devframe 0.6.0-beta.1 → 0.6.0-beta.3

package/dist/index-B4lNDq5v.d.mts

@@ -0,0 +1,107 @@
+import { L as SharedState, h as DevframeNodeRpcSession, m as DevframeNodeContext } from "./devframe-DgvncQy2.mjs";
+import { v as RpcFunctionDefinitionAny } from "./types-DZEx4ffs.mjs";
+import { n as InternalAnonymousAuthStorage } from "./context-B_I9fMBc.mjs";
+import { Peer } from "crossws";
+
+//#region src/node/auth/handler.d.ts
+/**
+ * A ready-made pre-auth RPC handler, as produced by
+ * `devframe/recipes/interactive-auth`'s `createInteractiveAuth`. Bundles
+ * everything a host adapter needs to wire an authenticated server:
+ * the handshake RPC functions, the resolver gate, the connect-time trust
+ * hook, and the startup banner.
+ *
+ * `startHttpAndWs` accepts one of these directly via its `auth` option —
+ * see {@link https://devfra.me | devframe}'s server docs — or a host can
+ * wire the four pieces itself against a lower-level transport.
+ */
+interface DevframeAuthHandler {
+  /**
+   * `anonymous:devframe:auth` + `anonymous:devframe:auth:exchange` (the
+   * handshake) and `devframe:auth:revoke` (self-revoke) — register these on
+   * the RPC host (e.g. `rpcHost.register(fn)` for each).
+   */
+  rpcFunctions: RpcFunctionDefinitionAny[];
+  /**
+   * Resolver gate: whether `methodName` is callable given `session`'s
+   * current trust state. Defaults to allowing any `anonymous:`-prefixed
+   * method (see `isAnonymousRpcMethod`) plus anything once the session is
+   * trusted.
+   */
+  authorize: (methodName: string, session: DevframeNodeRpcSession) => boolean;
+  /**
+   * Connect-time trust: reads a bearer token off the peer's upgrade request
+   * (an `Authorization: Bearer <token>` header, or a static/pre-shared
+   * token from `clientAuthTokens`) and, when valid, marks the session
+   * trusted immediately — before the client's own handshake call.
+   */
+  onConnect: (peer: Peer, session: DevframeNodeRpcSession) => void;
+  /**
+   * Print the current one-time code and its magic-link URL. Devframe stays
+   * headless — call this yourself once the server is listening. Safe to
+   * call repeatedly; it only prints once per code.
+   */
+  printBanner: () => void;
+}
+//#endregion
+//#region src/node/auth/revoke.d.ts
+/**
+ * Flip `isTrusted` to false on any live WS clients connected with `token`
+ * and broadcast the `auth:revoked` event so they can react.
+ *
+ * Shared between persisted-auth revocation and remote-dock token revocation.
+ */
+declare function revokeActiveConnectionsForToken(context: DevframeNodeContext, token: string): Promise<void>;
+/**
+ * Revoke an auth token: remove from storage and notify all connected clients
+ * using this token that they are no longer trusted.
+ */
+declare function revokeAuthToken(context: DevframeNodeContext, storage: SharedState<InternalAnonymousAuthStorage>, token: string): Promise<void>;
+//#endregion
+//#region src/node/auth/state.d.ts
+/**
+ * The current one-time authentication code. Display this to the user (e.g. in
+ * the dev-server terminal) so they can type it into the browser to authenticate.
+ */
+declare function getTempAuthCode(): string;
+/**
+ * Rotate the authentication code, resetting its expiry window and failed-attempt
+ * counter. Call this when a new authentication flow begins (e.g. when an
+ * untrusted client starts authenticating) so the displayed code is freshly
+ * valid for its full TTL.
+ */
+declare function refreshTempAuthCode(): string;
+/**
+ * Build a "magic link" authentication URL that embeds a one-time code (OTP) as
+ * a query parameter. Opening it authenticates the client without typing — print
+ * it on startup (devframe stays headless, so the host prints its own banner).
+ * Defaults to the current code; the link is subject to the same TTL.
+ */
+declare function buildOtpAuthUrl(baseUrl: string, code?: string): string;
+/**
+ * Re-authenticate a connection that presents a previously-issued bearer token.
+ * Returns `true` and marks the session trusted when the token is known.
+ *
+ * Used by the `anonymous:devframe:auth` handler so a client that already
+ * authenticated (token persisted in the browser) is trusted on reconnect
+ * without entering the code again.
+ */
+declare function verifyAuthToken(token: string, session: DevframeNodeRpcSession, storage: SharedState<InternalAnonymousAuthStorage>): boolean;
+/**
+ * Exchange a one-time authentication code for a fresh, node-issued bearer token.
+ *
+ * On success this mints a high-entropy token, records it in the trusted store,
+ * marks the calling session trusted, rotates the code, and returns the token
+ * for the client to persist. Returns `null` on any failure.
+ *
+ * Because the code is short and human-typed, verification is hardened against
+ * brute force: it enforces a time-to-live, compares in constant time, and
+ * rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
+ * attacker cannot keep guessing against the same code.
+ */
+declare function exchangeTempAuthCode(code: string, session: DevframeNodeRpcSession, info: {
+  ua: string;
+  origin: string;
+}, storage: SharedState<InternalAnonymousAuthStorage>): string | null;
+//#endregion
+export { verifyAuthToken as a, DevframeAuthHandler as c, refreshTempAuthCode as i, exchangeTempAuthCode as n, revokeActiveConnectionsForToken as o, getTempAuthCode as r, revokeAuthToken as s, buildOtpAuthUrl as t };

package/dist/{index-CxaPKDXX.d.mts → index-Dy6GFDRf.d.mts}

@@ -16,6 +16,7 @@ declare class RpcCacheManager {
   constructor(options: RpcCacheOptions);
   updateOptions(options: Partial<RpcCacheOptions>): void;
   cached<T>(m: string, a: unknown[]): T | undefined;
+  has(m: string, a: unknown[]): boolean;
   apply(req: {
     m: string;
     a: unknown[];

package/dist/index.d.mts

@@ -1,8 +1,8 @@
-import { $ as ScopedServerFunctions, G as DevframeScopedNodeContext, H as EntriesToObject, J as DevframeSettings, K as DevframeScopedNodeRpc, Q as ScopedClientFunctions, S as RpcStreamingHost, St as EventsMap, U as PartialWithoutId, W as Thenable, X as DevframeSettingsStore, Y as DevframeSettingsRegistry, Z as ScopedBroadcastOptions, _ as RpcFunctionsHost, _t as AgentToolInput, a as DevframeDuplicationStrategy, at as DevframeRpcSharedStates, b as RpcStreamingChannel, bt as EventEmitter, c as DevframeSpaOptions, ct as DevframeDiagnosticsDefinition, d as ConnectionMeta, dt as AgentHandle, et as ScopedSharedStates, f as ConnectionMetaWebsocket, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, i as DevframeDeploymentKind, it as DevframeRpcServerFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsHost, m as DevframeNodeContext, mt as AgentResourceContent, n as DevframeCliOptions, nt as DevframeViewHost, o as DevframeRuntime, ot as DevframeHost, p as DevframeCapabilities, pt as AgentResource, q as DevframeScopedStreamingHost, r as DevframeDefinition, rt as DevframeRpcClientFunctions, s as DevframeSetupInfo, st as DevframeDefineDiagnosticsOptions, t as DevframeBrowserContext, tt as SettingsForNamespace, u as defineDevframe, ut as DevframeDiagnosticsLogger, v as RpcSharedStateGetOptions, vt as DevframeAgentHost, x as RpcStreamingChannelOptions, xt as EventUnsubscribe, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "./devframe-BwfavB78.mjs";
+import { $ as ScopedServerFunctions, G as DevframeScopedNodeContext, H as EntriesToObject, J as DevframeSettings, K as DevframeScopedNodeRpc, Q as ScopedClientFunctions, S as RpcStreamingHost, St as EventsMap, U as PartialWithoutId, W as Thenable, X as DevframeSettingsStore, Y as DevframeSettingsRegistry, Z as ScopedBroadcastOptions, _ as RpcFunctionsHost, _t as AgentToolInput, a as DevframeDuplicationStrategy, at as DevframeRpcSharedStates, b as RpcStreamingChannel, bt as EventEmitter, c as DevframeSpaOptions, ct as DevframeDiagnosticsDefinition, d as ConnectionMeta, dt as AgentHandle, et as ScopedSharedStates, f as ConnectionMetaWebsocket, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, i as DevframeDeploymentKind, it as DevframeRpcServerFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsHost, m as DevframeNodeContext, mt as AgentResourceContent, n as DevframeCliOptions, nt as DevframeViewHost, o as DevframeRuntime, ot as DevframeHost, p as DevframeCapabilities, pt as AgentResource, q as DevframeScopedStreamingHost, r as DevframeDefinition, rt as DevframeRpcClientFunctions, s as DevframeSetupInfo, st as DevframeDefineDiagnosticsOptions, t as DevframeBrowserContext, tt as SettingsForNamespace, u as defineDevframe, ut as DevframeDiagnosticsLogger, v as RpcSharedStateGetOptions, vt as DevframeAgentHost, x as RpcStreamingChannelOptions, xt as EventUnsubscribe, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "./devframe-DgvncQy2.mjs";
 import { C as RpcFunctionType, T as RpcReturnSchema, _ as RpcFunctionDefinition, g as RpcFunctionAgentOptions, i as RpcArgsSchema } from "./types-DZEx4ffs.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "./ws-server-BVVMDo2n.mjs";
+import { t as DevframeNodeRpcSessionMeta } from "./ws-server-Bc2wBHl-.mjs";
 
 //#region src/define.d.ts
 declare const defineRpcFunction: <NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>) => RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>;
 //#endregion
-export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, PartialWithoutId, RpcBroadcastOptions, RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe, defineRpcFunction };
+export { type AgentHandle, type AgentManifest, type AgentResource, type AgentResourceContent, type AgentResourceInput, type AgentTool, type AgentToolInput, type ConnectionMeta, type ConnectionMetaWebsocket, type DevframeAgentHost, type DevframeAgentHostEvents, type DevframeBrowserContext, type DevframeCapabilities, type DevframeCliOptions, type DevframeDefineDiagnosticsOptions, type DevframeDefinition, type DevframeDeploymentKind, type DevframeDiagnosticsDefinition, type DevframeDiagnosticsHost, type DevframeDiagnosticsLogger, type DevframeDuplicationStrategy, type DevframeHost, type DevframeNodeContext, type DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, type DevframeRpcClientFunctions, type DevframeRpcServerFunctions, type DevframeRpcSharedStates, type DevframeRuntime, type DevframeScopedNodeContext, type DevframeScopedNodeRpc, type DevframeScopedStreamingHost, type DevframeSettings, type DevframeSettingsRegistry, type DevframeSettingsStore, type DevframeSetupInfo, type DevframeSpaOptions, type DevframeViewHost, type DevframeWsOptions, type EntriesToObject, type EventEmitter, type EventUnsubscribe, type EventsMap, type PartialWithoutId, type RpcBroadcastOptions, type RpcFunctionAgentOptions, type RpcFunctionsHost, type RpcSharedStateGetOptions, type RpcSharedStateHost, type RpcStreamingChannel, type RpcStreamingChannelOptions, type RpcStreamingHost, type ScopedBroadcastOptions, type ScopedClientFunctions, type ScopedServerFunctions, type ScopedSharedStates, type SettingsForNamespace, type Thenable, type defineDevframe, defineRpcFunction };

package/dist/{launch-editor-CgXBgviI.mjs → launch-editor-DIzaS5EG.mjs}

@@ -21,7 +21,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	value: mod,
 	enumerable: true
 }) : target, mod));
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
 //#region ../../node_modules/.pnpm/picocolors@1.1.1/node_modules/picocolors/picocolors.js
 var require_picocolors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -91,21 +91,66 @@ var require_picocolors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports.createColors = createColors;
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/shell-quote@1.8.3/node_modules/shell-quote/quote.js
+//#region ../../node_modules/.pnpm/shell-quote@1.9.0/node_modules/shell-quote/quote.js
 var require_quote = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/** @import { ControlOperator } from './parse' */
+	/** @type {ControlOperator['op'][]} */
+	var OPS = [
+		"||",
+		"&&",
+		";;",
+		"|&",
+		"<(",
+		"<<<",
+		">>",
+		">&",
+		"<&",
+		"&",
+		";",
+		"(",
+		")",
+		"|",
+		"<",
+		">"
+	];
+	var LINE_TERMINATORS = /[\n\r\u2028\u2029]/;
+	var GLOB_SHELL_SPECIAL = /[\s#!"$&'():;<=>@\\^`|]/g;
+	/** @type {import('./quote')} */
 	module.exports = function quote(xs) {
 		return xs.map(function(s) {
 			if (s === "") return "''";
-			if (s && typeof s === "object") return s.op.replace(/(.)/g, "\\$1");
+			if (s && typeof s === "object") {
+				if ("op" in s && s.op === "glob") {
+					if (typeof s.pattern !== "string") throw new TypeError("glob token requires a string `pattern`");
+					if (LINE_TERMINATORS.test(s.pattern)) throw new TypeError("glob `pattern` must not contain line terminators");
+					return s.pattern.replace(GLOB_SHELL_SPECIAL, "\\$&");
+				}
+				if ("op" in s && typeof s.op === "string") {
+					if (OPS.indexOf(s.op) < 0) throw new TypeError("invalid `op` value: " + JSON.stringify(s.op));
+					return s.op.replace(/[\s\S]/g, "\\$&");
+				}
+				if ("comment" in s && typeof s.comment === "string") {
+					if (LINE_TERMINATORS.test(s.comment)) throw new TypeError("`comment` must not contain line terminators");
+					return "#" + s.comment;
+				}
+				throw new TypeError("unrecognized object token shape");
+			}
 			if (/["\s\\]/.test(s) && !/'/.test(s)) return "'" + s.replace(/(['])/g, "\\$1") + "'";
 			if (/["'\s]/.test(s)) return "\"" + s.replace(/(["\\$`!])/g, "\\$1") + "\"";
-			return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}])/g, "$1\\$2");
+			return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}~])/g, "$1\\$2");
 		}).join(" ");
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/shell-quote@1.8.3/node_modules/shell-quote/parse.js
+//#region ../../node_modules/.pnpm/shell-quote@1.9.0/node_modules/shell-quote/parse.js
 var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/**
+	* @import {
+	* 	ControlOperator,
+	* 	Env,
+	* 	GlobPattern,
+	* 	ParseEntry,
+	* } from './parse' */
 	var CONTROL = "(?:" + [
 		"\\|\\|",
 		"\\&\\&",
@@ -130,17 +175,26 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var mult = 4294967296;
 	for (var i = 0; i < 4; i++) TOKEN += (mult * Math.random()).toString(16);
 	var startsWithToken = new RegExp("^" + TOKEN);
+	/**
+	* @param {string} s
+	* @param {RegExp} r
+	*/
 	function matchAll(s, r) {
 		var origIndex = r.lastIndex;
 		var matches = [];
 		var matchObj;
 		while (matchObj = r.exec(s)) {
-			matches.push(matchObj);
+			matches[matches.length] = matchObj;
 			if (r.lastIndex === matchObj.index) r.lastIndex += 1;
 		}
 		r.lastIndex = origIndex;
 		return matches;
 	}
+	/**
+	* @param {Env} env
+	* @param {string} pre
+	* @param {string} key
+	*/
 	function getVar(env, pre, key) {
 		var r = typeof env === "function" ? env(key) : env[key];
 		if (typeof r === "undefined" && key != "") r = "";
@@ -148,6 +202,12 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		if (typeof r === "object") return pre + TOKEN + JSON.stringify(r) + TOKEN;
 		return pre + r;
 	}
+	/**
+	* @param {string} string
+	* @param {Env} [env]
+	* @param {{ escape?: string }} [opts]
+	* @returns {ParseEntry[]}
+	*/
 	function parseInternal(string, env, opts) {
 		if (!opts) opts = {};
 		var BS = opts.escape || "\\";
@@ -160,14 +220,18 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			var s = match[0];
 			if (!s || commented) return;
 			if (controlRE.test(s)) return { op: s };
+			/** @type {string | boolean} */
 			var quote = false;
 			var esc = false;
 			var out = "";
 			var isGlob = false;
+			/** @type {number} */
 			var i;
 			function parseEnvVar() {
 				i += 1;
+				/** @type {number | RegExpMatchArray | null} */
 				var varend;
+				/** @type {string} */
 				var varname;
 				var char = s.charAt(i);
 				if (char === "{") {
@@ -225,31 +289,42 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			};
 			return out;
 		}).reduce(function(prev, arg) {
-			return typeof arg === "undefined" ? prev : prev.concat(arg);
+			if (typeof arg === "undefined") return prev;
+			/** @type {ParseEntry[]} */ [].concat(arg).forEach(function(entry) {
+				prev[prev.length] = entry;
+			});
+			return prev;
 		}, []);
 	}
+	/** @type {import('./parse')} */
 	module.exports = function parse(s, env, opts) {
 		var mapped = parseInternal(s, env, opts);
 		if (typeof env !== "function") return mapped;
 		return mapped.reduce(function(acc, s) {
-			if (typeof s === "object") return acc.concat(s);
+			if (typeof s === "object") {
+				acc[acc.length] = s;
+				return acc;
+			}
 			var xs = s.split(RegExp("(" + TOKEN + ".*?" + TOKEN + ")", "g"));
-			if (xs.length === 1) return acc.concat(xs[0]);
-			return acc.concat(xs.filter(Boolean).map(function(x) {
-				if (startsWithToken.test(x)) return JSON.parse(x.split(TOKEN)[1]);
-				return x;
-			}));
+			if (xs.length === 1) {
+				acc[acc.length] = xs[0];
+				return acc;
+			}
+			xs.filter(Boolean).forEach(function(x) {
+				acc[acc.length] = startsWithToken.test(x) ? JSON.parse(x.split(TOKEN)[1]) : x;
+			});
+			return acc;
 		}, []);
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/shell-quote@1.8.3/node_modules/shell-quote/index.js
+//#region ../../node_modules/.pnpm/shell-quote@1.9.0/node_modules/shell-quote/index.js
 var require_shell_quote = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.quote = require_quote();
 	exports.parse = require_parse();
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.13.2/node_modules/launch-editor/editor-info/macos.js
+//#region ../../node_modules/.pnpm/launch-editor@2.14.1/node_modules/launch-editor/editor-info/macos.js
 var require_macos = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = {
 		"/Applications/Atom.app/Contents/MacOS/Atom": "atom",
@@ -284,7 +359,7 @@ var require_macos = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.13.2/node_modules/launch-editor/editor-info/linux.js
+//#region ../../node_modules/.pnpm/launch-editor@2.14.1/node_modules/launch-editor/editor-info/linux.js
 var require_linux = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = {
 		atom: "atom",
@@ -318,7 +393,7 @@ var require_linux = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.13.2/node_modules/launch-editor/editor-info/windows.js
+//#region ../../node_modules/.pnpm/launch-editor@2.14.1/node_modules/launch-editor/editor-info/windows.js
 var require_windows = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = [
 		"Brackets.exe",
@@ -351,7 +426,7 @@ var require_windows = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	];
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.13.2/node_modules/launch-editor/guess.js
+//#region ../../node_modules/.pnpm/launch-editor@2.14.1/node_modules/launch-editor/guess.js
 var require_guess = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const path$2 = __require("path");
 	const shellQuote = require_shell_quote();
@@ -359,60 +434,74 @@ var require_guess = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const COMMON_EDITORS_MACOS = require_macos();
 	const COMMON_EDITORS_LINUX = require_linux();
 	const COMMON_EDITORS_WIN = require_windows();
-	module.exports = function guessEditor(specifiedEditor) {
+	function getEditorFromMacProcesses(output) {
+		const processNames = Object.keys(COMMON_EDITORS_MACOS);
+		const processList = output.split("\n");
+		for (let i = 0; i < processNames.length; i++) {
+			const processName = processNames[i];
+			if (processList.includes(processName)) return COMMON_EDITORS_MACOS[processName];
+			const processNameWithoutApplications = processName.replace("/Applications", "");
+			if (output.indexOf(processNameWithoutApplications) !== -1) {
+				if (processName !== COMMON_EDITORS_MACOS[processName]) return COMMON_EDITORS_MACOS[processName];
+				const runningProcess = processList.find((procName) => procName.endsWith(processNameWithoutApplications));
+				if (runningProcess !== void 0) return runningProcess;
+			}
+		}
+	}
+	function getEditorFromWindowsProcesses(output) {
+		const runningProcesses = output.split("\r\n");
+		for (let i = 0; i < runningProcesses.length; i++) {
+			const fullProcessPath = runningProcesses[i].trim();
+			const shortProcessName = path$2.win32.basename(fullProcessPath);
+			if (COMMON_EDITORS_WIN.indexOf(shortProcessName) !== -1) return fullProcessPath;
+		}
+	}
+	function getEditorFromLinuxProcesses(output) {
+		const processNames = Object.keys(COMMON_EDITORS_LINUX);
+		for (let i = 0; i < processNames.length; i++) {
+			const processName = processNames[i];
+			if (output.indexOf(processName) !== -1) return COMMON_EDITORS_LINUX[processName];
+		}
+	}
+	function guessEditor(specifiedEditor) {
 		if (specifiedEditor) return shellQuote.parse(specifiedEditor);
 		if (process.env.LAUNCH_EDITOR) return [process.env.LAUNCH_EDITOR];
 		if (process.versions.webcontainer) return [process.env.EDITOR || "code"];
 		try {
 			if (process.platform === "darwin") {
-				const output = childProcess$1.execSync("ps x -o comm=", { stdio: [
+				const editor = getEditorFromMacProcesses(childProcess$1.execSync("ps x -o comm=", { stdio: [
 					"pipe",
 					"pipe",
 					"ignore"
-				] }).toString();
-				const processNames = Object.keys(COMMON_EDITORS_MACOS);
-				const processList = output.split("\n");
-				for (let i = 0; i < processNames.length; i++) {
-					const processName = processNames[i];
-					if (processList.includes(processName)) return [COMMON_EDITORS_MACOS[processName]];
-					const processNameWithoutApplications = processName.replace("/Applications", "");
-					if (output.indexOf(processNameWithoutApplications) !== -1) {
-						if (processName !== COMMON_EDITORS_MACOS[processName]) return [COMMON_EDITORS_MACOS[processName]];
-						const runningProcess = processList.find((procName) => procName.endsWith(processNameWithoutApplications));
-						if (runningProcess !== void 0) return [runningProcess];
-					}
-				}
+				] }).toString());
+				if (editor !== void 0) return [editor];
 			} else if (process.platform === "win32") {
-				const runningProcesses = childProcess$1.execSync("powershell -NoProfile -Command \"[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-CimInstance -Query \\\"select executablepath from win32_process where executablepath is not null\\\" | % { $_.ExecutablePath }\"", { stdio: [
+				const editor = getEditorFromWindowsProcesses(childProcess$1.execSync("powershell -NoProfile -Command \"[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-CimInstance -Query \\\"select executablepath from win32_process where executablepath is not null\\\" | % { $_.ExecutablePath }\"", { stdio: [
 					"pipe",
 					"pipe",
 					"ignore"
-				] }).toString().split("\r\n");
-				for (let i = 0; i < runningProcesses.length; i++) {
-					const fullProcessPath = runningProcesses[i].trim();
-					const shortProcessName = path$2.basename(fullProcessPath);
-					if (COMMON_EDITORS_WIN.indexOf(shortProcessName) !== -1) return [fullProcessPath];
-				}
+				] }).toString());
+				if (editor !== void 0) return [editor];
 			} else if (process.platform === "linux") {
-				const output = childProcess$1.execSync("ps x --no-heading -o comm --sort=comm", { stdio: [
+				const editor = getEditorFromLinuxProcesses(childProcess$1.execSync("ps x --no-heading -o comm --sort=comm", { stdio: [
 					"pipe",
 					"pipe",
 					"ignore"
-				] }).toString();
-				const processNames = Object.keys(COMMON_EDITORS_LINUX);
-				for (let i = 0; i < processNames.length; i++) {
-					const processName = processNames[i];
-					if (output.indexOf(processName) !== -1) return [COMMON_EDITORS_LINUX[processName]];
-				}
+				] }).toString());
+				if (editor !== void 0) return [editor];
 			}
 		} catch (ignoreError) {}
 		if (process.env.VISUAL) return [process.env.VISUAL];
 		else if (process.env.EDITOR) return [process.env.EDITOR];
 		return [null];
-	};
+	}
+	module.exports = guessEditor;
+	module.exports.getEditorFromMacProcesses = getEditorFromMacProcesses;
+	module.exports.getEditorFromWindowsProcesses = getEditorFromWindowsProcesses;
+	module.exports.getEditorFromLinuxProcesses = getEditorFromLinuxProcesses;
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.13.2/node_modules/launch-editor/get-args.js
+//#region ../../node_modules/.pnpm/launch-editor@2.14.1/node_modules/launch-editor/get-args.js
 var require_get_args = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const path$1 = __require("path");
 	module.exports = function getArgumentsForPosition(editor, fileName, lineNumber, columnNumber = 1) {
@@ -540,11 +629,12 @@ var import_launch_editor = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 			columnNumber: match && match[3]
 		};
 	}
-	let _childProcess = null;
+	let currentChildProcess = null;
 	function launchEditor(file, specifiedEditor, onErrorCallback) {
 		const parsed = parseFile(file);
 		let { fileName } = parsed;
 		const { lineNumber, columnNumber } = parsed;
+		if (process.platform === "win32" && path.resolve(fileName).startsWith("\\\\")) return onErrorCallback(fileName, "UNC paths are not supported on Windows to avoid security issues. See https://github.com/vitejs/launch-editor/tree/main/packages/launch-editor#unc-paths-on-windows for details.");
 		if (!fs.existsSync(fileName)) return;
 		if (typeof specifiedEditor === "function") {
 			onErrorCallback = specifiedEditor;
@@ -561,7 +651,7 @@ var import_launch_editor = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 			const extraArgs = getArgumentsForPosition(editor, fileName, lineNumber, columnNumber);
 			args.push.apply(args, extraArgs);
 		} else args.push(fileName);
-		if (_childProcess && isTerminalEditor(editor)) _childProcess.kill("SIGKILL");
+		if (currentChildProcess && isTerminalEditor(editor)) currentChildProcess.kill("SIGKILL");
 		if (process.platform === "win32") {
 			function escapeCmdArgs(cmdArgs) {
 				return cmdArgs.replace(/([&|<>,;=^])/g, "^$1");
@@ -572,16 +662,16 @@ var import_launch_editor = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 				return str;
 			}
 			const launchCommand = [editor, ...args.map(escapeCmdArgs)].map(doubleQuoteIfNeeded).join(" ");
-			_childProcess = childProcess.exec(launchCommand, {
+			currentChildProcess = childProcess.exec(launchCommand, {
 				stdio: "inherit",
 				shell: true
 			});
-		} else _childProcess = childProcess.spawn(editor, args, { stdio: "inherit" });
-		_childProcess.on("exit", function(errorCode) {
-			_childProcess = null;
+		} else currentChildProcess = childProcess.spawn(editor, args, { stdio: "inherit" });
+		currentChildProcess.on("exit", function(errorCode) {
+			currentChildProcess = null;
 			if (errorCode) onErrorCallback(fileName, "(code " + errorCode + ")");
 		});
-		_childProcess.on("error", function(error) {
+		currentChildProcess.on("error", function(error) {
 			let { code, message } = error;
 			if ("ENOENT" === code) message = `${message} ('${editor}' command does not exist in 'PATH')`;
 			onErrorCallback(fileName, message);

package/dist/node/auth.d.mts

@@ -1,64 +1,2 @@
-import { L as SharedState, h as DevframeNodeRpcSession, m as DevframeNodeContext } from "../devframe-BwfavB78.mjs";
-import { n as InternalAnonymousAuthStorage } from "../context-o-TwncyP.mjs";
-
-//#region src/node/auth/revoke.d.ts
-/**
- * Flip `isTrusted` to false on any live WS clients connected with `token`
- * and broadcast the `auth:revoked` event so they can react.
- *
- * Shared between persisted-auth revocation and remote-dock token revocation.
- */
-declare function revokeActiveConnectionsForToken(context: DevframeNodeContext, token: string): Promise<void>;
-/**
- * Revoke an auth token: remove from storage and notify all connected clients
- * using this token that they are no longer trusted.
- */
-declare function revokeAuthToken(context: DevframeNodeContext, storage: SharedState<InternalAnonymousAuthStorage>, token: string): Promise<void>;
-//#endregion
-//#region src/node/auth/state.d.ts
-/**
- * The current one-time authentication code. Display this to the user (e.g. in
- * the dev-server terminal) so they can type it into the browser to authenticate.
- */
-declare function getTempAuthCode(): string;
-/**
- * Rotate the authentication code, resetting its expiry window and failed-attempt
- * counter. Call this when a new authentication flow begins (e.g. when an
- * untrusted client starts authenticating) so the displayed code is freshly
- * valid for its full TTL.
- */
-declare function refreshTempAuthCode(): string;
-/**
- * Build a "magic link" authentication URL that embeds a one-time code (OTP) as
- * a query parameter. Opening it authenticates the client without typing — print
- * it on startup (devframe stays headless, so the host prints its own banner).
- * Defaults to the current code; the link is subject to the same TTL.
- */
-declare function buildOtpAuthUrl(baseUrl: string, code?: string): string;
-/**
- * Re-authenticate a connection that presents a previously-issued bearer token.
- * Returns `true` and marks the session trusted when the token is known.
- *
- * Used by the `devframe:anonymous:auth` handler so a client that already
- * authenticated (token persisted in the browser) is trusted on reconnect
- * without entering the code again.
- */
-declare function verifyAuthToken(token: string, session: DevframeNodeRpcSession, storage: SharedState<InternalAnonymousAuthStorage>): boolean;
-/**
- * Exchange a one-time authentication code for a fresh, node-issued bearer token.
- *
- * On success this mints a high-entropy token, records it in the trusted store,
- * marks the calling session trusted, rotates the code, and returns the token
- * for the client to persist. Returns `null` on any failure.
- *
- * Because the code is short and human-typed, verification is hardened against
- * brute force: it enforces a time-to-live, compares in constant time, and
- * rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
- * attacker cannot keep guessing against the same code.
- */
-declare function exchangeTempAuthCode(code: string, session: DevframeNodeRpcSession, info: {
-  ua: string;
-  origin: string;
-}, storage: SharedState<InternalAnonymousAuthStorage>): string | null;
-//#endregion
-export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };
+import { a as verifyAuthToken, c as DevframeAuthHandler, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-B4lNDq5v.mjs";
+export { DevframeAuthHandler, buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };