devframe 1.3.1 → 1.3.3

package/dist/index.d.mts

@@ -1,15 +1,14 @@
-import { C as RpcFunctionType, T as RpcReturnSchema, h as RpcFunctionDefinition, m as RpcFunctionAgentOptions, n as RpcArgsSchema } from "./types-BmDbfHCx.mjs";
-import { $ as DevframeServiceOf, $t as AgentToolProviderHandle, At as McpFetchHandler, B as DevframeSetupInfo, Ct as DevframeStorageScope, Dt as CreateMcpServerOptions, Et as CreateMcpFetchHandlerOptions, F as DevframeDefinition, Ft as McpResourceTemplate, G as McpAuthorization, Gt as AgentHandle, H as DevframeSnapshotRpcInputs, I as DevframeDeploymentKind, It as McpResourceTemplateContent, J as DevframeServiceDefinition, Jt as AgentResourceContent, K as McpRouteOptions, Kt as AgentManifest, L as DevframeDockDefaults, Lt as McpResourceTemplateEntry, Mt as McpPromptArgument, Nt as McpPromptMessage, Ot as McpConnectionInfo, P as DevframeCliOptions, Pt as McpPromptResult, Q as DevframeServiceMeta, Qt as AgentToolProvider, R as DevframeDuplicationStrategy, Rt as McpResourcesChangedHook, St as DevframeHost, Tt as DevframeDiagnosticsLogger, U as DevframeSseOptions, V as DevframeSnapshotRpcEntry, W as DevframeWsOptions, X as DevframeServiceId, Xt as AgentTool, Y as DevframeServiceDescriptor, Yt as AgentResourceInput, Z as DevframeServiceInput, Zt as AgentToolInput, _t as DevframeViewHost, a as DevframeConnectionConfigsRegistry, at as DevframeScopedNodeContext, bt as DevframeRpcSharedStates, c as RpcBroadcastOptions, ct as DevframeSettings, d as RpcSharedStateHost, dt as ScopedBroadcastOptions, en as DevframeAgentHost, et as DevframeServiceScopeOf, f as RpcStreamingChannel, ft as ScopedClientFunctions, gt as SettingsForNamespace, ht as ScopedSharedStates, i as DevframeCapabilities, in as EventsMap, it as DevframeServicesState, jt as McpPrompt, kt as McpContentBlock, l as RpcFunctionsHost, lt as DevframeSettingsRegistry, m as RpcStreamingHost, mt as ScopedServerFunctions, n as ConnectionMetaSse, nn as EventEmitter, nt as DevframeServicesRegistry, o as DevframeNodeContext, ot as DevframeScopedNodeRpc, p as RpcStreamingChannelOptions, pt as ScopedRpcFn, q as McpSetting, qt as AgentResource, r as ConnectionMetaWebsocket, rn as EventUnsubscribe, rt as DevframeServicesScopeRegistry, s as DevframeNodeRpcSession, st as DevframeScopedStreamingHost, t as ConnectionMeta, tn as DevframeAgentHostEvents, tt as DevframeServicesHost, u as RpcSharedStateGetOptions, ut as DevframeSettingsStore, vt as DevframeRpcClientFunctions, wt as DevframeDiagnosticsHost, yt as DevframeRpcServerFunctions, z as DevframeRpcOptions, zt as McpServerHandle } from "./context-BNxFOPbX.mjs";
-import { a as DevframeWsPeer, i as DevframeRpcTransportKind, n as DevframeRpcConnection, r as DevframeRpcConnectionRequest, t as DevframeNodeRpcSessionMeta } from "./session-r6PDixP6.mjs";
-import { a as RemoteAssetsStore, i as RemoteAssetsProviderCustom, n as RemoteAssetsErrorMessage, o as StaticAssetsSource, r as RemoteAssetsProvider, t as RemoteAssets } from "./remote-assets-eBvSKZMS.mjs";
-import { i as DevframeDefineDiagnosticsOptions } from "./nostics-DWvukRwa.mjs";
-import { n as withMcpContent } from "./mcp-content-QImBQO8e.mjs";
-//#region src/define.d.ts
+import { C as RpcFunctionType, T as RpcReturnSchema, h as RpcFunctionDefinition, m as RpcFunctionAgentOptions, n as RpcArgsSchema } from "./types-KZOyhez5.mjs";
+import { n as withMcpContent } from "./mcp-content-0a0mpCL5.mjs";
+import "./rpc/index.mjs";
+import { a as DevframeWsPeer, i as DevframeRpcTransportKind, n as DevframeRpcConnection, r as DevframeRpcConnectionRequest, t as DevframeNodeRpcSessionMeta } from "./session-Y9R6tqg4.mjs";
+import { DevframeDefineDiagnosticsOptions } from "./utils/nostics.mjs";
+import { a as RemoteAssetsStore, i as RemoteAssetsProviderCustom, n as RemoteAssetsErrorMessage, o as StaticAssetsSource, r as RemoteAssetsProvider, t as RemoteAssets } from "./remote-assets-5AQMHZnV.mjs";
+import { $ as DevframeServiceId, $t as AgentToolProviderHandle, B as DevframeNodeRpcSession, C as McpPromptResult, Ct as DevframeDiagnosticsHost, D as McpResourcesChangedHook, E as McpResourceTemplateEntry, F as ConnectionMetaSse, G as RpcStreamingChannel, Gt as AgentHandle, H as RpcFunctionsHost, I as ConnectionMetaWebsocket, J as DevframeRpcClientFunctions, Jt as AgentResourceContent, K as RpcStreamingChannelOptions, Kt as AgentManifest, L as DevframeCapabilities, O as McpServerHandle, P as ConnectionMeta, Q as DevframeServiceDescriptor, Qt as AgentToolProvider, R as DevframeConnectionConfigsRegistry, S as McpPromptMessage, St as DevframeStorageScope, T as McpResourceTemplateContent, U as RpcSharedStateGetOptions, V as RpcBroadcastOptions, W as RpcSharedStateHost, X as DevframeRpcSharedStates, Xt as AgentTool, Y as DevframeRpcServerFunctions, Yt as AgentResourceInput, Z as DevframeServiceDefinition, Zt as AgentToolInput, _ as McpConnectionInfo, _t as ScopedServerFunctions, a as DevframeDuplicationStrategy, at as DevframeServicesRegistry, b as McpPrompt, bt as DevframeViewHost, c as DevframeSnapshotRpcEntry, ct as DevframeScopedNodeContext, d as DevframeWsOptions, dt as DevframeSettings, en as DevframeAgentHost, et as DevframeServiceInput, f as McpAuthorization, ft as DevframeSettingsRegistry, g as CreateMcpServerOptions, gt as ScopedRpcFn, h as CreateMcpFetchHandlerOptions, ht as ScopedClientFunctions, i as DevframeDockDefaults, in as EventsMap, it as DevframeServicesHost, l as DevframeSnapshotRpcInputs, lt as DevframeScopedNodeRpc, m as McpSetting, mt as ScopedBroadcastOptions, n as DevframeDefinition, nn as EventEmitter, nt as DevframeServiceOf, o as DevframeRpcOptions, ot as DevframeServicesScopeRegistry, p as McpRouteOptions, pt as DevframeSettingsStore, q as RpcStreamingHost, qt as AgentResource, r as DevframeDeploymentKind, rn as EventUnsubscribe, rt as DevframeServiceScopeOf, s as DevframeSetupInfo, st as DevframeServicesState, t as DevframeCliOptions, tn as DevframeAgentHostEvents, tt as DevframeServiceMeta, u as DevframeSseOptions, ut as DevframeScopedStreamingHost, v as McpContentBlock, vt as ScopedSharedStates, w as McpResourceTemplate, wt as DevframeDiagnosticsLogger, x as McpPromptArgument, xt as DevframeHost, y as McpFetchHandler, yt as SettingsForNamespace, z as DevframeNodeContext } from "./index-BhUqJUHG.mjs";
 export declare const defineRpcFunction: <NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>) => RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>;
 /**
  * Identity helper that types a devframe definition, the primary authoring
  * entry point. Import it from the package root: `import { defineDevframe } from 'devframe'`.
  */
 export declare function defineDevframe(d: DevframeDefinition): DevframeDefinition;
-//#endregion
 export { type AgentHandle, type AgentManifest, type AgentResource, type AgentResourceContent, type AgentResourceInput, type AgentTool, type AgentToolInput, type AgentToolProvider, type AgentToolProviderHandle, type ConnectionMeta, type ConnectionMetaSse, type ConnectionMetaWebsocket, type CreateMcpFetchHandlerOptions, type CreateMcpServerOptions, type DevframeAgentHost, type DevframeAgentHostEvents, type DevframeCapabilities, type DevframeCliOptions, type DevframeConnectionConfigsRegistry, type DevframeDefineDiagnosticsOptions, type DevframeDefinition, type DevframeDeploymentKind, type DevframeDiagnosticsHost, type DevframeDiagnosticsLogger, type DevframeDockDefaults, type DevframeDuplicationStrategy, type DevframeHost, type DevframeNodeContext, type DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, type DevframeRpcClientFunctions, type DevframeRpcConnection, type DevframeRpcConnectionRequest, type DevframeRpcOptions, type DevframeRpcServerFunctions, type DevframeRpcSharedStates, type DevframeRpcTransportKind, type DevframeScopedNodeContext, type DevframeScopedNodeRpc, type DevframeScopedStreamingHost, type DevframeServiceDefinition, type DevframeServiceDescriptor, type DevframeServiceId, type DevframeServiceInput, type DevframeServiceMeta, type DevframeServiceOf, type DevframeServiceScopeOf, type DevframeServicesHost, type DevframeServicesRegistry, type DevframeServicesScopeRegistry, type DevframeServicesState, type DevframeSettings, type DevframeSettingsRegistry, type DevframeSettingsStore, type DevframeSetupInfo, type DevframeSnapshotRpcEntry, type DevframeSnapshotRpcInputs, type DevframeSseOptions, type DevframeStorageScope, type DevframeViewHost, type DevframeWsOptions, type DevframeWsPeer, type EventEmitter, type EventUnsubscribe, type EventsMap, type McpAuthorization, type McpConnectionInfo, type McpContentBlock, type McpFetchHandler, type McpPrompt, type McpPromptArgument, type McpPromptMessage, type McpPromptResult, type McpResourceTemplate, type McpResourceTemplateContent, type McpResourceTemplateEntry, type McpResourcesChangedHook, type McpRouteOptions, type McpServerHandle, type McpSetting, type RemoteAssets, type RemoteAssetsErrorMessage, type RemoteAssetsProvider, type RemoteAssetsProviderCustom, type RemoteAssetsStore, type RpcBroadcastOptions, type RpcFunctionAgentOptions, type RpcFunctionsHost, type RpcSharedStateGetOptions, type RpcSharedStateHost, type RpcStreamingChannel, type RpcStreamingChannelOptions, type RpcStreamingHost, type ScopedBroadcastOptions, type ScopedClientFunctions, type ScopedRpcFn, type ScopedServerFunctions, type ScopedSharedStates, type SettingsForNamespace, type StaticAssetsSource, withMcpContent };

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { n as withMcpContent } from "./mcp-content-DN3O212x.mjs";
-import { t as createDefineWrapperWithContext } from "./define-BLWPsH6y.mjs";
-//#region src/define.ts
+import { n as withMcpContent } from "./mcp-content-CqU8yaF7.mjs";
+import { t as createDefineWrapperWithContext } from "./define-C8h-fyD3.mjs";
+// src/define.ts
 const defineRpcFunction = createDefineWrapperWithContext();
 /**
 * Identity helper that types a devframe definition, the primary authoring
@@ -9,5 +9,4 @@ const defineRpcFunction = createDefineWrapperWithContext();
 function defineDevframe(d) {
 	return d;
 }
-//#endregion
 export { defineDevframe, defineRpcFunction, withMcpContent };

package/dist/{instance-registry-C_4PpB6N.mjs → instance-registry-DwmnWyCK.mjs}

@@ -1,16 +1,11 @@
-import { n as __exportAll } from "./rolldown-runtime-B4iAMlE-.mjs";
-import { t as diagnostics } from "./diagnostics-E_PvUPsA.mjs";
+import { n as __exportAll } from "./rolldown-runtime-BVN1G_yT.mjs";
+import { t as diagnostics } from "./diagnostics-DC1-WcvN.mjs";
 import { join } from "pathe";
 import { mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import process from "node:process";
 import { homedir } from "node:os";
-//#region src/node/instance-registry.ts
-var instance_registry_exports = /* @__PURE__ */ __exportAll({
-	listLiveDevframeInstances: () => listLiveDevframeInstances,
-	probeDevframeOrigin: () => probeDevframeOrigin,
-	readDevframeInstances: () => readDevframeInstances,
-	registerDevframeInstance: () => registerDevframeInstance
-});
+// src/node/instance-registry.ts
+var instance_registry_exports = /* @__PURE__ */ __exportAll({ registerDevframeInstance: () => registerDevframeInstance });
 /** Environment variable overriding the registry directory (tests, CI). */
 const DEVFRAME_INSTANCES_DIR_ENV = "DEVFRAME_INSTANCES_DIR";
 /** Environment variable disabling instance registration entirely. */
@@ -191,5 +186,4 @@ async function listLiveDevframeInstances(options = {}) {
 		pruned
 	};
 }
-//#endregion
 export { registerDevframeInstance as i, listLiveDevframeInstances as n, probeDevframeOrigin as r, instance_registry_exports as t };

package/dist/{instance-shell-m4sY2oTG.mjs → instance-shell-Coid7CP6.mjs}

@@ -1,15 +1,15 @@
+import { r as validateOriginCandidate } from "./origin-Ck7mLbKU.mjs";
+import { c as joinURL, d as withoutLeadingSlash, f as withoutTrailingSlash, u as withLeadingSlash } from "./_shared-CtXCQFTV.mjs";
 import "./constants.mjs";
-import { r as validateOriginCandidate } from "./origin-DZit9g29.mjs";
-import { t as diagnostics } from "./diagnostics-E_PvUPsA.mjs";
-import { c as joinURL, d as withoutLeadingSlash, f as withoutTrailingSlash, u as withLeadingSlash } from "./_shared-C61zPwIz.mjs";
-import { t as getInternalContext } from "./context-D_jSSdME.mjs";
-import { n as createInteractiveAuth } from "./interactive-auth-DdDxs3WF.mjs";
+import { n as createInteractiveAuth } from "./interactive-auth-BURwIAvE.mjs";
+import { t as diagnostics } from "./diagnostics-DC1-WcvN.mjs";
+import { t as getInternalContext } from "./context-BTxC4QrJ.mjs";
 import { createServer } from "node:http";
 import process from "node:process";
 import { isIP } from "node:net";
 import { Server } from "node:tls";
-import { H3, defineHandler, toNodeHandler } from "h3";
-//#region src/node/listen.ts
+import { H3, defineHandler, fromNodeHandler, toNodeHandler } from "h3";
+// src/node/listen.ts
 function listen(server, port, host) {
 	return new Promise((resolve, reject) => {
 		const onError = (error) => reject(error);
@@ -54,8 +54,7 @@ async function listenWithLoopbackTwin(server, port, host) {
 		throw error;
 	}
 }
-//#endregion
-//#region src/node/runtime.ts
+// src/node/runtime.ts
 /**
 * Detect the current server runtime from its runtime-specific global. The
 * WebSocket binding branches on this: Bun and Deno expose their sockets as
@@ -69,8 +68,7 @@ function detectServerRuntime() {
 	if (typeof g.Bun !== "undefined") return "bun";
 	return "node";
 }
-//#endregion
-//#region src/node/utils.ts
+// src/node/utils.ts
 const NON_DIALABLE_HOSTS = /* @__PURE__ */ new Set([
 	"0.0.0.0",
 	"127.0.0.1",
@@ -90,8 +88,7 @@ function formatHostForUrl(host) {
 function normalizeHttpServerUrl(host, port) {
 	return `http://${formatHostForUrl(host)}:${port}`;
 }
-//#endregion
-//#region src/node/instance-shell.ts
+// src/node/instance-shell.ts
 function websocketConnectionMeta(rpcHost, path) {
 	const jsonSerializableMethods = [];
 	for (const def of rpcHost.definitions.values()) if (def.jsonSerializable === true) jsonSerializableMethods.push(def.name);
@@ -362,7 +359,7 @@ function createInstanceShell(options) {
 		const origin = currentOrigin();
 		if (!cfg || registerPromise || !origin || !meta) return;
 		const resolvedMeta = meta;
-		registerPromise = import("./instance-registry-C_4PpB6N.mjs").then((n) => n.t).then(({ registerDevframeInstance }) => {
+		registerPromise = import("./instance-registry-DwmnWyCK.mjs").then((n) => n.t).then(({ registerDevframeInstance }) => {
 			let port = 0;
 			try {
 				const url = new URL(origin);
@@ -398,6 +395,29 @@ function createInstanceShell(options) {
 		}
 		maybeRegister();
 	}
+	/**
+	* The host stack's `next` for each in-flight `nodeMiddleware` request at
+	* base `/`, read by the fall-through middleware mounted at the end of
+	* `init()`.
+	*/
+	const hostFallthrough = /* @__PURE__ */ new WeakMap();
+	/**
+	* A devframe at `/` shares the origin root with its host, so it can't claim
+	* every path the way it owns a `/__<id>/` base. A `nodeMiddleware` request
+	* that no route answers goes to the host's `next` instead of h3's 404, so
+	* the host app (e.g. Vite with the bridge) keeps serving its own pages.
+	*/
+	function mountHostFallthrough() {
+		if (base !== "/") return;
+		app.use((event, next) => {
+			if (event.context.matchedRoute) return next();
+			const nodeReq = event.runtime?.node?.req;
+			const hostNext = nodeReq && hostFallthrough.get(nodeReq);
+			if (!hostNext) return next();
+			hostFallthrough.delete(nodeReq);
+			return fromNodeHandler((_req, _res, _next) => hostNext())(event);
+		});
+	}
 	let started;
 	let transport;
 	let dispose;
@@ -438,7 +458,7 @@ function createInstanceShell(options) {
 	let resolvedAuth = false;
 	let corePromise;
 	function ensureCore() {
-		corePromise ??= import("./rpc-core-BLc5hm9X.mjs").then((n) => n.n).then(({ createContextRpcServer }) => createContextRpcServer({
+		corePromise ??= import("./rpc-core-BmDHiDR6.mjs").then((n) => n.n).then(({ createContextRpcServer }) => createContextRpcServer({
 			context: ctx,
 			auth: resolvedAuth,
 			onPeerConnect: options.onPeerConnect,
@@ -482,7 +502,7 @@ function createInstanceShell(options) {
 			return nativeRuntime ? bindNativeHttpAndWs(runtime, bindOptions) : bindHttpAndWs(bindOptions);
 		};
 		if (ws.port != null) return await start(ws.port);
-		const { getPort } = await import("./dist-CZXfGEkd.mjs").then((n) => n.t);
+		const { getPort } = await import("./dist-CZ-TySHD.mjs").then((n) => n.t);
 		let lastError;
 		for (let attempt = 0; attempt < 3; attempt++) {
 			const port = attempt === 0 && options.resolveSidecarPort ? await options.resolveSidecarPort(sidecarHost) : await getPort({
@@ -566,6 +586,7 @@ function createInstanceShell(options) {
 		};
 		if (Object.keys(ctx.staticConfig).length > 0) meta.configs = ctx.staticConfig;
 		await options.mount?.(ctx, meta, api);
+		mountHostFallthrough();
 		maybeRegister();
 	}
 	const initPromise = init();
@@ -625,6 +646,7 @@ function createInstanceShell(options) {
 				const { toNodeHandler } = await import("h3/node");
 				nodeHandler = toNodeHandler(app);
 			}
+			if (next && base === "/") hostFallthrough.set(req, () => next());
 			return nodeHandler(req, res);
 		}).catch((err) => {
 			if (next) {
@@ -699,5 +721,4 @@ function createInstanceShell(options) {
 		}
 	};
 }
-//#endregion
 export { isAddressInUse as a, normalizeHttpServerUrl as i, resolveInstanceRegister as n, listenWithLoopbackTwin as o, samePath as r, createInstanceShell as t };

package/dist/{instance-shell-GihbmXoF.d.mts → instance-shell-DTk514M9.d.mts}

@@ -1,14 +1,13 @@
-import { n as BirpcGroup } from "./index-Bia1vKjL.mjs";
-import { Bt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, o as DevframeNodeContext, s as DevframeNodeRpcSession, t as ConnectionMeta, vt as DevframeRpcClientFunctions, yt as DevframeRpcServerFunctions } from "./context-BNxFOPbX.mjs";
-import { n as DevframeRpcConnection, t as DevframeNodeRpcSessionMeta } from "./session-r6PDixP6.mjs";
-import { n as WsOriginRegistry } from "./ws-server-y2R76aSW.mjs";
-import "./index-CxJatyA1.mjs";
-import { H3 } from "h3";
+import { n as BirpcGroup } from "./index-BKu9BxcT.mjs";
+import { WsOriginRegistry } from "./rpc/transports/ws-server.mjs";
+import { n as DevframeRpcConnection, t as DevframeNodeRpcSessionMeta } from "./session-Y9R6tqg4.mjs";
+import { B as DevframeNodeRpcSession, J as DevframeRpcClientFunctions, P as ConnectionMeta, Y as DevframeRpcServerFunctions, d as DevframeWsOptions, k as DevframeAuthHandler, u as DevframeSseOptions, z as DevframeNodeContext } from "./index-BhUqJUHG.mjs";
+import "./node/auth.mjs";
 import { NodeAdapter } from "crossws/adapters/node";
 import { Buffer } from "node:buffer";
 import { IncomingMessage, Server, ServerResponse } from "node:http";
 import { Duplex } from "node:stream";
-//#region src/node/instance-registry.d.ts
+import { H3 } from "h3";
 /**
  * One running devframe instance, as recorded in the instance registry.
  * Records are self-describing JSON, so additive fields are safe.
@@ -111,8 +110,6 @@ declare function listLiveDevframeInstances(options?: {
   live: DevframeInstanceRecord[];
   pruned: DevframeInstanceRecord[];
 }>;
-//#endregion
-//#region src/node/instance-shell.d.ts
 /**
  * The live handle for a bound HTTP + WebSocket RPC server: what the
  * side-car / shared-server tiers produce and what {@link createDevServer}
@@ -287,5 +284,4 @@ declare function samePath(a: string, b: string): boolean;
  * @internal
  */
 declare function createInstanceShell<TContext extends DevframeNodeContext>(options: CreateInstanceShellOptions<TContext>): InstanceShell<TContext>;
-//#endregion
 export { InstanceShellInit as a, StartedServer as c, samePath as d, DevframeInstanceRecord as f, registerDevframeInstance as g, probeDevframeOrigin as h, InstanceShellApi as i, createInstanceShell as l, listLiveDevframeInstances as m, InstanceRegisterConfig as n, InstanceShellInternals as o, DevframeInstanceRegistration as p, InstanceShell as r, InstanceWsTier as s, CreateInstanceShellOptions as t, resolveInstanceRegister as u };

package/dist/{interactive-auth-DdDxs3WF.mjs → interactive-auth-BURwIAvE.mjs}

@@ -1,9 +1,9 @@
-import { s as colors } from "./nostics-D0PvLZsn.mjs";
-import { n as defineRpcFunction } from "./define-BLWPsH6y.mjs";
+import { s as colors } from "./nostics-InlX4tmd.mjs";
 import { isAnonymousRpcMethod } from "./constants.mjs";
-import { a as getTempAuthCodeInfo, n as describeUA, o as refreshTempAuthCode, r as exchangeTempAuthCode, s as verifyAuthToken, t as buildOtpAuthUrl } from "./state-W4wI6X5X.mjs";
-import { t as getInternalContext } from "./context-D_jSSdME.mjs";
-//#region src/utils/simple-schema.ts
+import { a as getTempAuthCodeInfo, n as describeUA, o as refreshTempAuthCode, r as exchangeTempAuthCode, s as verifyAuthToken, t as buildOtpAuthUrl } from "./state-B_yjfeqo.mjs";
+import { t as getInternalContext } from "./context-BTxC4QrJ.mjs";
+import { n as defineRpcFunction } from "./define-C8h-fyD3.mjs";
+// src/utils/simple-schema.ts
 function ok(value) {
 	return { value };
 }
@@ -155,8 +155,7 @@ const s = {
 	nullable,
 	describe
 };
-//#endregion
-//#region src/recipes/interactive-auth.ts
+// src/recipes/interactive-auth.ts
 /**
 * Build a {@link AuthBannerFunction} that renders the auth code + magic-link
 * URL as a small bordered box, its two rows label-aligned. `createInteractiveAuth`
@@ -380,5 +379,4 @@ function createInteractiveAuth(context, options = {}) {
 		buildOpenUrl
 	};
 }
-//#endregion
 export { createInteractiveAuth as n, createAuthBanner as t };

package/dist/internal/index.d.mts

@@ -1,13 +1,12 @@
-import { t as StandardSchemaV1 } from "../index-CeEtxDmK.mjs";
-import { g as RpcFunctionDefinitionAny } from "../types-BmDbfHCx.mjs";
-import { $t as AgentToolProviderHandle, Gt as AgentHandle, Jt as AgentResourceContent, Kt as AgentManifest, Qt as AgentToolProvider, St as DevframeHost, Xt as AgentTool, Yt as AgentResourceInput, Zt as AgentToolInput, en as DevframeAgentHost$1, nn as EventEmitter, o as DevframeNodeContext, qt as AgentResource, tn as DevframeAgentHostEvents, xt as BrowserAgentClientInfo } from "../context-BNxFOPbX.mjs";
-import { a as RemoteAssetsStore } from "../remote-assets-eBvSKZMS.mjs";
-import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, g as registerDevframeInstance, h as probeDevframeOrigin, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-GihbmXoF.mjs";
-import { i as importAgenticMcp, n as MountMcpHttpOptions, r as MountedMcpHttp, t as AgenticMcpModule } from "../agentic-C6SCkdtj.mjs";
-import { a as resolveBasePath, i as normalizeBasePath, n as ResolvedMcpConfig, r as loadAutoMcpAdapter, s as resolveMcpConfig } from "../_shared-Cm4iD0L3.mjs";
-import { t as getMcpContent } from "../mcp-content-QImBQO8e.mjs";
-import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-CGTCla-R.mjs";
-//#region src/agent/stringify.d.ts
+import { a as resolveBasePath, i as normalizeBasePath, n as ResolvedMcpConfig, r as loadAutoMcpAdapter, s as resolveMcpConfig } from "../_shared-BxeuukaL.mjs";
+import { t as getMcpContent } from "../mcp-content-0a0mpCL5.mjs";
+import { t as StandardSchemaV1 } from "../index-BIRF0E5l.mjs";
+import { i as importAgenticMcp, n as MountMcpHttpOptions, r as MountedMcpHttp, t as AgenticMcpModule } from "../agentic-DVgUzwhV.mjs";
+import { $t as AgentToolProviderHandle, Gt as AgentHandle, Jt as AgentResourceContent, Kt as AgentManifest, Qt as AgentToolProvider, Tt as BrowserAgentClientInfo, Xt as AgentTool, Yt as AgentResourceInput, Zt as AgentToolInput, en as DevframeAgentHost$1, nn as EventEmitter, qt as AgentResource, tn as DevframeAgentHostEvents, xt as DevframeHost, z as DevframeNodeContext } from "../index-BhUqJUHG.mjs";
+import { a as RemoteAssetsStore } from "../remote-assets-5AQMHZnV.mjs";
+import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, g as registerDevframeInstance, h as probeDevframeOrigin, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-DTk514M9.mjs";
+import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-CblgPYJ_.mjs";
+import { g as RpcFunctionDefinitionAny } from "../types-KZOyhez5.mjs";
 /**
  * JSON-coercing serializer for MCP text payloads.
  *
@@ -38,8 +37,6 @@ export declare function stringifyForMcp(value: unknown): string;
  * level of `cause.message` so context isn't dropped silently.
  */
 export declare function formatMcpError(error: unknown): string;
-//#endregion
-//#region src/agent/to-json-schema.d.ts
 /**
  * JSON Schema for an RPC return value on the agent/MCP surface.
  *
@@ -63,8 +60,6 @@ export declare function returnToJsonSchema(schema: StandardSchemaV1 | undefined)
  * @internal
  */
 export declare function argsToJsonSchema(args: readonly StandardSchemaV1[] | undefined): unknown;
-//#endregion
-//#region src/node/client-agent.d.ts
 /** Id of the built-in tool listing connected browser tabs (wire name `devframe_agent_list-clients`). */
 export declare const LIST_CLIENTS_TOOL = "devframe:agent:list-clients";
 /** One connected browser tab as reported by {@link LIST_CLIENTS_TOOL}. */
@@ -73,8 +68,6 @@ interface ConnectedClient extends BrowserAgentClientInfo {
   connectedAt: number;
   tools: string[];
 }
-//#endregion
-//#region src/node/diagnostics.d.ts
 /**
  * DF00xx codes are allocated across packages (e.g. @devframes/json-render
  * owns DF0037–DF0041), so this file alone doesn't show the next free
@@ -423,8 +416,6 @@ export declare const diagnostics: import("nostics").Diagnostics<{
 }, readonly [(d: import("nostics").Diagnostic, { method }?: {
   method?: "log" | "warn" | "error";
 }) => void], never>;
-//#endregion
-//#region src/node/host-agent.d.ts
 /**
  * Framework-neutral host aggregating the agent-exposed surface of a
  * devframe. Auto-discovers RPC functions with an `agent` field from
@@ -459,8 +450,6 @@ export declare class DevframeAgentHost implements DevframeAgentHost$1 {
   private _collectRpcTools;
   private _findRpcDefinition;
 }
-//#endregion
-//#region src/node/host-h3.d.ts
 export interface CreateH3DevframeHostOptions {
   /**
    * Host the standalone server listens on, e.g. `http://localhost:9999`.
@@ -496,8 +485,6 @@ export interface CreateH3DevframeHostOptions {
  * h3-backed {@link DevframeHost}, used by the standalone CLI adapter.
  */
 export declare function createH3DevframeHost(options: CreateH3DevframeHostOptions): DevframeHost;
-//#endregion
-//#region src/node/import-runtime-module.d.ts
 /**
  * Resolve and import a package at runtime without adding it to a consumer's
  * bundle graph. First-party adapters use this for modules whose code is
@@ -507,11 +494,7 @@ export declare function createH3DevframeHost(options: CreateH3DevframeHostOption
  * @internal
  */
 export declare function importRuntimeModule<T = unknown>(specifier: string): Promise<T>;
-//#endregion
-//#region src/node/utils.d.ts
 export declare function normalizeHttpServerUrl(host: string, port: number | string): string;
-//#endregion
-//#region src/rpc/wire-codec.d.ts
 /**
  * The per-connection `serialize`/`deserialize` pair for a live RPC wire.
  *
@@ -545,9 +528,6 @@ export declare function peekRpcWireFrame(raw: string): {
   t?: string;
   i?: string;
 };
-//#endregion
-//#region src/tool-input.d.ts
 /** Convert tool input for a command, whose arguments must be declared. */
 export declare function toolInputToCommandArgs(input: unknown, argumentCount?: number): unknown[];
-//#endregion
 export { type AgenticMcpModule, type ConnectedClient, type ContextRpcServer, type CreateContextRpcServerOptions, type CreateInstanceShellOptions, type DevframeInstanceRecord, type DevframeInstanceRegistration, type InstanceRegisterConfig, type InstanceShell, type InstanceShellApi, type InstanceShellInit, type InstanceShellInternals, type InstanceWsTier, type MountMcpHttpOptions, type MountedMcpHttp, type ResolvedMcpConfig, type RpcWireCodec, type StartedServer, createContextRpcServer, createInstanceShell, getMcpContent, importAgenticMcp, listLiveDevframeInstances, loadAutoMcpAdapter, normalizeBasePath, probeDevframeOrigin, registerDevframeInstance, resolveBasePath, resolveInstanceRegister, resolveMcpConfig, samePath };

package/dist/internal/index.mjs

@@ -1,15 +1,15 @@
-import { t as getMcpContent } from "../mcp-content-DN3O212x.mjs";
-import { t as Diagnostic } from "../nostics-D0PvLZsn.mjs";
-import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../wire-codec-B1W3zH3L.mjs";
-import { t as diagnostics } from "../diagnostics-E_PvUPsA.mjs";
-import { a as toolInputToCommandArgs, i as DevframeAgentHost, t as LIST_CLIENTS_TOOL } from "../client-agent-iBkMYxqn.mjs";
-import { a as resolveMcpConfig, n as normalizeBasePath, r as resolveBasePath, s as importAgenticMcp, t as loadAutoMcpAdapter } from "../_shared-C61zPwIz.mjs";
-import { t as importRuntimeModule } from "../import-runtime-module-BzlEQ9PI.mjs";
-import { t as createH3DevframeHost } from "../host-h3-BROI6SQ4.mjs";
-import { i as registerDevframeInstance, n as listLiveDevframeInstances, r as probeDevframeOrigin } from "../instance-registry-C_4PpB6N.mjs";
-import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-m4sY2oTG.mjs";
-import { t as createContextRpcServer } from "../rpc-core-BLc5hm9X.mjs";
-//#region src/agent/stringify.ts
+import { a as resolveMcpConfig, n as normalizeBasePath, r as resolveBasePath, s as importAgenticMcp, t as loadAutoMcpAdapter } from "../_shared-CtXCQFTV.mjs";
+import { t as getMcpContent } from "../mcp-content-CqU8yaF7.mjs";
+import { t as Diagnostic } from "../nostics-InlX4tmd.mjs";
+import { a as toolInputToCommandArgs, i as DevframeAgentHost, t as LIST_CLIENTS_TOOL } from "../client-agent-qNMgDUev.mjs";
+import { t as diagnostics } from "../diagnostics-DC1-WcvN.mjs";
+import { t as createH3DevframeHost } from "../host-h3-D1uj5EM8.mjs";
+import { t as importRuntimeModule } from "../import-runtime-module-DsdqJ1gK.mjs";
+import { i as registerDevframeInstance, n as listLiveDevframeInstances, r as probeDevframeOrigin } from "../instance-registry-DwmnWyCK.mjs";
+import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-Coid7CP6.mjs";
+import { t as createContextRpcServer } from "../rpc-core-BmDHiDR6.mjs";
+import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../wire-codec-BdngvzfH.mjs";
+// src/agent/stringify.ts
 /**
 * JSON-coercing serializer for MCP text payloads.
 *
@@ -82,8 +82,7 @@ function formatMcpError(error) {
 	const causeText = cause instanceof Error ? ` (cause: ${cause.message})` : cause !== void 0 ? ` (cause: ${String(cause)})` : "";
 	return `${error.name}: ${error.message}${causeText}`;
 }
-//#endregion
-//#region src/agent/to-json-schema.ts
+// src/agent/to-json-schema.ts
 const FALLBACK_OBJECT_SCHEMA = Object.freeze({
 	type: "object",
 	additionalProperties: true
@@ -156,5 +155,4 @@ function argsToJsonSchema(args) {
 		additionalProperties: false
 	};
 }
-//#endregion
 export { DevframeAgentHost, LIST_CLIENTS_TOOL, argsToJsonSchema, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, formatMcpError, getMcpContent, importAgenticMcp, importRuntimeModule, listLiveDevframeInstances, loadAutoMcpAdapter, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, probeDevframeOrigin, registerDevframeInstance, resolveBasePath, resolveInstanceRegister, resolveMcpConfig, returnToJsonSchema, samePath, stringifyForMcp, toolInputToCommandArgs };

package/dist/{mcp-content-QImBQO8e.d.mts → mcp-content-0a0mpCL5.d.mts}

@@ -1,5 +1,4 @@
-import { kt as McpContentBlock } from "./context-BNxFOPbX.mjs";
-//#region src/agent/mcp-content.d.ts
+import { v as McpContentBlock } from "./index-BhUqJUHG.mjs";
 /**
  * Attach MCP content blocks to a tool result, for example an image next to
  * its text. The MCP adapter sends these blocks as the `content` of the
@@ -21,5 +20,4 @@ declare function withMcpContent<T extends object>(value: T, content: readonly Mc
  * @internal
  */
 declare function getMcpContent(value: unknown): unknown;
-//#endregion
 export { withMcpContent as n, getMcpContent as t };

package/dist/{mcp-content-DN3O212x.mjs → mcp-content-CqU8yaF7.mjs}

@@ -1,4 +1,4 @@
-//#region src/agent/mcp-content.ts
+// src/agent/mcp-content.ts
 /**
 * Registry symbol for the content blocks attached by {@link withMcpContent}.
 * `Symbol.for` keeps the key the same across duplicate copies of devframe.
@@ -36,5 +36,4 @@ function getMcpContent(value) {
 	if (value === null || typeof value !== "object") return void 0;
 	return value[MCP_CONTENT];
 }
-//#endregion
 export { withMcpContent as n, getMcpContent as t };

package/dist/{mrmime-40h5OOIp.mjs → mrmime-y_XyiVcd.mjs}

@@ -1,4 +1,4 @@
-//#region ../../node_modules/.pnpm/mrmime@2.0.1/node_modules/mrmime/index.mjs
+// ../../node_modules/.pnpm/mrmime@2.0.1/node_modules/mrmime/index.mjs
 const mimes = {
 	"3g2": "video/3gpp2",
 	"3gp": "video/3gpp",
@@ -444,5 +444,4 @@ function lookup(extn) {
 	let idx = tmp.lastIndexOf(".");
 	return mimes[!~idx ? tmp : tmp.substring(++idx)];
 }
-//#endregion
 export { lookup as t };

package/dist/node/auth.d.mts

@@ -1,3 +1,84 @@
-import { Bt as DevframeAuthHandler } from "../context-BNxFOPbX.mjs";
-import { a as getTempAuthCodeInfo, c as revokeActiveConnectionsForToken, i as getTempAuthCode, l as revokeAuthToken, n as describeUA, o as refreshTempAuthCode, r as exchangeTempAuthCode, s as verifyAuthToken, t as buildOtpAuthUrl } from "../index-CxJatyA1.mjs";
-export { DevframeAuthHandler, buildOtpAuthUrl, describeUA, exchangeTempAuthCode, getTempAuthCode, getTempAuthCodeInfo, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };
+import { B as DevframeNodeRpcSession, Bt as SharedState, k as DevframeAuthHandler, z as DevframeNodeContext } from "../index-BhUqJUHG.mjs";
+import { n as InternalAnonymousAuthStorage } from "../context-B-AARy_U.mjs";
+/**
+ * Flip `isTrusted` to false on any live WS clients connected with `token`
+ * and broadcast the `auth:revoked` event so they can react.
+ *
+ * Shared between persisted-auth revocation and remote-dock token revocation.
+ */
+export declare function revokeActiveConnectionsForToken(context: DevframeNodeContext, token: string): Promise<void>;
+/**
+ * Revoke an auth token: remove from storage and notify all connected clients
+ * using this token that they are no longer trusted.
+ */
+export declare function revokeAuthToken(context: DevframeNodeContext, storage: SharedState<InternalAnonymousAuthStorage>, token: string): Promise<void>;
+/**
+ * Format a raw `navigator.userAgent` string into the short display label
+ * shown for a trusted device (e.g. "Chrome 120 | macOS 14 desktop").
+ *
+ * The client used to parse+format this itself, but that pulled
+ * `ua-parser-modern` into the browser bundle for a label nothing else on
+ * the client needs; the client now sends the raw string and parsing
+ * happens here, at the server ingress, keeping the persisted label format
+ * identical.
+ */
+export declare function describeUA(userAgent: string): string;
+/**
+ * The current one-time authentication code. Display this to the user (e.g. in
+ * the dev-server terminal) so they can type it into the browser to authenticate.
+ */
+export declare function getTempAuthCode(): string;
+/**
+ * The current code plus its expiry timestamp, for display (e.g. the auth
+ * banner). An already-expired code is rotated first, so the returned code is
+ * always redeemable for its remaining lifetime.
+ */
+export declare function getTempAuthCodeInfo(): {
+  code: string;
+  expireAt: number;
+};
+/**
+ * Rotate the authentication code, resetting its expiry window and failed-attempt
+ * counter. Call this when a new authentication flow begins (e.g. when an
+ * untrusted client starts authenticating) so the displayed code is freshly
+ * valid for its full TTL.
+ */
+export declare function refreshTempAuthCode(): string;
+/**
+ * Build a "magic link" authentication URL that embeds a one-time code (OTP) in
+ * the URL **fragment**. Opening it authenticates the client without typing;
+ * print it on startup (devframe stays headless, so the host prints its own
+ * banner). Defaults to the current code; the link is subject to the same TTL.
+ *
+ * The code rides the fragment (`#devframe_otp=…`), not the query string, so it
+ * is never sent to the server, written to an access log, or leaked in a
+ * `Referer` header; the browser client reads it locally (see
+ * `consumeOtpFromUrl`). Any existing fragment parameters are preserved.
+ */
+export declare function buildOtpAuthUrl(baseUrl: string, code?: string): string;
+/**
+ * Re-authenticate a connection that presents a previously-issued bearer token.
+ * Returns `true` and marks the session trusted when the token is known.
+ *
+ * Used by the `anonymous:devframe:auth` handler so a client that already
+ * authenticated (token persisted in the browser) is trusted on reconnect
+ * without entering the code again.
+ */
+export declare function verifyAuthToken(token: string, session: DevframeNodeRpcSession, storage: SharedState<InternalAnonymousAuthStorage>): boolean;
+/**
+ * Exchange a one-time authentication code for a fresh, node-issued bearer token.
+ *
+ * On success this mints a high-entropy token, records it in the trusted store,
+ * marks the calling session trusted, rotates the code, and returns the token
+ * for the client to persist. Returns `null` on any failure.
+ *
+ * Because the code is short and human-typed, verification is hardened against
+ * brute force: it enforces a time-to-live, compares in constant time, and
+ * rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
+ * attacker cannot keep guessing against the same code.
+ */
+export declare function exchangeTempAuthCode(code: string, session: DevframeNodeRpcSession, info: {
+  ua: string;
+  origin: string;
+}, storage: SharedState<InternalAnonymousAuthStorage>): string | null;
+export { DevframeAuthHandler };

package/dist/node/auth.mjs

@@ -1,3 +1,3 @@
-import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-CeQUo6KI.mjs";
-import { a as getTempAuthCodeInfo, i as getTempAuthCode, n as describeUA, o as refreshTempAuthCode, r as exchangeTempAuthCode, s as verifyAuthToken, t as buildOtpAuthUrl } from "../state-W4wI6X5X.mjs";
+import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-D6KA3vwr.mjs";
+import { a as getTempAuthCodeInfo, i as getTempAuthCode, n as describeUA, o as refreshTempAuthCode, r as exchangeTempAuthCode, s as verifyAuthToken, t as buildOtpAuthUrl } from "../state-B_yjfeqo.mjs";
 export { buildOtpAuthUrl, describeUA, exchangeTempAuthCode, getTempAuthCode, getTempAuthCodeInfo, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,3 +1,12 @@
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-BGJi0ITA.mjs";
-import { a as resolveBasePath, i as normalizeBasePath } from "../_shared-Cm4iD0L3.mjs";
+/**
+ * Public surface for first-party hub adapters (`@devframes/hub` and
+ * similar). Carries the primitives a hub-kit author needs to bridge a
+ * framework dev server into a hub context: base-path resolution and
+ * the remote-dock token bridge used by the hub's docks host.
+ *
+ * Stable across minor versions; treat additions or removals as breaking
+ * only across major versions.
+ */
+import { a as resolveBasePath, i as normalizeBasePath } from "../_shared-BxeuukaL.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-B-AARy_U.mjs";
 export { type DevframeInternalContext, type InternalAnonymousAuthStorage, type RemoteTokenRecord, getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/hub-internals.mjs

@@ -1,3 +1,3 @@
-import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-C61zPwIz.mjs";
-import { n as internalContextMap, t as getInternalContext } from "../context-D_jSSdME.mjs";
+import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-CtXCQFTV.mjs";
+import { n as internalContextMap, t as getInternalContext } from "../context-BTxC4QrJ.mjs";
 export { getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/index.d.mts

@@ -1,6 +1,7 @@
-import { g as RpcFunctionDefinitionAny } from "../types-BmDbfHCx.mjs";
-import { St as DevframeHost, k as SharedState, l as RpcFunctionsHost, o as DevframeNodeContext } from "../context-BNxFOPbX.mjs";
-//#region src/node/context.d.ts
+import "../rpc/index.mjs";
+import { g as RpcFunctionDefinitionAny } from "../types-KZOyhez5.mjs";
+import { Bt as SharedState, H as RpcFunctionsHost, xt as DevframeHost, z as DevframeNodeContext } from "../index-BhUqJUHG.mjs";
+import "../index-BKu9BxcT.mjs";
 export interface CreateHostContextOptions {
   cwd: string;
   workspaceRoot?: string;
@@ -31,8 +32,6 @@ export interface CreateHostContextOptions {
  * `commands` when mounted into Vite DevTools.
  */
 export declare function createHostContext(options: CreateHostContextOptions): Promise<DevframeNodeContext>;
-//#endregion
-//#region src/node/storage.d.ts
 export interface CreateStorageOptions<T extends object> {
   filepath: string;
   initialValue: T;
@@ -40,5 +39,4 @@ export interface CreateStorageOptions<T extends object> {
   debounce?: number;
 }
 export declare function createStorage<T extends object>(options: CreateStorageOptions<T>): SharedState<T>;
-//#endregion
 export type { RpcFunctionsHost };

package/dist/node/index.mjs

@@ -1,3 +1,3 @@
-import { t as createHostContext } from "../context-CAJ5V017.mjs";
-import { t as createStorage } from "../storage-CWI9PZ-5.mjs";
+import { t as createHostContext } from "../context-C5FcbWQi.mjs";
+import { t as createStorage } from "../storage-DpJ52UB_.mjs";
 export { createHostContext, createStorage };