@tinycloud/mcp 0.7.0-beta.35 → 0.7.0-beta.36

package/dist/index.js

@@ -403,6 +403,7 @@ function registerTinyCloudTools(server, selection, validator) {
         const metrics = { replayedGrants: 0 };
         let code = "INTERNAL_ERROR";
         try {
+          await selection.beforeOperation?.();
           const result = await invokeOperation(
             binding.operationId,
             binding.operationVersion,
@@ -410,7 +411,11 @@ function registerTinyCloudTools(server, selection, validator) {
             input,
             metrics
           );
-          const projected = selection.transformOperationResult === void 0 ? result : await selection.transformOperationResult(result);
+          const projected = selection.transformOperationResult === void 0 ? result : await selection.transformOperationResult(result, {
+            operationId: binding.operationId,
+            operationVersion: binding.operationVersion,
+            input
+          });
           const response = toMcpToolResult(projected, TOOL_BINDINGS, {
             surface: selection.surface,
             readOnly: binding.readOnlyHint,
@@ -442,7 +447,7 @@ function outcomeCode(result) {
 // package.json
 var package_default = {
   name: "@tinycloud/mcp",
-  version: "0.7.0-beta.35",
+  version: "0.7.0-beta.36",
   description: "TinyCloud delegated operations MCP server",
   keywords: [
     "tinycloud",
@@ -515,7 +520,7 @@ var package_default = {
     "@modelcontextprotocol/server": "2.0.0-beta.5",
     "@tinycloud/node-sdk": "3.3.0-beta.36",
     "@tinycloud/node-sdk-wasm": "1.7.8-beta.0",
-    "@tinycloud/operations": "0.7.0-beta.34",
+    "@tinycloud/operations": "0.7.0-beta.35",
     jose: "6.2.4"
   },
   devDependencies: {
@@ -756,10 +761,12 @@ import {
   UnsupportedSessionRestoreError,
   isCapabilitySubset,
   principalDidEquals,
-  siweRuntimeDelegation
+  siweRuntimeDelegation,
+  signedCompactUcanExpiry
 } from "@tinycloud/node-sdk";
 import { TCWSessionManager, importKey, initPanicHook } from "@tinycloud/node-sdk-wasm";
 import { invokeOperation as invokeOperation2 } from "@tinycloud/operations";
+import { nodeRevocationOf, operationRetryDescriptor } from "@tinycloud/operations/mcp-authority";
 import { tcAppsApprovalMessage, tcAppsApprovalReason } from "@tinycloud/operations/tc-apps";
 var PROFILE = "agent";
 var MAX_CALLBACK_BYTES = 256 * 1024;
@@ -807,6 +814,15 @@ var ApprovalRequestError = class extends Error {
 var RemoteTenantStore = class {
   #config;
   #initializing = /* @__PURE__ */ new Map();
+  #sessionChecks = /* @__PURE__ */ new Map();
+  #clearing = /* @__PURE__ */ new Map();
+  #activeSessions = /* @__PURE__ */ new Map();
+  #pendingWrites = /* @__PURE__ */ new Map();
+  #renewalRequired = /* @__PURE__ */ new Set();
+  #approvalEpochs = /* @__PURE__ */ new Map();
+  #scopedClearing = /* @__PURE__ */ new Map();
+  #clearedScoped = /* @__PURE__ */ new Map();
+  #approvalProcessing = /* @__PURE__ */ new Map();
   constructor(config) {
     this.#config = config;
   }
@@ -817,9 +833,13 @@ var RemoteTenantStore = class {
   async initializeTenant(subject) {
     return (await this.#ensureTenant(subject)).stateRoot;
   }
+  /** Check stored node authority before an authenticated operation uses it. */
+  async validateTenant(subject, ownerDids) {
+    await this.#hasValidSession(await this.#ensureTenant(subject), ownerDids);
+  }
   async connectStatus(subject, ownerDids = []) {
     const tenant = await this.#ensureTenant(subject);
-    if (await this.#hasValidSession(tenant, ownerDids)) {
+    if (await this.#hasValidSession(tenant, ownerDids, true)) {
       return { connected: true, sessionDid: tenant.sessionDid };
     }
     const pending = await this.#createPending(subject, ownerDids, "bootstrap", BOOTSTRAP_PERMISSIONS);
@@ -830,24 +850,54 @@ var RemoteTenantStore = class {
       expiresAt: pending.expiresAt
     };
   }
-  async decorateAuthorityResult(subject, ownerDids, result) {
+  async decorateAuthorityResult(subject, ownerDids, result, invocation) {
     if (!isRecord(result)) return result;
     if (result.status === "error" && isRecord(result.error) && (result.error.code === "SESSION_NOT_FOUND" || result.error.code === "AUTH_REQUIRED")) {
-      await this.#ensureTenant(subject);
+      const tenant2 = await this.#ensureTenant(subject);
+      const refusal = revocationFromResult(result.error);
+      const cleared = refusal === void 0 ? void 0 : await this.#clearRefusedAuthority(tenant2, refusal);
+      if (cleared === "scoped" && invocation !== void 0) {
+        return this.#renewScopedApproval(subject, ownerDids, tenant2, result, invocation);
+      }
+      const valid = await this.#hasValidSession(tenant2, ownerDids, true);
+      if (valid && result.error.code === "AUTH_REQUIRED") {
+        if (refusal === void 0) return result;
+        return {
+          ...result,
+          error: { code: "AUTH_REQUIRED", message: "TinyCloud approval is required.", retryable: false }
+        };
+      }
       const pending2 = await this.#createPending(subject, ownerDids, "bootstrap", BOOTSTRAP_PERMISSIONS);
       return {
-        ...result,
+        status: "error",
+        operation: result.operation,
+        context: result.context,
         error: {
-          ...result.error,
-          details: {
-            ...isRecord(result.error.details) ? result.error.details : {},
-            approvalUrl: this.#connectUrl(pending2),
-            expiresAt: pending2.expiresAt
-          }
+          code: result.error.code === "SESSION_NOT_FOUND" && await readJson(this.#sessionPath(tenant2.stateRoot)) === null ? "SESSION_NOT_FOUND" : "AUTH_REQUIRED",
+          message: "A new TinyCloud approval is required.",
+          retryable: false,
+          details: { approvalUrl: this.#connectUrl(pending2), expiresAt: pending2.expiresAt }
         }
       };
     }
     if (result.status !== "authority_required") return result;
+    const tenant = await this.#ensureTenant(subject);
+    if (this.#renewalRequired.has(tenant.stateRoot) || !await this.#hasValidSession(tenant, ownerDids, true)) {
+      if (this.#renewalRequired.has(tenant.stateRoot)) {
+        const pending2 = await this.#createPending(subject, ownerDids, "bootstrap", BOOTSTRAP_PERMISSIONS);
+        return {
+          status: "error",
+          operation: result.operation,
+          context: result.context,
+          error: {
+            code: "AUTH_REQUIRED",
+            message: "A new TinyCloud approval is required.",
+            retryable: false,
+            details: { approvalUrl: this.#connectUrl(pending2), expiresAt: pending2.expiresAt }
+          }
+        };
+      }
+    }
     const request = isRecord(result.request) ? result.request : void 0;
     const requestId = typeof request?.requestId === "string" ? request.requestId : void 0;
     const requested = Array.isArray(request?.requested) ? request.requested.filter(isPermissionEntry) : [];
@@ -864,6 +914,90 @@ var RemoteTenantStore = class {
       }
     };
   }
+  async #renewScopedApproval(subject, ownerDids, tenant, result, invocation) {
+    const planned = await invokeOperation2(
+      "tinycloud.auth.request",
+      1,
+      { profile: PROFILE, stateRoot: tenant.stateRoot },
+      invocation
+    );
+    const output = planned.status === "ok" && isRecord(planned.output) ? planned.output : void 0;
+    const request = isRecord(output?.request) ? output.request : void 0;
+    const requestId = typeof request?.requestId === "string" ? request.requestId : void 0;
+    const requested = Array.isArray(request?.requested) ? request.requested.filter(isPermissionEntry) : [];
+    const missing = Array.isArray(output?.missing) ? output.missing.filter(isPermissionEntry) : [];
+    if (requestId === void 0 || requested.length === 0 || missing.length === 0) {
+      return {
+        status: "error",
+        operation: result.operation,
+        context: result.context,
+        error: { code: "AUTH_REQUIRED", message: "A new TinyCloud approval is required.", retryable: false }
+      };
+    }
+    const pending = await this.#createPending(subject, ownerDids, "delegation", requested, requestId);
+    return {
+      status: "authority_required",
+      operation: result.operation,
+      context: result.context,
+      missing,
+      request,
+      approval: {
+        kind: "openkey",
+        requestId,
+        url: this.#connectUrl(pending),
+        fallback: tcAppsApprovalMessage(requested) ?? "Open the approval URL, then retry the same MCP tool."
+      },
+      retry: operationRetryDescriptor(invocation, invocation.input)
+    };
+  }
+  async #clearRefusedAuthority(tenant, refusal) {
+    const raw = await readJson(this.#sessionPath(tenant.stateRoot)).catch(() => null);
+    const bootstrapCid = raw?.delegationCid;
+    const ancestorCid = refusal.reason === "delegation_ancestor_revoked" ? refusal.ancestorCid : void 0;
+    if (typeof bootstrapCid === "string" && (bootstrapCid === refusal.revokedCid || bootstrapCid === ancestorCid)) {
+      await this.#clearAuthority(tenant);
+      return "bootstrap";
+    }
+    const key = tenant.stateRoot;
+    const removed = this.#clearedScoped.get(tenant.stateRoot);
+    if (removed?.has(refusal.revokedCid)) return "scoped";
+    const additional = await readJson(this.#additionalPath(tenant.stateRoot));
+    if (this.#clearedScoped.get(key)?.has(refusal.revokedCid)) return "scoped";
+    if (!Array.isArray(additional)) return void 0;
+    const affected = additional.some((entry) => {
+      const cid = isRecord(entry) && isRecord(entry.delegation) ? entry.delegation.cid : void 0;
+      return typeof cid === "string" && (cid === refusal.revokedCid || cid === ancestorCid);
+    });
+    const inProgress = this.#scopedClearing.get(key);
+    if (inProgress) {
+      await inProgress;
+      return this.#clearRefusedAuthority(tenant, refusal);
+    }
+    if (!affected) return void 0;
+    const clearing = (async () => {
+      const latest = await readJson(this.#additionalPath(tenant.stateRoot));
+      if (!Array.isArray(latest)) return;
+      const remaining = latest.filter((entry) => {
+        const cid = isRecord(entry) && isRecord(entry.delegation) ? entry.delegation.cid : void 0;
+        return typeof cid !== "string" || cid !== refusal.revokedCid && cid !== ancestorCid;
+      });
+      if (remaining.length === latest.length) return;
+      this.#activeSessions.delete(tenant.stateRoot);
+      const epoch = (this.#approvalEpochs.get(tenant.stateRoot) ?? tenant.approvalEpoch) + 1;
+      this.#approvalEpochs.set(tenant.stateRoot, epoch);
+      const profilePath = this.#profilePath(tenant.stateRoot);
+      const profile = await readJson(profilePath);
+      await secureWrite(profilePath, { ...profile, approvalEpoch: epoch });
+      if (remaining.length === 0) await rm(this.#additionalPath(tenant.stateRoot), { force: true });
+      else await secureWrite(this.#additionalPath(tenant.stateRoot), remaining);
+      const cleared = removed ?? /* @__PURE__ */ new Set();
+      cleared.add(refusal.revokedCid);
+      this.#clearedScoped.set(tenant.stateRoot, cleared);
+    })().finally(() => this.#scopedClearing.delete(key));
+    this.#scopedClearing.set(key, clearing);
+    await clearing;
+    return "scoped";
+  }
   async approvalRedirect(state) {
     const pending = await this.#readPending(state, false);
     const tenant = await this.#readTenant(pending.tenantId);
@@ -904,21 +1038,36 @@ var RemoteTenantStore = class {
     }
     if (!isRecord(data)) throw new ApprovalRequestError("body_invalid", "Callback body is invalid.");
     const pending = await this.#readPending(state, true);
-    try {
-      const tenant = await this.#readTenant(pending.tenantId);
-      if (pending.kind === "bootstrap") {
-        await this.#storeBootstrap(tenant, pending, data);
-      } else {
-        await this.#storeDelegation(tenant, pending, data);
+    const stateRoot = join2(this.#config.stateDir, "tenants", pending.tenantId);
+    const prior = this.#approvalProcessing.get(stateRoot);
+    const processing = (async () => {
+      if (prior) await prior.catch(() => void 0);
+      try {
+        const tenant = await this.#readTenant(pending.tenantId);
+        if ((pending.approvalEpoch ?? 0) !== tenant.approvalEpoch) {
+          throw new ApprovalRequestError("state_not_pending", "Approval state is invalid or already used.");
+        }
+        if (pending.kind === "bootstrap") {
+          await this.#storeBootstrap(tenant, pending, data);
+        } else {
+          await this.#storeDelegation(tenant, pending, data);
+        }
+        await rm(this.#pendingPath(tenant.stateRoot, pending.nonce) + ".processing", { force: true });
+      } catch (error) {
+        await this.#restorePending(pending).catch(() => void 0);
+        throw error;
       }
-      await rm(this.#pendingPath(tenant.stateRoot, pending.nonce) + ".processing", { force: true });
-    } catch (error) {
-      await this.#restorePending(pending).catch(() => void 0);
-      throw error;
+    })();
+    this.#approvalProcessing.set(stateRoot, processing);
+    try {
+      await processing;
+    } finally {
+      if (this.#approvalProcessing.get(stateRoot) === processing) this.#approvalProcessing.delete(stateRoot);
     }
   }
   async #storeBootstrap(tenant, pending, data) {
     const { node, session } = await this.#restoreApproval(tenant, data);
+    this.#assertCurrentApproval(pending, session);
     if (pending.ownerDids.length > 0 && !pending.ownerDids.some((did) => samePrincipal(node.did, did))) {
       throw new ApprovalOwnerMismatchError();
     }
@@ -935,10 +1084,13 @@ var RemoteTenantStore = class {
       authMethod: "openkey",
       ...session
     });
+    this.#renewalRequired.delete(tenant.stateRoot);
+    this.#activeSessions.delete(tenant.stateRoot);
   }
   async #storeDelegation(tenant, pending, data) {
     if (pending.requestId === void 0) throw new Error("Authority request is missing.");
     const { node, session } = await this.#restoreApproval(tenant, data);
+    this.#assertCurrentApproval(pending, session);
     if (!pending.ownerDids.some((did) => samePrincipal(node.did, did))) throw new ApprovalOwnerMismatchError();
     let delegation;
     try {
@@ -982,6 +1134,12 @@ var RemoteTenantStore = class {
     }
     if (result.status !== "ok") throw new ApprovalStageError("auth_import", "AUTHORITY_REQUIRED");
   }
+  #assertCurrentApproval(pending, session) {
+    const issuedAt = /^Issued At: ([^\r\n]+)\r?$/m.exec(session.siwe)?.[1];
+    if (issuedAt === void 0 || !Number.isFinite(Date.parse(issuedAt)) || Date.parse(issuedAt) < Date.parse(pending.createdAt)) {
+      throw new ApprovalStageError("restore_approval", "APPROVAL_PREDATES_REQUEST");
+    }
+  }
   /**
    * Verify the OpenKey callback as a SIWE session for this tenant's key. The
    * callback must carry the full signed proof (SIWE, signature, address and
@@ -1022,17 +1180,104 @@ var RemoteTenantStore = class {
     this.#initializing.set(tenantId, initializing);
     return initializing;
   }
-  async #hasValidSession(tenant, ownerDids) {
-    const raw = await readJson(this.#sessionPath(tenant.stateRoot));
+  async #hasValidSession(tenant, ownerDids, fresh = false) {
+    if (this.#renewalRequired.has(tenant.stateRoot)) return false;
+    const key = JSON.stringify([tenant.stateRoot, ownerDids.map(normalizeDid), fresh]);
+    const current = this.#sessionChecks.get(key);
+    if (current) return current;
+    const checking = this.#checkSession(tenant, ownerDids, fresh).finally(() => {
+      this.#sessionChecks.delete(key);
+    });
+    this.#sessionChecks.set(key, checking);
+    return checking;
+  }
+  async #checkSession(tenant, ownerDids, fresh) {
+    let raw;
+    try {
+      raw = await readJson(this.#sessionPath(tenant.stateRoot));
+    } catch (error) {
+      if (!(error instanceof SyntaxError)) throw error;
+      await this.#clearAuthority(tenant);
+      return false;
+    }
     if (raw === null) return false;
+    const node = new TinyCloudNode({ host: this.#config.nodeHost });
     try {
-      const node = new TinyCloudNode({ host: this.#config.nodeHost });
       await node.restoreSession(raw);
-      return samePrincipal(node.sessionDid, tenant.sessionDid) && ownerDids.some((did) => samePrincipal(node.did, did));
     } catch {
-      await rm(this.#sessionPath(tenant.stateRoot), { force: true });
+      const header = isRecord(raw.delegationHeader) ? raw.delegationHeader.Authorization : void 0;
+      const signedExpiry = typeof header === "string" ? signedCompactUcanExpiry(header) : void 0;
+      const siweExpiry = typeof raw.siwe === "string" ? /^Expiration Time: ([^\r\n]+)\r?$/m.exec(raw.siwe)?.[1] : void 0;
+      const expiry = signedExpiry ?? (siweExpiry === void 0 ? void 0 : new Date(siweExpiry));
+      if (expiry !== void 0 && expiry.getTime() <= Date.now()) return false;
+      await this.#clearAuthority(tenant);
+      return false;
+    }
+    if (!samePrincipal(node.sessionDid, tenant.sessionDid) || !ownerDids.some((did) => samePrincipal(node.did, did))) return false;
+    const additional = await readJson(this.#additionalPath(tenant.stateRoot));
+    const cids = [raw.delegationCid];
+    if (additional !== null) {
+      if (!Array.isArray(additional)) throw new Error("Stored TinyCloud authority is unavailable.");
+      for (const entry of additional) {
+        const cid = isRecord(entry) && isRecord(entry.delegation) ? entry.delegation.cid : void 0;
+        cids.push(cid);
+      }
+    }
+    if (!cids.every((cid) => typeof cid === "string" && cid.length > 0)) {
+      throw new Error("Stored TinyCloud authority is unavailable.");
+    }
+    const fingerprint = cids.join("\n");
+    const cached = this.#activeSessions.get(tenant.stateRoot);
+    if (!fresh && cached?.cids === fingerprint && cached.until > Date.now()) return true;
+    let timer;
+    const timeout = new Promise((resolve) => {
+      timer = setTimeout(() => resolve(void 0), 2e3);
+      timer.unref();
+    });
+    const probe = await Promise.race([
+      node.kvForSpace(String(raw.spaceId)).list({ prefix: "spaces/" }).catch(() => void 0),
+      timeout
+    ]).finally(() => clearTimeout(timer));
+    const refusal = probe !== void 0 && !probe.ok ? nodeRevocationOf(probe.error) : void 0;
+    if (refusal !== void 0 && (refusal.revokedCid === raw.delegationCid || refusal.reason === "delegation_ancestor_revoked" && refusal.ancestorCid === raw.delegationCid)) {
+      await this.#clearAuthority(tenant);
       return false;
     }
+    if (this.#renewalRequired.has(tenant.stateRoot)) return false;
+    if (probe?.ok) {
+      this.#activeSessions.set(tenant.stateRoot, { cids: fingerprint, until: Date.now() + 3e4 });
+    }
+    return true;
+  }
+  async #clearAuthority(tenant) {
+    const current = this.#clearing.get(tenant.stateRoot);
+    if (current) return current;
+    this.#activeSessions.delete(tenant.stateRoot);
+    this.#renewalRequired.add(tenant.stateRoot);
+    this.#clearedScoped.delete(tenant.stateRoot);
+    this.#approvalEpochs.set(
+      tenant.stateRoot,
+      (this.#approvalEpochs.get(tenant.stateRoot) ?? tenant.approvalEpoch) + 1
+    );
+    const clearing = (async () => {
+      const processing = this.#approvalProcessing.get(tenant.stateRoot);
+      if (processing) await processing.catch(() => void 0);
+      const scoped = this.#scopedClearing.get(tenant.stateRoot);
+      if (scoped) await scoped;
+      this.#renewalRequired.add(tenant.stateRoot);
+      const profilePath = this.#profilePath(tenant.stateRoot);
+      const profile = await readJson(profilePath);
+      await secureWrite(profilePath, {
+        ...profile,
+        approvalEpoch: this.#approvalEpochs.get(tenant.stateRoot)
+      });
+      await rm(this.#additionalPath(tenant.stateRoot), { force: true });
+      await rm(join2(tenant.stateRoot, ".tinycloud", "profiles", PROFILE, "auth-requests.json"), { force: true });
+      await rm(this.#pendingDirectory(tenant.stateRoot), { recursive: true, force: true });
+      await rm(this.#sessionPath(tenant.stateRoot), { force: true });
+    })().finally(() => this.#clearing.delete(tenant.stateRoot));
+    this.#clearing.set(tenant.stateRoot, clearing);
+    await clearing;
   }
   async #initializeTenant(tenantId) {
     const stateRoot = join2(this.#config.stateDir, "tenants", tenantId);
@@ -1071,21 +1316,36 @@ var RemoteTenantStore = class {
 `
       );
     }
-    return { stateRoot, sessionDid, jwk };
+    const approvalEpoch = this.#approvalEpochs.get(stateRoot) ?? (typeof profile?.approvalEpoch === "number" ? profile.approvalEpoch : 0);
+    this.#approvalEpochs.set(stateRoot, approvalEpoch);
+    return { stateRoot, sessionDid, jwk, approvalEpoch };
   }
   async #readTenant(tenantId) {
     if (!/^[a-f0-9]{64}$/.test(tenantId)) throw new ApprovalRequestError("state_invalid", "Approval state is invalid.");
     const stateRoot = join2(this.#config.stateDir, "tenants", tenantId);
     const jwk = await readJson(this.#keyPath(stateRoot));
     if (jwk === null) throw new ApprovalRequestError("tenant_missing", "The TinyCloud delegate no longer exists.");
-    return { stateRoot, jwk, sessionDid: didFromJwk(jwk) };
+    const profile = await readJson(this.#profilePath(stateRoot));
+    const approvalEpoch = this.#approvalEpochs.get(stateRoot) ?? (typeof profile?.approvalEpoch === "number" ? profile.approvalEpoch : 0);
+    return { stateRoot, jwk, sessionDid: didFromJwk(jwk), approvalEpoch };
   }
   async #createPending(subject, ownerDids, kind, permissions, requestId) {
+    const clearing = this.#clearing.get(this.tenantStateRoot(subject));
+    if (clearing) await clearing;
     const tenant = await this.#ensureTenant(subject);
     const tenantId = this.#tenantId(subject);
+    const normalizedOwners = ownerDids.map(normalizeDid);
+    const key = JSON.stringify([tenantId, tenant.approvalEpoch, kind, requestId, permissions, normalizedOwners]);
+    const current = this.#pendingWrites.get(key);
+    if (current) return current;
+    const writing = this.#writePending(tenant, tenantId, kind, permissions, normalizedOwners, requestId).finally(() => this.#pendingWrites.delete(key));
+    this.#pendingWrites.set(key, writing);
+    return writing;
+  }
+  async #writePending(tenant, tenantId, kind, permissions, ownerDids, requestId) {
     const reusable = await reusablePending(
       this.#pendingDirectory(tenant.stateRoot),
-      { tenantId, kind, requestId, permissions, ownerDids: ownerDids.map(normalizeDid) }
+      { tenantId, approvalEpoch: tenant.approvalEpoch, kind, requestId, permissions, ownerDids }
     );
     if (reusable !== void 0) return reusable;
     const nonce = randomBytes(24).toString("base64url");
@@ -1094,10 +1354,11 @@ var RemoteTenantStore = class {
       version: 1,
       nonce,
       tenantId,
+      approvalEpoch: tenant.approvalEpoch,
       kind,
       ...requestId === void 0 ? {} : { requestId },
       permissions,
-      ownerDids: ownerDids.map(normalizeDid),
+      ownerDids,
       createdAt: new Date(created).toISOString(),
       expiresAt: new Date(created + this.#config.approvalTtlSeconds * 1e3).toISOString()
     };
@@ -1138,6 +1399,11 @@ var RemoteTenantStore = class {
       if (pending === null || pending.version !== 1 || pending.tenantId !== tenantId || pending.nonce !== nonce) {
         throw new ApprovalRequestError("state_not_pending", "Approval state is invalid or already used.");
       }
+      const profile = await readJson(this.#profilePath(stateRoot));
+      const approvalEpoch = this.#approvalEpochs.get(stateRoot) ?? (typeof profile?.approvalEpoch === "number" ? profile.approvalEpoch : 0);
+      if ((pending.approvalEpoch ?? 0) !== approvalEpoch) {
+        throw new ApprovalRequestError("state_not_pending", "Approval state is invalid or already used.");
+      }
       if (new Date(pending.expiresAt).getTime() <= Date.now()) {
         await rm(consume ? claimed : path, { force: true });
         throw new ApprovalRequestError("state_expired", "Approval state has expired.");
@@ -1173,6 +1439,9 @@ var RemoteTenantStore = class {
   #sessionPath(stateRoot) {
     return join2(stateRoot, ".tinycloud", "profiles", PROFILE, "session.json");
   }
+  #additionalPath(stateRoot) {
+    return join2(stateRoot, ".tinycloud", "profiles", PROFILE, "additional-delegations.json");
+  }
   #pendingPath(stateRoot, nonce) {
     return join2(this.#pendingDirectory(stateRoot), `${nonce}.json`);
   }
@@ -1200,6 +1469,21 @@ function ensureWasm() {
   initPanicHook();
   wasmInitialized = true;
 }
+function revocationFromResult(error) {
+  const details = error.details;
+  if (!isRecord(details) || typeof details.revokedCid !== "string") return void 0;
+  if (details.reason === "delegation_revoked") {
+    return { reason: "delegation_revoked", revokedCid: details.revokedCid };
+  }
+  if (details.reason === "delegation_ancestor_revoked" && typeof details.ancestorCid === "string") {
+    return {
+      reason: "delegation_ancestor_revoked",
+      revokedCid: details.revokedCid,
+      ancestorCid: details.ancestorCid
+    };
+  }
+  return void 0;
+}
 function sessionFromCallback(data, privateJwk) {
   const delegationHeader = data.delegationHeader;
   if (!isRecord(delegationHeader) || typeof delegationHeader.Authorization !== "string" || typeof data.delegationCid !== "string" || typeof data.spaceId !== "string" || typeof data.verificationMethod !== "string" || typeof data.address !== "string" || typeof data.chainId !== "number" || typeof data.siwe !== "string" || typeof data.signature !== "string") {
@@ -1290,7 +1574,7 @@ async function reusablePending(directory, expected) {
   return void 0;
 }
 function samePendingRequest(pending, expected) {
-  return pending.version === 1 && pending.tenantId === expected.tenantId && pending.kind === expected.kind && pending.requestId === expected.requestId && JSON.stringify(pending.permissions) === JSON.stringify(expected.permissions) && JSON.stringify(pending.ownerDids) === JSON.stringify(expected.ownerDids);
+  return pending.version === 1 && pending.tenantId === expected.tenantId && (pending.approvalEpoch ?? 0) === expected.approvalEpoch && pending.kind === expected.kind && pending.requestId === expected.requestId && JSON.stringify(pending.permissions) === JSON.stringify(expected.permissions) && JSON.stringify(pending.ownerDids) === JSON.stringify(expected.ownerDids);
 }
 
 // src/http.ts
@@ -1330,7 +1614,8 @@ function createHostedMcpApp(config) {
       explicitProfile: true,
       allowOwnerProfile: false,
       stateRoot,
-      transformOperationResult: (result) => store.decorateAuthorityResult(subject, ownerDids, result)
+      beforeOperation: () => store.validateTenant(subject, ownerDids),
+      transformOperationResult: (result, invocation) => store.decorateAuthorityResult(subject, ownerDids, result, invocation)
     }, validator);
     registerConnectTool(server, validator, store, identity);
     return server;