@tenuo/core 0.3.1-beta.0 → 0.3.3-beta.0

package/dist/generated/tenuo_wasm.js

@@ -295,6 +295,29 @@ class SdkContext {
         SdkContextFinalization.register(this, this.__wbg_ptr, this);
         return this;
     }
+    /**
+     * `_meta.tenuo` for argument JSON text at `timestamp` (unix seconds).
+     *
+     * The proof covers the core's parse of `args_json`, including JSON null.
+     * @param {SdkSession} session
+     * @param {string} tool
+     * @param {string} args_json
+     * @param {number} timestamp
+     * @param {any} approvals
+     * @returns {any}
+     */
+    signMeta(session, tool, args_json, timestamp, approvals) {
+        _assertClass(session, SdkSession);
+        const ptr0 = passStringToWasm0(tool, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(args_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.sdkcontext_signMeta(this.__wbg_ptr, session.__wbg_ptr, ptr0, len0, ptr1, len1, timestamp, approvals);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return takeFromExternrefTable0(ret[0]);
+    }
     /**
      * Holder PoP only. Does not authorize. Used to fill `_meta.tenuo.signature`.
      * @param {SdkSession} session
@@ -371,6 +394,54 @@ class SdkContext {
             wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
         }
     }
+    /**
+     * Compatibility alias for verifyMetaPop. NOT an authorization check.
+     * @param {string} warrant
+     * @param {string} signature
+     * @param {string} tool
+     * @param {string} args_json
+     * @param {number} timestamp
+     * @returns {boolean}
+     */
+    verifyMeta(warrant, signature, tool, args_json, timestamp) {
+        const ptr0 = passStringToWasm0(warrant, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(signature, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(tool, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passStringToWasm0(args_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len3 = WASM_VECTOR_LEN;
+        const ret = wasm.sdkcontext_verifyMeta(this.__wbg_ptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, timestamp);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return ret[0] !== 0;
+    }
+    /**
+     * Check ONLY the holder proof, not trust, expiry, constraints, approvals or replay.
+     * @param {string} warrant
+     * @param {string} signature
+     * @param {string} tool
+     * @param {string} args_json
+     * @param {number} timestamp
+     * @returns {boolean}
+     */
+    verifyMetaPop(warrant, signature, tool, args_json, timestamp) {
+        const ptr0 = passStringToWasm0(warrant, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(signature, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(tool, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passStringToWasm0(args_json, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len3 = WASM_VECTOR_LEN;
+        const ret = wasm.sdkcontext_verifyMetaPop(this.__wbg_ptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, timestamp);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return ret[0] !== 0;
+    }
     /**
      * Sign verifier receipts with this 32-byte holder secret instead of an
      * ephemeral key. Used by the TypeScript `Runtime`.
@@ -519,7 +590,7 @@ class SdkSession {
         return SdkSession.__wrap(ret[0]);
     }
     /**
-     * CBOR warrant stack as standard base64. Matches Python `encode_warrant_stack`.
+     * CBOR warrant stack as unpadded URL-safe base64. Same bytes as `_meta.tenuo.warrant`.
      * @returns {string}
      */
     toStackWire() {
@@ -877,15 +948,34 @@ function parse_connect_token(token) {
 }
 exports.parse_connect_token = parse_connect_token;
 
+/**
+ * Reject a repeated key in any object.
+ *
+ * A tools/call the host has already turned into an object cannot be checked:
+ * the duplicate key is gone. Call this while the text is still available.
+ * Nested objects are checked too. On success the caller parses `json_text`
+ * with the host parser. This function does not build a JavaScript object:
+ * that conversion turns `__proto__` into a prototype change and `null` into
+ * `undefined`.
+ * @param {string} json_text
+ */
+function parse_strict_json(json_text) {
+    const ptr0 = passStringToWasm0(json_text, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len0 = WASM_VECTOR_LEN;
+    const ret = wasm.parse_strict_json(ptr0, len0);
+    if (ret[1]) {
+        throw takeFromExternrefTable0(ret[0]);
+    }
+}
+exports.parse_strict_json = parse_strict_json;
+
 /**
  * Decode and check an approval envelope. Not authorization.
- * @param {string} envelope
+ * @param {any} envelope
  * @returns {any}
  */
 function sdkInspectApproval(envelope) {
-    const ptr0 = passStringToWasm0(envelope, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.sdkInspectApproval(ptr0, len0);
+    const ret = wasm.sdkInspectApproval(envelope);
     if (ret[2]) {
         throw takeFromExternrefTable0(ret[1]);
     }

package/dist/generated/tenuo_wasm_bg.wasm.d.ts

@@ -3,6 +3,7 @@
 export const memory: WebAssembly.Memory;
 export const __wbg_sdkcontext_free: (a: number, b: number) => void;
 export const __wbg_sdksession_free: (a: number, b: number) => void;
+export const parse_strict_json: (a: number, b: number) => [number, number];
 export const sdkInspectParts: (a: number, b: number, c: number, d: number) => [number, number, number];
 export const sdkInspectWarrant: (a: number, b: number) => [number, number, number];
 export const sdkProtocolLimits: () => [number, number, number];
@@ -21,8 +22,11 @@ export const sdkcontext_loadRevocationList: (a: number, b: number, c: number) =>
 export const sdkcontext_mint: (a: number, b: any, c: number, d: any, e: number, f: number, g: number) => [number, number, number];
 export const sdkcontext_narrow: (a: number, b: number, c: any, d: any) => [number, number, number];
 export const sdkcontext_new: () => number;
+export const sdkcontext_signMeta: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: any) => [number, number, number];
 export const sdkcontext_signPop: (a: number, b: number, c: number, d: number, e: any) => [number, number, number, number];
 export const sdkcontext_signRevocationList: (a: number, b: any) => [number, number, number, number];
+export const sdkcontext_verifyMeta: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, j: number) => [number, number, number];
+export const sdkcontext_verifyMetaPop: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, j: number) => [number, number, number];
 export const sdkcontext_withReceiptSigner: (a: number, b: number, c: number) => [number, number, number];
 export const sdksession_dedupKey: (a: number, b: number, c: number, d: any) => [number, number, number, number];
 export const sdksession_describe: (a: number) => [number, number, number];
@@ -55,7 +59,7 @@ export const verify_approval_set: (a: number, b: number, c: number, d: number, e
 export const verify_signed_approval: (a: number, b: number) => any;
 export const verify_srl: (a: number, b: number, c: number, d: number) => any;
 export const init_panic_hook: () => void;
-export const sdkInspectApproval: (a: number, b: number) => [number, number, number];
+export const sdkInspectApproval: (a: any) => [number, number, number];
 export const sdkInspectRevocationList: (a: number, b: number) => [number, number, number];
 export const sdkSignApprovalForRequest: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number) => [number, number, number, number];
 export const sdkSignRevocationListVersioned: (a: any, b: number, c: number, d: number) => [number, number, number, number];

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export type { ApprovalGateInspection, ApprovalRequirement, ApprovalRequirementStatus, } from "./wasm.ts";
-export { approvalRequirement, evaluateApprovalGates, inspectApprovalGate } from "./wasm.ts";
+export { approvalRequirement, evaluateApprovalGates, inspectApprovalGate, parseStrictJson, } from "./wasm.ts";
 export type { AllConstraint, AllowPolicy, AnyOfConstraint, ApprovalContextAttestation, ApprovalInfo, ApprovalRequest, ApprovalRequestSummary, ArgApprovalGate, CelConstraint, CidrConstraint, Clearance, ConstraintExpr, ContainsConstraint, ControlPlaneApprovalRequestV1, ControlPlaneApprovalResponseV1, CreateTenuoOptions, Decision, DevRoot, EmailConstraint, ExactConstraint, ExecuteOptions, ExplainedField, Explanation, IssueInput, IssuerKey, MaxConstraint, McpAttachOptions, McpCallParams, McpHandlerPolicy, McpJsonRpcError, McpVerifyOptions, MinConstraint, NarrowInput, NarrowOptions, NonceStore, NotConstraint, NotOneOfConstraint, OneOfConstraint, PatternConstraint, PresentedCall, ProtectedTool, PublicKeyHandle, RangeConstraint, ReceiptChainInfo, ReceiptInfo, RegexConstraint, RequireApproval, RevocationListInfo, RevocationListInput, Session, SessionAllow, SessionFromWireInput, SessionInfo, SessionInput, ShlexConstraint, SignApprovalOptions, SubsetConstraint, Tenuo, LegacyTenuoErrorCode, ProtocolDenialCode, TenuoErrorCode, TenuoMcp, TenuoMcpMeta, ToolApprovalGate, ToolLike, ToolPolicy, UnderConstraint, UrlPatternConstraint, UrlSafeConstraint, WarrantPart, WildcardConstraint, } from "./api.ts";
 export { ApprovalRequiredError, AuthorizationDeniedError, TenuoConfigurationError, TenuoError, } from "./errors.ts";
 export { all, anyOf, cel, cidr, contains, email, exact, max, min, not, notOneOf, oneOf, pathGlob, pattern, range, regex, shlex, subset, under, urlPattern, urlSafe, wildcard, } from "./constraints.ts";

package/dist/index.js

@@ -1,4 +1,4 @@
-export { approvalRequirement, evaluateApprovalGates, inspectApprovalGate } from "./wasm.js";
+export { approvalRequirement, evaluateApprovalGates, inspectApprovalGate, parseStrictJson, } from "./wasm.js";
 export { ApprovalRequiredError, AuthorizationDeniedError, TenuoConfigurationError, TenuoError, } from "./errors.js";
 export { all, anyOf, cel, cidr, contains, email, exact, max, min, not, notOneOf, oneOf, pathGlob, pattern, range, regex, shlex, subset, under, urlPattern, urlSafe, wildcard, } from "./constraints.js";
 export { memoryNonceStore } from "./nonce.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AA4E5F,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,GAAG,EACH,KAAK,EACL,GAAG,EACH,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,KAAK,EACL,GAAG,EACH,GAAG,EACH,GAAG,EACH,QAAQ,EACR,KAAK,EACL,QAAQ,EACR,OAAO,EACP,KAAK,EACL,KAAK,EACL,KAAK,EACL,MAAM,EACN,KAAK,EACL,UAAU,EACV,OAAO,EACP,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEnE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAG/D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAElF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC","sourcesContent":["export type {\n  ApprovalGateInspection,\n  ApprovalRequirement,\n  ApprovalRequirementStatus,\n} from \"./wasm.ts\";\n\nexport { approvalRequirement, evaluateApprovalGates, inspectApprovalGate } from \"./wasm.ts\";\n\nexport type {\n  AllConstraint,\n  AllowPolicy,\n  AnyOfConstraint,\n  ApprovalContextAttestation,\n  ApprovalInfo,\n  ApprovalRequest,\n  ApprovalRequestSummary,\n  ArgApprovalGate,\n  CelConstraint,\n  CidrConstraint,\n  Clearance,\n  ConstraintExpr,\n  ContainsConstraint,\n  ControlPlaneApprovalRequestV1,\n  ControlPlaneApprovalResponseV1,\n  CreateTenuoOptions,\n  Decision,\n  DevRoot,\n  EmailConstraint,\n  ExactConstraint,\n  ExecuteOptions,\n  ExplainedField,\n  Explanation,\n  IssueInput,\n  IssuerKey,\n  MaxConstraint,\n  McpAttachOptions,\n  McpCallParams,\n  McpHandlerPolicy,\n  McpJsonRpcError,\n  McpVerifyOptions,\n  MinConstraint,\n  NarrowInput,\n  NarrowOptions,\n  NonceStore,\n  NotConstraint,\n  NotOneOfConstraint,\n  OneOfConstraint,\n  PatternConstraint,\n  PresentedCall,\n  ProtectedTool,\n  PublicKeyHandle,\n  RangeConstraint,\n  ReceiptChainInfo,\n  ReceiptInfo,\n  RegexConstraint,\n  RequireApproval,\n  RevocationListInfo,\n  RevocationListInput,\n  Session,\n  SessionAllow,\n  SessionFromWireInput,\n  SessionInfo,\n  SessionInput,\n  ShlexConstraint,\n  SignApprovalOptions,\n  SubsetConstraint,\n  Tenuo,\n  LegacyTenuoErrorCode,\n  ProtocolDenialCode,\n  TenuoErrorCode,\n  TenuoMcp,\n  TenuoMcpMeta,\n  ToolApprovalGate,\n  ToolLike,\n  ToolPolicy,\n  UnderConstraint,\n  UrlPatternConstraint,\n  UrlSafeConstraint,\n  WarrantPart,\n  WildcardConstraint,\n} from \"./api.ts\";\n\nexport {\n  ApprovalRequiredError,\n  AuthorizationDeniedError,\n  TenuoConfigurationError,\n  TenuoError,\n} from \"./errors.ts\";\n\nexport {\n  all,\n  anyOf,\n  cel,\n  cidr,\n  contains,\n  email,\n  exact,\n  max,\n  min,\n  not,\n  notOneOf,\n  oneOf,\n  pathGlob,\n  pattern,\n  range,\n  regex,\n  shlex,\n  subset,\n  under,\n  urlPattern,\n  urlSafe,\n  wildcard,\n} from \"./constraints.ts\";\n\nexport { memoryNonceStore } from \"./nonce.ts\";\n\nexport { Session as SessionHandle, isSession } from \"./session.ts\";\n\nexport { ConnectToken, parseConnectToken } from \"./connect.ts\";\nexport type { ResolveEndpointOptions } from \"./connect.ts\";\n\nexport { HolderIdentity, generateIdentity, identityFromKey } from \"./identity.ts\";\n\nexport { Runtime } from \"./runtime.ts\";\nexport type { ReceiptsMode, RuntimeOptions, SessionWarrant } from \"./runtime.ts\";\n\nexport { createTenuo } from \"./client.ts\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,GAChB,MAAM,WAAW,CAAC;AA4EnB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,GAAG,EACH,KAAK,EACL,GAAG,EACH,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,KAAK,EACL,GAAG,EACH,GAAG,EACH,GAAG,EACH,QAAQ,EACR,KAAK,EACL,QAAQ,EACR,OAAO,EACP,KAAK,EACL,KAAK,EACL,KAAK,EACL,MAAM,EACN,KAAK,EACL,UAAU,EACV,OAAO,EACP,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEnE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAG/D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAElF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC","sourcesContent":["export type {\n  ApprovalGateInspection,\n  ApprovalRequirement,\n  ApprovalRequirementStatus,\n} from \"./wasm.ts\";\n\nexport {\n  approvalRequirement,\n  evaluateApprovalGates,\n  inspectApprovalGate,\n  parseStrictJson,\n} from \"./wasm.ts\";\n\nexport type {\n  AllConstraint,\n  AllowPolicy,\n  AnyOfConstraint,\n  ApprovalContextAttestation,\n  ApprovalInfo,\n  ApprovalRequest,\n  ApprovalRequestSummary,\n  ArgApprovalGate,\n  CelConstraint,\n  CidrConstraint,\n  Clearance,\n  ConstraintExpr,\n  ContainsConstraint,\n  ControlPlaneApprovalRequestV1,\n  ControlPlaneApprovalResponseV1,\n  CreateTenuoOptions,\n  Decision,\n  DevRoot,\n  EmailConstraint,\n  ExactConstraint,\n  ExecuteOptions,\n  ExplainedField,\n  Explanation,\n  IssueInput,\n  IssuerKey,\n  MaxConstraint,\n  McpAttachOptions,\n  McpCallParams,\n  McpHandlerPolicy,\n  McpJsonRpcError,\n  McpVerifyOptions,\n  MinConstraint,\n  NarrowInput,\n  NarrowOptions,\n  NonceStore,\n  NotConstraint,\n  NotOneOfConstraint,\n  OneOfConstraint,\n  PatternConstraint,\n  PresentedCall,\n  ProtectedTool,\n  PublicKeyHandle,\n  RangeConstraint,\n  ReceiptChainInfo,\n  ReceiptInfo,\n  RegexConstraint,\n  RequireApproval,\n  RevocationListInfo,\n  RevocationListInput,\n  Session,\n  SessionAllow,\n  SessionFromWireInput,\n  SessionInfo,\n  SessionInput,\n  ShlexConstraint,\n  SignApprovalOptions,\n  SubsetConstraint,\n  Tenuo,\n  LegacyTenuoErrorCode,\n  ProtocolDenialCode,\n  TenuoErrorCode,\n  TenuoMcp,\n  TenuoMcpMeta,\n  ToolApprovalGate,\n  ToolLike,\n  ToolPolicy,\n  UnderConstraint,\n  UrlPatternConstraint,\n  UrlSafeConstraint,\n  WarrantPart,\n  WildcardConstraint,\n} from \"./api.ts\";\n\nexport {\n  ApprovalRequiredError,\n  AuthorizationDeniedError,\n  TenuoConfigurationError,\n  TenuoError,\n} from \"./errors.ts\";\n\nexport {\n  all,\n  anyOf,\n  cel,\n  cidr,\n  contains,\n  email,\n  exact,\n  max,\n  min,\n  not,\n  notOneOf,\n  oneOf,\n  pathGlob,\n  pattern,\n  range,\n  regex,\n  shlex,\n  subset,\n  under,\n  urlPattern,\n  urlSafe,\n  wildcard,\n} from \"./constraints.ts\";\n\nexport { memoryNonceStore } from \"./nonce.ts\";\n\nexport { Session as SessionHandle, isSession } from \"./session.ts\";\n\nexport { ConnectToken, parseConnectToken } from \"./connect.ts\";\nexport type { ResolveEndpointOptions } from \"./connect.ts\";\n\nexport { HolderIdentity, generateIdentity, identityFromKey } from \"./identity.ts\";\n\nexport { Runtime } from \"./runtime.ts\";\nexport type { ReceiptsMode, RuntimeOptions, SessionWarrant } from \"./runtime.ts\";\n\nexport { createTenuo } from \"./client.ts\";\n"]}

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
 import type { McpAttachOptions, McpVerifyOptions, PresentedCall, Session as SessionContract, TenuoMcp } from "./api.ts";
-import type { WasmContext, WasmDecision } from "./wasm.ts";
+import { type WasmContext, type WasmDecision } from "./wasm.ts";
 export type Decide = (decision: WasmDecision, tool: string, native?: object, args?: Record<string, unknown>) => void;
 /**
  * Transport-agnostic half of `attach`: authorize locally, then sign

package/dist/mcp.js

@@ -1,6 +1,8 @@
 import { AuthorizationDeniedError, TenuoConfigurationError, TenuoError } from "./errors.js";
 import { collectReceipt, emitIsolatedReceipt } from "./receipts.js";
+import { admitNonce, consumeApprovals, snapshotApprovals } from "./replay.js";
 import { nativeSession } from "./session.js";
+import { loadWasm } from "./wasm.js";
 /**
  * Transport-agnostic half of `attach`: authorize locally, then sign
  * proof-of-possession over the call. Shared by `tenuo.present()` and
@@ -11,19 +13,19 @@ export function presentCall(context, decide, session, name, args, options, label
         assertKnownKeys(options, ATTACH_OPTION_KEYS, `${label} options`);
     }
     const native = nativeSession(session);
-    const wireArgs = stripNulls(args);
-    const local = context.authorize(native, name, wireArgs, options?.approvals, undefined, options?.requestId);
+    const snapshot = captureArguments(args);
+    const local = context.authorize(native, name, snapshot.json, options?.approvals, undefined, options?.requestId);
     emitReceipt(options?.onReceipt, local.receipt, session, host);
-    decide(local, name, native, wireArgs);
-    const signature = context.signPop(native, name, wireArgs);
-    const warrant = stackWire(native);
-    if (options?.approvals !== undefined && options.approvals.length > 0) {
-        return {
-            presented: { warrant, signature, approvals: options.approvals.map(approvalWire) },
-            wireArgs,
-        };
-    }
-    return { presented: { warrant, signature }, wireArgs };
+    decide(local, name, native, snapshot.executionArgs());
+    const envelope = context.signMeta(native, name, snapshot.json, Math.floor(Date.now() / 1000), options?.approvals ?? null);
+    const presented = {
+        warrant: envelope.warrant,
+        signature: envelope.signature,
+        ...(envelope.approvals !== undefined && envelope.approvals.length > 0
+            ? { approvals: envelope.approvals }
+            : {}),
+    };
+    return { presented, wireArgs: snapshot.executionArgs() };
 }
 /**
  * Transport-agnostic half of `verify`: check a presented warrant chain and
@@ -38,15 +40,24 @@ export async function verifyPresented(context, decide, presented, name, args, op
     if (envelope === undefined) {
         throw new TenuoConfigurationError(`${label} needs { warrant, signature } from tenuo.present() or tenuo.mcp.attach()`);
     }
-    const decision = context.authorizePresented(envelope.warrant, name, stripNulls(args), envelope.signature, envelope.approvals, options?.allow, options?.requestId);
+    const approvals = snapshotApprovals(envelope.approvals);
+    // Capture once: replay admission and receipt callbacks may yield or mutate
+    // the caller's object. Execution must use the exact snapshot verified here.
+    const snapshot = captureArguments(args);
+    const decision = context.authorizePresented(envelope.warrant, name, snapshot.json, envelope.signature, approvals, options?.allow, options?.requestId);
     // Rust already signed this envelope. Emit before the nonce store can
     // refuse a replay — otherwise an attacker leaves no audit artifact.
     emitReceipt(options?.onReceipt, decision.receipt, undefined, host);
     if (decision.outcome === "allow") {
         await admitPop(options?.nonceStore, envelope.signature, options?.onNonceStoreError);
+        // A fresh PoP over the same approvals is a new token; consume the
+        // approvals themselves so a nonce store makes them one-use here too.
+        await consumeApprovals(options?.nonceStore, approvals, receiptRequestHash(decision.receipt), name, options?.onNonceStoreError);
     }
     decide(decision, name);
-    return plainArgs(decision.args);
+    // Run the host parse of the JSON text the proof covers. The raw host
+    // object can contain values that JSON drops.
+    return snapshot.executionArgs();
 }
 export function createMcp(context, decide, host) {
     const mcp = {
@@ -83,22 +94,16 @@ export function createMcp(context, decide, host) {
     };
     return mcp;
 }
-function stackWire(native) {
-    const session = native;
-    if (typeof session.toStackWire !== "function") {
-        throw new TenuoConfigurationError("session is not bound to the WASM core");
+/** A private immutable input snapshot, not an authorization token. */
+function captureArguments(args) {
+    const text = JSON.stringify(args);
+    if (typeof text !== "string") {
+        throw new TenuoConfigurationError("arguments must be JSON");
     }
-    const wire = session.toStackWire();
-    if (typeof wire !== "string" || wire.length === 0) {
-        throw new TenuoConfigurationError("toStackWire() did not return a warrant stack");
-    }
-    return wire;
-}
-function approvalWire(value) {
-    if (typeof value === "string") {
-        return value;
-    }
-    return Buffer.from(value).toString("base64");
+    return Object.freeze({
+        json: text,
+        executionArgs: () => plainArgs(JSON.parse(text)),
+    });
 }
 function presentedEnvelope(value) {
     if (value === null || typeof value !== "object") {
@@ -111,9 +116,11 @@ function presentedEnvelope(value) {
     if (typeof tenuo.signature !== "string" || tenuo.signature.length === 0) {
         return undefined;
     }
-    const approvals = Array.isArray(tenuo.approvals)
-        ? tenuo.approvals.filter((item) => typeof item === "string")
-        : undefined;
+    if (tenuo.approvals != null &&
+        (!Array.isArray(tenuo.approvals) || tenuo.approvals.some((item) => typeof item !== "string"))) {
+        return undefined;
+    }
+    const approvals = tenuo.approvals ?? undefined;
     return {
         warrant: tenuo.warrant,
         signature: tenuo.signature,
@@ -136,10 +143,7 @@ const VERIFY_OPTION_KEYS = new Set([
     "onNonceStoreError",
     "requestId",
 ]);
-const REPLAY_STORE_UNAVAILABLE = "Replay store unavailable";
 const ATTACH_OPTION_KEYS = new Set(["approvals", "onReceipt", "requestId"]);
-const MAX_STRIP_DEPTH = 32;
-const MAX_STRIP_LEN = 1024;
 function assertKnownKeys(value, known, label) {
     const unknown = Object.keys(value).filter((key) => !known.has(key));
     if (unknown[0] !== undefined) {
@@ -159,57 +163,21 @@ function isHandlerPolicy(value) {
     const hasStoreError = "onNonceStoreError" in record && typeof record.onNonceStoreError === "function";
     return keys.length === 0 || hasAllow || hasReceipt || hasNonce || hasStoreError;
 }
-async function admitPop(store, signature, onNonceStoreError) {
-    if (store === undefined) {
-        return;
-    }
-    let admitted;
-    try {
-        admitted = store.checkAndRecord(signature);
-    }
-    catch (error) {
-        throw replayStoreUnavailable(error, onNonceStoreError);
-    }
-    if (isThenable(admitted)) {
-        try {
-            admitted = await admitted;
-        }
-        catch (error) {
-            throw replayStoreUnavailable(error, onNonceStoreError);
-        }
-    }
-    if (typeof admitted !== "boolean") {
-        throw replayStoreUnavailable(new TenuoConfigurationError("NonceStore.checkAndRecord() must return boolean or Promise<boolean>"), onNonceStoreError);
-    }
-    if (!admitted) {
-        throw new AuthorizationDeniedError("TENUO_INVALID_POP", "PoP replay detected — this exact authorization token was already consumed.");
-    }
-}
-function replayStoreUnavailable(cause, onNonceStoreError) {
-    emitIsolated(onNonceStoreError, cause);
-    const error = new TenuoConfigurationError(REPLAY_STORE_UNAVAILABLE);
-    if (cause !== undefined) {
-        error.cause = cause;
-    }
-    return error;
+function admitPop(store, signature, onNonceStoreError) {
+    return admitNonce(store, signature, onNonceStoreError, () => new AuthorizationDeniedError("TENUO_INVALID_POP", "PoP replay detected — this exact authorization token was already consumed."));
 }
-function emitIsolated(hook, error) {
-    if (hook === undefined) {
-        return;
+/** The request hash core wrote into the decision receipt, when there is one. */
+function receiptRequestHash(receipt) {
+    if (receipt === undefined) {
+        return undefined;
     }
     try {
-        const result = hook(error);
-        if (isThenable(result)) {
-            void Promise.resolve(result).catch(() => undefined);
-        }
+        return loadWasm().sdkVerifyReceipt(receipt).request_hash;
     }
     catch {
-        // Isolated — must not change the public error.
+        return undefined;
     }
 }
-function isThenable(value) {
-    return value !== null && typeof value === "object" && "then" in value && typeof value.then === "function";
-}
 function emitReceipt(onReceipt, receipt, session, host) {
     collectReceipt(receipt, session, host);
     emitIsolatedReceipt(onReceipt, receipt);
@@ -223,37 +191,6 @@ function plainArgs(value) {
     }
     return {};
 }
-/** Same rule as Python `strip_none_values`: drop null so optional MCP args do not break PoP. */
-function stripNulls(args) {
-    const keys = Object.keys(args);
-    if (keys.length > MAX_STRIP_LEN) {
-        throw new TenuoConfigurationError("arguments exceed the TypeScript input budget");
-    }
-    const out = {};
-    for (const [key, value] of Object.entries(args)) {
-        if (value === null || value === undefined) {
-            continue;
-        }
-        out[key] = Array.isArray(value) ? cleanList(value, 1) : value;
-    }
-    return out;
-}
-function cleanList(value, depth) {
-    if (depth > MAX_STRIP_DEPTH) {
-        throw new TenuoConfigurationError("arguments exceed the TypeScript nesting budget");
-    }
-    if (value.length > MAX_STRIP_LEN) {
-        throw new TenuoConfigurationError("arguments exceed the TypeScript input budget");
-    }
-    const cleaned = [];
-    for (const item of value) {
-        if (item === null || item === undefined) {
-            continue;
-        }
-        cleaned.push(Array.isArray(item) ? cleanList(item, depth + 1) : item);
-    }
-    return cleaned;
-}
 function jsonRpcError(error) {
     if (error instanceof TenuoError) {
         const code = error.code;

package/dist/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,aAAa,EAAgB,MAAM,cAAc,CAAC;AAK3D;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,OAAoB,EACpB,MAAc,EACd,OAAwB,EACxB,IAAY,EACZ,IAAuC,EACvC,OAAqC,EACrC,KAAa,EACb,IAAa;IAEb,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,eAAe,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAkB,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAC7B,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,OAAO,EAAE,SAAS,EAClB,SAAS,EACT,OAAO,EAAE,SAAS,CACnB,CAAC;IACF,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE;YACjF,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAoB,EACpB,MAAc,EACd,SAAwB,EACxB,IAAY,EACZ,IAAuC,EACvC,OAAqC,EACrC,KAAa,EACb,IAAa;IAEb,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,eAAe,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,KAAK,0EAA0E,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CACzC,QAAQ,CAAC,OAAO,EAChB,IAAI,EACJ,UAAU,CAAC,IAAI,CAAC,EAChB,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,SAAS,EAClB,OAAO,EAAE,KAAK,EACd,OAAO,EAAE,SAAS,CACnB,CAAC;IACF,qEAAqE;IACrE,oEAAoE;IACpE,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvB,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAoB,EAAE,MAAc,EAAE,IAAa;IAC3E,MAAM,GAAG,GAAa;QACpB,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;YACjC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,WAAW,CACzC,OAAO,EACP,MAAM,EACN,OAAO,EACP,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,cAAc,EACd,IAAI,CACL,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;YACpC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,uBAAuB,CAC/B,2EAA2E,CAC5E,CAAC;YACJ,CAAC;YACD,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QAC/F,CAAC;QAED,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,YAAa;YAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,MAAM,OAAO,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC;YAClF,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC3B,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,KAAK,EAAE,IAAI,EAAE;oBAC3E,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/D,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,GAAG,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9E,GAAG,CAAC,MAAM,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpG,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,UAAmB,CAAC,CAAC;YACtC,CAAC,CAAC;QACJ,CAAC;QAED,YAAY,CAAC,KAAK;YAChB,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,OAAO,GAAG,MAAyC,CAAC;IAC1D,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAAC,8CAA8C,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAA0B;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc;IAEd,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,KAAwE,CAAC;IACvF,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAC9C,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC5E,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,IAAa;IAEb,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,IAA4C,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAK,IAAI,CAAC,KAAyC,EAAE,KAAK,CAAC;IACnF,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC/F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,OAAO;IACP,WAAW;IACX,YAAY;IACZ,mBAAmB;IACnB,WAAW;CACZ,CAAC,CAAC;AACH,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAC5D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAC5E,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,eAAe,CAAC,KAAa,EAAE,KAA0B,EAAE,KAAa;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,KAAK,qBAAqB,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QACvG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,eAAe,CAAC,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,KAKd,CAAC;IACF,MAAM,QAAQ,GACZ,OAAO,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjH,MAAM,UAAU,GAAG,WAAW,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC;IACnF,MAAM,QAAQ,GAAG,YAAY,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC;IAC/G,MAAM,aAAa,GAAG,mBAAmB,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,iBAAiB,KAAK,UAAU,CAAC;IACtG,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,IAAI,UAAU,IAAI,QAAQ,IAAI,aAAa,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,KAAuF,EACvF,SAAiB,EACjB,iBAA4D;IAE5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IACD,IAAI,QAAoC,CAAC;IACzC,IAAI,CAAC;QACH,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,sBAAsB,CAC1B,IAAI,uBAAuB,CAAC,qEAAqE,CAAC,EAClG,iBAAiB,CAClB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,wBAAwB,CAChC,mBAAmB,EACnB,4EAA4E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAc,EACd,iBAA4D;IAE5D,YAAY,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;IACpE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CACnB,IAA4D,EAC5D,KAAc;IAEd,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;AAC5G,CAAC;AAED,SAAS,WAAW,CAClB,SAAkE,EAClE,OAA2B,EAC3B,OAAyB,EACzB,IAAa;IAEb,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,GAAI,KAAiC,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,gGAAgG;AAChG,SAAS,UAAU,CAAC,IAAuC;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,8CAA8C,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB,EAAE,KAAa;IACzD,IAAI,KAAK,GAAG,eAAe,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAAC,gDAAgD,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,8CAA8C,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,GAAmB,KAAK,CAAC,IAAI,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9G,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC","sourcesContent":["import type {\n  McpAttachOptions,\n  McpCallParams,\n  McpHandlerPolicy,\n  McpJsonRpcError,\n  McpVerifyOptions,\n  PresentedCall,\n  Session as SessionContract,\n  TenuoErrorCode,\n  TenuoMcp,\n} from \"./api.ts\";\nimport { AuthorizationDeniedError, TenuoConfigurationError, TenuoError } from \"./errors.ts\";\nimport { collectReceipt, emitIsolatedReceipt } from \"./receipts.ts\";\nimport { nativeSession, type Session } from \"./session.ts\";\nimport type { WasmContext, WasmDecision } from \"./wasm.ts\";\n\nexport type Decide = (decision: WasmDecision, tool: string, native?: object, args?: Record<string, unknown>) => void;\n\n/**\n * Transport-agnostic half of `attach`: authorize locally, then sign\n * proof-of-possession over the call. Shared by `tenuo.present()` and\n * `tenuo.mcp.attach()`.\n */\nexport function presentCall(\n  context: WasmContext,\n  decide: Decide,\n  session: SessionContract,\n  name: string,\n  args: Readonly<Record<string, unknown>>,\n  options: McpAttachOptions | undefined,\n  label: string,\n  host?: object,\n): { readonly presented: PresentedCall; readonly wireArgs: Record<string, unknown> } {\n  if (options !== undefined) {\n    assertKnownKeys(options, ATTACH_OPTION_KEYS, `${label} options`);\n  }\n  const native = nativeSession(session as Session);\n  const wireArgs = stripNulls(args);\n  const local = context.authorize(\n    native,\n    name,\n    wireArgs,\n    options?.approvals,\n    undefined,\n    options?.requestId,\n  );\n  emitReceipt(options?.onReceipt, local.receipt, session, host);\n  decide(local, name, native, wireArgs);\n  const signature = context.signPop(native, name, wireArgs);\n  const warrant = stackWire(native);\n  if (options?.approvals !== undefined && options.approvals.length > 0) {\n    return {\n      presented: { warrant, signature, approvals: options.approvals.map(approvalWire) },\n      wireArgs,\n    };\n  }\n  return { presented: { warrant, signature }, wireArgs };\n}\n\n/**\n * Transport-agnostic half of `verify`: check a presented warrant chain and\n * proof-of-possession, then apply the host ceiling. Shared by\n * `tenuo.verify()` and `tenuo.mcp.verify()`.\n */\nexport async function verifyPresented(\n  context: WasmContext,\n  decide: Decide,\n  presented: PresentedCall,\n  name: string,\n  args: Readonly<Record<string, unknown>>,\n  options: McpVerifyOptions | undefined,\n  label: string,\n  host?: object,\n): Promise<Readonly<Record<string, unknown>>> {\n  if (options !== undefined) {\n    assertKnownKeys(options, VERIFY_OPTION_KEYS, `${label} options`);\n  }\n  const envelope = presentedEnvelope(presented);\n  if (envelope === undefined) {\n    throw new TenuoConfigurationError(\n      `${label} needs { warrant, signature } from tenuo.present() or tenuo.mcp.attach()`,\n    );\n  }\n  const decision = context.authorizePresented(\n    envelope.warrant,\n    name,\n    stripNulls(args),\n    envelope.signature,\n    envelope.approvals,\n    options?.allow,\n    options?.requestId,\n  );\n  // Rust already signed this envelope. Emit before the nonce store can\n  // refuse a replay — otherwise an attacker leaves no audit artifact.\n  emitReceipt(options?.onReceipt, decision.receipt, undefined, host);\n  if (decision.outcome === \"allow\") {\n    await admitPop(options?.nonceStore, envelope.signature, options?.onNonceStoreError);\n  }\n  decide(decision, name);\n  return plainArgs(decision.args);\n}\n\nexport function createMcp(context: WasmContext, decide: Decide, host?: object): TenuoMcp {\n  const mcp: TenuoMcp = {\n    attach(session, name, args, options) {\n      const { presented, wireArgs } = presentCall(\n        context,\n        decide,\n        session,\n        name,\n        args,\n        options,\n        \"mcp.attach()\",\n        host,\n      );\n      return { name, arguments: wireArgs, _meta: { tenuo: presented } };\n    },\n\n    async verify(name, args, meta, options) {\n      const envelope = tenuoEnvelope(meta);\n      if (envelope === undefined) {\n        throw new TenuoConfigurationError(\n          \"MCP call is missing _meta.tenuo. The client must call tenuo.mcp.attach().\",\n        );\n      }\n      return verifyPresented(context, decide, envelope, name, args, options, \"mcp.verify()\", host);\n    },\n\n    handler(name, policyOrExecute, maybeExecute?) {\n      const policy = isHandlerPolicy(policyOrExecute) ? policyOrExecute : undefined;\n      const execute = isHandlerPolicy(policyOrExecute) ? maybeExecute : policyOrExecute;\n      if (typeof execute !== \"function\") {\n        throw new TenuoConfigurationError(\"mcp.handler() requires an execute function\");\n      }\n      return async (args, extra) => {\n        const authorized = await mcp.verify(name, args, extra?._meta ?? extra?.meta, {\n          ...(policy?.allow !== undefined ? { allow: policy.allow } : {}),\n          ...(policy?.onReceipt !== undefined ? { onReceipt: policy.onReceipt } : {}),\n          ...(policy?.nonceStore !== undefined ? { nonceStore: policy.nonceStore } : {}),\n          ...(policy?.onNonceStoreError !== undefined ? { onNonceStoreError: policy.onNonceStoreError } : {}),\n        });\n        return execute(authorized as never);\n      };\n    },\n\n    jsonRpcError(error) {\n      return jsonRpcError(error);\n    },\n  };\n  return mcp;\n}\n\nfunction stackWire(native: object): string {\n  const session = native as { toStackWire?: () => unknown };\n  if (typeof session.toStackWire !== \"function\") {\n    throw new TenuoConfigurationError(\"session is not bound to the WASM core\");\n  }\n  const wire = session.toStackWire();\n  if (typeof wire !== \"string\" || wire.length === 0) {\n    throw new TenuoConfigurationError(\"toStackWire() did not return a warrant stack\");\n  }\n  return wire;\n}\n\nfunction approvalWire(value: string | Uint8Array): string {\n  if (typeof value === \"string\") {\n    return value;\n  }\n  return Buffer.from(value).toString(\"base64\");\n}\n\nfunction presentedEnvelope(\n  value: unknown,\n): { warrant: string; signature: string; approvals?: string[] } | undefined {\n  if (value === null || typeof value !== \"object\") {\n    return undefined;\n  }\n  const tenuo = value as { warrant?: unknown; signature?: unknown; approvals?: unknown };\n  if (typeof tenuo.warrant !== \"string\" || tenuo.warrant.length === 0) {\n    return undefined;\n  }\n  if (typeof tenuo.signature !== \"string\" || tenuo.signature.length === 0) {\n    return undefined;\n  }\n  const approvals = Array.isArray(tenuo.approvals)\n    ? tenuo.approvals.filter((item): item is string => typeof item === \"string\")\n    : undefined;\n  return {\n    warrant: tenuo.warrant,\n    signature: tenuo.signature,\n    ...(approvals !== undefined && approvals.length > 0 ? { approvals } : {}),\n  };\n}\n\nfunction tenuoEnvelope(\n  meta: unknown,\n): { warrant: string; signature: string; approvals?: string[] } | undefined {\n  if (meta === null || typeof meta !== \"object\") {\n    return undefined;\n  }\n  const root = meta as { tenuo?: unknown; _meta?: unknown };\n  const block = root.tenuo ?? (root._meta as { tenuo?: unknown } | undefined)?.tenuo;\n  return presentedEnvelope(block);\n}\n\nconst HANDLER_POLICY_KEYS = new Set([\"allow\", \"onReceipt\", \"nonceStore\", \"onNonceStoreError\"]);\nconst VERIFY_OPTION_KEYS = new Set([\n  \"allow\",\n  \"onReceipt\",\n  \"nonceStore\",\n  \"onNonceStoreError\",\n  \"requestId\",\n]);\nconst REPLAY_STORE_UNAVAILABLE = \"Replay store unavailable\";\nconst ATTACH_OPTION_KEYS = new Set([\"approvals\", \"onReceipt\", \"requestId\"]);\nconst MAX_STRIP_DEPTH = 32;\nconst MAX_STRIP_LEN = 1024;\n\nfunction assertKnownKeys(value: object, known: ReadonlySet<string>, label: string): void {\n  const unknown = Object.keys(value).filter((key) => !known.has(key));\n  if (unknown[0] !== undefined) {\n    throw new TenuoConfigurationError(\n      `${label} has unknown key '${unknown[0]}'. Use ${[...known].join(\", \")}.`,\n    );\n  }\n}\n\nfunction isHandlerPolicy(value: unknown): value is McpHandlerPolicy {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value) || typeof value === \"function\") {\n    return false;\n  }\n  const keys = Object.keys(value);\n  assertKnownKeys(value, HANDLER_POLICY_KEYS, \"mcp.handler() policy\");\n  const record = value as {\n    allow?: unknown;\n    onReceipt?: unknown;\n    nonceStore?: unknown;\n    onNonceStoreError?: unknown;\n  };\n  const hasAllow =\n    \"allow\" in record && record.allow !== null && typeof record.allow === \"object\" && !Array.isArray(record.allow);\n  const hasReceipt = \"onReceipt\" in record && typeof record.onReceipt === \"function\";\n  const hasNonce = \"nonceStore\" in record && record.nonceStore !== null && typeof record.nonceStore === \"object\";\n  const hasStoreError = \"onNonceStoreError\" in record && typeof record.onNonceStoreError === \"function\";\n  return keys.length === 0 || hasAllow || hasReceipt || hasNonce || hasStoreError;\n}\n\nasync function admitPop(\n  store: { checkAndRecord(popSignature: string): boolean | Promise<boolean> } | undefined,\n  signature: string,\n  onNonceStoreError?: (error: unknown) => void | Promise<void>,\n): Promise<void> {\n  if (store === undefined) {\n    return;\n  }\n  let admitted: boolean | Promise<boolean>;\n  try {\n    admitted = store.checkAndRecord(signature);\n  } catch (error) {\n    throw replayStoreUnavailable(error, onNonceStoreError);\n  }\n  if (isThenable(admitted)) {\n    try {\n      admitted = await admitted;\n    } catch (error) {\n      throw replayStoreUnavailable(error, onNonceStoreError);\n    }\n  }\n  if (typeof admitted !== \"boolean\") {\n    throw replayStoreUnavailable(\n      new TenuoConfigurationError(\"NonceStore.checkAndRecord() must return boolean or Promise<boolean>\"),\n      onNonceStoreError,\n    );\n  }\n  if (!admitted) {\n    throw new AuthorizationDeniedError(\n      \"TENUO_INVALID_POP\",\n      \"PoP replay detected — this exact authorization token was already consumed.\",\n    );\n  }\n}\n\nfunction replayStoreUnavailable(\n  cause: unknown,\n  onNonceStoreError?: (error: unknown) => void | Promise<void>,\n): TenuoConfigurationError {\n  emitIsolated(onNonceStoreError, cause);\n  const error = new TenuoConfigurationError(REPLAY_STORE_UNAVAILABLE);\n  if (cause !== undefined) {\n    error.cause = cause;\n  }\n  return error;\n}\n\nfunction emitIsolated(\n  hook: ((error: unknown) => void | Promise<void>) | undefined,\n  error: unknown,\n): void {\n  if (hook === undefined) {\n    return;\n  }\n  try {\n    const result = hook(error);\n    if (isThenable(result)) {\n      void Promise.resolve(result).catch(() => undefined);\n    }\n  } catch {\n    // Isolated — must not change the public error.\n  }\n}\n\nfunction isThenable(value: unknown): value is Promise<boolean> {\n  return value !== null && typeof value === \"object\" && \"then\" in value && typeof value.then === \"function\";\n}\n\nfunction emitReceipt(\n  onReceipt: ((receipt: string) => void | Promise<void>) | undefined,\n  receipt: string | undefined,\n  session?: SessionContract,\n  host?: object,\n): void {\n  collectReceipt(receipt, session, host);\n  emitIsolatedReceipt(onReceipt, receipt);\n}\n\nfunction plainArgs(value: unknown): Record<string, unknown> {\n  if (value instanceof Map) {\n    return Object.fromEntries(value);\n  }\n  if (value !== null && typeof value === \"object\" && !Array.isArray(value)) {\n    return { ...(value as Record<string, unknown>) };\n  }\n  return {};\n}\n\n/** Same rule as Python `strip_none_values`: drop null so optional MCP args do not break PoP. */\nfunction stripNulls(args: Readonly<Record<string, unknown>>): Record<string, unknown> {\n  const keys = Object.keys(args);\n  if (keys.length > MAX_STRIP_LEN) {\n    throw new TenuoConfigurationError(\"arguments exceed the TypeScript input budget\");\n  }\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(args)) {\n    if (value === null || value === undefined) {\n      continue;\n    }\n    out[key] = Array.isArray(value) ? cleanList(value, 1) : value;\n  }\n  return out;\n}\n\nfunction cleanList(value: readonly unknown[], depth: number): unknown[] {\n  if (depth > MAX_STRIP_DEPTH) {\n    throw new TenuoConfigurationError(\"arguments exceed the TypeScript nesting budget\");\n  }\n  if (value.length > MAX_STRIP_LEN) {\n    throw new TenuoConfigurationError(\"arguments exceed the TypeScript input budget\");\n  }\n  const cleaned: unknown[] = [];\n  for (const item of value) {\n    if (item === null || item === undefined) {\n      continue;\n    }\n    cleaned.push(Array.isArray(item) ? cleanList(item, depth + 1) : item);\n  }\n  return cleaned;\n}\n\nfunction jsonRpcError(error: unknown): McpJsonRpcError {\n  if (error instanceof TenuoError) {\n    const code: TenuoErrorCode = error.code;\n    const rpc = code === \"TENUO_APPROVAL_REQUIRED\" ? -32002 : code === \"TENUO_CANONICALIZATION\" ? -32602 : -32001;\n    return { code: rpc, message: error.message, data: { tenuo: { code } } };\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  return { code: -32001, message };\n}\n"]}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAgB,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAuC,MAAM,WAAW,CAAC;AAI1E;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,OAAoB,EACpB,MAAc,EACd,OAAwB,EACxB,IAAY,EACZ,IAAuC,EACvC,OAAqC,EACrC,KAAa,EACb,IAAa;IAEb,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,eAAe,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAkB,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAC7B,MAAM,EACN,IAAI,EACJ,QAAQ,CAAC,IAAI,EACb,OAAO,EAAE,SAAS,EAClB,SAAS,EACT,OAAO,EAAE,SAAS,CACnB,CAAC;IACF,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAC/B,MAAM,EACN,IAAI,EACJ,QAAQ,CAAC,IAAI,EACb,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC7B,OAAO,EAAE,SAAS,IAAI,IAAI,CAC3B,CAAC;IACF,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YACnE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE;YACnC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAoB,EACpB,MAAc,EACd,SAAwB,EACxB,IAAY,EACZ,IAAuC,EACvC,OAAqC,EACrC,KAAa,EACb,IAAa;IAEb,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,eAAe,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,KAAK,0EAA0E,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxD,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CACzC,QAAQ,CAAC,OAAO,EAChB,IAAI,EACJ,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,SAAS,EAClB,SAAS,EACT,OAAO,EAAE,KAAK,EACd,OAAO,EAAE,SAAS,CACnB,CAAC;IACF,qEAAqE;IACrE,oEAAoE;IACpE,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACpF,kEAAkE;QAClE,qEAAqE;QACrE,MAAM,gBAAgB,CACpB,OAAO,EAAE,UAAU,EACnB,SAAS,EACT,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,EACpC,IAAI,EACJ,OAAO,EAAE,iBAAiB,CAC3B,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvB,qEAAqE;IACrE,6CAA6C;IAC7C,OAAO,QAAQ,CAAC,aAAa,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAoB,EAAE,MAAc,EAAE,IAAa;IAC3E,MAAM,GAAG,GAAa;QACpB,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;YACjC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,WAAW,CACzC,OAAO,EACP,MAAM,EACN,OAAO,EACP,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,cAAc,EACd,IAAI,CACL,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;YACpC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,uBAAuB,CAC/B,2EAA2E,CAC5E,CAAC;YACJ,CAAC;YACD,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QAC/F,CAAC;QAED,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,YAAa;YAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,MAAM,OAAO,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC;YAClF,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC3B,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,KAAK,EAAE,IAAI,EAAE;oBAC3E,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/D,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,GAAG,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9E,GAAG,CAAC,MAAM,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpG,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,UAAmB,CAAC,CAAC;YACtC,CAAC,CAAC;QACJ,CAAC;QAED,YAAY,CAAC,KAAK;YAChB,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CAAC,IAAuC;IAI/D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,IAAI;QACV,aAAa,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;KACjD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc;IAEd,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,KAAwE,CAAC;IACvF,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QAClG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC;IAC/C,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,IAAa;IAEb,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,IAA4C,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAK,IAAI,CAAC,KAAyC,EAAE,KAAK,CAAC;IACnF,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC/F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,OAAO;IACP,WAAW;IACX,YAAY;IACZ,mBAAmB;IACnB,WAAW;CACZ,CAAC,CAAC;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAC5E,SAAS,eAAe,CAAC,KAAa,EAAE,KAA0B,EAAE,KAAa;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,KAAK,qBAAqB,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QACvG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,eAAe,CAAC,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,KAKd,CAAC;IACF,MAAM,QAAQ,GACZ,OAAO,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjH,MAAM,UAAU,GAAG,WAAW,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC;IACnF,MAAM,QAAQ,GAAG,YAAY,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC;IAC/G,MAAM,aAAa,GAAG,mBAAmB,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,iBAAiB,KAAK,UAAU,CAAC;IACtG,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,IAAI,UAAU,IAAI,QAAQ,IAAI,aAAa,CAAC;AAClF,CAAC;AAED,SAAS,QAAQ,CACf,KAAqC,EACrC,SAAiB,EACjB,iBAA4D;IAE5D,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAC1D,IAAI,wBAAwB,CAC1B,mBAAmB,EACnB,4EAA4E,CAC7E,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,kBAAkB,CAAC,OAA2B;IACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,SAAkE,EAClE,OAA2B,EAC3B,OAAyB,EACzB,IAAa;IAEb,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,GAAI,KAAiC,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,GAAmB,KAAK,CAAC,IAAI,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9G,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC","sourcesContent":["import type {\n  McpAttachOptions,\n  McpCallParams,\n  McpHandlerPolicy,\n  McpJsonRpcError,\n  McpVerifyOptions,\n  PresentedCall,\n  Session as SessionContract,\n  TenuoErrorCode,\n  TenuoMcp,\n} from \"./api.ts\";\nimport { AuthorizationDeniedError, TenuoConfigurationError, TenuoError } from \"./errors.ts\";\nimport { collectReceipt, emitIsolatedReceipt } from \"./receipts.ts\";\nimport { admitNonce, consumeApprovals, snapshotApprovals } from \"./replay.ts\";\nimport { nativeSession, type Session } from \"./session.ts\";\nimport { loadWasm, type WasmContext, type WasmDecision } from \"./wasm.ts\";\n\nexport type Decide = (decision: WasmDecision, tool: string, native?: object, args?: Record<string, unknown>) => void;\n\n/**\n * Transport-agnostic half of `attach`: authorize locally, then sign\n * proof-of-possession over the call. Shared by `tenuo.present()` and\n * `tenuo.mcp.attach()`.\n */\nexport function presentCall(\n  context: WasmContext,\n  decide: Decide,\n  session: SessionContract,\n  name: string,\n  args: Readonly<Record<string, unknown>>,\n  options: McpAttachOptions | undefined,\n  label: string,\n  host?: object,\n): { readonly presented: PresentedCall; readonly wireArgs: Record<string, unknown> } {\n  if (options !== undefined) {\n    assertKnownKeys(options, ATTACH_OPTION_KEYS, `${label} options`);\n  }\n  const native = nativeSession(session as Session);\n  const snapshot = captureArguments(args);\n  const local = context.authorize(\n    native,\n    name,\n    snapshot.json,\n    options?.approvals,\n    undefined,\n    options?.requestId,\n  );\n  emitReceipt(options?.onReceipt, local.receipt, session, host);\n  decide(local, name, native, snapshot.executionArgs());\n  const envelope = context.signMeta(\n    native,\n    name,\n    snapshot.json,\n    Math.floor(Date.now() / 1000),\n    options?.approvals ?? null,\n  );\n  const presented = {\n    warrant: envelope.warrant,\n    signature: envelope.signature,\n    ...(envelope.approvals !== undefined && envelope.approvals.length > 0\n      ? { approvals: envelope.approvals }\n      : {}),\n  };\n  return { presented, wireArgs: snapshot.executionArgs() };\n}\n\n/**\n * Transport-agnostic half of `verify`: check a presented warrant chain and\n * proof-of-possession, then apply the host ceiling. Shared by\n * `tenuo.verify()` and `tenuo.mcp.verify()`.\n */\nexport async function verifyPresented(\n  context: WasmContext,\n  decide: Decide,\n  presented: PresentedCall,\n  name: string,\n  args: Readonly<Record<string, unknown>>,\n  options: McpVerifyOptions | undefined,\n  label: string,\n  host?: object,\n): Promise<Readonly<Record<string, unknown>>> {\n  if (options !== undefined) {\n    assertKnownKeys(options, VERIFY_OPTION_KEYS, `${label} options`);\n  }\n  const envelope = presentedEnvelope(presented);\n  if (envelope === undefined) {\n    throw new TenuoConfigurationError(\n      `${label} needs { warrant, signature } from tenuo.present() or tenuo.mcp.attach()`,\n    );\n  }\n  const approvals = snapshotApprovals(envelope.approvals);\n  // Capture once: replay admission and receipt callbacks may yield or mutate\n  // the caller's object. Execution must use the exact snapshot verified here.\n  const snapshot = captureArguments(args);\n  const decision = context.authorizePresented(\n    envelope.warrant,\n    name,\n    snapshot.json,\n    envelope.signature,\n    approvals,\n    options?.allow,\n    options?.requestId,\n  );\n  // Rust already signed this envelope. Emit before the nonce store can\n  // refuse a replay — otherwise an attacker leaves no audit artifact.\n  emitReceipt(options?.onReceipt, decision.receipt, undefined, host);\n  if (decision.outcome === \"allow\") {\n    await admitPop(options?.nonceStore, envelope.signature, options?.onNonceStoreError);\n    // A fresh PoP over the same approvals is a new token; consume the\n    // approvals themselves so a nonce store makes them one-use here too.\n    await consumeApprovals(\n      options?.nonceStore,\n      approvals,\n      receiptRequestHash(decision.receipt),\n      name,\n      options?.onNonceStoreError,\n    );\n  }\n  decide(decision, name);\n  // Run the host parse of the JSON text the proof covers. The raw host\n  // object can contain values that JSON drops.\n  return snapshot.executionArgs();\n}\n\nexport function createMcp(context: WasmContext, decide: Decide, host?: object): TenuoMcp {\n  const mcp: TenuoMcp = {\n    attach(session, name, args, options) {\n      const { presented, wireArgs } = presentCall(\n        context,\n        decide,\n        session,\n        name,\n        args,\n        options,\n        \"mcp.attach()\",\n        host,\n      );\n      return { name, arguments: wireArgs, _meta: { tenuo: presented } };\n    },\n\n    async verify(name, args, meta, options) {\n      const envelope = tenuoEnvelope(meta);\n      if (envelope === undefined) {\n        throw new TenuoConfigurationError(\n          \"MCP call is missing _meta.tenuo. The client must call tenuo.mcp.attach().\",\n        );\n      }\n      return verifyPresented(context, decide, envelope, name, args, options, \"mcp.verify()\", host);\n    },\n\n    handler(name, policyOrExecute, maybeExecute?) {\n      const policy = isHandlerPolicy(policyOrExecute) ? policyOrExecute : undefined;\n      const execute = isHandlerPolicy(policyOrExecute) ? maybeExecute : policyOrExecute;\n      if (typeof execute !== \"function\") {\n        throw new TenuoConfigurationError(\"mcp.handler() requires an execute function\");\n      }\n      return async (args, extra) => {\n        const authorized = await mcp.verify(name, args, extra?._meta ?? extra?.meta, {\n          ...(policy?.allow !== undefined ? { allow: policy.allow } : {}),\n          ...(policy?.onReceipt !== undefined ? { onReceipt: policy.onReceipt } : {}),\n          ...(policy?.nonceStore !== undefined ? { nonceStore: policy.nonceStore } : {}),\n          ...(policy?.onNonceStoreError !== undefined ? { onNonceStoreError: policy.onNonceStoreError } : {}),\n        });\n        return execute(authorized as never);\n      };\n    },\n\n    jsonRpcError(error) {\n      return jsonRpcError(error);\n    },\n  };\n  return mcp;\n}\n\n/** A private immutable input snapshot, not an authorization token. */\nfunction captureArguments(args: Readonly<Record<string, unknown>>): {\n  readonly json: string;\n  executionArgs(): Record<string, unknown>;\n} {\n  const text = JSON.stringify(args);\n  if (typeof text !== \"string\") {\n    throw new TenuoConfigurationError(\"arguments must be JSON\");\n  }\n  return Object.freeze({\n    json: text,\n    executionArgs: () => plainArgs(JSON.parse(text)),\n  });\n}\n\nfunction presentedEnvelope(\n  value: unknown,\n): { warrant: string; signature: string; approvals?: string[] } | undefined {\n  if (value === null || typeof value !== \"object\") {\n    return undefined;\n  }\n  const tenuo = value as { warrant?: unknown; signature?: unknown; approvals?: unknown };\n  if (typeof tenuo.warrant !== \"string\" || tenuo.warrant.length === 0) {\n    return undefined;\n  }\n  if (typeof tenuo.signature !== \"string\" || tenuo.signature.length === 0) {\n    return undefined;\n  }\n  if (tenuo.approvals != null &&\n      (!Array.isArray(tenuo.approvals) || tenuo.approvals.some((item) => typeof item !== \"string\"))) {\n    return undefined;\n  }\n  const approvals = tenuo.approvals ?? undefined;\n  return {\n    warrant: tenuo.warrant,\n    signature: tenuo.signature,\n    ...(approvals !== undefined && approvals.length > 0 ? { approvals } : {}),\n  };\n}\n\nfunction tenuoEnvelope(\n  meta: unknown,\n): { warrant: string; signature: string; approvals?: string[] } | undefined {\n  if (meta === null || typeof meta !== \"object\") {\n    return undefined;\n  }\n  const root = meta as { tenuo?: unknown; _meta?: unknown };\n  const block = root.tenuo ?? (root._meta as { tenuo?: unknown } | undefined)?.tenuo;\n  return presentedEnvelope(block);\n}\n\nconst HANDLER_POLICY_KEYS = new Set([\"allow\", \"onReceipt\", \"nonceStore\", \"onNonceStoreError\"]);\nconst VERIFY_OPTION_KEYS = new Set([\n  \"allow\",\n  \"onReceipt\",\n  \"nonceStore\",\n  \"onNonceStoreError\",\n  \"requestId\",\n]);\nconst ATTACH_OPTION_KEYS = new Set([\"approvals\", \"onReceipt\", \"requestId\"]);\nfunction assertKnownKeys(value: object, known: ReadonlySet<string>, label: string): void {\n  const unknown = Object.keys(value).filter((key) => !known.has(key));\n  if (unknown[0] !== undefined) {\n    throw new TenuoConfigurationError(\n      `${label} has unknown key '${unknown[0]}'. Use ${[...known].join(\", \")}.`,\n    );\n  }\n}\n\nfunction isHandlerPolicy(value: unknown): value is McpHandlerPolicy {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value) || typeof value === \"function\") {\n    return false;\n  }\n  const keys = Object.keys(value);\n  assertKnownKeys(value, HANDLER_POLICY_KEYS, \"mcp.handler() policy\");\n  const record = value as {\n    allow?: unknown;\n    onReceipt?: unknown;\n    nonceStore?: unknown;\n    onNonceStoreError?: unknown;\n  };\n  const hasAllow =\n    \"allow\" in record && record.allow !== null && typeof record.allow === \"object\" && !Array.isArray(record.allow);\n  const hasReceipt = \"onReceipt\" in record && typeof record.onReceipt === \"function\";\n  const hasNonce = \"nonceStore\" in record && record.nonceStore !== null && typeof record.nonceStore === \"object\";\n  const hasStoreError = \"onNonceStoreError\" in record && typeof record.onNonceStoreError === \"function\";\n  return keys.length === 0 || hasAllow || hasReceipt || hasNonce || hasStoreError;\n}\n\nfunction admitPop(\n  store: McpVerifyOptions[\"nonceStore\"],\n  signature: string,\n  onNonceStoreError?: (error: unknown) => void | Promise<void>,\n): Promise<void> {\n  return admitNonce(store, signature, onNonceStoreError, () =>\n    new AuthorizationDeniedError(\n      \"TENUO_INVALID_POP\",\n      \"PoP replay detected — this exact authorization token was already consumed.\",\n    ),\n  );\n}\n\n/** The request hash core wrote into the decision receipt, when there is one. */\nfunction receiptRequestHash(receipt: string | undefined): string | undefined {\n  if (receipt === undefined) {\n    return undefined;\n  }\n  try {\n    return loadWasm().sdkVerifyReceipt(receipt).request_hash;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction emitReceipt(\n  onReceipt: ((receipt: string) => void | Promise<void>) | undefined,\n  receipt: string | undefined,\n  session?: SessionContract,\n  host?: object,\n): void {\n  collectReceipt(receipt, session, host);\n  emitIsolatedReceipt(onReceipt, receipt);\n}\n\nfunction plainArgs(value: unknown): Record<string, unknown> {\n  if (value instanceof Map) {\n    return Object.fromEntries(value);\n  }\n  if (value !== null && typeof value === \"object\" && !Array.isArray(value)) {\n    return { ...(value as Record<string, unknown>) };\n  }\n  return {};\n}\n\nfunction jsonRpcError(error: unknown): McpJsonRpcError {\n  if (error instanceof TenuoError) {\n    const code: TenuoErrorCode = error.code;\n    const rpc = code === \"TENUO_APPROVAL_REQUIRED\" ? -32002 : code === \"TENUO_CANONICALIZATION\" ? -32602 : -32001;\n    return { code: rpc, message: error.message, data: { tenuo: { code } } };\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  return { code: -32001, message };\n}\n"]}

package/dist/replay.d.ts

@@ -0,0 +1,20 @@
+import type { NonceStore } from "./api.ts";
+/**
+ * Record `key` in a `NonceStore`. Throws `replayed()` when the store has
+ * already seen it, and the constant "Replay store unavailable" when the
+ * store throws, rejects, or returns a non-boolean. Shared by the MCP PoP
+ * check and approval consumption.
+ */
+export declare function admitNonce(store: NonceStore | undefined, key: string, onNonceStoreError: ((error: unknown) => void | Promise<void>) | undefined, replayed: () => Error): Promise<void>;
+/**
+ * Make approvals one-use: record every approval envelope that counts for
+ * this call (valid signature and, when `requestHash` is known, bound to this
+ * exact request). Run only after core allowed the call. Do not apply a second
+ * expiry check here: core intentionally accepts its configured clock-skew
+ * grace window, and an approval it accepted must still be consumed.
+ *
+ * Keys come from signed approval fields, so re-encoding an envelope (hex,
+ * base64, bytes) does not make it fresh again.
+ */
+export declare function consumeApprovals(store: NonceStore | undefined, approvals: unknown, requestHash: string | undefined, tool: string, onNonceStoreError: ((error: unknown) => void | Promise<void>) | undefined): Promise<void>;
+export declare function snapshotApprovals(approvals: unknown): unknown;