@imgly/codesign-mcp 0.1.5 → 0.1.6

package/dist/diagnostics/redact.js

@@ -0,0 +1,43 @@
+// packages/codesign-mcp/src/diagnostics/redact.ts
+//
+// Executable form of .claude/rules/no-secrets.md. Two entry points: redactText
+// for raw log lines (pattern scrub + home-path), redactValue for structured
+// events (drop secret-named keys + recurse + pattern scrub every string).
+// Both are pure and total; callers that persist/externalise apply them.
+import { homedir } from 'node:os';
+const REDACTED = '[REDACTED]';
+/** Key names whose VALUE is always dropped, matched case-insensitively. */
+export const SECRET_KEY_RE = /(license|api[-_]?key|secret|token|password|authorization)/i;
+/** Substrings shaped like a credential; scrubbed out of any string. */
+export const SECRET_PATTERNS = [
+    /sk-(?:or|ant|proj|cl)-[A-Za-z0-9_-]{20,}/g,
+    /sk-[A-Za-z0-9_-]{20,}/g,
+    /xai-[A-Za-z0-9]{20,}/g,
+    /AKIA[0-9A-Z]{16}/g,
+    /gh[posur]_[A-Za-z0-9]{20,}/g,
+    /AIza[0-9A-Za-z_-]{35}/g
+];
+export function redactText(text) {
+    let out = text;
+    for (const re of SECRET_PATTERNS)
+        out = out.replace(re, REDACTED);
+    const home = homedir();
+    if (home && home !== '/')
+        out = out.split(home).join('~');
+    return out;
+}
+export function redactValue(value) {
+    if (typeof value === 'string')
+        return redactText(value);
+    if (Array.isArray(value))
+        return value.map(redactValue);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = SECRET_KEY_RE.test(k) ? REDACTED : redactValue(v);
+        }
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=redact.js.map

package/dist/diagnostics/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/diagnostics/redact.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,0EAA0E;AAC1E,wEAAwE;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GACxB,4DAA4D,CAAC;AAE/D,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,2CAA2C;IAC3C,wBAAwB;IACxB,uBAAuB;IACvB,mBAAmB;IACnB,6BAA6B;IAC7B,wBAAwB;CACzB,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,EAAE,IAAI,eAAe;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["// packages/codesign-mcp/src/diagnostics/redact.ts\n//\n// Executable form of .claude/rules/no-secrets.md. Two entry points: redactText\n// for raw log lines (pattern scrub + home-path), redactValue for structured\n// events (drop secret-named keys + recurse + pattern scrub every string).\n// Both are pure and total; callers that persist/externalise apply them.\nimport { homedir } from 'node:os';\n\nconst REDACTED = '[REDACTED]';\n\n/** Key names whose VALUE is always dropped, matched case-insensitively. */\nexport const SECRET_KEY_RE =\n  /(license|api[-_]?key|secret|token|password|authorization)/i;\n\n/** Substrings shaped like a credential; scrubbed out of any string. */\nexport const SECRET_PATTERNS: RegExp[] = [\n  /sk-(?:or|ant|proj|cl)-[A-Za-z0-9_-]{20,}/g,\n  /sk-[A-Za-z0-9_-]{20,}/g,\n  /xai-[A-Za-z0-9]{20,}/g,\n  /AKIA[0-9A-Z]{16}/g,\n  /gh[posur]_[A-Za-z0-9]{20,}/g,\n  /AIza[0-9A-Za-z_-]{35}/g\n];\n\nexport function redactText(text: string): string {\n  let out = text;\n  for (const re of SECRET_PATTERNS) out = out.replace(re, REDACTED);\n  const home = homedir();\n  if (home && home !== '/') out = out.split(home).join('~');\n  return out;\n}\n\nexport function redactValue(value: unknown): unknown {\n  if (typeof value === 'string') return redactText(value);\n  if (Array.isArray(value)) return value.map(redactValue);\n  if (value && typeof value === 'object') {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {\n      out[k] = SECRET_KEY_RE.test(k) ? REDACTED : redactValue(v);\n    }\n    return out;\n  }\n  return value;\n}\n"]}

package/dist/diagnostics/tool-call-adapter.d.ts

@@ -0,0 +1,4 @@
+import type { DiagnosticsSink } from './events.js';
+import type { TelemetrySink } from '../tools/spans.js';
+export declare function toolCallSink(diag: DiagnosticsSink, now?: () => number): TelemetrySink;
+//# sourceMappingURL=tool-call-adapter.d.ts.map

package/dist/diagnostics/tool-call-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-call-adapter.d.ts","sourceRoot":"","sources":["../../src/diagnostics/tool-call-adapter.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAmB,eAAe,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,mBAAmB,CAAC;AAEvE,wBAAgB,YAAY,CAC1B,IAAI,EAAE,eAAe,EACrB,GAAG,GAAE,MAAM,MAAyB,GACnC,aAAa,CAmBf"}

package/dist/diagnostics/tool-call-adapter.js

@@ -0,0 +1,21 @@
+export function toolCallSink(diag, now = () => Date.now()) {
+    return {
+        record(report) {
+            const event = {
+                kind: 'tool_call',
+                timestamp: now(),
+                tool: report.tool,
+                succeeded: report.succeeded,
+                totalMs: report.totalMs,
+                spans: report.spans,
+                ...(report.error ? { error: report.error } : {}),
+                ...(report.args !== undefined ? { args: report.args } : {}),
+                ...(report.result !== undefined ? { result: report.result } : {}),
+                ...(report.revision ? { revision: report.revision } : {}),
+                ...(report.session ? { session: report.session } : {})
+            };
+            diag.emit(event);
+        }
+    };
+}
+//# sourceMappingURL=tool-call-adapter.js.map

package/dist/diagnostics/tool-call-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-call-adapter.js","sourceRoot":"","sources":["../../src/diagnostics/tool-call-adapter.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,YAAY,CAC1B,IAAqB,EACrB,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IAEpC,OAAO;QACL,MAAM,CAAC,MAAsB;YAC3B,MAAM,KAAK,GAAoB;gBAC7B,IAAI,EAAE,WAAW;gBACjB,SAAS,EAAE,GAAG,EAAE;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["// packages/codesign-mcp/src/diagnostics/tool-call-adapter.ts\n//\n// The one bridge between the tool-owned TelemetrySink port and the unified\n// diagnostics stream: a ToolCallReport becomes a { kind: 'tool_call' } event,\n// timestamped and emitted. Redaction of args happens downstream in the sink.\nimport type { DiagnosticEvent, DiagnosticsSink } from './events.js';\nimport type { TelemetrySink, ToolCallReport } from '../tools/spans.js';\n\nexport function toolCallSink(\n  diag: DiagnosticsSink,\n  now: () => number = () => Date.now()\n): TelemetrySink {\n  return {\n    record(report: ToolCallReport): void {\n      const event: DiagnosticEvent = {\n        kind: 'tool_call',\n        timestamp: now(),\n        tool: report.tool,\n        succeeded: report.succeeded,\n        totalMs: report.totalMs,\n        spans: report.spans,\n        ...(report.error ? { error: report.error } : {}),\n        ...(report.args !== undefined ? { args: report.args } : {}),\n        ...(report.result !== undefined ? { result: report.result } : {}),\n        ...(report.revision ? { revision: report.revision } : {}),\n        ...(report.session ? { session: report.session } : {})\n      };\n      diag.emit(event);\n    }\n  };\n}\n"]}

package/dist/engine/cesdk-adapter.d.ts

@@ -2,9 +2,13 @@ import type CreativeEngine from '@cesdk/engine';
 import type { EngineAdapter } from './session.js';
 /**
  * Adapts a `@cesdk/engine` CreativeEngine instance to the EngineSession's
- * generic EngineAdapter shape. One-to-one mapping; the only quirk is `reset`
+ * generic EngineAdapter shape. One-to-one mapping; two quirks. First, `reset`
  * (CE.SDK has no `reset()` — we wipe by creating a new scene via the same
  * patched create path `ensureHeadlessEngine` installed for the design-unit fix).
+ * Second, `saveToString` passes an explicit `allowedResourceSchemes`: the
+ * engine default rejects our durable `workspace://` scheme, so an edit commit
+ * of a scene referencing workspace assets would fail without it (see
+ * scene-resource-schemes.ts, CODE-3).
  *
  * `engine` may be a Promise: the stdio transport defers engine init off the
  * MCP-handshake path and hands the in-flight promise here. EngineSession only

package/dist/engine/cesdk-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cesdk-adapter.d.ts","sourceRoot":"","sources":["../../src/engine/cesdk-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,cAAc,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,GAC/C,aAAa,CAAC,cAAc,CAAC,CAW/B"}
+{"version":3,"file":"cesdk-adapter.d.ts","sourceRoot":"","sources":["../../src/engine/cesdk-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,cAAc,MAAM,eAAe,CAAC;AAEhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,GAC/C,aAAa,CAAC,cAAc,CAAC,CAc/B"}

package/dist/engine/cesdk-adapter.js

@@ -1,8 +1,13 @@
+import { SCENE_ALLOWED_RESOURCE_SCHEMES } from './scene-resource-schemes.js';
 /**
  * Adapts a `@cesdk/engine` CreativeEngine instance to the EngineSession's
- * generic EngineAdapter shape. One-to-one mapping; the only quirk is `reset`
+ * generic EngineAdapter shape. One-to-one mapping; two quirks. First, `reset`
  * (CE.SDK has no `reset()` — we wipe by creating a new scene via the same
  * patched create path `ensureHeadlessEngine` installed for the design-unit fix).
+ * Second, `saveToString` passes an explicit `allowedResourceSchemes`: the
+ * engine default rejects our durable `workspace://` scheme, so an edit commit
+ * of a scene referencing workspace assets would fail without it (see
+ * scene-resource-schemes.ts, CODE-3).
  *
  * `engine` may be a Promise: the stdio transport defers engine init off the
  * MCP-handshake path and hands the in-flight promise here. EngineSession only
@@ -19,7 +24,9 @@ export function cesdkAdapter(engine) {
         loadFromString: async (eng, scene) => {
             await eng.scene.loadFromString(scene);
         },
-        saveToString: async (eng) => eng.scene.saveToString()
+        saveToString: async (eng) => eng.scene.saveToString({
+            allowedResourceSchemes: SCENE_ALLOWED_RESOURCE_SCHEMES
+        })
     };
 }
 //# sourceMappingURL=cesdk-adapter.js.map

package/dist/engine/cesdk-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"cesdk-adapter.js","sourceRoot":"","sources":["../../src/engine/cesdk-adapter.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAgD;IAEhD,OAAO;QACL,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,gFAAgF;QACtG,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,4EAA4E;QAClG,CAAC;QACD,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnC,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE;KACtD,CAAC;AACJ,CAAC","sourcesContent":["import type CreativeEngine from '@cesdk/engine';\nimport type { EngineAdapter } from './session.js';\n\n/**\n * Adapts a `@cesdk/engine` CreativeEngine instance to the EngineSession's\n * generic EngineAdapter shape. One-to-one mapping; the only quirk is `reset`\n * (CE.SDK has no `reset()` — we wipe by creating a new scene via the same\n * patched create path `ensureHeadlessEngine` installed for the design-unit fix).\n *\n * `engine` may be a Promise: the stdio transport defers engine init off the\n * MCP-handshake path and hands the in-flight promise here. EngineSession only\n * calls `create()` on the first slot (first edit), awaiting it then — by which\n * point init is usually already settled. The other methods receive the resolved\n * engine from EngineSession, so they never touch the promise.\n */\nexport function cesdkAdapter(\n  engine: CreativeEngine | Promise<CreativeEngine>\n): EngineAdapter<CreativeEngine> {\n  return {\n    create: () => engine, // single-engine adapter: always the same instance (awaited lazily if a promise)\n    reset: async (eng) => {\n      eng.scene.create(); // wipes the active scene; design-unit patch from tools/engine.ts re-applies\n    },\n    loadFromString: async (eng, scene) => {\n      await eng.scene.loadFromString(scene);\n    },\n    saveToString: async (eng) => eng.scene.saveToString()\n  };\n}\n"]}
+{"version":3,"file":"cesdk-adapter.js","sourceRoot":"","sources":["../../src/engine/cesdk-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAG7E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAgD;IAEhD,OAAO;QACL,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,gFAAgF;QACtG,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACnB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,4EAA4E;QAClG,CAAC;QACD,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnC,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAC1B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;YACrB,sBAAsB,EAAE,8BAA8B;SACvD,CAAC;KACL,CAAC;AACJ,CAAC","sourcesContent":["import type CreativeEngine from '@cesdk/engine';\nimport { SCENE_ALLOWED_RESOURCE_SCHEMES } from './scene-resource-schemes.js';\nimport type { EngineAdapter } from './session.js';\n\n/**\n * Adapts a `@cesdk/engine` CreativeEngine instance to the EngineSession's\n * generic EngineAdapter shape. One-to-one mapping; two quirks. First, `reset`\n * (CE.SDK has no `reset()` — we wipe by creating a new scene via the same\n * patched create path `ensureHeadlessEngine` installed for the design-unit fix).\n * Second, `saveToString` passes an explicit `allowedResourceSchemes`: the\n * engine default rejects our durable `workspace://` scheme, so an edit commit\n * of a scene referencing workspace assets would fail without it (see\n * scene-resource-schemes.ts, CODE-3).\n *\n * `engine` may be a Promise: the stdio transport defers engine init off the\n * MCP-handshake path and hands the in-flight promise here. EngineSession only\n * calls `create()` on the first slot (first edit), awaiting it then — by which\n * point init is usually already settled. The other methods receive the resolved\n * engine from EngineSession, so they never touch the promise.\n */\nexport function cesdkAdapter(\n  engine: CreativeEngine | Promise<CreativeEngine>\n): EngineAdapter<CreativeEngine> {\n  return {\n    create: () => engine, // single-engine adapter: always the same instance (awaited lazily if a promise)\n    reset: async (eng) => {\n      eng.scene.create(); // wipes the active scene; design-unit patch from tools/engine.ts re-applies\n    },\n    loadFromString: async (eng, scene) => {\n      await eng.scene.loadFromString(scene);\n    },\n    saveToString: async (eng) =>\n      eng.scene.saveToString({\n        allowedResourceSchemes: SCENE_ALLOWED_RESOURCE_SCHEMES\n      })\n  };\n}\n"]}

package/dist/engine/index.d.ts

@@ -1,3 +1,4 @@
 export { cesdkAdapter } from './cesdk-adapter.js';
 export { type EngineAdapter, EngineSession, type EngineSessionOptions, type EngineSlot } from './session.js';
+export { ensureHeadlessEngine } from '../tools/engine.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/engine/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/engine/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,KAAK,aAAa,EAClB,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/engine/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,KAAK,aAAa,EAClB,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAItB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/engine/index.js

@@ -1,3 +1,7 @@
 export { cesdkAdapter } from './cesdk-adapter.js';
 export { EngineSession } from './session.js';
+// A headless CE.SDK engine (design-unit-patched). Exposed so consumers outside
+// the MCP server — e.g. eval harnesses re-opening a produced artifact — can
+// spin one up without reimplementing the @cesdk/node WASM/worker require dance.
+export { ensureHeadlessEngine } from '../tools/engine.js';
 //# sourceMappingURL=index.js.map

package/dist/engine/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/engine/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAEL,aAAa,EAGd,MAAM,cAAc,CAAC","sourcesContent":["export { cesdkAdapter } from './cesdk-adapter.js';\nexport {\n  type EngineAdapter,\n  EngineSession,\n  type EngineSessionOptions,\n  type EngineSlot\n} from './session.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/engine/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAEL,aAAa,EAGd,MAAM,cAAc,CAAC;AACtB,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC","sourcesContent":["export { cesdkAdapter } from './cesdk-adapter.js';\nexport {\n  type EngineAdapter,\n  EngineSession,\n  type EngineSessionOptions,\n  type EngineSlot\n} from './session.js';\n// A headless CE.SDK engine (design-unit-patched). Exposed so consumers outside\n// the MCP server — e.g. eval harnesses re-opening a produced artifact — can\n// spin one up without reimplementing the @cesdk/node WASM/worker require dance.\nexport { ensureHeadlessEngine } from '../tools/engine.js';\n"]}

package/dist/engine/scene-resource-schemes.d.ts

@@ -0,0 +1,2 @@
+export declare const SCENE_ALLOWED_RESOURCE_SCHEMES: string[];
+//# sourceMappingURL=scene-resource-schemes.d.ts.map

package/dist/engine/scene-resource-schemes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scene-resource-schemes.d.ts","sourceRoot":"","sources":["../../src/engine/scene-resource-schemes.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,8BAA8B,UAQ1C,CAAC"}

package/dist/engine/scene-resource-schemes.js

@@ -0,0 +1,20 @@
+// packages/codesign-mcp/src/engine/scene-resource-schemes.ts
+//
+// The resource-URL schemes allowed to appear in a PERSISTED scene string.
+// CE.SDK's scene.saveToString default omits `workspace` — our durable scheme
+// for content-addressed assets (see uri-resolver.ts) — and the engine checks
+// the RAW stored URL, not the resolved one (verified empirically, CODE-3).
+// Every scene-serialization path (edit commits via cesdk-adapter, load's
+// archive explode) must use this list, or a scene referencing workspace://
+// assets fails to save. `buffer` stays excluded deliberately: a transient
+// resource in a persisted scene is silent data loss — fail loudly instead.
+export const SCENE_ALLOWED_RESOURCE_SCHEMES = [
+    'blob',
+    'bundle',
+    'file',
+    'http',
+    'https',
+    'opfs',
+    'workspace'
+];
+//# sourceMappingURL=scene-resource-schemes.js.map

package/dist/engine/scene-resource-schemes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scene-resource-schemes.js","sourceRoot":"","sources":["../../src/engine/scene-resource-schemes.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,WAAW;CACZ,CAAC","sourcesContent":["// packages/codesign-mcp/src/engine/scene-resource-schemes.ts\n//\n// The resource-URL schemes allowed to appear in a PERSISTED scene string.\n// CE.SDK's scene.saveToString default omits `workspace` — our durable scheme\n// for content-addressed assets (see uri-resolver.ts) — and the engine checks\n// the RAW stored URL, not the resolved one (verified empirically, CODE-3).\n// Every scene-serialization path (edit commits via cesdk-adapter, load's\n// archive explode) must use this list, or a scene referencing workspace://\n// assets fails to save. `buffer` stays excluded deliberately: a transient\n// resource in a persisted scene is silent data loss — fail loudly instead.\nexport const SCENE_ALLOWED_RESOURCE_SCHEMES = [\n  'blob',\n  'bundle',\n  'file',\n  'http',\n  'https',\n  'opfs',\n  'workspace'\n];\n"]}

package/dist/http/server.d.ts

@@ -3,7 +3,6 @@ import { type CorsOptions } from 'cors';
 import { type Express, type Request, type RequestHandler } from 'express';
 import { type CodesignMcpToolRegistration, createCodesignMcpServer } from '../server.js';
 import { SessionManager } from './session-manager.js';
-import type { MetricsRecorder } from '../metrics/recorder.js';
 /**
  * Per-session state held by the SessionManager: the engine, the MCP server,
  * and the per-session HTTP transport. Every incoming request with this
@@ -46,11 +45,6 @@ export interface CreateCodesignHttpServerOptions {
     }>;
     /** Optional: mount additional routes (viewer router, dashboards) before MCP. */
     mountExtras?: (app: Express) => void;
-    /**
-     * Optional metrics recorder, DI'd into every session's MCP server so tool
-     * calls are timed at the single dispatch chokepoint. Absent → no timing.
-     */
-    metrics?: MetricsRecorder;
     /** Build identity reported as `serverInfo.version`. Default `'dev'`. */
     buildId?: string;
     /** Optional auth middleware — runs before MCP routing. Default: no-op. */

package/dist/http/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAa,EAAE,KAAK,WAAW,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAgB,EACd,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,cAAc,EAEpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,2BAA2B,EAChC,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA2B,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACnD,SAAS,EAAE,6BAA6B,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACjE;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,aAAa,EAAE,CAAC,GAAG,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QAC1E,MAAM,EAAE,OAAO,CAAC;QAChB,KAAK,EAAE,2BAA2B,EAAE,CAAC;QACrC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;KAC/B,CAAC,CAAC;IACH,gFAAgF;IAChF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;IACrC;;;OAGG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,gDAAgD;IAChD,IAAI,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAmB,SAAQ,OAAO;IACjD,QAAQ,EAAE,cAAc,CACtB,mBAAmB,EACnB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAC3C,CAAC;IACF,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,kBAAkB,CAAC,CAwL7B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAa,EAAE,KAAK,WAAW,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAgB,EACd,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,cAAc,EAEpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,2BAA2B,EAChC,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAA2B,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG/E;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACnD,SAAS,EAAE,6BAA6B,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACjE;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,aAAa,EAAE,CAAC,GAAG,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QAC1E,MAAM,EAAE,OAAO,CAAC;QAChB,KAAK,EAAE,2BAA2B,EAAE,CAAC;QACrC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;KAC/B,CAAC,CAAC;IACH,gFAAgF;IAChF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;IACrC,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,gDAAgD;IAChD,IAAI,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAmB,SAAQ,OAAO;IACjD,QAAQ,EAAE,cAAc,CACtB,mBAAmB,EACnB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAC3C,CAAC;IACF,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,kBAAkB,CAAC,CAuL7B"}

package/dist/http/server.js

@@ -22,8 +22,7 @@ export async function createCodesignHttpServer(opts) {
                 assets: opts.assets,
                 resourceScheme: opts.resourceScheme,
                 tools,
-                ...(opts.buildId ? { buildId: opts.buildId } : {}),
-                ...(opts.metrics ? { metrics: opts.metrics } : {})
+                ...(opts.buildId ? { buildId: opts.buildId } : {})
             });
             const transport = new StreamableHTTPServerTransport({
                 sessionIdGenerator: () => id,

package/dist/http/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,IAA0B,MAAM,MAAM,CAAC;AAC9C,OAAO,OAKN,MAAM,SAAS,CAAC;AACjB,OAAO,EAEL,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AA2EzD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAqC;IAErC,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAExE,MAAM,UAAU,GAAG,IAAI,cAAc,CAGnC;QACA,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,KAAK,CACb,uDAAuD,CACxD,CAAC;YACJ,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;YACzB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;gBAC1D,SAAS,EAAE,EAAE;gBACb,WAAW,EAAE,GAAG,CAAC,WAAW;aAC7B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,KAAK;gBACL,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE;gBAC5B,sEAAsE;gBACtE,uEAAuE;gBACvE,sEAAsE;gBACtE,oEAAoE;gBACpE,oEAAoE;gBACpE,iEAAiE;gBACjE,0CAA0C;gBAC1C,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE;oBACvB,KAAK,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;wBACrC,qEAAqE;oBACvE,CAAC,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACnB,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,0EAA0E;YAC1E,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,OAAO,EAAwB,CAAC;IAC5C,GAAG,CAAC,QAAQ,GAAG,UAAU,CAAC;IAE1B,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,qEAAqE;IACrE,SAAS,OAAO,CAAC,CAAU;QACzB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC;YACvD,CAAC,CAAG,CAAwB,CAAC,IAA2B;YACxD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QAClE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAE/C,kEAAkE;QAClE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB;gBAC1C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;gBAC9D,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,YAAY,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;YAC9C,IAAI,WAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,WAAW,GAAG,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;oBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;wBAC7C,EAAE,EAAE,IAAI;qBACT,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE;oBAClD,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,OAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;oBAChC,SAAS,EAAE,YAAY;oBACvB,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;oBAC3C,GAAG;yBACA,MAAM,CAAC,GAAG,CAAC;yBACX,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC;yBACxB,IAAI,CAAC;wBACJ,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;wBAC7C,EAAE,EAAE,IAAI;qBACT,CAAC,CAAC;oBACL,OAAO;gBACT,CAAC;gBACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC,KAAK;4BACZ,OAAO,EACL,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;yBAC7D;wBACD,EAAE,EAAE,IAAI;qBACT,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE;oBAClD,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,qDAAqD;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE;gBAClE,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,SAAS,EAAE,EAAE;gBACjE,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,WAAW;QAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAE5C,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3B,GAAG,CAAC,QAAQ,GAAG,KAAK,IAAI,EAAE;QACxB,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;IAChC,CAAC,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport cors, { type CorsOptions } from 'cors';\nimport express, {\n  type Express,\n  type Request,\n  type RequestHandler,\n  type Response\n} from 'express';\nimport {\n  type CodesignMcpToolRegistration,\n  createCodesignMcpServer\n} from '../server.js';\nimport { SessionCapExceededError, SessionManager } from './session-manager.js';\nimport { WorkspaceAuthError } from './workspace-auth.js';\nimport type { MetricsRecorder } from '../metrics/recorder.js';\n\n/**\n * Per-session state held by the SessionManager: the engine, the MCP server,\n * and the per-session HTTP transport. Every incoming request with this\n * session's id is routed to `transport.handleRequest`.\n */\nexport interface CodesignHttpSession {\n  id: string;\n  engine: unknown;\n  server: ReturnType<typeof createCodesignMcpServer>;\n  transport: StreamableHTTPServerTransport;\n  dispose?: () => Promise<void>;\n}\n\nexport interface CreateCodesignHttpServerOptions {\n  assets: Record<string, string>;\n  resourceScheme?: string;\n  maxSessions: number;\n  idleTimeoutMs: number;\n  /**\n   * Resolve the front-asserted workspaceId for a new MCP session. Receives the\n   * freshly-minted session id (so `session` mode can derive `s/<id>`). May throw\n   * WorkspaceAuthError → 401. Default: a fixed \"default\" workspace.\n   */\n  resolveWorkspaceId?: (req: Request, sessionId: string) => string;\n  /**\n   * When set, an `initialize` request carrying this (case-insensitive) header uses\n   * its value as the MCP session id instead of minting one. The Worker/front\n   * mints the id so it can route follow-ups to the same warm instance (spec §3).\n   * The front MUST strip any client-supplied value of this header — same trust\n   * posture as the workspace header. Absent header → mint as normal.\n   */\n  trustedSessionIdHeader?: string;\n  /** Build everything needed for one session in one go. */\n  createSession: (ctx: { sessionId: string; workspaceId: string }) => Promise<{\n    engine: unknown;\n    tools: CodesignMcpToolRegistration[];\n    dispose?: () => Promise<void>;\n  }>;\n  /** Optional: mount additional routes (viewer router, dashboards) before MCP. */\n  mountExtras?: (app: Express) => void;\n  /**\n   * Optional metrics recorder, DI'd into every session's MCP server so tool\n   * calls are timed at the single dispatch chokepoint. Absent → no timing.\n   */\n  metrics?: MetricsRecorder;\n  /** Build identity reported as `serverInfo.version`. Default `'dev'`. */\n  buildId?: string;\n  /** Optional auth middleware — runs before MCP routing. Default: no-op. */\n  auth?: RequestHandler;\n  /** Optional CORS options. Default: disabled. */\n  cors?: CorsOptions | false;\n}\n\n/**\n * Express app exposing MCP over Streamable HTTP at /mcp. Stateful sessions:\n * each MCP `initialize` call spawns a fresh session (engine + server +\n * transport); follow-up requests carry `Mcp-Session-Id` to route back. The\n * underlying SessionManager enforces idle eviction and a session cap.\n *\n * The returned object exposes:\n *   .listen / .use / etc.    — Express's surface (composes into larger apps)\n *   .sessions                 — the SessionManager (testing + ops insight)\n *   .shutdown()               — destroy every active session, dispose engines\n */\nexport interface CodesignHttpServer extends Express {\n  sessions: SessionManager<\n    CodesignHttpSession,\n    { sessionId: string; workspaceId: string }\n  >;\n  shutdown(): Promise<void>;\n}\n\nexport async function createCodesignHttpServer(\n  opts: CreateCodesignHttpServerOptions\n): Promise<CodesignHttpServer> {\n  const resolveWorkspaceId = opts.resolveWorkspaceId ?? (() => 'default');\n\n  const sessionMgr = new SessionManager<\n    CodesignHttpSession,\n    { sessionId: string; workspaceId: string }\n  >({\n    maxSessions: opts.maxSessions,\n    idleTimeoutMs: opts.idleTimeoutMs,\n    create: async (ctx) => {\n      if (!ctx)\n        throw new Error(\n          'createCodesignHttpServer: session context is required'\n        );\n      const id = ctx.sessionId;\n      const { engine, tools, dispose } = await opts.createSession({\n        sessionId: id,\n        workspaceId: ctx.workspaceId\n      });\n      const server = createCodesignMcpServer({\n        assets: opts.assets,\n        resourceScheme: opts.resourceScheme,\n        tools,\n        ...(opts.buildId ? { buildId: opts.buildId } : {}),\n        ...(opts.metrics ? { metrics: opts.metrics } : {})\n      });\n      const transport = new StreamableHTTPServerTransport({\n        sessionIdGenerator: () => id,\n        // A client `DELETE /mcp` (graceful termination) fires this before the\n        // transport closes itself. Bridge it to the SessionManager so the slot\n        // and its engine are reclaimed immediately instead of squatting until\n        // idle eviction. Only fires on the DELETE path — not from transport\n        // `close()` during `destroy` — so there is no re-entrancy: `delete`\n        // removes the map entry first, then runs `destroy` (a redundant,\n        // idempotent second `transport.close()`).\n        onsessionclosed: (sid) => {\n          void sessionMgr.delete(sid).catch(() => {\n            // Already gone (idle-evicted, or a duplicate close) — nothing to do.\n          });\n        }\n      });\n      await server.connect(transport);\n      return { id, engine, server, transport, dispose };\n    },\n    destroy: async (s) => {\n      try {\n        await s.transport.close();\n      } catch {\n        // ignore — best-effort\n      }\n      try {\n        await s.server.close();\n      } catch {\n        // ignore\n      }\n      // Call the session's dispose callback if provided (e.g. engine teardown).\n      try {\n        await s.dispose?.();\n      } catch {\n        // ignore\n      }\n    }\n  });\n\n  const app = express() as CodesignHttpServer;\n  app.sessions = sessionMgr;\n\n  if (opts.cors !== false) {\n    app.use(cors(opts.cors));\n  }\n  if (opts.auth) {\n    app.use(opts.auth);\n  }\n  app.use(express.json({ limit: '16mb' }));\n\n  /** Narrow `code` out of an unknown thrown value without `as any`. */\n  function errCode(e: unknown): string | undefined {\n    return typeof e === 'object' && e !== null && 'code' in e\n      ? ((e as { code?: unknown }).code as string | undefined)\n      : undefined;\n  }\n\n  const handle = async (req: Request, res: Response): Promise<void> => {\n    const sessionId = req.header('mcp-session-id');\n\n    // Initialization (POST without session id) → spawn a new session.\n    if (req.method === 'POST' && !sessionId) {\n      const injected = opts.trustedSessionIdHeader\n        ? req.header(opts.trustedSessionIdHeader)?.trim() || undefined\n        : undefined;\n      const newSessionId = injected ?? randomUUID();\n      let workspaceId: string;\n      try {\n        workspaceId = resolveWorkspaceId(req, newSessionId);\n      } catch (err) {\n        if (err instanceof WorkspaceAuthError) {\n          res.status(401).json({\n            jsonrpc: '2.0',\n            error: { code: -32002, message: err.message },\n            id: null\n          });\n          return;\n        }\n        res.status(500).json({\n          jsonrpc: '2.0',\n          error: { code: -32603, message: 'internal error' },\n          id: null\n        });\n        return;\n      }\n      let session: CodesignHttpSession;\n      try {\n        session = await sessionMgr.create({\n          sessionId: newSessionId,\n          workspaceId\n        });\n      } catch (err) {\n        if (err instanceof SessionCapExceededError) {\n          res\n            .status(503)\n            .set('Retry-After', '30')\n            .json({\n              jsonrpc: '2.0',\n              error: { code: -32000, message: err.message },\n              id: null\n            });\n          return;\n        }\n        if (errCode(err) === 'EINVAL') {\n          res.status(400).json({\n            jsonrpc: '2.0',\n            error: {\n              code: -32602,\n              message:\n                err instanceof Error ? err.message : 'invalid workspaceId'\n            },\n            id: null\n          });\n          return;\n        }\n        res.status(500).json({\n          jsonrpc: '2.0',\n          error: { code: -32603, message: 'internal error' },\n          id: null\n        });\n        return;\n      }\n      await session.transport.handleRequest(req, res, req.body);\n      return;\n    }\n\n    // Subsequent requests must carry a known session id.\n    if (!sessionId) {\n      res.status(400).json({\n        jsonrpc: '2.0',\n        error: { code: -32600, message: 'Mcp-Session-Id header required' },\n        id: null\n      });\n      return;\n    }\n    const session = sessionMgr.get(sessionId);\n    if (!session) {\n      res.status(404).json({\n        jsonrpc: '2.0',\n        error: { code: -32001, message: `unknown session: ${sessionId}` },\n        id: null\n      });\n      return;\n    }\n    sessionMgr.touch(sessionId);\n    await session.transport.handleRequest(req, res, req.body);\n  };\n\n  if (opts.mountExtras) opts.mountExtras(app);\n\n  app.post('/mcp', handle);\n  app.get('/mcp', handle);\n  app.delete('/mcp', handle);\n\n  app.shutdown = async () => {\n    await sessionMgr.destroyAll();\n  };\n\n  return app;\n}\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,IAA0B,MAAM,MAAM,CAAC;AAC9C,OAAO,OAKN,MAAM,SAAS,CAAC;AACjB,OAAO,EAEL,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAqEzD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAqC;IAErC,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAExE,MAAM,UAAU,GAAG,IAAI,cAAc,CAGnC;QACA,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,KAAK,CACb,uDAAuD,CACxD,CAAC;YACJ,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;YACzB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;gBAC1D,SAAS,EAAE,EAAE;gBACb,WAAW,EAAE,GAAG,CAAC,WAAW;aAC7B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,uBAAuB,CAAC;gBACrC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,KAAK;gBACL,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;gBAClD,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE;gBAC5B,sEAAsE;gBACtE,uEAAuE;gBACvE,sEAAsE;gBACtE,oEAAoE;gBACpE,oEAAoE;gBACpE,iEAAiE;gBACjE,0CAA0C;gBAC1C,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE;oBACvB,KAAK,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;wBACrC,qEAAqE;oBACvE,CAAC,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACnB,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,0EAA0E;YAC1E,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,OAAO,EAAwB,CAAC;IAC5C,GAAG,CAAC,QAAQ,GAAG,UAAU,CAAC;IAE1B,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEzC,qEAAqE;IACrE,SAAS,OAAO,CAAC,CAAU;QACzB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC;YACvD,CAAC,CAAG,CAAwB,CAAC,IAA2B;YACxD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QAClE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAE/C,kEAAkE;QAClE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB;gBAC1C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;gBAC9D,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,YAAY,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;YAC9C,IAAI,WAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,WAAW,GAAG,kBAAkB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;oBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;wBAC7C,EAAE,EAAE,IAAI;qBACT,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE;oBAClD,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,OAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;oBAChC,SAAS,EAAE,YAAY;oBACvB,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;oBAC3C,GAAG;yBACA,MAAM,CAAC,GAAG,CAAC;yBACX,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC;yBACxB,IAAI,CAAC;wBACJ,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;wBAC7C,EAAE,EAAE,IAAI;qBACT,CAAC,CAAC;oBACL,OAAO;gBACT,CAAC;gBACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC,KAAK;4BACZ,OAAO,EACL,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;yBAC7D;wBACD,EAAE,EAAE,IAAI;qBACT,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE;oBAClD,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,qDAAqD;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE;gBAClE,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,SAAS,EAAE,EAAE;gBACjE,EAAE,EAAE,IAAI;aACT,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,WAAW;QAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAE5C,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3B,GAAG,CAAC,QAAQ,GAAG,KAAK,IAAI,EAAE;QACxB,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;IAChC,CAAC,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';\nimport cors, { type CorsOptions } from 'cors';\nimport express, {\n  type Express,\n  type Request,\n  type RequestHandler,\n  type Response\n} from 'express';\nimport {\n  type CodesignMcpToolRegistration,\n  createCodesignMcpServer\n} from '../server.js';\nimport { SessionCapExceededError, SessionManager } from './session-manager.js';\nimport { WorkspaceAuthError } from './workspace-auth.js';\n\n/**\n * Per-session state held by the SessionManager: the engine, the MCP server,\n * and the per-session HTTP transport. Every incoming request with this\n * session's id is routed to `transport.handleRequest`.\n */\nexport interface CodesignHttpSession {\n  id: string;\n  engine: unknown;\n  server: ReturnType<typeof createCodesignMcpServer>;\n  transport: StreamableHTTPServerTransport;\n  dispose?: () => Promise<void>;\n}\n\nexport interface CreateCodesignHttpServerOptions {\n  assets: Record<string, string>;\n  resourceScheme?: string;\n  maxSessions: number;\n  idleTimeoutMs: number;\n  /**\n   * Resolve the front-asserted workspaceId for a new MCP session. Receives the\n   * freshly-minted session id (so `session` mode can derive `s/<id>`). May throw\n   * WorkspaceAuthError → 401. Default: a fixed \"default\" workspace.\n   */\n  resolveWorkspaceId?: (req: Request, sessionId: string) => string;\n  /**\n   * When set, an `initialize` request carrying this (case-insensitive) header uses\n   * its value as the MCP session id instead of minting one. The Worker/front\n   * mints the id so it can route follow-ups to the same warm instance (spec §3).\n   * The front MUST strip any client-supplied value of this header — same trust\n   * posture as the workspace header. Absent header → mint as normal.\n   */\n  trustedSessionIdHeader?: string;\n  /** Build everything needed for one session in one go. */\n  createSession: (ctx: { sessionId: string; workspaceId: string }) => Promise<{\n    engine: unknown;\n    tools: CodesignMcpToolRegistration[];\n    dispose?: () => Promise<void>;\n  }>;\n  /** Optional: mount additional routes (viewer router, dashboards) before MCP. */\n  mountExtras?: (app: Express) => void;\n  /** Build identity reported as `serverInfo.version`. Default `'dev'`. */\n  buildId?: string;\n  /** Optional auth middleware — runs before MCP routing. Default: no-op. */\n  auth?: RequestHandler;\n  /** Optional CORS options. Default: disabled. */\n  cors?: CorsOptions | false;\n}\n\n/**\n * Express app exposing MCP over Streamable HTTP at /mcp. Stateful sessions:\n * each MCP `initialize` call spawns a fresh session (engine + server +\n * transport); follow-up requests carry `Mcp-Session-Id` to route back. The\n * underlying SessionManager enforces idle eviction and a session cap.\n *\n * The returned object exposes:\n *   .listen / .use / etc.    — Express's surface (composes into larger apps)\n *   .sessions                 — the SessionManager (testing + ops insight)\n *   .shutdown()               — destroy every active session, dispose engines\n */\nexport interface CodesignHttpServer extends Express {\n  sessions: SessionManager<\n    CodesignHttpSession,\n    { sessionId: string; workspaceId: string }\n  >;\n  shutdown(): Promise<void>;\n}\n\nexport async function createCodesignHttpServer(\n  opts: CreateCodesignHttpServerOptions\n): Promise<CodesignHttpServer> {\n  const resolveWorkspaceId = opts.resolveWorkspaceId ?? (() => 'default');\n\n  const sessionMgr = new SessionManager<\n    CodesignHttpSession,\n    { sessionId: string; workspaceId: string }\n  >({\n    maxSessions: opts.maxSessions,\n    idleTimeoutMs: opts.idleTimeoutMs,\n    create: async (ctx) => {\n      if (!ctx)\n        throw new Error(\n          'createCodesignHttpServer: session context is required'\n        );\n      const id = ctx.sessionId;\n      const { engine, tools, dispose } = await opts.createSession({\n        sessionId: id,\n        workspaceId: ctx.workspaceId\n      });\n      const server = createCodesignMcpServer({\n        assets: opts.assets,\n        resourceScheme: opts.resourceScheme,\n        tools,\n        ...(opts.buildId ? { buildId: opts.buildId } : {})\n      });\n      const transport = new StreamableHTTPServerTransport({\n        sessionIdGenerator: () => id,\n        // A client `DELETE /mcp` (graceful termination) fires this before the\n        // transport closes itself. Bridge it to the SessionManager so the slot\n        // and its engine are reclaimed immediately instead of squatting until\n        // idle eviction. Only fires on the DELETE path — not from transport\n        // `close()` during `destroy` — so there is no re-entrancy: `delete`\n        // removes the map entry first, then runs `destroy` (a redundant,\n        // idempotent second `transport.close()`).\n        onsessionclosed: (sid) => {\n          void sessionMgr.delete(sid).catch(() => {\n            // Already gone (idle-evicted, or a duplicate close) — nothing to do.\n          });\n        }\n      });\n      await server.connect(transport);\n      return { id, engine, server, transport, dispose };\n    },\n    destroy: async (s) => {\n      try {\n        await s.transport.close();\n      } catch {\n        // ignore — best-effort\n      }\n      try {\n        await s.server.close();\n      } catch {\n        // ignore\n      }\n      // Call the session's dispose callback if provided (e.g. engine teardown).\n      try {\n        await s.dispose?.();\n      } catch {\n        // ignore\n      }\n    }\n  });\n\n  const app = express() as CodesignHttpServer;\n  app.sessions = sessionMgr;\n\n  if (opts.cors !== false) {\n    app.use(cors(opts.cors));\n  }\n  if (opts.auth) {\n    app.use(opts.auth);\n  }\n  app.use(express.json({ limit: '16mb' }));\n\n  /** Narrow `code` out of an unknown thrown value without `as any`. */\n  function errCode(e: unknown): string | undefined {\n    return typeof e === 'object' && e !== null && 'code' in e\n      ? ((e as { code?: unknown }).code as string | undefined)\n      : undefined;\n  }\n\n  const handle = async (req: Request, res: Response): Promise<void> => {\n    const sessionId = req.header('mcp-session-id');\n\n    // Initialization (POST without session id) → spawn a new session.\n    if (req.method === 'POST' && !sessionId) {\n      const injected = opts.trustedSessionIdHeader\n        ? req.header(opts.trustedSessionIdHeader)?.trim() || undefined\n        : undefined;\n      const newSessionId = injected ?? randomUUID();\n      let workspaceId: string;\n      try {\n        workspaceId = resolveWorkspaceId(req, newSessionId);\n      } catch (err) {\n        if (err instanceof WorkspaceAuthError) {\n          res.status(401).json({\n            jsonrpc: '2.0',\n            error: { code: -32002, message: err.message },\n            id: null\n          });\n          return;\n        }\n        res.status(500).json({\n          jsonrpc: '2.0',\n          error: { code: -32603, message: 'internal error' },\n          id: null\n        });\n        return;\n      }\n      let session: CodesignHttpSession;\n      try {\n        session = await sessionMgr.create({\n          sessionId: newSessionId,\n          workspaceId\n        });\n      } catch (err) {\n        if (err instanceof SessionCapExceededError) {\n          res\n            .status(503)\n            .set('Retry-After', '30')\n            .json({\n              jsonrpc: '2.0',\n              error: { code: -32000, message: err.message },\n              id: null\n            });\n          return;\n        }\n        if (errCode(err) === 'EINVAL') {\n          res.status(400).json({\n            jsonrpc: '2.0',\n            error: {\n              code: -32602,\n              message:\n                err instanceof Error ? err.message : 'invalid workspaceId'\n            },\n            id: null\n          });\n          return;\n        }\n        res.status(500).json({\n          jsonrpc: '2.0',\n          error: { code: -32603, message: 'internal error' },\n          id: null\n        });\n        return;\n      }\n      await session.transport.handleRequest(req, res, req.body);\n      return;\n    }\n\n    // Subsequent requests must carry a known session id.\n    if (!sessionId) {\n      res.status(400).json({\n        jsonrpc: '2.0',\n        error: { code: -32600, message: 'Mcp-Session-Id header required' },\n        id: null\n      });\n      return;\n    }\n    const session = sessionMgr.get(sessionId);\n    if (!session) {\n      res.status(404).json({\n        jsonrpc: '2.0',\n        error: { code: -32001, message: `unknown session: ${sessionId}` },\n        id: null\n      });\n      return;\n    }\n    sessionMgr.touch(sessionId);\n    await session.transport.handleRequest(req, res, req.body);\n  };\n\n  if (opts.mountExtras) opts.mountExtras(app);\n\n  app.post('/mcp', handle);\n  app.get('/mcp', handle);\n  app.delete('/mcp', handle);\n\n  app.shutdown = async () => {\n    await sessionMgr.destroyAll();\n  };\n\n  return app;\n}\n"]}

package/dist/server.d.ts

@@ -1,5 +1,4 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import type { MetricsRecorder } from './metrics/recorder.js';
 /**
  * One tool the server exposes via tools/list + tools/call. Caller-supplied so
  * the engine-bound implementations live near the surface that owns the engine
@@ -28,7 +27,6 @@ export interface CodesignMcpServerOptions {
      * Asset bundle. Keys are forward-slash paths under one of:
      *   "docs/<doc>/SKILL.md"          — entry point for handbook / api / guide
      *   "docs/<doc>/<file>"            — sub-files reachable via the doc tools
-     *   "prompts/<name>.md"            — slash-command prompts
      * Values are file contents.
      */
     assets: Record<string, string>;
@@ -36,8 +34,6 @@ export interface CodesignMcpServerOptions {
     resourceScheme?: string;
     /** Tools to expose via tools/list + tools/call. */
     tools?: CodesignMcpToolRegistration[];
-    /** Optional metrics sink. Absent → tool calls are not timed (no-op). */
-    metrics?: MetricsRecorder;
     /**
      * Build identity reported as `serverInfo.version` on `initialize`. A client
      * (the deploy smoketest) can assert it to confirm it's talking to the

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAenE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;QAC/B,OAAO,EAAE,KAAK,CACV;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAC9B;YAAE,IAAI,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CACpD,CAAC;QACF,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,KAAK,CAAC,EAAE,2BAA2B,EAAE,CAAC;IACtC,wEAAwE;IACxE,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,MAAM,CA2LR"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAYnE;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;QAC/B,OAAO,EAAE,KAAK,CACV;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,GAC9B;YAAE,IAAI,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CACpD,CAAC;QACF,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,KAAK,CAAC,EAAE,2BAA2B,EAAE,CAAC;IACtC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,MAAM,CAmIR"}

package/dist/server.js

@@ -1,17 +1,14 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { CallToolRequestSchema, ErrorCode, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListToolsRequestSchema, McpError, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { CallToolRequestSchema, ErrorCode, ListResourcesRequestSchema, ListToolsRequestSchema, McpError, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { rewriteSkillLinks } from './cross-ref.js';
-import { parseFrontmatter } from './frontmatter.js';
 import { buildSkillReadTools } from './skill-tools.js';
-import { performance } from 'node:perf_hooks';
 const DOC_FILE = /^docs\/([^/]+)\/(.+)$/;
-const PROMPT_FILE = /^prompts\/([^/]+)\.md$/;
 export function createCodesignMcpServer(opts) {
     const scheme = opts.resourceScheme ?? 'codesign';
     const assets = opts.assets;
     // `instructions` is intentionally short — it tells the model what the
     // server is and STRONGLY directs it to call `codesign_read_codesign_system`
-    // before its first design_exec. Skills are now first-class tools (not MCP
+    // before its first edit. Skills are now first-class tools (not MCP
     // resources buried in an XML block), so discovery happens via tools/list
     // on every host without needing ReadMcpResourceTool support.
     //
@@ -66,21 +63,8 @@ export function createCodesignMcpServer(opts) {
         const uri = `${scheme}://docs/${doc}/${rest}`;
         rewrittenContent.set(uri, rewriteSkillLinks(content, doc, scheme));
     }
-    // Index prompts by name (frontmatter `name`, falling back to filename).
-    const prompts = new Map();
-    for (const [key, content] of Object.entries(assets)) {
-        const m = key.match(PROMPT_FILE);
-        if (!m)
-            continue;
-        const front = parseFrontmatter(content);
-        const name = front.name ?? m[1];
-        prompts.set(name, {
-            description: front.description ?? '',
-            body: front.body
-        });
-    }
     const server = new Server({ name: 'codesign', version: opts.buildId ?? 'dev' }, {
-        capabilities: { resources: {}, prompts: {}, tools: {} },
+        capabilities: { resources: {}, tools: {} },
         instructions
     });
     // `resources/list` advertises only the per-skill SKILL.md (the entry
@@ -106,26 +90,6 @@ export function createCodesignMcpServer(opts) {
             contents: [{ uri: req.params.uri, mimeType: 'text/markdown', text }]
         };
     });
-    server.setRequestHandler(ListPromptsRequestSchema, async () => ({
-        prompts: Array.from(prompts.entries()).map(([name, p]) => ({
-            name,
-            description: p.description
-        }))
-    }));
-    server.setRequestHandler(GetPromptRequestSchema, async (req) => {
-        const p = prompts.get(req.params.name);
-        if (!p) {
-            throw new McpError(ErrorCode.InvalidParams, `Unknown prompt: ${req.params.name}`);
-        }
-        return {
-            messages: [
-                {
-                    role: 'user',
-                    content: { type: 'text', text: p.body }
-                }
-            ]
-        };
-    });
     // Tools registered with the server: caller-supplied design tools + the
     // auto-generated skill-read tools (one per skill in the asset bundle).
     // The skill tools always come first so Level 1 wording in the design tool
@@ -148,27 +112,7 @@ export function createCodesignMcpServer(opts) {
         if (!t) {
             throw new McpError(ErrorCode.InvalidParams, `Unknown tool: ${req.params.name}`);
         }
-        // No recorder → byte-for-byte the original behaviour (the off-switch).
-        if (!opts.metrics)
-            return await t.call(req.params.arguments ?? {});
-        const startedAt = performance.now();
-        let ok = true;
-        try {
-            const res = await t.call(req.params.arguments ?? {});
-            ok = res.isError !== true;
-            return res;
-        }
-        catch (err) {
-            ok = false;
-            throw err;
-        }
-        finally {
-            opts.metrics.record({
-                tool: req.params.name,
-                durationMs: performance.now() - startedAt,
-                ok
-            });
-        }
+        return await t.call(req.params.arguments ?? {});
     });
     return server;
 }

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,EACtB,QAAQ,EACR,yBAAyB,EAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA8C9C,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AACzC,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,UAAU,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAE3B,sEAAsE;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,0DAA0D;IAC1D,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,gBAAgB,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CACnC,CAAC;IACF,MAAM,YAAY,GAAG;QACnB,sKAAsK;QACtK,EAAE;QACF,6SAA6S;QAC7S,EAAE;QACF,4BAA4B;QAC5B,qEAAqE;QACrE,yEAAyE;QACzE,EAAE;QACF,4CAA4C;QAC5C,8HAA8H;QAC9H,0EAA0E;QAC1E,kHAAkH;QAClH,6HAA6H;QAC7H,EAAE;QACF,6DAA6D;QAC7D,2DAA2D;QAC3D,sFAAsF;QACtF,uHAAuH;QACvH,oDAAoD;QACpD,6EAA6E;QAC7E,0FAA0F;KAC3F;SACE,MAAM,CACL,gBAAgB;QACd,CAAC,CAAC;YACE,EAAE;YACF,mBAAmB;YACnB,sHAAsH;SACvH;QACH,CAAC,CAAC,EAAE,CACP;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,6EAA6E;IAC7E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,GAAG,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9C,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,wEAAwE;IACxE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiD,CAAC;IACzE,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,KAAK,EAAE,EACpD;QACE,YAAY,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QACvD,YAAY;KACb,CACF,CAAC;IAEF,qEAAqE;IACrE,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,4BAA4B;IAC5B,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAChE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;aAC3C,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;aAC1C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,GAAG;YACH,QAAQ,EAAE,eAAe;YACzB,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,KAAK,EAAE,EAAE,CAAC;SACtC,CAAC,CAAC;KACN,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,qBAAqB,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CACtC,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;SACrE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9D,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzD,IAAI;YACJ,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7D,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,mBAAmB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CACrC,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;iBACxC;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,kDAAkD;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvD,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAoB;SACpC,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,iBAAiB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CACnC,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAEnE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,IAAI,EAAE,GAAG,IAAI,CAAC;QACd,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACrD,EAAE,GAAG,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC;YAC1B,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,GAAG,KAAK,CAAC;YACX,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAClB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI;gBACrB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;gBACzC,EAAE;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { Server } from '@modelcontextprotocol/sdk/server/index.js';\nimport {\n  CallToolRequestSchema,\n  ErrorCode,\n  GetPromptRequestSchema,\n  ListPromptsRequestSchema,\n  ListResourcesRequestSchema,\n  ListToolsRequestSchema,\n  McpError,\n  ReadResourceRequestSchema\n} from '@modelcontextprotocol/sdk/types.js';\nimport { rewriteSkillLinks } from './cross-ref.js';\nimport { parseFrontmatter } from './frontmatter.js';\nimport { buildSkillReadTools } from './skill-tools.js';\nimport { performance } from 'node:perf_hooks';\nimport type { MetricsRecorder } from './metrics/recorder.js';\n\n/**\n * One tool the server exposes via tools/list + tools/call. Caller-supplied so\n * the engine-bound implementations live near the surface that owns the engine\n * (the demo passes its existing `createDesignTools` output adapted to this\n * shape; an external bootstrap could pass server-side equivalents).\n */\nexport interface CodesignMcpToolRegistration {\n  name: string;\n  description?: string;\n  /** JSON Schema describing the tool's input arguments. */\n  inputSchema: unknown;\n  call: (args: unknown) => Promise<{\n    content: Array<\n      | { type: 'text'; text: string }\n      | { type: 'image'; data: string; mimeType: string }\n    >;\n    isError?: boolean;\n  }>;\n}\n\nexport interface CodesignMcpServerOptions {\n  /**\n   * Asset bundle. Keys are forward-slash paths under one of:\n   *   \"docs/<doc>/SKILL.md\"          — entry point for handbook / api / guide\n   *   \"docs/<doc>/<file>\"            — sub-files reachable via the doc tools\n   *   \"prompts/<name>.md\"            — slash-command prompts\n   * Values are file contents.\n   */\n  assets: Record<string, string>;\n  /** URI scheme for resources. Default: \"codesign\". */\n  resourceScheme?: string;\n  /** Tools to expose via tools/list + tools/call. */\n  tools?: CodesignMcpToolRegistration[];\n  /** Optional metrics sink. Absent → tool calls are not timed (no-op). */\n  metrics?: MetricsRecorder;\n  /**\n   * Build identity reported as `serverInfo.version` on `initialize`. A client\n   * (the deploy smoketest) can assert it to confirm it's talking to the\n   * just-deployed build, not a stale container. Default `'dev'`.\n   */\n  buildId?: string;\n}\n\nconst DOC_FILE = /^docs\\/([^/]+)\\/(.+)$/;\nconst PROMPT_FILE = /^prompts\\/([^/]+)\\.md$/;\n\nexport function createCodesignMcpServer(\n  opts: CodesignMcpServerOptions\n): Server {\n  const scheme = opts.resourceScheme ?? 'codesign';\n  const assets = opts.assets;\n\n  // `instructions` is intentionally short — it tells the model what the\n  // server is and STRONGLY directs it to call `codesign_read_codesign_system`\n  // before its first design_exec. Skills are now first-class tools (not MCP\n  // resources buried in an XML block), so discovery happens via tools/list\n  // on every host without needing ReadMcpResourceTool support.\n  //\n  // Why short: Claude Code wraps MCP `instructions` in a <system-reminder>\n  // and truncates long ones mid-stream. Keeping `instructions` under ~1.5 KB\n  // ensures the whole pointer survives any sane truncation.\n  //\n  // The asset-generation hint is included only when an `asset_generate` tool\n  // is actually registered (Local hides it without an API_KEY), so we never\n  // advertise a tool the model can't see in tools/list.\n  const hasAssetGenerate = (opts.tools ?? []).some(\n    (t) => t.name === 'asset_generate'\n  );\n  const instructions = [\n    'This is the **codesign** MCP server. It hosts a CE.SDK CreativeEngine and a persistent design workspace (revision DAG) for vector design + print-quality PDF output.',\n    '',\n    '**Required first step** — before any `edit`, call `handbook` (no args). It teaches the mandatory `parent` argument, dirty-on-throw safety, rewind recovery via `list`/`history`, the typeface schema setFont requires, and the runtime quirks that bite first attempts. Skipping it produces broken output.',\n    '',\n    'Reference docs, on demand:',\n    '- `api({ path?, offset?, limit? })` — CE.SDK TypeScript signatures.',\n    '- `guide({ path? })` — CE.SDK Vanilla JS reference docs / topic guides.',\n    '',\n    'Design tools (after reading the handbook):',\n    '- `edit({ parent, code, title?, note? })` — mutate the canvas; `parent` is REQUIRED (revision id, or null for a new design).',\n    '- `preview({ blockId, revision? })` — render a block to an inline image.',\n    '- `export({ target, format, revision, blockId })` — render a block to pdf/image and write it into the workspace.',\n    '- `save({ revision, outPath? })` — write a self-contained `.zip` archive (scene + assets) of a revision into the workspace.',\n    '',\n    'Workspace tools (for resuming + navigating across designs):',\n    '- `list()` — every design in the workspace, newest first.',\n    '- `history({ revision })` — walk back to the root; how you re-ground after a rewind.',\n    '- `inspect({ revision })` — read one revision in full, including the code that produced it (patterns, not block ids).',\n    '- `rename({ revision, title })` — rename a design.',\n    '- `open_editor({ revision? })` — URL the human can open to view the design.',\n    '- `asset_search({ sourceId?, query? })` — browse asset sources; apply results in `edit`.'\n  ]\n    .concat(\n      hasAssetGenerate\n        ? [\n            '',\n            'Asset generation:',\n            \"- `asset_generate({ kind: 'image', prompt, width?, height? })` — opt-in (Local needs API_KEY); Hosted is cost-gated.\"\n          ]\n        : []\n    )\n    .join('\\n');\n\n  // Build the resource map up-front: URI → rewritten markdown body. Cross-refs\n  // inside doc content are rewritten to absolute MCP URIs so the model never\n  // has to resolve a relative path against a doc dir.\n  const rewrittenContent = new Map<string, string>();\n  for (const [key, content] of Object.entries(assets)) {\n    const m = key.match(DOC_FILE);\n    if (!m) continue;\n    const [, doc, rest] = m;\n    const uri = `${scheme}://docs/${doc}/${rest}`;\n    rewrittenContent.set(uri, rewriteSkillLinks(content, doc, scheme));\n  }\n\n  // Index prompts by name (frontmatter `name`, falling back to filename).\n  const prompts = new Map<string, { description: string; body: string }>();\n  for (const [key, content] of Object.entries(assets)) {\n    const m = key.match(PROMPT_FILE);\n    if (!m) continue;\n    const front = parseFrontmatter(content);\n    const name = front.name ?? m[1];\n    prompts.set(name, {\n      description: front.description ?? '',\n      body: front.body\n    });\n  }\n\n  const server = new Server(\n    { name: 'codesign', version: opts.buildId ?? 'dev' },\n    {\n      capabilities: { resources: {}, prompts: {}, tools: {} },\n      instructions\n    }\n  );\n\n  // `resources/list` advertises only the per-skill SKILL.md (the entry\n  // point), not the 392 nested cesdk-guide files. Sub-files stay readable\n  // via `resources/read` against any cached URI, but skill content discovery\n  // happens through the codesign_read_* tools — those are the universal\n  // surface across MCP hosts.\n  server.setRequestHandler(ListResourcesRequestSchema, async () => ({\n    resources: Array.from(rewrittenContent.keys())\n      .filter((uri) => uri.endsWith('/SKILL.md'))\n      .map((uri) => ({\n        uri,\n        mimeType: 'text/markdown',\n        name: uri.replace(`${scheme}://`, '')\n      }))\n  }));\n\n  server.setRequestHandler(ReadResourceRequestSchema, async (req) => {\n    const text = rewrittenContent.get(req.params.uri);\n    if (text === undefined) {\n      throw new McpError(\n        ErrorCode.InvalidParams,\n        `Unknown resource: ${req.params.uri}`\n      );\n    }\n    return {\n      contents: [{ uri: req.params.uri, mimeType: 'text/markdown', text }]\n    };\n  });\n\n  server.setRequestHandler(ListPromptsRequestSchema, async () => ({\n    prompts: Array.from(prompts.entries()).map(([name, p]) => ({\n      name,\n      description: p.description\n    }))\n  }));\n\n  server.setRequestHandler(GetPromptRequestSchema, async (req) => {\n    const p = prompts.get(req.params.name);\n    if (!p) {\n      throw new McpError(\n        ErrorCode.InvalidParams,\n        `Unknown prompt: ${req.params.name}`\n      );\n    }\n    return {\n      messages: [\n        {\n          role: 'user',\n          content: { type: 'text', text: p.body }\n        }\n      ]\n    };\n  });\n\n  // Tools registered with the server: caller-supplied design tools + the\n  // auto-generated skill-read tools (one per skill in the asset bundle).\n  // The skill tools always come first so Level 1 wording in the design tool\n  // descriptions (\"call codesign_read_codesign_system first\") points at\n  // something the model already sees in tools/list.\n  const tools = new Map<string, CodesignMcpToolRegistration>();\n  for (const t of buildSkillReadTools(assets)) tools.set(t.name, t);\n  for (const t of opts.tools ?? []) tools.set(t.name, t);\n\n  server.setRequestHandler(ListToolsRequestSchema, async () => ({\n    tools: Array.from(tools.values()).map((t) => ({\n      name: t.name,\n      description: t.description,\n      inputSchema: t.inputSchema as never\n    }))\n  }));\n\n  server.setRequestHandler(CallToolRequestSchema, async (req) => {\n    const t = tools.get(req.params.name);\n    if (!t) {\n      throw new McpError(\n        ErrorCode.InvalidParams,\n        `Unknown tool: ${req.params.name}`\n      );\n    }\n    // No recorder → byte-for-byte the original behaviour (the off-switch).\n    if (!opts.metrics) return await t.call(req.params.arguments ?? {});\n\n    const startedAt = performance.now();\n    let ok = true;\n    try {\n      const res = await t.call(req.params.arguments ?? {});\n      ok = res.isError !== true;\n      return res;\n    } catch (err) {\n      ok = false;\n      throw err;\n    } finally {\n      opts.metrics.record({\n        tool: req.params.name,\n        durationMs: performance.now() - startedAt,\n        ok\n      });\n    }\n  });\n\n  return server;\n}\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,SAAS,EACT,0BAA0B,EAC1B,sBAAsB,EACtB,QAAQ,EACR,yBAAyB,EAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AA0CvD,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AAEzC,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,UAAU,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAE3B,sEAAsE;IACtE,4EAA4E;IAC5E,mEAAmE;IACnE,yEAAyE;IACzE,6DAA6D;IAC7D,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,0DAA0D;IAC1D,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,gBAAgB,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CACnC,CAAC;IACF,MAAM,YAAY,GAAG;QACnB,sKAAsK;QACtK,EAAE;QACF,6SAA6S;QAC7S,EAAE;QACF,4BAA4B;QAC5B,qEAAqE;QACrE,yEAAyE;QACzE,EAAE;QACF,4CAA4C;QAC5C,8HAA8H;QAC9H,0EAA0E;QAC1E,kHAAkH;QAClH,6HAA6H;QAC7H,EAAE;QACF,6DAA6D;QAC7D,2DAA2D;QAC3D,sFAAsF;QACtF,uHAAuH;QACvH,oDAAoD;QACpD,6EAA6E;QAC7E,0FAA0F;KAC3F;SACE,MAAM,CACL,gBAAgB;QACd,CAAC,CAAC;YACE,EAAE;YACF,mBAAmB;YACnB,sHAAsH;SACvH;QACH,CAAC,CAAC,EAAE,CACP;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,6EAA6E;IAC7E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,GAAG,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9C,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,KAAK,EAAE,EACpD;QACE,YAAY,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC1C,YAAY;KACb,CACF,CAAC;IAEF,qEAAqE;IACrE,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,4BAA4B;IAC5B,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAChE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;aAC3C,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;aAC1C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,GAAG;YACH,QAAQ,EAAE,eAAe;YACzB,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,KAAK,EAAE,EAAE,CAAC;SACtC,CAAC,CAAC;KACN,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,qBAAqB,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CACtC,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;SACrE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,kDAAkD;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvD,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAoB;SACpC,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,iBAAiB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CACnC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { Server } from '@modelcontextprotocol/sdk/server/index.js';\nimport {\n  CallToolRequestSchema,\n  ErrorCode,\n  ListResourcesRequestSchema,\n  ListToolsRequestSchema,\n  McpError,\n  ReadResourceRequestSchema\n} from '@modelcontextprotocol/sdk/types.js';\nimport { rewriteSkillLinks } from './cross-ref.js';\nimport { buildSkillReadTools } from './skill-tools.js';\n\n/**\n * One tool the server exposes via tools/list + tools/call. Caller-supplied so\n * the engine-bound implementations live near the surface that owns the engine\n * (the demo passes its existing `createDesignTools` output adapted to this\n * shape; an external bootstrap could pass server-side equivalents).\n */\nexport interface CodesignMcpToolRegistration {\n  name: string;\n  description?: string;\n  /** JSON Schema describing the tool's input arguments. */\n  inputSchema: unknown;\n  call: (args: unknown) => Promise<{\n    content: Array<\n      | { type: 'text'; text: string }\n      | { type: 'image'; data: string; mimeType: string }\n    >;\n    isError?: boolean;\n  }>;\n}\n\nexport interface CodesignMcpServerOptions {\n  /**\n   * Asset bundle. Keys are forward-slash paths under one of:\n   *   \"docs/<doc>/SKILL.md\"          — entry point for handbook / api / guide\n   *   \"docs/<doc>/<file>\"            — sub-files reachable via the doc tools\n   * Values are file contents.\n   */\n  assets: Record<string, string>;\n  /** URI scheme for resources. Default: \"codesign\". */\n  resourceScheme?: string;\n  /** Tools to expose via tools/list + tools/call. */\n  tools?: CodesignMcpToolRegistration[];\n  /**\n   * Build identity reported as `serverInfo.version` on `initialize`. A client\n   * (the deploy smoketest) can assert it to confirm it's talking to the\n   * just-deployed build, not a stale container. Default `'dev'`.\n   */\n  buildId?: string;\n}\n\nconst DOC_FILE = /^docs\\/([^/]+)\\/(.+)$/;\n\nexport function createCodesignMcpServer(\n  opts: CodesignMcpServerOptions\n): Server {\n  const scheme = opts.resourceScheme ?? 'codesign';\n  const assets = opts.assets;\n\n  // `instructions` is intentionally short — it tells the model what the\n  // server is and STRONGLY directs it to call `codesign_read_codesign_system`\n  // before its first edit. Skills are now first-class tools (not MCP\n  // resources buried in an XML block), so discovery happens via tools/list\n  // on every host without needing ReadMcpResourceTool support.\n  //\n  // Why short: Claude Code wraps MCP `instructions` in a <system-reminder>\n  // and truncates long ones mid-stream. Keeping `instructions` under ~1.5 KB\n  // ensures the whole pointer survives any sane truncation.\n  //\n  // The asset-generation hint is included only when an `asset_generate` tool\n  // is actually registered (Local hides it without an API_KEY), so we never\n  // advertise a tool the model can't see in tools/list.\n  const hasAssetGenerate = (opts.tools ?? []).some(\n    (t) => t.name === 'asset_generate'\n  );\n  const instructions = [\n    'This is the **codesign** MCP server. It hosts a CE.SDK CreativeEngine and a persistent design workspace (revision DAG) for vector design + print-quality PDF output.',\n    '',\n    '**Required first step** — before any `edit`, call `handbook` (no args). It teaches the mandatory `parent` argument, dirty-on-throw safety, rewind recovery via `list`/`history`, the typeface schema setFont requires, and the runtime quirks that bite first attempts. Skipping it produces broken output.',\n    '',\n    'Reference docs, on demand:',\n    '- `api({ path?, offset?, limit? })` — CE.SDK TypeScript signatures.',\n    '- `guide({ path? })` — CE.SDK Vanilla JS reference docs / topic guides.',\n    '',\n    'Design tools (after reading the handbook):',\n    '- `edit({ parent, code, title?, note? })` — mutate the canvas; `parent` is REQUIRED (revision id, or null for a new design).',\n    '- `preview({ blockId, revision? })` — render a block to an inline image.',\n    '- `export({ target, format, revision, blockId })` — render a block to pdf/image and write it into the workspace.',\n    '- `save({ revision, outPath? })` — write a self-contained `.zip` archive (scene + assets) of a revision into the workspace.',\n    '',\n    'Workspace tools (for resuming + navigating across designs):',\n    '- `list()` — every design in the workspace, newest first.',\n    '- `history({ revision })` — walk back to the root; how you re-ground after a rewind.',\n    '- `inspect({ revision })` — read one revision in full, including the code that produced it (patterns, not block ids).',\n    '- `rename({ revision, title })` — rename a design.',\n    '- `open_editor({ revision? })` — URL the human can open to view the design.',\n    '- `asset_search({ sourceId?, query? })` — browse asset sources; apply results in `edit`.'\n  ]\n    .concat(\n      hasAssetGenerate\n        ? [\n            '',\n            'Asset generation:',\n            \"- `asset_generate({ kind: 'image', prompt, width?, height? })` — opt-in (Local needs API_KEY); Hosted is cost-gated.\"\n          ]\n        : []\n    )\n    .join('\\n');\n\n  // Build the resource map up-front: URI → rewritten markdown body. Cross-refs\n  // inside doc content are rewritten to absolute MCP URIs so the model never\n  // has to resolve a relative path against a doc dir.\n  const rewrittenContent = new Map<string, string>();\n  for (const [key, content] of Object.entries(assets)) {\n    const m = key.match(DOC_FILE);\n    if (!m) continue;\n    const [, doc, rest] = m;\n    const uri = `${scheme}://docs/${doc}/${rest}`;\n    rewrittenContent.set(uri, rewriteSkillLinks(content, doc, scheme));\n  }\n\n  const server = new Server(\n    { name: 'codesign', version: opts.buildId ?? 'dev' },\n    {\n      capabilities: { resources: {}, tools: {} },\n      instructions\n    }\n  );\n\n  // `resources/list` advertises only the per-skill SKILL.md (the entry\n  // point), not the 392 nested cesdk-guide files. Sub-files stay readable\n  // via `resources/read` against any cached URI, but skill content discovery\n  // happens through the codesign_read_* tools — those are the universal\n  // surface across MCP hosts.\n  server.setRequestHandler(ListResourcesRequestSchema, async () => ({\n    resources: Array.from(rewrittenContent.keys())\n      .filter((uri) => uri.endsWith('/SKILL.md'))\n      .map((uri) => ({\n        uri,\n        mimeType: 'text/markdown',\n        name: uri.replace(`${scheme}://`, '')\n      }))\n  }));\n\n  server.setRequestHandler(ReadResourceRequestSchema, async (req) => {\n    const text = rewrittenContent.get(req.params.uri);\n    if (text === undefined) {\n      throw new McpError(\n        ErrorCode.InvalidParams,\n        `Unknown resource: ${req.params.uri}`\n      );\n    }\n    return {\n      contents: [{ uri: req.params.uri, mimeType: 'text/markdown', text }]\n    };\n  });\n\n  // Tools registered with the server: caller-supplied design tools + the\n  // auto-generated skill-read tools (one per skill in the asset bundle).\n  // The skill tools always come first so Level 1 wording in the design tool\n  // descriptions (\"call codesign_read_codesign_system first\") points at\n  // something the model already sees in tools/list.\n  const tools = new Map<string, CodesignMcpToolRegistration>();\n  for (const t of buildSkillReadTools(assets)) tools.set(t.name, t);\n  for (const t of opts.tools ?? []) tools.set(t.name, t);\n\n  server.setRequestHandler(ListToolsRequestSchema, async () => ({\n    tools: Array.from(tools.values()).map((t) => ({\n      name: t.name,\n      description: t.description,\n      inputSchema: t.inputSchema as never\n    }))\n  }));\n\n  server.setRequestHandler(CallToolRequestSchema, async (req) => {\n    const t = tools.get(req.params.name);\n    if (!t) {\n      throw new McpError(\n        ErrorCode.InvalidParams,\n        `Unknown tool: ${req.params.name}`\n      );\n    }\n    return await t.call(req.params.arguments ?? {});\n  });\n\n  return server;\n}\n"]}

package/dist/test/scripts/changelog-add.d.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+export declare function entryFileName(name: string): string;
+export declare function addEntry(opts: {
+    templatePath: string;
+    entriesDir: string;
+    name: string;
+}): Promise<string>;
+//# sourceMappingURL=changelog-add.d.ts.map

package/dist/test/scripts/changelog-add.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changelog-add.d.ts","sourceRoot":"","sources":["../../../scripts/changelog-add.ts"],"names":[],"mappings":";AAOA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,MAAM,CAAC,CAWlB"}

package/dist/test/scripts/changelog-add.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+// Create a new changelog-next entry from the template.
+// Run via `node --experimental-strip-types` (see package.json).
+import { copyFile, access } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+export function entryFileName(name) {
+    const sanitized = name
+        .replace(/[\\/]/g, '-')
+        .replace(/^-+/, '')
+        .replace(/\.md$/i, '');
+    return `${sanitized}.md`;
+}
+export async function addEntry(opts) {
+    const target = join(opts.entriesDir, entryFileName(opts.name));
+    let exists = true;
+    try {
+        await access(target);
+    }
+    catch {
+        exists = false;
+    }
+    if (exists)
+        throw new Error(`entry already exists: ${target}`);
+    await copyFile(opts.templatePath, target);
+    return target;
+}
+async function main() {
+    const name = process.argv[2];
+    if (!name) {
+        console.error('usage: node --experimental-strip-types scripts/changelog-add.ts <name>');
+        process.exit(1);
+    }
+    const here = dirname(fileURLToPath(import.meta.url));
+    const entriesDir = join(here, '..', 'changelog-next');
+    const target = await addEntry({
+        templatePath: join(entriesDir, '-template.md'),
+        entriesDir,
+        name
+    });
+    console.log(`created ${target} — edit it and commit.`);
+}
+if (process.argv[1] &&
+    import.meta.url === pathToFileURL(process.argv[1]).href) {
+    main().catch((err) => {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=changelog-add.js.map