vitral 0.3.0 → 0.4.0

package/dist/vite.js

@@ -1,7 +1,7 @@
 // src/vite.ts
-import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join5, resolve as resolve5 } from "path";
+import { createHash as createHash3 } from "crypto";
+import { readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join6, resolve as resolve5 } from "path";
 
 // src/vite-exposes.ts
 import { resolve } from "path";
@@ -105,9 +105,149 @@ function withSplit(m, outDir, s, groups2 = []) {
   return { ...m, files, ...s && { split: { entry: s.entry, chunks: s.chunks } }, ...dedupe.length && { dedupe } };
 }
 
+// src/vite/sbom.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync, readFileSync as readFileSync2, realpathSync } from "fs";
+import { dirname, isAbsolute, join as join2, sep } from "path";
+var SBOM_FILE = "sbom.cdx.json";
+var readPkg = (dir) => {
+  try {
+    return JSON.parse(readFileSync2(join2(dir, "package.json"), "utf8"));
+  } catch {
+    return void 0;
+  }
+};
+function bundledFiles(bundle, into = /* @__PURE__ */ new Set()) {
+  for (const f of Object.values(bundle)) {
+    if (f.type !== "chunk" || !f.modules) continue;
+    for (const [id, m] of Object.entries(f.modules)) {
+      const file = id.split("?")[0];
+      if (m.renderedLength > 0 && isAbsolute(file)) into.add(file);
+    }
+  }
+  return into;
+}
+function packageDirs(files) {
+  const dirs = /* @__PURE__ */ new Set();
+  const near = /* @__PURE__ */ new Map();
+  const nearest = (dir) => {
+    if (near.has(dir)) return near.get(dir);
+    const parent = dirname(dir);
+    const found = readPkg(dir)?.name ? dir : parent === dir ? null : nearest(parent);
+    near.set(dir, found);
+    return found;
+  };
+  const nm = `${sep}node_modules${sep}`;
+  for (const file of files) {
+    const at = file.lastIndexOf(nm);
+    if (at >= 0) {
+      const parts = file.slice(at + nm.length).split(sep);
+      const name = parts[0].startsWith("@") ? parts.slice(0, 2).join(sep) : parts[0];
+      if (parts.length > (parts[0].startsWith("@") ? 2 : 1)) dirs.add(file.slice(0, at + nm.length) + name);
+    } else {
+      const dir = nearest(dirname(file));
+      if (dir) dirs.add(dir);
+    }
+  }
+  return dirs;
+}
+function purl(name, version) {
+  const path = name.split("/").map(encodeURIComponent).join("/");
+  return `pkg:npm/${path}${version ? `@${encodeURIComponent(version)}` : ""}`;
+}
+function licenses(pkg) {
+  const raw = typeof pkg.license === "string" ? pkg.license : pkg.license?.type ?? pkg.licenses?.map((l) => l.type).filter(Boolean).join(" OR ");
+  if (!raw) return void 0;
+  const spdx = /^\(?[A-Za-z0-9.+-]+( (AND|OR|WITH) \(?[A-Za-z0-9.+-]+\)?)*\)?$/.test(raw) && raw !== "UNLICENSED";
+  return spdx ? [{ expression: raw }] : [{ license: { name: raw } }];
+}
+function component(pkg, type) {
+  const scoped = pkg.name.startsWith("@") && pkg.name.includes("/");
+  const ref = purl(pkg.name, pkg.version);
+  const license = licenses(pkg);
+  return {
+    type,
+    "bom-ref": ref,
+    ...scoped && { group: pkg.name.slice(0, pkg.name.indexOf("/")) },
+    name: scoped ? pkg.name.slice(pkg.name.indexOf("/") + 1) : pkg.name,
+    ...pkg.version && { version: pkg.version },
+    ...pkg.description && { description: pkg.description },
+    ...license && { licenses: license },
+    purl: ref
+  };
+}
+function resolveDir(from, name) {
+  for (let dir = from; ; dir = dirname(dir)) {
+    const candidate = join2(dir, "node_modules", name);
+    if (existsSync(join2(candidate, "package.json"))) {
+      try {
+        return realpathSync(candidate);
+      } catch {
+        return candidate;
+      }
+    }
+    if (dirname(dir) === dir) return void 0;
+  }
+}
+function createSbom(input) {
+  const rootDir = realpathSync(input.root);
+  const rootPkg = readPkg(rootDir) ?? {};
+  const main = component({ ...rootPkg, name: input.name, version: input.version }, "application");
+  const hashes = input.entry && [{ alg: "SHA-512", content: createHash2("sha512").update(input.entry).digest("hex") }];
+  const byDir = /* @__PURE__ */ new Map();
+  for (const dir of packageDirs(input.files)) {
+    let real = dir;
+    try {
+      real = realpathSync(dir);
+    } catch {
+    }
+    const pkg = readPkg(real);
+    if (real === rootDir || !pkg?.name || byDir.has(real)) continue;
+    byDir.set(real, { pkg, ref: purl(pkg.name, pkg.version) });
+  }
+  const deps = (dir, pkg) => {
+    const names = Object.keys({ ...pkg.peerDependencies, ...pkg.optionalDependencies, ...pkg.dependencies });
+    const refs = /* @__PURE__ */ new Set();
+    for (const n of names) {
+      const hit = byDir.get(resolveDir(dir, n) ?? "");
+      if (hit) refs.add(hit.ref);
+    }
+    return [...refs].sort();
+  };
+  const components = /* @__PURE__ */ new Map();
+  const graph = /* @__PURE__ */ new Map([[main["bom-ref"], new Set(deps(rootDir, rootPkg))]]);
+  for (const [dir, { pkg, ref }] of byDir) {
+    if (!components.has(ref)) components.set(ref, component(pkg, "library"));
+    const set = graph.get(ref) ?? /* @__PURE__ */ new Set();
+    for (const d of deps(dir, pkg)) if (d !== ref) set.add(d);
+    graph.set(ref, set);
+  }
+  const epoch = Number(process.env.SOURCE_DATE_EPOCH);
+  const timestamp = input.timestamp ?? (Number.isFinite(epoch) && process.env.SOURCE_DATE_EPOCH ? new Date(epoch * 1e3) : /* @__PURE__ */ new Date());
+  const body = {
+    metadata: {
+      timestamp: timestamp.toISOString().replace(/\.\d{3}Z$/, "Z"),
+      tools: { components: [{ type: "application", name: "vitral", ...input.tool && { version: input.tool }, purl: purl("vitral", input.tool) }] },
+      component: { ...main, ...hashes && { hashes } }
+    },
+    components: [...components.values()].sort((a, b) => a["bom-ref"].localeCompare(b["bom-ref"])),
+    dependencies: [...graph].map(([ref, set]) => ({ ref, dependsOn: [...set].sort() }))
+  };
+  const h = createHash2("sha1").update(JSON.stringify(body)).digest("hex");
+  const serial = `urn:uuid:${h.slice(0, 8)}-${h.slice(8, 12)}-5${h.slice(13, 16)}-${(parseInt(h[16], 16) & 3 | 8).toString(16)}${h.slice(17, 20)}-${h.slice(20, 32)}`;
+  return {
+    $schema: "http://cyclonedx.org/schema/bom-1.6.schema.json",
+    bomFormat: "CycloneDX",
+    specVersion: "1.6",
+    serialNumber: serial,
+    version: 1,
+    ...body
+  };
+}
+
 // src/vite/dedupe.ts
-import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { dirname, join as join2, resolve as resolve2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname2, join as join3, resolve as resolve2 } from "path";
 import { pathToFileURL } from "url";
 var REACT = ["react", "react-dom", "react-dom/client", "react/jsx-runtime", "react/jsx-dev-runtime", "react/compiler-runtime"];
 var BOOT = "virtual:vitral-boot";
@@ -118,10 +258,10 @@ var pkgOf = (spec) => spec.split("/").slice(0, spec.startsWith("@") ? 2 : 1).joi
 var groupOf = (spec) => REACT.includes(spec) || pkgOf(spec) === "scheduler" ? "react" : pkgOf(spec);
 var ident = /^[A-Za-z_$][\w$]*$/;
 function versionOf(file, pkg) {
-  for (let dir = dirname(file); dir !== dirname(dir); dir = dirname(dir)) {
-    const json = join2(dir, "package.json");
-    if (!existsSync(json)) continue;
-    const data = JSON.parse(readFileSync2(json, "utf8"));
+  for (let dir = dirname2(file); dir !== dirname2(dir); dir = dirname2(dir)) {
+    const json = join3(dir, "package.json");
+    if (!existsSync2(json)) continue;
+    const data = JSON.parse(readFileSync3(json, "utf8"));
     if (data.name === pkg) return data.version;
   }
   throw new Error(`vitral: vers\xE3o de ${pkg} n\xE3o encontrada`);
@@ -417,7 +557,7 @@ function splitShadowCss(text) {
 }
 
 // src/vite/adapter.ts
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { resolve as resolve3 } from "path";
 var PLUGINS = [
   [/^(preact:|prefresh$)/, "preact"],
@@ -456,10 +596,14 @@ import { component } from 'vitral'
 function wrap(c) {
   if (typeof c === 'function' && typeof HTMLElement !== 'undefined' && c.prototype instanceof HTMLElement) {
     const base = ${JSON.stringify(`${scope}-remote`.toLowerCase().replace(/^[^a-z]+/, "x-"))}
-    let tag = customElements.getName?.(c) || base
-    // Uma tag n\xE3o aceita outra classe: no HMR, a classe nova ganha tag nova.
-    for (let n = 2; customElements.get(tag) && customElements.get(tag) !== c; n++) tag = base + '-' + n
-    return elementRemote(tag, () => customElements.get(tag) || customElements.define(tag, c))
+    // No registro do remote (ctx.customElements). Uma tag n\xE3o aceita outra
+    // classe: no HMR, a classe nova ganha tag nova.
+    return elementRemote(base, (r) => {
+      let tag = r.getName?.(c) || base
+      for (let n = 2; r.get(tag) && r.get(tag) !== c; n++) tag = base + '-' + n
+      r.get(tag) || r.define(tag, c)
+      return tag
+    })
   }
   if (typeof c === 'function') return component(c)
   throw new Error('[vitral] o export default n\xE3o \xE9 um remote: exporte um componente, uma fun\xE7\xE3o ou um objeto com mount()')
@@ -471,21 +615,21 @@ var CANDIDATES = ["src/remote", "src/App", "src/app"];
 var EXTENSIONS = [".tsx", ".ts", ".jsx", ".js", ".vue", ".svelte"];
 function findEntry(root) {
   for (const base of CANDIDATES) {
-    for (const ext of EXTENSIONS) if (existsSync2(resolve3(root, base + ext))) return base + ext;
+    for (const ext of EXTENSIONS) if (existsSync3(resolve3(root, base + ext))) return base + ext;
   }
 }
 
 // src/vite/types.ts
 import { createRequire as createRequire2 } from "module";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 
 // src/vite/oxc.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
 import { createRequire } from "module";
-import { dirname as dirname2, join as join3, resolve as resolve4 } from "path";
+import { dirname as dirname3, join as join4, resolve as resolve4 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 async function loadOxc(root) {
-  const req = createRequire(join3(root, "package.json"));
+  const req = createRequire(join4(root, "package.json"));
   const ids = [() => req.resolve("oxc-transform"), () => createRequire(req.resolve("vite/package.json")).resolve("rolldown/experimental")];
   for (const id of ids) {
     try {
@@ -525,7 +669,7 @@ var Reader = class {
     const cached = this.scopes.get(file);
     if (cached) return cached;
     const { ts } = this;
-    let code = readFileSync3(file, "utf8");
+    let code = readFileSync4(file, "utf8");
     if (!/\.d\.[cm]?ts$/.test(file)) {
       const out = this.oxc.isolatedDeclarationSync(file, code, {});
       if (out.errors.length) unsupported();
@@ -738,10 +882,10 @@ var Reader = class {
   }
 };
 function resolveFile(from, spec) {
-  const base = resolve4(dirname2(from), spec);
+  const base = resolve4(dirname3(from), spec);
   const stem = base.replace(/\.[cm]?jsx?$/, "");
-  const candidates = [base, ...[".ts", ".tsx", ".mts", ".cts", ".d.ts"].map((ext) => stem + ext), ...["index.ts", "index.tsx", "index.d.ts"].map((f) => join3(base, f))];
-  const file = candidates.find((f) => /\.[cm]?tsx?$/.test(f) && existsSync3(f));
+  const candidates = [base, ...[".ts", ".tsx", ".mts", ".cts", ".d.ts"].map((ext) => stem + ext), ...["index.ts", "index.tsx", "index.d.ts"].map((f) => join4(base, f))];
+  const file = candidates.find((f) => /\.[cm]?tsx?$/.test(f) && existsSync4(f));
   return file ?? unsupported();
 }
 
@@ -754,7 +898,7 @@ export type Props = ${props}
 async function loadTs(root) {
   const api = (ts) => typeof ts?.createProgram === "function" ? ts : null;
   try {
-    const ts = api(createRequire2(join4(root, "package.json"))("typescript"));
+    const ts = api(createRequire2(join5(root, "package.json"))("typescript"));
     if (ts) return ts;
   } catch {
   }
@@ -874,6 +1018,116 @@ var Printer = class {
   }
 };
 
+// src/vite/mcp-app.ts
+var MCP_APP_PROTOCOL = "2026-01-26";
+var MCP_APP_GLOBAL = "__vitral_remote__";
+var MCP_RUNTIME = `function (w, mod, info) {
+  var parent = w.parent, doc = w.document, seq = 0, pending = {}, handlers = {}, last = {}, context = {}
+  var props = {}, mounted = null, ready = false, dirty = false
+  function send(m) { m.jsonrpc = '2.0'; parent.postMessage(m, '*') }
+  function request(method, params) {
+    var id = ++seq
+    return new Promise(function (ok, fail) {
+      pending[id] = [ok, fail]
+      send({ id: id, method: method, params: params || {} })
+    })
+  }
+  function notify(method, params) { send({ method: method, params: params || {} }) }
+  function report(e) { notify('notifications/message', { level: 'error', logger: info.name, data: String((e && e.message) || e) }) }
+  function text(p, key) { return typeof p === 'string' ? p : p && p[key] }
+  function push() { if (mounted && mounted.update) { try { mounted.update(Object.assign({}, props)) } catch (e) { report(e) } } }
+  // Antes do mount terminar, s\xF3 guarda: o update sai uma vez, logo depois.
+  function set(key, value) { props[key] = value; if (ready) push(); else dirty = true }
+  function theme(c) {
+    if (!c) return
+    var root = doc.documentElement, vars = c.styles && c.styles.variables
+    if (c.theme) { root.setAttribute('data-theme', c.theme); root.style.colorScheme = c.theme }
+    for (var k in vars) if (vars[k] != null) root.style.setProperty(k, vars[k])
+  }
+  var events = {
+    emit: function (type, payload) {
+      last[type] = payload
+      ;(handlers[type] || []).slice().forEach(function (h) { try { h(payload) } catch (e) { w.console.error(e) } })
+      if (type === 'mcp:message') request('ui/message', { role: 'user', content: [{ type: 'text', text: String(text(payload, 'text')) }] }).catch(report)
+      else if (type === 'mcp:open-link') request('ui/open-link', { url: String(text(payload, 'url')) }).catch(report)
+      else {
+        context[type] = payload
+        request('ui/update-model-context', { structuredContent: context, content: [{ type: 'text', text: JSON.stringify(context) }] }).catch(report)
+      }
+    },
+    on: function (type, fn) {
+      ;(handlers[type] = handlers[type] || []).push(fn)
+      return function () { handlers[type] = handlers[type].filter(function (h) { return h !== fn }) }
+    },
+    last: function (type) { return last[type] }
+  }
+  var root = doc.createElement('div')
+  root.setAttribute('data-vitral-root', info.name)
+  if (info.scope) root.setAttribute('data-vitral-scope', info.scope)
+  var ctx = {
+    name: info.name, baseUrl: w.location.href, events: events, shadowRoot: null, portalContainer: doc.body, protocol: 1,
+    reportError: report,
+    navigate: function (url) { request('ui/open-link', { url: String(url) }).catch(report) },
+    mcp: { request: request, notify: notify, hostContext: function () { return props.hostContext } }
+  }
+  function size() {
+    var h = doc.documentElement, old = h.style.height
+    h.style.height = 'max-content'
+    var height = Math.ceil(h.getBoundingClientRect().height)
+    h.style.height = old
+    notify('ui/notifications/size-changed', { width: Math.ceil(w.innerWidth), height: height })
+  }
+  var on = {
+    'ui/notifications/tool-input': function (p) { set('toolInput', p.arguments) },
+    'ui/notifications/tool-input-partial': function (p) { set('toolInputPartial', p.arguments) },
+    'ui/notifications/tool-result': function (p) { set('toolResult', p) },
+    'ui/notifications/tool-cancelled': function (p) { set('toolCancelled', p.reason || true) },
+    'ui/notifications/host-context-changed': function (p) { theme(p); set('hostContext', Object.assign({}, props.hostContext, p)) },
+    'ui/resource-teardown': function () { if (mounted) mounted.unmount(); mounted = null; return {} },
+    ping: function () { return {} }
+  }
+  w.addEventListener('message', function (e) {
+    var m = e.data
+    if (e.source !== parent || !m || m.jsonrpc !== '2.0') return
+    if (m.method === undefined) {
+      var p = pending[m.id]
+      if (!p) return
+      delete pending[m.id]
+      return m.error ? p[1](new Error(m.error.message)) : p[0](m.result)
+    }
+    var fn = on[m.method], result
+    if (m.id === undefined) return void (fn && fn(m.params || {}))
+    if (!fn) return send({ id: m.id, error: { code: -32601, message: 'm\xE9todo desconhecido: ' + m.method } })
+    try { result = fn(m.params || {}) } catch (err) { return send({ id: m.id, error: { code: -32603, message: String(err && err.message || err) } }) }
+    send({ id: m.id, result: result })
+  })
+  request('ui/initialize', {
+    appInfo: { name: info.name, version: info.version || '0.0.0' }, appCapabilities: {}, protocolVersion: '${MCP_APP_PROTOCOL}'
+  }).then(function (r) {
+    props.hostContext = r && r.hostContext
+    theme(props.hostContext)
+    notify('ui/notifications/initialized')
+    doc.body.appendChild(root)
+    var remote = (mod && mod.default) || mod
+    if (!remote || typeof remote.mount !== 'function') throw new Error('o m\xF3dulo n\xE3o exporta mount()')
+    dirty = false
+    return remote.mount(root, Object.assign({}, props), ctx)
+  }).then(function (handle) {
+    mounted = handle
+    ready = true
+    if (dirty) push()
+    size()
+    if (w.ResizeObserver) { var ro = new w.ResizeObserver(size); ro.observe(doc.documentElement); ro.observe(doc.body) }
+  }).catch(report)
+}`;
+var inline = (text, tag) => text.replace(new RegExp(`</(${tag})`, "gi"), "<\\/$1").replace(/<!--/g, "<\\!--");
+function mcpAppHtml(page) {
+  const info = JSON.stringify({ name: page.name, version: page.version, scope: page.scope });
+  const styles = page.css.map((css) => `<style>${inline(css, "style")}</style>`).join("");
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${page.name.replace(/[<&]/g, (c) => c === "<" ? "&lt;" : "&amp;")}</title><style>html,body{margin:0}body{display:flow-root}</style>${styles}</head><body><script>${inline(page.code, "script")}</script><script>(${MCP_RUNTIME})(window, ${MCP_APP_GLOBAL}, ${inline(info, "script")})</script></body></html>
+`;
+}
+
 // src/vite/dev.ts
 var DEV_ENTRY = "@vitral/entry.js";
 var VIRTUAL_DEV_ENTRY = "\0vitral:dev-entry";
@@ -971,6 +1225,7 @@ function vitral(options = {}) {
   let pkg = {};
   let manifest;
   let split;
+  let modules = /* @__PURE__ */ new Set();
   let entry = options.entry;
   let adapter = "element";
   let framework = "element";
@@ -979,13 +1234,35 @@ function vitral(options = {}) {
   let shared = [];
   const dedupe = !!options.dedupe?.length;
   const hooks = dedupeHooks(() => options.exposes ? EXPOSES_ENTRY : options.adapter === false ? entryFile() : ENTRY_ID, () => shared);
+  const mcp = options.target === "mcp-app";
+  if (mcp && (options.exposes || dedupe || options.shared?.length)) {
+    throw new Error("[vitral] target: 'mcp-app' gera um HTML \xFAnico: n\xE3o combina com exposes, dedupe nem shared.");
+  }
   const scopeName = () => (options.name ?? pkg.name ?? "remote").replace(/[^a-zA-Z0-9_-]/g, "-");
+  const mcpApp = (files, js) => {
+    const css = files.filter((f) => f.type === "asset" && f.fileName.endsWith(".css")).map((f) => f.fileName);
+    const read = (file) => {
+      const text = readFileSync5(join6(outDir, file), "utf8");
+      rmSync2(join6(outDir, file));
+      return text;
+    };
+    const scope = options.scopeCss === false ? void 0 : scopeName();
+    const html = mcpAppHtml({
+      name: options.name ?? pkg.name ?? "remote",
+      version: options.version ?? pkg.version,
+      scope,
+      code: read(js),
+      css: css.map((f) => transformCss(read(f), options, scopeName()))
+    });
+    writeFileSync2(join6(outDir, "mcp-app.html"), html);
+  };
   return {
     name: "vitral",
     config(user, { mode, command }) {
       entry ??= findEntry(resolve5(user.root ?? process.cwd()));
       if (!entry) throw new Error("[vitral] n\xE3o achei a entrada do remote (src/remote.* ou src/App.*). Use vitral({ entry }).");
       const rolldown = "rolldownVersion" in this.meta;
+      const dir = options.versionDir ? versionDir(user.root ?? process.cwd(), user.build?.outDir, options.version) : void 0;
       return {
         // Código de biblioteca não tem process.env; React e Vue precisam disso.
         define: { "process.env.NODE_ENV": JSON.stringify(mode === "development" ? "development" : "production") },
@@ -995,12 +1272,18 @@ function vitral(options = {}) {
         // O remote não tem index.html: sem isso o Vite só descobre as
         // dependências no primeiro request e recarrega a página do host.
         optimizeDeps: user.optimizeDeps?.entries ? void 0 : { entries: [entry] },
-        build: {
+        build: mcp ? {
+          // Um IIFE só, sem chunks: o HTML do MCP App não pode buscar arquivos.
+          lib: { entry: options.adapter === false ? entry : ENTRY_ID, formats: ["iife"], name: MCP_APP_GLOBAL, fileName: () => "mcp-app.js", cssFileName: "remote" },
+          rollupOptions: { output: rolldown ? { codeSplitting: false } : { inlineDynamicImports: true } },
+          cssCodeSplit: false
+        } : {
           // Nomes com hash: cache eterno no CDN. Só o vitral.json muda a cada deploy.
           lib: { entry: dedupe ? BOOT : options.exposes ? EXPOSES_ENTRY : options.adapter === false ? entry : ENTRY_ID, fileName: () => "remote-[hash].js", cssFileName: "remote" },
           // Arquivo único (hosts antigos e caminho com blob:) e build dividido (manifesto v2).
           rollupOptions: { external: options.shared ?? [], output: outputs(rolldown) },
-          cssCodeSplit: false
+          cssCodeSplit: false,
+          ...dir && { outDir: dir }
         }
       };
     },
@@ -1011,7 +1294,7 @@ function vitral(options = {}) {
       serve = c.command === "serve";
       outDir = resolve5(c.root, c.build.outDir);
       try {
-        pkg = JSON.parse(readFileSync4(join5(root, "package.json"), "utf8"));
+        pkg = JSON.parse(readFileSync5(join6(root, "package.json"), "utf8"));
       } catch {
       }
     },
@@ -1056,20 +1339,22 @@ function vitral(options = {}) {
       }
     },
     writeBundle(_, bundle) {
+      if (options.sbom) bundledFiles(bundle, modules);
       if (isSplit(bundle)) return void (split = collect(outDir, bundle));
       const files = Object.values(bundle);
       const entry2 = files.find((f) => f.type === "chunk" && f.isEntry);
       if (!entry2) return;
+      if (mcp) return mcpApp(files, entry2.fileName);
       const emit = (file, text, kind = "") => {
-        const hash = createHash2("sha256").update(text).digest("base64url").slice(0, 8);
+        const hash = createHash3("sha256").update(text).digest("base64url").slice(0, 8);
         const name = file.replace(/\.css$/, `${kind}-${hash}.css`);
-        writeFileSync2(join5(outDir, name), text);
+        writeFileSync2(join6(outDir, name), text);
         return name;
       };
       const shadow = { css: [] };
       const css = files.filter((f) => f.type === "asset" && f.fileName.endsWith(".css")).map((f) => {
-        const from = join5(outDir, f.fileName);
-        const text = transformCss(readFileSync4(from, "utf8"), options, scopeName());
+        const from = join6(outDir, f.fileName);
+        const text = transformCss(readFileSync5(from, "utf8"), options, scopeName());
         const name = emit(f.fileName, text);
         if (name !== f.fileName) rmSync2(from);
         const split2 = splitShadowCss(text);
@@ -1079,14 +1364,14 @@ function vitral(options = {}) {
         if (split2.rebase) shadow.rebase = true;
         return name;
       });
-      const code = readFileSync4(join5(outDir, entry2.fileName));
+      const code = readFileSync5(join6(outDir, entry2.fileName));
       manifest = {
         name: options.name ?? pkg.name ?? "remote",
         version: options.version ?? pkg.version,
         entry: entry2.fileName,
         css,
         ...css.length ? { shadow } : {},
-        integrity: "sha384-" + createHash2("sha384").update(code).digest("base64"),
+        integrity: "sha384-" + createHash3("sha384").update(code).digest("base64"),
         ...options.scopeCss === false ? {} : { scope: scopeName() },
         ...options.exposes ? { exposes: Object.keys(exposeKeys(options.exposes)) } : {},
         ...contractOf(options.contract?.version, shared)
@@ -1095,13 +1380,34 @@ function vitral(options = {}) {
     async closeBundle() {
       if (!manifest) return;
       const done = withSplit(manifest, outDir, split, shared);
+      if (options.sbom) {
+        const bom = createSbom({ root, name: done.name, version: done.version, files: modules, entry: readFileSync5(join6(outDir, done.entry)), tool: ownVersion() });
+        writeFileSync2(join6(outDir, SBOM_FILE), JSON.stringify(bom, null, 2) + "\n");
+        done.sbom = { file: SBOM_FILE, integrity: sri(join6(outDir, SBOM_FILE)) };
+      }
       manifest = split = void 0;
-      writeFileSync2(join5(outDir, "vitral.json"), JSON.stringify(done, null, 2) + "\n");
+      modules = /* @__PURE__ */ new Set();
+      writeFileSync2(join6(outDir, "vitral.json"), JSON.stringify(done, null, 2) + "\n");
       const props = options.types === false ? null : await extractProps(root, entryFile());
-      if (props) writeFileSync2(join5(outDir, "vitral.d.ts"), typesFile(done.name, props));
+      if (props) writeFileSync2(join6(outDir, "vitral.d.ts"), typesFile(done.name, props));
     }
   };
 }
+function ownVersion() {
+  try {
+    return JSON.parse(readFileSync5(new URL("../package.json", import.meta.url), "utf8")).version;
+  } catch {
+    return void 0;
+  }
+}
+function versionDir(root, outDir = "dist", version) {
+  try {
+    version ??= JSON.parse(readFileSync5(join6(resolve5(root), "package.json"), "utf8")).version;
+  } catch {
+  }
+  if (!version) throw new Error('[vitral] versionDir precisa de uma vers\xE3o: use vitral({ version }) ou "version" no package.json.');
+  return join6(outDir, version);
+}
 function contractOf(version, groups2) {
   const contract = {
     ...version && { version },

package/dist/vue.d.ts

@@ -1,7 +1,7 @@
 import * as vue from 'vue';
 import { PropType, App, ShallowRef, WritableComputedRef, ComputedRef, Component } from 'vue';
-import { P as Props, I as Isolation, R as RemoteContext, S as Shared, a as RemoteModule } from './types-Czvm-siZ.js';
-export { e as events } from './events-D5gs7rff.js';
+import { P as Props, I as Isolation, R as RemoteContext, S as Shared, a as RemoteModule } from './types-CA2p9KHC.js';
+export { e as events } from './events-Dkpkw_Sv.js';
 import { L as Loading, P as Prefetch } from './host-slot-Cz6EiGsB.js';
 import './errors-kjBv6IH_.js';
 
@@ -127,8 +127,8 @@ declare const VitralRemote: vue.DefineComponent<vue.ExtractPropTypes<{
     onError?: ((...args: any[]) => any) | undefined;
     onReady?: ((...args: any[]) => any) | undefined;
 }>, {
-    isolate: Isolation;
     name: string;
+    isolate: Isolation;
     priority: RequestPriority;
     loading: Loading;
     src: string;

package/dist/vue.js

@@ -1,20 +1,20 @@
 import {
   hostSlot,
   timings
-} from "./chunk-IHTUM6LT.js";
+} from "./chunk-W6322KGP.js";
 import {
   defineRemote,
   events,
   memoSelect,
   same,
   shared
-} from "./chunk-I3VSKSAZ.js";
-import "./chunk-TD4S3IHA.js";
-import "./chunk-ZAC6QQI6.js";
+} from "./chunk-WD4CDGDZ.js";
+import "./chunk-EMSB2NVX.js";
+import "./chunk-6EX5KYT5.js";
 import {
   absolute
-} from "./chunk-GNHCZRQP.js";
-import "./chunk-AKNNHQ2H.js";
+} from "./chunk-TW7KYJQ6.js";
+import "./chunk-463H6B56.js";
 import "./chunk-GNPFWISJ.js";
 
 // src/vue.ts