@happyvertical/smrt-app-runtime 0.53.3 → 0.53.5

package/dist/local-mcp-tokens.d.ts

@@ -0,0 +1,123 @@
+/**
+ * Owner-minted bearer tokens for local MCP clients (`local` profile only).
+ *
+ * A token is a random 256-bit value with a fixed prefix. The runtime stores
+ * only a domain-separated HMAC of it (keyed by the local application secret)
+ * in the runtime-owned `_smrt_local_mcp_tokens` system table, alongside the
+ * owner's user and tenant, the granted scopes and the expiry. The plaintext
+ * is returned exactly once, by `issue()`.
+ *
+ * A token never carries more authority than its owner holds *now*: `issue()`
+ * refuses scopes the owner does not currently hold, and `verify()` returns
+ * the token's scopes intersected with the owner's live permissions from its
+ * active direct membership in the bound tenant (inherited authority never
+ * substitutes for it; no such membership, an inactive user, a revoked or an
+ * expired token all yield `null`). Routes should still bind the principal with
+ * `runtime.runAsPrincipal`, which applies the same intersection inside the
+ * request permission context.
+ */
+import type { DatabaseInterface } from '@happyvertical/sql';
+/** Runtime-owned system table; ignored by schema diff, parity and portability. */
+export declare const LOCAL_MCP_TOKEN_TABLE = "_smrt_local_mcp_tokens";
+/** Prefix of every local MCP token (aids secret scanning). */
+export declare const LOCAL_MCP_TOKEN_PREFIX = "smrt_mcp_";
+/** Default token lifetime: 30 days. */
+export declare const DEFAULT_LOCAL_MCP_TOKEN_TTL_SECONDS: number;
+/** Longest token lifetime: 365 days. There is no non-expiring token. */
+export declare const MAX_LOCAL_MCP_TOKEN_TTL_SECONDS: number;
+/** Input for {@link LocalMcpTokenStore.issue}. */
+export interface IssueLocalMcpTokenInput {
+    /** Permission slugs the token may use. Each must be held by the owner. */
+    readonly scopes: readonly string[];
+    /**
+     * Lifetime in whole seconds, 60..{@link MAX_LOCAL_MCP_TOKEN_TTL_SECONDS}.
+     * Defaults to {@link DEFAULT_LOCAL_MCP_TOKEN_TTL_SECONDS}.
+     */
+    readonly expiresInSeconds?: number;
+    /** Operator note shown by `list()` (printable, at most 80 characters). */
+    readonly label?: string;
+}
+/** The one-time result of {@link LocalMcpTokenStore.issue}. */
+export interface IssuedLocalMcpToken {
+    /** Public token id used by `list()`/`revoke()`; not a credential. */
+    readonly id: string;
+    /** The bearer credential. Shown once; only its HMAC is stored. */
+    readonly token: string;
+    readonly scopes: readonly string[];
+    readonly label: string | null;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+}
+/** Lifecycle state of a stored token. */
+export type LocalMcpTokenStatus = 'active' | 'expired' | 'revoked';
+/** Secret-free token metadata returned by {@link LocalMcpTokenStore.list}. */
+export interface LocalMcpTokenRecord {
+    readonly id: string;
+    readonly scopes: readonly string[];
+    readonly label: string | null;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly revokedAt: string | null;
+    readonly status: LocalMcpTokenStatus;
+}
+/**
+ * Brand on every principal `verify()` returns. It is an enumerable symbol, so
+ * a spread copy keeps it and `runAsPrincipal` can refuse any attempt to widen
+ * the binding of a token-derived principal.
+ *
+ * @internal
+ */
+export declare const LOCAL_MCP_TOKEN_PRINCIPAL: unique symbol;
+/**
+ * A verified token principal, structurally an MCP app principal. `scopes`
+ * are the token scopes the owner still holds in `tenantId`. The object is
+ * frozen (its `scopes` array too) and always binds `direct`: passed straight to `runAsPrincipal`, it
+ * is authorized only by the owner's active direct membership in `tenantId`.
+ * A copy that sets any other `tenantBinding` is rejected, not ignored.
+ */
+export interface LocalMcpTokenPrincipal {
+    readonly id: string;
+    readonly tenantId: string;
+    readonly kind: 'human';
+    /** Frozen: token scopes ∩ live permissions at verification. */
+    readonly scopes: readonly string[];
+    readonly tenantBinding: 'direct';
+    /** @internal Token provenance brand; see {@link LOCAL_MCP_TOKEN_PRINCIPAL}. */
+    readonly [LOCAL_MCP_TOKEN_PRINCIPAL]: true;
+}
+/** True for a principal derived from a verified local MCP token. */
+export declare function isLocalMcpTokenPrincipal(value: unknown): boolean;
+/** Owner-scoped local MCP token operations. */
+export interface LocalMcpTokenStore {
+    /** Mint a token bound to the local owner's user and tenant. */
+    issue(input: IssueLocalMcpTokenInput): Promise<IssuedLocalMcpToken>;
+    /** Every stored token, newest first, without token values or hashes. */
+    list(): Promise<LocalMcpTokenRecord[]>;
+    /** Revoke a token by id. Repeating it is a no-op. Unknown ids throw. */
+    revoke(id: string): Promise<'revoked' | 'already-revoked'>;
+    /**
+     * Resolve a presented token to its principal, or `null` (fail closed) for
+     * a malformed, unknown, revoked or expired token, or an owner whose user or
+     * membership is no longer active.
+     */
+    verify(token: string): Promise<LocalMcpTokenPrincipal | null>;
+}
+/** @internal Collaborators supplied by the local runtime. */
+export interface LocalMcpTokenStoreDependencies {
+    readonly db: DatabaseInterface;
+    /** Read the local application secret (validated custody). */
+    readonly readSecret: () => Promise<string>;
+    readonly now: () => Date;
+    /** The active local owner, or `null` before owner setup. */
+    readonly findOwner: (db: DatabaseInterface) => Promise<{
+        userId: string;
+        tenantId: string;
+    } | null>;
+    /** Build the stable, secret-free runtime error. */
+    readonly fail: (code: 'invalid_scope' | 'owner_unavailable' | 'invalid_configuration', message: string) => Error;
+}
+/** Create the runtime-owned token table if it does not exist. */
+export declare function ensureLocalMcpTokenTable(db: DatabaseInterface): Promise<void>;
+/** @internal Build the store over an open local database. */
+export declare function createLocalMcpTokenStore(deps: LocalMcpTokenStoreDependencies): LocalMcpTokenStore;
+//# sourceMappingURL=local-mcp-tokens.d.ts.map

package/dist/local-mcp-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-mcp-tokens.d.ts","sourceRoot":"","sources":["../src/local-mcp-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AASH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAI5D,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAC9D,8DAA8D;AAC9D,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAClD,uCAAuC;AACvC,eAAO,MAAM,mCAAmC,QAAoB,CAAC;AACrE,wEAAwE;AACxE,eAAO,MAAM,+BAA+B,QAAqB,CAAC;AAYlE,kDAAkD;AAClD,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,yCAAyC;AACzC,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAEnE,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,OAAO,MAE9C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC;CAC5C;AAED,oEAAoE;AACpE,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAMhE;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,KAAK,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACpE,wEAAwE;IACxE,IAAI,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACvC,wEAAwE;IACxE,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAAC;IAC3D;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;CAC/D;AAED,6DAA6D;AAC7D,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAC/B,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,CAClB,EAAE,EAAE,iBAAiB,KAClB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC1D,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,CACb,IAAI,EAAE,eAAe,GAAG,mBAAmB,GAAG,uBAAuB,EACrE,OAAO,EAAE,MAAM,KACZ,KAAK,CAAC;CACZ;AAaD,iEAAiE;AACjE,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,iBAAiB,GACpB,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,6DAA6D;AAC7D,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,8BAA8B,GACnC,kBAAkB,CAmOpB"}

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-app-runtime",
-  "packageVersion": "0.53.3",
+  "packageVersion": "0.53.5",
   "objects": {},
   "moduleType": "smrt",
   "smrtDependencies": [

package/dist/operation-lock.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Exclusive operator-operation lock (`<state>/operation.lock`).
+ *
+ * Ported from the template's `scripts/smrt-operation-lock.mjs`: the same
+ * file, record shape, and messages. Stale-owner reclamation is serialized
+ * through `stale-reclaim.ts` so it can never remove a live lock.
+ */
+/** Held lock handed to the operation callback. */
+export interface OperationLock {
+    /** Per-acquisition nonce; a managed writer presents it to join the operation. */
+    readonly instance: string;
+    /** Lock file path. */
+    readonly path: string;
+}
+/** True when `pid` names a live process, including one owned by another user. */
+export declare function processExists(pid: number): boolean;
+/** Owner pid of a lock record, or `null` when it cannot be verified. */
+export declare function lockOwnerPid(contents: string): number | null;
+/** True when an operation-lock record names an owner that no longer exists. */
+export declare function isStaleOperationLock(contents: string): boolean;
+/**
+ * Run `callback` while holding the application's exclusive operation lock.
+ *
+ * A lock whose owner process is gone is reclaimed; an unverifiable lock fails
+ * closed. The lock is only removed when it is still this acquisition's own.
+ */
+export declare function withOperationLock<T>(stateRoot: string, operation: string, callback: (lock: OperationLock) => Promise<T> | T): Promise<T>;
+//# sourceMappingURL=operation-lock.d.ts.map

package/dist/operation-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-lock.d.ts","sourceRoot":"","sources":["../src/operation-lock.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sBAAsB;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CASlD;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS5D;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG9D;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAChD,OAAO,CAAC,CAAC,CAAC,CAiEZ"}

package/dist/plain-data.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Hardened copies of caller-supplied plain data (#3413 review N1).
+ *
+ * Every copy is built from own data properties only, into null-prototype
+ * objects and fresh dense arrays, and deep-frozen. It rejects, at every
+ * depth: the keys `__proto__`, `constructor` and `prototype`; accessor
+ * properties (getters are never invoked); objects whose prototype is not
+ * `Object.prototype` or `null` (class instances, objects inheriting data);
+ * arrays that are sparse, subclassed or carry extra own keys; functions; and
+ * nesting deeper than {@link MAX_PLAIN_DATA_DEPTH}. Non-enumerable own
+ * properties are dropped.
+ *
+ * @internal
+ */
+/** Keys that can rewrite a prototype or impersonate a constructor. */
+export declare const FORBIDDEN_DATA_KEYS: ReadonlySet<string>;
+/** Deepest accepted nesting. */
+export declare const MAX_PLAIN_DATA_DEPTH = 8;
+/** Thrown for input that is not acceptable plain data. */
+export declare class PlainDataError extends Error {
+    readonly name = "PlainDataError";
+}
+/** Deep-frozen copy of `value`, or a {@link PlainDataError}. */
+export declare function deepFrozenPlainCopy(value: unknown, depth?: number): unknown;
+/** Own data value of `key` on a copy made by {@link deepFrozenPlainCopy}. */
+export declare function ownValue(record: object, key: PropertyKey): unknown;
+//# sourceMappingURL=plain-data.d.ts.map

package/dist/plain-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plain-data.d.ts","sourceRoot":"","sources":["../src/plain-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAIlD,CAAC;AAEH,gCAAgC;AAChC,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,0DAA0D;AAC1D,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,IAAI,oBAAoB;CAC3C;AAED,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CA4DtE;AAED,6EAA6E;AAC7E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAIlE"}

package/dist/provider-readiness.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Provider-owned readiness probes for deployed profiles.
+ *
+ * Ported from the template's `scripts/smrt-provider-readiness.mjs`. The
+ * module named by the environment setting is resolved from the application
+ * (not from this CLI package), because it is the application's installed
+ * provider adapter.
+ */
+/** Provider components with a readiness module setting. */
+export type ReadinessComponent = 'authentication' | 'assets' | 'secrets';
+/** Environment variable naming each component's readiness module. */
+export declare const PROVIDER_READINESS_SETTINGS: Readonly<Record<ReadinessComponent, string>>;
+/** Context handed to the provider's probe. */
+export interface ReadinessContext {
+    profile: string;
+    provider: string;
+}
+/** Options for {@link createProviderReadinessProbe}. */
+export interface ProviderReadinessOptions {
+    /** Application root the module is resolved from. Defaults to `process.cwd()`. */
+    sourceRoot?: string;
+    /** Environment to read the setting from. Defaults to `process.env`. */
+    environment?: Record<string, string | undefined>;
+}
+/**
+ * Locate an installed package the way an ES module in `sourceRoot` would:
+ * the nearest `node_modules/<name>` walking up from the application. Unlike
+ * CommonJS resolution this never consults `NODE_PATH`, which package-manager
+ * bin shims point at the CLI's own dependency store.
+ */
+export declare function findInstalledPackage(sourceRoot: string, packageName: string): string | null;
+/**
+ * Resolve a readiness module specifier the way the application would.
+ *
+ * URLs (`data:`, `file:`) are imported as given; absolute paths become file
+ * URLs; relative paths resolve against the application root; bare package
+ * specifiers resolve through Node's ESM resolver from the application root
+ * (as the template's in-app `import()` did) and must land inside the
+ * package installed in the application's own `node_modules` chain.
+ */
+export declare function resolveReadinessModule(specifier: string, sourceRoot: string): Promise<string>;
+/**
+ * Build a provider-owned readiness probe. The installed adapter module must
+ * export `checkReadiness()` (or a default function) and return `true` or
+ * `{ ready: true }` only after checking its real backing service.
+ */
+export declare function createProviderReadinessProbe(component: ReadinessComponent, context: ReadinessContext, options?: ProviderReadinessOptions): () => Promise<void>;
+//# sourceMappingURL=provider-readiness.d.ts.map

package/dist/provider-readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-readiness.d.ts","sourceRoot":"","sources":["../src/provider-readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEzE,qEAAqE;AACrE,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAChD,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAKlC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,wBAAwB;IACvC,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI,CASf;AAgDD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,kBAAkB,EAC7B,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,wBAA6B,GACrC,MAAM,OAAO,CAAC,IAAI,CAAC,CAkCrB"}

package/dist/smrt-knowledge.json

@@ -3,16 +3,17 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-app-runtime",
-  "packageVersion": "0.53.3",
+  "packageVersion": "0.53.5",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "c4e1b33b8ca0ac595f2b70a65d7c5ba22d1434682faa154fb95beef12ff6e214",
-    "packageJson": "707fc79bc32d3422801bf43738be6c88e7ed24b920cc6de16e159e13a97afce4",
-    "agents": "f209485465cd0e0f48385f49f0785443a717f2563a9d0a6ca811ca0f24940cc2"
+    "manifest": "0876fa0e092ab5080b8e228ef3f629a02af073b66a791b57891469b923f85dec",
+    "packageJson": "4b101ed7e43dc09873c74edf101dcbae6f1d681f5c7cb6757994cee31d3521c1",
+    "agents": "f5b360b498cc5c914a13958ebf462791c4793409b98e09ce325a68514bdc1d37"
   },
   "exports": [
-    "."
+    ".",
+    "./sveltekit"
   ],
   "dependencies": {
     "@happyvertical/smrt-config": "workspace:*",
@@ -23,7 +24,9 @@
     "@happyvertical/smrt-users": "workspace:*",
     "@happyvertical/sql": "catalog:",
     "@happyvertical/smrt-vitest": "workspace:*",
+    "@sveltejs/kit": "^2.20.0",
     "@types/node": "24.13.6",
+    "tsx": "^4.23.13",
     "typescript": "6.0.3",
     "vite": "8.1.4",
     "vitest": "4.1.10"
@@ -63,5 +66,5 @@
     "polymorphicAssociations": 0,
     "uuidColumns": 0
   },
-  "agentDoc": "# @happyvertical/smrt-app-runtime\n\nApplication infrastructure composition for the validated runtime profiles in\n`@happyvertical/smrt-config`.\n\n## Local profile\n\n- `validateApplicationId()` is the canonical strict validator for explicit app\n  IDs. `encodeApplicationId()` derives a length-bounded, collision-resistant\n  ID from package names; generated operational surfaces must share these APIs.\n- `initializeLocalApplicationRuntime()` owns user data paths, SQLite tuning,\n  local application-secret creation, and the single-use owner bootstrap flow.\n- SQLite is acquired through `@happyvertical/sql`'s explicit\n  `{ driver: 'node:sqlite', custody: 'trusted-parent' }` boundary after the\n  runtime establishes its user-owned mode-0700 data root.\n- Application migrations are explicit through `prepareDatabase`; runtime never\n  creates application model tables implicitly. A rejected `prepareDatabase` is\n  normalized into `LocalRuntimeError` with the stable `migration_failed` code\n  and the fixed recovery message `MIGRATION_FAILED_MESSAGE` (\"run pnpm\n  app:setup and inspect the private migration logs\"). The caller's error text\n  is never surfaced — it is retained only as a non-enumerable `cause` for\n  private logs — and the same application root stays retryable.\n- Standalone migration commands must call `prepareLocalDatabaseStorage()`\n  before opening SQLite so custody is established without creating schema or\n  bootstrap records.\n- Read-only/copy/import operator commands must call\n  `validateLocalDatabaseStorage()` before opening SQLite; it verifies the\n  app-bound marker, source separation, real path chain, ownership, and mode\n  without creating or repairing storage.\n- Owner bootstrap creates normal `Person`, `User`, `Tenant`, owner `Role` /\n  `Membership`, and `Session` records in one transaction.\n- Bootstrap is loopback-only. Only an HMAC of the short-lived token is stored.\n  A token that cannot claim fails a read-only preflight before role/catalog\n  seeding (#3323); the claim transaction's conditional UPDATE stays the\n  authority for single use, expiry, and concurrency.\n- Background jobs and application-defined paid capabilities are default-off.\n- The embedded runner reuses `TaskRunner`; it is not a second job contract.\n\n## Deployed profiles\n\n- `initializeDeployedApplicationRuntime()` composes only `self-hosted` and\n  `cloud`; it rejects local initialization and provider/binding mismatches.\n- Provider bindings own credentials, vendor clients, and readiness checks.\n  Runtime diagnostics contain selectors and status only.\n- The database binding must expose a provider-owned `close` callback before\n  `connect` can run. The runtime owns that cleanup boundary and runs the\n  application's explicit, idempotent `prepareDatabase` hook.\n- A failed startup cleanup throws `DeployedRuntimeCleanupError`; callers retain\n  and retry its idempotent `retryCleanup()` boundary until it succeeds.\n- Public authentication, asset storage, and secret bindings are mandatory and\n  readiness-checked before startup succeeds.\n- `createTaskWorker()` and `createScheduleWorker()` initialize the normal jobs\n  package runners against the shared PostgreSQL database. They are intended for\n  separate processes; the web process does not start them automatically. The\n  worker process must import the app's compiled registration\n  (`.smrt/runtime/register.js`, #3117) first; runners resolve `objectType`\n  through the registry and never load application source themselves.\n- `close()` drains in-flight readiness/session/worker initialization and\n  serialized runner start/stop operations, stops every runner returned by the\n  runtime, and then closes PostgreSQL. Returned runners must not be restarted\n  after runtime shutdown begins.\n- A tracked operation may await a re-entrant `close()` request without\n  deadlocking; external `close()` callers still await complete cleanup.\n- `health()` is process liveness. `readiness()` probes database/auth/assets/\n  secrets; it does not claim that an external worker fleet is running.\n- Database-provider readiness is additive; a PostgreSQL-specific server-version\n  probe always gates startup and live readiness.\n- Cloud must keep required tenant context and must never introduce a root or\n  unscoped tenant fallback. RLS remains an explicit deployment/migration choice.\n\n## Public runtime diagnostics\n\n- `projectRuntimeDiagnostics()` is the only public diagnostic projection. It\n  constructs the schema-version-1 allowlist and never serializes the private\n  local or deployed diagnostics objects.\n- The allowlist is limited to active profile/coarse health, schema and\n  migration readiness, six fixed capability statuses, a sorted/capped public\n  tool inventory plus digest, explicit operational topology differences,\n  coarse worker heartbeat state, and eight stable code/timestamp errors.\n- Callers supply an explicit clock and worker-heartbeat seam. A missing\n  heartbeat is `unknown`; web-process liveness never proves worker liveness.\n- Error ingestion maps unknown codes to `runtime_error`, truncates timestamps\n  to the minute, and ignores messages, stacks, logs, records, and nested state.\n- Authentication and diagnostics-read authorization belong before every call\n  to the projector or its runtime probes.\n\n## Invariants\n\n- Never expose application-secret bytes or bootstrap token hashes in diagnostics.\n- Never include migration or provider error text in a local or deployed startup\n  error message; migration driver text is a likely credential carrier.\n- Never include provider error text, URLs, tokens, or credentials in deployed\n  errors, diagnostics, health, or readiness payloads.\n- Keep local data, assets, database, and secrets outside the source tree.\n- Do not reach into collection/database private fields. Add an upstream public\n  API if composition cannot be expressed through exported surfaces.\n- Keep profile selection out of domain models, generated APIs, MCP/WebMCP\n  surfaces, effects, approvals, and authorization records.\n\n## Validation\n\n```bash\npnpm --filter @happyvertical/smrt-app-runtime test\npnpm --filter @happyvertical/smrt-app-runtime typecheck\npnpm --filter @happyvertical/smrt-app-runtime build\n```\n"
+  "agentDoc": "# @happyvertical/smrt-app-runtime\n\nApplication infrastructure composition for the validated runtime profiles in\n`@happyvertical/smrt-config`.\n\n## Local profile\n\n- `validateApplicationId()` is the canonical strict validator for explicit app\n  IDs. `encodeApplicationId()` derives a length-bounded, collision-resistant\n  ID from package names; generated operational surfaces must share these APIs.\n- `initializeLocalApplicationRuntime()` owns user data paths, SQLite tuning,\n  local application-secret creation, and the single-use owner bootstrap flow.\n- SQLite is acquired through `@happyvertical/sql`'s explicit\n  `{ driver: 'node:sqlite', custody: 'trusted-parent' }` boundary after the\n  runtime establishes its user-owned mode-0700 data root.\n- Application migrations are explicit through `prepareDatabase`; runtime never\n  creates application model tables implicitly. A rejected `prepareDatabase` is\n  normalized into `LocalRuntimeError` with the stable `migration_failed` code\n  and the fixed recovery message `MIGRATION_FAILED_MESSAGE` (\"run pnpm\n  app:setup and inspect the private migration logs\"). The caller's error text\n  is never surfaced — it is retained only as a non-enumerable `cause` for\n  private logs — and the same application root stays retryable.\n- Standalone migration commands must call `prepareLocalDatabaseStorage()`\n  before opening SQLite so custody is established without creating schema or\n  bootstrap records.\n- Read-only/copy/import operator commands must call\n  `validateLocalDatabaseStorage()` before opening SQLite; it verifies the\n  app-bound marker, source separation, real path chain, ownership, and mode\n  without creating or repairing storage.\n- Owner bootstrap creates normal `Person`, `User`, `Tenant`, owner `Role` /\n  `Membership`, and `Session` records in one transaction.\n- Bootstrap is loopback-only. Only an HMAC of the short-lived token is stored.\n  A token that cannot claim fails a read-only preflight before role/catalog\n  seeding (#3323); the claim transaction's conditional UPDATE stays the\n  authority for single use, expiry, and concurrency.\n- Local MCP tokens (`mcpTokens`, `openLocalMcpTokenStore`, `smrt app token`):\n  owner-bound, scoped, expiring (default 30 d, max 365 d), revocable. Only a\n  domain-separated HMAC (application secret) is stored, in the runtime-owned\n  `_smrt_local_mcp_tokens` system table (created like the bootstrap table;\n  never application schema). Issue refuses scopes the owner lacks; verify\n  returns token scopes ∩ live permissions and `null` for anything else.\n- Bearer binding is explicit (`tenantBinding`, set by the auth adapter;\n  `direct-membership.ts`): `direct` (local tokens, default hosted resolver)\n  needs an active direct membership in exactly the tenant; the default\n  `direct-or-inherited` (hosted app mappings) applies\n  `isSessionTenantAuthorized`'s rule. The direct row, when present, is pinned\n  into `PermissionResolver`, so inheritance never substitutes for it.\n  `verify()` principals (and their `scopes` arrays) are frozen;\n  `runAsPrincipal` takes a validated, deep-frozen, null-prototype copy of\n  the principal before any await (`plain-data.ts`: own data only; poison\n  keys `__proto__`/`constructor`/`prototype`, accessors, inherited or\n  non-plain data, sparse arrays and functions rejected), authorizes from it,\n  and hands `fn` that snapshot. Token `issue()` input is read the same way.\n  They carry\n  `tenantBinding: 'direct'` and the\n  `LOCAL_MCP_TOKEN_PRINCIPAL` brand; `runAsPrincipal` rejects a copy that\n  widens the binding, so the two public APIs compose safely.\n  Never log or return the token outside `issue()`. The operator store opens an\n  uncached connection and takes no writer lease (revocation is per request).\n- Background jobs and application-defined paid capabilities are default-off.\n- The embedded runner reuses `TaskRunner`; it is not a second job contract.\n\n## Deployed profiles\n\n- `initializeDeployedApplicationRuntime()` composes only `self-hosted` and\n  `cloud`; it rejects local initialization and provider/binding mismatches.\n- Provider bindings own credentials, vendor clients, and readiness checks.\n  Runtime diagnostics contain selectors and status only.\n- The database binding must expose a provider-owned `close` callback before\n  `connect` can run. The runtime owns that cleanup boundary and runs the\n  application's explicit, idempotent `prepareDatabase` hook.\n- A failed startup cleanup throws `DeployedRuntimeCleanupError`; callers retain\n  and retry its idempotent `retryCleanup()` boundary until it succeeds.\n- Public authentication, asset storage, and secret bindings are mandatory and\n  readiness-checked before startup succeeds.\n- `createTaskWorker()` and `createScheduleWorker()` initialize the normal jobs\n  package runners against the shared PostgreSQL database. They are intended for\n  separate processes; the web process does not start them automatically. The\n  worker process must import the app's compiled registration\n  (`.smrt/runtime/register.js`, #3117) first; runners resolve `objectType`\n  through the registry and never load application source themselves.\n- `close()` drains in-flight readiness/session/worker initialization and\n  serialized runner start/stop operations, stops every runner returned by the\n  runtime, and then closes PostgreSQL. Returned runners must not be restarted\n  after runtime shutdown begins.\n- A tracked operation may await a re-entrant `close()` request without\n  deadlocking; external `close()` callers still await complete cleanup.\n- `health()` is process liveness. `readiness()` probes database/auth/assets/\n  secrets; it does not claim that an external worker fleet is running.\n- Database-provider readiness is additive; a PostgreSQL-specific server-version\n  probe always gates startup and live readiness.\n- Cloud must keep required tenant context and must never introduce a root or\n  unscoped tenant fallback. RLS remains an explicit deployment/migration choice.\n\n## SvelteKit entry (`./sveltekit`)\n\n- Server-only subpath; `@sveltejs/kit` is an optional peer and is externalized\n  in `vite.config.ts` (kit recognizes `redirect`/`fail` by class identity).\n  The root entry must never import kit or Svelte.\n- Without a `runtime` option the profile comes from smrt-config's\n  `resolveEffectiveApplicationRuntime(await loadConfig())`, the same rule as\n  `smrt app` (#3446): no block → `local`; `null`/`false`/`0`/`''` fail closed.\n- `createSmrtSvelteKitRuntime()` order is fixed: readiness gate → URL tenant\n  selection (`locals.selectedTenant*`, never tenant context, headers ignored) →\n  verified session (tenant context entered only when\n  `isSessionTenantAuthorized()` accepts it, else unauthenticated; never via\n  `createSessionHandler`, which re-runs `resolve` on downstream errors) →\n  publish `locals.tenantContext` only for that verified tenant.\n- `database-rls` isolation forces `postgresRls: true`, including on\n  `skipPaths` (anonymous principal). `resolve` runs at most once;\n  session-layer failure before it is a 500 with cleared locals.\n- In an RLS request `classOptions()`/`databaseConfig()` return the\n  transaction-bound request db (class `db` overrides win). Anything that\n  outlives a request (session service, tenant selector) must use the base\n  config, never these.\n- The local writer lease defaults to `defaultWriterLease()` (root\n  `acquireWriterLease` over `prepareApplicationStateRoot`, presenting\n  `SMRT_OPERATION_INSTANCE`); `acquireWriterLease` replaces it, `false` opts\n  out, deployed profiles never take it. Provider readiness stays injected:\n  apps pass `createProviderReadinessProbe`; deployed startup fails closed\n  without `providerReadiness`.\n- `getCollection()` builds from `classOptions()` on every call (RLS request db\n  inside a request); each generated route's embedded prelude imports the\n  app's `smrt.ts` and reaches it through core's\n  `createGeneratedCollectionAccess()` (a legacy accessor export wins,\n  deprecated for one release).\n- Owner setup removes the `smrt app` onboarding hand-off files by default,\n  immediately after the claim commits (before cookie serialization or hooks);\n  `onOwnerClaimed` is for additional cleanup and\n  `removeOnboardingHandoff: false` is the explicit opt-out.\n- Owner setup re-checks loopback peer and loopback URL host per request and\n  returns only fixed `{ code, message }` failures.\n- `verifyLocalMcpToken` (local only) and `resolveMcpPrincipal` (hosted only:\n  issuer/subject → `oidc_identities` → exactly one active user with exactly\n  one active direct membership, else `null`) are the runtime's MCP credential\n  bindings; pass the runtime as `createHostedMcpResourceAuth({ runtime })`.\n  Token claims never select a tenant.\n- `resolveApplicationId()` / `runtimeConfigurationFingerprint()` must stay\n  byte-compatible with process managers (golden vectors in tests).\n\n## Operator state (root entry)\n\n- One owner for the state shared by the web process and `smrt app`\n  (`@happyvertical/smrt-cli/app` re-exports these): `resolveApplicationStateRoot`\n  / `prepareApplicationStateRoot` (private app-bound mode-0700 root and\n  marker), `withOperationLock` (`operation.lock`), `acquireWriterLease` /\n  `readActiveWriterLease` (`writer.lease`), `reclaimStaleRecord`, and\n  `createProviderReadinessProbe` (`SMRT_*_READINESS_MODULE`, resolved from the\n  app root with Node's own ESM rules). File names, record formats, and\n  messages are a cross-process contract; never change them unilaterally.\n- Tests that hook `node:fs` interleavings must live in this package: from a\n  consumer the package is an externalized dependency a mock cannot reach.\n\n## Public runtime diagnostics\n\n- `projectRuntimeDiagnostics()` is the only public diagnostic projection. It\n  constructs the schema-version-1 allowlist and never serializes the private\n  local or deployed diagnostics objects.\n- The allowlist is limited to active profile/coarse health, schema and\n  migration readiness, six fixed capability statuses, a sorted/capped public\n  tool inventory plus digest, explicit operational topology differences,\n  coarse worker heartbeat state, and eight stable code/timestamp errors.\n- Callers supply an explicit clock and worker-heartbeat seam. A missing\n  heartbeat is `unknown`; web-process liveness never proves worker liveness.\n- Error ingestion maps unknown codes to `runtime_error`, truncates timestamps\n  to the minute, and ignores messages, stacks, logs, records, and nested state.\n- Authentication and diagnostics-read authorization belong before every call\n  to the projector or its runtime probes.\n\n## Invariants\n\n- Never expose application-secret bytes or bootstrap token hashes in diagnostics.\n- Never include migration or provider error text in a local or deployed startup\n  error message; migration driver text is a likely credential carrier.\n- Never include provider error text, URLs, tokens, or credentials in deployed\n  errors, diagnostics, health, or readiness payloads.\n- Keep local data, assets, database, and secrets outside the source tree.\n- Do not reach into collection/database private fields. Add an upstream public\n  API if composition cannot be expressed through exported surfaces.\n- Keep profile selection out of domain models, generated APIs, MCP/WebMCP\n  surfaces, effects, approvals, and authorization records.\n\n## Validation\n\n```bash\npnpm --filter @happyvertical/smrt-app-runtime test\npnpm --filter @happyvertical/smrt-app-runtime typecheck\npnpm --filter @happyvertical/smrt-app-runtime build\n```\n"
 }

package/dist/stale-reclaim.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Serialized removal of stale `operation.lock` / `writer.lease` files.
+ *
+ * Deciding a lock is stale (owner pid gone) and unlinking it are two steps,
+ * and POSIX has no "unlink if unchanged". Two reclaimers that both observed
+ * the same dead owner could otherwise interleave so that the slower one
+ * unlinks the live lock the faster one just created (#3371 review R1).
+ *
+ * Every reclamation therefore runs under an exclusive SQLite transaction on
+ * a dedicated mutex database next to the lock. The kernel releases that lock
+ * when its holder dies, so the mutex itself can never go stale, and nothing
+ * on the lock path is renamed or replaced. Under the mutex the reclaimer
+ * re-reads the lock and only unlinks the exact record it judged stale, after
+ * re-checking that its owner is still gone. Acquisition stays a plain
+ * `O_EXCL` create, so record formats are unchanged and readable by the
+ * template's original scripts.
+ */
+/** Mutex database file created in the lock's (private) state directory. */
+export declare const RECLAIM_MUTEX_FILE = ".smrt-lock-reclaim.sqlite";
+/** Outcome of {@link reclaimStaleRecord}. */
+export type ReclaimOutcome = 
+/** The observed stale record was removed by this call. */
+'removed'
+/** The lock no longer exists (another reclaimer removed it). */
+ | 'gone'
+/** The lock now holds a different record, or its owner is live: untouched. */
+ | 'changed';
+/**
+ * Remove `path` only if it still contains exactly `observed` and
+ * `isStale(observed)` still holds, serialized against every other reclaimer.
+ */
+export declare function reclaimStaleRecord(path: string, observed: string, isStale: (contents: string) => boolean): ReclaimOutcome;
+//# sourceMappingURL=stale-reclaim.d.ts.map

package/dist/stale-reclaim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stale-reclaim.d.ts","sourceRoot":"","sources":["../src/stale-reclaim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,8BAA8B,CAAC;AAK9D,6CAA6C;AAC7C,MAAM,MAAM,cAAc;AACxB,0DAA0D;AACxD,SAAS;AACX,gEAAgE;GAC9D,MAAM;AACR,8EAA8E;GAC5E,SAAS,CAAC;AAoCd;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GACrC,cAAc,CAahB"}

package/dist/state-root.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Private, app-bound state root shared by the running web process and the
+ * `smrt app` operator commands (`writer.lease`, `operation.lock`, onboarding
+ * handoff files).
+ *
+ * The path is derived from the canonical application/data identity so every
+ * process managing one database root shares one lock domain. Moved here from
+ * `@happyvertical/smrt-cli/app` (which re-exports it) so the web process does
+ * not depend on the CLI package; files, names, and error messages are
+ * unchanged from the template's former `scripts/smrt-runtime-identity.mjs`.
+ */
+/** Inputs for the state-root resolvers. */
+export interface ApplicationStateRootOptions {
+    appId: string;
+    dataDirectory?: string;
+    sourceRoot?: string;
+    /** Testable platform override. */
+    platformName?: NodeJS.Platform | string;
+    /** Testable home-directory override. */
+    homeDirectory?: string;
+    /** Testable environment override. */
+    environment?: Record<string, string | undefined>;
+}
+/**
+ * State is derived from the canonical application/data identity. It is not an
+ * independent override because every process and operator command must share
+ * one lock domain for a given database root.
+ */
+export declare function resolveApplicationStateRoot(options: ApplicationStateRootOptions): string;
+/** Owner check seam; production uses the real process uid. */
+export interface StateCustodyOptions {
+    /**
+     * Testable uid override (e.g. to prove a foreign owner is rejected). It can
+     * only substitute a uid; it cannot disable the ownership check.
+     */
+    currentUid?: number;
+}
+/**
+ * Create or verify the private, app-bound state/lock directory.
+ */
+export declare function prepareApplicationStateRoot(options: ApplicationStateRootOptions & StateCustodyOptions): string;
+/**
+ * Hand-off files `smrt app setup` / `recover` leave in the private state root.
+ * They hold the loopback `/setup?token=` URL, so they are spent once the owner
+ * claim commits.
+ */
+export declare const ONBOARDING_HANDOFF_FILES: readonly string[];
+/**
+ * Remove the onboarding hand-off files from `stateRoot`. Missing files are
+ * fine. Call only after the owner claim transaction has committed.
+ */
+export declare function removeOnboardingHandoff(stateRoot: string): void;
+//# sourceMappingURL=state-root.d.ts.map

package/dist/state-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-root.d.ts","sourceRoot":"","sources":["../src/state-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,2CAA2C;AAC3C,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC;IACxC,wCAAwC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,2BAA2B,GACnC,MAAM,CAoBR;AAWD,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,2BAA2B,GAAG,mBAAmB,GACzD,MAAM,CAyFR;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAGpD,CAAC;AAEH;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAI/D"}

package/dist/sveltekit/handlers.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Mountable runtime routes: liveness health, authorized diagnostics, and the
+ * server-owned session summary for the root layout.
+ */
+import { type RequestHandler } from '@sveltejs/kit';
+import type { RuntimeDiagnostics } from '../runtime-diagnostics.js';
+import type { ApplicationRuntimeDiagnosticsOptions, SmrtSvelteKitRuntime } from './runtime.js';
+/** Explicit permission that grants diagnostics read without the owner role. */
+export declare const RUNTIME_DIAGNOSTICS_READ_PERMISSION = "runtime_diagnostics.read";
+/**
+ * Mount as `src/routes/api/_runtime/health/+server.ts`:
+ * `export const GET = createRuntimeHealthHandler(runtime);`
+ *
+ * Local responses add the application ID, managed process instance, and the
+ * secret-free configuration fingerprint that process managers compare.
+ * Deployed responses expose only schema version, status, and profile.
+ */
+export declare function createRuntimeHealthHandler(runtime: Pick<SmrtSvelteKitRuntime, 'health'>): RequestHandler;
+/** The locals the diagnostics route authorizes against. */
+export interface DiagnosticsPrincipalLocals {
+    readonly user?: {
+        readonly id?: unknown;
+    } | null;
+    readonly membership?: {
+        readonly userId?: unknown;
+        readonly tenantId?: unknown;
+        readonly roleId?: unknown;
+        isActive?: () => boolean;
+    } | null;
+    readonly permissions?: readonly string[];
+    readonly tenantId?: unknown;
+    readonly sessionId?: unknown;
+}
+type DiagnosticsInputValue<T> = T | (() => T);
+export interface RuntimeDiagnosticsHandlerOptions {
+    /** Supplies default diagnostics reading and owner-role lookup. */
+    readonly runtime?: Pick<SmrtSvelteKitRuntime, 'readDiagnostics' | 'classOptions'>;
+    /** Replace the runtime projection (must already be the public allowlist). */
+    readonly readDiagnostics?: () => Promise<RuntimeDiagnostics>;
+    /** Replace the owner-role lookup. Thrown errors deny. */
+    readonly resolveRoleSlug?: (roleId: string) => Promise<string | null>;
+    /** Override where the principal comes from. Defaults to `event.locals`. */
+    readonly resolveLocals?: (event: {
+        readonly locals: unknown;
+    }) => DiagnosticsPrincipalLocals;
+    /** Public tool inventory (sorted/capped by the projector). */
+    readonly toolNames?: DiagnosticsInputValue<readonly string[]>;
+    readonly schemaStatus?: DiagnosticsInputValue<ApplicationRuntimeDiagnosticsOptions['schemaStatus']>;
+    readonly migrationStatus?: DiagnosticsInputValue<ApplicationRuntimeDiagnosticsOptions['migrationStatus']>;
+    readonly workerHeartbeatAt?: () => Date | string | null | undefined;
+    readonly recentErrors?: () => ApplicationRuntimeDiagnosticsOptions['recentErrors'];
+    /** Testable clock. */
+    readonly now?: () => Date;
+}
+/**
+ * Mount as `src/routes/api/_runtime/diagnostics/+server.ts`:
+ * `export const GET = createRuntimeDiagnosticsHandler({ runtime });`
+ *
+ * Authentication and authorization always complete before the private runtime
+ * is read. Authorized callers hold `runtime_diagnostics.read` or the `owner`
+ * role of their active, session-matching membership. Every failure is a
+ * stable `{ schemaVersion: 1, error: { code } }` body.
+ */
+export declare function createRuntimeDiagnosticsHandler(options: RuntimeDiagnosticsHandlerOptions): RequestHandler;
+/** Server-owned session summary for the root layout. */
+export interface SessionLayoutData {
+    readonly session: {
+        readonly authenticated: boolean;
+        /** Tenant authorized by the active session. */
+        readonly activeTenantId: string | null;
+        /** URL-selected tenant candidate; display only, never authorization. */
+        readonly selectedTenantSlug: string | null;
+    };
+}
+/**
+ * Mount as `src/routes/+layout.server.ts`:
+ * `export const load = createSessionLayoutLoad();`
+ */
+export declare function createSessionLayoutLoad(): (event: {
+    readonly locals: unknown;
+}) => SessionLayoutData;
+export {};
+//# sourceMappingURL=handlers.d.ts.map

package/dist/sveltekit/handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/sveltekit/handlers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EACV,oCAAoC,EACpC,oBAAoB,EACrB,MAAM,cAAc,CAAC;AAEtB,+EAA+E;AAC/E,eAAO,MAAM,mCAAmC,6BAA6B,CAAC;AAE9E;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAC5C,cAAc,CAEhB;AAED,2DAA2D;AAC3D,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC;KAC1B,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,KAAK,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAE9C,MAAM,WAAW,gCAAgC;IAC/C,kEAAkE;IAClE,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CACrB,oBAAoB,EACpB,iBAAiB,GAAG,cAAc,CACnC,CAAC;IACF,6EAA6E;IAC7E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7D,yDAAyD;IACzD,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QAC/B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;KAC1B,KAAK,0BAA0B,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAC3C,oCAAoC,CAAC,cAAc,CAAC,CACrD,CAAC;IACF,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAC9C,oCAAoC,CAAC,iBAAiB,CAAC,CACxD,CAAC;IACF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,IAAI,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,oCAAoC,CAAC,cAAc,CAAC,CAAC;IACnF,sBAAsB;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAQD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,cAAc,CA+DhB;AAoCD,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;QAChC,+CAA+C;QAC/C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QACvC,wEAAwE;QACxE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5C,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,KAAK,iBAAiB,CAetB"}

package/dist/sveltekit/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * SvelteKit server entry for `@happyvertical/smrt-app-runtime`.
+ *
+ * Server-only: this entry never imports Svelte components or browser code.
+ * `@sveltejs/kit` is an optional peer dependency resolved from the consumer.
+ *
+ * @example
+ * ```ts
+ * // src/hooks.server.ts
+ * import { createSmrtSvelteKitRuntime } from '@happyvertical/smrt-app-runtime/sveltekit';
+ *
+ * export const runtime = createSmrtSvelteKitRuntime();
+ * export const { handle, init } = runtime;
+ * ```
+ */
+export { createRuntimeDiagnosticsHandler, createRuntimeHealthHandler, createSessionLayoutLoad, type DiagnosticsPrincipalLocals, RUNTIME_DIAGNOSTICS_READ_PERMISSION, type RuntimeDiagnosticsHandlerOptions, type SessionLayoutData, } from './handlers.js';
+export { createOwnerSetupPage, DEFAULT_OWNER_SETUP_MESSAGES, isLoopbackAddress, isLoopbackHostname, isLoopbackRequest, OWNER_SETUP_FIELDS, type OwnerSetupActionEvent, type OwnerSetupErrorCode, type OwnerSetupEvent, type OwnerSetupFailure, type OwnerSetupPage, type OwnerSetupPageData, type OwnerSetupPageOptions, } from './owner-setup.js';
+export { type ApplicationRuntimeDiagnosticsOptions, authorizedTenantLocalsHandle, composeHandles, createSmrtSvelteKitRuntime, defaultWriterLease, type ProviderReadinessComponent, type ProviderReadinessFactory, type RuntimeHealthBody, type SmrtRuntimeBoundPrincipal, type SmrtRuntimeBoundPrincipalSnapshot, type SmrtRuntimeDeepReadonly, type SmrtRuntimeLocals, type SmrtRuntimeMcpIdentity, type SmrtRuntimeMcpPrincipalMapping, type SmrtRuntimeSessionCookie, type SmrtRuntimeSessionOptions, type SmrtSvelteKitRuntime, type SmrtSvelteKitRuntimeOptions, type TenantBindingMode, type WriterLease, type WriterLeaseContext, } from './runtime.js';
+export { createSubdomainTenantSelector, normalizeTenantSelection, type SubdomainTenantSelectorOptions, selectTenantSlug, type TenantSelection, type TenantSelectionEvent, type TenantSelector, } from './tenancy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/sveltekit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sveltekit/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,0BAA0B,EAC/B,mCAAmC,EACnC,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,oCAAoC,EACzC,4BAA4B,EAC5B,cAAc,EACd,0BAA0B,EAC1B,kBAAkB,EAClB,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,8BAA8B,EACnC,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAC"}