@lowdefy/server-dev 5.6.0 → 6.1.0

package/src/routes/devInspect.js

@@ -0,0 +1,111 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { serializer } from '@lowdefy/helpers';
+
+import { readCheckpoint } from '../../lib/docs/checkpointStore.js';
+import { loadMocks } from '../../lib/docs/devMockRegistry.js';
+import getPathSegments from '../lib/getPathSegments.js';
+import { listTabs, resolveTabRequest, updateTabPage } from '../../lib/docs/tabChannel.js';
+
+// Origin/host check mirrors clientError.js — this endpoint accepts a POST
+// from Inspector.jsx (a same-origin dev-only browser component), not from
+// arbitrary agents, so it needs the same CSRF-style guard.
+function checkOrigin(c) {
+  const origin = c.req.header('origin');
+  if (!origin) {
+    return false;
+  }
+  try {
+    return new URL(origin).host === c.req.header('host');
+  } catch {
+    return false;
+  }
+}
+
+// Dev-only agent-state-xray: a human tab bootstrapping from a
+// `?_checkpoint=<name>` URL (client/Inspector.jsx) fetches this. It returns
+// the checkpoint's state part + manifest for the tab to inject client-side,
+// and — as a side effect — loads the checkpoint's recorded requests into
+// devMockRegistry server-side, so that tab's own requests (src/routes/
+// request.js) replay recorded data instead of hitting real connections.
+function handleCheckpointBootstrap(c, { name }) {
+  let checkpoint;
+  try {
+    checkpoint = readCheckpoint({ name });
+  } catch (error) {
+    return c.json({ error: error.message }, 404);
+  }
+  loadMocks({ pageId: checkpoint.checkpoint.pageId, mocks: checkpoint.requests });
+  return c.json(
+    serializer.serialize({
+      checkpoint: checkpoint.checkpoint,
+      state: checkpoint.state,
+      urlQuery: checkpoint.urlQuery,
+      input: checkpoint.input,
+      user: checkpoint.user,
+      global: checkpoint.global,
+    })
+  );
+}
+
+// Inspector.jsx posts { tabId, pageId } here whenever its tab navigates, so
+// the tab registry (lib/docs/tabChannel.js) knows which page each connected
+// tab is on without the tab reconnecting its event stream.
+async function handleTabPage(c) {
+  const { tabId, pageId } = await c.req.json();
+  if (!tabId) {
+    return c.json({ error: 'Missing "tabId".' }, 400);
+  }
+  updateTabPage({ id: tabId, pageId });
+  return c.json({ ok: true });
+}
+
+// GET lists connected tabs for diagnostics (or, under /checkpoint/<name>,
+// bootstraps a human tab from a state checkpoint); POST /page updates the
+// page a connected tab is on; POST at the root is the answer leg of the SSE
+// request/response round trip (Inspector.jsx posts back {requestId, result}
+// after handling an inspect-request/eval-request event).
+async function devInspectHandler(c) {
+  if (c.req.method === 'GET') {
+    const segments = getPathSegments(c, '/api/dev-inspect/');
+    if (segments[0] === 'checkpoint' && segments[1]) {
+      return handleCheckpointBootstrap(c, { name: segments[1] });
+    }
+    return c.json({ tabs: listTabs() });
+  }
+
+  if (c.req.method !== 'POST') {
+    throw new Error('Only GET and POST requests are supported.');
+  }
+
+  if (!checkOrigin(c)) {
+    return c.json({ error: 'Forbidden' }, 403);
+  }
+
+  if (getPathSegments(c, '/api/dev-inspect/')[0] === 'page') {
+    return handleTabPage(c);
+  }
+
+  const { requestId, result } = await c.req.json();
+  if (!requestId) {
+    return c.json({ error: 'Missing "requestId".' }, 400);
+  }
+  const resolved = resolveTabRequest({ requestId, result });
+  return c.json({ ok: resolved });
+}
+
+export default devInspectHandler;

package/src/routes/devInspect.test.mjs

@@ -0,0 +1,119 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { Hono } from 'hono';
+import { jest } from '@jest/globals';
+
+const { listTabs, registerTab, requestFromTab, unregisterTab } = await import(
+  '../../lib/docs/tabChannel.js'
+);
+const { default: devInspectHandler } = await import('./devInspect.js');
+
+function createApp() {
+  const app = new Hono();
+  app.all('/api/dev-inspect', devInspectHandler);
+  app.all('/api/dev-inspect/*', devInspectHandler);
+  return app;
+}
+
+const sameOriginHeaders = {
+  host: 'localhost:3001',
+  origin: 'http://localhost:3001',
+  'content-type': 'application/json',
+};
+
+// tabChannel keeps its registries at module scope, so clear connected tabs
+// between tests to keep them independent.
+afterEach(() => {
+  listTabs().forEach((tab) => unregisterTab({ id: tab.id }));
+});
+
+test('GET /api/dev-inspect lists connected tabs', async () => {
+  registerTab({ id: 'tab-1', pageId: 'home', send: jest.fn() });
+  const res = await createApp().request('/api/dev-inspect');
+  expect(res.status).toBe(200);
+  const body = await res.json();
+  expect(body.tabs).toHaveLength(1);
+  expect(body.tabs[0]).toMatchObject({ id: 'tab-1', pageId: 'home' });
+});
+
+test('POST /api/dev-inspect/page returns 403 when the Origin header is missing', async () => {
+  registerTab({ id: 'tab-1', pageId: 'home', send: jest.fn() });
+  const res = await createApp().request('/api/dev-inspect/page', {
+    method: 'POST',
+    headers: { host: 'localhost:3001', 'content-type': 'application/json' },
+    body: JSON.stringify({ tabId: 'tab-1', pageId: 'about' }),
+  });
+  expect(res.status).toBe(403);
+  expect(listTabs()[0].pageId).toBe('home');
+});
+
+test('POST /api/dev-inspect/page moves a connected tab to the posted page', async () => {
+  registerTab({ id: 'tab-1', pageId: 'home', send: jest.fn() });
+  const res = await createApp().request('/api/dev-inspect/page', {
+    method: 'POST',
+    headers: sameOriginHeaders,
+    body: JSON.stringify({ tabId: 'tab-1', pageId: 'about' }),
+  });
+  expect(res.status).toBe(200);
+  expect(await res.json()).toEqual({ ok: true });
+  expect(listTabs()[0].pageId).toBe('about');
+});
+
+test('POST /api/dev-inspect/page returns 400 when tabId is missing', async () => {
+  const res = await createApp().request('/api/dev-inspect/page', {
+    method: 'POST',
+    headers: sameOriginHeaders,
+    body: JSON.stringify({ pageId: 'about' }),
+  });
+  expect(res.status).toBe(400);
+  expect(await res.json()).toEqual({ error: 'Missing "tabId".' });
+});
+
+test('POST /api/dev-inspect/page for a tab that already disconnected returns ok', async () => {
+  const res = await createApp().request('/api/dev-inspect/page', {
+    method: 'POST',
+    headers: sameOriginHeaders,
+    body: JSON.stringify({ tabId: 'gone', pageId: 'about' }),
+  });
+  expect(res.status).toBe(200);
+  expect(listTabs()).toHaveLength(0);
+});
+
+test('POST /api/dev-inspect resolves a pending tab request with the posted result', async () => {
+  const send = jest.fn();
+  registerTab({ id: 'tab-1', pageId: 'home', send });
+  const pending = requestFromTab({ pageId: 'home', event: 'inspect-request' });
+  const [, { requestId }] = send.mock.calls[0];
+
+  const res = await createApp().request('/api/dev-inspect', {
+    method: 'POST',
+    headers: sameOriginHeaders,
+    body: JSON.stringify({ requestId, result: { state: { a: 1 } } }),
+  });
+  expect(res.status).toBe(200);
+  expect(await res.json()).toEqual({ ok: true });
+  await expect(pending).resolves.toEqual({ state: { a: 1 } });
+});
+
+test('POST /api/dev-inspect returns 400 when requestId is missing', async () => {
+  const res = await createApp().request('/api/dev-inspect', {
+    method: 'POST',
+    headers: sameOriginHeaders,
+    body: JSON.stringify({ result: {} }),
+  });
+  expect(res.status).toBe(400);
+});

package/{pages/[[...pageId]].js → src/routes/devTools.js}

@@ -14,6 +14,8 @@
   limitations under the License.
 */
 
-import App from '../lib/client/App.js';
+function devToolsHandler(c) {
+  return c.json({ directories: { config: process.env.LOWDEFY_DIRECTORY_CONFIG } });
+}
 
-export default App;
+export default devToolsHandler;

package/{pages/404.js → src/routes/docs/appMap.js}

@@ -14,6 +14,10 @@
   limitations under the License.
 */
 
-import App from '../lib/client/App.js';
+import getAppMap from '../../../lib/docs/getAppMap.js';
 
-export default App;
+function docsAppMapHandler(c) {
+  return c.json(getAppMap());
+}
+
+export default docsAppMapHandler;

package/{pages/api/dev-tools.js → src/routes/docs/buildStatus.js}

@@ -13,10 +13,11 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-import apiWrapper from '../../lib/server/apiWrapper.js';
 
-async function handler({ req, res }) {
-  res.status(200).json({ directories: { config: process.env.LOWDEFY_DIRECTORY_CONFIG } });
+import getBuildStatus from '../../../lib/docs/getBuildStatus.js';
+
+function docsBuildStatusHandler(c) {
+  return c.json(getBuildStatus());
 }
 
-export default apiWrapper(handler);
+export default docsBuildStatusHandler;

package/src/routes/docs/checkpointsCreate.js

@@ -0,0 +1,28 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import createConfigCheckpoint from '../../../lib/docs/createConfigCheckpoint.js';
+
+// Lets an agent snapshot the config directory before an experimental change,
+// so it can revert cleanly with POST /lowdefy-docs/checkpoints/revert if the
+// change doesn't work out.
+async function docsCheckpointsCreateHandler(c) {
+  const body = await c.req.json().catch(() => ({}));
+  const result = createConfigCheckpoint({ label: body.label });
+  return c.json(result);
+}
+
+export default docsCheckpointsCreateHandler;

package/src/routes/docs/checkpointsList.js

@@ -0,0 +1,23 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import listConfigCheckpoints from '../../../lib/docs/listConfigCheckpoints.js';
+
+function docsCheckpointsListHandler(c) {
+  return c.json(listConfigCheckpoints());
+}
+
+export default docsCheckpointsListHandler;

package/{pages/api/icons/dynamic.js → src/routes/docs/checkpointsRevert.js}

@@ -14,21 +14,20 @@
   limitations under the License.
 */
 
-import fs from 'fs';
-import path from 'path';
+import revertConfigCheckpoint from '../../../lib/docs/revertConfigCheckpoint.js';
 
-async function handler(req, res) {
-  const filePath = path.join(process.cwd(), 'build', 'plugins', 'iconsDynamic.js');
+async function docsCheckpointsRevertHandler(c) {
+  const body = await c.req.json().catch(() => ({}));
+  if (!body.id) {
+    return c.json({ error: 'revert requires an "id" of the checkpoint to restore.' }, 400);
+  }
 
   try {
-    const content = fs.readFileSync(filePath, 'utf8');
-    res.setHeader('Content-Type', 'application/javascript');
-    res.status(200).send(content);
-  } catch {
-    // Return empty default export if file doesn't exist yet
-    res.setHeader('Content-Type', 'application/javascript');
-    res.status(200).send('export default {};');
+    const result = revertConfigCheckpoint({ id: body.id });
+    return c.json(result);
+  } catch (error) {
+    return c.json({ error: error.message }, 400);
   }
 }
 
-export default handler;
+export default docsCheckpointsRevertHandler;

package/src/routes/docs/content.js

@@ -0,0 +1,31 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import getCoreDoc from '../../../lib/docs/getCoreDoc.js';
+
+function docsContentHandler(c) {
+  const slug = c.req.param('slug');
+  const doc = getCoreDoc({ slug });
+  if (doc === null) {
+    return c.json(
+      { error: `No doc found for slug "${slug}". Use GET /lowdefy-docs/search?q=... to find the right slug.` },
+      404
+    );
+  }
+  return c.text(doc.markdown, 200, { 'Content-Type': 'text/markdown; charset=utf-8' });
+}
+
+export default docsContentHandler;

package/src/routes/docs/evalOperator.js

@@ -0,0 +1,56 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import evalOperator from '../../../lib/docs/evalOperator.js';
+import parseUserParam from './parseUserParam.js';
+
+async function docsEvalOperatorHandler(c) {
+  const body = await c.req.json().catch(() => ({}));
+  const { pageId, source } = body;
+  // "operator" is accepted as an alias for "expression" — agents commonly
+  // guess it as the body key for this endpoint.
+  const expression = body.expression ?? body.operator;
+  if (expression === undefined) {
+    return c.json(
+      {
+        error:
+          'POST /lowdefy-docs/eval-operator requires an "expression" in the JSON body — the operator expression to evaluate, e.g. {"pageId": "home", "expression": {"_state": "key"}}.',
+      },
+      400
+    );
+  }
+  // Derived from the incoming request rather than a config value — this is
+  // the origin an agent can actually reach the dev server on (host/port it
+  // just connected to), regardless of how the server is bound.
+  const origin = new URL(c.req.url).origin;
+
+  const { user, error: userError } = parseUserParam({ value: body.user });
+  if (userError) {
+    return c.json({ error: userError }, 400);
+  }
+
+  const result = await evalOperator({ origin, pageId, expression, source, user });
+  if (result.error) {
+    // A contradictory call (`user` with `source: 'tab'`) is the caller's
+    // mistake, not a failed render — 502 would read as "the renderer broke" and
+    // invite a pointless retry of the same request.
+    const status = result.invalidInput ? 400 : 502;
+    return c.json({ error: result.error, source: result.source }, status);
+  }
+  return c.json(result);
+}
+
+export default docsEvalOperatorHandler;

package/src/routes/docs/examples.js

@@ -0,0 +1,33 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import getExamples from '../../../lib/docs/getExamples.js';
+
+function docsExamplesHandler(c) {
+  const type = c.req.param('type');
+  const examples = getExamples({ type });
+  if (examples === null) {
+    return c.json(
+      {
+        error: `No examples shipped for block type "${type}". Use GET /lowdefy-docs/schema/blocks/${type} for its schema.`,
+      },
+      404
+    );
+  }
+  return c.json(examples);
+}
+
+export default docsExamplesHandler;

package/src/routes/docs/find.js

@@ -0,0 +1,30 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import findConfig from '../../../lib/docs/findConfig.js';
+
+async function docsFindHandler(c) {
+  const id = c.req.param('id');
+  const pageId = c.req.query('pageId');
+  try {
+    const result = await findConfig({ id, pageId });
+    return c.json(result);
+  } catch (error) {
+    return c.json({ error: error.message }, 400);
+  }
+}
+
+export default docsFindHandler;

package/src/routes/docs/index.js

@@ -0,0 +1,23 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import getOverview from '../../../lib/docs/getOverview.js';
+
+function docsIndexHandler(c) {
+  return c.text(getOverview(), 200, { 'Content-Type': 'text/markdown; charset=utf-8' });
+}
+
+export default docsIndexHandler;

package/src/routes/docs/inspectState.js

@@ -0,0 +1,44 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import inspectState from '../../../lib/docs/inspectState.js';
+import parseUserParam from './parseUserParam.js';
+
+async function docsInspectStateHandler(c) {
+  const pageId = c.req.param('pageId');
+  const source = c.req.query('source');
+  // Derived from the incoming request rather than a config value — this is
+  // the origin an agent can actually reach the dev server on (host/port it
+  // just connected to), regardless of how the server is bound.
+  const origin = new URL(c.req.url).origin;
+
+  const { user, error: userError } = parseUserParam({ value: c.req.query('user') });
+  if (userError) {
+    return c.json({ error: userError }, 400);
+  }
+
+  const result = await inspectState({ origin, pageId, source, user });
+  if (result.error) {
+    // A contradictory call (`user` with `source=tab`) is the caller's mistake,
+    // not a failed render — 502 would read as "the renderer broke" and invite a
+    // pointless retry of the same request.
+    const status = result.invalidInput ? 400 : 502;
+    return c.json({ error: result.error, source: result.source }, status);
+  }
+  return c.json(result);
+}
+
+export default docsInspectStateHandler;

package/src/routes/docs/loadState.js

@@ -0,0 +1,49 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import loadState from '../../../lib/docs/loadState.js';
+import parseUserParam from './parseUserParam.js';
+
+// Loads a state checkpoint back into the running app. mode: 'headless'
+// (default) drives a headless page and injects state directly for an agent
+// to verify; mode: 'registry-only' just loads the recorded requests into
+// devMockRegistry and returns a URL for a human to open in a real browser
+// tab (client/Inspector.jsx does the state injection there).
+async function docsLoadStateHandler(c) {
+  const body = await c.req.json();
+  const { name, mode } = body;
+  // Derived from the incoming request rather than a config value — this is
+  // the origin an agent can actually reach the dev server on (host/port it
+  // just connected to), regardless of how the server is bound.
+  const origin = new URL(c.req.url).origin;
+
+  const { user, error: userError } = parseUserParam({ value: body.user });
+  if (userError) {
+    return c.json({ error: userError }, 400);
+  }
+
+  const result = await loadState({ origin, name, mode, user });
+  if (result.error) {
+    // A contradictory call (`user` in 'registry-only' mode) is the caller's
+    // mistake, not a failed render — 502 would read as "the renderer broke" and
+    // invite a pointless retry of the same request.
+    const status = result.invalidInput ? 400 : 502;
+    return c.json({ error: result.error }, status);
+  }
+  return c.json(result);
+}
+
+export default docsLoadStateHandler;

package/src/routes/docs/mcp.js

@@ -0,0 +1,30 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { StreamableHTTPTransport } from '@hono/mcp';
+
+import createDocsMcpServer from '../../../lib/docs/createDocsMcpServer.js';
+
+// Stateless per-request server: docs tools read build artifacts fresh on
+// every call, so there is no session state worth keeping between requests.
+async function mcpHandler(c) {
+  const server = createDocsMcpServer({ origin: new URL(c.req.url).origin, honoContext: c });
+  const transport = new StreamableHTTPTransport();
+  await server.connect(transport);
+  return transport.handleRequest(c);
+}
+
+export default mcpHandler;