@xtrable-ltd/nanoesis 0.1.10 → 0.1.12

package/dist/index.d.ts

@@ -458,22 +458,108 @@ interface CompileInput {
 declare function compileTemplate(input: CompileInput): string;
 
 /**
- * Stamping decisions (PROPOSAL-template-versioning §4.1 + §6). `detectStamp` is pure —
- * given the old and new template sources, it decides whether a destructive change is
- * taking place and which tokens are removed / added. The actual snapshot write happens
- * inside {@link IndexedStore.write}'s auto-stamp path, which has direct access to the
- * underlying BlobStore (so it can write reserved-version paths that the public
- * `write` rejects); a standalone `stampSnapshot(store, ...)` for the manual
- * "Stamp version" action is deferred to Phase 2 when the editor's button + the
- * matching `/api/templates/stamp` route land.
+ * The field-type registry (DESIGN §6.7). Field types and their rules are defined
+ * *once* here and shared by the compiler, the editor's form generator, and (later)
+ * Monaco's IntelliSense. This is the OCP extension point (CLAUDE.md §3): adding a
+ * field type means adding an entry here, never editing a switch in the compiler or
+ * the inference cascade.
+ */
+type FieldType = 'image' | 'file' | 'url' | 'email' | 'phone' | 'date' | 'time' | 'code' | 'richtext' | 'authors' | 'text' | 'shorttext';
+/** How a resolved value is placed into output, the compiler reads this, never the type name. */
+type ValueKind = 'text' | 'html' | 'url' | 'asset' | 'authors';
+interface FieldTypeDef {
+    readonly type: FieldType;
+    readonly valueKind: ValueKind;
+    /** Default editor control hint, consumed by the form generator (DESIGN §7). */
+    readonly control: string;
+    readonly multiline: boolean;
+}
+declare const FIELD_TYPES: Readonly<Record<FieldType, FieldTypeDef>>;
+declare function isFieldType(value: string): value is FieldType;
+declare function valueKindOf(type: FieldType): ValueKind;
+
+/**
+ * Derive the editor's form from a template, "the template is the schema"
+ * (DESIGN §5.5/§6). Walking the same parse the compiler uses, each page-scope
+ * token becomes one field whose control is inferred from where it sits, deduped by
+ * name and labelled. This is the single source of truth the editor's form
+ * generator and the compiler share (DESIGN §6.7).
+ *
+ * Inference is **component-aware**: when a component is used (`<doc file="{x}">`),
+ * the bound field's type comes from how that prop is used *inside* the component,
+ * not from the attribute's position on the usage. A component's prop types are
+ * simply the field types of its own body, so the same derivation resolves them,
+ * recursively, through nested components, with a cycle guard.
+ */
+interface DerivedField {
+    readonly name: string;
+    readonly type: FieldType;
+    readonly label: string;
+    readonly required: boolean;
+    readonly multiline: boolean;
+    readonly help?: string;
+    /** Minimum character length (`data-minlength`); the gate warns when shorter. */
+    readonly minLength?: number;
+    /** Maximum character length (`data-maxlength`); the gate warns when longer. */
+    readonly maxLength?: number;
+    /** A curated multi-reference (a `data-each` loop field). */
+    readonly multiple?: boolean;
+    /** Collection the reference picker is scoped to (`data-pick-from`). */
+    readonly pickFrom?: string;
+}
+/** Author-declared length bounds on a field value (`data-minlength`/`data-maxlength`). */
+interface LengthConstraints {
+    readonly minLength?: number;
+    readonly maxLength?: number;
+}
+declare function deriveFields(template: string, components?: ComponentMap): DerivedField[];
+
+/**
+ * Stamping decisions (PROPOSAL-template-versioning §4.1, PROPOSAL-llm-guardrails §4).
+ * `detectStamp` is pure — given the old and new template sources, it decides whether a
+ * destructive change is taking place and reports the schema delta (added / removed
+ * fields, plus per-token type changes).
+ *
+ * Two destructive shapes (PROPOSAL-llm-guardrails §1, both share the same recovery
+ * story — auto-stamp a snapshot, flag for migration):
  *
- * The destructive-change definition is **token-set asymmetric** (PROPOSAL §2.2): a
- * proper superset (additions only) is non-destructive and does not stamp; any removed
- * token (including the "rename" case, which reads as remove + add) is destructive and
- * triggers a stamp. This is the rule the editor and MCP wire identically through
- * `IndexedStore.write`, so the safety story is the same on every authoring path.
+ * 1. **Token-set asymmetric.** A token removed or renamed. The token *doesn't exist*
+ *    in the new schema, so content authored against it has nowhere to render.
+ * 2. **Token retained, type changed destructively.** The token *still exists*, but
+ *    its inferred type can't losslessly render data authored under the old type
+ *    (`richtext → shorttext` silently escapes HTML; `shorttext → image` reinterprets
+ *    free text as a path). The §4 rule in {@link isDestructiveTypeChange} encodes
+ *    which transitions are destructive vs widening.
+ *
+ * Both flow through `IndexedStore.write`'s auto-stamp path identically — the editor
+ * UI and MCP both see the same recovery affordance, regardless of which destructive
+ * shape triggered it.
  */
 type TemplateKind = 'template' | 'component';
+/** A field reference (name + inferred type) in the schema delta returned by `computeSchemaDelta`. */
+interface SchemaFieldRef {
+    readonly name: string;
+    readonly type: FieldType;
+}
+/** A type change on a token retained across the edit (PROPOSAL-llm-guardrails §4-§5). */
+interface TypeChange {
+    readonly name: string;
+    readonly from: FieldType;
+    readonly to: FieldType;
+    /** True when the change can't losslessly render data authored under `from`. */
+    readonly destructive: boolean;
+}
+/**
+ * Structured "what changed" report (PROPOSAL-llm-guardrails §5). Returned by
+ * `IndexedStore.write` for template/component writes so callers (MCP, editor UI)
+ * can react without re-deriving themselves. Empty arrays everywhere when an edit
+ * changes only whitespace, comments, or non-token markup.
+ */
+interface SchemaDelta {
+    readonly added: readonly SchemaFieldRef[];
+    readonly removed: readonly SchemaFieldRef[];
+    readonly typeChanged: readonly TypeChange[];
+}
 /** What `detectStamp` learned from comparing two template sources. */
 interface StampDecision {
     readonly destructive: boolean;
@@ -481,6 +567,8 @@ interface StampDecision {
     readonly removedTokens: readonly string[];
     /** Tokens present in `newSource` but absent in `oldSource`, sorted for stability. */
     readonly addedTokens: readonly string[];
+    /** Tokens retained but whose inferred type changed (PROPOSAL-llm-guardrails §1). */
+    readonly typeChanged: readonly TypeChange[];
 }
 /** The record `stampSnapshot` returns (and that the write path surfaces as `stamped`). */
 interface StampRecord {
@@ -491,13 +579,35 @@ interface StampRecord {
     /** The full path the snapshot was written to. */
     readonly snapshotPath: string;
 }
+/**
+ * Whether a field's type change from `from` to `to` can't losslessly render content
+ * authored against `from`. Drives both auto-stamp (destructive triggers a snapshot)
+ * and the validation gate's `content.type-drift` warning per-item.
+ *
+ * The rule (PROPOSAL-llm-guardrails §4) reduces to:
+ * - `anything → richtext` is safe (HTML escapes text fine).
+ * - `richtext → anything else` is destructive (HTML becomes escaped text).
+ * - Free-text → strict date/time is destructive (ISO required, free text won't parse).
+ * - `date ↔ time` is destructive (both ISO but different shapes; values don't transfer).
+ * - Same `valueKind` otherwise is non-destructive (text ↔ text, asset ↔ asset).
+ * - Cross-`valueKind` into text is non-destructive (text representation works).
+ * - Everything else cross-kind is destructive (text → asset/url/authors; asset ↔ url; …).
+ */
+declare function isDestructiveTypeChange(from: FieldType, to: FieldType): boolean;
+/**
+ * Compute the schema delta between two field lists. The richer counterpart to the
+ * token-name diff in {@link detectStamp} — used by `IndexedStore.write` to surface
+ * `schemaDelta` (PROPOSAL-llm-guardrails §5) without re-deriving on the caller side.
+ * Pure; component-aware via `deriveFields`.
+ */
+declare function computeSchemaDelta(oldFields: readonly DerivedField[], newFields: readonly DerivedField[]): SchemaDelta;
 /**
  * Decide whether the change from `oldSource` to `newSource` is destructive, and report
- * which tokens were removed / added. Pure — no I/O. The field-name set is derived via
- * the same `deriveFields` the editor's form generator uses (so the "schema" the decision
- * is taken against is identical to what the form shows the user). Component-aware:
- * when components are passed, fields bound to component props are categorised by how
- * the component uses them internally, matching the compiler's resolution.
+ * the schema diff (added / removed / typeChanged). Pure — no I/O. The field-name +
+ * type set is derived via the same `deriveFields` the editor's form generator uses
+ * (so the "schema" the decision is taken against is identical to what the form shows).
+ * Component-aware: fields bound to component props are categorised by how that
+ * component uses them internally, matching the compiler's resolution.
  */
 declare function detectStamp(oldSource: string, newSource: string, components?: ComponentMap): StampDecision;
 
@@ -533,6 +643,16 @@ interface WriteResult {
      * is known to be unavailable for items affected by this particular stamp.
      */
     readonly stampIncomplete?: boolean;
+    /**
+     * The schema diff between the old and new bytes for template/component writes
+     * (PROPOSAL-llm-guardrails §5). Present whenever the target is a template or
+     * component and there was a prior version; undefined for content writes, public
+     * files, and brand-new templates. Carries `added`/`removed` (with types) and
+     * `typeChanged` (with per-change `destructive` flag). MCP callers consume this to
+     * react to schema impact without re-deriving; the editor surfaces a summary in the
+     * stamp banner.
+     */
+    readonly schemaDelta?: SchemaDelta;
 }
 /**
  * The editor's working store (DESIGN §11c): a read {@link ContentSource} for
@@ -802,27 +922,6 @@ declare const DOCUMENT_SHELL = "document";
  */
 declare function loadDocumentShell(source: ContentSource, templatesDir?: string): Promise<string | undefined>;
 
-/**
- * The field-type registry (DESIGN §6.7). Field types and their rules are defined
- * *once* here and shared by the compiler, the editor's form generator, and (later)
- * Monaco's IntelliSense. This is the OCP extension point (CLAUDE.md §3): adding a
- * field type means adding an entry here, never editing a switch in the compiler or
- * the inference cascade.
- */
-type FieldType = 'image' | 'file' | 'url' | 'email' | 'phone' | 'date' | 'time' | 'code' | 'richtext' | 'authors' | 'text' | 'shorttext';
-/** How a resolved value is placed into output, the compiler reads this, never the type name. */
-type ValueKind = 'text' | 'html' | 'url' | 'asset' | 'authors';
-interface FieldTypeDef {
-    readonly type: FieldType;
-    readonly valueKind: ValueKind;
-    /** Default editor control hint, consumed by the form generator (DESIGN §7). */
-    readonly control: string;
-    readonly multiline: boolean;
-}
-declare const FIELD_TYPES: Readonly<Record<FieldType, FieldTypeDef>>;
-declare function isFieldType(value: string): value is FieldType;
-declare function valueKindOf(type: FieldType): ValueKind;
-
 /**
  * Contextual token inference (DESIGN §6.2). A token's control type is inferred from
  * *where it sits*, via a precedence cascade:
@@ -1047,42 +1146,6 @@ declare function buildRss(entries: readonly PageEntry[], options: RssOptions): A
  */
 declare function buildContentIndex(entries: readonly PageEntry[]): Artifact;
 
-/**
- * Derive the editor's form from a template, "the template is the schema"
- * (DESIGN §5.5/§6). Walking the same parse the compiler uses, each page-scope
- * token becomes one field whose control is inferred from where it sits, deduped by
- * name and labelled. This is the single source of truth the editor's form
- * generator and the compiler share (DESIGN §6.7).
- *
- * Inference is **component-aware**: when a component is used (`<doc file="{x}">`),
- * the bound field's type comes from how that prop is used *inside* the component,
- * not from the attribute's position on the usage. A component's prop types are
- * simply the field types of its own body, so the same derivation resolves them,
- * recursively, through nested components, with a cycle guard.
- */
-interface DerivedField {
-    readonly name: string;
-    readonly type: FieldType;
-    readonly label: string;
-    readonly required: boolean;
-    readonly multiline: boolean;
-    readonly help?: string;
-    /** Minimum character length (`data-minlength`); the gate warns when shorter. */
-    readonly minLength?: number;
-    /** Maximum character length (`data-maxlength`); the gate warns when longer. */
-    readonly maxLength?: number;
-    /** A curated multi-reference (a `data-each` loop field). */
-    readonly multiple?: boolean;
-    /** Collection the reference picker is scoped to (`data-pick-from`). */
-    readonly pickFrom?: string;
-}
-/** Author-declared length bounds on a field value (`data-minlength`/`data-maxlength`). */
-interface LengthConstraints {
-    readonly minLength?: number;
-    readonly maxLength?: number;
-}
-declare function deriveFields(template: string, components?: ComponentMap): DerivedField[];
-
 /**
  * Static analysis of a template's structure, used by the validation gate, the
  * media phase, and (later) the editor. Extracts the signals downstream needs:
@@ -1597,4 +1660,4 @@ declare function createDiagnosticRegistry(): DiagnosticRegistry;
 
 declare const workingStoreRoundTripDiagnostic: Diagnostic;
 
-export { type Artifact, type ArtifactSink, type AuthEndpoints, type AuthResult, type AuthorDirectory, type AuthorEntry, type AuthorOption, type AuthorRef, type AuthoringReference, type BlobStore, type BoundItem, type ChangePasswordRequest, type ChangePasswordSuccess, type CollectionConfig, type CollectionQuery, type CompileInput, type CompilePageOptions, type CompileSiteOptions, type CompiledPage, type ComponentMap, type ContentIndex, type ContentItem, ContentParseError, type ContentSource, type CreateTokenSuccess, type CreateUserRequest, DEFAULT_DIRS, DOCUMENT_SHELL, type DerivedField, type DiagnoseDeps, type Severity as DiagnoseSeverity, type Source as DiagnoseSource, type Diagnostic$1 as Diagnostic, type Diagnostic as DiagnosticCheck, type DiagnosticRegistry, type DirEntry, type DirNode, type EncodeRequest, type EncodedImage, type EncodedVariant, type EntryKind, FIELD_TYPES, type FieldPrimitive, type FieldRecord, type FieldType, type FieldTypeDef, type FieldValue, type Finding, type IdentityProvider, type ImageEncoder, type ImageFormat, type ImageInfo, InMemoryArtifactSink, InMemoryBlobStore, InMemoryContentSource, IndexedStore, type ItemNode, type LengthConstraints, type LoginRequest, type LoginSuccess, type MediaResolver, type MigrationResolution, type PageEntry, type PendingMigrationItem, type PendingMigrations, type PreBuildHook, type Principal, type PublishOptions, type PublishResult, type PublishSummary, type PurgeService, RESERVED_PREFIX, type ReconcileResult, type RedirectRule, type ReferenceContext, type ReferenceEntry, type ReferenceSection, type RefreshSuccess, type RenameResult, type Repair, type RepairArgs, type ResetPasswordRequest, type ResolveContext, type Role, type RssOptions, type Scope, type Severity$1 as Severity, type SiteConfig, type SortFile, type StampDecision, type StampRecord, type TemplateAnalysis, type TemplateKind, type TokenContext, type TokenRef, type TreeNode, type UpdateUserRequest, type UserAdminEndpoints, type UserSummary, type ValidationResult, type ValueKind, type WorkingStore, analyzeTemplate, applyMigration, baseTemplateName, bestFitSnapshot, buildAuthoringReference, buildContentIndex, buildPictureMarkup, buildRedirects, buildResolveContext, buildRss, buildSitemap, canEdit, compilePage, compileSite, compileTemplate, contentHash, contentTypeFor, createDiagnosticRegistry, deriveFields, detectStamp, emptyIndex, escapeHtmlAttribute, escapeHtmlText, escapeJsonStringContent, findTokens, hasRole, humanize, inferControl, isFieldType, isReservedVersionedPath, isVersionedTemplateName, joinAuthors, loadComponentScripts, loadComponentStyles, loadComponents, loadContentTree, loadDocumentShell, loadIndex, loadRedirects, loadSiteConfig, loadTemplate, nextVersionNumber, noopPurgeService, outputPathForItem, parseContentItem, parseRedirects, parseSortFile, pendingMigrations, processImage, publishSite, reconcileIndex, renderAuthors, renderReferenceMarkdown, sanitizeUrl, saveIndex, slugify, snapshotName, textContent, toAuthorRefs, urlForItem, validateSite, valueKindOf, versionNumber, wholeValueToken, workingStoreRoundTripDiagnostic };
+export { type Artifact, type ArtifactSink, type AuthEndpoints, type AuthResult, type AuthorDirectory, type AuthorEntry, type AuthorOption, type AuthorRef, type AuthoringReference, type BlobStore, type BoundItem, type ChangePasswordRequest, type ChangePasswordSuccess, type CollectionConfig, type CollectionQuery, type CompileInput, type CompilePageOptions, type CompileSiteOptions, type CompiledPage, type ComponentMap, type ContentIndex, type ContentItem, ContentParseError, type ContentSource, type CreateTokenSuccess, type CreateUserRequest, DEFAULT_DIRS, DOCUMENT_SHELL, type DerivedField, type DiagnoseDeps, type Severity as DiagnoseSeverity, type Source as DiagnoseSource, type Diagnostic$1 as Diagnostic, type Diagnostic as DiagnosticCheck, type DiagnosticRegistry, type DirEntry, type DirNode, type EncodeRequest, type EncodedImage, type EncodedVariant, type EntryKind, FIELD_TYPES, type FieldPrimitive, type FieldRecord, type FieldType, type FieldTypeDef, type FieldValue, type Finding, type IdentityProvider, type ImageEncoder, type ImageFormat, type ImageInfo, InMemoryArtifactSink, InMemoryBlobStore, InMemoryContentSource, IndexedStore, type ItemNode, type LengthConstraints, type LoginRequest, type LoginSuccess, type MediaResolver, type MigrationResolution, type PageEntry, type PendingMigrationItem, type PendingMigrations, type PreBuildHook, type Principal, type PublishOptions, type PublishResult, type PublishSummary, type PurgeService, RESERVED_PREFIX, type ReconcileResult, type RedirectRule, type ReferenceContext, type ReferenceEntry, type ReferenceSection, type RefreshSuccess, type RenameResult, type Repair, type RepairArgs, type ResetPasswordRequest, type ResolveContext, type Role, type RssOptions, type SchemaDelta, type SchemaFieldRef, type Scope, type Severity$1 as Severity, type SiteConfig, type SortFile, type StampDecision, type StampRecord, type TemplateAnalysis, type TemplateKind, type TokenContext, type TokenRef, type TreeNode, type TypeChange, type UpdateUserRequest, type UserAdminEndpoints, type UserSummary, type ValidationResult, type ValueKind, type WorkingStore, analyzeTemplate, applyMigration, baseTemplateName, bestFitSnapshot, buildAuthoringReference, buildContentIndex, buildPictureMarkup, buildRedirects, buildResolveContext, buildRss, buildSitemap, canEdit, compilePage, compileSite, compileTemplate, computeSchemaDelta, contentHash, contentTypeFor, createDiagnosticRegistry, deriveFields, detectStamp, emptyIndex, escapeHtmlAttribute, escapeHtmlText, escapeJsonStringContent, findTokens, hasRole, humanize, inferControl, isDestructiveTypeChange, isFieldType, isReservedVersionedPath, isVersionedTemplateName, joinAuthors, loadComponentScripts, loadComponentStyles, loadComponents, loadContentTree, loadDocumentShell, loadIndex, loadRedirects, loadSiteConfig, loadTemplate, nextVersionNumber, noopPurgeService, outputPathForItem, parseContentItem, parseRedirects, parseSortFile, pendingMigrations, processImage, publishSite, reconcileIndex, renderAuthors, renderReferenceMarkdown, sanitizeUrl, saveIndex, slugify, snapshotName, textContent, toAuthorRefs, urlForItem, validateSite, valueKindOf, versionNumber, wholeValueToken, workingStoreRoundTripDiagnostic };

package/dist/index.js

@@ -23,6 +23,7 @@ import {
   compilePage,
   compileSite,
   compileTemplate,
+  computeSchemaDelta,
   contentHash,
   contentTypeFor,
   createDiagnosticRegistry,
@@ -36,6 +37,7 @@ import {
   hasRole,
   humanize,
   inferControl,
+  isDestructiveTypeChange,
   isFieldType,
   isReservedVersionedPath,
   isVersionedTemplateName,
@@ -73,7 +75,7 @@ import {
   versionNumber,
   wholeValueToken,
   workingStoreRoundTripDiagnostic
-} from "./chunk-UZQ7UP2B.js";
+} from "./chunk-XO3CT6GL.js";
 export {
   ContentParseError,
   DEFAULT_DIRS,
@@ -99,6 +101,7 @@ export {
   compilePage,
   compileSite,
   compileTemplate,
+  computeSchemaDelta,
   contentHash,
   contentTypeFor,
   createDiagnosticRegistry,
@@ -112,6 +115,7 @@ export {
   hasRole,
   humanize,
   inferControl,
+  isDestructiveTypeChange,
   isFieldType,
   isReservedVersionedPath,
   isVersionedTemplateName,

package/dist/mcp.d.ts

@@ -0,0 +1,48 @@
+import { ApiDeps } from '@nanoesis/editor-api';
+
+/**
+ * Identity reported to MCP clients on `initialize`. Defaults: `{ name: 'nanoesis', version:
+ * '0.0.0' }`. Adopters embedding the HTTP route in their own host typically override `name`
+ * with their site identifier and `version` with their app version so client UIs identify
+ * the deployment, not the framework.
+ */
+interface McpServerIdentity {
+    readonly name?: string;
+    readonly version?: string;
+}
+
+/**
+ * Options for {@link handleMcpRequest}. Both fields are passed straight through to the
+ * MCP `Server`'s `initialize` response so client UIs (Claude Desktop, Cursor, …) identify
+ * the deployment rather than the framework.
+ */
+type HandleMcpRequestOptions = McpServerIdentity;
+/**
+ * Handle a single MCP HTTP request over the SDK's web-standard Streamable HTTP transport
+ * (DESIGN §11c/§14). Stateless: each call builds a fresh `Server` + `Transport` pair, so
+ * the caller's per-request `Authorization: Bearer …` header — propagated by the SDK into
+ * the request handlers as `extra.requestInfo.headers` — drives the editor's per-user role
+ * gate exactly as `/api/*` does.
+ *
+ * The signature is Fetch-API neutral: any runtime that hands a handler a standard
+ * `Request` (Azure Functions v4, Cloudflare Workers, plain Node 18+, Bun, Deno, Hono)
+ * wires it the same way:
+ *
+ * ```ts
+ * import { handleMcpRequest } from '@xtrable-ltd/nanoesis/mcp';
+ * // ... build `deps` once at startup
+ * app.http('mcp', {
+ *   methods: ['POST', 'GET', 'DELETE'],
+ *   handler: (req) => handleMcpRequest(deps, req, { name: 'my-site', version: pkg.version }),
+ * });
+ * ```
+ *
+ * Runtimes whose request shape is not a standard `Request` (e.g. Azure Functions' enhanced
+ * HttpRequest, Express' IncomingMessage) translate to/from `Request`/`Response` at the
+ * boundary — that translation is adopter-side because it depends on the host runtime; the
+ * MCP server construction and transport handling, which used to be ~120 lines of inlined
+ * boilerplate per adopter, is now this one call.
+ */
+declare function handleMcpRequest(deps: ApiDeps, request: Request, opts?: HandleMcpRequestOptions): Promise<Response>;
+
+export { type HandleMcpRequestOptions, handleMcpRequest };

package/dist/mcp.js

@@ -0,0 +1,76 @@
+import {
+  MCP_RESOURCES,
+  MCP_TOOLS,
+  callMcpTool,
+  readMcpResource
+} from "./chunk-EN5SMEWJ.js";
+import "./chunk-XO3CT6GL.js";
+
+// ../../hosts/host-mcp/src/http.ts
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+
+// ../../hosts/host-mcp/src/server.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import {
+  CallToolRequestSchema,
+  ListResourcesRequestSchema,
+  ListToolsRequestSchema,
+  ReadResourceRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+var BEARER_PREFIX = /^Bearer\s+/i;
+function bearerFrom(headers) {
+  if (headers === void 0) return void 0;
+  const raw = headers["authorization"] ?? headers["Authorization"];
+  const value = Array.isArray(raw) ? raw[0] : raw;
+  if (value === void 0) return void 0;
+  const match = BEARER_PREFIX.exec(value);
+  return match ? value.slice(match[0].length).trim() : void 0;
+}
+function createMcpServer(deps, identity) {
+  const server = new Server(
+    { name: identity?.name ?? "nanoesis", version: identity?.version ?? "0.0.0" },
+    { capabilities: { tools: {}, resources: {} } }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [...MCP_TOOLS] }));
+  server.setRequestHandler(CallToolRequestSchema, async (req, extra) => {
+    const args = req.params.arguments ?? {};
+    const token = bearerFrom(extra.requestInfo?.headers);
+    const result = await callMcpTool(
+      deps,
+      req.params.name,
+      args,
+      token !== void 0 ? { token } : {}
+    );
+    return { content: [{ type: "text", text: result.text }], isError: result.isError };
+  });
+  server.setRequestHandler(ListResourcesRequestSchema, async () => ({
+    resources: [...MCP_RESOURCES]
+  }));
+  server.setRequestHandler(ReadResourceRequestSchema, async (req) => {
+    const { uri } = req.params;
+    const resource = readMcpResource(uri);
+    if (resource === void 0) throw new Error(`Unknown resource: ${uri}`);
+    return { contents: [{ uri, mimeType: resource.mimeType, text: resource.text }] };
+  });
+  return server;
+}
+
+// ../../hosts/host-mcp/src/http.ts
+var DEFAULT_VERSION = true ? "0.1.12" : "0.0.0-workspace";
+async function handleMcpRequest(deps, request, opts) {
+  const server = createMcpServer(deps, {
+    name: opts?.name ?? "nanoesis",
+    version: opts?.version ?? DEFAULT_VERSION
+  });
+  const transport = new WebStandardStreamableHTTPServerTransport({ enableJsonResponse: true });
+  await server.connect(transport);
+  try {
+    return await transport.handleRequest(request);
+  } finally {
+    await transport.close();
+    await server.close();
+  }
+}
+export {
+  handleMcpRequest
+};

package/editor/assets/{MigrationsPane-_FGonx4-.js → MigrationsPane-BYGqWBAA.js}

@@ -1,4 +1,4 @@
-import{a3 as Ie,ao as F,a1 as Te,V as g,J as k,G as e,f as n,W as Ye,l as a,B as Q,ap as h,t as j,ak as o,E as _,ad as v,m as ze,y as U,s as He,g as Qe,au as Ue,ai as c,aq as W,ae as X,af as _e,K as Xe,ac as Ze,Y as ea}from"./index-LtCzUHAw.js";var aa=_('<p class="placeholder svelte-1lpfi31">Loading preview…</p>'),ta=_('<p class="error svelte-1lpfi31" role="alert"> </p>'),la=_("<option> </option>"),sa=_('<select class="svelte-1lpfi31"></select>'),ra=_('<li class="orphan svelte-1lpfi31"><div class="orphan-head svelte-1lpfi31"><code class="orphan-name svelte-1lpfi31"> </code> <span class="orphan-value svelte-1lpfi31"> </span></div> <div class="orphan-actions svelte-1lpfi31" role="radiogroup"><label class="svelte-1lpfi31"><input type="radio" value="drop"/> Drop</label> <label class="svelte-1lpfi31"><input type="radio" value="keep"/> Keep (unrendered)</label> <label class="svelte-1lpfi31"><input type="radio" value="rename"/> Rename to</label> <!></div></li>'),ia=_(`<section class="resolutions svelte-1lpfi31" aria-label="Orphan field resolutions"><h3 class="svelte-1lpfi31">Orphan fields</h3> <p class="hint svelte-1lpfi31">These fields exist in this item's JSON but the current template doesn't render them.
+import{a3 as Ie,ao as F,a1 as Te,V as g,J as k,G as e,f as n,W as Ye,l as a,B as Q,ap as h,t as j,ak as o,E as _,ad as v,m as ze,y as U,s as He,g as Qe,au as Ue,ai as c,aq as W,ae as X,af as _e,K as Xe,ac as Ze,Y as ea}from"./index-Do1drqEQ.js";var aa=_('<p class="placeholder svelte-1lpfi31">Loading preview…</p>'),ta=_('<p class="error svelte-1lpfi31" role="alert"> </p>'),la=_("<option> </option>"),sa=_('<select class="svelte-1lpfi31"></select>'),ra=_('<li class="orphan svelte-1lpfi31"><div class="orphan-head svelte-1lpfi31"><code class="orphan-name svelte-1lpfi31"> </code> <span class="orphan-value svelte-1lpfi31"> </span></div> <div class="orphan-actions svelte-1lpfi31" role="radiogroup"><label class="svelte-1lpfi31"><input type="radio" value="drop"/> Drop</label> <label class="svelte-1lpfi31"><input type="radio" value="keep"/> Keep (unrendered)</label> <label class="svelte-1lpfi31"><input type="radio" value="rename"/> Rename to</label> <!></div></li>'),ia=_(`<section class="resolutions svelte-1lpfi31" aria-label="Orphan field resolutions"><h3 class="svelte-1lpfi31">Orphan fields</h3> <p class="hint svelte-1lpfi31">These fields exist in this item's JSON but the current template doesn't render them.
             Pick what to do with each.</p> <ul class="orphans svelte-1lpfi31"></ul></section>`),na=_('<p class="error svelte-1lpfi31" role="alert"> </p>'),oa=_('<div class="diff svelte-1lpfi31"><section class="pane svelte-1lpfi31" aria-label="Previous version (left)"><header class="pane-head svelte-1lpfi31"><!></header> <pre class="source svelte-1lpfi31"> </pre></section> <section class="pane svelte-1lpfi31" aria-label="Current template (right)"><header class="pane-head svelte-1lpfi31"> </header> <pre class="source svelte-1lpfi31"> </pre></section></div> <!> <!> <div class="commit-bar svelte-1lpfi31"><button type="button" class="primary svelte-1lpfi31"> </button></div>',1),va=_('<header class="detail-head svelte-1lpfi31"><button type="button" class="back svelte-1lpfi31">← Back</button> <h2 class="svelte-1lpfi31"> </h2></header> <!>',1),pa=_('<p class="error svelte-1lpfi31" role="alert"> </p>'),ca=_('<p class="placeholder svelte-1lpfi31">Loading…</p>'),fa=_(`<div class="empty svelte-1lpfi31"><h3 class="svelte-1lpfi31">All caught up</h3> <p>Every content item's fields match its bound template. Migrations show up here when a
           destructive template edit (or a manual hand-edit) leaves an item with orphan fields.</p></div>`),da=_('<li class="item"><button class="item-row svelte-1lpfi31" type="button"><span class="item-path svelte-1lpfi31"><code> </code></span> <span class="item-summary svelte-1lpfi31"><!> <!> <!></span> <span class="open-icon svelte-1lpfi31">→</span></button></li>'),ua=_('<section class="group svelte-1lpfi31"><h3 class="group-title svelte-1lpfi31"><code class="svelte-1lpfi31"> </code> <span class="count svelte-1lpfi31"> </span></h3> <ul class="items svelte-1lpfi31"></ul></section>'),ma=_('<header class="list-head svelte-1lpfi31"><h2>Migrations</h2> <button type="button" class="svelte-1lpfi31"> </button></header> <!>',1),_a=_('<div class="migrations svelte-1lpfi31"><!> <!></div>');function ga(Ee,Le){Ie(Le,!0);let M=F(null),d=F(null),Z=F(!1),R=F(null),r=F(Te({})),he=F(Te({})),A=F(!1),K=F(null);g.ensureLoaded();async function Re(s){v(M,s,!0),v(r,{},!0),v(he,{},!0),v(d,null),v(R,null),v(Z,!0);try{v(d,await ea(s),!0);const f={};for(const l of e(d).orphans){const u=Se(l.name,e(d).currentTemplateFields);f[l.name]=u?{rename:u}:"keep"}v(r,f,!0)}catch(f){v(R,f instanceof Error?f.message:String(f),!0)}finally{v(Z,!1)}}function ge(){v(M,null),v(d,null),v(R,null)}function Se(s,f){const l=s.toLowerCase();for(const u of f)if(u.toLowerCase().startsWith(l)||u.toLowerCase().endsWith(l))return u;return null}async function Ce(){if(!(e(M)===null||e(d)===null)){v(A,!0),v(K,null);try{const s={drop:Object.entries(e(r)).filter(([,l])=>l==="drop").map(([l])=>l),keep:Object.entries(e(r)).filter(([,l])=>l==="keep").map(([l])=>l),rename:Object.fromEntries(Object.entries(e(r)).filter(([,l])=>typeof l=="object"&&l!==null&&"rename"in l).map(([l,u])=>[l,u.rename])),fill:{...e(he)}},f=await Qe(e(M),s);g.refresh().catch(()=>{}),ge()}catch(s){v(K,s instanceof Error?s.message:String(s),!0)}finally{v(A,!1)}}}function Pe(s){return typeof s=="string"?s:JSON.stringify(s)}const qe=Ue(()=>g.list===null?[]:Object.entries(g.list.byTemplate).map(([s,f])=>({template:s,items:[...f].sort((l,u)=>l.path.localeCompare(u.path))})));var be=_a(),ye=a(be);{var Be=s=>{var f=va(),l=Q(f),u=a(l),ee=o(u,2),ae=a(ee),te=o(l,2);{var le=i=>{var m=aa();n(i,m)},se=i=>{var m=ta(),w=a(m);h(()=>c(w,e(R))),n(i,m)},re=i=>{var m=oa(),w=Q(m),E=a(w),O=a(E),N=a(O);{var V=p=>{var y=W();h(()=>c(y,`Before — ${e(d).left.template??""}`)),n(p,y)},$=p=>{var y=W("Before — no snapshot available");n(p,y)};k(N,p=>{e(d).left?p(V):p($,-1)})}var ie=o(O,2),ne=a(ie),oe=o(E,2),D=a(oe),S=a(D),b=o(D,2),G=a(b),C=o(w,2);{var I=p=>{var y=ia(),P=o(a(y),4);U(P,21,()=>e(d).orphans,q=>q.name,(q,t)=>{var x=ra(),z=a(x),xe=a(z),Ke=a(xe),Ne=o(xe,2),Ve=a(Ne),ke=o(z,2),we=a(ke),fe=a(we),Fe=o(we,2),de=a(Fe),je=o(Fe,2),ue=a(je),$e=o(je,2);{var De=B=>{var T=sa();U(T,20,()=>e(d).currentTemplateFields,J=>J,(J,me)=>{var H=la(),Ge=a(H),Oe={};h(()=>{c(Ge,me),Oe!==(Oe=me)&&(H.value=(H.__value=me)??"")}),n(J,H)});var Me;Xe(T),h(()=>{Me!==(Me=e(r)[e(t).name].rename)&&(T.value=(T.__value=e(r)[e(t).name].rename)??"",Ze(T,e(r)[e(t).name].rename))}),j("change",T,J=>v(r,{...e(r),[e(t).name]:{rename:J.currentTarget.value}},!0)),n(B,T)};k($e,B=>{typeof e(r)[e(t).name]=="object"&&e(r)[e(t).name]!==null&&"rename"in e(r)[e(t).name]&&B(De)})}h(B=>{c(Ke,e(t).name),c(Ve,B),X(ke,"aria-label",`Resolution for ${e(t).name}`),X(fe,"name",`d-${e(t).name}`),_e(fe,e(r)[e(t).name]==="drop"),X(de,"name",`d-${e(t).name}`),_e(de,e(r)[e(t).name]==="keep"),X(ue,"name",`d-${e(t).name}`),_e(ue,typeof e(r)[e(t).name]=="object"&&e(r)[e(t).name]!==null&&"rename"in e(r)[e(t).name])},[()=>Pe(e(t).value)]),j("change",fe,()=>v(r,{...e(r),[e(t).name]:"drop"},!0)),j("change",de,()=>v(r,{...e(r),[e(t).name]:"keep"},!0)),j("change",ue,()=>v(r,{...e(r),[e(t).name]:{rename:e(d).currentTemplateFields[0]??""}},!0)),n(q,x)}),n(p,y)};k(C,p=>{e(d).orphans.length>0&&p(I)})}var Y=o(C,2);{var ve=p=>{var y=na(),P=a(y);h(()=>c(P,e(K))),n(p,y)};k(Y,p=>{e(K)&&p(ve)})}var pe=o(Y,2),L=a(pe),ce=a(L);h(()=>{var p;c(ne,((p=e(d).left)==null?void 0:p.html)??"(no snapshot covers this item)"),c(S,`After — ${e(d).right.template??""}`),c(G,e(d).right.html),L.disabled=e(A)||e(d).orphans.length===0,c(ce,e(A)?"Migrating…":"Migrate item")}),j("click",L,Ce),n(i,m)};k(te,i=>{e(Z)?i(le):e(R)?i(se,1):e(d)&&i(re,2)})}h(()=>c(ae,e(M))),j("click",u,ge),n(s,f)},Je=s=>{var f=ma(),l=Q(f),u=o(a(l),2),ee=a(u),ae=o(l,2);{var te=i=>{var m=pa(),w=a(m);h(()=>c(w,g.error)),n(i,m)},le=i=>{var m=ca();n(i,m)},se=i=>{var m=fa();n(i,m)},re=i=>{var m=ze(),w=Q(m);U(w,17,()=>e(qe),E=>E.template,(E,O)=>{var N=ua(),V=a(N),$=a(V),ie=a($),ne=o($,2),oe=a(ne),D=o(V,2);U(D,21,()=>e(O).items,S=>S.path,(S,b)=>{var G=da(),C=a(G),I=a(C),Y=a(I),ve=a(Y),pe=o(I,2),L=a(pe);{var ce=t=>{var x=W();h(z=>c(x,`${e(b).orphanFields.length??""} orphan field${e(b).orphanFields.length===1?"":"s"}:
                       ${z??""}`),[()=>e(b).orphanFields.join(", ")]),n(t,x)};k(L,t=>{e(b).orphanFields.length>0&&t(ce)})}var p=o(L,2);{var y=t=>{var x=W();h(()=>c(x,`· ${e(b).missingRequiredFields.length??""} missing required`)),n(t,x)};k(p,t=>{e(b).missingRequiredFields.length>0&&t(y)})}var P=o(p,2);{var q=t=>{var x=W();h(()=>c(x,`· best-fit: ${e(b).bestFitSnapshot??""}`)),n(t,x)};k(P,t=>{e(b).bestFitSnapshot&&t(q)})}h(()=>c(ve,e(b).path)),j("click",C,()=>Re(e(b).path)),n(S,G)}),h(()=>{c(ie,e(O).template),c(oe,`${e(O).items.length??""} item${e(O).items.length===1?"":"s"}`)}),n(E,N)}),n(i,m)};k(ae,i=>{g.error?i(te):g.loading&&g.list===null?i(le,1):g.count===0?i(se,2):i(re,-1)})}h(()=>{u.disabled=g.loading,c(ee,g.loading?"Refreshing…":"Refresh")}),j("click",u,()=>g.refresh()),n(s,f)};k(ye,s=>{e(M)!==null?s(Be):s(Je,-1)})}var We=o(ye,2);{var Ae=s=>{};k(We,s=>{!e(M)&&g.list===null&&s(Ae)})}n(Ee,be),Ye()}He(["click","change"]);export{ga as default};