devframe 0.7.16 → 0.8.1

package/dist/utils/simple-schema.mjs

@@ -0,0 +1,154 @@
+//#region src/utils/simple-schema.ts
+function ok(value) {
+	return { value };
+}
+function fail(message, path) {
+	return { issues: [path ? {
+		message,
+		path
+	} : { message }] };
+}
+function make(type, validate, extra) {
+	return {
+		type,
+		...extra,
+		"~standard": {
+			version: 1,
+			vendor: "devframe",
+			validate
+		}
+	};
+}
+/** Run a Standard Schema synchronously, rejecting async validators. */
+function runSync(schema, value) {
+	const result = schema["~standard"].validate(value);
+	if (result instanceof Promise) throw new TypeError("[devframe/utils/simple-schema] async validators are not supported inside object()/optional()/nullable()");
+	return result;
+}
+/** Any string. */
+function string() {
+	return make("string", (v) => typeof v === "string" ? ok(v) : fail("Expected a string"));
+}
+/** A finite number (rejects `NaN`). */
+function number() {
+	return make("number", (v) => typeof v === "number" && !Number.isNaN(v) ? ok(v) : fail("Expected a number"));
+}
+/** A boolean. */
+function boolean() {
+	return make("boolean", (v) => typeof v === "boolean" ? ok(v) : fail("Expected a boolean"));
+}
+/** `undefined` — mirrors valibot's `void`. */
+function voidType() {
+	return make("void", (v) => v === void 0 ? ok(void 0) : fail("Expected undefined"));
+}
+/** `null`. */
+function nullType() {
+	return make("null", (v) => v === null ? ok(null) : fail("Expected null"));
+}
+/** One of a fixed set of literal values. */
+function picklist(values) {
+	const set = new Set(values);
+	return make("picklist", (v) => set.has(v) ? ok(v) : fail(`Expected one of: ${values.join(", ")}`), { values });
+}
+/** A single literal value (string / number / boolean). */
+function literal(value) {
+	return make("literal", (v) => v === value ? ok(v) : fail(`Expected ${JSON.stringify(value)}`), { value });
+}
+/** A value matching any one of the given schemas. */
+function union(options) {
+	return make("union", (v) => {
+		const issues = [];
+		for (const option of options) {
+			const result = runSync(option, v);
+			if (!result.issues) return ok(v);
+			issues.push(...result.issues);
+		}
+		return { issues };
+	}, { options });
+}
+/** A record with string keys whose values each satisfy the value schema. */
+function record(_key, value) {
+	return make("record", (v) => {
+		if (typeof v !== "object" || v === null || Array.isArray(v)) return fail("Expected an object");
+		const obj = v;
+		const issues = [];
+		for (const key of Object.keys(obj)) {
+			const result = runSync(value, obj[key]);
+			if (result.issues) for (const issue of result.issues) issues.push({
+				message: issue.message,
+				path: [key, ...issue.path ?? []]
+			});
+		}
+		return issues.length ? { issues } : ok(v);
+	});
+}
+/** An array whose every element satisfies the item schema. */
+function array(item) {
+	return make("array", (v) => {
+		if (!Array.isArray(v)) return fail("Expected an array");
+		const issues = [];
+		for (let i = 0; i < v.length; i++) {
+			const result = runSync(item, v[i]);
+			if (result.issues) for (const issue of result.issues) issues.push({
+				message: issue.message,
+				path: [i, ...issue.path ?? []]
+			});
+		}
+		return issues.length ? { issues } : ok(v);
+	});
+}
+/** An object whose known keys each satisfy their schema (extra keys are kept). */
+function object(shape) {
+	const entries = Object.entries(shape);
+	return make("object", (v) => {
+		if (typeof v !== "object" || v === null || Array.isArray(v)) return fail("Expected an object");
+		const obj = v;
+		const issues = [];
+		for (const [key, schema] of entries) {
+			const result = runSync(schema, obj[key]);
+			if (result.issues) for (const issue of result.issues) issues.push({
+				message: issue.message,
+				path: [key, ...issue.path ?? []]
+			});
+		}
+		return issues.length ? { issues } : ok(v);
+	});
+}
+/** Allow `undefined` in addition to the inner schema. */
+function optional(inner) {
+	return make("optional", (v) => v === void 0 ? ok(void 0) : runSync(inner, v), { wrapped: inner });
+}
+/** Allow `null` in addition to the inner schema. */
+function nullable(inner) {
+	return make("nullable", (v) => v === null ? ok(null) : runSync(inner, v), { wrapped: inner });
+}
+/** Attach a human-readable description (used for CLI option help). */
+function describe(schema, description) {
+	return {
+		...schema,
+		description
+	};
+}
+/**
+* Grouped access to every builder — `s.string()`, `s.object({ ... })`,
+* `s.void()`, etc. Handy for a valibot-like `import { s } from
+* 'devframe/utils/simple-schema'` call site.
+*/
+const s = {
+	string,
+	number,
+	boolean,
+	void: voidType,
+	null: nullType,
+	literal,
+	picklist,
+	union,
+	record,
+	array,
+	object,
+	optional,
+	nullable,
+	describe
+};
+//#endregion
+export { array, boolean, describe, literal, nullType, nullable, number, object, optional, picklist, record, s, string, union, voidType };

package/dist/utils/streaming-channel.d.mts

@@ -1,2 +1,2 @@
-import { at as StreamReader, ct as createStreamReader, it as StreamErrorPayload, lt as createStreamSink, nt as CreateStreamReaderOptions, ot as StreamSink, rt as CreateStreamSinkOptions, st as StreamSinkEvents, tt as BufferedChunk } from "../devframe-Ckhf3kFw.mjs";
+import { at as StreamReader, ct as createStreamReader, it as StreamErrorPayload, lt as createStreamSink, nt as CreateStreamReaderOptions, ot as StreamSink, rt as CreateStreamSinkOptions, st as StreamSinkEvents, tt as BufferedChunk } from "../devframe-qgCKL683.mjs";
 export { BufferedChunk, CreateStreamReaderOptions, CreateStreamSinkOptions, StreamErrorPayload, StreamReader, StreamSink, StreamSinkEvents, createStreamReader, createStreamSink };

package/dist/{ws-client-DSXiI2h7.d.mts → ws-client-B6Tnr0ic.d.mts}

@@ -1,4 +1,4 @@
-import { v as RpcFunctionDefinitionAny } from "./types-CrzNxXKq.mjs";
+import { v as RpcFunctionDefinitionAny } from "./types-CnJSgRVa.mjs";
 import { ChannelOptions } from "birpc";
 //#region src/rpc/transports/ws-client.d.ts
 interface WsRpcChannelOptions {

package/dist/{ws-server-9-wn7MNQ.d.mts → ws-server-J-zkiOyp.d.mts}

@@ -1,4 +1,4 @@
-import { v as RpcFunctionDefinitionAny } from "./types-CrzNxXKq.mjs";
+import { v as RpcFunctionDefinitionAny } from "./types-CnJSgRVa.mjs";
 import { Peer } from "crossws";
 import { BirpcGroup, ChannelOptions } from "birpc";
 import { NodeAdapter } from "crossws/adapters/node";
@@ -62,7 +62,7 @@ interface WsRpcTransportOptions {
    * Pass `false` to disable origin checking entirely (not recommended).
    * Default: loopback-only.
    */
-  allowedOrigins?: readonly string[] | false;
+  allowedOrigins?: readonly string[] | WsOriginRegistry | false;
   /**
    * RPC function definitions, used by the per-call wire serializer to
    * dispatch between strict-JSON and structured-clone encoding based
@@ -79,6 +79,27 @@ interface WsRpcTransportOptions {
   /** Override the default per-call deserializer. Most callers should leave this unset. */
   deserialize?: ChannelOptions['deserialize'];
 }
+interface CreateWsOriginRegistryOptions {
+  /** Origins allowed before any external viewers are registered. */
+  allowedOrigins?: readonly string[];
+  /** Additional validation to run after the registration token is verified. */
+  validateOrigin?: (origin: string) => boolean;
+}
+interface WsOriginRegistry {
+  /** Registration token to include in connection metadata. */
+  readonly token: string;
+  /** Read and register an origin from a connection bootstrap URL. */
+  registerFromUrl: (url: string) => string | undefined;
+  /** Check whether an origin is currently allowed. */
+  isAllowed: (origin: string | undefined) => boolean;
+}
+/**
+ * Create a live, token-protected origin allowlist for external browser
+ * viewers. Pass it to {@link WsRpcTransportOptions.allowedOrigins}, then use
+ * `registerFromUrl()` in the connection metadata handler to authorize a
+ * viewer without sharing a mutable array or disabling DNS-rebinding protection.
+ */
+declare function createWsOriginRegistry(options?: CreateWsOriginRegistryOptions): WsOriginRegistry;
 interface WsRpcTransport {
   /**
    * The crossws node adapter driving the socket — exposes the connected
@@ -115,4 +136,4 @@ declare function isAllowedOrigin(origin: string | undefined, allowedOrigins: rea
  */
 declare function attachWsRpcTransport<ClientFunctions extends object, ServerFunctions extends object>(rpcGroup: BirpcGroup<ClientFunctions, ServerFunctions, false>, options?: WsRpcTransportOptions): WsRpcTransport;
 //#endregion
-export { isAllowedOrigin as a, attachWsRpcTransport as i, WsRpcTransport as n, isLoopbackHostname as o, WsRpcTransportOptions as r, DevframeNodeRpcSessionMeta as t };
+export { WsRpcTransportOptions as a, isAllowedOrigin as c, WsRpcTransport as i, isLoopbackHostname as l, DevframeNodeRpcSessionMeta as n, attachWsRpcTransport as o, WsOriginRegistry as r, createWsOriginRegistry as s, CreateWsOriginRegistryOptions as t };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devframe",
   "type": "module",
-  "version": "0.7.16",
+  "version": "0.8.1",
   "description": "Framework for building generic devframes",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",
@@ -42,6 +42,7 @@
     "./rpc/transports/ws-client": "./dist/rpc/transports/ws-client.mjs",
     "./rpc/transports/ws-server": "./dist/rpc/transports/ws-server.mjs",
     "./types": "./dist/types/index.mjs",
+    "./utils/agent-tool-name": "./dist/utils/agent-tool-name.mjs",
     "./utils/colors": "./dist/utils/colors.mjs",
     "./utils/crypto-token": "./dist/utils/crypto-token.mjs",
     "./utils/events": "./dist/utils/events.mjs",
@@ -50,6 +51,7 @@
     "./utils/nanoid": "./dist/utils/nanoid.mjs",
     "./utils/open": "./dist/utils/open.mjs",
     "./utils/promise": "./dist/utils/promise.mjs",
+    "./utils/simple-schema": "./dist/utils/simple-schema.mjs",
     "./utils/scope": "./dist/utils/scope.mjs",
     "./utils/serve-static": "./dist/utils/serve-static.mjs",
     "./utils/shared-state": "./dist/utils/shared-state.mjs",
@@ -59,16 +61,24 @@
     "./package.json": "./package.json"
   },
   "types": "./dist/index.d.mts",
+  "bin": {
+    "devframe": "./bin/devframe.mjs"
+  },
   "files": [
+    "bin",
     "dist",
     "skills"
   ],
   "peerDependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/client": "^2.0.0",
+    "@modelcontextprotocol/server": "^2.0.0",
     "cac": "^7.0.0"
   },
   "peerDependenciesMeta": {
-    "@modelcontextprotocol/sdk": {
+    "@modelcontextprotocol/client": {
+      "optional": true
+    },
+    "@modelcontextprotocol/server": {
       "optional": true
     },
     "cac": {
@@ -76,7 +86,7 @@
     }
   },
   "dependencies": {
-    "@valibot/to-json-schema": "^1.7.1",
+    "@standard-schema/spec": "^1.1.0",
     "birpc": "^4.0.0",
     "crossws": "^0.4.10",
     "destr": "^2.0.5",
@@ -84,11 +94,11 @@
     "mrmime": "^2.0.1",
     "nostics": "^1.2.0",
     "pathe": "^2.0.3",
-    "ufo": "^1.6.4",
-    "valibot": "^1.4.2"
+    "ufo": "^1.6.4"
   },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/client": "^2.0.0",
+    "@modelcontextprotocol/server": "^2.0.0",
     "cac": "^7.0.0",
     "get-port-please": "^3.2.0",
     "immer": "^11.1.15",
@@ -103,6 +113,7 @@
     "tinyglobby": "^0.2.17",
     "tsdown": "^0.22.14",
     "ua-parser-modern": "^0.1.1",
+    "valibot": "^1.4.2",
     "whenexpr": "^0.1.2",
     "ws": "^8.21.1"
   },

package/skills/devframe/SKILL.md

@@ -485,7 +485,7 @@ import { createMcpServer } from 'devframe/adapters/mcp'
 await createMcpServer(devframe, { transport: 'stdio' })
 ```
 
-`@modelcontextprotocol/sdk` is a peer dependency. The CLI adapter also exposes `my-devframe mcp` — route host logs to stderr (stdout is the MCP transport). Safety classifications (`'read' | 'action' | 'destructive'`) drive MCP hint annotations that agent clients use to prompt for confirmation.
+`@modelcontextprotocol/server` is a peer dependency. The CLI adapter also exposes `my-devframe mcp` — route host logs to stderr (stdout is the MCP transport). Safety classifications (`'read' | 'action' | 'destructive'`) drive MCP hint annotations that agent clients use to prompt for confirmation.
 
 ## Author SPA
 
@@ -569,10 +569,11 @@ RPC handlers run with the full privileges of the host process, so the boundary t
 - **`auth` defaults to `true`** — dev-mode connections must authenticate before calls are accepted. Devframe ships the node primitives (`exchangeTempAuthCode`, `verifyAuthToken` in `devframe/node/auth`); the host adapter (e.g. Vite DevTools) provides the interactive `devframe:anonymous:auth` + `devframe:auth:exchange` handlers and auth UI.
 - **`auth: false` trusts every reachable connection.** Use it only for single-user `localhost` tools. Never combine it with a non-loopback bind host, a tunnel, or a shared/CI environment. The default bind host is already `localhost`.
 - **Authentication** exchanges a 6-digit one-time code (shown in the developer's terminal) for a node-issued bearer token via `requestTrustWithCode(code)`. The code is single-use, expires in 5 min, compared in constant time, and rotates after repeated failures — show it only in the terminal, never over the network.
-- **Magic-link (optional):** print `buildOtpAuthUrl(origin)` — `<origin>/?devframe_otp=<code>`. `connectDevframe` reads the code, exchanges it, and strips it from the URL. Integrations can opt out (`otpParam: false`) and drive it via the exposed `authenticateWithUrlOtp(rpc)` / `consumeOtpFromUrl()` client utilities. Only the single-use code rides the URL, never the bearer; treat the printed link like the code itself. The standalone CLI's `--open` does this automatically via `DevframeAuthHandler.buildOpenUrl` — the launched tab already carries the OTP, no prompt needed.
+- **Magic-link (optional):** print `buildOtpAuthUrl(origin)` — `<origin>/#devframe_otp=<code>`. The code rides the URL **fragment**, which the browser never sends to the server, so it stays out of access logs and `Referer`. `connectDevframe` reads the code, exchanges it, and strips it from the URL. Integrations can opt out (`otpParam: false`) and drive it via the exposed `authenticateWithUrlOtp(rpc)` / `consumeOtpFromUrl()` client utilities. Only the single-use code rides the URL, never the bearer; treat the printed link like the code itself. The standalone CLI's `--open` does this automatically via `DevframeAuthHandler.buildOpenUrl` — the launched tab already carries the OTP, no prompt needed.
 - **Tokens are secrets.** The bearer token rides the WS URL (`?devframe_auth_token=…`) — serve over `wss://`/`https://` beyond loopback. Never log the token or code, never bake them into build output. Revoke via `revokeAuthToken(...)`; clients drop to untrusted on `devframe:auth:revoked`.
 - **Authorize handlers.** Any trusted client can call any registered function — validate inputs, and mark state-changing functions `type: 'destructive'` so MCP/agent clients prompt first.
-- **Origin-lock remote docks** (`originLock`) so a dock token is honored only from its expected origin.
+- **Origin-lock remote docks** (`originLock`, on by default) so a dock's session token is honored only on a connection whose `Origin` matches the dock — the connect-time gate enforces it.
+- **The MCP route requires an Origin.** The route-based MCP server (`cli.mcp`, `viteDevBridge`/Next handler `mcp`, `createMcpFetchHandler`) rejects `Origin`-less requests — a request must carry a loopback (or allow-listed) `Origin`, so it isn't reachable by an arbitrary local process. `devframe connect` sends each instance's own loopback origin automatically.
 
 See [Security](https://devfra.me/security) for the full reference.
 

package/dist/build-server-C7vTKjiQ.mjs

@@ -1,359 +0,0 @@
-import { a as diagnostics } from "./storage-gEnj9ASQ.mjs";
-import { n as createHostContext } from "./host-h3-CgOetlNE.mjs";
-import { Diagnostic } from "nostics";
-import { join } from "pathe";
-import process from "node:process";
-import { homedir } from "node:os";
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { CallToolRequestSchema, ListResourcesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import { toJsonSchema } from "@valibot/to-json-schema";
-//#region src/adapters/mcp/stringify.ts
-/**
-* JSON-coercing serializer for MCP text payloads.
-*
-* MCP carries tool results and resource reads as plain text over a
-* JSON-RPC transport, so we cannot use the `s:`-prefixed structured-clone
-* format the WS RPC transport falls back to for non-JSON values. Instead,
-* we coerce common non-JSON types into JSON-friendly forms so the LLM
-* client sees something useful instead of `[object Object]`.
-*
-* Coercions:
-*   - `BigInt` → `"123n"`
-*   - `Date` → ISO string (via the native `toJSON`)
-*   - `Map` → `{ __type: 'Map', entries: [[k, v], …] }`
-*   - `Set` → `{ __type: 'Set', entries: [v, …] }`
-*   - `Error` → `{ name, message, stack, cause? }` (cause recurses)
-*   - `Function` → `"[Function: name]"`
-*   - `Symbol` → `value.toString()`
-*   - cycles → `"[Circular]"`
-*/
-function stringifyForMcp(value) {
-	if (value === void 0) return "undefined";
-	if (typeof value === "string") return value;
-	const seen = /* @__PURE__ */ new WeakSet();
-	return JSON.stringify(value, (_key, val) => {
-		if (typeof val === "bigint") return `${val}n`;
-		if (val instanceof Error) {
-			const out = {
-				name: val.name,
-				message: val.message,
-				stack: val.stack
-			};
-			if (val.cause !== void 0) out.cause = val.cause;
-			return out;
-		}
-		if (val instanceof Map) return {
-			__type: "Map",
-			entries: [...val.entries()]
-		};
-		if (val instanceof Set) return {
-			__type: "Set",
-			entries: [...val]
-		};
-		if (typeof val === "function") return `[Function: ${val.name || "anonymous"}]`;
-		if (typeof val === "symbol") return val.toString();
-		if (val !== null && typeof val === "object") {
-			if (seen.has(val)) return "[Circular]";
-			seen.add(val);
-		}
-		return val;
-	}, 2);
-}
-/**
-* Format a thrown value for an MCP `isError` text payload.
-*
-* A nostics `Diagnostic` (every coded devframe error) becomes structured
-* JSON — `{ error: { code, message, fix?, docs? } }` — so an agent receives
-* the actionable next step (`fix`) and the docs URL instead of a bare
-* message string. Other errors surface `Error.name`/`message`, plus one
-* level of `cause.message` so context isn't dropped silently.
-*/
-function formatMcpError(error) {
-	if (error instanceof Diagnostic) return JSON.stringify({ error: {
-		code: error.code,
-		message: error.message,
-		...error.fix ? { fix: error.fix } : {},
-		...error.docs ? { docs: error.docs } : {}
-	} }, null, 2);
-	if (!(error instanceof Error)) return String(error);
-	const cause = error.cause;
-	const causeText = cause instanceof Error ? ` (cause: ${cause.message})` : cause !== void 0 ? ` (cause: ${String(cause)})` : "";
-	return `${error.name}: ${error.message}${causeText}`;
-}
-//#endregion
-//#region src/adapters/mcp/to-json-schema.ts
-const FALLBACK_OBJECT_SCHEMA = Object.freeze({
-	type: "object",
-	additionalProperties: true
-});
-/**
-* Convert a valibot return schema to JSON Schema.
-* @internal
-*/
-function valibotReturnToJsonSchema(schema) {
-	if (!schema) return void 0;
-	try {
-		return toJsonSchema(schema);
-	} catch {
-		return FALLBACK_OBJECT_SCHEMA;
-	}
-}
-/**
-* Convert positional RPC args schemas to a single MCP-friendly object
-* schema. When the RPC declares `args: [v.object(...)]`, unwrap the
-* single-object schema directly (nicer agent UX than `{ arg0: {...} }`).
-*
-* Returns `undefined` when there are no args (the MCP SDK treats this
-* as `{ type: 'object', properties: {} }`).
-* @internal
-*/
-function valibotArgsToJsonSchema(args) {
-	if (!args || args.length === 0) return {
-		schema: {
-			type: "object",
-			properties: {}
-		},
-		unwrapped: false
-	};
-	if (args.length === 1) {
-		const inner = safeToJsonSchema(args[0]);
-		if (isObjectJsonSchema(inner)) return {
-			schema: inner,
-			unwrapped: true
-		};
-	}
-	const properties = {};
-	const required = [];
-	for (let i = 0; i < args.length; i++) {
-		const key = `arg${i}`;
-		properties[key] = safeToJsonSchema(args[i]);
-		required.push(key);
-	}
-	return {
-		schema: {
-			type: "object",
-			properties,
-			required,
-			additionalProperties: false
-		},
-		unwrapped: false
-	};
-}
-function safeToJsonSchema(schema) {
-	try {
-		return toJsonSchema(schema);
-	} catch {
-		return FALLBACK_OBJECT_SCHEMA;
-	}
-}
-function isObjectJsonSchema(value) {
-	return !!value && typeof value === "object" && value.type === "object";
-}
-//#endregion
-//#region src/adapters/mcp/build-server.ts
-/**
-* Wire an MCP {@link Server} to a devframe context. Returns the server
-* plus a disposal function for the subscriptions it sets up. The
-* transport is the caller's responsibility — `createMcpServer` connects
-* stdio; tests can connect an {@link InMemoryTransport} instead.
-*
-* @internal
-*/
-function buildMcpServerFromContext(ctx, options) {
-	const server = new Server({
-		name: options.serverName,
-		version: options.serverVersion
-	}, { capabilities: {
-		tools: { listChanged: true },
-		resources: { listChanged: true }
-	} });
-	registerToolHandlers(server, ctx);
-	registerResourceHandlers(server, ctx, options.exposeSharedState);
-	const notify = (method) => {
-		server.notification({ method }).catch(() => {});
-	};
-	const offManifest = ctx.agent.events.on("agent:manifest:changed", () => {
-		notify("notifications/tools/list_changed");
-		notify("notifications/resources/list_changed");
-	});
-	const offKeyAdded = ctx.rpc.sharedState.onKeyAdded(() => {
-		notify("notifications/resources/list_changed");
-	});
-	return {
-		server,
-		dispose: () => {
-			offManifest();
-			offKeyAdded();
-		}
-	};
-}
-/**
-* Build an MCP server over the agent surface of a devframe definition.
-* Currently supports `stdio` transport only.
-*
-* @experimental The agent-native surface is experimental and may change
-* without a major version bump until it stabilizes.
-*/
-async function createMcpServer(definition, options = {}) {
-	const transport = options.transport ?? "stdio";
-	if (transport !== "stdio") throw diagnostics.DF0017({
-		transport,
-		reason: "Only stdio transport is supported in this release."
-	});
-	const ctx = await createHostContext({
-		cwd: process.cwd(),
-		mode: "dev",
-		host: {
-			mountStatic: () => {},
-			resolveOrigin: () => "mcp://devframe",
-			getStorageDir: (scope) => {
-				if (scope === "workspace") return join(process.cwd(), ".devframe");
-				if (scope === "project") return join(process.cwd(), `node_modules/.${definition.id}/devframe`);
-				return join(homedir(), `.${definition.id}/devframe`);
-			}
-		}
-	});
-	await definition.setup(ctx);
-	const { server, dispose } = buildMcpServerFromContext(ctx, {
-		serverName: options.serverName ?? `${definition.id} (devframe)`,
-		serverVersion: options.serverVersion ?? definition.version ?? "0.0.0",
-		exposeSharedState: options.exposeSharedState ?? true
-	});
-	const { startStdioTransport } = await import("./transports-BmDVn4SF.mjs");
-	let stop;
-	try {
-		stop = await startStdioTransport(server);
-	} catch (error) {
-		const reason = error instanceof Error ? error.message : String(error);
-		throw diagnostics.DF0017({
-			transport,
-			reason,
-			cause: error
-		});
-	}
-	options.onReady?.({ transport: "stdio" });
-	return { async stop() {
-		dispose();
-		await stop();
-	} };
-}
-function registerToolHandlers(server, ctx) {
-	server.setRequestHandler(ListToolsRequestSchema, async () => {
-		return { tools: ctx.agent.list().tools.map((tool) => projectTool(tool, ctx)) };
-	});
-	server.setRequestHandler(CallToolRequestSchema, async (request) => {
-		const { name, arguments: args } = request.params;
-		try {
-			const tool = ctx.agent.getTool(name);
-			const outputSchema = tool ? tool.outputSchema ?? computeOutputSchema(tool, ctx) : void 0;
-			const result = await ctx.agent.invoke(name, args ?? {});
-			return {
-				content: [{
-					type: "text",
-					text: stringifyForMcp(result)
-				}],
-				...outputSchema ? { structuredContent: result } : {}
-			};
-		} catch (error) {
-			return {
-				isError: true,
-				content: [{
-					type: "text",
-					text: `Error invoking "${name}": ${formatMcpError(error)}`
-				}]
-			};
-		}
-	});
-}
-function registerResourceHandlers(server, ctx, exposeSharedState) {
-	server.setRequestHandler(ListResourcesRequestSchema, async () => {
-		const resources = ctx.agent.list().resources.map((resource) => ({
-			uri: resource.uri,
-			name: resource.name,
-			description: resource.description,
-			mimeType: resource.mimeType
-		}));
-		if (exposeSharedState !== false) {
-			const filter = typeof exposeSharedState === "function" ? exposeSharedState : () => true;
-			for (const key of ctx.rpc.sharedState.keys()) {
-				if (!filter(key)) continue;
-				resources.push({
-					uri: `devframe://state/${encodeURIComponent(key)}`,
-					name: key,
-					description: `Shared state: ${key}`,
-					mimeType: "application/json"
-				});
-			}
-		}
-		return { resources };
-	});
-	server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
-		const { uri } = request.params;
-		const parsed = parseResourceUri(uri);
-		if (parsed.kind === "resource") {
-			const content = await ctx.agent.read(parsed.id);
-			return { contents: [{
-				uri,
-				mimeType: content.mimeType ?? "application/json",
-				text: content.text ?? stringifyForMcp(content.json)
-			}] };
-		}
-		if (parsed.kind === "state") return { contents: [{
-			uri,
-			mimeType: "application/json",
-			text: stringifyForMcp((await ctx.rpc.sharedState.get(parsed.key)).value())
-		}] };
-		throw new Error(`[devframe/mcp] unknown resource URI "${uri}"`);
-	});
-}
-function projectTool(tool, ctx) {
-	const inputSchema = tool.inputSchema ?? computeInputSchema(tool, ctx);
-	const outputSchema = tool.outputSchema ?? computeOutputSchema(tool, ctx);
-	return {
-		name: tool.id,
-		title: tool.title,
-		description: tool.description,
-		inputSchema,
-		...outputSchema ? { outputSchema } : {},
-		annotations: {
-			title: tool.title,
-			readOnlyHint: tool.safety === "read",
-			destructiveHint: tool.safety === "destructive"
-		}
-	};
-}
-function computeInputSchema(tool, ctx) {
-	if (tool.kind !== "rpc" || !tool.rpcName) return {
-		type: "object",
-		properties: {}
-	};
-	const def = ctx.rpc.definitions.get(tool.rpcName);
-	if (!def) return {
-		type: "object",
-		properties: {}
-	};
-	const args = def.args;
-	return valibotArgsToJsonSchema(args).schema;
-}
-function computeOutputSchema(tool, ctx) {
-	if (tool.kind !== "rpc" || !tool.rpcName) return void 0;
-	const def = ctx.rpc.definitions.get(tool.rpcName);
-	if (!def) return void 0;
-	return valibotReturnToJsonSchema(def.returns);
-}
-function parseResourceUri(uri) {
-	const match = uri.match(/^devframe:\/\/(resource|state)\/(.+)$/);
-	if (!match) return { kind: "unknown" };
-	const [, kind, rest] = match;
-	const decoded = decodeURIComponent(rest);
-	if (kind === "resource") return {
-		kind: "resource",
-		id: decoded
-	};
-	return {
-		kind: "state",
-		key: decoded
-	};
-}
-//#endregion
-export { createMcpServer as n, buildMcpServerFromContext as t };