@anchrd/intel-api 0.2.0

package/dist/mcp/mcp.js

@@ -0,0 +1,484 @@
+import { ArchiveKnowledgeNodeInput, CompleteFlowRunStepInput, CreateFlowInput, CreateKnowledgeLinkInput, CreateKnowledgeNodeInput, DeleteKnowledgeLinkInput, ExecuteToolInput, GetFlowInput, GetFlowRunInput, GetKnowledgeNodeInput, KnowledgeGraphInput, ListFlowGrantsInput, ListKnowledgeGrantsInput, ListKnowledgeNodesInput, PublishFlowInput, RevokeFlowGrantInput, RevokeKnowledgeGrantInput, SaveFlowVersionInput, SaveKnowledgeAttachmentInput, SaveKnowledgeVersionInput, SearchKnowledgeInput, ShareFlowInput, ShareKnowledgeInput, StartFlowRunInput, TestToolInput, UpdateKnowledgeNodeInput, } from "@anchrd/intel-contract";
+import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { z } from "zod";
+import { IntelError } from "../shared/intel-error/intel-error.js";
+function text(value) {
+    return { content: [{ type: "text", text: JSON.stringify(value) }], isError: false };
+}
+// MCP returns resource payloads inline as base64, so an attachment cannot be streamed to the client
+// and must fit in Worker memory twice over. Refuse oversized attachments instead of losing the
+// isolate; HTTP still serves them as a stream.
+const AttachmentInlineLimit = 10 * 1024 * 1024;
+async function base64(stream) {
+    const bytes = new Uint8Array(await new Response(stream).arrayBuffer());
+    const chunkSize = 24_576;
+    let encoded = "";
+    for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+        let binary = "";
+        for (const byte of bytes.subarray(offset, offset + chunkSize)) {
+            binary += String.fromCharCode(byte);
+        }
+        encoded += btoa(binary);
+    }
+    return encoded;
+}
+export async function handleMcp(request, deps) {
+    const actor = {
+        id: deps.authorization.identity.id,
+        email: deps.authorization.identity.email,
+        canReindex: deps.authorization.can("intel", "admin"),
+    };
+    const toolActor = {
+        id: deps.authorization.identity.id,
+        email: deps.authorization.identity.email,
+        canExecute: deps.authorization.can("tools", "execute"),
+    };
+    const flowActor = {
+        id: deps.authorization.identity.id,
+        email: deps.authorization.identity.email,
+        canRun: deps.authorization.can("flows", "run"),
+        canApprove: deps.authorization.can("flows", "approve"),
+    };
+    const server = new McpServer({ name: "intel", version: "0.1.0" });
+    const EmptyInput = z.strictObject({});
+    if (deps.authorization.can("knowledge", "read")) {
+        server.registerTool("knowledge_list", {
+            title: "List knowledge",
+            description: "List authorized folders, documents, and attachments under one parent.",
+            inputSchema: ListKnowledgeNodesInput,
+            annotations: {
+                title: "List knowledge",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.list(actor, input)));
+        server.registerTool("knowledge_get", {
+            title: "Get knowledge",
+            description: "Get one authorized Knowledge node and its current immutable content version.",
+            inputSchema: GetKnowledgeNodeInput,
+            annotations: {
+                title: "Get knowledge",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.get(actor, input.nodeId)));
+        server.registerTool("knowledge_versions_list", {
+            title: "List knowledge versions",
+            description: "List immutable versions of one authorized Knowledge node.",
+            inputSchema: GetKnowledgeNodeInput,
+            annotations: {
+                title: "List knowledge versions",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.listVersions(actor, input.nodeId)));
+        server.registerTool("knowledge_attachment_get", {
+            title: "Get knowledge attachment",
+            description: "Get authorized immutable attachment metadata and its explicit MCP resource URI.",
+            inputSchema: GetKnowledgeNodeInput,
+            annotations: {
+                title: "Get knowledge attachment",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.getAttachment(actor, input.nodeId)));
+        server.registerResource("knowledge-attachment", new ResourceTemplate("intel://knowledge/{nodeId}/attachment", { list: undefined }), { title: "Intel knowledge attachment" }, async (uri, variables) => {
+            const { attachment, body } = await deps.knowledge.readAttachment(actor, String(variables.nodeId));
+            if (attachment.version.size > AttachmentInlineLimit) {
+                await body.cancel();
+                throw new IntelError(413, "attachment_too_large", "Attachment is too large to inline; read it over HTTP instead");
+            }
+            return {
+                contents: [
+                    {
+                        uri: uri.href,
+                        mimeType: attachment.version.mediaType,
+                        blob: await base64(body),
+                    },
+                ],
+            };
+        });
+        server.registerResource("knowledge-document", new ResourceTemplate("intel://knowledge/{nodeId}", { list: undefined }), { title: "Intel knowledge document", mimeType: "application/json" }, async (uri, variables) => {
+            const document = await deps.knowledge.get(actor, String(variables.nodeId));
+            return {
+                contents: [
+                    { uri: uri.href, mimeType: "application/json", text: JSON.stringify(document) },
+                ],
+            };
+        });
+        server.registerTool("knowledge_search", {
+            title: "Search knowledge",
+            description: "Search only authorized indexed Knowledge and return version-pinned citations.",
+            inputSchema: SearchKnowledgeInput,
+            annotations: {
+                title: "Search knowledge",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.search(actor, input)));
+        server.registerTool("knowledge_links_list", {
+            title: "List knowledge links",
+            description: "List authorized outgoing links and backlinks for one Knowledge node.",
+            inputSchema: GetKnowledgeNodeInput,
+            annotations: {
+                title: "List knowledge links",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.listLinks(actor, input.nodeId)));
+        server.registerTool("knowledge_graph", {
+            title: "Get knowledge graph",
+            description: "Get the authorized Knowledge nodes and explicit relationships for discovery.",
+            inputSchema: KnowledgeGraphInput,
+            annotations: {
+                title: "Get knowledge graph",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.graph(actor, input)));
+    }
+    if (deps.authorization.can("intel", "admin")) {
+        server.registerTool("knowledge_reindex", {
+            title: "Reindex knowledge",
+            description: "Queue every current canonical Knowledge version for derived index rebuild.",
+            inputSchema: EmptyInput,
+            annotations: {
+                title: "Reindex knowledge",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async () => text(await deps.knowledge.reindex(actor)));
+    }
+    if (deps.authorization.can("knowledge", "create")) {
+        server.registerTool("knowledge_create", {
+            title: "Create knowledge",
+            description: "Create a governed folder, document, or attachment metadata node.",
+            inputSchema: CreateKnowledgeNodeInput,
+            annotations: {
+                title: "Create knowledge",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.create(actor, input)));
+    }
+    if (deps.authorization.can("knowledge", "write")) {
+        server.registerTool("knowledge_save", {
+            title: "Save knowledge version",
+            description: "Append an immutable content version using an optimistic base version.",
+            inputSchema: SaveKnowledgeVersionInput,
+            annotations: {
+                title: "Save knowledge version",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.save(actor, input)));
+        server.registerTool("knowledge_attachment_save", {
+            title: "Save knowledge attachment",
+            description: "Append immutable base64 file bytes to an attachment node.",
+            inputSchema: SaveKnowledgeAttachmentInput,
+            annotations: {
+                title: "Save knowledge attachment",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.saveAttachment(actor, input)));
+        server.registerTool("knowledge_update", {
+            title: "Update knowledge",
+            description: "Rename, move, describe, or change the context policy of Knowledge.",
+            inputSchema: UpdateKnowledgeNodeInput,
+            annotations: {
+                title: "Update knowledge",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.update(actor, input)));
+        server.registerTool("knowledge_archive", {
+            title: "Archive knowledge",
+            description: "Archive or restore one Knowledge node using optimistic concurrency.",
+            inputSchema: ArchiveKnowledgeNodeInput,
+            annotations: {
+                title: "Archive knowledge",
+                readOnlyHint: false,
+                destructiveHint: true,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.archive(actor, input)));
+        server.registerTool("knowledge_link_create", {
+            title: "Link knowledge",
+            description: "Create a governed relationship between two authorized Knowledge nodes.",
+            inputSchema: CreateKnowledgeLinkInput,
+            annotations: {
+                title: "Link knowledge",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.createLink(actor, input)));
+        server.registerTool("knowledge_link_delete", {
+            title: "Delete knowledge link",
+            description: "Delete one governed Knowledge relationship by ID.",
+            inputSchema: DeleteKnowledgeLinkInput,
+            annotations: {
+                title: "Delete knowledge link",
+                readOnlyHint: false,
+                destructiveHint: true,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.deleteLink(actor, input)));
+    }
+    if (deps.authorization.can("knowledge", "share")) {
+        server.registerTool("knowledge_shares_list", {
+            title: "List knowledge shares",
+            description: "List direct grants for Knowledge the caller is allowed to manage.",
+            inputSchema: ListKnowledgeGrantsInput,
+            annotations: {
+                title: "List knowledge shares",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.listGrants(actor, input.resourceId)));
+        server.registerTool("knowledge_share", {
+            title: "Share knowledge",
+            description: "Grant inherited Knowledge access to a Gate user, verified email, or the organization.",
+            inputSchema: ShareKnowledgeInput,
+            annotations: {
+                title: "Share knowledge",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.share(actor, input)));
+        server.registerTool("knowledge_revoke_share", {
+            title: "Revoke knowledge share",
+            description: "Revoke one direct Knowledge grant by ID.",
+            inputSchema: RevokeKnowledgeGrantInput,
+            annotations: {
+                title: "Revoke knowledge share",
+                readOnlyHint: false,
+                destructiveHint: true,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.knowledge.revokeGrant(actor, input)));
+    }
+    if (deps.authorization.can("flows", "read")) {
+        server.registerTool("flows_list", {
+            title: "List flows",
+            description: "List authorized company flows by title and description.",
+            inputSchema: EmptyInput,
+            annotations: {
+                title: "List flows",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async () => text(await deps.flows.list(flowActor)));
+        server.registerTool("flow_get", {
+            title: "Get flow",
+            description: "Load one authorized flow and its current immutable graph on demand.",
+            inputSchema: GetFlowInput,
+            annotations: {
+                title: "Get flow",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.flows.get(flowActor, input.flowId)));
+        server.registerTool("flow_run_get", {
+            title: "Get flow run",
+            description: "Get durable run state and the next node an AI or person must handle.",
+            inputSchema: GetFlowRunInput,
+            annotations: {
+                title: "Get flow run",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.flows.getRun(flowActor, input.runId)));
+    }
+    if (deps.authorization.can("flows", "share")) {
+        server.registerTool("flow_shares_list", {
+            title: "List flow shares",
+            description: "List direct grants for a Flow the caller is allowed to manage.",
+            inputSchema: ListFlowGrantsInput,
+            annotations: {
+                title: "List flow shares",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.flows.listGrants(flowActor, input.resourceId)));
+        server.registerTool("flow_share", {
+            title: "Share flow",
+            description: "Grant Flow access to a Gate user, verified email, or the organization.",
+            inputSchema: ShareFlowInput,
+            annotations: {
+                title: "Share flow",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.flows.share(flowActor, input)));
+        server.registerTool("flow_revoke_share", {
+            title: "Revoke flow share",
+            description: "Revoke one direct Flow grant by ID.",
+            inputSchema: RevokeFlowGrantInput,
+            annotations: {
+                title: "Revoke flow share",
+                readOnlyHint: false,
+                destructiveHint: true,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.flows.revokeGrant(flowActor, input)));
+    }
+    if (deps.authorization.can("flows", "create")) {
+        server.registerTool("flow_create", {
+            title: "Create flow",
+            description: "Create governed flow metadata before adding an immutable graph version.",
+            inputSchema: CreateFlowInput,
+            annotations: {
+                title: "Create flow",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.flows.create(flowActor, input)));
+    }
+    if (deps.authorization.can("flows", "write")) {
+        server.registerTool("flow_save", {
+            title: "Save flow",
+            description: "Append a validated immutable flow graph version with optimistic concurrency.",
+            inputSchema: SaveFlowVersionInput,
+            annotations: {
+                title: "Save flow",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.flows.save(flowActor, input)));
+    }
+    if (deps.authorization.can("flows", "publish")) {
+        server.registerTool("flow_publish", {
+            title: "Publish flow",
+            description: "Publish a version after resolving its authorized Knowledge and tool references.",
+            inputSchema: PublishFlowInput,
+            annotations: {
+                title: "Publish flow",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.flows.publish(flowActor, input)));
+    }
+    if (deps.authorization.can("flows", "run")) {
+        server.registerTool("flow_run_start", {
+            title: "Start flow run",
+            description: "Start a durable run of the published graph and return its first actionable node.",
+            inputSchema: StartFlowRunInput,
+            annotations: {
+                title: "Start flow run",
+                readOnlyHint: false,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async (input) => text(await deps.flows.start(flowActor, input)));
+        server.registerTool("flow_run_complete_step", {
+            title: "Complete flow step",
+            description: "Submit a node result or semantic branch to advance a durable run without persisting credentials.",
+            inputSchema: CompleteFlowRunStepInput,
+            annotations: {
+                title: "Complete flow step",
+                readOnlyHint: false,
+                destructiveHint: true,
+                idempotentHint: true,
+                openWorldHint: true,
+            },
+        }, async (input) => text(await deps.flows.completeStep(flowActor, input)));
+    }
+    if (deps.authorization.can("tools", "read")) {
+        server.registerTool("tools_catalog_list", {
+            title: "List tools",
+            description: "List the MCP tools the calling user can reach through the portal, live rather than cached.",
+            inputSchema: EmptyInput,
+            annotations: {
+                title: "List tools",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: true,
+                openWorldHint: false,
+            },
+        }, async () => text(await deps.tools.catalog(toolActor)));
+    }
+    if (deps.authorization.can("tools", "test")) {
+        server.registerTool("tools_test", {
+            title: "Test tool",
+            description: "Validate input and execute one explicitly read-only cached MCP tool with the caller's Gate connection.",
+            inputSchema: TestToolInput,
+            annotations: {
+                title: "Test tool",
+                readOnlyHint: true,
+                destructiveHint: false,
+                idempotentHint: false,
+                openWorldHint: true,
+            },
+        }, async (input) => text(await deps.tools.test(toolActor, input)));
+    }
+    if (deps.authorization.can("tools", "execute")) {
+        server.registerTool("tools_execute", {
+            title: "Execute tool",
+            description: "Validate and execute a discovered MCP tool with the caller's just-in-time Gate connection.",
+            inputSchema: ExecuteToolInput,
+            annotations: {
+                title: "Execute tool",
+                readOnlyHint: false,
+                destructiveHint: true,
+                idempotentHint: false,
+                openWorldHint: true,
+            },
+        }, async (input) => text(await deps.tools.execute(toolActor, input)));
+    }
+    const transport = new WebStandardStreamableHTTPServerTransport({ enableJsonResponse: true });
+    await server.connect(transport);
+    return await transport.handleRequest(request);
+}

package/dist/mcp/mcp.types.d.ts

@@ -0,0 +1,10 @@
+import type { Authorized } from "@anchrd/gate-sdk";
+import type { FlowService } from "../flows/flows.types.js";
+import type { KnowledgeService } from "../knowledge/knowledge.types.js";
+import type { ToolService } from "../tools/tools.types.js";
+export interface McpDeps {
+    authorization: Authorized;
+    knowledge: KnowledgeService;
+    flows: FlowService;
+    tools: ToolService;
+}

package/dist/mcp/mcp.types.js

@@ -0,0 +1 @@
+export {};

package/dist/prepare/prepare.d.ts

@@ -0,0 +1,4 @@
+import type { PrepareDeps } from "./prepare.types.js";
+export declare function createPrepare(deps: PrepareDeps): {
+    prepare(): Promise<number>;
+};

package/dist/prepare/prepare.js

@@ -0,0 +1,16 @@
+export function createPrepare(deps) {
+    return {
+        async prepare() {
+            const location = await deps.resolveMigrations();
+            if (!location) {
+                deps.log("Error: @anchrd/intel-api migrations were not found.");
+                return 1;
+            }
+            const temporaryOutDir = `${location.outDir}.tmp`;
+            await deps.copyDir(location.dir, temporaryOutDir);
+            await deps.replaceDir(temporaryOutDir, location.outDir);
+            deps.log(`Intel migrations copied to ${location.outDir}.`);
+            return 0;
+        },
+    };
+}

package/dist/prepare/prepare.types.d.ts

@@ -0,0 +1,9 @@
+export interface PrepareDeps {
+    resolveMigrations(): Promise<{
+        dir: string;
+        outDir: string;
+    } | null>;
+    copyDir(from: string, to: string): Promise<void>;
+    replaceDir(from: string, to: string): Promise<void>;
+    log(message: string): void;
+}

package/dist/prepare/prepare.types.js

@@ -0,0 +1 @@
+export {};

package/dist/shared/gate-authorization/gate-authorization.d.ts

@@ -0,0 +1,4 @@
+import type { Authorized, GateClient } from "@anchrd/gate-sdk";
+export declare function bearer(headers: Headers): string | null;
+export declare function authorize(gate: Pick<GateClient, "authorize">, headers: Headers, resource: string): Promise<Authorized | null>;
+export declare function authorizeBearer(gate: Pick<GateClient, "authorize">, token: string, resource: string): Promise<Authorized | null>;

package/dist/shared/gate-authorization/gate-authorization.js

@@ -0,0 +1,19 @@
+export function bearer(headers) {
+    const value = headers.get("authorization");
+    // RFC 9110 defines the auth scheme as case-insensitive, so a client sending "bearer" must not be
+    // turned away as unauthenticated.
+    if (!value || !/^bearer /i.test(value))
+        return null;
+    const token = value.slice(7);
+    return token.length > 0 ? token : null;
+}
+export async function authorize(gate, headers, resource) {
+    const token = bearer(headers);
+    if (!token)
+        return null;
+    return await authorizeBearer(gate, token, resource);
+}
+export async function authorizeBearer(gate, token, resource) {
+    const result = await gate.authorize(token);
+    return result.ok && result.resource === resource ? result : null;
+}

package/dist/shared/intel-error/intel-error.d.ts

@@ -0,0 +1,5 @@
+export declare class IntelError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}

package/dist/shared/intel-error/intel-error.js

@@ -0,0 +1,10 @@
+export class IntelError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "IntelError";
+    }
+}

package/dist/shared/problem-details/problem-details.d.ts

@@ -0,0 +1,8 @@
+export declare function problemDetails(status: number, code: string, title: string, detail?: string): {
+    type: string;
+    status: number;
+    title: string;
+    detail?: string | undefined;
+    instance?: string | undefined;
+    code?: string | undefined;
+};

package/dist/shared/problem-details/problem-details.js

@@ -0,0 +1,4 @@
+import { ProblemDetails } from "@anchrd/intel-contract";
+export function problemDetails(status, code, title, detail) {
+    return ProblemDetails.parse({ type: "about:blank", status, code, title, detail });
+}

package/dist/shared/safe-return-path/safe-return-path.d.ts

@@ -0,0 +1,2 @@
+import { z } from "zod";
+export declare const SafeReturnPath: z.ZodString;

package/dist/shared/safe-return-path/safe-return-path.js

@@ -0,0 +1,11 @@
+import { z } from "zod";
+export const SafeReturnPath = z
+    .string()
+    .startsWith("/")
+    .refine((value) => !value.startsWith("//") &&
+    !value.startsWith("/\\") &&
+    !value.includes("\\") &&
+    ![...value].some((character) => {
+        const code = character.charCodeAt(0);
+        return code < 32 || code === 127;
+    }), "Return path must be a local absolute path");

package/dist/shared/sha256/sha256.d.ts

@@ -0,0 +1 @@
+export declare function sha256Hex(crypto: Crypto, content: string | ArrayBuffer | Uint8Array): Promise<string>;

package/dist/shared/sha256/sha256.js

@@ -0,0 +1,9 @@
+export async function sha256Hex(crypto, content) {
+    const source = typeof content === "string"
+        ? new TextEncoder().encode(content).buffer
+        : content instanceof Uint8Array
+            ? Uint8Array.from(content).buffer
+            : content;
+    const digest = await crypto.subtle.digest("SHA-256", source);
+    return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/dist/tools/tools.d.ts

@@ -0,0 +1,2 @@
+import type { ToolDeps, ToolService } from "./tools.types.js";
+export declare function createTools(deps: ToolDeps): ToolService;