@happyvertical/smrt-app-mcp 0.53.4 → 0.53.5

package/AGENTS.md

@@ -34,6 +34,17 @@ tool policy; `./sveltekit` owns the stateless Streamable HTTP transport.
   re-check the originating action against the allow-list and `effects`,
   after a principal-level `taskPrincipalPolicy` (defaults: scope policy);
   `mountMcpProtectedResourceMetadataRoute` serves only the advertised path.
+- `createHostedMcpResourceAuth({ profile, runtime })`: locally, a runtime
+  `verifyLocalMcpToken` yields the `sessionFallback` adapter
+  (`createLocalMcpTokenAuth`): no `Authorization` header keeps the session
+  principal; a presented bearer must verify (401, never cookie fallback); no
+  metadata (404). Hosted, `runtime.resolveMcpPrincipal` is the default
+  identity mapping; an explicit `resolvePrincipal` overrides it.
+- Adapters stamp `principal.tenantBinding` for `bindPrincipal`: the local
+  token adapter always `direct`; the JWT adapter the mapping's value or
+  `direct-or-inherited`. Never derive it from request input. Both adapters
+  read principals/mappings from own data only (`own-data.ts`): inherited
+  values, accessors and poison keys deny.
 - Keep tool catalogs private by default. Public caching requires an explicit
   attestation and a global, unauthenticated, read-only, non-tenant catalog with
   no principal-aware policy.

package/README.md

@@ -126,10 +126,10 @@ binding. `createHostedMcpResourceAuth` from `./auth` builds that source from
 
 ```ts
 import { createHostedMcpResourceAuth } from '@happyvertical/smrt-app-mcp/auth';
-const auth = createHostedMcpResourceAuth({
-  profile: () => applicationRuntime.profile,
-  resolvePrincipal: resolveHostedMcpPrincipal, // application-owned lookup
-});
+const { profile } = await runtime.resolvedRuntime();
+// `runtime` supplies both credential bindings (see below); pass
+// `resolvePrincipal` as well to override the hosted identity mapping.
+const auth = createHostedMcpResourceAuth({ profile, runtime });
 // api/mcp/+server.ts
 export const POST = mountMcpAppRoute({
   models: [Item], requiredScopes: ['items.read'], effects: ['read'],
@@ -139,9 +139,28 @@ export const POST = mountMcpAppRoute({
 export const GET = mountMcpProtectedResourceMetadataRoute(auth);
 ```
 
+The `runtime` option takes any object with the optional
+`verifyLocalMcpToken(token)` and `resolveMcpPrincipal(identity)` methods; the
+s-m-r-t SvelteKit runtime has both.
+
+- **Local profile.** With `verifyLocalMcpToken`, the source yields the
+  `createLocalMcpTokenAuth` adapter for owner-minted tokens
+  (`smrt app token --scopes items.read`). A request with no `Authorization`
+  header keeps the session principal, exactly as before. A presented bearer
+  must verify: an unknown, revoked or expired token is a bare 401
+  (`WWW-Authenticate: Bearer error="invalid_token"`) and never falls back to
+  the cookie. The origin check still runs first. Without the runtime the
+  source yields `null`, as before.
+- **Hosted profiles.** Without `resolvePrincipal`, the runtime's
+  membership-backed `resolveMcpPrincipal` maps the verified issuer/subject to
+  a user linked through `oidc_identities` with exactly one active tenant
+  membership, and denies anything else. Pass `resolvePrincipal` when users
+  belong to several tenants.
+
 `mountMcpProtectedResourceMetadataRoute` serves the RFC 9728 document only at
-the adapter's advertised `metadataUrl` path and returns 404 otherwise or for
-the `local` profile. It does not implement an OAuth authorization server.
+the adapter's advertised `metadataUrl` path. It returns 404 for any other
+path, and in the `local` profile (no adapter, or the local token adapter). It
+does not implement an OAuth authorization server.
 
 For piping a deployed app's MCP surface to a local stdio MCP client, see `@happyvertical/smrt-app-cli` — the client-side runtime CLI exposes a `startMcpBridge()` default and a generic `smrt-mcp-bridge` bin.
 

package/dist/auth.d.ts

@@ -1,6 +1,6 @@
 /** Server-only OAuth protected-resource boundary. This is not an issuer. */
 import { type JWTPayload } from 'jose';
-import type { McpAppPrincipal } from './server.js';
+import type { McpAppPrincipal, McpTenantBinding } from './server.js';
 export type McpDeploymentProfile = 'local' | 'self-hosted' | 'cloud';
 export interface McpVerifiedIdentity {
     readonly issuer: string;
@@ -13,6 +13,12 @@ export interface McpPrincipalMapping {
     tenantId?: string;
     kind?: string;
     roles?: string[];
+    /**
+     * How the mapped tenant authority may be bound. Defaults to
+     * `direct-or-inherited`; a mapping that selected a direct membership
+     * returns `direct` so inheritance can never substitute for it.
+     */
+    tenantBinding?: McpTenantBinding;
 }
 export interface McpResourceAuthOptions {
     profile: McpDeploymentProfile;
@@ -35,9 +41,21 @@ export interface McpResourceAuthOptions {
     resolvePrincipal(identity: McpVerifiedIdentity): Promise<McpPrincipalMapping | null>;
 }
 export interface McpResourceAuth {
-    /** Mount GET at this URL. Paths use RFC 9728's well-known path insertion. */
+    /**
+     * Mount GET at this URL. Paths use RFC 9728's well-known path insertion.
+     * Empty for a {@link McpResourceAuth.sessionFallback} adapter, which
+     * advertises no OAuth metadata.
+     */
     readonly metadataUrl: string;
     metadataResponse(): Response;
+    /**
+     * When `true`, a request that carries no `Authorization` header is not
+     * challenged: the route resolves its session principal instead (today's
+     * local-profile behaviour). A presented bearer must still verify; an
+     * invalid one is refused and never falls back to the session. Only the
+     * local owner-token adapter ({@link createLocalMcpTokenAuth}) sets it.
+     */
+    readonly sessionFallback?: boolean;
     /** A failure response contains no token, claims or upstream error details. */
     authenticate(request: Request): Promise<{
         ok: true;
@@ -49,6 +67,51 @@ export interface McpResourceAuth {
         response: Response;
     }>;
 }
+/**
+ * Credential bindings an application runtime can supply to
+ * {@link createHostedMcpResourceAuth}, structurally satisfied by the SMRT
+ * SvelteKit runtime from `@happyvertical/smrt-app-runtime/sveltekit`.
+ */
+/**
+ * A verified local-token principal as a runtime returns it. Its `scopes` may
+ * be a frozen (readonly) array; the adapter copies it.
+ */
+export type McpLocalTokenPrincipal = Omit<McpAppPrincipal, 'scopes'> & {
+    id: string;
+    scopes?: readonly string[];
+};
+export interface McpAuthRuntime {
+    /**
+     * Verify an owner-minted local MCP token (`smrt app token`). Resolve the
+     * token principal (with scopes already capped to live permissions), or
+     * `null` to deny. Used only in the `local` profile.
+     */
+    verifyLocalMcpToken?(token: string): Promise<McpLocalTokenPrincipal | null>;
+    /**
+     * Default hosted identity mapping, used when no explicit
+     * `resolvePrincipal` is given (for example the runtime's membership-backed
+     * resolver).
+     */
+    resolveMcpPrincipal?(identity: McpVerifiedIdentity): Promise<McpPrincipalMapping | null>;
+}
+/** Options for {@link createLocalMcpTokenAuth}. */
+export interface LocalMcpTokenAuthOptions {
+    /**
+     * Resolve a presented token to its principal, or `null` to deny. A thrown
+     * error is also a denial. The principal needs a non-empty `id` and
+     * `tenantId` and string `scopes`; `allowCrossTenant` is never honoured.
+     */
+    verify(token: string): Promise<McpLocalTokenPrincipal | null>;
+}
+/**
+ * Bearer adapter for owner-minted local MCP tokens. It is a
+ * {@link McpResourceAuth.sessionFallback} adapter: without an `Authorization`
+ * header the route keeps its session principal; with one, the token must
+ * verify, otherwise the response is `401` with
+ * `WWW-Authenticate: Bearer error="invalid_token"` and no token, claim or
+ * upstream detail. It advertises no OAuth metadata (the metadata route 404s).
+ */
+export declare function createLocalMcpTokenAuth(options: LocalMcpTokenAuthOptions): McpResourceAuth;
 /** Options for {@link createHostedMcpResourceAuth}. */
 export interface HostedMcpResourceAuthOptions {
     /**
@@ -58,10 +121,20 @@ export interface HostedMcpResourceAuthOptions {
     profile: McpDeploymentProfile | (() => McpDeploymentProfile);
     /**
      * Application-owned mapping from a verified identity to a current account
-     * and active membership. Required for every non-local profile; token claims
-     * never select a tenant. An absent binding throws on first hosted use.
+     * and active membership; token claims never select a tenant. Overrides
+     * `runtime.resolveMcpPrincipal`. A hosted profile with neither throws on
+     * first use.
      */
     resolvePrincipal?: McpResourceAuthOptions['resolvePrincipal'];
+    /**
+     * The application runtime (for example the SMRT SvelteKit runtime). In the
+     * `local` profile its `verifyLocalMcpToken` turns on owner-minted bearer
+     * tokens through {@link createLocalMcpTokenAuth} (requests without a
+     * bearer keep the session principal); without it the thunk yields `null`
+     * as before. In hosted profiles its membership-backed
+     * `resolveMcpPrincipal` is the default identity mapping.
+     */
+    runtime?: McpAuthRuntime;
     /** Environment source. Defaults to `process.env`, read lazily. */
     env?: Readonly<Record<string, string | undefined>>;
     /** Default `['RS256']`. */

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,OAAO,EAAsB,KAAK,UAAU,EAAa,MAAM,MAAM,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,aAAa,GAAG,OAAO,CAAC;AACrE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;CACvC;AACD,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AACD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;IAC3C,qFAAqF;IACrF,SAAS,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC7B,gFAAgF;IAChF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,gBAAgB,CACd,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CACxC;AAqCD,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gBAAgB,IAAI,QAAQ,CAAC;IAC7B,8EAA8E;IAC9E,YAAY,CACV,OAAO,EAAE,OAAO,GACf,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,eAAe,GAAG;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GACzD;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CACpC,CAAC;CACH;AAED,uDAAuD;AACvD,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,OAAO,EAAE,oBAAoB,GAAG,CAAC,MAAM,oBAAoB,CAAC,CAAC;IAC7D;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAC9D,kEAAkE;IAClE,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACnD,2BAA2B;IAC3B,UAAU,CAAC,EAAE,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAClD,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAChD,aAAa,CAAC,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;CACzD;AAED,yEAAyE;AACzE,eAAO,MAAM,mBAAmB;;;;;EAK9B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,MAAM,eAAe,GAAG,IAAI,CAqC9B;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAC9B,eAAe,CA0HjB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,OAAO,EAAsB,KAAK,UAAU,EAAa,MAAM,MAAM,CAAC;AAEtE,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAErE,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,aAAa,GAAG,OAAO,CAAC;AACrE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;CACvC;AACD,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAGD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;IAC3C,qFAAqF;IACrF,SAAS,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC7B,gFAAgF;IAChF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,gBAAgB,CACd,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CACxC;AAqCD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gBAAgB,IAAI,QAAQ,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,8EAA8E;IAC9E,YAAY,CACV,OAAO,EAAE,OAAO,GACf,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,eAAe,GAAG;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GACzD;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CACpC,CAAC;CACH;AAED;;;;GAIG;AACH;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,GAAG;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC5E;;;;OAIG;IACH,mBAAmB,CAAC,CAClB,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CACxC;AAED,mDAAmD;AACnD,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;CAC/D;AAID;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,wBAAwB,GAChC,eAAe,CAkEjB;AAED,uDAAuD;AACvD,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,OAAO,EAAE,oBAAoB,GAAG,CAAC,MAAM,oBAAoB,CAAC,CAAC;IAC7D;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAC9D;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,kEAAkE;IAClE,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACnD,2BAA2B;IAC3B,UAAU,CAAC,EAAE,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAClD,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAChD,aAAa,CAAC,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;CACzD;AAED,yEAAyE;AACzE,eAAO,MAAM,mBAAmB;;;;;EAK9B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,MAAM,eAAe,GAAG,IAAI,CAqD9B;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAC9B,eAAe,CA4IjB"}

package/dist/auth.js

@@ -697,7 +697,44 @@ function createRemoteJWKSet(url, options) {
 	});
 }
 //#endregion
+//#region src/own-data.ts
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function readOwnFields(value, keys) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) return null;
+	for (const key of Reflect.ownKeys(value)) if (typeof key === "string" && FORBIDDEN_KEYS.has(key)) return null;
+	const fields = /* @__PURE__ */ Object.create(null);
+	for (const key of keys) {
+		const descriptor = Reflect.getOwnPropertyDescriptor(value, key);
+		if (!descriptor) continue;
+		if (!("value" in descriptor)) return null;
+		fields[key] = descriptor.value;
+	}
+	return fields;
+}
+function ownStringArray(value) {
+	if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype) return null;
+	const length = value.length;
+	for (const key of Reflect.ownKeys(value)) {
+		if (key === "length") continue;
+		if (typeof key !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(key) || Number(key) >= length) return null;
+	}
+	const copy = [];
+	for (let index = 0; index < length; index += 1) {
+		const descriptor = Reflect.getOwnPropertyDescriptor(value, index);
+		if (!descriptor || !("value" in descriptor) || typeof descriptor.value !== "string") return null;
+		copy.push(descriptor.value);
+	}
+	return copy;
+}
+//#endregion
 //#region src/auth.ts
+var TENANT_BINDINGS = ["direct", "direct-or-inherited"];
 var scopePattern = /^[\x21\x23-\x5b\x5d-\x7e]+$/u;
 function validateUrl(value, profile) {
 	let url;
@@ -717,6 +754,57 @@ function validateUrl(value, profile) {
 function validString(value) {
 	return typeof value === "string" && value.length > 0 && value.length <= 1024 && value.trim() === value && [...value].every((character) => character.charCodeAt(0) > 31 && character.charCodeAt(0) !== 127);
 }
+var LOCAL_BEARER_PATTERN = /^Bearer +([A-Za-z0-9._~+/-]{16,512}=*)$/iu;
+function createLocalMcpTokenAuth(options) {
+	const verify = options?.verify;
+	if (typeof verify !== "function") throw new TypeError("Local MCP token auth requires a verify function.");
+	const deny = () => ({
+		ok: false,
+		response: new Response(null, {
+			status: 401,
+			headers: {
+				"WWW-Authenticate": "Bearer error=\"invalid_token\"",
+				"Cache-Control": "no-store"
+			}
+		})
+	});
+	return Object.freeze({
+		metadataUrl: "",
+		sessionFallback: true,
+		metadataResponse: () => new Response(null, {
+			status: 404,
+			headers: { "Cache-Control": "no-store" }
+		}),
+		async authenticate(request) {
+			const match = LOCAL_BEARER_PATTERN.exec(request.headers.get("authorization") ?? "");
+			if (!match) return deny();
+			let principal;
+			try {
+				principal = await verify(match[1]);
+			} catch {
+				return deny();
+			}
+			const fields = readOwnFields(principal, [
+				"id",
+				"tenantId",
+				"kind",
+				"scopes"
+			]);
+			const scopes = fields ? ownStringArray(fields.scopes) : null;
+			if (!fields || !scopes || !validString(fields.id) || !validString(fields.tenantId) || fields.kind !== void 0 && !validString(fields.kind) || !scopes.every((scope) => scopePattern.test(scope))) return deny();
+			return {
+				ok: true,
+				principal: {
+					id: fields.id,
+					tenantId: fields.tenantId,
+					kind: fields.kind,
+					scopes,
+					tenantBinding: "direct"
+				}
+			};
+		}
+	});
+}
 var HOSTED_MCP_AUTH_ENV = Object.freeze({
 	resource: "SMRT_MCP_RESOURCE",
 	issuer: "SMRT_MCP_ISSUER",
@@ -725,9 +813,16 @@ var HOSTED_MCP_AUTH_ENV = Object.freeze({
 });
 function createHostedMcpResourceAuth(options) {
 	let cached;
+	let local;
+	const runtime = options.runtime;
 	return () => {
 		const profile = typeof options.profile === "function" ? options.profile() : options.profile;
-		if (profile === "local") return null;
+		if (profile === "local") {
+			const verify = runtime?.verifyLocalMcpToken;
+			if (typeof verify !== "function") return null;
+			local ??= createLocalMcpTokenAuth({ verify: (token) => verify.call(runtime, token) });
+			return local;
+		}
 		if (cached) return cached;
 		const env = options.env ?? globalThis.process?.env ?? {};
 		const required = (name) => {
@@ -735,7 +830,9 @@ function createHostedMcpResourceAuth(options) {
 			if (!value) throw new Error(`Hosted MCP requires ${name}.`);
 			return value;
 		};
-		if (!options.resolvePrincipal) throw new Error("Hosted MCP requires an application-owned resolvePrincipal binding.");
+		const runtimeResolver = runtime?.resolveMcpPrincipal;
+		const resolvePrincipal = options.resolvePrincipal ?? (typeof runtimeResolver === "function" ? (identity) => runtimeResolver.call(runtime, identity) : void 0);
+		if (!resolvePrincipal) throw new Error("Hosted MCP requires an application-owned resolvePrincipal binding or a runtime with resolveMcpPrincipal.");
 		cached = createMcpResourceAuth({
 			profile,
 			resource: required(HOSTED_MCP_AUTH_ENV.resource),
@@ -745,7 +842,7 @@ function createHostedMcpResourceAuth(options) {
 			algorithms: options.algorithms ?? ["RS256"],
 			tokenType: options.tokenType,
 			requireTenant: options.requireTenant,
-			resolvePrincipal: options.resolvePrincipal
+			resolvePrincipal
 		});
 		return cached;
 	};
@@ -819,21 +916,29 @@ function createMcpResourceAuth(options) {
 				const granted = payload.scope === "" ? [] : payload.scope.split(" ");
 				if (granted.some((scope) => !scopePattern.test(scope))) return deny("invalid_token");
 				if (scopes.some((scope) => !granted.includes(scope))) return deny("insufficient_scope");
-				const mapping = await resolvePrincipal(Object.freeze({
+				const fields = readOwnFields(await resolvePrincipal(Object.freeze({
 					issuer,
 					subject: payload.sub,
 					scopes: Object.freeze([...granted]),
 					claims: Object.freeze(payload)
-				}));
-				if (!mapping || !validString(mapping.id) || requireTenant && !validString(mapping.tenantId) || mapping.tenantId !== void 0 && !validString(mapping.tenantId) || mapping.kind !== void 0 && !validString(mapping.kind) || mapping.roles !== void 0 && (!Array.isArray(mapping.roles) || !mapping.roles.every(validString))) return deny("invalid_token");
+				})), [
+					"id",
+					"tenantId",
+					"kind",
+					"roles",
+					"tenantBinding"
+				]);
+				const roles = fields?.roles === void 0 ? void 0 : ownStringArray(fields.roles);
+				if (!fields || roles === null || !validString(fields.id) || requireTenant && !validString(fields.tenantId) || fields.tenantId !== void 0 && !validString(fields.tenantId) || fields.kind !== void 0 && !validString(fields.kind) || roles !== void 0 && !roles.every(validString) || fields.tenantBinding !== void 0 && (typeof fields.tenantBinding !== "string" || !TENANT_BINDINGS.includes(fields.tenantBinding))) return deny("invalid_token");
 				return {
 					ok: true,
 					principal: {
-						id: mapping.id,
-						tenantId: mapping.tenantId,
-						kind: mapping.kind,
-						roles: mapping.roles ? [...mapping.roles] : void 0,
-						scopes: [...granted]
+						id: fields.id,
+						tenantId: fields.tenantId,
+						kind: fields.kind,
+						roles,
+						scopes: [...granted],
+						tenantBinding: fields.tenantBinding ?? "direct-or-inherited"
 					}
 				};
 			} catch {
@@ -843,6 +948,6 @@ function createMcpResourceAuth(options) {
 	};
 }
 //#endregion
-export { HOSTED_MCP_AUTH_ENV, createHostedMcpResourceAuth, createMcpResourceAuth };
+export { HOSTED_MCP_AUTH_ENV, createHostedMcpResourceAuth, createLocalMcpTokenAuth, createMcpResourceAuth };
 
 //# sourceMappingURL=auth.js.map