fix(val,mcp): Standard Schema v1 compat + packed-ELF record drops (cutils#27)

[espetro]

Summary

Fixes sigilco/cutils#27 — the @chttp/mcp × @chttp/val pairing failed to type-check under the published tarballs, and the packed ELF dropped response fields. Note: the issue is filed on cutils, but @chttp/val now lives in packages/val here and @chttp/mcp only exists on this branch — so the fix lands stacked on the move-auth-mcp branch.

Type compatibility (val):

• StdProps.version widened to number made every val schema refuse StandardSchemaV1 (TS2345/TS2739). It is now the literal 1.
• v.toJsonSchema/v.toOpenApiSchema required a VSchema, so a consumer's emitJsonSchema adapter receiving StandardSchemaV1 rejected it. They now take the {"~standard": unknown} structural minimum and validate instanceof VSchema at runtime.
• tool() handler input stayed unknown (TS18046) because InferInput/InferOutput found no ~standard.types slot and factories erased concrete classes to VSchema. Each schema class now merges a StdTyped<I, O> interface (type-level only — the runtime field stays StdProps, keeping scriptc lowering at 100%), and factories return the concrete classes (string(): VStr, …).

Packed-ELF record drops (mcp):

• scriptc drops member writes that expand a non-empty record literal when the package is compiled from its tsc dist JS — packed tarballs returned bare {"jsonrpc":"2.0","id":N} for every method. resultResponse, errorResponse, progressNotification params, and the initialize/tools/resources/prompts listing records now use single full literals or {} open records.

Smoke coverage:

• pnpm smoke:pack now packs @chttp/mcp, type-checks tests/pack-smoke/mcp-app.ts (the issue's repro: val schema into tool() + emitJsonSchema arrow + inferred handler input) under tsc, builds it to an ELF, and serves tools/list + tools/call (valid + invalid args) through Server.handleRequest.

Known limitation documented in the script: an error-member response crossing the package call boundary still loses the member under scriptc's stringify — invalid-args returns the envelope {"jsonrpc","id":3} (dispatch reaches errorResponse correctly; JS runtimes emit the full INVALID_PARAMS body). This looks like a compiler-side tagged-union/serialization gap worth its own issue.

Test plan

• pnpm test — all workspace tests incl. packages/mcp elf.test: pass
• pnpm -r build: pass
• pnpm smoke:pack: pass (incl. new mcp+val section)
• bash scripts/scriptc-gate.sh: 100% on all eight gates
• pnpm lint: warnings only (pre-existing)
• pnpm docs:build: pass

Link to Devin session: https://app.devin.ai/sessions/3f418b516b064c8ea1c69ecc54752ba9
Open in Devin Desktop: https://app.devin.ai/desktop/session/3f418b516b064c8ea1c69ecc54752ba9?variant=devin
Requested by: @espetro

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[cloudflare-workers-and-pages]

Deploying chttpjs with    Cloudflare Pages

Latest commit:	846487c
Status:	✅  Deploy successful!
Preview URL:	https://00be6f1d.chttpjs.pages.dev
Branch Preview URL:	https://devin-1792347973-mcp-val-std.chttpjs.pages.dev

View logs

[devin-ai-integration]

Follow-up on the known gap documented in scripts/pack-smoke.sh (response record's error member dropped when crossing the package call boundary into the consumer's stringify):

Reproduced with a minimal standalone scriptc program (no chttp deps — a package class whose handleRequest returns a Resp | null union built from {jsonrpc,id,result} and {jsonrpc,id,error} literals). Under 0.3.4 the error member is physically stripped at the boundary (Object.keys-equivalent probe reads ABSENT, not just skipped by JSON.stringify); under 0.3.5 and 0.3.6 it survives — this is the upstream fix "Checked JSON records keep keys they do not declare" from the v0.3.5 changelog.

Upstream issue (retroactive report + regression coverage): vercel-labs/scriptc#1314

So the pack-smoke workaround can be retired once the repo's scriptc floor is >=0.3.5.

Written by Devin