@agimon-ai/po-core 0.0.0-alpha.2 → 0.0.0-alpha.21

package/dist/src/server/largeFrameLink.cjs

@@ -0,0 +1,47 @@
+//#region src/server/largeFrameLink.ts
+const LARGE_FRAME_SIZE = 33554432;
+/** Report encoded sizes without serializing or retaining frame payloads a second time. */
+function reportingLargeFrames(link, notice) {
+	const provided = /* @__PURE__ */ new Map();
+	const consumed = /* @__PURE__ */ new Map();
+	const calls = /* @__PURE__ */ new Map();
+	link.onClose(() => {
+		provided.clear();
+		consumed.clear();
+		calls.clear();
+	});
+	return {
+		get closed() {
+			return link.closed;
+		},
+		send(frame) {
+			if (frame.t === "shape") provided.set(frame.id, frame.contract);
+			let member = "";
+			if (frame.t === "state") member = `${provided.get(frame.hold) ?? frame.hold}.${frame.m}`;
+			if (frame.t === "call") member = `${consumed.get(frame.hold) ?? frame.hold}.${frame.member}`;
+			if (frame.t === "result") member = calls.get(frame.id) ?? String(frame.id);
+			const size = link.send(frame);
+			if (frame.t === "result") calls.delete(frame.id);
+			if (frame.t === "gone") provided.delete(frame.id);
+			if (frame.t === "release") consumed.delete(frame.id);
+			if (size !== void 0 && size > LARGE_FRAME_SIZE) notice(`large Chord frame: ${frame.t}${member ? ` ${member}` : ""}, encoded size ${size} (limit ${LARGE_FRAME_SIZE})`);
+			return size;
+		},
+		receive(handler) {
+			link.receive((frame) => {
+				if (frame.t === "shape") consumed.set(frame.id, frame.contract);
+				if (frame.t === "call") calls.set(frame.id, `${provided.get(frame.hold) ?? frame.hold}.${frame.member}`);
+				if (frame.t === "cancel") calls.delete(frame.id);
+				if (frame.t === "release") provided.delete(frame.id);
+				if (frame.t === "gone") consumed.delete(frame.id);
+				handler(frame);
+			});
+		},
+		onClose: (handler) => link.onClose(handler),
+		close: (reason) => link.close(reason)
+	};
+}
+//#endregion
+exports.reportingLargeFrames = reportingLargeFrames;
+
+//# sourceMappingURL=largeFrameLink.cjs.map

package/dist/src/server/largeFrameLink.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"largeFrameLink.cjs","names":[],"sources":["../../../src/server/largeFrameLink.ts"],"sourcesContent":["import type { Link } from '@earendil-works/chord';\n\nconst LARGE_FRAME_SIZE = 32 * 1024 * 1024;\n\n/** Report encoded sizes without serializing or retaining frame payloads a second time. */\nexport function reportingLargeFrames(link: Link, notice: (message: string) => void): Link {\n  const provided = new Map<number, string>();\n  const consumed = new Map<number, string>();\n  const calls = new Map<number, string>();\n  link.onClose(() => {\n    provided.clear();\n    consumed.clear();\n    calls.clear();\n  });\n  return {\n    get closed() {\n      return link.closed;\n    },\n    send(frame) {\n      if (frame.t === 'shape') provided.set(frame.id, frame.contract);\n      let member = '';\n      if (frame.t === 'state') member = `${provided.get(frame.hold) ?? frame.hold}.${frame.m}`;\n      if (frame.t === 'call') member = `${consumed.get(frame.hold) ?? frame.hold}.${frame.member}`;\n      if (frame.t === 'result') member = calls.get(frame.id) ?? String(frame.id);\n      const size = link.send(frame);\n      if (frame.t === 'result') calls.delete(frame.id);\n      if (frame.t === 'gone') provided.delete(frame.id);\n      if (frame.t === 'release') consumed.delete(frame.id);\n      if (size !== undefined && size > LARGE_FRAME_SIZE)\n        notice(\n          `large Chord frame: ${frame.t}${member ? ` ${member}` : ''}, encoded size ${size} (limit ${LARGE_FRAME_SIZE})`,\n        );\n      return size;\n    },\n    receive(handler) {\n      link.receive((frame) => {\n        if (frame.t === 'shape') consumed.set(frame.id, frame.contract);\n        if (frame.t === 'call') calls.set(frame.id, `${provided.get(frame.hold) ?? frame.hold}.${frame.member}`);\n        if (frame.t === 'cancel') calls.delete(frame.id);\n        if (frame.t === 'release') provided.delete(frame.id);\n        if (frame.t === 'gone') consumed.delete(frame.id);\n        handler(frame);\n      });\n    },\n    onClose: (handler) => link.onClose(handler),\n    close: (reason) => link.close(reason),\n  };\n}\n"],"mappings":";AAEA,MAAM,mBAAmB;;AAGzB,SAAgB,qBAAqB,MAAY,QAAyC;CACxF,MAAM,2BAAW,IAAI,IAAoB;CACzC,MAAM,2BAAW,IAAI,IAAoB;CACzC,MAAM,wBAAQ,IAAI,IAAoB;CACtC,KAAK,cAAc;EACjB,SAAS,MAAM;EACf,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CACD,OAAO;EACL,IAAI,SAAS;GACX,OAAO,KAAK;EACd;EACA,KAAK,OAAO;GACV,IAAI,MAAM,MAAM,SAAS,SAAS,IAAI,MAAM,IAAI,MAAM,QAAQ;GAC9D,IAAI,SAAS;GACb,IAAI,MAAM,MAAM,SAAS,SAAS,GAAG,SAAS,IAAI,MAAM,IAAI,KAAK,MAAM,KAAK,GAAG,MAAM;GACrF,IAAI,MAAM,MAAM,QAAQ,SAAS,GAAG,SAAS,IAAI,MAAM,IAAI,KAAK,MAAM,KAAK,GAAG,MAAM;GACpF,IAAI,MAAM,MAAM,UAAU,SAAS,MAAM,IAAI,MAAM,EAAE,KAAK,OAAO,MAAM,EAAE;GACzE,MAAM,OAAO,KAAK,KAAK,KAAK;GAC5B,IAAI,MAAM,MAAM,UAAU,MAAM,OAAO,MAAM,EAAE;GAC/C,IAAI,MAAM,MAAM,QAAQ,SAAS,OAAO,MAAM,EAAE;GAChD,IAAI,MAAM,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE;GACnD,IAAI,SAAS,KAAA,KAAa,OAAO,kBAC/B,OACE,sBAAsB,MAAM,IAAI,SAAS,IAAI,WAAW,GAAG,iBAAiB,KAAK,UAAU,iBAAiB,EAC9G;GACF,OAAO;EACT;EACA,QAAQ,SAAS;GACf,KAAK,SAAS,UAAU;IACtB,IAAI,MAAM,MAAM,SAAS,SAAS,IAAI,MAAM,IAAI,MAAM,QAAQ;IAC9D,IAAI,MAAM,MAAM,QAAQ,MAAM,IAAI,MAAM,IAAI,GAAG,SAAS,IAAI,MAAM,IAAI,KAAK,MAAM,KAAK,GAAG,MAAM,QAAQ;IACvG,IAAI,MAAM,MAAM,UAAU,MAAM,OAAO,MAAM,EAAE;IAC/C,IAAI,MAAM,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE;IACnD,IAAI,MAAM,MAAM,QAAQ,SAAS,OAAO,MAAM,EAAE;IAChD,QAAQ,KAAK;GACf,CAAC;EACH;EACA,UAAU,YAAY,KAAK,QAAQ,OAAO;EAC1C,QAAQ,WAAW,KAAK,MAAM,MAAM;CACtC;AACF"}

package/dist/src/server/largeFrameLink.mjs

@@ -0,0 +1,47 @@
+//#region src/server/largeFrameLink.ts
+const LARGE_FRAME_SIZE = 33554432;
+/** Report encoded sizes without serializing or retaining frame payloads a second time. */
+function reportingLargeFrames(link, notice) {
+	const provided = /* @__PURE__ */ new Map();
+	const consumed = /* @__PURE__ */ new Map();
+	const calls = /* @__PURE__ */ new Map();
+	link.onClose(() => {
+		provided.clear();
+		consumed.clear();
+		calls.clear();
+	});
+	return {
+		get closed() {
+			return link.closed;
+		},
+		send(frame) {
+			if (frame.t === "shape") provided.set(frame.id, frame.contract);
+			let member = "";
+			if (frame.t === "state") member = `${provided.get(frame.hold) ?? frame.hold}.${frame.m}`;
+			if (frame.t === "call") member = `${consumed.get(frame.hold) ?? frame.hold}.${frame.member}`;
+			if (frame.t === "result") member = calls.get(frame.id) ?? String(frame.id);
+			const size = link.send(frame);
+			if (frame.t === "result") calls.delete(frame.id);
+			if (frame.t === "gone") provided.delete(frame.id);
+			if (frame.t === "release") consumed.delete(frame.id);
+			if (size !== void 0 && size > LARGE_FRAME_SIZE) notice(`large Chord frame: ${frame.t}${member ? ` ${member}` : ""}, encoded size ${size} (limit ${LARGE_FRAME_SIZE})`);
+			return size;
+		},
+		receive(handler) {
+			link.receive((frame) => {
+				if (frame.t === "shape") consumed.set(frame.id, frame.contract);
+				if (frame.t === "call") calls.set(frame.id, `${provided.get(frame.hold) ?? frame.hold}.${frame.member}`);
+				if (frame.t === "cancel") calls.delete(frame.id);
+				if (frame.t === "release") provided.delete(frame.id);
+				if (frame.t === "gone") consumed.delete(frame.id);
+				handler(frame);
+			});
+		},
+		onClose: (handler) => link.onClose(handler),
+		close: (reason) => link.close(reason)
+	};
+}
+//#endregion
+export { reportingLargeFrames };
+
+//# sourceMappingURL=largeFrameLink.mjs.map

package/dist/src/server/largeFrameLink.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"largeFrameLink.mjs","names":[],"sources":["../../../src/server/largeFrameLink.ts"],"sourcesContent":["import type { Link } from '@earendil-works/chord';\n\nconst LARGE_FRAME_SIZE = 32 * 1024 * 1024;\n\n/** Report encoded sizes without serializing or retaining frame payloads a second time. */\nexport function reportingLargeFrames(link: Link, notice: (message: string) => void): Link {\n  const provided = new Map<number, string>();\n  const consumed = new Map<number, string>();\n  const calls = new Map<number, string>();\n  link.onClose(() => {\n    provided.clear();\n    consumed.clear();\n    calls.clear();\n  });\n  return {\n    get closed() {\n      return link.closed;\n    },\n    send(frame) {\n      if (frame.t === 'shape') provided.set(frame.id, frame.contract);\n      let member = '';\n      if (frame.t === 'state') member = `${provided.get(frame.hold) ?? frame.hold}.${frame.m}`;\n      if (frame.t === 'call') member = `${consumed.get(frame.hold) ?? frame.hold}.${frame.member}`;\n      if (frame.t === 'result') member = calls.get(frame.id) ?? String(frame.id);\n      const size = link.send(frame);\n      if (frame.t === 'result') calls.delete(frame.id);\n      if (frame.t === 'gone') provided.delete(frame.id);\n      if (frame.t === 'release') consumed.delete(frame.id);\n      if (size !== undefined && size > LARGE_FRAME_SIZE)\n        notice(\n          `large Chord frame: ${frame.t}${member ? ` ${member}` : ''}, encoded size ${size} (limit ${LARGE_FRAME_SIZE})`,\n        );\n      return size;\n    },\n    receive(handler) {\n      link.receive((frame) => {\n        if (frame.t === 'shape') consumed.set(frame.id, frame.contract);\n        if (frame.t === 'call') calls.set(frame.id, `${provided.get(frame.hold) ?? frame.hold}.${frame.member}`);\n        if (frame.t === 'cancel') calls.delete(frame.id);\n        if (frame.t === 'release') provided.delete(frame.id);\n        if (frame.t === 'gone') consumed.delete(frame.id);\n        handler(frame);\n      });\n    },\n    onClose: (handler) => link.onClose(handler),\n    close: (reason) => link.close(reason),\n  };\n}\n"],"mappings":";AAEA,MAAM,mBAAmB;;AAGzB,SAAgB,qBAAqB,MAAY,QAAyC;CACxF,MAAM,2BAAW,IAAI,IAAoB;CACzC,MAAM,2BAAW,IAAI,IAAoB;CACzC,MAAM,wBAAQ,IAAI,IAAoB;CACtC,KAAK,cAAc;EACjB,SAAS,MAAM;EACf,SAAS,MAAM;EACf,MAAM,MAAM;CACd,CAAC;CACD,OAAO;EACL,IAAI,SAAS;GACX,OAAO,KAAK;EACd;EACA,KAAK,OAAO;GACV,IAAI,MAAM,MAAM,SAAS,SAAS,IAAI,MAAM,IAAI,MAAM,QAAQ;GAC9D,IAAI,SAAS;GACb,IAAI,MAAM,MAAM,SAAS,SAAS,GAAG,SAAS,IAAI,MAAM,IAAI,KAAK,MAAM,KAAK,GAAG,MAAM;GACrF,IAAI,MAAM,MAAM,QAAQ,SAAS,GAAG,SAAS,IAAI,MAAM,IAAI,KAAK,MAAM,KAAK,GAAG,MAAM;GACpF,IAAI,MAAM,MAAM,UAAU,SAAS,MAAM,IAAI,MAAM,EAAE,KAAK,OAAO,MAAM,EAAE;GACzE,MAAM,OAAO,KAAK,KAAK,KAAK;GAC5B,IAAI,MAAM,MAAM,UAAU,MAAM,OAAO,MAAM,EAAE;GAC/C,IAAI,MAAM,MAAM,QAAQ,SAAS,OAAO,MAAM,EAAE;GAChD,IAAI,MAAM,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE;GACnD,IAAI,SAAS,KAAA,KAAa,OAAO,kBAC/B,OACE,sBAAsB,MAAM,IAAI,SAAS,IAAI,WAAW,GAAG,iBAAiB,KAAK,UAAU,iBAAiB,EAC9G;GACF,OAAO;EACT;EACA,QAAQ,SAAS;GACf,KAAK,SAAS,UAAU;IACtB,IAAI,MAAM,MAAM,SAAS,SAAS,IAAI,MAAM,IAAI,MAAM,QAAQ;IAC9D,IAAI,MAAM,MAAM,QAAQ,MAAM,IAAI,MAAM,IAAI,GAAG,SAAS,IAAI,MAAM,IAAI,KAAK,MAAM,KAAK,GAAG,MAAM,QAAQ;IACvG,IAAI,MAAM,MAAM,UAAU,MAAM,OAAO,MAAM,EAAE;IAC/C,IAAI,MAAM,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE;IACnD,IAAI,MAAM,MAAM,QAAQ,SAAS,OAAO,MAAM,EAAE;IAChD,QAAQ,KAAK;GACf,CAAC;EACH;EACA,UAAU,YAAY,KAAK,QAAQ,OAAO;EAC1C,QAAQ,WAAW,KAAK,MAAM,MAAM;CACtC;AACF"}

package/dist/src/server/liveImport.cjs

@@ -1,7 +1,7 @@
 //#region src/server/liveImport.ts
 /** Longest a live package `import()` may take before it is abandoned and poisoned. */
 const LIVE_IMPORT_TIMEOUT_MS = 15e3;
-/** Longest a package factory (facet apply, MCP session, Pi factory) may take. */
+/** Longest a package factory (server plugin apply, MCP session, Pi factory) may take. */
 const LIVE_FACTORY_TIMEOUT_MS = 1e4;
 /**
 * Bounds one host-awaited step of package code.

package/dist/src/server/liveImport.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"liveImport.cjs","names":[],"sources":["../../../src/server/liveImport.ts"],"sourcesContent":["/** Longest a live package `import()` may take before it is abandoned and poisoned. */\nexport const LIVE_IMPORT_TIMEOUT_MS = 15_000;\n/** Longest a package factory (facet apply, MCP session, Pi factory) may take. */\nexport const LIVE_FACTORY_TIMEOUT_MS = 10_000;\n\n/**\n * Bounds one host-awaited step of package code.\n *\n * The abandoned promise keeps running, because a module cannot be cancelled; its late\n * rejection is observed here so it never surfaces as an unhandled rejection.\n */\nexport function withTimeout<T>(work: Promise<T>, ms: number, label: string): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const timeout = new Promise<never>((_, reject) => {\n    timer = setTimeout(() => reject(new Error(`${label} timed out after ${String(ms)} ms`)), ms);\n    timer.unref?.();\n  });\n  work.catch(() => undefined);\n  return Promise.race([work, timeout]).finally(() => clearTimeout(timer));\n}\n\nexport interface LiveImportGuard {\n  /** Defaults to `LIVE_IMPORT_TIMEOUT_MS`. */\n  readonly importTimeoutMs?: number;\n  /** Defaults to `LIVE_FACTORY_TIMEOUT_MS`. */\n  readonly factoryTimeoutMs?: number;\n  /**\n   * URLs whose import timed out or threw in this process. Shared across loaders so a bad\n   * package is skipped everywhere until its content, and so its URL, changes.\n   */\n  readonly poisoned?: Set<string>;\n}\n\n/** Imports a live package URL under a timeout, skipping and recording poisoned URLs. */\nexport async function guardedImport(\n  url: string,\n  importer: (url: string) => Promise<unknown>,\n  guard: LiveImportGuard,\n): Promise<unknown> {\n  if (guard.poisoned?.has(url))\n    throw new Error('skipped: this package content failed to load earlier and retries only after it changes');\n  try {\n    return await withTimeout(\n      Promise.resolve().then(() => importer(url)),\n      guard.importTimeoutMs ?? LIVE_IMPORT_TIMEOUT_MS,\n      'import',\n    );\n  } catch (error) {\n    guard.poisoned?.add(url);\n    throw error;\n  }\n}\n"],"mappings":";;AACA,MAAa,yBAAyB;;AAEtC,MAAa,0BAA0B;;;;;;;AAQvC,SAAgB,YAAe,MAAkB,IAAY,OAA2B;CACtF,IAAI;CACJ,MAAM,UAAU,IAAI,SAAgB,GAAG,WAAW;EAChD,QAAQ,iBAAiB,uBAAO,IAAI,MAAM,GAAG,MAAM,mBAAmB,OAAO,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;EAC3F,MAAM,QAAQ;CAChB,CAAC;CACD,KAAK,YAAY,KAAA,CAAS;CAC1B,OAAO,QAAQ,KAAK,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,cAAc,aAAa,KAAK,CAAC;AACxE;;AAeA,eAAsB,cACpB,KACA,UACA,OACkB;CAClB,IAAI,MAAM,UAAU,IAAI,GAAG,GACzB,MAAM,IAAI,MAAM,wFAAwF;CAC1G,IAAI;EACF,OAAO,MAAM,YACX,QAAQ,QAAQ,CAAC,CAAC,WAAW,SAAS,GAAG,CAAC,GAC1C,MAAM,mBAAA,MACN,QACF;CACF,SAAS,OAAO;EACd,MAAM,UAAU,IAAI,GAAG;EACvB,MAAM;CACR;AACF"}
+{"version":3,"file":"liveImport.cjs","names":[],"sources":["../../../src/server/liveImport.ts"],"sourcesContent":["/** Longest a live package `import()` may take before it is abandoned and poisoned. */\nexport const LIVE_IMPORT_TIMEOUT_MS = 15_000;\n/** Longest a package factory (server plugin apply, MCP session, Pi factory) may take. */\nexport const LIVE_FACTORY_TIMEOUT_MS = 10_000;\n\n/**\n * Bounds one host-awaited step of package code.\n *\n * The abandoned promise keeps running, because a module cannot be cancelled; its late\n * rejection is observed here so it never surfaces as an unhandled rejection.\n */\nexport function withTimeout<T>(work: Promise<T>, ms: number, label: string): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const timeout = new Promise<never>((_, reject) => {\n    timer = setTimeout(() => reject(new Error(`${label} timed out after ${String(ms)} ms`)), ms);\n    timer.unref?.();\n  });\n  work.catch(() => undefined);\n  return Promise.race([work, timeout]).finally(() => clearTimeout(timer));\n}\n\nexport interface LiveImportGuard {\n  /** Defaults to `LIVE_IMPORT_TIMEOUT_MS`. */\n  readonly importTimeoutMs?: number;\n  /** Defaults to `LIVE_FACTORY_TIMEOUT_MS`. */\n  readonly factoryTimeoutMs?: number;\n  /**\n   * URLs whose import timed out or threw in this process. Shared across loaders so a bad\n   * package is skipped everywhere until its content, and so its URL, changes.\n   */\n  readonly poisoned?: Set<string>;\n}\n\n/** Imports a live package URL under a timeout, skipping and recording poisoned URLs. */\nexport async function guardedImport(\n  url: string,\n  importer: (url: string) => Promise<unknown>,\n  guard: LiveImportGuard,\n): Promise<unknown> {\n  if (guard.poisoned?.has(url))\n    throw new Error('skipped: this package content failed to load earlier and retries only after it changes');\n  try {\n    return await withTimeout(\n      Promise.resolve().then(() => importer(url)),\n      guard.importTimeoutMs ?? LIVE_IMPORT_TIMEOUT_MS,\n      'import',\n    );\n  } catch (error) {\n    guard.poisoned?.add(url);\n    throw error;\n  }\n}\n"],"mappings":";;AACA,MAAa,yBAAyB;;AAEtC,MAAa,0BAA0B;;;;;;;AAQvC,SAAgB,YAAe,MAAkB,IAAY,OAA2B;CACtF,IAAI;CACJ,MAAM,UAAU,IAAI,SAAgB,GAAG,WAAW;EAChD,QAAQ,iBAAiB,uBAAO,IAAI,MAAM,GAAG,MAAM,mBAAmB,OAAO,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;EAC3F,MAAM,QAAQ;CAChB,CAAC;CACD,KAAK,YAAY,KAAA,CAAS;CAC1B,OAAO,QAAQ,KAAK,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,cAAc,aAAa,KAAK,CAAC;AACxE;;AAeA,eAAsB,cACpB,KACA,UACA,OACkB;CAClB,IAAI,MAAM,UAAU,IAAI,GAAG,GACzB,MAAM,IAAI,MAAM,wFAAwF;CAC1G,IAAI;EACF,OAAO,MAAM,YACX,QAAQ,QAAQ,CAAC,CAAC,WAAW,SAAS,GAAG,CAAC,GAC1C,MAAM,mBAAA,MACN,QACF;CACF,SAAS,OAAO;EACd,MAAM,UAAU,IAAI,GAAG;EACvB,MAAM;CACR;AACF"}

package/dist/src/server/liveImport.d.mts

@@ -1,7 +1,7 @@
 //#region src/server/liveImport.d.ts
 /** Longest a live package `import()` may take before it is abandoned and poisoned. */
 export declare const LIVE_IMPORT_TIMEOUT_MS = 15000;
-/** Longest a package factory (facet apply, MCP session, Pi factory) may take. */
+/** Longest a package factory (server plugin apply, MCP session, Pi factory) may take. */
 export declare const LIVE_FACTORY_TIMEOUT_MS = 10000;
 /**
  * Bounds one host-awaited step of package code.

package/dist/src/server/liveImport.mjs

@@ -1,7 +1,7 @@
 //#region src/server/liveImport.ts
 /** Longest a live package `import()` may take before it is abandoned and poisoned. */
 const LIVE_IMPORT_TIMEOUT_MS = 15e3;
-/** Longest a package factory (facet apply, MCP session, Pi factory) may take. */
+/** Longest a package factory (server plugin apply, MCP session, Pi factory) may take. */
 const LIVE_FACTORY_TIMEOUT_MS = 1e4;
 /**
 * Bounds one host-awaited step of package code.

package/dist/src/server/liveImport.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"liveImport.mjs","names":[],"sources":["../../../src/server/liveImport.ts"],"sourcesContent":["/** Longest a live package `import()` may take before it is abandoned and poisoned. */\nexport const LIVE_IMPORT_TIMEOUT_MS = 15_000;\n/** Longest a package factory (facet apply, MCP session, Pi factory) may take. */\nexport const LIVE_FACTORY_TIMEOUT_MS = 10_000;\n\n/**\n * Bounds one host-awaited step of package code.\n *\n * The abandoned promise keeps running, because a module cannot be cancelled; its late\n * rejection is observed here so it never surfaces as an unhandled rejection.\n */\nexport function withTimeout<T>(work: Promise<T>, ms: number, label: string): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const timeout = new Promise<never>((_, reject) => {\n    timer = setTimeout(() => reject(new Error(`${label} timed out after ${String(ms)} ms`)), ms);\n    timer.unref?.();\n  });\n  work.catch(() => undefined);\n  return Promise.race([work, timeout]).finally(() => clearTimeout(timer));\n}\n\nexport interface LiveImportGuard {\n  /** Defaults to `LIVE_IMPORT_TIMEOUT_MS`. */\n  readonly importTimeoutMs?: number;\n  /** Defaults to `LIVE_FACTORY_TIMEOUT_MS`. */\n  readonly factoryTimeoutMs?: number;\n  /**\n   * URLs whose import timed out or threw in this process. Shared across loaders so a bad\n   * package is skipped everywhere until its content, and so its URL, changes.\n   */\n  readonly poisoned?: Set<string>;\n}\n\n/** Imports a live package URL under a timeout, skipping and recording poisoned URLs. */\nexport async function guardedImport(\n  url: string,\n  importer: (url: string) => Promise<unknown>,\n  guard: LiveImportGuard,\n): Promise<unknown> {\n  if (guard.poisoned?.has(url))\n    throw new Error('skipped: this package content failed to load earlier and retries only after it changes');\n  try {\n    return await withTimeout(\n      Promise.resolve().then(() => importer(url)),\n      guard.importTimeoutMs ?? LIVE_IMPORT_TIMEOUT_MS,\n      'import',\n    );\n  } catch (error) {\n    guard.poisoned?.add(url);\n    throw error;\n  }\n}\n"],"mappings":";;AACA,MAAa,yBAAyB;;AAEtC,MAAa,0BAA0B;;;;;;;AAQvC,SAAgB,YAAe,MAAkB,IAAY,OAA2B;CACtF,IAAI;CACJ,MAAM,UAAU,IAAI,SAAgB,GAAG,WAAW;EAChD,QAAQ,iBAAiB,uBAAO,IAAI,MAAM,GAAG,MAAM,mBAAmB,OAAO,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;EAC3F,MAAM,QAAQ;CAChB,CAAC;CACD,KAAK,YAAY,KAAA,CAAS;CAC1B,OAAO,QAAQ,KAAK,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,cAAc,aAAa,KAAK,CAAC;AACxE;;AAeA,eAAsB,cACpB,KACA,UACA,OACkB;CAClB,IAAI,MAAM,UAAU,IAAI,GAAG,GACzB,MAAM,IAAI,MAAM,wFAAwF;CAC1G,IAAI;EACF,OAAO,MAAM,YACX,QAAQ,QAAQ,CAAC,CAAC,WAAW,SAAS,GAAG,CAAC,GAC1C,MAAM,mBAAA,MACN,QACF;CACF,SAAS,OAAO;EACd,MAAM,UAAU,IAAI,GAAG;EACvB,MAAM;CACR;AACF"}
+{"version":3,"file":"liveImport.mjs","names":[],"sources":["../../../src/server/liveImport.ts"],"sourcesContent":["/** Longest a live package `import()` may take before it is abandoned and poisoned. */\nexport const LIVE_IMPORT_TIMEOUT_MS = 15_000;\n/** Longest a package factory (server plugin apply, MCP session, Pi factory) may take. */\nexport const LIVE_FACTORY_TIMEOUT_MS = 10_000;\n\n/**\n * Bounds one host-awaited step of package code.\n *\n * The abandoned promise keeps running, because a module cannot be cancelled; its late\n * rejection is observed here so it never surfaces as an unhandled rejection.\n */\nexport function withTimeout<T>(work: Promise<T>, ms: number, label: string): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const timeout = new Promise<never>((_, reject) => {\n    timer = setTimeout(() => reject(new Error(`${label} timed out after ${String(ms)} ms`)), ms);\n    timer.unref?.();\n  });\n  work.catch(() => undefined);\n  return Promise.race([work, timeout]).finally(() => clearTimeout(timer));\n}\n\nexport interface LiveImportGuard {\n  /** Defaults to `LIVE_IMPORT_TIMEOUT_MS`. */\n  readonly importTimeoutMs?: number;\n  /** Defaults to `LIVE_FACTORY_TIMEOUT_MS`. */\n  readonly factoryTimeoutMs?: number;\n  /**\n   * URLs whose import timed out or threw in this process. Shared across loaders so a bad\n   * package is skipped everywhere until its content, and so its URL, changes.\n   */\n  readonly poisoned?: Set<string>;\n}\n\n/** Imports a live package URL under a timeout, skipping and recording poisoned URLs. */\nexport async function guardedImport(\n  url: string,\n  importer: (url: string) => Promise<unknown>,\n  guard: LiveImportGuard,\n): Promise<unknown> {\n  if (guard.poisoned?.has(url))\n    throw new Error('skipped: this package content failed to load earlier and retries only after it changes');\n  try {\n    return await withTimeout(\n      Promise.resolve().then(() => importer(url)),\n      guard.importTimeoutMs ?? LIVE_IMPORT_TIMEOUT_MS,\n      'import',\n    );\n  } catch (error) {\n    guard.poisoned?.add(url);\n    throw error;\n  }\n}\n"],"mappings":";;AACA,MAAa,yBAAyB;;AAEtC,MAAa,0BAA0B;;;;;;;AAQvC,SAAgB,YAAe,MAAkB,IAAY,OAA2B;CACtF,IAAI;CACJ,MAAM,UAAU,IAAI,SAAgB,GAAG,WAAW;EAChD,QAAQ,iBAAiB,uBAAO,IAAI,MAAM,GAAG,MAAM,mBAAmB,OAAO,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;EAC3F,MAAM,QAAQ;CAChB,CAAC;CACD,KAAK,YAAY,KAAA,CAAS;CAC1B,OAAO,QAAQ,KAAK,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,cAAc,aAAa,KAAK,CAAC;AACxE;;AAeA,eAAsB,cACpB,KACA,UACA,OACkB;CAClB,IAAI,MAAM,UAAU,IAAI,GAAG,GACzB,MAAM,IAAI,MAAM,wFAAwF;CAC1G,IAAI;EACF,OAAO,MAAM,YACX,QAAQ,QAAQ,CAAC,CAAC,WAAW,SAAS,GAAG,CAAC,GAC1C,MAAM,mBAAA,MACN,QACF;CACF,SAAS,OAAO;EACd,MAAM,UAAU,IAAI,GAAG;EACvB,MAAM;CACR;AACF"}

package/dist/src/server/mcpBundleLoader.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mcpBundleLoader.cjs","names":["guardedImport","withTimeout"],"sources":["../../../src/server/mcpBundleLoader.ts"],"sourcesContent":["import type { DoomMcpBundleEntry } from '../schemas/mcpBundle';\nimport type { DoomMcpPluginDefinition, DoomMcpUiResource } from '../schemas/mcpFacet';\nimport { guardedImport, LIVE_FACTORY_TIMEOUT_MS, type LiveImportGuard, withTimeout } from './liveImport';\n/** The parts of an MCP declaration a live session host reads. */\nexport type McpPluginDeclaration = Omit<DoomMcpBundleEntry, 'sha256'> & { readonly sha256?: string };\n\nexport interface LoadedMcpPlugin {\n  readonly declaration: McpPluginDeclaration;\n  readonly plugin: DoomMcpPluginDefinition;\n}\n\nfunction isMcpPlugin(value: unknown): value is DoomMcpPluginDefinition {\n  if (typeof value !== 'object' || value === null) return false;\n  const candidate = value as Partial<DoomMcpPluginDefinition>;\n  return (\n    typeof candidate.name === 'string' &&\n    (typeof candidate.session === 'function' || typeof candidate.session === 'object')\n  );\n}\n\n/** Points a package's widget-tagged tools at the composed UI resource and serves it with them. */\nfunction withPackageWidgets(\n  original: DoomMcpPluginDefinition,\n  widgets: readonly string[] | undefined,\n  ui: DoomMcpUiResource | undefined,\n): DoomMcpPluginDefinition {\n  const allowedWidgets = new Set(widgets ?? []);\n  if (ui === undefined || allowedWidgets.size === 0) return original;\n  return {\n    ...original,\n    async session(context) {\n      const scope = typeof original.session === 'function' ? await original.session(context) : original.session;\n      const { tools: contributedTools, uiResources: contributedResources, ...rest } = scope;\n      let usesWidget = false;\n      const tools = contributedTools?.map((tool) => {\n        const widget = tool._meta?.['po/widget'];\n        if (widget === undefined) return tool;\n        if (typeof widget !== 'string' || !allowedWidgets.has(widget))\n          throw new Error(`MCP tool '${tool.name}' references a widget not owned by its package`);\n        usesWidget = true;\n        return {\n          ...tool,\n          _meta: {\n            ...tool._meta,\n            ui: { ...tool._meta?.ui, resourceUri: ui.uri, visibility: tool._meta?.ui?.visibility ?? ['model'] },\n            'openai/outputTemplate': ui.uri,\n          },\n        };\n      });\n      return {\n        ...rest,\n        ...(tools === undefined ? {} : { tools }),\n        uiResources: [...(contributedResources ?? []), ...(usesWidget ? [ui] : [])],\n      };\n    },\n  };\n}\n\n/** The served MCP App resource for composed package widget HTML. */\nexport function mcpUiResource(html: string, sha256: string): DoomMcpUiResource {\n  return {\n    uri: `ui://po/tools/${sha256}/index.html`,\n    name: 'po-tool-widgets',\n    description: 'Package-owned tool widgets composed by po.',\n    mimeType: 'text/html;profile=mcp-app',\n    _meta: {\n      ui: { csp: { connectDomains: [], resourceDomains: [] }, prefersBorder: true },\n      'openai/widgetPrefersBorder': true,\n      'openai/widgetCSP': { connect_domains: [], resource_domains: [] },\n    },\n    read: () => html,\n  };\n}\n\n/** One live MCP plugin: its declaration plus the URL its package module imports from. */\nexport interface LiveMcpPluginEntry extends McpPluginDeclaration {\n  /** Content-addressed import URL for `module`, see the po server's `packageUrl`. */\n  readonly url: string;\n}\n\nexport interface LoadMcpPluginsOptions extends LiveImportGuard {\n  readonly entries: readonly LiveMcpPluginEntry[];\n  readonly majorMode: string;\n  readonly activeLayers: readonly string[];\n  readonly onNotice?: (message: string) => void;\n  /** Retain admitted candidates so a live session can follow selection changes. */\n  readonly retainCandidates?: boolean;\n  /** Composed package widget UI, served by tools whose package owns the widget. */\n  readonly uiResource?: DoomMcpUiResource;\n  /** Test seam; defaults to native `import()`. */\n  readonly importer?: (url: string) => Promise<unknown>;\n}\n\nexport interface LoadedMcpPlugins {\n  readonly plugins: readonly LoadedMcpPlugin[];\n}\n\n/**\n * Live reader: imports each package's built MCP entry from its content-addressed URL.\n *\n * Same eligibility rules as `loadMcpBundle`: an ineligible candidate is kept only with\n * `retainCandidates`, and a failure is fatal only for an eligible plugin. Package widgets\n * resolve to `uiResource`, which the po server builds per content key. Each import\n * is bounded and poisoned on failure (see `guardedImport`), and each `session` factory call\n * is bounded by `factoryTimeoutMs`.\n */\nexport async function loadMcpPlugins(options: LoadMcpPluginsOptions): Promise<LoadedMcpPlugins> {\n  const importer = options.importer ?? ((url: string) => import(url));\n  const factoryTimeoutMs = options.factoryTimeoutMs ?? LIVE_FACTORY_TIMEOUT_MS;\n  const plugins: LoadedMcpPlugin[] = [];\n  for (const { url, ...declaration } of options.entries) {\n    const eligible = declaration.owners.some(\n      (owner) =>\n        owner.majorMode === options.majorMode &&\n        (owner.layer === 'default' || options.activeLayers.includes(owner.layer)),\n    );\n    if (!eligible && options.retainCandidates !== true) continue;\n    try {\n      const imported = (await guardedImport(url, importer, options)) as { default?: unknown } | undefined;\n      if (!isMcpPlugin(imported?.default)) throw new Error('default export is not an MCP plugin');\n      const original = withPackageWidgets(imported.default, declaration.widgets, options.uiResource);\n      const session = original.session;\n      const label = `MCP plugin '${declaration.packageName}' session`;\n      plugins.push({\n        declaration,\n        plugin:\n          typeof session === 'function'\n            ? {\n                ...original,\n                session: (context) =>\n                  withTimeout(\n                    Promise.resolve().then(() => session.call(original, context)),\n                    factoryTimeoutMs,\n                    label,\n                  ),\n              }\n            : original,\n      });\n    } catch (error) {\n      const message = `MCP plugin '${declaration.packageName}' could not load (${error instanceof Error ? error.message : String(error)})`;\n      if (eligible) throw new Error(message, { cause: error });\n      options.onNotice?.(message);\n    }\n  }\n  return { plugins };\n}\n"],"mappings":";;AAWA,SAAS,YAAY,OAAkD;CACrE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAClB,OACE,OAAO,UAAU,SAAS,aACzB,OAAO,UAAU,YAAY,cAAc,OAAO,UAAU,YAAY;AAE7E;;AAGA,SAAS,mBACP,UACA,SACA,IACyB;CACzB,MAAM,iBAAiB,IAAI,IAAI,WAAW,CAAC,CAAC;CAC5C,IAAI,OAAO,KAAA,KAAa,eAAe,SAAS,GAAG,OAAO;CAC1D,OAAO;EACL,GAAG;EACH,MAAM,QAAQ,SAAS;GAErB,MAAM,EAAE,OAAO,kBAAkB,aAAa,sBAAsB,GAAG,SADzD,OAAO,SAAS,YAAY,aAAa,MAAM,SAAS,QAAQ,OAAO,IAAI,SAAS;GAElG,IAAI,aAAa;GACjB,MAAM,QAAQ,kBAAkB,KAAK,SAAS;IAC5C,MAAM,SAAS,KAAK,QAAQ;IAC5B,IAAI,WAAW,KAAA,GAAW,OAAO;IACjC,IAAI,OAAO,WAAW,YAAY,CAAC,eAAe,IAAI,MAAM,GAC1D,MAAM,IAAI,MAAM,aAAa,KAAK,KAAK,+CAA+C;IACxF,aAAa;IACb,OAAO;KACL,GAAG;KACH,OAAO;MACL,GAAG,KAAK;MACR,IAAI;OAAE,GAAG,KAAK,OAAO;OAAI,aAAa,GAAG;OAAK,YAAY,KAAK,OAAO,IAAI,cAAc,CAAC,OAAO;MAAE;MAClG,yBAAyB,GAAG;KAC9B;IACF;GACF,CAAC;GACD,OAAO;IACL,GAAG;IACH,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,aAAa,CAAC,GAAI,wBAAwB,CAAC,GAAI,GAAI,aAAa,CAAC,EAAE,IAAI,CAAC,CAAE;GAC5E;EACF;CACF;AACF;;AAGA,SAAgB,cAAc,MAAc,QAAmC;CAC7E,OAAO;EACL,KAAK,iBAAiB,OAAO;EAC7B,MAAM;EACN,aAAa;EACb,UAAU;EACV,OAAO;GACL,IAAI;IAAE,KAAK;KAAE,gBAAgB,CAAC;KAAG,iBAAiB,CAAC;IAAE;IAAG,eAAe;GAAK;GAC5E,8BAA8B;GAC9B,oBAAoB;IAAE,iBAAiB,CAAC;IAAG,kBAAkB,CAAC;GAAE;EAClE;EACA,YAAY;CACd;AACF;;;;;;;;;;AAkCA,eAAsB,eAAe,SAA2D;CAC9F,MAAM,WAAW,QAAQ,cAAc,QAAgB,OAAO;CAC9D,MAAM,mBAAmB,QAAQ,oBAAA;CACjC,MAAM,UAA6B,CAAC;CACpC,KAAK,MAAM,EAAE,KAAK,GAAG,iBAAiB,QAAQ,SAAS;EACrD,MAAM,WAAW,YAAY,OAAO,MACjC,UACC,MAAM,cAAc,QAAQ,cAC3B,MAAM,UAAU,aAAa,QAAQ,aAAa,SAAS,MAAM,KAAK,EAC3E;EACA,IAAI,CAAC,YAAY,QAAQ,qBAAqB,MAAM;EACpD,IAAI;GACF,MAAM,WAAY,MAAMA,mBAAAA,cAAc,KAAK,UAAU,OAAO;GAC5D,IAAI,CAAC,YAAY,UAAU,OAAO,GAAG,MAAM,IAAI,MAAM,qCAAqC;GAC1F,MAAM,WAAW,mBAAmB,SAAS,SAAS,YAAY,SAAS,QAAQ,UAAU;GAC7F,MAAM,UAAU,SAAS;GACzB,MAAM,QAAQ,eAAe,YAAY,YAAY;GACrD,QAAQ,KAAK;IACX;IACA,QACE,OAAO,YAAY,aACf;KACE,GAAG;KACH,UAAU,YACRC,mBAAAA,YACE,QAAQ,QAAQ,CAAC,CAAC,WAAW,QAAQ,KAAK,UAAU,OAAO,CAAC,GAC5D,kBACA,KACF;IACJ,IACA;GACR,CAAC;EACH,SAAS,OAAO;GACd,MAAM,UAAU,eAAe,YAAY,YAAY,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;GAClI,IAAI,UAAU,MAAM,IAAI,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;GACvD,QAAQ,WAAW,OAAO;EAC5B;CACF;CACA,OAAO,EAAE,QAAQ;AACnB"}
+{"version":3,"file":"mcpBundleLoader.cjs","names":["guardedImport","withTimeout"],"sources":["../../../src/server/mcpBundleLoader.ts"],"sourcesContent":["import type { PoMcpBundleEntry } from '../schemas/mcpBundle';\nimport type { PoMcpPluginDefinition, PoMcpUiResource } from '../schemas/mcpFacet';\nimport { guardedImport, LIVE_FACTORY_TIMEOUT_MS, type LiveImportGuard, withTimeout } from './liveImport';\n/** The parts of an MCP declaration a live session host reads. */\nexport type McpPluginDeclaration = Omit<PoMcpBundleEntry, 'sha256'> & { readonly sha256?: string };\n\nexport interface LoadedMcpPlugin {\n  readonly declaration: McpPluginDeclaration;\n  readonly plugin: PoMcpPluginDefinition;\n}\n\nfunction isMcpPlugin(value: unknown): value is PoMcpPluginDefinition {\n  if (typeof value !== 'object' || value === null) return false;\n  const candidate = value as Partial<PoMcpPluginDefinition>;\n  return (\n    typeof candidate.name === 'string' &&\n    (typeof candidate.session === 'function' || typeof candidate.session === 'object')\n  );\n}\n\n/** Points a package's widget-tagged tools at the composed UI resource and serves it with them. */\nfunction withPackageWidgets(\n  original: PoMcpPluginDefinition,\n  widgets: readonly string[] | undefined,\n  ui: PoMcpUiResource | undefined,\n): PoMcpPluginDefinition {\n  const allowedWidgets = new Set(widgets ?? []);\n  if (ui === undefined || allowedWidgets.size === 0) return original;\n  return {\n    ...original,\n    async session(context) {\n      const scope = typeof original.session === 'function' ? await original.session(context) : original.session;\n      const { tools: contributedTools, uiResources: contributedResources, ...rest } = scope;\n      let usesWidget = false;\n      const tools = contributedTools?.map((tool) => {\n        const widget = tool._meta?.['po/widget'];\n        if (widget === undefined) return tool;\n        if (typeof widget !== 'string' || !allowedWidgets.has(widget))\n          throw new Error(`MCP tool '${tool.name}' references a widget not owned by its package`);\n        usesWidget = true;\n        return {\n          ...tool,\n          _meta: {\n            ...tool._meta,\n            ui: { ...tool._meta?.ui, resourceUri: ui.uri, visibility: tool._meta?.ui?.visibility ?? ['model'] },\n            'openai/outputTemplate': ui.uri,\n          },\n        };\n      });\n      return {\n        ...rest,\n        ...(tools === undefined ? {} : { tools }),\n        uiResources: [...(contributedResources ?? []), ...(usesWidget ? [ui] : [])],\n      };\n    },\n  };\n}\n\n/** The served MCP App resource for composed package widget HTML. */\nexport function mcpUiResource(html: string, sha256: string): PoMcpUiResource {\n  return {\n    uri: `ui://po/tools/${sha256}/index.html`,\n    name: 'po-tool-widgets',\n    description: 'Package-owned tool widgets composed by po.',\n    mimeType: 'text/html;profile=mcp-app',\n    _meta: {\n      ui: { csp: { connectDomains: [], resourceDomains: [] }, prefersBorder: true },\n      'openai/widgetPrefersBorder': true,\n      'openai/widgetCSP': { connect_domains: [], resource_domains: [] },\n    },\n    read: () => html,\n  };\n}\n\n/** One live MCP plugin: its declaration plus the URL its package module imports from. */\nexport interface LiveMcpPluginEntry extends McpPluginDeclaration {\n  /** Content-addressed import URL for `module`, see the po server's `packageUrl`. */\n  readonly url: string;\n}\n\nexport interface LoadMcpPluginsOptions extends LiveImportGuard {\n  readonly entries: readonly LiveMcpPluginEntry[];\n  readonly majorMode: string;\n  readonly activeLayers: readonly string[];\n  readonly onNotice?: (message: string) => void;\n  /** Retain admitted candidates so a live session can follow selection changes. */\n  readonly retainCandidates?: boolean;\n  /** Composed package widget UI, served by tools whose package owns the widget. */\n  readonly uiResource?: PoMcpUiResource;\n  /** Test seam; defaults to native `import()`. */\n  readonly importer?: (url: string) => Promise<unknown>;\n}\n\nexport interface LoadedMcpPlugins {\n  readonly plugins: readonly LoadedMcpPlugin[];\n}\n\n/**\n * Live reader: imports each package's built MCP entry from its content-addressed URL.\n *\n * Same eligibility rules as `loadMcpBundle`: an ineligible candidate is kept only with\n * `retainCandidates`, and a failure is fatal only for an eligible plugin. Package widgets\n * resolve to `uiResource`, which the po server builds per content key. Each import\n * is bounded and poisoned on failure (see `guardedImport`), and each `session` factory call\n * is bounded by `factoryTimeoutMs`.\n */\nexport async function loadMcpPlugins(options: LoadMcpPluginsOptions): Promise<LoadedMcpPlugins> {\n  const importer = options.importer ?? ((url: string) => import(url));\n  const factoryTimeoutMs = options.factoryTimeoutMs ?? LIVE_FACTORY_TIMEOUT_MS;\n  const plugins: LoadedMcpPlugin[] = [];\n  for (const { url, ...declaration } of options.entries) {\n    const eligible = declaration.owners.some(\n      (owner) =>\n        owner.majorMode === options.majorMode &&\n        (owner.layer === 'default' || options.activeLayers.includes(owner.layer)),\n    );\n    if (!eligible && options.retainCandidates !== true) continue;\n    try {\n      const imported = (await guardedImport(url, importer, options)) as { default?: unknown } | undefined;\n      if (!isMcpPlugin(imported?.default)) throw new Error('default export is not an MCP plugin');\n      const original = withPackageWidgets(imported.default, declaration.widgets, options.uiResource);\n      const session = original.session;\n      const label = `MCP plugin '${declaration.packageName}' session`;\n      plugins.push({\n        declaration,\n        plugin:\n          typeof session === 'function'\n            ? {\n                ...original,\n                session: (context) =>\n                  withTimeout(\n                    Promise.resolve().then(() => session.call(original, context)),\n                    factoryTimeoutMs,\n                    label,\n                  ),\n              }\n            : original,\n      });\n    } catch (error) {\n      const message = `MCP plugin '${declaration.packageName}' could not load (${error instanceof Error ? error.message : String(error)})`;\n      if (eligible) throw new Error(message, { cause: error });\n      options.onNotice?.(message);\n    }\n  }\n  return { plugins };\n}\n"],"mappings":";;AAWA,SAAS,YAAY,OAAgD;CACnE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAClB,OACE,OAAO,UAAU,SAAS,aACzB,OAAO,UAAU,YAAY,cAAc,OAAO,UAAU,YAAY;AAE7E;;AAGA,SAAS,mBACP,UACA,SACA,IACuB;CACvB,MAAM,iBAAiB,IAAI,IAAI,WAAW,CAAC,CAAC;CAC5C,IAAI,OAAO,KAAA,KAAa,eAAe,SAAS,GAAG,OAAO;CAC1D,OAAO;EACL,GAAG;EACH,MAAM,QAAQ,SAAS;GAErB,MAAM,EAAE,OAAO,kBAAkB,aAAa,sBAAsB,GAAG,SADzD,OAAO,SAAS,YAAY,aAAa,MAAM,SAAS,QAAQ,OAAO,IAAI,SAAS;GAElG,IAAI,aAAa;GACjB,MAAM,QAAQ,kBAAkB,KAAK,SAAS;IAC5C,MAAM,SAAS,KAAK,QAAQ;IAC5B,IAAI,WAAW,KAAA,GAAW,OAAO;IACjC,IAAI,OAAO,WAAW,YAAY,CAAC,eAAe,IAAI,MAAM,GAC1D,MAAM,IAAI,MAAM,aAAa,KAAK,KAAK,+CAA+C;IACxF,aAAa;IACb,OAAO;KACL,GAAG;KACH,OAAO;MACL,GAAG,KAAK;MACR,IAAI;OAAE,GAAG,KAAK,OAAO;OAAI,aAAa,GAAG;OAAK,YAAY,KAAK,OAAO,IAAI,cAAc,CAAC,OAAO;MAAE;MAClG,yBAAyB,GAAG;KAC9B;IACF;GACF,CAAC;GACD,OAAO;IACL,GAAG;IACH,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,aAAa,CAAC,GAAI,wBAAwB,CAAC,GAAI,GAAI,aAAa,CAAC,EAAE,IAAI,CAAC,CAAE;GAC5E;EACF;CACF;AACF;;AAGA,SAAgB,cAAc,MAAc,QAAiC;CAC3E,OAAO;EACL,KAAK,iBAAiB,OAAO;EAC7B,MAAM;EACN,aAAa;EACb,UAAU;EACV,OAAO;GACL,IAAI;IAAE,KAAK;KAAE,gBAAgB,CAAC;KAAG,iBAAiB,CAAC;IAAE;IAAG,eAAe;GAAK;GAC5E,8BAA8B;GAC9B,oBAAoB;IAAE,iBAAiB,CAAC;IAAG,kBAAkB,CAAC;GAAE;EAClE;EACA,YAAY;CACd;AACF;;;;;;;;;;AAkCA,eAAsB,eAAe,SAA2D;CAC9F,MAAM,WAAW,QAAQ,cAAc,QAAgB,OAAO;CAC9D,MAAM,mBAAmB,QAAQ,oBAAA;CACjC,MAAM,UAA6B,CAAC;CACpC,KAAK,MAAM,EAAE,KAAK,GAAG,iBAAiB,QAAQ,SAAS;EACrD,MAAM,WAAW,YAAY,OAAO,MACjC,UACC,MAAM,cAAc,QAAQ,cAC3B,MAAM,UAAU,aAAa,QAAQ,aAAa,SAAS,MAAM,KAAK,EAC3E;EACA,IAAI,CAAC,YAAY,QAAQ,qBAAqB,MAAM;EACpD,IAAI;GACF,MAAM,WAAY,MAAMA,mBAAAA,cAAc,KAAK,UAAU,OAAO;GAC5D,IAAI,CAAC,YAAY,UAAU,OAAO,GAAG,MAAM,IAAI,MAAM,qCAAqC;GAC1F,MAAM,WAAW,mBAAmB,SAAS,SAAS,YAAY,SAAS,QAAQ,UAAU;GAC7F,MAAM,UAAU,SAAS;GACzB,MAAM,QAAQ,eAAe,YAAY,YAAY;GACrD,QAAQ,KAAK;IACX;IACA,QACE,OAAO,YAAY,aACf;KACE,GAAG;KACH,UAAU,YACRC,mBAAAA,YACE,QAAQ,QAAQ,CAAC,CAAC,WAAW,QAAQ,KAAK,UAAU,OAAO,CAAC,GAC5D,kBACA,KACF;IACJ,IACA;GACR,CAAC;EACH,SAAS,OAAO;GACd,MAAM,UAAU,eAAe,YAAY,YAAY,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;GAClI,IAAI,UAAU,MAAM,IAAI,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;GACvD,QAAQ,WAAW,OAAO;EAC5B;CACF;CACA,OAAO,EAAE,QAAQ;AACnB"}

package/dist/src/server/mcpBundleLoader.d.mts

@@ -1,17 +1,17 @@
-import { DoomMcpPluginDefinition, DoomMcpUiResource } from "../schemas/mcpFacet.mjs";
+import { PoMcpPluginDefinition, PoMcpUiResource } from "../schemas/mcpFacet.mjs";
 import { LiveImportGuard } from "./liveImport.mjs";
-import { DoomMcpBundleEntry } from "../schemas/mcpBundle.mjs";
+import { PoMcpBundleEntry } from "../schemas/mcpBundle.mjs";
 //#region src/server/mcpBundleLoader.d.ts
 /** The parts of an MCP declaration a live session host reads. */
-export type McpPluginDeclaration = Omit<DoomMcpBundleEntry, 'sha256'> & {
+export type McpPluginDeclaration = Omit<PoMcpBundleEntry, 'sha256'> & {
   readonly sha256?: string;
 };
 export interface LoadedMcpPlugin {
   readonly declaration: McpPluginDeclaration;
-  readonly plugin: DoomMcpPluginDefinition;
+  readonly plugin: PoMcpPluginDefinition;
 }
 /** The served MCP App resource for composed package widget HTML. */
-export declare function mcpUiResource(html: string, sha256: string): DoomMcpUiResource;
+export declare function mcpUiResource(html: string, sha256: string): PoMcpUiResource;
 /** One live MCP plugin: its declaration plus the URL its package module imports from. */
 export interface LiveMcpPluginEntry extends McpPluginDeclaration {
   /** Content-addressed import URL for `module`, see the po server's `packageUrl`. */
@@ -25,7 +25,7 @@ export interface LoadMcpPluginsOptions extends LiveImportGuard {
   /** Retain admitted candidates so a live session can follow selection changes. */
   readonly retainCandidates?: boolean;
   /** Composed package widget UI, served by tools whose package owns the widget. */
-  readonly uiResource?: DoomMcpUiResource;
+  readonly uiResource?: PoMcpUiResource;
   /** Test seam; defaults to native `import()`. */
   readonly importer?: (url: string) => Promise<unknown>;
 }

package/dist/src/server/mcpBundleLoader.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"mcpBundleLoader.d.mts","names":[],"sources":["../../../src/server/mcpBundleLoader.ts"],"mappings":";;;;;YAIY,uBAAuB,KAAK;WAA2C;;iBAElE;WACN,aAAa;WACb,QAAQ;;;wBAmDH,cAAc,cAAc,iBAAiB;;iBAgB5C,2BAA2B;;WAEjC;;iBAGM,8BAA8B;WACpC,kBAAkB;WAClB;WACA;WACA,YAAY;;WAEZ;;WAEA,aAAa;;WAEb,YAAY,gBAAgB;;iBAGtB;WACN,kBAAkB;;;;;;;;;;;wBAYP,eAAe,SAAS,wBAAwB,QAAQ"}
+{"version":3,"file":"mcpBundleLoader.d.mts","names":[],"sources":["../../../src/server/mcpBundleLoader.ts"],"mappings":";;;;;YAIY,uBAAuB,KAAK;WAAyC;;iBAEhE;WACN,aAAa;WACb,QAAQ;;;wBAmDH,cAAc,cAAc,iBAAiB;;iBAgB5C,2BAA2B;;WAEjC;;iBAGM,8BAA8B;WACpC,kBAAkB;WAClB;WACA;WACA,YAAY;;WAEZ;;WAEA,aAAa;;WAEb,YAAY,gBAAgB;;iBAGtB;WACN,kBAAkB;;;;;;;;;;;wBAYP,eAAe,SAAS,wBAAwB,QAAQ"}

package/dist/src/server/mcpBundleLoader.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mcpBundleLoader.mjs","names":[],"sources":["../../../src/server/mcpBundleLoader.ts"],"sourcesContent":["import type { DoomMcpBundleEntry } from '../schemas/mcpBundle';\nimport type { DoomMcpPluginDefinition, DoomMcpUiResource } from '../schemas/mcpFacet';\nimport { guardedImport, LIVE_FACTORY_TIMEOUT_MS, type LiveImportGuard, withTimeout } from './liveImport';\n/** The parts of an MCP declaration a live session host reads. */\nexport type McpPluginDeclaration = Omit<DoomMcpBundleEntry, 'sha256'> & { readonly sha256?: string };\n\nexport interface LoadedMcpPlugin {\n  readonly declaration: McpPluginDeclaration;\n  readonly plugin: DoomMcpPluginDefinition;\n}\n\nfunction isMcpPlugin(value: unknown): value is DoomMcpPluginDefinition {\n  if (typeof value !== 'object' || value === null) return false;\n  const candidate = value as Partial<DoomMcpPluginDefinition>;\n  return (\n    typeof candidate.name === 'string' &&\n    (typeof candidate.session === 'function' || typeof candidate.session === 'object')\n  );\n}\n\n/** Points a package's widget-tagged tools at the composed UI resource and serves it with them. */\nfunction withPackageWidgets(\n  original: DoomMcpPluginDefinition,\n  widgets: readonly string[] | undefined,\n  ui: DoomMcpUiResource | undefined,\n): DoomMcpPluginDefinition {\n  const allowedWidgets = new Set(widgets ?? []);\n  if (ui === undefined || allowedWidgets.size === 0) return original;\n  return {\n    ...original,\n    async session(context) {\n      const scope = typeof original.session === 'function' ? await original.session(context) : original.session;\n      const { tools: contributedTools, uiResources: contributedResources, ...rest } = scope;\n      let usesWidget = false;\n      const tools = contributedTools?.map((tool) => {\n        const widget = tool._meta?.['po/widget'];\n        if (widget === undefined) return tool;\n        if (typeof widget !== 'string' || !allowedWidgets.has(widget))\n          throw new Error(`MCP tool '${tool.name}' references a widget not owned by its package`);\n        usesWidget = true;\n        return {\n          ...tool,\n          _meta: {\n            ...tool._meta,\n            ui: { ...tool._meta?.ui, resourceUri: ui.uri, visibility: tool._meta?.ui?.visibility ?? ['model'] },\n            'openai/outputTemplate': ui.uri,\n          },\n        };\n      });\n      return {\n        ...rest,\n        ...(tools === undefined ? {} : { tools }),\n        uiResources: [...(contributedResources ?? []), ...(usesWidget ? [ui] : [])],\n      };\n    },\n  };\n}\n\n/** The served MCP App resource for composed package widget HTML. */\nexport function mcpUiResource(html: string, sha256: string): DoomMcpUiResource {\n  return {\n    uri: `ui://po/tools/${sha256}/index.html`,\n    name: 'po-tool-widgets',\n    description: 'Package-owned tool widgets composed by po.',\n    mimeType: 'text/html;profile=mcp-app',\n    _meta: {\n      ui: { csp: { connectDomains: [], resourceDomains: [] }, prefersBorder: true },\n      'openai/widgetPrefersBorder': true,\n      'openai/widgetCSP': { connect_domains: [], resource_domains: [] },\n    },\n    read: () => html,\n  };\n}\n\n/** One live MCP plugin: its declaration plus the URL its package module imports from. */\nexport interface LiveMcpPluginEntry extends McpPluginDeclaration {\n  /** Content-addressed import URL for `module`, see the po server's `packageUrl`. */\n  readonly url: string;\n}\n\nexport interface LoadMcpPluginsOptions extends LiveImportGuard {\n  readonly entries: readonly LiveMcpPluginEntry[];\n  readonly majorMode: string;\n  readonly activeLayers: readonly string[];\n  readonly onNotice?: (message: string) => void;\n  /** Retain admitted candidates so a live session can follow selection changes. */\n  readonly retainCandidates?: boolean;\n  /** Composed package widget UI, served by tools whose package owns the widget. */\n  readonly uiResource?: DoomMcpUiResource;\n  /** Test seam; defaults to native `import()`. */\n  readonly importer?: (url: string) => Promise<unknown>;\n}\n\nexport interface LoadedMcpPlugins {\n  readonly plugins: readonly LoadedMcpPlugin[];\n}\n\n/**\n * Live reader: imports each package's built MCP entry from its content-addressed URL.\n *\n * Same eligibility rules as `loadMcpBundle`: an ineligible candidate is kept only with\n * `retainCandidates`, and a failure is fatal only for an eligible plugin. Package widgets\n * resolve to `uiResource`, which the po server builds per content key. Each import\n * is bounded and poisoned on failure (see `guardedImport`), and each `session` factory call\n * is bounded by `factoryTimeoutMs`.\n */\nexport async function loadMcpPlugins(options: LoadMcpPluginsOptions): Promise<LoadedMcpPlugins> {\n  const importer = options.importer ?? ((url: string) => import(url));\n  const factoryTimeoutMs = options.factoryTimeoutMs ?? LIVE_FACTORY_TIMEOUT_MS;\n  const plugins: LoadedMcpPlugin[] = [];\n  for (const { url, ...declaration } of options.entries) {\n    const eligible = declaration.owners.some(\n      (owner) =>\n        owner.majorMode === options.majorMode &&\n        (owner.layer === 'default' || options.activeLayers.includes(owner.layer)),\n    );\n    if (!eligible && options.retainCandidates !== true) continue;\n    try {\n      const imported = (await guardedImport(url, importer, options)) as { default?: unknown } | undefined;\n      if (!isMcpPlugin(imported?.default)) throw new Error('default export is not an MCP plugin');\n      const original = withPackageWidgets(imported.default, declaration.widgets, options.uiResource);\n      const session = original.session;\n      const label = `MCP plugin '${declaration.packageName}' session`;\n      plugins.push({\n        declaration,\n        plugin:\n          typeof session === 'function'\n            ? {\n                ...original,\n                session: (context) =>\n                  withTimeout(\n                    Promise.resolve().then(() => session.call(original, context)),\n                    factoryTimeoutMs,\n                    label,\n                  ),\n              }\n            : original,\n      });\n    } catch (error) {\n      const message = `MCP plugin '${declaration.packageName}' could not load (${error instanceof Error ? error.message : String(error)})`;\n      if (eligible) throw new Error(message, { cause: error });\n      options.onNotice?.(message);\n    }\n  }\n  return { plugins };\n}\n"],"mappings":";;AAWA,SAAS,YAAY,OAAkD;CACrE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAClB,OACE,OAAO,UAAU,SAAS,aACzB,OAAO,UAAU,YAAY,cAAc,OAAO,UAAU,YAAY;AAE7E;;AAGA,SAAS,mBACP,UACA,SACA,IACyB;CACzB,MAAM,iBAAiB,IAAI,IAAI,WAAW,CAAC,CAAC;CAC5C,IAAI,OAAO,KAAA,KAAa,eAAe,SAAS,GAAG,OAAO;CAC1D,OAAO;EACL,GAAG;EACH,MAAM,QAAQ,SAAS;GAErB,MAAM,EAAE,OAAO,kBAAkB,aAAa,sBAAsB,GAAG,SADzD,OAAO,SAAS,YAAY,aAAa,MAAM,SAAS,QAAQ,OAAO,IAAI,SAAS;GAElG,IAAI,aAAa;GACjB,MAAM,QAAQ,kBAAkB,KAAK,SAAS;IAC5C,MAAM,SAAS,KAAK,QAAQ;IAC5B,IAAI,WAAW,KAAA,GAAW,OAAO;IACjC,IAAI,OAAO,WAAW,YAAY,CAAC,eAAe,IAAI,MAAM,GAC1D,MAAM,IAAI,MAAM,aAAa,KAAK,KAAK,+CAA+C;IACxF,aAAa;IACb,OAAO;KACL,GAAG;KACH,OAAO;MACL,GAAG,KAAK;MACR,IAAI;OAAE,GAAG,KAAK,OAAO;OAAI,aAAa,GAAG;OAAK,YAAY,KAAK,OAAO,IAAI,cAAc,CAAC,OAAO;MAAE;MAClG,yBAAyB,GAAG;KAC9B;IACF;GACF,CAAC;GACD,OAAO;IACL,GAAG;IACH,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,aAAa,CAAC,GAAI,wBAAwB,CAAC,GAAI,GAAI,aAAa,CAAC,EAAE,IAAI,CAAC,CAAE;GAC5E;EACF;CACF;AACF;;AAGA,SAAgB,cAAc,MAAc,QAAmC;CAC7E,OAAO;EACL,KAAK,iBAAiB,OAAO;EAC7B,MAAM;EACN,aAAa;EACb,UAAU;EACV,OAAO;GACL,IAAI;IAAE,KAAK;KAAE,gBAAgB,CAAC;KAAG,iBAAiB,CAAC;IAAE;IAAG,eAAe;GAAK;GAC5E,8BAA8B;GAC9B,oBAAoB;IAAE,iBAAiB,CAAC;IAAG,kBAAkB,CAAC;GAAE;EAClE;EACA,YAAY;CACd;AACF;;;;;;;;;;AAkCA,eAAsB,eAAe,SAA2D;CAC9F,MAAM,WAAW,QAAQ,cAAc,QAAgB,OAAO;CAC9D,MAAM,mBAAmB,QAAQ,oBAAA;CACjC,MAAM,UAA6B,CAAC;CACpC,KAAK,MAAM,EAAE,KAAK,GAAG,iBAAiB,QAAQ,SAAS;EACrD,MAAM,WAAW,YAAY,OAAO,MACjC,UACC,MAAM,cAAc,QAAQ,cAC3B,MAAM,UAAU,aAAa,QAAQ,aAAa,SAAS,MAAM,KAAK,EAC3E;EACA,IAAI,CAAC,YAAY,QAAQ,qBAAqB,MAAM;EACpD,IAAI;GACF,MAAM,WAAY,MAAM,cAAc,KAAK,UAAU,OAAO;GAC5D,IAAI,CAAC,YAAY,UAAU,OAAO,GAAG,MAAM,IAAI,MAAM,qCAAqC;GAC1F,MAAM,WAAW,mBAAmB,SAAS,SAAS,YAAY,SAAS,QAAQ,UAAU;GAC7F,MAAM,UAAU,SAAS;GACzB,MAAM,QAAQ,eAAe,YAAY,YAAY;GACrD,QAAQ,KAAK;IACX;IACA,QACE,OAAO,YAAY,aACf;KACE,GAAG;KACH,UAAU,YACR,YACE,QAAQ,QAAQ,CAAC,CAAC,WAAW,QAAQ,KAAK,UAAU,OAAO,CAAC,GAC5D,kBACA,KACF;IACJ,IACA;GACR,CAAC;EACH,SAAS,OAAO;GACd,MAAM,UAAU,eAAe,YAAY,YAAY,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;GAClI,IAAI,UAAU,MAAM,IAAI,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;GACvD,QAAQ,WAAW,OAAO;EAC5B;CACF;CACA,OAAO,EAAE,QAAQ;AACnB"}
+{"version":3,"file":"mcpBundleLoader.mjs","names":[],"sources":["../../../src/server/mcpBundleLoader.ts"],"sourcesContent":["import type { PoMcpBundleEntry } from '../schemas/mcpBundle';\nimport type { PoMcpPluginDefinition, PoMcpUiResource } from '../schemas/mcpFacet';\nimport { guardedImport, LIVE_FACTORY_TIMEOUT_MS, type LiveImportGuard, withTimeout } from './liveImport';\n/** The parts of an MCP declaration a live session host reads. */\nexport type McpPluginDeclaration = Omit<PoMcpBundleEntry, 'sha256'> & { readonly sha256?: string };\n\nexport interface LoadedMcpPlugin {\n  readonly declaration: McpPluginDeclaration;\n  readonly plugin: PoMcpPluginDefinition;\n}\n\nfunction isMcpPlugin(value: unknown): value is PoMcpPluginDefinition {\n  if (typeof value !== 'object' || value === null) return false;\n  const candidate = value as Partial<PoMcpPluginDefinition>;\n  return (\n    typeof candidate.name === 'string' &&\n    (typeof candidate.session === 'function' || typeof candidate.session === 'object')\n  );\n}\n\n/** Points a package's widget-tagged tools at the composed UI resource and serves it with them. */\nfunction withPackageWidgets(\n  original: PoMcpPluginDefinition,\n  widgets: readonly string[] | undefined,\n  ui: PoMcpUiResource | undefined,\n): PoMcpPluginDefinition {\n  const allowedWidgets = new Set(widgets ?? []);\n  if (ui === undefined || allowedWidgets.size === 0) return original;\n  return {\n    ...original,\n    async session(context) {\n      const scope = typeof original.session === 'function' ? await original.session(context) : original.session;\n      const { tools: contributedTools, uiResources: contributedResources, ...rest } = scope;\n      let usesWidget = false;\n      const tools = contributedTools?.map((tool) => {\n        const widget = tool._meta?.['po/widget'];\n        if (widget === undefined) return tool;\n        if (typeof widget !== 'string' || !allowedWidgets.has(widget))\n          throw new Error(`MCP tool '${tool.name}' references a widget not owned by its package`);\n        usesWidget = true;\n        return {\n          ...tool,\n          _meta: {\n            ...tool._meta,\n            ui: { ...tool._meta?.ui, resourceUri: ui.uri, visibility: tool._meta?.ui?.visibility ?? ['model'] },\n            'openai/outputTemplate': ui.uri,\n          },\n        };\n      });\n      return {\n        ...rest,\n        ...(tools === undefined ? {} : { tools }),\n        uiResources: [...(contributedResources ?? []), ...(usesWidget ? [ui] : [])],\n      };\n    },\n  };\n}\n\n/** The served MCP App resource for composed package widget HTML. */\nexport function mcpUiResource(html: string, sha256: string): PoMcpUiResource {\n  return {\n    uri: `ui://po/tools/${sha256}/index.html`,\n    name: 'po-tool-widgets',\n    description: 'Package-owned tool widgets composed by po.',\n    mimeType: 'text/html;profile=mcp-app',\n    _meta: {\n      ui: { csp: { connectDomains: [], resourceDomains: [] }, prefersBorder: true },\n      'openai/widgetPrefersBorder': true,\n      'openai/widgetCSP': { connect_domains: [], resource_domains: [] },\n    },\n    read: () => html,\n  };\n}\n\n/** One live MCP plugin: its declaration plus the URL its package module imports from. */\nexport interface LiveMcpPluginEntry extends McpPluginDeclaration {\n  /** Content-addressed import URL for `module`, see the po server's `packageUrl`. */\n  readonly url: string;\n}\n\nexport interface LoadMcpPluginsOptions extends LiveImportGuard {\n  readonly entries: readonly LiveMcpPluginEntry[];\n  readonly majorMode: string;\n  readonly activeLayers: readonly string[];\n  readonly onNotice?: (message: string) => void;\n  /** Retain admitted candidates so a live session can follow selection changes. */\n  readonly retainCandidates?: boolean;\n  /** Composed package widget UI, served by tools whose package owns the widget. */\n  readonly uiResource?: PoMcpUiResource;\n  /** Test seam; defaults to native `import()`. */\n  readonly importer?: (url: string) => Promise<unknown>;\n}\n\nexport interface LoadedMcpPlugins {\n  readonly plugins: readonly LoadedMcpPlugin[];\n}\n\n/**\n * Live reader: imports each package's built MCP entry from its content-addressed URL.\n *\n * Same eligibility rules as `loadMcpBundle`: an ineligible candidate is kept only with\n * `retainCandidates`, and a failure is fatal only for an eligible plugin. Package widgets\n * resolve to `uiResource`, which the po server builds per content key. Each import\n * is bounded and poisoned on failure (see `guardedImport`), and each `session` factory call\n * is bounded by `factoryTimeoutMs`.\n */\nexport async function loadMcpPlugins(options: LoadMcpPluginsOptions): Promise<LoadedMcpPlugins> {\n  const importer = options.importer ?? ((url: string) => import(url));\n  const factoryTimeoutMs = options.factoryTimeoutMs ?? LIVE_FACTORY_TIMEOUT_MS;\n  const plugins: LoadedMcpPlugin[] = [];\n  for (const { url, ...declaration } of options.entries) {\n    const eligible = declaration.owners.some(\n      (owner) =>\n        owner.majorMode === options.majorMode &&\n        (owner.layer === 'default' || options.activeLayers.includes(owner.layer)),\n    );\n    if (!eligible && options.retainCandidates !== true) continue;\n    try {\n      const imported = (await guardedImport(url, importer, options)) as { default?: unknown } | undefined;\n      if (!isMcpPlugin(imported?.default)) throw new Error('default export is not an MCP plugin');\n      const original = withPackageWidgets(imported.default, declaration.widgets, options.uiResource);\n      const session = original.session;\n      const label = `MCP plugin '${declaration.packageName}' session`;\n      plugins.push({\n        declaration,\n        plugin:\n          typeof session === 'function'\n            ? {\n                ...original,\n                session: (context) =>\n                  withTimeout(\n                    Promise.resolve().then(() => session.call(original, context)),\n                    factoryTimeoutMs,\n                    label,\n                  ),\n              }\n            : original,\n      });\n    } catch (error) {\n      const message = `MCP plugin '${declaration.packageName}' could not load (${error instanceof Error ? error.message : String(error)})`;\n      if (eligible) throw new Error(message, { cause: error });\n      options.onNotice?.(message);\n    }\n  }\n  return { plugins };\n}\n"],"mappings":";;AAWA,SAAS,YAAY,OAAgD;CACnE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAClB,OACE,OAAO,UAAU,SAAS,aACzB,OAAO,UAAU,YAAY,cAAc,OAAO,UAAU,YAAY;AAE7E;;AAGA,SAAS,mBACP,UACA,SACA,IACuB;CACvB,MAAM,iBAAiB,IAAI,IAAI,WAAW,CAAC,CAAC;CAC5C,IAAI,OAAO,KAAA,KAAa,eAAe,SAAS,GAAG,OAAO;CAC1D,OAAO;EACL,GAAG;EACH,MAAM,QAAQ,SAAS;GAErB,MAAM,EAAE,OAAO,kBAAkB,aAAa,sBAAsB,GAAG,SADzD,OAAO,SAAS,YAAY,aAAa,MAAM,SAAS,QAAQ,OAAO,IAAI,SAAS;GAElG,IAAI,aAAa;GACjB,MAAM,QAAQ,kBAAkB,KAAK,SAAS;IAC5C,MAAM,SAAS,KAAK,QAAQ;IAC5B,IAAI,WAAW,KAAA,GAAW,OAAO;IACjC,IAAI,OAAO,WAAW,YAAY,CAAC,eAAe,IAAI,MAAM,GAC1D,MAAM,IAAI,MAAM,aAAa,KAAK,KAAK,+CAA+C;IACxF,aAAa;IACb,OAAO;KACL,GAAG;KACH,OAAO;MACL,GAAG,KAAK;MACR,IAAI;OAAE,GAAG,KAAK,OAAO;OAAI,aAAa,GAAG;OAAK,YAAY,KAAK,OAAO,IAAI,cAAc,CAAC,OAAO;MAAE;MAClG,yBAAyB,GAAG;KAC9B;IACF;GACF,CAAC;GACD,OAAO;IACL,GAAG;IACH,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;IACvC,aAAa,CAAC,GAAI,wBAAwB,CAAC,GAAI,GAAI,aAAa,CAAC,EAAE,IAAI,CAAC,CAAE;GAC5E;EACF;CACF;AACF;;AAGA,SAAgB,cAAc,MAAc,QAAiC;CAC3E,OAAO;EACL,KAAK,iBAAiB,OAAO;EAC7B,MAAM;EACN,aAAa;EACb,UAAU;EACV,OAAO;GACL,IAAI;IAAE,KAAK;KAAE,gBAAgB,CAAC;KAAG,iBAAiB,CAAC;IAAE;IAAG,eAAe;GAAK;GAC5E,8BAA8B;GAC9B,oBAAoB;IAAE,iBAAiB,CAAC;IAAG,kBAAkB,CAAC;GAAE;EAClE;EACA,YAAY;CACd;AACF;;;;;;;;;;AAkCA,eAAsB,eAAe,SAA2D;CAC9F,MAAM,WAAW,QAAQ,cAAc,QAAgB,OAAO;CAC9D,MAAM,mBAAmB,QAAQ,oBAAA;CACjC,MAAM,UAA6B,CAAC;CACpC,KAAK,MAAM,EAAE,KAAK,GAAG,iBAAiB,QAAQ,SAAS;EACrD,MAAM,WAAW,YAAY,OAAO,MACjC,UACC,MAAM,cAAc,QAAQ,cAC3B,MAAM,UAAU,aAAa,QAAQ,aAAa,SAAS,MAAM,KAAK,EAC3E;EACA,IAAI,CAAC,YAAY,QAAQ,qBAAqB,MAAM;EACpD,IAAI;GACF,MAAM,WAAY,MAAM,cAAc,KAAK,UAAU,OAAO;GAC5D,IAAI,CAAC,YAAY,UAAU,OAAO,GAAG,MAAM,IAAI,MAAM,qCAAqC;GAC1F,MAAM,WAAW,mBAAmB,SAAS,SAAS,YAAY,SAAS,QAAQ,UAAU;GAC7F,MAAM,UAAU,SAAS;GACzB,MAAM,QAAQ,eAAe,YAAY,YAAY;GACrD,QAAQ,KAAK;IACX;IACA,QACE,OAAO,YAAY,aACf;KACE,GAAG;KACH,UAAU,YACR,YACE,QAAQ,QAAQ,CAAC,CAAC,WAAW,QAAQ,KAAK,UAAU,OAAO,CAAC,GAC5D,kBACA,KACF;IACJ,IACA;GACR,CAAC;EACH,SAAS,OAAO;GACd,MAAM,UAAU,eAAe,YAAY,YAAY,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;GAClI,IAAI,UAAU,MAAM,IAAI,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;GACvD,QAAQ,WAAW,OAAO;EAC5B;CACF;CACA,OAAO,EAAE,QAAQ;AACnB"}

package/dist/src/server/serverPackages.cjs

@@ -0,0 +1,60 @@
+const require_liveImport = require("./liveImport.cjs");
+//#region src/server/serverPackages.ts
+/** Pure pre-model metadata from initially admitted session packages, never from retained candidates. */
+function selectedServerProviderOverrides(packages, environment) {
+	return packages.flatMap(({ declaration, plugin, initiallyEligible }) => initiallyEligible === false || !declaration.scopes.includes("session") ? [] : plugin.providerOverrides?.({ environment }) ?? []);
+}
+function ownedBy(owners, majorMode, activeLayers) {
+	return owners.some((owner) => owner.majorMode === majorMode && (owner.layer === "default" || activeLayers.includes(owner.layer)));
+}
+/** A module's default export is a server plugin when it is a named cordis object plugin. */
+function isServerPlugin(value) {
+	return typeof value === "object" && value !== null && typeof value.apply === "function" && typeof value.name === "string";
+}
+async function loadPackageEntries(scope, entries, options, importUrl) {
+	const packages = [];
+	for (const declaration of entries) {
+		if (!declaration.scopes.includes(scope)) continue;
+		const eligible = ownedBy(declaration.owners, options.majorMode, options.activeLayers);
+		if (!(scope === "session" && options.retainCandidates === true) && !eligible) continue;
+		try {
+			const imported = await importUrl(declaration);
+			if (!isServerPlugin(imported?.default)) throw new Error("default export is not a server plugin");
+			packages.push({
+				declaration,
+				plugin: imported.default,
+				...scope === "session" && options.retainCandidates ? {
+					retained: true,
+					initiallyEligible: eligible
+				} : {}
+			});
+		} catch (error) {
+			const message = `Server package '${declaration.packageName}' could not load (${error instanceof Error ? error.message : String(error)})`;
+			if (declaration.required && eligible) throw new Error(message, { cause: error });
+			options.onNotice?.(message);
+		}
+	}
+	return packages;
+}
+/**
+* Live reader: imports each package's built entry from its content-addressed URL.
+*
+* Applies the scope, ownership and `required` rules of each entry. Each import is bounded and a URL that
+* timed out or threw is poisoned (see `guardedImport`); a poisoned required package fails
+* exactly as a load failure does. A URL is imported once per process, so the same content is the
+* same plugin object, which is how a scope tells an unchanged package from a changed one.
+*/
+async function loadServerPackages(scope, options) {
+	const importer = options.importer ?? ((url) => import(url));
+	const urls = new Map(options.entries.map((entry) => [entry, entry.url]));
+	const packages = await loadPackageEntries(scope, options.entries, options, (declaration) => require_liveImport.guardedImport(urls.get(declaration), importer, options));
+	return {
+		entries: options.entries,
+		packages
+	};
+}
+//#endregion
+exports.loadServerPackages = loadServerPackages;
+exports.selectedServerProviderOverrides = selectedServerProviderOverrides;
+
+//# sourceMappingURL=serverPackages.cjs.map

package/dist/src/server/serverPackages.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverPackages.cjs","names":["guardedImport"],"sources":["../../../src/server/serverPackages.ts"],"sourcesContent":["import type { PoApiScope } from '../schemas/packageApi';\nimport type { PoServerBundleEntry } from '../schemas/serverBundle';\nimport type { PoServerPlugin, PoServerProviderOverride } from '../schemas/serverPlugin';\nimport { guardedImport, type LiveImportGuard } from './liveImport';\n\n/** One imported package: its bundle entry and the server plugin its module exports. */\nexport interface LoadedServerPackage {\n  readonly declaration: PoServerBundleEntry;\n  readonly plugin: PoServerPlugin;\n  readonly retained?: true;\n  readonly initiallyEligible?: boolean;\n}\n\n/** One live server package: the bundle entry shape plus the URL its package module imports from. */\nexport interface LiveServerPackageEntry extends PoServerBundleEntry {\n  /** Content-addressed import URL for `module`, see the po server's `packageUrl`. */\n  readonly url: string;\n}\n\nexport interface LoadServerPackagesOptions extends LiveImportGuard {\n  readonly entries: readonly LiveServerPackageEntry[];\n  readonly majorMode: string;\n  readonly activeLayers: readonly string[];\n  readonly onNotice?: (message: string) => void;\n  /** Only a session host with declarative contribution gating may retain all candidates. */\n  readonly retainCandidates?: boolean;\n  /** Test seam; defaults to native `import()`. */\n  readonly importer?: (url: string) => Promise<unknown>;\n}\n\nexport interface LoadedServerPackages {\n  readonly entries: readonly LiveServerPackageEntry[];\n  readonly packages: readonly LoadedServerPackage[];\n}\n\n/** Pure pre-model metadata from initially admitted session packages, never from retained candidates. */\nexport function selectedServerProviderOverrides(\n  packages: readonly LoadedServerPackage[],\n  environment: Readonly<Record<string, string | undefined>>,\n): readonly PoServerProviderOverride[] {\n  return packages.flatMap(({ declaration, plugin, initiallyEligible }) =>\n    initiallyEligible === false || !declaration.scopes.includes('session')\n      ? []\n      : (plugin.providerOverrides?.({ environment }) ?? []),\n  );\n}\n\nfunction ownedBy(\n  owners: readonly { readonly majorMode: string; readonly layer: string }[],\n  majorMode: string,\n  activeLayers: readonly string[],\n): boolean {\n  return owners.some(\n    (owner) => owner.majorMode === majorMode && (owner.layer === 'default' || activeLayers.includes(owner.layer)),\n  );\n}\n\n/** A module's default export is a server plugin when it is a named cordis object plugin. */\nfunction isServerPlugin(value: unknown): value is PoServerPlugin {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { apply?: unknown }).apply === 'function' &&\n    typeof (value as { name?: unknown }).name === 'string'\n  );\n}\n\nasync function loadPackageEntries(\n  scope: PoApiScope,\n  entries: readonly PoServerBundleEntry[],\n  options: Pick<LoadServerPackagesOptions, 'majorMode' | 'activeLayers' | 'onNotice' | 'retainCandidates'>,\n  importUrl: (declaration: PoServerBundleEntry) => Promise<unknown>,\n): Promise<LoadedServerPackage[]> {\n  const packages: LoadedServerPackage[] = [];\n  for (const declaration of entries) {\n    if (!declaration.scopes.includes(scope)) continue;\n    const eligible = ownedBy(declaration.owners, options.majorMode, options.activeLayers);\n    if (!(scope === 'session' && options.retainCandidates === true) && !eligible) continue;\n    try {\n      const imported = (await importUrl(declaration)) as { default?: unknown } | undefined;\n      if (!isServerPlugin(imported?.default)) throw new Error('default export is not a server plugin');\n      packages.push({\n        declaration,\n        plugin: imported.default,\n        ...(scope === 'session' && options.retainCandidates\n          ? { retained: true as const, initiallyEligible: eligible }\n          : {}),\n      });\n    } catch (error) {\n      const message = `Server package '${declaration.packageName}' could not load (${error instanceof Error ? error.message : String(error)})`;\n      if (declaration.required && eligible) throw new Error(message, { cause: error });\n      options.onNotice?.(message);\n    }\n  }\n  return packages;\n}\n\n/**\n * Live reader: imports each package's built entry from its content-addressed URL.\n *\n * Applies the scope, ownership and `required` rules of each entry. Each import is bounded and a URL that\n * timed out or threw is poisoned (see `guardedImport`); a poisoned required package fails\n * exactly as a load failure does. A URL is imported once per process, so the same content is the\n * same plugin object, which is how a scope tells an unchanged package from a changed one.\n */\nexport async function loadServerPackages(\n  scope: PoApiScope,\n  options: LoadServerPackagesOptions,\n): Promise<LoadedServerPackages> {\n  const importer = options.importer ?? ((url: string) => import(url));\n  const urls = new Map(options.entries.map((entry) => [entry as PoServerBundleEntry, entry.url]));\n  const packages = await loadPackageEntries(scope, options.entries, options, (declaration) =>\n    guardedImport(urls.get(declaration)!, importer, options),\n  );\n  return { entries: options.entries, packages };\n}\n"],"mappings":";;;AAoCA,SAAgB,gCACd,UACA,aACqC;CACrC,OAAO,SAAS,SAAS,EAAE,aAAa,QAAQ,wBAC9C,sBAAsB,SAAS,CAAC,YAAY,OAAO,SAAS,SAAS,IACjE,CAAC,IACA,OAAO,oBAAoB,EAAE,YAAY,CAAC,KAAK,CAAC,CACvD;AACF;AAEA,SAAS,QACP,QACA,WACA,cACS;CACT,OAAO,OAAO,MACX,UAAU,MAAM,cAAc,cAAc,MAAM,UAAU,aAAa,aAAa,SAAS,MAAM,KAAK,EAC7G;AACF;;AAGA,SAAS,eAAe,OAAyC;CAC/D,OACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA8B,UAAU,cAChD,OAAQ,MAA6B,SAAS;AAElD;AAEA,eAAe,mBACb,OACA,SACA,SACA,WACgC;CAChC,MAAM,WAAkC,CAAC;CACzC,KAAK,MAAM,eAAe,SAAS;EACjC,IAAI,CAAC,YAAY,OAAO,SAAS,KAAK,GAAG;EACzC,MAAM,WAAW,QAAQ,YAAY,QAAQ,QAAQ,WAAW,QAAQ,YAAY;EACpF,IAAI,EAAE,UAAU,aAAa,QAAQ,qBAAqB,SAAS,CAAC,UAAU;EAC9E,IAAI;GACF,MAAM,WAAY,MAAM,UAAU,WAAW;GAC7C,IAAI,CAAC,eAAe,UAAU,OAAO,GAAG,MAAM,IAAI,MAAM,uCAAuC;GAC/F,SAAS,KAAK;IACZ;IACA,QAAQ,SAAS;IACjB,GAAI,UAAU,aAAa,QAAQ,mBAC/B;KAAE,UAAU;KAAe,mBAAmB;IAAS,IACvD,CAAC;GACP,CAAC;EACH,SAAS,OAAO;GACd,MAAM,UAAU,mBAAmB,YAAY,YAAY,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;GACtI,IAAI,YAAY,YAAY,UAAU,MAAM,IAAI,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;GAC/E,QAAQ,WAAW,OAAO;EAC5B;CACF;CACA,OAAO;AACT;;;;;;;;;AAUA,eAAsB,mBACpB,OACA,SAC+B;CAC/B,MAAM,WAAW,QAAQ,cAAc,QAAgB,OAAO;CAC9D,MAAM,OAAO,IAAI,IAAI,QAAQ,QAAQ,KAAK,UAAU,CAAC,OAA8B,MAAM,GAAG,CAAC,CAAC;CAC9F,MAAM,WAAW,MAAM,mBAAmB,OAAO,QAAQ,SAAS,UAAU,gBAC1EA,mBAAAA,cAAc,KAAK,IAAI,WAAW,GAAI,UAAU,OAAO,CACzD;CACA,OAAO;EAAE,SAAS,QAAQ;EAAS;CAAS;AAC9C"}

package/dist/src/server/serverPackages.d.mts

@@ -0,0 +1,44 @@
+import { PoApiScope } from "../schemas/packageApi.mjs";
+import { PoServerBundleEntry } from "../schemas/serverBundle.mjs";
+import { PoServerPlugin, PoServerProviderOverride } from "../schemas/serverPlugin.mjs";
+import { LiveImportGuard } from "./liveImport.mjs";
+//#region src/server/serverPackages.d.ts
+/** One imported package: its bundle entry and the server plugin its module exports. */
+export interface LoadedServerPackage {
+  readonly declaration: PoServerBundleEntry;
+  readonly plugin: PoServerPlugin;
+  readonly retained?: true;
+  readonly initiallyEligible?: boolean;
+}
+/** One live server package: the bundle entry shape plus the URL its package module imports from. */
+export interface LiveServerPackageEntry extends PoServerBundleEntry {
+  /** Content-addressed import URL for `module`, see the po server's `packageUrl`. */
+  readonly url: string;
+}
+export interface LoadServerPackagesOptions extends LiveImportGuard {
+  readonly entries: readonly LiveServerPackageEntry[];
+  readonly majorMode: string;
+  readonly activeLayers: readonly string[];
+  readonly onNotice?: (message: string) => void;
+  /** Only a session host with declarative contribution gating may retain all candidates. */
+  readonly retainCandidates?: boolean;
+  /** Test seam; defaults to native `import()`. */
+  readonly importer?: (url: string) => Promise<unknown>;
+}
+export interface LoadedServerPackages {
+  readonly entries: readonly LiveServerPackageEntry[];
+  readonly packages: readonly LoadedServerPackage[];
+}
+/** Pure pre-model metadata from initially admitted session packages, never from retained candidates. */
+export declare function selectedServerProviderOverrides(packages: readonly LoadedServerPackage[], environment: Readonly<Record<string, string | undefined>>): readonly PoServerProviderOverride[];
+/**
+ * Live reader: imports each package's built entry from its content-addressed URL.
+ *
+ * Applies the scope, ownership and `required` rules of each entry. Each import is bounded and a URL that
+ * timed out or threw is poisoned (see `guardedImport`); a poisoned required package fails
+ * exactly as a load failure does. A URL is imported once per process, so the same content is the
+ * same plugin object, which is how a scope tells an unchanged package from a changed one.
+ */
+export declare function loadServerPackages(scope: PoApiScope, options: LoadServerPackagesOptions): Promise<LoadedServerPackages>;
+//#endregion
+//# sourceMappingURL=serverPackages.d.mts.map

package/dist/src/server/serverPackages.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverPackages.d.mts","names":[],"sources":["../../../src/server/serverPackages.ts"],"mappings":";;;;;;iBAMiB;WACN,aAAa;WACb,QAAQ;WACR;WACA;;;iBAIM,+BAA+B;;WAErC;;iBAGM,kCAAkC;WACxC,kBAAkB;WAClB;WACA;WACA,YAAY;;WAEZ;;WAEA,YAAY,gBAAgB;;iBAGtB;WACN,kBAAkB;WAClB,mBAAmB;;;wBAId,gCACd,mBAAmB,uBACnB,aAAa,SAAS,+CACZ;;;;;;;;;wBAkEU,mBACpB,OAAO,YACP,SAAS,4BACR,QAAQ"}

package/dist/src/server/serverPackages.mjs

@@ -0,0 +1,59 @@
+import { guardedImport } from "./liveImport.mjs";
+//#region src/server/serverPackages.ts
+/** Pure pre-model metadata from initially admitted session packages, never from retained candidates. */
+function selectedServerProviderOverrides(packages, environment) {
+	return packages.flatMap(({ declaration, plugin, initiallyEligible }) => initiallyEligible === false || !declaration.scopes.includes("session") ? [] : plugin.providerOverrides?.({ environment }) ?? []);
+}
+function ownedBy(owners, majorMode, activeLayers) {
+	return owners.some((owner) => owner.majorMode === majorMode && (owner.layer === "default" || activeLayers.includes(owner.layer)));
+}
+/** A module's default export is a server plugin when it is a named cordis object plugin. */
+function isServerPlugin(value) {
+	return typeof value === "object" && value !== null && typeof value.apply === "function" && typeof value.name === "string";
+}
+async function loadPackageEntries(scope, entries, options, importUrl) {
+	const packages = [];
+	for (const declaration of entries) {
+		if (!declaration.scopes.includes(scope)) continue;
+		const eligible = ownedBy(declaration.owners, options.majorMode, options.activeLayers);
+		if (!(scope === "session" && options.retainCandidates === true) && !eligible) continue;
+		try {
+			const imported = await importUrl(declaration);
+			if (!isServerPlugin(imported?.default)) throw new Error("default export is not a server plugin");
+			packages.push({
+				declaration,
+				plugin: imported.default,
+				...scope === "session" && options.retainCandidates ? {
+					retained: true,
+					initiallyEligible: eligible
+				} : {}
+			});
+		} catch (error) {
+			const message = `Server package '${declaration.packageName}' could not load (${error instanceof Error ? error.message : String(error)})`;
+			if (declaration.required && eligible) throw new Error(message, { cause: error });
+			options.onNotice?.(message);
+		}
+	}
+	return packages;
+}
+/**
+* Live reader: imports each package's built entry from its content-addressed URL.
+*
+* Applies the scope, ownership and `required` rules of each entry. Each import is bounded and a URL that
+* timed out or threw is poisoned (see `guardedImport`); a poisoned required package fails
+* exactly as a load failure does. A URL is imported once per process, so the same content is the
+* same plugin object, which is how a scope tells an unchanged package from a changed one.
+*/
+async function loadServerPackages(scope, options) {
+	const importer = options.importer ?? ((url) => import(url));
+	const urls = new Map(options.entries.map((entry) => [entry, entry.url]));
+	const packages = await loadPackageEntries(scope, options.entries, options, (declaration) => guardedImport(urls.get(declaration), importer, options));
+	return {
+		entries: options.entries,
+		packages
+	};
+}
+//#endregion
+export { loadServerPackages, selectedServerProviderOverrides };
+
+//# sourceMappingURL=serverPackages.mjs.map

package/dist/src/server/serverPackages.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverPackages.mjs","names":[],"sources":["../../../src/server/serverPackages.ts"],"sourcesContent":["import type { PoApiScope } from '../schemas/packageApi';\nimport type { PoServerBundleEntry } from '../schemas/serverBundle';\nimport type { PoServerPlugin, PoServerProviderOverride } from '../schemas/serverPlugin';\nimport { guardedImport, type LiveImportGuard } from './liveImport';\n\n/** One imported package: its bundle entry and the server plugin its module exports. */\nexport interface LoadedServerPackage {\n  readonly declaration: PoServerBundleEntry;\n  readonly plugin: PoServerPlugin;\n  readonly retained?: true;\n  readonly initiallyEligible?: boolean;\n}\n\n/** One live server package: the bundle entry shape plus the URL its package module imports from. */\nexport interface LiveServerPackageEntry extends PoServerBundleEntry {\n  /** Content-addressed import URL for `module`, see the po server's `packageUrl`. */\n  readonly url: string;\n}\n\nexport interface LoadServerPackagesOptions extends LiveImportGuard {\n  readonly entries: readonly LiveServerPackageEntry[];\n  readonly majorMode: string;\n  readonly activeLayers: readonly string[];\n  readonly onNotice?: (message: string) => void;\n  /** Only a session host with declarative contribution gating may retain all candidates. */\n  readonly retainCandidates?: boolean;\n  /** Test seam; defaults to native `import()`. */\n  readonly importer?: (url: string) => Promise<unknown>;\n}\n\nexport interface LoadedServerPackages {\n  readonly entries: readonly LiveServerPackageEntry[];\n  readonly packages: readonly LoadedServerPackage[];\n}\n\n/** Pure pre-model metadata from initially admitted session packages, never from retained candidates. */\nexport function selectedServerProviderOverrides(\n  packages: readonly LoadedServerPackage[],\n  environment: Readonly<Record<string, string | undefined>>,\n): readonly PoServerProviderOverride[] {\n  return packages.flatMap(({ declaration, plugin, initiallyEligible }) =>\n    initiallyEligible === false || !declaration.scopes.includes('session')\n      ? []\n      : (plugin.providerOverrides?.({ environment }) ?? []),\n  );\n}\n\nfunction ownedBy(\n  owners: readonly { readonly majorMode: string; readonly layer: string }[],\n  majorMode: string,\n  activeLayers: readonly string[],\n): boolean {\n  return owners.some(\n    (owner) => owner.majorMode === majorMode && (owner.layer === 'default' || activeLayers.includes(owner.layer)),\n  );\n}\n\n/** A module's default export is a server plugin when it is a named cordis object plugin. */\nfunction isServerPlugin(value: unknown): value is PoServerPlugin {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { apply?: unknown }).apply === 'function' &&\n    typeof (value as { name?: unknown }).name === 'string'\n  );\n}\n\nasync function loadPackageEntries(\n  scope: PoApiScope,\n  entries: readonly PoServerBundleEntry[],\n  options: Pick<LoadServerPackagesOptions, 'majorMode' | 'activeLayers' | 'onNotice' | 'retainCandidates'>,\n  importUrl: (declaration: PoServerBundleEntry) => Promise<unknown>,\n): Promise<LoadedServerPackage[]> {\n  const packages: LoadedServerPackage[] = [];\n  for (const declaration of entries) {\n    if (!declaration.scopes.includes(scope)) continue;\n    const eligible = ownedBy(declaration.owners, options.majorMode, options.activeLayers);\n    if (!(scope === 'session' && options.retainCandidates === true) && !eligible) continue;\n    try {\n      const imported = (await importUrl(declaration)) as { default?: unknown } | undefined;\n      if (!isServerPlugin(imported?.default)) throw new Error('default export is not a server plugin');\n      packages.push({\n        declaration,\n        plugin: imported.default,\n        ...(scope === 'session' && options.retainCandidates\n          ? { retained: true as const, initiallyEligible: eligible }\n          : {}),\n      });\n    } catch (error) {\n      const message = `Server package '${declaration.packageName}' could not load (${error instanceof Error ? error.message : String(error)})`;\n      if (declaration.required && eligible) throw new Error(message, { cause: error });\n      options.onNotice?.(message);\n    }\n  }\n  return packages;\n}\n\n/**\n * Live reader: imports each package's built entry from its content-addressed URL.\n *\n * Applies the scope, ownership and `required` rules of each entry. Each import is bounded and a URL that\n * timed out or threw is poisoned (see `guardedImport`); a poisoned required package fails\n * exactly as a load failure does. A URL is imported once per process, so the same content is the\n * same plugin object, which is how a scope tells an unchanged package from a changed one.\n */\nexport async function loadServerPackages(\n  scope: PoApiScope,\n  options: LoadServerPackagesOptions,\n): Promise<LoadedServerPackages> {\n  const importer = options.importer ?? ((url: string) => import(url));\n  const urls = new Map(options.entries.map((entry) => [entry as PoServerBundleEntry, entry.url]));\n  const packages = await loadPackageEntries(scope, options.entries, options, (declaration) =>\n    guardedImport(urls.get(declaration)!, importer, options),\n  );\n  return { entries: options.entries, packages };\n}\n"],"mappings":";;;AAoCA,SAAgB,gCACd,UACA,aACqC;CACrC,OAAO,SAAS,SAAS,EAAE,aAAa,QAAQ,wBAC9C,sBAAsB,SAAS,CAAC,YAAY,OAAO,SAAS,SAAS,IACjE,CAAC,IACA,OAAO,oBAAoB,EAAE,YAAY,CAAC,KAAK,CAAC,CACvD;AACF;AAEA,SAAS,QACP,QACA,WACA,cACS;CACT,OAAO,OAAO,MACX,UAAU,MAAM,cAAc,cAAc,MAAM,UAAU,aAAa,aAAa,SAAS,MAAM,KAAK,EAC7G;AACF;;AAGA,SAAS,eAAe,OAAyC;CAC/D,OACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA8B,UAAU,cAChD,OAAQ,MAA6B,SAAS;AAElD;AAEA,eAAe,mBACb,OACA,SACA,SACA,WACgC;CAChC,MAAM,WAAkC,CAAC;CACzC,KAAK,MAAM,eAAe,SAAS;EACjC,IAAI,CAAC,YAAY,OAAO,SAAS,KAAK,GAAG;EACzC,MAAM,WAAW,QAAQ,YAAY,QAAQ,QAAQ,WAAW,QAAQ,YAAY;EACpF,IAAI,EAAE,UAAU,aAAa,QAAQ,qBAAqB,SAAS,CAAC,UAAU;EAC9E,IAAI;GACF,MAAM,WAAY,MAAM,UAAU,WAAW;GAC7C,IAAI,CAAC,eAAe,UAAU,OAAO,GAAG,MAAM,IAAI,MAAM,uCAAuC;GAC/F,SAAS,KAAK;IACZ;IACA,QAAQ,SAAS;IACjB,GAAI,UAAU,aAAa,QAAQ,mBAC/B;KAAE,UAAU;KAAe,mBAAmB;IAAS,IACvD,CAAC;GACP,CAAC;EACH,SAAS,OAAO;GACd,MAAM,UAAU,mBAAmB,YAAY,YAAY,oBAAoB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;GACtI,IAAI,YAAY,YAAY,UAAU,MAAM,IAAI,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;GAC/E,QAAQ,WAAW,OAAO;EAC5B;CACF;CACA,OAAO;AACT;;;;;;;;;AAUA,eAAsB,mBACpB,OACA,SAC+B;CAC/B,MAAM,WAAW,QAAQ,cAAc,QAAgB,OAAO;CAC9D,MAAM,OAAO,IAAI,IAAI,QAAQ,QAAQ,KAAK,UAAU,CAAC,OAA8B,MAAM,GAAG,CAAC,CAAC;CAC9F,MAAM,WAAW,MAAM,mBAAmB,OAAO,QAAQ,SAAS,UAAU,gBAC1E,cAAc,KAAK,IAAI,WAAW,GAAI,UAAU,OAAO,CACzD;CACA,OAAO;EAAE,SAAS,QAAQ;EAAS;CAAS;AAC9C"}