@happyvertical/smrt-template-sveltekit 0.54.3 → 0.55.0

package/AGENTS.md

@@ -104,11 +104,13 @@ It is the ground-up alternative to `smrt-saas-starter`.
   (`createRuntimeDiagnosticsHandler`) requires a direct active tenant membership
   plus the owner role or `runtime_diagnostics.read` before any projection or
   probe; it never calls principal-bound server tools.
-- The opt-in `mcp-apps-template/` overlay is one `mountMcpAppRoute()` route
-  and the protected-resource metadata route, both using
-  `createHostedMcpResourceAuth({ profile, runtime })` (local owner tokens,
-  hosted membership-backed principals); `pnpm typecheck` checks it against
-  the template. `__tests__/localMcpToken.test.ts` proves mint → real
+- The opt-in `mcp-apps-template/` overlay is one
+  `mountMcpAppRoute({ runtime })` route and
+  `mountMcpProtectedResourceMetadataRoute({ runtime })` (#3491): the
+  runtime supplies the request database, `runAsPrincipal` and, per request,
+  the profile's bearer adapter (local owner tokens, hosted membership-backed
+  principals). No `mcp.ts` helper or top-level `await`; `pnpm typecheck`
+  checks it against the template. `__tests__/localMcpToken.test.ts` proves mint → real
   `smrt-mcp-bridge` stdio → route against the real runtime.
   `__tests__/mcpConsumerBundle.test.ts` (why `@happyvertical/smrt-chat` is a
   devDependency) Vite-SSR-builds `fixtures/mcp-chat-consumer/` with chat and

package/mcp-apps-template/package.dependencies.json

@@ -1,4 +1,4 @@
 {
-  "@happyvertical/smrt-app-mcp": "^0.54.3",
-  "@happyvertical/smrt-mcp-openai": "^0.54.3"
+  "@happyvertical/smrt-app-mcp": "^0.55.0",
+  "@happyvertical/smrt-mcp-openai": "^0.55.0"
 }

package/mcp-apps-template/src/routes/.well-known/oauth-protected-resource/api/mcp/+server.ts

@@ -1,11 +1,6 @@
-import { createHostedMcpResourceAuth } from '@happyvertical/smrt-app-mcp/auth';
 import { mountMcpProtectedResourceMetadataRoute } from '@happyvertical/smrt-app-mcp/sveltekit';
 
 import { runtime } from '$lib/server/smrt';
 
-const { profile } = await runtime.resolvedRuntime();
-
 /** RFC 9728 metadata at exactly the URL hosted bearer challenges advertise (404 locally). */
-export const GET = mountMcpProtectedResourceMetadataRoute(
-  createHostedMcpResourceAuth({ profile, runtime }),
-);
+export const GET = mountMcpProtectedResourceMetadataRoute({ runtime });

package/mcp-apps-template/src/routes/api/mcp/+server.ts

@@ -1,5 +1,4 @@
 import type { McpWorkflowToolDefinition } from '@happyvertical/smrt-app-mcp';
-import { createHostedMcpResourceAuth } from '@happyvertical/smrt-app-mcp/auth';
 import { mountMcpAppRoute } from '@happyvertical/smrt-app-mcp/sveltekit';
 import { openAiDisplayMetadata, withOpenAiEntrypoints } from '@happyvertical/smrt-mcp-openai';
 
@@ -35,28 +34,27 @@ const itemsOverview: McpWorkflowToolDefinition = withOpenAiEntrypoints(
   ['global'],
 );
 
-const { profile } = await runtime.resolvedRuntime();
-
 /**
  * Stateless SDK-v2 Streamable HTTP MCP endpoint for this app's own `Item`.
- * Locally the principal is the signed session (user, authorized tenant, and
- * permission slugs), or an owner-minted bearer token from `smrt app token`
- * for a local MCP client such as the `smrt-mcp-bridge` stdio bridge. Hosted
- * profiles verify a bearer access token and map it through the runtime's
- * membership-backed `resolveMcpPrincipal` (pass `resolvePrincipal` to
- * override it). A bearer principal is bound into the request permission
+ * `runtime` supplies the request database, the bearer adapter for the profile
+ * it resolves per request, and the principal binding. Locally the principal
+ * is the signed session (user, authorized tenant, and permission slugs), or
+ * an owner-minted bearer token from `smrt app token` for a local MCP client
+ * such as the `smrt-mcp-bridge` stdio bridge. Hosted profiles verify a bearer
+ * access token and map it through the runtime's membership-backed
+ * `resolveMcpPrincipal` (pass an explicit `auth` built with
+ * `createHostedMcpResourceAuth({ ..., resolvePrincipal })` to override it).
+ * A bearer principal is bound into the request permission
  * context (under `database-rls`, its own RLS transaction) with its scopes
  * capped to live permissions. Every principal needs `items.read`, so only
  * read-only tools are published until per-operation authorization exists;
  * browser requests from a foreign `Origin` are refused.
  */
 export const POST = mountMcpAppRoute({
+  runtime,
   models: [Item],
   requiredScopes: ['items.read'],
   effects: ['read'],
-  smrtOptions: () => ({ db: runtime.databaseConfig() }),
-  auth: createHostedMcpResourceAuth({ profile, runtime }),
-  bindPrincipal: runtime.runAsPrincipal,
   workflowTools: [itemsOverview],
   resources: [
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-template-sveltekit",
-  "version": "0.54.3",
+  "version": "0.55.0",
   "description": "Minimal SvelteKit project template with s-m-r-t framework integration",
   "type": "module",
   "main": "index.js",
@@ -32,26 +32,26 @@
     "directory": "packages/template-sveltekit"
   },
   "peerDependencies": {
-    "@happyvertical/smrt-core": "0.54.3"
+    "@happyvertical/smrt-core": "0.55.0"
   },
   "devDependencies": {
-    "@happyvertical/smrt-app-cli": "0.54.3",
-    "@happyvertical/smrt-app-mcp": "0.54.3",
-    "@happyvertical/smrt-app-runtime": "0.54.3",
-    "@happyvertical/smrt-assets": "0.54.3",
-    "@happyvertical/smrt-chat": "0.54.3",
-    "@happyvertical/smrt-cli": "0.54.3",
-    "@happyvertical/smrt-config": "0.54.3",
-    "@happyvertical/smrt-jobs": "0.54.3",
-    "@happyvertical/smrt-mcp-openai": "0.54.3",
-    "@happyvertical/smrt-playbooks": "0.54.3",
-    "@happyvertical/smrt-profiles": "0.54.3",
-    "@happyvertical/smrt-scanner": "0.54.3",
-    "@happyvertical/smrt-svelte": "0.54.3",
-    "@happyvertical/smrt-tenancy": "0.54.3",
-    "@happyvertical/smrt-ui": "0.54.3",
-    "@happyvertical/smrt-users": "0.54.3",
-    "@happyvertical/smrt-web": "0.54.3",
+    "@happyvertical/smrt-app-cli": "0.55.0",
+    "@happyvertical/smrt-app-mcp": "0.55.0",
+    "@happyvertical/smrt-app-runtime": "0.55.0",
+    "@happyvertical/smrt-assets": "0.55.0",
+    "@happyvertical/smrt-chat": "0.55.0",
+    "@happyvertical/smrt-cli": "0.55.0",
+    "@happyvertical/smrt-config": "0.55.0",
+    "@happyvertical/smrt-jobs": "0.55.0",
+    "@happyvertical/smrt-mcp-openai": "0.55.0",
+    "@happyvertical/smrt-playbooks": "0.55.0",
+    "@happyvertical/smrt-profiles": "0.55.0",
+    "@happyvertical/smrt-scanner": "0.55.0",
+    "@happyvertical/smrt-svelte": "0.55.0",
+    "@happyvertical/smrt-tenancy": "0.55.0",
+    "@happyvertical/smrt-ui": "0.55.0",
+    "@happyvertical/smrt-users": "0.55.0",
+    "@happyvertical/smrt-web": "0.55.0",
     "@happyvertical/sql": "^0.89.12",
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "^2.0.0",

package/template/README.md

@@ -254,8 +254,9 @@ non-object or malformed manifests, credential-shaped JSON fields and credential
 URL userinfo, non-portable schemas, and non-loopback HTTP server URLs. Diagnostics never
 include malformed manifest content.
 
-The option stages `src/routes/api/mcp/+server.ts`, one `mountMcpAppRoute()`
-call from `@happyvertical/smrt-app-mcp/sveltekit` that publishes `Item` to
+The option stages `src/routes/api/mcp/+server.ts`, one
+`mountMcpAppRoute({ runtime, ... })` call from
+`@happyvertical/smrt-app-mcp/sveltekit` that publishes `Item` to
 principals holding `items.read` (the signed session's permissions locally),
 refuses browser requests from a foreign `Origin`, and serves a bounded static
 resource with a restrictive CSP and the optional OpenAI display metadata. It
@@ -456,7 +457,7 @@ For `self-hosted` and `cloud`, configure HTTPS `SMRT_MCP_RESOURCE`,
 `SMRT_MCP_SCOPES` values. On every request, the runtime maps the verified
 issuer and subject to the user linked through OIDC login. That user must have
 exactly one active tenant membership. Disabled, unmapped, or multi-tenant
-identities are denied. To use a different lookup, pass `resolvePrincipal` to
-`createHostedMcpResourceAuth`. The route never derives tenant authority from
+identities are denied. To use a different lookup, pass the route an explicit
+`auth` built with `createHostedMcpResourceAuth({ ..., resolvePrincipal })`. The route never derives tenant authority from
 JWT claims, request headers, or tool arguments. Missing configuration fails
 closed before MCP dispatch.

package/template/package.json

@@ -39,19 +39,19 @@
     "svelte-check": "^4.7.6",
     "typescript": "6.0.3",
     "vite": "8.3.0",
-    "@happyvertical/smrt-cli": "^0.54.3"
+    "@happyvertical/smrt-cli": "^0.55.0"
   },
   "dependencies": {
-    "@happyvertical/smrt-app-runtime": "^0.54.3",
-    "@happyvertical/smrt-config": "^0.54.3",
-    "@happyvertical/smrt-core": "^0.54.3",
-    "@happyvertical/smrt-jobs": "^0.54.3",
-    "@happyvertical/smrt-profiles": "^0.54.3",
-    "@happyvertical/smrt-svelte": "^0.54.3",
-    "@happyvertical/smrt-tenancy": "^0.54.3",
-    "@happyvertical/smrt-ui": "^0.54.3",
-    "@happyvertical/smrt-users": "^0.54.3",
-    "@happyvertical/smrt-web": "^0.54.3",
+    "@happyvertical/smrt-app-runtime": "^0.55.0",
+    "@happyvertical/smrt-config": "^0.55.0",
+    "@happyvertical/smrt-core": "^0.55.0",
+    "@happyvertical/smrt-jobs": "^0.55.0",
+    "@happyvertical/smrt-profiles": "^0.55.0",
+    "@happyvertical/smrt-svelte": "^0.55.0",
+    "@happyvertical/smrt-tenancy": "^0.55.0",
+    "@happyvertical/smrt-ui": "^0.55.0",
+    "@happyvertical/smrt-users": "^0.55.0",
+    "@happyvertical/smrt-web": "^0.55.0",
     "@happyvertical/sql": "^0.89.12",
     "@modelcontextprotocol/server": "^2.0.0"
   }

package/template.config.js

@@ -19,22 +19,22 @@ export default {
 
   // Dependencies to add to generated project
   dependencies: {
-    '@happyvertical/smrt-app-runtime': '^0.54.3',
-    '@happyvertical/smrt-config': '^0.54.3',
-    '@happyvertical/smrt-core': '^0.54.3',
-    '@happyvertical/smrt-jobs': '^0.54.3',
-    '@happyvertical/smrt-profiles': '^0.54.3',
-    '@happyvertical/smrt-svelte': '^0.54.3',
-    '@happyvertical/smrt-tenancy': '^0.54.3',
-    '@happyvertical/smrt-ui': '^0.54.3',
-    '@happyvertical/smrt-users': '^0.54.3',
-    '@happyvertical/smrt-web': '^0.54.3',
+    '@happyvertical/smrt-app-runtime': '^0.55.0',
+    '@happyvertical/smrt-config': '^0.55.0',
+    '@happyvertical/smrt-core': '^0.55.0',
+    '@happyvertical/smrt-jobs': '^0.55.0',
+    '@happyvertical/smrt-profiles': '^0.55.0',
+    '@happyvertical/smrt-svelte': '^0.55.0',
+    '@happyvertical/smrt-tenancy': '^0.55.0',
+    '@happyvertical/smrt-ui': '^0.55.0',
+    '@happyvertical/smrt-users': '^0.55.0',
+    '@happyvertical/smrt-web': '^0.55.0',
     '@happyvertical/sql': '^0.89.12',
     '@modelcontextprotocol/server': '^2.0.0',
   },
 
   devDependencies: {
-    '@happyvertical/smrt-cli': '^0.54.3',
+    '@happyvertical/smrt-cli': '^0.55.0',
     '@sveltejs/adapter-node': '^5.5.7',
     '@sveltejs/kit': '2.70.3',
     '@sveltejs/vite-plugin-svelte': '^7.3.0',