Interface McpRequestStateProtector

@ThreadSafe
public interface McpRequestStateProtector

Thread-safe application-supplied alternative to Soklet's built-in request-state protection.

The protector owns its algorithm, envelope format, keys, rotation, fleet compatibility, randomness, and per-key invocation limits. Soklet continues to own canonical state serialization, size, round, and lifetime checks, plus context binding. Implementations must authenticate the exact associated data supplied in the context and may be invoked concurrently.

Author:

Mark Allen

Method Summary

Modifier and Type	Method	Description
byte @NonNull []	open(@NonNull McpRequestStateProtectionContext requestStateProtectionContext, @NonNull String protectedState)	Opens a framework request-state wire value previously produced by this protector.
@NonNull String	seal(@NonNull McpRequestStateProtectionContext requestStateProtectionContext, byte @NonNull [] plaintext)	Protects canonical framework request-state bytes.

Method Details

seal

@NonNull String seal(@NonNull McpRequestStateProtectionContext requestStateProtectionContext,
 byte @NonNull [] plaintext)
              throws McpRequestStateProtectionException

Protects canonical framework request-state bytes.

Parameters:

requestStateProtectionContext - immutable binding context

plaintext - call-confined canonical framework bytes; implementations must not retain or mutate this array

Returns:

opaque string suitable for the MCP wire value

Throws:

McpRequestStateProtectionException - on a sanitized protection failure

open

byte @NonNull [] open(@NonNull McpRequestStateProtectionContext requestStateProtectionContext,
 @NonNull String protectedState)
               throws McpRequestStateProtectionException

Opens a framework request-state wire value previously produced by this protector.

Parameters:

requestStateProtectionContext - immutable expected binding context

protectedState - opaque value received from the client

Returns:

newly allocated canonical framework bytes whose ownership transfers to Soklet

Throws:

McpRequestStateProtectionException - with McpRequestStateProtectionException.Reason.INVALID_STATE for every malformation, authentication failure, expiry-equivalent failure, or context mismatch detected by the protector