devframe 0.6.0-beta.2 → 0.6.0

package/dist/index.d.mts

@@ -1,8 +1,8 @@
-import { $ as ScopedServerFunctions, G as DevframeScopedNodeContext, H as EntriesToObject, J as DevframeSettings, K as DevframeScopedNodeRpc, Q as ScopedClientFunctions, S as RpcStreamingHost, St as EventsMap, U as PartialWithoutId, W as Thenable, X as DevframeSettingsStore, Y as DevframeSettingsRegistry, Z as ScopedBroadcastOptions, _ as RpcFunctionsHost, _t as AgentToolInput, a as DevframeDuplicationStrategy, at as DevframeRpcSharedStates, b as RpcStreamingChannel, bt as EventEmitter, c as DevframeSpaOptions, ct as DevframeDiagnosticsDefinition, d as ConnectionMeta, dt as AgentHandle, et as ScopedSharedStates, f as ConnectionMetaWebsocket, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, i as DevframeDeploymentKind, it as DevframeRpcServerFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsHost, m as DevframeNodeContext, mt as AgentResourceContent, n as DevframeCliOptions, nt as DevframeViewHost, o as DevframeRuntime, ot as DevframeHost, p as DevframeCapabilities, pt as AgentResource, q as DevframeScopedStreamingHost, r as DevframeDefinition, rt as DevframeRpcClientFunctions, s as DevframeSetupInfo, st as DevframeDefineDiagnosticsOptions, t as DevframeBrowserContext, tt as SettingsForNamespace, u as defineDevframe, ut as DevframeDiagnosticsLogger, v as RpcSharedStateGetOptions, vt as DevframeAgentHost, x as RpcStreamingChannelOptions, xt as EventUnsubscribe, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "./devframe-D-gr9sBx.mjs";
+import { $ as ScopedClientFunctions, C as RpcStreamingHost, Ct as EventsMap, G as Thenable, J as DevframeScopedStreamingHost, K as DevframeScopedNodeContext, Q as ScopedBroadcastOptions, S as RpcStreamingChannelOptions, St as EventUnsubscribe, U as EntriesToObject, W as PartialWithoutId, X as DevframeSettingsRegistry, Y as DevframeSettings, Z as DevframeSettingsStore, _ as RpcBroadcastOptions, _t as AgentTool, a as DevframeDuplicationStrategy, at as DevframeRpcServerFunctions, b as RpcSharedStateHost, bt as DevframeAgentHostEvents, c as DevframeSpaOptions, ct as DevframeDefineDiagnosticsOptions, d as defineDevframe, dt as DevframeDiagnosticsLogger, et as ScopedServerFunctions, f as ConnectionMeta, ft as AgentHandle, g as DevframeNodeRpcSession, gt as AgentResourceInput, h as DevframeNodeContext, ht as AgentResourceContent, i as DevframeDeploymentKind, it as DevframeRpcClientFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsDefinition, m as DevframeCapabilities, mt as AgentResource, n as DevframeCliOptions, nt as SettingsForNamespace, o as DevframeRuntime, ot as DevframeRpcSharedStates, p as ConnectionMetaWebsocket, pt as AgentManifest, q as DevframeScopedNodeRpc, r as DevframeDefinition, rt as DevframeViewHost, s as DevframeSetupInfo, st as DevframeHost, t as DevframeBrowserContext, tt as ScopedSharedStates, u as McpRouteOptions, ut as DevframeDiagnosticsHost, v as RpcFunctionsHost, vt as AgentToolInput, x as RpcStreamingChannel, xt as EventEmitter, y as RpcSharedStateGetOptions, yt as DevframeAgentHost } from "./devframe-BtVHhmwM.mjs";
 import { C as RpcFunctionType, T as RpcReturnSchema, _ as RpcFunctionDefinition, g as RpcFunctionAgentOptions, i as RpcArgsSchema } from "./types-DZEx4ffs.mjs";
 import { t as DevframeNodeRpcSessionMeta } from "./ws-server-Bc2wBHl-.mjs";
 
 //#region src/define.d.ts
 declare const defineRpcFunction: <NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>) => RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>;
 //#endregion
-export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, PartialWithoutId, RpcBroadcastOptions, RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe, defineRpcFunction };
+export { type AgentHandle, type AgentManifest, type AgentResource, type AgentResourceContent, type AgentResourceInput, type AgentTool, type AgentToolInput, type ConnectionMeta, type ConnectionMetaWebsocket, type DevframeAgentHost, type DevframeAgentHostEvents, type DevframeBrowserContext, type DevframeCapabilities, type DevframeCliOptions, type DevframeDefineDiagnosticsOptions, type DevframeDefinition, type DevframeDeploymentKind, type DevframeDiagnosticsDefinition, type DevframeDiagnosticsHost, type DevframeDiagnosticsLogger, type DevframeDuplicationStrategy, type DevframeHost, type DevframeNodeContext, type DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, type DevframeRpcClientFunctions, type DevframeRpcServerFunctions, type DevframeRpcSharedStates, type DevframeRuntime, type DevframeScopedNodeContext, type DevframeScopedNodeRpc, type DevframeScopedStreamingHost, type DevframeSettings, type DevframeSettingsRegistry, type DevframeSettingsStore, type DevframeSetupInfo, type DevframeSpaOptions, type DevframeViewHost, type DevframeWsOptions, type EntriesToObject, type EventEmitter, type EventUnsubscribe, type EventsMap, type McpRouteOptions, type PartialWithoutId, type RpcBroadcastOptions, type RpcFunctionAgentOptions, type RpcFunctionsHost, type RpcSharedStateGetOptions, type RpcSharedStateHost, type RpcStreamingChannel, type RpcStreamingChannelOptions, type RpcStreamingHost, type ScopedBroadcastOptions, type ScopedClientFunctions, type ScopedServerFunctions, type ScopedSharedStates, type SettingsForNamespace, type Thenable, type defineDevframe, defineRpcFunction };

package/dist/{launch-editor-DPfltGA4.mjs → launch-editor-DIzaS5EG.mjs}

@@ -21,7 +21,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	value: mod,
 	enumerable: true
 }) : target, mod));
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
 //#region ../../node_modules/.pnpm/picocolors@1.1.1/node_modules/picocolors/picocolors.js
 var require_picocolors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -324,7 +324,7 @@ var require_shell_quote = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.parse = require_parse();
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.13.2/node_modules/launch-editor/editor-info/macos.js
+//#region ../../node_modules/.pnpm/launch-editor@2.14.1/node_modules/launch-editor/editor-info/macos.js
 var require_macos = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = {
 		"/Applications/Atom.app/Contents/MacOS/Atom": "atom",
@@ -359,7 +359,7 @@ var require_macos = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.13.2/node_modules/launch-editor/editor-info/linux.js
+//#region ../../node_modules/.pnpm/launch-editor@2.14.1/node_modules/launch-editor/editor-info/linux.js
 var require_linux = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = {
 		atom: "atom",
@@ -393,7 +393,7 @@ var require_linux = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.13.2/node_modules/launch-editor/editor-info/windows.js
+//#region ../../node_modules/.pnpm/launch-editor@2.14.1/node_modules/launch-editor/editor-info/windows.js
 var require_windows = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = [
 		"Brackets.exe",
@@ -426,7 +426,7 @@ var require_windows = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	];
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.13.2/node_modules/launch-editor/guess.js
+//#region ../../node_modules/.pnpm/launch-editor@2.14.1/node_modules/launch-editor/guess.js
 var require_guess = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const path$2 = __require("path");
 	const shellQuote = require_shell_quote();
@@ -434,60 +434,74 @@ var require_guess = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const COMMON_EDITORS_MACOS = require_macos();
 	const COMMON_EDITORS_LINUX = require_linux();
 	const COMMON_EDITORS_WIN = require_windows();
-	module.exports = function guessEditor(specifiedEditor) {
+	function getEditorFromMacProcesses(output) {
+		const processNames = Object.keys(COMMON_EDITORS_MACOS);
+		const processList = output.split("\n");
+		for (let i = 0; i < processNames.length; i++) {
+			const processName = processNames[i];
+			if (processList.includes(processName)) return COMMON_EDITORS_MACOS[processName];
+			const processNameWithoutApplications = processName.replace("/Applications", "");
+			if (output.indexOf(processNameWithoutApplications) !== -1) {
+				if (processName !== COMMON_EDITORS_MACOS[processName]) return COMMON_EDITORS_MACOS[processName];
+				const runningProcess = processList.find((procName) => procName.endsWith(processNameWithoutApplications));
+				if (runningProcess !== void 0) return runningProcess;
+			}
+		}
+	}
+	function getEditorFromWindowsProcesses(output) {
+		const runningProcesses = output.split("\r\n");
+		for (let i = 0; i < runningProcesses.length; i++) {
+			const fullProcessPath = runningProcesses[i].trim();
+			const shortProcessName = path$2.win32.basename(fullProcessPath);
+			if (COMMON_EDITORS_WIN.indexOf(shortProcessName) !== -1) return fullProcessPath;
+		}
+	}
+	function getEditorFromLinuxProcesses(output) {
+		const processNames = Object.keys(COMMON_EDITORS_LINUX);
+		for (let i = 0; i < processNames.length; i++) {
+			const processName = processNames[i];
+			if (output.indexOf(processName) !== -1) return COMMON_EDITORS_LINUX[processName];
+		}
+	}
+	function guessEditor(specifiedEditor) {
 		if (specifiedEditor) return shellQuote.parse(specifiedEditor);
 		if (process.env.LAUNCH_EDITOR) return [process.env.LAUNCH_EDITOR];
 		if (process.versions.webcontainer) return [process.env.EDITOR || "code"];
 		try {
 			if (process.platform === "darwin") {
-				const output = childProcess$1.execSync("ps x -o comm=", { stdio: [
+				const editor = getEditorFromMacProcesses(childProcess$1.execSync("ps x -o comm=", { stdio: [
 					"pipe",
 					"pipe",
 					"ignore"
-				] }).toString();
-				const processNames = Object.keys(COMMON_EDITORS_MACOS);
-				const processList = output.split("\n");
-				for (let i = 0; i < processNames.length; i++) {
-					const processName = processNames[i];
-					if (processList.includes(processName)) return [COMMON_EDITORS_MACOS[processName]];
-					const processNameWithoutApplications = processName.replace("/Applications", "");
-					if (output.indexOf(processNameWithoutApplications) !== -1) {
-						if (processName !== COMMON_EDITORS_MACOS[processName]) return [COMMON_EDITORS_MACOS[processName]];
-						const runningProcess = processList.find((procName) => procName.endsWith(processNameWithoutApplications));
-						if (runningProcess !== void 0) return [runningProcess];
-					}
-				}
+				] }).toString());
+				if (editor !== void 0) return [editor];
 			} else if (process.platform === "win32") {
-				const runningProcesses = childProcess$1.execSync("powershell -NoProfile -Command \"[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-CimInstance -Query \\\"select executablepath from win32_process where executablepath is not null\\\" | % { $_.ExecutablePath }\"", { stdio: [
+				const editor = getEditorFromWindowsProcesses(childProcess$1.execSync("powershell -NoProfile -Command \"[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-CimInstance -Query \\\"select executablepath from win32_process where executablepath is not null\\\" | % { $_.ExecutablePath }\"", { stdio: [
 					"pipe",
 					"pipe",
 					"ignore"
-				] }).toString().split("\r\n");
-				for (let i = 0; i < runningProcesses.length; i++) {
-					const fullProcessPath = runningProcesses[i].trim();
-					const shortProcessName = path$2.basename(fullProcessPath);
-					if (COMMON_EDITORS_WIN.indexOf(shortProcessName) !== -1) return [fullProcessPath];
-				}
+				] }).toString());
+				if (editor !== void 0) return [editor];
 			} else if (process.platform === "linux") {
-				const output = childProcess$1.execSync("ps x --no-heading -o comm --sort=comm", { stdio: [
+				const editor = getEditorFromLinuxProcesses(childProcess$1.execSync("ps x --no-heading -o comm --sort=comm", { stdio: [
 					"pipe",
 					"pipe",
 					"ignore"
-				] }).toString();
-				const processNames = Object.keys(COMMON_EDITORS_LINUX);
-				for (let i = 0; i < processNames.length; i++) {
-					const processName = processNames[i];
-					if (output.indexOf(processName) !== -1) return [COMMON_EDITORS_LINUX[processName]];
-				}
+				] }).toString());
+				if (editor !== void 0) return [editor];
 			}
 		} catch (ignoreError) {}
 		if (process.env.VISUAL) return [process.env.VISUAL];
 		else if (process.env.EDITOR) return [process.env.EDITOR];
 		return [null];
-	};
+	}
+	module.exports = guessEditor;
+	module.exports.getEditorFromMacProcesses = getEditorFromMacProcesses;
+	module.exports.getEditorFromWindowsProcesses = getEditorFromWindowsProcesses;
+	module.exports.getEditorFromLinuxProcesses = getEditorFromLinuxProcesses;
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.13.2/node_modules/launch-editor/get-args.js
+//#region ../../node_modules/.pnpm/launch-editor@2.14.1/node_modules/launch-editor/get-args.js
 var require_get_args = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const path$1 = __require("path");
 	module.exports = function getArgumentsForPosition(editor, fileName, lineNumber, columnNumber = 1) {
@@ -615,11 +629,12 @@ var import_launch_editor = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 			columnNumber: match && match[3]
 		};
 	}
-	let _childProcess = null;
+	let currentChildProcess = null;
 	function launchEditor(file, specifiedEditor, onErrorCallback) {
 		const parsed = parseFile(file);
 		let { fileName } = parsed;
 		const { lineNumber, columnNumber } = parsed;
+		if (process.platform === "win32" && path.resolve(fileName).startsWith("\\\\")) return onErrorCallback(fileName, "UNC paths are not supported on Windows to avoid security issues. See https://github.com/vitejs/launch-editor/tree/main/packages/launch-editor#unc-paths-on-windows for details.");
 		if (!fs.existsSync(fileName)) return;
 		if (typeof specifiedEditor === "function") {
 			onErrorCallback = specifiedEditor;
@@ -636,7 +651,7 @@ var import_launch_editor = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 			const extraArgs = getArgumentsForPosition(editor, fileName, lineNumber, columnNumber);
 			args.push.apply(args, extraArgs);
 		} else args.push(fileName);
-		if (_childProcess && isTerminalEditor(editor)) _childProcess.kill("SIGKILL");
+		if (currentChildProcess && isTerminalEditor(editor)) currentChildProcess.kill("SIGKILL");
 		if (process.platform === "win32") {
 			function escapeCmdArgs(cmdArgs) {
 				return cmdArgs.replace(/([&|<>,;=^])/g, "^$1");
@@ -647,16 +662,16 @@ var import_launch_editor = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 				return str;
 			}
 			const launchCommand = [editor, ...args.map(escapeCmdArgs)].map(doubleQuoteIfNeeded).join(" ");
-			_childProcess = childProcess.exec(launchCommand, {
+			currentChildProcess = childProcess.exec(launchCommand, {
 				stdio: "inherit",
 				shell: true
 			});
-		} else _childProcess = childProcess.spawn(editor, args, { stdio: "inherit" });
-		_childProcess.on("exit", function(errorCode) {
-			_childProcess = null;
+		} else currentChildProcess = childProcess.spawn(editor, args, { stdio: "inherit" });
+		currentChildProcess.on("exit", function(errorCode) {
+			currentChildProcess = null;
 			if (errorCode) onErrorCallback(fileName, "(code " + errorCode + ")");
 		});
-		_childProcess.on("error", function(error) {
+		currentChildProcess.on("error", function(error) {
 			let { code, message } = error;
 			if ("ENOENT" === code) message = `${message} ('${editor}' command does not exist in 'PATH')`;
 			onErrorCallback(fileName, message);

package/dist/node/auth.d.mts

@@ -1,64 +1,2 @@
-import { L as SharedState, h as DevframeNodeRpcSession, m as DevframeNodeContext } from "../devframe-D-gr9sBx.mjs";
-import { n as InternalAnonymousAuthStorage } from "../context-BEVByy_Z.mjs";
-
-//#region src/node/auth/revoke.d.ts
-/**
- * Flip `isTrusted` to false on any live WS clients connected with `token`
- * and broadcast the `auth:revoked` event so they can react.
- *
- * Shared between persisted-auth revocation and remote-dock token revocation.
- */
-declare function revokeActiveConnectionsForToken(context: DevframeNodeContext, token: string): Promise<void>;
-/**
- * Revoke an auth token: remove from storage and notify all connected clients
- * using this token that they are no longer trusted.
- */
-declare function revokeAuthToken(context: DevframeNodeContext, storage: SharedState<InternalAnonymousAuthStorage>, token: string): Promise<void>;
-//#endregion
-//#region src/node/auth/state.d.ts
-/**
- * The current one-time authentication code. Display this to the user (e.g. in
- * the dev-server terminal) so they can type it into the browser to authenticate.
- */
-declare function getTempAuthCode(): string;
-/**
- * Rotate the authentication code, resetting its expiry window and failed-attempt
- * counter. Call this when a new authentication flow begins (e.g. when an
- * untrusted client starts authenticating) so the displayed code is freshly
- * valid for its full TTL.
- */
-declare function refreshTempAuthCode(): string;
-/**
- * Build a "magic link" authentication URL that embeds a one-time code (OTP) as
- * a query parameter. Opening it authenticates the client without typing — print
- * it on startup (devframe stays headless, so the host prints its own banner).
- * Defaults to the current code; the link is subject to the same TTL.
- */
-declare function buildOtpAuthUrl(baseUrl: string, code?: string): string;
-/**
- * Re-authenticate a connection that presents a previously-issued bearer token.
- * Returns `true` and marks the session trusted when the token is known.
- *
- * Used by the `devframe:anonymous:auth` handler so a client that already
- * authenticated (token persisted in the browser) is trusted on reconnect
- * without entering the code again.
- */
-declare function verifyAuthToken(token: string, session: DevframeNodeRpcSession, storage: SharedState<InternalAnonymousAuthStorage>): boolean;
-/**
- * Exchange a one-time authentication code for a fresh, node-issued bearer token.
- *
- * On success this mints a high-entropy token, records it in the trusted store,
- * marks the calling session trusted, rotates the code, and returns the token
- * for the client to persist. Returns `null` on any failure.
- *
- * Because the code is short and human-typed, verification is hardened against
- * brute force: it enforces a time-to-live, compares in constant time, and
- * rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
- * attacker cannot keep guessing against the same code.
- */
-declare function exchangeTempAuthCode(code: string, session: DevframeNodeRpcSession, info: {
-  ua: string;
-  origin: string;
-}, storage: SharedState<InternalAnonymousAuthStorage>): string | null;
-//#endregion
-export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };
+import { a as verifyAuthToken, c as DevframeAuthHandler, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-ByaMT1Xp.mjs";
+export { DevframeAuthHandler, buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/auth.mjs

@@ -1,101 +1,3 @@
-import { DEVFRAME_OTP_URL_PARAM } from "../constants.mjs";
-import { a as timingSafeEqual, i as randomToken, n as revokeAuthToken, r as randomDigits, t as revokeActiveConnectionsForToken } from "../revoke-ENfxWkFK.mjs";
-//#region src/node/auth/state.ts
-/** Number of decimal digits in a human-typed one-time authentication code. */
-const TEMP_AUTH_CODE_LENGTH = 6;
-/**
-* How long an authentication code stays valid after it is (re)generated. A
-* 6-digit code only has ~20 bits of entropy, so a short lifetime plus the
-* attempt cap below are what keep it brute-force resistant.
-*/
-const TEMP_AUTH_CODE_TTL = 5 * 6e4;
-/** Failed attempts allowed against a single code before it is rotated. */
-const TEMP_AUTH_MAX_ATTEMPTS = 5;
-let tempAuthCode = generateTempCode();
-let tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
-let tempAuthFailedAttempts = 0;
-function generateTempCode() {
-	return randomDigits(TEMP_AUTH_CODE_LENGTH);
-}
-/**
-* The current one-time authentication code. Display this to the user (e.g. in
-* the dev-server terminal) so they can type it into the browser to authenticate.
-*/
-function getTempAuthCode() {
-	return tempAuthCode;
-}
-/**
-* Rotate the authentication code, resetting its expiry window and failed-attempt
-* counter. Call this when a new authentication flow begins (e.g. when an
-* untrusted client starts authenticating) so the displayed code is freshly
-* valid for its full TTL.
-*/
-function refreshTempAuthCode() {
-	tempAuthCode = generateTempCode();
-	tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
-	tempAuthFailedAttempts = 0;
-	return tempAuthCode;
-}
-/**
-* Build a "magic link" authentication URL that embeds a one-time code (OTP) as
-* a query parameter. Opening it authenticates the client without typing — print
-* it on startup (devframe stays headless, so the host prints its own banner).
-* Defaults to the current code; the link is subject to the same TTL.
-*/
-function buildOtpAuthUrl(baseUrl, code = tempAuthCode) {
-	const url = new URL(baseUrl);
-	url.searchParams.set(DEVFRAME_OTP_URL_PARAM, code);
-	return url.href;
-}
-/**
-* Re-authenticate a connection that presents a previously-issued bearer token.
-* Returns `true` and marks the session trusted when the token is known.
-*
-* Used by the `devframe:anonymous:auth` handler so a client that already
-* authenticated (token persisted in the browser) is trusted on reconnect
-* without entering the code again.
-*/
-function verifyAuthToken(token, session, storage) {
-	if (!token || !storage.value().trusted[token]) return false;
-	session.meta.clientAuthToken = token;
-	session.meta.isTrusted = true;
-	return true;
-}
-/**
-* Exchange a one-time authentication code for a fresh, node-issued bearer token.
-*
-* On success this mints a high-entropy token, records it in the trusted store,
-* marks the calling session trusted, rotates the code, and returns the token
-* for the client to persist. Returns `null` on any failure.
-*
-* Because the code is short and human-typed, verification is hardened against
-* brute force: it enforces a time-to-live, compares in constant time, and
-* rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
-* attacker cannot keep guessing against the same code.
-*/
-function exchangeTempAuthCode(code, session, info, storage) {
-	if (Date.now() > tempAuthCodeExpiresAt) {
-		refreshTempAuthCode();
-		return null;
-	}
-	if (!timingSafeEqual(code, tempAuthCode)) {
-		tempAuthFailedAttempts += 1;
-		if (tempAuthFailedAttempts >= TEMP_AUTH_MAX_ATTEMPTS) refreshTempAuthCode();
-		return null;
-	}
-	const authToken = randomToken();
-	storage.mutate((state) => {
-		state.trusted[authToken] = {
-			authToken,
-			ua: info.ua,
-			origin: info.origin,
-			timestamp: Date.now()
-		};
-	});
-	session.meta.clientAuthToken = authToken;
-	session.meta.isTrusted = true;
-	refreshTempAuthCode();
-	return authToken;
-}
-//#endregion
+import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-BtQDKTp7.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-WX3HT5a3.mjs";
 export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,5 +1,5 @@
-import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-D-gr9sBx.mjs";
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-BEVByy_Z.mjs";
+import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-BtVHhmwM.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-UX9qUDK7.mjs";
 
 //#region src/adapters/_shared.d.ts
 /**

package/dist/node/hub-internals.mjs

@@ -1,3 +1,3 @@
-import { n as internalContextMap, t as getInternalContext } from "../context-3x_bgBgZ.mjs";
+import { n as internalContextMap, t as getInternalContext } from "../context-CKJheEtf.mjs";
 import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-bWRzeSa0.mjs";
 export { getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/index.d.mts

@@ -1,8 +1,8 @@
-import { G as DevframeScopedNodeContext, J as DevframeSettings, L as SharedState, S as RpcStreamingHost, _ as RpcFunctionsHost$1, _t as AgentToolInput, bt as EventEmitter, dt as AgentHandle, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, it as DevframeRpcServerFunctions, lt as DevframeDiagnosticsHost$1, m as DevframeNodeContext, mt as AgentResourceContent, nt as DevframeViewHost$1, ot as DevframeHost, pt as AgentResource, rt as DevframeRpcClientFunctions, ut as DevframeDiagnosticsLogger, vt as DevframeAgentHost$1, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "../devframe-D-gr9sBx.mjs";
+import { C as RpcStreamingHost, K as DevframeScopedNodeContext, R as SharedState, Y as DevframeSettings, _ as RpcBroadcastOptions, _t as AgentTool, at as DevframeRpcServerFunctions, b as RpcSharedStateHost, bt as DevframeAgentHostEvents, dt as DevframeDiagnosticsLogger, ft as AgentHandle, g as DevframeNodeRpcSession, gt as AgentResourceInput, h as DevframeNodeContext, ht as AgentResourceContent, it as DevframeRpcClientFunctions, mt as AgentResource, pt as AgentManifest, rt as DevframeViewHost$1, st as DevframeHost, ut as DevframeDiagnosticsHost$1, v as RpcFunctionsHost$1, vt as AgentToolInput, xt as EventEmitter, yt as DevframeAgentHost$1 } from "../devframe-BtVHhmwM.mjs";
 import { v as RpcFunctionDefinitionAny } from "../types-DZEx4ffs.mjs";
-import { S as RpcFunctionsCollectorBase } from "../index-CxaPKDXX.mjs";
+import { S as RpcFunctionsCollectorBase } from "../index-Dy6GFDRf.mjs";
 import { t as DevframeNodeRpcSessionMeta } from "../ws-server-Bc2wBHl-.mjs";
-import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-rX781kz-.mjs";
+import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-Cfr1NrGQ.mjs";
 import { BirpcGroup } from "birpc";
 import { AsyncLocalStorage } from "node:async_hooks";
 

package/dist/node/index.mjs

@@ -1,6 +1,6 @@
-import { t as createStorage } from "../storage-l2ezeend.mjs";
-import { a as DevframeViewHost, c as createRpcSharedStateServerHost, i as createNodeSettings, l as DevframeDiagnosticsHost, n as createHostContext, o as RpcFunctionsHost, r as createScopedNodeContext, s as createRpcStreamingServerHost, t as createH3DevframeHost, u as DevframeAgentHost } from "../host-h3-C5SZlk03.mjs";
-import { t as startHttpAndWs } from "../server-Dl6TU5LE.mjs";
+import { t as createStorage } from "../storage-yrUZaiib.mjs";
+import { a as DevframeViewHost, c as createRpcSharedStateServerHost, i as createNodeSettings, l as DevframeDiagnosticsHost, n as createHostContext, o as RpcFunctionsHost, r as createScopedNodeContext, s as createRpcStreamingServerHost, t as createH3DevframeHost, u as DevframeAgentHost } from "../host-h3-Dsf-Tgwx.mjs";
+import { t as startHttpAndWs } from "../server-CAsvfJNK.mjs";
 import { isIP } from "node:net";
 //#region src/node/utils.ts
 function isObject(value) {

package/dist/recipes/interactive-auth.d.mts

@@ -0,0 +1,53 @@
+import { h as DevframeNodeContext } from "../devframe-BtVHhmwM.mjs";
+import { c as DevframeAuthHandler } from "../index-ByaMT1Xp.mjs";
+
+//#region src/recipes/interactive-auth.d.ts
+interface CreateInteractiveAuthOptions {
+  /**
+   * Static, pre-shared bearer tokens that are always trusted — for CI runs
+   * or shared machines where the interactive code prompt would only get in
+   * the way. Checked in both the handshake handler and the connect-time
+   * hook, alongside tokens minted by a real code exchange.
+   */
+  clientAuthTokens?: string[];
+  /**
+   * Print the current code + magic-link URL. Devframe stays headless, so
+   * there is no default banner printed automatically — call
+   * `auth.printBanner()` yourself once the server is listening. Override
+   * this to customize the format; defaults to a small boxed message on
+   * stdout.
+   */
+  banner?: (info: {
+    code: string;
+    url: string;
+  }) => void;
+  /**
+   * The base URL the magic link should point at. Defaults to
+   * `context.host.resolveOrigin()`.
+   */
+  serverUrl?: () => string;
+}
+/**
+ * Package the interactive OTP auth protocol devframe's primitives
+ * (`exchangeTempAuthCode`, `verifyAuthToken`, `revokeAuthToken`,
+ * `getTempAuthCode`, `buildOtpAuthUrl`) implement into a ready-made
+ * {@link DevframeAuthHandler} — the handshake RPC functions, the resolver
+ * gate, the connect-time trust hook, and the startup banner.
+ *
+ * The auth storage stays internal to this handler — callers never reach into
+ * `devframe/node/hub-internals` themselves.
+ *
+ * ```ts
+ * import { createInteractiveAuth } from 'devframe/recipes/interactive-auth'
+ *
+ * const auth = createInteractiveAuth(ctx)
+ * auth.rpcFunctions.forEach(fn => ctx.rpc.register(fn))
+ * auth.printBanner()
+ *
+ * // wire `auth.authorize` / `auth.onConnect` into your transport, or pass
+ * // the whole handler to `startHttpAndWs({ auth, ... })`.
+ * ```
+ */
+declare function createInteractiveAuth(context: DevframeNodeContext, options?: CreateInteractiveAuthOptions): DevframeAuthHandler;
+//#endregion
+export { CreateInteractiveAuthOptions, createInteractiveAuth };

package/dist/recipes/interactive-auth.mjs

@@ -0,0 +1,132 @@
+import { n as colors } from "../diagnostics-reporter-CsIG85Q5.mjs";
+import { isAnonymousRpcMethod } from "../constants.mjs";
+import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
+import { t as getInternalContext } from "../context-CKJheEtf.mjs";
+import { a as verifyAuthToken, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-WX3HT5a3.mjs";
+import * as v from "valibot";
+//#region src/recipes/interactive-auth.ts
+function defaultBanner(info) {
+	console.log(`\n  ${colors.dim("devframe auth code")}  ${colors.bold(info.code)}\n  ${colors.dim("or open")}       ${colors.cyan(info.url)}\n`);
+}
+/**
+* Package the interactive OTP auth protocol devframe's primitives
+* (`exchangeTempAuthCode`, `verifyAuthToken`, `revokeAuthToken`,
+* `getTempAuthCode`, `buildOtpAuthUrl`) implement into a ready-made
+* {@link DevframeAuthHandler} — the handshake RPC functions, the resolver
+* gate, the connect-time trust hook, and the startup banner.
+*
+* The auth storage stays internal to this handler — callers never reach into
+* `devframe/node/hub-internals` themselves.
+*
+* ```ts
+* import { createInteractiveAuth } from 'devframe/recipes/interactive-auth'
+*
+* const auth = createInteractiveAuth(ctx)
+* auth.rpcFunctions.forEach(fn => ctx.rpc.register(fn))
+* auth.printBanner()
+*
+* // wire `auth.authorize` / `auth.onConnect` into your transport, or pass
+* // the whole handler to `startHttpAndWs({ auth, ... })`.
+* ```
+*/
+function createInteractiveAuth(context, options = {}) {
+	const internal = getInternalContext(context);
+	const storage = internal.storage.auth;
+	const staticTokens = new Set(options.clientAuthTokens ?? []);
+	function isStaticToken(token) {
+		return !!token && staticTokens.has(token);
+	}
+	function resolveServerUrl() {
+		return options.serverUrl?.() ?? context.host.resolveOrigin();
+	}
+	let bannerPrintedForCode;
+	function printBanner() {
+		const code = getTempAuthCode();
+		if (code === bannerPrintedForCode) return;
+		bannerPrintedForCode = code;
+		const url = buildOtpAuthUrl(resolveServerUrl(), code);
+		(options.banner ?? defaultBanner)({
+			code,
+			url
+		});
+	}
+	const anonymousAuth = defineRpcFunction({
+		name: "anonymous:devframe:auth",
+		type: "action",
+		jsonSerializable: true,
+		args: [v.object({
+			authToken: v.string(),
+			ua: v.string(),
+			origin: v.string()
+		})],
+		returns: v.object({ isTrusted: v.boolean() }),
+		handler(params) {
+			const session = context.rpc.getCurrentRpcSession();
+			if (!session) return { isTrusted: false };
+			if (isStaticToken(params.authToken)) {
+				session.meta.clientAuthToken = params.authToken;
+				session.meta.isTrusted = true;
+				return { isTrusted: true };
+			}
+			return { isTrusted: verifyAuthToken(params.authToken, session, storage) };
+		}
+	});
+	const anonymousAuthExchange = defineRpcFunction({
+		name: "anonymous:devframe:auth:exchange",
+		type: "action",
+		jsonSerializable: true,
+		args: [v.object({
+			code: v.string(),
+			ua: v.string(),
+			origin: v.string()
+		})],
+		returns: v.object({ authToken: v.nullable(v.string()) }),
+		handler(params) {
+			const session = context.rpc.getCurrentRpcSession();
+			if (!session) return { authToken: null };
+			const authToken = exchangeTempAuthCode(params.code, session, params, storage);
+			printBanner();
+			return { authToken };
+		}
+	});
+	const revoke = defineRpcFunction({
+		name: "devframe:auth:revoke",
+		type: "action",
+		jsonSerializable: true,
+		args: [],
+		returns: v.void(),
+		async handler() {
+			const token = context.rpc.getCurrentRpcSession()?.meta.clientAuthToken;
+			if (token) await internal.revokeAuthToken(token);
+		}
+	});
+	function authorize(methodName, session) {
+		if (isAnonymousRpcMethod(methodName)) return true;
+		return !!session.meta.isTrusted;
+	}
+	function onConnect(peer, session) {
+		let token;
+		try {
+			token = new URL(peer.request?.url ?? "", "http://localhost").searchParams.get("devframe_auth_token") ?? void 0;
+		} catch {}
+		if (!token) return;
+		if (isStaticToken(token)) {
+			session.meta.clientAuthToken = token;
+			session.meta.isTrusted = true;
+			return;
+		}
+		verifyAuthToken(token, session, storage);
+	}
+	return {
+		rpcFunctions: [
+			anonymousAuth,
+			anonymousAuthExchange,
+			revoke
+		],
+		authorize,
+		onConnect,
+		printBanner
+	};
+}
+//#endregion
+export { createInteractiveAuth };

package/dist/recipes/open-helpers.mjs

@@ -1,6 +1,6 @@
-import { t as launchEditor } from "../launch-editor-DPfltGA4.mjs";
+import { t as launchEditor } from "../launch-editor-DIzaS5EG.mjs";
 import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
-import { t as open } from "../open-Dusa2Zzd.mjs";
+import { t as open } from "../open-Deb5xmIT.mjs";
 import * as v from "valibot";
 //#region src/recipes/open-helpers.ts
 /**

package/dist/{revoke-ENfxWkFK.mjs → revoke-BtQDKTp7.mjs}

@@ -19,7 +19,7 @@ function randomToken(byteLength = 16) {
 */
 function randomDigits(length) {
 	const limit = 250;
-	const buf = new Uint8Array(1);
+	const buf = /* @__PURE__ */ new Uint8Array(1);
 	let out = "";
 	while (out.length < length) {
 		globalThis.crypto.getRandomValues(buf);

package/dist/rpc/dump.mjs

@@ -1,2 +1,2 @@
-import { a as dumpFunctions, c as serializeDumpError, i as createClientFromDump, o as getDefinitionsWithDumps, s as reviveDumpError, t as collectStaticRpcDump } from "../dump-DoXkj4ku.mjs";
+import { a as dumpFunctions, c as serializeDumpError, i as createClientFromDump, o as getDefinitionsWithDumps, s as reviveDumpError, t as collectStaticRpcDump } from "../dump-D09PZb7T.mjs";
 export { collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError };