devframe 0.6.0-beta.2 → 0.6.0

package/dist/build-server-0jWgMrz-.mjs

@@ -0,0 +1,338 @@
+import { a as diagnostics } from "./storage-yrUZaiib.mjs";
+import { n as createHostContext } from "./host-h3-Dsf-Tgwx.mjs";
+import { join } from "pathe";
+import process from "node:process";
+import { homedir } from "node:os";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListResourcesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { toJsonSchema } from "@valibot/to-json-schema";
+//#region src/adapters/mcp/stringify.ts
+/**
+* JSON-coercing serializer for MCP text payloads.
+*
+* MCP carries tool results and resource reads as plain text over a
+* JSON-RPC transport, so we cannot use the `s:`-prefixed structured-clone
+* format the WS RPC transport falls back to for non-JSON values. Instead,
+* we coerce common non-JSON types into JSON-friendly forms so the LLM
+* client sees something useful instead of `[object Object]`.
+*
+* Coercions:
+*   - `BigInt` → `"123n"`
+*   - `Date` → ISO string (via the native `toJSON`)
+*   - `Map` → `{ __type: 'Map', entries: [[k, v], …] }`
+*   - `Set` → `{ __type: 'Set', entries: [v, …] }`
+*   - `Error` → `{ name, message, stack, cause? }` (cause recurses)
+*   - `Function` → `"[Function: name]"`
+*   - `Symbol` → `value.toString()`
+*   - cycles → `"[Circular]"`
+*/
+function stringifyForMcp(value) {
+	if (value === void 0) return "undefined";
+	if (typeof value === "string") return value;
+	const seen = /* @__PURE__ */ new WeakSet();
+	return JSON.stringify(value, (_key, val) => {
+		if (typeof val === "bigint") return `${val}n`;
+		if (val instanceof Error) {
+			const out = {
+				name: val.name,
+				message: val.message,
+				stack: val.stack
+			};
+			if (val.cause !== void 0) out.cause = val.cause;
+			return out;
+		}
+		if (val instanceof Map) return {
+			__type: "Map",
+			entries: [...val.entries()]
+		};
+		if (val instanceof Set) return {
+			__type: "Set",
+			entries: [...val]
+		};
+		if (typeof val === "function") return `[Function: ${val.name || "anonymous"}]`;
+		if (typeof val === "symbol") return val.toString();
+		if (val !== null && typeof val === "object") {
+			if (seen.has(val)) return "[Circular]";
+			seen.add(val);
+		}
+		return val;
+	}, 2);
+}
+/**
+* Format a thrown value for an MCP `isError` text payload. Surfaces the
+* `Error.name`/`message`, and one level of `cause.message` so context
+* isn't dropped silently.
+*/
+function formatMcpError(error) {
+	if (!(error instanceof Error)) return String(error);
+	const cause = error.cause;
+	const causeText = cause instanceof Error ? ` (cause: ${cause.message})` : cause !== void 0 ? ` (cause: ${String(cause)})` : "";
+	return `${error.name}: ${error.message}${causeText}`;
+}
+//#endregion
+//#region src/adapters/mcp/to-json-schema.ts
+const FALLBACK_OBJECT_SCHEMA = Object.freeze({
+	type: "object",
+	additionalProperties: true
+});
+/**
+* Convert a valibot return schema to JSON Schema.
+* @internal
+*/
+function valibotReturnToJsonSchema(schema) {
+	if (!schema) return void 0;
+	try {
+		return toJsonSchema(schema);
+	} catch {
+		return FALLBACK_OBJECT_SCHEMA;
+	}
+}
+/**
+* Convert positional RPC args schemas to a single MCP-friendly object
+* schema. When the RPC declares `args: [v.object(...)]`, unwrap the
+* single-object schema directly (nicer agent UX than `{ arg0: {...} }`).
+*
+* Returns `undefined` when there are no args (the MCP SDK treats this
+* as `{ type: 'object', properties: {} }`).
+* @internal
+*/
+function valibotArgsToJsonSchema(args) {
+	if (!args || args.length === 0) return {
+		schema: {
+			type: "object",
+			properties: {}
+		},
+		unwrapped: false
+	};
+	if (args.length === 1) {
+		const inner = safeToJsonSchema(args[0]);
+		if (isObjectJsonSchema(inner)) return {
+			schema: inner,
+			unwrapped: true
+		};
+	}
+	const properties = {};
+	const required = [];
+	for (let i = 0; i < args.length; i++) {
+		const key = `arg${i}`;
+		properties[key] = safeToJsonSchema(args[i]);
+		required.push(key);
+	}
+	return {
+		schema: {
+			type: "object",
+			properties,
+			required,
+			additionalProperties: false
+		},
+		unwrapped: false
+	};
+}
+function safeToJsonSchema(schema) {
+	try {
+		return toJsonSchema(schema);
+	} catch {
+		return FALLBACK_OBJECT_SCHEMA;
+	}
+}
+function isObjectJsonSchema(value) {
+	return !!value && typeof value === "object" && value.type === "object";
+}
+//#endregion
+//#region src/adapters/mcp/build-server.ts
+/**
+* Wire an MCP {@link Server} to a devframe context. Returns the server
+* plus a disposal function for the subscriptions it sets up. The
+* transport is the caller's responsibility — `createMcpServer` connects
+* stdio; tests can connect an {@link InMemoryTransport} instead.
+*
+* @internal
+*/
+function buildMcpServerFromContext(ctx, options) {
+	const server = new Server({
+		name: options.serverName,
+		version: options.serverVersion
+	}, { capabilities: {
+		tools: { listChanged: true },
+		resources: { listChanged: true }
+	} });
+	registerToolHandlers(server, ctx);
+	registerResourceHandlers(server, ctx, options.exposeSharedState);
+	const notify = (method) => {
+		server.notification({ method }).catch(() => {});
+	};
+	const offManifest = ctx.agent.events.on("agent:manifest:changed", () => {
+		notify("notifications/tools/list_changed");
+		notify("notifications/resources/list_changed");
+	});
+	const offKeyAdded = ctx.rpc.sharedState.onKeyAdded(() => {
+		notify("notifications/resources/list_changed");
+	});
+	return {
+		server,
+		dispose: () => {
+			offManifest();
+			offKeyAdded();
+		}
+	};
+}
+/**
+* Build an MCP server over the agent surface of a devframe definition.
+* Currently supports `stdio` transport only.
+*
+* @experimental The agent-native surface is experimental and may change
+* without a major version bump until it stabilizes.
+*/
+async function createMcpServer(definition, options = {}) {
+	const transport = options.transport ?? "stdio";
+	if (transport !== "stdio") throw diagnostics.DF0017({
+		transport,
+		reason: "Only stdio transport is supported in this release."
+	});
+	const ctx = await createHostContext({
+		cwd: process.cwd(),
+		mode: "dev",
+		host: {
+			mountStatic: () => {},
+			resolveOrigin: () => "mcp://devframe",
+			getStorageDir: (scope) => scope === "workspace" ? join(process.cwd(), `node_modules/.${definition.id}/devframe`) : join(homedir(), `.${definition.id}/devframe`)
+		}
+	});
+	await definition.setup(ctx);
+	const { server, dispose } = buildMcpServerFromContext(ctx, {
+		serverName: options.serverName ?? `${definition.id} (devframe)`,
+		serverVersion: options.serverVersion ?? definition.version ?? "0.0.0",
+		exposeSharedState: options.exposeSharedState ?? true
+	});
+	const { startStdioTransport } = await import("./transports-BmDVn4SF.mjs");
+	let stop;
+	try {
+		stop = await startStdioTransport(server);
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		throw diagnostics.DF0017({
+			transport,
+			reason,
+			cause: error
+		});
+	}
+	options.onReady?.({ transport: "stdio" });
+	return { async stop() {
+		dispose();
+		await stop();
+	} };
+}
+function registerToolHandlers(server, ctx) {
+	server.setRequestHandler(ListToolsRequestSchema, async () => {
+		return { tools: ctx.agent.list().tools.map((tool) => projectTool(tool, ctx)) };
+	});
+	server.setRequestHandler(CallToolRequestSchema, async (request) => {
+		const { name, arguments: args } = request.params;
+		try {
+			return { content: [{
+				type: "text",
+				text: stringifyForMcp(await ctx.agent.invoke(name, args ?? {}))
+			}] };
+		} catch (error) {
+			return {
+				isError: true,
+				content: [{
+					type: "text",
+					text: `Error invoking "${name}": ${formatMcpError(error)}`
+				}]
+			};
+		}
+	});
+}
+function registerResourceHandlers(server, ctx, exposeSharedState) {
+	server.setRequestHandler(ListResourcesRequestSchema, async () => {
+		const resources = ctx.agent.list().resources.map((resource) => ({
+			uri: resource.uri,
+			name: resource.name,
+			description: resource.description,
+			mimeType: resource.mimeType
+		}));
+		if (exposeSharedState !== false) {
+			const filter = typeof exposeSharedState === "function" ? exposeSharedState : () => true;
+			for (const key of ctx.rpc.sharedState.keys()) {
+				if (!filter(key)) continue;
+				resources.push({
+					uri: `devframe://state/${encodeURIComponent(key)}`,
+					name: key,
+					description: `Shared state: ${key}`,
+					mimeType: "application/json"
+				});
+			}
+		}
+		return { resources };
+	});
+	server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
+		const { uri } = request.params;
+		const parsed = parseResourceUri(uri);
+		if (parsed.kind === "resource") {
+			const content = await ctx.agent.read(parsed.id);
+			return { contents: [{
+				uri,
+				mimeType: content.mimeType ?? "application/json",
+				text: content.text ?? stringifyForMcp(content.json)
+			}] };
+		}
+		if (parsed.kind === "state") return { contents: [{
+			uri,
+			mimeType: "application/json",
+			text: stringifyForMcp((await ctx.rpc.sharedState.get(parsed.key)).value())
+		}] };
+		throw new Error(`[devframe/mcp] unknown resource URI "${uri}"`);
+	});
+}
+function projectTool(tool, ctx) {
+	const inputSchema = tool.inputSchema ?? computeInputSchema(tool, ctx);
+	const outputSchema = tool.outputSchema ?? computeOutputSchema(tool, ctx);
+	return {
+		name: tool.id,
+		title: tool.title,
+		description: tool.description,
+		inputSchema,
+		...outputSchema ? { outputSchema } : {},
+		annotations: {
+			title: tool.title,
+			readOnlyHint: tool.safety === "read",
+			destructiveHint: tool.safety === "destructive"
+		}
+	};
+}
+function computeInputSchema(tool, ctx) {
+	if (tool.kind !== "rpc" || !tool.rpcName) return {
+		type: "object",
+		properties: {}
+	};
+	const def = ctx.rpc.definitions.get(tool.rpcName);
+	if (!def) return {
+		type: "object",
+		properties: {}
+	};
+	const args = def.args;
+	return valibotArgsToJsonSchema(args).schema;
+}
+function computeOutputSchema(tool, ctx) {
+	if (tool.kind !== "rpc" || !tool.rpcName) return void 0;
+	const def = ctx.rpc.definitions.get(tool.rpcName);
+	if (!def) return void 0;
+	return valibotReturnToJsonSchema(def.returns);
+}
+function parseResourceUri(uri) {
+	const match = uri.match(/^devframe:\/\/(resource|state)\/(.+)$/);
+	if (!match) return { kind: "unknown" };
+	const [, kind, rest] = match;
+	const decoded = decodeURIComponent(rest);
+	if (kind === "resource") return {
+		kind: "resource",
+		id: decoded
+	};
+	return {
+		kind: "state",
+		key: decoded
+	};
+}
+//#endregion
+export { createMcpServer as n, buildMcpServerFromContext as t };

package/dist/client/index.d.mts

@@ -1,6 +1,6 @@
-import { $ as ScopedServerFunctions, D as StreamReader, J as DevframeSettings, L as SharedState, O as StreamSink, bt as EventEmitter, d as ConnectionMeta, et as ScopedSharedStates, it as DevframeRpcServerFunctions, rt as DevframeRpcClientFunctions, tt as SettingsForNamespace, v as RpcSharedStateGetOptions, y as RpcSharedStateHost } from "../devframe-D-gr9sBx.mjs";
+import { O as StreamReader, R as SharedState, Y as DevframeSettings, at as DevframeRpcServerFunctions, b as RpcSharedStateHost, et as ScopedServerFunctions, f as ConnectionMeta, it as DevframeRpcClientFunctions, k as StreamSink, nt as SettingsForNamespace, tt as ScopedSharedStates, xt as EventEmitter, y as RpcSharedStateGetOptions } from "../devframe-BtVHhmwM.mjs";
 import { _ as RpcFunctionDefinition, w as RpcFunctionsCollector } from "../types-DZEx4ffs.mjs";
-import { C as RpcCacheManager, w as RpcCacheOptions } from "../index-CxaPKDXX.mjs";
+import { C as RpcCacheManager, w as RpcCacheOptions } from "../index-Dy6GFDRf.mjs";
 import { t as WsRpcChannelOptions } from "../ws-client-D0z0pOhn.mjs";
 import { BirpcOptions, BirpcReturn } from "birpc";
 

package/dist/client/index.mjs

@@ -1,7 +1,7 @@
-import { t as hash } from "../hash-DFc5WwhO.mjs";
+import { t as hash } from "../hash-PAfnyu2k.mjs";
 import { colors } from "../utils/colors.mjs";
 import { createEventEmitter } from "../utils/events.mjs";
-import { t as createSharedState } from "../shared-state-D4PPieA0.mjs";
+import { t as createSharedState } from "../shared-state-QtMas0NG.mjs";
 import { i as structuredCloneStringify, n as structuredCloneParse, t as structuredCloneDeserialize } from "../structured-clone-CeZOHvkd.mjs";
 import { createStreamReader, createStreamSink } from "../utils/streaming-channel.mjs";
 import { promiseWithResolver } from "../utils/promise.mjs";
@@ -21,6 +21,14 @@ const DEVFRAME_RPC_DUMP_MANIFEST_FILENAME = "__rpc-dump/index.json";
 * `consumeOtpFromUrl` client utilities (or `connectDevframe`'s `otpParam`).
 */
 const DEVFRAME_OTP_URL_PARAM = "devframe_otp";
+/**
+* WS upgrade-URL query parameter carrying a previously-issued bearer token.
+* Set by `createWsRpcChannel` (browser transport) whenever `authToken` is
+* passed; read at connect time by a host's connect-time trust hook (see
+* `recipes/interactive-auth`'s `onConnect`) so a returning client can be
+* trusted before its own `anonymous:devframe:auth` handshake call arrives.
+*/
+const DEVFRAME_AUTH_TOKEN_QUERY_PARAM = "devframe_auth_token";
 //#endregion
 //#region src/utils/diagnostics-reporter.ts
 const formatAnsi = ansiFormatter(colors);
@@ -83,14 +91,24 @@ async function getRpcResolvedSetupResult(definition, context) {
 	if (!definition.setup) return {};
 	if (typeof context === "object" && context !== null) {
 		definition.__cache ??= /* @__PURE__ */ new WeakMap();
-		let promise = definition.__cache.get(context);
+		const cache = definition.__cache;
+		let promise = cache.get(context);
 		if (!promise) {
 			promise = Promise.resolve(definition.setup(context));
-			definition.__cache.set(context, promise);
+			promise.catch(() => {
+				if (cache.get(context) === promise) cache.delete(context);
+			});
+			cache.set(context, promise);
 		}
 		return await promise;
 	}
-	definition.__promise ??= Promise.resolve(definition.setup(context));
+	if (!definition.__promise) {
+		const promise = Promise.resolve(definition.setup(context));
+		promise.catch(() => {
+			if (definition.__promise === promise) definition.__promise = void 0;
+		});
+		definition.__promise = promise;
+	}
 	return await definition.__promise;
 }
 async function getRpcHandler(definition, context) {
@@ -122,6 +140,9 @@ var RpcCacheManager = class {
 		const methodCache = this.cacheMap.get(m);
 		if (methodCache) return methodCache.get(this.keySerializer(a));
 	}
+	has(m, a) {
+		return this.cacheMap.get(m)?.has(this.keySerializer(a)) ?? false;
+	}
 	apply(req, res) {
 		const methodCache = this.cacheMap.get(req.m) || /* @__PURE__ */ new Map();
 		methodCache.set(this.keySerializer(req.a), res);
@@ -398,8 +419,12 @@ function createRpcSharedStateClientHost(rpc) {
 			return new Promise((resolve) => {
 				if (!rpc.isTrusted) {
 					resolve(state);
+					let initialized = false;
 					rpc.events.on("rpc:is-trusted:updated", (isTrusted) => {
-						if (isTrusted) initSharedState();
+						if (isTrusted && !initialized) {
+							initialized = true;
+							initSharedState();
+						}
 					});
 				} else initSharedState().then(resolve);
 			});
@@ -611,14 +636,15 @@ const EMPTY_DEFS = /* @__PURE__ */ new Map();
 */
 function createWsRpcChannel(options) {
 	let url = options.url;
-	if (options.authToken) url = `${url}?devframe_auth_token=${encodeURIComponent(options.authToken)}`;
+	if (options.authToken) url = `${url}?${DEVFRAME_AUTH_TOKEN_QUERY_PARAM}=${encodeURIComponent(options.authToken)}`;
 	const ws = new WebSocket(url);
 	const { onConnected = NOOP, onError = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS } = options;
 	ws.addEventListener("open", (e) => {
 		onConnected(e);
 	});
 	ws.addEventListener("error", (e) => {
-		onError(e instanceof Error ? e : new Error(e.type));
+		const _e = e instanceof Error ? e : new Error(e.type);
+		onError(_e);
 	});
 	ws.addEventListener("close", (e) => {
 		onDisconnected(e);
@@ -631,14 +657,25 @@ function createWsRpcChannel(options) {
 			});
 		},
 		post: (data) => {
-			if (ws.readyState === WebSocket.OPEN) ws.send(data);
-			else {
-				function handler() {
-					ws.send(data);
-					ws.removeEventListener("open", handler);
+			if (ws.readyState === WebSocket.OPEN) {
+				ws.send(data);
+				return;
+			}
+			if (ws.readyState === WebSocket.CONNECTING) {
+				const onOpen = () => {
+					cleanup();
+					if (ws.readyState === WebSocket.OPEN) ws.send(data);
+				};
+				const onClose = () => cleanup();
+				function cleanup() {
+					ws.removeEventListener("open", onOpen);
+					ws.removeEventListener("close", onClose);
 				}
-				ws.addEventListener("open", handler);
+				ws.addEventListener("open", onOpen);
+				ws.addEventListener("close", onClose);
+				return;
 			}
+			onError(/* @__PURE__ */ new Error("Devframe WebSocket is not open; message dropped"));
 		},
 		serialize: (msg) => {
 			let method;
@@ -1899,7 +1936,7 @@ function createWsRpcClientMode(options) {
 	}
 	async function requestTrustWithToken(token) {
 		currentAuthToken = token;
-		const result = await serverRpc.$call("devframe:anonymous:auth", {
+		const result = await serverRpc.$call("anonymous:devframe:auth", {
 			authToken: token,
 			ua: describeUA(),
 			origin: location.origin
@@ -1910,7 +1947,7 @@ function createWsRpcClientMode(options) {
 		return result.isTrusted;
 	}
 	async function requestTrustWithCode(code) {
-		const token = (await serverRpc.$call("devframe:auth:exchange", {
+		const token = (await serverRpc.$call("anonymous:devframe:auth:exchange", {
 			code,
 			ua: describeUA(),
 			origin: location.origin
@@ -2124,12 +2161,9 @@ async function getDevframeRpcClient(options = {}) {
 			async onRequest(req, next, resolve) {
 				await rpcOptions.onRequest?.call(this, req, next, resolve);
 				if (cacheOptions && cacheManager?.validate(req.m)) {
-					const cached = cacheManager.cached(req.m, req.a);
-					if (cached) return resolve(cached);
-					else {
-						const res = await next(req);
-						cacheManager?.apply(req, res);
-					}
+					if (cacheManager.has(req.m, req.a)) return resolve(cacheManager.cached(req.m, req.a));
+					const res = await next(req);
+					cacheManager.apply(req, res);
 				} else await next(req);
 			}
 		},

package/dist/constants.d.mts

@@ -11,6 +11,13 @@ declare const DEVFRAME_CONNECTION_META_FILENAME = "__connection.json";
  * handler here without colliding with its own routes (HMR, asset serving).
  */
 declare const DEVFRAME_WS_ROUTE = "__devframe_ws";
+/**
+ * Route the Streamable-HTTP MCP endpoint is bound to, relative to a
+ * devframe's base path. Sits next to `__connection.json` and the WS route
+ * so an MCP client reaches it on the same origin the SPA loaded from — the
+ * dev server shares one port for HTTP, WS, and MCP. Opt-in via `cli.mcp`.
+ */
+declare const DEVFRAME_MCP_ROUTE = "__mcp";
 declare const DEVFRAME_RPC_DUMP_MANIFEST_FILENAME = "__rpc-dump/index.json";
 declare const DEVFRAME_DOCK_IMPORTS_FILENAME = "__client-imports.js";
 declare const DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID = "/__devframe-client-imports.js";
@@ -29,5 +36,28 @@ declare const REMOTE_CONNECTION_KEY = "devframe-remote-connection";
  * `consumeOtpFromUrl` client utilities (or `connectDevframe`'s `otpParam`).
  */
 declare const DEVFRAME_OTP_URL_PARAM = "devframe_otp";
+/**
+ * WS upgrade-URL query parameter carrying a previously-issued bearer token.
+ * Set by `createWsRpcChannel` (browser transport) whenever `authToken` is
+ * passed; read at connect time by a host's connect-time trust hook (see
+ * `recipes/interactive-auth`'s `onConnect`) so a returning client can be
+ * trusted before its own `anonymous:devframe:auth` handshake call arrives.
+ */
+declare const DEVFRAME_AUTH_TOKEN_QUERY_PARAM = "devframe_auth_token";
+/**
+ * Prefix that marks an RPC method as callable before a connection is
+ * trusted. This is the *only* rule the pre-trust gate applies — there is no
+ * per-method allowlist. Any handshake method a host adapter needs to reach
+ * before authentication must be named `anonymous:<rest>` (e.g.
+ * `anonymous:devframe:auth`).
+ */
+declare const ANONYMOUS_RPC_PREFIX = "anonymous:";
+/**
+ * Whether `name` is callable before a connection is trusted, i.e. it starts
+ * with {@link ANONYMOUS_RPC_PREFIX}. Used by the resolver gate in
+ * `startHttpAndWs` (via an `authorize` function) and by host adapters that
+ * implement their own transport.
+ */
+declare function isAnonymousRpcMethod(name: string): boolean;
 //#endregion
-export { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DIRNAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID, DEVFRAME_MOUNT_PATH, DEVFRAME_MOUNT_PATH_NO_TRAILING_SLASH, DEVFRAME_OTP_URL_PARAM, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME, DEVFRAME_WS_ROUTE, REMOTE_CONNECTION_KEY };
+export { ANONYMOUS_RPC_PREFIX, DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DIRNAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID, DEVFRAME_MCP_ROUTE, DEVFRAME_MOUNT_PATH, DEVFRAME_MOUNT_PATH_NO_TRAILING_SLASH, DEVFRAME_OTP_URL_PARAM, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME, DEVFRAME_WS_ROUTE, REMOTE_CONNECTION_KEY, isAnonymousRpcMethod };

package/dist/constants.mjs

@@ -11,6 +11,13 @@ const DEVFRAME_CONNECTION_META_FILENAME = "__connection.json";
 * handler here without colliding with its own routes (HMR, asset serving).
 */
 const DEVFRAME_WS_ROUTE = "__devframe_ws";
+/**
+* Route the Streamable-HTTP MCP endpoint is bound to, relative to a
+* devframe's base path. Sits next to `__connection.json` and the WS route
+* so an MCP client reaches it on the same origin the SPA loaded from — the
+* dev server shares one port for HTTP, WS, and MCP. Opt-in via `cli.mcp`.
+*/
+const DEVFRAME_MCP_ROUTE = "__mcp";
 const DEVFRAME_RPC_DUMP_MANIFEST_FILENAME = "__rpc-dump/index.json";
 const DEVFRAME_DOCK_IMPORTS_FILENAME = "__client-imports.js";
 const DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID = "/__devframe-client-imports.js";
@@ -29,5 +36,30 @@ const REMOTE_CONNECTION_KEY = "devframe-remote-connection";
 * `consumeOtpFromUrl` client utilities (or `connectDevframe`'s `otpParam`).
 */
 const DEVFRAME_OTP_URL_PARAM = "devframe_otp";
+/**
+* WS upgrade-URL query parameter carrying a previously-issued bearer token.
+* Set by `createWsRpcChannel` (browser transport) whenever `authToken` is
+* passed; read at connect time by a host's connect-time trust hook (see
+* `recipes/interactive-auth`'s `onConnect`) so a returning client can be
+* trusted before its own `anonymous:devframe:auth` handshake call arrives.
+*/
+const DEVFRAME_AUTH_TOKEN_QUERY_PARAM = "devframe_auth_token";
+/**
+* Prefix that marks an RPC method as callable before a connection is
+* trusted. This is the *only* rule the pre-trust gate applies — there is no
+* per-method allowlist. Any handshake method a host adapter needs to reach
+* before authentication must be named `anonymous:<rest>` (e.g.
+* `anonymous:devframe:auth`).
+*/
+const ANONYMOUS_RPC_PREFIX = "anonymous:";
+/**
+* Whether `name` is callable before a connection is trusted, i.e. it starts
+* with {@link ANONYMOUS_RPC_PREFIX}. Used by the resolver gate in
+* `startHttpAndWs` (via an `authorize` function) and by host adapters that
+* implement their own transport.
+*/
+function isAnonymousRpcMethod(name) {
+	return name.startsWith(ANONYMOUS_RPC_PREFIX);
+}
 //#endregion
-export { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DIRNAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID, DEVFRAME_MOUNT_PATH, DEVFRAME_MOUNT_PATH_NO_TRAILING_SLASH, DEVFRAME_OTP_URL_PARAM, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME, DEVFRAME_WS_ROUTE, REMOTE_CONNECTION_KEY };
+export { ANONYMOUS_RPC_PREFIX, DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DIRNAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID, DEVFRAME_MCP_ROUTE, DEVFRAME_MOUNT_PATH, DEVFRAME_MOUNT_PATH_NO_TRAILING_SLASH, DEVFRAME_OTP_URL_PARAM, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME, DEVFRAME_WS_ROUTE, REMOTE_CONNECTION_KEY, isAnonymousRpcMethod };

package/dist/{context-3x_bgBgZ.mjs → context-CKJheEtf.mjs}

@@ -1,5 +1,5 @@
-import { t as createStorage } from "./storage-l2ezeend.mjs";
-import { i as randomToken, n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "./revoke-ENfxWkFK.mjs";
+import { t as createStorage } from "./storage-yrUZaiib.mjs";
+import { i as randomToken, n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "./revoke-BtQDKTp7.mjs";
 import { join } from "pathe";
 //#region src/node/hub-internals/context.ts
 const internalContextMap = /* @__PURE__ */ new WeakMap();

package/dist/{context-BEVByy_Z.d.mts → context-UX9qUDK7.d.mts}

@@ -1,4 +1,4 @@
-import { L as SharedState, m as DevframeNodeContext } from "./devframe-D-gr9sBx.mjs";
+import { R as SharedState, h as DevframeNodeContext } from "./devframe-BtVHhmwM.mjs";
 
 //#region src/node/hub-internals/context.d.ts
 interface InternalAnonymousAuthStorage {