webmcp-codegen 0.0.1 → 0.2.0

package/dist/cli.js

@@ -0,0 +1,270 @@
+#!/usr/bin/env node
+import {
+  CONFIG_FILE_NAMES,
+  loadConfig,
+  runGenerate
+} from "./chunk-R3DEBBQ3.js";
+import {
+  js
+} from "./chunk-GDJDVR4E.js";
+import {
+  openapi
+} from "./chunk-WYGVTIGI.js";
+import "./chunk-BIKKPCRT.js";
+import "./chunk-5L4KN6F4.js";
+
+// src/cli.ts
+import { existsSync, watch } from "fs";
+import { writeFile } from "fs/promises";
+import { basename, join as join2, relative as relative2 } from "path";
+import { parseArgs } from "util";
+
+// src/detect.ts
+import { readdir } from "fs/promises";
+import { join, relative } from "path";
+var SPEC_FILE_PATTERN = /^(openapi|swagger|api)\.(ya?ml|json)$/i;
+var IGNORED_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  ".turbo",
+  ".next",
+  "dist",
+  "build",
+  "coverage"
+]);
+var MAX_DEPTH = 5;
+async function findSpecs(cwd) {
+  const found = [];
+  async function walk(dir, depth) {
+    if (depth > MAX_DEPTH) return;
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (!IGNORED_DIRS.has(entry.name)) await walk(join(dir, entry.name), depth + 1);
+      } else if (SPEC_FILE_PATTERN.test(entry.name)) {
+        found.push({ path: join(dir, entry.name), depth });
+      }
+    }
+  }
+  await walk(cwd, 0);
+  return found.sort((a, b) => a.depth - b.depth).map((entry) => relative(cwd, entry.path));
+}
+
+// src/cli.ts
+var HELP = `webmcp-codegen \u2014 generate WebMCP tools from the API contracts you already have
+
+Fastest start (no install, no config):
+  npx webmcp-codegen generate --dry-run   Detect your spec, preview the tools
+  npx webmcp-codegen generate             Write the tool files
+
+Commands:
+  init                         Write a codegen.config.mjs for full control
+  generate                     Generate (or update) your WebMCP tools
+  generate --watch             Re-generate when files change
+
+Flags for generate:
+  --spec PATH    Which OpenAPI spec to use (auto-detected when omitted)
+  --out DIR      Where the tool files go (default: ./src/webmcp)
+  --dry-run      Preview what would be written, write nothing
+  --skip-audit   Skip the safety report
+  --force        Write files even when the audit reports errors
+  --config PATH  Use a config file at PATH
+`;
+var CONFIG_FILE = "codegen.config.mjs";
+async function main() {
+  const { positionals, values } = parseArgs({
+    allowPositionals: true,
+    options: {
+      "dry-run": { type: "boolean", default: false },
+      "skip-audit": { type: "boolean", default: false },
+      force: { type: "boolean", default: false },
+      watch: { type: "boolean", default: false },
+      config: { type: "string" },
+      spec: { type: "string" },
+      out: { type: "string" },
+      help: { type: "boolean", default: false }
+    }
+  });
+  const command = positionals[0];
+  if (values.help || !command) {
+    console.log(HELP);
+    return 0;
+  }
+  switch (command) {
+    case "init":
+      return init();
+    case "generate":
+      return generate({
+        dryRun: values["dry-run"],
+        skipAudit: values["skip-audit"],
+        force: values.force,
+        watch: values.watch,
+        configPath: values.config,
+        spec: values.spec,
+        out: values.out
+      });
+    default:
+      console.error(`Unknown command "${command}".
+`);
+      console.log(HELP);
+      return 1;
+  }
+}
+async function init() {
+  const cwd = process.cwd();
+  const configPath = join2(cwd, CONFIG_FILE);
+  if (existsSync(configPath)) {
+    console.error(`${CONFIG_FILE} already exists \u2014 nothing to do.`);
+    return 1;
+  }
+  const specs = await findSpecs(cwd);
+  const specPath = specs.length > 0 ? `./${specs[0]}` : "./openapi.yaml";
+  await writeFile(
+    configPath,
+    `import { defineConfig } from "webmcp-codegen";
+import { openapi } from "webmcp-codegen/sources";
+import { js } from "webmcp-codegen/generators";
+
+export default defineConfig({
+  sources: [openapi({ spec: "${specPath}" })],
+  generate: [js({ outDir: "./src/webmcp" })],
+  safety: {
+    // Extra field names to treat as PII, on top of the built-in list:
+    // piiFields: ["internalId"],
+    // Tools to skip entirely (matched against name and route):
+    // exclude: ["internal"],
+  },
+});
+`
+  );
+  console.log("Installed the package? A config file needs it:");
+  console.log("  npm install -D webmcp-codegen\n");
+  if (specs.length > 0) {
+    console.log(`Found ${specs[0]} \u2014 wrote ${CONFIG_FILE}.`);
+    console.log("\nNext: npx webmcp-codegen generate --dry-run");
+  } else {
+    console.log(`No OpenAPI spec found, so ${CONFIG_FILE} points at ./openapi.yaml.`);
+    console.log("Edit the `spec` path to point at your spec, then run:");
+    console.log("\n  npx webmcp-codegen generate --dry-run");
+  }
+  return 0;
+}
+async function generate(flags) {
+  const cwd = process.cwd();
+  if (flags.watch) {
+    await watchLoop(cwd, flags);
+    return 0;
+  }
+  const result = await runOnce(cwd, flags);
+  return result.blocked ? 1 : 0;
+}
+async function resolveConfig(cwd, flags) {
+  const hasConfigFile = flags.configPath ? existsSync(join2(cwd, flags.configPath)) : CONFIG_FILE_NAMES.some((name) => existsSync(join2(cwd, name)));
+  if (hasConfigFile) {
+    const { config, path } = await loadConfig(cwd, flags.configPath);
+    if (flags.spec || flags.out) {
+      console.warn(`Note: --spec/--out are ignored \u2014 ${basename(path)} is in charge here.`);
+    }
+    return { config, label: basename(path) };
+  }
+  if (flags.configPath) {
+    throw new Error(`No config file at "${flags.configPath}".`);
+  }
+  const spec = flags.spec ?? await detectSpec(cwd);
+  const outDir = flags.out ?? "./src/webmcp";
+  return {
+    config: { sources: [openapi({ spec })], generate: [js({ outDir })] },
+    label: flags.spec ? `--spec ${spec}` : `detected ${spec}`
+  };
+}
+async function detectSpec(cwd) {
+  const specs = await findSpecs(cwd);
+  if (specs.length === 0) {
+    throw new Error(
+      "No OpenAPI spec found in this project.\nPoint at one:  npx webmcp-codegen generate --spec path/to/openapi.json"
+    );
+  }
+  if (specs.length > 1) {
+    const list = specs.map((spec) => `  - ${spec}`).join("\n");
+    throw new Error(
+      `Found ${specs.length} API specs:
+${list}
+
+Pick one:  npx webmcp-codegen generate --spec ${specs[0]}`
+    );
+  }
+  console.log(`Detected ${specs[0]} (override with --spec)
+`);
+  return specs[0];
+}
+async function runOnce(cwd, flags) {
+  const { config, label } = await resolveConfig(cwd, flags);
+  const result = await runGenerate(config, {
+    cwd,
+    dryRun: flags.dryRun,
+    skipAudit: flags.skipAudit,
+    force: flags.force
+  });
+  printReport(result, flags, label, cwd);
+  return result;
+}
+function printReport(result, flags, configName, cwd) {
+  const { tools, findings, files, blocked } = result;
+  console.log(`
+webmcp-codegen (${configName}) \u2014 ${tools.length} tool(s)
+`);
+  for (const tool of tools) {
+    console.log(`  ${tool.name}  [${tool.riskTier}]  \u2190 ${tool.source.ref}`);
+  }
+  if (findings.length > 0) {
+    console.log("");
+    for (const finding of findings) {
+      const icon = finding.level === "error" ? "\u2716" : "\u26A0";
+      const where = finding.tool ? ` (${finding.tool})` : "";
+      console.log(`  ${icon} ${finding.message}${where}`);
+    }
+  }
+  if (files.length > 0) {
+    console.log("");
+    for (const file of files) {
+      if (file.action === "unchanged" && !file.conflict) continue;
+      const shown = file.conflict ? `conflict \u2192 wrote ${relative2(cwd, file.conflict)}` : file.action;
+      console.log(`  ${shown}: ${relative2(cwd, file.path)}`);
+    }
+  }
+  if (blocked) {
+    console.log(
+      "\nGeneration blocked by audit errors. Fix them, or re-run with --force to write anyway."
+    );
+  } else if (flags.dryRun) {
+    console.log("\nDry run \u2014 nothing written. Re-run without --dry-run to write these files.");
+  } else {
+    console.log("\nDone. Fill in each execute() below the marker, then registerAllTools().");
+  }
+}
+async function watchLoop(cwd, flags) {
+  await runOnce(cwd, { ...flags, dryRun: false });
+  console.log("\nWatching for changes\u2026 (Ctrl+C to stop)");
+  let timer;
+  watch(cwd, { recursive: true }, (_event, filename) => {
+    if (!filename) return;
+    if (/node_modules|\.git|\/dist|\/src\/webmcp/.test(filename)) return;
+    if (!/\.(ya?ml|json|ts|tsx|mts|mjs)$/.test(filename)) return;
+    clearTimeout(timer);
+    timer = setTimeout(() => {
+      runOnce(cwd, { ...flags, dryRun: false }).catch((error) => {
+        console.error(error instanceof Error ? error.message : error);
+      });
+    }, 300);
+  });
+}
+main().then((code) => process.exit(code)).catch((error) => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli.ts","../src/detect.ts"],"sourcesContent":["#!/usr/bin/env node\n\n/**\n * The webmcp-codegen CLI.\n *\n * The path we optimize for is the zero-everything first run:\n *\n *   npx webmcp-codegen generate\n *\n * No install, no config file, no flags — the CLI detects your API spec and\n * generates into ./src/webmcp. When you outgrow the defaults:\n *\n *   --spec/--out    quick overrides without a config file\n *   init            writes codegen.config.mjs for full control (needs the\n *                   package installed, since the config imports from it)\n *\n * Plus the flags you'd expect on a codegen tool: --dry-run to preview,\n * --watch to re-run on change, --skip-audit to bypass the safety report,\n * --force to write through audit errors, --config to point at a config\n * file somewhere else.\n */\n\nimport { existsSync, watch } from \"node:fs\";\nimport { writeFile } from \"node:fs/promises\";\nimport { basename, join, relative } from \"node:path\";\nimport { parseArgs } from \"node:util\";\nimport { CONFIG_FILE_NAMES, loadConfig } from \"./config.js\";\nimport { findSpecs } from \"./detect.js\";\nimport { js } from \"./generators/js.js\";\nimport { type GenerateResult, runGenerate } from \"./pipeline.js\";\nimport { openapi } from \"./sources/openapi.js\";\nimport type { CodegenConfig } from \"./types.js\";\n\nconst HELP = `webmcp-codegen — generate WebMCP tools from the API contracts you already have\n\nFastest start (no install, no config):\n  npx webmcp-codegen generate --dry-run   Detect your spec, preview the tools\n  npx webmcp-codegen generate             Write the tool files\n\nCommands:\n  init                         Write a codegen.config.mjs for full control\n  generate                     Generate (or update) your WebMCP tools\n  generate --watch             Re-generate when files change\n\nFlags for generate:\n  --spec PATH    Which OpenAPI spec to use (auto-detected when omitted)\n  --out DIR      Where the tool files go (default: ./src/webmcp)\n  --dry-run      Preview what would be written, write nothing\n  --skip-audit   Skip the safety report\n  --force        Write files even when the audit reports errors\n  --config PATH  Use a config file at PATH\n`;\n\nconst CONFIG_FILE = \"codegen.config.mjs\";\n\nasync function main(): Promise<number> {\n  const { positionals, values } = parseArgs({\n    allowPositionals: true,\n    options: {\n      \"dry-run\": { type: \"boolean\", default: false },\n      \"skip-audit\": { type: \"boolean\", default: false },\n      force: { type: \"boolean\", default: false },\n      watch: { type: \"boolean\", default: false },\n      config: { type: \"string\" },\n      spec: { type: \"string\" },\n      out: { type: \"string\" },\n      help: { type: \"boolean\", default: false },\n    },\n  });\n\n  const command = positionals[0];\n  if (values.help || !command) {\n    console.log(HELP);\n    return 0;\n  }\n\n  switch (command) {\n    case \"init\":\n      return init();\n    case \"generate\":\n      return generate({\n        dryRun: values[\"dry-run\"],\n        skipAudit: values[\"skip-audit\"],\n        force: values.force,\n        watch: values.watch,\n        configPath: values.config,\n        spec: values.spec,\n        out: values.out,\n      });\n    default:\n      console.error(`Unknown command \"${command}\".\\n`);\n      console.log(HELP);\n      return 1;\n  }\n}\n\n/** Detect the project's API spec and write a starter config. */\nasync function init(): Promise<number> {\n  const cwd = process.cwd();\n  const configPath = join(cwd, CONFIG_FILE);\n\n  if (existsSync(configPath)) {\n    console.error(`${CONFIG_FILE} already exists — nothing to do.`);\n    return 1;\n  }\n\n  const specs = await findSpecs(cwd);\n  const specPath = specs.length > 0 ? `./${specs[0]}` : \"./openapi.yaml\";\n\n  await writeFile(\n    configPath,\n    `import { defineConfig } from \"webmcp-codegen\";\nimport { openapi } from \"webmcp-codegen/sources\";\nimport { js } from \"webmcp-codegen/generators\";\n\nexport default defineConfig({\n  sources: [openapi({ spec: \"${specPath}\" })],\n  generate: [js({ outDir: \"./src/webmcp\" })],\n  safety: {\n    // Extra field names to treat as PII, on top of the built-in list:\n    // piiFields: [\"internalId\"],\n    // Tools to skip entirely (matched against name and route):\n    // exclude: [\"internal\"],\n  },\n});\n`,\n  );\n\n  // The config imports from the package, so keeping it means installing it.\n  console.log(\"Installed the package? A config file needs it:\");\n  console.log(\"  npm install -D webmcp-codegen\\n\");\n  if (specs.length > 0) {\n    console.log(`Found ${specs[0]} — wrote ${CONFIG_FILE}.`);\n    console.log(\"\\nNext: npx webmcp-codegen generate --dry-run\");\n  } else {\n    console.log(`No OpenAPI spec found, so ${CONFIG_FILE} points at ./openapi.yaml.`);\n    console.log(\"Edit the `spec` path to point at your spec, then run:\");\n    console.log(\"\\n  npx webmcp-codegen generate --dry-run\");\n  }\n  return 0;\n}\n\ninterface GenerateFlags {\n  dryRun: boolean;\n  skipAudit: boolean;\n  force: boolean;\n  watch: boolean;\n  configPath?: string;\n  spec?: string;\n  out?: string;\n}\n\nasync function generate(flags: GenerateFlags): Promise<number> {\n  const cwd = process.cwd();\n\n  if (flags.watch) {\n    // Watch mode never exits; it re-runs generate on every relevant change.\n    await watchLoop(cwd, flags);\n    return 0;\n  }\n\n  const result = await runOnce(cwd, flags);\n  return result.blocked ? 1 : 0;\n}\n\n/**\n * Where the tools come from, in priority order:\n *\n *   1. a config file (codegen.config.mjs or --config) — full control\n *   2. --spec/--out flags — quick overrides, no config needed\n *   3. auto-detection — the zero-argument npx run\n *\n * Branches 2 and 3 build the config right here inside the CLI, which is\n * what makes `npx webmcp-codegen generate` work without installing the\n * package: the user's project never has to resolve a webmcp-codegen import.\n */\nasync function resolveConfig(\n  cwd: string,\n  flags: GenerateFlags,\n): Promise<{ config: CodegenConfig; label: string }> {\n  const hasConfigFile = flags.configPath\n    ? existsSync(join(cwd, flags.configPath))\n    : CONFIG_FILE_NAMES.some((name) => existsSync(join(cwd, name)));\n\n  if (hasConfigFile) {\n    const { config, path } = await loadConfig(cwd, flags.configPath);\n    if (flags.spec || flags.out) {\n      console.warn(`Note: --spec/--out are ignored — ${basename(path)} is in charge here.`);\n    }\n    return { config, label: basename(path) };\n  }\n  if (flags.configPath) {\n    throw new Error(`No config file at \"${flags.configPath}\".`);\n  }\n\n  const spec = flags.spec ?? (await detectSpec(cwd));\n  const outDir = flags.out ?? \"./src/webmcp\";\n  return {\n    config: { sources: [openapi({ spec })], generate: [js({ outDir })] },\n    label: flags.spec ? `--spec ${spec}` : `detected ${spec}`,\n  };\n}\n\n/**\n * Find the project's API spec. One candidate: use it and say so. Several:\n * list them and make the human pick. None: say exactly what to do next.\n */\nasync function detectSpec(cwd: string): Promise<string> {\n  const specs = await findSpecs(cwd);\n\n  if (specs.length === 0) {\n    throw new Error(\n      \"No OpenAPI spec found in this project.\\n\" +\n        \"Point at one:  npx webmcp-codegen generate --spec path/to/openapi.json\",\n    );\n  }\n  if (specs.length > 1) {\n    const list = specs.map((spec) => `  - ${spec}`).join(\"\\n\");\n    throw new Error(\n      `Found ${specs.length} API specs:\\n${list}\\n\\n` +\n        `Pick one:  npx webmcp-codegen generate --spec ${specs[0]}`,\n    );\n  }\n\n  console.log(`Detected ${specs[0]} (override with --spec)\\n`);\n  return specs[0] as string;\n}\n\n/** One generate pass: resolve the config, run the pipeline, print the report. */\nasync function runOnce(cwd: string, flags: GenerateFlags): Promise<GenerateResult> {\n  const { config, label } = await resolveConfig(cwd, flags);\n  const result = await runGenerate(config, {\n    cwd,\n    dryRun: flags.dryRun,\n    skipAudit: flags.skipAudit,\n    force: flags.force,\n  });\n  printReport(result, flags, label, cwd);\n  return result;\n}\n\n/**\n * The report is the product's voice: plain language, one line per file,\n * findings grouped by severity, and a summary that says what to do next.\n */\nfunction printReport(\n  result: GenerateResult,\n  flags: GenerateFlags,\n  configName: string,\n  cwd: string,\n): void {\n  const { tools, findings, files, blocked } = result;\n\n  console.log(`\\nwebmcp-codegen (${configName}) — ${tools.length} tool(s)\\n`);\n\n  for (const tool of tools) {\n    console.log(`  ${tool.name}  [${tool.riskTier}]  ← ${tool.source.ref}`);\n  }\n\n  if (findings.length > 0) {\n    console.log(\"\");\n    for (const finding of findings) {\n      const icon = finding.level === \"error\" ? \"✖\" : \"⚠\";\n      const where = finding.tool ? ` (${finding.tool})` : \"\";\n      console.log(`  ${icon} ${finding.message}${where}`);\n    }\n  }\n\n  if (files.length > 0) {\n    console.log(\"\");\n    for (const file of files) {\n      if (file.action === \"unchanged\" && !file.conflict) continue;\n      const shown = file.conflict\n        ? `conflict → wrote ${relative(cwd, file.conflict)}`\n        : file.action;\n      console.log(`  ${shown}: ${relative(cwd, file.path)}`);\n    }\n  }\n\n  if (blocked) {\n    console.log(\n      \"\\nGeneration blocked by audit errors. Fix them, or re-run with --force to write anyway.\",\n    );\n  } else if (flags.dryRun) {\n    console.log(\"\\nDry run — nothing written. Re-run without --dry-run to write these files.\");\n  } else {\n    console.log(\"\\nDone. Fill in each execute() below the marker, then registerAllTools().\");\n  }\n}\n\n/**\n * Re-run generate when anything relevant changes. Node's recursive watcher\n * covers Linux/macOS/Windows on Node 20+, which is our engine floor anyway.\n */\nasync function watchLoop(cwd: string, flags: GenerateFlags): Promise<void> {\n  await runOnce(cwd, { ...flags, dryRun: false });\n  console.log(\"\\nWatching for changes… (Ctrl+C to stop)\");\n\n  let timer: NodeJS.Timeout | undefined;\n  watch(cwd, { recursive: true }, (_event, filename) => {\n    if (!filename) return;\n    // Only source-ish changes are worth regenerating for.\n    if (/node_modules|\\.git|\\/dist|\\/src\\/webmcp/.test(filename)) return;\n    if (!/\\.(ya?ml|json|ts|tsx|mts|mjs)$/.test(filename)) return;\n    clearTimeout(timer);\n    timer = setTimeout(() => {\n      runOnce(cwd, { ...flags, dryRun: false }).catch((error: unknown) => {\n        console.error(error instanceof Error ? error.message : error);\n      });\n    }, 300);\n  });\n}\n\nmain()\n  .then((code) => process.exit(code))\n  .catch((error: unknown) => {\n    console.error(error instanceof Error ? error.message : error);\n    process.exit(1);\n  });\n","/**\n * Spec auto-detection — the reason `npx webmcp-codegen generate` works with\n * zero arguments, zero config, and zero install.\n *\n * The rule is deliberately boring: walk the project (skipping the obvious\n * noise), recognize the usual spec filenames, and return what we find\n * shallowest-first. When exactly one spec exists we just use it; the CLI\n * layer decides what to do about zero or several.\n */\n\nimport type { Dirent } from \"node:fs\";\nimport { readdir } from \"node:fs/promises\";\nimport { join, relative } from \"node:path\";\n\n/** Filenames we recognize as API specs. */\nexport const SPEC_FILE_PATTERN = /^(openapi|swagger|api)\\.(ya?ml|json)$/i;\n\n/** Directories never worth descending into. */\nconst IGNORED_DIRS = new Set([\n  \"node_modules\",\n  \".git\",\n  \".turbo\",\n  \".next\",\n  \"dist\",\n  \"build\",\n  \"coverage\",\n]);\n\n/**\n * How deep we look. Enough for monorepo layouts like\n * apps/server/openapi/openapi.json (depth 3) without wandering forever.\n */\nconst MAX_DEPTH = 5;\n\n/**\n * Find API spec files under `cwd`, returned as paths relative to `cwd`,\n * shallowest first — a root-level spec is a likelier intent than one\n * buried six folders deep.\n */\nexport async function findSpecs(cwd: string): Promise<string[]> {\n  const found: { path: string; depth: number }[] = [];\n\n  async function walk(dir: string, depth: number): Promise<void> {\n    if (depth > MAX_DEPTH) return;\n    let entries: Dirent[];\n    try {\n      entries = await readdir(dir, { withFileTypes: true });\n    } catch {\n      return; // Unreadable directory — skip it, never die on detection.\n    }\n    for (const entry of entries) {\n      if (entry.isDirectory()) {\n        if (!IGNORED_DIRS.has(entry.name)) await walk(join(dir, entry.name), depth + 1);\n      } else if (SPEC_FILE_PATTERN.test(entry.name)) {\n        found.push({ path: join(dir, entry.name), depth });\n      }\n    }\n  }\n\n  await walk(cwd, 0);\n  return found.sort((a, b) => a.depth - b.depth).map((entry) => relative(cwd, entry.path));\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,SAAS,YAAY,aAAa;AAClC,SAAS,iBAAiB;AAC1B,SAAS,UAAU,QAAAA,OAAM,YAAAC,iBAAgB;AACzC,SAAS,iBAAiB;;;ACd1B,SAAS,eAAe;AACxB,SAAS,MAAM,gBAAgB;AAGxB,IAAM,oBAAoB;AAGjC,IAAM,eAAe,oBAAI,IAAI;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMD,IAAM,YAAY;AAOlB,eAAsB,UAAU,KAAgC;AAC9D,QAAM,QAA2C,CAAC;AAElD,iBAAe,KAAK,KAAa,OAA8B;AAC7D,QAAI,QAAQ,UAAW;AACvB,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,IACtD,QAAQ;AACN;AAAA,IACF;AACA,eAAW,SAAS,SAAS;AAC3B,UAAI,MAAM,YAAY,GAAG;AACvB,YAAI,CAAC,aAAa,IAAI,MAAM,IAAI,EAAG,OAAM,KAAK,KAAK,KAAK,MAAM,IAAI,GAAG,QAAQ,CAAC;AAAA,MAChF,WAAW,kBAAkB,KAAK,MAAM,IAAI,GAAG;AAC7C,cAAM,KAAK,EAAE,MAAM,KAAK,KAAK,MAAM,IAAI,GAAG,MAAM,CAAC;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,KAAK,KAAK,CAAC;AACjB,SAAO,MAAM,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,SAAS,KAAK,MAAM,IAAI,CAAC;AACzF;;;AD5BA,IAAM,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoBb,IAAM,cAAc;AAEpB,eAAe,OAAwB;AACrC,QAAM,EAAE,aAAa,OAAO,IAAI,UAAU;AAAA,IACxC,kBAAkB;AAAA,IAClB,SAAS;AAAA,MACP,WAAW,EAAE,MAAM,WAAW,SAAS,MAAM;AAAA,MAC7C,cAAc,EAAE,MAAM,WAAW,SAAS,MAAM;AAAA,MAChD,OAAO,EAAE,MAAM,WAAW,SAAS,MAAM;AAAA,MACzC,OAAO,EAAE,MAAM,WAAW,SAAS,MAAM;AAAA,MACzC,QAAQ,EAAE,MAAM,SAAS;AAAA,MACzB,MAAM,EAAE,MAAM,SAAS;AAAA,MACvB,KAAK,EAAE,MAAM,SAAS;AAAA,MACtB,MAAM,EAAE,MAAM,WAAW,SAAS,MAAM;AAAA,IAC1C;AAAA,EACF,CAAC;AAED,QAAM,UAAU,YAAY,CAAC;AAC7B,MAAI,OAAO,QAAQ,CAAC,SAAS;AAC3B,YAAQ,IAAI,IAAI;AAChB,WAAO;AAAA,EACT;AAEA,UAAQ,SAAS;AAAA,IACf,KAAK;AACH,aAAO,KAAK;AAAA,IACd,KAAK;AACH,aAAO,SAAS;AAAA,QACd,QAAQ,OAAO,SAAS;AAAA,QACxB,WAAW,OAAO,YAAY;AAAA,QAC9B,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,YAAY,OAAO;AAAA,QACnB,MAAM,OAAO;AAAA,QACb,KAAK,OAAO;AAAA,MACd,CAAC;AAAA,IACH;AACE,cAAQ,MAAM,oBAAoB,OAAO;AAAA,CAAM;AAC/C,cAAQ,IAAI,IAAI;AAChB,aAAO;AAAA,EACX;AACF;AAGA,eAAe,OAAwB;AACrC,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,aAAaC,MAAK,KAAK,WAAW;AAExC,MAAI,WAAW,UAAU,GAAG;AAC1B,YAAQ,MAAM,GAAG,WAAW,uCAAkC;AAC9D,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MAAM,UAAU,GAAG;AACjC,QAAM,WAAW,MAAM,SAAS,IAAI,KAAK,MAAM,CAAC,CAAC,KAAK;AAEtD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA,+BAK2B,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUrC;AAGA,UAAQ,IAAI,gDAAgD;AAC5D,UAAQ,IAAI,mCAAmC;AAC/C,MAAI,MAAM,SAAS,GAAG;AACpB,YAAQ,IAAI,SAAS,MAAM,CAAC,CAAC,iBAAY,WAAW,GAAG;AACvD,YAAQ,IAAI,+CAA+C;AAAA,EAC7D,OAAO;AACL,YAAQ,IAAI,6BAA6B,WAAW,4BAA4B;AAChF,YAAQ,IAAI,uDAAuD;AACnE,YAAQ,IAAI,2CAA2C;AAAA,EACzD;AACA,SAAO;AACT;AAYA,eAAe,SAAS,OAAuC;AAC7D,QAAM,MAAM,QAAQ,IAAI;AAExB,MAAI,MAAM,OAAO;AAEf,UAAM,UAAU,KAAK,KAAK;AAC1B,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,MAAM,QAAQ,KAAK,KAAK;AACvC,SAAO,OAAO,UAAU,IAAI;AAC9B;AAaA,eAAe,cACb,KACA,OACmD;AACnD,QAAM,gBAAgB,MAAM,aACxB,WAAWA,MAAK,KAAK,MAAM,UAAU,CAAC,IACtC,kBAAkB,KAAK,CAAC,SAAS,WAAWA,MAAK,KAAK,IAAI,CAAC,CAAC;AAEhE,MAAI,eAAe;AACjB,UAAM,EAAE,QAAQ,KAAK,IAAI,MAAM,WAAW,KAAK,MAAM,UAAU;AAC/D,QAAI,MAAM,QAAQ,MAAM,KAAK;AAC3B,cAAQ,KAAK,yCAAoC,SAAS,IAAI,CAAC,qBAAqB;AAAA,IACtF;AACA,WAAO,EAAE,QAAQ,OAAO,SAAS,IAAI,EAAE;AAAA,EACzC;AACA,MAAI,MAAM,YAAY;AACpB,UAAM,IAAI,MAAM,sBAAsB,MAAM,UAAU,IAAI;AAAA,EAC5D;AAEA,QAAM,OAAO,MAAM,QAAS,MAAM,WAAW,GAAG;AAChD,QAAM,SAAS,MAAM,OAAO;AAC5B,SAAO;AAAA,IACL,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE;AAAA,IACnE,OAAO,MAAM,OAAO,UAAU,IAAI,KAAK,YAAY,IAAI;AAAA,EACzD;AACF;AAMA,eAAe,WAAW,KAA8B;AACtD,QAAM,QAAQ,MAAM,UAAU,GAAG;AAEjC,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,MAAI,MAAM,SAAS,GAAG;AACpB,UAAM,OAAO,MAAM,IAAI,CAAC,SAAS,OAAO,IAAI,EAAE,EAAE,KAAK,IAAI;AACzD,UAAM,IAAI;AAAA,MACR,SAAS,MAAM,MAAM;AAAA,EAAgB,IAAI;AAAA;AAAA,gDACU,MAAM,CAAC,CAAC;AAAA,IAC7D;AAAA,EACF;AAEA,UAAQ,IAAI,YAAY,MAAM,CAAC,CAAC;AAAA,CAA2B;AAC3D,SAAO,MAAM,CAAC;AAChB;AAGA,eAAe,QAAQ,KAAa,OAA+C;AACjF,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,cAAc,KAAK,KAAK;AACxD,QAAM,SAAS,MAAM,YAAY,QAAQ;AAAA,IACvC;AAAA,IACA,QAAQ,MAAM;AAAA,IACd,WAAW,MAAM;AAAA,IACjB,OAAO,MAAM;AAAA,EACf,CAAC;AACD,cAAY,QAAQ,OAAO,OAAO,GAAG;AACrC,SAAO;AACT;AAMA,SAAS,YACP,QACA,OACA,YACA,KACM;AACN,QAAM,EAAE,OAAO,UAAU,OAAO,QAAQ,IAAI;AAE5C,UAAQ,IAAI;AAAA,kBAAqB,UAAU,YAAO,MAAM,MAAM;AAAA,CAAY;AAE1E,aAAW,QAAQ,OAAO;AACxB,YAAQ,IAAI,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,aAAQ,KAAK,OAAO,GAAG,EAAE;AAAA,EACxE;AAEA,MAAI,SAAS,SAAS,GAAG;AACvB,YAAQ,IAAI,EAAE;AACd,eAAW,WAAW,UAAU;AAC9B,YAAM,OAAO,QAAQ,UAAU,UAAU,WAAM;AAC/C,YAAM,QAAQ,QAAQ,OAAO,KAAK,QAAQ,IAAI,MAAM;AACpD,cAAQ,IAAI,KAAK,IAAI,IAAI,QAAQ,OAAO,GAAG,KAAK,EAAE;AAAA,IACpD;AAAA,EACF;AAEA,MAAI,MAAM,SAAS,GAAG;AACpB,YAAQ,IAAI,EAAE;AACd,eAAW,QAAQ,OAAO;AACxB,UAAI,KAAK,WAAW,eAAe,CAAC,KAAK,SAAU;AACnD,YAAM,QAAQ,KAAK,WACf,yBAAoBC,UAAS,KAAK,KAAK,QAAQ,CAAC,KAChD,KAAK;AACT,cAAQ,IAAI,KAAK,KAAK,KAAKA,UAAS,KAAK,KAAK,IAAI,CAAC,EAAE;AAAA,IACvD;AAAA,EACF;AAEA,MAAI,SAAS;AACX,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF,WAAW,MAAM,QAAQ;AACvB,YAAQ,IAAI,kFAA6E;AAAA,EAC3F,OAAO;AACL,YAAQ,IAAI,2EAA2E;AAAA,EACzF;AACF;AAMA,eAAe,UAAU,KAAa,OAAqC;AACzE,QAAM,QAAQ,KAAK,EAAE,GAAG,OAAO,QAAQ,MAAM,CAAC;AAC9C,UAAQ,IAAI,+CAA0C;AAEtD,MAAI;AACJ,QAAM,KAAK,EAAE,WAAW,KAAK,GAAG,CAAC,QAAQ,aAAa;AACpD,QAAI,CAAC,SAAU;AAEf,QAAI,0CAA0C,KAAK,QAAQ,EAAG;AAC9D,QAAI,CAAC,iCAAiC,KAAK,QAAQ,EAAG;AACtD,iBAAa,KAAK;AAClB,YAAQ,WAAW,MAAM;AACvB,cAAQ,KAAK,EAAE,GAAG,OAAO,QAAQ,MAAM,CAAC,EAAE,MAAM,CAAC,UAAmB;AAClE,gBAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH,GAAG,GAAG;AAAA,EACR,CAAC;AACH;AAEA,KAAK,EACF,KAAK,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC,EACjC,MAAM,CAAC,UAAmB;AACzB,UAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,KAAK;AAC5D,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":["join","relative","join","relative"]}

package/dist/generators/index.d.ts

@@ -0,0 +1,35 @@
+import { T as ToolGenerator } from '../types-Bf5MxWeH.js';
+
+/**
+ * The `js` generator — named after what lands in your repo: plain JavaScript/
+ * TypeScript files that call the spec's imperative API
+ * (`document.modelContext.registerTool`).
+ *
+ * Output layout for `js({ outDir: "./src/webmcp" })`:
+ *
+ *   src/webmcp/
+ *   ├── runtime.webmcp.ts          ← fully generated, never edit
+ *   ├── index.ts                   ← fully generated, registers everything
+ *   ├── get-order-status.webmcp.ts ← generated contract + YOUR execute()
+ *   └── ...
+ *
+ * Each per-tool file has two regions, divided by marker comments:
+ *
+ *   generated region   schema, input type, tool definition, register()
+ *   ── end generated ── everything below survives regeneration
+ *   your region        execute(), scaffolded once, then owned by you
+ *
+ * This file contains only the *file mechanics*: which files exist, and how to
+ * update them without destroying hand-written code. The text of the generated
+ * code itself lives in js-templates.ts — keeping "what the output looks like"
+ * separate from "how files get written" is what keeps both readable.
+ */
+
+interface JsGeneratorOptions {
+    /** Where the tool files go, relative to the project root. */
+    outDir: string;
+}
+/** Create the `js` generator for the config's `generate` array. */
+declare function js(options: JsGeneratorOptions): ToolGenerator;
+
+export { js };

package/dist/generators/index.js

@@ -0,0 +1,8 @@
+import {
+  js
+} from "../chunk-GDJDVR4E.js";
+import "../chunk-5L4KN6F4.js";
+export {
+  js
+};
+//# sourceMappingURL=index.js.map

package/dist/generators/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/index.d.ts

@@ -0,0 +1,49 @@
+import { C as CodegenConfig, R as ReviewedTool, A as AuditFinding, G as GeneratedFile } from './types-Bf5MxWeH.js';
+export { a as CandidateTool, J as JsonSchema, b as RiskTier, c as SafetyOptions, d as SideEffect, S as Source, e as SourceKind, T as ToolGenerator, f as ToolHints } from './types-Bf5MxWeH.js';
+
+/**
+ * Config: `defineConfig` for authoring, `loadConfig` for the CLI.
+ *
+ * Config files are plain JavaScript (`codegen.config.mjs`) so the CLI can
+ * load them with a plain dynamic import — no TypeScript loader, no build
+ * step, no extra dependencies. If you want types while authoring, that is
+ * what `defineConfig` is for:
+ *
+ *   import { defineConfig } from "webmcp-codegen";
+ *   export default defineConfig({ ... });
+ */
+
+/** Identity function whose only job is type-checking the config object. */
+declare function defineConfig(config: CodegenConfig): CodegenConfig;
+
+/**
+ * The pipeline: sources → normalize → safety review → audit → write.
+ *
+ * This module is the only place the stages meet. It owns no opinions of its
+ * own — naming, safety, and file formats all live in their own modules — it
+ * just runs them in order and produces one honest report of what happened
+ * (or what *would* happen, when called with `write: false`).
+ */
+
+interface GenerateOptions {
+    /** Project root. Everything (config, spec paths, outDir) resolves from here. */
+    cwd: string;
+    /** Preview mode: compute everything, write nothing. */
+    dryRun?: boolean;
+    /** Skip the audit pass entirely (classification still runs — output needs it). */
+    skipAudit?: boolean;
+    /** Write even when the audit found errors. The report still shows them. */
+    force?: boolean;
+}
+interface GenerateResult {
+    tools: ReviewedTool[];
+    findings: AuditFinding[];
+    files: GeneratedFile[];
+    /** True when audit errors stopped any file from being written. */
+    blocked: boolean;
+    /** True when this run actually wrote files (false for dry runs and blocks). */
+    wrote: boolean;
+}
+declare function runGenerate(config: CodegenConfig, options: GenerateOptions): Promise<GenerateResult>;
+
+export { AuditFinding, CodegenConfig, type GenerateOptions, type GenerateResult, GeneratedFile, ReviewedTool, defineConfig, runGenerate };

package/dist/index.js

@@ -0,0 +1,11 @@
+import {
+  defineConfig,
+  runGenerate
+} from "./chunk-R3DEBBQ3.js";
+import "./chunk-BIKKPCRT.js";
+import "./chunk-5L4KN6F4.js";
+export {
+  defineConfig,
+  runGenerate
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/sources/index.d.ts

@@ -0,0 +1,28 @@
+import { S as Source } from '../types-Bf5MxWeH.js';
+
+/**
+ * The OpenAPI source.
+ *
+ * Reads an OpenAPI 3.x document (YAML or JSON) and turns every operation
+ * into a CandidateTool. This is the highest-reach source: most backend
+ * frameworks can already emit an OpenAPI spec, so teams get value without
+ * changing any application code.
+ *
+ * What we read from each operation:
+ *   - name        ← operationId, slugified (falls back to method + path)
+ *   - description ← summary, else the first line of description, else a template
+ *   - inputSchema ← path + query parameters merged with the JSON request body
+ *   - outputSchema ← the first 2xx response's JSON schema, when present
+ *
+ * Header and cookie parameters are skipped on purpose: agents should not be
+ * setting those by hand, and auth headers are the app's job, not the tool's.
+ */
+
+interface OpenApiSourceOptions {
+    /** Path to the OpenAPI document, relative to the project root. */
+    spec: string;
+}
+/** Create an OpenAPI source for the config's `sources` array. */
+declare function openapi(options: OpenApiSourceOptions): Source;
+
+export { openapi };

package/dist/sources/index.js

@@ -0,0 +1,9 @@
+import {
+  openapi
+} from "../chunk-WYGVTIGI.js";
+import "../chunk-BIKKPCRT.js";
+import "../chunk-5L4KN6F4.js";
+export {
+  openapi
+};
+//# sourceMappingURL=index.js.map

package/dist/sources/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/types-Bf5MxWeH.d.ts

@@ -0,0 +1,136 @@
+/**
+ * The shared shapes that flow through the codegen pipeline.
+ *
+ * Every stage of the pipeline speaks in these types:
+ *
+ *   Source → CandidateTool → (safety review) → ReviewedTool → Generator → GeneratedFile
+ *
+ * A source (OpenAPI today, tRPC/Zod later) only has to produce CandidateTools.
+ * A generator only has to turn ReviewedTools into files. Everything in between
+ * lives here so the stages stay independent.
+ */
+/**
+ * A relaxed JSON Schema type. Real-world schemas (especially from OpenAPI)
+ * carry keywords we don't model individually, so unknown keywords are allowed
+ * through untouched instead of being rejected.
+ */
+interface JsonSchema {
+    type?: string;
+    properties?: Record<string, JsonSchema>;
+    required?: string[];
+    items?: JsonSchema;
+    enum?: unknown[];
+    description?: string;
+    format?: string;
+    nullable?: boolean;
+    anyOf?: JsonSchema[];
+    oneOf?: JsonSchema[];
+    allOf?: JsonSchema[];
+    additionalProperties?: boolean | JsonSchema;
+    [keyword: string]: unknown;
+}
+/** Which source a candidate came from. Grows as new sources are added. */
+type SourceKind = "openapi" | "trpc" | "zod" | "prisma" | "graphql" | "manual";
+/**
+ * What the tool does to the world. The safety layer derives this from the
+ * HTTP method plus naming heuristics; it drives both the MCP hints and the
+ * risk tier.
+ */
+type SideEffect = "read" | "write" | "destructive" | "unknown";
+/** How dangerous the tool is to expose to an agent. */
+type RiskTier = "safe-read" | "write-confirm" | "destructive-confirm";
+/**
+ * A tool being considered for generation. Sources produce these; nothing is
+ * written to disk until the safety layer has reviewed every candidate.
+ */
+interface CandidateTool {
+    /** Stable id used for diffing across regenerations. */
+    id: string;
+    /** The final tool name an agent will see (validated, de-duplicated). */
+    name: string;
+    /** Where this candidate came from, e.g. `{ kind: "openapi", ref: "GET /orders/{id}" }`. */
+    source: {
+        kind: SourceKind;
+        ref: string;
+    };
+    /** Always derived from the source contract, never hand-typed. */
+    inputSchema: JsonSchema;
+    /** Present when the source has response typing. */
+    outputSchema?: JsonSchema;
+    /** Name of the generated TypeScript input type, e.g. "GetOrderStatusInput". */
+    inputTypeName: string;
+    httpMethod?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+    sideEffect: SideEffect;
+    requiresAuth: boolean;
+    /** Where the description text came from — always reviewable before commit. */
+    description: string;
+    descriptionSource: "openapi-summary" | "generated-template";
+}
+/** The MCP hints the spec defines for a tool, computed by the safety layer. */
+interface ToolHints {
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+    idempotentHint: boolean;
+}
+/** A candidate after safety review: classified, hinted, and linted. */
+interface ReviewedTool extends CandidateTool {
+    riskTier: RiskTier;
+    hints: ToolHints;
+    /**
+     * Output field paths the PII heuristics flagged (e.g. "user.email").
+     * These are fields that would leave the page and reach the agent.
+     */
+    piiInOutput: string[];
+}
+/** One audit finding. Errors block generation (unless --force); warnings don't. */
+interface AuditFinding {
+    level: "error" | "warning";
+    /** Tool name this finding is about, or undefined for project-level findings. */
+    tool?: string;
+    message: string;
+}
+/** A file the generator wants to write. */
+interface GeneratedFile {
+    /** Absolute path on disk. */
+    path: string;
+    /** Full new contents. */
+    contents: string;
+    /** What writing this file would do — used for the report and --dry-run. */
+    action: "create" | "update" | "unchanged";
+    /**
+     * Present when an existing file was edited by hand in the generated region,
+     * so we refused to touch it. The new contents go to a `.new` sibling instead.
+     */
+    conflict?: string;
+}
+/**
+ * A source reads an existing contract and produces candidate tools.
+ * Create one with a helper like `openapi({ spec: "./openapi.yaml" })`.
+ */
+interface Source {
+    readonly kind: SourceKind;
+    collect(): Promise<CandidateTool[]>;
+}
+/**
+ * A generator turns reviewed tools into files.
+ * Named after what lands in your repo: `js`, `html`, `react`, `manifest`.
+ */
+interface ToolGenerator {
+    readonly kind: string;
+    generate(tools: ReviewedTool[], cwd: string): Promise<GeneratedFile[]>;
+}
+/** Safety knobs. Everything here extends defaults; nothing is required. */
+interface SafetyOptions {
+    /** Extra field names to treat as PII, on top of the built-in list. */
+    piiFields?: string[];
+    /** Tool names or source refs to skip entirely (substrings, case-insensitive). */
+    exclude?: string[];
+}
+/** The config file shape. Create it with `defineConfig` for type checking. */
+interface CodegenConfig {
+    sources: Source[];
+    generate: ToolGenerator[];
+    safety?: SafetyOptions;
+}
+
+export type { AuditFinding as A, CodegenConfig as C, GeneratedFile as G, JsonSchema as J, ReviewedTool as R, Source as S, ToolGenerator as T, CandidateTool as a, RiskTier as b, SafetyOptions as c, SideEffect as d, SourceKind as e, ToolHints as f };

package/package.json

@@ -1,17 +1,37 @@
 {
   "name": "webmcp-codegen",
-  "version": "0.0.1",
-  "description": "Generate safe, typed, human-reviewed WebMCP tools from the API contracts you already have (OpenAPI, tRPC, Zod). Under active development.",
+  "version": "0.2.0",
+  "description": "Generate safe, typed, human-reviewed WebMCP tools from the API contracts you already have (OpenAPI, tRPC, Zod).",
+  "license": "MIT",
   "type": "module",
-  "main": "./src/index.js",
+  "sideEffects": false,
+  "bin": {
+    "webmcp-codegen": "./dist/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./src/index.js"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./sources": {
+      "types": "./dist/sources/index.d.ts",
+      "import": "./dist/sources/index.js"
+    },
+    "./generators": {
+      "types": "./dist/generators/index.d.ts",
+      "import": "./dist/generators/index.js"
+    }
   },
   "files": [
-    "src"
+    "dist"
   ],
-  "engines": {
-    "node": ">=20"
+  "scripts": {
+    "build": "tsup src/index.ts src/cli.ts src/sources/index.ts src/generators/index.ts --format esm --dts --sourcemap --clean",
+    "dev": "tsup src/index.ts src/cli.ts src/sources/index.ts src/generators/index.ts --format esm --dts --sourcemap --watch",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
   },
   "keywords": [
     "webmcp",
@@ -22,10 +42,18 @@
     "zod",
     "model-context-protocol"
   ],
-  "license": "MIT",
+  "engines": {
+    "node": ">=20"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/SouravInsights/groundstate.git",
     "directory": "packages/codegen"
+  },
+  "dependencies": {
+    "yaml": "^2.8.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.1"
   }
 }