@happyvertical/smrt-cli 0.53.4 → 0.53.5

package/dist/{cli-BRFsobey.js → cli-OZsH5cdL.js}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { accessSync, constants, cpSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { accessSync, chmodSync, closeSync, constants, cpSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { acquireWriterLease, createProviderReadinessProbe, findInstalledPackage, prepareApplicationStateRoot, readActiveWriterLease, resolveApplicationId, resolveApplicationStateRoot, runtimeConfigurationFingerprint, withOperationLock } from "@happyvertical/smrt-app-runtime";
+import { acquireWriterLease, createProviderReadinessProbe, findInstalledPackage, openLocalMcpTokenStore, prepareApplicationStateRoot, readActiveWriterLease, resolveApplicationId, resolveApplicationStateRoot, runtimeConfigurationFingerprint, withOperationLock } from "@happyvertical/smrt-app-runtime";
 import { spawn, spawnSync } from "node:child_process";
 import { platform } from "node:os";
 import { randomBytes } from "node:crypto";
@@ -27,10 +27,81 @@ var AppCommandError = class extends Error {
 		});
 	}
 };
+/**
+* A `smrt app start` whose web process never proved readiness. Carries the
+* already-redacted, bounded tail of that process's output and the private
+* log it came from, for the error envelope.
+*/
+var ApplicationStartError = class extends Error {
+	output;
+	logFile;
+	constructor(message, output, logFile) {
+		super(message);
+		this.name = "ApplicationStartError";
+		this.output = output;
+		this.logFile = logFile;
+	}
+};
+/** Replacement marker for every redacted value. */
+var REDACTED = "[redacted]";
 /** Minimum length before an environment value is treated as redactable. */
 var MIN_REDACTED_VALUE_LENGTH = 8;
 /** Environment names whose values must never reach operator output. */
 var SECRET_ENVIRONMENT_NAME = /(?:^|_)(?:DATABASE_URL|URL|DSN|TOKEN|SECRET|PASSWORD|PASSWD|KEY|CREDENTIALS?|AUTH)(?:_|$)/i;
+/** URL userinfo (`scheme://user:pass@`); group 2 is the credential span. */
+var URL_USERINFO = /\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:'"]*(?::[^\s/@'"]*)?)@/dgi;
+/** Query/parameter credential (`?token=…`); group 2 is the value span. */
+var QUERY_CREDENTIAL = /([?&;](?:token|password|secret|key|access_token)=)([^&\s"'<>]+)/dgi;
+/** Bearer token; group 2 is the token span (8+ characters unless strict). */
+var BEARER = /\b(Bearer\s+)([A-Za-z0-9._~+/=-]{8,})/dg;
+var BEARER_ANY_LENGTH = /\b(Bearer\s+)([A-Za-z0-9._~+/=-]+)/dg;
+function structuralSpans(text, strict) {
+	const spans = [];
+	for (const pattern of [
+		URL_USERINFO,
+		QUERY_CREDENTIAL,
+		strict ? BEARER_ANY_LENGTH : BEARER
+	]) for (const match of text.matchAll(pattern)) {
+		const span = match.indices?.[2];
+		if (span && (span[1] > span[0] || pattern === URL_USERINFO)) spans.push([span[0], span[1]]);
+	}
+	return spans;
+}
+/** Every existing `[redacted]` marker in `text`: opaque to later passes. */
+function markerSpans(text) {
+	return literalSpans(text, [REDACTED], []);
+}
+function literalSpans(text, values, opaque) {
+	const spans = [];
+	for (const value of values) for (let index = text.indexOf(value); index !== -1; index = text.indexOf(value, index + 1)) {
+		const end = index + value.length;
+		if (opaque.some(([start, stop]) => index >= start && end <= stop)) continue;
+		spans.push([index, end]);
+	}
+	return spans;
+}
+/** Replace the union of `spans` (overlapping or touching spans merge). */
+function maskSpans(text, spans) {
+	if (spans.length === 0) return text;
+	spans.sort((left, right) => left[0] - right[0] || right[1] - left[1]);
+	let result = "";
+	let cursor = 0;
+	let [start, end] = spans[0];
+	const flush = () => {
+		result += text.slice(cursor, start) + REDACTED;
+		cursor = end;
+	};
+	for (const [nextStart, nextEnd] of spans.slice(1)) {
+		if (nextStart <= end) {
+			end = Math.max(end, nextEnd);
+			continue;
+		}
+		flush();
+		[start, end] = [nextStart, nextEnd];
+	}
+	flush();
+	return result + text.slice(cursor);
+}
 /**
 * Remove secret material from an operator-facing message.
 *
@@ -38,12 +109,37 @@ var SECRET_ENVIRONMENT_NAME = /(?:^|_)(?:DATABASE_URL|URL|DSN|TOKEN|SECRET|PASSW
 * connection string, credential, or bootstrap token. Redaction covers:
 * literal values of secret-named environment variables, URL userinfo,
 * `token=`/`password=`/`secret=` query values, and bearer tokens.
+*
+* Every span is located on the raw text and the union is masked at once, so
+* a literal value can never split a structural match (an env value that is
+* a Bearer-token prefix, or a URL's scheme and host, used to leave the rest
+* of the token or the URL password visible). A final structural pass over
+* the masked text keeps everything the earlier sequential order masked.
 */
-function redactSecrets(message, environment = process.env) {
-	let redacted = message;
-	const values = Object.entries(environment).filter(([name, value]) => typeof value === "string" && value.length >= MIN_REDACTED_VALUE_LENGTH && SECRET_ENVIRONMENT_NAME.test(name)).map(([, value]) => value).sort((left, right) => right.length - left.length);
-	for (const value of values) redacted = redacted.replaceAll(value, "[redacted]");
-	return redacted.replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:'"]*(?::[^\s/@'"]*)?@/gi, "$1[redacted]@").replace(/([?&;](?:token|password|secret|key|access_token)=)[^&\s"'<>]+/gi, "$1[redacted]").replace(/\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/g, "Bearer [redacted]");
+function redactSecrets(message, environment = process.env, options = {}) {
+	const strict = options.strict === true;
+	const minimumLength = strict ? 1 : MIN_REDACTED_VALUE_LENGTH;
+	const secretValues = Object.entries(environment).filter(([name, value]) => typeof value === "string" && value.length >= minimumLength && SECRET_ENVIRONMENT_NAME.test(name)).map(([, value]) => value);
+	const markers = markerSpans(message);
+	const masked = maskSpans(message, [
+		...markers,
+		...structuralSpans(message, strict),
+		...literalSpans(message, secretValues, markers)
+	]);
+	return maskSpans(masked, [...markerSpans(masked), ...structuralSpans(masked, strict)]);
+}
+/**
+* The last `maxBytes` of `text`: a leading partial line (and any split
+* multi-byte character) is dropped when the cut lands mid-text. Redact
+* before cutting; cutting never exposes anything redaction masked.
+*/
+function boundedTail(text, maxBytes) {
+	const bytes = Buffer.from(text, "utf8");
+	if (bytes.length <= maxBytes) return text;
+	const tail = bytes.subarray(bytes.length - maxBytes).toString("utf8");
+	let cut = tail.slice(tail.indexOf("\n") + 1);
+	while (Buffer.byteLength(cut) > maxBytes) cut = cut.slice(1);
+	return cut;
 }
 //#endregion
 //#region src/app/identity.ts
@@ -162,14 +258,22 @@ function createBrowserOpener(sourceRoot) {
 		runChild(sourceRoot, binary, args);
 	};
 }
-/** Default runtime resolver: reload `smrt.config` without the cache. */
+/**
+* Default runtime resolver: reload `smrt.config` without the cache.
+*
+* Profile selection is `resolveEffectiveApplicationRuntime()` from
+* smrt-config — the rule the web process applies in app-runtime's SvelteKit
+* entry — so the operator and the server it manages never disagree: no
+* `runtime` block (or no config file) is the `local` profile, and a present
+* value that is not a valid block (`null`, `false`, `0`, `''`, ...) fails
+* closed.
+*/
 async function resolveConfiguredRuntime(sourceRoot) {
-	const { loadConfig, resolveConfiguredApplicationRuntime } = await import("@happyvertical/smrt-config");
-	await loadConfig({
+	const { loadConfig, resolveEffectiveApplicationRuntime } = await import("@happyvertical/smrt-config");
+	return resolveEffectiveApplicationRuntime(await loadConfig({
 		cache: false,
 		searchFrom: sourceRoot
-	});
-	return resolveConfiguredApplicationRuntime();
+	}));
 }
 /** Build the default dependency set for `sourceRoot`. */
 async function defaultDependencies(sourceRoot) {
@@ -391,6 +495,23 @@ function resolveViteEntry(sourceRoot) {
 	if (!existsSync(entry)) throw new ViteLauncherError("The installed Vite package CLI is missing; reinstall dependencies.");
 	return entry;
 }
+/** Loopback host every `smrt app` URL (onboarding, `open`, `start`) names. */
+var LOOPBACK_HOST = "127.0.0.1";
+/**
+* Arguments for `smrt app dev`: the caller's Vite arguments, plus
+* `--host 127.0.0.1` unless they name `--host`, and `--port $PORT` when
+* `PORT` is set and they name no `--port`. Vite's own default host is
+* `localhost`, which Node resolves to `[::1]` first, so the dev server would
+* not answer the `http://127.0.0.1:<PORT>` URL onboarding and `app:open` hand
+* out. An explicit `--host`/`--port` (or `smrt app vite dev …`) wins.
+*/
+function devServerArguments(args, env = process.env) {
+	const names = (flag) => args.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
+	const result = [...args];
+	if (!names("--host")) result.push("--host", LOOPBACK_HOST);
+	if (!names("--port") && env.PORT) result.push("--port", env.PORT);
+	return result;
+}
 /**
 * Run the application's Vite CLI in this process with `args` verbatim. The
 * caller has already loaded `.env` without overriding the shell.
@@ -576,9 +697,14 @@ var APP_OPERATIONS = [
 	"export",
 	"import"
 ];
-function printJson(context, value, pretty = false) {
+function printJson$1(context, value, pretty = false) {
 	context.io.stdout(`${pretty ? JSON.stringify(value, null, 2) : JSON.stringify(value)}\n`);
 }
+/** Print the one-time URL to the operator's terminal only, never to logs. */
+function printOnboardingUrl(context, url) {
+	if (!url || !context.io.operatorTerminal) return;
+	context.io.operatorTerminal(`Open this one-time owner setup link on this device (it works once and expires):\n  ${url}\n`);
+}
 function ensurePrivateDirectory(path) {
 	mkdirSync(path, {
 		recursive: true,
@@ -710,7 +836,7 @@ async function setup(context, operationLock) {
 			onboardingRecovery: onboardingAvailable ? "pnpm app:open" : null,
 			secretValuesIncluded: false
 		};
-		printJson(context, report, true);
+		printJson$1(context, report, true);
 		return {
 			...report,
 			onboardingUrl: retainedOnboardingUrl
@@ -728,15 +854,17 @@ async function recoverOnboarding(context, operationLock) {
 		const initialized = await initializeLocal(context, runtime, env);
 		if (!initialized) throw new Error("Local runtime initialization failed.");
 		const invitation = await initialized.runtime.rotateBootstrapInvitation();
-		saveOnboardingUrl(context, `http://127.0.0.1:${env.PORT || "5173"}/setup?token=${encodeURIComponent(invitation.token)}`);
+		const url = `http://127.0.0.1:${env.PORT || "5173"}/setup?token=${encodeURIComponent(invitation.token)}`;
+		saveOnboardingUrl(context, url);
 		await initialized.runtime.db.close?.();
-		printJson(context, {
+		printJson$1(context, {
 			schemaVersion: 1,
 			status: "ready",
 			onboardingAvailable: true,
 			recovery: "Run pnpm app:start, then pnpm app:open.",
 			secretValuesIncluded: false
 		});
+		printOnboardingUrl(context, url);
 	} finally {
 		operatorLease.release();
 	}
@@ -778,7 +906,7 @@ async function start(context, operationLock) {
 	const existing = readOwnedProcess(pidPath(context));
 	if (existing) {
 		await waitForReady(context, url, existing.pid, existing.instance, configuration);
-		printJson(context, {
+		printJson$1(context, {
 			schemaVersion: 1,
 			status: "running",
 			pid: existing.pid
@@ -787,18 +915,30 @@ async function start(context, operationLock) {
 	}
 	ensurePrivateDirectory(preparedStateRoot(context));
 	const instance = randomBytes(16).toString("hex");
-	const child = spawn(process.execPath, [webLauncherPath(), `--smrt-instance=${instance}`], {
-		cwd: context.sourceRoot,
-		env: {
-			...env,
-			HOST: runtime.profile === "local" ? "127.0.0.1" : env.HOST || "0.0.0.0",
-			PORT: env.PORT || "5173",
-			SMRT_PROCESS_INSTANCE: instance,
-			SMRT_OPERATION_INSTANCE: operationLock?.instance
-		},
-		detached: true,
-		stdio: "ignore"
-	});
+	const childEnv = {
+		...env,
+		HOST: runtime.profile === "local" ? "127.0.0.1" : env.HOST || "0.0.0.0",
+		PORT: env.PORT || "5173",
+		SMRT_PROCESS_INSTANCE: instance,
+		SMRT_OPERATION_INSTANCE: operationLock?.instance
+	};
+	const logFile = startLogPath(context);
+	const logFd = openStartLog(logFile);
+	let child;
+	try {
+		child = spawn(process.execPath, [webLauncherPath(), `--smrt-instance=${instance}`], {
+			cwd: context.sourceRoot,
+			env: childEnv,
+			detached: true,
+			stdio: [
+				"ignore",
+				logFd,
+				logFd
+			]
+		});
+	} finally {
+		closeSync(logFd);
+	}
 	child.unref();
 	const pid = child.pid;
 	if (pid === void 0) throw new Error("The application process could not be started.");
@@ -811,15 +951,60 @@ async function start(context, operationLock) {
 	} catch (error) {
 		if (!await terminateFailedStart(context, child)) throw new Error(`${error instanceof Error ? error.message : "The application did not become ready."} Application process ${pid} did not exit after SIGTERM and SIGKILL and remains recorded; run pnpm app:stop.`);
 		rmSync(pidPath(context), { force: true });
-		throw error;
+		throw new ApplicationStartError(error instanceof Error ? error.message : "The application did not become ready.", redactedLogTail(logFile, childEnv), logFile);
 	}
-	printJson(context, {
+	printJson$1(context, {
 		schemaVersion: 1,
 		status: "started",
 		pid
 	});
 	return pid;
 }
+/** Upper bound on the web-process output a failed `start` reports. */
+var START_OUTPUT_TAIL_BYTES = 8 * 1024;
+/** Window read before redaction, so a cut never splits a reported secret. */
+var START_OUTPUT_WINDOW_BYTES = 64 * 1024;
+function startLogPath(context) {
+	return join(preparedStateRoot(context), "app.log");
+}
+/**
+* Create a fresh 0600 `app.log` for this start. The previous run's log is
+* removed first and the new one is created exclusively, so a planted link or
+* file is never written through.
+*/
+function openStartLog(path) {
+	rmSync(path, { force: true });
+	return openSync(path, "wx", 384);
+}
+/**
+* The last {@link START_OUTPUT_TAIL_BYTES} of `path`, strictly redacted
+* against the child's environment. A bounded window is redacted before it is cut, and a
+* window that starts mid-file drops its leading partial record (all of it
+* when the window holds no newline), so no fragment of a secret whose
+* prefix lies before the window can survive the cut.
+*/
+function redactedLogTail(path, env) {
+	let text;
+	try {
+		const fd = openSync(path, "r");
+		try {
+			const size = fstatSync(fd).size;
+			const length = Math.min(size, START_OUTPUT_WINDOW_BYTES);
+			const buffer = Buffer.alloc(length);
+			readSync(fd, buffer, 0, length, size - length);
+			text = buffer.toString("utf8");
+			if (length < size) {
+				const newline = text.indexOf("\n");
+				text = newline === -1 ? "" : text.slice(newline + 1);
+			}
+		} finally {
+			closeSync(fd);
+		}
+	} catch {
+		return "";
+	}
+	return boundedTail(redactSecrets(text, env, { strict: true }), START_OUTPUT_TAIL_BYTES);
+}
 /**
 * Terminate a launcher that failed to prove readiness: SIGTERM, wait, then
 * SIGKILL, wait. Resolves `true` only once the child has provably exited.
@@ -847,7 +1032,7 @@ async function stop(context) {
 	const pid = record?.pid || null;
 	if (!record || !pid) {
 		rmSync(pidPath(context), { force: true });
-		printJson(context, {
+		printJson$1(context, {
 			schemaVersion: 1,
 			status: "stopped"
 		});
@@ -857,7 +1042,7 @@ async function stop(context) {
 	if (state === "unverifiable") throw new Error(`Application process ${pid} is live but its identity could not be re-verified; app.pid was kept and no signal was sent. Retry pnpm app:stop.`);
 	if (state !== "owned" || !sendTerminationSignal(pid)) {
 		rmSync(pidPath(context), { force: true });
-		printJson(context, {
+		printJson$1(context, {
 			schemaVersion: 1,
 			status: "stopped",
 			pid
@@ -874,7 +1059,7 @@ async function stop(context) {
 		if (attempt === 39) throw new Error(`Application process ${pid} did not stop cleanly.`);
 	}
 	rmSync(pidPath(context), { force: true });
-	printJson(context, {
+	printJson$1(context, {
 		schemaVersion: 1,
 		status: "stopped",
 		pid
@@ -887,7 +1072,7 @@ async function open(context) {
 	if (onboardingUrl) saveOnboardingLaunch(context, onboardingUrl);
 	const destination = onboardingUrl ? pathToFileURL(onboardingLaunchPath(context)).toString() : url;
 	context.deps.openBrowser(destination);
-	printJson(context, {
+	printJson$1(context, {
 		schemaVersion: 1,
 		status: "opened",
 		url
@@ -1009,10 +1194,10 @@ async function doctor(context) {
 		findings,
 		secretValuesIncluded: false
 	};
-	printJson(context, report, true);
+	printJson$1(context, report, true);
 	return report.status === "error" ? 1 : 0;
 }
-async function backup(context, args, operationLock) {
+async function backup(context, args) {
 	if ((await context.deps.resolveRuntime(context.sourceRoot)).profile !== "local") throw new Error("This scaffold delegates deployed backups to the selected operator or managed provider.");
 	const explicitDestination = args[0] ? assertExternalArtifactPath({
 		sourceRoot: context.sourceRoot,
@@ -1024,41 +1209,42 @@ async function backup(context, args, operationLock) {
 		dataDirectory: process.env.SMRT_DATA_DIR,
 		sourceRoot: context.sourceRoot
 	});
-	const operatorLease = acquireWriterLease(preparedStateRoot(context), { operationInstance: operationLock?.instance });
-	try {
-		const destination = assertExternalArtifactPath({
-			sourceRoot: context.sourceRoot,
-			path: explicitDestination || join(dirname(paths.root), "backups", `${context.appId}-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}`),
-			label: "Backup destination"
-		});
-		ensurePrivateDirectory(dirname(destination));
-		try {
-			mkdirSync(destination, { mode: 448 });
-		} catch (error) {
-			if (errorCode(error) === "EEXIST") throw new Error(`Backup destination already exists: ${destination}`);
-			throw error;
-		}
+	await withOperationLock(preparedStateRoot(context), "backup", async (lock) => {
+		const operatorLease = acquireWriterLease(preparedStateRoot(context), { operationInstance: lock.instance });
 		try {
-			cpSync(paths.root, destination, {
-				recursive: true,
-				force: false,
-				errorOnExist: true
+			const destination = assertExternalArtifactPath({
+				sourceRoot: context.sourceRoot,
+				path: explicitDestination || join(dirname(paths.root), "backups", `${context.appId}-${(/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-")}`),
+				label: "Backup destination"
 			});
-		} catch (error) {
-			rmSync(destination, {
-				recursive: true,
-				force: true
+			const storageRelative = relative(paths.root, destination);
+			if (storageRelative === "" || !isAbsolute(storageRelative) && storageRelative !== ".." && !storageRelative.startsWith(`..${sep}`)) throw new Error("Backup destination must remain outside local storage.");
+			ensurePrivateDirectory(dirname(destination));
+			try {
+				mkdirSync(destination, { mode: 448 });
+			} catch (error) {
+				if (error.code !== "EEXIST") throw error;
+				throw new Error(`Backup destination already exists: ${destination}`);
+			}
+			try {
+				for (const entry of readdirSync(paths.root)) cpSync(join(paths.root, entry), join(destination, entry), {
+					recursive: true,
+					force: false,
+					errorOnExist: true
+				});
+				chmodSync(destination, 448);
+			} catch (error) {
+				throw new Error(`Backup copy failed; destination preserved at ${destination}`, { cause: error });
+			}
+			printJson$1(context, {
+				schemaVersion: 1,
+				status: "backed-up",
+				destination
 			});
-			throw error;
+		} finally {
+			operatorLease.release();
 		}
-		printJson(context, {
-			schemaVersion: 1,
-			status: "backed-up",
-			destination
-		});
-	} finally {
-		operatorLease.release();
-	}
+	});
 }
 /**
 * The application's own adapter at `scripts/smrt-portability.mjs` keeps
@@ -1068,7 +1254,7 @@ async function backup(context, args, operationLock) {
 async function loadPortabilityAdapter(context) {
 	const override = join(context.sourceRoot, "scripts", "smrt-portability.mjs");
 	if (existsSync(override)) return await import(pathToFileURL(override).href);
-	return import("./portability-DmQWSSXA.js").then((n) => n.s);
+	return import("./portability-CES1YC2m.js").then((n) => n.s);
 }
 async function portability(context, operation, args, operationLock) {
 	const adapter = await loadPortabilityAdapter(context);
@@ -1104,7 +1290,7 @@ async function portability(context, operation, args, operationLock) {
 			...portabilityContext,
 			path: artifactPath
 		});
-		printJson(context, {
+		printJson$1(context, {
 			schemaVersion: 1,
 			status: `${operation}ed`,
 			...result
@@ -1130,7 +1316,9 @@ async function runApplicationOperation(context, operation, args) {
 			});
 			return 0;
 		case "setup":
-			await withOperationLock(preparedStateRoot(context), operation, (lock) => setup(context, lock));
+			await withOperationLock(preparedStateRoot(context), operation, async (lock) => {
+				printOnboardingUrl(context, (await setup(context, lock)).onboardingUrl);
+			});
 			return 0;
 		case "recover":
 			await assertLocalOperation(context, "app:recover");
@@ -1149,7 +1337,7 @@ async function runApplicationOperation(context, operation, args) {
 			await withOperationLock(preparedStateRoot(context), operation, () => stop(context));
 			return 0;
 		case "backup":
-			await withOperationLock(preparedStateRoot(context), operation, (lock) => backup(context, args, lock));
+			await backup(context, args);
 			return 0;
 		case "export":
 		case "import":
@@ -1158,6 +1346,137 @@ async function runApplicationOperation(context, operation, args) {
 	}
 }
 //#endregion
+//#region src/app/tokens.ts
+/**
+* `smrt app token` — owner-minted bearer tokens for local MCP clients.
+*
+* ```
+* smrt app token --scopes notes.read [--expires 30d] [--label "Claude Desktop"]
+* smrt app token list
+* smrt app token revoke <id>
+* ```
+*
+* Local profile only. The token is printed once, in the `issued` JSON
+* document on stdout, and is otherwise never written anywhere: the runtime
+* stores only its HMAC. `list` and `revoke` output carries no token values.
+*/
+/** Usage text for `smrt app token`. */
+var TOKEN_USAGE = "Usage: smrt app token [create] --scopes <scope[,scope...]> [--expires <n>s|m|h|d] [--label <text>] | token list | token revoke <id>";
+var UNIT_SECONDS = {
+	s: 1,
+	m: 60,
+	h: 3600,
+	d: 1440 * 60
+};
+/** Parse `30d`, `12h`, `90m`, `3600s` or bare seconds. */
+function parseTokenLifetime(value) {
+	const match = /^([1-9][0-9]{0,8})([smhd]?)$/u.exec(value.trim());
+	if (!match) throw new Error(`Invalid --expires value. ${TOKEN_USAGE}`);
+	return Number(match[1]) * UNIT_SECONDS[match[2] || "s"];
+}
+function parseCreateArgs(args) {
+	const scopes = [];
+	let expiresInSeconds;
+	let label;
+	for (let index = 0; index < args.length; index += 1) {
+		const arg = args[index];
+		const equals = arg.indexOf("=");
+		const name = equals > 0 ? arg.slice(0, equals) : arg;
+		if (![
+			"--scopes",
+			"--scope",
+			"--expires",
+			"--label"
+		].includes(name)) throw new Error(`Unknown token option: ${name}. ${TOKEN_USAGE}`);
+		const value = equals > 0 ? arg.slice(equals + 1) : args[++index];
+		if (value === void 0 || equals < 0 && value.startsWith("--")) throw new Error(`Token option ${name} requires a value. ${TOKEN_USAGE}`);
+		if (name === "--scopes" || name === "--scope") scopes.push(...value.split(/[\s,]+/u).filter(Boolean));
+		else if (name === "--expires") {
+			if (expiresInSeconds !== void 0) throw new Error("Token option --expires was provided more than once.");
+			expiresInSeconds = parseTokenLifetime(value);
+		} else {
+			if (label !== void 0) throw new Error("Token option --label was provided more than once.");
+			label = value;
+		}
+	}
+	if (scopes.length === 0) throw new Error(`At least one scope is required. ${TOKEN_USAGE}`);
+	return {
+		scopes,
+		expiresInSeconds,
+		label
+	};
+}
+function printJson(context, value) {
+	context.io.stdout(`${JSON.stringify(value, null, 2)}\n`);
+}
+/** Run `smrt app token <args…>` and resolve to the exit code. */
+async function runTokenOperation(context, args) {
+	const [first, ...rest] = args;
+	if (first === "help" || first === "--help" || first === "-h") {
+		context.io.stdout(`${TOKEN_USAGE}\n`);
+		return 0;
+	}
+	const subcommand = first === void 0 || first.startsWith("--") ? "create" : first;
+	const subArgs = subcommand === first ? rest : args;
+	if (![
+		"create",
+		"list",
+		"revoke"
+	].includes(subcommand)) throw new Error(`Unknown token operation: ${subcommand}. ${TOKEN_USAGE}`);
+	const create = subcommand === "create" ? parseCreateArgs(subArgs) : null;
+	if (subcommand === "list" && subArgs.length > 0) throw new Error(`token list takes no arguments. ${TOKEN_USAGE}`);
+	if (subcommand === "revoke" && subArgs.length !== 1) throw new Error(`token revoke takes exactly one token id. ${TOKEN_USAGE}`);
+	await assertLocalOperation(context, "app:token");
+	const open = context.deps.runtime.openLocalMcpTokenStore ?? openLocalMcpTokenStore;
+	const withStore = async (fn) => {
+		const store = await open({
+			appId: context.appId,
+			dataDirectory: process.env.SMRT_DATA_DIR,
+			sourceRoot: context.sourceRoot
+		});
+		try {
+			return await fn(store);
+		} finally {
+			await store.close();
+		}
+	};
+	if (subcommand === "list") {
+		printJson(context, {
+			schemaVersion: 1,
+			status: "ok",
+			tokens: await withStore((store) => store.list()),
+			secretValuesIncluded: false
+		});
+		return 0;
+	}
+	return withOperationLock(preparedStateRoot(context), `token-${subcommand}`, async () => {
+		if (create) {
+			const issued = await withStore((store) => store.issue(create));
+			printJson(context, {
+				schemaVersion: 1,
+				status: "issued",
+				id: issued.id,
+				token: issued.token,
+				scopes: issued.scopes,
+				label: issued.label,
+				createdAt: issued.createdAt,
+				expiresAt: issued.expiresAt,
+				notice: "This token is shown once and only its hash is stored. Put it in your MCP client configuration now; revoke it with smrt app token revoke <id>.",
+				secretValuesIncluded: true
+			});
+			return 0;
+		}
+		const id = subArgs[0];
+		printJson(context, {
+			schemaVersion: 1,
+			status: await withStore((store) => store.revoke(id)),
+			id,
+			secretValuesIncluded: false
+		});
+		return 0;
+	});
+}
+//#endregion
 //#region src/app/cli.ts
 /**
 * `smrt app <operation>` dispatcher.
@@ -1188,6 +1507,7 @@ var APP_COMMANDS = Object.freeze({
 	"export [path]": "Write a logical, asset-aware export bundle",
 	"import <path>": "Import a logical export bundle into an empty application",
 	migrate: "Prepare storage custody and run smrt db:migrate under the lock",
+	"token [list|revoke <id>] [--scopes ...]": "Local: issue, list, or revoke a scoped bearer token for a local MCP client",
 	"worker [task|schedule]": "Deployed: run the task or schedule worker",
 	"dev [...vite args]": "Run the application's Vite dev server",
 	"build [...vite args]": "Validate ./mcp-apps when present, then run the Vite build",
@@ -1202,6 +1522,10 @@ function errorEnvelope(error) {
 		code: "operation-failed",
 		...runtimeCode ? { runtimeCode } : {},
 		message: redactSecrets(error instanceof Error ? error.message : "Application operation failed."),
+		...error instanceof ApplicationStartError ? {
+			output: boundedTail(redactSecrets(error.output, process.env, { strict: true }), START_OUTPUT_TAIL_BYTES),
+			logFile: error.logFile
+		} : {},
 		recovery: APP_RECOVERY,
 		secretValuesIncluded: false
 	};
@@ -1214,6 +1538,7 @@ function renderAppHelp() {
 var ENV_FILE_OPERATIONS = /* @__PURE__ */ new Set([
 	...APP_OPERATIONS,
 	"migrate",
+	"token",
 	"dev",
 	"build",
 	"vite"
@@ -1227,7 +1552,8 @@ var ENV_FILE_OPERATIONS = /* @__PURE__ */ new Set([
 async function runAppCommand(argv, options = {}) {
 	const io = {
 		stdout: options.io?.stdout ?? ((text) => void process.stdout.write(text)),
-		stderr: options.io?.stderr ?? ((text) => void process.stderr.write(text))
+		stderr: options.io?.stderr ?? ((text) => void process.stderr.write(text)),
+		operatorTerminal: options.io ? options.io.operatorTerminal : process.stderr.isTTY && process.stdout.isTTY ? (text) => void process.stderr.write(text) : void 0
 	};
 	const operation = argv[0] || "doctor";
 	const rawArgs = argv.slice(1);
@@ -1250,7 +1576,7 @@ async function runAppCommand(argv, options = {}) {
 				const status = await validateMcpAppsIfPresent(context);
 				if (status !== 0) return status;
 			}
-			return launchVite(context, operation === "vite" ? args : [operation, ...args]);
+			return launchVite(context, operation === "vite" ? args : operation === "dev" ? ["dev", ...devServerArguments(args)] : [operation, ...args]);
 		}
 		const deps = {
 			...await defaultDependencies(sourceRoot),
@@ -1264,6 +1590,7 @@ async function runAppCommand(argv, options = {}) {
 		};
 		if (operation === "migrate") return await prepareMigration(context);
 		if (operation === "worker") return await runWorker(context, args);
+		if (operation === "token") return await runTokenOperation(context, args);
 		if (!APP_OPERATIONS.includes(operation)) throw new Error(`Unknown app operation: ${operation}`);
 		return await runApplicationOperation(context, operation, args);
 	} catch (error) {
@@ -1272,4 +1599,4 @@ async function runAppCommand(argv, options = {}) {
 	}
 }
 //#endregion
-export { AppCommandError as A, runtimeEnvironment as C, resolveApplicationId as D, prepareApplicationStateRoot as E, redactSecrets as M, resolveApplicationStateRoot as O, cliExecutablePath as S, assertExternalArtifactPath as T, launchVite as _, renderAppHelp as a, runWorker as b, runApplicationOperation as c, matchesApplicationProcess as d, readOwnedProcess as f, ViteLauncherError as g, writeProcessRecord as h, errorEnvelope as i, errorCode as j, runtimeConfigurationFingerprint as k, WEB_LAUNCHER_NAME as l, verifyOwnedProcess as m, APP_RECOVERY as n, runAppCommand as o, sendTerminationSignal as p, cli_exports as r, APP_OPERATIONS as s, APP_COMMANDS as t, checkOwnedProcess as u, prepareMigration as v, webLauncherPath as w, validateMcpAppsIfPresent as x, resolveViteEntry as y };
+export { assertExternalArtifactPath as A, prepareMigration as C, cliExecutablePath as D, validateMcpAppsIfPresent as E, AppCommandError as F, ApplicationStartError as I, errorCode as L, resolveApplicationId as M, resolveApplicationStateRoot as N, runtimeEnvironment as O, runtimeConfigurationFingerprint as P, redactSecrets as R, launchVite as S, runWorker as T, sendTerminationSignal as _, renderAppHelp as a, ViteLauncherError as b, parseTokenLifetime as c, START_OUTPUT_TAIL_BYTES as d, runApplicationOperation as f, readOwnedProcess as g, matchesApplicationProcess as h, errorEnvelope as i, prepareApplicationStateRoot as j, webLauncherPath as k, runTokenOperation as l, checkOwnedProcess as m, APP_RECOVERY as n, runAppCommand as o, WEB_LAUNCHER_NAME as p, cli_exports as r, TOKEN_USAGE as s, APP_COMMANDS as t, APP_OPERATIONS as u, verifyOwnedProcess as v, resolveViteEntry as w, devServerArguments as x, writeProcessRecord as y };