[bartsdev]

Summary

Replaces #107. In xmcp 1.x, xmcp build and xmcp dev live in a separate dev-only package, so #107 failed at yarn build:

$ xmcp build
xmcp dev/build now requires the dev-only compiler: npm i -D @xmcp-dev/compiler

 devDependencies
+  @xmcp-dev/compiler  ^1.9.0
-  xmcp                ^0.6.13
+  xmcp                ^1.9.0

No source changes. We import only types from xmcp (ToolMetadata, InferSchema, PromptMetadata, ToolExtraArguments), and they still type-check.

The build output is now a single self-contained dist/stdio.js, with no numbered chunk files. The Dockerfile runtime stage copies dist/, so it needs no change.

xmcp's runtime still inlines its own zod, now 4.6.5 instead of 4.4.3. I updated the zod note in .github/dependabot.yml to match and kept the ignore rule. zod stays at 4.3.6 in this PR.

Evidence

• Before (Bump xmcp from 0.6.13 to 1.9.0 #107 CI): build, smoke and mcp-direct-tests failed on the missing compiler.
• After (local):
  • tsc --noEmit passes, jest passes 395/395, and yarn build registers 15 tools and 1 prompt.
  • Raw stdio tools/list returns 15 tools and prompts/list returns 1. This still works when dist/ is run from a directory with no node_modules, which is what the Docker runtime stage does.
  • Playwright direct and azure-offline tests pass 10/11. The remaining test is docs, which needs LOCALSTACK_AUTH_TOKEN and runs in CI.
  • I also tried zod 4.6.7 against xmcp 1.9's runtime and tools/list works, so bumping zod becomes possible after this lands.

Merge Danger

Door: two-way

A dev-dependency bump with no source changes. Revert to undo.

Blast Radius: medium

xmcp produces the whole server bundle, so any change in the server's stdio behavior would affect every MCP client. CI's smoke (Docker image) and mcp-direct-tests exercise the built server end to end.

🤖 Generated with Claude Code