devframe 0.9.9 → 0.9.11

package/dist/{_shared-CK3czkH4.d.mts → _shared-DEAMiPfH.d.mts}

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, G as McpAuthorization, I as DevframeDeploymentKind, K as McpRouteOptions, t as ConnectionMeta } from "./context-4AIVRLYF.mjs";
+import { F as DevframeDefinition, G as McpAuthorization, I as DevframeDeploymentKind, q as McpSetting, t as ConnectionMeta, zt as DevframeAgentHost } from "./context-BBWPLDHh.mjs";
 //#region src/adapters/_shared.d.ts
 /**
  * Resolve the mount base path for a devframe's SPA. Hosted adapters
@@ -38,20 +38,39 @@ interface ResolvedMcpConfig {
   authorization: McpAuthorization;
 }
 /**
- * Normalize the `mcp` option (`boolean | McpRouteOptions`) into a
- * fully-resolved config, or `undefined` when the MCP route is disabled.
+ * Normalize an *explicit* `mcp` setting into a fully-resolved config, or
+ * `undefined` when the MCP route is disabled. `'auto'` also resolves to
+ * `undefined` here: whether it mounts depends on the live agent surface,
+ * which only the mounting adapter can consult (through
+ * {@link loadAutoMcpAdapter}) - static resolvers like
+ * `resolveMcpConnectionMeta` treat it as unadvertisable.
  *
  * An enabled route trusts same-machine callers by default: the authorization
  * resolves to origin-only (`false`) unless the object config opts into a
  * bearer/callback identity check. An empty-string bearer is treated as no
  * bearer (origin-only) rather than a usable credential.
  */
-declare function resolveMcpConfig(mcp: boolean | McpRouteOptions | undefined): ResolvedMcpConfig | undefined;
+declare function resolveMcpConfig(mcp: McpSetting | undefined): ResolvedMcpConfig | undefined;
+/**
+ * Resolve the `mcp: 'auto'` default at mount time: import the MCP adapter
+ * when the devframe's agent surface is non-empty, or return `undefined`
+ * (mount nothing) when the surface is empty - the zero-cost path, loading
+ * no MCP code at all. The adapter (and the MCP SDK behind it) loads through
+ * `importRuntimeModule`, so it never enters a consumer's bundle graph.
+ *
+ * Generic like `importRuntimeModule`: the caller names the module type
+ * (`typeof import('devframe/adapters/mcp')`) so this shared helper carries
+ * no type-level dependency on the MCP adapter.
+ */
+declare function loadAutoMcpAdapter<T>(agent: Pick<DevframeAgentHost, 'hasSurface'>): Promise<T | undefined>;
 /**
  * Resolve the `mcp` entry a `__connection.json` should advertise for a dev
  * server started with the given `mcp` option (falling back to `def.cli?.mcp`,
  * exactly like `createDevServer`), or `undefined` when the route is
- * disabled.
+ * disabled. `'auto'` (the omitted default) resolves at mount time against
+ * the live agent surface, so hand-rolled meta advertises it only for an
+ * explicit setting; the adapters advertise the actually-mounted route
+ * themselves.
  *
  * Hosted bridges that hand-roll their connection meta pass the side-car
  * `port`: the advertised path becomes absolute (the side-car mounts at `/`)
@@ -59,6 +78,6 @@ declare function resolveMcpConfig(mcp: boolean | McpRouteOptions | undefined): R
  * stays relative, resolved against `__connection.json`'s own location (the
  * same-server default).
  */
-declare function resolveMcpConnectionMeta(def: DevframeDefinition, mcp: boolean | McpRouteOptions | undefined, port?: number): ConnectionMeta['mcp'];
+declare function resolveMcpConnectionMeta(def: DevframeDefinition, mcp: McpSetting | undefined, port?: number): ConnectionMeta['mcp'];
 //#endregion
-export { resolveDevServerPort as a, resolveBasePath as i, ResolvedMcpConfig as n, resolveMcpConfig as o, normalizeBasePath as r, resolveMcpConnectionMeta as s, ResolveDevServerPortOptions as t };
+export { resolveBasePath as a, resolveMcpConnectionMeta as c, normalizeBasePath as i, ResolvedMcpConfig as n, resolveDevServerPort as o, loadAutoMcpAdapter as r, resolveMcpConfig as s, ResolveDevServerPortOptions as t };

package/dist/{_shared-C08SdQRl.mjs → _shared-U8D-xzrp.mjs}

@@ -1,6 +1,20 @@
 import "./constants.mjs";
+import { r as importServicePackage } from "./services-install-Ben4yh52.mjs";
 import { n as getPort } from "./dist-CZXfGEkd.mjs";
 import { cleanDoubleSlashes, withLeadingSlash, withTrailingSlash, withoutLeadingSlash } from "ufo";
+//#region src/node/import-runtime-module.ts
+/**
+* Resolve and import a package at runtime without adding it to a consumer's
+* bundle graph. First-party adapters use this for modules whose code is
+* needed only when the matching feature is enabled (optional peers, and the
+* MCP adapter with the SDK behind it).
+*
+* @internal
+*/
+async function importRuntimeModule(specifier) {
+	return await importServicePackage(specifier, [import.meta.url]);
+}
+//#endregion
 //#region src/adapters/_shared.ts
 const DEFAULT_PORT = 9999;
 /**
@@ -36,8 +50,12 @@ async function resolveDevServerPort(def, options = {}) {
 	return getPort(portOptions);
 }
 /**
-* Normalize the `mcp` option (`boolean | McpRouteOptions`) into a
-* fully-resolved config, or `undefined` when the MCP route is disabled.
+* Normalize an *explicit* `mcp` setting into a fully-resolved config, or
+* `undefined` when the MCP route is disabled. `'auto'` also resolves to
+* `undefined` here: whether it mounts depends on the live agent surface,
+* which only the mounting adapter can consult (through
+* {@link loadAutoMcpAdapter}) - static resolvers like
+* `resolveMcpConnectionMeta` treat it as unadvertisable.
 *
 * An enabled route trusts same-machine callers by default: the authorization
 * resolves to origin-only (`false`) unless the object config opts into a
@@ -45,7 +63,7 @@ async function resolveDevServerPort(def, options = {}) {
 * bearer (origin-only) rather than a usable credential.
 */
 function resolveMcpConfig(mcp) {
-	if (!mcp) return void 0;
+	if (!mcp || mcp === "auto") return void 0;
 	if (mcp === true) return { authorization: false };
 	const authorization = typeof mcp.authorization === "string" && mcp.authorization.length === 0 ? false : mcp.authorization ?? false;
 	return {
@@ -55,10 +73,28 @@ function resolveMcpConfig(mcp) {
 	};
 }
 /**
+* Resolve the `mcp: 'auto'` default at mount time: import the MCP adapter
+* when the devframe's agent surface is non-empty, or return `undefined`
+* (mount nothing) when the surface is empty - the zero-cost path, loading
+* no MCP code at all. The adapter (and the MCP SDK behind it) loads through
+* `importRuntimeModule`, so it never enters a consumer's bundle graph.
+*
+* Generic like `importRuntimeModule`: the caller names the module type
+* (`typeof import('devframe/adapters/mcp')`) so this shared helper carries
+* no type-level dependency on the MCP adapter.
+*/
+async function loadAutoMcpAdapter(agent) {
+	if (!agent.hasSurface()) return void 0;
+	return await importRuntimeModule("devframe/adapters/mcp");
+}
+/**
 * Resolve the `mcp` entry a `__connection.json` should advertise for a dev
 * server started with the given `mcp` option (falling back to `def.cli?.mcp`,
 * exactly like `createDevServer`), or `undefined` when the route is
-* disabled.
+* disabled. `'auto'` (the omitted default) resolves at mount time against
+* the live agent surface, so hand-rolled meta advertises it only for an
+* explicit setting; the adapters advertise the actually-mounted route
+* themselves.
 *
 * Hosted bridges that hand-roll their connection meta pass the side-car
 * `port`: the advertised path becomes absolute (the side-car mounts at `/`)
@@ -76,4 +112,4 @@ function resolveMcpConnectionMeta(def, mcp, port) {
 	} : { path: route };
 }
 //#endregion
-export { resolveMcpConnectionMeta as a, resolveMcpConfig as i, resolveBasePath as n, resolveDevServerPort as r, normalizeBasePath as t };
+export { resolveMcpConfig as a, resolveDevServerPort as i, normalizeBasePath as n, resolveMcpConnectionMeta as o, resolveBasePath as r, importRuntimeModule as s, loadAutoMcpAdapter as t };

package/dist/adapters/build.d.mts

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, V as DevframeSnapshotRpcEntry, o as DevframeNodeContext } from "../context-4AIVRLYF.mjs";
+import { F as DevframeDefinition, V as DevframeSnapshotRpcEntry, o as DevframeNodeContext } from "../context-BBWPLDHh.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
 //#region src/adapters/build.d.ts
 interface CreateBuildOptions {

package/dist/adapters/build.mjs

@@ -1,17 +1,15 @@
 import { s as colors } from "../nostics-D0PvLZsn.mjs";
-import { n as strictJsonStringify } from "../serialization-DTZnPQ1-.mjs";
 import { t as resolveClientAssets } from "../client-assets-DNdhagGm.mjs";
-import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME } from "../constants.mjs";
-import { t as collectStaticRpcDump } from "../static-DZ8P2Kn7.mjs";
-import { n as structuredCloneStringify } from "../structured-clone-CbAV5rFI.mjs";
-import { t as diagnostics } from "../diagnostics-BMfN8mb1.mjs";
-import { t as createHostContext } from "../context-CwPUinjn.mjs";
-import { t as resolveStaticAssetsSource } from "../remote-assets-BIFWOlBW.mjs";
-import { t as createH3DevframeHost } from "../host-h3-BJ4siyz7.mjs";
+import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME } from "../constants.mjs";
+import { n as collectStaticRpcDump, t as writeStaticRpcDump } from "../write-BuLCrn9h.mjs";
+import { t as diagnostics } from "../diagnostics-DZA6KQ_Z.mjs";
+import { t as createHostContext } from "../context-Bq27SDK-.mjs";
+import { t as resolveStaticAssetsSource } from "../remote-assets-DMFzLSoH.mjs";
+import { t as createH3DevframeHost } from "../host-h3-BROI6SQ4.mjs";
+import fs from "node:fs/promises";
+import { resolve } from "pathe";
 import process from "node:process";
-import { dirname, resolve } from "pathe";
 import { existsSync } from "node:fs";
-import fs$1 from "node:fs/promises";
 //#region src/adapters/build.ts
 /**
 * Produce a self-contained static deploy of a devframe:
@@ -29,8 +27,8 @@ async function createBuild(d, options = {}) {
 	const outDir = resolve(options.outDir ?? "dist-static");
 	const distSource = options.distDir ?? resolveClientAssets(d);
 	if (!distSource) throw new Error(`[devframe] createBuild: no client assets for "${d.id}". Set \`clientAssets\` on the definition or pass it as an option.`);
-	if (existsSync(outDir)) await fs$1.rm(outDir, { recursive: true });
-	await fs$1.mkdir(outDir, { recursive: true });
+	if (existsSync(outDir)) await fs.rm(outDir, { recursive: true });
+	await fs.mkdir(outDir, { recursive: true });
 	const host = createH3DevframeHost({
 		origin: "http://localhost",
 		appName: d.id
@@ -46,19 +44,17 @@ async function createBuild(d, options = {}) {
 	await ctx.services.ready();
 	await d.setup(ctx);
 	applySnapshotRpc(ctx, d.rpc?.snapshot);
-	await fs$1.mkdir(resolve(outDir, DEVFRAME_RPC_DUMP_DIRNAME), { recursive: true });
 	await writeConnectionMeta(ctx, outDir);
 	console.log(colors.cyan`[devframe] writing RPC dump to ${resolve(outDir, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME)}`);
 	const dump = await collectStaticRpcDump(ctx.rpc.definitions.values(), ctx);
-	await writeDumpFiles(dump, outDir, options.pretty ? 2 : void 0);
-	await fs$1.writeFile(resolve(outDir, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME), JSON.stringify(dump.manifest, null, 2), "utf-8");
+	await writeStaticRpcDump(dump, outDir, { pretty: options.pretty });
 	console.log(colors.green`[devframe] built "${d.id}" -> ${outDir}`);
 }
 /** Copy a local SPA dist, or materialize a remote assets source, into `outDir`. */
 async function materializeSpa(resolved, outDir) {
 	if (typeof resolved === "string") {
 		console.log(colors.cyan`[devframe] copying SPA from ${resolved} -> ${outDir}`);
-		await fs$1.cp(resolved, outDir, { recursive: true });
+		await fs.cp(resolved, outDir, { recursive: true });
 		return;
 	}
 	console.log(colors.cyan`[devframe] materializing SPA from ${resolved.assets.package}@${resolved.assets.version} -> ${outDir}`);
@@ -68,20 +64,11 @@ async function materializeSpa(resolved, outDir) {
 async function writeConnectionMeta(ctx, outDir) {
 	const jsonSerializableMethods = [];
 	for (const def of ctx.rpc.definitions.values()) if (def.jsonSerializable === true) jsonSerializableMethods.push(def.name);
-	await fs$1.writeFile(resolve(outDir, DEVFRAME_CONNECTION_META_FILENAME), JSON.stringify({
+	await fs.writeFile(resolve(outDir, DEVFRAME_CONNECTION_META_FILENAME), JSON.stringify({
 		backend: "static",
 		jsonSerializableMethods
 	}, null, 2), "utf-8");
 }
-/** Encode and write each sharded RPC dump file under `outDir`. */
-async function writeDumpFiles(dump, outDir, indent) {
-	for (const [filepath, file] of Object.entries(dump.files)) {
-		const fullpath = resolve(outDir, filepath);
-		await fs$1.mkdir(dirname(fullpath), { recursive: true });
-		const text = file.serialization === "structured-clone" ? structuredCloneStringify(file.data) : strictJsonStringify(file.data, file.fnName);
-		await fs$1.writeFile(fullpath, file.serialization === "json" && indent != null ? JSON.stringify(JSON.parse(text), null, indent) : text, "utf-8");
-	}
-}
 /**
 * Attach a `dump` to each {@link DevframeRpcOptions.snapshot} target so the
 * static collector bakes it, even though the (service-owned) definition

package/dist/adapters/cac.d.mts

@@ -1,4 +1,4 @@
-import { Dt as defineCliFlags, Et as InferCliFlags, F as DevframeDefinition, K as McpRouteOptions, Ot as parseCliFlags, Tt as CliFlagsSchema } from "../context-4AIVRLYF.mjs";
+import { Dt as InferCliFlags, Et as CliFlagsSchema, F as DevframeDefinition, Ot as defineCliFlags, kt as parseCliFlags, q as McpSetting } from "../context-BBWPLDHh.mjs";
 import { CAC } from "cac";
 import { H3 } from "h3";
 //#region src/adapters/cac.d.ts
@@ -9,17 +9,13 @@ interface CreateCacOptions {
    * Expose a route-based MCP server alongside the dev server, speaking the
    * MCP Streamable-HTTP transport at `<base>__mcp`. Whether to expose MCP is
    * a hosting decision made at the CLI assembly stage, so it lives here rather
-   * than on the definition.
+   * than on the definition. When unset, falls back to the definition's
+   * deprecated `cli.mcp`, then to the `'auto'` default (mount once the agent
+   * surface is non-empty). See {@link McpSetting}.
    *
-   * - `false` / omitted (default): no MCP route is mounted.
-   * - `true`: mount at the default `__mcp` route with the loopback origin gate.
-   * - {@link McpRouteOptions}: customise the route path, origin allow-list, and
-   *   opt into an identity check.
-   *
-   * The `--mcp` / `--no-mcp` flags override this per run. Falls back to the
-   * definition's deprecated `cli.mcp` when unset.
+   * The `--mcp` / `--no-mcp` flags override this per run.
    */
-  mcp?: boolean | McpRouteOptions;
+  mcp?: McpSetting;
   /**
    * Final CAC hook invoked after devframe's built-in subcommands and
    * after the definition's `cli.configure`. Use this to add app-level

package/dist/adapters/cac.mjs

@@ -1,8 +1,7 @@
 import { s as colors } from "../nostics-D0PvLZsn.mjs";
-import { r as resolveDevServerPort } from "../_shared-C08SdQRl.mjs";
-import { a as importRuntimeModule } from "../instance-shell-cdVETpfz.mjs";
+import { i as resolveDevServerPort, s as importRuntimeModule } from "../_shared-U8D-xzrp.mjs";
 import { createBuild } from "./build.mjs";
-import { t as createDevServer } from "../dev-Eqq5PX0k.mjs";
+import { t as createDevServer } from "../dev-B32EVw5w.mjs";
 import process from "node:process";
 import cac$1 from "cac";
 //#region src/adapters/flags.ts
@@ -96,7 +95,7 @@ function createCac(d, options = {}) {
 	const defaultHost = d.cli?.host ?? "localhost";
 	const command = d.cli?.command ?? d.id;
 	const cli = cac$1(command);
-	const devCommand = cli.command("[...args]", "Start a local dev server").option("--port <port>", "Port to listen on").option("--host <host>", "Host to bind to", { default: defaultHost }).option("--open", "Open the browser on start").option("--no-open", "Do not open the browser").option("--no-auth", "Disable the interactive authentication gate").option("--mcp", "Expose an MCP server over HTTP at /__mcp (use --no-mcp to disable)");
+	const devCommand = cli.command("[...args]", "Start a local dev server").option("--port <port>", "Port to listen on").option("--host <host>", "Host to bind to", { default: defaultHost }).option("--open", "Open the browser on start").option("--no-open", "Do not open the browser").option("--no-auth", "Disable the interactive authentication gate").option("--mcp", "Force the MCP route on (use --no-mcp to disable; default mounts it once agent tools exist)");
 	if (d.cli?.flags) for (const [key, schema] of Object.entries(d.cli.flags)) {
 		const optionName = flagKeyToOption(key);
 		const description = schema.description ?? "";

package/dist/adapters/dev.d.mts

@@ -1,8 +1,8 @@
 import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection, n as WsOriginRegistry } from "../ws-server-D2nv68Hg.mjs";
-import { F as DevframeDefinition, K as McpRouteOptions, U as DevframeSseOptions, W as DevframeWsOptions, s as DevframeNodeRpcSession, wt as DevframeAuthHandler } from "../context-4AIVRLYF.mjs";
+import { F as DevframeDefinition, Tt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, q as McpSetting, s as DevframeNodeRpcSession } from "../context-BBWPLDHh.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
-import { c as StartedServer } from "../instance-shell-7Z52PE4_.mjs";
-import { a as resolveDevServerPort, s as resolveMcpConnectionMeta, t as ResolveDevServerPortOptions } from "../_shared-CK3czkH4.mjs";
+import { c as StartedServer } from "../instance-shell-BWh0JQuo.mjs";
+import { c as resolveMcpConnectionMeta, o as resolveDevServerPort, t as ResolveDevServerPortOptions } from "../_shared-DEAMiPfH.mjs";
 import { H3 } from "h3";
 //#region src/adapters/dev.d.ts
 interface CreateDevServerOptions {
@@ -81,11 +81,11 @@ interface CreateDevServerOptions {
   auth?: boolean | DevframeAuthHandler;
   /**
    * Expose a route-based MCP server on the dev server (Streamable-HTTP).
-   * Overrides `def.cli?.mcp`; `undefined` falls through to it. `false`
-   * disables the route regardless of the definition default. See
-   * {@link McpRouteOptions}.
+   * Overrides `def.cli?.mcp`; `undefined` falls through to it, then to the
+   * `'auto'` default (mount once the agent surface is non-empty). `false`
+   * disables the route regardless. See {@link McpSetting}.
    */
-  mcp?: boolean | McpRouteOptions;
+  mcp?: McpSetting;
   /**
    * Called once per new RPC connection, right after its session is created.
    * Forwarded verbatim to the underlying transport binding.

package/dist/adapters/dev.mjs

@@ -1,3 +1,3 @@
-import { a as resolveMcpConnectionMeta, r as resolveDevServerPort } from "../_shared-C08SdQRl.mjs";
-import { t as createDevServer } from "../dev-Eqq5PX0k.mjs";
+import { i as resolveDevServerPort, o as resolveMcpConnectionMeta } from "../_shared-U8D-xzrp.mjs";
+import { t as createDevServer } from "../dev-B32EVw5w.mjs";
 export { createDevServer, resolveDevServerPort, resolveMcpConnectionMeta };

package/dist/adapters/embedded.d.mts

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, o as DevframeNodeContext } from "../context-4AIVRLYF.mjs";
+import { F as DevframeDefinition, o as DevframeNodeContext } from "../context-BBWPLDHh.mjs";
 //#region src/adapters/embedded.d.ts
 interface CreateEmbeddedOptions {
   /** Target context the devframe is registered into. Required. */

package/dist/adapters/initiate.d.mts

@@ -1,7 +1,7 @@
 import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection, n as WsOriginRegistry } from "../ws-server-D2nv68Hg.mjs";
-import { F as DevframeDefinition, K as McpRouteOptions, U as DevframeSseOptions, W as DevframeWsOptions, o as DevframeNodeContext, s as DevframeNodeRpcSession, t as ConnectionMeta, wt as DevframeAuthHandler, xt as DevframeStorageScope } from "../context-4AIVRLYF.mjs";
+import { F as DevframeDefinition, St as DevframeStorageScope, Tt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, o as DevframeNodeContext, q as McpSetting, s as DevframeNodeRpcSession, t as ConnectionMeta } from "../context-BBWPLDHh.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
-import { c as StartedServer, f as DevframeInstanceRecord } from "../instance-shell-7Z52PE4_.mjs";
+import { c as StartedServer, f as DevframeInstanceRecord } from "../instance-shell-BWh0JQuo.mjs";
 import { Buffer } from "node:buffer";
 import { IncomingMessage, Server, ServerResponse } from "node:http";
 import { Duplex } from "node:stream";
@@ -73,9 +73,10 @@ interface InitDevframeOptions {
   /**
    * Expose a route-based MCP server (Streamable-HTTP) at `<base>__mcp` and
    * advertise it in `__connection.json`. Overrides `def.cli?.mcp`;
-   * `undefined` falls through to it. See {@link McpRouteOptions}.
+   * `undefined` falls through to it, then to the `'auto'` default (mount
+   * once the agent surface is non-empty). See {@link McpSetting}.
    */
-  mcp?: boolean | McpRouteOptions;
+  mcp?: McpSetting;
   /**
    * Public origin the host app is reachable at (e.g. `http://localhost:3000`),
    * or a getter for hosts that resolve it late. Backs the auth banner's magic

package/dist/adapters/initiate.mjs

@@ -1,2 +1,2 @@
-import { n as getInstanceInternals, r as initDevframe } from "../dev-Eqq5PX0k.mjs";
+import { n as getInstanceInternals, r as initDevframe } from "../dev-B32EVw5w.mjs";
 export { getInstanceInternals, initDevframe };

package/dist/adapters/mcp.d.mts

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, G as McpAuthorization, o as DevframeNodeContext } from "../context-4AIVRLYF.mjs";
+import { F as DevframeDefinition, G as McpAuthorization, o as DevframeNodeContext } from "../context-BBWPLDHh.mjs";
 import { H3 } from "h3";
 import "@modelcontextprotocol/server";
 //#region src/adapters/mcp/build-server.d.ts

package/dist/adapters/mcp.mjs

@@ -2,11 +2,11 @@ import { t as Diagnostic } from "../nostics-D0PvLZsn.mjs";
 import { t as DEVFRAME_EVENTS } from "../events-BV4Dj59a.mjs";
 import { t as isAllowedOrigin } from "../origin-DZit9g29.mjs";
 import { r as timingSafeEqual } from "../crypto-token-TVbGGFuj.mjs";
-import { t as diagnostics } from "../diagnostics-BMfN8mb1.mjs";
-import { t as createHostContext } from "../context-CwPUinjn.mjs";
+import { t as diagnostics } from "../diagnostics-DZA6KQ_Z.mjs";
+import { t as createHostContext } from "../context-Bq27SDK-.mjs";
 import { t as toAgentToolName } from "../agent-tool-name-DGzeuWcO.mjs";
-import process from "node:process";
 import { join } from "pathe";
+import process from "node:process";
 import { homedir } from "node:os";
 import { defineHandler } from "h3";
 import { Server, createMcpHandler } from "@modelcontextprotocol/server";

package/dist/cli/main.mjs

@@ -1,6 +1,6 @@
 import { t as Diagnostic } from "../nostics-D0PvLZsn.mjs";
-import { t as diagnostics } from "../diagnostics-BMfN8mb1.mjs";
-import { n as listLiveDevframeInstances, r as probeDevframeOrigin } from "../instance-registry-C7-41RSp.mjs";
+import { t as diagnostics } from "../diagnostics-DZA6KQ_Z.mjs";
+import { n as listLiveDevframeInstances, r as probeDevframeOrigin } from "../instance-registry-DCq762YJ.mjs";
 import { t as toAgentToolName } from "../agent-tool-name-DGzeuWcO.mjs";
 import process from "node:process";
 import { joinURL } from "ufo";

package/dist/client/index.d.mts

@@ -1,6 +1,6 @@
 import { f as RpcCacheManager, p as RpcCacheOptions } from "../index-pIVt92jP.mjs";
 import { _ as RpcFunctionDefinition, w as RpcFunctionsCollector } from "../types-Dq4i156u.mjs";
-import { $ as DevframeServiceScopeOf, Bt as EventEmitter, Z as DevframeServiceMeta, _t as DevframeRpcClientFunctions, b as StreamSink, d as RpcSharedStateHost, ft as ScopedRpcFn, ht as SettingsForNamespace, k as SharedState, mt as ScopedSharedStates, pt as ScopedServerFunctions, rt as DevframeServicesState, st as DevframeSettings, t as ConnectionMeta, u as RpcSharedStateGetOptions, vt as DevframeRpcServerFunctions, y as StreamReader } from "../context-4AIVRLYF.mjs";
+import { Q as DevframeServiceMeta, Vt as EventEmitter, b as StreamSink, ct as DevframeSettings, d as RpcSharedStateHost, et as DevframeServiceScopeOf, gt as SettingsForNamespace, ht as ScopedSharedStates, it as DevframeServicesState, k as SharedState, mt as ScopedServerFunctions, pt as ScopedRpcFn, t as ConnectionMeta, u as RpcSharedStateGetOptions, vt as DevframeRpcClientFunctions, y as StreamReader, yt as DevframeRpcServerFunctions } from "../context-BBWPLDHh.mjs";
 import { t as SseRpcChannelOptions } from "../sse-client-BQ4jS3eO.mjs";
 import { t as WsRpcChannelOptions } from "../ws-client-Xpxt0oPA.mjs";
 import { BirpcOptions, BirpcReturn } from "birpc";

package/dist/client/index.mjs

@@ -533,9 +533,15 @@ async function setupDevframeConnection(options = {}) {
 			const response = await fetch(metaPath);
 			if (!response.ok) throw new Error(`Failed to fetch connection meta from ${metaUrl}: ${response.status}`);
 			const connectionMeta = await response.json();
+			const loadedFrom = response.url || metaUrl;
 			const connection = {
 				connectionMeta,
-				metaBaseUrl: response.url || metaUrl,
+				/**
+				* A served `baseUrl` re-points relative resolution (RPC dump shards,
+				* transport paths) at the meta that owns them: a static hub build's
+				* per-frame meta directs each frame SPA at the hub's own dump.
+				*/
+				metaBaseUrl: connectionMeta.baseUrl ? new URL(connectionMeta.baseUrl, loadedFrom).href : loadedFrom,
 				authToken: readStoredAuthToken(options.authToken ?? connectionMeta.authToken)
 			};
 			storeConnection(connection);

package/dist/{context-4AIVRLYF.d.mts → context-BBWPLDHh.d.mts}

@@ -261,6 +261,13 @@ interface DevframeAgentHost {
    * tools/resources registered on the host.
    */
   list: () => AgentManifest;
+  /**
+   * Whether the devframe exposes anything to agents: an `agent`-flagged RPC
+   * function, a registered tool or resource, or a provider currently
+   * yielding at least one tool. The `mcp: 'auto'` default consults this to
+   * decide whether a route is worth mounting.
+   */
+  hasSurface: () => boolean;
   /**
    * Invoke any tool by id. Routes to the underlying RPC handler for
    * `kind === 'rpc'`, or to the registered handler for `kind === 'tool'`.
@@ -677,11 +684,17 @@ interface DevframeRpcSharedStates {
 //#region src/types/views.d.ts
 interface DevframeViewHost {
   /**
+   * Static mounts registered through {@link DevframeViewHost.hostStatic}, each
+   * carrying the `resolveFrom` base it was mounted with so a build step that
+   * copies these itself (rather than serving them live) re-resolves a remote
+   * source to the same locally-installed copy it would serve live.
+   *
    * @internal
    */
   buildStaticDirs: {
     baseUrl: string;
     source: StaticAssetsSource;
+    resolveFrom?: string | null;
   }[];
   /**
    * Helper to host static files
@@ -1169,9 +1182,27 @@ interface DevframeSseOptions {
  * - `false`, the default: **origin-only**, trusting same-machine callers.
  */
 type McpAuthorization = string | ((request: Request) => boolean | Promise<boolean>) | false;
+/**
+ * The route-based MCP setting accepted everywhere a host mounts a devframe
+ * (`cli.mcp`, `initDevframe` / `initHub` / `createDevServer` options, the
+ * framework kits):
+ *
+ * - `'auto'`, the default: mount the route when the devframe exposes an
+ *   agent surface (an `agent`-flagged RPC function, or a tool / resource /
+ *   provider registered on `ctx.agent`). An empty agent surface mounts
+ *   nothing and loads no MCP code.
+ * - `true`: always mount at the default `__mcp` route.
+ * - `false`: never mount.
+ * - {@link McpRouteOptions}: always mount, with a custom route path, origin
+ *   allow-list, or {@link McpAuthorization} identity check.
+ *
+ * A mounted route trusts same-machine callers by default (the loopback
+ * origin gate), exactly like `mcp: true`.
+ */
+type McpSetting = boolean | 'auto' | McpRouteOptions;
 /**
  * Configuration for the route-based MCP server mounted alongside the dev
- * server (opt-in via {@link DevframeCliOptions.mcp}). The endpoint speaks
+ * server (via {@link DevframeCliOptions.mcp}). The endpoint speaks
  * the MCP Streamable-HTTP transport over the same origin as the SPA,
  * exposing the definition's `ctx.agent` tools + shared-state resources to
  * external MCP clients connected to the *running* server.
@@ -1253,11 +1284,11 @@ interface DevframeCliOptions {
    * base path). It surfaces the same `ctx.agent` tools + shared-state
    * resources as the stdio `mcp` command, but against the live server.
    *
-   * - `false` / omitted (default): no MCP route is mounted.
-   * - `true`: mount at the default `__mcp` route with the loopback origin
-   *   gate (trusting same-machine callers).
-   * - {@link McpRouteOptions}: customise the route path, origin allow-list,
-   *   and opt into an {@link McpAuthorization} identity check.
+   * Defaults to `'auto'`: the route mounts once the devframe exposes an
+   * agent surface (an `agent`-flagged RPC, a registered tool / resource).
+   * See {@link McpSetting} for the full contract, and
+   * {@link McpRouteOptions} for the route path, origin allow-list, and
+   * {@link McpAuthorization} identity check.
    *
    * The `--mcp` / `--no-mcp` CLI flags override this per run. Whether to expose
    * MCP is a hosting decision, so programmatic hosts pass it to
@@ -1268,7 +1299,7 @@ interface DevframeCliOptions {
    * This field is still read as a fallback, and will be removed in a future
    * release.
    */
-  mcp?: boolean | McpRouteOptions;
+  mcp?: McpSetting;
   /**
    * Author's SPA dist, served as the devframe's UI.
    *
@@ -1461,10 +1492,11 @@ interface DevframeDefinition {
    * act on a `false` before doing any work:
    *
    * - `build: false`: `createCac` skips registering the `build` subcommand,
-   *   and `createBuild` refuses (throws `DF0042`) unless `{ force: true }`.
-   *   Useful for a devframe whose value is inherently live (e.g. it manages
-   *   real files on disk), so a static export would only ever produce a
-   *   broken, write-less shell of the tool.
+   *   `createBuild` refuses (throws `DF0042`) unless `{ force: true }`, and
+   *   a hub static build (`buildHub`) silently skips the devframe - no dock,
+   *   no SPA copy, no RPCs in the dump. Useful for a devframe whose value is
+   *   inherently live (e.g. it manages real files on disk), so a static
+   *   export would only ever produce a broken, write-less shell of the tool.
    * - `dev: false`: `createDevServer` refuses (throws `DF0058`) unless
    *   `{ force: true }`. Useful for a devframe that only makes sense as a
    *   static export (e.g. a report generator with nothing to serve live).
@@ -2060,12 +2092,19 @@ interface ConnectionMeta {
    */
   jsonSerializableMethods?: string[];
   /**
-   * Absolute URL of the `__connection.json` this meta was loaded from.
-   * Annotated by the client (not served) when it publishes the meta on a
-   * shared window for same-origin inheritance: a relative `websocket.path`
-   * resolves against this, so a child SPA mounted at another base (e.g. a hub
-   * mounting several devframes at `/__foo/`, `/__bar/`, …) inherits a dialable
-   * endpoint rather than resolving the path against its own mount.
+   * URL of the `__connection.json` that owns this meta's relative paths.
+   * Two producers write it:
+   *
+   *   - The client annotates it (absolute) when it publishes the meta on a
+   *     shared window for same-origin inheritance: a relative
+   *     `websocket.path` resolves against this, so a child SPA mounted at
+   *     another base (e.g. a hub mounting several devframes at `/__foo/`,
+   *     `/__bar/`, …) inherits a dialable endpoint rather than resolving the
+   *     path against its own mount.
+   *   - A static hub build serves it (base-absolute, e.g.
+   *     `/__devframes/__connection.json`) in each **per-frame** meta, so a
+   *     frame SPA that fetched its own copy still resolves the shared RPC
+   *     dump from the hub base. Resolved against the fetched URL.
    */
   baseUrl?: string;
   /**
@@ -2125,4 +2164,4 @@ interface ConnectionMeta {
  */
 interface DevframeConnectionConfigsRegistry {}
 //#endregion
-export { DevframeServiceScopeOf as $, SharedStateEvents as A, AgentManifest as At, DevframeSetupInfo as B, EventEmitter as Bt, createStreamSink as C, DevframeDiagnosticsLogger as Ct, ImmutableObject as D, defineCliFlags as Dt, ImmutableMap as E, InferCliFlags as Et, DevframeDefinition as F, AgentToolInput as Ft, McpAuthorization as G, DevframeSnapshotRpcInputs as H, EventsMap as Ht, DevframeDeploymentKind as I, AgentToolProvider as It, DevframeServiceDescriptor as J, McpRouteOptions as K, DevframeDockDefaults as L, AgentToolProviderHandle as Lt, SharedStatePatch as M, AgentResourceContent as Mt, createSharedState as N, AgentResourceInput as Nt, ImmutableSet as O, parseCliFlags as Ot, DevframeCliOptions as P, AgentTool as Pt, DevframeServiceOf as Q, DevframeDuplicationStrategy as R, DevframeAgentHost as Rt, createStreamReader as S, DevframeDiagnosticsHost as St, ImmutableArray as T, CliFlagsSchema as Tt, DevframeSseOptions as U, DevframeSnapshotRpcEntry as V, EventUnsubscribe as Vt, DevframeWsOptions as W, DevframeServiceInput as X, DevframeServiceId as Y, DevframeServiceMeta as Z, CreateStreamSinkOptions as _, DevframeRpcClientFunctions as _t, DevframeConnectionConfigsRegistry as a, DevframeScopedNodeRpc as at, StreamSink as b, DevframeHost as bt, RpcBroadcastOptions as c, DevframeSettingsRegistry as ct, RpcSharedStateHost as d, ScopedClientFunctions as dt, DevframeServicesHost as et, RpcStreamingChannel as f, ScopedRpcFn as ft, CreateStreamReaderOptions as g, DevframeViewHost as gt, BufferedChunk as h, SettingsForNamespace as ht, DevframeCapabilities as i, DevframeScopedNodeContext as it, SharedStateOptions as j, AgentResource as jt, SharedState as k, AgentHandle as kt, RpcFunctionsHost as l, DevframeSettingsStore as lt, RpcStreamingHost as m, ScopedSharedStates as mt, ConnectionMetaSse as n, DevframeServicesScopeRegistry as nt, DevframeNodeContext as o, DevframeScopedStreamingHost as ot, RpcStreamingChannelOptions as p, ScopedServerFunctions as pt, DevframeServiceDefinition as q, ConnectionMetaWebsocket as r, DevframeServicesState as rt, DevframeNodeRpcSession as s, DevframeSettings as st, ConnectionMeta as t, DevframeServicesRegistry as tt, RpcSharedStateGetOptions as u, ScopedBroadcastOptions as ut, StreamErrorPayload as v, DevframeRpcServerFunctions as vt, Immutable as w, DevframeAuthHandler as wt, StreamSinkEvents as x, DevframeStorageScope as xt, StreamReader as y, DevframeRpcSharedStates as yt, DevframeRpcOptions as z, DevframeAgentHostEvents as zt };
+export { DevframeServiceOf as $, SharedStateEvents as A, AgentHandle as At, DevframeSetupInfo as B, DevframeAgentHostEvents as Bt, createStreamSink as C, DevframeDiagnosticsHost as Ct, ImmutableObject as D, InferCliFlags as Dt, ImmutableMap as E, CliFlagsSchema as Et, DevframeDefinition as F, AgentTool as Ft, McpAuthorization as G, DevframeSnapshotRpcInputs as H, EventUnsubscribe as Ht, DevframeDeploymentKind as I, AgentToolInput as It, DevframeServiceDefinition as J, McpRouteOptions as K, DevframeDockDefaults as L, AgentToolProvider as Lt, SharedStatePatch as M, AgentResource as Mt, createSharedState as N, AgentResourceContent as Nt, ImmutableSet as O, defineCliFlags as Ot, DevframeCliOptions as P, AgentResourceInput as Pt, DevframeServiceMeta as Q, DevframeDuplicationStrategy as R, AgentToolProviderHandle as Rt, createStreamReader as S, DevframeStorageScope as St, ImmutableArray as T, DevframeAuthHandler as Tt, DevframeSseOptions as U, EventsMap as Ut, DevframeSnapshotRpcEntry as V, EventEmitter as Vt, DevframeWsOptions as W, DevframeServiceId as X, DevframeServiceDescriptor as Y, DevframeServiceInput as Z, CreateStreamSinkOptions as _, DevframeViewHost as _t, DevframeConnectionConfigsRegistry as a, DevframeScopedNodeContext as at, StreamSink as b, DevframeRpcSharedStates as bt, RpcBroadcastOptions as c, DevframeSettings as ct, RpcSharedStateHost as d, ScopedBroadcastOptions as dt, DevframeServiceScopeOf as et, RpcStreamingChannel as f, ScopedClientFunctions as ft, CreateStreamReaderOptions as g, SettingsForNamespace as gt, BufferedChunk as h, ScopedSharedStates as ht, DevframeCapabilities as i, DevframeServicesState as it, SharedStateOptions as j, AgentManifest as jt, SharedState as k, parseCliFlags as kt, RpcFunctionsHost as l, DevframeSettingsRegistry as lt, RpcStreamingHost as m, ScopedServerFunctions as mt, ConnectionMetaSse as n, DevframeServicesRegistry as nt, DevframeNodeContext as o, DevframeScopedNodeRpc as ot, RpcStreamingChannelOptions as p, ScopedRpcFn as pt, McpSetting as q, ConnectionMetaWebsocket as r, DevframeServicesScopeRegistry as rt, DevframeNodeRpcSession as s, DevframeScopedStreamingHost as st, ConnectionMeta as t, DevframeServicesHost as tt, RpcSharedStateGetOptions as u, DevframeSettingsStore as ut, StreamErrorPayload as v, DevframeRpcClientFunctions as vt, Immutable as w, DevframeDiagnosticsLogger as wt, StreamSinkEvents as x, DevframeHost as xt, StreamReader as y, DevframeRpcServerFunctions as yt, DevframeRpcOptions as z, DevframeAgentHost as zt };