@tinycloud/mcp 0.5.4-beta.0 → 0.5.4-beta.1

package/dist/index.js

@@ -315,7 +315,7 @@ function registerTinyCloudTools(server, selection, validator) {
 // package.json
 var package_default = {
   name: "@tinycloud/mcp",
-  version: "0.5.4-beta.0",
+  version: "0.5.4-beta.1",
   description: "TinyCloud delegated operations MCP server",
   keywords: [
     "tinycloud",
@@ -388,7 +388,7 @@ var package_default = {
     "@modelcontextprotocol/server": "2.0.0-beta.4",
     "@tinycloud/node-sdk": "3.2.4-beta.0",
     "@tinycloud/node-sdk-wasm": "1.7.7",
-    "@tinycloud/operations": "0.5.4-beta.0",
+    "@tinycloud/operations": "0.5.4-beta.1",
     jose: "6.1.3"
   },
   devDependencies: {
@@ -536,6 +536,7 @@ import {
   oauthMetadataResponse,
   requireBearerAuth
 } from "@modelcontextprotocol/server";
+import { RUNTIME_DELEGATION_REJECTIONS } from "@tinycloud/node-sdk";
 
 // src/oauth.ts
 import {
@@ -622,7 +623,10 @@ import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 import { chmod, mkdir, readFile, readdir, rename, rm, writeFile } from "fs/promises";
 import { dirname, join as join2 } from "path";
 import {
+  InvalidRestoredSessionError,
+  RuntimeDelegationRejectedError,
   TinyCloudNode,
+  UnsupportedSessionRestoreError,
   isCapabilitySubset,
   principalDidEquals,
   siweRuntimeDelegation
@@ -651,6 +655,26 @@ var ApprovalOwnerMismatchError = class extends Error {
     this.name = "ApprovalOwnerMismatchError";
   }
 };
+var ApprovalStageError = class extends Error {
+  stage;
+  code;
+  reason;
+  constructor(stage, code, reason, cause) {
+    super(`The approval failed at ${stage} (${code}).`, { cause });
+    this.name = "ApprovalStageError";
+    this.stage = stage;
+    this.code = code;
+    this.reason = reason;
+  }
+};
+var ApprovalRequestError = class extends Error {
+  detail;
+  constructor(detail, message, cause) {
+    super(message, { cause });
+    this.name = "ApprovalRequestError";
+    this.detail = detail;
+  }
+};
 var RemoteTenantStore = class {
   #config;
   #initializing = /* @__PURE__ */ new Map();
@@ -716,11 +740,20 @@ var RemoteTenantStore = class {
   }
   async completeApproval(state, request) {
     const length = Number(request.headers.get("content-length") ?? "0");
-    if (Number.isFinite(length) && length > MAX_CALLBACK_BYTES) throw new Error("Callback body is too large.");
+    if (Number.isFinite(length) && length > MAX_CALLBACK_BYTES) {
+      throw new ApprovalRequestError("body_invalid", "Callback body is too large.");
+    }
     const text = await request.text();
-    if (Buffer.byteLength(text) > MAX_CALLBACK_BYTES) throw new Error("Callback body is too large.");
-    const data = JSON.parse(text);
-    if (!isRecord(data)) throw new Error("Callback body is invalid.");
+    if (Buffer.byteLength(text) > MAX_CALLBACK_BYTES) {
+      throw new ApprovalRequestError("body_invalid", "Callback body is too large.");
+    }
+    let data;
+    try {
+      data = JSON.parse(text);
+    } catch (error) {
+      throw new ApprovalRequestError("body_invalid", "Callback body is invalid.", error);
+    }
+    if (!isRecord(data)) throw new ApprovalRequestError("body_invalid", "Callback body is invalid.");
     const pending = await this.#readPending(state, true);
     try {
       const tenant = await this.#readTenant(pending.tenantId);
@@ -758,16 +791,26 @@ var RemoteTenantStore = class {
     if (pending.requestId === void 0) throw new Error("Authority request is missing.");
     const { node, session } = await this.#restoreApproval(tenant, data);
     if (!pending.ownerDids.some((did) => samePrincipal(node.did, did))) throw new ApprovalOwnerMismatchError();
-    const delegation = siweRuntimeDelegation(node, {
-      authorization: session.delegationHeader.Authorization,
-      cid: session.delegationCid,
-      spaceId: session.spaceId,
-      ownerAddress: session.address,
-      chainId: session.chainId,
-      siwe: session.siwe,
-      signature: session.signature,
-      host: this.#config.nodeHost
-    });
+    let delegation;
+    try {
+      delegation = siweRuntimeDelegation(node, {
+        authorization: session.delegationHeader.Authorization,
+        cid: session.delegationCid,
+        spaceId: session.spaceId,
+        ownerAddress: session.address,
+        chainId: session.chainId,
+        siwe: session.siwe,
+        signature: session.signature,
+        host: this.#config.nodeHost
+      });
+    } catch (error) {
+      throw new ApprovalStageError(
+        "siwe_runtime_delegation",
+        "DELEGATION_REJECTED",
+        error instanceof RuntimeDelegationRejectedError ? error.reason : void 0,
+        error
+      );
+    }
     const result = await invokeOperation2(
       "tinycloud.auth.import",
       1,
@@ -780,7 +823,15 @@ var RemoteTenantStore = class {
         delegation
       }
     );
-    if (result.status !== "ok") throw new Error("TinyCloud rejected the approved delegation.");
+    if (result.status === "error") {
+      const reason = result.error.details?.reason;
+      throw new ApprovalStageError(
+        result.error.code === "DELEGATION_REJECTED" && typeof reason === "string" ? "activation" : "auth_import",
+        result.error.code,
+        typeof reason === "string" ? reason : void 0
+      );
+    }
+    if (result.status !== "ok") throw new ApprovalStageError("auth_import", "AUTHORITY_REQUIRED");
   }
   /**
    * Verify the OpenKey callback as a SIWE session for this tenant's key. The
@@ -790,11 +841,25 @@ var RemoteTenantStore = class {
    * exactly the delegation being stored.
    */
   async #restoreApproval(tenant, data) {
-    const session = sessionFromCallback(data, tenant.jwk);
+    let session;
+    try {
+      session = sessionFromCallback(data, tenant.jwk);
+    } catch (error) {
+      throw new ApprovalStageError("restore_approval", "CALLBACK_INCOMPLETE", void 0, error);
+    }
     const node = new TinyCloudNode({ host: this.#config.nodeHost });
-    await node.restoreSession(session);
+    try {
+      await node.restoreSession(session);
+    } catch (error) {
+      throw new ApprovalStageError(
+        "restore_approval",
+        error instanceof InvalidRestoredSessionError || error instanceof UnsupportedSessionRestoreError ? error.code : "SESSION_RESTORE_FAILED",
+        void 0,
+        error
+      );
+    }
     if (!samePrincipal(node.sessionDid, tenant.sessionDid)) {
-      throw new Error("The approved delegation targets a different session.");
+      throw new ApprovalStageError("restore_approval", "SESSION_MISMATCH");
     }
     return { node, session };
   }
@@ -853,10 +918,10 @@ var RemoteTenantStore = class {
     return { stateRoot, sessionDid, jwk };
   }
   async #readTenant(tenantId) {
-    if (!/^[a-f0-9]{64}$/.test(tenantId)) throw new Error("Approval state is invalid.");
+    if (!/^[a-f0-9]{64}$/.test(tenantId)) throw new ApprovalRequestError("state_invalid", "Approval state is invalid.");
     const stateRoot = join2(this.#config.stateDir, "tenants", tenantId);
     const jwk = await readJson(this.#keyPath(stateRoot));
-    if (jwk === null) throw new Error("The TinyCloud delegate no longer exists.");
+    if (jwk === null) throw new ApprovalRequestError("tenant_missing", "The TinyCloud delegate no longer exists.");
     return { stateRoot, jwk, sessionDid: didFromJwk(jwk) };
   }
   async #createPending(subject, ownerDids, kind, permissions, requestId) {
@@ -886,26 +951,40 @@ var RemoteTenantStore = class {
   async #readPending(state, consume) {
     const [tenantId, nonce, signature] = state.split(".");
     if (tenantId === void 0 || nonce === void 0 || signature === void 0) {
-      throw new Error("Approval state is invalid.");
+      throw new ApprovalRequestError("state_invalid", "Approval state is invalid.");
     }
     const expected = this.#signState(tenantId, nonce);
     const supplied = Buffer.from(signature, "base64url");
     const expectedBytes = Buffer.from(expected, "base64url");
     if (supplied.length !== expectedBytes.length || !timingSafeEqual(supplied, expectedBytes)) {
-      throw new Error("Approval state is invalid.");
+      throw new ApprovalRequestError("state_invalid", "Approval state is invalid.");
     }
     const stateRoot = join2(this.#config.stateDir, "tenants", tenantId);
     const path = this.#pendingPath(stateRoot, nonce);
     const claimed = `${path}.processing`;
-    if (consume) await rename(path, claimed);
+    if (consume) {
+      try {
+        await rename(path, claimed);
+      } catch (error) {
+        if (!isRecord(error) || error.code !== "ENOENT") throw error;
+        const tenantExists = await readJson(this.#keyPath(stateRoot)).then(
+          (jwk) => jwk !== null,
+          () => true
+        );
+        if (!tenantExists) {
+          throw new ApprovalRequestError("tenant_missing", "The TinyCloud delegate no longer exists.", error);
+        }
+        throw new ApprovalRequestError("state_not_pending", "Approval state is invalid or already used.", error);
+      }
+    }
     try {
       const pending = await readJson(consume ? claimed : path);
       if (pending === null || pending.version !== 1 || pending.tenantId !== tenantId || pending.nonce !== nonce) {
-        throw new Error("Approval state is invalid or already used.");
+        throw new ApprovalRequestError("state_not_pending", "Approval state is invalid or already used.");
       }
       if (new Date(pending.expiresAt).getTime() <= Date.now()) {
         await rm(consume ? claimed : path, { force: true });
-        throw new Error("Approval state has expired.");
+        throw new ApprovalRequestError("state_expired", "Approval state has expired.");
       }
       return pending;
     } catch (error) {
@@ -1142,8 +1221,23 @@ function createHostedMcpApp(config) {
           await store.completeApproval(requiredState(url), request);
           return callbackCors(json({ success: true }), config.openkeyHost);
         } catch (error) {
+          if (error instanceof ApprovalOwnerMismatchError) {
+            return callbackCors(json({ error: error.message, code: "approval_owner_mismatch" }, 403), config.openkeyHost);
+          }
+          const stage = error instanceof ApprovalStageError ? error.stage : "unknown";
+          const code = error instanceof ApprovalStageError && /^[A-Z][A-Z0-9_]{0,63}$/.test(error.code) ? error.code : "UNKNOWN";
+          const reason = !(error instanceof ApprovalStageError) || error.reason === void 0 ? void 0 : RUNTIME_DELEGATION_REJECTIONS.find((known) => known === error.reason) ?? "unknown";
+          const detail = error instanceof ApprovalRequestError ? error.detail : "none";
+          writeDiagnostic(
+            `connect callback rejected: stage=${stage} code=${code}${reason === void 0 ? "" : ` reason=${reason}`} detail=${detail}`
+          );
           return callbackCors(
-            error instanceof ApprovalOwnerMismatchError ? json({ error: error.message, code: "approval_owner_mismatch" }, 403) : json({ error: "TinyCloud could not accept this delegation." }, 400),
+            json({
+              error: stage,
+              code,
+              ...reason === void 0 ? {} : { reason },
+              message: "TinyCloud could not accept this delegation."
+            }, 400),
             config.openkeyHost
           );
         }
@@ -1218,7 +1312,8 @@ function canonicalResourceUrl(url) {
 }
 function requiredState(url) {
   const state = url.searchParams.get("state");
-  if (state === null || state.length > 512) throw new Error("Missing approval state.");
+  if (state === null) throw new ApprovalRequestError("state_missing", "Missing approval state.");
+  if (state.length > 512) throw new ApprovalRequestError("state_invalid", "Approval state is invalid.");
   return state;
 }
 function validateOrigin(request, allowed) {