@happyvertical/smrt-template-sveltekit 0.55.16 → 0.55.18

package/AGENTS.md

@@ -84,17 +84,34 @@ It is the ground-up alternative to `smrt-saas-starter`.
   establishes tenant context. Never turn an untrusted header into authority.
 - App code uses `runtime.getCollection()`/`runtime.classOptions()`, which are
   request-scoped (RLS transaction) and must never be retained.
-- `Item` is the single example object and demonstrates optional tenant scope,
-  a REST writable allowlist, shared CRUD action metadata, and the explicit
+- `Note` is the single example object (the canonical Notes starter, matching
+  `smrt-start`) and demonstrates required tenant scope, a REST writable allowlist, shared CRUD action metadata, and the explicit
   collection registration required by generated CLI/MCP runtime commands.
 - Initial data comes from `+page.server.ts`; loads declare
-  `depends('smrt:items')`, mutations call `invalidate('smrt:items')`, and
+  `depends('smrt:notes')`, mutations call `invalidate('smrt:notes')`, and
   hand-written writes call `assertOperationPermission()` with the session's
   exact permission snapshot.
 - The root layout is `AppShell` from `@happyvertical/smrt-svelte/app` with a
   small explicit `nav`; `/setup` and `/settings` mount that package's
   `OwnerSetupForm` and `ShellSettingsPage`. Generated REST routes do not imply
   page routes.
+- Session user and sign-out: `+layout.server.ts` (`createSessionLayoutLoad()`)
+  returns `session.user` (`{ id, email, name? }` only, never the record or
+  tokens). The root layout passes it as AppShell `user` (account menu) with
+  `onSignOut` from `src/lib/sign-out.ts` (same-origin `fetch` `POST /sign-out`,
+  then `invalidateAll()` and `goto('/')`); the settings page passes the same
+  helper. `src/routes/sign-out/+server.ts` mounts `createSignOutHandler(runtime)`
+  (POST only, 405 otherwise; same-origin only, 403 otherwise; 204, or 303 to `/`
+  for an HTML form post). The layout enables `phoneTabBar` and sets
+  `chrome={!page.route.id?.startsWith('/setup')}` so `/setup` renders only the
+  chrome-free `OwnerSetupForm` card.
+- The Notes page is built from smrt-ui primitives only (`Button`, `Card`,
+  `Form`, `FormGroup`, `Input`, `Textarea`, `EmptyState`): no raw `<form>`,
+  `<input>`, or `<button>`, token spacing, and a "Start your first note" empty
+  state. The root layout passes only live AppShell props (no `subtitle`,
+  `tenantLabel`, or `appPanelDocs`) and gives each nav item a shell icon name.
+  `app.html` carries `viewport-fit=cover`, `color-scheme`, light and dark
+  `theme-color`, and `static/favicon.svg`.
 - AppShell's Provider registers generated WebMCP read tools with the
   authenticated page session. Write/destructive effects require an explicit
   page-owned policy.

package/README.md

@@ -70,13 +70,13 @@ lifecycle script is `smrt app <operation>`.
 
 ## 3. Define the first object
 
-The generated `src/lib/objects/Item.ts` is one optional-tenant object with
-title, description, and status fields. Its small explicit `ItemCollection`
+The generated `src/lib/objects/Note.ts` is one required-tenant object with
+title and body fields. Its small explicit `NoteCollection`
 constructor keeps generated CLI/MCP runtime commands constructible. Its
 `@smrt()` configuration exposes CRUD to REST, MCP, WebMCP definitions, and CLI
 while using an API writable allowlist.
 
-Add objects beside Item and export them from `src/lib/objects/index.ts`.
+Add objects beside Note and export them from `src/lib/objects/index.ts`.
 `vite.config.ts` already scans that directory.
 
 ## 4. Initialize or migrate the database
@@ -121,9 +121,9 @@ points.
 
 ## 7. Load data into a SvelteKit page
 
-The home page loads Item rows in `+page.server.ts`, returns plain serialized
-data, and declares `depends('smrt:items')`. The Svelte 5 page reads hydrated
-`$props()` data and calls `invalidate('smrt:items')` after a successful form
+The home page loads Note rows in `+page.server.ts`, returns plain serialized
+data, and declares `depends('smrt:notes')`. The Svelte 5 page reads hydrated
+`$props()` data and calls `invalidate('smrt:notes')` after a successful form
 mutation. It does not fetch initial data in `onMount` or `$effect`.
 
 ## 8. Use generated REST, MCP, WebMCP, and CLI interfaces
@@ -134,7 +134,7 @@ declared dev dependency:
 
 ```bash
 pnpm smrt objects
-pnpm smrt schema Item
+pnpm smrt schema Note
 pnpm smrt generate-mcp --no-config --no-readme
 ```
 
@@ -156,7 +156,7 @@ is needed for WebMCP. Live browser collections remain opt-in per page; import
 the collection helpers only on pages that need interactive client data.
 
 The generated-project README shows the current hydration pattern:
-`createSmrtCollection(getCollectionDefinition('items'), { initialData,
+`createSmrtCollection(getCollectionDefinition('notes'), { initialData,
 basePath: '/api' })` followed by `liveCollection()`. The root layout's
 read-only WebMCP registration does not materialize live collections.
 

package/mcp-apps-template/package.dependencies.json

@@ -1,4 +1,4 @@
 {
-  "@happyvertical/smrt-app-mcp": "^0.55.16",
-  "@happyvertical/smrt-mcp-openai": "^0.55.16"
+  "@happyvertical/smrt-app-mcp": "^0.55.18",
+  "@happyvertical/smrt-mcp-openai": "^0.55.18"
 }

package/mcp-apps-template/src/routes/api/mcp/+server.ts

@@ -2,17 +2,17 @@ import type { McpWorkflowToolDefinition } from '@happyvertical/smrt-app-mcp';
 import { mountMcpAppRoute } from '@happyvertical/smrt-app-mcp/sveltekit';
 import { openAiDisplayMetadata, withOpenAiEntrypoints } from '@happyvertical/smrt-mcp-openai';
 
-import { Item } from '$lib/objects/Item';
+import { Note } from '$lib/objects/Note';
 import { runtime } from '$lib/server/smrt';
 
-const ITEM_RESOURCE_URI = 'ui://smrt-app/v1/items.html';
-const itemResourceHtml = `<!doctype html><html lang="en"><head><title>Items</title></head><body><main tabindex="-1"><h1>Items</h1><p>Use the host controls to review your authorized items.</p></main></body></html>`;
+const NOTE_RESOURCE_URI = 'ui://smrt-app/v1/notes.html';
+const noteResourceHtml = `<!doctype html><html lang="en"><head><title>Notes</title></head><body><main tabindex="-1"><h1>Notes</h1><p>Use the host controls to review your authorized notes.</p></main></body></html>`;
 
-const itemsOverview: McpWorkflowToolDefinition = withOpenAiEntrypoints(
+const notesOverview: McpWorkflowToolDefinition = withOpenAiEntrypoints(
   {
-    name: 'items_overview',
+    name: 'notes_overview',
     description: 'Open the authorized item overview.',
-    title: 'Items',
+    title: 'Notes',
     inputSchema: { type: 'object', properties: {}, additionalProperties: false },
     outputSchema: {
       type: 'object',
@@ -23,10 +23,10 @@ const itemsOverview: McpWorkflowToolDefinition = withOpenAiEntrypoints(
     effect: 'read',
     idempotent: true,
     openWorld: false,
-    ui: { resourceUri: ITEM_RESOURCE_URI },
+    ui: { resourceUri: NOTE_RESOURCE_URI },
     async execute() {
       return {
-        content: [{ type: 'text', text: 'Item overview is ready.' }],
+        content: [{ type: 'text', text: 'Note overview is ready.' }],
         structuredContent: { state: 'ready' },
       };
     },
@@ -35,7 +35,7 @@ const itemsOverview: McpWorkflowToolDefinition = withOpenAiEntrypoints(
 );
 
 /**
- * Stateless SDK-v2 Streamable HTTP MCP endpoint for this app's own `Item`.
+ * Stateless SDK-v2 Streamable HTTP MCP endpoint for this app's own `Note`.
  * `runtime` supplies the request database, the bearer adapter for the profile
  * it resolves per request, and the principal binding. Locally the principal
  * is the signed session (user, authorized tenant, and permission slugs), or
@@ -46,22 +46,22 @@ const itemsOverview: McpWorkflowToolDefinition = withOpenAiEntrypoints(
  * `createHostedMcpResourceAuth({ ..., resolvePrincipal })` to override it).
  * A bearer principal is bound into the request permission
  * context (under `database-rls`, its own RLS transaction) with its scopes
- * capped to live permissions. Every principal needs `items.read`, so only
+ * capped to live permissions. Every principal needs `notes.read`, so only
  * read-only tools are published until per-operation authorization exists;
  * browser requests from a foreign `Origin` are refused.
  */
 export const POST = mountMcpAppRoute({
   runtime,
-  models: [Item],
-  requiredScopes: ['items.read'],
+  models: [Note],
+  requiredScopes: ['notes.read'],
   effects: ['read'],
-  workflowTools: [itemsOverview],
+  workflowTools: [notesOverview],
   resources: [
     {
-      uri: ITEM_RESOURCE_URI,
+      uri: NOTE_RESOURCE_URI,
       version: 'v1',
-      name: 'Items',
-      html: itemResourceHtml,
+      name: 'Notes',
+      html: noteResourceHtml,
       csp: {},
       metadata: openAiDisplayMetadata({ availableDisplayModes: ['inline'] }),
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-template-sveltekit",
-  "version": "0.55.16",
+  "version": "0.55.18",
   "description": "Minimal SvelteKit project template with s-m-r-t framework integration",
   "type": "module",
   "main": "index.js",
@@ -32,26 +32,26 @@
     "directory": "packages/template-sveltekit"
   },
   "peerDependencies": {
-    "@happyvertical/smrt-core": "0.55.16"
+    "@happyvertical/smrt-core": "0.55.18"
   },
   "devDependencies": {
-    "@happyvertical/smrt-app-cli": "0.55.16",
-    "@happyvertical/smrt-app-mcp": "0.55.16",
-    "@happyvertical/smrt-app-runtime": "0.55.16",
-    "@happyvertical/smrt-assets": "0.55.16",
-    "@happyvertical/smrt-chat": "0.55.16",
-    "@happyvertical/smrt-cli": "0.55.16",
-    "@happyvertical/smrt-config": "0.55.16",
-    "@happyvertical/smrt-jobs": "0.55.16",
-    "@happyvertical/smrt-mcp-openai": "0.55.16",
-    "@happyvertical/smrt-playbooks": "0.55.16",
-    "@happyvertical/smrt-profiles": "0.55.16",
-    "@happyvertical/smrt-scanner": "0.55.16",
-    "@happyvertical/smrt-svelte": "0.55.16",
-    "@happyvertical/smrt-tenancy": "0.55.16",
-    "@happyvertical/smrt-ui": "0.55.16",
-    "@happyvertical/smrt-users": "0.55.16",
-    "@happyvertical/smrt-web": "0.55.16",
+    "@happyvertical/smrt-app-cli": "0.55.18",
+    "@happyvertical/smrt-app-mcp": "0.55.18",
+    "@happyvertical/smrt-app-runtime": "0.55.18",
+    "@happyvertical/smrt-assets": "0.55.18",
+    "@happyvertical/smrt-chat": "0.55.18",
+    "@happyvertical/smrt-cli": "0.55.18",
+    "@happyvertical/smrt-config": "0.55.18",
+    "@happyvertical/smrt-jobs": "0.55.18",
+    "@happyvertical/smrt-mcp-openai": "0.55.18",
+    "@happyvertical/smrt-playbooks": "0.55.18",
+    "@happyvertical/smrt-profiles": "0.55.18",
+    "@happyvertical/smrt-scanner": "0.55.18",
+    "@happyvertical/smrt-svelte": "0.55.18",
+    "@happyvertical/smrt-tenancy": "0.55.18",
+    "@happyvertical/smrt-ui": "0.55.18",
+    "@happyvertical/smrt-users": "0.55.18",
+    "@happyvertical/smrt-web": "0.55.18",
     "@happyvertical/sql": "^0.89.12",
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "^2.0.0",

package/template/README.md

@@ -1,7 +1,7 @@
 # s-m-r-t SvelteKit starter
 
 This is the small, ground-up starting point for s-m-r-t 0.43.10. It contains
-one object and a profile-aware operational surface for local, self-hosted, and
+one Notes object and a profile-aware operational surface for local, self-hosted, and
 managed-cloud environments. It does not provision external providers.
 
 ## 1. Install and run
@@ -69,7 +69,7 @@ objects.
 
 ## 3. Define the first object
 
-`src/lib/objects/Item.ts` is the only example. It exposes the same CRUD action
+`src/lib/objects/Note.ts` is the only example. It exposes the same CRUD action
 set to REST, MCP, WebMCP definitions, and the CLI, while limiting writable REST
 fields and opting into tenant scoping:
 
@@ -85,26 +85,25 @@ import { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';
 @smrt({
   api: {
     include: ['list', 'get', 'create', 'update', 'delete'],
-    writable: ['title', 'description', 'status'],
+    writable: ['title', 'body'],
   },
   cli: { include: ['list', 'get', 'create', 'update', 'delete'] },
   mcp: { include: ['list', 'get', 'create', 'update', 'delete'] },
 })
-@TenantScoped({ mode: 'optional' })
-export class Item extends SmrtObject {
-  @tenantId({ nullable: true })
-  tenantId: string | null = null;
+@TenantScoped({ mode: 'required' })
+export class Note extends SmrtObject {
+  @tenantId()
+  tenantId: string = '';
 
   title: string = '';
-  description: string = '';
-  status: string = 'draft';
+  body: string = '';
 }
 
-export class ItemCollection extends SmrtCollection<Item> {
-  static readonly _itemClass = Item;
+export class NoteCollection extends SmrtCollection<Note> {
+  static readonly _itemClass = Note;
 }
 
-ObjectRegistry.registerCollection('Item', ItemCollection);
+ObjectRegistry.registerCollection('Note', NoteCollection);
 ```
 
 Add another class beside it and export the class from
@@ -182,8 +181,8 @@ These are separate records with separate responsibilities:
 - Session binds the authenticated user to an active tenant and publishes the
   resolved permission set for the request.
 
-CRUD permissions are manifest-derived: `items.read`, `items.create`,
-`items.update`, and `items.delete`. Provisioning code should sync the catalog
+CRUD permissions are manifest-derived: `notes.read`, `notes.create`,
+`notes.update`, and `notes.delete`. Provisioning code should sync the catalog
 and seed roles after the database migration:
 
 ```ts
@@ -219,17 +218,17 @@ session context directly. Return plain serializable rows:
 
 ```ts
 export const load: PageServerLoad = async ({ depends, locals }) => {
-  depends('smrt:items');
+  depends('smrt:notes');
 
-  if (!locals.permissions.includes('items.read')) {
-    return { items: [] };
+  if (!locals.permissions.includes('notes.read')) {
+    return { notes: [] };
   }
 
-  const items = await runtime.getCollection<Item>('Item');
-  const rows = await items.list({ limit: 50 });
+  const notes = await runtime.getCollection<Note>('Note');
+  const rows = await notes.list({ limit: 50 });
   return {
-    items: rows.flatMap((item) =>
-      item.id ? [{ id: item.id, title: item.title, status: item.status }] : [],
+    notes: rows.flatMap((note) =>
+      note.id ? [{ id: note.id, title: note.title, body: note.body }] : [],
     ),
   };
 };
@@ -237,8 +236,8 @@ export const load: PageServerLoad = async ({ depends, locals }) => {
 
 The page receives that data through `$props()`. Do not fetch initial page data
 from `onMount` or `$effect`; SvelteKit already serialized it into the response.
-After a mutation, call `invalidate('smrt:items')`. Only loads that declared
-`depends('smrt:items')` re-run.
+After a mutation, call `invalidate('smrt:notes')`. Only loads that declared
+`depends('smrt:notes')` re-run.
 
 ## 8. Use generated REST, MCP, WebMCP, and CLI interfaces
 
@@ -256,8 +255,8 @@ include malformed manifest content.
 
 The option stages `src/routes/api/mcp/+server.ts`, one
 `mountMcpAppRoute({ runtime, ... })` call from
-`@happyvertical/smrt-app-mcp/sveltekit` that publishes `Item` to
-principals holding `items.read` (the signed session's permissions locally),
+`@happyvertical/smrt-app-mcp/sveltekit` that publishes `Note` to
+principals holding `notes.read` (the signed session's permissions locally),
 refuses browser requests from a foreign `Origin`, and serves a bounded static
 resource with a restrictive CSP and the optional OpenAI display metadata. It
 also stages the protected-resource metadata route. For a view, mount
@@ -273,20 +272,20 @@ request nor grants tenant or workflow authority. Register `.app.json` only
 after the host creates an eligible server ID; do not copy runtime extension
 metadata into the portable manifest.
 
-The Item configuration generates:
+The Note configuration generates:
 
-- REST: `GET`/`POST /api/items` and
-  `GET`/`PUT`/`DELETE /api/items/[id]`.
-- MCP descriptors and tools for Item CRUD.
+- REST: `GET`/`POST /api/notes` and
+  `GET`/`PUT`/`DELETE /api/notes/[id]`.
+- MCP descriptors and tools for Note CRUD.
 - Web collection definitions in the virtual
   `@happyvertical/smrt-virt-web` module.
-- CLI commands for Item CRUD.
+- CLI commands for Note CRUD.
 
 Inspect the registered objects and use the example CLI:
 
 ```bash
 pnpm smrt objects
-pnpm smrt schema Item
+pnpm smrt schema Note
 ```
 
 The CLI's manifest-only `objects` and `schema` commands work directly in this
@@ -372,12 +371,12 @@ hydrated rows so the first render does not issue a duplicate request:
 
   let { data }: PageProps = $props();
 
-  const items = createSmrtCollection(getCollectionDefinition('items'), {
+  const notes = createSmrtCollection(getCollectionDefinition('notes'), {
     basePath: '/api',
-    initialData: data.items,
+    initialData: data.notes,
     staleTimeMs: 30_000,
   });
-  const view = liveCollection(items);
+  const view = liveCollection(notes);
 </script>
 
 {#each view.rows as item (item.id)}
@@ -441,7 +440,7 @@ the signed browser session. The other is an owner-minted bearer token for a
 local MCP client such as Claude Desktop through `smrt-mcp-bridge`:
 
 ```bash
-pnpm exec smrt app token --scopes items.read --label "Claude Desktop"
+pnpm exec smrt app token --scopes notes.read --label "Claude Desktop"
 pnpm exec smrt app token list
 pnpm exec smrt app token revoke <id>
 ```

package/template/package.json

@@ -39,19 +39,19 @@
     "svelte-check": "^4.7.6",
     "typescript": "6.0.3",
     "vite": "8.3.0",
-    "@happyvertical/smrt-cli": "^0.55.16"
+    "@happyvertical/smrt-cli": "^0.55.18"
   },
   "dependencies": {
-    "@happyvertical/smrt-app-runtime": "^0.55.16",
-    "@happyvertical/smrt-config": "^0.55.16",
-    "@happyvertical/smrt-core": "^0.55.16",
-    "@happyvertical/smrt-jobs": "^0.55.16",
-    "@happyvertical/smrt-profiles": "^0.55.16",
-    "@happyvertical/smrt-svelte": "^0.55.16",
-    "@happyvertical/smrt-tenancy": "^0.55.16",
-    "@happyvertical/smrt-ui": "^0.55.16",
-    "@happyvertical/smrt-users": "^0.55.16",
-    "@happyvertical/smrt-web": "^0.55.16",
+    "@happyvertical/smrt-app-runtime": "^0.55.18",
+    "@happyvertical/smrt-config": "^0.55.18",
+    "@happyvertical/smrt-core": "^0.55.18",
+    "@happyvertical/smrt-jobs": "^0.55.18",
+    "@happyvertical/smrt-profiles": "^0.55.18",
+    "@happyvertical/smrt-svelte": "^0.55.18",
+    "@happyvertical/smrt-tenancy": "^0.55.18",
+    "@happyvertical/smrt-ui": "^0.55.18",
+    "@happyvertical/smrt-users": "^0.55.18",
+    "@happyvertical/smrt-web": "^0.55.18",
     "@happyvertical/sql": "^0.89.12",
     "@modelcontextprotocol/server": "^2.0.0"
   }

package/template/src/app.html

@@ -2,7 +2,11 @@
 <html lang="en">
   <head>
     <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+    <meta name="color-scheme" content="light dark" />
+    <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)" />
+    <meta name="theme-color" content="#121212" media="(prefers-color-scheme: dark)" />
+    <link rel="icon" type="image/svg+xml" href="%sveltekit.assets%/favicon.svg" />
     %sveltekit.head%
   </head>
   <body data-sveltekit-preload-data="hover">

package/template/src/lib/objects/Note.ts

@@ -0,0 +1,44 @@
+/**
+ * Example s-m-r-t object.
+ *
+ * This one declaration is the app's data model: the `smrt()` Vite plugin turns
+ * it into the schema, the REST routes under `/api/notes`, the WebMCP read
+ * tools, and the generated CLI/MCP commands. Rename or replace it with your
+ * own objects.
+ */
+
+import {
+  ObjectRegistry,
+  SmrtCollection,
+  SmrtObject,
+  smrt,
+} from '@happyvertical/smrt-core';
+import { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';
+
+@smrt({
+  api: {
+    include: ['list', 'get', 'create', 'update', 'delete'],
+    writable: ['title', 'body'],
+  },
+  cli: { include: ['list', 'get', 'create', 'update', 'delete'] },
+  mcp: { include: ['list', 'get', 'create', 'update', 'delete'] },
+})
+@TenantScoped({ mode: 'required' })
+export class Note extends SmrtObject {
+  /** Tenant rows are isolated automatically by the session's tenant. */
+  @tenantId()
+  tenantId: string = '';
+
+  /** Note title */
+  title: string = '';
+
+  /** Note body */
+  body: string = '';
+}
+
+/** Explicit collection constructor used by generated CLI/MCP/runtime tools. */
+export class NoteCollection extends SmrtCollection<Note> {
+  static readonly _itemClass = Note;
+}
+
+ObjectRegistry.registerCollection('Note', NoteCollection);

package/template/src/lib/objects/index.ts

@@ -5,4 +5,4 @@
  * They will be automatically registered and available for CLI/API/MCP.
  */
 
-export { Item, ItemCollection } from './Item.js';
+export { Note, NoteCollection } from './Note.js';

package/template/src/lib/sign-out.ts

@@ -0,0 +1,19 @@
+import { goto, invalidateAll } from '$app/navigation';
+
+/**
+ * Sign out through the runtime's same-origin `POST /sign-out` route, then
+ * refresh the session-derived layout data and return home. A failed request
+ * (403, 5xx) throws instead of pretending the session ended: the user stays
+ * signed in and the error names the status.
+ */
+export async function signOut(): Promise<void> {
+  const response = await fetch('/sign-out', {
+    method: 'POST',
+    credentials: 'same-origin',
+  });
+  if (!response.ok) {
+    throw new Error(`Sign-out failed with status ${response.status}`);
+  }
+  await invalidateAll();
+  await goto('/');
+}

package/template/src/routes/+layout.svelte

@@ -3,6 +3,7 @@
   import { webMcpToolDefinitions } from '@happyvertical/smrt-virt-web';
   import { AppShell } from '@happyvertical/smrt-svelte/app';
   import type { ShellNavItem } from '@happyvertical/smrt-svelte/workspace';
+  import { signOut } from '$lib/sign-out';
   import type { LayoutProps } from './$types';
 
   let { data, children }: LayoutProps = $props();
@@ -10,8 +11,8 @@
   // Add application routes here. Generated REST routes live under /api and do
   // not automatically imply a human-facing page.
   const nav: ShellNavItem[] = [
-    { href: '/', label: 'Items', description: 'The example s-m-r-t object' },
-    { href: '/settings', label: 'Settings', description: 'Workspace layout and shortcuts' },
+    { href: '/', label: 'Notes', icon: 'book', description: 'Your workspace notes' },
+    { href: '/settings', label: 'Settings', icon: 'settings', description: 'Workspace layout and shortcuts' },
   ];
 
   // Generated read-only WebMCP tools, only in browsers that expose WebMCP.
@@ -24,18 +25,17 @@
 
 <AppShell
   title="s-m-r-t app"
-  subtitle="SvelteKit"
   {webmcp}
   {nav}
   currentHref={page.url.pathname}
   runtimeDiagnostics={data.session.authenticated}
-  tenantLabel={data.session.activeTenantId ? 'Authorized session tenant' : 'No active tenant'}
   settingsHref="/settings"
+  edgeToggles={{ left: true }}
+  config={{ left: { initial: 'expanded' } }}
+  user={data.session.user}
+  onSignOut={signOut}
+  phoneTabBar
+  chrome={!page.route.id?.startsWith('/setup')}
 >
-  {#snippet appPanelDocs()}
-    {#if data.session.selectedTenantSlug}
-      <p>Selected URL tenant: <strong>{data.session.selectedTenantSlug}</strong></p>
-    {/if}
-  {/snippet}
   {@render children()}
 </AppShell>

package/template/src/routes/+page.server.ts

@@ -1,21 +1,21 @@
 import { assertOperationPermission } from '@happyvertical/smrt-users';
 import { fail } from '@sveltejs/kit';
 
-import type { Item } from '$lib/objects/Item';
+import type { Note } from '$lib/objects/Note';
 import { runtime } from '$lib/server/smrt';
 import type { Actions, PageServerLoad } from './$types';
 
-const READ_PERMISSION = 'items.read';
-const CREATE_PERMISSION = 'items.create';
+const READ_PERMISSION = 'notes.read';
+const CREATE_PERMISSION = 'notes.create';
 
-export interface ItemRow {
+export interface NoteRow {
   id: string;
   title: string;
-  status: string;
+  body: string;
 }
 
 export const load: PageServerLoad = async ({ depends, locals }) => {
-  depends('smrt:items');
+  depends('smrt:notes');
 
   const authenticated = Boolean(locals.user);
   const hasTenant = Boolean(locals.tenantId);
@@ -26,8 +26,9 @@ export const load: PageServerLoad = async ({ depends, locals }) => {
 
   if (!canRead) {
     return {
-      items: [] as ItemRow[],
+      notes: [] as NoteRow[],
       canCreate,
+      authenticated,
       loadError: null as string | null,
       accessMessage: !authenticated
         ? 'Sign in before loading tenant data.'
@@ -38,28 +39,30 @@ export const load: PageServerLoad = async ({ depends, locals }) => {
   }
 
   try {
-    const items = await runtime.getCollection<Item>('Item');
-    const rows = await items.list({
+    const notes = await runtime.getCollection<Note>('Note');
+    const rows = await notes.list({
       orderBy: 'created_at DESC',
-      limit: 50,
+      limit: 100,
     });
 
     return {
-      items: rows.flatMap((item): ItemRow[] =>
-        item.id
-          ? [{ id: item.id, title: item.title, status: item.status }]
+      notes: rows.flatMap((note): NoteRow[] =>
+        note.id
+          ? [{ id: note.id, title: note.title, body: note.body }]
           : [],
       ),
       canCreate,
+      authenticated,
       loadError: null as string | null,
       accessMessage: null as string | null,
     };
   } catch (error) {
     return {
-      items: [] as ItemRow[],
+      notes: [] as NoteRow[],
       canCreate,
+      authenticated,
       loadError:
-        error instanceof Error ? error.message : 'Failed to load items',
+        error instanceof Error ? error.message : 'Failed to load notes',
       accessMessage: null as string | null,
     };
   }
@@ -72,9 +75,9 @@ export const actions: Actions = {
     }
 
     const decision = await assertOperationPermission({
-      ...runtime.classOptions('Item'),
+      ...runtime.classOptions('Note'),
       action: 'create',
-      collection: 'items',
+      collection: 'notes',
       onDeny: 'return',
       permissionSet: locals.permissions,
       tenantId: locals.tenantId,
@@ -86,18 +89,20 @@ export const actions: Actions = {
 
     const form = await request.formData();
     const title = String(form.get('title') ?? '').trim();
+    const body = String(form.get('body') ?? '').trim();
     if (!title) {
-      return fail(400, { title, error: 'Title is required.' });
+      return fail(400, { title, body, error: 'A title is required.' });
     }
 
     try {
-      const items = await runtime.getCollection<Item>('Item');
-      await items.create({ title });
+      const notes = await runtime.getCollection<Note>('Note');
+      await notes.create({ title, body });
       return { created: title };
     } catch (error) {
       return fail(500, {
         title,
-        error: error instanceof Error ? error.message : 'Failed to create item',
+        body,
+        error: error instanceof Error ? error.message : 'Failed to create note',
       });
     }
   },

package/template/src/routes/+page.svelte

@@ -1,213 +1,137 @@
 <script lang="ts">
   import { enhance } from '$app/forms';
   import { invalidate } from '$app/navigation';
+  import { Form, FormGroup, Input, Textarea } from '@happyvertical/smrt-ui/forms';
+  import { EmptyState } from '@happyvertical/smrt-ui/layout';
+  import { Button, Card } from '@happyvertical/smrt-ui/ui';
+  import type { SubmitFunction } from '@sveltejs/kit';
+  import { fromAction } from 'svelte/attachments';
   import type { PageProps } from './$types';
 
   let { data, form }: PageProps = $props();
   let creating = $state(false);
+  let title = $state('');
+  let body = $state('');
+  let composing = $state(false);
+
+  // The form shows once the owner has notes, or after "Start your first note".
+  const showForm = $derived(
+    data.canCreate && (data.notes.length > 0 || composing),
+  );
+
+  const submit: SubmitFunction = () => {
+    creating = true;
+    return async ({ result, update }) => {
+      try {
+        await update({ invalidateAll: false, reset: false });
+        if (result.type === 'success') {
+          title = '';
+          body = '';
+          await invalidate('smrt:notes');
+        }
+      } finally {
+        creating = false;
+      }
+    };
+  };
 </script>
 
 <svelte:head>
-  <title>s-m-r-t SvelteKit starter</title>
+  <title>Notes</title>
 </svelte:head>
 
-<div class="page">
-  <header>
-    <p class="eyebrow">s-m-r-t 0.38.25</p>
-    <h1>Learn the application foundation</h1>
-    <p>
-      One object, SQLite defaults, server-loaded data, generated interfaces,
-      session-authorized tenancy, and room to grow.
-    </p>
-  </header>
+<main class="page">
+  <h1>Notes</h1>
 
-  <section>
-    <div class="section-heading">
-      <div>
-        <h2>Items</h2>
-        <p>The initial list comes from <code>+page.server.ts</code>.</p>
-      </div>
-    </div>
-
-    {#if data.loadError}
-      <p class="notice notice--error">{data.loadError}</p>
+  {#if data.loadError}
+    <Card>
+      <p role="alert">{data.loadError}</p>
       <p>Run <code>pnpm db:migrate</code> after changing object fields.</p>
-    {:else if data.accessMessage}
-      <p class="notice">{data.accessMessage}</p>
-    {:else if data.items.length === 0}
-      <p class="notice">No items yet.</p>
+    </Card>
+  {:else if data.accessMessage}
+    <Card>
+      <p>{data.accessMessage}</p>
+      {#if !data.authenticated}
+        <Button href="/setup">Set up this app</Button>
+      {/if}
+    </Card>
+  {:else}
+    {#if showForm}
+      <Card>
+        <Form
+          method="POST"
+          action="?/create"
+          preventDefault={false}
+          {@attach fromAction(enhance, () => submit)}
+        >
+          <FormGroup label="Title" required>
+            <Input name="title" bind:value={title} required />
+          </FormGroup>
+          <FormGroup label="Body">
+            <Textarea name="body" bind:value={body} rows={4} />
+          </FormGroup>
+          {#if form?.error}<p role="alert">{form.error}</p>{/if}
+          <div>
+            <Button type="submit" loading={creating} disabled={creating}>
+              Add note
+            </Button>
+          </div>
+        </Form>
+      </Card>
+    {/if}
+
+    {#if data.notes.length === 0}
+      <EmptyState
+        title="Start your first note"
+        description={data.canCreate
+          ? 'Notes you add show up here for everyone in this workspace.'
+          : 'Notes will show up here once someone adds them.'}
+        actionLabel={data.canCreate && !composing ? 'New note' : undefined}
+        onaction={() => {
+          composing = true;
+        }}
+      />
     {:else}
-      <ul class="items">
-        {#each data.items as item (item.id)}
+      <ul class="notes">
+        {#each data.notes as note (note.id)}
           <li>
-            <strong>{item.title}</strong>
-            <span>{item.status}</span>
+            <Card>
+              <h2>{note.title}</h2>
+              {#if note.body}<p>{note.body}</p>{/if}
+            </Card>
           </li>
         {/each}
       </ul>
     {/if}
-
-    {#if data.canCreate}
-      <form
-        method="POST"
-        action="?/create"
-        use:enhance={() => {
-          creating = true;
-          return async ({ result, update }) => {
-            try {
-              await update({ invalidateAll: false });
-              if (result.type === 'success') {
-                await invalidate('smrt:items');
-              }
-            } finally {
-              creating = false;
-            }
-          };
-        }}
-      >
-        <label for="title">New item</label>
-        <div class="form-row">
-          <input id="title" name="title" placeholder="Write a title" required />
-          <button type="submit" disabled={creating}>
-            {creating ? 'Creating…' : 'Create item'}
-          </button>
-        </div>
-      </form>
-    {/if}
-
-    {#if form?.error}
-      <p class="notice notice--error">{form.error}</p>
-    {/if}
-  </section>
-
-  <section>
-    <h2>Where to extend</h2>
-    <ol>
-      <li>Edit <code>src/lib/objects/Item.ts</code>.</li>
-      <li>Run <code>pnpm db:migrate</code>.</li>
-      <li>Add pages that query collections in <code>+page.server.ts</code>.</li>
-      <li>Add membership-gated login and tenant-switch actions for your app.</li>
-    </ol>
-  </section>
-</div>
+  {/if}
+</main>
 
 <style>
-  .page {
-    display: grid;
-    gap: var(--smrt-spacing-6);
-    width: min(100%, 56rem);
-    margin-inline: auto;
-    padding: var(--smrt-spacing-8);
-  }
-
-  header,
-  section,
-  .section-heading,
-  form {
-    display: grid;
-    gap: var(--smrt-spacing-3);
-  }
-
-  header p,
-  h1,
-  h2,
-  section p {
-    margin: 0;
-  }
-
-  .eyebrow {
-    color: var(--smrt-color-primary);
-    font: var(--smrt-typography-label-large);
-    letter-spacing: 0.08em;
-    text-transform: uppercase;
-  }
-
-  section {
-    padding: var(--smrt-spacing-6);
-    border: 1px solid var(--smrt-color-outline-variant);
-    border-radius: var(--smrt-radius-large);
-    background: var(--smrt-color-surface);
-  }
-
-  .notice {
-    padding: var(--smrt-spacing-3);
-    border-radius: var(--smrt-radius-medium);
-    background: var(--smrt-color-surface-container);
-    color: var(--smrt-color-on-surface-variant);
-  }
-
-  .notice--error {
-    color: var(--smrt-color-error);
-  }
-
-  .items {
-    display: grid;
-    gap: var(--smrt-spacing-2);
-    margin: 0;
-    padding: 0;
-    list-style: none;
-  }
-
-  .items li {
-    display: flex;
-    justify-content: space-between;
-    gap: var(--smrt-spacing-3);
-    padding-block: var(--smrt-spacing-2);
-    border-block-end: 1px solid var(--smrt-color-outline-variant);
-  }
-
-  .items span {
-    color: var(--smrt-color-on-surface-variant);
-  }
-
-  label {
-    font-weight: var(--smrt-typography-weight-semibold);
-  }
-
-  .form-row {
-    display: flex;
-    gap: var(--smrt-spacing-2);
-  }
-
-  input,
-  button {
-    min-height: 2.75rem;
-    padding-inline: var(--smrt-spacing-3);
-    border-radius: var(--smrt-radius-medium);
-    font: inherit;
-  }
-
-  input {
-    flex: 1;
-    border: 1px solid var(--smrt-color-outline);
-    background: var(--smrt-color-surface);
-    color: var(--smrt-color-on-surface);
-  }
-
-  button {
-    border: 0;
-    background: var(--smrt-color-primary);
-    color: var(--smrt-color-on-primary);
-    cursor: pointer;
-  }
-
-  button:disabled {
-    opacity: 0.6;
-    cursor: wait;
-  }
+  @layer smrt.theme {
+    .page {
+      display: grid;
+      gap: var(--smrt-spacing-6);
+      width: min(100%, 48rem);
+      margin-inline: auto;
+      padding: var(--smrt-spacing-6) var(--smrt-spacing-4);
+    }
 
-  code {
-    font-family: var(--smrt-typography-code-font-family, monospace);
-  }
+    .notes {
+      display: grid;
+      gap: var(--smrt-spacing-3);
+      margin: 0;
+      padding: 0;
+      list-style: none;
+    }
 
-  @media (max-width: 42rem) {
-    .page {
-      padding: var(--smrt-spacing-4);
+    h1,
+    h2,
+    p {
+      margin: 0;
     }
 
-    .form-row {
-      align-items: stretch;
-      flex-direction: column;
+    h2 {
+      font: var(--smrt-typography-title-medium);
     }
   }
 </style>

package/template/src/routes/settings/+page.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
   import { ShellSettingsPage } from '@happyvertical/smrt-svelte/app';
+  import { signOut } from '$lib/sign-out';
 </script>
 
 <svelte:head>
@@ -7,4 +8,4 @@
 </svelte:head>
 
 <!-- Panel layout and WASD hotkeys, persisted through the shell's storageKey. -->
-<ShellSettingsPage />
+<ShellSettingsPage onSignOut={signOut} />

package/template/src/routes/setup/+page.svelte

@@ -8,4 +8,4 @@
 
 <svelte:head><title>Set up your local application</title></svelte:head>
 
-<OwnerSetupForm {data} {form} {enhance} />
+<OwnerSetupForm {data} {form} {enhance} title="s-m-r-t app" />

package/template/src/routes/sign-out/+server.ts

@@ -0,0 +1,6 @@
+import { createSignOutHandler } from '@happyvertical/smrt-app-runtime/sveltekit';
+
+import { runtime } from '$lib/server/smrt';
+
+/** POST-only, same-origin: destroys the session and clears its cookie. */
+export const POST = createSignOutHandler(runtime);

package/template/static/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><style>svg{color:#1c1b1f}@media(prefers-color-scheme:dark){svg{color:#e6e1e5}}</style><path d="M6 3h9l4 4v14H6z"/><path d="M14 3v5h5M9 13h7M9 17h5"/></svg>

package/template.config.js

@@ -19,22 +19,22 @@ export default {
 
   // Dependencies to add to generated project
   dependencies: {
-    '@happyvertical/smrt-app-runtime': '^0.55.16',
-    '@happyvertical/smrt-config': '^0.55.16',
-    '@happyvertical/smrt-core': '^0.55.16',
-    '@happyvertical/smrt-jobs': '^0.55.16',
-    '@happyvertical/smrt-profiles': '^0.55.16',
-    '@happyvertical/smrt-svelte': '^0.55.16',
-    '@happyvertical/smrt-tenancy': '^0.55.16',
-    '@happyvertical/smrt-ui': '^0.55.16',
-    '@happyvertical/smrt-users': '^0.55.16',
-    '@happyvertical/smrt-web': '^0.55.16',
+    '@happyvertical/smrt-app-runtime': '^0.55.18',
+    '@happyvertical/smrt-config': '^0.55.18',
+    '@happyvertical/smrt-core': '^0.55.18',
+    '@happyvertical/smrt-jobs': '^0.55.18',
+    '@happyvertical/smrt-profiles': '^0.55.18',
+    '@happyvertical/smrt-svelte': '^0.55.18',
+    '@happyvertical/smrt-tenancy': '^0.55.18',
+    '@happyvertical/smrt-ui': '^0.55.18',
+    '@happyvertical/smrt-users': '^0.55.18',
+    '@happyvertical/smrt-web': '^0.55.18',
     '@happyvertical/sql': '^0.89.12',
     '@modelcontextprotocol/server': '^2.0.0',
   },
 
   devDependencies: {
-    '@happyvertical/smrt-cli': '^0.55.16',
+    '@happyvertical/smrt-cli': '^0.55.18',
     '@sveltejs/adapter-node': '^5.5.7',
     '@sveltejs/kit': '2.70.3',
     '@sveltejs/vite-plugin-svelte': '^7.3.0',

package/template/src/lib/objects/Item.ts

@@ -1,45 +0,0 @@
-/**
- * Example s-m-r-t object.
- *
- * This is a sample SMRT object to demonstrate the pattern.
- * Rename or replace this with your own objects.
- */
-
-import {
-  ObjectRegistry,
-  SmrtCollection,
-  SmrtObject,
-  smrt,
-} from '@happyvertical/smrt-core';
-import { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';
-
-@smrt({
-  api: {
-    include: ['list', 'get', 'create', 'update', 'delete'],
-    writable: ['title', 'description', 'status'],
-  },
-  cli: { include: ['list', 'get', 'create', 'update', 'delete'] },
-  mcp: { include: ['list', 'get', 'create', 'update', 'delete'] },
-})
-@TenantScoped({ mode: 'optional' })
-export class Item extends SmrtObject {
-  /** Null rows are global; tenant rows are isolated automatically. */
-  @tenantId({ nullable: true })
-  tenantId: string | null = null;
-
-  /** Item title */
-  title: string = '';
-
-  /** Item description */
-  description: string = '';
-
-  /** Status of the item */
-  status: string = 'draft';
-}
-
-/** Explicit collection constructor used by generated CLI/MCP/runtime tools. */
-export class ItemCollection extends SmrtCollection<Item> {
-  static readonly _itemClass = Item;
-}
-
-ObjectRegistry.registerCollection('Item', ItemCollection);