@modootoday/pmcp 0.2.0 → 0.4.0

package/README.md

@@ -1,8 +1,10 @@
 # pmcp
 
 Find and use package skills without loading every document into your agent's context.
-`pmcp` reads `SKILL.md` files from installed packages and from plugin marketplaces
-(`--marketplace <dir>`), and exposes five MCP tools: `skill_catalog`, `skill_find`,
+`pmcp` reads `SKILL.md` files from installed packages, from monorepo workspaces
+(`--workspace <dir>`: the root and every member its `workspaces` globs name, nested
+workspace roots included), from single package directories (`--package <dir>`), and
+from plugin marketplaces (`--marketplace <dir>`), and exposes five MCP tools: `skill_catalog`, `skill_find`,
 `skill_describe`, `skill_call`, and `skill_read`.
 
 ## Install
@@ -60,6 +62,27 @@ within the discovery depth. A skill needs a frontmatter `description` for search
 `skill_find` accepts a problem description and returns matching skills.
 `skill_call` opens the selected document. Local MCP reading requires no login.
 
+## Hosting over HTTP
+
+`@modootoday/pmcp/http` serves the same five tools over streamable HTTP for a hosted catalog.
+The host owns identity: `authorize(request)` returns the caller or `undefined` (answered 401),
+and `tiersFor(caller)` decides which tiers that caller sees (default `open` and `free`; skills
+without a tier count as `open`). The catalog is read once; call `reload()` after deploying new
+skill releases.
+
+```ts
+import { createSkillHttpHandler } from "@modootoday/pmcp/http";
+
+const skills = createSkillHttpHandler({
+  roots: [],
+  marketplaces: ["/srv/marketplace", "/srv/marketplace-free"],
+  authorize: async (request) => verifyBearer(request.headers.get("authorization")),
+});
+export default { fetch: (request: Request) => skills.fetch(request) };
+```
+
+Put Origin and Host validation in front of it when it is mounted bare.
+
 ## Runtime and licence
 
 Node.js 22 or later, or Bun 1.3 or later. Default ranking is lexical. The optional

package/dist/catalog-BiPLcbLu.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The skills the installed packages brought with them.
+ *
+ * Derived from `node_modules` at read time rather than from a list somebody
+ * maintains: installing a package is how its skill arrives and uninstalling it
+ * is how the skill leaves, so the catalog is always true of the project.
+ */
+interface SkillEntry {
+    /** `<package>/<slug>`. Unique, and stable while the package is installed. */
+    readonly name: string;
+    readonly package: string;
+    readonly slug: string;
+    /** Frontmatter description. The only text `find` ranks against. */
+    readonly description: string;
+    /** Absolute path to the SKILL.md. `call` reads the body from here. */
+    readonly path: string;
+    /** open, free or paid. Set for marketplace skills, absent for packages. */
+    readonly tier?: string;
+    /** The frontmatter `metadata:` block, one level deep. */
+    readonly metadata?: Readonly<Record<string, string | readonly string[]>>;
+    /** Extra search terms. Ranked with the description, never used as triggers. */
+    readonly keywords?: readonly string[];
+}
+interface CatalogOptions {
+    /** Directories to walk. Each is a `node_modules` root, not a package root. */
+    readonly roots: readonly string[];
+    /** Package name prefixes to consider. Empty means every package. */
+    readonly scopes?: readonly string[];
+    /** Marketplace directories, each holding .claude-plugin/marketplace.json. */
+    readonly marketplaces?: readonly string[];
+    /** Package directories read directly, for a package no node_modules links. */
+    readonly packages?: readonly string[];
+    /** Workspace roots: the root and every member its workspaces globs name. */
+    readonly workspaces?: readonly string[];
+    /** Told about every marketplace skill left out, and why. */
+    readonly onReject?: (rejection: {
+        path: string;
+        reason: string;
+    }) => void;
+}
+/**
+ * Directories a walk does not enter. Kept as short as the evidence allows: a
+ * name here is a package whose skill will never be found, and the cost of one
+ * extra readdir is far below the cost of missing a skill. Measured 20260906 --
+ * `lib` was on this list and hid playwright's `lib/skill/SKILL.md`, which is
+ * the most widely installed skill in the real world.
+ */
+declare const SKIPPED_DIRS: ReadonlySet<string>;
+/**
+ * How deep below a package root a SKILL.md is looked for. Three reaches every
+ * convention in use (skills, .agent/skills, .claude/skills, .gemini/skills,
+ * .codex/skills); four was measured to find nothing more.
+ */
+declare const MAX_SKILL_DEPTH = 3;
+/**
+ * Reads `name` and `description` out of YAML frontmatter without a parser.
+ *
+ * A parser is a dependency this server does not otherwise need, and the two
+ * fields it wants are flat scalars on their own line. Anything more nested is
+ * not read, which is the honest limit rather than a partial YAML.
+ */
+declare function readFrontmatter(source: string): Record<string, string>;
+/**
+ * The body after the frontmatter, or the whole file when there is none.
+ *
+ * The slice starts at the newline terminating the closing `---`, and a blank
+ * line after it is separator rather than content, so both are dropped.
+ */
+declare function readBody(source: string): string;
+/**
+ * Every skill reachable from the given roots, sorted by name.
+ *
+ * A package with no skills directory contributes nothing and costs one
+ * `existsSync` per convention. A skill with no description is skipped rather
+ * than listed:
+ * `find` ranks descriptions, so one without a description can only ever be
+ * found by already knowing its name, and listing it would spend a session's
+ * tokens on an entry that cannot answer.
+ */
+declare function readCatalog(options: CatalogOptions): SkillEntry[];
+/** A catalog entry without its body, which is what `catalog` returns. */
+declare function withoutBody({ path, ...rest }: SkillEntry): Omit<SkillEntry, "path">;
+/** Path relative to a root, for a message a reader can act on. */
+declare function displayPath(root: string, entry: SkillEntry): string;
+
+export { type CatalogOptions as C, MAX_SKILL_DEPTH as M, type SkillEntry as S, SKIPPED_DIRS as a, readCatalog as b, readFrontmatter as c, displayPath as d, readBody as r, withoutBody as w };

package/dist/{chunk-3NNRQ5A4.js → chunk-BFET6MFN.js}

@@ -9,7 +9,7 @@ import { join as join2, resolve } from "path";
 
 // src/catalog.ts
 import { existsSync, readFileSync, readdirSync } from "fs";
-import { basename, dirname, join, relative } from "path";
+import { basename, dirname, isAbsolute, join, relative } from "path";
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -86,48 +86,148 @@ function packageDirs(root) {
   }
   return found;
 }
+function readManifest(dir) {
+  try {
+    const parsed = JSON.parse(
+      readFileSync(join(dir, "package.json"), "utf8")
+    );
+    return parsed !== null && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function workspacePatterns(manifest) {
+  const field = manifest["workspaces"];
+  const list = Array.isArray(field) ? field : field?.packages;
+  if (!Array.isArray(list)) return [];
+  return list.filter((p) => typeof p === "string");
+}
+function expandBraces(pattern) {
+  const match = /\{([^{}]*)\}/u.exec(pattern);
+  if (!match) return [pattern];
+  const head = pattern.slice(0, match.index);
+  const tail = pattern.slice(match.index + match[0].length);
+  return match[1].split(",").flatMap((option) => expandBraces(`${head}${option}${tail}`));
+}
+function segmentMatcher(segment) {
+  const body = segment.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/gu, "\\$&")).join("[^/]*");
+  return new RegExp(`^${body}$`, "u");
+}
+function globDirs(base, pattern) {
+  const segments = pattern.split("/").filter((s) => s !== "" && s !== ".");
+  const found = /* @__PURE__ */ new Set();
+  const walk = (dir, index) => {
+    if (index === segments.length) {
+      found.add(dir);
+      return;
+    }
+    const segment = segments[index];
+    if (!segment.includes("*")) {
+      const next = join(dir, segment);
+      if (existsSync(next)) walk(next, index + 1);
+      return;
+    }
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    const children = entries.filter((e) => e.isDirectory() || e.isSymbolicLink()).filter((e) => !SKIPPED_DIRS.has(e.name));
+    if (segment === "**") {
+      walk(dir, index + 1);
+      for (const child of children) walk(join(dir, child.name), index);
+      return;
+    }
+    const matcher = segmentMatcher(segment);
+    for (const child of children) {
+      if (matcher.test(child.name)) walk(join(dir, child.name), index + 1);
+    }
+  };
+  walk(base, 0);
+  return [...found];
+}
+function workspacePackageDirs(root) {
+  const ordered = [];
+  const visited = /* @__PURE__ */ new Set();
+  const expand = (dir) => {
+    if (visited.has(dir)) return;
+    visited.add(dir);
+    const manifest = readManifest(dir);
+    if (manifest === null) return;
+    const included = /* @__PURE__ */ new Set();
+    const excluded = /* @__PURE__ */ new Set();
+    for (const raw of workspacePatterns(manifest)) {
+      const negated = raw.startsWith("!");
+      const pattern = negated ? raw.slice(1) : raw;
+      for (const alternative of expandBraces(pattern)) {
+        for (const match of globDirs(dir, alternative)) {
+          (negated ? excluded : included).add(match);
+        }
+      }
+    }
+    const members = [...included].filter((m) => !excluded.has(m) && existsSync(join(m, "package.json"))).sort();
+    for (const member of members) expand(member);
+    ordered.push(dir);
+  };
+  expand(root);
+  return ordered;
+}
+function nameOf(dir, named) {
+  const manifestName = readManifest(dir)?.["name"];
+  if (typeof manifestName === "string" && manifestName !== "") {
+    return manifestName;
+  }
+  if (named) return basename(dir);
+  return "";
+}
+function expandRootGlob(dir) {
+  if (!dir.includes("*")) return [dir];
+  const absolute = isAbsolute(dir);
+  const base = absolute ? "/" : ".";
+  return globDirs(base, dir).filter((d) => existsSync(join(d, "package.json"))).sort();
+}
 function readCatalog(options) {
   const scopes = options.scopes ?? [];
   const found = [];
   const seen = /* @__PURE__ */ new Set();
-  for (const root of options.roots) {
-    for (const packageDir of packageDirs(root)) {
-      const manifestPath = join(packageDir, "package.json");
-      if (!existsSync(manifestPath)) continue;
-      let packageName;
+  const seenPaths = /* @__PURE__ */ new Set();
+  const direct = new Set(options.packages ?? []);
+  const packageDirsToRead = [
+    ...options.roots.flatMap(packageDirs),
+    ...direct,
+    ...(options.workspaces ?? []).flatMap(expandRootGlob).flatMap(workspacePackageDirs)
+  ];
+  for (const packageDir of packageDirsToRead) {
+    const packageName = nameOf(packageDir, direct.has(packageDir));
+    if (packageName === "") continue;
+    if (scopes.length > 0 && !scopes.some((s) => packageName.startsWith(s))) {
+      continue;
+    }
+    for (const path of skillFiles(packageDir)) {
+      if (seenPaths.has(path)) continue;
+      seenPaths.add(path);
+      let source;
       try {
-        const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-        if (!manifest.name) continue;
-        packageName = manifest.name;
+        source = readFileSync(path, "utf8");
       } catch {
         continue;
       }
-      if (scopes.length > 0 && !scopes.some((s) => packageName.startsWith(s))) {
-        continue;
-      }
-      for (const path of skillFiles(packageDir)) {
-        let source;
-        try {
-          source = readFileSync(path, "utf8");
-        } catch {
-          continue;
-        }
-        const front = readFrontmatter(source);
-        const description = front["description"] ?? "";
-        if (description === "") continue;
-        const dirName = basename(dirname(path));
-        const slug = front["name"] ?? (dirName === basename(packageDir) ? packageName : dirName);
-        const name = `${packageName}/${slug}`;
-        if (seen.has(name)) continue;
-        seen.add(name);
-        found.push({
-          name,
-          package: packageName,
-          slug,
-          description,
-          path
-        });
-      }
+      const front = readFrontmatter(source);
+      const description = front["description"] ?? "";
+      if (description === "") continue;
+      const dirName = basename(dirname(path));
+      const slug = front["name"] ?? (dirName === basename(packageDir) ? packageName : dirName);
+      const name = `${packageName}/${slug}`;
+      if (seen.has(name)) continue;
+      seen.add(name);
+      found.push({
+        name,
+        package: packageName,
+        slug,
+        description,
+        path
+      });
     }
   }
   for (const dir of options.marketplaces ?? []) {
@@ -345,7 +445,7 @@ function rank(matches2, limit) {
 // src/server.ts
 import { createHash } from "crypto";
 import { readFileSync as readFileSync3, readdirSync as readdirSync3, realpathSync, statSync } from "fs";
-import { dirname as dirname2, isAbsolute, join as join3, relative as relative2, resolve as resolve2, sep } from "path";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join3, relative as relative2, resolve as resolve2, sep } from "path";
 var READ_BUDGET_BYTES = 256 * 1024;
 var DESCRIBE_FILE_LIMIT = 200;
 var CATALOG_PAGE_SIZE = 8;
@@ -403,6 +503,8 @@ function createSkillTools(options) {
       roots: options.roots,
       scopes: options.scopes,
       marketplaces: options.marketplaces,
+      packages: options.packages,
+      workspaces: options.workspaces,
       onReject: options.onReject
     });
     return entries;
@@ -492,7 +594,7 @@ function createSkillTools(options) {
     read(name, path = "SKILL.md") {
       const entry = catalog().find((candidate) => candidate.name === name);
       if (!entry) return { ok: false, error: "unknown_skill", detail: name };
-      if (isAbsolute(path) || path.split(/[\\/]/u).includes("..")) {
+      if (isAbsolute2(path) || path.split(/[\\/]/u).includes("..")) {
         return { ok: false, error: "path_outside_skill", detail: path };
       }
       const root = realpathSync(dirname2(entry.path));
@@ -562,7 +664,7 @@ function registerSkillTools(server, tools) {
       inputSchema: z.object({
         page: z.number().int().min(1).optional(),
         pageSize: z.number().int().min(1).max(20).optional(),
-        tier: z.enum(["open", "free", "paid"]).optional()
+        tier: z.enum(["open", "free", "paid", "internal"]).optional()
       }),
       annotations: readOnly
     },
@@ -577,7 +679,7 @@ function registerSkillTools(server, tools) {
         intent: z.string().min(1).max(256).describe("What you are trying to do, as an English sentence."),
         limit: z.number().int().min(1).max(25).optional(),
         filters: z.object({
-          tier: z.enum(["open", "free", "paid"]).optional(),
+          tier: z.enum(["open", "free", "paid", "internal"]).optional(),
           package: z.string().optional(),
           level: z.string().optional(),
           domain: z.string().optional(),
@@ -666,7 +768,7 @@ function registerSkillTools(server, tools) {
   return server;
 }
 function createSkillServer(options) {
-  const server = new McpServer({ name: SERVER_NAME, version: "0.2.0" });
+  const server = new McpServer({ name: SERVER_NAME, version: "0.4.0" });
   return registerSkillTools(server, createSkillTools(options));
 }
 
@@ -695,4 +797,4 @@ export {
   registerSkillTools,
   createSkillServer
 };
-//# sourceMappingURL=chunk-3NNRQ5A4.js.map
+//# sourceMappingURL=chunk-BFET6MFN.js.map

package/dist/{chunk-Y32X35YV.js → chunk-JL5BCIQM.js}

@@ -1,6 +1,6 @@
 import {
   createSkillServer
-} from "./chunk-3NNRQ5A4.js";
+} from "./chunk-BFET6MFN.js";
 
 // src/stdio.ts
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
@@ -8,11 +8,9 @@ function resolveRoots(argv, cwd) {
   const given = argv.filter((arg) => !arg.startsWith("-"));
   return given.length > 0 ? given : [`${cwd}/node_modules`];
 }
-function serve(roots, scopes = [], marketplaces = []) {
+function serve(catalog) {
   const options = {
-    roots,
-    ...scopes.length > 0 ? { scopes } : {},
-    ...marketplaces.length > 0 ? { marketplaces } : {},
+    ...catalog,
     onReject: ({ path, reason }) => process.stderr.write(`pmcp: skipped ${path}: ${reason}
 `)
   };
@@ -25,10 +23,11 @@ function serve(roots, scopes = [], marketplaces = []) {
 }
 function main(argv = process.argv.slice(2)) {
   const scopeArg = argv.find((arg) => arg.startsWith("--scope="));
-  serve(
-    resolveRoots(argv, process.cwd()),
-    scopeArg ? scopeArg.slice("--scope=".length).split(",") : []
-  );
+  const scopes = scopeArg ? scopeArg.slice("--scope=".length).split(",") : [];
+  serve({
+    roots: resolveRoots(argv, process.cwd()),
+    ...scopes.length > 0 ? { scopes } : {}
+  });
 }
 
 export {
@@ -36,4 +35,4 @@ export {
   serve,
   main
 };
-//# sourceMappingURL=chunk-Y32X35YV.js.map
+//# sourceMappingURL=chunk-JL5BCIQM.js.map

package/dist/{chunk-2NOO5RSP.js → chunk-RBT3ISF4.js}

@@ -1,6 +1,6 @@
 import {
   normaliseIntent
-} from "./chunk-3NNRQ5A4.js";
+} from "./chunk-BFET6MFN.js";
 
 // src/cache.ts
 async function openDatabase(path) {
@@ -131,4 +131,4 @@ export {
   DEFAULT_INTENT_CACHE_LIMIT,
   openIntentCache
 };
-//# sourceMappingURL=chunk-2NOO5RSP.js.map
+//# sourceMappingURL=chunk-RBT3ISF4.js.map

package/dist/cli.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   openDatabase
-} from "./chunk-2NOO5RSP.js";
+} from "./chunk-RBT3ISF4.js";
 import {
   serve
-} from "./chunk-Y32X35YV.js";
+} from "./chunk-JL5BCIQM.js";
 import {
   readCatalog
-} from "./chunk-3NNRQ5A4.js";
+} from "./chunk-BFET6MFN.js";
 
 // src/cli/command.ts
 var ArgumentError = class extends Error {
@@ -308,6 +308,18 @@ var CATALOG_OPTIONS = [
     describe: "A plugin marketplace directory (holds .claude-plugin/marketplace.json). Repeatable.",
     repeat: true,
     placeholder: "<dir>"
+  },
+  {
+    name: "package",
+    describe: "A package directory read directly, for one no node_modules links; without a package.json its folder name is the package name. Repeatable.",
+    repeat: true,
+    placeholder: "<dir>"
+  },
+  {
+    name: "workspace",
+    describe: "A workspace root, or a glob of them: each root and every member its workspaces globs name. Repeatable.",
+    repeat: true,
+    placeholder: "<dir>"
   }
 ];
 function rootsFrom(context) {
@@ -317,10 +329,14 @@ function rootsFrom(context) {
 function catalogOptionsFrom(context, onReject) {
   const scopes = many(context.args, "scope");
   const marketplaces = many(context.args, "marketplace");
+  const packages = many(context.args, "package");
+  const workspaces = many(context.args, "workspace");
   return {
     roots: rootsFrom(context),
     ...scopes.length > 0 ? { scopes } : {},
     ...marketplaces.length > 0 ? { marketplaces } : {},
+    ...packages.length > 0 ? { packages } : {},
+    ...workspaces.length > 0 ? { workspaces } : {},
     ...onReject ? { onReject } : {}
   };
 }
@@ -433,7 +449,7 @@ var indexCommand = {
 var listCommand = {
   name: "list",
   describe: "List the skills discovered in node_modules and marketplaces",
-  usage: "pmcp list [--root <dir>] [--scope <prefix>] [--marketplace <dir>] [--json]",
+  usage: "pmcp list [--root <dir>] [--scope <prefix>] [--marketplace <dir>] [--package <dir>] [--workspace <dir|glob>] [--json]",
   options: [
     ...CATALOG_OPTIONS,
     { name: "json", describe: "Emit JSON rather than a table.", boolean: true }
@@ -472,14 +488,10 @@ var listCommand = {
 var serveCommand = {
   name: "serve",
   describe: "Run the MCP server on stdio (the default with no command)",
-  usage: "pmcp serve [--root <dir>] [--scope <prefix>] [--marketplace <dir>]",
+  usage: "pmcp serve [--root <dir>] [--scope <prefix>] [--marketplace <dir>] [--package <dir>] [--workspace <dir>]",
   options: [...CATALOG_OPTIONS],
   run(context) {
-    serve(
-      rootsFrom(context),
-      many(context.args, "scope"),
-      many(context.args, "marketplace")
-    );
+    serve(catalogOptionsFrom(context));
     return 0;
   }
 };
@@ -2073,7 +2085,7 @@ function dispatch(argv, options = {}) {
   }
   return run(command, rest, { ui, env, cwd });
 }
-var VERSION = "0.2.0";
+var VERSION = "0.4.0";
 async function run(command, argv, context) {
   try {
     return await command.run({

package/dist/http.d.ts

@@ -0,0 +1,34 @@
+import { S as SkillEntry } from './catalog-BiPLcbLu.js';
+import { S as SkillServerOptions } from './server-dNFrR_Zh.js';
+
+/**
+ * The catalog over streamable HTTP, for a hosted skills server.
+ *
+ * The host owns identity: it passes authorize(), which turns a request into a
+ * caller or undefined. Anonymous requests are refused; each caller sees only the
+ * tiers tiersFor() grants. The catalog is read once and filtered per request.
+ */
+
+interface SkillCaller {
+    /** Stable id of the signed-in user, recorded by the host, never by pmcp. */
+    readonly id: string;
+    /** Whatever the host's token carried; passed to tiersFor unchanged. */
+    readonly claims?: Readonly<Record<string, unknown>>;
+}
+interface SkillHttpOptions extends SkillServerOptions {
+    readonly authorize: (request: Request) => SkillCaller | undefined | Promise<SkillCaller | undefined>;
+    /** Tiers a caller may list and load. Package skills without a tier count as open. */
+    readonly tiersFor?: (caller: SkillCaller) => readonly string[];
+    /** Sent in WWW-Authenticate on a refused request, e.g. a resource metadata URL. */
+    readonly challenge?: string;
+}
+declare const DEFAULT_TIERS: readonly string[];
+declare function visibleTo(entries: readonly SkillEntry[], tiers: readonly string[]): SkillEntry[];
+interface SkillHttpHandler {
+    fetch(request: Request): Promise<Response>;
+    /** Re-read the catalog, for a host that deploys new skill releases in place. */
+    reload(): void;
+}
+declare function createSkillHttpHandler(options: SkillHttpOptions): SkillHttpHandler;
+
+export { DEFAULT_TIERS, type SkillCaller, type SkillHttpHandler, type SkillHttpOptions, createSkillHttpHandler, visibleTo };

package/dist/http.js

@@ -0,0 +1,65 @@
+import {
+  createSkillServer,
+  readCatalog
+} from "./chunk-BFET6MFN.js";
+
+// src/http.ts
+import {
+  createMcpHandler
+} from "@modelcontextprotocol/server";
+var DEFAULT_TIERS = ["open", "free"];
+function visibleTo(entries, tiers) {
+  const allowed = new Set(tiers);
+  return entries.filter((entry) => allowed.has(entry.tier ?? "open"));
+}
+function createSkillHttpHandler(options) {
+  const load = options.loadCatalog ?? readCatalog;
+  let all = load(options);
+  const tiersFor = options.tiersFor ?? (() => DEFAULT_TIERS);
+  const handlers = /* @__PURE__ */ new Map();
+  const handlerFor = (tiers) => {
+    const key = [...tiers].sort().join(",");
+    const cached = handlers.get(key);
+    if (cached) return cached;
+    const handler = createMcpHandler(
+      () => createSkillServer({
+        ...options,
+        loadCatalog: () => visibleTo(all, tiers)
+      })
+    );
+    handlers.set(key, handler);
+    return handler;
+  };
+  return {
+    async fetch(request) {
+      const caller = await options.authorize(request);
+      if (!caller) {
+        return new Response(JSON.stringify({ error: "unauthorized" }), {
+          status: 401,
+          headers: {
+            "content-type": "application/json",
+            "www-authenticate": options.challenge ?? "Bearer"
+          }
+        });
+      }
+      return handlerFor(tiersFor(caller)).fetch(request, {
+        authInfo: {
+          token: "",
+          clientId: caller.id,
+          scopes: [],
+          extra: { ...caller.claims }
+        }
+      });
+    },
+    reload() {
+      all = load(options);
+      handlers.clear();
+    }
+  };
+}
+export {
+  DEFAULT_TIERS,
+  createSkillHttpHandler,
+  visibleTo
+};
+//# sourceMappingURL=http.js.map

package/dist/index.d.ts

@@ -1,34 +1,9 @@
+import { I as IntentCache, S as SkillServerOptions, a as SkillTools } from './server-dNFrR_Zh.js';
+export { C as CATALOG_PAGE_MAX, b as CATALOG_PAGE_SIZE, c as CallResponse, d as CatalogResponse, D as DEFAULT_FIND_LIMIT, e as DESCRIBE_FILE_LIMIT, E as Embedder, F as FindOptions, f as FindResult, g as IntentCacheStats, M as Match, R as READ_BUDGET_BYTES, h as Ranking, i as ReadResult, j as SkillFilters, k as cosine, l as createSkillTools, m as find, n as lexicalScore, o as normaliseIntent } from './server-dNFrR_Zh.js';
+import { S as SkillEntry } from './catalog-BiPLcbLu.js';
+export { C as CatalogOptions, M as MAX_SKILL_DEPTH, a as SKIPPED_DIRS, d as displayPath, r as readBody, b as readCatalog, c as readFrontmatter, w as withoutBody } from './catalog-BiPLcbLu.js';
 import { McpServer } from '@modelcontextprotocol/server';
 
-/**
- * The intent key and the cache contract.
- *
- * Separate from the sqlite implementation so that ranking, which needs the key
- * and the interface, does not pull a bun-only module into a consumer running
- * under node. Only `cache.ts` requires bun.
- */
-interface IntentCacheStats {
-    readonly hits: number;
-    readonly misses: number;
-    /** Rows found for the key but written by a different model. */
-    readonly mismatched: number;
-    readonly rows: number;
-    /** Which sqlite builtin answered, or absent when there is no cache. */
-    readonly provider?: string;
-}
-interface IntentCache {
-    /** The cached vector for an intent, or null when nothing usable is stored. */
-    get(intent: string): Float32Array | null;
-    put(intent: string, vector: Float32Array): void;
-    stats(): IntentCacheStats;
-    close(): void;
-}
-/**
- * Same question, differently typed. Case, punctuation and spacing only — the
- * key has to survive a caller writing "How do I wire X?" and "how do i wire x".
- */
-declare function normaliseIntent(intent: string): string;
-
 /**
  * Query vectors, kept on disk between sessions.
  *
@@ -61,143 +36,6 @@ declare const DEFAULT_INTENT_CACHE_LIMIT = 4096;
  */
 declare function openIntentCache(options: IntentCacheOptions): Promise<IntentCache | null>;
 
-/**
- * The skills the installed packages brought with them.
- *
- * Derived from `node_modules` at read time rather than from a list somebody
- * maintains: installing a package is how its skill arrives and uninstalling it
- * is how the skill leaves, so the catalog is always true of the project.
- */
-interface SkillEntry {
-    /** `<package>/<slug>`. Unique, and stable while the package is installed. */
-    readonly name: string;
-    readonly package: string;
-    readonly slug: string;
-    /** Frontmatter description. The only text `find` ranks against. */
-    readonly description: string;
-    /** Absolute path to the SKILL.md. `call` reads the body from here. */
-    readonly path: string;
-    /** open, free or paid. Set for marketplace skills, absent for packages. */
-    readonly tier?: string;
-    /** The frontmatter `metadata:` block, one level deep. */
-    readonly metadata?: Readonly<Record<string, string | readonly string[]>>;
-    /** Extra search terms. Ranked with the description, never used as triggers. */
-    readonly keywords?: readonly string[];
-}
-interface CatalogOptions {
-    /** Directories to walk. Each is a `node_modules` root, not a package root. */
-    readonly roots: readonly string[];
-    /** Package name prefixes to consider. Empty means every package. */
-    readonly scopes?: readonly string[];
-    /** Marketplace directories, each holding .claude-plugin/marketplace.json. */
-    readonly marketplaces?: readonly string[];
-    /** Told about every marketplace skill left out, and why. */
-    readonly onReject?: (rejection: {
-        path: string;
-        reason: string;
-    }) => void;
-}
-/**
- * Directories a walk does not enter. Kept as short as the evidence allows: a
- * name here is a package whose skill will never be found, and the cost of one
- * extra readdir is far below the cost of missing a skill. Measured 20260906 --
- * `lib` was on this list and hid playwright's `lib/skill/SKILL.md`, which is
- * the most widely installed skill in the real world.
- */
-declare const SKIPPED_DIRS: ReadonlySet<string>;
-/**
- * How deep below a package root a SKILL.md is looked for. Three reaches every
- * convention in use (skills, .agent/skills, .claude/skills, .gemini/skills,
- * .codex/skills); four was measured to find nothing more.
- */
-declare const MAX_SKILL_DEPTH = 3;
-/**
- * Reads `name` and `description` out of YAML frontmatter without a parser.
- *
- * A parser is a dependency this server does not otherwise need, and the two
- * fields it wants are flat scalars on their own line. Anything more nested is
- * not read, which is the honest limit rather than a partial YAML.
- */
-declare function readFrontmatter(source: string): Record<string, string>;
-/**
- * The body after the frontmatter, or the whole file when there is none.
- *
- * The slice starts at the newline terminating the closing `---`, and a blank
- * line after it is separator rather than content, so both are dropped.
- */
-declare function readBody(source: string): string;
-/**
- * Every skill reachable from the given roots, sorted by name.
- *
- * A package with no skills directory contributes nothing and costs one
- * `existsSync` per convention. A skill with no description is skipped rather
- * than listed:
- * `find` ranks descriptions, so one without a description can only ever be
- * found by already knowing its name, and listing it would spend a session's
- * tokens on an entry that cannot answer.
- */
-declare function readCatalog(options: CatalogOptions): SkillEntry[];
-/** A catalog entry without its body, which is what `catalog` returns. */
-declare function withoutBody({ path, ...rest }: SkillEntry): Omit<SkillEntry, "path">;
-/** Path relative to a root, for a message a reader can act on. */
-declare function displayPath(root: string, entry: SkillEntry): string;
-
-/**
- * Ranking an intent against skill descriptions.
- *
- * Semantic when an embedder is supplied, lexical otherwise, and the answer says
- * which. A caller that cannot tell the two apart cannot tell a degraded server
- * from a working one.
- */
-
-type Ranking = "semantic" | "lexical";
-interface Match {
-    readonly name: string;
-    readonly package: string;
-    readonly description: string;
-    readonly score: number;
-}
-interface FindResult {
-    readonly ranking: Ranking;
-    readonly matches: readonly Match[];
-}
-/**
- * The encoder, supplied by the caller. There is no default and no bundled
- * model: which model runs decides what the scores mean, so it is the consuming
- * repository's declaration rather than this package's.
- */
-interface Embedder {
-    readonly modelId: string;
-    readonly dims: number;
-    embed(text: string): Promise<Float32Array>;
-}
-interface FindOptions {
-    readonly entries: readonly SkillEntry[];
-    readonly intent: string;
-    readonly limit?: number;
-    readonly embedder?: Embedder;
-    readonly cache?: IntentCache;
-    /** Precomputed description vectors, keyed by skill name. */
-    readonly vectors?: ReadonlyMap<string, Float32Array>;
-}
-declare const DEFAULT_FIND_LIMIT = 5;
-/**
- * Token overlap and bigram Dice, averaged. Deterministic and dependency-free:
- * this is the answer when there is no model, so it must never be the thing
- * that fails.
- */
-declare function lexicalScore(intent: string, description: string): number;
-/** Cosine over two equal-width vectors. Zero when either has no magnitude. */
-declare function cosine(a: Float32Array, b: Float32Array): number;
-/**
- * Ranked matches, and which ranking produced them.
- *
- * Returns rather than loads: a search verb that also acts cannot be used to
- * look, and the whole reason this server exists is that looking should be
- * cheap.
- */
-declare function find(options: FindOptions): Promise<FindResult>;
-
 /**
  * Skills laid out as an agent plugin marketplace: a directory holding
  * `.claude-plugin/marketplace.json`, whose plugins keep skills at
@@ -224,112 +62,6 @@ declare function readFrontmatterText(source: string): string;
  */
 declare function readMarketplace(dir: string, onReject?: (rejection: Rejection) => void): SkillEntry[];
 
-/**
- * The five tools, and nothing else.
- *
- * The point of the server is that a session's startup cost does not grow with
- * the number of skills installed: the host lists five tools whatever the
- * catalog holds, and a body is read only when one is asked for.
- */
-
-/** Largest file skill_read returns. A skill needing more should split it. */
-declare const READ_BUDGET_BYTES: number;
-/** How many files skill_describe lists before saying the rest were cut. */
-declare const DESCRIBE_FILE_LIMIT = 200;
-declare const CATALOG_PAGE_SIZE = 8;
-declare const CATALOG_PAGE_MAX = 20;
-/** Equality filters over catalog fields. Unset keys match everything. */
-interface SkillFilters {
-    readonly tier?: string;
-    readonly package?: string;
-    readonly level?: string;
-    readonly domain?: string;
-    readonly medium?: string;
-}
-type ReadResult = {
-    readonly ok: true;
-    readonly name: string;
-    readonly path: string;
-    readonly bytes: number;
-    readonly sha256: string;
-    readonly text: string;
-} | {
-    readonly ok: false;
-    readonly error: string;
-    readonly detail: string;
-};
-interface SkillServerOptions extends CatalogOptions {
-    readonly embedder?: Embedder;
-    readonly cache?: IntentCache;
-    readonly vectors?: ReadonlyMap<string, Float32Array>;
-    /** Injected for tests. Reads the catalog off disk otherwise. */
-    readonly loadCatalog?: (options: CatalogOptions) => SkillEntry[];
-}
-interface CatalogResponse {
-    readonly count: number;
-    readonly page: number;
-    readonly totalPages: number;
-    readonly hasNext: boolean;
-    readonly packages: readonly {
-        readonly package: string;
-        readonly skills: readonly {
-            readonly name: string;
-            readonly description: string;
-            readonly tier?: string;
-        }[];
-    }[];
-}
-interface CallResponse {
-    readonly name: string;
-    readonly body: string;
-}
-/**
- * The catalog, the search and the read, as plain functions.
- *
- * Separate from the MCP wiring so they can be exercised without a transport,
- * and so a consumer that wants them from a hook or a script is not made to
- * speak a protocol to get them.
- */
-declare function createSkillTools(options: SkillServerOptions): {
-    /**
-     * Grouped, and without bodies. The cheap overview and the search's miss
-     * path. Paged by package so a large catalog never arrives in one answer.
-     */
-    catalog(request?: {
-        page?: number;
-        pageSize?: number;
-        tier?: string;
-    }): CatalogResponse;
-    /** Ranked names. Returns; never loads a body. */
-    find(intent: string, limit?: number, filters?: SkillFilters): Promise<FindResult>;
-    /** Every property of one skill and the files it carries, without bodies. */
-    describe(name: string): {
-        name: string;
-        package: string;
-        description: string;
-        tier: string | undefined;
-        metadata: Readonly<Record<string, string | readonly string[]>>;
-        frontmatter: string;
-        files: {
-            path: string;
-            bytes: number;
-            sha256: string;
-        }[];
-        filesTruncated: boolean;
-    } | null;
-    /**
-     * One file inside a skill's directory. Paths that leave the directory,
-     * directly or through a link, are refused; nothing is ever executed.
-     */
-    read(name: string, path?: string): ReadResult;
-    /** One body, at the moment it is needed. */
-    call(name: string): CallResponse | null;
-    /** Drops the memoised catalog, so the next call re-reads the tree. */
-    refresh(): void;
-    entries: () => Omit<SkillEntry, "path">[];
-};
-type SkillTools = ReturnType<typeof createSkillTools>;
-
 /**
  * The five tools, spoken over MCP.
  *
@@ -356,4 +88,4 @@ declare function registerSkillTools(server: McpServer, tools: SkillTools): McpSe
  */
 declare function createSkillServer(options: SkillServerOptions): McpServer;
 
-export { CATALOG_PAGE_MAX, CATALOG_PAGE_SIZE, type CallResponse, type CatalogOptions, type CatalogResponse, DEFAULT_FIND_LIMIT, DEFAULT_INTENT_CACHE_LIMIT, DESCRIBE_FILE_LIMIT, type Embedder, type FindOptions, type FindResult, type IntentCache, type IntentCacheOptions, type IntentCacheStats, MAX_SKILL_DEPTH, type Match, type MetadataValue, READ_BUDGET_BYTES, type Ranking, type ReadResult, type Rejection, SERVER_NAME, SKIPPED_DIRS, type SkillEntry, type SkillFilters, type SkillServerOptions, type SkillTools, cosine, createSkillServer, createSkillTools, displayPath, find, lexicalScore, normaliseIntent, openIntentCache, readBody, readCatalog, readFrontmatter, readFrontmatterText, readMarketplace, readMetadata, registerSkillTools, withoutBody };
+export { DEFAULT_INTENT_CACHE_LIMIT, IntentCache, type IntentCacheOptions, type MetadataValue, type Rejection, SERVER_NAME, SkillEntry, SkillServerOptions, SkillTools, createSkillServer, openIntentCache, readFrontmatterText, readMarketplace, readMetadata, registerSkillTools };

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   DEFAULT_INTENT_CACHE_LIMIT,
   openIntentCache
-} from "./chunk-2NOO5RSP.js";
+} from "./chunk-RBT3ISF4.js";
 import {
   CATALOG_PAGE_MAX,
   CATALOG_PAGE_SIZE,
@@ -26,7 +26,7 @@ import {
   readMetadata,
   registerSkillTools,
   withoutBody
-} from "./chunk-3NNRQ5A4.js";
+} from "./chunk-BFET6MFN.js";
 export {
   CATALOG_PAGE_MAX,
   CATALOG_PAGE_SIZE,

package/dist/server-dNFrR_Zh.d.ts

@@ -0,0 +1,194 @@
+import { S as SkillEntry, C as CatalogOptions } from './catalog-BiPLcbLu.js';
+
+/**
+ * The intent key and the cache contract.
+ *
+ * Separate from the sqlite implementation so that ranking, which needs the key
+ * and the interface, does not pull a bun-only module into a consumer running
+ * under node. Only `cache.ts` requires bun.
+ */
+interface IntentCacheStats {
+    readonly hits: number;
+    readonly misses: number;
+    /** Rows found for the key but written by a different model. */
+    readonly mismatched: number;
+    readonly rows: number;
+    /** Which sqlite builtin answered, or absent when there is no cache. */
+    readonly provider?: string;
+}
+interface IntentCache {
+    /** The cached vector for an intent, or null when nothing usable is stored. */
+    get(intent: string): Float32Array | null;
+    put(intent: string, vector: Float32Array): void;
+    stats(): IntentCacheStats;
+    close(): void;
+}
+/**
+ * Same question, differently typed. Case, punctuation and spacing only — the
+ * key has to survive a caller writing "How do I wire X?" and "how do i wire x".
+ */
+declare function normaliseIntent(intent: string): string;
+
+/**
+ * Ranking an intent against skill descriptions.
+ *
+ * Semantic when an embedder is supplied, lexical otherwise, and the answer says
+ * which. A caller that cannot tell the two apart cannot tell a degraded server
+ * from a working one.
+ */
+
+type Ranking = "semantic" | "lexical";
+interface Match {
+    readonly name: string;
+    readonly package: string;
+    readonly description: string;
+    readonly score: number;
+}
+interface FindResult {
+    readonly ranking: Ranking;
+    readonly matches: readonly Match[];
+}
+/**
+ * The encoder, supplied by the caller. There is no default and no bundled
+ * model: which model runs decides what the scores mean, so it is the consuming
+ * repository's declaration rather than this package's.
+ */
+interface Embedder {
+    readonly modelId: string;
+    readonly dims: number;
+    embed(text: string): Promise<Float32Array>;
+}
+interface FindOptions {
+    readonly entries: readonly SkillEntry[];
+    readonly intent: string;
+    readonly limit?: number;
+    readonly embedder?: Embedder;
+    readonly cache?: IntentCache;
+    /** Precomputed description vectors, keyed by skill name. */
+    readonly vectors?: ReadonlyMap<string, Float32Array>;
+}
+declare const DEFAULT_FIND_LIMIT = 5;
+/**
+ * Token overlap and bigram Dice, averaged. Deterministic and dependency-free:
+ * this is the answer when there is no model, so it must never be the thing
+ * that fails.
+ */
+declare function lexicalScore(intent: string, description: string): number;
+/** Cosine over two equal-width vectors. Zero when either has no magnitude. */
+declare function cosine(a: Float32Array, b: Float32Array): number;
+/**
+ * Ranked matches, and which ranking produced them.
+ *
+ * Returns rather than loads: a search verb that also acts cannot be used to
+ * look, and the whole reason this server exists is that looking should be
+ * cheap.
+ */
+declare function find(options: FindOptions): Promise<FindResult>;
+
+/**
+ * The five tools, and nothing else.
+ *
+ * The point of the server is that a session's startup cost does not grow with
+ * the number of skills installed: the host lists five tools whatever the
+ * catalog holds, and a body is read only when one is asked for.
+ */
+
+/** Largest file skill_read returns. A skill needing more should split it. */
+declare const READ_BUDGET_BYTES: number;
+/** How many files skill_describe lists before saying the rest were cut. */
+declare const DESCRIBE_FILE_LIMIT = 200;
+declare const CATALOG_PAGE_SIZE = 8;
+declare const CATALOG_PAGE_MAX = 20;
+/** Equality filters over catalog fields. Unset keys match everything. */
+interface SkillFilters {
+    readonly tier?: string;
+    readonly package?: string;
+    readonly level?: string;
+    readonly domain?: string;
+    readonly medium?: string;
+}
+type ReadResult = {
+    readonly ok: true;
+    readonly name: string;
+    readonly path: string;
+    readonly bytes: number;
+    readonly sha256: string;
+    readonly text: string;
+} | {
+    readonly ok: false;
+    readonly error: string;
+    readonly detail: string;
+};
+interface SkillServerOptions extends CatalogOptions {
+    readonly embedder?: Embedder;
+    readonly cache?: IntentCache;
+    readonly vectors?: ReadonlyMap<string, Float32Array>;
+    /** Injected for tests. Reads the catalog off disk otherwise. */
+    readonly loadCatalog?: (options: CatalogOptions) => SkillEntry[];
+}
+interface CatalogResponse {
+    readonly count: number;
+    readonly page: number;
+    readonly totalPages: number;
+    readonly hasNext: boolean;
+    readonly packages: readonly {
+        readonly package: string;
+        readonly skills: readonly {
+            readonly name: string;
+            readonly description: string;
+            readonly tier?: string;
+        }[];
+    }[];
+}
+interface CallResponse {
+    readonly name: string;
+    readonly body: string;
+}
+/**
+ * The catalog, the search and the read, as plain functions.
+ *
+ * Separate from the MCP wiring so they can be exercised without a transport,
+ * and so a consumer that wants them from a hook or a script is not made to
+ * speak a protocol to get them.
+ */
+declare function createSkillTools(options: SkillServerOptions): {
+    /**
+     * Grouped, and without bodies. The cheap overview and the search's miss
+     * path. Paged by package so a large catalog never arrives in one answer.
+     */
+    catalog(request?: {
+        page?: number;
+        pageSize?: number;
+        tier?: string;
+    }): CatalogResponse;
+    /** Ranked names. Returns; never loads a body. */
+    find(intent: string, limit?: number, filters?: SkillFilters): Promise<FindResult>;
+    /** Every property of one skill and the files it carries, without bodies. */
+    describe(name: string): {
+        name: string;
+        package: string;
+        description: string;
+        tier: string | undefined;
+        metadata: Readonly<Record<string, string | readonly string[]>>;
+        frontmatter: string;
+        files: {
+            path: string;
+            bytes: number;
+            sha256: string;
+        }[];
+        filesTruncated: boolean;
+    } | null;
+    /**
+     * One file inside a skill's directory. Paths that leave the directory,
+     * directly or through a link, are refused; nothing is ever executed.
+     */
+    read(name: string, path?: string): ReadResult;
+    /** One body, at the moment it is needed. */
+    call(name: string): CallResponse | null;
+    /** Drops the memoised catalog, so the next call re-reads the tree. */
+    refresh(): void;
+    entries: () => Omit<SkillEntry, "path">[];
+};
+type SkillTools = ReturnType<typeof createSkillTools>;
+
+export { CATALOG_PAGE_MAX as C, DEFAULT_FIND_LIMIT as D, type Embedder as E, type FindOptions as F, type IntentCache as I, type Match as M, READ_BUDGET_BYTES as R, type SkillServerOptions as S, type SkillTools as a, CATALOG_PAGE_SIZE as b, type CallResponse as c, type CatalogResponse as d, DESCRIBE_FILE_LIMIT as e, type FindResult as f, type IntentCacheStats as g, type Ranking as h, type ReadResult as i, type SkillFilters as j, cosine as k, createSkillTools as l, find as m, lexicalScore as n, normaliseIntent as o };

package/dist/stdio.d.ts

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { C as CatalogOptions } from './catalog-BiPLcbLu.js';
+
 /**
  * The stdio entry a host launches.
  *
@@ -6,9 +8,10 @@
  * the dependency tree is its data source, and from an npx cache it is not a
  * sibling of the consumer's packages and would find no skills at all.
  */
+
 /** `node_modules` roots to walk, from argv or from the working directory. */
 declare function resolveRoots(argv: readonly string[], cwd: string): string[];
-declare function serve(roots: readonly string[], scopes?: readonly string[], marketplaces?: readonly string[]): void;
+declare function serve(catalog: CatalogOptions): void;
 declare function main(argv?: readonly string[]): void;
 
 export { main, resolveRoots, serve };

package/dist/stdio.js

@@ -3,8 +3,8 @@ import {
   main,
   resolveRoots,
   serve
-} from "./chunk-Y32X35YV.js";
-import "./chunk-3NNRQ5A4.js";
+} from "./chunk-JL5BCIQM.js";
+import "./chunk-BFET6MFN.js";
 export {
   main,
   resolveRoots,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modootoday/pmcp",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "license": "Elastic-2.0",
   "author": "modootoday",
   "description": "An MCP server that finds the skills your installed packages already ship. Reads SKILL.md out of node_modules by shape rather than by path, so it sees the skills, .agent, .claude, .gemini and .codex conventions alike, and keeps session startup flat as the number of installed skills grows.",
@@ -37,6 +37,10 @@
       "types": "./dist/stdio.d.ts",
       "import": "./dist/stdio.js"
     },
+    "./http": {
+      "types": "./dist/http.d.ts",
+      "import": "./dist/http.js"
+    },
     "./cli": {
       "types": "./dist/cli.d.ts",
       "import": "./dist/cli.js"