@happyvertical/smrt-template-sveltekit 0.53.3 → 0.53.5

package/template/README.md

@@ -22,7 +22,9 @@ re-running install, setup, or recovery; each operation is repeatable from that
 stopped state. `pnpm app:doctor`
 prints secret-free JSON diagnostics and recovery steps. Individual
 setup/start/doctor/open/stop/backup/export/import operations are available as
-`pnpm app:<operation>`.
+`pnpm app:<operation>`. Every lifecycle script is a one-line call to
+`smrt app <operation>` from `@happyvertical/smrt-cli`; the app ships no copied
+operator scripts, so upgrading the CLI upgrades them.
 
 `app:start` defaults adapter-node `ORIGIN` to its loopback HTTP URL (including
 the selected `PORT`) and preserves an explicitly configured `ORIGIN`. Origin
@@ -58,9 +60,12 @@ The source of truth is `src/lib/objects`. Running `pnpm dev`, `pnpm build`, or
 | `src/lib/types/smrt-generated/` | Virtual-module and consumer declarations | No |
 | `src/routes/api/**/+server.ts` | Generated SvelteKit REST routes | No |
 
-Do not edit generated files. `smrtPlugin()` owns local scanning, manifests,
-types, and routes. `smrtConsumer()` explicitly consumes the profiles, tenancy,
-and users manifests so those models are available to setup and tooling.
+Do not edit generated files. The `smrt()` plugin in `vite.config.ts` owns
+local scanning, manifests, types, routes, and the decorator transform. It
+consumes exactly the packages listed in `smrt.config.ts` under
+`consumer.packages` (profiles, tenancy, and users) so those models are
+available to setup and tooling; add a SMRT package there when the app uses its
+objects.
 
 ## 3. Define the first object
 
@@ -130,22 +135,37 @@ migration command, not by adding schema creation to a request handler.
 
 ## 5. Understand tenant context
 
-`src/hooks.server.ts` keeps tenant selection separate from authorization:
+`src/hooks.server.ts` mounts the runtime configured in `src/lib/server/smrt.ts`
+(`createSmrtSvelteKitRuntime()` from `@happyvertical/smrt-app-runtime/sveltekit`).
+It keeps tenant selection separate from authorization:
 
-1. `src/lib/server/tenancy.ts` reads a subdomain slug and looks up an active
-   Tenant UUID. It stores the candidate in `locals.selectedTenantId` and
-   `locals.selectedTenantSlug`.
+1. A subdomain slug is looked up as an active Tenant UUID and stored only as a
+   candidate in `locals.selectedTenantId` and `locals.selectedTenantSlug`.
 2. That candidate does not enter AsyncLocalStorage and cannot scope queries.
-3. `createSessionHandler({ enterTenantContext: true })` loads the signed session,
-   resolves its membership and permissions, and establishes the authorized
-   `locals.tenantId` context.
-4. `enableTenancy()` makes `@TenantScoped` collections honor that context.
-
-The default resolver ignores `x-tenant-id`. If a gateway supplies a tenant
-header, validate the gateway identity/signature before mapping it to a tenant,
-and still use `switchSessionTenant()` for browser session changes. That helper
-checks active membership and rotates the session ID; never copy an untrusted
-header directly into `locals.tenantId` or `enterTenantContext()`.
+3. The signed session is loaded. Its tenant is accepted only for an active (or
+   legitimately inherited) membership, which establishes the authorized
+   `locals.tenantId`, the permission set, and the tenant context.
+4. The runtime enables tenancy, so `@TenantScoped` collections honor that
+   context.
+
+The default selector ignores `x-tenant-id`. To select tenants from a path,
+signed cookie, or trusted gateway, pass `selectTenant` to
+`createSmrtSvelteKitRuntime()`; selection must still never establish
+authorization. Validate a gateway's identity/signature before mapping its
+header to a tenant, and use `switchSessionTenant()` for browser session
+changes. That helper checks active membership and rotates the session ID; never
+copy an untrusted header directly into `locals.tenantId` or
+`enterTenantContext()`.
+
+`src/lib/server/smrt.ts` holds only the runtime and its options. The `smrt()`
+plugin registers the generated objects before it runs, and each generated API
+route imports this module and resolves collections through its exported
+`runtime.getCollection()` (a `getCollection` export here would take precedence,
+deprecated for one release, so do not add one). In the local profile
+the runtime holds the single-writer lease (`acquireWriterLease: false` opts
+out). `runtime.getCollection()` and `runtime.classOptions()` are
+request-scoped (under `database-rls` isolation they carry the request
+transaction): call them inside a request and never keep the result.
 
 Set `TENANT_BASE_DOMAIN` for deployed subdomain routing. The fallback parser is
 only for local shapes such as `acme.demo.local`.
@@ -171,10 +191,10 @@ import {
   RoleCollection,
   syncPermissionCatalog,
 } from '@happyvertical/smrt-users';
-import { getSmrtConfig } from '$lib/server/smrt';
+import { runtime } from '$lib/server/smrt';
 
-await syncPermissionCatalog(getSmrtConfig('Permission'));
-const roles = await RoleCollection.create(getSmrtConfig('Role'));
+await syncPermissionCatalog(runtime.classOptions('Permission'));
+const roles = await RoleCollection.create(runtime.classOptions('Role'));
 await roles.seedSystemRoles({ seedPermissions: true });
 ```
 
@@ -205,7 +225,7 @@ export const load: PageServerLoad = async ({ depends, locals }) => {
     return { items: [] };
   }
 
-  const items = await getCollection<Item>('Item');
+  const items = await runtime.getCollection<Item>('Item');
   const rows = await items.list({ limit: 50 });
   return {
     items: rows.flatMap((item) =>
@@ -234,10 +254,14 @@ non-object or malformed manifests, credential-shaped JSON fields and credential
 URL userinfo, non-portable schemas, and non-loopback HTTP server URLs. Diagnostics never
 include malformed manifest content.
 
-The option stages `src/routes/api/mcp/+server.ts`, a session-authorized `mcp`
-server, and a bounded static resource with a restrictive CSP. It also includes
-`McpAppsBridge.svelte` for an application-configured trusted host origin and
-the optional OpenAI display adapter; it stays inert until your UI mounts it.
+The option stages `src/routes/api/mcp/+server.ts`, one `mountMcpAppRoute()`
+call from `@happyvertical/smrt-app-mcp/sveltekit` that publishes `Item` to
+principals holding `items.read` (the signed session's permissions locally),
+refuses browser requests from a foreign `Origin`, and serves a bounded static
+resource with a restrictive CSP and the optional OpenAI display metadata. It
+also stages the protected-resource metadata route. For a view, mount
+`McpAppsBridge` from `@happyvertical/smrt-svelte/mcp-apps` with an
+application-configured trusted host origin.
 The scaffold does not enable remote MCP tasks, so a deployment that adds them
 must supply the durable worker's live authorization callback before publication.
 
@@ -300,7 +324,7 @@ narrower tool set.
 ```svelte
 <script lang="ts">
   import { webMcpToolDefinitions } from '@happyvertical/smrt-virt-web';
-  import { Provider } from '@happyvertical/smrt-svelte';
+  import { AppShell } from '@happyvertical/smrt-svelte/app';
 
   const webmcp = $derived(
     typeof document !== 'undefined' && 'modelContext' in document
@@ -309,11 +333,17 @@ narrower tool set.
   );
 </script>
 
-<Provider {webmcp}>
+<!-- AppShell passes `webmcp` to its Provider unchanged. -->
+<AppShell title="s-m-r-t app" {webmcp} {nav}>
   {@render children()}
-</Provider>
+</AppShell>
 ```
 
+The root layout is `AppShell` from `@happyvertical/smrt-svelte/app` (Provider,
+theme and its CSS, the admin shell, and navigation); the app supplies its
+navigation and content. `/setup` and `/settings` use the same package's
+`OwnerSetupForm` and `ShellSettingsPage`.
+
 `registerWebMcpTools()` feature-detects browser support and uses the current
 authenticated page session. Omitted policy exposes all `read`-effect tools:
 intrinsic `list`/`get` plus custom actions explicitly declared as reads. To
@@ -399,18 +429,34 @@ Every supported local web
 entry point (`app:start` or `pnpm dev`) holds a shared writer lease. Direct
 production startup must set an explicit loopback `HOST`, and `app:start` is the
 recommended entry point. Stop the app before backup/import. For deployed import, stop
-web/workers and set `SMRT_MAINTENANCE_MODE=true`. Extend
-`scripts/smrt-portability.mjs` for domain-specific transformations.
+web/workers and set `SMRT_MAINTENANCE_MODE=true`. For domain-specific
+transformations, add a `scripts/smrt-portability.mjs` adapter; when present it
+replaces `smrt app export`/`import`'s built-in one.
+
+### MCP authorization
+
+In the `local` profile, the opt-in MCP route accepts two credentials. One is
+the signed browser session. The other is an owner-minted bearer token for a
+local MCP client such as Claude Desktop through `smrt-mcp-bridge`:
+
+```bash
+pnpm exec smrt app token --scopes items.read --label "Claude Desktop"
+pnpm exec smrt app token list
+pnpm exec smrt app token revoke <id>
+```
 
-### Hosted MCP authorization
+The token is printed once and only its hash is stored. It is bound to the
+owner and the owner's workspace. It expires after 30 days unless you pass
+`--expires`, up to 365 days. It never carries a permission the owner no longer
+holds. Point the bridge at `/api/mcp` with `<PREFIX>_SERVER_URL` and
+`<PREFIX>_TOKEN`; see the `@happyvertical/smrt-app-cli` README.
 
-The opt-in MCP route uses the local signed session only in the `local` profile.
 For `self-hosted` and `cloud`, configure HTTPS `SMRT_MCP_RESOURCE`,
 `SMRT_MCP_ISSUER`, `SMRT_MCP_JWKS_URI`, and space-separated
-`SMRT_MCP_SCOPES` values. Bind `resolveHostedMcpPrincipal` in
-`src/lib/server/mcp-hosted-principal.ts` to an application-owned lookup that
-checks the current account and active tenant membership on every request. It
-must return `null` for disabled, revoked, or unmapped identities. The route
-does not derive tenant authority from JWT claims, request headers, or tool
-arguments; missing configuration or a missing binding fails closed before MCP
-dispatch.
+`SMRT_MCP_SCOPES` values. On every request, the runtime maps the verified
+issuer and subject to the user linked through OIDC login. That user must have
+exactly one active tenant membership. Disabled, unmapped, or multi-tenant
+identities are denied. To use a different lookup, pass `resolvePrincipal` to
+`createHostedMcpResourceAuth`. The route never derives tenant authority from
+JWT claims, request headers, or tool arguments. Missing configuration fails
+closed before MCP dispatch.

package/template/compose.yaml

@@ -16,7 +16,7 @@ services:
     build: .
     env_file: .env.self-hosted
     environment: *runtime-environment
-    command: node scripts/smrt-worker.mjs task
+    command: pnpm exec smrt app worker task
     depends_on:
       migrate:
         condition: service_completed_successfully
@@ -24,7 +24,7 @@ services:
     build: .
     env_file: .env.self-hosted
     environment: *runtime-environment
-    command: node scripts/smrt-worker.mjs schedule
+    command: pnpm exec smrt app worker schedule
     depends_on:
       migrate:
         condition: service_completed_successfully

package/template/package.json

@@ -9,25 +9,26 @@
     "pnpm": "11.25.0"
   },
   "scripts": {
-    "dev": "node --env-file-if-exists=.env scripts/smrt-vite.mjs dev",
-    "build": "node scripts/smrt-mcp-apps.mjs validate-if-present && node --env-file-if-exists=.env scripts/smrt-vite.mjs build",
-    "preview": "node scripts/smrt-app.mjs start",
+    "dev": "smrt app dev",
+    "build": "smrt app build",
+    "preview": "smrt app start",
     "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
     "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
-    "db:migrate": "vite build && node scripts/smrt-prepare-migration.mjs",
-    "app:install": "node scripts/smrt-app.mjs install",
-    "app:setup": "node scripts/smrt-app.mjs setup",
-    "app:recover": "node scripts/smrt-app.mjs recover",
-    "app:start": "node scripts/smrt-app.mjs start",
-    "app:doctor": "node scripts/smrt-app.mjs doctor",
-    "app:open": "node scripts/smrt-app.mjs open",
-    "app:stop": "node scripts/smrt-app.mjs stop",
-    "app:backup": "node scripts/smrt-app.mjs backup",
-    "app:export": "node scripts/smrt-app.mjs export",
-    "app:import": "node scripts/smrt-app.mjs import",
+    "typecheck": "svelte-kit sync && tsc --noEmit -p tsconfig.json && svelte-check --tsconfig ./tsconfig.json",
+    "db:migrate": "vite build && smrt app migrate",
+    "app:install": "smrt app install",
+    "app:setup": "smrt app setup",
+    "app:recover": "smrt app recover",
+    "app:start": "smrt app start",
+    "app:doctor": "smrt app doctor",
+    "app:open": "smrt app open",
+    "app:stop": "smrt app stop",
+    "app:backup": "smrt app backup",
+    "app:export": "smrt app export",
+    "app:import": "smrt app import",
     "mcp-apps:validate": "pnpm exec smrt mcp-apps validate --output-dir ./mcp-apps",
-    "worker": "node scripts/smrt-worker.mjs task",
-    "worker:schedule": "node scripts/smrt-worker.mjs schedule"
+    "worker": "smrt app worker task",
+    "worker:schedule": "smrt app worker schedule"
   },
   "devDependencies": {
     "@sveltejs/adapter-node": "^5.5.7",
@@ -38,19 +39,19 @@
     "svelte-check": "^4.7.6",
     "typescript": "6.0.3",
     "vite": "8.3.0",
-    "@happyvertical/smrt-cli": "^0.53.3"
+    "@happyvertical/smrt-cli": "^0.53.5"
   },
   "dependencies": {
-    "@happyvertical/smrt-app-runtime": "^0.53.3",
-    "@happyvertical/smrt-config": "^0.53.3",
-    "@happyvertical/smrt-core": "^0.53.3",
-    "@happyvertical/smrt-jobs": "^0.53.3",
-    "@happyvertical/smrt-profiles": "^0.53.3",
-    "@happyvertical/smrt-svelte": "^0.53.3",
-    "@happyvertical/smrt-tenancy": "^0.53.3",
-    "@happyvertical/smrt-ui": "^0.53.3",
-    "@happyvertical/smrt-users": "^0.53.3",
-    "@happyvertical/smrt-web": "^0.53.3",
+    "@happyvertical/smrt-app-runtime": "^0.53.5",
+    "@happyvertical/smrt-config": "^0.53.5",
+    "@happyvertical/smrt-core": "^0.53.5",
+    "@happyvertical/smrt-jobs": "^0.53.5",
+    "@happyvertical/smrt-profiles": "^0.53.5",
+    "@happyvertical/smrt-svelte": "^0.53.5",
+    "@happyvertical/smrt-tenancy": "^0.53.5",
+    "@happyvertical/smrt-ui": "^0.53.5",
+    "@happyvertical/smrt-users": "^0.53.5",
+    "@happyvertical/smrt-web": "^0.53.5",
     "@happyvertical/sql": "^0.89.12",
     "@modelcontextprotocol/server": "^2.0.0"
   }

package/template/smrt.config.ts

@@ -5,25 +5,10 @@
  * See: https://github.com/happyvertical/smrt
  */
 
-import { resolveLocalRuntimePaths } from '@happyvertical/smrt-app-runtime';
-import { resolveApplicationId } from './scripts/smrt-runtime-identity.mjs';
-
 const profile = (process.env.SMRT_RUNTIME_PROFILE || 'local') as
   | 'local'
   | 'self-hosted'
   | 'cloud';
-const appId = resolveApplicationId({
-  sourceRoot: process.cwd(),
-  explicitId: process.env.SMRT_APP_ID,
-});
-const localDatabase =
-  profile === 'local'
-    ? resolveLocalRuntimePaths({
-        appId,
-        dataDirectory: process.env.SMRT_DATA_DIR,
-        sourceRoot: process.cwd(),
-      }).database
-    : undefined;
 
 export default {
   // This is the single infrastructure selector for the application. Domain
@@ -32,7 +17,18 @@ export default {
     profile,
   },
 
-  // Agent/developer knowledge artifacts are generated by smrtPlugin().
+  // SMRT packages whose object manifests this app consumes. Keeping the list
+  // explicit avoids treating tooling/UI packages as domain model providers
+  // and makes generated runtime registration deterministic.
+  consumer: {
+    packages: [
+      '@happyvertical/smrt-profiles',
+      '@happyvertical/smrt-tenancy',
+      '@happyvertical/smrt-users',
+    ],
+  },
+
+  // Agent/developer knowledge artifacts are generated by the smrt() Vite plugin.
   // HTTP API routes stay off unless explicitly enabled for a dev/admin-only workflow.
   knowledge: {
     enabled: true,
@@ -45,22 +41,8 @@ export default {
     },
   },
 
-  // Package-specific configuration
-  packages: {
-    // CLI configuration
-    cli: {
-      database: {
-        type:
-          profile === 'local' ? 'sqlite' : 'postgres',
-        // `smrt-app` sets DATABASE_URL to the profile-owned data path before
-        // migrations. Deployed profiles require an operator-owned URL.
-        url:
-          profile === 'local'
-            ? process.env.DATABASE_URL || localDatabase
-            : process.env.DATABASE_URL,
-      },
-      verbose: false,
-    },
-
-  },
+  // No `packages.cli.database`: `smrt app setup` / `smrt app migrate` hand
+  // `smrt db:migrate` the profile-owned database through DATABASE_URL and
+  // DATABASE_TYPE (local: the SQLite file in the user data root; deployed: the
+  // operator's URL). See the smrt-cli README for the precedence.
 };

package/template/src/app.d.ts

@@ -1,21 +1,14 @@
 // See https://svelte.dev/docs/kit/types#app.d.ts
 // for information about these interfaces
 
-import type { SessionLocals } from '@happyvertical/smrt-users/sveltekit';
+import type { SmrtRuntimeLocals } from '@happyvertical/smrt-app-runtime/sveltekit';
 
 declare global {
   namespace App {
     // interface Error {}
-    interface Locals extends SessionLocals {
-      /**
-       * URL-selected tenant candidate. Never use this as authorization; the
-       * session-authorized tenant remains `tenantId` from SessionLocals.
-       */
-      selectedTenantId: string | null;
-      selectedTenantSlug: string | null;
-      /** Full context for the authorized session tenant, when present. */
-      tenantContext?: import('@happyvertical/smrt-tenancy').MinimalTenantContext;
-    }
+    // Session user, permissions, the authorized `tenantId`/`tenantContext`,
+    // and the URL-selected tenant candidate (never authorization).
+    interface Locals extends SmrtRuntimeLocals {}
     // interface PageData {}
     // interface PageState {}
     // interface Platform {}

package/template/src/hooks.server.ts

@@ -1,56 +1,15 @@
 /**
- * Request foundation, in order:
+ * Request foundation from `@happyvertical/smrt-app-runtime/sveltekit`, in
+ * order: the fail-closed startup gate (`init`), URL tenant selection
+ * (`locals.selectedTenant*`, never authority; tenant headers are ignored), the
+ * signed session (the only source of tenant context and permissions), and
+ * `locals.tenantContext` published only for the verified session tenant.
  *
- * 1. Resolve a URL tenant candidate into `locals.selectedTenant*`. This is
- *    selection only and does not enter AsyncLocalStorage tenant context.
- * 2. Load the signed session. `enterTenantContext: true` establishes the
- *    authorized session tenant and its permission set for downstream code.
- * 3. Publish the authorized context on locals when it matches the session.
- *
- * This ordering prevents a spoofed header or hostname from becoming query
- * authority. Membership-gated tenant switching belongs in an explicit action
- * using `switchSessionTenant()` from `@happyvertical/smrt-users/sveltekit`.
+ * Membership-gated tenant switching belongs in an explicit action using
+ * `switchSessionTenant()` from `@happyvertical/smrt-users/sveltekit`.
+ * Configure the runtime in `$lib/server/smrt`.
  */
 
-import { getCurrentTenant, enableTenancy } from '@happyvertical/smrt-tenancy';
-import { createSessionHandler } from '@happyvertical/smrt-users/sveltekit';
-import type { Handle, ServerInit } from '@sveltejs/kit';
-import { sequence } from '@sveltejs/kit/hooks';
-
-import { getSmrtConfig } from '$lib/server/smrt';
-import { ensureApplicationRuntimeReady } from '$lib/server/application-runtime';
-import { resolveTenant } from '$lib/server/tenancy';
-
-enableTenancy();
-
-export const init: ServerInit = ensureApplicationRuntimeReady;
-
-const tenantSelectionHandle: Handle = async ({ event, resolve }) => {
-  const selection = await resolveTenant(event);
-  event.locals.selectedTenantId = selection.tenantId;
-  event.locals.selectedTenantSlug = selection.tenantSlug;
-  return resolve(event);
-};
-
-const sessionHandle = createSessionHandler({
-  ...getSmrtConfig('Session'),
-  enterTenantContext: true,
-}) as unknown as Handle;
-
-const authorizedTenantLocalsHandle: Handle = async ({ event, resolve }) => {
-  const activeContext = getCurrentTenant();
-  if (
-    event.locals.user &&
-    event.locals.tenantId &&
-    activeContext?.tenantId === event.locals.tenantId
-  ) {
-    event.locals.tenantContext = activeContext;
-  }
-  return resolve(event);
-};
+import { runtime } from '$lib/server/smrt';
 
-export const handle: Handle = sequence(
-  tenantSelectionHandle,
-  sessionHandle,
-  authorizedTenantLocalsHandle,
-);
+export const { handle, init } = runtime;

package/template/src/lib/server/smrt.ts

@@ -1,103 +1,27 @@
 /**
- * Centralized SMRT Configuration
+ * The application's SMRT runtime: app options only.
  *
- * This file provides configuration for all SMRT objects in your project.
- * Import this file in your routes to get properly configured collections.
- */
-
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-
-import {
-  ObjectRegistry,
-  type SmrtClassOptions,
-  type SmrtObject,
-} from '@happyvertical/smrt-core';
-import { loadManifestFromPathSync } from '@happyvertical/smrt-core/manifest';
-import { getRequestScopedDatabase } from '@happyvertical/smrt-users';
-
-import { getApplicationDatabaseConfig } from './application-runtime.js';
-
-// Import all SMRT objects to register them.
-import '../objects/index.js';
-
-// Upgrade those registrations to package-qualified identities
-// (`<package>:<Class>`) — required to link each class to its scanned field
-// metadata below. smrtPlugin() generates this module on every dev/build run
-// (it is gitignored, like the generated API routes); guard the import so a
-// fresh checkout that has not run the plugin yet still boots.
-try {
-  // @ts-ignore generated by smrtPlugin before a consumer build starts
-  await import('./smrt-register.js');
-} catch (error) {
-  // Not generated yet — the first `vite dev` / `vite build` creates it. Do
-  // not hide a real import/runtime error from an existing generated module.
-  const code = (error as NodeJS.ErrnoException).code;
-  const message = error instanceof Error ? error.message : '';
-  if (
-    code !== 'ERR_MODULE_NOT_FOUND' &&
-    !message.includes('smrt-register.js')
-  ) {
-    throw error;
-  }
-}
-
-// Hydrate field metadata for this app's own objects from the local manifest
-// written by smrtPlugin() (`.smrt/manifest.json`). The decorator import above
-// registers the classes, but their scanned field metadata (plain properties
-// like `title: string = ''`) lives in the manifest — without seeding it, the
-// runtime only knows the framework base fields and server-side writes would
-// silently drop your domain columns.
-const localManifestPath = join(process.cwd(), '.smrt', 'manifest.json');
-if (existsSync(localManifestPath)) {
-  loadManifestFromPathSync(localManifestPath);
-}
-
-/**
- * Per-object configuration overrides
- *
- * Use this to configure specific objects differently from defaults.
- * Example:
- *   AuditLog: { db: { url: process.env.AUDIT_DB_URL!, type: 'postgres' } }
- */
-const objectOverrides: Record<string, Partial<SmrtClassOptions>> = {
-  // Add object-specific overrides here
-};
-
-/**
- * Get default configuration for SMRT objects
- */
-function getDefaultConfig(): SmrtClassOptions {
-  return {
-    db: getApplicationDatabaseConfig(),
-  };
-}
-
-/**
- * Get configuration for a specific SMRT class
- */
-export function getSmrtConfig(className: string): SmrtClassOptions {
-  const defaults = getDefaultConfig();
-  const override = objectOverrides[className];
-  return override ? { ...defaults, ...override } : defaults;
-}
-
-/**
- * Get a collection instance for a SMRT class
+ * `runtime` composes the configured profile (local SQLite or deployed
+ * PostgreSQL), storage custody, the owner bootstrap, tenant selection, the
+ * signed session, and (local profile) the single-writer lease shared with
+ * `smrt app` operations; `src/hooks.server.ts` mounts its `handle` and `init`.
+ * The smrt() Vite plugin registers the generated objects before this module
+ * runs, and generated API routes resolve collections through
+ * `runtime.getCollection()`.
  *
- * Usage in routes:
- *   const products = await getCollection<Product>('Product');
- *   const items = await products.list();
+ * `runtime.getCollection()` and `runtime.classOptions()` are request-scoped:
+ * under `database-rls` isolation they carry the request's transaction, so
+ * call them per request and never keep the result.
  */
-export async function getCollection<T extends SmrtObject>(className: string) {
-  const config = getSmrtConfig(className);
-  const objectOverride = objectOverrides[className];
-  const requestScopedDb = objectOverride?.db
-    ? undefined
-    : (getRequestScopedDatabase() as SmrtClassOptions['db'] | undefined);
 
-  return await ObjectRegistry.getCollection<T>(className, {
-    ...config,
-    db: requestScopedDb ?? config.db,
-  });
-}
+import { createProviderReadinessProbe } from '@happyvertical/smrt-app-runtime';
+import { createSmrtSvelteKitRuntime } from '@happyvertical/smrt-app-runtime/sveltekit';
+
+export const runtime = createSmrtSvelteKitRuntime({
+  // Deployed profiles prove authentication, asset, and secret readiness
+  // through the installed modules named by SMRT_*_READINESS_MODULE.
+  providerReadiness: createProviderReadinessProbe,
+  // Per-object overrides, for example:
+  //   AuditLog: { db: { type: 'postgres', url: process.env.AUDIT_DB_URL! } }
+  classOverrides: {},
+});

package/template/src/routes/+layout.server.ts

@@ -1,15 +1,7 @@
-import type { LayoutServerLoad } from './$types';
+import { createSessionLayoutLoad } from '@happyvertical/smrt-app-runtime/sveltekit';
 
 /**
- * Keep session and tenant state server-owned. The selected tenant is displayed
- * separately from the tenant authorized by the active session.
+ * Server-owned session summary: whether a user is signed in, the tenant the
+ * session authorizes, and (display only) the URL-selected tenant candidate.
  */
-export const load: LayoutServerLoad = async ({ locals }) => {
-  return {
-    session: {
-      authenticated: Boolean(locals.user),
-      activeTenantId: locals.tenantId,
-      selectedTenantSlug: locals.selectedTenantSlug,
-    },
-  };
-};
+export const load = createSessionLayoutLoad();