npm - @happyvertical/smrt-template-sveltekit - Versions diffs - 0.38.26 → 0.39.0 - Mend

@happyvertical/smrt-template-sveltekit 0.38.26 → 0.39.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (23) hide show

package/AGENTS.md +45 -26
package/README.md +118 -80
package/index.js +4 -4
package/package.json +10 -8
package/template/.env.example +4 -8
package/template/AGENTS.md +29 -28
package/template/README.md +232 -398
package/template/package.json +21 -12
package/template/smrt.config.ts +1 -16
package/template/src/app.d.ts +5 -4
package/template/src/app.html +0 -1
package/template/src/hooks.server.ts +27 -111
package/template/src/lib/objects/Item.ts +23 -22
package/template/src/lib/objects/index.ts +1 -1
package/template/src/lib/server/smrt.ts +14 -22
package/template/src/lib/server/tenancy.ts +81 -234
package/template/src/routes/+layout.server.ts +12 -66
package/template/src/routes/+layout.svelte +64 -76
package/template/src/routes/+page.server.ts +67 -70
package/template/src/routes/+page.svelte +141 -109
package/template/src/routes/settings/+page.svelte +1 -1
package/template/vite.config.ts +14 -4
package/LICENSE +0 -7

package/template/package.json CHANGED Viewed

@@ -1,29 +1,38 @@
 {
   "name": "smrt-sveltekit-app",
   "version": "0.0.1",
+  "private": true,
   "type": "module",
+  "packageManager": "pnpm@10.34.4",
+  "engines": {
+    "node": ">=24.18.0",
+    "pnpm": "10.34.4"
+  },
   "scripts": {
     "dev": "vite dev",
     "build": "vite build",
     "preview": "vite preview",
     "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
-    "typecheck": "svelte-kit sync && tsc --noEmit && svelte-check --tsconfig ./tsconfig.json",
-    "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch"
+    "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+    "db:migrate": "vite build && smrt db:migrate"
   },
   "devDependencies": {
     "@sveltejs/adapter-auto": "^7.0.1",
-    "@sveltejs/kit": "^2.69.1",
-    "@sveltejs/vite-plugin-svelte": "^7.1.2",
+    "@sveltejs/kit": "^2.69.2",
+    "@sveltejs/vite-plugin-svelte": "^7.2.0",
+    "@types/node": "^24.13.3",
     "svelte": "^5.56.4",
-    "svelte-check": "^4.7.1",
-    "typescript": "^5.9.3",
-    "vite": "^8.1.3"
+    "svelte-check": "^4.7.2",
+    "typescript": "^6.0.3",
+    "vite": "^8.1.4",
+    "@happyvertical/smrt-cli": "^0.39.0"
   },
   "dependencies": {
-    "@happyvertical/smrt-core": "^0.38.26",
-    "@happyvertical/smrt-svelte": "^0.38.26",
-    "@happyvertical/smrt-tenancy": "^0.38.26",
-    "@happyvertical/smrt-ui": "^0.38.26",
-    "@happyvertical/smrt-users": "^0.38.26"
+    "@happyvertical/smrt-core": "^0.39.0",
+    "@happyvertical/smrt-profiles": "^0.39.0",
+    "@happyvertical/smrt-svelte": "^0.39.0",
+    "@happyvertical/smrt-tenancy": "^0.39.0",
+    "@happyvertical/smrt-ui": "^0.39.0",
+    "@happyvertical/smrt-users": "^0.39.0"
   }
 }

package/template/smrt.config.ts CHANGED Viewed

@@ -6,14 +6,6 @@
  */
 export default {
-  // Global SMRT settings
-  smrt: {
-    logLevel: 'info',
-    schemaMigration: {
-      strategy: 'auto-add',
-    },
-  },
   // Agent/developer knowledge artifacts are generated by smrtPlugin().
   // HTTP API routes stay off unless explicitly enabled for a dev/admin-only workflow.
   knowledge: {
@@ -33,17 +25,10 @@ export default {
     cli: {
       database: {
         type: 'sqlite',
-        url: process.env.DATABASE_URL || './data/app.db',
+        url: process.env.DATABASE_URL || './app.db',
       },
       verbose: false,
     },
-    // AI configuration (optional)
-    ai: process.env.OPENAI_API_KEY
-      ? {
-          provider: 'openai',
-          apiKey: process.env.OPENAI_API_KEY,
-        }
-      : undefined,
   },
 };

package/template/src/app.d.ts CHANGED Viewed

@@ -8,11 +8,12 @@ declare global {
     // interface Error {}
     interface Locals extends SessionLocals {
       /**
-       * Tenant context object set by the smrt-tenancy SvelteKit handle.
-       * `event.locals.tenantId` (from SessionLocals) is the canonical id
-       * string; this object carries the full context (permissions,
-       * superAdminBypass, etc.) when needed.
+       * URL-selected tenant candidate. Never use this as authorization; the
+       * session-authorized tenant remains `tenantId` from SessionLocals.
        */
+      selectedTenantId: string | null;
+      selectedTenantSlug: string | null;
+      /** Full context for the authorized session tenant, when present. */
       tenantContext?: import('@happyvertical/smrt-tenancy').MinimalTenantContext;
     }
     // interface PageData {}

package/template/src/app.html CHANGED Viewed

@@ -2,7 +2,6 @@
 <html lang="en">
   <head>
     <meta charset="utf-8" />
-    <link rel="icon" href="%sveltekit.assets%/favicon.png" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     %sveltekit.head%
   </head>

package/template/src/hooks.server.ts CHANGED Viewed

@@ -1,137 +1,53 @@
 /**
- * SvelteKit server hooks.
+ * Request foundation, in order:
  *
- * Pre-wired with:
- *   1. `enableTenancy()` — registers the @happyvertical/smrt-tenancy
- *      interceptor with `GlobalInterceptors` at priority 100, so any class
- *      decorated with `@TenantScoped` is auto-filtered by the tenant in
- *      AsyncLocalStorage. Idempotent — safe to call on every module load.
- *   2. A subdomain-based tenant resolver (`tenancyHandle`) — if the URL has
- *      a leading subdomain (e.g. `acme.demo.local`), the request runs inside
- *      `withTenant({ tenantId: 'acme' })`.
- *   3. `createSessionHandler({ enterTenantContext: true })` from
- *      @happyvertical/smrt-users/sveltekit — populates
- *      `event.locals.{user, permissions, tenantId, sessionId}` and pushes
- *      the session's tenant into the AsyncLocalStorage context.
- *   4. `reconcileTenantLocals` — final reconciliation step. The session
- *      handler initializes `event.locals.tenantId = null` before reading
- *      the session, so for unauthenticated public requests it clobbers the
- *      subdomain value set by step 2. This handle restores the subdomain
- *      tenant on `event.locals.tenantId` when no session tenant set it,
- *      so layout/page/action code reads a consistent value regardless of
- *      auth state.
+ * 1. Resolve a URL tenant candidate into `locals.selectedTenant*`. This is
+ *    selection only and does not enter AsyncLocalStorage tenant context.
+ * 2. Load the signed session. `enterTenantContext: true` establishes the
+ *    authorized session tenant and its permission set for downstream code.
+ * 3. Publish the authorized context on locals when it matches the session.
  *
- * To swap the resolution strategy, edit `src/lib/server/tenancy.ts`.
+ * This ordering prevents a spoofed header or hostname from becoming query
+ * authority. Membership-gated tenant switching belongs in an explicit action
+ * using `switchSessionTenant()` from `@happyvertical/smrt-users/sveltekit`.
  */
-import { sequence } from '@sveltejs/kit/hooks';
-import type { Handle } from '@sveltejs/kit';
+import { getCurrentTenant, enableTenancy } from '@happyvertical/smrt-tenancy';
 import { createSessionHandler } from '@happyvertical/smrt-users/sveltekit';
-import {
-  createSvelteKitHandle,
-  enableTenancy,
-  getCurrentTenant,
-} from '@happyvertical/smrt-tenancy';
+import type { Handle } from '@sveltejs/kit';
+import { sequence } from '@sveltejs/kit/hooks';
-import { resolveTenant } from '$lib/server/tenancy';
 import { getSmrtConfig } from '$lib/server/smrt';
+import { resolveTenant } from '$lib/server/tenancy';
-// Register the tenancy interceptor globally. Idempotent — `enableTenancy()`
-// guards against duplicate registration internally.
 enableTenancy();
-// Both upstream factories (`createSvelteKitHandle` from smrt-tenancy and
-// `createSessionHandler` from smrt-users/sveltekit) declare a structural
-// event type with `locals: Record<string, unknown>` to avoid taking a
-// hard dependency on `@sveltejs/kit`. SvelteKit's own `Handle` expects
-// `event.locals: App.Locals` — a strict named interface without an
-// index signature — so the two shapes aren't directly assignable under
-// strict typechecking. The casts below adapt the upstream return types
-// to SvelteKit's `Handle` once. Runtime behaviour is unchanged; the
-// types still flow through `Handle` to the `sequence(...)` composition.
-/**
- * Subdomain → tenantId handle. Runs BEFORE the session handler so generated
- * routes have a tenant in context even for unauthenticated public requests
- * (e.g. tenant-scoped catalog endpoints). If a session also carries a
- * tenant, the session handler's inner `withTenant()` will override.
- */
-const tenancyHandle = createSvelteKitHandle({
-  resolveTenantId: async (event) => {
-    // The createSvelteKitHandle adapter passes a structural event that is
-    // directly assignable to the resolver's `TenantResolverEvent` shape
-    // (`url` + `request.headers`), so no cast is needed.
-    const result = await resolveTenant(event);
-    return result.tenantId;
-  },
-}) as unknown as Handle;
+const tenantSelectionHandle: Handle = async ({ event, resolve }) => {
+  const selection = await resolveTenant(event);
+  event.locals.selectedTenantId = selection.tenantId;
+  event.locals.selectedTenantSlug = selection.tenantSlug;
+  return resolve(event);
+};
-/**
- * Session handle from @happyvertical/smrt-users. `enterTenantContext: true`
- * makes it call `enterTenantContext()` after loading the session, so
- * downstream code sees the *session's* tenant id when one is present.
- */
 const sessionHandle = createSessionHandler({
   ...getSmrtConfig('Session'),
   enterTenantContext: true,
 }) as unknown as Handle;
-/**
- * Final reconciliation: read the active AsyncLocalStorage tenant (already
- * set correctly by tenancyHandle + sessionHandle, with session winning
- * over subdomain when both are present) and align BOTH `event.locals.tenantId`
- * AND `event.locals.tenantContext` to it.
- *
- * Two failure modes this guards against:
- *
- *   1. **Public requests with a subdomain.** `createSessionHandler` resets
- *      `event.locals.tenantId` to `null` before checking for a session
- *      cookie. With no session, the session handler returns without
- *      repopulating it, so the subdomain-resolved tenant goes missing
- *      from layouts/actions even though the ALS context (set by
- *      `tenancyHandle`) still carries it.
- *   2. **Authenticated requests where the session's tenant differs from
- *      the subdomain.** The session handler calls `withTenant(sessionCtx, ...)`
- *      — switching the ALS context to the session tenant — and updates
- *      `event.locals.tenantId` to match. But it does NOT touch
- *      `event.locals.tenantContext`, which is still the subdomain context
- *      previously written by `tenancyHandle`. Layouts/actions reading
- *      `tenantContext` would then see stale permissions/superAdminBypass
- *      that don't match the tenant their queries are scoped to.
- *
- * Reading the live ALS context here and writing it back to BOTH
- * `locals.tenantId` and `locals.tenantContext` keeps the three vantage
- * points (locals.tenantId, locals.tenantContext, ALS-scoped queries) in
- * sync regardless of auth state.
- *
- * **ALS-scope dependency:** this handle reads `getCurrentTenant()` from
- * AsyncLocalStorage, which only works because both upstream handles
- * call `resolve(event)` *inside* their own ALS scope:
- *   - `createSvelteKitHandle` (smrt-tenancy) wraps in `withTenant(ctx, () => resolve(event))`.
- *   - `createSessionHandler` (smrt-users) wraps in `withSessionPermissionContext`,
- *     which internally calls `withTenant(sessionCtx, fn)` when the session
- *     has a tenantId.
- * If a future refactor moved either handle's `resolve()` call outside
- * its ALS scope, `getCurrentTenant()` here would return `undefined` and
- * the reconciliation would silently no-op. We deliberately do NOT fall
- * back to `event.locals.tenantId` here — that would re-introduce the
- * stale-tenantContext bug from the subdomain handler. If the upstream
- * scoping ever changes, this handle should be updated to read from a
- * dedicated cross-handler carrier (e.g. `event.locals._tenantSource`)
- * rather than guessing.
- */
-const reconcileTenantLocals: Handle = async ({ event, resolve }) => {
+const authorizedTenantLocalsHandle: Handle = async ({ event, resolve }) => {
   const activeContext = getCurrentTenant();
-  if (activeContext) {
-    event.locals.tenantId = activeContext.tenantId;
+  if (
+    event.locals.user &&
+    event.locals.tenantId &&
+    activeContext?.tenantId === event.locals.tenantId
+  ) {
     event.locals.tenantContext = activeContext;
   }
   return resolve(event);
 };
 export const handle: Handle = sequence(
-  tenancyHandle,
+  tenantSelectionHandle,
   sessionHandle,
-  reconcileTenantLocals,
+  authorizedTenantLocalsHandle,
 );

package/template/src/lib/objects/Item.ts CHANGED Viewed

@@ -1,19 +1,32 @@
 /**
- * Example SMRT Object
+ * Example s-m-r-t object.
  *
  * This is a sample SMRT object to demonstrate the pattern.
  * Rename or replace this with your own objects.
  */
-import { SmrtObject, smrt } from '@happyvertical/smrt-core';
+import {
+  ObjectRegistry,
+  SmrtCollection,
+  SmrtObject,
+  smrt,
+} from '@happyvertical/smrt-core';
+import { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';
 @smrt({
   api: {
-    include: ['list', 'get', 'create', 'update', 'delete', 'summarize'],
+    include: ['list', 'get', 'create', 'update', 'delete'],
+    writable: ['title', 'description', 'status'],
   },
-  cli: { include: ['list', 'get', 'summarize'] },
+  cli: { include: ['list', 'get', 'create', 'update', 'delete'] },
+  mcp: { include: ['list', 'get', 'create', 'update', 'delete'] },
 })
+@TenantScoped({ mode: 'optional' })
 export class Item extends SmrtObject {
+  /** Null rows are global; tenant rows are isolated automatically. */
+  @tenantId({ nullable: true })
+  tenantId: string | null = null;
   /** Item title */
   title: string = '';
@@ -22,23 +35,11 @@ export class Item extends SmrtObject {
   /** Status of the item */
   status: string = 'draft';
+}
-  /** When the item was published */
-  publishedAt: Date | null = null;
-  /**
-   * AI-powered summarization
-   */
-  async summarize(): Promise<string> {
-    return await this.do('Create a brief summary of this item');
-  }
-  /**
-   * Mark item as published
-   */
-  async publish(): Promise<void> {
-    this.status = 'published';
-    this.publishedAt = new Date();
-    await this.save();
-  }
+/** Explicit collection constructor used by generated CLI/MCP/runtime tools. */
+export class ItemCollection extends SmrtCollection<Item> {
+  static readonly _itemClass = Item;
 }
+ObjectRegistry.registerCollection('Item', ItemCollection);

package/template/src/lib/objects/index.ts CHANGED Viewed

@@ -5,4 +5,4 @@
  * They will be automatically registered and available for CLI/API/MCP.
  */
-export { Item } from './Item.js';
+export { Item, ItemCollection } from './Item.js';

package/template/src/lib/server/smrt.ts CHANGED Viewed

@@ -14,6 +14,7 @@ import {
   type SmrtObject,
 } from '@happyvertical/smrt-core';
 import { loadManifestFromPathSync } from '@happyvertical/smrt-core/manifest';
+import { getRequestScopedDatabase } from '@happyvertical/smrt-users';
 // Import all SMRT objects to register them.
 import '../objects/index.js';
@@ -25,8 +26,17 @@ import '../objects/index.js';
 // fresh checkout that has not run the plugin yet still boots.
 try {
   await import('./smrt-register.js');
-} catch {
-  // Not generated yet — the first `vite dev` / `vite build` will create it.
+} catch (error) {
+  // Not generated yet — the first `vite dev` / `vite build` creates it. Do
+  // not hide a real import/runtime error from an existing generated module.
+  const code = (error as NodeJS.ErrnoException).code;
+  const message = error instanceof Error ? error.message : '';
+  if (
+    code !== 'ERR_MODULE_NOT_FOUND' &&
+    !message.includes('smrt-register.js')
+  ) {
+    throw error;
+  }
 }
 // Hydrate field metadata for this app's own objects from the local manifest
@@ -40,13 +50,6 @@ if (existsSync(localManifestPath)) {
   loadManifestFromPathSync(localManifestPath);
 }
-declare global {
-  // eslint-disable-next-line no-var
-  var __smrtGetRequestScopedDatabase:
-    | (() => SmrtClassOptions['db'] | undefined)
-    | undefined;
-}
 /**
  * Per-object configuration overrides
  *
@@ -64,23 +67,12 @@ const objectOverrides: Record<string, Partial<SmrtClassOptions>> = {
 function getDefaultConfig(): SmrtClassOptions {
   return {
     db: {
-      url: process.env.DATABASE_URL || './data/app.db',
+      url: process.env.DATABASE_URL || './app.db',
       type: (process.env.DATABASE_TYPE as 'sqlite' | 'postgres') || 'sqlite',
     },
-    ai: process.env.OPENAI_API_KEY
-      ? {
-          type: 'openai',
-          apiKey: process.env.OPENAI_API_KEY,
-        }
-      : undefined,
   };
 }
-function getRequestScopedDatabase(): SmrtClassOptions['db'] | undefined {
-  const getter = globalThis.__smrtGetRequestScopedDatabase;
-  return typeof getter === 'function' ? getter() : undefined;
-}
 /**
  * Get configuration for a specific SMRT class
  */
@@ -102,7 +94,7 @@ export async function getCollection<T extends SmrtObject>(className: string) {
   const objectOverride = objectOverrides[className];
   const requestScopedDb = objectOverride?.db
     ? undefined
-    : getRequestScopedDatabase();
+    : (getRequestScopedDatabase() as SmrtClassOptions['db'] | undefined);
   return await ObjectRegistry.getCollection<T>(className, {
     ...config,