@openfairygui/mcp 0.3.0 → 0.3.1

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { a as OPENFAIRYGUI_BACKEND_TOOL_OUTPUT_SCHEMA, c as OPENFAIRYGUI_BACKEND_CAPABILITIES_RESOURCE_URI, d as OPENFAIRYGUI_BACKEND_PROMPT_NAMES, i as OPENFAIRYGUI_BACKEND_TOOL_NAMES, l as OPENFAIRYGUI_BACKEND_RESOURCE_TEMPLATES, n as createOpenFairyGuiMcpServer, o as OPENFAIRYGUI_BACKEND_TOOL_PREFIX, r as OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS, s as callOpenFairyGuiBackendTool, t as connectOpenFairyGuiMcpStdio, u as OPENFAIRYGUI_BACKEND_PROMPT_DEFINITIONS } from "./stdio-48jCJzS3.mjs";
+import { a as OPENFAIRYGUI_BACKEND_TOOL_NAMES, c as OPENFAIRYGUI_BACKEND_CAPABILITIES_RESOURCE_URI, d as OPENFAIRYGUI_BACKEND_PROMPT_NAMES, i as OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS, l as OPENFAIRYGUI_BACKEND_RESOURCE_TEMPLATES, n as createOpenFairyGuiMcpServer, o as OPENFAIRYGUI_BACKEND_TOOL_OUTPUT_SCHEMA, r as callOpenFairyGuiBackendTool, s as OPENFAIRYGUI_BACKEND_TOOL_PREFIX, t as connectOpenFairyGuiMcpStdio, u as OPENFAIRYGUI_BACKEND_PROMPT_DEFINITIONS } from "./stdio-HOHWH0x4.mjs";
 export { OPENFAIRYGUI_BACKEND_CAPABILITIES_RESOURCE_URI, OPENFAIRYGUI_BACKEND_PROMPT_DEFINITIONS, OPENFAIRYGUI_BACKEND_PROMPT_NAMES, OPENFAIRYGUI_BACKEND_RESOURCE_TEMPLATES, OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS, OPENFAIRYGUI_BACKEND_TOOL_NAMES, OPENFAIRYGUI_BACKEND_TOOL_OUTPUT_SCHEMA, OPENFAIRYGUI_BACKEND_TOOL_PREFIX, callOpenFairyGuiBackendTool, connectOpenFairyGuiMcpStdio, createOpenFairyGuiMcpServer };

package/dist/{stdio-48jCJzS3.mjs → stdio-HOHWH0x4.mjs}

@@ -1,8 +1,10 @@
 import { createRequire } from "node:module";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { createNodeBackendRuntime } from "@openfairygui/backend/node";
+import { BACKEND_CAPABILITY_SCHEMA_VERSION, BACKEND_CONTRACT_VERSION } from "@openfairygui/backend";
 import { z } from "zod";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import path from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/prompt-definitions.ts
 const OPENFAIRYGUI_BACKEND_PROMPT_NAMES = [
@@ -144,114 +146,6 @@ function registerOpenFairyGuiBackendResources(server, runtime) {
 	})));
 }
 //#endregion
-//#region src/tool-handler.ts
-function jsonResult(payload, isError = false) {
-	return {
-		content: [{
-			type: "text",
-			text: JSON.stringify(payload, null, 2)
-		}],
-		structuredContent: { backendResult: payload },
-		isError
-	};
-}
-function isBackendFailure(value) {
-	return typeof value === "object" && value !== null && "ok" in value && value.ok === false;
-}
-async function callOpenFairyGuiBackendTool(runtime, name, input) {
-	let result;
-	switch (name) {
-		case "openfairygui_backend_get_capabilities":
-			result = runtime.getCapabilities();
-			break;
-		case "openfairygui_backend_open_session":
-			result = await runtime.openSession({ projectPath: String(input.projectPath) });
-			break;
-		case "openfairygui_backend_open_project_session":
-			result = runtime.openProjectSession({
-				project: input.project,
-				sessionId: input.sessionId === void 0 ? void 0 : String(input.sessionId),
-				canonicalProjectPath: input.canonicalProjectPath === void 0 ? void 0 : String(input.canonicalProjectPath),
-				canonicalPathKey: input.canonicalPathKey === void 0 ? void 0 : String(input.canonicalPathKey)
-			});
-			break;
-		case "openfairygui_backend_get_session":
-			result = runtime.getSession({ sessionId: String(input.sessionId) });
-			break;
-		case "openfairygui_backend_get_project_outline":
-			result = runtime.getProjectOutline({ sessionId: String(input.sessionId) });
-			break;
-		case "openfairygui_backend_validate_session":
-			result = runtime.validateSession({ sessionId: String(input.sessionId) });
-			break;
-		case "openfairygui_backend_apply_transaction":
-			result = await runtime.applyTransaction({
-				sessionId: String(input.sessionId),
-				expectedRevision: Number(input.expectedRevision),
-				operations: input.operations
-			});
-			break;
-		case "openfairygui_backend_save_session":
-			result = await runtime.saveSession({
-				sessionId: String(input.sessionId),
-				expectedRevision: input.expectedRevision === void 0 ? void 0 : Number(input.expectedRevision),
-				targetPath: input.targetPath === void 0 ? void 0 : String(input.targetPath),
-				force: input.force === void 0 ? void 0 : Boolean(input.force),
-				mode: input.mode
-			});
-			break;
-		case "openfairygui_backend_materialize_session":
-			result = await runtime.materializeSession({
-				sessionId: String(input.sessionId),
-				expectedRevision: input.expectedRevision === void 0 ? void 0 : Number(input.expectedRevision),
-				mode: input.mode,
-				reason: input.reason === void 0 ? void 0 : String(input.reason)
-			});
-			break;
-		case "openfairygui_backend_close_session":
-			result = await runtime.closeSession({ sessionId: String(input.sessionId) });
-			break;
-		case "openfairygui_backend_get_events":
-			result = runtime.getEvents({
-				sessionId: String(input.sessionId),
-				after: input.after === void 0 ? void 0 : String(input.after),
-				limit: input.limit === void 0 ? void 0 : Number(input.limit)
-			});
-			break;
-		case "openfairygui_backend_get_job":
-			result = runtime.getJob({
-				sessionId: String(input.sessionId),
-				jobId: String(input.jobId)
-			});
-			break;
-		case "openfairygui_backend_list_jobs":
-			result = runtime.listJobs({
-				sessionId: String(input.sessionId),
-				status: input.status,
-				kind: input.kind,
-				limit: input.limit === void 0 ? void 0 : Number(input.limit)
-			});
-			break;
-		case "openfairygui_backend_cancel_job":
-			result = runtime.cancelJob({
-				sessionId: String(input.sessionId),
-				jobId: String(input.jobId)
-			});
-			break;
-		case "openfairygui_backend_get_cache_snapshot":
-			result = runtime.getCacheSnapshot({ sessionId: String(input.sessionId) });
-			break;
-		case "openfairygui_backend_refresh_cache":
-			result = runtime.refreshCache({
-				sessionId: String(input.sessionId),
-				reason: input.reason
-			});
-			break;
-		default: throw new Error(`Unknown OpenFairyGUI backend MCP tool: ${name}`);
-	}
-	return jsonResult(result, isBackendFailure(result));
-}
-//#endregion
 //#region src/tool-definitions.ts
 const OPENFAIRYGUI_BACKEND_TOOL_PREFIX = "openfairygui_backend_";
 const OPENFAIRYGUI_BACKEND_TOOL_NAMES = [
@@ -276,12 +170,316 @@ const sessionId = z.string().min(1);
 const jobId = z.string().min(1);
 const expectedRevision = z.number().int().nonnegative();
 const limit = z.number().int().nonnegative().optional();
-const OPENFAIRYGUI_BACKEND_TOOL_OUTPUT_SCHEMA = z.object({ backendResult: z.object({
-	ok: z.boolean(),
-	data: z.unknown().optional(),
-	error: z.unknown().optional(),
-	meta: z.unknown().optional()
-}).passthrough() });
+const identifier = z.string().min(1).max(256);
+function isOpenFairyGuiMcpPayloadWithinBudget(root) {
+	const pending = [{
+		value: root,
+		depth: 0
+	}];
+	let nodes = 0;
+	while (pending.length > 0) {
+		const { value, depth } = pending.pop();
+		nodes += 1;
+		if (nodes > 1e5 || depth > 32) return false;
+		if (value === null || typeof value === "boolean") continue;
+		if (typeof value === "number") {
+			if (!Number.isFinite(value)) return false;
+			continue;
+		}
+		if (typeof value === "string") {
+			if (value.length > 1e6) return false;
+			continue;
+		}
+		if (value instanceof Uint8Array) {
+			if (value.byteLength > 8 * 1024 * 1024) return false;
+			continue;
+		}
+		if (Array.isArray(value)) {
+			if (value.length > 1e4) return false;
+			for (const child of value) pending.push({
+				value: child,
+				depth: depth + 1
+			});
+			continue;
+		}
+		if (typeof value !== "object") return false;
+		const entries = Object.entries(value);
+		if (entries.length > 1e4 || entries.some(([key]) => key.length > 256)) return false;
+		for (const [, child] of entries) pending.push({
+			value: child,
+			depth: depth + 1
+		});
+	}
+	return true;
+}
+const boundedPayload = z.json();
+const bytes = z.array(z.number().int().min(0).max(255)).max(8 * 1024 * 1024);
+const packageSelector = z.object({ packageId: identifier });
+const resourceSelector = z.object({
+	packageId: identifier,
+	resourceId: identifier
+});
+const componentSelector = z.object({
+	packageId: identifier,
+	componentResourceId: identifier
+});
+const displayNodeSelector = componentSelector.extend({ displayNodeId: identifier });
+const controllerSelector = componentSelector.extend({ controllerName: identifier });
+const transitionSelector = componentSelector.extend({ transitionName: identifier });
+const folderSelector = packageSelector.extend({
+	branch: z.string().max(256).optional(),
+	path: z.string().min(1).max(4096)
+});
+const operationBase = { opId: identifier.optional() };
+const operation = z.discriminatedUnion("kind", [
+	z.object({
+		...operationBase,
+		kind: z.literal("updateProjectSettings"),
+		settings: boundedPayload
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("updatePackageSettings"),
+		selector: packageSelector,
+		settings: boundedPayload
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("renameResource"),
+		selector: resourceSelector,
+		newName: identifier
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("moveResource"),
+		selector: resourceSelector,
+		toPath: z.string().max(4096)
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("setResourceFavorite"),
+		selector: resourceSelector,
+		favorite: z.boolean()
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("setResourceFolderFavorite"),
+		selector: folderSelector,
+		favorite: z.boolean()
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("setResourceFolderAtlas"),
+		selector: folderSelector,
+		atlas: z.string().max(32)
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("setResourceExported"),
+		selector: resourceSelector,
+		exported: z.boolean()
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("addResourceFolder"),
+		selector: packageSelector,
+		path: z.string().max(4096),
+		branch: z.string().max(256).optional(),
+		favorite: z.boolean().optional(),
+		atlas: z.string().max(32).optional()
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("renameResourceFolder"),
+		selector: folderSelector,
+		newName: identifier
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("moveResourceFolder"),
+		selector: folderSelector,
+		toPath: z.string().max(4096)
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("removeResourceFolder"),
+		selector: folderSelector
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("setImageResourceProps"),
+		selector: resourceSelector,
+		props: boundedPayload
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("addResource"),
+		selector: packageSelector,
+		resource: boundedPayload,
+		atIndex: z.number().int().nonnegative().optional()
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("addBranch"),
+		branch: identifier
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("renameBranch"),
+		selector: z.object({ branch: identifier }),
+		newName: identifier
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("removeBranch"),
+		selector: z.object({ branch: identifier })
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("addPackage"),
+		package: boundedPayload,
+		atIndex: z.number().int().nonnegative()
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("renamePackage"),
+		selector: packageSelector,
+		newName: identifier
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("removePackage"),
+		selector: packageSelector
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("addComponent"),
+		selector: packageSelector,
+		component: boundedPayload,
+		atIndex: z.number().int().nonnegative()
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("removeComponent"),
+		selector: componentSelector
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("moveComponent"),
+		selector: componentSelector,
+		toPackageId: identifier,
+		toIndex: z.number().int().nonnegative()
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("replaceResourceBytes"),
+		selector: resourceSelector,
+		sourceBytes: bytes
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("removeResource"),
+		selector: resourceSelector
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("setDisplayNodeProps"),
+		selector: displayNodeSelector,
+		props: boundedPayload
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("setComponentProps"),
+		selector: componentSelector,
+		props: boundedPayload
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("attachDisplayNode"),
+		selector: componentSelector,
+		atIndex: z.number().int().nonnegative(),
+		node: boundedPayload
+	}),
+	z.object({
+		...operationBase,
+		kind: z.literal("detachDisplayNode"),
+		selector: displayNodeSelector
+	}),
+	...["addController", "updateController"].map((kind) => z.object({
+		...operationBase,
+		kind: z.literal(kind),
+		selector: controllerSelector,
+		controller: boundedPayload
+	})),
+	z.object({
+		...operationBase,
+		kind: z.literal("removeController"),
+		selector: controllerSelector
+	}),
+	...["addTransition", "updateTransition"].map((kind) => z.object({
+		...operationBase,
+		kind: z.literal(kind),
+		selector: transitionSelector,
+		transition: boundedPayload
+	})),
+	z.object({
+		...operationBase,
+		kind: z.literal("removeTransition"),
+		selector: transitionSelector
+	}),
+	...[
+		"addLookGear",
+		"updateLookGear",
+		"addGear",
+		"updateGear"
+	].map((kind) => z.object({
+		...operationBase,
+		kind: z.literal(kind),
+		selector: displayNodeSelector.extend({
+			kind: identifier,
+			controllerName: identifier
+		}),
+		gear: boundedPayload
+	})),
+	...["removeLookGear", "removeGear"].map((kind) => z.object({
+		...operationBase,
+		kind: z.literal(kind),
+		selector: displayNodeSelector.extend({
+			kind: identifier,
+			controllerName: identifier
+		})
+	}))
+]);
+const project = z.object({
+	projectId: identifier,
+	projectType: z.number().int(),
+	version: z.string().max(256),
+	branches: z.array(z.string().max(256)).max(256),
+	settings: boundedPayload,
+	packages: z.array(z.object({
+		id: identifier,
+		name: identifier,
+		compressPNG: z.boolean().nullable(),
+		jpegQuality: z.number().finite().nullable(),
+		publish: boundedPayload.nullable(),
+		branchNames: z.array(z.string().max(256)).max(256),
+		folders: z.array(boundedPayload).max(1e4),
+		resources: z.array(boundedPayload).max(1e5)
+	})).max(1e3)
+});
+const OPENFAIRYGUI_BACKEND_TOOL_OUTPUT_SCHEMA = z.object({ backendResult: z.discriminatedUnion("ok", [z.object({
+	ok: z.literal(true),
+	data: boundedPayload,
+	meta: boundedPayload
+}), z.object({
+	ok: z.literal(false),
+	error: z.object({
+		code: identifier,
+		message: z.string().max(1e6)
+	}).passthrough(),
+	meta: boundedPayload,
+	session: boundedPayload.optional()
+})]) });
 const OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS = [
 	{
 		name: "openfairygui_backend_get_capabilities",
@@ -315,7 +513,7 @@ const OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS = [
 		title: "Open Project Session",
 		description: "Open a browser-safe backend session from an already loaded UAM project without filesystem access.",
 		inputSchema: z.object({
-			project: z.unknown(),
+			project,
 			sessionId: z.string().min(1).optional(),
 			canonicalProjectPath: z.string().min(1).optional(),
 			canonicalPathKey: z.string().min(1).optional()
@@ -370,11 +568,11 @@ const OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS = [
 		name: "openfairygui_backend_apply_transaction",
 		backendMethod: "applyTransaction",
 		title: "Apply UAM Transaction",
-		description: "Apply a backend revision-checked UAM operation batch without redefining selector or operation grammar.",
+		description: "Apply a bounded, revision-checked UAM operation batch using the Core transaction discriminants.",
 		inputSchema: z.object({
 			sessionId,
 			expectedRevision,
-			operations: z.array(z.unknown())
+			operations: z.array(operation).min(1).max(1e3)
 		}),
 		outputSchema: OPENFAIRYGUI_BACKEND_TOOL_OUTPUT_SCHEMA,
 		annotations: {
@@ -388,7 +586,7 @@ const OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS = [
 		name: "openfairygui_backend_save_session",
 		backendMethod: "saveSession",
 		title: "Save Backend Session",
-		description: "Write the current backend session back through the backend coordinated non-atomic save path.",
+		description: "Write the current backend session through its coordinated save path; Node uses an atomic staged directory swap.",
 		inputSchema: z.object({
 			sessionId,
 			expectedRevision: expectedRevision.optional(),
@@ -546,10 +744,149 @@ const OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS = [
 	}
 ];
 //#endregion
+//#region src/tool-handler.ts
+function jsonResult(payload, isError = false) {
+	const text = JSON.stringify(payload, null, 2);
+	const wirePayload = JSON.parse(text);
+	return {
+		content: [{
+			type: "text",
+			text
+		}],
+		structuredContent: { backendResult: wirePayload },
+		isError
+	};
+}
+function isBackendFailure(value) {
+	return typeof value === "object" && value !== null && "ok" in value && value.ok === false;
+}
+function unhandledBackendFailure(startedAt) {
+	return {
+		ok: false,
+		meta: {
+			requestId: crypto.randomUUID(),
+			durationMs: Math.max(0, Date.now() - startedAt),
+			warnings: [],
+			diagnostics: [],
+			stage: "runtime",
+			contractVersion: BACKEND_CONTRACT_VERSION,
+			capabilitySchemaVersion: BACKEND_CAPABILITY_SCHEMA_VERSION
+		},
+		error: {
+			code: "backend_unhandled_error",
+			message: "Backend tool execution failed."
+		}
+	};
+}
+async function callOpenFairyGuiBackendTool(runtime, name, input) {
+	if (!isOpenFairyGuiMcpPayloadWithinBudget(input)) throw new RangeError("MCP input exceeds the depth, node, key, string, or byte budget.");
+	const startedAt = Date.now();
+	let result;
+	try {
+		switch (name) {
+			case "openfairygui_backend_get_capabilities":
+				result = runtime.getCapabilities();
+				break;
+			case "openfairygui_backend_open_session":
+				result = await runtime.openSession({ projectPath: String(input.projectPath) });
+				break;
+			case "openfairygui_backend_open_project_session":
+				result = runtime.openProjectSession({
+					project: input.project,
+					sessionId: input.sessionId === void 0 ? void 0 : String(input.sessionId),
+					canonicalProjectPath: input.canonicalProjectPath === void 0 ? void 0 : String(input.canonicalProjectPath),
+					canonicalPathKey: input.canonicalPathKey === void 0 ? void 0 : String(input.canonicalPathKey)
+				});
+				break;
+			case "openfairygui_backend_get_session":
+				result = runtime.getSession({ sessionId: String(input.sessionId) });
+				break;
+			case "openfairygui_backend_get_project_outline":
+				result = runtime.getProjectOutline({ sessionId: String(input.sessionId) });
+				break;
+			case "openfairygui_backend_validate_session":
+				result = runtime.validateSession({ sessionId: String(input.sessionId) });
+				break;
+			case "openfairygui_backend_apply_transaction": {
+				const operations = input.operations.map((operation) => operation.kind === "replaceResourceBytes" ? {
+					...operation,
+					sourceBytes: new Uint8Array(operation.sourceBytes)
+				} : operation);
+				result = await runtime.applyTransaction({
+					sessionId: String(input.sessionId),
+					expectedRevision: Number(input.expectedRevision),
+					operations
+				});
+				break;
+			}
+			case "openfairygui_backend_save_session":
+				result = await runtime.saveSession({
+					sessionId: String(input.sessionId),
+					expectedRevision: input.expectedRevision === void 0 ? void 0 : Number(input.expectedRevision),
+					targetPath: input.targetPath === void 0 ? void 0 : String(input.targetPath),
+					force: input.force === void 0 ? void 0 : Boolean(input.force),
+					mode: input.mode
+				});
+				break;
+			case "openfairygui_backend_materialize_session":
+				result = await runtime.materializeSession({
+					sessionId: String(input.sessionId),
+					expectedRevision: input.expectedRevision === void 0 ? void 0 : Number(input.expectedRevision),
+					mode: input.mode,
+					reason: input.reason === void 0 ? void 0 : String(input.reason)
+				});
+				break;
+			case "openfairygui_backend_close_session":
+				result = await runtime.closeSession({ sessionId: String(input.sessionId) });
+				break;
+			case "openfairygui_backend_get_events":
+				result = runtime.getEvents({
+					sessionId: String(input.sessionId),
+					after: input.after === void 0 ? void 0 : String(input.after),
+					limit: input.limit === void 0 ? void 0 : Number(input.limit)
+				});
+				break;
+			case "openfairygui_backend_get_job":
+				result = runtime.getJob({
+					sessionId: String(input.sessionId),
+					jobId: String(input.jobId)
+				});
+				break;
+			case "openfairygui_backend_list_jobs":
+				result = runtime.listJobs({
+					sessionId: String(input.sessionId),
+					status: input.status,
+					kind: input.kind,
+					limit: input.limit === void 0 ? void 0 : Number(input.limit)
+				});
+				break;
+			case "openfairygui_backend_cancel_job":
+				result = runtime.cancelJob({
+					sessionId: String(input.sessionId),
+					jobId: String(input.jobId)
+				});
+				break;
+			case "openfairygui_backend_get_cache_snapshot":
+				result = runtime.getCacheSnapshot({ sessionId: String(input.sessionId) });
+				break;
+			case "openfairygui_backend_refresh_cache":
+				result = runtime.refreshCache({
+					sessionId: String(input.sessionId),
+					reason: input.reason
+				});
+				break;
+			default: throw new Error(`Unknown OpenFairyGUI backend MCP tool: ${name}`);
+		}
+	} catch {
+		return jsonResult(unhandledBackendFailure(startedAt), true);
+	}
+	return jsonResult(result, isBackendFailure(result));
+}
+//#endregion
 //#region src/server.ts
 const require = createRequire(import.meta.url);
 function getInjectedPackageVersion() {
-	const version = "0.3.0";
+	const version = "0.3.1";
 	return typeof version === "string" && true ? version : null;
 }
 function readPackageVersion() {
@@ -563,7 +900,7 @@ function readPackageVersion() {
 }
 const PACKAGE_VERSION = readPackageVersion();
 function createOpenFairyGuiMcpServer(options = {}) {
-	const runtime = options.runtime ?? createNodeBackendRuntime();
+	const runtime = options.runtime ?? createNodeBackendRuntime({ allowedProjectRoots: options.allowedProjectRoots ?? [process.cwd()] });
 	const server = new McpServer({
 		name: options.name ?? "openfairygui-mcp",
 		version: options.version ?? PACKAGE_VERSION
@@ -586,11 +923,12 @@ function createOpenFairyGuiMcpServer(options = {}) {
 //#endregion
 //#region src/stdio.ts
 async function connectOpenFairyGuiMcpStdio() {
-	await createOpenFairyGuiMcpServer().connect(new StdioServerTransport());
+	const configuredRoots = process.env.OPENFAIRYGUI_ALLOWED_PROJECT_ROOTS?.split(path.delimiter).map((value) => value.trim()).filter(Boolean);
+	await createOpenFairyGuiMcpServer({ allowedProjectRoots: configuredRoots }).connect(new StdioServerTransport());
 }
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) connectOpenFairyGuiMcpStdio().catch((error) => {
 	console.error(error instanceof Error ? error.stack ?? error.message : String(error));
 	process.exitCode = 1;
 });
 //#endregion
-export { OPENFAIRYGUI_BACKEND_TOOL_OUTPUT_SCHEMA as a, OPENFAIRYGUI_BACKEND_CAPABILITIES_RESOURCE_URI as c, OPENFAIRYGUI_BACKEND_PROMPT_NAMES as d, OPENFAIRYGUI_BACKEND_TOOL_NAMES as i, OPENFAIRYGUI_BACKEND_RESOURCE_TEMPLATES as l, createOpenFairyGuiMcpServer as n, OPENFAIRYGUI_BACKEND_TOOL_PREFIX as o, OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS as r, callOpenFairyGuiBackendTool as s, connectOpenFairyGuiMcpStdio as t, OPENFAIRYGUI_BACKEND_PROMPT_DEFINITIONS as u };
+export { OPENFAIRYGUI_BACKEND_TOOL_NAMES as a, OPENFAIRYGUI_BACKEND_CAPABILITIES_RESOURCE_URI as c, OPENFAIRYGUI_BACKEND_PROMPT_NAMES as d, OPENFAIRYGUI_BACKEND_TOOL_DEFINITIONS as i, OPENFAIRYGUI_BACKEND_RESOURCE_TEMPLATES as l, createOpenFairyGuiMcpServer as n, OPENFAIRYGUI_BACKEND_TOOL_OUTPUT_SCHEMA as o, callOpenFairyGuiBackendTool as r, OPENFAIRYGUI_BACKEND_TOOL_PREFIX as s, connectOpenFairyGuiMcpStdio as t, OPENFAIRYGUI_BACKEND_PROMPT_DEFINITIONS as u };