@tinycloud/mcp 0.8.3-beta.22 → 0.8.3-beta.24

package/README.md

@@ -1,8 +1,10 @@
 # @tinycloud/mcp
 
-TinyCloud MCP server for delegated operations. The canonical remote connection
-is the hosted Streamable HTTP endpoint `https://mcp.tinycloud.xyz/mcp`, using
-OpenKey OAuth. Local stdio is the alternative when you want your MCP client to
+TinyCloud MCP server for delegated operations. Agents that can run the CLI
+should use https://agents.tinycloud.xyz/onboarding instead. Any agent that
+supports remote MCP connects to the hosted Streamable HTTP endpoint
+`https://mcp.tinycloud.xyz/mcp`, using OpenKey OAuth; Claude and ChatGPT are
+examples. Local stdio is the alternative when you want your MCP client to
 launch the server as a local process.
 Both transports use exact, revocable TinyCloud capabilities and never silently fall back to owner authority.
 
@@ -12,15 +14,15 @@ Availability depends on the ChatGPT plan and workspace settings. Follow
 
 ## Hosted Streamable HTTP
 
-In Claude, add the hosted URL as a remote MCP connector and complete OpenKey
-OAuth. Other remote clients can connect when they support Streamable HTTP and
-OAuth.
+Any agent that supports remote MCP can add the hosted URL and complete OpenKey
+OAuth when it supports Streamable HTTP and OAuth; in Claude, add it as a remote
+MCP connector. Meetings are available through the CLI.
 
 ## Local stdio requirements
 
-- Node.js 20 or newer
+- Node.js 22.20 or later
 - `@tinycloud/cli`
-- A delegated TinyCloud profile
+- A profile signed in with `tinycloud onboard`
 - A TinyCloud node running 1.6.0 or newer
 
 ## Hosted personal-record behavior
@@ -248,7 +250,7 @@ Configure a local stdio server in your MCP client:
   "mcpServers": {
     "tinycloud": {
       "command": "tinycloud-mcp",
-      "args": ["--profile", "agent"]
+      "args": ["--profile", "default", "--allow-owner-profile"]
     }
   }
 }
@@ -287,7 +289,7 @@ profile's stored session and reports, without reading any value, whether each
 named secret is `ready`, `pending` (with a Secret Manager `/request` setup
 link), or `consent_required` (no permission request is saved). When it cannot
 proceed, `error.details.recovery` names the next step: `sign_in` carries the
-persistent `tc --profile <P> auth login ...` command to run in a terminal, and
+persistent `tinycloud --profile <P> auth login ...` command to run in a terminal, and
 `complete_migration` carries `tool: "tinycloud_auth_capabilities"`, which you
 call once before retrying status.
 
@@ -327,23 +329,18 @@ are read-only and bounded; SQL execution accepts one parameterized `INSERT`,
 `UPDATE`, or `DELETE` and requires explicit acknowledgement that the delegated
 SQL write capability is database-wide.
 
-## Delegate bootstrap
+## Sign in
 
-A new `delegate-session` profile has a key but no TinyCloud authority. Complete
-the one-time bootstrap flow before starting MCP:
-
-1. Create an exact request with `tc auth request --cap ...`.
-2. Have the owner grant that request.
-3. Import the returned delegation with `tc auth import`.
-
-After bootstrap, MCP tools can create exact permission requests and import the
-request-bound delegations. Requests and imports persist, so approval and retry
-can happen in separate processes.
+Run `tinycloud onboard` once, then start
+`tinycloud-mcp --profile <that profile> --allow-owner-profile`. MCP tools can
+then create exact permission requests and import the request-bound
+delegations. Requests and imports persist, so approval and retry can happen in
+separate processes.
 
 Each imported delegation is stored with the request it was checked against.
 Every tool call reinstalls a stored compact-UCAN delegation only when its
 signed capabilities fit inside that request, so a delegation broader than its
-binding is refused before it is activated. `tc auth import` of an artifact
+binding is refused before it is activated. `tinycloud auth import` of an artifact
 with no request binds the delegation to exactly its own signed capabilities.
 Delegations stored by earlier releases are bound once, the same way, by the
 first command that restores the profile's session; after that, a record

package/dist/cli.cjs

@@ -483,7 +483,7 @@ function outcomeCode(result) {
 // package.json
 var package_default = {
   name: "@tinycloud/mcp",
-  version: "0.8.3-beta.22",
+  version: "0.8.3-beta.24",
   description: "TinyCloud delegated operations MCP server",
   keywords: [
     "tinycloud",
@@ -554,9 +554,9 @@ var package_default = {
   dependencies: {
     "@modelcontextprotocol/node": "2.0.0-beta.5",
     "@modelcontextprotocol/server": "2.0.0-beta.5",
-    "@tinycloud/node-sdk": "3.8.0-beta.20",
+    "@tinycloud/node-sdk": "3.8.0-beta.21",
     "@tinycloud/node-sdk-wasm": "1.7.8",
-    "@tinycloud/operations": "0.7.7-beta.19",
+    "@tinycloud/operations": "0.7.7-beta.20",
     jose: "6.2.4"
   },
   devDependencies: {

package/dist/cli.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli.ts","../src/server.ts","../src/tools.ts","../src/results.ts","../src/logging.ts","../src/schemas.ts","../package.json","../src/version.ts"],"sourcesContent":["import { basename } from \"node:path\";\n\nimport { resolveInvocationProfileName } from \"@tinycloud/operations/profile\";\n\nimport { serveTinyCloudMcp, MCP_VERSION } from \"./server.js\";\n\nexport interface ParsedCliOptions {\n  readonly profile?: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n  readonly help: boolean;\n  readonly version: boolean;\n}\n\nconst HELP = `TinyCloud delegated operations MCP server\n\nUsage: tinycloud-mcp [options]\n\nOptions:\n  --profile <name>       Pin the TinyCloud profile for this process\n  --allow-owner-profile  Allow data execution for an explicitly selected owner profile\n  --help                 Show this help\n  --version              Show the package version\n`;\n\nexport function parseCliOptions(arguments_: readonly string[]): ParsedCliOptions {\n  let profile: string | undefined;\n  let explicitProfile = false;\n  let allowOwnerProfile = false;\n  let help = false;\n  let version = false;\n\n  for (let index = 0; index < arguments_.length; index += 1) {\n    const argument = arguments_[index];\n    if (argument === \"--help\" || argument === \"-h\") {\n      help = true;\n      continue;\n    }\n    if (argument === \"--version\" || argument === \"-v\") {\n      version = true;\n      continue;\n    }\n    if (argument === \"--allow-owner-profile\") {\n      allowOwnerProfile = true;\n      continue;\n    }\n    if (argument === \"--profile\") {\n      const value = arguments_[index + 1];\n      if (value === undefined || value.startsWith(\"-\") || value.trim().length === 0) {\n        throw new Error(\"--profile requires a non-empty profile name.\");\n      }\n      profile = value;\n      explicitProfile = true;\n      index += 1;\n      continue;\n    }\n    if (argument?.startsWith(\"--profile=\")) {\n      const value = argument.slice(\"--profile=\".length);\n      if (value.trim().length === 0) throw new Error(\"--profile requires a non-empty profile name.\");\n      profile = value;\n      explicitProfile = true;\n      continue;\n    }\n    throw new Error(`Unknown option: ${argument}`);\n  }\n\n  return { profile, explicitProfile, allowOwnerProfile, help, version };\n}\n\nexport async function main(arguments_: readonly string[] = process.argv.slice(2)): Promise<number> {\n  let options: ParsedCliOptions;\n  try {\n    options = parseCliOptions(arguments_);\n  } catch (error) {\n    process.stderr.write(\"[tinycloud-mcp] Invalid command line.\\n\");\n    return 2;\n  }\n\n  if (options.help) {\n    process.stdout.write(HELP);\n    return 0;\n  }\n  if (options.version) {\n    process.stdout.write(`${MCP_VERSION}\\n`);\n    return 0;\n  }\n\n  let profile: string;\n  try {\n    profile = await resolveInvocationProfileName(options.profile);\n  } catch {\n    process.stderr.write(\"[tinycloud-mcp] Could not select a profile.\\n\");\n    return 2;\n  }\n\n  // The selected profile is now a value captured by the server closure. Every\n  // operation receives it explicitly and cannot re-read TC_PROFILE/config.\n  serveTinyCloudMcp({\n    profile,\n    explicitProfile: options.explicitProfile,\n    allowOwnerProfile: options.allowOwnerProfile,\n  });\n  return 0;\n}\n\nfunction isDirectInvocation(): boolean {\n  const argv = process.argv[1];\n  if (argv === undefined) return false;\n  return basename(argv) === \"cli.js\" || basename(argv) === \"cli.cjs\" || basename(argv) === \"tinycloud-mcp\";\n}\n\nif (isDirectInvocation()) {\n  void main().then((code) => {\n    if (code !== 0) process.exitCode = code;\n  }).catch(() => {\n    process.stderr.write(\"[tinycloud-mcp] Startup failed.\\n\");\n    process.exitCode = 1;\n  });\n}\n","import { McpServer } from \"@modelcontextprotocol/server\";\nimport { serveStdio, type StdioServerHandle } from \"@modelcontextprotocol/server/stdio\";\n\nimport { createJsonSchemaValidator, registerTinyCloudTools, type McpStartupSelection } from \"./tools.js\";\nimport { MCP_VERSION } from \"./version.js\";\n\nexport const MCP_SERVER_NAME = \"tinycloud-mcp\";\nexport { MCP_VERSION } from \"./version.js\";\n/** The stdio server is always the local surface. */\nexport type LocalMcpSelection = Omit<McpStartupSelection, \"surface\">;\n\nexport function createTinyCloudMcpServer(selection: LocalMcpSelection): McpServer {\n  const validator = createJsonSchemaValidator();\n  const server = new McpServer(\n    { name: MCP_SERVER_NAME, version: MCP_VERSION },\n    { jsonSchemaValidator: validator },\n  );\n  registerTinyCloudTools(server, { ...selection, surface: \"local\" }, validator);\n  return server;\n}\n\n/** Start the only supported MCP transport: local stdio. */\nexport function serveTinyCloudMcp(selection: LocalMcpSelection): StdioServerHandle {\n  return serveStdio(\n    () => createTinyCloudMcpServer(selection),\n    { onerror: () => writeBoundedDiagnostic(\"MCP transport error\") },\n  );\n}\n\nfunction writeBoundedDiagnostic(message: string): void {\n  process.stderr.write(`[tinycloud-mcp] ${message}\\n`);\n}\n","import { createRequire } from \"node:module\";\nimport { join } from \"node:path\";\n\nimport { fromJsonSchema, type McpServer, type ToolAnnotations } from \"@modelcontextprotocol/server\";\nimport { AjvJsonSchemaValidator } from \"@modelcontextprotocol/server/validators/ajv\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nimport { toMcpToolResult, type McpToolResult } from \"./results.js\";\nimport { logToolCall } from \"./logging.js\";\nimport { toMcpJsonSchema } from \"./schemas.js\";\n\nexport const TOOL_NAMES = [\n  \"tinycloud_status\",\n  \"tinycloud_auth_status\",\n  \"tinycloud_auth_capabilities\",\n  \"tinycloud_auth_request\",\n  \"tinycloud_auth_import\",\n  \"tinycloud_account_spaces_list\",\n  \"tinycloud_account_applications_list\",\n  \"tinycloud_kv_list\",\n  \"tinycloud_kv_get\",\n  \"tinycloud_kv_head\",\n  \"tinycloud_kv_put\",\n  \"tinycloud_kv_delete\",\n  \"tinycloud_knowledge_list\",\n  \"tinycloud_knowledge_read\",\n  \"tinycloud_sql_schema_inspect\",\n  \"tinycloud_sql_query\",\n  \"tinycloud_sql_execute\",\n  \"tinycloud_secrets_get\",\n  \"tinycloud_secrets_status\",\n  \"tinycloud_apps_context\",\n  \"tinycloud_apps_read\",\n  \"tinycloud_apps_write\",\n  \"tinycloud_apps_query\",\n] as const;\n\nexport type ToolName = (typeof TOOL_NAMES)[number];\n\n/** Private stdio/hosted surfaces and the restricted public plugin. */\nexport type McpSurface = \"local\" | \"hosted\" | \"public\";\n\nexport interface McpStartupSelection {\n  /** Which server registers the tools; bindings not on this surface are skipped. */\n  readonly surface: McpSurface;\n  readonly profile: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n  /** Absolute TinyCloud home used to isolate one hosted principal. */\n  readonly stateRoot?: string;\n  /** Optional allowlist for surfaces whose grant is narrower than hosted OAuth. */\n  readonly allowedTools?: readonly ToolName[];\n  /** Check node authority only when an operation needs the account. */\n  readonly beforeOperation?: () => Promise<void>;\n  /** Hosted transports may attach a browser approval URL to canonical results. */\n  readonly transformOperationResult?: (result: unknown, invocation: McpOperationInvocation) => Promise<unknown>;\n}\n\nexport interface McpOperationInvocation {\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly input: unknown;\n}\n\nexport interface McpInvocationTarget {\n  readonly profile: string;\n  readonly allowOwnerProfile?: true;\n  readonly stateRoot?: string;\n}\n\n/** Project one startup selection into the only owner-sensitive target shape. */\nexport function invocationTargetForMcp(\n  selection: Omit<McpStartupSelection, \"surface\">,\n): McpInvocationTarget {\n  return {\n    profile: selection.profile,\n    ...(selection.explicitProfile && selection.allowOwnerProfile\n      ? { allowOwnerProfile: true }\n      : {}),\n    ...(selection.stateRoot === undefined ? {} : { stateRoot: selection.stateRoot }),\n  };\n}\n\ninterface CatalogOperation {\n  readonly id: string;\n  readonly version: number;\n  readonly title: string;\n  readonly description: string;\n  readonly input: Record<string, unknown>;\n  readonly result: Record<string, unknown>;\n}\n\ninterface OperationsCatalog {\n  readonly stableErrors: readonly string[];\n  readonly operations: readonly CatalogOperation[];\n}\n\n// The require anchor is this module, never the consumer entrypoint. In ESM\n// tsup preserves import.meta.url; in CJS it rewrites the same module-relative\n// anchor to the generated __filename, so both formats stay in MCP's package\n// dependency boundary.\nconst packageRequire = createRequire(\n  typeof __dirname === \"string\" ? join(__dirname, \"tools.cjs\") : import.meta.url,\n);\nconst generatedCatalog = packageRequire(\n  \"@tinycloud/operations/operations.json\",\n) as OperationsCatalog;\nconst stableErrorCodes: Readonly<Record<string, true>> = Object.fromEntries(\n  generatedCatalog.stableErrors.map((code) => [code, true as const]),\n);\n\nexport interface ToolBinding {\n  readonly name: ToolName;\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly readOnlyHint: boolean;\n  readonly idempotentHint: boolean;\n  readonly destructiveHint: boolean;\n  readonly openWorldHint: boolean;\n  /** Surfaces that register this tool; omitted means private local and hosted surfaces only. */\n  readonly surfaces?: readonly McpSurface[];\n}\n\nconst PRIVATE_SURFACES: readonly McpSurface[] = [\"local\", \"hosted\"];\n\n/** The surfaces a binding is registered on. */\nexport function bindingSurfaces(binding: ToolBinding): readonly McpSurface[] {\n  return binding.surfaces ?? PRIVATE_SURFACES;\n}\n\nexport const TOOL_BINDINGS: readonly ToolBinding[] = [\n  {\n    name: \"tinycloud_status\",\n    operationId: \"tinycloud.status.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_status\",\n    operationId: \"tinycloud.auth.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_capabilities\",\n    operationId: \"tinycloud.auth.capabilities\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_request\",\n    operationId: \"tinycloud.auth.request\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_import\",\n    operationId: \"tinycloud.auth.import\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n    // Hosted delegations must arrive through the owner/request-bound OpenKey callback,\n    // not a caller-supplied import artifact.\n    surfaces: [\"local\"],\n  },\n  {\n    name: \"tinycloud_account_spaces_list\",\n    operationId: \"tinycloud.account.spaces.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_account_applications_list\",\n    operationId: \"tinycloud.account.applications.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_list\",\n    operationId: \"tinycloud.kv.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_get\",\n    operationId: \"tinycloud.kv.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_head\",\n    operationId: \"tinycloud.kv.head\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_put\",\n    operationId: \"tinycloud.kv.put\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_delete\",\n    operationId: \"tinycloud.kv.delete\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_knowledge_list\",\n    operationId: \"tinycloud.knowledge.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_knowledge_read\",\n    operationId: \"tinycloud.knowledge.read\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_schema_inspect\",\n    operationId: \"tinycloud.sql.schema.inspect\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_query\",\n    operationId: \"tinycloud.sql.query\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_execute\",\n    operationId: \"tinycloud.sql.execute\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_get\",\n    operationId: \"tinycloud.secrets.get\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_status\",\n    operationId: \"tinycloud.secrets.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n    // Hosted has no persistent reauthorization path for a revoked session\n    // yet (TC-896), so status is local/stdio only.\n    surfaces: [\"local\"],\n  },\n  {\n    name: \"tinycloud_apps_context\",\n    operationId: \"tinycloud.apps.context\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_read\",\n    operationId: \"tinycloud.apps.read\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_write\",\n    operationId: \"tinycloud.apps.write\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_query\",\n    operationId: \"tinycloud.apps.query\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n] as const;\n\n// Project once per process; never mutate the catalog shared with non-MCP consumers.\nconst definitions = new Map(generatedCatalog.operations.map((operation) => [\n  `${operation.id}@${operation.version}`,\n  {\n    ...operation,\n    input: toMcpJsonSchema(operation.input),\n    result: toMcpJsonSchema(operation.result),\n  },\n]));\n\nexport function createJsonSchemaValidator(): AjvJsonSchemaValidator {\n  return new AjvJsonSchemaValidator();\n}\n\nexport function registerTinyCloudTools(\n  server: McpServer,\n  selection: McpStartupSelection,\n  validator: AjvJsonSchemaValidator,\n): void {\n  const bindings = TOOL_BINDINGS.filter((binding) =>\n    bindingSurfaces(binding).includes(selection.surface) &&\n    (selection.allowedTools === undefined || selection.allowedTools.includes(binding.name)));\n  for (const binding of bindings) {\n    const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);\n    if (operation === undefined) {\n      throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);\n    }\n\n    const inputSchema = fromJsonSchema(\n      operation.input as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const outputSchema = fromJsonSchema(\n      operation.result as unknown as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const annotations: ToolAnnotations = {\n      readOnlyHint: binding.readOnlyHint,\n      idempotentHint: binding.idempotentHint,\n      destructiveHint: binding.destructiveHint,\n      openWorldHint: binding.openWorldHint,\n    };\n\n    server.registerTool(\n      binding.name,\n      {\n        title: operation.title,\n        description: operation.description,\n        inputSchema,\n        outputSchema,\n        annotations,\n      },\n      async (input: unknown): Promise<McpToolResult> => {\n        const startedAt = performance.now();\n        const metrics = { replayedGrants: 0 };\n        let code = \"INTERNAL_ERROR\";\n        try {\n          await selection.beforeOperation?.();\n          const result = await invokeOperation(\n            binding.operationId,\n            binding.operationVersion,\n            invocationTargetForMcp(selection),\n            input,\n            metrics,\n          );\n          const projected = selection.transformOperationResult === undefined\n            ? result\n            : await selection.transformOperationResult(result, {\n              operationId: binding.operationId,\n              operationVersion: binding.operationVersion,\n              input,\n            });\n          const response = toMcpToolResult(projected, bindings, {\n            surface: selection.surface === \"local\" ? \"local\" : \"hosted\",\n            readOnly: binding.readOnlyHint,\n            operationId: binding.operationId,\n          });\n          code = outcomeCode(response.structuredContent);\n          return response;\n        } finally {\n          if (selection.surface !== \"local\") {\n            logToolCall(binding.name, code, startedAt, metrics.replayedGrants);\n          }\n        }\n      },\n    );\n  }\n}\n\nfunction outcomeCode(result: McpToolResult[\"structuredContent\"]): string {\n  if (result.status === \"error\") {\n    const error = result.error as { code?: unknown } | undefined;\n    return typeof error?.code === \"string\" && Object.hasOwn(stableErrorCodes, error.code) ? error.code : \"INTERNAL_ERROR\";\n  }\n  if (result.status !== \"ok\") return result.status;\n  const output = result.output as { outcome?: unknown; ops?: readonly { outcome?: unknown }[] } | undefined;\n  if (output?.outcome === \"COPY_PARTIAL\") return \"COPY_PARTIAL\";\n  if (Array.isArray(output?.ops) && output.ops.some((op) => op.outcome !== \"ok\")) return \"PARTIAL\";\n  return \"ok\";\n}\n\nexport function toolBindingsForTest(): readonly ToolBinding[] {\n  return TOOL_BINDINGS;\n}\n","/** MCP preserves the canonical envelope; hosted clients also receive readable JSON. */\nexport interface CanonicalOperationResult {\n  readonly status: \"ok\" | \"authority_required\" | \"setup_required\" | \"error\";\n  readonly [key: string]: unknown;\n}\n\nexport interface McpToolResult extends CallToolResult {\n  readonly content: [{ readonly type: \"text\"; readonly text: string }];\n  readonly structuredContent: CanonicalOperationResult;\n}\n\n/** The binding fields needed to name the tool that runs an operation. */\nexport interface RecoveryToolBinding {\n  readonly name: string;\n  readonly operationId: string;\n}\n\nexport interface McpToolResultOptions {\n  readonly surface?: \"hosted\" | \"local\";\n  readonly readOnly?: boolean;\n  /** Trusted operation identity from the tool binding, not operation output. */\n  readonly operationId?: string;\n}\n\nexport function toMcpToolResult(\n  result: unknown,\n  bindings: readonly RecoveryToolBinding[] = [],\n  options: McpToolResultOptions = {},\n): McpToolResult {\n  let canonical: CanonicalOperationResult = isCanonicalOperationResult(result)\n    ? withRecoveryTool(result, bindings)\n    : {\n      status: \"error\",\n      operation: {},\n      context: {},\n      error: { code: \"INTERNAL_ERROR\" },\n    };\n  let serialized: string | undefined;\n  if (options.surface === \"hosted\") {\n    serialized = JSON.stringify(canonical);\n    if (\n      (options.readOnly === true ||\n        options.operationId === \"tinycloud.apps.context\" ||\n        options.operationId === \"tinycloud.apps.query\") &&\n      serialized.length > 100_000\n    ) {\n      const sql = options.operationId?.startsWith(\"tinycloud.sql.\") ||\n        options.operationId === \"tinycloud.apps.query\";\n      canonical = {\n        status: \"error\",\n        operation: canonical.operation,\n        context: canonical.context,\n        error: {\n          code: sql ? \"SQL_RESULT_LIMIT_EXCEEDED\" : \"KV_RESPONSE_TOO_LARGE\",\n          message: sql\n            ? \"The result exceeds 100,000 characters. Select fewer columns or rows, add a WHERE filter or a smaller LIMIT, or aggregate the data.\"\n            : \"The result exceeds 100,000 characters. Request fewer keys, narrow the prefix, or use a smaller page size.\",\n          retryable: false,\n        },\n      };\n      serialized = JSON.stringify(canonical);\n    }\n  }\n\n  return {\n    content: [{\n      type: \"text\",\n      text: resultSummary(canonical.status) +\n        (serialized !== undefined && !(options.operationId === \"tinycloud.secrets.get\" && canonical.status === \"ok\")\n          ? `\\n${serialized}` : \"\"),\n    }],\n    structuredContent: canonical,\n  };\n}\n\n/**\n * A redacted `complete_migration` recovery names an operation; MCP clients\n * call tools, so name the bound tool. `tool` comes from the code-owned binding\n * table only, never from operation data, and is added after redaction. An\n * operationId with no binding gets no `tool`.\n */\nfunction withRecoveryTool(\n  result: CanonicalOperationResult,\n  bindings: readonly RecoveryToolBinding[],\n): CanonicalOperationResult {\n  if (result.status !== \"error\") return result;\n  // The kernel's redaction already constrained `error.details.recovery` to a\n  // safe recovery object; only its discriminant and operationId are read here.\n  const error = result.error as\n    | { readonly details?: { readonly recovery?: { readonly action?: unknown; readonly operationId?: unknown } } }\n    | undefined;\n  const recovery = error?.details?.recovery;\n  if (recovery?.action !== \"complete_migration\") return result;\n  const binding = bindings.find((candidate) => candidate.operationId === recovery.operationId);\n  if (binding === undefined) return result;\n  return {\n    ...result,\n    error: { ...error, details: { ...error?.details, recovery: { ...recovery, tool: binding.name } } },\n  };\n}\n\n/** The canonical envelope immediately before MCP protocol serialization. */\nexport function canonicalMcpAdapterResult(result: unknown): CanonicalOperationResult {\n  return toMcpToolResult(result).structuredContent;\n}\n\nfunction isCanonicalOperationResult(value: unknown): value is CanonicalOperationResult {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const status = (value as { status?: unknown }).status;\n  return status === \"ok\" ||\n    status === \"authority_required\" ||\n    status === \"setup_required\" ||\n    status === \"error\";\n}\n\nfunction resultSummary(status: CanonicalOperationResult[\"status\"]): string {\n  switch (status) {\n    case \"ok\":\n      return \"TinyCloud operation completed; use the structured result.\";\n    case \"authority_required\":\n      return \"TinyCloud authority is required; use the structured request and approval action.\";\n    case \"setup_required\":\n      return \"TinyCloud setup is required; use the structured setup action.\";\n    case \"error\":\n      return \"TinyCloud operation failed; use the structured error.\";\n  }\n}\nimport type { CallToolResult } from \"@modelcontextprotocol/server\";\n","/** Only code-owned tool names/codes and numeric counters reach this sink. */\nexport function logToolCall(\n  tool: string,\n  code: string,\n  startedAt: number,\n  replayedGrants: number,\n): void {\n  process.stderr.write(`${JSON.stringify({\n    tool,\n    code,\n    durationMs: Math.max(0, Math.round(performance.now() - startedAt)),\n    replayedGrants,\n  })}\\n`);\n}\n","type JsonSchema = boolean | Record<string, unknown>;\n\nconst DRAFT_7 = \"http://json-schema.org/draft-07/schema#\";\nconst DRAFT_2020_12 = \"https://json-schema.org/draft/2020-12/schema\";\nconst schemaMaps = new Set([\"properties\", \"patternProperties\", \"definitions\", \"$defs\"]);\nconst schemaArrays = new Set([\"allOf\", \"anyOf\", \"oneOf\"]);\nconst schemaValues = new Set([\n  \"additionalProperties\", \"items\", \"contains\", \"propertyNames\", \"not\", \"if\", \"then\", \"else\",\n]);\n\n/** Project the catalog's shared Draft-07/2020-12 vocabulary without changing its validation rules. */\nexport function toMcpJsonSchema(schema: Record<string, unknown>): Record<string, unknown>;\nexport function toMcpJsonSchema(schema: JsonSchema): JsonSchema;\nexport function toMcpJsonSchema(schema: JsonSchema): JsonSchema {\n  if (typeof schema === \"boolean\") return schema;\n  // These forms need a semantic migration, not just a dialect declaration. The\n  // generated catalog does not use them; fail closed if that contract changes.\n  if (Array.isArray(schema.items) || \"additionalItems\" in schema || \"dependencies\" in schema ||\n    (\"$ref\" in schema && Object.keys(schema).some((key) => key !== \"$ref\"))) {\n    throw new Error(\"The operations schema needs a semantic migration to JSON Schema 2020-12.\");\n  }\n\n  const projected: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(schema)) {\n    if (key === \"$schema\") {\n      if (value !== DRAFT_7) throw new Error(`Unsupported operations schema dialect: ${String(value)}.`);\n      projected[key] = DRAFT_2020_12;\n    } else if (schemaMaps.has(key)) {\n      projected[key] = Object.fromEntries(Object.entries(value as Record<string, JsonSchema>)\n        .map(([name, child]) => [name, toMcpJsonSchema(child)]));\n    } else if (schemaArrays.has(key)) {\n      projected[key] = (value as JsonSchema[]).map(toMcpJsonSchema);\n    } else if (schemaValues.has(key)) {\n      projected[key] = toMcpJsonSchema(value as JsonSchema);\n    } else {\n      // Descriptions, defaults, examples and const/enum values are data, not schemas.\n      projected[key] = value;\n    }\n  }\n  return projected;\n}\n","{\n  \"name\": \"@tinycloud/mcp\",\n  \"version\": \"0.8.3-beta.22\",\n  \"description\": \"TinyCloud delegated operations MCP server\",\n  \"keywords\": [\n    \"tinycloud\",\n    \"mcp\",\n    \"model-context-protocol\",\n    \"agents\",\n    \"delegation\",\n    \"ucan\",\n    \"kv\",\n    \"sqlite\"\n  ],\n  \"author\": \"TinyCloud, Inc.\",\n  \"license\": \"EGPL\",\n  \"type\": \"module\",\n  \"main\": \"dist/index.cjs\",\n  \"module\": \"dist/index.js\",\n  \"types\": \"dist/index.d.ts\",\n  \"bin\": {\n    \"tinycloud-mcp\": \"./bin/tinycloud-mcp\",\n    \"tinycloud-mcp-http\": \"./bin/tinycloud-mcp-http\"\n  },\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    },\n    \"./server\": {\n      \"types\": \"./dist/server.d.ts\",\n      \"import\": \"./dist/server.js\",\n      \"require\": \"./dist/server.cjs\"\n    },\n    \"./tools\": {\n      \"types\": \"./dist/tools.d.ts\",\n      \"import\": \"./dist/tools.js\",\n      \"require\": \"./dist/tools.cjs\"\n    },\n    \"./results\": {\n      \"types\": \"./dist/results.d.ts\",\n      \"import\": \"./dist/results.js\",\n      \"require\": \"./dist/results.cjs\"\n    },\n    \"./http\": {\n      \"types\": \"./dist/http.d.ts\",\n      \"import\": \"./dist/http.js\",\n      \"require\": \"./dist/http.cjs\"\n    }\n  },\n  \"files\": [\n    \"dist\",\n    \"bin\",\n    \"generated\",\n    \"skills\"\n  ],\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"clean\": \"rm -rf dist\",\n    \"test\": \"bun run build && bun scripts/test.ts && bun run check:generated\",\n    \"test:stdio\": \"bun run build && bun test src/stdio.test.ts\",\n    \"typecheck\": \"tsc -p tsconfig.json\",\n    \"start:http\": \"node dist/http-cli.js\",\n    \"generate\": \"bun scripts/generate.ts\",\n    \"check:generated\": \"bun scripts/generate.ts --check\"\n  },\n  \"dependencies\": {\n    \"@modelcontextprotocol/node\": \"2.0.0-beta.5\",\n    \"@modelcontextprotocol/server\": \"2.0.0-beta.5\",\n    \"@tinycloud/node-sdk\": \"3.8.0-beta.20\",\n    \"@tinycloud/node-sdk-wasm\": \"1.7.8\",\n    \"@tinycloud/operations\": \"0.7.7-beta.19\",\n    \"jose\": \"6.2.4\"\n  },\n  \"devDependencies\": {\n    \"@modelcontextprotocol/client\": \"2.0.0-beta.5\",\n    \"@types/node\": \"^20\",\n    \"tsup\": \"^8.0.0\",\n    \"typescript\": \"^5.9.3\"\n  },\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/TinyCloudLabs/js-sdk\"\n  },\n  \"homepage\": \"https://docs.tinycloud.xyz/cli/mcp\"\n}\n","import packageMetadata from \"../package.json\";\n\nexport const MCP_VERSION = packageMetadata.version;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAA,oBAAyB;AAEzB,qBAA6C;;;ACF7C,IAAAC,iBAA0B;AAC1B,mBAAmD;;;ACDnD,yBAA8B;AAC9B,uBAAqB;AAErB,oBAAqE;AACrE,iBAAuC;AACvC,wBAAgC;;;ACmBzB,SAAS,gBACd,QACA,WAA2C,CAAC,GAC5C,UAAgC,CAAC,GAClB;AACf,MAAI,YAAsC,2BAA2B,MAAM,IACvE,iBAAiB,QAAQ,QAAQ,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,WAAW,CAAC;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC;AACF,MAAI;AACJ,MAAI,QAAQ,YAAY,UAAU;AAChC,iBAAa,KAAK,UAAU,SAAS;AACrC,SACG,QAAQ,aAAa,QACpB,QAAQ,gBAAgB,4BACxB,QAAQ,gBAAgB,2BAC1B,WAAW,SAAS,KACpB;AACA,YAAM,MAAM,QAAQ,aAAa,WAAW,gBAAgB,KAC1D,QAAQ,gBAAgB;AAC1B,kBAAY;AAAA,QACV,QAAQ;AAAA,QACR,WAAW,UAAU;AAAA,QACrB,SAAS,UAAU;AAAA,QACnB,OAAO;AAAA,UACL,MAAM,MAAM,8BAA8B;AAAA,UAC1C,SAAS,MACL,uIACA;AAAA,UACJ,WAAW;AAAA,QACb;AAAA,MACF;AACA,mBAAa,KAAK,UAAU,SAAS;AAAA,IACvC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,CAAC;AAAA,MACR,MAAM;AAAA,MACN,MAAM,cAAc,UAAU,MAAM,KACjC,eAAe,UAAa,EAAE,QAAQ,gBAAgB,2BAA2B,UAAU,WAAW,QACnG;AAAA,EAAK,UAAU,KAAK;AAAA,IAC5B,CAAC;AAAA,IACD,mBAAmB;AAAA,EACrB;AACF;AAQA,SAAS,iBACP,QACA,UAC0B;AAC1B,MAAI,OAAO,WAAW,QAAS,QAAO;AAGtC,QAAM,QAAQ,OAAO;AAGrB,QAAM,WAAW,OAAO,SAAS;AACjC,MAAI,UAAU,WAAW,qBAAsB,QAAO;AACtD,QAAM,UAAU,SAAS,KAAK,CAAC,cAAc,UAAU,gBAAgB,SAAS,WAAW;AAC3F,MAAI,YAAY,OAAW,QAAO;AAClC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,EAAE,GAAG,OAAO,SAAS,EAAE,GAAG,OAAO,SAAS,UAAU,EAAE,GAAG,UAAU,MAAM,QAAQ,KAAK,EAAE,EAAE;AAAA,EACnG;AACF;AAOA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAU,MAA+B;AAC/C,SAAO,WAAW,QAChB,WAAW,wBACX,WAAW,oBACX,WAAW;AACf;AAEA,SAAS,cAAc,QAAoD;AACzE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;;;AC7HO,SAAS,YACd,MACA,MACA,WACA,gBACM;AACN,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU;AAAA,IACrC;AAAA,IACA;AAAA,IACA,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS,CAAC;AAAA,IACjE;AAAA,EACF,CAAC,CAAC;AAAA,CAAI;AACR;;;ACXA,IAAM,UAAU;AAChB,IAAM,gBAAgB;AACtB,IAAM,aAAa,oBAAI,IAAI,CAAC,cAAc,qBAAqB,eAAe,OAAO,CAAC;AACtF,IAAM,eAAe,oBAAI,IAAI,CAAC,SAAS,SAAS,OAAO,CAAC;AACxD,IAAM,eAAe,oBAAI,IAAI;AAAA,EAC3B;AAAA,EAAwB;AAAA,EAAS;AAAA,EAAY;AAAA,EAAiB;AAAA,EAAO;AAAA,EAAM;AAAA,EAAQ;AACrF,CAAC;AAKM,SAAS,gBAAgB,QAAgC;AAC9D,MAAI,OAAO,WAAW,UAAW,QAAO;AAGxC,MAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,qBAAqB,UAAU,kBAAkB,UACjF,UAAU,UAAU,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,QAAQ,QAAQ,MAAM,GAAI;AACzE,UAAM,IAAI,MAAM,0EAA0E;AAAA,EAC5F;AAEA,QAAM,YAAqC,CAAC;AAC5C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,WAAW;AACrB,UAAI,UAAU,QAAS,OAAM,IAAI,MAAM,0CAA0C,OAAO,KAAK,CAAC,GAAG;AACjG,gBAAU,GAAG,IAAI;AAAA,IACnB,WAAW,WAAW,IAAI,GAAG,GAAG;AAC9B,gBAAU,GAAG,IAAI,OAAO,YAAY,OAAO,QAAQ,KAAmC,EACnF,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,gBAAgB,KAAK,CAAC,CAAC,CAAC;AAAA,IAC3D,WAAW,aAAa,IAAI,GAAG,GAAG;AAChC,gBAAU,GAAG,IAAK,MAAuB,IAAI,eAAe;AAAA,IAC9D,WAAW,aAAa,IAAI,GAAG,GAAG;AAChC,gBAAU,GAAG,IAAI,gBAAgB,KAAmB;AAAA,IACtD,OAAO;AAEL,gBAAU,GAAG,IAAI;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;;;AHxCA;AAuEO,SAAS,uBACd,WACqB;AACrB,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,GAAI,UAAU,mBAAmB,UAAU,oBACvC,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,IACL,GAAI,UAAU,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,UAAU,UAAU;AAAA,EAChF;AACF;AAoBA,IAAM,qBAAiB;AAAA,EACrB,OAAO,cAAc,eAAW,uBAAK,WAAW,WAAW,IAAI,YAAY;AAC7E;AACA,IAAM,mBAAmB;AAAA,EACvB;AACF;AACA,IAAM,mBAAmD,OAAO;AAAA,EAC9D,iBAAiB,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,IAAa,CAAC;AACnE;AAcA,IAAM,mBAA0C,CAAC,SAAS,QAAQ;AAG3D,SAAS,gBAAgB,SAA6C;AAC3E,SAAO,QAAQ,YAAY;AAC7B;AAEO,IAAM,gBAAwC;AAAA,EACnD;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA;AAAA;AAAA,IAGf,UAAU,CAAC,OAAO;AAAA,EACpB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA;AAAA;AAAA,IAGf,UAAU,CAAC,OAAO;AAAA,EACpB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AACF;AAGA,IAAM,cAAc,IAAI,IAAI,iBAAiB,WAAW,IAAI,CAAC,cAAc;AAAA,EACzE,GAAG,UAAU,EAAE,IAAI,UAAU,OAAO;AAAA,EACpC;AAAA,IACE,GAAG;AAAA,IACH,OAAO,gBAAgB,UAAU,KAAK;AAAA,IACtC,QAAQ,gBAAgB,UAAU,MAAM;AAAA,EAC1C;AACF,CAAC,CAAC;AAEK,SAAS,4BAAoD;AAClE,SAAO,IAAI,kCAAuB;AACpC;AAEO,SAAS,uBACd,QACA,WACA,WACM;AACN,QAAM,WAAW,cAAc,OAAO,CAAC,YACrC,gBAAgB,OAAO,EAAE,SAAS,UAAU,OAAO,MAClD,UAAU,iBAAiB,UAAa,UAAU,aAAa,SAAS,QAAQ,IAAI,EAAE;AACzF,aAAW,WAAW,UAAU;AAC9B,UAAM,YAAY,YAAY,IAAI,GAAG,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,EAAE;AACtF,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI,MAAM,2CAA2C,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,GAAG;AAAA,IAC/G;AAEA,UAAM,kBAAc;AAAA,MAClB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,mBAAe;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,cAA+B;AAAA,MACnC,cAAc,QAAQ;AAAA,MACtB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB,eAAe,QAAQ;AAAA,IACzB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,QACE,OAAO,UAAU;AAAA,QACjB,aAAa,UAAU;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,OAAO,UAA2C;AAChD,cAAM,YAAY,YAAY,IAAI;AAClC,cAAM,UAAU,EAAE,gBAAgB,EAAE;AACpC,YAAI,OAAO;AACX,YAAI;AACF,gBAAM,UAAU,kBAAkB;AAClC,gBAAM,SAAS,UAAM;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,uBAAuB,SAAS;AAAA,YAChC;AAAA,YACA;AAAA,UACF;AACA,gBAAM,YAAY,UAAU,6BAA6B,SACrD,SACA,MAAM,UAAU,yBAAyB,QAAQ;AAAA,YACjD,aAAa,QAAQ;AAAA,YACrB,kBAAkB,QAAQ;AAAA,YAC1B;AAAA,UACF,CAAC;AACH,gBAAM,WAAW,gBAAgB,WAAW,UAAU;AAAA,YACpD,SAAS,UAAU,YAAY,UAAU,UAAU;AAAA,YACnD,UAAU,QAAQ;AAAA,YAClB,aAAa,QAAQ;AAAA,UACvB,CAAC;AACD,iBAAO,YAAY,SAAS,iBAAiB;AAC7C,iBAAO;AAAA,QACT,UAAE;AACA,cAAI,UAAU,YAAY,SAAS;AACjC,wBAAY,QAAQ,MAAM,MAAM,WAAW,QAAQ,cAAc;AAAA,UACnE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,YAAY,QAAoD;AACvE,MAAI,OAAO,WAAW,SAAS;AAC7B,UAAM,QAAQ,OAAO;AACrB,WAAO,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,kBAAkB,MAAM,IAAI,IAAI,MAAM,OAAO;AAAA,EACvG;AACA,MAAI,OAAO,WAAW,KAAM,QAAO,OAAO;AAC1C,QAAM,SAAS,OAAO;AACtB,MAAI,QAAQ,YAAY,eAAgB,QAAO;AAC/C,MAAI,MAAM,QAAQ,QAAQ,GAAG,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,GAAG,YAAY,IAAI,EAAG,QAAO;AACvF,SAAO;AACT;;;AIjcA;AAAA,EACE,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,aAAe;AAAA,EACf,UAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAU;AAAA,EACV,SAAW;AAAA,EACX,MAAQ;AAAA,EACR,MAAQ;AAAA,EACR,QAAU;AAAA,EACV,OAAS;AAAA,EACT,KAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,sBAAsB;AAAA,EACxB;AAAA,EACA,SAAW;AAAA,IACT,KAAK;AAAA,MACH,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,YAAY;AAAA,MACV,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACT,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,aAAa;AAAA,MACX,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,MACR,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,OAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,SAAW;AAAA,IACT,MAAQ;AAAA,EACV;AAAA,EACA,SAAW;AAAA,IACT,OAAS;AAAA,IACT,OAAS;AAAA,IACT,MAAQ;AAAA,IACR,cAAc;AAAA,IACd,WAAa;AAAA,IACb,cAAc;AAAA,IACd,UAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAAA,EACA,cAAgB;AAAA,IACd,8BAA8B;AAAA,IAC9B,gCAAgC;AAAA,IAChC,uBAAuB;AAAA,IACvB,4BAA4B;AAAA,IAC5B,yBAAyB;AAAA,IACzB,MAAQ;AAAA,EACV;AAAA,EACA,iBAAmB;AAAA,IACjB,gCAAgC;AAAA,IAChC,eAAe;AAAA,IACf,MAAQ;AAAA,IACR,YAAc;AAAA,EAChB;AAAA,EACA,YAAc;AAAA,IACZ,MAAQ;AAAA,IACR,KAAO;AAAA,EACT;AAAA,EACA,UAAY;AACd;;;ACvFO,IAAM,cAAc,gBAAgB;;;ANIpC,IAAM,kBAAkB;AAKxB,SAAS,yBAAyB,WAAyC;AAChF,QAAM,YAAY,0BAA0B;AAC5C,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,iBAAiB,SAAS,YAAY;AAAA,IAC9C,EAAE,qBAAqB,UAAU;AAAA,EACnC;AACA,yBAAuB,QAAQ,EAAE,GAAG,WAAW,SAAS,QAAQ,GAAG,SAAS;AAC5E,SAAO;AACT;AAGO,SAAS,kBAAkB,WAAiD;AACjF,aAAO;AAAA,IACL,MAAM,yBAAyB,SAAS;AAAA,IACxC,EAAE,SAAS,MAAM,uBAAuB,qBAAqB,EAAE;AAAA,EACjE;AACF;AAEA,SAAS,uBAAuB,SAAuB;AACrD,UAAQ,OAAO,MAAM,mBAAmB,OAAO;AAAA,CAAI;AACrD;;;ADjBA,IAAM,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWN,SAAS,gBAAgB,YAAiD;AAC/E,MAAI;AACJ,MAAI,kBAAkB;AACtB,MAAI,oBAAoB;AACxB,MAAI,OAAO;AACX,MAAI,UAAU;AAEd,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS,GAAG;AACzD,UAAM,WAAW,WAAW,KAAK;AACjC,QAAI,aAAa,YAAY,aAAa,MAAM;AAC9C,aAAO;AACP;AAAA,IACF;AACA,QAAI,aAAa,eAAe,aAAa,MAAM;AACjD,gBAAU;AACV;AAAA,IACF;AACA,QAAI,aAAa,yBAAyB;AACxC,0BAAoB;AACpB;AAAA,IACF;AACA,QAAI,aAAa,aAAa;AAC5B,YAAM,QAAQ,WAAW,QAAQ,CAAC;AAClC,UAAI,UAAU,UAAa,MAAM,WAAW,GAAG,KAAK,MAAM,KAAK,EAAE,WAAW,GAAG;AAC7E,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,gBAAU;AACV,wBAAkB;AAClB,eAAS;AACT;AAAA,IACF;AACA,QAAI,UAAU,WAAW,YAAY,GAAG;AACtC,YAAM,QAAQ,SAAS,MAAM,aAAa,MAAM;AAChD,UAAI,MAAM,KAAK,EAAE,WAAW,EAAG,OAAM,IAAI,MAAM,8CAA8C;AAC7F,gBAAU;AACV,wBAAkB;AAClB;AAAA,IACF;AACA,UAAM,IAAI,MAAM,mBAAmB,QAAQ,EAAE;AAAA,EAC/C;AAEA,SAAO,EAAE,SAAS,iBAAiB,mBAAmB,MAAM,QAAQ;AACtE;AAEA,eAAsB,KAAK,aAAgC,QAAQ,KAAK,MAAM,CAAC,GAAoB;AACjG,MAAI;AACJ,MAAI;AACF,cAAU,gBAAgB,UAAU;AAAA,EACtC,SAAS,OAAO;AACd,YAAQ,OAAO,MAAM,yCAAyC;AAC9D,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,MAAM;AAChB,YAAQ,OAAO,MAAM,IAAI;AACzB,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,SAAS;AACnB,YAAQ,OAAO,MAAM,GAAG,WAAW;AAAA,CAAI;AACvC,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,UAAM,6CAA6B,QAAQ,OAAO;AAAA,EAC9D,QAAQ;AACN,YAAQ,OAAO,MAAM,+CAA+C;AACpE,WAAO;AAAA,EACT;AAIA,oBAAkB;AAAA,IAChB;AAAA,IACA,iBAAiB,QAAQ;AAAA,IACzB,mBAAmB,QAAQ;AAAA,EAC7B,CAAC;AACD,SAAO;AACT;AAEA,SAAS,qBAA8B;AACrC,QAAM,OAAO,QAAQ,KAAK,CAAC;AAC3B,MAAI,SAAS,OAAW,QAAO;AAC/B,aAAO,4BAAS,IAAI,MAAM,gBAAY,4BAAS,IAAI,MAAM,iBAAa,4BAAS,IAAI,MAAM;AAC3F;AAEA,IAAI,mBAAmB,GAAG;AACxB,OAAK,KAAK,EAAE,KAAK,CAAC,SAAS;AACzB,QAAI,SAAS,EAAG,SAAQ,WAAW;AAAA,EACrC,CAAC,EAAE,MAAM,MAAM;AACb,YAAQ,OAAO,MAAM,mCAAmC;AACxD,YAAQ,WAAW;AAAA,EACrB,CAAC;AACH;","names":["import_node_path","import_server"]}
+{"version":3,"sources":["../src/cli.ts","../src/server.ts","../src/tools.ts","../src/results.ts","../src/logging.ts","../src/schemas.ts","../package.json","../src/version.ts"],"sourcesContent":["import { basename } from \"node:path\";\n\nimport { resolveInvocationProfileName } from \"@tinycloud/operations/profile\";\n\nimport { serveTinyCloudMcp, MCP_VERSION } from \"./server.js\";\n\nexport interface ParsedCliOptions {\n  readonly profile?: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n  readonly help: boolean;\n  readonly version: boolean;\n}\n\nconst HELP = `TinyCloud delegated operations MCP server\n\nUsage: tinycloud-mcp [options]\n\nOptions:\n  --profile <name>       Pin the TinyCloud profile for this process\n  --allow-owner-profile  Allow data execution for an explicitly selected owner profile\n  --help                 Show this help\n  --version              Show the package version\n`;\n\nexport function parseCliOptions(arguments_: readonly string[]): ParsedCliOptions {\n  let profile: string | undefined;\n  let explicitProfile = false;\n  let allowOwnerProfile = false;\n  let help = false;\n  let version = false;\n\n  for (let index = 0; index < arguments_.length; index += 1) {\n    const argument = arguments_[index];\n    if (argument === \"--help\" || argument === \"-h\") {\n      help = true;\n      continue;\n    }\n    if (argument === \"--version\" || argument === \"-v\") {\n      version = true;\n      continue;\n    }\n    if (argument === \"--allow-owner-profile\") {\n      allowOwnerProfile = true;\n      continue;\n    }\n    if (argument === \"--profile\") {\n      const value = arguments_[index + 1];\n      if (value === undefined || value.startsWith(\"-\") || value.trim().length === 0) {\n        throw new Error(\"--profile requires a non-empty profile name.\");\n      }\n      profile = value;\n      explicitProfile = true;\n      index += 1;\n      continue;\n    }\n    if (argument?.startsWith(\"--profile=\")) {\n      const value = argument.slice(\"--profile=\".length);\n      if (value.trim().length === 0) throw new Error(\"--profile requires a non-empty profile name.\");\n      profile = value;\n      explicitProfile = true;\n      continue;\n    }\n    throw new Error(`Unknown option: ${argument}`);\n  }\n\n  return { profile, explicitProfile, allowOwnerProfile, help, version };\n}\n\nexport async function main(arguments_: readonly string[] = process.argv.slice(2)): Promise<number> {\n  let options: ParsedCliOptions;\n  try {\n    options = parseCliOptions(arguments_);\n  } catch (error) {\n    process.stderr.write(\"[tinycloud-mcp] Invalid command line.\\n\");\n    return 2;\n  }\n\n  if (options.help) {\n    process.stdout.write(HELP);\n    return 0;\n  }\n  if (options.version) {\n    process.stdout.write(`${MCP_VERSION}\\n`);\n    return 0;\n  }\n\n  let profile: string;\n  try {\n    profile = await resolveInvocationProfileName(options.profile);\n  } catch {\n    process.stderr.write(\"[tinycloud-mcp] Could not select a profile.\\n\");\n    return 2;\n  }\n\n  // The selected profile is now a value captured by the server closure. Every\n  // operation receives it explicitly and cannot re-read TC_PROFILE/config.\n  serveTinyCloudMcp({\n    profile,\n    explicitProfile: options.explicitProfile,\n    allowOwnerProfile: options.allowOwnerProfile,\n  });\n  return 0;\n}\n\nfunction isDirectInvocation(): boolean {\n  const argv = process.argv[1];\n  if (argv === undefined) return false;\n  return basename(argv) === \"cli.js\" || basename(argv) === \"cli.cjs\" || basename(argv) === \"tinycloud-mcp\";\n}\n\nif (isDirectInvocation()) {\n  void main().then((code) => {\n    if (code !== 0) process.exitCode = code;\n  }).catch(() => {\n    process.stderr.write(\"[tinycloud-mcp] Startup failed.\\n\");\n    process.exitCode = 1;\n  });\n}\n","import { McpServer } from \"@modelcontextprotocol/server\";\nimport { serveStdio, type StdioServerHandle } from \"@modelcontextprotocol/server/stdio\";\n\nimport { createJsonSchemaValidator, registerTinyCloudTools, type McpStartupSelection } from \"./tools.js\";\nimport { MCP_VERSION } from \"./version.js\";\n\nexport const MCP_SERVER_NAME = \"tinycloud-mcp\";\nexport { MCP_VERSION } from \"./version.js\";\n/** The stdio server is always the local surface. */\nexport type LocalMcpSelection = Omit<McpStartupSelection, \"surface\">;\n\nexport function createTinyCloudMcpServer(selection: LocalMcpSelection): McpServer {\n  const validator = createJsonSchemaValidator();\n  const server = new McpServer(\n    { name: MCP_SERVER_NAME, version: MCP_VERSION },\n    { jsonSchemaValidator: validator },\n  );\n  registerTinyCloudTools(server, { ...selection, surface: \"local\" }, validator);\n  return server;\n}\n\n/** Start the only supported MCP transport: local stdio. */\nexport function serveTinyCloudMcp(selection: LocalMcpSelection): StdioServerHandle {\n  return serveStdio(\n    () => createTinyCloudMcpServer(selection),\n    { onerror: () => writeBoundedDiagnostic(\"MCP transport error\") },\n  );\n}\n\nfunction writeBoundedDiagnostic(message: string): void {\n  process.stderr.write(`[tinycloud-mcp] ${message}\\n`);\n}\n","import { createRequire } from \"node:module\";\nimport { join } from \"node:path\";\n\nimport { fromJsonSchema, type McpServer, type ToolAnnotations } from \"@modelcontextprotocol/server\";\nimport { AjvJsonSchemaValidator } from \"@modelcontextprotocol/server/validators/ajv\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nimport { toMcpToolResult, type McpToolResult } from \"./results.js\";\nimport { logToolCall } from \"./logging.js\";\nimport { toMcpJsonSchema } from \"./schemas.js\";\n\nexport const TOOL_NAMES = [\n  \"tinycloud_status\",\n  \"tinycloud_auth_status\",\n  \"tinycloud_auth_capabilities\",\n  \"tinycloud_auth_request\",\n  \"tinycloud_auth_import\",\n  \"tinycloud_account_spaces_list\",\n  \"tinycloud_account_applications_list\",\n  \"tinycloud_kv_list\",\n  \"tinycloud_kv_get\",\n  \"tinycloud_kv_head\",\n  \"tinycloud_kv_put\",\n  \"tinycloud_kv_delete\",\n  \"tinycloud_knowledge_list\",\n  \"tinycloud_knowledge_read\",\n  \"tinycloud_sql_schema_inspect\",\n  \"tinycloud_sql_query\",\n  \"tinycloud_sql_execute\",\n  \"tinycloud_secrets_get\",\n  \"tinycloud_secrets_status\",\n  \"tinycloud_apps_context\",\n  \"tinycloud_apps_read\",\n  \"tinycloud_apps_write\",\n  \"tinycloud_apps_query\",\n] as const;\n\nexport type ToolName = (typeof TOOL_NAMES)[number];\n\n/** Private stdio/hosted surfaces and the restricted public plugin. */\nexport type McpSurface = \"local\" | \"hosted\" | \"public\";\n\nexport interface McpStartupSelection {\n  /** Which server registers the tools; bindings not on this surface are skipped. */\n  readonly surface: McpSurface;\n  readonly profile: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n  /** Absolute TinyCloud home used to isolate one hosted principal. */\n  readonly stateRoot?: string;\n  /** Optional allowlist for surfaces whose grant is narrower than hosted OAuth. */\n  readonly allowedTools?: readonly ToolName[];\n  /** Check node authority only when an operation needs the account. */\n  readonly beforeOperation?: () => Promise<void>;\n  /** Hosted transports may attach a browser approval URL to canonical results. */\n  readonly transformOperationResult?: (result: unknown, invocation: McpOperationInvocation) => Promise<unknown>;\n}\n\nexport interface McpOperationInvocation {\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly input: unknown;\n}\n\nexport interface McpInvocationTarget {\n  readonly profile: string;\n  readonly allowOwnerProfile?: true;\n  readonly stateRoot?: string;\n}\n\n/** Project one startup selection into the only owner-sensitive target shape. */\nexport function invocationTargetForMcp(\n  selection: Omit<McpStartupSelection, \"surface\">,\n): McpInvocationTarget {\n  return {\n    profile: selection.profile,\n    ...(selection.explicitProfile && selection.allowOwnerProfile\n      ? { allowOwnerProfile: true }\n      : {}),\n    ...(selection.stateRoot === undefined ? {} : { stateRoot: selection.stateRoot }),\n  };\n}\n\ninterface CatalogOperation {\n  readonly id: string;\n  readonly version: number;\n  readonly title: string;\n  readonly description: string;\n  readonly input: Record<string, unknown>;\n  readonly result: Record<string, unknown>;\n}\n\ninterface OperationsCatalog {\n  readonly stableErrors: readonly string[];\n  readonly operations: readonly CatalogOperation[];\n}\n\n// The require anchor is this module, never the consumer entrypoint. In ESM\n// tsup preserves import.meta.url; in CJS it rewrites the same module-relative\n// anchor to the generated __filename, so both formats stay in MCP's package\n// dependency boundary.\nconst packageRequire = createRequire(\n  typeof __dirname === \"string\" ? join(__dirname, \"tools.cjs\") : import.meta.url,\n);\nconst generatedCatalog = packageRequire(\n  \"@tinycloud/operations/operations.json\",\n) as OperationsCatalog;\nconst stableErrorCodes: Readonly<Record<string, true>> = Object.fromEntries(\n  generatedCatalog.stableErrors.map((code) => [code, true as const]),\n);\n\nexport interface ToolBinding {\n  readonly name: ToolName;\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly readOnlyHint: boolean;\n  readonly idempotentHint: boolean;\n  readonly destructiveHint: boolean;\n  readonly openWorldHint: boolean;\n  /** Surfaces that register this tool; omitted means private local and hosted surfaces only. */\n  readonly surfaces?: readonly McpSurface[];\n}\n\nconst PRIVATE_SURFACES: readonly McpSurface[] = [\"local\", \"hosted\"];\n\n/** The surfaces a binding is registered on. */\nexport function bindingSurfaces(binding: ToolBinding): readonly McpSurface[] {\n  return binding.surfaces ?? PRIVATE_SURFACES;\n}\n\nexport const TOOL_BINDINGS: readonly ToolBinding[] = [\n  {\n    name: \"tinycloud_status\",\n    operationId: \"tinycloud.status.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_status\",\n    operationId: \"tinycloud.auth.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_capabilities\",\n    operationId: \"tinycloud.auth.capabilities\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_request\",\n    operationId: \"tinycloud.auth.request\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_import\",\n    operationId: \"tinycloud.auth.import\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n    // Hosted delegations must arrive through the owner/request-bound OpenKey callback,\n    // not a caller-supplied import artifact.\n    surfaces: [\"local\"],\n  },\n  {\n    name: \"tinycloud_account_spaces_list\",\n    operationId: \"tinycloud.account.spaces.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_account_applications_list\",\n    operationId: \"tinycloud.account.applications.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_list\",\n    operationId: \"tinycloud.kv.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_get\",\n    operationId: \"tinycloud.kv.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_head\",\n    operationId: \"tinycloud.kv.head\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_put\",\n    operationId: \"tinycloud.kv.put\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_delete\",\n    operationId: \"tinycloud.kv.delete\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_knowledge_list\",\n    operationId: \"tinycloud.knowledge.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_knowledge_read\",\n    operationId: \"tinycloud.knowledge.read\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_schema_inspect\",\n    operationId: \"tinycloud.sql.schema.inspect\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_query\",\n    operationId: \"tinycloud.sql.query\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_execute\",\n    operationId: \"tinycloud.sql.execute\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_get\",\n    operationId: \"tinycloud.secrets.get\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_status\",\n    operationId: \"tinycloud.secrets.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n    // Hosted has no persistent reauthorization path for a revoked session\n    // yet (TC-896), so status is local/stdio only.\n    surfaces: [\"local\"],\n  },\n  {\n    name: \"tinycloud_apps_context\",\n    operationId: \"tinycloud.apps.context\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_read\",\n    operationId: \"tinycloud.apps.read\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_write\",\n    operationId: \"tinycloud.apps.write\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_query\",\n    operationId: \"tinycloud.apps.query\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n] as const;\n\n// Project once per process; never mutate the catalog shared with non-MCP consumers.\nconst definitions = new Map(generatedCatalog.operations.map((operation) => [\n  `${operation.id}@${operation.version}`,\n  {\n    ...operation,\n    input: toMcpJsonSchema(operation.input),\n    result: toMcpJsonSchema(operation.result),\n  },\n]));\n\nexport function createJsonSchemaValidator(): AjvJsonSchemaValidator {\n  return new AjvJsonSchemaValidator();\n}\n\nexport function registerTinyCloudTools(\n  server: McpServer,\n  selection: McpStartupSelection,\n  validator: AjvJsonSchemaValidator,\n): void {\n  const bindings = TOOL_BINDINGS.filter((binding) =>\n    bindingSurfaces(binding).includes(selection.surface) &&\n    (selection.allowedTools === undefined || selection.allowedTools.includes(binding.name)));\n  for (const binding of bindings) {\n    const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);\n    if (operation === undefined) {\n      throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);\n    }\n\n    const inputSchema = fromJsonSchema(\n      operation.input as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const outputSchema = fromJsonSchema(\n      operation.result as unknown as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const annotations: ToolAnnotations = {\n      readOnlyHint: binding.readOnlyHint,\n      idempotentHint: binding.idempotentHint,\n      destructiveHint: binding.destructiveHint,\n      openWorldHint: binding.openWorldHint,\n    };\n\n    server.registerTool(\n      binding.name,\n      {\n        title: operation.title,\n        description: operation.description,\n        inputSchema,\n        outputSchema,\n        annotations,\n      },\n      async (input: unknown): Promise<McpToolResult> => {\n        const startedAt = performance.now();\n        const metrics = { replayedGrants: 0 };\n        let code = \"INTERNAL_ERROR\";\n        try {\n          await selection.beforeOperation?.();\n          const result = await invokeOperation(\n            binding.operationId,\n            binding.operationVersion,\n            invocationTargetForMcp(selection),\n            input,\n            metrics,\n          );\n          const projected = selection.transformOperationResult === undefined\n            ? result\n            : await selection.transformOperationResult(result, {\n              operationId: binding.operationId,\n              operationVersion: binding.operationVersion,\n              input,\n            });\n          const response = toMcpToolResult(projected, bindings, {\n            surface: selection.surface === \"local\" ? \"local\" : \"hosted\",\n            readOnly: binding.readOnlyHint,\n            operationId: binding.operationId,\n          });\n          code = outcomeCode(response.structuredContent);\n          return response;\n        } finally {\n          if (selection.surface !== \"local\") {\n            logToolCall(binding.name, code, startedAt, metrics.replayedGrants);\n          }\n        }\n      },\n    );\n  }\n}\n\nfunction outcomeCode(result: McpToolResult[\"structuredContent\"]): string {\n  if (result.status === \"error\") {\n    const error = result.error as { code?: unknown } | undefined;\n    return typeof error?.code === \"string\" && Object.hasOwn(stableErrorCodes, error.code) ? error.code : \"INTERNAL_ERROR\";\n  }\n  if (result.status !== \"ok\") return result.status;\n  const output = result.output as { outcome?: unknown; ops?: readonly { outcome?: unknown }[] } | undefined;\n  if (output?.outcome === \"COPY_PARTIAL\") return \"COPY_PARTIAL\";\n  if (Array.isArray(output?.ops) && output.ops.some((op) => op.outcome !== \"ok\")) return \"PARTIAL\";\n  return \"ok\";\n}\n\nexport function toolBindingsForTest(): readonly ToolBinding[] {\n  return TOOL_BINDINGS;\n}\n","/** MCP preserves the canonical envelope; hosted clients also receive readable JSON. */\nexport interface CanonicalOperationResult {\n  readonly status: \"ok\" | \"authority_required\" | \"setup_required\" | \"error\";\n  readonly [key: string]: unknown;\n}\n\nexport interface McpToolResult extends CallToolResult {\n  readonly content: [{ readonly type: \"text\"; readonly text: string }];\n  readonly structuredContent: CanonicalOperationResult;\n}\n\n/** The binding fields needed to name the tool that runs an operation. */\nexport interface RecoveryToolBinding {\n  readonly name: string;\n  readonly operationId: string;\n}\n\nexport interface McpToolResultOptions {\n  readonly surface?: \"hosted\" | \"local\";\n  readonly readOnly?: boolean;\n  /** Trusted operation identity from the tool binding, not operation output. */\n  readonly operationId?: string;\n}\n\nexport function toMcpToolResult(\n  result: unknown,\n  bindings: readonly RecoveryToolBinding[] = [],\n  options: McpToolResultOptions = {},\n): McpToolResult {\n  let canonical: CanonicalOperationResult = isCanonicalOperationResult(result)\n    ? withRecoveryTool(result, bindings)\n    : {\n      status: \"error\",\n      operation: {},\n      context: {},\n      error: { code: \"INTERNAL_ERROR\" },\n    };\n  let serialized: string | undefined;\n  if (options.surface === \"hosted\") {\n    serialized = JSON.stringify(canonical);\n    if (\n      (options.readOnly === true ||\n        options.operationId === \"tinycloud.apps.context\" ||\n        options.operationId === \"tinycloud.apps.query\") &&\n      serialized.length > 100_000\n    ) {\n      const sql = options.operationId?.startsWith(\"tinycloud.sql.\") ||\n        options.operationId === \"tinycloud.apps.query\";\n      canonical = {\n        status: \"error\",\n        operation: canonical.operation,\n        context: canonical.context,\n        error: {\n          code: sql ? \"SQL_RESULT_LIMIT_EXCEEDED\" : \"KV_RESPONSE_TOO_LARGE\",\n          message: sql\n            ? \"The result exceeds 100,000 characters. Select fewer columns or rows, add a WHERE filter or a smaller LIMIT, or aggregate the data.\"\n            : \"The result exceeds 100,000 characters. Request fewer keys, narrow the prefix, or use a smaller page size.\",\n          retryable: false,\n        },\n      };\n      serialized = JSON.stringify(canonical);\n    }\n  }\n\n  return {\n    content: [{\n      type: \"text\",\n      text: resultSummary(canonical.status) +\n        (serialized !== undefined && !(options.operationId === \"tinycloud.secrets.get\" && canonical.status === \"ok\")\n          ? `\\n${serialized}` : \"\"),\n    }],\n    structuredContent: canonical,\n  };\n}\n\n/**\n * A redacted `complete_migration` recovery names an operation; MCP clients\n * call tools, so name the bound tool. `tool` comes from the code-owned binding\n * table only, never from operation data, and is added after redaction. An\n * operationId with no binding gets no `tool`.\n */\nfunction withRecoveryTool(\n  result: CanonicalOperationResult,\n  bindings: readonly RecoveryToolBinding[],\n): CanonicalOperationResult {\n  if (result.status !== \"error\") return result;\n  // The kernel's redaction already constrained `error.details.recovery` to a\n  // safe recovery object; only its discriminant and operationId are read here.\n  const error = result.error as\n    | { readonly details?: { readonly recovery?: { readonly action?: unknown; readonly operationId?: unknown } } }\n    | undefined;\n  const recovery = error?.details?.recovery;\n  if (recovery?.action !== \"complete_migration\") return result;\n  const binding = bindings.find((candidate) => candidate.operationId === recovery.operationId);\n  if (binding === undefined) return result;\n  return {\n    ...result,\n    error: { ...error, details: { ...error?.details, recovery: { ...recovery, tool: binding.name } } },\n  };\n}\n\n/** The canonical envelope immediately before MCP protocol serialization. */\nexport function canonicalMcpAdapterResult(result: unknown): CanonicalOperationResult {\n  return toMcpToolResult(result).structuredContent;\n}\n\nfunction isCanonicalOperationResult(value: unknown): value is CanonicalOperationResult {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const status = (value as { status?: unknown }).status;\n  return status === \"ok\" ||\n    status === \"authority_required\" ||\n    status === \"setup_required\" ||\n    status === \"error\";\n}\n\nfunction resultSummary(status: CanonicalOperationResult[\"status\"]): string {\n  switch (status) {\n    case \"ok\":\n      return \"TinyCloud operation completed; use the structured result.\";\n    case \"authority_required\":\n      return \"TinyCloud authority is required; use the structured request and approval action.\";\n    case \"setup_required\":\n      return \"TinyCloud setup is required; use the structured setup action.\";\n    case \"error\":\n      return \"TinyCloud operation failed; use the structured error.\";\n  }\n}\nimport type { CallToolResult } from \"@modelcontextprotocol/server\";\n","/** Only code-owned tool names/codes and numeric counters reach this sink. */\nexport function logToolCall(\n  tool: string,\n  code: string,\n  startedAt: number,\n  replayedGrants: number,\n): void {\n  process.stderr.write(`${JSON.stringify({\n    tool,\n    code,\n    durationMs: Math.max(0, Math.round(performance.now() - startedAt)),\n    replayedGrants,\n  })}\\n`);\n}\n","type JsonSchema = boolean | Record<string, unknown>;\n\nconst DRAFT_7 = \"http://json-schema.org/draft-07/schema#\";\nconst DRAFT_2020_12 = \"https://json-schema.org/draft/2020-12/schema\";\nconst schemaMaps = new Set([\"properties\", \"patternProperties\", \"definitions\", \"$defs\"]);\nconst schemaArrays = new Set([\"allOf\", \"anyOf\", \"oneOf\"]);\nconst schemaValues = new Set([\n  \"additionalProperties\", \"items\", \"contains\", \"propertyNames\", \"not\", \"if\", \"then\", \"else\",\n]);\n\n/** Project the catalog's shared Draft-07/2020-12 vocabulary without changing its validation rules. */\nexport function toMcpJsonSchema(schema: Record<string, unknown>): Record<string, unknown>;\nexport function toMcpJsonSchema(schema: JsonSchema): JsonSchema;\nexport function toMcpJsonSchema(schema: JsonSchema): JsonSchema {\n  if (typeof schema === \"boolean\") return schema;\n  // These forms need a semantic migration, not just a dialect declaration. The\n  // generated catalog does not use them; fail closed if that contract changes.\n  if (Array.isArray(schema.items) || \"additionalItems\" in schema || \"dependencies\" in schema ||\n    (\"$ref\" in schema && Object.keys(schema).some((key) => key !== \"$ref\"))) {\n    throw new Error(\"The operations schema needs a semantic migration to JSON Schema 2020-12.\");\n  }\n\n  const projected: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(schema)) {\n    if (key === \"$schema\") {\n      if (value !== DRAFT_7) throw new Error(`Unsupported operations schema dialect: ${String(value)}.`);\n      projected[key] = DRAFT_2020_12;\n    } else if (schemaMaps.has(key)) {\n      projected[key] = Object.fromEntries(Object.entries(value as Record<string, JsonSchema>)\n        .map(([name, child]) => [name, toMcpJsonSchema(child)]));\n    } else if (schemaArrays.has(key)) {\n      projected[key] = (value as JsonSchema[]).map(toMcpJsonSchema);\n    } else if (schemaValues.has(key)) {\n      projected[key] = toMcpJsonSchema(value as JsonSchema);\n    } else {\n      // Descriptions, defaults, examples and const/enum values are data, not schemas.\n      projected[key] = value;\n    }\n  }\n  return projected;\n}\n","{\n  \"name\": \"@tinycloud/mcp\",\n  \"version\": \"0.8.3-beta.24\",\n  \"description\": \"TinyCloud delegated operations MCP server\",\n  \"keywords\": [\n    \"tinycloud\",\n    \"mcp\",\n    \"model-context-protocol\",\n    \"agents\",\n    \"delegation\",\n    \"ucan\",\n    \"kv\",\n    \"sqlite\"\n  ],\n  \"author\": \"TinyCloud, Inc.\",\n  \"license\": \"EGPL\",\n  \"type\": \"module\",\n  \"main\": \"dist/index.cjs\",\n  \"module\": \"dist/index.js\",\n  \"types\": \"dist/index.d.ts\",\n  \"bin\": {\n    \"tinycloud-mcp\": \"./bin/tinycloud-mcp\",\n    \"tinycloud-mcp-http\": \"./bin/tinycloud-mcp-http\"\n  },\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    },\n    \"./server\": {\n      \"types\": \"./dist/server.d.ts\",\n      \"import\": \"./dist/server.js\",\n      \"require\": \"./dist/server.cjs\"\n    },\n    \"./tools\": {\n      \"types\": \"./dist/tools.d.ts\",\n      \"import\": \"./dist/tools.js\",\n      \"require\": \"./dist/tools.cjs\"\n    },\n    \"./results\": {\n      \"types\": \"./dist/results.d.ts\",\n      \"import\": \"./dist/results.js\",\n      \"require\": \"./dist/results.cjs\"\n    },\n    \"./http\": {\n      \"types\": \"./dist/http.d.ts\",\n      \"import\": \"./dist/http.js\",\n      \"require\": \"./dist/http.cjs\"\n    }\n  },\n  \"files\": [\n    \"dist\",\n    \"bin\",\n    \"generated\",\n    \"skills\"\n  ],\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"clean\": \"rm -rf dist\",\n    \"test\": \"bun run build && bun scripts/test.ts && bun run check:generated\",\n    \"test:stdio\": \"bun run build && bun test src/stdio.test.ts\",\n    \"typecheck\": \"tsc -p tsconfig.json\",\n    \"start:http\": \"node dist/http-cli.js\",\n    \"generate\": \"bun scripts/generate.ts\",\n    \"check:generated\": \"bun scripts/generate.ts --check\"\n  },\n  \"dependencies\": {\n    \"@modelcontextprotocol/node\": \"2.0.0-beta.5\",\n    \"@modelcontextprotocol/server\": \"2.0.0-beta.5\",\n    \"@tinycloud/node-sdk\": \"3.8.0-beta.21\",\n    \"@tinycloud/node-sdk-wasm\": \"1.7.8\",\n    \"@tinycloud/operations\": \"0.7.7-beta.20\",\n    \"jose\": \"6.2.4\"\n  },\n  \"devDependencies\": {\n    \"@modelcontextprotocol/client\": \"2.0.0-beta.5\",\n    \"@types/node\": \"^20\",\n    \"tsup\": \"^8.0.0\",\n    \"typescript\": \"^5.9.3\"\n  },\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/TinyCloudLabs/js-sdk\"\n  },\n  \"homepage\": \"https://docs.tinycloud.xyz/cli/mcp\"\n}\n","import packageMetadata from \"../package.json\";\n\nexport const MCP_VERSION = packageMetadata.version;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAAAA,oBAAyB;AAEzB,qBAA6C;;;ACF7C,IAAAC,iBAA0B;AAC1B,mBAAmD;;;ACDnD,yBAA8B;AAC9B,uBAAqB;AAErB,oBAAqE;AACrE,iBAAuC;AACvC,wBAAgC;;;ACmBzB,SAAS,gBACd,QACA,WAA2C,CAAC,GAC5C,UAAgC,CAAC,GAClB;AACf,MAAI,YAAsC,2BAA2B,MAAM,IACvE,iBAAiB,QAAQ,QAAQ,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,WAAW,CAAC;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC;AACF,MAAI;AACJ,MAAI,QAAQ,YAAY,UAAU;AAChC,iBAAa,KAAK,UAAU,SAAS;AACrC,SACG,QAAQ,aAAa,QACpB,QAAQ,gBAAgB,4BACxB,QAAQ,gBAAgB,2BAC1B,WAAW,SAAS,KACpB;AACA,YAAM,MAAM,QAAQ,aAAa,WAAW,gBAAgB,KAC1D,QAAQ,gBAAgB;AAC1B,kBAAY;AAAA,QACV,QAAQ;AAAA,QACR,WAAW,UAAU;AAAA,QACrB,SAAS,UAAU;AAAA,QACnB,OAAO;AAAA,UACL,MAAM,MAAM,8BAA8B;AAAA,UAC1C,SAAS,MACL,uIACA;AAAA,UACJ,WAAW;AAAA,QACb;AAAA,MACF;AACA,mBAAa,KAAK,UAAU,SAAS;AAAA,IACvC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,CAAC;AAAA,MACR,MAAM;AAAA,MACN,MAAM,cAAc,UAAU,MAAM,KACjC,eAAe,UAAa,EAAE,QAAQ,gBAAgB,2BAA2B,UAAU,WAAW,QACnG;AAAA,EAAK,UAAU,KAAK;AAAA,IAC5B,CAAC;AAAA,IACD,mBAAmB;AAAA,EACrB;AACF;AAQA,SAAS,iBACP,QACA,UAC0B;AAC1B,MAAI,OAAO,WAAW,QAAS,QAAO;AAGtC,QAAM,QAAQ,OAAO;AAGrB,QAAM,WAAW,OAAO,SAAS;AACjC,MAAI,UAAU,WAAW,qBAAsB,QAAO;AACtD,QAAM,UAAU,SAAS,KAAK,CAAC,cAAc,UAAU,gBAAgB,SAAS,WAAW;AAC3F,MAAI,YAAY,OAAW,QAAO;AAClC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,EAAE,GAAG,OAAO,SAAS,EAAE,GAAG,OAAO,SAAS,UAAU,EAAE,GAAG,UAAU,MAAM,QAAQ,KAAK,EAAE,EAAE;AAAA,EACnG;AACF;AAOA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAU,MAA+B;AAC/C,SAAO,WAAW,QAChB,WAAW,wBACX,WAAW,oBACX,WAAW;AACf;AAEA,SAAS,cAAc,QAAoD;AACzE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;;;AC7HO,SAAS,YACd,MACA,MACA,WACA,gBACM;AACN,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU;AAAA,IACrC;AAAA,IACA;AAAA,IACA,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS,CAAC;AAAA,IACjE;AAAA,EACF,CAAC,CAAC;AAAA,CAAI;AACR;;;ACXA,IAAM,UAAU;AAChB,IAAM,gBAAgB;AACtB,IAAM,aAAa,oBAAI,IAAI,CAAC,cAAc,qBAAqB,eAAe,OAAO,CAAC;AACtF,IAAM,eAAe,oBAAI,IAAI,CAAC,SAAS,SAAS,OAAO,CAAC;AACxD,IAAM,eAAe,oBAAI,IAAI;AAAA,EAC3B;AAAA,EAAwB;AAAA,EAAS;AAAA,EAAY;AAAA,EAAiB;AAAA,EAAO;AAAA,EAAM;AAAA,EAAQ;AACrF,CAAC;AAKM,SAAS,gBAAgB,QAAgC;AAC9D,MAAI,OAAO,WAAW,UAAW,QAAO;AAGxC,MAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,qBAAqB,UAAU,kBAAkB,UACjF,UAAU,UAAU,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,QAAQ,QAAQ,MAAM,GAAI;AACzE,UAAM,IAAI,MAAM,0EAA0E;AAAA,EAC5F;AAEA,QAAM,YAAqC,CAAC;AAC5C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,WAAW;AACrB,UAAI,UAAU,QAAS,OAAM,IAAI,MAAM,0CAA0C,OAAO,KAAK,CAAC,GAAG;AACjG,gBAAU,GAAG,IAAI;AAAA,IACnB,WAAW,WAAW,IAAI,GAAG,GAAG;AAC9B,gBAAU,GAAG,IAAI,OAAO,YAAY,OAAO,QAAQ,KAAmC,EACnF,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,gBAAgB,KAAK,CAAC,CAAC,CAAC;AAAA,IAC3D,WAAW,aAAa,IAAI,GAAG,GAAG;AAChC,gBAAU,GAAG,IAAK,MAAuB,IAAI,eAAe;AAAA,IAC9D,WAAW,aAAa,IAAI,GAAG,GAAG;AAChC,gBAAU,GAAG,IAAI,gBAAgB,KAAmB;AAAA,IACtD,OAAO;AAEL,gBAAU,GAAG,IAAI;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;;;AHxCA;AAuEO,SAAS,uBACd,WACqB;AACrB,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,GAAI,UAAU,mBAAmB,UAAU,oBACvC,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,IACL,GAAI,UAAU,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,UAAU,UAAU;AAAA,EAChF;AACF;AAoBA,IAAM,qBAAiB;AAAA,EACrB,OAAO,cAAc,eAAW,uBAAK,WAAW,WAAW,IAAI,YAAY;AAC7E;AACA,IAAM,mBAAmB;AAAA,EACvB;AACF;AACA,IAAM,mBAAmD,OAAO;AAAA,EAC9D,iBAAiB,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,IAAa,CAAC;AACnE;AAcA,IAAM,mBAA0C,CAAC,SAAS,QAAQ;AAG3D,SAAS,gBAAgB,SAA6C;AAC3E,SAAO,QAAQ,YAAY;AAC7B;AAEO,IAAM,gBAAwC;AAAA,EACnD;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA;AAAA;AAAA,IAGf,UAAU,CAAC,OAAO;AAAA,EACpB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA;AAAA;AAAA,IAGf,UAAU,CAAC,OAAO;AAAA,EACpB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AACF;AAGA,IAAM,cAAc,IAAI,IAAI,iBAAiB,WAAW,IAAI,CAAC,cAAc;AAAA,EACzE,GAAG,UAAU,EAAE,IAAI,UAAU,OAAO;AAAA,EACpC;AAAA,IACE,GAAG;AAAA,IACH,OAAO,gBAAgB,UAAU,KAAK;AAAA,IACtC,QAAQ,gBAAgB,UAAU,MAAM;AAAA,EAC1C;AACF,CAAC,CAAC;AAEK,SAAS,4BAAoD;AAClE,SAAO,IAAI,kCAAuB;AACpC;AAEO,SAAS,uBACd,QACA,WACA,WACM;AACN,QAAM,WAAW,cAAc,OAAO,CAAC,YACrC,gBAAgB,OAAO,EAAE,SAAS,UAAU,OAAO,MAClD,UAAU,iBAAiB,UAAa,UAAU,aAAa,SAAS,QAAQ,IAAI,EAAE;AACzF,aAAW,WAAW,UAAU;AAC9B,UAAM,YAAY,YAAY,IAAI,GAAG,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,EAAE;AACtF,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI,MAAM,2CAA2C,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,GAAG;AAAA,IAC/G;AAEA,UAAM,kBAAc;AAAA,MAClB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,mBAAe;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,cAA+B;AAAA,MACnC,cAAc,QAAQ;AAAA,MACtB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB,eAAe,QAAQ;AAAA,IACzB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,QACE,OAAO,UAAU;AAAA,QACjB,aAAa,UAAU;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,OAAO,UAA2C;AAChD,cAAM,YAAY,YAAY,IAAI;AAClC,cAAM,UAAU,EAAE,gBAAgB,EAAE;AACpC,YAAI,OAAO;AACX,YAAI;AACF,gBAAM,UAAU,kBAAkB;AAClC,gBAAM,SAAS,UAAM;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,uBAAuB,SAAS;AAAA,YAChC;AAAA,YACA;AAAA,UACF;AACA,gBAAM,YAAY,UAAU,6BAA6B,SACrD,SACA,MAAM,UAAU,yBAAyB,QAAQ;AAAA,YACjD,aAAa,QAAQ;AAAA,YACrB,kBAAkB,QAAQ;AAAA,YAC1B;AAAA,UACF,CAAC;AACH,gBAAM,WAAW,gBAAgB,WAAW,UAAU;AAAA,YACpD,SAAS,UAAU,YAAY,UAAU,UAAU;AAAA,YACnD,UAAU,QAAQ;AAAA,YAClB,aAAa,QAAQ;AAAA,UACvB,CAAC;AACD,iBAAO,YAAY,SAAS,iBAAiB;AAC7C,iBAAO;AAAA,QACT,UAAE;AACA,cAAI,UAAU,YAAY,SAAS;AACjC,wBAAY,QAAQ,MAAM,MAAM,WAAW,QAAQ,cAAc;AAAA,UACnE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,YAAY,QAAoD;AACvE,MAAI,OAAO,WAAW,SAAS;AAC7B,UAAM,QAAQ,OAAO;AACrB,WAAO,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,kBAAkB,MAAM,IAAI,IAAI,MAAM,OAAO;AAAA,EACvG;AACA,MAAI,OAAO,WAAW,KAAM,QAAO,OAAO;AAC1C,QAAM,SAAS,OAAO;AACtB,MAAI,QAAQ,YAAY,eAAgB,QAAO;AAC/C,MAAI,MAAM,QAAQ,QAAQ,GAAG,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,GAAG,YAAY,IAAI,EAAG,QAAO;AACvF,SAAO;AACT;;;AIjcA;AAAA,EACE,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,aAAe;AAAA,EACf,UAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAU;AAAA,EACV,SAAW;AAAA,EACX,MAAQ;AAAA,EACR,MAAQ;AAAA,EACR,QAAU;AAAA,EACV,OAAS;AAAA,EACT,KAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,sBAAsB;AAAA,EACxB;AAAA,EACA,SAAW;AAAA,IACT,KAAK;AAAA,MACH,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,YAAY;AAAA,MACV,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACT,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,aAAa;AAAA,MACX,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,MACR,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,OAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,SAAW;AAAA,IACT,MAAQ;AAAA,EACV;AAAA,EACA,SAAW;AAAA,IACT,OAAS;AAAA,IACT,OAAS;AAAA,IACT,MAAQ;AAAA,IACR,cAAc;AAAA,IACd,WAAa;AAAA,IACb,cAAc;AAAA,IACd,UAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAAA,EACA,cAAgB;AAAA,IACd,8BAA8B;AAAA,IAC9B,gCAAgC;AAAA,IAChC,uBAAuB;AAAA,IACvB,4BAA4B;AAAA,IAC5B,yBAAyB;AAAA,IACzB,MAAQ;AAAA,EACV;AAAA,EACA,iBAAmB;AAAA,IACjB,gCAAgC;AAAA,IAChC,eAAe;AAAA,IACf,MAAQ;AAAA,IACR,YAAc;AAAA,EAChB;AAAA,EACA,YAAc;AAAA,IACZ,MAAQ;AAAA,IACR,KAAO;AAAA,EACT;AAAA,EACA,UAAY;AACd;;;ACvFO,IAAM,cAAc,gBAAgB;;;ANIpC,IAAM,kBAAkB;AAKxB,SAAS,yBAAyB,WAAyC;AAChF,QAAM,YAAY,0BAA0B;AAC5C,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,iBAAiB,SAAS,YAAY;AAAA,IAC9C,EAAE,qBAAqB,UAAU;AAAA,EACnC;AACA,yBAAuB,QAAQ,EAAE,GAAG,WAAW,SAAS,QAAQ,GAAG,SAAS;AAC5E,SAAO;AACT;AAGO,SAAS,kBAAkB,WAAiD;AACjF,aAAO;AAAA,IACL,MAAM,yBAAyB,SAAS;AAAA,IACxC,EAAE,SAAS,MAAM,uBAAuB,qBAAqB,EAAE;AAAA,EACjE;AACF;AAEA,SAAS,uBAAuB,SAAuB;AACrD,UAAQ,OAAO,MAAM,mBAAmB,OAAO;AAAA,CAAI;AACrD;;;ADjBA,IAAM,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWN,SAAS,gBAAgB,YAAiD;AAC/E,MAAI;AACJ,MAAI,kBAAkB;AACtB,MAAI,oBAAoB;AACxB,MAAI,OAAO;AACX,MAAI,UAAU;AAEd,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS,GAAG;AACzD,UAAM,WAAW,WAAW,KAAK;AACjC,QAAI,aAAa,YAAY,aAAa,MAAM;AAC9C,aAAO;AACP;AAAA,IACF;AACA,QAAI,aAAa,eAAe,aAAa,MAAM;AACjD,gBAAU;AACV;AAAA,IACF;AACA,QAAI,aAAa,yBAAyB;AACxC,0BAAoB;AACpB;AAAA,IACF;AACA,QAAI,aAAa,aAAa;AAC5B,YAAM,QAAQ,WAAW,QAAQ,CAAC;AAClC,UAAI,UAAU,UAAa,MAAM,WAAW,GAAG,KAAK,MAAM,KAAK,EAAE,WAAW,GAAG;AAC7E,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,gBAAU;AACV,wBAAkB;AAClB,eAAS;AACT;AAAA,IACF;AACA,QAAI,UAAU,WAAW,YAAY,GAAG;AACtC,YAAM,QAAQ,SAAS,MAAM,aAAa,MAAM;AAChD,UAAI,MAAM,KAAK,EAAE,WAAW,EAAG,OAAM,IAAI,MAAM,8CAA8C;AAC7F,gBAAU;AACV,wBAAkB;AAClB;AAAA,IACF;AACA,UAAM,IAAI,MAAM,mBAAmB,QAAQ,EAAE;AAAA,EAC/C;AAEA,SAAO,EAAE,SAAS,iBAAiB,mBAAmB,MAAM,QAAQ;AACtE;AAEA,eAAsB,KAAK,aAAgC,QAAQ,KAAK,MAAM,CAAC,GAAoB;AACjG,MAAI;AACJ,MAAI;AACF,cAAU,gBAAgB,UAAU;AAAA,EACtC,SAAS,OAAO;AACd,YAAQ,OAAO,MAAM,yCAAyC;AAC9D,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,MAAM;AAChB,YAAQ,OAAO,MAAM,IAAI;AACzB,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,SAAS;AACnB,YAAQ,OAAO,MAAM,GAAG,WAAW;AAAA,CAAI;AACvC,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,UAAM,6CAA6B,QAAQ,OAAO;AAAA,EAC9D,QAAQ;AACN,YAAQ,OAAO,MAAM,+CAA+C;AACpE,WAAO;AAAA,EACT;AAIA,oBAAkB;AAAA,IAChB;AAAA,IACA,iBAAiB,QAAQ;AAAA,IACzB,mBAAmB,QAAQ;AAAA,EAC7B,CAAC;AACD,SAAO;AACT;AAEA,SAAS,qBAA8B;AACrC,QAAM,OAAO,QAAQ,KAAK,CAAC;AAC3B,MAAI,SAAS,OAAW,QAAO;AAC/B,aAAO,4BAAS,IAAI,MAAM,gBAAY,4BAAS,IAAI,MAAM,iBAAa,4BAAS,IAAI,MAAM;AAC3F;AAEA,IAAI,mBAAmB,GAAG;AACxB,OAAK,KAAK,EAAE,KAAK,CAAC,SAAS;AACzB,QAAI,SAAS,EAAG,SAAQ,WAAW;AAAA,EACrC,CAAC,EAAE,MAAM,MAAM;AACb,YAAQ,OAAO,MAAM,mCAAmC;AACxD,YAAQ,WAAW;AAAA,EACrB,CAAC;AACH;","names":["import_node_path","import_server"]}

package/dist/cli.js

@@ -457,7 +457,7 @@ function outcomeCode(result) {
 // package.json
 var package_default = {
   name: "@tinycloud/mcp",
-  version: "0.8.3-beta.22",
+  version: "0.8.3-beta.24",
   description: "TinyCloud delegated operations MCP server",
   keywords: [
     "tinycloud",
@@ -528,9 +528,9 @@ var package_default = {
   dependencies: {
     "@modelcontextprotocol/node": "2.0.0-beta.5",
     "@modelcontextprotocol/server": "2.0.0-beta.5",
-    "@tinycloud/node-sdk": "3.8.0-beta.20",
+    "@tinycloud/node-sdk": "3.8.0-beta.21",
     "@tinycloud/node-sdk-wasm": "1.7.8",
-    "@tinycloud/operations": "0.7.7-beta.19",
+    "@tinycloud/operations": "0.7.7-beta.20",
     jose: "6.2.4"
   },
   devDependencies: {

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli.ts","../src/server.ts","../src/tools.ts","../src/results.ts","../src/logging.ts","../src/schemas.ts","../package.json","../src/version.ts"],"sourcesContent":["import { basename } from \"node:path\";\n\nimport { resolveInvocationProfileName } from \"@tinycloud/operations/profile\";\n\nimport { serveTinyCloudMcp, MCP_VERSION } from \"./server.js\";\n\nexport interface ParsedCliOptions {\n  readonly profile?: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n  readonly help: boolean;\n  readonly version: boolean;\n}\n\nconst HELP = `TinyCloud delegated operations MCP server\n\nUsage: tinycloud-mcp [options]\n\nOptions:\n  --profile <name>       Pin the TinyCloud profile for this process\n  --allow-owner-profile  Allow data execution for an explicitly selected owner profile\n  --help                 Show this help\n  --version              Show the package version\n`;\n\nexport function parseCliOptions(arguments_: readonly string[]): ParsedCliOptions {\n  let profile: string | undefined;\n  let explicitProfile = false;\n  let allowOwnerProfile = false;\n  let help = false;\n  let version = false;\n\n  for (let index = 0; index < arguments_.length; index += 1) {\n    const argument = arguments_[index];\n    if (argument === \"--help\" || argument === \"-h\") {\n      help = true;\n      continue;\n    }\n    if (argument === \"--version\" || argument === \"-v\") {\n      version = true;\n      continue;\n    }\n    if (argument === \"--allow-owner-profile\") {\n      allowOwnerProfile = true;\n      continue;\n    }\n    if (argument === \"--profile\") {\n      const value = arguments_[index + 1];\n      if (value === undefined || value.startsWith(\"-\") || value.trim().length === 0) {\n        throw new Error(\"--profile requires a non-empty profile name.\");\n      }\n      profile = value;\n      explicitProfile = true;\n      index += 1;\n      continue;\n    }\n    if (argument?.startsWith(\"--profile=\")) {\n      const value = argument.slice(\"--profile=\".length);\n      if (value.trim().length === 0) throw new Error(\"--profile requires a non-empty profile name.\");\n      profile = value;\n      explicitProfile = true;\n      continue;\n    }\n    throw new Error(`Unknown option: ${argument}`);\n  }\n\n  return { profile, explicitProfile, allowOwnerProfile, help, version };\n}\n\nexport async function main(arguments_: readonly string[] = process.argv.slice(2)): Promise<number> {\n  let options: ParsedCliOptions;\n  try {\n    options = parseCliOptions(arguments_);\n  } catch (error) {\n    process.stderr.write(\"[tinycloud-mcp] Invalid command line.\\n\");\n    return 2;\n  }\n\n  if (options.help) {\n    process.stdout.write(HELP);\n    return 0;\n  }\n  if (options.version) {\n    process.stdout.write(`${MCP_VERSION}\\n`);\n    return 0;\n  }\n\n  let profile: string;\n  try {\n    profile = await resolveInvocationProfileName(options.profile);\n  } catch {\n    process.stderr.write(\"[tinycloud-mcp] Could not select a profile.\\n\");\n    return 2;\n  }\n\n  // The selected profile is now a value captured by the server closure. Every\n  // operation receives it explicitly and cannot re-read TC_PROFILE/config.\n  serveTinyCloudMcp({\n    profile,\n    explicitProfile: options.explicitProfile,\n    allowOwnerProfile: options.allowOwnerProfile,\n  });\n  return 0;\n}\n\nfunction isDirectInvocation(): boolean {\n  const argv = process.argv[1];\n  if (argv === undefined) return false;\n  return basename(argv) === \"cli.js\" || basename(argv) === \"cli.cjs\" || basename(argv) === \"tinycloud-mcp\";\n}\n\nif (isDirectInvocation()) {\n  void main().then((code) => {\n    if (code !== 0) process.exitCode = code;\n  }).catch(() => {\n    process.stderr.write(\"[tinycloud-mcp] Startup failed.\\n\");\n    process.exitCode = 1;\n  });\n}\n","import { McpServer } from \"@modelcontextprotocol/server\";\nimport { serveStdio, type StdioServerHandle } from \"@modelcontextprotocol/server/stdio\";\n\nimport { createJsonSchemaValidator, registerTinyCloudTools, type McpStartupSelection } from \"./tools.js\";\nimport { MCP_VERSION } from \"./version.js\";\n\nexport const MCP_SERVER_NAME = \"tinycloud-mcp\";\nexport { MCP_VERSION } from \"./version.js\";\n/** The stdio server is always the local surface. */\nexport type LocalMcpSelection = Omit<McpStartupSelection, \"surface\">;\n\nexport function createTinyCloudMcpServer(selection: LocalMcpSelection): McpServer {\n  const validator = createJsonSchemaValidator();\n  const server = new McpServer(\n    { name: MCP_SERVER_NAME, version: MCP_VERSION },\n    { jsonSchemaValidator: validator },\n  );\n  registerTinyCloudTools(server, { ...selection, surface: \"local\" }, validator);\n  return server;\n}\n\n/** Start the only supported MCP transport: local stdio. */\nexport function serveTinyCloudMcp(selection: LocalMcpSelection): StdioServerHandle {\n  return serveStdio(\n    () => createTinyCloudMcpServer(selection),\n    { onerror: () => writeBoundedDiagnostic(\"MCP transport error\") },\n  );\n}\n\nfunction writeBoundedDiagnostic(message: string): void {\n  process.stderr.write(`[tinycloud-mcp] ${message}\\n`);\n}\n","import { createRequire } from \"node:module\";\nimport { join } from \"node:path\";\n\nimport { fromJsonSchema, type McpServer, type ToolAnnotations } from \"@modelcontextprotocol/server\";\nimport { AjvJsonSchemaValidator } from \"@modelcontextprotocol/server/validators/ajv\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nimport { toMcpToolResult, type McpToolResult } from \"./results.js\";\nimport { logToolCall } from \"./logging.js\";\nimport { toMcpJsonSchema } from \"./schemas.js\";\n\nexport const TOOL_NAMES = [\n  \"tinycloud_status\",\n  \"tinycloud_auth_status\",\n  \"tinycloud_auth_capabilities\",\n  \"tinycloud_auth_request\",\n  \"tinycloud_auth_import\",\n  \"tinycloud_account_spaces_list\",\n  \"tinycloud_account_applications_list\",\n  \"tinycloud_kv_list\",\n  \"tinycloud_kv_get\",\n  \"tinycloud_kv_head\",\n  \"tinycloud_kv_put\",\n  \"tinycloud_kv_delete\",\n  \"tinycloud_knowledge_list\",\n  \"tinycloud_knowledge_read\",\n  \"tinycloud_sql_schema_inspect\",\n  \"tinycloud_sql_query\",\n  \"tinycloud_sql_execute\",\n  \"tinycloud_secrets_get\",\n  \"tinycloud_secrets_status\",\n  \"tinycloud_apps_context\",\n  \"tinycloud_apps_read\",\n  \"tinycloud_apps_write\",\n  \"tinycloud_apps_query\",\n] as const;\n\nexport type ToolName = (typeof TOOL_NAMES)[number];\n\n/** Private stdio/hosted surfaces and the restricted public plugin. */\nexport type McpSurface = \"local\" | \"hosted\" | \"public\";\n\nexport interface McpStartupSelection {\n  /** Which server registers the tools; bindings not on this surface are skipped. */\n  readonly surface: McpSurface;\n  readonly profile: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n  /** Absolute TinyCloud home used to isolate one hosted principal. */\n  readonly stateRoot?: string;\n  /** Optional allowlist for surfaces whose grant is narrower than hosted OAuth. */\n  readonly allowedTools?: readonly ToolName[];\n  /** Check node authority only when an operation needs the account. */\n  readonly beforeOperation?: () => Promise<void>;\n  /** Hosted transports may attach a browser approval URL to canonical results. */\n  readonly transformOperationResult?: (result: unknown, invocation: McpOperationInvocation) => Promise<unknown>;\n}\n\nexport interface McpOperationInvocation {\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly input: unknown;\n}\n\nexport interface McpInvocationTarget {\n  readonly profile: string;\n  readonly allowOwnerProfile?: true;\n  readonly stateRoot?: string;\n}\n\n/** Project one startup selection into the only owner-sensitive target shape. */\nexport function invocationTargetForMcp(\n  selection: Omit<McpStartupSelection, \"surface\">,\n): McpInvocationTarget {\n  return {\n    profile: selection.profile,\n    ...(selection.explicitProfile && selection.allowOwnerProfile\n      ? { allowOwnerProfile: true }\n      : {}),\n    ...(selection.stateRoot === undefined ? {} : { stateRoot: selection.stateRoot }),\n  };\n}\n\ninterface CatalogOperation {\n  readonly id: string;\n  readonly version: number;\n  readonly title: string;\n  readonly description: string;\n  readonly input: Record<string, unknown>;\n  readonly result: Record<string, unknown>;\n}\n\ninterface OperationsCatalog {\n  readonly stableErrors: readonly string[];\n  readonly operations: readonly CatalogOperation[];\n}\n\n// The require anchor is this module, never the consumer entrypoint. In ESM\n// tsup preserves import.meta.url; in CJS it rewrites the same module-relative\n// anchor to the generated __filename, so both formats stay in MCP's package\n// dependency boundary.\nconst packageRequire = createRequire(\n  typeof __dirname === \"string\" ? join(__dirname, \"tools.cjs\") : import.meta.url,\n);\nconst generatedCatalog = packageRequire(\n  \"@tinycloud/operations/operations.json\",\n) as OperationsCatalog;\nconst stableErrorCodes: Readonly<Record<string, true>> = Object.fromEntries(\n  generatedCatalog.stableErrors.map((code) => [code, true as const]),\n);\n\nexport interface ToolBinding {\n  readonly name: ToolName;\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly readOnlyHint: boolean;\n  readonly idempotentHint: boolean;\n  readonly destructiveHint: boolean;\n  readonly openWorldHint: boolean;\n  /** Surfaces that register this tool; omitted means private local and hosted surfaces only. */\n  readonly surfaces?: readonly McpSurface[];\n}\n\nconst PRIVATE_SURFACES: readonly McpSurface[] = [\"local\", \"hosted\"];\n\n/** The surfaces a binding is registered on. */\nexport function bindingSurfaces(binding: ToolBinding): readonly McpSurface[] {\n  return binding.surfaces ?? PRIVATE_SURFACES;\n}\n\nexport const TOOL_BINDINGS: readonly ToolBinding[] = [\n  {\n    name: \"tinycloud_status\",\n    operationId: \"tinycloud.status.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_status\",\n    operationId: \"tinycloud.auth.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_capabilities\",\n    operationId: \"tinycloud.auth.capabilities\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_request\",\n    operationId: \"tinycloud.auth.request\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_import\",\n    operationId: \"tinycloud.auth.import\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n    // Hosted delegations must arrive through the owner/request-bound OpenKey callback,\n    // not a caller-supplied import artifact.\n    surfaces: [\"local\"],\n  },\n  {\n    name: \"tinycloud_account_spaces_list\",\n    operationId: \"tinycloud.account.spaces.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_account_applications_list\",\n    operationId: \"tinycloud.account.applications.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_list\",\n    operationId: \"tinycloud.kv.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_get\",\n    operationId: \"tinycloud.kv.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_head\",\n    operationId: \"tinycloud.kv.head\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_put\",\n    operationId: \"tinycloud.kv.put\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_delete\",\n    operationId: \"tinycloud.kv.delete\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_knowledge_list\",\n    operationId: \"tinycloud.knowledge.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_knowledge_read\",\n    operationId: \"tinycloud.knowledge.read\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_schema_inspect\",\n    operationId: \"tinycloud.sql.schema.inspect\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_query\",\n    operationId: \"tinycloud.sql.query\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_execute\",\n    operationId: \"tinycloud.sql.execute\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_get\",\n    operationId: \"tinycloud.secrets.get\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_status\",\n    operationId: \"tinycloud.secrets.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n    // Hosted has no persistent reauthorization path for a revoked session\n    // yet (TC-896), so status is local/stdio only.\n    surfaces: [\"local\"],\n  },\n  {\n    name: \"tinycloud_apps_context\",\n    operationId: \"tinycloud.apps.context\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_read\",\n    operationId: \"tinycloud.apps.read\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_write\",\n    operationId: \"tinycloud.apps.write\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_query\",\n    operationId: \"tinycloud.apps.query\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n] as const;\n\n// Project once per process; never mutate the catalog shared with non-MCP consumers.\nconst definitions = new Map(generatedCatalog.operations.map((operation) => [\n  `${operation.id}@${operation.version}`,\n  {\n    ...operation,\n    input: toMcpJsonSchema(operation.input),\n    result: toMcpJsonSchema(operation.result),\n  },\n]));\n\nexport function createJsonSchemaValidator(): AjvJsonSchemaValidator {\n  return new AjvJsonSchemaValidator();\n}\n\nexport function registerTinyCloudTools(\n  server: McpServer,\n  selection: McpStartupSelection,\n  validator: AjvJsonSchemaValidator,\n): void {\n  const bindings = TOOL_BINDINGS.filter((binding) =>\n    bindingSurfaces(binding).includes(selection.surface) &&\n    (selection.allowedTools === undefined || selection.allowedTools.includes(binding.name)));\n  for (const binding of bindings) {\n    const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);\n    if (operation === undefined) {\n      throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);\n    }\n\n    const inputSchema = fromJsonSchema(\n      operation.input as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const outputSchema = fromJsonSchema(\n      operation.result as unknown as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const annotations: ToolAnnotations = {\n      readOnlyHint: binding.readOnlyHint,\n      idempotentHint: binding.idempotentHint,\n      destructiveHint: binding.destructiveHint,\n      openWorldHint: binding.openWorldHint,\n    };\n\n    server.registerTool(\n      binding.name,\n      {\n        title: operation.title,\n        description: operation.description,\n        inputSchema,\n        outputSchema,\n        annotations,\n      },\n      async (input: unknown): Promise<McpToolResult> => {\n        const startedAt = performance.now();\n        const metrics = { replayedGrants: 0 };\n        let code = \"INTERNAL_ERROR\";\n        try {\n          await selection.beforeOperation?.();\n          const result = await invokeOperation(\n            binding.operationId,\n            binding.operationVersion,\n            invocationTargetForMcp(selection),\n            input,\n            metrics,\n          );\n          const projected = selection.transformOperationResult === undefined\n            ? result\n            : await selection.transformOperationResult(result, {\n              operationId: binding.operationId,\n              operationVersion: binding.operationVersion,\n              input,\n            });\n          const response = toMcpToolResult(projected, bindings, {\n            surface: selection.surface === \"local\" ? \"local\" : \"hosted\",\n            readOnly: binding.readOnlyHint,\n            operationId: binding.operationId,\n          });\n          code = outcomeCode(response.structuredContent);\n          return response;\n        } finally {\n          if (selection.surface !== \"local\") {\n            logToolCall(binding.name, code, startedAt, metrics.replayedGrants);\n          }\n        }\n      },\n    );\n  }\n}\n\nfunction outcomeCode(result: McpToolResult[\"structuredContent\"]): string {\n  if (result.status === \"error\") {\n    const error = result.error as { code?: unknown } | undefined;\n    return typeof error?.code === \"string\" && Object.hasOwn(stableErrorCodes, error.code) ? error.code : \"INTERNAL_ERROR\";\n  }\n  if (result.status !== \"ok\") return result.status;\n  const output = result.output as { outcome?: unknown; ops?: readonly { outcome?: unknown }[] } | undefined;\n  if (output?.outcome === \"COPY_PARTIAL\") return \"COPY_PARTIAL\";\n  if (Array.isArray(output?.ops) && output.ops.some((op) => op.outcome !== \"ok\")) return \"PARTIAL\";\n  return \"ok\";\n}\n\nexport function toolBindingsForTest(): readonly ToolBinding[] {\n  return TOOL_BINDINGS;\n}\n","/** MCP preserves the canonical envelope; hosted clients also receive readable JSON. */\nexport interface CanonicalOperationResult {\n  readonly status: \"ok\" | \"authority_required\" | \"setup_required\" | \"error\";\n  readonly [key: string]: unknown;\n}\n\nexport interface McpToolResult extends CallToolResult {\n  readonly content: [{ readonly type: \"text\"; readonly text: string }];\n  readonly structuredContent: CanonicalOperationResult;\n}\n\n/** The binding fields needed to name the tool that runs an operation. */\nexport interface RecoveryToolBinding {\n  readonly name: string;\n  readonly operationId: string;\n}\n\nexport interface McpToolResultOptions {\n  readonly surface?: \"hosted\" | \"local\";\n  readonly readOnly?: boolean;\n  /** Trusted operation identity from the tool binding, not operation output. */\n  readonly operationId?: string;\n}\n\nexport function toMcpToolResult(\n  result: unknown,\n  bindings: readonly RecoveryToolBinding[] = [],\n  options: McpToolResultOptions = {},\n): McpToolResult {\n  let canonical: CanonicalOperationResult = isCanonicalOperationResult(result)\n    ? withRecoveryTool(result, bindings)\n    : {\n      status: \"error\",\n      operation: {},\n      context: {},\n      error: { code: \"INTERNAL_ERROR\" },\n    };\n  let serialized: string | undefined;\n  if (options.surface === \"hosted\") {\n    serialized = JSON.stringify(canonical);\n    if (\n      (options.readOnly === true ||\n        options.operationId === \"tinycloud.apps.context\" ||\n        options.operationId === \"tinycloud.apps.query\") &&\n      serialized.length > 100_000\n    ) {\n      const sql = options.operationId?.startsWith(\"tinycloud.sql.\") ||\n        options.operationId === \"tinycloud.apps.query\";\n      canonical = {\n        status: \"error\",\n        operation: canonical.operation,\n        context: canonical.context,\n        error: {\n          code: sql ? \"SQL_RESULT_LIMIT_EXCEEDED\" : \"KV_RESPONSE_TOO_LARGE\",\n          message: sql\n            ? \"The result exceeds 100,000 characters. Select fewer columns or rows, add a WHERE filter or a smaller LIMIT, or aggregate the data.\"\n            : \"The result exceeds 100,000 characters. Request fewer keys, narrow the prefix, or use a smaller page size.\",\n          retryable: false,\n        },\n      };\n      serialized = JSON.stringify(canonical);\n    }\n  }\n\n  return {\n    content: [{\n      type: \"text\",\n      text: resultSummary(canonical.status) +\n        (serialized !== undefined && !(options.operationId === \"tinycloud.secrets.get\" && canonical.status === \"ok\")\n          ? `\\n${serialized}` : \"\"),\n    }],\n    structuredContent: canonical,\n  };\n}\n\n/**\n * A redacted `complete_migration` recovery names an operation; MCP clients\n * call tools, so name the bound tool. `tool` comes from the code-owned binding\n * table only, never from operation data, and is added after redaction. An\n * operationId with no binding gets no `tool`.\n */\nfunction withRecoveryTool(\n  result: CanonicalOperationResult,\n  bindings: readonly RecoveryToolBinding[],\n): CanonicalOperationResult {\n  if (result.status !== \"error\") return result;\n  // The kernel's redaction already constrained `error.details.recovery` to a\n  // safe recovery object; only its discriminant and operationId are read here.\n  const error = result.error as\n    | { readonly details?: { readonly recovery?: { readonly action?: unknown; readonly operationId?: unknown } } }\n    | undefined;\n  const recovery = error?.details?.recovery;\n  if (recovery?.action !== \"complete_migration\") return result;\n  const binding = bindings.find((candidate) => candidate.operationId === recovery.operationId);\n  if (binding === undefined) return result;\n  return {\n    ...result,\n    error: { ...error, details: { ...error?.details, recovery: { ...recovery, tool: binding.name } } },\n  };\n}\n\n/** The canonical envelope immediately before MCP protocol serialization. */\nexport function canonicalMcpAdapterResult(result: unknown): CanonicalOperationResult {\n  return toMcpToolResult(result).structuredContent;\n}\n\nfunction isCanonicalOperationResult(value: unknown): value is CanonicalOperationResult {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const status = (value as { status?: unknown }).status;\n  return status === \"ok\" ||\n    status === \"authority_required\" ||\n    status === \"setup_required\" ||\n    status === \"error\";\n}\n\nfunction resultSummary(status: CanonicalOperationResult[\"status\"]): string {\n  switch (status) {\n    case \"ok\":\n      return \"TinyCloud operation completed; use the structured result.\";\n    case \"authority_required\":\n      return \"TinyCloud authority is required; use the structured request and approval action.\";\n    case \"setup_required\":\n      return \"TinyCloud setup is required; use the structured setup action.\";\n    case \"error\":\n      return \"TinyCloud operation failed; use the structured error.\";\n  }\n}\nimport type { CallToolResult } from \"@modelcontextprotocol/server\";\n","/** Only code-owned tool names/codes and numeric counters reach this sink. */\nexport function logToolCall(\n  tool: string,\n  code: string,\n  startedAt: number,\n  replayedGrants: number,\n): void {\n  process.stderr.write(`${JSON.stringify({\n    tool,\n    code,\n    durationMs: Math.max(0, Math.round(performance.now() - startedAt)),\n    replayedGrants,\n  })}\\n`);\n}\n","type JsonSchema = boolean | Record<string, unknown>;\n\nconst DRAFT_7 = \"http://json-schema.org/draft-07/schema#\";\nconst DRAFT_2020_12 = \"https://json-schema.org/draft/2020-12/schema\";\nconst schemaMaps = new Set([\"properties\", \"patternProperties\", \"definitions\", \"$defs\"]);\nconst schemaArrays = new Set([\"allOf\", \"anyOf\", \"oneOf\"]);\nconst schemaValues = new Set([\n  \"additionalProperties\", \"items\", \"contains\", \"propertyNames\", \"not\", \"if\", \"then\", \"else\",\n]);\n\n/** Project the catalog's shared Draft-07/2020-12 vocabulary without changing its validation rules. */\nexport function toMcpJsonSchema(schema: Record<string, unknown>): Record<string, unknown>;\nexport function toMcpJsonSchema(schema: JsonSchema): JsonSchema;\nexport function toMcpJsonSchema(schema: JsonSchema): JsonSchema {\n  if (typeof schema === \"boolean\") return schema;\n  // These forms need a semantic migration, not just a dialect declaration. The\n  // generated catalog does not use them; fail closed if that contract changes.\n  if (Array.isArray(schema.items) || \"additionalItems\" in schema || \"dependencies\" in schema ||\n    (\"$ref\" in schema && Object.keys(schema).some((key) => key !== \"$ref\"))) {\n    throw new Error(\"The operations schema needs a semantic migration to JSON Schema 2020-12.\");\n  }\n\n  const projected: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(schema)) {\n    if (key === \"$schema\") {\n      if (value !== DRAFT_7) throw new Error(`Unsupported operations schema dialect: ${String(value)}.`);\n      projected[key] = DRAFT_2020_12;\n    } else if (schemaMaps.has(key)) {\n      projected[key] = Object.fromEntries(Object.entries(value as Record<string, JsonSchema>)\n        .map(([name, child]) => [name, toMcpJsonSchema(child)]));\n    } else if (schemaArrays.has(key)) {\n      projected[key] = (value as JsonSchema[]).map(toMcpJsonSchema);\n    } else if (schemaValues.has(key)) {\n      projected[key] = toMcpJsonSchema(value as JsonSchema);\n    } else {\n      // Descriptions, defaults, examples and const/enum values are data, not schemas.\n      projected[key] = value;\n    }\n  }\n  return projected;\n}\n","{\n  \"name\": \"@tinycloud/mcp\",\n  \"version\": \"0.8.3-beta.22\",\n  \"description\": \"TinyCloud delegated operations MCP server\",\n  \"keywords\": [\n    \"tinycloud\",\n    \"mcp\",\n    \"model-context-protocol\",\n    \"agents\",\n    \"delegation\",\n    \"ucan\",\n    \"kv\",\n    \"sqlite\"\n  ],\n  \"author\": \"TinyCloud, Inc.\",\n  \"license\": \"EGPL\",\n  \"type\": \"module\",\n  \"main\": \"dist/index.cjs\",\n  \"module\": \"dist/index.js\",\n  \"types\": \"dist/index.d.ts\",\n  \"bin\": {\n    \"tinycloud-mcp\": \"./bin/tinycloud-mcp\",\n    \"tinycloud-mcp-http\": \"./bin/tinycloud-mcp-http\"\n  },\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    },\n    \"./server\": {\n      \"types\": \"./dist/server.d.ts\",\n      \"import\": \"./dist/server.js\",\n      \"require\": \"./dist/server.cjs\"\n    },\n    \"./tools\": {\n      \"types\": \"./dist/tools.d.ts\",\n      \"import\": \"./dist/tools.js\",\n      \"require\": \"./dist/tools.cjs\"\n    },\n    \"./results\": {\n      \"types\": \"./dist/results.d.ts\",\n      \"import\": \"./dist/results.js\",\n      \"require\": \"./dist/results.cjs\"\n    },\n    \"./http\": {\n      \"types\": \"./dist/http.d.ts\",\n      \"import\": \"./dist/http.js\",\n      \"require\": \"./dist/http.cjs\"\n    }\n  },\n  \"files\": [\n    \"dist\",\n    \"bin\",\n    \"generated\",\n    \"skills\"\n  ],\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"clean\": \"rm -rf dist\",\n    \"test\": \"bun run build && bun scripts/test.ts && bun run check:generated\",\n    \"test:stdio\": \"bun run build && bun test src/stdio.test.ts\",\n    \"typecheck\": \"tsc -p tsconfig.json\",\n    \"start:http\": \"node dist/http-cli.js\",\n    \"generate\": \"bun scripts/generate.ts\",\n    \"check:generated\": \"bun scripts/generate.ts --check\"\n  },\n  \"dependencies\": {\n    \"@modelcontextprotocol/node\": \"2.0.0-beta.5\",\n    \"@modelcontextprotocol/server\": \"2.0.0-beta.5\",\n    \"@tinycloud/node-sdk\": \"3.8.0-beta.20\",\n    \"@tinycloud/node-sdk-wasm\": \"1.7.8\",\n    \"@tinycloud/operations\": \"0.7.7-beta.19\",\n    \"jose\": \"6.2.4\"\n  },\n  \"devDependencies\": {\n    \"@modelcontextprotocol/client\": \"2.0.0-beta.5\",\n    \"@types/node\": \"^20\",\n    \"tsup\": \"^8.0.0\",\n    \"typescript\": \"^5.9.3\"\n  },\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/TinyCloudLabs/js-sdk\"\n  },\n  \"homepage\": \"https://docs.tinycloud.xyz/cli/mcp\"\n}\n","import packageMetadata from \"../package.json\";\n\nexport const MCP_VERSION = packageMetadata.version;\n"],"mappings":";AAAA,SAAS,gBAAgB;AAEzB,SAAS,oCAAoC;;;ACF7C,SAAS,iBAAiB;AAC1B,SAAS,kBAA0C;;;ACDnD,SAAS,qBAAqB;AAC9B,SAAS,YAAY;AAErB,SAAS,sBAA4D;AACrE,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;;;ACmBzB,SAAS,gBACd,QACA,WAA2C,CAAC,GAC5C,UAAgC,CAAC,GAClB;AACf,MAAI,YAAsC,2BAA2B,MAAM,IACvE,iBAAiB,QAAQ,QAAQ,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,WAAW,CAAC;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC;AACF,MAAI;AACJ,MAAI,QAAQ,YAAY,UAAU;AAChC,iBAAa,KAAK,UAAU,SAAS;AACrC,SACG,QAAQ,aAAa,QACpB,QAAQ,gBAAgB,4BACxB,QAAQ,gBAAgB,2BAC1B,WAAW,SAAS,KACpB;AACA,YAAM,MAAM,QAAQ,aAAa,WAAW,gBAAgB,KAC1D,QAAQ,gBAAgB;AAC1B,kBAAY;AAAA,QACV,QAAQ;AAAA,QACR,WAAW,UAAU;AAAA,QACrB,SAAS,UAAU;AAAA,QACnB,OAAO;AAAA,UACL,MAAM,MAAM,8BAA8B;AAAA,UAC1C,SAAS,MACL,uIACA;AAAA,UACJ,WAAW;AAAA,QACb;AAAA,MACF;AACA,mBAAa,KAAK,UAAU,SAAS;AAAA,IACvC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,CAAC;AAAA,MACR,MAAM;AAAA,MACN,MAAM,cAAc,UAAU,MAAM,KACjC,eAAe,UAAa,EAAE,QAAQ,gBAAgB,2BAA2B,UAAU,WAAW,QACnG;AAAA,EAAK,UAAU,KAAK;AAAA,IAC5B,CAAC;AAAA,IACD,mBAAmB;AAAA,EACrB;AACF;AAQA,SAAS,iBACP,QACA,UAC0B;AAC1B,MAAI,OAAO,WAAW,QAAS,QAAO;AAGtC,QAAM,QAAQ,OAAO;AAGrB,QAAM,WAAW,OAAO,SAAS;AACjC,MAAI,UAAU,WAAW,qBAAsB,QAAO;AACtD,QAAM,UAAU,SAAS,KAAK,CAAC,cAAc,UAAU,gBAAgB,SAAS,WAAW;AAC3F,MAAI,YAAY,OAAW,QAAO;AAClC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,EAAE,GAAG,OAAO,SAAS,EAAE,GAAG,OAAO,SAAS,UAAU,EAAE,GAAG,UAAU,MAAM,QAAQ,KAAK,EAAE,EAAE;AAAA,EACnG;AACF;AAOA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAU,MAA+B;AAC/C,SAAO,WAAW,QAChB,WAAW,wBACX,WAAW,oBACX,WAAW;AACf;AAEA,SAAS,cAAc,QAAoD;AACzE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;;;AC7HO,SAAS,YACd,MACA,MACA,WACA,gBACM;AACN,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU;AAAA,IACrC;AAAA,IACA;AAAA,IACA,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS,CAAC;AAAA,IACjE;AAAA,EACF,CAAC,CAAC;AAAA,CAAI;AACR;;;ACXA,IAAM,UAAU;AAChB,IAAM,gBAAgB;AACtB,IAAM,aAAa,oBAAI,IAAI,CAAC,cAAc,qBAAqB,eAAe,OAAO,CAAC;AACtF,IAAM,eAAe,oBAAI,IAAI,CAAC,SAAS,SAAS,OAAO,CAAC;AACxD,IAAM,eAAe,oBAAI,IAAI;AAAA,EAC3B;AAAA,EAAwB;AAAA,EAAS;AAAA,EAAY;AAAA,EAAiB;AAAA,EAAO;AAAA,EAAM;AAAA,EAAQ;AACrF,CAAC;AAKM,SAAS,gBAAgB,QAAgC;AAC9D,MAAI,OAAO,WAAW,UAAW,QAAO;AAGxC,MAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,qBAAqB,UAAU,kBAAkB,UACjF,UAAU,UAAU,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,QAAQ,QAAQ,MAAM,GAAI;AACzE,UAAM,IAAI,MAAM,0EAA0E;AAAA,EAC5F;AAEA,QAAM,YAAqC,CAAC;AAC5C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,WAAW;AACrB,UAAI,UAAU,QAAS,OAAM,IAAI,MAAM,0CAA0C,OAAO,KAAK,CAAC,GAAG;AACjG,gBAAU,GAAG,IAAI;AAAA,IACnB,WAAW,WAAW,IAAI,GAAG,GAAG;AAC9B,gBAAU,GAAG,IAAI,OAAO,YAAY,OAAO,QAAQ,KAAmC,EACnF,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,gBAAgB,KAAK,CAAC,CAAC,CAAC;AAAA,IAC3D,WAAW,aAAa,IAAI,GAAG,GAAG;AAChC,gBAAU,GAAG,IAAK,MAAuB,IAAI,eAAe;AAAA,IAC9D,WAAW,aAAa,IAAI,GAAG,GAAG;AAChC,gBAAU,GAAG,IAAI,gBAAgB,KAAmB;AAAA,IACtD,OAAO;AAEL,gBAAU,GAAG,IAAI;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;;;AH+BO,SAAS,uBACd,WACqB;AACrB,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,GAAI,UAAU,mBAAmB,UAAU,oBACvC,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,IACL,GAAI,UAAU,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,UAAU,UAAU;AAAA,EAChF;AACF;AAoBA,IAAM,iBAAiB;AAAA,EACrB,OAAO,cAAc,WAAW,KAAK,WAAW,WAAW,IAAI,YAAY;AAC7E;AACA,IAAM,mBAAmB;AAAA,EACvB;AACF;AACA,IAAM,mBAAmD,OAAO;AAAA,EAC9D,iBAAiB,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,IAAa,CAAC;AACnE;AAcA,IAAM,mBAA0C,CAAC,SAAS,QAAQ;AAG3D,SAAS,gBAAgB,SAA6C;AAC3E,SAAO,QAAQ,YAAY;AAC7B;AAEO,IAAM,gBAAwC;AAAA,EACnD;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA;AAAA;AAAA,IAGf,UAAU,CAAC,OAAO;AAAA,EACpB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA;AAAA;AAAA,IAGf,UAAU,CAAC,OAAO;AAAA,EACpB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AACF;AAGA,IAAM,cAAc,IAAI,IAAI,iBAAiB,WAAW,IAAI,CAAC,cAAc;AAAA,EACzE,GAAG,UAAU,EAAE,IAAI,UAAU,OAAO;AAAA,EACpC;AAAA,IACE,GAAG;AAAA,IACH,OAAO,gBAAgB,UAAU,KAAK;AAAA,IACtC,QAAQ,gBAAgB,UAAU,MAAM;AAAA,EAC1C;AACF,CAAC,CAAC;AAEK,SAAS,4BAAoD;AAClE,SAAO,IAAI,uBAAuB;AACpC;AAEO,SAAS,uBACd,QACA,WACA,WACM;AACN,QAAM,WAAW,cAAc,OAAO,CAAC,YACrC,gBAAgB,OAAO,EAAE,SAAS,UAAU,OAAO,MAClD,UAAU,iBAAiB,UAAa,UAAU,aAAa,SAAS,QAAQ,IAAI,EAAE;AACzF,aAAW,WAAW,UAAU;AAC9B,UAAM,YAAY,YAAY,IAAI,GAAG,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,EAAE;AACtF,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI,MAAM,2CAA2C,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,GAAG;AAAA,IAC/G;AAEA,UAAM,cAAc;AAAA,MAClB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,eAAe;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,cAA+B;AAAA,MACnC,cAAc,QAAQ;AAAA,MACtB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB,eAAe,QAAQ;AAAA,IACzB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,QACE,OAAO,UAAU;AAAA,QACjB,aAAa,UAAU;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,OAAO,UAA2C;AAChD,cAAM,YAAY,YAAY,IAAI;AAClC,cAAM,UAAU,EAAE,gBAAgB,EAAE;AACpC,YAAI,OAAO;AACX,YAAI;AACF,gBAAM,UAAU,kBAAkB;AAClC,gBAAM,SAAS,MAAM;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,uBAAuB,SAAS;AAAA,YAChC;AAAA,YACA;AAAA,UACF;AACA,gBAAM,YAAY,UAAU,6BAA6B,SACrD,SACA,MAAM,UAAU,yBAAyB,QAAQ;AAAA,YACjD,aAAa,QAAQ;AAAA,YACrB,kBAAkB,QAAQ;AAAA,YAC1B;AAAA,UACF,CAAC;AACH,gBAAM,WAAW,gBAAgB,WAAW,UAAU;AAAA,YACpD,SAAS,UAAU,YAAY,UAAU,UAAU;AAAA,YACnD,UAAU,QAAQ;AAAA,YAClB,aAAa,QAAQ;AAAA,UACvB,CAAC;AACD,iBAAO,YAAY,SAAS,iBAAiB;AAC7C,iBAAO;AAAA,QACT,UAAE;AACA,cAAI,UAAU,YAAY,SAAS;AACjC,wBAAY,QAAQ,MAAM,MAAM,WAAW,QAAQ,cAAc;AAAA,UACnE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,YAAY,QAAoD;AACvE,MAAI,OAAO,WAAW,SAAS;AAC7B,UAAM,QAAQ,OAAO;AACrB,WAAO,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,kBAAkB,MAAM,IAAI,IAAI,MAAM,OAAO;AAAA,EACvG;AACA,MAAI,OAAO,WAAW,KAAM,QAAO,OAAO;AAC1C,QAAM,SAAS,OAAO;AACtB,MAAI,QAAQ,YAAY,eAAgB,QAAO;AAC/C,MAAI,MAAM,QAAQ,QAAQ,GAAG,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,GAAG,YAAY,IAAI,EAAG,QAAO;AACvF,SAAO;AACT;;;AIjcA;AAAA,EACE,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,aAAe;AAAA,EACf,UAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAU;AAAA,EACV,SAAW;AAAA,EACX,MAAQ;AAAA,EACR,MAAQ;AAAA,EACR,QAAU;AAAA,EACV,OAAS;AAAA,EACT,KAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,sBAAsB;AAAA,EACxB;AAAA,EACA,SAAW;AAAA,IACT,KAAK;AAAA,MACH,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,YAAY;AAAA,MACV,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACT,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,aAAa;AAAA,MACX,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,MACR,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,OAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,SAAW;AAAA,IACT,MAAQ;AAAA,EACV;AAAA,EACA,SAAW;AAAA,IACT,OAAS;AAAA,IACT,OAAS;AAAA,IACT,MAAQ;AAAA,IACR,cAAc;AAAA,IACd,WAAa;AAAA,IACb,cAAc;AAAA,IACd,UAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAAA,EACA,cAAgB;AAAA,IACd,8BAA8B;AAAA,IAC9B,gCAAgC;AAAA,IAChC,uBAAuB;AAAA,IACvB,4BAA4B;AAAA,IAC5B,yBAAyB;AAAA,IACzB,MAAQ;AAAA,EACV;AAAA,EACA,iBAAmB;AAAA,IACjB,gCAAgC;AAAA,IAChC,eAAe;AAAA,IACf,MAAQ;AAAA,IACR,YAAc;AAAA,EAChB;AAAA,EACA,YAAc;AAAA,IACZ,MAAQ;AAAA,IACR,KAAO;AAAA,EACT;AAAA,EACA,UAAY;AACd;;;ACvFO,IAAM,cAAc,gBAAgB;;;ANIpC,IAAM,kBAAkB;AAKxB,SAAS,yBAAyB,WAAyC;AAChF,QAAM,YAAY,0BAA0B;AAC5C,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,iBAAiB,SAAS,YAAY;AAAA,IAC9C,EAAE,qBAAqB,UAAU;AAAA,EACnC;AACA,yBAAuB,QAAQ,EAAE,GAAG,WAAW,SAAS,QAAQ,GAAG,SAAS;AAC5E,SAAO;AACT;AAGO,SAAS,kBAAkB,WAAiD;AACjF,SAAO;AAAA,IACL,MAAM,yBAAyB,SAAS;AAAA,IACxC,EAAE,SAAS,MAAM,uBAAuB,qBAAqB,EAAE;AAAA,EACjE;AACF;AAEA,SAAS,uBAAuB,SAAuB;AACrD,UAAQ,OAAO,MAAM,mBAAmB,OAAO;AAAA,CAAI;AACrD;;;ADjBA,IAAM,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWN,SAAS,gBAAgB,YAAiD;AAC/E,MAAI;AACJ,MAAI,kBAAkB;AACtB,MAAI,oBAAoB;AACxB,MAAI,OAAO;AACX,MAAI,UAAU;AAEd,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS,GAAG;AACzD,UAAM,WAAW,WAAW,KAAK;AACjC,QAAI,aAAa,YAAY,aAAa,MAAM;AAC9C,aAAO;AACP;AAAA,IACF;AACA,QAAI,aAAa,eAAe,aAAa,MAAM;AACjD,gBAAU;AACV;AAAA,IACF;AACA,QAAI,aAAa,yBAAyB;AACxC,0BAAoB;AACpB;AAAA,IACF;AACA,QAAI,aAAa,aAAa;AAC5B,YAAM,QAAQ,WAAW,QAAQ,CAAC;AAClC,UAAI,UAAU,UAAa,MAAM,WAAW,GAAG,KAAK,MAAM,KAAK,EAAE,WAAW,GAAG;AAC7E,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,gBAAU;AACV,wBAAkB;AAClB,eAAS;AACT;AAAA,IACF;AACA,QAAI,UAAU,WAAW,YAAY,GAAG;AACtC,YAAM,QAAQ,SAAS,MAAM,aAAa,MAAM;AAChD,UAAI,MAAM,KAAK,EAAE,WAAW,EAAG,OAAM,IAAI,MAAM,8CAA8C;AAC7F,gBAAU;AACV,wBAAkB;AAClB;AAAA,IACF;AACA,UAAM,IAAI,MAAM,mBAAmB,QAAQ,EAAE;AAAA,EAC/C;AAEA,SAAO,EAAE,SAAS,iBAAiB,mBAAmB,MAAM,QAAQ;AACtE;AAEA,eAAsB,KAAK,aAAgC,QAAQ,KAAK,MAAM,CAAC,GAAoB;AACjG,MAAI;AACJ,MAAI;AACF,cAAU,gBAAgB,UAAU;AAAA,EACtC,SAAS,OAAO;AACd,YAAQ,OAAO,MAAM,yCAAyC;AAC9D,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,MAAM;AAChB,YAAQ,OAAO,MAAM,IAAI;AACzB,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,SAAS;AACnB,YAAQ,OAAO,MAAM,GAAG,WAAW;AAAA,CAAI;AACvC,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,6BAA6B,QAAQ,OAAO;AAAA,EAC9D,QAAQ;AACN,YAAQ,OAAO,MAAM,+CAA+C;AACpE,WAAO;AAAA,EACT;AAIA,oBAAkB;AAAA,IAChB;AAAA,IACA,iBAAiB,QAAQ;AAAA,IACzB,mBAAmB,QAAQ;AAAA,EAC7B,CAAC;AACD,SAAO;AACT;AAEA,SAAS,qBAA8B;AACrC,QAAM,OAAO,QAAQ,KAAK,CAAC;AAC3B,MAAI,SAAS,OAAW,QAAO;AAC/B,SAAO,SAAS,IAAI,MAAM,YAAY,SAAS,IAAI,MAAM,aAAa,SAAS,IAAI,MAAM;AAC3F;AAEA,IAAI,mBAAmB,GAAG;AACxB,OAAK,KAAK,EAAE,KAAK,CAAC,SAAS;AACzB,QAAI,SAAS,EAAG,SAAQ,WAAW;AAAA,EACrC,CAAC,EAAE,MAAM,MAAM;AACb,YAAQ,OAAO,MAAM,mCAAmC;AACxD,YAAQ,WAAW;AAAA,EACrB,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/cli.ts","../src/server.ts","../src/tools.ts","../src/results.ts","../src/logging.ts","../src/schemas.ts","../package.json","../src/version.ts"],"sourcesContent":["import { basename } from \"node:path\";\n\nimport { resolveInvocationProfileName } from \"@tinycloud/operations/profile\";\n\nimport { serveTinyCloudMcp, MCP_VERSION } from \"./server.js\";\n\nexport interface ParsedCliOptions {\n  readonly profile?: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n  readonly help: boolean;\n  readonly version: boolean;\n}\n\nconst HELP = `TinyCloud delegated operations MCP server\n\nUsage: tinycloud-mcp [options]\n\nOptions:\n  --profile <name>       Pin the TinyCloud profile for this process\n  --allow-owner-profile  Allow data execution for an explicitly selected owner profile\n  --help                 Show this help\n  --version              Show the package version\n`;\n\nexport function parseCliOptions(arguments_: readonly string[]): ParsedCliOptions {\n  let profile: string | undefined;\n  let explicitProfile = false;\n  let allowOwnerProfile = false;\n  let help = false;\n  let version = false;\n\n  for (let index = 0; index < arguments_.length; index += 1) {\n    const argument = arguments_[index];\n    if (argument === \"--help\" || argument === \"-h\") {\n      help = true;\n      continue;\n    }\n    if (argument === \"--version\" || argument === \"-v\") {\n      version = true;\n      continue;\n    }\n    if (argument === \"--allow-owner-profile\") {\n      allowOwnerProfile = true;\n      continue;\n    }\n    if (argument === \"--profile\") {\n      const value = arguments_[index + 1];\n      if (value === undefined || value.startsWith(\"-\") || value.trim().length === 0) {\n        throw new Error(\"--profile requires a non-empty profile name.\");\n      }\n      profile = value;\n      explicitProfile = true;\n      index += 1;\n      continue;\n    }\n    if (argument?.startsWith(\"--profile=\")) {\n      const value = argument.slice(\"--profile=\".length);\n      if (value.trim().length === 0) throw new Error(\"--profile requires a non-empty profile name.\");\n      profile = value;\n      explicitProfile = true;\n      continue;\n    }\n    throw new Error(`Unknown option: ${argument}`);\n  }\n\n  return { profile, explicitProfile, allowOwnerProfile, help, version };\n}\n\nexport async function main(arguments_: readonly string[] = process.argv.slice(2)): Promise<number> {\n  let options: ParsedCliOptions;\n  try {\n    options = parseCliOptions(arguments_);\n  } catch (error) {\n    process.stderr.write(\"[tinycloud-mcp] Invalid command line.\\n\");\n    return 2;\n  }\n\n  if (options.help) {\n    process.stdout.write(HELP);\n    return 0;\n  }\n  if (options.version) {\n    process.stdout.write(`${MCP_VERSION}\\n`);\n    return 0;\n  }\n\n  let profile: string;\n  try {\n    profile = await resolveInvocationProfileName(options.profile);\n  } catch {\n    process.stderr.write(\"[tinycloud-mcp] Could not select a profile.\\n\");\n    return 2;\n  }\n\n  // The selected profile is now a value captured by the server closure. Every\n  // operation receives it explicitly and cannot re-read TC_PROFILE/config.\n  serveTinyCloudMcp({\n    profile,\n    explicitProfile: options.explicitProfile,\n    allowOwnerProfile: options.allowOwnerProfile,\n  });\n  return 0;\n}\n\nfunction isDirectInvocation(): boolean {\n  const argv = process.argv[1];\n  if (argv === undefined) return false;\n  return basename(argv) === \"cli.js\" || basename(argv) === \"cli.cjs\" || basename(argv) === \"tinycloud-mcp\";\n}\n\nif (isDirectInvocation()) {\n  void main().then((code) => {\n    if (code !== 0) process.exitCode = code;\n  }).catch(() => {\n    process.stderr.write(\"[tinycloud-mcp] Startup failed.\\n\");\n    process.exitCode = 1;\n  });\n}\n","import { McpServer } from \"@modelcontextprotocol/server\";\nimport { serveStdio, type StdioServerHandle } from \"@modelcontextprotocol/server/stdio\";\n\nimport { createJsonSchemaValidator, registerTinyCloudTools, type McpStartupSelection } from \"./tools.js\";\nimport { MCP_VERSION } from \"./version.js\";\n\nexport const MCP_SERVER_NAME = \"tinycloud-mcp\";\nexport { MCP_VERSION } from \"./version.js\";\n/** The stdio server is always the local surface. */\nexport type LocalMcpSelection = Omit<McpStartupSelection, \"surface\">;\n\nexport function createTinyCloudMcpServer(selection: LocalMcpSelection): McpServer {\n  const validator = createJsonSchemaValidator();\n  const server = new McpServer(\n    { name: MCP_SERVER_NAME, version: MCP_VERSION },\n    { jsonSchemaValidator: validator },\n  );\n  registerTinyCloudTools(server, { ...selection, surface: \"local\" }, validator);\n  return server;\n}\n\n/** Start the only supported MCP transport: local stdio. */\nexport function serveTinyCloudMcp(selection: LocalMcpSelection): StdioServerHandle {\n  return serveStdio(\n    () => createTinyCloudMcpServer(selection),\n    { onerror: () => writeBoundedDiagnostic(\"MCP transport error\") },\n  );\n}\n\nfunction writeBoundedDiagnostic(message: string): void {\n  process.stderr.write(`[tinycloud-mcp] ${message}\\n`);\n}\n","import { createRequire } from \"node:module\";\nimport { join } from \"node:path\";\n\nimport { fromJsonSchema, type McpServer, type ToolAnnotations } from \"@modelcontextprotocol/server\";\nimport { AjvJsonSchemaValidator } from \"@modelcontextprotocol/server/validators/ajv\";\nimport { invokeOperation } from \"@tinycloud/operations\";\n\nimport { toMcpToolResult, type McpToolResult } from \"./results.js\";\nimport { logToolCall } from \"./logging.js\";\nimport { toMcpJsonSchema } from \"./schemas.js\";\n\nexport const TOOL_NAMES = [\n  \"tinycloud_status\",\n  \"tinycloud_auth_status\",\n  \"tinycloud_auth_capabilities\",\n  \"tinycloud_auth_request\",\n  \"tinycloud_auth_import\",\n  \"tinycloud_account_spaces_list\",\n  \"tinycloud_account_applications_list\",\n  \"tinycloud_kv_list\",\n  \"tinycloud_kv_get\",\n  \"tinycloud_kv_head\",\n  \"tinycloud_kv_put\",\n  \"tinycloud_kv_delete\",\n  \"tinycloud_knowledge_list\",\n  \"tinycloud_knowledge_read\",\n  \"tinycloud_sql_schema_inspect\",\n  \"tinycloud_sql_query\",\n  \"tinycloud_sql_execute\",\n  \"tinycloud_secrets_get\",\n  \"tinycloud_secrets_status\",\n  \"tinycloud_apps_context\",\n  \"tinycloud_apps_read\",\n  \"tinycloud_apps_write\",\n  \"tinycloud_apps_query\",\n] as const;\n\nexport type ToolName = (typeof TOOL_NAMES)[number];\n\n/** Private stdio/hosted surfaces and the restricted public plugin. */\nexport type McpSurface = \"local\" | \"hosted\" | \"public\";\n\nexport interface McpStartupSelection {\n  /** Which server registers the tools; bindings not on this surface are skipped. */\n  readonly surface: McpSurface;\n  readonly profile: string;\n  readonly explicitProfile: boolean;\n  readonly allowOwnerProfile: boolean;\n  /** Absolute TinyCloud home used to isolate one hosted principal. */\n  readonly stateRoot?: string;\n  /** Optional allowlist for surfaces whose grant is narrower than hosted OAuth. */\n  readonly allowedTools?: readonly ToolName[];\n  /** Check node authority only when an operation needs the account. */\n  readonly beforeOperation?: () => Promise<void>;\n  /** Hosted transports may attach a browser approval URL to canonical results. */\n  readonly transformOperationResult?: (result: unknown, invocation: McpOperationInvocation) => Promise<unknown>;\n}\n\nexport interface McpOperationInvocation {\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly input: unknown;\n}\n\nexport interface McpInvocationTarget {\n  readonly profile: string;\n  readonly allowOwnerProfile?: true;\n  readonly stateRoot?: string;\n}\n\n/** Project one startup selection into the only owner-sensitive target shape. */\nexport function invocationTargetForMcp(\n  selection: Omit<McpStartupSelection, \"surface\">,\n): McpInvocationTarget {\n  return {\n    profile: selection.profile,\n    ...(selection.explicitProfile && selection.allowOwnerProfile\n      ? { allowOwnerProfile: true }\n      : {}),\n    ...(selection.stateRoot === undefined ? {} : { stateRoot: selection.stateRoot }),\n  };\n}\n\ninterface CatalogOperation {\n  readonly id: string;\n  readonly version: number;\n  readonly title: string;\n  readonly description: string;\n  readonly input: Record<string, unknown>;\n  readonly result: Record<string, unknown>;\n}\n\ninterface OperationsCatalog {\n  readonly stableErrors: readonly string[];\n  readonly operations: readonly CatalogOperation[];\n}\n\n// The require anchor is this module, never the consumer entrypoint. In ESM\n// tsup preserves import.meta.url; in CJS it rewrites the same module-relative\n// anchor to the generated __filename, so both formats stay in MCP's package\n// dependency boundary.\nconst packageRequire = createRequire(\n  typeof __dirname === \"string\" ? join(__dirname, \"tools.cjs\") : import.meta.url,\n);\nconst generatedCatalog = packageRequire(\n  \"@tinycloud/operations/operations.json\",\n) as OperationsCatalog;\nconst stableErrorCodes: Readonly<Record<string, true>> = Object.fromEntries(\n  generatedCatalog.stableErrors.map((code) => [code, true as const]),\n);\n\nexport interface ToolBinding {\n  readonly name: ToolName;\n  readonly operationId: string;\n  readonly operationVersion: number;\n  readonly readOnlyHint: boolean;\n  readonly idempotentHint: boolean;\n  readonly destructiveHint: boolean;\n  readonly openWorldHint: boolean;\n  /** Surfaces that register this tool; omitted means private local and hosted surfaces only. */\n  readonly surfaces?: readonly McpSurface[];\n}\n\nconst PRIVATE_SURFACES: readonly McpSurface[] = [\"local\", \"hosted\"];\n\n/** The surfaces a binding is registered on. */\nexport function bindingSurfaces(binding: ToolBinding): readonly McpSurface[] {\n  return binding.surfaces ?? PRIVATE_SURFACES;\n}\n\nexport const TOOL_BINDINGS: readonly ToolBinding[] = [\n  {\n    name: \"tinycloud_status\",\n    operationId: \"tinycloud.status.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_status\",\n    operationId: \"tinycloud.auth.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_capabilities\",\n    operationId: \"tinycloud.auth.capabilities\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_request\",\n    operationId: \"tinycloud.auth.request\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n  },\n  {\n    name: \"tinycloud_auth_import\",\n    operationId: \"tinycloud.auth.import\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n    // Hosted delegations must arrive through the owner/request-bound OpenKey callback,\n    // not a caller-supplied import artifact.\n    surfaces: [\"local\"],\n  },\n  {\n    name: \"tinycloud_account_spaces_list\",\n    operationId: \"tinycloud.account.spaces.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_account_applications_list\",\n    operationId: \"tinycloud.account.applications.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_list\",\n    operationId: \"tinycloud.kv.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_get\",\n    operationId: \"tinycloud.kv.get\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_head\",\n    operationId: \"tinycloud.kv.head\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_put\",\n    operationId: \"tinycloud.kv.put\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_kv_delete\",\n    operationId: \"tinycloud.kv.delete\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_knowledge_list\",\n    operationId: \"tinycloud.knowledge.list\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_knowledge_read\",\n    operationId: \"tinycloud.knowledge.read\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_schema_inspect\",\n    operationId: \"tinycloud.sql.schema.inspect\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_query\",\n    operationId: \"tinycloud.sql.query\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_sql_execute\",\n    operationId: \"tinycloud.sql.execute\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_get\",\n    operationId: \"tinycloud.secrets.get\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n  },\n  {\n    name: \"tinycloud_secrets_status\",\n    operationId: \"tinycloud.secrets.status\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: true,\n    // Hosted has no persistent reauthorization path for a revoked session\n    // yet (TC-896), so status is local/stdio only.\n    surfaces: [\"local\"],\n  },\n  {\n    name: \"tinycloud_apps_context\",\n    operationId: \"tinycloud.apps.context\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_read\",\n    operationId: \"tinycloud.apps.read\",\n    operationVersion: 1,\n    readOnlyHint: true,\n    idempotentHint: true,\n    destructiveHint: false,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_write\",\n    operationId: \"tinycloud.apps.write\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: false,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n  {\n    name: \"tinycloud_apps_query\",\n    operationId: \"tinycloud.apps.query\",\n    operationVersion: 1,\n    readOnlyHint: false,\n    idempotentHint: true,\n    destructiveHint: true,\n    openWorldHint: false,\n    surfaces: [\"hosted\", \"public\"],\n  },\n] as const;\n\n// Project once per process; never mutate the catalog shared with non-MCP consumers.\nconst definitions = new Map(generatedCatalog.operations.map((operation) => [\n  `${operation.id}@${operation.version}`,\n  {\n    ...operation,\n    input: toMcpJsonSchema(operation.input),\n    result: toMcpJsonSchema(operation.result),\n  },\n]));\n\nexport function createJsonSchemaValidator(): AjvJsonSchemaValidator {\n  return new AjvJsonSchemaValidator();\n}\n\nexport function registerTinyCloudTools(\n  server: McpServer,\n  selection: McpStartupSelection,\n  validator: AjvJsonSchemaValidator,\n): void {\n  const bindings = TOOL_BINDINGS.filter((binding) =>\n    bindingSurfaces(binding).includes(selection.surface) &&\n    (selection.allowedTools === undefined || selection.allowedTools.includes(binding.name)));\n  for (const binding of bindings) {\n    const operation = definitions.get(`${binding.operationId}@${binding.operationVersion}`);\n    if (operation === undefined) {\n      throw new Error(`Generated operations catalog is missing ${binding.operationId}@${binding.operationVersion}.`);\n    }\n\n    const inputSchema = fromJsonSchema(\n      operation.input as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const outputSchema = fromJsonSchema(\n      operation.result as unknown as Parameters<typeof fromJsonSchema>[0],\n      validator,\n    );\n    const annotations: ToolAnnotations = {\n      readOnlyHint: binding.readOnlyHint,\n      idempotentHint: binding.idempotentHint,\n      destructiveHint: binding.destructiveHint,\n      openWorldHint: binding.openWorldHint,\n    };\n\n    server.registerTool(\n      binding.name,\n      {\n        title: operation.title,\n        description: operation.description,\n        inputSchema,\n        outputSchema,\n        annotations,\n      },\n      async (input: unknown): Promise<McpToolResult> => {\n        const startedAt = performance.now();\n        const metrics = { replayedGrants: 0 };\n        let code = \"INTERNAL_ERROR\";\n        try {\n          await selection.beforeOperation?.();\n          const result = await invokeOperation(\n            binding.operationId,\n            binding.operationVersion,\n            invocationTargetForMcp(selection),\n            input,\n            metrics,\n          );\n          const projected = selection.transformOperationResult === undefined\n            ? result\n            : await selection.transformOperationResult(result, {\n              operationId: binding.operationId,\n              operationVersion: binding.operationVersion,\n              input,\n            });\n          const response = toMcpToolResult(projected, bindings, {\n            surface: selection.surface === \"local\" ? \"local\" : \"hosted\",\n            readOnly: binding.readOnlyHint,\n            operationId: binding.operationId,\n          });\n          code = outcomeCode(response.structuredContent);\n          return response;\n        } finally {\n          if (selection.surface !== \"local\") {\n            logToolCall(binding.name, code, startedAt, metrics.replayedGrants);\n          }\n        }\n      },\n    );\n  }\n}\n\nfunction outcomeCode(result: McpToolResult[\"structuredContent\"]): string {\n  if (result.status === \"error\") {\n    const error = result.error as { code?: unknown } | undefined;\n    return typeof error?.code === \"string\" && Object.hasOwn(stableErrorCodes, error.code) ? error.code : \"INTERNAL_ERROR\";\n  }\n  if (result.status !== \"ok\") return result.status;\n  const output = result.output as { outcome?: unknown; ops?: readonly { outcome?: unknown }[] } | undefined;\n  if (output?.outcome === \"COPY_PARTIAL\") return \"COPY_PARTIAL\";\n  if (Array.isArray(output?.ops) && output.ops.some((op) => op.outcome !== \"ok\")) return \"PARTIAL\";\n  return \"ok\";\n}\n\nexport function toolBindingsForTest(): readonly ToolBinding[] {\n  return TOOL_BINDINGS;\n}\n","/** MCP preserves the canonical envelope; hosted clients also receive readable JSON. */\nexport interface CanonicalOperationResult {\n  readonly status: \"ok\" | \"authority_required\" | \"setup_required\" | \"error\";\n  readonly [key: string]: unknown;\n}\n\nexport interface McpToolResult extends CallToolResult {\n  readonly content: [{ readonly type: \"text\"; readonly text: string }];\n  readonly structuredContent: CanonicalOperationResult;\n}\n\n/** The binding fields needed to name the tool that runs an operation. */\nexport interface RecoveryToolBinding {\n  readonly name: string;\n  readonly operationId: string;\n}\n\nexport interface McpToolResultOptions {\n  readonly surface?: \"hosted\" | \"local\";\n  readonly readOnly?: boolean;\n  /** Trusted operation identity from the tool binding, not operation output. */\n  readonly operationId?: string;\n}\n\nexport function toMcpToolResult(\n  result: unknown,\n  bindings: readonly RecoveryToolBinding[] = [],\n  options: McpToolResultOptions = {},\n): McpToolResult {\n  let canonical: CanonicalOperationResult = isCanonicalOperationResult(result)\n    ? withRecoveryTool(result, bindings)\n    : {\n      status: \"error\",\n      operation: {},\n      context: {},\n      error: { code: \"INTERNAL_ERROR\" },\n    };\n  let serialized: string | undefined;\n  if (options.surface === \"hosted\") {\n    serialized = JSON.stringify(canonical);\n    if (\n      (options.readOnly === true ||\n        options.operationId === \"tinycloud.apps.context\" ||\n        options.operationId === \"tinycloud.apps.query\") &&\n      serialized.length > 100_000\n    ) {\n      const sql = options.operationId?.startsWith(\"tinycloud.sql.\") ||\n        options.operationId === \"tinycloud.apps.query\";\n      canonical = {\n        status: \"error\",\n        operation: canonical.operation,\n        context: canonical.context,\n        error: {\n          code: sql ? \"SQL_RESULT_LIMIT_EXCEEDED\" : \"KV_RESPONSE_TOO_LARGE\",\n          message: sql\n            ? \"The result exceeds 100,000 characters. Select fewer columns or rows, add a WHERE filter or a smaller LIMIT, or aggregate the data.\"\n            : \"The result exceeds 100,000 characters. Request fewer keys, narrow the prefix, or use a smaller page size.\",\n          retryable: false,\n        },\n      };\n      serialized = JSON.stringify(canonical);\n    }\n  }\n\n  return {\n    content: [{\n      type: \"text\",\n      text: resultSummary(canonical.status) +\n        (serialized !== undefined && !(options.operationId === \"tinycloud.secrets.get\" && canonical.status === \"ok\")\n          ? `\\n${serialized}` : \"\"),\n    }],\n    structuredContent: canonical,\n  };\n}\n\n/**\n * A redacted `complete_migration` recovery names an operation; MCP clients\n * call tools, so name the bound tool. `tool` comes from the code-owned binding\n * table only, never from operation data, and is added after redaction. An\n * operationId with no binding gets no `tool`.\n */\nfunction withRecoveryTool(\n  result: CanonicalOperationResult,\n  bindings: readonly RecoveryToolBinding[],\n): CanonicalOperationResult {\n  if (result.status !== \"error\") return result;\n  // The kernel's redaction already constrained `error.details.recovery` to a\n  // safe recovery object; only its discriminant and operationId are read here.\n  const error = result.error as\n    | { readonly details?: { readonly recovery?: { readonly action?: unknown; readonly operationId?: unknown } } }\n    | undefined;\n  const recovery = error?.details?.recovery;\n  if (recovery?.action !== \"complete_migration\") return result;\n  const binding = bindings.find((candidate) => candidate.operationId === recovery.operationId);\n  if (binding === undefined) return result;\n  return {\n    ...result,\n    error: { ...error, details: { ...error?.details, recovery: { ...recovery, tool: binding.name } } },\n  };\n}\n\n/** The canonical envelope immediately before MCP protocol serialization. */\nexport function canonicalMcpAdapterResult(result: unknown): CanonicalOperationResult {\n  return toMcpToolResult(result).structuredContent;\n}\n\nfunction isCanonicalOperationResult(value: unknown): value is CanonicalOperationResult {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) return false;\n  const status = (value as { status?: unknown }).status;\n  return status === \"ok\" ||\n    status === \"authority_required\" ||\n    status === \"setup_required\" ||\n    status === \"error\";\n}\n\nfunction resultSummary(status: CanonicalOperationResult[\"status\"]): string {\n  switch (status) {\n    case \"ok\":\n      return \"TinyCloud operation completed; use the structured result.\";\n    case \"authority_required\":\n      return \"TinyCloud authority is required; use the structured request and approval action.\";\n    case \"setup_required\":\n      return \"TinyCloud setup is required; use the structured setup action.\";\n    case \"error\":\n      return \"TinyCloud operation failed; use the structured error.\";\n  }\n}\nimport type { CallToolResult } from \"@modelcontextprotocol/server\";\n","/** Only code-owned tool names/codes and numeric counters reach this sink. */\nexport function logToolCall(\n  tool: string,\n  code: string,\n  startedAt: number,\n  replayedGrants: number,\n): void {\n  process.stderr.write(`${JSON.stringify({\n    tool,\n    code,\n    durationMs: Math.max(0, Math.round(performance.now() - startedAt)),\n    replayedGrants,\n  })}\\n`);\n}\n","type JsonSchema = boolean | Record<string, unknown>;\n\nconst DRAFT_7 = \"http://json-schema.org/draft-07/schema#\";\nconst DRAFT_2020_12 = \"https://json-schema.org/draft/2020-12/schema\";\nconst schemaMaps = new Set([\"properties\", \"patternProperties\", \"definitions\", \"$defs\"]);\nconst schemaArrays = new Set([\"allOf\", \"anyOf\", \"oneOf\"]);\nconst schemaValues = new Set([\n  \"additionalProperties\", \"items\", \"contains\", \"propertyNames\", \"not\", \"if\", \"then\", \"else\",\n]);\n\n/** Project the catalog's shared Draft-07/2020-12 vocabulary without changing its validation rules. */\nexport function toMcpJsonSchema(schema: Record<string, unknown>): Record<string, unknown>;\nexport function toMcpJsonSchema(schema: JsonSchema): JsonSchema;\nexport function toMcpJsonSchema(schema: JsonSchema): JsonSchema {\n  if (typeof schema === \"boolean\") return schema;\n  // These forms need a semantic migration, not just a dialect declaration. The\n  // generated catalog does not use them; fail closed if that contract changes.\n  if (Array.isArray(schema.items) || \"additionalItems\" in schema || \"dependencies\" in schema ||\n    (\"$ref\" in schema && Object.keys(schema).some((key) => key !== \"$ref\"))) {\n    throw new Error(\"The operations schema needs a semantic migration to JSON Schema 2020-12.\");\n  }\n\n  const projected: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(schema)) {\n    if (key === \"$schema\") {\n      if (value !== DRAFT_7) throw new Error(`Unsupported operations schema dialect: ${String(value)}.`);\n      projected[key] = DRAFT_2020_12;\n    } else if (schemaMaps.has(key)) {\n      projected[key] = Object.fromEntries(Object.entries(value as Record<string, JsonSchema>)\n        .map(([name, child]) => [name, toMcpJsonSchema(child)]));\n    } else if (schemaArrays.has(key)) {\n      projected[key] = (value as JsonSchema[]).map(toMcpJsonSchema);\n    } else if (schemaValues.has(key)) {\n      projected[key] = toMcpJsonSchema(value as JsonSchema);\n    } else {\n      // Descriptions, defaults, examples and const/enum values are data, not schemas.\n      projected[key] = value;\n    }\n  }\n  return projected;\n}\n","{\n  \"name\": \"@tinycloud/mcp\",\n  \"version\": \"0.8.3-beta.24\",\n  \"description\": \"TinyCloud delegated operations MCP server\",\n  \"keywords\": [\n    \"tinycloud\",\n    \"mcp\",\n    \"model-context-protocol\",\n    \"agents\",\n    \"delegation\",\n    \"ucan\",\n    \"kv\",\n    \"sqlite\"\n  ],\n  \"author\": \"TinyCloud, Inc.\",\n  \"license\": \"EGPL\",\n  \"type\": \"module\",\n  \"main\": \"dist/index.cjs\",\n  \"module\": \"dist/index.js\",\n  \"types\": \"dist/index.d.ts\",\n  \"bin\": {\n    \"tinycloud-mcp\": \"./bin/tinycloud-mcp\",\n    \"tinycloud-mcp-http\": \"./bin/tinycloud-mcp-http\"\n  },\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    },\n    \"./server\": {\n      \"types\": \"./dist/server.d.ts\",\n      \"import\": \"./dist/server.js\",\n      \"require\": \"./dist/server.cjs\"\n    },\n    \"./tools\": {\n      \"types\": \"./dist/tools.d.ts\",\n      \"import\": \"./dist/tools.js\",\n      \"require\": \"./dist/tools.cjs\"\n    },\n    \"./results\": {\n      \"types\": \"./dist/results.d.ts\",\n      \"import\": \"./dist/results.js\",\n      \"require\": \"./dist/results.cjs\"\n    },\n    \"./http\": {\n      \"types\": \"./dist/http.d.ts\",\n      \"import\": \"./dist/http.js\",\n      \"require\": \"./dist/http.cjs\"\n    }\n  },\n  \"files\": [\n    \"dist\",\n    \"bin\",\n    \"generated\",\n    \"skills\"\n  ],\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"clean\": \"rm -rf dist\",\n    \"test\": \"bun run build && bun scripts/test.ts && bun run check:generated\",\n    \"test:stdio\": \"bun run build && bun test src/stdio.test.ts\",\n    \"typecheck\": \"tsc -p tsconfig.json\",\n    \"start:http\": \"node dist/http-cli.js\",\n    \"generate\": \"bun scripts/generate.ts\",\n    \"check:generated\": \"bun scripts/generate.ts --check\"\n  },\n  \"dependencies\": {\n    \"@modelcontextprotocol/node\": \"2.0.0-beta.5\",\n    \"@modelcontextprotocol/server\": \"2.0.0-beta.5\",\n    \"@tinycloud/node-sdk\": \"3.8.0-beta.21\",\n    \"@tinycloud/node-sdk-wasm\": \"1.7.8\",\n    \"@tinycloud/operations\": \"0.7.7-beta.20\",\n    \"jose\": \"6.2.4\"\n  },\n  \"devDependencies\": {\n    \"@modelcontextprotocol/client\": \"2.0.0-beta.5\",\n    \"@types/node\": \"^20\",\n    \"tsup\": \"^8.0.0\",\n    \"typescript\": \"^5.9.3\"\n  },\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/TinyCloudLabs/js-sdk\"\n  },\n  \"homepage\": \"https://docs.tinycloud.xyz/cli/mcp\"\n}\n","import packageMetadata from \"../package.json\";\n\nexport const MCP_VERSION = packageMetadata.version;\n"],"mappings":";AAAA,SAAS,gBAAgB;AAEzB,SAAS,oCAAoC;;;ACF7C,SAAS,iBAAiB;AAC1B,SAAS,kBAA0C;;;ACDnD,SAAS,qBAAqB;AAC9B,SAAS,YAAY;AAErB,SAAS,sBAA4D;AACrE,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;;;ACmBzB,SAAS,gBACd,QACA,WAA2C,CAAC,GAC5C,UAAgC,CAAC,GAClB;AACf,MAAI,YAAsC,2BAA2B,MAAM,IACvE,iBAAiB,QAAQ,QAAQ,IACjC;AAAA,IACA,QAAQ;AAAA,IACR,WAAW,CAAC;AAAA,IACZ,SAAS,CAAC;AAAA,IACV,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAClC;AACF,MAAI;AACJ,MAAI,QAAQ,YAAY,UAAU;AAChC,iBAAa,KAAK,UAAU,SAAS;AACrC,SACG,QAAQ,aAAa,QACpB,QAAQ,gBAAgB,4BACxB,QAAQ,gBAAgB,2BAC1B,WAAW,SAAS,KACpB;AACA,YAAM,MAAM,QAAQ,aAAa,WAAW,gBAAgB,KAC1D,QAAQ,gBAAgB;AAC1B,kBAAY;AAAA,QACV,QAAQ;AAAA,QACR,WAAW,UAAU;AAAA,QACrB,SAAS,UAAU;AAAA,QACnB,OAAO;AAAA,UACL,MAAM,MAAM,8BAA8B;AAAA,UAC1C,SAAS,MACL,uIACA;AAAA,UACJ,WAAW;AAAA,QACb;AAAA,MACF;AACA,mBAAa,KAAK,UAAU,SAAS;AAAA,IACvC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,CAAC;AAAA,MACR,MAAM;AAAA,MACN,MAAM,cAAc,UAAU,MAAM,KACjC,eAAe,UAAa,EAAE,QAAQ,gBAAgB,2BAA2B,UAAU,WAAW,QACnG;AAAA,EAAK,UAAU,KAAK;AAAA,IAC5B,CAAC;AAAA,IACD,mBAAmB;AAAA,EACrB;AACF;AAQA,SAAS,iBACP,QACA,UAC0B;AAC1B,MAAI,OAAO,WAAW,QAAS,QAAO;AAGtC,QAAM,QAAQ,OAAO;AAGrB,QAAM,WAAW,OAAO,SAAS;AACjC,MAAI,UAAU,WAAW,qBAAsB,QAAO;AACtD,QAAM,UAAU,SAAS,KAAK,CAAC,cAAc,UAAU,gBAAgB,SAAS,WAAW;AAC3F,MAAI,YAAY,OAAW,QAAO;AAClC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,EAAE,GAAG,OAAO,SAAS,EAAE,GAAG,OAAO,SAAS,UAAU,EAAE,GAAG,UAAU,MAAM,QAAQ,KAAK,EAAE,EAAE;AAAA,EACnG;AACF;AAOA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAU,MAA+B;AAC/C,SAAO,WAAW,QAChB,WAAW,wBACX,WAAW,oBACX,WAAW;AACf;AAEA,SAAS,cAAc,QAAoD;AACzE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;;;AC7HO,SAAS,YACd,MACA,MACA,WACA,gBACM;AACN,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU;AAAA,IACrC;AAAA,IACA;AAAA,IACA,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS,CAAC;AAAA,IACjE;AAAA,EACF,CAAC,CAAC;AAAA,CAAI;AACR;;;ACXA,IAAM,UAAU;AAChB,IAAM,gBAAgB;AACtB,IAAM,aAAa,oBAAI,IAAI,CAAC,cAAc,qBAAqB,eAAe,OAAO,CAAC;AACtF,IAAM,eAAe,oBAAI,IAAI,CAAC,SAAS,SAAS,OAAO,CAAC;AACxD,IAAM,eAAe,oBAAI,IAAI;AAAA,EAC3B;AAAA,EAAwB;AAAA,EAAS;AAAA,EAAY;AAAA,EAAiB;AAAA,EAAO;AAAA,EAAM;AAAA,EAAQ;AACrF,CAAC;AAKM,SAAS,gBAAgB,QAAgC;AAC9D,MAAI,OAAO,WAAW,UAAW,QAAO;AAGxC,MAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,qBAAqB,UAAU,kBAAkB,UACjF,UAAU,UAAU,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,QAAQ,QAAQ,MAAM,GAAI;AACzE,UAAM,IAAI,MAAM,0EAA0E;AAAA,EAC5F;AAEA,QAAM,YAAqC,CAAC;AAC5C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,QAAQ,WAAW;AACrB,UAAI,UAAU,QAAS,OAAM,IAAI,MAAM,0CAA0C,OAAO,KAAK,CAAC,GAAG;AACjG,gBAAU,GAAG,IAAI;AAAA,IACnB,WAAW,WAAW,IAAI,GAAG,GAAG;AAC9B,gBAAU,GAAG,IAAI,OAAO,YAAY,OAAO,QAAQ,KAAmC,EACnF,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,gBAAgB,KAAK,CAAC,CAAC,CAAC;AAAA,IAC3D,WAAW,aAAa,IAAI,GAAG,GAAG;AAChC,gBAAU,GAAG,IAAK,MAAuB,IAAI,eAAe;AAAA,IAC9D,WAAW,aAAa,IAAI,GAAG,GAAG;AAChC,gBAAU,GAAG,IAAI,gBAAgB,KAAmB;AAAA,IACtD,OAAO;AAEL,gBAAU,GAAG,IAAI;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;;;AH+BO,SAAS,uBACd,WACqB;AACrB,SAAO;AAAA,IACL,SAAS,UAAU;AAAA,IACnB,GAAI,UAAU,mBAAmB,UAAU,oBACvC,EAAE,mBAAmB,KAAK,IAC1B,CAAC;AAAA,IACL,GAAI,UAAU,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,UAAU,UAAU;AAAA,EAChF;AACF;AAoBA,IAAM,iBAAiB;AAAA,EACrB,OAAO,cAAc,WAAW,KAAK,WAAW,WAAW,IAAI,YAAY;AAC7E;AACA,IAAM,mBAAmB;AAAA,EACvB;AACF;AACA,IAAM,mBAAmD,OAAO;AAAA,EAC9D,iBAAiB,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,IAAa,CAAC;AACnE;AAcA,IAAM,mBAA0C,CAAC,SAAS,QAAQ;AAG3D,SAAS,gBAAgB,SAA6C;AAC3E,SAAO,QAAQ,YAAY;AAC7B;AAEO,IAAM,gBAAwC;AAAA,EACnD;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA;AAAA;AAAA,IAGf,UAAU,CAAC,OAAO;AAAA,EACpB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA;AAAA;AAAA,IAGf,UAAU,CAAC,OAAO;AAAA,EACpB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,UAAU,CAAC,UAAU,QAAQ;AAAA,EAC/B;AACF;AAGA,IAAM,cAAc,IAAI,IAAI,iBAAiB,WAAW,IAAI,CAAC,cAAc;AAAA,EACzE,GAAG,UAAU,EAAE,IAAI,UAAU,OAAO;AAAA,EACpC;AAAA,IACE,GAAG;AAAA,IACH,OAAO,gBAAgB,UAAU,KAAK;AAAA,IACtC,QAAQ,gBAAgB,UAAU,MAAM;AAAA,EAC1C;AACF,CAAC,CAAC;AAEK,SAAS,4BAAoD;AAClE,SAAO,IAAI,uBAAuB;AACpC;AAEO,SAAS,uBACd,QACA,WACA,WACM;AACN,QAAM,WAAW,cAAc,OAAO,CAAC,YACrC,gBAAgB,OAAO,EAAE,SAAS,UAAU,OAAO,MAClD,UAAU,iBAAiB,UAAa,UAAU,aAAa,SAAS,QAAQ,IAAI,EAAE;AACzF,aAAW,WAAW,UAAU;AAC9B,UAAM,YAAY,YAAY,IAAI,GAAG,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,EAAE;AACtF,QAAI,cAAc,QAAW;AAC3B,YAAM,IAAI,MAAM,2CAA2C,QAAQ,WAAW,IAAI,QAAQ,gBAAgB,GAAG;AAAA,IAC/G;AAEA,UAAM,cAAc;AAAA,MAClB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,eAAe;AAAA,MACnB,UAAU;AAAA,MACV;AAAA,IACF;AACA,UAAM,cAA+B;AAAA,MACnC,cAAc,QAAQ;AAAA,MACtB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,QAAQ;AAAA,MACzB,eAAe,QAAQ;AAAA,IACzB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,QACE,OAAO,UAAU;AAAA,QACjB,aAAa,UAAU;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA,OAAO,UAA2C;AAChD,cAAM,YAAY,YAAY,IAAI;AAClC,cAAM,UAAU,EAAE,gBAAgB,EAAE;AACpC,YAAI,OAAO;AACX,YAAI;AACF,gBAAM,UAAU,kBAAkB;AAClC,gBAAM,SAAS,MAAM;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,uBAAuB,SAAS;AAAA,YAChC;AAAA,YACA;AAAA,UACF;AACA,gBAAM,YAAY,UAAU,6BAA6B,SACrD,SACA,MAAM,UAAU,yBAAyB,QAAQ;AAAA,YACjD,aAAa,QAAQ;AAAA,YACrB,kBAAkB,QAAQ;AAAA,YAC1B;AAAA,UACF,CAAC;AACH,gBAAM,WAAW,gBAAgB,WAAW,UAAU;AAAA,YACpD,SAAS,UAAU,YAAY,UAAU,UAAU;AAAA,YACnD,UAAU,QAAQ;AAAA,YAClB,aAAa,QAAQ;AAAA,UACvB,CAAC;AACD,iBAAO,YAAY,SAAS,iBAAiB;AAC7C,iBAAO;AAAA,QACT,UAAE;AACA,cAAI,UAAU,YAAY,SAAS;AACjC,wBAAY,QAAQ,MAAM,MAAM,WAAW,QAAQ,cAAc;AAAA,UACnE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,YAAY,QAAoD;AACvE,MAAI,OAAO,WAAW,SAAS;AAC7B,UAAM,QAAQ,OAAO;AACrB,WAAO,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,kBAAkB,MAAM,IAAI,IAAI,MAAM,OAAO;AAAA,EACvG;AACA,MAAI,OAAO,WAAW,KAAM,QAAO,OAAO;AAC1C,QAAM,SAAS,OAAO;AACtB,MAAI,QAAQ,YAAY,eAAgB,QAAO;AAC/C,MAAI,MAAM,QAAQ,QAAQ,GAAG,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,GAAG,YAAY,IAAI,EAAG,QAAO;AACvF,SAAO;AACT;;;AIjcA;AAAA,EACE,MAAQ;AAAA,EACR,SAAW;AAAA,EACX,aAAe;AAAA,EACf,UAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAU;AAAA,EACV,SAAW;AAAA,EACX,MAAQ;AAAA,EACR,MAAQ;AAAA,EACR,QAAU;AAAA,EACV,OAAS;AAAA,EACT,KAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,sBAAsB;AAAA,EACxB;AAAA,EACA,SAAW;AAAA,IACT,KAAK;AAAA,MACH,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,YAAY;AAAA,MACV,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACT,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,aAAa;AAAA,MACX,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,MACR,OAAS;AAAA,MACT,QAAU;AAAA,MACV,SAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,OAAS;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,SAAW;AAAA,IACT,MAAQ;AAAA,EACV;AAAA,EACA,SAAW;AAAA,IACT,OAAS;AAAA,IACT,OAAS;AAAA,IACT,MAAQ;AAAA,IACR,cAAc;AAAA,IACd,WAAa;AAAA,IACb,cAAc;AAAA,IACd,UAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAAA,EACA,cAAgB;AAAA,IACd,8BAA8B;AAAA,IAC9B,gCAAgC;AAAA,IAChC,uBAAuB;AAAA,IACvB,4BAA4B;AAAA,IAC5B,yBAAyB;AAAA,IACzB,MAAQ;AAAA,EACV;AAAA,EACA,iBAAmB;AAAA,IACjB,gCAAgC;AAAA,IAChC,eAAe;AAAA,IACf,MAAQ;AAAA,IACR,YAAc;AAAA,EAChB;AAAA,EACA,YAAc;AAAA,IACZ,MAAQ;AAAA,IACR,KAAO;AAAA,EACT;AAAA,EACA,UAAY;AACd;;;ACvFO,IAAM,cAAc,gBAAgB;;;ANIpC,IAAM,kBAAkB;AAKxB,SAAS,yBAAyB,WAAyC;AAChF,QAAM,YAAY,0BAA0B;AAC5C,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,iBAAiB,SAAS,YAAY;AAAA,IAC9C,EAAE,qBAAqB,UAAU;AAAA,EACnC;AACA,yBAAuB,QAAQ,EAAE,GAAG,WAAW,SAAS,QAAQ,GAAG,SAAS;AAC5E,SAAO;AACT;AAGO,SAAS,kBAAkB,WAAiD;AACjF,SAAO;AAAA,IACL,MAAM,yBAAyB,SAAS;AAAA,IACxC,EAAE,SAAS,MAAM,uBAAuB,qBAAqB,EAAE;AAAA,EACjE;AACF;AAEA,SAAS,uBAAuB,SAAuB;AACrD,UAAQ,OAAO,MAAM,mBAAmB,OAAO;AAAA,CAAI;AACrD;;;ADjBA,IAAM,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWN,SAAS,gBAAgB,YAAiD;AAC/E,MAAI;AACJ,MAAI,kBAAkB;AACtB,MAAI,oBAAoB;AACxB,MAAI,OAAO;AACX,MAAI,UAAU;AAEd,WAAS,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS,GAAG;AACzD,UAAM,WAAW,WAAW,KAAK;AACjC,QAAI,aAAa,YAAY,aAAa,MAAM;AAC9C,aAAO;AACP;AAAA,IACF;AACA,QAAI,aAAa,eAAe,aAAa,MAAM;AACjD,gBAAU;AACV;AAAA,IACF;AACA,QAAI,aAAa,yBAAyB;AACxC,0BAAoB;AACpB;AAAA,IACF;AACA,QAAI,aAAa,aAAa;AAC5B,YAAM,QAAQ,WAAW,QAAQ,CAAC;AAClC,UAAI,UAAU,UAAa,MAAM,WAAW,GAAG,KAAK,MAAM,KAAK,EAAE,WAAW,GAAG;AAC7E,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,gBAAU;AACV,wBAAkB;AAClB,eAAS;AACT;AAAA,IACF;AACA,QAAI,UAAU,WAAW,YAAY,GAAG;AACtC,YAAM,QAAQ,SAAS,MAAM,aAAa,MAAM;AAChD,UAAI,MAAM,KAAK,EAAE,WAAW,EAAG,OAAM,IAAI,MAAM,8CAA8C;AAC7F,gBAAU;AACV,wBAAkB;AAClB;AAAA,IACF;AACA,UAAM,IAAI,MAAM,mBAAmB,QAAQ,EAAE;AAAA,EAC/C;AAEA,SAAO,EAAE,SAAS,iBAAiB,mBAAmB,MAAM,QAAQ;AACtE;AAEA,eAAsB,KAAK,aAAgC,QAAQ,KAAK,MAAM,CAAC,GAAoB;AACjG,MAAI;AACJ,MAAI;AACF,cAAU,gBAAgB,UAAU;AAAA,EACtC,SAAS,OAAO;AACd,YAAQ,OAAO,MAAM,yCAAyC;AAC9D,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,MAAM;AAChB,YAAQ,OAAO,MAAM,IAAI;AACzB,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,SAAS;AACnB,YAAQ,OAAO,MAAM,GAAG,WAAW;AAAA,CAAI;AACvC,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,6BAA6B,QAAQ,OAAO;AAAA,EAC9D,QAAQ;AACN,YAAQ,OAAO,MAAM,+CAA+C;AACpE,WAAO;AAAA,EACT;AAIA,oBAAkB;AAAA,IAChB;AAAA,IACA,iBAAiB,QAAQ;AAAA,IACzB,mBAAmB,QAAQ;AAAA,EAC7B,CAAC;AACD,SAAO;AACT;AAEA,SAAS,qBAA8B;AACrC,QAAM,OAAO,QAAQ,KAAK,CAAC;AAC3B,MAAI,SAAS,OAAW,QAAO;AAC/B,SAAO,SAAS,IAAI,MAAM,YAAY,SAAS,IAAI,MAAM,aAAa,SAAS,IAAI,MAAM;AAC3F;AAEA,IAAI,mBAAmB,GAAG;AACxB,OAAK,KAAK,EAAE,KAAK,CAAC,SAAS;AACzB,QAAI,SAAS,EAAG,SAAQ,WAAW;AAAA,EACrC,CAAC,EAAE,MAAM,MAAM;AACb,YAAQ,OAAO,MAAM,mCAAmC;AACxD,YAAQ,WAAW;AAAA,EACrB,CAAC;AACH;","names":[]}

package/dist/http-cli.cjs

@@ -1959,7 +1959,7 @@ function outcomeCode(result) {
 // package.json
 var package_default = {
   name: "@tinycloud/mcp",
-  version: "0.8.3-beta.22",
+  version: "0.8.3-beta.24",
   description: "TinyCloud delegated operations MCP server",
   keywords: [
     "tinycloud",
@@ -2030,9 +2030,9 @@ var package_default = {
   dependencies: {
     "@modelcontextprotocol/node": "2.0.0-beta.5",
     "@modelcontextprotocol/server": "2.0.0-beta.5",
-    "@tinycloud/node-sdk": "3.8.0-beta.20",
+    "@tinycloud/node-sdk": "3.8.0-beta.21",
     "@tinycloud/node-sdk-wasm": "1.7.8",
-    "@tinycloud/operations": "0.7.7-beta.19",
+    "@tinycloud/operations": "0.7.7-beta.20",
     jose: "6.2.4"
   },
   devDependencies: {