@plitzi/sdk-server 0.32.25 → 0.33.0

package/dist/modules/oauth/register.js

@@ -1,55 +0,0 @@
-import { randomId } from "./pkce.js";
-import { getClientByFingerprint, putClient, putClientFingerprint } from "./records.js";
-import { sendErrorJson, sendJson } from "./respond.js";
-import { createHash } from "node:crypto";
-//#region src/modules/oauth/register.ts
-var isUsableRedirectUri = (value) => {
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		return false;
-	}
-	if (url.protocol === "https:") return true;
-	return url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1");
-};
-var stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-var nowSeconds = () => Math.floor(Date.now() / 1e3);
-var fingerprintOf = (clientName, redirectUris) => createHash("sha256").update(JSON.stringify([clientName, [...redirectUris].sort()])).digest("base64url");
-/** RFC 7591 dynamic client registration. A remote host has no way to be configured into this server ahead of
-*  time, so it registers itself on first connect; the record it gets back is only ever used to pin the redirect
-*  target, since a public client authenticates with PKCE rather than with credentials. */
-var handleRegister = async (config, res, body) => {
-	if (typeof body !== "object" || body === null) {
-		sendErrorJson(res, 400, "invalid_request", "Expected a JSON client metadata object.");
-		return;
-	}
-	const metadata = body;
-	const redirectUris = stringList(metadata["redirect_uris"]).filter(isUsableRedirectUri);
-	if (redirectUris.length === 0) {
-		sendErrorJson(res, 400, "invalid_request", "redirect_uris must list at least one https (or loopback) URI.");
-		return;
-	}
-	const clientName = typeof metadata["client_name"] === "string" ? metadata["client_name"] : "MCP client";
-	const { store } = config.adapters;
-	const fingerprint = fingerprintOf(clientName, redirectUris);
-	const client = await getClientByFingerprint(store, fingerprint) ?? {
-		clientId: randomId(),
-		clientName,
-		redirectUris,
-		issuedAt: nowSeconds()
-	};
-	await putClient(store, client);
-	await putClientFingerprint(store, fingerprint, client.clientId);
-	sendJson(res, 201, {
-		client_id: client.clientId,
-		client_id_issued_at: client.issuedAt,
-		client_name: clientName,
-		redirect_uris: redirectUris,
-		grant_types: config.refreshTtlSeconds === 0 ? ["authorization_code"] : ["authorization_code", "refresh_token"],
-		response_types: ["code"],
-		token_endpoint_auth_method: "none"
-	});
-};
-//#endregion
-export { handleRegister };

package/dist/modules/oauth/respond.js

@@ -1,44 +0,0 @@
-import { renderErrorPage } from "./consentPage.js";
-//#region src/modules/oauth/respond.ts
-var sendJson = (res, status, body) => {
-	res.setStatus(status);
-	res.setHeader("Content-Type", "application/json");
-	res.setHeader("Cache-Control", "no-store, no-transform");
-	res.send(JSON.stringify(body));
-};
-var sendHtml = (res, status, html) => {
-	res.setStatus(status);
-	res.setHeader("Content-Type", "text/html; charset=utf-8");
-	res.setHeader("Cache-Control", "no-store, no-transform");
-	res.send(html);
-};
-var sendErrorJson = (res, status, error, description) => sendJson(res, status, {
-	error,
-	error_description: description
-});
-/** Shown when the authorization request itself is unusable — an unknown client, a `redirect_uri` that is not
-*  registered. Redirecting those back would turn the endpoint into an open redirector. */
-var sendErrorPage = (res, title, detail) => sendHtml(res, 400, renderErrorPage(title, detail));
-/** The other half of RFC 6749 error handling: once the redirect target is known to be legitimate, failures go
-*  back to the client so the host can report them, carrying `state` so it can match the response to its request. */
-var redirectWithError = (res, redirectUri, error, description, state) => {
-	const url = new URL(redirectUri);
-	url.searchParams.set("error", error);
-	url.searchParams.set("error_description", description);
-	if (state !== void 0) url.searchParams.set("state", state);
-	res.setStatus(302);
-	res.setHeader("Location", url.toString());
-	res.setHeader("Cache-Control", "no-store, no-transform");
-	res.end();
-};
-var redirectWithCode = (res, redirectUri, code, state) => {
-	const url = new URL(redirectUri);
-	url.searchParams.set("code", code);
-	if (state !== void 0) url.searchParams.set("state", state);
-	res.setStatus(302);
-	res.setHeader("Location", url.toString());
-	res.setHeader("Cache-Control", "no-store, no-transform");
-	res.end();
-};
-//#endregion
-export { redirectWithCode, redirectWithError, sendErrorJson, sendErrorPage, sendHtml, sendJson };

package/dist/modules/oauth/token.js

@@ -1,100 +0,0 @@
-import { scopesOf } from "./metadata.js";
-import { field, optionalField } from "./params.js";
-import { randomId, verifyChallenge } from "./pkce.js";
-import { dropCode, dropRefresh, getCode, getRefresh, putAccess, putRefresh } from "./records.js";
-import { sendErrorJson, sendJson } from "./respond.js";
-//#region src/modules/oauth/token.ts
-var DEFAULT_REFRESH_TTL_SECONDS = 2592e3;
-var DEFAULT_ACCESS_TTL_SECONDS = 2592e3;
-var refreshTtlOf = (config) => config.refreshTtlSeconds ?? DEFAULT_REFRESH_TTL_SECONDS;
-var scopeOf = (config, requested) => requested ?? scopesOf(config).join(" ");
-/** The token response, plus a rotated refresh grant when refresh is enabled. Rotation is unconditional: a refresh
-*  token is a long-lived credential, so the one just used never stays valid. */
-var sendTokens = async (config, res, credential, expiresInSeconds, grant) => {
-	const ttl = refreshTtlOf(config);
-	const bearer = randomId();
-	await putAccess(config.adapters.store, bearer, {
-		credential,
-		clientId: grant.clientId,
-		user: grant.user,
-		target: grant.target
-	}, Math.max(expiresInSeconds ?? DEFAULT_ACCESS_TTL_SECONDS, 1));
-	const body = {
-		access_token: bearer,
-		token_type: "Bearer",
-		scope: scopeOf(config, grant.scope)
-	};
-	if (expiresInSeconds !== void 0) body["expires_in"] = expiresInSeconds;
-	if (ttl > 0) {
-		const refreshToken = randomId();
-		await putRefresh(config.adapters.store, refreshToken, grant, ttl);
-		body["refresh_token"] = refreshToken;
-	}
-	sendJson(res, 200, body);
-};
-var exchangeCode = async (config, res, params) => {
-	const code = field(params, "code");
-	const record = code ? await getCode(config.adapters.store, code) : void 0;
-	if (!record) {
-		sendErrorJson(res, 400, "invalid_grant", "The authorization code is unknown or has expired.");
-		return;
-	}
-	await dropCode(config.adapters.store, code);
-	if (record.clientId !== field(params, "client_id")) {
-		sendErrorJson(res, 400, "invalid_grant", "The authorization code was issued to another client.");
-		return;
-	}
-	const redirectUri = optionalField(params, "redirect_uri");
-	if (redirectUri !== void 0 && redirectUri !== record.redirectUri) {
-		sendErrorJson(res, 400, "invalid_grant", "redirect_uri does not match the authorization request.");
-		return;
-	}
-	if (!verifyChallenge(field(params, "code_verifier"), record.challenge)) {
-		sendErrorJson(res, 400, "invalid_grant", "The PKCE code verifier does not match the challenge.");
-		return;
-	}
-	await sendTokens(config, res, record.token, record.expiresInSeconds, {
-		clientId: record.clientId,
-		scope: record.scope,
-		user: record.user,
-		target: record.target
-	});
-};
-var exchangeRefresh = async (config, res, params) => {
-	if (refreshTtlOf(config) === 0) {
-		sendErrorJson(res, 400, "unsupported_grant_type", "This server issues no refresh tokens.");
-		return;
-	}
-	const refreshToken = field(params, "refresh_token");
-	const record = refreshToken ? await getRefresh(config.adapters.store, refreshToken) : void 0;
-	if (!record) {
-		sendErrorJson(res, 400, "invalid_grant", "The refresh token is unknown or has expired.");
-		return;
-	}
-	await dropRefresh(config.adapters.store, refreshToken);
-	if (record.clientId !== field(params, "client_id")) {
-		sendErrorJson(res, 400, "invalid_grant", "The refresh token was issued to another client.");
-		return;
-	}
-	const issued = await config.adapters.issueToken(record.user, record.target);
-	if (!issued) {
-		sendErrorJson(res, 400, "invalid_grant", "The account no longer has access to this resource.");
-		return;
-	}
-	await sendTokens(config, res, issued.token, issued.expiresInSeconds, record);
-};
-/** POST /token. Public clients only, so there is no client authentication to check — PKCE is what proves the
-*  caller is the one that started the flow. */
-var handleToken = async (config, res, params) => {
-	switch (field(params, "grant_type")) {
-		case "authorization_code":
-			await exchangeCode(config, res, params);
-			return;
-		case "refresh_token":
-			await exchangeRefresh(config, res, params);
-			return;
-		default: sendErrorJson(res, 400, "unsupported_grant_type", "Supported grants: authorization_code, refresh_token.");
-	}
-};
-//#endregion
-export { handleToken };

package/dist/src/adapters/jsonAdapters.d.ts

@@ -1,7 +0,0 @@
-import { SSRAdapters, SSRRequest, SSRSpaceDeployment, SSRUser } from '@plitzi/sdk-shared';
-export type JsonAdaptersConfig = {
-    offlineData: string | ((spaceId: number, environment: string, revision?: number) => string);
-    deployment?: string | SSRSpaceDeployment | Record<string, SSRSpaceDeployment>;
-    user?: SSRUser | ((req: SSRRequest) => SSRUser | undefined | Promise<SSRUser | undefined>);
-};
-export declare const createJsonAdapters: (config: JsonAdaptersConfig) => SSRAdapters;

package/dist/src/core/createServer.d.ts

@@ -1,14 +0,0 @@
-import { SSRServer, SSRServerConfig } from '@plitzi/sdk-shared';
-export { createSSRServer } from './server/pageServer';
-export { createMCPServer } from './server/mcpServer';
-export { resolveServices } from './services/resolve';
-export type { ResolvedServices } from './services/resolve';
-/** The general server: mounts whatever the config asks for — SSR, RSC and MCP together, if that is what it
- *  enables — and is what a deployment reaches for when it serves more than one surface from a single port (the
- *  package's own standalone harness does exactly that).
- *
- *  Prefer the surface-specific factories whenever the surface IS known, so the process states what it serves by
- *  the name it calls: createSSRServer for pages + RSC, createMCPServer for a dedicated MCP server. An MCP-only
- *  config is handed to the latter here, since the lean pipeline builds none of the render template, caches or
- *  plugin manager a page server would carry unused. */
-export declare const createServer: (config: SSRServerConfig) => SSRServer;

package/dist/src/core/http/stages/health.d.ts

@@ -1,2 +0,0 @@
-import { Stage } from '../types';
-export declare const healthStage: Stage;

package/dist/src/core/http/stages/middlewares.d.ts

@@ -1,2 +0,0 @@
-import { Stage } from '../types';
-export declare const middlewaresStage: Stage;

package/dist/src/core/http/stages/static.d.ts

@@ -1,5 +0,0 @@
-import { Stage } from '../types';
-export declare const builtinPublicStage: Stage;
-export declare const publicDirStage: Stage;
-export declare const wellKnownStage: Stage;
-export declare const configStaticStage: Stage;

package/dist/src/core/http/types.d.ts

@@ -1,22 +0,0 @@
-import { RawResponse } from '../../helpers/buildResponseHelpers';
-import { ServerCaches } from '../../helpers/cache';
-import { PluginManager } from '../../plugins/manager';
-import { SSRRequest, SSRResponseHelpers, SSRServerConfig, SSRTemplateFn } from '@plitzi/sdk-shared';
-import { IncomingMessage } from 'node:http';
-export interface BaseContext {
-    raw: IncomingMessage;
-    rawRes: RawResponse;
-    req: SSRRequest;
-    res: SSRResponseHelpers;
-    config: SSRServerConfig;
-    port: number;
-    /** Set by the stage that answers when the path alone does not identify the work (the MCP endpoint serves every
-     *  JSON-RPC method on the same URL). The dispatcher folds it into the access log. */
-    operation?: string;
-}
-export interface SSRContext extends BaseContext {
-    renderFn: SSRTemplateFn;
-    caches: ServerCaches;
-    pluginManager: PluginManager;
-}
-export type Stage<C extends BaseContext = BaseContext> = (ctx: C) => boolean | Promise<boolean>;

package/dist/src/core/server/mcpServer.d.ts

@@ -1,2 +0,0 @@
-import { SSRServer, SSRServerConfig } from '@plitzi/sdk-shared';
-export declare const createMCPServer: (config: SSRServerConfig) => SSRServer;

package/dist/src/core/server/pageServer.d.ts

@@ -1,10 +0,0 @@
-import { ResolvedServices } from '../services/resolve';
-import { SSRServer, SSRServerConfig } from '@plitzi/sdk-shared';
-/** The page-serving machinery: html/rsc caches, the render template and the plugin manager, driving the page
- *  pipeline. Which services it mounts is the CALLER's decision — {@link createServer} passes whatever the config
- *  enables, createSSRServer pins the page surface — so this unit never second-guesses a factory's promise. */
-export declare const createPageServer: (config: SSRServerConfig, services: ResolvedServices) => SSRServer;
-/** The page server: SSR and RSC, and nothing else. MCP is pinned OFF here even when the config asks for it —
- *  what a factory named after a surface mounts must be readable from its name alone. A deployment that wants
- *  both surfaces in one process asks {@link createServer} for them; a dedicated MCP server is createMCPServer. */
-export declare const createSSRServer: (config: SSRServerConfig) => SSRServer;

package/dist/src/core/services/mcp.d.ts

@@ -1,3 +0,0 @@
-import { Stage } from '../http/types';
-export declare const mcpStage: Stage;
-export declare const mcpOnlyStage: Stage;

package/dist/src/core/services/oauth.d.ts

@@ -1,18 +0,0 @@
-import { Stage } from '../http/types';
-/** OAuth 2.1 authorization for the MCP server, mounted ONLY when a deployment configures `oauth`. Without it the
- *  stage falls straight through and the server keeps its anonymous contract: discovery 404s, the public surface
- *  (handshake, listings, the guide, plitzi_render) answers without a token, and nothing below changes.
- *
- *  It sits before the MCP stage because that one answers every path on a dedicated MCP server — these endpoints
- *  would otherwise be swallowed by the JSON-RPC transport, which is exactly the 406 a host hits on /register. */
-export declare const oauthStage: Stage;
-/** The protected-resource half of OAuth: an MCP call that presents no bearer this server can verify is refused
- *  with RFC 6750's challenge instead of being served the anonymous surface. That 401 is the whole handshake — it
- *  is how a host learns the server needs authorization, where its metadata lives and which scopes to ask for, and
- *  a 200 tells it none of that. Only the JSON-RPC POST is guarded: the CORS preflight, the GET 405 and the
- *  discovery probes carry no credential and must keep answering as they do.
- *
- *  Mounted only when `oauth` is configured. A deployment that configures none keeps the open server it had, where
- *  the whole public surface — handshake, listings, the guide, plitzi_render — answers without a token; with OAuth
- *  on, the grant that carries no space is what covers that same ground. */
-export declare const oauthGuardStage: Stage;

package/dist/src/core/services/preview.d.ts

@@ -1,2 +0,0 @@
-import { SSRContext, Stage } from '../http/types';
-export declare const previewStage: Stage<SSRContext>;

package/dist/src/core/services/proxy.d.ts

@@ -1,2 +0,0 @@
-import { Stage } from '../http/types';
-export declare const widgetProxyStage: Stage;

package/dist/src/core/services/registry.d.ts

@@ -1,4 +0,0 @@
-import { ResolvedServices } from './resolve';
-import { BaseContext, SSRContext, Stage } from '../http/types';
-export declare const buildPagePipeline: (services: ResolvedServices) => Stage<SSRContext>[];
-export declare const buildMCPPipeline: () => Stage<BaseContext>[];

package/dist/src/helpers/buildServerInfo.d.ts

@@ -1,2 +0,0 @@
-import { Server, SSRRequest, SSRServerConfig } from '@plitzi/sdk-shared';
-export declare const buildServerInfo: (req: SSRRequest, config: SSRServerConfig) => Promise<Partial<Server>>;

package/dist/src/helpers/compress.d.ts

@@ -1,3 +0,0 @@
-export type ContentEncoding = 'br' | 'gzip' | 'identity';
-export declare const selectEncoding: (acceptEncoding: string | undefined) => ContentEncoding;
-export declare const compressBody: (body: string, encoding: ContentEncoding) => Buffer | string;

package/dist/src/index.d.ts

@@ -1,15 +0,0 @@
-export { createServer, createSSRServer, createMCPServer, resolveServices } from './core/createServer';
-export { registerHealthCheck, buildHealthPayload } from './core/health';
-export { consoleLogger, renderLogEvent } from './helpers/serverLog';
-export type { HealthCheckApp, HealthIdentity } from './core/health';
-export { createJsonAdapters } from './adapters/jsonAdapters';
-export { AIEngine, toolResponseOk, toolResponseErr, zodToJsonSchema, getAllowedModes, bindTools, isToolActive, resolveToolHandler, isCallToolResult, toolResponseFromResult } from './modules/ai';
-export { createMcpServer, handleMcp, serveMcp, readMcpBody, buildAgentGuide, createHttpPreviewClient, createHttpScreenshotClient } from './modules/mcp';
-export { createPreview, createMemoryDraftStore, PREVIEW_TOKEN_PARAM } from './modules/ssr/preview';
-export { apply, search, read, validate, applyShape, searchShape, readShape, validateShape, operation, tools } from './modules/mcp/tools';
-export type { JsonAdaptersConfig } from './adapters/jsonAdapters';
-export type { ResolvedServices } from './core/createServer';
-export type { McpServerContext, McpRequestOptions, PreviewClient, PreviewRequestBody, PreviewResult, HttpPreviewClientConfig, ScreenshotClient, ScreenshotImage, ScreenshotResult, Viewport, HttpScreenshotClientConfig } from './modules/mcp';
-export type { ApplyInput, SearchInput, SearchResponse, SearchHit, ReadInput, ReadResponse, ReadHit, ValidateInput, WriteResponse, WriteElement, Persisters, Operation, ToolDef, ToolContext } from './modules/mcp/tools';
-export type { Space } from './modules/mcp/helpers';
-export type { Env } from './modules/mcp/types';

package/dist/src/mcp.d.ts

@@ -1,14 +0,0 @@
-/** The MCP role's entry point: everything an MCP deployment wires, and nothing else.
- *
- *  Import it as `@plitzi/sdk-server/mcp`. The package root is a barrel over every service (SSR, RSC, plugins, the
- *  AI engine…), so pulling `createMCPServer` from there makes the process load that whole graph — including the
- *  React element packages its types come from — where this entry loads only the MCP server. */
-export { createMCPServer } from './core/server/mcpServer';
-export { consoleLogger, renderLogEvent } from './helpers/serverLog';
-export { createMcpServer, handleMcp, serveMcp, readMcpBody } from './modules/mcp/handler';
-export { createHttpPreviewClient } from './modules/mcp/previewClient';
-export { createHttpScreenshotClient } from './modules/mcp/screenshotClient';
-export type { McpRequestOptions } from './modules/mcp/handler';
-export type { McpServerContext } from './modules/mcp/server';
-export type { PreviewClient, ScreenshotClient } from './modules/mcp/types';
-export type { HealthIdentity } from './core/health';

package/dist/src/middlewares/spaceDeployment.d.ts

@@ -1,2 +0,0 @@
-import { SSRAdapters, SSRMiddleware } from '@plitzi/sdk-shared';
-export declare const spaceDeploymentMiddleware: (adapters: SSRAdapters) => SSRMiddleware;

package/dist/src/modules/ai/AIEngine.d.ts

@@ -1,20 +0,0 @@
-import { AiMode, AiContext, McpPromptHandler, McpToolHandler, McpToolLifecycleHooks, StreamCallbacks, McpTool, McpToolHandlerResult } from '@plitzi/sdk-shared';
-declare class AIEngine implements McpToolLifecycleHooks {
-    private readonly mode;
-    readonly callbacks: StreamCallbacks;
-    private toolsAvailables;
-    private toolsAvailablesMap;
-    ctx: AiContext;
-    constructor(mode: AiMode | undefined, callbacks: StreamCallbacks, ctx: Omit<AiContext, 'mode'>);
-    readonly readResource: (name: string, uri: string) => void;
-    readonly setToolsAvailables: (tools: McpTool[]) => void;
-    readonly can: (name: string) => boolean;
-    readonly before: (name: string, args: Record<string, unknown>) => Promise<boolean>;
-    readonly after: (name: string, args: Record<string, unknown>, result: McpToolHandlerResult) => Promise<void>;
-    private readonly validateToolInput;
-    private readonly validateToolOutput;
-    private readonly runPipeline;
-    readonly execute: (name: string, handlerFn?: McpToolHandler) => (args: Record<string, unknown>) => Promise<McpToolHandlerResult>;
-    readonly executePrompt: (_name: string, handlerFn: McpPromptHandler) => (args: Record<string, unknown>) => Promise<import('@plitzi/sdk-shared').McpPromptHandlerResult>;
-}
-export default AIEngine;

package/dist/src/modules/ai/index.d.ts

@@ -1,4 +0,0 @@
-import { default as AIEngine } from './AIEngine';
-export * from './AIEngine';
-export { zodToJsonSchema, getAllowedModes, toolResponseOk, toolResponseErr, bindTools, isToolActive, resolveToolHandler, isCallToolResult, toolResponseFromResult } from './toolkit';
-export { AIEngine };

package/dist/src/modules/ai/toolkit.d.ts

@@ -1,17 +0,0 @@
-import { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
-import { AiMode, McpContent, McpTool, McpToolHandler, McpToolHandlerResult, ToolOperationType } from '@plitzi/sdk-shared';
-/** Convert a Zod schema to the JSON Schema an AI provider (Anthropic / OpenAI) expects in a tool definition.
- *  Delegates to Zod v4's built-in converter — one implementation, so descriptions, literal discriminators,
- *  enums, nested objects and recursive (z.lazy) shapes all survive and the provider sees the same contract an
- *  MCP client does. `io: 'input'` describes what the agent must SEND; `unrepresentable: 'any'` degrades an
- *  exotic type to an empty schema instead of throwing, so one unusual tool never breaks the whole tool list. */
-export declare const zodToJsonSchema: (schema: unknown) => Record<string, unknown>;
-export declare const firstText: (content: McpContent[]) => string | undefined;
-export declare const getAllowedModes: (operationType: ToolOperationType) => AiMode[];
-export declare const toolResponseOk: (data: unknown, agentMessage?: string) => McpToolHandlerResult;
-export declare const toolResponseErr: (error: Error | string) => McpToolHandlerResult;
-export declare const isCallToolResult: (result: unknown) => result is CallToolResult;
-export declare const toolResponseFromResult: (result: CallToolResult) => McpToolHandlerResult;
-export declare const isToolActive: (tool: McpTool) => boolean;
-export declare const resolveToolHandler: (tool: McpTool) => McpToolHandler | undefined;
-export declare const bindTools: (tools: McpTool[]) => McpTool[];

package/dist/src/modules/mcp/apps/example/index.d.ts

@@ -1,8 +0,0 @@
-import { McpApp } from '../../types';
-/** The reference app: the smallest definition that works, kept as the template a new app is copied from.
- *
- *  It is deliberately NOT in the `apps` list — nothing renders it, since no tool points at it — so it costs a
- *  real deployment nothing while the test suite still builds it, which is what keeps it from rotting. To turn it
- *  into a real app: add it to `apps` in ../index.ts and give a tool `ui: { resourceUri: EXAMPLE_APP_URI }`. */
-export declare const EXAMPLE_APP_URI = "ui://plitzi/example.html";
-export declare const exampleApp: McpApp;

package/dist/src/modules/mcp/apps/index.d.ts

@@ -1,11 +0,0 @@
-import { McpApp, McpViewSettings } from '../types';
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-/** What a view gets when the deployment says nothing: streaming on, because a host that streams no arguments
- *  paints exactly what it painted before. */
-export declare const DEFAULT_VIEW_SETTINGS: McpViewSettings;
-/** Every MCP App this server serves. A new one is a folder beside `render/` (its definition + its view) and one
- *  line here — the tool that opens it points at its `uri` through `ui: { resourceUri }`. Start from `example/`,
- *  which is that same shape stripped to the minimum. */
-export declare const apps: McpApp[];
-export declare const registerApps: (server: McpServer, settings?: McpViewSettings) => void;
-export { iconFontCss, RENDER_APP_URI } from './render';

package/dist/src/modules/mcp/apps/render/index.d.ts

@@ -1,4 +0,0 @@
-import { McpApp } from '../../types';
-export declare const RENDER_APP_URI = "ui://plitzi/render.html";
-export declare const renderApp: McpApp;
-export { iconFontCss } from './styles';

package/dist/src/modules/mcp/apps/render/styles.d.ts

@@ -1,10 +0,0 @@
-/** Lifts every @font-face block out of a stylesheet. Brace counting rather than a CSS parser: a @font-face body is
- *  plain declarations, and base64 payloads and url() values carry no braces of their own. */
-export declare const splitFontFaces: (css: string) => {
-    base: string;
-    fonts: string;
-};
-/** What the page shell inlines: the SDK stylesheet without the icon fonts. */
-export declare const widgetCss: () => string;
-/** The icon fonts, for the renders that draw one. */
-export declare const iconFontCss: () => string;

package/dist/src/modules/mcp/apps/shared/assets.d.ts

@@ -1,10 +0,0 @@
-/** The one folder of an app that ships to dist as SOURCE: its browser entry (`view/index.tsx`) and every module
- *  that entry bundles. The server builds it with esbuild at request time, so none of it is in the module graph the
- *  library build compiles — a view-side module that does not travel verbatim is simply missing at runtime, which
- *  the package only finds out when a host asks for the page. Everything else in an app (its definition) compiles
- *  like any other module. */
-export declare const VIEW_DIR = "view";
-/** Does this file ship as source? The build's copy step asks it, and `apps.test.ts` asks it of every real input of
- *  every app's bundle — so a view that grows a sibling module either lives in `view/` or fails the suite, instead
- *  of failing a deployment. Tests stay behind; the page shell travels with the views it renders. */
-export declare const shipsAsSource: (file: string) => boolean;

package/dist/src/modules/mcp/apps/shared/bundle.d.ts

@@ -1,4 +0,0 @@
-export declare const bundle: (entry: string) => Promise<string>;
-/** Every file the view pulls in, resolved by the build that serves it. The suite asks for this to check each one
- *  ships as source: a view-side module the package leaves behind resolves here, in the repo, and nowhere else. */
-export declare const bundleInputs: (entry: string) => Promise<string[]>;

package/dist/src/modules/mcp/apps/shared/index.d.ts

@@ -1,3 +0,0 @@
-export { shipsAsSource, VIEW_DIR } from './assets';
-export { registerApp } from './registerApp';
-export { require } from './resolve';

package/dist/src/modules/mcp/apps/shared/page.d.ts

@@ -1,2 +0,0 @@
-import { McpApp, McpViewSettings } from '../../types';
-export declare const page: (app: McpApp, settings: McpViewSettings) => Promise<string>;

package/dist/src/modules/mcp/apps/shared/registerApp.d.ts

@@ -1,5 +0,0 @@
-import { McpApp, McpViewSettings } from '../../types';
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-/** Serves the app as a self-contained page: no import map, no asset mounts, no cross-origin fetches, so the
- *  strictest host sandbox runs it and no deployment has to serve anything extra. */
-export declare const registerApp: (server: McpServer, app: McpApp, settings: McpViewSettings) => void;

package/dist/src/modules/mcp/apps/shared/resolve.d.ts

@@ -1 +0,0 @@
-export declare const require: NodeJS.Require;

package/dist/src/modules/mcp/apps/shared/zodEnglishOnly.d.ts

@@ -1,4 +0,0 @@
-import { Plugin } from 'esbuild';
-/** Drops zod's ~40 translations (194 KB): they are re-exported as a namespace, which no bundler can tree-shake.
- *  English survives because zod imports `locales/en.js` directly, not through this index. */
-export declare const zodEnglishOnly: Plugin;

package/dist/src/modules/mcp/catalogs/builtinCallbacks.d.ts

@@ -1,23 +0,0 @@
-import { ParamSpec } from './paramSpec';
-export interface BuiltinGlobalCallback {
-    source: string;
-    title: string;
-    strictParams: boolean;
-    params: ParamSpec;
-}
-export declare const BUILTIN_GLOBAL_CALLBACKS: Record<string, BuiltinGlobalCallback>;
-/** The built-in globalCallback for an action, or undefined when the action is not a known built-in (a plugin
- *  callback whose source/schema is not knowable here). */
-export declare const getGlobalCallback: (action: string) => BuiltinGlobalCallback | undefined;
-/** Report the param keys the agent supplied that are not valid for a built-in callback: only for CLOSED
- *  (`strictParams`) callbacks; open ones (collection) accept arbitrary field keys so nothing is unknown. Returns []
- *  for an unknown action (a plugin callback whose schema is not known here). */
-export declare const unknownBuiltinParams: (action: string, params: Record<string, unknown>) => string[];
-/** Resolve a `globalCallback` action against the built-in catalog: returns the module id it is registered under
- *  (`source`) and the params reconciled to the callback's schema — unknown keys dropped for a closed callback, then
- *  missing defaults filled. An action the catalog does not know (e.g. a plugin callback) yields no source and
- *  unchanged params, so the caller keeps its own behavior for it. */
-export declare const applyBuiltinCallback: (action: string, params: Record<string, unknown>) => {
-    source?: string;
-    params: Record<string, unknown>;
-};

package/dist/src/modules/mcp/catalogs/builtinComponents.d.ts

@@ -1,4 +0,0 @@
-import { ComponentCatalogEntry } from '@plitzi/sdk-shared';
-type BuiltinComponent = Required<Pick<ComponentCatalogEntry, 'label' | 'description' | 'category'>>;
-export declare const BUILTIN_COMPONENTS: Partial<Record<string, BuiltinComponent>>;
-export {};

package/dist/src/modules/mcp/catalogs/builtinElementCallbacks.d.ts

@@ -1,20 +0,0 @@
-import { ParamSpec } from './paramSpec';
-export interface BuiltinElementCallback {
-    title: string;
-    strictParams: boolean;
-    params: ParamSpec;
-}
-export declare const BUILTIN_ELEMENT_CALLBACKS: Record<string, BuiltinElementCallback>;
-/** The built-in element callback for an action, or undefined when the action is not a known built-in (an
- *  element-type-specific/plugin callback whose schema is not knowable here). */
-export declare const getElementCallback: (action: string) => BuiltinElementCallback | undefined;
-/** Param keys the agent supplied that are not valid for a built-in element callback (only for CLOSED sets). []
- *  for an unknown action (a plugin/element-specific callback whose schema is not known here). */
-export declare const unknownElementCallbackParams: (action: string, params: Record<string, unknown>) => string[];
-/** Reconcile a `callback` action against the element-callback catalog: unknown keys dropped for a closed callback,
- *  then missing defaults filled (category:"attribute", revertOnFinish:false). An unknown action yields unchanged
- *  params, so a plugin/element-specific callback keeps whatever the agent passed. */
-export declare const applyElementCallback: (action: string, params: Record<string, unknown>) => {
-    known: boolean;
-    params: Record<string, unknown>;
-};

package/dist/src/modules/mcp/catalogs/builtinTransformers.d.ts

@@ -1,28 +0,0 @@
-import { ParamSpec } from './paramSpec';
-export interface BuiltinTransformer {
-    title: string;
-    description: string;
-    strictParams: boolean;
-    params: ParamSpec;
-}
-export declare const BUILTIN_TRANSFORMERS: Record<string, BuiltinTransformer>;
-/** The built-in transformer for an action, or undefined when the action is not a known built-in transformer. */
-export declare const getTransformer: (action: string) => BuiltinTransformer | undefined;
-/** The closest known transformer action to a mistyped one (substring match either way), so a wrong action like
- *  "template" teaches "twigTemplate". Undefined when nothing is close. */
-export declare const suggestTransformer: (action: string) => string | undefined;
-export interface TransformerInfo {
-    action: string;
-    title: string;
-    description: string;
-    params: {
-        name: string;
-        type: string;
-        description: string;
-        default?: string | number | boolean;
-        options?: string[];
-    }[];
-}
-/** The transformer catalog projected for the data-sources resource / primer, so the agent knows the exact action
- *  names and params up front (the real fix for the "agent can't write transformers" problem). */
-export declare const transformerCatalog: () => TransformerInfo[];

package/dist/src/modules/mcp/catalogs/builtinUtilities.d.ts

@@ -1,18 +0,0 @@
-import { ParamSpec } from './paramSpec';
-export interface BuiltinUtility {
-    title: string;
-    strictParams: boolean;
-    params: ParamSpec;
-}
-export declare const BUILTIN_UTILITIES: Record<string, BuiltinUtility>;
-/** The built-in utility for an action, or undefined when the action is not a known built-in utility. */
-export declare const getUtility: (action: string) => BuiltinUtility | undefined;
-/** Param keys the agent supplied that are not valid for a built-in utility (only for CLOSED sets). [] for an unknown
- *  action (a utility whose schema is not known here). */
-export declare const unknownUtilityParams: (action: string, params: Record<string, unknown>) => string[];
-/** Reconcile a `utility` action against the utility catalog: unknown keys dropped for a closed utility, then missing
- *  defaults filled. An unknown action yields unchanged params. */
-export declare const applyUtility: (action: string, params: Record<string, unknown>) => {
-    known: boolean;
-    params: Record<string, unknown>;
-};

package/dist/src/modules/mcp/catalogs/cssCatalog/border.d.ts

@@ -1,4 +0,0 @@
-import { CssProps } from '../../types';
-export declare const classifyBorderTokens: (value: string) => Record<"width" | "style" | "color", string>;
-export declare const expandBorder: (key: string, value: string, out: CssProps) => void;
-export declare const expandBorderGroup: (suffix: string, value: string, out: CssProps) => void;

package/dist/src/modules/mcp/catalogs/cssCatalog/box.d.ts

@@ -1,4 +0,0 @@
-import { CssProps } from '../../types';
-export declare const expandBox: (key: string, value: string, out: CssProps) => void;
-export declare const expandBorderRadius: (value: string, out: CssProps) => void;
-export declare const expandGap: (value: string, out: CssProps) => void;