vibeshare-live 0.1.1 → 0.2.1

package/dist/index.d.ts

@@ -1,61 +1,120 @@
-export { a as AccessGate, b as AccessGateOptions, A as AccessMode, C as ConsentError, c as ControlRequestResult, D as DEFAULT_ACCESS, d as DenialReason, E as ExpirySpec, H as HOST_PARTICIPANT_NAME, R as RevokeReason, S as SHARE_SESSION_SCOPE, e as ShareHandle, f as ShareOptions, V as Viewer, g as ViewerRole, h as ViewerRoster, i as createAccessGate, j as createShare, p as parseExpiry } from './share-t_zYXkQB.js';
-import 'vibelive';
-import '@pooriaarab/vibe-core';
+import { ConsentStore, ConsentGrant, ConsentLedger } from '@pooriaarab/vibe-core';
+import { S as ShareTransport, a as Share, b as SessionFeed, V as ViewerRegistry, C as CreateShareOptions, c as ShareManager, d as CreatedShare } from './manager-uhMBJXtu.js';
+export { e as ConsentRequiredError, F as FeedEntry, J as JoinRequestStatus, P as PublishOptions, f as SHARE_SCOPE, g as ShareAccess, h as ShareError, i as ShareErrorCode, j as ShareManagerDeps, k as ShareState, l as Viewer, m as ViewerRole } from './manager-uhMBJXtu.js';
+import 'node:events';
 
-/** vibeshare package version (single source of truth for CLI + MCP). */
-declare const VERSION = "0.1.0";
+interface LocalHttpTransportOptions {
+    /** Bind address. Default 127.0.0.1 (loopback-only). Use 0.0.0.0 for LAN. */
+    readonly host?: string;
+    /** Port. Default 0 = ephemeral. */
+    readonly port?: number;
+    /**
+     * Public base URL to print instead of `http://host:port` — the seam where
+     * a future RelayTransport hands out `https://vibeshare.io` URLs. Routing
+     * still happens locally.
+     */
+    readonly baseUrl?: string;
+    /** Bearer token for the loopback control API. Generated when omitted. */
+    readonly hostToken?: string;
+    /**
+     * Called when the control API asks to stop a share (e.g. `vibeshare stop`
+     * from another process). When absent, the transport unserves + closes the
+     * feed itself.
+     */
+    readonly onStopRequested?: (shareId: string) => void;
+}
+declare class LocalHttpTransport implements ShareTransport {
+    #private;
+    readonly kind = "local-http";
+    readonly hostToken: string;
+    constructor(opts?: LocalHttpTransportOptions);
+    /** Bind the listener. Must be called before serve(). Idempotent. */
+    listen(): Promise<void>;
+    /** The port actually bound (useful with port 0). */
+    get port(): number;
+    serve(share: Share, feed: SessionFeed, viewers: ViewerRegistry): Promise<string>;
+    unserve(shareId: string): Promise<void>;
+    close(): Promise<void>;
+    /** Number of shares currently served (diagnostics/tests). */
+    get shareCount(): number;
+}
+
+declare function vibeHome(): string;
+/** Durable ConsentStore backing the vibe-core consent ledger. */
+declare class FileConsentStore implements ConsentStore {
+    readonly file: string;
+    constructor(file?: string);
+    load(): ConsentGrant[];
+    save(grants: ConsentGrant[]): void;
+}
+/** A consent ledger backed by the host's `~/.vibeshare/consent.json`. */
+declare function loadLedger(store?: ConsentStore): ConsentLedger;
 
 /**
- * The URL / capability-id layer of vibeshare.
- *
- * Pure logic — no IO — so every function here is directly unit-tested in
- * `src/url.test.ts`. A share link is a **capability URL**: the id is the only
- * thing that grants access, so it must be unguessable. The human-facing host is
- * vibeshare's own domain (`vibeshare.stream`); the actual transport is the
- * local/LAN ws relay owned by vibelive, which the URL only *represents*.
- */
-/**
- * The display origin for vibeshare share links. This is vibeshare's OWN domain —
- * not vibe.live — so a shared link reads as vibeshare even though the bytes flow
- * over a self-hostable e2e relay (see docs/spec.md · "its OWN domain, not
- * vibe.live").
+ * The web spectator view: a minimal, self-contained read-only client served
+ * straight from the host machine — no install, no build, no external assets
+ * (local-first holds for viewers too; the page phones nowhere).
  */
-declare const SHARE_ORIGIN = "https://vibeshare.stream";
-/** Path prefix for share links: `<origin>/s/<id>`. */
-declare const SHARE_PATH_PREFIX = "/s/";
+
+declare function spectatorPage(share: Share): string;
+
+/** A 12-char base64url id (72 bits of entropy) — unguessable, URL-safe. */
+declare function newShareId(): string;
+/** A random hex token (viewer bearer tokens, host control token). */
+declare function newToken(bytes?: number): string;
 /**
- * Mint an unguessable capability id. Uses the platform CSPRNG (`crypto.randomUUID`,
- * 122 bits of entropy) so a link is a genuine capability — guessing it is
- * infeasible, which is the whole basis of the access model.
+ * Parse an expiry spec into milliseconds.
+ *   'stop' | 'never'  → null (lasts until explicitly stopped)
+ *   '<n>m' | '<n>h' | '<n>d' → that duration ('1h', '24h', '7d', …)
+ * Anything else throws — callers (CLI) turn this into a usage error.
  */
-declare function newShareId(): string;
+declare function parseExpiry(spec: string): number | null;
+/** Hash a passphrase for storage: `scrypt$<saltHex>$<hashHex>`. */
+declare function hashPassphrase(passphrase: string): string;
+/** Verify a candidate against a stored `scrypt$…` hash, timing-safe. */
+declare function verifyPassphrase(passphrase: string, stored: string): boolean;
+
+declare const VERSION = "0.1.0";
+
 /**
- * Build the human-facing share URL for a capability id.
+ * vibeshare — npm library surface.
  *
- * The URL is for *display and parsing only* — opening it resolves to the
- * vibeshare spectator view, which then connects to the host's local/LAN relay.
- * The relay URL is carried out-of-band (printed next to the share URL by the CLI).
+ * ```ts
+ * import { createShare, grantConsent } from 'vibeshare';
+ *
+ * grantConsent('share this session from my app');   // once, recorded locally
+ * const { url, feed, viewers, revoke } = await createShare({
+ *   session: 'npm test',
+ *   access: 'spectate',
+ *   expiry: '1h',
+ * });
+ * feed.publish('tests starting…');
+ * await revoke();
+ * ```
+ *
+ * Consent is enforced by the vibe-core ledger: no `share:session` grant →
+ * `createShare` throws `ConsentRequiredError`. The default transport serves
+ * the spectator view + stream from this machine; the relay/p2p seam is the
+ * `ShareTransport` interface (see transport.ts).
  */
-declare function buildShareUrl(id: string, origin?: string): string;
-/** Error thrown when a string cannot be parsed as a vibeshare share URL. */
-declare class ShareUrlParseError extends Error {
-    constructor(message: string);
+
+interface CreateShareLibraryOptions extends CreateShareOptions {
+    /** Serve on a specific consent ledger (default: ~/.vibeshare file ledger). */
+    readonly consent?: ConsentLedger;
+    /** Transport options for the default local transport (host, port, baseUrl). */
+    readonly transport?: LocalHttpTransportOptions;
+    /** Bring your own manager (tests, embedders) instead of the shared default. */
+    readonly manager?: ShareManager;
 }
 /**
- * Parse a vibeshare share URL (or bare `/s/<id>` path) back into its capability id.
- *
- * Accepts:
- *   - full URLs: `https://vibeshare.stream/s/<id>`, `http://...`, with or without
- *     a trailing slash or query string;
- *   - bare paths: `/s/<id>`;
- *   - any origin host (we key off the `/s/` segment, not the host, so self-hosted
- *     / vanity domains round-trip too).
+ * Create a share → `{share, url, feed, viewers, revoke}`.
  *
- * Pure and total: throws {@link ShareUrlParseError} on input with no `/s/` segment.
- * Round-trips {@link buildShareUrl}: `parseShareUrl(buildShareUrl(id)).id === id`.
+ * @throws ConsentRequiredError when the ledger has no `share:session` grant.
  */
-declare function parseShareUrl(url: string): {
-    readonly id: string;
-};
+declare function createShare(opts?: CreateShareLibraryOptions): Promise<CreatedShare>;
+/** Grant the `share:session` scope on the host's local consent ledger. */
+declare function grantConsent(note?: string): void;
+/** Revoke the `share:session` scope. */
+declare function revokeConsent(): void;
 
-export { SHARE_ORIGIN, SHARE_PATH_PREFIX, ShareUrlParseError, VERSION, buildShareUrl, newShareId, parseShareUrl };
+export { type CreateShareLibraryOptions, CreateShareOptions, CreatedShare, FileConsentStore, LocalHttpTransport, type LocalHttpTransportOptions, SessionFeed, Share, ShareManager, ShareTransport, VERSION, ViewerRegistry, createShare, grantConsent, hashPassphrase, loadLedger, newShareId, newToken, parseExpiry, revokeConsent, spectatorPage, verifyPassphrase, vibeHome };

package/dist/index.js

@@ -1,32 +1,63 @@
 import {
-  ConsentError,
-  DEFAULT_ACCESS,
-  HOST_PARTICIPANT_NAME,
-  SHARE_ORIGIN,
-  SHARE_PATH_PREFIX,
-  SHARE_SESSION_SCOPE,
-  ShareUrlParseError,
+  ConsentRequiredError,
+  FileConsentStore,
+  LocalHttpTransport,
+  SHARE_SCOPE,
+  SessionFeed,
+  ShareError,
+  ShareManager,
   VERSION,
-  buildShareUrl,
-  createAccessGate,
-  createShare,
+  ViewerRegistry,
+  hashPassphrase,
+  loadLedger,
   newShareId,
+  newToken,
   parseExpiry,
-  parseShareUrl
-} from "./chunk-SBAGPPGC.js";
+  spectatorPage,
+  verifyPassphrase,
+  vibeHome
+} from "./chunk-RY2ANOPC.js";
+
+// src/index.ts
+import "@pooriaarab/vibe-core";
+var defaultManager = null;
+function getDefaultManager(transportOpts) {
+  defaultManager ??= new ShareManager({
+    consent: loadLedger(),
+    transport: new LocalHttpTransport(transportOpts)
+  });
+  return defaultManager;
+}
+async function createShare(opts = {}) {
+  const manager = opts.manager ?? (opts.consent ? new ShareManager({ consent: opts.consent, transport: new LocalHttpTransport(opts.transport) }) : getDefaultManager(opts.transport));
+  const { consent: _c, transport: _t, manager: _m, ...shareOpts } = opts;
+  return manager.createShare(shareOpts);
+}
+function grantConsent(note) {
+  loadLedger().grant(SHARE_SCOPE, note ?? "granted via vibeshare library");
+}
+function revokeConsent() {
+  loadLedger().revoke(SHARE_SCOPE);
+}
 export {
-  ConsentError,
-  DEFAULT_ACCESS,
-  HOST_PARTICIPANT_NAME,
-  SHARE_ORIGIN,
-  SHARE_PATH_PREFIX,
-  SHARE_SESSION_SCOPE,
-  ShareUrlParseError,
+  ConsentRequiredError,
+  FileConsentStore,
+  LocalHttpTransport,
+  SHARE_SCOPE,
+  SessionFeed,
+  ShareError,
+  ShareManager,
   VERSION,
-  buildShareUrl,
-  createAccessGate,
+  ViewerRegistry,
   createShare,
+  grantConsent,
+  hashPassphrase,
+  loadLedger,
   newShareId,
+  newToken,
   parseExpiry,
-  parseShareUrl
+  revokeConsent,
+  spectatorPage,
+  verifyPassphrase,
+  vibeHome
 };

package/dist/manager-uhMBJXtu.d.ts

@@ -0,0 +1,259 @@
+import { VibeEvent, ConsentLedger } from '@pooriaarab/vibe-core';
+import { EventEmitter } from 'node:events';
+
+/**
+ * vibeshare — shared types.
+ *
+ * vibeshare is the URL / identity / access layer for sharing a live agent
+ * coding session. It owns the *link and the gate*; the session content is an
+ * ordered feed of entries that spectators receive live. vibelive (the
+ * multiplayer engine) owns any future collaborator write path — see
+ * `transport.ts` for that seam.
+ */
+/** Access policy for a share link. */
+type ShareAccess = 
+/** Recipients can only watch. Genuinely read-only: there is no write route. */
+'spectate'
+/** Recipients may request to join; host approval promotes them to collaborator. */
+ | 'invite';
+type ShareState = 'live' | 'revoked' | 'expired';
+/** A live (or formerly live) share link. */
+interface Share {
+    /** Unguessable capability id — appears in the URL. */
+    readonly id: string;
+    /** Human label, e.g. the command being shared or the agent name. */
+    readonly name: string;
+    access: ShareAccess;
+    readonly createdAt: string;
+    /** ISO timestamp, or null when the share lasts "until I stop". */
+    readonly expiresAt: string | null;
+    state: ShareState;
+    /** scrypt hash (`scrypt$<salt>$<hash>`); never the plaintext passphrase. */
+    readonly passphraseHash: string | null;
+}
+type ViewerRole = 'spectator' | 'collaborator';
+type JoinRequestStatus = 'none' | 'pending' | 'approved' | 'denied';
+/** Someone who opened the link and joined as a viewer. */
+interface Viewer {
+    readonly id: string;
+    name: string;
+    role: ViewerRole;
+    /** Bearer token issued at join; required for stream/request/leave calls. */
+    readonly token: string;
+    readonly joinedAt: string;
+    joinRequest: JoinRequestStatus;
+}
+/** One entry in the shared session's ordered log. */
+interface FeedEntry {
+    /** Monotonic sequence number — also the SSE event id. */
+    readonly seq: number;
+    readonly ts: number;
+    readonly type: 'output' | 'milestone' | 'system';
+    /** Which host stream produced an `output` entry. */
+    readonly stream?: 'stdout' | 'stderr';
+    readonly text: string;
+}
+/** Options for creating a share (CLI, library, and MCP all funnel here). */
+interface CreateShareOptions {
+    /** Label for what is being shared (command line, agent name, …). */
+    readonly session?: string;
+    /** Access policy. Default `'spectate'`. */
+    readonly access?: ShareAccess;
+    /**
+     * How long the link lives: `'1h'`, `'24h'`, `'stop'` (until stopped), or
+     * any `<n>m` / `<n>h` / `<n>d`. Default `'stop'`.
+     */
+    readonly expiry?: string;
+    /** Passphrase second factor. Optional; stored only as a scrypt hash. */
+    readonly passphrase?: string;
+    /** Override the display name (defaults to `session`). */
+    readonly name?: string;
+    /**
+     * Direct millisecond expiry override (takes precedence over `expiry`).
+     * Mainly for tests and embedders that already hold a duration.
+     */
+    readonly expiryMs?: number;
+}
+/** vibeshare error with a machine-readable code (mapped to HTTP by transports). */
+declare class ShareError extends Error {
+    readonly code: ShareErrorCode;
+    constructor(code: ShareErrorCode, message: string);
+}
+type ShareErrorCode = 'not-live' | 'not-found' | 'passphrase-required' | 'passphrase-invalid' | 'invite-disabled' | 'already-pending' | 'not-pending' | 'consent-required' | 'bad-request';
+
+/**
+ * SessionFeed — the ordered log of everything a share broadcasts.
+ *
+ * The host (and only the host) publishes; spectators subscribe. Late joiners
+ * get a bounded replay of recent entries, then live entries in order. This is
+ * vibeshare's half of vibelive's "ordered-log channel": the log is the source
+ * of record, held on the host machine only.
+ */
+
+interface PublishOptions {
+    readonly type?: FeedEntry['type'];
+    readonly stream?: FeedEntry['stream'];
+}
+declare interface SessionFeed {
+    on(event: 'entry', listener: (entry: FeedEntry) => void): this;
+    on(event: 'close', listener: () => void): this;
+    once(event: 'close', listener: () => void): this;
+}
+declare class SessionFeed extends EventEmitter {
+    #private;
+    constructor(capacity?: number);
+    get closed(): boolean;
+    /** Append a line to the log and fan it out to subscribers. */
+    publish(text: string, opts?: PublishOptions): FeedEntry;
+    /** Publish a normalized vibe-core milestone event as a feed line. */
+    publishEvent(e: VibeEvent): FeedEntry;
+    /** Publish a host-side status line (share opened, viewer joined, …). */
+    system(text: string): FeedEntry;
+    /** Recent entries for late-joiner replay, oldest first. */
+    backlog(): readonly FeedEntry[];
+    /** Subscribe to live entries. Returns an unsubscribe function. */
+    subscribe(listener: (entry: FeedEntry) => void): () => void;
+    /** End the feed: notifies subscribers, refuses further publishes. */
+    close(): void;
+}
+
+/**
+ * ViewerRegistry — who is watching a share, and who may write.
+ *
+ * Write-arbitration invariant (shared with vibelive §4): the host is the
+ * server of record, and `canWrite()` is the single gate any input path must
+ * consult. A spectator can never pass it; promotion happens only through a
+ * host-approved join request on an `invite`-access share. v0 exposes no
+ * remote input route at all — the gate exists so the vibelive handoff has
+ * exactly one choke point when it lands.
+ */
+
+interface RegistryEvents {
+    join: (v: Viewer) => void;
+    leave: (v: Viewer) => void;
+    request: (v: Viewer) => void;
+    approve: (v: Viewer) => void;
+    deny: (v: Viewer) => void;
+    kick: (v: Viewer) => void;
+}
+declare interface ViewerRegistry {
+    on<K extends keyof RegistryEvents>(event: K, listener: RegistryEvents[K]): this;
+}
+declare class ViewerRegistry extends EventEmitter {
+    #private;
+    constructor(getAccess: () => ShareAccess);
+    /** Register a new spectator. Everyone enters read-only — no exceptions. */
+    add(name?: string): Viewer;
+    get(id: string): Viewer | undefined;
+    getByToken(token: string): Viewer | undefined;
+    list(): Viewer[];
+    count(): number;
+    /**
+     * A spectator asks to be promoted to collaborator. Only possible on an
+     * `invite`-access share; the host still has to approve.
+     */
+    requestJoin(id: string): Viewer;
+    /** Host approves a pending request → the viewer becomes a collaborator. */
+    approve(id: string): Viewer;
+    /** Host denies a pending request; the viewer stays a spectator. */
+    deny(id: string): Viewer;
+    /** Remove a viewer entirely (their streams are closed by the transport). */
+    kick(id: string): Viewer;
+    /** A viewer leaves on their own. */
+    leave(id: string): void;
+    /**
+     * The write-arbitration gate. The host writes by definition; a remote
+     * participant writes only as an approved collaborator. Any future input
+     * channel (vibelive cursors, shared terminal input) MUST consult this.
+     */
+    canWrite(viewerId: string): boolean;
+}
+
+/**
+ * ShareTransport — the one seam vibeshare deliberately leaves open.
+ *
+ * vibeshare owns the link + the gate. How feed bytes reach viewers is a
+ * pluggable transport behind this interface:
+ *
+ *   - `LocalHttpTransport` (implemented, the default): serves the spectator
+ *     web view + an SSE stream directly from the host machine over
+ *     loopback/LAN. Fully local-first — bytes go straight from host to
+ *     viewer; nothing is stored on any server.
+ *
+ *   - `RelayTransport` (NOT implemented — lands with vibelive): a dumb,
+ *     e2e-encrypted relay that forwards opaque blobs so viewers behind NAT
+ *     can reach the host, returning a public `https://vibeshare.io/s/<id>`
+ *     URL. The relay never sees plaintext and stores nothing; vibelive owns
+ *     the encryption and the p2p mesh. Everything in vibeshare (access
+ *     policy, consent, the viewer registry, write-arbitration) is transport-
+ *     agnostic and already works — swapping this interface in is the only
+ *     change a relay requires.
+ *
+ * The collaborator *input* channel is part of the same vibelive seam: a
+ * transport that accepts remote input MUST route it through
+ * `ViewerRegistry.canWrite()` before applying anything to the session.
+ */
+
+interface ShareTransport {
+    /** Transport label for diagnostics, e.g. 'local-http'. */
+    readonly kind: string;
+    /**
+     * Begin serving a share. Returns the URL viewers open. Called once per
+     * share; a transport may serve many shares concurrently.
+     */
+    serve(share: Share, feed: SessionFeed, viewers: ViewerRegistry): Promise<string>;
+    /**
+     * Stop serving one share: disconnect its viewers and make its URL answer
+     * as gone. Idempotent.
+     */
+    unserve(shareId: string): Promise<void>;
+    /** Tear the whole transport down (all shares, listeners, sockets). */
+    close(): Promise<void>;
+}
+
+/**
+ * ShareManager — creates, tracks, expires, and revokes shares.
+ *
+ * The consent ledger from @pooriaarab/vibe-core is the enforcement point for
+ * local-first: no grant for the `share:session` scope → no share. Expiry is
+ * enforced here with real timers that tear the share down (the transport
+ * disconnects viewers and the URL goes 410) — not just a filter on reads.
+ */
+
+/** The consent scope the suite reserves for sharing features. */
+declare const SHARE_SCOPE = "share:session";
+declare class ConsentRequiredError extends ShareError {
+    constructor();
+}
+interface CreatedShare {
+    readonly share: Share;
+    /** The URL viewers open. */
+    readonly url: string;
+    readonly feed: SessionFeed;
+    readonly viewers: ViewerRegistry;
+    /** End the share now (same as manager.revokeShare(share.id)). */
+    revoke(): Promise<void>;
+}
+interface ShareManagerDeps {
+    readonly consent: ConsentLedger;
+    readonly transport: ShareTransport;
+}
+declare class ShareManager {
+    #private;
+    constructor(deps: ShareManagerDeps);
+    /**
+     * Create a share: `createShare({session, access, expiry, passphrase})`
+     * → `{share, url, feed, viewers, revoke}`.
+     *
+     * @throws ConsentRequiredError when the ledger has no `share:session` grant.
+     */
+    createShare(opts?: CreateShareOptions): Promise<CreatedShare>;
+    /** End a share: disconnect viewers, 410 the URL, close the feed. */
+    revokeShare(id: string, reason?: 'revoked' | 'expired'): Promise<void>;
+    get(id: string): CreatedShare | undefined;
+    list(): CreatedShare[];
+    /** Revoke every live share and close the transport. */
+    stopAll(): Promise<void>;
+}
+
+export { type CreateShareOptions as C, type FeedEntry as F, type JoinRequestStatus as J, type PublishOptions as P, type ShareTransport as S, ViewerRegistry as V, type Share as a, SessionFeed as b, ShareManager as c, type CreatedShare as d, ConsentRequiredError as e, SHARE_SCOPE as f, type ShareAccess as g, ShareError as h, type ShareErrorCode as i, type ShareManagerDeps as j, type ShareState as k, type Viewer as l, type ViewerRole as m };

package/dist/mcp.d.ts

@@ -1,41 +1,30 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { RelayHandle } from 'vibelive';
-import { e as ShareHandle } from './share-t_zYXkQB.js';
-import '@pooriaarab/vibe-core';
+#!/usr/bin/env node
+import { ConsentLedger } from '@pooriaarab/vibe-core';
+import { c as ShareManager } from './manager-uhMBJXtu.js';
+import 'node:events';
 
-/**
- * vibeshare MCP server (stdio). Exposes two tools an agent can call:
- *
- *   - create_share  — host a vibelive session wrapping a command, mint a share URL
- *                     with an access policy (+ optional expiry/passphrase), and
- *                     return the capability URL + relay URL. Lives for the MCP
- *                     process lifetime (or until the wrapped agent exits).
- *   - viewers       — list active shares and their viewer rosters (connected
- *                     spectators/participants + pending join requests).
- *
- * Uses the high-level `McpServer` API from `@modelcontextprotocol/sdk`. Input
- * schemas are Zod raw shapes (the SDK's expected form); zod is a transitive
- * dependency of the SDK and gets bundled into dist/mcp.js by tsup.
- */
-
-interface ActiveShare {
-    readonly id: string;
-    readonly url: string;
-    readonly relayUrl: string;
-    readonly access: string;
-    readonly command: readonly string[];
-    readonly share: ShareHandle;
-    readonly relay: RelayHandle;
+interface JsonRpcRequest {
+    jsonrpc?: string;
+    id?: string | number | null;
+    method?: string;
+    params?: Record<string, unknown>;
+}
+interface JsonRpcResponse {
+    jsonrpc: '2.0';
+    id: string | number | null;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+    };
+}
+interface McpServerDeps {
+    manager: ShareManager;
+    consent: ConsentLedger;
+}
+interface McpServer {
+    handleMessage(msg: JsonRpcRequest): Promise<JsonRpcResponse | null>;
 }
-/**
- * Build the vibeshare MCP server (tools registered, not yet connected).
- *
- * `sessions` defaults to a fresh module-level map so independent `createMcpServer`
- * calls don't share state, but a single stdio process keeps one map for its
- * lifetime (so `viewers` sees shares started via `create_share`).
- */
-declare function createMcpServer(sessions?: Map<string, ActiveShare>): McpServer;
-/** Create the server, wire it to stdio, and run until the client disconnects. */
-declare function runMcpStdio(): Promise<void>;
+declare function createMcpServer(deps: McpServerDeps): McpServer;
 
-export { createMcpServer, runMcpStdio };
+export { type McpServer, type McpServerDeps, createMcpServer };