devframe 0.7.3 → 0.7.5

package/dist/adapters/build.d.mts

@@ -1,4 +1,4 @@
-import { r as DevframeDefinition } from "../devframe-CnTVuGw9.mjs";
+import { r as DevframeDefinition } from "../devframe-WHtcqYlZ.mjs";
 //#region src/adapters/build.d.ts
 interface CreateBuildOptions {
   /** Output directory. Defaults to `dist-static`. */

package/dist/adapters/build.mjs

@@ -3,7 +3,7 @@ import { n as colors } from "../diagnostics-reporter-CsIG85Q5.mjs";
 import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME } from "../constants.mjs";
 import { n as strictJsonStringify } from "../serialization-DpLXCy13.mjs";
 import { n as structuredCloneStringify } from "../structured-clone-XpHLZ8nr.mjs";
-import { n as createHostContext, t as createH3DevframeHost } from "../host-h3-Dsf-Tgwx.mjs";
+import { n as createHostContext, t as createH3DevframeHost } from "../host-h3-A8CXZoS5.mjs";
 import { n as resolveBasePath } from "../_shared-bWRzeSa0.mjs";
 import { existsSync } from "node:fs";
 import { dirname, resolve } from "pathe";

package/dist/adapters/cac.d.mts

@@ -1,4 +1,4 @@
-import { Dt as defineCliFlags, Et as InferCliFlags, Ot as parseCliFlags, Tt as CliFlagsSchema, r as DevframeDefinition } from "../devframe-CnTVuGw9.mjs";
+import { Mt as InferCliFlags, Nt as defineCliFlags, Pt as parseCliFlags, jt as CliFlagsSchema, r as DevframeDefinition } from "../devframe-WHtcqYlZ.mjs";
 import { CAC } from "cac";
 import { H3 } from "h3";
 //#region src/adapters/cac.d.ts

package/dist/adapters/cac.mjs

@@ -1,2 +1,2 @@
-import { n as defineCliFlags, r as parseCliFlags, t as createCac } from "../cac-BFCgKymz.mjs";
+import { n as defineCliFlags, r as parseCliFlags, t as createCac } from "../cac-Dr-qCdgQ.mjs";
 export { createCac, defineCliFlags, parseCliFlags };

package/dist/adapters/cli.d.mts

@@ -1,4 +1,4 @@
-import { Dt as defineCliFlags, Et as InferCliFlags, Ot as parseCliFlags, Tt as CliFlagsSchema } from "../devframe-CnTVuGw9.mjs";
+import { Mt as InferCliFlags, Nt as defineCliFlags, Pt as parseCliFlags, jt as CliFlagsSchema } from "../devframe-WHtcqYlZ.mjs";
 import { CacHandle, CreateCacOptions, createCac } from "./cac.mjs";
 //#region src/adapters/cli.d.ts
 /** @deprecated Use `createCac` from `devframe/adapters/cac` instead. */

package/dist/adapters/cli.mjs

@@ -1,4 +1,4 @@
-import { n as defineCliFlags, r as parseCliFlags, t as createCac } from "../cac-BFCgKymz.mjs";
+import { n as defineCliFlags, r as parseCliFlags, t as createCac } from "../cac-Dr-qCdgQ.mjs";
 //#region src/adapters/cli.ts
 /** @deprecated Use `createCac` from `devframe/adapters/cac` instead. */
 const createCli = createCac;

package/dist/adapters/dev.d.mts

@@ -1,5 +1,5 @@
-import { d as McpRouteOptions, r as DevframeDefinition, u as DevframeWsOptions } from "../devframe-CnTVuGw9.mjs";
-import { n as StartedServer } from "../server-4QH37sb-.mjs";
+import { d as McpRouteOptions, r as DevframeDefinition, u as DevframeWsOptions } from "../devframe-WHtcqYlZ.mjs";
+import { n as StartedServer } from "../server-BRxA2OAh.mjs";
 import { H3 } from "h3";
 //#region src/adapters/dev.d.ts
 interface CreateDevServerOptions {

package/dist/adapters/dev.mjs

@@ -1,2 +1,2 @@
-import { n as resolveDevServerPort, t as createDevServer } from "../dev-Bs4oRVnI.mjs";
+import { n as resolveDevServerPort, t as createDevServer } from "../dev-D6Hcv4v8.mjs";
 export { createDevServer, resolveDevServerPort };

package/dist/adapters/embedded.d.mts

@@ -1,4 +1,4 @@
-import { g as DevframeNodeContext, r as DevframeDefinition } from "../devframe-CnTVuGw9.mjs";
+import { b as DevframeNodeContext, r as DevframeDefinition } from "../devframe-WHtcqYlZ.mjs";
 //#region src/adapters/embedded.d.ts
 interface CreateEmbeddedOptions {
   /** Target context the devframe is registered into. Required. */

package/dist/adapters/mcp.d.mts

@@ -1,4 +1,4 @@
-import { r as DevframeDefinition } from "../devframe-CnTVuGw9.mjs";
+import { r as DevframeDefinition } from "../devframe-WHtcqYlZ.mjs";
 import "@modelcontextprotocol/sdk/server/index.js";
 //#region src/adapters/mcp/build-server.d.ts
 interface CreateMcpServerOptions {

package/dist/adapters/mcp.mjs

@@ -1,2 +1,2 @@
-import { n as createMcpServer } from "../build-server-Bo0G5XcS.mjs";
+import { n as createMcpServer } from "../build-server-D5-9okV6.mjs";
 export { createMcpServer };

package/dist/{build-server-Bo0G5XcS.mjs → build-server-D5-9okV6.mjs}

@@ -1,5 +1,5 @@
-import { a as diagnostics } from "./storage-yrUZaiib.mjs";
-import { n as createHostContext } from "./host-h3-Dsf-Tgwx.mjs";
+import { a as diagnostics } from "./storage-E9KrCsLr.mjs";
+import { n as createHostContext } from "./host-h3-A8CXZoS5.mjs";
 import { join } from "pathe";
 import process from "node:process";
 import { homedir } from "node:os";
@@ -195,7 +195,11 @@ async function createMcpServer(definition, options = {}) {
 		host: {
 			mountStatic: () => {},
 			resolveOrigin: () => "mcp://devframe",
-			getStorageDir: (scope) => scope === "workspace" ? join(process.cwd(), `node_modules/.${definition.id}/devframe`) : join(homedir(), `.${definition.id}/devframe`)
+			getStorageDir: (scope) => {
+				if (scope === "workspace") return join(process.cwd(), ".devframe");
+				if (scope === "project") return join(process.cwd(), `node_modules/.${definition.id}/devframe`);
+				return join(homedir(), `.${definition.id}/devframe`);
+			}
 		}
 	});
 	await definition.setup(ctx);

package/dist/{cac-BFCgKymz.mjs → cac-Dr-qCdgQ.mjs}

@@ -1,6 +1,6 @@
 import { n as colors } from "./diagnostics-reporter-CsIG85Q5.mjs";
 import { createBuild } from "./adapters/build.mjs";
-import { n as resolveDevServerPort, t as createDevServer } from "./dev-Bs4oRVnI.mjs";
+import { n as resolveDevServerPort, t as createDevServer } from "./dev-D6Hcv4v8.mjs";
 import process from "node:process";
 import cac from "cac";
 import { safeParse } from "valibot";
@@ -88,7 +88,7 @@ function createCac(d, options = {}) {
 	const defaultPort = options.defaultPort ?? d.cli?.port ?? 9999;
 	const defaultHost = d.cli?.host ?? "localhost";
 	const cli = cac(d.cli?.command ?? d.id);
-	const devCommand = cli.command("[...args]", "Start a local dev server").option("--port <port>", "Port to listen on").option("--host <host>", "Host to bind to", { default: defaultHost }).option("--open", "Open the browser on start").option("--no-open", "Do not open the browser").option("--mcp", "Expose an MCP server over HTTP at /__mcp (use --no-mcp to disable) [experimental]");
+	const devCommand = cli.command("[...args]", "Start a local dev server").option("--port <port>", "Port to listen on").option("--host <host>", "Host to bind to", { default: defaultHost }).option("--open", "Open the browser on start").option("--no-open", "Do not open the browser").option("--no-auth", "Disable the interactive authentication gate").option("--mcp", "Expose an MCP server over HTTP at /__mcp (use --no-mcp to disable) [experimental]");
 	if (d.cli?.flags) for (const [key, schema] of Object.entries(d.cli.flags)) {
 		const optionName = flagKeyToOption(key);
 		const description = schema.description ?? "";

package/dist/client/index.d.mts

@@ -1,4 +1,4 @@
-import { A as StreamSink, St as EventEmitter, X as DevframeSettings, at as DevframeRpcClientFunctions, b as RpcSharedStateGetOptions, k as StreamReader, nt as ScopedSharedStates, ot as DevframeRpcServerFunctions, p as ConnectionMeta, rt as SettingsForNamespace, tt as ScopedServerFunctions, x as RpcSharedStateHost, z as SharedState } from "../devframe-CnTVuGw9.mjs";
+import { F as SettingsForNamespace, K as RpcSharedStateGetOptions, N as ScopedServerFunctions, O as DevframeSettings, Ot as EventEmitter, P as ScopedSharedStates, Q as DevframeRpcServerFunctions, Z as DevframeRpcClientFunctions, _ as ConnectionMeta, at as StreamSink, it as StreamReader, mt as SharedState, q as RpcSharedStateHost } from "../devframe-WHtcqYlZ.mjs";
 import { _ as RpcFunctionDefinition, w as RpcFunctionsCollector } from "../types-CrzNxXKq.mjs";
 import { C as RpcCacheManager, w as RpcCacheOptions } from "../index-DgsLFhZg.mjs";
 import { t as WsRpcChannelOptions } from "../ws-client-DSXiI2h7.mjs";
@@ -195,9 +195,25 @@ interface DevframeRpcClientOptions {
    * (OTP) for "magic link" auth (e.g. a link the dev server prints). When
    * present, the client exchanges the code for a token and removes the parameter
    * from the URL. Set `false` to disable — e.g. integrations that drive their
-   * own authentication via `authenticateWithUrlOtp`. Default: `'devframe_otp'`.
+   * own authentication via `authenticateWithUrlOtp`.
+   *
+   * @default 'devframe_otp'
    */
   otpParam?: string | false;
+  /**
+   * Fall back to a native browser `prompt()` for the one-time authentication
+   * code when the server refuses trust and no other credential succeeds (a
+   * stored token, an injected token, or a magic-link OTP). The prompt fires
+   * only on a **top-level, unframed** page — a framed plugin (e.g. mounted in
+   * a hub dock) never prompts, since a hub pre-authorizes it and browsers
+   * block `prompt()` in cross-origin frames anyway.
+   *
+   * Set `false` to drive your own auth UI (a hub sets this on the plugin
+   * connections it manages, alongside supplying the token).
+   *
+   * @default true
+   */
+  simpleAuth?: boolean;
   wsOptions?: Partial<WsRpcChannelOptions>;
   rpcOptions?: Partial<BirpcOptions<DevframeRpcServerFunctions, DevframeRpcClientFunctions, boolean>>;
   cacheOptions?: boolean | Partial<RpcCacheOptions>;

package/dist/client/index.mjs

@@ -2269,7 +2269,7 @@ async function getDevframeRpcClient(options = {}) {
 		...typeof options.cacheOptions === "object" ? options.cacheOptions : {}
 	});
 	const context = { rpc: void 0 };
-	const authToken = getStoredAuthToken(options.authToken);
+	const authToken = getStoredAuthToken(options.authToken || connectionMeta.authToken);
 	if (authToken) persistAuthToken(authToken);
 	const clientRpc = new RpcFunctionsCollectorBase(context);
 	async function fetchJsonFromBases(path) {
@@ -2361,9 +2361,32 @@ async function getDevframeRpcClient(options = {}) {
 		return scoped;
 	});
 	context.rpc = rpc;
-	mode.requestTrust();
-	const otpParam = options.otpParam ?? "devframe_otp";
-	if (otpParam) authenticateWithUrlOtp(rpc, { param: otpParam });
+	function isTopLevelUnframed() {
+		try {
+			return typeof window !== "undefined" && window.self === window.top;
+		} catch {
+			return false;
+		}
+	}
+	async function runSimpleAuthPrompt() {
+		if (options.simpleAuth === false || !isTopLevelUnframed()) return;
+		if (typeof globalThis.prompt !== "function") return;
+		while (!rpc.isTrusted) {
+			const code = globalThis.prompt("devframe: enter the authentication code shown in your terminal");
+			if (code == null) return;
+			const trimmed = code.trim();
+			if (!trimmed) continue;
+			if (await rpc.requestTrustWithCode(trimmed)) return;
+		}
+	}
+	async function bootstrapAuth() {
+		const trusted = await mode.requestTrust();
+		const otpParam = options.otpParam ?? "devframe_otp";
+		const viaOtp = otpParam ? await authenticateWithUrlOtp(rpc, { param: otpParam }) : false;
+		if (trusted || viaOtp || rpc.isTrusted) return;
+		await runSimpleAuthPrompt();
+	}
+	bootstrapAuth();
 	if (authChannel) authChannel.onmessage = (event) => {
 		if (event.data?.type === "auth-update" && event.data.authToken) rpc.requestTrustWithToken(event.data.authToken);
 	};

package/dist/{context-CKJheEtf.mjs → context-ClRdkpJ7.mjs}

@@ -1,4 +1,4 @@
-import { t as createStorage } from "./storage-yrUZaiib.mjs";
+import { t as createStorage } from "./storage-E9KrCsLr.mjs";
 import { i as randomToken, n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "./revoke-BtQDKTp7.mjs";
 import { join } from "pathe";
 //#region src/node/hub-internals/context.ts

package/dist/{context-B1sekkgB.d.mts → context-DxFsOWkc.d.mts}

@@ -1,4 +1,4 @@
-import { g as DevframeNodeContext, z as SharedState } from "./devframe-CnTVuGw9.mjs";
+import { b as DevframeNodeContext, mt as SharedState } from "./devframe-WHtcqYlZ.mjs";
 //#region src/node/hub-internals/context.d.ts
 interface InternalAnonymousAuthStorage {
   trusted: Record<string, {

package/dist/{dev-Bs4oRVnI.mjs → dev-D6Hcv4v8.mjs}

@@ -1,16 +1,17 @@
 import { DEVFRAME_CONNECTION_META_FILENAME } from "./constants.mjs";
-import { a as diagnostics } from "./storage-yrUZaiib.mjs";
-import { n as createHostContext, t as createH3DevframeHost } from "./host-h3-Dsf-Tgwx.mjs";
-import { i as normalizeHttpServerUrl, t as startHttpAndWs } from "./server-CRFYfRqK.mjs";
+import { a as diagnostics } from "./storage-E9KrCsLr.mjs";
+import { n as createHostContext, t as createH3DevframeHost } from "./host-h3-A8CXZoS5.mjs";
+import { i as normalizeHttpServerUrl, t as startHttpAndWs } from "./server-DvrOR1LG.mjs";
 import { n as resolveBasePath, t as normalizeBasePath } from "./_shared-bWRzeSa0.mjs";
 import { t as open } from "./open-Deb5xmIT.mjs";
 import { mountStaticHandler } from "./utils/serve-static.mjs";
+import { createInteractiveAuth } from "./recipes/interactive-auth.mjs";
 import { resolve } from "pathe";
 import process$1 from "node:process";
 import { networkInterfaces } from "node:os";
 import { H3 } from "h3";
 import { createServer } from "node:net";
-import { joinURL, withBase as withBase$1, withLeadingSlash, withoutLeadingSlash } from "ufo";
+import { joinURL, withBase, withLeadingSlash, withoutLeadingSlash } from "ufo";
 //#region ../../node_modules/.pnpm/get-port-please@3.2.0/node_modules/get-port-please/dist/index.mjs
 const unsafePorts = /* @__PURE__ */ new Set([
 	1,
@@ -293,7 +294,7 @@ async function createDevServer(def, options = {}) {
 		const mcpPath = joinURL(basePath, mcpRoute);
 		let mountMcpHttp;
 		try {
-			({mountMcpHttp} = await import("./http-BirzlyE9.mjs"));
+			({mountMcpHttp} = await import("./http-Fxm-0_V7.mjs"));
 		} catch (error) {
 			const reason = error instanceof Error ? error.message : String(error);
 			throw diagnostics.DF0017({
@@ -318,6 +319,17 @@ async function createDevServer(def, options = {}) {
 		...mcpMeta ? { mcp: mcpMeta } : {}
 	}));
 	if (distDir) mountStaticHandler(app, basePath, resolve(distDir));
+	const authOption = flags.auth === false ? false : def.cli?.auth;
+	let authHandler;
+	let resolvedAuth;
+	if (authOption === false) resolvedAuth = false;
+	else if (typeof authOption === "object") {
+		authHandler = authOption;
+		resolvedAuth = authOption;
+	} else {
+		authHandler = createInteractiveAuth(ctx);
+		resolvedAuth = authHandler;
+	}
 	const started = await startHttpAndWs({
 		context: ctx,
 		host,
@@ -325,8 +337,9 @@ async function createDevServer(def, options = {}) {
 		app,
 		path: bindPath,
 		wsPort,
-		auth: def.cli?.auth,
+		auth: resolvedAuth,
 		onReady: async (info) => {
+			authHandler?.printBanner();
 			await options.onReady?.(info);
 			await maybeOpenBrowser(def, flags, `${info.origin}${basePath}`, options.openBrowser);
 		}
@@ -380,7 +393,7 @@ async function maybeOpenBrowser(def, flags, origin, override) {
 	const cliOpen = def.cli?.open;
 	const resolved = override ?? flagsOpen ?? cliOpen;
 	if (resolved === void 0 || resolved === false) return;
-	const target = typeof resolved === "string" ? withBase$1(resolved, origin) : origin;
+	const target = typeof resolved === "string" ? withBase(resolved, origin) : origin;
 	try {
 		await open(target);
 	} catch {}