@tinycloud/mcp 0.1.0 → 0.2.0

package/dist/tools.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/tools.ts","../src/results.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport { join } from \"node:path\";\n\nimport { fromJsonSchema, type McpServer, type ToolAnnotations } from \"@modelcontextprotocol/server\";\nimport { addFormats, Ajv, AjvJsonSchemaValidator } from \"@modelcontextprotocol/server/validators/ajv\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nimport { toMcpToolResult, type McpToolResult } from \"./results.js\";\n\nexport const TOOL_NAMES = [\n  \"tinycloud_status\",\n  \"tinycloud_auth_status\",\n  \"tinycloud_auth_capabilities\",\n  \"tinycloud_auth_request\",\n  \"tinycloud_auth_import\",\n  \"tinycloud_account_spaces_list\",\n  \"tinycloud_account_applications_list\",\n  \"tinycloud_kv_list\",\n  \"tinycloud_kv_get\",\n  \"tinycloud_secrets_get\",\n] as const;\n\nexport type ToolName = (typeof TOOL_NAMES)[number];\n\nexport interface McpStartupSelection {\n  readonly profile: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n}\n\nexport interface McpInvocationTarget {\n  readonly profile: string;\n  readonly allowOwnerProfile?: true;\n}\n\n/** Project one startup selection into the only owner-sensitive target shape. */\nexport function invocationTargetForMcp(\n  selection: McpStartupSelection,\n): McpInvocationTarget {\n  return {\n    profile: selection.profile,\n    ...(selection.explicitProfile && selection.allowOwnerProfile\n      ? { allowOwnerProfile: true }\n      : {}),\n  };\n}\n\ninterface CatalogOperation {\n  readonly id: string;\n  readonly version: number;\n  readonly title: string;\n  readonly description: string;\n  readonly input: Record<string, unknown>;\n  readonly result: Record<string, unknown>;\n}\n\ninterface OperationsCatalog {\n  readonly operations: readonly CatalogOperation[];\n}\n\n// The require anchor is this module, never the consumer entrypoint. In ESM\n// tsup preserves import.meta.url; in CJS it rewrites the same module-relative\n// anchor to the generated __filename, so both formats stay in MCP's package\n// dependency boundary.\nconst packageRequire = createRequire(\n  typeof __dirname === \"string\" ? join(__dirname, \"tools.cjs\") : import.meta.url,\n);\nconst generatedCatalog = packageRequire(\n  \"@tinycloud/operations/operations.json\",\n) as OperationsCatalog;\n\ninterface ToolBinding {\n  readonly name: ToolName;\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly readOnlyHint: boolean;\n  readonly idempotentHint: boolean;\n  readonly openWorldHint: boolean;\n}\n\nconst TOOL_BINDINGS: readonly ToolBinding[] = [\n  {\n    name: \"tinycloud_status\",\n    operationId: \"tinycloud.status.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_status\",\n    operationId: \"tinycloud.auth.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_capabilities\",\n    operationId: \"tinycloud.auth.capabilities\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_request\",\n    operationId: \"tinycloud.auth.request\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_import\",\n    operationId: \"tinycloud.auth.import\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_account_spaces_list\",\n    operationId: \"tinycloud.account.spaces.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_account_applications_list\",\n    operationId: \"tinycloud.account.applications.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_list\",\n    operationId: \"tinycloud.kv.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_get\",\n    operationId: \"tinycloud.kv.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_get\",\n    operationId: \"tinycloud.secrets.get\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    openWorldHint: true,\n  },\n] as const;\n\nexport function createJsonSchemaValidator(): AjvJsonSchemaValidator {\n  const ajv = new Ajv({ strict: false });\n  addFormats(ajv);\n  return new AjvJsonSchemaValidator(ajv);\n}\n\nexport function registerTinyCloudTools(\n  server: McpServer,\n  selection: McpStartupSelection,\n  validator: AjvJsonSchemaValidator,\n): void {\n  const definitions = new Map(\n    generatedCatalog.operations.map((operation) => [\n      `${operation.id}@${operation.version}`,\n      operation,\n    ]),\n  );\n\n  for (const binding of TOOL_BINDINGS) {\n    const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);\n    if (operation === undefined) {\n      throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);\n    }\n\n    const inputSchema = fromJsonSchema(\n      operation.input as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const outputSchema = fromJsonSchema(\n      operation.result as unknown as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const annotations: ToolAnnotations = {\n      readOnlyHint: binding.readOnlyHint,\n      idempotentHint: binding.idempotentHint,\n      destructiveHint: false,\n      openWorldHint: binding.openWorldHint,\n    };\n\n    server.registerTool(\n      binding.name,\n      {\n        title: operation.title,\n        description: operation.description,\n        inputSchema,\n        outputSchema,\n        annotations,\n      },\n      async (input: unknown): Promise<McpToolResult> => {\n        const result = await invokeOperation(\n          binding.operationId,\n          binding.operationVersion,\n          invocationTargetForMcp(selection),\n          input,\n        );\n        return toMcpToolResult(result);\n      },\n    );\n  }\n}\n\nexport function toolBindingsForTest(): readonly ToolBinding[] {\n  return TOOL_BINDINGS;\n}\n","/**\n * MCP has one structured result channel for a TinyCloud operation. Text is a\n * fixed, non-sensitive status line; it never serializes the operation result.\n */\nexport interface CanonicalOperationResult {\n  readonly status: \"ok\" | \"authority_required\" | \"setup_required\" | \"error\";\n  readonly [key: string]: unknown;\n}\n\nexport interface McpToolResult extends CallToolResult {\n  readonly content: [{ readonly type: \"text\"; readonly text: string }];\n  readonly structuredContent: CanonicalOperationResult;\n}\n\nexport function toMcpToolResult(result: unknown): McpToolResult {\n  const canonical: CanonicalOperationResult = isCanonicalOperationResult(result)\n    ? result\n    : {\n      status: \"error\",\n      operation: {},\n      context: {},\n      error: { code: \"INTERNAL_ERROR\" },\n    };\n\n  return {\n    content: [{ type: \"text\", text: resultSummary(canonical.status) }],\n    structuredContent: canonical,\n  };\n}\n\n/** The canonical envelope immediately before MCP protocol serialization. */\nexport function canonicalMcpAdapterResult(result: unknown): CanonicalOperationResult {\n  return toMcpToolResult(result).structuredContent;\n}\n\nfunction isCanonicalOperationResult(value: unknown): value is CanonicalOperationResult {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const status = (value as { status?: unknown }).status;\n  return status === \"ok\" ||\n    status === \"authority_required\" ||\n    status === \"setup_required\" ||\n    status === \"error\";\n}\n\nfunction resultSummary(status: CanonicalOperationResult[\"status\"]): string {\n  switch (status) {\n    case \"ok\":\n      return \"TinyCloud operation completed; use the structured result.\";\n    case \"authority_required\":\n      return \"TinyCloud authority is required; use the structured request and approval action.\";\n    case \"setup_required\":\n      return \"TinyCloud setup is required; use the structured setup action.\";\n    case \"error\":\n      return \"TinyCloud operation failed; use the structured error.\";\n  }\n}\nimport type { CallToolResult } from \"@modelcontextprotocol/server\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAA8B;AAC9B,uBAAqB;AAErB,oBAAqE;AACrE,iBAAwD;AACxD,wBAAgC;;;ACSzB,SAAS,gBAAgB,QAAgC;AAC9D,QAAM,YAAsC,2BAA2B,MAAM,IACzE,SACA;AAAA,IACA,QAAQ;AAAA,IACR,WAAW,CAAC;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC;AAEF,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,cAAc,UAAU,MAAM,EAAE,CAAC;AAAA,IACjE,mBAAmB;AAAA,EACrB;AACF;AAOA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAU,MAA+B;AAC/C,SAAO,WAAW,QAChB,WAAW,wBACX,WAAW,oBACX,WAAW;AACf;AAEA,SAAS,cAAc,QAAoD;AACzE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;;;ADvDA;AASO,IAAM,aAAa;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgBO,SAAS,uBACd,WACqB;AACrB,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,GAAI,UAAU,mBAAmB,UAAU,oBACvC,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,EACP;AACF;AAmBA,IAAM,qBAAiB;AAAA,EACrB,OAAO,cAAc,eAAW,uBAAK,WAAW,WAAW,IAAI,YAAY;AAC7E;AACA,IAAM,mBAAmB;AAAA,EACvB;AACF;AAWA,IAAM,gBAAwC;AAAA,EAC5C;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AACF;AAEO,SAAS,4BAAoD;AAClE,QAAM,MAAM,IAAI,eAAI,EAAE,QAAQ,MAAM,CAAC;AACrC,6BAAW,GAAG;AACd,SAAO,IAAI,kCAAuB,GAAG;AACvC;AAEO,SAAS,uBACd,QACA,WACA,WACM;AACN,QAAM,cAAc,IAAI;AAAA,IACtB,iBAAiB,WAAW,IAAI,CAAC,cAAc;AAAA,MAC7C,GAAG,UAAU,EAAE,IAAI,UAAU,OAAO;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH;AAEA,aAAW,WAAW,eAAe;AACnC,UAAM,YAAY,YAAY,IAAI,GAAG,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,EAAE;AACtF,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI,MAAM,2CAA2C,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,GAAG;AAAA,IAC/G;AAEA,UAAM,kBAAc;AAAA,MAClB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,mBAAe;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,cAA+B;AAAA,MACnC,cAAc,QAAQ;AAAA,MACtB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB;AAAA,MACjB,eAAe,QAAQ;AAAA,IACzB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,QACE,OAAO,UAAU;AAAA,QACjB,aAAa,UAAU;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,OAAO,UAA2C;AAChD,cAAM,SAAS,UAAM;AAAA,UACnB,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,uBAAuB,SAAS;AAAA,UAChC;AAAA,QACF;AACA,eAAO,gBAAgB,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,sBAA8C;AAC5D,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/tools.ts","../src/results.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport { join } from \"node:path\";\n\nimport { fromJsonSchema, type McpServer, type ToolAnnotations } from \"@modelcontextprotocol/server\";\nimport { addFormats, Ajv, AjvJsonSchemaValidator } from \"@modelcontextprotocol/server/validators/ajv\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nimport { toMcpToolResult, type McpToolResult } from \"./results.js\";\n\nexport const TOOL_NAMES = [\n  \"tinycloud_status\",\n  \"tinycloud_auth_status\",\n  \"tinycloud_auth_capabilities\",\n  \"tinycloud_auth_request\",\n  \"tinycloud_auth_import\",\n  \"tinycloud_account_spaces_list\",\n  \"tinycloud_account_applications_list\",\n  \"tinycloud_kv_list\",\n  \"tinycloud_kv_get\",\n  \"tinycloud_kv_head\",\n  \"tinycloud_kv_put\",\n  \"tinycloud_kv_delete\",\n  \"tinycloud_sql_schema_inspect\",\n  \"tinycloud_sql_query\",\n  \"tinycloud_sql_execute\",\n  \"tinycloud_secrets_get\",\n] as const;\n\nexport type ToolName = (typeof TOOL_NAMES)[number];\n\nexport interface McpStartupSelection {\n  readonly profile: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n}\n\nexport interface McpInvocationTarget {\n  readonly profile: string;\n  readonly allowOwnerProfile?: true;\n}\n\n/** Project one startup selection into the only owner-sensitive target shape. */\nexport function invocationTargetForMcp(\n  selection: McpStartupSelection,\n): McpInvocationTarget {\n  return {\n    profile: selection.profile,\n    ...(selection.explicitProfile && selection.allowOwnerProfile\n      ? { allowOwnerProfile: true }\n      : {}),\n  };\n}\n\ninterface CatalogOperation {\n  readonly id: string;\n  readonly version: number;\n  readonly title: string;\n  readonly description: string;\n  readonly input: Record<string, unknown>;\n  readonly result: Record<string, unknown>;\n}\n\ninterface OperationsCatalog {\n  readonly operations: readonly CatalogOperation[];\n}\n\n// The require anchor is this module, never the consumer entrypoint. In ESM\n// tsup preserves import.meta.url; in CJS it rewrites the same module-relative\n// anchor to the generated __filename, so both formats stay in MCP's package\n// dependency boundary.\nconst packageRequire = createRequire(\n  typeof __dirname === \"string\" ? join(__dirname, \"tools.cjs\") : import.meta.url,\n);\nconst generatedCatalog = packageRequire(\n  \"@tinycloud/operations/operations.json\",\n) as OperationsCatalog;\n\ninterface ToolBinding {\n  readonly name: ToolName;\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly readOnlyHint: boolean;\n  readonly idempotentHint: boolean;\n  readonly destructiveHint: boolean;\n  readonly openWorldHint: boolean;\n}\n\nconst TOOL_BINDINGS: readonly ToolBinding[] = [\n  {\n    name: \"tinycloud_status\",\n    operationId: \"tinycloud.status.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_status\",\n    operationId: \"tinycloud.auth.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_capabilities\",\n    operationId: \"tinycloud.auth.capabilities\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_request\",\n    operationId: \"tinycloud.auth.request\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_import\",\n    operationId: \"tinycloud.auth.import\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_account_spaces_list\",\n    operationId: \"tinycloud.account.spaces.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_account_applications_list\",\n    operationId: \"tinycloud.account.applications.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_list\",\n    operationId: \"tinycloud.kv.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_get\",\n    operationId: \"tinycloud.kv.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_head\",\n    operationId: \"tinycloud.kv.head\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_put\",\n    operationId: \"tinycloud.kv.put\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_delete\",\n    operationId: \"tinycloud.kv.delete\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_schema_inspect\",\n    operationId: \"tinycloud.sql.schema.inspect\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_query\",\n    operationId: \"tinycloud.sql.query\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_execute\",\n    operationId: \"tinycloud.sql.execute\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_get\",\n    operationId: \"tinycloud.secrets.get\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n] as const;\n\nexport function createJsonSchemaValidator(): AjvJsonSchemaValidator {\n  const ajv = new Ajv({ strict: false });\n  addFormats(ajv);\n  return new AjvJsonSchemaValidator(ajv);\n}\n\nexport function registerTinyCloudTools(\n  server: McpServer,\n  selection: McpStartupSelection,\n  validator: AjvJsonSchemaValidator,\n): void {\n  const definitions = new Map(\n    generatedCatalog.operations.map((operation) => [\n      `${operation.id}@${operation.version}`,\n      operation,\n    ]),\n  );\n\n  for (const binding of TOOL_BINDINGS) {\n    const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);\n    if (operation === undefined) {\n      throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);\n    }\n\n    const inputSchema = fromJsonSchema(\n      operation.input as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const outputSchema = fromJsonSchema(\n      operation.result as unknown as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const annotations: ToolAnnotations = {\n      readOnlyHint: binding.readOnlyHint,\n      idempotentHint: binding.idempotentHint,\n      destructiveHint: binding.destructiveHint,\n      openWorldHint: binding.openWorldHint,\n    };\n\n    server.registerTool(\n      binding.name,\n      {\n        title: operation.title,\n        description: operation.description,\n        inputSchema,\n        outputSchema,\n        annotations,\n      },\n      async (input: unknown): Promise<McpToolResult> => {\n        const result = await invokeOperation(\n          binding.operationId,\n          binding.operationVersion,\n          invocationTargetForMcp(selection),\n          input,\n        );\n        return toMcpToolResult(result);\n      },\n    );\n  }\n}\n\nexport function toolBindingsForTest(): readonly ToolBinding[] {\n  return TOOL_BINDINGS;\n}\n","/**\n * MCP has one structured result channel for a TinyCloud operation. Text is a\n * fixed, non-sensitive status line; it never serializes the operation result.\n */\nexport interface CanonicalOperationResult {\n  readonly status: \"ok\" | \"authority_required\" | \"setup_required\" | \"error\";\n  readonly [key: string]: unknown;\n}\n\nexport interface McpToolResult extends CallToolResult {\n  readonly content: [{ readonly type: \"text\"; readonly text: string }];\n  readonly structuredContent: CanonicalOperationResult;\n}\n\nexport function toMcpToolResult(result: unknown): McpToolResult {\n  const canonical: CanonicalOperationResult = isCanonicalOperationResult(result)\n    ? result\n    : {\n      status: \"error\",\n      operation: {},\n      context: {},\n      error: { code: \"INTERNAL_ERROR\" },\n    };\n\n  return {\n    content: [{ type: \"text\", text: resultSummary(canonical.status) }],\n    structuredContent: canonical,\n  };\n}\n\n/** The canonical envelope immediately before MCP protocol serialization. */\nexport function canonicalMcpAdapterResult(result: unknown): CanonicalOperationResult {\n  return toMcpToolResult(result).structuredContent;\n}\n\nfunction isCanonicalOperationResult(value: unknown): value is CanonicalOperationResult {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const status = (value as { status?: unknown }).status;\n  return status === \"ok\" ||\n    status === \"authority_required\" ||\n    status === \"setup_required\" ||\n    status === \"error\";\n}\n\nfunction resultSummary(status: CanonicalOperationResult[\"status\"]): string {\n  switch (status) {\n    case \"ok\":\n      return \"TinyCloud operation completed; use the structured result.\";\n    case \"authority_required\":\n      return \"TinyCloud authority is required; use the structured request and approval action.\";\n    case \"setup_required\":\n      return \"TinyCloud setup is required; use the structured setup action.\";\n    case \"error\":\n      return \"TinyCloud operation failed; use the structured error.\";\n  }\n}\nimport type { CallToolResult } from \"@modelcontextprotocol/server\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAA8B;AAC9B,uBAAqB;AAErB,oBAAqE;AACrE,iBAAwD;AACxD,wBAAgC;;;ACSzB,SAAS,gBAAgB,QAAgC;AAC9D,QAAM,YAAsC,2BAA2B,MAAM,IACzE,SACA;AAAA,IACA,QAAQ;AAAA,IACR,WAAW,CAAC;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC;AAEF,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,cAAc,UAAU,MAAM,EAAE,CAAC;AAAA,IACjE,mBAAmB;AAAA,EACrB;AACF;AAOA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAU,MAA+B;AAC/C,SAAO,WAAW,QAChB,WAAW,wBACX,WAAW,oBACX,WAAW;AACf;AAEA,SAAS,cAAc,QAAoD;AACzE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;;;ADvDA;AASO,IAAM,aAAa;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgBO,SAAS,uBACd,WACqB;AACrB,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,GAAI,UAAU,mBAAmB,UAAU,oBACvC,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,EACP;AACF;AAmBA,IAAM,qBAAiB;AAAA,EACrB,OAAO,cAAc,eAAW,uBAAK,WAAW,WAAW,IAAI,YAAY;AAC7E;AACA,IAAM,mBAAmB;AAAA,EACvB;AACF;AAYA,IAAM,gBAAwC;AAAA,EAC5C;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AACF;AAEO,SAAS,4BAAoD;AAClE,QAAM,MAAM,IAAI,eAAI,EAAE,QAAQ,MAAM,CAAC;AACrC,6BAAW,GAAG;AACd,SAAO,IAAI,kCAAuB,GAAG;AACvC;AAEO,SAAS,uBACd,QACA,WACA,WACM;AACN,QAAM,cAAc,IAAI;AAAA,IACtB,iBAAiB,WAAW,IAAI,CAAC,cAAc;AAAA,MAC7C,GAAG,UAAU,EAAE,IAAI,UAAU,OAAO;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH;AAEA,aAAW,WAAW,eAAe;AACnC,UAAM,YAAY,YAAY,IAAI,GAAG,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,EAAE;AACtF,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI,MAAM,2CAA2C,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,GAAG;AAAA,IAC/G;AAEA,UAAM,kBAAc;AAAA,MAClB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,mBAAe;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,cAA+B;AAAA,MACnC,cAAc,QAAQ;AAAA,MACtB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB,eAAe,QAAQ;AAAA,IACzB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,QACE,OAAO,UAAU;AAAA,QACjB,aAAa,UAAU;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,OAAO,UAA2C;AAChD,cAAM,SAAS,UAAM;AAAA,UACnB,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,uBAAuB,SAAS;AAAA,UAChC;AAAA,QACF;AACA,eAAO,gBAAgB,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,sBAA8C;AAC5D,SAAO;AACT;","names":[]}

package/dist/tools.d.cts

@@ -1,7 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/server';
 import { AjvJsonSchemaValidator } from '@modelcontextprotocol/server/validators/ajv';
 
-declare const TOOL_NAMES: readonly ["tinycloud_status", "tinycloud_auth_status", "tinycloud_auth_capabilities", "tinycloud_auth_request", "tinycloud_auth_import", "tinycloud_account_spaces_list", "tinycloud_account_applications_list", "tinycloud_kv_list", "tinycloud_kv_get", "tinycloud_secrets_get"];
+declare const TOOL_NAMES: readonly ["tinycloud_status", "tinycloud_auth_status", "tinycloud_auth_capabilities", "tinycloud_auth_request", "tinycloud_auth_import", "tinycloud_account_spaces_list", "tinycloud_account_applications_list", "tinycloud_kv_list", "tinycloud_kv_get", "tinycloud_kv_head", "tinycloud_kv_put", "tinycloud_kv_delete", "tinycloud_sql_schema_inspect", "tinycloud_sql_query", "tinycloud_sql_execute", "tinycloud_secrets_get"];
 type ToolName = (typeof TOOL_NAMES)[number];
 interface McpStartupSelection {
     readonly profile: string;
@@ -20,6 +20,7 @@ interface ToolBinding {
     readonly operationVersion: number;
     readonly readOnlyHint: boolean;
     readonly idempotentHint: boolean;
+    readonly destructiveHint: boolean;
     readonly openWorldHint: boolean;
 }
 declare function createJsonSchemaValidator(): AjvJsonSchemaValidator;

package/dist/tools.d.ts

@@ -1,7 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/server';
 import { AjvJsonSchemaValidator } from '@modelcontextprotocol/server/validators/ajv';
 
-declare const TOOL_NAMES: readonly ["tinycloud_status", "tinycloud_auth_status", "tinycloud_auth_capabilities", "tinycloud_auth_request", "tinycloud_auth_import", "tinycloud_account_spaces_list", "tinycloud_account_applications_list", "tinycloud_kv_list", "tinycloud_kv_get", "tinycloud_secrets_get"];
+declare const TOOL_NAMES: readonly ["tinycloud_status", "tinycloud_auth_status", "tinycloud_auth_capabilities", "tinycloud_auth_request", "tinycloud_auth_import", "tinycloud_account_spaces_list", "tinycloud_account_applications_list", "tinycloud_kv_list", "tinycloud_kv_get", "tinycloud_kv_head", "tinycloud_kv_put", "tinycloud_kv_delete", "tinycloud_sql_schema_inspect", "tinycloud_sql_query", "tinycloud_sql_execute", "tinycloud_secrets_get"];
 type ToolName = (typeof TOOL_NAMES)[number];
 interface McpStartupSelection {
     readonly profile: string;
@@ -20,6 +20,7 @@ interface ToolBinding {
     readonly operationVersion: number;
     readonly readOnlyHint: boolean;
     readonly idempotentHint: boolean;
+    readonly destructiveHint: boolean;
     readonly openWorldHint: boolean;
 }
 declare function createJsonSchemaValidator(): AjvJsonSchemaValidator;

package/dist/tools.js

@@ -47,6 +47,12 @@ var TOOL_NAMES = [
   "tinycloud_account_applications_list",
   "tinycloud_kv_list",
   "tinycloud_kv_get",
+  "tinycloud_kv_head",
+  "tinycloud_kv_put",
+  "tinycloud_kv_delete",
+  "tinycloud_sql_schema_inspect",
+  "tinycloud_sql_query",
+  "tinycloud_sql_execute",
   "tinycloud_secrets_get"
 ];
 function invocationTargetForMcp(selection) {
@@ -68,6 +74,7 @@ var TOOL_BINDINGS = [
     operationVersion: 1,
     readOnlyHint: true,
     idempotentHint: true,
+    destructiveHint: false,
     openWorldHint: false
   },
   {
@@ -76,6 +83,7 @@ var TOOL_BINDINGS = [
     operationVersion: 1,
     readOnlyHint: true,
     idempotentHint: true,
+    destructiveHint: false,
     openWorldHint: false
   },
   {
@@ -84,6 +92,7 @@ var TOOL_BINDINGS = [
     operationVersion: 1,
     readOnlyHint: true,
     idempotentHint: true,
+    destructiveHint: false,
     openWorldHint: false
   },
   {
@@ -92,6 +101,7 @@ var TOOL_BINDINGS = [
     operationVersion: 1,
     readOnlyHint: false,
     idempotentHint: true,
+    destructiveHint: false,
     openWorldHint: false
   },
   {
@@ -100,6 +110,7 @@ var TOOL_BINDINGS = [
     operationVersion: 1,
     readOnlyHint: false,
     idempotentHint: true,
+    destructiveHint: false,
     openWorldHint: false
   },
   {
@@ -108,6 +119,7 @@ var TOOL_BINDINGS = [
     operationVersion: 1,
     readOnlyHint: true,
     idempotentHint: true,
+    destructiveHint: false,
     openWorldHint: true
   },
   {
@@ -116,6 +128,7 @@ var TOOL_BINDINGS = [
     operationVersion: 1,
     readOnlyHint: true,
     idempotentHint: true,
+    destructiveHint: false,
     openWorldHint: true
   },
   {
@@ -124,6 +137,7 @@ var TOOL_BINDINGS = [
     operationVersion: 1,
     readOnlyHint: true,
     idempotentHint: true,
+    destructiveHint: false,
     openWorldHint: true
   },
   {
@@ -132,6 +146,61 @@ var TOOL_BINDINGS = [
     operationVersion: 1,
     readOnlyHint: true,
     idempotentHint: true,
+    destructiveHint: false,
+    openWorldHint: true
+  },
+  {
+    name: "tinycloud_kv_head",
+    operationId: "tinycloud.kv.head",
+    operationVersion: 1,
+    readOnlyHint: true,
+    idempotentHint: true,
+    destructiveHint: false,
+    openWorldHint: true
+  },
+  {
+    name: "tinycloud_kv_put",
+    operationId: "tinycloud.kv.put",
+    operationVersion: 1,
+    readOnlyHint: false,
+    idempotentHint: true,
+    destructiveHint: true,
+    openWorldHint: true
+  },
+  {
+    name: "tinycloud_kv_delete",
+    operationId: "tinycloud.kv.delete",
+    operationVersion: 1,
+    readOnlyHint: false,
+    idempotentHint: true,
+    destructiveHint: true,
+    openWorldHint: true
+  },
+  {
+    name: "tinycloud_sql_schema_inspect",
+    operationId: "tinycloud.sql.schema.inspect",
+    operationVersion: 1,
+    readOnlyHint: true,
+    idempotentHint: true,
+    destructiveHint: false,
+    openWorldHint: true
+  },
+  {
+    name: "tinycloud_sql_query",
+    operationId: "tinycloud.sql.query",
+    operationVersion: 1,
+    readOnlyHint: true,
+    idempotentHint: true,
+    destructiveHint: false,
+    openWorldHint: true
+  },
+  {
+    name: "tinycloud_sql_execute",
+    operationId: "tinycloud.sql.execute",
+    operationVersion: 1,
+    readOnlyHint: false,
+    idempotentHint: false,
+    destructiveHint: true,
     openWorldHint: true
   },
   {
@@ -140,6 +209,7 @@ var TOOL_BINDINGS = [
     operationVersion: 1,
     readOnlyHint: false,
     idempotentHint: true,
+    destructiveHint: false,
     openWorldHint: true
   }
 ];
@@ -171,7 +241,7 @@ function registerTinyCloudTools(server, selection, validator) {
     const annotations = {
       readOnlyHint: binding.readOnlyHint,
       idempotentHint: binding.idempotentHint,
-      destructiveHint: false,
+      destructiveHint: binding.destructiveHint,
       openWorldHint: binding.openWorldHint
     };
     server.registerTool(

package/dist/tools.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/tools.ts","../src/results.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport { join } from \"node:path\";\n\nimport { fromJsonSchema, type McpServer, type ToolAnnotations } from \"@modelcontextprotocol/server\";\nimport { addFormats, Ajv, AjvJsonSchemaValidator } from \"@modelcontextprotocol/server/validators/ajv\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nimport { toMcpToolResult, type McpToolResult } from \"./results.js\";\n\nexport const TOOL_NAMES = [\n  \"tinycloud_status\",\n  \"tinycloud_auth_status\",\n  \"tinycloud_auth_capabilities\",\n  \"tinycloud_auth_request\",\n  \"tinycloud_auth_import\",\n  \"tinycloud_account_spaces_list\",\n  \"tinycloud_account_applications_list\",\n  \"tinycloud_kv_list\",\n  \"tinycloud_kv_get\",\n  \"tinycloud_secrets_get\",\n] as const;\n\nexport type ToolName = (typeof TOOL_NAMES)[number];\n\nexport interface McpStartupSelection {\n  readonly profile: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n}\n\nexport interface McpInvocationTarget {\n  readonly profile: string;\n  readonly allowOwnerProfile?: true;\n}\n\n/** Project one startup selection into the only owner-sensitive target shape. */\nexport function invocationTargetForMcp(\n  selection: McpStartupSelection,\n): McpInvocationTarget {\n  return {\n    profile: selection.profile,\n    ...(selection.explicitProfile && selection.allowOwnerProfile\n      ? { allowOwnerProfile: true }\n      : {}),\n  };\n}\n\ninterface CatalogOperation {\n  readonly id: string;\n  readonly version: number;\n  readonly title: string;\n  readonly description: string;\n  readonly input: Record<string, unknown>;\n  readonly result: Record<string, unknown>;\n}\n\ninterface OperationsCatalog {\n  readonly operations: readonly CatalogOperation[];\n}\n\n// The require anchor is this module, never the consumer entrypoint. In ESM\n// tsup preserves import.meta.url; in CJS it rewrites the same module-relative\n// anchor to the generated __filename, so both formats stay in MCP's package\n// dependency boundary.\nconst packageRequire = createRequire(\n  typeof __dirname === \"string\" ? join(__dirname, \"tools.cjs\") : import.meta.url,\n);\nconst generatedCatalog = packageRequire(\n  \"@tinycloud/operations/operations.json\",\n) as OperationsCatalog;\n\ninterface ToolBinding {\n  readonly name: ToolName;\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly readOnlyHint: boolean;\n  readonly idempotentHint: boolean;\n  readonly openWorldHint: boolean;\n}\n\nconst TOOL_BINDINGS: readonly ToolBinding[] = [\n  {\n    name: \"tinycloud_status\",\n    operationId: \"tinycloud.status.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_status\",\n    operationId: \"tinycloud.auth.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_capabilities\",\n    operationId: \"tinycloud.auth.capabilities\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_request\",\n    operationId: \"tinycloud.auth.request\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_import\",\n    operationId: \"tinycloud.auth.import\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_account_spaces_list\",\n    operationId: \"tinycloud.account.spaces.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_account_applications_list\",\n    operationId: \"tinycloud.account.applications.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_list\",\n    operationId: \"tinycloud.kv.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_get\",\n    operationId: \"tinycloud.kv.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_get\",\n    operationId: \"tinycloud.secrets.get\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    openWorldHint: true,\n  },\n] as const;\n\nexport function createJsonSchemaValidator(): AjvJsonSchemaValidator {\n  const ajv = new Ajv({ strict: false });\n  addFormats(ajv);\n  return new AjvJsonSchemaValidator(ajv);\n}\n\nexport function registerTinyCloudTools(\n  server: McpServer,\n  selection: McpStartupSelection,\n  validator: AjvJsonSchemaValidator,\n): void {\n  const definitions = new Map(\n    generatedCatalog.operations.map((operation) => [\n      `${operation.id}@${operation.version}`,\n      operation,\n    ]),\n  );\n\n  for (const binding of TOOL_BINDINGS) {\n    const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);\n    if (operation === undefined) {\n      throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);\n    }\n\n    const inputSchema = fromJsonSchema(\n      operation.input as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const outputSchema = fromJsonSchema(\n      operation.result as unknown as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const annotations: ToolAnnotations = {\n      readOnlyHint: binding.readOnlyHint,\n      idempotentHint: binding.idempotentHint,\n      destructiveHint: false,\n      openWorldHint: binding.openWorldHint,\n    };\n\n    server.registerTool(\n      binding.name,\n      {\n        title: operation.title,\n        description: operation.description,\n        inputSchema,\n        outputSchema,\n        annotations,\n      },\n      async (input: unknown): Promise<McpToolResult> => {\n        const result = await invokeOperation(\n          binding.operationId,\n          binding.operationVersion,\n          invocationTargetForMcp(selection),\n          input,\n        );\n        return toMcpToolResult(result);\n      },\n    );\n  }\n}\n\nexport function toolBindingsForTest(): readonly ToolBinding[] {\n  return TOOL_BINDINGS;\n}\n","/**\n * MCP has one structured result channel for a TinyCloud operation. Text is a\n * fixed, non-sensitive status line; it never serializes the operation result.\n */\nexport interface CanonicalOperationResult {\n  readonly status: \"ok\" | \"authority_required\" | \"setup_required\" | \"error\";\n  readonly [key: string]: unknown;\n}\n\nexport interface McpToolResult extends CallToolResult {\n  readonly content: [{ readonly type: \"text\"; readonly text: string }];\n  readonly structuredContent: CanonicalOperationResult;\n}\n\nexport function toMcpToolResult(result: unknown): McpToolResult {\n  const canonical: CanonicalOperationResult = isCanonicalOperationResult(result)\n    ? result\n    : {\n      status: \"error\",\n      operation: {},\n      context: {},\n      error: { code: \"INTERNAL_ERROR\" },\n    };\n\n  return {\n    content: [{ type: \"text\", text: resultSummary(canonical.status) }],\n    structuredContent: canonical,\n  };\n}\n\n/** The canonical envelope immediately before MCP protocol serialization. */\nexport function canonicalMcpAdapterResult(result: unknown): CanonicalOperationResult {\n  return toMcpToolResult(result).structuredContent;\n}\n\nfunction isCanonicalOperationResult(value: unknown): value is CanonicalOperationResult {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const status = (value as { status?: unknown }).status;\n  return status === \"ok\" ||\n    status === \"authority_required\" ||\n    status === \"setup_required\" ||\n    status === \"error\";\n}\n\nfunction resultSummary(status: CanonicalOperationResult[\"status\"]): string {\n  switch (status) {\n    case \"ok\":\n      return \"TinyCloud operation completed; use the structured result.\";\n    case \"authority_required\":\n      return \"TinyCloud authority is required; use the structured request and approval action.\";\n    case \"setup_required\":\n      return \"TinyCloud setup is required; use the structured setup action.\";\n    case \"error\":\n      return \"TinyCloud operation failed; use the structured error.\";\n  }\n}\nimport type { CallToolResult } from \"@modelcontextprotocol/server\";\n"],"mappings":";AAAA,SAAS,qBAAqB;AAC9B,SAAS,YAAY;AAErB,SAAS,sBAA4D;AACrE,SAAS,YAAY,KAAK,8BAA8B;AACxD,SAAS,uBAAuB;;;ACSzB,SAAS,gBAAgB,QAAgC;AAC9D,QAAM,YAAsC,2BAA2B,MAAM,IACzE,SACA;AAAA,IACA,QAAQ;AAAA,IACR,WAAW,CAAC;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC;AAEF,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,cAAc,UAAU,MAAM,EAAE,CAAC;AAAA,IACjE,mBAAmB;AAAA,EACrB;AACF;AAOA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAU,MAA+B;AAC/C,SAAO,WAAW,QAChB,WAAW,wBACX,WAAW,oBACX,WAAW;AACf;AAEA,SAAS,cAAc,QAAoD;AACzE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;;;AD9CO,IAAM,aAAa;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgBO,SAAS,uBACd,WACqB;AACrB,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,GAAI,UAAU,mBAAmB,UAAU,oBACvC,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,EACP;AACF;AAmBA,IAAM,iBAAiB;AAAA,EACrB,OAAO,cAAc,WAAW,KAAK,WAAW,WAAW,IAAI,YAAY;AAC7E;AACA,IAAM,mBAAmB;AAAA,EACvB;AACF;AAWA,IAAM,gBAAwC;AAAA,EAC5C;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB;AACF;AAEO,SAAS,4BAAoD;AAClE,QAAM,MAAM,IAAI,IAAI,EAAE,QAAQ,MAAM,CAAC;AACrC,aAAW,GAAG;AACd,SAAO,IAAI,uBAAuB,GAAG;AACvC;AAEO,SAAS,uBACd,QACA,WACA,WACM;AACN,QAAM,cAAc,IAAI;AAAA,IACtB,iBAAiB,WAAW,IAAI,CAAC,cAAc;AAAA,MAC7C,GAAG,UAAU,EAAE,IAAI,UAAU,OAAO;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH;AAEA,aAAW,WAAW,eAAe;AACnC,UAAM,YAAY,YAAY,IAAI,GAAG,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,EAAE;AACtF,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI,MAAM,2CAA2C,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,GAAG;AAAA,IAC/G;AAEA,UAAM,cAAc;AAAA,MAClB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,eAAe;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,cAA+B;AAAA,MACnC,cAAc,QAAQ;AAAA,MACtB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB;AAAA,MACjB,eAAe,QAAQ;AAAA,IACzB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,QACE,OAAO,UAAU;AAAA,QACjB,aAAa,UAAU;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,OAAO,UAA2C;AAChD,cAAM,SAAS,MAAM;AAAA,UACnB,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,uBAAuB,SAAS;AAAA,UAChC;AAAA,QACF;AACA,eAAO,gBAAgB,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,sBAA8C;AAC5D,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/tools.ts","../src/results.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport { join } from \"node:path\";\n\nimport { fromJsonSchema, type McpServer, type ToolAnnotations } from \"@modelcontextprotocol/server\";\nimport { addFormats, Ajv, AjvJsonSchemaValidator } from \"@modelcontextprotocol/server/validators/ajv\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nimport { toMcpToolResult, type McpToolResult } from \"./results.js\";\n\nexport const TOOL_NAMES = [\n  \"tinycloud_status\",\n  \"tinycloud_auth_status\",\n  \"tinycloud_auth_capabilities\",\n  \"tinycloud_auth_request\",\n  \"tinycloud_auth_import\",\n  \"tinycloud_account_spaces_list\",\n  \"tinycloud_account_applications_list\",\n  \"tinycloud_kv_list\",\n  \"tinycloud_kv_get\",\n  \"tinycloud_kv_head\",\n  \"tinycloud_kv_put\",\n  \"tinycloud_kv_delete\",\n  \"tinycloud_sql_schema_inspect\",\n  \"tinycloud_sql_query\",\n  \"tinycloud_sql_execute\",\n  \"tinycloud_secrets_get\",\n] as const;\n\nexport type ToolName = (typeof TOOL_NAMES)[number];\n\nexport interface McpStartupSelection {\n  readonly profile: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n}\n\nexport interface McpInvocationTarget {\n  readonly profile: string;\n  readonly allowOwnerProfile?: true;\n}\n\n/** Project one startup selection into the only owner-sensitive target shape. */\nexport function invocationTargetForMcp(\n  selection: McpStartupSelection,\n): McpInvocationTarget {\n  return {\n    profile: selection.profile,\n    ...(selection.explicitProfile && selection.allowOwnerProfile\n      ? { allowOwnerProfile: true }\n      : {}),\n  };\n}\n\ninterface CatalogOperation {\n  readonly id: string;\n  readonly version: number;\n  readonly title: string;\n  readonly description: string;\n  readonly input: Record<string, unknown>;\n  readonly result: Record<string, unknown>;\n}\n\ninterface OperationsCatalog {\n  readonly operations: readonly CatalogOperation[];\n}\n\n// The require anchor is this module, never the consumer entrypoint. In ESM\n// tsup preserves import.meta.url; in CJS it rewrites the same module-relative\n// anchor to the generated __filename, so both formats stay in MCP's package\n// dependency boundary.\nconst packageRequire = createRequire(\n  typeof __dirname === \"string\" ? join(__dirname, \"tools.cjs\") : import.meta.url,\n);\nconst generatedCatalog = packageRequire(\n  \"@tinycloud/operations/operations.json\",\n) as OperationsCatalog;\n\ninterface ToolBinding {\n  readonly name: ToolName;\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly readOnlyHint: boolean;\n  readonly idempotentHint: boolean;\n  readonly destructiveHint: boolean;\n  readonly openWorldHint: boolean;\n}\n\nconst TOOL_BINDINGS: readonly ToolBinding[] = [\n  {\n    name: \"tinycloud_status\",\n    operationId: \"tinycloud.status.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_status\",\n    operationId: \"tinycloud.auth.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_capabilities\",\n    operationId: \"tinycloud.auth.capabilities\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_request\",\n    operationId: \"tinycloud.auth.request\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_import\",\n    operationId: \"tinycloud.auth.import\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_account_spaces_list\",\n    operationId: \"tinycloud.account.spaces.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_account_applications_list\",\n    operationId: \"tinycloud.account.applications.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_list\",\n    operationId: \"tinycloud.kv.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_get\",\n    operationId: \"tinycloud.kv.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_head\",\n    operationId: \"tinycloud.kv.head\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_put\",\n    operationId: \"tinycloud.kv.put\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_delete\",\n    operationId: \"tinycloud.kv.delete\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_schema_inspect\",\n    operationId: \"tinycloud.sql.schema.inspect\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_query\",\n    operationId: \"tinycloud.sql.query\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_execute\",\n    operationId: \"tinycloud.sql.execute\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_get\",\n    operationId: \"tinycloud.secrets.get\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n] as const;\n\nexport function createJsonSchemaValidator(): AjvJsonSchemaValidator {\n  const ajv = new Ajv({ strict: false });\n  addFormats(ajv);\n  return new AjvJsonSchemaValidator(ajv);\n}\n\nexport function registerTinyCloudTools(\n  server: McpServer,\n  selection: McpStartupSelection,\n  validator: AjvJsonSchemaValidator,\n): void {\n  const definitions = new Map(\n    generatedCatalog.operations.map((operation) => [\n      `${operation.id}@${operation.version}`,\n      operation,\n    ]),\n  );\n\n  for (const binding of TOOL_BINDINGS) {\n    const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);\n    if (operation === undefined) {\n      throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);\n    }\n\n    const inputSchema = fromJsonSchema(\n      operation.input as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const outputSchema = fromJsonSchema(\n      operation.result as unknown as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const annotations: ToolAnnotations = {\n      readOnlyHint: binding.readOnlyHint,\n      idempotentHint: binding.idempotentHint,\n      destructiveHint: binding.destructiveHint,\n      openWorldHint: binding.openWorldHint,\n    };\n\n    server.registerTool(\n      binding.name,\n      {\n        title: operation.title,\n        description: operation.description,\n        inputSchema,\n        outputSchema,\n        annotations,\n      },\n      async (input: unknown): Promise<McpToolResult> => {\n        const result = await invokeOperation(\n          binding.operationId,\n          binding.operationVersion,\n          invocationTargetForMcp(selection),\n          input,\n        );\n        return toMcpToolResult(result);\n      },\n    );\n  }\n}\n\nexport function toolBindingsForTest(): readonly ToolBinding[] {\n  return TOOL_BINDINGS;\n}\n","/**\n * MCP has one structured result channel for a TinyCloud operation. Text is a\n * fixed, non-sensitive status line; it never serializes the operation result.\n */\nexport interface CanonicalOperationResult {\n  readonly status: \"ok\" | \"authority_required\" | \"setup_required\" | \"error\";\n  readonly [key: string]: unknown;\n}\n\nexport interface McpToolResult extends CallToolResult {\n  readonly content: [{ readonly type: \"text\"; readonly text: string }];\n  readonly structuredContent: CanonicalOperationResult;\n}\n\nexport function toMcpToolResult(result: unknown): McpToolResult {\n  const canonical: CanonicalOperationResult = isCanonicalOperationResult(result)\n    ? result\n    : {\n      status: \"error\",\n      operation: {},\n      context: {},\n      error: { code: \"INTERNAL_ERROR\" },\n    };\n\n  return {\n    content: [{ type: \"text\", text: resultSummary(canonical.status) }],\n    structuredContent: canonical,\n  };\n}\n\n/** The canonical envelope immediately before MCP protocol serialization. */\nexport function canonicalMcpAdapterResult(result: unknown): CanonicalOperationResult {\n  return toMcpToolResult(result).structuredContent;\n}\n\nfunction isCanonicalOperationResult(value: unknown): value is CanonicalOperationResult {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const status = (value as { status?: unknown }).status;\n  return status === \"ok\" ||\n    status === \"authority_required\" ||\n    status === \"setup_required\" ||\n    status === \"error\";\n}\n\nfunction resultSummary(status: CanonicalOperationResult[\"status\"]): string {\n  switch (status) {\n    case \"ok\":\n      return \"TinyCloud operation completed; use the structured result.\";\n    case \"authority_required\":\n      return \"TinyCloud authority is required; use the structured request and approval action.\";\n    case \"setup_required\":\n      return \"TinyCloud setup is required; use the structured setup action.\";\n    case \"error\":\n      return \"TinyCloud operation failed; use the structured error.\";\n  }\n}\nimport type { CallToolResult } from \"@modelcontextprotocol/server\";\n"],"mappings":";AAAA,SAAS,qBAAqB;AAC9B,SAAS,YAAY;AAErB,SAAS,sBAA4D;AACrE,SAAS,YAAY,KAAK,8BAA8B;AACxD,SAAS,uBAAuB;;;ACSzB,SAAS,gBAAgB,QAAgC;AAC9D,QAAM,YAAsC,2BAA2B,MAAM,IACzE,SACA;AAAA,IACA,QAAQ;AAAA,IACR,WAAW,CAAC;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC;AAEF,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,cAAc,UAAU,MAAM,EAAE,CAAC;AAAA,IACjE,mBAAmB;AAAA,EACrB;AACF;AAOA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAU,MAA+B;AAC/C,SAAO,WAAW,QAChB,WAAW,wBACX,WAAW,oBACX,WAAW;AACf;AAEA,SAAS,cAAc,QAAoD;AACzE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;;;AD9CO,IAAM,aAAa;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgBO,SAAS,uBACd,WACqB;AACrB,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,GAAI,UAAU,mBAAmB,UAAU,oBACvC,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,EACP;AACF;AAmBA,IAAM,iBAAiB;AAAA,EACrB,OAAO,cAAc,WAAW,KAAK,WAAW,WAAW,IAAI,YAAY;AAC7E;AACA,IAAM,mBAAmB;AAAA,EACvB;AACF;AAYA,IAAM,gBAAwC;AAAA,EAC5C;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AACF;AAEO,SAAS,4BAAoD;AAClE,QAAM,MAAM,IAAI,IAAI,EAAE,QAAQ,MAAM,CAAC;AACrC,aAAW,GAAG;AACd,SAAO,IAAI,uBAAuB,GAAG;AACvC;AAEO,SAAS,uBACd,QACA,WACA,WACM;AACN,QAAM,cAAc,IAAI;AAAA,IACtB,iBAAiB,WAAW,IAAI,CAAC,cAAc;AAAA,MAC7C,GAAG,UAAU,EAAE,IAAI,UAAU,OAAO;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH;AAEA,aAAW,WAAW,eAAe;AACnC,UAAM,YAAY,YAAY,IAAI,GAAG,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,EAAE;AACtF,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI,MAAM,2CAA2C,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,GAAG;AAAA,IAC/G;AAEA,UAAM,cAAc;AAAA,MAClB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,eAAe;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,cAA+B;AAAA,MACnC,cAAc,QAAQ;AAAA,MACtB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB,eAAe,QAAQ;AAAA,IACzB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,QACE,OAAO,UAAU;AAAA,QACjB,aAAa,UAAU;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,OAAO,UAA2C;AAChD,cAAM,SAAS,MAAM;AAAA,UACnB,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,uBAAuB,SAAS;AAAA,UAChC;AAAA,QACF;AACA,eAAO,gBAAgB,MAAM;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,sBAA8C;AAC5D,SAAO;AACT;","names":[]}

package/generated/mcp-facts.json

@@ -86,6 +86,20 @@
       ],
       "sensitiveOutput": false
     },
+    {
+      "name": "tinycloud_kv_delete",
+      "operationId": "tinycloud.kv.delete",
+      "operationVersion": 1,
+      "effects": [
+        "destructive"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": false
+    },
     {
       "name": "tinycloud_kv_get",
       "operationId": "tinycloud.kv.get",
@@ -100,6 +114,20 @@
       ],
       "sensitiveOutput": true
     },
+    {
+      "name": "tinycloud_kv_head",
+      "operationId": "tinycloud.kv.head",
+      "operationVersion": 1,
+      "effects": [
+        "read"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": false
+    },
     {
       "name": "tinycloud_kv_list",
       "operationId": "tinycloud.kv.list",
@@ -114,6 +142,20 @@
       ],
       "sensitiveOutput": true
     },
+    {
+      "name": "tinycloud_kv_put",
+      "operationId": "tinycloud.kv.put",
+      "operationVersion": 1,
+      "effects": [
+        "write"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": false
+    },
     {
       "name": "tinycloud_secrets_get",
       "operationId": "tinycloud.secrets.get",
@@ -129,6 +171,49 @@
       ],
       "sensitiveOutput": true
     },
+    {
+      "name": "tinycloud_sql_execute",
+      "operationId": "tinycloud.sql.execute",
+      "operationVersion": 1,
+      "effects": [
+        "write",
+        "destructive"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": true
+    },
+    {
+      "name": "tinycloud_sql_query",
+      "operationId": "tinycloud.sql.query",
+      "operationVersion": 1,
+      "effects": [
+        "read"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": true
+    },
+    {
+      "name": "tinycloud_sql_schema_inspect",
+      "operationId": "tinycloud.sql.schema.inspect",
+      "operationVersion": 1,
+      "effects": [
+        "read"
+      ],
+      "postures": [
+        "owner-openkey",
+        "delegate-session",
+        "local-owner-key"
+      ],
+      "sensitiveOutput": true
+    },
     {
       "name": "tinycloud_status",
       "operationId": "tinycloud.status.get",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tinycloud/mcp",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "TinyCloud delegated operations MCP server",
   "author": "TinyCloud, Inc.",
   "license": "EGPL",
@@ -53,7 +53,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "2.0.0-beta.4",
-    "@tinycloud/operations": "0.1.0"
+    "@tinycloud/operations": "0.2.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "2.0.0-beta.4",

package/skills/tinycloud-delegated-secrets/SKILL.md

@@ -13,9 +13,15 @@ The following facts are generated from `@tinycloud/operations/operations.json`:
 - `tinycloud_auth_import` -> `tinycloud.auth.import@1`; effects: local_write; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: no.
 - `tinycloud_auth_request` -> `tinycloud.auth.request@1`; effects: local_write; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: no.
 - `tinycloud_auth_status` -> `tinycloud.auth.status@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key, unauthenticated; sensitive output: no.
+- `tinycloud_kv_delete` -> `tinycloud.kv.delete@1`; effects: destructive; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: no.
 - `tinycloud_kv_get` -> `tinycloud.kv.get@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: yes.
+- `tinycloud_kv_head` -> `tinycloud.kv.head@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: no.
 - `tinycloud_kv_list` -> `tinycloud.kv.list@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: yes.
+- `tinycloud_kv_put` -> `tinycloud.kv.put@1`; effects: write; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: no.
 - `tinycloud_secrets_get` -> `tinycloud.secrets.get@1`; effects: read, local_write; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: yes.
+- `tinycloud_sql_execute` -> `tinycloud.sql.execute@1`; effects: write, destructive; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: yes.
+- `tinycloud_sql_query` -> `tinycloud.sql.query@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: yes.
+- `tinycloud_sql_schema_inspect` -> `tinycloud.sql.schema.inspect@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key; sensitive output: yes.
 - `tinycloud_status` -> `tinycloud.status.get@1`; effects: read; postures: owner-openkey, delegate-session, local-owner-key, unauthenticated; sensitive output: no.
 <!-- END GENERATED TINYCloud operation facts -->
 
@@ -44,11 +50,19 @@ Coverage is generated from the Commander registration ledger; legacy commands ar
 4. Choose a non-secrets space from those results. Use `tinycloud_kv_list` with
    an exact space and prefix. Follow the same request, owner grant, import,
    restart, and retry sequence when authority is required.
-5. Use `tinycloud_kv_get` for one exact returned key. A list grant does not
-   imply get authority; request and import the exact get grant when required.
-6. Do not broaden a path, substitute a sibling key, change the audience, or
-   use generic KV tools against a secrets space. Use `tinycloud_secrets_get`
-   for secrets.
+5. Use `tinycloud_kv_get` for one exact returned key. The default base64
+   representation is byte-exact; request `text` or `json` only when the stored
+   bytes have that encoding. A list grant does not imply get authority.
+6. Before replacing or deleting existing data, call `tinycloud_kv_head` and
+   pass its ETag. Use `tinycloud_kv_put` mode `create` to reject collisions,
+   `replace` with an ETag for optimistic concurrency, or `upsert` only when the
+   user explicitly permits overwriting the key.
+7. Use `tinycloud_kv_delete` with the observed ETag when deleting an existing
+   object. Treat a precondition failure as a concurrent change and inspect the
+   object again rather than retrying blindly.
+8. Do not broaden a path, substitute a sibling key, change the audience, or
+   use generic KV tools against account or secrets spaces. Use
+   `tinycloud_secrets_get` for secrets.
 
 ## Secret workflow
 
@@ -77,9 +91,9 @@ transcripts, caches, or evaluation records. TinyCloud controls only its own
 logs and local profile state, not host-side transcript retention. Hosts should
 apply their own sensitive-result retention and access controls.
 
-This proving surface uses local stdio only. It has no continuation tool,
-resources, prompts, elicitation, remote transport, generic permission grant,
-or secret mutation tool.
+This surface uses local stdio only. It has no continuation tool, resources,
+prompts, elicitation, remote transport, generic permission grant, or secret
+mutation tool.
 
 This is a beta surface. Delegated posture is the default; owner-profile data
 access requires explicit opt-in. The user must enter secrets only in Secret