@modootoday/pmcp 0.3.0 → 0.4.0

package/README.md

@@ -62,6 +62,27 @@ within the discovery depth. A skill needs a frontmatter `description` for search
 `skill_find` accepts a problem description and returns matching skills.
 `skill_call` opens the selected document. Local MCP reading requires no login.
 
+## Hosting over HTTP
+
+`@modootoday/pmcp/http` serves the same five tools over streamable HTTP for a hosted catalog.
+The host owns identity: `authorize(request)` returns the caller or `undefined` (answered 401),
+and `tiersFor(caller)` decides which tiers that caller sees (default `open` and `free`; skills
+without a tier count as `open`). The catalog is read once; call `reload()` after deploying new
+skill releases.
+
+```ts
+import { createSkillHttpHandler } from "@modootoday/pmcp/http";
+
+const skills = createSkillHttpHandler({
+  roots: [],
+  marketplaces: ["/srv/marketplace", "/srv/marketplace-free"],
+  authorize: async (request) => verifyBearer(request.headers.get("authorization")),
+});
+export default { fetch: (request: Request) => skills.fetch(request) };
+```
+
+Put Origin and Host validation in front of it when it is mounted bare.
+
 ## Runtime and licence
 
 Node.js 22 or later, or Bun 1.3 or later. Default ranking is lexical. The optional

package/dist/{chunk-SPWHSHOC.js → chunk-BFET6MFN.js}

@@ -768,7 +768,7 @@ function registerSkillTools(server, tools) {
   return server;
 }
 function createSkillServer(options) {
-  const server = new McpServer({ name: SERVER_NAME, version: "0.3.0" });
+  const server = new McpServer({ name: SERVER_NAME, version: "0.4.0" });
   return registerSkillTools(server, createSkillTools(options));
 }
 
@@ -797,4 +797,4 @@ export {
   registerSkillTools,
   createSkillServer
 };
-//# sourceMappingURL=chunk-SPWHSHOC.js.map
+//# sourceMappingURL=chunk-BFET6MFN.js.map

package/dist/{chunk-QJS3NYLT.js → chunk-JL5BCIQM.js}

@@ -1,6 +1,6 @@
 import {
   createSkillServer
-} from "./chunk-SPWHSHOC.js";
+} from "./chunk-BFET6MFN.js";
 
 // src/stdio.ts
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
@@ -35,4 +35,4 @@ export {
   serve,
   main
 };
-//# sourceMappingURL=chunk-QJS3NYLT.js.map
+//# sourceMappingURL=chunk-JL5BCIQM.js.map

package/dist/{chunk-MBAXK4IZ.js → chunk-RBT3ISF4.js}

@@ -1,6 +1,6 @@
 import {
   normaliseIntent
-} from "./chunk-SPWHSHOC.js";
+} from "./chunk-BFET6MFN.js";
 
 // src/cache.ts
 async function openDatabase(path) {
@@ -131,4 +131,4 @@ export {
   DEFAULT_INTENT_CACHE_LIMIT,
   openIntentCache
 };
-//# sourceMappingURL=chunk-MBAXK4IZ.js.map
+//# sourceMappingURL=chunk-RBT3ISF4.js.map

package/dist/cli.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   openDatabase
-} from "./chunk-MBAXK4IZ.js";
+} from "./chunk-RBT3ISF4.js";
 import {
   serve
-} from "./chunk-QJS3NYLT.js";
+} from "./chunk-JL5BCIQM.js";
 import {
   readCatalog
-} from "./chunk-SPWHSHOC.js";
+} from "./chunk-BFET6MFN.js";
 
 // src/cli/command.ts
 var ArgumentError = class extends Error {
@@ -2085,7 +2085,7 @@ function dispatch(argv, options = {}) {
   }
   return run(command, rest, { ui, env, cwd });
 }
-var VERSION = "0.3.0";
+var VERSION = "0.4.0";
 async function run(command, argv, context) {
   try {
     return await command.run({

package/dist/http.d.ts

@@ -0,0 +1,34 @@
+import { S as SkillEntry } from './catalog-BiPLcbLu.js';
+import { S as SkillServerOptions } from './server-dNFrR_Zh.js';
+
+/**
+ * The catalog over streamable HTTP, for a hosted skills server.
+ *
+ * The host owns identity: it passes authorize(), which turns a request into a
+ * caller or undefined. Anonymous requests are refused; each caller sees only the
+ * tiers tiersFor() grants. The catalog is read once and filtered per request.
+ */
+
+interface SkillCaller {
+    /** Stable id of the signed-in user, recorded by the host, never by pmcp. */
+    readonly id: string;
+    /** Whatever the host's token carried; passed to tiersFor unchanged. */
+    readonly claims?: Readonly<Record<string, unknown>>;
+}
+interface SkillHttpOptions extends SkillServerOptions {
+    readonly authorize: (request: Request) => SkillCaller | undefined | Promise<SkillCaller | undefined>;
+    /** Tiers a caller may list and load. Package skills without a tier count as open. */
+    readonly tiersFor?: (caller: SkillCaller) => readonly string[];
+    /** Sent in WWW-Authenticate on a refused request, e.g. a resource metadata URL. */
+    readonly challenge?: string;
+}
+declare const DEFAULT_TIERS: readonly string[];
+declare function visibleTo(entries: readonly SkillEntry[], tiers: readonly string[]): SkillEntry[];
+interface SkillHttpHandler {
+    fetch(request: Request): Promise<Response>;
+    /** Re-read the catalog, for a host that deploys new skill releases in place. */
+    reload(): void;
+}
+declare function createSkillHttpHandler(options: SkillHttpOptions): SkillHttpHandler;
+
+export { DEFAULT_TIERS, type SkillCaller, type SkillHttpHandler, type SkillHttpOptions, createSkillHttpHandler, visibleTo };

package/dist/http.js

@@ -0,0 +1,65 @@
+import {
+  createSkillServer,
+  readCatalog
+} from "./chunk-BFET6MFN.js";
+
+// src/http.ts
+import {
+  createMcpHandler
+} from "@modelcontextprotocol/server";
+var DEFAULT_TIERS = ["open", "free"];
+function visibleTo(entries, tiers) {
+  const allowed = new Set(tiers);
+  return entries.filter((entry) => allowed.has(entry.tier ?? "open"));
+}
+function createSkillHttpHandler(options) {
+  const load = options.loadCatalog ?? readCatalog;
+  let all = load(options);
+  const tiersFor = options.tiersFor ?? (() => DEFAULT_TIERS);
+  const handlers = /* @__PURE__ */ new Map();
+  const handlerFor = (tiers) => {
+    const key = [...tiers].sort().join(",");
+    const cached = handlers.get(key);
+    if (cached) return cached;
+    const handler = createMcpHandler(
+      () => createSkillServer({
+        ...options,
+        loadCatalog: () => visibleTo(all, tiers)
+      })
+    );
+    handlers.set(key, handler);
+    return handler;
+  };
+  return {
+    async fetch(request) {
+      const caller = await options.authorize(request);
+      if (!caller) {
+        return new Response(JSON.stringify({ error: "unauthorized" }), {
+          status: 401,
+          headers: {
+            "content-type": "application/json",
+            "www-authenticate": options.challenge ?? "Bearer"
+          }
+        });
+      }
+      return handlerFor(tiersFor(caller)).fetch(request, {
+        authInfo: {
+          token: "",
+          clientId: caller.id,
+          scopes: [],
+          extra: { ...caller.claims }
+        }
+      });
+    },
+    reload() {
+      all = load(options);
+      handlers.clear();
+    }
+  };
+}
+export {
+  DEFAULT_TIERS,
+  createSkillHttpHandler,
+  visibleTo
+};
+//# sourceMappingURL=http.js.map

package/dist/index.d.ts

@@ -1,36 +1,9 @@
-import { S as SkillEntry, C as CatalogOptions } from './catalog-BiPLcbLu.js';
-export { M as MAX_SKILL_DEPTH, a as SKIPPED_DIRS, d as displayPath, r as readBody, b as readCatalog, c as readFrontmatter, w as withoutBody } from './catalog-BiPLcbLu.js';
+import { I as IntentCache, S as SkillServerOptions, a as SkillTools } from './server-dNFrR_Zh.js';
+export { C as CATALOG_PAGE_MAX, b as CATALOG_PAGE_SIZE, c as CallResponse, d as CatalogResponse, D as DEFAULT_FIND_LIMIT, e as DESCRIBE_FILE_LIMIT, E as Embedder, F as FindOptions, f as FindResult, g as IntentCacheStats, M as Match, R as READ_BUDGET_BYTES, h as Ranking, i as ReadResult, j as SkillFilters, k as cosine, l as createSkillTools, m as find, n as lexicalScore, o as normaliseIntent } from './server-dNFrR_Zh.js';
+import { S as SkillEntry } from './catalog-BiPLcbLu.js';
+export { C as CatalogOptions, M as MAX_SKILL_DEPTH, a as SKIPPED_DIRS, d as displayPath, r as readBody, b as readCatalog, c as readFrontmatter, w as withoutBody } from './catalog-BiPLcbLu.js';
 import { McpServer } from '@modelcontextprotocol/server';
 
-/**
- * The intent key and the cache contract.
- *
- * Separate from the sqlite implementation so that ranking, which needs the key
- * and the interface, does not pull a bun-only module into a consumer running
- * under node. Only `cache.ts` requires bun.
- */
-interface IntentCacheStats {
-    readonly hits: number;
-    readonly misses: number;
-    /** Rows found for the key but written by a different model. */
-    readonly mismatched: number;
-    readonly rows: number;
-    /** Which sqlite builtin answered, or absent when there is no cache. */
-    readonly provider?: string;
-}
-interface IntentCache {
-    /** The cached vector for an intent, or null when nothing usable is stored. */
-    get(intent: string): Float32Array | null;
-    put(intent: string, vector: Float32Array): void;
-    stats(): IntentCacheStats;
-    close(): void;
-}
-/**
- * Same question, differently typed. Case, punctuation and spacing only — the
- * key has to survive a caller writing "How do I wire X?" and "how do i wire x".
- */
-declare function normaliseIntent(intent: string): string;
-
 /**
  * Query vectors, kept on disk between sessions.
  *
@@ -63,62 +36,6 @@ declare const DEFAULT_INTENT_CACHE_LIMIT = 4096;
  */
 declare function openIntentCache(options: IntentCacheOptions): Promise<IntentCache | null>;
 
-/**
- * Ranking an intent against skill descriptions.
- *
- * Semantic when an embedder is supplied, lexical otherwise, and the answer says
- * which. A caller that cannot tell the two apart cannot tell a degraded server
- * from a working one.
- */
-
-type Ranking = "semantic" | "lexical";
-interface Match {
-    readonly name: string;
-    readonly package: string;
-    readonly description: string;
-    readonly score: number;
-}
-interface FindResult {
-    readonly ranking: Ranking;
-    readonly matches: readonly Match[];
-}
-/**
- * The encoder, supplied by the caller. There is no default and no bundled
- * model: which model runs decides what the scores mean, so it is the consuming
- * repository's declaration rather than this package's.
- */
-interface Embedder {
-    readonly modelId: string;
-    readonly dims: number;
-    embed(text: string): Promise<Float32Array>;
-}
-interface FindOptions {
-    readonly entries: readonly SkillEntry[];
-    readonly intent: string;
-    readonly limit?: number;
-    readonly embedder?: Embedder;
-    readonly cache?: IntentCache;
-    /** Precomputed description vectors, keyed by skill name. */
-    readonly vectors?: ReadonlyMap<string, Float32Array>;
-}
-declare const DEFAULT_FIND_LIMIT = 5;
-/**
- * Token overlap and bigram Dice, averaged. Deterministic and dependency-free:
- * this is the answer when there is no model, so it must never be the thing
- * that fails.
- */
-declare function lexicalScore(intent: string, description: string): number;
-/** Cosine over two equal-width vectors. Zero when either has no magnitude. */
-declare function cosine(a: Float32Array, b: Float32Array): number;
-/**
- * Ranked matches, and which ranking produced them.
- *
- * Returns rather than loads: a search verb that also acts cannot be used to
- * look, and the whole reason this server exists is that looking should be
- * cheap.
- */
-declare function find(options: FindOptions): Promise<FindResult>;
-
 /**
  * Skills laid out as an agent plugin marketplace: a directory holding
  * `.claude-plugin/marketplace.json`, whose plugins keep skills at
@@ -145,112 +62,6 @@ declare function readFrontmatterText(source: string): string;
  */
 declare function readMarketplace(dir: string, onReject?: (rejection: Rejection) => void): SkillEntry[];
 
-/**
- * The five tools, and nothing else.
- *
- * The point of the server is that a session's startup cost does not grow with
- * the number of skills installed: the host lists five tools whatever the
- * catalog holds, and a body is read only when one is asked for.
- */
-
-/** Largest file skill_read returns. A skill needing more should split it. */
-declare const READ_BUDGET_BYTES: number;
-/** How many files skill_describe lists before saying the rest were cut. */
-declare const DESCRIBE_FILE_LIMIT = 200;
-declare const CATALOG_PAGE_SIZE = 8;
-declare const CATALOG_PAGE_MAX = 20;
-/** Equality filters over catalog fields. Unset keys match everything. */
-interface SkillFilters {
-    readonly tier?: string;
-    readonly package?: string;
-    readonly level?: string;
-    readonly domain?: string;
-    readonly medium?: string;
-}
-type ReadResult = {
-    readonly ok: true;
-    readonly name: string;
-    readonly path: string;
-    readonly bytes: number;
-    readonly sha256: string;
-    readonly text: string;
-} | {
-    readonly ok: false;
-    readonly error: string;
-    readonly detail: string;
-};
-interface SkillServerOptions extends CatalogOptions {
-    readonly embedder?: Embedder;
-    readonly cache?: IntentCache;
-    readonly vectors?: ReadonlyMap<string, Float32Array>;
-    /** Injected for tests. Reads the catalog off disk otherwise. */
-    readonly loadCatalog?: (options: CatalogOptions) => SkillEntry[];
-}
-interface CatalogResponse {
-    readonly count: number;
-    readonly page: number;
-    readonly totalPages: number;
-    readonly hasNext: boolean;
-    readonly packages: readonly {
-        readonly package: string;
-        readonly skills: readonly {
-            readonly name: string;
-            readonly description: string;
-            readonly tier?: string;
-        }[];
-    }[];
-}
-interface CallResponse {
-    readonly name: string;
-    readonly body: string;
-}
-/**
- * The catalog, the search and the read, as plain functions.
- *
- * Separate from the MCP wiring so they can be exercised without a transport,
- * and so a consumer that wants them from a hook or a script is not made to
- * speak a protocol to get them.
- */
-declare function createSkillTools(options: SkillServerOptions): {
-    /**
-     * Grouped, and without bodies. The cheap overview and the search's miss
-     * path. Paged by package so a large catalog never arrives in one answer.
-     */
-    catalog(request?: {
-        page?: number;
-        pageSize?: number;
-        tier?: string;
-    }): CatalogResponse;
-    /** Ranked names. Returns; never loads a body. */
-    find(intent: string, limit?: number, filters?: SkillFilters): Promise<FindResult>;
-    /** Every property of one skill and the files it carries, without bodies. */
-    describe(name: string): {
-        name: string;
-        package: string;
-        description: string;
-        tier: string | undefined;
-        metadata: Readonly<Record<string, string | readonly string[]>>;
-        frontmatter: string;
-        files: {
-            path: string;
-            bytes: number;
-            sha256: string;
-        }[];
-        filesTruncated: boolean;
-    } | null;
-    /**
-     * One file inside a skill's directory. Paths that leave the directory,
-     * directly or through a link, are refused; nothing is ever executed.
-     */
-    read(name: string, path?: string): ReadResult;
-    /** One body, at the moment it is needed. */
-    call(name: string): CallResponse | null;
-    /** Drops the memoised catalog, so the next call re-reads the tree. */
-    refresh(): void;
-    entries: () => Omit<SkillEntry, "path">[];
-};
-type SkillTools = ReturnType<typeof createSkillTools>;
-
 /**
  * The five tools, spoken over MCP.
  *
@@ -277,4 +88,4 @@ declare function registerSkillTools(server: McpServer, tools: SkillTools): McpSe
  */
 declare function createSkillServer(options: SkillServerOptions): McpServer;
 
-export { CATALOG_PAGE_MAX, CATALOG_PAGE_SIZE, type CallResponse, CatalogOptions, type CatalogResponse, DEFAULT_FIND_LIMIT, DEFAULT_INTENT_CACHE_LIMIT, DESCRIBE_FILE_LIMIT, type Embedder, type FindOptions, type FindResult, type IntentCache, type IntentCacheOptions, type IntentCacheStats, type Match, type MetadataValue, READ_BUDGET_BYTES, type Ranking, type ReadResult, type Rejection, SERVER_NAME, SkillEntry, type SkillFilters, type SkillServerOptions, type SkillTools, cosine, createSkillServer, createSkillTools, find, lexicalScore, normaliseIntent, openIntentCache, readFrontmatterText, readMarketplace, readMetadata, registerSkillTools };
+export { DEFAULT_INTENT_CACHE_LIMIT, IntentCache, type IntentCacheOptions, type MetadataValue, type Rejection, SERVER_NAME, SkillEntry, SkillServerOptions, SkillTools, createSkillServer, openIntentCache, readFrontmatterText, readMarketplace, readMetadata, registerSkillTools };

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   DEFAULT_INTENT_CACHE_LIMIT,
   openIntentCache
-} from "./chunk-MBAXK4IZ.js";
+} from "./chunk-RBT3ISF4.js";
 import {
   CATALOG_PAGE_MAX,
   CATALOG_PAGE_SIZE,
@@ -26,7 +26,7 @@ import {
   readMetadata,
   registerSkillTools,
   withoutBody
-} from "./chunk-SPWHSHOC.js";
+} from "./chunk-BFET6MFN.js";
 export {
   CATALOG_PAGE_MAX,
   CATALOG_PAGE_SIZE,

package/dist/server-dNFrR_Zh.d.ts

@@ -0,0 +1,194 @@
+import { S as SkillEntry, C as CatalogOptions } from './catalog-BiPLcbLu.js';
+
+/**
+ * The intent key and the cache contract.
+ *
+ * Separate from the sqlite implementation so that ranking, which needs the key
+ * and the interface, does not pull a bun-only module into a consumer running
+ * under node. Only `cache.ts` requires bun.
+ */
+interface IntentCacheStats {
+    readonly hits: number;
+    readonly misses: number;
+    /** Rows found for the key but written by a different model. */
+    readonly mismatched: number;
+    readonly rows: number;
+    /** Which sqlite builtin answered, or absent when there is no cache. */
+    readonly provider?: string;
+}
+interface IntentCache {
+    /** The cached vector for an intent, or null when nothing usable is stored. */
+    get(intent: string): Float32Array | null;
+    put(intent: string, vector: Float32Array): void;
+    stats(): IntentCacheStats;
+    close(): void;
+}
+/**
+ * Same question, differently typed. Case, punctuation and spacing only — the
+ * key has to survive a caller writing "How do I wire X?" and "how do i wire x".
+ */
+declare function normaliseIntent(intent: string): string;
+
+/**
+ * Ranking an intent against skill descriptions.
+ *
+ * Semantic when an embedder is supplied, lexical otherwise, and the answer says
+ * which. A caller that cannot tell the two apart cannot tell a degraded server
+ * from a working one.
+ */
+
+type Ranking = "semantic" | "lexical";
+interface Match {
+    readonly name: string;
+    readonly package: string;
+    readonly description: string;
+    readonly score: number;
+}
+interface FindResult {
+    readonly ranking: Ranking;
+    readonly matches: readonly Match[];
+}
+/**
+ * The encoder, supplied by the caller. There is no default and no bundled
+ * model: which model runs decides what the scores mean, so it is the consuming
+ * repository's declaration rather than this package's.
+ */
+interface Embedder {
+    readonly modelId: string;
+    readonly dims: number;
+    embed(text: string): Promise<Float32Array>;
+}
+interface FindOptions {
+    readonly entries: readonly SkillEntry[];
+    readonly intent: string;
+    readonly limit?: number;
+    readonly embedder?: Embedder;
+    readonly cache?: IntentCache;
+    /** Precomputed description vectors, keyed by skill name. */
+    readonly vectors?: ReadonlyMap<string, Float32Array>;
+}
+declare const DEFAULT_FIND_LIMIT = 5;
+/**
+ * Token overlap and bigram Dice, averaged. Deterministic and dependency-free:
+ * this is the answer when there is no model, so it must never be the thing
+ * that fails.
+ */
+declare function lexicalScore(intent: string, description: string): number;
+/** Cosine over two equal-width vectors. Zero when either has no magnitude. */
+declare function cosine(a: Float32Array, b: Float32Array): number;
+/**
+ * Ranked matches, and which ranking produced them.
+ *
+ * Returns rather than loads: a search verb that also acts cannot be used to
+ * look, and the whole reason this server exists is that looking should be
+ * cheap.
+ */
+declare function find(options: FindOptions): Promise<FindResult>;
+
+/**
+ * The five tools, and nothing else.
+ *
+ * The point of the server is that a session's startup cost does not grow with
+ * the number of skills installed: the host lists five tools whatever the
+ * catalog holds, and a body is read only when one is asked for.
+ */
+
+/** Largest file skill_read returns. A skill needing more should split it. */
+declare const READ_BUDGET_BYTES: number;
+/** How many files skill_describe lists before saying the rest were cut. */
+declare const DESCRIBE_FILE_LIMIT = 200;
+declare const CATALOG_PAGE_SIZE = 8;
+declare const CATALOG_PAGE_MAX = 20;
+/** Equality filters over catalog fields. Unset keys match everything. */
+interface SkillFilters {
+    readonly tier?: string;
+    readonly package?: string;
+    readonly level?: string;
+    readonly domain?: string;
+    readonly medium?: string;
+}
+type ReadResult = {
+    readonly ok: true;
+    readonly name: string;
+    readonly path: string;
+    readonly bytes: number;
+    readonly sha256: string;
+    readonly text: string;
+} | {
+    readonly ok: false;
+    readonly error: string;
+    readonly detail: string;
+};
+interface SkillServerOptions extends CatalogOptions {
+    readonly embedder?: Embedder;
+    readonly cache?: IntentCache;
+    readonly vectors?: ReadonlyMap<string, Float32Array>;
+    /** Injected for tests. Reads the catalog off disk otherwise. */
+    readonly loadCatalog?: (options: CatalogOptions) => SkillEntry[];
+}
+interface CatalogResponse {
+    readonly count: number;
+    readonly page: number;
+    readonly totalPages: number;
+    readonly hasNext: boolean;
+    readonly packages: readonly {
+        readonly package: string;
+        readonly skills: readonly {
+            readonly name: string;
+            readonly description: string;
+            readonly tier?: string;
+        }[];
+    }[];
+}
+interface CallResponse {
+    readonly name: string;
+    readonly body: string;
+}
+/**
+ * The catalog, the search and the read, as plain functions.
+ *
+ * Separate from the MCP wiring so they can be exercised without a transport,
+ * and so a consumer that wants them from a hook or a script is not made to
+ * speak a protocol to get them.
+ */
+declare function createSkillTools(options: SkillServerOptions): {
+    /**
+     * Grouped, and without bodies. The cheap overview and the search's miss
+     * path. Paged by package so a large catalog never arrives in one answer.
+     */
+    catalog(request?: {
+        page?: number;
+        pageSize?: number;
+        tier?: string;
+    }): CatalogResponse;
+    /** Ranked names. Returns; never loads a body. */
+    find(intent: string, limit?: number, filters?: SkillFilters): Promise<FindResult>;
+    /** Every property of one skill and the files it carries, without bodies. */
+    describe(name: string): {
+        name: string;
+        package: string;
+        description: string;
+        tier: string | undefined;
+        metadata: Readonly<Record<string, string | readonly string[]>>;
+        frontmatter: string;
+        files: {
+            path: string;
+            bytes: number;
+            sha256: string;
+        }[];
+        filesTruncated: boolean;
+    } | null;
+    /**
+     * One file inside a skill's directory. Paths that leave the directory,
+     * directly or through a link, are refused; nothing is ever executed.
+     */
+    read(name: string, path?: string): ReadResult;
+    /** One body, at the moment it is needed. */
+    call(name: string): CallResponse | null;
+    /** Drops the memoised catalog, so the next call re-reads the tree. */
+    refresh(): void;
+    entries: () => Omit<SkillEntry, "path">[];
+};
+type SkillTools = ReturnType<typeof createSkillTools>;
+
+export { CATALOG_PAGE_MAX as C, DEFAULT_FIND_LIMIT as D, type Embedder as E, type FindOptions as F, type IntentCache as I, type Match as M, READ_BUDGET_BYTES as R, type SkillServerOptions as S, type SkillTools as a, CATALOG_PAGE_SIZE as b, type CallResponse as c, type CatalogResponse as d, DESCRIBE_FILE_LIMIT as e, type FindResult as f, type IntentCacheStats as g, type Ranking as h, type ReadResult as i, type SkillFilters as j, cosine as k, createSkillTools as l, find as m, lexicalScore as n, normaliseIntent as o };

package/dist/stdio.js

@@ -3,8 +3,8 @@ import {
   main,
   resolveRoots,
   serve
-} from "./chunk-QJS3NYLT.js";
-import "./chunk-SPWHSHOC.js";
+} from "./chunk-JL5BCIQM.js";
+import "./chunk-BFET6MFN.js";
 export {
   main,
   resolveRoots,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modootoday/pmcp",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "license": "Elastic-2.0",
   "author": "modootoday",
   "description": "An MCP server that finds the skills your installed packages already ship. Reads SKILL.md out of node_modules by shape rather than by path, so it sees the skills, .agent, .claude, .gemini and .codex conventions alike, and keeps session startup flat as the number of installed skills grows.",
@@ -37,6 +37,10 @@
       "types": "./dist/stdio.d.ts",
       "import": "./dist/stdio.js"
     },
+    "./http": {
+      "types": "./dist/http.d.ts",
+      "import": "./dist/http.js"
+    },
     "./cli": {
       "types": "./dist/cli.d.ts",
       "import": "./dist/cli.js"