devframe 0.9.8 → 0.9.10

package/dist/{context-CLF4-8Pp.d.mts → context-CHW4BZOj.d.mts}

@@ -1,8 +1,8 @@
-import { d as RpcFunctionsCollectorBase } from "./index-BzyopqxV.mjs";
-import { _ as RpcFunctionDefinition, v as RpcFunctionDefinitionAny } from "./types-CMdPYhOx.mjs";
-import { d as DevframeRpcConnection, u as DevframeNodeRpcSessionMeta } from "./ws-server-VyHlanzy.mjs";
-import { a as RemoteAssetsStore, o as StaticAssetsSource } from "./remote-assets-B13_vRkJ.mjs";
-import { m as defineDiagnostics } from "./nostics-SPGDgHEP.mjs";
+import { d as RpcFunctionsCollectorBase } from "./index-pIVt92jP.mjs";
+import { _ as RpcFunctionDefinition, v as RpcFunctionDefinitionAny } from "./types-Dq4i156u.mjs";
+import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection } from "./ws-server-D2nv68Hg.mjs";
+import { a as RemoteAssetsStore, o as StaticAssetsSource } from "./remote-assets-eBvSKZMS.mjs";
+import { m as defineDiagnostics } from "./nostics-0sKe5HIj.mjs";
 import { BirpcReturn } from "birpc";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 import { CAC } from "cac";
@@ -91,15 +91,15 @@ interface AgentTool {
   title: string;
   /** Human-readable description shown to the agent. */
   description: string;
-  /** Safety classification — drives MCP hint annotations downstream. */
+  /** Safety classification; drives MCP hint annotations downstream. */
   safety: 'read' | 'action' | 'destructive';
   /** Free-form tags for grouping/filtering. */
   tags?: readonly string[];
-  /** Present for `kind === 'rpc'` — points to the RPC function name. */
+  /** Present for `kind === 'rpc'`; points to the RPC function name. */
   rpcName?: string;
   /**
    * Positional Standard Schemas describing a `kind: 'tool'` entry's
-   * arguments — carried on the tool itself (mirroring how `rpcName` defers
+   * arguments, carried on the tool itself (mirroring how `rpcName` defers
    * an RPC-backed tool's schemas to `ctx.rpc.definitions`) so consumers
    * (e.g. the MCP adapter) convert Standard Schema → JSON Schema on demand,
    * same as RPC `args`.
@@ -126,7 +126,7 @@ interface AgentToolInput {
   safety?: 'read' | 'action' | 'destructive';
   tags?: readonly string[];
   /**
-   * Positional Standard Schemas describing the tool's arguments — the same
+   * Positional Standard Schemas describing the tool's arguments, the same
    * shape RPC definitions carry (any [Standard Schema](https://standardschema.dev/)
    * validator: valibot, zod, arktype, devframe's built-in `s` builder, …).
    * Each is advertised under `arg0` / `arg1` / … on the tool's JSON-Schema
@@ -166,7 +166,7 @@ interface AgentResourceInput {
   name: string;
   description?: string;
   mimeType?: string;
-  /** Optional URI override — if omitted, a `devframe://resource/<id>` URI is generated. */
+  /** Optional URI override; if omitted, a `devframe://resource/<id>` URI is generated. */
   uri?: string;
   /** Snapshot reader. Called on each read. */
   read: () => Promise<AgentResourceContent> | AgentResourceContent;
@@ -195,7 +195,7 @@ interface AgentHandle {
 }
 /**
  * A lazy source of agent tools, queried at `list()` / `getTool()` /
- * `invoke()` time — the same on-demand projection the host applies to
+ * `invoke()` time, the same on-demand projection the host applies to
  * `agent`-flagged RPC definitions. Use a provider when tools *derive from*
  * other state (a command registry, a plugin catalog): the underlying state
  * stays the single source of truth and nothing needs to be kept in sync.
@@ -225,7 +225,7 @@ interface DevframeAgentHostEvents {
   'agent:resource:registered': (resource: AgentResource) => void;
   'agent:resource:unregistered': (id: string) => void;
   /**
-   * Fires when the unified manifest changes — including when a new
+   * Fires when the unified manifest changes, including when a new
    * RPC function with an `agent` field is registered on `ctx.rpc`.
    */
   'agent:manifest:changed': () => void;
@@ -247,7 +247,7 @@ interface DevframeAgentHost {
   /** Unregister a previously registered tool by id. */
   unregisterTool: (id: string) => boolean;
   /**
-   * Register a lazy tool source, queried on demand — see
+   * Register a lazy tool source, queried on demand; see
    * {@link AgentToolProvider}.
    */
   registerToolProvider: (provider: AgentToolProvider) => AgentToolProviderHandle;
@@ -261,6 +261,13 @@ interface DevframeAgentHost {
    * tools/resources registered on the host.
    */
   list: () => AgentManifest;
+  /**
+   * Whether the devframe exposes anything to agents: an `agent`-flagged RPC
+   * function, a registered tool or resource, or a provider currently
+   * yielding at least one tool. The `mcp: 'auto'` default consults this to
+   * decide whether a route is worth mounting.
+   */
+  hasSurface: () => boolean;
   /**
    * Invoke any tool by id. Routes to the underlying RPC handler for
    * `kind === 'rpc'`, or to the registered handler for `kind === 'tool'`.
@@ -276,7 +283,7 @@ interface DevframeAgentHost {
 //#endregion
 //#region src/adapters/flags.d.ts
 /**
- * Schema map for typed CLI flags. Keys are flag names in camelCase —
+ * Schema map for typed CLI flags. Keys are flag names in camelCase, so
  * this matches CAC's parsed-flag output ( `--no-open` → `noOpen` ). Each
  * value is any [Standard Schema](https://standardschema.dev/) validator
  * (valibot, zod, arktype, devframe's built-in `s`, …) used to both (a)
@@ -285,7 +292,7 @@ interface DevframeAgentHost {
  */
 type CliFlagsSchema = Record<string, StandardSchemaV1>;
 /**
- * Identity helper that preserves the literal schema-map type — use this
+ * Identity helper that preserves the literal schema-map type; use this
  * so `InferCliFlags<typeof myFlags>` resolves to the right object shape.
  *
  * ```ts
@@ -321,14 +328,14 @@ declare function parseCliFlags(schema: CliFlagsSchema, raw: Record<string, unkno
  * the handshake RPC functions, the resolver gate, the connect-time trust
  * hook, and the startup banner.
  *
- * `initDevframe` / `initHub` accept one of these directly via their `auth` option —
- * see {@link https://devfra.me | devframe}'s server docs — or a host can
+ * `initDevframe` / `initHub` accept one of these directly via their `auth` option
+ * (see {@link https://devfra.me | devframe}'s server docs), or a host can
  * wire the four pieces itself against a lower-level transport.
  */
 interface DevframeAuthHandler {
   /**
    * `anonymous:devframe:auth` + `anonymous:devframe:auth:exchange` (the
-   * handshake) and `devframe:auth:revoke` (self-revoke) — register these on
+   * handshake) and `devframe:auth:revoke` (self-revoke); register these on
    * the RPC host (e.g. `rpcHost.register(fn)` for each).
    */
   rpcFunctions: RpcFunctionDefinitionAny[];
@@ -343,18 +350,18 @@ interface DevframeAuthHandler {
    * Connect-time trust: reads a bearer token off the connection's initial
    * request (a static/pre-shared token from `clientAuthTokens`, or a token
    * minted by the code exchange) and, when valid, marks the session
-   * trusted immediately — before the client's own handshake call.
+   * trusted immediately, before the client's own handshake call.
    */
   onConnect: (connection: DevframeRpcConnection, session: DevframeNodeRpcSession) => void;
   /**
    * Print the current one-time code and its magic-link URL. Devframe stays
-   * headless — call this yourself once the server is listening. Safe to
+   * headless, so call this yourself once the server is listening. Safe to
    * call repeatedly; it only prints once per code.
    */
   printBanner: () => void;
   /**
    * Rewrite a URL the CLI is about to open in the browser (`--open`) so the
-   * tab lands already authenticated — e.g. appending the current OTP as a
+   * tab lands already authenticated, e.g. appending the current OTP as a
    * query param. Called with the fully-resolved target URL; return it
    * unchanged to opt out. Optional: a handler that doesn't need this (e.g.
    * one gated by a pre-shared bearer token instead of an interactive code)
@@ -373,7 +380,7 @@ interface DevframeAuthHandler {
  */
 type DevframeDiagnosticsLogger = Record<string, any>;
 /**
- * Host for structured diagnostics — a thin layer over `nostics` that lets
+ * Host for structured diagnostics: a thin layer over `nostics` that lets
  * integrations register their own coded errors/warnings into a shared
  * registry without taking a direct dependency on `nostics`.
  *
@@ -398,9 +405,9 @@ type DevframeDiagnosticsLogger = Record<string, any>;
 interface DevframeDiagnosticsHost {
   /**
    * Proxy-backed lookup of every registered diagnostic handle by code name.
-   * Resolves to a `nostics` `DiagnosticHandle` — a callable that builds a
+   * Resolves to a `nostics` `DiagnosticHandle`: a callable that builds a
    * diagnostic and routes it through registered reporters; prefix with
-   * `throw` to raise. Loosely typed — for autocompletion, keep a reference
+   * `throw` to raise. Loosely typed; for autocompletion, keep a reference
    * to the typed result of `defineDiagnostics()` instead.
    */
   readonly logger: DevframeDiagnosticsLogger;
@@ -408,7 +415,7 @@ interface DevframeDiagnosticsHost {
    * Register additional diagnostic definitions with this host. After
    * registration, codes from the new definition are reachable via
    * `host.logger.CODE`. Plugins that want shared output formatting should
-   * build their diagnostics via `host.defineDiagnostics()` first — that
+   * build their diagnostics via `host.defineDiagnostics()` first; that
    * factory pre-wires the host's ANSI console reporter.
    */
   register: (definitions: Record<string, unknown>) => void;
@@ -424,12 +431,12 @@ interface DevframeDiagnosticsHost {
 //#region src/types/host.d.ts
 interface DevframeHost {
   /**
-   * Serve static assets at the given URL base — a local directory, or a
+   * Serve static assets at the given URL base: a local directory, or a
    * resolved {@link RemoteAssetsStore} back-proxy. Called by
    * `DevframeViewHost.hostStatic` (which normalizes `RemoteAssets`
    * declarations into stores first). Implementations map this to whatever
    * the underlying runtime expects (Vite middleware, h3 handler, no-op
-   * for build snapshots) — the shared engine in
+   * for build snapshots); the shared engine in
    * `devframe/utils/serve-static` accepts either shape.
    */
   mountStatic: (base: string, source: string | RemoteAssetsStore) => void | Promise<void>;
@@ -440,7 +447,7 @@ interface DevframeHost {
    *
    * Called by `ctx.install` for each mounted devframe (alongside
    * `mountStatic`). Without it, an embedded SPA can only discover the
-   * endpoint by inheriting it from a same-origin parent window — which fails
+   * endpoint by inheriting it from a same-origin parent window, which fails
    * for cross-origin or sandboxed iframes. Implementations serve the same
    * meta they expose at the hub's own base.
    *
@@ -465,15 +472,15 @@ interface DevframeHost {
    * collide between, say, the Vite host (`.vite/devframe`) and a
    * standalone CLI host (`.<appName>/devframe`).
    *
-   *   - `workspace` — state shared with the whole team through version
+   *   - `workspace`: state shared with the whole team through version
    *     control (saved queries, shared presets). Conventionally
    *     `${workspaceRoot}/.devframe/`; hosts must place it somewhere
    *     committable.
-   *   - `project`   — per-checkout private state (caches, personal
+   *   - `project`:   per-checkout private state (caches, personal
    *     settings). Typically under
    *     `${cwd}/node_modules/.<appName>/devframe/`, which version
    *     control ignores.
-   *   - `global`    — per-user state (auth tokens, machine-wide
+   *   - `global`:    per-user state (auth tokens, machine-wide
    *     preferences). Typically under
    *     `${homedir()}/.<appName>/devframe/`.
    *
@@ -553,7 +560,7 @@ interface DevframeRpcServerFunctions {
    * an auto-trust noop when `auth: false`.
    *
    * Named with the `anonymous:` prefix (see `isAnonymousRpcMethod`) so it is
-   * reachable before the connection is trusted — this is the *only* rule the
+   * reachable before the connection is trusted; this is the *only* rule the
    * pre-trust gate applies, no per-method allowlist.
    *
    * @internal
@@ -665,7 +672,7 @@ interface DevframeRpcServerFunctions {
  */
 interface DevframeRpcSharedStates {
   /**
-   * Wire-service advertisements — package name → `{ package, version,
+   * Wire-service advertisements: package name → `{ package, version,
    * scope, meta }` for every installed {@link import('./services').DevframeServiceDefinition}.
    * Written by the node services host at the `ready()` barrier; clients read
    * it through `client.services` (or subscribe to it directly for
@@ -758,9 +765,9 @@ interface DevframeSettingsStore<T extends Record<string, any> = Record<string, a
 /**
  * The two settings scopes available on a scoped context.
  *
- *   - `project` — per-workspace state, persisted under the host's
+ *   - `project`: per-workspace state, persisted under the host's
  *     `workspace` storage dir. Project-local settings.
- *   - `global`  — per-user state, persisted under the host's `global`
+ *   - `global`:  per-user state, persisted under the host's `global`
  *     storage dir. Machine-wide preferences.
  */
 interface DevframeSettings<T extends Record<string, any> = Record<string, any>> {
@@ -914,7 +921,7 @@ interface DevframeServicesScopeRegistry {}
 /** Resolved RPC scope namespace for a service package name, or `string`. */
 type DevframeServiceScopeOf<PKG> = PKG extends keyof DevframeServicesScopeRegistry ? DevframeServicesScopeRegistry[PKG] & string : string;
 /**
- * A **wire service** — a shared server-side capability (e.g. open-in-editor,
+ * A **wire service**: a shared server-side capability (e.g. open-in-editor,
  * syntax highlighting) packaged so any devframe host can install it once and
  * every plugin/client can consume it without re-implementing or re-bundling
  * it. Contrast with plain {@link DevframeServicesHost.provide}, which shares
@@ -925,16 +932,16 @@ type DevframeServiceScopeOf<PKG> = PKG extends keyof DevframeServicesScopeRegist
  * feature-detect it (`ctx.services.has(pkg)`) and degrade gracefully.
  *
  * Ship one per npm package (`@devframes/service-<slug>` for first-party),
- * with the package's default export being the `create<X>Service` factory —
+ * with the package's default export being the `create<X>Service` factory,
  * never a pre-built instance.
  */
 interface DevframeServiceDefinition<API = unknown, Options = any> {
   /**
-   * The npm package name this service ships in — also its registry key
+   * The npm package name this service ships in, also its registry key
    * (`ctx.services.has('@devframes/service-x')` on both node and client).
    */
   package: string;
-  /** Semver of the service — advertised to clients, checked against descriptor ranges. */
+  /** Semver of the service, advertised to clients and checked against descriptor ranges. */
   version: string;
   /**
    * RPC namespace the service's functions register under, following the
@@ -944,7 +951,7 @@ interface DevframeServiceDefinition<API = unknown, Options = any> {
   scope: string;
   /**
    * Extra advertised metadata (feature flags, defaults, …). Must be
-   * JSON-serializable — it is mirrored to every client.
+   * JSON-serializable, since it is mirrored to every client.
    */
   meta?: Record<string, unknown>;
   /**
@@ -961,18 +968,18 @@ interface DevframeServiceDefinition<API = unknown, Options = any> {
   mergeOptions?: (sets: Options[]) => Options;
   /**
    * Construct the service: register its RPC functions on the pre-scoped
-   * context and return its **node API** — the in-process surface other
+   * context and return its **node API**: the in-process surface other
    * plugins get from `ctx.services.get(package)` (no RPC hop server-side).
    * `info.options` carries every installer's option sets merged at the
    * `ready()` barrier (via {@link mergeOptions} when present, otherwise a
-   * shallow merge in declaration order — later sets win).
+   * shallow merge in declaration order, later sets win).
    */
   setup: (ctx: DevframeScopedNodeContext, info: {
     options?: Options;
   }) => API | Promise<API>;
 }
 /**
- * Declarative reference to a service package — the form a
+ * Declarative reference to a service package: the form a
  * {@link DevframeServiceInput} takes when the installer doesn't hold the
  * factory itself (e.g. `DevframeDefinition.services`). The host imports the
  * package's default-export factory and installs the resulting definition at
@@ -983,13 +990,13 @@ interface DevframeServiceDescriptor<Options = any> {
   package: string;
   /**
    * Accepted semver range for the installed service. An unsatisfied range
-   * warns (`DF0069`) — or throws (`DF0068`) when {@link required} — while the
+   * warns (`DF0069`), or throws (`DF0068`) when {@link required}, while the
    * service still installs; the advertised meta carries the real version.
    */
   version?: string;
   /**
    * Fail hard when the service can't be imported or its version range isn't
-   * satisfied. By default a missing service is skipped silently — clients see
+   * satisfied. By default a missing service is skipped silently; clients see
    * `has() === false` and degrade.
    *
    * @default false
@@ -1002,7 +1009,7 @@ interface DevframeServiceDescriptor<Options = any> {
  * What can be passed to `ctx.services.install()` (and listed in
  * `DevframeDefinition.services`): a declarative {@link DevframeServiceDescriptor}
  * (the host imports the factory) or a ready {@link DevframeServiceDefinition}
- * (the installer already called the factory — its `options` join the merge).
+ * (the installer already called the factory, so its `options` join the merge).
  */
 type DevframeServiceInput<API = unknown, Options = any> = DevframeServiceDescriptor<Options> | DevframeServiceDefinition<API, Options>;
 /**
@@ -1010,7 +1017,7 @@ type DevframeServiceInput<API = unknown, Options = any> = DevframeServiceDescrip
  * `devframe:services` shared state.
  */
 interface DevframeServiceMeta {
-  /** npm package name — the registry key. */
+  /** npm package name, the registry key. */
   package: string;
   /** Installed version of the service. */
   version: string;
@@ -1033,7 +1040,7 @@ interface DevframeServicesHost {
   get: <ID extends DevframeServiceId>(id: ID) => DevframeServiceOf<ID> | undefined;
   has: (id: DevframeServiceId) => boolean;
   /**
-   * Run `callback` with the service as soon as it is available — immediately
+   * Run `callback` with the service as soon as it is available: immediately
    * when already provided, otherwise on `provide`. Survives provider/consumer
    * setup-order differences. The callback also re-fires if the service is
    * revoked and provided again. Returns an unsubscribe function.
@@ -1043,7 +1050,7 @@ interface DevframeServicesHost {
   keys: () => string[];
   /**
    * Install a **wire service** (see {@link DevframeServiceDefinition}). The
-   * common path is declarative — list services on `DevframeDefinition.services`
+   * common path is declarative: list services on `DevframeDefinition.services`
    * (or `initHub({ services })`) and the adapter installs them for you before
    * `setup` runs. Call `install()` directly only for the dynamic escape hatch:
    * a service configured at runtime from data unknown until then.
@@ -1051,7 +1058,7 @@ interface DevframeServicesHost {
    * Before the pre-setup ready fires, installs are queued and their option
    * sets deep-merged, constructing each service **once**. After it, an install
    * constructs immediately; installing an already-installed package returns
-   * the existing API (a warning — `DF0066` — when the late install carried
+   * the existing API (a warning, `DF0066`, when the late install carried
    * options, since they're ignored). The returned promise resolves with the
    * node API (or `undefined` when an optional descriptor's package can't be
    * imported).
@@ -1065,7 +1072,7 @@ interface DevframeServicesHost {
     resolveFrom?: string | null;
   }) => Promise<API | undefined>;
   /**
-   * Construct every queued service — importing descriptor packages, merging
+   * Construct every queued service, importing descriptor packages, merging
    * option sets, `provide()`-ing each node API under its package name, and
    * advertising it to clients via the `devframe:services` shared state.
    * Idempotent. **Internal**: the adapters call it once, before running any
@@ -1089,28 +1096,28 @@ type DevframeDeploymentKind = 'standalone' | 'hosted';
  * How a hub deduplicates devframes that share an `id` when more than one
  * is mounted onto the same hub. See {@link DevframeDefinition.duplicationStrategy}.
  *
- * - `'warn'` (default) — keep the first registration, drop later
+ * - `'warn'` (default): keep the first registration, drop later
  *   duplicates, and emit a warning diagnostic (`DF8105`).
- * - `'silent'` — drop later duplicates without warning.
- * - `'throw'` — throw when a duplicate is mounted.
- * - `'duplicate'` — let every instance coexist under a disambiguated
+ * - `'silent'`: drop later duplicates without warning.
+ * - `'throw'`: throw when a duplicate is mounted.
+ * - `'duplicate'`: let every instance coexist under a disambiguated
  *   dock id.
  */
 type DevframeDuplicationStrategy = 'warn' | 'silent' | 'throw' | 'duplicate';
 /**
- * Controls where the browser opens the RPC WebSocket — advertised in
+ * Controls where the browser opens the RPC WebSocket, advertised in
  * `__connection.json` and used to bind the dev server. The three shapes map
  * to the three connection scenarios; precedence is `url` > `port` > `route`:
  *
- *   1. **Same server, different route** (default) — leave `port`/`url` unset.
+ *   1. **Same server, different route** (default): leave `port`/`url` unset.
  *      The socket shares the HTTP server's port and binds to `route`
  *      (`__ws`). The client connects to its own origin, so the link
  *      survives a reverse proxy that rewrites the host/port/subpath.
  *
- *   2. **Different port** — set `port`. The socket binds on its own port on the
+ *   2. **Different port**: set `port`. The socket binds on its own port on the
  *      same host; the client targets `ws(s)://<page-host>:<port>/<route>`.
  *
- *   3. **Remote, different origin** — set `url` to a full `ws://`/`wss://`
+ *   3. **Remote, different origin**: set `url` to a full `ws://`/`wss://`
  *      endpoint (e.g. a public tunnel or relay). The client uses it verbatim.
  */
 interface DevframeWsOptions {
@@ -1139,7 +1146,7 @@ interface DevframeWsOptions {
   url?: string;
 }
 /**
- * Controls the SSE RPC endpoint — the WebSocket-free transport for hosts
+ * Controls the SSE RPC endpoint, the WebSocket-free transport for hosts
  * and proxies where the upgrade isn't available. It rides whatever HTTP
  * surface serves the instance (the same one serving `__connection.json`),
  * so a relative `route` always resolves; there is no port plumbing of its
@@ -1153,9 +1160,43 @@ interface DevframeSseOptions {
    */
   route?: string;
 }
+/**
+ * An **optional** identity check layered on top of the origin gate. The
+ * route-based MCP endpoint trusts same-machine callers by default (the
+ * loopback origin gate is enough), so this is opt-in hardening for the cases
+ * where a same-machine process is not a trust boundary, like a LAN/tunnel
+ * origin, a shared/CI box, or a destructive tool surface:
+ *
+ * - a non-empty **bearer token string**: the request must carry
+ *   `Authorization: Bearer <token>`, compared in constant time. Back it with
+ *   an environment variable rather than a literal;
+ * - a **callback** `(request) => boolean | Promise<boolean>`: a custom
+ *   identity check (validate a signed header, an mTLS-derived claim, …). It
+ *   only governs identity and cannot relax the origin gate;
+ * - `false`, the default: **origin-only**, trusting same-machine callers.
+ */
+type McpAuthorization = string | ((request: Request) => boolean | Promise<boolean>) | false;
+/**
+ * The route-based MCP setting accepted everywhere a host mounts a devframe
+ * (`cli.mcp`, `initDevframe` / `initHub` / `createDevServer` options, the
+ * framework kits):
+ *
+ * - `'auto'`, the default: mount the route when the devframe exposes an
+ *   agent surface (an `agent`-flagged RPC function, or a tool / resource /
+ *   provider registered on `ctx.agent`). An empty agent surface mounts
+ *   nothing and loads no MCP code.
+ * - `true`: always mount at the default `__mcp` route.
+ * - `false`: never mount.
+ * - {@link McpRouteOptions}: always mount, with a custom route path, origin
+ *   allow-list, or {@link McpAuthorization} identity check.
+ *
+ * A mounted route trusts same-machine callers by default (the loopback
+ * origin gate), exactly like `mcp: true`.
+ */
+type McpSetting = boolean | 'auto' | McpRouteOptions;
 /**
  * Configuration for the route-based MCP server mounted alongside the dev
- * server (opt-in via {@link DevframeCliOptions.mcp}). The endpoint speaks
+ * server (via {@link DevframeCliOptions.mcp}). The endpoint speaks
  * the MCP Streamable-HTTP transport over the same origin as the SPA,
  * exposing the definition's `ctx.agent` tools + shared-state resources to
  * external MCP clients connected to the *running* server.
@@ -1166,6 +1207,16 @@ interface McpRouteOptions {
    * Default: `__mcp` (i.e. `/__mcp` standalone, `/__<id>/__mcp` hosted).
    */
   path?: string;
+  /**
+   * Optional identity check, layered on top of the origin gate and checked
+   * **after** it. Defaults to origin-only (`false`): the route trusts
+   * same-machine callers, since the loopback origin gate already keeps
+   * arbitrary remote/browser callers out. Set a bearer token or a callback to
+   * harden the route when a same-machine process is not your trust boundary
+   * (LAN/tunnel origin, shared/CI host, destructive tools). See
+   * {@link McpAuthorization}.
+   */
+  authorization?: McpAuthorization;
   /**
    * Extra `Origin` header values to accept beyond the loopback default
    * (`localhost`/`127.0.0.1`/`::1` and any `Origin`-less native client).
@@ -1173,10 +1224,12 @@ interface McpRouteOptions {
    * host, mirroring the WS transport's origin gate. Pass `false` to disable
    * origin checking entirely (not recommended). Default: loopback-only.
    *
-   * This is the endpoint's DNS-rebinding protection — the shared
+   * This is the endpoint's DNS-rebinding protection: the shared
    * `isAllowedOrigin` gate the WS upgrade already uses, applied as external
    * middleware (the approach the MCP SDK now recommends over its own
-   * deprecated `allowedHosts`/`allowedOrigins` transport flags).
+   * deprecated `allowedHosts`/`allowedOrigins` transport flags). When you
+   * widen it past loopback, layer on {@link McpRouteOptions.authorization} to
+   * prove identity too.
    */
   allowedOrigins?: readonly string[] | false;
 }
@@ -1200,16 +1253,16 @@ interface DevframeCliOptions {
   /**
    * Authentication for the standalone dev server.
    *
-   *   - `undefined` / `true` — the standalone adapters (`cli` /
+   *   - `undefined` / `true`: the standalone adapters (`cli` /
    *     served `build`) auto-wire devframe's interactive OTP auth
    *     (`createInteractiveAuth`): an untrusted client can only reach
    *     `anonymous:` methods until it exchanges the printed one-time code.
    *     The adapter prints the code + magic-link banner once the server is
    *     listening.
-   *   - `false` — no gate, for trusted single-user localhost tools where an
+   *   - `false`: no gate, for trusted single-user localhost tools where an
    *     auth round-trip only gets in the way (the built-in plugins set this).
    *     The `--no-auth` CLI flag maps here for one-off runs.
-   *   - A {@link DevframeAuthHandler} — a custom handler (e.g. a tuned
+   *   - A {@link DevframeAuthHandler}: a custom handler (e.g. a tuned
    *     `createInteractiveAuth`, or an entirely different scheme) passed
    *     straight through to the RPC transport binding.
    *
@@ -1220,21 +1273,29 @@ interface DevframeCliOptions {
    */
   auth?: boolean | DevframeAuthHandler;
   /**
-   * Expose a route-based MCP server alongside the dev server, speaking the
-   * MCP Streamable-HTTP transport at `/__mcp` (relative to the base path).
-   * It surfaces the same `ctx.agent` tools + shared-state resources as the
-   * stdio `mcp` command, but against the live, running server.
+   * Expose a route-based MCP server alongside the standalone dev server,
+   * speaking the MCP Streamable-HTTP transport at `/__mcp` (relative to the
+   * base path). It surfaces the same `ctx.agent` tools + shared-state
+   * resources as the stdio `mcp` command, but against the live server.
+   *
+   * Defaults to `'auto'`: the route mounts once the devframe exposes an
+   * agent surface (an `agent`-flagged RPC, a registered tool / resource).
+   * See {@link McpSetting} for the full contract, and
+   * {@link McpRouteOptions} for the route path, origin allow-list, and
+   * {@link McpAuthorization} identity check.
    *
-   * - `false` / omitted (default) — no MCP route is mounted.
-   * - `true` — mount at the default `__mcp` route with the loopback-only
-   *   origin gate.
-   * - {@link McpRouteOptions} — customise the route path / allowed origins.
+   * The `--mcp` / `--no-mcp` CLI flags override this per run. Whether to expose
+   * MCP is a hosting decision, so programmatic hosts pass it to
+   * `initDevframe` / `initHub` / `createDevServer` instead.
    *
-   * The `--mcp` / `--no-mcp` CLI flags override this per run.
+   * @deprecated Whether to expose MCP is a hosting decision, not a capability
+   * of the tool. Pass `mcp` to `createCac` (or the programmatic host) instead.
+   * This field is still read as a fallback, and will be removed in a future
+   * release.
    */
-  mcp?: boolean | McpRouteOptions;
+  mcp?: McpSetting;
   /**
-   * Author's SPA dist — served as the devframe's UI.
+   * Author's SPA dist, served as the devframe's UI.
    *
    * @deprecated Moved to the top-level {@link DevframeDefinition.clientAssets}.
    * Set `clientAssets` on the definition instead. This field is still read as a
@@ -1245,11 +1306,11 @@ interface DevframeCliOptions {
    * How the browser reaches the RPC WebSocket. Defaults to sharing the HTTP
    * port on the `__ws` route. See {@link DevframeWsOptions} for the
    * different-port and remote-origin variants. Pass `false` to serve no
-   * WebSocket at all — clients connect over SSE instead (`backend: 'sse'`).
+   * WebSocket at all; clients connect over SSE instead (`backend: 'sse'`).
    */
   ws?: DevframeWsOptions | false;
   /**
-   * How the browser reaches the SSE RPC endpoint — enabled by default
+   * How the browser reaches the SSE RPC endpoint, enabled by default
    * alongside the WebSocket as the more portable transport. Pass `false`
    * to disable, or a {@link DevframeSseOptions} to change its route.
    */
@@ -1291,7 +1352,7 @@ interface DevframeCliOptions {
 }
 /**
  * Default dock attributes for the iframe entry a hub synthesizes when it
- * mounts this devframe. Framework-neutral metadata only — the hub layer
+ * mounts this devframe. Framework-neutral metadata only; the hub layer
  * (`ctx.install`) merges these beneath its per-mount `dock` overrides,
  * which in turn sit beneath the locked, derived `id` / `type` / `url`.
  *
@@ -1325,7 +1386,7 @@ interface DevframeDockDefaults {
   /**
    * Render-only visibility expression, same syntax as {@link when}. Hides the
    * entry's own dock-bar button when it evaluates to `false` while leaving it
-   * registered and reachable (activation, RPC lookups, etc.) — unlike `when`,
+   * registered and reachable (activation, RPC lookups, etc.), unlike `when`,
    * which is the general relevance switch for the entry as a whole.
    */
   visibility?: string;
@@ -1372,13 +1433,13 @@ interface DevframeDefinition {
    * everything against the plugin's own installed packages rather than the
    * consuming app's.
    *
-   * - **Remote assets** — becomes the default `resolveFrom` for any remote
+   * - **Remote assets**: becomes the default `resolveFrom` for any remote
    *   {@link StaticAssetsSource} the devframe hosts (its `clientAssets`, and
    *   every `ctx.views.hostStatic` call) that doesn't set one explicitly, so a
    *   locally installed copy of the assets package is served with zero
    *   network. A per-asset `resolveFrom` still wins, and an explicit
    *   `resolveFrom: null` still opts out.
-   * - **Service dependencies** — becomes the base the host resolves declared
+   * - **Service dependencies**: becomes the base the host resolves declared
    *   {@link DevframeServiceInput | services} from, so a plugin can ship a
    *   service package as its own dependency instead of asking users to install
    *   it.
@@ -1424,12 +1485,13 @@ interface DevframeDefinition {
    * Declares which runtimes meaningfully support this devframe. Adapters
    * act on a `false` before doing any work:
    *
-   * - `build: false` — `createCac` skips registering the `build` subcommand,
-   *   and `createBuild` refuses (throws `DF0042`) unless `{ force: true }`.
-   *   Useful for a devframe whose value is inherently live (e.g. it manages
-   *   real files on disk), so a static export would only ever produce a
-   *   broken, write-less shell of the tool.
-   * - `dev: false` — `createDevServer` refuses (throws `DF0058`) unless
+   * - `build: false`: `createCac` skips registering the `build` subcommand,
+   *   `createBuild` refuses (throws `DF0042`) unless `{ force: true }`, and
+   *   a hub static build (`buildHub`) silently skips the devframe - no dock,
+   *   no SPA copy, no RPCs in the dump. Useful for a devframe whose value is
+   *   inherently live (e.g. it manages real files on disk), so a static
+   *   export would only ever produce a broken, write-less shell of the tool.
+   * - `dev: false`: `createDevServer` refuses (throws `DF0058`) unless
    *   `{ force: true }`. Useful for a devframe that only makes sense as a
    *   static export (e.g. a report generator with nothing to serve live).
    */
@@ -1440,18 +1502,18 @@ interface DevframeDefinition {
   /**
    * Wire services this devframe consumes (see `DevframeServiceDefinition`).
    * Each entry is either a declarative descriptor
-   * (`{ package, version?, required?, options? }` — the host imports the
+   * (`{ package, version?, required?, options? }`, where the host imports the
    * package's default-export factory, resolving it against **this plugin's
    * own dependencies**) or a ready `DevframeServiceDefinition` (the factory
    * was already called). The adapter queues these before `setup(ctx)` runs
    * and constructs each service once at the `ctx.services.ready()` barrier,
    * merging option sets across every declarer. Missing services are skipped
-   * unless marked `required` — clients feature-detect via
+   * unless marked `required`; clients feature-detect via
    * `client.services.has(pkg)` and degrade.
    */
   services?: DevframeServiceInput[];
   /**
-   * Author's SPA dist — served as the devframe's UI. A local directory, or
+   * Author's SPA dist, served as the devframe's UI. A local directory, or
    * a {@link StaticAssetsSource} remote declaration (`{ package, version }`)
    * served through devframe's caching CDN back-proxy so the assets need not
    * ship inside the node package.
@@ -1463,20 +1525,20 @@ interface DevframeDefinition {
   clientAssets?: StaticAssetsSource;
   /** RPC-level configuration for this devframe (see {@link DevframeRpcOptions}). */
   rpc?: DevframeRpcOptions;
-  /** Server-side setup — the primary entrypoint. Runs in every runtime. */
+  /** Server-side setup: the primary entrypoint. Runs in every runtime. */
   setup: (ctx: DevframeNodeContext, info?: DevframeSetupInfo) => void | Promise<void>;
   cli?: DevframeCliOptions;
 }
 interface DevframeRpcOptions {
   /**
    * Opt an RPC function into the static-build snapshot **without owning its
-   * definition** — the mechanism a devframe uses to bake a wire service's
+   * definition**, the mechanism a devframe uses to bake a wire service's
    * RPC (e.g. `@devframes/service-git`'s `status`/`log`/`show`) into its
    * `build` export, since the service itself defines no `dump`/`snapshot`.
    *
    * Each entry is either a bare method id (bakes the no-argument call, like
    * `snapshot: true`) or `{ method, inputs }` where `inputs` is the list of
-   * argument-tuples to bake — or an async provider given the node context
+   * argument-tuples to bake, or an async provider given the node context
    * (so it can enumerate at build time, e.g. read commit hashes via the
    * service's node API). `createBuild` resolves these after setup and
    * executes the target's own handler per tuple; the first tuple's result
@@ -1576,7 +1638,7 @@ interface BufferedChunk<T> {
 interface StreamSinkEvents<T> {
   /** Fired for each `write()`. The RPC layer subscribes and broadcasts. */
   chunk: (seq: number, chunk: T) => void;
-  /** Terminal — fired exactly once per sink lifetime. */
+  /** Terminal; fired exactly once per sink lifetime. */
   end: (error?: StreamErrorPayload) => void;
 }
 interface CreateStreamSinkOptions {
@@ -1610,17 +1672,17 @@ interface StreamSink<T> {
   close: () => void;
   /** External-cancel path. Aborts the signal so handlers can short-circuit. */
   abort: (reason?: unknown) => void;
-  /** `WritableStream<T>` adapter — same in-memory state as the imperative API. */
+  /** `WritableStream<T>` adapter; same in-memory state as the imperative API. */
   readonly writable: WritableStream<T>;
   /**
-   * Internal — RPC layer subscribes to receive chunk/end notifications.
+   * Internal: RPC layer subscribes to receive chunk/end notifications.
    * Not part of the public contract; do not call directly.
    *
    * @internal
    */
   readonly events: EventEmitter<StreamSinkEvents<T>>;
   /**
-   * Internal — replay buffer. RPC layer reads on (re)subscribe to feed
+   * Internal replay buffer. RPC layer reads on (re)subscribe to feed
    * missed chunks before going live.
    *
    * @internal
@@ -1640,12 +1702,12 @@ interface CreateStreamReaderOptions {
    * RPC-agnostic.
    */
   onOverflow?: (dropped: number) => void;
-  /** Called when the consumer cancels — the RPC layer sends `:cancel` upstream. */
+  /** Called when the consumer cancels; the RPC layer sends `:cancel` upstream. */
   onCancel?: () => void;
 }
 /**
  * Client-side consumer handle. Both an `AsyncIterable<T>` (for `for await`)
- * and exposes `readable: ReadableStream<T>` (for `pipeTo`). Pick one — they
+ * and exposes `readable: ReadableStream<T>` (for `pipeTo`). Pick one; they
  * share a single internal queue, so concurrent draining will race.
  */
 interface StreamReader<T> extends AsyncIterable<T> {
@@ -1663,13 +1725,13 @@ interface StreamReader<T> extends AsyncIterable<T> {
   _end: (error?: StreamErrorPayload) => void;
 }
 /**
- * Build a server-side stream sink. RPC-agnostic — the RPC host wires
+ * Build a server-side stream sink. RPC-agnostic; the RPC host wires
  * `events.on('chunk' | 'end')` to broadcast, and reads `buffer` to replay
  * for late or reconnecting subscribers.
  */
 declare function createStreamSink<T>(options?: CreateStreamSinkOptions): StreamSink<T>;
 /**
- * Build a client-side stream reader. RPC-agnostic — the RPC host calls
+ * Build a client-side stream reader. RPC-agnostic; the RPC host calls
  * `_push(seq, chunk)` on each incoming chunk and `_end(error?)` on the
  * terminal frame. Consumers iterate with `for await` or pipe `readable`.
  */
@@ -1747,7 +1809,7 @@ interface RpcStreamingChannelOptions {
    * replay-on-resubscribe. `0` (default) disables replay; on reconnect
    * the consumer only sees chunks that arrive after subscribing.
    *
-   * The buffer is per stream id, not per channel — each `channel.start()`
+   * The buffer is per stream id, not per channel; each `channel.start()`
    * gets its own.
    */
   replayWindow?: number;
@@ -1797,7 +1859,7 @@ interface RpcStreamingChannel<T = unknown> {
   /** All active outbound stream ids on this channel. */
   ids: () => string[];
   /**
-   * Open an inbound stream — the server side of a client-to-server
+   * Open an inbound stream: the server side of a client-to-server
    * upload. Allocates an id, returns a `StreamReader<T>` that fills as
    * the client writes chunks. Typical pattern is to call this from an
    * action handler, kick off background processing, and return the id
@@ -1848,7 +1910,7 @@ interface DevframeCapabilities {
   views?: boolean;
 }
 /**
- * Framework- and build-tool-agnostic node context — RPC + diagnostics +
+ * Framework- and build-tool-agnostic node context: RPC + diagnostics +
  * agent + the view-host (HTTP file-serving). Host adapters can wrap this
  * to add their own surfaces; for example, `@vitejs/devtools-kit`'s
  * `createKitContext` adds `docks`, `terminals`, `messages`, and
@@ -1862,10 +1924,10 @@ interface DevframeNodeContext {
   /**
    * Lifecycle distinction surfaced to plugin authors:
    *
-   *   - `'dev'`   — long-running, interactive session. Connections come and
+   *   - `'dev'`:   long-running, interactive session. Connections come and
    *                 go; broadcasts and shared-state mutations are debounced
    *                 to keep the UI responsive.
-   *   - `'build'` — one-shot batch run. The context is set up, the devtool
+   *   - `'build'`: one-shot batch run. The context is set up, the devtool
    *                 collects what it needs, and a snapshot is written. No
    *                 live UI, no WS server.
    *
@@ -1875,23 +1937,23 @@ interface DevframeNodeContext {
    */
   readonly mode: 'dev' | 'build';
   /**
-   * Host runtime abstraction — exposes `mountStatic` / `resolveOrigin` /
+   * Host runtime abstraction, exposing `mountStatic` / `resolveOrigin` /
    * `getStorageDir`.
    */
   host: DevframeHost;
   rpc: RpcFunctionsHost;
   views: DevframeViewHost;
   /**
-   * Structured diagnostics host — wraps `nostics` and lets integrations
+   * Structured diagnostics host; wraps `nostics` and lets integrations
    * register their own coded errors/warnings into the shared lookup.
    */
   diagnostics: DevframeDiagnosticsHost;
   /**
-   * Agent host — aggregates the agent-exposed surface of this devtool.
+   * Agent host; aggregates the agent-exposed surface of this devtool.
    */
   agent: DevframeAgentHost;
   /**
-   * Cross-plugin services — a typed, namespaced registry through which one
+   * Cross-plugin services: a typed, namespaced registry through which one
    * integration exposes a capability (e.g. a data-source registry) and
    * others consume it without a hard package dependency. Ids follow the RPC
    * namespacing rule (`<plugin-id>:<service>`); types come from augmenting
@@ -1900,11 +1962,11 @@ interface DevframeNodeContext {
    */
   services: DevframeServicesHost;
   /**
-   * This context's own {@link ConnectionMeta.configs} — static, boot-time
+   * This context's own {@link ConnectionMeta.configs}: static, boot-time
    * config a host publishes once through the connection handshake and every
    * client reads read-only. A plain, **non-reactive** object: mutate it
    * during `setup(ctx)` (a plugin sets its keys, a hub aggregates across
-   * every installed devframe), never during the session — it's serialized
+   * every installed devframe), never during the session, since it's serialized
    * once, after setup, and changing it afterwards reaches no client.
    *
    * ```ts
@@ -1935,7 +1997,7 @@ interface DevframeNodeContext {
  * where `__connection.json` was loaded, and the connection is made to the
  * page's own origin (only the `http`→`ws` / `https`→`wss` protocol swap is
  * applied). This survives reverse proxies that change the host/port, because
- * the client never trusts a server-baked hostname — it reuses its own.
+ * the client never trusts a server-baked hostname; it reuses its own.
  *
  * Set `port` (and/or `host`) only when the WS endpoint genuinely lives on a
  * different origin than the page, e.g. a side-car server on its own port.
@@ -1953,7 +2015,7 @@ interface ConnectionMetaWebsocket {
   host?: string;
 }
 /**
- * Object form of {@link ConnectionMeta.sse} — the same proxy-safe shape and
+ * Object form of {@link ConnectionMeta.sse}: the same proxy-safe shape and
  * resolution rules as {@link ConnectionMetaWebsocket}, producing an
  * `http(s)://` endpoint instead of a `ws(s)://` one. Set `port` (and/or
  * `host`) only when the SSE endpoint genuinely lives on a different origin
@@ -1981,10 +2043,10 @@ interface ConnectionMeta {
   /**
    * WebSocket endpoint, resolved by the client into a `ws(s)://` URL:
    *
-   *   - {@link ConnectionMetaWebsocket} — the proxy-flexible default; a
+   *   - {@link ConnectionMetaWebsocket}: the proxy-flexible default; a
    *     same-origin path relative to `__connection.json`.
-   *   - `number` — a port on the page's hostname (`ws(s)://<host>:<port>`).
-   *   - `string` — a full `ws://`/`wss://` URL used verbatim, an `http(s)://`
+   *   - `number`: a port on the page's hostname (`ws(s)://<host>:<port>`).
+   *   - `string`: a full `ws://`/`wss://` URL used verbatim, an `http(s)://`
    *     URL with its protocol swapped, or a path resolved same-origin.
    */
   websocket?: number | string | ConnectionMetaWebsocket;
@@ -1993,9 +2055,9 @@ interface ConnectionMeta {
    * resolved by the client into an `http(s)://` URL with the same
    * proxy-safe rules as {@link ConnectionMeta.websocket}:
    *
-   *   - {@link ConnectionMetaSse} — the proxy-flexible default; a
+   *   - {@link ConnectionMetaSse}: the proxy-flexible default; a
    *     same-origin path relative to `__connection.json`.
-   *   - `string` — a full `http(s)://` URL used verbatim, or a path
+   *   - `string`: a full `http(s)://` URL used verbatim, or a path
    *     resolved same-origin.
    */
   sse?: string | ConnectionMetaSse;
@@ -2005,7 +2067,7 @@ interface ConnectionMeta {
    * tooling (e.g. an MCP inspector) can discover it without guessing the
    * path. `path` is relative to `__connection.json`'s location, like the
    * WebSocket `path`. `port` is set when the endpoint lives on a side-car
-   * server on its own port (bridge mode — `devframeViteBridge`,
+   * server on its own port (bridge mode: `devframeViteBridge`,
    * `@devframes/next`): the client combines the page hostname with `port`
    * and resolves `path` against that origin, mirroring
    * {@link ConnectionMetaWebsocket.port}.
@@ -2024,18 +2086,25 @@ interface ConnectionMeta {
    */
   jsonSerializableMethods?: string[];
   /**
-   * Absolute URL of the `__connection.json` this meta was loaded from.
-   * Annotated by the client (not served) when it publishes the meta on a
-   * shared window for same-origin inheritance: a relative `websocket.path`
-   * resolves against this, so a child SPA mounted at another base (e.g. a hub
-   * mounting several devframes at `/__foo/`, `/__bar/`, …) inherits a dialable
-   * endpoint rather than resolving the path against its own mount.
+   * URL of the `__connection.json` that owns this meta's relative paths.
+   * Two producers write it:
+   *
+   *   - The client annotates it (absolute) when it publishes the meta on a
+   *     shared window for same-origin inheritance: a relative
+   *     `websocket.path` resolves against this, so a child SPA mounted at
+   *     another base (e.g. a hub mounting several devframes at `/__foo/`,
+   *     `/__bar/`, …) inherits a dialable endpoint rather than resolving the
+   *     path against its own mount.
+   *   - A static hub build serves it (base-absolute, e.g.
+   *     `/__devframes/__connection.json`) in each **per-frame** meta, so a
+   *     frame SPA that fetched its own copy still resolves the shared RPC
+   *     dump from the hub base. Resolved against the fetched URL.
    */
   baseUrl?: string;
   /**
    * A pre-issued bearer token embedded in the meta so a client trusts the
    * server on connect without any prompt or `localStorage` lookup. Only a
-   * **hub** serving a **per-frame** connection meta populates this — it
+   * **hub** serving a **per-frame** connection meta populates this; it
    * authenticates once at the top level and bakes the resulting token into
    * the meta each plugin iframe fetches, so a cross-origin frame (which
    * cannot read the hub's `localStorage`) is still pre-authorized. The
@@ -2043,7 +2112,7 @@ interface ConnectionMeta {
    *
    * > [!WARNING]
    * > A token in a fetchable JSON is only as protected as the URL serving
-   * > it. Emit it exclusively from hub-controlled, per-frame meta — never
+   * > it. Emit it exclusively from hub-controlled, per-frame meta, never
    * > from a publicly reachable static `__connection.json`.
    */
   authToken?: string;
@@ -2057,13 +2126,13 @@ interface ConnectionMeta {
    */
   viewerOriginToken?: string;
   /**
-   * Static, host-declared configuration — baked in once at connect time and
+   * Static, host-declared configuration, baked in once at connect time and
    * fixed for the life of the server (e.g. a hub's UI rebrand, or its
    * aggregated dock-bar layout preferences). Read-only from the browser: a
    * client only ever reads `rpc.connectionMeta.configs`, never writes to it.
    *
    * Contrast this with {@link DevframeSettingsRegistry} (`ctx.scope(ns).settings`)
-   * and a hub's `devframe:user-settings` shared-state key — both are
+   * and a hub's `devframe:user-settings` shared-state key; both are
    * mutable, user-editable, and synced bidirectionally over RPC for the
    * life of the session. `configs` is the opposite: one-way, immutable,
    * decided by whoever assembled the server.
@@ -2081,7 +2150,7 @@ interface ConnectionMeta {
   configs?: Partial<DevframeConnectionConfigsRegistry>;
 }
 /**
- * Augmentation point for {@link ConnectionMeta.configs}. Empty by default —
+ * Augmentation point for {@link ConnectionMeta.configs}. Empty by default;
  * a package that wants to publish static, boot-time config through the
  * connection handshake augments this interface with its own key (see
  * {@link ConnectionMeta.configs} for the pattern). `@devframes/hub`
@@ -2089,4 +2158,4 @@ interface ConnectionMeta {
  */
 interface DevframeConnectionConfigsRegistry {}
 //#endregion
-export { DevframeServicesHost as $, SharedStateEvents as A, AgentResource as At, DevframeSetupInfo as B, EventUnsubscribe as Bt, createStreamSink as C, DevframeAuthHandler as Ct, ImmutableObject as D, parseCliFlags as Dt, ImmutableMap as E, defineCliFlags as Et, DevframeDefinition as F, AgentToolProvider as Ft, McpRouteOptions as G, DevframeSnapshotRpcInputs as H, DevframeDeploymentKind as I, AgentToolProviderHandle as It, DevframeServiceId as J, DevframeServiceDefinition as K, DevframeDockDefaults as L, DevframeAgentHost as Lt, SharedStatePatch as M, AgentResourceInput as Mt, createSharedState as N, AgentTool as Nt, ImmutableSet as O, AgentHandle as Ot, DevframeCliOptions as P, AgentToolInput as Pt, DevframeServiceScopeOf as Q, DevframeDuplicationStrategy as R, DevframeAgentHostEvents as Rt, createStreamReader as S, DevframeDiagnosticsLogger as St, ImmutableArray as T, InferCliFlags as Tt, DevframeSseOptions as U, DevframeSnapshotRpcEntry as V, EventsMap as Vt, DevframeWsOptions as W, DevframeServiceMeta as X, DevframeServiceInput as Y, DevframeServiceOf as Z, CreateStreamSinkOptions as _, DevframeRpcServerFunctions as _t, DevframeConnectionConfigsRegistry as a, DevframeScopedStreamingHost as at, StreamSink as b, DevframeStorageScope as bt, RpcBroadcastOptions as c, DevframeSettingsStore as ct, RpcSharedStateHost as d, ScopedRpcFn as dt, DevframeServicesRegistry as et, RpcStreamingChannel as f, ScopedServerFunctions as ft, CreateStreamReaderOptions as g, DevframeRpcClientFunctions as gt, BufferedChunk as h, DevframeViewHost as ht, DevframeCapabilities as i, DevframeScopedNodeRpc as it, SharedStateOptions as j, AgentResourceContent as jt, SharedState as k, AgentManifest as kt, RpcFunctionsHost as l, ScopedBroadcastOptions as lt, RpcStreamingHost as m, SettingsForNamespace as mt, ConnectionMetaSse as n, DevframeServicesState as nt, DevframeNodeContext as o, DevframeSettings as ot, RpcStreamingChannelOptions as p, ScopedSharedStates as pt, DevframeServiceDescriptor as q, ConnectionMetaWebsocket as r, DevframeScopedNodeContext as rt, DevframeNodeRpcSession as s, DevframeSettingsRegistry as st, ConnectionMeta as t, DevframeServicesScopeRegistry as tt, RpcSharedStateGetOptions as u, ScopedClientFunctions as ut, StreamErrorPayload as v, DevframeRpcSharedStates as vt, Immutable as w, CliFlagsSchema as wt, StreamSinkEvents as x, DevframeDiagnosticsHost as xt, StreamReader as y, DevframeHost as yt, DevframeRpcOptions as z, EventEmitter as zt };
+export { DevframeServiceOf as $, SharedStateEvents as A, AgentHandle as At, DevframeSetupInfo as B, DevframeAgentHostEvents as Bt, createStreamSink as C, DevframeDiagnosticsHost as Ct, ImmutableObject as D, InferCliFlags as Dt, ImmutableMap as E, CliFlagsSchema as Et, DevframeDefinition as F, AgentTool as Ft, McpAuthorization as G, DevframeSnapshotRpcInputs as H, EventUnsubscribe as Ht, DevframeDeploymentKind as I, AgentToolInput as It, DevframeServiceDefinition as J, McpRouteOptions as K, DevframeDockDefaults as L, AgentToolProvider as Lt, SharedStatePatch as M, AgentResource as Mt, createSharedState as N, AgentResourceContent as Nt, ImmutableSet as O, defineCliFlags as Ot, DevframeCliOptions as P, AgentResourceInput as Pt, DevframeServiceMeta as Q, DevframeDuplicationStrategy as R, AgentToolProviderHandle as Rt, createStreamReader as S, DevframeStorageScope as St, ImmutableArray as T, DevframeAuthHandler as Tt, DevframeSseOptions as U, EventsMap as Ut, DevframeSnapshotRpcEntry as V, EventEmitter as Vt, DevframeWsOptions as W, DevframeServiceId as X, DevframeServiceDescriptor as Y, DevframeServiceInput as Z, CreateStreamSinkOptions as _, DevframeViewHost as _t, DevframeConnectionConfigsRegistry as a, DevframeScopedNodeContext as at, StreamSink as b, DevframeRpcSharedStates as bt, RpcBroadcastOptions as c, DevframeSettings as ct, RpcSharedStateHost as d, ScopedBroadcastOptions as dt, DevframeServiceScopeOf as et, RpcStreamingChannel as f, ScopedClientFunctions as ft, CreateStreamReaderOptions as g, SettingsForNamespace as gt, BufferedChunk as h, ScopedSharedStates as ht, DevframeCapabilities as i, DevframeServicesState as it, SharedStateOptions as j, AgentManifest as jt, SharedState as k, parseCliFlags as kt, RpcFunctionsHost as l, DevframeSettingsRegistry as lt, RpcStreamingHost as m, ScopedServerFunctions as mt, ConnectionMetaSse as n, DevframeServicesRegistry as nt, DevframeNodeContext as o, DevframeScopedNodeRpc as ot, RpcStreamingChannelOptions as p, ScopedRpcFn as pt, McpSetting as q, ConnectionMetaWebsocket as r, DevframeServicesScopeRegistry as rt, DevframeNodeRpcSession as s, DevframeScopedStreamingHost as st, ConnectionMeta as t, DevframeServicesHost as tt, RpcSharedStateGetOptions as u, DevframeSettingsStore as ut, StreamErrorPayload as v, DevframeRpcClientFunctions as vt, Immutable as w, DevframeDiagnosticsLogger as wt, StreamSinkEvents as x, DevframeHost as xt, StreamReader as y, DevframeRpcServerFunctions as yt, DevframeRpcOptions as z, DevframeAgentHost as zt };