@happyvertical/smrt-app-runtime 0.53.4 → 0.53.5

package/AGENTS.md

@@ -33,6 +33,30 @@ Application infrastructure composition for the validated runtime profiles in
   A token that cannot claim fails a read-only preflight before role/catalog
   seeding (#3323); the claim transaction's conditional UPDATE stays the
   authority for single use, expiry, and concurrency.
+- Local MCP tokens (`mcpTokens`, `openLocalMcpTokenStore`, `smrt app token`):
+  owner-bound, scoped, expiring (default 30 d, max 365 d), revocable. Only a
+  domain-separated HMAC (application secret) is stored, in the runtime-owned
+  `_smrt_local_mcp_tokens` system table (created like the bootstrap table;
+  never application schema). Issue refuses scopes the owner lacks; verify
+  returns token scopes ∩ live permissions and `null` for anything else.
+- Bearer binding is explicit (`tenantBinding`, set by the auth adapter;
+  `direct-membership.ts`): `direct` (local tokens, default hosted resolver)
+  needs an active direct membership in exactly the tenant; the default
+  `direct-or-inherited` (hosted app mappings) applies
+  `isSessionTenantAuthorized`'s rule. The direct row, when present, is pinned
+  into `PermissionResolver`, so inheritance never substitutes for it.
+  `verify()` principals (and their `scopes` arrays) are frozen;
+  `runAsPrincipal` takes a validated, deep-frozen, null-prototype copy of
+  the principal before any await (`plain-data.ts`: own data only; poison
+  keys `__proto__`/`constructor`/`prototype`, accessors, inherited or
+  non-plain data, sparse arrays and functions rejected), authorizes from it,
+  and hands `fn` that snapshot. Token `issue()` input is read the same way.
+  They carry
+  `tenantBinding: 'direct'` and the
+  `LOCAL_MCP_TOKEN_PRINCIPAL` brand; `runAsPrincipal` rejects a copy that
+  widens the binding, so the two public APIs compose safely.
+  Never log or return the token outside `issue()`. The operator store opens an
+  uncached connection and takes no writer lease (revocation is per request).
 - Background jobs and application-defined paid capabilities are default-off.
 - The embedded runner reuses `TaskRunner`; it is not a second job contract.
 
@@ -73,6 +97,9 @@ Application infrastructure composition for the validated runtime profiles in
 - Server-only subpath; `@sveltejs/kit` is an optional peer and is externalized
   in `vite.config.ts` (kit recognizes `redirect`/`fail` by class identity).
   The root entry must never import kit or Svelte.
+- Without a `runtime` option the profile comes from smrt-config's
+  `resolveEffectiveApplicationRuntime(await loadConfig())`, the same rule as
+  `smrt app` (#3446): no block → `local`; `null`/`false`/`0`/`''` fail closed.
 - `createSmrtSvelteKitRuntime()` order is fixed: readiness gate → URL tenant
   selection (`locals.selectedTenant*`, never tenant context, headers ignored) →
   verified session (tenant context entered only when
@@ -86,12 +113,28 @@ Application infrastructure composition for the validated runtime profiles in
   transaction-bound request db (class `db` overrides win). Anything that
   outlives a request (session service, tenant selector) must use the base
   config, never these.
-- The writer lease, provider readiness, and onboarding file cleanup are
-  injected hooks. Apps pass the root entry's `acquireWriterLease` (over
-  `prepareApplicationStateRoot`) and `createProviderReadinessProbe`; deployed
-  startup fails closed without `providerReadiness`.
+- The local writer lease defaults to `defaultWriterLease()` (root
+  `acquireWriterLease` over `prepareApplicationStateRoot`, presenting
+  `SMRT_OPERATION_INSTANCE`); `acquireWriterLease` replaces it, `false` opts
+  out, deployed profiles never take it. Provider readiness stays injected:
+  apps pass `createProviderReadinessProbe`; deployed startup fails closed
+  without `providerReadiness`.
+- `getCollection()` builds from `classOptions()` on every call (RLS request db
+  inside a request); each generated route's embedded prelude imports the
+  app's `smrt.ts` and reaches it through core's
+  `createGeneratedCollectionAccess()` (a legacy accessor export wins,
+  deprecated for one release).
+- Owner setup removes the `smrt app` onboarding hand-off files by default,
+  immediately after the claim commits (before cookie serialization or hooks);
+  `onOwnerClaimed` is for additional cleanup and
+  `removeOnboardingHandoff: false` is the explicit opt-out.
 - Owner setup re-checks loopback peer and loopback URL host per request and
   returns only fixed `{ code, message }` failures.
+- `verifyLocalMcpToken` (local only) and `resolveMcpPrincipal` (hosted only:
+  issuer/subject → `oidc_identities` → exactly one active user with exactly
+  one active direct membership, else `null`) are the runtime's MCP credential
+  bindings; pass the runtime as `createHostedMcpResourceAuth({ runtime })`.
+  Token claims never select a tenant.
 - `resolveApplicationId()` / `runtimeConfigurationFingerprint()` must stay
   byte-compatible with process managers (golden vectors in tests).
 

package/README.md

@@ -147,12 +147,22 @@ override), so call them per request and never retain the result. Downstream code
 at most once: its error propagates unchanged, and a session-layer failure
 before it returns 500 with no authenticated locals. Defaults read `SMRT_APP_ID`, `SMRT_DATA_DIR`, `HOST`, `DATABASE_URL`,
 `TENANT_BASE_DOMAIN`, and `SMRT_BACKGROUND_JOBS`; `smrt.config` `runtime`
-selects the profile (local when absent). Deployed profiles additionally require
-`providerReadiness` probes and fail closed without them. Optional hooks:
-`acquireWriterLease` (local single-writer lease), `onBootstrapInvitation`
-(present a newly issued setup token), `selectTenant`, `session`, and
-`classOverrides`. `runtime.classOptions(className)` returns collection options
-for application code.
+selects the profile (local when absent; a present `null`/`false`/`0`/`''`
+fails closed, as in `smrt app`). Deployed profiles additionally require
+`providerReadiness` probes and fail closed without them. In the local profile
+the runtime holds the single-writer lease shared with `smrt app` operations by
+default (`defaultWriterLease()`: `writer.lease` under
+`prepareApplicationStateRoot()`, presenting `SMRT_OPERATION_INSTANCE`); pass
+`acquireWriterLease` to replace it or `acquireWriterLease: false` to hold none.
+Optional hooks: `onBootstrapInvitation` (present a newly issued setup token),
+`selectTenant`, `session`, and `classOverrides`.
+`runtime.getCollection(className)` returns the registered collection built
+from `runtime.classOptions(className)` on that call. Each generated `/api/*`
+route embeds a prelude that imports the app's `src/lib/server/smrt.ts` and
+resolves collections through its exported `runtime` (core's
+`createGeneratedCollectionAccess()`), so an app's `smrt.ts` is only the
+runtime and its options. A legacy `getCollection`/`getSmrtConfig` export there
+still takes precedence for one release, with a deprecation warning.
 
 Mountable routes:
 
@@ -175,7 +185,12 @@ loopback; its `default` action reads `token`, `name`, `email`, and optional
 `tenantName`, sets the session cookie, and redirects 303, or returns
 `fail(status, { code, message })` with `setup_disabled` (404),
 `setup_unavailable` (403), `setup_invalid_input` (400), or `setup_invalid`
-(400). Claim error text is never returned.
+(400). Claim error text is never returned. After the claim commits, the
+runtime removes the `smrt app setup` / `recover` hand-off files
+(`ONBOARDING_HANDOFF_FILES`: `onboarding.json`, `onboarding-launch.html`) from
+`runtime.applicationStateRoot()`, so `pnpm app:open` stops offering the spent
+invitation; failed claims leave them untouched. `onOwnerClaimed` remains for
+extra app cleanup and `removeOnboardingHandoff: false` opts out.
 
 `resolveApplicationId()` and `runtimeConfigurationFingerprint()` (root entry)
 are the canonical app ID and secret-free configuration fingerprint shared by
@@ -184,21 +199,16 @@ the web health route and process managers.
 The root entry also owns the operator state shared with `smrt app`:
 `prepareApplicationStateRoot()` (private, app-bound state directory),
 `withOperationLock()`, `acquireWriterLease()` / `readActiveWriterLease()`,
-and `createProviderReadinessProbe()`. A SvelteKit app wires the last two into
-its runtime without depending on the CLI:
+and `createProviderReadinessProbe()`. The SvelteKit runtime takes the writer
+lease itself; a SvelteKit app passes only the readiness probe and its own
+options, without depending on the CLI:
 
 ```ts
-import {
-  acquireWriterLease,
-  createProviderReadinessProbe,
-  prepareApplicationStateRoot,
-} from '@happyvertical/smrt-app-runtime';
+// src/lib/server/smrt.ts
+import { createProviderReadinessProbe } from '@happyvertical/smrt-app-runtime';
+import { createSmrtSvelteKitRuntime } from '@happyvertical/smrt-app-runtime/sveltekit';
 
 export const runtime = createSmrtSvelteKitRuntime({
-  acquireWriterLease: (context) =>
-    acquireWriterLease(prepareApplicationStateRoot(context), {
-      operationInstance: process.env.SMRT_OPERATION_INSTANCE,
-    }),
   providerReadiness: createProviderReadinessProbe,
 });
 ```

package/dist/chunks/{src-DZGOVGsU.js → src-D7cM0zHW.js}

@@ -9,62 +9,13 @@ import { resolveApplicationRuntime } from "@happyvertical/smrt-config";
 import { ScheduleRunner, TaskRunner } from "@happyvertical/smrt-jobs";
 import { Person, ProfileTypeCollection } from "@happyvertical/smrt-profiles";
 import { withSystemContext } from "@happyvertical/smrt-tenancy";
-import { DEFAULT_ROLE_SLUGS, MembershipCollection, MembershipStatus, RoleCollection, SessionCollection, SessionService, TenantService, UserCollection, UserStatus } from "@happyvertical/smrt-users";
+import { DEFAULT_ROLE_SLUGS, MembershipCollection, MembershipStatus, PermissionResolver, RoleCollection, SessionCollection, SessionService, TenantService, UserCollection, UserStatus } from "@happyvertical/smrt-users";
 import { getDatabase } from "@happyvertical/sql";
-import { chmodSync, closeSync, constants as constants$1, existsSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { chmodSync, closeSync, constants as constants$1, existsSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { DatabaseSync } from "node:sqlite";
 import { registerHooks } from "node:module";
 import { fileURLToPath, pathToFileURL } from "node:url";
-//#region src/application-identity.ts
-function resolveApplicationId(options = {}) {
-	if (options.explicitId) return validateApplicationId(options.explicitId);
-	let packageName = options.packageName;
-	if (packageName === void 0) {
-		const sourceRoot = options.sourceRoot ?? process.cwd();
-		packageName = JSON.parse(readFileSync(join(sourceRoot, "package.json"), "utf8")).name;
-	}
-	if (typeof packageName !== "string" || packageName.trim() === "") throw new Error("package.json must declare a non-empty package name.");
-	return encodeApplicationId(packageName);
-}
-function databaseTargetIdentity(value) {
-	if (!value) return null;
-	try {
-		const target = new URL(value);
-		const sslMode = target.searchParams.get("sslmode");
-		target.username = "";
-		target.password = "";
-		target.search = "";
-		target.hash = "";
-		if (sslMode) target.searchParams.set("sslmode", sslMode);
-		return target.toString();
-	} catch {
-		return resolve(value);
-	}
-}
-function runtimeConfigurationFingerprint(runtime, environment = process.env) {
-	return createHash("sha256").update(JSON.stringify({
-		profile: runtime.profile,
-		providers: runtime.providers,
-		databaseTarget: databaseTargetIdentity(environment.DATABASE_URL),
-		host: environment.HOST || null,
-		port: environment.PORT || null,
-		origin: environment.ORIGIN || null,
-		backgroundJobs: environment.SMRT_BACKGROUND_JOBS === "true",
-		readinessModules: {
-			authentication: environment.SMRT_AUTH_READINESS_MODULE || null,
-			assets: environment.SMRT_ASSETS_READINESS_MODULE || null,
-			secrets: environment.SMRT_SECRETS_READINESS_MODULE || null
-		},
-		mcpAuthorization: {
-			resource: environment.SMRT_MCP_RESOURCE || null,
-			issuer: environment.SMRT_MCP_ISSUER || null,
-			jwksUri: environment.SMRT_MCP_JWKS_URI || null,
-			scopes: environment.SMRT_MCP_SCOPES || null
-		}
-	})).digest("hex");
-}
-//#endregion
 //#region src/deployed-runtime.ts
 var DeployedRuntimeError = class extends Error {
 	constructor(code, message, component) {
@@ -648,6 +599,303 @@ function deepFreeze$1(value, seen = /* @__PURE__ */ new WeakSet()) {
 	return value;
 }
 //#endregion
+//#region src/direct-membership.ts
+async function resolveBoundMembershipPermissions(options) {
+	const { memberships, resolver, userId, tenantId, binding } = options;
+	const direct = await withSystemContext(() => memberships.findByUserAndTenant(userId, tenantId));
+	if (direct) {
+		if (direct.userId !== userId || direct.tenantId !== tenantId || !direct.isActive()) return null;
+	} else if (binding !== "direct-or-inherited") return null;
+	const resolved = await resolver.resolvePermissions(userId, tenantId, { membership: direct ?? null });
+	if (!isSessionTenantAuthorized({
+		membership: direct ?? null,
+		tenantAuthorization: {
+			membershipId: resolved.membershipId,
+			inheritedFromTenantId: resolved.inheritedFromTenantId
+		}
+	}) || !resolved.membershipId) return null;
+	return {
+		membershipId: resolved.membershipId,
+		inheritedFromTenantId: resolved.inheritedFromTenantId,
+		permissions: resolved.permissions
+	};
+}
+//#endregion
+//#region src/plain-data.ts
+var FORBIDDEN_DATA_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+var PlainDataError = class extends Error {
+	name = "PlainDataError";
+};
+function deepFrozenPlainCopy(value, depth = 0) {
+	if (typeof value === "function") throw new PlainDataError("may contain only plain data");
+	if (value === null || typeof value !== "object") return value;
+	if (depth > 8) throw new PlainDataError("is nested too deeply");
+	if (Array.isArray(value)) {
+		if (Object.getPrototypeOf(value) !== Array.prototype) throw new PlainDataError("may contain only plain arrays");
+		const length = value.length;
+		for (const key of Reflect.ownKeys(value)) {
+			if (key === "length") continue;
+			if (typeof key !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(key) || Number(key) >= length) throw new PlainDataError("may contain only plain arrays");
+		}
+		const copy2 = [];
+		for (let index = 0; index < length; index += 1) {
+			const descriptor = Reflect.getOwnPropertyDescriptor(value, index);
+			if (!descriptor || !("value" in descriptor)) throw new PlainDataError("may contain only dense data arrays");
+			Object.defineProperty(copy2, index, {
+				value: deepFrozenPlainCopy(descriptor.value, depth + 1),
+				enumerable: true,
+				writable: false,
+				configurable: false
+			});
+		}
+		return Object.freeze(copy2);
+	}
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) throw new PlainDataError("may contain only plain data");
+	const copy = /* @__PURE__ */ Object.create(null);
+	for (const key of Reflect.ownKeys(value)) {
+		if (typeof key === "string" && FORBIDDEN_DATA_KEYS.has(key)) throw new PlainDataError(`may not contain the key ${key}`);
+		const descriptor = Reflect.getOwnPropertyDescriptor(value, key);
+		if (!descriptor?.enumerable) continue;
+		if (!("value" in descriptor)) throw new PlainDataError("may not contain accessor properties");
+		Object.defineProperty(copy, key, {
+			value: deepFrozenPlainCopy(descriptor.value, depth + 1),
+			enumerable: true,
+			writable: false,
+			configurable: false
+		});
+	}
+	return Object.freeze(copy);
+}
+function ownValue(record, key) {
+	return Object.hasOwn(record, key) ? record[key] : void 0;
+}
+//#endregion
+//#region src/local-mcp-tokens.ts
+var LOCAL_MCP_TOKEN_TABLE = "_smrt_local_mcp_tokens";
+var LOCAL_MCP_TOKEN_PREFIX = "smrt_mcp_";
+var DEFAULT_LOCAL_MCP_TOKEN_TTL_SECONDS = 720 * 60 * 60;
+var MAX_LOCAL_MCP_TOKEN_TTL_SECONDS = 365 * 24 * 60 * 60;
+var MAX_SCOPES = 64;
+var MAX_SCOPE_LENGTH = 128;
+var MAX_LABEL_LENGTH = 80;
+var SCOPE_PATTERN = /^[\x21\x23-\x5b\x5d-\x7e]+$/u;
+var TOKEN_PATTERN = /^smrt_mcp_[A-Za-z0-9_-]{43}$/u;
+var TOKEN_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u;
+var HMAC_DOMAIN = "smrt.local-mcp-token.v1\0";
+var LOCAL_MCP_TOKEN_PRINCIPAL = /* @__PURE__ */ Symbol.for("@happyvertical/smrt-app-runtime/local-mcp-token-principal");
+function isLocalMcpTokenPrincipal(value) {
+	return typeof value === "object" && value !== null && value[LOCAL_MCP_TOKEN_PRINCIPAL] === true;
+}
+async function ensureLocalMcpTokenTable(db) {
+	await db.query(`CREATE TABLE IF NOT EXISTS ${LOCAL_MCP_TOKEN_TABLE} (
+      id TEXT PRIMARY KEY,
+      token_hash TEXT NOT NULL UNIQUE,
+      user_id TEXT NOT NULL,
+      tenant_id TEXT NOT NULL,
+      scopes TEXT NOT NULL,
+      label TEXT NULL,
+      created_at TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      revoked_at TEXT NULL
+    )`);
+}
+function createLocalMcpTokenStore(deps) {
+	const { db, now, fail } = deps;
+	let keyPromise;
+	const hashKey = () => {
+		keyPromise ??= deps.readSecret().then((secret) => createHmac("sha256", secret.trim()).update(HMAC_DOMAIN).digest()).catch((error) => {
+			keyPromise = void 0;
+			throw error;
+		});
+		return keyPromise;
+	};
+	const hashToken = async (token) => createHmac("sha256", await hashKey()).update(token).digest("hex");
+	let resolverPromise;
+	const livePermissions = async (userId, tenantId) => {
+		resolverPromise ??= PermissionResolver.create({ db }).catch((error) => {
+			resolverPromise = void 0;
+			throw error;
+		});
+		return (await resolveBoundMembershipPermissions({
+			memberships: await MembershipCollection.create({ db }),
+			resolver: await resolverPromise,
+			userId,
+			tenantId,
+			binding: "direct"
+		}))?.permissions ?? null;
+	};
+	return Object.freeze({
+		async issue(input) {
+			let fields;
+			try {
+				fields = deepFrozenPlainCopy(input ?? {});
+			} catch (error) {
+				if (!(error instanceof PlainDataError)) throw error;
+				throw fail("invalid_configuration", `MCP token input ${error.message}.`);
+			}
+			if (fields === null || typeof fields !== "object") throw fail("invalid_configuration", "MCP token input must be an object.");
+			const scopes = normalizeScopes(ownValue(fields, "scopes"), fail);
+			const ttl = ownValue(fields, "expiresInSeconds") ?? 2592e3;
+			if (!Number.isSafeInteger(ttl) || ttl < 60 || ttl > 31536e3) throw fail("invalid_configuration", "MCP token lifetime must be between one minute and 365 days.");
+			const label = normalizeLabel(ownValue(fields, "label"), fail);
+			const owner = await deps.findOwner(db);
+			if (!owner) throw fail("owner_unavailable", "No local owner exists yet; finish owner setup before issuing MCP tokens.");
+			const held = await livePermissions(owner.userId, owner.tenantId);
+			const missing = scopes.filter((scope) => !held?.has(scope));
+			if (missing.length > 0) throw fail("invalid_scope", `The local owner does not hold: ${missing.join(", ")}.`);
+			await ensureLocalMcpTokenTable(db);
+			const token = `${LOCAL_MCP_TOKEN_PREFIX}${randomBytes(32).toString("base64url")}`;
+			const id = randomUUID();
+			const created = now();
+			const createdAt = created.toISOString();
+			const expiresAt = new Date(created.getTime() + ttl * 1e3).toISOString();
+			await db.query(`INSERT INTO ${LOCAL_MCP_TOKEN_TABLE}
+          (id, token_hash, user_id, tenant_id, scopes, label, created_at, expires_at, revoked_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`, id, await hashToken(token), owner.userId, owner.tenantId, JSON.stringify(scopes), label, createdAt, expiresAt);
+			return Object.freeze({
+				id,
+				token,
+				scopes: Object.freeze([...scopes]),
+				label,
+				createdAt,
+				expiresAt
+			});
+		},
+		async list() {
+			await ensureLocalMcpTokenTable(db);
+			const result = await db.query(`SELECT id, scopes, label, created_at, expires_at, revoked_at
+         FROM ${LOCAL_MCP_TOKEN_TABLE}
+         ORDER BY created_at DESC, id`);
+			const current = now().getTime();
+			return result.rows.map((row) => {
+				const expiresAt = String(row.expires_at);
+				const revokedAt = row.revoked_at == null ? null : String(row.revoked_at);
+				const status = revokedAt ? "revoked" : Date.parse(expiresAt) > current ? "active" : "expired";
+				return Object.freeze({
+					id: String(row.id),
+					scopes: Object.freeze(parseScopes(row.scopes) ?? []),
+					label: row.label == null ? null : String(row.label),
+					createdAt: String(row.created_at),
+					expiresAt,
+					revokedAt,
+					status
+				});
+			});
+		},
+		async revoke(id) {
+			if (typeof id !== "string" || !TOKEN_ID_PATTERN.test(id)) throw fail("invalid_configuration", "Unknown MCP token id.");
+			await ensureLocalMcpTokenTable(db);
+			if ((await db.query(`UPDATE _smrt_local_mcp_tokens
+         SET revoked_at = ?
+         WHERE id = ? AND revoked_at IS NULL
+         RETURNING id`, now().toISOString(), id)).rows.length > 0) return "revoked";
+			if ((await db.query(`SELECT id FROM _smrt_local_mcp_tokens WHERE id = ? LIMIT 1`, id)).rows.length === 0) throw fail("invalid_configuration", "Unknown MCP token id.");
+			return "already-revoked";
+		},
+		async verify(token) {
+			if (typeof token !== "string" || !TOKEN_PATTERN.test(token)) return null;
+			const row = (await db.query(`SELECT id, user_id, tenant_id, scopes, expires_at, revoked_at
+         FROM ${LOCAL_MCP_TOKEN_TABLE}
+         WHERE token_hash = ?
+         LIMIT 1`, await hashToken(token))).rows[0];
+			if (!row || row.revoked_at != null) return null;
+			const expiresAt = Date.parse(String(row.expires_at));
+			if (!Number.isFinite(expiresAt) || expiresAt <= now().getTime()) return null;
+			const userId = row.user_id;
+			const tenantId = row.tenant_id;
+			const scopes = parseScopes(row.scopes);
+			if (typeof userId !== "string" || userId.length === 0 || typeof tenantId !== "string" || tenantId.length === 0 || !scopes) return null;
+			const user = await (await UserCollection.create({ db })).get({ id: userId });
+			if (!user || user.status !== UserStatus.ACTIVE) return null;
+			const held = await livePermissions(userId, tenantId);
+			if (!held) return null;
+			return Object.freeze({
+				id: userId,
+				tenantId,
+				kind: "human",
+				scopes: Object.freeze(scopes.filter((scope) => held.has(scope))),
+				tenantBinding: "direct",
+				[LOCAL_MCP_TOKEN_PRINCIPAL]: true
+			});
+		}
+	});
+}
+function normalizeScopes(value, fail) {
+	if (!Array.isArray(value) || value.length === 0) throw fail("invalid_scope", "An MCP token needs at least one scope.");
+	if (value.length > MAX_SCOPES) throw fail("invalid_scope", "An MCP token may carry at most 64 scopes.");
+	for (const scope of value) if (typeof scope !== "string" || scope.length > MAX_SCOPE_LENGTH || !SCOPE_PATTERN.test(scope)) throw fail("invalid_scope", "Invalid MCP token scope.");
+	return [...new Set(value)].sort();
+}
+function normalizeLabel(value, fail) {
+	if (value === void 0) return null;
+	const label = typeof value === "string" ? value.trim() : "";
+	if (label.length === 0 || label.length > MAX_LABEL_LENGTH || /[\u0000-\u001f\u007f]/u.test(label)) throw fail("invalid_configuration", "An MCP token label must be 1-80 printable characters.");
+	return label;
+}
+function parseScopes(value) {
+	if (typeof value !== "string") return null;
+	try {
+		const parsed = JSON.parse(value);
+		return Array.isArray(parsed) && parsed.every((scope) => typeof scope === "string") ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/application-identity.ts
+function resolveApplicationId(options = {}) {
+	if (options.explicitId) return validateApplicationId(options.explicitId);
+	let packageName = options.packageName;
+	if (packageName === void 0) {
+		const sourceRoot = options.sourceRoot ?? process.cwd();
+		packageName = JSON.parse(readFileSync(join(sourceRoot, "package.json"), "utf8")).name;
+	}
+	if (typeof packageName !== "string" || packageName.trim() === "") throw new Error("package.json must declare a non-empty package name.");
+	return encodeApplicationId(packageName);
+}
+function databaseTargetIdentity(value) {
+	if (!value) return null;
+	try {
+		const target = new URL(value);
+		const sslMode = target.searchParams.get("sslmode");
+		target.username = "";
+		target.password = "";
+		target.search = "";
+		target.hash = "";
+		if (sslMode) target.searchParams.set("sslmode", sslMode);
+		return target.toString();
+	} catch {
+		return resolve(value);
+	}
+}
+function runtimeConfigurationFingerprint(runtime, environment = process.env) {
+	return createHash("sha256").update(JSON.stringify({
+		profile: runtime.profile,
+		providers: runtime.providers,
+		databaseTarget: databaseTargetIdentity(environment.DATABASE_URL),
+		host: environment.HOST || null,
+		port: environment.PORT || null,
+		origin: environment.ORIGIN || null,
+		backgroundJobs: environment.SMRT_BACKGROUND_JOBS === "true",
+		readinessModules: {
+			authentication: environment.SMRT_AUTH_READINESS_MODULE || null,
+			assets: environment.SMRT_ASSETS_READINESS_MODULE || null,
+			secrets: environment.SMRT_SECRETS_READINESS_MODULE || null
+		},
+		mcpAuthorization: {
+			resource: environment.SMRT_MCP_RESOURCE || null,
+			issuer: environment.SMRT_MCP_ISSUER || null,
+			jwksUri: environment.SMRT_MCP_JWKS_URI || null,
+			scopes: environment.SMRT_MCP_SCOPES || null
+		}
+	})).digest("hex");
+}
+//#endregion
 //#region src/error-code.ts
 function errorCode(error) {
 	return error && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : void 0;
@@ -1132,6 +1380,10 @@ function prepareApplicationStateRoot(options) {
 	}
 	return stateRoot;
 }
+var ONBOARDING_HANDOFF_FILES = Object.freeze(["onboarding.json", "onboarding-launch.html"]);
+function removeOnboardingHandoff(stateRoot) {
+	for (const file of ONBOARDING_HANDOFF_FILES) rmSync(join(stateRoot, file), { force: true });
+}
 //#endregion
 //#region src/writer-lease.ts
 function validateRecord(record) {
@@ -1345,6 +1597,45 @@ async function validateLocalDatabaseStorage(options) {
 	if (database.isSymbolicLink() || !database.isFile() || currentUid !== void 0 && database.uid !== currentUid || (database.mode & 511) !== 384) throw unsafeFilesystemEntry(`Local application database must be a current-user-owned mode-0600 file: ${paths.database}`);
 	return paths;
 }
+async function openLocalMcpTokenStore(options) {
+	const paths = await validateLocalDatabaseStorage(options);
+	const canonicalSourceRoot = await realpath(resolve(options.sourceRoot ?? process.cwd()));
+	const db = await getDatabase({
+		type: "sqlite",
+		url: paths.database,
+		cache: false,
+		secureFile: {
+			driver: "node:sqlite",
+			custody: "trusted-parent",
+			root: paths.root
+		}
+	});
+	try {
+		await tuneLocalSqlite(db);
+		await ensureLocalMcpTokenTable(db);
+	} catch (error) {
+		throw await closeDatabaseAfterFailure(db, error);
+	}
+	const store = localMcpTokenStore(db, paths, canonicalSourceRoot, options.now ?? (() => /* @__PURE__ */ new Date()));
+	return Object.freeze({
+		issue: store.issue,
+		list: store.list,
+		revoke: store.revoke,
+		verify: store.verify,
+		close: async () => {
+			await db.close?.();
+		}
+	});
+}
+function localMcpTokenStore(db, paths, canonicalSourceRoot, now) {
+	return createLocalMcpTokenStore({
+		db,
+		now,
+		readSecret: () => validateApplicationSecret(paths.applicationSecret, canonicalSourceRoot),
+		findOwner: findExistingOwner,
+		fail: (code, message) => new LocalRuntimeError(code, message)
+	});
+}
 var MIGRATION_FAILED_MESSAGE = "The application migration step failed; run pnpm app:setup and inspect the private migration logs.";
 var LocalRuntimeError = class extends Error {
 	constructor(code, message) {
@@ -1400,6 +1691,7 @@ async function initializeLocalApplicationRuntime(options) {
 			throw migrationFailed(migrationFailure);
 		}
 		await ensureBootstrapTable(db);
+		await ensureLocalMcpTokenTable(db);
 		const runtime = new InitializedLocalApplicationRuntime({
 			db,
 			paths,
@@ -1446,6 +1738,7 @@ var InitializedLocalApplicationRuntime = class {
 	resolvedRuntime;
 	backgroundJobsEnabled;
 	paidCapabilitiesEnabled;
+	mcpTokens;
 	bootstrapTtlSeconds;
 	sessionTtlSeconds;
 	now;
@@ -1461,6 +1754,7 @@ var InitializedLocalApplicationRuntime = class {
 		this.paidCapabilitiesEnabled = state.paidCapabilities;
 		this.now = state.now;
 		this.canonicalSourceRoot = state.canonicalSourceRoot;
+		this.mcpTokens = localMcpTokenStore(state.db, state.paths, state.canonicalSourceRoot, state.now);
 	}
 	/**
 	* Issue the first short-lived owner invitation when none is active.
@@ -2253,6 +2547,6 @@ function isDirectoryNotEmpty(error) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOTEMPTY";
 }
 //#endregion
-export { initializeDeployedApplicationRuntime as A, lockOwnerPid as C, reclaimStaleRecord as D, RECLAIM_MUTEX_FILE as E, resolveApplicationId as M, runtimeConfigurationFingerprint as N, DeployedRuntimeCleanupError as O, isStaleOperationLock as S, withOperationLock as T, projectRuntimeDiagnostics as _, prepareLocalDatabaseStorage as a, findInstalledPackage as b, validateLocalDatabaseStorage as c, prepareApplicationStateRoot as d, resolveApplicationStateRoot as f, RUNTIME_WORKER_FRESHNESS_SECONDS as g, RUNTIME_DIAGNOSTICS_SCHEMA_VERSION as h, initializeLocalApplicationRuntime as i, isSessionTenantAuthorized as j, DeployedRuntimeError as k, acquireWriterLease as l, MAX_RUNTIME_DIAGNOSTIC_TOOLS as m, MIGRATION_FAILED_MESSAGE as n, resolveLocalRuntimePaths as o, MAX_RUNTIME_DIAGNOSTIC_ERRORS as p, encodeApplicationId as r, validateApplicationId as s, LocalRuntimeError as t, readActiveWriterLease as u, PROVIDER_READINESS_SETTINGS as v, processExists as w, resolveReadinessModule as x, createProviderReadinessProbe as y };
+export { reclaimStaleRecord as A, deepFrozenPlainCopy as B, findInstalledPackage as C, processExists as D, lockOwnerPid as E, LOCAL_MCP_TOKEN_PRINCIPAL as F, initializeDeployedApplicationRuntime as G, resolveBoundMembershipPermissions as H, LOCAL_MCP_TOKEN_TABLE as I, isSessionTenantAuthorized as K, MAX_LOCAL_MCP_TOKEN_TTL_SECONDS as L, runtimeConfigurationFingerprint as M, DEFAULT_LOCAL_MCP_TOKEN_TTL_SECONDS as N, withOperationLock as O, LOCAL_MCP_TOKEN_PREFIX as P, isLocalMcpTokenPrincipal as R, createProviderReadinessProbe as S, isStaleOperationLock as T, DeployedRuntimeCleanupError as U, ownValue as V, DeployedRuntimeError as W, MAX_RUNTIME_DIAGNOSTIC_TOOLS as _, openLocalMcpTokenStore as a, projectRuntimeDiagnostics as b, validateApplicationId as c, readActiveWriterLease as d, ONBOARDING_HANDOFF_FILES as f, MAX_RUNTIME_DIAGNOSTIC_ERRORS as g, resolveApplicationStateRoot as h, initializeLocalApplicationRuntime as i, resolveApplicationId as j, RECLAIM_MUTEX_FILE as k, validateLocalDatabaseStorage as l, removeOnboardingHandoff as m, MIGRATION_FAILED_MESSAGE as n, prepareLocalDatabaseStorage as o, prepareApplicationStateRoot as p, encodeApplicationId as r, resolveLocalRuntimePaths as s, LocalRuntimeError as t, acquireWriterLease as u, RUNTIME_DIAGNOSTICS_SCHEMA_VERSION as v, resolveReadinessModule as w, PROVIDER_READINESS_SETTINGS as x, RUNTIME_WORKER_FRESHNESS_SECONDS as y, PlainDataError as z };
 
-//# sourceMappingURL=src-DZGOVGsU.js.map
+//# sourceMappingURL=src-D7cM0zHW.js.map