@happyvertical/smrt-dev-mcp 0.60.9 → 0.60.11

package/AGENTS.md

@@ -9,7 +9,7 @@ deterministic SMRT ecosystem knowledge, and portable agent workflows.
 |------|---------|
 | `generate-smrt-class` | Generates `@smrt()` class with fields, decorator config, imports |
 | `introspect-project` | Scans project directory for SMRT objects; compact summary by default, `detail: 'full'` for field/schema/method detail |
-| `review-smrt-project` | Advisory downstream ecosystem alignment review for dependencies, storage, app shell, auth/tenancy, and manifest generation |
+| `review-smrt-project` | Advisory downstream ecosystem alignment review for dependencies, storage, app shell, auth/tenancy, manifest generation, and intent-driven hand-rolled-equivalent detection (#4690) |
 | `reflect-knowledge` | Reports deterministic SMRT + HappyVertical SDK knowledge coverage and freshness |
 | `reflect-domain-knowledge` | Reports downstream/domain artifact coverage and freshness |
 | `check-knowledge-freshness` | Runs deterministic agent-doc and stale-reference checks |
@@ -33,6 +33,14 @@ deterministic SMRT ecosystem knowledge, and portable agent workflows.
 README parameter tables to the exported `TOOLS` definitions. Add or change a
 tool schema and its authored documentation in the same commit.
 
+## Intent-driven duplicate detection (#4690)
+
+`review-smrt-project` / `smrt-dev-mcp review` flag hand-rolled equivalents of
+smrt packages from the intent index. The rules (`regex:` tokens become `RegExp`)
+come from the full index packaged in this release, never from the reviewed tree;
+`intentIndexPath` / `--intent-index` is caller-trusted. Details, token kinds and
+the CLI/workflow contract: [agents/intent-duplicates.md](agents/intent-duplicates.md).
+
 ## Knowledge Discovery (#2143)
 
 Discovery reads the workspace globs instead of assuming `<root>/packages`:
@@ -104,6 +112,18 @@ otherwise emitted docs read `/AGENTS.md` and changed-file matching compares
 against a leading `/` and selects nothing. The root owns any changed path no
 member package owns, mirroring the member-excluded scan.
 
+### OKF component pages (#4686)
+
+`pnpm knowledge:okf` (after `pnpm build`) writes `docs/knowledge/components/<unscoped-name>.md` per
+workspace package from this index; never hand-edit them. `source_revision` is a `sha256` of the page's
+inputs (manifest slice, package AGENTS/module-doc hashes, models, MCP tools, `agentSurface`), not a commit.
+`knowledge:check --strict` fails on stale, edited, missing or extra pages and on dangling `/…md` links in
+hand-authored pages. Details: header of `scripts/knowledge-okf.ts`.
+
+Consumer bundle (#4689): `okf-bundle.ts` defines the `.agents/smrt-knowledge/` contract `smrt docs:agents` writes;
+`check-knowledge-freshness` reports its age (`okf-bundle-age` info, `okf-bundle-aged` past 90 days) and flags
+`stale-okf-bundle` when a page's `package_version` no longer matches `node_modules` until `docs:agents` reruns.
+
 ## Agent Skills
 
 Bundled skills live under `skills/`, the Agent Plugins fixed discovery
@@ -115,7 +135,11 @@ Skill-aware harnesses can parse the frontmatter; other harnesses can ignore it.
   Agents should fetch it with `get-agent-skill`, then call `build-context` (`task: review`) for
   deterministic context, inspect the actual diff, and produce a findings-first
   review.
+- `skills/smrt-catalog/SKILL.md` — catalog router skill (#4708), installed into consumers by `smrt docs:agents`.
+- `skills/smrt-contribute/SKILL.md` — contributor skill (#4709) for forks of this repository; an identical copy is
+  checked in at the root `.agents/skills/smrt-contribute/SKILL.md` and a test fails on drift.
 
+Trigger evals, the registry and install contract, and the drift rule: [agents/agent-skills.md](agents/agent-skills.md).
 
 ## Project runtime prerequisite
 
@@ -157,6 +181,12 @@ server is always launched from a repo that installs the package. Prefer an
 absolute `node /path/to/node_modules/@happyvertical/smrt-dev-mcp/dist/index.js`
 launcher or a small wrapper script with an absolute Node path.
 
+This monorepo's `.mcp.json` runs `node scripts/mcp-servers/smrt-dev-mcp.mjs`:
+stdout is protocol-only, the launcher never installs or uses `pnpm exec`/`npx`
+(their stdout banner breaks stdio, #4685), and it falls back to `tsx` on `src/`
+when `dist` is missing or older, so rebuild `dist` after server edits. Guarded by
+`src/launcher-stdio.test.ts`; see [scripts/mcp-servers/README.md](../../scripts/mcp-servers/README.md).
+
 ## MCP Tier Context
 
 - **Tier 1** (Runtime): auto-generated from `@smrt()` objects — live data operations
@@ -170,6 +200,8 @@ launcher or a small wrapper script with an absolute Node path.
 - `src/agent-skills.ts` — bundled skill registry and file loader
 - `plugin.json` / `mcp.json` — Agent Plugins 1.0.0 portable root manifests
 - `skills/smrt-code-review/SKILL.md` — downstream SMRT review procedure
+- `skills/smrt-contribute/SKILL.md` — contributor skill (copy at repo-root `.agents/skills/smrt-contribute/`)
+- `skills/smrt-catalog/SKILL.md` — catalog router skill; `skills/smrt-catalog/evals.json` — its trigger eval set
 - `src/tools/generate-smrt-class.ts` — class generation logic and package-ready templates
 - `src/tools/introspect-project.ts` — manifest-first project scanning, falling back to `@happyvertical/smrt-scanner`
 - `src/dev-plane.ts` — in-app runtime dev-plane (#2782): `createDevPlane({ token, projectRoot, db })` serves JSON + MCP on one mount with loopback/bearer guards and a positive catalog (`registry-live` + the nine runtime tools); mounted by the generated `_dev/[...tool]` SvelteKit route

package/README.md

@@ -334,7 +334,8 @@ available it falls back to `@happyvertical/smrt-scanner`.
 Run an advisory downstream ecosystem review. The tool scans package manifests
 and source imports for missing HappyVertical dependencies, direct storage
 bypasses, custom HTTP shells, custom object manifest generation, local
-auth/tenancy/audit seams, and UI shell drift. It returns deterministic findings
+auth/tenancy/audit seams, UI shell drift, and hand-rolled equivalents of
+smrt packages. It returns deterministic findings
 and suggested follow-up issue titles; it does not modify files.
 
 | Parameter | Type | Required | Description |
@@ -343,6 +344,21 @@ and suggested follow-up issue titles; it does not modify files.
 | `rootDir` | `string` | No | Compatibility alias for `directory` |
 | `includeSourceEvidence` | `boolean` | No | Include file/line evidence (default: true) |
 | `maxFindings` | `number` | No | Limit findings returned |
+| `intentIndexPath` | `string` | No | Caller-trusted intent index driving duplicate detection (`regex:` tokens become `RegExp`). Default: the full index packaged in this release (`dist/knowledge/intents/index.md`), else the monorepo's `docs/knowledge/intents/index.md` in a source checkout; never read from `directory` |
+| `detectDuplicates` | `boolean` | No | Run the intent-driven hand-rolled-equivalent pass (default: true) |
+
+Duplicate detection is table-driven: each row of the intent index names home
+packages and `import:`, `call:`, `regex:` and `decimal-field:` signals. When a
+package shows a signal and imports none of the row's home packages, the tool
+emits an advisory `duplicate-detection` finding anchored at `path:line` that
+names the intent page and component pages. Unknown signal kinds are skipped
+with a stderr note. The rules are never taken from the reviewed project, so a
+pull request cannot delete them or inject a pattern; when no index can be
+found the tool reports `skipped` with a note. The same pass runs from a shell with
+`npx @happyvertical/smrt-dev-mcp review --directory . [--intent-index PATH] [--format summary]`
+(exit 2 and a stderr message when no index is found, never a silent pass) and
+from the reusable `consumer-knowledge-review.yml` workflow, which always uses
+the packaged index.
 
 ### `reflect-knowledge`
 

package/agents/agent-skills.md

@@ -0,0 +1,16 @@
+# Agent skills: catalog and contribute
+
+- `skills/smrt-catalog/SKILL.md` — router skill (#4708). Fires before infrastructure, utility, or integration
+  code in a project that depends on smrt packages; reads `.agents/smrt-knowledge/intents/index.md`, the intent
+  page, then the component page, proposes the smrt package and entry point before code, falls back to
+  `build-context` when the bundle is missing or stale, and drafts an upstream issue plus a marked temporary shim
+  when the home package lacks the behaviour. The description is the design: `skills/smrt-catalog/evals.json`
+  holds the positive/negative trigger prompts and `src/agent-skills.test.ts` asserts every positive signal class
+  is named. `smrt docs:agents` installs it into consumers (`./agent-skills` export: `getAgentSkill`,
+  `getAgentSkillsPackageVersion`).
+- `skills/smrt-contribute/SKILL.md` — contributor skill (#4709): `CONTRIBUTING.md` as a fork-PR procedure with the
+  traps that fail from outside (package-name test filter, format then lint, generated knowledge pages, PR title
+  ≤92, no changesets, `.github/` guard, fork CI approval). It deliberately omits the maintainer lifecycle.
+  The repository root checks in an identical copy at `.agents/skills/smrt-contribute/SKILL.md` so a harness
+  opening a checkout finds it without the MCP server; `src/agent-skills.test.ts` fails when they drift, so edit
+  both together. Trigger evals: `skills/smrt-contribute/evals.json`.

package/agents/intent-duplicates.md

@@ -0,0 +1,26 @@
+# Intent-driven duplicate detection (#4690)
+
+`review-smrt-project` parses the intent index at runtime
+(`intent-index.ts`, pure) and `intent-detector.ts` evaluates each row's signals;
+no intent is named in code, so a new row with signals needs no change here.
+Trust boundary: `regex:` tokens become `RegExp`, so rules are never read from the
+reviewed tree. Index lookup: `intentIndexPath` / `--intent-index` (trusted by the
+caller), else the full unfiltered index shipped in this package's
+`dist/knowledge/intents/` (`scripts/ship-knowledge-pages.mjs`, list
+`OKF_INTENT_HOME_PACKAGES`), else the monorepo `docs/knowledge/intents/index.md`
+when run from the smrt checkout. The exported consumer bundle index is filtered
+to installed packages and is not consulted. Tokens:
+`import:<module>`, `call:<ident>`, `regex:<pattern>`, and
+`decimal-field:<glob>` (a property matching the glob declared with a decimal
+literal or `type: 'decimal'`). Unknown kinds are skipped with a stderr note. A
+finding needs a signal and no import of any row home package in the same
+package; it is advisory (`area: duplicate-detection`, `file: path:line`,
+`intentPage`, `componentPages`). Fixtures live in `test-fixtures/` (outside
+`src/`, so tsc, Biome, and vitest globs never see them).
+
+`smrt-dev-mcp review --directory . [--intent-index P] [--format summary]
+[--fail-on-findings]` runs the pass from a shell (exit 2 with a stderr message when
+no index is found; the tool reports `skipped` with a note). The reusable
+`.github/workflows/consumer-knowledge-review.yml` calls it through the pinned
+published package (public on npmjs, so private consumers need no token), has no
+index input, and writes the summary to `$GITHUB_STEP_SUMMARY`.

package/dist/agent-skills.d.ts

@@ -11,6 +11,8 @@ export interface AgentSkillBundle extends AgentSkillSummary {
         content: string;
     }>;
 }
+/** Version of the smrt-dev-mcp package that ships these skills. */
+export declare function getAgentSkillsPackageVersion(): string;
 export declare function listAgentSkills(): AgentSkillSummary[];
 export declare function getAgentSkill(options: {
     name: string;

package/dist/agent-skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-skills.d.ts","sourceRoot":"","sources":["../src/agent-skills.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,KAAK,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAiBD,wBAAgB,eAAe,IAAI,iBAAiB,EAAE,CAErD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,gBAAgB,CAoBnB"}
+{"version":3,"file":"agent-skills.d.ts","sourceRoot":"","sources":["../src/agent-skills.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,KAAK,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAiCD,mEAAmE;AACnE,wBAAgB,4BAA4B,IAAI,MAAM,CAKrD;AAED,wBAAgB,eAAe,IAAI,iBAAiB,EAAE,CAErD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,gBAAgB,CAoBnB"}

package/dist/agent-skills.js

@@ -0,0 +1,61 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+//#region src/agent-skills.ts
+var AGENT_SKILLS = [
+	{
+		name: "smrt-code-review",
+		description: "Harness-agnostic downstream SMRT code review workflow using smrt-dev-mcp deterministic context and prompt bundles.",
+		path: "skills/smrt-code-review/SKILL.md",
+		skillFile: "skills/smrt-code-review/SKILL.md",
+		references: ["skills/smrt-code-review/references/review-output.md"]
+	},
+	{
+		name: "smrt-catalog",
+		description: "Router skill: before writing infrastructure, utility, or integration code in a project that depends on smrt packages, consult the smrt knowledge catalog and reuse the installed package.",
+		path: "skills/smrt-catalog/SKILL.md",
+		skillFile: "skills/smrt-catalog/SKILL.md",
+		references: []
+	},
+	{
+		name: "smrt-contribute",
+		description: "Contributor skill: the fork pull-request procedure for happyvertical/smrt (CONTRIBUTING.md as steps) for agents working in a fork or clone that is not a maintainer session.",
+		path: "skills/smrt-contribute/SKILL.md",
+		skillFile: "skills/smrt-contribute/SKILL.md",
+		references: []
+	}
+];
+/** Version of the smrt-dev-mcp package that ships these skills. */
+function getAgentSkillsPackageVersion() {
+	return JSON.parse(readPackageFile("package.json")).version ?? "0.0.0";
+}
+function listAgentSkills() {
+	return AGENT_SKILLS.map(({ skillFile: _skillFile, ...skill }) => skill);
+}
+function getAgentSkill(options) {
+	const skill = AGENT_SKILLS.find((item) => item.name === options.name);
+	if (!skill) throw new Error(`Unknown agent skill: ${options.name}`);
+	return {
+		name: skill.name,
+		description: skill.description,
+		path: skill.path,
+		references: skill.references,
+		skillMarkdown: readPackageFile(skill.skillFile),
+		referenceFiles: options.includeReferences === false ? [] : skill.references.map((path) => ({
+			path,
+			content: readPackageFile(path)
+		}))
+	};
+}
+function readPackageFile(relativePath) {
+	return readFileSync(join(resolvePackageRoot(), relativePath), "utf8");
+}
+function resolvePackageRoot() {
+	const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+	if (!existsSync(join(packageRoot, "package.json"))) throw new Error(`Unable to resolve smrt-dev-mcp package root from ${import.meta.url}`);
+	return packageRoot;
+}
+//#endregion
+export { getAgentSkill, getAgentSkillsPackageVersion, listAgentSkills };
+
+//# sourceMappingURL=agent-skills.js.map

package/dist/agent-skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-skills.js","names":[],"sources":["../src/agent-skills.ts"],"sourcesContent":["import { existsSync, readFileSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport interface AgentSkillSummary {\n  name: string;\n  description: string;\n  path: string;\n  references: string[];\n}\n\nexport interface AgentSkillBundle extends AgentSkillSummary {\n  skillMarkdown: string;\n  referenceFiles: Array<{\n    path: string;\n    content: string;\n  }>;\n}\n\ninterface AgentSkillDefinition extends AgentSkillSummary {\n  skillFile: string;\n}\n\nconst AGENT_SKILLS: AgentSkillDefinition[] = [\n  {\n    name: 'smrt-code-review',\n    description:\n      'Harness-agnostic downstream SMRT code review workflow using smrt-dev-mcp deterministic context and prompt bundles.',\n    path: 'skills/smrt-code-review/SKILL.md',\n    skillFile: 'skills/smrt-code-review/SKILL.md',\n    references: ['skills/smrt-code-review/references/review-output.md'],\n  },\n  {\n    name: 'smrt-catalog',\n    description:\n      'Router skill: before writing infrastructure, utility, or integration code in a project that depends on smrt packages, consult the smrt knowledge catalog and reuse the installed package.',\n    path: 'skills/smrt-catalog/SKILL.md',\n    skillFile: 'skills/smrt-catalog/SKILL.md',\n    references: [],\n  },\n  {\n    name: 'smrt-contribute',\n    description:\n      'Contributor skill: the fork pull-request procedure for happyvertical/smrt (CONTRIBUTING.md as steps) for agents working in a fork or clone that is not a maintainer session.',\n    path: 'skills/smrt-contribute/SKILL.md',\n    skillFile: 'skills/smrt-contribute/SKILL.md',\n    references: [],\n  },\n];\n\n/** Version of the smrt-dev-mcp package that ships these skills. */\nexport function getAgentSkillsPackageVersion(): string {\n  const manifest = JSON.parse(readPackageFile('package.json')) as {\n    version?: string;\n  };\n  return manifest.version ?? '0.0.0';\n}\n\nexport function listAgentSkills(): AgentSkillSummary[] {\n  return AGENT_SKILLS.map(({ skillFile: _skillFile, ...skill }) => skill);\n}\n\nexport function getAgentSkill(options: {\n  name: string;\n  includeReferences?: boolean;\n}): AgentSkillBundle {\n  const skill = AGENT_SKILLS.find((item) => item.name === options.name);\n  if (!skill) {\n    throw new Error(`Unknown agent skill: ${options.name}`);\n  }\n\n  return {\n    name: skill.name,\n    description: skill.description,\n    path: skill.path,\n    references: skill.references,\n    skillMarkdown: readPackageFile(skill.skillFile),\n    referenceFiles:\n      options.includeReferences === false\n        ? []\n        : skill.references.map((path) => ({\n            path,\n            content: readPackageFile(path),\n          })),\n  };\n}\n\nfunction readPackageFile(relativePath: string): string {\n  const packageRoot = resolvePackageRoot();\n  return readFileSync(join(packageRoot, relativePath), 'utf8');\n}\n\nfunction resolvePackageRoot(): string {\n  // Works in both source tests (`src/agent-skills.ts`) and built packages\n  // (`dist/agent-skills.js`); guard it so packaging layout drift fails clearly.\n  const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));\n  if (!existsSync(join(packageRoot, 'package.json'))) {\n    throw new Error(\n      `Unable to resolve smrt-dev-mcp package root from ${import.meta.url}`,\n    );\n  }\n  return packageRoot;\n}\n"],"mappings":";;;;AAuBA,IAAM,eAAuC;CAC3C;EACE,MAAM;EACN,aACE;EACF,MAAM;EACN,WAAW;EACX,YAAY,CAAC,qDAAqD;CACpE;CACA;EACE,MAAM;EACN,aACE;EACF,MAAM;EACN,WAAW;EACX,YAAY,CAAC;CACf;CACA;EACE,MAAM;EACN,aACE;EACF,MAAM;EACN,WAAW;EACX,YAAY,CAAC;CACf;AACF;;AAGA,SAAgB,+BAAuC;CAIrD,OAHiB,KAAK,MAAM,gBAAgB,cAAc,CAGnD,CAAA,CAAS,WAAW;AAC7B;AAEA,SAAgB,kBAAuC;CACrD,OAAO,aAAa,KAAK,EAAE,WAAW,YAAY,GAAG,YAAY,KAAK;AACxE;AAEA,SAAgB,cAAc,SAGT;CACnB,MAAM,QAAQ,aAAa,MAAM,SAAS,KAAK,SAAS,QAAQ,IAAI;CACpE,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,wBAAwB,QAAQ,MAAM;CAGxD,OAAO;EACL,MAAM,MAAM;EACZ,aAAa,MAAM;EACnB,MAAM,MAAM;EACZ,YAAY,MAAM;EAClB,eAAe,gBAAgB,MAAM,SAAS;EAC9C,gBACE,QAAQ,sBAAsB,QAC1B,CAAC,IACD,MAAM,WAAW,KAAK,UAAU;GAC9B;GACA,SAAS,gBAAgB,IAAI;EAC/B,EAAE;CACV;AACF;AAEA,SAAS,gBAAgB,cAA8B;CAErD,OAAO,aAAa,KADA,mBACK,GAAa,YAAY,GAAG,MAAM;AAC7D;AAEA,SAAS,qBAA6B;CAGpC,MAAM,cAAc,QAAQ,QAAQ,cAAc,OAAO,KAAK,GAAG,CAAC,CAAC;CACnE,IAAI,CAAC,WAAW,KAAK,aAAa,cAAc,CAAC,GAC/C,MAAM,IAAI,MACR,oDAAoD,OAAO,KAAK,KAClE;CAEF,OAAO;AACT"}

package/dist/dev-plane.js

@@ -1,6 +1,6 @@
 import { a as runtimeMigrationStatus, c as runtimeScheduleHealth, g as loadProjectCore, i as runtimeJobHealth, m as ProjectRuntimeResolutionError, o as runtimeRecentChanges, p as safeErrorMessage, r as runtimeDispatchHealth, s as runtimeRegistryDrift, t as RUNTIME_PROVENANCE } from "./tools-B0uaPTz0.js";
-import { i as SERVER_VERSION, r as SERVER_NAME, t as bearerMatches } from "./http-CCiO7qQW.js";
-import { n as TOOLS } from "./tool-catalog-RHq7nyCm.js";
+import { i as SERVER_VERSION, r as SERVER_NAME, t as bearerMatches } from "./http-BqKiyqgN.js";
+import { n as TOOLS } from "./tool-catalog-BhnSCF8g.js";
 import { i as runtimeSchemaDiff, n as runtimeObject, r as runtimeRegistry } from "./observation-DbB4z-9t.js";
 import { Server, createMcpHandler } from "@modelcontextprotocol/server";
 //#region src/dev-plane.ts

package/dist/{http-CCiO7qQW.js → http-BqKiyqgN.js}

@@ -1,5 +1,5 @@
 import { a as runtimeMigrationStatus, c as runtimeScheduleHealth, i as runtimeJobHealth, o as runtimeRecentChanges, r as runtimeDispatchHealth, s as runtimeRegistryDrift } from "./tools-B0uaPTz0.js";
-import { n as TOOLS } from "./tool-catalog-RHq7nyCm.js";
+import { n as TOOLS } from "./tool-catalog-BhnSCF8g.js";
 import { a as bootRuntime, i as runtimeSchemaDiff, n as runtimeObject, r as runtimeRegistry } from "./observation-DbB4z-9t.js";
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -166,4 +166,4 @@ async function startRuntimeHttpHost(options = {}) {
 //#endregion
 export { SERVER_VERSION as i, startRuntimeHttpHost as n, SERVER_NAME as r, bearerMatches as t };
 
-//# sourceMappingURL=http-CCiO7qQW.js.map
+//# sourceMappingURL=http-BqKiyqgN.js.map

package/dist/{http-CCiO7qQW.js.map → http-BqKiyqgN.js.map}

@@ -1 +1 @@
-{"version":3,"file":"http-CCiO7qQW.js","names":[],"sources":["../src/server-info.ts","../src/http.ts"],"sourcesContent":["import { readFileSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const SERVER_NAME = 'smrt-dev-mcp';\n\nfunction readPackageVersion(): string {\n  try {\n    const packageRoot = dirname(fileURLToPath(import.meta.url));\n    const packageJsonPath = join(packageRoot, '..', 'package.json');\n    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8')) as {\n      version?: unknown;\n    };\n    return typeof packageJson.version === 'string'\n      ? packageJson.version\n      : '0.0.0';\n  } catch {\n    return '0.0.0';\n  }\n}\n\nexport const SERVER_VERSION = readPackageVersion();\n","/**\n * Standalone Level 2 runtime dev-plane host (#1831).\n *\n * Serves a *positive* read-only tool catalog over the stateless 2026-07-28\n * Streamable HTTP transport (#2147): `createMcpHandler` with `legacy: 'reject'`\n * and `maxSubscriptions: 0`, adapted to Node with `toNodeHandler`. No SSE,\n * no session header, no sticky routing.\n *\n * Security boundary (development only):\n * - binds loopback only; SDK localhost Host/Origin validation runs first;\n * - every request needs `Authorization: Bearer <token>` (constant-time\n *   compare) — from `SMRT_DEV_MCP_TOKEN` or minted per process;\n * - no authenticated principal exists here, so scope stays fail-closed\n *   global-only exactly as in Level 1;\n * - the catalog never includes generated CRUD, custom actions, `do()`, or\n *   tool-backed `is()`.\n */\n\nimport { randomBytes, timingSafeEqual } from 'node:crypto';\nimport {\n  createServer as createHttpServer,\n  type Server as HttpServer,\n  type IncomingMessage,\n  type ServerResponse,\n} from 'node:http';\nimport type { AddressInfo } from 'node:net';\nimport {\n  localhostHostValidation,\n  localhostOriginValidation,\n  toNodeHandler,\n} from '@modelcontextprotocol/node';\nimport type { CallToolResult } from '@modelcontextprotocol/server';\nimport { createMcpHandler, Server } from '@modelcontextprotocol/server';\nimport { SERVER_NAME, SERVER_VERSION } from './server-info.js';\nimport { TOOLS } from './tool-catalog.js';\nimport { bootRuntime, type RuntimeBoot } from './tools/runtime/boot.js';\nimport {\n  runtimeObject,\n  runtimeRegistry,\n  runtimeSchemaDiff,\n} from './tools/runtime/observation.js';\nimport {\n  runtimeDispatchHealth,\n  runtimeJobHealth,\n  runtimeMigrationStatus,\n  runtimeRecentChanges,\n  runtimeRegistryDrift,\n  runtimeScheduleHealth,\n} from './tools/runtime/tools.js';\n\n/**\n * The complete Level 2 catalog. A tool is exposed over HTTP only if it is\n * named here; the static stdio catalog is deliberately not mounted.\n */\nexport const RUNTIME_HTTP_TOOL_NAMES = [\n  'runtime-registry',\n  'runtime-object',\n  'runtime-schema-diff',\n  'migration-status',\n  'job-health',\n  'schedule-health',\n  'dispatch-health',\n  'recent-changes',\n  'registry-drift',\n] as const;\n\nexport type RuntimeHttpToolName = (typeof RUNTIME_HTTP_TOOL_NAMES)[number];\n\nconst RUNTIME_HTTP_HANDLERS: Record<\n  RuntimeHttpToolName,\n  (args: Record<string, unknown>) => Promise<unknown>\n> = {\n  'runtime-registry': (args) => runtimeRegistry(args as never),\n  'runtime-object': (args) => runtimeObject(args as never),\n  'runtime-schema-diff': (args) => runtimeSchemaDiff(args as never),\n  'migration-status': (args) => runtimeMigrationStatus(args as never),\n  'job-health': (args) => runtimeJobHealth(args as never),\n  'schedule-health': (args) => runtimeScheduleHealth(args as never),\n  'dispatch-health': (args) => runtimeDispatchHealth(args as never),\n  'recent-changes': (args) => runtimeRecentChanges(args as never),\n  'registry-drift': (args) => runtimeRegistryDrift(args as never),\n};\n\n/** Catalog definitions for the HTTP plane, in catalog order. */\nexport function runtimeHttpTools() {\n  const names = new Set<string>(RUNTIME_HTTP_TOOL_NAMES);\n  return TOOLS.filter((tool) => names.has(tool.name));\n}\n\n/**\n * Build a fresh protocol server per request (stateless transport contract).\n * `projectRoot` is fixed at host start; per-request `projectPath` arguments\n * are ignored so a client cannot re-point the booted process.\n */\nexport function createRuntimeProtocolServer(projectRoot: string): Server {\n  const server = new Server(\n    { name: `${SERVER_NAME}-runtime`, version: SERVER_VERSION },\n    { capabilities: { tools: {} } },\n  );\n  server.setRequestHandler('tools/list', async () => ({\n    tools: runtimeHttpTools(),\n  }));\n  server.setRequestHandler('tools/call', async (request) => {\n    const name = request.params.name as string;\n    const handler = (RUNTIME_HTTP_HANDLERS as Record<string, unknown>)[name];\n    if (typeof handler !== 'function') {\n      throw new Error(`Unknown runtime tool: ${name}`);\n    }\n    const { projectPath: _ignored, ...args } = (request.params.arguments ??\n      {}) as Record<string, unknown>;\n    const result = await (\n      handler as (a: Record<string, unknown>) => Promise<unknown>\n    )({ ...args, projectPath: projectRoot });\n    const text = JSON.stringify(result, null, 2);\n    return {\n      content: [{ type: 'text', text }],\n      structuredContent: result as Record<string, unknown>,\n    } satisfies CallToolResult;\n  });\n  return server;\n}\n\nexport interface RuntimeHttpHostOptions {\n  projectRoot?: string;\n  /** Loopback interface only; anything else is refused at startup. */\n  host?: '127.0.0.1' | 'localhost' | '::1';\n  /** `0` (default) picks a free port. */\n  port?: number;\n  /** Bearer token; defaults to `SMRT_DEV_MCP_TOKEN` or a per-process random token. */\n  token?: string;\n  /** Path the MCP endpoint is mounted on (default `/mcp`). */\n  path?: string;\n}\n\nexport interface RuntimeHttpHost {\n  url: string;\n  token: string;\n  boot: RuntimeBoot;\n  close(): Promise<void>;\n}\n\nconst LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1']);\n\nexport function bearerMatches(\n  header: string | undefined,\n  token: string,\n): boolean {\n  if (!header?.startsWith('Bearer ')) return false;\n  const presented = Buffer.from(header.slice('Bearer '.length));\n  const expected = Buffer.from(token);\n  return (\n    presented.length === expected.length && timingSafeEqual(presented, expected)\n  );\n}\n\nfunction deny(res: ServerResponse, status: number, message: string): void {\n  res.statusCode = status;\n  res.setHeader('content-type', 'application/json');\n  if (status === 401) {\n    res.setHeader('www-authenticate', 'Bearer realm=\"smrt-dev-mcp runtime\"');\n  }\n  res.end(JSON.stringify({ error: message }));\n}\n\n/** Start the Level 2 host. Boots the confined runtime before listening. */\nexport async function startRuntimeHttpHost(\n  options: RuntimeHttpHostOptions = {},\n): Promise<RuntimeHttpHost> {\n  const host = options.host ?? '127.0.0.1';\n  if (!LOOPBACK_HOSTS.has(host)) {\n    throw new Error(\n      'The runtime dev-plane binds loopback only (127.0.0.1, localhost, ::1).',\n    );\n  }\n  const path = options.path ?? '/mcp';\n  const token =\n    options.token ??\n    process.env.SMRT_DEV_MCP_TOKEN?.trim() ??\n    randomBytes(24).toString('base64url');\n  if (!token) {\n    throw new Error('SMRT_DEV_MCP_TOKEN must not be empty.');\n  }\n  const projectRoot = options.projectRoot ?? process.cwd();\n  const boot = await bootRuntime({ projectRoot });\n\n  const mcp = toNodeHandler(\n    createMcpHandler(() => createRuntimeProtocolServer(projectRoot), {\n      legacy: 'reject',\n      maxSubscriptions: 0,\n    }),\n  );\n  const hostGuard = localhostHostValidation();\n  const originGuard = localhostOriginValidation();\n\n  const httpServer: HttpServer = createHttpServer(\n    (req: IncomingMessage, res: ServerResponse) => {\n      // Guards answer and end the response themselves when they return false.\n      if (!hostGuard(req, res)) return;\n      if (!originGuard(req, res)) return;\n      const url = new URL(req.url ?? '/', 'http://localhost');\n      if (url.pathname !== path) {\n        deny(res, 404, 'not found');\n        return;\n      }\n      if (!bearerMatches(req.headers.authorization, token)) {\n        deny(res, 401, 'missing or invalid bearer token');\n        return;\n      }\n      void mcp(req, res);\n    },\n  );\n\n  await new Promise<void>((resolve, reject) => {\n    httpServer.once('error', reject);\n    httpServer.listen(options.port ?? 0, host, () => {\n      httpServer.off('error', reject);\n      resolve();\n    });\n  });\n  const address = httpServer.address() as AddressInfo;\n  const urlHost =\n    address.family === 'IPv6' ? `[${address.address}]` : address.address;\n  return {\n    url: `http://${urlHost}:${address.port}${path}`,\n    token,\n    boot,\n    close: () =>\n      new Promise<void>((resolve, reject) => {\n        httpServer.closeAllConnections?.();\n        httpServer.close((error) => (error ? reject(error) : resolve()));\n      }),\n  };\n}\n"],"mappings":";;;;;;;;;;;AAIA,IAAa,cAAc;AAE3B,SAAS,qBAA6B;CACpC,IAAI;EAEF,MAAM,kBAAkB,KADJ,QAAQ,cAAc,OAAO,KAAK,GAAG,CAC5B,GAAa,MAAM,cAAc;EAC9D,MAAM,cAAc,KAAK,MAAM,aAAa,iBAAiB,OAAO,CAAC;EAGrE,OAAO,OAAO,YAAY,YAAY,WAClC,YAAY,UACZ;CACN,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,iBAAiB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;ACiCjD,IAAa,0BAA0B;CACrC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAIA,IAAM,wBAGF;CACF,qBAAqB,SAAS,gBAAgB,IAAa;CAC3D,mBAAmB,SAAS,cAAc,IAAa;CACvD,wBAAwB,SAAS,kBAAkB,IAAa;CAChE,qBAAqB,SAAS,uBAAuB,IAAa;CAClE,eAAe,SAAS,iBAAiB,IAAa;CACtD,oBAAoB,SAAS,sBAAsB,IAAa;CAChE,oBAAoB,SAAS,sBAAsB,IAAa;CAChE,mBAAmB,SAAS,qBAAqB,IAAa;CAC9D,mBAAmB,SAAS,qBAAqB,IAAa;AAChE;;AAGA,SAAgB,mBAAmB;CACjC,MAAM,QAAQ,IAAI,IAAY,uBAAuB;CACrD,OAAO,MAAM,QAAQ,SAAS,MAAM,IAAI,KAAK,IAAI,CAAC;AACpD;;;;;;AAOA,SAAgB,4BAA4B,aAA6B;CACvE,MAAM,SAAS,IAAI,OACjB;EAAE,MAAM,GAAG,YAAY;EAAW,SAAS;CAAe,GAC1D,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE,CAChC;CACA,OAAO,kBAAkB,cAAc,aAAa,EAClD,OAAO,iBAAiB,EAC1B,EAAE;CACF,OAAO,kBAAkB,cAAc,OAAO,YAAY;EACxD,MAAM,OAAO,QAAQ,OAAO;EAC5B,MAAM,UAAW,sBAAkD;EACnE,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MAAM,yBAAyB,MAAM;EAEjD,MAAM,EAAE,aAAa,UAAU,GAAG,SAAU,QAAQ,OAAO,aACzD,CAAC;EACH,MAAM,SAAS,MACb,QACA;GAAE,GAAG;GAAM,aAAa;EAAY,CAAC;EAEvC,OAAO;GACL,SAAS,CAAC;IAAE,MAAM;IAAQ,MAFf,KAAK,UAAU,QAAQ,MAAM,CAEd;GAAK,CAAC;GAChC,mBAAmB;EACrB;CACF,CAAC;CACD,OAAO;AACT;AAqBA,IAAM,iCAAiB,IAAI,IAAI;CAAC;CAAa;CAAa;AAAK,CAAC;AAEhE,SAAgB,cACd,QACA,OACS;CACT,IAAI,CAAC,QAAQ,WAAW,SAAS,GAAG,OAAO;CAC3C,MAAM,YAAY,OAAO,KAAK,OAAO,MAAM,CAAgB,CAAC;CAC5D,MAAM,WAAW,OAAO,KAAK,KAAK;CAClC,OACE,UAAU,WAAW,SAAS,UAAU,gBAAgB,WAAW,QAAQ;AAE/E;AAEA,SAAS,KAAK,KAAqB,QAAgB,SAAuB;CACxE,IAAI,aAAa;CACjB,IAAI,UAAU,gBAAgB,kBAAkB;CAChD,IAAI,WAAW,KACb,IAAI,UAAU,oBAAoB,uCAAqC;CAEzE,IAAI,IAAI,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC,CAAC;AAC5C;;AAGA,eAAsB,qBACpB,UAAkC,CAAC,GACT;CAC1B,MAAM,OAAO,QAAQ,QAAQ;CAC7B,IAAI,CAAC,eAAe,IAAI,IAAI,GAC1B,MAAM,IAAI,MACR,wEACF;CAEF,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,QACJ,QAAQ,SACR,QAAQ,IAAI,oBAAoB,KAAK,KACrC,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACtC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,uCAAuC;CAEzD,MAAM,cAAc,QAAQ,eAAe,QAAQ,IAAI;CACvD,MAAM,OAAO,MAAM,YAAY,EAAE,YAAY,CAAC;CAE9C,MAAM,MAAM,cACV,uBAAuB,4BAA4B,WAAW,GAAG;EAC/D,QAAQ;EACR,kBAAkB;CACpB,CAAC,CACH;CACA,MAAM,YAAY,wBAAwB;CAC1C,MAAM,cAAc,0BAA0B;CAE9C,MAAM,aAAyB,cAC5B,KAAsB,QAAwB;EAE7C,IAAI,CAAC,UAAU,KAAK,GAAG,GAAG;EAC1B,IAAI,CAAC,YAAY,KAAK,GAAG,GAAG;EAE5B,IAAI,IADY,IAAI,IAAI,OAAO,KAAK,kBAChC,CAAA,CAAI,aAAa,MAAM;GACzB,KAAK,KAAK,KAAK,WAAW;GAC1B;EACF;EACA,IAAI,CAAC,cAAc,IAAI,QAAQ,eAAe,KAAK,GAAG;GACpD,KAAK,KAAK,KAAK,iCAAiC;GAChD;EACF;EACA,IAAS,KAAK,GAAG;CACnB,CACF;CAEA,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,WAAW,KAAK,SAAS,MAAM;EAC/B,WAAW,OAAO,QAAQ,QAAQ,GAAG,YAAY;GAC/C,WAAW,IAAI,SAAS,MAAM;GAC9B,QAAQ;EACV,CAAC;CACH,CAAC;CACD,MAAM,UAAU,WAAW,QAAQ;CAGnC,OAAO;EACL,KAAK,UAFL,QAAQ,WAAW,SAAS,IAAI,QAAQ,QAAQ,KAAK,QAAQ,QAEtC,GAAG,QAAQ,OAAO;EACzC;EACA;EACA,aACE,IAAI,SAAe,SAAS,WAAW;GACrC,WAAW,sBAAsB;GACjC,WAAW,OAAO,UAAW,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAE;EACjE,CAAC;CACL;AACF"}
+{"version":3,"file":"http-BqKiyqgN.js","names":[],"sources":["../src/server-info.ts","../src/http.ts"],"sourcesContent":["import { readFileSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport const SERVER_NAME = 'smrt-dev-mcp';\n\nfunction readPackageVersion(): string {\n  try {\n    const packageRoot = dirname(fileURLToPath(import.meta.url));\n    const packageJsonPath = join(packageRoot, '..', 'package.json');\n    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf-8')) as {\n      version?: unknown;\n    };\n    return typeof packageJson.version === 'string'\n      ? packageJson.version\n      : '0.0.0';\n  } catch {\n    return '0.0.0';\n  }\n}\n\nexport const SERVER_VERSION = readPackageVersion();\n","/**\n * Standalone Level 2 runtime dev-plane host (#1831).\n *\n * Serves a *positive* read-only tool catalog over the stateless 2026-07-28\n * Streamable HTTP transport (#2147): `createMcpHandler` with `legacy: 'reject'`\n * and `maxSubscriptions: 0`, adapted to Node with `toNodeHandler`. No SSE,\n * no session header, no sticky routing.\n *\n * Security boundary (development only):\n * - binds loopback only; SDK localhost Host/Origin validation runs first;\n * - every request needs `Authorization: Bearer <token>` (constant-time\n *   compare) — from `SMRT_DEV_MCP_TOKEN` or minted per process;\n * - no authenticated principal exists here, so scope stays fail-closed\n *   global-only exactly as in Level 1;\n * - the catalog never includes generated CRUD, custom actions, `do()`, or\n *   tool-backed `is()`.\n */\n\nimport { randomBytes, timingSafeEqual } from 'node:crypto';\nimport {\n  createServer as createHttpServer,\n  type Server as HttpServer,\n  type IncomingMessage,\n  type ServerResponse,\n} from 'node:http';\nimport type { AddressInfo } from 'node:net';\nimport {\n  localhostHostValidation,\n  localhostOriginValidation,\n  toNodeHandler,\n} from '@modelcontextprotocol/node';\nimport type { CallToolResult } from '@modelcontextprotocol/server';\nimport { createMcpHandler, Server } from '@modelcontextprotocol/server';\nimport { SERVER_NAME, SERVER_VERSION } from './server-info.js';\nimport { TOOLS } from './tool-catalog.js';\nimport { bootRuntime, type RuntimeBoot } from './tools/runtime/boot.js';\nimport {\n  runtimeObject,\n  runtimeRegistry,\n  runtimeSchemaDiff,\n} from './tools/runtime/observation.js';\nimport {\n  runtimeDispatchHealth,\n  runtimeJobHealth,\n  runtimeMigrationStatus,\n  runtimeRecentChanges,\n  runtimeRegistryDrift,\n  runtimeScheduleHealth,\n} from './tools/runtime/tools.js';\n\n/**\n * The complete Level 2 catalog. A tool is exposed over HTTP only if it is\n * named here; the static stdio catalog is deliberately not mounted.\n */\nexport const RUNTIME_HTTP_TOOL_NAMES = [\n  'runtime-registry',\n  'runtime-object',\n  'runtime-schema-diff',\n  'migration-status',\n  'job-health',\n  'schedule-health',\n  'dispatch-health',\n  'recent-changes',\n  'registry-drift',\n] as const;\n\nexport type RuntimeHttpToolName = (typeof RUNTIME_HTTP_TOOL_NAMES)[number];\n\nconst RUNTIME_HTTP_HANDLERS: Record<\n  RuntimeHttpToolName,\n  (args: Record<string, unknown>) => Promise<unknown>\n> = {\n  'runtime-registry': (args) => runtimeRegistry(args as never),\n  'runtime-object': (args) => runtimeObject(args as never),\n  'runtime-schema-diff': (args) => runtimeSchemaDiff(args as never),\n  'migration-status': (args) => runtimeMigrationStatus(args as never),\n  'job-health': (args) => runtimeJobHealth(args as never),\n  'schedule-health': (args) => runtimeScheduleHealth(args as never),\n  'dispatch-health': (args) => runtimeDispatchHealth(args as never),\n  'recent-changes': (args) => runtimeRecentChanges(args as never),\n  'registry-drift': (args) => runtimeRegistryDrift(args as never),\n};\n\n/** Catalog definitions for the HTTP plane, in catalog order. */\nexport function runtimeHttpTools() {\n  const names = new Set<string>(RUNTIME_HTTP_TOOL_NAMES);\n  return TOOLS.filter((tool) => names.has(tool.name));\n}\n\n/**\n * Build a fresh protocol server per request (stateless transport contract).\n * `projectRoot` is fixed at host start; per-request `projectPath` arguments\n * are ignored so a client cannot re-point the booted process.\n */\nexport function createRuntimeProtocolServer(projectRoot: string): Server {\n  const server = new Server(\n    { name: `${SERVER_NAME}-runtime`, version: SERVER_VERSION },\n    { capabilities: { tools: {} } },\n  );\n  server.setRequestHandler('tools/list', async () => ({\n    tools: runtimeHttpTools(),\n  }));\n  server.setRequestHandler('tools/call', async (request) => {\n    const name = request.params.name as string;\n    const handler = (RUNTIME_HTTP_HANDLERS as Record<string, unknown>)[name];\n    if (typeof handler !== 'function') {\n      throw new Error(`Unknown runtime tool: ${name}`);\n    }\n    const { projectPath: _ignored, ...args } = (request.params.arguments ??\n      {}) as Record<string, unknown>;\n    const result = await (\n      handler as (a: Record<string, unknown>) => Promise<unknown>\n    )({ ...args, projectPath: projectRoot });\n    const text = JSON.stringify(result, null, 2);\n    return {\n      content: [{ type: 'text', text }],\n      structuredContent: result as Record<string, unknown>,\n    } satisfies CallToolResult;\n  });\n  return server;\n}\n\nexport interface RuntimeHttpHostOptions {\n  projectRoot?: string;\n  /** Loopback interface only; anything else is refused at startup. */\n  host?: '127.0.0.1' | 'localhost' | '::1';\n  /** `0` (default) picks a free port. */\n  port?: number;\n  /** Bearer token; defaults to `SMRT_DEV_MCP_TOKEN` or a per-process random token. */\n  token?: string;\n  /** Path the MCP endpoint is mounted on (default `/mcp`). */\n  path?: string;\n}\n\nexport interface RuntimeHttpHost {\n  url: string;\n  token: string;\n  boot: RuntimeBoot;\n  close(): Promise<void>;\n}\n\nconst LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1']);\n\nexport function bearerMatches(\n  header: string | undefined,\n  token: string,\n): boolean {\n  if (!header?.startsWith('Bearer ')) return false;\n  const presented = Buffer.from(header.slice('Bearer '.length));\n  const expected = Buffer.from(token);\n  return (\n    presented.length === expected.length && timingSafeEqual(presented, expected)\n  );\n}\n\nfunction deny(res: ServerResponse, status: number, message: string): void {\n  res.statusCode = status;\n  res.setHeader('content-type', 'application/json');\n  if (status === 401) {\n    res.setHeader('www-authenticate', 'Bearer realm=\"smrt-dev-mcp runtime\"');\n  }\n  res.end(JSON.stringify({ error: message }));\n}\n\n/** Start the Level 2 host. Boots the confined runtime before listening. */\nexport async function startRuntimeHttpHost(\n  options: RuntimeHttpHostOptions = {},\n): Promise<RuntimeHttpHost> {\n  const host = options.host ?? '127.0.0.1';\n  if (!LOOPBACK_HOSTS.has(host)) {\n    throw new Error(\n      'The runtime dev-plane binds loopback only (127.0.0.1, localhost, ::1).',\n    );\n  }\n  const path = options.path ?? '/mcp';\n  const token =\n    options.token ??\n    process.env.SMRT_DEV_MCP_TOKEN?.trim() ??\n    randomBytes(24).toString('base64url');\n  if (!token) {\n    throw new Error('SMRT_DEV_MCP_TOKEN must not be empty.');\n  }\n  const projectRoot = options.projectRoot ?? process.cwd();\n  const boot = await bootRuntime({ projectRoot });\n\n  const mcp = toNodeHandler(\n    createMcpHandler(() => createRuntimeProtocolServer(projectRoot), {\n      legacy: 'reject',\n      maxSubscriptions: 0,\n    }),\n  );\n  const hostGuard = localhostHostValidation();\n  const originGuard = localhostOriginValidation();\n\n  const httpServer: HttpServer = createHttpServer(\n    (req: IncomingMessage, res: ServerResponse) => {\n      // Guards answer and end the response themselves when they return false.\n      if (!hostGuard(req, res)) return;\n      if (!originGuard(req, res)) return;\n      const url = new URL(req.url ?? '/', 'http://localhost');\n      if (url.pathname !== path) {\n        deny(res, 404, 'not found');\n        return;\n      }\n      if (!bearerMatches(req.headers.authorization, token)) {\n        deny(res, 401, 'missing or invalid bearer token');\n        return;\n      }\n      void mcp(req, res);\n    },\n  );\n\n  await new Promise<void>((resolve, reject) => {\n    httpServer.once('error', reject);\n    httpServer.listen(options.port ?? 0, host, () => {\n      httpServer.off('error', reject);\n      resolve();\n    });\n  });\n  const address = httpServer.address() as AddressInfo;\n  const urlHost =\n    address.family === 'IPv6' ? `[${address.address}]` : address.address;\n  return {\n    url: `http://${urlHost}:${address.port}${path}`,\n    token,\n    boot,\n    close: () =>\n      new Promise<void>((resolve, reject) => {\n        httpServer.closeAllConnections?.();\n        httpServer.close((error) => (error ? reject(error) : resolve()));\n      }),\n  };\n}\n"],"mappings":";;;;;;;;;;;AAIA,IAAa,cAAc;AAE3B,SAAS,qBAA6B;CACpC,IAAI;EAEF,MAAM,kBAAkB,KADJ,QAAQ,cAAc,OAAO,KAAK,GAAG,CAC5B,GAAa,MAAM,cAAc;EAC9D,MAAM,cAAc,KAAK,MAAM,aAAa,iBAAiB,OAAO,CAAC;EAGrE,OAAO,OAAO,YAAY,YAAY,WAClC,YAAY,UACZ;CACN,QAAQ;EACN,OAAO;CACT;AACF;AAEA,IAAa,iBAAiB,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;ACiCjD,IAAa,0BAA0B;CACrC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAIA,IAAM,wBAGF;CACF,qBAAqB,SAAS,gBAAgB,IAAa;CAC3D,mBAAmB,SAAS,cAAc,IAAa;CACvD,wBAAwB,SAAS,kBAAkB,IAAa;CAChE,qBAAqB,SAAS,uBAAuB,IAAa;CAClE,eAAe,SAAS,iBAAiB,IAAa;CACtD,oBAAoB,SAAS,sBAAsB,IAAa;CAChE,oBAAoB,SAAS,sBAAsB,IAAa;CAChE,mBAAmB,SAAS,qBAAqB,IAAa;CAC9D,mBAAmB,SAAS,qBAAqB,IAAa;AAChE;;AAGA,SAAgB,mBAAmB;CACjC,MAAM,QAAQ,IAAI,IAAY,uBAAuB;CACrD,OAAO,MAAM,QAAQ,SAAS,MAAM,IAAI,KAAK,IAAI,CAAC;AACpD;;;;;;AAOA,SAAgB,4BAA4B,aAA6B;CACvE,MAAM,SAAS,IAAI,OACjB;EAAE,MAAM,GAAG,YAAY;EAAW,SAAS;CAAe,GAC1D,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE,CAChC;CACA,OAAO,kBAAkB,cAAc,aAAa,EAClD,OAAO,iBAAiB,EAC1B,EAAE;CACF,OAAO,kBAAkB,cAAc,OAAO,YAAY;EACxD,MAAM,OAAO,QAAQ,OAAO;EAC5B,MAAM,UAAW,sBAAkD;EACnE,IAAI,OAAO,YAAY,YACrB,MAAM,IAAI,MAAM,yBAAyB,MAAM;EAEjD,MAAM,EAAE,aAAa,UAAU,GAAG,SAAU,QAAQ,OAAO,aACzD,CAAC;EACH,MAAM,SAAS,MACb,QACA;GAAE,GAAG;GAAM,aAAa;EAAY,CAAC;EAEvC,OAAO;GACL,SAAS,CAAC;IAAE,MAAM;IAAQ,MAFf,KAAK,UAAU,QAAQ,MAAM,CAEd;GAAK,CAAC;GAChC,mBAAmB;EACrB;CACF,CAAC;CACD,OAAO;AACT;AAqBA,IAAM,iCAAiB,IAAI,IAAI;CAAC;CAAa;CAAa;AAAK,CAAC;AAEhE,SAAgB,cACd,QACA,OACS;CACT,IAAI,CAAC,QAAQ,WAAW,SAAS,GAAG,OAAO;CAC3C,MAAM,YAAY,OAAO,KAAK,OAAO,MAAM,CAAgB,CAAC;CAC5D,MAAM,WAAW,OAAO,KAAK,KAAK;CAClC,OACE,UAAU,WAAW,SAAS,UAAU,gBAAgB,WAAW,QAAQ;AAE/E;AAEA,SAAS,KAAK,KAAqB,QAAgB,SAAuB;CACxE,IAAI,aAAa;CACjB,IAAI,UAAU,gBAAgB,kBAAkB;CAChD,IAAI,WAAW,KACb,IAAI,UAAU,oBAAoB,uCAAqC;CAEzE,IAAI,IAAI,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC,CAAC;AAC5C;;AAGA,eAAsB,qBACpB,UAAkC,CAAC,GACT;CAC1B,MAAM,OAAO,QAAQ,QAAQ;CAC7B,IAAI,CAAC,eAAe,IAAI,IAAI,GAC1B,MAAM,IAAI,MACR,wEACF;CAEF,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,QACJ,QAAQ,SACR,QAAQ,IAAI,oBAAoB,KAAK,KACrC,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACtC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,uCAAuC;CAEzD,MAAM,cAAc,QAAQ,eAAe,QAAQ,IAAI;CACvD,MAAM,OAAO,MAAM,YAAY,EAAE,YAAY,CAAC;CAE9C,MAAM,MAAM,cACV,uBAAuB,4BAA4B,WAAW,GAAG;EAC/D,QAAQ;EACR,kBAAkB;CACpB,CAAC,CACH;CACA,MAAM,YAAY,wBAAwB;CAC1C,MAAM,cAAc,0BAA0B;CAE9C,MAAM,aAAyB,cAC5B,KAAsB,QAAwB;EAE7C,IAAI,CAAC,UAAU,KAAK,GAAG,GAAG;EAC1B,IAAI,CAAC,YAAY,KAAK,GAAG,GAAG;EAE5B,IAAI,IADY,IAAI,IAAI,OAAO,KAAK,kBAChC,CAAA,CAAI,aAAa,MAAM;GACzB,KAAK,KAAK,KAAK,WAAW;GAC1B;EACF;EACA,IAAI,CAAC,cAAc,IAAI,QAAQ,eAAe,KAAK,GAAG;GACpD,KAAK,KAAK,KAAK,iCAAiC;GAChD;EACF;EACA,IAAS,KAAK,GAAG;CACnB,CACF;CAEA,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,WAAW,KAAK,SAAS,MAAM;EAC/B,WAAW,OAAO,QAAQ,QAAQ,GAAG,YAAY;GAC/C,WAAW,IAAI,SAAS,MAAM;GAC9B,QAAQ;EACV,CAAC;CACH,CAAC;CACD,MAAM,UAAU,WAAW,QAAQ;CAGnC,OAAO;EACL,KAAK,UAFL,QAAQ,WAAW,SAAS,IAAI,QAAQ,QAAQ,KAAK,QAAQ,QAEtC,GAAG,QAAQ,OAAO;EACzC;EACA;EACA,aACE,IAAI,SAAe,SAAS,WAAW;GACrC,WAAW,sBAAsB;GACjC,WAAW,OAAO,UAAW,QAAQ,OAAO,KAAK,IAAI,QAAQ,CAAE;EACjE,CAAC;CACL;AACF"}