@happyvertical/smrt-chat 0.53.4 → 0.53.6

package/AGENTS.md

@@ -149,15 +149,16 @@ Actions: `normalizeDataSurfaceActionRequest` → `AssistantActionClient`
 `data-surface-bridge.ts` channel). Generated `ChatThread`/`ChatMessage`
 `list`/`get` are tenant- not member-scoped; the dock never calls them.
 
-**Server routes (#3368).** `./sveltekit` `mountAssistantRoutes({ ai, ... })`
-serves the dock from one `[...path]` route; `createAssistantHttpTransport`
-and `createAssistantHttpActionClient` (`./svelte`) are its browser half.
-Principal from `event.locals` (`user.id`, `user.profileId`, `tenantId`) or
-`resolvePrincipal`; threads are served only from the actor's keyed assistant
-session room in that tenant (else 404); `allowedTools` is fail-closed;
-`ai` is injected, never read from env. `sendMessage`'s `clientRequestId`
-makes the row id a UUIDv5 (`clientRequestMessageId`): the PK is the retry
-reservation. Details: [`docs/assistant-dock.md`](../../docs/assistant-dock.md).
+**Server routes (#3368).** `./sveltekit` `mountAssistantRoutes()` serves the
+dock from one `[...path]` route; `createAssistantHttp{Transport,ActionClient}`
+(`./svelte`) are its browser half. Principal from `event.locals` or
+`resolvePrincipal`; threads only from the actor's keyed session room in that
+tenant (else 404). `allowedTools` is fail-closed; without `tools` it offers
+those manifest ops (an unprovided name is an error, #3414). `ai` defaults to
+the config `ai` block. Pass `runtime`: a turn never keeps the RLS request tx
+(own `runAsPrincipal` tx). `clientRequestId` makes the row id a UUIDv5
+(`clientRequestMessageId`): the PK is the retry reservation. See
+[docs](../../docs/assistant-dock.md).
 
 ## Gotchas
 

package/README.md

@@ -263,12 +263,21 @@ waiting | done | failed | cancelled`), with `pauseRun` / `continueRun`,
 The server side mounts in one route file. The principal comes from
 `event.locals` (`@happyvertical/smrt-users/sveltekit`); threads are scoped to
 the caller's own assistant session in the active tenant; tools are
-fail-closed (`allowedTools`, absent means none):
+fail-closed (`allowedTools`, absent means none) and, without `tools`, are the
+manifest operations `allowedTools` names. `ai` defaults to the `smrt.config`
+`ai` block. Pass the application `runtime`: each request then uses its own
+database (`runtime.databaseConfig()`), and under `database-rls` a streamed
+turn, which outlives the request's transaction, runs in a transaction of its
+own for the same principal (`runtime.runAsPrincipal`):
 
 ```ts
 // src/routes/api/assistant/[...path]/+server.ts
 import { mountAssistantRoutes } from '@happyvertical/smrt-chat/sveltekit';
-export const { GET, POST } = mountAssistantRoutes({ ai: assistantAI });
+import { runtime } from '$lib/server/smrt';
+export const { GET, POST } = mountAssistantRoutes({
+  allowedTools: ['notes.read', 'notes.create'],
+  runtime,
+});
 ```
 
 In the page, `createAssistantHttpTransport({ endpoint: '/api/assistant' })`