devframe 0.5.4 → 0.6.0-beta.1

package/dist/{host-h3-Dgpgr1Ul.mjs → host-h3-C5SZlk03.mjs}

@@ -1,15 +1,15 @@
-import { t as devframeReporter } from "./diagnostics-reporter-CBBZwoMv.mjs";
-import { t as diagnostics } from "./diagnostics-GitRGKbr.mjs";
+import { t as devframeReporter } from "./diagnostics-reporter-CsIG85Q5.mjs";
+import { t as diagnostics } from "./diagnostics-BXwBQmoN.mjs";
 import { RpcFunctionsCollectorBase } from "./rpc/index.mjs";
 import { defineRpcFunction } from "./index.mjs";
-import { i as diagnostics$1, n as nanoid, r as createEventEmitter, t as createSharedState } from "./shared-state-BlBNYziY.mjs";
+import { a as diagnostics$1, i as createEventEmitter, n as createSharedState, r as nanoid, t as createStorage } from "./storage-l2ezeend.mjs";
 import { defineDiagnostics } from "nostics";
 import { isatty } from "node:tty";
 import { formatWithOptions, inspect } from "node:util";
 import { existsSync } from "node:fs";
+import { join } from "pathe";
 import { homedir } from "node:os";
 import process$1 from "node:process";
-import { join } from "pathe";
 //#region src/node/host-agent.ts
 /**
 * Framework-neutral host aggregating the agent-exposed surface of a
@@ -1240,6 +1240,123 @@ const BUILTIN_AGENT_RPC = [
 	})
 ];
 //#endregion
+//#region src/utils/scope.ts
+/** Whether a name is already namespaced (contains a `:` separator). */
+function isQualifiedName(name) {
+	return name.includes(":");
+}
+/**
+* Prefix a bare name with `<namespace>:`. Names that already contain a
+* `:` are returned unchanged, so callers can reference another scope's
+* ids explicitly (e.g. `ctx.rpc.call('other-plugin:fn')`).
+*/
+function qualifyName(namespace, name) {
+	return isQualifiedName(name) ? name : `${namespace}:${name}`;
+}
+//#endregion
+//#region src/node/settings.ts
+const STORAGE_SCOPE = {
+	global: "global",
+	project: "workspace"
+};
+function createNodeSettingsStore(context, namespace, scope) {
+	const stateKey = `devframe:settings:${scope}:${namespace}`;
+	let statePromise;
+	function store() {
+		if (!statePromise) {
+			const filepath = join(context.host.getStorageDir(STORAGE_SCOPE[scope]), "settings", `${namespace}.json`);
+			statePromise = context.rpc.sharedState.get(stateKey, { sharedState: createStorage({
+				filepath,
+				initialValue: {}
+			}) });
+		}
+		return statePromise;
+	}
+	return {
+		async get(key) {
+			return (await store()).value()[key];
+		},
+		async set(key, value) {
+			(await store()).mutate((draft) => {
+				draft[key] = value;
+			});
+		},
+		async delete(key) {
+			(await store()).mutate((draft) => {
+				delete draft[key];
+			});
+		},
+		async all() {
+			return (await store()).value();
+		},
+		async onChange(fn) {
+			return (await store()).on("updated", (full) => fn(full));
+		}
+	};
+}
+/**
+* Build the node-side `settings` surface for a scope namespace. `project`
+* persists under the host's `workspace` storage dir, `global` under its
+* `global` dir. Each is a file-backed, client-synced key-value store.
+*/
+function createNodeSettings(context, namespace) {
+	return {
+		global: createNodeSettingsStore(context, namespace, "global"),
+		project: createNodeSettingsStore(context, namespace, "project")
+	};
+}
+//#endregion
+//#region src/node/scope.ts
+function prefixDefinition(namespace, fn) {
+	if (isQualifiedName(fn.name)) throw diagnostics$1.DF0034({
+		namespace,
+		name: fn.name
+	});
+	return {
+		...fn,
+		name: `${namespace}:${fn.name}`
+	};
+}
+/**
+* Build a namespace-scoped view of a {@link DevframeNodeContext}. Every
+* RPC id, shared-state key, and streaming channel passed through the
+* returned `rpc` surface is auto-namespaced with `<namespace>:`.
+*/
+function createScopedNodeContext(context, namespace) {
+	const base = context.rpc;
+	const rpc = {
+		namespace,
+		register(fn, force) {
+			base.register(prefixDefinition(namespace, fn), force);
+		},
+		update(fn, force) {
+			base.update(prefixDefinition(namespace, fn), force);
+		},
+		call: ((method, ...args) => base.invokeLocal(qualifyName(namespace, method), ...args)),
+		broadcast: ((options) => base.broadcast({
+			...options,
+			method: qualifyName(namespace, options.method)
+		})),
+		sharedState: ((key, options) => base.sharedState.get(qualifyName(namespace, key), options)),
+		streaming: { create: (name, opts) => base.streaming.create(qualifyName(namespace, name), opts) },
+		getCurrentRpcSession: () => base.getCurrentRpcSession()
+	};
+	return {
+		namespace,
+		base: context,
+		cwd: context.cwd,
+		workspaceRoot: context.workspaceRoot,
+		mode: context.mode,
+		host: context.host,
+		rpc,
+		settings: createNodeSettings(context, namespace),
+		views: context.views,
+		diagnostics: context.diagnostics,
+		agent: context.agent,
+		scope: context.scope
+	};
+}
+//#endregion
 //#region src/node/context.ts
 /**
 * Framework- and build-tool-agnostic core of the Devframe node context.
@@ -1259,7 +1376,8 @@ async function createHostContext(options) {
 		rpc: void 0,
 		views: void 0,
 		diagnostics: void 0,
-		agent: void 0
+		agent: void 0,
+		scope: void 0
 	};
 	const rpcHost = new RpcFunctionsHost(context);
 	const viewsHost = new DevframeViewHost(context);
@@ -1268,6 +1386,16 @@ async function createHostContext(options) {
 	context.views = viewsHost;
 	context.diagnostics = diagnosticsHost;
 	context.agent = new DevframeAgentHost(context);
+	const scopedCache = /* @__PURE__ */ new Map();
+	context.scope = ((namespace) => {
+		if (!namespace) return context;
+		let scoped = scopedCache.get(namespace);
+		if (!scoped) {
+			scoped = createScopedNodeContext(context, namespace);
+			scopedCache.set(namespace, scoped);
+		}
+		return scoped;
+	});
 	for (const fn of BUILTIN_AGENT_RPC) rpcHost.register(fn);
 	for (const fn of builtinRpcDeclarations) rpcHost.register(fn);
 	return context;
@@ -1293,4 +1421,4 @@ function createH3DevframeHost(options) {
 	};
 }
 //#endregion
-export { createRpcStreamingServerHost as a, DevframeAgentHost as c, RpcFunctionsHost as i, createHostContext as n, createRpcSharedStateServerHost as o, DevframeViewHost as r, DevframeDiagnosticsHost as s, createH3DevframeHost as t };
+export { DevframeViewHost as a, createRpcSharedStateServerHost as c, createNodeSettings as i, DevframeDiagnosticsHost as l, createHostContext as n, RpcFunctionsHost as o, createScopedNodeContext as r, createRpcStreamingServerHost as s, createH3DevframeHost as t, DevframeAgentHost as u };

package/dist/{index-C7M1hnvL.d.mts → index-CxaPKDXX.d.mts}

@@ -1,5 +1,5 @@
-import { C as RpcFunctionsCollector, S as RpcFunctionType, _ as RpcFunctionDefinitionAny, g as RpcFunctionDefinition, i as RpcArgsSchema, w as RpcReturnSchema, x as RpcFunctionSetupResult } from "./types-BkkQ0Txg.mjs";
-import { a as getDefinitionsWithDumps$1, c as StaticRpcDumpManifest$1, d as StaticRpcDumpManifestValue$1, f as StaticRpcDumpSerialization$1, i as dumpFunctions$1, l as StaticRpcDumpManifestQueryEntry$1, n as serializeDumpError$1, o as StaticRpcDumpCollection$1, p as collectStaticRpcDump$1, r as createClientFromDump$1, s as StaticRpcDumpFile$1, t as reviveDumpError$1, u as StaticRpcDumpManifestStaticEntry$1 } from "./index-DH2sBIwd.mjs";
+import { C as RpcFunctionType, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinition, i as RpcArgsSchema, v as RpcFunctionDefinitionAny, w as RpcFunctionsCollector } from "./types-DZEx4ffs.mjs";
+import { a as getDefinitionsWithDumps$1, c as StaticRpcDumpManifest$1, d as StaticRpcDumpManifestValue$1, f as StaticRpcDumpSerialization$1, i as dumpFunctions$1, l as StaticRpcDumpManifestQueryEntry$1, n as serializeDumpError$1, o as StaticRpcDumpCollection$1, p as collectStaticRpcDump$1, r as createClientFromDump$1, s as StaticRpcDumpFile$1, t as reviveDumpError$1, u as StaticRpcDumpManifestStaticEntry$1 } from "./index-DXHWuwJk.mjs";
 
 //#region src/rpc/cache.d.ts
 interface RpcCacheOptions {

package/dist/{index-DH2sBIwd.d.mts → index-DXHWuwJk.d.mts}

@@ -1,4 +1,4 @@
-import { _ as RpcFunctionDefinitionAny, c as RpcDumpClientOptions, l as RpcDumpCollectionOptions, m as RpcDumpStore, n as BirpcReturn, o as RpcDefinitionsToFunctions, p as RpcDumpRecordError } from "./types-BkkQ0Txg.mjs";
+import { h as RpcDumpStore, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny } from "./types-DZEx4ffs.mjs";
 
 //#region src/rpc/dump/static.d.ts
 type StaticRpcDumpSerialization = 'json' | 'structured-clone';

package/dist/index.d.mts

@@ -1,8 +1,8 @@
-import { $ as AgentResource, B as EntriesToObject, G as DevframeRpcSharedStates, H as Thenable, J as DevframeDiagnosticsDefinition, K as DevframeHost, Q as AgentManifest, U as DevframeRpcClientFunctions, V as PartialWithoutId, W as DevframeRpcServerFunctions, X as DevframeDiagnosticsLogger, Y as DevframeDiagnosticsHost, Z as AgentHandle, _ as RpcStreamingChannel, a as DevframeRuntime, at as DevframeAgentHostEvents, c as defineDevframe, ct as EventsMap, d as DevframeNodeContext, et as AgentResourceContent, f as DevframeNodeRpcSession, g as RpcSharedStateHost, h as RpcSharedStateGetOptions, i as DevframeDeploymentKind, it as DevframeAgentHost, l as ConnectionMeta, m as RpcFunctionsHost, n as DevframeCliOptions, nt as AgentTool, o as DevframeSetupInfo, ot as EventEmitter, p as RpcBroadcastOptions, q as DevframeDefineDiagnosticsOptions, r as DevframeDefinition, rt as AgentToolInput, s as DevframeSpaOptions, st as EventUnsubscribe, t as DevframeBrowserContext, tt as AgentResourceInput, u as DevframeCapabilities, v as RpcStreamingChannelOptions, y as RpcStreamingHost, z as DevframeViewHost } from "./devframe-BuR6n9ZD.mjs";
-import { S as RpcFunctionType, g as RpcFunctionDefinition, h as RpcFunctionAgentOptions, i as RpcArgsSchema, w as RpcReturnSchema } from "./types-BkkQ0Txg.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "./ws-server-C1LjmRnp.mjs";
+import { $ as ScopedServerFunctions, G as DevframeScopedNodeContext, H as EntriesToObject, J as DevframeSettings, K as DevframeScopedNodeRpc, Q as ScopedClientFunctions, S as RpcStreamingHost, St as EventsMap, U as PartialWithoutId, W as Thenable, X as DevframeSettingsStore, Y as DevframeSettingsRegistry, Z as ScopedBroadcastOptions, _ as RpcFunctionsHost, _t as AgentToolInput, a as DevframeDuplicationStrategy, at as DevframeRpcSharedStates, b as RpcStreamingChannel, bt as EventEmitter, c as DevframeSpaOptions, ct as DevframeDiagnosticsDefinition, d as ConnectionMeta, dt as AgentHandle, et as ScopedSharedStates, f as ConnectionMetaWebsocket, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, i as DevframeDeploymentKind, it as DevframeRpcServerFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsHost, m as DevframeNodeContext, mt as AgentResourceContent, n as DevframeCliOptions, nt as DevframeViewHost, o as DevframeRuntime, ot as DevframeHost, p as DevframeCapabilities, pt as AgentResource, q as DevframeScopedStreamingHost, r as DevframeDefinition, rt as DevframeRpcClientFunctions, s as DevframeSetupInfo, st as DevframeDefineDiagnosticsOptions, t as DevframeBrowserContext, tt as SettingsForNamespace, u as defineDevframe, ut as DevframeDiagnosticsLogger, v as RpcSharedStateGetOptions, vt as DevframeAgentHost, x as RpcStreamingChannelOptions, xt as EventUnsubscribe, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "./devframe-BwfavB78.mjs";
+import { C as RpcFunctionType, T as RpcReturnSchema, _ as RpcFunctionDefinition, g as RpcFunctionAgentOptions, i as RpcArgsSchema } from "./types-DZEx4ffs.mjs";
+import { t as DevframeNodeRpcSessionMeta } from "./ws-server-BVVMDo2n.mjs";
 
 //#region src/define.d.ts
 declare const defineRpcFunction: <NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>) => RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>;
 //#endregion
-export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeSetupInfo, DevframeSpaOptions, DevframeViewHost, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, PartialWithoutId, RpcBroadcastOptions, RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, Thenable, defineDevframe, defineRpcFunction };
+export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, PartialWithoutId, RpcBroadcastOptions, RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe, defineRpcFunction };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as createDefineWrapperWithContext } from "./define-CW9gLnyG.mjs";
+import { t as createDefineWrapperWithContext } from "./define-BLWPsH6y.mjs";
 //#region src/define.ts
 const defineRpcFunction = createDefineWrapperWithContext();
 //#endregion

package/dist/node/auth.d.mts

@@ -1,5 +1,5 @@
-import { P as SharedState, d as DevframeNodeContext, f as DevframeNodeRpcSession } from "../devframe-BuR6n9ZD.mjs";
-import { n as InternalAnonymousAuthStorage } from "../context-DTRcO_UH.mjs";
+import { L as SharedState, h as DevframeNodeRpcSession, m as DevframeNodeContext } from "../devframe-BwfavB78.mjs";
+import { n as InternalAnonymousAuthStorage } from "../context-o-TwncyP.mjs";
 
 //#region src/node/auth/revoke.d.ts
 /**
@@ -16,29 +16,49 @@ declare function revokeActiveConnectionsForToken(context: DevframeNodeContext, t
 declare function revokeAuthToken(context: DevframeNodeContext, storage: SharedState<InternalAnonymousAuthStorage>, token: string): Promise<void>;
 //#endregion
 //#region src/node/auth/state.d.ts
-interface PendingAuthRequest {
-  clientAuthToken: string;
-  session: DevframeNodeRpcSession;
-  ua: string;
-  origin: string;
-  resolve: (result: {
-    isTrusted: boolean;
-  }) => void;
-  abortController: AbortController;
-  timeout: ReturnType<typeof setTimeout>;
-}
-declare function getTempAuthToken(): string;
-declare function refreshTempAuthToken(): string;
-declare function getPendingAuth(): PendingAuthRequest | null;
-declare function setPendingAuth(request: PendingAuthRequest | null): void;
 /**
- * Abort and clean up any existing pending auth request.
+ * The current one-time authentication code. Display this to the user (e.g. in
+ * the dev-server terminal) so they can type it into the browser to authenticate.
+ */
+declare function getTempAuthCode(): string;
+/**
+ * Rotate the authentication code, resetting its expiry window and failed-attempt
+ * counter. Call this when a new authentication flow begins (e.g. when an
+ * untrusted client starts authenticating) so the displayed code is freshly
+ * valid for its full TTL.
  */
-declare function abortPendingAuth(): void;
+declare function refreshTempAuthCode(): string;
 /**
- * Consume the temp auth ID: verify it matches, trust the pending client, and clean up.
- * Returns the client's authToken if successful, null otherwise.
+ * Build a "magic link" authentication URL that embeds a one-time code (OTP) as
+ * a query parameter. Opening it authenticates the client without typing — print
+ * it on startup (devframe stays headless, so the host prints its own banner).
+ * Defaults to the current code; the link is subject to the same TTL.
+ */
+declare function buildOtpAuthUrl(baseUrl: string, code?: string): string;
+/**
+ * Re-authenticate a connection that presents a previously-issued bearer token.
+ * Returns `true` and marks the session trusted when the token is known.
+ *
+ * Used by the `devframe:anonymous:auth` handler so a client that already
+ * authenticated (token persisted in the browser) is trusted on reconnect
+ * without entering the code again.
  */
-declare function consumeTempAuthToken(id: string, storage: SharedState<InternalAnonymousAuthStorage>): string | null;
+declare function verifyAuthToken(token: string, session: DevframeNodeRpcSession, storage: SharedState<InternalAnonymousAuthStorage>): boolean;
+/**
+ * Exchange a one-time authentication code for a fresh, node-issued bearer token.
+ *
+ * On success this mints a high-entropy token, records it in the trusted store,
+ * marks the calling session trusted, rotates the code, and returns the token
+ * for the client to persist. Returns `null` on any failure.
+ *
+ * Because the code is short and human-typed, verification is hardened against
+ * brute force: it enforces a time-to-live, compares in constant time, and
+ * rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
+ * attacker cannot keep guessing against the same code.
+ */
+declare function exchangeTempAuthCode(code: string, session: DevframeNodeRpcSession, info: {
+  ua: string;
+  origin: string;
+}, storage: SharedState<InternalAnonymousAuthStorage>): string | null;
 //#endregion
-export { PendingAuthRequest, abortPendingAuth, consumeTempAuthToken, getPendingAuth, getTempAuthToken, refreshTempAuthToken, revokeActiveConnectionsForToken, revokeAuthToken, setPendingAuth };
+export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/auth.mjs

@@ -1,54 +1,101 @@
-import { n as revokeAuthToken, r as humanId, t as revokeActiveConnectionsForToken } from "../revoke-CL0LSAN9.mjs";
+import { DEVFRAME_OTP_URL_PARAM } from "../constants.mjs";
+import { a as timingSafeEqual, i as randomToken, n as revokeAuthToken, r as randomDigits, t as revokeActiveConnectionsForToken } from "../revoke-ENfxWkFK.mjs";
 //#region src/node/auth/state.ts
-let pendingAuth = null;
-let tempAuthToken = generateTempId();
-function generateTempId() {
-	return humanId();
-}
-function getTempAuthToken() {
-	return tempAuthToken;
+/** Number of decimal digits in a human-typed one-time authentication code. */
+const TEMP_AUTH_CODE_LENGTH = 6;
+/**
+* How long an authentication code stays valid after it is (re)generated. A
+* 6-digit code only has ~20 bits of entropy, so a short lifetime plus the
+* attempt cap below are what keep it brute-force resistant.
+*/
+const TEMP_AUTH_CODE_TTL = 5 * 6e4;
+/** Failed attempts allowed against a single code before it is rotated. */
+const TEMP_AUTH_MAX_ATTEMPTS = 5;
+let tempAuthCode = generateTempCode();
+let tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
+let tempAuthFailedAttempts = 0;
+function generateTempCode() {
+	return randomDigits(TEMP_AUTH_CODE_LENGTH);
 }
-function refreshTempAuthToken() {
-	tempAuthToken = generateTempId();
-	return tempAuthToken;
+/**
+* The current one-time authentication code. Display this to the user (e.g. in
+* the dev-server terminal) so they can type it into the browser to authenticate.
+*/
+function getTempAuthCode() {
+	return tempAuthCode;
 }
-function getPendingAuth() {
-	return pendingAuth;
+/**
+* Rotate the authentication code, resetting its expiry window and failed-attempt
+* counter. Call this when a new authentication flow begins (e.g. when an
+* untrusted client starts authenticating) so the displayed code is freshly
+* valid for its full TTL.
+*/
+function refreshTempAuthCode() {
+	tempAuthCode = generateTempCode();
+	tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
+	tempAuthFailedAttempts = 0;
+	return tempAuthCode;
 }
-function setPendingAuth(request) {
-	pendingAuth = request;
+/**
+* Build a "magic link" authentication URL that embeds a one-time code (OTP) as
+* a query parameter. Opening it authenticates the client without typing — print
+* it on startup (devframe stays headless, so the host prints its own banner).
+* Defaults to the current code; the link is subject to the same TTL.
+*/
+function buildOtpAuthUrl(baseUrl, code = tempAuthCode) {
+	const url = new URL(baseUrl);
+	url.searchParams.set(DEVFRAME_OTP_URL_PARAM, code);
+	return url.href;
 }
 /**
-* Abort and clean up any existing pending auth request.
+* Re-authenticate a connection that presents a previously-issued bearer token.
+* Returns `true` and marks the session trusted when the token is known.
+*
+* Used by the `devframe:anonymous:auth` handler so a client that already
+* authenticated (token persisted in the browser) is trusted on reconnect
+* without entering the code again.
 */
-function abortPendingAuth() {
-	if (pendingAuth) {
-		pendingAuth.abortController.abort();
-		clearTimeout(pendingAuth.timeout);
-		pendingAuth = null;
-	}
+function verifyAuthToken(token, session, storage) {
+	if (!token || !storage.value().trusted[token]) return false;
+	session.meta.clientAuthToken = token;
+	session.meta.isTrusted = true;
+	return true;
 }
 /**
-* Consume the temp auth ID: verify it matches, trust the pending client, and clean up.
-* Returns the client's authToken if successful, null otherwise.
+* Exchange a one-time authentication code for a fresh, node-issued bearer token.
+*
+* On success this mints a high-entropy token, records it in the trusted store,
+* marks the calling session trusted, rotates the code, and returns the token
+* for the client to persist. Returns `null` on any failure.
+*
+* Because the code is short and human-typed, verification is hardened against
+* brute force: it enforces a time-to-live, compares in constant time, and
+* rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
+* attacker cannot keep guessing against the same code.
 */
-function consumeTempAuthToken(id, storage) {
-	if (id !== tempAuthToken || !pendingAuth) return null;
-	const { clientAuthToken, session, ua, origin, resolve } = pendingAuth;
+function exchangeTempAuthCode(code, session, info, storage) {
+	if (Date.now() > tempAuthCodeExpiresAt) {
+		refreshTempAuthCode();
+		return null;
+	}
+	if (!timingSafeEqual(code, tempAuthCode)) {
+		tempAuthFailedAttempts += 1;
+		if (tempAuthFailedAttempts >= TEMP_AUTH_MAX_ATTEMPTS) refreshTempAuthCode();
+		return null;
+	}
+	const authToken = randomToken();
 	storage.mutate((state) => {
-		state.trusted[clientAuthToken] = {
-			authToken: clientAuthToken,
-			ua,
-			origin,
+		state.trusted[authToken] = {
+			authToken,
+			ua: info.ua,
+			origin: info.origin,
 			timestamp: Date.now()
 		};
 	});
-	session.meta.clientAuthToken = clientAuthToken;
+	session.meta.clientAuthToken = authToken;
 	session.meta.isTrusted = true;
-	resolve({ isTrusted: true });
-	abortPendingAuth();
-	refreshTempAuthToken();
-	return clientAuthToken;
+	refreshTempAuthCode();
+	return authToken;
 }
 //#endregion
-export { abortPendingAuth, consumeTempAuthToken, getPendingAuth, getTempAuthToken, refreshTempAuthToken, revokeActiveConnectionsForToken, revokeAuthToken, setPendingAuth };
+export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,5 +1,5 @@
-import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-BuR6n9ZD.mjs";
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-DTRcO_UH.mjs";
+import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-BwfavB78.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-o-TwncyP.mjs";
 
 //#region src/adapters/_shared.d.ts
 /**

package/dist/node/hub-internals.mjs

@@ -1,3 +1,3 @@
-import { n as internalContextMap, t as getInternalContext } from "../context-DaKmhhHY.mjs";
-import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-CUFqO4kJ.mjs";
+import { n as internalContextMap, t as getInternalContext } from "../context-3x_bgBgZ.mjs";
+import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-bWRzeSa0.mjs";
 export { getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/index.d.mts

@@ -1,8 +1,8 @@
-import { $ as AgentResource, K as DevframeHost, P as SharedState, Q as AgentManifest, U as DevframeRpcClientFunctions, W as DevframeRpcServerFunctions, X as DevframeDiagnosticsLogger, Y as DevframeDiagnosticsHost$1, Z as AgentHandle, at as DevframeAgentHostEvents, d as DevframeNodeContext, et as AgentResourceContent, f as DevframeNodeRpcSession, g as RpcSharedStateHost, it as DevframeAgentHost$1, m as RpcFunctionsHost$1, nt as AgentTool, ot as EventEmitter, p as RpcBroadcastOptions, rt as AgentToolInput, tt as AgentResourceInput, y as RpcStreamingHost, z as DevframeViewHost$1 } from "../devframe-BuR6n9ZD.mjs";
-import { _ as RpcFunctionDefinitionAny } from "../types-BkkQ0Txg.mjs";
-import { S as RpcFunctionsCollectorBase } from "../index-C7M1hnvL.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "../ws-server-C1LjmRnp.mjs";
-import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-wHlpcdZ9.mjs";
+import { G as DevframeScopedNodeContext, J as DevframeSettings, L as SharedState, S as RpcStreamingHost, _ as RpcFunctionsHost$1, _t as AgentToolInput, bt as EventEmitter, dt as AgentHandle, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, it as DevframeRpcServerFunctions, lt as DevframeDiagnosticsHost$1, m as DevframeNodeContext, mt as AgentResourceContent, nt as DevframeViewHost$1, ot as DevframeHost, pt as AgentResource, rt as DevframeRpcClientFunctions, ut as DevframeDiagnosticsLogger, vt as DevframeAgentHost$1, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "../devframe-BwfavB78.mjs";
+import { v as RpcFunctionDefinitionAny } from "../types-DZEx4ffs.mjs";
+import { S as RpcFunctionsCollectorBase } from "../index-CxaPKDXX.mjs";
+import { t as DevframeNodeRpcSessionMeta } from "../ws-server-BVVMDo2n.mjs";
+import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-oju7PTi2.mjs";
 import { BirpcGroup } from "birpc";
 import { AsyncLocalStorage } from "node:async_hooks";
 
@@ -156,6 +156,22 @@ declare function createRpcSharedStateServerHost(rpc: RpcFunctionsHost$1): RpcSha
  */
 declare function createRpcStreamingServerHost(rpc: RpcFunctionsHost$1): RpcStreamingHost;
 //#endregion
+//#region src/node/scope.d.ts
+/**
+ * Build a namespace-scoped view of a {@link DevframeNodeContext}. Every
+ * RPC id, shared-state key, and streaming channel passed through the
+ * returned `rpc` surface is auto-namespaced with `<namespace>:`.
+ */
+declare function createScopedNodeContext<NS extends string = string>(context: DevframeNodeContext, namespace: NS): DevframeScopedNodeContext<NS>;
+//#endregion
+//#region src/node/settings.d.ts
+/**
+ * Build the node-side `settings` surface for a scope namespace. `project`
+ * persists under the host's `workspace` storage dir, `global` under its
+ * `global` dir. Each is a file-backed, client-synced key-value store.
+ */
+declare function createNodeSettings<T extends Record<string, any> = Record<string, any>>(context: DevframeNodeContext, namespace: string): DevframeSettings<T>;
+//#endregion
 //#region src/node/storage.d.ts
 interface CreateStorageOptions<T extends object> {
   filepath: string;
@@ -169,4 +185,4 @@ declare function createStorage<T extends object>(options: CreateStorageOptions<T
 declare function isObject(value: unknown): value is Record<string, any>;
 declare function normalizeHttpServerUrl(host: string, port: number | string): string;
 //#endregion
-export { CreateH3DevframeHostOptions, CreateHostContextOptions, CreateStorageOptions, DevframeAgentHost, DevframeDiagnosticsHost, DevframeViewHost, RpcFunctionsHost, StartHttpAndWsOptions, StartedServer, createH3DevframeHost, createHostContext, createRpcSharedStateServerHost, createRpcStreamingServerHost, createStorage, isObject, normalizeHttpServerUrl, startHttpAndWs };
+export { CreateH3DevframeHostOptions, CreateHostContextOptions, CreateStorageOptions, DevframeAgentHost, DevframeDiagnosticsHost, DevframeViewHost, RpcFunctionsHost, StartHttpAndWsOptions, StartedServer, createH3DevframeHost, createHostContext, createNodeSettings, createRpcSharedStateServerHost, createRpcStreamingServerHost, createScopedNodeContext, createStorage, isObject, normalizeHttpServerUrl, startHttpAndWs };

package/dist/node/index.mjs

@@ -1,6 +1,6 @@
-import { a as createRpcStreamingServerHost, c as DevframeAgentHost, i as RpcFunctionsHost, n as createHostContext, o as createRpcSharedStateServerHost, r as DevframeViewHost, s as DevframeDiagnosticsHost, t as createH3DevframeHost } from "../host-h3-Dgpgr1Ul.mjs";
-import { r as createStorage } from "../context-DaKmhhHY.mjs";
-import { t as startHttpAndWs } from "../server-BBaBJaUL.mjs";
+import { t as createStorage } from "../storage-l2ezeend.mjs";
+import { a as DevframeViewHost, c as createRpcSharedStateServerHost, i as createNodeSettings, l as DevframeDiagnosticsHost, n as createHostContext, o as RpcFunctionsHost, r as createScopedNodeContext, s as createRpcStreamingServerHost, t as createH3DevframeHost, u as DevframeAgentHost } from "../host-h3-C5SZlk03.mjs";
+import { t as startHttpAndWs } from "../server-wyY3zh67.mjs";
 import { isIP } from "node:net";
 //#region src/node/utils.ts
 function isObject(value) {
@@ -10,4 +10,4 @@ function normalizeHttpServerUrl(host, port) {
 	return `http://${host === "127.0.0.1" ? "localhost" : isIP(host) === 6 ? `[${host}]` : host}:${port}`;
 }
 //#endregion
-export { DevframeAgentHost, DevframeDiagnosticsHost, DevframeViewHost, RpcFunctionsHost, createH3DevframeHost, createHostContext, createRpcSharedStateServerHost, createRpcStreamingServerHost, createStorage, isObject, normalizeHttpServerUrl, startHttpAndWs };
+export { DevframeAgentHost, DevframeDiagnosticsHost, DevframeViewHost, RpcFunctionsHost, createH3DevframeHost, createHostContext, createNodeSettings, createRpcSharedStateServerHost, createRpcStreamingServerHost, createScopedNodeContext, createStorage, isObject, normalizeHttpServerUrl, startHttpAndWs };

package/dist/recipes/open-helpers.d.mts

@@ -1,4 +1,4 @@
-import { T as Thenable, h as RpcFunctionAgentOptions, s as RpcDump, x as RpcFunctionSetupResult } from "../types-BkkQ0Txg.mjs";
+import { E as Thenable, S as RpcFunctionSetupResult, c as RpcDump, g as RpcFunctionAgentOptions } from "../types-DZEx4ffs.mjs";
 import * as v from "valibot";
 
 //#region src/recipes/open-helpers.d.ts

package/dist/recipes/open-helpers.mjs

@@ -1,6 +1,6 @@
-import { t as launchEditor } from "../launch-editor-BbNhtg7b.mjs";
-import { n as defineRpcFunction } from "../define-CW9gLnyG.mjs";
-import { t as open } from "../open-DiQn6zCH.mjs";
+import { t as launchEditor } from "../launch-editor-CgXBgviI.mjs";
+import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
+import { t as open } from "../open-Dusa2Zzd.mjs";
 import * as v from "valibot";
 //#region src/recipes/open-helpers.ts
 /**

package/dist/revoke-ENfxWkFK.mjs

@@ -0,0 +1,79 @@
+//#region src/utils/crypto-token.ts
+const HEX = "0123456789abcdef";
+/**
+* Generate a high-entropy, URL-safe (hex) random token suitable for use as a
+* bearer credential — e.g. the persistent client auth token or an ephemeral
+* remote-dock token. Defaults to 16 bytes (128 bits) of entropy.
+*/
+function randomToken(byteLength = 16) {
+	const bytes = new Uint8Array(byteLength);
+	globalThis.crypto.getRandomValues(bytes);
+	let out = "";
+	for (let i = 0; i < bytes.length; i++) out += HEX[bytes[i] >> 4] + HEX[bytes[i] & 15];
+	return out;
+}
+/**
+* Generate a uniformly-distributed string of decimal digits using rejection
+* sampling to avoid modulo bias. Intended for short, human-typed one-time
+* codes (e.g. a 6-digit authentication code). Leading zeros are preserved.
+*/
+function randomDigits(length) {
+	const limit = 250;
+	const buf = new Uint8Array(1);
+	let out = "";
+	while (out.length < length) {
+		globalThis.crypto.getRandomValues(buf);
+		if (buf[0] < limit) out += String(buf[0] % 10);
+	}
+	return out;
+}
+/**
+* Constant-time string equality. Compares every character so the comparison
+* time does not depend on the position of the first mismatch, mitigating
+* timing side-channels when verifying secrets.
+*
+* Length is treated as public (it short-circuits on differing lengths), which
+* is appropriate for fixed-length codes and tokens.
+*/
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let mismatch = 0;
+	for (let i = 0; i < a.length; i++) mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return mismatch === 0;
+}
+//#endregion
+//#region src/node/auth/revoke.ts
+/**
+* Flip `isTrusted` to false on any live WS clients connected with `token`
+* and broadcast the `auth:revoked` event so they can react.
+*
+* Shared between persisted-auth revocation and remote-dock token revocation.
+*/
+async function revokeActiveConnectionsForToken(context, token) {
+	const rpcHost = context.rpc;
+	if (!rpcHost?._rpcGroup) return;
+	const affectedSessionIds = /* @__PURE__ */ new Set();
+	for (const client of rpcHost._rpcGroup.clients) if (client.$meta.clientAuthToken === token) {
+		affectedSessionIds.add(client.$meta.id);
+		client.$meta.isTrusted = false;
+		client.$meta.clientAuthToken = void 0;
+	}
+	if (affectedSessionIds.size === 0) return;
+	await rpcHost.broadcast({
+		method: "devframe:auth:revoked",
+		args: [],
+		filter: (client) => affectedSessionIds.has(client.$meta.id)
+	});
+}
+/**
+* Revoke an auth token: remove from storage and notify all connected clients
+* using this token that they are no longer trusted.
+*/
+async function revokeAuthToken(context, storage, token) {
+	storage.mutate((state) => {
+		delete state.trusted[token];
+	});
+	await revokeActiveConnectionsForToken(context, token);
+}
+//#endregion
+export { timingSafeEqual as a, randomToken as i, revokeAuthToken as n, randomDigits as r, revokeActiveConnectionsForToken as t };

package/dist/rpc/dump.d.mts

@@ -1,2 +1,2 @@
-import { a as getDefinitionsWithDumps, c as StaticRpcDumpManifest, d as StaticRpcDumpManifestValue, f as StaticRpcDumpSerialization, i as dumpFunctions, l as StaticRpcDumpManifestQueryEntry, n as serializeDumpError, o as StaticRpcDumpCollection, p as collectStaticRpcDump, r as createClientFromDump, s as StaticRpcDumpFile, t as reviveDumpError, u as StaticRpcDumpManifestStaticEntry } from "../index-DH2sBIwd.mjs";
+import { a as getDefinitionsWithDumps, c as StaticRpcDumpManifest, d as StaticRpcDumpManifestValue, f as StaticRpcDumpSerialization, i as dumpFunctions, l as StaticRpcDumpManifestQueryEntry, n as serializeDumpError, o as StaticRpcDumpCollection, p as collectStaticRpcDump, r as createClientFromDump, s as StaticRpcDumpFile, t as reviveDumpError, u as StaticRpcDumpManifestStaticEntry } from "../index-DXHWuwJk.mjs";
 export { StaticRpcDumpCollection, StaticRpcDumpFile, StaticRpcDumpManifest, StaticRpcDumpManifestQueryEntry, StaticRpcDumpManifestStaticEntry, StaticRpcDumpManifestValue, StaticRpcDumpSerialization, collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError };

package/dist/rpc/dump.mjs

@@ -1,2 +1,2 @@
-import { a as dumpFunctions, c as serializeDumpError, i as createClientFromDump, o as getDefinitionsWithDumps, s as reviveDumpError, t as collectStaticRpcDump } from "../dump-9lKIJTLh.mjs";
+import { a as dumpFunctions, c as serializeDumpError, i as createClientFromDump, o as getDefinitionsWithDumps, s as reviveDumpError, t as collectStaticRpcDump } from "../dump-DoXkj4ku.mjs";
 export { collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError };