devframe 0.9.7 → 0.9.9

package/dist/{instance-shell-CpVW4zG0.mjs → instance-shell-cdVETpfz.mjs}

@@ -1,7 +1,8 @@
 import "./constants.mjs";
-import { t as diagnostics } from "./diagnostics-BXWW3VK-.mjs";
-import { r as importServicePackage } from "./services-install-CqqQVls5.mjs";
-import { t as getInternalContext } from "./context-KUqAfawQ.mjs";
+import { r as validateOriginCandidate } from "./origin-DZit9g29.mjs";
+import { t as diagnostics } from "./diagnostics-BMfN8mb1.mjs";
+import { r as importServicePackage } from "./services-install-P_DV7VYL.mjs";
+import { t as getInternalContext } from "./context-DIUvJW4D.mjs";
 import { createInteractiveAuth } from "./recipes/interactive-auth.mjs";
 import { createServer } from "node:http";
 import process from "node:process";
@@ -20,6 +21,21 @@ async function importRuntimeModule(specifier) {
 	return await importServicePackage(specifier, [import.meta.url]);
 }
 //#endregion
+//#region src/node/runtime.ts
+/**
+* Detect the current server runtime from its runtime-specific global. The
+* WebSocket binding branches on this: Bun and Deno expose their sockets as
+* `fetch` upgrades through `Bun.serve` / `Deno.serve` (crossws's Bun/Deno
+* adapters), while the `node:http` upgrade event (and crossws's Node adapter,
+* which refuses to run anywhere else) is Node-only.
+*/
+function detectServerRuntime() {
+	const g = globalThis;
+	if (typeof g.Deno !== "undefined") return "deno";
+	if (typeof g.Bun !== "undefined") return "bun";
+	return "node";
+}
+//#endregion
 //#region src/node/utils.ts
 const NON_DIALABLE_HOSTS = /* @__PURE__ */ new Set([
 	"0.0.0.0",
@@ -42,8 +58,17 @@ function normalizeHttpServerUrl(host, port) {
 }
 //#endregion
 //#region src/node/instance-shell.ts
+function websocketConnectionMeta(rpcHost, path) {
+	const jsonSerializableMethods = [];
+	for (const def of rpcHost.definitions.values()) if (def.jsonSerializable === true) jsonSerializableMethods.push(def.name);
+	return {
+		backend: "websocket",
+		websocket: { path },
+		jsonSerializableMethods
+	};
+}
 /**
-* Compose an h3 + WebSocket RPC server for a devframe context — the low-level
+* Compose an h3 + WebSocket RPC server for a devframe context: the low-level
 * "listen on a port (or share one) + attach the WS transport" binding the
 * side-car and shared-server tiers below are built on. Owns and listens on a
 * fresh `node:http` server unless `server` is supplied, in which case it only
@@ -97,22 +122,13 @@ async function bindHttpAndWs(options) {
 	const internal = getInternalContext(context);
 	const wsUrl = `ws://${formatHostForUrl(bindHost)}:${resolvedPort}${options.path ?? ""}`;
 	if (websocket) internal.setWsEndpoint({ url: wsUrl });
-	function connectionMeta() {
-		const jsonSerializableMethods = [];
-		for (const def of rpcHost.definitions.values()) if (def.jsonSerializable === true) jsonSerializableMethods.push(def.name);
-		return {
-			backend: "websocket",
-			websocket: { path: options.path },
-			jsonSerializableMethods
-		};
-	}
 	return {
 		origin,
 		port: resolvedPort,
 		app,
 		ws,
 		rpcGroup: core.rpcGroup,
-		connectionMeta,
+		connectionMeta: () => websocketConnectionMeta(rpcHost, options.path),
 		async close() {
 			await closeWs();
 			if (ownsHttpServer) await new Promise((r) => httpServer.close(() => r()));
@@ -121,6 +137,105 @@ async function bindHttpAndWs(options) {
 	};
 }
 /**
+* Whether a request is a WebSocket upgrade aimed at `path`: the `fetch`-side
+* equivalent of the Node transport's `upgrade`-event path filter, used by the
+* native ({@link bindNativeHttpAndWs}) tiers to route only the RPC route to
+* the socket and leave every other request to the h3 app.
+*/
+function isWsUpgradeRequest(request, path) {
+	if ((request.headers.get("upgrade") ?? "").toLowerCase() !== "websocket") return false;
+	if (!path) return true;
+	try {
+		return samePath(new URL(request.url).pathname, path);
+	} catch {
+		return false;
+	}
+}
+/**
+* The Bun/Deno counterpart to {@link bindHttpAndWs}: own and listen on a
+* native `fetch`-upgrade server (`Bun.serve` / `Deno.serve`) with crossws's
+* Bun/Deno adapter driving the RPC socket, since crossws's Node adapter (and
+* the `node:http` `upgrade` event it needs) refuses to run off Node. Only the
+* owns-a-server tiers reach here; a shared foreign `node:http` server can't be
+* re-hosted on a native runtime, so that path falls back to SSE instead.
+*/
+async function bindNativeHttpAndWs(runtime, options) {
+	const { context, port, core } = options;
+	const bindHost = options.host;
+	const app = new H3();
+	const rpcHost = context.rpc;
+	const wsPath = options.path;
+	const fail = async (closeWs, error) => {
+		await closeWs().catch(() => {});
+		throw diagnostics.DF0052({
+			host: bindHost,
+			port,
+			reason: error instanceof Error ? error.message : String(error),
+			cause: error
+		});
+	};
+	let resolvedPort;
+	let closeWs;
+	let closeServer;
+	if (runtime === "bun") {
+		const { attachBunWsTransport } = await import("./rpc/transports/ws-bun.mjs");
+		const tier = await attachBunWsTransport(core, { allowedOrigins: options.allowedOrigins });
+		closeWs = tier.close;
+		const Bun = globalThis.Bun;
+		let server;
+		try {
+			server = Bun.serve({
+				port,
+				hostname: bindHost,
+				fetch: async (request, srv) => isWsUpgradeRequest(request, wsPath) ? await tier.handleUpgrade(request, srv) : await app.fetch(request),
+				websocket: tier.websocket
+			});
+		} catch (error) {
+			return await fail(closeWs, error);
+		}
+		resolvedPort = server.port;
+		closeServer = async () => {
+			await server.stop(true);
+		};
+	} else {
+		const { attachDenoWsTransport } = await import("./rpc/transports/ws-deno.mjs");
+		const tier = await attachDenoWsTransport(core, { allowedOrigins: options.allowedOrigins });
+		closeWs = tier.close;
+		const Deno = globalThis.Deno;
+		let server;
+		try {
+			server = Deno.serve({
+				port,
+				hostname: bindHost,
+				onListen: () => {}
+			}, async (request, info) => isWsUpgradeRequest(request, wsPath) ? await tier.handleUpgrade(request, info) : await app.fetch(request));
+		} catch (error) {
+			return await fail(closeWs, error);
+		}
+		resolvedPort = server.addr.port;
+		closeServer = async () => {
+			await server.shutdown();
+		};
+	}
+	const origin = normalizeHttpServerUrl(bindHost, resolvedPort);
+	const internal = getInternalContext(context);
+	const wsUrl = `ws://${formatHostForUrl(bindHost)}:${resolvedPort}${options.path ?? ""}`;
+	internal.setWsEndpoint({ url: wsUrl });
+	return {
+		origin,
+		port: resolvedPort,
+		app,
+		ws: void 0,
+		rpcGroup: core.rpcGroup,
+		connectionMeta: () => websocketConnectionMeta(rpcHost, options.path),
+		async close() {
+			await closeServer();
+			await closeWs();
+			if (getInternalContext(context).wsEndpoint?.url === wsUrl) getInternalContext(context).setWsEndpoint(void 0);
+		}
+	};
+}
+/**
 * Translate the public `register?: boolean | Partial<DevframeInstanceRecord>`
 * option into a shell {@link InstanceRegisterConfig}, or `undefined` when
 * registration is opted out. The object form supplies record overrides on top
@@ -141,8 +256,8 @@ function samePath(a, b) {
 }
 /**
 * Copy a web `Response` from a fetch-style transport handler onto the h3
-* event's response and return its body — mirroring the MCP route's bridge.
-* Returning the body (a `ReadableStream`, or `''` for an empty one — h3
+* event's response and return its body, mirroring the MCP route's bridge.
+* Returning the body (a `ReadableStream`, or `''` for an empty one, since h3
 * middleware only falls through on `undefined`) terminates the chain with
 * the status/headers set here instead of continuing to the SPA catch-all.
 */
@@ -158,8 +273,8 @@ function respondWith(event, response) {
 * The shared machinery behind `initDevframe` and `initHub`: one mount base,
 * one h3 app, one lazily-derived public origin (and the auth banner that waits
 * for it), one WebSocket binding, and the fetch / connect-middleware pair that
-* serves them. Each factory supplies only what makes it itself — its context,
-* its routes, its diagnostics — through `init` / `mount`.
+* serves them. Each factory supplies only what makes it itself (its context,
+* its routes, its diagnostics) through `init` / `mount`.
 *
 * Nothing here listens on a port unless a side-car was explicitly requested:
 * the default tier leaves the socket `unbound`, so a host chains it onto its
@@ -172,6 +287,8 @@ function createInstanceShell(options) {
 	const base = options.base;
 	const baseNoSlash = withoutTrailingSlash(base);
 	const app = options.app ?? new H3();
+	const runtime = detectServerRuntime();
+	const nativeRuntime = runtime !== "node";
 	const wsDisabled = options.ws === false;
 	const ws = options.ws === false ? {} : options.ws ?? {};
 	const route = withoutLeadingSlash(ws.route ?? "__ws");
@@ -186,8 +303,11 @@ function createInstanceShell(options) {
 	const sseRoutePath = joinURL(base, sseRoute);
 	const advertisedSsePath = options.absoluteWsPath ? sseRoutePath : sseRoute;
 	let derivedOrigin;
+	function explicitOrigin() {
+		return typeof options.origin === "function" ? options.origin() : options.origin;
+	}
 	function currentOrigin() {
-		return (typeof options.origin === "function" ? options.origin() : options.origin) || derivedOrigin;
+		return explicitOrigin() || derivedOrigin;
 	}
 	let authHandler;
 	let bannerPrinted = false;
@@ -201,7 +321,7 @@ function createInstanceShell(options) {
 	let registerPromise;
 	/**
 	* Publish the instance in the global registry the moment both its origin
-	* and connection meta are known — at init end for a pinned origin, or on
+	* and connection meta are known: at init end for a pinned origin, or on
 	* the first request for a derived one. Registration never throws (the
 	* registry writer degrades to a coded warning), so failures never surface.
 	*/
@@ -210,7 +330,7 @@ function createInstanceShell(options) {
 		const origin = currentOrigin();
 		if (!cfg || registerPromise || !origin || !meta) return;
 		const resolvedMeta = meta;
-		registerPromise = import("./instance-registry-BjlMQbFB.mjs").then((n) => n.t).then(({ registerDevframeInstance }) => {
+		registerPromise = import("./instance-registry-C7-41RSp.mjs").then((n) => n.t).then(({ registerDevframeInstance }) => {
 			let port = 0;
 			try {
 				const url = new URL(origin);
@@ -230,8 +350,20 @@ function createInstanceShell(options) {
 			});
 		}).catch(() => {});
 	}
-	function noteOrigin(origin) {
-		derivedOrigin ??= origin;
+	/**
+	* Consider a request-derived origin candidate for the advertised public
+	* origin (which backs the OTP magic link). {@link validateOriginCandidate}
+	* adopts only a loopback host or an exact `allowedOrigins` match, so a raw
+	* inbound `Host`/URL authority never redirects the credential-bearing link.
+	* First-valid-origin wins: an invalid candidate leaves `derivedOrigin` unset
+	* (printing/registering nothing) so a later valid one can still be adopted.
+	*/
+	function noteOrigin(candidate) {
+		if (derivedOrigin === void 0 && !explicitOrigin()) {
+			const allowed = options.allowedOrigins;
+			const accepted = validateOriginCandidate(candidate, Array.isArray(allowed) ? allowed : void 0);
+			if (accepted !== void 0) derivedOrigin = accepted;
+		}
 		maybePrintBanner();
 		maybeRegister();
 	}
@@ -248,7 +380,7 @@ function createInstanceShell(options) {
 	/**
 	* Auth resolution: gate by default, `false` opts out, a handler object
 	* installs a custom scheme. The `external` tier has no local transport to
-	* gate — the server behind `ws.url` owns auth — so it resolves to nothing.
+	* gate (the server behind `ws.url` owns auth) so it resolves to nothing.
 	*/
 	function resolveAuth() {
 		if (options.auth === false) return false;
@@ -260,7 +392,7 @@ function createInstanceShell(options) {
 		return authHandler;
 	}
 	/**
-	* The context's RPC core (birpc group, session lifecycle, auth gate) —
+	* The context's RPC core (birpc group, session lifecycle, auth gate) is
 	* one per instance, shared by every transport binding (WS and SSE), so a
 	* WS peer and an SSE session live in the same session/broadcast space.
 	* Built lazily: an `unbound` host that never wires a transport pays
@@ -270,7 +402,7 @@ function createInstanceShell(options) {
 	let resolvedAuth = false;
 	let corePromise;
 	function ensureCore() {
-		corePromise ??= import("./rpc-core-DlHd276T.mjs").then((n) => n.n).then(({ createContextRpcServer }) => createContextRpcServer({
+		corePromise ??= import("./rpc-core-DVQ7xi89.mjs").then((n) => n.n).then(({ createContextRpcServer }) => createContextRpcServer({
 			context: ctx,
 			auth: resolvedAuth,
 			onPeerConnect: options.onPeerConnect,
@@ -302,14 +434,17 @@ function createInstanceShell(options) {
 	*/
 	async function startSidecar(core) {
 		const sidecarHost = options.host ?? "localhost";
-		const start = (port) => bindHttpAndWs({
-			context: ctx,
-			core,
-			host: sidecarHost,
-			port,
-			path: withLeadingSlash(route),
-			allowedOrigins: options.allowedOrigins
-		});
+		const start = (port) => {
+			const bindOptions = {
+				context: ctx,
+				core,
+				host: sidecarHost,
+				port,
+				path: withLeadingSlash(route),
+				allowedOrigins: options.allowedOrigins
+			};
+			return nativeRuntime ? bindNativeHttpAndWs(runtime, bindOptions) : bindHttpAndWs(bindOptions);
+		};
 		if (ws.port != null) return await start(ws.port);
 		const { getPort } = await import("./dist-CZXfGEkd.mjs").then((n) => n.t);
 		let lastError;
@@ -326,37 +461,70 @@ function createInstanceShell(options) {
 		}
 		throw lastError;
 	}
+	async function startServerTier() {
+		if (nativeRuntime && !ws.url) {
+			const core = await ensureCore();
+			started = {
+				origin: currentOrigin() ?? "",
+				port: 0,
+				app,
+				ws: void 0,
+				rpcGroup: core.rpcGroup,
+				connectionMeta: () => meta ?? options.onMetaUnavailable(),
+				close: async () => {}
+			};
+			return { wsAvailable: false };
+		}
+		started = await bindHttpAndWs({
+			context: ctx,
+			core: await ensureCore(),
+			host: options.host ?? "localhost",
+			port: 0,
+			server: options.server,
+			path: routePath,
+			allowedOrigins: options.allowedOrigins,
+			destroyUnmatched: options.destroyUnmatchedUpgrades
+		});
+		return {
+			websocketMeta: { path: advertisedPath },
+			wsAvailable: !wsDisabled
+		};
+	}
+	async function resolveWebsocketBinding() {
+		if (tier === "sidecar") {
+			started = await startSidecar(await ensureCore());
+			return {
+				websocketMeta: {
+					port: started.port,
+					path: route
+				},
+				wsAvailable: !wsDisabled
+			};
+		}
+		if (tier === "server") return startServerTier();
+		if (tier === "external") return {
+			websocketMeta: ws.url,
+			wsAvailable: !wsDisabled
+		};
+		return {
+			websocketMeta: { path: advertisedPath },
+			wsAvailable: !wsDisabled
+		};
+	}
 	async function init() {
 		const result = await options.init(api);
 		ctx = result.context;
 		dispose = result.dispose;
 		resolvedAuth = tier === "external" ? false : resolveAuth();
-		let websocketMeta;
-		if (tier === "sidecar") {
-			started = await startSidecar(await ensureCore());
-			websocketMeta = {
-				port: started.port,
-				path: route
-			};
-		} else if (tier === "server") {
-			started = await bindHttpAndWs({
-				context: ctx,
-				core: await ensureCore(),
-				host: options.host ?? "localhost",
-				port: 0,
-				server: options.server,
-				path: routePath,
-				allowedOrigins: options.allowedOrigins,
-				destroyUnmatched: options.destroyUnmatchedUpgrades
-			});
-			websocketMeta = { path: advertisedPath };
-		} else if (tier === "external") websocketMeta = ws.url;
-		else if (tier === "unbound") websocketMeta = { path: advertisedPath };
+		const binding = await resolveWebsocketBinding();
+		const wsAvailable = binding.wsAvailable;
+		let websocketMeta = binding.websocketMeta;
 		if (!wsDisabled && ws.url) websocketMeta = ws.url;
 		if (sseEnabled) app.use(sseRoutePath, defineHandler(async (event) => respondWith(event, await (await ensureSse()).handler(event.req))));
+		if (!wsDisabled && !wsAvailable && !sseEnabled) diagnostics.DF0075({ runtime }, { method: "warn" });
 		meta = {
-			backend: wsDisabled ? sseEnabled ? "sse" : "none" : "websocket",
-			...websocketMeta !== void 0 ? { websocket: websocketMeta } : {},
+			backend: !wsDisabled && wsAvailable ? "websocket" : sseEnabled ? "sse" : "none",
+			...wsAvailable && websocketMeta !== void 0 ? { websocket: websocketMeta } : {},
 			...sseEnabled ? { sse: { path: advertisedSsePath } } : {},
 			...result.mcp ? { mcp: result.mcp } : {}
 		};
@@ -371,7 +539,7 @@ function createInstanceShell(options) {
 	contextPromise.catch(() => {});
 	/**
 	* The `unbound` tier: the RPC core and its crossws adapter, bound to
-	* nothing. Built on the first `attach` / `handleUpgrade` — a host that
+	* nothing. Built on the first `attach` / `handleUpgrade`; a host that
 	* never wires the socket (or whose runtime brings its own WS transport)
 	* pays nothing for it, not even the adapter's imports.
 	*/
@@ -437,6 +605,7 @@ function createInstanceShell(options) {
 		if (tier === "disabled") throw diagnostics.DF0057();
 		if (tier === "external") throw diagnostics.DF0056({ url: ws.url });
 		if (tier !== "unbound") throw diagnostics.DF0055({ tier });
+		if (nativeRuntime) throw diagnostics.DF0076({ runtime });
 	}
 	/**
 	* Publish the socket's absolute URL on the context, so surfaces that hand

package/dist/internal/index.d.mts

@@ -1,17 +1,30 @@
-import { v as RpcFunctionDefinitionAny } from "../types-CMdPYhOx.mjs";
-import { At as AgentResource, Ft as AgentToolProvider, It as AgentToolProviderHandle, Lt as DevframeAgentHost$1, Mt as AgentResourceInput, Nt as AgentTool, Ot as AgentHandle, Pt as AgentToolInput, Rt as DevframeAgentHostEvents, jt as AgentResourceContent, kt as AgentManifest, o as DevframeNodeContext, yt as DevframeHost, zt as EventEmitter } from "../context-BhBzOXVa.mjs";
-import { a as RemoteAssetsStore } from "../remote-assets-B13_vRkJ.mjs";
-import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, h as registerDevframeInstance, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-Bh4l9Vz_.mjs";
-import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-BJ6AmwTu.mjs";
-import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-BHUsDl7s.mjs";
+import { v as RpcFunctionDefinitionAny } from "../types-Dq4i156u.mjs";
+import { At as AgentManifest, Bt as EventEmitter, F as DevframeDefinition, Ft as AgentToolInput, It as AgentToolProvider, Lt as AgentToolProviderHandle, Mt as AgentResourceContent, Nt as AgentResourceInput, Pt as AgentTool, Rt as DevframeAgentHost$1, bt as DevframeHost, jt as AgentResource, kt as AgentHandle, o as DevframeNodeContext, zt as DevframeAgentHostEvents } from "../context-4AIVRLYF.mjs";
+import { a as RemoteAssetsStore, o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
+import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, h as registerDevframeInstance, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-7Z52PE4_.mjs";
+import { i as resolveBasePath, n as ResolvedMcpConfig, o as resolveMcpConfig, r as normalizeBasePath } from "../_shared-CK3czkH4.mjs";
+import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-Ceu6AUz8.mjs";
+//#region src/client-assets.d.ts
+/**
+ * Resolve a definition's client assets source: the built SPA served as its
+ * UI. Prefers the top-level {@link DevframeDefinition.clientAssets} and falls
+ * back to the deprecated `cli.distDir`, so both the new and legacy shapes
+ * resolve. Returns `undefined` when neither is set (bridge mode, where the SPA is
+ * hosted elsewhere).
+ *
+ * Internal: exposed to first-party integrations via `devframe/internal`, not
+ * part of the stable public API.
+ */
+declare function resolveClientAssets(d: DevframeDefinition): StaticAssetsSource | undefined;
+//#endregion
 //#region src/node/agent-args.d.ts
 /**
  * How {@link coerceAgentPositionalArgs} treats an args object that carries
  * neither declared schemas nor `arg0`/`arg1`/… keys:
  *
- * - `'wrap'` — pass the object itself as the single positional argument.
+ * - `'wrap'`: pass the object itself as the single positional argument.
  *   RPC-backed tools use this: an untyped RPC may take one raw object.
- * - `'drop'` — call with zero arguments. Command-backed tools use this:
+ * - `'drop'`: call with zero arguments. Command-backed tools use this:
  *   a handler's positional parameters come solely from its declared
  *   `agent.args` schemas, so undeclared payload is ignored.
  */
@@ -33,6 +46,11 @@ type AgentArgsFallback = 'wrap' | 'drop';
 declare function coerceAgentPositionalArgs(args: unknown, schemas: readonly unknown[] | undefined, fallback?: AgentArgsFallback): unknown[];
 //#endregion
 //#region src/node/diagnostics.d.ts
+/**
+ * DF00xx codes are allocated across packages (e.g. @devframes/json-render
+ * owns DF0037–DF0041), so this file alone doesn't show the next free
+ * number; check `docs/content/6.errors/` for the full allocation before adding one.
+ */
 declare const diagnostics: import("nostics").Diagnostics<{
   readonly DF0006: {
     readonly why: (p: {
@@ -100,7 +118,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
       channel: string;
       id: string;
     }) => string;
-    readonly fix: "Track the producer lifecycle — guard writes with the `stream.signal.aborted` flag.";
+    readonly fix: "Track the producer lifecycle by guarding writes with the `stream.signal.aborted` flag.";
   };
   readonly DF0032: {
     readonly why: (p: {
@@ -132,7 +150,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
     readonly why: (p: {
       name: string;
     }) => string;
-    readonly fix: "Complete the auth handshake (or connect with a static/pre-shared token) before calling a trusted method. Untrusted callers may only call `anonymous:`-prefixed methods — see `isAnonymousRpcMethod`.";
+    readonly fix: "Complete the auth handshake (or connect with a static/pre-shared token) before calling a trusted method. Untrusted callers may only call `anonymous:`-prefixed methods; see `isAnonymousRpcMethod`.";
   };
   readonly DF0037: {
     readonly why: (p: {
@@ -181,7 +199,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
     readonly why: (p: {
       port: number;
     }) => string;
-    readonly fix: "Call devframe_connect_list-instances for the current instance list — the instance may have stopped or changed port.";
+    readonly fix: "Call devframe_connect_list-instances for the current instance list; the instance may have stopped or changed port.";
   };
   readonly DF0051: {
     readonly why: (p: {
@@ -201,7 +219,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
     readonly why: (p: {
       id: string;
     }) => string;
-    readonly fix: "Await `instance.ready` (or any request through `instance.handler`) before reading `connectionMeta()` — the WebSocket binding it describes is only known once initialization completes.";
+    readonly fix: "Await `instance.ready` (or any request through `instance.handler`) before reading `connectionMeta()`; the WebSocket binding it describes is only known once initialization completes.";
   };
   readonly DF0055: {
     readonly why: (p: {
@@ -217,7 +235,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
   };
   readonly DF0057: {
     readonly why: () => string;
-    readonly fix: "Clients connect over the SSE endpoint instead — no upgrade wiring is needed. Remove `ws: false` if the instance should serve a WebSocket after all.";
+    readonly fix: "Clients connect over the SSE endpoint instead, so no upgrade wiring is needed. Remove `ws: false` if the instance should serve a WebSocket after all.";
   };
   readonly DF0058: {
     readonly why: (p: {
@@ -248,7 +266,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
       required: string;
       installed: string;
     }) => string;
-    readonly fix: "Align the installed assets package with the version its node package declares — they are published in lockstep.";
+    readonly fix: "Align the installed assets package with the version its node package declares; they are published in lockstep.";
   };
   readonly DF0062: {
     readonly why: (p: {
@@ -278,7 +296,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
       field: "package" | "version";
       value: string;
     }) => string;
-    readonly fix: "A remote-assets `package` must be a valid npm package name and `version` an exact semver version (e.g. `1.2.3`) — they are interpolated into CDN URLs and the cache path.";
+    readonly fix: "A remote-assets `package` must be a valid npm package name and `version` an exact semver version (e.g. `1.2.3`); they are interpolated into CDN URLs and the cache path.";
   };
   readonly DF0066: {
     readonly why: (p: {
@@ -314,7 +332,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
       package: string;
       reason: string;
     }) => string;
-    readonly fix: "A service package's default export must be a factory returning a `DevframeServiceDefinition` — an object with `package`, `version`, `scope`, and a `setup` function.";
+    readonly fix: "A service package's default export must be a factory returning a `DevframeServiceDefinition`, an object with `package`, `version`, `scope`, and a `setup` function.";
   };
   readonly DF0072: {
     readonly why: (p: {
@@ -322,6 +340,18 @@ declare const diagnostics: import("nostics").Diagnostics<{
     }) => string;
     readonly fix: "Check the method id, and ensure the service/plugin that registers it is installed (e.g. declared in `services`) before the build collects the dump.";
   };
+  readonly DF0075: {
+    readonly why: (p: {
+      runtime: string;
+    }) => string;
+    readonly fix: "Keep the SSE endpoint enabled (drop `sse: false`) so clients connect over it on Bun/Deno, or move the socket to a side-car (`ws: { sidecar: true }`) which binds the native WebSocket adapter on its own port.";
+  };
+  readonly DF0076: {
+    readonly why: (p: {
+      runtime: string;
+    }) => string;
+    readonly fix: "On Bun/Deno, serve the advertised `__ws` route from `Bun.serve` / `Deno.serve` with `attachBunWsTransport` / `attachDenoWsTransport` (see the hub-deno-minimal example), or connect over the SSE endpoint instead.";
+  };
 }, readonly [(d: import("nostics").Diagnostic, { method }?: {
   method?: "log" | "warn" | "error";
 }) => void]>;
@@ -371,7 +401,7 @@ interface CreateH3DevframeHostOptions {
    */
   origin: string | (() => string);
   /**
-   * Register a static-file handler at `base` serving files from `source` —
+   * Register a static-file handler at `base` serving files from `source`:
    * a local directory or a resolved remote-assets back-proxy store (both
    * accepted by `devframe/utils/serve-static`). `mountStatic` forwards to
    * it; when omitted the host serves no SPA (bridge mode, where the SPA is
@@ -394,7 +424,7 @@ interface CreateH3DevframeHostOptions {
   workspaceRoot?: string;
 }
 /**
- * h3-backed {@link DevframeHost} — used by the standalone CLI adapter.
+ * h3-backed {@link DevframeHost}, used by the standalone CLI adapter.
  */
 declare function createH3DevframeHost(options: CreateH3DevframeHostOptions): DevframeHost;
 //#endregion
@@ -427,7 +457,7 @@ interface RpcWireCodec {
  * JSON (methods declared `jsonSerializable: true`) and `s:`-prefixed
  * structured-clone (everything else, including all error envelopes), with a
  * request-id → method map so a response independently picks the same
- * encoder as its request. One codec per connection — request-id spaces
+ * encoder as its request. One codec per connection; request-id spaces
  * don't collide across connections.
  *
  * @internal
@@ -435,7 +465,7 @@ interface RpcWireCodec {
 declare function createRpcWireCodec(definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>): RpcWireCodec;
 /**
  * Peek at a wire frame's birpc envelope without engaging a codec's
- * request-id bookkeeping — used by the SSE transport to route a frame
+ * request-id bookkeeping; used by the SSE transport to route a frame
  * (park a POST for its response / answer with a bare 202) before it is
  * handed to birpc proper.
  *
@@ -446,4 +476,4 @@ declare function peekRpcWireFrame(raw: string): {
   i?: string;
 };
 //#endregion
-export { type AgentArgsFallback, type ContextRpcServer, type CreateContextRpcServerOptions, CreateH3DevframeHostOptions, type CreateInstanceShellOptions, DevframeAgentHost, type DevframeInstanceRecord, type DevframeInstanceRegistration, type InstanceRegisterConfig, type InstanceShell, type InstanceShellApi, type InstanceShellInit, type InstanceShellInternals, type InstanceWsTier, type RpcWireCodec, type StartedServer, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveInstanceRegister, samePath };
+export { type AgentArgsFallback, type ContextRpcServer, type CreateContextRpcServerOptions, CreateH3DevframeHostOptions, type CreateInstanceShellOptions, DevframeAgentHost, type DevframeInstanceRecord, type DevframeInstanceRegistration, type InstanceRegisterConfig, type InstanceShell, type InstanceShellApi, type InstanceShellInit, type InstanceShellInternals, type InstanceWsTier, type ResolvedMcpConfig, type RpcWireCodec, type StartedServer, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveClientAssets, resolveInstanceRegister, resolveMcpConfig, samePath };

package/dist/internal/index.mjs

@@ -1,9 +1,10 @@
-import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../wire-codec-0K-o5MYW.mjs";
-import { t as diagnostics } from "../diagnostics-BXWW3VK-.mjs";
-import { a as DevframeAgentHost, o as coerceAgentPositionalArgs } from "../services-install-CqqQVls5.mjs";
-import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-BM3PdYli.mjs";
-import { t as createH3DevframeHost } from "../host-h3-fRbF9yor.mjs";
-import { a as importRuntimeModule, i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-CpVW4zG0.mjs";
-import { i as registerDevframeInstance, n as listLiveDevframeInstances } from "../instance-registry-BjlMQbFB.mjs";
-import { t as createContextRpcServer } from "../rpc-core-DlHd276T.mjs";
-export { DevframeAgentHost, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveInstanceRegister, samePath };
+import { t as resolveClientAssets } from "../client-assets-DNdhagGm.mjs";
+import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../wire-codec-dcCeXcSo.mjs";
+import { t as diagnostics } from "../diagnostics-BMfN8mb1.mjs";
+import { a as DevframeAgentHost, o as coerceAgentPositionalArgs } from "../services-install-P_DV7VYL.mjs";
+import { i as resolveMcpConfig, n as resolveBasePath, t as normalizeBasePath } from "../_shared-C08SdQRl.mjs";
+import { t as createH3DevframeHost } from "../host-h3-BJ4siyz7.mjs";
+import { a as importRuntimeModule, i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-cdVETpfz.mjs";
+import { i as registerDevframeInstance, n as listLiveDevframeInstances } from "../instance-registry-C7-41RSp.mjs";
+import { t as createContextRpcServer } from "../rpc-core-DVQ7xi89.mjs";
+export { DevframeAgentHost, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveClientAssets, resolveInstanceRegister, resolveMcpConfig, samePath };

package/dist/node/auth.d.mts

@@ -1,3 +1,3 @@
-import { Ct as DevframeAuthHandler } from "../context-BhBzOXVa.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-DcKxIMoI.mjs";
+import { wt as DevframeAuthHandler } from "../context-4AIVRLYF.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-pKl67H6w.mjs";
 export { DevframeAuthHandler, buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/auth.mjs

@@ -1,3 +1,3 @@
-import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-COLW0cOi.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-CK9LjrnT.mjs";
+import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-cqztiCX4.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-CeQQWzM-.mjs";
 export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,3 +1,3 @@
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-HOnG-WvG.mjs";
-import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-BJ6AmwTu.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-rgBSPFHS.mjs";
+import { i as resolveBasePath, r as normalizeBasePath } from "../_shared-CK3czkH4.mjs";
 export { type DevframeInternalContext, type InternalAnonymousAuthStorage, type RemoteTokenRecord, getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/hub-internals.mjs

@@ -1,3 +1,3 @@
-import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-BM3PdYli.mjs";
-import { n as internalContextMap, t as getInternalContext } from "../context-KUqAfawQ.mjs";
+import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-C08SdQRl.mjs";
+import { n as internalContextMap, t as getInternalContext } from "../context-DIUvJW4D.mjs";
 export { getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };