@tinycloud/mcp 0.8.3-beta.16 → 0.8.3-beta.18

package/dist/http-cli.cjs

@@ -289,16 +289,85 @@ function logToolCall(tool, code, startedAt, replayedGrants) {
 }
 
 // src/remote-store.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var import_promises = require("fs/promises");
 var import_node_path = require("path");
 var import_node_sdk2 = require("@tinycloud/node-sdk");
 var import_node_sdk_wasm = require("@tinycloud/node-sdk-wasm");
+var import_artifacts = require("@tinycloud/operations/artifacts");
+var import_state = require("@tinycloud/operations/state");
 var import_operations = require("@tinycloud/operations");
 var import_mcp_authority = require("@tinycloud/operations/mcp-authority");
 var import_tc_apps = require("@tinycloud/operations/tc-apps");
+
+// src/native-auth.ts
+var import_node_crypto2 = require("crypto");
+var NATIVE_SERVICE_CREDENTIAL_HEADER = "X-TinyCloud-Service-Credential";
+var NATIVE_OWNER_DID_HEADER = "X-TinyCloud-Owner-DID";
+var NATIVE_GRANT_MAX_LIFETIME_SECONDS = 30 * 24 * 60 * 60;
+var NATIVE_GRANT_REQUIRED = "native_grant_required";
+var NATIVE_GRANT_EXPIRED = "native_grant_expired";
+var NATIVE_GRANT_REJECTED = "native_grant_rejected";
+var NATIVE_SERVICE_UNAUTHORIZED = "native_service_unauthorized";
+var NATIVE_SERVICE_UNAVAILABLE = "native_service_unavailable";
+var NATIVE_GRANT_VALIDATION_UNAVAILABLE = "native_grant_validation_unavailable";
+var MAX_NATIVE_GRANT_BODY_BYTES = 256 * 1024;
+function serviceCredentialMatches(supplied, configured) {
+  if (supplied === null || configured === void 0) return false;
+  const suppliedBytes = Buffer.from(supplied, "utf8");
+  const configuredBytes = Buffer.from(configured, "utf8");
+  return suppliedBytes.byteLength === configuredBytes.byteLength && (0, import_node_crypto2.timingSafeEqual)(suppliedBytes, configuredBytes);
+}
+var OWNER_APPLICATIONS_SPACE = /^tinycloud:pkh:eip155:([1-9][0-9]*):(0x[0-9a-f]{40}):applications$/i;
+var SQL_PATH = "xyz.tinycloud.tinychat/connectors";
+var KV_PREFIX = "xyz.tinycloud.tinychat/connectors/";
+function canonicalOwnerDid(value) {
+  const match = /^did:pkh:eip155:([1-9][0-9]*):(0x[0-9a-f]{40})$/i.exec(value);
+  if (!match) return void 0;
+  const chainId = Number(match[1]);
+  if (!Number.isSafeInteger(chainId)) return void 0;
+  return `did:pkh:eip155:${chainId}:${match[2].toLowerCase()}`;
+}
+function nativeOwnerForConnectorGrant(permissions) {
+  if (permissions.length !== 2) return void 0;
+  const sqlEntries = permissions.filter((permission) => permission.service === "tinycloud.sql");
+  const kvEntries = permissions.filter((permission) => permission.service === "tinycloud.kv");
+  if (sqlEntries.length !== 1 || kvEntries.length !== 1) return void 0;
+  const sql = sqlEntries[0];
+  const kv = kvEntries[0];
+  if (typeof sql.space !== "string" || typeof kv.space !== "string" || sql.path !== SQL_PATH || kv.path !== KV_PREFIX) return void 0;
+  if (!actionsEqual(sql.actions, ["tinycloud.sql/read"]) || !actionsEqual(kv.actions, ["tinycloud.kv/get", "tinycloud.kv/list"])) return void 0;
+  if (hasCaveats(sql) || hasCaveats(kv)) return void 0;
+  const sqlSpace = ownerFromApplicationsSpace(sql.space);
+  const kvSpace = ownerFromApplicationsSpace(kv.space);
+  return sqlSpace !== void 0 && sqlSpace === kvSpace ? sqlSpace : void 0;
+}
+function ownerFromApplicationsSpace(space) {
+  const match = OWNER_APPLICATIONS_SPACE.exec(space);
+  if (!match) return void 0;
+  const chainId = Number(match[1]);
+  if (!Number.isSafeInteger(chainId)) return void 0;
+  return `did:pkh:eip155:${chainId}:${match[2].toLowerCase()}`;
+}
+function actionsEqual(actual, expected) {
+  const actualActions = [...actual].sort();
+  const expectedActions = [...expected].sort();
+  return actualActions.length === expectedActions.length && actualActions.every((value, index) => value === expectedActions[index]);
+}
+function hasCaveats(permission) {
+  return Object.hasOwn(permission, "caveats") && permission.caveats !== void 0;
+}
+
+// src/remote-store.ts
 var PROFILE = "agent";
 var MAX_CALLBACK_BYTES = 256 * 1024;
+var NATIVE_GRANT_IMPORT_REJECTION_CODES = /* @__PURE__ */ new Set([
+  "DELEGATION_ARTIFACT_INVALID",
+  "DELEGATION_EXPIRED",
+  "DELEGATION_AUDIENCE_MISMATCH",
+  "DELEGATION_HOST_MISMATCH",
+  "DELEGATION_REJECTED"
+]);
 var LEGACY_DEFAULT_NODE_HOST = "https://node.tinycloud.xyz";
 var BOOTSTRAP_PERMISSIONS = [
   {
@@ -340,6 +409,15 @@ var ApprovalRequestError = class extends Error {
     this.detail = detail;
   }
 };
+var NativeGrantValidationError = class extends Error {
+  code;
+  constructor(status) {
+    const code = status.startsWith("native_") ? status : status === "required" ? "native_grant_required" : status === "expired" ? "native_grant_expired" : status === "unavailable" ? "native_grant_validation_unavailable" : "native_grant_rejected";
+    super(code);
+    this.name = "NativeGrantValidationError";
+    this.code = code;
+  }
+};
 var RemoteTenantStore = class {
   #config;
   #initializing = /* @__PURE__ */ new Map();
@@ -352,9 +430,186 @@ var RemoteTenantStore = class {
   #scopedClearing = /* @__PURE__ */ new Map();
   #clearedScoped = /* @__PURE__ */ new Map();
   #approvalProcessing = /* @__PURE__ */ new Map();
+  #nativeIdentity;
+  #nativeGrantQueues = /* @__PURE__ */ new Map();
   constructor(config) {
     this.#config = config;
   }
+  async nativeServiceIdentity() {
+    const identity = await this.#loadNativeServiceKey();
+    return { serviceDid: normalizeDid(identity.did) };
+  }
+  nativeTenantStateRoot(ownerDid) {
+    const canonical = canonicalOwnerDid(ownerDid);
+    if (canonical === void 0) throw new NativeGrantValidationError("rejected");
+    const tenant = (0, import_node_crypto3.createHmac)("sha256", this.#config.stateSecret).update(`native-tenant:${canonical}`).digest("hex");
+    return (0, import_node_path.join)(this.#config.stateDir, "native-tenants", tenant);
+  }
+  async acceptNativeGrant(serializedDelegation) {
+    if (Buffer.byteLength(serializedDelegation) > MAX_CALLBACK_BYTES) {
+      throw new NativeGrantValidationError("rejected");
+    }
+    const identity = await this.#loadNativeServiceKey();
+    const activated = await this.#activateNativeDelegation(serializedDelegation, identity);
+    const { ownerDid, spaceId, permissions, expiresAt } = activated;
+    return this.#withNativeGrantLock(ownerDid, async () => {
+      const stateRoot = this.nativeTenantStateRoot(ownerDid);
+      let previous = null;
+      try {
+        const stored = await readJson(this.#nativeGrantPath(stateRoot));
+        if (isRecord(stored) && stored.version === 1 && stored.ownerDid === ownerDid && typeof stored.serviceDid === "string" && samePrincipal(stored.serviceDid, identity.did) && typeof stored.serializedDelegation === "string" && typeof stored.delegationCid === "string" && typeof stored.spaceId === "string" && Array.isArray(stored.permissions) && stored.permissions.every(isPermissionEntry) && nativeOwnerForConnectorGrant(stored.permissions) === ownerDid && typeof stored.expiresAt === "string" && Number.isFinite(Date.parse(stored.expiresAt))) {
+          previous = stored;
+        }
+      } catch (error) {
+        if (!(error instanceof SyntaxError)) throw error;
+      }
+      if (previous !== null) {
+        const previousExpiry = Date.parse(previous.expiresAt);
+        const nextExpiry = expiresAt.getTime();
+        if (previousExpiry > nextExpiry || previousExpiry === nextExpiry && previous.delegationCid !== activated.cid) {
+          throw new NativeGrantValidationError("rejected");
+        }
+        if (previous.delegationCid === activated.cid) {
+          return {
+            ownerDid,
+            serviceDid: normalizeDid(identity.did),
+            expiresAt: previous.expiresAt,
+            stateRoot
+          };
+        }
+      }
+      const session = {
+        delegationHeader: activated.delegation.delegationHeader,
+        delegationCid: activated.cid,
+        spaceId,
+        jwk: identity.jwk,
+        verificationMethod: identity.did,
+        tinycloudHosts: [this.#config.nodeHost]
+      };
+      const grant = {
+        version: 1,
+        ownerDid,
+        serviceDid: normalizeDid(identity.did),
+        serializedDelegation: (0, import_node_sdk2.serializeDelegation)(activated.delegation),
+        delegationCid: activated.cid,
+        spaceId,
+        permissions,
+        expiresAt: expiresAt.toISOString()
+      };
+      const sessionPath = this.#sessionPath(stateRoot);
+      const previousSession = await readOptionalText(sessionPath);
+      try {
+        await secureWrite(this.#profilePath(stateRoot), {
+          name: PROFILE,
+          host: this.#config.nodeHost,
+          chainId: activated.delegation.chainId,
+          spaceName: "applications",
+          did: identity.did,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          profile: PROFILE,
+          operatorType: "agent",
+          posture: "delegate-session",
+          ownerDid,
+          sessionDid: identity.did,
+          spaceId,
+          tinycloudHost: this.#config.nodeHost
+        });
+        await secureWrite(this.#keyPath(stateRoot), identity.jwk);
+        await secureWrite(sessionPath, session);
+        const request = await (0, import_state.withTinyCloudStateRoot)(stateRoot, () => (0, import_artifacts.createOrReusePermissionRequest)({
+          profile: PROFILE,
+          posture: "delegate-session",
+          operatorType: "agent",
+          host: this.#config.nodeHost,
+          sessionDid: identity.did,
+          ownerDid,
+          spaceId,
+          missing: permissions,
+          granted: [],
+          replace: true
+        }));
+        if (request.status !== "created") {
+          throw new NativeGrantValidationError("native_grant_validation_unavailable");
+        }
+        const imported = await (0, import_operations.invokeOperation)(
+          "tinycloud.auth.import",
+          1,
+          { profile: PROFILE, stateRoot },
+          {
+            kind: "tinycloud.auth.delegation",
+            version: 1,
+            requestId: request.request.requestId,
+            delegationCid: activated.cid,
+            delegation: activated.delegation
+          }
+        );
+        if (imported.status === "error") {
+          throw new NativeGrantValidationError(
+            NATIVE_GRANT_IMPORT_REJECTION_CODES.has(imported.error.code) ? "native_grant_rejected" : "native_grant_validation_unavailable"
+          );
+        }
+        if (imported.status !== "ok" || !isRecord(imported.output) || imported.output.activated !== true || imported.output.cid !== activated.cid) {
+          throw new NativeGrantValidationError("native_grant_validation_unavailable");
+        }
+        await secureWrite(this.#nativeGrantPath(stateRoot), grant);
+      } catch (error) {
+        try {
+          await restoreOptionalText(sessionPath, previousSession);
+        } catch {
+          await (0, import_promises.rm)(this.#nativeGrantPath(stateRoot), { force: true }).catch(() => void 0);
+          throw new NativeGrantValidationError("native_grant_validation_unavailable");
+        }
+        throw error;
+      }
+      return { ownerDid, serviceDid: normalizeDid(identity.did), expiresAt: grant.expiresAt, stateRoot };
+    });
+  }
+  async nativeGrantForOwner(ownerDid) {
+    const canonical = canonicalOwnerDid(ownerDid);
+    if (canonical === void 0) return { status: "rejected" };
+    const stateRoot = this.nativeTenantStateRoot(canonical);
+    let stored;
+    try {
+      stored = await readJson(this.#nativeGrantPath(stateRoot));
+    } catch {
+      return { status: "rejected" };
+    }
+    if (stored === null) return { status: "required" };
+    if (!isRecord(stored) || stored.version !== 1 || stored.ownerDid !== canonical || typeof stored.serviceDid !== "string" || typeof stored.serializedDelegation !== "string" || typeof stored.delegationCid !== "string" || typeof stored.spaceId !== "string" || typeof stored.expiresAt !== "string" || !Array.isArray(stored.permissions) || !stored.permissions.every(isPermissionEntry) || nativeOwnerForConnectorGrant(stored.permissions) !== canonical) {
+      return { status: "rejected" };
+    }
+    const expires = Date.parse(stored.expiresAt);
+    if (!Number.isFinite(expires)) return { status: "rejected" };
+    if (expires <= Date.now()) return { status: "expired" };
+    try {
+      const identity = await this.#loadNativeServiceKey();
+      if (!samePrincipal(stored.serviceDid, identity.did)) return { status: "rejected" };
+      const activated = await this.#activateNativeDelegation(stored.serializedDelegation, identity);
+      if (activated.ownerDid !== canonical || activated.cid !== stored.delegationCid || activated.spaceId !== stored.spaceId || JSON.stringify(activated.permissions) !== JSON.stringify(stored.permissions) || activated.expiresAt.toISOString() !== stored.expiresAt) return { status: "rejected" };
+      return { status: "ok", ownerDid: canonical, stateRoot, expiresAt: stored.expiresAt };
+    } catch (error) {
+      if (error instanceof NativeGrantValidationError) {
+        return { status: error.code === "native_grant_expired" ? "expired" : error.code === "native_grant_validation_unavailable" ? "unavailable" : "rejected" };
+      }
+      return { status: "unavailable" };
+    }
+  }
+  async assertNativeGrantActive(ownerDid) {
+    const canonical = canonicalOwnerDid(ownerDid);
+    if (canonical === void 0) throw new NativeGrantValidationError("rejected");
+    const stateRoot = this.nativeTenantStateRoot(canonical);
+    let stored;
+    try {
+      stored = await readJson(this.#nativeGrantPath(stateRoot));
+    } catch {
+      throw new NativeGrantValidationError("rejected");
+    }
+    if (stored === null) throw new NativeGrantValidationError("required");
+    if (!isRecord(stored) || stored.version !== 1 || stored.ownerDid !== canonical || typeof stored.expiresAt !== "string" || !Number.isFinite(Date.parse(stored.expiresAt))) {
+      throw new NativeGrantValidationError("rejected");
+    }
+    if (Date.parse(stored.expiresAt) <= Date.now()) throw new NativeGrantValidationError("expired");
+  }
   tenantStateRoot(subject) {
     return (0, import_node_path.join)(this.#config.stateDir, "tenants", this.#tenantId(subject));
   }
@@ -881,7 +1136,7 @@ var RemoteTenantStore = class {
       { tenantId, approvalEpoch: tenant.approvalEpoch, kind, requestId, permissions, ownerDids }
     );
     if (reusable !== void 0) return reusable;
-    const nonce = (0, import_node_crypto2.randomBytes)(24).toString("base64url");
+    const nonce = (0, import_node_crypto3.randomBytes)(24).toString("base64url");
     const created = Date.now();
     const pending = {
       version: 1,
@@ -906,7 +1161,7 @@ var RemoteTenantStore = class {
     const expected = this.#signState(tenantId, nonce);
     const supplied = Buffer.from(signature, "base64url");
     const expectedBytes = Buffer.from(expected, "base64url");
-    if (supplied.length !== expectedBytes.length || !(0, import_node_crypto2.timingSafeEqual)(supplied, expectedBytes)) {
+    if (supplied.length !== expectedBytes.length || !(0, import_node_crypto3.timingSafeEqual)(supplied, expectedBytes)) {
       throw new ApprovalRequestError("state_invalid", "Approval state is invalid.");
     }
     const stateRoot = (0, import_node_path.join)(this.#config.stateDir, "tenants", tenantId);
@@ -957,11 +1212,128 @@ var RemoteTenantStore = class {
     url.searchParams.set("state", `${pending.tenantId}.${pending.nonce}.${this.#signState(pending.tenantId, pending.nonce)}`);
     return url.toString();
   }
+  async #withNativeGrantLock(ownerDid, action) {
+    const previous = this.#nativeGrantQueues.get(ownerDid) ?? Promise.resolve();
+    let releaseNext;
+    const next = new Promise((resolve2) => {
+      releaseNext = resolve2;
+    });
+    this.#nativeGrantQueues.set(ownerDid, next);
+    await previous;
+    try {
+      return await action();
+    } finally {
+      releaseNext();
+      if (this.#nativeGrantQueues.get(ownerDid) === next) this.#nativeGrantQueues.delete(ownerDid);
+    }
+  }
+  async #loadNativeServiceKey() {
+    if (this.#nativeIdentity === void 0) {
+      const loading = this.#readOrCreateNativeServiceKey();
+      this.#nativeIdentity = loading;
+      void loading.catch(() => {
+        if (this.#nativeIdentity === loading) this.#nativeIdentity = void 0;
+      });
+    }
+    return this.#nativeIdentity;
+  }
+  async #readOrCreateNativeServiceKey() {
+    const path = (0, import_node_path.join)(this.#config.stateDir, ".tinycloud", "native-service-key.json");
+    await secureDirectory((0, import_node_path.dirname)(path));
+    let stored = await readJson(path);
+    if (stored === null) {
+      const generated = generateSessionKey();
+      try {
+        await (0, import_promises.writeFile)(path, `${JSON.stringify({ version: 1, jwk: generated.jwk })}
+`, {
+          mode: 384,
+          flag: "wx"
+        });
+      } catch (error) {
+        if (!isRecord(error) || error.code !== "EEXIST") throw error;
+      }
+      await (0, import_promises.chmod)(path, 384);
+      stored = await readJson(path);
+    }
+    if (stored === null || !isRecord(stored) || stored.version !== 1 || !isRecord(stored.jwk)) {
+      throw new Error("The native MCP service identity is unavailable.");
+    }
+    return { did: didFromJwk(stored.jwk), jwk: stored.jwk };
+  }
+  async #activateNativeDelegation(serialized, identity) {
+    let delegation;
+    try {
+      const parsed = JSON.parse(serialized);
+      if (!isRecord(parsed)) throw new Error("invalid delegation");
+      delegation = (0, import_node_sdk2.deserializeDelegation)(serialized);
+    } catch {
+      throw new NativeGrantValidationError("native_grant_rejected");
+    }
+    if (!isRecord(delegation.delegationHeader) || typeof delegation.delegationHeader.Authorization !== "string" || delegation.delegationHeader.Authorization.length === 0 || typeof delegation.cid !== "string" || delegation.cid.length === 0 || typeof delegation.delegateDID !== "string" || !samePrincipal(delegation.delegateDID, normalizeDid(identity.did)) || typeof delegation.spaceId !== "string" || typeof delegation.ownerAddress !== "string" || !Number.isSafeInteger(delegation.chainId) || typeof delegation.host !== "string" || !sameNodeHost(delegation.host, this.#config.nodeHost) || !(delegation.expiry instanceof Date) || !Number.isFinite(delegation.expiry.getTime())) {
+      throw new NativeGrantValidationError("native_grant_rejected");
+    }
+    const now = Date.now();
+    const claimedExpiry = delegation.expiry.getTime();
+    if (claimedExpiry <= now) throw new NativeGrantValidationError("native_grant_expired");
+    if (claimedExpiry > now + NATIVE_GRANT_MAX_LIFETIME_SECONDS * 1e3) {
+      throw new NativeGrantValidationError("native_grant_rejected");
+    }
+    let ownerDid;
+    let spaceId;
+    const node = new import_node_sdk2.TinyCloudNode({ host: this.#config.nodeHost });
+    try {
+      await node.restoreSession({
+        delegationHeader: delegation.delegationHeader,
+        delegationCid: delegation.cid,
+        spaceId: delegation.spaceId,
+        jwk: identity.jwk,
+        verificationMethod: identity.did,
+        tinycloudHosts: [this.#config.nodeHost]
+      });
+      const activated = await (0, import_node_sdk2.activateValidatedRuntimeDelegation)(node, delegation, {
+        host: this.#config.nodeHost,
+        authorize: (permissions) => {
+          const derivedOwner = nativeOwnerForConnectorGrant(permissions);
+          const signedSpace = permissions[0]?.space;
+          if (derivedOwner === void 0 || signedSpace === void 0) return false;
+          const metadataOwner = canonicalOwnerDid(
+            `did:pkh:eip155:${delegation.chainId}:${delegation.ownerAddress}`
+          );
+          if (metadataOwner !== derivedOwner || delegation.spaceId.toLowerCase() !== signedSpace.toLowerCase()) return false;
+          ownerDid = derivedOwner;
+          spaceId = signedSpace;
+          return true;
+        }
+      });
+      if (ownerDid === void 0 || spaceId === void 0 || !samePrincipal(activated.audience, normalizeDid(identity.did)) || activated.expiry.getTime() > now + NATIVE_GRANT_MAX_LIFETIME_SECONDS * 1e3) {
+        throw new NativeGrantValidationError("native_grant_rejected");
+      }
+      return {
+        ownerDid,
+        spaceId,
+        permissions: [...activated.effectivePermissions],
+        cid: activated.cid,
+        expiresAt: activated.expiry,
+        delegation: activated.delegation
+      };
+    } catch (error) {
+      if (error instanceof NativeGrantValidationError) throw error;
+      if (error instanceof import_node_sdk2.RuntimeDelegationRejectedError) {
+        throw new NativeGrantValidationError(
+          error.reason === "expired" ? "native_grant_expired" : error.reason === "activation_unavailable" ? "native_grant_validation_unavailable" : "native_grant_rejected"
+        );
+      }
+      throw new NativeGrantValidationError("native_grant_validation_unavailable");
+    }
+  }
+  #nativeGrantPath(stateRoot) {
+    return (0, import_node_path.join)(stateRoot, ".tinycloud", "native-grant.json");
+  }
   #tenantId(subject) {
-    return (0, import_node_crypto2.createHmac)("sha256", this.#config.stateSecret).update(`tenant:${subject}`).digest("hex");
+    return (0, import_node_crypto3.createHmac)("sha256", this.#config.stateSecret).update(`tenant:${subject}`).digest("hex");
   }
   #signState(tenantId, nonce) {
-    return (0, import_node_crypto2.createHmac)("sha256", this.#config.stateSecret).update(`approval:${tenantId}:${nonce}`).digest("base64url");
+    return (0, import_node_crypto3.createHmac)("sha256", this.#config.stateSecret).update(`approval:${tenantId}:${nonce}`).digest("base64url");
   }
   #profilePath(stateRoot) {
     return (0, import_node_path.join)(stateRoot, ".tinycloud", "profiles", PROFILE, "profile.json");
@@ -1050,6 +1422,21 @@ function samePrincipal(left, right) {
 function normalizeDid(value) {
   return value.split("#", 1)[0];
 }
+function sameNodeHost(left, right) {
+  try {
+    const normalize = (value) => {
+      const url = new URL(value);
+      if (url.username !== "" || url.password !== "") return "";
+      url.hash = "";
+      url.search = "";
+      url.pathname = url.pathname.replace(/\/+$/, "");
+      return url.toString().replace(/\/+$/, "");
+    };
+    return normalize(left) !== "" && normalize(left) === normalize(right);
+  } catch {
+    return false;
+  }
+}
 function isPermissionEntry(value) {
   return isRecord(value) && typeof value.service === "string" && typeof value.space === "string" && typeof value.path === "string" && Array.isArray(value.actions) && value.actions.every((action) => typeof action === "string");
 }
@@ -1063,7 +1450,7 @@ async function secureDirectory(path) {
 async function secureWrite(path, value) {
   const directory = (0, import_node_path.dirname)(path);
   await secureDirectory(directory);
-  const temporary = `${path}.${process.pid}.${(0, import_node_crypto2.randomBytes)(8).toString("hex")}.tmp`;
+  const temporary = `${path}.${process.pid}.${(0, import_node_crypto3.randomBytes)(8).toString("hex")}.tmp`;
   await (0, import_promises.writeFile)(temporary, `${JSON.stringify(value, jsonReplacer, 2)}
 `, { mode: 384 });
   await (0, import_promises.rename)(temporary, path);
@@ -1080,6 +1467,23 @@ async function readJson(path) {
     throw error;
   }
 }
+async function readOptionalText(path) {
+  try {
+    return await (0, import_promises.readFile)(path, "utf8");
+  } catch (error) {
+    if (isRecord(error) && error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function restoreOptionalText(path, contents) {
+  if (contents === null) {
+    await (0, import_promises.rm)(path, { force: true });
+    return;
+  }
+  await secureDirectory((0, import_node_path.dirname)(path));
+  await (0, import_promises.writeFile)(path, contents, { mode: 384 });
+  await (0, import_promises.chmod)(path, 384);
+}
 async function reusablePending(directory, expected) {
   let names;
   try {
@@ -1477,7 +1881,7 @@ function createJsonSchemaValidator() {
   return new import_ajv.AjvJsonSchemaValidator();
 }
 function registerTinyCloudTools(server, selection, validator) {
-  const bindings = TOOL_BINDINGS.filter((binding) => bindingSurfaces(binding).includes(selection.surface));
+  const bindings = TOOL_BINDINGS.filter((binding) => bindingSurfaces(binding).includes(selection.surface) && (selection.allowedTools === void 0 || selection.allowedTools.includes(binding.name)));
   for (const binding of bindings) {
     const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);
     if (operation === void 0) {
@@ -1555,7 +1959,7 @@ function outcomeCode(result) {
 // package.json
 var package_default = {
   name: "@tinycloud/mcp",
-  version: "0.8.3-beta.16",
+  version: "0.8.3-beta.18",
   description: "TinyCloud delegated operations MCP server",
   keywords: [
     "tinycloud",
@@ -1626,9 +2030,9 @@ var package_default = {
   dependencies: {
     "@modelcontextprotocol/node": "2.0.0-beta.5",
     "@modelcontextprotocol/server": "2.0.0-beta.5",
-    "@tinycloud/node-sdk": "3.8.0-beta.15",
+    "@tinycloud/node-sdk": "3.8.0-beta.16",
     "@tinycloud/node-sdk-wasm": "1.7.8",
-    "@tinycloud/operations": "0.7.7-beta.14",
+    "@tinycloud/operations": "0.7.7-beta.15",
     jose: "6.2.4"
   },
   devDependencies: {
@@ -1655,12 +2059,16 @@ var REQUIRED_SCOPE = "tinycloud:mcp";
 var LOCAL_CLI_PACKAGE = ["@tinycloud", "cli"].join("/");
 var LOCAL_MCP_PACKAGE = ["@tinycloud", "mcp"].join("/");
 function createHostedMcpApp(config) {
+  if (config.nativeServiceCredential !== void 0 && Buffer.byteLength(config.nativeServiceCredential, "utf8") < 32) {
+    throw new Error("TC_MCP_NATIVE_SERVICE_CREDENTIAL must contain at least 32 bytes.");
+  }
   const resourceUrl = canonicalResourceUrl(config.publicUrl);
   const pluginUrl = new URL("./chatgpt/mcp", resourceUrl);
   const statusFor = (resource) => config.introspection === void 0 ? void 0 : createTokenStatusChecker({ ...config.introspection, resourceUrl: resource.toString() });
   const hosted = createHostedSurface(config, resourceUrl, "hosted", statusFor(resourceUrl));
   const plugin = createHostedSurface({
     ...config,
+    nativeServiceCredential: void 0,
     stateDir: (0, import_node_path3.join)(config.stateDir, "chatgpt"),
     approvalPath: new URL("./connect", pluginUrl).pathname
   }, pluginUrl, "public", statusFor(pluginUrl));
@@ -1696,16 +2104,19 @@ function createHostedSurface(config, resourceUrl, surface, tokenStatus) {
     resourceMetadataUrl
   });
   const store = new RemoteTenantStore({ ...config, publicUrl: resourceUrl });
+  const nativeServiceIdentityEnabled = surface === "hosted" && config.nativeServiceCredential !== void 0;
+  if (nativeServiceIdentityEnabled) void store.nativeServiceIdentity().catch(() => void 0);
   const handler = (0, import_server4.createMcpHandler)(async ({ authInfo: authInfo2 }) => {
-    const identity = oauthIdentity(authInfo2);
+    const nativeOwner = typeof authInfo2?.extra?.nativeOwnerDid === "string" ? authInfo2.extra.nativeOwnerDid : void 0;
+    const identity = nativeOwner === void 0 ? oauthIdentity(authInfo2) : { subject: `native:${nativeOwner}`, ownerDids: [nativeOwner] };
     const { subject, ownerDids } = identity;
-    const stateRoot = await store.initializeTenant(subject);
+    const stateRoot = nativeOwner === void 0 ? await store.initializeTenant(subject) : store.nativeTenantStateRoot(nativeOwner);
     const validator = createJsonSchemaValidator();
     const server = new import_server4.McpServer(
       { name: MCP_SERVER_NAME, version: MCP_VERSION },
       {
         jsonSchemaValidator: validator,
-        instructions: surface === "public" ? "Use TinyCloud only for the user's requested task. Call tinycloud_connect first. If an operation returns authority_required, present approval.url and wait for the user's approval before retrying. If approval is declined, stop that operation. For personal records, call tinycloud_apps_context first. Never request or store passwords, API keys, authentication codes, government identifiers, payment-card data, or protected health information." : "Call tinycloud_connect first. If an operation returns authority_required, open approval.url, then retry that operation unchanged. For personal records such as weight, workouts, goals or todos, call tinycloud_apps_context first."
+        instructions: nativeOwner === void 0 ? surface === "public" ? "Use TinyCloud only for the user's requested task. Call tinycloud_connect first. If an operation returns authority_required, present approval.url and wait for the user's approval before retrying. If approval is declined, stop that operation. For personal records, call tinycloud_apps_context first. Never request or store passwords, API keys, authentication codes, government identifiers, payment-card data, or protected health information." : "Call tinycloud_connect first. If an operation returns authority_required, open approval.url, then retry that operation unchanged. For personal records such as weight, workouts, goals or todos, call tinycloud_apps_context first." : "Use only the user's requested connector-transcript data. The signed TinyCloud grant authorizes read-only SQL and transcript KV reads."
       }
     );
     registerTinyCloudTools(server, {
@@ -1714,10 +2125,15 @@ function createHostedSurface(config, resourceUrl, surface, tokenStatus) {
       explicitProfile: true,
       allowOwnerProfile: false,
       stateRoot,
-      beforeOperation: () => store.validateTenant(subject, ownerDids),
-      transformOperationResult: (result, invocation) => store.decorateAuthorityResult(subject, ownerDids, result, invocation)
+      ...nativeOwner === void 0 ? {} : {
+        allowedTools: ["tinycloud_sql_query", "tinycloud_kv_get"]
+      },
+      beforeOperation: nativeOwner === void 0 ? () => store.validateTenant(subject, ownerDids) : () => store.assertNativeGrantActive(nativeOwner),
+      ...nativeOwner === void 0 ? {
+        transformOperationResult: (result, invocation) => store.decorateAuthorityResult(subject, ownerDids, result, invocation)
+      } : {}
     }, validator);
-    registerConnectTool(server, validator, store, identity, surface);
+    if (nativeOwner === void 0) registerConnectTool(server, validator, store, identity, surface);
     return server;
   }, {
     legacy: "stateless",
@@ -1848,7 +2264,8 @@ Agentmap: ${new URL("/.well-known/ai-catalog.json", resourceUrl)}
           return publicMetadataCors(new Response(null, { status: 204 }), request);
         }
         if (request.method !== "GET") return methodNotAllowed("GET");
-        return publicMetadataCors(Response.json({
+        const identity = nativeServiceIdentityEnabled ? await store.nativeServiceIdentity().catch(() => void 0) : void 0;
+        const card = {
           $schema: "https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json",
           name: `xyz.tinycloud/${MCP_SERVER_NAME}`,
           title: "TinyCloud MCP",
@@ -1857,7 +2274,38 @@ Agentmap: ${new URL("/.well-known/ai-catalog.json", resourceUrl)}
           websiteUrl: "https://docs.tinycloud.xyz/cli/mcp",
           repository: { source: "github", url: "https://github.com/TinyCloudLabs/js-sdk", subfolder: "packages/mcp" },
           remotes: [{ type: "streamable-http", url: resourceUrl.toString() }]
-        }, { headers: { "cache-control": "public, max-age=300" } }), request);
+        };
+        if (identity !== void 0) {
+          card["x-tinycloud-native-auth"] = {
+            serviceDid: identity.serviceDid,
+            serviceDidField: "x-tinycloud-native-auth.serviceDid",
+            grantEndpoint: {
+              method: "POST",
+              path: "/native/grant",
+              body: { delegation: "serialized PortableDelegation JSON string" }
+            },
+            serviceCredentialHeader: NATIVE_SERVICE_CREDENTIAL_HEADER,
+            serviceCredentialEnv: "TC_MCP_NATIVE_SERVICE_CREDENTIAL",
+            ownerDidHeader: NATIVE_OWNER_DID_HEADER,
+            maxGrantLifetimeSeconds: NATIVE_GRANT_MAX_LIFETIME_SECONDS,
+            acceptedCapabilities: [
+              { service: "tinycloud.sql", space: "applications", path: "xyz.tinycloud.tinychat/connectors", actions: ["tinycloud.sql/read"] },
+              { service: "tinycloud.kv", space: "applications", path: "xyz.tinycloud.tinychat/connectors/", actions: ["tinycloud.kv/get", "tinycloud.kv/list"] }
+            ],
+            tools: ["tinycloud_sql_query", "tinycloud_kv_get"],
+            errors: {
+              required: NATIVE_GRANT_REQUIRED,
+              expired: NATIVE_GRANT_EXPIRED,
+              rejected: NATIVE_GRANT_REJECTED,
+              serviceUnauthorized: NATIVE_SERVICE_UNAUTHORIZED,
+              serviceUnavailable: NATIVE_SERVICE_UNAVAILABLE,
+              validationUnavailable: NATIVE_GRANT_VALIDATION_UNAVAILABLE
+            }
+          };
+        }
+        return publicMetadataCors(Response.json(card, {
+          headers: { "cache-control": "public, max-age=300" }
+        }), request);
       }
       if (url.pathname === "/llms.txt" && surface === "hosted") {
         return request.method === "GET" ? publicText(`# TinyCloud MCP
@@ -1955,6 +2403,73 @@ Local alternative: install \`${LOCAL_CLI_PACKAGE}\` and \`${LOCAL_MCP_PACKAGE}\`
           );
         }
       }
+      if (url.pathname === "/native/grant" && surface === "hosted") {
+        if (request.method !== "POST") return methodNotAllowed("POST");
+        if (request.headers.has("origin")) return json({ error: NATIVE_SERVICE_UNAUTHORIZED }, 403);
+        if (config.nativeServiceCredential === void 0) {
+          return json({ error: NATIVE_SERVICE_UNAVAILABLE }, 503);
+        }
+        if (!serviceCredentialMatches(
+          request.headers.get(NATIVE_SERVICE_CREDENTIAL_HEADER),
+          config.nativeServiceCredential
+        )) return json({ error: NATIVE_SERVICE_UNAUTHORIZED }, 403);
+        if (!request.headers.get("content-type")?.toLowerCase().startsWith("application/json")) {
+          return json({ error: NATIVE_GRANT_REJECTED }, 401);
+        }
+        const bodyText = await readBoundedBodyText(request, MAX_NATIVE_GRANT_BODY_BYTES);
+        if (bodyText === void 0) return json({ error: NATIVE_GRANT_REJECTED }, 401);
+        let body;
+        try {
+          body = JSON.parse(bodyText);
+        } catch {
+          return json({ error: NATIVE_GRANT_REJECTED }, 401);
+        }
+        if (typeof body !== "object" || body === null || Array.isArray(body) || !("delegation" in body)) {
+          return json({ error: NATIVE_GRANT_REJECTED }, 401);
+        }
+        const grantBody = body;
+        if (Object.keys(body).length !== 1 || typeof grantBody.delegation !== "string") {
+          return json({ error: NATIVE_GRANT_REJECTED }, 401);
+        }
+        try {
+          const accepted = await store.acceptNativeGrant(grantBody.delegation);
+          return json({
+            ownerDid: accepted.ownerDid,
+            serviceDid: accepted.serviceDid,
+            expiresAt: accepted.expiresAt
+          }, 201);
+        } catch (error) {
+          return nativeGrantErrorResponse(error);
+        }
+      }
+      if (url.pathname === resourceUrl.pathname && surface === "hosted" && (request.headers.has(NATIVE_SERVICE_CREDENTIAL_HEADER) || request.headers.has(NATIVE_OWNER_DID_HEADER))) {
+        if (config.nativeServiceCredential === void 0) {
+          return json({ error: NATIVE_SERVICE_UNAVAILABLE }, 503);
+        }
+        if (!serviceCredentialMatches(
+          request.headers.get(NATIVE_SERVICE_CREDENTIAL_HEADER),
+          config.nativeServiceCredential
+        )) return json({ error: NATIVE_SERVICE_UNAUTHORIZED }, 403);
+        if (request.headers.has("origin")) return json({ error: NATIVE_SERVICE_UNAUTHORIZED }, 403);
+        const ownerHeader = request.headers.get(NATIVE_OWNER_DID_HEADER);
+        if (ownerHeader === null || ownerHeader.length === 0) {
+          return json({ error: NATIVE_GRANT_REQUIRED }, 401);
+        }
+        const grant = await store.nativeGrantForOwner(ownerHeader);
+        if (grant.status !== "ok") {
+          const status = grant.status === "unavailable" ? 503 : 401;
+          const code = grant.status === "required" ? NATIVE_GRANT_REQUIRED : grant.status === "expired" ? NATIVE_GRANT_EXPIRED : grant.status === "unavailable" ? NATIVE_GRANT_VALIDATION_UNAVAILABLE : NATIVE_GRANT_REJECTED;
+          return json({ error: code }, status);
+        }
+        return handler.fetch(request, {
+          authInfo: {
+            token: "native-service",
+            clientId: "tinycloud-native",
+            scopes: [],
+            extra: { nativeOwnerDid: grant.ownerDid }
+          }
+        });
+      }
       if (url.pathname !== resourceUrl.pathname) return json({ error: "Not found" }, 404);
       const originFailure = validateOrigin(request, config.allowedOrigins);
       if (originFailure !== void 0) return originFailure;
@@ -2066,6 +2581,39 @@ function callbackCors(response, openkeyHost) {
   headers.set("vary", "Origin");
   return new Response(response.body, { status: response.status, headers });
 }
+async function readBoundedBodyText(request, maxBytes) {
+  const contentLength = request.headers.get("content-length");
+  if (contentLength !== null) {
+    const parsedLength = Number(contentLength);
+    if (Number.isFinite(parsedLength) && parsedLength > maxBytes) return void 0;
+  }
+  if (request.body === null) return "";
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel();
+        return void 0;
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk))).toString("utf8");
+}
+function nativeGrantErrorResponse(error) {
+  if (!(error instanceof NativeGrantValidationError)) {
+    return json({ error: NATIVE_SERVICE_UNAVAILABLE }, 503);
+  }
+  const unavailable = error.code === NATIVE_GRANT_VALIDATION_UNAVAILABLE || error.code === NATIVE_SERVICE_UNAVAILABLE;
+  return json({ error: error.code }, unavailable ? 503 : 401);
+}
 function json(value, status = 200) {
   return Response.json(value, { status, headers: { "cache-control": "no-store" } });
 }
@@ -2133,6 +2681,7 @@ async function main() {
     approvalTtlSeconds: positiveInteger(process.env.TC_MCP_APPROVAL_TTL_SECONDS, 300),
     delegationExpiry: process.env.TC_MCP_DELEGATION_EXPIRY ?? "1h",
     allowedOrigins: commaList(process.env.TC_MCP_ALLOWED_ORIGINS),
+    ...process.env.TC_MCP_NATIVE_SERVICE_CREDENTIAL === void 0 ? {} : { nativeServiceCredential: process.env.TC_MCP_NATIVE_SERVICE_CREDENTIAL },
     oauthMetadata,
     introspection: {
       endpoint: requiredUrl("TC_MCP_INTROSPECTION_URL").toString(),