diff --git a/alias.ts b/alias.ts
index 3efeb54a..1b1f8806 100644
--- a/alias.ts
+++ b/alias.ts
@@ -7,6 +7,7 @@ const r = (path: string) => fileURLToPath(new URL(`./packages/${path}`, import.m
 const p = (path: string) => fileURLToPath(new URL(`./plugins/${path}`, import.meta.url))
 
 export const alias = {
+  'devframe/rpc/transports/ws-bun': r('devframe/src/rpc/transports/ws-bun.ts'),
   'devframe/rpc/transports/ws-server': r('devframe/src/rpc/transports/ws-server.ts'),
   'devframe/rpc/transports/ws-client': r('devframe/src/rpc/transports/ws-client.ts'),
   'devframe/rpc/client': r('devframe/src/rpc/client.ts'),
@@ -44,6 +45,7 @@ export const alias = {
   'devframe/adapters/mcp': r('devframe/src/adapters/mcp/index.ts'),
   '@devframes/hub/client': r('hub/src/client/index.ts'),
   '@devframes/hub/constants': r('hub/src/constants.ts'),
+  '@devframes/hub/initiate': r('hub/src/node/initiate.ts'),
   '@devframes/hub/node': r('hub/src/node/index.ts'),
   '@devframes/hub/types': r('hub/src/types/index.ts'),
   '@devframes/hub': r('hub/src/index.ts'),
diff --git a/docs/errors/DF8000.md b/docs/errors/DF8000.md
new file mode 100644
index 00000000..2b1dfaaf
--- /dev/null
+++ b/docs/errors/DF8000.md
@@ -0,0 +1,31 @@
+---
+outline: deep
+---
+
+# DF8000: Devframe Id Collides With a Reserved Hub Path
+
+## Message
+
+> Devframe id "`{id}`" collides with a reserved hub path — it cannot be mounted directly under the hub base.
+
+## Cause
+
+`initHub` mounts every devframe at `<base><id>/`, directly under the hub base. The filenames that live at that same level — `__connection.json`, `__ws`, `__index.json`, `__client-imports.js`, `__mcp`, and `embedded.js` — are the hub protocol's own endpoints, so a devframe id equal to one of them would shadow the endpoint.
+
+## Example
+
+```ts
+import { initHub } from '@devframes/hub/initiate'
+
+initHub({
+  devframes: [defineDevframe({ id: '__mcp', /* … */ })], // ✗ throws DF8000
+})
+```
+
+## Fix
+
+Rename the devframe id, or mount it at a non-colliding path via `basePath` on the definition.
+
+## Source
+
+- [`packages/hub/src/node/initiate.ts`](https://github.com/devframes/devframe/blob/main/packages/hub/src/node/initiate.ts) — `initHub` throws this while mounting the `devframes` list.
diff --git a/docs/errors/DF8001.md b/docs/errors/DF8001.md
new file mode 100644
index 00000000..34aad8f7
--- /dev/null
+++ b/docs/errors/DF8001.md
@@ -0,0 +1,33 @@
+---
+outline: deep
+---
+
+# DF8001: Memoized Hub Instance Replaced
+
+## Message
+
+> initHub replaced the live hub instance memoized under key "`{key}`": its options changed since the previous call.
+
+## Cause
+
+`initHub` was called with a `key` that already maps to a live instance, but the option fingerprint differs from the memoized one's. Dev servers that re-evaluate modules on the fly (Next.js, Nitro, SvelteKit HMR) re-run `initHub` on every reload; the `key` memoization normally returns the live instance, but when the options genuinely changed the old instance — including its side-car WebSocket server — is closed and a fresh one starts.
+
+## Example
+
+```ts
+import { initHub } from '@devframes/hub/initiate'
+
+// First evaluation:
+initHub({ key: 'devtools', devframes: [git] })
+
+// A later reload with a different frame list replaces the live instance:
+initHub({ key: 'devtools', devframes: [git, terminals] }) // ⚠ DF8001
+```
+
+## Fix
+
+This is informational when you edited the options on purpose — the replacement is the intended behavior. If it fires without an intentional change, keep the options stable across reloads (module-level constants rather than values recomputed per evaluation), or give genuinely different hubs distinct keys.
+
+## Source
+
+- [`packages/hub/src/node/initiate.ts`](https://github.com/devframes/devframe/blob/main/packages/hub/src/node/initiate.ts) — `initHub` warns this before closing and replacing a memoized instance whose options fingerprint changed.
diff --git a/docs/errors/DF8002.md b/docs/errors/DF8002.md
new file mode 100644
index 00000000..c13c309c
--- /dev/null
+++ b/docs/errors/DF8002.md
@@ -0,0 +1,36 @@
+---
+outline: deep
+---
+
+# DF8002: Both devframes and context Passed to initHub
+
+## Message
+
+> initHub received both `devframes` and `context` — the two assembly modes are mutually exclusive.
+
+## Cause
+
+`initHub` assembles a hub in one of two ways: **declaratively** (`devframes: [...]` — the instance creates the hub context with its own host and mounts each frame under `<base><id>/`), or **from a pre-built context** (`context: ctx` — your host already created the context and mounted the frames; the instance serves only the hub-level endpoints and transport). A `devframes` list cannot be mounted into a context whose host the instance doesn't own, so passing both is a contradiction.
+
+## Example
+
+```ts
+// ✗ Bad
+initHub({ devframes: [git], context: myCtx })
+
+// ✓ Good — declarative:
+initHub({ devframes: [git] })
+
+// ✓ Good — bring your own context:
+const ctx = await createHubContext({ host: myHost, cwd })
+await mountDevframe(ctx, git)
+initHub({ context: ctx })
+```
+
+## Fix
+
+Pick one mode. Use `configure(ctx)` on the declarative mode when you need post-mount registrations (docks, commands, terminals) on the instance-created context.
+
+## Source
+
+- [`packages/hub/src/node/initiate.ts`](https://github.com/devframes/devframe/blob/main/packages/hub/src/node/initiate.ts) — `initHub` throws this during initialization when both options are present.
diff --git a/docs/errors/DF8003.md b/docs/errors/DF8003.md
new file mode 100644
index 00000000..cbe488c2
--- /dev/null
+++ b/docs/errors/DF8003.md
@@ -0,0 +1,33 @@
+---
+outline: deep
+---
+
+# DF8003: connectionMeta() Before Hub Instance Ready
+
+## Message
+
+> connectionMeta() was called before initHub finished initializing.
+
+## Cause
+
+`initHub` is a synchronous factory that kicks off asynchronous initialization eagerly — creating the hub context, mounting every frame, and binding the WebSocket tier. `connectionMeta()` describes the WebSocket binding, which only exists once that initialization completes; calling it earlier has nothing correct to return.
+
+## Example
+
+```ts
+import { initHub } from '@devframes/hub/initiate'
+
+const hub = initHub({ devframes: [git] })
+hub.connectionMeta() // ✗ throws DF8003 — init is still in flight
+
+await hub.ready
+hub.connectionMeta() // ✓ { backend: 'websocket', websocket: { … } }
+```
+
+## Fix
+
+Await `instance.ready` (or any request through `instance.handler` — it awaits readiness internally) before reading `connectionMeta()`.
+
+## Source
+
+- [`packages/hub/src/node/initiate.ts`](https://github.com/devframes/devframe/blob/main/packages/hub/src/node/initiate.ts) — `initHub`'s `connectionMeta()` throws this while initialization is still pending.
diff --git a/knip.jsonc b/knip.jsonc
index 6923fed4..4ab1553f 100644
--- a/knip.jsonc
+++ b/knip.jsonc
@@ -81,13 +81,13 @@
         "src/recipes/{common-rpc-functions,interactive-auth,open-helpers}.ts",
         "src/rpc/{index,client,server}.ts",
         "src/rpc/dump/index.ts",
-        "src/rpc/transports/{ws-client,ws-server}.ts",
+        "src/rpc/transports/{ws-bun,ws-client,ws-server}.ts",
         "src/types/index.ts",
         "src/utils/*.ts"
       ]
     },
     "packages/hub": {
-      "entry": ["src/{index,constants}.ts", "src/{client,node,types}/index.ts"]
+      "entry": ["src/{index,constants}.ts", "src/{client,node,types}/index.ts", "src/node/initiate.ts"]
     },
     "packages/json-render": {
       // `src/node/index.ts` is already picked up via `tsdown.config.ts`
diff --git a/packages/devframe/package.json b/packages/devframe/package.json
index 4d7ab5fb..fec54b16 100644
--- a/packages/devframe/package.json
+++ b/packages/devframe/package.json
@@ -40,6 +40,7 @@
     "./rpc/client": "./dist/rpc/client.mjs",
     "./rpc/dump": "./dist/rpc/dump.mjs",
     "./rpc/server": "./dist/rpc/server.mjs",
+    "./rpc/transports/ws-bun": "./dist/rpc/transports/ws-bun.mjs",
     "./rpc/transports/ws-client": "./dist/rpc/transports/ws-client.mjs",
     "./rpc/transports/ws-server": "./dist/rpc/transports/ws-server.mjs",
     "./types": "./dist/types/index.mjs",
diff --git a/packages/devframe/src/adapters/initiate.ts b/packages/devframe/src/adapters/initiate.ts
index 6d4de4de..76d29e46 100644
--- a/packages/devframe/src/adapters/initiate.ts
+++ b/packages/devframe/src/adapters/initiate.ts
@@ -4,8 +4,8 @@ import type { ConnectionMeta, DevframeNodeContext, DevframeNodeRpcSession, Devfr
 import type { IncomingMessage, Server as NodeHttpServer, ServerResponse } from 'node:http'
 import type { DevframeAuthHandler } from '../node/auth/handler'
 import type { StartedServer } from '../node/server'
+import type { BunWsTier } from '../rpc/transports/ws-bun'
 import type { DevframeDefinition, DevframeSetupInfo, DevframeWsOptions, McpRouteOptions } from '../types/devframe'
-import type { BunWsTier } from './initiate-bun'
 import process from 'node:process'
 import { mountStaticHandler } from 'devframe/utils/serve-static'
 import { H3, toNodeHandler } from 'h3'
@@ -456,7 +456,7 @@ function instantiateDevframe(
     else {
       // Bun fetch-upgrade — same-origin upgrades completed through
       // `handler(request, server)`, hooks exposed via `websocket`.
-      const { attachBunWsTransport } = await import('./initiate-bun')
+      const { attachBunWsTransport } = await import('../rpc/transports/ws-bun')
       const { createContextRpcServer } = await import('../node/rpc-core')
       const core = createContextRpcServer({
         context: ctx,
diff --git a/packages/devframe/src/adapters/mcp/index.ts b/packages/devframe/src/adapters/mcp/index.ts
index 485e083e..3704ca4b 100644
--- a/packages/devframe/src/adapters/mcp/index.ts
+++ b/packages/devframe/src/adapters/mcp/index.ts
@@ -23,3 +23,9 @@ export {
   type CreateMcpFetchHandlerOptions,
   type McpFetchHandler,
 } from './fetch'
+
+export {
+  type MountedMcpHttp,
+  mountMcpHttp,
+  type MountMcpHttpOptions,
+} from './http'
diff --git a/packages/devframe/src/node/index.ts b/packages/devframe/src/node/index.ts
index a511f40c..6df48382 100644
--- a/packages/devframe/src/node/index.ts
+++ b/packages/devframe/src/node/index.ts
@@ -19,6 +19,10 @@ export * from './host-views'
 // lower-level read/probe/prune helpers stay internal to the connector.
 export { listLiveDevframeInstances, registerDevframeInstance } from './instance-registry'
 export type { DevframeInstanceRecord, DevframeInstanceRegistration } from './instance-registry'
+// The transport-agnostic RPC core is public so hosts that bind their own
+// transports (a Bun fetch-upgrade route, a custom relay) reuse the exact
+// session/auth wiring `startHttpAndWs` uses — see `createContextRpcServer`.
+export * from './rpc-core'
 export * from './rpc-shared-state'
 export * from './rpc-streaming'
 export * from './scope'
diff --git a/packages/devframe/src/adapters/initiate-bun.ts b/packages/devframe/src/rpc/transports/ws-bun.ts
similarity index 79%
rename from packages/devframe/src/adapters/initiate-bun.ts
rename to packages/devframe/src/rpc/transports/ws-bun.ts
index 1954df45..c4247ba9 100644
--- a/packages/devframe/src/adapters/initiate-bun.ts
+++ b/packages/devframe/src/rpc/transports/ws-bun.ts
@@ -1,6 +1,6 @@
-import type { WsOriginRegistry } from 'devframe/rpc/transports/ws-server'
-import type { ContextRpcServer } from '../node/rpc-core'
-import { createWsRpcPeerHooks, isAllowedOrigin } from 'devframe/rpc/transports/ws-server'
+import type { ContextRpcServer } from '../../node/rpc-core'
+import type { WsOriginRegistry } from './ws-server'
+import { createWsRpcPeerHooks, isAllowedOrigin } from './ws-server'
 
 export interface AttachBunWsTransportOptions {
   /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */
@@ -12,7 +12,7 @@ export interface AttachBunWsTransportOptions {
  * crossws Bun adapter produces — typed loosely so devframe carries no
  * dependency on Bun's own types.
  */
-interface BunWsTierWebSocket {
+export interface BunWsTierWebSocket {
   open?: (ws: unknown) => unknown
   message: (ws: unknown, message: unknown) => unknown
   close?: (ws: unknown, code?: number, reason?: string) => unknown
@@ -28,11 +28,11 @@ export interface BunWsTier {
 }
 
 /**
- * The Bun fetch-upgrade WebSocket tier for `createHandler` — the same RPC
- * peer wiring as `attachWsRpcTransport`, driven by crossws's Bun adapter so
- * upgrades complete through `fetch(request, server)` on the app's own
- * origin, with no side-car server. Loaded dynamically so the Bun adapter
- * never enters a Node-only bundle path.
+ * The Bun fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the
+ * same RPC peer wiring as `attachWsRpcTransport`, driven by crossws's Bun
+ * adapter so upgrades complete through `handler(request, server)` on the
+ * app's own origin, with no side-car server. Load it dynamically so the Bun
+ * adapter never enters a Node-only bundle path.
  */
 export async function attachBunWsTransport(
   core: ContextRpcServer,
diff --git a/packages/devframe/tsdown.config.ts b/packages/devframe/tsdown.config.ts
index 70c9ee92..e1c79dbe 100644
--- a/packages/devframe/tsdown.config.ts
+++ b/packages/devframe/tsdown.config.ts
@@ -93,6 +93,7 @@ const serverEntries = {
   'rpc/client': 'src/rpc/client.ts',
   'rpc/dump': 'src/rpc/dump/index.ts',
   'rpc/server': 'src/rpc/server.ts',
+  'rpc/transports/ws-bun': 'src/rpc/transports/ws-bun.ts',
   'rpc/transports/ws-client': 'src/rpc/transports/ws-client.ts',
   'rpc/transports/ws-server': 'src/rpc/transports/ws-server.ts',
   'node/index': 'src/node/index.ts',
diff --git a/packages/hub/package.json b/packages/hub/package.json
index 2c2405db..4d2d8e39 100644
--- a/packages/hub/package.json
+++ b/packages/hub/package.json
@@ -24,6 +24,7 @@
     ".": "./dist/index.mjs",
     "./client": "./dist/client/index.mjs",
     "./constants": "./dist/constants.mjs",
+    "./initiate": "./dist/node/initiate.mjs",
     "./node": "./dist/node/index.mjs",
     "./types": "./dist/types/index.mjs",
     "./package.json": "./package.json"
@@ -44,15 +45,18 @@
   "dependencies": {
     "@standard-schema/spec": "catalog:deps",
     "destr": "catalog:deps",
+    "h3": "catalog:deps",
     "nostics": "catalog:deps",
     "pathe": "catalog:deps",
     "perfect-debounce": "catalog:deps",
     "tinyexec": "catalog:deps",
+    "ufo": "catalog:deps",
     "zigpty": "catalog:deps"
   },
   "devDependencies": {
     "@types/node": "catalog:types",
     "devframe": "workspace:*",
+    "get-port-please": "catalog:deps",
     "mlly": "catalog:build",
     "tsdown": "catalog:build",
     "valibot": "catalog:deps"
diff --git a/packages/hub/src/node/__tests__/initiate.test.ts b/packages/hub/src/node/__tests__/initiate.test.ts
new file mode 100644
index 00000000..065ce1aa
--- /dev/null
+++ b/packages/hub/src/node/__tests__/initiate.test.ts
@@ -0,0 +1,283 @@
+import type { DevframeDefinition, DevframeNodeContext, DevframeRpcClientFunctions, DevframeRpcServerFunctions } from 'devframe/types'
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { createServer } from 'node:http'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { createRpcClient } from 'devframe/rpc/client'
+import { createWsRpcChannel } from 'devframe/rpc/transports/ws-client'
+import { getPort } from 'get-port-please'
+import { describe, expect, it } from 'vitest'
+import { initHub } from '../initiate'
+
+function makeDist(html: string): string {
+  const dir = mkdtempSync(join(tmpdir(), 'hub-initiate-'))
+  writeFileSync(join(dir, 'index.html'), html, 'utf-8')
+  return dir
+}
+
+function makeFrame(id: string, distDir?: string): DevframeDefinition {
+  return {
+    id,
+    name: `Frame ${id}`,
+    version: '0.0.0',
+    packageName: `@test/${id}`,
+    homepage: '',
+    description: '',
+    ...(distDir ? { cli: { distDir } } : {}),
+    setup(ctx: DevframeNodeContext) {
+      ctx.rpc.register({ name: `${id}:probe`, type: 'query', handler: () => `ok:${id}` })
+      ctx.agent.registerTool({
+        id: `${id}-tool`,
+        description: `Tool from ${id}.`,
+        safety: 'read',
+        handler: () => ({ from: id }),
+      })
+    },
+  }
+}
+
+function connectWsClient(url: string) {
+  return createRpcClient<DevframeRpcServerFunctions, DevframeRpcClientFunctions>(
+    {} as DevframeRpcClientFunctions,
+    { channel: createWsRpcChannel({ url }) },
+  )
+}
+
+describe('initHub', () => {
+  it('connectionMeta() before ready throws DF8003', () => {
+    const hub = initHub({ auth: false })
+    expect(() => hub.connectionMeta()).toThrow(/DF8003|finished initializing/)
+    return hub.close()
+  })
+
+  it('rejects a devframe id that shadows a reserved hub path', async () => {
+    const hub = initHub({ auth: false, devframes: [makeFrame('__mcp')] })
+    await expect(hub.ready).rejects.toThrow(/DF8000|reserved hub path/)
+    await hub.close()
+  })
+
+  it('rejects devframes together with a pre-built context', async () => {
+    const hub = initHub({ auth: false })
+    await hub.ready
+    const ctx = await hub.context
+    const conflicting = initHub({ auth: false, context: ctx, devframes: [makeFrame('git')] })
+    await expect(conflicting.ready).rejects.toThrow(/DF8002|mutually exclusive/)
+    await conflicting.close()
+    await hub.close()
+  })
+
+  it('shared-server tier: one namespace serves frames, discovery, and one shared socket', async () => {
+    const host = '127.0.0.1'
+    const port = await getPort({ port: 18210, host })
+    const distA = makeDist('<!doctype html><title>frame a</title>')
+    const distB = makeDist('<!doctype html><title>frame b</title>')
+
+    let hubRef!: ReturnType<typeof initHub>
+    const server = createServer((req, res) => {
+      hubRef.nodeMiddleware(req, res, () => {
+        res.statusCode = 418
+        res.end('host app')
+      })
+    })
+    hubRef = initHub({
+      auth: false,
+      server,
+      devframes: [makeFrame('alpha', distA), makeFrame('beta', distB)],
+    })
+    await new Promise<void>(resolve => server.listen(port, host, resolve))
+
+    try {
+      await hubRef.ready
+      // One shared socket, advertised hub-base-absolute so the same meta
+      // resolves correctly from the hub base and from every frame base.
+      expect(hubRef.connectionMeta()).toEqual({
+        backend: 'websocket',
+        websocket: { path: '/__devframes/__ws' },
+      })
+
+      // Frame SPAs under <base><id>/.
+      const alpha = await fetch(`http://${host}:${port}/__devframes/alpha/`)
+      expect(await alpha.text()).toContain('frame a')
+      const beta = await fetch(`http://${host}:${port}/__devframes/beta/`)
+      expect(await beta.text()).toContain('frame b')
+
+      // Per-frame discovery points at the shared hub socket.
+      const frameMeta = await (await fetch(`http://${host}:${port}/__devframes/alpha/__connection.json`)).json()
+      expect(frameMeta.websocket).toEqual({ path: '/__devframes/__ws' })
+
+      // The index document names every frame; the headless root serves it too.
+      const index = await (await fetch(`http://${host}:${port}/__devframes/__index.json`)).json()
+      expect(index.frames.map((f: { id: string }) => f.id)).toEqual(['alpha', 'beta'])
+      const root = await (await fetch(`http://${host}:${port}/__devframes/`)).json()
+      expect(root.frames.length).toBe(2)
+
+      // No ui slot → embedded.js is a reserved 404.
+      const embedded = await fetch(`http://${host}:${port}/__devframes/embedded.js`)
+      expect(embedded.status).toBe(404)
+
+      // The client-imports module is served as an ES module.
+      const imports = await fetch(`http://${host}:${port}/__devframes/__client-imports.js`)
+      expect(imports.headers.get('content-type')).toContain('javascript')
+      expect(await imports.text()).toContain('export const clientImports')
+
+      // Outside the namespace stays the host app's.
+      const outside = await fetch(`http://${host}:${port}/app`)
+      expect(outside.status).toBe(418)
+
+      // Cross-frame RPC: one merged registry on the one shared socket.
+      const client = connectWsClient(`ws://${host}:${port}/__devframes/__ws`)
+      await expect(client.$call('alpha:probe' as any)).resolves.toBe('ok:alpha')
+      await expect(client.$call('beta:probe' as any)).resolves.toBe('ok:beta')
+      client.$close()
+    }
+    finally {
+      await hubRef.close()
+      server.close()
+      server.closeAllConnections()
+    }
+  })
+
+  it('ui slot: viewer owns the root, embedded.js serves the entry, discovery still wins', async () => {
+    const viewerDist = makeDist('<!doctype html><title>hub viewer</title>')
+    const embeddedDir = mkdtempSync(join(tmpdir(), 'hub-embedded-'))
+    const embeddedEntry = join(embeddedDir, 'embedded.js')
+    writeFileSync(embeddedEntry, 'console.log("embedded bootstrap")', 'utf-8')
+    const wsPort = await getPort({ port: 18220, host: '127.0.0.1' })
+
+    const hub = initHub({
+      auth: false,
+      host: '127.0.0.1',
+      ws: { port: wsPort },
+      devframes: [makeFrame('alpha', makeDist('<!doctype html><title>frame a</title>'))],
+      ui: {
+        viewer: { distDir: viewerDist },
+        embedded: { entry: embeddedEntry },
+      },
+    })
+
+    try {
+      await hub.ready
+      const origin = 'http://localhost:5173'
+
+      // The viewer SPA owns the namespace root…
+      const root = await hub.handler(new Request(`${origin}/__devframes/`))
+      expect(await root.text()).toContain('hub viewer')
+
+      // …while exact protocol endpoints still win over its SPA fallback.
+      const index = await hub.handler(new Request(`${origin}/__devframes/__index.json`))
+      expect((await index.json()).endpoints.embedded).toBe('embedded.js')
+      const meta = await hub.handler(new Request(`${origin}/__devframes/__connection.json`))
+      expect((await meta.json()).websocket).toEqual({ port: wsPort, path: '__ws' })
+
+      // The embedded bootstrap serves from the ui slot.
+      const embedded = await hub.handler(new Request(`${origin}/__devframes/embedded.js`))
+      expect(embedded.headers.get('content-type')).toContain('javascript')
+      expect(await embedded.text()).toContain('embedded bootstrap')
+
+      // Frames still mount beneath the viewer's base.
+      const alpha = await hub.handler(new Request(`${origin}/__devframes/alpha/`))
+      expect(await alpha.text()).toContain('frame a')
+    }
+    finally {
+      await hub.close()
+    }
+  })
+
+  it('aggregate MCP: one endpoint lists tools from every mounted frame', async () => {
+    const wsPort = await getPort({ port: 18230, host: '127.0.0.1' })
+    const hub = initHub({
+      auth: false,
+      host: '127.0.0.1',
+      ws: { port: wsPort },
+      mcp: true,
+      devframes: [makeFrame('alpha'), makeFrame('beta')],
+    })
+
+    try {
+      await hub.ready
+      expect(hub.connectionMeta().mcp).toEqual({ path: '__mcp' })
+
+      const origin = 'http://localhost:3000'
+      const init = await hub.handler(new Request(`${origin}/__devframes/__mcp`, {
+        method: 'POST',
+        headers: {
+          'content-type': 'application/json',
+          'accept': 'application/json, text/event-stream',
+          origin,
+        },
+        body: JSON.stringify({
+          jsonrpc: '2.0',
+          id: 1,
+          method: 'initialize',
+          params: { protocolVersion: '2025-03-26', capabilities: {}, clientInfo: { name: 'x', version: '0' } },
+        }),
+      }))
+      expect(init.status).toBe(200)
+      const sessionId = init.headers.get('mcp-session-id')
+      expect(sessionId).toBeTruthy()
+      await init.body?.cancel()
+
+      const initialized = await hub.handler(new Request(`${origin}/__devframes/__mcp`, {
+        method: 'POST',
+        headers: {
+          'content-type': 'application/json',
+          'accept': 'application/json, text/event-stream',
+          'mcp-session-id': sessionId!,
+          origin,
+        },
+        body: JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' }),
+      }))
+      await initialized.body?.cancel()
+
+      const list = await hub.handler(new Request(`${origin}/__devframes/__mcp`, {
+        method: 'POST',
+        headers: {
+          'content-type': 'application/json',
+          'accept': 'application/json, text/event-stream',
+          'mcp-session-id': sessionId!,
+          origin,
+        },
+        body: JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/list' }),
+      }))
+      expect(list.status).toBe(200)
+      const raw = await list.text()
+      // Tools from both frames surface through the one aggregate endpoint.
+      expect(raw).toContain('alpha-tool')
+      expect(raw).toContain('beta-tool')
+    }
+    finally {
+      await hub.close()
+    }
+  })
+
+  it('single hub Auth: one gate covers every frame on the shared socket', async () => {
+    const wsPort = await getPort({ port: 18240, host: '127.0.0.1' })
+    const hub = initHub({
+      host: '127.0.0.1',
+      ws: { port: wsPort },
+      devframes: [makeFrame('alpha')],
+    })
+
+    try {
+      await hub.ready
+      const client = connectWsClient(`ws://127.0.0.1:${wsPort}/__ws`)
+      const handshake = await client.$call('anonymous:devframe:auth' as any, { authToken: '', ua: 'test', origin: 'http://localhost' }) as { isTrusted: boolean }
+      expect(handshake.isTrusted).toBe(false)
+      // Untrusted callers reach neither frame functions nor hub built-ins.
+      await expect(client.$call('alpha:probe' as any)).rejects.toThrow()
+      client.$close()
+    }
+    finally {
+      await hub.close()
+    }
+  })
+
+  it('key memoization returns the live instance', async () => {
+    const wsPort = await getPort({ port: 18250, host: '127.0.0.1' })
+    const a = initHub({ auth: false, key: 'hub-memo', host: '127.0.0.1', ws: { port: wsPort } })
+    const b = initHub({ auth: false, key: 'hub-memo', host: '127.0.0.1', ws: { port: wsPort } })
+    expect(b).toBe(a)
+    await a.ready
+    await a.close()
+  })
+})
diff --git a/packages/hub/src/node/diagnostics.ts b/packages/hub/src/node/diagnostics.ts
index 75211a2f..eaf01246 100644
--- a/packages/hub/src/node/diagnostics.ts
+++ b/packages/hub/src/node/diagnostics.ts
@@ -14,6 +14,22 @@ export const diagnostics = defineDiagnostics({
   docsBase: 'https://devfra.me/errors',
   reporters: [hubReporter],
   codes: {
+    DF8000: {
+      why: (p: { id: string }) => `Devframe id "${p.id}" collides with a reserved hub path — it cannot be mounted directly under the hub base.`,
+      fix: 'The filenames directly under the hub base (`__connection.json`, `__ws`, `__index.json`, `__client-imports.js`, `__mcp`, `embedded.js`) are reserved for the hub protocol. Rename the devframe id, or override its mount with a non-colliding `basePath`.',
+    },
+    DF8001: {
+      why: (p: { key: string }) => `initHub replaced the live hub instance memoized under key "${p.key}": its options changed since the previous call.`,
+      fix: 'A dev-time module reload re-ran initHub with different options, so the old instance (and its side-car WebSocket server) was closed and a new one started. If this is unexpected, keep the options stable across reloads — or use distinct keys for genuinely different hubs.',
+    },
+    DF8002: {
+      why: 'initHub received both `devframes` and `context` — the two assembly modes are mutually exclusive.',
+      fix: 'Pass `devframes` to let the instance create the hub context and mount each frame itself, or pass a pre-built `context` (your host already mounted the frames) — never both.',
+    },
+    DF8003: {
+      why: 'connectionMeta() was called before initHub finished initializing.',
+      fix: 'Await `instance.ready` (or any request through `instance.handler`) before reading `connectionMeta()` — the WebSocket binding it describes is only known once initialization completes.',
+    },
     DF8100: {
       why: (p: { id: string }) => `Dock with id "${p.id}" is already registered`,
       fix: 'Use the `force` parameter to overwrite an existing registration.',
diff --git a/packages/hub/src/node/initiate.ts b/packages/hub/src/node/initiate.ts
new file mode 100644
index 00000000..66f95c41
--- /dev/null
+++ b/packages/hub/src/node/initiate.ts
@@ -0,0 +1,580 @@
+import type { StartedServer } from 'devframe/node'
+import type { DevframeAuthHandler } from 'devframe/node/auth'
+import type { BunWsTier } from 'devframe/rpc/transports/ws-bun'
+import type { WsOriginRegistry } from 'devframe/rpc/transports/ws-server'
+import type { ConnectionMeta, DevframeDefinition, DevframeStorageScope, DevframeWsOptions, McpRouteOptions } from 'devframe/types'
+import type { IncomingMessage, Server as NodeHttpServer, ServerResponse } from 'node:http'
+import type { ClientScriptEntry } from '../types/docks'
+import type { DevframeHubContext } from './context'
+import { createReadStream } from 'node:fs'
+import process from 'node:process'
+import { Readable } from 'node:stream'
+import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_MCP_ROUTE, DEVFRAME_WS_ROUTE } from 'devframe/constants'
+import { createH3DevframeHost, startHttpAndWs } from 'devframe/node'
+import { createInteractiveAuth } from 'devframe/recipes/interactive-auth'
+import { mountStaticHandler } from 'devframe/utils/serve-static'
+import { getPort } from 'get-port-please'
+import { H3, toNodeHandler } from 'h3'
+import { resolve } from 'pathe'
+import { cleanDoubleSlashes, joinURL, withLeadingSlash, withoutLeadingSlash, withoutTrailingSlash, withTrailingSlash } from 'ufo'
+import { createHubContext } from './context'
+import { diagnostics } from './diagnostics'
+import { mountDevframe } from './mount-devframe'
+
+/** Default mount base for a hub instance — one namespace, one catch-all. */
+export const DEVFRAMES_HUB_BASE = '/__devframes/'
+
+/** Reserved filenames directly under the hub base — a frame id can't shadow them. */
+const RESERVED_HUB_PATHS = [
+  DEVFRAME_CONNECTION_META_FILENAME,
+  DEVFRAME_DOCK_IMPORTS_FILENAME,
+  DEVFRAME_WS_ROUTE,
+  DEVFRAME_MCP_ROUTE,
+  '__index.json',
+  'embedded.js',
+] as const
+
+/**
+ * The UI slot of a hub instance — pure data, zero policy. The hub itself is
+ * headless: whoever fills this slot decides what a viewer looks like.
+ * `@devframes/hub-ui` ships the reference implementation (`createUi()`);
+ * Vite DevTools or any community viewer supplies its own object to the same
+ * slot and reuses all the infrastructure.
+ */
+export interface DevframeHubUi {
+  /**
+   * A standalone viewer SPA (built with relative asset paths) served at the
+   * hub base itself — open `<base>` in a tab and the devtools are there.
+   */
+  viewer?: {
+    /** Directory of the prebuilt viewer SPA. */
+    distDir: string
+  }
+  /**
+   * A prebuilt, self-contained script served at `<base>embedded.js` — the
+   * floating-devtools bootstrap a host page loads with one
+   * `<script type="module" src="<base>embedded.js">` tag. Visibility policy
+   * (always-on, keyboard-summoned, …) belongs entirely to this entry.
+   */
+  embedded?: {
+    /** File path of the prebuilt single-file module. */
+    entry: string
+  }
+}
+
+export interface InitHubOptions {
+  /**
+   * Mount base the hub answers under. Default: `/__devframes/` — every
+   * mounted devframe lives at `<base><id>/`, so the host app needs exactly
+   * one catch-all route.
+   */
+  base?: string
+  /**
+   * Devframes to mount: each runs its `setup()` against the shared hub
+   * context (one merged RPC registry, one WebSocket, one auth gate), serves
+   * its SPA at `<base><id>/`, and is auto-registered as an iframe dock.
+   */
+  devframes?: DevframeDefinition[]
+  /**
+   * Bring your own hub context instead of `devframes` — for hosts that
+   * assemble `createHubContext` + `mountDevframe` themselves (with their own
+   * `DevframeHost` serving the frames). The instance then serves only the
+   * hub-level endpoints (`__connection.json`, `__index.json`,
+   * `__client-imports.js`, the WS transport, MCP, and the `ui` slot);
+   * serve each frame's meta yourself from {@link HubInstance.connectionMeta}.
+   */
+  context?: DevframeHubContext
+  /**
+   * Runs once the context exists and every `devframes` entry is mounted —
+   * register docks, commands, terminals, and messages surfaces here.
+   */
+  configure?: (ctx: DevframeHubContext) => void | Promise<void>
+  /** See {@link DevframeHubUi} — omitted, the hub stays fully headless. */
+  ui?: DevframeHubUi
+  /**
+   * Share the host's `node:http` server for the WebSocket RPC endpoint
+   * (upgrade bound at `<base>__ws`). When omitted (and no `ws.url`/`ws.port`
+   * is given), an eager side-car WebSocket server starts at init. Under Bun,
+   * the default is the fetch-upgrade tier — pass the `Bun.serve` server as
+   * `handler`'s second argument and wire {@link HubInstance.websocket}.
+   */
+  server?: NodeHttpServer
+  /**
+   * Explicit WebSocket control, same contract as `initDevframe`:
+   * `url` overrides the advertisement (tunnel pattern), `port` pins a
+   * side-car, `route` renames the upgrade segment (default `__ws`).
+   */
+  ws?: DevframeWsOptions
+  /** Bind host for a side-car WebSocket server. Default: `localhost`. */
+  host?: string
+  /**
+   * The hub's **single Auth**: one gate at the one shared transport covers
+   * every mounted frame, the MCP route, and the hub built-ins. Gates by
+   * default (devframe's interactive OTP); `false` opts out; a
+   * {@link DevframeAuthHandler} installs a custom scheme.
+   */
+  auth?: boolean | DevframeAuthHandler
+  /**
+   * Expose the **aggregate** MCP endpoint at `<base>__mcp` — one
+   * Streamable-HTTP server over the shared context's whole tool registry
+   * (ids are already namespaced per plugin). Disabled by default.
+   *
+   * @experimental
+   */
+  mcp?: boolean | McpRouteOptions
+  /**
+   * Memoize the instance on `globalThis` under this key so dev-time module
+   * re-evaluation returns the live instance instead of leaking side-car
+   * servers (`DF8001` when the options changed).
+   */
+  key?: string
+  /**
+   * Public origin the host app is reachable at, or a getter. Derived lazily
+   * from the first request when omitted.
+   */
+  origin?: string | (() => string)
+  /** Working directory for the hub context. Default: `process.cwd()`. */
+  cwd?: string
+  /** Override where persisted devframe state lives. */
+  getStorageDir?: (scope: DevframeStorageScope) => string
+  /** Extra WS-upgrade origins beyond the loopback default; `false` disables the gate. */
+  allowedOrigins?: readonly string[] | WsOriginRegistry | false
+  /** Destroy off-route upgrades on a shared `server` devframe's adapter owns outright. */
+  destroyUnmatchedUpgrades?: boolean
+}
+
+export interface HubInstance {
+  /**
+   * Web-standard request handler for the whole hub — mount it on one
+   * catch-all route under {@link InitHubOptions.base}. Under Bun, pass the
+   * `Bun.serve` server as the second argument so WS upgrades complete.
+   */
+  handler: (request: Request, server?: unknown) => Promise<Response>
+  /** Connect/Express-style middleware over the same surface; `next()`s outside the base. */
+  nodeMiddleware: (req: IncomingMessage, res: ServerResponse, next?: (err?: unknown) => void) => void
+  /** `Bun.serve({ websocket })` handlers (active only under the Bun tier). */
+  websocket: {
+    open: (ws: unknown) => void
+    message: (ws: unknown, message: unknown) => void
+    close: (ws: unknown, code?: number, reason?: string) => void
+    drain: (ws: unknown) => void
+  }
+  /** Resolves once every frame is mounted and the WebSocket binding is live. */
+  ready: Promise<void>
+  /** The shared hub context, once initialized. */
+  context: Promise<DevframeHubContext>
+  /** The `ConnectionMeta` served at `<base>__connection.json` (and every frame base). */
+  connectionMeta: () => ConnectionMeta
+  /** Tear down: WS transport/side-car, MCP sessions, memo-registry entry. */
+  close: () => Promise<void>
+}
+
+interface HubRegistryEntry {
+  hash: string
+  instance: HubInstance
+}
+
+const REGISTRY_KEY = Symbol.for('devframes:hub-instance-registry')
+
+function hubRegistry(): Map<string, HubRegistryEntry> {
+  const holder = globalThis as { [REGISTRY_KEY]?: Map<string, HubRegistryEntry> }
+  holder[REGISTRY_KEY] ??= new Map()
+  return holder[REGISTRY_KEY]
+}
+
+function optionsHash(options: InitHubOptions): string {
+  return JSON.stringify({
+    base: options.base,
+    devframes: options.devframes?.map(d => d.id),
+    context: options.context != null,
+    ui: options.ui && {
+      viewer: options.ui.viewer?.distDir,
+      embedded: options.ui.embedded?.entry,
+    },
+    server: options.server != null,
+    ws: options.ws,
+    host: options.host,
+    auth: typeof options.auth === 'object' ? 'custom' : options.auth,
+    mcp: options.mcp,
+    origin: typeof options.origin === 'function' ? 'getter' : options.origin,
+    cwd: options.cwd ?? process.cwd(),
+    getStorageDir: options.getStorageDir != null,
+    allowedOrigins: Array.isArray(options.allowedOrigins) ? options.allowedOrigins : typeof options.allowedOrigins,
+    destroyUnmatchedUpgrades: options.destroyUnmatchedUpgrades,
+  })
+}
+
+function normalizeBase(base: string): string {
+  return cleanDoubleSlashes(withTrailingSlash(withLeadingSlash(base)))
+}
+
+/** Compare two URL paths ignoring a trailing slash. */
+function samePath(a: string, b: string): boolean {
+  return withoutTrailingSlash(a) === withoutTrailingSlash(b)
+}
+
+/**
+ * Render the dock client-script import map as an ES module — one dynamic
+ * import thunk per dock that carries a client script (`clientScript` on
+ * iframe docks, `action`, `renderer`). External viewers import this module
+ * from `<base>__client-imports.js` to load per-dock client code into the
+ * host page; `importFrom` values must be URL paths the host serves.
+ */
+function renderClientImportsModule(ctx: DevframeHubContext): string {
+  const entries: string[] = []
+  for (const [id, view] of ctx.docks.views) {
+    const scripts: ClientScriptEntry[] = []
+    const anyView = view as { clientScript?: ClientScriptEntry, action?: ClientScriptEntry, renderer?: ClientScriptEntry }
+    if (anyView.clientScript)
+      scripts.push(anyView.clientScript)
+    if (anyView.action)
+      scripts.push(anyView.action)
+    if (anyView.renderer)
+      scripts.push(anyView.renderer)
+    if (scripts.length === 0)
+      continue
+    const thunks = scripts.map(script => `() => import(${JSON.stringify(script.importFrom)})`)
+    entries.push(`  ${JSON.stringify(id)}: [${thunks.join(', ')}],`)
+  }
+  return `// Generated by @devframes/hub — dock client-script import map.\nexport const clientImports = {\n${entries.join('\n')}\n}\nexport default clientImports\n`
+}
+
+/**
+ * Initiate a hub instance — the whole multi-devframe devtools surface
+ * behind one framework-agnostic, web-standard handler. Every mounted
+ * devframe shares one context (merged RPC registry, shared state, docks /
+ * terminals / messages / commands), one WebSocket transport, and one Auth;
+ * the instance serves each frame's SPA at `<base><id>/`, the discovery
+ * endpoints (`__connection.json`, `__index.json`, `__client-imports.js`),
+ * the aggregate MCP route, and whatever the {@link DevframeHubUi} slot
+ * provides — the hub itself stays headless.
+ */
+export function initHub(options: InitHubOptions = {}): HubInstance {
+  if (options.key) {
+    const registry = hubRegistry()
+    const hash = optionsHash(options)
+    const existing = registry.get(options.key)
+    if (existing) {
+      if (existing.hash === hash)
+        return existing.instance
+      diagnostics.DF8001({ key: options.key })
+      void existing.instance.close().catch(() => {})
+    }
+    const instance = instantiateHub(options)
+    registry.set(options.key, { hash, instance })
+    return instance
+  }
+  return instantiateHub(options)
+}
+
+function instantiateHub(options: InitHubOptions): HubInstance {
+  const base = normalizeBase(options.base ?? DEVFRAMES_HUB_BASE)
+  const baseNoSlash = withoutTrailingSlash(base)
+  const app = new H3()
+  const cwd = options.cwd ?? process.cwd()
+
+  let derivedOrigin: string | undefined
+  function currentOrigin(): string | undefined {
+    const explicit = typeof options.origin === 'function' ? options.origin() : options.origin
+    return explicit || derivedOrigin
+  }
+  let authHandler: DevframeAuthHandler | undefined
+  let bannerPrinted = false
+  function maybePrintBanner(): void {
+    if (bannerPrinted || !authHandler || !currentOrigin())
+      return
+    bannerPrinted = true
+    authHandler.printBanner()
+  }
+  function noteOrigin(origin: string): void {
+    derivedOrigin ??= origin
+    maybePrintBanner()
+  }
+
+  let meta: ConnectionMeta | undefined
+  let started: StartedServer | undefined
+  let bunTier: BunWsTier | undefined
+  let bunUpgradePath: string | undefined
+  let mcpDispose: (() => Promise<void>) | undefined
+  let ctx: DevframeHubContext
+  const frames: { id: string, base: string, title: string }[] = []
+
+  async function init(): Promise<void> {
+    if (options.context && options.devframes?.length)
+      throw diagnostics.DF8002()
+
+    if (options.context) {
+      ctx = options.context
+    }
+    else {
+      const h3Host = createH3DevframeHost({
+        origin: () => currentOrigin() ?? 'http://localhost',
+        appName: 'devframes',
+        workspaceRoot: cwd,
+        mount: (mountBase, dir) => {
+          mountStaticHandler(app, mountBase, dir)
+        },
+      })
+      const host = {
+        ...h3Host,
+        ...(options.getStorageDir ? { getStorageDir: options.getStorageDir } : {}),
+        // Serve the hub's own connection meta under every mounted frame's
+        // base, so each SPA discovers the shared RPC endpoint via its
+        // relative `./__connection.json` fetch — the meta's WS path is
+        // hub-base-absolute, so it resolves to the one shared socket no
+        // matter how deep the frame base is.
+        mountConnectionMeta: (frameBase: string) => {
+          app.use(joinURL(frameBase, DEVFRAME_CONNECTION_META_FILENAME), () => meta)
+        },
+      }
+      ctx = await createHubContext({ cwd, workspaceRoot: cwd, mode: 'dev', host })
+    }
+
+    // Mount each devframe under `<base><id>/` — its SPA, its meta, and its
+    // auto-registered iframe dock — after guarding the id against the
+    // reserved hub filenames that live directly under the base.
+    for (const def of options.devframes ?? []) {
+      if ((RESERVED_HUB_PATHS as readonly string[]).includes(def.id))
+        throw diagnostics.DF8000({ id: def.id })
+      const frameBase = withTrailingSlash(joinURL(base, def.id))
+      await mountDevframe(ctx, def, { base: frameBase })
+      frames.push({ id: def.id, base: frameBase, title: def.name })
+    }
+
+    await options.configure?.(ctx)
+
+    // Aggregate MCP — one Streamable-HTTP endpoint over the shared
+    // context's whole registry (tool ids are namespaced per plugin, and the
+    // wire-name collision policy is `createMcpFetchHandler`'s own).
+    const mcpConfig = options.mcp === true ? {} : options.mcp
+    let mcpMeta: ConnectionMeta['mcp']
+    if (mcpConfig) {
+      const mcpRoute = withoutLeadingSlash(mcpConfig.path ?? DEVFRAME_MCP_ROUTE)
+      const { mountMcpHttp } = await import('devframe/adapters/mcp')
+      const mounted = mountMcpHttp(app, ctx, joinURL(base, mcpRoute), {
+        serverName: 'devframes-hub',
+        serverVersion: '0.0.0',
+        exposeSharedState: true,
+        allowedOrigins: mcpConfig.allowedOrigins,
+      })
+      mcpDispose = mounted.dispose
+      mcpMeta = { path: mcpRoute }
+    }
+
+    // WebSocket binding — same contract as `initDevframe`: explicit side-car
+    // port > shared host server > advertise-only external URL > Bun
+    // fetch-upgrade > eager auto side-car; `ws.url` always overrides the
+    // advertisement (tunnel pattern). One transport for the whole hub.
+    const ws = options.ws ?? {}
+    const route = withoutLeadingSlash(ws.route ?? DEVFRAME_WS_ROUTE)
+
+    const authOption = options.auth
+    let resolvedAuth: boolean | DevframeAuthHandler
+    if (authOption === false) {
+      resolvedAuth = false
+    }
+    else if (typeof authOption === 'object') {
+      authHandler = authOption
+      resolvedAuth = authOption
+    }
+    else {
+      authHandler = createInteractiveAuth(ctx)
+      resolvedAuth = authHandler
+    }
+
+    let websocketMeta: ConnectionMeta['websocket']
+    if (ws.port != null) {
+      started = await startHttpAndWs({
+        context: ctx,
+        host: options.host ?? 'localhost',
+        port: ws.port,
+        path: withLeadingSlash(route),
+        auth: resolvedAuth,
+        allowedOrigins: options.allowedOrigins,
+      })
+      websocketMeta = { port: started.port, path: route }
+    }
+    else if (options.server) {
+      started = await startHttpAndWs({
+        context: ctx,
+        port: 0,
+        server: options.server,
+        path: joinURL(base, route),
+        auth: resolvedAuth,
+        allowedOrigins: options.allowedOrigins,
+        destroyUnmatched: options.destroyUnmatchedUpgrades,
+      })
+      // Hub-base-absolute so the same meta object resolves to the one
+      // shared socket from the hub base *and* from every frame base.
+      websocketMeta = { path: joinURL(base, route) }
+    }
+    else if (ws.url) {
+      authHandler = undefined
+      websocketMeta = ws.url
+    }
+    else if (typeof (globalThis as any).Bun === 'undefined') {
+      const port = await getPort({ port: 9777, portRange: [9777, 9877], host: options.host ?? 'localhost' })
+      started = await startHttpAndWs({
+        context: ctx,
+        host: options.host ?? 'localhost',
+        port,
+        path: withLeadingSlash(route),
+        auth: resolvedAuth,
+        allowedOrigins: options.allowedOrigins,
+      })
+      websocketMeta = { port: started.port, path: route }
+    }
+    else {
+      const { attachBunWsTransport } = await import('devframe/rpc/transports/ws-bun')
+      const { createContextRpcServer } = await import('devframe/node')
+      const core = createContextRpcServer({ context: ctx, auth: resolvedAuth })
+      bunTier = await attachBunWsTransport(core, { allowedOrigins: options.allowedOrigins })
+      bunUpgradePath = joinURL(base, route)
+      websocketMeta = { path: joinURL(base, route) }
+    }
+    if (ws.url)
+      websocketMeta = ws.url
+
+    meta = {
+      backend: 'websocket',
+      websocket: websocketMeta,
+      ...(mcpMeta ? { mcp: mcpMeta } : {}),
+    }
+
+    // Hub-level discovery endpoints, registered before the viewer's static
+    // mount so its SPA-fallback can't swallow them.
+    app.use(joinURL(base, DEVFRAME_CONNECTION_META_FILENAME), () => meta)
+
+    const indexDocument = (): Record<string, unknown> => ({
+      base,
+      frames,
+      endpoints: {
+        connection: DEVFRAME_CONNECTION_META_FILENAME,
+        clientImports: DEVFRAME_DOCK_IMPORTS_FILENAME,
+        index: '__index.json',
+        websocket: meta!.websocket,
+        ...(mcpMeta ? { mcp: mcpMeta.path } : {}),
+        ...(options.ui?.embedded ? { embedded: 'embedded.js' } : {}),
+      },
+    })
+    app.use(joinURL(base, '__index.json'), () => indexDocument())
+
+    app.use(joinURL(base, DEVFRAME_DOCK_IMPORTS_FILENAME), (event) => {
+      event.res.headers.set('Content-Type', 'text/javascript; charset=utf-8')
+      event.res.headers.set('Cache-Control', 'no-store')
+      return renderClientImportsModule(ctx)
+    })
+
+    if (options.ui?.embedded) {
+      const entry = resolve(options.ui.embedded.entry)
+      app.use(joinURL(base, 'embedded.js'), (event) => {
+        event.res.headers.set('Content-Type', 'text/javascript; charset=utf-8')
+        event.res.headers.set('Cache-Control', 'no-store')
+        return Readable.toWeb(createReadStream(entry)) as ReadableStream
+      })
+    }
+
+    if (options.ui?.viewer) {
+      // The viewer SPA owns the hub base (mounted last — exact routes above
+      // win; frame mounts are longer prefixes and route ahead of it).
+      mountStaticHandler(app, base, resolve(options.ui.viewer.distDir))
+    }
+    else {
+      // Headless root: the index document, so the base is never a dead end.
+      app.use(baseNoSlash, () => indexDocument())
+      app.use(base, () => indexDocument())
+    }
+
+    maybePrintBanner()
+  }
+
+  const initPromise = init()
+  initPromise.catch(() => {})
+  const contextPromise = initPromise.then(() => ctx)
+  contextPromise.catch(() => {})
+
+  async function handleRequest(request: Request, server?: unknown): Promise<Response> {
+    await initPromise
+    const url = new URL(request.url)
+    noteOrigin(url.origin)
+    if (bunTier && samePath(url.pathname, bunUpgradePath!)
+      && request.headers.get('upgrade')?.toLowerCase() === 'websocket') {
+      if (!server) {
+        return new Response(
+          'Upgrade Required: pass the Bun server as the second argument to instance.handler(request, server)',
+          { status: 426 },
+        )
+      }
+      return await bunTier.handleUpgrade(request, server) as Response
+    }
+    const response = await app.fetch(request)
+    if (response.status === 404)
+      return new Response(null, { status: 404 })
+    return response
+  }
+
+  const nodeHandler = toNodeHandler(app)
+  function nodeMiddleware(req: IncomingMessage, res: ServerResponse, next?: (err?: unknown) => void): void {
+    let pathname = req.url ?? '/'
+    try {
+      pathname = new URL(pathname, 'http://localhost').pathname
+    }
+    catch {}
+    if (!(samePath(pathname, baseNoSlash) || pathname.startsWith(base))) {
+      if (next) {
+        next()
+        return
+      }
+      res.statusCode = 404
+      res.end()
+      return
+    }
+    void initPromise
+      .then(() => {
+        const host = req.headers.host
+        if (host) {
+          const encrypted = (req.socket as { encrypted?: boolean }).encrypted
+          noteOrigin(`${encrypted ? 'https' : 'http'}://${host}`)
+        }
+        return nodeHandler(req, res)
+      })
+      .catch((err: unknown) => {
+        if (next) {
+          next(err)
+          return
+        }
+        res.statusCode = 500
+        res.end()
+      })
+  }
+
+  const instance: HubInstance = {
+    handler: handleRequest,
+    nodeMiddleware,
+    websocket: {
+      open: ws => void bunTier?.websocket.open?.(ws),
+      message: (ws, message) => void bunTier?.websocket.message(ws, message),
+      close: (ws, code, reason) => void bunTier?.websocket.close?.(ws, code, reason),
+      drain: ws => void bunTier?.websocket.drain?.(ws),
+    },
+    ready: initPromise,
+    context: contextPromise,
+    connectionMeta: () => {
+      if (!meta)
+        throw diagnostics.DF8003()
+      return meta
+    },
+    close: async () => {
+      if (options.key) {
+        const registry = hubRegistry()
+        if (registry.get(options.key)?.instance === instance)
+          registry.delete(options.key)
+      }
+      await initPromise.catch(() => {})
+      await mcpDispose?.()
+      await started?.close()
+      await bunTier?.close()
+    },
+  }
+  return instance
+}
diff --git a/packages/hub/src/node/mount-devframe.ts b/packages/hub/src/node/mount-devframe.ts
index f8bdf53e..204a6763 100644
--- a/packages/hub/src/node/mount-devframe.ts
+++ b/packages/hub/src/node/mount-devframe.ts
@@ -74,17 +74,21 @@ export async function mountDevframe(
       : resolveBasePath({ ...d, id, basePath: undefined }, 'hosted'))
 
   if (d.cli?.distDir) {
-    ctx.views.hostStatic(base, resolve(d.cli.distDir))
     // Serve the hub's connection meta under the devframe's base so its SPA
     // discovers the RPC/WS endpoint via `connectDevframe()`'s relative
     // `./__connection.json` fetch — instead of relying on inheriting it from a
     // same-origin parent window (which breaks for cross-origin / sandboxed
     // iframes). A host that omits the hook turns this into silent breakage
     // (empty panels / stuck-loading SPAs), so surface it rather than no-op away.
+    //
+    // Mounted *before* the SPA statics: route-ordered hosts (h3) resolve the
+    // exact meta route ahead of the static catch-all, and connect-style hosts
+    // are order-agnostic (their static middleware `next()`s on a miss).
     if (ctx.host.mountConnectionMeta)
       await ctx.host.mountConnectionMeta(base)
     else
       diagnostics.DF8106({ id, name: d.name, base })
+    ctx.views.hostStatic(base, resolve(d.cli.distDir))
   }
 
   ctx.docks.register({
diff --git a/packages/hub/tsdown.config.ts b/packages/hub/tsdown.config.ts
index d8c17bb8..09d1d843 100644
--- a/packages/hub/tsdown.config.ts
+++ b/packages/hub/tsdown.config.ts
@@ -6,6 +6,7 @@ export default defineConfig({
     'constants': 'src/constants.ts',
     'client/index': 'src/client/index.ts',
     'node/index': 'src/node/index.ts',
+    'node/initiate': 'src/node/initiate.ts',
     'types/index': 'src/types/index.ts',
   },
   outExtensions: () => ({ js: '.mjs', dts: '.d.mts' }),
@@ -22,6 +23,7 @@ export default defineConfig({
     ],
     onlyBundle: [
       'acorn',
+      'get-port-please',
       'mlly',
     ],
   },
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2a7d48fc..a1464d55 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -896,6 +896,9 @@ importers:
       destr:
         specifier: catalog:deps
         version: 2.0.5
+      h3:
+        specifier: catalog:deps
+        version: 2.0.1-rc.26(crossws@0.4.10(srvx@0.12.4))
       nostics:
         specifier: catalog:deps
         version: 1.2.0
@@ -908,6 +911,9 @@ importers:
       tinyexec:
         specifier: catalog:deps
         version: 1.3.0
+      ufo:
+        specifier: catalog:deps
+        version: 1.6.4
       zigpty:
         specifier: catalog:deps
         version: 0.2.1
@@ -918,6 +924,9 @@ importers:
       devframe:
         specifier: workspace:*
         version: link:../devframe
+      get-port-please:
+        specifier: catalog:deps
+        version: 3.2.0
       mlly:
         specifier: catalog:build
         version: 1.8.2
@@ -17123,8 +17132,8 @@ snapshots:
       '@internationalized/date': 3.12.2
       '@internationalized/number': 3.6.7
       '@tanstack/vue-virtual': 3.13.30(vue@3.5.40(typescript@6.0.3))
-      '@vueuse/core': 14.3.0(vue@3.5.40(typescript@6.0.3))
-      '@vueuse/shared': 14.3.0(vue@3.5.40(typescript@6.0.3))
+      '@vueuse/core': 14.4.0(vue@3.5.40(typescript@6.0.3))
+      '@vueuse/shared': 14.4.0(vue@3.5.40(typescript@6.0.3))
       aria-hidden: 1.2.6
       defu: 6.1.7
       ohash: 2.0.11
diff --git a/tests/__snapshots__/tsnapi/@devframes/hub/initiate.snapshot.d.ts b/tests/__snapshots__/tsnapi/@devframes/hub/initiate.snapshot.d.ts
new file mode 100644
index 00000000..afed50f3
--- /dev/null
+++ b/tests/__snapshots__/tsnapi/@devframes/hub/initiate.snapshot.d.ts
@@ -0,0 +1,53 @@
+/**
+ * Generated by tsnapi — public API snapshot of `@devframes/hub/initiate`
+ */
+// #region Interfaces
+export interface DevframeHubUi {
+  viewer?: {
+    distDir: string;
+  };
+  embedded?: {
+    entry: string;
+  };
+}
+export interface HubInstance {
+  handler: (_: Request, _?: unknown) => Promise<Response>;
+  nodeMiddleware: (_: IncomingMessage, _: ServerResponse, _?: (_?: unknown) => void) => void;
+  websocket: {
+    open: (_: unknown) => void;
+    message: (_: unknown, _: unknown) => void;
+    close: (_: unknown, _?: number, _?: string) => void;
+    drain: (_: unknown) => void;
+  };
+  ready: Promise<void>;
+  context: Promise<DevframeHubContext>;
+  connectionMeta: () => ConnectionMeta;
+  close: () => Promise<void>;
+}
+export interface InitHubOptions {
+  base?: string;
+  devframes?: DevframeDefinition[];
+  context?: DevframeHubContext;
+  configure?: (_: DevframeHubContext) => void | Promise<void>;
+  ui?: DevframeHubUi;
+  server?: Server;
+  ws?: DevframeWsOptions;
+  host?: string;
+  auth?: boolean | DevframeAuthHandler;
+  mcp?: boolean | McpRouteOptions;
+  key?: string;
+  origin?: string | (() => string);
+  cwd?: string;
+  getStorageDir?: (_: DevframeStorageScope) => string;
+  allowedOrigins?: readonly string[] | WsOriginRegistry | false;
+  destroyUnmatchedUpgrades?: boolean;
+}
+// #endregion
+
+// #region Functions
+export declare function initHub(_?: InitHubOptions): HubInstance;
+// #endregion
+
+// #region Variables
+export declare const DEVFRAMES_HUB_BASE: string;
+// #endregion
\ No newline at end of file
diff --git a/tests/__snapshots__/tsnapi/@devframes/hub/initiate.snapshot.js b/tests/__snapshots__/tsnapi/@devframes/hub/initiate.snapshot.js
new file mode 100644
index 00000000..449c40ec
--- /dev/null
+++ b/tests/__snapshots__/tsnapi/@devframes/hub/initiate.snapshot.js
@@ -0,0 +1,10 @@
+/**
+ * Generated by tsnapi — public API snapshot of `@devframes/hub/initiate`
+ */
+// #region Functions
+export function initHub(_) {}
+// #endregion
+
+// #region Variables
+export var DEVFRAMES_HUB_BASE /* const */
+// #endregion
\ No newline at end of file
diff --git a/tests/__snapshots__/tsnapi/@devframes/hub/node.snapshot.js b/tests/__snapshots__/tsnapi/@devframes/hub/node.snapshot.js
index a76d3e1f..8be2e7ef 100644
--- a/tests/__snapshots__/tsnapi/@devframes/hub/node.snapshot.js
+++ b/tests/__snapshots__/tsnapi/@devframes/hub/node.snapshot.js
@@ -1,101 +1,28 @@
 /**
  * Generated by tsnapi — public API snapshot of `@devframes/hub/node`
  */
-// #region Classes
-export class DevframeCommandsHost {
-  context
-  commands
-  events
-  agentProvider
-  constructor(_) {}
-  register(_) {}
-  unregister(_) {}
-  async execute(_, ..._) {}
-  list() {}
-  findCommand(_) {}
-  toSerializable(_) {}
-  validateAgentExposure(_) {}
-  collectAgentTools() {}
-}
-export class DevframeDocksHost {
-  context
-  views
-  events
-  userSettings
-  remoteDocks
-  constructor(_) {}
-  async init() {}
-  values() {}
-  projectView(_) {}
-  resolveDevServerOrigin() {}
-  register(_, _) {}
-  update(_) {}
-  activate(_, _) {}
-  validateGroupMembership(_) {}
-  prepareRemoteRegistration(_) {}
-}
-export class DevframeMessagesHost {
-  context
-  entries
-  events
-  lastModified
-  removals
-  _autoDeleteTimers
-  _clock
-  _removalsTrimmedAt
-  _tick() {}
-  _recordRemoval(_, _) {}
-  constructor(_) {}
-  async add(_) {}
-  async update(_, _) {}
-  async remove(_) {}
-  info(_, _) {}
-  warn(_, _) {}
-  error(_, _) {}
-  success(_, _) {}
-  debug(_, _) {}
-  async clear() {}
-  listSince(_) {}
-  _createHandle(_) {}
-}
-export class DevframeTerminalsHost {
-  context
-  sessions
-  events
-  _boundStreams
-  _channel
-  constructor(_) {}
-  getStreamingChannel() {}
-  register(_) {}
-  update(_) {}
-  remove(_) {}
-  bindStream(_) {}
-  async startChildProcess(_, _) {}
-  async startPtySession(_, _) {}
-}
-// #endregion
-
 // #region Functions
-export async function createHubContext(_) {}
 export function createSimpleClientScript(_) {}
-export async function mountDevframe(_, _, _) {}
-// #endregion
-
-// #region Variables
-export var builtinHubRpcDeclarations /* const */
-export var hubCommandsExecute /* const */
-export var hubDocksActivate /* const */
-export var hubMessagesAdd /* const */
-export var hubMessagesClear /* const */
-export var hubMessagesRemove /* const */
-export var hubMessagesUpdate /* const */
-export var hubTerminalsRemove /* const */
-export var hubTerminalsResize /* const */
-export var hubTerminalsRestart /* const */
-export var hubTerminalsTerminate /* const */
-export var hubTerminalsWrite /* const */
 // #endregion
 
 // #region Other
+export { builtinHubRpcDeclarations }
+export { createHubContext }
 export { DEFAULT_CATEGORIES_ORDER }
+export { DevframeCommandsHost }
+export { DevframeDocksHost }
+export { DevframeMessagesHost }
+export { DevframeTerminalsHost }
+export { hubCommandsExecute }
+export { hubDocksActivate }
+export { hubMessagesAdd }
+export { hubMessagesClear }
+export { hubMessagesRemove }
+export { hubMessagesUpdate }
+export { hubTerminalsRemove }
+export { hubTerminalsResize }
+export { hubTerminalsRestart }
+export { hubTerminalsTerminate }
+export { hubTerminalsWrite }
+export { mountDevframe }
 // #endregion
\ No newline at end of file
diff --git a/tests/__snapshots__/tsnapi/devframe/adapters/mcp.snapshot.d.ts b/tests/__snapshots__/tsnapi/devframe/adapters/mcp.snapshot.d.ts
index 9c610d2b..a55bdd25 100644
--- a/tests/__snapshots__/tsnapi/devframe/adapters/mcp.snapshot.d.ts
+++ b/tests/__snapshots__/tsnapi/devframe/adapters/mcp.snapshot.d.ts
@@ -24,9 +24,14 @@ export interface McpFetchHandler {
 export interface McpServerHandle {
   stop: () => Promise<void>;
 }
+export interface MountedMcpHttp {
+  dispose: () => Promise<void>;
+}
+export interface MountMcpHttpOptions extends CreateMcpFetchHandlerOptions {}
 // #endregion
 
 // #region Functions
 export declare function createMcpFetchHandler(_: DevframeNodeContext, _: CreateMcpFetchHandlerOptions): McpFetchHandler;
 export declare function createMcpServer(_: DevframeDefinition, _?: CreateMcpServerOptions): Promise<McpServerHandle>;
+export declare function mountMcpHttp(_: H3, _: DevframeNodeContext, _: string, _: MountMcpHttpOptions): MountedMcpHttp;
 // #endregion
\ No newline at end of file
diff --git a/tests/__snapshots__/tsnapi/devframe/adapters/mcp.snapshot.js b/tests/__snapshots__/tsnapi/devframe/adapters/mcp.snapshot.js
index 8743467b..6ad22c4c 100644
--- a/tests/__snapshots__/tsnapi/devframe/adapters/mcp.snapshot.js
+++ b/tests/__snapshots__/tsnapi/devframe/adapters/mcp.snapshot.js
@@ -4,4 +4,5 @@
 // #region Other
 export { createMcpFetchHandler }
 export { createMcpServer }
+export { mountMcpHttp }
 // #endregion
\ No newline at end of file
diff --git a/tests/__snapshots__/tsnapi/devframe/node.snapshot.d.ts b/tests/__snapshots__/tsnapi/devframe/node.snapshot.d.ts
index 5ee58841..ddfdb91b 100644
--- a/tests/__snapshots__/tsnapi/devframe/node.snapshot.d.ts
+++ b/tests/__snapshots__/tsnapi/devframe/node.snapshot.d.ts
@@ -125,6 +125,9 @@ export declare function toDialableHost(_: string): string;
 // #endregion
 
 // #region Other
+export { ContextRpcServer }
+export { createContextRpcServer }
+export { CreateContextRpcServerOptions }
 export { RpcFunctionsHost }
 export { StartedServer }
 export { startHttpAndWs }
diff --git a/tests/__snapshots__/tsnapi/devframe/node.snapshot.js b/tests/__snapshots__/tsnapi/devframe/node.snapshot.js
index d95147c9..b76c5e0e 100644
--- a/tests/__snapshots__/tsnapi/devframe/node.snapshot.js
+++ b/tests/__snapshots__/tsnapi/devframe/node.snapshot.js
@@ -3,6 +3,7 @@
  */
 // #region Other
 export { coerceAgentPositionalArgs }
+export { createContextRpcServer }
 export { createH3DevframeHost }
 export { createHostContext }
 export { createNodeSettings }
diff --git a/tests/__snapshots__/tsnapi/devframe/rpc/transports/ws-bun.snapshot.d.ts b/tests/__snapshots__/tsnapi/devframe/rpc/transports/ws-bun.snapshot.d.ts
new file mode 100644
index 00000000..c45ac0b3
--- /dev/null
+++ b/tests/__snapshots__/tsnapi/devframe/rpc/transports/ws-bun.snapshot.d.ts
@@ -0,0 +1,23 @@
+/**
+ * Generated by tsnapi — public API snapshot of `devframe/rpc/transports/ws-bun`
+ */
+// #region Interfaces
+export interface AttachBunWsTransportOptions {
+  allowedOrigins?: readonly string[] | WsOriginRegistry | false;
+}
+export interface BunWsTier {
+  handleUpgrade: (_: Request, _: unknown) => Promise<Response | undefined>;
+  websocket: BunWsTierWebSocket;
+  close: () => Promise<void>;
+}
+export interface BunWsTierWebSocket {
+  open?: (_: unknown) => unknown;
+  message: (_: unknown, _: unknown) => unknown;
+  close?: (_: unknown, _?: number, _?: string) => unknown;
+  drain?: (_: unknown) => unknown;
+}
+// #endregion
+
+// #region Functions
+export declare function attachBunWsTransport(_: ContextRpcServer, _?: AttachBunWsTransportOptions): Promise<BunWsTier>;
+// #endregion
\ No newline at end of file
diff --git a/tests/__snapshots__/tsnapi/devframe/rpc/transports/ws-bun.snapshot.js b/tests/__snapshots__/tsnapi/devframe/rpc/transports/ws-bun.snapshot.js
new file mode 100644
index 00000000..46c5e407
--- /dev/null
+++ b/tests/__snapshots__/tsnapi/devframe/rpc/transports/ws-bun.snapshot.js
@@ -0,0 +1,6 @@
+/**
+ * Generated by tsnapi — public API snapshot of `devframe/rpc/transports/ws-bun`
+ */
+// #region Functions
+export async function attachBunWsTransport(_, _) {}
+// #endregion
\ No newline at end of file
diff --git a/tsconfig.base.json b/tsconfig.base.json
index ba637775..f311e3e7 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -7,6 +7,9 @@
     "module": "esnext",
     "moduleResolution": "Bundler",
     "paths": {
+      "devframe/rpc/transports/ws-bun": [
+        "./packages/devframe/src/rpc/transports/ws-bun.ts"
+      ],
       "devframe/rpc/transports/ws-server": [
         "./packages/devframe/src/rpc/transports/ws-server.ts"
       ],
@@ -118,6 +121,9 @@
       "@devframes/hub/constants": [
         "./packages/hub/src/constants.ts"
       ],
+      "@devframes/hub/initiate": [
+        "./packages/hub/src/node/initiate.ts"
+      ],
       "@devframes/hub/node": [
         "./packages/hub/src/node/index.ts"
       ],