@devframes/next 0.9.9 → 0.9.11

package/dist/hub.d.mts

@@ -76,8 +76,8 @@ interface DevframeNextHost {
    * Serve an MCP Streamable-HTTP endpoint at `path` **in-process**, on the
    * Next app's own origin, through the same catch-all route as the SPAs (the
    * `/_next/mcp` shape). Built on `createMcpFetchHandler` from
-   * `devframe/adapters/mcp` (imported lazily: `@modelcontextprotocol/server`
-   * stays an optional peer). Advertise the path in the connection meta
+   * `devframe/adapters/mcp` (imported lazily, so the MCP SDK stays out of
+   * the app's bundle graph). Advertise the path in the connection meta
    * (`mcp: { path }`, same origin, no port) and register the instance via
    * `registerDevframeInstance` so `devframe connect` can discover it.
    */
@@ -143,9 +143,11 @@ interface NextDevframeHubOptions {
   /** The hub's single auth gate. Gates by default; `false` opts out. */
   auth?: InitHubOptions['auth'];
   /**
-   * Expose the aggregate MCP endpoint at `<base>__mcp`. Disabled by default;
-   * `true` mounts it with the loopback origin gate (trusting same-machine
-   * callers), or pass an object to opt into an `authorization` identity check.
+   * Expose the aggregate MCP endpoint at `<base>__mcp`. Defaults to `'auto'`
+   * (mount once any mounted devframe exposes an agent surface); `true`
+   * mounts it unconditionally with the
+   * loopback origin gate (trusting same-machine callers), an object opts
+   * into an `authorization` identity check, `false` keeps it off.
    */
   mcp?: InitHubOptions['mcp'];
   /** Public origin the Next app is reachable at. Default: derived from `PORT`. */
@@ -163,8 +165,8 @@ interface NextDevframeHubOptions {
  * Build a devframes-hub for a Next.js App Router app: one `initHub()` call
  * mounting every devframe under `<base><id>/` behind one web-standard
  * `handler`, with the RPC socket on a side-car (Next routes can't accept WS
- * upgrades) and the aggregate MCP route opt-in (pass `mcp` to enable it). The
- * UI defaults to
+ * upgrades) and the aggregate MCP route mounted on demand (the `'auto'`
+ * default; pass `mcp` to force or disable it). The UI defaults to
  * `@devframes/hub-ui`'s `createUi()`, loaded lazily via a bundler-ignored
  * dynamic `import()` so its asset lookups resolve at request time; pass `ui`
  * to swap it or `ui: false` for a headless hub.

package/dist/hub.mjs

@@ -84,8 +84,8 @@ function createDevframeNextHost(options) {
 * Build a devframes-hub for a Next.js App Router app: one `initHub()` call
 * mounting every devframe under `<base><id>/` behind one web-standard
 * `handler`, with the RPC socket on a side-car (Next routes can't accept WS
-* upgrades) and the aggregate MCP route opt-in (pass `mcp` to enable it). The
-* UI defaults to
+* upgrades) and the aggregate MCP route mounted on demand (the `'auto'`
+* default; pass `mcp` to force or disable it). The UI defaults to
 * `@devframes/hub-ui`'s `createUi()`, loaded lazily via a bundler-ignored
 * dynamic `import()` so its asset lookups resolve at request time; pass `ui`
 * to swap it or `ui: false` for a headless hub.

package/dist/single.d.mts

@@ -52,6 +52,15 @@ interface CreateDevframeNextHandlerOptions {
    * or a handler for a custom scheme.
    */
   auth?: InitDevframeOptions['auth'];
+  /**
+   * Widen the side-car WebSocket origin check beyond devframe's
+   * loopback-only default. Reaching a remotely-accessed Next dev server
+   * (containers, Codespaces, tunnels) needs the app's own origin allowed.
+   * Pass extra origins, a `WsOriginRegistry`, or `false` to disable the
+   * check (safe when the auth gate owns the trust boundary). Forwarded
+   * verbatim to `initDevframe`.
+   */
+  allowedOrigins?: InitDevframeOptions['allowedOrigins'];
   /** Origin the Next app is reachable at, for docks needing an absolute URL. */
   resolveOrigin?: () => string;
   /** Override where persisted devframe state lives (defaults under the cwd / home). */
@@ -60,8 +69,9 @@ interface CreateDevframeNextHandlerOptions {
    * Expose the route-based MCP server (Streamable-HTTP) at `<base>__mcp`,
    * on the Next app's own origin, through the same catch-all route as the
    * SPA, and advertise it in the handler's `__connection.json`. Overrides
-   * `def.cli?.mcp`, `undefined` falls through to it, `false` disables the
-   * route regardless.
+   * `def.cli?.mcp`, `undefined` falls through to it, then to the `'auto'`
+   * default (mount once the agent surface is non-empty); `false` disables
+   * the route regardless.
    */
   mcp?: InitDevframeOptions['mcp'];
   /**

package/dist/single.mjs

@@ -91,6 +91,7 @@ function createDevframeNextHandler(def, options = {}) {
 		*/
 		auth: options.auth,
 		mcp: options.mcp,
+		allowedOrigins: options.allowedOrigins,
 		/**
 		* Next's route handlers never see WebSocket upgrades, so the RPC socket
 		* lives on a side-car server (on `options.port` when pinned, otherwise

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@devframes/next",
   "type": "module",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "description": "Next.js host integration that serves mounted devframes from an App Router route.",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",
@@ -47,9 +47,9 @@
     "dist"
   ],
   "peerDependencies": {
-    "@devframes/hub": "0.9.9",
-    "@devframes/hub-ui": "0.9.9",
-    "devframe": "0.9.9",
+    "@devframes/hub": "0.9.11",
+    "@devframes/hub-ui": "0.9.11",
+    "devframe": "0.9.11",
     "next": "^14.0.0 || ^15.0.0 || ^16.0.0",
     "react": "^18.0.0 || ^19.0.0"
   },
@@ -71,11 +71,11 @@
     "h3": "^2.0.1-rc.29"
   },
   "devDependencies": {
-    "@devframes/hub": "0.9.9",
-    "@devframes/hub-ui": "0.9.9",
+    "@devframes/hub": "0.9.11",
+    "@devframes/hub-ui": "0.9.11",
     "@types/node": "^26.4.0",
     "@types/react": "^19.2.18",
-    "devframe": "0.9.9",
+    "devframe": "0.9.11",
     "react": "^19.2.8",
     "tsdown": "^0.22.14"
   },