@happyvertical/smrt-template-sveltekit 0.43.9 → 0.44.0

package/template/scripts/smrt-runtime-identity.mjs

@@ -0,0 +1,238 @@
+import {
+  closeSync,
+  constants,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+} from 'node:fs';
+import { basename, dirname, join, parse, resolve } from 'node:path';
+import { homedir, platform } from 'node:os';
+import {
+  encodeApplicationId,
+  resolveLocalRuntimePaths,
+  validateApplicationId,
+} from '@happyvertical/smrt-app-runtime';
+
+/**
+ * Resolve one stable identity for CLI, development, and app operations.
+ * @param {{sourceRoot?: string, packageName?: string, explicitId?: string}} [options]
+ */
+export function resolveApplicationId(options = {}) {
+  const sourceRoot = options.sourceRoot || process.cwd();
+  let packageName = options.packageName;
+  if (!packageName) {
+    packageName = JSON.parse(
+      readFileSync(join(sourceRoot, 'package.json'), 'utf8'),
+    ).name;
+  }
+  if (typeof packageName !== 'string' || packageName.trim() === '') {
+    throw new Error('package.json must declare a non-empty package name.');
+  }
+  return options.explicitId
+    ? validateApplicationId(options.explicitId)
+    : encodeApplicationId(packageName);
+}
+
+/**
+ * State is derived from the canonical application/data identity. It is not an
+ * independent override because every process and operator command must share
+ * one lock domain for a given database root.
+ * @param {{appId: string, dataDirectory?: string, sourceRoot?: string, platformName?: string, homeDirectory?: string, environment?: Record<string, string | undefined>}} options
+ */
+export function resolveApplicationStateRoot(options) {
+  const paths = resolveLocalRuntimePaths({
+    appId: options.appId,
+    dataDirectory: options.dataDirectory,
+    sourceRoot: options.sourceRoot,
+  });
+  const platformName = options.platformName || platform();
+  const homeDirectory = options.homeDirectory || homedir();
+  const environment = options.environment || process.env;
+  const stateBase =
+    platformName === 'darwin'
+      ? join(homeDirectory, 'Library', 'Application Support')
+      : platformName === 'win32'
+        ? environment.LOCALAPPDATA || homeDirectory
+        : environment.XDG_STATE_HOME || join(homeDirectory, '.local', 'state');
+  const dataIdentity = createHash('sha256')
+    .update(resolve(paths.root))
+    .digest('hex')
+    .slice(0, 12);
+  return resolve(stateBase, `.${options.appId}-${dataIdentity}-state`);
+}
+
+/** @param {string | undefined} value */
+function databaseTargetIdentity(value) {
+  if (!value) return null;
+  try {
+    const target = new URL(value);
+    const sslMode = target.searchParams.get('sslmode');
+    target.username = '';
+    target.password = '';
+    target.search = '';
+    target.hash = '';
+    if (sslMode) target.searchParams.set('sslmode', sslMode);
+    return target.toString();
+  } catch {
+    return resolve(value);
+  }
+}
+
+/**
+ * Secret-safe identity used to reject stale managed processes after profile,
+ * provider, database-target, or listener configuration changes.
+ * @param {{profile: string, providers: object}} runtime
+ * @param {Record<string, string | undefined>} [environment]
+ */
+export function runtimeConfigurationFingerprint(
+  runtime,
+  environment = process.env,
+) {
+  return createHash('sha256')
+    .update(
+      JSON.stringify({
+        profile: runtime.profile,
+        providers: runtime.providers,
+        databaseTarget: databaseTargetIdentity(environment.DATABASE_URL),
+        host: environment.HOST || null,
+        port: environment.PORT || null,
+        backgroundJobs: environment.SMRT_BACKGROUND_JOBS === 'true',
+        readinessModules: {
+          authentication: environment.SMRT_AUTH_READINESS_MODULE || null,
+          assets: environment.SMRT_ASSETS_READINESS_MODULE || null,
+          secrets: environment.SMRT_SECRETS_READINESS_MODULE || null,
+        },
+      }),
+    )
+    .digest('hex');
+}
+
+/** @param {string} parent @param {string} child */
+function isInside(parent, child) {
+  const relative = child.slice(parent.length);
+  return (
+    child === parent ||
+    (child.startsWith(parent) && (relative.startsWith('/') || relative.startsWith('\\')))
+  );
+}
+
+/**
+ * Resolve an operator-selected artifact through its nearest existing ancestor
+ * and reject paths that could place application data in or over the checkout.
+ * @param {{sourceRoot: string, path: string, label?: string}} options
+ */
+export function assertExternalArtifactPath(options) {
+  const canonicalSource = realpathSync(resolve(options.sourceRoot));
+  const missingSegments = [];
+  let existingAncestor = resolve(options.path);
+  while (!existsSync(existingAncestor)) {
+    const parent = dirname(existingAncestor);
+    if (parent === existingAncestor) break;
+    missingSegments.unshift(basename(existingAncestor));
+    existingAncestor = parent;
+  }
+  const canonicalPath = resolve(
+    realpathSync(existingAncestor),
+    ...missingSegments,
+  );
+  if (
+    isInside(canonicalSource, canonicalPath) ||
+    isInside(canonicalPath, canonicalSource)
+  ) {
+    throw new Error(
+      `${options.label || 'Artifact'} must remain outside the source tree.`,
+    );
+  }
+  return canonicalPath;
+}
+
+/** @param {unknown} error */
+function errorCode(error) {
+  return error && typeof error === 'object' && 'code' in error
+    ? error.code
+    : undefined;
+}
+
+/**
+ * Create or verify the private, app-bound state/lock directory.
+ * @param {{appId: string, dataDirectory?: string, sourceRoot?: string, platformName?: string, homeDirectory?: string, environment?: Record<string, string | undefined>}} options
+ */
+export function prepareApplicationStateRoot(options) {
+  const sourceRoot = realpathSync(resolve(options.sourceRoot || process.cwd()));
+  const stateRoot = resolveApplicationStateRoot(options);
+  if (isInside(sourceRoot, stateRoot) || isInside(stateRoot, sourceRoot)) {
+    throw new Error('Application state must remain outside the source tree.');
+  }
+  const currentUid = process.getuid?.();
+  let component = parse(stateRoot).root;
+  for (const part of stateRoot.slice(component.length).split(/[\\/]+/).filter(Boolean)) {
+    component = join(component, part);
+    try {
+      const details = lstatSync(component);
+      if (details.isSymbolicLink() || !details.isDirectory()) {
+        throw new Error(`Application state path component is unsafe: ${component}`);
+      }
+      const sharedStickyRoot = details.uid === 0 && (details.mode & 0o1000) !== 0;
+      if (
+        currentUid !== undefined &&
+        ((details.uid !== currentUid && details.uid !== 0) ||
+          ((details.mode & 0o022) !== 0 && !sharedStickyRoot))
+      ) {
+        throw new Error(`Application state path lacks trusted custody: ${component}`);
+      }
+    } catch (error) {
+      if (errorCode(error) !== 'ENOENT') throw error;
+      try {
+        mkdirSync(component, { mode: 0o700 });
+      } catch (mkdirError) {
+        if (errorCode(mkdirError) !== 'EEXIST') throw mkdirError;
+      }
+      const created = lstatSync(component);
+      if (
+        created.isSymbolicLink() ||
+        !created.isDirectory() ||
+        (currentUid !== undefined && created.uid !== currentUid) ||
+        (created.mode & 0o777) !== 0o700
+      ) {
+        throw new Error(`Application state path component is unsafe: ${component}`);
+      }
+    }
+  }
+  const rootDetails = lstatSync(stateRoot);
+  if (
+    rootDetails.isSymbolicLink() ||
+    !rootDetails.isDirectory() ||
+    (currentUid !== undefined && rootDetails.uid !== currentUid) ||
+    (rootDetails.mode & 0o777) !== 0o700
+  ) {
+    throw new Error('Application state root must be current-user-owned mode 0700.');
+  }
+  const markerPath = join(stateRoot, `.smrt-state-${validateApplicationId(options.appId)}`);
+  let descriptor;
+  try {
+    descriptor = openSync(
+      markerPath,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL,
+      0o600,
+    );
+  } catch (error) {
+    if (errorCode(error) !== 'EEXIST') throw error;
+    const marker = lstatSync(markerPath);
+    if (
+      marker.isSymbolicLink() ||
+      !marker.isFile() ||
+      marker.size !== 0 ||
+      (currentUid !== undefined && marker.uid !== currentUid) ||
+      (marker.mode & 0o777) !== 0o600
+    ) {
+      throw new Error('Application state marker is unsafe.');
+    }
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
+  }
+  return stateRoot;
+}
+import { createHash } from 'node:crypto';

package/template/scripts/smrt-vite.mjs

@@ -0,0 +1,45 @@
+import { existsSync, readFileSync, writeSync } from 'node:fs';
+import { dirname, isAbsolute, relative, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+function fail(message) {
+  writeSync(2, `s-m-r-t Vite launcher: ${message}\n`);
+  process.exit(1);
+}
+
+let packagePath;
+try {
+  packagePath = fileURLToPath(import.meta.resolve('vite/package.json'));
+} catch (error) {
+  const detail = error instanceof Error ? `: ${error.message}` : '';
+  fail(
+    `Could not resolve the installed Vite package${detail}. Verify the generated app dependencies and Vite compatibility.`,
+  );
+}
+const packageRoot = dirname(packagePath);
+let metadata;
+try {
+  metadata = JSON.parse(readFileSync(packagePath, 'utf8'));
+} catch {
+  fail('The installed Vite package metadata is invalid; reinstall dependencies.');
+}
+const declaredBin =
+  typeof metadata.bin === 'string' ? metadata.bin : metadata.bin?.vite;
+if (typeof declaredBin !== 'string' || declaredBin === '') {
+  fail('The installed Vite package does not declare its CLI.');
+}
+const entry = resolve(packageRoot, declaredBin);
+const relativeEntry = relative(packageRoot, entry);
+if (
+  relativeEntry === '' ||
+  relativeEntry.startsWith('..') ||
+  isAbsolute(relativeEntry)
+) {
+  fail('The installed Vite package declares an unsafe CLI path.');
+}
+if (!existsSync(entry)) {
+  fail('The installed Vite package CLI is missing; reinstall dependencies.');
+}
+
+process.argv = [process.execPath, entry, ...process.argv.slice(2)];
+await import(pathToFileURL(entry).href);

package/template/scripts/smrt-web.mjs

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+const instance = process.argv
+  .find((value) => value.startsWith('--smrt-instance='))
+  ?.slice('--smrt-instance='.length);
+if (!instance || !/^[a-f0-9]{32}$/.test(instance)) {
+  throw new Error('A valid application process identity is required.');
+}
+
+await import('../build/index.js');

package/template/scripts/smrt-worker.mjs

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+
+import { initializeDeployedApplicationRuntime } from '@happyvertical/smrt-app-runtime';
+import {
+  loadConfig,
+  resolveConfiguredApplicationRuntime,
+} from '@happyvertical/smrt-config';
+import { getDatabase } from '@happyvertical/sql';
+import { createProviderReadinessProbe } from './smrt-provider-readiness.mjs';
+
+await loadConfig({ cache: false });
+const configured = resolveConfiguredApplicationRuntime();
+if (configured.profile === 'local') {
+  throw new Error('Local jobs run inline or embedded; a separate worker requires self-hosted or cloud.');
+}
+if (!process.env.DATABASE_URL) throw new Error('DATABASE_URL is required.');
+
+const runtime = await initializeDeployedApplicationRuntime({
+  profile: configured.profile,
+  providers: {
+    database: configured.providers.database,
+    authentication: configured.providers.authentication,
+    tenancy: configured.providers.tenancy,
+    assets: configured.providers.assets,
+    secrets: configured.providers.secrets,
+    jobs: configured.providers.jobs,
+    network: configured.providers.network,
+  },
+  database: {
+    engine: 'postgres',
+    connect: () =>
+      getDatabase({ type: 'postgres', url: process.env.DATABASE_URL }),
+    close: async (db) => db.close?.(),
+  },
+  authentication: {
+    provider: configured.providers.authentication.provider,
+    readiness: createProviderReadinessProbe('authentication', {
+      profile: configured.profile,
+      provider: configured.providers.authentication.provider,
+    }),
+  },
+  assets: {
+    provider: configured.providers.assets.provider,
+    readiness: createProviderReadinessProbe('assets', {
+      profile: configured.profile,
+      provider: configured.providers.assets.provider,
+    }),
+  },
+  secrets: {
+    provider: configured.providers.secrets.provider,
+    readiness: createProviderReadinessProbe('secrets', {
+      profile: configured.profile,
+      provider: configured.providers.secrets.provider,
+    }),
+  },
+});
+
+const kind = process.argv[2] || 'task';
+const runner =
+  kind === 'schedule'
+    ? await runtime.createScheduleWorker()
+    : await runtime.createTaskWorker({
+        concurrency: Number.parseInt(
+          process.env.SMRT_WORKER_CONCURRENCY || '4',
+          10,
+        ),
+      });
+
+await runner.start();
+console.log(
+  JSON.stringify({
+    schemaVersion: 1,
+    status: 'ready',
+    kind,
+    secretValuesIncluded: false,
+  }),
+);
+
+let stopping = false;
+async function stop() {
+  if (stopping) return;
+  stopping = true;
+  await runtime.close();
+}
+process.once('SIGINT', () => void stop());
+process.once('SIGTERM', () => void stop());

package/template/scripts/smrt-writer-lease.mjs

@@ -0,0 +1,199 @@
+import { randomBytes } from 'node:crypto';
+import {
+  closeSync,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { join } from 'node:path';
+
+/** @param {number} pid */
+function processExists(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    const code =
+      error && typeof error === 'object' && 'code' in error
+        ? error.code
+        : undefined;
+    return code === 'EPERM' || code === 'EACCES';
+  }
+}
+
+/** @param {{ schemaVersion: number, pid: number, instance: string }} record */
+function validateRecord(record) {
+  if (
+    record.schemaVersion !== 1 ||
+    !Number.isSafeInteger(record.pid) ||
+    record.pid < 1 ||
+    typeof record.instance !== 'string' ||
+    !/^[a-f0-9]{32}$/.test(record.instance)
+  ) {
+    throw new Error('The application writer lease is malformed.');
+  }
+  return record;
+}
+
+/** @param {string | number} pathOrDescriptor */
+function readRecord(pathOrDescriptor) {
+  return validateRecord(
+    JSON.parse(readFileSync(pathOrDescriptor, 'utf8')),
+  );
+}
+
+/** @param {string} stateRoot */
+export function readActiveWriterLease(stateRoot) {
+  const path = join(stateRoot, 'writer.lease');
+  for (let attempt = 0; attempt < 4; attempt += 1) {
+    let descriptor;
+    try {
+      descriptor = openSync(path, 'r');
+      const identity = fstatSync(descriptor);
+      const record = readRecord(descriptor);
+      closeSync(descriptor);
+      descriptor = undefined;
+      if (processExists(record.pid)) return record;
+      const current = lstatSync(path);
+      if (current.dev !== identity.dev || current.ino !== identity.ino) {
+        continue;
+      }
+      rmSync(path);
+      return null;
+    } catch (error) {
+      if (descriptor !== undefined) closeSync(descriptor);
+      if (
+        error &&
+        typeof error === 'object' &&
+        'code' in error &&
+        error.code === 'ENOENT'
+      ) {
+        return null;
+      }
+      throw new Error(
+        'The application writer lease cannot be verified; inspect the private state directory.',
+      );
+    }
+  }
+  throw new Error(
+    'The application writer lease changed repeatedly and cannot be verified.',
+  );
+}
+
+/**
+ * @param {string} stateRoot
+ * @param {{ operationInstance?: string }} [options]
+ */
+export function acquireWriterLease(stateRoot, options = {}) {
+  mkdirSync(stateRoot, { recursive: true, mode: 0o700 });
+  const path = join(stateRoot, 'writer.lease');
+  const active = readActiveWriterLease(stateRoot);
+  if (active?.pid === process.pid) return { release() {} };
+  if (active) {
+    throw new Error(
+      `Another application writer is active (process ${active.pid}).`,
+    );
+  }
+  const instance = randomBytes(16).toString('hex');
+  let descriptor;
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      descriptor = openSync(path, 'wx', 0o600);
+      writeFileSync(
+        descriptor,
+        `${JSON.stringify({ schemaVersion: 1, pid: process.pid, instance })}\n`,
+      );
+      break;
+    } catch (error) {
+      if (descriptor !== undefined) {
+        closeSync(descriptor);
+        descriptor = undefined;
+      }
+      if (
+        error &&
+        typeof error === 'object' &&
+        'code' in error &&
+        error.code === 'EEXIST'
+      ) {
+        const owner = readActiveWriterLease(stateRoot);
+        if (!owner && attempt === 0) continue;
+        throw new Error(
+          `Another application writer is active${owner ? ` (process ${owner.pid})` : ''}.`,
+        );
+      }
+      rmSync(path, { force: true });
+      throw error;
+    }
+  }
+  if (descriptor === undefined) {
+    throw new Error('The application writer lease could not be acquired.');
+  }
+  closeSync(descriptor);
+  let released = false;
+  const release = () => {
+    if (released) return;
+    released = true;
+    try {
+      const current = readRecord(path);
+      if (current.pid === process.pid && current.instance === instance) {
+        rmSync(path, { force: true });
+      }
+    } catch {
+      // A missing or externally repaired lease is not ours to remove.
+    }
+  };
+  let operationDescriptor;
+  try {
+    const operationPath = join(stateRoot, 'operation.lock');
+    operationDescriptor = openSync(operationPath, 'r');
+    const operationIdentity = fstatSync(operationDescriptor);
+    const operation = JSON.parse(readFileSync(operationDescriptor, 'utf8'));
+    closeSync(operationDescriptor);
+    operationDescriptor = undefined;
+    if (
+      !Number.isSafeInteger(operation.pid) ||
+      operation.pid < 1 ||
+      typeof operation.instance !== 'string'
+    ) {
+      throw new Error('The application operation lock cannot be verified.');
+    }
+    if (!processExists(operation.pid)) {
+      const currentIdentity = lstatSync(operationPath);
+      if (
+        currentIdentity.dev !== operationIdentity.dev ||
+        currentIdentity.ino !== operationIdentity.ino
+      ) {
+        throw new Error('The application operation lock changed unexpectedly.');
+      }
+      rmSync(operationPath);
+    } else if (operation.instance !== options.operationInstance) {
+      release();
+      throw new Error(
+        'An application operation is active; wait for it to finish before starting a writer.',
+      );
+    }
+  } catch (error) {
+    if (operationDescriptor !== undefined) closeSync(operationDescriptor);
+    if (
+      !(
+        error &&
+        typeof error === 'object' &&
+        'code' in error &&
+        error.code === 'ENOENT'
+      )
+    ) {
+      if (error instanceof SyntaxError) {
+        release();
+        throw new Error('The application operation lock cannot be verified.');
+      }
+      release();
+      throw error;
+    }
+  }
+  process.once('exit', release);
+  return { release };
+}

package/template/smrt.config.ts

@@ -5,7 +5,33 @@
  * See: https://github.com/happyvertical/smrt
  */
 
+import { resolveLocalRuntimePaths } from '@happyvertical/smrt-app-runtime';
+import { resolveApplicationId } from './scripts/smrt-runtime-identity.mjs';
+
+const profile = (process.env.SMRT_RUNTIME_PROFILE || 'local') as
+  | 'local'
+  | 'self-hosted'
+  | 'cloud';
+const appId = resolveApplicationId({
+  sourceRoot: process.cwd(),
+  explicitId: process.env.SMRT_APP_ID,
+});
+const localDatabase =
+  profile === 'local'
+    ? resolveLocalRuntimePaths({
+        appId,
+        dataDirectory: process.env.SMRT_DATA_DIR,
+        sourceRoot: process.cwd(),
+      }).database
+    : undefined;
+
 export default {
+  // This is the single infrastructure selector for the application. Domain
+  // objects and generated REST/CLI/MCP/WebMCP surfaces do not branch on it.
+  runtime: {
+    profile,
+  },
+
   // Agent/developer knowledge artifacts are generated by smrtPlugin().
   // HTTP API routes stay off unless explicitly enabled for a dev/admin-only workflow.
   knowledge: {
@@ -24,8 +50,14 @@ export default {
     // CLI configuration
     cli: {
       database: {
-        type: 'sqlite',
-        url: process.env.DATABASE_URL || './app.db',
+        type:
+          profile === 'local' ? 'sqlite' : 'postgres',
+        // `smrt-app` sets DATABASE_URL to the profile-owned data path before
+        // migrations. Deployed profiles require an operator-owned URL.
+        url:
+          profile === 'local'
+            ? process.env.DATABASE_URL || localDatabase
+            : process.env.DATABASE_URL,
       },
       verbose: false,
     },

package/template/src/hooks.server.ts

@@ -14,14 +14,17 @@
 
 import { getCurrentTenant, enableTenancy } from '@happyvertical/smrt-tenancy';
 import { createSessionHandler } from '@happyvertical/smrt-users/sveltekit';
-import type { Handle } from '@sveltejs/kit';
+import type { Handle, ServerInit } from '@sveltejs/kit';
 import { sequence } from '@sveltejs/kit/hooks';
 
 import { getSmrtConfig } from '$lib/server/smrt';
+import { ensureApplicationRuntimeReady } from '$lib/server/application-runtime';
 import { resolveTenant } from '$lib/server/tenancy';
 
 enableTenancy();
 
+export const init: ServerInit = ensureApplicationRuntimeReady;
+
 const tenantSelectionHandle: Handle = async ({ event, resolve }) => {
   const selection = await resolveTenant(event);
   event.locals.selectedTenantId = selection.tenantId;

package/template/src/lib/RuntimeDiagnosticsWebMcp.svelte

@@ -0,0 +1,11 @@
+<script lang="ts">
+  import { registerRuntimeDiagnosticsWebMcp } from './runtime-diagnostics-webmcp.js';
+
+  let { enabled = true }: { enabled?: boolean } = $props();
+
+  $effect(() => {
+    if (!enabled) return;
+    const owner = registerRuntimeDiagnosticsWebMcp();
+    return () => owner?.dispose();
+  });
+</script>