devframe 0.9.12 → 0.9.14

package/dist/client/index.mjs

@@ -1,12 +1,10 @@
-import { t as DEVFRAME_EVENTS } from "../events-BV4Dj59a.mjs";
+import { n as DEVFRAME_EVENTS, t as defineDiagnostics } from "../nostics-DD6gsDZA.mjs";
 import { t as hash } from "../hash-DdPnc4k3.mjs";
-import { colors } from "../utils/colors.mjs";
 import { createEventEmitter } from "../utils/events.mjs";
-import { t as createSharedState } from "../shared-state-CaxB1q0h.mjs";
+import { t as createSharedState } from "../shared-state-eQVYHNqA.mjs";
 import { i as structuredCloneStringify, n as structuredCloneParse, t as structuredCloneDeserialize } from "../structured-clone-CgtQ61SA.mjs";
 import { createStreamReader, createStreamSink } from "../utils/streaming-channel.mjs";
-import { defineDiagnostics } from "nostics";
-import { ansiFormatter } from "nostics/formatters/ansi";
+import { toAgentToolName } from "../utils/agent-tool-name.mjs";
 import { withBase, withProtocol } from "ufo";
 import { createBirpc } from "birpc";
 //#region src/constants.ts
@@ -96,34 +94,8 @@ var RpcCacheManager = class {
 	}
 };
 //#endregion
-//#region src/utils/nostics.ts
-const formatAnsi = ansiFormatter(colors);
-/**
-* The reporter every {@link defineDiagnostics} call below wires in ahead of
-* any caller-supplied ones: prints the diagnostic through devframe's own
-* ANSI colors via `console[method]` (default `'warn'`).
-*/
-function devframeReporter(d, { method = "warn" } = {}) {
-	console[method](formatAnsi(d));
-}
-/**
-* Drop-in replacement for `nostics`'s `defineDiagnostics()` with devframe's
-* ANSI console reporter pre-wired ahead of any `reporters` passed in. Every
-* `diagnostics.ts` in devframe core, `@devframes/hub`, `@devframes/json-render`,
-* and the built-in plugins defines its codes through this instead of
-* `nostics`'s own `defineDiagnostics`; the reporter registration lives
-* here, once, so none of them need to build their own reporter (`colors`,
-* `ansiFormatter`) or take a direct dependency on `nostics` themselves.
-*/
-function defineDiagnostics$1(options) {
-	return defineDiagnostics({
-		...options,
-		reporters: [devframeReporter, ...options.reporters ?? []]
-	});
-}
-//#endregion
 //#region src/rpc/diagnostics.ts
-const diagnostics = defineDiagnostics$1({
+const diagnostics = defineDiagnostics({
 	docsBase: "https://devfra.me/errors",
 	codes: {
 		DF0019: {
@@ -1103,6 +1075,13 @@ function createLiveRpcClientMode(options) {
 		}
 		return token;
 	}
+	async function requestAuthCode(options = {}) {
+		await serverRpc.$call("anonymous:devframe:auth:request-code", {
+			ua: navigator.userAgent,
+			origin: location.origin,
+			...options.reissue ? { reissue: true } : {}
+		});
+	}
 	async function requestTrust() {
 		if (isTrusted) return true;
 		return requestTrustWithToken(currentAuthToken ?? "");
@@ -1133,6 +1112,7 @@ function createLiveRpcClientMode(options) {
 		requestTrust,
 		requestTrustWithToken,
 		requestTrustWithCode,
+		requestAuthCode,
 		ensureTrusted,
 		call: (...args) => {
 			const method = String(args[0]);
@@ -1333,6 +1313,8 @@ async function createStaticRpcClientMode(options) {
 		requestTrustWithToken: async () => true,
 		/** Static backends are always trusted, so there's nothing to exchange. */
 		requestTrustWithCode: async () => null,
+		/** No server terminal to print a code in. */
+		requestAuthCode: async () => {},
 		ensureTrusted: async () => true,
 		call: (...args) => staticCaller.call(args[0], args.slice(1)),
 		callEvent: (...args) => staticCaller.callEvent(args[0], args.slice(1)),
@@ -1675,6 +1657,207 @@ function createScopedClientContext(rpc, namespace) {
 	};
 }
 //#endregion
+//#region src/adapters/mcp/to-json-schema.ts
+const FALLBACK_OBJECT_SCHEMA = Object.freeze({
+	type: "object",
+	additionalProperties: true
+});
+/**
+* Convert a Standard Schema to JSON Schema for the agent/MCP surface.
+*
+* Devframe stays validator-neutral, so conversion uses the schema's own
+* [Standard JSON Schema](https://standardschema.dev/) converter
+* (`~standard.jsonSchema`) when the validator provides one; zod 4 does,
+* for example. Validators without a native converter (e.g. valibot) degrade
+* to a permissive object schema rather than pulling in a converter library.
+*/
+function safeToJsonSchema(schema) {
+	const standard = schema["~standard"];
+	if (standard.jsonSchema) try {
+		return standard.jsonSchema.input({ target: "draft-2020-12" });
+	} catch {
+		return FALLBACK_OBJECT_SCHEMA;
+	}
+	return FALLBACK_OBJECT_SCHEMA;
+}
+/**
+* JSON Schema for an RPC function's positional args on the agent/MCP
+* surface. Each positional arg is advertised under `arg0` / `arg1` / …,
+* matching how the agent bridge coerces the incoming object payload back
+* into positional arguments.
+*
+* Returns `{ type: 'object', properties: {} }` when there are no args.
+* @internal
+*/
+function argsToJsonSchema(args) {
+	if (!args || args.length === 0) return {
+		type: "object",
+		properties: {}
+	};
+	const properties = {};
+	const required = [];
+	for (let i = 0; i < args.length; i++) {
+		const key = `arg${i}`;
+		properties[key] = safeToJsonSchema(args[i]);
+		required.push(key);
+	}
+	return {
+		type: "object",
+		properties,
+		required,
+		additionalProperties: false
+	};
+}
+//#endregion
+//#region src/node/agent-args.ts
+/**
+* Map the args payload an agent surface receives (MCP sends an object
+* keyed `arg0`/`arg1`/…, matching the schema the adapter advertises) onto
+* a handler's positional parameters. Shared by the agent host's RPC
+* bridge and the hub's command-derived tools so the coercion cannot
+* drift between them.
+*
+* - an array passes through as-is
+* - `null`/`undefined` become a zero-argument call
+* - with declared schemas, each schema reads its own `argN` key, in order
+* - without schemas, `arg0`/`arg1`/… keys are collected when present
+* - an empty object becomes a zero-argument call
+* - anything else follows the {@link AgentArgsFallback}
+*/
+function coerceAgentPositionalArgs(args, schemas, fallback = "wrap") {
+	if (Array.isArray(args)) return args;
+	if (args === void 0 || args === null) return [];
+	if (typeof args === "object") {
+		const obj = args;
+		if (schemas && schemas.length) return schemas.map((_, i) => obj[`arg${i}`]);
+		if ("arg0" in obj) {
+			const out = [];
+			let i = 0;
+			while (`arg${i}` in obj) {
+				out.push(obj[`arg${i}`]);
+				i++;
+			}
+			return out;
+		}
+		if (Object.keys(obj).length === 0) return [];
+	}
+	return fallback === "drop" ? [] : [args];
+}
+//#endregion
+//#region src/client/webmcp.ts
+/**
+* The page's WebMCP model context, when the browser (or a polyfill)
+* provides one. Checks `document.modelContext` (current draft) first,
+* then `navigator.modelContext` (earlier drafts and polyfills).
+*/
+function resolveWebMcpModelContext() {
+	if (typeof document !== "undefined") {
+		const context = document.modelContext;
+		if (context) return context;
+	}
+	if (typeof navigator !== "undefined") {
+		const context = navigator.modelContext;
+		if (context) return context;
+	}
+}
+/**
+* Mirror the `agent`-flagged RPC functions of a browser-side collector
+* (`rpc.client`) onto the page's WebMCP model context as callable tools,
+* using the same `agent` signature, wire names, and `arg0`/`arg1`/… input
+* schema as the node-side MCP adapter. Functions without an `agent` field
+* stay unexposed (default-deny), and the tool set follows later
+* `register`/`update` calls. Returns a dispose that unregisters every tool.
+*/
+function registerWebMcpTools(clientRpc, options = {}) {
+	const resolved = options.modelContext ?? resolveWebMcpModelContext();
+	if (!resolved) return () => {};
+	const modelContext = resolved;
+	/** Unregister callbacks keyed by definition name. */
+	const registered = /* @__PURE__ */ new Map();
+	/** Wire name → definition name, to detect sanitization collisions. */
+	const wireNames = /* @__PURE__ */ new Map();
+	function register(def, agent) {
+		const name = toAgentToolName(def.name);
+		const owner = wireNames.get(name);
+		if (owner && owner !== def.name) {
+			console.warn(`[devframe] WebMCP tool name "${name}" (from "${def.name}") collides with "${owner}"; keeping the first registration.`);
+			return;
+		}
+		const controller = new AbortController();
+		const result = modelContext.registerTool({
+			name,
+			description: agent.description,
+			inputSchema: argsToJsonSchema(def.args),
+			annotations: {
+				title: agent.title ?? def.name,
+				readOnlyHint: resolveSafety(def, agent) === "read",
+				destructiveHint: resolveSafety(def, agent) === "destructive"
+			},
+			execute: (args) => executeRpcTool(def, clientRpc.context, args)
+		}, { signal: controller.signal });
+		if (result && "then" in result) result.then(() => {}, () => {});
+		wireNames.set(name, def.name);
+		registered.set(def.name, () => {
+			controller.abort();
+			if (result && "unregister" in result && typeof result.unregister === "function") result.unregister();
+			wireNames.delete(name);
+		});
+	}
+	function sync(id) {
+		const names = id ? [id] : [...clientRpc.definitions.keys()];
+		for (const name of names) {
+			registered.get(name)?.();
+			registered.delete(name);
+			const def = clientRpc.definitions.get(name);
+			const agent = def?.agent;
+			if (def && agent) register(def, agent);
+		}
+	}
+	sync();
+	const unsubscribe = clientRpc.onChanged((id) => sync(id));
+	return () => {
+		unsubscribe();
+		for (const unregister of registered.values()) unregister();
+		registered.clear();
+	};
+}
+function resolveSafety(def, agent) {
+	if (agent.safety) return agent.safety;
+	const type = def.type ?? "query";
+	return type === "static" || type === "query" ? "read" : "action";
+}
+async function executeRpcTool(def, context, args) {
+	try {
+		const positional = coerceAgentPositionalArgs(args, def.args, "wrap");
+		return { content: [{
+			type: "text",
+			text: stringifyResult(await (await getRpcHandler(def, context))(...positional))
+		}] };
+	} catch (error) {
+		return {
+			isError: true,
+			content: [{
+				type: "text",
+				text: formatError(error)
+			}]
+		};
+	}
+}
+/**
+* Agent-exposed functions are strict-JSON by contract (`jsonSerializable:
+* true` is enforced at registration), so plain `JSON.stringify` suffices.
+*/
+function stringifyResult(value) {
+	if (value === void 0) return "undefined";
+	if (typeof value === "string") return value;
+	return JSON.stringify(value, null, 2);
+}
+function formatError(error) {
+	if (!(error instanceof Error)) return String(error);
+	const cause = error.cause instanceof Error ? ` (cause: ${error.cause.message})` : "";
+	return `${error.name}: ${error.message}${cause}`;
+}
+//#endregion
 //#region src/client/rpc.ts
 /**
 * Resolve the requested `transport` option against what the server
@@ -1716,6 +1899,7 @@ async function getDevframeRpcClient(options = {}) {
 	});
 	const context = { rpc: void 0 };
 	const clientRpc = new RpcFunctionsCollectorBase(context);
+	const disposeWebMcp = options.webmcp === false ? void 0 : registerWebMcpTools(clientRpc);
 	async function fetchJsonFromBases(path) {
 		const candidates = [resolvedBaseURL, ...bases.filter((base) => base !== resolvedBaseURL)].filter((x) => x != null);
 		const errors = [];
@@ -1812,6 +1996,7 @@ async function getDevframeRpcClient(options = {}) {
 			} catch {}
 			return true;
 		},
+		requestAuthCode: (options) => mode.requestAuthCode(options),
 		call: gateOnBootstrapAuth(mode.call),
 		callEvent: gateOnBootstrapAuth(mode.callEvent),
 		callOptional: gateOnBootstrapAuth(mode.callOptional),
@@ -1821,7 +2006,10 @@ async function getDevframeRpcClient(options = {}) {
 		streaming: void 0,
 		cacheManager,
 		scope: void 0,
-		close: () => mode.close?.()
+		close: () => {
+			disposeWebMcp?.();
+			mode.close?.();
+		}
 	};
 	rpc.sharedState = createRpcSharedStateClientHost(rpc);
 	rpc.streaming = createRpcStreamingClientHost(rpc);
@@ -1847,6 +2035,7 @@ async function getDevframeRpcClient(options = {}) {
 	async function runSimpleAuthPrompt() {
 		if (options.simpleAuth === false || !isTopLevelUnframed()) return;
 		if (typeof globalThis.prompt !== "function") return;
+		await rpc.requestAuthCode().catch(() => {});
 		while (!rpc.isTrusted) {
 			const code = globalThis.prompt("devframe: enter the authentication code shown in your terminal");
 			if (code == null) return;
@@ -1876,4 +2065,4 @@ async function getDevframeRpcClient(options = {}) {
 //#region src/client/index.ts
 const connectDevframe = getDevframeRpcClient;
 //#endregion
-export { DevframeConnectionError, authenticateWithUrlOtp, connectDevframe, consumeOtpFromUrl, createClientSettings, createRpcStreamingClientHost, createScopedClientContext, getDevframeConnection, getDevframeRpcClient, isCallableStatus, readOtpFromUrl, registerDevframeViewerOrigin, resolveClientTransport, resolveSseUrl, resolveWsUrl, setupDevframeConnection };
+export { DevframeConnectionError, authenticateWithUrlOtp, connectDevframe, consumeOtpFromUrl, createClientSettings, createRpcStreamingClientHost, createScopedClientContext, getDevframeConnection, getDevframeRpcClient, isCallableStatus, readOtpFromUrl, registerDevframeViewerOrigin, registerWebMcpTools, resolveClientTransport, resolveSseUrl, resolveWebMcpModelContext, resolveWsUrl, setupDevframeConnection };

package/dist/constants.d.mts

@@ -22,7 +22,7 @@
  * keys (a literal is unavoidable in a type position); those declarations mirror
  * this map and move with it.
  */
-declare const DEVFRAME_EVENTS: {
+export declare const DEVFRAME_EVENTS: {
   /**
    * Node-side host `EventEmitter` events. The agent host (`ctx.agent.events`)
    * emits these as its tool/resource surface changes; protocol adapters (e.g.
@@ -78,13 +78,13 @@ declare const DEVFRAME_EVENTS: {
 //#endregion
 //#region src/constants.d.ts
 /** Devframe runtime routes and static output conventions. */
-declare const DEVFRAME_CONNECTION_META_FILENAME = "__connection.json";
+export declare const DEVFRAME_CONNECTION_META_FILENAME = "__connection.json";
 /**
  * Global key holding the serializable connection prepared by
  * `setupDevframeConnection()`. External viewers can use this key to read the
  * connection from another JavaScript realm.
  */
-declare const DEVFRAME_CONNECTION_KEY = "__DEVFRAME_CONNECTION__";
+export declare const DEVFRAME_CONNECTION_KEY = "__DEVFRAME_CONNECTION__";
 /**
  * Route the WebSocket RPC endpoint is bound to, relative to a devframe's
  * base path. Sits next to `__connection.json` so the deployed SPA can reach
@@ -92,7 +92,7 @@ declare const DEVFRAME_CONNECTION_KEY = "__DEVFRAME_CONNECTION__";
  * both HTTP and WS, and a host server (Vite, etc.) can mount the WS upgrade
  * handler here without colliding with its own routes (HMR, asset serving).
  */
-declare const DEVFRAME_WS_ROUTE = "__ws";
+export declare const DEVFRAME_WS_ROUTE = "__ws";
 /**
  * Route the SSE RPC endpoint is bound to, relative to a devframe's base
  * path. A single method-dispatched route: `GET` opens the event stream
@@ -101,36 +101,36 @@ declare const DEVFRAME_WS_ROUTE = "__ws";
  * loaded from; the transport for hosts and proxies where the WebSocket
  * upgrade isn't available.
  */
-declare const DEVFRAME_SSE_ROUTE = "__sse";
+export declare const DEVFRAME_SSE_ROUTE = "__sse";
 /**
  * Request header carrying the SSE session id on every RPC `POST`. The
  * server mints the id as the stream's first event (`event: session`);
  * the client echoes it here so the POST joins that stream's birpc
  * channel. Mirrors birpc's own SSE helpers for wire compatibility.
  */
-declare const DEVFRAME_SSE_SESSION_HEADER = "x-birpc-session";
+export declare const DEVFRAME_SSE_SESSION_HEADER = "x-birpc-session";
 /**
  * Route the Streamable-HTTP MCP endpoint is bound to, relative to a
  * devframe's base path. Sits next to `__connection.json` and the WS route
  * so an MCP client reaches it on the same origin the SPA loaded from; the
  * dev server shares one port for HTTP, WS, and MCP. Opt-in via `cli.mcp`.
  */
-declare const DEVFRAME_MCP_ROUTE = "__mcp";
-declare const DEVFRAME_RPC_DUMP_MANIFEST_FILENAME = "__rpc-dump/index.json";
-declare const DEVFRAME_DOCK_IMPORTS_FILENAME = "__client-imports.js";
-declare const DEVFRAME_RPC_DUMP_DIRNAME = "__rpc-dump";
+export declare const DEVFRAME_MCP_ROUTE = "__mcp";
+export declare const DEVFRAME_RPC_DUMP_MANIFEST_FILENAME = "__rpc-dump/index.json";
+export declare const DEVFRAME_DOCK_IMPORTS_FILENAME = "__client-imports.js";
+export declare const DEVFRAME_RPC_DUMP_DIRNAME = "__rpc-dump";
 /**
  * Shared-state key carrying the wire-service advertisements (package name →
  * `DevframeServiceMeta`). Written by the node services host; mirrored to
  * clients for feature-detection via `client.services`.
  */
-declare const DEVFRAME_SERVICES_STATE_KEY = "devframe:services";
+export declare const DEVFRAME_SERVICES_STATE_KEY = "devframe:services";
 /**
  * URL fragment / query parameter name carrying the remote dock
  * connection descriptor (defined as `RemoteConnectionInfo` in
  * `@vitejs/devtools-kit`) injected into remote-UI iframe dock URLs.
  */
-declare const REMOTE_CONNECTION_KEY = "devframe-remote-connection";
+export declare const REMOTE_CONNECTION_KEY = "devframe-remote-connection";
 /**
  * Page-URL **fragment** parameter carrying a one-time authentication code (OTP)
  * for "magic link" auth. A host can print a link like
@@ -141,7 +141,7 @@ declare const REMOTE_CONNECTION_KEY = "devframe-remote-connection";
  * (node) and the `authenticateWithUrlOtp` / `consumeOtpFromUrl` client utilities
  * (or `connectDevframe`'s `otpParam`).
  */
-declare const DEVFRAME_OTP_URL_PARAM = "devframe_otp";
+export declare const DEVFRAME_OTP_URL_PARAM = "devframe_otp";
 /**
  * WS upgrade-URL query parameter carrying a previously-issued bearer token.
  * Set by `createWsRpcChannel` (browser transport) whenever `authToken` is
@@ -149,11 +149,11 @@ declare const DEVFRAME_OTP_URL_PARAM = "devframe_otp";
  * `recipes/interactive-auth`'s `onConnect`) so a returning client can be
  * trusted before its own `anonymous:devframe:auth` handshake call arrives.
  */
-declare const DEVFRAME_AUTH_TOKEN_QUERY_PARAM = "devframe_auth_token";
+export declare const DEVFRAME_AUTH_TOKEN_QUERY_PARAM = "devframe_auth_token";
 /** External viewer origin requested during connection bootstrap. */
-declare const DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM = "devframe_viewer_origin";
+export declare const DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM = "devframe_viewer_origin";
 /** Token that authorizes an external viewer origin registration. */
-declare const DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM = "devframe_viewer_origin_token";
+export declare const DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM = "devframe_viewer_origin_token";
 /**
  * `postMessage` type the remote-assets fallback page posts to `window.parent`
  * on load. That page is what a devframe serves (with a 502) when its client
@@ -162,7 +162,7 @@ declare const DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM = "devframe_viewer_origin
  * (`@devframes/hub-ui` does, in its iframe view). Payload shape:
  * `RemoteAssetsErrorMessage` (`devframe/types`).
  */
-declare const DEVFRAME_REMOTE_ASSETS_ERROR_MESSAGE_TYPE: string;
+export declare const DEVFRAME_REMOTE_ASSETS_ERROR_MESSAGE_TYPE: string;
 /**
  * Prefix that marks an RPC method as callable before a connection is
  * trusted. This is the *only* rule the pre-trust gate applies; there is no
@@ -170,13 +170,12 @@ declare const DEVFRAME_REMOTE_ASSETS_ERROR_MESSAGE_TYPE: string;
  * before authentication must be named `anonymous:<rest>` (e.g.
  * `anonymous:devframe:auth`).
  */
-declare const ANONYMOUS_RPC_PREFIX = "anonymous:";
+export declare const ANONYMOUS_RPC_PREFIX = "anonymous:";
 /**
  * Whether `name` is callable before a connection is trusted, i.e. it starts
  * with {@link ANONYMOUS_RPC_PREFIX}. Used by the resolver gate in
  * the RPC server binding (via an `authorize` function) and by host adapters that
  * implement their own transport.
  */
-declare function isAnonymousRpcMethod(name: string): boolean;
-//#endregion
-export { ANONYMOUS_RPC_PREFIX, DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_CONNECTION_KEY, DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_EVENTS, DEVFRAME_MCP_ROUTE, DEVFRAME_OTP_URL_PARAM, DEVFRAME_REMOTE_ASSETS_ERROR_MESSAGE_TYPE, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME, DEVFRAME_SERVICES_STATE_KEY, DEVFRAME_SSE_ROUTE, DEVFRAME_SSE_SESSION_HEADER, DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM, DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM, DEVFRAME_WS_ROUTE, REMOTE_CONNECTION_KEY, isAnonymousRpcMethod };
+export declare function isAnonymousRpcMethod(name: string): boolean;
+//#endregion

package/dist/{context-BBWPLDHh.d.mts → context-B7411Bem.d.mts}

@@ -335,8 +335,9 @@ declare function parseCliFlags(schema: CliFlagsSchema, raw: Record<string, unkno
 interface DevframeAuthHandler {
   /**
    * `anonymous:devframe:auth` + `anonymous:devframe:auth:exchange` (the
-   * handshake) and `devframe:auth:revoke` (self-revoke); register these on
-   * the RPC host (e.g. `rpcHost.register(fn)` for each).
+   * handshake), `anonymous:devframe:auth:request-code` (client-requested
+   * banner print), and `devframe:auth:revoke` (self-revoke); register these
+   * on the RPC host (e.g. `rpcHost.register(fn)` for each).
    */
   rpcFunctions: RpcFunctionDefinitionAny[];
   /**
@@ -354,9 +355,11 @@ interface DevframeAuthHandler {
    */
   onConnect: (connection: DevframeRpcConnection, session: DevframeNodeRpcSession) => void;
   /**
-   * Print the current one-time code and its magic-link URL. Devframe stays
-   * headless, so call this yourself once the server is listening. Safe to
-   * call repeatedly; it only prints once per code.
+   * Print the current one-time code and its magic-link URL. An untrusted
+   * browser client triggers this itself over
+   * `anonymous:devframe:auth:request-code`; call it directly when the host
+   * wants the code on screen without waiting for a client. Safe to call
+   * repeatedly; it only prints once per code.
    */
   printBanner: () => void;
   /**
@@ -589,6 +592,23 @@ interface DevframeRpcServerFunctions {
   }) => Promise<{
     authToken: string | null;
   }>;
+  /**
+   * Ask the server to print its auth banner (code + magic link) for this
+   * client, e.g. when an auth UI first shows; `reissue: true` rotates the code
+   * first (the manual "re-issue" action). Registered by
+   * `recipes/interactive-auth`; a repeat request for an already-printed code
+   * is a no-op.
+   *
+   * Named with the `anonymous:` prefix (see `isAnonymousRpcMethod`) so it is
+   * reachable before the connection is trusted.
+   *
+   * @internal
+   */
+  'anonymous:devframe:auth:request-code': (params: {
+    ua: string;
+    origin: string;
+    reissue?: boolean;
+  }) => Promise<void>;
   /**
    * Self-revoke: the caller asks the server to revoke its own bearer token
    * (if any) and drop to untrusted. Requires an already-trusted caller, so

package/dist/{context-_temOGDB.d.mts → context-CIsx_QnV.d.mts}

@@ -1,4 +1,4 @@
-import { k as SharedState, o as DevframeNodeContext } from "./context-BBWPLDHh.mjs";
+import { k as SharedState, o as DevframeNodeContext } from "./context-B7411Bem.mjs";
 //#region src/node/hub-internals/context.d.ts
 interface InternalAnonymousAuthStorage {
   trusted: Record<string, {

package/dist/{context-DwGevWqT.mjs → context-Cdj9z9m2.mjs}

@@ -143,7 +143,11 @@ function createRpcSharedStateServerHost(rpc) {
 		name: "devframe:rpc:server-state:set",
 		type: "query",
 		handler: async (key, value, syncId) => {
-			(await host.get(key, { initialValue: value })).mutate(() => value, syncId);
+			(await host.get(key, { initialValue: value })).patch([{
+				op: "replace",
+				path: [],
+				value
+			}], syncId);
 		}
 	});
 	rpc.register({
@@ -192,7 +196,10 @@ function createStreamSink(options = {}) {
 				seq: lastSeq,
 				chunk
 			});
-			if (buffer.length > replayWindow) buffer.splice(0, buffer.length - replayWindow);
+			if (buffer.length > replayWindow) {
+				if (buffer.length - replayWindow === 1) buffer.shift();
+				else buffer.splice(0, buffer.length - replayWindow);
+			}
 		}
 		events.emit("chunk", lastSeq, chunk);
 	}

package/dist/{dev-CZ1fu4J1.mjs → dev-DpfkCVqo.mjs}

@@ -1,11 +1,11 @@
 import { t as resolveClientAssets } from "./client-assets-DNdhagGm.mjs";
 import { DEVFRAME_CONNECTION_META_FILENAME } from "./constants.mjs";
 import { t as diagnostics } from "./diagnostics-DZA6KQ_Z.mjs";
-import { t as createHostContext } from "./context-DwGevWqT.mjs";
+import { t as createHostContext } from "./context-Cdj9z9m2.mjs";
 import { t as resolveStaticAssetsSource } from "./remote-assets-DMFzLSoH.mjs";
 import { a as resolveMcpConfig, i as resolveDevServerPort, n as normalizeBasePath, r as resolveBasePath, s as importRuntimeModule, t as loadAutoMcpAdapter } from "./_shared-U8D-xzrp.mjs";
 import { t as createH3DevframeHost } from "./host-h3-BROI6SQ4.mjs";
-import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-xuu6jg51.mjs";
+import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-370Oee9K.mjs";
 import { open } from "./utils/open.mjs";
 import { mountStaticHandler } from "./utils/serve-static.mjs";
 import { resolve } from "pathe";