devframe 0.6.0-beta.1 → 0.6.0-beta.3

package/dist/server-DXPq8q0K.d.mts

@@ -0,0 +1,121 @@
+import { d as ConnectionMeta, h as DevframeNodeRpcSession, it as DevframeRpcServerFunctions, m as DevframeNodeContext, rt as DevframeRpcClientFunctions } from "./devframe-DgvncQy2.mjs";
+import { c as DevframeAuthHandler } from "./index-B4lNDq5v.mjs";
+import { BirpcGroup } from "birpc";
+import { Peer } from "crossws";
+import { NodeAdapter } from "crossws/adapters/node";
+import { Server } from "node:http";
+import { H3 } from "h3";
+
+//#region src/node/server.d.ts
+interface StartHttpAndWsOptions {
+  context: DevframeNodeContext;
+  host?: string;
+  port: number;
+  /**
+   * Optional h3 app to mount on. When omitted a fresh one is created;
+   * when provided, callers can add their own routes (static handlers,
+   * auth middleware, etc.) first.
+   */
+  app?: H3;
+  /**
+   * Bind the WS endpoint to a single upgrade route (e.g. `/__devframe_ws`) instead of
+   * claiming every upgrade on the port. This lets the socket share a server
+   * with other upgrade handlers (Vite HMR, a host framework's own sockets)
+   * and is what the SPA's `__connection.json` points at. When omitted, the WS
+   * server handles every upgrade on the port (legacy behaviour).
+   */
+  path?: string;
+  /**
+   * Bind the WS endpoint on its own port instead of sharing the HTTP server's.
+   * The HTTP/SPA server still listens on `port`; the socket gets a dedicated
+   * `ws` server on `wsPort` (same `host`). Use this for the "different port"
+   * connection scenario. Ignored when a `server` is supplied.
+   */
+  wsPort?: number;
+  /**
+   * Mount the WS endpoint onto an existing HTTP server, sharing its port,
+   * rather than creating and listening on a fresh one. Use this to embed
+   * devframe's RPC socket inside a host server (e.g. a Vite dev server) — pair
+   * it with `path` so it coexists with the host's routes. The caller owns the
+   * server's lifecycle: {@link StartedServer.close} detaches devframe's upgrade
+   * listener but leaves the host server running. When set, `host`/`port` are
+   * only used to report the resolved origin.
+   */
+  server?: Server;
+  /**
+   * Authentication for the server:
+   *
+   *   - `true` (default) — no gate; every registered method is callable
+   *     regardless of trust (today's behavior, unchanged).
+   *   - `false` — the RPC server is started without a trust handshake.
+   *     Intended for single-user localhost tools where an auth round-trip
+   *     would only get in the way. A noop `anonymous:devframe:auth` handler
+   *     is registered so the browser client's unconditional handshake call
+   *     succeeds and auto-trusts.
+   *   - A {@link DevframeAuthHandler} (e.g. from
+   *     `devframe/recipes/interactive-auth`'s `createInteractiveAuth`) —
+   *     registers its `rpcFunctions`, wires its `authorize` as the resolver
+   *     gate, and wires its `onConnect` on every new peer. This is the
+   *     fully-authenticated server: an untrusted caller can only reach
+   *     `anonymous:`-prefixed methods (see `isAnonymousRpcMethod`).
+   */
+  auth?: boolean | DevframeAuthHandler;
+  /**
+   * Lower-level escape hatch: gate individual RPC calls by method name and
+   * session without a full {@link DevframeAuthHandler}. Ignored when `auth`
+   * is a handler object (its own `authorize` is used); combine with `auth:
+   * true` to layer a custom policy on top of an otherwise ungated server.
+   */
+  authorize?: (methodName: string, session: DevframeNodeRpcSession) => boolean;
+  /**
+   * Called once per new WS connection, right after its session is created
+   * (before any RPC call is dispatched). Runs after the auth handler's own
+   * `onConnect` (when `auth` is a {@link DevframeAuthHandler}), so it can
+   * observe — but not override — the connect-time trust decision.
+   */
+  onPeerConnect?: (peer: Peer, session: DevframeNodeRpcSession) => void;
+  /**
+   * Extra origins to accept on the WS upgrade beyond the loopback default
+   * (`localhost`/`127.0.0.1`/`::1` and any `Origin`-less request from a
+   * native client). Add your LAN/tunnel origin here when reaching the tool
+   * from another host. Pass `false` to disable origin checking entirely
+   * (not recommended). Default: loopback-only.
+   */
+  allowedOrigins?: readonly string[] | false;
+  /**
+   * Called once the WS server is bound so callers can mount static
+   * handlers whose origin depends on the resolved port, or print their
+   * own startup banner. Devframe does not print one itself.
+   */
+  onReady?: (info: {
+    origin: string;
+    port: number;
+    app: H3;
+  }) => void | Promise<void>;
+}
+interface StartedServer {
+  /** Listening origin, e.g. `http://localhost:9999`. */
+  origin: string;
+  port: number;
+  app: H3;
+  /** The crossws node adapter driving the RPC socket (connected peers, pub/sub). */
+  ws: NodeAdapter;
+  rpcGroup: BirpcGroup<DevframeRpcClientFunctions, DevframeRpcServerFunctions, false>;
+  /**
+   * The {@link ConnectionMeta} descriptor for this server — the same shape
+   * a `__connection.json` route should serve so a devframe client's
+   * `resolveWsUrl` can dial back in. Reflects the `path` / `wsPort` this
+   * server was started with and the `jsonSerializable` methods currently
+   * registered on `context.rpc`.
+   */
+  connectionMeta: () => ConnectionMeta;
+  close: () => Promise<void>;
+}
+/**
+ * Compose an h3 + WebSocket server for a devframe context. The RPC
+ * group is bound to `context.rpc.functions`; the WS endpoint lives on
+ * the same port as the HTTP server.
+ */
+declare function startHttpAndWs(options: StartHttpAndWsOptions): Promise<StartedServer>;
+//#endregion
+export { StartedServer as n, startHttpAndWs as r, StartHttpAndWsOptions as t };

package/dist/{shared-state-D4PPieA0.mjs → shared-state-QtMas0NG.mjs}

@@ -1,6 +1,6 @@
 import { createEventEmitter } from "./utils/events.mjs";
 import { nanoid } from "./utils/nanoid.mjs";
-//#region ../../node_modules/.pnpm/immer@11.1.8/node_modules/immer/dist/immer.mjs
+//#region ../../node_modules/.pnpm/immer@11.1.11/node_modules/immer/dist/immer.mjs
 var NOTHING = Symbol.for("immer-nothing");
 var DRAFTABLE = Symbol.for("immer-draftable");
 var DRAFT_STATE = Symbol.for("immer-state");
@@ -350,6 +350,21 @@ function createProxyProxy(base, parent) {
 var objectTraps = {
 	get(state, prop) {
 		if (prop === DRAFT_STATE) return state;
+		if (prop === "constructor" || prop === "__proto__") {
+			const value2 = latest(state)[prop];
+			return new Proxy(value2 || {}, {
+				get: (target, key) => {
+					if (key === "__proto__" || key === "prototype") return Object.freeze(/* @__PURE__ */ Object.create(null));
+					return Reflect.get(target, key);
+				},
+				set: () => {
+					return true;
+				},
+				apply: (target, thisArg, args) => {
+					return Reflect.apply(target, thisArg, args);
+				}
+			});
+		}
 		let arrayPlugin = state.scope_.arrayMethodsPlugin_;
 		const isArrayWithStringProp = state.type_ === 1 && typeof prop === "string";
 		if (isArrayWithStringProp) {
@@ -369,12 +384,14 @@ var objectTraps = {
 		return value;
 	},
 	has(state, prop) {
+		if (prop === "constructor" || prop === "__proto__" || prop === "prototype") return false;
 		return prop in latest(state);
 	},
 	ownKeys(state) {
 		return Reflect.ownKeys(latest(state));
 	},
 	set(state, prop, value) {
+		if (prop === "constructor" || prop === "__proto__" || prop === "prototype") return true;
 		const desc = getDescriptorFromProto(latest(state), prop);
 		if (desc?.set) {
 			desc.set.call(state.draft_, value);
@@ -392,7 +409,7 @@ var objectTraps = {
 			prepareCopy(state);
 			markChanged(state);
 		}
-		if (state.copy_[prop] === value && (value !== void 0 || prop in state.copy_) || Number.isNaN(value) && Number.isNaN(state.copy_[prop])) return true;
+		if (state.copy_[prop] === value && (value !== void 0 || has(state.copy_, prop, state.type_)) || Number.isNaN(value) && Number.isNaN(state.copy_[prop])) return true;
 		state.copy_[prop] = value;
 		state.assigned_.set(prop, true);
 		handleCrossReference(state, prop, value);
@@ -894,6 +911,19 @@ var produceWithPatches = /* @__PURE__ */ immer.produceWithPatches.bind(immer);
 var applyPatches = /* @__PURE__ */ immer.applyPatches.bind(immer);
 //#endregion
 //#region src/utils/shared-state.ts
+/**
+* Upper bound on retained syncIds. Loop echoes arrive near-immediately, so a
+* generous window preserves de-dup while capping memory on long-lived,
+* frequently-mutated states (e.g. a 1s terminal poll).
+*/
+const MAX_SYNC_IDS = 1e3;
+function rememberSyncId(syncIds, syncId) {
+	syncIds.add(syncId);
+	if (syncIds.size > MAX_SYNC_IDS) {
+		const oldest = syncIds.values().next().value;
+		if (oldest !== void 0) syncIds.delete(oldest);
+	}
+}
 function createSharedState(options) {
 	const { enablePatches: enablePatches$1 = false } = options;
 	const events = createEventEmitter();
@@ -906,12 +936,12 @@ function createSharedState(options) {
 			if (syncIds.has(syncId)) return;
 			enablePatches();
 			state = applyPatches(state, patches);
-			syncIds.add(syncId);
+			rememberSyncId(syncIds, syncId);
 			events.emit("updated", state, void 0, syncId);
 		},
 		mutate: (fn, syncId = nanoid()) => {
 			if (syncIds.has(syncId)) return;
-			syncIds.add(syncId);
+			rememberSyncId(syncIds, syncId);
 			if (enablePatches$1) {
 				const [newState, patches] = produceWithPatches(state, fn);
 				state = newState;

package/dist/state-WX3HT5a3.mjs

@@ -0,0 +1,101 @@
+import { DEVFRAME_OTP_URL_PARAM } from "./constants.mjs";
+import { a as timingSafeEqual, i as randomToken, r as randomDigits } from "./revoke-BtQDKTp7.mjs";
+//#region src/node/auth/state.ts
+/** Number of decimal digits in a human-typed one-time authentication code. */
+const TEMP_AUTH_CODE_LENGTH = 6;
+/**
+* How long an authentication code stays valid after it is (re)generated. A
+* 6-digit code only has ~20 bits of entropy, so a short lifetime plus the
+* attempt cap below are what keep it brute-force resistant.
+*/
+const TEMP_AUTH_CODE_TTL = 5 * 6e4;
+/** Failed attempts allowed against a single code before it is rotated. */
+const TEMP_AUTH_MAX_ATTEMPTS = 5;
+let tempAuthCode = generateTempCode();
+let tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
+let tempAuthFailedAttempts = 0;
+function generateTempCode() {
+	return randomDigits(TEMP_AUTH_CODE_LENGTH);
+}
+/**
+* The current one-time authentication code. Display this to the user (e.g. in
+* the dev-server terminal) so they can type it into the browser to authenticate.
+*/
+function getTempAuthCode() {
+	return tempAuthCode;
+}
+/**
+* Rotate the authentication code, resetting its expiry window and failed-attempt
+* counter. Call this when a new authentication flow begins (e.g. when an
+* untrusted client starts authenticating) so the displayed code is freshly
+* valid for its full TTL.
+*/
+function refreshTempAuthCode() {
+	tempAuthCode = generateTempCode();
+	tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
+	tempAuthFailedAttempts = 0;
+	return tempAuthCode;
+}
+/**
+* Build a "magic link" authentication URL that embeds a one-time code (OTP) as
+* a query parameter. Opening it authenticates the client without typing — print
+* it on startup (devframe stays headless, so the host prints its own banner).
+* Defaults to the current code; the link is subject to the same TTL.
+*/
+function buildOtpAuthUrl(baseUrl, code = tempAuthCode) {
+	const url = new URL(baseUrl);
+	url.searchParams.set(DEVFRAME_OTP_URL_PARAM, code);
+	return url.href;
+}
+/**
+* Re-authenticate a connection that presents a previously-issued bearer token.
+* Returns `true` and marks the session trusted when the token is known.
+*
+* Used by the `anonymous:devframe:auth` handler so a client that already
+* authenticated (token persisted in the browser) is trusted on reconnect
+* without entering the code again.
+*/
+function verifyAuthToken(token, session, storage) {
+	if (!token || !storage.value().trusted[token]) return false;
+	session.meta.clientAuthToken = token;
+	session.meta.isTrusted = true;
+	return true;
+}
+/**
+* Exchange a one-time authentication code for a fresh, node-issued bearer token.
+*
+* On success this mints a high-entropy token, records it in the trusted store,
+* marks the calling session trusted, rotates the code, and returns the token
+* for the client to persist. Returns `null` on any failure.
+*
+* Because the code is short and human-typed, verification is hardened against
+* brute force: it enforces a time-to-live, compares in constant time, and
+* rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
+* attacker cannot keep guessing against the same code.
+*/
+function exchangeTempAuthCode(code, session, info, storage) {
+	if (Date.now() > tempAuthCodeExpiresAt) {
+		refreshTempAuthCode();
+		return null;
+	}
+	if (!timingSafeEqual(code, tempAuthCode)) {
+		tempAuthFailedAttempts += 1;
+		if (tempAuthFailedAttempts >= TEMP_AUTH_MAX_ATTEMPTS) refreshTempAuthCode();
+		return null;
+	}
+	const authToken = randomToken();
+	storage.mutate((state) => {
+		state.trusted[authToken] = {
+			authToken,
+			ua: info.ua,
+			origin: info.origin,
+			timestamp: Date.now()
+		};
+	});
+	session.meta.clientAuthToken = authToken;
+	session.meta.isTrusted = true;
+	refreshTempAuthCode();
+	return authToken;
+}
+//#endregion
+export { verifyAuthToken as a, refreshTempAuthCode as i, exchangeTempAuthCode as n, getTempAuthCode as r, buildOtpAuthUrl as t };

package/dist/{storage-l2ezeend.mjs → storage-yrUZaiib.mjs}

@@ -2,6 +2,7 @@ import { t as devframeReporter } from "./diagnostics-reporter-CsIG85Q5.mjs";
 import { defineDiagnostics } from "nostics";
 import fs from "node:fs";
 import { dirname } from "pathe";
+import process$1 from "node:process";
 import { destr } from "destr";
 //#region src/node/diagnostics.ts
 const diagnostics = defineDiagnostics({
@@ -46,6 +47,14 @@ const diagnostics = defineDiagnostics({
 		DF0034: {
 			why: (p) => `Scoped RPC registration for namespace "${p.namespace}" received an already-namespaced function name "${p.name}".`,
 			fix: "A scoped context auto-namespaces ids. Pass a bare name without a \":\" separator (e.g. `register({ name: \"get-cwd\" })`), or use the unscoped `ctx.base.rpc.register` for a fully-qualified name."
+		},
+		DF0035: {
+			why: (p) => `Failed to persist storage file: ${p.filepath}`,
+			fix: "Check that the storage directory is writable and has free space."
+		},
+		DF0036: {
+			why: (p) => `RPC call to "${p.name}" was rejected: the caller is not authorized.`,
+			fix: "Complete the auth handshake (or connect with a static/pre-shared token) before calling a trusted method. Untrusted callers may only call `anonymous:`-prefixed methods — see `isAnonymousRpcMethod`."
 		}
 	}
 });
@@ -89,7 +98,7 @@ function createEventEmitter() {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/immer@11.1.8/node_modules/immer/dist/immer.mjs
+//#region ../../node_modules/.pnpm/immer@11.1.11/node_modules/immer/dist/immer.mjs
 var NOTHING = Symbol.for("immer-nothing");
 var DRAFTABLE = Symbol.for("immer-draftable");
 var DRAFT_STATE = Symbol.for("immer-state");
@@ -439,6 +448,21 @@ function createProxyProxy(base, parent) {
 var objectTraps = {
 	get(state, prop) {
 		if (prop === DRAFT_STATE) return state;
+		if (prop === "constructor" || prop === "__proto__") {
+			const value2 = latest(state)[prop];
+			return new Proxy(value2 || {}, {
+				get: (target, key) => {
+					if (key === "__proto__" || key === "prototype") return Object.freeze(/* @__PURE__ */ Object.create(null));
+					return Reflect.get(target, key);
+				},
+				set: () => {
+					return true;
+				},
+				apply: (target, thisArg, args) => {
+					return Reflect.apply(target, thisArg, args);
+				}
+			});
+		}
 		let arrayPlugin = state.scope_.arrayMethodsPlugin_;
 		const isArrayWithStringProp = state.type_ === 1 && typeof prop === "string";
 		if (isArrayWithStringProp) {
@@ -458,12 +482,14 @@ var objectTraps = {
 		return value;
 	},
 	has(state, prop) {
+		if (prop === "constructor" || prop === "__proto__" || prop === "prototype") return false;
 		return prop in latest(state);
 	},
 	ownKeys(state) {
 		return Reflect.ownKeys(latest(state));
 	},
 	set(state, prop, value) {
+		if (prop === "constructor" || prop === "__proto__" || prop === "prototype") return true;
 		const desc = getDescriptorFromProto(latest(state), prop);
 		if (desc?.set) {
 			desc.set.call(state.draft_, value);
@@ -481,7 +507,7 @@ var objectTraps = {
 			prepareCopy(state);
 			markChanged(state);
 		}
-		if (state.copy_[prop] === value && (value !== void 0 || prop in state.copy_) || Number.isNaN(value) && Number.isNaN(state.copy_[prop])) return true;
+		if (state.copy_[prop] === value && (value !== void 0 || has(state.copy_, prop, state.type_)) || Number.isNaN(value) && Number.isNaN(state.copy_[prop])) return true;
 		state.copy_[prop] = value;
 		state.assigned_.set(prop, true);
 		handleCrossReference(state, prop, value);
@@ -992,6 +1018,19 @@ function nanoid(size = 21) {
 }
 //#endregion
 //#region src/utils/shared-state.ts
+/**
+* Upper bound on retained syncIds. Loop echoes arrive near-immediately, so a
+* generous window preserves de-dup while capping memory on long-lived,
+* frequently-mutated states (e.g. a 1s terminal poll).
+*/
+const MAX_SYNC_IDS = 1e3;
+function rememberSyncId(syncIds, syncId) {
+	syncIds.add(syncId);
+	if (syncIds.size > MAX_SYNC_IDS) {
+		const oldest = syncIds.values().next().value;
+		if (oldest !== void 0) syncIds.delete(oldest);
+	}
+}
 function createSharedState(options) {
 	const { enablePatches: enablePatches$1 = false } = options;
 	const events = createEventEmitter();
@@ -1004,12 +1043,12 @@ function createSharedState(options) {
 			if (syncIds.has(syncId)) return;
 			enablePatches();
 			state = applyPatches(state, patches);
-			syncIds.add(syncId);
+			rememberSyncId(syncIds, syncId);
 			events.emit("updated", state, void 0, syncId);
 		},
 		mutate: (fn, syncId = nanoid()) => {
 			if (syncIds.has(syncId)) return;
-			syncIds.add(syncId);
+			rememberSyncId(syncIds, syncId);
 			if (enablePatches$1) {
 				const [newState, patches] = produceWithPatches(state, fn);
 				state = newState;
@@ -1132,8 +1171,18 @@ function createStorage(options) {
 		enablePatches: false
 	});
 	state.on("updated", debounce((newState) => {
-		fs.mkdirSync(dirname(options.filepath), { recursive: true });
-		fs.writeFileSync(options.filepath, `${JSON.stringify(newState, null, 2)}\n`);
+		try {
+			const dir = dirname(options.filepath);
+			fs.mkdirSync(dir, { recursive: true });
+			const tmp = `${options.filepath}.${process$1.pid}.tmp`;
+			fs.writeFileSync(tmp, `${JSON.stringify(newState, null, 2)}\n`);
+			fs.renameSync(tmp, options.filepath);
+		} catch (error) {
+			diagnostics.DF0035({
+				filepath: options.filepath,
+				cause: error
+			}, { method: "error" });
+		}
 	}, debounceTime));
 	return state;
 }

package/dist/types/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as ScopedServerFunctions, G as DevframeScopedNodeContext, H as EntriesToObject, J as DevframeSettings, K as DevframeScopedNodeRpc, Q as ScopedClientFunctions, S as RpcStreamingHost, St as EventsMap, U as PartialWithoutId, W as Thenable, X as DevframeSettingsStore, Y as DevframeSettingsRegistry, Z as ScopedBroadcastOptions, _ as RpcFunctionsHost, _t as AgentToolInput, a as DevframeDuplicationStrategy, at as DevframeRpcSharedStates, b as RpcStreamingChannel, bt as EventEmitter, c as DevframeSpaOptions, ct as DevframeDiagnosticsDefinition, d as ConnectionMeta, dt as AgentHandle, et as ScopedSharedStates, f as ConnectionMetaWebsocket, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, i as DevframeDeploymentKind, it as DevframeRpcServerFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsHost, m as DevframeNodeContext, mt as AgentResourceContent, n as DevframeCliOptions, nt as DevframeViewHost, o as DevframeRuntime, ot as DevframeHost, p as DevframeCapabilities, pt as AgentResource, q as DevframeScopedStreamingHost, r as DevframeDefinition, rt as DevframeRpcClientFunctions, s as DevframeSetupInfo, st as DevframeDefineDiagnosticsOptions, t as DevframeBrowserContext, tt as SettingsForNamespace, u as defineDevframe, ut as DevframeDiagnosticsLogger, v as RpcSharedStateGetOptions, vt as DevframeAgentHost, x as RpcStreamingChannelOptions, xt as EventUnsubscribe, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "../devframe-BwfavB78.mjs";
+import { $ as ScopedServerFunctions, G as DevframeScopedNodeContext, H as EntriesToObject, J as DevframeSettings, K as DevframeScopedNodeRpc, Q as ScopedClientFunctions, S as RpcStreamingHost, St as EventsMap, U as PartialWithoutId, W as Thenable, X as DevframeSettingsStore, Y as DevframeSettingsRegistry, Z as ScopedBroadcastOptions, _ as RpcFunctionsHost, _t as AgentToolInput, a as DevframeDuplicationStrategy, at as DevframeRpcSharedStates, b as RpcStreamingChannel, bt as EventEmitter, c as DevframeSpaOptions, ct as DevframeDiagnosticsDefinition, d as ConnectionMeta, dt as AgentHandle, et as ScopedSharedStates, f as ConnectionMetaWebsocket, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, i as DevframeDeploymentKind, it as DevframeRpcServerFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsHost, m as DevframeNodeContext, mt as AgentResourceContent, n as DevframeCliOptions, nt as DevframeViewHost, o as DevframeRuntime, ot as DevframeHost, p as DevframeCapabilities, pt as AgentResource, q as DevframeScopedStreamingHost, r as DevframeDefinition, rt as DevframeRpcClientFunctions, s as DevframeSetupInfo, st as DevframeDefineDiagnosticsOptions, t as DevframeBrowserContext, tt as SettingsForNamespace, u as defineDevframe, ut as DevframeDiagnosticsLogger, v as RpcSharedStateGetOptions, vt as DevframeAgentHost, x as RpcStreamingChannelOptions, xt as EventUnsubscribe, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "../devframe-DgvncQy2.mjs";
 import { g as RpcFunctionAgentOptions } from "../types-DZEx4ffs.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "../ws-server-BVVMDo2n.mjs";
-export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, PartialWithoutId, RpcBroadcastOptions, RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe };
+import { t as DevframeNodeRpcSessionMeta } from "../ws-server-Bc2wBHl-.mjs";
+export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, PartialWithoutId, RpcBroadcastOptions, type RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe };

package/dist/utils/crypto-token.mjs

@@ -19,7 +19,7 @@ function randomToken(byteLength = 16) {
 */
 function randomDigits(length) {
 	const limit = 250;
-	const buf = new Uint8Array(1);
+	const buf = /* @__PURE__ */ new Uint8Array(1);
 	let out = "";
 	while (out.length < length) {
 		globalThis.crypto.getRandomValues(buf);

package/dist/utils/events.d.mts

@@ -1,4 +1,4 @@
-import { St as EventsMap, bt as EventEmitter } from "../devframe-BwfavB78.mjs";
+import { St as EventsMap, bt as EventEmitter } from "../devframe-DgvncQy2.mjs";
 
 //#region src/utils/events.d.ts
 /**

package/dist/utils/hash.mjs

@@ -1,2 +1,2 @@
-import { t as hash } from "../hash-DFc5WwhO.mjs";
+import { t as hash } from "../hash-PAfnyu2k.mjs";
 export { hash };

package/dist/utils/launch-editor.mjs

@@ -1,2 +1,2 @@
-import { t as launchEditor } from "../launch-editor-CgXBgviI.mjs";
+import { t as launchEditor } from "../launch-editor-DIzaS5EG.mjs";
 export { launchEditor };

package/dist/utils/open.mjs

@@ -1,2 +1,2 @@
-import { t as open } from "../open-Dusa2Zzd.mjs";
+import { t as open } from "../open-Deb5xmIT.mjs";
 export { open };

package/dist/utils/serve-static.mjs

@@ -143,7 +143,8 @@ function serveStaticNodeMiddleware(dir, options) {
 				res.end();
 				return;
 			}
-			const file = await resolveTarget(absDir, req.url ?? "/", opts.indexNames, opts.single);
+			const url = req.url ?? "/";
+			const file = await resolveTarget(absDir, url, opts.indexNames, opts.single);
 			if (!file) {
 				if (next) {
 					next();

package/dist/utils/shared-state.d.mts

@@ -1,2 +1,2 @@
-import { B as SharedStatePatch, F as ImmutableObject, I as ImmutableSet, L as SharedState, M as Immutable, N as ImmutableArray, P as ImmutableMap, R as SharedStateEvents, V as createSharedState, z as SharedStateOptions } from "../devframe-BwfavB78.mjs";
+import { B as SharedStatePatch, F as ImmutableObject, I as ImmutableSet, L as SharedState, M as Immutable, N as ImmutableArray, P as ImmutableMap, R as SharedStateEvents, V as createSharedState, z as SharedStateOptions } from "../devframe-DgvncQy2.mjs";
 export { Immutable, ImmutableArray, ImmutableMap, ImmutableObject, ImmutableSet, SharedState, SharedStateEvents, SharedStateOptions, SharedStatePatch, createSharedState };

package/dist/utils/shared-state.mjs

@@ -1,2 +1,2 @@
-import { t as createSharedState } from "../shared-state-D4PPieA0.mjs";
+import { t as createSharedState } from "../shared-state-QtMas0NG.mjs";
 export { createSharedState };

package/dist/utils/streaming-channel.d.mts

@@ -1,2 +1,2 @@
-import { A as createStreamReader, C as BufferedChunk, D as StreamReader, E as StreamErrorPayload, O as StreamSink, T as CreateStreamSinkOptions, j as createStreamSink, k as StreamSinkEvents, w as CreateStreamReaderOptions } from "../devframe-BwfavB78.mjs";
+import { A as createStreamReader, C as BufferedChunk, D as StreamReader, E as StreamErrorPayload, O as StreamSink, T as CreateStreamSinkOptions, j as createStreamSink, k as StreamSinkEvents, w as CreateStreamReaderOptions } from "../devframe-DgvncQy2.mjs";
 export { BufferedChunk, CreateStreamReaderOptions, CreateStreamSinkOptions, StreamErrorPayload, StreamReader, StreamSink, StreamSinkEvents, createStreamReader, createStreamSink };

package/dist/utils/when.d.mts

@@ -381,4 +381,4 @@ declare function evaluateWhen<T extends object, const E extends string>(expressi
  */
 declare function resolveContextValue<T extends Record<string, unknown>>(key: string, context: T): unknown;
 //#endregion
-export { EvaluateWhenOptions, WhenContext, type WhenExpression, evaluateWhen, resolveContextValue };
+export { EvaluateWhenOptions, WhenContext, WhenExpression, evaluateWhen, resolveContextValue };

package/dist/{ws-server-BVVMDo2n.d.mts → ws-server-Bc2wBHl-.d.mts}

@@ -57,6 +57,13 @@ interface WsRpcTransportOptions {
   destroyUnmatched?: boolean;
   /** When set, a new https.Server is created and the WS endpoint is attached to it. */
   https?: ServerOptions;
+  /**
+   * Extra origins to accept on the WS upgrade beyond the loopback default.
+   * Add your LAN/tunnel origin here when reaching the tool from another host.
+   * Pass `false` to disable origin checking entirely (not recommended).
+   * Default: loopback-only.
+   */
+  allowedOrigins?: readonly string[] | false;
   /**
    * RPC function definitions, used by the per-call wire serializer to
    * dispatch between strict-JSON and structured-clone encoding based
@@ -88,6 +95,15 @@ interface WsRpcTransport {
    */
   close: () => Promise<void>;
 }
+declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Default origin policy for a localhost dev tool: allow requests with no
+ * `Origin` header (native, non-browser clients), allow any loopback origin
+ * (so cross-port localhost dev setups keep working), and allow explicitly
+ * configured origins. Everything else — a real remote page in the dev's
+ * browser — is rejected.
+ */
+declare function isAllowedOrigin(origin: string | undefined, allowedOrigins: readonly string[]): boolean;
 /**
  * Attach a WebSocket transport to an existing RPC group, powered by
  * [crossws](https://crossws.h3.dev). Either attach to an existing HTTP(S)
@@ -100,4 +116,4 @@ interface WsRpcTransport {
  */
 declare function attachWsRpcTransport<ClientFunctions extends object, ServerFunctions extends object>(rpcGroup: BirpcGroup<ClientFunctions, ServerFunctions, false>, options?: WsRpcTransportOptions): WsRpcTransport;
 //#endregion
-export { attachWsRpcTransport as i, WsRpcTransport as n, WsRpcTransportOptions as r, DevframeNodeRpcSessionMeta as t };
+export { isAllowedOrigin as a, attachWsRpcTransport as i, WsRpcTransport as n, isLoopbackHostname as o, WsRpcTransportOptions as r, DevframeNodeRpcSessionMeta as t };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devframe",
   "type": "module",
-  "version": "0.6.0-beta.1",
+  "version": "0.6.0-beta.3",
   "description": "Framework for building generic devframes",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",
@@ -31,6 +31,7 @@
     "./node": "./dist/node/index.mjs",
     "./node/auth": "./dist/node/auth.mjs",
     "./node/hub-internals": "./dist/node/hub-internals.mjs",
+    "./recipes/interactive-auth": "./dist/recipes/interactive-auth.mjs",
     "./recipes/open-helpers": "./dist/recipes/open-helpers.mjs",
     "./rpc": "./dist/rpc/index.mjs",
     "./rpc/client": "./dist/rpc/client.mjs",
@@ -69,32 +70,32 @@
     }
   },
   "dependencies": {
-    "@valibot/to-json-schema": "^1.7.0",
+    "@valibot/to-json-schema": "^1.7.1",
     "birpc": "^4.0.0",
     "cac": "^7.0.0",
-    "crossws": "^0.4.8",
+    "crossws": "^0.4.9",
     "destr": "^2.0.5",
     "h3": "2.0.1-rc.22",
     "mrmime": "^2.0.1",
     "nostics": "^1.1.4",
     "pathe": "^2.0.3",
     "ufo": "^1.6.4",
-    "valibot": "^1.4.1"
+    "valibot": "^1.4.2"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "get-port-please": "^3.2.0",
-    "immer": "^11.1.8",
-    "launch-editor": "^2.13.2",
+    "immer": "^11.1.11",
+    "launch-editor": "^2.14.1",
     "mlly": "^1.8.2",
-    "obug": "^2.1.1",
+    "obug": "^2.1.3",
     "ohash": "^2.0.11",
     "open": "^11.0.0",
     "p-limit": "^7.3.0",
     "perfect-debounce": "^2.1.0",
     "structured-clone-es": "^2.0.0",
-    "tinyglobby": "^0.2.16",
-    "tsdown": "^0.22.0",
+    "tinyglobby": "^0.2.17",
+    "tsdown": "^0.22.3",
     "ua-parser-modern": "^0.1.1",
     "whenexpr": "^0.1.2",
     "ws": "^8.21.0"