devframe 0.6.0-beta.2 → 0.6.0

package/dist/rpc/index.d.mts

@@ -1,3 +1,3 @@
 import { C as RpcFunctionType, E as Thenable, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinition, a as RpcDefinitionsFilter, b as RpcFunctionDefinitionBase, c as RpcDump, d as RpcDumpDefinition, f as RpcDumpGetter, g as RpcFunctionAgentOptions, h as RpcDumpStore, i as RpcArgsSchema, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, p as RpcDumpRecord, r as EntriesToObject, s as RpcDefinitionsToFunctionsWithNamespace, t as BirpcFn, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny, w as RpcFunctionsCollector, x as RpcFunctionDefinitionToFunction, y as RpcFunctionDefinitionAnyWithContext } from "../types-DZEx4ffs.mjs";
-import { C as RpcCacheManager, S as RpcFunctionsCollectorBase, _ as strictJsonStringify, a as StaticRpcDumpManifestStaticEntry, b as createDefineWrapperWithContext, c as collectStaticRpcDump, d as getDefinitionsWithDumps, f as reviveDumpError, g as STRUCTURED_CLONE_PREFIX, h as validateDefinitions, i as StaticRpcDumpManifestQueryEntry, l as createClientFromDump, m as validateDefinition, n as StaticRpcDumpFile, o as StaticRpcDumpManifestValue, p as serializeDumpError, r as StaticRpcDumpManifest, s as StaticRpcDumpSerialization, t as StaticRpcDumpCollection, u as dumpFunctions, v as getRpcHandler, w as RpcCacheOptions, x as defineRpcFunction, y as getRpcResolvedSetupResult } from "../index-CxaPKDXX.mjs";
-export { BirpcFn, BirpcReturn, EntriesToObject, RpcArgsSchema, RpcCacheManager, RpcCacheOptions, RpcDefinitionsFilter, RpcDefinitionsToFunctions, RpcDefinitionsToFunctionsWithNamespace, RpcDump, RpcDumpClientOptions, RpcDumpCollectionOptions, RpcDumpDefinition, RpcDumpGetter, RpcDumpRecord, RpcDumpRecordError, RpcDumpStore, RpcFunctionAgentOptions, RpcFunctionDefinition, RpcFunctionDefinitionAny, RpcFunctionDefinitionAnyWithContext, RpcFunctionDefinitionBase, RpcFunctionDefinitionToFunction, RpcFunctionSetupResult, RpcFunctionType, RpcFunctionsCollector, RpcFunctionsCollectorBase, RpcReturnSchema, STRUCTURED_CLONE_PREFIX, StaticRpcDumpCollection, StaticRpcDumpFile, StaticRpcDumpManifest, StaticRpcDumpManifestQueryEntry, StaticRpcDumpManifestStaticEntry, StaticRpcDumpManifestValue, StaticRpcDumpSerialization, Thenable, collectStaticRpcDump, createClientFromDump, createDefineWrapperWithContext, defineRpcFunction, dumpFunctions, getDefinitionsWithDumps, getRpcHandler, getRpcResolvedSetupResult, reviveDumpError, serializeDumpError, strictJsonStringify, validateDefinition, validateDefinitions };
+import { C as RpcCacheManager, S as RpcFunctionsCollectorBase, _ as strictJsonStringify, a as StaticRpcDumpManifestStaticEntry, b as createDefineWrapperWithContext, c as collectStaticRpcDump, d as getDefinitionsWithDumps, f as reviveDumpError, g as STRUCTURED_CLONE_PREFIX, h as validateDefinitions, i as StaticRpcDumpManifestQueryEntry, l as createClientFromDump, m as validateDefinition, n as StaticRpcDumpFile, o as StaticRpcDumpManifestValue, p as serializeDumpError, r as StaticRpcDumpManifest, s as StaticRpcDumpSerialization, t as StaticRpcDumpCollection, u as dumpFunctions, v as getRpcHandler, w as RpcCacheOptions, x as defineRpcFunction, y as getRpcResolvedSetupResult } from "../index-Dy6GFDRf.mjs";
+export { type BirpcFn, type BirpcReturn, EntriesToObject, RpcArgsSchema, RpcCacheManager, RpcCacheOptions, RpcDefinitionsFilter, RpcDefinitionsToFunctions, RpcDefinitionsToFunctionsWithNamespace, RpcDump, RpcDumpClientOptions, RpcDumpCollectionOptions, RpcDumpDefinition, RpcDumpGetter, RpcDumpRecord, RpcDumpRecordError, RpcDumpStore, RpcFunctionAgentOptions, RpcFunctionDefinition, RpcFunctionDefinitionAny, RpcFunctionDefinitionAnyWithContext, RpcFunctionDefinitionBase, RpcFunctionDefinitionToFunction, RpcFunctionSetupResult, RpcFunctionType, RpcFunctionsCollector, RpcFunctionsCollectorBase, RpcReturnSchema, STRUCTURED_CLONE_PREFIX, StaticRpcDumpCollection, StaticRpcDumpFile, StaticRpcDumpManifest, StaticRpcDumpManifestQueryEntry, StaticRpcDumpManifestStaticEntry, StaticRpcDumpManifestValue, StaticRpcDumpSerialization, Thenable, collectStaticRpcDump, createClientFromDump, createDefineWrapperWithContext, defineRpcFunction, dumpFunctions, getDefinitionsWithDumps, getRpcHandler, getRpcResolvedSetupResult, reviveDumpError, serializeDumpError, strictJsonStringify, validateDefinition, validateDefinitions };

package/dist/rpc/index.mjs

@@ -1,4 +1,4 @@
-import { a as dumpFunctions$1, c as serializeDumpError$1, d as hash, i as createClientFromDump$1, l as validateDefinition, n as getRpcHandler, o as getDefinitionsWithDumps$1, r as getRpcResolvedSetupResult, s as reviveDumpError$1, t as collectStaticRpcDump$1, u as validateDefinitions } from "../dump-DoXkj4ku.mjs";
+import { a as dumpFunctions$1, c as serializeDumpError$1, d as hash, i as createClientFromDump$1, l as validateDefinition, n as getRpcHandler, o as getDefinitionsWithDumps$1, r as getRpcResolvedSetupResult, s as reviveDumpError$1, t as collectStaticRpcDump$1, u as validateDefinitions } from "../dump-D09PZb7T.mjs";
 import { t as diagnostics } from "../diagnostics-BXwBQmoN.mjs";
 import { n as defineRpcFunction, t as createDefineWrapperWithContext } from "../define-BLWPsH6y.mjs";
 import { n as strictJsonStringify, t as STRUCTURED_CLONE_PREFIX } from "../serialization-DpLXCy13.mjs";
@@ -24,6 +24,9 @@ var RpcCacheManager = class {
 		const methodCache = this.cacheMap.get(m);
 		if (methodCache) return methodCache.get(this.keySerializer(a));
 	}
+	has(m, a) {
+		return this.cacheMap.get(m)?.has(this.keySerializer(a)) ?? false;
+	}
 	apply(req, res) {
 		const methodCache = this.cacheMap.get(req.m) || /* @__PURE__ */ new Map();
 		methodCache.set(this.keySerializer(req.a), res);

package/dist/rpc/transports/ws-client.mjs

@@ -1,3 +1,4 @@
+import { DEVFRAME_AUTH_TOKEN_QUERY_PARAM } from "../../constants.mjs";
 import { n as strictJsonStringify } from "../../serialization-DpLXCy13.mjs";
 import { n as structuredCloneStringify, t as structuredCloneParse } from "../../structured-clone-XpHLZ8nr.mjs";
 //#region src/rpc/transports/ws-client.ts
@@ -9,14 +10,15 @@ const EMPTY_DEFS = /* @__PURE__ */ new Map();
 */
 function createWsRpcChannel(options) {
 	let url = options.url;
-	if (options.authToken) url = `${url}?devframe_auth_token=${encodeURIComponent(options.authToken)}`;
+	if (options.authToken) url = `${url}?${DEVFRAME_AUTH_TOKEN_QUERY_PARAM}=${encodeURIComponent(options.authToken)}`;
 	const ws = new WebSocket(url);
 	const { onConnected = NOOP, onError = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS } = options;
 	ws.addEventListener("open", (e) => {
 		onConnected(e);
 	});
 	ws.addEventListener("error", (e) => {
-		onError(e instanceof Error ? e : new Error(e.type));
+		const _e = e instanceof Error ? e : new Error(e.type);
+		onError(_e);
 	});
 	ws.addEventListener("close", (e) => {
 		onDisconnected(e);
@@ -29,14 +31,25 @@ function createWsRpcChannel(options) {
 			});
 		},
 		post: (data) => {
-			if (ws.readyState === WebSocket.OPEN) ws.send(data);
-			else {
-				function handler() {
-					ws.send(data);
-					ws.removeEventListener("open", handler);
+			if (ws.readyState === WebSocket.OPEN) {
+				ws.send(data);
+				return;
+			}
+			if (ws.readyState === WebSocket.CONNECTING) {
+				const onOpen = () => {
+					cleanup();
+					if (ws.readyState === WebSocket.OPEN) ws.send(data);
+				};
+				const onClose = () => cleanup();
+				function cleanup() {
+					ws.removeEventListener("open", onOpen);
+					ws.removeEventListener("close", onClose);
 				}
-				ws.addEventListener("open", handler);
+				ws.addEventListener("open", onOpen);
+				ws.addEventListener("close", onClose);
+				return;
 			}
+			onError(/* @__PURE__ */ new Error("Devframe WebSocket is not open; message dropped"));
 		},
 		serialize: (msg) => {
 			let method;

package/dist/{server-Dl6TU5LE.mjs → server-CAsvfJNK.mjs}

@@ -1,6 +1,7 @@
 import { createRpcServer } from "./rpc/server.mjs";
 import { attachWsRpcTransport } from "./rpc/transports/ws-server.mjs";
-import { t as getInternalContext } from "./context-3x_bgBgZ.mjs";
+import { a as diagnostics } from "./storage-yrUZaiib.mjs";
+import { t as getInternalContext } from "./context-CKJheEtf.mjs";
 import { createServer } from "node:http";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { H3, toNodeHandler } from "h3";
@@ -18,18 +19,32 @@ async function startHttpAndWs(options) {
 	const httpServer = options.server ?? createServer(toNodeHandler(app));
 	const rpcHost = context.rpc;
 	const asyncStorage = new AsyncLocalStorage();
-	const rpcGroup = createRpcServer(rpcHost.functions, { rpcOptions: { resolver(name, fn) {
-		const rpc = this;
-		if (!fn) return void 0;
-		return async function(...args) {
-			return await asyncStorage.run({
-				rpc,
-				meta: rpc.$meta
-			}, async () => {
-				return (await fn).apply(this, args);
-			});
-		};
-	} } });
+	const authHandler = typeof options.auth === "object" ? options.auth : void 0;
+	const effectiveAuthorize = options.authorize ?? authHandler?.authorize;
+	if (authHandler) {
+		for (const fn of authHandler.rpcFunctions) if (!rpcHost.definitions.has(fn.name)) rpcHost.register(fn);
+	}
+	const rpcGroup = createRpcServer(rpcHost.functions, { rpcOptions: {
+		onFunctionError: options.rpcOptions?.onFunctionError,
+		onGeneralError: options.rpcOptions?.onGeneralError,
+		resolver(name, fn) {
+			const rpc = this;
+			if (!fn) return void 0;
+			return async function(...args) {
+				const meta = rpc.$meta;
+				if (effectiveAuthorize && !effectiveAuthorize(name, {
+					meta,
+					rpc
+				})) throw diagnostics.DF0036({ name });
+				return await asyncStorage.run({
+					rpc,
+					meta
+				}, async () => {
+					return (await fn).apply(this, args);
+				});
+			};
+		}
+	} });
 	const separateWsPort = ownsHttpServer && options.wsPort != null && options.wsPort !== port ? options.wsPort : void 0;
 	const { ws, close: closeWs } = attachWsRpcTransport(rpcGroup, {
 		...separateWsPort != null ? {
@@ -39,6 +54,14 @@ async function startHttpAndWs(options) {
 		path: options.path,
 		destroyUnmatched: ownsHttpServer,
 		allowedOrigins: options.allowedOrigins,
+		onConnected: authHandler || options.onPeerConnect ? (peer, meta) => {
+			const session = {
+				meta,
+				rpc: rpcGroup.clients.find((client) => client.$meta === meta)
+			};
+			authHandler?.onConnect(peer, session);
+			options.onPeerConnect?.(peer, session);
+		} : void 0,
 		onDisconnected: (_peer, meta) => {
 			rpcHost._emitSessionDisconnected(meta);
 		}
@@ -46,8 +69,8 @@ async function startHttpAndWs(options) {
 	rpcHost._rpcGroup = rpcGroup;
 	rpcHost._asyncStorage = asyncStorage;
 	rpcHost._authDisabled = options.auth === false;
-	if (options.auth === false && !rpcHost.definitions.has("devframe:anonymous:auth")) rpcHost.register({
-		name: "devframe:anonymous:auth",
+	if (options.auth === false && !rpcHost.definitions.has("anonymous:devframe:auth")) rpcHost.register({
+		name: "anonymous:devframe:auth",
 		type: "action",
 		handler: () => {
 			const session = rpcHost.getCurrentRpcSession();
@@ -69,12 +92,25 @@ async function startHttpAndWs(options) {
 		port: resolvedPort,
 		app
 	});
+	function connectionMeta() {
+		const jsonSerializableMethods = [];
+		for (const def of rpcHost.definitions.values()) if (def.jsonSerializable === true) jsonSerializableMethods.push(def.name);
+		return {
+			backend: "websocket",
+			websocket: separateWsPort != null ? {
+				port: separateWsPort,
+				path: options.path
+			} : { path: options.path },
+			jsonSerializableMethods
+		};
+	}
 	return {
 		origin,
 		port: resolvedPort,
 		app,
 		ws,
 		rpcGroup,
+		connectionMeta,
 		async close() {
 			await closeWs();
 			if (ownsHttpServer) await new Promise((r) => httpServer.close(() => r()));

package/dist/{server-rX781kz-.d.mts → server-Cfr1NrGQ.d.mts}

@@ -1,5 +1,7 @@
-import { it as DevframeRpcServerFunctions, m as DevframeNodeContext, rt as DevframeRpcClientFunctions } from "./devframe-D-gr9sBx.mjs";
-import { BirpcGroup } from "birpc";
+import { at as DevframeRpcServerFunctions, f as ConnectionMeta, g as DevframeNodeRpcSession, h as DevframeNodeContext, it as DevframeRpcClientFunctions } from "./devframe-BtVHhmwM.mjs";
+import { c as DevframeAuthHandler } from "./index-ByaMT1Xp.mjs";
+import { BirpcGroup, EventOptions } from "birpc";
+import { Peer } from "crossws";
 import { NodeAdapter } from "crossws/adapters/node";
 import { Server } from "node:http";
 import { H3 } from "h3";
@@ -41,16 +43,48 @@ interface StartHttpAndWsOptions {
    */
   server?: Server;
   /**
-   * When `false`, the RPC server is started without a trust handshake.
-   * Intended for single-user localhost tools where an auth round-trip
-   * would only get in the way. The Vite-flavoured auth layer in
-   * `@vitejs/devtools` already honors the equivalent
-   * `devtools.clientAuth` setting; devframe records the intent here so
-   * future auth plumbing can consult it without another API change.
+   * Authentication for the server:
    *
-   * Default: `true`.
+   *   - `true` (default) — no gate; every registered method is callable
+   *     regardless of trust (today's behavior, unchanged).
+   *   - `false` — the RPC server is started without a trust handshake.
+   *     Intended for single-user localhost tools where an auth round-trip
+   *     would only get in the way. A noop `anonymous:devframe:auth` handler
+   *     is registered so the browser client's unconditional handshake call
+   *     succeeds and auto-trusts.
+   *   - A {@link DevframeAuthHandler} (e.g. from
+   *     `devframe/recipes/interactive-auth`'s `createInteractiveAuth`) —
+   *     registers its `rpcFunctions`, wires its `authorize` as the resolver
+   *     gate, and wires its `onConnect` on every new peer. This is the
+   *     fully-authenticated server: an untrusted caller can only reach
+   *     `anonymous:`-prefixed methods (see `isAnonymousRpcMethod`).
    */
-  auth?: boolean;
+  auth?: boolean | DevframeAuthHandler;
+  /**
+   * Lower-level escape hatch: gate individual RPC calls by method name and
+   * session without a full {@link DevframeAuthHandler}. Ignored when `auth`
+   * is a handler object (its own `authorize` is used); combine with `auth:
+   * true` to layer a custom policy on top of an otherwise ungated server.
+   */
+  authorize?: (methodName: string, session: DevframeNodeRpcSession) => boolean;
+  /**
+   * Called once per new WS connection, right after its session is created
+   * (before any RPC call is dispatched). Runs after the auth handler's own
+   * `onConnect` (when `auth` is a {@link DevframeAuthHandler}), so it can
+   * observe — but not override — the connect-time trust decision.
+   */
+  onPeerConnect?: (peer: Peer, session: DevframeNodeRpcSession) => void;
+  /**
+   * Forwarded verbatim to the internal `createRpcServer`'s birpc
+   * `rpcOptions`, alongside the resolver `startHttpAndWs` installs for
+   * auth/session wiring. Use this so a host that owns its own structured
+   * diagnostics (e.g. a coded error reporter) keeps seeing RPC failures
+   * instead of them being silently absorbed by delegating to
+   * `startHttpAndWs`. Returning `true` from either callback suppresses
+   * birpc's own error response to the caller — see birpc's
+   * `EventOptions` for the full contract.
+   */
+  rpcOptions?: Pick<EventOptions<DevframeRpcClientFunctions, DevframeRpcServerFunctions, false>, 'onFunctionError' | 'onGeneralError'>;
   /**
    * Extra origins to accept on the WS upgrade beyond the loopback default
    * (`localhost`/`127.0.0.1`/`::1` and any `Origin`-less request from a
@@ -78,6 +112,14 @@ interface StartedServer {
   /** The crossws node adapter driving the RPC socket (connected peers, pub/sub). */
   ws: NodeAdapter;
   rpcGroup: BirpcGroup<DevframeRpcClientFunctions, DevframeRpcServerFunctions, false>;
+  /**
+   * The {@link ConnectionMeta} descriptor for this server — the same shape
+   * a `__connection.json` route should serve so a devframe client's
+   * `resolveWsUrl` can dial back in. Reflects the `path` / `wsPort` this
+   * server was started with and the `jsonSerializable` methods currently
+   * registered on `context.rpc`.
+   */
+  connectionMeta: () => ConnectionMeta;
   close: () => Promise<void>;
 }
 /**

package/dist/{shared-state-D4PPieA0.mjs → shared-state-QtMas0NG.mjs}

@@ -1,6 +1,6 @@
 import { createEventEmitter } from "./utils/events.mjs";
 import { nanoid } from "./utils/nanoid.mjs";
-//#region ../../node_modules/.pnpm/immer@11.1.8/node_modules/immer/dist/immer.mjs
+//#region ../../node_modules/.pnpm/immer@11.1.11/node_modules/immer/dist/immer.mjs
 var NOTHING = Symbol.for("immer-nothing");
 var DRAFTABLE = Symbol.for("immer-draftable");
 var DRAFT_STATE = Symbol.for("immer-state");
@@ -350,6 +350,21 @@ function createProxyProxy(base, parent) {
 var objectTraps = {
 	get(state, prop) {
 		if (prop === DRAFT_STATE) return state;
+		if (prop === "constructor" || prop === "__proto__") {
+			const value2 = latest(state)[prop];
+			return new Proxy(value2 || {}, {
+				get: (target, key) => {
+					if (key === "__proto__" || key === "prototype") return Object.freeze(/* @__PURE__ */ Object.create(null));
+					return Reflect.get(target, key);
+				},
+				set: () => {
+					return true;
+				},
+				apply: (target, thisArg, args) => {
+					return Reflect.apply(target, thisArg, args);
+				}
+			});
+		}
 		let arrayPlugin = state.scope_.arrayMethodsPlugin_;
 		const isArrayWithStringProp = state.type_ === 1 && typeof prop === "string";
 		if (isArrayWithStringProp) {
@@ -369,12 +384,14 @@ var objectTraps = {
 		return value;
 	},
 	has(state, prop) {
+		if (prop === "constructor" || prop === "__proto__" || prop === "prototype") return false;
 		return prop in latest(state);
 	},
 	ownKeys(state) {
 		return Reflect.ownKeys(latest(state));
 	},
 	set(state, prop, value) {
+		if (prop === "constructor" || prop === "__proto__" || prop === "prototype") return true;
 		const desc = getDescriptorFromProto(latest(state), prop);
 		if (desc?.set) {
 			desc.set.call(state.draft_, value);
@@ -392,7 +409,7 @@ var objectTraps = {
 			prepareCopy(state);
 			markChanged(state);
 		}
-		if (state.copy_[prop] === value && (value !== void 0 || prop in state.copy_) || Number.isNaN(value) && Number.isNaN(state.copy_[prop])) return true;
+		if (state.copy_[prop] === value && (value !== void 0 || has(state.copy_, prop, state.type_)) || Number.isNaN(value) && Number.isNaN(state.copy_[prop])) return true;
 		state.copy_[prop] = value;
 		state.assigned_.set(prop, true);
 		handleCrossReference(state, prop, value);
@@ -894,6 +911,19 @@ var produceWithPatches = /* @__PURE__ */ immer.produceWithPatches.bind(immer);
 var applyPatches = /* @__PURE__ */ immer.applyPatches.bind(immer);
 //#endregion
 //#region src/utils/shared-state.ts
+/**
+* Upper bound on retained syncIds. Loop echoes arrive near-immediately, so a
+* generous window preserves de-dup while capping memory on long-lived,
+* frequently-mutated states (e.g. a 1s terminal poll).
+*/
+const MAX_SYNC_IDS = 1e3;
+function rememberSyncId(syncIds, syncId) {
+	syncIds.add(syncId);
+	if (syncIds.size > MAX_SYNC_IDS) {
+		const oldest = syncIds.values().next().value;
+		if (oldest !== void 0) syncIds.delete(oldest);
+	}
+}
 function createSharedState(options) {
 	const { enablePatches: enablePatches$1 = false } = options;
 	const events = createEventEmitter();
@@ -906,12 +936,12 @@ function createSharedState(options) {
 			if (syncIds.has(syncId)) return;
 			enablePatches();
 			state = applyPatches(state, patches);
-			syncIds.add(syncId);
+			rememberSyncId(syncIds, syncId);
 			events.emit("updated", state, void 0, syncId);
 		},
 		mutate: (fn, syncId = nanoid()) => {
 			if (syncIds.has(syncId)) return;
-			syncIds.add(syncId);
+			rememberSyncId(syncIds, syncId);
 			if (enablePatches$1) {
 				const [newState, patches] = produceWithPatches(state, fn);
 				state = newState;

package/dist/state-WX3HT5a3.mjs

@@ -0,0 +1,101 @@
+import { DEVFRAME_OTP_URL_PARAM } from "./constants.mjs";
+import { a as timingSafeEqual, i as randomToken, r as randomDigits } from "./revoke-BtQDKTp7.mjs";
+//#region src/node/auth/state.ts
+/** Number of decimal digits in a human-typed one-time authentication code. */
+const TEMP_AUTH_CODE_LENGTH = 6;
+/**
+* How long an authentication code stays valid after it is (re)generated. A
+* 6-digit code only has ~20 bits of entropy, so a short lifetime plus the
+* attempt cap below are what keep it brute-force resistant.
+*/
+const TEMP_AUTH_CODE_TTL = 5 * 6e4;
+/** Failed attempts allowed against a single code before it is rotated. */
+const TEMP_AUTH_MAX_ATTEMPTS = 5;
+let tempAuthCode = generateTempCode();
+let tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
+let tempAuthFailedAttempts = 0;
+function generateTempCode() {
+	return randomDigits(TEMP_AUTH_CODE_LENGTH);
+}
+/**
+* The current one-time authentication code. Display this to the user (e.g. in
+* the dev-server terminal) so they can type it into the browser to authenticate.
+*/
+function getTempAuthCode() {
+	return tempAuthCode;
+}
+/**
+* Rotate the authentication code, resetting its expiry window and failed-attempt
+* counter. Call this when a new authentication flow begins (e.g. when an
+* untrusted client starts authenticating) so the displayed code is freshly
+* valid for its full TTL.
+*/
+function refreshTempAuthCode() {
+	tempAuthCode = generateTempCode();
+	tempAuthCodeExpiresAt = Date.now() + TEMP_AUTH_CODE_TTL;
+	tempAuthFailedAttempts = 0;
+	return tempAuthCode;
+}
+/**
+* Build a "magic link" authentication URL that embeds a one-time code (OTP) as
+* a query parameter. Opening it authenticates the client without typing — print
+* it on startup (devframe stays headless, so the host prints its own banner).
+* Defaults to the current code; the link is subject to the same TTL.
+*/
+function buildOtpAuthUrl(baseUrl, code = tempAuthCode) {
+	const url = new URL(baseUrl);
+	url.searchParams.set(DEVFRAME_OTP_URL_PARAM, code);
+	return url.href;
+}
+/**
+* Re-authenticate a connection that presents a previously-issued bearer token.
+* Returns `true` and marks the session trusted when the token is known.
+*
+* Used by the `anonymous:devframe:auth` handler so a client that already
+* authenticated (token persisted in the browser) is trusted on reconnect
+* without entering the code again.
+*/
+function verifyAuthToken(token, session, storage) {
+	if (!token || !storage.value().trusted[token]) return false;
+	session.meta.clientAuthToken = token;
+	session.meta.isTrusted = true;
+	return true;
+}
+/**
+* Exchange a one-time authentication code for a fresh, node-issued bearer token.
+*
+* On success this mints a high-entropy token, records it in the trusted store,
+* marks the calling session trusted, rotates the code, and returns the token
+* for the client to persist. Returns `null` on any failure.
+*
+* Because the code is short and human-typed, verification is hardened against
+* brute force: it enforces a time-to-live, compares in constant time, and
+* rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
+* attacker cannot keep guessing against the same code.
+*/
+function exchangeTempAuthCode(code, session, info, storage) {
+	if (Date.now() > tempAuthCodeExpiresAt) {
+		refreshTempAuthCode();
+		return null;
+	}
+	if (!timingSafeEqual(code, tempAuthCode)) {
+		tempAuthFailedAttempts += 1;
+		if (tempAuthFailedAttempts >= TEMP_AUTH_MAX_ATTEMPTS) refreshTempAuthCode();
+		return null;
+	}
+	const authToken = randomToken();
+	storage.mutate((state) => {
+		state.trusted[authToken] = {
+			authToken,
+			ua: info.ua,
+			origin: info.origin,
+			timestamp: Date.now()
+		};
+	});
+	session.meta.clientAuthToken = authToken;
+	session.meta.isTrusted = true;
+	refreshTempAuthCode();
+	return authToken;
+}
+//#endregion
+export { verifyAuthToken as a, refreshTempAuthCode as i, exchangeTempAuthCode as n, getTempAuthCode as r, buildOtpAuthUrl as t };

package/dist/{storage-l2ezeend.mjs → storage-yrUZaiib.mjs}

@@ -2,6 +2,7 @@ import { t as devframeReporter } from "./diagnostics-reporter-CsIG85Q5.mjs";
 import { defineDiagnostics } from "nostics";
 import fs from "node:fs";
 import { dirname } from "pathe";
+import process$1 from "node:process";
 import { destr } from "destr";
 //#region src/node/diagnostics.ts
 const diagnostics = defineDiagnostics({
@@ -46,6 +47,14 @@ const diagnostics = defineDiagnostics({
 		DF0034: {
 			why: (p) => `Scoped RPC registration for namespace "${p.namespace}" received an already-namespaced function name "${p.name}".`,
 			fix: "A scoped context auto-namespaces ids. Pass a bare name without a \":\" separator (e.g. `register({ name: \"get-cwd\" })`), or use the unscoped `ctx.base.rpc.register` for a fully-qualified name."
+		},
+		DF0035: {
+			why: (p) => `Failed to persist storage file: ${p.filepath}`,
+			fix: "Check that the storage directory is writable and has free space."
+		},
+		DF0036: {
+			why: (p) => `RPC call to "${p.name}" was rejected: the caller is not authorized.`,
+			fix: "Complete the auth handshake (or connect with a static/pre-shared token) before calling a trusted method. Untrusted callers may only call `anonymous:`-prefixed methods — see `isAnonymousRpcMethod`."
 		}
 	}
 });
@@ -89,7 +98,7 @@ function createEventEmitter() {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/immer@11.1.8/node_modules/immer/dist/immer.mjs
+//#region ../../node_modules/.pnpm/immer@11.1.11/node_modules/immer/dist/immer.mjs
 var NOTHING = Symbol.for("immer-nothing");
 var DRAFTABLE = Symbol.for("immer-draftable");
 var DRAFT_STATE = Symbol.for("immer-state");
@@ -439,6 +448,21 @@ function createProxyProxy(base, parent) {
 var objectTraps = {
 	get(state, prop) {
 		if (prop === DRAFT_STATE) return state;
+		if (prop === "constructor" || prop === "__proto__") {
+			const value2 = latest(state)[prop];
+			return new Proxy(value2 || {}, {
+				get: (target, key) => {
+					if (key === "__proto__" || key === "prototype") return Object.freeze(/* @__PURE__ */ Object.create(null));
+					return Reflect.get(target, key);
+				},
+				set: () => {
+					return true;
+				},
+				apply: (target, thisArg, args) => {
+					return Reflect.apply(target, thisArg, args);
+				}
+			});
+		}
 		let arrayPlugin = state.scope_.arrayMethodsPlugin_;
 		const isArrayWithStringProp = state.type_ === 1 && typeof prop === "string";
 		if (isArrayWithStringProp) {
@@ -458,12 +482,14 @@ var objectTraps = {
 		return value;
 	},
 	has(state, prop) {
+		if (prop === "constructor" || prop === "__proto__" || prop === "prototype") return false;
 		return prop in latest(state);
 	},
 	ownKeys(state) {
 		return Reflect.ownKeys(latest(state));
 	},
 	set(state, prop, value) {
+		if (prop === "constructor" || prop === "__proto__" || prop === "prototype") return true;
 		const desc = getDescriptorFromProto(latest(state), prop);
 		if (desc?.set) {
 			desc.set.call(state.draft_, value);
@@ -481,7 +507,7 @@ var objectTraps = {
 			prepareCopy(state);
 			markChanged(state);
 		}
-		if (state.copy_[prop] === value && (value !== void 0 || prop in state.copy_) || Number.isNaN(value) && Number.isNaN(state.copy_[prop])) return true;
+		if (state.copy_[prop] === value && (value !== void 0 || has(state.copy_, prop, state.type_)) || Number.isNaN(value) && Number.isNaN(state.copy_[prop])) return true;
 		state.copy_[prop] = value;
 		state.assigned_.set(prop, true);
 		handleCrossReference(state, prop, value);
@@ -992,6 +1018,19 @@ function nanoid(size = 21) {
 }
 //#endregion
 //#region src/utils/shared-state.ts
+/**
+* Upper bound on retained syncIds. Loop echoes arrive near-immediately, so a
+* generous window preserves de-dup while capping memory on long-lived,
+* frequently-mutated states (e.g. a 1s terminal poll).
+*/
+const MAX_SYNC_IDS = 1e3;
+function rememberSyncId(syncIds, syncId) {
+	syncIds.add(syncId);
+	if (syncIds.size > MAX_SYNC_IDS) {
+		const oldest = syncIds.values().next().value;
+		if (oldest !== void 0) syncIds.delete(oldest);
+	}
+}
 function createSharedState(options) {
 	const { enablePatches: enablePatches$1 = false } = options;
 	const events = createEventEmitter();
@@ -1004,12 +1043,12 @@ function createSharedState(options) {
 			if (syncIds.has(syncId)) return;
 			enablePatches();
 			state = applyPatches(state, patches);
-			syncIds.add(syncId);
+			rememberSyncId(syncIds, syncId);
 			events.emit("updated", state, void 0, syncId);
 		},
 		mutate: (fn, syncId = nanoid()) => {
 			if (syncIds.has(syncId)) return;
-			syncIds.add(syncId);
+			rememberSyncId(syncIds, syncId);
 			if (enablePatches$1) {
 				const [newState, patches] = produceWithPatches(state, fn);
 				state = newState;
@@ -1132,8 +1171,18 @@ function createStorage(options) {
 		enablePatches: false
 	});
 	state.on("updated", debounce((newState) => {
-		fs.mkdirSync(dirname(options.filepath), { recursive: true });
-		fs.writeFileSync(options.filepath, `${JSON.stringify(newState, null, 2)}\n`);
+		try {
+			const dir = dirname(options.filepath);
+			fs.mkdirSync(dir, { recursive: true });
+			const tmp = `${options.filepath}.${process$1.pid}.tmp`;
+			fs.writeFileSync(tmp, `${JSON.stringify(newState, null, 2)}\n`);
+			fs.renameSync(tmp, options.filepath);
+		} catch (error) {
+			diagnostics.DF0035({
+				filepath: options.filepath,
+				cause: error
+			}, { method: "error" });
+		}
 	}, debounceTime));
 	return state;
 }

package/dist/types/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as ScopedServerFunctions, G as DevframeScopedNodeContext, H as EntriesToObject, J as DevframeSettings, K as DevframeScopedNodeRpc, Q as ScopedClientFunctions, S as RpcStreamingHost, St as EventsMap, U as PartialWithoutId, W as Thenable, X as DevframeSettingsStore, Y as DevframeSettingsRegistry, Z as ScopedBroadcastOptions, _ as RpcFunctionsHost, _t as AgentToolInput, a as DevframeDuplicationStrategy, at as DevframeRpcSharedStates, b as RpcStreamingChannel, bt as EventEmitter, c as DevframeSpaOptions, ct as DevframeDiagnosticsDefinition, d as ConnectionMeta, dt as AgentHandle, et as ScopedSharedStates, f as ConnectionMetaWebsocket, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, i as DevframeDeploymentKind, it as DevframeRpcServerFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsHost, m as DevframeNodeContext, mt as AgentResourceContent, n as DevframeCliOptions, nt as DevframeViewHost, o as DevframeRuntime, ot as DevframeHost, p as DevframeCapabilities, pt as AgentResource, q as DevframeScopedStreamingHost, r as DevframeDefinition, rt as DevframeRpcClientFunctions, s as DevframeSetupInfo, st as DevframeDefineDiagnosticsOptions, t as DevframeBrowserContext, tt as SettingsForNamespace, u as defineDevframe, ut as DevframeDiagnosticsLogger, v as RpcSharedStateGetOptions, vt as DevframeAgentHost, x as RpcStreamingChannelOptions, xt as EventUnsubscribe, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "../devframe-D-gr9sBx.mjs";
+import { $ as ScopedClientFunctions, C as RpcStreamingHost, Ct as EventsMap, G as Thenable, J as DevframeScopedStreamingHost, K as DevframeScopedNodeContext, Q as ScopedBroadcastOptions, S as RpcStreamingChannelOptions, St as EventUnsubscribe, U as EntriesToObject, W as PartialWithoutId, X as DevframeSettingsRegistry, Y as DevframeSettings, Z as DevframeSettingsStore, _ as RpcBroadcastOptions, _t as AgentTool, a as DevframeDuplicationStrategy, at as DevframeRpcServerFunctions, b as RpcSharedStateHost, bt as DevframeAgentHostEvents, c as DevframeSpaOptions, ct as DevframeDefineDiagnosticsOptions, d as defineDevframe, dt as DevframeDiagnosticsLogger, et as ScopedServerFunctions, f as ConnectionMeta, ft as AgentHandle, g as DevframeNodeRpcSession, gt as AgentResourceInput, h as DevframeNodeContext, ht as AgentResourceContent, i as DevframeDeploymentKind, it as DevframeRpcClientFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsDefinition, m as DevframeCapabilities, mt as AgentResource, n as DevframeCliOptions, nt as SettingsForNamespace, o as DevframeRuntime, ot as DevframeRpcSharedStates, p as ConnectionMetaWebsocket, pt as AgentManifest, q as DevframeScopedNodeRpc, r as DevframeDefinition, rt as DevframeViewHost, s as DevframeSetupInfo, st as DevframeHost, t as DevframeBrowserContext, tt as ScopedSharedStates, u as McpRouteOptions, ut as DevframeDiagnosticsHost, v as RpcFunctionsHost, vt as AgentToolInput, x as RpcStreamingChannel, xt as EventEmitter, y as RpcSharedStateGetOptions, yt as DevframeAgentHost } from "../devframe-BtVHhmwM.mjs";
 import { g as RpcFunctionAgentOptions } from "../types-DZEx4ffs.mjs";
 import { t as DevframeNodeRpcSessionMeta } from "../ws-server-Bc2wBHl-.mjs";
-export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, PartialWithoutId, RpcBroadcastOptions, RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe };
+export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, McpRouteOptions, PartialWithoutId, RpcBroadcastOptions, type RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe };

package/dist/utils/crypto-token.mjs

@@ -19,7 +19,7 @@ function randomToken(byteLength = 16) {
 */
 function randomDigits(length) {
 	const limit = 250;
-	const buf = new Uint8Array(1);
+	const buf = /* @__PURE__ */ new Uint8Array(1);
 	let out = "";
 	while (out.length < length) {
 		globalThis.crypto.getRandomValues(buf);

package/dist/utils/events.d.mts

@@ -1,4 +1,4 @@
-import { St as EventsMap, bt as EventEmitter } from "../devframe-D-gr9sBx.mjs";
+import { Ct as EventsMap, xt as EventEmitter } from "../devframe-BtVHhmwM.mjs";
 
 //#region src/utils/events.d.ts
 /**

package/dist/utils/hash.mjs

@@ -1,2 +1,2 @@
-import { t as hash } from "../hash-DFc5WwhO.mjs";
+import { t as hash } from "../hash-PAfnyu2k.mjs";
 export { hash };

package/dist/utils/launch-editor.mjs

@@ -1,2 +1,2 @@
-import { t as launchEditor } from "../launch-editor-DPfltGA4.mjs";
+import { t as launchEditor } from "../launch-editor-DIzaS5EG.mjs";
 export { launchEditor };

package/dist/utils/open.mjs

@@ -1,2 +1,2 @@
-import { t as open } from "../open-Dusa2Zzd.mjs";
+import { t as open } from "../open-Deb5xmIT.mjs";
 export { open };

package/dist/utils/serve-static.mjs

@@ -143,7 +143,8 @@ function serveStaticNodeMiddleware(dir, options) {
 				res.end();
 				return;
 			}
-			const file = await resolveTarget(absDir, req.url ?? "/", opts.indexNames, opts.single);
+			const url = req.url ?? "/";
+			const file = await resolveTarget(absDir, url, opts.indexNames, opts.single);
 			if (!file) {
 				if (next) {
 					next();