@happyvertical/smrt-template-sveltekit 0.53.3 → 0.54.0

package/template/src/lib/runtime-diagnostics-webmcp.ts

@@ -1,108 +0,0 @@
-export const RUNTIME_DIAGNOSTICS_WEBMCP_TOOL_NAME =
-  'smrt.runtime.diagnostics.read';
-
-interface RuntimeDiagnosticsTool {
-  readonly name: string;
-  readonly description: string;
-  readonly inputSchema: Record<string, unknown>;
-  readonly annotations: {
-    readonly readOnlyHint: true;
-    readonly destructiveHint: false;
-    readonly idempotentHint: true;
-    readonly openWorldHint: false;
-  };
-  readonly execute: (args: Record<string, unknown>) => Promise<string>;
-}
-
-interface RuntimeDiagnosticsModelContext {
-  registerTool(
-    tool: RuntimeDiagnosticsTool,
-    options: { signal: AbortSignal },
-  ): void | Promise<void>;
-}
-
-export interface RuntimeDiagnosticsWebMcpOwner {
-  readonly dispose: () => void;
-}
-
-export interface RegisterRuntimeDiagnosticsWebMcpOptions {
-  readonly fetchFn?: typeof fetch;
-  readonly modelContext?: RuntimeDiagnosticsModelContext;
-}
-
-/** Register exactly one page-user, read-only diagnostics tool for its owner. */
-export function registerRuntimeDiagnosticsWebMcp(
-  options: RegisterRuntimeDiagnosticsWebMcpOptions = {},
-): RuntimeDiagnosticsWebMcpOwner | null {
-  const modelContext =
-    options.modelContext ??
-    (globalThis as {
-      document?: { modelContext?: RuntimeDiagnosticsModelContext };
-    }).document?.modelContext;
-  if (!modelContext || typeof modelContext.registerTool !== 'function') {
-    return null;
-  }
-
-  const controller = new AbortController();
-  const tool = createRuntimeDiagnosticsWebMcpTool(options.fetchFn ?? fetch);
-  try {
-    const registration = modelContext.registerTool(tool, {
-      signal: controller.signal,
-    });
-    void Promise.resolve(registration).catch(() => controller.abort());
-  } catch {
-    controller.abort();
-  }
-  return Object.freeze({ dispose: () => controller.abort() });
-}
-
-export function createRuntimeDiagnosticsWebMcpTool(
-  fetchFn: typeof fetch,
-): RuntimeDiagnosticsTool {
-  return Object.freeze({
-    name: RUNTIME_DIAGNOSTICS_WEBMCP_TOOL_NAME,
-    description:
-      'Read the authenticated, redacted application runtime diagnostics.',
-    inputSchema: Object.freeze({
-      type: 'object',
-      properties: Object.freeze({}),
-      additionalProperties: false,
-    }),
-    annotations: Object.freeze({
-      readOnlyHint: true as const,
-      destructiveHint: false as const,
-      idempotentHint: true as const,
-      openWorldHint: false as const,
-    }),
-    async execute() {
-      let response: Response;
-      try {
-        response = await fetchFn('/api/_runtime/diagnostics', {
-          method: 'GET',
-          credentials: 'same-origin',
-          headers: { accept: 'application/json' },
-        });
-      } catch {
-        return stableToolError('diagnostics_unavailable');
-      }
-      if (!response.ok) {
-        return stableToolError(
-          response.status === 401
-            ? 'authentication_required'
-            : response.status === 403
-              ? 'authorization_denied'
-              : 'diagnostics_unavailable',
-        );
-      }
-      try {
-        return JSON.stringify(await response.json());
-      } catch {
-        return stableToolError('diagnostics_unavailable');
-      }
-    },
-  });
-}
-
-function stableToolError(code: string): string {
-  return JSON.stringify({ ok: false, error: { code } });
-}

package/template/src/lib/server/application-runtime.ts

@@ -1,262 +0,0 @@
-import {
-  initializeDeployedApplicationRuntime,
-  initializeLocalApplicationRuntime,
-  projectRuntimeDiagnostics,
-  resolveLocalRuntimePaths,
-  type LocalApplicationRuntime,
-  type RuntimeDiagnostics,
-  type RuntimeDiagnosticsProjectionInput,
-} from '@happyvertical/smrt-app-runtime';
-import {
-  loadConfig,
-  resolveApplicationRuntime,
-  resolveConfiguredApplicationRuntime,
-} from '@happyvertical/smrt-config';
-import type { SmrtClassOptions } from '@happyvertical/smrt-core';
-import { getDatabase } from '@happyvertical/sql';
-import {
-  prepareApplicationStateRoot,
-  resolveApplicationId,
-  runtimeConfigurationFingerprint,
-} from '../../../scripts/smrt-runtime-identity.mjs';
-import { acquireWriterLease } from '../../../scripts/smrt-writer-lease.mjs';
-import { createProviderReadinessProbe } from '../../../scripts/smrt-provider-readiness.mjs';
-
-const loadedConfig = await loadConfig();
-
-export const applicationRuntime = loadedConfig.runtime
-  ? resolveConfiguredApplicationRuntime()
-  : resolveApplicationRuntime({ profile: 'local' });
-const appId = resolveApplicationId({
-  sourceRoot: process.cwd(),
-  explicitId: process.env.SMRT_APP_ID,
-});
-
-export const applicationRuntimeConfiguration = runtimeConfigurationFingerprint(
-  applicationRuntime,
-  process.env,
-);
-
-export function getApplicationDatabaseConfig(): SmrtClassOptions['db'] {
-  if (applicationRuntime.profile === 'local') {
-    const paths = resolveLocalRuntimePaths({
-      appId,
-      dataDirectory: process.env.SMRT_DATA_DIR,
-      sourceRoot: process.cwd(),
-    });
-    return { type: 'sqlite', url: paths.database };
-  }
-  const databaseUrl = process.env.DATABASE_URL;
-  if (!databaseUrl) {
-    throw new Error(`${applicationRuntime.profile} requires DATABASE_URL.`);
-  }
-  return { type: 'postgres', url: databaseUrl };
-}
-
-let localRuntimePromise: Promise<LocalApplicationRuntime> | undefined;
-let localWriterLease: { release(): void } | undefined;
-let deployedRuntimePromise: ReturnType<
-  typeof initializeDeployedApplicationRuntime
-> | undefined;
-
-/** Fail-closed startup gate for every deployed web process. */
-export async function ensureApplicationRuntimeReady(): Promise<void> {
-  if (applicationRuntime.profile === 'local') {
-    await getLocalApplicationRuntime();
-    return;
-  }
-  const databaseUrl = process.env.DATABASE_URL;
-  if (!databaseUrl) {
-    throw new Error(`${applicationRuntime.profile} requires DATABASE_URL.`);
-  }
-  const authenticationProvider =
-    applicationRuntime.providers.authentication.provider;
-  if (authenticationProvider === 'owner-bootstrap') {
-    throw new Error('Deployed profiles require public authentication.');
-  }
-  deployedRuntimePromise ??= initializeDeployedApplicationRuntime({
-    profile: applicationRuntime.profile,
-    providers: {
-      database: applicationRuntime.providers.database,
-      authentication: applicationRuntime.providers.authentication,
-      tenancy: applicationRuntime.providers.tenancy,
-      assets: applicationRuntime.providers.assets,
-      secrets: applicationRuntime.providers.secrets,
-      jobs: applicationRuntime.providers.jobs,
-      network: applicationRuntime.providers.network,
-    },
-    database: {
-      engine: 'postgres',
-      connect: () => getDatabase({ type: 'postgres', url: databaseUrl }),
-      close: async (db) => db.close?.(),
-    },
-    authentication: {
-      provider: authenticationProvider,
-      readiness: createProviderReadinessProbe('authentication', {
-        profile: applicationRuntime.profile,
-        provider: authenticationProvider,
-      }),
-    },
-    assets: {
-      provider: applicationRuntime.providers.assets.provider,
-      readiness: createProviderReadinessProbe('assets', {
-        profile: applicationRuntime.profile,
-        provider: applicationRuntime.providers.assets.provider,
-      }),
-    },
-    secrets: {
-      provider: applicationRuntime.providers.secrets.provider,
-      readiness: createProviderReadinessProbe('secrets', {
-        profile: applicationRuntime.profile,
-        provider: applicationRuntime.providers.secrets.provider,
-      }),
-    },
-  });
-  await deployedRuntimePromise;
-}
-
-/** Local onboarding runtime. Deployed authentication belongs to its provider. */
-export function getLocalApplicationRuntime(): Promise<LocalApplicationRuntime> {
-  if (applicationRuntime.profile !== 'local') {
-    throw new Error('Owner bootstrap is available only in the local profile.');
-  }
-  const bindHost =
-    process.env.HOST ||
-    (process.env.NODE_ENV === 'development' ? '127.0.0.1' : null);
-  if (!bindHost) {
-    throw new Error(
-      'Local production startup requires an explicit loopback HOST; use pnpm app:start.',
-    );
-  }
-  localWriterLease ??= acquireWriterLease(
-    prepareApplicationStateRoot({
-      appId,
-      dataDirectory: process.env.SMRT_DATA_DIR,
-      sourceRoot: process.cwd(),
-    }),
-    { operationInstance: process.env.SMRT_OPERATION_INSTANCE },
-  );
-  localRuntimePromise ??= initializeLocalApplicationRuntime({
-    appId,
-    dataDirectory: process.env.SMRT_DATA_DIR,
-    sourceRoot: process.cwd(),
-    bindHost,
-    providers: {
-      database: applicationRuntime.providers.database,
-      authentication: applicationRuntime.providers.authentication,
-      tenancy: applicationRuntime.providers.tenancy,
-      assets: applicationRuntime.providers.assets,
-      secrets: applicationRuntime.providers.secrets,
-      jobs: applicationRuntime.providers.jobs,
-      network: applicationRuntime.providers.network,
-    },
-    backgroundJobs: process.env.SMRT_BACKGROUND_JOBS === 'true',
-  })
-    .then(({ runtime }) => runtime)
-    .catch((error) => {
-      localWriterLease?.release();
-      localWriterLease = undefined;
-      localRuntimePromise = undefined;
-      throw error;
-    });
-  return localRuntimePromise;
-}
-
-export interface ApplicationRuntimeDiagnosticsOptions {
-  readonly toolNames: readonly string[];
-  readonly observedAt: Date;
-  /** Application-owned schema verification seam; runtime liveness is not proof. */
-  readonly schemaStatus?: 'not-ready' | 'ready' | 'unknown';
-  /** Application-owned migration tracker seam; database liveness is not proof. */
-  readonly migrationStatus?: 'current' | 'failed' | 'pending' | 'unknown';
-  /** Bounded worker seam supplied by the deployment's lease/heartbeat adapter. */
-  readonly workerHeartbeatAt?: Date | string | null;
-  /** Stable code/timestamp pairs only; raw errors never cross this seam. */
-  readonly recentErrors?: readonly {
-    readonly code?: unknown;
-    readonly at?: unknown;
-  }[];
-}
-
-/**
- * Read the private runtime only after the route has authenticated and
- * authorized its caller, then immediately project onto the public allowlist.
- */
-export async function readApplicationRuntimeDiagnostics(
-  options: ApplicationRuntimeDiagnosticsOptions,
-): Promise<RuntimeDiagnostics> {
-  await ensureApplicationRuntimeReady();
-
-  if (applicationRuntime.profile === 'local') {
-    const runtime = await getLocalApplicationRuntime();
-    const diagnostics = await runtime.diagnostics();
-    return projectRuntimeDiagnostics({
-      profile: 'local',
-      health: 'healthy',
-      schema: {
-        status: options.schemaStatus ?? 'unknown',
-        migrations: options.migrationStatus ?? 'unknown',
-      },
-      capabilities: {
-        'asset-storage': 'available',
-        authentication: 'available',
-        'background-jobs': diagnostics.jobs.backgroundEnabled
-          ? 'available'
-          : 'disabled',
-        database: 'available',
-        'paid-capabilities': diagnostics.paidCapabilitiesEnabled
-          ? 'available'
-          : 'disabled',
-        'secret-storage': 'available',
-      },
-      toolNames: options.toolNames,
-      worker: {
-        topology: diagnostics.jobs.topology,
-        required: diagnostics.jobs.backgroundEnabled,
-        heartbeatAt: options.workerHeartbeatAt,
-      },
-      recentErrors: options.recentErrors,
-      observedAt: options.observedAt,
-    });
-  }
-
-  const runtime = await deployedRuntimePromise;
-  if (!runtime) throw new Error('deployed_runtime_unavailable');
-  const readiness = await runtime.readiness();
-  const componentStatus = (
-    component: keyof typeof readiness.components,
-  ): 'available' | 'unavailable' =>
-    readiness.components[component].status === 'ready'
-      ? 'available'
-      : 'unavailable';
-  const input: RuntimeDiagnosticsProjectionInput = {
-    profile: applicationRuntime.profile,
-    health:
-      runtime.health().status === 'healthy'
-        ? readiness.status === 'ready'
-          ? 'healthy'
-          : 'degraded'
-        : 'stopped',
-    schema: {
-      status: options.schemaStatus ?? 'unknown',
-      migrations: options.migrationStatus ?? 'unknown',
-    },
-    capabilities: {
-      'asset-storage': componentStatus('assets'),
-      authentication: componentStatus('authentication'),
-      'background-jobs': 'available',
-      database: componentStatus('database'),
-      'paid-capabilities': 'unknown',
-      'secret-storage': componentStatus('secrets'),
-    },
-    toolNames: options.toolNames,
-    worker: {
-      topology: runtime.resolvedRuntime.providers.jobs.topology,
-      required: true,
-      heartbeatAt: options.workerHeartbeatAt,
-    },
-    recentErrors: options.recentErrors,
-    observedAt: options.observedAt,
-  };
-  return projectRuntimeDiagnostics(input);
-}

package/template/src/lib/server/runtime-diagnostics.ts

@@ -1,114 +0,0 @@
-import type { RuntimeDiagnostics } from '@happyvertical/smrt-app-runtime';
-import type { Role } from '@happyvertical/smrt-users';
-import { webMcpToolDefinitions } from '@happyvertical/smrt-virt-web';
-import { json } from '@sveltejs/kit';
-
-import { getCollection } from './smrt.js';
-import { readApplicationRuntimeDiagnostics } from './application-runtime.js';
-import { RUNTIME_DIAGNOSTICS_WEBMCP_TOOL_NAME } from '../runtime-diagnostics-webmcp.js';
-
-export const RUNTIME_DIAGNOSTICS_READ_PERMISSION = 'runtime_diagnostics.read';
-
-interface DiagnosticsLocals {
-  readonly user?: { readonly id?: unknown } | null;
-  readonly membership?: {
-    readonly userId?: unknown;
-    readonly tenantId?: unknown;
-    readonly roleId?: unknown;
-    isActive?: () => boolean;
-  } | null;
-  readonly permissions?: readonly string[];
-  readonly tenantId?: unknown;
-  readonly sessionId?: unknown;
-}
-
-interface RuntimeDiagnosticsHandlerOptions {
-  readonly resolveRoleSlug: (roleId: string) => Promise<string | null>;
-  readonly readDiagnostics: () => Promise<RuntimeDiagnostics>;
-}
-
-/** Testable route boundary: authorization always completes before projection. */
-export function createRuntimeDiagnosticsGet(
-  options: RuntimeDiagnosticsHandlerOptions,
-) {
-  return async ({ locals }: { locals: DiagnosticsLocals }) => {
-    const principal = authenticatedPrincipal(locals);
-    if (!principal) {
-      return stableError(401, 'authentication_required');
-    }
-
-    let authorized =
-      locals.permissions?.includes(RUNTIME_DIAGNOSTICS_READ_PERMISSION) === true;
-    if (!authorized) {
-      try {
-        authorized = (await options.resolveRoleSlug(principal.roleId)) === 'owner';
-      } catch {
-        authorized = false;
-      }
-    }
-    if (!authorized) return stableError(403, 'authorization_denied');
-
-    try {
-      return json(await options.readDiagnostics());
-    } catch {
-      return stableError(503, 'diagnostics_unavailable');
-    }
-  };
-}
-
-export const runtimeDiagnosticsGet = createRuntimeDiagnosticsGet({
-  async resolveRoleSlug(roleId) {
-    const roles = await getCollection<Role>('Role');
-    return (await roles.findById(roleId))?.slug ?? null;
-  },
-  readDiagnostics: () =>
-    readApplicationRuntimeDiagnostics({
-      toolNames: [
-        ...webMcpToolDefinitions.map((definition) => definition.name),
-        RUNTIME_DIAGNOSTICS_WEBMCP_TOOL_NAME,
-      ],
-      observedAt: new Date(),
-      // Install application migration/schema verifiers here. Process/database
-      // liveness alone intentionally leaves both values `unknown`.
-      schemaStatus: 'unknown',
-      migrationStatus: 'unknown',
-      // External deployments install their lease-backed heartbeat adapter here.
-      // Missing data remains `unknown`; web-process liveness is never substituted.
-      workerHeartbeatAt: null,
-      recentErrors: [],
-    }),
-});
-
-function authenticatedPrincipal(locals: DiagnosticsLocals): {
-  roleId: string;
-} | null {
-  const userId = locals.user?.id;
-  const tenantId = locals.tenantId;
-  const sessionId = locals.sessionId;
-  const membership = locals.membership;
-  if (
-    typeof userId !== 'string' ||
-    !userId ||
-    typeof tenantId !== 'string' ||
-    !tenantId ||
-    typeof sessionId !== 'string' ||
-    !sessionId ||
-    !membership ||
-    membership.userId !== userId ||
-    membership.tenantId !== tenantId ||
-    typeof membership.roleId !== 'string' ||
-    !membership.roleId
-  ) {
-    return null;
-  }
-  try {
-    if (membership.isActive?.() !== true) return null;
-  } catch {
-    return null;
-  }
-  return { roleId: membership.roleId };
-}
-
-function stableError(status: number, code: string) {
-  return json({ schemaVersion: 1, error: { code } }, { status });
-}

package/template/src/lib/server/tenancy.ts

@@ -1,114 +0,0 @@
-/**
- * Tenant selection for SvelteKit requests.
- *
- * Selection and authorization are deliberately separate:
- *
- * - this module maps a trusted URL shape (the leading subdomain) to an active
- *   tenant record;
- * - `createSessionHandler({ enterTenantContext: true })` authorizes the signed-
- *   in user's active membership and establishes the request tenant context.
- *
- * A selected tenant is useful for login and membership-gated switch flows, but
- * it never becomes ambient query authority by itself. In particular, this
- * resolver ignores client-provided tenant headers.
- */
-
-import {
-  TenantCollection,
-  TenantStatus,
-} from '@happyvertical/smrt-users';
-
-import { getSmrtConfig } from './smrt.js';
-
-export interface TenantResolverEvent {
-  url: URL;
-  request: { headers: Headers };
-}
-
-export interface TenantSelection {
-  /** Database UUID for an active tenant, or null when none resolves. */
-  tenantId: string | null;
-  /** URL-derived slug. Informational until membership authorizes a switch. */
-  tenantSlug: string | null;
-}
-
-const ROOT_LIKE_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
-const RESERVED_SUBDOMAINS = new Set(['www', 'api', 'app', 'admin']);
-
-/**
- * Pure URL parser used by the default resolver.
- *
- * Set `TENANT_BASE_DOMAIN` in production so multi-label public suffixes are
- * never guessed. Without it, the fallback is intended only for local domains
- * such as `acme.demo.local`.
- */
-export function selectTenantSlug(
-  url: URL,
-  baseDomain = process.env.TENANT_BASE_DOMAIN,
-): string | null {
-  const hostname = url.hostname.toLowerCase();
-  if (
-    ROOT_LIKE_HOSTS.has(hostname) ||
-    /^\d{1,3}(\.\d{1,3}){3}$/.test(hostname)
-  ) {
-    return null;
-  }
-
-  const normalizedBase = baseDomain
-    ?.trim()
-    .toLowerCase()
-    .replace(/^\.+|\.+$/g, '');
-
-  let candidate: string | undefined;
-  if (normalizedBase) {
-    if (hostname === normalizedBase) return null;
-    const suffix = `.${normalizedBase}`;
-    if (!hostname.endsWith(suffix)) return null;
-    candidate = hostname.slice(0, -suffix.length).split('.')[0];
-  } else {
-    const labels = hostname.split('.');
-    if (labels.length < 3) return null;
-    candidate = labels[0];
-  }
-
-  return candidate && !RESERVED_SUBDOMAINS.has(candidate) ? candidate : null;
-}
-
-function isMissingTenantTable(error: unknown): boolean {
-  if (!(error instanceof Error)) return false;
-  const code = (error as Error & { code?: string }).code;
-  return (
-    code === '42P01' ||
-    error.message.includes('relation "tenants" does not exist') ||
-    error.message.includes('no such table: tenants')
-  );
-}
-
-async function findActiveTenantId(slug: string): Promise<string | null> {
-  try {
-    const tenants = await TenantCollection.create(getSmrtConfig('Tenant'));
-    const tenant = await tenants.findBySlug(slug);
-    return tenant?.status === TenantStatus.ACTIVE ? (tenant.id ?? null) : null;
-  } catch (error) {
-    // A fresh project can render before its first `pnpm db:migrate`.
-    if (isMissingTenantTable(error)) return null;
-    throw error;
-  }
-}
-
-/**
- * Default selection extension point. Replace this function when your tenant
- * key comes from a path, signed cookie, or trusted gateway assertion. Preserve
- * the rule that selection alone does not establish authorization context.
- */
-export async function resolveTenant(
-  event: TenantResolverEvent,
-): Promise<TenantSelection> {
-  const tenantSlug = selectTenantSlug(event.url);
-  if (!tenantSlug) return { tenantId: null, tenantSlug: null };
-
-  return {
-    tenantId: await findActiveTenantId(tenantSlug),
-    tenantSlug,
-  };
-}

package/template/src/smrt-webmcp.d.ts

@@ -1,6 +0,0 @@
-// `smrtPlugin` supplies the runtime virtual module during Vite builds. Keep
-// source-first `svelte-check` useful before that build has emitted its ambient
-// declaration, while preserving the generated shape when the plugin runs.
-declare module '@happyvertical/smrt-virt-web' {
-  export const webMcpToolDefinitions: readonly import('@happyvertical/smrt-web').WebMcpToolDefinition[];
-}