@@ -26,6 +26,7 @@ export const alias = {
   'devframe/utils/nanoid': r('devframe/src/utils/nanoid.ts'),
   'devframe/utils/open': r('devframe/src/utils/open.ts'),
   'devframe/utils/promise': r('devframe/src/utils/promise.ts'),
+  'devframe/utils/schema': r('devframe/src/utils/schema.ts'),
   'devframe/utils/scope': r('devframe/src/utils/scope.ts'),
   'devframe/utils/serve-static': r('devframe/src/utils/serve-static.ts'),
   'devframe/utils/shared-state': r('devframe/src/utils/shared-state.ts'),
 
@@ -10,7 +10,7 @@ outline: deep
 
 ## Cause
 
-The `agent` field exposes an RPC function as an MCP tool. MCP and the underlying schema-conversion path (`@valibot/to-json-schema`) only consume JSON-shaped data. Functions whose payloads can include `Map`, `Set`, `Date`, `BigInt`, circular references, or class instances cannot be safely advertised to agents.
+The `agent` field exposes an RPC function as an MCP tool. MCP only consumes JSON-shaped data. Functions whose payloads can include `Map`, `Set`, `Date`, `BigInt`, circular references, or class instances cannot be safely advertised to agents.
 
 A registered function is rejected when `agent` is present and `jsonSerializable` is not explicitly `true`.
 
 
@@ -22,13 +22,13 @@ sequenceDiagram
 
 ```ts
 import { defineRpcFunction } from 'devframe'
-import * as v from 'valibot'
+import { s } from 'devframe/utils/schema' // or bring your own: valibot / zod / arktype
 
 export const getModules = defineRpcFunction({
   name: 'get-modules', // bare — the scope namespaces it to `my-devframe:get-modules`
   type: 'query',
-  args: [v.object({ limit: v.number() })],
-  returns: v.array(v.object({ id: v.string(), size: v.number() })),
+  args: [s.object({ limit: s.number() })],
+  returns: s.array(s.object({ id: s.string(), size: s.number() })),
   setup: ctx => ({
     handler: async ({ limit }) => {
       // `ctx` is the full DevframeNodeContext.
@@ -75,14 +75,16 @@ Use `static` for data collected once during `setup` and shipped to read-only sta
 
 ### Handler arguments
 
-Handlers accept any serializable arguments. Declare `args` schemas — any [Standard Schema](https://standardschema.dev/) validator, valibot below — and each argument is validated at the boundary before the handler runs; a mismatch is rejected with a coded diagnostic. Validation guards the payload without rewriting it, so extra object fields the schema doesn't mention still reach the handler:
+Handlers accept any serializable arguments. Declare `args` schemas — any [Standard Schema](https://standardschema.dev/) validator (valibot, zod, arktype, …) — and each argument is validated at the boundary before the handler runs; a mismatch is rejected with a coded diagnostic. Validation guards the payload without rewriting it, so extra object fields the schema doesn't mention still reach the handler.
+
+Devframe forces no validator on you. Bring the one you already use, or reach for the built-in zero-dependency builder at `devframe/utils/schema` (imported as `s` below):
 
 ```ts
 defineRpcFunction({
   name: 'get-file',
   type: 'query',
-  args: [v.object({ path: v.string(), includeSource: v.optional(v.boolean()) })],
-  returns: v.object({ path: v.string(), source: v.optional(v.string()) }),
+  args: [s.object({ path: s.string(), includeSource: s.optional(s.boolean()) })],
+  returns: s.object({ path: s.string(), source: s.optional(s.string()) }),
   setup: () => ({
     handler: async ({ path, includeSource }) => ({
       path,
@@ -92,7 +94,7 @@ defineRpcFunction({
 })
 ```
 
-Prefer a single object argument (`args: [v.object({ ... })]`) over positional args — property names are self-describing and agents/IDEs work best with object shapes.
+Prefer a single object argument (`args: [s.object({ ... })]`) over positional args — property names are self-describing and agents/IDEs work best with object shapes.
 
 > [!WARNING]
 > Declared `args`/`returns` schemas are enforced at runtime — a call whose arguments, or a handler whose return value, fail the schema is rejected with `DF0043` / `DF0044`. Make sure each schema matches what the function actually accepts and returns; a schema stricter than reality will now reject calls that previously ran.
@@ -245,7 +247,7 @@ defineRpcFunction({
   name: 'build-meta',
   type: 'static',
   args: [],
-  returns: v.object({ version: v.string(), builtAt: v.number() }),
+  returns: s.object({ version: s.string(), builtAt: s.number() }),
   setup: () => ({
     handler: async () => ({ version: '1.0.0', builtAt: Date.now() }),
   }),
@@ -309,8 +311,8 @@ defineRpcFunction({
   name: 'get-modules',
   type: 'query',
   jsonSerializable: true,
-  args: [v.object({ limit: v.number() })],
-  returns: v.array(v.object({ id: v.string(), size: v.number() })),
+  args: [s.object({ limit: s.number() })],
+  returns: s.array(s.object({ id: s.string(), size: s.number() })),
   agent: {
     description: 'List the N largest modules in the current build. Safe to call freely.',
     title: 'List modules',
 
@@ -168,7 +168,7 @@ const payload = await my.rpc.call('get-payload')
 
 ## Typed CLI flags
 
-For flags that are specific to your tool, declare them as valibot schemas so they're validated at parse time and typed at the call site:
+For flags that are specific to your tool, declare them with any [Standard Schema](https://standardschema.dev/) validator (valibot below, or zod / arktype / devframe's built-in `s`) so they're validated at parse time and typed at the call site:
 
 ```ts
 import type { InferCliFlags } from 'devframe/adapters/cac'
 
@@ -28,7 +28,7 @@ defineDevframe({
 | `KNOWN_EDITORS` | — | `readonly string[]` | — | The editor commands `openInEditor`'s `editor` argument accepts (`code`, `vim`, `subl`, `idea`, …). |
 | `KnownEditor` | — | type | — | Union of `KNOWN_EDITORS`. |
 
-Both functions are `action`-type RPCs returning `void` and use `valibot` schemas for their arguments — `openInEditor`'s `editor` argument is `v.optional(v.picklist(KNOWN_EDITORS))`, so a value outside `KNOWN_EDITORS` fails validation rather than reaching the underlying `launch-editor` process spawn. Both handlers dynamically `import()` their underlying `devframe/utils/*` implementation, so the `launch-editor` and `open` dependencies only load when the recipe actually runs.
+Both functions are `action`-type RPCs returning `void` and declare their arguments with devframe's built-in zero-dependency `s` builder from `devframe/utils/schema` — `openInEditor`'s `editor` argument is `s.optional(s.picklist(KNOWN_EDITORS))`, so a value outside `KNOWN_EDITORS` fails validation rather than reaching the underlying `launch-editor` process spawn. Both handlers dynamically `import()` their underlying `devframe/utils/*` implementation, so the `launch-editor` and `open` dependencies only load when the recipe actually runs.
 
 The `devframe/recipes/open-helpers` entry (`openHelpers`) remains as a deprecated alias for this module — new code should import `commonRpcFunctions` from `devframe/recipes/common-rpc-functions`.
 
 
@@ -50,6 +50,7 @@
     "./utils/nanoid": "./dist/utils/nanoid.mjs",
     "./utils/open": "./dist/utils/open.mjs",
     "./utils/promise": "./dist/utils/promise.mjs",
+    "./utils/schema": "./dist/utils/schema.mjs",
     "./utils/scope": "./dist/utils/scope.mjs",
     "./utils/serve-static": "./dist/utils/serve-static.mjs",
     "./utils/shared-state": "./dist/utils/shared-state.mjs",
@@ -83,16 +84,14 @@
   },
   "dependencies": {
     "@standard-schema/spec": "catalog:deps",
-    "@valibot/to-json-schema": "catalog:deps",
     "birpc": "catalog:deps",
     "crossws": "catalog:deps",
     "destr": "catalog:deps",
     "h3": "catalog:deps",
     "mrmime": "catalog:deps",
     "nostics": "catalog:deps",
     "pathe": "catalog:deps",
-    "ufo": "catalog:deps",
-    "valibot": "catalog:deps"
+    "ufo": "catalog:deps"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "catalog:deps",
@@ -111,6 +110,7 @@
     "tinyglobby": "catalog:deps",
     "tsdown": "catalog:build",
     "ua-parser-modern": "catalog:inlined",
+    "valibot": "catalog:deps",
     "whenexpr": "catalog:deps",
     "ws": "catalog:deps"
   }
 
@@ -1,14 +1,14 @@
-import type { GenericSchema, InferOutput } from 'valibot'
-import { safeParse } from 'valibot'
+import type { StandardSchemaV1 } from '@standard-schema/spec'
 
 /**
  * Schema map for typed CLI flags. Keys are flag names in camelCase —
  * this matches CAC's parsed-flag output ( `--no-open` → `noOpen` ). Each
- * value is a valibot schema used to both (a) derive the CAC option type
- * when the flag is registered and (b) validate / coerce the parsed
- * value before it's forwarded to `setup(ctx, { flags })`.
+ * value is any [Standard Schema](https://standardschema.dev/) validator
+ * (valibot, zod, arktype, devframe's built-in `s`, …) used to both (a)
+ * derive the CAC option type when the flag is registered and (b) validate
+ * the parsed value before it's forwarded to `setup(ctx, { flags })`.
  */
-export type CliFlagsSchema = Record<string, GenericSchema>
+export type CliFlagsSchema = Record<string, StandardSchemaV1>
 
 /**
  * Identity helper that preserves the literal schema-map type — use this
@@ -36,16 +36,18 @@ export function defineCliFlags<T extends CliFlagsSchema>(flags: T): T {
 
 /** Extract the parsed-output type from a {@link CliFlagsSchema}. */
 export type InferCliFlags<T extends CliFlagsSchema> = {
-  [K in keyof T]: InferOutput<T[K]>
+  [K in keyof T]: StandardSchemaV1.InferOutput<T[K]>
 }
 
 /**
- * Best-effort probe of a valibot schema to decide whether the
- * corresponding CAC option takes a value. Unwraps `optional` / `nullable`
- * / `nullish` / `default` / `pipe` wrappers then matches on the inner
- * type's kind.
+ * Best-effort, dependency-free probe of a schema to decide whether the
+ * corresponding CAC option takes a value. Duck-types the `type` /
+ * `wrapped` / `inner` / `pipe` fields exposed by valibot and by devframe's
+ * built-in `s` builder, unwrapping `optional` / `nullable` / `nullish` /
+ * `pipe` wrappers then matching on the inner kind. Validators that don't
+ * expose these fields (e.g. zod) fall through to a value-taking option.
  */
-function getSchemaKind(schema: GenericSchema): string {
+function getSchemaKind(schema: StandardSchemaV1): string {
   let current: any = schema
   while (current) {
     const kind = current.type
@@ -57,31 +59,36 @@ function getSchemaKind(schema: GenericSchema): string {
       current = current.pipe[0]
       continue
     }
-    return kind
+    return kind ?? 'unknown'
   }
   return 'unknown'
 }
 
 /** Whether the CAC option for this schema should be a boolean flag. */
-export function isBooleanFlag(schema: GenericSchema): boolean {
+export function isBooleanFlag(schema: StandardSchemaV1): boolean {
   return getSchemaKind(schema) === 'boolean'
 }
 
-/** Validate and coerce the raw cac-parsed bag against a {@link CliFlagsSchema}. */
+/** Validate the raw cac-parsed bag against a {@link CliFlagsSchema}. */
 export function parseCliFlags(
   schema: CliFlagsSchema,
   raw: Record<string, unknown>,
 ): { flags: Record<string, unknown>, issues?: string[] } {
   const flags: Record<string, unknown> = {}
   const issues: string[] = []
   for (const [key, fieldSchema] of Object.entries(schema)) {
-    const result = safeParse(fieldSchema, raw[key])
-    if (result.success) {
-      flags[key] = result.output
+    const result = fieldSchema['~standard'].validate(raw[key])
+    if (result instanceof Promise) {
+      // CLI parsing is synchronous; an async validator can't be awaited here.
+      issues.push(`--${toKebab(key)}: async flag validation is not supported`)
+      continue
     }
-    else {
+    if (result.issues) {
       issues.push(`--${toKebab(key)}: ${result.issues.map(i => i.message).join(', ')}`)
     }
+    else {
+      flags[key] = result.value
+    }
   }
   // Preserve any raw flags that aren't in the schema (e.g. --host, --port,
   // or options contributed via cli.configure) so authors keep access to
 
@@ -1,42 +1,42 @@
-import * as v from 'valibot'
+import { s } from 'devframe/utils/schema'
 import { describe, expect, it } from 'vitest'
 import { argsToJsonSchema, returnToJsonSchema } from '../to-json-schema'
 
+const PERMISSIVE = { type: 'object', additionalProperties: true }
+
 describe('argsToJsonSchema', () => {
   it('returns an empty object schema when no args', () => {
     const { schema, unwrapped } = argsToJsonSchema(undefined)
     expect(unwrapped).toBe(false)
     expect(schema).toEqual({ type: 'object', properties: {} })
   })
 
-  it('wraps multiple positional args under arg0/arg1/...', () => {
-    const { schema, unwrapped } = argsToJsonSchema([v.string(), v.number()])
+  it('advertises each positional arg as a permissive object under arg0/arg1/...', () => {
+    const { schema, unwrapped } = argsToJsonSchema([s.string(), s.number()])
     expect(unwrapped).toBe(false)
     expect(schema).toMatchObject({
       type: 'object',
       required: ['arg0', 'arg1'],
       additionalProperties: false,
     })
     const props = (schema as any).properties
-    expect(props.arg0).toMatchObject({ type: 'string' })
-    expect(props.arg1).toMatchObject({ type: 'number' })
-  })
-
-  it('unwraps a single object schema for nicer agent UX', () => {
-    const { schema, unwrapped } = argsToJsonSchema([
-      v.object({ name: v.string(), age: v.number() }),
-    ])
-    expect(unwrapped).toBe(true)
-    expect((schema as any).type).toBe('object')
-    const props = (schema as any).properties
-    expect(props.name).toBeDefined()
-    expect(props.age).toBeDefined()
+    expect(props.arg0).toEqual(PERMISSIVE)
+    expect(props.arg1).toEqual(PERMISSIVE)
   })
 
-  it('keeps arg0 shape when the single arg is a primitive', () => {
-    const { schema, unwrapped } = argsToJsonSchema([v.string()])
+  it('wraps a single arg under arg0 (no vendor-specific unwrapping)', () => {
+    const { schema, unwrapped } = argsToJsonSchema([s.object({ name: s.string() })])
     expect(unwrapped).toBe(false)
     expect(schema).toMatchObject({ type: 'object', required: ['arg0'] })
+    expect((schema as any).properties.arg0).toEqual(PERMISSIVE)
+  })
+
+  it('works with any Standard Schema vendor (falls back the same way)', () => {
+    const foreign = {
+      '~standard': { version: 1 as const, vendor: 'acme', validate: (value: unknown) => ({ value }) },
+    }
+    const { schema } = argsToJsonSchema([foreign])
+    expect((schema as any).properties.arg0).toEqual(PERMISSIVE)
   })
 })
 
@@ -45,38 +45,7 @@ describe('returnToJsonSchema', () => {
     expect(returnToJsonSchema(undefined)).toBeUndefined()
   })
 
-  it('converts a simple schema', () => {
-    const schema = returnToJsonSchema(v.object({ ok: v.boolean() }))
-    expect((schema as any).type).toBe('object')
-    expect((schema as any).properties.ok).toMatchObject({ type: 'boolean' })
-  })
-})
-
-describe('non-valibot Standard Schemas', () => {
-  // A minimal Standard Schema from a made-up vendor (mirrors zod/arktype,
-  // which devframe core does not depend on) — no valibot internals.
-  const foreign = {
-    '~standard': {
-      version: 1 as const,
-      vendor: 'acme',
-      validate: (value: unknown) => ({ value }),
-    },
-  }
-
-  it('falls back to a permissive object per positional arg', () => {
-    const { schema, unwrapped } = argsToJsonSchema([foreign, foreign])
-    expect(unwrapped).toBe(false)
-    expect(schema).toMatchObject({ type: 'object', required: ['arg0', 'arg1'] })
-    expect((schema as any).properties.arg0).toEqual({ type: 'object', additionalProperties: true })
-  })
-
-  it('unwraps a single foreign arg to the permissive object', () => {
-    const { schema, unwrapped } = argsToJsonSchema([foreign])
-    expect(unwrapped).toBe(true)
-    expect(schema).toEqual({ type: 'object', additionalProperties: true })
-  })
-
-  it('falls back to a permissive object schema for returns', () => {
-    expect(returnToJsonSchema(foreign)).toEqual({ type: 'object', additionalProperties: true })
+  it('advertises a permissive object for any declared return schema', () => {
+    expect(returnToJsonSchema(s.object({ ok: s.boolean() }))).toEqual(PERMISSIVE)
   })
 })