), and `ok`: false whenever anything was removed or refused.
+
+- On **save** the store refuses unless `ok`, stores only `canonical` (as
+  JSON with the kind's `formatVersion`), and deletes the row when `canonical`
+  is `null`.
+- On **load** the store uses `canonical` and reports `issues` per tier; the
+  row is not rewritten. Unparseable JSON and rows from a newer
+  `formatVersion` are dropped before `validate` runs. A `validate` that
+  throws on load drops the tier with a `validator_error` issue; on save the
+  error propagates and nothing is stored. Validators should not throw.
+- A payload is data, never code: no query strings, URLs or expressions a
+  reader would execute. Authorization happens where the data is read, never
+  through payload values.
+
+## Built-in kinds
+
+| Kind | Payload | Validator | Permissions | `options` |
+| --- | --- | --- | --- | --- |
+| `overview` | `OverviewOverride` (sparse, version 1) | save: `checkOverviewOverride`; load: `resolveOverview` + `diffOverview`, against the page definition (user tier: tenant-merged via `withTenantDefaults`) | `overviews.customize` / `overviews.personalize` | `{ definition, registry }`; `definition.id` must equal the surface id |
+| `shell-layout` | `ShellSettingsDelta` | `sanitizeShellSettingsDelta` from `@happyvertical/smrt-svelte/workspace/server` | `shell.customize` / `shell.personalize` | none |
+
+## Store calls
+
+`createPreferenceStore({ db })` returns `load(kind, surfaceId, { options })`
+(both tiers, `canCustomize` from the kind's pair), `save(kind, surfaceId, {
+scope, payload, revision, options })` and `reset(kind, surfaceId, { scope,
+revision? })` (`null` conflicts when a row exists; omitted is unguarded). Failures are `{ ok: false, reason: 'not_allowed' | 'conflict'
+| 'invalid' }`; an unregistered kind throws `UnknownPreferenceKindError`.
+
+Kind-shaped layers sit on top: `createOverviewStore` (the overview page API)
+and `createShellSettingsPreferences` (the server half of the shell's
+`ShellSettingsAdapter`: `read(surfaceId)` merges tenant and user with
+`mergeShellSettingsDelta`; `write(surfaceId, delta, { scope?, revision? })`
+is last-writer-wins only when the revision is omitted).

package/dist/__smrt-register__.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=__smrt-register__.d.ts.map

package/dist/__smrt-register__.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"__smrt-register__.d.ts","sourceRoot":"","sources":["../src/__smrt-register__.ts"],"names":[],"mappings":""}

package/dist/collections/UiPreferenceRecordCollection.d.ts

@@ -0,0 +1,18 @@
+import { SmrtCollection } from '@happyvertical/smrt-core';
+import type { PreferenceScope } from '../kinds.js';
+import { UiPreferenceRecord } from '../models/UiPreferenceRecord.js';
+/**
+ * Reads of {@link UiPreferenceRecord}. Not decorated: the model has no
+ * generated surface, so a decorated collection would only add a second
+ * manifest schema for the same table.
+ */
+export declare class UiPreferenceRecordCollection extends SmrtCollection<UiPreferenceRecord> {
+    static readonly _itemClass: typeof UiPreferenceRecord;
+    /**
+     * The row of one tier, or `null`. The tenant predicate is explicit (not
+     * only the interceptor's) because a super-admin bypass context does not
+     * filter reads.
+     */
+    findTier(tenantId: string, kind: string, surfaceId: string, scope: PreferenceScope, userId?: string): Promise<UiPreferenceRecord | null>;
+}
+//# sourceMappingURL=UiPreferenceRecordCollection.d.ts.map

package/dist/collections/UiPreferenceRecordCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UiPreferenceRecordCollection.d.ts","sourceRoot":"","sources":["../../src/collections/UiPreferenceRecordCollection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAEL,kBAAkB,EACnB,MAAM,iCAAiC,CAAC;AAEzC;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,cAAc,CAAC,kBAAkB,CAAC;IAClF,MAAM,CAAC,QAAQ,CAAC,UAAU,4BAAsB;IAEhD;;;;OAIG;IACG,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;CAStC"}

package/dist/context.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The request principal a preference read or write acts as.
+ *
+ * Identity always comes from the ambient context, never from a request body:
+ * the tenancy ALS (`withTenant`, the SvelteKit/Express adapters) first, and
+ * the authenticated users session-permission ALS (`createSessionHandler()`
+ * without `enterTenantContext`) as the fallback, the smrt-fields precedent.
+ */
+import { TenantIsolationError } from '@happyvertical/smrt-tenancy';
+export interface PreferencePrincipal {
+    tenantId: string;
+    /** Absent for service principals, API keys and background jobs. */
+    userId?: string;
+    permissions: ReadonlySet<string>;
+    superAdminBypass: boolean;
+    /** True when the tenancy ALS already carries this principal. */
+    fromTenancy: boolean;
+}
+/** The preference principal of the current async context, if any. */
+export declare function getPreferencePrincipal(): PreferencePrincipal | undefined;
+/** Bounded, identifier-free denial; generated transports serialize it as 403. */
+export declare class PreferenceAccessError extends TenantIsolationError {
+    readonly status = 403;
+    readonly publicMessage: string;
+    constructor(message: string);
+}
+/** The principal, or a fail-closed error when there is no tenant identity. */
+export declare function requirePreferencePrincipal(): PreferencePrincipal;
+/**
+ * Run `fn` with the tenancy ALS carrying `principal`. A session-only
+ * principal is entered as a tenant context with the same tenant, user and
+ * permissions, so the tenancy interceptor scopes the table exactly as it would
+ * under the tenancy adapter. Nothing is widened.
+ */
+export declare function withPrincipal<T>(principal: PreferencePrincipal, fn: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAGL,oBAAoB,EAErB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gEAAgE;IAChE,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,SAAS,CAoBxE;AAED,iFAAiF;AACjF,qBAAa,qBAAsB,SAAQ,oBAAoB;IAC7D,QAAQ,CAAC,MAAM,OAAO;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBAEnB,OAAO,EAAE,MAAM;CAK5B;AAED,8EAA8E;AAC9E,wBAAgB,0BAA0B,IAAI,mBAAmB,CAQhE;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,SAAS,EAAE,mBAAmB,EAC9B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAUZ"}

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @happyvertical/smrt-preferences
+ *
+ * Tenant defaults and per-user preferences for user-interface surfaces
+ * (#3727), stored in the `_smrt_ui_preferences` system table and validated
+ * per registered kind. Built-in kinds: `overview` (customizable overview
+ * pages of `@happyvertical/smrt-svelte/overview`) and `shell-layout` (the
+ * AdminShell settings delta).
+ *
+ * @packageDocumentation
+ */
+import './__smrt-register__.js';
+import './kinds/builtin.js';
+export { getPreferencePrincipal, PreferenceAccessError, type PreferencePrincipal, } from './context.js';
+export { ensureBuiltinPreferenceKinds } from './kinds/builtin.js';
+export { OVERVIEW_PREFERENCE_KIND, type OverviewKindOptions, overviewPreferenceKind, withTenantDefaults, } from './kinds/overview.js';
+export { createShellSettingsPreferences, SHELL_LAYOUT_PREFERENCE_KIND, type ShellSettingsPreferenceRead, type ShellSettingsPreferences, type ShellSettingsPreferenceWriteOptions, shellLayoutPreferenceKind, } from './kinds/shell-layout.js';
+export { getPreferenceKind, listPreferenceKinds, PREFERENCE_KIND_PATTERN, PREFERENCE_SCOPES, PREFERENCE_SURFACE_PATTERN, type PreferenceIssue, type PreferenceKindDefinition, type PreferenceScope, type PreferenceValidateContext, type PreferenceValidation, registerPreferenceKind, requirePreferenceKind, UnknownPreferenceKindError, } from './kinds.js';
+export { TENANT_SCOPE_KEY, UiPreferenceRecord, } from './models/UiPreferenceRecord.js';
+export { createOverviewStore, type OverviewPageOptions, type OverviewResetInput, type OverviewResetResult, type OverviewSaveInput, type OverviewSaveResult, type OverviewState, type OverviewStore, type OverviewStoreOptions, type OverviewTierState, type OverviewWidgetResult, type OverviewWriteFailure, } from './overview.js';
+export { CUSTOMIZE_OVERVIEW_PERMISSION, CUSTOMIZE_SHELL_PERMISSION, ensurePreferencePermissionsRegistered, PERSONALIZE_OVERVIEW_PERMISSION, PERSONALIZE_SHELL_PERMISSION, PREFERENCE_PERMISSION_DEFINITIONS, splitPermissionSlug, } from './permissions.js';
+export { createPreferenceStore, type PreferenceLoadInput, type PreferenceResetInput, type PreferenceResetResult, type PreferenceSaveInput, type PreferenceSaveResult, type PreferenceState, type PreferenceStore, type PreferenceStoreOptions, type PreferenceTier, type PreferenceWriteFailure, } from './store.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,wBAAwB,CAAC;AAChC,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EACL,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,mCAAmC,EACxC,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAMpB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,qCAAqC,EACrC,+BAA+B,EAC/B,4BAA4B,EAC5B,iCAAiC,EACjC,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,sBAAsB,GAC5B,MAAM,YAAY,CAAC"}