@happyvertical/smrt-template-sveltekit 0.53.3 → 0.53.4

package/template/src/routes/setup/+page.server.ts

@@ -1,96 +1,23 @@
 import { rmSync } from 'node:fs';
 import { join } from 'node:path';
-import { fail, redirect } from '@sveltejs/kit';
-import type { Actions, PageServerLoad } from './$types';
 
-import {
-  applicationRuntime,
-  getLocalApplicationRuntime,
-} from '$lib/server/application-runtime';
-import {
-  resolveApplicationId,
-  resolveApplicationStateRoot,
-} from '../../../scripts/smrt-runtime-identity.mjs';
+import { resolveApplicationStateRoot } from '@happyvertical/smrt-app-runtime';
+import { createOwnerSetupPage } from '@happyvertical/smrt-app-runtime/sveltekit';
 
-export const load: PageServerLoad = async ({ url, locals }) => {
-  if (locals.user) throw redirect(303, '/');
-  if (applicationRuntime.profile !== 'local') {
-    return { available: false, token: '' };
-  }
-  const runtime = await getLocalApplicationRuntime();
-  const diagnostics = await runtime.diagnostics();
-  return {
-    available: diagnostics.bootstrap.status !== 'claimed',
-    token: url.searchParams.get('token') || '',
-  };
-};
+import { runtime } from '$lib/server/smrt';
 
-export const actions: Actions = {
-  default: async (event) => {
-    if (applicationRuntime.profile !== 'local') {
-      return fail(404, { message: 'Local owner setup is disabled.' });
-    }
-    const form = await event.request.formData();
-    const token = String(form.get('token') || '');
-    const name = String(form.get('name') || '');
-    const email = String(form.get('email') || '');
-    if (!token || !name.trim() || !email.includes('@')) {
-      return fail(400, { message: 'Name, email, and a valid setup token are required.' });
-    }
-    const runtime = await getLocalApplicationRuntime();
-    let result;
-    try {
-      result = await runtime.claimOwner({
-        token,
-        name,
-        email,
-        userAgent: event.request.headers.get('user-agent') || undefined,
-        ipAddress: event.getClientAddress(),
-      });
-    } catch {
-      return fail(400, {
-        message:
-          'The setup invitation is invalid, expired, or already used. Run pnpm app:stop, pnpm app:recover, pnpm app:start, then pnpm app:open.',
-      });
-    }
-    event.cookies.set('sid', result.sessionId, {
-      path: '/',
-      httpOnly: true,
-      secure: event.url.protocol === 'https:',
-      sameSite: 'lax',
-      maxAge: 7 * 24 * 60 * 60,
+/** Local-profile, loopback-only, single-use owner bootstrap. */
+export const { load, actions } = createOwnerSetupPage(runtime, {
+  // `pnpm app:setup` leaves the invitation in mode-0600 handoff files; once
+  // the owner exists they only hold a token that now fails closed.
+  onOwnerClaimed() {
+    const stateRoot = resolveApplicationStateRoot({
+      appId: runtime.applicationId(),
+      dataDirectory: process.env.SMRT_DATA_DIR,
+      sourceRoot: process.cwd(),
     });
-    try {
-      const appId = resolveApplicationId({
-        sourceRoot: process.cwd(),
-        explicitId: process.env.SMRT_APP_ID,
-      });
-      rmSync(
-        join(
-          resolveApplicationStateRoot({
-            appId,
-            dataDirectory: process.env.SMRT_DATA_DIR,
-            sourceRoot: process.cwd(),
-          }),
-          'onboarding.json',
-        ),
-        { force: true },
-      );
-      rmSync(
-        join(
-          resolveApplicationStateRoot({
-            appId,
-            dataDirectory: process.env.SMRT_DATA_DIR,
-            sourceRoot: process.cwd(),
-          }),
-          'onboarding-launch.html',
-        ),
-        { force: true },
-      );
-    } catch {
-      // The owner and session are authoritative; stale mode-0600 handoff files
-      // only contain a token that now fails closed as already claimed.
+    for (const file of ['onboarding.json', 'onboarding-launch.html']) {
+      rmSync(join(stateRoot, file), { force: true });
     }
-    throw redirect(303, '/');
   },
-};
+});

package/template/src/routes/setup/+page.svelte

@@ -1,4 +1,6 @@
 <script lang="ts">
+  import { enhance } from '$app/forms';
+  import { OwnerSetupForm } from '@happyvertical/smrt-svelte/app';
   import type { PageProps } from './$types';
 
   let { data, form }: PageProps = $props();
@@ -6,26 +8,4 @@
 
 <svelte:head><title>Set up your local application</title></svelte:head>
 
-<main>
-  <h1>Set up your local application</h1>
-  {#if !data.available}
-    <p>Local owner setup is unavailable or has already been completed.</p>
-  {:else}
-    <p>Create the real local owner account. This invitation works once and stays on this device.</p>
-    {#if form?.message}<p role="alert">{form.message}</p>{/if}
-    <form method="POST">
-      <input type="hidden" name="token" value={data.token} />
-      <label>Name <input name="name" autocomplete="name" required /></label>
-      <label>Email <input name="email" type="email" autocomplete="email" required /></label>
-      <button type="submit">Create owner</button>
-    </form>
-  {/if}
-</main>
-
-<style>
-  main { max-width: 36rem; margin: 4rem auto; padding: 1.5rem; }
-  form { display: grid; gap: 1rem; }
-  label { display: grid; gap: 0.35rem; }
-  input { padding: 0.65rem; }
-  button { width: fit-content; padding: 0.65rem 1rem; }
-</style>
+<OwnerSetupForm {data} {form} {enhance} />

package/template/vite.config.ts

@@ -1,48 +1,10 @@
 import { sveltekit } from '@sveltejs/kit/vite';
-import { smrtConsumer } from '@happyvertical/smrt-core/consumer-plugin';
-import { smrtPlugin } from '@happyvertical/smrt-core/vite-plugin';
+import { smrt } from '@happyvertical/smrt-core/vite';
 import { defineConfig } from 'vite';
 
+// `smrt()` applies the legacy-decorator transform, consumes the manifests of
+// the packages listed in `smrt.config.ts` (`consumer.packages`), and generates
+// this app's object registration, types, and API routes.
 export default defineConfig({
-  // Lower `@smrt()` legacy (experimentalDecorators) decorators explicitly.
-  // tsconfig.json sets experimentalDecorators, but Vite's oxc transform does
-  // not reliably honor it through the SvelteKit `extends
-  // "./.svelte-kit/tsconfig.json"` chain — raw `@decorator class` syntax then
-  // reaches the SSR runtime and throws `SyntaxError: Invalid or unexpected
-  // token` on the first request.
-  oxc: {
-    decorator: {
-      legacy: true,
-      emitDecoratorMetadata: true,
-    },
-  },
-  plugins: [
-    sveltekit(),
-    // Only packages whose object manifests this app consumes belong here.
-    // Keeping the list explicit avoids treating tooling/UI packages as domain
-    // model providers and makes generated runtime registration deterministic.
-    smrtConsumer({
-      packages: [
-        '@happyvertical/smrt-profiles',
-        '@happyvertical/smrt-tenancy',
-        '@happyvertical/smrt-users',
-      ],
-      generateTypes: true,
-      typesDir: 'src/lib/types/smrt-generated',
-      svelteKit: true,
-    }),
-    smrtPlugin({
-      include: ['src/lib/objects/**/*.ts'],
-      exclude: ['**/*.test.ts', '**/*.spec.ts'],
-      generateTypes: true,
-      typeDeclarationsPath: 'src/lib/types/smrt-generated',
-      svelteKit: {
-        enabled: true,
-        routesDir: 'src/routes/api',
-        objectsDir: 'src/lib/objects',
-        configPath: 'src/lib/server',
-        configFileName: 'smrt.ts',
-      },
-    }),
-  ],
+  plugins: [sveltekit(), smrt()],
 });

package/template.config.js

@@ -19,22 +19,22 @@ export default {
 
   // Dependencies to add to generated project
   dependencies: {
-    '@happyvertical/smrt-app-runtime': '^0.53.3',
-    '@happyvertical/smrt-config': '^0.53.3',
-    '@happyvertical/smrt-core': '^0.53.3',
-    '@happyvertical/smrt-jobs': '^0.53.3',
-    '@happyvertical/smrt-profiles': '^0.53.3',
-    '@happyvertical/smrt-svelte': '^0.53.3',
-    '@happyvertical/smrt-tenancy': '^0.53.3',
-    '@happyvertical/smrt-ui': '^0.53.3',
-    '@happyvertical/smrt-users': '^0.53.3',
-    '@happyvertical/smrt-web': '^0.53.3',
+    '@happyvertical/smrt-app-runtime': '^0.53.4',
+    '@happyvertical/smrt-config': '^0.53.4',
+    '@happyvertical/smrt-core': '^0.53.4',
+    '@happyvertical/smrt-jobs': '^0.53.4',
+    '@happyvertical/smrt-profiles': '^0.53.4',
+    '@happyvertical/smrt-svelte': '^0.53.4',
+    '@happyvertical/smrt-tenancy': '^0.53.4',
+    '@happyvertical/smrt-ui': '^0.53.4',
+    '@happyvertical/smrt-users': '^0.53.4',
+    '@happyvertical/smrt-web': '^0.53.4',
     '@happyvertical/sql': '^0.89.12',
     '@modelcontextprotocol/server': '^2.0.0',
   },
 
   devDependencies: {
-    '@happyvertical/smrt-cli': '^0.53.3',
+    '@happyvertical/smrt-cli': '^0.53.4',
     '@sveltejs/adapter-node': '^5.5.7',
     '@sveltejs/kit': '2.70.3',
     '@sveltejs/vite-plugin-svelte': '^7.3.0',

package/mcp-apps-template/src/lib/McpAppsBridge.svelte

@@ -1,37 +0,0 @@
-<script lang="ts">
-  import { requestOpenAiDisplayMode } from '@happyvertical/smrt-mcp-openai/client';
-  import { useMcpApp } from '@happyvertical/smrt-svelte/mcp-apps';
-
-  interface Props {
-    /** Exact, application-configured host origin. Never derive this from URL input. */
-    hostOrigin: string;
-  }
-
-  let { hostOrigin }: Props = $props();
-  let expandUnavailable = $state(false);
-  const app = useMcpApp(() => ({
-    appInfo: { name: 'smrt-app', version: '0.1.0' },
-    availableDisplayModes: ['inline', 'fullscreen'],
-    hostOrigin,
-    hostWindow: parent,
-  }));
-
-  async function expand() {
-    try {
-      if (!app.bridge) throw new Error('Host bridge unavailable');
-      await requestOpenAiDisplayMode(app.bridge, 'fullscreen');
-    } catch {
-      expandUnavailable = true;
-    }
-  }
-</script>
-
-<section aria-labelledby="mcp-apps-title" class="mcp-apps-bridge">
-  <h1 id="mcp-apps-title">Items</h1>
-  <p>Use this view to review the items your signed-in tenant authorizes.</p>
-  {#if app.error || expandUnavailable}
-    <p role="status">Host controls are unavailable; this view remains inline.</p>
-  {:else}
-    <button type="button" onclick={expand}>Expand view</button>
-  {/if}
-</section>

package/mcp-apps-template/src/lib/server/mcp-hosted.ts

@@ -1,28 +0,0 @@
-import { createMcpResourceAuth } from '@happyvertical/smrt-app-mcp/auth';
-import { applicationRuntime } from './application-runtime.js';
-import { resolveHostedMcpPrincipal } from './mcp-hosted-principal.js';
-
-function required(name: string): string {
-  const value = process.env[name]?.trim();
-  if (!value) throw new Error(`Hosted MCP requires ${name}.`);
-  return value;
-}
-
-let cachedAuth: ReturnType<typeof createMcpResourceAuth> | undefined;
-
-export function hostedMcpAuth() {
-  if (applicationRuntime.profile === 'local') return null;
-  if (cachedAuth) return cachedAuth;
-  if (!resolveHostedMcpPrincipal)
-    throw new Error('Hosted MCP requires an application-owned resolveHostedMcpPrincipal binding.');
-  cachedAuth = createMcpResourceAuth({
-    profile: applicationRuntime.profile,
-    resource: required('SMRT_MCP_RESOURCE'),
-    issuer: required('SMRT_MCP_ISSUER'),
-    jwksUri: required('SMRT_MCP_JWKS_URI'),
-    scopes: required('SMRT_MCP_SCOPES').split(/\s+/u),
-    algorithms: ['RS256'],
-    resolvePrincipal: resolveHostedMcpPrincipal,
-  });
-  return cachedAuth;
-}

package/mcp-apps-template/src/lib/server/mcp.ts

@@ -1,85 +0,0 @@
-import {
-  createMcpAppServer,
-  type McpAppPrincipal,
-  type McpWorkflowToolDefinition,
-} from '@happyvertical/smrt-app-mcp';
-import { openAiDisplayMetadata, withOpenAiEntrypoints } from '@happyvertical/smrt-mcp-openai';
-import { getApplicationDatabaseConfig } from './application-runtime.js';
-
-const ITEM_RESOURCE_URI = 'ui://smrt-app/v1/items.html';
-const itemResourceHtml = `<!doctype html><html lang="en"><head><title>Items</title></head><body><main tabindex="-1"><h1>Items</h1><p>Use the host controls to review your authorized items.</p></main></body></html>`;
-
-const itemsOverview: McpWorkflowToolDefinition = withOpenAiEntrypoints(
-  {
-    name: 'items_overview',
-    description: 'Open the authorized item overview.',
-    title: 'Items',
-    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
-    outputSchema: {
-      type: 'object',
-      properties: { state: { type: 'string' } },
-      required: ['state'],
-      additionalProperties: false,
-    },
-    effect: 'read',
-    idempotent: true,
-    openWorld: false,
-    ui: { resourceUri: ITEM_RESOURCE_URI },
-    async execute() {
-      return {
-        content: [{ type: 'text', text: 'Item overview is ready.' }],
-        structuredContent: { state: 'ready' },
-      };
-    },
-  },
-  ['global'],
-);
-
-/**
- * The session hook resolves membership and permissions for every request. This
- * adapter only projects that trusted, request-local result; headers and route
- * arguments are never identity inputs.
- */
-export function resolveMcpPrincipal(event: {
-  locals?: Record<string, unknown>;
-}): McpAppPrincipal | null {
-  const user = event.locals?.user as { id?: unknown } | undefined;
-  const tenantId = event.locals?.tenantId;
-  const permissions = event.locals?.permissions;
-  if (typeof user?.id !== 'string' || typeof tenantId !== 'string') return null;
-  if (!Array.isArray(permissions) || !permissions.every((value) => typeof value === 'string'))
-    return null;
-  return {
-    id: user.id,
-    tenantId,
-    kind: 'human',
-    scopes: [...permissions].sort(),
-  };
-}
-
-export const mcpServer = createMcpAppServer({
-  smrtOptions: () => ({ db: getApplicationDatabaseConfig() }),
-  serverInfo: { name: 'smrt-app', version: '0.1.0' },
-  allowedClassNames: ['Item'],
-  workflowTools: [itemsOverview],
-  resources: [
-    {
-      uri: ITEM_RESOURCE_URI,
-      version: 'v1',
-      name: 'Items',
-      html: itemResourceHtml,
-      csp: {},
-      metadata: openAiDisplayMetadata({ availableDisplayModes: ['inline'] }),
-    },
-  ],
-  toolPolicy: ({ principal }) =>
-    principal?.kind === 'human' &&
-    typeof principal.id === 'string' &&
-    typeof principal.tenantId === 'string' &&
-    principal.scopes?.includes('items.read') === true,
-  resourcePolicy: ({ principal }) =>
-    principal?.kind === 'human' &&
-    typeof principal.id === 'string' &&
-    typeof principal.tenantId === 'string' &&
-    principal.scopes?.includes('items.read') === true,
-});