nylorun 0.8.0-beta → 0.11.0-beta

package/dist/stack/mcp.js

@@ -0,0 +1,114 @@
+/**
+ * `nylorun mcp connect <url> --server <name>`: signs the running local Tenant in to a remote MCP
+ * server with OAuth (F9 C2), through its Management API with a management key (`runningTenantApi`).
+ * The Runtime's keys module runs discovery, registration and the code exchange and seals the
+ * credential in an installation vault (`mcp` unless `--vault` names one); this command only
+ * opens the browser and waits for the credential to appear. It never starts the Tenant.
+ */
+import { randomUUID } from "node:crypto";
+import { PROTOCOL_HEADER, PROTOCOL_VERSION } from "@nylorun/core/compatibility";
+import { CliError } from "../errors.js";
+import { parseStackFlags, runningTenantApi } from "./commands.js";
+export const mcpUsage = `  mcp connect <url> --server <name> [--vault <id>] [--client-id <id>] [--tenant <name>] [--no-open]
+                                      sign the Tenant in to a remote MCP server with OAuth; the credential goes to the
+                                      installation vault mcp (or --vault), which sessions attach`;
+/** The installation vault `connect` uses unless `--vault` names one. */
+export const MCP_VAULT_NAME = "mcp";
+/** How long `connect` waits for the browser sign-in: the Runtime keeps it for ten minutes. */
+export const CONNECT_TIMEOUT_MS = 10 * 60_000;
+const usageError = (message) => new CliError(message, 2);
+async function call(deps, api, method, path, body) {
+    const response = await deps.fetch(`${api.runtimeUrl}${path}`, {
+        method,
+        headers: {
+            authorization: `Bearer ${api.managementKey}`,
+            [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
+            accept: "application/json",
+            ...(body === undefined ? {} : { "content-type": "application/json" }),
+        },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        redirect: "error",
+        signal: AbortSignal.timeout(150_000),
+    });
+    const answer = (await response.json().catch(() => ({})));
+    if (!response.ok)
+        throw new CliError(`${method} ${path} returned ${response.status}${typeof answer.message === "string" ? `: ${answer.message}` : ""}`, 1);
+    return answer;
+}
+/** The URL as the vault binds it: origin, path and query, no default port, no fragment. */
+function bindingUrl(input) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        throw usageError(`${input} is not a URL.`);
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:")
+        throw usageError(`${input} is not an http(s) URL.`);
+    if (url.username || url.password || url.hash)
+        throw usageError(`${input} must not carry userinfo or a fragment.`);
+    return `${url.origin}${url.pathname}${url.search}`;
+}
+/** The installation vault named `mcp`, created when there is none. */
+async function mcpVault(deps, api) {
+    const { vaults } = await call(deps, api, "GET", "/v1/tenant/vaults");
+    const found = vaults.find((vault) => vault.ownerUserId === "installation" && vault.name === MCP_VAULT_NAME);
+    if (found)
+        return found;
+    const key = `nylorun-mcp-${randomUUID()}`;
+    return await call(deps, api, "POST", "/v1/tenant/vaults", {
+        requestId: key,
+        idempotencyKey: key,
+        name: MCP_VAULT_NAME,
+        scope: "installation",
+    });
+}
+/** Each credential of the vault bound to `url`, by id, with when it last changed. */
+async function credentialsFor(deps, api, vaultId, url) {
+    const { credentials } = await call(deps, api, "GET", `/v1/tenant/vaults/${encodeURIComponent(vaultId)}/credentials`);
+    return new Map(credentials
+        .filter((item) => item.type === "oauth" && item.binding.url === url)
+        .map((item) => [item.id, item.rotatedAt ?? item.createdAt]));
+}
+async function connect(deps, args) {
+    const usage = "nylorun mcp connect <url> --server <name> [--vault <id>] [--client-id <id>] [--tenant <name>] [--no-open]";
+    const flags = parseStackFlags(args, { booleans: ["--no-open"], values: ["--server", "--vault", "--client-id", "--tenant"] }, usage);
+    if (flags.rest.length !== 1)
+        throw usageError(`Usage: ${usage}`);
+    const server = flags.values.get("--server");
+    if (!server)
+        throw usageError(`--server names the MCP server, as the agent declares it. Usage: ${usage}`);
+    const url = bindingUrl(flags.rest[0]);
+    const clientId = flags.values.get("--client-id");
+    const name = flags.values.get("--tenant");
+    const api = await runningTenantApi(deps, name === undefined ? {} : { name });
+    const vaultId = flags.values.get("--vault") ?? (await mcpVault(deps, api)).id;
+    const before = await credentialsFor(deps, api, vaultId, url);
+    const started = await call(deps, api, "POST", `/v1/tenant/vaults/${encodeURIComponent(vaultId)}/oauth/start`, { url, server, ...(clientId === undefined ? {} : { clientId }) });
+    deps.out(`Sign in to ${server} in your browser:`);
+    deps.out(`  ${started.authorizeUrl}`);
+    if (!flags.booleans.has("--no-open"))
+        await deps.openBrowser(started.authorizeUrl);
+    deps.out("Waiting for the sign-in to finish…");
+    const deadline = Math.min(Date.now() + CONNECT_TIMEOUT_MS, Date.parse(started.expiresAt) || Infinity);
+    const pollMs = deps.pollMs ?? 1000;
+    while (Date.now() < deadline) {
+        await new Promise((resolve) => setTimeout(resolve, pollMs));
+        const now = await credentialsFor(deps, api, vaultId, url);
+        for (const [id, changed] of now)
+            if (before.get(id) !== changed) {
+                deps.out(`Connected ${server} (${url}): credential ${id} in installation vault ${vaultId}.`);
+                deps.out(`Sessions use it when they attach the vault: vaultIds: ["${vaultId}"].`);
+                return 0;
+            }
+    }
+    throw new CliError(`The sign-in to ${server} did not finish in time. Run "nylorun mcp connect" again; the browser page says why when the server refused it.`, 1);
+}
+/** `nylorun mcp <connect> ...` */
+export async function mcpCommand(deps, args) {
+    const [sub, ...rest] = args;
+    if (sub === "connect")
+        return connect(deps, rest);
+    throw usageError(`Usage:\n${mcpUsage}`);
+}

package/dist/stack/operator-keys.d.ts

@@ -0,0 +1,39 @@
+import type { OperatorKey, PutOperatorKeyResponse } from "@nylorun/core/contracts";
+import { type KeyCredentials } from "../project/link.js";
+import type { DockerResult } from "./docker.js";
+import type { FetchLike } from "./studio-login.js";
+/** A local Tenant: `nylorun-operate` in its runtime container, and a fetch to probe keys. */
+export interface OperateEndpoint {
+    fetch: FetchLike;
+    /** Runs `nylorun-operate <args>` in the runtime container. */
+    operate(args: readonly string[]): Promise<DockerResult>;
+}
+/** The keys `nylorun start` gives the projects it links (and `-management`). */
+export declare const PROJECT_KEY_ID = "project";
+/** The keys nylorun commands use outside a linked project (and `-management`). */
+export declare const CLI_KEY_ID = "cli";
+/** Creates key `id` with `role` or rotates it; the answer holds the key, this once. */
+export declare function putOperatorKey(endpoint: OperateEndpoint, id: string, role: "application" | "management"): Promise<PutOperatorKeyResponse>;
+export declare function listOperatorKeys(endpoint: OperateEndpoint): Promise<OperatorKey[]>;
+/** Deletes key `id`: false when there is none. */
+export declare function deleteOperatorKey(endpoint: OperateEndpoint, id: string): Promise<boolean>;
+/**
+ * Whether `key` reaches the Tenant at `runtimeUrl`: one authenticated read (`GET /v1/me`, which
+ * every key reaches). An unknown key is the opaque 404; another answer is an error.
+ */
+export declare function keyAuthenticates(fetch: FetchLike, runtimeUrl: string, key: string): Promise<boolean>;
+/**
+ * The keys `id` (application) and `id-management` (management) kept in the Host root file
+ * `file` (0600): each of the file's keys while it still authenticates, else `adopt`'s when it
+ * does (keys a project already holds), else a new key put through `nylorun-operate`, written to
+ * the file. One process at a time (`lock`), so concurrent commands share one key instead of
+ * rotating each other's.
+ */
+export declare function hostKey(options: {
+    endpoint: OperateEndpoint;
+    runtimeUrl: string;
+    id: string;
+    file: string;
+    lock: string;
+    adopt?: KeyCredentials;
+}): Promise<Required<KeyCredentials>>;

package/dist/stack/operator-keys.js

@@ -0,0 +1,138 @@
+/**
+ * A local Tenant's keys as the nylorun commands use them: `nylorun-operate keys … --json` in its
+ * runtime container (`docker compose exec`), and the keys nylorun keeps in the Host root
+ * (`project` and `project-management`, `cli` and `cli-management`). nylorun depends on
+ * `@nylorun/core` only, so key probes are plain requests.
+ */
+import { open, rm, stat } from "node:fs/promises";
+import { PROTOCOL_HEADER, PROTOCOL_VERSION } from "@nylorun/core/compatibility";
+import { CliError } from "../errors.js";
+import { readCredentialsFile, writeCredentialsFile, } from "../project/link.js";
+/** The keys `nylorun start` gives the projects it links (and `-management`). */
+export const PROJECT_KEY_ID = "project";
+/** The keys nylorun commands use outside a linked project (and `-management`). */
+export const CLI_KEY_ID = "cli";
+/** `nylorun-operate keys <args> --json`: its JSON answer, or exit 1 refused, 2 Tenant not open. */
+async function operateKeys(endpoint, args) {
+    const result = await endpoint.operate(["keys", ...args, "--json"]);
+    const message = result.stderr.trim();
+    if (result.code === 0) {
+        try {
+            return JSON.parse(result.stdout);
+        }
+        catch {
+            /* below */
+        }
+    }
+    if (result.code === 1)
+        throw new CliError(message, 1);
+    if (result.code === 2)
+        throw new CliError(`The Tenant is not open: ${message}`, 7);
+    throw new CliError(`nylorun-operate keys ${args.join(" ")} failed (exit ${result.code})${message ? `: ${message}` : ""}`, 1);
+}
+/** Creates key `id` with `role` or rotates it; the answer holds the key, this once. */
+export async function putOperatorKey(endpoint, id, role) {
+    return (await operateKeys(endpoint, ["put", id, "--role", role]));
+}
+export async function listOperatorKeys(endpoint) {
+    return (await operateKeys(endpoint, ["list"])).keys;
+}
+/** Deletes key `id`: false when there is none. */
+export async function deleteOperatorKey(endpoint, id) {
+    return (await operateKeys(endpoint, ["rm", id])).deleted;
+}
+/**
+ * Whether `key` reaches the Tenant at `runtimeUrl`: one authenticated read (`GET /v1/me`, which
+ * every key reaches). An unknown key is the opaque 404; another answer is an error.
+ */
+export async function keyAuthenticates(fetch, runtimeUrl, key) {
+    let response;
+    try {
+        response = await fetch(`${runtimeUrl}/v1/me`, {
+            headers: {
+                authorization: `Bearer ${key}`,
+                [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
+                accept: "application/json",
+            },
+            redirect: "error",
+            signal: AbortSignal.timeout(10_000),
+        });
+    }
+    catch (error) {
+        throw new CliError(`The Runtime at ${runtimeUrl} did not answer (${error instanceof Error ? error.message : String(error)}).`, 7);
+    }
+    await response.arrayBuffer().catch(() => undefined);
+    if (response.ok)
+        return true;
+    if (response.status === 401 || response.status === 403 || response.status === 404)
+        return false;
+    throw new CliError(`GET ${runtimeUrl}/v1/me returned ${response.status}.`, 7);
+}
+const LOCK_TIMEOUT_MS = 30_000;
+/** A lock older than this was left by a process that died. */
+const LOCK_STALE_MS = 60_000;
+/** Runs `fn` holding the lock file `path` (created exclusively), so one process puts a key. */
+async function withLock(path, fn) {
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    for (;;) {
+        try {
+            const handle = await open(path, "wx", 0o600);
+            await handle.close();
+            break;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            const held = await stat(path).catch(() => undefined);
+            if (held && Date.now() - held.mtimeMs > LOCK_STALE_MS) {
+                await rm(path, { force: true });
+                continue;
+            }
+            if (Date.now() > deadline)
+                throw new CliError(`Another nylorun command holds ${path}. Remove it if none runs.`, 1);
+            await new Promise((resolve) => setTimeout(resolve, 100));
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        await rm(path, { force: true });
+    }
+}
+/**
+ * The keys `id` (application) and `id-management` (management) kept in the Host root file
+ * `file` (0600): each of the file's keys while it still authenticates, else `adopt`'s when it
+ * does (keys a project already holds), else a new key put through `nylorun-operate`, written to
+ * the file. One process at a time (`lock`), so concurrent commands share one key instead of
+ * rotating each other's.
+ */
+export async function hostKey(options) {
+    const { endpoint, runtimeUrl, id, file, adopt } = options;
+    const reaches = (key) => key === undefined ? Promise.resolve(false) : keyAuthenticates(endpoint.fetch, runtimeUrl, key);
+    return await withLock(options.lock, async () => {
+        const kept = await readCredentialsFile(file);
+        let application = kept && (await reaches(kept.applicationKey)) ? kept : undefined;
+        if (!application && adopt && (await reaches(adopt.applicationKey)))
+            application = adopt;
+        if (!application) {
+            const put = await putOperatorKey(endpoint, id, "application");
+            application = { applicationKey: put.key, principalId: put.id };
+        }
+        let management = (await reaches(kept?.management?.key)) ? kept.management : undefined;
+        if (!management && (await reaches(adopt?.management?.key)))
+            management = adopt.management;
+        if (!management) {
+            const put = await putOperatorKey(endpoint, `${id}-management`, "management");
+            management = { key: put.key, principalId: put.id };
+        }
+        const credentials = {
+            applicationKey: application.applicationKey,
+            principalId: application.principalId,
+            management,
+        };
+        if (JSON.stringify(kept) !== JSON.stringify(credentials))
+            await writeCredentialsFile(file, credentials);
+        return credentials;
+    });
+}

package/dist/stack/paths.d.ts

@@ -8,25 +8,31 @@ export interface StackPaths {
     credentials: string;
     /** host-state.json: written only by a launcher-managed Runtime. */
     state: string;
+    /**
+     * cli-credentials.json: the operator key `cli` that `nylorun` commands use outside a linked
+     * project (`nylorun sandbox`), mode 0600.
+     */
+    cliCredentials: string;
+    /**
+     * project-credentials.json: the operator key `project` that `nylorun start` gives every
+     * project it links to this Tenant (a copy of their `.nylorun/credentials.json`), mode 0600.
+     */
+    projectCredentials: string;
+    /** operator-keys.lock: held while a command puts one of the keys above. */
+    keysLock: string;
     /** tenant.json: the Tenant's name and the project it was created for. */
     record: string;
-    /** The Tenant directory: homes, sandboxes, plugin data, logs. */
-    tenant: string;
     /**
-     * The Tenant directory's parts the harness container mounts (F6.2): workspaces, plugin data,
-     * and the home and temporary directory of MCP stdio servers.
+     * identity.yaml: the trusted issuers (F9 I2), written by the operator. When it exists the
+     * runtime reads it at boot (`NYLORUN_IDENTITY_FILE`).
      */
+    identity: string;
+    /** The Tenant directory: home, sandboxes, logs. */
+    tenant: string;
+    /** The Tenant directory's parts the harness container mounts (F6.2): workspaces. */
     harness: {
         sandboxes: string;
-        pluginData: string;
-        home: string;
-        tmp: string;
     };
-    /**
-     * Plugin roots on this machine (`plugins/`), mounted read-only at the same path into the
-     * runtime and harness containers, so a stdio MCP server's plugin root resolves there.
-     */
-    plugins: string;
     /** The keys directory, mounted only into the gateway (F4.2). */
     keys: string;
     /** The Tenant's vault key (KEK), `keys/vault-kek`. */

package/dist/stack/paths.js

@@ -7,15 +7,13 @@ export function stackPaths(hostRoot) {
         config: join(root, "host.json"),
         credentials: join(root, "host-credentials.json"),
         state: join(root, "host-state.json"),
+        cliCredentials: join(root, "cli-credentials.json"),
+        projectCredentials: join(root, "project-credentials.json"),
+        keysLock: join(root, "operator-keys.lock"),
         record: join(root, "tenant.json"),
+        identity: join(root, "identity.yaml"),
         tenant: join(root, "tenant"),
-        harness: {
-            sandboxes: join(root, "tenant", "sandboxes"),
-            pluginData: join(root, "tenant", "plugin-data"),
-            home: join(root, "tenant", "home"),
-            tmp: join(root, "tenant", "tmp"),
-        },
-        plugins: join(root, "plugins"),
+        harness: { sandboxes: join(root, "tenant", "sandboxes") },
         keys: join(root, "keys"),
         vaultKey: join(root, "keys", "vault-kek"),
         home: join(root, "home"),

package/dist/stack/ports.d.ts

@@ -1,7 +1,5 @@
 export declare const DEFAULT_PORTS: {
     readonly runtime: 8787;
-    /** The Runtime's operator listener (Admin API). */
-    readonly admin: 8788;
     readonly studio: 4161;
     readonly restate: 9070;
 };

package/dist/stack/ports.js

@@ -1,8 +1,6 @@
 import { createServer } from "node:net";
 export const DEFAULT_PORTS = {
     runtime: 8787,
-    /** The Runtime's operator listener (Admin API). */
-    admin: 8788,
     studio: 4161,
     restate: 9070,
 };

package/dist/stack/prepare.d.ts

@@ -32,11 +32,9 @@ export declare function prepareStack(input: {
     ports: PortProbe;
     /** Ports other Tenants keep in their `.env`: never chosen for a port not chosen yet. */
     reserved?: ReadonlySet<number>;
-    /** `NYLORUN_DERIVED_PRINCIPALS` from the environment of `nylorun start`; else kept. */
-    derivedPrincipals?: string;
     /**
-     * Changes to the origins that may embed Studio: `reset` goes back to the
-     * defaults, `add` appends (for example a desktop app's dev server).
+     * Changes to the origins that may embed Studio: `reset` empties the list (the
+     * default), `add` appends (for example a desktop app's dev server).
      */
     studioEmbedOrigins?: {
         add?: readonly string[];

package/dist/stack/prepare.js

@@ -1,9 +1,10 @@
 import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
 import { chmod, readFile, rename, writeFile } from "node:fs/promises";
 import { renderComposeFile } from "./compose-file.js";
 import { parseFrameAncestors } from "@nylorun/core/contracts";
 import { CliError } from "../errors.js";
-import { DEFAULT_STUDIO_FRAME_ANCESTORS, parseDerivedPrincipals, parsePersisted, renderEnvFile, } from "./env-file.js";
+import { DEFAULT_STUDIO_FRAME_ANCESTORS, parsePersisted, renderEnvFile, } from "./env-file.js";
 import { sandboxesEnabled } from "../sandbox/cluster-file.js";
 import { ensureHostCredentials, ensureVaultKey, ensureHostLayout, writeStackHostConfig, } from "./host-files.js";
 import { choosePort, DEFAULT_PORTS } from "./ports.js";
@@ -48,7 +49,6 @@ export async function prepareStack(input) {
         return port;
     };
     const runtimePort = await pick(DEFAULT_PORTS.runtime, persisted.runtimePort);
-    const adminPort = await pick(DEFAULT_PORTS.admin, persisted.adminPort);
     const studioPort = await pick(DEFAULT_PORTS.studio, persisted.studioPort);
     const restatePort = await pick(DEFAULT_PORTS.restate, persisted.restatePort);
     const identity = await ensureIdentityKey(paths.restateIdentity, writeFileMode);
@@ -65,7 +65,6 @@ export async function prepareStack(input) {
     const studioFrameAncestors = [...new Set([...base, ...added])].join(" ");
     const env = {
         runtimePort,
-        adminPort,
         studioPort,
         restatePort,
         postgresPassword: persisted.postgresPassword ?? randomBytes(24).toString("hex"),
@@ -86,9 +85,6 @@ export async function prepareStack(input) {
         studioFrameAncestors,
         studioAnalyticsId: input.studioAnalyticsId ?? "",
         tenantName: input.name,
-        derivedPrincipals: (input.derivedPrincipals?.trim()
-            ? parseDerivedPrincipals(input.derivedPrincipals, "NYLORUN_DERIVED_PRINCIPALS")
-            : (persisted.derivedPrincipals ?? ["project"])).join(","),
     };
     const sandboxes = input.sandboxes === null
         ? undefined
@@ -100,7 +96,6 @@ export async function prepareStack(input) {
     await ensureVaultKey(paths);
     const host = await writeStackHostConfig(paths, {
         port: runtimePort,
-        adminPort,
         runtimeVersion: input.runtimeVersion,
     });
     await writeFileMode(paths.env, renderEnvFile(env), 0o600);
@@ -108,6 +103,8 @@ export async function prepareStack(input) {
         harness: env.harness,
         ...(env.sandboxes ? { sandboxes: true } : {}),
         ...(env.restateUi ? { restateUi: true } : {}),
+        // The trusted issuers, when the operator wrote an identity file; a change takes a restart.
+        ...(existsSync(paths.identity) ? { identity: true } : {}),
     }), 0o644);
     return { env, host, adminKey, firstRun };
 }

package/dist/stack/sandbox.js

@@ -1,6 +1,6 @@
 /**
  * `nylorun sandbox ls | rm`: the running local Tenant's sandbox resources (Host feature
- * `sandboxes`), through its Tenant API as the Project's derived principal. Neither starts the
+ * `sandboxes`), through its Tenant API with an operator key (`runningTenantApi`). Neither starts the
  * Tenant. `nylorun sandbox enable|disable|status` (sandbox pods on a cluster, F7.2) live in
  * `../sandbox/commands.ts`.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nylorun",
-  "version": "0.8.0-beta",
+  "version": "0.11.0-beta",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Set up and run local Nylorun Tenants (Runtime and Studio) with Docker Compose",
@@ -30,7 +30,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@nylorun/core": "0.12.0-beta"
+    "@nylorun/core": "0.15.0-beta"
   },
   "devDependencies": {
     "typescript": "npm:@typescript/typescript6@^6.0.2",
@@ -41,7 +41,7 @@
     "nylorun": "dist/cli.js"
   },
   "nylorun": {
-    "runtime": "0.16.0-beta",
-    "studio": "0.19.0-beta"
+    "runtime": "0.19.0-beta",
+    "studio": "0.22.0-beta"
   }
 }

package/dist/project/derived-key.d.ts

@@ -1,8 +0,0 @@
-/** The derived principal a Project uses; the local Runtime registers it on its Tenant. */
-export declare const PROJECT_PRINCIPAL_ID = "project";
-/**
- * Key of a derived principal on the local Tenant, from the admin key. A copy of
- * `deriveTenantKey` in `@nylorun/admin` (nylorun depends on `@nylorun/core` only); both are
- * tested against the same fixed vector.
- */
-export declare function deriveTenantKey(adminKey: string, tenantId: string, principalId: string): string;

package/dist/project/derived-key.js

@@ -1,18 +0,0 @@
-import { createHmac } from "node:crypto";
-/** The derived principal a Project uses; the local Runtime registers it on its Tenant. */
-export const PROJECT_PRINCIPAL_ID = "project";
-/**
- * Key of a derived principal on the local Tenant, from the admin key. A copy of
- * `deriveTenantKey` in `@nylorun/admin` (nylorun depends on `@nylorun/core` only); both are
- * tested against the same fixed vector.
- */
-export function deriveTenantKey(adminKey, tenantId, principalId) {
-    const message = Buffer.concat([
-        Buffer.from("nylorun/principal/v1", "utf8"),
-        Buffer.from([0]),
-        Buffer.from(principalId, "utf8"),
-        Buffer.from([0]),
-        Buffer.from(tenantId, "utf8"),
-    ]);
-    return createHmac("sha256", Buffer.from(adminKey, "utf8")).update(message).digest("hex");
-}