@happyvertical/smrt-dev-mcp 0.47.1 → 0.48.0

package/dist/index.js

@@ -1,17 +1,16 @@
 #!/usr/bin/env node
-import { a as checkKnowledgeFreshness, f as smrtArchitecture, h as TOOLS, i as buildReviewContext, m as REVIEW_SKILL_NAME, n as buildKnowledgeIndex, o as checkKnowledgeFreshnessFromIndex, p as smrtReview, r as buildPackageSpecialistContext, s as compactContextResult, t as buildArchitectureContext } from "./knowledge-DmZ-7GO9.js";
+import { i as SERVER_VERSION, n as startRuntimeHttpHost, r as SERVER_NAME } from "./http-TeoaK9Xr.js";
+import { n as TOOLS, t as REVIEW_SKILL_NAME } from "./tool-catalog-Zl-bcimC.js";
+import { c as runtimeMigrationStatus, d as runtimeScheduleHealth, f as redactConnectionString, l as runtimeRecentChanges, n as runtimeRegistry, o as runtimeDispatchHealth, r as runtimeSchemaDiff, s as runtimeJobHealth, t as runtimeObject, u as runtimeRegistryDrift } from "./observation-VJgHaPps.js";
+import { a as buildReviewContext, c as compactContextResult, i as buildPackageSpecialistContext, n as buildContext, o as checkKnowledgeFreshness, r as buildKnowledgeIndex, s as checkKnowledgeFreshnessFromIndex, t as buildArchitectureContext } from "./knowledge-BOsSAdPo.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { ProtocolError, ProtocolErrorCode, Server } from "@modelcontextprotocol/server";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
-import { createHash } from "node:crypto";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { ManifestAdapter, OxcScanner } from "@happyvertical/smrt-scanner";
 import { access, readFile, readdir } from "node:fs/promises";
 import { ManifestGenerator } from "@happyvertical/smrt-core/scanner";
-import { readDispatchHealth, readJobHealth, readMigrationStatus, readRecentChanges, readRegistryDrift, readScheduleHealth } from "@happyvertical/smrt-core";
-import { getPackageConfig, loadConfig } from "@happyvertical/smrt-config";
-import { getDatabase } from "@happyvertical/sql";
 //#region src/agent-skills.ts
 var AGENT_SKILLS = [{
 	name: "smrt-code-review",
@@ -271,7 +270,7 @@ var DEFAULT_MCP_OPERATIONS = [
 	"delete"
 ];
 async function introspectProject(args) {
-	const { directory = process.cwd(), includeFields = true, includeRelationships = true, includeMethods = true, detail = "summary", maxChars = DEFAULT_MAX_CHARS } = args;
+	const { directory = process.cwd(), includeFields = true, includeRelationships = true, includeMethods = true, detail = "summary", maxChars = DEFAULT_MAX_CHARS, cursor, limit } = args;
 	const projectPath = resolve(directory);
 	if (!await pathExists$1(projectPath)) return JSON.stringify({
 		projectPath,
@@ -302,7 +301,11 @@ async function introspectProject(args) {
 		tenantScope: tenantScopes.get(object.className)
 	}));
 	objects.sort((left, right) => left.className.localeCompare(right.className));
-	const { kept, omitted } = applyObjectBudget(objects, maxChars);
+	const afterCursor = typeof cursor === "string" && cursor.length > 0 ? objects.filter((object) => object.className.localeCompare(cursor) > 0) : objects;
+	const pageLimit = typeof limit === "number" && Number.isFinite(limit) && limit >= 1 ? Math.floor(limit) : void 0;
+	const { kept, omitted: budgetOmitted } = applyObjectBudget(pageLimit !== void 0 ? afterCursor.slice(0, pageLimit) : afterCursor, maxChars);
+	const omitted = afterCursor.length - kept.length;
+	const nextCursor = omitted > 0 && kept.length > 0 ? kept[kept.length - 1].className : void 0;
 	const output = {
 		projectPath,
 		manifestSource: manifestResult.source,
@@ -313,11 +316,14 @@ async function introspectProject(args) {
 		objectCount: objects.length,
 		scannedFileCount: manifestResult.scannedFileCount,
 		parseTimeMs: manifestResult.parseTimeMs,
+		...cursor ? { cursor } : {},
+		...nextCursor ? { nextCursor } : {},
 		...omitted > 0 ? { truncated: {
 			returnedObjectCount: kept.length,
 			omittedObjectCount: omitted,
 			budgetChars: maxChars,
-			guidance: "The object list hit its character budget; metadata and diagnostics are still complete. Narrow the scan with `directory` (a single package), keep `detail: \"summary\"`, or raise `maxChars` deliberately. Object names are sorted alphabetically, so omitted objects are the alphabetical tail."
+			...pageLimit !== void 0 ? { limit: pageLimit } : {},
+			guidance: budgetOmitted > 0 ? "The object list hit its character budget; metadata and diagnostics are still complete. Pass `cursor: nextCursor` to read the next page, narrow the scan with `directory`, keep `detail: \"summary\"`, or raise `maxChars` deliberately. Objects are sorted alphabetically." : "More objects follow this page. Pass `cursor: nextCursor` to continue."
 		} } : {},
 		objects: kept,
 		diagnostics: manifestResult.diagnostics
@@ -1056,403 +1062,12 @@ function pathExistsSyncHint(path) {
 	return existsSync(path);
 }
 //#endregion
-//#region src/tools/runtime/connection.ts
-/**
-* Optional read-only dev-database connection resolution for runtime
-* diagnostics tools (#1824).
-*
-* Resolution order per call:
-*   1. explicit `dbUrl`/`dbType` tool arguments
-*   2. `SMRT_DEV_DB_URL` environment variable
-*   3. the project's cosmiconfig CLI section (`getPackageConfig('cli', ...)`
-*      from `@happyvertical/smrt-config`) → `database.{type,url}`
-*
-* No configured connection → `db: null` with `source: 'none'`; callers return
-* a successful static-only envelope. A connection is always opened lazily per
-* call and closed in the caller's `finally` — nothing is cached across calls
-* and the server never holds a database handle.
-*
-* Sensitive handling: connection strings are never logged or echoed. Every
-* surfaced URL passes through {@link redactConnectionString}; driver errors
-* are surfaced only through {@link safeErrorMessage}, which strips anything
-* that looks like a credential-bearing URL.
-*/
-var RUNTIME_DATABASE_TYPES = [
-	"sqlite",
-	"postgres",
-	"duckdb"
-];
-function isRuntimeDatabaseType(value) {
-	return RUNTIME_DATABASE_TYPES.includes(value);
-}
-/**
-* Sensitive query-parameter names. Matching normalizes the key (lowercase,
-* `_`/`-` stripped), so camelCase (`authToken`, `accessToken`) and hyphen
-* variants (`api-key`) are masked exactly like their snake_case forms.
-*/
-var SENSITIVE_QUERY_PARAMS = [
-	"access_token",
-	"apikey",
-	"api_key",
-	"auth",
-	"auth_token",
-	"connectionstring",
-	"connection_string",
-	"password",
-	"token"
-];
-function normalizeQueryParamName(key) {
-	return key.toLowerCase().replace(/[_-]/g, "");
-}
-var SENSITIVE_QUERY_PARAM_NAMES = new Set(SENSITIVE_QUERY_PARAMS.map(normalizeQueryParamName));
-var DEFAULT_CLI_DATABASE = { database: {
-	type: "sqlite",
-	url: ":memory:"
-} };
-/**
-* Redact a connection string so it can be shown to an agent without leaking
-* credentials. Mirrors the CLI's `redactConnectionString` (which is CLI
-* private); patterned identically so dev-mcp never depends on the CLI.
-*
-* Query-parameter masking normalizes each key (lowercase, `_`/`-` stripped),
-* so camelCase forms such as Turso/libsql's `?authToken=` mask exactly like
-* their snake_case forms. A final regex pass also masks `key=value` pairs
-* embedded in free text (driver error messages often quote the URL); it treats
-* the start of the string, `?`, `&`, `,`, `(`, and whitespace as the
-* preceding boundary.
-*/
-function redactConnectionString(value) {
-	let redacted = value;
-	try {
-		const url = new URL(value);
-		if (url.password) url.password = "***";
-		for (const key of [...url.searchParams.keys()]) if (SENSITIVE_QUERY_PARAM_NAMES.has(normalizeQueryParamName(key))) url.searchParams.set(key, "***");
-		redacted = url.toString();
-	} catch {
-		redacted = value.replace(/([a-z][a-z0-9+.-]*:\/\/[^:\s/@]+:)(?:[^@\s]|@(?=[^@\s]*@))+(@)/gi, "$1***$2");
-	}
-	return redacted.replace(/((?:^|[?&,(\s])([a-z][a-z0-9_-]{0,30})=)([^&,\s)]+)/gi, (match, prefix, key) => SENSITIVE_QUERY_PARAM_NAMES.has(normalizeQueryParamName(key)) ? `${prefix}***` : match);
-}
-/**
-* Build a safe, redacted error message for a database failure. Connection
-* strings and raw driver error objects are never surfaced verbatim.
-*/
-function safeErrorMessage(error) {
-	return redactConnectionString(error instanceof Error ? error.message : String(error ?? "unknown error"));
-}
-/**
-* Normalize a type hint into an engine `getDatabase` accepts. Unknown values
-* throw a safe error (no URL is included) so the caller can surface a
-* diagnostic instead of silently opening the wrong adapter.
-*/
-function toRuntimeDatabaseType(value) {
-	const normalized = value.trim().toLowerCase();
-	if (isRuntimeDatabaseType(normalized)) return normalized;
-	throw new Error(`Unsupported runtime database type "${normalized}"; expected sqlite, postgres, or duckdb`);
-}
-/** Infer an engine hint from a URL scheme when no explicit type is given. */
-function inferDatabaseType(url, hint) {
-	if (hint && hint.trim().length > 0) return hint;
-	if (/^postgres(ql)?:/i.test(url)) return "postgres";
-	if (/^duckdb:/i.test(url)) return "duckdb";
-	return "sqlite";
-}
-/**
-* Resolve the dev-database connection for one tool call.
-*
-* Returns `db: null` (never throws) when no connection is configured; callers
-* must treat that as "no runtime database" and return a static-only envelope.
-* A thrown connect error is propagated to the caller, which converts it into
-* a diagnostic envelope — it must never reach the MCP transport.
-*/
-async function resolveRuntimeConnection(args = {}) {
-	const argUrl = args.dbUrl?.trim();
-	if (argUrl && argUrl !== ":memory:") {
-		const databaseType = toRuntimeDatabaseType(inferDatabaseType(argUrl, args.dbType));
-		return {
-			db: await getDatabaseInstance({
-				type: databaseType,
-				url: argUrl
-			}),
-			source: "argument",
-			displayUrl: redactConnectionString(argUrl),
-			databaseType
-		};
-	}
-	const envUrl = process.env.SMRT_DEV_DB_URL?.trim();
-	if (envUrl && envUrl !== ":memory:") {
-		const databaseType = toRuntimeDatabaseType(inferDatabaseType(envUrl, args.dbType));
-		return {
-			db: await getDatabaseInstance({
-				type: databaseType,
-				url: envUrl
-			}),
-			source: "environment",
-			displayUrl: redactConnectionString(envUrl),
-			databaseType
-		};
-	}
-	const config = await loadCliDatabaseConfig();
-	const configUrl = config?.database?.url?.trim();
-	if (configUrl && configUrl !== ":memory:") {
-		const databaseType = toRuntimeDatabaseType(config.database?.type || inferDatabaseType(configUrl, args.dbType));
-		return {
-			db: await getDatabaseInstance({
-				type: databaseType,
-				url: configUrl
-			}),
-			source: "config",
-			displayUrl: redactConnectionString(configUrl),
-			databaseType
-		};
-	}
-	return {
-		db: null,
-		source: "none",
-		displayUrl: "",
-		databaseType: null
-	};
-}
-async function loadCliDatabaseConfig() {
-	try {
-		await loadConfig();
-		const database = getPackageConfig("cli", DEFAULT_CLI_DATABASE).database;
-		if (database && typeof database.url === "string") return { database };
-		return {};
-	} catch {
-		return {};
-	}
-}
-async function getDatabaseInstance(options) {
-	return getDatabase(options);
-}
-/**
-* Best-effort close of a resolved connection. Never throws; diagnostics must
-* not fail because cleanup hiccuped.
-*/
-async function closeRuntimeConnection(db) {
-	if (!db || typeof db !== "object") return;
-	const closeable = db;
-	const close = closeable.close ?? closeable.client?.end ?? closeable.client?.close;
-	if (typeof close !== "function") return;
-	try {
-		await close.call(closeable.close ? closeable : closeable.client);
-	} catch {}
-}
-//#endregion
-//#region src/tools/runtime/tools.ts
-/**
-* Runtime diagnostics tools (#1824): read-only views over a project's dev
-* database `_smrt_*` system tables, powered by the shared SELECT-only
-* system-diagnostics reader in `@happyvertical/smrt-core`.
-*
-* Contract:
-* - **Optional connection.** No configured connection returns a successful
-*   static-only envelope — the server always starts and static tools are
-*   unaffected. A live connection is opened lazily per call and closed in
-*   `finally`; nothing is cached across calls.
-* - **Read-only.** Every underlying statement is a bounded SELECT; the reader
-*   never selects sensitive columns (job payloads/results, schedule
-*   `agentConfig`/`methodArgs`, dispatch `payload`/`metadata`).
-* - **Provenance-labeled.** Live results carry `provenance: 'runtime (live DB)'`;
-*   static-only results carry `provenance: 'static'` — agents must never
-*   conflate runtime facts with declared/manifest facts.
-* - **Fail-safe.** A connect/read error becomes a diagnostic envelope; it must
-*   never reach the MCP transport and never includes raw driver text or URLs.
-*/
-/** Provenance labels separating runtime facts from static/declared facts. */
-var RUNTIME_PROVENANCE = "runtime (live DB)";
-var STATIC_PROVENANCE = "static";
-/**
-* Serialize resolve → read → close per connection target so overlapping tool
-* calls never close a shared cached handle out from under each other.
-*
-* `@happyvertical/sql`'s `getDatabase` returns a cached handle per URL (no
-* opt-out in its public API). `closeRuntimeConnection` only calls the handle's
-* own `close`/`end`, but the SDK wraps those so a close also evicts the handle
-* from its connection cache. Two concurrent diagnostics calls resolving the
-* same URL would therefore share one handle, with the first finisher closing
-* it mid-read for the second. A per-key promise chain keeps each call's
-* lifecycle private: every call resolves its own view of the connection,
-* performs its read, and only then closes — the next queued call re-resolves
-* a fresh handle.
-*
-* The key is a digest of the resolved target, never the raw URL, so a
-* credential-bearing connection string is not retained in this map.
-*/
-var runtimeReadQueues = /* @__PURE__ */ new Map();
-function connectionQueueKey(args) {
-	const target = args.dbUrl?.trim() || process.env.SMRT_DEV_DB_URL?.trim() || "cli.config";
-	return createHash("sha256").update(target).digest("hex");
-}
-async function enqueueRuntimeRead(key, operation) {
-	const run = (runtimeReadQueues.get(key) ?? Promise.resolve()).then(operation, operation);
-	const tail = run.catch(() => void 0);
-	runtimeReadQueues.set(key, tail);
-	tail.then(() => {
-		if (runtimeReadQueues.get(key) === tail) runtimeReadQueues.delete(key);
-	});
-	return run;
-}
-/**
-* Run one read against the optional runtime connection, mapping every outcome
-* to a successful MCP envelope:
-*
-* - no connection configured → static-only envelope (`connected: false`)
-* - connect failure → static envelope with a safe diagnostic
-* - read failure → connected envelope with a safe diagnostic
-* - success → live result under `provenance: 'runtime (live DB)'`; a
-*   category-unavailable reader result keeps its `available: false` data and
-*   surfaces its message as a diagnostic
-*/
-async function withRuntimeConnection(args, read, staticHint) {
-	return enqueueRuntimeRead(connectionQueueKey(args), () => runWithRuntimeConnection(args, read, staticHint));
-}
-async function runWithRuntimeConnection(args, read, staticHint) {
-	let resolved;
-	try {
-		resolved = await resolveRuntimeConnection(args);
-	} catch (error) {
-		return {
-			ok: true,
-			coverage: null,
-			diagnostics: [{
-				severity: "warning",
-				code: "runtime_connection_error",
-				message: safeErrorMessage(error)
-			}],
-			data: {
-				provenance: STATIC_PROVENANCE,
-				connected: false
-			}
-		};
-	}
-	if (!resolved.db) return {
-		ok: true,
-		coverage: null,
-		diagnostics: [{
-			severity: "info",
-			code: "runtime_connection_unavailable",
-			message: `No runtime dev database configured (set SMRT_DEV_DB_URL or cli.database); returning static-only result: ${staticHint}. Static tools are unaffected.`
-		}],
-		data: {
-			provenance: STATIC_PROVENANCE,
-			connected: false
-		}
-	};
-	const { db, source, displayUrl, databaseType } = resolved;
-	try {
-		const { data, diagnostics } = await read(db);
-		return {
-			ok: true,
-			coverage: null,
-			diagnostics,
-			data: {
-				provenance: RUNTIME_PROVENANCE,
-				connected: true,
-				connectionSource: source,
-				databaseType,
-				displayUrl,
-				...data
-			}
-		};
-	} catch (error) {
-		return {
-			ok: true,
-			coverage: null,
-			diagnostics: [{
-				severity: "warning",
-				code: "runtime_read_error",
-				message: safeErrorMessage(error)
-			}],
-			data: {
-				provenance: RUNTIME_PROVENANCE,
-				connected: true,
-				connectionSource: source,
-				databaseType,
-				displayUrl
-			}
-		};
-	} finally {
-		await closeRuntimeConnection(db);
-	}
-}
-/**
-* Stored error columns (`error_message`, `last_error`) are free text written
-* at failure time and routinely quote connection URLs or credentials. Every
-* string in a live result passes through {@link redactConnectionString}
-* before it reaches an MCP client; structure and non-string values are kept.
-*/
-function redactStrings(value) {
-	if (typeof value === "string") return redactConnectionString(value);
-	if (Array.isArray(value)) return value.map((item) => redactStrings(item));
-	if (value !== null && typeof value === "object") {
-		const out = {};
-		for (const [key, item] of Object.entries(value)) out[key] = redactStrings(item);
-		return out;
-	}
-	return value;
-}
-/** Convert a reader result into envelope data + diagnostics. */
-function toEnvelopeParts(rawResult) {
-	const result = redactStrings(rawResult);
-	if (result !== null && typeof result === "object" && "available" in result && result.available === false) {
-		const unavailable = result;
-		const { message, ...rest } = unavailable;
-		return {
-			data: rest,
-			diagnostics: [{
-				severity: unavailable.reason === "retired" ? "info" : "warning",
-				code: `category_unavailable_${String(unavailable.reason).replace(/-/g, "_")}`,
-				message: String(message)
-			}]
-		};
-	}
-	return {
-		data: result,
-		diagnostics: []
-	};
-}
-function readToParts(read) {
-	return read.then((result) => toEnvelopeParts(result));
-}
-async function runtimeMigrationStatus(args = {}) {
-	const { limit, ...connectionArgs } = args;
-	return withRuntimeConnection(connectionArgs, (db) => readToParts(readMigrationStatus(db, { limit })), "no migration status — the manifest still reports the declared schema");
-}
-async function runtimeJobHealth(args = {}) {
-	const { limit, ...connectionArgs } = args;
-	return withRuntimeConnection(connectionArgs, (db) => readToParts(readJobHealth(db, { limit })), "no job health snapshot — the manifest still reports declared job queues");
-}
-async function runtimeScheduleHealth(args = {}) {
-	const { limit, ...connectionArgs } = args;
-	return withRuntimeConnection(connectionArgs, (db) => readToParts(readScheduleHealth(db, { limit })), "no schedule health snapshot — the manifest still reports declared schedules");
-}
-async function runtimeDispatchHealth(args = {}) {
-	const { limit, ...connectionArgs } = args;
-	return withRuntimeConnection(connectionArgs, (db) => readToParts(readDispatchHealth(db, { limit })), "no dispatch health snapshot — the manifest still reports declared dispatch topology");
-}
-async function runtimeRecentChanges(args = {}) {
-	const { since, tables, tenantId, limit, ...connectionArgs } = args;
-	return withRuntimeConnection(connectionArgs, (db) => readToParts(readRecentChanges(db, {
-		since,
-		tables,
-		tenantId,
-		limit
-	})), "no recent changes — static knowledge artifacts are unchanged");
-}
-async function runtimeRegistryDrift(args = {}) {
-	return withRuntimeConnection(args, (db) => readToParts(readRegistryDrift(db)), "no registry drift report — _smrt_registry is retired; declared objects come from the manifest");
-}
-//#endregion
 //#region src/index.ts
 /**
 * SMRT Development MCP Server
 * Provides code generation, project introspection, knowledge context,
 * review/architecture prompt bundles, and portable agent skills.
 */
-var SERVER_NAME = "smrt-dev-mcp";
-var SERVER_VERSION = readPackageVersion();
 var DEBUG = process.env.DEBUG === "true";
 var REVIEW_SKILL_URI = `smrt-dev-mcp://agent-skills/${REVIEW_SKILL_NAME}`;
 var DOMAIN_CODE_REVIEW_PROMPT = "domain-code-review";
@@ -1771,26 +1386,27 @@ function createServer() {
 				case "check-knowledge-freshness":
 					result = JSON.stringify(await checkKnowledgeFreshness(args), null, 2);
 					break;
-				case "check-domain-knowledge":
-					result = JSON.stringify(await checkKnowledgeFreshness(args), null, 2);
-					break;
-				case "build-review-context":
-				case "build-domain-review-context":
-					result = JSON.stringify(compactContextResult(await buildReviewContext(args), detailArg(args)), null, 2);
+				case "build-context":
+					result = JSON.stringify(compactContextResult(await buildContext(args), detailArg(args)), null, 2);
 					break;
 				case "smrt-review":
-					result = JSON.stringify(compactContextResult(await smrtReview(args), detailArg(args)), null, 2);
+				case "smrt-architecture": {
+					const task = name === "smrt-review" ? "review" : "architecture";
+					const context = compactContextResult(await buildContext({
+						...args,
+						task
+					}), detailArg(args));
+					context.diagnostics = [...Array.isArray(context.diagnostics) ? context.diagnostics : [], {
+						severity: "info",
+						code: "deprecated_tool_name",
+						message: `${name} is a compatibility name; call build-context with task: '${task}'. It will be removed in the next minor release.`
+					}];
+					result = JSON.stringify(context, null, 2);
 					break;
+				}
 				case "build-package-specialist-context":
 					result = JSON.stringify(sanitizePackageSpecialist(await buildPackageSpecialistContext(args)), null, 2);
 					break;
-				case "build-architecture-context":
-				case "build-domain-architecture-context":
-					result = JSON.stringify(compactContextResult(await buildArchitectureContext(args), detailArg(args)), null, 2);
-					break;
-				case "smrt-architecture":
-					result = JSON.stringify(compactContextResult(await smrtArchitecture(args), detailArg(args)), null, 2);
-					break;
 				case "list-agent-skills":
 					result = JSON.stringify({ skills: listAgentSkills() }, null, 2);
 					break;
@@ -1815,6 +1431,15 @@ function createServer() {
 				case "registry-drift":
 					result = JSON.stringify(await runtimeRegistryDrift(args), null, 2);
 					break;
+				case "runtime-registry":
+					result = JSON.stringify(await runtimeRegistry(args), null, 2);
+					break;
+				case "runtime-object":
+					result = JSON.stringify(await runtimeObject(args), null, 2);
+					break;
+				case "runtime-schema-diff":
+					result = JSON.stringify(await runtimeSchemaDiff(args), null, 2);
+					break;
 				default: throw new Error(`Unknown tool: ${name}`);
 			}
 			return {
@@ -1870,15 +1495,6 @@ function isEntrypoint() {
 		return import.meta.url === pathToFileURL(entry).href;
 	}
 }
-function readPackageVersion() {
-	try {
-		const packageJsonPath = join(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
-		const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
-		return typeof packageJson.version === "string" ? packageJson.version : "0.0.0";
-	} catch {
-		return "0.0.0";
-	}
-}
 function renderAgentSkillMarkdown(name) {
 	const skill = getAgentSkill({
 		name,
@@ -1995,11 +1611,53 @@ function sanitizePath(path) {
 	if (path.startsWith("/") || /^[A-Za-z]:[\\/]/.test(path)) return "<absolute-path>";
 	return path;
 }
-if (isEntrypoint()) main().catch((error) => {
-	console.error(`[${SERVER_NAME}] Fatal error:`, error);
-	process.exit(1);
-});
+/**
+* `smrt-dev-mcp --http [--port N] [--project DIR]` starts the Level 2 runtime
+* dev-plane host (#1831) instead of the stdio server. Loopback-only, bearer
+* protected, positive read-only catalog; see `http.ts`.
+*/
+function parseHttpCliArgs(argv) {
+	const result = { http: false };
+	for (let index = 0; index < argv.length; index += 1) {
+		const arg = argv[index];
+		if (arg === "--http") result.http = true;
+		else if (arg === "--port") {
+			const value = Number.parseInt(argv[index + 1] ?? "", 10);
+			if (!Number.isInteger(value) || value < 0 || value > 65535) throw new Error("--port requires an integer between 0 and 65535");
+			result.port = value;
+			index += 1;
+		} else if (arg === "--project") {
+			const value = argv[index + 1];
+			if (!value) throw new Error("--project requires a directory");
+			result.projectRoot = value;
+			index += 1;
+		}
+	}
+	return result;
+}
+async function mainHttp(cli) {
+	const host = await startRuntimeHttpHost({
+		port: cli.port,
+		projectRoot: cli.projectRoot
+	});
+	const minted = !process.env.SMRT_DEV_MCP_TOKEN?.trim();
+	console.error(`[${SERVER_NAME}] runtime dev-plane listening at ${host.url} (${host.boot.objectCount} booted objects, ${host.boot.manifests.length} manifests)`);
+	if (minted) console.error(`[${SERVER_NAME}] bearer token: ${host.token}`);
+	const shutdown = async () => {
+		await host.close();
+		process.exit(0);
+	};
+	process.on("SIGINT", shutdown);
+	process.on("SIGTERM", shutdown);
+}
+if (isEntrypoint()) {
+	const cli = parseHttpCliArgs(process.argv.slice(2));
+	(cli.http ? mainHttp(cli) : main()).catch((error) => {
+		console.error(`[${SERVER_NAME}] Fatal error:`, error);
+		process.exit(1);
+	});
+}
 //#endregion
-export { SERVER_VERSION, TOOLS, createServer };
+export { SERVER_VERSION, TOOLS, createServer, parseHttpCliArgs };
 
 //# sourceMappingURL=index.js.map