kiriya 0.1.0

package/dist/src/core/presentation/mcp/elicitation.js

@@ -0,0 +1,55 @@
+import { isObject } from "./protocol.js";
+/** Whether client capabilities include form mode. An empty `elicitation` object means form mode, as the specification says. */
+export function supportsFormElicitation(capabilities) {
+    const elicitation = capabilities["elicitation"];
+    if (!isObject(elicitation))
+        return false;
+    return Object.keys(elicitation).length === 0 || isObject(elicitation["form"]);
+}
+/** An answer as the client sent it. Anything that is not a valid answer counts as cancelled. */
+export function answerOf(value) {
+    if (!isObject(value))
+        return { action: "cancel", content: {} };
+    const { action, content } = value;
+    if (action !== "accept" && action !== "decline" && action !== "cancel")
+        return { action: "cancel", content: {} };
+    const fields = {};
+    if (isObject(content)) {
+        for (const [name, field] of Object.entries(content))
+            if (typeof field === "string")
+                fields[name] = field;
+    }
+    return { action, content: fields };
+}
+/** Ends a round of a call whose result asks for input; the client answers by calling again. */
+export class InputRequired extends Error {
+    inputRequests;
+    requestState;
+    constructor(inputRequests, requestState) {
+        super("input required");
+        this.inputRequests = inputRequests;
+        this.requestState = requestState;
+        this.name = "InputRequired";
+    }
+}
+/**
+ * The 2026-07-28 way to ask: the question travels in the call's result, and the answer
+ * comes back when the client calls again, so the command runs again from the start.
+ * Questions are numbered in the order the command asks them.
+ */
+export class RoundTripElicitation {
+    answers;
+    stop;
+    asked = 0;
+    constructor(answers, stop) {
+        this.answers = answers;
+        this.stop = stop;
+    }
+    ask(question) {
+        this.asked += 1;
+        const key = `confirm-${this.asked}`;
+        const answer = this.answers[key];
+        return answer === undefined ? Promise.reject(this.stop(key, question)) : Promise.resolve(answer);
+    }
+}
+//# sourceMappingURL=elicitation.js.map

package/dist/src/core/presentation/mcp/mcp-application.js

@@ -0,0 +1,60 @@
+import { createInterface } from "node:readline";
+import { mcpAllowsDestroy, mcpAllowsWrite } from "../../application/config-values.js";
+import { RootScope } from "../../application/root-scope.js";
+import { KiriyaError } from "../../domain/errors.js";
+import { RawReader } from "../../domain/input-schema.js";
+import { message } from "../../domain/message.js";
+import { Translator } from "../i18n/translator.js";
+import { McpServer } from "./mcp-server.js";
+/** What `kiriya mcp` takes on its command line. */
+export const MCP_INPUT = {
+    positionals: [{ name: "folders", description: "core.mcp.arg.folders", required: false, variadic: true, path: true }],
+    options: {
+        root: { type: "string", multiple: true, path: true, description: "core.mcp.option.root", valueName: "<folder>" },
+    },
+    // Folders as arguments serve an app that passes a list of them, such as the one an MCP bundle starts.
+    parse: (raw) => {
+        const reader = new RawReader(raw);
+        return { roots: [...reader.positionalsFrom(0), ...reader.strings("root")] };
+    },
+};
+/**
+ * `kiriya mcp`: one JSON-RPC message per line on stdin and stdout until stdin closes.
+ * Only protocol messages reach stdout; diagnostics go to stderr. A root that is not a
+ * folder stops it before it reads anything. The settings are read once, at the start.
+ */
+export async function serveMcp(deps, input, cwd) {
+    const translator = new Translator(deps.catalog);
+    const log = (value) => {
+        deps.stderr.write(`${translator.text(value)}\n`);
+    };
+    const scope = await RootScope.open(deps.fileSystem, input.roots, cwd, [deps.config.path]);
+    // A configuration file that cannot be read allows nothing beyond reading.
+    const settings = await deps.config.read().then((values) => ({ allowWrite: mcpAllowsWrite(values), allowDestroy: mcpAllowsDestroy(values) }), (error) => {
+        const detail = error instanceof KiriyaError ? translator.text(error.detail) : String(error);
+        log(message("core.mcp.config-unreadable", { detail }));
+        return { allowWrite: false, allowDestroy: false };
+    });
+    const server = new McpServer({
+        registry: deps.registry,
+        translator,
+        version: deps.version,
+        scope,
+        ...settings,
+        secret: deps.random.bytes(32),
+        now: () => deps.clock.now(),
+        send: (value) => deps.stdout.write(`${JSON.stringify(value)}\n`),
+        log,
+    });
+    const lines = createInterface({ input: deps.stdin, crlfDelay: Number.POSITIVE_INFINITY });
+    // A client that goes away closes stdout too; there is no one left to answer.
+    deps.stdout.once("error", () => lines.close());
+    for await (const line of lines) {
+        if (line.trim() !== "")
+            server.receive(line);
+    }
+    await server.close();
+    await new Promise((resolve) => deps.stdout.write("", () => resolve()));
+    return 0;
+}
+//# sourceMappingURL=mcp-application.js.map

package/dist/src/core/presentation/mcp/mcp-confirmation.js

@@ -0,0 +1,59 @@
+import { RefusedError } from "../../domain/errors.js";
+import { message } from "../../domain/message.js";
+/**
+ * Questions over MCP, by the tool's safety level:
+ *
+ * - `write`: yes-or-no questions are answered yes by the user's `mcp.allowWrite` setting,
+ *   as `--yes` would answer them on the command line.
+ * - `destroy`: yes-or-no questions are asked through elicitation, so no call of such a
+ *   tool changes anything the user did not accept.
+ * - Typed confirmations, in any tool, are asked through elicitation, which exists only
+ *   with `mcp.allowDestroy` and a client that supports it; without it they are refused.
+ *
+ * A value passed as `--confirm` never counts, since an agent could pass it.
+ */
+export class McpConfirmation {
+    safety;
+    elicitation;
+    translator;
+    constructor(safety, elicitation, translator) {
+        this.safety = safety;
+        this.elicitation = elicitation;
+        this.translator = translator;
+    }
+    async approve(question) {
+        if (this.safety === "read")
+            return false;
+        if (this.safety === "write")
+            return true;
+        const answer = await this.asker().ask({
+            message: this.translator.text(question),
+            requestedSchema: { type: "object", properties: {} },
+        });
+        return answer.action === "accept";
+    }
+    async typed(warning, expected) {
+        const instruction = this.translator.text(message("core.mcp.confirm.type", { expected }));
+        const answer = await this.asker().ask({
+            message: `${this.translator.text(warning)} ${instruction}`,
+            requestedSchema: {
+                type: "object",
+                properties: {
+                    value: {
+                        type: "string",
+                        title: this.translator.text(message("core.mcp.confirm.field")),
+                        description: instruction,
+                    },
+                },
+                required: ["value"],
+            },
+        });
+        return answer.action === "accept" && answer.content["value"]?.trim() === expected;
+    }
+    asker() {
+        if (this.elicitation === null)
+            throw new RefusedError("core.mcp.cannot-confirm");
+        return this.elicitation;
+    }
+}
+//# sourceMappingURL=mcp-confirmation.js.map

package/dist/src/core/presentation/mcp/mcp-server.js

@@ -0,0 +1,355 @@
+import { pathValues } from "../../application/root-scope.js";
+import { InterruptedError, KiriyaError } from "../../domain/errors.js";
+import { message } from "../../domain/message.js";
+import { byCodePoint } from "../../domain/names.js";
+import { answerOf, InputRequired, RoundTripElicitation, supportsFormElicitation, } from "./elicitation.js";
+import { McpConfirmation } from "./mcp-confirmation.js";
+import { INTERNAL_ERROR, INVALID_PARAMS, INVALID_REQUEST, isObject, LATEST_LEGACY_VERSION, LEGACY_VERSIONS, META_CLIENT_CAPABILITIES, META_PROTOCOL_VERSION, META_SERVER_INFO, METHOD_NOT_FOUND, MISSING_REQUIRED_CLIENT_CAPABILITY, MODERN_VERSIONS, PARSE_ERROR, ProtocolError, UNSUPPORTED_PROTOCOL_VERSION, } from "./protocol.js";
+import { callDigest, RequestStates } from "./request-state.js";
+import { rawInputOf, toolAccess, toolDefinition } from "./tool-definitions.js";
+import { commandToolResult, errorToolResult } from "./tool-results.js";
+/** How long a client may keep the tool list, which changes only when the server starts again. */
+const CACHE_TTL_MS = 300_000;
+/** Output a program prints through a command, such as docker's logs, kept from its end. */
+const OUTPUT_KEPT = 1_000_000;
+const SERVER_CAPABILITIES = { tools: {} };
+/**
+ * Read commands become tools, and sensitive read, write and destroy commands when the user
+ * allows them. A command that runs a program the user names, or one only for a terminal, never does.
+ * The generated docs say the same of each command through this function.
+ */
+export function offeredAsTool(spec, settings) {
+    if (spec.runsUserCommands || spec.terminalOnly === true)
+        return false;
+    if (spec.sensitive === true && !settings.allowWrite)
+        return false;
+    if (spec.safety === "write")
+        return settings.allowWrite;
+    if (spec.safety === "destroy")
+        return settings.allowDestroy;
+    return true;
+}
+const keyOf = (id) => `${typeof id}:${id}`;
+/**
+ * The protocol, apart from how messages travel. It serves the 2026-07-28 version, whose
+ * requests carry their own version, and the earlier ones, which begin with `initialize`.
+ */
+export class McpServer {
+    options;
+    tools = new Map();
+    running = new Map();
+    pending = new Set();
+    /** Questions this server asked a client of an earlier version, by request id. */
+    questions = new Map();
+    states;
+    nextQuestion = 1;
+    legacy = null;
+    constructor(options) {
+        this.options = options;
+        this.states = new RequestStates(options.secret, options.now);
+        const entries = options.registry
+            .list()
+            .flatMap((module) => [...module.commands.values()])
+            .filter((entry) => offeredAsTool(entry.command.spec, options))
+            .sort((a, b) => byCodePoint(a.command.spec.id, b.command.spec.id));
+        for (const entry of entries) {
+            const { spec } = entry.command;
+            try {
+                this.tools.set(spec.id, { entry, definition: toolDefinition(spec, options.translator, options.allowWrite) });
+            }
+            catch (error) {
+                options.log(message("core.mcp.tool-left-out", { tool: spec.id, detail: String(error) }));
+            }
+        }
+    }
+    /** One line from the client. Requests run side by side, and each answer is sent when it is ready. */
+    receive(line) {
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            this.fail(null, new ProtocolError(PARSE_ERROR, message("core.mcp.error.parse")));
+            return;
+        }
+        const invalid = new ProtocolError(INVALID_REQUEST, message("core.mcp.error.invalid-request"));
+        if (!isObject(parsed) || parsed["jsonrpc"] !== "2.0") {
+            this.fail(null, invalid);
+            return;
+        }
+        const { id, method, params } = parsed;
+        if (typeof method !== "string") {
+            // A response, which can only answer a question this server asked.
+            const answered = typeof id === "string" ? this.questions.get(id) : undefined;
+            if (answered !== undefined)
+                answered(answerOf(parsed["result"]));
+            else if (!("result" in parsed) && !("error" in parsed))
+                this.fail(null, invalid);
+            return;
+        }
+        if (id === undefined) {
+            this.notification(method, params);
+            return;
+        }
+        if (typeof id !== "string" && typeof id !== "number") {
+            this.fail(null, invalid);
+            return;
+        }
+        const work = this.request(id, method, params).finally(() => this.pending.delete(work));
+        this.pending.add(work);
+    }
+    /** Stops every running command and waits for it, as when the client closes the connection. */
+    async close() {
+        for (const controller of this.running.values())
+            controller.abort();
+        await Promise.allSettled([...this.pending]);
+    }
+    async request(id, method, params) {
+        const key = keyOf(id);
+        const controller = new AbortController();
+        this.running.set(key, controller);
+        try {
+            const result = await this.dispatch(method, params, controller.signal);
+            if (!controller.signal.aborted)
+                this.options.send({ jsonrpc: "2.0", id, result });
+        }
+        catch (error) {
+            // A cancelled request gets no answer at all.
+            if (controller.signal.aborted)
+                return;
+            if (error instanceof ProtocolError) {
+                this.fail(id, error);
+            }
+            else {
+                const detail = error instanceof Error ? error.message : String(error);
+                this.fail(id, new ProtocolError(INTERNAL_ERROR, message("core.error.unexpected", { detail })));
+            }
+        }
+        finally {
+            if (this.running.get(key) === controller)
+                this.running.delete(key);
+        }
+    }
+    async dispatch(method, params, signal) {
+        const given = params ?? {};
+        if (!isObject(given))
+            throw new ProtocolError(INVALID_PARAMS, message("core.mcp.error.params-not-object"));
+        switch (method) {
+            case "initialize":
+                return this.initialize(given);
+            case "ping":
+                return {};
+            case "server/discover":
+                return this.discover(given);
+            case "tools/list":
+                return this.listTools(this.era(given), given);
+            case "tools/call":
+                return this.callTool(this.era(given), given, signal);
+            default:
+                throw new ProtocolError(METHOD_NOT_FOUND, message("core.mcp.error.unknown-method", { method }));
+        }
+    }
+    notification(method, params) {
+        if (method !== "notifications/cancelled" || !isObject(params))
+            return;
+        const { requestId } = params;
+        if (typeof requestId === "string" || typeof requestId === "number")
+            this.running.get(keyOf(requestId))?.abort();
+    }
+    /** A modern request names its version and capabilities in `_meta`; one without belongs to the legacy session. */
+    era(params) {
+        const meta = metaOf(params);
+        const version = meta[META_PROTOCOL_VERSION];
+        if (version === undefined) {
+            if (this.legacy !== null)
+                return this.legacy;
+            throw new ProtocolError(INVALID_PARAMS, message("core.mcp.error.no-version"));
+        }
+        if (typeof version !== "string" || !MODERN_VERSIONS.includes(version)) {
+            throw new ProtocolError(UNSUPPORTED_PROTOCOL_VERSION, message("core.mcp.error.unsupported-version", { version: String(version) }), { supported: [...MODERN_VERSIONS, ...LEGACY_VERSIONS], requested: version });
+        }
+        const capabilities = meta[META_CLIENT_CAPABILITIES];
+        if (!isObject(capabilities))
+            throw new ProtocolError(INVALID_PARAMS, message("core.mcp.error.no-capabilities"));
+        return { modern: true, version, capabilities };
+    }
+    /** The handshake of the versions before 2026-07-28. The session it opens lasts as long as the process. */
+    initialize(params) {
+        const requested = params["protocolVersion"];
+        const capabilities = params["capabilities"];
+        const version = typeof requested === "string" && LEGACY_VERSIONS.includes(requested) ? requested : LATEST_LEGACY_VERSION;
+        this.legacy = { modern: false, version, capabilities: isObject(capabilities) ? capabilities : {} };
+        return {
+            protocolVersion: version,
+            capabilities: SERVER_CAPABILITIES,
+            serverInfo: this.serverInfo(),
+            instructions: this.instructions(),
+        };
+    }
+    /** Answers with or without `_meta`, since a client may probe with it; a version it names must still be supported. */
+    discover(params) {
+        if (metaOf(params)[META_PROTOCOL_VERSION] !== undefined)
+            this.era(params);
+        return this.complete({ modern: true, version: MODERN_VERSIONS[0] ?? "", capabilities: {} }, {
+            supportedVersions: [...MODERN_VERSIONS],
+            capabilities: SERVER_CAPABILITIES,
+            instructions: this.instructions(),
+            ttlMs: CACHE_TTL_MS,
+            cacheScope: "private",
+        });
+    }
+    /** A client that cannot ask its user in form mode is never offered a tool whose work cannot be undone. */
+    listTools(era, params) {
+        if (params["cursor"] !== undefined)
+            throw new ProtocolError(INVALID_PARAMS, message("core.mcp.error.unknown-cursor"));
+        const canAsk = supportsFormElicitation(era.capabilities);
+        const tools = [...this.tools.values()]
+            .filter((tool) => canAsk || tool.entry.command.spec.safety !== "destroy")
+            .map((tool) => tool.definition);
+        return this.complete(era, era.modern ? { tools, ttlMs: CACHE_TTL_MS, cacheScope: "private" } : { tools });
+    }
+    /**
+     * Runs the command as the CLI would, inside the roots. A failure the model can correct,
+     * such as a bad value or a refused path, is a result with `isError`; an unknown tool is a
+     * protocol error. A question for the user ends the round with an input-required result
+     * in the modern version, and becomes a request to the client in the earlier ones.
+     */
+    async callTool(era, params, signal) {
+        const name = params["name"];
+        if (typeof name !== "string")
+            throw new ProtocolError(INVALID_PARAMS, message("core.mcp.error.no-tool-name"));
+        const tool = this.tools.get(name);
+        if (tool === undefined)
+            throw new ProtocolError(INVALID_PARAMS, message("core.mcp.error.unknown-tool", { name }));
+        const { command } = tool.entry;
+        const { spec } = command;
+        const canAsk = supportsFormElicitation(era.capabilities);
+        if (spec.safety === "destroy" && !canAsk) {
+            throw new ProtocolError(MISSING_REQUIRED_CLIENT_CAPABILITY, message("core.mcp.error.needs-elicitation", { name }), { requiredCapabilities: { elicitation: { form: {} } } });
+        }
+        const digest = callDigest(name, params["arguments"]);
+        const elicitation = this.options.allowDestroy && canAsk ? this.elicitation(era, params, name, digest, signal) : null;
+        const { scope, translator } = this.options;
+        let output = "";
+        let result;
+        try {
+            const raw = rawInputOf(spec.input, params["arguments"], toolAccess(spec, this.options.allowWrite));
+            await scope.refuseOutside(pathValues(spec.input, raw), spec.safety !== "read");
+            const input = spec.input.parse(raw);
+            const outcome = await command.execute(input, {
+                cwd: scope.start,
+                signal,
+                confirmation: new McpConfirmation(spec.safety, elicitation, translator),
+                passthrough: {
+                    write: (text) => {
+                        output = (output + text).slice(-OUTPUT_KEPT);
+                    },
+                },
+            });
+            result = commandToolResult(spec.id, outcome, output, translator);
+        }
+        catch (error) {
+            if (error instanceof InputRequired) {
+                return {
+                    resultType: "input_required",
+                    inputRequests: error.inputRequests,
+                    requestState: error.requestState,
+                    _meta: { [META_SERVER_INFO]: this.serverInfo() },
+                };
+            }
+            if (!(error instanceof KiriyaError))
+                throw error;
+            result = errorToolResult(error, translator);
+        }
+        return this.complete(era, { ...result });
+    }
+    /** How this call asks its user: across rounds in the modern version, by a request of the server's own before it. */
+    elicitation(era, params, name, digest, signal) {
+        if (!era.modern)
+            return { ask: (question) => this.askClient(question, era, signal) };
+        const answers = this.answersOf(params, name, digest);
+        return new RoundTripElicitation(answers, (key, question) => {
+            const request = { method: "elicitation/create", params: { mode: "form", ...question } };
+            return new InputRequired({ [key]: request }, this.states.issue({ tool: name, digest, answers, key }));
+        });
+    }
+    /**
+     * The answers a retried call brings: those of earlier rounds, carried in the signed state,
+     * and the one to the question the last round asked. A state this server did not issue for
+     * this very call is refused; answers without a state are ignored, so no question is skipped.
+     */
+    answersOf(params, name, digest) {
+        const given = params["requestState"];
+        if (given === undefined)
+            return {};
+        const state = this.states.read(given);
+        const key = state?.["key"];
+        if (state === null || state["tool"] !== name || state["digest"] !== digest || typeof key !== "string") {
+            throw new ProtocolError(INVALID_PARAMS, message("core.mcp.error.bad-request-state"));
+        }
+        const answers = {};
+        const earlier = state["answers"];
+        if (isObject(earlier)) {
+            for (const [question, answer] of Object.entries(earlier))
+                answers[question] = answerOf(answer);
+        }
+        const responses = params["inputResponses"];
+        const response = isObject(responses) ? responses[key] : undefined;
+        if (response !== undefined)
+            answers[key] = answerOf(response);
+        return answers;
+    }
+    /** Before 2026-07-28 the server asks with a request of its own and waits for the client's answer. */
+    askClient(question, era, signal) {
+        const id = `kiriya-${this.nextQuestion}`;
+        this.nextQuestion += 1;
+        return new Promise((resolve, reject) => {
+            const stop = () => {
+                this.questions.delete(id);
+                reject(new InterruptedError("core.error.interrupted"));
+            };
+            if (signal.aborted) {
+                stop();
+                return;
+            }
+            signal.addEventListener("abort", stop, { once: true });
+            this.questions.set(id, (answer) => {
+                signal.removeEventListener("abort", stop);
+                this.questions.delete(id);
+                resolve(answer);
+            });
+            // 2025-06-18, the first version with elicitation, has no mode field; 2025-11-25 names it.
+            const params = era.version === "2025-06-18" ? { ...question } : { mode: "form", ...question };
+            this.options.send({ jsonrpc: "2.0", id, method: "elicitation/create", params });
+        });
+    }
+    /** Results of the modern version say they are complete and name the server. */
+    complete(era, body) {
+        return era.modern ? { resultType: "complete", ...body, _meta: { [META_SERVER_INFO]: this.serverInfo() } } : body;
+    }
+    serverInfo() {
+        return { name: "kiriya", version: this.options.version };
+    }
+    instructions() {
+        const { scope, translator, allowWrite, allowDestroy } = this.options;
+        const tools = message(allowDestroy
+            ? "core.mcp.instructions.destroy"
+            : allowWrite
+                ? "core.mcp.instructions.write"
+                : "core.mcp.instructions.read-only");
+        return translator.text(message("core.mcp.instructions", { tools, start: scope.start, roots: scope.roots.join(", ") }));
+    }
+    fail(id, error) {
+        const detail = { code: error.code, message: this.options.translator.text(error.detail) };
+        this.options.send({
+            jsonrpc: "2.0",
+            id,
+            error: error.data === undefined ? detail : { ...detail, data: error.data },
+        });
+    }
+}
+function metaOf(params) {
+    const meta = params["_meta"];
+    return isObject(meta) ? meta : {};
+}
+//# sourceMappingURL=mcp-server.js.map

package/dist/src/core/presentation/mcp/protocol.js

@@ -0,0 +1,32 @@
+/** Versions whose every request carries its version and client capabilities in `_meta`. */
+export const MODERN_VERSIONS = ["2026-07-28"];
+/** Versions that open with the `initialize` handshake, newest first. */
+export const LEGACY_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
+export const LATEST_LEGACY_VERSION = "2025-11-25";
+export const META_PROTOCOL_VERSION = "io.modelcontextprotocol/protocolVersion";
+export const META_CLIENT_CAPABILITIES = "io.modelcontextprotocol/clientCapabilities";
+export const META_SERVER_INFO = "io.modelcontextprotocol/serverInfo";
+export const PARSE_ERROR = -32700;
+export const INVALID_REQUEST = -32600;
+export const METHOD_NOT_FOUND = -32601;
+export const INVALID_PARAMS = -32602;
+export const INTERNAL_ERROR = -32603;
+export const MISSING_REQUIRED_CLIENT_CAPABILITY = -32021;
+export const UNSUPPORTED_PROTOCOL_VERSION = -32022;
+export function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** A request the server answers with a JSON-RPC error instead of a result. */
+export class ProtocolError extends Error {
+    code;
+    detail;
+    data;
+    constructor(code, detail, data) {
+        super(detail.key);
+        this.code = code;
+        this.detail = detail;
+        this.data = data;
+        this.name = "ProtocolError";
+    }
+}
+//# sourceMappingURL=protocol.js.map

package/dist/src/core/presentation/mcp/request-state.js

@@ -0,0 +1,66 @@
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { isObject } from "./protocol.js";
+/** How long a question asked over MCP stays open for its answer. */
+export const REQUEST_STATE_TTL_MS = 15 * 60_000;
+/** A JSON value as text with its keys sorted, so equal arguments always give the same digest. */
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (isObject(value)) {
+        const members = Object.keys(value)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`);
+        return `{${members.join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
+/** Names one call: the tool and its arguments. */
+export function callDigest(tool, args) {
+    return createHash("sha256")
+        .update(`${tool}\n${canonical(args ?? {})}`)
+        .digest("base64url");
+}
+/**
+ * The opaque `requestState` of a multi round-trip request. The client carries it between
+ * rounds, so it is signed with a secret of this process and dated: a state the process
+ * did not issue, one that was altered, and one past its time are all rejected.
+ */
+export class RequestStates {
+    secret;
+    now;
+    constructor(secret, now) {
+        this.secret = secret;
+        this.now = now;
+    }
+    issue(payload) {
+        const body = Buffer.from(JSON.stringify({ ...payload, expires: this.now() + REQUEST_STATE_TTL_MS })).toString("base64url");
+        return `${body}.${this.sign(body)}`;
+    }
+    /** The payload, or null for a state that is forged, altered or expired. */
+    read(state) {
+        if (typeof state !== "string")
+            return null;
+        const [body, signature, ...rest] = state.split(".");
+        if (body === undefined || signature === undefined || rest.length > 0)
+            return null;
+        const expected = Buffer.from(this.sign(body));
+        const given = Buffer.from(signature);
+        if (expected.length !== given.length || !timingSafeEqual(expected, given))
+            return null;
+        let payload;
+        try {
+            payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+        }
+        catch {
+            return null;
+        }
+        if (!isObject(payload))
+            return null;
+        const expires = payload["expires"];
+        return typeof expires === "number" && expires >= this.now() ? payload : null;
+    }
+    sign(body) {
+        return createHmac("sha256", this.secret).update(body).digest("base64url");
+    }
+}
+//# sourceMappingURL=request-state.js.map