@happyvertical/smrt-template-sveltekit 0.43.3 → 0.43.5

package/AGENTS.md

@@ -16,7 +16,8 @@ It is the ground-up alternative to `smrt-saas-starter`.
 - Node `>=24.18.0`; pnpm `10.34.4` via `packageManager` and `engines`.
 - Directly used `@happyvertical/smrt-*` packages share one current release range.
 - `@happyvertical/smrt-cli` is a direct dev dependency because scripts/docs use
-  its binary. `@happyvertical/smrt-web` stays opt-in until a page imports it.
+  its binary. The template includes `@happyvertical/smrt-web` because the root
+  Provider wires the generated read-only WebMCP definitions for every page.
 - The generated MCP server resolves its imports from the scaffolded app, not
   from the CLI, so every specifier `generate-mcp` emits must be declared here.
   `@modelcontextprotocol/server` (plus its `/stdio` subpath),
@@ -50,8 +51,10 @@ It is the ground-up alternative to `smrt-saas-starter`.
   exact permission snapshot.
 - The root layout uses Provider, the current smrt-ui ThemeProvider, AdminShell,
   and a small explicit TenantNav. Generated REST routes do not imply page routes.
-- WebMCP and live browser data examples are opt-in per page and must seed live
-  collections from SSR `initialData` to avoid a duplicate first request.
+- The root Provider registers generated WebMCP read tools with the authenticated
+  page session. Write/destructive effects require an explicit page-owned policy.
+  Live browser collections remain opt-in per page and must seed from SSR
+  `initialData` to avoid a duplicate first request.
 
 ## Tests
 

package/README.md

@@ -120,27 +120,27 @@ pnpm smrt schema Item
 pnpm smrt generate-mcp --no-config --no-readme
 ```
 
-WebMCP registration is documented as an opt-in, per-page integration using
-`collectionDefinitions` from `@happyvertical/smrt-virt-web` and
-`registerWebMcpTools()` from `@happyvertical/smrt-web`. CRUD is wired in
-0.38.25; custom action execution is not yet wired and is documented as such.
+The root layout wires the generated `webMcpToolDefinitions` into the Provider,
+so each browser page exposes only read-effect generated model tools by default.
+Write and destructive effects require explicit page-owned opt-in, and all
+custom actions execute through their authenticated generated REST routes. For a
+smaller page-specific surface, pass a filtered `definitions` array or use the
+framework-agnostic `registerWebMcpTools()` API from `@happyvertical/smrt-web`.
 The CLI's manifest-only `objects` and `schema` commands work in this
 source-first template. Local-object CRUD execution through the generic CLI
 additionally requires a compiled JavaScript project entry point.
 
 ## 9. Add optional live browser data
 
-`@happyvertical/smrt-web` is intentionally not a base direct dependency. A
-consumer adds it only when a page imports the live collection or WebMCP runtime:
-
-```bash
-pnpm add @happyvertical/smrt-web@0.38.25
-```
+`@happyvertical/smrt-web` is included on the synchronized release line because
+the root Provider loads the generated WebMCP definitions. No separate install
+is needed for WebMCP. Live browser collections remain opt-in per page; import
+the collection helpers only on pages that need interactive client data.
 
 The generated-project README shows the current hydration pattern:
 `createSmrtCollection(getCollectionDefinition('items'), { initialData,
-basePath: '/api' })` followed by `liveCollection()`. The root layout does not
-load the browser engine.
+basePath: '/api' })` followed by `liveCollection()`. The root layout's
+read-only WebMCP registration does not materialize live collections.
 
 ## 10. Graduate to smrt-saas-starter
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-template-sveltekit",
-  "version": "0.43.3",
+  "version": "0.43.5",
   "description": "Minimal SvelteKit project template with s-m-r-t framework integration",
   "type": "module",
   "main": "index.js",
@@ -29,12 +29,12 @@
     "directory": "packages/template-sveltekit"
   },
   "peerDependencies": {
-    "@happyvertical/smrt-core": "0.43.3"
+    "@happyvertical/smrt-core": "0.43.5"
   },
   "devDependencies": {
     "vitest": "4.1.10",
-    "@happyvertical/smrt-tenancy": "0.43.3",
-    "@happyvertical/smrt-users": "0.43.3"
+    "@happyvertical/smrt-tenancy": "0.43.5",
+    "@happyvertical/smrt-users": "0.43.5"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/template/AGENTS.md

@@ -30,6 +30,8 @@ tools, WebMCP definitions, and agent/developer knowledge artifacts.
 - Keep object relationship metadata close to `@smrt()`.
 - Add human-facing routes explicitly; generated REST routes do not create nav
   pages.
-- Add `@happyvertical/smrt-web` only when a dedicated page imports live browser
-  data or registers WebMCP tools. Seed live collections with SSR `initialData`.
+- The root layout includes `@happyvertical/smrt-web` and registers generated
+  WebMCP read tools through Provider when the browser exposes `modelContext`.
+  Keep the guard in place for SSR and seed live collections with SSR
+  `initialData`.
 - Do not enable knowledge HTTP routes in production without explicit admin auth.

package/template/README.md

@@ -249,40 +249,42 @@ Add the jobs package on the same release line as the other
 `@happyvertical/smrt-*` pins in `package.json`, then reinstall. Missing one of
 these fails at startup with `ERR_MODULE_NOT_FOUND` naming the package to add.
 
-WebMCP is opt-in per browser surface. First add the browser runtime, then put
-registration in a dedicated page that actually exposes tools:
-
-```bash
-pnpm add @happyvertical/smrt-web@0.38.25
-```
+WebMCP is wired at the root Provider as a read-only, authenticated browser
+surface. The template includes `@happyvertical/smrt-web` on the synchronized
+release line; keep the generated definitions page-owned when you need a
+narrower tool set.
 
 ```svelte
 <script lang="ts">
-  import { collectionDefinitions } from '@happyvertical/smrt-virt-web';
-  import { onMount } from 'svelte';
-
-  onMount(() => {
-    let dispose = () => {};
-    void import('@happyvertical/smrt-web').then(({ registerWebMcpTools }) => {
-      dispose = registerWebMcpTools([collectionDefinitions.items], {
-        basePath: '/api',
-      });
-    });
-    return () => dispose();
-  });
+  import { webMcpToolDefinitions } from '@happyvertical/smrt-virt-web';
+  import { Provider } from '@happyvertical/smrt-svelte';
+
+  const webmcp = $derived(
+    typeof document !== 'undefined' && 'modelContext' in document
+      ? { definitions: webMcpToolDefinitions, basePath: '/api', effects: ['read'] as const }
+      : false,
+  );
 </script>
+
+<Provider {webmcp}>
+  {@render children()}
+</Provider>
 ```
 
 `registerWebMcpTools()` feature-detects browser support and uses the current
-authenticated page session. In 0.38.25, list/get/create/update/delete are wired.
-Generated descriptors for custom actions exist, but custom action execution is
-not yet wired; WebMCP returns a clear result for those actions. Filter to read-only on
-surfaces that should not offer browser mutations.
+authenticated page session. Omitted policy exposes all `read`-effect tools:
+intrinsic `list`/`get` plus custom actions explicitly declared as reads. To
+advertise mutations on a trusted surface, pass an explicit effect allowlist, for
+example `effects: ['read', 'write']`; include `destructive` only where delete and
+destructive custom actions are intended. Generated custom actions execute
+through their authenticated REST routes, and undeclared custom effects fail
+closed as destructive.
 
 ## 9. Add optional live browser data
 
-Use this only on an interactive page. `@happyvertical/smrt-web` must be a direct
-dependency because the page imports it; the base starter does not need it.
+Use this only on an interactive page. The template already includes
+`@happyvertical/smrt-web` for the root Provider; no separate install is needed
+for WebMCP. Live browser collections remain opt-in per page.
 
 Keep the server load from section 7, then seed the browser collection from its
 hydrated rows so the first render does not issue a duplicate request:

package/template/package.json

@@ -25,16 +25,17 @@
     "svelte-check": "^4.7.2",
     "typescript": "^6.0.3",
     "vite": "^8.1.4",
-    "@happyvertical/smrt-cli": "^0.43.3"
+    "@happyvertical/smrt-cli": "^0.43.5"
   },
   "dependencies": {
-    "@happyvertical/smrt-config": "^0.43.3",
-    "@happyvertical/smrt-core": "^0.43.3",
-    "@happyvertical/smrt-profiles": "^0.43.3",
-    "@happyvertical/smrt-svelte": "^0.43.3",
-    "@happyvertical/smrt-tenancy": "^0.43.3",
-    "@happyvertical/smrt-ui": "^0.43.3",
-    "@happyvertical/smrt-users": "^0.43.3",
+    "@happyvertical/smrt-config": "^0.43.5",
+    "@happyvertical/smrt-core": "^0.43.5",
+    "@happyvertical/smrt-profiles": "^0.43.5",
+    "@happyvertical/smrt-svelte": "^0.43.5",
+    "@happyvertical/smrt-tenancy": "^0.43.5",
+    "@happyvertical/smrt-ui": "^0.43.5",
+    "@happyvertical/smrt-users": "^0.43.5",
+    "@happyvertical/smrt-web": "^0.43.5",
     "@modelcontextprotocol/server": "^2.0.0"
   }
 }

package/template/src/routes/+layout.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
   import { page } from '$app/state';
+  import { webMcpToolDefinitions } from '@happyvertical/smrt-virt-web';
   import { Provider } from '@happyvertical/smrt-svelte';
   import {
     AdminShell,
@@ -18,6 +19,18 @@
     data.session.activeTenantId ? 'Authorized session tenant' : 'No active tenant',
   );
 
+  // Keep the optional data-plane runtime out of browsers that do not expose
+  // WebMCP. SSR remains safe because the feature check is document-guarded.
+  const webmcp = $derived(
+    typeof document !== 'undefined' && 'modelContext' in document
+      ? {
+          definitions: webMcpToolDefinitions,
+          basePath: '/api',
+          effects: ['read'] as const,
+        }
+      : false,
+  );
+
   // Add application routes here. Generated REST routes live under /api and do
   // not automatically imply a human-facing page.
   const nav: ShellNavItem[] = [
@@ -34,7 +47,7 @@
   ];
 </script>
 
-<Provider>
+<Provider {webmcp}>
   <ThemeProvider preset="smrt" colorScheme="system" persist={true}>
     <AdminShell
       title="s-m-r-t app"

package/template/src/smrt-webmcp.d.ts

@@ -0,0 +1,6 @@
+// `smrtPlugin` supplies the runtime virtual module during Vite builds. Keep
+// source-first `svelte-check` useful before that build has emitted its ambient
+// declaration, while preserving the generated shape when the plugin runs.
+declare module '@happyvertical/smrt-virt-web' {
+  export const webMcpToolDefinitions: readonly import('@happyvertical/smrt-web').WebMcpToolDefinition[];
+}