devframe 0.9.12 → 0.9.14

package/dist/{_shared-DEAMiPfH.d.mts → _shared-Bf2FcfJ4.d.mts}

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, G as McpAuthorization, I as DevframeDeploymentKind, q as McpSetting, t as ConnectionMeta, zt as DevframeAgentHost } from "./context-BBWPLDHh.mjs";
+import { F as DevframeDefinition, G as McpAuthorization, I as DevframeDeploymentKind, q as McpSetting, t as ConnectionMeta, zt as DevframeAgentHost } from "./context-B7411Bem.mjs";
 //#region src/adapters/_shared.d.ts
 /**
  * Resolve the mount base path for a devframe's SPA. Hosted adapters

package/dist/adapters/build.d.mts

@@ -1,7 +1,7 @@
-import { F as DevframeDefinition, V as DevframeSnapshotRpcEntry, o as DevframeNodeContext } from "../context-BBWPLDHh.mjs";
+import { F as DevframeDefinition, V as DevframeSnapshotRpcEntry, o as DevframeNodeContext } from "../context-B7411Bem.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
 //#region src/adapters/build.d.ts
-interface CreateBuildOptions {
+export interface CreateBuildOptions {
   /** Output directory. Defaults to `dist-static`. */
   outDir?: string;
   /**
@@ -37,7 +37,7 @@ interface CreateBuildOptions {
  *     output is mount-path agnostic, so the same bundle works at `/`,
  *     `/devframe/`, or any base, no rewriting required.
  */
-declare function createBuild(d: DevframeDefinition, options?: CreateBuildOptions): Promise<void>;
+export declare function createBuild(d: DevframeDefinition, options?: CreateBuildOptions): Promise<void>;
 /**
  * Attach a `dump` to each {@link DevframeRpcOptions.snapshot} target so the
  * static collector bakes it, even though the (service-owned) definition
@@ -46,6 +46,5 @@ declare function createBuild(d: DevframeDefinition, options?: CreateBuildOptions
  * argument-tuple by running the target's own handler, with the first tuple's
  * output as the fallback.
  */
-declare function applySnapshotRpc(ctx: DevframeNodeContext, entries: readonly DevframeSnapshotRpcEntry[] | undefined): void;
-//#endregion
-export { CreateBuildOptions, applySnapshotRpc, createBuild };
+export declare function applySnapshotRpc(ctx: DevframeNodeContext, entries: readonly DevframeSnapshotRpcEntry[] | undefined): void;
+//#endregion

package/dist/adapters/build.mjs

@@ -1,9 +1,9 @@
 import { s as colors } from "../nostics-D0PvLZsn.mjs";
 import { t as resolveClientAssets } from "../client-assets-DNdhagGm.mjs";
 import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME } from "../constants.mjs";
-import { n as collectStaticRpcDump, t as writeStaticRpcDump } from "../write-BuLCrn9h.mjs";
+import { n as collectStaticRpcDump, t as writeStaticRpcDump } from "../write-D2AJqVT8.mjs";
 import { t as diagnostics } from "../diagnostics-DZA6KQ_Z.mjs";
-import { t as createHostContext } from "../context-DwGevWqT.mjs";
+import { t as createHostContext } from "../context-Cdj9z9m2.mjs";
 import { t as resolveStaticAssetsSource } from "../remote-assets-DMFzLSoH.mjs";
 import { t as createH3DevframeHost } from "../host-h3-BROI6SQ4.mjs";
 import fs from "node:fs/promises";

package/dist/adapters/cac.d.mts

@@ -1,8 +1,8 @@
-import { Dt as InferCliFlags, Et as CliFlagsSchema, F as DevframeDefinition, Ot as defineCliFlags, kt as parseCliFlags, q as McpSetting } from "../context-BBWPLDHh.mjs";
+import { Dt as InferCliFlags, Et as CliFlagsSchema, F as DevframeDefinition, Ot as defineCliFlags, kt as parseCliFlags, q as McpSetting } from "../context-B7411Bem.mjs";
 import { CAC } from "cac";
 import { H3 } from "h3";
 //#region src/adapters/cac.d.ts
-interface CreateCacOptions {
+export interface CreateCacOptions {
   /** Default port for `dev` (default: 9999). */
   defaultPort?: number;
   /**
@@ -32,7 +32,7 @@ interface CreateCacOptions {
     app: H3;
   }) => void | Promise<void>;
 }
-interface CacHandle {
+export interface CacHandle {
   /**
    * Raw CAC instance. Mutate before calling `parse()` for last-mile
    * flag or command additions that don't fit `configureCli`.
@@ -46,6 +46,6 @@ interface CacHandle {
  *
  * Requires the optional `cac` peer dependency.
  */
-declare function createCac(d: DevframeDefinition, options?: CreateCacOptions): CacHandle;
+export declare function createCac(d: DevframeDefinition, options?: CreateCacOptions): CacHandle;
 //#endregion
-export { CacHandle, type CliFlagsSchema, CreateCacOptions, type InferCliFlags, createCac, defineCliFlags, parseCliFlags };
+export { type CliFlagsSchema, type InferCliFlags, defineCliFlags, parseCliFlags };

package/dist/adapters/cac.mjs

@@ -1,7 +1,7 @@
 import { s as colors } from "../nostics-D0PvLZsn.mjs";
 import { i as resolveDevServerPort, s as importRuntimeModule } from "../_shared-U8D-xzrp.mjs";
 import { createBuild } from "./build.mjs";
-import { t as createDevServer } from "../dev-CZ1fu4J1.mjs";
+import { t as createDevServer } from "../dev-DpfkCVqo.mjs";
 import process from "node:process";
 import cac$1 from "cac";
 //#region src/adapters/flags.ts

package/dist/adapters/dev.d.mts

@@ -1,11 +1,11 @@
 import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection, n as WsOriginRegistry } from "../ws-server-D2nv68Hg.mjs";
-import { F as DevframeDefinition, Tt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, q as McpSetting, s as DevframeNodeRpcSession } from "../context-BBWPLDHh.mjs";
+import { F as DevframeDefinition, Tt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, q as McpSetting, s as DevframeNodeRpcSession } from "../context-B7411Bem.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
-import { c as StartedServer } from "../instance-shell-BUyYrKlu.mjs";
-import { c as resolveMcpConnectionMeta, o as resolveDevServerPort, t as ResolveDevServerPortOptions } from "../_shared-DEAMiPfH.mjs";
+import { c as StartedServer } from "../instance-shell-B-FE8NY5.mjs";
+import { c as resolveMcpConnectionMeta, o as resolveDevServerPort, t as ResolveDevServerPortOptions } from "../_shared-Bf2FcfJ4.mjs";
 import { H3 } from "h3";
 //#region src/adapters/dev.d.ts
-interface CreateDevServerOptions {
+export interface CreateDevServerOptions {
   /** Bind host. Default: `def.cli?.host ?? 'localhost'`. */
   host?: string;
   /**
@@ -131,6 +131,6 @@ interface CreateDevServerOptions {
  * framework (commander, yargs, hand-rolled CAC). For the all-in-one
  * `dev` / `build` / `mcp` shell, reach for {@link createCac} instead.
  */
-declare function createDevServer(def: DevframeDefinition, options?: CreateDevServerOptions): Promise<StartedServer>;
+export declare function createDevServer(def: DevframeDefinition, options?: CreateDevServerOptions): Promise<StartedServer>;
 //#endregion
-export { CreateDevServerOptions, type ResolveDevServerPortOptions, createDevServer, resolveDevServerPort, resolveMcpConnectionMeta };
+export { type ResolveDevServerPortOptions, resolveDevServerPort, resolveMcpConnectionMeta };

package/dist/adapters/dev.mjs

@@ -1,3 +1,3 @@
 import { i as resolveDevServerPort, o as resolveMcpConnectionMeta } from "../_shared-U8D-xzrp.mjs";
-import { t as createDevServer } from "../dev-CZ1fu4J1.mjs";
+import { t as createDevServer } from "../dev-DpfkCVqo.mjs";
 export { createDevServer, resolveDevServerPort, resolveMcpConnectionMeta };

package/dist/adapters/embedded.d.mts

@@ -1,6 +1,6 @@
-import { F as DevframeDefinition, o as DevframeNodeContext } from "../context-BBWPLDHh.mjs";
+import { F as DevframeDefinition, o as DevframeNodeContext } from "../context-B7411Bem.mjs";
 //#region src/adapters/embedded.d.ts
-interface CreateEmbeddedOptions {
+export interface CreateEmbeddedOptions {
   /** Target context the devframe is registered into. Required. */
   ctx: DevframeNodeContext;
 }
@@ -13,6 +13,5 @@ interface CreateEmbeddedOptions {
  * The host owns the mount path; when a hosted mount is needed the
  * effective default follows the hosted rule of `def.basePath ?? '/__<id>/'`.
  */
-declare function createEmbedded(d: DevframeDefinition, options: CreateEmbeddedOptions): Promise<void>;
-//#endregion
-export { CreateEmbeddedOptions, createEmbedded };
+export declare function createEmbedded(d: DevframeDefinition, options: CreateEmbeddedOptions): Promise<void>;
+//#endregion

package/dist/adapters/initiate.d.mts

@@ -1,13 +1,13 @@
 import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection, n as WsOriginRegistry } from "../ws-server-D2nv68Hg.mjs";
-import { F as DevframeDefinition, St as DevframeStorageScope, Tt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, o as DevframeNodeContext, q as McpSetting, s as DevframeNodeRpcSession, t as ConnectionMeta } from "../context-BBWPLDHh.mjs";
+import { F as DevframeDefinition, St as DevframeStorageScope, Tt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, o as DevframeNodeContext, q as McpSetting, s as DevframeNodeRpcSession, t as ConnectionMeta } from "../context-B7411Bem.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
-import { c as StartedServer, f as DevframeInstanceRecord } from "../instance-shell-BUyYrKlu.mjs";
+import { c as StartedServer, f as DevframeInstanceRecord } from "../instance-shell-B-FE8NY5.mjs";
 import { Buffer } from "node:buffer";
 import { IncomingMessage, Server, ServerResponse } from "node:http";
 import { Duplex } from "node:stream";
 import { H3 } from "h3";
 //#region src/adapters/initiate.d.ts
-interface InitDevframeOptions {
+export interface InitDevframeOptions {
   /**
    * Mount base the handler answers under (e.g. `/__my-tool/`), required so
    * the mount path is explicit at the call site. A handler is by definition
@@ -63,8 +63,8 @@ interface InitDevframeOptions {
    * Authentication for the RPC endpoint. A handler mounted inside an app
    * server is reachable by anything that can open its socket, so it **gates
    * by default**: when unset (or `true`), devframe's interactive OTP handler
-   * is wired and its code/link banner prints once the public origin is known
-   * (derived from the first request, or `origin`). Pass a
+   * is wired and its code/link banner prints when an untrusted client asks
+   * for a code (the client's `requestAuthCode()`). Pass a
    * {@link DevframeAuthHandler} for a custom scheme, or `false` to opt out
    * for a single-user localhost setup that owns the trust boundary another
    * way. Ignored for the `ws.url` tier, since the server behind that URL owns auth.
@@ -137,7 +137,7 @@ interface InitDevframeOptions {
    */
   onPeerDisconnect?: (connection: DevframeRpcConnection, meta: DevframeNodeRpcSessionMeta) => void;
 }
-interface DevframeInstance {
+export interface DevframeInstance {
   /**
    * The normalized mount base this instance answers under (leading and
    * trailing slash, e.g. `/__my-tool/`). Reference it when wiring the mount
@@ -198,14 +198,14 @@ interface DevframeInstance {
  *
  * @internal
  */
-interface DevframeInstanceInternals {
+export interface DevframeInstanceInternals {
   /** The bound HTTP+WS server handle backing the side-car / shared-server WS tiers. */
   readonly started?: StartedServer;
   /** The resolved auth handler when the gate is active. */
   readonly authHandler?: DevframeAuthHandler;
 }
 /** @internal */
-declare function getInstanceInternals(handler: object): DevframeInstanceInternals;
+export declare function getInstanceInternals(handler: object): DevframeInstanceInternals;
 /**
  * Serve a devframe through one framework-agnostic, web-standard handler:
  * the SPA, `__connection.json` discovery, the WebSocket RPC endpoint, the
@@ -223,6 +223,5 @@ declare function getInstanceInternals(handler: object): DevframeInstanceInternal
  * transport to an external server. `__connection.json` reflects whichever
  * combination is active.
  */
-declare function initDevframe(def: DevframeDefinition, options: InitDevframeOptions): DevframeInstance;
-//#endregion
-export { DevframeInstance, DevframeInstanceInternals, InitDevframeOptions, getInstanceInternals, initDevframe };
+export declare function initDevframe(def: DevframeDefinition, options: InitDevframeOptions): DevframeInstance;
+//#endregion

package/dist/adapters/initiate.mjs

@@ -1,2 +1,2 @@
-import { n as getInstanceInternals, r as initDevframe } from "../dev-CZ1fu4J1.mjs";
+import { n as getInstanceInternals, r as initDevframe } from "../dev-DpfkCVqo.mjs";
 export { getInstanceInternals, initDevframe };

package/dist/adapters/mcp.d.mts

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, G as McpAuthorization, o as DevframeNodeContext } from "../context-BBWPLDHh.mjs";
+import { F as DevframeDefinition, G as McpAuthorization, o as DevframeNodeContext } from "../context-B7411Bem.mjs";
 import { H3 } from "h3";
 import "@modelcontextprotocol/server";
 //#region src/adapters/mcp/build-server.d.ts
@@ -33,7 +33,7 @@ interface McpServerHandle {
  * Build an MCP server over the agent surface of a devframe definition.
  * Currently supports `stdio` transport only.
  */
-declare function createMcpServer(definition: DevframeDefinition, options?: CreateMcpServerOptions): Promise<McpServerHandle>;
+export declare function createMcpServer(definition: DevframeDefinition, options?: CreateMcpServerOptions): Promise<McpServerHandle>;
 //#endregion
 //#region src/adapters/mcp/fetch.d.ts
 interface CreateMcpFetchHandlerOptions {
@@ -97,7 +97,7 @@ interface McpFetchHandler {
  * calling (a missing/invalid credential gets `401` with a
  * `WWW-Authenticate: Bearer` challenge).
  */
-declare function createMcpFetchHandler(ctx: DevframeNodeContext, options: CreateMcpFetchHandlerOptions): McpFetchHandler;
+export declare function createMcpFetchHandler(ctx: DevframeNodeContext, options: CreateMcpFetchHandlerOptions): McpFetchHandler;
 //#endregion
 //#region src/adapters/mcp/http.d.ts
 interface MountMcpHttpOptions extends CreateMcpFetchHandlerOptions {}
@@ -118,6 +118,6 @@ interface MountedMcpHttp {
  * falls through to the next handler" rule (which would otherwise hand the
  * request to the SPA static catch-all).
  */
-declare function mountMcpHttp(app: H3, ctx: DevframeNodeContext, path: string, options: MountMcpHttpOptions): MountedMcpHttp;
+export declare function mountMcpHttp(app: H3, ctx: DevframeNodeContext, path: string, options: MountMcpHttpOptions): MountedMcpHttp;
 //#endregion
-export { type CreateMcpFetchHandlerOptions, type CreateMcpServerOptions, type McpFetchHandler, type McpServerHandle, type MountMcpHttpOptions, type MountedMcpHttp, createMcpFetchHandler, createMcpServer, mountMcpHttp };
+export type { CreateMcpFetchHandlerOptions, CreateMcpServerOptions, McpFetchHandler, McpServerHandle, MountMcpHttpOptions, MountedMcpHttp };

package/dist/adapters/mcp.mjs

@@ -3,7 +3,7 @@ import { t as DEVFRAME_EVENTS } from "../events-BV4Dj59a.mjs";
 import { t as isAllowedOrigin } from "../origin-DZit9g29.mjs";
 import { r as timingSafeEqual } from "../crypto-token-TVbGGFuj.mjs";
 import { t as diagnostics } from "../diagnostics-DZA6KQ_Z.mjs";
-import { t as createHostContext } from "../context-DwGevWqT.mjs";
+import { t as createHostContext } from "../context-Cdj9z9m2.mjs";
 import { t as toAgentToolName } from "../agent-tool-name-DGzeuWcO.mjs";
 import { join } from "pathe";
 import process from "node:process";

package/dist/cli/main.d.mts

@@ -4,6 +4,5 @@
  * CLI shells authors build with `createCac(definition)`. It hosts the
  * app-independent commands; today that is `connect`, the MCP connector.
  */
-declare function runDevframeCli(argv?: string[]): Promise<void>;
-//#endregion
-export { runDevframeCli };
+export declare function runDevframeCli(argv?: string[]): Promise<void>;
+//#endregion

package/dist/client/index.d.mts

@@ -1,11 +1,11 @@
 import { f as RpcCacheManager, p as RpcCacheOptions } from "../index-pIVt92jP.mjs";
 import { _ as RpcFunctionDefinition, w as RpcFunctionsCollector } from "../types-Dq4i156u.mjs";
-import { Q as DevframeServiceMeta, Vt as EventEmitter, b as StreamSink, ct as DevframeSettings, d as RpcSharedStateHost, et as DevframeServiceScopeOf, gt as SettingsForNamespace, ht as ScopedSharedStates, it as DevframeServicesState, k as SharedState, mt as ScopedServerFunctions, pt as ScopedRpcFn, t as ConnectionMeta, u as RpcSharedStateGetOptions, vt as DevframeRpcClientFunctions, y as StreamReader, yt as DevframeRpcServerFunctions } from "../context-BBWPLDHh.mjs";
+import { Q as DevframeServiceMeta, Vt as EventEmitter, b as StreamSink, ct as DevframeSettings, d as RpcSharedStateHost, et as DevframeServiceScopeOf, gt as SettingsForNamespace, ht as ScopedSharedStates, it as DevframeServicesState, k as SharedState, mt as ScopedServerFunctions, pt as ScopedRpcFn, t as ConnectionMeta, u as RpcSharedStateGetOptions, vt as DevframeRpcClientFunctions, y as StreamReader, yt as DevframeRpcServerFunctions } from "../context-B7411Bem.mjs";
 import { t as SseRpcChannelOptions } from "../sse-client-BQ4jS3eO.mjs";
 import { t as WsRpcChannelOptions } from "../ws-client-Xpxt0oPA.mjs";
 import { BirpcOptions, BirpcReturn } from "birpc";
 //#region src/client/connection.d.ts
-interface DevframeConnection {
+export interface DevframeConnection {
   /** Server-advertised transport and serialization metadata. */
   connectionMeta: ConnectionMeta;
   /**
@@ -17,7 +17,7 @@ interface DevframeConnection {
   /** Previously issued bearer token, when the connection is already trusted. */
   authToken?: string;
 }
-interface SetupDevframeConnectionOptions {
+export interface SetupDevframeConnectionOptions {
   /** Reuse a complete connection prepared in another viewer or JavaScript realm. */
   connection?: DevframeConnection;
   /** Use a pre-known descriptor while deriving its source URL from `baseURL`. */
@@ -32,18 +32,18 @@ interface SetupDevframeConnectionOptions {
  * the Devframe host. Returns `false` if the host did not provide an origin
  * registration token.
  */
-declare function registerDevframeViewerOrigin(connection: DevframeConnection, origin?: any): Promise<boolean>;
+export declare function registerDevframeViewerOrigin(connection: DevframeConnection, origin?: any): Promise<boolean>;
 /**
  * Return connection information previously prepared in this window or an
  * accessible parent window.
  */
-declare function getDevframeConnection(): DevframeConnection | undefined;
+export declare function getDevframeConnection(): DevframeConnection | undefined;
 /**
  * Prepare the connection information shared by a devframe client and external
  * viewers. Reuses an explicit or previously prepared connection before
  * fetching `__connection.json` from the configured base URLs.
  */
-declare function setupDevframeConnection(options?: SetupDevframeConnectionOptions): Promise<DevframeConnection>;
+export declare function setupDevframeConnection(options?: SetupDevframeConnectionOptions): Promise<DevframeConnection>;
 /**
  * The connection lifecycle of a devframe client, as a single value a UI can
  * render from. Derived from the transport (WebSocket open/close/error) and the
@@ -64,21 +64,21 @@ declare function setupDevframeConnection(options?: SetupDevframeConnectionOption
  * A `static` backend has no live socket, so it reports `connected` for its
  * whole life.
  */
-type DevframeConnectionStatus = 'connecting' | 'connected' | 'unauthorized' | 'disconnected' | 'error';
+export type DevframeConnectionStatus = 'connecting' | 'connected' | 'unauthorized' | 'disconnected' | 'error';
 /**
  * What kind of failure a {@link DevframeConnectionError} describes:
  * - `connection`: the transport dropped, errored, or never opened.
  * - `auth`: the server rejected trust for this client.
  * - `timeout`: a call exceeded its {@link DevframeRpcClientOptions.callTimeout}.
  */
-type DevframeConnectionErrorKind = 'connection' | 'auth' | 'timeout';
+export type DevframeConnectionErrorKind = 'connection' | 'auth' | 'timeout';
 /**
  * The error rejected from `rpc.call(...)` (and carried on
  * `rpc.connectionError`) when a call cannot be served because the connection is
  * down, the client is unauthorized, or a call timed out. Its `kind` lets a UI
  * tailor its message and recovery affordance without string-matching.
  */
-declare class DevframeConnectionError extends Error {
+export declare class DevframeConnectionError extends Error {
   name: string;
   readonly kind: DevframeConnectionErrorKind;
   constructor(kind: DevframeConnectionErrorKind, message: string, options?: {
@@ -90,14 +90,14 @@ declare class DevframeConnectionError extends Error {
  * the transport queues outgoing calls until the socket opens; the terminal
  * failure states short-circuit calls so a stuck socket never hangs the UI.
  */
-declare function isCallableStatus(status: DevframeConnectionStatus): boolean;
+export declare function isCallableStatus(status: DevframeConnectionStatus): boolean;
 //#endregion
 //#region src/client/rpc-streaming.d.ts
-interface StreamingSubscribeOptions {
+export interface StreamingSubscribeOptions {
   /** Maximum buffered chunks before the oldest is dropped. Default 256. */
   highWaterMark?: number;
 }
-interface RpcStreamingClientHost {
+export interface RpcStreamingClientHost {
   /**
    * Subscribe to a server-side stream by channel + id. Returns a reader
    * that's both an `AsyncIterable<T>` (`for await`) and exposes
@@ -120,7 +120,7 @@ interface RpcStreamingClientHost {
  * registers the two `:chunk` / `:end` event handlers once, then per-stream
  * state lives in a `Map<streamKey, StreamReader>`.
  */
-declare function createRpcStreamingClientHost(rpc: DevframeRpcClient): RpcStreamingClientHost;
+export declare function createRpcStreamingClientHost(rpc: DevframeRpcClient): RpcStreamingClientHost;
 //#endregion
 //#region src/client/scope.d.ts
 type AnyRpcFn = (...args: any[]) => any;
@@ -128,7 +128,7 @@ type AnyRpcFn = (...args: any[]) => any;
  * Client-side streaming host scoped to a namespace. Channel names are
  * auto-prefixed with `<namespace>:`.
  */
-interface DevframeScopedClientStreamingHost {
+export interface DevframeScopedClientStreamingHost {
   subscribe: <T = unknown>(channel: string, id: string, options?: StreamingSubscribeOptions) => StreamReader<T>;
   upload: <T = unknown>(channel: string, id: string) => StreamSink<T>;
 }
@@ -137,7 +137,7 @@ interface DevframeScopedClientStreamingHost {
  * `client.scope('my-plugin').rpc`. IDs and keys you pass are
  * auto-namespaced with `my-plugin:`.
  */
-interface DevframeScopedClientRpc<NS extends string = string> {
+export interface DevframeScopedClientRpc<NS extends string = string> {
   /** The namespace this surface is scoped to. */
   readonly namespace: NS;
   /**
@@ -176,7 +176,7 @@ interface DevframeScopedClientRpc<NS extends string = string> {
  * `client.scope('my-plugin')`. Replaces `rpc` with the auto-namespaced
  * surface and adds a top-level `settings` store.
  */
-interface DevframeScopedClientContext<NS extends string = string, Settings extends Record<string, any> = Record<string, any>> {
+export interface DevframeScopedClientContext<NS extends string = string, Settings extends Record<string, any> = Record<string, any>> {
   /** The namespace this context is scoped to. */
   readonly namespace: NS;
   /** The underlying unscoped client. */
@@ -195,7 +195,7 @@ interface DevframeScopedClientContext<NS extends string = string, Settings exten
  * id, shared-state key, and streaming channel passed through the returned
  * `rpc` surface is auto-namespaced with `<namespace>:`.
  */
-declare function createScopedClientContext<NS extends string = string>(rpc: DevframeRpcClient, namespace: NS): DevframeScopedClientContext<NS>;
+export declare function createScopedClientContext<NS extends string = string>(rpc: DevframeRpcClient, namespace: NS): DevframeScopedClientContext<NS>;
 //#endregion
 //#region src/client/rpc-services.d.ts
 /**
@@ -237,14 +237,14 @@ interface DevframeServicesClient {
 }
 //#endregion
 //#region src/client/rpc.d.ts
-interface DevframeRpcContext {
+export interface DevframeRpcContext {
   /**
    * The RPC client to interact with the server
    */
   readonly rpc: DevframeRpcClient;
 }
-type DevframeClientRpcHost = RpcFunctionsCollector<DevframeRpcClientFunctions, DevframeRpcContext>;
-interface RpcClientEvents {
+export type DevframeClientRpcHost = RpcFunctionsCollector<DevframeRpcClientFunctions, DevframeRpcContext>;
+export interface RpcClientEvents {
   'rpc:is-trusted:updated': (isTrusted: boolean) => void;
   /**
    * The connection status changed. Carries the new status and the previous one
@@ -262,7 +262,7 @@ interface RpcClientEvents {
    */
   'rpc:error': (error: Error, method: string) => void;
 }
-interface DevframeRpcClientOptions extends SetupDevframeConnectionOptions {
+export interface DevframeRpcClientOptions extends SetupDevframeConnectionOptions {
   /**
    * The auth token to use for the client
    */
@@ -311,6 +311,18 @@ interface DevframeRpcClientOptions extends SetupDevframeConnectionOptions {
   sseOptions?: Partial<SseRpcChannelOptions>;
   rpcOptions?: Partial<BirpcOptions<DevframeRpcServerFunctions, DevframeRpcClientFunctions, boolean>>;
   cacheOptions?: boolean | Partial<RpcCacheOptions>;
+  /**
+   * Mirror `agent`-flagged client RPC functions (functions registered on
+   * `rpc.client` with an `agent` field) onto the page's WebMCP model
+   * context (`document.modelContext` / `navigator.modelContext`) as
+   * callable tools, so in-page and browser-integrated agents can invoke
+   * them; see `registerWebMcpTools`. Applies only when the browser
+   * provides a model context. Set `false` to keep the browser side off
+   * the WebMCP surface.
+   *
+   * @default true
+   */
+  webmcp?: boolean;
   /**
    * Reject a pending `rpc.call(...)` if the server hasn't answered within this
    * many milliseconds, with a {@link DevframeConnectionError} of kind
@@ -320,10 +332,10 @@ interface DevframeRpcClientOptions extends SetupDevframeConnectionOptions {
    */
   callTimeout?: number;
 }
-type DevframeRpcClientCall = BirpcReturn<DevframeRpcServerFunctions, DevframeRpcClientFunctions>['$call'];
-type DevframeRpcClientCallEvent = BirpcReturn<DevframeRpcServerFunctions, DevframeRpcClientFunctions>['$callEvent'];
-type DevframeRpcClientCallOptional = BirpcReturn<DevframeRpcServerFunctions, DevframeRpcClientFunctions>['$callOptional'];
-interface DevframeRpcClient {
+export type DevframeRpcClientCall = BirpcReturn<DevframeRpcServerFunctions, DevframeRpcClientFunctions>['$call'];
+export type DevframeRpcClientCallEvent = BirpcReturn<DevframeRpcServerFunctions, DevframeRpcClientFunctions>['$callEvent'];
+export type DevframeRpcClientCallOptional = BirpcReturn<DevframeRpcServerFunctions, DevframeRpcClientFunctions>['$callOptional'];
+export interface DevframeRpcClient {
   /**
    * The events of the client
    */
@@ -382,6 +394,15 @@ interface DevframeRpcClient {
    * authenticated.
    */
   requestTrustWithCode: (code: string) => Promise<boolean>;
+  /**
+   * Ask the server to print its one-time code banner in the terminal, e.g.
+   * when a custom auth UI is shown. Pass `reissue: true` to rotate the code
+   * first (a "re-issue" button), guaranteeing a freshly-valid code; without
+   * it the server prints each code at most once.
+   */
+  requestAuthCode: (options?: {
+    reissue?: boolean;
+  }) => Promise<void>;
   /**
    * Call a RPC function on the server
    */
@@ -446,7 +467,7 @@ interface DevframeRpcClient {
    */
   close?: () => void;
 }
-interface DevframeRpcClientMode {
+export interface DevframeRpcClientMode {
   /**
    * The transport this mode speaks. Optional so a mode implemented before
    * this field existed (a custom transport, a hand-typed mock) still
@@ -464,6 +485,7 @@ interface DevframeRpcClientMode {
    * token on success (for the caller to persist), or `null` on failure.
    */
   requestTrustWithCode: (code: string) => Promise<string | null>;
+  requestAuthCode: DevframeRpcClient['requestAuthCode'];
   call: DevframeRpcClient['call'];
   callEvent: DevframeRpcClient['callEvent'];
   callOptional: DevframeRpcClient['callOptional'];
@@ -477,8 +499,8 @@ interface DevframeRpcClientMode {
  * present; an explicit `'websocket'` / `'sse'` pins that transport and
  * throws when the server doesn't advertise it.
  */
-declare function resolveClientTransport(requested: 'auto' | 'websocket' | 'sse', meta: ConnectionMeta): 'websocket' | 'sse' | 'static';
-declare function getDevframeRpcClient(options?: DevframeRpcClientOptions): Promise<DevframeRpcClient>;
+export declare function resolveClientTransport(requested: 'auto' | 'websocket' | 'sse', meta: ConnectionMeta): 'websocket' | 'sse' | 'static';
+export declare function getDevframeRpcClient(options?: DevframeRpcClientOptions): Promise<DevframeRpcClient>;
 //#endregion
 //#region src/client/otp.d.ts
 /**
@@ -486,14 +508,14 @@ declare function getDevframeRpcClient(options?: DevframeRpcClientOptions): Promi
  * fragment, without side effects. Returns `undefined` when the parameter is
  * absent.
  */
-declare function readOtpFromUrl(param?: string): string | undefined;
+export declare function readOtpFromUrl(param?: string): string | undefined;
 /**
  * Read the one-time code from the page URL fragment and remove it from the
  * address bar (and the current history entry), so the single-use code isn't
  * left in the URL, browser history, or a `Referer`. Returns the code, or
  * `undefined` when absent.
  */
-declare function consumeOtpFromUrl(param?: string): string | undefined;
+export declare function consumeOtpFromUrl(param?: string): string | undefined;
 /**
  * Consume a one-time code from the page URL (see {@link consumeOtpFromUrl}) and
  * exchange it for a token via the client. Resolves `true` when the client is
@@ -504,7 +526,7 @@ declare function consumeOtpFromUrl(param?: string): string | undefined;
  * authentication UI can disable `connectDevframe`'s built-in handling with
  * `otpParam: false` and call this (or {@link consumeOtpFromUrl}) themselves.
  */
-declare function authenticateWithUrlOtp(rpc: Pick<DevframeRpcClient, 'isTrusted' | 'requestTrustWithCode'>, options?: {
+export declare function authenticateWithUrlOtp(rpc: Pick<DevframeRpcClient, 'isTrusted' | 'requestTrustWithCode'>, options?: {
   param?: string;
 }): Promise<boolean>;
 //#endregion
@@ -528,7 +550,7 @@ interface WsUrlLocation {
  * `port`/`host` (or a full `ws(s)://` URL string) opts into a cross-origin
  * endpoint, e.g. a side-car server on its own port.
  */
-declare function resolveWsUrl(websocket: ConnectionMeta['websocket'], metaBaseUrl: string, loc: WsUrlLocation): string;
+export declare function resolveWsUrl(websocket: ConnectionMeta['websocket'], metaBaseUrl: string, loc: WsUrlLocation): string;
 //#endregion
 //#region src/client/rpc-sse.d.ts
 /**
@@ -539,16 +561,102 @@ declare function resolveWsUrl(websocket: ConnectionMeta['websocket'], metaBaseUr
  * hostname), while an explicit `port`/`host` (or a full `http(s)://` URL
  * string) opts into a cross-origin endpoint.
  */
-declare function resolveSseUrl(sse: ConnectionMeta['sse'], metaBaseUrl: string, loc: WsUrlLocation): string;
+export declare function resolveSseUrl(sse: ConnectionMeta['sse'], metaBaseUrl: string, loc: WsUrlLocation): string;
 //#endregion
 //#region src/client/settings.d.ts
 /**
  * Build the client-side `settings` surface for a scope namespace. Mirrors
  * the node-side stores over the shared-state sync protocol.
  */
-declare function createClientSettings<T extends Record<string, any> = Record<string, any>>(rpc: DevframeRpcClient, namespace: string): DevframeSettings<T>;
+export declare function createClientSettings<T extends Record<string, any> = Record<string, any>>(rpc: DevframeRpcClient, namespace: string): DevframeSettings<T>;
+//#endregion
+//#region src/client/webmcp.d.ts
+/**
+ * Result a WebMCP tool's `execute` resolves with; mirrors the MCP
+ * `CallToolResult` text shape the [WebMCP](https://github.com/webmachinelearning/webmcp)
+ * proposal adopts.
+ */
+export interface WebMcpToolResult {
+  content: {
+    type: 'text';
+    text: string;
+  }[];
+  isError?: boolean;
+}
+/** A tool descriptor as passed to {@link WebMcpModelContext.registerTool}. */
+export interface WebMcpToolDescriptor {
+  name: string;
+  description: string;
+  inputSchema?: unknown;
+  annotations?: {
+    title?: string;
+    readOnlyHint?: boolean;
+    destructiveHint?: boolean;
+  };
+  execute: (args: Record<string, unknown>) => Promise<WebMcpToolResult>;
+}
+/**
+ * A tool as reported by {@link WebMcpModelContext.getTools}: the
+ * serializable descriptor fields plus the registering `origin`. The
+ * browser may attach more members (e.g. the owner `window`); pass the
+ * object through unchanged to {@link WebMcpModelContext.executeTool}.
+ */
+export interface WebMcpRegisteredTool {
+  name: string;
+  description?: string;
+  inputSchema?: unknown;
+  origin?: string;
+}
+/**
+ * Structural subset of the experimental WebMCP model context
+ * (`document.modelContext` / `navigator.modelContext`). The current draft
+ * unregisters a tool by aborting the passed `AbortSignal` and returns a
+ * promise; earlier drafts returned a handle with `unregister()`. Typed to
+ * accept both generations. `getTools` / `executeTool` are the draft's
+ * discovery/execution surface for in-page agents; absent on older drafts.
+ */
+export interface WebMcpModelContext {
+  registerTool: (tool: WebMcpToolDescriptor, options?: {
+    signal?: AbortSignal;
+  }) => void | {
+    unregister?: () => void;
+  } | Promise<unknown>;
+  getTools?: (options?: {
+    fromOrigins?: string[];
+  }) => Promise<WebMcpRegisteredTool[]>;
+  /**
+   * The spec draft takes the args as a dictionary; Chromium's current
+   * build takes (and returns) JSON strings instead, hence the union.
+   */
+  executeTool?: (tool: WebMcpRegisteredTool, args: Record<string, unknown> | string, options?: {
+    signal?: AbortSignal;
+  }) => Promise<unknown>;
+}
+/**
+ * The page's WebMCP model context, when the browser (or a polyfill)
+ * provides one. Checks `document.modelContext` (current draft) first,
+ * then `navigator.modelContext` (earlier drafts and polyfills).
+ */
+export declare function resolveWebMcpModelContext(): WebMcpModelContext | undefined;
+export interface RegisterWebMcpToolsOptions {
+  /**
+   * Model context to register tools on. Defaults to the one the page
+   * provides (see {@link resolveWebMcpModelContext}); when neither is
+   * given, registration is a no-op.
+   */
+  modelContext?: WebMcpModelContext;
+}
+/**
+ * Mirror the `agent`-flagged RPC functions of a browser-side collector
+ * (`rpc.client`) onto the page's WebMCP model context as callable tools,
+ * using the same `agent` signature, wire names, and `arg0`/`arg1`/… input
+ * schema as the node-side MCP adapter. Functions without an `agent` field
+ * stay unexposed (default-deny), and the tool set follows later
+ * `register`/`update` calls. Returns a dispose that unregisters every tool.
+ */
+export declare function registerWebMcpTools<LocalFunctions, SetupContext>(clientRpc: RpcFunctionsCollector<LocalFunctions, SetupContext>, options?: RegisterWebMcpToolsOptions): () => void;
 //#endregion
 //#region src/client/index.d.ts
-declare const connectDevframe: typeof getDevframeRpcClient;
+export declare const connectDevframe: typeof getDevframeRpcClient;
 //#endregion
-export { DevframeClientRpcHost, DevframeConnection, DevframeConnectionError, DevframeConnectionErrorKind, DevframeConnectionStatus, DevframeRpcClient, DevframeRpcClientCall, DevframeRpcClientCallEvent, DevframeRpcClientCallOptional, DevframeRpcClientMode, DevframeRpcClientOptions, DevframeRpcContext, DevframeScopedClientContext, DevframeScopedClientRpc, DevframeScopedClientStreamingHost, type DevframeServiceClientHandle, type DevframeServicesClient, RpcClientEvents, RpcStreamingClientHost, SetupDevframeConnectionOptions, StreamingSubscribeOptions, type WsUrlLocation, authenticateWithUrlOtp, connectDevframe, consumeOtpFromUrl, createClientSettings, createRpcStreamingClientHost, createScopedClientContext, getDevframeConnection, getDevframeRpcClient, isCallableStatus, readOtpFromUrl, registerDevframeViewerOrigin, resolveClientTransport, resolveSseUrl, resolveWsUrl, setupDevframeConnection };
+export type { DevframeServiceClientHandle, DevframeServicesClient, WsUrlLocation };