@happyvertical/smrt-app-runtime 0.60.9 → 0.60.11

package/AGENTS.md

@@ -46,7 +46,11 @@ Application infrastructure composition for the validated runtime profiles in
   selects the tenant slug (default `default`); because `Tenant` upserts on
   slug, the claim must look the slug up first and fail closed
   (`owner_tenant_conflict`) rather than save over it. `adoptExisting` adopts
-  only an active root tenant with zero memberships (#3032).
+  only an active root tenant with zero memberships (#3032). Fresh tenant
+  creation uses `TenantService` with the local ownership policy and a trusted
+  reserved identity. Default tenant and owner graph IDs derive from the
+  protected per-install application secret. Preserve that file when restoring
+  the same installation.
 - Bootstrap is loopback-only. Only an HMAC of the short-lived token is stored.
   A token that cannot claim fails a read-only preflight before role/catalog
   seeding (#3323); the claim transaction's conditional UPDATE stays the
@@ -73,7 +77,12 @@ Application infrastructure composition for the validated runtime profiles in
   `tenantBinding: 'direct'` and the
   `LOCAL_MCP_TOKEN_PRINCIPAL` brand; `runAsPrincipal` rejects a copy that
   widens the binding, so the two public APIs compose safely.
-  Never log or return the token outside `issue()`. The operator store opens an
+  Return bearer material only to the issuing operator or the authenticated
+  desktop credential response. The opt-in `createLocalMcpCredentialHandler`
+  requires a direct loopback peer, matching Host and exact Origin, and the sole
+  active owner's first-class session. Desktop slots use a disjoint ID namespace,
+  atomic hash replacement and terminal revocation. See the desktop protocol in
+  [README.md](README.md). The operator store opens an
   uncached connection and takes no writer lease (revocation is per request).
 - Background jobs and application-defined paid capabilities are default-off.
 - The embedded runner reuses `TaskRunner`; it is not a second job contract.

package/README.md

@@ -134,11 +134,31 @@ remains global. Startup and setup are idempotent; replayed, expired, or
 concurrent claims fail closed.
 `ownerTenant: { slug, name, adoptExisting }` (also accepted by the SvelteKit
 runtime) selects the bootstrap tenant; the default is a new tenant with slug
-`default`. Because `Tenant` upserts on its slug, the claim checks first and
-never replaces an existing tenant: it fails with `owner_tenant_conflict`, or,
-with `adoptExisting: true`, adds the owner membership to an application-seeded
-tenant only when that tenant is active, has no parent, and has no memberships of
-any status. An adopted tenant keeps its id and name. A failed claim rolls back
+`default`. The default tenant, owner User, owner Person, and owner Membership
+have separate UUIDv8 identifiers derived with domain-separated HMAC-SHA256
+from the installation's private `secrets/application.secret`. Independent
+installs of the same app get distinct identities and share the global built-in
+role IDs. Restarts reuse the same installation identities. Treat
+`secrets/application.secret` as installation identity material. Preserve it
+with the database in protected backups and during a restore or move of the
+same installation. Deleting, replacing, or rotating the file changes the
+derived identities and invalidates existing bootstrap and local MCP tokens.
+Keep only one active installation for a given secret. A copied data root
+retains the same owner, tenant, and writer IDs, and the runtime currently has
+no way to detect that copy. Start independent installations with a fresh data
+root.
+
+The invitation and active owner membership authorize the owner. The same
+seed derives a separate writer UUID. The local runtime binds it to the
+database so local edits to tracked rows identify this installation, including
+after a restart.
+
+A tenant with the selected slug causes `owner_tenant_conflict`, unless
+`adoptExisting: true` explicitly allows adopting an active root tenant with
+zero memberships of any status. An adopted tenant keeps its id and name.
+The claim rejects an unrelated row using the reserved tenant UUID and an
+account using the owner UUID or the claimed email. The owner Person and
+Membership also use strict inserts. A failed claim rolls back
 and leaves the invitation claimable.
 Authenticated session TTLs are configured in whole seconds with a minimum of
 one second, and invalid values are rejected before filesystem mutation.
@@ -148,6 +168,73 @@ explicitly enabled. With embedded job topology, `createEmbeddedJobRunner()`
 returns the normal s-m-r-t `TaskRunner`, so the application keeps one enqueue
 and execution contract without requiring a separate worker service.
 
+### Local desktop MCP credentials
+
+A desktop product can mount this opt-in SvelteKit route in
+`src/routes/api/local/mcp-credentials/+server.ts`.
+
+```ts
+import { createLocalMcpCredentialHandler } from '@happyvertical/smrt-app-runtime/sveltekit';
+import { runtime } from '$lib/server/smrt';
+
+export const POST = createLocalMcpCredentialHandler(runtime);
+```
+
+Serve it on the desktop app's direct loopback listener, with the adapter's
+socket peer address and request Host. Keep forwarded address, host, and
+protocol configuration unset. Set adapter-node's
+`ORIGIN` to the actual desktop URL, such as `http://127.0.0.1:4678`, because
+adapter-node otherwise assumes HTTPS. The handler checks the socket peer,
+loopback URL host, matching Host and exact Origin. When the browser
+sends `Sec-Fetch-Site`, it must be `same-origin`. Call the endpoint from the
+app's signed-in, same-origin desktop webview using its normal session cookie.
+The session must use local bootstrap, password or passkey authentication,
+have a direct active membership, and match the sole active system Owner
+membership of the installation. Device, layered and permission-capped sessions
+are rejected.
+
+Send a JSON POST with an opaque lowercase UUIDv4 `id` generated by the
+desktop app, a nonempty array of permission slugs, and an explicit integer
+lifetime from 60 to 31,536,000 seconds.
+
+```json
+{
+  "action": "put",
+  "id": "2c70f518-b95a-445b-a75e-8126ae7c032a",
+  "scopes": ["notes.read"],
+  "expiresInSeconds": 3600
+}
+```
+
+The first PUT creates the slot. A later POST with the same `action: "put"`
+replaces its bearer, scopes and expiry atomically. Scopes must be held by
+both the live owner and the authenticated session. Successful replies carry
+`{ id, token, scopes, expiresAt }` in a private `Cache-Control: no-store`
+response. Pass the bearer directly to native credential handling for the MCP
+bridge. Keep it out of arguments, URLs, logs, browser storage, and generated
+plugin artifacts. The installation secret stays on the server, and the
+database stores only the bearer HMAC.
+
+Persist the non-secret slot ID before the first request and serialize actions
+per slot. A failed write preserves the previous credential. If the outcome is
+unknown or the response is lost, repeat PUT with the same ID. Each successful
+write produces a fresh credential, and only the latest committed write
+verifies. A retry therefore recovers the slot without leaving an extra active
+credential.
+
+Send `{ "action": "revoke", "id": "<slot-id>" }` with an unrestricted owner
+session to disconnect. Repeating it returns `{ "status": "revoked" }`.
+Revocation is permanent for the slot even if a PUT was delayed or no PUT
+completed, so use a new UUID to reconnect. The operator CLI can list or
+revoke the stored UUIDv8 record. Desktop slots and manual CLI token IDs are
+separate namespaces.
+
+Failures carry a fixed `code` and no credentials. A revoked slot returns
+`409 slot_unavailable`; validation failures return `400 invalid_request`
+or `400 invalid_scope`; requests failing the trust checks return
+`403 forbidden`. Deployed profiles return `404 unavailable` to requests
+that reach the profile check.
+
 ## SvelteKit entry
 
 `@happyvertical/smrt-app-runtime/sveltekit` composes the profile runtime,

package/dist/chunks/{src-DP7SxcSY.js → src-DG72tyzB.js}

@@ -6,6 +6,7 @@ import { dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:p
 import { promisify } from "node:util";
 import { Worker } from "node:worker_threads";
 import { resolveApplicationRuntime } from "@happyvertical/smrt-config";
+import { setDatabaseSyncDeviceId } from "@happyvertical/smrt-core";
 import { SCHEDULED_JOB_QUEUE, ScheduleRunner, TaskRunner } from "@happyvertical/smrt-jobs";
 import { Person, ProfileTypeCollection } from "@happyvertical/smrt-profiles";
 import { withSystemContext } from "@happyvertical/smrt-tenancy";
@@ -16,6 +17,25 @@ import { chmodSync, closeSync, constants as constants$1, existsSync, lstatSync,
 import { DatabaseSync } from "node:sqlite";
 import { registerHooks } from "node:module";
 import { fileURLToPath, pathToFileURL } from "node:url";
+//#region src/local-installation-identity.ts
+function installationUuid(key, purpose) {
+	const bytes = createHmac("sha256", key).update(`smrt/local-installation/v1/${purpose}`).digest();
+	bytes[6] = bytes[6] & 15 | 128;
+	bytes[8] = bytes[8] & 63 | 128;
+	const hex = bytes.toString("hex", 0, 16);
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function deriveLocalInstallationIdentity(applicationSecret) {
+	const key = Buffer.from(applicationSecret.trim(), "base64url");
+	return {
+		deviceId: installationUuid(key, "device"),
+		tenantId: installationUuid(key, "default-tenant"),
+		ownerId: installationUuid(key, "owner"),
+		profileId: installationUuid(key, "owner-profile"),
+		membershipId: installationUuid(key, "owner-membership")
+	};
+}
+//#endregion
 //#region src/deployed-runtime.ts
 var DeployedRuntimeError = class extends Error {
 	constructor(code, message, component) {
@@ -688,6 +708,8 @@ var MAX_SCOPE_LENGTH = 128;
 var MAX_LABEL_LENGTH = 80;
 var SCOPE_PATTERN = /^[\x21\x23-\x5b\x5d-\x7e]+$/u;
 var TOKEN_PATTERN = /^smrt_mcp_[A-Za-z0-9_-]{43}$/u;
+var DESKTOP_SLOT_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
+var DESKTOP_SLOT_LABEL = "Desktop integration";
 var TOKEN_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u;
 var HMAC_DOMAIN = "smrt.local-mcp-token.v1\0";
 var LOCAL_MCP_TOKEN_PRINCIPAL = /* @__PURE__ */ Symbol.for("@happyvertical/smrt-app-runtime/local-mcp-token-principal");
@@ -744,7 +766,7 @@ function createLocalMcpTokenStore(deps) {
 			if (fields === null || typeof fields !== "object") throw fail("invalid_configuration", "MCP token input must be an object.");
 			const scopes = normalizeScopes(ownValue(fields, "scopes"), fail);
 			const ttl = ownValue(fields, "expiresInSeconds") ?? 2592e3;
-			if (!Number.isSafeInteger(ttl) || ttl < 60 || ttl > 31536e3) throw fail("invalid_configuration", "MCP token lifetime must be between one minute and 365 days.");
+			validateTtl(ttl, fail);
 			const label = normalizeLabel(ownValue(fields, "label"), fail);
 			const owner = await deps.findOwner(db);
 			if (!owner) throw fail("owner_unavailable", "No local owner exists yet; finish owner setup before issuing MCP tokens.");
@@ -769,6 +791,58 @@ function createLocalMcpTokenStore(deps) {
 				expiresAt
 			});
 		},
+		async manageDesktopCredential(session, input) {
+			let request;
+			try {
+				request = deepFrozenPlainCopy(input);
+			} catch (error) {
+				if (!(error instanceof PlainDataError)) throw error;
+				throw fail("invalid_configuration", "Invalid desktop MCP input.");
+			}
+			if (typeof request?.id !== "string" || !DESKTOP_SLOT_ID_PATTERN.test(request.id)) throw fail("invalid_configuration", "Invalid desktop MCP slot id.");
+			const id = `${request.id.slice(0, 14)}8${request.id.slice(15)}`;
+			const { userId, tenantId, permissions } = session;
+			const allowed = new Set(permissions);
+			const owner = await deps.findOwner(db, true);
+			if (!owner || owner.userId !== userId || owner.tenantId !== tenantId) throw fail("owner_unavailable", "The local owner session is required.");
+			const user = await (await UserCollection.create({ db })).get({ id: owner.userId });
+			const held = await livePermissions(owner.userId, owner.tenantId);
+			if (!user?.isActive() || !held) throw fail("owner_unavailable", "The local owner session is required.");
+			const created = now();
+			const createdAt = created.toISOString();
+			if (request.action === "revoke") return (await db.query(`INSERT INTO _smrt_local_mcp_tokens
+             (id, token_hash, user_id, tenant_id, scopes, label, created_at, expires_at, revoked_at)
+           VALUES (?, ?, ?, ?, '[]', ?, ?, ?, ?)
+           ON CONFLICT(id) DO UPDATE SET revoked_at =
+             coalesce(_smrt_local_mcp_tokens.revoked_at, excluded.revoked_at)
+           WHERE _smrt_local_mcp_tokens.user_id = excluded.user_id
+             AND _smrt_local_mcp_tokens.tenant_id = excluded.tenant_id
+           RETURNING id`, id, randomBytes(32).toString("hex"), owner.userId, owner.tenantId, DESKTOP_SLOT_LABEL, createdAt, createdAt, createdAt)).rows.length > 0 ? "revoked" : "slot_unavailable";
+			if (request.action !== "put") throw fail("invalid_configuration", "Invalid desktop MCP action.");
+			const scopes = normalizeScopes(request.scopes, fail);
+			validateTtl(request.expiresInSeconds, fail);
+			if (scopes.some((scope) => !held.has(scope) || !allowed.has(scope))) throw fail("invalid_scope", "Desktop MCP scopes are not authorized.");
+			const expiresAt = new Date(created.getTime() + request.expiresInSeconds * 1e3).toISOString();
+			const token = `${LOCAL_MCP_TOKEN_PREFIX}${randomBytes(32).toString("base64url")}`;
+			if ((await db.query(`INSERT INTO _smrt_local_mcp_tokens
+           (id, token_hash, user_id, tenant_id, scopes, label, created_at, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(id) DO UPDATE SET
+           token_hash = excluded.token_hash, scopes = excluded.scopes,
+           created_at = excluded.created_at, expires_at = excluded.expires_at
+         WHERE _smrt_local_mcp_tokens.revoked_at IS NULL
+           AND _smrt_local_mcp_tokens.user_id = excluded.user_id
+           AND _smrt_local_mcp_tokens.tenant_id = excluded.tenant_id
+         RETURNING id`, id, await hashToken(token), owner.userId, owner.tenantId, JSON.stringify(scopes), DESKTOP_SLOT_LABEL, createdAt, expiresAt)).rows.length === 0) return "slot_unavailable";
+			return Object.freeze({
+				id,
+				token,
+				scopes: Object.freeze(scopes),
+				label: DESKTOP_SLOT_LABEL,
+				createdAt,
+				expiresAt
+			});
+		},
 		async list() {
 			await ensureLocalMcpTokenTable(db);
 			const result = await db.query(`SELECT id, scopes, label, created_at, expires_at, revoked_at
@@ -828,6 +902,9 @@ function createLocalMcpTokenStore(deps) {
 		}
 	});
 }
+function validateTtl(ttl, fail) {
+	if (!Number.isSafeInteger(ttl) || ttl < 60 || ttl > 31536e3) throw fail("invalid_configuration", "MCP token lifetime must be between one minute and 365 days.");
+}
 function normalizeScopes(value, fail) {
 	if (!Array.isArray(value) || value.length === 0) throw fail("invalid_scope", "An MCP token needs at least one scope.");
 	if (value.length > MAX_SCOPES) throw fail("invalid_scope", "An MCP token may carry at most 64 scopes.");
@@ -1707,7 +1784,8 @@ async function initializeLocalApplicationRuntime(options) {
 		const acquired = await acquireLocalDatabase(paths, sourceRoot, appId);
 		db = acquired.db;
 		const { canonicalSourceRoot } = acquired;
-		await prepareLocalFilesystem(paths, canonicalSourceRoot);
+		const identity = await prepareLocalFilesystem(paths, canonicalSourceRoot);
+		setDatabaseSyncDeviceId(db, identity.deviceId);
 		await tuneLocalSqlite(db);
 		try {
 			await options.prepareDatabase?.(db);
@@ -1727,6 +1805,7 @@ async function initializeLocalApplicationRuntime(options) {
 			paidCapabilities: options.paidCapabilities === true,
 			ownerTenant,
 			passwordPolicy: options.passwordPolicy,
+			identity,
 			now: options.now ?? (() => /* @__PURE__ */ new Date()),
 			canonicalSourceRoot
 		});
@@ -1771,6 +1850,7 @@ var InitializedLocalApplicationRuntime = class {
 	passwordPolicy;
 	now;
 	canonicalSourceRoot;
+	identity;
 	constructor(state) {
 		this.db = state.db;
 		this.paths = state.paths;
@@ -1784,6 +1864,7 @@ var InitializedLocalApplicationRuntime = class {
 		this.paidCapabilitiesEnabled = state.paidCapabilities;
 		this.now = state.now;
 		this.canonicalSourceRoot = state.canonicalSourceRoot;
+		this.identity = state.identity;
 		this.mcpTokens = localMcpTokenStore(state.db, state.paths, state.canonicalSourceRoot, state.now);
 	}
 	/**
@@ -1833,7 +1914,7 @@ var InitializedLocalApplicationRuntime = class {
            AND expires_at > ?
          RETURNING expires_at`, nowIso, tokenHash, nowIso)).rows.length === 0) await throwBootstrapClaimFailure(tx, now);
 			if (await findExistingOwner(tx)) throw new LocalRuntimeError("bootstrap_claimed", "The local owner has already been claimed.");
-			return createLocalOwnerRecords(tx, input, this.sessionTtlSeconds, this.ownerTenant, this.passwordPolicy);
+			return createLocalOwnerRecords(tx, input, this.sessionTtlSeconds, this.ownerTenant, this.identity, this.passwordPolicy);
 		});
 	}
 	/** Restore the normal server-side session created by owner bootstrap. */
@@ -1923,54 +2004,71 @@ var InitializedLocalApplicationRuntime = class {
 		return createHmac("sha256", (await validateApplicationSecret(this.paths.applicationSecret, this.canonicalSourceRoot)).trim()).update(token).digest("hex");
 	}
 };
-async function createLocalOwnerRecords(db, input, sessionTtlSeconds, ownerTenant, passwordPolicy) {
-	const existingTenant = await (await TenantCollection.create({ db })).findBySlug(ownerTenant.slug);
+async function createLocalOwnerRecords(db, input, sessionTtlSeconds, ownerTenant, identity, passwordPolicy) {
+	const tenants = await TenantCollection.create({ db });
+	const existingTenant = await tenants.findBySlug(ownerTenant.slug);
+	const defaultTenant = ownerTenant.slug === DEFAULT_OWNER_TENANT_SLUG;
+	const reservedTenant = defaultTenant ? await tenants.get(identity.tenantId) : null;
+	if (reservedTenant && reservedTenant.id !== existingTenant?.id) throw new LocalRuntimeError("owner_tenant_conflict", "The reserved local tenant identity is already in use.");
+	const users = await UserCollection.create({ db });
+	if (await users.get(identity.ownerId) || await users.findByEmail(input.email.trim())) throw new LocalRuntimeError("owner_identity_conflict", "The local owner identity is already in use.");
 	const memberships = await MembershipCollection.create({ db });
 	if (existingTenant) await assertAdoptableOwnerTenant(existingTenant, ownerTenant, memberships);
 	const profileTypes = await ProfileTypeCollection.create({ db });
+	const personType = await withSystemContext(() => profileTypes.getOrCreateGlobalBySlug("person", {
+		name: "Person",
+		description: "An individual person"
+	}));
 	const person = new Person({
 		db,
-		typeId: requireId((await withSystemContext(() => profileTypes.getOrCreateGlobalBySlug("person", {
-			name: "Person",
-			description: "An individual person"
-		}))).id, "Person profile type"),
+		id: identity.profileId,
+		_skipLoad: true,
+		typeId: requireId(personType.id, "Person profile type"),
 		tenantId: null,
 		name: input.name.trim(),
 		email: input.email.trim()
 	});
 	await person.initialize();
+	person.requireInsertOnSave({ preserveDerivedSlug: true });
 	await person.save();
-	const user = await (await UserCollection.create({ db })).create({
+	const user = await users.create({
+		id: identity.ownerId,
+		_insertOnly: true,
 		profileId: requireId(person.id, "Person"),
 		email: input.email.trim(),
 		status: UserStatus.ACTIVE,
 		lastLoginAt: /* @__PURE__ */ new Date()
 	});
-	await user.save();
 	const userId = requireId(user.id, "User");
-	let tenant;
-	let membership;
+	let ownership;
 	if (existingTenant) {
 		const ownerRole = await (await RoleCollection.create({ db })).findSystemRoleBySlug(DEFAULT_ROLE_SLUGS.OWNER);
-		const created = await memberships.create({
-			userId,
-			tenantId: requireId(existingTenant.id, "Tenant"),
-			roleId: requireId(ownerRole?.id, "Owner role"),
-			status: MembershipStatus.ACTIVE
-		});
-		await created.save();
-		tenant = existingTenant;
-		membership = created;
+		ownership = {
+			tenant: existingTenant,
+			membership: await memberships.create({
+				id: identity.membershipId,
+				_insertOnly: true,
+				userId,
+				tenantId: requireId(existingTenant.id, "Tenant"),
+				roleId: requireId(ownerRole?.id, "Owner role"),
+				status: MembershipStatus.ACTIVE
+			})
+		};
 	} else {
 		const tenantName = input.tenantName?.trim() || ownerTenant.name;
-		const tenantService = new TenantService({ db }, {
+		ownership = await (await TenantService.create({ db }, {
 			mode: "required",
 			maxTenants: 1,
 			defaultName: tenantName
+		})).createTenantWithOwnership(userId, tenantName, {
+			slug: ownerTenant.slug,
+			reservedIdentity: {
+				tenantId: defaultTenant ? identity.tenantId : void 0,
+				membershipId: identity.membershipId
+			}
 		});
-		await tenantService.initialize();
-		({tenant, membership} = await tenantService.createTenantWithOwnership(userId, tenantName, { slug: ownerTenant.slug }));
 	}
+	const { tenant, membership } = ownership;
 	person.tenantId = requireId(tenant.id, "Tenant");
 	await person.save();
 	const session = await (await SessionCollection.create({ db })).createSession({
@@ -2022,11 +2120,12 @@ function resolveOwnerTenant(options) {
 		adoptExisting: options?.adoptExisting === true
 	});
 }
-async function findExistingOwner(db) {
+async function findExistingOwner(db, requireUnique = false) {
 	const ownerRole = await (await RoleCollection.create({ db })).findSystemRoleBySlug(DEFAULT_ROLE_SLUGS.OWNER);
 	if (!ownerRole?.id) return null;
-	const active = (await (await MembershipCollection.create({ db })).findByRole(ownerRole.id)).find((membership) => membership.status === MembershipStatus.ACTIVE && typeof membership.userId === "string" && typeof membership.tenantId === "string");
-	return active ? {
+	const activeOwners = (await (await MembershipCollection.create({ db })).findByRole(ownerRole.id)).filter((membership) => membership.status === MembershipStatus.ACTIVE && typeof membership.userId === "string" && typeof membership.tenantId === "string");
+	const active = activeOwners[0];
+	return active && (!requireUnique || activeOwners.length === 1) ? {
 		userId: active.userId,
 		tenantId: active.tenantId
 	} : null;
@@ -2233,6 +2332,7 @@ async function prepareLocalFilesystem(paths, canonicalSourceRoot) {
 	await ensureSafeDirectoryTree(paths.assets, canonicalSourceRoot);
 	await ensureSafeDirectoryTree(paths.secrets, canonicalSourceRoot);
 	await ensureApplicationSecret(paths.applicationSecret, canonicalSourceRoot);
+	return deriveLocalInstallationIdentity(await validateApplicationSecret(paths.applicationSecret, canonicalSourceRoot));
 }
 async function prepareDedicatedRoot(path, canonicalSourceRoot, appId, createdDirectories) {
 	const finalMarker = resolve(path, `${ROOT_MARKER_PREFIX}${appId}`);
@@ -2775,4 +2875,4 @@ function isDirectoryNotEmpty(error) {
 //#endregion
 export { reclaimStaleRecord as A, deepFrozenPlainCopy as B, findInstalledPackage as C, processExists as D, lockOwnerPid as E, LOCAL_MCP_TOKEN_PRINCIPAL as F, initializeDeployedApplicationRuntime as G, resolveBoundMembershipPermissions as H, LOCAL_MCP_TOKEN_TABLE as I, isSessionTenantAuthorized as K, MAX_LOCAL_MCP_TOKEN_TTL_SECONDS as L, runtimeConfigurationFingerprint as M, DEFAULT_LOCAL_MCP_TOKEN_TTL_SECONDS as N, withOperationLock as O, LOCAL_MCP_TOKEN_PREFIX as P, isLocalMcpTokenPrincipal as R, createProviderReadinessProbe as S, isStaleOperationLock as T, DeployedRuntimeCleanupError as U, ownValue as V, DeployedRuntimeError as W, MAX_RUNTIME_DIAGNOSTIC_TOOLS as _, openLocalMcpTokenStore as a, projectRuntimeDiagnostics as b, validateApplicationId as c, readActiveWriterLease as d, ONBOARDING_HANDOFF_FILES as f, MAX_RUNTIME_DIAGNOSTIC_ERRORS as g, resolveApplicationStateRoot as h, initializeLocalApplicationRuntime as i, resolveApplicationId as j, RECLAIM_MUTEX_FILE as k, validateLocalDatabaseStorage as l, removeOnboardingHandoff as m, MIGRATION_FAILED_MESSAGE as n, prepareLocalDatabaseStorage as o, prepareApplicationStateRoot as p, encodeApplicationId as r, resolveLocalRuntimePaths as s, LocalRuntimeError as t, acquireWriterLease as u, RUNTIME_DIAGNOSTICS_SCHEMA_VERSION as v, resolveReadinessModule as w, PROVIDER_READINESS_SETTINGS as x, RUNTIME_WORKER_FRESHNESS_SECONDS as y, PlainDataError as z };
 
-//# sourceMappingURL=src-DP7SxcSY.js.map
+//# sourceMappingURL=src-DG72tyzB.js.map