@tinycloud/mcp 0.7.4-beta.0 → 0.8.0-beta.2

package/dist/server.js

@@ -6,7 +6,7 @@ import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { createRequire } from "module";
 import { join } from "path";
 import { fromJsonSchema } from "@modelcontextprotocol/server";
-import { addFormats, Ajv, AjvJsonSchemaValidator } from "@modelcontextprotocol/server/validators/ajv";
+import { AjvJsonSchemaValidator } from "@modelcontextprotocol/server/validators/ajv";
 import { invokeOperation } from "@tinycloud/operations";
 
 // src/results.ts
@@ -20,7 +20,7 @@ function toMcpToolResult(result, bindings = [], options = {}) {
   let serialized;
   if (options.surface === "hosted") {
     serialized = JSON.stringify(canonical);
-    if (options.readOnly === true && serialized.length > 1e5) {
+    if ((options.readOnly === true || options.operationId === "tinycloud.apps.context" || options.operationId === "tinycloud.apps.query") && serialized.length > 1e5) {
       const sql = options.operationId?.startsWith("tinycloud.sql.") || options.operationId === "tinycloud.apps.query";
       canonical = {
         status: "error",
@@ -85,6 +85,44 @@ function logToolCall(tool, code, startedAt, replayedGrants) {
 `);
 }
 
+// src/schemas.ts
+var DRAFT_7 = "http://json-schema.org/draft-07/schema#";
+var DRAFT_2020_12 = "https://json-schema.org/draft/2020-12/schema";
+var schemaMaps = /* @__PURE__ */ new Set(["properties", "patternProperties", "definitions", "$defs"]);
+var schemaArrays = /* @__PURE__ */ new Set(["allOf", "anyOf", "oneOf"]);
+var schemaValues = /* @__PURE__ */ new Set([
+  "additionalProperties",
+  "items",
+  "contains",
+  "propertyNames",
+  "not",
+  "if",
+  "then",
+  "else"
+]);
+function toMcpJsonSchema(schema) {
+  if (typeof schema === "boolean") return schema;
+  if (Array.isArray(schema.items) || "additionalItems" in schema || "dependencies" in schema || "$ref" in schema && Object.keys(schema).some((key) => key !== "$ref")) {
+    throw new Error("The operations schema needs a semantic migration to JSON Schema 2020-12.");
+  }
+  const projected = {};
+  for (const [key, value] of Object.entries(schema)) {
+    if (key === "$schema") {
+      if (value !== DRAFT_7) throw new Error(`Unsupported operations schema dialect: ${String(value)}.`);
+      projected[key] = DRAFT_2020_12;
+    } else if (schemaMaps.has(key)) {
+      projected[key] = Object.fromEntries(Object.entries(value).map(([name, child]) => [name, toMcpJsonSchema(child)]));
+    } else if (schemaArrays.has(key)) {
+      projected[key] = value.map(toMcpJsonSchema);
+    } else if (schemaValues.has(key)) {
+      projected[key] = toMcpJsonSchema(value);
+    } else {
+      projected[key] = value;
+    }
+  }
+  return projected;
+}
+
 // src/tools.ts
 function invocationTargetForMcp(selection) {
   return {
@@ -102,9 +140,9 @@ var generatedCatalog = packageRequire(
 var stableErrorCodes = Object.fromEntries(
   generatedCatalog.stableErrors.map((code) => [code, true])
 );
-var ALL_SURFACES = ["local", "hosted"];
+var PRIVATE_SURFACES = ["local", "hosted"];
 function bindingSurfaces(binding) {
-  return binding.surfaces ?? ALL_SURFACES;
+  return binding.surfaces ?? PRIVATE_SURFACES;
 }
 var TOOL_BINDINGS = [
   {
@@ -288,11 +326,11 @@ var TOOL_BINDINGS = [
     name: "tinycloud_apps_context",
     operationId: "tinycloud.apps.context",
     operationVersion: 1,
-    readOnlyHint: true,
+    readOnlyHint: false,
     idempotentHint: true,
-    destructiveHint: false,
-    openWorldHint: true,
-    surfaces: ["hosted"]
+    destructiveHint: true,
+    openWorldHint: false,
+    surfaces: ["hosted", "public"]
   },
   {
     name: "tinycloud_apps_read",
@@ -301,8 +339,8 @@ var TOOL_BINDINGS = [
     readOnlyHint: true,
     idempotentHint: true,
     destructiveHint: false,
-    openWorldHint: true,
-    surfaces: ["hosted"]
+    openWorldHint: false,
+    surfaces: ["hosted", "public"]
   },
   {
     name: "tinycloud_apps_write",
@@ -311,34 +349,34 @@ var TOOL_BINDINGS = [
     readOnlyHint: false,
     idempotentHint: false,
     destructiveHint: true,
-    openWorldHint: true,
-    surfaces: ["hosted"]
+    openWorldHint: false,
+    surfaces: ["hosted", "public"]
   },
   {
     name: "tinycloud_apps_query",
     operationId: "tinycloud.apps.query",
     operationVersion: 1,
-    readOnlyHint: true,
+    readOnlyHint: false,
     idempotentHint: true,
-    destructiveHint: false,
-    openWorldHint: true,
-    surfaces: ["hosted"]
+    destructiveHint: true,
+    openWorldHint: false,
+    surfaces: ["hosted", "public"]
   }
 ];
+var definitions = new Map(generatedCatalog.operations.map((operation) => [
+  `${operation.id}@${operation.version}`,
+  {
+    ...operation,
+    input: toMcpJsonSchema(operation.input),
+    result: toMcpJsonSchema(operation.result)
+  }
+]));
 function createJsonSchemaValidator() {
-  const ajv = new Ajv({ strict: false });
-  addFormats(ajv);
-  return new AjvJsonSchemaValidator(ajv);
+  return new AjvJsonSchemaValidator();
 }
 function registerTinyCloudTools(server, selection, validator) {
-  const definitions = new Map(
-    generatedCatalog.operations.map((operation) => [
-      `${operation.id}@${operation.version}`,
-      operation
-    ])
-  );
-  for (const binding of TOOL_BINDINGS) {
-    if (!bindingSurfaces(binding).includes(selection.surface)) continue;
+  const bindings = TOOL_BINDINGS.filter((binding) => bindingSurfaces(binding).includes(selection.surface));
+  for (const binding of bindings) {
     const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);
     if (operation === void 0) {
       throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);
@@ -384,15 +422,15 @@ function registerTinyCloudTools(server, selection, validator) {
             operationVersion: binding.operationVersion,
             input
           });
-          const response = toMcpToolResult(projected, TOOL_BINDINGS, {
-            surface: selection.surface,
+          const response = toMcpToolResult(projected, bindings, {
+            surface: selection.surface === "local" ? "local" : "hosted",
             readOnly: binding.readOnlyHint,
             operationId: binding.operationId
           });
           code = outcomeCode(response.structuredContent);
           return response;
         } finally {
-          if (selection.surface === "hosted") {
+          if (selection.surface !== "local") {
             logToolCall(binding.name, code, startedAt, metrics.replayedGrants);
           }
         }
@@ -415,7 +453,7 @@ function outcomeCode(result) {
 // package.json
 var package_default = {
   name: "@tinycloud/mcp",
-  version: "0.7.4-beta.0",
+  version: "0.8.0-beta.2",
   description: "TinyCloud delegated operations MCP server",
   keywords: [
     "tinycloud",
@@ -486,9 +524,9 @@ var package_default = {
   dependencies: {
     "@modelcontextprotocol/node": "2.0.0-beta.5",
     "@modelcontextprotocol/server": "2.0.0-beta.5",
-    "@tinycloud/node-sdk": "3.6.0-beta.0",
+    "@tinycloud/node-sdk": "3.6.0-beta.2",
     "@tinycloud/node-sdk-wasm": "1.7.8",
-    "@tinycloud/operations": "0.7.4-beta.0",
+    "@tinycloud/operations": "0.7.4-beta.2",
     jose: "6.2.4"
   },
   devDependencies: {

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts","../src/tools.ts","../src/results.ts","../src/logging.ts","../package.json","../src/version.ts"],"sourcesContent":["import { McpServer } from \"@modelcontextprotocol/server\";\nimport { serveStdio, type StdioServerHandle } from \"@modelcontextprotocol/server/stdio\";\n\nimport { createJsonSchemaValidator, registerTinyCloudTools, type McpStartupSelection } from \"./tools.js\";\nimport { MCP_VERSION } from \"./version.js\";\n\nexport const MCP_SERVER_NAME = \"tinycloud-mcp\";\nexport { MCP_VERSION } from \"./version.js\";\n/** The stdio server is always the local surface. */\nexport type LocalMcpSelection = Omit<McpStartupSelection, \"surface\">;\n\nexport function createTinyCloudMcpServer(selection: LocalMcpSelection): McpServer {\n  const validator = createJsonSchemaValidator();\n  const server = new McpServer(\n    { name: MCP_SERVER_NAME, version: MCP_VERSION },\n    { jsonSchemaValidator: validator },\n  );\n  registerTinyCloudTools(server, { ...selection, surface: \"local\" }, validator);\n  return server;\n}\n\n/** Start the only supported MCP transport: local stdio. */\nexport function serveTinyCloudMcp(selection: LocalMcpSelection): StdioServerHandle {\n  return serveStdio(\n    () => createTinyCloudMcpServer(selection),\n    { onerror: () => writeBoundedDiagnostic(\"MCP transport error\") },\n  );\n}\n\nfunction writeBoundedDiagnostic(message: string): void {\n  process.stderr.write(`[tinycloud-mcp] ${message}\\n`);\n}\n","import { createRequire } from \"node:module\";\nimport { join } from \"node:path\";\n\nimport { fromJsonSchema, type McpServer, type ToolAnnotations } from \"@modelcontextprotocol/server\";\nimport { addFormats, Ajv, AjvJsonSchemaValidator } from \"@modelcontextprotocol/server/validators/ajv\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nimport { toMcpToolResult, type McpToolResult } from \"./results.js\";\nimport { logToolCall } from \"./logging.js\";\n\nexport const TOOL_NAMES = [\n  \"tinycloud_status\",\n  \"tinycloud_auth_status\",\n  \"tinycloud_auth_capabilities\",\n  \"tinycloud_auth_request\",\n  \"tinycloud_auth_import\",\n  \"tinycloud_account_spaces_list\",\n  \"tinycloud_account_applications_list\",\n  \"tinycloud_kv_list\",\n  \"tinycloud_kv_get\",\n  \"tinycloud_kv_head\",\n  \"tinycloud_kv_put\",\n  \"tinycloud_kv_delete\",\n  \"tinycloud_knowledge_list\",\n  \"tinycloud_knowledge_read\",\n  \"tinycloud_sql_schema_inspect\",\n  \"tinycloud_sql_query\",\n  \"tinycloud_sql_execute\",\n  \"tinycloud_secrets_get\",\n  \"tinycloud_secrets_status\",\n  \"tinycloud_apps_context\",\n  \"tinycloud_apps_read\",\n  \"tinycloud_apps_write\",\n  \"tinycloud_apps_query\",\n] as const;\n\nexport type ToolName = (typeof TOOL_NAMES)[number];\n\n/** MCP server surfaces: local stdio and the hosted OAuth HTTP server. */\nexport type McpSurface = \"local\" | \"hosted\";\n\nexport interface McpStartupSelection {\n  /** Which server registers the tools; bindings not on this surface are skipped. */\n  readonly surface: McpSurface;\n  readonly profile: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n  /** Absolute TinyCloud home used to isolate one hosted OAuth principal. */\n  readonly stateRoot?: string;\n  /** Check node authority only when an operation needs the account. */\n  readonly beforeOperation?: () => Promise<void>;\n  /** Hosted transports may attach a browser approval URL to canonical results. */\n  readonly transformOperationResult?: (result: unknown, invocation: McpOperationInvocation) => Promise<unknown>;\n}\n\nexport interface McpOperationInvocation {\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly input: unknown;\n}\n\nexport interface McpInvocationTarget {\n  readonly profile: string;\n  readonly allowOwnerProfile?: true;\n  readonly stateRoot?: string;\n}\n\n/** Project one startup selection into the only owner-sensitive target shape. */\nexport function invocationTargetForMcp(\n  selection: Omit<McpStartupSelection, \"surface\">,\n): McpInvocationTarget {\n  return {\n    profile: selection.profile,\n    ...(selection.explicitProfile && selection.allowOwnerProfile\n      ? { allowOwnerProfile: true }\n      : {}),\n    ...(selection.stateRoot === undefined ? {} : { stateRoot: selection.stateRoot }),\n  };\n}\n\ninterface CatalogOperation {\n  readonly id: string;\n  readonly version: number;\n  readonly title: string;\n  readonly description: string;\n  readonly input: Record<string, unknown>;\n  readonly result: Record<string, unknown>;\n}\n\ninterface OperationsCatalog {\n  readonly stableErrors: readonly string[];\n  readonly operations: readonly CatalogOperation[];\n}\n\n// The require anchor is this module, never the consumer entrypoint. In ESM\n// tsup preserves import.meta.url; in CJS it rewrites the same module-relative\n// anchor to the generated __filename, so both formats stay in MCP's package\n// dependency boundary.\nconst packageRequire = createRequire(\n  typeof __dirname === \"string\" ? join(__dirname, \"tools.cjs\") : import.meta.url,\n);\nconst generatedCatalog = packageRequire(\n  \"@tinycloud/operations/operations.json\",\n) as OperationsCatalog;\nconst stableErrorCodes: Readonly<Record<string, true>> = Object.fromEntries(\n  generatedCatalog.stableErrors.map((code) => [code, true as const]),\n);\n\nexport interface ToolBinding {\n  readonly name: ToolName;\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly readOnlyHint: boolean;\n  readonly idempotentHint: boolean;\n  readonly destructiveHint: boolean;\n  readonly openWorldHint: boolean;\n  /** Surfaces that register this tool; omitted means every surface. */\n  readonly surfaces?: readonly McpSurface[];\n}\n\nconst ALL_SURFACES: readonly McpSurface[] = [\"local\", \"hosted\"];\n\n/** The surfaces a binding is registered on. */\nexport function bindingSurfaces(binding: ToolBinding): readonly McpSurface[] {\n  return binding.surfaces ?? ALL_SURFACES;\n}\n\nexport const TOOL_BINDINGS: readonly ToolBinding[] = [\n  {\n    name: \"tinycloud_status\",\n    operationId: \"tinycloud.status.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_status\",\n    operationId: \"tinycloud.auth.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_capabilities\",\n    operationId: \"tinycloud.auth.capabilities\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_request\",\n    operationId: \"tinycloud.auth.request\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_import\",\n    operationId: \"tinycloud.auth.import\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n    // Hosted delegations must arrive through the owner/request-bound OpenKey callback,\n    // not a caller-supplied import artifact.\n    surfaces: [\"local\"],\n  },\n  {\n    name: \"tinycloud_account_spaces_list\",\n    operationId: \"tinycloud.account.spaces.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_account_applications_list\",\n    operationId: \"tinycloud.account.applications.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_list\",\n    operationId: \"tinycloud.kv.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_get\",\n    operationId: \"tinycloud.kv.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_head\",\n    operationId: \"tinycloud.kv.head\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_put\",\n    operationId: \"tinycloud.kv.put\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_delete\",\n    operationId: \"tinycloud.kv.delete\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_knowledge_list\",\n    operationId: \"tinycloud.knowledge.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_knowledge_read\",\n    operationId: \"tinycloud.knowledge.read\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_schema_inspect\",\n    operationId: \"tinycloud.sql.schema.inspect\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_query\",\n    operationId: \"tinycloud.sql.query\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_execute\",\n    operationId: \"tinycloud.sql.execute\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_get\",\n    operationId: \"tinycloud.secrets.get\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_status\",\n    operationId: \"tinycloud.secrets.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n    // Hosted has no persistent reauthorization path for a revoked session\n    // yet (TC-896), so status is local/stdio only.\n    surfaces: [\"local\"],\n  },\n  {\n    name: \"tinycloud_apps_context\",\n    operationId: \"tinycloud.apps.context\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n    surfaces: [\"hosted\"],\n  },\n  {\n    name: \"tinycloud_apps_read\",\n    operationId: \"tinycloud.apps.read\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n    surfaces: [\"hosted\"],\n  },\n  {\n    name: \"tinycloud_apps_write\",\n    operationId: \"tinycloud.apps.write\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: true,\n    surfaces: [\"hosted\"],\n  },\n  {\n    name: \"tinycloud_apps_query\",\n    operationId: \"tinycloud.apps.query\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n    surfaces: [\"hosted\"],\n  },\n] as const;\n\nexport function createJsonSchemaValidator(): AjvJsonSchemaValidator {\n  const ajv = new Ajv({ strict: false });\n  addFormats(ajv);\n  return new AjvJsonSchemaValidator(ajv);\n}\n\nexport function registerTinyCloudTools(\n  server: McpServer,\n  selection: McpStartupSelection,\n  validator: AjvJsonSchemaValidator,\n): void {\n  const definitions = new Map(\n    generatedCatalog.operations.map((operation) => [\n      `${operation.id}@${operation.version}`,\n      operation,\n    ]),\n  );\n\n  for (const binding of TOOL_BINDINGS) {\n    if (!bindingSurfaces(binding).includes(selection.surface)) continue;\n    const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);\n    if (operation === undefined) {\n      throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);\n    }\n\n    const inputSchema = fromJsonSchema(\n      operation.input as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const outputSchema = fromJsonSchema(\n      operation.result as unknown as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const annotations: ToolAnnotations = {\n      readOnlyHint: binding.readOnlyHint,\n      idempotentHint: binding.idempotentHint,\n      destructiveHint: binding.destructiveHint,\n      openWorldHint: binding.openWorldHint,\n    };\n\n    server.registerTool(\n      binding.name,\n      {\n        title: operation.title,\n        description: operation.description,\n        inputSchema,\n        outputSchema,\n        annotations,\n      },\n      async (input: unknown): Promise<McpToolResult> => {\n        const startedAt = performance.now();\n        const metrics = { replayedGrants: 0 };\n        let code = \"INTERNAL_ERROR\";\n        try {\n          await selection.beforeOperation?.();\n          const result = await invokeOperation(\n            binding.operationId,\n            binding.operationVersion,\n            invocationTargetForMcp(selection),\n            input,\n            metrics,\n          );\n          const projected = selection.transformOperationResult === undefined\n            ? result\n            : await selection.transformOperationResult(result, {\n              operationId: binding.operationId,\n              operationVersion: binding.operationVersion,\n              input,\n            });\n          const response = toMcpToolResult(projected, TOOL_BINDINGS, {\n            surface: selection.surface,\n            readOnly: binding.readOnlyHint,\n            operationId: binding.operationId,\n          });\n          code = outcomeCode(response.structuredContent);\n          return response;\n        } finally {\n          if (selection.surface === \"hosted\") {\n            logToolCall(binding.name, code, startedAt, metrics.replayedGrants);\n          }\n        }\n      },\n    );\n  }\n}\n\nfunction outcomeCode(result: McpToolResult[\"structuredContent\"]): string {\n  if (result.status === \"error\") {\n    const error = result.error as { code?: unknown } | undefined;\n    return typeof error?.code === \"string\" && Object.hasOwn(stableErrorCodes, error.code) ? error.code : \"INTERNAL_ERROR\";\n  }\n  if (result.status !== \"ok\") return result.status;\n  const output = result.output as { outcome?: unknown; ops?: readonly { outcome?: unknown }[] } | undefined;\n  if (output?.outcome === \"COPY_PARTIAL\") return \"COPY_PARTIAL\";\n  if (Array.isArray(output?.ops) && output.ops.some((op) => op.outcome !== \"ok\")) return \"PARTIAL\";\n  return \"ok\";\n}\n\nexport function toolBindingsForTest(): readonly ToolBinding[] {\n  return TOOL_BINDINGS;\n}\n","/** MCP preserves the canonical envelope; hosted clients also receive readable JSON. */\nexport interface CanonicalOperationResult {\n  readonly status: \"ok\" | \"authority_required\" | \"setup_required\" | \"error\";\n  readonly [key: string]: unknown;\n}\n\nexport interface McpToolResult extends CallToolResult {\n  readonly content: [{ readonly type: \"text\"; readonly text: string }];\n  readonly structuredContent: CanonicalOperationResult;\n}\n\n/** The binding fields needed to name the tool that runs an operation. */\nexport interface RecoveryToolBinding {\n  readonly name: string;\n  readonly operationId: string;\n}\n\nexport interface McpToolResultOptions {\n  readonly surface?: \"hosted\" | \"local\";\n  readonly readOnly?: boolean;\n  /** Trusted operation identity from the tool binding, not operation output. */\n  readonly operationId?: string;\n}\n\nexport function toMcpToolResult(\n  result: unknown,\n  bindings: readonly RecoveryToolBinding[] = [],\n  options: McpToolResultOptions = {},\n): McpToolResult {\n  let canonical: CanonicalOperationResult = isCanonicalOperationResult(result)\n    ? withRecoveryTool(result, bindings)\n    : {\n      status: \"error\",\n      operation: {},\n      context: {},\n      error: { code: \"INTERNAL_ERROR\" },\n    };\n  let serialized: string | undefined;\n  if (options.surface === \"hosted\") {\n    serialized = JSON.stringify(canonical);\n    if (options.readOnly === true && serialized.length > 100_000) {\n      const sql = options.operationId?.startsWith(\"tinycloud.sql.\") ||\n        options.operationId === \"tinycloud.apps.query\";\n      canonical = {\n        status: \"error\",\n        operation: canonical.operation,\n        context: canonical.context,\n        error: {\n          code: sql ? \"SQL_RESULT_LIMIT_EXCEEDED\" : \"KV_RESPONSE_TOO_LARGE\",\n          message: sql\n            ? \"The result exceeds 100,000 characters. Select fewer columns or rows, add a WHERE filter or a smaller LIMIT, or aggregate the data.\"\n            : \"The result exceeds 100,000 characters. Request fewer keys, narrow the prefix, or use a smaller page size.\",\n          retryable: false,\n        },\n      };\n      serialized = JSON.stringify(canonical);\n    }\n  }\n\n  return {\n    content: [{\n      type: \"text\",\n      text: resultSummary(canonical.status) +\n        (serialized !== undefined && !(options.operationId === \"tinycloud.secrets.get\" && canonical.status === \"ok\")\n          ? `\\n${serialized}` : \"\"),\n    }],\n    structuredContent: canonical,\n  };\n}\n\n/**\n * A redacted `complete_migration` recovery names an operation; MCP clients\n * call tools, so name the bound tool. `tool` comes from the code-owned binding\n * table only, never from operation data, and is added after redaction. An\n * operationId with no binding gets no `tool`.\n */\nfunction withRecoveryTool(\n  result: CanonicalOperationResult,\n  bindings: readonly RecoveryToolBinding[],\n): CanonicalOperationResult {\n  if (result.status !== \"error\") return result;\n  // The kernel's redaction already constrained `error.details.recovery` to a\n  // safe recovery object; only its discriminant and operationId are read here.\n  const error = result.error as\n    | { readonly details?: { readonly recovery?: { readonly action?: unknown; readonly operationId?: unknown } } }\n    | undefined;\n  const recovery = error?.details?.recovery;\n  if (recovery?.action !== \"complete_migration\") return result;\n  const binding = bindings.find((candidate) => candidate.operationId === recovery.operationId);\n  if (binding === undefined) return result;\n  return {\n    ...result,\n    error: { ...error, details: { ...error?.details, recovery: { ...recovery, tool: binding.name } } },\n  };\n}\n\n/** The canonical envelope immediately before MCP protocol serialization. */\nexport function canonicalMcpAdapterResult(result: unknown): CanonicalOperationResult {\n  return toMcpToolResult(result).structuredContent;\n}\n\nfunction isCanonicalOperationResult(value: unknown): value is CanonicalOperationResult {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const status = (value as { status?: unknown }).status;\n  return status === \"ok\" ||\n    status === \"authority_required\" ||\n    status === \"setup_required\" ||\n    status === \"error\";\n}\n\nfunction resultSummary(status: CanonicalOperationResult[\"status\"]): string {\n  switch (status) {\n    case \"ok\":\n      return \"TinyCloud operation completed; use the structured result.\";\n    case \"authority_required\":\n      return \"TinyCloud authority is required; use the structured request and approval action.\";\n    case \"setup_required\":\n      return \"TinyCloud setup is required; use the structured setup action.\";\n    case \"error\":\n      return \"TinyCloud operation failed; use the structured error.\";\n  }\n}\nimport type { CallToolResult } from \"@modelcontextprotocol/server\";\n","/** Only code-owned tool names/codes and numeric counters reach this sink. */\nexport function logToolCall(\n  tool: string,\n  code: string,\n  startedAt: number,\n  replayedGrants: number,\n): void {\n  process.stderr.write(`${JSON.stringify({\n    tool,\n    code,\n    durationMs: Math.max(0, Math.round(performance.now() - startedAt)),\n    replayedGrants,\n  })}\\n`);\n}\n","{\n  \"name\": \"@tinycloud/mcp\",\n  \"version\": \"0.7.4-beta.0\",\n  \"description\": \"TinyCloud delegated operations MCP server\",\n  \"keywords\": [\n    \"tinycloud\",\n    \"mcp\",\n    \"model-context-protocol\",\n    \"agents\",\n    \"delegation\",\n    \"ucan\",\n    \"kv\",\n    \"sqlite\"\n  ],\n  \"author\": \"TinyCloud, Inc.\",\n  \"license\": \"EGPL\",\n  \"type\": \"module\",\n  \"main\": \"dist/index.cjs\",\n  \"module\": \"dist/index.js\",\n  \"types\": \"dist/index.d.ts\",\n  \"bin\": {\n    \"tinycloud-mcp\": \"./bin/tinycloud-mcp\",\n    \"tinycloud-mcp-http\": \"./bin/tinycloud-mcp-http\"\n  },\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    },\n    \"./server\": {\n      \"types\": \"./dist/server.d.ts\",\n      \"import\": \"./dist/server.js\",\n      \"require\": \"./dist/server.cjs\"\n    },\n    \"./tools\": {\n      \"types\": \"./dist/tools.d.ts\",\n      \"import\": \"./dist/tools.js\",\n      \"require\": \"./dist/tools.cjs\"\n    },\n    \"./results\": {\n      \"types\": \"./dist/results.d.ts\",\n      \"import\": \"./dist/results.js\",\n      \"require\": \"./dist/results.cjs\"\n    },\n    \"./http\": {\n      \"types\": \"./dist/http.d.ts\",\n      \"import\": \"./dist/http.js\",\n      \"require\": \"./dist/http.cjs\"\n    }\n  },\n  \"files\": [\n    \"dist\",\n    \"bin\",\n    \"generated\",\n    \"skills\"\n  ],\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"clean\": \"rm -rf dist\",\n    \"test\": \"bun run build && bun scripts/test.ts && bun run check:generated\",\n    \"test:stdio\": \"bun run build && bun test src/stdio.test.ts\",\n    \"typecheck\": \"tsc -p tsconfig.json\",\n    \"start:http\": \"node dist/http-cli.js\",\n    \"generate\": \"bun scripts/generate.ts\",\n    \"check:generated\": \"bun scripts/generate.ts --check\"\n  },\n  \"dependencies\": {\n    \"@modelcontextprotocol/node\": \"2.0.0-beta.5\",\n    \"@modelcontextprotocol/server\": \"2.0.0-beta.5\",\n    \"@tinycloud/node-sdk\": \"3.6.0-beta.0\",\n    \"@tinycloud/node-sdk-wasm\": \"1.7.8\",\n    \"@tinycloud/operations\": \"0.7.4-beta.0\",\n    \"jose\": \"6.2.4\"\n  },\n  \"devDependencies\": {\n    \"@modelcontextprotocol/client\": \"2.0.0-beta.5\",\n    \"@types/node\": \"^20\",\n    \"tsup\": \"^8.0.0\",\n    \"typescript\": \"^5.9.3\"\n  },\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/TinyCloudLabs/js-sdk\"\n  },\n  \"homepage\": \"https://docs.tinycloud.xyz/cli/mcp\"\n}\n","import packageMetadata from \"../package.json\";\n\nexport const MCP_VERSION = packageMetadata.version;\n"],"mappings":";AAAA,SAAS,iBAAiB;AAC1B,SAAS,kBAA0C;;;ACDnD,SAAS,qBAAqB;AAC9B,SAAS,YAAY;AAErB,SAAS,sBAA4D;AACrE,SAAS,YAAY,KAAK,8BAA8B;AACxD,SAAS,uBAAuB;;;ACmBzB,SAAS,gBACd,QACA,WAA2C,CAAC,GAC5C,UAAgC,CAAC,GAClB;AACf,MAAI,YAAsC,2BAA2B,MAAM,IACvE,iBAAiB,QAAQ,QAAQ,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,WAAW,CAAC;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC;AACF,MAAI;AACJ,MAAI,QAAQ,YAAY,UAAU;AAChC,iBAAa,KAAK,UAAU,SAAS;AACrC,QAAI,QAAQ,aAAa,QAAQ,WAAW,SAAS,KAAS;AAC5D,YAAM,MAAM,QAAQ,aAAa,WAAW,gBAAgB,KAC1D,QAAQ,gBAAgB;AAC1B,kBAAY;AAAA,QACV,QAAQ;AAAA,QACR,WAAW,UAAU;AAAA,QACrB,SAAS,UAAU;AAAA,QACnB,OAAO;AAAA,UACL,MAAM,MAAM,8BAA8B;AAAA,UAC1C,SAAS,MACL,uIACA;AAAA,UACJ,WAAW;AAAA,QACb;AAAA,MACF;AACA,mBAAa,KAAK,UAAU,SAAS;AAAA,IACvC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,CAAC;AAAA,MACR,MAAM;AAAA,MACN,MAAM,cAAc,UAAU,MAAM,KACjC,eAAe,UAAa,EAAE,QAAQ,gBAAgB,2BAA2B,UAAU,WAAW,QACnG;AAAA,EAAK,UAAU,KAAK;AAAA,IAC5B,CAAC;AAAA,IACD,mBAAmB;AAAA,EACrB;AACF;AAQA,SAAS,iBACP,QACA,UAC0B;AAC1B,MAAI,OAAO,WAAW,QAAS,QAAO;AAGtC,QAAM,QAAQ,OAAO;AAGrB,QAAM,WAAW,OAAO,SAAS;AACjC,MAAI,UAAU,WAAW,qBAAsB,QAAO;AACtD,QAAM,UAAU,SAAS,KAAK,CAAC,cAAc,UAAU,gBAAgB,SAAS,WAAW;AAC3F,MAAI,YAAY,OAAW,QAAO;AAClC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,EAAE,GAAG,OAAO,SAAS,EAAE,GAAG,OAAO,SAAS,UAAU,EAAE,GAAG,UAAU,MAAM,QAAQ,KAAK,EAAE,EAAE;AAAA,EACnG;AACF;AAOA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAU,MAA+B;AAC/C,SAAO,WAAW,QAChB,WAAW,wBACX,WAAW,oBACX,WAAW;AACf;AAEA,SAAS,cAAc,QAAoD;AACzE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;;;ACxHO,SAAS,YACd,MACA,MACA,WACA,gBACM;AACN,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU;AAAA,IACrC;AAAA,IACA;AAAA,IACA,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS,CAAC;AAAA,IACjE;AAAA,EACF,CAAC,CAAC;AAAA,CAAI;AACR;;;AFuDO,SAAS,uBACd,WACqB;AACrB,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,GAAI,UAAU,mBAAmB,UAAU,oBACvC,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,IACL,GAAI,UAAU,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,UAAU,UAAU;AAAA,EAChF;AACF;AAoBA,IAAM,iBAAiB;AAAA,EACrB,OAAO,cAAc,WAAW,KAAK,WAAW,WAAW,IAAI,YAAY;AAC7E;AACA,IAAM,mBAAmB;AAAA,EACvB;AACF;AACA,IAAM,mBAAmD,OAAO;AAAA,EAC9D,iBAAiB,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,IAAa,CAAC;AACnE;AAcA,IAAM,eAAsC,CAAC,SAAS,QAAQ;AAGvD,SAAS,gBAAgB,SAA6C;AAC3E,SAAO,QAAQ,YAAY;AAC7B;AAEO,IAAM,gBAAwC;AAAA,EACnD;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA;AAAA;AAAA,IAGf,UAAU,CAAC,OAAO;AAAA,EACpB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA;AAAA;AAAA,IAGf,UAAU,CAAC,OAAO;AAAA,EACpB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,QAAQ;AAAA,EACrB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,QAAQ;AAAA,EACrB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,QAAQ;AAAA,EACrB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,QAAQ;AAAA,EACrB;AACF;AAEO,SAAS,4BAAoD;AAClE,QAAM,MAAM,IAAI,IAAI,EAAE,QAAQ,MAAM,CAAC;AACrC,aAAW,GAAG;AACd,SAAO,IAAI,uBAAuB,GAAG;AACvC;AAEO,SAAS,uBACd,QACA,WACA,WACM;AACN,QAAM,cAAc,IAAI;AAAA,IACtB,iBAAiB,WAAW,IAAI,CAAC,cAAc;AAAA,MAC7C,GAAG,UAAU,EAAE,IAAI,UAAU,OAAO;AAAA,MACpC;AAAA,IACF,CAAC;AAAA,EACH;AAEA,aAAW,WAAW,eAAe;AACnC,QAAI,CAAC,gBAAgB,OAAO,EAAE,SAAS,UAAU,OAAO,EAAG;AAC3D,UAAM,YAAY,YAAY,IAAI,GAAG,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,EAAE;AACtF,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI,MAAM,2CAA2C,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,GAAG;AAAA,IAC/G;AAEA,UAAM,cAAc;AAAA,MAClB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,eAAe;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,cAA+B;AAAA,MACnC,cAAc,QAAQ;AAAA,MACtB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB,eAAe,QAAQ;AAAA,IACzB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,QACE,OAAO,UAAU;AAAA,QACjB,aAAa,UAAU;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,OAAO,UAA2C;AAChD,cAAM,YAAY,YAAY,IAAI;AAClC,cAAM,UAAU,EAAE,gBAAgB,EAAE;AACpC,YAAI,OAAO;AACX,YAAI;AACF,gBAAM,UAAU,kBAAkB;AAClC,gBAAM,SAAS,MAAM;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,uBAAuB,SAAS;AAAA,YAChC;AAAA,YACA;AAAA,UACF;AACA,gBAAM,YAAY,UAAU,6BAA6B,SACrD,SACA,MAAM,UAAU,yBAAyB,QAAQ;AAAA,YACjD,aAAa,QAAQ;AAAA,YACrB,kBAAkB,QAAQ;AAAA,YAC1B;AAAA,UACF,CAAC;AACH,gBAAM,WAAW,gBAAgB,WAAW,eAAe;AAAA,YACzD,SAAS,UAAU;AAAA,YACnB,UAAU,QAAQ;AAAA,YAClB,aAAa,QAAQ;AAAA,UACvB,CAAC;AACD,iBAAO,YAAY,SAAS,iBAAiB;AAC7C,iBAAO;AAAA,QACT,UAAE;AACA,cAAI,UAAU,YAAY,UAAU;AAClC,wBAAY,QAAQ,MAAM,MAAM,WAAW,QAAQ,cAAc;AAAA,UACnE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,YAAY,QAAoD;AACvE,MAAI,OAAO,WAAW,SAAS;AAC7B,UAAM,QAAQ,OAAO;AACrB,WAAO,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,kBAAkB,MAAM,IAAI,IAAI,MAAM,OAAO;AAAA,EACvG;AACA,MAAI,OAAO,WAAW,KAAM,QAAO,OAAO;AAC1C,QAAM,SAAS,OAAO;AACtB,MAAI,QAAQ,YAAY,eAAgB,QAAO;AAC/C,MAAI,MAAM,QAAQ,QAAQ,GAAG,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,GAAG,YAAY,IAAI,EAAG,QAAO;AACvF,SAAO;AACT;;;AG3bA;AAAA,EACE,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,aAAe;AAAA,EACf,UAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAU;AAAA,EACV,SAAW;AAAA,EACX,MAAQ;AAAA,EACR,MAAQ;AAAA,EACR,QAAU;AAAA,EACV,OAAS;AAAA,EACT,KAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,sBAAsB;AAAA,EACxB;AAAA,EACA,SAAW;AAAA,IACT,KAAK;AAAA,MACH,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,YAAY;AAAA,MACV,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACT,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,aAAa;AAAA,MACX,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,MACR,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,OAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,SAAW;AAAA,IACT,MAAQ;AAAA,EACV;AAAA,EACA,SAAW;AAAA,IACT,OAAS;AAAA,IACT,OAAS;AAAA,IACT,MAAQ;AAAA,IACR,cAAc;AAAA,IACd,WAAa;AAAA,IACb,cAAc;AAAA,IACd,UAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAAA,EACA,cAAgB;AAAA,IACd,8BAA8B;AAAA,IAC9B,gCAAgC;AAAA,IAChC,uBAAuB;AAAA,IACvB,4BAA4B;AAAA,IAC5B,yBAAyB;AAAA,IACzB,MAAQ;AAAA,EACV;AAAA,EACA,iBAAmB;AAAA,IACjB,gCAAgC;AAAA,IAChC,eAAe;AAAA,IACf,MAAQ;AAAA,IACR,YAAc;AAAA,EAChB;AAAA,EACA,YAAc;AAAA,IACZ,MAAQ;AAAA,IACR,KAAO;AAAA,EACT;AAAA,EACA,UAAY;AACd;;;ACvFO,IAAM,cAAc,gBAAgB;;;ALIpC,IAAM,kBAAkB;AAKxB,SAAS,yBAAyB,WAAyC;AAChF,QAAM,YAAY,0BAA0B;AAC5C,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,iBAAiB,SAAS,YAAY;AAAA,IAC9C,EAAE,qBAAqB,UAAU;AAAA,EACnC;AACA,yBAAuB,QAAQ,EAAE,GAAG,WAAW,SAAS,QAAQ,GAAG,SAAS;AAC5E,SAAO;AACT;AAGO,SAAS,kBAAkB,WAAiD;AACjF,SAAO;AAAA,IACL,MAAM,yBAAyB,SAAS;AAAA,IACxC,EAAE,SAAS,MAAM,uBAAuB,qBAAqB,EAAE;AAAA,EACjE;AACF;AAEA,SAAS,uBAAuB,SAAuB;AACrD,UAAQ,OAAO,MAAM,mBAAmB,OAAO;AAAA,CAAI;AACrD;","names":[]}
+{"version":3,"sources":["../src/server.ts","../src/tools.ts","../src/results.ts","../src/logging.ts","../src/schemas.ts","../package.json","../src/version.ts"],"sourcesContent":["import { McpServer } from \"@modelcontextprotocol/server\";\nimport { serveStdio, type StdioServerHandle } from \"@modelcontextprotocol/server/stdio\";\n\nimport { createJsonSchemaValidator, registerTinyCloudTools, type McpStartupSelection } from \"./tools.js\";\nimport { MCP_VERSION } from \"./version.js\";\n\nexport const MCP_SERVER_NAME = \"tinycloud-mcp\";\nexport { MCP_VERSION } from \"./version.js\";\n/** The stdio server is always the local surface. */\nexport type LocalMcpSelection = Omit<McpStartupSelection, \"surface\">;\n\nexport function createTinyCloudMcpServer(selection: LocalMcpSelection): McpServer {\n  const validator = createJsonSchemaValidator();\n  const server = new McpServer(\n    { name: MCP_SERVER_NAME, version: MCP_VERSION },\n    { jsonSchemaValidator: validator },\n  );\n  registerTinyCloudTools(server, { ...selection, surface: \"local\" }, validator);\n  return server;\n}\n\n/** Start the only supported MCP transport: local stdio. */\nexport function serveTinyCloudMcp(selection: LocalMcpSelection): StdioServerHandle {\n  return serveStdio(\n    () => createTinyCloudMcpServer(selection),\n    { onerror: () => writeBoundedDiagnostic(\"MCP transport error\") },\n  );\n}\n\nfunction writeBoundedDiagnostic(message: string): void {\n  process.stderr.write(`[tinycloud-mcp] ${message}\\n`);\n}\n","import { createRequire } from \"node:module\";\nimport { join } from \"node:path\";\n\nimport { fromJsonSchema, type McpServer, type ToolAnnotations } from \"@modelcontextprotocol/server\";\nimport { AjvJsonSchemaValidator } from \"@modelcontextprotocol/server/validators/ajv\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nimport { toMcpToolResult, type McpToolResult } from \"./results.js\";\nimport { logToolCall } from \"./logging.js\";\nimport { toMcpJsonSchema } from \"./schemas.js\";\n\nexport const TOOL_NAMES = [\n  \"tinycloud_status\",\n  \"tinycloud_auth_status\",\n  \"tinycloud_auth_capabilities\",\n  \"tinycloud_auth_request\",\n  \"tinycloud_auth_import\",\n  \"tinycloud_account_spaces_list\",\n  \"tinycloud_account_applications_list\",\n  \"tinycloud_kv_list\",\n  \"tinycloud_kv_get\",\n  \"tinycloud_kv_head\",\n  \"tinycloud_kv_put\",\n  \"tinycloud_kv_delete\",\n  \"tinycloud_knowledge_list\",\n  \"tinycloud_knowledge_read\",\n  \"tinycloud_sql_schema_inspect\",\n  \"tinycloud_sql_query\",\n  \"tinycloud_sql_execute\",\n  \"tinycloud_secrets_get\",\n  \"tinycloud_secrets_status\",\n  \"tinycloud_apps_context\",\n  \"tinycloud_apps_read\",\n  \"tinycloud_apps_write\",\n  \"tinycloud_apps_query\",\n] as const;\n\nexport type ToolName = (typeof TOOL_NAMES)[number];\n\n/** Private stdio/hosted surfaces and the restricted public plugin. */\nexport type McpSurface = \"local\" | \"hosted\" | \"public\";\n\nexport interface McpStartupSelection {\n  /** Which server registers the tools; bindings not on this surface are skipped. */\n  readonly surface: McpSurface;\n  readonly profile: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n  /** Absolute TinyCloud home used to isolate one hosted OAuth principal. */\n  readonly stateRoot?: string;\n  /** Check node authority only when an operation needs the account. */\n  readonly beforeOperation?: () => Promise<void>;\n  /** Hosted transports may attach a browser approval URL to canonical results. */\n  readonly transformOperationResult?: (result: unknown, invocation: McpOperationInvocation) => Promise<unknown>;\n}\n\nexport interface McpOperationInvocation {\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly input: unknown;\n}\n\nexport interface McpInvocationTarget {\n  readonly profile: string;\n  readonly allowOwnerProfile?: true;\n  readonly stateRoot?: string;\n}\n\n/** Project one startup selection into the only owner-sensitive target shape. */\nexport function invocationTargetForMcp(\n  selection: Omit<McpStartupSelection, \"surface\">,\n): McpInvocationTarget {\n  return {\n    profile: selection.profile,\n    ...(selection.explicitProfile && selection.allowOwnerProfile\n      ? { allowOwnerProfile: true }\n      : {}),\n    ...(selection.stateRoot === undefined ? {} : { stateRoot: selection.stateRoot }),\n  };\n}\n\ninterface CatalogOperation {\n  readonly id: string;\n  readonly version: number;\n  readonly title: string;\n  readonly description: string;\n  readonly input: Record<string, unknown>;\n  readonly result: Record<string, unknown>;\n}\n\ninterface OperationsCatalog {\n  readonly stableErrors: readonly string[];\n  readonly operations: readonly CatalogOperation[];\n}\n\n// The require anchor is this module, never the consumer entrypoint. In ESM\n// tsup preserves import.meta.url; in CJS it rewrites the same module-relative\n// anchor to the generated __filename, so both formats stay in MCP's package\n// dependency boundary.\nconst packageRequire = createRequire(\n  typeof __dirname === \"string\" ? join(__dirname, \"tools.cjs\") : import.meta.url,\n);\nconst generatedCatalog = packageRequire(\n  \"@tinycloud/operations/operations.json\",\n) as OperationsCatalog;\nconst stableErrorCodes: Readonly<Record<string, true>> = Object.fromEntries(\n  generatedCatalog.stableErrors.map((code) => [code, true as const]),\n);\n\nexport interface ToolBinding {\n  readonly name: ToolName;\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly readOnlyHint: boolean;\n  readonly idempotentHint: boolean;\n  readonly destructiveHint: boolean;\n  readonly openWorldHint: boolean;\n  /** Surfaces that register this tool; omitted means private local and hosted surfaces only. */\n  readonly surfaces?: readonly McpSurface[];\n}\n\nconst PRIVATE_SURFACES: readonly McpSurface[] = [\"local\", \"hosted\"];\n\n/** The surfaces a binding is registered on. */\nexport function bindingSurfaces(binding: ToolBinding): readonly McpSurface[] {\n  return binding.surfaces ?? PRIVATE_SURFACES;\n}\n\nexport const TOOL_BINDINGS: readonly ToolBinding[] = [\n  {\n    name: \"tinycloud_status\",\n    operationId: \"tinycloud.status.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_status\",\n    operationId: \"tinycloud.auth.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_capabilities\",\n    operationId: \"tinycloud.auth.capabilities\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_request\",\n    operationId: \"tinycloud.auth.request\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_import\",\n    operationId: \"tinycloud.auth.import\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n    // Hosted delegations must arrive through the owner/request-bound OpenKey callback,\n    // not a caller-supplied import artifact.\n    surfaces: [\"local\"],\n  },\n  {\n    name: \"tinycloud_account_spaces_list\",\n    operationId: \"tinycloud.account.spaces.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_account_applications_list\",\n    operationId: \"tinycloud.account.applications.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_list\",\n    operationId: \"tinycloud.kv.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_get\",\n    operationId: \"tinycloud.kv.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_head\",\n    operationId: \"tinycloud.kv.head\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_put\",\n    operationId: \"tinycloud.kv.put\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_delete\",\n    operationId: \"tinycloud.kv.delete\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_knowledge_list\",\n    operationId: \"tinycloud.knowledge.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_knowledge_read\",\n    operationId: \"tinycloud.knowledge.read\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_schema_inspect\",\n    operationId: \"tinycloud.sql.schema.inspect\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_query\",\n    operationId: \"tinycloud.sql.query\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_execute\",\n    operationId: \"tinycloud.sql.execute\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_get\",\n    operationId: \"tinycloud.secrets.get\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_status\",\n    operationId: \"tinycloud.secrets.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n    // Hosted has no persistent reauthorization path for a revoked session\n    // yet (TC-896), so status is local/stdio only.\n    surfaces: [\"local\"],\n  },\n  {\n    name: \"tinycloud_apps_context\",\n    operationId: \"tinycloud.apps.context\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_read\",\n    operationId: \"tinycloud.apps.read\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_write\",\n    operationId: \"tinycloud.apps.write\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_query\",\n    operationId: \"tinycloud.apps.query\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n] as const;\n\n// Project once per process; never mutate the catalog shared with non-MCP consumers.\nconst definitions = new Map(generatedCatalog.operations.map((operation) => [\n  `${operation.id}@${operation.version}`,\n  {\n    ...operation,\n    input: toMcpJsonSchema(operation.input),\n    result: toMcpJsonSchema(operation.result),\n  },\n]));\n\nexport function createJsonSchemaValidator(): AjvJsonSchemaValidator {\n  return new AjvJsonSchemaValidator();\n}\n\nexport function registerTinyCloudTools(\n  server: McpServer,\n  selection: McpStartupSelection,\n  validator: AjvJsonSchemaValidator,\n): void {\n  const bindings = TOOL_BINDINGS.filter((binding) => bindingSurfaces(binding).includes(selection.surface));\n  for (const binding of bindings) {\n    const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);\n    if (operation === undefined) {\n      throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);\n    }\n\n    const inputSchema = fromJsonSchema(\n      operation.input as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const outputSchema = fromJsonSchema(\n      operation.result as unknown as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const annotations: ToolAnnotations = {\n      readOnlyHint: binding.readOnlyHint,\n      idempotentHint: binding.idempotentHint,\n      destructiveHint: binding.destructiveHint,\n      openWorldHint: binding.openWorldHint,\n    };\n\n    server.registerTool(\n      binding.name,\n      {\n        title: operation.title,\n        description: operation.description,\n        inputSchema,\n        outputSchema,\n        annotations,\n      },\n      async (input: unknown): Promise<McpToolResult> => {\n        const startedAt = performance.now();\n        const metrics = { replayedGrants: 0 };\n        let code = \"INTERNAL_ERROR\";\n        try {\n          await selection.beforeOperation?.();\n          const result = await invokeOperation(\n            binding.operationId,\n            binding.operationVersion,\n            invocationTargetForMcp(selection),\n            input,\n            metrics,\n          );\n          const projected = selection.transformOperationResult === undefined\n            ? result\n            : await selection.transformOperationResult(result, {\n              operationId: binding.operationId,\n              operationVersion: binding.operationVersion,\n              input,\n            });\n          const response = toMcpToolResult(projected, bindings, {\n            surface: selection.surface === \"local\" ? \"local\" : \"hosted\",\n            readOnly: binding.readOnlyHint,\n            operationId: binding.operationId,\n          });\n          code = outcomeCode(response.structuredContent);\n          return response;\n        } finally {\n          if (selection.surface !== \"local\") {\n            logToolCall(binding.name, code, startedAt, metrics.replayedGrants);\n          }\n        }\n      },\n    );\n  }\n}\n\nfunction outcomeCode(result: McpToolResult[\"structuredContent\"]): string {\n  if (result.status === \"error\") {\n    const error = result.error as { code?: unknown } | undefined;\n    return typeof error?.code === \"string\" && Object.hasOwn(stableErrorCodes, error.code) ? error.code : \"INTERNAL_ERROR\";\n  }\n  if (result.status !== \"ok\") return result.status;\n  const output = result.output as { outcome?: unknown; ops?: readonly { outcome?: unknown }[] } | undefined;\n  if (output?.outcome === \"COPY_PARTIAL\") return \"COPY_PARTIAL\";\n  if (Array.isArray(output?.ops) && output.ops.some((op) => op.outcome !== \"ok\")) return \"PARTIAL\";\n  return \"ok\";\n}\n\nexport function toolBindingsForTest(): readonly ToolBinding[] {\n  return TOOL_BINDINGS;\n}\n","/** MCP preserves the canonical envelope; hosted clients also receive readable JSON. */\nexport interface CanonicalOperationResult {\n  readonly status: \"ok\" | \"authority_required\" | \"setup_required\" | \"error\";\n  readonly [key: string]: unknown;\n}\n\nexport interface McpToolResult extends CallToolResult {\n  readonly content: [{ readonly type: \"text\"; readonly text: string }];\n  readonly structuredContent: CanonicalOperationResult;\n}\n\n/** The binding fields needed to name the tool that runs an operation. */\nexport interface RecoveryToolBinding {\n  readonly name: string;\n  readonly operationId: string;\n}\n\nexport interface McpToolResultOptions {\n  readonly surface?: \"hosted\" | \"local\";\n  readonly readOnly?: boolean;\n  /** Trusted operation identity from the tool binding, not operation output. */\n  readonly operationId?: string;\n}\n\nexport function toMcpToolResult(\n  result: unknown,\n  bindings: readonly RecoveryToolBinding[] = [],\n  options: McpToolResultOptions = {},\n): McpToolResult {\n  let canonical: CanonicalOperationResult = isCanonicalOperationResult(result)\n    ? withRecoveryTool(result, bindings)\n    : {\n      status: \"error\",\n      operation: {},\n      context: {},\n      error: { code: \"INTERNAL_ERROR\" },\n    };\n  let serialized: string | undefined;\n  if (options.surface === \"hosted\") {\n    serialized = JSON.stringify(canonical);\n    if (\n      (options.readOnly === true ||\n        options.operationId === \"tinycloud.apps.context\" ||\n        options.operationId === \"tinycloud.apps.query\") &&\n      serialized.length > 100_000\n    ) {\n      const sql = options.operationId?.startsWith(\"tinycloud.sql.\") ||\n        options.operationId === \"tinycloud.apps.query\";\n      canonical = {\n        status: \"error\",\n        operation: canonical.operation,\n        context: canonical.context,\n        error: {\n          code: sql ? \"SQL_RESULT_LIMIT_EXCEEDED\" : \"KV_RESPONSE_TOO_LARGE\",\n          message: sql\n            ? \"The result exceeds 100,000 characters. Select fewer columns or rows, add a WHERE filter or a smaller LIMIT, or aggregate the data.\"\n            : \"The result exceeds 100,000 characters. Request fewer keys, narrow the prefix, or use a smaller page size.\",\n          retryable: false,\n        },\n      };\n      serialized = JSON.stringify(canonical);\n    }\n  }\n\n  return {\n    content: [{\n      type: \"text\",\n      text: resultSummary(canonical.status) +\n        (serialized !== undefined && !(options.operationId === \"tinycloud.secrets.get\" && canonical.status === \"ok\")\n          ? `\\n${serialized}` : \"\"),\n    }],\n    structuredContent: canonical,\n  };\n}\n\n/**\n * A redacted `complete_migration` recovery names an operation; MCP clients\n * call tools, so name the bound tool. `tool` comes from the code-owned binding\n * table only, never from operation data, and is added after redaction. An\n * operationId with no binding gets no `tool`.\n */\nfunction withRecoveryTool(\n  result: CanonicalOperationResult,\n  bindings: readonly RecoveryToolBinding[],\n): CanonicalOperationResult {\n  if (result.status !== \"error\") return result;\n  // The kernel's redaction already constrained `error.details.recovery` to a\n  // safe recovery object; only its discriminant and operationId are read here.\n  const error = result.error as\n    | { readonly details?: { readonly recovery?: { readonly action?: unknown; readonly operationId?: unknown } } }\n    | undefined;\n  const recovery = error?.details?.recovery;\n  if (recovery?.action !== \"complete_migration\") return result;\n  const binding = bindings.find((candidate) => candidate.operationId === recovery.operationId);\n  if (binding === undefined) return result;\n  return {\n    ...result,\n    error: { ...error, details: { ...error?.details, recovery: { ...recovery, tool: binding.name } } },\n  };\n}\n\n/** The canonical envelope immediately before MCP protocol serialization. */\nexport function canonicalMcpAdapterResult(result: unknown): CanonicalOperationResult {\n  return toMcpToolResult(result).structuredContent;\n}\n\nfunction isCanonicalOperationResult(value: unknown): value is CanonicalOperationResult {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const status = (value as { status?: unknown }).status;\n  return status === \"ok\" ||\n    status === \"authority_required\" ||\n    status === \"setup_required\" ||\n    status === \"error\";\n}\n\nfunction resultSummary(status: CanonicalOperationResult[\"status\"]): string {\n  switch (status) {\n    case \"ok\":\n      return \"TinyCloud operation completed; use the structured result.\";\n    case \"authority_required\":\n      return \"TinyCloud authority is required; use the structured request and approval action.\";\n    case \"setup_required\":\n      return \"TinyCloud setup is required; use the structured setup action.\";\n    case \"error\":\n      return \"TinyCloud operation failed; use the structured error.\";\n  }\n}\nimport type { CallToolResult } from \"@modelcontextprotocol/server\";\n","/** Only code-owned tool names/codes and numeric counters reach this sink. */\nexport function logToolCall(\n  tool: string,\n  code: string,\n  startedAt: number,\n  replayedGrants: number,\n): void {\n  process.stderr.write(`${JSON.stringify({\n    tool,\n    code,\n    durationMs: Math.max(0, Math.round(performance.now() - startedAt)),\n    replayedGrants,\n  })}\\n`);\n}\n","type JsonSchema = boolean | Record<string, unknown>;\n\nconst DRAFT_7 = \"http://json-schema.org/draft-07/schema#\";\nconst DRAFT_2020_12 = \"https://json-schema.org/draft/2020-12/schema\";\nconst schemaMaps = new Set([\"properties\", \"patternProperties\", \"definitions\", \"$defs\"]);\nconst schemaArrays = new Set([\"allOf\", \"anyOf\", \"oneOf\"]);\nconst schemaValues = new Set([\n  \"additionalProperties\", \"items\", \"contains\", \"propertyNames\", \"not\", \"if\", \"then\", \"else\",\n]);\n\n/** Project the catalog's shared Draft-07/2020-12 vocabulary without changing its validation rules. */\nexport function toMcpJsonSchema(schema: Record<string, unknown>): Record<string, unknown>;\nexport function toMcpJsonSchema(schema: JsonSchema): JsonSchema;\nexport function toMcpJsonSchema(schema: JsonSchema): JsonSchema {\n  if (typeof schema === \"boolean\") return schema;\n  // These forms need a semantic migration, not just a dialect declaration. The\n  // generated catalog does not use them; fail closed if that contract changes.\n  if (Array.isArray(schema.items) || \"additionalItems\" in schema || \"dependencies\" in schema ||\n    (\"$ref\" in schema && Object.keys(schema).some((key) => key !== \"$ref\"))) {\n    throw new Error(\"The operations schema needs a semantic migration to JSON Schema 2020-12.\");\n  }\n\n  const projected: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(schema)) {\n    if (key === \"$schema\") {\n      if (value !== DRAFT_7) throw new Error(`Unsupported operations schema dialect: ${String(value)}.`);\n      projected[key] = DRAFT_2020_12;\n    } else if (schemaMaps.has(key)) {\n      projected[key] = Object.fromEntries(Object.entries(value as Record<string, JsonSchema>)\n        .map(([name, child]) => [name, toMcpJsonSchema(child)]));\n    } else if (schemaArrays.has(key)) {\n      projected[key] = (value as JsonSchema[]).map(toMcpJsonSchema);\n    } else if (schemaValues.has(key)) {\n      projected[key] = toMcpJsonSchema(value as JsonSchema);\n    } else {\n      // Descriptions, defaults, examples and const/enum values are data, not schemas.\n      projected[key] = value;\n    }\n  }\n  return projected;\n}\n","{\n  \"name\": \"@tinycloud/mcp\",\n  \"version\": \"0.8.0-beta.2\",\n  \"description\": \"TinyCloud delegated operations MCP server\",\n  \"keywords\": [\n    \"tinycloud\",\n    \"mcp\",\n    \"model-context-protocol\",\n    \"agents\",\n    \"delegation\",\n    \"ucan\",\n    \"kv\",\n    \"sqlite\"\n  ],\n  \"author\": \"TinyCloud, Inc.\",\n  \"license\": \"EGPL\",\n  \"type\": \"module\",\n  \"main\": \"dist/index.cjs\",\n  \"module\": \"dist/index.js\",\n  \"types\": \"dist/index.d.ts\",\n  \"bin\": {\n    \"tinycloud-mcp\": \"./bin/tinycloud-mcp\",\n    \"tinycloud-mcp-http\": \"./bin/tinycloud-mcp-http\"\n  },\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    },\n    \"./server\": {\n      \"types\": \"./dist/server.d.ts\",\n      \"import\": \"./dist/server.js\",\n      \"require\": \"./dist/server.cjs\"\n    },\n    \"./tools\": {\n      \"types\": \"./dist/tools.d.ts\",\n      \"import\": \"./dist/tools.js\",\n      \"require\": \"./dist/tools.cjs\"\n    },\n    \"./results\": {\n      \"types\": \"./dist/results.d.ts\",\n      \"import\": \"./dist/results.js\",\n      \"require\": \"./dist/results.cjs\"\n    },\n    \"./http\": {\n      \"types\": \"./dist/http.d.ts\",\n      \"import\": \"./dist/http.js\",\n      \"require\": \"./dist/http.cjs\"\n    }\n  },\n  \"files\": [\n    \"dist\",\n    \"bin\",\n    \"generated\",\n    \"skills\"\n  ],\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"clean\": \"rm -rf dist\",\n    \"test\": \"bun run build && bun scripts/test.ts && bun run check:generated\",\n    \"test:stdio\": \"bun run build && bun test src/stdio.test.ts\",\n    \"typecheck\": \"tsc -p tsconfig.json\",\n    \"start:http\": \"node dist/http-cli.js\",\n    \"generate\": \"bun scripts/generate.ts\",\n    \"check:generated\": \"bun scripts/generate.ts --check\"\n  },\n  \"dependencies\": {\n    \"@modelcontextprotocol/node\": \"2.0.0-beta.5\",\n    \"@modelcontextprotocol/server\": \"2.0.0-beta.5\",\n    \"@tinycloud/node-sdk\": \"3.6.0-beta.2\",\n    \"@tinycloud/node-sdk-wasm\": \"1.7.8\",\n    \"@tinycloud/operations\": \"0.7.4-beta.2\",\n    \"jose\": \"6.2.4\"\n  },\n  \"devDependencies\": {\n    \"@modelcontextprotocol/client\": \"2.0.0-beta.5\",\n    \"@types/node\": \"^20\",\n    \"tsup\": \"^8.0.0\",\n    \"typescript\": \"^5.9.3\"\n  },\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/TinyCloudLabs/js-sdk\"\n  },\n  \"homepage\": \"https://docs.tinycloud.xyz/cli/mcp\"\n}\n","import packageMetadata from \"../package.json\";\n\nexport const MCP_VERSION = packageMetadata.version;\n"],"mappings":";AAAA,SAAS,iBAAiB;AAC1B,SAAS,kBAA0C;;;ACDnD,SAAS,qBAAqB;AAC9B,SAAS,YAAY;AAErB,SAAS,sBAA4D;AACrE,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;;;ACmBzB,SAAS,gBACd,QACA,WAA2C,CAAC,GAC5C,UAAgC,CAAC,GAClB;AACf,MAAI,YAAsC,2BAA2B,MAAM,IACvE,iBAAiB,QAAQ,QAAQ,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,WAAW,CAAC;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC;AACF,MAAI;AACJ,MAAI,QAAQ,YAAY,UAAU;AAChC,iBAAa,KAAK,UAAU,SAAS;AACrC,SACG,QAAQ,aAAa,QACpB,QAAQ,gBAAgB,4BACxB,QAAQ,gBAAgB,2BAC1B,WAAW,SAAS,KACpB;AACA,YAAM,MAAM,QAAQ,aAAa,WAAW,gBAAgB,KAC1D,QAAQ,gBAAgB;AAC1B,kBAAY;AAAA,QACV,QAAQ;AAAA,QACR,WAAW,UAAU;AAAA,QACrB,SAAS,UAAU;AAAA,QACnB,OAAO;AAAA,UACL,MAAM,MAAM,8BAA8B;AAAA,UAC1C,SAAS,MACL,uIACA;AAAA,UACJ,WAAW;AAAA,QACb;AAAA,MACF;AACA,mBAAa,KAAK,UAAU,SAAS;AAAA,IACvC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,CAAC;AAAA,MACR,MAAM;AAAA,MACN,MAAM,cAAc,UAAU,MAAM,KACjC,eAAe,UAAa,EAAE,QAAQ,gBAAgB,2BAA2B,UAAU,WAAW,QACnG;AAAA,EAAK,UAAU,KAAK;AAAA,IAC5B,CAAC;AAAA,IACD,mBAAmB;AAAA,EACrB;AACF;AAQA,SAAS,iBACP,QACA,UAC0B;AAC1B,MAAI,OAAO,WAAW,QAAS,QAAO;AAGtC,QAAM,QAAQ,OAAO;AAGrB,QAAM,WAAW,OAAO,SAAS;AACjC,MAAI,UAAU,WAAW,qBAAsB,QAAO;AACtD,QAAM,UAAU,SAAS,KAAK,CAAC,cAAc,UAAU,gBAAgB,SAAS,WAAW;AAC3F,MAAI,YAAY,OAAW,QAAO;AAClC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,EAAE,GAAG,OAAO,SAAS,EAAE,GAAG,OAAO,SAAS,UAAU,EAAE,GAAG,UAAU,MAAM,QAAQ,KAAK,EAAE,EAAE;AAAA,EACnG;AACF;AAOA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAU,MAA+B;AAC/C,SAAO,WAAW,QAChB,WAAW,wBACX,WAAW,oBACX,WAAW;AACf;AAEA,SAAS,cAAc,QAAoD;AACzE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;;;AC7HO,SAAS,YACd,MACA,MACA,WACA,gBACM;AACN,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU;AAAA,IACrC;AAAA,IACA;AAAA,IACA,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS,CAAC;AAAA,IACjE;AAAA,EACF,CAAC,CAAC;AAAA,CAAI;AACR;;;ACXA,IAAM,UAAU;AAChB,IAAM,gBAAgB;AACtB,IAAM,aAAa,oBAAI,IAAI,CAAC,cAAc,qBAAqB,eAAe,OAAO,CAAC;AACtF,IAAM,eAAe,oBAAI,IAAI,CAAC,SAAS,SAAS,OAAO,CAAC;AACxD,IAAM,eAAe,oBAAI,IAAI;AAAA,EAC3B;AAAA,EAAwB;AAAA,EAAS;AAAA,EAAY;AAAA,EAAiB;AAAA,EAAO;AAAA,EAAM;AAAA,EAAQ;AACrF,CAAC;AAKM,SAAS,gBAAgB,QAAgC;AAC9D,MAAI,OAAO,WAAW,UAAW,QAAO;AAGxC,MAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,qBAAqB,UAAU,kBAAkB,UACjF,UAAU,UAAU,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,QAAQ,QAAQ,MAAM,GAAI;AACzE,UAAM,IAAI,MAAM,0EAA0E;AAAA,EAC5F;AAEA,QAAM,YAAqC,CAAC;AAC5C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,WAAW;AACrB,UAAI,UAAU,QAAS,OAAM,IAAI,MAAM,0CAA0C,OAAO,KAAK,CAAC,GAAG;AACjG,gBAAU,GAAG,IAAI;AAAA,IACnB,WAAW,WAAW,IAAI,GAAG,GAAG;AAC9B,gBAAU,GAAG,IAAI,OAAO,YAAY,OAAO,QAAQ,KAAmC,EACnF,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,gBAAgB,KAAK,CAAC,CAAC,CAAC;AAAA,IAC3D,WAAW,aAAa,IAAI,GAAG,GAAG;AAChC,gBAAU,GAAG,IAAK,MAAuB,IAAI,eAAe;AAAA,IAC9D,WAAW,aAAa,IAAI,GAAG,GAAG;AAChC,gBAAU,GAAG,IAAI,gBAAgB,KAAmB;AAAA,IACtD,OAAO;AAEL,gBAAU,GAAG,IAAI;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;;;AH6BO,SAAS,uBACd,WACqB;AACrB,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,GAAI,UAAU,mBAAmB,UAAU,oBACvC,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,IACL,GAAI,UAAU,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,UAAU,UAAU;AAAA,EAChF;AACF;AAoBA,IAAM,iBAAiB;AAAA,EACrB,OAAO,cAAc,WAAW,KAAK,WAAW,WAAW,IAAI,YAAY;AAC7E;AACA,IAAM,mBAAmB;AAAA,EACvB;AACF;AACA,IAAM,mBAAmD,OAAO;AAAA,EAC9D,iBAAiB,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,IAAa,CAAC;AACnE;AAcA,IAAM,mBAA0C,CAAC,SAAS,QAAQ;AAG3D,SAAS,gBAAgB,SAA6C;AAC3E,SAAO,QAAQ,YAAY;AAC7B;AAEO,IAAM,gBAAwC;AAAA,EACnD;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA;AAAA;AAAA,IAGf,UAAU,CAAC,OAAO;AAAA,EACpB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA;AAAA;AAAA,IAGf,UAAU,CAAC,OAAO;AAAA,EACpB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AACF;AAGA,IAAM,cAAc,IAAI,IAAI,iBAAiB,WAAW,IAAI,CAAC,cAAc;AAAA,EACzE,GAAG,UAAU,EAAE,IAAI,UAAU,OAAO;AAAA,EACpC;AAAA,IACE,GAAG;AAAA,IACH,OAAO,gBAAgB,UAAU,KAAK;AAAA,IACtC,QAAQ,gBAAgB,UAAU,MAAM;AAAA,EAC1C;AACF,CAAC,CAAC;AAEK,SAAS,4BAAoD;AAClE,SAAO,IAAI,uBAAuB;AACpC;AAEO,SAAS,uBACd,QACA,WACA,WACM;AACN,QAAM,WAAW,cAAc,OAAO,CAAC,YAAY,gBAAgB,OAAO,EAAE,SAAS,UAAU,OAAO,CAAC;AACvG,aAAW,WAAW,UAAU;AAC9B,UAAM,YAAY,YAAY,IAAI,GAAG,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,EAAE;AACtF,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI,MAAM,2CAA2C,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,GAAG;AAAA,IAC/G;AAEA,UAAM,cAAc;AAAA,MAClB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,eAAe;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,cAA+B;AAAA,MACnC,cAAc,QAAQ;AAAA,MACtB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB,eAAe,QAAQ;AAAA,IACzB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,QACE,OAAO,UAAU;AAAA,QACjB,aAAa,UAAU;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,OAAO,UAA2C;AAChD,cAAM,YAAY,YAAY,IAAI;AAClC,cAAM,UAAU,EAAE,gBAAgB,EAAE;AACpC,YAAI,OAAO;AACX,YAAI;AACF,gBAAM,UAAU,kBAAkB;AAClC,gBAAM,SAAS,MAAM;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,uBAAuB,SAAS;AAAA,YAChC;AAAA,YACA;AAAA,UACF;AACA,gBAAM,YAAY,UAAU,6BAA6B,SACrD,SACA,MAAM,UAAU,yBAAyB,QAAQ;AAAA,YACjD,aAAa,QAAQ;AAAA,YACrB,kBAAkB,QAAQ;AAAA,YAC1B;AAAA,UACF,CAAC;AACH,gBAAM,WAAW,gBAAgB,WAAW,UAAU;AAAA,YACpD,SAAS,UAAU,YAAY,UAAU,UAAU;AAAA,YACnD,UAAU,QAAQ;AAAA,YAClB,aAAa,QAAQ;AAAA,UACvB,CAAC;AACD,iBAAO,YAAY,SAAS,iBAAiB;AAC7C,iBAAO;AAAA,QACT,UAAE;AACA,cAAI,UAAU,YAAY,SAAS;AACjC,wBAAY,QAAQ,MAAM,MAAM,WAAW,QAAQ,cAAc;AAAA,UACnE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,YAAY,QAAoD;AACvE,MAAI,OAAO,WAAW,SAAS;AAC7B,UAAM,QAAQ,OAAO;AACrB,WAAO,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,kBAAkB,MAAM,IAAI,IAAI,MAAM,OAAO;AAAA,EACvG;AACA,MAAI,OAAO,WAAW,KAAM,QAAO,OAAO;AAC1C,QAAM,SAAS,OAAO;AACtB,MAAI,QAAQ,YAAY,eAAgB,QAAO;AAC/C,MAAI,MAAM,QAAQ,QAAQ,GAAG,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,GAAG,YAAY,IAAI,EAAG,QAAO;AACvF,SAAO;AACT;;;AI7bA;AAAA,EACE,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,aAAe;AAAA,EACf,UAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAU;AAAA,EACV,SAAW;AAAA,EACX,MAAQ;AAAA,EACR,MAAQ;AAAA,EACR,QAAU;AAAA,EACV,OAAS;AAAA,EACT,KAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,sBAAsB;AAAA,EACxB;AAAA,EACA,SAAW;AAAA,IACT,KAAK;AAAA,MACH,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,YAAY;AAAA,MACV,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACT,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,aAAa;AAAA,MACX,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,MACR,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,OAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,SAAW;AAAA,IACT,MAAQ;AAAA,EACV;AAAA,EACA,SAAW;AAAA,IACT,OAAS;AAAA,IACT,OAAS;AAAA,IACT,MAAQ;AAAA,IACR,cAAc;AAAA,IACd,WAAa;AAAA,IACb,cAAc;AAAA,IACd,UAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAAA,EACA,cAAgB;AAAA,IACd,8BAA8B;AAAA,IAC9B,gCAAgC;AAAA,IAChC,uBAAuB;AAAA,IACvB,4BAA4B;AAAA,IAC5B,yBAAyB;AAAA,IACzB,MAAQ;AAAA,EACV;AAAA,EACA,iBAAmB;AAAA,IACjB,gCAAgC;AAAA,IAChC,eAAe;AAAA,IACf,MAAQ;AAAA,IACR,YAAc;AAAA,EAChB;AAAA,EACA,YAAc;AAAA,IACZ,MAAQ;AAAA,IACR,KAAO;AAAA,EACT;AAAA,EACA,UAAY;AACd;;;ACvFO,IAAM,cAAc,gBAAgB;;;ANIpC,IAAM,kBAAkB;AAKxB,SAAS,yBAAyB,WAAyC;AAChF,QAAM,YAAY,0BAA0B;AAC5C,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,iBAAiB,SAAS,YAAY;AAAA,IAC9C,EAAE,qBAAqB,UAAU;AAAA,EACnC;AACA,yBAAuB,QAAQ,EAAE,GAAG,WAAW,SAAS,QAAQ,GAAG,SAAS;AAC5E,SAAO;AACT;AAGO,SAAS,kBAAkB,WAAiD;AACjF,SAAO;AAAA,IACL,MAAM,yBAAyB,SAAS;AAAA,IACxC,EAAE,SAAS,MAAM,uBAAuB,qBAAqB,EAAE;AAAA,EACjE;AACF;AAEA,SAAS,uBAAuB,SAAuB;AACrD,UAAQ,OAAO,MAAM,mBAAmB,OAAO;AAAA,CAAI;AACrD;","names":[]}

package/dist/tools.cjs

@@ -46,7 +46,7 @@ function toMcpToolResult(result, bindings = [], options = {}) {
   let serialized;
   if (options.surface === "hosted") {
     serialized = JSON.stringify(canonical);
-    if (options.readOnly === true && serialized.length > 1e5) {
+    if ((options.readOnly === true || options.operationId === "tinycloud.apps.context" || options.operationId === "tinycloud.apps.query") && serialized.length > 1e5) {
       const sql = options.operationId?.startsWith("tinycloud.sql.") || options.operationId === "tinycloud.apps.query";
       canonical = {
         status: "error",
@@ -111,6 +111,44 @@ function logToolCall(tool, code, startedAt, replayedGrants) {
 `);
 }
 
+// src/schemas.ts
+var DRAFT_7 = "http://json-schema.org/draft-07/schema#";
+var DRAFT_2020_12 = "https://json-schema.org/draft/2020-12/schema";
+var schemaMaps = /* @__PURE__ */ new Set(["properties", "patternProperties", "definitions", "$defs"]);
+var schemaArrays = /* @__PURE__ */ new Set(["allOf", "anyOf", "oneOf"]);
+var schemaValues = /* @__PURE__ */ new Set([
+  "additionalProperties",
+  "items",
+  "contains",
+  "propertyNames",
+  "not",
+  "if",
+  "then",
+  "else"
+]);
+function toMcpJsonSchema(schema) {
+  if (typeof schema === "boolean") return schema;
+  if (Array.isArray(schema.items) || "additionalItems" in schema || "dependencies" in schema || "$ref" in schema && Object.keys(schema).some((key) => key !== "$ref")) {
+    throw new Error("The operations schema needs a semantic migration to JSON Schema 2020-12.");
+  }
+  const projected = {};
+  for (const [key, value] of Object.entries(schema)) {
+    if (key === "$schema") {
+      if (value !== DRAFT_7) throw new Error(`Unsupported operations schema dialect: ${String(value)}.`);
+      projected[key] = DRAFT_2020_12;
+    } else if (schemaMaps.has(key)) {
+      projected[key] = Object.fromEntries(Object.entries(value).map(([name, child]) => [name, toMcpJsonSchema(child)]));
+    } else if (schemaArrays.has(key)) {
+      projected[key] = value.map(toMcpJsonSchema);
+    } else if (schemaValues.has(key)) {
+      projected[key] = toMcpJsonSchema(value);
+    } else {
+      projected[key] = value;
+    }
+  }
+  return projected;
+}
+
 // src/tools.ts
 var import_meta = {};
 var TOOL_NAMES = [
@@ -154,9 +192,9 @@ var generatedCatalog = packageRequire(
 var stableErrorCodes = Object.fromEntries(
   generatedCatalog.stableErrors.map((code) => [code, true])
 );
-var ALL_SURFACES = ["local", "hosted"];
+var PRIVATE_SURFACES = ["local", "hosted"];
 function bindingSurfaces(binding) {
-  return binding.surfaces ?? ALL_SURFACES;
+  return binding.surfaces ?? PRIVATE_SURFACES;
 }
 var TOOL_BINDINGS = [
   {
@@ -340,11 +378,11 @@ var TOOL_BINDINGS = [
     name: "tinycloud_apps_context",
     operationId: "tinycloud.apps.context",
     operationVersion: 1,
-    readOnlyHint: true,
+    readOnlyHint: false,
     idempotentHint: true,
-    destructiveHint: false,
-    openWorldHint: true,
-    surfaces: ["hosted"]
+    destructiveHint: true,
+    openWorldHint: false,
+    surfaces: ["hosted", "public"]
   },
   {
     name: "tinycloud_apps_read",
@@ -353,8 +391,8 @@ var TOOL_BINDINGS = [
     readOnlyHint: true,
     idempotentHint: true,
     destructiveHint: false,
-    openWorldHint: true,
-    surfaces: ["hosted"]
+    openWorldHint: false,
+    surfaces: ["hosted", "public"]
   },
   {
     name: "tinycloud_apps_write",
@@ -363,34 +401,34 @@ var TOOL_BINDINGS = [
     readOnlyHint: false,
     idempotentHint: false,
     destructiveHint: true,
-    openWorldHint: true,
-    surfaces: ["hosted"]
+    openWorldHint: false,
+    surfaces: ["hosted", "public"]
   },
   {
     name: "tinycloud_apps_query",
     operationId: "tinycloud.apps.query",
     operationVersion: 1,
-    readOnlyHint: true,
+    readOnlyHint: false,
     idempotentHint: true,
-    destructiveHint: false,
-    openWorldHint: true,
-    surfaces: ["hosted"]
+    destructiveHint: true,
+    openWorldHint: false,
+    surfaces: ["hosted", "public"]
   }
 ];
+var definitions = new Map(generatedCatalog.operations.map((operation) => [
+  `${operation.id}@${operation.version}`,
+  {
+    ...operation,
+    input: toMcpJsonSchema(operation.input),
+    result: toMcpJsonSchema(operation.result)
+  }
+]));
 function createJsonSchemaValidator() {
-  const ajv = new import_ajv.Ajv({ strict: false });
-  (0, import_ajv.addFormats)(ajv);
-  return new import_ajv.AjvJsonSchemaValidator(ajv);
+  return new import_ajv.AjvJsonSchemaValidator();
 }
 function registerTinyCloudTools(server, selection, validator) {
-  const definitions = new Map(
-    generatedCatalog.operations.map((operation) => [
-      `${operation.id}@${operation.version}`,
-      operation
-    ])
-  );
-  for (const binding of TOOL_BINDINGS) {
-    if (!bindingSurfaces(binding).includes(selection.surface)) continue;
+  const bindings = TOOL_BINDINGS.filter((binding) => bindingSurfaces(binding).includes(selection.surface));
+  for (const binding of bindings) {
     const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);
     if (operation === void 0) {
       throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);
@@ -436,15 +474,15 @@ function registerTinyCloudTools(server, selection, validator) {
             operationVersion: binding.operationVersion,
             input
           });
-          const response = toMcpToolResult(projected, TOOL_BINDINGS, {
-            surface: selection.surface,
+          const response = toMcpToolResult(projected, bindings, {
+            surface: selection.surface === "local" ? "local" : "hosted",
             readOnly: binding.readOnlyHint,
             operationId: binding.operationId
           });
           code = outcomeCode(response.structuredContent);
           return response;
         } finally {
-          if (selection.surface === "hosted") {
+          if (selection.surface !== "local") {
             logToolCall(binding.name, code, startedAt, metrics.replayedGrants);
           }
         }