@imgly/codesign-mcp 0.1.0 → 0.1.2

package/dist/cli/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/cli/http.ts"],"names":[],"mappings":"AA4EA,wBAAsB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+M5D"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/cli/http.ts"],"names":[],"mappings":"AA6EA,wBAAsB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkN5D"}

package/dist/cli/http.js

@@ -10,6 +10,7 @@ import { ensureEngineAssetSources } from '../engine/asset-sources.js';
 import { cesdkAdapter } from '../engine/cesdk-adapter.js';
 import { Mutex } from '../engine/mutex.js';
 import { EngineSession } from '../engine/session.js';
+import { registerUnsplashSource } from '../engine/unsplash-source.js';
 import { registerWorkspaceUriResolver } from '../engine/uri-resolver.js';
 import { LocalGatewayClient } from '../gateway/local.js';
 import { createCodesignHttpServer } from '../http/server.js';
@@ -98,6 +99,9 @@ export async function runHttp(_argv) {
             const engine = await ensureHeadlessEngine(license);
             // Idempotent (engine is a process singleton) — only the first successful registration pays the CDN fetch.
             await ensureEngineAssetSources(engine);
+            // Demo `unsplash` custom source (synchronous, idempotent) so asset_search
+            // has a real remote source alongside the CDN ones. Public IMG.LY proxy.
+            registerUnsplashSource(engine);
             // Per-session viewer base: session mode lives under /v/<sid> (reachable
             // through the CF Worker when IMGLY_PUBLIC_BASE_URL is set); single mode
             // keeps the fixed /viewer mount.

package/dist/cli/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/cli/http.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,yEAAyE;AACzE,mEAAmE;AACnE,+EAA+E;AAC/E,wEAAwE;AACxE,wEAAwE;AACxE,OAAO,EAAE,UAAU,EAAqB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,aAAa,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,sDAAsD;AAc9E,KAAK,UAAU,YAAY,CAAC,GAAiB;IAC3C,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC;YAC1B,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,eAAe;gBACtC,CAAC,CAAC;oBACE,WAAW,EAAE;wBACX,WAAW,EAAE,EAAE,CAAC,WAAW;wBAC3B,eAAe,EAAE,EAAE,CAAC,eAAe;qBACpC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;YACvD,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE;SAClC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAe;IAC3C,IAAI,GAAiB,CAAC;IACtB,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC3E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC;IACjC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,cAAc,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC;QACrC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;QAC1B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IACH,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,UAAU,GAAG,IAAI,KAAK,EAAE,CAAC;IAC/B,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACtD,uEAAuE;IACvE,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAElB,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;QACzC,MAAM,EAAE,cAAc,EAAE;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,WAAW,EAAE,GAAG,CAAC,UAAU;QAC3B,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,kBAAkB;QAClB,sBAAsB,EAAE,kBAAkB;QAC1C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,iBAAiB;YACvB,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC;QACP,aAAa,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE;YAClD,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACnD,0GAA0G;YAC1G,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACvC,wEAAwE;YACxE,wEAAwE;YACxE,iCAAiC;YACjC,MAAM,UAAU,GAAG,aAAa,CAAC;gBAC/B,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;gBACnB,SAAS;aACV,CAAC,CAAC;YACH,mEAAmE;YACnE,mEAAmE;YACnE,wEAAwE;YACxE,8DAA8D;YAC9D,iEAAiE;YACjE,MAAM,UAAU,GAAG,SAAS;gBAC1B,CAAC,CAAC,IAAI,qBAAqB,CAAC;oBACxB,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,WAAW;iBACZ,CAAC;gBACJ,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YACpD,2EAA2E;YAC3E,2EAA2E;YAC3E,mEAAmE;YACnE,yDAAyD;YACzD,wEAAwE;YACxE,4BAA4B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;gBAChC,IAAI,EAAE,CAAC;gBACP,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC;aAC9B,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,KAAK,EAAE,EAC7B,MAAM,EAAE,GAAG,EAIZ,EAAE,EAAE;gBACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;gBAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;gBACpD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE;oBAC1D,WAAW,EAAE,GAAG;iBACjB,CAAC,CAAC;gBACH,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAClD,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,4BAA4B,CAAC;gBACzC,EAAE,EAAE,QAAQ;gBACZ,KAAK;gBACL,OAAO;gBACP,UAAU;gBACV,OAAO;gBACP,UAAU;gBACV,YAAY,EAAE,KAAK;gBACnB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC9C,2EAA2E;gBAC3E,4EAA4E;gBAC5E,6EAA6E;gBAC7E,eAAe,EAAE,eAAwB;aAC1C,CAAC,CAAC;YACH,IAAI,QAAQ,EAAE,CAAC;gBACb,uEAAuE;gBACvE,iEAAiE;gBACjE,KAAK,CAAC,IAAI,CACR,iBAAiB,CAAC;oBAChB,QAAQ;oBACR,cAAc,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI;oBACvC,WAAW,EAAE,GAAG,CAAC,UAAU;iBAC5B,CAAC,CACH,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;QACD,WAAW,EAAE,CAAC,UAAU,EAAE,EAAE;YAC1B,IAAI,QAAQ,EAAE,CAAC;gBACb,2EAA2E;gBAC3E,qBAAqB,CAAC,UAAU,EAAE;oBAChC,QAAQ;oBACR,WAAW,EAAE,GAAG,CAAC,UAAU;oBAC3B,cAAc,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI;iBACxC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChC,qEAAqE;gBACrE,kBAAkB,CAAC,UAAU,EAAE;oBAC7B,KAAK;oBACL,WAAW;oBACX,YAAY,EAAE,OAAO;iBACtB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0CAA0C,GAAG,CAAC,IAAI,CAAC,IAAI,gDAAgD,CACxG,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,iBAAiB,CAC1C,KAAK,EACL,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,SAAS,CACvC,CAAC;YACF,MAAM,WAAW,GAAG,IAAI,aAAa,CAAC,cAAc,CAAC,CAAC;YACtD,UAAU,CAAC,GAAG,CACZ,SAAS,EACT,kBAAkB,CAAC;gBACjB,KAAK,EAAE,WAAW;gBAClB,EAAE,EAAE,cAAc;gBAClB,WAAW;gBACX,YAAY,EAAE,OAAO;aACtB,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,WAAW,CAC5B,GAAG,EAAE,CACH,KAAK,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA8B,OAAO,CAAC,MAAM,oBAAoB,CACjE,CAAC;IACN,CAAC,CAAC,EACJ,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,CACxC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0CAA0C,IAAI,IAAI,GAAG,CAAC,IAAI,MAAM;YAC9D,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,CAChE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACxC,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sBAAsB,MAAM,0BAA0B,CACvD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,MAAM,qBAAqB,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,CAC1D,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,aAAa,CAAC,UAAU,CAAC,CAAC;QAC1B,QAAQ,EAAE,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,WAAW,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACxD,CAAC","sourcesContent":["// packages/codesign-mcp/src/cli/http.ts\n//\n// codesign-mcp http — Streamable HTTP transport. Composition root: loads\n// IMGLY_* config, selects the storage backend (local|s3), builds a\n// PER-SESSION ScopedWorkspaceFS + RevisionStore, wires the workspace resolver,\n// and mounts the viewer: fixed `/viewer` in `single` mode, multi-tenant\n// `/v/<sid>` in `session` mode (disabled in `header` mode — follow-up).\nimport { loadConfig, type ServerConfig } from '../config.js';\nimport { ensureEngineAssetSources } from '../engine/asset-sources.js';\nimport { cesdkAdapter } from '../engine/cesdk-adapter.js';\nimport { Mutex } from '../engine/mutex.js';\nimport { EngineSession } from '../engine/session.js';\nimport { registerWorkspaceUriResolver } from '../engine/uri-resolver.js';\nimport { LocalGatewayClient } from '../gateway/local.js';\nimport { createCodesignHttpServer } from '../http/server.js';\nimport { makeWorkspaceResolver } from '../http/workspace-auth.js';\nimport { RevisionStore } from '../revisions/store.js';\nimport { ensureHeadlessEngine } from '../tools/engine.js';\nimport { buildDesignToolRegistrations } from '../tools/index.js';\nimport {\n  createViewerRouter,\n  LocalViewerUrlBuilder,\n  mountSessionViewer,\n  SseBroadcaster,\n  viewerBaseFor\n} from '../viewer/index.js';\nimport { PresignedR2UrlBuilder } from '../viewer/presigned-r2-url-builder.js';\nimport { NodeWorkspaceFS } from '../workspace/node-fs.js';\nimport { S3WorkspaceFS } from '../workspace/s3.js';\nimport { ScopedWorkspaceFS } from '../workspace/scoped.js';\nimport { loadNodeAssets } from '../assets/load-node.js';\nimport type { WorkspaceFS } from '../workspace/types.js';\nimport { mountMetricsEndpoints } from '../metrics/mount.js';\nimport { MetricsRecorder } from '../metrics/recorder.js';\nimport { createMetricsTool } from '../tools/metrics.js';\n\nconst HOST = '0.0.0.0'; // bind all interfaces; TLS/routing is the front's job\n\ninterface S3BackendInfo {\n  /** The real S3Client — used to build per-session presigned download URLs. */\n  client: import('@aws-sdk/client-s3').S3Client;\n  bucket: string;\n}\n\ninterface BackendResult {\n  rawFs: WorkspaceFS;\n  /** Present only when the s3 backend is active. */\n  s3?: S3BackendInfo;\n}\n\nasync function buildBackend(cfg: ServerConfig): Promise<BackendResult> {\n  if (cfg.workspace.backend === 's3') {\n    const { S3Client } = await import('@aws-sdk/client-s3');\n    const s3 = cfg.workspace.s3;\n    if (!s3)\n      throw new Error('config: s3 backend selected but s3 config missing');\n    const client = new S3Client({\n      region: s3.region,\n      ...(s3.endpoint ? { endpoint: s3.endpoint, forcePathStyle: true } : {}),\n      ...(s3.accessKeyId && s3.secretAccessKey\n        ? {\n            credentials: {\n              accessKeyId: s3.accessKeyId,\n              secretAccessKey: s3.secretAccessKey\n            }\n          }\n        : {})\n    });\n    return {\n      rawFs: new S3WorkspaceFS({ client, bucket: s3.bucket }),\n      s3: { client, bucket: s3.bucket }\n    };\n  }\n  return { rawFs: new NodeWorkspaceFS(cfg.workspace.dir ?? '/data') };\n}\n\nexport async function runHttp(_argv: string[]): Promise<void> {\n  let cfg: ServerConfig;\n  try {\n    cfg = loadConfig();\n  } catch (err) {\n    process.stderr.write(\n      `codesign-mcp http: ${err instanceof Error ? err.message : String(err)}\\n`\n    );\n    process.exit(1);\n  }\n\n  const license = cfg.cesdkLicense;\n  const { rawFs, s3: s3Backend } = await buildBackend(cfg);\n  const broadcaster = new SseBroadcaster();\n  const gateway = new LocalGatewayClient({\n    apiKey: cfg.gateway.apiKey,\n    ...(cfg.gateway.baseUrl ? { endpoint: cfg.gateway.baseUrl } : {})\n  });\n  // ensureHeadlessEngine is a process singleton, so EVERY session's tools\n  // operate on the same CE.SDK engine. This one lock — created once here, NOT\n  // per session — serializes all engine access across sessions so two clients\n  // editing concurrently can't corrupt each other's scene. When the engine\n  // becomes a per-session/per-workspace pool, this moves to be one lock per\n  // engine (per pool slot) so distinct engines run in parallel.\n  const engineLock = new Mutex();\n  const resolveWorkspaceId = makeWorkspaceResolver(cfg);\n  // Process-global perf recorder — constructed once, owns its own memory\n  // timer, DI'd into every session's MCP server. Undefined (and thus a no-op\n  // everywhere) unless IMGLY_METRICS_ENABLED is on.\n  const recorder = cfg.metricsEnabled ? new MetricsRecorder() : undefined;\n  recorder?.start();\n\n  const app = await createCodesignHttpServer({\n    assets: loadNodeAssets(),\n    buildId: cfg.buildId,\n    maxSessions: cfg.maxEngines,\n    idleTimeoutMs: cfg.idleTimeoutMs,\n    resolveWorkspaceId,\n    trustedSessionIdHeader: 'x-mcp-session-id',\n    ...(recorder ? { metrics: recorder } : {}),\n    ...(cfg.viewerCorsOrigins\n      ? { cors: { origin: cfg.viewerCorsOrigins } }\n      : {}),\n    createSession: async ({ sessionId, workspaceId }) => {\n      const scopedFs = new ScopedWorkspaceFS(rawFs, workspaceId);\n      const store = new RevisionStore(scopedFs);\n      const engine = await ensureHeadlessEngine(license);\n      // Idempotent (engine is a process singleton) — only the first successful registration pays the CDN fetch.\n      await ensureEngineAssetSources(engine);\n      // Per-session viewer base: session mode lives under /v/<sid> (reachable\n      // through the CF Worker when IMGLY_PUBLIC_BASE_URL is set); single mode\n      // keeps the fixed /viewer mount.\n      const viewerBase = viewerBaseFor({\n        publicBaseUrl: cfg.publicBaseUrl,\n        port: cfg.port,\n        mode: cfg.auth.mode,\n        sessionId\n      });\n      // Build a per-session URL builder. On the S3/R2 backend we use the\n      // PresignedR2UrlBuilder so forDownload returns a presigned GET URL\n      // directly from R2 — the /r/ Express route is not mounted on the hosted\n      // Cloudflare deployment. On the local backend we fall back to\n      // LocalViewerUrlBuilder (forDownload == forResource == /r/ URL).\n      const urlBuilder = s3Backend\n        ? new PresignedR2UrlBuilder({\n            base: viewerBase,\n            client: s3Backend.client,\n            bucket: s3Backend.bucket,\n            workspaceId\n          })\n        : new LocalViewerUrlBuilder({ base: viewerBase });\n      // The engine and its URI resolver are process-global (ensureHeadlessEngine\n      // is a cached singleton). Re-registering here is redundant after the first\n      // session but harmless — the resolver is always the same function.\n      // PresignedR2UrlBuilder inherits forResource (sync) from\n      // LocalViewerUrlBuilder, so the sync URI-resolver callback stays valid.\n      registerWorkspaceUriResolver(engine, urlBuilder);\n      const session = new EngineSession({\n        size: 1,\n        adapter: cesdkAdapter(engine)\n      });\n      const renderThumbnail = async ({\n        engine: eng\n      }: {\n        revision: string;\n        engine: import('@cesdk/engine').default;\n      }) => {\n        const pages = eng.scene.getPages?.() ?? [];\n        if (pages.length === 0) throw new Error('no pages');\n        const blob = await eng.block.export(pages[0], 'image/webp', {\n          targetWidth: 256\n        });\n        return new Uint8Array(await blob.arrayBuffer());\n      };\n      const tools = buildDesignToolRegistrations({\n        fs: scopedFs,\n        store,\n        session,\n        engineLock,\n        gateway,\n        urlBuilder,\n        allowOutPath: false,\n        onLeafWritten: (e) => broadcaster.broadcast(e),\n        // `as never`: buildDesignToolRegistrations is generic over the engine type\n        // (unknown at this composition root); the concrete @cesdk/engine type isn't\n        // threaded up here, so this is the sanctioned boundary cast (see no-as-any).\n        renderThumbnail: renderThumbnail as never\n      });\n      if (recorder) {\n        // Same merged shape as GET /metrics; `app` is assigned by the time any\n        // session is created (first initialize), so the closure is safe.\n        tools.push(\n          createMetricsTool({\n            recorder,\n            activeSessions: () => app.sessions.size,\n            maxSessions: cfg.maxEngines\n          })\n        );\n      }\n      return { engine, tools };\n    },\n    mountExtras: (expressApp) => {\n      if (recorder) {\n        // Metrics work in every workspace mode; the viewer (below) is single-only.\n        mountMetricsEndpoints(expressApp, {\n          recorder,\n          maxSessions: cfg.maxEngines,\n          activeSessions: () => app.sessions.size\n        });\n      }\n      if (cfg.auth.mode === 'session') {\n        // Multi-tenant viewer: /v/<sid> scopes reads to s/<sid> per request.\n        mountSessionViewer(expressApp, {\n          rawFs,\n          broadcaster,\n          cesdkLicense: license\n        });\n        return;\n      }\n      if (cfg.auth.mode !== 'single') {\n        process.stderr.write(\n          `codesign-mcp http: viewer disabled in \"${cfg.auth.mode}\" mode (multi-tenant viewer is a follow-up).\\n`\n        );\n        return;\n      }\n      const viewerScopedFs = new ScopedWorkspaceFS(\n        rawFs,\n        cfg.auth.fixedWorkspaceId ?? 'default'\n      );\n      const viewerStore = new RevisionStore(viewerScopedFs);\n      expressApp.use(\n        '/viewer',\n        createViewerRouter({\n          store: viewerStore,\n          fs: viewerScopedFs,\n          broadcaster,\n          cesdkLicense: license\n        })\n      );\n    }\n  });\n\n  const evictTimer = setInterval(\n    () =>\n      void app.sessions.evictIdle().then((evicted) => {\n        if (evicted.length > 0)\n          process.stderr.write(\n            `codesign-mcp http: evicted ${evicted.length} idle session(s)\\n`\n          );\n      }),\n    Math.max(10_000, cfg.idleTimeoutMs / 2)\n  );\n\n  const server = app.listen(cfg.port, HOST, () => {\n    process.stderr.write(\n      `codesign-mcp http: listening on http://${HOST}:${cfg.port}/mcp` +\n        ` (mode=${cfg.auth.mode} backend=${cfg.workspace.backend})\\n`\n    );\n  });\n\n  let shuttingDown = false;\n  const shutdown = async (signal: string) => {\n    if (shuttingDown) {\n      process.stderr.write(\n        `codesign-mcp http: ${signal} again — forcing exit.\\n`\n      );\n      process.exit(1);\n    }\n    shuttingDown = true;\n    process.stderr.write(`codesign-mcp http: ${signal} — shutting down.\\n`);\n    const hardExit = setTimeout(() => {\n      process.stderr.write(\n        'codesign-mcp http: shutdown timed out — forcing exit.\\n'\n      );\n      process.exit(1);\n    }, 5000);\n    hardExit.unref();\n    clearInterval(evictTimer);\n    recorder?.stop();\n    server.close();\n    server.closeAllConnections();\n    broadcaster.closeAll();\n    await app.shutdown();\n    process.exit(0);\n  };\n  process.on('SIGINT', () => void shutdown('SIGINT'));\n  process.on('SIGTERM', () => void shutdown('SIGTERM'));\n}\n"]}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/cli/http.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,yEAAyE;AACzE,mEAAmE;AACnE,+EAA+E;AAC/E,wEAAwE;AACxE,wEAAwE;AACxE,OAAO,EAAE,UAAU,EAAqB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,aAAa,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,sDAAsD;AAc9E,KAAK,UAAU,YAAY,CAAC,GAAiB;IAC3C,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,EAAE;YACL,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC;YAC1B,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,eAAe;gBACtC,CAAC,CAAC;oBACE,WAAW,EAAE;wBACX,WAAW,EAAE,EAAE,CAAC,WAAW;wBAC3B,eAAe,EAAE,EAAE,CAAC,eAAe;qBACpC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO;YACL,KAAK,EAAE,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;YACvD,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE;SAClC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAe;IAC3C,IAAI,GAAiB,CAAC;IACtB,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC3E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC;IACjC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,cAAc,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC;QACrC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;QAC1B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IACH,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,UAAU,GAAG,IAAI,KAAK,EAAE,CAAC;IAC/B,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACtD,uEAAuE;IACvE,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAElB,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC;QACzC,MAAM,EAAE,cAAc,EAAE;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,WAAW,EAAE,GAAG,CAAC,UAAU;QAC3B,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,kBAAkB;QAClB,sBAAsB,EAAE,kBAAkB;QAC1C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,iBAAiB;YACvB,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC;QACP,aAAa,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE;YAClD,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACnD,0GAA0G;YAC1G,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACvC,0EAA0E;YAC1E,wEAAwE;YACxE,sBAAsB,CAAC,MAAM,CAAC,CAAC;YAC/B,wEAAwE;YACxE,wEAAwE;YACxE,iCAAiC;YACjC,MAAM,UAAU,GAAG,aAAa,CAAC;gBAC/B,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;gBACnB,SAAS;aACV,CAAC,CAAC;YACH,mEAAmE;YACnE,mEAAmE;YACnE,wEAAwE;YACxE,8DAA8D;YAC9D,iEAAiE;YACjE,MAAM,UAAU,GAAG,SAAS;gBAC1B,CAAC,CAAC,IAAI,qBAAqB,CAAC;oBACxB,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,WAAW;iBACZ,CAAC;gBACJ,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YACpD,2EAA2E;YAC3E,2EAA2E;YAC3E,mEAAmE;YACnE,yDAAyD;YACzD,wEAAwE;YACxE,4BAA4B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;gBAChC,IAAI,EAAE,CAAC;gBACP,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC;aAC9B,CAAC,CAAC;YACH,MAAM,eAAe,GAAG,KAAK,EAAE,EAC7B,MAAM,EAAE,GAAG,EAIZ,EAAE,EAAE;gBACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;gBAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;gBACpD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE;oBAC1D,WAAW,EAAE,GAAG;iBACjB,CAAC,CAAC;gBACH,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAClD,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,4BAA4B,CAAC;gBACzC,EAAE,EAAE,QAAQ;gBACZ,KAAK;gBACL,OAAO;gBACP,UAAU;gBACV,OAAO;gBACP,UAAU;gBACV,YAAY,EAAE,KAAK;gBACnB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC9C,2EAA2E;gBAC3E,4EAA4E;gBAC5E,6EAA6E;gBAC7E,eAAe,EAAE,eAAwB;aAC1C,CAAC,CAAC;YACH,IAAI,QAAQ,EAAE,CAAC;gBACb,uEAAuE;gBACvE,iEAAiE;gBACjE,KAAK,CAAC,IAAI,CACR,iBAAiB,CAAC;oBAChB,QAAQ;oBACR,cAAc,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI;oBACvC,WAAW,EAAE,GAAG,CAAC,UAAU;iBAC5B,CAAC,CACH,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;QACD,WAAW,EAAE,CAAC,UAAU,EAAE,EAAE;YAC1B,IAAI,QAAQ,EAAE,CAAC;gBACb,2EAA2E;gBAC3E,qBAAqB,CAAC,UAAU,EAAE;oBAChC,QAAQ;oBACR,WAAW,EAAE,GAAG,CAAC,UAAU;oBAC3B,cAAc,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI;iBACxC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChC,qEAAqE;gBACrE,kBAAkB,CAAC,UAAU,EAAE;oBAC7B,KAAK;oBACL,WAAW;oBACX,YAAY,EAAE,OAAO;iBACtB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0CAA0C,GAAG,CAAC,IAAI,CAAC,IAAI,gDAAgD,CACxG,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,iBAAiB,CAC1C,KAAK,EACL,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,SAAS,CACvC,CAAC;YACF,MAAM,WAAW,GAAG,IAAI,aAAa,CAAC,cAAc,CAAC,CAAC;YACtD,UAAU,CAAC,GAAG,CACZ,SAAS,EACT,kBAAkB,CAAC;gBACjB,KAAK,EAAE,WAAW;gBAClB,EAAE,EAAE,cAAc;gBAClB,WAAW;gBACX,YAAY,EAAE,OAAO;aACtB,CAAC,CACH,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,WAAW,CAC5B,GAAG,EAAE,CACH,KAAK,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA8B,OAAO,CAAC,MAAM,oBAAoB,CACjE,CAAC;IACN,CAAC,CAAC,EACJ,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,CACxC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0CAA0C,IAAI,IAAI,GAAG,CAAC,IAAI,MAAM;YAC9D,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,CAChE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACxC,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sBAAsB,MAAM,0BAA0B,CACvD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,MAAM,qBAAqB,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,CAC1D,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,aAAa,CAAC,UAAU,CAAC,CAAC;QAC1B,QAAQ,EAAE,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,WAAW,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACxD,CAAC","sourcesContent":["// packages/codesign-mcp/src/cli/http.ts\n//\n// codesign-mcp http — Streamable HTTP transport. Composition root: loads\n// IMGLY_* config, selects the storage backend (local|s3), builds a\n// PER-SESSION ScopedWorkspaceFS + RevisionStore, wires the workspace resolver,\n// and mounts the viewer: fixed `/viewer` in `single` mode, multi-tenant\n// `/v/<sid>` in `session` mode (disabled in `header` mode — follow-up).\nimport { loadConfig, type ServerConfig } from '../config.js';\nimport { ensureEngineAssetSources } from '../engine/asset-sources.js';\nimport { cesdkAdapter } from '../engine/cesdk-adapter.js';\nimport { Mutex } from '../engine/mutex.js';\nimport { EngineSession } from '../engine/session.js';\nimport { registerUnsplashSource } from '../engine/unsplash-source.js';\nimport { registerWorkspaceUriResolver } from '../engine/uri-resolver.js';\nimport { LocalGatewayClient } from '../gateway/local.js';\nimport { createCodesignHttpServer } from '../http/server.js';\nimport { makeWorkspaceResolver } from '../http/workspace-auth.js';\nimport { RevisionStore } from '../revisions/store.js';\nimport { ensureHeadlessEngine } from '../tools/engine.js';\nimport { buildDesignToolRegistrations } from '../tools/index.js';\nimport {\n  createViewerRouter,\n  LocalViewerUrlBuilder,\n  mountSessionViewer,\n  SseBroadcaster,\n  viewerBaseFor\n} from '../viewer/index.js';\nimport { PresignedR2UrlBuilder } from '../viewer/presigned-r2-url-builder.js';\nimport { NodeWorkspaceFS } from '../workspace/node-fs.js';\nimport { S3WorkspaceFS } from '../workspace/s3.js';\nimport { ScopedWorkspaceFS } from '../workspace/scoped.js';\nimport { loadNodeAssets } from '../assets/load-node.js';\nimport type { WorkspaceFS } from '../workspace/types.js';\nimport { mountMetricsEndpoints } from '../metrics/mount.js';\nimport { MetricsRecorder } from '../metrics/recorder.js';\nimport { createMetricsTool } from '../tools/metrics.js';\n\nconst HOST = '0.0.0.0'; // bind all interfaces; TLS/routing is the front's job\n\ninterface S3BackendInfo {\n  /** The real S3Client — used to build per-session presigned download URLs. */\n  client: import('@aws-sdk/client-s3').S3Client;\n  bucket: string;\n}\n\ninterface BackendResult {\n  rawFs: WorkspaceFS;\n  /** Present only when the s3 backend is active. */\n  s3?: S3BackendInfo;\n}\n\nasync function buildBackend(cfg: ServerConfig): Promise<BackendResult> {\n  if (cfg.workspace.backend === 's3') {\n    const { S3Client } = await import('@aws-sdk/client-s3');\n    const s3 = cfg.workspace.s3;\n    if (!s3)\n      throw new Error('config: s3 backend selected but s3 config missing');\n    const client = new S3Client({\n      region: s3.region,\n      ...(s3.endpoint ? { endpoint: s3.endpoint, forcePathStyle: true } : {}),\n      ...(s3.accessKeyId && s3.secretAccessKey\n        ? {\n            credentials: {\n              accessKeyId: s3.accessKeyId,\n              secretAccessKey: s3.secretAccessKey\n            }\n          }\n        : {})\n    });\n    return {\n      rawFs: new S3WorkspaceFS({ client, bucket: s3.bucket }),\n      s3: { client, bucket: s3.bucket }\n    };\n  }\n  return { rawFs: new NodeWorkspaceFS(cfg.workspace.dir ?? '/data') };\n}\n\nexport async function runHttp(_argv: string[]): Promise<void> {\n  let cfg: ServerConfig;\n  try {\n    cfg = loadConfig();\n  } catch (err) {\n    process.stderr.write(\n      `codesign-mcp http: ${err instanceof Error ? err.message : String(err)}\\n`\n    );\n    process.exit(1);\n  }\n\n  const license = cfg.cesdkLicense;\n  const { rawFs, s3: s3Backend } = await buildBackend(cfg);\n  const broadcaster = new SseBroadcaster();\n  const gateway = new LocalGatewayClient({\n    apiKey: cfg.gateway.apiKey,\n    ...(cfg.gateway.baseUrl ? { endpoint: cfg.gateway.baseUrl } : {})\n  });\n  // ensureHeadlessEngine is a process singleton, so EVERY session's tools\n  // operate on the same CE.SDK engine. This one lock — created once here, NOT\n  // per session — serializes all engine access across sessions so two clients\n  // editing concurrently can't corrupt each other's scene. When the engine\n  // becomes a per-session/per-workspace pool, this moves to be one lock per\n  // engine (per pool slot) so distinct engines run in parallel.\n  const engineLock = new Mutex();\n  const resolveWorkspaceId = makeWorkspaceResolver(cfg);\n  // Process-global perf recorder — constructed once, owns its own memory\n  // timer, DI'd into every session's MCP server. Undefined (and thus a no-op\n  // everywhere) unless IMGLY_METRICS_ENABLED is on.\n  const recorder = cfg.metricsEnabled ? new MetricsRecorder() : undefined;\n  recorder?.start();\n\n  const app = await createCodesignHttpServer({\n    assets: loadNodeAssets(),\n    buildId: cfg.buildId,\n    maxSessions: cfg.maxEngines,\n    idleTimeoutMs: cfg.idleTimeoutMs,\n    resolveWorkspaceId,\n    trustedSessionIdHeader: 'x-mcp-session-id',\n    ...(recorder ? { metrics: recorder } : {}),\n    ...(cfg.viewerCorsOrigins\n      ? { cors: { origin: cfg.viewerCorsOrigins } }\n      : {}),\n    createSession: async ({ sessionId, workspaceId }) => {\n      const scopedFs = new ScopedWorkspaceFS(rawFs, workspaceId);\n      const store = new RevisionStore(scopedFs);\n      const engine = await ensureHeadlessEngine(license);\n      // Idempotent (engine is a process singleton) — only the first successful registration pays the CDN fetch.\n      await ensureEngineAssetSources(engine);\n      // Demo `unsplash` custom source (synchronous, idempotent) so asset_search\n      // has a real remote source alongside the CDN ones. Public IMG.LY proxy.\n      registerUnsplashSource(engine);\n      // Per-session viewer base: session mode lives under /v/<sid> (reachable\n      // through the CF Worker when IMGLY_PUBLIC_BASE_URL is set); single mode\n      // keeps the fixed /viewer mount.\n      const viewerBase = viewerBaseFor({\n        publicBaseUrl: cfg.publicBaseUrl,\n        port: cfg.port,\n        mode: cfg.auth.mode,\n        sessionId\n      });\n      // Build a per-session URL builder. On the S3/R2 backend we use the\n      // PresignedR2UrlBuilder so forDownload returns a presigned GET URL\n      // directly from R2 — the /r/ Express route is not mounted on the hosted\n      // Cloudflare deployment. On the local backend we fall back to\n      // LocalViewerUrlBuilder (forDownload == forResource == /r/ URL).\n      const urlBuilder = s3Backend\n        ? new PresignedR2UrlBuilder({\n            base: viewerBase,\n            client: s3Backend.client,\n            bucket: s3Backend.bucket,\n            workspaceId\n          })\n        : new LocalViewerUrlBuilder({ base: viewerBase });\n      // The engine and its URI resolver are process-global (ensureHeadlessEngine\n      // is a cached singleton). Re-registering here is redundant after the first\n      // session but harmless — the resolver is always the same function.\n      // PresignedR2UrlBuilder inherits forResource (sync) from\n      // LocalViewerUrlBuilder, so the sync URI-resolver callback stays valid.\n      registerWorkspaceUriResolver(engine, urlBuilder);\n      const session = new EngineSession({\n        size: 1,\n        adapter: cesdkAdapter(engine)\n      });\n      const renderThumbnail = async ({\n        engine: eng\n      }: {\n        revision: string;\n        engine: import('@cesdk/engine').default;\n      }) => {\n        const pages = eng.scene.getPages?.() ?? [];\n        if (pages.length === 0) throw new Error('no pages');\n        const blob = await eng.block.export(pages[0], 'image/webp', {\n          targetWidth: 256\n        });\n        return new Uint8Array(await blob.arrayBuffer());\n      };\n      const tools = buildDesignToolRegistrations({\n        fs: scopedFs,\n        store,\n        session,\n        engineLock,\n        gateway,\n        urlBuilder,\n        allowOutPath: false,\n        onLeafWritten: (e) => broadcaster.broadcast(e),\n        // `as never`: buildDesignToolRegistrations is generic over the engine type\n        // (unknown at this composition root); the concrete @cesdk/engine type isn't\n        // threaded up here, so this is the sanctioned boundary cast (see no-as-any).\n        renderThumbnail: renderThumbnail as never\n      });\n      if (recorder) {\n        // Same merged shape as GET /metrics; `app` is assigned by the time any\n        // session is created (first initialize), so the closure is safe.\n        tools.push(\n          createMetricsTool({\n            recorder,\n            activeSessions: () => app.sessions.size,\n            maxSessions: cfg.maxEngines\n          })\n        );\n      }\n      return { engine, tools };\n    },\n    mountExtras: (expressApp) => {\n      if (recorder) {\n        // Metrics work in every workspace mode; the viewer (below) is single-only.\n        mountMetricsEndpoints(expressApp, {\n          recorder,\n          maxSessions: cfg.maxEngines,\n          activeSessions: () => app.sessions.size\n        });\n      }\n      if (cfg.auth.mode === 'session') {\n        // Multi-tenant viewer: /v/<sid> scopes reads to s/<sid> per request.\n        mountSessionViewer(expressApp, {\n          rawFs,\n          broadcaster,\n          cesdkLicense: license\n        });\n        return;\n      }\n      if (cfg.auth.mode !== 'single') {\n        process.stderr.write(\n          `codesign-mcp http: viewer disabled in \"${cfg.auth.mode}\" mode (multi-tenant viewer is a follow-up).\\n`\n        );\n        return;\n      }\n      const viewerScopedFs = new ScopedWorkspaceFS(\n        rawFs,\n        cfg.auth.fixedWorkspaceId ?? 'default'\n      );\n      const viewerStore = new RevisionStore(viewerScopedFs);\n      expressApp.use(\n        '/viewer',\n        createViewerRouter({\n          store: viewerStore,\n          fs: viewerScopedFs,\n          broadcaster,\n          cesdkLicense: license\n        })\n      );\n    }\n  });\n\n  const evictTimer = setInterval(\n    () =>\n      void app.sessions.evictIdle().then((evicted) => {\n        if (evicted.length > 0)\n          process.stderr.write(\n            `codesign-mcp http: evicted ${evicted.length} idle session(s)\\n`\n          );\n      }),\n    Math.max(10_000, cfg.idleTimeoutMs / 2)\n  );\n\n  const server = app.listen(cfg.port, HOST, () => {\n    process.stderr.write(\n      `codesign-mcp http: listening on http://${HOST}:${cfg.port}/mcp` +\n        ` (mode=${cfg.auth.mode} backend=${cfg.workspace.backend})\\n`\n    );\n  });\n\n  let shuttingDown = false;\n  const shutdown = async (signal: string) => {\n    if (shuttingDown) {\n      process.stderr.write(\n        `codesign-mcp http: ${signal} again — forcing exit.\\n`\n      );\n      process.exit(1);\n    }\n    shuttingDown = true;\n    process.stderr.write(`codesign-mcp http: ${signal} — shutting down.\\n`);\n    const hardExit = setTimeout(() => {\n      process.stderr.write(\n        'codesign-mcp http: shutdown timed out — forcing exit.\\n'\n      );\n      process.exit(1);\n    }, 5000);\n    hardExit.unref();\n    clearInterval(evictTimer);\n    recorder?.stop();\n    server.close();\n    server.closeAllConnections();\n    broadcaster.closeAll();\n    await app.shutdown();\n    process.exit(0);\n  };\n  process.on('SIGINT', () => void shutdown('SIGINT'));\n  process.on('SIGTERM', () => void shutdown('SIGTERM'));\n}\n"]}

package/dist/cli/stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../src/cli/stdio.ts"],"names":[],"mappings":"AA6CA,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAmG9C"}
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../src/cli/stdio.ts"],"names":[],"mappings":"AAqDA,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CA0G9C"}

package/dist/cli/stdio.js

@@ -10,6 +10,13 @@
 // stdio's single-engine, single-workspace model is the simplest possible
 // wiring; HTTP transport (F2) reuses the same primitives per-session.
 //
+// Startup order matters: everything cheap (workspace, store, viewer listener,
+// tool wiring) runs before `server.connect()` so the MCP handshake replies
+// immediately. The expensive CE.SDK engine init + CDN asset-source fetch are
+// deferred to a background promise (bootstrapEngine) that the first tool call
+// awaits. Doing this work before connect can blow the host's MCP startup
+// timeout on a cold boot — seen as "fails on add/update, works after Reconnect".
+//
 // Optional env:
 //   CESDK_LICENSE — overrides the build-time-bundled trial license. Mandatory
 //   at GA / when no trial is baked in (see resolve-license.ts).
@@ -24,6 +31,7 @@ import { ensureEngineAssetSources } from '../engine/asset-sources.js';
 import { cesdkAdapter } from '../engine/cesdk-adapter.js';
 import { Mutex } from '../engine/mutex.js';
 import { EngineSession } from '../engine/session.js';
+import { registerUnsplashSource } from '../engine/unsplash-source.js';
 import { registerWorkspaceUriResolver } from '../engine/uri-resolver.js';
 import { LocalGatewayClient } from '../gateway/local.js';
 import { RevisionStore } from '../revisions/store.js';
@@ -50,26 +58,15 @@ export async function runStdio() {
     const workspaceRoot = process.env.CODESIGN_WORKSPACE ?? DEFAULT_WORKSPACE;
     const fs = new NodeWorkspaceFS(workspaceRoot);
     const store = new RevisionStore(fs);
-    let engine;
-    try {
-        engine = await ensureHeadlessEngine(license);
-    }
-    catch (err) {
-        if (usedTrial) {
-            process.stderr.write('codesign-mcp stdio: the bundled trial license was rejected (it may have expired). Set CESDK_LICENSE to a valid CE.SDK node license string.\n');
-        }
-        throw err;
-    }
-    // Default + demo asset sources so `asset_search` has content (CDN fetch,
-    // best-effort — a failure logs to stderr and the server still starts).
-    await ensureEngineAssetSources(engine);
-    const session = new EngineSession({ size: 1, adapter: cesdkAdapter(engine) });
     // One engine, one lock. stdio is single-session so there is no contention
     // today, but the engine tools require the lock and it keeps wiring uniform
     // with the HTTP transport.
     const engineLock = new Mutex();
     const broadcaster = new SseBroadcaster();
     const gateway = new LocalGatewayClient({ apiKey: process.env.API_KEY });
+    // The viewer listener binds an ephemeral localhost port — cheap and local, so
+    // it stays on the startup path. urlBuilder must exist before we build the tools
+    // and before the engine's workspace:// URI resolver is wired.
     const viewerRouter = createViewerRouter({
         store,
         fs,
@@ -80,9 +77,22 @@ export async function runStdio() {
     const listener = await startViewerListener({ router: viewerRouter });
     process.stderr.write(`codesign-mcp stdio: viewer at ${listener.base}\n`);
     const urlBuilder = new LocalViewerUrlBuilder({ base: listener.base });
-    // Resolve workspace:// asset URIs to the listener's /r/ route so the
-    // headless engine can fetch generated assets embedded in scenes.
-    registerWorkspaceUriResolver(engine, urlBuilder);
+    // Kick off the heavy engine bootstrap WITHOUT awaiting it — see the file
+    // header. server.connect() below answers the handshake while this runs.
+    const enginePromise = bootstrapEngine({ license, urlBuilder, usedTrial });
+    // Nothing awaits enginePromise until the first tool call. Attach a logger so a
+    // background init failure surfaces on stderr instead of crashing the process
+    // on an unhandled rejection; the awaiting tool call still sees the real error.
+    void enginePromise.catch((err) => {
+        process.stderr.write(`codesign-mcp stdio: engine initialization failed — ${err instanceof Error ? (err.stack ?? err.message) : String(err)}\n`);
+    });
+    // size=1, single shared engine resolved lazily from enginePromise.
+    // EngineSession only calls adapter.create() (awaiting the engine) on the first
+    // edit, by which point the bootstrap is usually already settled.
+    const session = new EngineSession({
+        size: 1,
+        adapter: cesdkAdapter(enginePromise)
+    });
     const renderThumbnail = async ({ engine: eng }) => {
         // Thumbnail = the scene's first page rendered to a 256-px webp. Best-effort.
         // We use page 0 of the scene; if the scene has no pages, throw → swallowed.
@@ -107,7 +117,6 @@ export async function runStdio() {
     });
     const assets = loadNodeAssets();
     const server = createCodesignMcpServer({
-        engine,
         assets,
         tools
     });
@@ -121,4 +130,32 @@ export async function runStdio() {
     process.on('SIGINT', () => void shutdown());
     process.on('SIGTERM', () => void shutdown());
 }
+// Heavy engine bootstrap, run in the background by runStdio (off the MCP
+// handshake path). Resolves to a fully-wired engine: design-unit-patched (by
+// ensureHeadlessEngine), workspace:// URI resolver installed, and — best-effort
+// — the default + demo + unsplash asset sources registered so asset_search has
+// content. The asset-source step hits the CDN; failures log to stderr and leave
+// the engine usable (asset_search just sees fewer sources).
+async function bootstrapEngine({ license, urlBuilder, usedTrial }) {
+    let engine;
+    try {
+        engine = await ensureHeadlessEngine(license);
+    }
+    catch (err) {
+        if (usedTrial) {
+            process.stderr.write('codesign-mcp stdio: the bundled trial license was rejected (it may have expired). Set CESDK_LICENSE to a valid CE.SDK node license string.\n');
+        }
+        throw err;
+    }
+    // Resolve workspace:// asset URIs to the listener's /r/ route so the headless
+    // engine can fetch generated assets embedded in scenes.
+    registerWorkspaceUriResolver(engine, urlBuilder);
+    // Default + demo asset sources so `asset_search` has content (CDN fetch,
+    // best-effort — a failure logs to stderr and the engine stays usable).
+    await ensureEngineAssetSources(engine);
+    // Demo `unsplash` custom source (synchronous, idempotent) so asset_search has
+    // a real remote source alongside the CDN ones. Public IMG.LY demo proxy.
+    registerUnsplashSource(engine);
+    return engine;
+}
 //# sourceMappingURL=stdio.js.map

package/dist/cli/stdio.js.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../src/cli/stdio.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,yFAAyF;AACzF,uCAAuC;AACvC,6DAA6D;AAC7D,oCAAoC;AACpC,mDAAmD;AACnD,4CAA4C;AAC5C,0CAA0C;AAC1C,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,EAAE;AACF,gBAAgB;AAChB,8EAA8E;AAC9E,gEAAgE;AAChE,EAAE;AACF,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,iBAAiB,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAExE,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,oFAAoF;IACpF,uBAAuB,EAAE,CAAC;IAE1B,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8HAA8H,CAC/H,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,gFAAgF;IAChF,4EAA4E;IAC5E,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAErD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,iBAAiB,CAAC;IAC1E,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,MAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8IAA8I,CAC/I,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,UAAU,GAAG,IAAI,KAAK,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,IAAI,cAAc,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,kBAAkB,CAAC;QACtC,KAAK;QACL,EAAE;QACF,WAAW;QACX,YAAY,EAAE,OAAO;QACrB,aAAa;KACd,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;IAEzE,MAAM,UAAU,GAAG,IAAI,qBAAqB,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,4BAA4B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAEjD,MAAM,eAAe,GAAG,KAAK,EAAE,EAC7B,MAAM,EAAE,GAAG,EAIZ,EAAuB,EAAE;QACxB,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE;YAC1D,WAAW,EAAE,GAAG;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,4BAA4B,CAAC;QACzC,EAAE;QACF,KAAK;QACL,OAAO;QACP,UAAU;QACV,OAAO;QACP,UAAU;QACV,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9C,eAAe,EAAE,eAAwB,CAAC,2DAA2D;KACtG,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,uBAAuB,CAAC;QACrC,MAAM;QACN,MAAM;QACN,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC/C,CAAC","sourcesContent":["// MCP server over stdin/stdout. Bootstraps:\n//   - Workspace (NodeWorkspaceFS rooted at $CODESIGN_WORKSPACE or ~/.codesign/workspace)\n//   - RevisionStore over the workspace\n//   - EngineSession (size=1) over the headless CE.SDK engine\n//   - SseBroadcaster for the viewer\n//   - Viewer router + ephemeral localhost listener\n//   - design + workspace tool registrations\n//   - LocalGatewayClient (reads $API_KEY)\n//\n// stdio's single-engine, single-workspace model is the simplest possible\n// wiring; HTTP transport (F2) reuses the same primitives per-session.\n//\n// Optional env:\n//   CESDK_LICENSE — overrides the build-time-bundled trial license. Mandatory\n//   at GA / when no trial is baked in (see resolve-license.ts).\n//\n// Logging note: stdout is reserved for MCP protocol traffic. Everything\n// human-facing (errors, progress) goes to stderr.\nimport { homedir } from 'node:os';\nimport { join as joinPath } from 'node:path';\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport { loadNodeAssets } from '../assets/load-node.js';\nimport { ensureEngineAssetSources } from '../engine/asset-sources.js';\nimport { cesdkAdapter } from '../engine/cesdk-adapter.js';\nimport { Mutex } from '../engine/mutex.js';\nimport { EngineSession } from '../engine/session.js';\nimport { registerWorkspaceUriResolver } from '../engine/uri-resolver.js';\nimport { LocalGatewayClient } from '../gateway/local.js';\nimport { RevisionStore } from '../revisions/store.js';\nimport { createCodesignMcpServer } from '../server.js';\nimport { ensureHeadlessEngine } from '../tools/engine.js';\nimport { buildDesignToolRegistrations } from '../tools/index.js';\nimport {\n  createViewerRouter,\n  LocalViewerUrlBuilder,\n  SseBroadcaster,\n  startViewerListener\n} from '../viewer/index.js';\nimport { NodeWorkspaceFS } from '../workspace/node-fs.js';\nimport { redirectConsoleToStderr } from './redirect-console.js';\nimport { resolveLicense } from './resolve-license.js';\nimport { TRIAL_CESDK_LICENSE } from './trial-license.generated.js';\n\nconst DEFAULT_WORKSPACE = joinPath(homedir(), '.codesign', 'workspace');\n\nexport async function runStdio(): Promise<void> {\n  // stdout is the JSON-RPC channel in stdio mode; keep engine console.* noise off it.\n  redirectConsoleToStderr();\n\n  const license = resolveLicense(process.env, TRIAL_CESDK_LICENSE);\n  if (!license) {\n    process.stderr.write(\n      'codesign-mcp stdio: no CESDK_LICENSE set and no bundled trial license — set CESDK_LICENSE to a CE.SDK node license string.\\n'\n    );\n    process.exit(1);\n  }\n  // True when the license came from the bundled trial (no explicit env override).\n  // Used only to turn an engine-init rejection into a trial-aware hint below.\n  const usedTrial = !process.env.CESDK_LICENSE?.trim();\n\n  const workspaceRoot = process.env.CODESIGN_WORKSPACE ?? DEFAULT_WORKSPACE;\n  const fs = new NodeWorkspaceFS(workspaceRoot);\n  const store = new RevisionStore(fs);\n  let engine: Awaited<ReturnType<typeof ensureHeadlessEngine>>;\n  try {\n    engine = await ensureHeadlessEngine(license);\n  } catch (err) {\n    if (usedTrial) {\n      process.stderr.write(\n        'codesign-mcp stdio: the bundled trial license was rejected (it may have expired). Set CESDK_LICENSE to a valid CE.SDK node license string.\\n'\n      );\n    }\n    throw err;\n  }\n  // Default + demo asset sources so `asset_search` has content (CDN fetch,\n  // best-effort — a failure logs to stderr and the server still starts).\n  await ensureEngineAssetSources(engine);\n  const session = new EngineSession({ size: 1, adapter: cesdkAdapter(engine) });\n  // One engine, one lock. stdio is single-session so there is no contention\n  // today, but the engine tools require the lock and it keeps wiring uniform\n  // with the HTTP transport.\n  const engineLock = new Mutex();\n  const broadcaster = new SseBroadcaster();\n  const gateway = new LocalGatewayClient({ apiKey: process.env.API_KEY });\n  const viewerRouter = createViewerRouter({\n    store,\n    fs,\n    broadcaster,\n    cesdkLicense: license,\n    workspaceRoot\n  });\n  const listener = await startViewerListener({ router: viewerRouter });\n  process.stderr.write(`codesign-mcp stdio: viewer at ${listener.base}\\n`);\n\n  const urlBuilder = new LocalViewerUrlBuilder({ base: listener.base });\n  // Resolve workspace:// asset URIs to the listener's /r/ route so the\n  // headless engine can fetch generated assets embedded in scenes.\n  registerWorkspaceUriResolver(engine, urlBuilder);\n\n  const renderThumbnail = async ({\n    engine: eng\n  }: {\n    revision: string;\n    engine: import('@cesdk/engine').default;\n  }): Promise<Uint8Array> => {\n    // Thumbnail = the scene's first page rendered to a 256-px webp. Best-effort.\n    // We use page 0 of the scene; if the scene has no pages, throw → swallowed.\n    const pages = eng.scene.getPages();\n    if (!pages || pages.length === 0) throw new Error('no pages');\n    const blob = await eng.block.export(pages[0], 'image/webp', {\n      targetWidth: 256\n    });\n    return new Uint8Array(await blob.arrayBuffer());\n  };\n\n  const tools = buildDesignToolRegistrations({\n    fs,\n    store,\n    session,\n    engineLock,\n    gateway,\n    urlBuilder,\n    allowOutPath: true,\n    onLeafWritten: (e) => broadcaster.broadcast(e),\n    renderThumbnail: renderThumbnail as never // adapter's E generic is `unknown`; cesdk engine type fits\n  });\n\n  const assets = loadNodeAssets();\n  const server = createCodesignMcpServer({\n    engine,\n    assets,\n    tools\n  });\n\n  const transport = new StdioServerTransport();\n  await server.connect(transport);\n\n  const shutdown = async () => {\n    await listener.close();\n    await server.close();\n    process.exit(0);\n  };\n  process.on('SIGINT', () => void shutdown());\n  process.on('SIGTERM', () => void shutdown());\n}\n"]}
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../src/cli/stdio.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,yFAAyF;AACzF,uCAAuC;AACvC,6DAA6D;AAC7D,oCAAoC;AACpC,mDAAmD;AACnD,4CAA4C;AAC5C,0CAA0C;AAC1C,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,iFAAiF;AACjF,EAAE;AACF,gBAAgB;AAChB,8EAA8E;AAC9E,gEAAgE;AAChE,EAAE;AACF,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,iBAAiB,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAExE,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,oFAAoF;IACpF,uBAAuB,EAAE,CAAC;IAE1B,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8HAA8H,CAC/H,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,gFAAgF;IAChF,4EAA4E;IAC5E,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAErD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,iBAAiB,CAAC;IAC1E,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;IAEpC,0EAA0E;IAC1E,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,UAAU,GAAG,IAAI,KAAK,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,IAAI,cAAc,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAExE,8EAA8E;IAC9E,gFAAgF;IAChF,8DAA8D;IAC9D,MAAM,YAAY,GAAG,kBAAkB,CAAC;QACtC,KAAK;QACL,EAAE;QACF,WAAW;QACX,YAAY,EAAE,OAAO;QACrB,aAAa;KACd,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,qBAAqB,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAEtE,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,aAAa,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1E,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sDACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAChE,IAAI,CACL,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,+EAA+E;IAC/E,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;QAChC,IAAI,EAAE,CAAC;QACP,OAAO,EAAE,YAAY,CAAC,aAAa,CAAC;KACrC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,KAAK,EAAE,EAC7B,MAAM,EAAE,GAAG,EAIZ,EAAuB,EAAE;QACxB,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE;YAC1D,WAAW,EAAE,GAAG;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,4BAA4B,CAAC;QACzC,EAAE;QACF,KAAK;QACL,OAAO;QACP,UAAU;QACV,OAAO;QACP,UAAU;QACV,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9C,eAAe,EAAE,eAAwB,CAAC,2DAA2D;KACtG,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,uBAAuB,CAAC;QACrC,MAAM;QACN,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,yEAAyE;AACzE,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,4DAA4D;AAC5D,KAAK,UAAU,eAAe,CAAC,EAC7B,OAAO,EACP,UAAU,EACV,SAAS,EAMV;IACC,IAAI,MAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8IAA8I,CAC/I,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,8EAA8E;IAC9E,wDAAwD;IACxD,4BAA4B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACjD,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACvC,8EAA8E;IAC9E,yEAAyE;IACzE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["// MCP server over stdin/stdout. Bootstraps:\n//   - Workspace (NodeWorkspaceFS rooted at $CODESIGN_WORKSPACE or ~/.codesign/workspace)\n//   - RevisionStore over the workspace\n//   - EngineSession (size=1) over the headless CE.SDK engine\n//   - SseBroadcaster for the viewer\n//   - Viewer router + ephemeral localhost listener\n//   - design + workspace tool registrations\n//   - LocalGatewayClient (reads $API_KEY)\n//\n// stdio's single-engine, single-workspace model is the simplest possible\n// wiring; HTTP transport (F2) reuses the same primitives per-session.\n//\n// Startup order matters: everything cheap (workspace, store, viewer listener,\n// tool wiring) runs before `server.connect()` so the MCP handshake replies\n// immediately. The expensive CE.SDK engine init + CDN asset-source fetch are\n// deferred to a background promise (bootstrapEngine) that the first tool call\n// awaits. Doing this work before connect can blow the host's MCP startup\n// timeout on a cold boot — seen as \"fails on add/update, works after Reconnect\".\n//\n// Optional env:\n//   CESDK_LICENSE — overrides the build-time-bundled trial license. Mandatory\n//   at GA / when no trial is baked in (see resolve-license.ts).\n//\n// Logging note: stdout is reserved for MCP protocol traffic. Everything\n// human-facing (errors, progress) goes to stderr.\nimport { homedir } from 'node:os';\nimport { join as joinPath } from 'node:path';\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport { loadNodeAssets } from '../assets/load-node.js';\nimport { ensureEngineAssetSources } from '../engine/asset-sources.js';\nimport { cesdkAdapter } from '../engine/cesdk-adapter.js';\nimport { Mutex } from '../engine/mutex.js';\nimport { EngineSession } from '../engine/session.js';\nimport { registerUnsplashSource } from '../engine/unsplash-source.js';\nimport { registerWorkspaceUriResolver } from '../engine/uri-resolver.js';\nimport { LocalGatewayClient } from '../gateway/local.js';\nimport { RevisionStore } from '../revisions/store.js';\nimport { createCodesignMcpServer } from '../server.js';\nimport { ensureHeadlessEngine } from '../tools/engine.js';\nimport { buildDesignToolRegistrations } from '../tools/index.js';\nimport {\n  createViewerRouter,\n  LocalViewerUrlBuilder,\n  SseBroadcaster,\n  startViewerListener\n} from '../viewer/index.js';\nimport { NodeWorkspaceFS } from '../workspace/node-fs.js';\nimport { redirectConsoleToStderr } from './redirect-console.js';\nimport { resolveLicense } from './resolve-license.js';\nimport { TRIAL_CESDK_LICENSE } from './trial-license.generated.js';\n\nconst DEFAULT_WORKSPACE = joinPath(homedir(), '.codesign', 'workspace');\n\nexport async function runStdio(): Promise<void> {\n  // stdout is the JSON-RPC channel in stdio mode; keep engine console.* noise off it.\n  redirectConsoleToStderr();\n\n  const license = resolveLicense(process.env, TRIAL_CESDK_LICENSE);\n  if (!license) {\n    process.stderr.write(\n      'codesign-mcp stdio: no CESDK_LICENSE set and no bundled trial license — set CESDK_LICENSE to a CE.SDK node license string.\\n'\n    );\n    process.exit(1);\n  }\n  // True when the license came from the bundled trial (no explicit env override).\n  // Used only to turn an engine-init rejection into a trial-aware hint below.\n  const usedTrial = !process.env.CESDK_LICENSE?.trim();\n\n  const workspaceRoot = process.env.CODESIGN_WORKSPACE ?? DEFAULT_WORKSPACE;\n  const fs = new NodeWorkspaceFS(workspaceRoot);\n  const store = new RevisionStore(fs);\n\n  // One engine, one lock. stdio is single-session so there is no contention\n  // today, but the engine tools require the lock and it keeps wiring uniform\n  // with the HTTP transport.\n  const engineLock = new Mutex();\n  const broadcaster = new SseBroadcaster();\n  const gateway = new LocalGatewayClient({ apiKey: process.env.API_KEY });\n\n  // The viewer listener binds an ephemeral localhost port — cheap and local, so\n  // it stays on the startup path. urlBuilder must exist before we build the tools\n  // and before the engine's workspace:// URI resolver is wired.\n  const viewerRouter = createViewerRouter({\n    store,\n    fs,\n    broadcaster,\n    cesdkLicense: license,\n    workspaceRoot\n  });\n  const listener = await startViewerListener({ router: viewerRouter });\n  process.stderr.write(`codesign-mcp stdio: viewer at ${listener.base}\\n`);\n  const urlBuilder = new LocalViewerUrlBuilder({ base: listener.base });\n\n  // Kick off the heavy engine bootstrap WITHOUT awaiting it — see the file\n  // header. server.connect() below answers the handshake while this runs.\n  const enginePromise = bootstrapEngine({ license, urlBuilder, usedTrial });\n  // Nothing awaits enginePromise until the first tool call. Attach a logger so a\n  // background init failure surfaces on stderr instead of crashing the process\n  // on an unhandled rejection; the awaiting tool call still sees the real error.\n  void enginePromise.catch((err) => {\n    process.stderr.write(\n      `codesign-mcp stdio: engine initialization failed — ${\n        err instanceof Error ? (err.stack ?? err.message) : String(err)\n      }\\n`\n    );\n  });\n\n  // size=1, single shared engine resolved lazily from enginePromise.\n  // EngineSession only calls adapter.create() (awaiting the engine) on the first\n  // edit, by which point the bootstrap is usually already settled.\n  const session = new EngineSession({\n    size: 1,\n    adapter: cesdkAdapter(enginePromise)\n  });\n\n  const renderThumbnail = async ({\n    engine: eng\n  }: {\n    revision: string;\n    engine: import('@cesdk/engine').default;\n  }): Promise<Uint8Array> => {\n    // Thumbnail = the scene's first page rendered to a 256-px webp. Best-effort.\n    // We use page 0 of the scene; if the scene has no pages, throw → swallowed.\n    const pages = eng.scene.getPages();\n    if (!pages || pages.length === 0) throw new Error('no pages');\n    const blob = await eng.block.export(pages[0], 'image/webp', {\n      targetWidth: 256\n    });\n    return new Uint8Array(await blob.arrayBuffer());\n  };\n\n  const tools = buildDesignToolRegistrations({\n    fs,\n    store,\n    session,\n    engineLock,\n    gateway,\n    urlBuilder,\n    allowOutPath: true,\n    onLeafWritten: (e) => broadcaster.broadcast(e),\n    renderThumbnail: renderThumbnail as never // adapter's E generic is `unknown`; cesdk engine type fits\n  });\n\n  const assets = loadNodeAssets();\n  const server = createCodesignMcpServer({\n    assets,\n    tools\n  });\n\n  const transport = new StdioServerTransport();\n  await server.connect(transport);\n\n  const shutdown = async () => {\n    await listener.close();\n    await server.close();\n    process.exit(0);\n  };\n  process.on('SIGINT', () => void shutdown());\n  process.on('SIGTERM', () => void shutdown());\n}\n\n// Heavy engine bootstrap, run in the background by runStdio (off the MCP\n// handshake path). Resolves to a fully-wired engine: design-unit-patched (by\n// ensureHeadlessEngine), workspace:// URI resolver installed, and — best-effort\n// — the default + demo + unsplash asset sources registered so asset_search has\n// content. The asset-source step hits the CDN; failures log to stderr and leave\n// the engine usable (asset_search just sees fewer sources).\nasync function bootstrapEngine({\n  license,\n  urlBuilder,\n  usedTrial\n}: {\n  license: string;\n  urlBuilder: LocalViewerUrlBuilder;\n  /** License came from the bundled trial — turns an init rejection into a hint. */\n  usedTrial: boolean;\n}): Promise<Awaited<ReturnType<typeof ensureHeadlessEngine>>> {\n  let engine: Awaited<ReturnType<typeof ensureHeadlessEngine>>;\n  try {\n    engine = await ensureHeadlessEngine(license);\n  } catch (err) {\n    if (usedTrial) {\n      process.stderr.write(\n        'codesign-mcp stdio: the bundled trial license was rejected (it may have expired). Set CESDK_LICENSE to a valid CE.SDK node license string.\\n'\n      );\n    }\n    throw err;\n  }\n  // Resolve workspace:// asset URIs to the listener's /r/ route so the headless\n  // engine can fetch generated assets embedded in scenes.\n  registerWorkspaceUriResolver(engine, urlBuilder);\n  // Default + demo asset sources so `asset_search` has content (CDN fetch,\n  // best-effort — a failure logs to stderr and the engine stays usable).\n  await ensureEngineAssetSources(engine);\n  // Demo `unsplash` custom source (synchronous, idempotent) so asset_search has\n  // a real remote source alongside the CDN ones. Public IMG.LY demo proxy.\n  registerUnsplashSource(engine);\n  return engine;\n}\n"]}

package/dist/engine/cesdk-adapter.d.ts

@@ -5,6 +5,12 @@ import type { EngineAdapter } from './session.js';
  * generic EngineAdapter shape. One-to-one mapping; the only quirk is `reset`
  * (CE.SDK has no `reset()` — we wipe by creating a new scene via the same
  * patched create path `ensureHeadlessEngine` installed for the design-unit fix).
+ *
+ * `engine` may be a Promise: the stdio transport defers engine init off the
+ * MCP-handshake path and hands the in-flight promise here. EngineSession only
+ * calls `create()` on the first slot (first edit), awaiting it then — by which
+ * point init is usually already settled. The other methods receive the resolved
+ * engine from EngineSession, so they never touch the promise.
  */
-export declare function cesdkAdapter(engine: CreativeEngine): EngineAdapter<CreativeEngine>;
+export declare function cesdkAdapter(engine: CreativeEngine | Promise<CreativeEngine>): EngineAdapter<CreativeEngine>;
 //# sourceMappingURL=cesdk-adapter.d.ts.map

package/dist/engine/cesdk-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cesdk-adapter.d.ts","sourceRoot":"","sources":["../../src/engine/cesdk-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,cAAc,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,GACrB,aAAa,CAAC,cAAc,CAAC,CAW/B"}
+{"version":3,"file":"cesdk-adapter.d.ts","sourceRoot":"","sources":["../../src/engine/cesdk-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,cAAc,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,GAC/C,aAAa,CAAC,cAAc,CAAC,CAW/B"}

package/dist/engine/cesdk-adapter.js

@@ -3,10 +3,16 @@
  * generic EngineAdapter shape. One-to-one mapping; the only quirk is `reset`
  * (CE.SDK has no `reset()` — we wipe by creating a new scene via the same
  * patched create path `ensureHeadlessEngine` installed for the design-unit fix).
+ *
+ * `engine` may be a Promise: the stdio transport defers engine init off the
+ * MCP-handshake path and hands the in-flight promise here. EngineSession only
+ * calls `create()` on the first slot (first edit), awaiting it then — by which
+ * point init is usually already settled. The other methods receive the resolved
+ * engine from EngineSession, so they never touch the promise.
  */
 export function cesdkAdapter(engine) {
     return {
-        create: () => engine, // single-engine adapter: always the same instance
+        create: () => engine, // single-engine adapter: always the same instance (awaited lazily if a promise)
         reset: async (eng) => {
             eng.scene.create(); // wipes the active scene; design-unit patch from tools/engine.ts re-applies
         },

package/dist/engine/cesdk-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"cesdk-adapter.js","sourceRoot":"","sources":["../../src/engine/cesdk-adapter.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAsB;IAEtB,OAAO;QACL,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,kDAAkD;QACxE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,4EAA4E;QAClG,CAAC;QACD,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnC,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE;KACtD,CAAC;AACJ,CAAC","sourcesContent":["import type CreativeEngine from '@cesdk/engine';\nimport type { EngineAdapter } from './session.js';\n\n/**\n * Adapts a `@cesdk/engine` CreativeEngine instance to the EngineSession's\n * generic EngineAdapter shape. One-to-one mapping; the only quirk is `reset`\n * (CE.SDK has no `reset()` — we wipe by creating a new scene via the same\n * patched create path `ensureHeadlessEngine` installed for the design-unit fix).\n */\nexport function cesdkAdapter(\n  engine: CreativeEngine\n): EngineAdapter<CreativeEngine> {\n  return {\n    create: () => engine, // single-engine adapter: always the same instance\n    reset: async (eng) => {\n      eng.scene.create(); // wipes the active scene; design-unit patch from tools/engine.ts re-applies\n    },\n    loadFromString: async (eng, scene) => {\n      await eng.scene.loadFromString(scene);\n    },\n    saveToString: async (eng) => eng.scene.saveToString()\n  };\n}\n"]}
+{"version":3,"file":"cesdk-adapter.js","sourceRoot":"","sources":["../../src/engine/cesdk-adapter.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAgD;IAEhD,OAAO;QACL,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,gFAAgF;QACtG,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,4EAA4E;QAClG,CAAC;QACD,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnC,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE;KACtD,CAAC;AACJ,CAAC","sourcesContent":["import type CreativeEngine from '@cesdk/engine';\nimport type { EngineAdapter } from './session.js';\n\n/**\n * Adapts a `@cesdk/engine` CreativeEngine instance to the EngineSession's\n * generic EngineAdapter shape. One-to-one mapping; the only quirk is `reset`\n * (CE.SDK has no `reset()` — we wipe by creating a new scene via the same\n * patched create path `ensureHeadlessEngine` installed for the design-unit fix).\n *\n * `engine` may be a Promise: the stdio transport defers engine init off the\n * MCP-handshake path and hands the in-flight promise here. EngineSession only\n * calls `create()` on the first slot (first edit), awaiting it then — by which\n * point init is usually already settled. The other methods receive the resolved\n * engine from EngineSession, so they never touch the promise.\n */\nexport function cesdkAdapter(\n  engine: CreativeEngine | Promise<CreativeEngine>\n): EngineAdapter<CreativeEngine> {\n  return {\n    create: () => engine, // single-engine adapter: always the same instance (awaited lazily if a promise)\n    reset: async (eng) => {\n      eng.scene.create(); // wipes the active scene; design-unit patch from tools/engine.ts re-applies\n    },\n    loadFromString: async (eng, scene) => {\n      await eng.scene.loadFromString(scene);\n    },\n    saveToString: async (eng) => eng.scene.saveToString()\n  };\n}\n"]}

package/dist/engine/unsplash-source.d.ts

@@ -0,0 +1,8 @@
+import type CreativeEngine from '@cesdk/engine';
+/**
+ * Adds the `unsplash` demo source to the (process-singleton) engine. Idempotent:
+ * a no-op once the source is present, so the per-session HTTP transport can call
+ * it on every session without re-registering.
+ */
+export declare function registerUnsplashSource(engine: CreativeEngine): void;
+//# sourceMappingURL=unsplash-source.d.ts.map

package/dist/engine/unsplash-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsplash-source.d.ts","sourceRoot":"","sources":["../../src/engine/unsplash-source.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,cAAc,MAAM,eAAe,CAAC;AA4ChD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CA+CnE"}

package/dist/engine/unsplash-source.js

@@ -0,0 +1,77 @@
+// packages/codesign-mcp/src/engine/unsplash-source.ts
+//
+// Registers a custom `unsplash` asset source backed by IMG.LY's public Unsplash
+// demo proxy, so `asset_search` (and engine.asset.apply) have a real remote,
+// customer-style custom source to exercise alongside the built-in CDN ones.
+// Shaped per the CE.SDK guide (import-media/from-remote-source/unsplash).
+//
+// Demo-grade on purpose: it maps `urls.regular` straight to the asset URI and
+// skips Unsplash's download-tracking endpoint. That's fine against IMG.LY's own
+// demo proxy for the beta, but a production Unsplash integration MUST trigger
+// the per-photo `links.download_location` endpoint on apply (Unsplash API ToS).
+const SOURCE_ID = 'unsplash';
+const PROXY_URL = 'https://api.img.ly/unsplashProxy';
+function translate(image) {
+    return {
+        id: image.id,
+        locale: 'en',
+        label: image.description ?? image.alt_description ?? 'Unsplash Image',
+        tags: image.tags?.map((t) => t.title),
+        meta: {
+            uri: image.urls.regular,
+            thumbUri: image.urls.thumb,
+            blockType: '//ly.img.ubq/graphic',
+            fillType: '//ly.img.ubq/fill/image',
+            shapeType: '//ly.img.ubq/shape/rect',
+            kind: 'image',
+            width: image.width,
+            height: image.height
+        },
+        credits: image.user?.name
+            ? { name: image.user.name, url: image.user?.links?.html }
+            : undefined
+    };
+}
+/**
+ * Adds the `unsplash` demo source to the (process-singleton) engine. Idempotent:
+ * a no-op once the source is present, so the per-session HTTP transport can call
+ * it on every session without re-registering.
+ */
+export function registerUnsplashSource(engine) {
+    if (engine.asset.findAllSources().includes(SOURCE_ID))
+        return;
+    engine.asset.addSource({
+        id: SOURCE_ID,
+        async findAssets(queryData) {
+            const page = queryData.page + 1; // Unsplash pages are 1-based
+            if (queryData.query) {
+                const res = await fetch(`${PROXY_URL}/search/photos?query=${encodeURIComponent(queryData.query)}&page=${page}&per_page=${queryData.perPage}`);
+                if (!res.ok)
+                    throw new Error(`unsplash proxy: HTTP ${res.status}`);
+                const body = (await res.json());
+                return {
+                    assets: body.results.map(translate),
+                    total: body.total,
+                    currentPage: queryData.page,
+                    nextPage: queryData.page + 1 < body.total_pages
+                        ? queryData.page + 1
+                        : undefined
+                };
+            }
+            const res = await fetch(`${PROXY_URL}/photos?order_by=popular&page=${page}&per_page=${queryData.perPage}`);
+            if (!res.ok)
+                throw new Error(`unsplash proxy: HTTP ${res.status}`);
+            const results = (await res.json());
+            return {
+                assets: results.map(translate),
+                total: queryData.page * queryData.perPage + results.length,
+                currentPage: queryData.page,
+                nextPage: results.length === queryData.perPage ? queryData.page + 1 : undefined
+            };
+        },
+        async applyAsset(assetResult) {
+            return engine.asset.defaultApplyAsset(assetResult);
+        }
+    });
+}
+//# sourceMappingURL=unsplash-source.js.map

package/dist/engine/unsplash-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsplash-source.js","sourceRoot":"","sources":["../../src/engine/unsplash-source.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAUhF,MAAM,SAAS,GAAG,UAAU,CAAC;AAC7B,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAarD,SAAS,SAAS,CAAC,KAAoB;IACrC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,eAAe,IAAI,gBAAgB;QACrE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACrC,IAAI,EAAE;YACJ,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;YACvB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YAC1B,SAAS,EAAE,sBAAsB;YACjC,QAAQ,EAAE,yBAAyB;YACnC,SAAS,EAAE,yBAAyB;YACpC,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB;QACD,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI;YACvB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;YACzD,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAsB;IAC3D,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO;IAC9D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QACrB,EAAE,EAAE,SAAS;QACb,KAAK,CAAC,UAAU,CACd,SAAyB;YAEzB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,6BAA6B;YAC9D,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,SAAS,wBAAwB,kBAAkB,CACpD,SAAS,CAAC,KAAK,CAChB,SAAS,IAAI,aAAa,SAAS,CAAC,OAAO,EAAE,CAC/C,CAAC;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACnE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;gBACF,OAAO;oBACL,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;oBACnC,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,SAAS,CAAC,IAAI;oBAC3B,QAAQ,EACN,SAAS,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW;wBACnC,CAAC,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC;wBACpB,CAAC,CAAC,SAAS;iBAChB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,SAAS,iCAAiC,IAAI,aAAa,SAAS,CAAC,OAAO,EAAE,CAClF,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoB,CAAC;YACtD,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;gBAC9B,KAAK,EAAE,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM;gBAC1D,WAAW,EAAE,SAAS,CAAC,IAAI;gBAC3B,QAAQ,EACN,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;aACxE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,WAAgC;YAC/C,OAAO,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACrD,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["// packages/codesign-mcp/src/engine/unsplash-source.ts\n//\n// Registers a custom `unsplash` asset source backed by IMG.LY's public Unsplash\n// demo proxy, so `asset_search` (and engine.asset.apply) have a real remote,\n// customer-style custom source to exercise alongside the built-in CDN ones.\n// Shaped per the CE.SDK guide (import-media/from-remote-source/unsplash).\n//\n// Demo-grade on purpose: it maps `urls.regular` straight to the asset URI and\n// skips Unsplash's download-tracking endpoint. That's fine against IMG.LY's own\n// demo proxy for the beta, but a production Unsplash integration MUST trigger\n// the per-photo `links.download_location` endpoint on apply (Unsplash API ToS).\n\nimport type CreativeEngine from '@cesdk/engine';\nimport type {\n  AssetQueryData,\n  AssetResult,\n  AssetsQueryResult,\n  CompleteAssetResult\n} from '@cesdk/engine';\n\nconst SOURCE_ID = 'unsplash';\nconst PROXY_URL = 'https://api.img.ly/unsplashProxy';\n\ninterface UnsplashPhoto {\n  id: string;\n  description?: string | null;\n  alt_description?: string | null;\n  width: number;\n  height: number;\n  urls: { regular: string; thumb: string };\n  user?: { name?: string; links?: { html?: string } };\n  tags?: Array<{ title: string }>;\n}\n\nfunction translate(image: UnsplashPhoto): AssetResult {\n  return {\n    id: image.id,\n    locale: 'en',\n    label: image.description ?? image.alt_description ?? 'Unsplash Image',\n    tags: image.tags?.map((t) => t.title),\n    meta: {\n      uri: image.urls.regular,\n      thumbUri: image.urls.thumb,\n      blockType: '//ly.img.ubq/graphic',\n      fillType: '//ly.img.ubq/fill/image',\n      shapeType: '//ly.img.ubq/shape/rect',\n      kind: 'image',\n      width: image.width,\n      height: image.height\n    },\n    credits: image.user?.name\n      ? { name: image.user.name, url: image.user?.links?.html }\n      : undefined\n  };\n}\n\n/**\n * Adds the `unsplash` demo source to the (process-singleton) engine. Idempotent:\n * a no-op once the source is present, so the per-session HTTP transport can call\n * it on every session without re-registering.\n */\nexport function registerUnsplashSource(engine: CreativeEngine): void {\n  if (engine.asset.findAllSources().includes(SOURCE_ID)) return;\n  engine.asset.addSource({\n    id: SOURCE_ID,\n    async findAssets(\n      queryData: AssetQueryData\n    ): Promise<AssetsQueryResult | undefined> {\n      const page = queryData.page + 1; // Unsplash pages are 1-based\n      if (queryData.query) {\n        const res = await fetch(\n          `${PROXY_URL}/search/photos?query=${encodeURIComponent(\n            queryData.query\n          )}&page=${page}&per_page=${queryData.perPage}`\n        );\n        if (!res.ok) throw new Error(`unsplash proxy: HTTP ${res.status}`);\n        const body = (await res.json()) as {\n          results: UnsplashPhoto[];\n          total: number;\n          total_pages: number;\n        };\n        return {\n          assets: body.results.map(translate),\n          total: body.total,\n          currentPage: queryData.page,\n          nextPage:\n            queryData.page + 1 < body.total_pages\n              ? queryData.page + 1\n              : undefined\n        };\n      }\n      const res = await fetch(\n        `${PROXY_URL}/photos?order_by=popular&page=${page}&per_page=${queryData.perPage}`\n      );\n      if (!res.ok) throw new Error(`unsplash proxy: HTTP ${res.status}`);\n      const results = (await res.json()) as UnsplashPhoto[];\n      return {\n        assets: results.map(translate),\n        total: queryData.page * queryData.perPage + results.length,\n        currentPage: queryData.page,\n        nextPage:\n          results.length === queryData.perPage ? queryData.page + 1 : undefined\n      };\n    },\n    async applyAsset(assetResult: CompleteAssetResult) {\n      return engine.asset.defaultApplyAsset(assetResult);\n    }\n  });\n}\n"]}

package/dist/http/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAa,EAAE,KAAK,WAAW,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAgB,EACd,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,cAAc,EAEpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,2BAA2B,EAChC,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA2B,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACnD,SAAS,EAAE,6BAA6B,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACjE;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,aAAa,EAAE,CAAC,GAAG,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QAC1E,MAAM,EAAE,OAAO,CAAC;QAChB,KAAK,EAAE,2BAA2B,EAAE,CAAC;QACrC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;KAC/B,CAAC,CAAC;IACH,gFAAgF;IAChF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,gDAAgD;IAChD,IAAI,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAmB,SAAQ,OAAO;IACjD,QAAQ,EAAE,cAAc,CACtB,mBAAmB,EACnB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAC3C,CAAC;IACF,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,kBAAkB,CAAC,CAyL7B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAa,EAAE,KAAK,WAAW,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAgB,EACd,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,cAAc,EAEpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,2BAA2B,EAChC,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA2B,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACnD,SAAS,EAAE,6BAA6B,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACjE;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,aAAa,EAAE,CAAC,GAAG,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QAC1E,MAAM,EAAE,OAAO,CAAC;QAChB,KAAK,EAAE,2BAA2B,EAAE,CAAC;QACrC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;KAC/B,CAAC,CAAC;IACH,gFAAgF;IAChF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,gDAAgD;IAChD,IAAI,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAmB,SAAQ,OAAO;IACjD,QAAQ,EAAE,cAAc,CACtB,mBAAmB,EACnB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAC3C,CAAC;IACF,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,kBAAkB,CAAC,CAwL7B"}

package/dist/http/server.js

@@ -19,7 +19,6 @@ export async function createCodesignHttpServer(opts) {
                 workspaceId: ctx.workspaceId
             });
             const server = createCodesignMcpServer({
-                engine,
                 assets: opts.assets,
                 resourceScheme: opts.resourceScheme,
                 tools,

package/dist/http/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,IAA0B,MAAM,MAAM,CAAC;AAC9C,OAAO,OAKN,MAAM,SAAS,CAAC;AACjB,OAAO,EAEL,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AA2EzD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAqC;IAErC,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAExE,MAAM,UAAU,GAAG,IAAI,cAAc,CAGnC;QACA,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,KAAK,CACb,uDAAuD,CACxD,CAAC;YACJ,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;YACzB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;gBAC1D,SAAS,EAAE,EAAE;gBACb,WAAW,EAAE,GAAG,CAAC,WAAW;aAC7B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,MAAM;gBACN,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,KAAK;gBACL,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE;gBAC5B,sEAAsE;gBACtE,uEAAuE;gBACvE,sEAAsE;gBACtE,oEAAoE;gBACpE,oEAAoE;gBACpE,iEAAiE;gBACjE,0CAA0C;gBAC1C,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE;oBACvB,KAAK,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;wBACrC,qEAAqE;oBACvE,CAAC,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACnB,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,0EAA0E;YAC1E,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,OAAO,EAAwB,CAAC;IAC5C,GAAG,CAAC,QAAQ,GAAG,UAAU,CAAC;IAE1B,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,qEAAqE;IACrE,SAAS,OAAO,CAAC,CAAU;QACzB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC;YACvD,CAAC,CAAG,CAAwB,CAAC,IAA2B;YACxD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QAClE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAE/C,kEAAkE;QAClE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB;gBAC1C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;gBAC9D,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,YAAY,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;YAC9C,IAAI,WAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,WAAW,GAAG,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;oBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;wBAC7C,EAAE,EAAE,IAAI;qBACT,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE;oBAClD,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,OAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;oBAChC,SAAS,EAAE,YAAY;oBACvB,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;oBAC3C,GAAG;yBACA,MAAM,CAAC,GAAG,CAAC;yBACX,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC;yBACxB,IAAI,CAAC;wBACJ,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;wBAC7C,EAAE,EAAE,IAAI;qBACT,CAAC,CAAC;oBACL,OAAO;gBACT,CAAC;gBACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC,KAAK;4BACZ,OAAO,EACL,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;yBAC7D;wBACD,EAAE,EAAE,IAAI;qBACT,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE;oBAClD,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,qDAAqD;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE;gBAClE,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,SAAS,EAAE,EAAE;gBACjE,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,WAAW;QAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAE5C,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3B,GAAG,CAAC,QAAQ,GAAG,KAAK,IAAI,EAAE;QACxB,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;IAChC,CAAC,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport cors, { type CorsOptions } from 'cors';\nimport express, {\n  type Express,\n  type Request,\n  type RequestHandler,\n  type Response\n} from 'express';\nimport {\n  type CodesignMcpToolRegistration,\n  createCodesignMcpServer\n} from '../server.js';\nimport { SessionCapExceededError, SessionManager } from './session-manager.js';\nimport { WorkspaceAuthError } from './workspace-auth.js';\nimport type { MetricsRecorder } from '../metrics/recorder.js';\n\n/**\n * Per-session state held by the SessionManager: the engine, the MCP server,\n * and the per-session HTTP transport. Every incoming request with this\n * session's id is routed to `transport.handleRequest`.\n */\nexport interface CodesignHttpSession {\n  id: string;\n  engine: unknown;\n  server: ReturnType<typeof createCodesignMcpServer>;\n  transport: StreamableHTTPServerTransport;\n  dispose?: () => Promise<void>;\n}\n\nexport interface CreateCodesignHttpServerOptions {\n  assets: Record<string, string>;\n  resourceScheme?: string;\n  maxSessions: number;\n  idleTimeoutMs: number;\n  /**\n   * Resolve the front-asserted workspaceId for a new MCP session. Receives the\n   * freshly-minted session id (so `session` mode can derive `s/<id>`). May throw\n   * WorkspaceAuthError → 401. Default: a fixed \"default\" workspace.\n   */\n  resolveWorkspaceId?: (req: Request, sessionId: string) => string;\n  /**\n   * When set, an `initialize` request carrying this (case-insensitive) header uses\n   * its value as the MCP session id instead of minting one. The Worker/front\n   * mints the id so it can route follow-ups to the same warm instance (spec §3).\n   * The front MUST strip any client-supplied value of this header — same trust\n   * posture as the workspace header. Absent header → mint as normal.\n   */\n  trustedSessionIdHeader?: string;\n  /** Build everything needed for one session in one go. */\n  createSession: (ctx: { sessionId: string; workspaceId: string }) => Promise<{\n    engine: unknown;\n    tools: CodesignMcpToolRegistration[];\n    dispose?: () => Promise<void>;\n  }>;\n  /** Optional: mount additional routes (viewer router, dashboards) before MCP. */\n  mountExtras?: (app: Express) => void;\n  /**\n   * Optional metrics recorder, DI'd into every session's MCP server so tool\n   * calls are timed at the single dispatch chokepoint. Absent → no timing.\n   */\n  metrics?: MetricsRecorder;\n  /** Build identity reported as `serverInfo.version`. Default `'dev'`. */\n  buildId?: string;\n  /** Optional auth middleware — runs before MCP routing. Default: no-op. */\n  auth?: RequestHandler;\n  /** Optional CORS options. Default: disabled. */\n  cors?: CorsOptions | false;\n}\n\n/**\n * Express app exposing MCP over Streamable HTTP at /mcp. Stateful sessions:\n * each MCP `initialize` call spawns a fresh session (engine + server +\n * transport); follow-up requests carry `Mcp-Session-Id` to route back. The\n * underlying SessionManager enforces idle eviction and a session cap.\n *\n * The returned object exposes:\n *   .listen / .use / etc.    — Express's surface (composes into larger apps)\n *   .sessions                 — the SessionManager (testing + ops insight)\n *   .shutdown()               — destroy every active session, dispose engines\n */\nexport interface CodesignHttpServer extends Express {\n  sessions: SessionManager<\n    CodesignHttpSession,\n    { sessionId: string; workspaceId: string }\n  >;\n  shutdown(): Promise<void>;\n}\n\nexport async function createCodesignHttpServer(\n  opts: CreateCodesignHttpServerOptions\n): Promise<CodesignHttpServer> {\n  const resolveWorkspaceId = opts.resolveWorkspaceId ?? (() => 'default');\n\n  const sessionMgr = new SessionManager<\n    CodesignHttpSession,\n    { sessionId: string; workspaceId: string }\n  >({\n    maxSessions: opts.maxSessions,\n    idleTimeoutMs: opts.idleTimeoutMs,\n    create: async (ctx) => {\n      if (!ctx)\n        throw new Error(\n          'createCodesignHttpServer: session context is required'\n        );\n      const id = ctx.sessionId;\n      const { engine, tools, dispose } = await opts.createSession({\n        sessionId: id,\n        workspaceId: ctx.workspaceId\n      });\n      const server = createCodesignMcpServer({\n        engine,\n        assets: opts.assets,\n        resourceScheme: opts.resourceScheme,\n        tools,\n        ...(opts.buildId ? { buildId: opts.buildId } : {}),\n        ...(opts.metrics ? { metrics: opts.metrics } : {})\n      });\n      const transport = new StreamableHTTPServerTransport({\n        sessionIdGenerator: () => id,\n        // A client `DELETE /mcp` (graceful termination) fires this before the\n        // transport closes itself. Bridge it to the SessionManager so the slot\n        // and its engine are reclaimed immediately instead of squatting until\n        // idle eviction. Only fires on the DELETE path — not from transport\n        // `close()` during `destroy` — so there is no re-entrancy: `delete`\n        // removes the map entry first, then runs `destroy` (a redundant,\n        // idempotent second `transport.close()`).\n        onsessionclosed: (sid) => {\n          void sessionMgr.delete(sid).catch(() => {\n            // Already gone (idle-evicted, or a duplicate close) — nothing to do.\n          });\n        }\n      });\n      await server.connect(transport);\n      return { id, engine, server, transport, dispose };\n    },\n    destroy: async (s) => {\n      try {\n        await s.transport.close();\n      } catch {\n        // ignore — best-effort\n      }\n      try {\n        await s.server.close();\n      } catch {\n        // ignore\n      }\n      // Call the session's dispose callback if provided (e.g. engine teardown).\n      try {\n        await s.dispose?.();\n      } catch {\n        // ignore\n      }\n    }\n  });\n\n  const app = express() as CodesignHttpServer;\n  app.sessions = sessionMgr;\n\n  if (opts.cors !== false) {\n    app.use(cors(opts.cors));\n  }\n  if (opts.auth) {\n    app.use(opts.auth);\n  }\n  app.use(express.json({ limit: '16mb' }));\n\n  /** Narrow `code` out of an unknown thrown value without `as any`. */\n  function errCode(e: unknown): string | undefined {\n    return typeof e === 'object' && e !== null && 'code' in e\n      ? ((e as { code?: unknown }).code as string | undefined)\n      : undefined;\n  }\n\n  const handle = async (req: Request, res: Response): Promise<void> => {\n    const sessionId = req.header('mcp-session-id');\n\n    // Initialization (POST without session id) → spawn a new session.\n    if (req.method === 'POST' && !sessionId) {\n      const injected = opts.trustedSessionIdHeader\n        ? req.header(opts.trustedSessionIdHeader)?.trim() || undefined\n        : undefined;\n      const newSessionId = injected ?? randomUUID();\n      let workspaceId: string;\n      try {\n        workspaceId = resolveWorkspaceId(req, newSessionId);\n      } catch (err) {\n        if (err instanceof WorkspaceAuthError) {\n          res.status(401).json({\n            jsonrpc: '2.0',\n            error: { code: -32002, message: err.message },\n            id: null\n          });\n          return;\n        }\n        res.status(500).json({\n          jsonrpc: '2.0',\n          error: { code: -32603, message: 'internal error' },\n          id: null\n        });\n        return;\n      }\n      let session: CodesignHttpSession;\n      try {\n        session = await sessionMgr.create({\n          sessionId: newSessionId,\n          workspaceId\n        });\n      } catch (err) {\n        if (err instanceof SessionCapExceededError) {\n          res\n            .status(503)\n            .set('Retry-After', '30')\n            .json({\n              jsonrpc: '2.0',\n              error: { code: -32000, message: err.message },\n              id: null\n            });\n          return;\n        }\n        if (errCode(err) === 'EINVAL') {\n          res.status(400).json({\n            jsonrpc: '2.0',\n            error: {\n              code: -32602,\n              message:\n                err instanceof Error ? err.message : 'invalid workspaceId'\n            },\n            id: null\n          });\n          return;\n        }\n        res.status(500).json({\n          jsonrpc: '2.0',\n          error: { code: -32603, message: 'internal error' },\n          id: null\n        });\n        return;\n      }\n      await session.transport.handleRequest(req, res, req.body);\n      return;\n    }\n\n    // Subsequent requests must carry a known session id.\n    if (!sessionId) {\n      res.status(400).json({\n        jsonrpc: '2.0',\n        error: { code: -32600, message: 'Mcp-Session-Id header required' },\n        id: null\n      });\n      return;\n    }\n    const session = sessionMgr.get(sessionId);\n    if (!session) {\n      res.status(404).json({\n        jsonrpc: '2.0',\n        error: { code: -32001, message: `unknown session: ${sessionId}` },\n        id: null\n      });\n      return;\n    }\n    sessionMgr.touch(sessionId);\n    await session.transport.handleRequest(req, res, req.body);\n  };\n\n  if (opts.mountExtras) opts.mountExtras(app);\n\n  app.post('/mcp', handle);\n  app.get('/mcp', handle);\n  app.delete('/mcp', handle);\n\n  app.shutdown = async () => {\n    await sessionMgr.destroyAll();\n  };\n\n  return app;\n}\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,IAA0B,MAAM,MAAM,CAAC;AAC9C,OAAO,OAKN,MAAM,SAAS,CAAC;AACjB,OAAO,EAEL,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AA2EzD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAqC;IAErC,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAExE,MAAM,UAAU,GAAG,IAAI,cAAc,CAGnC;QACA,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,KAAK,CACb,uDAAuD,CACxD,CAAC;YACJ,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;YACzB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;gBAC1D,SAAS,EAAE,EAAE;gBACb,WAAW,EAAE,GAAG,CAAC,WAAW;aAC7B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,KAAK;gBACL,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE;gBAC5B,sEAAsE;gBACtE,uEAAuE;gBACvE,sEAAsE;gBACtE,oEAAoE;gBACpE,oEAAoE;gBACpE,iEAAiE;gBACjE,0CAA0C;gBAC1C,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE;oBACvB,KAAK,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;wBACrC,qEAAqE;oBACvE,CAAC,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACnB,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,0EAA0E;YAC1E,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,OAAO,EAAwB,CAAC;IAC5C,GAAG,CAAC,QAAQ,GAAG,UAAU,CAAC;IAE1B,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,qEAAqE;IACrE,SAAS,OAAO,CAAC,CAAU;QACzB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC;YACvD,CAAC,CAAG,CAAwB,CAAC,IAA2B;YACxD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QAClE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAE/C,kEAAkE;QAClE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB;gBAC1C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;gBAC9D,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,YAAY,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;YAC9C,IAAI,WAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,WAAW,GAAG,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;oBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;wBAC7C,EAAE,EAAE,IAAI;qBACT,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE;oBAClD,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,OAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;oBAChC,SAAS,EAAE,YAAY;oBACvB,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;oBAC3C,GAAG;yBACA,MAAM,CAAC,GAAG,CAAC;yBACX,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC;yBACxB,IAAI,CAAC;wBACJ,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;wBAC7C,EAAE,EAAE,IAAI;qBACT,CAAC,CAAC;oBACL,OAAO;gBACT,CAAC;gBACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC,KAAK;4BACZ,OAAO,EACL,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;yBAC7D;wBACD,EAAE,EAAE,IAAI;qBACT,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE;oBAClD,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,qDAAqD;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE;gBAClE,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,SAAS,EAAE,EAAE;gBACjE,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,WAAW;QAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAE5C,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3B,GAAG,CAAC,QAAQ,GAAG,KAAK,IAAI,EAAE;QACxB,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;IAChC,CAAC,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport cors, { type CorsOptions } from 'cors';\nimport express, {\n  type Express,\n  type Request,\n  type RequestHandler,\n  type Response\n} from 'express';\nimport {\n  type CodesignMcpToolRegistration,\n  createCodesignMcpServer\n} from '../server.js';\nimport { SessionCapExceededError, SessionManager } from './session-manager.js';\nimport { WorkspaceAuthError } from './workspace-auth.js';\nimport type { MetricsRecorder } from '../metrics/recorder.js';\n\n/**\n * Per-session state held by the SessionManager: the engine, the MCP server,\n * and the per-session HTTP transport. Every incoming request with this\n * session's id is routed to `transport.handleRequest`.\n */\nexport interface CodesignHttpSession {\n  id: string;\n  engine: unknown;\n  server: ReturnType<typeof createCodesignMcpServer>;\n  transport: StreamableHTTPServerTransport;\n  dispose?: () => Promise<void>;\n}\n\nexport interface CreateCodesignHttpServerOptions {\n  assets: Record<string, string>;\n  resourceScheme?: string;\n  maxSessions: number;\n  idleTimeoutMs: number;\n  /**\n   * Resolve the front-asserted workspaceId for a new MCP session. Receives the\n   * freshly-minted session id (so `session` mode can derive `s/<id>`). May throw\n   * WorkspaceAuthError → 401. Default: a fixed \"default\" workspace.\n   */\n  resolveWorkspaceId?: (req: Request, sessionId: string) => string;\n  /**\n   * When set, an `initialize` request carrying this (case-insensitive) header uses\n   * its value as the MCP session id instead of minting one. The Worker/front\n   * mints the id so it can route follow-ups to the same warm instance (spec §3).\n   * The front MUST strip any client-supplied value of this header — same trust\n   * posture as the workspace header. Absent header → mint as normal.\n   */\n  trustedSessionIdHeader?: string;\n  /** Build everything needed for one session in one go. */\n  createSession: (ctx: { sessionId: string; workspaceId: string }) => Promise<{\n    engine: unknown;\n    tools: CodesignMcpToolRegistration[];\n    dispose?: () => Promise<void>;\n  }>;\n  /** Optional: mount additional routes (viewer router, dashboards) before MCP. */\n  mountExtras?: (app: Express) => void;\n  /**\n   * Optional metrics recorder, DI'd into every session's MCP server so tool\n   * calls are timed at the single dispatch chokepoint. Absent → no timing.\n   */\n  metrics?: MetricsRecorder;\n  /** Build identity reported as `serverInfo.version`. Default `'dev'`. */\n  buildId?: string;\n  /** Optional auth middleware — runs before MCP routing. Default: no-op. */\n  auth?: RequestHandler;\n  /** Optional CORS options. Default: disabled. */\n  cors?: CorsOptions | false;\n}\n\n/**\n * Express app exposing MCP over Streamable HTTP at /mcp. Stateful sessions:\n * each MCP `initialize` call spawns a fresh session (engine + server +\n * transport); follow-up requests carry `Mcp-Session-Id` to route back. The\n * underlying SessionManager enforces idle eviction and a session cap.\n *\n * The returned object exposes:\n *   .listen / .use / etc.    — Express's surface (composes into larger apps)\n *   .sessions                 — the SessionManager (testing + ops insight)\n *   .shutdown()               — destroy every active session, dispose engines\n */\nexport interface CodesignHttpServer extends Express {\n  sessions: SessionManager<\n    CodesignHttpSession,\n    { sessionId: string; workspaceId: string }\n  >;\n  shutdown(): Promise<void>;\n}\n\nexport async function createCodesignHttpServer(\n  opts: CreateCodesignHttpServerOptions\n): Promise<CodesignHttpServer> {\n  const resolveWorkspaceId = opts.resolveWorkspaceId ?? (() => 'default');\n\n  const sessionMgr = new SessionManager<\n    CodesignHttpSession,\n    { sessionId: string; workspaceId: string }\n  >({\n    maxSessions: opts.maxSessions,\n    idleTimeoutMs: opts.idleTimeoutMs,\n    create: async (ctx) => {\n      if (!ctx)\n        throw new Error(\n          'createCodesignHttpServer: session context is required'\n        );\n      const id = ctx.sessionId;\n      const { engine, tools, dispose } = await opts.createSession({\n        sessionId: id,\n        workspaceId: ctx.workspaceId\n      });\n      const server = createCodesignMcpServer({\n        assets: opts.assets,\n        resourceScheme: opts.resourceScheme,\n        tools,\n        ...(opts.buildId ? { buildId: opts.buildId } : {}),\n        ...(opts.metrics ? { metrics: opts.metrics } : {})\n      });\n      const transport = new StreamableHTTPServerTransport({\n        sessionIdGenerator: () => id,\n        // A client `DELETE /mcp` (graceful termination) fires this before the\n        // transport closes itself. Bridge it to the SessionManager so the slot\n        // and its engine are reclaimed immediately instead of squatting until\n        // idle eviction. Only fires on the DELETE path — not from transport\n        // `close()` during `destroy` — so there is no re-entrancy: `delete`\n        // removes the map entry first, then runs `destroy` (a redundant,\n        // idempotent second `transport.close()`).\n        onsessionclosed: (sid) => {\n          void sessionMgr.delete(sid).catch(() => {\n            // Already gone (idle-evicted, or a duplicate close) — nothing to do.\n          });\n        }\n      });\n      await server.connect(transport);\n      return { id, engine, server, transport, dispose };\n    },\n    destroy: async (s) => {\n      try {\n        await s.transport.close();\n      } catch {\n        // ignore — best-effort\n      }\n      try {\n        await s.server.close();\n      } catch {\n        // ignore\n      }\n      // Call the session's dispose callback if provided (e.g. engine teardown).\n      try {\n        await s.dispose?.();\n      } catch {\n        // ignore\n      }\n    }\n  });\n\n  const app = express() as CodesignHttpServer;\n  app.sessions = sessionMgr;\n\n  if (opts.cors !== false) {\n    app.use(cors(opts.cors));\n  }\n  if (opts.auth) {\n    app.use(opts.auth);\n  }\n  app.use(express.json({ limit: '16mb' }));\n\n  /** Narrow `code` out of an unknown thrown value without `as any`. */\n  function errCode(e: unknown): string | undefined {\n    return typeof e === 'object' && e !== null && 'code' in e\n      ? ((e as { code?: unknown }).code as string | undefined)\n      : undefined;\n  }\n\n  const handle = async (req: Request, res: Response): Promise<void> => {\n    const sessionId = req.header('mcp-session-id');\n\n    // Initialization (POST without session id) → spawn a new session.\n    if (req.method === 'POST' && !sessionId) {\n      const injected = opts.trustedSessionIdHeader\n        ? req.header(opts.trustedSessionIdHeader)?.trim() || undefined\n        : undefined;\n      const newSessionId = injected ?? randomUUID();\n      let workspaceId: string;\n      try {\n        workspaceId = resolveWorkspaceId(req, newSessionId);\n      } catch (err) {\n        if (err instanceof WorkspaceAuthError) {\n          res.status(401).json({\n            jsonrpc: '2.0',\n            error: { code: -32002, message: err.message },\n            id: null\n          });\n          return;\n        }\n        res.status(500).json({\n          jsonrpc: '2.0',\n          error: { code: -32603, message: 'internal error' },\n          id: null\n        });\n        return;\n      }\n      let session: CodesignHttpSession;\n      try {\n        session = await sessionMgr.create({\n          sessionId: newSessionId,\n          workspaceId\n        });\n      } catch (err) {\n        if (err instanceof SessionCapExceededError) {\n          res\n            .status(503)\n            .set('Retry-After', '30')\n            .json({\n              jsonrpc: '2.0',\n              error: { code: -32000, message: err.message },\n              id: null\n            });\n          return;\n        }\n        if (errCode(err) === 'EINVAL') {\n          res.status(400).json({\n            jsonrpc: '2.0',\n            error: {\n              code: -32602,\n              message:\n                err instanceof Error ? err.message : 'invalid workspaceId'\n            },\n            id: null\n          });\n          return;\n        }\n        res.status(500).json({\n          jsonrpc: '2.0',\n          error: { code: -32603, message: 'internal error' },\n          id: null\n        });\n        return;\n      }\n      await session.transport.handleRequest(req, res, req.body);\n      return;\n    }\n\n    // Subsequent requests must carry a known session id.\n    if (!sessionId) {\n      res.status(400).json({\n        jsonrpc: '2.0',\n        error: { code: -32600, message: 'Mcp-Session-Id header required' },\n        id: null\n      });\n      return;\n    }\n    const session = sessionMgr.get(sessionId);\n    if (!session) {\n      res.status(404).json({\n        jsonrpc: '2.0',\n        error: { code: -32001, message: `unknown session: ${sessionId}` },\n        id: null\n      });\n      return;\n    }\n    sessionMgr.touch(sessionId);\n    await session.transport.handleRequest(req, res, req.body);\n  };\n\n  if (opts.mountExtras) opts.mountExtras(app);\n\n  app.post('/mcp', handle);\n  app.get('/mcp', handle);\n  app.delete('/mcp', handle);\n\n  app.shutdown = async () => {\n    await sessionMgr.destroyAll();\n  };\n\n  return app;\n}\n"]}

package/dist/server.d.ts

@@ -24,8 +24,6 @@ export interface CodesignMcpToolRegistration {
     }>;
 }
 export interface CodesignMcpServerOptions {
-    /** CreativeEngine instance, DI'd by caller. Pass-through to design tools. */
-    engine: unknown;
     /**
      * Asset bundle. Keys are forward-slash paths under one of:
      *   "docs/<doc>/SKILL.md"          — entry point for handbook / api / guide

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAenE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;QAC/B,OAAO,EAAE,KAAK,CACV;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAC9B;YAAE,IAAI,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CACpD,CAAC;QACF,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,KAAK,CAAC,EAAE,2BAA2B,EAAE,CAAC;IACtC,wEAAwE;IACxE,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,MAAM,CA2LR"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAenE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;QAC/B,OAAO,EAAE,KAAK,CACV;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAC9B;YAAE,IAAI,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CACpD,CAAC;QACF,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,KAAK,CAAC,EAAE,2BAA2B,EAAE,CAAC;IACtC,wEAAwE;IACxE,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,MAAM,CA2LR"}