@robinbraemer/codemode 0.1.0

package/dist/codemode-DbXujxeq.d.ts

@@ -0,0 +1,198 @@
+/**
+ * Result from executing sandboxed code.
+ */
+interface ExecuteResult {
+    result: unknown;
+    error?: string;
+    logs: string[];
+}
+/**
+ * Sandbox executor interface. Implement this to use a custom sandbox runtime.
+ *
+ * Built-in implementations:
+ * - `IsolatedVMExecutor` (requires `isolated-vm` peer dependency)
+ * - `QuickJSExecutor` (requires `quickjs-emscripten` peer dependency)
+ */
+interface Executor {
+    /**
+     * Execute JavaScript code in a sandboxed environment.
+     *
+     * @param code - An async arrow function as a string, e.g. `async () => { ... }`
+     * @param globals - Named globals to inject into the sandbox. Each value is either:
+     *   - A plain object/array/primitive (injected as a frozen read-only value)
+     *   - A function (injected as a callable host function)
+     *   - An object with function values (injected as a namespace with callable methods)
+     */
+    execute(code: string, globals: Record<string, unknown>): Promise<ExecuteResult>;
+    /** Clean up resources. */
+    dispose?(): void;
+}
+/**
+ * Options for configuring the sandbox executor.
+ */
+interface SandboxOptions {
+    /** Memory limit in MB (default: 64) */
+    memoryMB?: number;
+    /** Execution timeout in ms (default: 30000) */
+    timeoutMs?: number;
+}
+/**
+ * A fetch-compatible request handler.
+ * Works with Hono's `app.request()`, standard `fetch`, or any function
+ * that takes a Request and returns a Response.
+ */
+type RequestHandler = (input: string | URL | Request, init?: RequestInit) => Response | Promise<Response>;
+/**
+ * OpenAPI specification object (JSON-parsed OpenAPI 3.x document).
+ */
+type OpenAPISpec = {
+    openapi?: string;
+    info?: {
+        title?: string;
+        version?: string;
+        description?: string;
+    };
+    paths?: Record<string, unknown>;
+    [key: string]: unknown;
+};
+/**
+ * Spec provider: a static spec, a URL to fetch, or an async getter function.
+ */
+type SpecProvider = OpenAPISpec | (() => OpenAPISpec | Promise<OpenAPISpec>);
+/**
+ * Options for creating a CodeMode instance.
+ */
+interface CodeModeOptions {
+    /**
+     * OpenAPI spec or async getter that returns one.
+     * The spec is made available inside the `search()` tool as a `spec` global.
+     */
+    spec: SpecProvider;
+    /**
+     * Fetch-compatible request handler for API calls from the `execute()` tool.
+     *
+     * For Hono: `app.request.bind(app)` (in-process, no network hop)
+     * For standard fetch: `fetch` or any `(Request) => Response` function
+     */
+    request: RequestHandler;
+    /**
+     * Namespace for the client object inside the execute sandbox.
+     * Default: `"api"`
+     *
+     * Example: with namespace "cnap", sandbox code calls `cnap.request(...)`.
+     */
+    namespace?: string;
+    /**
+     * Base URL prepended to relative paths in sandbox requests.
+     * Default: `"http://localhost"`
+     *
+     * Only used when the sandbox code provides a relative path like `/v1/clusters`.
+     * For Hono app.request(), any base URL works since it doesn't hit the network.
+     */
+    baseUrl?: string;
+    /**
+     * Sandbox configuration.
+     */
+    sandbox?: SandboxOptions;
+    /**
+     * Custom executor instance. If not provided, auto-detects
+     * isolated-vm or quickjs-emscripten from installed peer dependencies.
+     */
+    executor?: Executor;
+}
+/**
+ * MCP tool definition (compatible with @modelcontextprotocol/sdk).
+ */
+interface ToolDefinition {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: Record<string, unknown>;
+        required?: string[];
+    };
+}
+/**
+ * MCP tool call result.
+ */
+interface ToolCallResult {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}
+
+/**
+ * CodeMode provides `search` and `execute` MCP tools that let an AI agent
+ * discover and call your API by writing JavaScript code in a sandboxed runtime.
+ *
+ * Instead of defining hundreds of individual MCP tools (one per API endpoint),
+ * CodeMode exposes just two tools:
+ * - `search` — the agent writes JS to filter your OpenAPI spec
+ * - `execute` — the agent writes JS to call your API via a typed client
+ *
+ * @example
+ * ```ts
+ * import { CodeMode } from 'codemode';
+ * import { Hono } from 'hono';
+ *
+ * const app = new Hono();
+ * // ... define routes ...
+ *
+ * const codemode = new CodeMode({
+ *   spec: () => generateOpenAPISpec(app),
+ *   request: app.request.bind(app),
+ *   namespace: 'cnap',
+ * });
+ *
+ * // Get MCP tool definitions
+ * const tools = codemode.tools();
+ *
+ * // Handle a tool call
+ * const result = await codemode.callTool('search', { code: 'async () => ...' });
+ * ```
+ */
+declare class CodeMode {
+    private specProvider;
+    private requestBridge;
+    private namespace;
+    private executor;
+    private executorPromise;
+    private options;
+    private searchToolName;
+    private executeToolName;
+    constructor(options: CodeModeOptions);
+    /**
+     * Override the default tool names.
+     */
+    setToolNames(search: string, execute: string): this;
+    /**
+     * Returns MCP tool definitions for search and execute.
+     */
+    tools(): ToolDefinition[];
+    /**
+     * Handle an MCP tool call.
+     */
+    callTool(toolName: string, args: {
+        code: string;
+    }): Promise<ToolCallResult>;
+    /**
+     * Execute a search against the OpenAPI spec.
+     * The code runs in a sandbox with `spec` available as a global.
+     */
+    search(code: string): Promise<ToolCallResult>;
+    /**
+     * Execute API calls in the sandbox.
+     * The code runs with `{namespace}.request()` available as a global.
+     */
+    execute(code: string): Promise<ToolCallResult>;
+    /**
+     * Clean up sandbox resources.
+     */
+    dispose(): void;
+    private resolveSpec;
+    private getExecutor;
+}
+
+export { CodeMode as C, type Executor as E, type OpenAPISpec as O, type RequestHandler as R, type SandboxOptions as S, type ToolCallResult as T, type ExecuteResult as a, type CodeModeOptions as b, type SpecProvider as c, type ToolDefinition as d };

package/dist/index.d.ts

@@ -0,0 +1,69 @@
+import { E as Executor, S as SandboxOptions, a as ExecuteResult, R as RequestHandler } from './codemode-DbXujxeq.js';
+export { C as CodeMode, b as CodeModeOptions, O as OpenAPISpec, c as SpecProvider, T as ToolCallResult, d as ToolDefinition } from './codemode-DbXujxeq.js';
+
+/**
+ * Executor implementation using isolated-vm (V8 isolates).
+ * Requires `isolated-vm` v6+ as a peer dependency.
+ *
+ * Each execute() call creates a fresh V8 isolate with its own heap — no state
+ * leaks between calls. The sandbox has zero I/O capabilities by default (no
+ * fetch, no fs, no require). The only way out is through injected host functions.
+ */
+declare class IsolatedVMExecutor implements Executor {
+    private memoryMB;
+    private timeoutMs;
+    constructor(options?: SandboxOptions);
+    execute(code: string, globals: Record<string, unknown>): Promise<ExecuteResult>;
+}
+
+/**
+ * Executor implementation using quickjs-emscripten (QuickJS compiled to WASM).
+ * Requires `quickjs-emscripten` as a peer dependency.
+ *
+ * Advantages over isolated-vm:
+ * - Pure WASM, no native dependencies (works everywhere including Bun)
+ * - WASM-level sandbox isolation
+ *
+ * Tradeoffs:
+ * - ~3-5x slower than V8 for compute (negligible for API orchestration)
+ * - Only one async suspension at a time per module
+ */
+declare class QuickJSExecutor implements Executor {
+    private memoryBytes;
+    private timeoutMs;
+    constructor(options?: SandboxOptions);
+    execute(code: string, globals: Record<string, unknown>): Promise<ExecuteResult>;
+}
+
+/**
+ * Auto-detect and create an executor from available peer dependencies.
+ * Tries isolated-vm first, then quickjs-emscripten.
+ */
+declare function createExecutor(options?: SandboxOptions): Promise<Executor>;
+
+/**
+ * Options for a sandbox request call.
+ * This is what the LLM-generated code passes to `{namespace}.request()`.
+ */
+interface SandboxRequestOptions {
+    method: string;
+    path: string;
+    query?: Record<string, string | number | boolean>;
+    body?: unknown;
+    headers?: Record<string, string>;
+}
+/**
+ * Response returned to the sandbox from a request call.
+ */
+interface SandboxResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: unknown;
+}
+/**
+ * Creates the `request()` function that gets injected into the execute sandbox.
+ * Bridges sandbox API calls to the host request handler (Hono app.request, fetch, etc.).
+ */
+declare function createRequestBridge(handler: RequestHandler, baseUrl: string): (options: SandboxRequestOptions) => Promise<SandboxResponse>;
+
+export { ExecuteResult, Executor, IsolatedVMExecutor, QuickJSExecutor, RequestHandler, SandboxOptions, type SandboxRequestOptions, type SandboxResponse, createExecutor, createRequestBridge };

package/dist/index.js

@@ -0,0 +1,308 @@
+import {
+  IsolatedVMExecutor
+} from "./chunk-NSUQUO7S.js";
+import {
+  QuickJSExecutor
+} from "./chunk-ZWSO33DZ.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/executor/auto.ts
+async function createExecutor(options = {}) {
+  try {
+    await import("isolated-vm");
+    const { IsolatedVMExecutor: IsolatedVMExecutor2 } = await import("./isolated-vm-57EIYEJM.js");
+    return new IsolatedVMExecutor2(options);
+  } catch {
+  }
+  try {
+    await import("quickjs-emscripten");
+    const { QuickJSExecutor: QuickJSExecutor2 } = await import("./quickjs-BGVQS2YE.js");
+    return new QuickJSExecutor2(options);
+  } catch {
+  }
+  throw new Error(
+    "No sandbox runtime found. Install one of:\n  npm install isolated-vm    # V8 isolates, fastest (Node.js only)\n  npm install quickjs-emscripten  # WASM sandbox, portable (Node.js, Bun, browsers)"
+  );
+}
+
+// src/request-bridge.ts
+function createRequestBridge(handler, baseUrl) {
+  return async (options) => {
+    const { method, path, query, body, headers } = options;
+    const url = new URL(path, baseUrl);
+    if (query) {
+      for (const [key, value] of Object.entries(query)) {
+        url.searchParams.set(key, String(value));
+      }
+    }
+    const init = {
+      method: method.toUpperCase(),
+      headers: {
+        ...headers
+      }
+    };
+    if (body !== void 0 && body !== null) {
+      init.body = JSON.stringify(body);
+      init.headers["content-type"] = init.headers["content-type"] ?? "application/json";
+    }
+    const response = await handler(url.toString(), init);
+    const responseHeaders = {};
+    response.headers.forEach((value, key) => {
+      responseHeaders[key] = value;
+    });
+    const contentType = response.headers.get("content-type") ?? "";
+    let responseBody;
+    if (contentType.includes("application/json")) {
+      try {
+        responseBody = await response.json();
+      } catch {
+        responseBody = await response.text();
+      }
+    } else {
+      responseBody = await response.text();
+    }
+    return {
+      status: response.status,
+      headers: responseHeaders,
+      body: responseBody
+    };
+  };
+}
+
+// src/tools.ts
+function createSearchToolDefinition(toolName) {
+  return {
+    name: toolName,
+    description: `Search the API specification to discover available endpoints.
+
+Write an async JavaScript arrow function that filters and explores the \`spec\` object (an OpenAPI 3.x document). The full spec is available as a global variable.
+
+Common patterns:
+- Find endpoints by path: \`spec.paths\` is an object keyed by path string
+- Each path has HTTP methods (get, post, put, delete, patch) as keys
+- Each operation has: summary, description, parameters, requestBody, responses
+- Use spec.components.schemas for data models
+
+Examples:
+  // Find all cluster-related endpoints
+  async () => {
+    return Object.entries(spec.paths)
+      .filter(([p]) => p.includes('/clusters'))
+      .flatMap(([path, methods]) =>
+        Object.entries(methods)
+          .filter(([m]) => ['get','post','put','delete','patch'].includes(m))
+          .map(([method, op]) => ({
+            method: method.toUpperCase(), path, summary: op.summary
+          }))
+      );
+  }
+
+  // Get the schema for a specific model
+  async () => {
+    return spec.components?.schemas?.Product;
+  }
+
+Return the matching endpoints/schemas as a structured result the agent can use to plan execute() calls.`,
+    inputSchema: {
+      type: "object",
+      properties: {
+        code: {
+          type: "string",
+          description: "An async JavaScript arrow function that searches the `spec` object. Must return a value."
+        }
+      },
+      required: ["code"]
+    }
+  };
+}
+function createExecuteToolDefinition(toolName, namespace) {
+  return {
+    name: toolName,
+    description: `Execute API calls by writing JavaScript code.
+
+Write an async JavaScript arrow function that uses \`${namespace}.request()\` to make API calls. The request function handles authentication automatically.
+
+\`${namespace}.request(options)\` takes:
+  - method: HTTP method string ("GET", "POST", "PUT", "DELETE", "PATCH")
+  - path: API path string (e.g. "/v1/clusters")
+  - query: optional object of query parameters
+  - body: optional request body (will be JSON-serialized)
+  - headers: optional object of additional headers
+
+Returns: { status: number, headers: object, body: unknown }
+
+Examples:
+  // List resources
+  async () => {
+    const res = await ${namespace}.request({ method: "GET", path: "/v1/clusters" });
+    return res.body;
+  }
+
+  // Create a resource
+  async () => {
+    return ${namespace}.request({
+      method: "POST",
+      path: "/v1/products",
+      body: { name: "My Product", chart: "nginx" }
+    });
+  }
+
+  // Chain multiple calls
+  async () => {
+    const clusters = await ${namespace}.request({ method: "GET", path: "/v1/clusters" });
+    const details = await Promise.all(
+      clusters.body.map(c =>
+        ${namespace}.request({ method: "GET", path: \`/v1/clusters/\${c.id}\` })
+      )
+    );
+    return details.map(d => d.body);
+  }
+
+Write clean, focused code. Return the data the user needs.`,
+    inputSchema: {
+      type: "object",
+      properties: {
+        code: {
+          type: "string",
+          description: `An async JavaScript arrow function that uses \`${namespace}.request()\` to make API calls.`
+        }
+      },
+      required: ["code"]
+    }
+  };
+}
+
+// src/codemode.ts
+var CodeMode = class {
+  specProvider;
+  requestBridge;
+  namespace;
+  executor;
+  executorPromise = null;
+  options;
+  searchToolName;
+  executeToolName;
+  constructor(options) {
+    this.options = options;
+    this.specProvider = options.spec;
+    this.namespace = options.namespace ?? "api";
+    this.executor = options.executor ?? null;
+    this.searchToolName = "search";
+    this.executeToolName = "execute";
+    const baseUrl = options.baseUrl ?? "http://localhost";
+    const bridge = createRequestBridge(options.request, baseUrl);
+    this.requestBridge = (...args) => bridge(args[0]);
+  }
+  /**
+   * Override the default tool names.
+   */
+  setToolNames(search, execute) {
+    this.searchToolName = search;
+    this.executeToolName = execute;
+    return this;
+  }
+  /**
+   * Returns MCP tool definitions for search and execute.
+   */
+  tools() {
+    return [
+      createSearchToolDefinition(this.searchToolName),
+      createExecuteToolDefinition(this.executeToolName, this.namespace)
+    ];
+  }
+  /**
+   * Handle an MCP tool call.
+   */
+  async callTool(toolName, args) {
+    if (toolName === this.searchToolName) {
+      return this.search(args.code);
+    }
+    if (toolName === this.executeToolName) {
+      return this.execute(args.code);
+    }
+    return {
+      content: [{ type: "text", text: `Unknown tool: ${toolName}` }],
+      isError: true
+    };
+  }
+  /**
+   * Execute a search against the OpenAPI spec.
+   * The code runs in a sandbox with `spec` available as a global.
+   */
+  async search(code) {
+    const executor = await this.getExecutor();
+    const spec = await this.resolveSpec();
+    const result = await executor.execute(code, { spec });
+    return formatResult(result);
+  }
+  /**
+   * Execute API calls in the sandbox.
+   * The code runs with `{namespace}.request()` available as a global.
+   */
+  async execute(code) {
+    const executor = await this.getExecutor();
+    const client = {
+      request: this.requestBridge
+    };
+    const result = await executor.execute(code, {
+      [this.namespace]: client
+    });
+    return formatResult(result);
+  }
+  /**
+   * Clean up sandbox resources.
+   */
+  dispose() {
+    this.executor?.dispose?.();
+  }
+  async resolveSpec() {
+    if (typeof this.specProvider === "function") {
+      return await this.specProvider();
+    }
+    return this.specProvider;
+  }
+  async getExecutor() {
+    if (this.executor) return this.executor;
+    if (!this.executorPromise) {
+      this.executorPromise = createExecutor(this.options.sandbox).then(
+        (executor) => {
+          this.executor = executor;
+          return executor;
+        }
+      );
+    }
+    return this.executorPromise;
+  }
+};
+function formatResult(result) {
+  if (result.error) {
+    const parts2 = [];
+    if (result.logs.length > 0) {
+      parts2.push(`Console output:
+${result.logs.join("\n")}`);
+    }
+    parts2.push(`Error: ${result.error}`);
+    return {
+      content: [{ type: "text", text: parts2.join("\n\n") }],
+      isError: true
+    };
+  }
+  const parts = [];
+  if (result.logs.length > 0) {
+    parts.push(`Console output:
+${result.logs.join("\n")}`);
+  }
+  const resultText = typeof result.result === "string" ? result.result : JSON.stringify(result.result, null, 2);
+  parts.push(resultText);
+  return {
+    content: [{ type: "text", text: parts.join("\n\n") }]
+  };
+}
+export {
+  CodeMode,
+  IsolatedVMExecutor,
+  QuickJSExecutor,
+  createExecutor,
+  createRequestBridge
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/executor/auto.ts","../src/request-bridge.ts","../src/tools.ts","../src/codemode.ts"],"sourcesContent":["import type { Executor, SandboxOptions } from \"../types.js\";\n\n/**\n * Auto-detect and create an executor from available peer dependencies.\n * Tries isolated-vm first, then quickjs-emscripten.\n */\nexport async function createExecutor(\n  options: SandboxOptions = {},\n): Promise<Executor> {\n  // Try isolated-vm first (faster, V8-native)\n  try {\n    // @ts-ignore — optional peer dependency\n    await import(\"isolated-vm\");\n    const { IsolatedVMExecutor } = await import(\"./isolated-vm.js\");\n    return new IsolatedVMExecutor(options);\n  } catch {\n    // Not available\n  }\n\n  // Try quickjs-emscripten (portable WASM)\n  try {\n    await import(\"quickjs-emscripten\");\n    const { QuickJSExecutor } = await import(\"./quickjs.js\");\n    return new QuickJSExecutor(options);\n  } catch {\n    // Not available\n  }\n\n  throw new Error(\n    \"No sandbox runtime found. Install one of:\\n\" +\n      \"  npm install isolated-vm    # V8 isolates, fastest (Node.js only)\\n\" +\n      \"  npm install quickjs-emscripten  # WASM sandbox, portable (Node.js, Bun, browsers)\",\n  );\n}\n","import type { RequestHandler } from \"./types.js\";\n\n/**\n * Options for a sandbox request call.\n * This is what the LLM-generated code passes to `{namespace}.request()`.\n */\nexport interface SandboxRequestOptions {\n  method: string;\n  path: string;\n  query?: Record<string, string | number | boolean>;\n  body?: unknown;\n  headers?: Record<string, string>;\n}\n\n/**\n * Response returned to the sandbox from a request call.\n */\nexport interface SandboxResponse {\n  status: number;\n  headers: Record<string, string>;\n  body: unknown;\n}\n\n/**\n * Creates the `request()` function that gets injected into the execute sandbox.\n * Bridges sandbox API calls to the host request handler (Hono app.request, fetch, etc.).\n */\nexport function createRequestBridge(\n  handler: RequestHandler,\n  baseUrl: string,\n): (options: SandboxRequestOptions) => Promise<SandboxResponse> {\n  return async (options: SandboxRequestOptions): Promise<SandboxResponse> => {\n    const { method, path, query, body, headers } = options;\n\n    // Build URL\n    const url = new URL(path, baseUrl);\n    if (query) {\n      for (const [key, value] of Object.entries(query)) {\n        url.searchParams.set(key, String(value));\n      }\n    }\n\n    // Build request init\n    const init: RequestInit = {\n      method: method.toUpperCase(),\n      headers: {\n        ...headers,\n      },\n    };\n\n    if (body !== undefined && body !== null) {\n      init.body = JSON.stringify(body);\n      (init.headers as Record<string, string>)[\"content-type\"] =\n        (init.headers as Record<string, string>)[\"content-type\"] ?? \"application/json\";\n    }\n\n    // Call the host handler\n    const response = await handler(url.toString(), init);\n\n    // Parse response\n    const responseHeaders: Record<string, string> = {};\n    response.headers.forEach((value, key) => {\n      responseHeaders[key] = value;\n    });\n\n    const contentType = response.headers.get(\"content-type\") ?? \"\";\n    let responseBody: unknown;\n    if (contentType.includes(\"application/json\")) {\n      try {\n        responseBody = await response.json();\n      } catch {\n        responseBody = await response.text();\n      }\n    } else {\n      responseBody = await response.text();\n    }\n\n    return {\n      status: response.status,\n      headers: responseHeaders,\n      body: responseBody,\n    };\n  };\n}\n","import type { ToolDefinition } from \"./types.js\";\n\nexport function createSearchToolDefinition(toolName: string): ToolDefinition {\n  return {\n    name: toolName,\n    description: `Search the API specification to discover available endpoints.\n\nWrite an async JavaScript arrow function that filters and explores the \\`spec\\` object (an OpenAPI 3.x document). The full spec is available as a global variable.\n\nCommon patterns:\n- Find endpoints by path: \\`spec.paths\\` is an object keyed by path string\n- Each path has HTTP methods (get, post, put, delete, patch) as keys\n- Each operation has: summary, description, parameters, requestBody, responses\n- Use spec.components.schemas for data models\n\nExamples:\n  // Find all cluster-related endpoints\n  async () => {\n    return Object.entries(spec.paths)\n      .filter(([p]) => p.includes('/clusters'))\n      .flatMap(([path, methods]) =>\n        Object.entries(methods)\n          .filter(([m]) => ['get','post','put','delete','patch'].includes(m))\n          .map(([method, op]) => ({\n            method: method.toUpperCase(), path, summary: op.summary\n          }))\n      );\n  }\n\n  // Get the schema for a specific model\n  async () => {\n    return spec.components?.schemas?.Product;\n  }\n\nReturn the matching endpoints/schemas as a structured result the agent can use to plan execute() calls.`,\n    inputSchema: {\n      type: \"object\",\n      properties: {\n        code: {\n          type: \"string\",\n          description:\n            \"An async JavaScript arrow function that searches the `spec` object. Must return a value.\",\n        },\n      },\n      required: [\"code\"],\n    },\n  };\n}\n\nexport function createExecuteToolDefinition(\n  toolName: string,\n  namespace: string,\n): ToolDefinition {\n  return {\n    name: toolName,\n    description: `Execute API calls by writing JavaScript code.\n\nWrite an async JavaScript arrow function that uses \\`${namespace}.request()\\` to make API calls. The request function handles authentication automatically.\n\n\\`${namespace}.request(options)\\` takes:\n  - method: HTTP method string (\"GET\", \"POST\", \"PUT\", \"DELETE\", \"PATCH\")\n  - path: API path string (e.g. \"/v1/clusters\")\n  - query: optional object of query parameters\n  - body: optional request body (will be JSON-serialized)\n  - headers: optional object of additional headers\n\nReturns: { status: number, headers: object, body: unknown }\n\nExamples:\n  // List resources\n  async () => {\n    const res = await ${namespace}.request({ method: \"GET\", path: \"/v1/clusters\" });\n    return res.body;\n  }\n\n  // Create a resource\n  async () => {\n    return ${namespace}.request({\n      method: \"POST\",\n      path: \"/v1/products\",\n      body: { name: \"My Product\", chart: \"nginx\" }\n    });\n  }\n\n  // Chain multiple calls\n  async () => {\n    const clusters = await ${namespace}.request({ method: \"GET\", path: \"/v1/clusters\" });\n    const details = await Promise.all(\n      clusters.body.map(c =>\n        ${namespace}.request({ method: \"GET\", path: \\`/v1/clusters/\\${c.id}\\` })\n      )\n    );\n    return details.map(d => d.body);\n  }\n\nWrite clean, focused code. Return the data the user needs.`,\n    inputSchema: {\n      type: \"object\",\n      properties: {\n        code: {\n          type: \"string\",\n          description: `An async JavaScript arrow function that uses \\`${namespace}.request()\\` to make API calls.`,\n        },\n      },\n      required: [\"code\"],\n    },\n  };\n}\n","import { createExecutor } from \"./executor/auto.js\";\nimport { createRequestBridge } from \"./request-bridge.js\";\nimport { createExecuteToolDefinition, createSearchToolDefinition } from \"./tools.js\";\nimport type {\n  CodeModeOptions,\n  Executor,\n  OpenAPISpec,\n  SpecProvider,\n  ToolCallResult,\n  ToolDefinition,\n} from \"./types.js\";\n\n/**\n * CodeMode provides `search` and `execute` MCP tools that let an AI agent\n * discover and call your API by writing JavaScript code in a sandboxed runtime.\n *\n * Instead of defining hundreds of individual MCP tools (one per API endpoint),\n * CodeMode exposes just two tools:\n * - `search` — the agent writes JS to filter your OpenAPI spec\n * - `execute` — the agent writes JS to call your API via a typed client\n *\n * @example\n * ```ts\n * import { CodeMode } from 'codemode';\n * import { Hono } from 'hono';\n *\n * const app = new Hono();\n * // ... define routes ...\n *\n * const codemode = new CodeMode({\n *   spec: () => generateOpenAPISpec(app),\n *   request: app.request.bind(app),\n *   namespace: 'cnap',\n * });\n *\n * // Get MCP tool definitions\n * const tools = codemode.tools();\n *\n * // Handle a tool call\n * const result = await codemode.callTool('search', { code: 'async () => ...' });\n * ```\n */\nexport class CodeMode {\n  private specProvider: SpecProvider;\n  private requestBridge: (...args: unknown[]) => Promise<unknown>;\n  private namespace: string;\n  private executor: Executor | null;\n  private executorPromise: Promise<Executor> | null = null;\n  private options: CodeModeOptions;\n  private searchToolName: string;\n  private executeToolName: string;\n\n  constructor(options: CodeModeOptions) {\n    this.options = options;\n    this.specProvider = options.spec;\n    this.namespace = options.namespace ?? \"api\";\n    this.executor = options.executor ?? null;\n    this.searchToolName = \"search\";\n    this.executeToolName = \"execute\";\n\n    const baseUrl = options.baseUrl ?? \"http://localhost\";\n    const bridge = createRequestBridge(options.request, baseUrl);\n    this.requestBridge = (...args: unknown[]) => bridge(args[0] as any);\n  }\n\n  /**\n   * Override the default tool names.\n   */\n  setToolNames(search: string, execute: string): this {\n    this.searchToolName = search;\n    this.executeToolName = execute;\n    return this;\n  }\n\n  /**\n   * Returns MCP tool definitions for search and execute.\n   */\n  tools(): ToolDefinition[] {\n    return [\n      createSearchToolDefinition(this.searchToolName),\n      createExecuteToolDefinition(this.executeToolName, this.namespace),\n    ];\n  }\n\n  /**\n   * Handle an MCP tool call.\n   */\n  async callTool(\n    toolName: string,\n    args: { code: string },\n  ): Promise<ToolCallResult> {\n    if (toolName === this.searchToolName) {\n      return this.search(args.code);\n    }\n    if (toolName === this.executeToolName) {\n      return this.execute(args.code);\n    }\n    return {\n      content: [{ type: \"text\", text: `Unknown tool: ${toolName}` }],\n      isError: true,\n    };\n  }\n\n  /**\n   * Execute a search against the OpenAPI spec.\n   * The code runs in a sandbox with `spec` available as a global.\n   */\n  async search(code: string): Promise<ToolCallResult> {\n    const executor = await this.getExecutor();\n    const spec = await this.resolveSpec();\n\n    const result = await executor.execute(code, { spec });\n\n    return formatResult(result);\n  }\n\n  /**\n   * Execute API calls in the sandbox.\n   * The code runs with `{namespace}.request()` available as a global.\n   */\n  async execute(code: string): Promise<ToolCallResult> {\n    const executor = await this.getExecutor();\n\n    const client = {\n      request: this.requestBridge,\n    };\n\n    const result = await executor.execute(code, {\n      [this.namespace]: client,\n    });\n\n    return formatResult(result);\n  }\n\n  /**\n   * Clean up sandbox resources.\n   */\n  dispose(): void {\n    this.executor?.dispose?.();\n  }\n\n  private async resolveSpec(): Promise<OpenAPISpec> {\n    if (typeof this.specProvider === \"function\") {\n      return await this.specProvider();\n    }\n    return this.specProvider;\n  }\n\n  private async getExecutor(): Promise<Executor> {\n    if (this.executor) return this.executor;\n\n    // Lazy-init with deduplication\n    if (!this.executorPromise) {\n      this.executorPromise = createExecutor(this.options.sandbox).then(\n        (executor) => {\n          this.executor = executor;\n          return executor;\n        },\n      );\n    }\n    return this.executorPromise;\n  }\n}\n\nfunction formatResult(result: {\n  result: unknown;\n  error?: string;\n  logs: string[];\n}): ToolCallResult {\n  if (result.error) {\n    const parts: string[] = [];\n    if (result.logs.length > 0) {\n      parts.push(`Console output:\\n${result.logs.join(\"\\n\")}`);\n    }\n    parts.push(`Error: ${result.error}`);\n    return {\n      content: [{ type: \"text\", text: parts.join(\"\\n\\n\") }],\n      isError: true,\n    };\n  }\n\n  const parts: string[] = [];\n  if (result.logs.length > 0) {\n    parts.push(`Console output:\\n${result.logs.join(\"\\n\")}`);\n  }\n\n  const resultText =\n    typeof result.result === \"string\"\n      ? result.result\n      : JSON.stringify(result.result, null, 2);\n  parts.push(resultText);\n\n  return {\n    content: [{ type: \"text\", text: parts.join(\"\\n\\n\") }],\n  };\n}\n"],"mappings":";;;;;;;;;AAMA,eAAsB,eACpB,UAA0B,CAAC,GACR;AAEnB,MAAI;AAEF,UAAM,OAAO,aAAa;AAC1B,UAAM,EAAE,oBAAAA,oBAAmB,IAAI,MAAM,OAAO,2BAAkB;AAC9D,WAAO,IAAIA,oBAAmB,OAAO;AAAA,EACvC,QAAQ;AAAA,EAER;AAGA,MAAI;AACF,UAAM,OAAO,oBAAoB;AACjC,UAAM,EAAE,iBAAAC,iBAAgB,IAAI,MAAM,OAAO,uBAAc;AACvD,WAAO,IAAIA,iBAAgB,OAAO;AAAA,EACpC,QAAQ;AAAA,EAER;AAEA,QAAM,IAAI;AAAA,IACR;AAAA,EAGF;AACF;;;ACNO,SAAS,oBACd,SACA,SAC8D;AAC9D,SAAO,OAAO,YAA6D;AACzE,UAAM,EAAE,QAAQ,MAAM,OAAO,MAAM,QAAQ,IAAI;AAG/C,UAAM,MAAM,IAAI,IAAI,MAAM,OAAO;AACjC,QAAI,OAAO;AACT,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,YAAI,aAAa,IAAI,KAAK,OAAO,KAAK,CAAC;AAAA,MACzC;AAAA,IACF;AAGA,UAAM,OAAoB;AAAA,MACxB,QAAQ,OAAO,YAAY;AAAA,MAC3B,SAAS;AAAA,QACP,GAAG;AAAA,MACL;AAAA,IACF;AAEA,QAAI,SAAS,UAAa,SAAS,MAAM;AACvC,WAAK,OAAO,KAAK,UAAU,IAAI;AAC/B,MAAC,KAAK,QAAmC,cAAc,IACpD,KAAK,QAAmC,cAAc,KAAK;AAAA,IAChE;AAGA,UAAM,WAAW,MAAM,QAAQ,IAAI,SAAS,GAAG,IAAI;AAGnD,UAAM,kBAA0C,CAAC;AACjD,aAAS,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AACvC,sBAAgB,GAAG,IAAI;AAAA,IACzB,CAAC;AAED,UAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;AAC5D,QAAI;AACJ,QAAI,YAAY,SAAS,kBAAkB,GAAG;AAC5C,UAAI;AACF,uBAAe,MAAM,SAAS,KAAK;AAAA,MACrC,QAAQ;AACN,uBAAe,MAAM,SAAS,KAAK;AAAA,MACrC;AAAA,IACF,OAAO;AACL,qBAAe,MAAM,SAAS,KAAK;AAAA,IACrC;AAEA,WAAO;AAAA,MACL,QAAQ,SAAS;AAAA,MACjB,SAAS;AAAA,MACT,MAAM;AAAA,IACR;AAAA,EACF;AACF;;;ACjFO,SAAS,2BAA2B,UAAkC;AAC3E,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IA8Bb,aAAa;AAAA,MACX,MAAM;AAAA,MACN,YAAY;AAAA,QACV,MAAM;AAAA,UACJ,MAAM;AAAA,UACN,aACE;AAAA,QACJ;AAAA,MACF;AAAA,MACA,UAAU,CAAC,MAAM;AAAA,IACnB;AAAA,EACF;AACF;AAEO,SAAS,4BACd,UACA,WACgB;AAChB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa;AAAA;AAAA,uDAEsC,SAAS;AAAA;AAAA,IAE5D,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAYW,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAMpB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,6BASO,SAAS;AAAA;AAAA;AAAA,UAG5B,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOf,aAAa;AAAA,MACX,MAAM;AAAA,MACN,YAAY;AAAA,QACV,MAAM;AAAA,UACJ,MAAM;AAAA,UACN,aAAa,kDAAkD,SAAS;AAAA,QAC1E;AAAA,MACF;AAAA,MACA,UAAU,CAAC,MAAM;AAAA,IACnB;AAAA,EACF;AACF;;;ACjEO,IAAM,WAAN,MAAe;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,kBAA4C;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,SAA0B;AACpC,SAAK,UAAU;AACf,SAAK,eAAe,QAAQ;AAC5B,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,WAAW,QAAQ,YAAY;AACpC,SAAK,iBAAiB;AACtB,SAAK,kBAAkB;AAEvB,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,SAAS,oBAAoB,QAAQ,SAAS,OAAO;AAC3D,SAAK,gBAAgB,IAAI,SAAoB,OAAO,KAAK,CAAC,CAAQ;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,QAAgB,SAAuB;AAClD,SAAK,iBAAiB;AACtB,SAAK,kBAAkB;AACvB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,QAA0B;AACxB,WAAO;AAAA,MACL,2BAA2B,KAAK,cAAc;AAAA,MAC9C,4BAA4B,KAAK,iBAAiB,KAAK,SAAS;AAAA,IAClE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SACJ,UACA,MACyB;AACzB,QAAI,aAAa,KAAK,gBAAgB;AACpC,aAAO,KAAK,OAAO,KAAK,IAAI;AAAA,IAC9B;AACA,QAAI,aAAa,KAAK,iBAAiB;AACrC,aAAO,KAAK,QAAQ,KAAK,IAAI;AAAA,IAC/B;AACA,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,iBAAiB,QAAQ,GAAG,CAAC;AAAA,MAC7D,SAAS;AAAA,IACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,MAAuC;AAClD,UAAM,WAAW,MAAM,KAAK,YAAY;AACxC,UAAM,OAAO,MAAM,KAAK,YAAY;AAEpC,UAAM,SAAS,MAAM,SAAS,QAAQ,MAAM,EAAE,KAAK,CAAC;AAEpD,WAAO,aAAa,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,MAAuC;AACnD,UAAM,WAAW,MAAM,KAAK,YAAY;AAExC,UAAM,SAAS;AAAA,MACb,SAAS,KAAK;AAAA,IAChB;AAEA,UAAM,SAAS,MAAM,SAAS,QAAQ,MAAM;AAAA,MAC1C,CAAC,KAAK,SAAS,GAAG;AAAA,IACpB,CAAC;AAED,WAAO,aAAa,MAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKA,UAAgB;AACd,SAAK,UAAU,UAAU;AAAA,EAC3B;AAAA,EAEA,MAAc,cAAoC;AAChD,QAAI,OAAO,KAAK,iBAAiB,YAAY;AAC3C,aAAO,MAAM,KAAK,aAAa;AAAA,IACjC;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,cAAiC;AAC7C,QAAI,KAAK,SAAU,QAAO,KAAK;AAG/B,QAAI,CAAC,KAAK,iBAAiB;AACzB,WAAK,kBAAkB,eAAe,KAAK,QAAQ,OAAO,EAAE;AAAA,QAC1D,CAAC,aAAa;AACZ,eAAK,WAAW;AAChB,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AACF;AAEA,SAAS,aAAa,QAIH;AACjB,MAAI,OAAO,OAAO;AAChB,UAAMC,SAAkB,CAAC;AACzB,QAAI,OAAO,KAAK,SAAS,GAAG;AAC1B,MAAAA,OAAM,KAAK;AAAA,EAAoB,OAAO,KAAK,KAAK,IAAI,CAAC,EAAE;AAAA,IACzD;AACA,IAAAA,OAAM,KAAK,UAAU,OAAO,KAAK,EAAE;AACnC,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAMA,OAAM,KAAK,MAAM,EAAE,CAAC;AAAA,MACpD,SAAS;AAAA,IACX;AAAA,EACF;AAEA,QAAM,QAAkB,CAAC;AACzB,MAAI,OAAO,KAAK,SAAS,GAAG;AAC1B,UAAM,KAAK;AAAA,EAAoB,OAAO,KAAK,KAAK,IAAI,CAAC,EAAE;AAAA,EACzD;AAEA,QAAM,aACJ,OAAO,OAAO,WAAW,WACrB,OAAO,SACP,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC;AAC3C,QAAM,KAAK,UAAU;AAErB,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,EAAE,CAAC;AAAA,EACtD;AACF;","names":["IsolatedVMExecutor","QuickJSExecutor","parts"]}

package/dist/isolated-vm-57EIYEJM.js

@@ -0,0 +1,8 @@
+import {
+  IsolatedVMExecutor
+} from "./chunk-NSUQUO7S.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  IsolatedVMExecutor
+};
+//# sourceMappingURL=isolated-vm-57EIYEJM.js.map

package/dist/isolated-vm-57EIYEJM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/mcp.d.ts

@@ -0,0 +1,38 @@
+import { C as CodeMode } from './codemode-DbXujxeq.js';
+import { z } from 'zod';
+
+/**
+ * MCP server integration for CodeMode.
+ *
+ * This module provides helpers for integrating CodeMode with
+ * `@modelcontextprotocol/sdk`. Import from `codemode/mcp`.
+ *
+ * @example
+ * ```ts
+ * import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+ * import { CodeMode } from 'codemode';
+ * import { registerTools } from 'codemode/mcp';
+ *
+ * const codemode = new CodeMode({ spec, request: app.request.bind(app) });
+ * const server = new McpServer({ name: 'my-api', version: '1.0.0' });
+ *
+ * registerTools(codemode, server);
+ * ```
+ */
+
+/**
+ * Register CodeMode's search and execute tools on an MCP server.
+ *
+ * This uses the `@modelcontextprotocol/sdk` `McpServer.tool()` API
+ * to register both tools with proper Zod schemas.
+ */
+declare function registerTools(codemode: CodeMode, server: McpServerLike): void;
+/**
+ * Minimal interface for MCP server tool registration.
+ * Compatible with `McpServer` from `@modelcontextprotocol/sdk`.
+ */
+interface McpServerLike {
+    tool(name: string, description: string, schema: Record<string, z.ZodType>, handler: (args: Record<string, unknown>) => Promise<unknown>): void;
+}
+
+export { registerTools };