@vitest-agent/engine 0.1.0

package/programs/record-workspace-changes.js

@@ -0,0 +1,57 @@
+import { DataStore } from "../services/DataStore.js";
+import { Effect } from "effect";
+import { SqlClient } from "effect/unstable/sql/SqlClient";
+
+//#region src/programs/record-workspace-changes.ts
+/**
+* `ProjectRunSummary` doesn't expose `lastRunId`, so we query it directly
+* via SqlClient. This is the run id of the most-recent test run for a
+* given project (or any project, when `project` is unspecified). Used
+* only as a best-effort association target for `run_changed_files`.
+*/
+const findLatestRunId = (project) => Effect.gen(function* () {
+	const sql = yield* SqlClient;
+	const rows = project !== void 0 ? yield* sql`
+						SELECT id FROM test_runs
+						WHERE project = ${project}
+						ORDER BY timestamp DESC LIMIT 1
+					` : yield* sql`
+						SELECT id FROM test_runs
+						ORDER BY timestamp DESC LIMIT 1
+					`;
+	return rows.length === 0 ? null : rows[0].id;
+}).pipe(Effect.orElseSucceed(() => null));
+/**
+* Record a commit and, best-effort, associate its changed files with the
+* most recent test run for the project.
+*
+* @param input - the commit and its changed files
+* @public
+*/
+const recordRunWorkspaceChangesEffect = (input) => Effect.gen(function* () {
+	const store = yield* DataStore;
+	yield* store.writeCommit({
+		sha: input.sha,
+		...input.parentSha !== void 0 && { parentSha: input.parentSha },
+		...input.message !== void 0 && { message: input.message },
+		...input.author !== void 0 && { author: input.author },
+		...input.committedAt !== void 0 && { committedAt: input.committedAt },
+		...input.branch !== void 0 && { branch: input.branch }
+	});
+	const runId = yield* findLatestRunId(input.project);
+	if (runId !== null && input.files.length > 0) yield* store.writeRunChangedFiles({
+		runId,
+		files: input.files.map((f) => ({
+			filePath: f.filePath,
+			changeKind: f.changeKind,
+			commitSha: input.sha
+		}))
+	});
+	return {
+		sha: input.sha,
+		fileRowsWritten: runId !== null ? input.files.length : 0
+	};
+});
+
+//#endregion
+export { recordRunWorkspaceChangesEffect };

package/programs/register-agent.js

@@ -0,0 +1,85 @@
+import { DataReader } from "../services/DataReader.js";
+import { DataStore } from "../services/DataStore.js";
+import { PerClientSessionMapWriter } from "../services/PerClientSessionMap.js";
+import { RunContextService } from "../services/RunContext.js";
+import { deriveIdempotencyKey } from "../services/idempotency.js";
+import { Effect, Option } from "effect";
+
+//#region src/programs/register-agent.ts
+const deriveDefaultClientNonce = (input) => {
+	const parent = input.parentAgentId ?? "__ROOT__";
+	return `${input.hostSessionId}|${input.agentType}|${parent}`;
+};
+/**
+* End-to-end agent registration.
+*
+* Returns the canonical `agentId` + the conversation it belongs to +
+* the resolved `idempotencyKey`. The `idempotencyHit` flag is `true`
+* when the per-project store recovered an existing agent row instead
+* of inserting a new one.
+*
+* @param input - registration inputs including host identifiers and agent metadata
+* @returns an Effect resolving to `RegisterAgentProgramOutput`
+* @public
+*/
+const registerAgentEffect = (input) => Effect.gen(function* () {
+	const sessionMap = yield* PerClientSessionMapWriter;
+	const reader = yield* DataReader;
+	const store = yield* DataStore;
+	const ctx = yield* RunContextService;
+	const conversationId = yield* sessionMap.mapConversation(input.transcriptPath);
+	const sessionMapping = yield* sessionMap.mapSession({
+		hostSessionId: input.hostSessionId,
+		conversationId,
+		projectKey: input.projectKey,
+		projectDir: input.cwd
+	});
+	const existingSession = yield* reader.getSessionByChatId(input.hostSessionId);
+	const sessionRowId = yield* Option.match(existingSession, {
+		onNone: () => store.writeSession({
+			chatId: input.hostSessionId,
+			project: input.projectKey,
+			cwd: input.cwd,
+			agentKind: input.parentAgentId === void 0 ? "main" : "subagent",
+			agentType: input.agentType,
+			triageWasNonEmpty: false,
+			startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			conversationId
+		}),
+		onSome: (s) => Effect.succeed(s.id)
+	});
+	yield* store.setSessionConversationIdIfNull({
+		sessionId: sessionRowId,
+		conversationId
+	});
+	const agentContext = yield* ctx.captureAgentContext(input.cwd);
+	const clientNonce = input.clientNonce ?? deriveDefaultClientNonce(input);
+	const idempotencyKey = deriveIdempotencyKey({
+		agentType: input.agentType,
+		parentAgentId: input.parentAgentId ?? null,
+		clientNonce
+	});
+	const result = yield* store.registerAgent({
+		sessionId: sessionRowId,
+		agentType: input.agentType,
+		parentAgentId: input.parentAgentId ?? null,
+		conversationId,
+		startedAt: Math.floor(Date.now() / 1e3),
+		...agentContext.startGitBranch !== null && { startGitBranch: agentContext.startGitBranch },
+		...agentContext.startGitCommitSha !== null && { startGitCommitSha: agentContext.startGitCommitSha },
+		...agentContext.startWorktreeDir !== null && { startWorktreeDir: agentContext.startWorktreeDir },
+		idempotencyKey,
+		agentId: sessionMapping.mainAgentId
+	});
+	const isHit = result._tag === "IdempotencyHit";
+	return {
+		agentId: isHit ? result.existingAgentId : result.agentId,
+		conversationId,
+		mainAgentId: sessionMapping.mainAgentId,
+		idempotencyKey,
+		idempotencyHit: isHit
+	};
+});
+
+//#endregion
+export { registerAgentEffect };

package/programs/resolve-session-for-recording.js

@@ -0,0 +1,44 @@
+import { DataReader } from "../services/DataReader.js";
+import { DataStore } from "../services/DataStore.js";
+import { Effect, FileSystem, Option } from "effect";
+
+//#region src/programs/resolve-session-for-recording.ts
+/**
+* Resolve the `sessions` row for a hook-delivered chat id: exact match,
+* then the synthetic `-subagent-` prefix, then an idempotent bootstrap of
+* a `main` row so recording never fails with "Unknown chat_id".
+*
+* @param input - the chat id and ambient bootstrap inputs
+* @returns the resolved (or newly created) session row
+* @public
+*/
+const resolveSessionForRecording = (input) => Effect.gen(function* () {
+	const reader = yield* DataReader;
+	const store = yield* DataStore;
+	const fs = yield* FileSystem.FileSystem;
+	const exact = yield* reader.getSessionByChatId(input.chatId);
+	if (Option.isSome(exact)) return exact.value;
+	const synthetic = yield* reader.findSessionsByChatPrefix(`${input.chatId}-subagent-`);
+	if (synthetic.length > 0) return synthetic[0];
+	const cwd = input.cwd;
+	const project = input.project ?? (yield* readPackageName(fs, cwd)) ?? "unknown";
+	yield* store.upsertSession({
+		chatId: input.chatId,
+		project,
+		cwd,
+		agentKind: "main",
+		triageWasNonEmpty: false,
+		startedAt: input.recordedAt
+	});
+	const created = yield* reader.getSessionByChatId(input.chatId);
+	return Option.getOrThrowWith(created, () => /* @__PURE__ */ new Error(`upsertSession succeeded but row not found for ${input.chatId}`));
+});
+/**
+* Best-effort `package.json#name` read through the injected `FileSystem`.
+* Any read or parse failure resolves to `undefined` — the caller falls
+* back to `"unknown"`, exactly as the former sync `readFileSync` probe did.
+*/
+const readPackageName = (fs, cwd) => fs.readFileString(`${cwd}/package.json`).pipe(Effect.flatMap((raw) => Effect.try(() => JSON.parse(raw))), Effect.map((parsed) => typeof parsed.name === "string" ? parsed.name : void 0), Effect.catch(() => Effect.succeed(void 0)));
+
+//#endregion
+export { resolveSessionForRecording };

package/programs/session-env.js

@@ -0,0 +1,85 @@
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+//#region src/programs/session-env.ts
+const EXPORT_LINE = /^export ([A-Z_][A-Z0-9_]*)=(.*)$/;
+/**
+* Undo the `printf '%q'` quoting the SessionStart hook applies to export
+* values. UUIDs and plain paths arrive bare; values with specials arrive
+* as `$'...'`, `'...'`, `"..."`, or backslash-escaped words.
+*/
+const unquote = (raw) => {
+	let v = raw.trim();
+	if (v.startsWith("$'") && v.endsWith("'") && v.length >= 3) v = v.slice(2, -1);
+	else if (v.startsWith("'") && v.endsWith("'") || v.startsWith("\"") && v.endsWith("\"")) {
+		if (v.length >= 2) v = v.slice(1, -1);
+	}
+	return v.replace(/\\(.)/g, "$1");
+};
+/**
+* Parse `export KEY=value` lines from a session-env hook file into a
+* plain record. Non-export lines are ignored.
+*
+* @param content - the raw text of a session-env hook file
+* @returns a record of export names to unquoted values
+* @public
+*/
+const parseSessionEnvExports = (content) => {
+	const out = {};
+	for (const line of content.split("\n")) {
+		const m = EXPORT_LINE.exec(line.trim());
+		if (m?.[1] !== void 0 && m[2] !== void 0) out[m[1]] = unquote(m[2]);
+	}
+	return out;
+};
+/**
+* Recover a {@link SessionContext} from the newest session-env hook file
+* whose `VITEST_AGENT_PROJECT_DIR` matches `projectDir`.
+*
+* Returns `null` when the session-env root is missing, unreadable, or no
+* session dir matches the project. Never throws — recovery is best-effort
+* and callers fall back to their existing null-context behavior.
+*
+* Synchronous by contract: the MCP server calls it from the lazy
+* `SessionContextRef.get()` recover thunk, which is itself synchronous.
+*
+* @param opts - `projectDir` to match against; `homeDir` is the caller's
+*   home directory (ambient input — the MCP bin passes `os.homedir()`),
+*   under which `.claude/session-env` is read
+* @public
+*/
+const recoverSessionContextFromSessionEnv = (opts) => {
+	const root = join(opts.homeDir, ".claude", "session-env");
+	const wantDir = resolve(opts.projectDir);
+	let entries;
+	try {
+		entries = readdirSync(root);
+	} catch {
+		return null;
+	}
+	let best = null;
+	for (const entry of entries) {
+		const file = join(root, entry, "vitest-agent-hook.sh");
+		try {
+			const st = statSync(file);
+			const env = parseSessionEnvExports(readFileSync(file, "utf8"));
+			const chatId = env.VITEST_AGENT_CHAT_ID;
+			const conversationId = env.VITEST_AGENT_CONVERSATION_ID;
+			const mainAgentId = env.VITEST_AGENT_MAIN_AGENT_ID ?? env.VITEST_AGENT_AGENT_ID;
+			const fileProjectDir = env.VITEST_AGENT_PROJECT_DIR;
+			if (chatId === void 0 || chatId.length === 0 || conversationId === void 0 || conversationId.length === 0 || mainAgentId === void 0 || mainAgentId.length === 0 || fileProjectDir === void 0 || resolve(fileProjectDir) !== wantDir) continue;
+			if (best === null || st.mtimeMs > best.mtimeMs) best = {
+				mtimeMs: st.mtimeMs,
+				ctx: {
+					chatId,
+					conversationId,
+					mainAgentId
+				}
+			};
+		} catch {}
+	}
+	return best === null ? null : best.ctx;
+};
+
+//#endregion
+export { parseSessionEnvExports, recoverSessionContextFromSessionEnv };

package/project-dir.js

@@ -0,0 +1,32 @@
+//#region src/project-dir.ts
+/**
+* Environment variables that may override the project directory, in
+* precedence order (highest first).
+*/
+const PROJECT_DIR_ENV_KEYS = [
+	"VITEST_AGENT_PROJECT_DIR",
+	"VITEST_AGENT_REPORTER_PROJECT_DIR",
+	"CLAUDE_PROJECT_DIR"
+];
+/**
+* Resolve the project directory the front ends anchor on.
+*
+* Precedence: `VITEST_AGENT_PROJECT_DIR` (hook-driven override), then
+* `VITEST_AGENT_REPORTER_PROJECT_DIR` (the plugin-spawned MCP server's
+* hand-off), then `CLAUDE_PROJECT_DIR` (Claude Code's own convention),
+* then `cwd`. An empty string counts as unset. Pure: both the env map and
+* the working directory are injected by the caller.
+*
+* @param input - the env map and the fallback working directory
+* @public
+*/
+const resolveProjectDir = (input) => {
+	for (const key of PROJECT_DIR_ENV_KEYS) {
+		const value = input.env[key];
+		if (value !== void 0 && value !== "") return value;
+	}
+	return input.cwd;
+};
+
+//#endregion
+export { resolveProjectDir };

package/services/Config.js

@@ -0,0 +1,15 @@
+import { ConfigFile } from "@effected/config-file";
+
+//#region src/services/Config.ts
+/**
+* Typed service class (Context tag) for the vitest-agent config file service.
+*
+* Both runtime packages (reporter, MCP) yield this tag to access the loaded
+* `VitestAgentConfig`. The live layer is built per `projectDir` via
+* `ConfigLive(projectDir)`.
+* @public
+*/
+var VitestAgentConfigFile = class extends ConfigFile.Service()("vitest-agent/Config") {};
+
+//#endregion
+export { VitestAgentConfigFile };

package/services/DataReader.js

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+
+//#region src/services/DataReader.ts
+/** @public */
+var DataReader = class extends Context.Service()("vitest-agent/DataReader") {};
+
+//#endregion
+export { DataReader };

package/services/DataStore.js

@@ -0,0 +1,15 @@
+import { Context } from "effect";
+
+//#region src/services/DataStore.ts
+/**
+* Ceiling on an inline attachment body. Vitest has already copied file
+* attachments into `.vitest/attachments/`, so a large body is referenced
+* by `path` rather than duplicated into `data.db`.
+* @public
+*/
+const INLINE_ATTACHMENT_BODY_CAP_BYTES = 65536;
+/** @public */
+var DataStore = class extends Context.Service()("vitest-agent/DataStore") {};
+
+//#endregion
+export { DataStore, INLINE_ATTACHMENT_BODY_CAP_BYTES };

package/services/DetailResolver.js

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+
+//#region src/services/DetailResolver.ts
+/** @public */
+var DetailResolver = class extends Context.Service()("vitest-agent/DetailResolver") {};
+
+//#endregion
+export { DetailResolver };

package/services/DiscoveryRegistry.js

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+
+//#region src/services/DiscoveryRegistry.ts
+/** @public */
+var DiscoveryRegistry = class extends Context.Service()("vitest-agent/DiscoveryRegistry") {};
+
+//#endregion
+export { DiscoveryRegistry };

package/services/EnvironmentDetector.js

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+
+//#region src/services/EnvironmentDetector.ts
+/** @public */
+var EnvironmentDetector = class extends Context.Service()("vitest-agent/EnvironmentDetector") {};
+
+//#endregion
+export { EnvironmentDetector };

package/services/ExecutorResolver.js

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+
+//#region src/services/ExecutorResolver.ts
+/** @public */
+var ExecutorResolver = class extends Context.Service()("vitest-agent/ExecutorResolver") {};
+
+//#endregion
+export { ExecutorResolver };

package/services/FormatSelector.js

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+
+//#region src/services/FormatSelector.ts
+/** @public */
+var FormatSelector = class extends Context.Service()("vitest-agent/FormatSelector") {};
+
+//#endregion
+export { FormatSelector };

package/services/HistoryTracker.js

@@ -0,0 +1,20 @@
+import { Context } from "effect";
+
+//#region src/services/HistoryTracker.ts
+/**
+* Builds the composite (modulePath, fullName) key used to key the internal
+* testMap and the returned classifications Map, so identically-named tests
+* in different files classify independently instead of colliding.
+*
+* Uses `JSON.stringify` for an injective encoding: a plain delimiter such as
+* a space is not collision-proof (e.g. `("a b", "c")` and `("a", "b c")` would
+* both yield `"a b c"`), which would reintroduce the very collision class this
+* key exists to prevent.
+* @public
+*/
+const historyKey = (modulePath, fullName) => JSON.stringify([modulePath, fullName]);
+/** @public */
+var HistoryTracker = class extends Context.Service()("vitest-agent/HistoryTracker") {};
+
+//#endregion
+export { HistoryTracker, historyKey };

package/services/OutputRenderer.js

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+
+//#region src/services/OutputRenderer.ts
+/** @public */
+var OutputRenderer = class extends Context.Service()("vitest-agent/OutputRenderer") {};
+
+//#endregion
+export { OutputRenderer };

package/services/PerClientSessionMap.js

@@ -0,0 +1,22 @@
+import { Context } from "effect";
+
+//#region src/services/PerClientSessionMap.ts
+/**
+* Read-only side of the session map.
+*
+* Provided by `PerClientSessionMapReaderLive` (opens SQLite with
+* `?mode=ro`). MCP server depends on this tag — calls to write
+* methods would be a type error.
+* @public
+*/
+var PerClientSessionMapReader = class extends Context.Service()("vitest-agent/PerClientSessionMapReader") {};
+/**
+* Read-write side of the session map. Sidecar provides this; the
+* Writer layer also satisfies the Reader tag so consumers of either
+* one resolve.
+* @public
+*/
+var PerClientSessionMapWriter = class extends Context.Service()("vitest-agent/PerClientSessionMapWriter") {};
+
+//#endregion
+export { PerClientSessionMapReader, PerClientSessionMapWriter };

package/services/ProjectDiscovery.js

@@ -0,0 +1,8 @@
+import { Context } from "effect";
+
+//#region src/services/ProjectDiscovery.ts
+/** @public */
+var ProjectDiscovery = class extends Context.Service()("vitest-agent/ProjectDiscovery") {};
+
+//#endregion
+export { ProjectDiscovery };

package/services/ProjectIdentity.js

@@ -0,0 +1,62 @@
+import { canonicalizeGitUrl, gitUrlToProjectKey, normalizeWorkspaceKey } from "@vitest-agent/sdk";
+import { Context } from "effect";
+
+//#region src/services/ProjectIdentity.ts
+const isUseful = (value) => value !== void 0 && value.trim().length > 0;
+/**
+* Pure priority resolver. Returns `null` when no candidate produces a
+* usable value — the caller wraps `null` into a tagged error.
+*
+* For non-git sources the `canonicalForm` equals the original
+* (un-normalized) input so the discovery registry can display
+* `@spencerbeggs/vitest-agent` rather than the underscored form. For
+* git sources, `canonicalForm` is the slash-preserving `host/path`
+* shape from `canonicalizeGitUrl`.
+* @public
+*/
+const resolveProjectIdentityFromCandidates = (candidates) => {
+	if (isUseful(candidates.explicit)) return {
+		projectKey: normalizeWorkspaceKey(candidates.explicit),
+		canonicalForm: candidates.explicit,
+		source: "explicit"
+	};
+	if (isUseful(candidates.toml)) return {
+		projectKey: normalizeWorkspaceKey(candidates.toml),
+		canonicalForm: candidates.toml,
+		source: "toml"
+	};
+	if (isUseful(candidates.gitRemote)) {
+		const canonical = canonicalizeGitUrl(candidates.gitRemote);
+		const key = gitUrlToProjectKey(candidates.gitRemote);
+		if (canonical !== null && key !== null) return {
+			projectKey: key,
+			canonicalForm: canonical,
+			source: "git-remote"
+		};
+	}
+	if (isUseful(candidates.packageJsonRepoUrl)) {
+		const canonical = canonicalizeGitUrl(candidates.packageJsonRepoUrl);
+		const key = gitUrlToProjectKey(candidates.packageJsonRepoUrl);
+		if (canonical !== null && key !== null) return {
+			projectKey: key,
+			canonicalForm: canonical,
+			source: "package-repository"
+		};
+	}
+	if (isUseful(candidates.packageJsonName)) return {
+		projectKey: normalizeWorkspaceKey(candidates.packageJsonName),
+		canonicalForm: candidates.packageJsonName,
+		source: "package-name"
+	};
+	return null;
+};
+/**
+* Service tag. The Live layer (in `layers/ProjectIdentityLive.ts`)
+* wires up the I/O sources; tests provide a stub that returns a
+* pre-built `ResolvedIdentity`.
+* @public
+*/
+var ProjectIdentity = class extends Context.Service()("vitest-agent/ProjectIdentity") {};
+
+//#endregion
+export { ProjectIdentity, resolveProjectIdentityFromCandidates };

package/services/RunContext.js

@@ -0,0 +1,53 @@
+import { Context, Schema } from "effect";
+
+//#region src/services/RunContext.ts
+/**
+* Per-run snapshot of the workspace's git state and host context.
+* Every field is nullable: a non-git workspace has all-NULL git
+* fields, a CI run with no terminal probe match has all-NULL host
+* fields, and a worker that can't read upstream info has a NULL
+* `gitUpstream` while everything else is set.
+*
+* Declared as a `Schema.Class` so callers can `new RunContext({...})`
+* and `Schema.encode(...)` for the SQLite row mapping.
+* @public
+*/
+var RunContext = class extends Schema.Class("vitest-agent/RunContext")({
+	gitBranch: Schema.NullOr(Schema.String),
+	gitCommitSha: Schema.NullOr(Schema.String),
+	gitDirty: Schema.NullOr(Schema.Boolean),
+	gitUpstream: Schema.NullOr(Schema.String),
+	gitWorktreeDir: Schema.NullOr(Schema.String),
+	hostSource: Schema.NullOr(Schema.String),
+	hostValue: Schema.NullOr(Schema.String),
+	hostMetadata: Schema.NullOr(Schema.Unknown)
+}) {};
+/**
+* Subset of {@link RunContext} captured at agent registration. Only
+* the inheritable git context — branch, sha, worktree path. Mid-run
+* dirty-tree state and upstream tracking are per-run concerns.
+* @public
+*/
+var AgentContext = class extends Schema.Class("vitest-agent/AgentContext")({
+	startGitBranch: Schema.NullOr(Schema.String),
+	startGitCommitSha: Schema.NullOr(Schema.String),
+	startWorktreeDir: Schema.NullOr(Schema.String)
+}) {};
+/**
+* Service tag. The Live layer captures real I/O; the Test layer
+* returns whatever the test fixture passes.
+* @public
+*/
+var RunContext$ = class extends Context.Service()("vitest-agent/RunContextService") {};
+/**
+* Re-export the service tag under a less-collision-prone name. The
+* `RunContext` Schema.Class above shares its symbol-name with the
+* service tag concept; the `$` suffix on the Context.Tag class name
+* keeps both addressable from the same module.
+*
+* @public
+*/
+const RunContextService = RunContext$;
+
+//#endregion
+export { AgentContext, RunContext, RunContext$, RunContextService };

package/services/idempotency.js

@@ -0,0 +1,58 @@
+import { createHash } from "node:crypto";
+
+//#region src/services/idempotency.ts
+/**
+* Sentinel substituted for `parentAgentId` when the value is `null`.
+* Avoids ambiguity around hashing the literal string "null" or empty
+* string, both of which could collide with caller-supplied values.
+* @public
+*/
+const IDEMPOTENCY_ROOT_SENTINEL = "__ROOT__";
+/**
+* Derive the canonical idempotency key for an `agents` row.
+*
+* Algorithm:
+*   sha256(agentType + "|" + (parentAgentId ?? "__ROOT__") + "|" + clientNonce)
+*   then base32 (RFC 4648 alphabet, lowercased) truncated to 26 chars.
+*
+* 26 base32 chars = 130 bits, far beyond the birthday-bound for the
+* scoping (UNIQUE per session). The base32 alphabet is a-z2-7 — all
+* lowercase to keep the column lexicographically friendly and
+* case-insensitive on filesystems that we never hit but might in
+* future debugging.
+* @public
+*/
+const deriveIdempotencyKey = (input) => {
+	const parent = input.parentAgentId ?? "__ROOT__";
+	const message = `${input.agentType}|${parent}|${input.clientNonce}`;
+	const digest = createHash("sha256").update(message).digest();
+	return base32Encode(digest).slice(0, 26);
+};
+const BASE32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+/**
+* RFC 4648 base32 encoder, lowercase, no padding. Produces ceil(8n/5)
+* characters from an `n`-byte input. SHA-256 output (32 bytes) yields
+* 52 base32 chars; the caller truncates to 26.
+*/
+const base32Encode = (bytes) => {
+	let output = "";
+	let buffer = 0;
+	let bitsInBuffer = 0;
+	for (const byte of bytes) {
+		buffer = buffer << 8 | byte;
+		bitsInBuffer += 8;
+		while (bitsInBuffer >= 5) {
+			bitsInBuffer -= 5;
+			const index = buffer >> bitsInBuffer & 31;
+			output += BASE32_ALPHABET[index];
+		}
+	}
+	if (bitsInBuffer > 0) {
+		const index = buffer << 5 - bitsInBuffer & 31;
+		output += BASE32_ALPHABET[index];
+	}
+	return output;
+};
+
+//#endregion
+export { IDEMPOTENCY_ROOT_SENTINEL, deriveIdempotencyKey };