devframe 0.5.4 → 0.6.0-beta.2

package/dist/{host-h3-Dgpgr1Ul.mjs → host-h3-C5SZlk03.mjs}

@@ -1,15 +1,15 @@
-import { t as devframeReporter } from "./diagnostics-reporter-CBBZwoMv.mjs";
-import { t as diagnostics } from "./diagnostics-GitRGKbr.mjs";
+import { t as devframeReporter } from "./diagnostics-reporter-CsIG85Q5.mjs";
+import { t as diagnostics } from "./diagnostics-BXwBQmoN.mjs";
 import { RpcFunctionsCollectorBase } from "./rpc/index.mjs";
 import { defineRpcFunction } from "./index.mjs";
-import { i as diagnostics$1, n as nanoid, r as createEventEmitter, t as createSharedState } from "./shared-state-BlBNYziY.mjs";
+import { a as diagnostics$1, i as createEventEmitter, n as createSharedState, r as nanoid, t as createStorage } from "./storage-l2ezeend.mjs";
 import { defineDiagnostics } from "nostics";
 import { isatty } from "node:tty";
 import { formatWithOptions, inspect } from "node:util";
 import { existsSync } from "node:fs";
+import { join } from "pathe";
 import { homedir } from "node:os";
 import process$1 from "node:process";
-import { join } from "pathe";
 //#region src/node/host-agent.ts
 /**
 * Framework-neutral host aggregating the agent-exposed surface of a
@@ -1240,6 +1240,123 @@ const BUILTIN_AGENT_RPC = [
 	})
 ];
 //#endregion
+//#region src/utils/scope.ts
+/** Whether a name is already namespaced (contains a `:` separator). */
+function isQualifiedName(name) {
+	return name.includes(":");
+}
+/**
+* Prefix a bare name with `<namespace>:`. Names that already contain a
+* `:` are returned unchanged, so callers can reference another scope's
+* ids explicitly (e.g. `ctx.rpc.call('other-plugin:fn')`).
+*/
+function qualifyName(namespace, name) {
+	return isQualifiedName(name) ? name : `${namespace}:${name}`;
+}
+//#endregion
+//#region src/node/settings.ts
+const STORAGE_SCOPE = {
+	global: "global",
+	project: "workspace"
+};
+function createNodeSettingsStore(context, namespace, scope) {
+	const stateKey = `devframe:settings:${scope}:${namespace}`;
+	let statePromise;
+	function store() {
+		if (!statePromise) {
+			const filepath = join(context.host.getStorageDir(STORAGE_SCOPE[scope]), "settings", `${namespace}.json`);
+			statePromise = context.rpc.sharedState.get(stateKey, { sharedState: createStorage({
+				filepath,
+				initialValue: {}
+			}) });
+		}
+		return statePromise;
+	}
+	return {
+		async get(key) {
+			return (await store()).value()[key];
+		},
+		async set(key, value) {
+			(await store()).mutate((draft) => {
+				draft[key] = value;
+			});
+		},
+		async delete(key) {
+			(await store()).mutate((draft) => {
+				delete draft[key];
+			});
+		},
+		async all() {
+			return (await store()).value();
+		},
+		async onChange(fn) {
+			return (await store()).on("updated", (full) => fn(full));
+		}
+	};
+}
+/**
+* Build the node-side `settings` surface for a scope namespace. `project`
+* persists under the host's `workspace` storage dir, `global` under its
+* `global` dir. Each is a file-backed, client-synced key-value store.
+*/
+function createNodeSettings(context, namespace) {
+	return {
+		global: createNodeSettingsStore(context, namespace, "global"),
+		project: createNodeSettingsStore(context, namespace, "project")
+	};
+}
+//#endregion
+//#region src/node/scope.ts
+function prefixDefinition(namespace, fn) {
+	if (isQualifiedName(fn.name)) throw diagnostics$1.DF0034({
+		namespace,
+		name: fn.name
+	});
+	return {
+		...fn,
+		name: `${namespace}:${fn.name}`
+	};
+}
+/**
+* Build a namespace-scoped view of a {@link DevframeNodeContext}. Every
+* RPC id, shared-state key, and streaming channel passed through the
+* returned `rpc` surface is auto-namespaced with `<namespace>:`.
+*/
+function createScopedNodeContext(context, namespace) {
+	const base = context.rpc;
+	const rpc = {
+		namespace,
+		register(fn, force) {
+			base.register(prefixDefinition(namespace, fn), force);
+		},
+		update(fn, force) {
+			base.update(prefixDefinition(namespace, fn), force);
+		},
+		call: ((method, ...args) => base.invokeLocal(qualifyName(namespace, method), ...args)),
+		broadcast: ((options) => base.broadcast({
+			...options,
+			method: qualifyName(namespace, options.method)
+		})),
+		sharedState: ((key, options) => base.sharedState.get(qualifyName(namespace, key), options)),
+		streaming: { create: (name, opts) => base.streaming.create(qualifyName(namespace, name), opts) },
+		getCurrentRpcSession: () => base.getCurrentRpcSession()
+	};
+	return {
+		namespace,
+		base: context,
+		cwd: context.cwd,
+		workspaceRoot: context.workspaceRoot,
+		mode: context.mode,
+		host: context.host,
+		rpc,
+		settings: createNodeSettings(context, namespace),
+		views: context.views,
+		diagnostics: context.diagnostics,
+		agent: context.agent,
+		scope: context.scope
+	};
+}
+//#endregion
 //#region src/node/context.ts
 /**
 * Framework- and build-tool-agnostic core of the Devframe node context.
@@ -1259,7 +1376,8 @@ async function createHostContext(options) {
 		rpc: void 0,
 		views: void 0,
 		diagnostics: void 0,
-		agent: void 0
+		agent: void 0,
+		scope: void 0
 	};
 	const rpcHost = new RpcFunctionsHost(context);
 	const viewsHost = new DevframeViewHost(context);
@@ -1268,6 +1386,16 @@ async function createHostContext(options) {
 	context.views = viewsHost;
 	context.diagnostics = diagnosticsHost;
 	context.agent = new DevframeAgentHost(context);
+	const scopedCache = /* @__PURE__ */ new Map();
+	context.scope = ((namespace) => {
+		if (!namespace) return context;
+		let scoped = scopedCache.get(namespace);
+		if (!scoped) {
+			scoped = createScopedNodeContext(context, namespace);
+			scopedCache.set(namespace, scoped);
+		}
+		return scoped;
+	});
 	for (const fn of BUILTIN_AGENT_RPC) rpcHost.register(fn);
 	for (const fn of builtinRpcDeclarations) rpcHost.register(fn);
 	return context;
@@ -1293,4 +1421,4 @@ function createH3DevframeHost(options) {
 	};
 }
 //#endregion
-export { createRpcStreamingServerHost as a, DevframeAgentHost as c, RpcFunctionsHost as i, createHostContext as n, createRpcSharedStateServerHost as o, DevframeViewHost as r, DevframeDiagnosticsHost as s, createH3DevframeHost as t };
+export { DevframeViewHost as a, createRpcSharedStateServerHost as c, createNodeSettings as i, DevframeDiagnosticsHost as l, createHostContext as n, RpcFunctionsHost as o, createScopedNodeContext as r, createRpcStreamingServerHost as s, createH3DevframeHost as t, DevframeAgentHost as u };

package/dist/{index-C7M1hnvL.d.mts → index-CxaPKDXX.d.mts}

@@ -1,5 +1,5 @@
-import { C as RpcFunctionsCollector, S as RpcFunctionType, _ as RpcFunctionDefinitionAny, g as RpcFunctionDefinition, i as RpcArgsSchema, w as RpcReturnSchema, x as RpcFunctionSetupResult } from "./types-BkkQ0Txg.mjs";
-import { a as getDefinitionsWithDumps$1, c as StaticRpcDumpManifest$1, d as StaticRpcDumpManifestValue$1, f as StaticRpcDumpSerialization$1, i as dumpFunctions$1, l as StaticRpcDumpManifestQueryEntry$1, n as serializeDumpError$1, o as StaticRpcDumpCollection$1, p as collectStaticRpcDump$1, r as createClientFromDump$1, s as StaticRpcDumpFile$1, t as reviveDumpError$1, u as StaticRpcDumpManifestStaticEntry$1 } from "./index-DH2sBIwd.mjs";
+import { C as RpcFunctionType, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinition, i as RpcArgsSchema, v as RpcFunctionDefinitionAny, w as RpcFunctionsCollector } from "./types-DZEx4ffs.mjs";
+import { a as getDefinitionsWithDumps$1, c as StaticRpcDumpManifest$1, d as StaticRpcDumpManifestValue$1, f as StaticRpcDumpSerialization$1, i as dumpFunctions$1, l as StaticRpcDumpManifestQueryEntry$1, n as serializeDumpError$1, o as StaticRpcDumpCollection$1, p as collectStaticRpcDump$1, r as createClientFromDump$1, s as StaticRpcDumpFile$1, t as reviveDumpError$1, u as StaticRpcDumpManifestStaticEntry$1 } from "./index-DXHWuwJk.mjs";
 
 //#region src/rpc/cache.d.ts
 interface RpcCacheOptions {

package/dist/{index-DH2sBIwd.d.mts → index-DXHWuwJk.d.mts}

@@ -1,4 +1,4 @@
-import { _ as RpcFunctionDefinitionAny, c as RpcDumpClientOptions, l as RpcDumpCollectionOptions, m as RpcDumpStore, n as BirpcReturn, o as RpcDefinitionsToFunctions, p as RpcDumpRecordError } from "./types-BkkQ0Txg.mjs";
+import { h as RpcDumpStore, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny } from "./types-DZEx4ffs.mjs";
 
 //#region src/rpc/dump/static.d.ts
 type StaticRpcDumpSerialization = 'json' | 'structured-clone';

package/dist/index.d.mts

@@ -1,8 +1,8 @@
-import { $ as AgentResource, B as EntriesToObject, G as DevframeRpcSharedStates, H as Thenable, J as DevframeDiagnosticsDefinition, K as DevframeHost, Q as AgentManifest, U as DevframeRpcClientFunctions, V as PartialWithoutId, W as DevframeRpcServerFunctions, X as DevframeDiagnosticsLogger, Y as DevframeDiagnosticsHost, Z as AgentHandle, _ as RpcStreamingChannel, a as DevframeRuntime, at as DevframeAgentHostEvents, c as defineDevframe, ct as EventsMap, d as DevframeNodeContext, et as AgentResourceContent, f as DevframeNodeRpcSession, g as RpcSharedStateHost, h as RpcSharedStateGetOptions, i as DevframeDeploymentKind, it as DevframeAgentHost, l as ConnectionMeta, m as RpcFunctionsHost, n as DevframeCliOptions, nt as AgentTool, o as DevframeSetupInfo, ot as EventEmitter, p as RpcBroadcastOptions, q as DevframeDefineDiagnosticsOptions, r as DevframeDefinition, rt as AgentToolInput, s as DevframeSpaOptions, st as EventUnsubscribe, t as DevframeBrowserContext, tt as AgentResourceInput, u as DevframeCapabilities, v as RpcStreamingChannelOptions, y as RpcStreamingHost, z as DevframeViewHost } from "./devframe-BuR6n9ZD.mjs";
-import { S as RpcFunctionType, g as RpcFunctionDefinition, h as RpcFunctionAgentOptions, i as RpcArgsSchema, w as RpcReturnSchema } from "./types-BkkQ0Txg.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "./ws-server-C1LjmRnp.mjs";
+import { $ as ScopedServerFunctions, G as DevframeScopedNodeContext, H as EntriesToObject, J as DevframeSettings, K as DevframeScopedNodeRpc, Q as ScopedClientFunctions, S as RpcStreamingHost, St as EventsMap, U as PartialWithoutId, W as Thenable, X as DevframeSettingsStore, Y as DevframeSettingsRegistry, Z as ScopedBroadcastOptions, _ as RpcFunctionsHost, _t as AgentToolInput, a as DevframeDuplicationStrategy, at as DevframeRpcSharedStates, b as RpcStreamingChannel, bt as EventEmitter, c as DevframeSpaOptions, ct as DevframeDiagnosticsDefinition, d as ConnectionMeta, dt as AgentHandle, et as ScopedSharedStates, f as ConnectionMetaWebsocket, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, i as DevframeDeploymentKind, it as DevframeRpcServerFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsHost, m as DevframeNodeContext, mt as AgentResourceContent, n as DevframeCliOptions, nt as DevframeViewHost, o as DevframeRuntime, ot as DevframeHost, p as DevframeCapabilities, pt as AgentResource, q as DevframeScopedStreamingHost, r as DevframeDefinition, rt as DevframeRpcClientFunctions, s as DevframeSetupInfo, st as DevframeDefineDiagnosticsOptions, t as DevframeBrowserContext, tt as SettingsForNamespace, u as defineDevframe, ut as DevframeDiagnosticsLogger, v as RpcSharedStateGetOptions, vt as DevframeAgentHost, x as RpcStreamingChannelOptions, xt as EventUnsubscribe, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "./devframe-D-gr9sBx.mjs";
+import { C as RpcFunctionType, T as RpcReturnSchema, _ as RpcFunctionDefinition, g as RpcFunctionAgentOptions, i as RpcArgsSchema } from "./types-DZEx4ffs.mjs";
+import { t as DevframeNodeRpcSessionMeta } from "./ws-server-Bc2wBHl-.mjs";
 
 //#region src/define.d.ts
 declare const defineRpcFunction: <NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>) => RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>;
 //#endregion
-export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeSetupInfo, DevframeSpaOptions, DevframeViewHost, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, PartialWithoutId, RpcBroadcastOptions, RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, Thenable, defineDevframe, defineRpcFunction };
+export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, PartialWithoutId, RpcBroadcastOptions, RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe, defineRpcFunction };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as createDefineWrapperWithContext } from "./define-CW9gLnyG.mjs";
+import { t as createDefineWrapperWithContext } from "./define-BLWPsH6y.mjs";
 //#region src/define.ts
 const defineRpcFunction = createDefineWrapperWithContext();
 //#endregion

package/dist/{launch-editor-BbNhtg7b.mjs → launch-editor-DPfltGA4.mjs}

@@ -91,21 +91,66 @@ var require_picocolors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports.createColors = createColors;
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/shell-quote@1.8.3/node_modules/shell-quote/quote.js
+//#region ../../node_modules/.pnpm/shell-quote@1.9.0/node_modules/shell-quote/quote.js
 var require_quote = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/** @import { ControlOperator } from './parse' */
+	/** @type {ControlOperator['op'][]} */
+	var OPS = [
+		"||",
+		"&&",
+		";;",
+		"|&",
+		"<(",
+		"<<<",
+		">>",
+		">&",
+		"<&",
+		"&",
+		";",
+		"(",
+		")",
+		"|",
+		"<",
+		">"
+	];
+	var LINE_TERMINATORS = /[\n\r\u2028\u2029]/;
+	var GLOB_SHELL_SPECIAL = /[\s#!"$&'():;<=>@\\^`|]/g;
+	/** @type {import('./quote')} */
 	module.exports = function quote(xs) {
 		return xs.map(function(s) {
 			if (s === "") return "''";
-			if (s && typeof s === "object") return s.op.replace(/(.)/g, "\\$1");
+			if (s && typeof s === "object") {
+				if ("op" in s && s.op === "glob") {
+					if (typeof s.pattern !== "string") throw new TypeError("glob token requires a string `pattern`");
+					if (LINE_TERMINATORS.test(s.pattern)) throw new TypeError("glob `pattern` must not contain line terminators");
+					return s.pattern.replace(GLOB_SHELL_SPECIAL, "\\$&");
+				}
+				if ("op" in s && typeof s.op === "string") {
+					if (OPS.indexOf(s.op) < 0) throw new TypeError("invalid `op` value: " + JSON.stringify(s.op));
+					return s.op.replace(/[\s\S]/g, "\\$&");
+				}
+				if ("comment" in s && typeof s.comment === "string") {
+					if (LINE_TERMINATORS.test(s.comment)) throw new TypeError("`comment` must not contain line terminators");
+					return "#" + s.comment;
+				}
+				throw new TypeError("unrecognized object token shape");
+			}
 			if (/["\s\\]/.test(s) && !/'/.test(s)) return "'" + s.replace(/(['])/g, "\\$1") + "'";
 			if (/["'\s]/.test(s)) return "\"" + s.replace(/(["\\$`!])/g, "\\$1") + "\"";
-			return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}])/g, "$1\\$2");
+			return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}~])/g, "$1\\$2");
 		}).join(" ");
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/shell-quote@1.8.3/node_modules/shell-quote/parse.js
+//#region ../../node_modules/.pnpm/shell-quote@1.9.0/node_modules/shell-quote/parse.js
 var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/**
+	* @import {
+	* 	ControlOperator,
+	* 	Env,
+	* 	GlobPattern,
+	* 	ParseEntry,
+	* } from './parse' */
 	var CONTROL = "(?:" + [
 		"\\|\\|",
 		"\\&\\&",
@@ -130,17 +175,26 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var mult = 4294967296;
 	for (var i = 0; i < 4; i++) TOKEN += (mult * Math.random()).toString(16);
 	var startsWithToken = new RegExp("^" + TOKEN);
+	/**
+	* @param {string} s
+	* @param {RegExp} r
+	*/
 	function matchAll(s, r) {
 		var origIndex = r.lastIndex;
 		var matches = [];
 		var matchObj;
 		while (matchObj = r.exec(s)) {
-			matches.push(matchObj);
+			matches[matches.length] = matchObj;
 			if (r.lastIndex === matchObj.index) r.lastIndex += 1;
 		}
 		r.lastIndex = origIndex;
 		return matches;
 	}
+	/**
+	* @param {Env} env
+	* @param {string} pre
+	* @param {string} key
+	*/
 	function getVar(env, pre, key) {
 		var r = typeof env === "function" ? env(key) : env[key];
 		if (typeof r === "undefined" && key != "") r = "";
@@ -148,6 +202,12 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		if (typeof r === "object") return pre + TOKEN + JSON.stringify(r) + TOKEN;
 		return pre + r;
 	}
+	/**
+	* @param {string} string
+	* @param {Env} [env]
+	* @param {{ escape?: string }} [opts]
+	* @returns {ParseEntry[]}
+	*/
 	function parseInternal(string, env, opts) {
 		if (!opts) opts = {};
 		var BS = opts.escape || "\\";
@@ -160,14 +220,18 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			var s = match[0];
 			if (!s || commented) return;
 			if (controlRE.test(s)) return { op: s };
+			/** @type {string | boolean} */
 			var quote = false;
 			var esc = false;
 			var out = "";
 			var isGlob = false;
+			/** @type {number} */
 			var i;
 			function parseEnvVar() {
 				i += 1;
+				/** @type {number | RegExpMatchArray | null} */
 				var varend;
+				/** @type {string} */
 				var varname;
 				var char = s.charAt(i);
 				if (char === "{") {
@@ -225,25 +289,36 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			};
 			return out;
 		}).reduce(function(prev, arg) {
-			return typeof arg === "undefined" ? prev : prev.concat(arg);
+			if (typeof arg === "undefined") return prev;
+			/** @type {ParseEntry[]} */ [].concat(arg).forEach(function(entry) {
+				prev[prev.length] = entry;
+			});
+			return prev;
 		}, []);
 	}
+	/** @type {import('./parse')} */
 	module.exports = function parse(s, env, opts) {
 		var mapped = parseInternal(s, env, opts);
 		if (typeof env !== "function") return mapped;
 		return mapped.reduce(function(acc, s) {
-			if (typeof s === "object") return acc.concat(s);
+			if (typeof s === "object") {
+				acc[acc.length] = s;
+				return acc;
+			}
 			var xs = s.split(RegExp("(" + TOKEN + ".*?" + TOKEN + ")", "g"));
-			if (xs.length === 1) return acc.concat(xs[0]);
-			return acc.concat(xs.filter(Boolean).map(function(x) {
-				if (startsWithToken.test(x)) return JSON.parse(x.split(TOKEN)[1]);
-				return x;
-			}));
+			if (xs.length === 1) {
+				acc[acc.length] = xs[0];
+				return acc;
+			}
+			xs.filter(Boolean).forEach(function(x) {
+				acc[acc.length] = startsWithToken.test(x) ? JSON.parse(x.split(TOKEN)[1]) : x;
+			});
+			return acc;
 		}, []);
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/shell-quote@1.8.3/node_modules/shell-quote/index.js
+//#region ../../node_modules/.pnpm/shell-quote@1.9.0/node_modules/shell-quote/index.js
 var require_shell_quote = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.quote = require_quote();
 	exports.parse = require_parse();

package/dist/node/auth.d.mts

@@ -1,5 +1,5 @@
-import { P as SharedState, d as DevframeNodeContext, f as DevframeNodeRpcSession } from "../devframe-BuR6n9ZD.mjs";
-import { n as InternalAnonymousAuthStorage } from "../context-DTRcO_UH.mjs";
+import { L as SharedState, h as DevframeNodeRpcSession, m as DevframeNodeContext } from "../devframe-D-gr9sBx.mjs";
+import { n as InternalAnonymousAuthStorage } from "../context-BEVByy_Z.mjs";
 
 //#region src/node/auth/revoke.d.ts
 /**
@@ -16,29 +16,49 @@ declare function revokeActiveConnectionsForToken(context: DevframeNodeContext, t
 declare function revokeAuthToken(context: DevframeNodeContext, storage: SharedState<InternalAnonymousAuthStorage>, token: string): Promise<void>;
 //#endregion
 //#region src/node/auth/state.d.ts
-interface PendingAuthRequest {
-  clientAuthToken: string;
-  session: DevframeNodeRpcSession;
-  ua: string;
-  origin: string;
-  resolve: (result: {
-    isTrusted: boolean;
-  }) => void;
-  abortController: AbortController;
-  timeout: ReturnType<typeof setTimeout>;
-}
-declare function getTempAuthToken(): string;
-declare function refreshTempAuthToken(): string;
-declare function getPendingAuth(): PendingAuthRequest | null;
-declare function setPendingAuth(request: PendingAuthRequest | null): void;
 /**
- * Abort and clean up any existing pending auth request.
+ * The current one-time authentication code. Display this to the user (e.g. in
+ * the dev-server terminal) so they can type it into the browser to authenticate.
+ */
+declare function getTempAuthCode(): string;
+/**
+ * Rotate the authentication code, resetting its expiry window and failed-attempt
+ * counter. Call this when a new authentication flow begins (e.g. when an
+ * untrusted client starts authenticating) so the displayed code is freshly
+ * valid for its full TTL.
  */
-declare function abortPendingAuth(): void;
+declare function refreshTempAuthCode(): string;
 /**
- * Consume the temp auth ID: verify it matches, trust the pending client, and clean up.
- * Returns the client's authToken if successful, null otherwise.
+ * Build a "magic link" authentication URL that embeds a one-time code (OTP) as
+ * a query parameter. Opening it authenticates the client without typing — print
+ * it on startup (devframe stays headless, so the host prints its own banner).
+ * Defaults to the current code; the link is subject to the same TTL.
+ */
+declare function buildOtpAuthUrl(baseUrl: string, code?: string): string;
+/**
+ * Re-authenticate a connection that presents a previously-issued bearer token.
+ * Returns `true` and marks the session trusted when the token is known.
+ *
+ * Used by the `devframe:anonymous:auth` handler so a client that already
+ * authenticated (token persisted in the browser) is trusted on reconnect
+ * without entering the code again.
  */
-declare function consumeTempAuthToken(id: string, storage: SharedState<InternalAnonymousAuthStorage>): string | null;
+declare function verifyAuthToken(token: string, session: DevframeNodeRpcSession, storage: SharedState<InternalAnonymousAuthStorage>): boolean;
+/**
+ * Exchange a one-time authentication code for a fresh, node-issued bearer token.
+ *
+ * On success this mints a high-entropy token, records it in the trusted store,
+ * marks the calling session trusted, rotates the code, and returns the token
+ * for the client to persist. Returns `null` on any failure.
+ *
+ * Because the code is short and human-typed, verification is hardened against
+ * brute force: it enforces a time-to-live, compares in constant time, and
+ * rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
+ * attacker cannot keep guessing against the same code.
+ */
+declare function exchangeTempAuthCode(code: string, session: DevframeNodeRpcSession, info: {
+  ua: string;
+  origin: string;
+}, storage: SharedState<InternalAnonymousAuthStorage>): string | null;
 //#endregion
-export { PendingAuthRequest, abortPendingAuth, consumeTempAuthToken, getPendingAuth, getTempAuthToken, refreshTempAuthToken, revokeActiveConnectionsForToken, revokeAuthToken, setPendingAuth };
+export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/auth.mjs

@@ -1,54 +1,101 @@
-import { n as revokeAuthToken, r as humanId, t as revokeActiveConnectionsForToken } from "../revoke-CL0LSAN9.mjs";
+import { DEVFRAME_OTP_URL_PARAM } from "../constants.mjs";
+import { a as timingSafeEqual, i as randomToken, n as revokeAuthToken, r as randomDigits, t as revokeActiveConnectionsForToken } from "../revoke-ENfxWkFK.mjs";
 //#region src/node/auth/state.ts
-let pendingAuth = null;
-let tempAuthToken = generateTempId();
-function generateTempId() {
-	return humanId();
-}
-function getTempAuthToken() {
-	return tempAuthToken;
+/** Number of decimal digits in a human-typed one-time authentication code. */
+const TEMP_AUTH_CODE_LENGTH = 6;
+/**
+* How long an authentication code stays valid after it is (re)generated. A
+* 6-digit code only has ~20 bits of entropy, so a short lifetime plus the
+* attempt cap below are what keep it brute-force resistant.
+*/
+const TEMP_AUTH_CODE_TTL = 5 * 6e4;
+/** Failed attempts allowed against a single code before it is rotated. */
+const TEMP_AUTH_MAX_ATTEMPTS = 5;
+let tempAuthCode = generateTempCode();
+let tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
+let tempAuthFailedAttempts = 0;
+function generateTempCode() {
+	return randomDigits(TEMP_AUTH_CODE_LENGTH);
 }
-function refreshTempAuthToken() {
-	tempAuthToken = generateTempId();
-	return tempAuthToken;
+/**
+* The current one-time authentication code. Display this to the user (e.g. in
+* the dev-server terminal) so they can type it into the browser to authenticate.
+*/
+function getTempAuthCode() {
+	return tempAuthCode;
 }
-function getPendingAuth() {
-	return pendingAuth;
+/**
+* Rotate the authentication code, resetting its expiry window and failed-attempt
+* counter. Call this when a new authentication flow begins (e.g. when an
+* untrusted client starts authenticating) so the displayed code is freshly
+* valid for its full TTL.
+*/
+function refreshTempAuthCode() {
+	tempAuthCode = generateTempCode();
+	tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
+	tempAuthFailedAttempts = 0;
+	return tempAuthCode;
 }
-function setPendingAuth(request) {
-	pendingAuth = request;
+/**
+* Build a "magic link" authentication URL that embeds a one-time code (OTP) as
+* a query parameter. Opening it authenticates the client without typing — print
+* it on startup (devframe stays headless, so the host prints its own banner).
+* Defaults to the current code; the link is subject to the same TTL.
+*/
+function buildOtpAuthUrl(baseUrl, code = tempAuthCode) {
+	const url = new URL(baseUrl);
+	url.searchParams.set(DEVFRAME_OTP_URL_PARAM, code);
+	return url.href;
 }
 /**
-* Abort and clean up any existing pending auth request.
+* Re-authenticate a connection that presents a previously-issued bearer token.
+* Returns `true` and marks the session trusted when the token is known.
+*
+* Used by the `devframe:anonymous:auth` handler so a client that already
+* authenticated (token persisted in the browser) is trusted on reconnect
+* without entering the code again.
 */
-function abortPendingAuth() {
-	if (pendingAuth) {
-		pendingAuth.abortController.abort();
-		clearTimeout(pendingAuth.timeout);
-		pendingAuth = null;
-	}
+function verifyAuthToken(token, session, storage) {
+	if (!token || !storage.value().trusted[token]) return false;
+	session.meta.clientAuthToken = token;
+	session.meta.isTrusted = true;
+	return true;
 }
 /**
-* Consume the temp auth ID: verify it matches, trust the pending client, and clean up.
-* Returns the client's authToken if successful, null otherwise.
+* Exchange a one-time authentication code for a fresh, node-issued bearer token.
+*
+* On success this mints a high-entropy token, records it in the trusted store,
+* marks the calling session trusted, rotates the code, and returns the token
+* for the client to persist. Returns `null` on any failure.
+*
+* Because the code is short and human-typed, verification is hardened against
+* brute force: it enforces a time-to-live, compares in constant time, and
+* rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
+* attacker cannot keep guessing against the same code.
 */
-function consumeTempAuthToken(id, storage) {
-	if (id !== tempAuthToken || !pendingAuth) return null;
-	const { clientAuthToken, session, ua, origin, resolve } = pendingAuth;
+function exchangeTempAuthCode(code, session, info, storage) {
+	if (Date.now() > tempAuthCodeExpiresAt) {
+		refreshTempAuthCode();
+		return null;
+	}
+	if (!timingSafeEqual(code, tempAuthCode)) {
+		tempAuthFailedAttempts += 1;
+		if (tempAuthFailedAttempts >= TEMP_AUTH_MAX_ATTEMPTS) refreshTempAuthCode();
+		return null;
+	}
+	const authToken = randomToken();
 	storage.mutate((state) => {
-		state.trusted[clientAuthToken] = {
-			authToken: clientAuthToken,
-			ua,
-			origin,
+		state.trusted[authToken] = {
+			authToken,
+			ua: info.ua,
+			origin: info.origin,
 			timestamp: Date.now()
 		};
 	});
-	session.meta.clientAuthToken = clientAuthToken;
+	session.meta.clientAuthToken = authToken;
 	session.meta.isTrusted = true;
-	resolve({ isTrusted: true });
-	abortPendingAuth();
-	refreshTempAuthToken();
-	return clientAuthToken;
+	refreshTempAuthCode();
+	return authToken;
 }
 //#endregion
-export { abortPendingAuth, consumeTempAuthToken, getPendingAuth, getTempAuthToken, refreshTempAuthToken, revokeActiveConnectionsForToken, revokeAuthToken, setPendingAuth };
+export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,5 +1,5 @@
-import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-BuR6n9ZD.mjs";
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-DTRcO_UH.mjs";
+import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-D-gr9sBx.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-BEVByy_Z.mjs";
 
 //#region src/adapters/_shared.d.ts
 /**

package/dist/node/hub-internals.mjs

@@ -1,3 +1,3 @@
-import { n as internalContextMap, t as getInternalContext } from "../context-DaKmhhHY.mjs";
-import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-CUFqO4kJ.mjs";
+import { n as internalContextMap, t as getInternalContext } from "../context-3x_bgBgZ.mjs";
+import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-bWRzeSa0.mjs";
 export { getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };