mountly-mcp 4.3.0 → 4.4.0

package/README.md

@@ -207,10 +207,98 @@ function Library() {
 }
 ```
 
+**Entrypoint types** place one View on several ChatGPT surfaces. Other hosts
+ignore `openai/ui` and render the View inline:
+
+| `type`     | ChatGPT surface                                 | Extra fields                     |
+| ---------- | ----------------------------------------------- | -------------------------------- |
+| `global`   | Persistent sidebar panel                        | `quickAction` (sidebar shortcut) |
+| `thread`   | Conversation panel beside the chat              | none                             |
+| `file`     | File viewer/editor for matching extensions      | `extensions`                     |
+| `settings` | Plugin settings page                            | `searchTerms`                    |
+
+A file viewer receives the opened file as tool input. Parse it with the SDK schema:
+
+```ts
+import { OpenAIFileEntrypointInputSchema } from "@openai/mcp-extensions/server";
+
+{
+  name: "parts.open_cad",
+  resourceUri: "ui://parts/cad-viewer",
+  config: {
+    inputSchema: OpenAIFileEntrypointInputSchema.shape,
+    _meta: openaiUiToolMeta({
+      entrypoints: [{ type: "file", extensions: [".step", ".stl"] }],
+    }),
+  },
+  handler: async ({ file }) => ({ structuredContent: { name: file.name, uri: file.resourceUri } }),
+}
+```
+
 Smoke in ChatGPT: serve Streamable HTTP at `/mcp`, enable Developer mode, add the
 connector, then open a `global` entrypoint from the Desktop sidebar. See the
 [host matrix](https://mountly.dev/mcp-apps/host-matrix/).
 
+## MCP Events (experimental)
+
+`mountly-mcp/events` lets your server wake a ChatGPT conversation when something
+changes, such as a finished deploy or a new comment. It implements webhook
+delivery from the draft MCP Events spec: Standard Webhooks signing, callback
+challenge verification, retries with backoff, and `410` cleanup. The API follows
+the draft spec.
+
+You need an **MCP 2.0** server (`@modelcontextprotocol/server` v2, protocol
+`2026-07-28`). Register the helpers as custom methods:
+
+```ts
+import { McpServer, createMcpHandler } from "@modelcontextprotocol/server";
+import { defineEvents } from "mountly-mcp/events";
+import { z } from "zod";
+
+const events = defineEvents({
+  events: {
+    "deploy.finished": {
+      description: "A deploy for the app finished.",
+      input: z.object({ app: z.string() }),
+      payload: z.object({ app: z.string(), id: z.string(), status: z.enum(["ok", "failed"]) }),
+    },
+  },
+  store: subscriptionsTable, // get/set/delete/values; a Map is fine for dev
+  authorize: ({ arguments: args, authInfo }) => canSeeApp(authInfo, args.app),
+});
+
+const handler = createMcpHandler(() => {
+  const server = new McpServer({ name: "deploys", version: "1.0.0" });
+  server.server.registerCapabilities({ events: {} });
+  const params = z.looseObject({});
+  server.server.setRequestHandler("events/list", { params }, () => events.list());
+  server.server.setRequestHandler("events/subscribe", { params }, (p, ctx) =>
+    events.subscribe(p, { authInfo: ctx.http?.authInfo }));
+  server.server.setRequestHandler("events/unsubscribe", { params }, (p, ctx) =>
+    events.unsubscribe(p, { authInfo: ctx.http?.authInfo }));
+  return server;
+});
+
+// Later, when it happens:
+await events.emit(
+  "deploy.finished",
+  { app: "web", id: "d_42", status: "ok" },
+  (args) => args.app === "web",
+);
+```
+
+Give the events server at least one tool. ChatGPT creates a connector once
+`tools/list` succeeds.
+
+`authorize` runs on subscribe and again before each delivery, using the principal
+stored at subscribe time, so revoking access stops delivery. Callback URLs use
+`https:`; pass `allowCallbackUrl` to restrict them further. Keep `authInfo`
+serializable when your store persists subscriptions.
+
+ChatGPT subscribes from Work chats and processes events asynchronously. See the
+[`mcp-chatgpt-plugin` example](https://github.com/jagreehal/mountly/tree/main/docs/examples/mcp-chatgpt-plugin) for a
+full walkthrough.
+
 ## Verify
 
 ```bash
@@ -281,6 +369,7 @@ the view sends the agent its next turn with the current page. The
 | `mountly-mcp/artifact`    | Manifest APIs                           |
 | `mountly-mcp/server`      | `registerMcpApps`                       |
 | `mountly-mcp/openai/server` | ChatGPT helpers (`enableOpenAiExtensions`, `openaiUiToolMeta`) |
+| `mountly-mcp/events`      | Experimental MCP Events (`defineEvents`, `signWebhook`) |
 | `mountly-mcp/dev`         | Local host helpers                      |
 | `mountly-mcp/testing`     | `verifyMcpApps`                         |
 | `mountly-mcp/json-render` | Generative path                         |

package/dist/cli.js

@@ -349,7 +349,7 @@ async function main() {
     return addView(parseAddArgs(rest));
   }
   if (command === "doctor") {
-    const { doctorCommand } = await import("./doctor-4MTC6Y4X.js");
+    const { doctorCommand } = await import("./doctor-NB3DE4CG.js");
     return doctorCommand();
   }
   if (command === "dev") return dev(parseArgs(rest));

package/dist/{doctor-4MTC6Y4X.js → doctor-NB3DE4CG.js}

@@ -6,7 +6,7 @@ import {
 // src/doctor.ts
 import { existsSync, readFileSync, readdirSync } from "fs";
 import { createRequire } from "module";
-import { join, resolve } from "path";
+import { dirname, join, resolve } from "path";
 function nodeMajor() {
   return Number(process.versions.node.split(".")[0] ?? 0);
 }
@@ -18,6 +18,13 @@ function tryResolve(specifier, fromDir) {
     return null;
   }
 }
+function findInstalled(pkg, fromDir) {
+  for (let dir = resolve(fromDir); ; dir = dirname(dir)) {
+    const path = join(dir, "node_modules", pkg, "package.json");
+    if (existsSync(path)) return path;
+    if (dirname(dir) === dir) return null;
+  }
+}
 var OPENAI_USAGE = /openai\/ui|useOpenAIExtensions|mountly-mcp\/openai|mountly-mcp\/react\/openai|@openai\/mcp-extensions|openaiUi\b|openaiUiToolMeta|enableOpenAiExtensions/;
 function projectSourcesMentionOpenAi(cwd, viteConfig) {
   const candidates = [];
@@ -116,7 +123,7 @@ function runDoctor(cwd = process.cwd()) {
     }
   }
   if (projectSourcesMentionOpenAi(cwd, viteConfig)) {
-    const openai = tryResolve("@openai/mcp-extensions/package.json", cwd);
+    const openai = findInstalled("@openai/mcp-extensions", cwd);
     checks.push({
       id: "openai-extensions",
       ok: Boolean(openai),
@@ -154,4 +161,4 @@ export {
   formatDoctorReport,
   runDoctor
 };
-//# sourceMappingURL=doctor-4MTC6Y4X.js.map
+//# sourceMappingURL=doctor-NB3DE4CG.js.map

package/dist/doctor-NB3DE4CG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/doctor.ts"],"sourcesContent":["import { existsSync, readFileSync, readdirSync } from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport { dirname, join, resolve } from \"node:path\";\nimport { CLI_ERROR_CODES, cliError } from \"./errors.js\";\n\nexport interface DoctorCheck {\n  id: string;\n  ok: boolean;\n  detail: string;\n}\n\nexport interface DoctorReport {\n  ok: boolean;\n  checks: DoctorCheck[];\n}\n\nfunction nodeMajor(): number {\n  return Number(process.versions.node.split(\".\")[0] ?? 0);\n}\n\nfunction tryResolve(specifier: string, fromDir: string): string | null {\n  try {\n    const require = createRequire(resolve(fromDir, \"package.json\"));\n    return require.resolve(specifier);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Path to `pkg` in the project's node_modules, walking up from `fromDir`. Reads the\n * filesystem, so packages whose `exports` omit `./package.json` resolve too.\n */\nfunction findInstalled(pkg: string, fromDir: string): string | null {\n  for (let dir = resolve(fromDir); ; dir = dirname(dir)) {\n    const path = join(dir, \"node_modules\", pkg, \"package.json\");\n    if (existsSync(path)) return path;\n    if (dirname(dir) === dir) return null;\n  }\n}\n\nconst OPENAI_USAGE =\n  /openai\\/ui|useOpenAIExtensions|mountly-mcp\\/openai|mountly-mcp\\/react\\/openai|@openai\\/mcp-extensions|openaiUi\\b|openaiUiToolMeta|enableOpenAiExtensions/;\n\nfunction projectSourcesMentionOpenAi(cwd: string, viteConfig?: string): boolean {\n  const candidates: string[] = [];\n  if (viteConfig) candidates.push(viteConfig);\n  for (const name of [\"server.ts\", \"server.mjs\", \"server.js\", \"src/server.ts\", \"src/view.tsx\"]) {\n    const path = resolve(cwd, name);\n    if (existsSync(path)) candidates.push(path);\n  }\n  const srcDir = resolve(cwd, \"src\");\n  if (existsSync(srcDir)) {\n    try {\n      for (const entry of readdirSync(srcDir, { withFileTypes: true })) {\n        if (entry.isFile() && /\\.(tsx?|jsx?|mjs|cjs)$/.test(entry.name)) {\n          candidates.push(join(srcDir, entry.name));\n        }\n      }\n    } catch {\n      // ignore unreadable src\n    }\n  }\n  for (const path of candidates) {\n    try {\n      if (OPENAI_USAGE.test(readFileSync(path, \"utf8\"))) return true;\n    } catch {\n      // skip\n    }\n  }\n  return false;\n}\n\n/**\n * Check the local project for Mountly MCP readiness. Exits nonzero via the\n * CLI when `ok` is false.\n */\nexport function runDoctor(cwd = process.cwd()): DoctorReport {\n  const checks: DoctorCheck[] = [];\n\n  const major = nodeMajor();\n  checks.push({\n    id: \"node\",\n    ok: major >= 20,\n    detail:\n      major >= 20\n        ? `Node ${process.versions.node} (ok; 20+ required, 22+ recommended)`\n        : `Node ${process.versions.node} is below 20. Upgrade Node, then re-run mountly-mcp doctor.`,\n  });\n\n  const viteConfigCandidates = [\n    \"vite.config.ts\",\n    \"vite.config.mts\",\n    \"vite.config.js\",\n    \"vite.config.mjs\",\n  ].map((name) => resolve(cwd, name));\n  const viteConfig = viteConfigCandidates.find((path) => existsSync(path));\n  checks.push({\n    id: \"vite-config\",\n    ok: Boolean(viteConfig),\n    detail: viteConfig\n      ? `Found ${viteConfig}`\n      : \"No vite.config.* in this directory. Run from the View project, or: npx mountly-mcp create my-app --framework react\",\n  });\n\n  if (viteConfig) {\n    const source = readFileSync(viteConfig, \"utf8\");\n    const hasPlugin = /mountlyMcpViews\\s*\\(/.test(source);\n    checks.push({\n      id: \"vite-plugin\",\n      ok: hasPlugin,\n      detail: hasPlugin\n        ? \"vite config imports mountlyMcpViews()\"\n        : `Add mountlyMcpViews() from \"mountly-mcp/vite\" to ${viteConfig}`,\n    });\n  }\n\n  const manifest = resolve(cwd, \"dist/mountly-mcp.manifest.json\");\n  checks.push({\n    id: \"manifest\",\n    ok: existsSync(manifest),\n    detail: existsSync(manifest)\n      ? `Found ${manifest}`\n      : \"No dist/mountly-mcp.manifest.json yet. Run: npx mountly-mcp build\",\n  });\n\n  const playwright = tryResolve(\"playwright\", cwd) ?? tryResolve(\"@playwright/test\", cwd);\n  checks.push({\n    id: \"playwright\",\n    ok: Boolean(playwright),\n    detail: playwright\n      ? `Playwright resolvable for verify --render (${playwright})`\n      : \"Playwright not installed. For CI render checks: pnpm add -D playwright && npx playwright install chromium\",\n  });\n\n  const pkgPath = resolve(cwd, \"package.json\");\n  if (existsSync(pkgPath)) {\n    const pkg = JSON.parse(readFileSync(pkgPath, \"utf8\")) as {\n      dependencies?: Record<string, string>;\n      peerDependencies?: Record<string, string>;\n      devDependencies?: Record<string, string>;\n    };\n    const deps = { ...pkg.dependencies, ...pkg.devDependencies };\n    if (deps.react) {\n      const reactPath = tryResolve(\"react/package.json\", cwd);\n      if (reactPath) {\n        const reactPkg = JSON.parse(readFileSync(reactPath, \"utf8\")) as { version?: string };\n        const reactMajor = Number((reactPkg.version ?? \"0\").split(\".\")[0]);\n        checks.push({\n          id: \"react\",\n          ok: reactMajor >= 19,\n          detail:\n            reactMajor >= 19\n              ? `React ${reactPkg.version} (ok)`\n              : `React ${reactPkg.version} is below 19. mountly-mcp/react and mountly-react require React 19.`,\n        });\n      }\n    }\n    if (deps.vite) {\n      const vitePath = tryResolve(\"vite/package.json\", cwd);\n      if (vitePath) {\n        const vitePkg = JSON.parse(readFileSync(vitePath, \"utf8\")) as { version?: string };\n        const viteMajor = Number((vitePkg.version ?? \"0\").split(\".\")[0]);\n        checks.push({\n          id: \"vite\",\n          ok: viteMajor >= 8,\n          detail:\n            viteMajor >= 8\n              ? `Vite ${vitePkg.version} (ok)`\n              : `Vite ${vitePkg.version} is below 8. mountly-mcp/vite is built and tested against Vite 8.`,\n        });\n      }\n    }\n  }\n\n  if (projectSourcesMentionOpenAi(cwd, viteConfig)) {\n    const openai = findInstalled(\"@openai/mcp-extensions\", cwd);\n    checks.push({\n      id: \"openai-extensions\",\n      ok: Boolean(openai),\n      detail: openai\n        ? `@openai/mcp-extensions resolvable (${openai})`\n        : 'Project references OpenAI MCP extensions but @openai/mcp-extensions is not installed. Run: pnpm add @openai/mcp-extensions',\n    });\n  }\n\n  // Manifest missing is advisory for a brand-new scaffold before first build.\n  const hard = checks.filter((c) => c.id !== \"manifest\" && c.id !== \"playwright\");\n  const ok = hard.every((c) => c.ok);\n\n  return { ok, checks };\n}\n\nexport function formatDoctorReport(report: DoctorReport): string {\n  const lines = [\"mountly-mcp doctor\", \"\"];\n  for (const check of report.checks) {\n    lines.push(`${check.ok ? \"ok\" : \"FAIL\"}  ${check.id.padEnd(14)} ${check.detail}`);\n  }\n  lines.push(\"\");\n  lines.push(report.ok ? \"Ready for mountly-mcp build / dev / verify.\" : \"Fix FAIL items above.\");\n  lines.push(\"\");\n  return `${lines.join(\"\\n\")}\\n`;\n}\n\nexport function doctorCommand(cwd = process.cwd()): void {\n  const report = runDoctor(cwd);\n  process.stdout.write(formatDoctorReport(report));\n  if (!report.ok) {\n    throw cliError(\n      CLI_ERROR_CODES.DOCTOR_FAILED,\n      \"one or more doctor checks failed\",\n      \"Fix the FAIL lines above, then re-run: mountly-mcp doctor\",\n    );\n  }\n}\n"],"mappings":";;;;;;AAAA,SAAS,YAAY,cAAc,mBAAmB;AACtD,SAAS,qBAAqB;AAC9B,SAAS,SAAS,MAAM,eAAe;AAcvC,SAAS,YAAoB;AAC3B,SAAO,OAAO,QAAQ,SAAS,KAAK,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC;AACxD;AAEA,SAAS,WAAW,WAAmB,SAAgC;AACrE,MAAI;AACF,UAAMA,WAAU,cAAc,QAAQ,SAAS,cAAc,CAAC;AAC9D,WAAOA,SAAQ,QAAQ,SAAS;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,SAAS,cAAc,KAAa,SAAgC;AAClE,WAAS,MAAM,QAAQ,OAAO,KAAK,MAAM,QAAQ,GAAG,GAAG;AACrD,UAAM,OAAO,KAAK,KAAK,gBAAgB,KAAK,cAAc;AAC1D,QAAI,WAAW,IAAI,EAAG,QAAO;AAC7B,QAAI,QAAQ,GAAG,MAAM,IAAK,QAAO;AAAA,EACnC;AACF;AAEA,IAAM,eACJ;AAEF,SAAS,4BAA4B,KAAa,YAA8B;AAC9E,QAAM,aAAuB,CAAC;AAC9B,MAAI,WAAY,YAAW,KAAK,UAAU;AAC1C,aAAW,QAAQ,CAAC,aAAa,cAAc,aAAa,iBAAiB,cAAc,GAAG;AAC5F,UAAM,OAAO,QAAQ,KAAK,IAAI;AAC9B,QAAI,WAAW,IAAI,EAAG,YAAW,KAAK,IAAI;AAAA,EAC5C;AACA,QAAM,SAAS,QAAQ,KAAK,KAAK;AACjC,MAAI,WAAW,MAAM,GAAG;AACtB,QAAI;AACF,iBAAW,SAAS,YAAY,QAAQ,EAAE,eAAe,KAAK,CAAC,GAAG;AAChE,YAAI,MAAM,OAAO,KAAK,yBAAyB,KAAK,MAAM,IAAI,GAAG;AAC/D,qBAAW,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC;AAAA,QAC1C;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,aAAW,QAAQ,YAAY;AAC7B,QAAI;AACF,UAAI,aAAa,KAAK,aAAa,MAAM,MAAM,CAAC,EAAG,QAAO;AAAA,IAC5D,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,UAAU,MAAM,QAAQ,IAAI,GAAiB;AAC3D,QAAM,SAAwB,CAAC;AAE/B,QAAM,QAAQ,UAAU;AACxB,SAAO,KAAK;AAAA,IACV,IAAI;AAAA,IACJ,IAAI,SAAS;AAAA,IACb,QACE,SAAS,KACL,QAAQ,QAAQ,SAAS,IAAI,yCAC7B,QAAQ,QAAQ,SAAS,IAAI;AAAA,EACrC,CAAC;AAED,QAAM,uBAAuB;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,IAAI,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC;AAClC,QAAM,aAAa,qBAAqB,KAAK,CAAC,SAAS,WAAW,IAAI,CAAC;AACvE,SAAO,KAAK;AAAA,IACV,IAAI;AAAA,IACJ,IAAI,QAAQ,UAAU;AAAA,IACtB,QAAQ,aACJ,SAAS,UAAU,KACnB;AAAA,EACN,CAAC;AAED,MAAI,YAAY;AACd,UAAM,SAAS,aAAa,YAAY,MAAM;AAC9C,UAAM,YAAY,uBAAuB,KAAK,MAAM;AACpD,WAAO,KAAK;AAAA,MACV,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,QAAQ,YACJ,0CACA,oDAAoD,UAAU;AAAA,IACpE,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,QAAQ,KAAK,gCAAgC;AAC9D,SAAO,KAAK;AAAA,IACV,IAAI;AAAA,IACJ,IAAI,WAAW,QAAQ;AAAA,IACvB,QAAQ,WAAW,QAAQ,IACvB,SAAS,QAAQ,KACjB;AAAA,EACN,CAAC;AAED,QAAM,aAAa,WAAW,cAAc,GAAG,KAAK,WAAW,oBAAoB,GAAG;AACtF,SAAO,KAAK;AAAA,IACV,IAAI;AAAA,IACJ,IAAI,QAAQ,UAAU;AAAA,IACtB,QAAQ,aACJ,8CAA8C,UAAU,MACxD;AAAA,EACN,CAAC;AAED,QAAM,UAAU,QAAQ,KAAK,cAAc;AAC3C,MAAI,WAAW,OAAO,GAAG;AACvB,UAAM,MAAM,KAAK,MAAM,aAAa,SAAS,MAAM,CAAC;AAKpD,UAAM,OAAO,EAAE,GAAG,IAAI,cAAc,GAAG,IAAI,gBAAgB;AAC3D,QAAI,KAAK,OAAO;AACd,YAAM,YAAY,WAAW,sBAAsB,GAAG;AACtD,UAAI,WAAW;AACb,cAAM,WAAW,KAAK,MAAM,aAAa,WAAW,MAAM,CAAC;AAC3D,cAAM,aAAa,QAAQ,SAAS,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC;AACjE,eAAO,KAAK;AAAA,UACV,IAAI;AAAA,UACJ,IAAI,cAAc;AAAA,UAClB,QACE,cAAc,KACV,SAAS,SAAS,OAAO,UACzB,SAAS,SAAS,OAAO;AAAA,QACjC,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,KAAK,MAAM;AACb,YAAM,WAAW,WAAW,qBAAqB,GAAG;AACpD,UAAI,UAAU;AACZ,cAAM,UAAU,KAAK,MAAM,aAAa,UAAU,MAAM,CAAC;AACzD,cAAM,YAAY,QAAQ,QAAQ,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC;AAC/D,eAAO,KAAK;AAAA,UACV,IAAI;AAAA,UACJ,IAAI,aAAa;AAAA,UACjB,QACE,aAAa,IACT,QAAQ,QAAQ,OAAO,UACvB,QAAQ,QAAQ,OAAO;AAAA,QAC/B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,MAAI,4BAA4B,KAAK,UAAU,GAAG;AAChD,UAAM,SAAS,cAAc,0BAA0B,GAAG;AAC1D,WAAO,KAAK;AAAA,MACV,IAAI;AAAA,MACJ,IAAI,QAAQ,MAAM;AAAA,MAClB,QAAQ,SACJ,sCAAsC,MAAM,MAC5C;AAAA,IACN,CAAC;AAAA,EACH;AAGA,QAAM,OAAO,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,cAAc,EAAE,OAAO,YAAY;AAC9E,QAAM,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,EAAE;AAEjC,SAAO,EAAE,IAAI,OAAO;AACtB;AAEO,SAAS,mBAAmB,QAA8B;AAC/D,QAAM,QAAQ,CAAC,sBAAsB,EAAE;AACvC,aAAW,SAAS,OAAO,QAAQ;AACjC,UAAM,KAAK,GAAG,MAAM,KAAK,OAAO,MAAM,KAAK,MAAM,GAAG,OAAO,EAAE,CAAC,IAAI,MAAM,MAAM,EAAE;AAAA,EAClF;AACA,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,OAAO,KAAK,gDAAgD,uBAAuB;AAC9F,QAAM,KAAK,EAAE;AACb,SAAO,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA;AAC5B;AAEO,SAAS,cAAc,MAAM,QAAQ,IAAI,GAAS;AACvD,QAAM,SAAS,UAAU,GAAG;AAC5B,UAAQ,OAAO,MAAM,mBAAmB,MAAM,CAAC;AAC/C,MAAI,CAAC,OAAO,IAAI;AACd,UAAM;AAAA,MACJ,gBAAgB;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;","names":["require"]}

package/dist/events/index.d.ts

@@ -0,0 +1,97 @@
+import { z } from "zod";
+type MaybePromise<T> = T | Promise<T>;
+export interface EventDefinition<I extends z.ZodType = z.ZodType, P extends z.ZodType = z.ZodType> {
+    description?: string;
+    /** Subscription arguments (e.g. `{ document_id }`). */
+    input: I;
+    /** Event `data`. Validated on `emit` when set. */
+    payload?: P;
+}
+export interface EventSubscription {
+    id: string;
+    name: string;
+    arguments: Record<string, unknown>;
+    url: string;
+    secret: string;
+    /** Epoch ms. */
+    expiresAt: number;
+    /** Principal captured at subscribe time; re-checked before every delivery. */
+    authInfo?: unknown;
+}
+/** A `Map` works. Persist across restarts in production (the spec requires it). */
+export interface SubscriptionStore {
+    get(key: string): MaybePromise<EventSubscription | undefined>;
+    set(key: string, subscription: EventSubscription): unknown;
+    delete(key: string): unknown;
+    values(): MaybePromise<Iterable<EventSubscription>>;
+}
+export interface AuthorizeRequest {
+    name: string;
+    arguments: Record<string, unknown>;
+    authInfo?: unknown;
+}
+export interface DefineEventsOptions<E extends Record<string, EventDefinition>> {
+    events: E;
+    store?: SubscriptionStore;
+    /**
+     * Called on subscribe/unsubscribe with the caller, and before each delivery with
+     * the principal stored at subscribe time. Return `false` to deny; a denied
+     * delivery deletes the subscription.
+     */
+    authorize?: (request: AuthorizeRequest) => MaybePromise<boolean>;
+    /** Default: `https:` only. Narrow further to block SSRF to internal hosts. */
+    allowCallbackUrl?: (url: URL) => boolean;
+    /** Default and maximum subscription lifetime. Default 30 days. */
+    maxTtlMs?: number;
+    /** Delivery attempts per event. Default 5. */
+    maxAttempts?: number;
+    /** First retry delay; doubles each attempt. Default 1000. */
+    retryBaseMs?: number;
+    fetch?: typeof fetch;
+}
+export interface EmitResult {
+    subscriptionId: string;
+    status: number;
+    delivered: boolean;
+}
+/** JSON-RPC error; `code` is honoured by the MCP SDK when thrown from a handler. */
+export declare class McpEventsError extends Error {
+    readonly code: number;
+    constructor(code: number, message: string);
+}
+/** Standard Webhooks `v1` signature (what ChatGPT verifies). */
+export declare function signWebhook(input: {
+    secret: string;
+    id: string;
+    timestamp: number;
+    body: string;
+}): string;
+export declare function defineEvents<E extends Record<string, EventDefinition>>(options: DefineEventsOptions<E>): {
+    /** `events/list` result. */
+    list(): {
+        events: {
+            name: string;
+            description?: string | undefined;
+            delivery: string[];
+            inputSchema: z.core.ZodStandardJSONSchemaPayload<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+            payloadSchema?: z.core.ZodStandardJSONSchemaPayload<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>> | undefined;
+        }[];
+        nextCursor: null;
+    };
+    /** `events/subscribe`, idempotent per (name, arguments, url). */
+    subscribe(params: unknown, ctx?: {
+        authInfo?: unknown;
+    }): Promise<{
+        id: string;
+        refreshBefore: string;
+        cursor: null;
+        truncated: boolean;
+    }>;
+    /** `events/unsubscribe`, idempotent. */
+    unsubscribe(params: unknown, ctx?: {
+        authInfo?: unknown;
+    }): Promise<{}>;
+    /** Deliver one event to every live subscription for `name` whose arguments `match`. */
+    emit<N extends keyof E & string>(name: N, data: E[N]["payload"] extends z.ZodType ? z.input<E[N]["payload"]> : unknown, match?: (args: z.output<E[N]["input"]>) => boolean): Promise<EmitResult[]>;
+};
+export {};

package/dist/events/index.js

@@ -0,0 +1,215 @@
+// src/events/index.ts
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { z } from "zod";
+var McpEventsError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "McpEventsError";
+    this.code = code;
+  }
+};
+var INVALID_PARAMS = -32602;
+var MAX_BODY_BYTES = 262144;
+var SECRET = /^whsec_([A-Za-z0-9+/]+={0,2})$/;
+var SubscribeParams = z.object({
+  name: z.string(),
+  arguments: z.record(z.string(), z.unknown()).default({}),
+  delivery: z.object({ mode: z.literal("webhook"), url: z.string(), secret: z.string() }),
+  cursor: z.string().nullish(),
+  ttlMs: z.number().int().positive().nullish()
+});
+var UnsubscribeParams = z.object({
+  name: z.string(),
+  arguments: z.record(z.string(), z.unknown()).default({}),
+  delivery: z.object({ mode: z.literal("webhook"), url: z.string() })
+});
+function signWebhook(input) {
+  const key = Buffer.from(input.secret.replace(/^whsec_/, ""), "base64");
+  const mac = createHmac("sha256", key).update(`${input.id}.${input.timestamp}.${input.body}`);
+  return `v1,${mac.digest("base64")}`;
+}
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    const obj = value;
+    return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${canonical(obj[k])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function parse(schema, value, what) {
+  const result = schema.safeParse(value);
+  if (!result.success)
+    throw new McpEventsError(INVALID_PARAMS, `Invalid ${what}: ${z.prettifyError(result.error)}`);
+  return result.data;
+}
+var id = (prefix) => `${prefix}_${randomBytes(12).toString("hex")}`;
+var keyOf = (name, args, url) => `${name}
+${canonical(args)}
+${url}`;
+function defineEvents(options) {
+  const {
+    events,
+    store = /* @__PURE__ */ new Map(),
+    authorize,
+    allowCallbackUrl = (url) => url.protocol === "https:",
+    maxTtlMs = 30 * 24 * 60 * 60 * 1e3,
+    maxAttempts = 5,
+    retryBaseMs = 1e3,
+    fetch: fetchFn = fetch
+  } = options;
+  function definition(name) {
+    const def = Object.prototype.hasOwnProperty.call(events, name) ? events[name] : void 0;
+    if (!def) throw new McpEventsError(INVALID_PARAMS, `Unknown event: ${name}`);
+    return def;
+  }
+  async function allowed(request) {
+    return !authorize || await authorize(request);
+  }
+  function post(sub, webhookId, body) {
+    const timestamp = Math.floor(Date.now() / 1e3);
+    return fetchFn(sub.url, {
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(1e4),
+      headers: {
+        "content-type": "application/json",
+        "webhook-id": webhookId,
+        "webhook-timestamp": String(timestamp),
+        "webhook-signature": signWebhook({ secret: sub.secret, id: webhookId, timestamp, body }),
+        "x-mcp-subscription-id": sub.id
+      },
+      body
+    });
+  }
+  async function verify(sub) {
+    const challenge = randomBytes(32).toString("base64url");
+    const res = await post(
+      sub,
+      id("msg_verification"),
+      JSON.stringify({ type: "verification", challenge })
+    ).catch(() => void 0);
+    const echoed = res?.ok ? (await res.json().catch(() => ({}))).challenge : void 0;
+    const ok = typeof echoed === "string" && echoed.length === challenge.length && timingSafeEqual(Buffer.from(echoed), Buffer.from(challenge));
+    if (!ok) throw new McpEventsError(INVALID_PARAMS, "Callback verification failed");
+  }
+  async function deliver(key, sub, eventId, body) {
+    let status = 0;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      status = (await post(sub, eventId, body).catch(() => void 0))?.status ?? 0;
+      if (status >= 200 && status < 300) return { subscriptionId: sub.id, status, delivered: true };
+      if (status === 410) await store.delete(key);
+      const transient = status === 0 || status === 408 || status === 429 || status >= 500;
+      if (!transient) break;
+      if (attempt < maxAttempts)
+        await new Promise((r) => setTimeout(r, retryBaseMs * 2 ** (attempt - 1)));
+    }
+    return { subscriptionId: sub.id, status, delivered: false };
+  }
+  return {
+    /** `events/list` result. */
+    list() {
+      return {
+        events: Object.entries(events).map(([name, def]) => ({
+          name,
+          ...def.description ? { description: def.description } : {},
+          delivery: ["webhook"],
+          inputSchema: z.toJSONSchema(def.input),
+          ...def.payload ? { payloadSchema: z.toJSONSchema(def.payload) } : {}
+        })),
+        nextCursor: null
+      };
+    },
+    /** `events/subscribe`, idempotent per (name, arguments, url). */
+    async subscribe(params, ctx = {}) {
+      const p = parse(SubscribeParams, params, "events/subscribe params");
+      const args = parse(
+        definition(p.name).input,
+        p.arguments,
+        `arguments for ${p.name}`
+      );
+      const url = URL.parse(p.delivery.url);
+      if (!url || !allowCallbackUrl(url))
+        throw new McpEventsError(INVALID_PARAMS, "Callback URL not allowed");
+      const secret = SECRET.exec(p.delivery.secret)?.[1];
+      const keyBytes = secret ? Buffer.from(secret, "base64").length : 0;
+      if (keyBytes < 24 || keyBytes > 64)
+        throw new McpEventsError(INVALID_PARAMS, "Secret must be whsec_ + base64 of 24\u201364 bytes");
+      if (!await allowed({ name: p.name, arguments: args, authInfo: ctx.authInfo })) {
+        throw new McpEventsError(INVALID_PARAMS, "Not authorized to subscribe");
+      }
+      const key = keyOf(p.name, args, url.href);
+      const existing = await store.get(key);
+      const ttl = Math.min(p.ttlMs ?? maxTtlMs, maxTtlMs);
+      const sub = {
+        id: existing?.id ?? id("sub"),
+        name: p.name,
+        arguments: args,
+        url: url.href,
+        secret: p.delivery.secret,
+        expiresAt: Date.now() + ttl,
+        authInfo: ctx.authInfo
+      };
+      if (existing?.secret !== sub.secret) await verify(sub);
+      await store.set(key, sub);
+      return {
+        id: sub.id,
+        refreshBefore: new Date(sub.expiresAt).toISOString(),
+        cursor: null,
+        truncated: false
+      };
+    },
+    /** `events/unsubscribe`, idempotent. */
+    async unsubscribe(params, ctx = {}) {
+      const p = parse(UnsubscribeParams, params, "events/unsubscribe params");
+      const args = parse(
+        definition(p.name).input,
+        p.arguments,
+        `arguments for ${p.name}`
+      );
+      if (!await allowed({ name: p.name, arguments: args, authInfo: ctx.authInfo })) {
+        throw new McpEventsError(INVALID_PARAMS, "Not authorized to unsubscribe");
+      }
+      const url = URL.parse(p.delivery.url);
+      if (url) await store.delete(keyOf(p.name, args, url.href));
+      return {};
+    },
+    /** Deliver one event to every live subscription for `name` whose arguments `match`. */
+    async emit(name, data, match = () => true) {
+      const def = definition(name);
+      const payload = def.payload ? parse(def.payload, data, `payload for ${name}`) : data;
+      const eventId = id("evt");
+      const body = JSON.stringify({
+        eventId,
+        name,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        data: payload,
+        cursor: null
+      });
+      if (Buffer.byteLength(body) > MAX_BODY_BYTES)
+        throw new McpEventsError(INVALID_PARAMS, "Event body exceeds 256 KiB");
+      const now = Date.now();
+      const deliveries = [];
+      for (const sub of [...await store.values()]) {
+        if (sub.name !== name) continue;
+        const key = keyOf(sub.name, sub.arguments, sub.url);
+        if (sub.expiresAt <= now) {
+          await store.delete(key);
+          continue;
+        }
+        if (!match(sub.arguments)) continue;
+        if (!await allowed({ name, arguments: sub.arguments, authInfo: sub.authInfo })) {
+          await store.delete(key);
+          continue;
+        }
+        deliveries.push(deliver(key, sub, eventId, body));
+      }
+      return Promise.all(deliveries);
+    }
+  };
+}
+export {
+  McpEventsError,
+  defineEvents,
+  signWebhook
+};
+//# sourceMappingURL=index.js.map

package/dist/events/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/events/index.ts"],"sourcesContent":["/**\n * MCP Events over webhooks (protocol `2026-07-28`), the delivery mode ChatGPT uses.\n *\n * Wire `list`, `subscribe` and `unsubscribe` into any MCP 2.0 server as `events/*`\n * request handlers, then call `emit` when something changes. This entry tracks the\n * draft spec and stays experimental until the spec settles.\n */\nimport { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { z } from \"zod\";\n\ntype MaybePromise<T> = T | Promise<T>;\n\nexport interface EventDefinition<I extends z.ZodType = z.ZodType, P extends z.ZodType = z.ZodType> {\n  description?: string;\n  /** Subscription arguments (e.g. `{ document_id }`). */\n  input: I;\n  /** Event `data`. Validated on `emit` when set. */\n  payload?: P;\n}\n\nexport interface EventSubscription {\n  id: string;\n  name: string;\n  arguments: Record<string, unknown>;\n  url: string;\n  secret: string;\n  /** Epoch ms. */\n  expiresAt: number;\n  /** Principal captured at subscribe time; re-checked before every delivery. */\n  authInfo?: unknown;\n}\n\n/** A `Map` works. Persist across restarts in production (the spec requires it). */\nexport interface SubscriptionStore {\n  get(key: string): MaybePromise<EventSubscription | undefined>;\n  set(key: string, subscription: EventSubscription): unknown;\n  delete(key: string): unknown;\n  values(): MaybePromise<Iterable<EventSubscription>>;\n}\n\nexport interface AuthorizeRequest {\n  name: string;\n  arguments: Record<string, unknown>;\n  authInfo?: unknown;\n}\n\nexport interface DefineEventsOptions<E extends Record<string, EventDefinition>> {\n  events: E;\n  store?: SubscriptionStore;\n  /**\n   * Called on subscribe/unsubscribe with the caller, and before each delivery with\n   * the principal stored at subscribe time. Return `false` to deny; a denied\n   * delivery deletes the subscription.\n   */\n  authorize?: (request: AuthorizeRequest) => MaybePromise<boolean>;\n  /** Default: `https:` only. Narrow further to block SSRF to internal hosts. */\n  allowCallbackUrl?: (url: URL) => boolean;\n  /** Default and maximum subscription lifetime. Default 30 days. */\n  maxTtlMs?: number;\n  /** Delivery attempts per event. Default 5. */\n  maxAttempts?: number;\n  /** First retry delay; doubles each attempt. Default 1000. */\n  retryBaseMs?: number;\n  fetch?: typeof fetch;\n}\n\nexport interface EmitResult {\n  subscriptionId: string;\n  status: number;\n  delivered: boolean;\n}\n\n/** JSON-RPC error; `code` is honoured by the MCP SDK when thrown from a handler. */\nexport class McpEventsError extends Error {\n  readonly code: number;\n  constructor(code: number, message: string) {\n    super(message);\n    this.name = \"McpEventsError\";\n    this.code = code;\n  }\n}\n\nconst INVALID_PARAMS = -32602;\nconst MAX_BODY_BYTES = 262_144;\nconst SECRET = /^whsec_([A-Za-z0-9+/]+={0,2})$/;\n\nconst SubscribeParams = z.object({\n  name: z.string(),\n  arguments: z.record(z.string(), z.unknown()).default({}),\n  delivery: z.object({ mode: z.literal(\"webhook\"), url: z.string(), secret: z.string() }),\n  cursor: z.string().nullish(),\n  ttlMs: z.number().int().positive().nullish(),\n});\n\nconst UnsubscribeParams = z.object({\n  name: z.string(),\n  arguments: z.record(z.string(), z.unknown()).default({}),\n  delivery: z.object({ mode: z.literal(\"webhook\"), url: z.string() }),\n});\n\n/** Standard Webhooks `v1` signature (what ChatGPT verifies). */\nexport function signWebhook(input: {\n  secret: string;\n  id: string;\n  timestamp: number;\n  body: string;\n}): string {\n  const key = Buffer.from(input.secret.replace(/^whsec_/, \"\"), \"base64\");\n  const mac = createHmac(\"sha256\", key).update(`${input.id}.${input.timestamp}.${input.body}`);\n  return `v1,${mac.digest(\"base64\")}`;\n}\n\nfunction canonical(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(canonical).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    const obj = value as Record<string, unknown>;\n    return `{${Object.keys(obj)\n      .sort()\n      .map((k) => `${JSON.stringify(k)}:${canonical(obj[k])}`)\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value);\n}\n\nfunction parse<S extends z.ZodType>(schema: S, value: unknown, what: string): z.output<S> {\n  const result = schema.safeParse(value);\n  if (!result.success)\n    throw new McpEventsError(INVALID_PARAMS, `Invalid ${what}: ${z.prettifyError(result.error)}`);\n  return result.data;\n}\n\nconst id = (prefix: string) => `${prefix}_${randomBytes(12).toString(\"hex\")}`;\n\nconst keyOf = (name: string, args: unknown, url: string) => `${name}\\n${canonical(args)}\\n${url}`;\n\nexport function defineEvents<E extends Record<string, EventDefinition>>(\n  options: DefineEventsOptions<E>,\n) {\n  const {\n    events,\n    store = new Map<string, EventSubscription>(),\n    authorize,\n    allowCallbackUrl = (url) => url.protocol === \"https:\",\n    maxTtlMs = 30 * 24 * 60 * 60 * 1000,\n    maxAttempts = 5,\n    retryBaseMs = 1000,\n    fetch: fetchFn = fetch,\n  } = options;\n\n  function definition(name: string): EventDefinition {\n    const def = Object.prototype.hasOwnProperty.call(events, name) ? events[name] : undefined;\n    if (!def) throw new McpEventsError(INVALID_PARAMS, `Unknown event: ${name}`);\n    return def;\n  }\n\n  async function allowed(request: AuthorizeRequest) {\n    return !authorize || (await authorize(request));\n  }\n\n  function post(sub: EventSubscription, webhookId: string, body: string) {\n    const timestamp = Math.floor(Date.now() / 1000);\n    return fetchFn(sub.url, {\n      method: \"POST\",\n      redirect: \"error\",\n      signal: AbortSignal.timeout(10_000),\n      headers: {\n        \"content-type\": \"application/json\",\n        \"webhook-id\": webhookId,\n        \"webhook-timestamp\": String(timestamp),\n        \"webhook-signature\": signWebhook({ secret: sub.secret, id: webhookId, timestamp, body }),\n        \"x-mcp-subscription-id\": sub.id,\n      },\n      body,\n    });\n  }\n\n  async function verify(sub: EventSubscription) {\n    const challenge = randomBytes(32).toString(\"base64url\");\n    const res = await post(\n      sub,\n      id(\"msg_verification\"),\n      JSON.stringify({ type: \"verification\", challenge }),\n    ).catch(() => undefined);\n    const echoed = res?.ok\n      ? ((await res.json().catch(() => ({}))) as { challenge?: unknown }).challenge\n      : undefined;\n    const ok =\n      typeof echoed === \"string\" &&\n      echoed.length === challenge.length &&\n      timingSafeEqual(Buffer.from(echoed), Buffer.from(challenge));\n    if (!ok) throw new McpEventsError(INVALID_PARAMS, \"Callback verification failed\");\n  }\n\n  async function deliver(\n    key: string,\n    sub: EventSubscription,\n    eventId: string,\n    body: string,\n  ): Promise<EmitResult> {\n    let status = 0;\n    for (let attempt = 1; attempt <= maxAttempts; attempt++) {\n      // Fresh timestamp + signature per attempt; same event id and body bytes.\n      status = (await post(sub, eventId, body).catch(() => undefined))?.status ?? 0;\n      if (status >= 200 && status < 300) return { subscriptionId: sub.id, status, delivered: true };\n      if (status === 410) await store.delete(key);\n      const transient = status === 0 || status === 408 || status === 429 || status >= 500;\n      if (!transient) break;\n      if (attempt < maxAttempts)\n        await new Promise((r) => setTimeout(r, retryBaseMs * 2 ** (attempt - 1)));\n    }\n    return { subscriptionId: sub.id, status, delivered: false };\n  }\n\n  return {\n    /** `events/list` result. */\n    list() {\n      return {\n        events: Object.entries(events).map(([name, def]) => ({\n          name,\n          ...(def.description ? { description: def.description } : {}),\n          delivery: [\"webhook\"],\n          inputSchema: z.toJSONSchema(def.input),\n          ...(def.payload ? { payloadSchema: z.toJSONSchema(def.payload) } : {}),\n        })),\n        nextCursor: null,\n      };\n    },\n\n    /** `events/subscribe`, idempotent per (name, arguments, url). */\n    async subscribe(params: unknown, ctx: { authInfo?: unknown } = {}) {\n      const p = parse(SubscribeParams, params, \"events/subscribe params\");\n      const args = parse(\n        definition(p.name).input,\n        p.arguments,\n        `arguments for ${p.name}`,\n      ) as Record<string, unknown>;\n\n      const url = URL.parse(p.delivery.url);\n      if (!url || !allowCallbackUrl(url))\n        throw new McpEventsError(INVALID_PARAMS, \"Callback URL not allowed\");\n      const secret = SECRET.exec(p.delivery.secret)?.[1];\n      const keyBytes = secret ? Buffer.from(secret, \"base64\").length : 0;\n      if (keyBytes < 24 || keyBytes > 64)\n        throw new McpEventsError(INVALID_PARAMS, \"Secret must be whsec_ + base64 of 24–64 bytes\");\n      if (!(await allowed({ name: p.name, arguments: args, authInfo: ctx.authInfo }))) {\n        throw new McpEventsError(INVALID_PARAMS, \"Not authorized to subscribe\");\n      }\n\n      const key = keyOf(p.name, args, url.href);\n      const existing = await store.get(key);\n      const ttl = Math.min(p.ttlMs ?? maxTtlMs, maxTtlMs);\n      const sub: EventSubscription = {\n        id: existing?.id ?? id(\"sub\"),\n        name: p.name,\n        arguments: args,\n        url: url.href,\n        secret: p.delivery.secret,\n        expiresAt: Date.now() + ttl,\n        authInfo: ctx.authInfo,\n      };\n      if (existing?.secret !== sub.secret) await verify(sub);\n      await store.set(key, sub);\n      return {\n        id: sub.id,\n        refreshBefore: new Date(sub.expiresAt).toISOString(),\n        cursor: null,\n        truncated: false,\n      };\n    },\n\n    /** `events/unsubscribe`, idempotent. */\n    async unsubscribe(params: unknown, ctx: { authInfo?: unknown } = {}) {\n      const p = parse(UnsubscribeParams, params, \"events/unsubscribe params\");\n      const args = parse(\n        definition(p.name).input,\n        p.arguments,\n        `arguments for ${p.name}`,\n      ) as Record<string, unknown>;\n      if (!(await allowed({ name: p.name, arguments: args, authInfo: ctx.authInfo }))) {\n        throw new McpEventsError(INVALID_PARAMS, \"Not authorized to unsubscribe\");\n      }\n      const url = URL.parse(p.delivery.url);\n      if (url) await store.delete(keyOf(p.name, args, url.href));\n      return {};\n    },\n\n    /** Deliver one event to every live subscription for `name` whose arguments `match`. */\n    async emit<N extends keyof E & string>(\n      name: N,\n      data: E[N][\"payload\"] extends z.ZodType ? z.input<E[N][\"payload\"]> : unknown,\n      match: (args: z.output<E[N][\"input\"]>) => boolean = () => true,\n    ): Promise<EmitResult[]> {\n      const def = definition(name);\n      const payload = def.payload ? parse(def.payload, data, `payload for ${name}`) : data;\n      const eventId = id(\"evt\");\n      const body = JSON.stringify({\n        eventId,\n        name,\n        timestamp: new Date().toISOString(),\n        data: payload,\n        cursor: null,\n      });\n      if (Buffer.byteLength(body) > MAX_BODY_BYTES)\n        throw new McpEventsError(INVALID_PARAMS, \"Event body exceeds 256 KiB\");\n\n      const now = Date.now();\n      const deliveries: Promise<EmitResult>[] = [];\n      for (const sub of [...(await store.values())]) {\n        if (sub.name !== name) continue;\n        const key = keyOf(sub.name, sub.arguments, sub.url);\n        if (sub.expiresAt <= now) {\n          await store.delete(key);\n          continue;\n        }\n        if (!match(sub.arguments as z.output<E[N][\"input\"]>)) continue;\n        if (!(await allowed({ name, arguments: sub.arguments, authInfo: sub.authInfo }))) {\n          await store.delete(key);\n          continue;\n        }\n        deliveries.push(deliver(key, sub, eventId, body));\n      }\n      return Promise.all(deliveries);\n    },\n  };\n}\n"],"mappings":";AAOA,SAAS,YAAY,aAAa,uBAAuB;AACzD,SAAS,SAAS;AAiEX,IAAM,iBAAN,cAA6B,MAAM;AAAA,EAExC,YAAY,MAAc,SAAiB;AACzC,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;AACvB,IAAM,SAAS;AAEf,IAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACvD,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,KAAK,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;AAAA,EACtF,QAAQ,EAAE,OAAO,EAAE,QAAQ;AAAA,EAC3B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ;AAC7C,CAAC;AAED,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,MAAM,EAAE,OAAO;AAAA,EACf,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACvD,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC;AACpE,CAAC;AAGM,SAAS,YAAY,OAKjB;AACT,QAAM,MAAM,OAAO,KAAK,MAAM,OAAO,QAAQ,WAAW,EAAE,GAAG,QAAQ;AACrE,QAAM,MAAM,WAAW,UAAU,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,IAAI,MAAM,SAAS,IAAI,MAAM,IAAI,EAAE;AAC3F,SAAO,MAAM,IAAI,OAAO,QAAQ,CAAC;AACnC;AAEA,SAAS,UAAU,OAAwB;AACzC,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,SAAS,EAAE,KAAK,GAAG,CAAC;AACnE,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,MAAM;AACZ,WAAO,IAAI,OAAO,KAAK,GAAG,EACvB,KAAK,EACL,IAAI,CAAC,MAAM,GAAG,KAAK,UAAU,CAAC,CAAC,IAAI,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,EACtD,KAAK,GAAG,CAAC;AAAA,EACd;AACA,SAAO,KAAK,UAAU,KAAK;AAC7B;AAEA,SAAS,MAA2B,QAAW,OAAgB,MAA2B;AACxF,QAAM,SAAS,OAAO,UAAU,KAAK;AACrC,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,eAAe,gBAAgB,WAAW,IAAI,KAAK,EAAE,cAAc,OAAO,KAAK,CAAC,EAAE;AAC9F,SAAO,OAAO;AAChB;AAEA,IAAM,KAAK,CAAC,WAAmB,GAAG,MAAM,IAAI,YAAY,EAAE,EAAE,SAAS,KAAK,CAAC;AAE3E,IAAM,QAAQ,CAAC,MAAc,MAAe,QAAgB,GAAG,IAAI;AAAA,EAAK,UAAU,IAAI,CAAC;AAAA,EAAK,GAAG;AAExF,SAAS,aACd,SACA;AACA,QAAM;AAAA,IACJ;AAAA,IACA,QAAQ,oBAAI,IAA+B;AAAA,IAC3C;AAAA,IACA,mBAAmB,CAAC,QAAQ,IAAI,aAAa;AAAA,IAC7C,WAAW,KAAK,KAAK,KAAK,KAAK;AAAA,IAC/B,cAAc;AAAA,IACd,cAAc;AAAA,IACd,OAAO,UAAU;AAAA,EACnB,IAAI;AAEJ,WAAS,WAAW,MAA+B;AACjD,UAAM,MAAM,OAAO,UAAU,eAAe,KAAK,QAAQ,IAAI,IAAI,OAAO,IAAI,IAAI;AAChF,QAAI,CAAC,IAAK,OAAM,IAAI,eAAe,gBAAgB,kBAAkB,IAAI,EAAE;AAC3E,WAAO;AAAA,EACT;AAEA,iBAAe,QAAQ,SAA2B;AAChD,WAAO,CAAC,aAAc,MAAM,UAAU,OAAO;AAAA,EAC/C;AAEA,WAAS,KAAK,KAAwB,WAAmB,MAAc;AACrE,UAAM,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC9C,WAAO,QAAQ,IAAI,KAAK;AAAA,MACtB,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,QAAQ,YAAY,QAAQ,GAAM;AAAA,MAClC,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,cAAc;AAAA,QACd,qBAAqB,OAAO,SAAS;AAAA,QACrC,qBAAqB,YAAY,EAAE,QAAQ,IAAI,QAAQ,IAAI,WAAW,WAAW,KAAK,CAAC;AAAA,QACvF,yBAAyB,IAAI;AAAA,MAC/B;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAEA,iBAAe,OAAO,KAAwB;AAC5C,UAAM,YAAY,YAAY,EAAE,EAAE,SAAS,WAAW;AACtD,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA,GAAG,kBAAkB;AAAA,MACrB,KAAK,UAAU,EAAE,MAAM,gBAAgB,UAAU,CAAC;AAAA,IACpD,EAAE,MAAM,MAAM,MAAS;AACvB,UAAM,SAAS,KAAK,MACd,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,GAA+B,YAClE;AACJ,UAAM,KACJ,OAAO,WAAW,YAClB,OAAO,WAAW,UAAU,UAC5B,gBAAgB,OAAO,KAAK,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC;AAC7D,QAAI,CAAC,GAAI,OAAM,IAAI,eAAe,gBAAgB,8BAA8B;AAAA,EAClF;AAEA,iBAAe,QACb,KACA,KACA,SACA,MACqB;AACrB,QAAI,SAAS;AACb,aAAS,UAAU,GAAG,WAAW,aAAa,WAAW;AAEvD,gBAAU,MAAM,KAAK,KAAK,SAAS,IAAI,EAAE,MAAM,MAAM,MAAS,IAAI,UAAU;AAC5E,UAAI,UAAU,OAAO,SAAS,IAAK,QAAO,EAAE,gBAAgB,IAAI,IAAI,QAAQ,WAAW,KAAK;AAC5F,UAAI,WAAW,IAAK,OAAM,MAAM,OAAO,GAAG;AAC1C,YAAM,YAAY,WAAW,KAAK,WAAW,OAAO,WAAW,OAAO,UAAU;AAChF,UAAI,CAAC,UAAW;AAChB,UAAI,UAAU;AACZ,cAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,cAAc,MAAM,UAAU,EAAE,CAAC;AAAA,IAC5E;AACA,WAAO,EAAE,gBAAgB,IAAI,IAAI,QAAQ,WAAW,MAAM;AAAA,EAC5D;AAEA,SAAO;AAAA;AAAA,IAEL,OAAO;AACL,aAAO;AAAA,QACL,QAAQ,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,UACnD;AAAA,UACA,GAAI,IAAI,cAAc,EAAE,aAAa,IAAI,YAAY,IAAI,CAAC;AAAA,UAC1D,UAAU,CAAC,SAAS;AAAA,UACpB,aAAa,EAAE,aAAa,IAAI,KAAK;AAAA,UACrC,GAAI,IAAI,UAAU,EAAE,eAAe,EAAE,aAAa,IAAI,OAAO,EAAE,IAAI,CAAC;AAAA,QACtE,EAAE;AAAA,QACF,YAAY;AAAA,MACd;AAAA,IACF;AAAA;AAAA,IAGA,MAAM,UAAU,QAAiB,MAA8B,CAAC,GAAG;AACjE,YAAM,IAAI,MAAM,iBAAiB,QAAQ,yBAAyB;AAClE,YAAM,OAAO;AAAA,QACX,WAAW,EAAE,IAAI,EAAE;AAAA,QACnB,EAAE;AAAA,QACF,iBAAiB,EAAE,IAAI;AAAA,MACzB;AAEA,YAAM,MAAM,IAAI,MAAM,EAAE,SAAS,GAAG;AACpC,UAAI,CAAC,OAAO,CAAC,iBAAiB,GAAG;AAC/B,cAAM,IAAI,eAAe,gBAAgB,0BAA0B;AACrE,YAAM,SAAS,OAAO,KAAK,EAAE,SAAS,MAAM,IAAI,CAAC;AACjD,YAAM,WAAW,SAAS,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS;AACjE,UAAI,WAAW,MAAM,WAAW;AAC9B,cAAM,IAAI,eAAe,gBAAgB,oDAA+C;AAC1F,UAAI,CAAE,MAAM,QAAQ,EAAE,MAAM,EAAE,MAAM,WAAW,MAAM,UAAU,IAAI,SAAS,CAAC,GAAI;AAC/E,cAAM,IAAI,eAAe,gBAAgB,6BAA6B;AAAA,MACxE;AAEA,YAAM,MAAM,MAAM,EAAE,MAAM,MAAM,IAAI,IAAI;AACxC,YAAM,WAAW,MAAM,MAAM,IAAI,GAAG;AACpC,YAAM,MAAM,KAAK,IAAI,EAAE,SAAS,UAAU,QAAQ;AAClD,YAAM,MAAyB;AAAA,QAC7B,IAAI,UAAU,MAAM,GAAG,KAAK;AAAA,QAC5B,MAAM,EAAE;AAAA,QACR,WAAW;AAAA,QACX,KAAK,IAAI;AAAA,QACT,QAAQ,EAAE,SAAS;AAAA,QACnB,WAAW,KAAK,IAAI,IAAI;AAAA,QACxB,UAAU,IAAI;AAAA,MAChB;AACA,UAAI,UAAU,WAAW,IAAI,OAAQ,OAAM,OAAO,GAAG;AACrD,YAAM,MAAM,IAAI,KAAK,GAAG;AACxB,aAAO;AAAA,QACL,IAAI,IAAI;AAAA,QACR,eAAe,IAAI,KAAK,IAAI,SAAS,EAAE,YAAY;AAAA,QACnD,QAAQ;AAAA,QACR,WAAW;AAAA,MACb;AAAA,IACF;AAAA;AAAA,IAGA,MAAM,YAAY,QAAiB,MAA8B,CAAC,GAAG;AACnE,YAAM,IAAI,MAAM,mBAAmB,QAAQ,2BAA2B;AACtE,YAAM,OAAO;AAAA,QACX,WAAW,EAAE,IAAI,EAAE;AAAA,QACnB,EAAE;AAAA,QACF,iBAAiB,EAAE,IAAI;AAAA,MACzB;AACA,UAAI,CAAE,MAAM,QAAQ,EAAE,MAAM,EAAE,MAAM,WAAW,MAAM,UAAU,IAAI,SAAS,CAAC,GAAI;AAC/E,cAAM,IAAI,eAAe,gBAAgB,+BAA+B;AAAA,MAC1E;AACA,YAAM,MAAM,IAAI,MAAM,EAAE,SAAS,GAAG;AACpC,UAAI,IAAK,OAAM,MAAM,OAAO,MAAM,EAAE,MAAM,MAAM,IAAI,IAAI,CAAC;AACzD,aAAO,CAAC;AAAA,IACV;AAAA;AAAA,IAGA,MAAM,KACJ,MACA,MACA,QAAoD,MAAM,MACnC;AACvB,YAAM,MAAM,WAAW,IAAI;AAC3B,YAAM,UAAU,IAAI,UAAU,MAAM,IAAI,SAAS,MAAM,eAAe,IAAI,EAAE,IAAI;AAChF,YAAM,UAAU,GAAG,KAAK;AACxB,YAAM,OAAO,KAAK,UAAU;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,MAAM;AAAA,QACN,QAAQ;AAAA,MACV,CAAC;AACD,UAAI,OAAO,WAAW,IAAI,IAAI;AAC5B,cAAM,IAAI,eAAe,gBAAgB,4BAA4B;AAEvE,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,aAAoC,CAAC;AAC3C,iBAAW,OAAO,CAAC,GAAI,MAAM,MAAM,OAAO,CAAE,GAAG;AAC7C,YAAI,IAAI,SAAS,KAAM;AACvB,cAAM,MAAM,MAAM,IAAI,MAAM,IAAI,WAAW,IAAI,GAAG;AAClD,YAAI,IAAI,aAAa,KAAK;AACxB,gBAAM,MAAM,OAAO,GAAG;AACtB;AAAA,QACF;AACA,YAAI,CAAC,MAAM,IAAI,SAAoC,EAAG;AACtD,YAAI,CAAE,MAAM,QAAQ,EAAE,MAAM,WAAW,IAAI,WAAW,UAAU,IAAI,SAAS,CAAC,GAAI;AAChF,gBAAM,MAAM,OAAO,GAAG;AACtB;AAAA,QACF;AACA,mBAAW,KAAK,QAAQ,KAAK,KAAK,SAAS,IAAI,CAAC;AAAA,MAClD;AACA,aAAO,QAAQ,IAAI,UAAU;AAAA,IAC/B;AAAA,EACF;AACF;","names":[]}

package/dist/index.js

@@ -1,11 +1,11 @@
+import {
+  sandboxProxyHtml
+} from "./chunk-6QHKKFO3.js";
 import {
   MCP_VIEW_GLOBAL_KEY,
   getPublishedMcpView,
   publishMcpView
 } from "./chunk-5L3QHYWK.js";
-import {
-  sandboxProxyHtml
-} from "./chunk-6QHKKFO3.js";
 import {
   App,
   PostMessageTransport,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mountly-mcp",
-  "version": "4.3.0",
+  "version": "4.4.0",
   "description": "Build MCP Apps (SEP-1865) views from React, Vue or Svelte components — new or existing. One build emits the ui:// resource, its sidecar, and the MCP server wiring.",
   "keywords": [
     "chatgpt",
@@ -69,6 +69,10 @@
       "types": "./dist/openai/server.d.ts",
       "import": "./dist/openai/server.js"
     },
+    "./events": {
+      "types": "./dist/events/index.d.ts",
+      "import": "./dist/events/index.js"
+    },
     "./json-render": {
       "types": "./dist/json-render/index.d.ts",
       "import": "./dist/json-render/index.js"

package/templates/react/README.md.tmpl

@@ -9,6 +9,8 @@ pnpm install
 pnpm dev                 # sandboxed AppBridge host on :5179 (uses --server ./server.mjs)
 pnpm verify              # static conformance
 pnpm verify:render       # + Chromium mount check (needs Playwright)
+pnpm typecheck           # TypeScript 7 (native tsc, a.k.a. tsgo)
+pnpm lint                # oxlint, type-aware via tsgolint
 ```
 
 | File | Role |
@@ -78,6 +80,7 @@ jobs:
       - uses: actions/setup-node@v4
         with: { node-version: 22, cache: pnpm }
       - run: pnpm install
+      - run: pnpm typecheck && pnpm lint
       - run: pnpm exec mountly-mcp build
       - run: pnpm exec playwright install chromium
       - run: pnpm exec mountly-mcp verify --strict --render

package/templates/react/package.json.tmpl

@@ -10,7 +10,8 @@
     "verify:strict": "mountly-mcp verify --strict",
     "verify:render": "mountly-mcp verify --strict --render",
     "doctor": "mountly-mcp doctor",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint --type-aware"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
@@ -22,8 +23,10 @@
   "devDependencies": {
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.4",
-    "@vitejs/plugin-react": "^5.0.0",
-    "typescript": "^5.9.0",
+    "@vitejs/plugin-react": "^6.1.1",
+    "oxlint": "^1.86.0",
+    "oxlint-tsgolint": "^7.0.2003",
+    "typescript": "^7.0.2",
     "vite": "^8.2.1"
   }
 }

package/templates/svelte/README.md.tmpl

@@ -9,6 +9,8 @@ pnpm install
 pnpm dev
 pnpm verify
 pnpm verify:render
+pnpm typecheck           # TypeScript 7 (native tsc, a.k.a. tsgo)
+pnpm lint                # oxlint, type-aware via tsgolint
 ```
 
 | File | Role |

package/templates/svelte/package.json.tmpl

@@ -10,7 +10,8 @@
     "verify:strict": "mountly-mcp verify --strict",
     "verify:render": "mountly-mcp verify --strict --render",
     "doctor": "mountly-mcp doctor",
-    "typecheck": "svelte-check --tsconfig ./tsconfig.json"
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint --type-aware"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
@@ -21,8 +22,9 @@
   },
   "devDependencies": {
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
-    "svelte-check": "^4.0.0",
-    "typescript": "^5.9.0",
+    "oxlint": "^1.86.0",
+    "oxlint-tsgolint": "^7.0.2003",
+    "typescript": "^7.0.2",
     "vite": "^8.2.1"
   }
 }

package/templates/svelte/src/env.d.ts.tmpl

@@ -0,0 +1,10 @@
+/// <reference types="vite/client" />
+
+// Types `.svelte` imports for `tsc --noEmit` on TypeScript 7. Switch typecheck to
+// `svelte-check` and delete this file once svelte-check supports TypeScript 7.
+declare module "*.svelte" {
+  import type { Component } from "svelte";
+
+  const component: Component<Record<string, unknown>>;
+  export default component;
+}

package/templates/vanilla/README.md.tmpl

@@ -9,6 +9,8 @@ pnpm install
 pnpm dev
 pnpm verify
 pnpm verify:render
+pnpm typecheck           # TypeScript 7 (native tsc, a.k.a. tsgo)
+pnpm lint                # oxlint, type-aware via tsgolint
 ```
 
 | File | Role |

package/templates/vanilla/package.json.tmpl

@@ -10,7 +10,8 @@
     "verify:strict": "mountly-mcp verify --strict",
     "verify:render": "mountly-mcp verify --strict --render",
     "doctor": "mountly-mcp doctor",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint --type-aware"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
@@ -18,7 +19,9 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "typescript": "^5.9.0",
+    "oxlint": "^1.86.0",
+    "oxlint-tsgolint": "^7.0.2003",
+    "typescript": "^7.0.2",
     "vite": "^8.2.1"
   }
 }

package/templates/vue/README.md.tmpl

@@ -9,6 +9,8 @@ pnpm install
 pnpm dev
 pnpm verify
 pnpm verify:render
+pnpm typecheck           # TypeScript 7 (native tsc, a.k.a. tsgo)
+pnpm lint                # oxlint, type-aware via tsgolint
 ```
 
 | File | Role |

package/templates/vue/package.json.tmpl

@@ -10,7 +10,8 @@
     "verify:strict": "mountly-mcp verify --strict",
     "verify:render": "mountly-mcp verify --strict --render",
     "doctor": "mountly-mcp doctor",
-    "typecheck": "vue-tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint --type-aware"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
@@ -21,8 +22,9 @@
   },
   "devDependencies": {
     "@vitejs/plugin-vue": "^6.0.8",
-    "typescript": "^5.9.0",
-    "vite": "^8.2.1",
-    "vue-tsc": "^2.2.0"
+    "oxlint": "^1.86.0",
+    "oxlint-tsgolint": "^7.0.2003",
+    "typescript": "^7.0.2",
+    "vite": "^8.2.1"
   }
 }

package/templates/vue/src/env.d.ts.tmpl

@@ -0,0 +1,10 @@
+/// <reference types="vite/client" />
+
+// Types `.vue` imports for `tsc --noEmit` on TypeScript 7. Switch typecheck to
+// `vue-tsc --noEmit` and delete this file once vue-tsc supports TypeScript 7.
+declare module "*.vue" {
+  import type { DefineComponent } from "vue";
+
+  const component: DefineComponent<Record<string, unknown>, Record<string, unknown>, unknown>;
+  export default component;
+}

package/dist/doctor-4MTC6Y4X.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/doctor.ts"],"sourcesContent":["import { existsSync, readFileSync, readdirSync } from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport { join, resolve } from \"node:path\";\nimport { CLI_ERROR_CODES, cliError } from \"./errors.js\";\n\nexport interface DoctorCheck {\n  id: string;\n  ok: boolean;\n  detail: string;\n}\n\nexport interface DoctorReport {\n  ok: boolean;\n  checks: DoctorCheck[];\n}\n\nfunction nodeMajor(): number {\n  return Number(process.versions.node.split(\".\")[0] ?? 0);\n}\n\nfunction tryResolve(specifier: string, fromDir: string): string | null {\n  try {\n    const require = createRequire(resolve(fromDir, \"package.json\"));\n    return require.resolve(specifier);\n  } catch {\n    return null;\n  }\n}\n\nconst OPENAI_USAGE =\n  /openai\\/ui|useOpenAIExtensions|mountly-mcp\\/openai|mountly-mcp\\/react\\/openai|@openai\\/mcp-extensions|openaiUi\\b|openaiUiToolMeta|enableOpenAiExtensions/;\n\nfunction projectSourcesMentionOpenAi(cwd: string, viteConfig?: string): boolean {\n  const candidates: string[] = [];\n  if (viteConfig) candidates.push(viteConfig);\n  for (const name of [\"server.ts\", \"server.mjs\", \"server.js\", \"src/server.ts\", \"src/view.tsx\"]) {\n    const path = resolve(cwd, name);\n    if (existsSync(path)) candidates.push(path);\n  }\n  const srcDir = resolve(cwd, \"src\");\n  if (existsSync(srcDir)) {\n    try {\n      for (const entry of readdirSync(srcDir, { withFileTypes: true })) {\n        if (entry.isFile() && /\\.(tsx?|jsx?|mjs|cjs)$/.test(entry.name)) {\n          candidates.push(join(srcDir, entry.name));\n        }\n      }\n    } catch {\n      // ignore unreadable src\n    }\n  }\n  for (const path of candidates) {\n    try {\n      if (OPENAI_USAGE.test(readFileSync(path, \"utf8\"))) return true;\n    } catch {\n      // skip\n    }\n  }\n  return false;\n}\n\n/**\n * Check the local project for Mountly MCP readiness. Exits nonzero via the\n * CLI when `ok` is false.\n */\nexport function runDoctor(cwd = process.cwd()): DoctorReport {\n  const checks: DoctorCheck[] = [];\n\n  const major = nodeMajor();\n  checks.push({\n    id: \"node\",\n    ok: major >= 20,\n    detail:\n      major >= 20\n        ? `Node ${process.versions.node} (ok; 20+ required, 22+ recommended)`\n        : `Node ${process.versions.node} is below 20. Upgrade Node, then re-run mountly-mcp doctor.`,\n  });\n\n  const viteConfigCandidates = [\n    \"vite.config.ts\",\n    \"vite.config.mts\",\n    \"vite.config.js\",\n    \"vite.config.mjs\",\n  ].map((name) => resolve(cwd, name));\n  const viteConfig = viteConfigCandidates.find((path) => existsSync(path));\n  checks.push({\n    id: \"vite-config\",\n    ok: Boolean(viteConfig),\n    detail: viteConfig\n      ? `Found ${viteConfig}`\n      : \"No vite.config.* in this directory. Run from the View project, or: npx mountly-mcp create my-app --framework react\",\n  });\n\n  if (viteConfig) {\n    const source = readFileSync(viteConfig, \"utf8\");\n    const hasPlugin = /mountlyMcpViews\\s*\\(/.test(source);\n    checks.push({\n      id: \"vite-plugin\",\n      ok: hasPlugin,\n      detail: hasPlugin\n        ? \"vite config imports mountlyMcpViews()\"\n        : `Add mountlyMcpViews() from \"mountly-mcp/vite\" to ${viteConfig}`,\n    });\n  }\n\n  const manifest = resolve(cwd, \"dist/mountly-mcp.manifest.json\");\n  checks.push({\n    id: \"manifest\",\n    ok: existsSync(manifest),\n    detail: existsSync(manifest)\n      ? `Found ${manifest}`\n      : \"No dist/mountly-mcp.manifest.json yet. Run: npx mountly-mcp build\",\n  });\n\n  const playwright = tryResolve(\"playwright\", cwd) ?? tryResolve(\"@playwright/test\", cwd);\n  checks.push({\n    id: \"playwright\",\n    ok: Boolean(playwright),\n    detail: playwright\n      ? `Playwright resolvable for verify --render (${playwright})`\n      : \"Playwright not installed. For CI render checks: pnpm add -D playwright && npx playwright install chromium\",\n  });\n\n  const pkgPath = resolve(cwd, \"package.json\");\n  if (existsSync(pkgPath)) {\n    const pkg = JSON.parse(readFileSync(pkgPath, \"utf8\")) as {\n      dependencies?: Record<string, string>;\n      peerDependencies?: Record<string, string>;\n      devDependencies?: Record<string, string>;\n    };\n    const deps = { ...pkg.dependencies, ...pkg.devDependencies };\n    if (deps.react) {\n      const reactPath = tryResolve(\"react/package.json\", cwd);\n      if (reactPath) {\n        const reactPkg = JSON.parse(readFileSync(reactPath, \"utf8\")) as { version?: string };\n        const reactMajor = Number((reactPkg.version ?? \"0\").split(\".\")[0]);\n        checks.push({\n          id: \"react\",\n          ok: reactMajor >= 19,\n          detail:\n            reactMajor >= 19\n              ? `React ${reactPkg.version} (ok)`\n              : `React ${reactPkg.version} is below 19. mountly-mcp/react and mountly-react require React 19.`,\n        });\n      }\n    }\n    if (deps.vite) {\n      const vitePath = tryResolve(\"vite/package.json\", cwd);\n      if (vitePath) {\n        const vitePkg = JSON.parse(readFileSync(vitePath, \"utf8\")) as { version?: string };\n        const viteMajor = Number((vitePkg.version ?? \"0\").split(\".\")[0]);\n        checks.push({\n          id: \"vite\",\n          ok: viteMajor >= 8,\n          detail:\n            viteMajor >= 8\n              ? `Vite ${vitePkg.version} (ok)`\n              : `Vite ${vitePkg.version} is below 8. mountly-mcp/vite is built and tested against Vite 8.`,\n        });\n      }\n    }\n  }\n\n  if (projectSourcesMentionOpenAi(cwd, viteConfig)) {\n    const openai = tryResolve(\"@openai/mcp-extensions/package.json\", cwd);\n    checks.push({\n      id: \"openai-extensions\",\n      ok: Boolean(openai),\n      detail: openai\n        ? `@openai/mcp-extensions resolvable (${openai})`\n        : 'Project references OpenAI MCP extensions but @openai/mcp-extensions is not installed. Run: pnpm add @openai/mcp-extensions',\n    });\n  }\n\n  // Manifest missing is advisory for a brand-new scaffold before first build.\n  const hard = checks.filter((c) => c.id !== \"manifest\" && c.id !== \"playwright\");\n  const ok = hard.every((c) => c.ok);\n\n  return { ok, checks };\n}\n\nexport function formatDoctorReport(report: DoctorReport): string {\n  const lines = [\"mountly-mcp doctor\", \"\"];\n  for (const check of report.checks) {\n    lines.push(`${check.ok ? \"ok\" : \"FAIL\"}  ${check.id.padEnd(14)} ${check.detail}`);\n  }\n  lines.push(\"\");\n  lines.push(report.ok ? \"Ready for mountly-mcp build / dev / verify.\" : \"Fix FAIL items above.\");\n  lines.push(\"\");\n  return `${lines.join(\"\\n\")}\\n`;\n}\n\nexport function doctorCommand(cwd = process.cwd()): void {\n  const report = runDoctor(cwd);\n  process.stdout.write(formatDoctorReport(report));\n  if (!report.ok) {\n    throw cliError(\n      CLI_ERROR_CODES.DOCTOR_FAILED,\n      \"one or more doctor checks failed\",\n      \"Fix the FAIL lines above, then re-run: mountly-mcp doctor\",\n    );\n  }\n}\n"],"mappings":";;;;;;AAAA,SAAS,YAAY,cAAc,mBAAmB;AACtD,SAAS,qBAAqB;AAC9B,SAAS,MAAM,eAAe;AAc9B,SAAS,YAAoB;AAC3B,SAAO,OAAO,QAAQ,SAAS,KAAK,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC;AACxD;AAEA,SAAS,WAAW,WAAmB,SAAgC;AACrE,MAAI;AACF,UAAMA,WAAU,cAAc,QAAQ,SAAS,cAAc,CAAC;AAC9D,WAAOA,SAAQ,QAAQ,SAAS;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,eACJ;AAEF,SAAS,4BAA4B,KAAa,YAA8B;AAC9E,QAAM,aAAuB,CAAC;AAC9B,MAAI,WAAY,YAAW,KAAK,UAAU;AAC1C,aAAW,QAAQ,CAAC,aAAa,cAAc,aAAa,iBAAiB,cAAc,GAAG;AAC5F,UAAM,OAAO,QAAQ,KAAK,IAAI;AAC9B,QAAI,WAAW,IAAI,EAAG,YAAW,KAAK,IAAI;AAAA,EAC5C;AACA,QAAM,SAAS,QAAQ,KAAK,KAAK;AACjC,MAAI,WAAW,MAAM,GAAG;AACtB,QAAI;AACF,iBAAW,SAAS,YAAY,QAAQ,EAAE,eAAe,KAAK,CAAC,GAAG;AAChE,YAAI,MAAM,OAAO,KAAK,yBAAyB,KAAK,MAAM,IAAI,GAAG;AAC/D,qBAAW,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC;AAAA,QAC1C;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,aAAW,QAAQ,YAAY;AAC7B,QAAI;AACF,UAAI,aAAa,KAAK,aAAa,MAAM,MAAM,CAAC,EAAG,QAAO;AAAA,IAC5D,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,UAAU,MAAM,QAAQ,IAAI,GAAiB;AAC3D,QAAM,SAAwB,CAAC;AAE/B,QAAM,QAAQ,UAAU;AACxB,SAAO,KAAK;AAAA,IACV,IAAI;AAAA,IACJ,IAAI,SAAS;AAAA,IACb,QACE,SAAS,KACL,QAAQ,QAAQ,SAAS,IAAI,yCAC7B,QAAQ,QAAQ,SAAS,IAAI;AAAA,EACrC,CAAC;AAED,QAAM,uBAAuB;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,IAAI,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC;AAClC,QAAM,aAAa,qBAAqB,KAAK,CAAC,SAAS,WAAW,IAAI,CAAC;AACvE,SAAO,KAAK;AAAA,IACV,IAAI;AAAA,IACJ,IAAI,QAAQ,UAAU;AAAA,IACtB,QAAQ,aACJ,SAAS,UAAU,KACnB;AAAA,EACN,CAAC;AAED,MAAI,YAAY;AACd,UAAM,SAAS,aAAa,YAAY,MAAM;AAC9C,UAAM,YAAY,uBAAuB,KAAK,MAAM;AACpD,WAAO,KAAK;AAAA,MACV,IAAI;AAAA,MACJ,IAAI;AAAA,MACJ,QAAQ,YACJ,0CACA,oDAAoD,UAAU;AAAA,IACpE,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,QAAQ,KAAK,gCAAgC;AAC9D,SAAO,KAAK;AAAA,IACV,IAAI;AAAA,IACJ,IAAI,WAAW,QAAQ;AAAA,IACvB,QAAQ,WAAW,QAAQ,IACvB,SAAS,QAAQ,KACjB;AAAA,EACN,CAAC;AAED,QAAM,aAAa,WAAW,cAAc,GAAG,KAAK,WAAW,oBAAoB,GAAG;AACtF,SAAO,KAAK;AAAA,IACV,IAAI;AAAA,IACJ,IAAI,QAAQ,UAAU;AAAA,IACtB,QAAQ,aACJ,8CAA8C,UAAU,MACxD;AAAA,EACN,CAAC;AAED,QAAM,UAAU,QAAQ,KAAK,cAAc;AAC3C,MAAI,WAAW,OAAO,GAAG;AACvB,UAAM,MAAM,KAAK,MAAM,aAAa,SAAS,MAAM,CAAC;AAKpD,UAAM,OAAO,EAAE,GAAG,IAAI,cAAc,GAAG,IAAI,gBAAgB;AAC3D,QAAI,KAAK,OAAO;AACd,YAAM,YAAY,WAAW,sBAAsB,GAAG;AACtD,UAAI,WAAW;AACb,cAAM,WAAW,KAAK,MAAM,aAAa,WAAW,MAAM,CAAC;AAC3D,cAAM,aAAa,QAAQ,SAAS,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC;AACjE,eAAO,KAAK;AAAA,UACV,IAAI;AAAA,UACJ,IAAI,cAAc;AAAA,UAClB,QACE,cAAc,KACV,SAAS,SAAS,OAAO,UACzB,SAAS,SAAS,OAAO;AAAA,QACjC,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,KAAK,MAAM;AACb,YAAM,WAAW,WAAW,qBAAqB,GAAG;AACpD,UAAI,UAAU;AACZ,cAAM,UAAU,KAAK,MAAM,aAAa,UAAU,MAAM,CAAC;AACzD,cAAM,YAAY,QAAQ,QAAQ,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC;AAC/D,eAAO,KAAK;AAAA,UACV,IAAI;AAAA,UACJ,IAAI,aAAa;AAAA,UACjB,QACE,aAAa,IACT,QAAQ,QAAQ,OAAO,UACvB,QAAQ,QAAQ,OAAO;AAAA,QAC/B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,MAAI,4BAA4B,KAAK,UAAU,GAAG;AAChD,UAAM,SAAS,WAAW,uCAAuC,GAAG;AACpE,WAAO,KAAK;AAAA,MACV,IAAI;AAAA,MACJ,IAAI,QAAQ,MAAM;AAAA,MAClB,QAAQ,SACJ,sCAAsC,MAAM,MAC5C;AAAA,IACN,CAAC;AAAA,EACH;AAGA,QAAM,OAAO,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,cAAc,EAAE,OAAO,YAAY;AAC9E,QAAM,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,EAAE;AAEjC,SAAO,EAAE,IAAI,OAAO;AACtB;AAEO,SAAS,mBAAmB,QAA8B;AAC/D,QAAM,QAAQ,CAAC,sBAAsB,EAAE;AACvC,aAAW,SAAS,OAAO,QAAQ;AACjC,UAAM,KAAK,GAAG,MAAM,KAAK,OAAO,MAAM,KAAK,MAAM,GAAG,OAAO,EAAE,CAAC,IAAI,MAAM,MAAM,EAAE;AAAA,EAClF;AACA,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,OAAO,KAAK,gDAAgD,uBAAuB;AAC9F,QAAM,KAAK,EAAE;AACb,SAAO,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA;AAC5B;AAEO,SAAS,cAAc,MAAM,QAAQ,IAAI,GAAS;AACvD,QAAM,SAAS,UAAU,GAAG;AAC5B,UAAQ,OAAO,MAAM,mBAAmB,MAAM,CAAC;AAC/C,MAAI,CAAC,OAAO,IAAI;AACd,UAAM;AAAA,MACJ,gBAAgB;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;","names":["require"]}