devframe 0.7.16 → 0.8.1

package/dist/{server-B0wiP_Oi.d.mts → server-E9z4ZWbd.d.mts}

@@ -1,5 +1,6 @@
-import { $ as DevframeRpcServerFunctions, Q as DevframeRpcClientFunctions, W as DevframeNodeRpcSession, _ as ConnectionMeta, b as DevframeNodeContext, p as DevframeAuthHandler } from "./devframe-Ckhf3kFw.mjs";
-import "./index-8dndvIxR.mjs";
+import { $ as DevframeRpcServerFunctions, Q as DevframeRpcClientFunctions, W as DevframeNodeRpcSession, _ as ConnectionMeta, b as DevframeNodeContext, p as DevframeAuthHandler } from "./devframe-qgCKL683.mjs";
+import { r as WsOriginRegistry } from "./ws-server-J-zkiOyp.mjs";
+import "./index-B7RgLw--.mjs";
 import { Peer } from "crossws";
 import { BirpcGroup, EventOptions } from "birpc";
 import { NodeAdapter } from "crossws/adapters/node";
@@ -91,7 +92,7 @@ interface StartHttpAndWsOptions {
    * from another host. Pass `false` to disable origin checking entirely
    * (not recommended). Default: loopback-only.
    */
-  allowedOrigins?: readonly string[] | false;
+  allowedOrigins?: readonly string[] | WsOriginRegistry | false;
   /**
    * Called once the WS server is bound so callers can mount static
    * handlers whose origin depends on the resolved port, or print their

package/dist/simple-schema-BDzLeJDk.d.mts

@@ -0,0 +1,102 @@
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/utils/simple-schema.d.ts
+/**
+ * A tiny, zero-dependency [Standard Schema](https://standardschema.dev/)
+ * builder.
+ *
+ * ⚠️ **Discouraged for app code.** This is a deliberately minimal,
+ * best-effort validator that exists only so devframe's own first-party
+ * packages (recipes, built-in plugins) can declare `args`/`returns`/flag
+ * schemas without taking on a validator dependency. It implements a small
+ * subset of primitives and approximates refinements — it is not a
+ * general-purpose validator.
+ *
+ * For your own code, prefer a real Standard Schema validator — **valibot**,
+ * **zod**, or **arktype**. Devframe's RPC and CLI-flag layers accept any of
+ * them; install the one you like and use it directly:
+ *
+ * ```ts
+ * import * as v from 'valibot' // npm i valibot
+ *
+ * defineRpcFunction({
+ *   name: 'greet',
+ *   args: [v.object({ name: v.string() })],
+ *   returns: v.string(),
+ *   handler: ({ name }) => `hi ${name}`,
+ * })
+ * ```
+ */
+/**
+ * A Standard Schema produced by the {@link s} builder. It carries a
+ * duck-typed `type` marker (and `wrapped` for wrappers) alongside the
+ * standard `~standard` prop so the CLI-flags adapter can introspect the
+ * schema kind without importing any validator.
+ */
+interface SimpleSchema<Input, Output = Input> extends StandardSchemaV1<Input, Output> {
+  /** Schema kind marker, e.g. `'string'`, `'boolean'`, `'optional'`. */
+  readonly type: string;
+  /** Inner schema for wrapper kinds (`optional` / `nullable`). */
+  readonly wrapped?: StandardSchemaV1;
+  /** Optional human description (surfaced as CLI option help). */
+  readonly description?: string;
+}
+/** Any string. */
+declare function string(): SimpleSchema<string>;
+/** A finite number (rejects `NaN`). */
+declare function number(): SimpleSchema<number>;
+/** A boolean. */
+declare function boolean(): SimpleSchema<boolean>;
+/** `undefined` — mirrors valibot's `void`. */
+declare function voidType(): SimpleSchema<void>;
+/** `null`. */
+declare function nullType(): SimpleSchema<null>;
+/** One of a fixed set of literal values. */
+declare function picklist<const T extends readonly (string | number | boolean)[]>(values: T): SimpleSchema<T[number]>;
+/** A single literal value (string / number / boolean). */
+declare function literal<const T extends string | number | boolean>(value: T): SimpleSchema<T>;
+/** A value matching any one of the given schemas. */
+declare function union<const T extends readonly StandardSchemaV1[]>(options: T): SimpleSchema<StandardSchemaV1.InferInput<T[number]>, StandardSchemaV1.InferOutput<T[number]>>;
+/** A record with string keys whose values each satisfy the value schema. */
+declare function record<V extends StandardSchemaV1>(_key: StandardSchemaV1, value: V): SimpleSchema<Record<string, StandardSchemaV1.InferInput<V>>, Record<string, StandardSchemaV1.InferOutput<V>>>;
+/** An array whose every element satisfies the item schema. */
+declare function array<T extends StandardSchemaV1>(item: T): SimpleSchema<StandardSchemaV1.InferInput<T>[], StandardSchemaV1.InferOutput<T>[]>;
+/** Flatten an intersection into a single object literal for readable types. */
+type Prettify<T> = { [K in keyof T]: T[K]; } & {};
+/**
+ * Map a shape to its object type, turning fields whose type includes
+ * `undefined` (i.e. `optional()`) into optional keys — mirroring how
+ * valibot/zod render `optional` object entries.
+ */
+type InferField<T extends StandardSchemaV1, Mode extends 'input' | 'output'> = Mode extends 'input' ? StandardSchemaV1.InferInput<T> : StandardSchemaV1.InferOutput<T>;
+type InferObject<T extends Record<string, StandardSchemaV1>, Mode extends 'input' | 'output'> = Prettify<{ [K in keyof T as undefined extends InferField<T[K], Mode> ? never : K]: InferField<T[K], Mode>; } & { [K in keyof T as undefined extends InferField<T[K], Mode> ? K : never]?: InferField<T[K], Mode>; }>;
+/** An object whose known keys each satisfy their schema (extra keys are kept). */
+declare function object<T extends Record<string, StandardSchemaV1>>(shape: T): SimpleSchema<InferObject<T, 'input'>, InferObject<T, 'output'>>;
+/** Allow `undefined` in addition to the inner schema. */
+declare function optional<T extends StandardSchemaV1>(inner: T): SimpleSchema<StandardSchemaV1.InferInput<T> | undefined, StandardSchemaV1.InferOutput<T> | undefined>;
+/** Allow `null` in addition to the inner schema. */
+declare function nullable<T extends StandardSchemaV1>(inner: T): SimpleSchema<StandardSchemaV1.InferInput<T> | null, StandardSchemaV1.InferOutput<T> | null>;
+/** Attach a human-readable description (used for CLI option help). */
+declare function describe<T extends SimpleSchema<any, any>>(schema: T, description: string): T;
+/**
+ * Grouped access to every builder — `s.string()`, `s.object({ ... })`,
+ * `s.void()`, etc. Handy for a valibot-like `import { s } from
+ * 'devframe/utils/simple-schema'` call site.
+ */
+declare const s: {
+  readonly string: typeof string;
+  readonly number: typeof number;
+  readonly boolean: typeof boolean;
+  readonly void: typeof voidType;
+  readonly null: typeof nullType;
+  readonly literal: typeof literal;
+  readonly picklist: typeof picklist;
+  readonly union: typeof union;
+  readonly record: typeof record;
+  readonly array: typeof array;
+  readonly object: typeof object;
+  readonly optional: typeof optional;
+  readonly nullable: typeof nullable;
+  readonly describe: typeof describe;
+};
+//#endregion
+export { literal as a, number as c, picklist as d, record as f, voidType as g, union as h, describe as i, object as l, string as m, array as n, nullType as o, s as p, boolean as r, nullable as s, SimpleSchema as t, optional as u };

package/dist/simple-schema-DQPZrAaZ.mjs

@@ -0,0 +1,154 @@
+//#region src/utils/simple-schema.ts
+function ok(value) {
+	return { value };
+}
+function fail(message, path) {
+	return { issues: [path ? {
+		message,
+		path
+	} : { message }] };
+}
+function make(type, validate, extra) {
+	return {
+		type,
+		...extra,
+		"~standard": {
+			version: 1,
+			vendor: "devframe",
+			validate
+		}
+	};
+}
+/** Run a Standard Schema synchronously, rejecting async validators. */
+function runSync(schema, value) {
+	const result = schema["~standard"].validate(value);
+	if (result instanceof Promise) throw new TypeError("[devframe/utils/simple-schema] async validators are not supported inside object()/optional()/nullable()");
+	return result;
+}
+/** Any string. */
+function string() {
+	return make("string", (v) => typeof v === "string" ? ok(v) : fail("Expected a string"));
+}
+/** A finite number (rejects `NaN`). */
+function number() {
+	return make("number", (v) => typeof v === "number" && !Number.isNaN(v) ? ok(v) : fail("Expected a number"));
+}
+/** A boolean. */
+function boolean() {
+	return make("boolean", (v) => typeof v === "boolean" ? ok(v) : fail("Expected a boolean"));
+}
+/** `undefined` — mirrors valibot's `void`. */
+function voidType() {
+	return make("void", (v) => v === void 0 ? ok(void 0) : fail("Expected undefined"));
+}
+/** `null`. */
+function nullType() {
+	return make("null", (v) => v === null ? ok(null) : fail("Expected null"));
+}
+/** One of a fixed set of literal values. */
+function picklist(values) {
+	const set = new Set(values);
+	return make("picklist", (v) => set.has(v) ? ok(v) : fail(`Expected one of: ${values.join(", ")}`), { values });
+}
+/** A single literal value (string / number / boolean). */
+function literal(value) {
+	return make("literal", (v) => v === value ? ok(v) : fail(`Expected ${JSON.stringify(value)}`), { value });
+}
+/** A value matching any one of the given schemas. */
+function union(options) {
+	return make("union", (v) => {
+		const issues = [];
+		for (const option of options) {
+			const result = runSync(option, v);
+			if (!result.issues) return ok(v);
+			issues.push(...result.issues);
+		}
+		return { issues };
+	}, { options });
+}
+/** A record with string keys whose values each satisfy the value schema. */
+function record(_key, value) {
+	return make("record", (v) => {
+		if (typeof v !== "object" || v === null || Array.isArray(v)) return fail("Expected an object");
+		const obj = v;
+		const issues = [];
+		for (const key of Object.keys(obj)) {
+			const result = runSync(value, obj[key]);
+			if (result.issues) for (const issue of result.issues) issues.push({
+				message: issue.message,
+				path: [key, ...issue.path ?? []]
+			});
+		}
+		return issues.length ? { issues } : ok(v);
+	});
+}
+/** An array whose every element satisfies the item schema. */
+function array(item) {
+	return make("array", (v) => {
+		if (!Array.isArray(v)) return fail("Expected an array");
+		const issues = [];
+		for (let i = 0; i < v.length; i++) {
+			const result = runSync(item, v[i]);
+			if (result.issues) for (const issue of result.issues) issues.push({
+				message: issue.message,
+				path: [i, ...issue.path ?? []]
+			});
+		}
+		return issues.length ? { issues } : ok(v);
+	});
+}
+/** An object whose known keys each satisfy their schema (extra keys are kept). */
+function object(shape) {
+	const entries = Object.entries(shape);
+	return make("object", (v) => {
+		if (typeof v !== "object" || v === null || Array.isArray(v)) return fail("Expected an object");
+		const obj = v;
+		const issues = [];
+		for (const [key, schema] of entries) {
+			const result = runSync(schema, obj[key]);
+			if (result.issues) for (const issue of result.issues) issues.push({
+				message: issue.message,
+				path: [key, ...issue.path ?? []]
+			});
+		}
+		return issues.length ? { issues } : ok(v);
+	});
+}
+/** Allow `undefined` in addition to the inner schema. */
+function optional(inner) {
+	return make("optional", (v) => v === void 0 ? ok(void 0) : runSync(inner, v), { wrapped: inner });
+}
+/** Allow `null` in addition to the inner schema. */
+function nullable(inner) {
+	return make("nullable", (v) => v === null ? ok(null) : runSync(inner, v), { wrapped: inner });
+}
+/** Attach a human-readable description (used for CLI option help). */
+function describe(schema, description) {
+	return {
+		...schema,
+		description
+	};
+}
+/**
+* Grouped access to every builder — `s.string()`, `s.object({ ... })`,
+* `s.void()`, etc. Handy for a valibot-like `import { s } from
+* 'devframe/utils/simple-schema'` call site.
+*/
+const s = {
+	string,
+	number,
+	boolean,
+	void: voidType,
+	null: nullType,
+	literal,
+	picklist,
+	union,
+	record,
+	array,
+	object,
+	optional,
+	nullable,
+	describe
+};
+//#endregion
+export { s as t };

package/dist/{state-WX3HT5a3.mjs → state-BeUHDDjk.mjs}

@@ -1,5 +1,5 @@
 import { DEVFRAME_OTP_URL_PARAM } from "./constants.mjs";
-import { a as timingSafeEqual, i as randomToken, r as randomDigits } from "./revoke-BtQDKTp7.mjs";
+import { n as randomToken, r as timingSafeEqual, t as randomDigits } from "./crypto-token-XCqTSMg9.mjs";
 //#region src/node/auth/state.ts
 /** Number of decimal digits in a human-typed one-time authentication code. */
 const TEMP_AUTH_CODE_LENGTH = 6;
@@ -37,14 +37,21 @@ function refreshTempAuthCode() {
 	return tempAuthCode;
 }
 /**
-* Build a "magic link" authentication URL that embeds a one-time code (OTP) as
-* a query parameter. Opening it authenticates the client without typing — print
-* it on startup (devframe stays headless, so the host prints its own banner).
-* Defaults to the current code; the link is subject to the same TTL.
+* Build a "magic link" authentication URL that embeds a one-time code (OTP) in
+* the URL **fragment**. Opening it authenticates the client without typing —
+* print it on startup (devframe stays headless, so the host prints its own
+* banner). Defaults to the current code; the link is subject to the same TTL.
+*
+* The code rides the fragment (`#devframe_otp=…`), not the query string, so it
+* is never sent to the server, written to an access log, or leaked in a
+* `Referer` header — the browser client reads it locally (see
+* `consumeOtpFromUrl`). Any existing fragment parameters are preserved.
 */
 function buildOtpAuthUrl(baseUrl, code = tempAuthCode) {
 	const url = new URL(baseUrl);
-	url.searchParams.set(DEVFRAME_OTP_URL_PARAM, code);
+	const fragment = new URLSearchParams(url.hash.replace(/^#/, ""));
+	fragment.set(DEVFRAME_OTP_URL_PARAM, code);
+	url.hash = fragment.toString();
 	return url.href;
 }
 /**

package/dist/{storage-gEnj9ASQ.mjs → storage-Dzoc3NVC.mjs}

@@ -1,72 +1,8 @@
-import { t as devframeReporter } from "./diagnostics-reporter-CsIG85Q5.mjs";
-import { defineDiagnostics } from "nostics";
+import { t as diagnostics } from "./diagnostics-B5-qHeqD.mjs";
 import fs from "node:fs";
 import { dirname } from "pathe";
 import process$1 from "node:process";
 import { destr } from "destr";
-//#region src/node/diagnostics.ts
-const diagnostics = defineDiagnostics({
-	docsBase: "https://devfra.me/errors",
-	reporters: [devframeReporter],
-	codes: {
-		DF0006: { why: (p) => `RPC function "${p.name}" is not registered` },
-		DF0007: { why: "AsyncLocalStorage is not set, it likely to be an internal bug of the Devframe foundation" },
-		DF0008: { why: (p) => `distDir ${p.distDir} does not exist` },
-		DF0012: { why: (p) => `Failed to parse storage file: ${p.filepath}, falling back to defaults.` },
-		DF0013: { why: (p) => `Shared state of "${p.key}" is not found, please provide an initial value for the first time` },
-		DF0014: {
-			why: (p) => `RPC function "${p.name}" has an invalid \`agent\` field — \`description\` must be a non-empty string.`,
-			fix: "Provide a short description (~1–3 sentences) explaining what the tool does and when agents should invoke it."
-		},
-		DF0015: {
-			why: (p) => `Agent tool "${p.id}" is already registered.`,
-			fix: "Tool ids must be unique across RPC functions with an `agent` field and tools registered via `ctx.agent.registerTool()`."
-		},
-		DF0016: { why: (p) => `Agent resource "${p.id}" is already registered.` },
-		DF0017: { why: (p) => `Failed to start MCP server (${p.transport}): ${p.reason}` },
-		DF0029: {
-			why: (p) => `Stream "${p.channel}#${p.id}" dropped ${p.dropped} chunk(s) after exceeding the client high-water mark.`,
-			fix: "The consumer is too slow for the producer. Raise `highWaterMark` on the subscription, slow the producer, or batch chunks."
-		},
-		DF0030: {
-			why: (p) => `Stream "${p.channel}#${p.id}" is unknown — no producer has called \`channel.start({ id: "${p.id}" })\`.`,
-			fix: "Ensure the server-side producer is running before clients subscribe, or check for typos in the stream id."
-		},
-		DF0031: {
-			why: (p) => `Cannot write to closed stream "${p.channel}#${p.id}".`,
-			fix: "Track the producer lifecycle — guard writes with the `stream.signal.aborted` flag."
-		},
-		DF0032: {
-			why: (p) => `Streaming channel "${p.channel}" is already registered.`,
-			fix: "Each channel name must be unique within a context. Pick a different name or reuse the existing channel handle."
-		},
-		DF0033: {
-			why: (p) => `Failed to start dev RPC bridge for "${p.id}": ${p.reason}`,
-			fix: "Verify the bridge port is free and the devframe setup function does not throw. Pin a port via `cli.port` / `cli.portRange` on the definition, or via `devMiddleware.port` on `viteDevBridge`."
-		},
-		DF0034: {
-			why: (p) => `Scoped RPC registration for namespace "${p.namespace}" received an already-namespaced function name "${p.name}".`,
-			fix: "A scoped context auto-namespaces ids. Pass a bare name without a \":\" separator (e.g. `register({ name: \"get-cwd\" })`), or use the unscoped `ctx.base.rpc.register` for a fully-qualified name."
-		},
-		DF0035: {
-			why: (p) => `Failed to persist storage file: ${p.filepath}`,
-			fix: "Check that the storage directory is writable and has free space."
-		},
-		DF0036: {
-			why: (p) => `RPC call to "${p.name}" was rejected: the caller is not authorized.`,
-			fix: "Complete the auth handshake (or connect with a static/pre-shared token) before calling a trusted method. Untrusted callers may only call `anonymous:`-prefixed methods — see `isAnonymousRpcMethod`."
-		},
-		DF0037: {
-			why: (p) => `A service is already provided under "${p.id}".`,
-			fix: "Service ids are unique per context. Revoke the existing provider first (the `provide()` call returns a revoke function), or namespace the id with your plugin id to avoid collisions."
-		},
-		DF0042: {
-			why: (p) => `"${p.id}" declares \`capabilities.build: false\` — its static export is not meaningful (writes are excluded and any live-served data won't be there).`,
-			fix: "Pass `{ force: true }` to `createBuild()` if the degraded export is still useful to you, or drop `capabilities.build: false` on the definition."
-		}
-	}
-});
-//#endregion
 //#region src/utils/events.ts
 /**
 * Create event emitter.
@@ -1183,4 +1119,4 @@ function createStorage(options) {
 	return state;
 }
 //#endregion
-export { diagnostics as a, createEventEmitter as i, createSharedState as n, nanoid as r, createStorage as t };
+export { createEventEmitter as i, createSharedState as n, nanoid as r, createStorage as t };

package/dist/{transports-BmDVn4SF.mjs → transports-vhizgqXM.mjs}

@@ -1,4 +1,4 @@
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
 //#region src/adapters/mcp/transports.ts
 /**
 * Start the MCP server on stdio. Returns a stop function.

package/dist/types/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as DevframeRpcServerFunctions, A as DevframeSettingsStore, At as EventUnsubscribe, B as DevframeDefineDiagnosticsOptions, C as DevframeServicesHost, Ct as AgentResourceContent, D as DevframeScopedStreamingHost, Dt as DevframeAgentHost, E as DevframeScopedNodeRpc, Et as AgentToolInput, F as ScopedSharedStates, G as RpcBroadcastOptions, H as DevframeDiagnosticsHost, I as SettingsForNamespace, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost, M as ScopedClientFunctions, N as ScopedRpcFn, O as DevframeSettings, Ot as DevframeAgentHostEvents, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, V as DevframeDiagnosticsDefinition, W as DevframeNodeRpcSession, X as RpcStreamingChannelOptions, Y as RpcStreamingChannel, Z as RpcStreamingHost, _ as ConnectionMeta, a as DevframeDockDefaults, b as DevframeNodeContext, bt as AgentHandle, c as DevframeSetupInfo, d as McpRouteOptions, et as DevframeRpcSharedStates, f as defineDevframe, g as Thenable, h as PartialWithoutId, i as DevframeDeploymentKind, j as ScopedBroadcastOptions, jt as EventsMap, k as DevframeSettingsRegistry, kt as EventEmitter, l as DevframeSpaOptions, m as EntriesToObject, n as DevframeCliOptions, o as DevframeDuplicationStrategy, q as RpcSharedStateGetOptions, r as DevframeDefinition, s as DevframeRuntime, t as DevframeBrowserContext, u as DevframeWsOptions, v as ConnectionMetaWebsocket, w as DevframeServicesRegistry, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest, y as DevframeCapabilities, z as DevframeStorageScope } from "../devframe-Ckhf3kFw.mjs";
-import { g as RpcFunctionAgentOptions } from "../types-CrzNxXKq.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "../ws-server-9-wn7MNQ.mjs";
-export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDockDefaults, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeServiceId, DevframeServiceOf, DevframeServicesHost, DevframeServicesRegistry, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeStorageScope, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, McpRouteOptions, PartialWithoutId, RpcBroadcastOptions, type RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedRpcFn, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe };
+import { $ as DevframeRpcServerFunctions, A as DevframeSettingsStore, At as DevframeAgentHostEvents, B as DevframeDefineDiagnosticsOptions, C as DevframeServicesHost, Ct as AgentResourceContent, D as DevframeScopedStreamingHost, Dt as AgentToolProvider, E as DevframeScopedNodeRpc, Et as AgentToolInput, F as ScopedSharedStates, G as RpcBroadcastOptions, H as DevframeDiagnosticsHost, I as SettingsForNamespace, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost, M as ScopedClientFunctions, Mt as EventUnsubscribe, N as ScopedRpcFn, Nt as EventsMap, O as DevframeSettings, Ot as AgentToolProviderHandle, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, V as DevframeDiagnosticsDefinition, W as DevframeNodeRpcSession, X as RpcStreamingChannelOptions, Y as RpcStreamingChannel, Z as RpcStreamingHost, _ as ConnectionMeta, a as DevframeDockDefaults, b as DevframeNodeContext, bt as AgentHandle, c as DevframeSetupInfo, d as McpRouteOptions, et as DevframeRpcSharedStates, f as defineDevframe, g as Thenable, h as PartialWithoutId, i as DevframeDeploymentKind, j as ScopedBroadcastOptions, jt as EventEmitter, k as DevframeSettingsRegistry, kt as DevframeAgentHost, l as DevframeSpaOptions, m as EntriesToObject, n as DevframeCliOptions, o as DevframeDuplicationStrategy, q as RpcSharedStateGetOptions, r as DevframeDefinition, s as DevframeRuntime, t as DevframeBrowserContext, u as DevframeWsOptions, v as ConnectionMetaWebsocket, w as DevframeServicesRegistry, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest, y as DevframeCapabilities, z as DevframeStorageScope } from "../devframe-qgCKL683.mjs";
+import { g as RpcFunctionAgentOptions } from "../types-CnJSgRVa.mjs";
+import { n as DevframeNodeRpcSessionMeta } from "../ws-server-J-zkiOyp.mjs";
+export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, AgentToolProvider, AgentToolProviderHandle, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDockDefaults, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeServiceId, DevframeServiceOf, DevframeServicesHost, DevframeServicesRegistry, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeStorageScope, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, McpRouteOptions, PartialWithoutId, RpcBroadcastOptions, type RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedRpcFn, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe };

package/dist/{types-CrzNxXKq.d.mts → types-CnJSgRVa.d.mts}

@@ -1,10 +1,10 @@
-import { GenericSchema, InferInput } from "valibot";
+import { StandardSchemaV1 } from "@standard-schema/spec";
 import { BirpcFn, BirpcReturn as BirpcReturn$1 } from "birpc";
 //#region src/rpc/utils.d.ts
-/** Infers TypeScript tuple type from Valibot schema array */
-type InferArgsType<S extends RpcArgsSchema | undefined> = S extends readonly [] ? [] : S extends readonly [infer H, ...infer T] ? H extends GenericSchema ? T extends readonly GenericSchema[] ? [InferInput<H>, ...InferArgsType<T>] : never : never : never;
-/** Infers TypeScript return type from Valibot return schema */
-type InferReturnType<S extends RpcReturnSchema | undefined> = S extends RpcReturnSchema ? InferInput<S> : void;
+/** Infers a TypeScript argument tuple from a Standard Schema array */
+type InferArgsType<S extends RpcArgsSchema | undefined> = S extends readonly [] ? [] : S extends readonly [infer H, ...infer T] ? H extends StandardSchemaV1 ? T extends readonly StandardSchemaV1[] ? [StandardSchemaV1.InferInput<H>, ...InferArgsType<T>] : never : never : never;
+/** Infers a TypeScript return type from a Standard Schema */
+type InferReturnType<S extends RpcReturnSchema | undefined> = S extends StandardSchemaV1 ? StandardSchemaV1.InferInput<S> : void;
 //#endregion
 //#region src/rpc/types.d.ts
 type Thenable<T> = T | Promise<T>;
@@ -89,10 +89,20 @@ interface RpcFunctionSetupResult<ARGS extends any[], RETURN = void> {
   /** Optional dump definition (overrides definition-level dump) */
   dump?: RpcDumpDefinition<ARGS, RETURN>;
 }
-/** Valibot schema array for validating function arguments */
-type RpcArgsSchema = readonly GenericSchema[];
-/** Valibot schema for validating function return value */
-type RpcReturnSchema = GenericSchema;
+/**
+ * Positional argument schemas for an RPC function. Each entry is any
+ * [Standard Schema](https://standardschema.dev)-compliant validator
+ * (valibot, zod, arktype, …); the entry at index `i` validates argument
+ * `i` at call time and drives that argument's inferred type.
+ */
+type RpcArgsSchema = readonly StandardSchemaV1[];
+/**
+ * Return-value schema for an RPC function. Any
+ * [Standard Schema](https://standardschema.dev)-compliant validator; it
+ * validates the handler's resolved return value and drives its inferred
+ * type.
+ */
+type RpcReturnSchema = StandardSchemaV1;
 /**
  * Serialized representation of a thrown value in a dump record.
  *
@@ -206,9 +216,9 @@ type RpcFunctionDefinition<NAME extends string, TYPE extends RpcFunctionType = '
   type?: TYPE;
   /** Whether the function results should be cached */
   cacheable?: boolean;
-  /** Valibot schema array for validating function arguments */
+  /** Standard Schema array validating (and typing) the arguments */
   args?: AS;
-  /** Valibot schema for validating function return value */
+  /** Standard Schema validating (and typing) the return value */
   returns?: RS;
   /**
    * Declares whether this function's args/return are JSON-serializable
@@ -253,9 +263,9 @@ type RpcFunctionDefinition<NAME extends string, TYPE extends RpcFunctionType = '
   type?: TYPE;
   /** Whether the function results should be cached */
   cacheable?: boolean;
-  /** Valibot schema array for validating function arguments */
+  /** Standard Schema array validating (and typing) the arguments */
   args: AS;
-  /** Valibot schema for validating function return value */
+  /** Standard Schema validating (and typing) the return value */
   returns: RS;
   /**
    * Declares whether this function's args/return are JSON-serializable
@@ -275,11 +285,15 @@ type RpcFunctionDefinition<NAME extends string, TYPE extends RpcFunctionType = '
    */
   agent?: RpcFunctionAgentOptions;
   /** Setup function called with context to initialize handler and dump */
-  setup?: (context: CONTEXT) => Thenable<RpcFunctionSetupResult<InferArgsType<AS>, InferReturnType<RS>>>;
-  /** Function implementation (required if setup doesn't provide one) */
-  handler?: (...args: InferArgsType<AS>) => InferReturnType<RS>;
+  setup?: (context: CONTEXT) => Thenable<RpcFunctionSetupResult<InferArgsType<AS>, Thenable<InferReturnType<RS>>>>;
+  /**
+   * Function implementation (required if setup doesn't provide one).
+   * The declared `returns` schema describes the *resolved* value —
+   * async handlers return a promise of it (the runtime always awaits).
+   */
+  handler?: (...args: InferArgsType<AS>) => Thenable<InferReturnType<RS>>;
   /** Dump definition (setup dump takes priority) */
-  dump?: RpcDump<InferArgsType<AS>, InferReturnType<RS>, CONTEXT>;
+  dump?: RpcDump<InferArgsType<AS>, Thenable<InferReturnType<RS>>, CONTEXT>;
   /**
    * Sugar for "query in dev, single baked snapshot in build": when
    * `true` and no `dump` is provided, the build adapter runs the
@@ -290,9 +304,9 @@ type RpcFunctionDefinition<NAME extends string, TYPE extends RpcFunctionType = '
    */
   snapshot?: boolean;
   /** Per-context setup-result cache, populated by `getRpcResolvedSetupResult`. @internal */
-  __cache?: WeakMap<object, Thenable<RpcFunctionSetupResult<InferArgsType<AS>, InferReturnType<RS>>>>;
+  __cache?: WeakMap<object, Thenable<RpcFunctionSetupResult<InferArgsType<AS>, Thenable<InferReturnType<RS>>>>>;
   /** Single-slot fallback for primitive contexts. @internal */
-  __promise?: Thenable<RpcFunctionSetupResult<InferArgsType<AS>, InferReturnType<RS>>>;
+  __promise?: Thenable<RpcFunctionSetupResult<InferArgsType<AS>, Thenable<InferReturnType<RS>>>>;
 };
 type RpcFunctionDefinitionToFunction<T extends RpcFunctionDefinitionAny> = T extends {
   args: infer AS;

package/dist/utils/agent-tool-name.d.mts

@@ -0,0 +1,27 @@
+//#region src/utils/agent-tool-name.d.ts
+/**
+ * Derive the wire-safe agent tool name for an internal tool id.
+ *
+ * Devframe tool ids are colon-namespaced — `devframe:<area>:<fn>` for
+ * built-ins, `devframes:plugin:<slug>:<fn>` for plugin RPCs, and hub
+ * command ids for command-derived tools. MCP clients constrain tool names
+ * to `^[a-zA-Z0-9_-]{1,128}$`, so the agent/MCP boundary derives the wire
+ * name automatically: every run of characters outside `[a-zA-Z0-9_-]`
+ * becomes a single `_`, truncated to 128 characters. Internal ids never
+ * change — resolution back to the id happens at the boundary.
+ *
+ * ```
+ * devframe:state:read          → devframe_state_read
+ * devframes:plugin:git:status  → devframes_plugin_git_status
+ * ```
+ *
+ * A plain string transform with no node dependency, so browser-side UIs
+ * that display a tool's id (e.g. the inspect plugin's agent view) can
+ * import it too and show the name a client actually calls.
+ *
+ * @experimental The agent-native surface is experimental and may change
+ * without a major version bump until it stabilizes.
+ */
+declare function toAgentToolName(id: string): string;
+//#endregion
+export { toAgentToolName };

package/dist/utils/agent-tool-name.mjs

@@ -0,0 +1,34 @@
+//#region src/utils/agent-tool-name.ts
+/**
+* Maximum tool-name length several MCP clients enforce (the Anthropic API
+* pattern is `^[a-zA-Z0-9_-]{1,128}$`).
+*/
+const MAX_TOOL_NAME_LENGTH = 128;
+/**
+* Derive the wire-safe agent tool name for an internal tool id.
+*
+* Devframe tool ids are colon-namespaced — `devframe:<area>:<fn>` for
+* built-ins, `devframes:plugin:<slug>:<fn>` for plugin RPCs, and hub
+* command ids for command-derived tools. MCP clients constrain tool names
+* to `^[a-zA-Z0-9_-]{1,128}$`, so the agent/MCP boundary derives the wire
+* name automatically: every run of characters outside `[a-zA-Z0-9_-]`
+* becomes a single `_`, truncated to 128 characters. Internal ids never
+* change — resolution back to the id happens at the boundary.
+*
+* ```
+* devframe:state:read          → devframe_state_read
+* devframes:plugin:git:status  → devframes_plugin_git_status
+* ```
+*
+* A plain string transform with no node dependency, so browser-side UIs
+* that display a tool's id (e.g. the inspect plugin's agent view) can
+* import it too and show the name a client actually calls.
+*
+* @experimental The agent-native surface is experimental and may change
+* without a major version bump until it stabilizes.
+*/
+function toAgentToolName(id) {
+	return id.replace(/[^\w-]+/g, "_").slice(0, MAX_TOOL_NAME_LENGTH);
+}
+//#endregion
+export { toAgentToolName };

package/dist/utils/events.d.mts

@@ -1,4 +1,4 @@
-import { jt as EventsMap, kt as EventEmitter } from "../devframe-Ckhf3kFw.mjs";
+import { Nt as EventsMap, jt as EventEmitter } from "../devframe-qgCKL683.mjs";
 //#region src/utils/events.d.ts
 /**
  * Create event emitter.

package/dist/utils/shared-state.d.mts

@@ -1,2 +1,2 @@
-import { _t as SharedStateOptions, dt as ImmutableArray, ft as ImmutableMap, gt as SharedStateEvents, ht as SharedState, mt as ImmutableSet, pt as ImmutableObject, ut as Immutable, vt as SharedStatePatch, yt as createSharedState } from "../devframe-Ckhf3kFw.mjs";
+import { _t as SharedStateOptions, dt as ImmutableArray, ft as ImmutableMap, gt as SharedStateEvents, ht as SharedState, mt as ImmutableSet, pt as ImmutableObject, ut as Immutable, vt as SharedStatePatch, yt as createSharedState } from "../devframe-qgCKL683.mjs";
 export { Immutable, ImmutableArray, ImmutableMap, ImmutableObject, ImmutableSet, SharedState, SharedStateEvents, SharedStateOptions, SharedStatePatch, createSharedState };

package/dist/utils/simple-schema.d.mts

@@ -0,0 +1,2 @@
+import { a as literal, c as number, d as picklist, f as record, g as voidType, h as union, i as describe, l as object, m as string, n as array, o as nullType, p as s, r as boolean, s as nullable, t as SimpleSchema, u as optional } from "../simple-schema-BDzLeJDk.mjs";
+export { SimpleSchema, array, boolean, describe, literal, nullType, nullable, number, object, optional, picklist, record, s, string, union, voidType };