devframe 0.6.0-beta.1 → 0.6.0-beta.3

package/dist/node/auth.mjs

@@ -1,101 +1,3 @@
-import { DEVFRAME_OTP_URL_PARAM } from "../constants.mjs";
-import { a as timingSafeEqual, i as randomToken, n as revokeAuthToken, r as randomDigits, t as revokeActiveConnectionsForToken } from "../revoke-ENfxWkFK.mjs";
-//#region src/node/auth/state.ts
-/** Number of decimal digits in a human-typed one-time authentication code. */
-const TEMP_AUTH_CODE_LENGTH = 6;
-/**
-* How long an authentication code stays valid after it is (re)generated. A
-* 6-digit code only has ~20 bits of entropy, so a short lifetime plus the
-* attempt cap below are what keep it brute-force resistant.
-*/
-const TEMP_AUTH_CODE_TTL = 5 * 6e4;
-/** Failed attempts allowed against a single code before it is rotated. */
-const TEMP_AUTH_MAX_ATTEMPTS = 5;
-let tempAuthCode = generateTempCode();
-let tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
-let tempAuthFailedAttempts = 0;
-function generateTempCode() {
-	return randomDigits(TEMP_AUTH_CODE_LENGTH);
-}
-/**
-* The current one-time authentication code. Display this to the user (e.g. in
-* the dev-server terminal) so they can type it into the browser to authenticate.
-*/
-function getTempAuthCode() {
-	return tempAuthCode;
-}
-/**
-* Rotate the authentication code, resetting its expiry window and failed-attempt
-* counter. Call this when a new authentication flow begins (e.g. when an
-* untrusted client starts authenticating) so the displayed code is freshly
-* valid for its full TTL.
-*/
-function refreshTempAuthCode() {
-	tempAuthCode = generateTempCode();
-	tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
-	tempAuthFailedAttempts = 0;
-	return tempAuthCode;
-}
-/**
-* Build a "magic link" authentication URL that embeds a one-time code (OTP) as
-* a query parameter. Opening it authenticates the client without typing — print
-* it on startup (devframe stays headless, so the host prints its own banner).
-* Defaults to the current code; the link is subject to the same TTL.
-*/
-function buildOtpAuthUrl(baseUrl, code = tempAuthCode) {
-	const url = new URL(baseUrl);
-	url.searchParams.set(DEVFRAME_OTP_URL_PARAM, code);
-	return url.href;
-}
-/**
-* Re-authenticate a connection that presents a previously-issued bearer token.
-* Returns `true` and marks the session trusted when the token is known.
-*
-* Used by the `devframe:anonymous:auth` handler so a client that already
-* authenticated (token persisted in the browser) is trusted on reconnect
-* without entering the code again.
-*/
-function verifyAuthToken(token, session, storage) {
-	if (!token || !storage.value().trusted[token]) return false;
-	session.meta.clientAuthToken = token;
-	session.meta.isTrusted = true;
-	return true;
-}
-/**
-* Exchange a one-time authentication code for a fresh, node-issued bearer token.
-*
-* On success this mints a high-entropy token, records it in the trusted store,
-* marks the calling session trusted, rotates the code, and returns the token
-* for the client to persist. Returns `null` on any failure.
-*
-* Because the code is short and human-typed, verification is hardened against
-* brute force: it enforces a time-to-live, compares in constant time, and
-* rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
-* attacker cannot keep guessing against the same code.
-*/
-function exchangeTempAuthCode(code, session, info, storage) {
-	if (Date.now() > tempAuthCodeExpiresAt) {
-		refreshTempAuthCode();
-		return null;
-	}
-	if (!timingSafeEqual(code, tempAuthCode)) {
-		tempAuthFailedAttempts += 1;
-		if (tempAuthFailedAttempts >= TEMP_AUTH_MAX_ATTEMPTS) refreshTempAuthCode();
-		return null;
-	}
-	const authToken = randomToken();
-	storage.mutate((state) => {
-		state.trusted[authToken] = {
-			authToken,
-			ua: info.ua,
-			origin: info.origin,
-			timestamp: Date.now()
-		};
-	});
-	session.meta.clientAuthToken = authToken;
-	session.meta.isTrusted = true;
-	refreshTempAuthCode();
-	return authToken;
-}
-//#endregion
+import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-BtQDKTp7.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-WX3HT5a3.mjs";
 export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,5 +1,5 @@
-import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-BwfavB78.mjs";
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-o-TwncyP.mjs";
+import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-DgvncQy2.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-B_I9fMBc.mjs";
 
 //#region src/adapters/_shared.d.ts
 /**

package/dist/node/hub-internals.mjs

@@ -1,3 +1,3 @@
-import { n as internalContextMap, t as getInternalContext } from "../context-3x_bgBgZ.mjs";
+import { n as internalContextMap, t as getInternalContext } from "../context-CKJheEtf.mjs";
 import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-bWRzeSa0.mjs";
 export { getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/index.d.mts

@@ -1,8 +1,8 @@
-import { G as DevframeScopedNodeContext, J as DevframeSettings, L as SharedState, S as RpcStreamingHost, _ as RpcFunctionsHost$1, _t as AgentToolInput, bt as EventEmitter, dt as AgentHandle, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, it as DevframeRpcServerFunctions, lt as DevframeDiagnosticsHost$1, m as DevframeNodeContext, mt as AgentResourceContent, nt as DevframeViewHost$1, ot as DevframeHost, pt as AgentResource, rt as DevframeRpcClientFunctions, ut as DevframeDiagnosticsLogger, vt as DevframeAgentHost$1, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "../devframe-BwfavB78.mjs";
+import { G as DevframeScopedNodeContext, J as DevframeSettings, L as SharedState, S as RpcStreamingHost, _ as RpcFunctionsHost$1, _t as AgentToolInput, bt as EventEmitter, dt as AgentHandle, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, it as DevframeRpcServerFunctions, lt as DevframeDiagnosticsHost$1, m as DevframeNodeContext, mt as AgentResourceContent, nt as DevframeViewHost$1, ot as DevframeHost, pt as AgentResource, rt as DevframeRpcClientFunctions, ut as DevframeDiagnosticsLogger, vt as DevframeAgentHost$1, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "../devframe-DgvncQy2.mjs";
 import { v as RpcFunctionDefinitionAny } from "../types-DZEx4ffs.mjs";
-import { S as RpcFunctionsCollectorBase } from "../index-CxaPKDXX.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "../ws-server-BVVMDo2n.mjs";
-import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-oju7PTi2.mjs";
+import { S as RpcFunctionsCollectorBase } from "../index-Dy6GFDRf.mjs";
+import { t as DevframeNodeRpcSessionMeta } from "../ws-server-Bc2wBHl-.mjs";
+import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-DXPq8q0K.mjs";
 import { BirpcGroup } from "birpc";
 import { AsyncLocalStorage } from "node:async_hooks";
 

package/dist/node/index.mjs

@@ -1,6 +1,6 @@
-import { t as createStorage } from "../storage-l2ezeend.mjs";
-import { a as DevframeViewHost, c as createRpcSharedStateServerHost, i as createNodeSettings, l as DevframeDiagnosticsHost, n as createHostContext, o as RpcFunctionsHost, r as createScopedNodeContext, s as createRpcStreamingServerHost, t as createH3DevframeHost, u as DevframeAgentHost } from "../host-h3-C5SZlk03.mjs";
-import { t as startHttpAndWs } from "../server-wyY3zh67.mjs";
+import { t as createStorage } from "../storage-yrUZaiib.mjs";
+import { a as DevframeViewHost, c as createRpcSharedStateServerHost, i as createNodeSettings, l as DevframeDiagnosticsHost, n as createHostContext, o as RpcFunctionsHost, r as createScopedNodeContext, s as createRpcStreamingServerHost, t as createH3DevframeHost, u as DevframeAgentHost } from "../host-h3-Dsf-Tgwx.mjs";
+import { t as startHttpAndWs } from "../server-BdN41ckC.mjs";
 import { isIP } from "node:net";
 //#region src/node/utils.ts
 function isObject(value) {

package/dist/recipes/interactive-auth.d.mts

@@ -0,0 +1,53 @@
+import { m as DevframeNodeContext } from "../devframe-DgvncQy2.mjs";
+import { c as DevframeAuthHandler } from "../index-B4lNDq5v.mjs";
+
+//#region src/recipes/interactive-auth.d.ts
+interface CreateInteractiveAuthOptions {
+  /**
+   * Static, pre-shared bearer tokens that are always trusted — for CI runs
+   * or shared machines where the interactive code prompt would only get in
+   * the way. Checked in both the handshake handler and the connect-time
+   * hook, alongside tokens minted by a real code exchange.
+   */
+  clientAuthTokens?: string[];
+  /**
+   * Print the current code + magic-link URL. Devframe stays headless, so
+   * there is no default banner printed automatically — call
+   * `auth.printBanner()` yourself once the server is listening. Override
+   * this to customize the format; defaults to a small boxed message on
+   * stdout.
+   */
+  banner?: (info: {
+    code: string;
+    url: string;
+  }) => void;
+  /**
+   * The base URL the magic link should point at. Defaults to
+   * `context.host.resolveOrigin()`.
+   */
+  serverUrl?: () => string;
+}
+/**
+ * Package the interactive OTP auth protocol devframe's primitives
+ * (`exchangeTempAuthCode`, `verifyAuthToken`, `revokeAuthToken`,
+ * `getTempAuthCode`, `buildOtpAuthUrl`) implement into a ready-made
+ * {@link DevframeAuthHandler} — the handshake RPC functions, the resolver
+ * gate, the connect-time trust hook, and the startup banner.
+ *
+ * The auth storage stays internal to this handler — callers never reach into
+ * `devframe/node/hub-internals` themselves.
+ *
+ * ```ts
+ * import { createInteractiveAuth } from 'devframe/recipes/interactive-auth'
+ *
+ * const auth = createInteractiveAuth(ctx)
+ * auth.rpcFunctions.forEach(fn => ctx.rpc.register(fn))
+ * auth.printBanner()
+ *
+ * // wire `auth.authorize` / `auth.onConnect` into your transport, or pass
+ * // the whole handler to `startHttpAndWs({ auth, ... })`.
+ * ```
+ */
+declare function createInteractiveAuth(context: DevframeNodeContext, options?: CreateInteractiveAuthOptions): DevframeAuthHandler;
+//#endregion
+export { CreateInteractiveAuthOptions, createInteractiveAuth };

package/dist/recipes/interactive-auth.mjs

@@ -0,0 +1,132 @@
+import { n as colors } from "../diagnostics-reporter-CsIG85Q5.mjs";
+import { isAnonymousRpcMethod } from "../constants.mjs";
+import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
+import { t as getInternalContext } from "../context-CKJheEtf.mjs";
+import { a as verifyAuthToken, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-WX3HT5a3.mjs";
+import * as v from "valibot";
+//#region src/recipes/interactive-auth.ts
+function defaultBanner(info) {
+	console.log(`\n  ${colors.dim("devframe auth code")}  ${colors.bold(info.code)}\n  ${colors.dim("or open")}       ${colors.cyan(info.url)}\n`);
+}
+/**
+* Package the interactive OTP auth protocol devframe's primitives
+* (`exchangeTempAuthCode`, `verifyAuthToken`, `revokeAuthToken`,
+* `getTempAuthCode`, `buildOtpAuthUrl`) implement into a ready-made
+* {@link DevframeAuthHandler} — the handshake RPC functions, the resolver
+* gate, the connect-time trust hook, and the startup banner.
+*
+* The auth storage stays internal to this handler — callers never reach into
+* `devframe/node/hub-internals` themselves.
+*
+* ```ts
+* import { createInteractiveAuth } from 'devframe/recipes/interactive-auth'
+*
+* const auth = createInteractiveAuth(ctx)
+* auth.rpcFunctions.forEach(fn => ctx.rpc.register(fn))
+* auth.printBanner()
+*
+* // wire `auth.authorize` / `auth.onConnect` into your transport, or pass
+* // the whole handler to `startHttpAndWs({ auth, ... })`.
+* ```
+*/
+function createInteractiveAuth(context, options = {}) {
+	const internal = getInternalContext(context);
+	const storage = internal.storage.auth;
+	const staticTokens = new Set(options.clientAuthTokens ?? []);
+	function isStaticToken(token) {
+		return !!token && staticTokens.has(token);
+	}
+	function resolveServerUrl() {
+		return options.serverUrl?.() ?? context.host.resolveOrigin();
+	}
+	let bannerPrintedForCode;
+	function printBanner() {
+		const code = getTempAuthCode();
+		if (code === bannerPrintedForCode) return;
+		bannerPrintedForCode = code;
+		const url = buildOtpAuthUrl(resolveServerUrl(), code);
+		(options.banner ?? defaultBanner)({
+			code,
+			url
+		});
+	}
+	const anonymousAuth = defineRpcFunction({
+		name: "anonymous:devframe:auth",
+		type: "action",
+		jsonSerializable: true,
+		args: [v.object({
+			authToken: v.string(),
+			ua: v.string(),
+			origin: v.string()
+		})],
+		returns: v.object({ isTrusted: v.boolean() }),
+		handler(params) {
+			const session = context.rpc.getCurrentRpcSession();
+			if (!session) return { isTrusted: false };
+			if (isStaticToken(params.authToken)) {
+				session.meta.clientAuthToken = params.authToken;
+				session.meta.isTrusted = true;
+				return { isTrusted: true };
+			}
+			return { isTrusted: verifyAuthToken(params.authToken, session, storage) };
+		}
+	});
+	const anonymousAuthExchange = defineRpcFunction({
+		name: "anonymous:devframe:auth:exchange",
+		type: "action",
+		jsonSerializable: true,
+		args: [v.object({
+			code: v.string(),
+			ua: v.string(),
+			origin: v.string()
+		})],
+		returns: v.object({ authToken: v.nullable(v.string()) }),
+		handler(params) {
+			const session = context.rpc.getCurrentRpcSession();
+			if (!session) return { authToken: null };
+			const authToken = exchangeTempAuthCode(params.code, session, params, storage);
+			printBanner();
+			return { authToken };
+		}
+	});
+	const revoke = defineRpcFunction({
+		name: "devframe:auth:revoke",
+		type: "action",
+		jsonSerializable: true,
+		args: [],
+		returns: v.void(),
+		async handler() {
+			const token = context.rpc.getCurrentRpcSession()?.meta.clientAuthToken;
+			if (token) await internal.revokeAuthToken(token);
+		}
+	});
+	function authorize(methodName, session) {
+		if (isAnonymousRpcMethod(methodName)) return true;
+		return !!session.meta.isTrusted;
+	}
+	function onConnect(peer, session) {
+		let token;
+		try {
+			token = new URL(peer.request?.url ?? "", "http://localhost").searchParams.get("devframe_auth_token") ?? void 0;
+		} catch {}
+		if (!token) return;
+		if (isStaticToken(token)) {
+			session.meta.clientAuthToken = token;
+			session.meta.isTrusted = true;
+			return;
+		}
+		verifyAuthToken(token, session, storage);
+	}
+	return {
+		rpcFunctions: [
+			anonymousAuth,
+			anonymousAuthExchange,
+			revoke
+		],
+		authorize,
+		onConnect,
+		printBanner
+	};
+}
+//#endregion
+export { createInteractiveAuth };

package/dist/recipes/open-helpers.mjs

@@ -1,6 +1,6 @@
-import { t as launchEditor } from "../launch-editor-CgXBgviI.mjs";
+import { t as launchEditor } from "../launch-editor-DIzaS5EG.mjs";
 import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
-import { t as open } from "../open-Dusa2Zzd.mjs";
+import { t as open } from "../open-Deb5xmIT.mjs";
 import * as v from "valibot";
 //#region src/recipes/open-helpers.ts
 /**

package/dist/{revoke-ENfxWkFK.mjs → revoke-BtQDKTp7.mjs}

@@ -19,7 +19,7 @@ function randomToken(byteLength = 16) {
 */
 function randomDigits(length) {
 	const limit = 250;
-	const buf = new Uint8Array(1);
+	const buf = /* @__PURE__ */ new Uint8Array(1);
 	let out = "";
 	while (out.length < length) {
 		globalThis.crypto.getRandomValues(buf);

package/dist/rpc/dump.mjs

@@ -1,2 +1,2 @@
-import { a as dumpFunctions, c as serializeDumpError, i as createClientFromDump, o as getDefinitionsWithDumps, s as reviveDumpError, t as collectStaticRpcDump } from "../dump-DoXkj4ku.mjs";
+import { a as dumpFunctions, c as serializeDumpError, i as createClientFromDump, o as getDefinitionsWithDumps, s as reviveDumpError, t as collectStaticRpcDump } from "../dump-D09PZb7T.mjs";
 export { collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError };

package/dist/rpc/index.d.mts

@@ -1,3 +1,3 @@
 import { C as RpcFunctionType, E as Thenable, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinition, a as RpcDefinitionsFilter, b as RpcFunctionDefinitionBase, c as RpcDump, d as RpcDumpDefinition, f as RpcDumpGetter, g as RpcFunctionAgentOptions, h as RpcDumpStore, i as RpcArgsSchema, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, p as RpcDumpRecord, r as EntriesToObject, s as RpcDefinitionsToFunctionsWithNamespace, t as BirpcFn, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny, w as RpcFunctionsCollector, x as RpcFunctionDefinitionToFunction, y as RpcFunctionDefinitionAnyWithContext } from "../types-DZEx4ffs.mjs";
-import { C as RpcCacheManager, S as RpcFunctionsCollectorBase, _ as strictJsonStringify, a as StaticRpcDumpManifestStaticEntry, b as createDefineWrapperWithContext, c as collectStaticRpcDump, d as getDefinitionsWithDumps, f as reviveDumpError, g as STRUCTURED_CLONE_PREFIX, h as validateDefinitions, i as StaticRpcDumpManifestQueryEntry, l as createClientFromDump, m as validateDefinition, n as StaticRpcDumpFile, o as StaticRpcDumpManifestValue, p as serializeDumpError, r as StaticRpcDumpManifest, s as StaticRpcDumpSerialization, t as StaticRpcDumpCollection, u as dumpFunctions, v as getRpcHandler, w as RpcCacheOptions, x as defineRpcFunction, y as getRpcResolvedSetupResult } from "../index-CxaPKDXX.mjs";
-export { BirpcFn, BirpcReturn, EntriesToObject, RpcArgsSchema, RpcCacheManager, RpcCacheOptions, RpcDefinitionsFilter, RpcDefinitionsToFunctions, RpcDefinitionsToFunctionsWithNamespace, RpcDump, RpcDumpClientOptions, RpcDumpCollectionOptions, RpcDumpDefinition, RpcDumpGetter, RpcDumpRecord, RpcDumpRecordError, RpcDumpStore, RpcFunctionAgentOptions, RpcFunctionDefinition, RpcFunctionDefinitionAny, RpcFunctionDefinitionAnyWithContext, RpcFunctionDefinitionBase, RpcFunctionDefinitionToFunction, RpcFunctionSetupResult, RpcFunctionType, RpcFunctionsCollector, RpcFunctionsCollectorBase, RpcReturnSchema, STRUCTURED_CLONE_PREFIX, StaticRpcDumpCollection, StaticRpcDumpFile, StaticRpcDumpManifest, StaticRpcDumpManifestQueryEntry, StaticRpcDumpManifestStaticEntry, StaticRpcDumpManifestValue, StaticRpcDumpSerialization, Thenable, collectStaticRpcDump, createClientFromDump, createDefineWrapperWithContext, defineRpcFunction, dumpFunctions, getDefinitionsWithDumps, getRpcHandler, getRpcResolvedSetupResult, reviveDumpError, serializeDumpError, strictJsonStringify, validateDefinition, validateDefinitions };
+import { C as RpcCacheManager, S as RpcFunctionsCollectorBase, _ as strictJsonStringify, a as StaticRpcDumpManifestStaticEntry, b as createDefineWrapperWithContext, c as collectStaticRpcDump, d as getDefinitionsWithDumps, f as reviveDumpError, g as STRUCTURED_CLONE_PREFIX, h as validateDefinitions, i as StaticRpcDumpManifestQueryEntry, l as createClientFromDump, m as validateDefinition, n as StaticRpcDumpFile, o as StaticRpcDumpManifestValue, p as serializeDumpError, r as StaticRpcDumpManifest, s as StaticRpcDumpSerialization, t as StaticRpcDumpCollection, u as dumpFunctions, v as getRpcHandler, w as RpcCacheOptions, x as defineRpcFunction, y as getRpcResolvedSetupResult } from "../index-Dy6GFDRf.mjs";
+export { type BirpcFn, type BirpcReturn, EntriesToObject, RpcArgsSchema, RpcCacheManager, RpcCacheOptions, RpcDefinitionsFilter, RpcDefinitionsToFunctions, RpcDefinitionsToFunctionsWithNamespace, RpcDump, RpcDumpClientOptions, RpcDumpCollectionOptions, RpcDumpDefinition, RpcDumpGetter, RpcDumpRecord, RpcDumpRecordError, RpcDumpStore, RpcFunctionAgentOptions, RpcFunctionDefinition, RpcFunctionDefinitionAny, RpcFunctionDefinitionAnyWithContext, RpcFunctionDefinitionBase, RpcFunctionDefinitionToFunction, RpcFunctionSetupResult, RpcFunctionType, RpcFunctionsCollector, RpcFunctionsCollectorBase, RpcReturnSchema, STRUCTURED_CLONE_PREFIX, StaticRpcDumpCollection, StaticRpcDumpFile, StaticRpcDumpManifest, StaticRpcDumpManifestQueryEntry, StaticRpcDumpManifestStaticEntry, StaticRpcDumpManifestValue, StaticRpcDumpSerialization, Thenable, collectStaticRpcDump, createClientFromDump, createDefineWrapperWithContext, defineRpcFunction, dumpFunctions, getDefinitionsWithDumps, getRpcHandler, getRpcResolvedSetupResult, reviveDumpError, serializeDumpError, strictJsonStringify, validateDefinition, validateDefinitions };

package/dist/rpc/index.mjs

@@ -1,4 +1,4 @@
-import { a as dumpFunctions$1, c as serializeDumpError$1, d as hash, i as createClientFromDump$1, l as validateDefinition, n as getRpcHandler, o as getDefinitionsWithDumps$1, r as getRpcResolvedSetupResult, s as reviveDumpError$1, t as collectStaticRpcDump$1, u as validateDefinitions } from "../dump-DoXkj4ku.mjs";
+import { a as dumpFunctions$1, c as serializeDumpError$1, d as hash, i as createClientFromDump$1, l as validateDefinition, n as getRpcHandler, o as getDefinitionsWithDumps$1, r as getRpcResolvedSetupResult, s as reviveDumpError$1, t as collectStaticRpcDump$1, u as validateDefinitions } from "../dump-D09PZb7T.mjs";
 import { t as diagnostics } from "../diagnostics-BXwBQmoN.mjs";
 import { n as defineRpcFunction, t as createDefineWrapperWithContext } from "../define-BLWPsH6y.mjs";
 import { n as strictJsonStringify, t as STRUCTURED_CLONE_PREFIX } from "../serialization-DpLXCy13.mjs";
@@ -24,6 +24,9 @@ var RpcCacheManager = class {
 		const methodCache = this.cacheMap.get(m);
 		if (methodCache) return methodCache.get(this.keySerializer(a));
 	}
+	has(m, a) {
+		return this.cacheMap.get(m)?.has(this.keySerializer(a)) ?? false;
+	}
 	apply(req, res) {
 		const methodCache = this.cacheMap.get(req.m) || /* @__PURE__ */ new Map();
 		methodCache.set(this.keySerializer(req.a), res);

package/dist/rpc/transports/ws-client.mjs

@@ -1,3 +1,4 @@
+import { DEVFRAME_AUTH_TOKEN_QUERY_PARAM } from "../../constants.mjs";
 import { n as strictJsonStringify } from "../../serialization-DpLXCy13.mjs";
 import { n as structuredCloneStringify, t as structuredCloneParse } from "../../structured-clone-XpHLZ8nr.mjs";
 //#region src/rpc/transports/ws-client.ts
@@ -9,14 +10,15 @@ const EMPTY_DEFS = /* @__PURE__ */ new Map();
 */
 function createWsRpcChannel(options) {
 	let url = options.url;
-	if (options.authToken) url = `${url}?devframe_auth_token=${encodeURIComponent(options.authToken)}`;
+	if (options.authToken) url = `${url}?${DEVFRAME_AUTH_TOKEN_QUERY_PARAM}=${encodeURIComponent(options.authToken)}`;
 	const ws = new WebSocket(url);
 	const { onConnected = NOOP, onError = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS } = options;
 	ws.addEventListener("open", (e) => {
 		onConnected(e);
 	});
 	ws.addEventListener("error", (e) => {
-		onError(e instanceof Error ? e : new Error(e.type));
+		const _e = e instanceof Error ? e : new Error(e.type);
+		onError(_e);
 	});
 	ws.addEventListener("close", (e) => {
 		onDisconnected(e);
@@ -29,14 +31,25 @@ function createWsRpcChannel(options) {
 			});
 		},
 		post: (data) => {
-			if (ws.readyState === WebSocket.OPEN) ws.send(data);
-			else {
-				function handler() {
-					ws.send(data);
-					ws.removeEventListener("open", handler);
+			if (ws.readyState === WebSocket.OPEN) {
+				ws.send(data);
+				return;
+			}
+			if (ws.readyState === WebSocket.CONNECTING) {
+				const onOpen = () => {
+					cleanup();
+					if (ws.readyState === WebSocket.OPEN) ws.send(data);
+				};
+				const onClose = () => cleanup();
+				function cleanup() {
+					ws.removeEventListener("open", onOpen);
+					ws.removeEventListener("close", onClose);
 				}
-				ws.addEventListener("open", handler);
+				ws.addEventListener("open", onOpen);
+				ws.addEventListener("close", onClose);
+				return;
 			}
+			onError(/* @__PURE__ */ new Error("Devframe WebSocket is not open; message dropped"));
 		},
 		serialize: (msg) => {
 			let method;

package/dist/rpc/transports/ws-server.d.mts

@@ -1,2 +1,2 @@
-import { i as attachWsRpcTransport, n as WsRpcTransport, r as WsRpcTransportOptions, t as DevframeNodeRpcSessionMeta } from "../../ws-server-BVVMDo2n.mjs";
-export { DevframeNodeRpcSessionMeta, WsRpcTransport, WsRpcTransportOptions, attachWsRpcTransport };
+import { a as isAllowedOrigin, i as attachWsRpcTransport, n as WsRpcTransport, o as isLoopbackHostname, r as WsRpcTransportOptions, t as DevframeNodeRpcSessionMeta } from "../../ws-server-Bc2wBHl-.mjs";
+export { DevframeNodeRpcSessionMeta, WsRpcTransport, WsRpcTransportOptions, attachWsRpcTransport, isAllowedOrigin, isLoopbackHostname };

package/dist/rpc/transports/ws-server.mjs

@@ -12,6 +12,26 @@ function pathMatches(a, b) {
 	const strip = (p) => p.length > 1 && p.endsWith("/") ? p.slice(0, -1) : p;
 	return strip(a) === strip(b);
 }
+function isLoopbackHostname(hostname) {
+	const h = hostname.replace(/^\[|\]$/g, "");
+	return h === "localhost" || h === "127.0.0.1" || h === "::1" || h.endsWith(".localhost") || h.startsWith("127.");
+}
+/**
+* Default origin policy for a localhost dev tool: allow requests with no
+* `Origin` header (native, non-browser clients), allow any loopback origin
+* (so cross-port localhost dev setups keep working), and allow explicitly
+* configured origins. Everything else — a real remote page in the dev's
+* browser — is rejected.
+*/
+function isAllowedOrigin(origin, allowedOrigins) {
+	if (!origin) return true;
+	if (allowedOrigins.includes(origin)) return true;
+	try {
+		return isLoopbackHostname(new URL(origin).hostname);
+	} catch {
+		return false;
+	}
+}
 /**
 * Route `upgrade` events on a server to the crossws adapter, optionally
 * filtered to a single `path`. Non-matching requests are left untouched so
@@ -19,18 +39,27 @@ function pathMatches(a, b) {
 * them, unless `destroyUnmatched` is set. Returns a detach function that
 * removes the listener.
 */
-function routeUpgrades(server, ws, path, destroyUnmatched) {
+function routeUpgrades(server, ws, path, destroyUnmatched, allowedOrigins) {
 	const listener = (req, socket, head) => {
+		socket.on("error", () => {});
 		if (path) {
 			let pathname = req.url ?? "/";
 			try {
 				pathname = new URL(req.url ?? "/", "http://localhost").pathname;
 			} catch {}
 			if (!pathMatches(pathname, path)) {
-				if (destroyUnmatched) socket.destroy();
+				if (destroyUnmatched) {
+					socket.write("HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n");
+					socket.destroy();
+				}
 				return;
 			}
 		}
+		if (allowedOrigins !== false && !isAllowedOrigin(req.headers.origin, allowedOrigins ?? [])) {
+			socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+			socket.destroy();
+			return;
+		}
 		ws.handleUpgrade(req, socket, head);
 	};
 	server.on("upgrade", listener);
@@ -47,7 +76,7 @@ function routeUpgrades(server, ws, path, destroyUnmatched) {
 * teardown).
 */
 function attachWsRpcTransport(rpcGroup, options = {}) {
-	const { server, port, host = "localhost", path, destroyUnmatched = false, https, onConnected = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS, serialize: serializeOverride, deserialize: deserializeOverride } = options;
+	const { server, port, host = "localhost", path, destroyUnmatched = false, https, allowedOrigins, onConnected = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS, serialize: serializeOverride, deserialize: deserializeOverride } = options;
 	const states = /* @__PURE__ */ new WeakMap();
 	const ws = crossws({ hooks: {
 		open: (peer) => {
@@ -108,17 +137,17 @@ function attachWsRpcTransport(rpcGroup, options = {}) {
 	} });
 	let detach = NOOP;
 	let ownedServer;
-	if (server) detach = routeUpgrades(server, ws, path, destroyUnmatched);
+	if (server) detach = routeUpgrades(server, ws, path, destroyUnmatched, allowedOrigins);
 	else if (https) {
 		ownedServer = createServer$1(https);
-		detach = routeUpgrades(ownedServer, ws, path, true);
+		detach = routeUpgrades(ownedServer, ws, path, true, allowedOrigins);
 		ownedServer.listen(port, host);
 	} else {
 		ownedServer = createServer((_req, res) => {
 			res.writeHead(426, { "content-type": "text/plain" });
 			res.end("Upgrade Required");
 		});
-		detach = routeUpgrades(ownedServer, ws, path, true);
+		detach = routeUpgrades(ownedServer, ws, path, true, allowedOrigins);
 		ownedServer.listen(port, host);
 	}
 	return {
@@ -135,4 +164,4 @@ function attachWsRpcTransport(rpcGroup, options = {}) {
 	};
 }
 //#endregion
-export { attachWsRpcTransport };
+export { attachWsRpcTransport, isAllowedOrigin, isLoopbackHostname };

package/dist/{server-wyY3zh67.mjs → server-BdN41ckC.mjs}

@@ -1,6 +1,7 @@
 import { createRpcServer } from "./rpc/server.mjs";
 import { attachWsRpcTransport } from "./rpc/transports/ws-server.mjs";
-import { t as getInternalContext } from "./context-3x_bgBgZ.mjs";
+import { a as diagnostics } from "./storage-yrUZaiib.mjs";
+import { t as getInternalContext } from "./context-CKJheEtf.mjs";
 import { createServer } from "node:http";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { H3, toNodeHandler } from "h3";
@@ -18,13 +19,23 @@ async function startHttpAndWs(options) {
 	const httpServer = options.server ?? createServer(toNodeHandler(app));
 	const rpcHost = context.rpc;
 	const asyncStorage = new AsyncLocalStorage();
+	const authHandler = typeof options.auth === "object" ? options.auth : void 0;
+	const effectiveAuthorize = options.authorize ?? authHandler?.authorize;
+	if (authHandler) {
+		for (const fn of authHandler.rpcFunctions) if (!rpcHost.definitions.has(fn.name)) rpcHost.register(fn);
+	}
 	const rpcGroup = createRpcServer(rpcHost.functions, { rpcOptions: { resolver(name, fn) {
 		const rpc = this;
 		if (!fn) return void 0;
 		return async function(...args) {
+			const meta = rpc.$meta;
+			if (effectiveAuthorize && !effectiveAuthorize(name, {
+				meta,
+				rpc
+			})) throw diagnostics.DF0036({ name });
 			return await asyncStorage.run({
 				rpc,
-				meta: rpc.$meta
+				meta
 			}, async () => {
 				return (await fn).apply(this, args);
 			});
@@ -38,6 +49,15 @@ async function startHttpAndWs(options) {
 		} : { server: httpServer },
 		path: options.path,
 		destroyUnmatched: ownsHttpServer,
+		allowedOrigins: options.allowedOrigins,
+		onConnected: authHandler || options.onPeerConnect ? (peer, meta) => {
+			const session = {
+				meta,
+				rpc: rpcGroup.clients.find((client) => client.$meta === meta)
+			};
+			authHandler?.onConnect(peer, session);
+			options.onPeerConnect?.(peer, session);
+		} : void 0,
 		onDisconnected: (_peer, meta) => {
 			rpcHost._emitSessionDisconnected(meta);
 		}
@@ -45,8 +65,8 @@ async function startHttpAndWs(options) {
 	rpcHost._rpcGroup = rpcGroup;
 	rpcHost._asyncStorage = asyncStorage;
 	rpcHost._authDisabled = options.auth === false;
-	if (options.auth === false && !rpcHost.definitions.has("devframe:anonymous:auth")) rpcHost.register({
-		name: "devframe:anonymous:auth",
+	if (options.auth === false && !rpcHost.definitions.has("anonymous:devframe:auth")) rpcHost.register({
+		name: "anonymous:devframe:auth",
 		type: "action",
 		handler: () => {
 			const session = rpcHost.getCurrentRpcSession();
@@ -68,12 +88,25 @@ async function startHttpAndWs(options) {
 		port: resolvedPort,
 		app
 	});
+	function connectionMeta() {
+		const jsonSerializableMethods = [];
+		for (const def of rpcHost.definitions.values()) if (def.jsonSerializable === true) jsonSerializableMethods.push(def.name);
+		return {
+			backend: "websocket",
+			websocket: separateWsPort != null ? {
+				port: separateWsPort,
+				path: options.path
+			} : { path: options.path },
+			jsonSerializableMethods
+		};
+	}
 	return {
 		origin,
 		port: resolvedPort,
 		app,
 		ws,
 		rpcGroup,
+		connectionMeta,
 		async close() {
 			await closeWs();
 			if (ownsHttpServer) await new Promise((r) => httpServer.close(() => r()));