@thenavidm/slipway 0.1.0

package/dist/policy.d.ts

@@ -0,0 +1,66 @@
+/**
+ * What a person running the server decides, read from the environment.
+ *
+ * The person who installs a server is not always the person who wrote it, and
+ * the switches that matter to them are the same on every server: hide writes,
+ * block the irreversible ones, keep a log, load fewer tools. They live under
+ * the server's own prefix, so two servers in one client never share a switch.
+ */
+import type { Risk, Tool } from "./tool.js";
+export type ToolSurface = "full" | "search";
+/**
+ * Who confirms a call that needs confirmation.
+ *
+ * - `human`: a person, wherever the client can ask one. Claude Code shows its
+ *   own approval prompt, other clients that support elicitation show an
+ *   approval form, and only a client that can do neither falls back to the
+ *   model passing `confirm: true`.
+ * - `model`: `confirm: true` from the model is enough. For a headless agent
+ *   with no person to ask.
+ */
+export type ConfirmMode = "human" | "model";
+export type Policy = {
+    readOnly: boolean;
+    allowDestructive: boolean;
+    auditLog?: string;
+    /** `all`, or the toolsets that are on. Tools with no tags are always on. */
+    toolsets: "all" | ReadonlySet<string>;
+    /** `search` replaces the tool list with three tools that find, describe and call the rest. */
+    surface: ToolSurface;
+    toolTimeoutMs?: number;
+    confirm: ConfirmMode;
+    /** Whether reads that opted in may answer from the local cache. */
+    cache: boolean;
+};
+export type PolicyDefaults = {
+    /**
+     * The toolsets on when `<PREFIX>_TOOLSETS` is unset. A function receives the
+     * environment, so a server can keep an older switch working, such as a
+     * `<PREFIX>_ENABLE_BETA=1` that predates toolsets.
+     */
+    toolsets?: readonly string[] | "all" | ((env: NodeJS.ProcessEnv) => readonly string[] | "all");
+    surface?: ToolSurface;
+    confirm?: ConfirmMode;
+};
+export type PolicyEnv = {
+    readOnly: string;
+    allowDestructive: string;
+    auditLog: string;
+    toolsets: string;
+    surface: string;
+    toolTimeoutMs: string;
+    confirm: string;
+    cache: string;
+    dataDir: string;
+};
+export declare function policyEnvNames(prefix: string): PolicyEnv;
+export declare function readPolicy(env: NodeJS.ProcessEnv, prefix: string, defaults?: PolicyDefaults): Policy;
+export type Visibility = {
+    visible: true;
+} | {
+    visible: false;
+    reason: "read-only" | "toolset";
+};
+/** Whether a tool is on under this policy, and if not, why, so a refusal can say how to turn it on. */
+export declare function visibility(tool: Pick<Tool, "risk" | "tags">, policy: Policy): Visibility;
+export declare function riskMark(risk: Risk): string;

package/dist/policy.js

@@ -0,0 +1,74 @@
+/**
+ * What a person running the server decides, read from the environment.
+ *
+ * The person who installs a server is not always the person who wrote it, and
+ * the switches that matter to them are the same on every server: hide writes,
+ * block the irreversible ones, keep a log, load fewer tools. They live under
+ * the server's own prefix, so two servers in one client never share a switch.
+ */
+export function policyEnvNames(prefix) {
+    return {
+        readOnly: `${prefix}_READ_ONLY`,
+        allowDestructive: `${prefix}_ALLOW_DESTRUCTIVE`,
+        auditLog: `${prefix}_AUDIT_LOG`,
+        toolsets: `${prefix}_TOOLSETS`,
+        surface: `${prefix}_SURFACE`,
+        toolTimeoutMs: `${prefix}_TOOL_TIMEOUT_MS`,
+        confirm: `${prefix}_CONFIRM`,
+        cache: `${prefix}_CACHE`,
+        dataDir: `${prefix}_DATA_DIR`,
+    };
+}
+const TRUE = /^(1|true|yes|on)$/i;
+const FALSE = /^(0|false|no|off)$/i;
+function flag(value, fallback) {
+    if (value === undefined || value.trim() === "")
+        return fallback;
+    if (TRUE.test(value.trim()))
+        return true;
+    if (FALSE.test(value.trim()))
+        return false;
+    return fallback;
+}
+export function readPolicy(env, prefix, defaults = {}) {
+    const names = policyEnvNames(prefix);
+    const rawToolsets = env[names.toolsets]?.trim();
+    const fromDefaults = (typeof defaults.toolsets === "function" ? defaults.toolsets(env) : defaults.toolsets) ?? "all";
+    const toolsets = rawToolsets === undefined || rawToolsets === ""
+        ? fromDefaults === "all"
+            ? "all"
+            : new Set(fromDefaults)
+        : rawToolsets.toLowerCase() === "all"
+            ? "all"
+            : new Set(rawToolsets
+                .split(",")
+                .map((part) => part.trim().toLowerCase())
+                .filter(Boolean));
+    const surface = env[names.surface]?.trim().toLowerCase();
+    const timeout = Number(env[names.toolTimeoutMs]);
+    const confirm = env[names.confirm]?.trim().toLowerCase();
+    return {
+        readOnly: flag(env[names.readOnly], false),
+        allowDestructive: flag(env[names.allowDestructive], true),
+        auditLog: env[names.auditLog]?.trim() || undefined,
+        toolsets,
+        surface: surface === "search" || surface === "full" ? surface : (defaults.surface ?? "full"),
+        toolTimeoutMs: Number.isFinite(timeout) && timeout > 0 ? timeout : undefined,
+        confirm: confirm === "human" || confirm === "model" ? confirm : (defaults.confirm ?? "human"),
+        cache: flag(env[names.cache], true),
+    };
+}
+/** Whether a tool is on under this policy, and if not, why, so a refusal can say how to turn it on. */
+export function visibility(tool, policy) {
+    if (policy.readOnly && tool.risk !== "read")
+        return { visible: false, reason: "read-only" };
+    if (policy.toolsets !== "all" && tool.tags.length > 0) {
+        const on = policy.toolsets;
+        if (!tool.tags.some((tag) => on.has(tag)))
+            return { visible: false, reason: "toolset" };
+    }
+    return { visible: true };
+}
+export function riskMark(risk) {
+    return risk === "read" ? " " : risk === "destructive" ? "!" : "*";
+}

package/dist/redact.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Keeps credentials out of everything a tool returns.
+ *
+ * An upstream API will happily echo a key back in an error message or a
+ * response body, and from there it lands in a model's context, a terminal
+ * scrollback or an audit log. Every result and every error on both surfaces
+ * passes through here, so a secret registered once is masked everywhere.
+ */
+export declare class Secrets {
+    private readonly values;
+    /** Register values that must never appear in output: keys, tokens, passwords. */
+    add(...values: Array<string | undefined | null>): void;
+    get size(): number;
+    redact(text: string): string;
+    /** Walk a value and mask registered secrets in strings and every credential-named field. */
+    redactDeep<T>(value: T): T;
+    private walk;
+}

package/dist/redact.js

@@ -0,0 +1,60 @@
+/**
+ * Keeps credentials out of everything a tool returns.
+ *
+ * An upstream API will happily echo a key back in an error message or a
+ * response body, and from there it lands in a model's context, a terminal
+ * scrollback or an audit log. Every result and every error on both surfaces
+ * passes through here, so a secret registered once is masked everywhere.
+ */
+const MASK = "[redacted]";
+/** Field names whose values are credentials whatever they contain. */
+const SECRET_KEYS = /^(authorization|proxy[-_]?authorization|cookie|set[-_]?cookie|password|passwd|secret|client[-_]?secret|api[-_]?key|apikey|access[-_]?token|refresh[-_]?token|id[-_]?token|token|private[-_]?key|session[-_]?token)$/i;
+/**
+ * Values shorter than this are not masked, because a short "secret" such as a
+ * default region code would turn every matching word in a response into noise.
+ */
+const MIN_LENGTH = 6;
+export class Secrets {
+    values = new Set();
+    /** Register values that must never appear in output: keys, tokens, passwords. */
+    add(...values) {
+        for (const value of values) {
+            if (typeof value === "string" && value.length >= MIN_LENGTH)
+                this.values.add(value);
+        }
+    }
+    get size() {
+        return this.values.size;
+    }
+    redact(text) {
+        let out = text;
+        // Longest first, so a secret that contains another is masked whole.
+        for (const value of [...this.values].sort((a, b) => b.length - a.length)) {
+            if (out.includes(value))
+                out = out.split(value).join(MASK);
+        }
+        return out;
+    }
+    /** Walk a value and mask registered secrets in strings and every credential-named field. */
+    redactDeep(value) {
+        return this.walk(value, new WeakSet());
+    }
+    walk(value, seen) {
+        if (typeof value === "string")
+            return this.redact(value);
+        if (value === null || typeof value !== "object")
+            return value;
+        if (value instanceof Uint8Array)
+            return value;
+        if (seen.has(value))
+            return "[circular]";
+        seen.add(value);
+        if (Array.isArray(value))
+            return value.map((item) => this.walk(item, seen));
+        const out = {};
+        for (const [key, inner] of Object.entries(value)) {
+            out[key] = SECRET_KEYS.test(key) && inner !== null && inner !== undefined && inner !== "" ? MASK : this.walk(inner, seen);
+        }
+        return out;
+    }
+}

package/dist/result.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Turning what a handler returns into what a client receives.
+ *
+ * A handler returns plain data. An object goes out twice: as compact JSON text,
+ * which every client can show a model, and as `structuredContent`, which a
+ * client can use without parsing text. Compact, because the reader of that text
+ * is usually a model paying for every character, not a person.
+ */
+import type { CallToolResult, ContentBlock } from "@modelcontextprotocol/server";
+import type { SlipwayError } from "./errors.js";
+import type { Secrets } from "./redact.js";
+import type { Tool } from "./tool.js";
+declare const CONTENT: unique symbol;
+/** A result that is already content blocks: images, audio, files, links, or several texts. */
+export type ContentResult = {
+    readonly [CONTENT]: true;
+    readonly parts: readonly ContentBlock[];
+    /** Typed data to send alongside, and to print in a terminal. */
+    readonly data?: unknown;
+};
+export declare function content(parts: ContentBlock | readonly ContentBlock[], data?: unknown): ContentResult;
+export declare function isContentResult(value: unknown): value is ContentResult;
+/** An image. Pass bytes, or a base64 string you already have. */
+export declare function image(data: Uint8Array | string, mimeType: string): ContentBlock;
+export declare function audio(data: Uint8Array | string, mimeType: string): ContentBlock;
+/** A file embedded in the result, for a client that saves or renders it. */
+export declare function file(data: Uint8Array | string, options: {
+    uri: string;
+    mimeType: string;
+}): ContentBlock;
+/** A pointer to something the client can fetch, without its bytes in the result. */
+export declare function resourceLink(uri: string, options: {
+    name: string;
+    title?: string;
+    description?: string;
+    mimeType?: string;
+}): ContentBlock;
+export declare function text(value: string): ContentBlock;
+export declare function isPlainObject(value: unknown): value is Record<string, unknown>;
+/** What a handler returned, as data: the value itself, or a content result's data. */
+export declare function dataOf(value: unknown): unknown;
+export declare function toCallToolResult(tool: Tool, value: unknown, secrets: Secrets): CallToolResult;
+export declare function errorResult(error: SlipwayError, secrets: Secrets): CallToolResult;
+export {};

package/dist/result.js

@@ -0,0 +1,74 @@
+/**
+ * Turning what a handler returns into what a client receives.
+ *
+ * A handler returns plain data. An object goes out twice: as compact JSON text,
+ * which every client can show a model, and as `structuredContent`, which a
+ * client can use without parsing text. Compact, because the reader of that text
+ * is usually a model paying for every character, not a person.
+ */
+const CONTENT = Symbol.for("slipway.content");
+export function content(parts, data) {
+    return { [CONTENT]: true, parts: Array.isArray(parts) ? [...parts] : [parts], data };
+}
+export function isContentResult(value) {
+    return value !== null && typeof value === "object" && value[CONTENT] === true;
+}
+function base64(data) {
+    return typeof data === "string" ? data : Buffer.from(data).toString("base64");
+}
+/** An image. Pass bytes, or a base64 string you already have. */
+export function image(data, mimeType) {
+    return { type: "image", data: base64(data), mimeType };
+}
+export function audio(data, mimeType) {
+    return { type: "audio", data: base64(data), mimeType };
+}
+/** A file embedded in the result, for a client that saves or renders it. */
+export function file(data, options) {
+    return { type: "resource", resource: { uri: options.uri, mimeType: options.mimeType, blob: base64(data) } };
+}
+/** A pointer to something the client can fetch, without its bytes in the result. */
+export function resourceLink(uri, options) {
+    return { type: "resource_link", uri, ...options };
+}
+export function text(value) {
+    return { type: "text", text: value };
+}
+export function isPlainObject(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/** What a handler returned, as data: the value itself, or a content result's data. */
+export function dataOf(value) {
+    return isContentResult(value) ? value.data : value;
+}
+export function toCallToolResult(tool, value, secrets) {
+    if (isContentResult(value)) {
+        const parts = value.parts.map((part) => part.type === "text" ? { ...part, text: secrets.redact(part.text) } : part);
+        const data = secrets.redactDeep(value.data);
+        const structured = data !== undefined && (isPlainObject(data) || tool.output !== undefined);
+        return structured ? { content: parts, structuredContent: data } : { content: parts };
+    }
+    const data = secrets.redactDeep(value);
+    if (data === undefined || data === null) {
+        return { content: [text("Done.")] };
+    }
+    const rendered = tool.render ? secrets.redact(tool.render(data)) : undefined;
+    if (typeof data === "string") {
+        return tool.output
+            ? { content: [text(rendered ?? data)], structuredContent: data }
+            : { content: [text(rendered ?? data)] };
+    }
+    const body = rendered ?? (typeof data === "object" ? JSON.stringify(data) : String(data));
+    // An object is always typed data. Anything else only is when the tool declares
+    // an output schema, because the protocol needs a schema to describe it.
+    if (isPlainObject(data) || tool.output !== undefined) {
+        return { content: [text(body)], structuredContent: data };
+    }
+    return { content: [text(body)] };
+}
+export function errorResult(error, secrets) {
+    return { isError: true, content: [text(secrets.redact(JSON.stringify(secrets.redactDeep(error.toJSON()))))] };
+}

package/dist/rpc.d.ts

@@ -0,0 +1,69 @@
+/**
+ * A minimal MCP client over an in-memory pair, for checks and tests.
+ *
+ * It speaks raw JSON-RPC rather than wrapping a full client library, which
+ * keeps the client package out of every server's install and shows exactly
+ * what a client receives on the wire. The server side is the same stdio entry
+ * the binary runs, so both protocol eras are served exactly as a real client
+ * reaches them: the 2025 handshake, and the 2026-07-28 revision where every
+ * request carries the client's details and a call can come back asking for
+ * input before it finishes.
+ */
+import { type CallToolResult } from "@modelcontextprotocol/server";
+import type { App } from "./app.js";
+export type ListedTool = {
+    name: string;
+    title?: string;
+    description?: string;
+    inputSchema: Record<string, unknown>;
+    outputSchema?: Record<string, unknown>;
+    annotations?: Record<string, unknown>;
+    icons?: unknown[];
+    _meta?: Record<string, unknown>;
+};
+export type InitializeResult = {
+    protocolVersion: string;
+    serverInfo: {
+        name: string;
+        version: string;
+        title?: string;
+    };
+    capabilities: Record<string, unknown>;
+    instructions?: string;
+};
+/** What a server asks a person through the client: a message and the fields of a form. */
+export type ElicitRequest = {
+    message: string;
+    requestedSchema?: Record<string, unknown>;
+    mode?: string;
+};
+export type ElicitAnswer = {
+    action: "accept" | "decline" | "cancel";
+    content?: Record<string, unknown>;
+};
+export type ConnectOptions = {
+    /** `legacy` opens with the 2025 handshake, `modern` with the 2026-07-28 revision. */
+    era?: "legacy" | "modern";
+    /** Who the client says it is. Some behavior depends on it: Claude Code prompts for confirmed tools itself. */
+    clientInfo?: {
+        name: string;
+        version: string;
+    };
+    /**
+     * Answer the server's approval forms and other questions, as a person would.
+     * Setting it declares that the client can ask a person.
+     */
+    elicit?: (request: ElicitRequest) => ElicitAnswer | Promise<ElicitAnswer>;
+};
+export type RpcClient = {
+    era: "legacy" | "modern";
+    initialize: InitializeResult;
+    /** A request, answered and retried for as long as the server asks for input, the way a client does. */
+    request(method: string, params?: Record<string, unknown>): Promise<unknown>;
+    /** One request and the server's first answer, with no retry: for testing what the protocol carries. */
+    send(method: string, params?: Record<string, unknown>): Promise<unknown>;
+    listTools(): Promise<ListedTool[]>;
+    callTool(name: string, args?: Record<string, unknown>): Promise<CallToolResult>;
+    close(): Promise<void>;
+};
+export declare function connectInMemory(app: App, env?: NodeJS.ProcessEnv, options?: ConnectOptions): Promise<RpcClient>;

package/dist/rpc.js

@@ -0,0 +1,120 @@
+/**
+ * A minimal MCP client over an in-memory pair, for checks and tests.
+ *
+ * It speaks raw JSON-RPC rather than wrapping a full client library, which
+ * keeps the client package out of every server's install and shows exactly
+ * what a client receives on the wire. The server side is the same stdio entry
+ * the binary runs, so both protocol eras are served exactly as a real client
+ * reaches them: the 2025 handshake, and the 2026-07-28 revision where every
+ * request carries the client's details and a call can come back asking for
+ * input before it finishes.
+ */
+import { InMemoryTransport } from "@modelcontextprotocol/server";
+import { serveStdio } from "@modelcontextprotocol/server/stdio";
+const MODERN = "2026-07-28";
+const LEGACY = "2025-11-25";
+const KEY = {
+    protocolVersion: "io.modelcontextprotocol/protocolVersion",
+    clientInfo: "io.modelcontextprotocol/clientInfo",
+    clientCapabilities: "io.modelcontextprotocol/clientCapabilities",
+    serverInfo: "io.modelcontextprotocol/serverInfo",
+};
+/** How many times one call may come back asking for input before the client gives up, as the SDK's own client does. */
+const MAX_ROUNDS = 8;
+export async function connectInMemory(app, env = process.env, options = {}) {
+    const era = options.era ?? "legacy";
+    const clientInfo = options.clientInfo ?? { name: "slipway-check", version: "0" };
+    const capabilities = options.elicit ? { elicitation: { form: {} } } : {};
+    const [clientSide, serverSide] = InMemoryTransport.createLinkedPair();
+    const handle = serveStdio(() => app.createServer(env), { transport: serverSide });
+    let nextId = 0;
+    const pending = new Map();
+    /** What this client answers when the server asks it something, in either era. */
+    const answer = async (method, params) => {
+        if (method === "elicitation/create" && options.elicit)
+            return options.elicit(params);
+        if (method === "ping")
+            return {};
+        if (method === "roots/list")
+            return { roots: [] };
+        throw Object.assign(new Error(`This client does not answer ${method}.`), { code: -32601 });
+    };
+    clientSide.onmessage = (raw) => {
+        const message = raw;
+        if (message.method !== undefined) {
+            // A request from the server, which only the 2025 handshake sends this way.
+            if (message.id === undefined)
+                return;
+            const id = message.id;
+            void answer(message.method, message.params).then((result) => clientSide.send({ jsonrpc: "2.0", id, result: result }), (error) => clientSide.send({ jsonrpc: "2.0", id, error: { code: error.code ?? -32603, message: error.message } }));
+            return;
+        }
+        if (message.id === undefined || !pending.has(message.id))
+            return;
+        const waiter = pending.get(message.id);
+        pending.delete(message.id);
+        if (message.error)
+            waiter.reject(Object.assign(new Error(message.error.message), { code: message.error.code }));
+        else
+            waiter.resolve(message.result);
+    };
+    await clientSide.start();
+    const envelope = { [KEY.protocolVersion]: MODERN, [KEY.clientInfo]: clientInfo, [KEY.clientCapabilities]: capabilities };
+    const send = (method, params = {}) => new Promise((resolve, reject) => {
+        const id = ++nextId;
+        pending.set(id, { resolve, reject });
+        const body = era === "modern" ? { ...params, _meta: { ...(params._meta ?? {}), ...envelope } } : params;
+        void clientSide.send({ jsonrpc: "2.0", id, method, params: body });
+    });
+    /** A request, retried with answers for as long as the server comes back asking for input. */
+    const request = async (method, params = {}) => {
+        let result = (await send(method, params));
+        for (let round = 0; result?.resultType === "input_required"; round++) {
+            if (round >= MAX_ROUNDS)
+                throw new Error(`${method} still asked for input after ${MAX_ROUNDS} rounds.`);
+            const inputResponses = {};
+            for (const [key, entry] of Object.entries(result.inputRequests ?? {})) {
+                inputResponses[key] = await answer(entry.method, entry.params);
+            }
+            result = (await send(method, { ...params, inputResponses, ...(result.requestState === undefined ? {} : { requestState: result.requestState }) }));
+        }
+        return result;
+    };
+    let initialize;
+    if (era === "modern") {
+        const found = (await send("server/discover"));
+        initialize = {
+            protocolVersion: MODERN,
+            serverInfo: found._meta?.[KEY.serverInfo] ?? { name: "", version: "" },
+            capabilities: found.capabilities ?? {},
+            ...(found.instructions === undefined ? {} : { instructions: found.instructions }),
+        };
+    }
+    else {
+        initialize = (await send("initialize", { protocolVersion: LEGACY, capabilities, clientInfo }));
+        await clientSide.send({ jsonrpc: "2.0", method: "notifications/initialized" });
+    }
+    return {
+        era,
+        initialize,
+        request,
+        send,
+        async listTools() {
+            const tools = [];
+            let cursor;
+            do {
+                const page = (await request("tools/list", cursor ? { cursor } : {}));
+                tools.push(...page.tools);
+                cursor = page.nextCursor;
+            } while (cursor);
+            return tools;
+        },
+        async callTool(name, args = {}) {
+            return (await request("tools/call", { name, arguments: args }));
+        },
+        async close() {
+            await handle.close();
+            await clientSide.close().catch(() => undefined);
+        },
+    };
+}

package/dist/schema.d.ts

@@ -0,0 +1,99 @@
+/**
+ * One schema interface for every tool, whatever wrote it.
+ *
+ * A hand-written tool uses Zod. A tool generated from an API contract uses the
+ * contract's JSON Schema. Both become a Standard Schema object here, which is
+ * what the MCP SDK validates and advertises, and what the CLI derives its
+ * flags from. Because both surfaces read the same object, an argument one
+ * accepts the other accepts too.
+ */
+import { type StandardSchemaWithJSON } from "@modelcontextprotocol/server";
+export type JsonSchema = Record<string, unknown>;
+export type Schema<Input = unknown, Output = Input> = StandardSchemaWithJSON<Input, Output>;
+/** What the Standard Schema spec says a schema declares about its own types. */
+type Types<S> = S extends {
+    readonly "~standard": {
+        readonly types?: infer T;
+    };
+} ? NonNullable<T> : never;
+/** What a caller passes. */
+export type InferInput<S> = Types<S> extends {
+    readonly input: infer I;
+} ? I : Record<string, unknown>;
+/** What a handler receives, after defaults and transforms. */
+export type InferOutput<S> = Types<S> extends {
+    readonly output: infer O;
+} ? O : Record<string, unknown>;
+export type Issue = {
+    path: string;
+    message: string;
+};
+/**
+ * Wrap a raw JSON Schema so it validates and converts like a Zod schema.
+ *
+ * This is how a tool generated from an OpenAPI document or a pinned contract
+ * joins the same tool list as hand-written ones.
+ */
+export declare function jsonSchema<T = Record<string, unknown>>(schema: JsonSchema): Schema<T, T>;
+/** The input of a tool that takes nothing. */
+export declare function emptyInput(): Schema<Record<string, never>>;
+export declare function isSchema(value: unknown): value is Schema;
+/** The JSON Schema an MCP client receives for this input. */
+export declare function inputJsonSchema(schema: Schema): JsonSchema;
+export declare function outputJsonSchema(schema: Schema): JsonSchema;
+/** Validate with the schema's own validator, sync or async, and flatten the issues. */
+export declare function validate<T>(schema: Schema<unknown, T>, value: unknown): Promise<{
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    issues: Issue[];
+}>;
+export declare function formatIssues(issues: Issue[]): string;
+/** Arguments Slipway adds to a tool's input. They never reach the tool author's schema or handler. */
+export type Controls = {
+    confirm?: boolean;
+    wait_seconds?: number;
+};
+/** The names Slipway adds, which a tool's own input may not use. */
+export declare const CONTROL_NAMES: readonly ["confirm", "wait_seconds"];
+/**
+ * Short on purpose: it is repeated in every confirmed tool a client lists.
+ * What the effect is lives in the tool's own description and annotations.
+ */
+export declare const CONFIRM_DESCRIPTION = "Set true only when the user asked for exactly this action.";
+/** The schema already carries the range and the default, so the words only say what the number is for. */
+export declare const WAIT_DESCRIPTION = "Seconds to wait for the job to finish before returning it to check later.";
+/**
+ * A schema as clients receive it, without the `$schema` line that names its
+ * dialect. A client reads JSON Schema 2020-12 when no dialect is named, so
+ * the line only adds bytes to every tool in every listing.
+ */
+export declare function advertised<I, O>(schema: Schema<I, O>): Schema<I, O>;
+/**
+ * Add Slipway's own arguments to any schema: `confirm` for a tool that needs
+ * confirming, `wait_seconds` for a job.
+ *
+ * Validation takes them out before the author's schema sees the rest and puts
+ * them back afterwards, so a strict contract schema with
+ * `additionalProperties: false` still accepts them, and the author never
+ * declares them by hand.
+ */
+export declare function withControls<I, O>(schema: Schema<I, O>, controls: {
+    confirm: boolean;
+    wait?: {
+        defaultSeconds: number;
+        maxSeconds: number;
+    };
+}): Schema<I & Controls, O & Controls>;
+/** Serialized size of a schema, the number that decides what a client pays to load the tool. */
+export declare function schemaBytes(schema: JsonSchema): number;
+/**
+ * Find `$defs` blocks that repeat inside one schema.
+ *
+ * A generator that inlines a referenced body and also keeps it under `$defs`
+ * ships the same definitions twice; a schema of a few hundred kilobytes is
+ * often half repetition.
+ */
+export declare function repeatedDefinitions(schema: JsonSchema): string[];
+export {};