@happyvertical/smrt-app-mcp 0.53.3 → 0.53.5

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-app-mcp",
-  "packageVersion": "0.53.3",
+  "packageVersion": "0.53.5",
   "objects": {},
   "moduleType": "smrt",
   "smrtDependencies": [

package/dist/own-data.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Own-data reads of application-supplied principal mappings (#3413 review
+ * N1). Inherited values, accessors and prototype-poison keys never become
+ * authority.
+ *
+ * @internal
+ */
+/**
+ * The listed own data fields of a plain object (prototype `Object.prototype`
+ * or `null`) in a null-prototype record, or `null` when `value` is not a
+ * plain object, has an own `__proto__`/`constructor`/`prototype` key, or any
+ * listed field is an accessor. Absent fields are omitted.
+ */
+export declare function readOwnFields(value: unknown, keys: readonly string[]): Record<string, unknown> | null;
+/**
+ * A copy of a dense, plain array of strings read from own data properties,
+ * or `null` for anything else (sparse, subclassed, extra keys, accessors,
+ * non-strings).
+ */
+export declare function ownStringArray(value: unknown): string[] | null;
+//# sourceMappingURL=own-data.d.ts.map

package/dist/own-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"own-data.d.ts","sourceRoot":"","sources":["../src/own-data.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAehC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CA2B9D"}

package/dist/server.d.ts

@@ -18,6 +18,7 @@
 import type { MCPConfig, MCPResponse, MCPTool } from '@happyvertical/smrt-core/generators/mcp';
 import { type McpTask } from '@happyvertical/smrt-jobs';
 import { type McpAppResource, type McpAppResourceContent, type McpAppResourceDefinition, type McpResourcePolicy } from './resources.js';
+import { type McpToolEffect } from './tools.js';
 import { type McpWorkflowToolDefinition } from './workflow-tools.js';
 /**
  * Generic authenticated caller information available to app-MCP policy.
@@ -27,6 +28,13 @@ import { type McpWorkflowToolDefinition } from './workflow-tools.js';
  * application's identity or capability model. A missing principal means the
  * request is unauthenticated.
  */
+/**
+ * How a bearer principal's tenant authority may be established when the
+ * route binds it (`runtime.runAsPrincipal`): `direct` needs an active direct
+ * membership in exactly `tenantId`; `direct-or-inherited` also accepts
+ * authority inherited from an active inheritable ancestor membership.
+ */
+export type McpTenantBinding = 'direct' | 'direct-or-inherited';
 export interface McpAppPrincipal {
     id?: string;
     /** Tenant boundary for task ownership and generated tenant-scoped actions. */
@@ -36,6 +44,12 @@ export interface McpAppPrincipal {
     kind?: string;
     roles?: string[];
     scopes?: string[];
+    /**
+     * Binding mode carried from the authentication adapter, never request
+     * input: local owner tokens are `direct`; hosted access tokens default to
+     * `direct-or-inherited` unless their mapping narrows it.
+     */
+    tenantBinding?: McpTenantBinding;
 }
 /** Minimal legacy user shape used for generated tool-call attribution. */
 export interface McpAppUser extends McpAppPrincipal {
@@ -53,6 +67,15 @@ export interface McpToolPolicyContext {
  * boundary.
  */
 export type McpToolPolicy = (context: McpToolPolicyContext) => boolean | Promise<boolean>;
+/**
+ * Principal-level predicate for durable task lifecycle calls (`tasks/get`,
+ * `tasks/update`, `tasks/cancel`). It receives the authenticated, bound
+ * principal (with effective scopes) and no tool: return `false` to answer
+ * the call as an unknown task. A thrown error is a denial.
+ */
+export type McpTaskPrincipalPolicy = (context: {
+    principal: McpAppPrincipal;
+}) => boolean | Promise<boolean>;
 /**
  * Workflow assertion hook signature. Throw `McpAccessError` to reject the
  * call. Implementations may mutate `args` in place to inject server-trusted
@@ -128,7 +151,25 @@ export interface CreateMcpAppServerOptions {
      * assertion gates before the handler runs.
      */
     workflowTools?: readonly McpWorkflowToolDefinition[];
+    /**
+     * Restrict the catalog to tools whose effect (see `mcpToolEffect`) is
+     * listed, for example `['read']` until per-operation authorization exists.
+     * Excluded tools are absent from discovery and a direct call receives the
+     * same not-found error as an unknown tool, so they cannot be enumerated.
+     * Omitted: every allow-listed tool, regardless of effect.
+     */
+    effects?: readonly McpToolEffect[];
     resources?: readonly McpAppResourceDefinition[];
+    /**
+     * Gate every task lifecycle call (`tasks/get`, `tasks/update`,
+     * `tasks/cancel`) on the calling principal before the task store is
+     * touched; a denial is answered as an unknown task. `toolPolicy` is not
+     * re-applied to lifecycle calls (a task does not yet record the tool that
+     * created it), so a server whose `toolPolicy` encodes principal-level
+     * requirements (scopes, roles, revocation) should restate them here.
+     * `createDefaultMcpAppServer` supplies its principal scope policy.
+     */
+    taskPrincipalPolicy?: McpTaskPrincipalPolicy;
     /** Required for private resources; rechecked on catalog/read, errors deny. */
     resourcePolicy?: McpResourcePolicy;
 }

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EACV,SAAS,EACT,WAAW,EACX,OAAO,EAER,MAAM,yCAAyC,CAAC;AAKjD,OAAO,EACL,KAAK,OAAO,EAGb,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EAEvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,0EAA0E;AAC1E,MAAM,WAAW,UAAW,SAAQ,eAAe;IACjD,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAClC,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,oBAAoB,KAC1B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,EAAE,UAAU,GAAG,IAAI,KACpB,IAAI,CAAC;AAEV;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhE,mEAAmE;AACnE,MAAM,MAAM,0BAA0B,GAAG,MAAM,SAAS,MAAM,EAAE,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,SAAS,GAAG,QAAQ,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAClC;;;OAGG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,WAAW,EAAE,mBAAmB,CAAC;IACjC,oDAAoD;IACpD,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GACvD,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACjC;;;;OAIG;IACH,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IAChD;;;;OAIG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;OAIG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,aAAa,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACrD,SAAS,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAChD,8EAA8E;IAC9E,cAAc,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,2BAA2B;AAC3B,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACnC;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wBAAwB;AACxB,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,4EAA4E;IAC5E,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACnC;;;OAGG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;CAC1B;AAED,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrD,aAAa,CAAC,CAAC,KAAK,EAAE;QACpB,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;KACpC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9B,YAAY,CAAC,CAAC,KAAK,EAAE;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;KACpC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrD,0EAA0E;IAC1E,cAAc,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,yDAAyD;IACzD,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,kDAAkD;IAClD,OAAO,CAAC,CAAC,KAAK,EAAE;QACd,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;KACpC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrB,UAAU,CAAC,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;KACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,UAAU,CAAC,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;KACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,sDAAsD;IACtD,qBAAqB,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxD,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC,YAAY,CAAC,CAAC;CAC9D;AAmDD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GACjC,YAAY,CAmad"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EACV,SAAS,EACT,WAAW,EACX,OAAO,EAER,MAAM,yCAAyC,CAAC;AAKjD,OAAO,EACL,KAAK,OAAO,EAIb,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EAEvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,KAAK,aAAa,EAEnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;GAOG;AACH;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,qBAAqB,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,0EAA0E;AAC1E,MAAM,WAAW,UAAW,SAAQ,eAAe;IACjD,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAClC,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,oBAAoB,KAC1B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE;IAC7C,SAAS,EAAE,eAAe,CAAC;CAC5B,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjC;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,EAAE,UAAU,GAAG,IAAI,KACpB,IAAI,CAAC;AAEV;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhE,mEAAmE;AACnE,MAAM,MAAM,0BAA0B,GAAG,MAAM,SAAS,MAAM,EAAE,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,SAAS,GAAG,QAAQ,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;IAClC;;;OAGG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,WAAW,EAAE,mBAAmB,CAAC;IACjC,oDAAoD;IACpD,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GACvD,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACjC;;;;OAIG;IACH,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IAChD;;;;OAIG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;OAIG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,aAAa,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACrD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAChD;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,sBAAsB,CAAC;IAC7C,8EAA8E;IAC9E,cAAc,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,2BAA2B;AAC3B,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACnC;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wBAAwB;AACxB,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,4EAA4E;IAC5E,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACnC;;;OAGG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;CAC1B;AAED,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrD,aAAa,CAAC,CAAC,KAAK,EAAE;QACpB,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;KACpC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9B,YAAY,CAAC,CAAC,KAAK,EAAE;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;KACpC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrD,0EAA0E;IAC1E,cAAc,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,yDAAyD;IACzD,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtD,kDAAkD;IAClD,OAAO,CAAC,CAAC,KAAK,EAAE;QACd,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;KACpC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrB,UAAU,CAAC,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;KACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,UAAU,CAAC,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;KACpC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,sDAAsD;IACtD,qBAAqB,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxD,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC,YAAY,CAAC,CAAC;CAC9D;AAkED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GACjC,YAAY,CAygBd"}

package/dist/smrt-knowledge.json

@@ -3,13 +3,13 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-app-mcp",
-  "packageVersion": "0.53.3",
+  "packageVersion": "0.53.5",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "72e1d126b3045a39adc26c832b883ae58eefddd49bea66f5a2f4c530b1e14090",
-    "packageJson": "ecadf664928b812213c1cca17e00fb6913dbf6c12fe354a04df619b3e91e1485",
-    "agents": "f249d4732daeb08f865b67237c0da2b166a96f749b1ec6b595f2bb17c24c2d30"
+    "manifest": "c197f498693ff6388bcbf4efcd4e10480efcde3885cf82d98dc07eda8f3a110f",
+    "packageJson": "2efaa45af7ae288ffbc7d78c95e977a805431cf5e7c03662f0b84270ef68bba2",
+    "agents": "9a9a0828eec449ebe5d7c0c36960bf7cf52ba18586e2355bd60782903940d378"
   },
   "exports": [
     ".",
@@ -59,5 +59,5 @@
     "polymorphicAssociations": 0,
     "uuidColumns": 0
   },
-  "agentDoc": "# @happyvertical/smrt-app-mcp\n\nApplication-scoped MCP server wrapper for SMRT apps. The core owns generated\ntool policy; `./sveltekit` owns the stateless Streamable HTTP transport.\n\n## Purpose\n\n- Wraps `@happyvertical/smrt-core` MCP generation with app-level tool allow-lists.\n- Filters unauthenticated tool visibility to public read-only tools.\n- Applies an optional principal-aware policy consistently to discovery and calls.\n- Provides workflow assertions so app servers can reject unsafe or incomplete tool calls before dispatch.\n- Exposes an opt-in durable Tasks extension through `@happyvertical/smrt-jobs`.\n\n## Patterns\n\n- Generate tools from core, then filter by allowed class-name prefixes.\n- Treat list/get tools as read-only; mutating tools require authentication unless the app deliberately wraps them with stronger policy.\n- Keep app policy outside generated tool schemas. The wrapper owns auth, allow-list, and workflow assertion behavior.\n- Return 404 for tools outside the app allow-list so private generated tools are not enumerated by mistake.\n- Trust only a principal supplied by the application adapter. This package\n  does not implement an OAuth authorization server. The opt-in `./auth` entry\n  validates JWT access tokens and requires an application-owned principal mapper.\n- Mount `mountMcpRoute` as one modern `POST` endpoint. It creates a fresh\n  protocol server per request, emits no session id, and refuses subscriptions.\n- Keep tool catalogs private by default. Public caching requires an explicit\n  attestation and a global, unauthenticated, read-only, non-tenant catalog with\n  no principal-aware policy.\n\n## Gotchas\n\n- Public tool patterns are still constrained by read-only detection.\n- Policy errors fail closed and expose only the shared safe denial envelope.\n- Workflow assertions run before generated tool dispatch and should be deterministic.\n- Tasks require a stable authenticated principal id, preserve its tenant boundary,\n  and require the deployment to run a `TaskRunner` for the `mcp-tasks` queue.\n- This package ships no stdio executable. Use `@happyvertical/smrt-app-cli` to\n  bridge a deployed app endpoint to a local MCP client.\n- `mountMcpToolsRoute` and `mountMcpCallRoute` are deprecated REST-shaped\n  compatibility aliases, not MCP transports.\n- This package is runtime app infrastructure, not the development MCP. Use `@happyvertical/smrt-dev-mcp` for agentic development knowledge, review, and architecture tooling.\n"
+  "agentDoc": "# @happyvertical/smrt-app-mcp\n\nApplication-scoped MCP server wrapper for SMRT apps. The core owns generated\ntool policy; `./sveltekit` owns the stateless Streamable HTTP transport.\n\n## Purpose\n\n- Wraps `@happyvertical/smrt-core` MCP generation with app-level tool allow-lists.\n- Filters unauthenticated tool visibility to public read-only tools.\n- Applies an optional principal-aware policy consistently to discovery and calls.\n- Provides workflow assertions so app servers can reject unsafe or incomplete tool calls before dispatch.\n- Exposes an opt-in durable Tasks extension through `@happyvertical/smrt-jobs`.\n\n## Patterns\n\n- Generate tools from core, then filter by allowed class-name prefixes.\n- Treat list/get tools as read-only; mutating tools require authentication unless the app deliberately wraps them with stronger policy.\n- Keep app policy outside generated tool schemas. The wrapper owns auth, allow-list, and workflow assertion behavior.\n- Return 404 for tools outside the app allow-list so private generated tools are not enumerated by mistake.\n- Trust only a principal supplied by the application adapter. This package\n  does not implement an OAuth authorization server. The opt-in `./auth` entry\n  validates JWT access tokens and requires an application-owned principal mapper.\n- Mount `mountMcpRoute` as one modern `POST` endpoint. It creates a fresh\n  protocol server per request, emits no session id, and refuses subscriptions.\n- `mountMcpAppRoute` (`src/defaults.ts` + `./sveltekit`) is the one-call app\n  route: explicit `models` allow-list, required `requiredScopes`, principal from\n  session locals (`principalFromSessionLocals`). App policies compose with the\n  default and may only narrow it. Its `Origin` check (default on; opt-in on\n  `mountMcpRoute`) runs before auth and dispatch; no-`Origin` clients pass.\n  `effects` filters the catalog by `mcpToolEffect` (excluded tools 404).\n  `auth` swaps in bearer principals; `bindPrincipal` runs their dispatch in\n  the app's principal context (RLS transaction), failing closed, and\n  authorizes with the binder's narrowed (live) scopes; task lifecycle calls\n  re-check the originating action against the allow-list and `effects`,\n  after a principal-level `taskPrincipalPolicy` (defaults: scope policy);\n  `mountMcpProtectedResourceMetadataRoute` serves only the advertised path.\n- `createHostedMcpResourceAuth({ profile, runtime })`: locally, a runtime\n  `verifyLocalMcpToken` yields the `sessionFallback` adapter\n  (`createLocalMcpTokenAuth`): no `Authorization` header keeps the session\n  principal; a presented bearer must verify (401, never cookie fallback); no\n  metadata (404). Hosted, `runtime.resolveMcpPrincipal` is the default\n  identity mapping; an explicit `resolvePrincipal` overrides it.\n- Adapters stamp `principal.tenantBinding` for `bindPrincipal`: the local\n  token adapter always `direct`; the JWT adapter the mapping's value or\n  `direct-or-inherited`. Never derive it from request input. Both adapters\n  read principals/mappings from own data only (`own-data.ts`): inherited\n  values, accessors and poison keys deny.\n- Keep tool catalogs private by default. Public caching requires an explicit\n  attestation and a global, unauthenticated, read-only, non-tenant catalog with\n  no principal-aware policy.\n\n## Gotchas\n\n- Public tool patterns are still constrained by read-only detection.\n- Policy errors fail closed and expose only the shared safe denial envelope.\n- Workflow assertions run before generated tool dispatch and should be deterministic.\n- Tasks require a stable authenticated principal id, preserve its tenant boundary,\n  and require the deployment to run a `TaskRunner` for the `mcp-tasks` queue.\n- This package ships no stdio executable. Use `@happyvertical/smrt-app-cli` to\n  bridge a deployed app endpoint to a local MCP client.\n- `mountMcpToolsRoute` and `mountMcpCallRoute` are deprecated REST-shaped\n  compatibility aliases, not MCP transports.\n- This package is runtime app infrastructure, not the development MCP. Use `@happyvertical/smrt-dev-mcp` for agentic development knowledge, review, and architecture tooling.\n"
 }

package/dist/sveltekit.d.ts

@@ -7,12 +7,26 @@
  *
  * @example
  * ```ts
- * // src/routes/api/mcp/+server.ts
+ * // src/routes/api/mcp/+server.ts — one call with the app defaults
+ * import { mountMcpAppRoute } from '@happyvertical/smrt-app-mcp/sveltekit';
+ * import { Item } from '$lib/objects/Item';
+ * export const POST = mountMcpAppRoute({
+ *   models: [Item],
+ *   requiredScopes: ['items.read'],
+ *   smrtOptions: () => ({ db: getDatabaseConfig() }),
+ * });
+ * ```
+ *
+ * @example
+ * ```ts
+ * // src/routes/api/mcp/+server.ts — a custom server core
  * import { mountMcpRoute } from '@happyvertical/smrt-app-mcp/sveltekit';
  * import { mcpServer } from '$lib/server/mcp';
  * export const POST = mountMcpRoute(mcpServer);
  * ```
  */
+import type { McpResourceAuth } from './auth.js';
+import { type CreateDefaultMcpAppServerOptions } from './defaults.js';
 import { type McpProtocolRequestOptions } from './protocol.js';
 import type { McpAppPrincipal, McpAppServer } from './server.js';
 /** Minimal subset of a SvelteKit RequestEvent we actually touch. */
@@ -27,8 +41,104 @@ export type McpSvelteKitHandler = (event: SvelteKitRequestEvent) => Promise<Resp
 export type McpPrincipalResolver = (event: SvelteKitRequestEvent) => McpAppPrincipal | null | undefined;
 /** Backwards-compatible alias for callers that name the principal a user. */
 export type McpUserResolver = McpPrincipalResolver;
+/**
+ * The bearer-authentication surface `mountMcpRoute` and the metadata route
+ * need from `createMcpResourceAuth` (`./auth`). Typed structurally so this
+ * entry does not load the JWT verifier.
+ */
+export type McpRouteResourceAuth = Pick<McpResourceAuth, 'metadataUrl' | 'metadataResponse' | 'authenticate' | 'sessionFallback'>;
+/**
+ * A protected-resource adapter, or a thunk read on every request. A `null` or
+ * `undefined` result (for example the `local` profile) means the route uses
+ * its session principal resolver instead.
+ */
+export type McpRouteResourceAuthSource = McpRouteResourceAuth | null | undefined | (() => McpRouteResourceAuth | null | undefined);
+/**
+ * Project the session hook's request-local result onto an MCP principal.
+ *
+ * Reads only `locals.user.id`, the session-authorized `locals.tenantId`, and
+ * `locals.permissions` as populated by `createSessionHandler` from
+ * `@happyvertical/smrt-users/sveltekit`. Headers, URL-selected tenants
+ * (`locals.selectedTenantId`), request bodies and route arguments are never
+ * identity inputs. Any missing or malformed field yields `null`
+ * (unauthenticated), which fails closed for every non-public tool.
+ */
+export declare function principalFromSessionLocals(event: {
+    locals?: Record<string, unknown>;
+}): McpAppPrincipal | null;
+/**
+ * Run MCP dispatch for a bearer-authenticated principal inside an
+ * application-owned context bound to that principal (for example
+ * `runtime.runAsPrincipal` from `@happyvertical/smrt-app-runtime/sveltekit`,
+ * which opens the principal's permission context and, under `database-rls`,
+ * its RLS transaction). Must call `run` exactly once and return its result;
+ * throwing before `run` (an unbindable principal) is a denial.
+ *
+ * Pass `run` the bound principal carrying its *effective* `scopes` (for
+ * example the token scopes still granted by live membership permissions).
+ * Dispatch then authorizes with those scopes, intersected with the token's:
+ * a binder can only narrow authority, and changing the principal's `id` or
+ * `tenantId` is a denial. Calling `run()` with no argument keeps the token
+ * scopes.
+ */
+export type McpPrincipalBinder = <T>(principal: McpAppPrincipal & {
+    id: string;
+}, run: (bound?: McpBoundPrincipal) => Promise<T>) => Promise<T>;
+/**
+ * The principal a binder hands back to `run`: the authenticated identity,
+ * possibly as a frozen snapshot whose arrays are readonly (for example the
+ * deep-frozen principal `runtime.runAsPrincipal` passes its callback).
+ */
+export type McpBoundPrincipal = Omit<McpAppPrincipal, 'scopes' | 'roles'> & {
+    id: string;
+    scopes?: readonly string[];
+    roles?: readonly string[];
+};
 /** Options shared by both route mounts. */
 export interface MountMcpRouteOptions {
+    /**
+     * Bind a bearer-authenticated principal around dispatch (see
+     * {@link McpPrincipalBinder}). The `smrtOptions` database thunk, task
+     * handling and tool execution all run inside the binding, and the response
+     * is fully materialized before it returns. A binder that throws before
+     * running dispatch, or returns without running it, yields HTTP 403 with the
+     * safe `mcp_tool_access_denied` JSON-RPC error. Scopes the binder hands
+     * back become the effective authority for the tool policy, so live
+     * revocation applies even without a database-enforced policy. Used only when `auth`
+     * authenticated the request; the session-locals path is unchanged.
+     */
+    bindPrincipal?: McpPrincipalBinder;
+    /**
+     * Refuse a modern-endpoint request whose `Origin` header is present but is
+     * neither the request URL's own origin nor in `trustedOrigins` (and, when
+     * `Origin` is absent, one whose `Sec-Fetch-Site` is `cross-site` or
+     * `same-site`). The check runs before bearer authentication, principal
+     * resolution and any task or tool dispatch, and answers 403 with the safe
+     * `mcp_origin_denied` JSON-RPC error. Requests without browser origin
+     * signals (server-side MCP clients, the `smrt-app-cli` stdio bridge) are
+     * unaffected. Off unless set for `mountMcpRoute`; on by default for
+     * `mountMcpAppRoute`. Ignored by the deprecated REST-shaped mounts.
+     */
+    checkOrigin?: boolean;
+    /**
+     * Additional exact origins (`scheme://host[:port]`) accepted by the origin
+     * check, e.g. a browser-hosted MCP client, or the public origin when a
+     * proxy makes `event.url` differ from what browsers send. `null`, wildcards,
+     * paths and credentials are rejected at mount time.
+     */
+    trustedOrigins?: readonly string[];
+    /**
+     * Optional bearer authentication for the modern `mountMcpRoute` endpoint.
+     * When the source yields an adapter, every request must carry a valid
+     * bearer token: a failed check returns the adapter's challenge response
+     * before any dispatch, and the adapter's mapped principal replaces the
+     * session principal (`resolvePrincipal` is not consulted). When it yields
+     * `null`, the route resolves its principal from the request as usual. A
+     * `sessionFallback` adapter (the local owner-token adapter) challenges only
+     * requests that carry an `Authorization` header; others keep the session
+     * principal. Ignored by the deprecated REST-shaped mounts.
+     */
+    auth?: McpRouteResourceAuthSource;
     /** Optional extension discovery projected from the request-authorized tool catalog. */
     extensions?: McpProtocolRequestOptions['extensions'];
     /**
@@ -54,6 +164,55 @@ export interface MountMcpRouteOptions {
  * route holds neither MCP sessions nor request principal state between nodes.
  */
 export declare function mountMcpRoute(server: McpAppServer, options?: MountMcpRouteOptions): McpSvelteKitHandler;
+/** Options for {@link mountMcpAppRoute}. */
+export interface MountMcpAppRouteOptions extends CreateDefaultMcpAppServerOptions, Pick<MountMcpRouteOptions, 'auth' | 'bindPrincipal' | 'extensions' | 'checkOrigin' | 'trustedOrigins'> {
+    /**
+     * Resolve the request principal when no bearer adapter is active. Defaults
+     * to {@link principalFromSessionLocals}.
+     */
+    resolvePrincipal?: McpPrincipalResolver;
+}
+/** A mounted app route; `server` is the policy core it serves. */
+export type McpAppSvelteKitHandler = McpSvelteKitHandler & {
+    readonly server: McpAppServer;
+};
+/**
+ * One-call application MCP endpoint: the app's declared `models`, the default
+ * principal scope policy (see `createDefaultMcpAppServer`), principals from
+ * the SvelteKit session locals, and optional bearer authentication, mounted
+ * as the stateless {@link mountMcpRoute} `POST` endpoint. The origin check
+ * (`checkOrigin`) is on by default because the default principal is an
+ * ambient session cookie; set `trustedOrigins` for extra browser origins or
+ * `checkOrigin: false` to opt out.
+ *
+ * @example
+ * ```ts
+ * // src/routes/api/mcp/+server.ts
+ * import { mountMcpAppRoute } from '@happyvertical/smrt-app-mcp/sveltekit';
+ * import { Item } from '$lib/objects/Item';
+ * import { getDatabaseConfig } from '$lib/server/db';
+ *
+ * export const POST = mountMcpAppRoute({
+ *   models: [Item],
+ *   requiredScopes: ['items.read'],
+ *   smrtOptions: () => ({ db: getDatabaseConfig() }),
+ * });
+ * ```
+ */
+export declare function mountMcpAppRoute(options: MountMcpAppRouteOptions): McpAppSvelteKitHandler;
+/**
+ * Mount the RFC 9728 protected-resource metadata document as a SvelteKit
+ * `GET` handler, at the exact `metadataUrl` path the bearer challenge
+ * advertises (for `/api/mcp`:
+ * `src/routes/.well-known/oauth-protected-resource/api/mcp/+server.ts`).
+ *
+ * Returns 404 when the source yields no adapter or the local owner-token
+ * adapter (the `local` profile), or when the request path is not the
+ * advertised metadata path. This handler does
+ * not implement an OAuth authorization server; the metadata names the
+ * operator-owned issuer.
+ */
+export declare function mountMcpProtectedResourceMetadataRoute(auth: McpRouteResourceAuthSource): McpSvelteKitHandler;
 /**
  * Mount `server.listTools` as a `GET` handler. Returns the tool list shape
  * `{ tools }` for compatibility with the stock MCP bridge.
@@ -70,6 +229,7 @@ export declare function mountMcpToolsRoute(server: McpAppServer, options?: Mount
  * this compatibility alias while migrating without a coordinated cutover.
  */
 export declare function mountMcpCallRoute(server: McpAppServer, options?: MountMcpRouteOptions): McpSvelteKitHandler;
+export type { CreateDefaultMcpAppServerOptions, McpAppModel, } from './defaults.js';
 export { McpAccessError } from './errors.js';
 export type { McpAppPrincipal, McpAppServer } from './server.js';
 //# sourceMappingURL=sveltekit.d.ts.map

package/dist/sveltekit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sveltekit.d.ts","sourceRoot":"","sources":["../src/sveltekit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAiB,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhF,oEAAoE;AACpE,KAAK,qBAAqB,GAAG;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAEF,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB,GAAG,CAChC,KAAK,EAAE,qBAAqB,KACzB,OAAO,CAAC,QAAQ,CAAC,CAAC;AAQvB,8EAA8E;AAC9E,MAAM,MAAM,oBAAoB,GAAG,CACjC,KAAK,EAAE,qBAAqB,KACzB,eAAe,GAAG,IAAI,GAAG,SAAS,CAAC;AAExC,6EAA6E;AAC7E,MAAM,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAwCnD,2CAA2C;AAC3C,MAAM,WAAW,oBAAoB;IACnC,uFAAuF;IACvF,UAAU,CAAC,EAAE,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACrD;;;OAGG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;OAEG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC;CAClE;AAkBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,oBAAyB,GACjC,mBAAmB,CA8BrB;AA6OD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,oBAAyB,GACjC,mBAAmB,CAcrB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,oBAAyB,GACjC,mBAAmB,CA0BrB;AAyBD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"sveltekit.d.ts","sourceRoot":"","sources":["../src/sveltekit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EACL,KAAK,gCAAgC,EAEtC,MAAM,eAAe,CAAC;AAMvB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAiB,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhF,oEAAoE;AACpE,KAAK,qBAAqB,GAAG;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAEF,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB,GAAG,CAChC,KAAK,EAAE,qBAAqB,KACzB,OAAO,CAAC,QAAQ,CAAC,CAAC;AAQvB,8EAA8E;AAC9E,MAAM,MAAM,oBAAoB,GAAG,CACjC,KAAK,EAAE,qBAAqB,KACzB,eAAe,GAAG,IAAI,GAAG,SAAS,CAAC;AAExC,6EAA6E;AAC7E,MAAM,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAwCnD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACrC,eAAe,EACf,aAAa,GAAG,kBAAkB,GAAG,cAAc,GAAG,iBAAiB,CACxE,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAClC,oBAAoB,GACpB,IAAI,GACJ,SAAS,GACT,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAuFpD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,GAAG,eAAe,GAAG,IAAI,CAoBzB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EACjC,SAAS,EAAE,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC3C,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,KAC3C,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B,CAAC;AA6BF,2CAA2C;AAC3C,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,0BAA0B,CAAC;IAClC,uFAAuF;IACvF,UAAU,CAAC,EAAE,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACrD;;;OAGG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;OAEG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC;CAClE;AAkBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,oBAAyB,GACjC,mBAAmB,CAkFrB;AAuBD,4CAA4C;AAC5C,MAAM,WAAW,uBACf,SAAQ,gCAAgC,EACtC,IAAI,CACF,oBAAoB,EACpB,MAAM,GAAG,eAAe,GAAG,YAAY,GAAG,aAAa,GAAG,gBAAgB,CAC3E;IACH;;;OAGG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAED,kEAAkE;AAClE,MAAM,MAAM,sBAAsB,GAAG,mBAAmB,GAAG;IACzD,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,uBAAuB,GAC/B,sBAAsB,CAwBxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,0BAA0B,GAC/B,mBAAmB,CAcrB;AA6OD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,oBAAyB,GACjC,mBAAmB,CAcrB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,oBAAyB,GACjC,mBAAmB,CA0BrB;AAyBD,YAAY,EACV,gCAAgC,EAChC,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/sveltekit.js

@@ -1,4 +1,4 @@
-import { f as McpAccessError, r as createMcpProtocolServerForRequest, t as MCP_TASKS_EXTENSION } from "./chunks/protocol-Ce0U_XSp.js";
+import { C as McpAccessError, S as MCP_TOOL_ACCESS_DENIED_CODE, a as createDefaultMcpAppServer, r as createMcpProtocolServerForRequest, t as MCP_TASKS_EXTENSION, x as MCP_ORIGIN_DENIED_CODE } from "./chunks/protocol-BlbEg3jn.js";
 import { classifyInboundRequest, createMcpHandler, isJsonContentType } from "@modelcontextprotocol/server";
 //#region src/sveltekit.ts
 var defaultResolvePrincipal = (event) => event.locals?.user ?? null;
@@ -17,6 +17,87 @@ function listToolsInput(resolved) {
 	if (!resolved.principal && resolved.legacyAuthenticated) return { authenticated: true };
 	return { principal: resolved.principal };
 }
+function currentResourceAuth(source) {
+	return (typeof source === "function" ? source() : source) ?? null;
+}
+function canonicalOrigin(value) {
+	if (value === "null") return void 0;
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") return void 0;
+	if (url.username || url.password || url.search || url.hash) return void 0;
+	if (url.pathname !== "/") return void 0;
+	return url.origin;
+}
+function normalizeTrustedOrigins(values) {
+	if (!Array.isArray(values)) throw new TypeError("MCP trustedOrigins must be an array of origins.");
+	const origins = /* @__PURE__ */ new Set();
+	for (const value of values) {
+		const origin = typeof value === "string" ? canonicalOrigin(value) : void 0;
+		if (!origin) throw new TypeError("Invalid MCP trusted origin.");
+		origins.add(origin);
+	}
+	return origins;
+}
+function originPermitted(event, trusted) {
+	const header = event.request.headers.get("origin");
+	if (header !== null) {
+		const origin = canonicalOrigin(header.trim());
+		return origin !== void 0 && (origin === event.url.origin || trusted.has(origin));
+	}
+	const site = event.request.headers.get("sec-fetch-site")?.trim().toLowerCase();
+	return site !== "cross-site" && site !== "same-site";
+}
+function originDeniedResponse() {
+	return new Response(JSON.stringify({
+		jsonrpc: "2.0",
+		id: null,
+		error: {
+			code: -32600,
+			message: "MCP request origin is not permitted.",
+			data: {
+				code: MCP_ORIGIN_DENIED_CODE,
+				retryable: false
+			}
+		}
+	}), {
+		status: 403,
+		headers: {
+			"content-type": "application/json",
+			"cache-control": "no-store"
+		}
+	});
+}
+function principalFromSessionLocals(event) {
+	const locals = event.locals;
+	if (!locals || typeof locals !== "object") return null;
+	const user = locals.user;
+	const tenantId = locals.tenantId;
+	const permissions = locals.permissions;
+	if (!user || typeof user !== "object") return null;
+	if (typeof user.id !== "string" || user.id.length === 0) return null;
+	if (typeof tenantId !== "string" || tenantId.length === 0) return null;
+	if (!Array.isArray(permissions) || !permissions.every((value) => typeof value === "string")) return null;
+	return {
+		id: user.id,
+		tenantId,
+		kind: "human",
+		scopes: [...permissions].sort()
+	};
+}
+function effectiveBoundPrincipal(authenticated, bound) {
+	if (bound === void 0) return authenticated;
+	if (!bound || typeof bound !== "object" || bound.id !== authenticated.id || (bound.tenantId ?? null) !== (authenticated.tenantId ?? null) || !Array.isArray(bound.scopes) || !bound.scopes.every((scope) => typeof scope === "string")) return;
+	const granted = new Set(bound.scopes);
+	return {
+		...authenticated,
+		scopes: (authenticated.scopes ?? []).filter((scope) => granted.has(scope))
+	};
+}
 function protocolServerForRequest(server, resolved) {
 	if (!resolved.legacyAuthenticated || resolved.principal) return server;
 	return {
@@ -27,8 +108,36 @@ function protocolServerForRequest(server, resolved) {
 	};
 }
 function mountMcpRoute(server, options = {}) {
+	const trustedOrigins = options.checkOrigin ? normalizeTrustedOrigins(options.trustedOrigins ?? []) : void 0;
 	return async (event) => {
-		const resolved = resolveRequestPrincipal(event, options);
+		if (trustedOrigins && !originPermitted(event, trustedOrigins)) return originDeniedResponse();
+		const auth = currentResourceAuth(options.auth);
+		if (!auth) return dispatch(event, resolveRequestPrincipal(event, options));
+		if (auth.sessionFallback === true && !event.request.headers.has("authorization")) return dispatch(event, resolveRequestPrincipal(event, options));
+		const checked = await auth.authenticate(event.request);
+		if (!checked.ok) return checked.response;
+		if (!options.bindPrincipal) return dispatch(event, { principal: checked.principal });
+		let entered = false;
+		let response;
+		try {
+			response = await options.bindPrincipal(checked.principal, async (bound) => {
+				entered = true;
+				const principal = effectiveBoundPrincipal(checked.principal, bound);
+				if (!principal) return principalUnboundResponse();
+				const dispatched = await dispatch(event, { principal });
+				return new Response(await dispatched.arrayBuffer(), {
+					status: dispatched.status,
+					statusText: dispatched.statusText,
+					headers: dispatched.headers
+				});
+			});
+		} catch (error) {
+			if (entered) throw error;
+			return principalUnboundResponse();
+		}
+		return entered ? response : principalUnboundResponse();
+	};
+	async function dispatch(event, resolved) {
 		const taskResponse = await maybeHandleTaskRequest(server, resolved.principal, event.request);
 		if (taskResponse) return taskResponse;
 		return createMcpHandler(() => createMcpProtocolServerForRequest(protocolServerForRequest(server, resolved), {
@@ -38,6 +147,52 @@ function mountMcpRoute(server, options = {}) {
 			legacy: "reject",
 			maxSubscriptions: 0
 		}).fetch(event.request);
+	}
+}
+function principalUnboundResponse() {
+	return new Response(JSON.stringify({
+		jsonrpc: "2.0",
+		id: null,
+		error: {
+			code: -32600,
+			message: "MCP tool access is not permitted.",
+			data: {
+				code: MCP_TOOL_ACCESS_DENIED_CODE,
+				retryable: false
+			}
+		}
+	}), {
+		status: 403,
+		headers: {
+			"content-type": "application/json",
+			"cache-control": "no-store"
+		}
+	});
+}
+function mountMcpAppRoute(options) {
+	const { auth, bindPrincipal, extensions, resolvePrincipal, checkOrigin, trustedOrigins, ...serverOptions } = options;
+	const server = createDefaultMcpAppServer(serverOptions);
+	const handler = mountMcpRoute(server, {
+		auth,
+		bindPrincipal,
+		extensions,
+		checkOrigin: checkOrigin ?? true,
+		trustedOrigins,
+		resolvePrincipal: resolvePrincipal ?? principalFromSessionLocals
+	});
+	return Object.defineProperty(handler, "server", {
+		value: server,
+		enumerable: true
+	});
+}
+function mountMcpProtectedResourceMetadataRoute(auth) {
+	return async (event) => {
+		const current = currentResourceAuth(auth);
+		if (!current || current.sessionFallback === true || event.url.pathname !== new URL(current.metadataUrl).pathname) return new Response(null, {
+			status: 404,
+			headers: { "Cache-Control": "no-store" }
+		});
+		return current.metadataResponse();
 	};
 }
 async function maybeHandleTaskRequest(server, principal, request) {
@@ -215,6 +370,6 @@ function jsonResponse(body, status = 200) {
 	});
 }
 //#endregion
-export { McpAccessError, mountMcpCallRoute, mountMcpRoute, mountMcpToolsRoute };
+export { McpAccessError, mountMcpAppRoute, mountMcpCallRoute, mountMcpProtectedResourceMetadataRoute, mountMcpRoute, mountMcpToolsRoute, principalFromSessionLocals };
 
 //# sourceMappingURL=sveltekit.js.map