@pracht/vite-plugin 0.6.2 → 0.7.0

package/dist/index.d.mts

@@ -6,6 +6,8 @@ import { RenderMode, RenderMode as RenderMode$1 } from "@pracht/core";
 declare const PRACHT_CLIENT_MODULE_ID = "virtual:pracht/client";
 declare const PRACHT_SERVER_MODULE_ID = "virtual:pracht/server";
 declare const PRACHT_ISLANDS_CLIENT_MODULE_ID = "virtual:pracht/islands-client";
+declare const PRACHT_CAPABILITIES_MODULE_ID = "virtual:pracht/capabilities";
+declare const PRACHT_WEBMCP_MODULE_ID = "virtual:pracht/webmcp";
 //#endregion
 //#region src/env-safety.d.ts
 /**
@@ -84,6 +86,23 @@ interface PrachtAdapter {
 }
 //#endregion
 //#region src/plugin-options.d.ts
+type LlmsTxtSection = "pages" | "api" | "capabilities";
+interface PrachtLlmsTxtOptions {
+  /** H1 title. Defaults to the app's package.json `name`. */
+  title?: string;
+  /**
+   * Blockquote summary under the title. Defaults to the app's package.json
+   * `description`; omitted when neither is set.
+   */
+  description?: string;
+  /**
+   * Origin (e.g. "https://example.com") prepended to every link so llms.txt
+   * contains absolute URLs. Links stay root-relative when omitted.
+   */
+  origin?: string;
+  /** Sections to emit. Defaults to ["pages", "api", "capabilities"]. */
+  include?: LlmsTxtSection[];
+}
 interface PrachtPluginOptions {
   appFile?: string;
   routesDir?: string;
@@ -96,6 +115,11 @@ interface PrachtPluginOptions {
    * `hydration: "islands"` routes. Defaults to "/src/islands".
    */
   islandsDir?: string;
+  /**
+   * Directory containing capability modules registered in the app manifest
+   * via `capabilities: { ... }`. Defaults to "/src/capabilities".
+   */
+  capabilitiesDir?: string;
   adapter?: PrachtAdapter;
   /** Enable file-system pages routing by pointing to the pages directory (e.g. "/src/pages"). */
   pagesDir?: string;
@@ -125,6 +149,12 @@ interface PrachtPluginOptions {
    * variables, or `false` to disable the check entirely.
    */
   envSafety?: false | EnvSafetyOptions;
+  /**
+   * Opt into emitting an llms.txt file (https://llmstxt.org) generated from
+   * the resolved app graph. `pracht build` writes `dist/client/llms.txt` and
+   * the dev server serves `/llms.txt` live. Disabled by default.
+   */
+  llmsTxt?: false | PrachtLlmsTxtOptions;
 }
 //#endregion
 //#region src/plugin-codegen.d.ts
@@ -137,14 +167,61 @@ declare function createPrachtClientModuleSource(options?: PrachtPluginOptions, b
  * manifest, the router, or the full client runtime: it only scans the DOM
  * for island markers and hydrates the islands present on the page.
  */
-declare function createPrachtIslandsClientModuleSource(options?: PrachtPluginOptions): string;
+declare function createPrachtIslandsClientModuleSource(options?: PrachtPluginOptions, buildOptions?: {
+  root?: string;
+}): string;
 declare function createPrachtServerModuleSource(options?: PrachtPluginOptions, buildOptions?: {
   root?: string;
   isBuild?: boolean;
 }): string;
 declare function createPrachtRegistryModuleSource(options?: PrachtPluginOptions): string;
 //#endregion
+//#region src/plugin-capabilities.d.ts
+interface ExtractedCapability {
+  name: string;
+  /** Manifest-relative module path, e.g. "./capabilities/notes-search.ts". */
+  file: string;
+  description: string;
+  effect: string | null;
+  httpPath: string | null;
+  webmcp: boolean;
+  inputSchema: Record<string, unknown> | null;
+}
+/**
+ * Extract capability registrations (name → module path) from the app
+ * manifest source and their exposure metadata from each capability source.
+ * Pages-router apps have no manifest, so capabilities are manifest-mode only.
+ */
+declare function extractCapabilities(options?: PrachtPluginOptions, root?: string): ExtractedCapability[];
+/**
+ * Generate `virtual:pracht/capabilities` — the browser-side `callCapability`
+ * helper plus the endpoint map for http-exposed capabilities. Side-effect
+ * free, so it costs zero bytes unless application code imports it.
+ *
+ * After every call settles, the helper announces itself on
+ * CAPABILITY_SETTLED_EVENT with the capability's effect class; the framework
+ * runtime revalidates route data for successful non-`read` calls (opt out
+ * per call via `{ revalidate: false }`).
+ */
+declare function createPrachtCapabilitiesClientModuleSource(options?: PrachtPluginOptions, buildOptions?: {
+  root?: string;
+}): string;
+/**
+ * Generate `virtual:pracht/webmcp` — the disposable WebMCP registration shim.
+ * One page tool per `expose.webmcp` capability; `execute` dispatches through
+ * `callCapability`, so the user's session authenticates the call and all
+ * validation/middleware/policy stays server-side. Each dispatch carries the
+ * transport marker header so audit events can attribute it to WebMCP.
+ *
+ * Targets the Chrome origin-trial API: `document.modelContext.registerTool()`
+ * (Chrome 150+; `navigator.modelContext` is the deprecated pre-150 location
+ * and is kept as a fallback). No-ops silently when the API is absent.
+ */
+declare function createPrachtWebmcpModuleSource(options?: PrachtPluginOptions, buildOptions?: {
+  root?: string;
+}): string;
+//#endregion
 //#region src/index.d.ts
 declare function pracht(options?: PrachtPluginOptions): Plugin[];
 //#endregion
-export { type EnvLeakReference, type EnvSafetyOptions, PRACHT_CLIENT_MODULE_ID, PRACHT_ISLANDS_CLIENT_MODULE_ID, PRACHT_SERVER_MODULE_ID, PUBLIC_ENV_PREFIX, type PrachtAdapter, type PrachtPluginOptions, type RenderMode, VITE_BUILTIN_ENV_VARS, createEnvSafetyPlugin, createPrachtClientModuleSource, createPrachtIslandsClientModuleSource, createPrachtRegistryModuleSource, createPrachtServerModuleSource, formatEnvLeakError, pracht, scanCodeForEnvLeaks };
+export { type EnvLeakReference, type EnvSafetyOptions, type LlmsTxtSection, PRACHT_CAPABILITIES_MODULE_ID, PRACHT_CLIENT_MODULE_ID, PRACHT_ISLANDS_CLIENT_MODULE_ID, PRACHT_SERVER_MODULE_ID, PRACHT_WEBMCP_MODULE_ID, PUBLIC_ENV_PREFIX, type PrachtAdapter, type PrachtLlmsTxtOptions, type PrachtPluginOptions, type RenderMode, VITE_BUILTIN_ENV_VARS, createEnvSafetyPlugin, createPrachtCapabilitiesClientModuleSource, createPrachtClientModuleSource, createPrachtIslandsClientModuleSource, createPrachtRegistryModuleSource, createPrachtServerModuleSource, createPrachtWebmcpModuleSource, extractCapabilities, formatEnvLeakError, pracht, scanCodeForEnvLeaks };

package/dist/index.mjs

@@ -5,7 +5,10 @@ import preact from "@preact/preset-vite";
 import { dirname, extname, join, resolve } from "node:path";
 import { parseAst } from "vite";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { CAPABILITY_SETTLED_EVENT, CAPABILITY_TRANSPORT_HEADER, CONFIRMATION_HEADER, capabilityHttpPath, isValidCapabilityHttpPath } from "@pracht/capabilities";
+import { evaluateLiteral, extractCapabilityRegistrations, extractDefineCapabilityArgs, scanTopLevelProperties } from "@pracht/capabilities/static";
 import { createNodeServerEntryModule } from "@pracht/adapter-node";
+import { resolveRegistryModule } from "@pracht/core";
 //#region src/client-module-query.ts
 const CLIENT_MODULE_QUERY = "pracht-client";
 const PRACHT_CLIENT_MODULE_QUERY = `?${CLIENT_MODULE_QUERY}`;
@@ -1191,6 +1194,8 @@ function createEnvSafetyPlugin(envSafety) {
 const PRACHT_CLIENT_MODULE_ID = "virtual:pracht/client";
 const PRACHT_SERVER_MODULE_ID = "virtual:pracht/server";
 const PRACHT_ISLANDS_CLIENT_MODULE_ID = "virtual:pracht/islands-client";
+const PRACHT_CAPABILITIES_MODULE_ID = "virtual:pracht/capabilities";
+const PRACHT_WEBMCP_MODULE_ID = "virtual:pracht/webmcp";
 const CLIENT_BROWSER_PATH = "/@pracht/client.js";
 const ISLANDS_CLIENT_BROWSER_PATH = "/@pracht/islands.js";
 function readClientBuildAssets(root = process.cwd()) {
@@ -1256,6 +1261,12 @@ function isServerModule(id) {
 function isIslandsClientModule(id) {
 	return id === "virtual:pracht/islands-client" || id === "/@pracht/islands.js" || id.endsWith("virtual:pracht/islands-client");
 }
+function isCapabilitiesModule(id) {
+	return id === "virtual:pracht/capabilities" || id.endsWith("virtual:pracht/capabilities");
+}
+function isWebmcpModule(id) {
+	return id === "virtual:pracht/webmcp" || id.endsWith("virtual:pracht/webmcp");
+}
 //#endregion
 //#region src/plugin-adapter.ts
 function createDefaultNodeAdapter() {
@@ -1277,6 +1288,7 @@ const DEFAULTS = {
 	apiDir: "/src/api",
 	serverDir: "/src/server",
 	islandsDir: "/src/islands",
+	capabilitiesDir: "/src/capabilities",
 	adapter: createDefaultNodeAdapter(),
 	pagesDir: "",
 	pagesDefaultRender: "ssr",
@@ -1284,18 +1296,33 @@ const DEFAULTS = {
 	maxBodySize: 1024 * 1024,
 	budgets: {},
 	precompileSsrJsx: false,
-	envSafety: {}
+	envSafety: {},
+	llmsTxt: false
 };
 function resolveOptions(options) {
 	const resolved = {
 		...DEFAULTS,
 		...options
 	};
+	if (resolved.llmsTxt === void 0) resolved.llmsTxt = false;
 	if (!Number.isInteger(resolved.prerenderConcurrency) || resolved.prerenderConcurrency <= 0) throw new Error("pracht({ prerenderConcurrency }) expects a positive integer.");
 	if (!Number.isInteger(resolved.maxBodySize) || resolved.maxBodySize <= 0) throw new Error("pracht({ maxBodySize }) expects a positive integer number of bytes.");
 	validateBudgets(resolved.budgets);
+	validateLlmsTxt(resolved.llmsTxt);
 	return resolved;
 }
+const LLMS_TXT_SECTIONS = new Set([
+	"pages",
+	"api",
+	"capabilities"
+]);
+function validateLlmsTxt(llmsTxt) {
+	if (llmsTxt === false) return;
+	if (typeof llmsTxt !== "object" || llmsTxt === null) throw new Error("pracht({ llmsTxt }) expects false or an options object.");
+	if (llmsTxt.include !== void 0) {
+		if (!(Array.isArray(llmsTxt.include) && llmsTxt.include.every((section) => LLMS_TXT_SECTIONS.has(section)))) throw new Error(`pracht({ llmsTxt: { include } }) expects an array of "pages", "api", and/or "capabilities", got ${JSON.stringify(llmsTxt.include)}.`);
+	}
+}
 function validateBudgets(budgets) {
 	for (const [key, value] of Object.entries(budgets)) {
 		if (key !== "*" && !key.startsWith("/")) throw new Error(`pracht({ budgets }) keys must be "*" or a route path starting with "/", got ${JSON.stringify(key)}.`);
@@ -1305,6 +1332,288 @@ function validateBudgets(budgets) {
 	}
 }
 //#endregion
+//#region src/plugin-capabilities.ts
+/**
+* Build-time capability projection for the browser.
+*
+* The client never loads capability modules (they are server-only), so the
+* `virtual:pracht/capabilities` and `virtual:pracht/webmcp` modules are
+* generated from static analysis of the app manifest and the registered
+* capability sources — the same approach the plugin already uses for
+* hydration-mode excludes. Only serializable metadata crosses the boundary:
+* capability names, HTTP endpoints, effects, and (for WebMCP tools)
+* description and input schema.
+*
+* The static analyzer itself lives in `@pracht/capabilities/static` and is
+* shared with `pracht verify`, so the build and verification can never
+* disagree about what is analyzable. Constraint it imposes: a capability's
+* `expose`, HTTP-projected `effect`, and WebMCP `input` values must be inline
+* literals (no imported constants or spreads) — the extractor parses the
+* literal text as data.
+* Extraction failures fail the build with a pointer to the offending file
+* rather than silently dropping an endpoint.
+*/
+/**
+* Extract capability registrations (name → module path) from the app
+* manifest source and their exposure metadata from each capability source.
+* Pages-router apps have no manifest, so capabilities are manifest-mode only.
+*/
+function extractCapabilities(options = {}, root = process.cwd()) {
+	const resolved = resolveOptions(options);
+	if (resolved.pagesDir) return [];
+	const appFileAbs = resolve(root, resolved.appFile.replace(/^\//, ""));
+	let manifestSource;
+	try {
+		manifestSource = readFileSync(appFileAbs, "utf-8");
+	} catch {
+		return [];
+	}
+	const registrations = extractCapabilityRegistrations(manifestSource);
+	if (registrations.length === 0) return [];
+	const appDir = dirname(appFileAbs);
+	return registrations.map(({ name, file }) => {
+		const capabilityFileAbs = file.startsWith("/") ? resolve(root, file.replace(/^\//, "")) : resolve(appDir, file);
+		let source;
+		try {
+			source = readFileSync(capabilityFileAbs, "utf-8");
+		} catch {
+			throw new Error(`[pracht] Capability "${name}" references missing file ${JSON.stringify(file)}.`);
+		}
+		return extractCapabilityMetadata(name, file, source);
+	});
+}
+function extractCapabilityMetadata(name, file, source) {
+	const args = extractDefineCapabilityArgs(source);
+	if (!args) throw new Error(`[pracht] Capability "${name}" (${file}) does not contain a defineCapability({ ... }) call the build can analyze.`);
+	const properties = scanTopLevelProperties(args);
+	const exposeText = properties.get("expose");
+	if (!exposeText) return {
+		name,
+		file,
+		description: "",
+		effect: null,
+		httpPath: null,
+		webmcp: false,
+		inputSchema: null
+	};
+	const expose = evaluateLiteral(exposeText);
+	if (!isPlainObject(expose)) throw new Error(`[pracht] Capability "${name}" (${file}): "expose" must be an inline object literal so the client projection can be generated at build time.`);
+	const http = expose.http;
+	let httpPath = null;
+	if (http === true) httpPath = capabilityHttpPath(name);
+	else if (isPlainObject(http)) httpPath = typeof http.path === "string" ? http.path : capabilityHttpPath(name);
+	if (httpPath && !isValidCapabilityHttpPath(httpPath)) throw new Error(`[pracht] Capability "${name}" (${file}): HTTP exposure "path" must be an exact same-origin pathname starting with "/".`);
+	const webmcp = expose.webmcp === true;
+	if (webmcp && !httpPath) throw new Error(`[pracht] Capability "${name}" (${file}): expose.webmcp requires expose.http.`);
+	let description = "";
+	const descriptionText = properties.get("description");
+	if (descriptionText) {
+		const value = evaluateLiteral(descriptionText);
+		if (typeof value === "string") description = value;
+	}
+	let effect = null;
+	const effectText = properties.get("effect");
+	if (effectText) {
+		const value = evaluateLiteral(effectText);
+		if (typeof value === "string") effect = value;
+	}
+	if (httpPath && effect !== "read" && effect !== "write" && effect !== "destructive") throw new Error(`[pracht] Capability "${name}" (${file}) is exposed via HTTP, but its "effect" could not be extracted at build time. HTTP-exposed capabilities must declare "effect" as an inline "read", "write", or "destructive" string literal.`);
+	let inputSchema = null;
+	if (webmcp) {
+		const inputText = properties.get("input");
+		const value = inputText ? evaluateLiteral(inputText) : void 0;
+		if (!isPlainObject(value)) throw new Error(`[pracht] Capability "${name}" (${file}) is exposed via WebMCP, but its "input" schema could not be extracted at build time. WebMCP-exposed capabilities must declare their input schema as an inline object literal.`);
+		inputSchema = value;
+	}
+	return {
+		name,
+		file,
+		description,
+		effect,
+		httpPath,
+		webmcp,
+		inputSchema
+	};
+}
+/**
+* Generate `virtual:pracht/capabilities` — the browser-side `callCapability`
+* helper plus the endpoint map for http-exposed capabilities. Side-effect
+* free, so it costs zero bytes unless application code imports it.
+*
+* After every call settles, the helper announces itself on
+* CAPABILITY_SETTLED_EVENT with the capability's effect class; the framework
+* runtime revalidates route data for successful non-`read` calls (opt out
+* per call via `{ revalidate: false }`).
+*/
+function createPrachtCapabilitiesClientModuleSource(options = {}, buildOptions = {}) {
+	const capabilities = extractCapabilities(options, buildOptions.root);
+	const endpoints = {};
+	for (const capability of capabilities) if (capability.httpPath) endpoints[capability.name] = {
+		method: "POST",
+		path: capability.httpPath,
+		effect: capability.effect
+	};
+	return [
+		"// Generated by @pracht/vite-plugin from the app manifest capability registrations.",
+		"// Contains only http-exposed capability names, endpoints, and effects —",
+		"// capability modules themselves are server-only and never reach the client graph.",
+		`const endpoints = ${JSON.stringify(endpoints)};`,
+		"",
+		"export const capabilityEndpoints = endpoints;",
+		"",
+		"async function dispatchCapability(endpoint, input, opts) {",
+		"  let response;",
+		"  try {",
+		"    const headers = new Headers(opts && opts.headers);",
+		"    headers.set(\"content-type\", \"application/json\");",
+		"    if (opts && opts.confirm) {",
+		`      headers.set(${JSON.stringify(CONFIRMATION_HEADER)}, opts.confirm);`,
+		"    }",
+		"    response = await fetch(endpoint.path, {",
+		"      method: endpoint.method,",
+		"      headers,",
+		"      body: JSON.stringify(input === undefined ? {} : input),",
+		"      credentials: \"same-origin\",",
+		"      signal: opts && opts.signal,",
+		"    });",
+		"  } catch (error) {",
+		"    return {",
+		"      ok: false,",
+		"      error: { code: \"network_error\", message: String((error && error.message) || error) },",
+		"    };",
+		"  }",
+		"  try {",
+		"    return await response.json();",
+		"  } catch {",
+		"    return {",
+		"      ok: false,",
+		"      error: {",
+		"        code: \"invalid_response\",",
+		"        message: `Capability endpoint returned a non-JSON response (status ${response.status}).`,",
+		"      },",
+		"    };",
+		"  }",
+		"}",
+		"",
+		"export async function callCapability(name, input, opts) {",
+		"  const endpoint = endpoints[name];",
+		"  if (!endpoint) {",
+		"    return {",
+		"      ok: false,",
+		"      error: {",
+		"        code: \"unknown_capability\",",
+		"        message: `No HTTP-exposed capability named \"${name}\" is registered.`,",
+		"      },",
+		"    };",
+		"  }",
+		"  const result = await dispatchCapability(endpoint, input, opts);",
+		"  // Announce the settled call so the route runtime can revalidate after",
+		"  // successful non-read effects. Best-effort — never breaks the call.",
+		"  try {",
+		"    if (typeof window !== \"undefined\") {",
+		`      window.dispatchEvent(new CustomEvent(${JSON.stringify(CAPABILITY_SETTLED_EVENT)}, {`,
+		"        detail: {",
+		"          name,",
+		"          effect: endpoint.effect,",
+		"          ok: result && result.ok === true,",
+		"          revalidate: opts && opts.revalidate === false ? false : undefined,",
+		"        },",
+		"      }));",
+		"    }",
+		"  } catch {}",
+		"  return result;",
+		"}",
+		""
+	].join("\n");
+}
+/**
+* Generate `virtual:pracht/webmcp` — the disposable WebMCP registration shim.
+* One page tool per `expose.webmcp` capability; `execute` dispatches through
+* `callCapability`, so the user's session authenticates the call and all
+* validation/middleware/policy stays server-side. Each dispatch carries the
+* transport marker header so audit events can attribute it to WebMCP.
+*
+* Targets the Chrome origin-trial API: `document.modelContext.registerTool()`
+* (Chrome 150+; `navigator.modelContext` is the deprecated pre-150 location
+* and is kept as a fallback). No-ops silently when the API is absent.
+*/
+function createPrachtWebmcpModuleSource(options = {}, buildOptions = {}) {
+	const tools = extractCapabilities(options, buildOptions.root).filter((capability) => capability.webmcp).map((capability) => ({
+		name: capability.name,
+		description: capability.description,
+		effect: capability.effect,
+		inputSchema: capability.inputSchema
+	}));
+	return [
+		"// Generated by @pracht/vite-plugin — WebMCP page-tool registration shim.",
+		"import { callCapability } from \"virtual:pracht/capabilities\";",
+		"",
+		`const tools = ${JSON.stringify(tools)};`,
+		`const transportHeaders = { ${JSON.stringify(CAPABILITY_TRANSPORT_HEADER)}: "webmcp" };`,
+		"",
+		"export function registerPrachtWebmcpTools() {",
+		"  const modelContext =",
+		"    (typeof document !== \"undefined\" && document.modelContext) ||",
+		"    (typeof navigator !== \"undefined\" && navigator.modelContext) ||",
+		"    null;",
+		"  if (!modelContext || typeof modelContext.registerTool !== \"function\") {",
+		"    return false;",
+		"  }",
+		"  for (const tool of tools) {",
+		"    try {",
+		"      const registration = modelContext.registerTool({",
+		"        name: tool.name,",
+		"        description: tool.description,",
+		"        inputSchema: tool.inputSchema,",
+		"        annotations: { readOnlyHint: tool.effect === \"read\" },",
+		"        async execute(input) {",
+		"          const result = await callCapability(tool.name, input, { headers: transportHeaders });",
+		"          return { content: [{ type: \"text\", text: JSON.stringify(result) }] };",
+		"        },",
+		"      });",
+		"      if (registration && typeof registration.catch === \"function\") {",
+		"        registration.catch(() => {});",
+		"      }",
+		"    } catch {",
+		"      // Origin-trial API surface may shift; a failed registration must",
+		"      // never break the page.",
+		"    }",
+		"  }",
+		"  return true;",
+		"}",
+		"",
+		"registerPrachtWebmcpTools();",
+		""
+	].join("\n");
+}
+/**
+* Snippet appended to the client entry / islands bootstrap when at least one
+* capability opts into WebMCP. Feature-detects before importing so browsers
+* without the origin trial never pay for the shim chunk.
+*/
+function createWebmcpBootstrapSource() {
+	return [
+		"// WebMCP page tools — loaded only when the browser exposes the API.",
+		"if (",
+		"  typeof document !== \"undefined\" &&",
+		"  (document.modelContext || (typeof navigator !== \"undefined\" && navigator.modelContext))",
+		") {",
+		"  import(\"virtual:pracht/webmcp\").catch(() => {});",
+		"}",
+		""
+	];
+}
+function hasWebmcpCapabilities(options = {}, root = process.cwd()) {
+	try {
+		return extractCapabilities(options, root).some((capability) => capability.webmcp);
+	} catch {
+		return true;
+	}
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
 //#region src/plugin-codegen.ts
 const ROUTE_MODULE_EXTENSIONS = new Set([
 	".ts",
@@ -1500,7 +1809,8 @@ function createPrachtClientModuleSource(options = {}, buildOptions = {}) {
 		"    findModuleKey,",
 		"  });",
 		"}",
-		""
+		"",
+		...hasWebmcpCapabilities(resolved, buildOptions.root) ? createWebmcpBootstrapSource() : []
 	].join("\n");
 }
 /**
@@ -1509,15 +1819,17 @@ function createPrachtClientModuleSource(options = {}, buildOptions = {}) {
 * manifest, the router, or the full client runtime: it only scans the DOM
 * for island markers and hydrates the islands present on the page.
 */
-function createPrachtIslandsClientModuleSource(options = {}) {
-	const islandsGlob = `${resolveOptions(options).islandsDir}/**/*.{ts,tsx,js,jsx}`;
+function createPrachtIslandsClientModuleSource(options = {}, buildOptions = {}) {
+	const resolved = resolveOptions(options);
+	const islandsGlob = `${resolved.islandsDir}/**/*.{ts,tsx,js,jsx}`;
 	return [
 		"import { hydrateIslands } from \"@pracht/core/islands-client\";",
 		"",
 		`const islandModules = import.meta.glob(${JSON.stringify(islandsGlob)});`,
 		"",
 		"hydrateIslands({ modules: islandModules });",
-		""
+		"",
+		...hasWebmcpCapabilities(resolved, buildOptions.root) ? createWebmcpBootstrapSource() : []
 	].join("\n");
 }
 function createPrachtServerModuleSource(options = {}, buildOptions = {}) {
@@ -1532,7 +1844,9 @@ function createPrachtServerModuleSource(options = {}, buildOptions = {}) {
 		jsManifest: {}
 	};
 	const adapter = resolved.adapter;
-	const prachtImports = adapter?.serverImports ? adapter.serverImports + "\nimport { prerenderApp } from \"@pracht/core/server\";" : "import { resolveApp, resolveApiRoutes, prerenderApp } from \"@pracht/core/server\";";
+	const llmsTxtConfig = resolveLlmsTxtConfig(resolved, buildOptions.root);
+	let prachtImports = adapter?.serverImports ? adapter.serverImports + "\nimport { prerenderApp } from \"@pracht/core/server\";" : "import { resolveApp, resolveApiRoutes, prerenderApp } from \"@pracht/core/server\";";
+	if (llmsTxtConfig) prachtImports += "\nimport { buildLlmsTxt } from \"@pracht/core/server\";";
 	const appImport = isPagesMode ? generatePagesAppInlineSource(resolved, buildOptions.root) : `import { app } from ${JSON.stringify(resolved.appFile)};`;
 	const islandsEntryUrl = buildOptions.isBuild ? clientBuild.islandsEntryUrl : ISLANDS_CLIENT_BROWSER_PATH;
 	const islandsGlob = `${resolved.islandsDir}/**/*.{ts,tsx,js,jsx}`;
@@ -1563,11 +1877,37 @@ function createPrachtServerModuleSource(options = {}, buildOptions = {}) {
 		`export const prerenderConcurrency = ${JSON.stringify(resolved.prerenderConcurrency)};`,
 		`export const budgets = ${JSON.stringify(resolved.budgets)};`,
 		"export { prerenderApp };",
+		...llmsTxtConfig ? [
+			"// llms.txt (https://llmstxt.org) generated from the resolved app graph.",
+			"// `pracht build` writes it to dist/client/llms.txt; the dev SSR",
+			"// middleware serves it at /llms.txt.",
+			`const llmsTxtConfig = ${JSON.stringify(llmsTxtConfig)};`,
+			"export const generateLlmsTxt = () =>",
+			"  buildLlmsTxt({ ...llmsTxtConfig, apiRoutes, app: resolvedApp, registry });"
+		] : [],
 		""
 	];
 	if (adapter) source.push(adapter.createServerEntryModule());
 	return source.join("\n");
 }
+/**
+* Fill llms.txt title/description from the app's package.json when the user
+* did not set them explicitly. Returns null when the feature is disabled so
+* the server module codegen stays byte-for-byte unchanged.
+*/
+function resolveLlmsTxtConfig(resolved, root = process.cwd()) {
+	if (!resolved.llmsTxt) return null;
+	let pkg = {};
+	try {
+		pkg = JSON.parse(readFileSync(resolve(root, "package.json"), "utf-8"));
+	} catch {}
+	const config = { title: resolved.llmsTxt.title ?? (typeof pkg.name === "string" && pkg.name ? pkg.name : "App") };
+	const description = resolved.llmsTxt.description ?? (typeof pkg.description === "string" && pkg.description ? pkg.description : void 0);
+	if (description) config.description = description;
+	if (resolved.llmsTxt.origin) config.origin = resolved.llmsTxt.origin;
+	if (resolved.llmsTxt.include) config.include = resolved.llmsTxt.include;
+	return config;
+}
 function createApplyRouteLoaderHintsSource() {
 	return [
 		"function applyRouteLoaderHints(resolvedApp, routeLoaderHints) {",
@@ -1618,6 +1958,7 @@ function createPrachtRegistryModuleSource(options = {}) {
 		`export const middlewareModules = import.meta.glob(${JSON.stringify(`${resolved.middlewareDir}/**/*.{ts,tsx,js,jsx}`)});`,
 		`export const apiModules = import.meta.glob(${JSON.stringify(`${resolved.apiDir}/**/*.{ts,js,tsx,jsx}`)});`,
 		`export const dataModules = import.meta.glob(${JSON.stringify(`${resolved.serverDir}/**/*.{ts,js,tsx,jsx}`)});`,
+		`export const capabilityModules = import.meta.glob(${JSON.stringify(`${resolved.capabilitiesDir}/**/*.{ts,js,tsx,jsx}`)});`,
 		"",
 		"export const registry = {",
 		"  routeModules,",
@@ -1625,6 +1966,7 @@ function createPrachtRegistryModuleSource(options = {}) {
 		"  middlewareModules,",
 		"  apiModules,",
 		"  dataModules,",
+		"  capabilityModules,",
 		"};"
 	].join("\n");
 }
@@ -1654,9 +1996,14 @@ function generatePagesAppInlineSource(options, root = process.cwd()) {
 const BODYLESS_METHODS = new Set(["GET", "HEAD"]);
 const DEFAULT_MAX_BODY_SIZE = 1024 * 1024;
 const DEVTOOLS_JSON_PATH = "/_pracht.json";
+const LLMS_TXT_PATH = "/llms.txt";
 function createDevSSRMiddleware(server, options = {}) {
 	const maxBodySize = options.maxBodySize ?? DEFAULT_MAX_BODY_SIZE;
 	let warnedDevtoolsCollision = false;
+	let warnedLlmsTxtCollision = false;
+	if (options.llmsTxt && typeof server.config.publicDir === "string") {
+		if (existsSync(join(server.config.publicDir, "llms.txt"))) server.config.logger.warn("[pracht] Both public/llms.txt and the pracht({ llmsTxt }) option are present. Dev serves the static public/llms.txt, but \"pracht build\" overwrites it with the generated content. Remove one to avoid a dev/production mismatch.");
+	}
 	return async (req, res, next) => {
 		const url = req.url ?? "/";
 		const requestUrl = new URL(url, "http://localhost");
@@ -1681,6 +2028,17 @@ function createDevSSRMiddleware(server, options = {}) {
 				});
 				return;
 			}
+			if (options.llmsTxt && requestUrl.pathname === "/llms.txt" && BODYLESS_METHODS.has((req.method ?? "GET").toUpperCase()) && typeof serverMod.generateLlmsTxt === "function") {
+				if (!warnedLlmsTxtCollision && matchesResolvedRoute("/llms.txt", routeMatchers)) {
+					warnedLlmsTxtCollision = true;
+					server.config.logger.warn(`[pracht] An app route matches ${LLMS_TXT_PATH}, which is reserved by the pracht({ llmsTxt }) option. The generated llms.txt wins; disable the option to serve the app route instead.`);
+				}
+				const llmsTxt = await serverMod.generateLlmsTxt();
+				res.statusCode = 200;
+				res.setHeader("content-type", "text/plain; charset=utf-8");
+				res.end(llmsTxt);
+				return;
+			}
 			if (shouldBypassDevSSR(requestUrl, req, routeMatchers)) return next();
 			if (isDevNotFoundRequest(requestUrl, req, routeMatchers)) return serveDevNotFound(server, res, next, url, requestUrl.pathname, routeMatchers);
 			let webRequest;
@@ -1704,7 +2062,8 @@ function createDevSSRMiddleware(server, options = {}) {
 				apiRoutes: serverMod.apiRoutes,
 				timings
 			});
-			if (response.status === 404 && !routeMatchers.app?.notFound) return next();
+			const responseContentType = response.headers.get("content-type") ?? "";
+			if (response.status === 404 && !responseContentType.includes("application/json") && !routeMatchers.app?.notFound) return next();
 			const contentType = response.headers.get("content-type") ?? "text/html";
 			let body = await response.text();
 			if (contentType.includes("text/html")) body = await server.transformIndexHtml(url, body);
@@ -1726,10 +2085,13 @@ function createDevSSRMiddleware(server, options = {}) {
 */
 async function serveDevtools(server, res, options) {
 	const devtools = await server.ssrLoadModule("@pracht/core/devtools");
+	const capabilityModules = (await server.ssrLoadModule(PRACHT_SERVER_MODULE_ID)).registry?.capabilityModules;
 	const graph = await devtools.buildAppGraph({
 		apiRoutes: options.apiRoutes,
 		app: options.app,
-		loadModule: (file) => server.ssrLoadModule(file),
+		loadModule: async (file) => {
+			return await resolveRegistryModule(capabilityModules, file) ?? server.ssrLoadModule(file);
+		},
 		readSource: (file) => readFileSync(resolve(server.config.root, `.${file}`), "utf-8")
 	});
 	if (options.wantsJson) {
@@ -1960,16 +2322,20 @@ function pracht(options = {}) {
 			if (isIslandsClientModule(id)) return PRACHT_ISLANDS_CLIENT_MODULE_ID;
 			if (isClientModule(id)) return PRACHT_CLIENT_MODULE_ID;
 			if (isServerModule(id)) return PRACHT_SERVER_MODULE_ID;
+			if (isCapabilitiesModule(id)) return PRACHT_CAPABILITIES_MODULE_ID;
+			if (isWebmcpModule(id)) return PRACHT_WEBMCP_MODULE_ID;
 			if (id === "@pracht/core/env/server" && !resolveIdOptions?.ssr && !resolveIdOptions?.scan) throw new Error(`[pracht] ${JSON.stringify(SERVER_ENV_MODULE_ID)} was imported by ${JSON.stringify(importer ?? "unknown module")} in client code. serverEnv is server-only — read it inside loaders, middleware, or API routes, or use publicEnv (PRACHT_PUBLIC_-prefixed variables) from "@pracht/core" instead.`);
 			return null;
 		},
 		load(id) {
-			if (isIslandsClientModule(id)) return createPrachtIslandsClientModuleSource(resolved);
+			if (isIslandsClientModule(id)) return createPrachtIslandsClientModuleSource(resolved, { root });
 			if (isClientModule(id)) return createPrachtClientModuleSource(resolved, { root });
 			if (isServerModule(id)) return createPrachtServerModuleSource(resolved, {
 				root,
 				isBuild
 			});
+			if (isCapabilitiesModule(id)) return createPrachtCapabilitiesClientModuleSource(resolved, { root });
+			if (isWebmcpModule(id)) return createPrachtWebmcpModuleSource(resolved, { root });
 			return null;
 		},
 		transform(code, id) {
@@ -1986,7 +2352,10 @@ function pracht(options = {}) {
 			if (isPagesMode) watchPagesDirectory(server, resolved, root);
 			if (resolved.adapter.ownsDevServer) return;
 			return () => {
-				server.middlewares.use(createDevSSRMiddleware(server, { maxBodySize: resolved.maxBodySize }));
+				server.middlewares.use(createDevSSRMiddleware(server, {
+					llmsTxt: !!resolved.llmsTxt,
+					maxBodySize: resolved.maxBodySize
+				}));
 			};
 		},
 		handleHotUpdate({ file, server }) {
@@ -2008,7 +2377,8 @@ function pracht(options = {}) {
 				resolved.middlewareDir,
 				resolved.apiDir,
 				resolved.serverDir,
-				resolved.islandsDir
+				resolved.islandsDir,
+				resolved.capabilitiesDir
 			].some((dir) => relative.startsWith(dir))) {
 				const serverMod = server.moduleGraph.getModuleById(PRACHT_SERVER_MODULE_ID);
 				if (serverMod) server.moduleGraph.invalidateModule(serverMod);
@@ -2020,6 +2390,15 @@ function pracht(options = {}) {
 					const islandsMod = server.moduleGraph.getModuleById(PRACHT_ISLANDS_CLIENT_MODULE_ID);
 					if (islandsMod) server.moduleGraph.invalidateModule(islandsMod);
 				}
+				if (relative.startsWith(resolved.capabilitiesDir)) for (const moduleId of [
+					PRACHT_CAPABILITIES_MODULE_ID,
+					PRACHT_WEBMCP_MODULE_ID,
+					PRACHT_CLIENT_MODULE_ID,
+					PRACHT_ISLANDS_CLIENT_MODULE_ID
+				]) {
+					const capabilityMod = server.moduleGraph.getModuleById(moduleId);
+					if (capabilityMod) server.moduleGraph.invalidateModule(capabilityMod);
+				}
 			}
 		}
 	};
@@ -2112,7 +2491,8 @@ function createPrachtOptimizeDepsEntries(resolved) {
 		`${toOptimizeDepsEntry(resolved.middlewareDir)}/**/*.${scriptExtensions}`,
 		`${toOptimizeDepsEntry(resolved.apiDir)}/**/*.{ts,js,tsx,jsx}`,
 		`${toOptimizeDepsEntry(resolved.serverDir)}/**/*.{ts,js,tsx,jsx}`,
-		`${toOptimizeDepsEntry(resolved.islandsDir)}/**/*.${scriptExtensions}`
+		`${toOptimizeDepsEntry(resolved.islandsDir)}/**/*.${scriptExtensions}`,
+		`${toOptimizeDepsEntry(resolved.capabilitiesDir)}/**/*.{ts,js,tsx,jsx}`
 	];
 	return [...new Set(entries.filter(Boolean))];
 }
@@ -2180,4 +2560,4 @@ function withTrailingSep(p) {
 	return p.endsWith("/") ? p : `${p}/`;
 }
 //#endregion
-export { PRACHT_CLIENT_MODULE_ID, PRACHT_ISLANDS_CLIENT_MODULE_ID, PRACHT_SERVER_MODULE_ID, PUBLIC_ENV_PREFIX, VITE_BUILTIN_ENV_VARS, createEnvSafetyPlugin, createPrachtClientModuleSource, createPrachtIslandsClientModuleSource, createPrachtRegistryModuleSource, createPrachtServerModuleSource, formatEnvLeakError, pracht, scanCodeForEnvLeaks };
+export { PRACHT_CAPABILITIES_MODULE_ID, PRACHT_CLIENT_MODULE_ID, PRACHT_ISLANDS_CLIENT_MODULE_ID, PRACHT_SERVER_MODULE_ID, PRACHT_WEBMCP_MODULE_ID, PUBLIC_ENV_PREFIX, VITE_BUILTIN_ENV_VARS, createEnvSafetyPlugin, createPrachtCapabilitiesClientModuleSource, createPrachtClientModuleSource, createPrachtIslandsClientModuleSource, createPrachtRegistryModuleSource, createPrachtServerModuleSource, createPrachtWebmcpModuleSource, extractCapabilities, formatEnvLeakError, pracht, scanCodeForEnvLeaks };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pracht/vite-plugin",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "Vite plugin for Pracht apps with virtual modules, dev SSR, prerendering, route inspection, and multi-adapter builds.",
   "keywords": [
     "pracht",
@@ -44,9 +44,10 @@
   "dependencies": {
     "@preact/preset-vite": "^2.10.5",
     "@prefresh/vite": "^2.0.0",
-    "@pracht/adapter-node": "0.3.2",
-    "@pracht/core": "0.10.2",
-    "@pracht/preact-ssr-precompile": "0.1.2"
+    "@pracht/adapter-node": "0.3.3",
+    "@pracht/core": "0.11.0",
+    "@pracht/preact-ssr-precompile": "0.1.2",
+    "@pracht/capabilities": "0.1.0"
   },
   "peerDependencies": {
     "vite": "^8.0.0"