devframe 0.9.8 → 0.9.10

package/dist/{context-KUqAfawQ.mjs → context-jXO5vzjH.mjs}

@@ -1,6 +1,6 @@
-import { n as randomToken } from "./crypto-token-XCqTSMg9.mjs";
-import { t as createStorage } from "./storage-BXNVhKyR.mjs";
-import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "./revoke-COLW0cOi.mjs";
+import { n as randomToken } from "./crypto-token-TVbGGFuj.mjs";
+import { t as createStorage } from "./storage-B70AXK64.mjs";
+import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "./revoke-cqztiCX4.mjs";
 import { join } from "pathe";
 //#region src/node/hub-internals/context.ts
 const internalContextMap = /* @__PURE__ */ new WeakMap();

package/dist/{crypto-token-XCqTSMg9.mjs → crypto-token-TVbGGFuj.mjs}

@@ -2,7 +2,7 @@
 const HEX = "0123456789abcdef";
 /**
 * Generate a high-entropy, URL-safe (hex) random token suitable for use as a
-* bearer credential — e.g. the persistent client auth token or an ephemeral
+* bearer credential, e.g. the persistent client auth token or an ephemeral
 * remote-dock token. Defaults to 16 bytes (128 bits) of entropy.
 */
 function randomToken(byteLength = 16) {

package/dist/{dev-CzkPCJwi.mjs → dev-CRYHx7iG.mjs}

@@ -1,17 +1,17 @@
-import { t as resolveClientAssets } from "./client-assets-C7SXgTWY.mjs";
+import { t as resolveClientAssets } from "./client-assets-DNdhagGm.mjs";
 import { DEVFRAME_CONNECTION_META_FILENAME } from "./constants.mjs";
-import { t as diagnostics } from "./diagnostics-BXWW3VK-.mjs";
-import { t as createHostContext } from "./context-omlma_1n.mjs";
-import { t as resolveStaticAssetsSource } from "./remote-assets-DezQmPQU.mjs";
-import { i as resolveMcpConnectionMeta, n as resolveBasePath, r as resolveDevServerPort, t as normalizeBasePath } from "./_shared-BM3PdYli.mjs";
-import { t as createH3DevframeHost } from "./host-h3-fRbF9yor.mjs";
-import { a as importRuntimeModule, i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-CpVW4zG0.mjs";
+import { t as diagnostics } from "./diagnostics-DZA6KQ_Z.mjs";
+import { t as createHostContext } from "./context-B29Oh0oA.mjs";
+import { t as resolveStaticAssetsSource } from "./remote-assets-DMFzLSoH.mjs";
+import { a as resolveMcpConfig, i as resolveDevServerPort, n as normalizeBasePath, r as resolveBasePath, s as importRuntimeModule, t as loadAutoMcpAdapter } from "./_shared-U8D-xzrp.mjs";
+import { t as createH3DevframeHost } from "./host-h3-BROI6SQ4.mjs";
+import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-DvYCwrDy.mjs";
 import { open } from "./utils/open.mjs";
 import { mountStaticHandler } from "./utils/serve-static.mjs";
+import { resolve } from "pathe";
 import { createServer } from "node:http";
 import process from "node:process";
-import { resolve } from "pathe";
-import { joinURL, withBase } from "ufo";
+import { joinURL, withBase, withoutLeadingSlash } from "ufo";
 import { H3, toNodeHandler } from "h3";
 //#region src/adapters/initiate.ts
 const INSTANCE_INTERNALS = /* @__PURE__ */ new WeakMap();
@@ -20,7 +20,7 @@ function getInstanceInternals(handler) {
 	return INSTANCE_INTERNALS.get(handler) ?? {};
 }
 /**
-* Serve a devframe through one framework-agnostic, web-standard handler —
+* Serve a devframe through one framework-agnostic, web-standard handler:
 * the SPA, `__connection.json` discovery, the WebSocket RPC endpoint, the
 * auth gate, and the optional MCP route, all under a single mount base.
 * Mount `handler` on any framework's catch-all route (or `nodeMiddleware` on
@@ -28,10 +28,10 @@ function getInstanceInternals(handler) {
 *
 * The factory is synchronous and kicks off initialization eagerly;
 * `handler`/`nodeMiddleware` await readiness internally. Nothing binds a port
-* on its own: the WebSocket resolves in precedence order — `ws.port` (pinned
+* on its own: the WebSocket resolves in precedence order: `ws.port` (pinned
 * side-car) > `server` (shared upgrade at `<base>__ws`) > `ws.sidecar`
 * (auto-port side-car) > the host driving upgrades itself through
-* {@link DevframeInstance.attach} — while `ws.url`, when set, overrides the
+* {@link DevframeInstance.attach}. Meanwhile `ws.url`, when set, overrides the
 * advertised* endpoint (the tunnel pattern) and on its own hands the whole
 * transport to an external server. `__connection.json` reflects whichever
 * combination is active.
@@ -46,6 +46,10 @@ function initDevframe(def, options) {
 		app,
 		host,
 		origin: options.origin,
+		/**
+		* Auth resolution mirrors `createDevServer`: gate by default, explicit
+		* `false` opts out, a handler object installs a custom scheme.
+		*/
 		auth: options.auth !== void 0 ? options.auth : def.cli?.auth,
 		server: options.server,
 		ws: options.ws ?? def.cli?.ws,
@@ -84,34 +88,11 @@ function initDevframe(def, options) {
 			for (const input of def.services ?? []) context.services.install(input, { resolveFrom: def.importMetaUrl });
 			await context.services.ready();
 			await def.setup(context, setupInfo);
-			const mcpOption = options.mcp ?? def.cli?.mcp;
-			const mcpMeta = resolveMcpConnectionMeta(def, mcpOption);
-			let mcpDispose;
-			if (mcpMeta) {
-				const mcpConfig = mcpOption === true || mcpOption === void 0 ? {} : mcpOption;
-				const mcpPath = joinURL(base, mcpMeta.path);
-				let mountMcpHttp;
-				try {
-					({mountMcpHttp} = await importRuntimeModule("devframe/adapters/mcp"));
-				} catch (error) {
-					const reason = error instanceof Error ? error.message : String(error);
-					throw diagnostics.DF0017({
-						transport: "http",
-						reason,
-						cause: error
-					});
-				}
-				mcpDispose = mountMcpHttp(app, context, mcpPath, {
-					serverName: `${def.id} (devframe)`,
-					serverVersion: def.version ?? "0.0.0",
-					exposeSharedState: true,
-					allowedOrigins: mcpConfig.allowedOrigins
-				}).dispose;
-			}
+			const mcp = await mountMcpRoute(app, context, def, base, options.mcp ?? def.cli?.mcp ?? "auto");
 			return {
 				context,
-				...mcpMeta ? { mcp: mcpMeta } : {},
-				...mcpDispose ? { dispose: mcpDispose } : {}
+				...mcp?.meta ? { mcp: mcp.meta } : {},
+				...mcp?.dispose ? { dispose: mcp.dispose } : {}
 			};
 		},
 		mount(context, meta) {
@@ -136,17 +117,56 @@ function initDevframe(def, options) {
 	INSTANCE_INTERNALS.set(instance, shell.internals);
 	return instance;
 }
+/**
+* Mount the route-based MCP server at `<base>__mcp`, before the SPA static
+* catch-all so the exact route wins. The MCP SDK is pulled in dynamically
+* only when the route mounts, keeping it out of consumer bundles: `'auto'`
+* mounts once `setup()` left a non-empty agent surface (an empty surface
+* loads no MCP code); an explicit setting mounts unconditionally. The
+* resolved config is origin-only unless it opts into a bearer/callback.
+*/
+async function mountMcpRoute(app, context, def, base, setting) {
+	let module;
+	let config;
+	if (setting === "auto") {
+		module = await loadAutoMcpAdapter(context.agent);
+		if (module) config = { authorization: false };
+	} else config = resolveMcpConfig(setting);
+	if (!config) return void 0;
+	const route = withoutLeadingSlash(config.path ?? "__mcp");
+	if (!module) try {
+		module = await importRuntimeModule("devframe/adapters/mcp");
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		throw diagnostics.DF0017({
+			transport: "http",
+			reason,
+			cause: error
+		});
+	}
+	const mounted = module.mountMcpHttp(app, context, joinURL(base, route), {
+		serverName: `${def.id} (devframe)`,
+		serverVersion: def.version ?? "0.0.0",
+		exposeSharedState: true,
+		authorization: config.authorization,
+		allowedOrigins: config.allowedOrigins
+	});
+	return {
+		meta: { path: route },
+		dispose: mounted.dispose
+	};
+}
 //#endregion
 //#region src/adapters/dev.ts
 /**
-* Start a devframe dev server for a {@link DevframeDefinition} —
+* Start a devframe dev server for a {@link DevframeDefinition}:
 * h3 + WebSocket RPC + (optionally) the author's SPA mounted at the
 * resolved base path.
 *
 * When `distDir` is omitted (and the definition's client assets are unset) the
 * server runs in **bridge mode**: only `__connection.json` and the WS
 * endpoint are mounted, with no SPA mount. The SPA is expected to be
-* hosted elsewhere (e.g. by a parent Vite/Nuxt dev server) — see
+* hosted elsewhere (e.g. by a parent Vite/Nuxt dev server); see
 * `devframeViteBridge` from `@devframes/vite`.
 *
 * Returns the underlying {@link StartedServer} handle so callers can
@@ -194,12 +214,25 @@ async function createDevServer(def, options = {}) {
 		ws: options.ws,
 		allowedOrigins: options.allowedOrigins,
 		sse: options.sse,
+		/**
+		* The `--no-auth` flag forces the gate off regardless of the `auth`
+		* option / definition default (which the instance resolves itself).
+		*/
 		auth: flags.auth === false ? false : options.auth,
 		mcp: options.mcp,
 		flags,
 		onPeerConnect: options.onPeerConnect,
 		onPeerDisconnect: options.onPeerDisconnect,
+		/**
+		* Publish in the global registry so discovery tooling (`devframe connect`)
+		* finds the server without port guessing. The instance owns the record's
+		* lifecycle, written once its (pinned) origin resolves, removed on close.
+		*/
 		register: true,
+		/**
+		* This server is devframe's own, and nothing else handles its upgrades, so
+		* off-route upgrade attempts are rejected promptly.
+		*/
 		destroyUnmatchedUpgrades: true
 	});
 	try {

package/dist/{diagnostics-BXWW3VK-.mjs → diagnostics-DZA6KQ_Z.mjs}

@@ -1,5 +1,10 @@
-import { i as defineDiagnostics } from "./nostics-CzECRXpE.mjs";
+import { i as defineDiagnostics } from "./nostics-D0PvLZsn.mjs";
 //#region src/node/diagnostics.ts
+/**
+* DF00xx codes are allocated across packages (e.g. @devframes/json-render
+* owns DF0037–DF0041), so this file alone doesn't show the next free
+* number; check `docs/content/6.errors/` for the full allocation before adding one.
+*/
 const diagnostics = defineDiagnostics({
 	docsBase: "https://devfra.me/errors",
 	codes: {
@@ -9,7 +14,7 @@ const diagnostics = defineDiagnostics({
 		DF0012: { why: (p) => `Failed to parse storage file: ${p.filepath}, falling back to defaults.` },
 		DF0013: { why: (p) => `Shared state of "${p.key}" is not found, please provide an initial value for the first time` },
 		DF0014: {
-			why: (p) => `RPC function "${p.name}" has an invalid \`agent\` field — \`description\` must be a non-empty string.`,
+			why: (p) => `RPC function "${p.name}" has an invalid \`agent\` field: \`description\` must be a non-empty string.`,
 			fix: "Provide a short description (~1–3 sentences) explaining what the tool does and when agents should invoke it."
 		},
 		DF0015: {
@@ -23,12 +28,12 @@ const diagnostics = defineDiagnostics({
 			fix: "The consumer is too slow for the producer. Raise `highWaterMark` on the subscription, slow the producer, or batch chunks."
 		},
 		DF0030: {
-			why: (p) => `Stream "${p.channel}#${p.id}" is unknown — no producer has called \`channel.start({ id: "${p.id}" })\`.`,
+			why: (p) => `Stream "${p.channel}#${p.id}" is unknown; no producer has called \`channel.start({ id: "${p.id}" })\`.`,
 			fix: "Ensure the server-side producer is running before clients subscribe, or check for typos in the stream id."
 		},
 		DF0031: {
 			why: (p) => `Cannot write to closed stream "${p.channel}#${p.id}".`,
-			fix: "Track the producer lifecycle — guard writes with the `stream.signal.aborted` flag."
+			fix: "Track the producer lifecycle by guarding writes with the `stream.signal.aborted` flag."
 		},
 		DF0032: {
 			why: (p) => `Streaming channel "${p.channel}" is already registered.`,
@@ -48,14 +53,14 @@ const diagnostics = defineDiagnostics({
 		},
 		DF0036: {
 			why: (p) => `RPC call to "${p.name}" was rejected: the caller is not authorized.`,
-			fix: "Complete the auth handshake (or connect with a static/pre-shared token) before calling a trusted method. Untrusted callers may only call `anonymous:`-prefixed methods — see `isAnonymousRpcMethod`."
+			fix: "Complete the auth handshake (or connect with a static/pre-shared token) before calling a trusted method. Untrusted callers may only call `anonymous:`-prefixed methods; see `isAnonymousRpcMethod`."
 		},
 		DF0037: {
 			why: (p) => `A service is already provided under "${p.id}".`,
 			fix: "Service ids are unique per context. Revoke the existing provider first (the `provide()` call returns a revoke function), or namespace the id with your plugin id to avoid collisions."
 		},
 		DF0042: {
-			why: (p) => `"${p.id}" declares \`capabilities.build: false\` — its static export is not meaningful (writes are excluded and any live-served data won't be there).`,
+			why: (p) => `"${p.id}" declares \`capabilities.build: false\`, so its static export is not meaningful (writes are excluded and any live-served data won't be there).`,
 			fix: "Pass `{ force: true }` to `createBuild()` if the degraded export is still useful to you, or drop `capabilities.build: false` on the definition."
 		},
 		DF0045: {
@@ -63,8 +68,8 @@ const diagnostics = defineDiagnostics({
 			fix: "Discovery tooling (`devframe connect`) will not see this instance. Check that the registry directory is writable, point `DEVFRAME_INSTANCES_DIR` at a writable directory, or set `DEVFRAME_DISABLE_INSTANCE_REGISTRY=1` to opt out of registration."
 		},
 		DF0046: {
-			why: (p) => `\`devframe connect\` requires the optional peer dependency @modelcontextprotocol/server: ${p.reason}`,
-			fix: "Install it next to devframe (e.g. `npm install @modelcontextprotocol/server`) and run `devframe connect` again."
+			why: (p) => `\`devframe connect\` requires the optional peer dependency @modelcontextprotocol/client: ${p.reason}`,
+			fix: "Install it next to devframe (e.g. `npm install @modelcontextprotocol/client`) and run `devframe connect` again."
 		},
 		DF0047: {
 			why: (p) => `Agent tool "${p.id}" is hidden from the MCP surface: its wire name "${p.name}" collides with the tool "${p.existing}".`,
@@ -80,7 +85,7 @@ const diagnostics = defineDiagnostics({
 		},
 		DF0050: {
 			why: (p) => `No running devframe instance on port ${p.port}.`,
-			fix: "Call devframe_connect_list-instances for the current instance list — the instance may have stopped or changed port."
+			fix: "Call devframe_connect_list-instances for the current instance list; the instance may have stopped or changed port."
 		},
 		DF0051: {
 			why: (p) => `The devframe instance on port ${p.port} has no MCP endpoint.`,
@@ -92,7 +97,7 @@ const diagnostics = defineDiagnostics({
 		},
 		DF0054: {
 			why: (p) => `connectionMeta() was called before initDevframe("${p.id}") finished initializing.`,
-			fix: "Await `instance.ready` (or any request through `instance.handler`) before reading `connectionMeta()` — the WebSocket binding it describes is only known once initialization completes."
+			fix: "Await `instance.ready` (or any request through `instance.handler`) before reading `connectionMeta()`; the WebSocket binding it describes is only known once initialization completes."
 		},
 		DF0055: {
 			why: (p) => `This instance already owns its WebSocket transport (${p.tier}), so it cannot take over the host's upgrade events.`,
@@ -104,10 +109,10 @@ const diagnostics = defineDiagnostics({
 		},
 		DF0057: {
 			why: () => "This instance disables its WebSocket transport (`ws: false`), so there is no socket to drive upgrades into.",
-			fix: "Clients connect over the SSE endpoint instead — no upgrade wiring is needed. Remove `ws: false` if the instance should serve a WebSocket after all."
+			fix: "Clients connect over the SSE endpoint instead, so no upgrade wiring is needed. Remove `ws: false` if the instance should serve a WebSocket after all."
 		},
 		DF0058: {
-			why: (p) => `"${p.id}" declares \`capabilities.dev: false\` — it does not support a live dev server (its value is a static export only).`,
+			why: (p) => `"${p.id}" declares \`capabilities.dev: false\`, so it does not support a live dev server (its value is a static export only).`,
 			fix: "Pass `{ force: true }` to `createDevServer()` to run it anyway, or drop `capabilities.dev: false` on the definition."
 		},
 		DF0059: {
@@ -120,10 +125,10 @@ const diagnostics = defineDiagnostics({
 		},
 		DF0061: {
 			why: (p) => `The locally installed "${p.package}@${p.installed}" is a different major version than the required "${p.required}".`,
-			fix: "Align the installed assets package with the version its node package declares — they are published in lockstep."
+			fix: "Align the installed assets package with the version its node package declares; they are published in lockstep."
 		},
 		DF0062: {
-			why: (p) => `The locally installed "${p.package}@${p.installed}" differs from the required "${p.required}" — serving the installed one.`,
+			why: (p) => `The locally installed "${p.package}@${p.installed}" differs from the required "${p.required}"; serving the installed one.`,
 			fix: "Install the exact declared version to serve byte-identical assets."
 		},
 		DF0063: {
@@ -136,10 +141,10 @@ const diagnostics = defineDiagnostics({
 		},
 		DF0065: {
 			why: (p) => `Invalid remote-assets ${p.field} "${p.value}".`,
-			fix: "A remote-assets `package` must be a valid npm package name and `version` an exact semver version (e.g. `1.2.3`) — they are interpolated into CDN URLs and the cache path."
+			fix: "A remote-assets `package` must be a valid npm package name and `version` an exact semver version (e.g. `1.2.3`); they are interpolated into CDN URLs and the cache path."
 		},
 		DF0066: {
-			why: (p) => `Service "${p.package}" is already installed — keeping the first installation and ignoring this one's options.`,
+			why: (p) => `Service "${p.package}" is already installed; keeping the first installation and ignoring this one's options.`,
 			fix: "Option sets only merge before `ctx.services.ready()` fires. Install the service (or declare it in `DevframeDefinition.services`) before the barrier so its options join the merge."
 		},
 		DF0067: {
@@ -151,16 +156,24 @@ const diagnostics = defineDiagnostics({
 			fix: "Align the installed service package with the range its declarer requires, or drop `required: true` to downgrade the mismatch to a warning."
 		},
 		DF0069: {
-			why: (p) => `The installed service "${p.package}@${p.installed}" does not satisfy the declared range "${p.required}" — installing it anyway.`,
+			why: (p) => `The installed service "${p.package}@${p.installed}" does not satisfy the declared range "${p.required}"; installing it anyway.`,
 			fix: "The advertised meta carries the real version, so clients can gate on it. Align the installed service package with the declared range to silence this warning."
 		},
 		DF0070: {
 			why: (p) => `Invalid service "${p.package}": ${p.reason}`,
-			fix: "A service package's default export must be a factory returning a `DevframeServiceDefinition` — an object with `package`, `version`, `scope`, and a `setup` function."
+			fix: "A service package's default export must be a factory returning a `DevframeServiceDefinition`, an object with `package`, `version`, `scope`, and a `setup` function."
 		},
 		DF0072: {
-			why: (p) => `\`rpc.snapshot\` names "${p.method}", but no RPC function is registered under that id — nothing to bake into the static build.`,
+			why: (p) => `\`rpc.snapshot\` names "${p.method}", but no RPC function is registered under that id, so nothing to bake into the static build.`,
 			fix: "Check the method id, and ensure the service/plugin that registers it is installed (e.g. declared in `services`) before the build collects the dump."
+		},
+		DF0075: {
+			why: (p) => `On ${p.runtime} the shared server's WebSocket upgrade needs crossws's Node adapter, which refuses to run off Node, and SSE is disabled, so this instance advertises no RPC transport at all.`,
+			fix: "Keep the SSE endpoint enabled (drop `sse: false`) so clients connect over it on Bun/Deno, or move the socket to a side-car (`ws: { sidecar: true }`) which binds the native WebSocket adapter on its own port."
+		},
+		DF0076: {
+			why: (p) => `\`attach\` / \`handleUpgrade\` drive a raw \`node:http\` upgrade into crossws's Node adapter, which refuses to run on ${p.runtime}.`,
+			fix: "On Bun/Deno, serve the advertised `__ws` route from `Bun.serve` / `Deno.serve` with `attachBunWsTransport` / `attachDenoWsTransport` (see the hub-deno example), or connect over the SSE endpoint instead."
 		}
 	}
 });

package/dist/{events-4daw0uK9.mjs → events-BV4Dj59a.mjs}

@@ -1,8 +1,8 @@
 //#region src/events.ts
 /**
-* Centralized registry of the core devframe event names — the node-side host
+* Centralized registry of the core devframe event names: the node-side host
 * bus events, the client RPC connection events, and the server→client
-* broadcast notifications — so these names live in one place instead of
+* broadcast notifications, so these names live in one place instead of
 * scattered string literals.
 *
 * **Keep this in sync with [`docs/content/8.references/3.events.md`](../../../docs/content/8.references/3.events.md)**

package/dist/{services-install-CqqQVls5.mjs → host-agent-CKqSTEX9.mjs}

@@ -1,8 +1,5 @@
-import { t as DEVFRAME_EVENTS } from "./events-4daw0uK9.mjs";
-import { t as diagnostics } from "./diagnostics-BXWW3VK-.mjs";
-import { createRequire } from "node:module";
-import { pathToFileURL } from "node:url";
-import { isAbsolute, join } from "pathe";
+import { t as DEVFRAME_EVENTS } from "./events-BV4Dj59a.mjs";
+import { t as diagnostics } from "./diagnostics-DZA6KQ_Z.mjs";
 //#region src/utils/events.ts
 /**
 * Create event emitter.
@@ -174,6 +171,12 @@ var DevframeAgentHost = class {
 			resources
 		};
 	}
+	hasSurface() {
+		if (this.tools.size > 0 || this.resources.size > 0) return true;
+		for (const [, def] of this.context.rpc.definitions) if (def.agent) return true;
+		for (const provider of this.providers) if (provider().length > 0) return true;
+		return false;
+	}
 	getTool(id) {
 		const plain = this.tools.get(id);
 		if (plain) return plain.tool;
@@ -219,6 +222,12 @@ var DevframeAgentHost = class {
 			description: input.description,
 			safety: input.safety ?? "action",
 			tags: input.tags,
+			/**
+			* Standard Schema `args` are carried raw (mirroring how an RPC-backed
+			* tool defers to `ctx.rpc.definitions`); consumers (the MCP adapter)
+			* convert to JSON Schema on demand. An explicit `inputSchema` override
+			* wins when given.
+			*/
 			args: input.args,
 			inputSchema: input.inputSchema,
 			outputSchema: input.outputSchema,
@@ -265,149 +274,4 @@ function inferSafety(type) {
 	return "action";
 }
 //#endregion
-//#region src/node/services-install.ts
-/**
-* Turn a `resolveFrom` value (a file path, a file URL like `import.meta.url`,
-* or a directory) into something `createRequire` accepts — a directory gets a
-* synthetic filename appended so resolution starts inside it.
-*/
-function toRequireBase(resolveFrom) {
-	if (resolveFrom.startsWith("file://")) return resolveFrom;
-	if ((resolveFrom.split(/[/\\]/).pop() ?? "").includes(".")) return resolveFrom;
-	return join(resolveFrom, "_devframe_resolve.js");
-}
-/**
-* Normalize an `install()` `resolveFrom` into a resolution base. Paths and
-* file URLs pass through (the common case: the declaring plugin's
-* `importMetaUrl`, so a service it declares resolves against the plugin's own
-* dependencies); a bare npm package name resolves to that package's location
-* from `cwd`. An unresolvable package name reads as no base (the caller's
-* workspace fallbacks apply).
-*/
-function expandResolveFrom(resolveFrom, cwd) {
-	if (resolveFrom.startsWith("file://") || resolveFrom.startsWith(".") || isAbsolute(resolveFrom)) return resolveFrom;
-	const require = createRequire(join(cwd, "_devframe_resolve.js"));
-	try {
-		return require.resolve(`${resolveFrom}/package.json`);
-	} catch {}
-	try {
-		return require.resolve(resolveFrom);
-	} catch {}
-}
-/**
-* Import a service package's module, trying each `resolveFrom` candidate in
-* order (so a plugin-declared service resolves against the plugin's own
-* dependency tree first, then the workspace fallback). Throws the last
-* resolution error when no candidate succeeds.
-*/
-async function importServicePackage(pkg, resolveFroms) {
-	const candidates = [...new Set(resolveFroms.filter((x) => typeof x === "string" && x.length > 0))];
-	let lastError = /* @__PURE__ */ new Error(`no resolution base available for "${pkg}"`);
-	for (const from of candidates) {
-		let resolved;
-		try {
-			resolved = createRequire(toRequireBase(from)).resolve(pkg);
-		} catch (error) {
-			lastError = error;
-			continue;
-		}
-		return await import(
-			/* webpackIgnore: true */
-			/* @vite-ignore */
-			/* turbopackIgnore: true */
-			pathToFileURL(resolved).href
-);
-	}
-	throw lastError;
-}
-function parseVersion(input) {
-	const [core, ...prerelease] = input.trim().replace(/^v/, "").split("-");
-	if (!core) return void 0;
-	const parts = core.split(".").map((part) => Number.parseInt(part, 10));
-	if (parts.length === 0 || parts.some((part) => Number.isNaN(part) || part < 0)) return void 0;
-	while (parts.length < 3) parts.push(0);
-	return {
-		parts,
-		...prerelease.length ? { prerelease: prerelease.join("-") } : {}
-	};
-}
-function compareVersions(a, b) {
-	for (let i = 0; i < 3; i++) {
-		const diff = (a.parts[i] ?? 0) - (b.parts[i] ?? 0);
-		if (diff !== 0) return diff;
-	}
-	if (a.prerelease && !b.prerelease) return -1;
-	if (!a.prerelease && b.prerelease) return 1;
-	if (a.prerelease && b.prerelease) return a.prerelease < b.prerelease ? -1 : a.prerelease > b.prerelease ? 1 : 0;
-	return 0;
-}
-function satisfiesComparator(version, comparator) {
-	const raw = comparator.trim();
-	if (!raw || raw === "*" || raw === "x") return true;
-	const operatorMatch = raw.match(/^([\^~]|>=|<=|[><=])?(.+)$/);
-	if (!operatorMatch) return false;
-	const operator = operatorMatch[1];
-	const rest = operatorMatch[2].trim();
-	const segments = rest.replace(/\.[x*]/gi, "").split(".").filter(Boolean);
-	const base = parseVersion(rest.replace(/[x*]/gi, "0"));
-	if (!base) return false;
-	switch (operator) {
-		case ">": return compareVersions(version, base) > 0;
-		case ">=": return compareVersions(version, base) >= 0;
-		case "<": return compareVersions(version, base) < 0;
-		case "<=": return compareVersions(version, base) <= 0;
-		case "^": {
-			if (compareVersions(version, base) < 0) return false;
-			const fixedIndex = base.parts.findIndex((part) => part !== 0);
-			const lockUpTo = fixedIndex === -1 ? base.parts.length - 1 : fixedIndex;
-			for (let i = 0; i <= lockUpTo; i++) if ((version.parts[i] ?? 0) !== (base.parts[i] ?? 0)) return false;
-			return true;
-		}
-		case "~": {
-			if (compareVersions(version, base) < 0) return false;
-			const lockUpTo = segments.length >= 2 ? 1 : 0;
-			for (let i = 0; i <= lockUpTo; i++) if ((version.parts[i] ?? 0) !== (base.parts[i] ?? 0)) return false;
-			return true;
-		}
-		default:
-			for (let i = 0; i < Math.max(segments.length, 3); i++) if (i < segments.length && (version.parts[i] ?? 0) !== (base.parts[i] ?? 0)) return false;
-			return segments.length >= 3 ? compareVersions(version, base) === 0 : true;
-	}
-}
-/**
-* Pragmatic semver range check for service version declarations — supports
-* the common forms (`1.2.3`, `^1.2.3`, `~1.2`, `>=1 <3`, `1.x`, `*`, and
-* `||`-joined alternatives) without pulling in a semver dependency. An
-* unparseable version or range reads as **not satisfied**.
-*/
-function satisfiesVersionRange(version, range) {
-	const parsed = parseVersion(version);
-	if (!parsed) return false;
-	const alternatives = range.split("||").map((alt) => alt.trim()).filter(Boolean);
-	if (alternatives.length === 0) return true;
-	return alternatives.some((alternative) => alternative.split(/\s+/).every((comparator) => satisfiesComparator(parsed, comparator)));
-}
-function isPlainObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/** Deep-merge two values with the service option-set rules (see below). */
-function deepMergeTwo(a, b) {
-	if (Array.isArray(a) && Array.isArray(b)) return [.../* @__PURE__ */ new Set([...a, ...b])];
-	if (isPlainObject(a) && isPlainObject(b)) {
-		const out = { ...a };
-		for (const key of Object.keys(b)) out[key] = key in a ? deepMergeTwo(a[key], b[key]) : b[key];
-		return out;
-	}
-	return b;
-}
-/**
-* Default option-set merge when a service declares no `mergeOptions`:
-* deep-merge in declaration order — objects recurse, arrays union-dedupe,
-* scalars take the later value. Covers the built-in services (`roots` /
-* `langs` union, `themes` per-key last-wins) without a custom hook.
-*/
-function deepMergeOptionSets(sets) {
-	return sets.reduce((merged, set) => deepMergeTwo(merged, set));
-}
-//#endregion
-export { DevframeAgentHost as a, satisfiesVersionRange as i, expandResolveFrom as n, coerceAgentPositionalArgs as o, importServicePackage as r, createEventEmitter as s, deepMergeOptionSets as t };
+export { coerceAgentPositionalArgs as n, createEventEmitter as r, DevframeAgentHost as t };

package/dist/{host-h3-fRbF9yor.mjs → host-h3-BROI6SQ4.mjs}

@@ -1,9 +1,9 @@
-import process from "node:process";
 import { join } from "pathe";
+import process from "node:process";
 import { homedir } from "node:os";
 //#region src/node/host-h3.ts
 /**
-* h3-backed {@link DevframeHost} — used by the standalone CLI adapter.
+* h3-backed {@link DevframeHost}, used by the standalone CLI adapter.
 */
 function createH3DevframeHost(options) {
 	const workspaceRoot = options.workspaceRoot ?? process.cwd();