@happyvertical/smrt-template-sveltekit 0.53.3 → 0.53.5

package/template/src/routes/+layout.svelte

@@ -1,113 +1,41 @@
 <script lang="ts">
   import { page } from '$app/state';
   import { webMcpToolDefinitions } from '@happyvertical/smrt-virt-web';
-  import { Provider } from '@happyvertical/smrt-svelte';
-  import {
-    AdminShell,
-    AppScopePanel,
-    type ShellNavItem,
-    TenantNav,
-  } from '@happyvertical/smrt-svelte/workspace';
-  import { ThemeProvider } from '@happyvertical/smrt-ui/themes';
-  import '@happyvertical/smrt-ui/themes/styles/fonts.css';
-  import RuntimeDiagnosticsWebMcp from '$lib/RuntimeDiagnosticsWebMcp.svelte';
+  import { AppShell } from '@happyvertical/smrt-svelte/app';
+  import type { ShellNavItem } from '@happyvertical/smrt-svelte/workspace';
   import type { LayoutProps } from './$types';
 
   let { data, children }: LayoutProps = $props();
 
-  const currentHref = $derived(page.url.pathname);
-  const activeTenantLabel = $derived(
-    data.session.activeTenantId ? 'Authorized session tenant' : 'No active tenant',
-  );
+  // Add application routes here. Generated REST routes live under /api and do
+  // not automatically imply a human-facing page.
+  const nav: ShellNavItem[] = [
+    { href: '/', label: 'Items', description: 'The example s-m-r-t object' },
+    { href: '/settings', label: 'Settings', description: 'Workspace layout and shortcuts' },
+  ];
 
-  // Keep the optional data-plane runtime out of browsers that do not expose
-  // WebMCP. SSR remains safe because the feature check is document-guarded.
+  // Generated read-only WebMCP tools, only in browsers that expose WebMCP.
   const webmcp = $derived(
     typeof document !== 'undefined' && 'modelContext' in document
-      ? {
-          definitions: webMcpToolDefinitions,
-          basePath: '/api',
-          effects: ['read'] as const,
-        }
+      ? { definitions: webMcpToolDefinitions, basePath: '/api', effects: ['read'] as const }
       : false,
   );
-
-  // Add application routes here. Generated REST routes live under /api and do
-  // not automatically imply a human-facing page.
-  const nav: ShellNavItem[] = [
-    {
-      href: '/',
-      label: 'Items',
-      description: 'The example s-m-r-t object',
-    },
-    {
-      href: '/settings',
-      label: 'Settings',
-      description: 'Workspace layout and shortcuts',
-    },
-  ];
 </script>
 
-<Provider {webmcp}>
-  <RuntimeDiagnosticsWebMcp enabled={data.session.authenticated} />
-  <ThemeProvider preset="smrt" colorScheme="system" persist={true}>
-    <AdminShell
-      title="s-m-r-t app"
-      subtitle="SvelteKit"
-      storageKey="smrt-app-shell"
-    >
-      {#snippet appPanel()}
-        <AppScopePanel
-          appName="s-m-r-t app"
-          tenantName={activeTenantLabel}
-          environment="local"
-          showSettings={false}
-        >
-          {#snippet docs()}
-            {#if data.session.selectedTenantSlug}
-              <p class="tenant-selection">
-                Selected URL tenant: <strong>{data.session.selectedTenantSlug}</strong>
-              </p>
-            {/if}
-            <a href="/settings">Shell settings</a>
-          {/snippet}
-        </AppScopePanel>
-      {/snippet}
-
-      {#snippet tenantPanel()}
-        <TenantNav items={nav} {currentHref} />
-      {/snippet}
-
-      {@render children()}
-    </AdminShell>
-  </ThemeProvider>
-</Provider>
-
-<style>
-  :global(*),
-  :global(*::before),
-  :global(*::after) {
-    box-sizing: border-box;
-  }
-
-  :global(html),
-  :global(body) {
-    min-height: 100%;
-    margin: 0;
-  }
-
-  :global(body) {
-    background: var(--smrt-color-background);
-    color: var(--smrt-color-on-background);
-    font-family: var(--smrt-typography-body-font-family, Inter, system-ui, sans-serif);
-  }
-
-  .tenant-selection {
-    margin: 0 0 var(--smrt-spacing-2);
-    color: var(--smrt-color-on-surface-variant);
-  }
-
-  a {
-    color: var(--smrt-color-primary);
-  }
-</style>
+<AppShell
+  title="s-m-r-t app"
+  subtitle="SvelteKit"
+  {webmcp}
+  {nav}
+  currentHref={page.url.pathname}
+  runtimeDiagnostics={data.session.authenticated}
+  tenantLabel={data.session.activeTenantId ? 'Authorized session tenant' : 'No active tenant'}
+  settingsHref="/settings"
+>
+  {#snippet appPanelDocs()}
+    {#if data.session.selectedTenantSlug}
+      <p>Selected URL tenant: <strong>{data.session.selectedTenantSlug}</strong></p>
+    {/if}
+  {/snippet}
+  {@render children()}
+</AppShell>

package/template/src/routes/+page.server.ts

@@ -2,7 +2,7 @@ import { assertOperationPermission } from '@happyvertical/smrt-users';
 import { fail } from '@sveltejs/kit';
 
 import type { Item } from '$lib/objects/Item';
-import { getCollection, getSmrtConfig } from '$lib/server/smrt';
+import { runtime } from '$lib/server/smrt';
 import type { Actions, PageServerLoad } from './$types';
 
 const READ_PERMISSION = 'items.read';
@@ -38,7 +38,7 @@ export const load: PageServerLoad = async ({ depends, locals }) => {
   }
 
   try {
-    const items = await getCollection<Item>('Item');
+    const items = await runtime.getCollection<Item>('Item');
     const rows = await items.list({
       orderBy: 'created_at DESC',
       limit: 50,
@@ -72,7 +72,7 @@ export const actions: Actions = {
     }
 
     const decision = await assertOperationPermission({
-      ...getSmrtConfig('Item'),
+      ...runtime.classOptions('Item'),
       action: 'create',
       collection: 'items',
       onDeny: 'return',
@@ -91,7 +91,7 @@ export const actions: Actions = {
     }
 
     try {
-      const items = await getCollection<Item>('Item');
+      const items = await runtime.getCollection<Item>('Item');
       await items.create({ title });
       return { created: title };
     } catch (error) {

package/template/src/routes/api/_runtime/diagnostics/+server.ts

@@ -1,5 +1,19 @@
-import type { RequestHandler } from './$types';
+import { createRuntimeDiagnosticsHandler } from '@happyvertical/smrt-app-runtime/sveltekit';
+import { RUNTIME_DIAGNOSTICS_WEBMCP_TOOL_NAME } from '@happyvertical/smrt-svelte/app/runtime-diagnostics';
+import { webMcpToolDefinitions } from '@happyvertical/smrt-virt-web';
 
-import { runtimeDiagnosticsGet } from '$lib/server/runtime-diagnostics';
+import { runtime } from '$lib/server/smrt';
 
-export const GET: RequestHandler = runtimeDiagnosticsGet;
+/**
+ * Authenticated, authorized (owner role or `runtime_diagnostics.read`) and
+ * redacted runtime diagnostics. Schema/migration status and the worker
+ * heartbeat stay `unknown` until the application installs real verifiers;
+ * process liveness is never substituted for them.
+ */
+export const GET = createRuntimeDiagnosticsHandler({
+  runtime,
+  toolNames: () => [
+    ...webMcpToolDefinitions.map((definition) => definition.name),
+    RUNTIME_DIAGNOSTICS_WEBMCP_TOOL_NAME,
+  ],
+});

package/template/src/routes/api/_runtime/health/+server.ts

@@ -1,30 +1,6 @@
-import { json } from '@sveltejs/kit';
-import type { RequestHandler } from './$types';
-import { resolveApplicationId } from '../../../../../scripts/smrt-runtime-identity.mjs';
-import {
-  applicationRuntime,
-  applicationRuntimeConfiguration,
-} from '$lib/server/application-runtime';
+import { createRuntimeHealthHandler } from '@happyvertical/smrt-app-runtime/sveltekit';
 
-const applicationId = resolveApplicationId({
-  sourceRoot: process.cwd(),
-  explicitId: process.env.SMRT_APP_ID,
-});
+import { runtime } from '$lib/server/smrt';
 
-export const GET: RequestHandler = async () => {
-  const publicHealth = {
-    schemaVersion: 1,
-    status: 'ready',
-    profile: applicationRuntime.profile,
-  };
-  return json(
-    applicationRuntime.profile === 'local'
-      ? {
-          ...publicHealth,
-          application: applicationId,
-          instance: process.env.SMRT_PROCESS_INSTANCE || null,
-          configuration: applicationRuntimeConfiguration,
-        }
-      : publicHealth,
-  );
-};
+/** Liveness; local responses add the identity `smrt app start` verifies. */
+export const GET = createRuntimeHealthHandler(runtime);

package/template/src/routes/settings/+page.svelte

@@ -1,41 +1,10 @@
 <script lang="ts">
-  import { ShellSettingsPanel } from '@happyvertical/smrt-svelte/workspace';
-
-  // This page renders inside the root layout's <AdminShell>, so the shell
-  // context set by AdminShell is available to descendants — ShellSettingsPanel
-  // reads it via useAdminShell() with no extra wiring. It lets users toggle
-  // panel visibility and remap the WASD hotkeys; changes persist through the
-  // shell's `storageKey` (localStorage), applied client-side after mount.
+  import { ShellSettingsPage } from '@happyvertical/smrt-svelte/app';
 </script>
 
 <svelte:head>
   <title>Settings · s-m-r-t app</title>
 </svelte:head>
 
-<section class="settings">
-  <header>
-    <h1>Settings</h1>
-    <p>Adjust the workspace shell — panel layout and keyboard shortcuts.</p>
-  </header>
-
-  <ShellSettingsPanel />
-</section>
-
-<style>
-  .settings {
-    display: grid;
-    gap: var(--smrt-spacing-6, 1.5rem);
-    max-width: 720px;
-    padding: var(--smrt-spacing-8, 2rem);
-  }
-
-  .settings header {
-    display: grid;
-    gap: var(--smrt-spacing-2, 0.5rem);
-  }
-
-  .settings h1,
-  .settings p {
-    margin: 0;
-  }
-</style>
+<!-- Panel layout and WASD hotkeys, persisted through the shell's storageKey. -->
+<ShellSettingsPage />

package/template/src/routes/setup/+page.server.ts

@@ -1,96 +1,9 @@
-import { rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { fail, redirect } from '@sveltejs/kit';
-import type { Actions, PageServerLoad } from './$types';
+import { createOwnerSetupPage } from '@happyvertical/smrt-app-runtime/sveltekit';
 
-import {
-  applicationRuntime,
-  getLocalApplicationRuntime,
-} from '$lib/server/application-runtime';
-import {
-  resolveApplicationId,
-  resolveApplicationStateRoot,
-} from '../../../scripts/smrt-runtime-identity.mjs';
+import { runtime } from '$lib/server/smrt';
 
-export const load: PageServerLoad = async ({ url, locals }) => {
-  if (locals.user) throw redirect(303, '/');
-  if (applicationRuntime.profile !== 'local') {
-    return { available: false, token: '' };
-  }
-  const runtime = await getLocalApplicationRuntime();
-  const diagnostics = await runtime.diagnostics();
-  return {
-    available: diagnostics.bootstrap.status !== 'claimed',
-    token: url.searchParams.get('token') || '',
-  };
-};
-
-export const actions: Actions = {
-  default: async (event) => {
-    if (applicationRuntime.profile !== 'local') {
-      return fail(404, { message: 'Local owner setup is disabled.' });
-    }
-    const form = await event.request.formData();
-    const token = String(form.get('token') || '');
-    const name = String(form.get('name') || '');
-    const email = String(form.get('email') || '');
-    if (!token || !name.trim() || !email.includes('@')) {
-      return fail(400, { message: 'Name, email, and a valid setup token are required.' });
-    }
-    const runtime = await getLocalApplicationRuntime();
-    let result;
-    try {
-      result = await runtime.claimOwner({
-        token,
-        name,
-        email,
-        userAgent: event.request.headers.get('user-agent') || undefined,
-        ipAddress: event.getClientAddress(),
-      });
-    } catch {
-      return fail(400, {
-        message:
-          'The setup invitation is invalid, expired, or already used. Run pnpm app:stop, pnpm app:recover, pnpm app:start, then pnpm app:open.',
-      });
-    }
-    event.cookies.set('sid', result.sessionId, {
-      path: '/',
-      httpOnly: true,
-      secure: event.url.protocol === 'https:',
-      sameSite: 'lax',
-      maxAge: 7 * 24 * 60 * 60,
-    });
-    try {
-      const appId = resolveApplicationId({
-        sourceRoot: process.cwd(),
-        explicitId: process.env.SMRT_APP_ID,
-      });
-      rmSync(
-        join(
-          resolveApplicationStateRoot({
-            appId,
-            dataDirectory: process.env.SMRT_DATA_DIR,
-            sourceRoot: process.cwd(),
-          }),
-          'onboarding.json',
-        ),
-        { force: true },
-      );
-      rmSync(
-        join(
-          resolveApplicationStateRoot({
-            appId,
-            dataDirectory: process.env.SMRT_DATA_DIR,
-            sourceRoot: process.cwd(),
-          }),
-          'onboarding-launch.html',
-        ),
-        { force: true },
-      );
-    } catch {
-      // The owner and session are authoritative; stale mode-0600 handoff files
-      // only contain a token that now fails closed as already claimed.
-    }
-    throw redirect(303, '/');
-  },
-};
+/**
+ * Local-profile, loopback-only, single-use owner bootstrap. The runtime
+ * removes the `pnpm app:setup` onboarding hand-off files once the claim commits.
+ */
+export const { load, actions } = createOwnerSetupPage(runtime);

package/template/src/routes/setup/+page.svelte

@@ -1,4 +1,6 @@
 <script lang="ts">
+  import { enhance } from '$app/forms';
+  import { OwnerSetupForm } from '@happyvertical/smrt-svelte/app';
   import type { PageProps } from './$types';
 
   let { data, form }: PageProps = $props();
@@ -6,26 +8,4 @@
 
 <svelte:head><title>Set up your local application</title></svelte:head>
 
-<main>
-  <h1>Set up your local application</h1>
-  {#if !data.available}
-    <p>Local owner setup is unavailable or has already been completed.</p>
-  {:else}
-    <p>Create the real local owner account. This invitation works once and stays on this device.</p>
-    {#if form?.message}<p role="alert">{form.message}</p>{/if}
-    <form method="POST">
-      <input type="hidden" name="token" value={data.token} />
-      <label>Name <input name="name" autocomplete="name" required /></label>
-      <label>Email <input name="email" type="email" autocomplete="email" required /></label>
-      <button type="submit">Create owner</button>
-    </form>
-  {/if}
-</main>
-
-<style>
-  main { max-width: 36rem; margin: 4rem auto; padding: 1.5rem; }
-  form { display: grid; gap: 1rem; }
-  label { display: grid; gap: 0.35rem; }
-  input { padding: 0.65rem; }
-  button { width: fit-content; padding: 0.65rem 1rem; }
-</style>
+<OwnerSetupForm {data} {form} {enhance} />

package/template/vite.config.ts

@@ -1,48 +1,10 @@
 import { sveltekit } from '@sveltejs/kit/vite';
-import { smrtConsumer } from '@happyvertical/smrt-core/consumer-plugin';
-import { smrtPlugin } from '@happyvertical/smrt-core/vite-plugin';
+import { smrt } from '@happyvertical/smrt-core/vite';
 import { defineConfig } from 'vite';
 
+// `smrt()` applies the legacy-decorator transform, consumes the manifests of
+// the packages listed in `smrt.config.ts` (`consumer.packages`), and generates
+// this app's object registration, types, and API routes.
 export default defineConfig({
-  // Lower `@smrt()` legacy (experimentalDecorators) decorators explicitly.
-  // tsconfig.json sets experimentalDecorators, but Vite's oxc transform does
-  // not reliably honor it through the SvelteKit `extends
-  // "./.svelte-kit/tsconfig.json"` chain — raw `@decorator class` syntax then
-  // reaches the SSR runtime and throws `SyntaxError: Invalid or unexpected
-  // token` on the first request.
-  oxc: {
-    decorator: {
-      legacy: true,
-      emitDecoratorMetadata: true,
-    },
-  },
-  plugins: [
-    sveltekit(),
-    // Only packages whose object manifests this app consumes belong here.
-    // Keeping the list explicit avoids treating tooling/UI packages as domain
-    // model providers and makes generated runtime registration deterministic.
-    smrtConsumer({
-      packages: [
-        '@happyvertical/smrt-profiles',
-        '@happyvertical/smrt-tenancy',
-        '@happyvertical/smrt-users',
-      ],
-      generateTypes: true,
-      typesDir: 'src/lib/types/smrt-generated',
-      svelteKit: true,
-    }),
-    smrtPlugin({
-      include: ['src/lib/objects/**/*.ts'],
-      exclude: ['**/*.test.ts', '**/*.spec.ts'],
-      generateTypes: true,
-      typeDeclarationsPath: 'src/lib/types/smrt-generated',
-      svelteKit: {
-        enabled: true,
-        routesDir: 'src/routes/api',
-        objectsDir: 'src/lib/objects',
-        configPath: 'src/lib/server',
-        configFileName: 'smrt.ts',
-      },
-    }),
-  ],
+  plugins: [sveltekit(), smrt()],
 });

package/template.config.js

@@ -19,22 +19,22 @@ export default {
 
   // Dependencies to add to generated project
   dependencies: {
-    '@happyvertical/smrt-app-runtime': '^0.53.3',
-    '@happyvertical/smrt-config': '^0.53.3',
-    '@happyvertical/smrt-core': '^0.53.3',
-    '@happyvertical/smrt-jobs': '^0.53.3',
-    '@happyvertical/smrt-profiles': '^0.53.3',
-    '@happyvertical/smrt-svelte': '^0.53.3',
-    '@happyvertical/smrt-tenancy': '^0.53.3',
-    '@happyvertical/smrt-ui': '^0.53.3',
-    '@happyvertical/smrt-users': '^0.53.3',
-    '@happyvertical/smrt-web': '^0.53.3',
+    '@happyvertical/smrt-app-runtime': '^0.53.5',
+    '@happyvertical/smrt-config': '^0.53.5',
+    '@happyvertical/smrt-core': '^0.53.5',
+    '@happyvertical/smrt-jobs': '^0.53.5',
+    '@happyvertical/smrt-profiles': '^0.53.5',
+    '@happyvertical/smrt-svelte': '^0.53.5',
+    '@happyvertical/smrt-tenancy': '^0.53.5',
+    '@happyvertical/smrt-ui': '^0.53.5',
+    '@happyvertical/smrt-users': '^0.53.5',
+    '@happyvertical/smrt-web': '^0.53.5',
     '@happyvertical/sql': '^0.89.12',
     '@modelcontextprotocol/server': '^2.0.0',
   },
 
   devDependencies: {
-    '@happyvertical/smrt-cli': '^0.53.3',
+    '@happyvertical/smrt-cli': '^0.53.5',
     '@sveltejs/adapter-node': '^5.5.7',
     '@sveltejs/kit': '2.70.3',
     '@sveltejs/vite-plugin-svelte': '^7.3.0',

package/mcp-apps-template/src/lib/McpAppsBridge.svelte

@@ -1,37 +0,0 @@
-<script lang="ts">
-  import { requestOpenAiDisplayMode } from '@happyvertical/smrt-mcp-openai/client';
-  import { useMcpApp } from '@happyvertical/smrt-svelte/mcp-apps';
-
-  interface Props {
-    /** Exact, application-configured host origin. Never derive this from URL input. */
-    hostOrigin: string;
-  }
-
-  let { hostOrigin }: Props = $props();
-  let expandUnavailable = $state(false);
-  const app = useMcpApp(() => ({
-    appInfo: { name: 'smrt-app', version: '0.1.0' },
-    availableDisplayModes: ['inline', 'fullscreen'],
-    hostOrigin,
-    hostWindow: parent,
-  }));
-
-  async function expand() {
-    try {
-      if (!app.bridge) throw new Error('Host bridge unavailable');
-      await requestOpenAiDisplayMode(app.bridge, 'fullscreen');
-    } catch {
-      expandUnavailable = true;
-    }
-  }
-</script>
-
-<section aria-labelledby="mcp-apps-title" class="mcp-apps-bridge">
-  <h1 id="mcp-apps-title">Items</h1>
-  <p>Use this view to review the items your signed-in tenant authorizes.</p>
-  {#if app.error || expandUnavailable}
-    <p role="status">Host controls are unavailable; this view remains inline.</p>
-  {:else}
-    <button type="button" onclick={expand}>Expand view</button>
-  {/if}
-</section>

package/mcp-apps-template/src/lib/server/mcp-hosted-principal.ts

@@ -1,12 +0,0 @@
-import type { McpVerifiedIdentity, McpPrincipalMapping } from '@happyvertical/smrt-app-mcp/auth';
-
-/**
- * Deployments must replace this binding with a database-backed current-account
- * and active-membership lookup. Token claims never select a tenant.
- */
-export type HostedMcpPrincipalResolver = (
-  identity: McpVerifiedIdentity,
-) => Promise<McpPrincipalMapping | null>;
-
-export const resolveHostedMcpPrincipal: HostedMcpPrincipalResolver | undefined =
-  undefined;

package/mcp-apps-template/src/lib/server/mcp-hosted.ts

@@ -1,28 +0,0 @@
-import { createMcpResourceAuth } from '@happyvertical/smrt-app-mcp/auth';
-import { applicationRuntime } from './application-runtime.js';
-import { resolveHostedMcpPrincipal } from './mcp-hosted-principal.js';
-
-function required(name: string): string {
-  const value = process.env[name]?.trim();
-  if (!value) throw new Error(`Hosted MCP requires ${name}.`);
-  return value;
-}
-
-let cachedAuth: ReturnType<typeof createMcpResourceAuth> | undefined;
-
-export function hostedMcpAuth() {
-  if (applicationRuntime.profile === 'local') return null;
-  if (cachedAuth) return cachedAuth;
-  if (!resolveHostedMcpPrincipal)
-    throw new Error('Hosted MCP requires an application-owned resolveHostedMcpPrincipal binding.');
-  cachedAuth = createMcpResourceAuth({
-    profile: applicationRuntime.profile,
-    resource: required('SMRT_MCP_RESOURCE'),
-    issuer: required('SMRT_MCP_ISSUER'),
-    jwksUri: required('SMRT_MCP_JWKS_URI'),
-    scopes: required('SMRT_MCP_SCOPES').split(/\s+/u),
-    algorithms: ['RS256'],
-    resolvePrincipal: resolveHostedMcpPrincipal,
-  });
-  return cachedAuth;
-}