@tinycloud/mcp 0.5.5-beta.0 → 0.6.0-beta.1

package/dist/index.js

@@ -14,15 +14,37 @@ import { addFormats, Ajv, AjvJsonSchemaValidator } from "@modelcontextprotocol/s
 import { invokeOperation } from "@tinycloud/operations";
 
 // src/results.ts
-function toMcpToolResult(result, bindings = []) {
-  const canonical = isCanonicalOperationResult(result) ? withRecoveryTool(result, bindings) : {
+function toMcpToolResult(result, bindings = [], options = {}) {
+  let canonical = isCanonicalOperationResult(result) ? withRecoveryTool(result, bindings) : {
     status: "error",
     operation: {},
     context: {},
     error: { code: "INTERNAL_ERROR" }
   };
+  let serialized;
+  if (options.surface === "hosted") {
+    serialized = JSON.stringify(canonical);
+    if (options.readOnly === true && serialized.length > 1e5) {
+      const sql = options.operationId?.startsWith("tinycloud.sql.") || options.operationId === "tinycloud.apps.query";
+      canonical = {
+        status: "error",
+        operation: canonical.operation,
+        context: canonical.context,
+        error: {
+          code: sql ? "SQL_RESULT_LIMIT_EXCEEDED" : "KV_RESPONSE_TOO_LARGE",
+          message: sql ? "The result exceeds 100,000 characters. Select fewer columns or rows, add a WHERE filter or a smaller LIMIT, or aggregate the data." : "The result exceeds 100,000 characters. Request fewer keys, narrow the prefix, or use a smaller page size.",
+          retryable: false
+        }
+      };
+      serialized = JSON.stringify(canonical);
+    }
+  }
   return {
-    content: [{ type: "text", text: resultSummary(canonical.status) }],
+    content: [{
+      type: "text",
+      text: resultSummary(canonical.status) + (serialized !== void 0 && !(options.operationId === "tinycloud.secrets.get" && canonical.status === "ok") ? `
+${serialized}` : "")
+    }],
     structuredContent: canonical
   };
 }
@@ -59,6 +81,17 @@ function resultSummary(status) {
   }
 }
 
+// src/logging.ts
+function logToolCall(tool, code, startedAt, replayedGrants) {
+  process.stderr.write(`${JSON.stringify({
+    tool,
+    code,
+    durationMs: Math.max(0, Math.round(performance.now() - startedAt)),
+    replayedGrants
+  })}
+`);
+}
+
 // src/tools.ts
 var TOOL_NAMES = [
   "tinycloud_status",
@@ -77,7 +110,10 @@ var TOOL_NAMES = [
   "tinycloud_sql_query",
   "tinycloud_sql_execute",
   "tinycloud_secrets_get",
-  "tinycloud_secrets_status"
+  "tinycloud_secrets_status",
+  "tinycloud_apps_context",
+  "tinycloud_apps_read",
+  "tinycloud_apps_write"
 ];
 function invocationTargetForMcp(selection) {
   return {
@@ -92,6 +128,9 @@ var packageRequire = createRequire(
 var generatedCatalog = packageRequire(
   "@tinycloud/operations/operations.json"
 );
+var stableErrorCodes = Object.fromEntries(
+  generatedCatalog.stableErrors.map((code) => [code, true])
+);
 var ALL_SURFACES = ["local", "hosted"];
 function bindingSurfaces(binding) {
   return binding.surfaces ?? ALL_SURFACES;
@@ -255,6 +294,36 @@ var TOOL_BINDINGS = [
     // Hosted has no persistent reauthorization path for a revoked session
     // yet (TC-896), so status is local/stdio only.
     surfaces: ["local"]
+  },
+  {
+    name: "tinycloud_apps_context",
+    operationId: "tinycloud.apps.context",
+    operationVersion: 1,
+    readOnlyHint: true,
+    idempotentHint: true,
+    destructiveHint: false,
+    openWorldHint: true,
+    surfaces: ["hosted"]
+  },
+  {
+    name: "tinycloud_apps_read",
+    operationId: "tinycloud.apps.read",
+    operationVersion: 1,
+    readOnlyHint: true,
+    idempotentHint: true,
+    destructiveHint: false,
+    openWorldHint: true,
+    surfaces: ["hosted"]
+  },
+  {
+    name: "tinycloud_apps_write",
+    operationId: "tinycloud.apps.write",
+    operationVersion: 1,
+    readOnlyHint: false,
+    idempotentHint: false,
+    destructiveHint: true,
+    openWorldHint: true,
+    surfaces: ["hosted"]
   }
 ];
 function createJsonSchemaValidator() {
@@ -299,23 +368,50 @@ function registerTinyCloudTools(server, selection, validator) {
         annotations
       },
       async (input) => {
-        const result = await invokeOperation(
-          binding.operationId,
-          binding.operationVersion,
-          invocationTargetForMcp(selection),
-          input
-        );
-        const projected = selection.transformOperationResult === void 0 ? result : await selection.transformOperationResult(result);
-        return toMcpToolResult(projected, TOOL_BINDINGS);
+        const startedAt = performance.now();
+        const metrics = { replayedGrants: 0 };
+        let code = "INTERNAL_ERROR";
+        try {
+          const result = await invokeOperation(
+            binding.operationId,
+            binding.operationVersion,
+            invocationTargetForMcp(selection),
+            input,
+            metrics
+          );
+          const projected = selection.transformOperationResult === void 0 ? result : await selection.transformOperationResult(result);
+          const response = toMcpToolResult(projected, TOOL_BINDINGS, {
+            surface: selection.surface,
+            readOnly: binding.readOnlyHint,
+            operationId: binding.operationId
+          });
+          code = outcomeCode(response.structuredContent);
+          return response;
+        } finally {
+          if (selection.surface === "hosted") {
+            logToolCall(binding.name, code, startedAt, metrics.replayedGrants);
+          }
+        }
       }
     );
   }
 }
+function outcomeCode(result) {
+  if (result.status === "error") {
+    const error = result.error;
+    return typeof error?.code === "string" && Object.hasOwn(stableErrorCodes, error.code) ? error.code : "INTERNAL_ERROR";
+  }
+  if (result.status !== "ok") return result.status;
+  const output = result.output;
+  if (output?.outcome === "COPY_PARTIAL") return "COPY_PARTIAL";
+  if (Array.isArray(output?.ops) && output.ops.some((op) => op.outcome !== "ok")) return "PARTIAL";
+  return "ok";
+}
 
 // package.json
 var package_default = {
   name: "@tinycloud/mcp",
-  version: "0.5.5-beta.0",
+  version: "0.6.0-beta.1",
   description: "TinyCloud delegated operations MCP server",
   keywords: [
     "tinycloud",
@@ -388,7 +484,7 @@ var package_default = {
     "@modelcontextprotocol/server": "2.0.0-beta.4",
     "@tinycloud/node-sdk": "3.2.5-beta.0",
     "@tinycloud/node-sdk-wasm": "1.7.7",
-    "@tinycloud/operations": "0.5.5-beta.0",
+    "@tinycloud/operations": "0.6.0-beta.1",
     jose: "6.1.3"
   },
   devDependencies: {
@@ -633,6 +729,7 @@ import {
 } from "@tinycloud/node-sdk";
 import { TCWSessionManager, importKey, initPanicHook } from "@tinycloud/node-sdk-wasm";
 import { invokeOperation as invokeOperation2 } from "@tinycloud/operations";
+import { tcAppsApprovalMessage, tcAppsApprovalReason } from "@tinycloud/operations/tc-apps";
 var PROFILE = "agent";
 var MAX_CALLBACK_BYTES = 256 * 1024;
 var LEGACY_DEFAULT_NODE_HOST = "https://node.tinycloud.xyz";
@@ -685,6 +782,10 @@ var RemoteTenantStore = class {
   tenantStateRoot(subject) {
     return join2(this.#config.stateDir, "tenants", this.#tenantId(subject));
   }
+  /** Prepare only this authenticated account's profile before its first operation. */
+  async initializeTenant(subject) {
+    return (await this.#ensureTenant(subject)).stateRoot;
+  }
   async connectStatus(subject, ownerDids = []) {
     const tenant = await this.#ensureTenant(subject);
     if (await this.#hasValidSession(tenant, ownerDids)) {
@@ -699,7 +800,23 @@ var RemoteTenantStore = class {
     };
   }
   async decorateAuthorityResult(subject, ownerDids, result) {
-    if (!isRecord(result) || result.status !== "authority_required") return result;
+    if (!isRecord(result)) return result;
+    if (result.status === "error" && isRecord(result.error) && (result.error.code === "SESSION_NOT_FOUND" || result.error.code === "AUTH_REQUIRED")) {
+      await this.#ensureTenant(subject);
+      const pending2 = await this.#createPending(subject, ownerDids, "bootstrap", BOOTSTRAP_PERMISSIONS);
+      return {
+        ...result,
+        error: {
+          ...result.error,
+          details: {
+            ...isRecord(result.error.details) ? result.error.details : {},
+            approvalUrl: this.#connectUrl(pending2),
+            expiresAt: pending2.expiresAt
+          }
+        }
+      };
+    }
+    if (result.status !== "authority_required") return result;
     const request = isRecord(result.request) ? result.request : void 0;
     const requestId = typeof request?.requestId === "string" ? request.requestId : void 0;
     const requested = Array.isArray(request?.requested) ? request.requested.filter(isPermissionEntry) : [];
@@ -712,7 +829,7 @@ var RemoteTenantStore = class {
         kind: "openkey",
         requestId,
         url: this.#connectUrl(pending),
-        fallback: "Open the approval URL, then retry the same MCP tool."
+        fallback: tcAppsApprovalMessage(requested) ?? "Open the approval URL, then retry the same MCP tool."
       }
     };
   }
@@ -729,7 +846,7 @@ var RemoteTenantStore = class {
       permissions: Buffer.from(JSON.stringify({
         permissions: pending.permissions,
         reason: [
-          pending.kind === "bootstrap" ? "Connect this TinyCloud account to the hosted MCP delegate." : "Approve the exact capabilities requested by the TinyCloud MCP operation.",
+          pending.kind === "bootstrap" ? "Connect this TinyCloud account to the hosted MCP delegate." : tcAppsApprovalReason(pending.permissions) ?? "Approve the exact capabilities requested by the TinyCloud MCP operation.",
           // Owner DIDs come from the verified OpenKey access token of the MCP
           // client that created this link, never from the link itself.
           ...pending.ownerDids.length === 0 ? [] : [`Requested by TinyCloud account ${pending.ownerDids.join(", ")}; approve only if that is you.`]
@@ -1167,13 +1284,13 @@ function createHostedMcpApp(config) {
   const handler = createMcpHandler(async ({ authInfo: authInfo2 }) => {
     const identity = oauthIdentity(authInfo2);
     const { subject, ownerDids } = identity;
-    const stateRoot = store.tenantStateRoot(subject);
+    const stateRoot = await store.initializeTenant(subject);
     const validator = createJsonSchemaValidator();
     const server = new McpServer2(
       { name: MCP_SERVER_NAME, version: MCP_VERSION },
       {
         jsonSchemaValidator: validator,
-        instructions: "Call tinycloud_connect first. If an operation returns authority_required, open approval.url, then retry that operation unchanged."
+        instructions: "Call tinycloud_connect first. If an operation returns authority_required, open approval.url, then retry that operation unchanged. For personal records such as weight, workouts, goals or todos, call tinycloud_apps_context first."
       }
     );
     registerTinyCloudTools(server, {
@@ -1285,14 +1402,21 @@ function registerConnectTool(server, validator, store, identity) {
       }
     },
     async () => {
-      const status = await store.connectStatus(identity.subject, identity.ownerDids);
-      return {
-        content: [{
-          type: "text",
-          text: status.connected ? "TinyCloud is connected." : "TinyCloud approval is required; open approvalUrl, then call this tool again."
-        }],
-        structuredContent: status
-      };
+      const startedAt = performance.now();
+      let code = "INTERNAL_ERROR";
+      try {
+        const status = await store.connectStatus(identity.subject, identity.ownerDids);
+        code = status.connected ? "ok" : "authority_required";
+        return {
+          content: [{
+            type: "text",
+            text: status.connected ? "TinyCloud is connected." : `TinyCloud approval is required. Open ${status.approvalUrl}, then call this tool again. This link expires at ${status.expiresAt}.`
+          }],
+          structuredContent: status
+        };
+      } finally {
+        logToolCall("tinycloud_connect", code, startedAt, 0);
+      }
     }
   );
 }