devframe 0.8.2 → 0.9.0-beta.10

package/dist/{diagnostics-D7wM2cwM.mjs → diagnostics-DOQPnQmX.mjs}

@@ -1,9 +1,7 @@
-import { t as devframeReporter } from "./diagnostics-reporter-CsIG85Q5.mjs";
-import { defineDiagnostics } from "nostics";
+import { i as defineDiagnostics } from "./nostics-CzECRXpE.mjs";
 //#region src/node/diagnostics.ts
 const diagnostics = defineDiagnostics({
 	docsBase: "https://devfra.me/errors",
-	reporters: [devframeReporter],
 	codes: {
 		DF0006: { why: (p) => `RPC function "${p.name}" is not registered` },
 		DF0007: { why: "AsyncLocalStorage is not set, it likely to be an internal bug of the Devframe foundation" },
@@ -38,7 +36,7 @@ const diagnostics = defineDiagnostics({
 		},
 		DF0033: {
 			why: (p) => `Failed to start dev RPC bridge for "${p.id}": ${p.reason}`,
-			fix: "Verify the bridge port is free and the devframe setup function does not throw. Pin a port via `cli.port` / `cli.portRange` on the definition, or via `devMiddleware.port` on `viteDevBridge`."
+			fix: "Verify the bridge port is free and the devframe setup function does not throw. Pin a port via `cli.port` / `cli.portRange` on the definition, or via `port` on `devframeViteBridge` (`@devframes/vite`)."
 		},
 		DF0034: {
 			why: (p) => `Scoped RPC registration for namespace "${p.namespace}" received an already-namespaced function name "${p.name}".`,
@@ -90,7 +88,55 @@ const diagnostics = defineDiagnostics({
 		},
 		DF0052: {
 			why: (p) => `Failed to listen on ${p.host}:${p.port}: ${p.reason}`,
-			fix: "The port is likely already taken by another process (often a previous devframe instance). Free it, or pick another via `--port`, `cli.port` / `cli.portRange` on the definition, or `devMiddleware.port` on `viteDevBridge`. The original node error is available as `error.cause`."
+			fix: "The port is likely already taken by another process (often a previous devframe instance). Free it, or pick another via `--port`, `cli.port` / `cli.portRange` on the definition, or `port` on `devframeViteBridge` (`@devframes/vite`). The original node error is available as `error.cause`."
+		},
+		DF0054: {
+			why: (p) => `connectionMeta() was called before initDevframe("${p.id}") finished initializing.`,
+			fix: "Await `instance.ready` (or any request through `instance.handler`) before reading `connectionMeta()` — the WebSocket binding it describes is only known once initialization completes."
+		},
+		DF0055: {
+			why: (p) => `This instance already owns its WebSocket transport (${p.tier}), so it cannot take over the host's upgrade events.`,
+			fix: "Drop `handleUpgrade`/`attach` and let the configured transport serve the socket, or remove `server` / `ws.port` / `ws.sidecar` from the options so the instance leaves the binding to you."
+		},
+		DF0056: {
+			why: (p) => `This instance advertises an external WebSocket endpoint (${p.url}), so it serves no socket of its own.`,
+			fix: "The server behind `ws.url` owns the transport (and its auth). Drop `ws.url` to have the instance serve the socket, or pair it with `server` / `ws.port` / `ws.sidecar` for the tunnel pattern, where a local binding is advertised through the relay."
+		},
+		DF0057: {
+			why: () => "This instance disables its WebSocket transport (`ws: false`), so there is no socket to drive upgrades into.",
+			fix: "Clients connect over the SSE endpoint instead — no upgrade wiring is needed. Remove `ws: false` if the instance should serve a WebSocket after all."
+		},
+		DF0058: {
+			why: (p) => `"${p.id}" declares \`capabilities.dev: false\` — it does not support a live dev server (its value is a static export only).`,
+			fix: "Pass `{ force: true }` to `createDevServer()` to run it anyway, or drop `capabilities.dev: false` on the definition."
+		},
+		DF0059: {
+			why: (p) => `Failed to fetch the file listing for "${p.package}@${p.version}" from ${p.provider}: ${p.reason}`,
+			fix: "Requests fall back to probing the provider per file. Check network access to the provider, or install the assets package locally so no listing is needed."
+		},
+		DF0060: {
+			why: (p) => `Failed to fetch a remote asset of "${p.package}" (${p.url}): ${p.reason}`,
+			fix: "Install the assets package locally (`npm install <package>`) to serve it with zero network, or check network access to the configured provider."
+		},
+		DF0061: {
+			why: (p) => `The locally installed "${p.package}@${p.installed}" is a different major version than the required "${p.required}".`,
+			fix: "Align the installed assets package with the version its node package declares — they are published in lockstep."
+		},
+		DF0062: {
+			why: (p) => `The locally installed "${p.package}@${p.installed}" differs from the required "${p.required}" — serving the installed one.`,
+			fix: "Install the exact declared version to serve byte-identical assets."
+		},
+		DF0063: {
+			why: (p) => `Failed to persist a remote asset into the cache at "${p.filepath}": ${p.reason}`,
+			fix: "The response was still served; only caching failed. Check that the cache directory is writable and has free space."
+		},
+		DF0064: {
+			why: (p) => `Failed to materialize the remote assets of "${p.package}@${p.version}": ${p.reason}`,
+			fix: "Static builds need every asset file up front. Install the assets package locally, or ensure the provider (and its file-listing API) is reachable during the build."
+		},
+		DF0065: {
+			why: (p) => `Invalid remote-assets ${p.field} "${p.value}".`,
+			fix: "A remote-assets `package` must be a valid npm package name and `version` an exact semver version (e.g. `1.2.3`) — they are interpolated into CDN URLs and the cache path."
 		}
 	}
 });

package/dist/dist-eNI9qM_I.mjs

@@ -0,0 +1,228 @@
+import { n as __exportAll } from "./rolldown-runtime-JspESFgx.mjs";
+import "node:fs/promises";
+import { createServer } from "node:net";
+import { networkInterfaces } from "node:os";
+//#region ../../node_modules/.pnpm/get-port-please@3.2.0/node_modules/get-port-please/dist/index.mjs
+var dist_exports = /* @__PURE__ */ __exportAll({
+	checkPort: () => checkPort,
+	getPort: () => getPort,
+	getRandomPort: () => getRandomPort,
+	isSafePort: () => isSafePort,
+	isUnsafePort: () => isUnsafePort
+});
+const unsafePorts = /* @__PURE__ */ new Set([
+	1,
+	7,
+	9,
+	11,
+	13,
+	15,
+	17,
+	19,
+	20,
+	21,
+	22,
+	23,
+	25,
+	37,
+	42,
+	43,
+	53,
+	69,
+	77,
+	79,
+	87,
+	95,
+	101,
+	102,
+	103,
+	104,
+	109,
+	110,
+	111,
+	113,
+	115,
+	117,
+	119,
+	123,
+	135,
+	137,
+	139,
+	143,
+	161,
+	179,
+	389,
+	427,
+	465,
+	512,
+	513,
+	514,
+	515,
+	526,
+	530,
+	531,
+	532,
+	540,
+	548,
+	554,
+	556,
+	563,
+	587,
+	601,
+	636,
+	989,
+	990,
+	993,
+	995,
+	1719,
+	1720,
+	1723,
+	2049,
+	3659,
+	4045,
+	5060,
+	5061,
+	6e3,
+	6566,
+	6665,
+	6666,
+	6667,
+	6668,
+	6669,
+	6697,
+	10080
+]);
+function isUnsafePort(port) {
+	return unsafePorts.has(port);
+}
+function isSafePort(port) {
+	return !isUnsafePort(port);
+}
+var GetPortError = class extends Error {
+	constructor(message, opts) {
+		super(message, opts);
+		this.message = message;
+	}
+	name = "GetPortError";
+};
+function _log(verbose, message) {
+	if (verbose) console.log(`[get-port] ${message}`);
+}
+function _generateRange(from, to) {
+	if (to < from) return [];
+	const r = [];
+	for (let index = from; index <= to; index++) r.push(index);
+	return r;
+}
+function _tryPort(port, host) {
+	return new Promise((resolve) => {
+		const server = createServer();
+		server.unref();
+		server.on("error", () => {
+			resolve(false);
+		});
+		server.listen({
+			port,
+			host
+		}, () => {
+			const { port: port2 } = server.address();
+			server.close(() => {
+				resolve(isSafePort(port2) && port2);
+			});
+		});
+	});
+}
+function _getLocalHosts(additional) {
+	const hosts = new Set(additional);
+	for (const _interface of Object.values(networkInterfaces())) for (const config of _interface || []) if (config.address && !config.internal && !config.address.startsWith("fe80::") && !config.address.startsWith("169.254")) hosts.add(config.address);
+	return [...hosts];
+}
+async function _findPort(ports, host) {
+	for (const port of ports) {
+		const r = await _tryPort(port, host);
+		if (r) return r;
+	}
+}
+function _fmtOnHost(hostname) {
+	return hostname ? `on host ${JSON.stringify(hostname)}` : "on any host";
+}
+const HOSTNAME_RE = /^(?!-)[\d.:A-Za-z-]{1,63}(?<!-)$/;
+function _validateHostname(hostname, _public, verbose) {
+	if (hostname && !HOSTNAME_RE.test(hostname)) {
+		const fallbackHost = _public ? "0.0.0.0" : "127.0.0.1";
+		_log(verbose, `Invalid hostname: ${JSON.stringify(hostname)}. Using ${JSON.stringify(fallbackHost)} as fallback.`);
+		return fallbackHost;
+	}
+	return hostname;
+}
+async function getPort(_userOptions = {}) {
+	if (typeof _userOptions === "number" || typeof _userOptions === "string") _userOptions = { port: Number.parseInt(_userOptions + "") || 0 };
+	const _port = Number(_userOptions.port ?? process.env.PORT);
+	const _userSpecifiedAnyPort = Boolean(_userOptions.port || _userOptions.ports?.length || _userOptions.portRange?.length);
+	const options = {
+		random: _port === 0,
+		ports: [],
+		portRange: [],
+		alternativePortRange: _userSpecifiedAnyPort ? [] : [3e3, 3100],
+		verbose: false,
+		..._userOptions,
+		port: _port,
+		host: _validateHostname(_userOptions.host ?? process.env.HOST, _userOptions.public, _userOptions.verbose)
+	};
+	if (options.random && !_userSpecifiedAnyPort) return getRandomPort(options.host);
+	const portsToCheck = [
+		options.port,
+		...options.ports,
+		..._generateRange(...options.portRange)
+	].filter((port) => {
+		if (!port) return false;
+		if (!isSafePort(port)) {
+			_log(options.verbose, `Ignoring unsafe port: ${port}`);
+			return false;
+		}
+		return true;
+	});
+	if (portsToCheck.length === 0) portsToCheck.push(3e3);
+	let availablePort = await _findPort(portsToCheck, options.host);
+	if (!availablePort && options.alternativePortRange.length > 0) {
+		availablePort = await _findPort(_generateRange(...options.alternativePortRange), options.host);
+		if (portsToCheck.length > 0) {
+			let message = `Unable to find an available port (tried ${portsToCheck.join("-")} ${_fmtOnHost(options.host)}).`;
+			if (availablePort) message += ` Using alternative port ${availablePort}.`;
+			_log(options.verbose, message);
+		}
+	}
+	if (!availablePort && _userOptions.random !== false) {
+		availablePort = await getRandomPort(options.host);
+		if (availablePort) _log(options.verbose, `Using random port ${availablePort}`);
+	}
+	if (!availablePort) {
+		const triedRanges = [
+			options.port,
+			options.portRange.join("-"),
+			options.alternativePortRange.join("-")
+		].filter(Boolean).join(", ");
+		throw new GetPortError(`Unable to find an available port ${_fmtOnHost(options.host)} (tried ${triedRanges})`);
+	}
+	return availablePort;
+}
+async function getRandomPort(host) {
+	const port = await checkPort(0, host);
+	if (port === false) throw new GetPortError(`Unable to find a random port ${_fmtOnHost(host)}`);
+	return port;
+}
+async function checkPort(port, host = process.env.HOST, verbose) {
+	if (!host) host = _getLocalHosts([void 0, "0.0.0.0"]);
+	if (!Array.isArray(host)) return _tryPort(port, host);
+	for (const _host of host) {
+		const _port = await _tryPort(port, _host);
+		if (_port === false) {
+			if (port < 1024 && verbose) _log(verbose, `Unable to listen to the privileged port ${port} ${_fmtOnHost(_host)}`);
+			return false;
+		}
+		if (port === 0 && _port !== 0) port = _port;
+	}
+	return port;
+}
+//#endregion
+export { getPort as n, dist_exports as t };

package/dist/host-agent-xLCSe65D.mjs

@@ -0,0 +1,264 @@
+import { t as diagnostics } from "./diagnostics-DOQPnQmX.mjs";
+//#region src/utils/events.ts
+/**
+* Create event emitter.
+*/
+function createEventEmitter() {
+	const _listeners = {};
+	function emit(event, ...args) {
+		const callbacks = _listeners[event] || [];
+		for (let i = 0, length = callbacks.length; i < length; i++) {
+			const callback = callbacks[i];
+			if (callback) callback(...args);
+		}
+	}
+	function emitOnce(event, ...args) {
+		emit(event, ...args);
+		delete _listeners[event];
+	}
+	function on(event, cb) {
+		(_listeners[event] ||= []).push(cb);
+		return () => {
+			_listeners[event] = _listeners[event]?.filter((i) => cb !== i);
+		};
+	}
+	function once(event, cb) {
+		const unsubscribe = on(event, ((...args) => {
+			unsubscribe();
+			return cb(...args);
+		}));
+		return unsubscribe;
+	}
+	return {
+		_listeners,
+		emit,
+		emitOnce,
+		on,
+		once
+	};
+}
+//#endregion
+//#region src/node/agent-args.ts
+/**
+* Map the args payload an agent surface receives (MCP sends an object
+* keyed `arg0`/`arg1`/…, matching the schema the adapter advertises) onto
+* a handler's positional parameters. Shared by the agent host's RPC
+* bridge and the hub's command-derived tools so the coercion cannot
+* drift between them.
+*
+* - an array passes through as-is
+* - `null`/`undefined` become a zero-argument call
+* - with declared schemas, each schema reads its own `argN` key, in order
+* - without schemas, `arg0`/`arg1`/… keys are collected when present
+* - an empty object becomes a zero-argument call
+* - anything else follows the {@link AgentArgsFallback}
+*/
+function coerceAgentPositionalArgs(args, schemas, fallback = "wrap") {
+	if (Array.isArray(args)) return args;
+	if (args === void 0 || args === null) return [];
+	if (typeof args === "object") {
+		const obj = args;
+		if (schemas && schemas.length) return schemas.map((_, i) => obj[`arg${i}`]);
+		if ("arg0" in obj) {
+			const out = [];
+			let i = 0;
+			while (`arg${i}` in obj) {
+				out.push(obj[`arg${i}`]);
+				i++;
+			}
+			return out;
+		}
+		if (Object.keys(obj).length === 0) return [];
+	}
+	return fallback === "drop" ? [] : [args];
+}
+//#endregion
+//#region src/node/host-agent.ts
+/**
+* Framework-neutral host aggregating the agent-exposed surface of a
+* devframe. Auto-discovers RPC functions with an `agent` field from
+* `ctx.rpc.definitions`, and accepts plugin-registered tools /
+* resources via `registerTool` / `registerResource`.
+*/
+var DevframeAgentHost = class {
+	context;
+	events = createEventEmitter();
+	tools = /* @__PURE__ */ new Map();
+	resources = /* @__PURE__ */ new Map();
+	providers = /* @__PURE__ */ new Set();
+	_rpcUnsubscribe;
+	constructor(context) {
+		this.context = context;
+		this._rpcUnsubscribe = context.rpc.onChanged(() => {
+			this.events.emit("agent:manifest:changed");
+		});
+	}
+	registerTool(input) {
+		this._validateToolId(input.id);
+		const tool = this._projectTool(input);
+		this.tools.set(tool.id, {
+			tool,
+			handler: input.handler
+		});
+		this.events.emit("agent:tool:registered", tool);
+		this.events.emit("agent:manifest:changed");
+		return { unregister: () => this.unregisterTool(tool.id) };
+	}
+	unregisterTool(id) {
+		const existed = this.tools.delete(id);
+		if (existed) {
+			this.events.emit("agent:tool:unregistered", id);
+			this.events.emit("agent:manifest:changed");
+		}
+		return existed;
+	}
+	registerToolProvider(provider) {
+		this.providers.add(provider);
+		this.events.emit("agent:manifest:changed");
+		const notifyChanged = () => {
+			if (this.providers.has(provider)) this.events.emit("agent:manifest:changed");
+		};
+		return {
+			notifyChanged,
+			unregister: () => {
+				if (this.providers.delete(provider)) this.events.emit("agent:manifest:changed");
+			}
+		};
+	}
+	registerResource(input) {
+		if (this.resources.has(input.id)) throw diagnostics.DF0016({ id: input.id });
+		const resource = {
+			id: input.id,
+			name: input.name,
+			description: input.description,
+			mimeType: input.mimeType ?? "application/json",
+			uri: input.uri ?? `devframe://resource/${encodeURIComponent(input.id)}`
+		};
+		this.resources.set(resource.id, {
+			resource,
+			read: input.read
+		});
+		this.events.emit("agent:resource:registered", resource);
+		this.events.emit("agent:manifest:changed");
+		return { unregister: () => this.unregisterResource(resource.id) };
+	}
+	unregisterResource(id) {
+		const existed = this.resources.delete(id);
+		if (existed) {
+			this.events.emit("agent:resource:unregistered", id);
+			this.events.emit("agent:manifest:changed");
+		}
+		return existed;
+	}
+	list() {
+		const rpcTools = this._collectRpcTools();
+		const plainTools = Array.from(this.tools.values()).map((t) => t.tool);
+		const resources = Array.from(this.resources.values()).map((r) => r.resource);
+		const seen = new Set([...rpcTools, ...plainTools].map((t) => t.id));
+		const providerTools = [];
+		for (const { tool } of this._collectProviderTools()) {
+			if (seen.has(tool.id)) continue;
+			seen.add(tool.id);
+			providerTools.push(tool);
+		}
+		return {
+			tools: [
+				...rpcTools,
+				...plainTools,
+				...providerTools
+			],
+			resources
+		};
+	}
+	getTool(id) {
+		const plain = this.tools.get(id);
+		if (plain) return plain.tool;
+		const rpc = this._collectRpcTools().find((t) => t.id === id);
+		if (rpc) return rpc;
+		return this._collectProviderTools().find((t) => t.tool.id === id)?.tool;
+	}
+	getResource(id) {
+		return this.resources.get(id)?.resource;
+	}
+	async invoke(id, args) {
+		const plain = this.tools.get(id);
+		if (plain?.handler) return await plain.handler(args);
+		const rpcDef = this._findRpcDefinition(id);
+		if (rpcDef) {
+			const positional = coerceAgentPositionalArgs(args, rpcDef.args, "wrap");
+			return await this.context.rpc.invokeLocal(id, ...positional);
+		}
+		const provided = this._collectProviderTools().find((t) => t.tool.id === id);
+		if (provided) return await provided.input.handler(args);
+		throw new Error(`[devframe/agent] tool "${id}" not found`);
+	}
+	async read(id) {
+		const entry = this.resources.get(id);
+		if (!entry) throw new Error(`[devframe/agent] resource "${id}" not found`);
+		return await entry.read();
+	}
+	/** @internal */
+	_dispose() {
+		this._rpcUnsubscribe?.();
+		this._rpcUnsubscribe = void 0;
+	}
+	_validateToolId(id) {
+		if (this.tools.has(id)) throw diagnostics.DF0015({ id });
+		if (this.context.rpc.definitions.get(id)?.agent) throw diagnostics.DF0015({ id });
+	}
+	_projectTool(input) {
+		if (!input.description || typeof input.description !== "string") throw diagnostics.DF0014({ name: input.id });
+		return {
+			id: input.id,
+			kind: "tool",
+			title: input.title ?? input.id,
+			description: input.description,
+			safety: input.safety ?? "action",
+			tags: input.tags,
+			args: input.args,
+			inputSchema: input.inputSchema,
+			outputSchema: input.outputSchema,
+			examples: input.examples
+		};
+	}
+	/** Query every registered provider, projecting inputs to serializable tools. */
+	_collectProviderTools() {
+		const out = [];
+		for (const provider of this.providers) for (const input of provider()) out.push({
+			input,
+			tool: this._projectTool(input)
+		});
+		return out;
+	}
+	_collectRpcTools() {
+		const out = [];
+		for (const [name, def] of this.context.rpc.definitions) {
+			const agent = def.agent;
+			if (!agent) continue;
+			if (!agent.description || typeof agent.description !== "string") throw diagnostics.DF0014({ name });
+			const type = def.type ?? "query";
+			const safety = agent.safety ?? inferSafety(type);
+			out.push({
+				id: name,
+				kind: "rpc",
+				title: agent.title ?? name,
+				description: agent.description,
+				safety,
+				tags: agent.tags,
+				rpcName: name,
+				examples: agent.examples
+			});
+		}
+		return out;
+	}
+	_findRpcDefinition(id) {
+		const def = this.context.rpc.definitions.get(id);
+		if (def?.agent) return def;
+	}
+};
+function inferSafety(type) {
+	if (type === "static" || type === "query") return "read";
+	return "action";
+}
+//#endregion
+export { coerceAgentPositionalArgs as n, createEventEmitter as r, DevframeAgentHost as t };

package/dist/host-h3-Crkzm42q.mjs

@@ -0,0 +1,26 @@
+import { join } from "pathe";
+import process from "node:process";
+import { homedir } from "node:os";
+//#region src/node/host-h3.ts
+/**
+* h3-backed {@link DevframeHost} — used by the standalone CLI adapter.
+*/
+function createH3DevframeHost(options) {
+	const workspaceRoot = options.workspaceRoot ?? process.cwd();
+	return {
+		mountStatic(base, source) {
+			return options.mount?.(base, source);
+		},
+		resolveOrigin() {
+			return typeof options.origin === "function" ? options.origin() : options.origin;
+		},
+		getStorageDir(scope) {
+			const namespace = `.${options.appName}/devframe`;
+			if (scope === "workspace") return join(workspaceRoot, ".devframe");
+			if (scope === "project") return join(workspaceRoot, "node_modules", namespace);
+			return join(homedir(), namespace);
+		}
+	};
+}
+//#endregion
+export { createH3DevframeHost as t };

package/dist/{fetch-BKaD0Vb3.mjs → http-DYpK0cUi.mjs}

@@ -1,12 +1,14 @@
-import { isAllowedOrigin } from "./rpc/transports/ws-server.mjs";
-import { n as createHostContext } from "./host-h3-D2hYZvDK.mjs";
-import { t as diagnostics } from "./diagnostics-D7wM2cwM.mjs";
-import { t as toAgentToolName } from "./agent-tool-name-C3b5vEwJ.mjs";
+import { n as __exportAll } from "./rolldown-runtime-JspESFgx.mjs";
+import { t as Diagnostic } from "./nostics-CzECRXpE.mjs";
+import { i as isAllowedOrigin } from "./ws-server-BdSLrhxE.mjs";
+import { t as diagnostics } from "./diagnostics-DOQPnQmX.mjs";
+import { t as createHostContext } from "./context-CEe4PBz1.mjs";
+import { t as toAgentToolName } from "./agent-tool-name-EgfoFO8C.mjs";
 import { randomUUID } from "node:crypto";
-import { Diagnostic } from "nostics";
 import { join } from "pathe";
 import process from "node:process";
 import { homedir } from "node:os";
+import { defineHandler } from "h3";
 import { Server, WebStandardStreamableHTTPServerTransport, isInitializeRequest } from "@modelcontextprotocol/server";
 //#region src/adapters/mcp/stringify.ts
 /**
@@ -188,9 +190,6 @@ function buildMcpServerFromContext(ctx, options) {
 /**
 * Build an MCP server over the agent surface of a devframe definition.
 * Currently supports `stdio` transport only.
-*
-* @experimental The agent-native surface is experimental and may change
-* without a major version bump until it stabilizes.
 */
 async function createMcpServer(definition, options = {}) {
 	const transport = options.transport ?? "stdio";
@@ -461,8 +460,6 @@ function parseResourceUri(uri) {
 * loopback-default DNS-rebinding protection that — unlike the WS upgrade's
 * `isAllowedOrigin` — also rejects `Origin`-less requests, so a route-based
 * endpoint isn't reachable by an arbitrary local process.
-*
-* @experimental
 */
 function createMcpFetchHandler(ctx, options) {
 	const sessions = /* @__PURE__ */ new Map();
@@ -531,4 +528,38 @@ function createMcpFetchHandler(ctx, options) {
 	};
 }
 //#endregion
-export { createMcpServer as n, createMcpFetchHandler as t };
+//#region src/adapters/mcp/http.ts
+var http_exports = /* @__PURE__ */ __exportAll({ mountMcpHttp: () => mountMcpHttp });
+/**
+* Mount an MCP Streamable-HTTP endpoint on an h3 app at `path` — the h3
+* binding over {@link createMcpFetchHandler}, which owns the sessions, the
+* origin gate, and the transport plumbing.
+*
+* The handler is web-standard — it takes the h3 event's web `Request` and
+* returns a web `Response` (an SSE `ReadableStream` body for the
+* server→client stream). We copy that response onto `event.res` and return
+* its body rather than returning the `Response` object directly, so a
+* legitimate MCP 404 (unknown session) isn't swallowed by h3's
+* "Response-with-404 falls through to the next handler" rule (which would
+* otherwise hand the request to the SPA static catch-all).
+*/
+function mountMcpHttp(app, ctx, path, options) {
+	const handler = createMcpFetchHandler(ctx, options);
+	app.use(path, defineHandler(async (event) => respond(event, await handler.fetch(event.req))));
+	return { dispose: handler.dispose };
+}
+/**
+* Copy a web `Response` from the MCP transport onto the h3 event's response
+* and return its body. Returning the body (a `ReadableStream` or `null`)
+* rather than the `Response` object avoids h3's 404-fall-through behavior.
+*/
+function respond(event, response) {
+	event.res.status = response.status;
+	event.res.statusText = response.statusText;
+	response.headers.forEach((value, key) => {
+		event.res.headers.set(key, value);
+	});
+	return response.body ?? "";
+}
+//#endregion
+export { createMcpServer as i, mountMcpHttp as n, createMcpFetchHandler as r, http_exports as t };

package/dist/{index-b64Uuhy2.d.mts → index-CB-fSUyn.d.mts}

@@ -1,5 +1,5 @@
-import { W as DevframeNodeRpcSession, b as DevframeNodeContext, ht as SharedState } from "./devframe-mQ4qZAuo.mjs";
-import { n as InternalAnonymousAuthStorage } from "./context-DoSozfvx.mjs";
+import { R as DevframeNodeRpcSession, g as DevframeNodeContext, lt as SharedState } from "./devframe-DJMg0WLe.mjs";
+import { n as InternalAnonymousAuthStorage } from "./context-B3YUu_95.mjs";
 //#region src/node/auth/revoke.d.ts
 /**
  * Flip `isTrusted` to false on any live WS clients connected with `token`