devframe 0.9.13 → 0.9.14

package/dist/{_shared-DEAMiPfH.d.mts → _shared-Bf2FcfJ4.d.mts}

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, G as McpAuthorization, I as DevframeDeploymentKind, q as McpSetting, t as ConnectionMeta, zt as DevframeAgentHost } from "./context-BBWPLDHh.mjs";
+import { F as DevframeDefinition, G as McpAuthorization, I as DevframeDeploymentKind, q as McpSetting, t as ConnectionMeta, zt as DevframeAgentHost } from "./context-B7411Bem.mjs";
 //#region src/adapters/_shared.d.ts
 /**
  * Resolve the mount base path for a devframe's SPA. Hosted adapters

package/dist/adapters/build.d.mts

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, V as DevframeSnapshotRpcEntry, o as DevframeNodeContext } from "../context-BBWPLDHh.mjs";
+import { F as DevframeDefinition, V as DevframeSnapshotRpcEntry, o as DevframeNodeContext } from "../context-B7411Bem.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
 //#region src/adapters/build.d.ts
 export interface CreateBuildOptions {

package/dist/adapters/cac.d.mts

@@ -1,4 +1,4 @@
-import { Dt as InferCliFlags, Et as CliFlagsSchema, F as DevframeDefinition, Ot as defineCliFlags, kt as parseCliFlags, q as McpSetting } from "../context-BBWPLDHh.mjs";
+import { Dt as InferCliFlags, Et as CliFlagsSchema, F as DevframeDefinition, Ot as defineCliFlags, kt as parseCliFlags, q as McpSetting } from "../context-B7411Bem.mjs";
 import { CAC } from "cac";
 import { H3 } from "h3";
 //#region src/adapters/cac.d.ts

package/dist/adapters/cac.mjs

@@ -1,7 +1,7 @@
 import { s as colors } from "../nostics-D0PvLZsn.mjs";
 import { i as resolveDevServerPort, s as importRuntimeModule } from "../_shared-U8D-xzrp.mjs";
 import { createBuild } from "./build.mjs";
-import { t as createDevServer } from "../dev-SPZzBTrH.mjs";
+import { t as createDevServer } from "../dev-DpfkCVqo.mjs";
 import process from "node:process";
 import cac$1 from "cac";
 //#region src/adapters/flags.ts

package/dist/adapters/dev.d.mts

@@ -1,8 +1,8 @@
 import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection, n as WsOriginRegistry } from "../ws-server-D2nv68Hg.mjs";
-import { F as DevframeDefinition, Tt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, q as McpSetting, s as DevframeNodeRpcSession } from "../context-BBWPLDHh.mjs";
+import { F as DevframeDefinition, Tt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, q as McpSetting, s as DevframeNodeRpcSession } from "../context-B7411Bem.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
-import { c as StartedServer } from "../instance-shell-BUyYrKlu.mjs";
-import { c as resolveMcpConnectionMeta, o as resolveDevServerPort, t as ResolveDevServerPortOptions } from "../_shared-DEAMiPfH.mjs";
+import { c as StartedServer } from "../instance-shell-B-FE8NY5.mjs";
+import { c as resolveMcpConnectionMeta, o as resolveDevServerPort, t as ResolveDevServerPortOptions } from "../_shared-Bf2FcfJ4.mjs";
 import { H3 } from "h3";
 //#region src/adapters/dev.d.ts
 export interface CreateDevServerOptions {

package/dist/adapters/dev.mjs

@@ -1,3 +1,3 @@
 import { i as resolveDevServerPort, o as resolveMcpConnectionMeta } from "../_shared-U8D-xzrp.mjs";
-import { t as createDevServer } from "../dev-SPZzBTrH.mjs";
+import { t as createDevServer } from "../dev-DpfkCVqo.mjs";
 export { createDevServer, resolveDevServerPort, resolveMcpConnectionMeta };

package/dist/adapters/embedded.d.mts

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, o as DevframeNodeContext } from "../context-BBWPLDHh.mjs";
+import { F as DevframeDefinition, o as DevframeNodeContext } from "../context-B7411Bem.mjs";
 //#region src/adapters/embedded.d.ts
 export interface CreateEmbeddedOptions {
   /** Target context the devframe is registered into. Required. */

package/dist/adapters/initiate.d.mts

@@ -1,7 +1,7 @@
 import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection, n as WsOriginRegistry } from "../ws-server-D2nv68Hg.mjs";
-import { F as DevframeDefinition, St as DevframeStorageScope, Tt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, o as DevframeNodeContext, q as McpSetting, s as DevframeNodeRpcSession, t as ConnectionMeta } from "../context-BBWPLDHh.mjs";
+import { F as DevframeDefinition, St as DevframeStorageScope, Tt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, o as DevframeNodeContext, q as McpSetting, s as DevframeNodeRpcSession, t as ConnectionMeta } from "../context-B7411Bem.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
-import { c as StartedServer, f as DevframeInstanceRecord } from "../instance-shell-BUyYrKlu.mjs";
+import { c as StartedServer, f as DevframeInstanceRecord } from "../instance-shell-B-FE8NY5.mjs";
 import { Buffer } from "node:buffer";
 import { IncomingMessage, Server, ServerResponse } from "node:http";
 import { Duplex } from "node:stream";
@@ -63,8 +63,8 @@ export interface InitDevframeOptions {
    * Authentication for the RPC endpoint. A handler mounted inside an app
    * server is reachable by anything that can open its socket, so it **gates
    * by default**: when unset (or `true`), devframe's interactive OTP handler
-   * is wired and its code/link banner prints once the public origin is known
-   * (derived from the first request, or `origin`). Pass a
+   * is wired and its code/link banner prints when an untrusted client asks
+   * for a code (the client's `requestAuthCode()`). Pass a
    * {@link DevframeAuthHandler} for a custom scheme, or `false` to opt out
    * for a single-user localhost setup that owns the trust boundary another
    * way. Ignored for the `ws.url` tier, since the server behind that URL owns auth.

package/dist/adapters/initiate.mjs

@@ -1,2 +1,2 @@
-import { n as getInstanceInternals, r as initDevframe } from "../dev-SPZzBTrH.mjs";
+import { n as getInstanceInternals, r as initDevframe } from "../dev-DpfkCVqo.mjs";
 export { getInstanceInternals, initDevframe };

package/dist/adapters/mcp.d.mts

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, G as McpAuthorization, o as DevframeNodeContext } from "../context-BBWPLDHh.mjs";
+import { F as DevframeDefinition, G as McpAuthorization, o as DevframeNodeContext } from "../context-B7411Bem.mjs";
 import { H3 } from "h3";
 import "@modelcontextprotocol/server";
 //#region src/adapters/mcp/build-server.d.ts

package/dist/client/index.d.mts

@@ -1,6 +1,6 @@
 import { f as RpcCacheManager, p as RpcCacheOptions } from "../index-pIVt92jP.mjs";
 import { _ as RpcFunctionDefinition, w as RpcFunctionsCollector } from "../types-Dq4i156u.mjs";
-import { Q as DevframeServiceMeta, Vt as EventEmitter, b as StreamSink, ct as DevframeSettings, d as RpcSharedStateHost, et as DevframeServiceScopeOf, gt as SettingsForNamespace, ht as ScopedSharedStates, it as DevframeServicesState, k as SharedState, mt as ScopedServerFunctions, pt as ScopedRpcFn, t as ConnectionMeta, u as RpcSharedStateGetOptions, vt as DevframeRpcClientFunctions, y as StreamReader, yt as DevframeRpcServerFunctions } from "../context-BBWPLDHh.mjs";
+import { Q as DevframeServiceMeta, Vt as EventEmitter, b as StreamSink, ct as DevframeSettings, d as RpcSharedStateHost, et as DevframeServiceScopeOf, gt as SettingsForNamespace, ht as ScopedSharedStates, it as DevframeServicesState, k as SharedState, mt as ScopedServerFunctions, pt as ScopedRpcFn, t as ConnectionMeta, u as RpcSharedStateGetOptions, vt as DevframeRpcClientFunctions, y as StreamReader, yt as DevframeRpcServerFunctions } from "../context-B7411Bem.mjs";
 import { t as SseRpcChannelOptions } from "../sse-client-BQ4jS3eO.mjs";
 import { t as WsRpcChannelOptions } from "../ws-client-Xpxt0oPA.mjs";
 import { BirpcOptions, BirpcReturn } from "birpc";
@@ -394,6 +394,15 @@ export interface DevframeRpcClient {
    * authenticated.
    */
   requestTrustWithCode: (code: string) => Promise<boolean>;
+  /**
+   * Ask the server to print its one-time code banner in the terminal, e.g.
+   * when a custom auth UI is shown. Pass `reissue: true` to rotate the code
+   * first (a "re-issue" button), guaranteeing a freshly-valid code; without
+   * it the server prints each code at most once.
+   */
+  requestAuthCode: (options?: {
+    reissue?: boolean;
+  }) => Promise<void>;
   /**
    * Call a RPC function on the server
    */
@@ -476,6 +485,7 @@ export interface DevframeRpcClientMode {
    * token on success (for the caller to persist), or `null` on failure.
    */
   requestTrustWithCode: (code: string) => Promise<string | null>;
+  requestAuthCode: DevframeRpcClient['requestAuthCode'];
   call: DevframeRpcClient['call'];
   callEvent: DevframeRpcClient['callEvent'];
   callOptional: DevframeRpcClient['callOptional'];

package/dist/client/index.mjs

@@ -1075,6 +1075,13 @@ function createLiveRpcClientMode(options) {
 		}
 		return token;
 	}
+	async function requestAuthCode(options = {}) {
+		await serverRpc.$call("anonymous:devframe:auth:request-code", {
+			ua: navigator.userAgent,
+			origin: location.origin,
+			...options.reissue ? { reissue: true } : {}
+		});
+	}
 	async function requestTrust() {
 		if (isTrusted) return true;
 		return requestTrustWithToken(currentAuthToken ?? "");
@@ -1105,6 +1112,7 @@ function createLiveRpcClientMode(options) {
 		requestTrust,
 		requestTrustWithToken,
 		requestTrustWithCode,
+		requestAuthCode,
 		ensureTrusted,
 		call: (...args) => {
 			const method = String(args[0]);
@@ -1305,6 +1313,8 @@ async function createStaticRpcClientMode(options) {
 		requestTrustWithToken: async () => true,
 		/** Static backends are always trusted, so there's nothing to exchange. */
 		requestTrustWithCode: async () => null,
+		/** No server terminal to print a code in. */
+		requestAuthCode: async () => {},
 		ensureTrusted: async () => true,
 		call: (...args) => staticCaller.call(args[0], args.slice(1)),
 		callEvent: (...args) => staticCaller.callEvent(args[0], args.slice(1)),
@@ -1986,6 +1996,7 @@ async function getDevframeRpcClient(options = {}) {
 			} catch {}
 			return true;
 		},
+		requestAuthCode: (options) => mode.requestAuthCode(options),
 		call: gateOnBootstrapAuth(mode.call),
 		callEvent: gateOnBootstrapAuth(mode.callEvent),
 		callOptional: gateOnBootstrapAuth(mode.callOptional),
@@ -2024,6 +2035,7 @@ async function getDevframeRpcClient(options = {}) {
 	async function runSimpleAuthPrompt() {
 		if (options.simpleAuth === false || !isTopLevelUnframed()) return;
 		if (typeof globalThis.prompt !== "function") return;
+		await rpc.requestAuthCode().catch(() => {});
 		while (!rpc.isTrusted) {
 			const code = globalThis.prompt("devframe: enter the authentication code shown in your terminal");
 			if (code == null) return;

package/dist/{context-BBWPLDHh.d.mts → context-B7411Bem.d.mts}

@@ -335,8 +335,9 @@ declare function parseCliFlags(schema: CliFlagsSchema, raw: Record<string, unkno
 interface DevframeAuthHandler {
   /**
    * `anonymous:devframe:auth` + `anonymous:devframe:auth:exchange` (the
-   * handshake) and `devframe:auth:revoke` (self-revoke); register these on
-   * the RPC host (e.g. `rpcHost.register(fn)` for each).
+   * handshake), `anonymous:devframe:auth:request-code` (client-requested
+   * banner print), and `devframe:auth:revoke` (self-revoke); register these
+   * on the RPC host (e.g. `rpcHost.register(fn)` for each).
    */
   rpcFunctions: RpcFunctionDefinitionAny[];
   /**
@@ -354,9 +355,11 @@ interface DevframeAuthHandler {
    */
   onConnect: (connection: DevframeRpcConnection, session: DevframeNodeRpcSession) => void;
   /**
-   * Print the current one-time code and its magic-link URL. Devframe stays
-   * headless, so call this yourself once the server is listening. Safe to
-   * call repeatedly; it only prints once per code.
+   * Print the current one-time code and its magic-link URL. An untrusted
+   * browser client triggers this itself over
+   * `anonymous:devframe:auth:request-code`; call it directly when the host
+   * wants the code on screen without waiting for a client. Safe to call
+   * repeatedly; it only prints once per code.
    */
   printBanner: () => void;
   /**
@@ -589,6 +592,23 @@ interface DevframeRpcServerFunctions {
   }) => Promise<{
     authToken: string | null;
   }>;
+  /**
+   * Ask the server to print its auth banner (code + magic link) for this
+   * client, e.g. when an auth UI first shows; `reissue: true` rotates the code
+   * first (the manual "re-issue" action). Registered by
+   * `recipes/interactive-auth`; a repeat request for an already-printed code
+   * is a no-op.
+   *
+   * Named with the `anonymous:` prefix (see `isAnonymousRpcMethod`) so it is
+   * reachable before the connection is trusted.
+   *
+   * @internal
+   */
+  'anonymous:devframe:auth:request-code': (params: {
+    ua: string;
+    origin: string;
+    reissue?: boolean;
+  }) => Promise<void>;
   /**
    * Self-revoke: the caller asks the server to revoke its own bearer token
    * (if any) and drop to untrusted. Requires an already-trusted caller, so

package/dist/{context-_temOGDB.d.mts → context-CIsx_QnV.d.mts}

@@ -1,4 +1,4 @@
-import { k as SharedState, o as DevframeNodeContext } from "./context-BBWPLDHh.mjs";
+import { k as SharedState, o as DevframeNodeContext } from "./context-B7411Bem.mjs";
 //#region src/node/hub-internals/context.d.ts
 interface InternalAnonymousAuthStorage {
   trusted: Record<string, {

package/dist/{dev-SPZzBTrH.mjs → dev-DpfkCVqo.mjs}

@@ -5,7 +5,7 @@ import { t as createHostContext } from "./context-Cdj9z9m2.mjs";
 import { t as resolveStaticAssetsSource } from "./remote-assets-DMFzLSoH.mjs";
 import { a as resolveMcpConfig, i as resolveDevServerPort, n as normalizeBasePath, r as resolveBasePath, s as importRuntimeModule, t as loadAutoMcpAdapter } from "./_shared-U8D-xzrp.mjs";
 import { t as createH3DevframeHost } from "./host-h3-BROI6SQ4.mjs";
-import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-xuu6jg51.mjs";
+import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-370Oee9K.mjs";
 import { open } from "./utils/open.mjs";
 import { mountStaticHandler } from "./utils/serve-static.mjs";
 import { resolve } from "pathe";

package/dist/in-page-channel/index.d.mts

@@ -1,5 +1,5 @@
 import { D as InferArgsType, E as Thenable, O as InferReturnType, T as RpcReturnSchema, i as RpcArgsSchema } from "../types-Dq4i156u.mjs";
-import { Vt as EventEmitter, k as SharedState } from "../context-BBWPLDHh.mjs";
+import { Vt as EventEmitter, k as SharedState } from "../context-B7411Bem.mjs";
 import { BirpcReturn } from "birpc";
 //#region src/in-page-channel/types.d.ts
 /**

package/dist/{index-1ezCLThh.d.mts → index--pZ3fdAq.d.mts}

@@ -1,5 +1,5 @@
-import { k as SharedState, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "./context-BBWPLDHh.mjs";
-import { n as InternalAnonymousAuthStorage } from "./context-_temOGDB.mjs";
+import { k as SharedState, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "./context-B7411Bem.mjs";
+import { n as InternalAnonymousAuthStorage } from "./context-CIsx_QnV.mjs";
 //#region src/node/auth/revoke.d.ts
 /**
  * Flip `isTrusted` to false on any live WS clients connected with `token`
@@ -15,11 +15,31 @@ declare function revokeActiveConnectionsForToken(context: DevframeNodeContext, t
 declare function revokeAuthToken(context: DevframeNodeContext, storage: SharedState<InternalAnonymousAuthStorage>, token: string): Promise<void>;
 //#endregion
 //#region src/node/auth/state.d.ts
+/**
+ * Format a raw `navigator.userAgent` string into the short display label
+ * shown for a trusted device (e.g. "Chrome 120 | macOS 14 desktop").
+ *
+ * The client used to parse+format this itself, but that pulled
+ * `ua-parser-modern` into the browser bundle for a label nothing else on
+ * the client needs; the client now sends the raw string and parsing
+ * happens here, at the server ingress, keeping the persisted label format
+ * identical.
+ */
+declare function describeUA(userAgent: string): string;
 /**
  * The current one-time authentication code. Display this to the user (e.g. in
  * the dev-server terminal) so they can type it into the browser to authenticate.
  */
 declare function getTempAuthCode(): string;
+/**
+ * The current code plus its expiry timestamp, for display (e.g. the auth
+ * banner). An already-expired code is rotated first, so the returned code is
+ * always redeemable for its remaining lifetime.
+ */
+declare function getTempAuthCodeInfo(): {
+  code: string;
+  expireAt: number;
+};
 /**
  * Rotate the authentication code, resetting its expiry window and failed-attempt
  * counter. Call this when a new authentication flow begins (e.g. when an
@@ -65,4 +85,4 @@ declare function exchangeTempAuthCode(code: string, session: DevframeNodeRpcSess
   origin: string;
 }, storage: SharedState<InternalAnonymousAuthStorage>): string | null;
 //#endregion
-export { verifyAuthToken as a, refreshTempAuthCode as i, exchangeTempAuthCode as n, revokeActiveConnectionsForToken as o, getTempAuthCode as r, revokeAuthToken as s, buildOtpAuthUrl as t };
+export { getTempAuthCodeInfo as a, revokeActiveConnectionsForToken as c, getTempAuthCode as i, revokeAuthToken as l, describeUA as n, refreshTempAuthCode as o, exchangeTempAuthCode as r, verifyAuthToken as s, buildOtpAuthUrl as t };

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import "./index-pIVt92jP.mjs";
 import { C as RpcFunctionType, T as RpcReturnSchema, _ as RpcFunctionDefinition, g as RpcFunctionAgentOptions, i as RpcArgsSchema } from "./types-Dq4i156u.mjs";
 import { c as DevframeNodeRpcSessionMeta, d as DevframeRpcTransportKind, l as DevframeRpcConnection, u as DevframeRpcConnectionRequest } from "./ws-server-D2nv68Hg.mjs";
-import { $ as DevframeServiceOf, At as AgentHandle, B as DevframeSetupInfo, Bt as DevframeAgentHostEvents, Ct as DevframeDiagnosticsHost, F as DevframeDefinition, Ft as AgentTool, G as McpAuthorization, H as DevframeSnapshotRpcInputs, Ht as EventUnsubscribe, I as DevframeDeploymentKind, It as AgentToolInput, J as DevframeServiceDefinition, K as McpRouteOptions, L as DevframeDockDefaults, Lt as AgentToolProvider, Mt as AgentResource, Nt as AgentResourceContent, P as DevframeCliOptions, Pt as AgentResourceInput, Q as DevframeServiceMeta, R as DevframeDuplicationStrategy, Rt as AgentToolProviderHandle, St as DevframeStorageScope, U as DevframeSseOptions, Ut as EventsMap, V as DevframeSnapshotRpcEntry, Vt as EventEmitter, W as DevframeWsOptions, X as DevframeServiceId, Y as DevframeServiceDescriptor, Z as DevframeServiceInput, _t as DevframeViewHost, a as DevframeConnectionConfigsRegistry, at as DevframeScopedNodeContext, bt as DevframeRpcSharedStates, c as RpcBroadcastOptions, ct as DevframeSettings, d as RpcSharedStateHost, dt as ScopedBroadcastOptions, et as DevframeServiceScopeOf, f as RpcStreamingChannel, ft as ScopedClientFunctions, gt as SettingsForNamespace, ht as ScopedSharedStates, i as DevframeCapabilities, it as DevframeServicesState, jt as AgentManifest, l as RpcFunctionsHost, lt as DevframeSettingsRegistry, m as RpcStreamingHost, mt as ScopedServerFunctions, n as ConnectionMetaSse, nt as DevframeServicesRegistry, o as DevframeNodeContext, ot as DevframeScopedNodeRpc, p as RpcStreamingChannelOptions, pt as ScopedRpcFn, q as McpSetting, r as ConnectionMetaWebsocket, rt as DevframeServicesScopeRegistry, s as DevframeNodeRpcSession, st as DevframeScopedStreamingHost, t as ConnectionMeta, tt as DevframeServicesHost, u as RpcSharedStateGetOptions, ut as DevframeSettingsStore, vt as DevframeRpcClientFunctions, wt as DevframeDiagnosticsLogger, xt as DevframeHost, yt as DevframeRpcServerFunctions, z as DevframeRpcOptions, zt as DevframeAgentHost } from "./context-BBWPLDHh.mjs";
+import { $ as DevframeServiceOf, At as AgentHandle, B as DevframeSetupInfo, Bt as DevframeAgentHostEvents, Ct as DevframeDiagnosticsHost, F as DevframeDefinition, Ft as AgentTool, G as McpAuthorization, H as DevframeSnapshotRpcInputs, Ht as EventUnsubscribe, I as DevframeDeploymentKind, It as AgentToolInput, J as DevframeServiceDefinition, K as McpRouteOptions, L as DevframeDockDefaults, Lt as AgentToolProvider, Mt as AgentResource, Nt as AgentResourceContent, P as DevframeCliOptions, Pt as AgentResourceInput, Q as DevframeServiceMeta, R as DevframeDuplicationStrategy, Rt as AgentToolProviderHandle, St as DevframeStorageScope, U as DevframeSseOptions, Ut as EventsMap, V as DevframeSnapshotRpcEntry, Vt as EventEmitter, W as DevframeWsOptions, X as DevframeServiceId, Y as DevframeServiceDescriptor, Z as DevframeServiceInput, _t as DevframeViewHost, a as DevframeConnectionConfigsRegistry, at as DevframeScopedNodeContext, bt as DevframeRpcSharedStates, c as RpcBroadcastOptions, ct as DevframeSettings, d as RpcSharedStateHost, dt as ScopedBroadcastOptions, et as DevframeServiceScopeOf, f as RpcStreamingChannel, ft as ScopedClientFunctions, gt as SettingsForNamespace, ht as ScopedSharedStates, i as DevframeCapabilities, it as DevframeServicesState, jt as AgentManifest, l as RpcFunctionsHost, lt as DevframeSettingsRegistry, m as RpcStreamingHost, mt as ScopedServerFunctions, n as ConnectionMetaSse, nt as DevframeServicesRegistry, o as DevframeNodeContext, ot as DevframeScopedNodeRpc, p as RpcStreamingChannelOptions, pt as ScopedRpcFn, q as McpSetting, r as ConnectionMetaWebsocket, rt as DevframeServicesScopeRegistry, s as DevframeNodeRpcSession, st as DevframeScopedStreamingHost, t as ConnectionMeta, tt as DevframeServicesHost, u as RpcSharedStateGetOptions, ut as DevframeSettingsStore, vt as DevframeRpcClientFunctions, wt as DevframeDiagnosticsLogger, xt as DevframeHost, yt as DevframeRpcServerFunctions, z as DevframeRpcOptions, zt as DevframeAgentHost } from "./context-B7411Bem.mjs";
 import { a as RemoteAssetsStore, i as RemoteAssetsProviderCustom, n as RemoteAssetsErrorMessage, o as StaticAssetsSource, r as RemoteAssetsProvider, t as RemoteAssets } from "./remote-assets-eBvSKZMS.mjs";
 import { i as DevframeDefineDiagnosticsOptions } from "./nostics-0sKe5HIj.mjs";
 //#region src/define.d.ts

package/dist/{instance-shell-xuu6jg51.mjs → instance-shell-370Oee9K.mjs}

@@ -258,9 +258,9 @@ function respondWith(event, response) {
 }
 /**
 * The shared machinery behind `initDevframe` and `initHub`: one mount base,
-* one h3 app, one lazily-derived public origin (and the auth banner that waits
-* for it), one WebSocket binding, and the fetch / connect-middleware pair that
-* serves them. Each factory supplies only what makes it itself (its context,
+* one h3 app, one lazily-derived public origin (which backs the auth
+* banner's magic link), one WebSocket binding, and the fetch /
+* connect-middleware pair that serves them. Each factory supplies only what makes it itself (its context,
 * its routes, its diagnostics) through `init` / `mount`.
 *
 * Nothing here listens on a port unless a side-car was explicitly requested:
@@ -297,12 +297,6 @@ function createInstanceShell(options) {
 		return explicitOrigin() || derivedOrigin;
 	}
 	let authHandler;
-	let bannerPrinted = false;
-	function maybePrintBanner() {
-		if (bannerPrinted || !authHandler || !currentOrigin()) return;
-		bannerPrinted = true;
-		authHandler.printBanner();
-	}
 	let meta;
 	let registration;
 	let registerPromise;
@@ -343,7 +337,7 @@ function createInstanceShell(options) {
 	* adopts only a loopback host or an exact `allowedOrigins` match, so a raw
 	* inbound `Host`/URL authority never redirects the credential-bearing link.
 	* First-valid-origin wins: an invalid candidate leaves `derivedOrigin` unset
-	* (printing/registering nothing) so a later valid one can still be adopted.
+	* (registering nothing) so a later valid one can still be adopted.
 	*/
 	function noteOrigin(candidate) {
 		if (derivedOrigin === void 0 && !explicitOrigin()) {
@@ -351,7 +345,6 @@ function createInstanceShell(options) {
 			const accepted = validateOriginCandidate(candidate, Array.isArray(allowed) ? allowed : void 0);
 			if (accepted !== void 0) derivedOrigin = accepted;
 		}
-		maybePrintBanner();
 		maybeRegister();
 	}
 	let started;
@@ -522,7 +515,6 @@ function createInstanceShell(options) {
 		};
 		if (Object.keys(ctx.staticConfig).length > 0) meta.configs = ctx.staticConfig;
 		await options.mount?.(ctx, meta, api);
-		maybePrintBanner();
 		maybeRegister();
 	}
 	const initPromise = init();

package/dist/{instance-shell-BUyYrKlu.d.mts → instance-shell-B-FE8NY5.d.mts}

@@ -1,6 +1,6 @@
 import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection, n as WsOriginRegistry } from "./ws-server-D2nv68Hg.mjs";
-import { Tt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, o as DevframeNodeContext, s as DevframeNodeRpcSession, t as ConnectionMeta, vt as DevframeRpcClientFunctions, yt as DevframeRpcServerFunctions } from "./context-BBWPLDHh.mjs";
-import "./index-1ezCLThh.mjs";
+import { Tt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, o as DevframeNodeContext, s as DevframeNodeRpcSession, t as ConnectionMeta, vt as DevframeRpcClientFunctions, yt as DevframeRpcServerFunctions } from "./context-B7411Bem.mjs";
+import "./index--pZ3fdAq.mjs";
 import { BirpcGroup } from "birpc";
 import { NodeAdapter } from "crossws/adapters/node";
 import { Buffer } from "node:buffer";
@@ -245,9 +245,9 @@ interface InstanceShell<TContext extends DevframeNodeContext> {
 declare function samePath(a: string, b: string): boolean;
 /**
  * The shared machinery behind `initDevframe` and `initHub`: one mount base,
- * one h3 app, one lazily-derived public origin (and the auth banner that waits
- * for it), one WebSocket binding, and the fetch / connect-middleware pair that
- * serves them. Each factory supplies only what makes it itself (its context,
+ * one h3 app, one lazily-derived public origin (which backs the auth
+ * banner's magic link), one WebSocket binding, and the fetch /
+ * connect-middleware pair that serves them. Each factory supplies only what makes it itself (its context,
  * its routes, its diagnostics) through `init` / `mount`.
  *
  * Nothing here listens on a port unless a side-car was explicitly requested:

package/dist/internal/index.d.mts

@@ -1,9 +1,9 @@
 import { v as RpcFunctionDefinitionAny } from "../types-Dq4i156u.mjs";
-import { At as AgentHandle, Bt as DevframeAgentHostEvents, F as DevframeDefinition, Ft as AgentTool, It as AgentToolInput, Lt as AgentToolProvider, Mt as AgentResource, Nt as AgentResourceContent, Pt as AgentResourceInput, Rt as AgentToolProviderHandle, Vt as EventEmitter, jt as AgentManifest, o as DevframeNodeContext, xt as DevframeHost, zt as DevframeAgentHost$1 } from "../context-BBWPLDHh.mjs";
+import { At as AgentHandle, Bt as DevframeAgentHostEvents, F as DevframeDefinition, Ft as AgentTool, It as AgentToolInput, Lt as AgentToolProvider, Mt as AgentResource, Nt as AgentResourceContent, Pt as AgentResourceInput, Rt as AgentToolProviderHandle, Vt as EventEmitter, jt as AgentManifest, o as DevframeNodeContext, xt as DevframeHost, zt as DevframeAgentHost$1 } from "../context-B7411Bem.mjs";
 import { a as RemoteAssetsStore, o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
-import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, h as registerDevframeInstance, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-BUyYrKlu.mjs";
-import { a as resolveBasePath, i as normalizeBasePath, n as ResolvedMcpConfig, r as loadAutoMcpAdapter, s as resolveMcpConfig } from "../_shared-DEAMiPfH.mjs";
-import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-DiCr5etS.mjs";
+import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, h as registerDevframeInstance, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-B-FE8NY5.mjs";
+import { a as resolveBasePath, i as normalizeBasePath, n as ResolvedMcpConfig, r as loadAutoMcpAdapter, s as resolveMcpConfig } from "../_shared-Bf2FcfJ4.mjs";
+import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-D7WvbvK0.mjs";
 //#region src/client-assets.d.ts
 /**
  * Resolve a definition's client assets source: the built SPA served as its

package/dist/internal/index.mjs

@@ -5,6 +5,6 @@ import { n as coerceAgentPositionalArgs, t as DevframeAgentHost } from "../host-
 import { a as resolveMcpConfig, n as normalizeBasePath, r as resolveBasePath, s as importRuntimeModule, t as loadAutoMcpAdapter } from "../_shared-U8D-xzrp.mjs";
 import { t as createH3DevframeHost } from "../host-h3-BROI6SQ4.mjs";
 import { i as registerDevframeInstance, n as listLiveDevframeInstances } from "../instance-registry-DCq762YJ.mjs";
-import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-xuu6jg51.mjs";
+import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-370Oee9K.mjs";
 import { t as createContextRpcServer } from "../rpc-core-CvkU23bQ.mjs";
 export { DevframeAgentHost, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, loadAutoMcpAdapter, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveClientAssets, resolveInstanceRegister, resolveMcpConfig, samePath };

package/dist/node/auth.d.mts

@@ -1,3 +1,3 @@
-import { Tt as DevframeAuthHandler } from "../context-BBWPLDHh.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-1ezCLThh.mjs";
-export { DevframeAuthHandler, buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };
+import { Tt as DevframeAuthHandler } from "../context-B7411Bem.mjs";
+import { a as getTempAuthCodeInfo, c as revokeActiveConnectionsForToken, i as getTempAuthCode, l as revokeAuthToken, n as describeUA, o as refreshTempAuthCode, r as exchangeTempAuthCode, s as verifyAuthToken, t as buildOtpAuthUrl } from "../index--pZ3fdAq.mjs";
+export { DevframeAuthHandler, buildOtpAuthUrl, describeUA, exchangeTempAuthCode, getTempAuthCode, getTempAuthCodeInfo, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/auth.mjs

@@ -1,3 +1,3 @@
 import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-cqztiCX4.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-Mwt6--el.mjs";
-export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };
+import { a as getTempAuthCodeInfo, i as getTempAuthCode, n as describeUA, o as refreshTempAuthCode, r as exchangeTempAuthCode, s as verifyAuthToken, t as buildOtpAuthUrl } from "../state-W4wI6X5X.mjs";
+export { buildOtpAuthUrl, describeUA, exchangeTempAuthCode, getTempAuthCode, getTempAuthCodeInfo, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,3 +1,3 @@
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-_temOGDB.mjs";
-import { a as resolveBasePath, i as normalizeBasePath } from "../_shared-DEAMiPfH.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-CIsx_QnV.mjs";
+import { a as resolveBasePath, i as normalizeBasePath } from "../_shared-Bf2FcfJ4.mjs";
 export { type DevframeInternalContext, type InternalAnonymousAuthStorage, type RemoteTokenRecord, getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/index.d.mts

@@ -1,6 +1,6 @@
 import "../index-pIVt92jP.mjs";
 import { v as RpcFunctionDefinitionAny } from "../types-Dq4i156u.mjs";
-import { k as SharedState, l as RpcFunctionsHost, o as DevframeNodeContext, xt as DevframeHost } from "../context-BBWPLDHh.mjs";
+import { k as SharedState, l as RpcFunctionsHost, o as DevframeNodeContext, xt as DevframeHost } from "../context-B7411Bem.mjs";
 import { BirpcGroup } from "birpc";
 //#region src/node/context.d.ts
 export interface CreateHostContextOptions {

package/dist/recipes/common-rpc-functions.d.mts

@@ -1,6 +1,6 @@
 import "../index-pIVt92jP.mjs";
 import { E as Thenable, S as RpcFunctionSetupResult, c as RpcDump, g as RpcFunctionAgentOptions } from "../types-Dq4i156u.mjs";
-import "../context-BBWPLDHh.mjs";
+import "../context-B7411Bem.mjs";
 import { SimpleSchema } from "../utils/simple-schema.mjs";
 //#region src/recipes/common-rpc-functions.d.ts
 /**

package/dist/recipes/interactive-auth.d.mts

@@ -1,5 +1,5 @@
-import { Tt as DevframeAuthHandler, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "../context-BBWPLDHh.mjs";
-import "../index-1ezCLThh.mjs";
+import { Tt as DevframeAuthHandler, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "../context-B7411Bem.mjs";
+import "../index--pZ3fdAq.mjs";
 import { ColorFn } from "../utils/colors.mjs";
 //#region src/recipes/interactive-auth.d.ts
 export interface CreateInteractiveAuthOptions {
@@ -11,20 +11,18 @@ export interface CreateInteractiveAuthOptions {
    */
   clientAuthTokens?: string[];
   /**
-   * Print the current code + magic-link URL. Devframe stays headless, so
-   * there is no default banner printed automatically; call
-   * `auth.printBanner()` yourself once the server is listening. Defaults to
-   * {@link createAuthBanner}'s output; pass its result here directly to
-   * rebrand the box (title / colors), or your own function to replace the
-   * format outright.
+   * Print the current code + magic-link URL. Runs when an untrusted browser
+   * client asks for a code (`anonymous:devframe:auth:request-code`, sent by
+   * the client's `requestAuthCode()`) or when the host calls
+   * `auth.printBanner()` itself. Defaults to {@link createAuthBanner}'s
+   * output; pass its result here directly to rebrand the box (title /
+   * colors), or your own function to replace the format outright.
    */
   banner?: AuthBannerFunction;
   /**
    * Called once a code exchange succeeds, so a host rendering its own
-   * banner can retract it. Fires after the rotated code is printed, so
-   * such a host drops that follow-up too and calls `auth.printBanner()`
-   * when it next wants a code on screen. Connect-time trust from a static
-   * or remote-dock token doesn't call this.
+   * banner can retract it. Connect-time trust from a static or
+   * remote-dock token doesn't call this.
    */
   onTrusted?: (info: {
     session: DevframeNodeRpcSession;
@@ -36,11 +34,24 @@ export interface CreateInteractiveAuthOptions {
    */
   serverUrl?: () => string;
 }
-/** Signature of `options.banner`: render the current auth code + magic-link URL. */
-export type AuthBannerFunction = (info: {
+/** The browser client whose `anonymous:devframe:auth:request-code` call triggered a banner print. */
+export interface AuthBannerRequester {
+  /** Short display label parsed from the client's user agent (e.g. `Chrome 120 | macOS 14 desktop`). */
+  ua: string;
+  /** The requesting page's `location.origin`. */
+  origin: string;
+}
+/** What `options.banner` receives on each print. */
+export interface AuthBannerInfo {
   code: string;
   url: string;
-}) => void;
+  /** Epoch-ms timestamp the code stops being redeemable at. */
+  expireAt: number;
+  /** Present when a browser client requested the print; absent for a host's own `printBanner()` call. */
+  requester?: AuthBannerRequester;
+}
+/** Signature of `options.banner`: render the current auth code + magic-link URL. */
+export type AuthBannerFunction = (info: AuthBannerInfo) => void;
 /** Palette for {@link createAuthBanner}'s box - one color per part, so a host can rebrand a subset. */
 export interface CreateAuthBannerColorsOptions {
   border: ColorFn;

package/dist/recipes/interactive-auth.mjs

@@ -1,7 +1,7 @@
 import { s as colors } from "../nostics-D0PvLZsn.mjs";
 import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
 import { isAnonymousRpcMethod } from "../constants.mjs";
-import { a as verifyAuthToken, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-Mwt6--el.mjs";
+import { a as getTempAuthCodeInfo, n as describeUA, o as refreshTempAuthCode, r as exchangeTempAuthCode, s as verifyAuthToken, t as buildOtpAuthUrl } from "../state-W4wI6X5X.mjs";
 import { t as getInternalContext } from "../context-jXO5vzjH.mjs";
 import { t as s } from "../simple-schema-Bi40l-P6.mjs";
 //#region src/recipes/interactive-auth.ts
@@ -16,28 +16,48 @@ function createAuthBanner(options = {}) {
 	const title = options.title ?? "Devframe";
 	const palette = {
 		border: colors.dim,
-		title: colors.bold,
+		title: (x) => colors.gray(colors.bold(x)),
 		label: colors.dim,
-		code: colors.bold,
+		code: (f) => colors.green(colors.bold(f)),
 		url: colors.cyan,
 		...options.colors
 	};
 	return (info) => {
-		const rows = [[
-			"auth code",
-			info.code,
-			palette.code
-		], [
-			"or open",
-			info.url,
-			palette.url
-		]];
+		const rows = [
+			[
+				"auth code",
+				info.code,
+				palette.code
+			],
+			[
+				"or open",
+				info.url,
+				palette.url
+			],
+			[
+				"expires at",
+				new Date(info.expireAt).toLocaleTimeString(),
+				palette.label
+			]
+		];
+		if (info.requester) {
+			rows.push([
+				"ua",
+				info.requester.ua,
+				palette.label
+			]);
+			rows.push([
+				"origin",
+				info.requester.origin,
+				palette.label
+			]);
+		}
 		const labelWidth = Math.max(...rows.map(([label]) => label.length));
 		const contentWidth = Math.max(...rows.map(([, value]) => labelWidth + 2 + value.length));
-		const titleBarLength = title.length + 3;
+		const titleBarLength = title.length + 2;
 		const lineWidth = Math.max(contentWidth, titleBarLength - 2);
 		const top = [
-			palette.border(`╭─`),
+			palette.border(`╭`),
 			palette.title(title),
 			palette.border(`${"─".repeat(Math.max(lineWidth + 2 - titleBarLength, 0))}╮`)
 		].join(" ");
@@ -83,14 +103,16 @@ function createInteractiveAuth(context, options = {}) {
 	}
 	const banner = options.banner ?? createAuthBanner();
 	let bannerPrintedForCode;
-	function printBanner() {
-		const code = getTempAuthCode();
+	function printBanner(info) {
+		const { code, expireAt } = getTempAuthCodeInfo();
 		if (code === bannerPrintedForCode) return;
 		bannerPrintedForCode = code;
 		const url = buildOtpAuthUrl(resolveServerUrl(), code);
 		banner({
 			code,
-			url
+			url,
+			expireAt,
+			...info?.requester ? { requester: info.requester } : {}
 		});
 	}
 	const anonymousAuth = defineRpcFunction({
@@ -129,7 +151,6 @@ function createInteractiveAuth(context, options = {}) {
 			const session = context.rpc.getCurrentRpcSession();
 			if (!session) return { authToken: null };
 			const authToken = exchangeTempAuthCode(params.code, session, params, storage);
-			printBanner();
 			if (authToken) options.onTrusted?.({
 				session,
 				authToken
@@ -137,6 +158,24 @@ function createInteractiveAuth(context, options = {}) {
 			return { authToken };
 		}
 	});
+	const anonymousAuthRequestCode = defineRpcFunction({
+		name: "anonymous:devframe:auth:request-code",
+		type: "action",
+		jsonSerializable: true,
+		args: [s.object({
+			ua: s.string(),
+			origin: s.string(),
+			reissue: s.optional(s.boolean())
+		})],
+		returns: s.void(),
+		handler(params) {
+			if (params.reissue) refreshTempAuthCode();
+			printBanner({ requester: {
+				ua: describeUA(params.ua),
+				origin: params.origin
+			} });
+		}
+	});
 	const revoke = defineRpcFunction({
 		name: "devframe:auth:revoke",
 		type: "action",
@@ -180,6 +219,7 @@ function createInteractiveAuth(context, options = {}) {
 		rpcFunctions: [
 			anonymousAuth,
 			anonymousAuthExchange,
+			anonymousAuthRequestCode,
 			revoke
 		],
 		authorize,

package/dist/rpc/transports/ws-bun.d.mts

@@ -1,5 +1,5 @@
 import { n as WsOriginRegistry } from "../../ws-server-D2nv68Hg.mjs";
-import { t as ContextRpcServer } from "../../rpc-core-DiCr5etS.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-D7WvbvK0.mjs";
 //#region src/rpc/transports/ws-bun.d.ts
 export interface AttachBunWsTransportOptions {
   /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */

package/dist/rpc/transports/ws-deno.d.mts

@@ -1,5 +1,5 @@
 import { n as WsOriginRegistry } from "../../ws-server-D2nv68Hg.mjs";
-import { t as ContextRpcServer } from "../../rpc-core-DiCr5etS.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-D7WvbvK0.mjs";
 //#region src/rpc/transports/ws-deno.d.ts
 export interface AttachDenoWsTransportOptions {
   /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */

package/dist/{rpc-core-DiCr5etS.d.mts → rpc-core-D7WvbvK0.d.mts}

@@ -1,6 +1,6 @@
 import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection } from "./ws-server-D2nv68Hg.mjs";
-import { Tt as DevframeAuthHandler, o as DevframeNodeContext, s as DevframeNodeRpcSession, vt as DevframeRpcClientFunctions, yt as DevframeRpcServerFunctions } from "./context-BBWPLDHh.mjs";
-import "./index-1ezCLThh.mjs";
+import { Tt as DevframeAuthHandler, o as DevframeNodeContext, s as DevframeNodeRpcSession, vt as DevframeRpcClientFunctions, yt as DevframeRpcServerFunctions } from "./context-B7411Bem.mjs";
+import "./index--pZ3fdAq.mjs";
 import { BirpcGroup, EventOptions } from "birpc";
 //#region src/node/rpc-core.d.ts
 interface CreateContextRpcServerOptions {

package/dist/{state-Mwt6--el.mjs → state-W4wI6X5X.mjs}

@@ -1215,6 +1215,19 @@ function getTempAuthCode() {
 	return ensureTempAuthCode();
 }
 /**
+* The current code plus its expiry timestamp, for display (e.g. the auth
+* banner). An already-expired code is rotated first, so the returned code is
+* always redeemable for its remaining lifetime.
+*/
+function getTempAuthCodeInfo() {
+	ensureTempAuthCode();
+	if (Date.now() > tempAuthCodeExpiresAt) refreshTempAuthCode();
+	return {
+		code: tempAuthCode,
+		expireAt: tempAuthCodeExpiresAt
+	};
+}
+/**
 * Rotate the authentication code, resetting its expiry window and failed-attempt
 * counter. Call this when a new authentication flow begins (e.g. when an
 * untrusted client starts authenticating) so the displayed code is freshly
@@ -1296,4 +1309,4 @@ function exchangeTempAuthCode(code, session, info, storage) {
 	return authToken;
 }
 //#endregion
-export { verifyAuthToken as a, refreshTempAuthCode as i, exchangeTempAuthCode as n, getTempAuthCode as r, buildOtpAuthUrl as t };
+export { getTempAuthCodeInfo as a, getTempAuthCode as i, describeUA as n, refreshTempAuthCode as o, exchangeTempAuthCode as r, verifyAuthToken as s, buildOtpAuthUrl as t };

package/dist/types/index.d.mts

@@ -1,6 +1,6 @@
 import { g as RpcFunctionAgentOptions } from "../types-Dq4i156u.mjs";
 import { c as DevframeNodeRpcSessionMeta, d as DevframeRpcTransportKind, l as DevframeRpcConnection, u as DevframeRpcConnectionRequest } from "../ws-server-D2nv68Hg.mjs";
-import { $ as DevframeServiceOf, At as AgentHandle, B as DevframeSetupInfo, Bt as DevframeAgentHostEvents, Ct as DevframeDiagnosticsHost, F as DevframeDefinition, Ft as AgentTool, G as McpAuthorization, H as DevframeSnapshotRpcInputs, Ht as EventUnsubscribe, I as DevframeDeploymentKind, It as AgentToolInput, J as DevframeServiceDefinition, K as McpRouteOptions, L as DevframeDockDefaults, Lt as AgentToolProvider, Mt as AgentResource, Nt as AgentResourceContent, P as DevframeCliOptions, Pt as AgentResourceInput, Q as DevframeServiceMeta, R as DevframeDuplicationStrategy, Rt as AgentToolProviderHandle, St as DevframeStorageScope, U as DevframeSseOptions, Ut as EventsMap, V as DevframeSnapshotRpcEntry, Vt as EventEmitter, W as DevframeWsOptions, X as DevframeServiceId, Y as DevframeServiceDescriptor, Z as DevframeServiceInput, _t as DevframeViewHost, a as DevframeConnectionConfigsRegistry, at as DevframeScopedNodeContext, bt as DevframeRpcSharedStates, c as RpcBroadcastOptions, ct as DevframeSettings, d as RpcSharedStateHost, dt as ScopedBroadcastOptions, et as DevframeServiceScopeOf, f as RpcStreamingChannel, ft as ScopedClientFunctions, gt as SettingsForNamespace, ht as ScopedSharedStates, i as DevframeCapabilities, it as DevframeServicesState, jt as AgentManifest, l as RpcFunctionsHost, lt as DevframeSettingsRegistry, m as RpcStreamingHost, mt as ScopedServerFunctions, n as ConnectionMetaSse, nt as DevframeServicesRegistry, o as DevframeNodeContext, ot as DevframeScopedNodeRpc, p as RpcStreamingChannelOptions, pt as ScopedRpcFn, q as McpSetting, r as ConnectionMetaWebsocket, rt as DevframeServicesScopeRegistry, s as DevframeNodeRpcSession, st as DevframeScopedStreamingHost, t as ConnectionMeta, tt as DevframeServicesHost, u as RpcSharedStateGetOptions, ut as DevframeSettingsStore, vt as DevframeRpcClientFunctions, wt as DevframeDiagnosticsLogger, xt as DevframeHost, yt as DevframeRpcServerFunctions, z as DevframeRpcOptions, zt as DevframeAgentHost } from "../context-BBWPLDHh.mjs";
+import { $ as DevframeServiceOf, At as AgentHandle, B as DevframeSetupInfo, Bt as DevframeAgentHostEvents, Ct as DevframeDiagnosticsHost, F as DevframeDefinition, Ft as AgentTool, G as McpAuthorization, H as DevframeSnapshotRpcInputs, Ht as EventUnsubscribe, I as DevframeDeploymentKind, It as AgentToolInput, J as DevframeServiceDefinition, K as McpRouteOptions, L as DevframeDockDefaults, Lt as AgentToolProvider, Mt as AgentResource, Nt as AgentResourceContent, P as DevframeCliOptions, Pt as AgentResourceInput, Q as DevframeServiceMeta, R as DevframeDuplicationStrategy, Rt as AgentToolProviderHandle, St as DevframeStorageScope, U as DevframeSseOptions, Ut as EventsMap, V as DevframeSnapshotRpcEntry, Vt as EventEmitter, W as DevframeWsOptions, X as DevframeServiceId, Y as DevframeServiceDescriptor, Z as DevframeServiceInput, _t as DevframeViewHost, a as DevframeConnectionConfigsRegistry, at as DevframeScopedNodeContext, bt as DevframeRpcSharedStates, c as RpcBroadcastOptions, ct as DevframeSettings, d as RpcSharedStateHost, dt as ScopedBroadcastOptions, et as DevframeServiceScopeOf, f as RpcStreamingChannel, ft as ScopedClientFunctions, gt as SettingsForNamespace, ht as ScopedSharedStates, i as DevframeCapabilities, it as DevframeServicesState, jt as AgentManifest, l as RpcFunctionsHost, lt as DevframeSettingsRegistry, m as RpcStreamingHost, mt as ScopedServerFunctions, n as ConnectionMetaSse, nt as DevframeServicesRegistry, o as DevframeNodeContext, ot as DevframeScopedNodeRpc, p as RpcStreamingChannelOptions, pt as ScopedRpcFn, q as McpSetting, r as ConnectionMetaWebsocket, rt as DevframeServicesScopeRegistry, s as DevframeNodeRpcSession, st as DevframeScopedStreamingHost, t as ConnectionMeta, tt as DevframeServicesHost, u as RpcSharedStateGetOptions, ut as DevframeSettingsStore, vt as DevframeRpcClientFunctions, wt as DevframeDiagnosticsLogger, xt as DevframeHost, yt as DevframeRpcServerFunctions, z as DevframeRpcOptions, zt as DevframeAgentHost } from "../context-B7411Bem.mjs";
 import { a as RemoteAssetsStore, i as RemoteAssetsProviderCustom, n as RemoteAssetsErrorMessage, o as StaticAssetsSource, r as RemoteAssetsProvider, t as RemoteAssets } from "../remote-assets-eBvSKZMS.mjs";
 import { i as DevframeDefineDiagnosticsOptions } from "../nostics-0sKe5HIj.mjs";
 export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, AgentToolProvider, AgentToolProviderHandle, ConnectionMeta, ConnectionMetaSse, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeCapabilities, DevframeCliOptions, DevframeConnectionConfigsRegistry, type DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDockDefaults, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, type DevframeRpcConnection, type DevframeRpcConnectionRequest, DevframeRpcOptions, DevframeRpcServerFunctions, DevframeRpcSharedStates, type DevframeRpcTransportKind, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeServiceDefinition, DevframeServiceDescriptor, DevframeServiceId, DevframeServiceInput, DevframeServiceMeta, DevframeServiceOf, DevframeServiceScopeOf, DevframeServicesHost, DevframeServicesRegistry, DevframeServicesScopeRegistry, DevframeServicesState, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSnapshotRpcEntry, DevframeSnapshotRpcInputs, DevframeSseOptions, DevframeStorageScope, DevframeViewHost, DevframeWsOptions, EventEmitter, EventUnsubscribe, EventsMap, McpAuthorization, McpRouteOptions, McpSetting, RemoteAssets, RemoteAssetsErrorMessage, RemoteAssetsProvider, RemoteAssetsProviderCustom, RemoteAssetsStore, RpcBroadcastOptions, type RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedRpcFn, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, StaticAssetsSource };

package/dist/utils/events.d.mts

@@ -1,4 +1,4 @@
-import { Ut as EventsMap, Vt as EventEmitter } from "../context-BBWPLDHh.mjs";
+import { Ut as EventsMap, Vt as EventEmitter } from "../context-B7411Bem.mjs";
 //#region src/utils/events.d.ts
 /**
  * Create event emitter.

package/dist/utils/shared-state.d.mts

@@ -1,2 +1,2 @@
-import { A as SharedStateEvents, D as ImmutableObject, E as ImmutableMap, M as SharedStatePatch, N as createSharedState, O as ImmutableSet, T as ImmutableArray, j as SharedStateOptions, k as SharedState, w as Immutable } from "../context-BBWPLDHh.mjs";
+import { A as SharedStateEvents, D as ImmutableObject, E as ImmutableMap, M as SharedStatePatch, N as createSharedState, O as ImmutableSet, T as ImmutableArray, j as SharedStateOptions, k as SharedState, w as Immutable } from "../context-B7411Bem.mjs";
 export { Immutable, ImmutableArray, ImmutableMap, ImmutableObject, ImmutableSet, SharedState, SharedStateEvents, SharedStateOptions, SharedStatePatch, createSharedState };

package/dist/utils/streaming-channel.d.mts

@@ -1,2 +1,2 @@
-import { C as createStreamSink, S as createStreamReader, _ as CreateStreamSinkOptions, b as StreamSink, g as CreateStreamReaderOptions, h as BufferedChunk, v as StreamErrorPayload, x as StreamSinkEvents, y as StreamReader } from "../context-BBWPLDHh.mjs";
+import { C as createStreamSink, S as createStreamReader, _ as CreateStreamSinkOptions, b as StreamSink, g as CreateStreamReaderOptions, h as BufferedChunk, v as StreamErrorPayload, x as StreamSinkEvents, y as StreamReader } from "../context-B7411Bem.mjs";
 export { BufferedChunk, CreateStreamReaderOptions, CreateStreamSinkOptions, StreamErrorPayload, StreamReader, StreamSink, StreamSinkEvents, createStreamReader, createStreamSink };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devframe",
   "type": "module",
-  "version": "0.9.13",
+  "version": "0.9.14",
   "description": "Framework for building one portable devtool integration that runs in any viewer.",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",