@happyvertical/smrt-svelte 0.43.10 → 0.44.0

package/dist/web/view-intent.svelte.js

@@ -0,0 +1,83 @@
+// The dependency-free intent entry, NOT the package root: it pulls no
+// client-data engine, so a component binding an intent pays only for the
+// declaration contract. The registrar itself is still loaded lazily, by
+// `useWebMcpTool`.
+import { compileViewIntentToolSpec } from '@happyvertical/smrt-web/intents';
+import { useWebMcpTool } from './webmcp.svelte.js';
+import { tryGetWebMcpUiContext } from './webmcp-ui-context.js';
+/**
+ * Bind a declared view intent (#2588) to this component's mounted registry
+ * identity, for exactly this component's lifetime.
+ *
+ * Svelte is the FIRST binding, not the only one: the declaration contract,
+ * the registry, and the compilation to a browser tool all live in
+ * `@happyvertical/smrt-web` with no Svelte dependency. This file is the thin
+ * part — it resolves the mounted registries from the nearest Provider and
+ * hands the compiled spec to {@link useWebMcpTool}, which already owns the
+ * WebMCP lifecycle: the synchronous Provider policy read, the `options.effects`
+ * fallback, serialized same-name re-registration across effect reruns, and
+ * the lazy `@happyvertical/smrt-web` import.
+ *
+ * Registration therefore goes through `registerWebMcpBespokeTool`, so an
+ * intent is subject to the same fail-closed exposure policy as a generated
+ * model tool. Execution dispatches exactly one registry command with
+ * `source: 'agent'` — `StagedControlReview` stays on the path, agent-staged
+ * values remain proposals, and there is no path to REST.
+ *
+ * Declare the intent itself at module scope in a `.ts` sidecar
+ * (`Foo.intents.ts`) so #2591's scanner can emit it; import it here.
+ *
+ * With no Provider ancestor and no explicit registry override, this is a
+ * silent no-op — an intent with nothing mounted to dispatch to registers
+ * nothing, the same way every WebMCP entry point no-ops off-WebMCP. Because
+ * the registries are resolved INSIDE the tool factory, a Provider that
+ * enables `webmcp.ui` after this component initializes, or that swaps a
+ * registry, re-runs the effect and registers the intent against the current
+ * one rather than staying stuck on what was there at init.
+ *
+ * @throws if `identity` does not match the intent's declared target registry,
+ * or contradicts an identity the declaration pinned — both are author errors,
+ * not environment differences.
+ */
+export function useViewIntent(intent, options) {
+    // `getContext` is only valid during component initialization, so the
+    // CONTEXT OBJECT must be captured here. Its `enabled` and registry members
+    // are reactive getters, though, and reading them here would freeze one
+    // value for the component's whole life — so they are read inside the
+    // factory below, which `useWebMcpTool` runs within its `$effect`.
+    const uiContext = tryGetWebMcpUiContext();
+    // The identity SHAPE is a static author decision, so it is checked eagerly:
+    // a mismatch surfaces at the call site rather than inside an effect, where
+    // a throw is harder to attribute. Only the registries are deferred.
+    assertIdentityShape(intent, options.identity);
+    useWebMcpTool(() => {
+        const controlRegistry = options.controlRegistry ??
+            (uiContext?.enabled ? uiContext.controlRegistry : undefined);
+        const dataSurfaceRegistry = options.dataSurfaceRegistry ??
+            (uiContext?.enabled ? uiContext.dataSurfaceRegistry : undefined);
+        const binding = resolveBinding(intent, options.identity, controlRegistry, dataSurfaceRegistry);
+        return binding ? compileViewIntentToolSpec(intent, binding) : null;
+    }, options.effects ? { effects: options.effects } : {});
+}
+function assertIdentityShape(intent, identity) {
+    if (intent.target.registry === 'control' && !('formId' in identity)) {
+        throw new Error(`[smrt-svelte] intent '${intent.id}' targets the control registry and needs a { formId, controlId } identity`);
+    }
+    if (intent.target.registry === 'dataSurface' && !('surfaceId' in identity)) {
+        throw new Error(`[smrt-svelte] intent '${intent.id}' targets the dataSurface registry and needs a { surfaceId, kind } identity`);
+    }
+}
+function resolveBinding(intent, identity, controlRegistry, dataSurfaceRegistry) {
+    if (intent.target.registry === 'control') {
+        if (!controlRegistry || !('formId' in identity))
+            return null;
+        return { registry: 'control', registryPort: controlRegistry, identity };
+    }
+    if (!dataSurfaceRegistry || !('surfaceId' in identity))
+        return null;
+    return {
+        registry: 'dataSurface',
+        registryPort: dataSurfaceRegistry,
+        identity,
+    };
+}

package/dist/web/webmcp-bespoke-context.d.ts

@@ -0,0 +1,14 @@
+import type { WebMcpToolEffect } from '@happyvertical/smrt-web';
+/**
+ * The `effects` exposure policy `useWebMcpTool` applies to a bespoke
+ * component tool (#2586). Provider sets this from the same `webmcp.effects`
+ * config it passes to `registerWebMcpTools` for generated tools, so a
+ * bespoke and a generated tool share one policy. Absent a Provider ancestor,
+ * `useWebMcpTool` falls back to the registrar's own default (read-only).
+ */
+export interface WebMcpBespokeContext {
+    readonly effects?: readonly WebMcpToolEffect[];
+}
+export declare function setWebMcpBespokeContext(context: WebMcpBespokeContext): void;
+export declare function tryGetWebMcpBespokeContext(): WebMcpBespokeContext | null;
+//# sourceMappingURL=webmcp-bespoke-context.d.ts.map

package/dist/web/webmcp-bespoke-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webmcp-bespoke-context.d.ts","sourceRoot":"","sources":["../../src/web/webmcp-bespoke-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAKhE;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAChD;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAE3E;AAED,wBAAgB,0BAA0B,IAAI,oBAAoB,GAAG,IAAI,CAExE"}

package/dist/web/webmcp-bespoke-context.js

@@ -0,0 +1,8 @@
+import { getContext, setContext } from 'svelte';
+const WEBMCP_BESPOKE_CONTEXT_KEY = Symbol('smrt-webmcp-bespoke-context');
+export function setWebMcpBespokeContext(context) {
+    setContext(WEBMCP_BESPOKE_CONTEXT_KEY, context);
+}
+export function tryGetWebMcpBespokeContext() {
+    return getContext(WEBMCP_BESPOKE_CONTEXT_KEY) ?? null;
+}

package/dist/web/webmcp.svelte.d.ts

@@ -1,16 +1,16 @@
+import type { WebMcpBespokeToolSpec, WebMcpToolEffect } from '@happyvertical/smrt-web';
 /** A tool exposed to the browser's WebMCP model context. */
-export interface WebMcpToolSpec {
-    name: string;
-    description: string;
-    inputSchema: Record<string, unknown>;
-    annotations?: {
-        readOnlyHint?: boolean;
-        destructiveHint?: boolean;
-        idempotentHint?: boolean;
-        openWorldHint?: boolean;
-        untrustedContentHint?: boolean;
-    };
-    execute: (args: Record<string, unknown>) => string | Promise<string>;
+export type WebMcpToolSpec = WebMcpBespokeToolSpec;
+export interface UseWebMcpToolOptions {
+    /**
+     * This tool's own `effects` exposure-policy fallback, used only when no
+     * Provider ancestor supplies an explicit `webmcp.effects` policy. A
+     * Provider's explicit policy always wins over this default — even a
+     * narrower one — so a component cannot use its own default to grant
+     * itself more than an ancestor Provider allows (#2586). Omit to keep the
+     * registrar's own read-only default as the no-Provider fallback.
+     */
+    effects?: readonly WebMcpToolEffect[];
 }
 declare global {
     interface Document {
@@ -26,6 +26,22 @@ declare global {
  * Register a component-owned WebMCP intent for exactly that component's
  * lifetime. The factory runs inside the effect so rune dependencies used by a
  * bespoke intent cause the tool to be replaced when its spec changes.
+ *
+ * Routes through `@happyvertical/smrt-web`'s `registerWebMcpBespokeTool` so a
+ * bespoke tool is subject to the same fail-closed `effects` exposure policy
+ * as generated model tools (#2586): a spec with no `annotations`, or with
+ * annotations that leave its effect undeclared, classifies destructive,
+ * non-idempotent, open-world, and is excluded unless policy allows
+ * `destructive`. The policy is the nearest Provider's `webmcp.effects` (read
+ * from context so a bespoke and a generated tool share one policy); absent a
+ * Provider ancestor, it falls back to the registrar's own read-only default.
+ * `namespace` and `maxTools` deliberately do not apply to a bespoke tool.
+ *
+ * `@happyvertical/smrt-web` loads lazily, on first use, so a page that only
+ * calls `useWebMcpTool` never bundles the client-data engine.
+ *
+ * @param options.effects a fallback exposure policy applied only when no
+ * Provider ancestor declares one — see {@link UseWebMcpToolOptions}.
  */
-export declare function useWebMcpTool(factory: () => WebMcpToolSpec | null | undefined): void;
+export declare function useWebMcpTool(factory: () => WebMcpToolSpec | null | undefined, options?: UseWebMcpToolOptions): void;
 //# sourceMappingURL=webmcp.svelte.d.ts.map

package/dist/web/webmcp.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webmcp.svelte.d.ts","sourceRoot":"","sources":["../../src/web/webmcp.svelte.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE;QACZ,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtE;AAID,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,QAAQ;QAChB,YAAY,CAAC,EAAE,kBAAkB,CAAC;KACnC;IAED,UAAU,kBAAkB;QAC1B,YAAY,CACV,IAAI,EAAE,cAAc,EACpB,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,WAAW,CAAA;SAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CAAC;KAClB;CACF;AAYD;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,cAAc,GAAG,IAAI,GAAG,SAAS,GAC/C,IAAI,CAiBN"}
+{"version":3,"file":"webmcp.svelte.d.ts","sourceRoot":"","sources":["../../src/web/webmcp.svelte.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EAErB,gBAAgB,EACjB,MAAM,yBAAyB,CAAC;AAGjC,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEnD,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACvC;AAID,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,QAAQ;QAChB,YAAY,CAAC,EAAE,kBAAkB,CAAC;KACnC;IAED,UAAU,kBAAkB;QAC1B,YAAY,CACV,IAAI,EAAE,cAAc,EACpB,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,WAAW,CAAA;SAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CAAC;KAClB;CACF;AAYD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,cAAc,GAAG,IAAI,GAAG,SAAS,EAChD,OAAO,GAAE,oBAAyB,GACjC,IAAI,CAuFN"}

package/dist/web/webmcp.svelte.js

@@ -1,3 +1,4 @@
+import { tryGetWebMcpBespokeContext } from './webmcp-bespoke-context.js';
 function getModelContext() {
     // Do not read `document` at module evaluation time: this module is imported
     // by SSR bundles and by browsers without the WebMCP origin trial.
@@ -11,22 +12,101 @@ function getModelContext() {
  * Register a component-owned WebMCP intent for exactly that component's
  * lifetime. The factory runs inside the effect so rune dependencies used by a
  * bespoke intent cause the tool to be replaced when its spec changes.
+ *
+ * Routes through `@happyvertical/smrt-web`'s `registerWebMcpBespokeTool` so a
+ * bespoke tool is subject to the same fail-closed `effects` exposure policy
+ * as generated model tools (#2586): a spec with no `annotations`, or with
+ * annotations that leave its effect undeclared, classifies destructive,
+ * non-idempotent, open-world, and is excluded unless policy allows
+ * `destructive`. The policy is the nearest Provider's `webmcp.effects` (read
+ * from context so a bespoke and a generated tool share one policy); absent a
+ * Provider ancestor, it falls back to the registrar's own read-only default.
+ * `namespace` and `maxTools` deliberately do not apply to a bespoke tool.
+ *
+ * `@happyvertical/smrt-web` loads lazily, on first use, so a page that only
+ * calls `useWebMcpTool` never bundles the client-data engine.
+ *
+ * @param options.effects a fallback exposure policy applied only when no
+ * Provider ancestor declares one — see {@link UseWebMcpToolOptions}.
  */
-export function useWebMcpTool(factory) {
+export function useWebMcpTool(factory, options = {}) {
+    const bespokeContext = tryGetWebMcpBespokeContext();
+    // Survives across effect reruns (unlike the per-run `dispose`/`cancelled`
+    // locals below) so a new run can serialize its registration against the
+    // previous run's — see the comment at its read site.
+    let previousDisposer;
     $effect(() => {
-        const context = getModelContext();
-        if (!context)
+        if (typeof window === 'undefined')
             return;
-        const spec = factory();
-        if (!spec)
+        // Feature-detect locally first so a browser without WebMCP never pays for
+        // the dynamic import below.
+        if (!getModelContext())
             return;
-        const controller = new AbortController();
-        const registration = context.registerTool(spec, {
-            signal: controller.signal,
-        });
-        if (registration) {
-            void Promise.resolve(registration).catch(() => controller.abort());
+        const factorySpec = factory();
+        if (!factorySpec)
+            return;
+        // Rebind to a definitely-non-nullish const: TypeScript does not carry
+        // the `!factorySpec` narrowing above into the `register` closure below,
+        // since it runs later, asynchronously.
+        const spec = factorySpec;
+        // Read the Provider's effects policy synchronously, inside this effect's
+        // tracking window — `bespokeContext.effects` is a reactive getter, and a
+        // read from inside the dynamic import's `.then()` below happens after
+        // the effect has already finished its synchronous run, so it would never
+        // register as a dependency. Capturing it here means a later change to
+        // the Provider's policy re-runs this effect, tearing down and
+        // re-registering the tool under the new policy. A Provider's explicit
+        // policy always wins; this call's own `options.effects` is only the
+        // no-Provider fallback.
+        const effects = bespokeContext?.effects ?? options.effects;
+        // Snapshotted before this run's async work starts: the previous run's
+        // cleanup (below) synchronously aborts its controller, but a host is not
+        // required to finish processing that abort before this run's dynamic
+        // import resolves. Awaiting the prior disposer's `.ready` settling first
+        // serializes same-name re-registration so this run never asks the host
+        // to accept a new registration while it may still consider the old one
+        // live.
+        const priorReady = previousDisposer?.ready;
+        let cancelled = false;
+        let dispose = () => { };
+        async function register() {
+            // The dynamic import failing to load is expected in bundle profiles
+            // without `@happyvertical/smrt-web` — treat it like WebMCP being
+            // unavailable and no-op, silently. Only THIS statement's failure is
+            // caught: a synchronous throw from `registerWebMcpBespokeTool` below
+            // (e.g. an invalid `effects` policy) happens outside this try block
+            // and is deliberately left to propagate as an unhandled rejection of
+            // `register()`'s own promise, rather than being swallowed alongside
+            // the load-failure case.
+            let registerWebMcpBespokeTool;
+            try {
+                ({ registerWebMcpBespokeTool } = await import('@happyvertical/smrt-web'));
+            }
+            catch {
+                return;
+            }
+            if (cancelled)
+                return;
+            if (priorReady) {
+                await priorReady.catch(() => undefined);
+                // A newer run may have superseded this one while the wait above
+                // was pending; re-check before registering under this run's name.
+                if (cancelled)
+                    return;
+            }
+            const registration = registerWebMcpBespokeTool(spec, { effects });
+            dispose = registration;
+            previousDisposer = registration;
+            void registration.ready.catch((error) => {
+                if (!cancelled) {
+                    console.warn('[smrt-svelte] bespoke WebMCP tool registration failed', spec.name, error);
+                }
+            });
         }
-        return () => controller.abort();
+        void register();
+        return () => {
+            cancelled = true;
+            dispose();
+        };
     });
 }

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@happyvertical/smrt-svelte",
-  "version": "0.43.10",
+  "version": "0.44.0",
+  "smrtJsdoc": "strict",
   "description": "Svelte 5 components for SMRT user management - auth, users, tenants, roles, permissions, groups",
   "type": "module",
   "smrtRawPrimitives": "strict",
@@ -123,10 +124,10 @@
     "@tanstack/db": "^0.6.14",
     "@tanstack/svelte-db": "^0.1.91",
     "esm-env": "^1.2.2",
-    "@happyvertical/smrt-languages": "0.43.10",
-    "@happyvertical/smrt-types": "0.43.10",
-    "@happyvertical/smrt-ui": "0.43.10",
-    "@happyvertical/smrt-web": "0.43.10"
+    "@happyvertical/smrt-languages": "0.44.0",
+    "@happyvertical/smrt-types": "0.44.0",
+    "@happyvertical/smrt-ui": "0.44.0",
+    "@happyvertical/smrt-web": "0.44.0"
   },
   "peerDependencies": {
     "@huggingface/transformers": ">=3.8.1",
@@ -166,8 +167,8 @@
     "typescript": "5.9.3",
     "vite": "8.1.4",
     "vitest": "4.1.10",
-    "@happyvertical/smrt-core": "0.43.10",
-    "@happyvertical/smrt-scanner": "0.43.10"
+    "@happyvertical/smrt-core": "0.44.0",
+    "@happyvertical/smrt-scanner": "0.44.0"
   },
   "scripts": {
     "build": "svelte-package -i src --tsconfig tsconfig.svelte.json",