devframe 0.9.0-beta.1 → 0.9.0-beta.10

package/dist/constants.d.mts

@@ -39,7 +39,6 @@ declare const DEVFRAME_SSE_SESSION_HEADER = "x-birpc-session";
 declare const DEVFRAME_MCP_ROUTE = "__mcp";
 declare const DEVFRAME_RPC_DUMP_MANIFEST_FILENAME = "__rpc-dump/index.json";
 declare const DEVFRAME_DOCK_IMPORTS_FILENAME = "__client-imports.js";
-declare const DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID = "/__devframe-client-imports.js";
 declare const DEVFRAME_RPC_DUMP_DIRNAME = "__rpc-dump";
 /**
  * URL fragment / query parameter name carrying the remote dock
@@ -70,6 +69,15 @@ declare const DEVFRAME_AUTH_TOKEN_QUERY_PARAM = "devframe_auth_token";
 declare const DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM = "devframe_viewer_origin";
 /** Token that authorizes an external viewer origin registration. */
 declare const DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM = "devframe_viewer_origin_token";
+/**
+ * `postMessage` type the remote-assets fallback page posts to `window.parent`
+ * on load. That page is what a devframe serves (with a 502) when its client
+ * assets can be reached neither locally nor through their CDN provider — the
+ * message lets an embedding viewer replace the bare page with its own UI
+ * (`@devframes/hub-ui` does, in its iframe view). Payload shape:
+ * `RemoteAssetsErrorMessage` (`devframe/types`).
+ */
+declare const DEVFRAME_REMOTE_ASSETS_ERROR_MESSAGE_TYPE = "devframe:remote-assets-error";
 /**
  * Prefix that marks an RPC method as callable before a connection is
  * trusted. This is the *only* rule the pre-trust gate applies — there is no
@@ -86,4 +94,4 @@ declare const ANONYMOUS_RPC_PREFIX = "anonymous:";
  */
 declare function isAnonymousRpcMethod(name: string): boolean;
 //#endregion
-export { ANONYMOUS_RPC_PREFIX, DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_CONNECTION_KEY, DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID, DEVFRAME_MCP_ROUTE, DEVFRAME_OTP_URL_PARAM, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME, DEVFRAME_SSE_ROUTE, DEVFRAME_SSE_SESSION_HEADER, DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM, DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM, DEVFRAME_WS_ROUTE, REMOTE_CONNECTION_KEY, isAnonymousRpcMethod };
+export { ANONYMOUS_RPC_PREFIX, DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_CONNECTION_KEY, DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_MCP_ROUTE, DEVFRAME_OTP_URL_PARAM, DEVFRAME_REMOTE_ASSETS_ERROR_MESSAGE_TYPE, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME, DEVFRAME_SSE_ROUTE, DEVFRAME_SSE_SESSION_HEADER, DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM, DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM, DEVFRAME_WS_ROUTE, REMOTE_CONNECTION_KEY, isAnonymousRpcMethod };

package/dist/constants.mjs

@@ -39,7 +39,6 @@ const DEVFRAME_SSE_SESSION_HEADER = "x-birpc-session";
 const DEVFRAME_MCP_ROUTE = "__mcp";
 const DEVFRAME_RPC_DUMP_MANIFEST_FILENAME = "__rpc-dump/index.json";
 const DEVFRAME_DOCK_IMPORTS_FILENAME = "__client-imports.js";
-const DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID = "/__devframe-client-imports.js";
 const DEVFRAME_RPC_DUMP_DIRNAME = "__rpc-dump";
 /**
 * URL fragment / query parameter name carrying the remote dock
@@ -71,6 +70,15 @@ const DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM = "devframe_viewer_origin";
 /** Token that authorizes an external viewer origin registration. */
 const DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM = "devframe_viewer_origin_token";
 /**
+* `postMessage` type the remote-assets fallback page posts to `window.parent`
+* on load. That page is what a devframe serves (with a 502) when its client
+* assets can be reached neither locally nor through their CDN provider — the
+* message lets an embedding viewer replace the bare page with its own UI
+* (`@devframes/hub-ui` does, in its iframe view). Payload shape:
+* `RemoteAssetsErrorMessage` (`devframe/types`).
+*/
+const DEVFRAME_REMOTE_ASSETS_ERROR_MESSAGE_TYPE = "devframe:remote-assets-error";
+/**
 * Prefix that marks an RPC method as callable before a connection is
 * trusted. This is the *only* rule the pre-trust gate applies — there is no
 * per-method allowlist. Any handshake method a host adapter needs to reach
@@ -88,4 +96,4 @@ function isAnonymousRpcMethod(name) {
 	return name.startsWith(ANONYMOUS_RPC_PREFIX);
 }
 //#endregion
-export { ANONYMOUS_RPC_PREFIX, DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_CONNECTION_KEY, DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID, DEVFRAME_MCP_ROUTE, DEVFRAME_OTP_URL_PARAM, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME, DEVFRAME_SSE_ROUTE, DEVFRAME_SSE_SESSION_HEADER, DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM, DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM, DEVFRAME_WS_ROUTE, REMOTE_CONNECTION_KEY, isAnonymousRpcMethod };
+export { ANONYMOUS_RPC_PREFIX, DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_CONNECTION_KEY, DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_MCP_ROUTE, DEVFRAME_OTP_URL_PARAM, DEVFRAME_REMOTE_ASSETS_ERROR_MESSAGE_TYPE, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME, DEVFRAME_SSE_ROUTE, DEVFRAME_SSE_SESSION_HEADER, DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM, DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM, DEVFRAME_WS_ROUTE, REMOTE_CONNECTION_KEY, isAnonymousRpcMethod };

package/dist/{context-CSCwoABx.d.mts → context-B3YUu_95.d.mts}

@@ -1,4 +1,4 @@
-import { gt as SharedState, x as DevframeNodeContext } from "./devframe-Bdd9YXTy.mjs";
+import { g as DevframeNodeContext, lt as SharedState } from "./devframe-DJMg0WLe.mjs";
 //#region src/node/hub-internals/context.d.ts
 interface InternalAnonymousAuthStorage {
   trusted: Record<string, {
@@ -44,6 +44,24 @@ interface DevframeInternalContext {
     /** Full `ws://` or `wss://` URL with host and port. */
     url: string;
   };
+  /**
+   * Set {@link DevframeInternalContext.wsEndpoint} and notify subscribers —
+   * the WS-binding tiers (side-car, shared-server, and the `unbound` tier's
+   * `attach()`) call this once the socket is bound (or `undefined` once torn
+   * down) instead of assigning the field directly, so anything that already
+   * projected the endpoint (a hub's remote-dock URLs, registered before an
+   * async bind resolves) gets a chance to re-project it.
+   */
+  setWsEndpoint: (endpoint: {
+    url: string;
+  } | undefined) => void;
+  /**
+   * Subscribe to every {@link DevframeInternalContext.setWsEndpoint} call.
+   * Returns an unsubscribe function. The hub context uses this to refresh
+   * the `devframe:docks` shared state so a remote dock registered before the
+   * WS port resolves still ends up with a live connection URL.
+   */
+  onWsEndpointChange: (cb: () => void) => () => void;
 }
 declare const internalContextMap: WeakMap<DevframeNodeContext, DevframeInternalContext>;
 declare function getInternalContext(context: DevframeNodeContext): DevframeInternalContext;

package/dist/{context-Du11TLcO.mjs → context-CEe4PBz1.mjs}

@@ -1,13 +1,12 @@
-import { t as devframeReporter } from "./diagnostics-reporter-CsIG85Q5.mjs";
-import { t as diagnostics } from "./diagnostics-hwjXp_UV.mjs";
+import { i as defineDiagnostics } from "./nostics-CzECRXpE.mjs";
+import { t as diagnostics } from "./diagnostics-CD8nlgll.mjs";
 import { RpcFunctionsCollectorBase } from "./rpc/index.mjs";
 import { defineRpcFunction } from "./index.mjs";
-import { t as diagnostics$1 } from "./diagnostics-DLYH5oD3.mjs";
-import { i as createEventEmitter, n as createSharedState, r as nanoid, t as createStorage } from "./storage-BcmVEJRc.mjs";
-import { t as DevframeAgentHost } from "./host-agent-CpbAoqBx.mjs";
-import { defineDiagnostics } from "nostics";
-import { isatty } from "node:tty";
-import { formatWithOptions, inspect } from "node:util";
+import { t as diagnostics$1 } from "./diagnostics-DOQPnQmX.mjs";
+import { r as createEventEmitter, t as DevframeAgentHost } from "./host-agent-xLCSe65D.mjs";
+import { n as createDebug, t as resolveStaticAssetsSource } from "./remote-assets-nTTxY2MU.mjs";
+import { t as createStorage } from "./storage-CYye7P7L.mjs";
+import { createSharedState } from "devframe/utils/shared-state";
 import { existsSync } from "node:fs";
 import { join } from "pathe";
 //#region src/node/host-diagnostics.ts
@@ -15,12 +14,7 @@ var DevframeDiagnosticsHost = class {
 	context;
 	_registry = {};
 	logger = new Proxy({}, { get: (_, code) => this._registry[code] });
-	defineDiagnostics = (opts) => {
-		return defineDiagnostics({
-			...opts,
-			reporters: [devframeReporter, ...opts.reporters ?? []]
-		});
-	};
+	defineDiagnostics = defineDiagnostics;
 	constructor(context, initialDefinitions = []) {
 		this.context = context;
 		for (const d of initialDefinitions) this.register(d);
@@ -30,291 +24,6 @@ var DevframeDiagnosticsHost = class {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/obug@2.1.4/node_modules/obug/dist/core.js
-/**
-* Coerce `value`.
-*/
-function coerce(value) {
-	if (value instanceof Error) return value.stack || value.message;
-	return value;
-}
-/**
-* Selects a color for a debug namespace
-* @return An ANSI color code for the given namespace
-*/
-function selectColor(colors, namespace) {
-	let hash = 0;
-	for (let i = 0; i < namespace.length; i++) {
-		hash = (hash << 5) - hash + namespace.charCodeAt(i);
-		hash |= 0;
-	}
-	return colors[Math.abs(hash) % colors.length];
-}
-/**
-* Checks if the given string matches a namespace template, honoring
-* asterisks as wildcards.
-*/
-function matchesTemplate(search, template) {
-	let searchIndex = 0;
-	let templateIndex = 0;
-	let starIndex = -1;
-	let matchIndex = 0;
-	while (searchIndex < search.length) if (templateIndex < template.length && (template[templateIndex] === search[searchIndex] || template[templateIndex] === "*")) if (template[templateIndex] === "*") {
-		starIndex = templateIndex;
-		matchIndex = searchIndex;
-		templateIndex++;
-	} else {
-		searchIndex++;
-		templateIndex++;
-	}
-	else if (starIndex !== -1) {
-		templateIndex = starIndex + 1;
-		matchIndex++;
-		searchIndex = matchIndex;
-	} else return false;
-	while (templateIndex < template.length && template[templateIndex] === "*") templateIndex++;
-	return templateIndex === template.length;
-}
-function humanize(value) {
-	if (value >= 1e3) return `${(value / 1e3).toFixed(1)}s`;
-	return `${value}ms`;
-}
-let globalNamespaces = "";
-function createDebug$1(namespace, options) {
-	let prevTime;
-	let enableOverride;
-	let namespacesCache;
-	let enabledCache;
-	const debug = (...args) => {
-		if (!debug.enabled) return;
-		const curr = Date.now();
-		const diff = curr - (prevTime || curr);
-		prevTime = curr;
-		args[0] = coerce(args[0]);
-		if (typeof args[0] !== "string") args.unshift("%O");
-		let index = 0;
-		args[0] = args[0].replace(/%([a-z%])/gi, (match, format) => {
-			if (match === "%%") return "%";
-			index++;
-			const formatter = options.formatters[format];
-			if (typeof formatter === "function") {
-				const value = args[index];
-				match = formatter.call(debug, value);
-				args.splice(index, 1);
-				index--;
-			}
-			return match;
-		});
-		options.formatArgs.call(debug, diff, args);
-		debug.log(...args);
-	};
-	debug.extend = function(namespace, delimiter = ":") {
-		return createDebug$1(this.namespace + delimiter + namespace, {
-			useColors: this.useColors,
-			color: this.color,
-			formatArgs: this.formatArgs,
-			formatters: this.formatters,
-			inspectOpts: this.inspectOpts,
-			log: this.log,
-			humanize: this.humanize
-		});
-	};
-	Object.assign(debug, options);
-	debug.namespace = namespace;
-	Object.defineProperty(debug, "enabled", {
-		enumerable: true,
-		configurable: false,
-		get: () => {
-			if (enableOverride != null) return enableOverride;
-			if (namespacesCache !== globalNamespaces) {
-				namespacesCache = globalNamespaces;
-				enabledCache = enabled(namespace);
-			}
-			return enabledCache;
-		},
-		set: (v) => {
-			enableOverride = v;
-		}
-	});
-	return debug;
-}
-let names = [];
-let skips = [];
-function enable(namespaces) {
-	globalNamespaces = namespaces;
-	names = [];
-	skips = [];
-	const split = globalNamespaces.trim().replace(/\s+/g, ",").split(",").filter(Boolean);
-	for (const ns of split) if (ns[0] === "-") skips.push(ns.slice(1));
-	else names.push(ns);
-}
-/**
-* Returns true if the given mode name is enabled, false otherwise.
-*/
-function enabled(name) {
-	for (const skip of skips) if (matchesTemplate(name, skip)) return false;
-	for (const ns of names) if (matchesTemplate(name, ns)) return true;
-	return false;
-}
-//#endregion
-//#region ../../node_modules/.pnpm/obug@2.1.4/node_modules/obug/dist/node.js
-let env = {};
-try {
-	process.env.DEBUG;
-	env = process.env;
-} catch (_unused) {}
-const colors = process.stderr.getColorDepth && process.stderr.getColorDepth(env) > 2 ? [
-	20,
-	21,
-	26,
-	27,
-	32,
-	33,
-	38,
-	39,
-	40,
-	41,
-	42,
-	43,
-	44,
-	45,
-	56,
-	57,
-	62,
-	63,
-	68,
-	69,
-	74,
-	75,
-	76,
-	77,
-	78,
-	79,
-	80,
-	81,
-	92,
-	93,
-	98,
-	99,
-	112,
-	113,
-	128,
-	129,
-	134,
-	135,
-	148,
-	149,
-	160,
-	161,
-	162,
-	163,
-	164,
-	165,
-	166,
-	167,
-	168,
-	169,
-	170,
-	171,
-	172,
-	173,
-	178,
-	179,
-	184,
-	185,
-	196,
-	197,
-	198,
-	199,
-	200,
-	201,
-	202,
-	203,
-	204,
-	205,
-	206,
-	207,
-	208,
-	209,
-	214,
-	215,
-	220,
-	221
-] : [
-	6,
-	2,
-	3,
-	4,
-	5,
-	1
-];
-const inspectOpts = Object.keys(env).filter((key) => /^debug_/i.test(key)).reduce((obj, key) => {
-	const prop = key.slice(6).toLowerCase().replace(/_([a-z])/g, (_, k) => k.toUpperCase());
-	let value = env[key];
-	const lowerCase = typeof value === "string" && value.toLowerCase();
-	if (value === "null") value = null;
-	else if (lowerCase === "yes" || lowerCase === "on" || lowerCase === "true" || lowerCase === "enabled") value = true;
-	else if (lowerCase === "no" || lowerCase === "off" || lowerCase === "false" || lowerCase === "disabled") value = false;
-	else value = Number(value);
-	obj[prop] = value;
-	return obj;
-}, Object.create(null));
-/**
-* Is stdout a TTY? Colored output is enabled when `true`.
-*/
-function useColors() {
-	return "colors" in inspectOpts ? Boolean(inspectOpts.colors) : isatty(process.stderr.fd);
-}
-function getDate() {
-	if (inspectOpts.hideDate) return "";
-	return `${(/* @__PURE__ */ new Date()).toISOString()} `;
-}
-/**
-* Adds ANSI color escape codes if enabled.
-*/
-function formatArgs(diff, args) {
-	const { namespace: name, useColors } = this;
-	if (useColors) {
-		const c = this.color;
-		const colorCode = `\u001B[3${c < 8 ? c : `8;5;${c}`}`;
-		const prefix = `  ${colorCode};1m${name} \u001B[0m`;
-		args[0] = prefix + args[0].split("\n").join(`\n${prefix}`);
-		args.push(`${colorCode}m+${this.humanize(diff)}\u001B[0m`);
-	} else args[0] = `${getDate()}${name} ${args[0]}`;
-}
-function log(...args) {
-	process.stderr.write(`${formatWithOptions(this.inspectOpts, ...args)}\n`);
-}
-const defaultOptions = {
-	useColors: useColors(),
-	formatArgs,
-	formatters: {
-		/**
-		* Map %o to `util.inspect()`, all on a single line.
-		*/
-		o(v) {
-			this.inspectOpts.colors = this.useColors;
-			return inspect(v, this.inspectOpts).split("\n").map((str) => str.trim()).join(" ");
-		},
-		/**
-		* Map %O to `util.inspect()`, allowing multiple lines if needed.
-		*/
-		O(v) {
-			this.inspectOpts.colors = this.useColors;
-			return inspect(v, this.inspectOpts);
-		}
-	},
-	inspectOpts,
-	log,
-	humanize
-};
-function createDebug(namespace, options) {
-	var _ref;
-	const color = (_ref = options && options.color) !== null && _ref !== void 0 ? _ref : selectColor(colors, namespace);
-	return createDebug$1(namespace, Object.assign(defaultOptions, { color }, options));
-}
-enable(env.DEBUG || "");
-//#endregion
 //#region src/node/rpc-shared-state.ts
 const debug$1 = createDebug("devframe:rpc:state:changed");
 const debugSubscribe = createDebug("devframe:rpc:state:subscribe");
@@ -431,6 +140,15 @@ function createRpcSharedStateServerHost(rpc) {
 	return host;
 }
 //#endregion
+//#region src/utils/nanoid.ts
+const urlAlphabet = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";
+function nanoid(size = 21) {
+	let id = "";
+	let i = size;
+	while (i--) id += urlAlphabet[Math.random() * 64 | 0];
+	return id;
+}
+//#endregion
 //#region src/utils/streaming-channel.ts
 const DEFAULT_HIGH_WATER_MARK = 256;
 var StreamClosedError = class extends Error {
@@ -1093,13 +811,14 @@ var DevframeViewHost = class {
 	constructor(context) {
 		this.context = context;
 	}
-	hostStatic(baseUrl, distDir) {
-		if (!existsSync(distDir)) throw diagnostics$1.DF0008({ distDir });
+	hostStatic(baseUrl, source) {
+		const resolved = resolveStaticAssetsSource(source, this.context.host.getStorageDir("project"));
+		if (typeof resolved === "string" && !existsSync(resolved)) throw diagnostics$1.DF0008({ distDir: resolved });
 		this.buildStaticDirs.push({
 			baseUrl,
-			distDir
+			source
 		});
-		this.context.host.mountStatic(baseUrl, distDir);
+		this.context.host.mountStatic(baseUrl, resolved);
 	}
 };
 //#endregion
@@ -1131,8 +850,6 @@ const agentListResources = defineRpcFunction({
 * Built-in agent introspection RPC functions. Registered automatically
 * by `createHostContext`. Not themselves agent-exposed (no `agent`
 * field) — they power the MCP adapter and any future agent CLI.
-*
-* @experimental
 */
 const BUILTIN_AGENT_RPC = [
 	defineRpcFunction({
@@ -1297,6 +1014,7 @@ async function createHostContext(options) {
 		diagnostics: void 0,
 		agent: void 0,
 		services: void 0,
+		staticConfig: {},
 		scope: void 0
 	};
 	const rpcHost = new RpcFunctionsHostImpl(context);

package/dist/{context-C33rR7n0.mjs → context-xdynGSLP.mjs}

@@ -1,5 +1,5 @@
 import { n as randomToken } from "./crypto-token-XCqTSMg9.mjs";
-import { t as createStorage } from "./storage-BcmVEJRc.mjs";
+import { t as createStorage } from "./storage-CYye7P7L.mjs";
 import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "./revoke-DZbJ7Cl0.mjs";
 import { join } from "pathe";
 //#region src/node/hub-internals/context.ts
@@ -11,6 +11,7 @@ function getInternalContext(context) {
 			initialValue: { trusted: {} }
 		});
 		const remoteTokens = /* @__PURE__ */ new Map();
+		const wsEndpointListeners = /* @__PURE__ */ new Set();
 		function revokeRemoteToken(token) {
 			if (!remoteTokens.delete(token)) return;
 			revokeActiveConnectionsForToken(context, token);
@@ -18,6 +19,14 @@ function getInternalContext(context) {
 		const internalContext = {
 			storage: { auth: storage },
 			revokeAuthToken: (token) => revokeAuthToken(context, storage, token),
+			setWsEndpoint(endpoint) {
+				internalContext.wsEndpoint = endpoint;
+				for (const listener of wsEndpointListeners) listener();
+			},
+			onWsEndpointChange(cb) {
+				wsEndpointListeners.add(cb);
+				return () => wsEndpointListeners.delete(cb);
+			},
 			remoteTokens,
 			allocateRemoteToken(dockId, origin, originLock) {
 				const token = randomToken();

package/dist/{dev-BEveeA5H.mjs → dev--rAPzbvO.mjs}

@@ -1,10 +1,11 @@
 import { DEVFRAME_CONNECTION_META_FILENAME } from "./constants.mjs";
-import { t as diagnostics } from "./diagnostics-DLYH5oD3.mjs";
-import { t as createHostContext } from "./context-Du11TLcO.mjs";
-import { i as resolveMcpConnectionMeta, n as resolveBasePath, r as resolveDevServerPort, t as normalizeBasePath } from "./_shared-CttmCMBi.mjs";
-import { t as createH3DevframeHost } from "./host-h3-CzCZwtuV.mjs";
-import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-KRdee1QF.mjs";
-import { t as open } from "./open-Dz4V4irZ.mjs";
+import { t as diagnostics } from "./diagnostics-DOQPnQmX.mjs";
+import { t as createHostContext } from "./context-CEe4PBz1.mjs";
+import { t as resolveStaticAssetsSource } from "./remote-assets-nTTxY2MU.mjs";
+import { i as resolveMcpConnectionMeta, n as resolveBasePath, r as resolveDevServerPort, t as normalizeBasePath } from "./_shared-CbZ_yhbz.mjs";
+import { t as createH3DevframeHost } from "./host-h3-Crkzm42q.mjs";
+import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-CMFyszWJ.mjs";
+import { open } from "./utils/open.mjs";
 import { mountStaticHandler } from "./utils/serve-static.mjs";
 import { createServer } from "node:http";
 import { resolve } from "pathe";
@@ -86,7 +87,7 @@ function initDevframe(def, options) {
 				const mcpPath = joinURL(base, mcpMeta.path);
 				let mountMcpHttp;
 				try {
-					({mountMcpHttp} = await import("./http-DLr_cJZ7.mjs").then((n) => n.t));
+					({mountMcpHttp} = await import("./http-DYpK0cUi.mjs").then((n) => n.t));
 				} catch (error) {
 					const reason = error instanceof Error ? error.message : String(error);
 					throw diagnostics.DF0017({
@@ -108,9 +109,12 @@ function initDevframe(def, options) {
 				...mcpDispose ? { dispose: mcpDispose } : {}
 			};
 		},
-		mount(_context, meta) {
+		mount(context, meta) {
 			app.use(joinURL(base, DEVFRAME_CONNECTION_META_FILENAME), () => meta);
-			if (distDir) mountStaticHandler(app, base, resolve(distDir));
+			if (distDir) {
+				const source = resolveStaticAssetsSource(distDir, context.host.getStorageDir("project"));
+				mountStaticHandler(app, base, typeof source === "string" ? resolve(source) : source);
+			}
 		}
 	});
 	const instance = {
@@ -138,7 +142,7 @@ function initDevframe(def, options) {
 * server runs in **bridge mode**: only `__connection.json` and the WS
 * endpoint are mounted, with no SPA mount. The SPA is expected to be
 * hosted elsewhere (e.g. by a parent Vite/Nuxt dev server) — see
-* `viteDevBridge({ devMiddleware })`.
+* `devframeViteBridge` from `@devframes/vite`.
 *
 * Returns the underlying {@link StartedServer} handle so callers can
 * close it gracefully (SIGINT, hot-reload, test teardown).
@@ -148,6 +152,7 @@ function initDevframe(def, options) {
 * `dev` / `build` / `mcp` shell, reach for {@link createCac} instead.
 */
 async function createDevServer(def, options = {}) {
+	if (def.capabilities?.dev === false && !options.force) throw diagnostics.DF0058({ id: def.id });
 	const host = options.host ?? def.cli?.host ?? "localhost";
 	const requestedPort = options.port ?? await resolveDevServerPort(def, { host });
 	const flags = options.flags ?? {};
@@ -182,6 +187,7 @@ async function createDevServer(def, options = {}) {
 		host,
 		origin,
 		ws: options.ws,
+		allowedOrigins: options.allowedOrigins,
 		sse: options.sse,
 		auth: flags.auth === false ? false : options.auth,
 		mcp: options.mcp,