@happyvertical/smrt-app-mcp 0.53.3 → 0.53.5

package/AGENTS.md

@@ -22,6 +22,29 @@ tool policy; `./sveltekit` owns the stateless Streamable HTTP transport.
   validates JWT access tokens and requires an application-owned principal mapper.
 - Mount `mountMcpRoute` as one modern `POST` endpoint. It creates a fresh
   protocol server per request, emits no session id, and refuses subscriptions.
+- `mountMcpAppRoute` (`src/defaults.ts` + `./sveltekit`) is the one-call app
+  route: explicit `models` allow-list, required `requiredScopes`, principal from
+  session locals (`principalFromSessionLocals`). App policies compose with the
+  default and may only narrow it. Its `Origin` check (default on; opt-in on
+  `mountMcpRoute`) runs before auth and dispatch; no-`Origin` clients pass.
+  `effects` filters the catalog by `mcpToolEffect` (excluded tools 404).
+  `auth` swaps in bearer principals; `bindPrincipal` runs their dispatch in
+  the app's principal context (RLS transaction), failing closed, and
+  authorizes with the binder's narrowed (live) scopes; task lifecycle calls
+  re-check the originating action against the allow-list and `effects`,
+  after a principal-level `taskPrincipalPolicy` (defaults: scope policy);
+  `mountMcpProtectedResourceMetadataRoute` serves only the advertised path.
+- `createHostedMcpResourceAuth({ profile, runtime })`: locally, a runtime
+  `verifyLocalMcpToken` yields the `sessionFallback` adapter
+  (`createLocalMcpTokenAuth`): no `Authorization` header keeps the session
+  principal; a presented bearer must verify (401, never cookie fallback); no
+  metadata (404). Hosted, `runtime.resolveMcpPrincipal` is the default
+  identity mapping; an explicit `resolvePrincipal` overrides it.
+- Adapters stamp `principal.tenantBinding` for `bindPrincipal`: the local
+  token adapter always `direct`; the JWT adapter the mapping's value or
+  `direct-or-inherited`. Never derive it from request input. Both adapters
+  read principals/mappings from own data only (`own-data.ts`): inherited
+  values, accessors and poison keys deny.
 - Keep tool catalogs private by default. Public caching requires an explicit
   attestation and a global, unauthenticated, read-only, non-tenant catalog with
   no principal-aware policy.

package/README.md

@@ -8,6 +8,160 @@ App-runtime MCP server scaffolding for s-m-r-t apps. Provides:
   `mountMcpToolsRoute` / `mountMcpCallRoute` aliases remain available for one
   release while applications migrate.
 
+## One-call app route
+
+Most applications need no server helper module. `mountMcpAppRoute` builds the
+server from the app's own declared models, maps the request principal from the
+SvelteKit session locals populated by `createSessionHandler`
+(`@happyvertical/smrt-users/sveltekit`), and mounts the stateless endpoint:
+
+```ts
+// src/routes/api/mcp/+server.ts
+import { mountMcpAppRoute } from '@happyvertical/smrt-app-mcp/sveltekit';
+import { Item } from '$lib/objects/Item';
+// The app's `createSmrtSvelteKitRuntime()` (@happyvertical/smrt-app-runtime/sveltekit).
+import { runtime } from '$lib/server/smrt';
+
+export const POST = mountMcpAppRoute({
+  models: [Item],
+  requiredScopes: ['items.read'],
+  // Per request: under RLS this is the request's transaction-bound database.
+  smrtOptions: () => ({ db: runtime.databaseConfig() }),
+});
+```
+
+- **Allow-list** — exactly the `models` listed (registered `@smrt()`
+  constructors; anything else throws at construction). Other registered
+  models are never enumerated; direct calls to them return the unknown-tool
+  error (404 semantics).
+- **Principal** — `principalFromSessionLocals` reads only `locals.user.id`, the
+  session-authorized `locals.tenantId`, and `locals.permissions` (as sorted
+  `scopes`, `kind: 'human'`). Missing or malformed fields mean unauthenticated.
+  URL-selected tenants, headers and bodies are never identity inputs. Override
+  with `resolvePrincipal`.
+- **Policy** — `requiredScopes` is required: every authenticated principal must
+  be an accepted kind (`principalKinds`, default `['human']`) with an id, a
+  tenant, and every listed scope, for every tool and resource. Unauthenticated
+  callers keep the base rule (only `publicToolPatterns` read-only tools; none by
+  default) and mutating tools always need a principal. A supplied `toolPolicy`
+  or `resourcePolicy` is composed with this default and can only narrow it;
+  for a wider policy, call `createMcpAppServer` and `mountMcpRoute` directly.
+  Because the default is principal-aware, `tools/list` stays `private` even
+  with a public-cache attestation. A scope applies uniformly to every
+  published tool, so a read scope such as `items.read` must be paired with
+  `effects: ['read']` (below) unless the app adds per-operation policy.
+- **Effects** — `effects` (also on `createMcpAppServer`) limits the catalog to
+  tools whose effect is listed: `'read'`, `'write'`, `'destructive'`, the
+  WebMCP vocabulary. `mcpToolEffect` classifies with the existing read-only
+  detection (canonical `readOnlyHint`, else the `_list`/`_get` name rule); any
+  other tool is `destructive` unless it declares `destructiveHint: false`.
+  Excluded tools are absent from `tools/list`, and a direct call gets the same
+  unknown-tool error as a nonexistent name, so they cannot be enumerated.
+  Omitted, every allow-listed tool is published (unchanged behaviour).
+  Durable task lifecycle calls (`tasks/get`, `tasks/update`, `tasks/cancel`)
+  re-apply the allow-list and `effects` filter to the task's originating
+  action, the generated tool for the class (simple or qualified name) and
+  method its job persists; a task whose action is excluded, or maps to no
+  allow-listed generated tool, is answered exactly like an unknown task.
+  `toolPolicy` is not re-applied to lifecycle calls: a task created by an
+  application workflow does not record which workflow created it, and such
+  workflows often front a policy-hidden generated task tool. Owner and tenant
+  scoping apply to every lifecycle call. Principal-level authority is checked
+  first, before the task store is touched: `createDefaultMcpAppServer` (and so
+  `mountMcpAppRoute`) gates every lifecycle call on its principal scope policy
+  — accepted kind, id, tenant and every `requiredScopes` entry, evaluated on
+  the *effective* bound principal — so a bearer whose live permissions were
+  revoked cannot read, resume (supply input to) or cancel an existing task;
+  restoring the permission restores access. A custom `createMcpAppServer`
+  supplies the same gate with `taskPrincipalPolicy({ principal })`; without
+  it, a custom `toolPolicy` is not applied to lifecycle calls. A denial or a
+  thrown predicate is answered as an unknown task.
+- **Server** — `serverInfo` defaults to `{ name: 'smrt-app', version: '0.1.0' }`;
+  every other `createMcpAppServer` option (`workflowTools`, `resources`,
+  `workflowAssertions`, `toolListCache`, …) passes through. The handler's
+  `server` property exposes the policy core. The same defaults are available
+  without SvelteKit as `createDefaultMcpAppServer` from the root entry.
+
+- **Origin check** — on by default (`checkOrigin`). Before bearer
+  authentication, principal resolution or any dispatch, a request whose
+  `Origin` is present but is not the request URL's own origin (exact scheme,
+  host and port) or one of `trustedOrigins` — including `Origin: null` and
+  sibling subdomains — gets HTTP 403 with the JSON-RPC error data
+  `{ code: 'mcp_origin_denied', retryable: false }`, naming no origins. With
+  no `Origin`, a `Sec-Fetch-Site` of `cross-site`/`same-site` is also
+  refused. Clients that send no browser origin signals (server-side MCP
+  clients, the `smrt-app-cli` bridge) are unaffected; a browser-hosted MCP
+  client must be listed in `trustedOrigins`. Bearer requests are checked too:
+  the token is not ambient authority, but the MCP Streamable HTTP transport
+  requires origin validation and server-side remote clients send no `Origin`.
+  "Own origin" is `event.url`, so behind a rewriting proxy configure the
+  SvelteKit adapter's origin (adapter-node `ORIGIN`, or its
+  `PROTOCOL_HEADER`/`HOST_HEADER`) or add the public origin to
+  `trustedOrigins`; this package never reads `X-Forwarded-*`.
+  `checkOrigin: false` opts out. `mountMcpRoute` accepts the same options,
+  off unless set.
+
+Bearer authentication for hosted profiles is an `auth` option on both
+`mountMcpRoute` and `mountMcpAppRoute`. When its source yields an adapter,
+every request must carry a valid bearer token and the adapter's principal
+replaces the session principal; `null` (the `local` profile) keeps the session
+principal. Pass `bindPrincipal` (for example `runtime.runAsPrincipal` from
+`@happyvertical/smrt-app-runtime/sveltekit`) so that, after bearer
+authentication, the `smrtOptions` database thunk, task handling and tool
+execution all run inside a context bound to that principal: under
+`database-rls` the runtime opens a fresh RLS transaction publishing the bearer
+user, tenant and its live membership permissions capped by the token's scopes,
+instead of the anonymous (or a cookie user's) request transaction. The binder
+hands dispatch the principal's effective scopes (`runAsPrincipal` passes the
+token scopes still granted by live permissions), and the tool policy
+authorizes with those, intersected with the token's: a revoked permission
+denies the tool before dispatch even under `application` isolation, while the
+principal keeps the tools its remaining permissions allow. A binder can never
+widen scopes or change the principal's id or tenant. A binder
+that fails before dispatch answers HTTP 403 with the safe
+`mcp_tool_access_denied` error; the response is materialized inside the
+binding. `createHostedMcpResourceAuth` from `./auth` builds that source from
+`SMRT_MCP_RESOURCE`, `SMRT_MCP_ISSUER`, `SMRT_MCP_JWKS_URI` and
+`SMRT_MCP_SCOPES`, caching one adapter and retrying a failed construction:
+
+```ts
+import { createHostedMcpResourceAuth } from '@happyvertical/smrt-app-mcp/auth';
+const { profile } = await runtime.resolvedRuntime();
+// `runtime` supplies both credential bindings (see below); pass
+// `resolvePrincipal` as well to override the hosted identity mapping.
+const auth = createHostedMcpResourceAuth({ profile, runtime });
+// api/mcp/+server.ts
+export const POST = mountMcpAppRoute({
+  models: [Item], requiredScopes: ['items.read'], effects: ['read'],
+  smrtOptions, auth, bindPrincipal: runtime.runAsPrincipal,
+});
+// .well-known/oauth-protected-resource/api/mcp/+server.ts
+export const GET = mountMcpProtectedResourceMetadataRoute(auth);
+```
+
+The `runtime` option takes any object with the optional
+`verifyLocalMcpToken(token)` and `resolveMcpPrincipal(identity)` methods; the
+s-m-r-t SvelteKit runtime has both.
+
+- **Local profile.** With `verifyLocalMcpToken`, the source yields the
+  `createLocalMcpTokenAuth` adapter for owner-minted tokens
+  (`smrt app token --scopes items.read`). A request with no `Authorization`
+  header keeps the session principal, exactly as before. A presented bearer
+  must verify: an unknown, revoked or expired token is a bare 401
+  (`WWW-Authenticate: Bearer error="invalid_token"`) and never falls back to
+  the cookie. The origin check still runs first. Without the runtime the
+  source yields `null`, as before.
+- **Hosted profiles.** Without `resolvePrincipal`, the runtime's
+  membership-backed `resolveMcpPrincipal` maps the verified issuer/subject to
+  a user linked through `oidc_identities` with exactly one active tenant
+  membership, and denies anything else. Pass `resolvePrincipal` when users
+  belong to several tenants.
+
+`mountMcpProtectedResourceMetadataRoute` serves the RFC 9728 document only at
+the adapter's advertised `metadataUrl` path. It returns 404 for any other
+path, and in the `local` profile (no adapter, or the local token adapter). It
+does not implement an OAuth authorization server.
+
 For piping a deployed app's MCP surface to a local stdio MCP client, see `@happyvertical/smrt-app-cli` — the client-side runtime CLI exposes a `startMcpBridge()` default and a generic `smrt-mcp-bridge` bin.
 
 For public deployments, follow the

package/dist/auth.d.ts

@@ -1,6 +1,6 @@
 /** Server-only OAuth protected-resource boundary. This is not an issuer. */
 import { type JWTPayload } from 'jose';
-import type { McpAppPrincipal } from './server.js';
+import type { McpAppPrincipal, McpTenantBinding } from './server.js';
 export type McpDeploymentProfile = 'local' | 'self-hosted' | 'cloud';
 export interface McpVerifiedIdentity {
     readonly issuer: string;
@@ -13,6 +13,12 @@ export interface McpPrincipalMapping {
     tenantId?: string;
     kind?: string;
     roles?: string[];
+    /**
+     * How the mapped tenant authority may be bound. Defaults to
+     * `direct-or-inherited`; a mapping that selected a direct membership
+     * returns `direct` so inheritance can never substitute for it.
+     */
+    tenantBinding?: McpTenantBinding;
 }
 export interface McpResourceAuthOptions {
     profile: McpDeploymentProfile;
@@ -35,9 +41,21 @@ export interface McpResourceAuthOptions {
     resolvePrincipal(identity: McpVerifiedIdentity): Promise<McpPrincipalMapping | null>;
 }
 export interface McpResourceAuth {
-    /** Mount GET at this URL. Paths use RFC 9728's well-known path insertion. */
+    /**
+     * Mount GET at this URL. Paths use RFC 9728's well-known path insertion.
+     * Empty for a {@link McpResourceAuth.sessionFallback} adapter, which
+     * advertises no OAuth metadata.
+     */
     readonly metadataUrl: string;
     metadataResponse(): Response;
+    /**
+     * When `true`, a request that carries no `Authorization` header is not
+     * challenged: the route resolves its session principal instead (today's
+     * local-profile behaviour). A presented bearer must still verify; an
+     * invalid one is refused and never falls back to the session. Only the
+     * local owner-token adapter ({@link createLocalMcpTokenAuth}) sets it.
+     */
+    readonly sessionFallback?: boolean;
     /** A failure response contains no token, claims or upstream error details. */
     authenticate(request: Request): Promise<{
         ok: true;
@@ -49,5 +67,99 @@ export interface McpResourceAuth {
         response: Response;
     }>;
 }
+/**
+ * Credential bindings an application runtime can supply to
+ * {@link createHostedMcpResourceAuth}, structurally satisfied by the SMRT
+ * SvelteKit runtime from `@happyvertical/smrt-app-runtime/sveltekit`.
+ */
+/**
+ * A verified local-token principal as a runtime returns it. Its `scopes` may
+ * be a frozen (readonly) array; the adapter copies it.
+ */
+export type McpLocalTokenPrincipal = Omit<McpAppPrincipal, 'scopes'> & {
+    id: string;
+    scopes?: readonly string[];
+};
+export interface McpAuthRuntime {
+    /**
+     * Verify an owner-minted local MCP token (`smrt app token`). Resolve the
+     * token principal (with scopes already capped to live permissions), or
+     * `null` to deny. Used only in the `local` profile.
+     */
+    verifyLocalMcpToken?(token: string): Promise<McpLocalTokenPrincipal | null>;
+    /**
+     * Default hosted identity mapping, used when no explicit
+     * `resolvePrincipal` is given (for example the runtime's membership-backed
+     * resolver).
+     */
+    resolveMcpPrincipal?(identity: McpVerifiedIdentity): Promise<McpPrincipalMapping | null>;
+}
+/** Options for {@link createLocalMcpTokenAuth}. */
+export interface LocalMcpTokenAuthOptions {
+    /**
+     * Resolve a presented token to its principal, or `null` to deny. A thrown
+     * error is also a denial. The principal needs a non-empty `id` and
+     * `tenantId` and string `scopes`; `allowCrossTenant` is never honoured.
+     */
+    verify(token: string): Promise<McpLocalTokenPrincipal | null>;
+}
+/**
+ * Bearer adapter for owner-minted local MCP tokens. It is a
+ * {@link McpResourceAuth.sessionFallback} adapter: without an `Authorization`
+ * header the route keeps its session principal; with one, the token must
+ * verify, otherwise the response is `401` with
+ * `WWW-Authenticate: Bearer error="invalid_token"` and no token, claim or
+ * upstream detail. It advertises no OAuth metadata (the metadata route 404s).
+ */
+export declare function createLocalMcpTokenAuth(options: LocalMcpTokenAuthOptions): McpResourceAuth;
+/** Options for {@link createHostedMcpResourceAuth}. */
+export interface HostedMcpResourceAuthOptions {
+    /**
+     * Deployment profile, or a thunk read on every call. `local` disables bearer
+     * authentication; the route then uses its session principal.
+     */
+    profile: McpDeploymentProfile | (() => McpDeploymentProfile);
+    /**
+     * Application-owned mapping from a verified identity to a current account
+     * and active membership; token claims never select a tenant. Overrides
+     * `runtime.resolveMcpPrincipal`. A hosted profile with neither throws on
+     * first use.
+     */
+    resolvePrincipal?: McpResourceAuthOptions['resolvePrincipal'];
+    /**
+     * The application runtime (for example the SMRT SvelteKit runtime). In the
+     * `local` profile its `verifyLocalMcpToken` turns on owner-minted bearer
+     * tokens through {@link createLocalMcpTokenAuth} (requests without a
+     * bearer keep the session principal); without it the thunk yields `null`
+     * as before. In hosted profiles its membership-backed
+     * `resolveMcpPrincipal` is the default identity mapping.
+     */
+    runtime?: McpAuthRuntime;
+    /** Environment source. Defaults to `process.env`, read lazily. */
+    env?: Readonly<Record<string, string | undefined>>;
+    /** Default `['RS256']`. */
+    algorithms?: McpResourceAuthOptions['algorithms'];
+    tokenType?: McpResourceAuthOptions['tokenType'];
+    requireTenant?: McpResourceAuthOptions['requireTenant'];
+}
+/** Environment variables read by {@link createHostedMcpResourceAuth}. */
+export declare const HOSTED_MCP_AUTH_ENV: Readonly<{
+    resource: "SMRT_MCP_RESOURCE";
+    issuer: "SMRT_MCP_ISSUER";
+    jwksUri: "SMRT_MCP_JWKS_URI";
+    scopes: "SMRT_MCP_SCOPES";
+}>;
+/**
+ * Lazily build the hosted protected-resource adapter from operator
+ * environment. The returned thunk yields `null` for the `local` profile,
+ * otherwise one cached `createMcpResourceAuth` instance configured from
+ * `SMRT_MCP_RESOURCE`, `SMRT_MCP_ISSUER`, `SMRT_MCP_JWKS_URI` and the
+ * whitespace-separated `SMRT_MCP_SCOPES`. Missing configuration throws (fail
+ * closed); a failed construction is not cached, so a corrected environment
+ * is picked up on the next request. Pass the thunk as the `auth` option of
+ * `mountMcpRoute`/`mountMcpAppRoute` and to
+ * `mountMcpProtectedResourceMetadataRoute`.
+ */
+export declare function createHostedMcpResourceAuth(options: HostedMcpResourceAuthOptions): () => McpResourceAuth | null;
 export declare function createMcpResourceAuth(options: McpResourceAuthOptions): McpResourceAuth;
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,OAAO,EAAsB,KAAK,UAAU,EAAa,MAAM,MAAM,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,aAAa,GAAG,OAAO,CAAC;AACrE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;CACvC;AACD,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AACD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;IAC3C,qFAAqF;IACrF,SAAS,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC7B,gFAAgF;IAChF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,gBAAgB,CACd,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CACxC;AAqCD,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gBAAgB,IAAI,QAAQ,CAAC;IAC7B,8EAA8E;IAC9E,YAAY,CACV,OAAO,EAAE,OAAO,GACf,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,eAAe,GAAG;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GACzD;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CACpC,CAAC;CACH;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAC9B,eAAe,CA0HjB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,OAAO,EAAsB,KAAK,UAAU,EAAa,MAAM,MAAM,CAAC;AAEtE,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAErE,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,aAAa,GAAG,OAAO,CAAC;AACrE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;CACvC;AACD,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAGD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;IAC3C,qFAAqF;IACrF,SAAS,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC7B,gFAAgF;IAChF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,gBAAgB,CACd,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CACxC;AAqCD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gBAAgB,IAAI,QAAQ,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,8EAA8E;IAC9E,YAAY,CACV,OAAO,EAAE,OAAO,GACf,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,eAAe,GAAG;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GACzD;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CACpC,CAAC;CACH;AAED;;;;GAIG;AACH;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,GAAG;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC5E;;;;OAIG;IACH,mBAAmB,CAAC,CAClB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CACxC;AAED,mDAAmD;AACnD,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;CAC/D;AAID;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,wBAAwB,GAChC,eAAe,CAkEjB;AAED,uDAAuD;AACvD,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,OAAO,EAAE,oBAAoB,GAAG,CAAC,MAAM,oBAAoB,CAAC,CAAC;IAC7D;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAC9D;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,kEAAkE;IAClE,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACnD,2BAA2B;IAC3B,UAAU,CAAC,EAAE,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAClD,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAChD,aAAa,CAAC,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;CACzD;AAED,yEAAyE;AACzE,eAAO,MAAM,mBAAmB;;;;;EAK9B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,MAAM,eAAe,GAAG,IAAI,CAqD9B;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAC9B,eAAe,CA4IjB"}

package/dist/auth.js

@@ -697,7 +697,44 @@ function createRemoteJWKSet(url, options) {
 	});
 }
 //#endregion
+//#region src/own-data.ts
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function readOwnFields(value, keys) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) return null;
+	for (const key of Reflect.ownKeys(value)) if (typeof key === "string" && FORBIDDEN_KEYS.has(key)) return null;
+	const fields = /* @__PURE__ */ Object.create(null);
+	for (const key of keys) {
+		const descriptor = Reflect.getOwnPropertyDescriptor(value, key);
+		if (!descriptor) continue;
+		if (!("value" in descriptor)) return null;
+		fields[key] = descriptor.value;
+	}
+	return fields;
+}
+function ownStringArray(value) {
+	if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype) return null;
+	const length = value.length;
+	for (const key of Reflect.ownKeys(value)) {
+		if (key === "length") continue;
+		if (typeof key !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(key) || Number(key) >= length) return null;
+	}
+	const copy = [];
+	for (let index = 0; index < length; index += 1) {
+		const descriptor = Reflect.getOwnPropertyDescriptor(value, index);
+		if (!descriptor || !("value" in descriptor) || typeof descriptor.value !== "string") return null;
+		copy.push(descriptor.value);
+	}
+	return copy;
+}
+//#endregion
 //#region src/auth.ts
+var TENANT_BINDINGS = ["direct", "direct-or-inherited"];
 var scopePattern = /^[\x21\x23-\x5b\x5d-\x7e]+$/u;
 function validateUrl(value, profile) {
 	let url;
@@ -717,6 +754,99 @@ function validateUrl(value, profile) {
 function validString(value) {
 	return typeof value === "string" && value.length > 0 && value.length <= 1024 && value.trim() === value && [...value].every((character) => character.charCodeAt(0) > 31 && character.charCodeAt(0) !== 127);
 }
+var LOCAL_BEARER_PATTERN = /^Bearer +([A-Za-z0-9._~+/-]{16,512}=*)$/iu;
+function createLocalMcpTokenAuth(options) {
+	const verify = options?.verify;
+	if (typeof verify !== "function") throw new TypeError("Local MCP token auth requires a verify function.");
+	const deny = () => ({
+		ok: false,
+		response: new Response(null, {
+			status: 401,
+			headers: {
+				"WWW-Authenticate": "Bearer error=\"invalid_token\"",
+				"Cache-Control": "no-store"
+			}
+		})
+	});
+	return Object.freeze({
+		metadataUrl: "",
+		sessionFallback: true,
+		metadataResponse: () => new Response(null, {
+			status: 404,
+			headers: { "Cache-Control": "no-store" }
+		}),
+		async authenticate(request) {
+			const match = LOCAL_BEARER_PATTERN.exec(request.headers.get("authorization") ?? "");
+			if (!match) return deny();
+			let principal;
+			try {
+				principal = await verify(match[1]);
+			} catch {
+				return deny();
+			}
+			const fields = readOwnFields(principal, [
+				"id",
+				"tenantId",
+				"kind",
+				"scopes"
+			]);
+			const scopes = fields ? ownStringArray(fields.scopes) : null;
+			if (!fields || !scopes || !validString(fields.id) || !validString(fields.tenantId) || fields.kind !== void 0 && !validString(fields.kind) || !scopes.every((scope) => scopePattern.test(scope))) return deny();
+			return {
+				ok: true,
+				principal: {
+					id: fields.id,
+					tenantId: fields.tenantId,
+					kind: fields.kind,
+					scopes,
+					tenantBinding: "direct"
+				}
+			};
+		}
+	});
+}
+var HOSTED_MCP_AUTH_ENV = Object.freeze({
+	resource: "SMRT_MCP_RESOURCE",
+	issuer: "SMRT_MCP_ISSUER",
+	jwksUri: "SMRT_MCP_JWKS_URI",
+	scopes: "SMRT_MCP_SCOPES"
+});
+function createHostedMcpResourceAuth(options) {
+	let cached;
+	let local;
+	const runtime = options.runtime;
+	return () => {
+		const profile = typeof options.profile === "function" ? options.profile() : options.profile;
+		if (profile === "local") {
+			const verify = runtime?.verifyLocalMcpToken;
+			if (typeof verify !== "function") return null;
+			local ??= createLocalMcpTokenAuth({ verify: (token) => verify.call(runtime, token) });
+			return local;
+		}
+		if (cached) return cached;
+		const env = options.env ?? globalThis.process?.env ?? {};
+		const required = (name) => {
+			const value = env[name]?.trim();
+			if (!value) throw new Error(`Hosted MCP requires ${name}.`);
+			return value;
+		};
+		const runtimeResolver = runtime?.resolveMcpPrincipal;
+		const resolvePrincipal = options.resolvePrincipal ?? (typeof runtimeResolver === "function" ? (identity) => runtimeResolver.call(runtime, identity) : void 0);
+		if (!resolvePrincipal) throw new Error("Hosted MCP requires an application-owned resolvePrincipal binding or a runtime with resolveMcpPrincipal.");
+		cached = createMcpResourceAuth({
+			profile,
+			resource: required(HOSTED_MCP_AUTH_ENV.resource),
+			issuer: required(HOSTED_MCP_AUTH_ENV.issuer),
+			jwksUri: required(HOSTED_MCP_AUTH_ENV.jwksUri),
+			scopes: required(HOSTED_MCP_AUTH_ENV.scopes).split(/\s+/u),
+			algorithms: options.algorithms ?? ["RS256"],
+			tokenType: options.tokenType,
+			requireTenant: options.requireTenant,
+			resolvePrincipal
+		});
+		return cached;
+	};
+}
 function createMcpResourceAuth(options) {
 	if (![
 		"local",
@@ -786,21 +916,29 @@ function createMcpResourceAuth(options) {
 				const granted = payload.scope === "" ? [] : payload.scope.split(" ");
 				if (granted.some((scope) => !scopePattern.test(scope))) return deny("invalid_token");
 				if (scopes.some((scope) => !granted.includes(scope))) return deny("insufficient_scope");
-				const mapping = await resolvePrincipal(Object.freeze({
+				const fields = readOwnFields(await resolvePrincipal(Object.freeze({
 					issuer,
 					subject: payload.sub,
 					scopes: Object.freeze([...granted]),
 					claims: Object.freeze(payload)
-				}));
-				if (!mapping || !validString(mapping.id) || requireTenant && !validString(mapping.tenantId) || mapping.tenantId !== void 0 && !validString(mapping.tenantId) || mapping.kind !== void 0 && !validString(mapping.kind) || mapping.roles !== void 0 && (!Array.isArray(mapping.roles) || !mapping.roles.every(validString))) return deny("invalid_token");
+				})), [
+					"id",
+					"tenantId",
+					"kind",
+					"roles",
+					"tenantBinding"
+				]);
+				const roles = fields?.roles === void 0 ? void 0 : ownStringArray(fields.roles);
+				if (!fields || roles === null || !validString(fields.id) || requireTenant && !validString(fields.tenantId) || fields.tenantId !== void 0 && !validString(fields.tenantId) || fields.kind !== void 0 && !validString(fields.kind) || roles !== void 0 && !roles.every(validString) || fields.tenantBinding !== void 0 && (typeof fields.tenantBinding !== "string" || !TENANT_BINDINGS.includes(fields.tenantBinding))) return deny("invalid_token");
 				return {
 					ok: true,
 					principal: {
-						id: mapping.id,
-						tenantId: mapping.tenantId,
-						kind: mapping.kind,
-						roles: mapping.roles ? [...mapping.roles] : void 0,
-						scopes: [...granted]
+						id: fields.id,
+						tenantId: fields.tenantId,
+						kind: fields.kind,
+						roles,
+						scopes: [...granted],
+						tenantBinding: fields.tenantBinding ?? "direct-or-inherited"
 					}
 				};
 			} catch {
@@ -810,6 +948,6 @@ function createMcpResourceAuth(options) {
 	};
 }
 //#endregion
-export { createMcpResourceAuth };
+export { HOSTED_MCP_AUTH_ENV, createHostedMcpResourceAuth, createLocalMcpTokenAuth, createMcpResourceAuth };
 
 //# sourceMappingURL=auth.js.map