devframe 0.7.16 → 0.8.1

package/dist/{host-h3-CgOetlNE.mjs → host-h3-Kz7t5Xab.mjs}

@@ -1,8 +1,9 @@
 import { t as devframeReporter } from "./diagnostics-reporter-CsIG85Q5.mjs";
-import { t as diagnostics } from "./diagnostics-BXwBQmoN.mjs";
+import { t as diagnostics } from "./diagnostics-hwjXp_UV.mjs";
 import { RpcFunctionsCollectorBase } from "./rpc/index.mjs";
 import { defineRpcFunction } from "./index.mjs";
-import { a as diagnostics$1, i as createEventEmitter, n as createSharedState, r as nanoid, t as createStorage } from "./storage-gEnj9ASQ.mjs";
+import { t as diagnostics$1 } from "./diagnostics-B5-qHeqD.mjs";
+import { i as createEventEmitter, n as createSharedState, r as nanoid, t as createStorage } from "./storage-Dzoc3NVC.mjs";
 import { defineDiagnostics } from "nostics";
 import { isatty } from "node:tty";
 import { formatWithOptions, inspect } from "node:util";
@@ -10,6 +11,43 @@ import { existsSync } from "node:fs";
 import { join } from "pathe";
 import process$1 from "node:process";
 import { homedir } from "node:os";
+//#region src/node/agent-args.ts
+/**
+* Map the args payload an agent surface receives (MCP sends an object
+* keyed `arg0`/`arg1`/…, matching the schema the adapter advertises) onto
+* a handler's positional parameters. Shared by the agent host's RPC
+* bridge and the hub's command-derived tools so the coercion cannot
+* drift between them.
+*
+* - an array passes through as-is
+* - `null`/`undefined` become a zero-argument call
+* - with declared schemas, each schema reads its own `argN` key, in order
+* - without schemas, `arg0`/`arg1`/… keys are collected when present
+* - an empty object becomes a zero-argument call
+* - anything else follows the {@link AgentArgsFallback}
+*
+* @experimental
+*/
+function coerceAgentPositionalArgs(args, schemas, fallback = "wrap") {
+	if (Array.isArray(args)) return args;
+	if (args === void 0 || args === null) return [];
+	if (typeof args === "object") {
+		const obj = args;
+		if (schemas && schemas.length) return schemas.map((_, i) => obj[`arg${i}`]);
+		if ("arg0" in obj) {
+			const out = [];
+			let i = 0;
+			while (`arg${i}` in obj) {
+				out.push(obj[`arg${i}`]);
+				i++;
+			}
+			return out;
+		}
+		if (Object.keys(obj).length === 0) return [];
+	}
+	return fallback === "drop" ? [] : [args];
+}
+//#endregion
 //#region src/node/host-agent.ts
 /**
 * Framework-neutral host aggregating the agent-exposed surface of a
@@ -24,6 +62,7 @@ var DevframeAgentHost = class {
 	events = createEventEmitter();
 	tools = /* @__PURE__ */ new Map();
 	resources = /* @__PURE__ */ new Map();
+	providers = /* @__PURE__ */ new Set();
 	_rpcUnsubscribe;
 	constructor(context) {
 		this.context = context;
@@ -50,6 +89,19 @@ var DevframeAgentHost = class {
 		}
 		return existed;
 	}
+	registerToolProvider(provider) {
+		this.providers.add(provider);
+		this.events.emit("agent:manifest:changed");
+		const notifyChanged = () => {
+			if (this.providers.has(provider)) this.events.emit("agent:manifest:changed");
+		};
+		return {
+			notifyChanged,
+			unregister: () => {
+				if (this.providers.delete(provider)) this.events.emit("agent:manifest:changed");
+			}
+		};
+	}
 	registerResource(input) {
 		if (this.resources.has(input.id)) throw diagnostics$1.DF0016({ id: input.id });
 		const resource = {
@@ -79,15 +131,28 @@ var DevframeAgentHost = class {
 		const rpcTools = this._collectRpcTools();
 		const plainTools = Array.from(this.tools.values()).map((t) => t.tool);
 		const resources = Array.from(this.resources.values()).map((r) => r.resource);
+		const seen = new Set([...rpcTools, ...plainTools].map((t) => t.id));
+		const providerTools = [];
+		for (const { tool } of this._collectProviderTools()) {
+			if (seen.has(tool.id)) continue;
+			seen.add(tool.id);
+			providerTools.push(tool);
+		}
 		return {
-			tools: [...rpcTools, ...plainTools],
+			tools: [
+				...rpcTools,
+				...plainTools,
+				...providerTools
+			],
 			resources
 		};
 	}
 	getTool(id) {
 		const plain = this.tools.get(id);
 		if (plain) return plain.tool;
-		return this._collectRpcTools().find((t) => t.id === id);
+		const rpc = this._collectRpcTools().find((t) => t.id === id);
+		if (rpc) return rpc;
+		return this._collectProviderTools().find((t) => t.tool.id === id)?.tool;
 	}
 	getResource(id) {
 		return this.resources.get(id)?.resource;
@@ -97,9 +162,11 @@ var DevframeAgentHost = class {
 		if (plain?.handler) return await plain.handler(args);
 		const rpcDef = this._findRpcDefinition(id);
 		if (rpcDef) {
-			const positional = this._coercePositionalArgs(args, rpcDef);
+			const positional = coerceAgentPositionalArgs(args, rpcDef.args, "wrap");
 			return await this.context.rpc.invokeLocal(id, ...positional);
 		}
+		const provided = this._collectProviderTools().find((t) => t.tool.id === id);
+		if (provided) return await provided.input.handler(args);
 		throw new Error(`[devframe/agent] tool "${id}" not found`);
 	}
 	async read(id) {
@@ -125,11 +192,21 @@ var DevframeAgentHost = class {
 			description: input.description,
 			safety: input.safety ?? "action",
 			tags: input.tags,
+			args: input.args,
 			inputSchema: input.inputSchema,
 			outputSchema: input.outputSchema,
 			examples: input.examples
 		};
 	}
+	/** Query every registered provider, projecting inputs to serializable tools. */
+	_collectProviderTools() {
+		const out = [];
+		for (const provider of this.providers) for (const input of provider()) out.push({
+			input,
+			tool: this._projectTool(input)
+		});
+		return out;
+	}
 	_collectRpcTools() {
 		const out = [];
 		for (const [name, def] of this.context.rpc.definitions) {
@@ -155,33 +232,11 @@ var DevframeAgentHost = class {
 		const def = this.context.rpc.definitions.get(id);
 		if (def?.agent) return def;
 	}
-	_coercePositionalArgs(args, def) {
-		if (Array.isArray(args)) return args;
-		if (args === void 0 || args === null) return [];
-		if (args && typeof args === "object") {
-			const obj = args;
-			const schemas = def.args;
-			if (schemas && schemas.length) return schemas.map((_, i) => obj[`arg${i}`]);
-			if (hasPositionalKeys(obj)) {
-				const out = [];
-				let i = 0;
-				while (`arg${i}` in obj) {
-					out.push(obj[`arg${i}`]);
-					i++;
-				}
-				return out;
-			}
-		}
-		return [args];
-	}
 };
 function inferSafety(type) {
 	if (type === "static" || type === "query") return "read";
 	return "action";
 }
-function hasPositionalKeys(obj) {
-	return "arg0" in obj;
-}
 //#endregion
 //#region src/node/host-diagnostics.ts
 var DevframeDiagnosticsHost = class {
@@ -1517,4 +1572,4 @@ function createH3DevframeHost(options) {
 	};
 }
 //#endregion
-export { DevframeViewHost as a, createRpcSharedStateServerHost as c, createNodeSettings as i, DevframeDiagnosticsHost as l, createHostContext as n, DevframeServicesHostImpl as o, createScopedNodeContext as r, createRpcStreamingServerHost as s, createH3DevframeHost as t, DevframeAgentHost as u };
+export { DevframeViewHost as a, createRpcSharedStateServerHost as c, coerceAgentPositionalArgs as d, createNodeSettings as i, DevframeDiagnosticsHost as l, createHostContext as n, DevframeServicesHostImpl as o, createScopedNodeContext as r, createRpcStreamingServerHost as s, createH3DevframeHost as t, DevframeAgentHost as u };

package/dist/http-Dvgxujcu.mjs

@@ -0,0 +1,38 @@
+import { t as createMcpFetchHandler } from "./fetch-CK0S253E.mjs";
+import { defineHandler } from "h3";
+//#region src/adapters/mcp/http.ts
+/**
+* Mount an MCP Streamable-HTTP endpoint on an h3 app at `path` — the h3
+* binding over {@link createMcpFetchHandler}, which owns the sessions, the
+* origin gate, and the transport plumbing.
+*
+* The handler is web-standard — it takes the h3 event's web `Request` and
+* returns a web `Response` (an SSE `ReadableStream` body for the
+* server→client stream). We copy that response onto `event.res` and return
+* its body rather than returning the `Response` object directly, so a
+* legitimate MCP 404 (unknown session) isn't swallowed by h3's
+* "Response-with-404 falls through to the next handler" rule (which would
+* otherwise hand the request to the SPA static catch-all).
+*
+* @experimental
+*/
+function mountMcpHttp(app, ctx, path, options) {
+	const handler = createMcpFetchHandler(ctx, options);
+	app.use(path, defineHandler(async (event) => respond(event, await handler.fetch(event.req))));
+	return { dispose: handler.dispose };
+}
+/**
+* Copy a web `Response` from the MCP transport onto the h3 event's response
+* and return its body. Returning the body (a `ReadableStream` or `null`)
+* rather than the `Response` object avoids h3's 404-fall-through behavior.
+*/
+function respond(event, response) {
+	event.res.status = response.status;
+	event.res.statusText = response.statusText;
+	response.headers.forEach((value, key) => {
+		event.res.headers.set(key, value);
+	});
+	return response.body ?? "";
+}
+//#endregion
+export { mountMcpHttp };

package/dist/{index-8dndvIxR.d.mts → index-B7RgLw--.d.mts}

@@ -1,5 +1,5 @@
-import { W as DevframeNodeRpcSession, b as DevframeNodeContext, ht as SharedState } from "./devframe-Ckhf3kFw.mjs";
-import { n as InternalAnonymousAuthStorage } from "./context-CzqPrJSz.mjs";
+import { W as DevframeNodeRpcSession, b as DevframeNodeContext, ht as SharedState } from "./devframe-qgCKL683.mjs";
+import { n as InternalAnonymousAuthStorage } from "./context-DFzmxCLa.mjs";
 //#region src/node/auth/revoke.d.ts
 /**
  * Flip `isTrusted` to false on any live WS clients connected with `token`
@@ -28,10 +28,15 @@ declare function getTempAuthCode(): string;
  */
 declare function refreshTempAuthCode(): string;
 /**
- * Build a "magic link" authentication URL that embeds a one-time code (OTP) as
- * a query parameter. Opening it authenticates the client without typing — print
- * it on startup (devframe stays headless, so the host prints its own banner).
- * Defaults to the current code; the link is subject to the same TTL.
+ * Build a "magic link" authentication URL that embeds a one-time code (OTP) in
+ * the URL **fragment**. Opening it authenticates the client without typing —
+ * print it on startup (devframe stays headless, so the host prints its own
+ * banner). Defaults to the current code; the link is subject to the same TTL.
+ *
+ * The code rides the fragment (`#devframe_otp=…`), not the query string, so it
+ * is never sent to the server, written to an access log, or leaked in a
+ * `Referer` header — the browser client reads it locally (see
+ * `consumeOtpFromUrl`). Any existing fragment parameters are preserved.
  */
 declare function buildOtpAuthUrl(baseUrl: string, code?: string): string;
 /**

package/dist/{index-DgsLFhZg.d.mts → index-Dbw1p5ch.d.mts}

@@ -1,5 +1,5 @@
-import { C as RpcFunctionType, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinition, i as RpcArgsSchema, v as RpcFunctionDefinitionAny, w as RpcFunctionsCollector } from "./types-CrzNxXKq.mjs";
-import { a as getDefinitionsWithDumps$1, c as StaticRpcDumpManifest$1, d as StaticRpcDumpManifestValue$1, f as StaticRpcDumpSerialization$1, i as dumpFunctions$1, l as StaticRpcDumpManifestQueryEntry$1, n as serializeDumpError$1, o as StaticRpcDumpCollection$1, p as collectStaticRpcDump$1, r as createClientFromDump$1, s as StaticRpcDumpFile$1, t as reviveDumpError$1, u as StaticRpcDumpManifestStaticEntry$1 } from "./index-YDSJgsyG.mjs";
+import { C as RpcFunctionType, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinition, i as RpcArgsSchema, v as RpcFunctionDefinitionAny, w as RpcFunctionsCollector } from "./types-CnJSgRVa.mjs";
+import { a as getDefinitionsWithDumps$1, c as StaticRpcDumpManifest$1, d as StaticRpcDumpManifestValue$1, f as StaticRpcDumpSerialization$1, i as dumpFunctions$1, l as StaticRpcDumpManifestQueryEntry$1, n as serializeDumpError$1, o as StaticRpcDumpCollection$1, p as collectStaticRpcDump$1, r as createClientFromDump$1, s as StaticRpcDumpFile$1, t as reviveDumpError$1, u as StaticRpcDumpManifestStaticEntry$1 } from "./index-vAX6bYuc.mjs";
 //#region src/rpc/cache.d.ts
 interface RpcCacheOptions {
   functions: string[];
@@ -94,6 +94,30 @@ declare const STRUCTURED_CLONE_PREFIX = "s:";
  */
 declare function strictJsonStringify(value: unknown, fnName?: string): string;
 //#endregion
+//#region src/rpc/validate-io.d.ts
+/**
+ * Validate positional arguments against their declared schemas. Only
+ * indices with a schema are checked; extra arguments pass through
+ * untouched. Throws `DF0038` on the first failing argument.
+ *
+ * Validation guards the payload without rewriting it: the original values
+ * are handed to the handler unchanged, so a schema that describes a subset
+ * of an object never silently strips the sender's extra fields (and any
+ * declared transforms stay a purely type-level concern).
+ *
+ * @internal
+ */
+declare function validateRpcArgs(name: string, argsSchema: RpcArgsSchema | undefined, args: readonly unknown[]): Promise<unknown[]>;
+/**
+ * Validate a handler's resolved return value against its declared schema.
+ * Throws `DF0039` when the value fails the schema, otherwise returns the
+ * original value unchanged (guard-only, never rewriting the payload — see
+ * {@link validateRpcArgs}). Passes through when no return schema is set.
+ *
+ * @internal
+ */
+declare function validateRpcReturn(name: string, returnSchema: RpcReturnSchema | undefined, value: unknown): Promise<unknown>;
+//#endregion
 //#region src/rpc/validation.d.ts
 /**
  * Validates RPC function definitions.
@@ -137,4 +161,4 @@ type StaticRpcDumpManifestValue = StaticRpcDumpManifestValue$1;
 /** @deprecated Import from `devframe/rpc/dump` instead. */
 type StaticRpcDumpSerialization = StaticRpcDumpSerialization$1;
 //#endregion
-export { RpcCacheManager as C, RpcFunctionsCollectorBase as S, strictJsonStringify as _, StaticRpcDumpManifestStaticEntry as a, createDefineWrapperWithContext as b, collectStaticRpcDump as c, getDefinitionsWithDumps as d, reviveDumpError as f, STRUCTURED_CLONE_PREFIX as g, validateDefinitions as h, StaticRpcDumpManifestQueryEntry as i, createClientFromDump as l, validateDefinition as m, StaticRpcDumpFile as n, StaticRpcDumpManifestValue as o, serializeDumpError as p, StaticRpcDumpManifest as r, StaticRpcDumpSerialization as s, StaticRpcDumpCollection as t, dumpFunctions as u, getRpcHandler as v, RpcCacheOptions as w, defineRpcFunction as x, getRpcResolvedSetupResult as y };
+export { defineRpcFunction as C, RpcCacheOptions as E, createDefineWrapperWithContext as S, RpcCacheManager as T, validateRpcReturn as _, StaticRpcDumpManifestStaticEntry as a, getRpcHandler as b, collectStaticRpcDump as c, getDefinitionsWithDumps as d, reviveDumpError as f, validateRpcArgs as g, validateDefinitions as h, StaticRpcDumpManifestQueryEntry as i, createClientFromDump as l, validateDefinition as m, StaticRpcDumpFile as n, StaticRpcDumpManifestValue as o, serializeDumpError as p, StaticRpcDumpManifest as r, StaticRpcDumpSerialization as s, StaticRpcDumpCollection as t, dumpFunctions as u, STRUCTURED_CLONE_PREFIX as v, RpcFunctionsCollectorBase as w, getRpcResolvedSetupResult as x, strictJsonStringify as y };

package/dist/{index-YDSJgsyG.d.mts → index-vAX6bYuc.d.mts}

@@ -1,4 +1,4 @@
-import { h as RpcDumpStore, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny } from "./types-CrzNxXKq.mjs";
+import { h as RpcDumpStore, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny } from "./types-CnJSgRVa.mjs";
 //#region src/rpc/dump/static.d.ts
 type StaticRpcDumpSerialization = 'json' | 'structured-clone';
 interface StaticRpcDumpManifestStaticEntry {

package/dist/index.d.mts

@@ -1,8 +1,8 @@
-import { $ as DevframeRpcServerFunctions, A as DevframeSettingsStore, At as EventUnsubscribe, B as DevframeDefineDiagnosticsOptions, C as DevframeServicesHost, Ct as AgentResourceContent, D as DevframeScopedStreamingHost, Dt as DevframeAgentHost, E as DevframeScopedNodeRpc, Et as AgentToolInput, F as ScopedSharedStates, G as RpcBroadcastOptions, H as DevframeDiagnosticsHost, I as SettingsForNamespace, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost, M as ScopedClientFunctions, N as ScopedRpcFn, O as DevframeSettings, Ot as DevframeAgentHostEvents, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, V as DevframeDiagnosticsDefinition, W as DevframeNodeRpcSession, X as RpcStreamingChannelOptions, Y as RpcStreamingChannel, Z as RpcStreamingHost, _ as ConnectionMeta, a as DevframeDockDefaults, b as DevframeNodeContext, bt as AgentHandle, c as DevframeSetupInfo, d as McpRouteOptions, et as DevframeRpcSharedStates, f as defineDevframe, g as Thenable, h as PartialWithoutId, i as DevframeDeploymentKind, j as ScopedBroadcastOptions, jt as EventsMap, k as DevframeSettingsRegistry, kt as EventEmitter, l as DevframeSpaOptions, m as EntriesToObject, n as DevframeCliOptions, o as DevframeDuplicationStrategy, q as RpcSharedStateGetOptions, r as DevframeDefinition, s as DevframeRuntime, t as DevframeBrowserContext, u as DevframeWsOptions, v as ConnectionMetaWebsocket, w as DevframeServicesRegistry, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest, y as DevframeCapabilities, z as DevframeStorageScope } from "./devframe-Ckhf3kFw.mjs";
-import { C as RpcFunctionType, T as RpcReturnSchema, _ as RpcFunctionDefinition, g as RpcFunctionAgentOptions, i as RpcArgsSchema } from "./types-CrzNxXKq.mjs";
-import "./index-DgsLFhZg.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "./ws-server-9-wn7MNQ.mjs";
+import { $ as DevframeRpcServerFunctions, A as DevframeSettingsStore, At as DevframeAgentHostEvents, B as DevframeDefineDiagnosticsOptions, C as DevframeServicesHost, Ct as AgentResourceContent, D as DevframeScopedStreamingHost, Dt as AgentToolProvider, E as DevframeScopedNodeRpc, Et as AgentToolInput, F as ScopedSharedStates, G as RpcBroadcastOptions, H as DevframeDiagnosticsHost, I as SettingsForNamespace, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost, M as ScopedClientFunctions, Mt as EventUnsubscribe, N as ScopedRpcFn, Nt as EventsMap, O as DevframeSettings, Ot as AgentToolProviderHandle, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, V as DevframeDiagnosticsDefinition, W as DevframeNodeRpcSession, X as RpcStreamingChannelOptions, Y as RpcStreamingChannel, Z as RpcStreamingHost, _ as ConnectionMeta, a as DevframeDockDefaults, b as DevframeNodeContext, bt as AgentHandle, c as DevframeSetupInfo, d as McpRouteOptions, et as DevframeRpcSharedStates, f as defineDevframe, g as Thenable, h as PartialWithoutId, i as DevframeDeploymentKind, j as ScopedBroadcastOptions, jt as EventEmitter, k as DevframeSettingsRegistry, kt as DevframeAgentHost, l as DevframeSpaOptions, m as EntriesToObject, n as DevframeCliOptions, o as DevframeDuplicationStrategy, q as RpcSharedStateGetOptions, r as DevframeDefinition, s as DevframeRuntime, t as DevframeBrowserContext, u as DevframeWsOptions, v as ConnectionMetaWebsocket, w as DevframeServicesRegistry, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest, y as DevframeCapabilities, z as DevframeStorageScope } from "./devframe-qgCKL683.mjs";
+import { C as RpcFunctionType, T as RpcReturnSchema, _ as RpcFunctionDefinition, g as RpcFunctionAgentOptions, i as RpcArgsSchema } from "./types-CnJSgRVa.mjs";
+import "./index-Dbw1p5ch.mjs";
+import { n as DevframeNodeRpcSessionMeta } from "./ws-server-J-zkiOyp.mjs";
 //#region src/define.d.ts
 declare const defineRpcFunction: <NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>) => RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>;
 //#endregion
-export { type AgentHandle, type AgentManifest, type AgentResource, type AgentResourceContent, type AgentResourceInput, type AgentTool, type AgentToolInput, type ConnectionMeta, type ConnectionMetaWebsocket, type DevframeAgentHost, type DevframeAgentHostEvents, type DevframeBrowserContext, type DevframeCapabilities, type DevframeCliOptions, type DevframeDefineDiagnosticsOptions, type DevframeDefinition, type DevframeDeploymentKind, type DevframeDiagnosticsDefinition, type DevframeDiagnosticsHost, type DevframeDiagnosticsLogger, type DevframeDockDefaults, type DevframeDuplicationStrategy, type DevframeHost, type DevframeNodeContext, type DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, type DevframeRpcClientFunctions, type DevframeRpcServerFunctions, type DevframeRpcSharedStates, type DevframeRuntime, type DevframeScopedNodeContext, type DevframeScopedNodeRpc, type DevframeScopedStreamingHost, type DevframeServiceId, type DevframeServiceOf, type DevframeServicesHost, type DevframeServicesRegistry, type DevframeSettings, type DevframeSettingsRegistry, type DevframeSettingsStore, type DevframeSetupInfo, type DevframeSpaOptions, type DevframeStorageScope, type DevframeViewHost, type DevframeWsOptions, type EntriesToObject, type EventEmitter, type EventUnsubscribe, type EventsMap, type McpRouteOptions, type PartialWithoutId, type RpcBroadcastOptions, type RpcFunctionAgentOptions, type RpcFunctionsHost, type RpcSharedStateGetOptions, type RpcSharedStateHost, type RpcStreamingChannel, type RpcStreamingChannelOptions, type RpcStreamingHost, type ScopedBroadcastOptions, type ScopedClientFunctions, type ScopedRpcFn, type ScopedServerFunctions, type ScopedSharedStates, type SettingsForNamespace, type Thenable, type defineDevframe, defineRpcFunction };
+export { type AgentHandle, type AgentManifest, type AgentResource, type AgentResourceContent, type AgentResourceInput, type AgentTool, type AgentToolInput, type AgentToolProvider, type AgentToolProviderHandle, type ConnectionMeta, type ConnectionMetaWebsocket, type DevframeAgentHost, type DevframeAgentHostEvents, type DevframeBrowserContext, type DevframeCapabilities, type DevframeCliOptions, type DevframeDefineDiagnosticsOptions, type DevframeDefinition, type DevframeDeploymentKind, type DevframeDiagnosticsDefinition, type DevframeDiagnosticsHost, type DevframeDiagnosticsLogger, type DevframeDockDefaults, type DevframeDuplicationStrategy, type DevframeHost, type DevframeNodeContext, type DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, type DevframeRpcClientFunctions, type DevframeRpcServerFunctions, type DevframeRpcSharedStates, type DevframeRuntime, type DevframeScopedNodeContext, type DevframeScopedNodeRpc, type DevframeScopedStreamingHost, type DevframeServiceId, type DevframeServiceOf, type DevframeServicesHost, type DevframeServicesRegistry, type DevframeSettings, type DevframeSettingsRegistry, type DevframeSettingsStore, type DevframeSetupInfo, type DevframeSpaOptions, type DevframeStorageScope, type DevframeViewHost, type DevframeWsOptions, type EntriesToObject, type EventEmitter, type EventUnsubscribe, type EventsMap, type McpRouteOptions, type PartialWithoutId, type RpcBroadcastOptions, type RpcFunctionAgentOptions, type RpcFunctionsHost, type RpcSharedStateGetOptions, type RpcSharedStateHost, type RpcStreamingChannel, type RpcStreamingChannelOptions, type RpcStreamingHost, type ScopedBroadcastOptions, type ScopedClientFunctions, type ScopedRpcFn, type ScopedServerFunctions, type ScopedSharedStates, type SettingsForNamespace, type Thenable, type defineDevframe, defineRpcFunction };

package/dist/instance-registry-D6fxYu36.mjs

@@ -0,0 +1,190 @@
+import { t as diagnostics } from "./diagnostics-B5-qHeqD.mjs";
+import { mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "pathe";
+import process from "node:process";
+import { homedir } from "node:os";
+//#region src/node/instance-registry.ts
+/** Environment variable overriding the registry directory (tests, CI). */
+const DEVFRAME_INSTANCES_DIR_ENV = "DEVFRAME_INSTANCES_DIR";
+/** Environment variable disabling instance registration entirely. */
+const DEVFRAME_DISABLE_INSTANCE_REGISTRY_ENV = "DEVFRAME_DISABLE_INSTANCE_REGISTRY";
+/**
+* Resolve the registry directory: `~/.devframe/instances/` by default —
+* the framework's own global dir, deliberately outside the per-app
+* `~/.<appName>/devframe/` storage convention since the registry spans apps —
+* overridable via `DEVFRAME_INSTANCES_DIR`.
+*/
+function resolveInstancesDir(override) {
+	return override ?? process.env[DEVFRAME_INSTANCES_DIR_ENV] ?? join(homedir(), ".devframe", "instances");
+}
+function isRegistryDisabled() {
+	const value = process.env[DEVFRAME_DISABLE_INSTANCE_REGISTRY_ENV];
+	return value === "1" || value === "true";
+}
+/**
+* Record a running devframe instance in the global instance registry so
+* discovery tooling (`devframe connect`, editor integrations) can find it
+* without port guessing.
+*
+* `createDevServer` registers automatically; custom hosts that serve a
+* devframe in-process (e.g. `@devframes/next`'s host inside a Next dev
+* server) call this explicitly with the origin they are reachable at.
+*
+* The record is written atomically to `<dir>/<pid>-<port>.json` and removed
+* by {@link DevframeInstanceRegistration.unregister}. Records surviving a
+* crash are pruned by readers whose liveness probe fails. Registration never
+* throws — a write failure degrades to a coded warning (`DF0045`), since a
+* dev server must not die over discovery metadata.
+*
+* @experimental
+*/
+function registerDevframeInstance(record, options = {}) {
+	const dir = resolveInstancesDir(options.instancesDir);
+	const file = join(dir, `${record.pid}-${record.port}.json`);
+	if (!isRegistryDisabled()) try {
+		mkdirSync(dir, { recursive: true });
+		const tmp = join(dir, `.${record.pid}-${record.port}.${Date.now()}.tmp`);
+		writeFileSync(tmp, `${JSON.stringify(record, null, 2)}\n`);
+		renameSync(tmp, file);
+	} catch (error) {
+		diagnostics.DF0045({
+			file,
+			reason: error instanceof Error ? error.message : String(error),
+			cause: error
+		});
+	}
+	return {
+		file,
+		unregister: () => {
+			try {
+				rmSync(file, { force: true });
+			} catch (error) {
+				diagnostics.DF0045({
+					file,
+					reason: error instanceof Error ? error.message : String(error),
+					cause: error
+				});
+			}
+		}
+	};
+}
+/**
+* Read every record in the registry directory, dropping unparseable files.
+* Liveness is the caller's concern — see {@link probeDevframeInstance}.
+*
+* @experimental
+*/
+function readDevframeInstances(options = {}) {
+	const dir = resolveInstancesDir(options.instancesDir);
+	let files;
+	try {
+		files = readdirSync(dir).filter((f) => f.endsWith(".json"));
+	} catch {
+		return [];
+	}
+	const records = [];
+	for (const file of files) try {
+		const parsed = JSON.parse(readFileSync(join(dir, file), "utf8"));
+		if (typeof parsed?.origin === "string" && typeof parsed?.pid === "number") records.push(parsed);
+	} catch {}
+	return records;
+}
+/**
+* Dialable-origin candidates for a recorded origin. A `localhost` bind is
+* ambiguous — the server may listen on `127.0.0.1`, `::1`, or both, and
+* HTTP clients differ in which family they try — so probe the explicit
+* addresses too and adopt whichever answers.
+*/
+function originCandidates(origin) {
+	try {
+		const url = new URL(origin);
+		if (url.hostname !== "localhost") return [origin];
+		const port = url.port ? `:${url.port}` : "";
+		return [
+			origin,
+			`${url.protocol}//127.0.0.1${port}`,
+			`${url.protocol}//[::1]${port}`
+		];
+	} catch {
+		return [origin];
+	}
+}
+/**
+* Probe `<origin><basePath>__connection.json`, trying each dialable
+* candidate for the origin (see {@link originCandidates}). The single
+* probe primitive behind both registry liveness checks and the
+* connector's explicit `--port` probes.
+*
+* @internal
+*/
+async function probeDevframeOrigin(origin, basePath, timeoutMs) {
+	const base = basePath.endsWith("/") ? basePath : `${basePath}/`;
+	for (const candidate of originCandidates(origin)) try {
+		const response = await fetch(`${candidate}${base}__connection.json`, { signal: AbortSignal.timeout(timeoutMs ?? 1e3) });
+		if (!response.ok) continue;
+		return {
+			origin: candidate,
+			meta: await response.json().catch(() => ({}))
+		};
+	} catch {}
+	return null;
+}
+/**
+* Probe a record's `__connection.json` to check the instance is alive.
+* Returns the **dialable origin** that answered (for `localhost` records
+* this may be an explicit `127.0.0.1` / `[::1]` origin), or `null` when
+* unreachable.
+*/
+async function probeDevframeInstance(record, options = {}) {
+	return (await probeDevframeOrigin(record.origin, record.basePath, options.timeoutMs))?.origin ?? null;
+}
+/**
+* Read the registry and split records into live and dead by probing each
+* one's `__connection.json`, deleting dead records (prune-on-read). Live
+* records carry the dialable origin the probe confirmed (a `localhost`
+* record may come back as `127.0.0.1` / `[::1]`).
+*
+* A liveness probe only proves *something* answers on the record's port, so
+* records left behind by killed processes shadow the server currently bound
+* there: per `(port, basePath)` only the newest record survives, older
+* ghosts are pruned with the dead.
+*
+* @experimental
+*/
+async function listLiveDevframeInstances(options = {}) {
+	const dir = resolveInstancesDir(options.instancesDir);
+	const records = readDevframeInstances({ instancesDir: dir });
+	const pruned = [];
+	const prune = (record) => {
+		pruned.push(record);
+		try {
+			rmSync(join(dir, `${record.pid}-${record.port}.json`), { force: true });
+		} catch {}
+	};
+	const newest = /* @__PURE__ */ new Map();
+	for (const record of records) {
+		const key = `${record.port}|${record.basePath}`;
+		const existing = newest.get(key);
+		if (!existing) newest.set(key, record);
+		else if (record.startedAt > existing.startedAt) {
+			prune(existing);
+			newest.set(key, record);
+		} else prune(record);
+	}
+	const live = [];
+	await Promise.all([...newest.values()].map(async (record) => {
+		const origin = await probeDevframeInstance(record, options);
+		if (origin) live.push(origin === record.origin ? record : {
+			...record,
+			origin
+		});
+		else prune(record);
+	}));
+	live.sort((a, b) => a.startedAt - b.startedAt);
+	return {
+		live,
+		pruned
+	};
+}
+//#endregion
+export { probeDevframeOrigin as n, registerDevframeInstance as r, listLiveDevframeInstances as t };

package/dist/node/auth.d.mts

@@ -1,3 +1,3 @@
-import { p as DevframeAuthHandler } from "../devframe-Ckhf3kFw.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-8dndvIxR.mjs";
+import { p as DevframeAuthHandler } from "../devframe-qgCKL683.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-B7RgLw--.mjs";
 export { DevframeAuthHandler, buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/auth.mjs

@@ -1,3 +1,3 @@
-import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-BtQDKTp7.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-WX3HT5a3.mjs";
+import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-DZbJ7Cl0.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-BeUHDDjk.mjs";
 export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,5 +1,5 @@
-import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-Ckhf3kFw.mjs";
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-CzqPrJSz.mjs";
+import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-qgCKL683.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-DFzmxCLa.mjs";
 //#region src/adapters/_shared.d.ts
 /**
  * Resolve the mount base path for a devframe's SPA. Hosted adapters

package/dist/node/hub-internals.mjs

@@ -1,3 +1,3 @@
-import { n as internalContextMap, t as getInternalContext } from "../context-DY72brRI.mjs";
+import { n as internalContextMap, t as getInternalContext } from "../context-CQefP2jR.mjs";
 import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-bWRzeSa0.mjs";
 export { getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };