devframe 0.7.10 → 0.7.11

package/dist/adapters/cac.mjs

@@ -1,2 +1,2 @@
-import { n as defineCliFlags, r as parseCliFlags, t as createCac } from "../cac-BK-MiL3k.mjs";
+import { n as defineCliFlags, r as parseCliFlags, t as createCac } from "../cac-Drj5sjnU.mjs";
 export { createCac, defineCliFlags, parseCliFlags };

package/dist/adapters/cli.mjs

@@ -1,4 +1,4 @@
-import { n as defineCliFlags, r as parseCliFlags, t as createCac } from "../cac-BK-MiL3k.mjs";
+import { n as defineCliFlags, r as parseCliFlags, t as createCac } from "../cac-Drj5sjnU.mjs";
 //#region src/adapters/cli.ts
 /** @deprecated Use `createCac` from `devframe/adapters/cac` instead. */
 const createCli = createCac;

package/dist/adapters/dev.d.mts

@@ -1,4 +1,4 @@
-import { d as McpRouteOptions, r as DevframeDefinition, u as DevframeWsOptions } from "../devframe-C18zEiex.mjs";
+import { d as McpRouteOptions, p as DevframeAuthHandler, r as DevframeDefinition, u as DevframeWsOptions } from "../devframe-C18zEiex.mjs";
 import { n as StartedServer } from "../server-BLaM21gv.mjs";
 import { H3 } from "h3";
 //#region src/adapters/dev.d.ts
@@ -50,6 +50,17 @@ interface CreateDevServerOptions {
    * sources; a string opens that relative path.
    */
   openBrowser?: boolean | string;
+  /**
+   * Override how authentication resolves, taking precedence over
+   * `def.cli?.auth`. Pass `false` to skip the gate entirely (the standard
+   * choice for a **hosted** deployment where the host manages auth — see
+   * {@link viteDevBridge}); a {@link DevframeAuthHandler} to install a custom
+   * scheme; or `true` to force devframe's interactive OTP gate on. When
+   * omitted, auth resolves from `flags.auth` / `def.cli?.auth` (the standalone
+   * default: gated). The `--no-auth` flag (`flags.auth === false`) still forces
+   * the gate off regardless of this option.
+   */
+  auth?: boolean | DevframeAuthHandler;
   /**
    * Expose a route-based MCP server on the dev server (Streamable-HTTP).
    * Overrides `def.cli?.mcp`; `undefined` falls through to it. `false`

package/dist/adapters/dev.mjs

@@ -1,2 +1,2 @@
-import { n as resolveDevServerPort, t as createDevServer } from "../dev-DmdXbLyJ.mjs";
+import { n as resolveDevServerPort, t as createDevServer } from "../dev-BdegDQKt.mjs";
 export { createDevServer, resolveDevServerPort };

package/dist/{cac-BK-MiL3k.mjs → cac-Drj5sjnU.mjs}

@@ -1,6 +1,6 @@
 import { n as colors } from "./diagnostics-reporter-CsIG85Q5.mjs";
 import { createBuild } from "./adapters/build.mjs";
-import { n as resolveDevServerPort, t as createDevServer } from "./dev-DmdXbLyJ.mjs";
+import { n as resolveDevServerPort, t as createDevServer } from "./dev-BdegDQKt.mjs";
 import process from "node:process";
 import cac from "cac";
 import { safeParse } from "valibot";

package/dist/{dev-DmdXbLyJ.mjs → dev-BdegDQKt.mjs}

@@ -319,7 +319,7 @@ async function createDevServer(def, options = {}) {
 		...mcpMeta ? { mcp: mcpMeta } : {}
 	}));
 	if (distDir) mountStaticHandler(app, basePath, resolve(distDir));
-	const authOption = flags.auth === false ? false : def.cli?.auth;
+	const authOption = flags.auth === false ? false : options.auth !== void 0 ? options.auth : def.cli?.auth;
 	let authHandler;
 	let resolvedAuth;
 	if (authOption === false) resolvedAuth = false;

package/dist/helpers/vite.d.mts

@@ -1,4 +1,4 @@
-import { r as DevframeDefinition } from "../devframe-C18zEiex.mjs";
+import { p as DevframeAuthHandler, r as DevframeDefinition } from "../devframe-C18zEiex.mjs";
 //#region src/helpers/vite.d.ts
 interface ViteDevBridgeOptions {
   /**
@@ -30,6 +30,19 @@ interface ViteDevBridgeOptions {
     /** Flag bag forwarded to `def.setup(ctx, { flags })`. */
     flags?: Record<string, unknown>;
   };
+  /**
+   * Whether the bridged devframe runs its own auth gate. This is a **hosted**
+   * adapter — the devframe shares the host app's origin and the host owns
+   * authentication — so it defaults to `false`: the plugin's own gate never
+   * fires and its `cli.auth` default is ignored (matching devframe's
+   * hosted-deployment contract). Pass `true` to force devframe's interactive
+   * OTP gate on, or a {@link DevframeAuthHandler} to install a custom scheme.
+   * Only applies in bridge mode (`devMiddleware`); the static-mount mode
+   * starts no RPC server.
+   *
+   * @default false
+   */
+  auth?: boolean | DevframeAuthHandler;
 }
 interface DevframeVitePlugin {
   name: string;
@@ -58,6 +71,12 @@ interface DevframeVitePlugin {
  *     host-served SPA can discover the WS endpoint via
  *     {@link connectDevframe}.
  *
+ * As a hosted adapter the bridge defers authentication to the host: its
+ * side-car RPC server runs with the plugin's own auth gate **off** by
+ * default (ignoring `def.cli?.auth`), so a plugin mounted this way never
+ * triggers its standalone OTP prompt. Opt back in per-mount with
+ * `options.auth` (`true` for devframe's interactive gate, or a handler).
+ *
  * Use bridge mode when integrating with frameworks that own the SPA
  * (Nuxt, Astro, SolidStart, plain Vite apps). For the all-in-one
  * `dev` / `build` / `mcp` shell, reach for {@link createCac} instead.

package/dist/helpers/vite.mjs

@@ -2,7 +2,7 @@ import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_WS_ROUTE } from "../constan
 import { a as diagnostics } from "../storage-D_Xy9v1l.mjs";
 import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-bWRzeSa0.mjs";
 import { serveStaticNodeMiddleware } from "../utils/serve-static.mjs";
-import { n as resolveDevServerPort, t as createDevServer } from "../dev-DmdXbLyJ.mjs";
+import { n as resolveDevServerPort, t as createDevServer } from "../dev-BdegDQKt.mjs";
 import { resolve } from "pathe";
 //#region src/helpers/vite.ts
 /**
@@ -19,6 +19,12 @@ import { resolve } from "pathe";
 *     host-served SPA can discover the WS endpoint via
 *     {@link connectDevframe}.
 *
+* As a hosted adapter the bridge defers authentication to the host: its
+* side-car RPC server runs with the plugin's own auth gate **off** by
+* default (ignoring `def.cli?.auth`), so a plugin mounted this way never
+* triggers its standalone OTP prompt. Opt back in per-mount with
+* `options.auth` (`true` for devframe's interactive gate, or a handler).
+*
 * Use bridge mode when integrating with frameworks that own the SPA
 * (Nuxt, Astro, SolidStart, plain Vite apps). For the all-in-one
 * `dev` / `build` / `mcp` shell, reach for {@link createCac} instead.
@@ -51,7 +57,8 @@ function viteDevBridge(d, options = {}) {
 					host: mw.host,
 					port,
 					flags: mw.flags,
-					openBrowser: false
+					openBrowser: false,
+					auth: options.auth ?? false
 				});
 			} catch (e) {
 				diagnostics.DF0033({

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devframe",
   "type": "module",
-  "version": "0.7.10",
+  "version": "0.7.11",
   "description": "Framework for building generic devframes",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",