@happyvertical/smrt-dev-mcp 0.60.9 → 0.60.10

package/AGENTS.md

@@ -9,7 +9,7 @@ deterministic SMRT ecosystem knowledge, and portable agent workflows.
 |------|---------|
 | `generate-smrt-class` | Generates `@smrt()` class with fields, decorator config, imports |
 | `introspect-project` | Scans project directory for SMRT objects; compact summary by default, `detail: 'full'` for field/schema/method detail |
-| `review-smrt-project` | Advisory downstream ecosystem alignment review for dependencies, storage, app shell, auth/tenancy, and manifest generation |
+| `review-smrt-project` | Advisory downstream ecosystem alignment review for dependencies, storage, app shell, auth/tenancy, manifest generation, and intent-driven hand-rolled-equivalent detection (#4690) |
 | `reflect-knowledge` | Reports deterministic SMRT + HappyVertical SDK knowledge coverage and freshness |
 | `reflect-domain-knowledge` | Reports downstream/domain artifact coverage and freshness |
 | `check-knowledge-freshness` | Runs deterministic agent-doc and stale-reference checks |
@@ -33,6 +33,14 @@ deterministic SMRT ecosystem knowledge, and portable agent workflows.
 README parameter tables to the exported `TOOLS` definitions. Add or change a
 tool schema and its authored documentation in the same commit.
 
+## Intent-driven duplicate detection (#4690)
+
+`review-smrt-project` / `smrt-dev-mcp review` flag hand-rolled equivalents of
+smrt packages from the intent index. The rules (`regex:` tokens become `RegExp`)
+come from the full index packaged in this release, never from the reviewed tree;
+`intentIndexPath` / `--intent-index` is caller-trusted. Details, token kinds and
+the CLI/workflow contract: [agents/intent-duplicates.md](agents/intent-duplicates.md).
+
 ## Knowledge Discovery (#2143)
 
 Discovery reads the workspace globs instead of assuming `<root>/packages`:
@@ -104,6 +112,18 @@ otherwise emitted docs read `/AGENTS.md` and changed-file matching compares
 against a leading `/` and selects nothing. The root owns any changed path no
 member package owns, mirroring the member-excluded scan.
 
+### OKF component pages (#4686)
+
+`pnpm knowledge:okf` (after `pnpm build`) writes `docs/knowledge/components/<unscoped-name>.md` per
+workspace package from this index; never hand-edit them. `source_revision` is a `sha256` of the page's
+inputs (manifest slice, package AGENTS/module-doc hashes, models, MCP tools, `agentSurface`), not a commit.
+`knowledge:check --strict` fails on stale, edited, missing or extra pages and on dangling `/…md` links in
+hand-authored pages. Details: header of `scripts/knowledge-okf.ts`.
+
+Consumer bundle (#4689): `okf-bundle.ts` defines the `.agents/smrt-knowledge/` contract `smrt docs:agents` writes;
+`check-knowledge-freshness` reports its age (`okf-bundle-age` info, `okf-bundle-aged` past 90 days) and flags
+`stale-okf-bundle` when a page's `package_version` no longer matches `node_modules` until `docs:agents` reruns.
+
 ## Agent Skills
 
 Bundled skills live under `skills/`, the Agent Plugins fixed discovery
@@ -157,6 +177,12 @@ server is always launched from a repo that installs the package. Prefer an
 absolute `node /path/to/node_modules/@happyvertical/smrt-dev-mcp/dist/index.js`
 launcher or a small wrapper script with an absolute Node path.
 
+This monorepo's `.mcp.json` runs `node scripts/mcp-servers/smrt-dev-mcp.mjs`:
+stdout is protocol-only, the launcher never installs or uses `pnpm exec`/`npx`
+(their stdout banner breaks stdio, #4685), and it falls back to `tsx` on `src/`
+when `dist` is missing or older, so rebuild `dist` after server edits. Guarded by
+`src/launcher-stdio.test.ts`; see [scripts/mcp-servers/README.md](../../scripts/mcp-servers/README.md).
+
 ## MCP Tier Context
 
 - **Tier 1** (Runtime): auto-generated from `@smrt()` objects — live data operations

package/README.md

@@ -334,7 +334,8 @@ available it falls back to `@happyvertical/smrt-scanner`.
 Run an advisory downstream ecosystem review. The tool scans package manifests
 and source imports for missing HappyVertical dependencies, direct storage
 bypasses, custom HTTP shells, custom object manifest generation, local
-auth/tenancy/audit seams, and UI shell drift. It returns deterministic findings
+auth/tenancy/audit seams, UI shell drift, and hand-rolled equivalents of
+smrt packages. It returns deterministic findings
 and suggested follow-up issue titles; it does not modify files.
 
 | Parameter | Type | Required | Description |
@@ -343,6 +344,21 @@ and suggested follow-up issue titles; it does not modify files.
 | `rootDir` | `string` | No | Compatibility alias for `directory` |
 | `includeSourceEvidence` | `boolean` | No | Include file/line evidence (default: true) |
 | `maxFindings` | `number` | No | Limit findings returned |
+| `intentIndexPath` | `string` | No | Caller-trusted intent index driving duplicate detection (`regex:` tokens become `RegExp`). Default: the full index packaged in this release (`dist/knowledge/intents/index.md`), else the monorepo's `docs/knowledge/intents/index.md` in a source checkout; never read from `directory` |
+| `detectDuplicates` | `boolean` | No | Run the intent-driven hand-rolled-equivalent pass (default: true) |
+
+Duplicate detection is table-driven: each row of the intent index names home
+packages and `import:`, `call:`, `regex:` and `decimal-field:` signals. When a
+package shows a signal and imports none of the row's home packages, the tool
+emits an advisory `duplicate-detection` finding anchored at `path:line` that
+names the intent page and component pages. Unknown signal kinds are skipped
+with a stderr note. The rules are never taken from the reviewed project, so a
+pull request cannot delete them or inject a pattern; when no index can be
+found the tool reports `skipped` with a note. The same pass runs from a shell with
+`npx @happyvertical/smrt-dev-mcp review --directory . [--intent-index PATH] [--format summary]`
+(exit 2 and a stderr message when no index is found, never a silent pass) and
+from the reusable `consumer-knowledge-review.yml` workflow, which always uses
+the packaged index.
 
 ### `reflect-knowledge`
 

package/agents/intent-duplicates.md

@@ -0,0 +1,26 @@
+# Intent-driven duplicate detection (#4690)
+
+`review-smrt-project` parses the intent index at runtime
+(`intent-index.ts`, pure) and `intent-detector.ts` evaluates each row's signals;
+no intent is named in code, so a new row with signals needs no change here.
+Trust boundary: `regex:` tokens become `RegExp`, so rules are never read from the
+reviewed tree. Index lookup: `intentIndexPath` / `--intent-index` (trusted by the
+caller), else the full unfiltered index shipped in this package's
+`dist/knowledge/intents/` (`scripts/ship-knowledge-pages.mjs`, list
+`OKF_INTENT_HOME_PACKAGES`), else the monorepo `docs/knowledge/intents/index.md`
+when run from the smrt checkout. The exported consumer bundle index is filtered
+to installed packages and is not consulted. Tokens:
+`import:<module>`, `call:<ident>`, `regex:<pattern>`, and
+`decimal-field:<glob>` (a property matching the glob declared with a decimal
+literal or `type: 'decimal'`). Unknown kinds are skipped with a stderr note. A
+finding needs a signal and no import of any row home package in the same
+package; it is advisory (`area: duplicate-detection`, `file: path:line`,
+`intentPage`, `componentPages`). Fixtures live in `test-fixtures/` (outside
+`src/`, so tsc, Biome, and vitest globs never see them).
+
+`smrt-dev-mcp review --directory . [--intent-index P] [--format summary]
+[--fail-on-findings]` runs the pass from a shell (exit 2 with a stderr message when
+no index is found; the tool reports `skipped` with a note). The reusable
+`.github/workflows/consumer-knowledge-review.yml` calls it through the pinned
+published package (public on npmjs, so private consumers need no token), has no
+index input, and writes the summary to `$GITHUB_STEP_SUMMARY`.

package/dist/dev-plane.js

@@ -1,6 +1,6 @@
 import { a as runtimeMigrationStatus, c as runtimeScheduleHealth, g as loadProjectCore, i as runtimeJobHealth, m as ProjectRuntimeResolutionError, o as runtimeRecentChanges, p as safeErrorMessage, r as runtimeDispatchHealth, s as runtimeRegistryDrift, t as RUNTIME_PROVENANCE } from "./tools-B0uaPTz0.js";
-import { i as SERVER_VERSION, r as SERVER_NAME, t as bearerMatches } from "./http-CCiO7qQW.js";
-import { n as TOOLS } from "./tool-catalog-RHq7nyCm.js";
+import { i as SERVER_VERSION, r as SERVER_NAME, t as bearerMatches } from "./http-BqKiyqgN.js";
+import { n as TOOLS } from "./tool-catalog-BhnSCF8g.js";
 import { i as runtimeSchemaDiff, n as runtimeObject, r as runtimeRegistry } from "./observation-DbB4z-9t.js";
 import { Server, createMcpHandler } from "@modelcontextprotocol/server";
 //#region src/dev-plane.ts

package/dist/{http-CCiO7qQW.js → http-BqKiyqgN.js}

@@ -1,5 +1,5 @@
 import { a as runtimeMigrationStatus, c as runtimeScheduleHealth, i as runtimeJobHealth, o as runtimeRecentChanges, r as runtimeDispatchHealth, s as runtimeRegistryDrift } from "./tools-B0uaPTz0.js";
-import { n as TOOLS } from "./tool-catalog-RHq7nyCm.js";
+import { n as TOOLS } from "./tool-catalog-BhnSCF8g.js";
 import { a as bootRuntime, i as runtimeSchemaDiff, n as runtimeObject, r as runtimeRegistry } from "./observation-DbB4z-9t.js";
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -166,4 +166,4 @@ async function startRuntimeHttpHost(options = {}) {
 //#endregion
 export { SERVER_VERSION as i, startRuntimeHttpHost as n, SERVER_NAME as r, bearerMatches as t };
 
-//# sourceMappingURL=http-CCiO7qQW.js.map
+//# sourceMappingURL=http-BqKiyqgN.js.map

package/dist/{http-CCiO7qQW.js.map → http-BqKiyqgN.js.map}

@@ -1 +1 @@
-{"version":3,"file":"http-CCiO7qQW.js","names":[],"sources":["../src/server-info.ts","../src/http.ts"],"sourcesContent":["import { readFileSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const SERVER_NAME = 'smrt-dev-mcp';\n\nfunction readPackageVersion(): string {\n  try {\n    const packageRoot = dirname(fileURLToPath(import.meta.url));\n    const packageJsonPath = join(packageRoot, '..', 'package.json');\n    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8')) as {\n      version?: unknown;\n    };\n    return typeof packageJson.version === 'string'\n      ? packageJson.version\n      : '0.0.0';\n  } catch {\n    return '0.0.0';\n  }\n}\n\nexport const SERVER_VERSION = readPackageVersion();\n","/**\n * Standalone Level 2 runtime dev-plane host (#1831).\n *\n * Serves a *positive* read-only tool catalog over the stateless 2026-07-28\n * Streamable HTTP transport (#2147): `createMcpHandler` with `legacy: 'reject'`\n * and `maxSubscriptions: 0`, adapted to Node with `toNodeHandler`. No SSE,\n * no session header, no sticky routing.\n *\n * Security boundary (development only):\n * - binds loopback only; SDK localhost Host/Origin validation runs first;\n * - every request needs `Authorization: Bearer <token>` (constant-time\n *   compare) — from `SMRT_DEV_MCP_TOKEN` or minted per process;\n * - no authenticated principal exists here, so scope stays fail-closed\n *   global-only exactly as in Level 1;\n * - the catalog never includes generated CRUD, custom actions, `do()`, or\n *   tool-backed `is()`.\n */\n\nimport { randomBytes, timingSafeEqual } from 'node:crypto';\nimport {\n  createServer as createHttpServer,\n  type Server as HttpServer,\n  type IncomingMessage,\n  type ServerResponse,\n} from 'node:http';\nimport type { AddressInfo } from 'node:net';\nimport {\n  localhostHostValidation,\n  localhostOriginValidation,\n  toNodeHandler,\n} from '@modelcontextprotocol/node';\nimport type { CallToolResult } from '@modelcontextprotocol/server';\nimport { createMcpHandler, Server } from '@modelcontextprotocol/server';\nimport { SERVER_NAME, SERVER_VERSION } from './server-info.js';\nimport { TOOLS } from './tool-catalog.js';\nimport { bootRuntime, type RuntimeBoot } from './tools/runtime/boot.js';\nimport {\n  runtimeObject,\n  runtimeRegistry,\n  runtimeSchemaDiff,\n} from './tools/runtime/observation.js';\nimport {\n  runtimeDispatchHealth,\n  runtimeJobHealth,\n  runtimeMigrationStatus,\n  runtimeRecentChanges,\n  runtimeRegistryDrift,\n  runtimeScheduleHealth,\n} from './tools/runtime/tools.js';\n\n/**\n * The complete Level 2 catalog. A tool is exposed over HTTP only if it is\n * named here; the static stdio catalog is deliberately not mounted.\n */\nexport const RUNTIME_HTTP_TOOL_NAMES = [\n  'runtime-registry',\n  'runtime-object',\n  'runtime-schema-diff',\n  'migration-status',\n  'job-health',\n  'schedule-health',\n  'dispatch-health',\n  'recent-changes',\n  'registry-drift',\n] as const;\n\nexport type RuntimeHttpToolName = (typeof RUNTIME_HTTP_TOOL_NAMES)[number];\n\nconst RUNTIME_HTTP_HANDLERS: Record<\n  RuntimeHttpToolName,\n  (args: Record<string, unknown>) => Promise<unknown>\n> = {\n  'runtime-registry': (args) => runtimeRegistry(args as never),\n  'runtime-object': (args) => runtimeObject(args as never),\n  'runtime-schema-diff': (args) => runtimeSchemaDiff(args as never),\n  'migration-status': (args) => runtimeMigrationStatus(args as never),\n  'job-health': (args) => runtimeJobHealth(args as never),\n  'schedule-health': (args) => runtimeScheduleHealth(args as never),\n  'dispatch-health': (args) => runtimeDispatchHealth(args as never),\n  'recent-changes': (args) => runtimeRecentChanges(args as never),\n  'registry-drift': (args) => runtimeRegistryDrift(args as never),\n};\n\n/** Catalog definitions for the HTTP plane, in catalog order. */\nexport function runtimeHttpTools() {\n  const names = new Set<string>(RUNTIME_HTTP_TOOL_NAMES);\n  return TOOLS.filter((tool) => names.has(tool.name));\n}\n\n/**\n * Build a fresh protocol server per request (stateless transport contract).\n * `projectRoot` is fixed at host start; per-request `projectPath` arguments\n * are ignored so a client cannot re-point the booted process.\n */\nexport function createRuntimeProtocolServer(projectRoot: string): Server {\n  const server = new Server(\n    { name: `${SERVER_NAME}-runtime`, version: SERVER_VERSION },\n    { capabilities: { tools: {} } },\n  );\n  server.setRequestHandler('tools/list', async () => ({\n    tools: runtimeHttpTools(),\n  }));\n  server.setRequestHandler('tools/call', async (request) => {\n    const name = request.params.name as string;\n    const handler = (RUNTIME_HTTP_HANDLERS as Record<string, unknown>)[name];\n    if (typeof handler !== 'function') {\n      throw new Error(`Unknown runtime tool: ${name}`);\n    }\n    const { projectPath: _ignored, ...args } = (request.params.arguments ??\n      {}) as Record<string, unknown>;\n    const result = await (\n      handler as (a: Record<string, unknown>) => Promise<unknown>\n    )({ ...args, projectPath: projectRoot });\n    const text = JSON.stringify(result, null, 2);\n    return {\n      content: [{ type: 'text', text }],\n      structuredContent: result as Record<string, unknown>,\n    } satisfies CallToolResult;\n  });\n  return server;\n}\n\nexport interface RuntimeHttpHostOptions {\n  projectRoot?: string;\n  /** Loopback interface only; anything else is refused at startup. */\n  host?: '127.0.0.1' | 'localhost' | '::1';\n  /** `0` (default) picks a free port. */\n  port?: number;\n  /** Bearer token; defaults to `SMRT_DEV_MCP_TOKEN` or a per-process random token. */\n  token?: string;\n  /** Path the MCP endpoint is mounted on (default `/mcp`). */\n  path?: string;\n}\n\nexport interface RuntimeHttpHost {\n  url: string;\n  token: string;\n  boot: RuntimeBoot;\n  close(): Promise<void>;\n}\n\nconst LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1']);\n\nexport function bearerMatches(\n  header: string | undefined,\n  token: string,\n): boolean {\n  if (!header?.startsWith('Bearer ')) return false;\n  const presented = Buffer.from(header.slice('Bearer '.length));\n  const expected = Buffer.from(token);\n  return (\n    presented.length === expected.length && timingSafeEqual(presented, expected)\n  );\n}\n\nfunction deny(res: ServerResponse, status: number, message: string): void {\n  res.statusCode = status;\n  res.setHeader('content-type', 'application/json');\n  if (status === 401) {\n    res.setHeader('www-authenticate', 'Bearer realm=\"smrt-dev-mcp runtime\"');\n  }\n  res.end(JSON.stringify({ error: message }));\n}\n\n/** Start the Level 2 host. Boots the confined runtime before listening. */\nexport async function startRuntimeHttpHost(\n  options: RuntimeHttpHostOptions = {},\n): Promise<RuntimeHttpHost> {\n  const host = options.host ?? '127.0.0.1';\n  if (!LOOPBACK_HOSTS.has(host)) {\n    throw new Error(\n      'The runtime dev-plane binds loopback only (127.0.0.1, localhost, ::1).',\n    );\n  }\n  const path = options.path ?? '/mcp';\n  const token =\n    options.token ??\n    process.env.SMRT_DEV_MCP_TOKEN?.trim() ??\n    randomBytes(24).toString('base64url');\n  if (!token) {\n    throw new Error('SMRT_DEV_MCP_TOKEN must not be empty.');\n  }\n  const projectRoot = options.projectRoot ?? process.cwd();\n  const boot = await bootRuntime({ projectRoot });\n\n  const mcp = toNodeHandler(\n    createMcpHandler(() => createRuntimeProtocolServer(projectRoot), {\n      legacy: 'reject',\n      maxSubscriptions: 0,\n    }),\n  );\n  const hostGuard = localhostHostValidation();\n  const originGuard = localhostOriginValidation();\n\n  const httpServer: HttpServer = createHttpServer(\n    (req: IncomingMessage, res: ServerResponse) => {\n      // Guards answer and end the response themselves when they return false.\n      if (!hostGuard(req, res)) return;\n      if (!originGuard(req, res)) return;\n      const url = new URL(req.url ?? '/', 'http://localhost');\n      if (url.pathname !== path) {\n        deny(res, 404, 'not found');\n        return;\n      }\n      if (!bearerMatches(req.headers.authorization, token)) {\n        deny(res, 401, 'missing or invalid bearer token');\n        return;\n      }\n      void mcp(req, res);\n    },\n  );\n\n  await new Promise<void>((resolve, reject) => {\n    httpServer.once('error', reject);\n    httpServer.listen(options.port ?? 0, host, () => {\n      httpServer.off('error', reject);\n      resolve();\n    });\n  });\n  const address = httpServer.address() as AddressInfo;\n  const urlHost =\n    address.family === 'IPv6' ? `[${address.address}]` : address.address;\n  return {\n    url: `http://${urlHost}:${address.port}${path}`,\n    token,\n    boot,\n    close: () =>\n      new Promise<void>((resolve, reject) => {\n        httpServer.closeAllConnections?.();\n        httpServer.close((error) => (error ? reject(error) : resolve()));\n      }),\n  };\n}\n"],"mappings":";;;;;;;;;;;AAIA,IAAa,cAAc;AAE3B,SAAS,qBAA6B;CACpC,IAAI;EAEF,MAAM,kBAAkB,KADJ,QAAQ,cAAc,OAAO,KAAK,GAAG,CAC5B,GAAa,MAAM,cAAc;EAC9D,MAAM,cAAc,KAAK,MAAM,aAAa,iBAAiB,OAAO,CAAC;EAGrE,OAAO,OAAO,YAAY,YAAY,WAClC,YAAY,UACZ;CACN,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,iBAAiB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;ACiCjD,IAAa,0BAA0B;CACrC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAIA,IAAM,wBAGF;CACF,qBAAqB,SAAS,gBAAgB,IAAa;CAC3D,mBAAmB,SAAS,cAAc,IAAa;CACvD,wBAAwB,SAAS,kBAAkB,IAAa;CAChE,qBAAqB,SAAS,uBAAuB,IAAa;CAClE,eAAe,SAAS,iBAAiB,IAAa;CACtD,oBAAoB,SAAS,sBAAsB,IAAa;CAChE,oBAAoB,SAAS,sBAAsB,IAAa;CAChE,mBAAmB,SAAS,qBAAqB,IAAa;CAC9D,mBAAmB,SAAS,qBAAqB,IAAa;AAChE;;AAGA,SAAgB,mBAAmB;CACjC,MAAM,QAAQ,IAAI,IAAY,uBAAuB;CACrD,OAAO,MAAM,QAAQ,SAAS,MAAM,IAAI,KAAK,IAAI,CAAC;AACpD;;;;;;AAOA,SAAgB,4BAA4B,aAA6B;CACvE,MAAM,SAAS,IAAI,OACjB;EAAE,MAAM,GAAG,YAAY;EAAW,SAAS;CAAe,GAC1D,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE,CAChC;CACA,OAAO,kBAAkB,cAAc,aAAa,EAClD,OAAO,iBAAiB,EAC1B,EAAE;CACF,OAAO,kBAAkB,cAAc,OAAO,YAAY;EACxD,MAAM,OAAO,QAAQ,OAAO;EAC5B,MAAM,UAAW,sBAAkD;EACnE,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MAAM,yBAAyB,MAAM;EAEjD,MAAM,EAAE,aAAa,UAAU,GAAG,SAAU,QAAQ,OAAO,aACzD,CAAC;EACH,MAAM,SAAS,MACb,QACA;GAAE,GAAG;GAAM,aAAa;EAAY,CAAC;EAEvC,OAAO;GACL,SAAS,CAAC;IAAE,MAAM;IAAQ,MAFf,KAAK,UAAU,QAAQ,MAAM,CAEd;GAAK,CAAC;GAChC,mBAAmB;EACrB;CACF,CAAC;CACD,OAAO;AACT;AAqBA,IAAM,iCAAiB,IAAI,IAAI;CAAC;CAAa;CAAa;AAAK,CAAC;AAEhE,SAAgB,cACd,QACA,OACS;CACT,IAAI,CAAC,QAAQ,WAAW,SAAS,GAAG,OAAO;CAC3C,MAAM,YAAY,OAAO,KAAK,OAAO,MAAM,CAAgB,CAAC;CAC5D,MAAM,WAAW,OAAO,KAAK,KAAK;CAClC,OACE,UAAU,WAAW,SAAS,UAAU,gBAAgB,WAAW,QAAQ;AAE/E;AAEA,SAAS,KAAK,KAAqB,QAAgB,SAAuB;CACxE,IAAI,aAAa;CACjB,IAAI,UAAU,gBAAgB,kBAAkB;CAChD,IAAI,WAAW,KACb,IAAI,UAAU,oBAAoB,uCAAqC;CAEzE,IAAI,IAAI,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC,CAAC;AAC5C;;AAGA,eAAsB,qBACpB,UAAkC,CAAC,GACT;CAC1B,MAAM,OAAO,QAAQ,QAAQ;CAC7B,IAAI,CAAC,eAAe,IAAI,IAAI,GAC1B,MAAM,IAAI,MACR,wEACF;CAEF,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,QACJ,QAAQ,SACR,QAAQ,IAAI,oBAAoB,KAAK,KACrC,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACtC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,uCAAuC;CAEzD,MAAM,cAAc,QAAQ,eAAe,QAAQ,IAAI;CACvD,MAAM,OAAO,MAAM,YAAY,EAAE,YAAY,CAAC;CAE9C,MAAM,MAAM,cACV,uBAAuB,4BAA4B,WAAW,GAAG;EAC/D,QAAQ;EACR,kBAAkB;CACpB,CAAC,CACH;CACA,MAAM,YAAY,wBAAwB;CAC1C,MAAM,cAAc,0BAA0B;CAE9C,MAAM,aAAyB,cAC5B,KAAsB,QAAwB;EAE7C,IAAI,CAAC,UAAU,KAAK,GAAG,GAAG;EAC1B,IAAI,CAAC,YAAY,KAAK,GAAG,GAAG;EAE5B,IAAI,IADY,IAAI,IAAI,OAAO,KAAK,kBAChC,CAAA,CAAI,aAAa,MAAM;GACzB,KAAK,KAAK,KAAK,WAAW;GAC1B;EACF;EACA,IAAI,CAAC,cAAc,IAAI,QAAQ,eAAe,KAAK,GAAG;GACpD,KAAK,KAAK,KAAK,iCAAiC;GAChD;EACF;EACA,IAAS,KAAK,GAAG;CACnB,CACF;CAEA,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,WAAW,KAAK,SAAS,MAAM;EAC/B,WAAW,OAAO,QAAQ,QAAQ,GAAG,YAAY;GAC/C,WAAW,IAAI,SAAS,MAAM;GAC9B,QAAQ;EACV,CAAC;CACH,CAAC;CACD,MAAM,UAAU,WAAW,QAAQ;CAGnC,OAAO;EACL,KAAK,UAFL,QAAQ,WAAW,SAAS,IAAI,QAAQ,QAAQ,KAAK,QAAQ,QAEtC,GAAG,QAAQ,OAAO;EACzC;EACA;EACA,aACE,IAAI,SAAe,SAAS,WAAW;GACrC,WAAW,sBAAsB;GACjC,WAAW,OAAO,UAAW,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAE;EACjE,CAAC;CACL;AACF"}
+{"version":3,"file":"http-BqKiyqgN.js","names":[],"sources":["../src/server-info.ts","../src/http.ts"],"sourcesContent":["import { readFileSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const SERVER_NAME = 'smrt-dev-mcp';\n\nfunction readPackageVersion(): string {\n  try {\n    const packageRoot = dirname(fileURLToPath(import.meta.url));\n    const packageJsonPath = join(packageRoot, '..', 'package.json');\n    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8')) as {\n      version?: unknown;\n    };\n    return typeof packageJson.version === 'string'\n      ? packageJson.version\n      : '0.0.0';\n  } catch {\n    return '0.0.0';\n  }\n}\n\nexport const SERVER_VERSION = readPackageVersion();\n","/**\n * Standalone Level 2 runtime dev-plane host (#1831).\n *\n * Serves a *positive* read-only tool catalog over the stateless 2026-07-28\n * Streamable HTTP transport (#2147): `createMcpHandler` with `legacy: 'reject'`\n * and `maxSubscriptions: 0`, adapted to Node with `toNodeHandler`. No SSE,\n * no session header, no sticky routing.\n *\n * Security boundary (development only):\n * - binds loopback only; SDK localhost Host/Origin validation runs first;\n * - every request needs `Authorization: Bearer <token>` (constant-time\n *   compare) — from `SMRT_DEV_MCP_TOKEN` or minted per process;\n * - no authenticated principal exists here, so scope stays fail-closed\n *   global-only exactly as in Level 1;\n * - the catalog never includes generated CRUD, custom actions, `do()`, or\n *   tool-backed `is()`.\n */\n\nimport { randomBytes, timingSafeEqual } from 'node:crypto';\nimport {\n  createServer as createHttpServer,\n  type Server as HttpServer,\n  type IncomingMessage,\n  type ServerResponse,\n} from 'node:http';\nimport type { AddressInfo } from 'node:net';\nimport {\n  localhostHostValidation,\n  localhostOriginValidation,\n  toNodeHandler,\n} from '@modelcontextprotocol/node';\nimport type { CallToolResult } from '@modelcontextprotocol/server';\nimport { createMcpHandler, Server } from '@modelcontextprotocol/server';\nimport { SERVER_NAME, SERVER_VERSION } from './server-info.js';\nimport { TOOLS } from './tool-catalog.js';\nimport { bootRuntime, type RuntimeBoot } from './tools/runtime/boot.js';\nimport {\n  runtimeObject,\n  runtimeRegistry,\n  runtimeSchemaDiff,\n} from './tools/runtime/observation.js';\nimport {\n  runtimeDispatchHealth,\n  runtimeJobHealth,\n  runtimeMigrationStatus,\n  runtimeRecentChanges,\n  runtimeRegistryDrift,\n  runtimeScheduleHealth,\n} from './tools/runtime/tools.js';\n\n/**\n * The complete Level 2 catalog. A tool is exposed over HTTP only if it is\n * named here; the static stdio catalog is deliberately not mounted.\n */\nexport const RUNTIME_HTTP_TOOL_NAMES = [\n  'runtime-registry',\n  'runtime-object',\n  'runtime-schema-diff',\n  'migration-status',\n  'job-health',\n  'schedule-health',\n  'dispatch-health',\n  'recent-changes',\n  'registry-drift',\n] as const;\n\nexport type RuntimeHttpToolName = (typeof RUNTIME_HTTP_TOOL_NAMES)[number];\n\nconst RUNTIME_HTTP_HANDLERS: Record<\n  RuntimeHttpToolName,\n  (args: Record<string, unknown>) => Promise<unknown>\n> = {\n  'runtime-registry': (args) => runtimeRegistry(args as never),\n  'runtime-object': (args) => runtimeObject(args as never),\n  'runtime-schema-diff': (args) => runtimeSchemaDiff(args as never),\n  'migration-status': (args) => runtimeMigrationStatus(args as never),\n  'job-health': (args) => runtimeJobHealth(args as never),\n  'schedule-health': (args) => runtimeScheduleHealth(args as never),\n  'dispatch-health': (args) => runtimeDispatchHealth(args as never),\n  'recent-changes': (args) => runtimeRecentChanges(args as never),\n  'registry-drift': (args) => runtimeRegistryDrift(args as never),\n};\n\n/** Catalog definitions for the HTTP plane, in catalog order. */\nexport function runtimeHttpTools() {\n  const names = new Set<string>(RUNTIME_HTTP_TOOL_NAMES);\n  return TOOLS.filter((tool) => names.has(tool.name));\n}\n\n/**\n * Build a fresh protocol server per request (stateless transport contract).\n * `projectRoot` is fixed at host start; per-request `projectPath` arguments\n * are ignored so a client cannot re-point the booted process.\n */\nexport function createRuntimeProtocolServer(projectRoot: string): Server {\n  const server = new Server(\n    { name: `${SERVER_NAME}-runtime`, version: SERVER_VERSION },\n    { capabilities: { tools: {} } },\n  );\n  server.setRequestHandler('tools/list', async () => ({\n    tools: runtimeHttpTools(),\n  }));\n  server.setRequestHandler('tools/call', async (request) => {\n    const name = request.params.name as string;\n    const handler = (RUNTIME_HTTP_HANDLERS as Record<string, unknown>)[name];\n    if (typeof handler !== 'function') {\n      throw new Error(`Unknown runtime tool: ${name}`);\n    }\n    const { projectPath: _ignored, ...args } = (request.params.arguments ??\n      {}) as Record<string, unknown>;\n    const result = await (\n      handler as (a: Record<string, unknown>) => Promise<unknown>\n    )({ ...args, projectPath: projectRoot });\n    const text = JSON.stringify(result, null, 2);\n    return {\n      content: [{ type: 'text', text }],\n      structuredContent: result as Record<string, unknown>,\n    } satisfies CallToolResult;\n  });\n  return server;\n}\n\nexport interface RuntimeHttpHostOptions {\n  projectRoot?: string;\n  /** Loopback interface only; anything else is refused at startup. */\n  host?: '127.0.0.1' | 'localhost' | '::1';\n  /** `0` (default) picks a free port. */\n  port?: number;\n  /** Bearer token; defaults to `SMRT_DEV_MCP_TOKEN` or a per-process random token. */\n  token?: string;\n  /** Path the MCP endpoint is mounted on (default `/mcp`). */\n  path?: string;\n}\n\nexport interface RuntimeHttpHost {\n  url: string;\n  token: string;\n  boot: RuntimeBoot;\n  close(): Promise<void>;\n}\n\nconst LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1']);\n\nexport function bearerMatches(\n  header: string | undefined,\n  token: string,\n): boolean {\n  if (!header?.startsWith('Bearer ')) return false;\n  const presented = Buffer.from(header.slice('Bearer '.length));\n  const expected = Buffer.from(token);\n  return (\n    presented.length === expected.length && timingSafeEqual(presented, expected)\n  );\n}\n\nfunction deny(res: ServerResponse, status: number, message: string): void {\n  res.statusCode = status;\n  res.setHeader('content-type', 'application/json');\n  if (status === 401) {\n    res.setHeader('www-authenticate', 'Bearer realm=\"smrt-dev-mcp runtime\"');\n  }\n  res.end(JSON.stringify({ error: message }));\n}\n\n/** Start the Level 2 host. Boots the confined runtime before listening. */\nexport async function startRuntimeHttpHost(\n  options: RuntimeHttpHostOptions = {},\n): Promise<RuntimeHttpHost> {\n  const host = options.host ?? '127.0.0.1';\n  if (!LOOPBACK_HOSTS.has(host)) {\n    throw new Error(\n      'The runtime dev-plane binds loopback only (127.0.0.1, localhost, ::1).',\n    );\n  }\n  const path = options.path ?? '/mcp';\n  const token =\n    options.token ??\n    process.env.SMRT_DEV_MCP_TOKEN?.trim() ??\n    randomBytes(24).toString('base64url');\n  if (!token) {\n    throw new Error('SMRT_DEV_MCP_TOKEN must not be empty.');\n  }\n  const projectRoot = options.projectRoot ?? process.cwd();\n  const boot = await bootRuntime({ projectRoot });\n\n  const mcp = toNodeHandler(\n    createMcpHandler(() => createRuntimeProtocolServer(projectRoot), {\n      legacy: 'reject',\n      maxSubscriptions: 0,\n    }),\n  );\n  const hostGuard = localhostHostValidation();\n  const originGuard = localhostOriginValidation();\n\n  const httpServer: HttpServer = createHttpServer(\n    (req: IncomingMessage, res: ServerResponse) => {\n      // Guards answer and end the response themselves when they return false.\n      if (!hostGuard(req, res)) return;\n      if (!originGuard(req, res)) return;\n      const url = new URL(req.url ?? '/', 'http://localhost');\n      if (url.pathname !== path) {\n        deny(res, 404, 'not found');\n        return;\n      }\n      if (!bearerMatches(req.headers.authorization, token)) {\n        deny(res, 401, 'missing or invalid bearer token');\n        return;\n      }\n      void mcp(req, res);\n    },\n  );\n\n  await new Promise<void>((resolve, reject) => {\n    httpServer.once('error', reject);\n    httpServer.listen(options.port ?? 0, host, () => {\n      httpServer.off('error', reject);\n      resolve();\n    });\n  });\n  const address = httpServer.address() as AddressInfo;\n  const urlHost =\n    address.family === 'IPv6' ? `[${address.address}]` : address.address;\n  return {\n    url: `http://${urlHost}:${address.port}${path}`,\n    token,\n    boot,\n    close: () =>\n      new Promise<void>((resolve, reject) => {\n        httpServer.closeAllConnections?.();\n        httpServer.close((error) => (error ? reject(error) : resolve()));\n      }),\n  };\n}\n"],"mappings":";;;;;;;;;;;AAIA,IAAa,cAAc;AAE3B,SAAS,qBAA6B;CACpC,IAAI;EAEF,MAAM,kBAAkB,KADJ,QAAQ,cAAc,OAAO,KAAK,GAAG,CAC5B,GAAa,MAAM,cAAc;EAC9D,MAAM,cAAc,KAAK,MAAM,aAAa,iBAAiB,OAAO,CAAC;EAGrE,OAAO,OAAO,YAAY,YAAY,WAClC,YAAY,UACZ;CACN,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,iBAAiB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;ACiCjD,IAAa,0BAA0B;CACrC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAIA,IAAM,wBAGF;CACF,qBAAqB,SAAS,gBAAgB,IAAa;CAC3D,mBAAmB,SAAS,cAAc,IAAa;CACvD,wBAAwB,SAAS,kBAAkB,IAAa;CAChE,qBAAqB,SAAS,uBAAuB,IAAa;CAClE,eAAe,SAAS,iBAAiB,IAAa;CACtD,oBAAoB,SAAS,sBAAsB,IAAa;CAChE,oBAAoB,SAAS,sBAAsB,IAAa;CAChE,mBAAmB,SAAS,qBAAqB,IAAa;CAC9D,mBAAmB,SAAS,qBAAqB,IAAa;AAChE;;AAGA,SAAgB,mBAAmB;CACjC,MAAM,QAAQ,IAAI,IAAY,uBAAuB;CACrD,OAAO,MAAM,QAAQ,SAAS,MAAM,IAAI,KAAK,IAAI,CAAC;AACpD;;;;;;AAOA,SAAgB,4BAA4B,aAA6B;CACvE,MAAM,SAAS,IAAI,OACjB;EAAE,MAAM,GAAG,YAAY;EAAW,SAAS;CAAe,GAC1D,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE,CAChC;CACA,OAAO,kBAAkB,cAAc,aAAa,EAClD,OAAO,iBAAiB,EAC1B,EAAE;CACF,OAAO,kBAAkB,cAAc,OAAO,YAAY;EACxD,MAAM,OAAO,QAAQ,OAAO;EAC5B,MAAM,UAAW,sBAAkD;EACnE,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MAAM,yBAAyB,MAAM;EAEjD,MAAM,EAAE,aAAa,UAAU,GAAG,SAAU,QAAQ,OAAO,aACzD,CAAC;EACH,MAAM,SAAS,MACb,QACA;GAAE,GAAG;GAAM,aAAa;EAAY,CAAC;EAEvC,OAAO;GACL,SAAS,CAAC;IAAE,MAAM;IAAQ,MAFf,KAAK,UAAU,QAAQ,MAAM,CAEd;GAAK,CAAC;GAChC,mBAAmB;EACrB;CACF,CAAC;CACD,OAAO;AACT;AAqBA,IAAM,iCAAiB,IAAI,IAAI;CAAC;CAAa;CAAa;AAAK,CAAC;AAEhE,SAAgB,cACd,QACA,OACS;CACT,IAAI,CAAC,QAAQ,WAAW,SAAS,GAAG,OAAO;CAC3C,MAAM,YAAY,OAAO,KAAK,OAAO,MAAM,CAAgB,CAAC;CAC5D,MAAM,WAAW,OAAO,KAAK,KAAK;CAClC,OACE,UAAU,WAAW,SAAS,UAAU,gBAAgB,WAAW,QAAQ;AAE/E;AAEA,SAAS,KAAK,KAAqB,QAAgB,SAAuB;CACxE,IAAI,aAAa;CACjB,IAAI,UAAU,gBAAgB,kBAAkB;CAChD,IAAI,WAAW,KACb,IAAI,UAAU,oBAAoB,uCAAqC;CAEzE,IAAI,IAAI,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC,CAAC;AAC5C;;AAGA,eAAsB,qBACpB,UAAkC,CAAC,GACT;CAC1B,MAAM,OAAO,QAAQ,QAAQ;CAC7B,IAAI,CAAC,eAAe,IAAI,IAAI,GAC1B,MAAM,IAAI,MACR,wEACF;CAEF,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,QACJ,QAAQ,SACR,QAAQ,IAAI,oBAAoB,KAAK,KACrC,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACtC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,uCAAuC;CAEzD,MAAM,cAAc,QAAQ,eAAe,QAAQ,IAAI;CACvD,MAAM,OAAO,MAAM,YAAY,EAAE,YAAY,CAAC;CAE9C,MAAM,MAAM,cACV,uBAAuB,4BAA4B,WAAW,GAAG;EAC/D,QAAQ;EACR,kBAAkB;CACpB,CAAC,CACH;CACA,MAAM,YAAY,wBAAwB;CAC1C,MAAM,cAAc,0BAA0B;CAE9C,MAAM,aAAyB,cAC5B,KAAsB,QAAwB;EAE7C,IAAI,CAAC,UAAU,KAAK,GAAG,GAAG;EAC1B,IAAI,CAAC,YAAY,KAAK,GAAG,GAAG;EAE5B,IAAI,IADY,IAAI,IAAI,OAAO,KAAK,kBAChC,CAAA,CAAI,aAAa,MAAM;GACzB,KAAK,KAAK,KAAK,WAAW;GAC1B;EACF;EACA,IAAI,CAAC,cAAc,IAAI,QAAQ,eAAe,KAAK,GAAG;GACpD,KAAK,KAAK,KAAK,iCAAiC;GAChD;EACF;EACA,IAAS,KAAK,GAAG;CACnB,CACF;CAEA,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,WAAW,KAAK,SAAS,MAAM;EAC/B,WAAW,OAAO,QAAQ,QAAQ,GAAG,YAAY;GAC/C,WAAW,IAAI,SAAS,MAAM;GAC9B,QAAQ;EACV,CAAC;CACH,CAAC;CACD,MAAM,UAAU,WAAW,QAAQ;CAGnC,OAAO;EACL,KAAK,UAFL,QAAQ,WAAW,SAAS,IAAI,QAAQ,QAAQ,KAAK,QAAQ,QAEtC,GAAG,QAAQ,OAAO;EACzC;EACA;EACA,aACE,IAAI,SAAe,SAAS,WAAW;GACrC,WAAW,sBAAsB;GACjC,WAAW,OAAO,UAAW,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAE;EACjE,CAAC;CACL;AACF"}

package/dist/index.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { f as redactConnectionString, m as ProjectRuntimeResolutionError } from "./tools-B0uaPTz0.js";
-import { i as SERVER_VERSION, n as startRuntimeHttpHost, r as SERVER_NAME } from "./http-CCiO7qQW.js";
-import { n as TOOLS, t as REVIEW_SKILL_NAME } from "./tool-catalog-RHq7nyCm.js";
-import { a as buildReviewContext, c as compactContextResult, i as buildPackageSpecialistContext, n as buildContext, o as checkKnowledgeFreshness, r as buildKnowledgeIndex, s as checkKnowledgeFreshnessFromIndex, t as buildArchitectureContext } from "./knowledge-DqoDX-lZ.js";
+import { i as SERVER_VERSION, n as startRuntimeHttpHost, r as SERVER_NAME } from "./http-BqKiyqgN.js";
+import { n as TOOLS, t as REVIEW_SKILL_NAME } from "./tool-catalog-BhnSCF8g.js";
+import { a as buildReviewContext, c as compactContextResult, i as buildPackageSpecialistContext, n as buildContext, o as checkKnowledgeFreshness, r as buildKnowledgeIndex, s as checkKnowledgeFreshnessFromIndex, t as buildArchitectureContext } from "./knowledge-DUiMUjEg.js";
+import { t as reviewSmrtProject } from "./review-smrt-project-ByEwPcor.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
-import { dirname, join, relative, resolve, sep } from "node:path";
+import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { ProtocolError, ProtocolErrorCode, Server } from "@modelcontextprotocol/server";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
-import { access, readFile, readdir } from "node:fs/promises";
 //#region src/agent-skills.ts
 var AGENT_SKILLS = [{
 	name: "smrt-code-review",
@@ -232,409 +232,6 @@ function compactObject(value) {
 	return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== void 0));
 }
 //#endregion
-//#region src/tools/review-smrt-project.ts
-/**
-* Ecosystem-aware downstream project review.
-* Advisory only: scans manifests and source files, then reports alignment risks.
-*/
-var SOURCE_EXTENSIONS = /\.(tsx?|jsx?|svelte)$/;
-var SKIP_DIRS = /* @__PURE__ */ new Set([
-	"node_modules",
-	"dist",
-	"build",
-	".git",
-	".smrt",
-	".svelte-kit",
-	"coverage"
-]);
-var DEPENDENCY_SECTIONS = [
-	"dependencies",
-	"devDependencies",
-	"peerDependencies",
-	"optionalDependencies"
-];
-var SMRT_PACKAGE_PREFIX = "@happyvertical/smrt-";
-var HAPPYVERTICAL_PACKAGE_PREFIX = "@happyvertical/";
-async function reviewSmrtProject(args) {
-	const projectPath = resolve(args.directory ?? args.rootDir ?? process.cwd());
-	if (!await pathExists(projectPath)) return JSON.stringify({
-		projectPath,
-		packageCount: 0,
-		packages: [],
-		findings: [],
-		summary: {
-			high: 0,
-			medium: 0,
-			low: 0
-		},
-		diagnostics: [{
-			severity: "warning",
-			message: `Project directory does not exist: ${projectPath}`
-		}]
-	}, null, 2);
-	const packageContexts = await buildPackageContexts(projectPath);
-	const sourceFiles = await listSourceFiles(projectPath, packageContexts);
-	await attachSourceFiles(sourceFiles, packageContexts, projectPath);
-	const findings = limitFindings([
-		...findMissingHappyVerticalDependencies(packageContexts),
-		...findCustomManifestGeneration(sourceFiles, projectPath),
-		...findDirectStorageBypasses(sourceFiles, packageContexts, projectPath),
-		...findCustomHttpShells(sourceFiles, packageContexts, projectPath),
-		...findLocalAuthTenancy(sourceFiles, packageContexts, projectPath),
-		...findUiShellDrift(packageContexts, projectPath),
-		...findMissingManifestArtifacts(sourceFiles, packageContexts, projectPath)
-	], args.maxFindings);
-	const packages = packageContexts.map(packageInventory).sort((left, right) => left.path.localeCompare(right.path));
-	const summary = summarizeFindings(findings);
-	return JSON.stringify({
-		projectPath,
-		packageCount: packages.length,
-		packages,
-		findings: args.includeSourceEvidence === false ? findings.map(({ evidence: _evidence, ...finding }) => finding) : findings,
-		summary,
-		referenceChecks: [
-			"Prefer SMRT scanner/runtime manifests over custom manifest builders.",
-			"Prefer SvelteKit plus @happyvertical/smrt-svelte for app shells.",
-			"Prefer @happyvertical/sql and @happyvertical/files/assets/content over direct durable node:fs storage.",
-			"Prefer smrt-users, smrt-tenancy, and profile/audit packages over local static auth seams."
-		],
-		suggestedFollowUpIssues: findings.map((finding) => ({
-			title: finding.suggestedIssueTitle,
-			severity: finding.severity,
-			area: finding.area
-		}))
-	}, null, 2);
-}
-async function buildPackageContexts(projectPath) {
-	const packageJsonPaths = await listPackageJsonFiles(projectPath);
-	const contexts = await Promise.all(packageJsonPaths.map(async (packageJsonPath) => {
-		const json = JSON.parse(await readFile(packageJsonPath, "utf-8"));
-		const directory = dirname(packageJsonPath);
-		return {
-			directory,
-			relativePath: relative(projectPath, directory) || ".",
-			packageJsonPath,
-			json,
-			dependencies: collectDependencies(json),
-			scripts: isRecord$1(json.scripts) ? json.scripts : {},
-			imports: /* @__PURE__ */ new Map(),
-			sourceFiles: []
-		};
-	}));
-	if (contexts.length === 0) contexts.push({
-		directory: projectPath,
-		relativePath: ".",
-		packageJsonPath: join(projectPath, "package.json"),
-		json: {},
-		dependencies: /* @__PURE__ */ new Set(),
-		scripts: {},
-		imports: /* @__PURE__ */ new Map(),
-		sourceFiles: []
-	});
-	return contexts.sort((left, right) => left.directory.length - right.directory.length);
-}
-async function listPackageJsonFiles(projectPath) {
-	const files = [];
-	await visit(projectPath, async (filePath, entryName) => {
-		if (entryName === "package.json") files.push(filePath);
-	});
-	return files;
-}
-async function listSourceFiles(projectPath, packages) {
-	const files = [];
-	await visit(projectPath, async (filePath, entryName) => {
-		if (!SOURCE_EXTENSIONS.test(entryName)) return;
-		if (entryName.endsWith(".d.ts") || entryName.endsWith(".test.ts") || entryName.endsWith(".spec.ts")) return;
-		const packageDir = findOwningPackage(filePath, packages).directory;
-		const content = await readFile(filePath, "utf-8");
-		files.push({
-			path: filePath,
-			packageDir,
-			content
-		});
-	});
-	return files;
-}
-async function attachSourceFiles(sourceFiles, packages, projectPath) {
-	for (const sourceFile of sourceFiles) {
-		const owner = packages.find((pkg) => pkg.directory === sourceFile.packageDir);
-		if (!owner) continue;
-		owner.sourceFiles.push(sourceFile);
-		for (const importedPackage of extractImports(sourceFile.content)) {
-			if (!importedPackage.startsWith(HAPPYVERTICAL_PACKAGE_PREFIX)) continue;
-			const evidence = {
-				filePath: relative(projectPath, sourceFile.path),
-				line: lineNumber(sourceFile.content, importedPackage),
-				detail: `Imports ${importedPackage}`
-			};
-			const existing = owner.imports.get(importedPackage) ?? [];
-			existing.push(evidence);
-			owner.imports.set(importedPackage, existing);
-		}
-	}
-}
-function findMissingHappyVerticalDependencies(packages) {
-	return packages.flatMap((pkg) => {
-		const ownName = typeof pkg.json.name === "string" ? pkg.json.name : void 0;
-		const missing = Array.from(pkg.imports.keys()).filter((importedPackage) => importedPackage !== ownName && !pkg.dependencies.has(importedPackage));
-		if (missing.length === 0) return [];
-		return [{
-			severity: missing.some((name) => name.startsWith(SMRT_PACKAGE_PREFIX)) ? "high" : "medium",
-			area: "dependencies",
-			code: "missing-happyvertical-dependencies",
-			title: `${packageLabel(pkg)} imports HappyVertical packages that package.json does not declare`,
-			evidence: missing.flatMap((name) => pkg.imports.get(name) ?? []),
-			recommendation: "Declare every imported @happyvertical package in the owning package manifest so downstream installs and generated knowledge stay reproducible.",
-			suggestedIssueTitle: `Declare missing HappyVertical dependencies in ${packageLabel(pkg)}`
-		}];
-	});
-}
-function findCustomManifestGeneration(sourceFiles, projectPath) {
-	return sourceFiles.filter((file) => /manifest\.json/.test(file.content) && /objects\s*:/.test(file.content) && /\b(writeFile|writeFileSync)\b/.test(file.content) && !/@happyvertical\/smrt-scanner/.test(file.content)).map((file) => ({
-		severity: "high",
-		area: "manifest",
-		code: "custom-object-manifest-generation",
-		title: "Custom SMRT object manifest generation detected",
-		evidence: [{
-			filePath: relative(projectPath, file.path),
-			line: lineNumber(file.content, "manifest.json"),
-			detail: "Writes a manifest.json object inventory outside the SMRT scanner/runtime path."
-		}],
-		recommendation: "Use the SMRT scanner/runtime manifest path so defaults, relationships, schemas, tenant fields, and cross-package references match framework behavior.",
-		suggestedIssueTitle: "Replace custom object manifest generation with SMRT scanner/runtime manifest generation"
-	}));
-}
-function findDirectStorageBypasses(sourceFiles, packages, projectPath) {
-	return sourceFiles.flatMap((file) => {
-		const owner = findOwningPackage(file.path, packages);
-		const usesFs = /from\s+['"](?:node:fs|node:fs\/promises|fs|fs\/promises)['"]|require\(['"](?:node:fs|node:fs\/promises|fs|fs\/promises)['"]\)/.test(file.content);
-		const writesDurableData = /\b(writeFile|appendFile|mkdir|rm|rename)\b/.test(file.content) && /(\.json|data|storage|persist|cache|db)/i.test(file.content);
-		const usesDirectSql = /from\s+['"](?:better-sqlite3|sqlite3|pg|mysql2?|knex|drizzle-orm)['"]/.test(file.content);
-		if ((!usesFs || !writesDurableData) && !usesDirectSql) return [];
-		if (owner.dependencies.has("@happyvertical/sql") || owner.dependencies.has("@happyvertical/files") || owner.dependencies.has("@happyvertical/smrt-assets") || owner.dependencies.has("@happyvertical/smrt-content")) return [];
-		return [{
-			severity: "medium",
-			area: "storage",
-			code: "direct-storage-bypass",
-			title: `${packageLabel(owner)} appears to bypass HappyVertical storage packages`,
-			evidence: [{
-				filePath: relative(projectPath, file.path),
-				line: lineNumber(file.content, usesDirectSql ? "sqlite" : "writeFile"),
-				detail: usesDirectSql ? "Imports a direct SQL/storage library without @happyvertical/sql." : "Uses node:fs-style durable writes without @happyvertical/files/assets/content."
-			}],
-			recommendation: "Route durable data through @happyvertical/sql, @happyvertical/files, SMRT assets, or SMRT content unless this is explicitly build-only tooling.",
-			suggestedIssueTitle: `Review direct storage usage in ${packageLabel(owner)}`
-		}];
-	});
-}
-function findCustomHttpShells(sourceFiles, packages, projectPath) {
-	const evidenceByPackage = /* @__PURE__ */ new Map();
-	for (const pkg of packages) {
-		if (pkg.dependencies.has("@sveltejs/kit")) continue;
-		const routerDependencies = [
-			"express",
-			"fastify",
-			"hono",
-			"koa"
-		].filter((dep) => pkg.dependencies.has(dep));
-		if (routerDependencies.length === 0) continue;
-		appendEvidence(evidenceByPackage, pkg, {
-			filePath: relative(projectPath, pkg.packageJsonPath),
-			detail: `Declares custom router package(s): ${routerDependencies.join(", ")}.`
-		});
-	}
-	for (const file of sourceFiles) {
-		const owner = findOwningPackage(file.path, packages);
-		if (owner.dependencies.has("@sveltejs/kit")) continue;
-		if (!/from\s+['"](?:node:http|http|node:https|https)['"]|createServer\s*\(/.test(file.content)) continue;
-		appendEvidence(evidenceByPackage, owner, {
-			filePath: relative(projectPath, file.path),
-			line: lineNumber(file.content, "createServer"),
-			detail: "Custom HTTP routing found without the SvelteKit/SMRT app-shell dependency pattern."
-		});
-	}
-	return Array.from(evidenceByPackage.entries()).map(([owner, evidence]) => ({
-		severity: "medium",
-		area: "api-shell",
-		code: "custom-http-shell",
-		title: `${packageLabel(owner)} uses a custom HTTP shell`,
-		evidence,
-		recommendation: "Compare the app shell against the Anytown/Ergot SvelteKit + SMRT shell pattern before adding custom HTTP infrastructure.",
-		suggestedIssueTitle: `Align ${packageLabel(owner)} app shell with SMRT/SvelteKit conventions`
-	}));
-}
-function appendEvidence(evidenceByPackage, pkg, evidence) {
-	const existing = evidenceByPackage.get(pkg);
-	if (existing) {
-		existing.push(evidence);
-		return;
-	}
-	evidenceByPackage.set(pkg, [evidence]);
-}
-function findLocalAuthTenancy(sourceFiles, packages, projectPath) {
-	return sourceFiles.flatMap((file) => {
-		const owner = findOwningPackage(file.path, packages);
-		const pathSignal = /(auth|tenant|audit|session|rbac|user)/i.test(file.path);
-		const codeSignal = /\b(tenantId|tenant|role|permission|session|auditLog|apiKey)\b/.test(file.content);
-		if (!pathSignal || !codeSignal) return [];
-		if (owner.dependencies.has("@happyvertical/smrt-users") || owner.dependencies.has("@happyvertical/smrt-tenancy") || owner.dependencies.has("@happyvertical/smrt-profiles")) return [];
-		return [{
-			severity: "medium",
-			area: "auth-tenancy",
-			code: "local-auth-tenancy",
-			title: `${packageLabel(owner)} contains local auth/tenancy/audit logic`,
-			evidence: [{
-				filePath: relative(projectPath, file.path),
-				line: lineNumber(file.content, "tenant"),
-				detail: "Auth, tenancy, session, role, or audit terminology appears without smrt-users/smrt-tenancy/smrt-profiles dependencies."
-			}],
-			recommendation: "Add explicit adapters to smrt-users, smrt-tenancy, and profile/audit models or document why this local implementation is intentionally isolated.",
-			suggestedIssueTitle: `Review auth and tenancy adapters in ${packageLabel(owner)}`
-		}];
-	});
-}
-function findUiShellDrift(packages, projectPath) {
-	return packages.flatMap((pkg) => {
-		if (!(pkg.sourceFiles.some((file) => file.path.endsWith(".svelte")) || /(?:web|ui|app|site|frontend)/i.test(packageLabel(pkg)) || pkg.dependencies.has("svelte") || pkg.dependencies.has("vite"))) return [];
-		if (pkg.dependencies.has("@happyvertical/smrt-svelte")) return [];
-		return [{
-			severity: "low",
-			area: "ui-shell",
-			code: "missing-smrt-svelte-shell",
-			title: `${packageLabel(pkg)} looks like UI work without @happyvertical/smrt-svelte`,
-			evidence: [{
-				filePath: relative(projectPath, pkg.packageJsonPath),
-				detail: "UI-facing package does not declare @happyvertical/smrt-svelte."
-			}],
-			recommendation: "Use @happyvertical/smrt-svelte and the SvelteKit shell pattern for downstream app UI unless this package is intentionally framework-agnostic.",
-			suggestedIssueTitle: `Check SMRT Svelte shell alignment for ${packageLabel(pkg)}`
-		}];
-	});
-}
-function findMissingManifestArtifacts(sourceFiles, packages, projectPath) {
-	return packages.flatMap((pkg) => {
-		if (!pkg.sourceFiles.some((file) => /@smrt\s*\(/.test(file.content))) return [];
-		if (sourceFiles.some((file) => file.packageDir === pkg.directory && /@happyvertical\/smrt-scanner/.test(file.content)) || pathExistsSyncHint(join(pkg.directory, ".smrt", "manifest.json")) || pathExistsSyncHint(join(pkg.directory, "dist", "manifest.json"))) return [];
-		return [{
-			severity: "low",
-			area: "manifest",
-			code: "missing-generated-manifest-artifact",
-			title: `${packageLabel(pkg)} has @smrt objects but no generated manifest artifact was found`,
-			evidence: [{
-				filePath: relative(projectPath, pkg.packageJsonPath),
-				detail: "No .smrt/manifest.json or dist/manifest.json was visible during review."
-			}],
-			recommendation: "Run the package build/test manifest generation path and verify it uses the SMRT scanner/runtime manifest pipeline.",
-			suggestedIssueTitle: `Verify SMRT manifest generation for ${packageLabel(pkg)}`
-		}];
-	});
-}
-async function visit(dir, onFile) {
-	let entries;
-	try {
-		entries = await readdir(dir, { withFileTypes: true });
-	} catch {
-		return;
-	}
-	for (const entry of entries) {
-		const fullPath = join(dir, entry.name);
-		if (entry.isDirectory()) {
-			if (SKIP_DIRS.has(entry.name)) continue;
-			await visit(fullPath, onFile);
-			continue;
-		}
-		if (entry.isFile()) await onFile(fullPath, entry.name);
-	}
-}
-function collectDependencies(packageJson) {
-	const dependencies = /* @__PURE__ */ new Set();
-	for (const sectionName of DEPENDENCY_SECTIONS) {
-		const section = packageJson[sectionName];
-		if (!isRecord$1(section)) continue;
-		for (const dependencyName of Object.keys(section)) dependencies.add(dependencyName);
-	}
-	return dependencies;
-}
-function extractImports(content) {
-	const imports = /* @__PURE__ */ new Set();
-	for (const pattern of [
-		/(?:import|export)\s+(?:type\s+)?(?:[^'"]+\s+from\s+)?['"]([^'"]+)['"]/g,
-		/\bimport\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
-		/\brequire\s*\(\s*['"]([^'"]+)['"]\s*\)/g
-	]) for (const match of content.matchAll(pattern)) {
-		const imported = normalizePackageImport(match[1]);
-		if (imported) imports.add(imported);
-	}
-	return Array.from(imports);
-}
-function normalizePackageImport(value) {
-	if (!value || value.startsWith(".") || value.startsWith("/")) return void 0;
-	if (value.startsWith("@")) {
-		const [scope, name] = value.split("/");
-		return scope && name ? `${scope}/${name}` : value;
-	}
-	return value.split("/")[0];
-}
-function findOwningPackage(filePath, packages) {
-	const normalized = resolve(filePath);
-	return packages.filter((pkg) => normalized === pkg.directory || normalized.startsWith(`${pkg.directory}${sep}`)).sort((left, right) => right.directory.length - left.directory.length)[0] ?? packages[0];
-}
-function packageInventory(pkg) {
-	const declaredHappyVerticalDependencies = Array.from(pkg.dependencies).filter((dependency) => dependency.startsWith(HAPPYVERTICAL_PACKAGE_PREFIX)).sort();
-	const importedHappyVerticalPackages = Array.from(pkg.imports.keys()).sort();
-	const ownName = typeof pkg.json.name === "string" ? pkg.json.name : void 0;
-	return {
-		name: packageLabel(pkg),
-		path: pkg.relativePath,
-		private: typeof pkg.json.private === "boolean" ? pkg.json.private : void 0,
-		scripts: Object.keys(pkg.scripts).sort(),
-		declaredHappyVerticalDependencies,
-		importedHappyVerticalPackages,
-		missingHappyVerticalDependencies: importedHappyVerticalPackages.filter((name) => name !== ownName && !pkg.dependencies.has(name)),
-		hasSvelteKit: pkg.dependencies.has("@sveltejs/kit"),
-		hasSmrtSvelte: pkg.dependencies.has("@happyvertical/smrt-svelte")
-	};
-}
-function summarizeFindings(findings) {
-	return findings.reduce((summary, finding) => {
-		summary[finding.severity]++;
-		return summary;
-	}, {
-		high: 0,
-		medium: 0,
-		low: 0
-	});
-}
-function limitFindings(findings, maxFindings) {
-	const sorted = findings.sort((left, right) => severityRank(left.severity) - severityRank(right.severity) || left.area.localeCompare(right.area) || left.title.localeCompare(right.title));
-	return maxFindings && maxFindings > 0 ? sorted.slice(0, maxFindings) : sorted;
-}
-function severityRank(severity) {
-	return severity === "high" ? 0 : severity === "medium" ? 1 : 2;
-}
-function packageLabel(pkg) {
-	return typeof pkg.json.name === "string" ? pkg.json.name : pkg.relativePath;
-}
-function lineNumber(content, needle) {
-	const index = content.indexOf(needle);
-	if (index < 0) return void 0;
-	return content.slice(0, index).split("\n").length;
-}
-function isRecord$1(value) {
-	return !!value && typeof value === "object" && !Array.isArray(value);
-}
-async function pathExists(path) {
-	try {
-		await access(path);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function pathExistsSyncHint(path) {
-	return existsSync(path);
-}
-//#endregion
 //#region src/index.ts
 /**
 * SMRT Development MCP Server
@@ -1227,7 +824,13 @@ async function mainHttp(cli) {
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
 }
-if (isEntrypoint()) {
+if (isEntrypoint()) if (process.argv[2] === "review") import("./review-cli-DJIWUlFp.js").then(({ runReviewCli }) => runReviewCli(process.argv.slice(3))).then((code) => {
+	process.exitCode = code;
+}).catch((error) => {
+	console.error(`[${SERVER_NAME}] review failed:`, error);
+	process.exit(1);
+});
+else {
 	const cli = parseHttpCliArgs(process.argv.slice(2));
 	(cli.http ? mainHttp(cli) : main()).catch((error) => {
 		console.error(`[${SERVER_NAME}] Fatal error:`, error);