@devxcrew/framework 0.1.8

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Devxcrew
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,139 @@
+# framework
+
+Own reusable configuration validation and native HTTP primitives.
+
+Use the sibling workspace layout. Shared framework and UI keep their existing public exports and
+build contracts.
+
+## Run
+
+Use Node 26.10 or newer and the package manifest requirements. Clone the sibling tools and
+mcp-governance repositories along with this repository.
+
+```powershell
+npm install
+npm run check
+```
+
+Cxsun runs npm run build:framework using its compiler to build this package.
+
+## Repository records
+
+- `AGENTS.md`: repository instructions and ownership rules.
+- `agent/SKILLS.md`: repository capabilities.
+- `agent/TASK.md`: current task and status.
+- `agent/PLAN.md`: next steps.
+- `agent/CHANGELOG.md`: versioned changes and validation results.
+
+## Shared guidance
+
+Retrieve shared documentation and rules only from `https://mcp.codexsun.com/mcp` using `npm run mcp:connect`.
+A successful authenticated connection is required before repository work. Stop and report connection failures.
+Do not use local guides or cached instructions as fallback. Instruction retrieval does not authorize actions.
+
+Retrieve shared documentation and rules only from `https://mcp.codexsun.com/mcp` using `npm run mcp:connect`.
+A successful authenticated connection is required before repository work. Stop and report connection failures.
+Do not use local guides or cached instructions as fallback. Instruction retrieval does not authorize actions.
+
+Configure these values with `.env.example`:
+
+- `MCP_SERVER_URL`
+- `MCP_SERVER_SECRET`
+- `APP_ID`
+- `APP_USER`
+
+Keep the secret in ignored `.env` files.
+
+```powershell
+npm run mcp:connect
+npm run mcp:verify
+```
+
+Use `mcp:connect` to retrieve instructions. Use `mcp:verify` for a strict connection test.
+Connection failures do not block application work. Editor registration uses the central connection
+template and depends on the editor.
+
+## Maintenance
+
+```powershell
+npm run version-bump -- --dry-run
+npm run version-bump -- --title "Release title" --note "Change details"
+npm run check:versions
+npm run fix:line-endings
+npm run lines:check
+npm run github:now -- --dry-run
+```
+
+Version bumps align `package.json`, `package-lock.json`, and `agent/CHANGELOG.md`. Record changes
+and validation before committing.
+
+Commit subjects use `#<patch> - <release title>`. For example:
+`#5 - Central governance and repository agent layout`.
+
+Review the changed files before an authorized `npm run github:now`. Do not bump again when the
+release version is already prepared.
+
+## Tools source and publication
+
+Workspace maintenance delegates to `shared/tools`. The installed npm package remains pinned at
+`0.1.3` until agent changelog support is published.
+
+GitHub source releases use `github:now`. Npm publication requires separate authorization.
+
+## npm package
+
+Framework publishes compiled ESM JavaScript and TypeScript declarations. Run npm run build before local development consumption.
+
+Run `npm run release:check`, then `npm publish --access public` from this repository.
+Only public exports are supported. App manifests use npm versions.
+
+## Public runtime contracts
+
+`composeModules` registers owner providers in dependency order. Factories receive only their declared dependencies.
+`start` runs lifecycle hooks. Failed startup calls stop hooks in reverse order, including the failed module.
+`stop` attempts every cleanup hook and reports cleanup failures together.
+
+`createApplicationServer` keeps the existing static and development behavior.
+Optional `apiHandler` receives the request, response, and request context for `/api` paths.
+The handler owns routing and independent Zod validation before service execution.
+Unexpected handler failures return a safe JSON error with a generated request ID.
+Optional `readiness` exposes `/health/ready`. Readiness reports the consumer's actual dependency state.
+Receive and header timeouts are configurable positive millisecond values. They do not bound handler execution.
+
+`readJsonBody` checks content type and limits bytes. Its result is unknown until the owner validates it.
+`parseListQuery` validates pagination and allowlisted sort fields. Owners validate domain filters independently.
+`HttpError` carries safe transport errors and optional field messages. Do not place secrets in these messages.
+`createRequestContext` supplies a server-generated request ID and an abort signal.
+Identity, tenant scope, transactions, and domain rules remain with their owner providers.
+
+Provider factories must only compose values. Acquire connections and other resources inside start hooks so failed startup can release them.
+Stop during startup is rejected. Concurrent stop calls share one cleanup operation.
+Oversized streamed JSON is drained without destroying the response socket, allowing a safe 413 response.
+
+## Handler and shutdown deadlines
+
+Set `handlerTimeoutMs` on `createApplicationServer` to bound API response time. The default is 30000 milliseconds.
+Request contexts expose `deadlineAt` and `signal`. At the deadline, the server aborts the signal.
+It returns a safe 504 before response headers or destroys an incomplete streamed response.
+Handlers must honor cancellation and check response state before writing late results.
+A deadline cannot stop synchronous JavaScript or forcibly cancel an uncooperative dependency.
+
+Set `shutdownTimeoutMs` in the second argument of `composeModules`. The default total budget is 30000 milliseconds.
+Stop attempts every hook in reverse dependency order. The budget bounds awaited asynchronous cleanup.
+A timed-out hook can continue running. State becomes `failed`, and stop rejects with cleanup failures.
+Consumers must report failed cleanup and apply their process termination policy.
+
+## Startup deadline
+
+Set startupTimeoutMs in composeModules options. The default total startup budget is 30000 milliseconds.
+Start hooks receive the owner provider and an AbortSignal. Timeout aborts the signal and rolls back started modules.
+An uncooperative hook can continue. Owners must honor cancellation before acquiring or retaining resources.
+
+## Consumer transaction and cancellation contract
+
+Framework owns request deadlines and cancellation signals. The module that owns a mutation owns its database transaction.
+A module validates authorization and input before persistence. It checks cancellation before a write and before committing.
+Cancellation after a successful commit does not roll back committed data. A client must reload before retrying an uncertain mutation.
+Existing identity updates use expectedVersion for stale-write detection. Token completion uses a single database claim.
+Do not retry POST mutations automatically. Add an idempotency key only when a real consumer requires repeatable retries.
+Synchronous identity operations need no generic event bus or queue. External delivery stays outside a database transaction.

package/dist/http/server.d.ts

@@ -0,0 +1,14 @@
+import { type RequestListener } from "node:http";
+import type { ApplicationConfig } from "../runtime/config.js";
+import { createRequestContext } from "../modules/http/http.provider.js";
+export interface ApplicationServerOptions {
+    config: ApplicationConfig;
+    frontendDirectory: string;
+    developmentHandler?: RequestListener;
+    apiHandler?: (request: import("node:http").IncomingMessage, response: import("node:http").ServerResponse, context: ReturnType<typeof createRequestContext>) => void | Promise<void>;
+    readiness?: () => boolean;
+    requestTimeoutMs?: number;
+    headersTimeoutMs?: number;
+    handlerTimeoutMs?: number;
+}
+export declare function createApplicationServer(options: ApplicationServerOptions): import("node:http").Server<typeof import("node:http").IncomingMessage, typeof import("node:http").ServerResponse>;

package/dist/http/server.js

@@ -0,0 +1,116 @@
+import { createServer } from "node:http";
+import { readFile, realpath } from "node:fs/promises";
+import { extname, resolve, sep } from "node:path";
+import { createRequestContext, writeJsonError, HttpError } from "../modules/http/http.provider.js";
+const contentTypes = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".ico": "image/x-icon",
+    ".woff2": "font/woff2",
+};
+export function createApplicationServer(options) {
+    const handlerTimeoutMs = positiveTimeout(options.handlerTimeoutMs ?? 30_000);
+    const server = createServer((request, response) => {
+        if (options.readiness && request.url === "/health/ready") {
+            if (request.method !== "GET" && request.method !== "HEAD") {
+                response.writeHead(405, { Allow: "GET, HEAD" });
+                response.end();
+                return;
+            }
+            let ready = false;
+            try {
+                ready = options.readiness();
+            }
+            catch {
+                ready = false;
+            }
+            response.writeHead(ready ? 200 : 503, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+            response.end(request.method === "HEAD" ? undefined : JSON.stringify({ ready }));
+            return;
+        }
+        if (options.apiHandler && /^\/api(?:\/|\?|$)/.test(request.url ?? "")) {
+            const context = createRequestContext(request, Date.now() + handlerTimeoutMs);
+            const deadline = setTimeout(() => {
+                const error = new HttpError(504, "request_timeout", "Request deadline exceeded.");
+                context.abort(error);
+                if (!response.writableEnded && !response.destroyed)
+                    writeJsonError(response, error, context.requestId);
+            }, handlerTimeoutMs);
+            response.once("finish", () => clearTimeout(deadline));
+            response.once("close", () => clearTimeout(deadline));
+            response.setHeader("X-Request-ID", context.requestId);
+            response.once("close", () => { if (!response.writableFinished)
+                request.emit("aborted"); });
+            void Promise.resolve().then(() => options.apiHandler(request, response, context))
+                .catch((error) => {
+                if (!response.writableEnded && !response.destroyed)
+                    writeJsonError(response, error, context.requestId);
+            });
+            return;
+        }
+        if (options.developmentHandler)
+            return options.developmentHandler(request, response);
+        void serveFrontend(options.frontendDirectory, request.url || "/", request.method || "GET", response);
+    });
+    server.requestTimeout = positiveTimeout(options.requestTimeoutMs ?? 30_000);
+    server.headersTimeout = positiveTimeout(options.headersTimeoutMs ?? 10_000);
+    return server;
+}
+function positiveTimeout(value) {
+    if (!Number.isSafeInteger(value) || value < 1)
+        throw new Error("Invalid HTTP timeout.");
+    return value;
+}
+async function serveFrontend(root, requestUrl, method, response) {
+    if (method !== "GET" && method !== "HEAD") {
+        response.writeHead(405, { Allow: "GET, HEAD" });
+        response.end();
+        return;
+    }
+    let pathname;
+    try {
+        pathname = decodeURIComponent(new URL(requestUrl, "http://localhost").pathname);
+    }
+    catch {
+        response.writeHead(400);
+        response.end("Invalid URL");
+        return;
+    }
+    if (pathname === "/api" || pathname.startsWith("/api/")) {
+        response.writeHead(404);
+        response.end("No backend APIs are configured.");
+        return;
+    }
+    const resolvedRoot = resolve(root);
+    const file = resolve(root, `.${pathname}`);
+    if ((file !== resolvedRoot && !file.startsWith(`${resolvedRoot}${sep}`)) ||
+        pathname.includes("\\")) {
+        response.writeHead(403);
+        response.end("Forbidden");
+        return;
+    }
+    const target = extname(pathname) ? file : resolve(root, "index.html");
+    try {
+        const [actualRoot, actualTarget] = await Promise.all([realpath(root), realpath(target)]);
+        if (actualTarget !== actualRoot && !actualTarget.startsWith(`${actualRoot}${sep}`)) {
+            response.writeHead(403);
+            response.end("Forbidden");
+            return;
+        }
+        const content = await readFile(target);
+        response.writeHead(200, {
+            "Content-Type": contentTypes[extname(target)] || "application/octet-stream",
+            "Cache-Control": "no-cache",
+        });
+        response.end(method === "HEAD" ? undefined : content);
+    }
+    catch (error) {
+        const missing = error.code === "ENOENT";
+        response.writeHead(missing ? 404 : 500);
+        response.end(missing ? "Not found" : "Unable to load frontend");
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { readApplicationConfig, type ApplicationConfig, } from "./runtime/config.js";
+export { createApplicationServer, type ApplicationServerOptions, } from "./http/server.js";
+export { composeModules, type ModuleProvider } from "./modules/runtime/runtime.provider.js";
+export { HttpError, createRequestContext, writeJsonError, parseListQuery, readJsonBody } from "./modules/http/http.provider.js";

package/dist/index.js

@@ -0,0 +1,4 @@
+export { readApplicationConfig, } from "./runtime/config.js";
+export { createApplicationServer, } from "./http/server.js";
+export { composeModules } from "./modules/runtime/runtime.provider.js";
+export { HttpError, createRequestContext, writeJsonError, parseListQuery, readJsonBody } from "./modules/http/http.provider.js";

package/dist/modules/http/http.provider.d.ts

@@ -0,0 +1,25 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+export declare class HttpError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly fields?: Record<string, string[]> | undefined;
+    constructor(status: number, code: string, message: string, fields?: Record<string, string[]> | undefined);
+}
+export declare function createRequestContext(request: IncomingMessage, deadlineAt?: number): {
+    requestId: `${string}-${string}-${string}-${string}-${string}`;
+    signal: AbortSignal;
+    deadlineAt: number | undefined;
+    abort: (reason?: unknown) => void;
+};
+export declare function writeJsonError(response: ServerResponse, error: unknown, requestId: string): void;
+export declare function parseListQuery(search: URLSearchParams, allowedSorts: readonly string[], defaults?: {
+    perPage: number;
+    maxPerPage: number;
+}): {
+    page: number;
+    perPage: number;
+    offset: number;
+    sort: string;
+    direction: "asc" | "desc";
+};
+export declare function readJsonBody(request: IncomingMessage, maxBytes?: number): Promise<unknown>;

package/dist/modules/http/http.provider.js

@@ -0,0 +1,80 @@
+import { randomUUID } from "node:crypto";
+export class HttpError extends Error {
+    status;
+    code;
+    fields;
+    constructor(status, code, message, fields) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.fields = fields;
+        if (!Number.isInteger(status) || status < 400 || status > 599) {
+            throw new Error("Invalid HTTP error status.");
+        }
+    }
+}
+export function createRequestContext(request, deadlineAt) {
+    const controller = new AbortController();
+    request.once("aborted", () => controller.abort());
+    return { requestId: randomUUID(), signal: controller.signal, deadlineAt,
+        abort: (reason) => controller.abort(reason) };
+}
+export function writeJsonError(response, error, requestId) {
+    if (response.headersSent) {
+        response.destroy();
+        return;
+    }
+    const known = error instanceof HttpError;
+    response.writeHead(known ? error.status : 500, {
+        "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store",
+        "X-Request-ID": requestId,
+    });
+    response.end(JSON.stringify({ error: {
+            code: known ? error.code : "internal_error",
+            message: known ? error.message : "Unable to complete the request.",
+            ...(known && error.fields ? { fields: error.fields } : {}),
+        }, requestId }));
+}
+export function parseListQuery(search, allowedSorts, defaults = { perPage: 20, maxPerPage: 100 }) {
+    const integer = (key, fallback, max) => {
+        const raw = search.get(key);
+        if (raw === null)
+            return fallback;
+        if (!/^\d+$/.test(raw) || Number(raw) < 1 || Number(raw) > max) {
+            throw new HttpError(422, "invalid_query", `Invalid ${key}.`);
+        }
+        return Number(raw);
+    };
+    const sort = search.get("sort") ?? allowedSorts[0];
+    const direction = search.get("direction") ?? "asc";
+    if ((sort !== undefined && !allowedSorts.includes(sort)) || !["asc", "desc"].includes(direction)) {
+        throw new HttpError(422, "invalid_query", "Invalid sorting.");
+    }
+    const page = integer("page", 1, 1_000_000);
+    const perPage = integer("per_page", defaults.perPage, defaults.maxPerPage);
+    return { page, perPage, offset: (page - 1) * perPage, sort, direction: direction };
+}
+export async function readJsonBody(request, maxBytes = 1_048_576) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1)
+        throw new Error("Invalid body limit.");
+    if (request.headers["content-type"]?.split(";")[0].trim() !== "application/json") {
+        throw new HttpError(415, "unsupported_media_type", "Use application/json.");
+    }
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of request.iterator({ destroyOnReturn: false })) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += buffer.length;
+        if (bytes > maxBytes) {
+            request.resume();
+            throw new HttpError(413, "body_too_large", "Request body is too large.");
+        }
+        chunks.push(buffer);
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    }
+    catch {
+        throw new HttpError(400, "invalid_json", "Invalid JSON body.");
+    }
+}

package/dist/modules/runtime/runtime.provider.d.ts

@@ -0,0 +1,16 @@
+export interface ModuleProvider<T = unknown> {
+    name: string;
+    dependencies?: readonly string[];
+    create(providers: ReadonlyMap<string, unknown>): T;
+    start?(provider: T, signal: AbortSignal): void | Promise<void>;
+    stop?(provider: T): void | Promise<void>;
+}
+export declare function composeModules(modules: readonly ModuleProvider<any>[], options?: {
+    startupTimeoutMs?: number;
+    shutdownTimeoutMs?: number;
+}): {
+    readonly state: "created" | "starting" | "ready" | "stopping" | "stopped" | "failed";
+    get<T>(name: string): T;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+};

package/dist/modules/runtime/runtime.provider.js

@@ -0,0 +1,102 @@
+export function composeModules(modules, options = {}) {
+    const startupTimeoutMs = options.startupTimeoutMs ?? 30_000;
+    if (!Number.isSafeInteger(startupTimeoutMs) || startupTimeoutMs < 1)
+        throw new Error("Invalid startup timeout.");
+    const shutdownTimeoutMs = options.shutdownTimeoutMs ?? 30_000;
+    if (!Number.isSafeInteger(shutdownTimeoutMs) || shutdownTimeoutMs < 1)
+        throw new Error("Invalid shutdown timeout.");
+    const pending = new Map(modules.map((module) => [module.name, module]));
+    if (pending.size !== modules.length)
+        throw new Error("Duplicate module name.");
+    const providers = new Map();
+    const ordered = [];
+    while (pending.size) {
+        const ready = [...pending.values()].find((module) => (module.dependencies ?? []).every((name) => providers.has(name)));
+        if (!ready)
+            throw new Error("Missing or cyclic module dependencies.");
+        const dependencies = new Map((ready.dependencies ?? []).map((name) => [name, providers.get(name)]));
+        providers.set(ready.name, ready.create(dependencies));
+        ordered.push(ready);
+        pending.delete(ready.name);
+    }
+    const started = [];
+    let state = "created";
+    let cleanupPromise;
+    async function cleanup() {
+        state = "stopping";
+        const failures = [];
+        const deadline = Date.now() + shutdownTimeoutMs;
+        for (const module of started.splice(0).reverse()) {
+            try {
+                const work = Promise.resolve(module.stop?.(providers.get(module.name)));
+                const remaining = deadline - Date.now();
+                if (remaining <= 0) {
+                    void work.catch(() => { });
+                    throw new Error(`Module shutdown deadline exceeded: ${module.name}`);
+                }
+                await withinDeadline(work, remaining, module.name);
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        state = failures.length ? "failed" : "stopped";
+        if (failures.length)
+            throw new AggregateError(failures, "Module cleanup failed.");
+    }
+    return {
+        get state() { return state; },
+        get(name) {
+            if (!providers.has(name))
+                throw new Error(`Unknown module: ${name}`);
+            return providers.get(name);
+        },
+        async start() {
+            if (state !== "created")
+                throw new Error("Modules can only start once.");
+            state = "starting";
+            const controller = new AbortController();
+            const deadline = Date.now() + startupTimeoutMs;
+            try {
+                for (const module of ordered) {
+                    started.push(module);
+                    const remaining = deadline - Date.now();
+                    if (remaining <= 0)
+                        throw new Error(`Module startup deadline exceeded: ${module.name}`);
+                    await withinDeadline(Promise.resolve(module.start?.(providers.get(module.name), controller.signal)), remaining, module.name, "startup");
+                }
+                state = "ready";
+            }
+            catch (error) {
+                controller.abort(error);
+                try {
+                    cleanupPromise ??= cleanup();
+                    await cleanupPromise;
+                }
+                catch (cleanup) {
+                    throw new AggregateError([error, cleanup], "Startup and cleanup failed.");
+                }
+                throw error;
+            }
+        },
+        async stop() {
+            if (state === "starting")
+                throw new Error("Cannot stop modules during startup.");
+            if (state === "stopped")
+                return;
+            cleanupPromise ??= cleanup();
+            await cleanupPromise;
+        },
+    };
+}
+async function withinDeadline(work, milliseconds, name, phase = "shutdown") {
+    let timer;
+    try {
+        await Promise.race([work, new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`Module ${phase} deadline exceeded: ${name}`)), milliseconds);
+            })]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/runtime/config.d.ts

@@ -0,0 +1,8 @@
+export interface ApplicationConfig {
+    name: string;
+    port: number;
+    url: string;
+    host: string;
+    mode: "development" | "production";
+}
+export declare function readApplicationConfig(env: Record<string, string | undefined>): ApplicationConfig;

package/dist/runtime/config.js

@@ -0,0 +1,33 @@
+export function readApplicationConfig(env) {
+    const name = required(env, "APP_NAME");
+    const portValue = required(env, "APP_PORT");
+    const port = Number(portValue);
+    if (!/^\d+$/.test(portValue) || port < 1 || port > 65535)
+        throw new Error("APP_PORT must be an integer between 1 and 65535.");
+    const mode = required(env, "APP_MODE");
+    if (mode !== "development" && mode !== "production")
+        throw new Error("APP_MODE must be development or production.");
+    const url = new URL(required(env, "APP_URL"));
+    if (!["http:", "https:"].includes(url.protocol) ||
+        url.username ||
+        url.password ||
+        url.pathname !== "/" ||
+        url.search ||
+        url.hash)
+        throw new Error("APP_URL must be an HTTP origin without credentials or a path.");
+    if (Number(url.port || (url.protocol === "https:" ? 443 : 80)) !== port)
+        throw new Error("APP_URL must use APP_PORT.");
+    return {
+        name,
+        port,
+        url: url.origin,
+        host: env.APP_HOST?.trim() || url.hostname,
+        mode,
+    };
+}
+function required(env, key) {
+    const value = env[key]?.trim();
+    if (!value)
+        throw new Error(`${key} is required.`);
+    return value;
+}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@devxcrew/framework",
+  "version": "0.1.8",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=26.10.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/devxcrew/framework.git"
+  },
+  "devDependencies": {
+    "@devxcrew/tools": "0.1.7",
+    "@types/node": "^26.0.0",
+    "typescript": "6.0.3"
+  },
+  "scripts": {
+    "github:now": "devxcrew-tools github:now",
+    "version:update": "devxcrew-tools version:bump",
+    "fix:line-endings": "devxcrew-tools lines:fix",
+    "check:versions": "devxcrew-tools check:versions",
+    "version:show": "devxcrew-tools version:show",
+    "version:bump": "devxcrew-tools version:bump",
+    "changelog:append": "devxcrew-tools changelog:append",
+    "changelog:show": "devxcrew-tools changelog:show",
+    "tools:lines:fix": "devxcrew-tools lines:fix",
+    "lines:check": "devxcrew-tools lines:check",
+    "tools:check": "devxcrew-tools dependencies:order && devxcrew-tools check:versions && devxcrew-tools lines:check",
+    "check": "npm run tools:check && npm test",
+    "mcp:connect": "node agent/connect.mjs",
+    "mcp:verify": "node agent/connect.mjs --strict",
+    "version-bump": "devxcrew-tools version:bump",
+    "prepublishOnly": "npm run release:check",
+    "build": "tsc -p tsconfig.json",
+    "prepack": "npm run build",
+    "release:check": "npm run check && npm run build && npm pack --dry-run --ignore-scripts",
+    "test": "npm run build && node --test tests/*.test.mjs"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "license": "MIT"
+}