devframe 0.7.7 → 0.7.8

package/dist/adapters/build.d.mts

@@ -1,4 +1,4 @@
-import { r as DevframeDefinition } from "../devframe-elfUcUJG.mjs";
+import { r as DevframeDefinition } from "../devframe-C18zEiex.mjs";
 //#region src/adapters/build.d.ts
 interface CreateBuildOptions {
   /** Output directory. Defaults to `dist-static`. */

package/dist/adapters/cac.d.mts

@@ -1,4 +1,4 @@
-import { Ft as parseCliFlags, Mt as CliFlagsSchema, Nt as InferCliFlags, Pt as defineCliFlags, r as DevframeDefinition } from "../devframe-elfUcUJG.mjs";
+import { Ft as parseCliFlags, Mt as CliFlagsSchema, Nt as InferCliFlags, Pt as defineCliFlags, r as DevframeDefinition } from "../devframe-C18zEiex.mjs";
 import { CAC } from "cac";
 import { H3 } from "h3";
 //#region src/adapters/cac.d.ts

package/dist/adapters/cac.mjs

@@ -1,2 +1,2 @@
-import { n as defineCliFlags, r as parseCliFlags, t as createCac } from "../cac-CQB28Ucm.mjs";
+import { n as defineCliFlags, r as parseCliFlags, t as createCac } from "../cac-BK-MiL3k.mjs";
 export { createCac, defineCliFlags, parseCliFlags };

package/dist/adapters/cli.d.mts

@@ -1,4 +1,4 @@
-import { Ft as parseCliFlags, Mt as CliFlagsSchema, Nt as InferCliFlags, Pt as defineCliFlags } from "../devframe-elfUcUJG.mjs";
+import { Ft as parseCliFlags, Mt as CliFlagsSchema, Nt as InferCliFlags, Pt as defineCliFlags } from "../devframe-C18zEiex.mjs";
 import { CacHandle, CreateCacOptions, createCac } from "./cac.mjs";
 //#region src/adapters/cli.d.ts
 /** @deprecated Use `createCac` from `devframe/adapters/cac` instead. */

package/dist/adapters/cli.mjs

@@ -1,4 +1,4 @@
-import { n as defineCliFlags, r as parseCliFlags, t as createCac } from "../cac-CQB28Ucm.mjs";
+import { n as defineCliFlags, r as parseCliFlags, t as createCac } from "../cac-BK-MiL3k.mjs";
 //#region src/adapters/cli.ts
 /** @deprecated Use `createCac` from `devframe/adapters/cac` instead. */
 const createCli = createCac;

package/dist/adapters/dev.d.mts

@@ -1,5 +1,5 @@
-import { d as McpRouteOptions, r as DevframeDefinition, u as DevframeWsOptions } from "../devframe-elfUcUJG.mjs";
-import { n as StartedServer } from "../server-kmetRyhu.mjs";
+import { d as McpRouteOptions, r as DevframeDefinition, u as DevframeWsOptions } from "../devframe-C18zEiex.mjs";
+import { n as StartedServer } from "../server-BLaM21gv.mjs";
 import { H3 } from "h3";
 //#region src/adapters/dev.d.ts
 interface CreateDevServerOptions {

package/dist/adapters/dev.mjs

@@ -1,2 +1,2 @@
-import { n as resolveDevServerPort, t as createDevServer } from "../dev-J2PqMPTn.mjs";
+import { n as resolveDevServerPort, t as createDevServer } from "../dev-DmdXbLyJ.mjs";
 export { createDevServer, resolveDevServerPort };

package/dist/adapters/embedded.d.mts

@@ -1,4 +1,4 @@
-import { b as DevframeNodeContext, r as DevframeDefinition } from "../devframe-elfUcUJG.mjs";
+import { b as DevframeNodeContext, r as DevframeDefinition } from "../devframe-C18zEiex.mjs";
 //#region src/adapters/embedded.d.ts
 interface CreateEmbeddedOptions {
   /** Target context the devframe is registered into. Required. */

package/dist/adapters/mcp.d.mts

@@ -1,4 +1,4 @@
-import { r as DevframeDefinition } from "../devframe-elfUcUJG.mjs";
+import { r as DevframeDefinition } from "../devframe-C18zEiex.mjs";
 import "@modelcontextprotocol/sdk/server/index.js";
 //#region src/adapters/mcp/build-server.d.ts
 interface CreateMcpServerOptions {

package/dist/{cac-CQB28Ucm.mjs → cac-BK-MiL3k.mjs}

@@ -1,6 +1,6 @@
 import { n as colors } from "./diagnostics-reporter-CsIG85Q5.mjs";
 import { createBuild } from "./adapters/build.mjs";
-import { n as resolveDevServerPort, t as createDevServer } from "./dev-J2PqMPTn.mjs";
+import { n as resolveDevServerPort, t as createDevServer } from "./dev-DmdXbLyJ.mjs";
 import process from "node:process";
 import cac from "cac";
 import { safeParse } from "valibot";

package/dist/client/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as DevframeRpcServerFunctions, F as ScopedSharedStates, I as SettingsForNamespace, J as RpcSharedStateHost, N as ScopedRpcFn, O as DevframeSettings, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, _ as ConnectionMeta, at as StreamReader, ht as SharedState, kt as EventEmitter, ot as StreamSink, q as RpcSharedStateGetOptions } from "../devframe-elfUcUJG.mjs";
+import { $ as DevframeRpcServerFunctions, F as ScopedSharedStates, I as SettingsForNamespace, J as RpcSharedStateHost, N as ScopedRpcFn, O as DevframeSettings, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, _ as ConnectionMeta, at as StreamReader, ht as SharedState, kt as EventEmitter, ot as StreamSink, q as RpcSharedStateGetOptions } from "../devframe-C18zEiex.mjs";
 import { _ as RpcFunctionDefinition, w as RpcFunctionsCollector } from "../types-CrzNxXKq.mjs";
 import { C as RpcCacheManager, w as RpcCacheOptions } from "../index-DgsLFhZg.mjs";
 import { t as WsRpcChannelOptions } from "../ws-client-DSXiI2h7.mjs";

package/dist/client/index.mjs

@@ -2318,6 +2318,14 @@ async function getDevframeRpcClient(options = {}) {
 	try {
 		authChannel = new BroadcastChannel("devframe-auth");
 	} catch {}
+	let bootstrapAuthPromise;
+	let bootstrapAuthSettled = false;
+	function gateOnBootstrapAuth(fn) {
+		return ((...args) => {
+			if (bootstrapAuthSettled || !bootstrapAuthPromise) return fn(...args);
+			return bootstrapAuthPromise.then(() => fn(...args));
+		});
+	}
 	const rpc = {
 		events,
 		get isTrusted() {
@@ -2348,9 +2356,9 @@ async function getDevframeRpcClient(options = {}) {
 			} catch {}
 			return true;
 		},
-		call: mode.call,
-		callEvent: mode.callEvent,
-		callOptional: mode.callOptional,
+		call: gateOnBootstrapAuth(mode.call),
+		callEvent: gateOnBootstrapAuth(mode.callEvent),
+		callOptional: gateOnBootstrapAuth(mode.callOptional),
 		client: clientRpc,
 		sharedState: void 0,
 		streaming: void 0,
@@ -2395,7 +2403,11 @@ async function getDevframeRpcClient(options = {}) {
 		if (trusted || viaOtp || rpc.isTrusted) return;
 		await runSimpleAuthPrompt();
 	}
-	bootstrapAuth();
+	bootstrapAuthPromise = bootstrapAuth().then(() => {
+		bootstrapAuthSettled = true;
+	}, () => {
+		bootstrapAuthSettled = true;
+	});
 	if (authChannel) authChannel.onmessage = (event) => {
 		if (event.data?.type === "auth-update" && event.data.authToken) rpc.requestTrustWithToken(event.data.authToken);
 	};

package/dist/{context-D0md0kxv.d.mts → context-CuEeZkUg.d.mts}

@@ -1,4 +1,4 @@
-import { b as DevframeNodeContext, ht as SharedState } from "./devframe-elfUcUJG.mjs";
+import { b as DevframeNodeContext, ht as SharedState } from "./devframe-C18zEiex.mjs";
 //#region src/node/hub-internals/context.d.ts
 interface InternalAnonymousAuthStorage {
   trusted: Record<string, {

package/dist/{dev-J2PqMPTn.mjs → dev-DmdXbLyJ.mjs}

@@ -341,7 +341,7 @@ async function createDevServer(def, options = {}) {
 		onReady: async (info) => {
 			authHandler?.printBanner();
 			await options.onReady?.(info);
-			await maybeOpenBrowser(def, flags, `${info.origin}${basePath}`, options.openBrowser);
+			await maybeOpenBrowser(def, flags, `${info.origin}${basePath}`, options.openBrowser, authHandler);
 		}
 	});
 	if (mcpDispose) {
@@ -388,14 +388,15 @@ function resolveWsConnection(def, options, basePath) {
 		meta: { path: route }
 	};
 }
-async function maybeOpenBrowser(def, flags, origin, override) {
+async function maybeOpenBrowser(def, flags, origin, override, authHandler) {
 	const flagsOpen = flags.open;
 	const cliOpen = def.cli?.open;
 	const resolved = override ?? flagsOpen ?? cliOpen;
 	if (resolved === void 0 || resolved === false) return;
 	const target = typeof resolved === "string" ? withBase(resolved, origin) : origin;
+	const authorizedTarget = authHandler?.buildOpenUrl?.(target) ?? target;
 	try {
-		await open(target);
+		await open(authorizedTarget);
 	} catch {}
 }
 //#endregion

package/dist/{devframe-elfUcUJG.d.mts → devframe-C18zEiex.d.mts}

@@ -1407,6 +1407,15 @@ interface DevframeAuthHandler {
    * call repeatedly; it only prints once per code.
    */
   printBanner: () => void;
+  /**
+   * Rewrite a URL the CLI is about to open in the browser (`--open`) so the
+   * tab lands already authenticated — e.g. appending the current OTP as a
+   * query param. Called with the fully-resolved target URL; return it
+   * unchanged to opt out. Optional: a handler that doesn't need this (e.g.
+   * one gated by a pre-shared bearer token instead of an interactive code)
+   * can omit it and the URL opens as-is.
+   */
+  buildOpenUrl?: (url: string) => string;
 }
 //#endregion
 //#region src/types/devframe.d.ts

package/dist/helpers/vite.d.mts

@@ -1,4 +1,4 @@
-import { r as DevframeDefinition } from "../devframe-elfUcUJG.mjs";
+import { r as DevframeDefinition } from "../devframe-C18zEiex.mjs";
 //#region src/helpers/vite.d.ts
 interface ViteDevBridgeOptions {
   /**

package/dist/helpers/vite.mjs

@@ -2,7 +2,7 @@ import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_WS_ROUTE } from "../constan
 import { a as diagnostics } from "../storage-D_Xy9v1l.mjs";
 import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-bWRzeSa0.mjs";
 import { serveStaticNodeMiddleware } from "../utils/serve-static.mjs";
-import { n as resolveDevServerPort, t as createDevServer } from "../dev-J2PqMPTn.mjs";
+import { n as resolveDevServerPort, t as createDevServer } from "../dev-DmdXbLyJ.mjs";
 import { resolve } from "pathe";
 //#region src/helpers/vite.ts
 /**

package/dist/{index-D8RNkmY_.d.mts → index-BSmqhVju.d.mts}

@@ -1,5 +1,5 @@
-import { W as DevframeNodeRpcSession, b as DevframeNodeContext, ht as SharedState } from "./devframe-elfUcUJG.mjs";
-import { n as InternalAnonymousAuthStorage } from "./context-D0md0kxv.mjs";
+import { W as DevframeNodeRpcSession, b as DevframeNodeContext, ht as SharedState } from "./devframe-C18zEiex.mjs";
+import { n as InternalAnonymousAuthStorage } from "./context-CuEeZkUg.mjs";
 //#region src/node/auth/revoke.d.ts
 /**
  * Flip `isTrusted` to false on any live WS clients connected with `token`

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as DevframeRpcServerFunctions, A as DevframeSettingsStore, At as EventUnsubscribe, B as DevframeDefineDiagnosticsOptions, C as DevframeServicesHost, Ct as AgentResourceContent, D as DevframeScopedStreamingHost, Dt as DevframeAgentHost, E as DevframeScopedNodeRpc, Et as AgentToolInput, F as ScopedSharedStates, G as RpcBroadcastOptions, H as DevframeDiagnosticsHost, I as SettingsForNamespace, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost, M as ScopedClientFunctions, N as ScopedRpcFn, O as DevframeSettings, Ot as DevframeAgentHostEvents, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, V as DevframeDiagnosticsDefinition, W as DevframeNodeRpcSession, X as RpcStreamingChannelOptions, Y as RpcStreamingChannel, Z as RpcStreamingHost, _ as ConnectionMeta, a as DevframeDockDefaults, b as DevframeNodeContext, bt as AgentHandle, c as DevframeSetupInfo, d as McpRouteOptions, et as DevframeRpcSharedStates, f as defineDevframe, g as Thenable, h as PartialWithoutId, i as DevframeDeploymentKind, j as ScopedBroadcastOptions, jt as EventsMap, k as DevframeSettingsRegistry, kt as EventEmitter, l as DevframeSpaOptions, m as EntriesToObject, n as DevframeCliOptions, o as DevframeDuplicationStrategy, q as RpcSharedStateGetOptions, r as DevframeDefinition, s as DevframeRuntime, t as DevframeBrowserContext, u as DevframeWsOptions, v as ConnectionMetaWebsocket, w as DevframeServicesRegistry, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest, y as DevframeCapabilities, z as DevframeStorageScope } from "./devframe-elfUcUJG.mjs";
+import { $ as DevframeRpcServerFunctions, A as DevframeSettingsStore, At as EventUnsubscribe, B as DevframeDefineDiagnosticsOptions, C as DevframeServicesHost, Ct as AgentResourceContent, D as DevframeScopedStreamingHost, Dt as DevframeAgentHost, E as DevframeScopedNodeRpc, Et as AgentToolInput, F as ScopedSharedStates, G as RpcBroadcastOptions, H as DevframeDiagnosticsHost, I as SettingsForNamespace, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost, M as ScopedClientFunctions, N as ScopedRpcFn, O as DevframeSettings, Ot as DevframeAgentHostEvents, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, V as DevframeDiagnosticsDefinition, W as DevframeNodeRpcSession, X as RpcStreamingChannelOptions, Y as RpcStreamingChannel, Z as RpcStreamingHost, _ as ConnectionMeta, a as DevframeDockDefaults, b as DevframeNodeContext, bt as AgentHandle, c as DevframeSetupInfo, d as McpRouteOptions, et as DevframeRpcSharedStates, f as defineDevframe, g as Thenable, h as PartialWithoutId, i as DevframeDeploymentKind, j as ScopedBroadcastOptions, jt as EventsMap, k as DevframeSettingsRegistry, kt as EventEmitter, l as DevframeSpaOptions, m as EntriesToObject, n as DevframeCliOptions, o as DevframeDuplicationStrategy, q as RpcSharedStateGetOptions, r as DevframeDefinition, s as DevframeRuntime, t as DevframeBrowserContext, u as DevframeWsOptions, v as ConnectionMetaWebsocket, w as DevframeServicesRegistry, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest, y as DevframeCapabilities, z as DevframeStorageScope } from "./devframe-C18zEiex.mjs";
 import { C as RpcFunctionType, T as RpcReturnSchema, _ as RpcFunctionDefinition, g as RpcFunctionAgentOptions, i as RpcArgsSchema } from "./types-CrzNxXKq.mjs";
 import "./index-DgsLFhZg.mjs";
 import { t as DevframeNodeRpcSessionMeta } from "./ws-server-9-wn7MNQ.mjs";

package/dist/node/auth.d.mts

@@ -1,3 +1,3 @@
-import { p as DevframeAuthHandler } from "../devframe-elfUcUJG.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-D8RNkmY_.mjs";
+import { p as DevframeAuthHandler } from "../devframe-C18zEiex.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-BSmqhVju.mjs";
 export { DevframeAuthHandler, buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,5 +1,5 @@
-import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-elfUcUJG.mjs";
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-D0md0kxv.mjs";
+import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-C18zEiex.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-CuEeZkUg.mjs";
 //#region src/adapters/_shared.d.ts
 /**
  * Resolve the mount base path for a devframe's SPA. Hosted adapters

package/dist/node/index.d.mts

@@ -1,7 +1,7 @@
-import { C as DevframeServicesHost, Ct as AgentResourceContent, Dt as DevframeAgentHost$1, Et as AgentToolInput, H as DevframeDiagnosticsHost$1, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost$1, O as DevframeSettings, Ot as DevframeAgentHostEvents, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, Z as RpcStreamingHost, b as DevframeNodeContext, bt as AgentHandle, ht as SharedState, kt as EventEmitter, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest } from "../devframe-elfUcUJG.mjs";
+import { C as DevframeServicesHost, Ct as AgentResourceContent, Dt as DevframeAgentHost$1, Et as AgentToolInput, H as DevframeDiagnosticsHost$1, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost$1, O as DevframeSettings, Ot as DevframeAgentHostEvents, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, Z as RpcStreamingHost, b as DevframeNodeContext, bt as AgentHandle, ht as SharedState, kt as EventEmitter, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest } from "../devframe-C18zEiex.mjs";
 import { v as RpcFunctionDefinitionAny } from "../types-CrzNxXKq.mjs";
 import "../index-DgsLFhZg.mjs";
-import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-kmetRyhu.mjs";
+import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-BLaM21gv.mjs";
 import { BirpcGroup } from "birpc";
 //#region src/node/context.d.ts
 interface CreateHostContextOptions {

package/dist/recipes/interactive-auth.d.mts

@@ -1,5 +1,5 @@
-import { b as DevframeNodeContext, p as DevframeAuthHandler } from "../devframe-elfUcUJG.mjs";
-import "../index-D8RNkmY_.mjs";
+import { b as DevframeNodeContext, p as DevframeAuthHandler } from "../devframe-C18zEiex.mjs";
+import "../index-BSmqhVju.mjs";
 //#region src/recipes/interactive-auth.d.ts
 interface CreateInteractiveAuthOptions {
   /**

package/dist/recipes/interactive-auth.mjs

@@ -118,6 +118,9 @@ function createInteractiveAuth(context, options = {}) {
 		}
 		verifyAuthToken(token, session, storage);
 	}
+	function buildOpenUrl(url) {
+		return buildOtpAuthUrl(url);
+	}
 	return {
 		rpcFunctions: [
 			anonymousAuth,
@@ -126,7 +129,8 @@ function createInteractiveAuth(context, options = {}) {
 		],
 		authorize,
 		onConnect,
-		printBanner
+		printBanner,
+		buildOpenUrl
 	};
 }
 //#endregion

package/dist/recipes/open-helpers.d.mts

@@ -1,4 +1,4 @@
-import "../devframe-elfUcUJG.mjs";
+import "../devframe-C18zEiex.mjs";
 import { E as Thenable, S as RpcFunctionSetupResult, c as RpcDump, g as RpcFunctionAgentOptions } from "../types-CrzNxXKq.mjs";
 import "../index-DgsLFhZg.mjs";
 import * as v from "valibot";

package/dist/{server-kmetRyhu.d.mts → server-BLaM21gv.d.mts}

@@ -1,5 +1,5 @@
-import { $ as DevframeRpcServerFunctions, Q as DevframeRpcClientFunctions, W as DevframeNodeRpcSession, _ as ConnectionMeta, b as DevframeNodeContext, p as DevframeAuthHandler } from "./devframe-elfUcUJG.mjs";
-import "./index-D8RNkmY_.mjs";
+import { $ as DevframeRpcServerFunctions, Q as DevframeRpcClientFunctions, W as DevframeNodeRpcSession, _ as ConnectionMeta, b as DevframeNodeContext, p as DevframeAuthHandler } from "./devframe-C18zEiex.mjs";
+import "./index-BSmqhVju.mjs";
 import { Peer } from "crossws";
 import { BirpcGroup, EventOptions } from "birpc";
 import { NodeAdapter } from "crossws/adapters/node";

package/dist/types/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as DevframeRpcServerFunctions, A as DevframeSettingsStore, At as EventUnsubscribe, B as DevframeDefineDiagnosticsOptions, C as DevframeServicesHost, Ct as AgentResourceContent, D as DevframeScopedStreamingHost, Dt as DevframeAgentHost, E as DevframeScopedNodeRpc, Et as AgentToolInput, F as ScopedSharedStates, G as RpcBroadcastOptions, H as DevframeDiagnosticsHost, I as SettingsForNamespace, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost, M as ScopedClientFunctions, N as ScopedRpcFn, O as DevframeSettings, Ot as DevframeAgentHostEvents, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, V as DevframeDiagnosticsDefinition, W as DevframeNodeRpcSession, X as RpcStreamingChannelOptions, Y as RpcStreamingChannel, Z as RpcStreamingHost, _ as ConnectionMeta, a as DevframeDockDefaults, b as DevframeNodeContext, bt as AgentHandle, c as DevframeSetupInfo, d as McpRouteOptions, et as DevframeRpcSharedStates, f as defineDevframe, g as Thenable, h as PartialWithoutId, i as DevframeDeploymentKind, j as ScopedBroadcastOptions, jt as EventsMap, k as DevframeSettingsRegistry, kt as EventEmitter, l as DevframeSpaOptions, m as EntriesToObject, n as DevframeCliOptions, o as DevframeDuplicationStrategy, q as RpcSharedStateGetOptions, r as DevframeDefinition, s as DevframeRuntime, t as DevframeBrowserContext, u as DevframeWsOptions, v as ConnectionMetaWebsocket, w as DevframeServicesRegistry, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest, y as DevframeCapabilities, z as DevframeStorageScope } from "../devframe-elfUcUJG.mjs";
+import { $ as DevframeRpcServerFunctions, A as DevframeSettingsStore, At as EventUnsubscribe, B as DevframeDefineDiagnosticsOptions, C as DevframeServicesHost, Ct as AgentResourceContent, D as DevframeScopedStreamingHost, Dt as DevframeAgentHost, E as DevframeScopedNodeRpc, Et as AgentToolInput, F as ScopedSharedStates, G as RpcBroadcastOptions, H as DevframeDiagnosticsHost, I as SettingsForNamespace, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost, M as ScopedClientFunctions, N as ScopedRpcFn, O as DevframeSettings, Ot as DevframeAgentHostEvents, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, V as DevframeDiagnosticsDefinition, W as DevframeNodeRpcSession, X as RpcStreamingChannelOptions, Y as RpcStreamingChannel, Z as RpcStreamingHost, _ as ConnectionMeta, a as DevframeDockDefaults, b as DevframeNodeContext, bt as AgentHandle, c as DevframeSetupInfo, d as McpRouteOptions, et as DevframeRpcSharedStates, f as defineDevframe, g as Thenable, h as PartialWithoutId, i as DevframeDeploymentKind, j as ScopedBroadcastOptions, jt as EventsMap, k as DevframeSettingsRegistry, kt as EventEmitter, l as DevframeSpaOptions, m as EntriesToObject, n as DevframeCliOptions, o as DevframeDuplicationStrategy, q as RpcSharedStateGetOptions, r as DevframeDefinition, s as DevframeRuntime, t as DevframeBrowserContext, u as DevframeWsOptions, v as ConnectionMetaWebsocket, w as DevframeServicesRegistry, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest, y as DevframeCapabilities, z as DevframeStorageScope } from "../devframe-C18zEiex.mjs";
 import { g as RpcFunctionAgentOptions } from "../types-CrzNxXKq.mjs";
 import { t as DevframeNodeRpcSessionMeta } from "../ws-server-9-wn7MNQ.mjs";
 export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDockDefaults, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeServiceId, DevframeServiceOf, DevframeServicesHost, DevframeServicesRegistry, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeStorageScope, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, McpRouteOptions, PartialWithoutId, RpcBroadcastOptions, type RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedRpcFn, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe };

package/dist/utils/events.d.mts

@@ -1,4 +1,4 @@
-import { jt as EventsMap, kt as EventEmitter } from "../devframe-elfUcUJG.mjs";
+import { jt as EventsMap, kt as EventEmitter } from "../devframe-C18zEiex.mjs";
 //#region src/utils/events.d.ts
 /**
  * Create event emitter.

package/dist/utils/shared-state.d.mts

@@ -1,2 +1,2 @@
-import { _t as SharedStateOptions, dt as ImmutableArray, ft as ImmutableMap, gt as SharedStateEvents, ht as SharedState, mt as ImmutableSet, pt as ImmutableObject, ut as Immutable, vt as SharedStatePatch, yt as createSharedState } from "../devframe-elfUcUJG.mjs";
+import { _t as SharedStateOptions, dt as ImmutableArray, ft as ImmutableMap, gt as SharedStateEvents, ht as SharedState, mt as ImmutableSet, pt as ImmutableObject, ut as Immutable, vt as SharedStatePatch, yt as createSharedState } from "../devframe-C18zEiex.mjs";
 export { Immutable, ImmutableArray, ImmutableMap, ImmutableObject, ImmutableSet, SharedState, SharedStateEvents, SharedStateOptions, SharedStatePatch, createSharedState };

package/dist/utils/streaming-channel.d.mts

@@ -1,2 +1,2 @@
-import { at as StreamReader, ct as createStreamReader, it as StreamErrorPayload, lt as createStreamSink, nt as CreateStreamReaderOptions, ot as StreamSink, rt as CreateStreamSinkOptions, st as StreamSinkEvents, tt as BufferedChunk } from "../devframe-elfUcUJG.mjs";
+import { at as StreamReader, ct as createStreamReader, it as StreamErrorPayload, lt as createStreamSink, nt as CreateStreamReaderOptions, ot as StreamSink, rt as CreateStreamSinkOptions, st as StreamSinkEvents, tt as BufferedChunk } from "../devframe-C18zEiex.mjs";
 export { BufferedChunk, CreateStreamReaderOptions, CreateStreamSinkOptions, StreamErrorPayload, StreamReader, StreamSink, StreamSinkEvents, createStreamReader, createStreamSink };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devframe",
   "type": "module",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Framework for building generic devframes",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",

package/skills/devframe/SKILL.md

@@ -569,7 +569,7 @@ RPC handlers run with the full privileges of the host process, so the boundary t
 - **`auth` defaults to `true`** — dev-mode connections must authenticate before calls are accepted. Devframe ships the node primitives (`exchangeTempAuthCode`, `verifyAuthToken` in `devframe/node/auth`); the host adapter (e.g. Vite DevTools) provides the interactive `devframe:anonymous:auth` + `devframe:auth:exchange` handlers and auth UI.
 - **`auth: false` trusts every reachable connection.** Use it only for single-user `localhost` tools. Never combine it with a non-loopback bind host, a tunnel, or a shared/CI environment. The default bind host is already `localhost`.
 - **Authentication** exchanges a 6-digit one-time code (shown in the developer's terminal) for a node-issued bearer token via `requestTrustWithCode(code)`. The code is single-use, expires in 5 min, compared in constant time, and rotates after repeated failures — show it only in the terminal, never over the network.
-- **Magic-link (optional):** print `buildOtpAuthUrl(origin)` — `<origin>/?devframe_otp=<code>`. `connectDevframe` reads the code, exchanges it, and strips it from the URL. Integrations can opt out (`otpParam: false`) and drive it via the exposed `authenticateWithUrlOtp(rpc)` / `consumeOtpFromUrl()` client utilities. Only the single-use code rides the URL, never the bearer; treat the printed link like the code itself.
+- **Magic-link (optional):** print `buildOtpAuthUrl(origin)` — `<origin>/?devframe_otp=<code>`. `connectDevframe` reads the code, exchanges it, and strips it from the URL. Integrations can opt out (`otpParam: false`) and drive it via the exposed `authenticateWithUrlOtp(rpc)` / `consumeOtpFromUrl()` client utilities. Only the single-use code rides the URL, never the bearer; treat the printed link like the code itself. The standalone CLI's `--open` does this automatically via `DevframeAuthHandler.buildOpenUrl` — the launched tab already carries the OTP, no prompt needed.
 - **Tokens are secrets.** The bearer token rides the WS URL (`?devframe_auth_token=…`) — serve over `wss://`/`https://` beyond loopback. Never log the token or code, never bake them into build output. Revoke via `revokeAuthToken(...)`; clients drop to untrusted on `devframe:auth:revoked`.
 - **Authorize handlers.** Any trusted client can call any registered function — validate inputs, and mark state-changing functions `type: 'destructive'` so MCP/agent clients prompt first.
 - **Origin-lock remote docks** (`originLock`) so a dock token is honored only from its expected origin.