@happyvertical/smrt-template-sveltekit 0.53.4 → 0.53.5

package/AGENTS.md

@@ -22,11 +22,17 @@ It is the ground-up alternative to `smrt-saas-starter`.
   Never reintroduce copied operator scripts: fix the CLI command instead.
 - Server composition is `createSmrtSvelteKitRuntime()` from
   `@happyvertical/smrt-app-runtime/sveltekit`, built once in
-  `src/lib/server/smrt.ts` with the writer lease
-  (`acquireWriterLease(prepareApplicationStateRoot(...))`) and provider
-  readiness (`createProviderReadinessProbe`) from app-runtime's root entry, so
-  the web process never imports the CLI. Health, diagnostics, layout session,
-  and owner setup routes mount that package's handlers.
+  `src/lib/server/smrt.ts`, which holds only `runtime` and its options
+  (provider readiness via `createProviderReadinessProbe`), so the web process
+  never imports the CLI. The runtime takes the local writer lease by default,
+  the `smrt()` plugin injects the generated registration, and each generated
+  route embeds a prelude that imports `$lib/server/smrt` and resolves
+  collections through its exported `runtime.getCollection()` (#3416). A legacy
+  `getCollection`/`getSmrtConfig` export would take precedence (deprecated,
+  honoured for one release): never re-add one, a register import, guard, or
+  manifest hydration.
+  Health, diagnostics, layout session, and owner setup routes mount that
+  package's handlers.
 - The production baseline uses adapter-node with separate web, task-worker, and
   schedule-worker processes. Workers import the build-compiled
   `.smrt/runtime/register.js` (#3117) before creating runners so app-defined
@@ -74,9 +80,7 @@ It is the ground-up alternative to `smrt-saas-starter`.
 - `src/hooks.server.ts` re-exports the runtime's `handle`/`init`: URL tenant
   selection stays a separate candidate and only the verified session
   establishes tenant context. Never turn an untrusted header into authority.
-- `src/lib/server/smrt.ts` imports generated local registrations, loads the
-  generated manifest metadata, creates the runtime, and exposes
-  `getCollection()`/`getSmrtConfig()` over `runtime.classOptions()`, which is
+- App code uses `runtime.getCollection()`/`runtime.classOptions()`, which are
   request-scoped (RLS transaction) and must never be retained.
 - `Item` is the single example object and demonstrates optional tenant scope,
   a REST writable allowlist, shared CRUD action metadata, and the explicit
@@ -100,10 +104,12 @@ It is the ground-up alternative to `smrt-saas-starter`.
   (`createRuntimeDiagnosticsHandler`) requires a direct active tenant membership
   plus the owner role or `runtime_diagnostics.read` before any projection or
   probe; it never calls principal-bound server tools.
-- The opt-in `mcp-apps-template/` overlay is one `mountMcpAppRoute()` route,
-  the protected-resource metadata route, and the application-owned
-  `mcp-hosted-principal.ts` binding; `pnpm typecheck` checks it against the
-  template.
+- The opt-in `mcp-apps-template/` overlay is one `mountMcpAppRoute()` route
+  and the protected-resource metadata route, both using
+  `createHostedMcpResourceAuth({ profile, runtime })` (local owner tokens,
+  hosted membership-backed principals); `pnpm typecheck` checks it against
+  the template. `__tests__/localMcpToken.test.ts` proves mint → real
+  `smrt-mcp-bridge` stdio → route against the real runtime.
 
 ## Tests
 

package/README.md

@@ -53,7 +53,7 @@ fixtures.
 ## 2. Understand the generated files
 
 The checked-in template contains authored objects, one server module
-(`src/lib/server/smrt.ts`, the runtime and collection access), thin hooks and
+(`src/lib/server/smrt.ts`, the runtime and its options), thin hooks and
 routes that mount package handlers, pages, and configuration. It ships no
 operator scripts. Vite generates `.smrt/manifest.json`,
 `.smrt/smrt-knowledge.json`, `.smrt/register.js`,

package/mcp-apps-template/package.dependencies.json

@@ -1,4 +1,4 @@
 {
-  "@happyvertical/smrt-app-mcp": "^0.53.4",
-  "@happyvertical/smrt-mcp-openai": "^0.53.4"
+  "@happyvertical/smrt-app-mcp": "^0.53.5",
+  "@happyvertical/smrt-mcp-openai": "^0.53.5"
 }

package/mcp-apps-template/src/routes/.well-known/oauth-protected-resource/api/mcp/+server.ts

@@ -1,15 +1,11 @@
 import { createHostedMcpResourceAuth } from '@happyvertical/smrt-app-mcp/auth';
 import { mountMcpProtectedResourceMetadataRoute } from '@happyvertical/smrt-app-mcp/sveltekit';
 
-import { resolveHostedMcpPrincipal } from '$lib/server/mcp-hosted-principal';
 import { runtime } from '$lib/server/smrt';
 
 const { profile } = await runtime.resolvedRuntime();
 
 /** RFC 9728 metadata at exactly the URL hosted bearer challenges advertise (404 locally). */
 export const GET = mountMcpProtectedResourceMetadataRoute(
-  createHostedMcpResourceAuth({
-    profile,
-    resolvePrincipal: resolveHostedMcpPrincipal,
-  }),
+  createHostedMcpResourceAuth({ profile, runtime }),
 );

package/mcp-apps-template/src/routes/api/mcp/+server.ts

@@ -4,7 +4,6 @@ import { mountMcpAppRoute } from '@happyvertical/smrt-app-mcp/sveltekit';
 import { openAiDisplayMetadata, withOpenAiEntrypoints } from '@happyvertical/smrt-mcp-openai';
 
 import { Item } from '$lib/objects/Item';
-import { resolveHostedMcpPrincipal } from '$lib/server/mcp-hosted-principal';
 import { runtime } from '$lib/server/smrt';
 
 const ITEM_RESOURCE_URI = 'ui://smrt-app/v1/items.html';
@@ -41,22 +40,22 @@ const { profile } = await runtime.resolvedRuntime();
 /**
  * Stateless SDK-v2 Streamable HTTP MCP endpoint for this app's own `Item`.
  * Locally the principal is the signed session (user, authorized tenant, and
- * permission slugs); hosted profiles verify a bearer token and map it through
- * the application-owned `resolveHostedMcpPrincipal`, and the verified bearer
- * principal is bound into the request permission context (under
- * `database-rls`, its own RLS transaction). Every principal needs
- * `items.read`, so only read-only tools are published until per-operation
- * authorization exists; browser requests from a foreign `Origin` are refused.
+ * permission slugs), or an owner-minted bearer token from `smrt app token`
+ * for a local MCP client such as the `smrt-mcp-bridge` stdio bridge. Hosted
+ * profiles verify a bearer access token and map it through the runtime's
+ * membership-backed `resolveMcpPrincipal` (pass `resolvePrincipal` to
+ * override it). A bearer principal is bound into the request permission
+ * context (under `database-rls`, its own RLS transaction) with its scopes
+ * capped to live permissions. Every principal needs `items.read`, so only
+ * read-only tools are published until per-operation authorization exists;
+ * browser requests from a foreign `Origin` are refused.
  */
 export const POST = mountMcpAppRoute({
   models: [Item],
   requiredScopes: ['items.read'],
   effects: ['read'],
   smrtOptions: () => ({ db: runtime.databaseConfig() }),
-  auth: createHostedMcpResourceAuth({
-    profile,
-    resolvePrincipal: resolveHostedMcpPrincipal,
-  }),
+  auth: createHostedMcpResourceAuth({ profile, runtime }),
   bindPrincipal: runtime.runAsPrincipal,
   workflowTools: [itemsOverview],
   resources: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-template-sveltekit",
-  "version": "0.53.4",
+  "version": "0.53.5",
   "description": "Minimal SvelteKit project template with s-m-r-t framework integration",
   "type": "module",
   "main": "index.js",
@@ -32,25 +32,27 @@
     "directory": "packages/template-sveltekit"
   },
   "peerDependencies": {
-    "@happyvertical/smrt-core": "0.53.4"
+    "@happyvertical/smrt-core": "0.53.5"
   },
   "devDependencies": {
-    "@happyvertical/smrt-app-mcp": "0.53.4",
-    "@happyvertical/smrt-app-runtime": "0.53.4",
-    "@happyvertical/smrt-assets": "0.53.4",
-    "@happyvertical/smrt-cli": "0.53.4",
-    "@happyvertical/smrt-config": "0.53.4",
-    "@happyvertical/smrt-jobs": "0.53.4",
-    "@happyvertical/smrt-mcp-openai": "0.53.4",
-    "@happyvertical/smrt-playbooks": "0.53.4",
-    "@happyvertical/smrt-profiles": "0.53.4",
-    "@happyvertical/smrt-scanner": "0.53.4",
-    "@happyvertical/smrt-svelte": "0.53.4",
-    "@happyvertical/smrt-tenancy": "0.53.4",
-    "@happyvertical/smrt-ui": "0.53.4",
-    "@happyvertical/smrt-users": "0.53.4",
-    "@happyvertical/smrt-web": "0.53.4",
+    "@happyvertical/smrt-app-cli": "0.53.5",
+    "@happyvertical/smrt-app-mcp": "0.53.5",
+    "@happyvertical/smrt-app-runtime": "0.53.5",
+    "@happyvertical/smrt-assets": "0.53.5",
+    "@happyvertical/smrt-cli": "0.53.5",
+    "@happyvertical/smrt-config": "0.53.5",
+    "@happyvertical/smrt-jobs": "0.53.5",
+    "@happyvertical/smrt-mcp-openai": "0.53.5",
+    "@happyvertical/smrt-playbooks": "0.53.5",
+    "@happyvertical/smrt-profiles": "0.53.5",
+    "@happyvertical/smrt-scanner": "0.53.5",
+    "@happyvertical/smrt-svelte": "0.53.5",
+    "@happyvertical/smrt-tenancy": "0.53.5",
+    "@happyvertical/smrt-ui": "0.53.5",
+    "@happyvertical/smrt-users": "0.53.5",
+    "@happyvertical/smrt-web": "0.53.5",
     "@happyvertical/sql": "^0.89.12",
+    "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "@playwright/test": "^1.63.0",
     "@sveltejs/adapter-node": "^5.5.7",

package/template/AGENTS.md

@@ -24,10 +24,14 @@ tools, WebMCP definitions, and agent/developer knowledge artifacts.
 - Server composition (profile, storage custody, owner bootstrap, tenant
   selection, session, health, diagnostics) comes from
   `@happyvertical/smrt-app-runtime/sveltekit`, configured once in
-  `src/lib/server/smrt.ts`. Pass app-specific behaviour as options
-  (`selectTenant`, `classOverrides`, `session`, `prepareDatabase`); do not
-  reimplement hooks. `getCollection()`/`getSmrtConfig()` are request-scoped:
-  never keep their result beyond the request.
+  `src/lib/server/smrt.ts`, which holds only `runtime` and its options. Pass
+  app-specific behaviour as options (`selectTenant`, `classOverrides`,
+  `session`, `prepareDatabase`); do not reimplement hooks, re-add the
+  `smrt-register` import (the `smrt()` plugin injects it), or export
+  `getCollection` (generated routes import this module and use its
+  `runtime.getCollection()`; a legacy export would win, deprecated).
+  `runtime.getCollection()`/`runtime.classOptions()` are request-scoped: never
+  keep their result beyond the request.
 - Recover an interrupted unclaimed owner invitation with `pnpm app:stop`, then
   `pnpm app:recover`, `pnpm app:start`, and `pnpm app:open`; never print or copy
   its token.

package/template/README.md

@@ -157,8 +157,14 @@ changes. That helper checks active membership and rotates the session ID; never
 copy an untrusted header directly into `locals.tenantId` or
 `enterTenantContext()`.
 
-`getCollection()` and `getSmrtConfig()` in `$lib/server/smrt` return
-request-scoped options (under `database-rls` isolation they carry the request
+`src/lib/server/smrt.ts` holds only the runtime and its options. The `smrt()`
+plugin registers the generated objects before it runs, and each generated API
+route imports this module and resolves collections through its exported
+`runtime.getCollection()` (a `getCollection` export here would take precedence,
+deprecated for one release, so do not add one). In the local profile
+the runtime holds the single-writer lease (`acquireWriterLease: false` opts
+out). `runtime.getCollection()` and `runtime.classOptions()` are
+request-scoped (under `database-rls` isolation they carry the request
 transaction): call them inside a request and never keep the result.
 
 Set `TENANT_BASE_DOMAIN` for deployed subdomain routing. The fallback parser is
@@ -185,10 +191,10 @@ import {
   RoleCollection,
   syncPermissionCatalog,
 } from '@happyvertical/smrt-users';
-import { getSmrtConfig } from '$lib/server/smrt';
+import { runtime } from '$lib/server/smrt';
 
-await syncPermissionCatalog(getSmrtConfig('Permission'));
-const roles = await RoleCollection.create(getSmrtConfig('Role'));
+await syncPermissionCatalog(runtime.classOptions('Permission'));
+const roles = await RoleCollection.create(runtime.classOptions('Role'));
 await roles.seedSystemRoles({ seedPermissions: true });
 ```
 
@@ -219,7 +225,7 @@ export const load: PageServerLoad = async ({ depends, locals }) => {
     return { items: [] };
   }
 
-  const items = await getCollection<Item>('Item');
+  const items = await runtime.getCollection<Item>('Item');
   const rows = await items.list({ limit: 50 });
   return {
     items: rows.flatMap((item) =>
@@ -427,15 +433,30 @@ web/workers and set `SMRT_MAINTENANCE_MODE=true`. For domain-specific
 transformations, add a `scripts/smrt-portability.mjs` adapter; when present it
 replaces `smrt app export`/`import`'s built-in one.
 
-### Hosted MCP authorization
+### MCP authorization
+
+In the `local` profile, the opt-in MCP route accepts two credentials. One is
+the signed browser session. The other is an owner-minted bearer token for a
+local MCP client such as Claude Desktop through `smrt-mcp-bridge`:
+
+```bash
+pnpm exec smrt app token --scopes items.read --label "Claude Desktop"
+pnpm exec smrt app token list
+pnpm exec smrt app token revoke <id>
+```
+
+The token is printed once and only its hash is stored. It is bound to the
+owner and the owner's workspace. It expires after 30 days unless you pass
+`--expires`, up to 365 days. It never carries a permission the owner no longer
+holds. Point the bridge at `/api/mcp` with `<PREFIX>_SERVER_URL` and
+`<PREFIX>_TOKEN`; see the `@happyvertical/smrt-app-cli` README.
 
-The opt-in MCP route uses the local signed session only in the `local` profile.
 For `self-hosted` and `cloud`, configure HTTPS `SMRT_MCP_RESOURCE`,
 `SMRT_MCP_ISSUER`, `SMRT_MCP_JWKS_URI`, and space-separated
-`SMRT_MCP_SCOPES` values. Bind `resolveHostedMcpPrincipal` in
-`src/lib/server/mcp-hosted-principal.ts` to an application-owned lookup that
-checks the current account and active tenant membership on every request. It
-must return `null` for disabled, revoked, or unmapped identities. The route
-does not derive tenant authority from JWT claims, request headers, or tool
-arguments; missing configuration or a missing binding fails closed before MCP
-dispatch.
+`SMRT_MCP_SCOPES` values. On every request, the runtime maps the verified
+issuer and subject to the user linked through OIDC login. That user must have
+exactly one active tenant membership. Disabled, unmapped, or multi-tenant
+identities are denied. To use a different lookup, pass `resolvePrincipal` to
+`createHostedMcpResourceAuth`. The route never derives tenant authority from
+JWT claims, request headers, or tool arguments. Missing configuration fails
+closed before MCP dispatch.

package/template/package.json

@@ -39,19 +39,19 @@
     "svelte-check": "^4.7.6",
     "typescript": "6.0.3",
     "vite": "8.3.0",
-    "@happyvertical/smrt-cli": "^0.53.4"
+    "@happyvertical/smrt-cli": "^0.53.5"
   },
   "dependencies": {
-    "@happyvertical/smrt-app-runtime": "^0.53.4",
-    "@happyvertical/smrt-config": "^0.53.4",
-    "@happyvertical/smrt-core": "^0.53.4",
-    "@happyvertical/smrt-jobs": "^0.53.4",
-    "@happyvertical/smrt-profiles": "^0.53.4",
-    "@happyvertical/smrt-svelte": "^0.53.4",
-    "@happyvertical/smrt-tenancy": "^0.53.4",
-    "@happyvertical/smrt-ui": "^0.53.4",
-    "@happyvertical/smrt-users": "^0.53.4",
-    "@happyvertical/smrt-web": "^0.53.4",
+    "@happyvertical/smrt-app-runtime": "^0.53.5",
+    "@happyvertical/smrt-config": "^0.53.5",
+    "@happyvertical/smrt-core": "^0.53.5",
+    "@happyvertical/smrt-jobs": "^0.53.5",
+    "@happyvertical/smrt-profiles": "^0.53.5",
+    "@happyvertical/smrt-svelte": "^0.53.5",
+    "@happyvertical/smrt-tenancy": "^0.53.5",
+    "@happyvertical/smrt-ui": "^0.53.5",
+    "@happyvertical/smrt-users": "^0.53.5",
+    "@happyvertical/smrt-web": "^0.53.5",
     "@happyvertical/sql": "^0.89.12",
     "@modelcontextprotocol/server": "^2.0.0"
   }

package/template/smrt.config.ts

@@ -5,27 +5,10 @@
  * See: https://github.com/happyvertical/smrt
  */
 
-import {
-  resolveApplicationId,
-  resolveLocalRuntimePaths,
-} from '@happyvertical/smrt-app-runtime';
-
 const profile = (process.env.SMRT_RUNTIME_PROFILE || 'local') as
   | 'local'
   | 'self-hosted'
   | 'cloud';
-const appId = resolveApplicationId({
-  sourceRoot: process.cwd(),
-  explicitId: process.env.SMRT_APP_ID,
-});
-const localDatabase =
-  profile === 'local'
-    ? resolveLocalRuntimePaths({
-        appId,
-        dataDirectory: process.env.SMRT_DATA_DIR,
-        sourceRoot: process.cwd(),
-      }).database
-    : undefined;
 
 export default {
   // This is the single infrastructure selector for the application. Domain
@@ -58,22 +41,8 @@ export default {
     },
   },
 
-  // Package-specific configuration
-  packages: {
-    // CLI configuration
-    cli: {
-      database: {
-        type:
-          profile === 'local' ? 'sqlite' : 'postgres',
-        // `smrt app` sets DATABASE_URL to the profile-owned data path before
-        // migrations. Deployed profiles require an operator-owned URL.
-        url:
-          profile === 'local'
-            ? process.env.DATABASE_URL || localDatabase
-            : process.env.DATABASE_URL,
-      },
-      verbose: false,
-    },
-
-  },
+  // No `packages.cli.database`: `smrt app setup` / `smrt app migrate` hand
+  // `smrt db:migrate` the profile-owned database through DATABASE_URL and
+  // DATABASE_TYPE (local: the SQLite file in the user data root; deployed: the
+  // operator's URL). See the smrt-cli README for the precedence.
 };

package/template/src/lib/server/smrt.ts

@@ -1,87 +1,23 @@
 /**
- * The application's SMRT runtime and collection access.
+ * The application's SMRT runtime: app options only.
  *
  * `runtime` composes the configured profile (local SQLite or deployed
- * PostgreSQL), storage custody, the owner bootstrap, tenant selection, and the
- * signed session; `src/hooks.server.ts` mounts its `handle` and `init`.
- * Generated API routes import `getCollection` from this file.
+ * PostgreSQL), storage custody, the owner bootstrap, tenant selection, the
+ * signed session, and (local profile) the single-writer lease shared with
+ * `smrt app` operations; `src/hooks.server.ts` mounts its `handle` and `init`.
+ * The smrt() Vite plugin registers the generated objects before this module
+ * runs, and generated API routes resolve collections through
+ * `runtime.getCollection()`.
+ *
+ * `runtime.getCollection()` and `runtime.classOptions()` are request-scoped:
+ * under `database-rls` isolation they carry the request's transaction, so
+ * call them per request and never keep the result.
  */
 
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-
-import {
-  acquireWriterLease,
-  createProviderReadinessProbe,
-  prepareApplicationStateRoot,
-} from '@happyvertical/smrt-app-runtime';
+import { createProviderReadinessProbe } from '@happyvertical/smrt-app-runtime';
 import { createSmrtSvelteKitRuntime } from '@happyvertical/smrt-app-runtime/sveltekit';
-import {
-  ObjectRegistry,
-  type SmrtClassOptions,
-  type SmrtObject,
-} from '@happyvertical/smrt-core';
-import { loadManifestFromPathSync } from '@happyvertical/smrt-core/manifest';
-
-// Import all SMRT objects to register them.
-import '../objects/index.js';
-
-/**
- * Whether `error` reports that the generated register module itself is
- * absent. Only the missing module named by the error counts (Node's `url`,
- * or `Cannot find module '<path>'` from Node and Vite's module runner); a
- * package or file that an existing generated module imports is a different
- * missing module and is never matched.
- */
-function isMissingRegisterModule(error: unknown): boolean {
-  const { code, url, message } = (error ?? {}) as {
-    code?: unknown;
-    url?: unknown;
-    message?: unknown;
-  };
-  if (code !== 'ERR_MODULE_NOT_FOUND') return false;
-  const missing =
-    typeof url === 'string'
-      ? url
-      : typeof message === 'string'
-        ? /^Cannot find module '([^']+)'/.exec(message)?.[1]
-        : undefined;
-  if (!missing) return false;
-  const path = missing.replace(/^file:\/\//, '').replace(/[?#].*$/, '');
-  return /\/lib\/server\/smrt-register\.(?:js|ts)$/.test(path);
-}
-
-// Upgrade those registrations to package-qualified identities
-// (`<package>:<Class>`) — required to link each class to its scanned field
-// metadata below. The `smrt()` Vite plugin generates this module on every
-// dev/build run (it is gitignored, like the generated API routes); guard the
-// import so a fresh checkout that has not run the plugin yet still boots.
-try {
-  // @ts-ignore generated by the smrt() Vite plugin before a build starts
-  await import('./smrt-register.js');
-} catch (error) {
-  // Not generated yet — the first `pnpm dev` / `pnpm build` creates it. Any
-  // other failure, including a missing dependency of an existing generated
-  // module (an uninstalled extension package), must fail startup.
-  if (!isMissingRegisterModule(error)) throw error;
-}
-
-// Hydrate field metadata for this app's own objects from the local manifest
-// (`.smrt/manifest.json`). Without it the runtime only knows the framework
-// base fields and server-side writes would silently drop your domain columns.
-const localManifestPath = join(process.cwd(), '.smrt', 'manifest.json');
-if (existsSync(localManifestPath)) {
-  loadManifestFromPathSync(localManifestPath);
-}
 
 export const runtime = createSmrtSvelteKitRuntime({
-  // Every local web writer (`pnpm dev`, `pnpm app:start`) holds the same
-  // single-writer lease as `smrt app` operations, so imports and backups
-  // fail closed while the app is running.
-  acquireWriterLease: (context) =>
-    acquireWriterLease(prepareApplicationStateRoot(context), {
-      operationInstance: process.env.SMRT_OPERATION_INSTANCE,
-    }),
   // Deployed profiles prove authentication, asset, and secret readiness
   // through the installed modules named by SMRT_*_READINESS_MODULE.
   providerReadiness: createProviderReadinessProbe,
@@ -89,23 +25,3 @@ export const runtime = createSmrtSvelteKitRuntime({
   //   AuditLog: { db: { type: 'postgres', url: process.env.AUDIT_DB_URL! } }
   classOverrides: {},
 });
-
-/**
- * Collection options for a class. Call per request and never keep the result:
- * under `database-rls` isolation it carries the request's transaction.
- */
-export function getSmrtConfig(className: string): SmrtClassOptions {
-  return runtime.classOptions(className);
-}
-
-/**
- * Get a collection for a SMRT class, scoped to the current request.
- *
- *   const items = await getCollection<Item>('Item');
- */
-export async function getCollection<T extends SmrtObject>(className: string) {
-  return await ObjectRegistry.getCollection<T>(
-    className,
-    runtime.classOptions(className),
-  );
-}

package/template/src/routes/+page.server.ts

@@ -2,7 +2,7 @@ import { assertOperationPermission } from '@happyvertical/smrt-users';
 import { fail } from '@sveltejs/kit';
 
 import type { Item } from '$lib/objects/Item';
-import { getCollection, getSmrtConfig } from '$lib/server/smrt';
+import { runtime } from '$lib/server/smrt';
 import type { Actions, PageServerLoad } from './$types';
 
 const READ_PERMISSION = 'items.read';
@@ -38,7 +38,7 @@ export const load: PageServerLoad = async ({ depends, locals }) => {
   }
 
   try {
-    const items = await getCollection<Item>('Item');
+    const items = await runtime.getCollection<Item>('Item');
     const rows = await items.list({
       orderBy: 'created_at DESC',
       limit: 50,
@@ -72,7 +72,7 @@ export const actions: Actions = {
     }
 
     const decision = await assertOperationPermission({
-      ...getSmrtConfig('Item'),
+      ...runtime.classOptions('Item'),
       action: 'create',
       collection: 'items',
       onDeny: 'return',
@@ -91,7 +91,7 @@ export const actions: Actions = {
     }
 
     try {
-      const items = await getCollection<Item>('Item');
+      const items = await runtime.getCollection<Item>('Item');
       await items.create({ title });
       return { created: title };
     } catch (error) {

package/template/src/routes/setup/+page.server.ts

@@ -1,23 +1,9 @@
-import { rmSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { resolveApplicationStateRoot } from '@happyvertical/smrt-app-runtime';
 import { createOwnerSetupPage } from '@happyvertical/smrt-app-runtime/sveltekit';
 
 import { runtime } from '$lib/server/smrt';
 
-/** Local-profile, loopback-only, single-use owner bootstrap. */
-export const { load, actions } = createOwnerSetupPage(runtime, {
-  // `pnpm app:setup` leaves the invitation in mode-0600 handoff files; once
-  // the owner exists they only hold a token that now fails closed.
-  onOwnerClaimed() {
-    const stateRoot = resolveApplicationStateRoot({
-      appId: runtime.applicationId(),
-      dataDirectory: process.env.SMRT_DATA_DIR,
-      sourceRoot: process.cwd(),
-    });
-    for (const file of ['onboarding.json', 'onboarding-launch.html']) {
-      rmSync(join(stateRoot, file), { force: true });
-    }
-  },
-});
+/**
+ * Local-profile, loopback-only, single-use owner bootstrap. The runtime
+ * removes the `pnpm app:setup` onboarding hand-off files once the claim commits.
+ */
+export const { load, actions } = createOwnerSetupPage(runtime);

package/template.config.js

@@ -19,22 +19,22 @@ export default {
 
   // Dependencies to add to generated project
   dependencies: {
-    '@happyvertical/smrt-app-runtime': '^0.53.4',
-    '@happyvertical/smrt-config': '^0.53.4',
-    '@happyvertical/smrt-core': '^0.53.4',
-    '@happyvertical/smrt-jobs': '^0.53.4',
-    '@happyvertical/smrt-profiles': '^0.53.4',
-    '@happyvertical/smrt-svelte': '^0.53.4',
-    '@happyvertical/smrt-tenancy': '^0.53.4',
-    '@happyvertical/smrt-ui': '^0.53.4',
-    '@happyvertical/smrt-users': '^0.53.4',
-    '@happyvertical/smrt-web': '^0.53.4',
+    '@happyvertical/smrt-app-runtime': '^0.53.5',
+    '@happyvertical/smrt-config': '^0.53.5',
+    '@happyvertical/smrt-core': '^0.53.5',
+    '@happyvertical/smrt-jobs': '^0.53.5',
+    '@happyvertical/smrt-profiles': '^0.53.5',
+    '@happyvertical/smrt-svelte': '^0.53.5',
+    '@happyvertical/smrt-tenancy': '^0.53.5',
+    '@happyvertical/smrt-ui': '^0.53.5',
+    '@happyvertical/smrt-users': '^0.53.5',
+    '@happyvertical/smrt-web': '^0.53.5',
     '@happyvertical/sql': '^0.89.12',
     '@modelcontextprotocol/server': '^2.0.0',
   },
 
   devDependencies: {
-    '@happyvertical/smrt-cli': '^0.53.4',
+    '@happyvertical/smrt-cli': '^0.53.5',
     '@sveltejs/adapter-node': '^5.5.7',
     '@sveltejs/kit': '2.70.3',
     '@sveltejs/vite-plugin-svelte': '^7.3.0',

package/mcp-apps-template/src/lib/server/mcp-hosted-principal.ts

@@ -1,12 +0,0 @@
-import type { McpVerifiedIdentity, McpPrincipalMapping } from '@happyvertical/smrt-app-mcp/auth';
-
-/**
- * Deployments must replace this binding with a database-backed current-account
- * and active-membership lookup. Token claims never select a tenant.
- */
-export type HostedMcpPrincipalResolver = (
-  identity: McpVerifiedIdentity,
-) => Promise<McpPrincipalMapping | null>;
-
-export const resolveHostedMcpPrincipal: HostedMcpPrincipalResolver | undefined =
-  undefined;