devframe 1.2.3 → 1.2.4

package/dist/{_shared-B2PZsp-J.mjs → _shared-DlRoV7v3.mjs}

@@ -143,6 +143,7 @@ function resolveMcpConfig(mcp) {
 	return {
 		...mcp.path !== void 0 ? { path: mcp.path } : {},
 		...mcp.allowedOrigins !== void 0 ? { allowedOrigins: mcp.allowedOrigins } : {},
+		...mcp.exposeSharedState !== void 0 ? { exposeSharedState: mcp.exposeSharedState } : {},
 		authorization
 	};
 }

package/dist/{_shared-DjkowZKP.d.mts → _shared-NSl4p_om.d.mts}

@@ -1,5 +1,5 @@
-import { B as DevframeDefinition, Q as McpSetting, V as DevframeDeploymentKind, Wt as DevframeAgentHost, X as McpAuthorization, t as ConnectionMeta } from "./context-BvaYawdU.mjs";
-import { t as AgenticMcpModule } from "./agentic-B8y_r5tQ.mjs";
+import { B as DevframeDefinition, Q as McpSetting, V as DevframeDeploymentKind, Wt as DevframeAgentHost, X as McpAuthorization, t as ConnectionMeta } from "./context-DhycZ2lx.mjs";
+import { t as AgenticMcpModule } from "./agentic-D61fXLzA.mjs";
 //#region src/adapters/_shared.d.ts
 /**
  * Resolve the mount base path for a devframe's SPA. Hosted adapters
@@ -35,6 +35,8 @@ interface ResolvedMcpConfig {
   path?: string;
   /** Origin allow-list, or `false` to disable the origin gate. */
   allowedOrigins?: readonly string[] | false;
+  /** Shared-state exposure from the route options; omitted means every key. */
+  exposeSharedState?: boolean | ((key: string) => boolean);
   /** The resolved identity policy: a bearer token, callback, or `false`. */
   authorization: McpAuthorization;
 }

package/dist/adapters/build.d.mts

@@ -1,4 +1,4 @@
-import { B as DevframeDefinition, K as DevframeSnapshotRpcEntry, o as DevframeNodeContext } from "../context-BvaYawdU.mjs";
+import { B as DevframeDefinition, K as DevframeSnapshotRpcEntry, o as DevframeNodeContext } from "../context-DhycZ2lx.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
 //#region src/adapters/build.d.ts
 export interface CreateBuildOptions {

package/dist/adapters/build.mjs

@@ -1,14 +1,14 @@
 import { s as colors } from "../nostics-D0PvLZsn.mjs";
 import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME } from "../constants.mjs";
-import { n as collectStaticRpcDump, t as writeStaticRpcDump } from "../write-BWIO0h0Z.mjs";
+import { n as collectStaticRpcDump, t as writeStaticRpcDump } from "../write-DK7rBUN3.mjs";
 import { t as diagnostics } from "../diagnostics-Cx4_VjlG.mjs";
-import { t as createHostContext } from "../context-BqpgC5tq.mjs";
+import { t as createHostContext } from "../context-BKw9KkCR.mjs";
 import { t as resolveStaticAssetsSource } from "../remote-assets-B9MeWmW6.mjs";
 import { t as createH3DevframeHost } from "../host-h3-BROI6SQ4.mjs";
 import fs from "node:fs/promises";
 import { resolve } from "pathe";
-import process from "node:process";
 import { existsSync } from "node:fs";
+import process from "node:process";
 //#region src/adapters/build.ts
 /**
 * Produce a self-contained static deploy of a devframe:

package/dist/adapters/cac.d.mts

@@ -1,4 +1,4 @@
-import { B as DevframeDefinition, Mt as InferCliFlags, Nt as defineCliFlags, Pt as parseCliFlags, Q as McpSetting, jt as CliFlagsSchema } from "../context-BvaYawdU.mjs";
+import { B as DevframeDefinition, Mt as InferCliFlags, Nt as defineCliFlags, Pt as parseCliFlags, Q as McpSetting, jt as CliFlagsSchema } from "../context-DhycZ2lx.mjs";
 import { CAC } from "cac";
 import { H3 } from "h3";
 //#region src/adapters/cac.d.ts

package/dist/adapters/cac.mjs

@@ -1,7 +1,7 @@
 import { s as colors } from "../nostics-D0PvLZsn.mjs";
-import { i as resolveDevServerPort, s as importAgenticMcp } from "../_shared-B2PZsp-J.mjs";
+import { i as resolveDevServerPort, s as importAgenticMcp } from "../_shared-DlRoV7v3.mjs";
 import { createBuild } from "./build.mjs";
-import { t as createDevServer } from "../dev-CInztvNK.mjs";
+import { t as createDevServer } from "../dev-BViAfnlw.mjs";
 import process from "node:process";
 import cac$1 from "cac";
 //#region src/adapters/flags.ts

package/dist/adapters/dev.d.mts

@@ -1,9 +1,9 @@
-import { At as DevframeAuthHandler, B as DevframeDefinition, J as DevframeSseOptions, Q as McpSetting, Y as DevframeWsOptions, s as DevframeNodeRpcSession } from "../context-BvaYawdU.mjs";
+import { At as DevframeAuthHandler, B as DevframeDefinition, J as DevframeSseOptions, Q as McpSetting, Y as DevframeWsOptions, s as DevframeNodeRpcSession } from "../context-DhycZ2lx.mjs";
 import { n as DevframeRpcConnection, t as DevframeNodeRpcSessionMeta } from "../session-r6PDixP6.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
 import { n as WsOriginRegistry } from "../ws-server-y2R76aSW.mjs";
-import { c as StartedServer } from "../instance-shell-CM2nruNe.mjs";
-import { c as resolveMcpConnectionMeta, o as resolveDevServerPort, t as ResolveDevServerPortOptions } from "../_shared-DjkowZKP.mjs";
+import { c as StartedServer } from "../instance-shell-fl3ir6RC.mjs";
+import { c as resolveMcpConnectionMeta, o as resolveDevServerPort, t as ResolveDevServerPortOptions } from "../_shared-NSl4p_om.mjs";
 import { H3 } from "h3";
 //#region src/adapters/dev.d.ts
 export interface CreateDevServerOptions {

package/dist/adapters/dev.mjs

@@ -1,3 +1,3 @@
-import { i as resolveDevServerPort, o as resolveMcpConnectionMeta } from "../_shared-B2PZsp-J.mjs";
-import { t as createDevServer } from "../dev-CInztvNK.mjs";
+import { i as resolveDevServerPort, o as resolveMcpConnectionMeta } from "../_shared-DlRoV7v3.mjs";
+import { t as createDevServer } from "../dev-BViAfnlw.mjs";
 export { createDevServer, resolveDevServerPort, resolveMcpConnectionMeta };

package/dist/adapters/embedded.d.mts

@@ -1,4 +1,4 @@
-import { B as DevframeDefinition, o as DevframeNodeContext } from "../context-BvaYawdU.mjs";
+import { B as DevframeDefinition, o as DevframeNodeContext } from "../context-DhycZ2lx.mjs";
 //#region src/adapters/embedded.d.ts
 export interface CreateEmbeddedOptions {
   /** Target context the devframe is registered into. Required. */

package/dist/adapters/initiate.d.mts

@@ -1,8 +1,8 @@
-import { At as DevframeAuthHandler, B as DevframeDefinition, Dt as DevframeStorageScope, J as DevframeSseOptions, Q as McpSetting, Y as DevframeWsOptions, o as DevframeNodeContext, s as DevframeNodeRpcSession, t as ConnectionMeta } from "../context-BvaYawdU.mjs";
+import { At as DevframeAuthHandler, B as DevframeDefinition, Dt as DevframeStorageScope, J as DevframeSseOptions, Q as McpSetting, Y as DevframeWsOptions, o as DevframeNodeContext, s as DevframeNodeRpcSession, t as ConnectionMeta } from "../context-DhycZ2lx.mjs";
 import { n as DevframeRpcConnection, t as DevframeNodeRpcSessionMeta } from "../session-r6PDixP6.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
 import { n as WsOriginRegistry } from "../ws-server-y2R76aSW.mjs";
-import { c as StartedServer, f as DevframeInstanceRecord } from "../instance-shell-CM2nruNe.mjs";
+import { c as StartedServer, f as DevframeInstanceRecord } from "../instance-shell-fl3ir6RC.mjs";
 import { H3 } from "h3";
 import { Buffer } from "node:buffer";
 import { IncomingMessage, Server, ServerResponse } from "node:http";

package/dist/adapters/initiate.mjs

@@ -1,2 +1,2 @@
-import { n as getInstanceInternals, r as initDevframe } from "../dev-CInztvNK.mjs";
+import { n as getInstanceInternals, r as initDevframe } from "../dev-BViAfnlw.mjs";
 export { getInstanceInternals, initDevframe };

package/dist/adapters/mcp.d.mts

@@ -1,4 +1,4 @@
-import { F as CreateMcpServerOptions, I as McpConnectionInfo, L as McpFetchHandler, P as CreateMcpFetchHandlerOptions, R as McpServerHandle } from "../context-BvaYawdU.mjs";
-import { n as MountMcpHttpOptions, r as MountedMcpHttp } from "../agentic-B8y_r5tQ.mjs";
+import { F as CreateMcpServerOptions, I as McpConnectionInfo, L as McpFetchHandler, P as CreateMcpFetchHandlerOptions, R as McpServerHandle } from "../context-DhycZ2lx.mjs";
+import { n as MountMcpHttpOptions, r as MountedMcpHttp } from "../agentic-D61fXLzA.mjs";
 import { createMcpFetchHandler, createMcpServer, mountMcpHttp } from "@devframes/agentic/mcp";
 export { type CreateMcpFetchHandlerOptions, type CreateMcpServerOptions, type McpConnectionInfo, type McpFetchHandler, type McpServerHandle, type MountMcpHttpOptions, type MountedMcpHttp, createMcpFetchHandler, createMcpServer, mountMcpHttp };

package/dist/{agentic-B8y_r5tQ.d.mts → agentic-D61fXLzA.d.mts}

@@ -1,4 +1,4 @@
-import { B as DevframeDefinition, F as CreateMcpServerOptions, L as McpFetchHandler, P as CreateMcpFetchHandlerOptions, R as McpServerHandle, o as DevframeNodeContext } from "./context-BvaYawdU.mjs";
+import { B as DevframeDefinition, F as CreateMcpServerOptions, L as McpFetchHandler, P as CreateMcpFetchHandlerOptions, R as McpServerHandle, o as DevframeNodeContext } from "./context-DhycZ2lx.mjs";
 import { H3 } from "h3";
 //#region src/node/agentic.d.ts
 /**

package/dist/client/index.d.mts

@@ -1,7 +1,7 @@
 import { i as BirpcReturn, r as BirpcOptions } from "../index-Bia1vKjL.mjs";
 import { f as RpcCacheManager, p as RpcCacheOptions } from "../index-DuEm0sDH.mjs";
 import { h as RpcFunctionDefinition, w as RpcFunctionsCollector } from "../types-BmDbfHCx.mjs";
-import { Ct as DevframeRpcClientFunctions, Kt as EventEmitter, at as DevframeServiceScopeOf, b as StreamSink, bt as ScopedSharedStates, d as RpcSharedStateHost, k as SharedState, lt as DevframeServicesState, pt as DevframeSettings, rt as DevframeServiceMeta, t as ConnectionMeta, u as RpcSharedStateGetOptions, vt as ScopedRpcFn, wt as DevframeRpcServerFunctions, xt as SettingsForNamespace, y as StreamReader, yt as ScopedServerFunctions } from "../context-BvaYawdU.mjs";
+import { Ct as DevframeRpcClientFunctions, Kt as EventEmitter, at as DevframeServiceScopeOf, b as StreamSink, bt as ScopedSharedStates, d as RpcSharedStateHost, k as SharedState, lt as DevframeServicesState, pt as DevframeSettings, rt as DevframeServiceMeta, t as ConnectionMeta, u as RpcSharedStateGetOptions, vt as ScopedRpcFn, wt as DevframeRpcServerFunctions, xt as SettingsForNamespace, y as StreamReader, yt as ScopedServerFunctions } from "../context-DhycZ2lx.mjs";
 import { t as SseRpcChannelOptions } from "../sse-client-DNdscfu_.mjs";
 import { t as WsRpcChannelOptions } from "../ws-client-6Mrz6eC4.mjs";
 //#region src/client/connection.d.ts
@@ -310,6 +310,7 @@ export interface DevframeRpcClientOptions extends SetupDevframeConnectionOptions
   /** Channel overrides for the SSE transport, the `wsOptions` counterpart. */
   sseOptions?: Partial<SseRpcChannelOptions>;
   rpcOptions?: Partial<BirpcOptions<DevframeRpcServerFunctions, DevframeRpcClientFunctions, boolean>>;
+  /** Cache declared static/opted-in query methods with `true`, or select an explicit function list. */
   cacheOptions?: boolean | Partial<RpcCacheOptions>;
   /**
    * Mirror `agent`-flagged client RPC functions (functions registered on

package/dist/client/index.mjs

@@ -1,4 +1,4 @@
-import { a as defineDiagnostics, i as createBirpc, n as argsToJsonSchema, o as DEVFRAME_EVENTS, r as resolveAgentSafety, t as toolInputToRpcArgs } from "../tool-input-BAQXvvqL.mjs";
+import { a as defineDiagnostics, i as createBirpc, n as argsToJsonSchema, o as DEVFRAME_EVENTS, r as resolveAgentSafety, t as toolInputToRpcArgs } from "../tool-input-CES3Pc4y.mjs";
 import { t as hash } from "../hash-DdPnc4k3.mjs";
 import { createEventEmitter } from "../utils/events.mjs";
 import { withBase, withProtocol } from "../utils/url.mjs";
@@ -738,7 +738,7 @@ function createRpcSharedStateClientHost(rpc) {
 					return state;
 				}
 			}
-			return new Promise((resolve) => {
+			return new Promise((resolve, reject) => {
 				if (!rpc.isTrusted) {
 					resolve(state);
 					let initialized = false;
@@ -748,7 +748,7 @@ function createRpcSharedStateClientHost(rpc) {
 							initSharedState();
 						}
 					});
-				} else initSharedState().then(resolve);
+				} else initSharedState().then(resolve, reject);
 			});
 		}
 	};
@@ -1599,23 +1599,24 @@ function qualifyName(namespace, name) {
 function createSettingsStore(store) {
 	return {
 		async get(key) {
-			return (await store()).value()[key];
+			return (await store()).value()?.[key];
 		},
 		async set(key, value) {
 			(await store()).mutate((draft) => {
+				if (draft === void 0) return { [key]: value };
 				draft[key] = value;
 			});
 		},
 		async delete(key) {
 			(await store()).mutate((draft) => {
-				delete draft[key];
+				if (draft !== void 0) delete draft[key];
 			});
 		},
 		async all() {
-			return (await store()).value();
+			return (await store()).value() ?? {};
 		},
 		async onChange(fn) {
-			return (await store()).on("updated", (full) => fn(full));
+			return (await store()).on("updated", (full) => fn(full ?? {}));
 		}
 	};
 }
@@ -1625,7 +1626,13 @@ function createClientSettingsStore(rpc, namespace, scope) {
 	const stateKey = `devframe:settings:${scope}:${namespace}`;
 	let statePromise;
 	function store() {
-		if (!statePromise) statePromise = rpc.sharedState.get(stateKey, { initialValue: {} });
+		if (!statePromise) statePromise = (async () => {
+			await rpc.ensureTrusted();
+			return rpc.sharedState.get(stateKey);
+		})().catch((error) => {
+			statePromise = void 0;
+			throw error;
+		});
 		return statePromise;
 	}
 	return createSettingsStore(store);
@@ -1828,6 +1835,23 @@ async function getDevframeRpcClient(options = {}) {
 	const disposeWebMcp = options.webmcp === false ? void 0 : registerWebMcpTools(clientRpc);
 	let disposeBrowserAgentBridge;
 	let closed = false;
+	let cacheGeneration = 0;
+	let cacheFunctions;
+	function invalidateCache() {
+		cacheGeneration++;
+		cacheFunctions = void 0;
+		cacheManager.clear();
+		if (cacheOptions === true) cacheManager.updateOptions({ functions: [] });
+	}
+	if (cacheOptions) {
+		clientRpc.register({
+			name: DEVFRAME_EVENTS.broadcast.cacheInvalidate,
+			type: "event",
+			handler: invalidateCache
+		});
+		events.on(DEVFRAME_EVENTS.client.connectionStatus, invalidateCache);
+		events.on(DEVFRAME_EVENTS.client.isTrustedUpdated, invalidateCache);
+	}
 	async function fetchJsonFromBases(path) {
 		const candidates = [resolvedBaseURL, ...bases.filter((base) => base !== resolvedBaseURL)].filter((x) => x != null);
 		const errors = [];
@@ -1841,6 +1865,9 @@ async function getDevframeRpcClient(options = {}) {
 		}
 		throw new Error(`Failed to load ${path} from ${candidates.join(", ")}`, { cause: errors });
 	}
+	const timeout = options.callTimeout ?? 0;
+	const requestBudget = timeout > 0 ? timeout : Infinity;
+	let mode;
 	const liveModeOptions = {
 		authToken,
 		connectionMeta,
@@ -1851,17 +1878,38 @@ async function getDevframeRpcClient(options = {}) {
 		rpcOptions: {
 			...rpcOptions,
 			async onRequest(req, next, resolve) {
+				const deadline = performance.now() + requestBudget;
 				await rpcOptions.onRequest?.call(this, req, next, resolve);
-				if (cacheOptions && cacheManager?.validate(req.m)) {
+				if (cacheOptions === true && req.i && mode.isTrusted && !req.m.startsWith("anonymous:") && req.m !== "devframe:rpc:cacheable-functions") {
+					function checkDeadline() {
+						if (performance.now() >= deadline) throw new DevframeConnectionError("timeout", `[devframe] RPC call "${req.m}" timed out after ${timeout}ms`);
+					}
+					while (!cacheFunctions) {
+						checkDeadline();
+						if (closed || mode.status !== "connected") break;
+						const generation = cacheGeneration;
+						cacheFunctions = mode.callOptional("devframe:rpc:cacheable-functions").then((functions) => {
+							if (generation === cacheGeneration) cacheManager.updateOptions({ functions: functions ?? [] });
+						}).catch((error) => {
+							if (generation === cacheGeneration) cacheFunctions = void 0;
+							throw error;
+						});
+						await cacheFunctions;
+					}
+					await cacheFunctions;
+					checkDeadline();
+				}
+				const generation = cacheGeneration;
+				if (cacheOptions && req.i && !closed && mode.isTrusted && cacheManager.validate(req.m)) {
 					if (cacheManager.has(req.m, req.a)) return resolve(cacheManager.cached(req.m, req.a));
 					const res = await next(req);
-					cacheManager.apply(req, res);
+					if (generation === cacheGeneration && !closed) cacheManager.apply(req, res);
 				} else await next(req);
 			}
 		}
 	};
 	const transport = resolveClientTransport(options.transport ?? "auto", connectionMeta);
-	const mode = transport === "static" ? await createStaticRpcClientMode({ fetchJsonFromBases }) : transport === "sse" ? createSseRpcClientMode({
+	mode = transport === "static" ? await createStaticRpcClientMode({ fetchJsonFromBases }) : transport === "sse" ? createSseRpcClientMode({
 		...liveModeOptions,
 		sseOptions: options.sseOptions
 	}) : createWsRpcClientMode({
@@ -1883,6 +1931,7 @@ async function getDevframeRpcClient(options = {}) {
 	/** Release authentication and transport resources even if another disposer fails. */
 	function closeRpcClient() {
 		closed = true;
+		invalidateCache();
 		try {
 			disposeBrowserAgentBridge?.();
 			disposeWebMcp?.();

package/dist/constants.d.mts

@@ -52,6 +52,7 @@ export declare const DEVFRAME_EVENTS: {
    */
   readonly broadcast: {
     readonly authRevoked: "devframe:auth:revoked";
+    readonly cacheInvalidate: "devframe:rpc:cache:invalidate";
     readonly clientStateUpdated: "devframe:rpc:client-state:updated";
     readonly clientStatePatch: "devframe:rpc:client-state:patch";
     readonly streamingChunk: "devframe:streaming:chunk";

package/dist/constants.mjs

@@ -1,4 +1,4 @@
-import { t as DEVFRAME_EVENTS } from "./events-BV4Dj59a.mjs";
+import { t as DEVFRAME_EVENTS } from "./events-0wDwalmL.mjs";
 //#region src/constants.ts
 /** Devframe runtime routes and static output conventions. */
 const DEVFRAME_CONNECTION_META_FILENAME = "__connection.json";

package/dist/{context-BqpgC5tq.mjs → context-BKw9KkCR.mjs}

@@ -2,17 +2,17 @@ import { i as defineDiagnostics } from "./nostics-D0PvLZsn.mjs";
 import { r as diagnostics } from "./serialization-BhuOoL80.mjs";
 import { RpcFunctionsCollectorBase } from "./rpc/index.mjs";
 import { defineRpcFunction } from "./index.mjs";
-import { t as DEVFRAME_EVENTS } from "./events-BV4Dj59a.mjs";
+import { t as DEVFRAME_EVENTS } from "./events-0wDwalmL.mjs";
 import { DEVFRAME_SERVICES_STATE_KEY } from "./constants.mjs";
 import { t as diagnostics$1 } from "./diagnostics-Cx4_VjlG.mjs";
-import { r as createEventEmitter, t as DevframeAgentHost } from "./host-agent-mIbQ6Qi5.mjs";
+import { r as createEventEmitter, t as DevframeAgentHost } from "./host-agent-CJu735ch.mjs";
 import { n as createDebug, t as resolveStaticAssetsSource } from "./remote-assets-B9MeWmW6.mjs";
+import { t as createStorage } from "./storage-DPoitS2X.mjs";
 import { a as satisfiesVersionRange, n as expandResolveFrom, r as importServicePackage, t as deepMergeOptionSets } from "./services-install-D5YUwFXW.mjs";
-import { t as createStorage } from "./storage-CHD1IkqU.mjs";
-import { join } from "pathe";
+import { isAbsolute, join, relative } from "pathe";
 import { createSharedState } from "devframe/utils/shared-state";
-import process from "node:process";
 import { existsSync } from "node:fs";
+import process from "node:process";
 //#region src/node/host-diagnostics.ts
 var DevframeDiagnosticsHost = class {
 	context;
@@ -75,7 +75,7 @@ function removeClientAgentSession(context, meta) {
 //#region src/node/rpc-shared-state.ts
 const debug$2 = createDebug("devframe:rpc:state:changed");
 const debugSubscribe = createDebug("devframe:rpc:state:subscribe");
-function createRpcSharedStateServerHost(rpc) {
+function createRpcSharedStateServerHost(rpc, resolveState) {
 	const sharedState = /* @__PURE__ */ new Map();
 	const stateDisposers = /* @__PURE__ */ new Map();
 	const keyAddedListeners = /* @__PURE__ */ new Set();
@@ -116,19 +116,28 @@ function createRpcSharedStateServerHost(rpc) {
 			for (const off of offs) off();
 		};
 	}
+	function addState(key, state) {
+		debug$2("new-state", key);
+		stateDisposers.set(key, registerSharedState(key, state));
+		sharedState.set(key, state);
+		for (const fn of keyAddedListeners) fn(key);
+		return state;
+	}
+	function resolve(key) {
+		const existing = sharedState.get(key);
+		if (existing) return existing;
+		const state = resolveState?.(key);
+		return state ? addState(key, state) : void 0;
+	}
 	const host = {
 		get: async (key, options) => {
-			if (sharedState.has(key)) return sharedState.get(key);
+			const existing = resolve(key);
+			if (existing) return existing;
 			if (options?.initialValue === void 0 && options?.sharedState === void 0) throw diagnostics$1.DF0013({ key });
-			debug$2("new-state", key);
-			const state = options.sharedState ?? createSharedState({
+			return addState(key, options.sharedState ?? createSharedState({
 				initialValue: options.initialValue,
 				enablePatches: false
-			});
-			stateDisposers.set(key, registerSharedState(key, state));
-			sharedState.set(key, state);
-			for (const fn of keyAddedListeners) fn(key);
-			return state;
+			}));
 		},
 		keys() {
 			return Array.from(sharedState.keys());
@@ -165,8 +174,7 @@ function createRpcSharedStateServerHost(rpc) {
 		name: "devframe:rpc:server-state:get",
 		type: "query",
 		handler: async (key) => {
-			if (!sharedState.has(key)) return void 0;
-			return (await host.get(key)).value();
+			return resolve(key)?.value();
 		},
 		/**
 		* Pre-compute snapshots for the build-mode static dump so the SPA
@@ -194,8 +202,7 @@ function createRpcSharedStateServerHost(rpc) {
 		name: "devframe:rpc:server-state:patch",
 		type: "query",
 		handler: async (key, patches, syncId) => {
-			if (!sharedState.has(key)) return;
-			(await host.get(key)).patch(patches, syncId);
+			resolve(key)?.patch(patches, syncId);
 		}
 	});
 	return host;
@@ -771,6 +778,79 @@ function createRpcStreamingServerHost(rpc) {
 	};
 }
 //#endregion
+//#region src/settings-store.ts
+/**
+* The key-value store surface over a lazily-resolved shared state, shared by
+* the node-side (file-backed) and client-side (RPC-mirrored) settings stores.
+* Each side supplies its own `store()` resolver; the read/write/subscribe
+* behavior on top of it is identical.
+*/
+function createSettingsStore(store) {
+	return {
+		async get(key) {
+			return (await store()).value()?.[key];
+		},
+		async set(key, value) {
+			(await store()).mutate((draft) => {
+				if (draft === void 0) return { [key]: value };
+				draft[key] = value;
+			});
+		},
+		async delete(key) {
+			(await store()).mutate((draft) => {
+				if (draft !== void 0) delete draft[key];
+			});
+		},
+		async all() {
+			return (await store()).value() ?? {};
+		},
+		async onChange(fn) {
+			return (await store()).on("updated", (full) => fn(full ?? {}));
+		}
+	};
+}
+//#endregion
+//#region src/node/settings.ts
+const STORAGE_SCOPE = {
+	global: "global",
+	project: "project"
+};
+/** Resolve reserved settings keys before the sync protocol creates an in-memory state. */
+function resolveSettingsState(context, key) {
+	const match = /^devframe:settings:(global|project):(.+)$/.exec(key);
+	if (!match) return;
+	const scope = match[1];
+	const namespace = match[2];
+	const dir = join(context.host.getStorageDir(STORAGE_SCOPE[scope]), "settings");
+	const filepath = join(dir, `${namespace}.json`);
+	const path = relative(dir, filepath);
+	if (namespace.includes("\0") || path === ".." || path.startsWith("../") || isAbsolute(path)) return;
+	return createStorage({
+		filepath,
+		initialValue: {}
+	});
+}
+function createNodeSettingsStore(context, namespace, scope) {
+	const stateKey = `devframe:settings:${scope}:${namespace}`;
+	let statePromise;
+	function store() {
+		if (!statePromise) statePromise = context.rpc.sharedState.get(stateKey);
+		return statePromise;
+	}
+	return createSettingsStore(store);
+}
+/**
+* Build the node-side `settings` surface for a scope namespace. `project`
+* persists under the host's `project` storage dir, `global` under its
+* `global` dir. Each is a file-backed, client-synced key-value store.
+*/
+function createNodeSettings(context, namespace) {
+	return {
+		global: createNodeSettingsStore(context, namespace, "global"),
+		project: createNodeSettingsStore(context, namespace, "project")
+	};
+}
+//#endregion
 //#region src/node/host-functions.ts
 const debugBroadcast = createDebug("devframe:rpc:broadcast");
 /**
@@ -790,8 +870,19 @@ var RpcFunctionsHostImpl = class extends RpcFunctionsCollectorBase {
 	_asyncStorage = void 0;
 	constructor(context) {
 		super(context);
-		this.sharedState = createRpcSharedStateServerHost(this);
+		this.sharedState = createRpcSharedStateServerHost(this, (key) => resolveSettingsState(context, key));
 		this.streaming = createRpcStreamingServerHost(this);
+		this.register(defineRpcFunction({
+			name: "devframe:rpc:cacheable-functions",
+			type: "query",
+			handler: () => [...this.definitions.values()].filter((fn) => fn.type === "static" || fn.type === "query" && fn.cacheable === true).map((fn) => fn.name)
+		}));
+		this.onChanged(() => {
+			this.broadcast({
+				method: DEVFRAME_EVENTS.broadcast.cacheInvalidate,
+				args: []
+			});
+		});
 	}
 	sharedState;
 	streaming;
@@ -1191,70 +1282,6 @@ function qualifyName(namespace, name) {
 	return isQualifiedName(name) ? name : `${namespace}:${name}`;
 }
 //#endregion
-//#region src/settings-store.ts
-/**
-* The key-value store surface over a lazily-resolved shared state, shared by
-* the node-side (file-backed) and client-side (RPC-mirrored) settings stores.
-* Each side supplies its own `store()` resolver; the read/write/subscribe
-* behavior on top of it is identical.
-*/
-function createSettingsStore(store) {
-	return {
-		async get(key) {
-			return (await store()).value()[key];
-		},
-		async set(key, value) {
-			(await store()).mutate((draft) => {
-				draft[key] = value;
-			});
-		},
-		async delete(key) {
-			(await store()).mutate((draft) => {
-				delete draft[key];
-			});
-		},
-		async all() {
-			return (await store()).value();
-		},
-		async onChange(fn) {
-			return (await store()).on("updated", (full) => fn(full));
-		}
-	};
-}
-//#endregion
-//#region src/node/settings.ts
-const STORAGE_SCOPE = {
-	global: "global",
-	project: "project"
-};
-function createNodeSettingsStore(context, namespace, scope) {
-	const stateKey = `devframe:settings:${scope}:${namespace}`;
-	let statePromise;
-	function store() {
-		if (!statePromise) {
-			const dir = context.host.getStorageDir(STORAGE_SCOPE[scope]);
-			const filepath = join(dir, "settings", `${namespace}.json`);
-			statePromise = context.rpc.sharedState.get(stateKey, { sharedState: createStorage({
-				filepath,
-				initialValue: {}
-			}) });
-		}
-		return statePromise;
-	}
-	return createSettingsStore(store);
-}
-/**
-* Build the node-side `settings` surface for a scope namespace. `project`
-* persists under the host's `workspace` storage dir, `global` under its
-* `global` dir. Each is a file-backed, client-synced key-value store.
-*/
-function createNodeSettings(context, namespace) {
-	return {
-		global: createNodeSettingsStore(context, namespace, "global"),
-		project: createNodeSettingsStore(context, namespace, "project")
-	};
-}
-//#endregion
 //#region src/node/scope.ts
 function prefixDefinition(namespace, fn) {
 	if (isQualifiedName(fn.name)) throw diagnostics$1.DF0034({

package/dist/{context-CNX8VDIJ.d.mts → context-Bgvuxv1C.d.mts}

@@ -1,4 +1,4 @@
-import { k as SharedState, o as DevframeNodeContext } from "./context-BvaYawdU.mjs";
+import { k as SharedState, o as DevframeNodeContext } from "./context-DhycZ2lx.mjs";
 //#region src/node/hub-internals/context.d.ts
 interface InternalAnonymousAuthStorage {
   trusted: Record<string, {

package/dist/{context-CHpyLX8W.mjs → context-CNq7GLeT.mjs}

@@ -1,6 +1,6 @@
 import { n as randomToken } from "./crypto-token-TVbGGFuj.mjs";
-import { t as createStorage } from "./storage-CHD1IkqU.mjs";
-import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "./revoke-cqztiCX4.mjs";
+import { t as createStorage } from "./storage-DPoitS2X.mjs";
+import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "./revoke-CeQUo6KI.mjs";
 import { join } from "pathe";
 //#region src/node/hub-internals/context.ts
 const internalContextMap = /* @__PURE__ */ new WeakMap();

package/dist/{context-BvaYawdU.d.mts → context-DhycZ2lx.d.mts}

@@ -515,6 +515,8 @@ interface BrowserAgentToolManifest {
  * To be extended
  */
 interface DevframeRpcClientFunctions {
+  /** Clear cached RPC results and refresh cache eligibility. */
+  'devframe:rpc:cache:invalidate': () => Promise<void>;
   /** Invoke a tool registered in this browser document. @internal */
   'devframe:agent:invoke-client-tool': (id: string, args: Record<string, unknown>) => Promise<unknown>;
   /**
@@ -568,6 +570,8 @@ interface DevframeRpcClientFunctions {
  * To be extended
  */
 interface DevframeRpcServerFunctions {
+  /** Methods eligible for automatic client caching. @internal */
+  'devframe:rpc:cacheable-functions': () => Promise<string[]>;
   /** Replace this connection's browser-agent tool manifest, tagged with the calling tab's stable client id. @internal */
   'devframe:agent:sync-client-tools': (clientId: string, tools: BrowserAgentToolManifest[]) => Promise<void>;
   /**
@@ -1275,6 +1279,16 @@ interface McpRouteOptions {
    * prove identity too.
    */
   allowedOrigins?: readonly string[] | false;
+  /**
+   * Which shared-state keys the route exposes to agents, through the built-in
+   * `devframe_state_read` tool and the `devframe://state/<key>` resources.
+   * - `true` (default): every key the host publishes
+   * - `false`: none
+   * - `(key) => boolean`: only the keys the filter accepts
+   *
+   * The states themselves stay available to the UI over RPC.
+   */
+  exposeSharedState?: boolean | ((key: string) => boolean);
 }
 interface DevframeCliOptions {
   /** Binary name; default: the devframe's `id`. */

package/dist/{dev-CInztvNK.mjs → dev-BViAfnlw.mjs}

@@ -1,10 +1,10 @@
 import { DEVFRAME_CONNECTION_META_FILENAME } from "./constants.mjs";
 import { t as diagnostics } from "./diagnostics-Cx4_VjlG.mjs";
-import { t as createHostContext } from "./context-BqpgC5tq.mjs";
+import { t as createHostContext } from "./context-BKw9KkCR.mjs";
 import { t as resolveStaticAssetsSource } from "./remote-assets-B9MeWmW6.mjs";
-import { a as resolveMcpConfig, c as joinURL, d as withoutLeadingSlash, i as resolveDevServerPort, l as withBase, n as normalizeBasePath, r as resolveBasePath, s as importAgenticMcp, t as loadAutoMcpAdapter } from "./_shared-B2PZsp-J.mjs";
+import { a as resolveMcpConfig, c as joinURL, d as withoutLeadingSlash, i as resolveDevServerPort, l as withBase, n as normalizeBasePath, r as resolveBasePath, s as importAgenticMcp, t as loadAutoMcpAdapter } from "./_shared-DlRoV7v3.mjs";
 import { t as createH3DevframeHost } from "./host-h3-BROI6SQ4.mjs";
-import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-C3VrwJRS.mjs";
+import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-DmyVIJzj.mjs";
 import { open } from "./utils/open.mjs";
 import { mountStaticHandler } from "./utils/serve-static.mjs";
 import { resolve } from "pathe";
@@ -139,7 +139,7 @@ async function mountMcpRoute(app, context, def, base, setting) {
 	const mounted = module.mountMcpHttp(app, context, joinURL(base, route), {
 		serverName: `${def.id} (devframe)`,
 		serverVersion: def.version ?? "0.0.0",
-		exposeSharedState: true,
+		exposeSharedState: config.exposeSharedState ?? true,
 		authorization: config.authorization,
 		allowedOrigins: config.allowedOrigins
 	});