@imgly/codesign-mcp 0.1.0

package/dist/cli.js

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+// codesign-mcp — single bin, two transports.
+//
+//   codesign-mcp stdio      MCP server over stdin/stdout. Spawned by hosts
+//                           like Claude Desktop / Claude Code via their
+//                           `command` config.
+//
+//   codesign-mcp http       MCP server over Streamable HTTP. Long-running
+//                           listener; hosts connect via their `url` config.
+//
+// Lazy imports per subcommand: stdio mode never loads express; http mode
+// never loads StdioServerTransport. Smaller crash surface, faster start.
+const USAGE = `Usage: codesign-mcp <stdio|http> [flags]
+
+Subcommands:
+  stdio                       MCP server over stdin/stdout. Spawned by hosts
+                              like Claude Desktop / Claude Code via their
+                              \`command\` config.
+
+  http [--port <n>]           MCP server over Streamable HTTP. Long-running
+       [--host <ip>]          listener; hosts connect via their \`url\` config.
+       [--max-sessions <n>]   Defaults: --port 3030 --host 127.0.0.1
+       [--idle-timeout-ms <n>]          --max-sessions 10 --idle-timeout-ms 1800000
+
+Common env:
+  CESDK_LICENSE                  required for both modes (CE.SDK headless
+                                 engine license).
+  IMGLY_DEFAULT_ASSETS_BASE_URL  manifest root for the default asset sources
+                                 (self-hosted deployments; default: IMG.LY CDN).
+  IMGLY_DEMO_ASSETS_BASE_URL     manifest root for the demo asset sources
+                                 (default: IMG.LY CDN).
+`;
+async function main() {
+    const sub = process.argv[2];
+    switch (sub) {
+        case 'stdio': {
+            const { runStdio } = await import('./cli/stdio.js');
+            await runStdio();
+            return;
+        }
+        case 'http': {
+            const { runHttp } = await import('./cli/http.js');
+            await runHttp(process.argv.slice(3));
+            return;
+        }
+        case '-h':
+        case '--help':
+            process.stdout.write(USAGE);
+            return;
+        case undefined:
+            process.stderr.write(`codesign-mcp: missing subcommand.\n${USAGE}`);
+            process.exit(2);
+            return;
+        default:
+            process.stderr.write(`codesign-mcp: unknown subcommand "${sub}".\n${USAGE}`);
+            process.exit(2);
+    }
+}
+main().catch((err) => {
+    process.stderr.write(`codesign-mcp: fatal — ${err instanceof Error ? (err.stack ?? err.message) : String(err)}\n`);
+    process.exit(1);
+});
+export {};
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,6CAA6C;AAC7C,EAAE;AACF,2EAA2E;AAC3E,wEAAwE;AACxE,8CAA8C;AAC9C,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AAEzE,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;CAmBb,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACpD,MAAM,QAAQ,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YAClD,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,KAAK,IAAI,CAAC;QACV,KAAK,QAAQ;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO;QACT,KAAK,SAAS;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT;YACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qCAAqC,GAAG,OAAO,KAAK,EAAE,CACvD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAC7F,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\n// codesign-mcp — single bin, two transports.\n//\n//   codesign-mcp stdio      MCP server over stdin/stdout. Spawned by hosts\n//                           like Claude Desktop / Claude Code via their\n//                           `command` config.\n//\n//   codesign-mcp http       MCP server over Streamable HTTP. Long-running\n//                           listener; hosts connect via their `url` config.\n//\n// Lazy imports per subcommand: stdio mode never loads express; http mode\n// never loads StdioServerTransport. Smaller crash surface, faster start.\n\nconst USAGE = `Usage: codesign-mcp <stdio|http> [flags]\n\nSubcommands:\n  stdio                       MCP server over stdin/stdout. Spawned by hosts\n                              like Claude Desktop / Claude Code via their\n                              \\`command\\` config.\n\n  http [--port <n>]           MCP server over Streamable HTTP. Long-running\n       [--host <ip>]          listener; hosts connect via their \\`url\\` config.\n       [--max-sessions <n>]   Defaults: --port 3030 --host 127.0.0.1\n       [--idle-timeout-ms <n>]          --max-sessions 10 --idle-timeout-ms 1800000\n\nCommon env:\n  CESDK_LICENSE                  required for both modes (CE.SDK headless\n                                 engine license).\n  IMGLY_DEFAULT_ASSETS_BASE_URL  manifest root for the default asset sources\n                                 (self-hosted deployments; default: IMG.LY CDN).\n  IMGLY_DEMO_ASSETS_BASE_URL     manifest root for the demo asset sources\n                                 (default: IMG.LY CDN).\n`;\n\nasync function main(): Promise<void> {\n  const sub = process.argv[2];\n  switch (sub) {\n    case 'stdio': {\n      const { runStdio } = await import('./cli/stdio.js');\n      await runStdio();\n      return;\n    }\n    case 'http': {\n      const { runHttp } = await import('./cli/http.js');\n      await runHttp(process.argv.slice(3));\n      return;\n    }\n    case '-h':\n    case '--help':\n      process.stdout.write(USAGE);\n      return;\n    case undefined:\n      process.stderr.write(`codesign-mcp: missing subcommand.\\n${USAGE}`);\n      process.exit(2);\n      return;\n    default:\n      process.stderr.write(\n        `codesign-mcp: unknown subcommand \"${sub}\".\\n${USAGE}`\n      );\n      process.exit(2);\n  }\n}\n\nmain().catch((err) => {\n  process.stderr.write(\n    `codesign-mcp: fatal — ${err instanceof Error ? (err.stack ?? err.message) : String(err)}\\n`\n  );\n  process.exit(1);\n});\n"]}

package/dist/config.d.ts

@@ -0,0 +1,61 @@
+export type Env = Record<string, string | undefined>;
+/**
+ * Resolve a secret: prefer `<NAME>_FILE` (trimmed file contents — secret files
+ * end in a newline) and fall back to the plain `<NAME>` env var. A superset of
+ * "just env vars": production mounts a file, local dev passes the raw value.
+ */
+export declare function resolveSecret(name: string, env?: Env): string | undefined;
+export type WorkspaceMode = 'header' | 'session' | 'single';
+export type WorkspaceBackend = 'local' | 's3';
+export interface S3Config {
+    bucket: string;
+    endpoint?: string;
+    region: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+}
+export interface WorkspaceConfig {
+    backend: WorkspaceBackend;
+    /** local backend only */
+    dir?: string;
+    /** s3 backend only */
+    s3?: S3Config;
+}
+export interface ServerConfig {
+    cesdkLicense: string;
+    /**
+     * Build identity, surfaced as the MCP `serverInfo.version`. Lets a client
+     * (e.g. the deploy smoketest) detect a stale, not-yet-rolled-out container:
+     * the deploy injects the git SHA, the smoketest asserts the running server
+     * reports it. Default `'dev'` for local runs.
+     */
+    buildId: string;
+    port: number;
+    /** Max concurrent engines/sessions — the RAM cap (spec §9.2). */
+    maxEngines: number;
+    idleTimeoutMs: number;
+    logLevel: string;
+    /** Expose the perf metrics route + dashboard SPA. Default false. */
+    metricsEnabled: boolean;
+    workspace: WorkspaceConfig;
+    auth: {
+        mode: WorkspaceMode;
+        /** header carrying the trusted workspaceId (header mode). */
+        header: string;
+        /** fixed workspaceId (single mode). */
+        fixedWorkspaceId?: string;
+    };
+    gateway: {
+        apiKey?: string;
+        baseUrl?: string;
+    };
+    viewerCorsOrigins?: string[];
+    /**
+     * Public origin of this deployment (e.g. the Cloudflare Worker URL),
+     * no trailing slash. Used to build viewer URLs the MCP client's human can
+     * actually open. Absent → loopback URLs (local dev).
+     */
+    publicBaseUrl?: string;
+}
+export declare function loadConfig(env?: Env): ServerConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,GAAiB,GACrB,MAAM,GAAG,SAAS,CAIpB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,IAAI,CAAC;AAE9C,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,yBAAyB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,EAAE,CAAC,EAAE,QAAQ,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,eAAe,CAAC;IAC3B,IAAI,EAAE;QACJ,IAAI,EAAE,aAAa,CAAC;QACpB,6DAA6D;QAC7D,MAAM,EAAE,MAAM,CAAC;QACf,uCAAuC;QACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAsBD,wBAAgB,UAAU,CAAC,GAAG,GAAE,GAAiB,GAAG,YAAY,CAqE/D"}

package/dist/config.js

@@ -0,0 +1,102 @@
+// packages/codesign-mcp/src/config.ts
+//
+// The IMGLY_* configuration contract (spec §9.2). One image, switched purely
+// by runtime env. Non-secret knobs are plain env vars; the four secrets
+// (license, gateway key, two S3 keys) also accept the `*_FILE` convention via
+// resolveSecret — the de-facto Docker/K8s secret standard. No secret is ever
+// logged or written; loadConfig only reads.
+import { readFileSync } from 'node:fs';
+/**
+ * Resolve a secret: prefer `<NAME>_FILE` (trimmed file contents — secret files
+ * end in a newline) and fall back to the plain `<NAME>` env var. A superset of
+ * "just env vars": production mounts a file, local dev passes the raw value.
+ */
+export function resolveSecret(name, env = process.env) {
+    const filePath = env[`${name}_FILE`];
+    if (filePath)
+        return readFileSync(filePath, 'utf8').trim();
+    return env[name];
+}
+function requireEnv(env, name) {
+    const v = env[name];
+    if (!v)
+        throw new Error(`config: ${name} is required`);
+    return v;
+}
+function intEnv(env, name, fallback) {
+    const raw = env[name];
+    if (raw === undefined)
+        return fallback;
+    const n = Number(raw);
+    if (!Number.isFinite(n))
+        throw new Error(`config: ${name} must be a number`);
+    return n;
+}
+function boolEnv(env, name, fallback) {
+    const raw = env[name];
+    if (raw === undefined)
+        return fallback;
+    return raw === 'true' || raw === '1';
+}
+export function loadConfig(env = process.env) {
+    const cesdkLicense = resolveSecret('IMGLY_CESDK_LICENSE', env);
+    if (!cesdkLicense)
+        throw new Error('config: IMGLY_CESDK_LICENSE is required');
+    const mode = (env.IMGLY_WORKSPACE_MODE ?? 'header');
+    if (mode !== 'header' && mode !== 'session' && mode !== 'single')
+        throw new Error(`config: IMGLY_WORKSPACE_MODE must be header|session|single (got "${mode}")`);
+    const auth = {
+        mode,
+        header: env.IMGLY_AUTH_WORKSPACE_HEADER ?? 'X-Workspace-Id'
+    };
+    if (mode === 'single') {
+        auth.fixedWorkspaceId = requireEnv(env, 'IMGLY_WORKSPACE_ID');
+    }
+    const backend = (env.IMGLY_WORKSPACE_BACKEND ?? 'local');
+    if (backend !== 'local' && backend !== 's3')
+        throw new Error(`config: IMGLY_WORKSPACE_BACKEND must be local|s3 (got "${backend}")`);
+    let workspace;
+    if (backend === 's3') {
+        const s3 = {
+            bucket: requireEnv(env, 'IMGLY_WORKSPACE_S3_BUCKET'),
+            region: env.IMGLY_WORKSPACE_S3_REGION ?? 'auto'
+        };
+        if (env.IMGLY_WORKSPACE_S3_ENDPOINT)
+            s3.endpoint = env.IMGLY_WORKSPACE_S3_ENDPOINT;
+        // Keys are optional: absent -> AWS default credential chain (IAM role).
+        const accessKeyId = resolveSecret('IMGLY_WORKSPACE_S3_ACCESS_KEY_ID', env);
+        const secretAccessKey = resolveSecret('IMGLY_WORKSPACE_S3_SECRET_ACCESS_KEY', env);
+        if (accessKeyId)
+            s3.accessKeyId = accessKeyId;
+        if (secretAccessKey)
+            s3.secretAccessKey = secretAccessKey;
+        workspace = { backend, s3 };
+    }
+    else {
+        workspace = { backend, dir: env.IMGLY_WORKSPACE_DIR ?? '/data' };
+    }
+    const gateway = {};
+    const gatewayKey = resolveSecret('IMGLY_GATEWAY_API_KEY', env);
+    if (gatewayKey)
+        gateway.apiKey = gatewayKey;
+    if (env.IMGLY_GATEWAY_BASE_URL)
+        gateway.baseUrl = env.IMGLY_GATEWAY_BASE_URL;
+    const cfg = {
+        cesdkLicense,
+        buildId: env.IMGLY_BUILD_ID ?? 'dev',
+        port: intEnv(env, 'PORT', 8080),
+        maxEngines: intEnv(env, 'IMGLY_MAX_ENGINES', 8),
+        idleTimeoutMs: intEnv(env, 'IMGLY_SESSION_IDLE_TIMEOUT', 900) * 1000,
+        logLevel: env.IMGLY_LOG_LEVEL ?? 'info',
+        metricsEnabled: boolEnv(env, 'IMGLY_METRICS_ENABLED', false),
+        workspace,
+        auth,
+        gateway
+    };
+    if (env.IMGLY_VIEWER_CORS_ORIGINS)
+        cfg.viewerCorsOrigins = env.IMGLY_VIEWER_CORS_ORIGINS.split(',').map((s) => s.trim());
+    if (env.IMGLY_PUBLIC_BASE_URL)
+        cfg.publicBaseUrl = env.IMGLY_PUBLIC_BASE_URL.replace(/\/+$/, '');
+    return cfg;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,8EAA8E;AAC9E,6EAA6E;AAC7E,4CAA4C;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAIvC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,MAAW,OAAO,CAAC,GAAG;IAEtB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IACrC,IAAI,QAAQ;QAAE,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAuDD,SAAS,UAAU,CAAC,GAAQ,EAAE,IAAY;IACxC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;IACvD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM,CAAC,GAAQ,EAAE,IAAY,EAAE,QAAgB;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,mBAAmB,CAAC,CAAC;IAC7E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CAAC,GAAQ,EAAE,IAAY,EAAE,QAAiB;IACxD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAW,OAAO,CAAC,GAAG;IAC/C,MAAM,YAAY,GAAG,aAAa,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAE9E,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,oBAAoB,IAAI,QAAQ,CAAkB,CAAC;IACrE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ;QAC9D,MAAM,IAAI,KAAK,CACb,oEAAoE,IAAI,IAAI,CAC7E,CAAC;IAEJ,MAAM,IAAI,GAAyB;QACjC,IAAI;QACJ,MAAM,EAAE,GAAG,CAAC,2BAA2B,IAAI,gBAAgB;KAC5D,CAAC;IACF,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,uBAAuB,IAAI,OAAO,CAAqB,CAAC;IAC7E,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,IAAI;QACzC,MAAM,IAAI,KAAK,CACb,0DAA0D,OAAO,IAAI,CACtE,CAAC;IAEJ,IAAI,SAA0B,CAAC;IAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,EAAE,GAAa;YACnB,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,2BAA2B,CAAC;YACpD,MAAM,EAAE,GAAG,CAAC,yBAAyB,IAAI,MAAM;SAChD,CAAC;QACF,IAAI,GAAG,CAAC,2BAA2B;YACjC,EAAE,CAAC,QAAQ,GAAG,GAAG,CAAC,2BAA2B,CAAC;QAChD,wEAAwE;QACxE,MAAM,WAAW,GAAG,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,eAAe,GAAG,aAAa,CACnC,sCAAsC,EACtC,GAAG,CACJ,CAAC;QACF,IAAI,WAAW;YAAE,EAAE,CAAC,WAAW,GAAG,WAAW,CAAC;QAC9C,IAAI,eAAe;YAAE,EAAE,CAAC,eAAe,GAAG,eAAe,CAAC;QAC1D,SAAS,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,UAAU;QAAE,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC;IAC5C,IAAI,GAAG,CAAC,sBAAsB;QAAE,OAAO,CAAC,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAE7E,MAAM,GAAG,GAAiB;QACxB,YAAY;QACZ,OAAO,EAAE,GAAG,CAAC,cAAc,IAAI,KAAK;QACpC,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/C,aAAa,EAAE,MAAM,CAAC,GAAG,EAAE,4BAA4B,EAAE,GAAG,CAAC,GAAG,IAAI;QACpE,QAAQ,EAAE,GAAG,CAAC,eAAe,IAAI,MAAM;QACvC,cAAc,EAAE,OAAO,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,CAAC;QAC5D,SAAS;QACT,IAAI;QACJ,OAAO;KACR,CAAC;IACF,IAAI,GAAG,CAAC,yBAAyB;QAC/B,GAAG,CAAC,iBAAiB,GAAG,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzE,CAAC,CAAC,IAAI,EAAE,CACT,CAAC;IACJ,IAAI,GAAG,CAAC,qBAAqB;QAC3B,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["// packages/codesign-mcp/src/config.ts\n//\n// The IMGLY_* configuration contract (spec §9.2). One image, switched purely\n// by runtime env. Non-secret knobs are plain env vars; the four secrets\n// (license, gateway key, two S3 keys) also accept the `*_FILE` convention via\n// resolveSecret — the de-facto Docker/K8s secret standard. No secret is ever\n// logged or written; loadConfig only reads.\nimport { readFileSync } from 'node:fs';\n\nexport type Env = Record<string, string | undefined>;\n\n/**\n * Resolve a secret: prefer `<NAME>_FILE` (trimmed file contents — secret files\n * end in a newline) and fall back to the plain `<NAME>` env var. A superset of\n * \"just env vars\": production mounts a file, local dev passes the raw value.\n */\nexport function resolveSecret(\n  name: string,\n  env: Env = process.env\n): string | undefined {\n  const filePath = env[`${name}_FILE`];\n  if (filePath) return readFileSync(filePath, 'utf8').trim();\n  return env[name];\n}\n\nexport type WorkspaceMode = 'header' | 'session' | 'single';\nexport type WorkspaceBackend = 'local' | 's3';\n\nexport interface S3Config {\n  bucket: string;\n  endpoint?: string;\n  region: string;\n  accessKeyId?: string;\n  secretAccessKey?: string;\n}\n\nexport interface WorkspaceConfig {\n  backend: WorkspaceBackend;\n  /** local backend only */\n  dir?: string;\n  /** s3 backend only */\n  s3?: S3Config;\n}\n\nexport interface ServerConfig {\n  cesdkLicense: string;\n  /**\n   * Build identity, surfaced as the MCP `serverInfo.version`. Lets a client\n   * (e.g. the deploy smoketest) detect a stale, not-yet-rolled-out container:\n   * the deploy injects the git SHA, the smoketest asserts the running server\n   * reports it. Default `'dev'` for local runs.\n   */\n  buildId: string;\n  port: number;\n  /** Max concurrent engines/sessions — the RAM cap (spec §9.2). */\n  maxEngines: number;\n  idleTimeoutMs: number;\n  logLevel: string;\n  /** Expose the perf metrics route + dashboard SPA. Default false. */\n  metricsEnabled: boolean;\n  workspace: WorkspaceConfig;\n  auth: {\n    mode: WorkspaceMode;\n    /** header carrying the trusted workspaceId (header mode). */\n    header: string;\n    /** fixed workspaceId (single mode). */\n    fixedWorkspaceId?: string;\n  };\n  gateway: { apiKey?: string; baseUrl?: string };\n  viewerCorsOrigins?: string[];\n  /**\n   * Public origin of this deployment (e.g. the Cloudflare Worker URL),\n   * no trailing slash. Used to build viewer URLs the MCP client's human can\n   * actually open. Absent → loopback URLs (local dev).\n   */\n  publicBaseUrl?: string;\n}\n\nfunction requireEnv(env: Env, name: string): string {\n  const v = env[name];\n  if (!v) throw new Error(`config: ${name} is required`);\n  return v;\n}\n\nfunction intEnv(env: Env, name: string, fallback: number): number {\n  const raw = env[name];\n  if (raw === undefined) return fallback;\n  const n = Number(raw);\n  if (!Number.isFinite(n)) throw new Error(`config: ${name} must be a number`);\n  return n;\n}\n\nfunction boolEnv(env: Env, name: string, fallback: boolean): boolean {\n  const raw = env[name];\n  if (raw === undefined) return fallback;\n  return raw === 'true' || raw === '1';\n}\n\nexport function loadConfig(env: Env = process.env): ServerConfig {\n  const cesdkLicense = resolveSecret('IMGLY_CESDK_LICENSE', env);\n  if (!cesdkLicense) throw new Error('config: IMGLY_CESDK_LICENSE is required');\n\n  const mode = (env.IMGLY_WORKSPACE_MODE ?? 'header') as WorkspaceMode;\n  if (mode !== 'header' && mode !== 'session' && mode !== 'single')\n    throw new Error(\n      `config: IMGLY_WORKSPACE_MODE must be header|session|single (got \"${mode}\")`\n    );\n\n  const auth: ServerConfig['auth'] = {\n    mode,\n    header: env.IMGLY_AUTH_WORKSPACE_HEADER ?? 'X-Workspace-Id'\n  };\n  if (mode === 'single') {\n    auth.fixedWorkspaceId = requireEnv(env, 'IMGLY_WORKSPACE_ID');\n  }\n\n  const backend = (env.IMGLY_WORKSPACE_BACKEND ?? 'local') as WorkspaceBackend;\n  if (backend !== 'local' && backend !== 's3')\n    throw new Error(\n      `config: IMGLY_WORKSPACE_BACKEND must be local|s3 (got \"${backend}\")`\n    );\n\n  let workspace: WorkspaceConfig;\n  if (backend === 's3') {\n    const s3: S3Config = {\n      bucket: requireEnv(env, 'IMGLY_WORKSPACE_S3_BUCKET'),\n      region: env.IMGLY_WORKSPACE_S3_REGION ?? 'auto'\n    };\n    if (env.IMGLY_WORKSPACE_S3_ENDPOINT)\n      s3.endpoint = env.IMGLY_WORKSPACE_S3_ENDPOINT;\n    // Keys are optional: absent -> AWS default credential chain (IAM role).\n    const accessKeyId = resolveSecret('IMGLY_WORKSPACE_S3_ACCESS_KEY_ID', env);\n    const secretAccessKey = resolveSecret(\n      'IMGLY_WORKSPACE_S3_SECRET_ACCESS_KEY',\n      env\n    );\n    if (accessKeyId) s3.accessKeyId = accessKeyId;\n    if (secretAccessKey) s3.secretAccessKey = secretAccessKey;\n    workspace = { backend, s3 };\n  } else {\n    workspace = { backend, dir: env.IMGLY_WORKSPACE_DIR ?? '/data' };\n  }\n\n  const gateway: ServerConfig['gateway'] = {};\n  const gatewayKey = resolveSecret('IMGLY_GATEWAY_API_KEY', env);\n  if (gatewayKey) gateway.apiKey = gatewayKey;\n  if (env.IMGLY_GATEWAY_BASE_URL) gateway.baseUrl = env.IMGLY_GATEWAY_BASE_URL;\n\n  const cfg: ServerConfig = {\n    cesdkLicense,\n    buildId: env.IMGLY_BUILD_ID ?? 'dev',\n    port: intEnv(env, 'PORT', 8080),\n    maxEngines: intEnv(env, 'IMGLY_MAX_ENGINES', 8),\n    idleTimeoutMs: intEnv(env, 'IMGLY_SESSION_IDLE_TIMEOUT', 900) * 1000,\n    logLevel: env.IMGLY_LOG_LEVEL ?? 'info',\n    metricsEnabled: boolEnv(env, 'IMGLY_METRICS_ENABLED', false),\n    workspace,\n    auth,\n    gateway\n  };\n  if (env.IMGLY_VIEWER_CORS_ORIGINS)\n    cfg.viewerCorsOrigins = env.IMGLY_VIEWER_CORS_ORIGINS.split(',').map((s) =>\n      s.trim()\n    );\n  if (env.IMGLY_PUBLIC_BASE_URL)\n    cfg.publicBaseUrl = env.IMGLY_PUBLIC_BASE_URL.replace(/\\/+$/, '');\n  return cfg;\n}\n"]}

package/dist/cross-ref.d.ts

@@ -0,0 +1,2 @@
+export declare function rewriteSkillLinks(input: string, doc: string, scheme: string): string;
+//# sourceMappingURL=cross-ref.d.ts.map

package/dist/cross-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-ref.d.ts","sourceRoot":"","sources":["../src/cross-ref.ts"],"names":[],"mappings":"AAiBA,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,MAAM,CASR"}

package/dist/cross-ref.js

@@ -0,0 +1,31 @@
+/**
+ * Rewrite relative-path markdown links inside a doc's content so every link
+ * the model sees is a fully-qualified MCP resource URI.
+ *
+ * Patterns rewritten:
+ *   [text](file.md)            → [text](<scheme>://docs/<doc>/file.md)
+ *   [text](./file.md)          → [text](<scheme>://docs/<doc>/file.md)
+ *   [text](subdir/file.md)     → [text](<scheme>://docs/<doc>/subdir/file.md)
+ *
+ * Patterns left untouched:
+ *   - Absolute URLs (https://, mailto:, etc.)
+ *   - Anchors (#section)
+ *   - Paths starting with .. (escape the doc dir)
+ *   - Absolute filesystem paths (/abs/...)
+ */
+const LINK = /\[([^\]]*)\]\(([^)\s]+)\)/g;
+export function rewriteSkillLinks(input, doc, scheme) {
+    return input.replace(LINK, (full, text, target) => {
+        if (/^[a-z][a-z0-9+\-.]*:/i.test(target))
+            return full; // absolute URL
+        if (target.startsWith('#'))
+            return full; // anchor
+        if (target.startsWith('..'))
+            return full; // escape
+        if (target.startsWith('/'))
+            return full; // absolute fs path
+        const cleaned = target.startsWith('./') ? target.slice(2) : target;
+        return `[${text}](${scheme}://docs/${doc}/${cleaned})`;
+    });
+}
+//# sourceMappingURL=cross-ref.js.map

package/dist/cross-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-ref.js","sourceRoot":"","sources":["../src/cross-ref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,IAAI,GAAG,4BAA4B,CAAC;AAE1C,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,GAAW,EACX,MAAc;IAEd,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;QAChD,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,eAAe;QACtE,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,SAAS;QAClD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,SAAS;QACnD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,mBAAmB;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACnE,OAAO,IAAI,IAAI,KAAK,MAAM,WAAW,GAAG,IAAI,OAAO,GAAG,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Rewrite relative-path markdown links inside a doc's content so every link\n * the model sees is a fully-qualified MCP resource URI.\n *\n * Patterns rewritten:\n *   [text](file.md)            → [text](<scheme>://docs/<doc>/file.md)\n *   [text](./file.md)          → [text](<scheme>://docs/<doc>/file.md)\n *   [text](subdir/file.md)     → [text](<scheme>://docs/<doc>/subdir/file.md)\n *\n * Patterns left untouched:\n *   - Absolute URLs (https://, mailto:, etc.)\n *   - Anchors (#section)\n *   - Paths starting with .. (escape the doc dir)\n *   - Absolute filesystem paths (/abs/...)\n */\nconst LINK = /\\[([^\\]]*)\\]\\(([^)\\s]+)\\)/g;\n\nexport function rewriteSkillLinks(\n  input: string,\n  doc: string,\n  scheme: string\n): string {\n  return input.replace(LINK, (full, text, target) => {\n    if (/^[a-z][a-z0-9+\\-.]*:/i.test(target)) return full; // absolute URL\n    if (target.startsWith('#')) return full; // anchor\n    if (target.startsWith('..')) return full; // escape\n    if (target.startsWith('/')) return full; // absolute fs path\n    const cleaned = target.startsWith('./') ? target.slice(2) : target;\n    return `[${text}](${scheme}://docs/${doc}/${cleaned})`;\n  });\n}\n"]}

package/dist/dashboard/router.d.ts

@@ -0,0 +1,3 @@
+import { Router } from 'express';
+export declare function createDashboardRouter(): Router;
+//# sourceMappingURL=router.d.ts.map

package/dist/dashboard/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/dashboard/router.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC,wBAAgB,qBAAqB,IAAI,MAAM,CAQ9C"}

package/dist/dashboard/router.js

@@ -0,0 +1,19 @@
+// packages/codesign-mcp/src/dashboard/router.ts
+//
+// Standalone performance-dashboard SPA — deliberately SEPARATE from the viewer
+// SPA (src/viewer) and sharing no assets with it. Serves one self-contained
+// HTML page that polls the /metrics JSON route and renders sessions, process
+// memory, per-tool latency, and a recent-calls list. Mounted only when
+// IMGLY_METRICS_ENABLED is on (see src/metrics/mount.ts).
+import { Router } from 'express';
+import { SPA_ASSETS } from './spa-assets.generated.js';
+export function createDashboardRouter() {
+    const router = Router();
+    router.get('/', (_req, res) => {
+        res
+            .type('html')
+            .send(SPA_ASSETS['index.html'].replaceAll('{{METRICS_URL}}', '/metrics'));
+    });
+    return router;
+}
+//# sourceMappingURL=router.js.map

package/dist/dashboard/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/dashboard/router.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,uEAAuE;AACvE,0DAA0D;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,MAAM,UAAU,qBAAqB;IACnC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC5B,GAAG;aACA,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["// packages/codesign-mcp/src/dashboard/router.ts\n//\n// Standalone performance-dashboard SPA — deliberately SEPARATE from the viewer\n// SPA (src/viewer) and sharing no assets with it. Serves one self-contained\n// HTML page that polls the /metrics JSON route and renders sessions, process\n// memory, per-tool latency, and a recent-calls list. Mounted only when\n// IMGLY_METRICS_ENABLED is on (see src/metrics/mount.ts).\nimport { Router } from 'express';\nimport { SPA_ASSETS } from './spa-assets.generated.js';\n\nexport function createDashboardRouter(): Router {\n  const router = Router();\n  router.get('/', (_req, res) => {\n    res\n      .type('html')\n      .send(SPA_ASSETS['index.html'].replaceAll('{{METRICS_URL}}', '/metrics'));\n  });\n  return router;\n}\n"]}

package/dist/dashboard/spa-assets.generated.d.ts

@@ -0,0 +1,2 @@
+export declare const SPA_ASSETS: Record<string, string>;
+//# sourceMappingURL=spa-assets.generated.d.ts.map

package/dist/dashboard/spa-assets.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spa-assets.generated.d.ts","sourceRoot":"","sources":["../../src/dashboard/spa-assets.generated.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAyN7C,CAAC"}

package/dist/dashboard/spa-assets.generated.js

@@ -0,0 +1,220 @@
+// AUTO-GENERATED by scripts/generate-spa-assets.mjs. Do not edit by hand.
+export const SPA_ASSETS = {
+    "index.html": `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>codesign-mcp — metrics</title>
+    <style>
+      :root {
+        color-scheme: light dark;
+      }
+      body {
+        font:
+          14px/1.5 system-ui,
+          sans-serif;
+        margin: 0;
+        padding: 1.5rem;
+      }
+      h1 {
+        font-size: 1.1rem;
+        margin: 0 0 1rem;
+      }
+      h2 {
+        font-size: 0.9rem;
+        margin: 0 0 0.5rem;
+      }
+      .cards {
+        display: flex;
+        flex-wrap: wrap;
+        gap: 1rem;
+        margin-bottom: 1.5rem;
+      }
+      .card {
+        border: 1px solid #8884;
+        border-radius: 8px;
+        padding: 0.75rem 1rem;
+        min-width: 9rem;
+      }
+      .card .label {
+        font-size: 0.75rem;
+        opacity: 0.7;
+        text-transform: uppercase;
+        letter-spacing: 0.04em;
+      }
+      .card .value {
+        font-size: 1.3rem;
+        font-variant-numeric: tabular-nums;
+      }
+      table {
+        border-collapse: collapse;
+        width: 100%;
+        margin-bottom: 1.5rem;
+      }
+      th,
+      td {
+        text-align: right;
+        padding: 0.3rem 0.6rem;
+        border-bottom: 1px solid #8883;
+        font-variant-numeric: tabular-nums;
+      }
+      th:first-child,
+      td:first-child {
+        text-align: left;
+      }
+      .recent {
+        list-style: none;
+        padding: 0;
+        margin: 0;
+        max-height: 16rem;
+        overflow: auto;
+        font-variant-numeric: tabular-nums;
+      }
+      .recent li {
+        display: flex;
+        gap: 0.75rem;
+        padding: 0.15rem 0;
+        border-bottom: 1px solid #8882;
+      }
+      .err {
+        color: #c0392b;
+      }
+      .muted {
+        opacity: 0.6;
+      }
+      #status {
+        font-size: 0.8rem;
+        opacity: 0.7;
+        margin-left: 0.5rem;
+      }
+    </style>
+  </head>
+  <body>
+    <h1>codesign-mcp metrics <span id="status">connecting…</span></h1>
+    <div class="cards" id="cards"></div>
+    <h2>Per-tool</h2>
+    <table>
+      <thead>
+        <tr>
+          <th>tool</th>
+          <th>calls</th>
+          <th>err%</th>
+          <th>p50 ms</th>
+          <th>p95 ms</th>
+          <th>max ms</th>
+        </tr>
+      </thead>
+      <tbody id="tools"></tbody>
+    </table>
+    <h2>Recent calls</h2>
+    <ul class="recent" id="recent"></ul>
+    <script>
+      const METRICS_URL = '{{METRICS_URL}}';
+      const fmtBytes = (n) => {
+        if (n == null) return '—';
+        const u = ['B', 'KB', 'MB', 'GB'];
+        let i = 0;
+        let v = n;
+        while (v >= 1024 && i < u.length - 1) {
+          v /= 1024;
+          i++;
+        }
+        return v.toFixed(1) + ' ' + u[i];
+      };
+      const fmtMs = (n) => (n == null ? '—' : Math.round(n).toString());
+      const esc = (s) =>
+        String(s)
+          .replace(/&/g, '&amp;')
+          .replace(/</g, '&lt;')
+          .replace(/>/g, '&gt;');
+      const card = (label, value) =>
+        '<div class="card"><div class="label">' +
+        label +
+        '</div><div class="value">' +
+        value +
+        '</div></div>';
+
+      async function tick() {
+        let data;
+        try {
+          const r = await fetch(METRICS_URL, { cache: 'no-store' });
+          if (!r.ok) throw new Error('HTTP ' + r.status);
+          data = await r.json();
+        } catch (e) {
+          document.getElementById('status').textContent =
+            'offline (' + e.message + ')';
+          return;
+        }
+        document.getElementById('status').textContent =
+          'updated ' + new Date().toLocaleTimeString();
+
+        const mem = data.memory || {};
+        document.getElementById('cards').innerHTML = [
+          card(
+            'sessions',
+            (data.activeSessions ?? 0) + ' / ' + (data.maxSessions ?? '?')
+          ),
+          card('uptime', Math.round((data.uptimeMs ?? 0) / 1000) + ' s'),
+          card('rss', fmtBytes(mem.rss)),
+          card('heap used', fmtBytes(mem.heapUsed)),
+          card('external', fmtBytes(mem.external)),
+          card('arrayBuffers', fmtBytes(mem.arrayBuffers))
+        ].join('');
+
+        const tools = (data.tools || [])
+          .slice()
+          .sort((a, b) => b.count - a.count);
+        document.getElementById('tools').innerHTML =
+          tools
+            .map((t) => {
+              const errPct = t.count
+                ? ((t.errorCount / t.count) * 100).toFixed(0)
+                : '0';
+              return (
+                '<tr><td>' +
+                esc(t.tool) +
+                '</td><td>' +
+                t.count +
+                '</td><td>' +
+                errPct +
+                '</td><td>' +
+                fmtMs(t.p50) +
+                '</td><td>' +
+                fmtMs(t.p95) +
+                '</td><td>' +
+                fmtMs(t.max) +
+                '</td></tr>'
+              );
+            })
+            .join('') ||
+          '<tr><td colspan="6" class="muted">no calls yet</td></tr>';
+
+        const recent = (data.recent || []).slice().reverse();
+        document.getElementById('recent').innerHTML =
+          recent
+            .map((r) => {
+              const t = new Date(r.ts).toLocaleTimeString();
+              const mark = r.ok ? '✓' : '<span class="err">✗</span>';
+              return (
+                '<li><span>' +
+                mark +
+                '</span><span>' +
+                esc(r.tool) +
+                '</span><span>' +
+                fmtMs(r.durationMs) +
+                ' ms</span><span class="muted">' +
+                t +
+                '</span></li>'
+              );
+            })
+            .join('') || '<li class="muted">no calls yet</li>';
+      }
+      tick();
+      setInterval(tick, 3000);
+    </script>
+  </body>
+</html>
+`,
+};
+//# sourceMappingURL=spa-assets.generated.js.map

package/dist/dashboard/spa-assets.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spa-assets.generated.js","sourceRoot":"","sources":["../../src/dashboard/spa-assets.generated.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,MAAM,CAAC,MAAM,UAAU,GAA2B;IACjD,YAAY,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuNd;CACA,CAAC","sourcesContent":["// AUTO-GENERATED by scripts/generate-spa-assets.mjs. Do not edit by hand.\nexport const SPA_ASSETS: Record<string, string> = {\n\t\"index.html\": `<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>codesign-mcp — metrics</title>\n    <style>\n      :root {\n        color-scheme: light dark;\n      }\n      body {\n        font:\n          14px/1.5 system-ui,\n          sans-serif;\n        margin: 0;\n        padding: 1.5rem;\n      }\n      h1 {\n        font-size: 1.1rem;\n        margin: 0 0 1rem;\n      }\n      h2 {\n        font-size: 0.9rem;\n        margin: 0 0 0.5rem;\n      }\n      .cards {\n        display: flex;\n        flex-wrap: wrap;\n        gap: 1rem;\n        margin-bottom: 1.5rem;\n      }\n      .card {\n        border: 1px solid #8884;\n        border-radius: 8px;\n        padding: 0.75rem 1rem;\n        min-width: 9rem;\n      }\n      .card .label {\n        font-size: 0.75rem;\n        opacity: 0.7;\n        text-transform: uppercase;\n        letter-spacing: 0.04em;\n      }\n      .card .value {\n        font-size: 1.3rem;\n        font-variant-numeric: tabular-nums;\n      }\n      table {\n        border-collapse: collapse;\n        width: 100%;\n        margin-bottom: 1.5rem;\n      }\n      th,\n      td {\n        text-align: right;\n        padding: 0.3rem 0.6rem;\n        border-bottom: 1px solid #8883;\n        font-variant-numeric: tabular-nums;\n      }\n      th:first-child,\n      td:first-child {\n        text-align: left;\n      }\n      .recent {\n        list-style: none;\n        padding: 0;\n        margin: 0;\n        max-height: 16rem;\n        overflow: auto;\n        font-variant-numeric: tabular-nums;\n      }\n      .recent li {\n        display: flex;\n        gap: 0.75rem;\n        padding: 0.15rem 0;\n        border-bottom: 1px solid #8882;\n      }\n      .err {\n        color: #c0392b;\n      }\n      .muted {\n        opacity: 0.6;\n      }\n      #status {\n        font-size: 0.8rem;\n        opacity: 0.7;\n        margin-left: 0.5rem;\n      }\n    </style>\n  </head>\n  <body>\n    <h1>codesign-mcp metrics <span id=\"status\">connecting…</span></h1>\n    <div class=\"cards\" id=\"cards\"></div>\n    <h2>Per-tool</h2>\n    <table>\n      <thead>\n        <tr>\n          <th>tool</th>\n          <th>calls</th>\n          <th>err%</th>\n          <th>p50 ms</th>\n          <th>p95 ms</th>\n          <th>max ms</th>\n        </tr>\n      </thead>\n      <tbody id=\"tools\"></tbody>\n    </table>\n    <h2>Recent calls</h2>\n    <ul class=\"recent\" id=\"recent\"></ul>\n    <script>\n      const METRICS_URL = '{{METRICS_URL}}';\n      const fmtBytes = (n) => {\n        if (n == null) return '—';\n        const u = ['B', 'KB', 'MB', 'GB'];\n        let i = 0;\n        let v = n;\n        while (v >= 1024 && i < u.length - 1) {\n          v /= 1024;\n          i++;\n        }\n        return v.toFixed(1) + ' ' + u[i];\n      };\n      const fmtMs = (n) => (n == null ? '—' : Math.round(n).toString());\n      const esc = (s) =>\n        String(s)\n          .replace(/&/g, '&amp;')\n          .replace(/</g, '&lt;')\n          .replace(/>/g, '&gt;');\n      const card = (label, value) =>\n        '<div class=\"card\"><div class=\"label\">' +\n        label +\n        '</div><div class=\"value\">' +\n        value +\n        '</div></div>';\n\n      async function tick() {\n        let data;\n        try {\n          const r = await fetch(METRICS_URL, { cache: 'no-store' });\n          if (!r.ok) throw new Error('HTTP ' + r.status);\n          data = await r.json();\n        } catch (e) {\n          document.getElementById('status').textContent =\n            'offline (' + e.message + ')';\n          return;\n        }\n        document.getElementById('status').textContent =\n          'updated ' + new Date().toLocaleTimeString();\n\n        const mem = data.memory || {};\n        document.getElementById('cards').innerHTML = [\n          card(\n            'sessions',\n            (data.activeSessions ?? 0) + ' / ' + (data.maxSessions ?? '?')\n          ),\n          card('uptime', Math.round((data.uptimeMs ?? 0) / 1000) + ' s'),\n          card('rss', fmtBytes(mem.rss)),\n          card('heap used', fmtBytes(mem.heapUsed)),\n          card('external', fmtBytes(mem.external)),\n          card('arrayBuffers', fmtBytes(mem.arrayBuffers))\n        ].join('');\n\n        const tools = (data.tools || [])\n          .slice()\n          .sort((a, b) => b.count - a.count);\n        document.getElementById('tools').innerHTML =\n          tools\n            .map((t) => {\n              const errPct = t.count\n                ? ((t.errorCount / t.count) * 100).toFixed(0)\n                : '0';\n              return (\n                '<tr><td>' +\n                esc(t.tool) +\n                '</td><td>' +\n                t.count +\n                '</td><td>' +\n                errPct +\n                '</td><td>' +\n                fmtMs(t.p50) +\n                '</td><td>' +\n                fmtMs(t.p95) +\n                '</td><td>' +\n                fmtMs(t.max) +\n                '</td></tr>'\n              );\n            })\n            .join('') ||\n          '<tr><td colspan=\"6\" class=\"muted\">no calls yet</td></tr>';\n\n        const recent = (data.recent || []).slice().reverse();\n        document.getElementById('recent').innerHTML =\n          recent\n            .map((r) => {\n              const t = new Date(r.ts).toLocaleTimeString();\n              const mark = r.ok ? '✓' : '<span class=\"err\">✗</span>';\n              return (\n                '<li><span>' +\n                mark +\n                '</span><span>' +\n                esc(r.tool) +\n                '</span><span>' +\n                fmtMs(r.durationMs) +\n                ' ms</span><span class=\"muted\">' +\n                t +\n                '</span></li>'\n              );\n            })\n            .join('') || '<li class=\"muted\">no calls yet</li>';\n      }\n      tick();\n      setInterval(tick, 3000);\n    </script>\n  </body>\n</html>\n`,\n};\n"]}

package/dist/engine/asset-sources.d.ts

@@ -0,0 +1,17 @@
+/** The slice of CreativeEngine this module needs — keeps it testable. */
+export interface AssetSourceEngine {
+    asset: {
+        findAllSources(): string[];
+    };
+    addDefaultAssetSources(opts?: {
+        baseURL?: string;
+        excludeAssetSourceIds?: string[];
+    }): Promise<void>;
+    addDemoAssetSources(opts?: {
+        baseURL?: string;
+    }): Promise<void>;
+}
+export declare function ensureEngineAssetSources(engine: AssetSourceEngine): Promise<void>;
+/** @internal test-only — resets the module-level in-flight guard. */
+export declare function resetEngineAssetSourcesForTest(): void;
+//# sourceMappingURL=asset-sources.d.ts.map

package/dist/engine/asset-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-sources.d.ts","sourceRoot":"","sources":["../../src/engine/asset-sources.ts"],"names":[],"mappings":"AAaA,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE;QAAE,cAAc,IAAI,MAAM,EAAE,CAAA;KAAE,CAAC;IACtC,sBAAsB,CAAC,IAAI,CAAC,EAAE;QAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;KAClC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,mBAAmB,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAeD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,IAAI,CAAC,CAGf;AAwDD,qEAAqE;AACrE,wBAAgB,8BAA8B,IAAI,IAAI,CAErD"}