@happyvertical/smrt-template-sveltekit 0.52.0 → 0.53.0

package/AGENTS.md

@@ -13,7 +13,8 @@ It is the ground-up alternative to `smrt-saas-starter`.
 
 ## Current generated-project contract
 
-- Node `>=24.18.0`; pnpm `11.25.0` via `packageManager` and `engines`.
+- Node `>=26.0.0`; pnpm `11.25.0` via `packageManager` and `engines`. Node 25+
+  images ship no Corepack, so the Dockerfile installs a pinned copy.
 - `runtime.profile` is the canonical infrastructure selector. Generated apps
   expose deterministic `app:*` operations and keep runtime state outside source.
 - The production baseline uses adapter-node with separate web, task-worker, and

package/README.md

@@ -20,9 +20,19 @@ Run the copy command from the monorepo root. The public 0.43.10 CLI advertises
 `gnode create`, but its command dispatcher currently rejects `gnode`; this
 package's tested `copyTemplate()` export is the working scaffold path.
 
-Generated projects require Node.js 24.18.0 or newer and pnpm 11.25.0. They pin
+Generated projects require Node.js 26.0.0 or newer and pnpm 11.25.0. They pin
 all directly used `@happyvertical/smrt-*` packages to the current monorepo
-release (synced at publish by `scripts/sync-template-versions.mjs`).
+release, including opt-in MCP Apps dependencies (synced at publish by
+`scripts/sync-template-versions.mjs`; `--check` detects drift).
+
+`smrt gnode create <name> --mcp-apps` supports installed, local, and Git
+subdirectory templates. Plugin names must satisfy the pinned Agent Plugins
+1.0.0 schema before generation starts. `smrt mcp-apps validate` applies the
+official closed plugin/MCP schemas offline, then s-m-r-t endpoint and credential
+checks. Every existing scoped registry directive must be canonical; inline
+`#` and `;` comments are supported. Hosted MCP caches its successfully created
+authenticator for the process, preserving JWKS keys across requests while
+principal resolution and task authorization still run for each request.
 
 For programmatic scaffolding:
 

package/index.js

@@ -80,6 +80,14 @@ export function copyTemplate(destination, options = {}) {
   if (!existsSync(destination)) {
     mkdirSync(destination, { recursive: true });
   }
+  if (!pathEntryExists(join(destination, '.npmrc'))) writeFileSync(join(destination, '.npmrc'), '@happyvertical:registry=https://npm.happyvertical.com/\n');
+  else {
+    const npmrc = join(destination, '.npmrc');
+    if (!lstatSync(npmrc).isFile()) throw new Error('Generated application .npmrc must be a regular file');
+    const current = readFileSync(npmrc, 'utf8'), routes = [...current.matchAll(/^\s*@happyvertical:registry\s*=\s*(\S+)(?:\s+[;#].*)?\s*$/gm)].map((match) => match[1]);
+    if (routes.some((route) => route !== 'https://npm.happyvertical.com/')) throw new Error('Generated application .npmrc has a conflicting @happyvertical registry');
+    if (!routes.length) writeFileSync(npmrc, `${current}${current.endsWith('\n') ? '' : '\n'}@happyvertical:registry=https://npm.happyvertical.com/\n`);
+  }
 
   // Copy all template files, skipping internal-only directories
   cpSync(templatePath, destination, {

package/mcp-apps-template/package.dependencies.json

@@ -0,0 +1,4 @@
+{
+  "@happyvertical/smrt-app-mcp": "^0.52.0",
+  "@happyvertical/smrt-mcp-openai": "^0.52.0"
+}

package/mcp-apps-template/src/lib/McpAppsBridge.svelte

@@ -0,0 +1,37 @@
+<script lang="ts">
+  import { requestOpenAiDisplayMode } from '@happyvertical/smrt-mcp-openai/client';
+  import { useMcpApp } from '@happyvertical/smrt-svelte/mcp-apps';
+
+  interface Props {
+    /** Exact, application-configured host origin. Never derive this from URL input. */
+    hostOrigin: string;
+  }
+
+  let { hostOrigin }: Props = $props();
+  let expandUnavailable = $state(false);
+  const app = useMcpApp(() => ({
+    appInfo: { name: 'smrt-app', version: '0.1.0' },
+    availableDisplayModes: ['inline', 'fullscreen'],
+    hostOrigin,
+    hostWindow: parent,
+  }));
+
+  async function expand() {
+    try {
+      if (!app.bridge) throw new Error('Host bridge unavailable');
+      await requestOpenAiDisplayMode(app.bridge, 'fullscreen');
+    } catch {
+      expandUnavailable = true;
+    }
+  }
+</script>
+
+<section aria-labelledby="mcp-apps-title" class="mcp-apps-bridge">
+  <h1 id="mcp-apps-title">Items</h1>
+  <p>Use this view to review the items your signed-in tenant authorizes.</p>
+  {#if app.error || expandUnavailable}
+    <p role="status">Host controls are unavailable; this view remains inline.</p>
+  {:else}
+    <button type="button" onclick={expand}>Expand view</button>
+  {/if}
+</section>

package/mcp-apps-template/src/lib/server/mcp-hosted-principal.ts

@@ -0,0 +1,12 @@
+import type { McpVerifiedIdentity, McpPrincipalMapping } from '@happyvertical/smrt-app-mcp/auth';
+
+/**
+ * Deployments must replace this binding with a database-backed current-account
+ * and active-membership lookup. Token claims never select a tenant.
+ */
+export type HostedMcpPrincipalResolver = (
+  identity: McpVerifiedIdentity,
+) => Promise<McpPrincipalMapping | null>;
+
+export const resolveHostedMcpPrincipal: HostedMcpPrincipalResolver | undefined =
+  undefined;

package/mcp-apps-template/src/lib/server/mcp-hosted.ts

@@ -0,0 +1,28 @@
+import { createMcpResourceAuth } from '@happyvertical/smrt-app-mcp/auth';
+import { applicationRuntime } from './application-runtime.js';
+import { resolveHostedMcpPrincipal } from './mcp-hosted-principal.js';
+
+function required(name: string): string {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(`Hosted MCP requires ${name}.`);
+  return value;
+}
+
+let cachedAuth: ReturnType<typeof createMcpResourceAuth> | undefined;
+
+export function hostedMcpAuth() {
+  if (applicationRuntime.profile === 'local') return null;
+  if (cachedAuth) return cachedAuth;
+  if (!resolveHostedMcpPrincipal)
+    throw new Error('Hosted MCP requires an application-owned resolveHostedMcpPrincipal binding.');
+  cachedAuth = createMcpResourceAuth({
+    profile: applicationRuntime.profile,
+    resource: required('SMRT_MCP_RESOURCE'),
+    issuer: required('SMRT_MCP_ISSUER'),
+    jwksUri: required('SMRT_MCP_JWKS_URI'),
+    scopes: required('SMRT_MCP_SCOPES').split(/\s+/u),
+    algorithms: ['RS256'],
+    resolvePrincipal: resolveHostedMcpPrincipal,
+  });
+  return cachedAuth;
+}

package/mcp-apps-template/src/lib/server/mcp.ts

@@ -0,0 +1,85 @@
+import {
+  createMcpAppServer,
+  type McpAppPrincipal,
+  type McpWorkflowToolDefinition,
+} from '@happyvertical/smrt-app-mcp';
+import { openAiDisplayMetadata, withOpenAiEntrypoints } from '@happyvertical/smrt-mcp-openai';
+import { getApplicationDatabaseConfig } from './application-runtime.js';
+
+const ITEM_RESOURCE_URI = 'ui://smrt-app/v1/items.html';
+const itemResourceHtml = `<!doctype html><html lang="en"><head><title>Items</title></head><body><main tabindex="-1"><h1>Items</h1><p>Use the host controls to review your authorized items.</p></main></body></html>`;
+
+const itemsOverview: McpWorkflowToolDefinition = withOpenAiEntrypoints(
+  {
+    name: 'items_overview',
+    description: 'Open the authorized item overview.',
+    title: 'Items',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    outputSchema: {
+      type: 'object',
+      properties: { state: { type: 'string' } },
+      required: ['state'],
+      additionalProperties: false,
+    },
+    effect: 'read',
+    idempotent: true,
+    openWorld: false,
+    ui: { resourceUri: ITEM_RESOURCE_URI },
+    async execute() {
+      return {
+        content: [{ type: 'text', text: 'Item overview is ready.' }],
+        structuredContent: { state: 'ready' },
+      };
+    },
+  },
+  ['global'],
+);
+
+/**
+ * The session hook resolves membership and permissions for every request. This
+ * adapter only projects that trusted, request-local result; headers and route
+ * arguments are never identity inputs.
+ */
+export function resolveMcpPrincipal(event: {
+  locals?: Record<string, unknown>;
+}): McpAppPrincipal | null {
+  const user = event.locals?.user as { id?: unknown } | undefined;
+  const tenantId = event.locals?.tenantId;
+  const permissions = event.locals?.permissions;
+  if (typeof user?.id !== 'string' || typeof tenantId !== 'string') return null;
+  if (!Array.isArray(permissions) || !permissions.every((value) => typeof value === 'string'))
+    return null;
+  return {
+    id: user.id,
+    tenantId,
+    kind: 'human',
+    scopes: [...permissions].sort(),
+  };
+}
+
+export const mcpServer = createMcpAppServer({
+  smrtOptions: () => ({ db: getApplicationDatabaseConfig() }),
+  serverInfo: { name: 'smrt-app', version: '0.1.0' },
+  allowedClassNames: ['Item'],
+  workflowTools: [itemsOverview],
+  resources: [
+    {
+      uri: ITEM_RESOURCE_URI,
+      version: 'v1',
+      name: 'Items',
+      html: itemResourceHtml,
+      csp: {},
+      metadata: openAiDisplayMetadata({ availableDisplayModes: ['inline'] }),
+    },
+  ],
+  toolPolicy: ({ principal }) =>
+    principal?.kind === 'human' &&
+    typeof principal.id === 'string' &&
+    typeof principal.tenantId === 'string' &&
+    principal.scopes?.includes('items.read') === true,
+  resourcePolicy: ({ principal }) =>
+    principal?.kind === 'human' &&
+    typeof principal.id === 'string' &&
+    typeof principal.tenantId === 'string' &&
+    principal.scopes?.includes('items.read') === true,
+});

package/mcp-apps-template/src/routes/.well-known/oauth-protected-resource/api/mcp/+server.ts

@@ -0,0 +1,7 @@
+import { hostedMcpAuth } from '$lib/server/mcp-hosted';
+
+/** Serve exactly the RFC 9728 metadata URL advertised by hosted bearer challenges. */
+export function GET() {
+  const auth = hostedMcpAuth();
+  return auth?.metadataResponse() ?? new Response(null, { status: 404 });
+}

package/mcp-apps-template/src/routes/api/mcp/+server.ts

@@ -0,0 +1,15 @@
+import { mountMcpRoute } from '@happyvertical/smrt-app-mcp/sveltekit';
+
+import { mcpServer, resolveMcpPrincipal } from '$lib/server/mcp';
+import { hostedMcpAuth } from '$lib/server/mcp-hosted';
+
+/** Stateless SDK-v2 Streamable HTTP MCP endpoint. */
+const localRoute = mountMcpRoute(mcpServer, { resolvePrincipal: resolveMcpPrincipal });
+
+export async function POST(event: Parameters<typeof localRoute>[0]) {
+  const auth = hostedMcpAuth();
+  if (!auth) return localRoute(event);
+  const checked = await auth.authenticate(event.request);
+  if (!checked.ok) return checked.response;
+  return mountMcpRoute(mcpServer, { resolvePrincipal: () => checked.principal })(event);
+}

package/package.json

@@ -1,19 +1,22 @@
 {
   "name": "@happyvertical/smrt-template-sveltekit",
-  "version": "0.52.0",
+  "version": "0.53.0",
   "description": "Minimal SvelteKit project template with s-m-r-t framework integration",
   "type": "module",
   "main": "index.js",
   "exports": {
     ".": "./index.js",
+    "./template.config.js": "./template.config.js",
     "./template/*": "./template/*"
   },
   "files": [
     "CLAUDE.md",
     "README.md",
     "index.js",
+    "template.config.js",
     "template",
-    "AGENTS.md"
+    "AGENTS.md",
+    "mcp-apps-template"
   ],
   "keywords": [
     "smrt",
@@ -29,22 +32,22 @@
     "directory": "packages/template-sveltekit"
   },
   "peerDependencies": {
-    "@happyvertical/smrt-core": "0.52.0"
+    "@happyvertical/smrt-core": "0.53.0"
   },
   "devDependencies": {
-    "@happyvertical/smrt-app-runtime": "0.52.0",
-    "@happyvertical/smrt-assets": "0.52.0",
-    "@happyvertical/smrt-cli": "0.52.0",
-    "@happyvertical/smrt-config": "0.52.0",
-    "@happyvertical/smrt-jobs": "0.52.0",
-    "@happyvertical/smrt-playbooks": "0.52.0",
-    "@happyvertical/smrt-profiles": "0.52.0",
-    "@happyvertical/smrt-scanner": "0.52.0",
-    "@happyvertical/smrt-svelte": "0.52.0",
-    "@happyvertical/smrt-tenancy": "0.52.0",
-    "@happyvertical/smrt-ui": "0.52.0",
-    "@happyvertical/smrt-users": "0.52.0",
-    "@happyvertical/smrt-web": "0.52.0",
+    "@happyvertical/smrt-app-runtime": "0.53.0",
+    "@happyvertical/smrt-assets": "0.53.0",
+    "@happyvertical/smrt-cli": "0.53.0",
+    "@happyvertical/smrt-config": "0.53.0",
+    "@happyvertical/smrt-jobs": "0.53.0",
+    "@happyvertical/smrt-playbooks": "0.53.0",
+    "@happyvertical/smrt-profiles": "0.53.0",
+    "@happyvertical/smrt-scanner": "0.53.0",
+    "@happyvertical/smrt-svelte": "0.53.0",
+    "@happyvertical/smrt-tenancy": "0.53.0",
+    "@happyvertical/smrt-ui": "0.53.0",
+    "@happyvertical/smrt-users": "0.53.0",
+    "@happyvertical/smrt-web": "0.53.0",
     "@happyvertical/sql": "^0.89.12",
     "@modelcontextprotocol/server": "^2.0.0",
     "@playwright/test": "^1.63.0",

package/template/Dockerfile

@@ -1,15 +1,17 @@
-FROM node:24.18.0-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS build
+FROM node:26.9.0-alpine@sha256:dbaa92e5758cbbcf85d65d5403fdb530fe3442cbe8c6dbfb7ef23365450d5070 AS build
 WORKDIR /app
-RUN corepack enable
-COPY package.json pnpm-lock.yaml* ./
+# Node 25+ images no longer bundle Corepack; a pinned copy keeps
+# `packageManager` authoritative for the pnpm version.
+RUN npm install --global corepack@0.36.0 && corepack enable
+COPY package.json pnpm-lock.yaml* pnpm-workspace.yaml ./
 RUN pnpm install --frozen-lockfile
 COPY . .
 RUN pnpm build
 
-FROM node:24.18.0-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS runtime
+FROM node:26.9.0-alpine@sha256:dbaa92e5758cbbcf85d65d5403fdb530fe3442cbe8c6dbfb7ef23365450d5070 AS runtime
 WORKDIR /app
-RUN corepack enable
-COPY --from=build /app/package.json /app/pnpm-lock.yaml* ./
+RUN npm install --global corepack@0.36.0 && corepack enable
+COPY --from=build /app/package.json /app/pnpm-lock.yaml* /app/pnpm-workspace.yaml ./
 RUN pnpm install --frozen-lockfile --prod=false
 ENV NODE_ENV=production
 ENV SMRT_RUNTIME_PROFILE=self-hosted

package/template/README.md

@@ -6,7 +6,7 @@ managed-cloud environments. It does not provision external providers.
 
 ## 1. Install and run
 
-Requirements: Node.js 24.18.0 or newer and pnpm 11.25.0. The exact pnpm version
+Requirements: Node.js 26.0.0 or newer and pnpm 11.25.0. The exact pnpm version
 is declared in `packageManager`.
 
 ```bash
@@ -222,6 +222,32 @@ After a mutation, call `invalidate('smrt:items')`. Only loads that declared
 
 ## 8. Use generated REST, MCP, WebMCP, and CLI interfaces
 
+## Optional portable MCP Apps packaging
+
+The ordinary scaffold does not create a plugin package or add a remote endpoint.
+When you create a project with `smrt gnode create <name> --mcp-apps`, it adds
+`mcp-apps/plugin.json` and `mcp-apps/mcp.json`. The initial server points only
+at loopback (`http://127.0.0.1:3000/api/mcp`) so it cannot silently publish a
+local instance. Run `pnpm mcp-apps:validate` in the generated application after
+editing package metadata. It rejects symlinks, traversal paths, missing or linked UI assets (including screenshots),
+non-object or malformed manifests, credential-shaped JSON fields and credential carrier files,
+URL userinfo, non-portable schemas, and non-loopback HTTP server URLs. Diagnostics never
+include malformed manifest content.
+
+The option stages `src/routes/api/mcp/+server.ts`, a session-authorized `mcp`
+server, and a bounded static resource with a restrictive CSP. It also includes
+`McpAppsBridge.svelte` for an application-configured trusted host origin and
+the optional OpenAI display adapter; it stays inert until your UI mounts it.
+The scaffold does not enable remote MCP tasks, so a deployment that adds them
+must supply the durable worker's live authorization callback before publication.
+
+Before changing that URL, mount the native SDK v2 Streamable HTTP endpoint and
+configure the application gateway's verified principal, issuer, audience and
+scopes. Plugin metadata is an install surface only; it neither authenticates a
+request nor grants tenant or workflow authority. Register `.app.json` only
+after the host creates an eligible server ID; do not copy runtime extension
+metadata into the portable manifest.
+
 The Item configuration generates:
 
 - REST: `GET`/`POST /api/items` and
@@ -375,3 +401,16 @@ production startup must set an explicit loopback `HOST`, and `app:start` is the
 recommended entry point. Stop the app before backup/import. For deployed import, stop
 web/workers and set `SMRT_MAINTENANCE_MODE=true`. Extend
 `scripts/smrt-portability.mjs` for domain-specific transformations.
+
+### Hosted MCP authorization
+
+The opt-in MCP route uses the local signed session only in the `local` profile.
+For `self-hosted` and `cloud`, configure HTTPS `SMRT_MCP_RESOURCE`,
+`SMRT_MCP_ISSUER`, `SMRT_MCP_JWKS_URI`, and space-separated
+`SMRT_MCP_SCOPES` values. Bind `resolveHostedMcpPrincipal` in
+`src/lib/server/mcp-hosted-principal.ts` to an application-owned lookup that
+checks the current account and active tenant membership on every request. It
+must return `null` for disabled, revoked, or unmapped identities. The route
+does not derive tenant authority from JWT claims, request headers, or tool
+arguments; missing configuration or a missing binding fails closed before MCP
+dispatch.

package/template/package.json

@@ -5,12 +5,12 @@
   "type": "module",
   "packageManager": "pnpm@11.25.0",
   "engines": {
-    "node": ">=24.18.0",
+    "node": ">=26.0.0",
     "pnpm": "11.25.0"
   },
   "scripts": {
     "dev": "node --env-file-if-exists=.env scripts/smrt-vite.mjs dev",
-    "build": "node --env-file-if-exists=.env scripts/smrt-vite.mjs build",
+    "build": "node scripts/smrt-mcp-apps.mjs validate-if-present && node --env-file-if-exists=.env scripts/smrt-vite.mjs build",
     "preview": "node scripts/smrt-app.mjs start",
     "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
     "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
@@ -25,6 +25,7 @@
     "app:backup": "node scripts/smrt-app.mjs backup",
     "app:export": "node scripts/smrt-app.mjs export",
     "app:import": "node scripts/smrt-app.mjs import",
+    "mcp-apps:validate": "pnpm exec smrt mcp-apps validate --output-dir ./mcp-apps",
     "worker": "node scripts/smrt-worker.mjs task",
     "worker:schedule": "node scripts/smrt-worker.mjs schedule"
   },
@@ -37,19 +38,19 @@
     "svelte-check": "^4.7.6",
     "typescript": "6.0.3",
     "vite": "8.3.0",
-    "@happyvertical/smrt-cli": "^0.52.0"
+    "@happyvertical/smrt-cli": "^0.53.0"
   },
   "dependencies": {
-    "@happyvertical/smrt-app-runtime": "^0.52.0",
-    "@happyvertical/smrt-config": "^0.52.0",
-    "@happyvertical/smrt-core": "^0.52.0",
-    "@happyvertical/smrt-jobs": "^0.52.0",
-    "@happyvertical/smrt-profiles": "^0.52.0",
-    "@happyvertical/smrt-svelte": "^0.52.0",
-    "@happyvertical/smrt-tenancy": "^0.52.0",
-    "@happyvertical/smrt-ui": "^0.52.0",
-    "@happyvertical/smrt-users": "^0.52.0",
-    "@happyvertical/smrt-web": "^0.52.0",
+    "@happyvertical/smrt-app-runtime": "^0.53.0",
+    "@happyvertical/smrt-config": "^0.53.0",
+    "@happyvertical/smrt-core": "^0.53.0",
+    "@happyvertical/smrt-jobs": "^0.53.0",
+    "@happyvertical/smrt-profiles": "^0.53.0",
+    "@happyvertical/smrt-svelte": "^0.53.0",
+    "@happyvertical/smrt-tenancy": "^0.53.0",
+    "@happyvertical/smrt-ui": "^0.53.0",
+    "@happyvertical/smrt-users": "^0.53.0",
+    "@happyvertical/smrt-web": "^0.53.0",
     "@happyvertical/sql": "^0.89.12",
     "@modelcontextprotocol/server": "^2.0.0"
   }

package/template/pnpm-workspace.yaml

@@ -0,0 +1,3 @@
+allowBuilds:
+  esbuild: true
+  protobufjs: true

package/template/scripts/smrt-app.mjs

@@ -545,11 +545,11 @@ async function doctor() {
     });
   }
 
-  if (Number(process.versions.node.split('.')[0]) < 24) {
+  if (Number(process.versions.node.split('.')[0]) < 26) {
     findings.push({
       code: 'unsupported-node',
       severity: 'error',
-      message: 'Node.js 24 or newer is required.',
+      message: 'Node.js 26 or newer is required.',
       recovery: 'Install the Node.js version declared in package.json engines.',
     });
   }

package/template/scripts/smrt-mcp-apps.mjs

@@ -0,0 +1,18 @@
+/** Validate opt-in portable MCP Apps metadata before an application build. */
+import { existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+if (process.argv[2] !== 'validate-if-present') {
+  throw new Error('Usage: smrt-mcp-apps.mjs validate-if-present');
+}
+
+if (!existsSync('mcp-apps')) process.exit(0);
+
+const command = process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm';
+const result = spawnSync(
+  command,
+  ['exec', 'smrt', 'mcp-apps', 'validate', '--output-dir', './mcp-apps'],
+  { stdio: 'inherit' },
+);
+if (result.error) throw result.error;
+if (result.status !== 0) process.exit(result.status ?? 1);

package/template/scripts/smrt-runtime-identity.mjs

@@ -106,6 +106,12 @@ export function runtimeConfigurationFingerprint(
           assets: environment.SMRT_ASSETS_READINESS_MODULE || null,
           secrets: environment.SMRT_SECRETS_READINESS_MODULE || null,
         },
+        mcpAuthorization: {
+          resource: environment.SMRT_MCP_RESOURCE || null,
+          issuer: environment.SMRT_MCP_ISSUER || null,
+          jwksUri: environment.SMRT_MCP_JWKS_URI || null,
+          scopes: environment.SMRT_MCP_SCOPES || null,
+        },
       }),
     )
     .digest('hex');

package/template.config.js

@@ -0,0 +1,75 @@
+/**
+ * SvelteKit Template Configuration
+ *
+ * This file configures the template for use with `smrt gnode create`
+ *
+ * Version pins are kept in sync with `template/package.json` and the rest of
+ * the s-m-r-t monorepo. Any changes here MUST be mirrored in
+ * `template/package.json` so generated projects match the tracked template.
+ */
+
+export default {
+  name: 'sveltekit',
+  description: 'Minimal SvelteKit project with s-m-r-t integration',
+  framework: 'sveltekit',
+  version: '1.0.0',
+
+  // Template directory location (relative to this config file)
+  templateDir: './template',
+
+  // Dependencies to add to generated project
+  dependencies: {
+    '@happyvertical/smrt-app-runtime': '^0.53.0',
+    '@happyvertical/smrt-config': '^0.53.0',
+    '@happyvertical/smrt-core': '^0.53.0',
+    '@happyvertical/smrt-jobs': '^0.53.0',
+    '@happyvertical/smrt-profiles': '^0.53.0',
+    '@happyvertical/smrt-svelte': '^0.53.0',
+    '@happyvertical/smrt-tenancy': '^0.53.0',
+    '@happyvertical/smrt-ui': '^0.53.0',
+    '@happyvertical/smrt-users': '^0.53.0',
+    '@happyvertical/smrt-web': '^0.53.0',
+    '@happyvertical/sql': '^0.89.12',
+    '@modelcontextprotocol/server': '^2.0.0',
+  },
+
+  devDependencies: {
+    '@happyvertical/smrt-cli': '^0.53.0',
+    '@sveltejs/adapter-node': '^5.5.7',
+    '@sveltejs/kit': '2.70.3',
+    '@sveltejs/vite-plugin-svelte': '^7.3.0',
+    '@types/node': '^24.13.6',
+    'svelte': '^5.57.1',
+    'svelte-check': '^4.7.6',
+    'typescript': '6.0.3',
+    'vite': '8.3.0',
+  },
+
+  // Optional: customize files
+  files: {
+    // Rename patterns during generation
+    rename: {},
+    // Skip certain files
+    skip: ['.gitkeep'],
+    // Append/merge patterns
+    append: {},
+  },
+
+  // Placeholder substitutions
+  placeholders: {
+    '{{PROJECT_NAME}}': (ctx) => ctx.name,
+    '{{PACKAGE_NAME}}': (ctx) => ctx.name.toLowerCase().replace(/[^a-z0-9-]/g, '-'),
+  },
+
+  // Post-generation hooks
+  hooks: {
+    afterGenerate: async (ctx) => {
+      console.log(`\n✅ Created ${ctx.name} successfully!`);
+      console.log('\nNext steps:');
+      console.log(`  cd ${ctx.name}`);
+      console.log('  pnpm install');
+      console.log('  pnpm app:install');
+      console.log();
+    },
+  },
+};