devframe 1.3.2 → 1.3.5

package/dist/index.d.mts

@@ -1,9 +1,10 @@
-import { C as RpcFunctionType, T as RpcReturnSchema, h as RpcFunctionDefinition, m as RpcFunctionAgentOptions, n as RpcArgsSchema } from "./types-844OBepb.mjs";
-import { n as withMcpContent } from "./mcp-content-CQQBt2An.mjs";
+import { C as RpcFunctionType, T as RpcReturnSchema, h as RpcFunctionDefinition, m as RpcFunctionAgentOptions, n as RpcArgsSchema } from "./types-KZOyhez5.mjs";
+import { n as withMcpContent } from "./mcp-content-0a0mpCL5.mjs";
+import "./rpc/index.mjs";
 import { a as DevframeWsPeer, i as DevframeRpcTransportKind, n as DevframeRpcConnection, r as DevframeRpcConnectionRequest, t as DevframeNodeRpcSessionMeta } from "./session-Y9R6tqg4.mjs";
+import { DevframeDefineDiagnosticsOptions } from "./utils/nostics.mjs";
 import { a as RemoteAssetsStore, i as RemoteAssetsProviderCustom, n as RemoteAssetsErrorMessage, o as StaticAssetsSource, r as RemoteAssetsProvider, t as RemoteAssets } from "./remote-assets-5AQMHZnV.mjs";
-import { i as DevframeDefineDiagnosticsOptions } from "./nostics-Dgwh7ytT.mjs";
-import { $ as DevframeServiceOf, $t as AgentToolProviderHandle, At as McpFetchHandler, B as DevframeSetupInfo, Ct as DevframeStorageScope, Dt as CreateMcpServerOptions, Et as CreateMcpFetchHandlerOptions, F as DevframeDefinition, Ft as McpResourceTemplate, G as McpAuthorization, Gt as AgentHandle, H as DevframeSnapshotRpcInputs, I as DevframeDeploymentKind, It as McpResourceTemplateContent, J as DevframeServiceDefinition, Jt as AgentResourceContent, K as McpRouteOptions, Kt as AgentManifest, L as DevframeDockDefaults, Lt as McpResourceTemplateEntry, Mt as McpPromptArgument, Nt as McpPromptMessage, Ot as McpConnectionInfo, P as DevframeCliOptions, Pt as McpPromptResult, Q as DevframeServiceMeta, Qt as AgentToolProvider, R as DevframeDuplicationStrategy, Rt as McpResourcesChangedHook, St as DevframeHost, Tt as DevframeDiagnosticsLogger, U as DevframeSseOptions, V as DevframeSnapshotRpcEntry, W as DevframeWsOptions, X as DevframeServiceId, Xt as AgentTool, Y as DevframeServiceDescriptor, Yt as AgentResourceInput, Z as DevframeServiceInput, Zt as AgentToolInput, _t as DevframeViewHost, a as DevframeConnectionConfigsRegistry, at as DevframeScopedNodeContext, bt as DevframeRpcSharedStates, c as RpcBroadcastOptions, ct as DevframeSettings, d as RpcSharedStateHost, dt as ScopedBroadcastOptions, en as DevframeAgentHost, et as DevframeServiceScopeOf, f as RpcStreamingChannel, ft as ScopedClientFunctions, gt as SettingsForNamespace, ht as ScopedSharedStates, i as DevframeCapabilities, in as EventsMap, it as DevframeServicesState, jt as McpPrompt, kt as McpContentBlock, l as RpcFunctionsHost, lt as DevframeSettingsRegistry, m as RpcStreamingHost, mt as ScopedServerFunctions, n as ConnectionMetaSse, nn as EventEmitter, nt as DevframeServicesRegistry, o as DevframeNodeContext, ot as DevframeScopedNodeRpc, p as RpcStreamingChannelOptions, pt as ScopedRpcFn, q as McpSetting, qt as AgentResource, r as ConnectionMetaWebsocket, rn as EventUnsubscribe, rt as DevframeServicesScopeRegistry, s as DevframeNodeRpcSession, st as DevframeScopedStreamingHost, t as ConnectionMeta, tn as DevframeAgentHostEvents, tt as DevframeServicesHost, u as RpcSharedStateGetOptions, ut as DevframeSettingsStore, vt as DevframeRpcClientFunctions, wt as DevframeDiagnosticsHost, yt as DevframeRpcServerFunctions, z as DevframeRpcOptions, zt as McpServerHandle } from "./context-WxTq6kqb.mjs";
+import { $ as DevframeServiceId, $t as AgentToolProviderHandle, B as DevframeNodeRpcSession, C as McpPromptResult, Ct as DevframeDiagnosticsHost, D as McpResourcesChangedHook, E as McpResourceTemplateEntry, F as ConnectionMetaSse, G as RpcStreamingChannel, Gt as AgentHandle, H as RpcFunctionsHost, I as ConnectionMetaWebsocket, J as DevframeRpcClientFunctions, Jt as AgentResourceContent, K as RpcStreamingChannelOptions, Kt as AgentManifest, L as DevframeCapabilities, O as McpServerHandle, P as ConnectionMeta, Q as DevframeServiceDescriptor, Qt as AgentToolProvider, R as DevframeConnectionConfigsRegistry, S as McpPromptMessage, St as DevframeStorageScope, T as McpResourceTemplateContent, U as RpcSharedStateGetOptions, V as RpcBroadcastOptions, W as RpcSharedStateHost, X as DevframeRpcSharedStates, Xt as AgentTool, Y as DevframeRpcServerFunctions, Yt as AgentResourceInput, Z as DevframeServiceDefinition, Zt as AgentToolInput, _ as McpConnectionInfo, _t as ScopedServerFunctions, a as DevframeDuplicationStrategy, at as DevframeServicesRegistry, b as McpPrompt, bt as DevframeViewHost, c as DevframeSnapshotRpcEntry, ct as DevframeScopedNodeContext, d as DevframeWsOptions, dt as DevframeSettings, en as DevframeAgentHost, et as DevframeServiceInput, f as McpAuthorization, ft as DevframeSettingsRegistry, g as CreateMcpServerOptions, gt as ScopedRpcFn, h as CreateMcpFetchHandlerOptions, ht as ScopedClientFunctions, i as DevframeDockDefaults, in as EventsMap, it as DevframeServicesHost, l as DevframeSnapshotRpcInputs, lt as DevframeScopedNodeRpc, m as McpSetting, mt as ScopedBroadcastOptions, n as DevframeDefinition, nn as EventEmitter, nt as DevframeServiceOf, o as DevframeRpcOptions, ot as DevframeServicesScopeRegistry, p as McpRouteOptions, pt as DevframeSettingsStore, q as RpcStreamingHost, qt as AgentResource, r as DevframeDeploymentKind, rn as EventUnsubscribe, rt as DevframeServiceScopeOf, s as DevframeSetupInfo, st as DevframeServicesState, t as DevframeCliOptions, tn as DevframeAgentHostEvents, tt as DevframeServiceMeta, u as DevframeSseOptions, ut as DevframeScopedStreamingHost, v as McpContentBlock, vt as ScopedSharedStates, w as McpResourceTemplate, wt as DevframeDiagnosticsLogger, x as McpPromptArgument, xt as DevframeHost, y as McpFetchHandler, yt as SettingsForNamespace, z as DevframeNodeContext } from "./index-BhUqJUHG.mjs";
 export declare const defineRpcFunction: <NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>) => RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>;
 /**
  * Identity helper that types a devframe definition, the primary authoring

package/dist/{instance-registry-CmZfF5u3.mjs → instance-registry-DwmnWyCK.mjs}

@@ -1,4 +1,4 @@
-import { n as __exportAll } from "./rolldown-runtime-DYf_mQCB.mjs";
+import { n as __exportAll } from "./rolldown-runtime-BVN1G_yT.mjs";
 import { t as diagnostics } from "./diagnostics-DC1-WcvN.mjs";
 import { join } from "pathe";
 import { mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";

package/dist/{instance-shell-Dk2SejFT.mjs → instance-shell-C0yMifrP.mjs}

@@ -1,7 +1,7 @@
 import { r as validateOriginCandidate } from "./origin-Ck7mLbKU.mjs";
-import { c as joinURL, d as withoutLeadingSlash, f as withoutTrailingSlash, u as withLeadingSlash } from "./_shared-BGb9aDxr.mjs";
+import { c as joinURL, d as withoutLeadingSlash, f as withoutTrailingSlash, u as withLeadingSlash } from "./_shared-CtXCQFTV.mjs";
 import "./constants.mjs";
-import { n as createInteractiveAuth } from "./interactive-auth-BURwIAvE.mjs";
+import { n as createInteractiveAuth } from "./interactive-auth-CZ3CPfEs.mjs";
 import { t as diagnostics } from "./diagnostics-DC1-WcvN.mjs";
 import { t as getInternalContext } from "./context-BTxC4QrJ.mjs";
 import { createServer } from "node:http";
@@ -359,7 +359,7 @@ function createInstanceShell(options) {
 		const origin = currentOrigin();
 		if (!cfg || registerPromise || !origin || !meta) return;
 		const resolvedMeta = meta;
-		registerPromise = import("./instance-registry-CmZfF5u3.mjs").then((n) => n.t).then(({ registerDevframeInstance }) => {
+		registerPromise = import("./instance-registry-DwmnWyCK.mjs").then((n) => n.t).then(({ registerDevframeInstance }) => {
 			let port = 0;
 			try {
 				const url = new URL(origin);
@@ -458,7 +458,7 @@ function createInstanceShell(options) {
 	let resolvedAuth = false;
 	let corePromise;
 	function ensureCore() {
-		corePromise ??= import("./rpc-core-CDUizUQB.mjs").then((n) => n.n).then(({ createContextRpcServer }) => createContextRpcServer({
+		corePromise ??= import("./rpc-core-BmDHiDR6.mjs").then((n) => n.n).then(({ createContextRpcServer }) => createContextRpcServer({
 			context: ctx,
 			auth: resolvedAuth,
 			onPeerConnect: options.onPeerConnect,
@@ -502,7 +502,7 @@ function createInstanceShell(options) {
 			return nativeRuntime ? bindNativeHttpAndWs(runtime, bindOptions) : bindHttpAndWs(bindOptions);
 		};
 		if (ws.port != null) return await start(ws.port);
-		const { getPort } = await import("./dist-DJydMELP.mjs").then((n) => n.t);
+		const { getPort } = await import("./dist-CZ-TySHD.mjs").then((n) => n.t);
 		let lastError;
 		for (let attempt = 0; attempt < 3; attempt++) {
 			const port = attempt === 0 && options.resolveSidecarPort ? await options.resolveSidecarPort(sidecarHost) : await getPort({

package/dist/{instance-shell-Bujp0BhE.d.mts → instance-shell-DTk514M9.d.mts}

@@ -1,13 +1,13 @@
 import { n as BirpcGroup } from "./index-BKu9BxcT.mjs";
-import { n as WsOriginRegistry } from "./ws-server-CYHkeyA-.mjs";
+import { WsOriginRegistry } from "./rpc/transports/ws-server.mjs";
 import { n as DevframeRpcConnection, t as DevframeNodeRpcSessionMeta } from "./session-Y9R6tqg4.mjs";
-import { Bt as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, o as DevframeNodeContext, s as DevframeNodeRpcSession, t as ConnectionMeta, vt as DevframeRpcClientFunctions, yt as DevframeRpcServerFunctions } from "./context-WxTq6kqb.mjs";
-import "./index-HMJPlexc.mjs";
-import { H3 } from "h3";
+import { B as DevframeNodeRpcSession, J as DevframeRpcClientFunctions, P as ConnectionMeta, Y as DevframeRpcServerFunctions, d as DevframeWsOptions, k as DevframeAuthHandler, u as DevframeSseOptions, z as DevframeNodeContext } from "./index-BhUqJUHG.mjs";
+import "./node/auth.mjs";
 import { NodeAdapter } from "crossws/adapters/node";
 import { Buffer } from "node:buffer";
 import { IncomingMessage, Server, ServerResponse } from "node:http";
 import { Duplex } from "node:stream";
+import { H3 } from "h3";
 /**
  * One running devframe instance, as recorded in the instance registry.
  * Records are self-describing JSON, so additive fields are safe.

package/dist/{interactive-auth-BURwIAvE.mjs → interactive-auth-CZ3CPfEs.mjs}

@@ -1,6 +1,6 @@
 import { s as colors } from "./nostics-InlX4tmd.mjs";
 import { isAnonymousRpcMethod } from "./constants.mjs";
-import { a as getTempAuthCodeInfo, n as describeUA, o as refreshTempAuthCode, r as exchangeTempAuthCode, s as verifyAuthToken, t as buildOtpAuthUrl } from "./state-B_yjfeqo.mjs";
+import { a as getTempAuthCodeInfo, n as describeUA, o as refreshTempAuthCode, r as exchangeTempAuthCode, s as verifyAuthToken, t as buildOtpAuthUrl } from "./state-TdDWqiG-.mjs";
 import { t as getInternalContext } from "./context-BTxC4QrJ.mjs";
 import { n as defineRpcFunction } from "./define-C8h-fyD3.mjs";
 // src/utils/simple-schema.ts

package/dist/internal/index.d.mts

@@ -1,12 +1,12 @@
-import { a as resolveBasePath, i as normalizeBasePath, n as ResolvedMcpConfig, r as loadAutoMcpAdapter, s as resolveMcpConfig } from "../_shared-CnKu5myY.mjs";
-import { t as getMcpContent } from "../mcp-content-CQQBt2An.mjs";
+import { a as resolveBasePath, i as normalizeBasePath, n as ResolvedMcpConfig, r as loadAutoMcpAdapter, s as resolveMcpConfig } from "../_shared-BxeuukaL.mjs";
+import { t as getMcpContent } from "../mcp-content-0a0mpCL5.mjs";
 import { t as StandardSchemaV1 } from "../index-BIRF0E5l.mjs";
-import { i as importAgenticMcp, n as MountMcpHttpOptions, r as MountedMcpHttp, t as AgenticMcpModule } from "../agentic-CCstJ5yv.mjs";
-import { $t as AgentToolProviderHandle, Gt as AgentHandle, Jt as AgentResourceContent, Kt as AgentManifest, Qt as AgentToolProvider, St as DevframeHost, Xt as AgentTool, Yt as AgentResourceInput, Zt as AgentToolInput, en as DevframeAgentHost$1, nn as EventEmitter, o as DevframeNodeContext, qt as AgentResource, tn as DevframeAgentHostEvents, xt as BrowserAgentClientInfo } from "../context-WxTq6kqb.mjs";
+import { i as importAgenticMcp, n as MountMcpHttpOptions, r as MountedMcpHttp, t as AgenticMcpModule } from "../agentic-DVgUzwhV.mjs";
+import { $t as AgentToolProviderHandle, Gt as AgentHandle, Jt as AgentResourceContent, Kt as AgentManifest, Qt as AgentToolProvider, Tt as BrowserAgentClientInfo, Xt as AgentTool, Yt as AgentResourceInput, Zt as AgentToolInput, en as DevframeAgentHost$1, nn as EventEmitter, qt as AgentResource, tn as DevframeAgentHostEvents, xt as DevframeHost, z as DevframeNodeContext } from "../index-BhUqJUHG.mjs";
 import { a as RemoteAssetsStore } from "../remote-assets-5AQMHZnV.mjs";
-import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, g as registerDevframeInstance, h as probeDevframeOrigin, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-Bujp0BhE.mjs";
-import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-CFwyV10r.mjs";
-import { g as RpcFunctionDefinitionAny } from "../types-844OBepb.mjs";
+import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, g as registerDevframeInstance, h as probeDevframeOrigin, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-DTk514M9.mjs";
+import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-CblgPYJ_.mjs";
+import { g as RpcFunctionDefinitionAny } from "../types-KZOyhez5.mjs";
 /**
  * JSON-coercing serializer for MCP text payloads.
  *

package/dist/internal/index.mjs

@@ -1,13 +1,13 @@
-import { a as resolveMcpConfig, n as normalizeBasePath, r as resolveBasePath, s as importAgenticMcp, t as loadAutoMcpAdapter } from "../_shared-BGb9aDxr.mjs";
+import { a as resolveMcpConfig, n as normalizeBasePath, r as resolveBasePath, s as importAgenticMcp, t as loadAutoMcpAdapter } from "../_shared-CtXCQFTV.mjs";
 import { t as getMcpContent } from "../mcp-content-CqU8yaF7.mjs";
 import { t as Diagnostic } from "../nostics-InlX4tmd.mjs";
 import { a as toolInputToCommandArgs, i as DevframeAgentHost, t as LIST_CLIENTS_TOOL } from "../client-agent-qNMgDUev.mjs";
 import { t as diagnostics } from "../diagnostics-DC1-WcvN.mjs";
 import { t as createH3DevframeHost } from "../host-h3-D1uj5EM8.mjs";
 import { t as importRuntimeModule } from "../import-runtime-module-DsdqJ1gK.mjs";
-import { i as registerDevframeInstance, n as listLiveDevframeInstances, r as probeDevframeOrigin } from "../instance-registry-CmZfF5u3.mjs";
-import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-Dk2SejFT.mjs";
-import { t as createContextRpcServer } from "../rpc-core-CDUizUQB.mjs";
+import { i as registerDevframeInstance, n as listLiveDevframeInstances, r as probeDevframeOrigin } from "../instance-registry-DwmnWyCK.mjs";
+import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-C0yMifrP.mjs";
+import { t as createContextRpcServer } from "../rpc-core-BmDHiDR6.mjs";
 import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../wire-codec-BdngvzfH.mjs";
 // src/agent/stringify.ts
 /**

package/dist/{mcp-content-CQQBt2An.d.mts → mcp-content-0a0mpCL5.d.mts}

@@ -1,4 +1,4 @@
-import { kt as McpContentBlock } from "./context-WxTq6kqb.mjs";
+import { v as McpContentBlock } from "./index-BhUqJUHG.mjs";
 /**
  * Attach MCP content blocks to a tool result, for example an image next to
  * its text. The MCP adapter sends these blocks as the `content` of the

package/dist/node/auth.d.mts

@@ -1,3 +1,84 @@
-import { Bt as DevframeAuthHandler } from "../context-WxTq6kqb.mjs";
-import { a as getTempAuthCodeInfo, c as revokeActiveConnectionsForToken, i as getTempAuthCode, l as revokeAuthToken, n as describeUA, o as refreshTempAuthCode, r as exchangeTempAuthCode, s as verifyAuthToken, t as buildOtpAuthUrl } from "../index-HMJPlexc.mjs";
-export { DevframeAuthHandler, buildOtpAuthUrl, describeUA, exchangeTempAuthCode, getTempAuthCode, getTempAuthCodeInfo, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };
+import { B as DevframeNodeRpcSession, Bt as SharedState, k as DevframeAuthHandler, z as DevframeNodeContext } from "../index-BhUqJUHG.mjs";
+import { n as InternalAnonymousAuthStorage } from "../context-B-AARy_U.mjs";
+/**
+ * Flip `isTrusted` to false on any live WS clients connected with `token`
+ * and broadcast the `auth:revoked` event so they can react.
+ *
+ * Shared between persisted-auth revocation and remote-dock token revocation.
+ */
+export declare function revokeActiveConnectionsForToken(context: DevframeNodeContext, token: string): Promise<void>;
+/**
+ * Revoke an auth token: remove from storage and notify all connected clients
+ * using this token that they are no longer trusted.
+ */
+export declare function revokeAuthToken(context: DevframeNodeContext, storage: SharedState<InternalAnonymousAuthStorage>, token: string): Promise<void>;
+/**
+ * Format a raw `navigator.userAgent` string into the short display label
+ * shown for a trusted device (e.g. "Chrome 120 | macOS 14 desktop").
+ *
+ * The client used to parse+format this itself, but that pulled
+ * `ua-parser-modern` into the browser bundle for a label nothing else on
+ * the client needs; the client now sends the raw string and parsing
+ * happens here, at the server ingress, keeping the persisted label format
+ * identical.
+ */
+export declare function describeUA(userAgent: string): string;
+/**
+ * The current one-time authentication code. Display this to the user (e.g. in
+ * the dev-server terminal) so they can type it into the browser to authenticate.
+ */
+export declare function getTempAuthCode(): string;
+/**
+ * The current code plus its expiry timestamp, for display (e.g. the auth
+ * banner). An already-expired code is rotated first, so the returned code is
+ * always redeemable for its remaining lifetime.
+ */
+export declare function getTempAuthCodeInfo(): {
+  code: string;
+  expireAt: number;
+};
+/**
+ * Rotate the authentication code, resetting its expiry window and failed-attempt
+ * counter. Call this when a new authentication flow begins (e.g. when an
+ * untrusted client starts authenticating) so the displayed code is freshly
+ * valid for its full TTL.
+ */
+export declare function refreshTempAuthCode(): string;
+/**
+ * Build a "magic link" authentication URL that embeds a one-time code (OTP) in
+ * the URL **fragment**. Opening it authenticates the client without typing;
+ * print it on startup (devframe stays headless, so the host prints its own
+ * banner). Defaults to the current code; the link is subject to the same TTL.
+ *
+ * The code rides the fragment (`#devframe_otp=…`), not the query string, so it
+ * is never sent to the server, written to an access log, or leaked in a
+ * `Referer` header; the browser client reads it locally (see
+ * `consumeOtpFromUrl`). Any existing fragment parameters are preserved.
+ */
+export declare function buildOtpAuthUrl(baseUrl: string, code?: string): string;
+/**
+ * Re-authenticate a connection that presents a previously-issued bearer token.
+ * Returns `true` and marks the session trusted when the token is known.
+ *
+ * Used by the `anonymous:devframe:auth` handler so a client that already
+ * authenticated (token persisted in the browser) is trusted on reconnect
+ * without entering the code again.
+ */
+export declare function verifyAuthToken(token: string, session: DevframeNodeRpcSession, storage: SharedState<InternalAnonymousAuthStorage>): boolean;
+/**
+ * Exchange a one-time authentication code for a fresh, node-issued bearer token.
+ *
+ * On success this mints a high-entropy token, records it in the trusted store,
+ * marks the calling session trusted, rotates the code, and returns the token
+ * for the client to persist. Returns `null` on any failure.
+ *
+ * Because the code is short and human-typed, verification is hardened against
+ * brute force: it enforces a time-to-live, compares in constant time, and
+ * rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
+ * attacker cannot keep guessing against the same code.
+ */
+export declare function exchangeTempAuthCode(code: string, session: DevframeNodeRpcSession, info: {
+  ua: string;
+  origin: string;
+}, storage: SharedState<InternalAnonymousAuthStorage>): string | null;
+export { DevframeAuthHandler };

package/dist/node/auth.mjs

@@ -1,3 +1,3 @@
 import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-D6KA3vwr.mjs";
-import { a as getTempAuthCodeInfo, i as getTempAuthCode, n as describeUA, o as refreshTempAuthCode, r as exchangeTempAuthCode, s as verifyAuthToken, t as buildOtpAuthUrl } from "../state-B_yjfeqo.mjs";
+import { a as getTempAuthCodeInfo, i as getTempAuthCode, n as describeUA, o as refreshTempAuthCode, r as exchangeTempAuthCode, s as verifyAuthToken, t as buildOtpAuthUrl } from "../state-TdDWqiG-.mjs";
 export { buildOtpAuthUrl, describeUA, exchangeTempAuthCode, getTempAuthCode, getTempAuthCodeInfo, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,3 +1,12 @@
-import { a as resolveBasePath, i as normalizeBasePath } from "../_shared-CnKu5myY.mjs";
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-CsdPs3po.mjs";
+/**
+ * Public surface for first-party hub adapters (`@devframes/hub` and
+ * similar). Carries the primitives a hub-kit author needs to bridge a
+ * framework dev server into a hub context: base-path resolution and
+ * the remote-dock token bridge used by the hub's docks host.
+ *
+ * Stable across minor versions; treat additions or removals as breaking
+ * only across major versions.
+ */
+import { a as resolveBasePath, i as normalizeBasePath } from "../_shared-BxeuukaL.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-B-AARy_U.mjs";
 export { type DevframeInternalContext, type InternalAnonymousAuthStorage, type RemoteTokenRecord, getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/hub-internals.mjs

@@ -1,3 +1,3 @@
-import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-BGb9aDxr.mjs";
+import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-CtXCQFTV.mjs";
 import { n as internalContextMap, t as getInternalContext } from "../context-BTxC4QrJ.mjs";
 export { getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/index.d.mts

@@ -1,5 +1,7 @@
-import { g as RpcFunctionDefinitionAny } from "../types-844OBepb.mjs";
-import { St as DevframeHost, k as SharedState, l as RpcFunctionsHost, o as DevframeNodeContext } from "../context-WxTq6kqb.mjs";
+import "../rpc/index.mjs";
+import { g as RpcFunctionDefinitionAny } from "../types-KZOyhez5.mjs";
+import { Bt as SharedState, H as RpcFunctionsHost, xt as DevframeHost, z as DevframeNodeContext } from "../index-BhUqJUHG.mjs";
+import "../index-BKu9BxcT.mjs";
 export interface CreateHostContextOptions {
   cwd: string;
   workspaceRoot?: string;

package/dist/recipes/interactive-auth.d.mts

@@ -1,6 +1,6 @@
-import { Bt as DevframeAuthHandler, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "../context-WxTq6kqb.mjs";
+import { B as DevframeNodeRpcSession, k as DevframeAuthHandler, z as DevframeNodeContext } from "../index-BhUqJUHG.mjs";
 import { ColorFn } from "../utils/colors.mjs";
-import "../index-HMJPlexc.mjs";
+import "../node/auth.mjs";
 export interface CreateInteractiveAuthOptions {
   /**
    * Static, pre-shared bearer tokens that are always trusted, for CI runs

package/dist/recipes/interactive-auth.mjs

@@ -1 +1 @@
-export { t as createAuthBanner, n as createInteractiveAuth } from "../interactive-auth-BURwIAvE.mjs";
+export { t as createAuthBanner, n as createInteractiveAuth } from "../interactive-auth-CZ3CPfEs.mjs";

package/dist/{rolldown-runtime-DYf_mQCB.mjs → rolldown-runtime-BVN1G_yT.mjs}

@@ -7,14 +7,14 @@ var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod, mod.exports), cb = null), mod.exports);
-var __exportAll = (all, no_symbols) => {
-	let target = {};
+var __exportAll = (all, flags) => {
+	let target = Object.setPrototypeOf({}, null);
 	for (var name in all) __defProp(target, name, {
 		get: all[name],
 		enumerable: true
 	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
+	if (!(flags & 1)) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return flags & 2 ? target : Object.preventExtensions(target);
 };
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {

package/dist/rpc/dump.d.mts

@@ -1,5 +1,5 @@
 import { i as BirpcReturn } from "../index-BKu9BxcT.mjs";
-import { c as RpcDumpCollectionOptions, f as RpcDumpRecordError, g as RpcFunctionDefinitionAny, i as RpcDefinitionsToFunctions, p as RpcDumpStore, s as RpcDumpClientOptions } from "../types-844OBepb.mjs";
+import { c as RpcDumpCollectionOptions, f as RpcDumpRecordError, g as RpcFunctionDefinitionAny, i as RpcDefinitionsToFunctions, p as RpcDumpStore, s as RpcDumpClientOptions } from "../types-KZOyhez5.mjs";
 export declare function dumpFunctions<T extends readonly RpcFunctionDefinitionAny[]>(definitions: T, context?: any, options?: RpcDumpCollectionOptions): Promise<RpcDumpStore<RpcDefinitionsToFunctions<T>>>;
 /**
  * Creates a client that serves pre-computed results from a dump store.

package/dist/rpc/index.d.mts

@@ -1,4 +1,122 @@
 import { i as BirpcReturn, t as BirpcFn } from "../index-BKu9BxcT.mjs";
-import { a as STRUCTURED_CLONE_PREFIX, c as getRpcResolvedSetupResult, d as RpcFunctionsCollectorBase, f as RpcCacheManager, i as validateRpcReturn, l as createDefineWrapperWithContext, n as validateDefinitions, o as strictJsonStringify, p as RpcCacheOptions, r as validateRpcArgs, s as getRpcHandler, t as validateDefinition, u as defineRpcFunction } from "../index-D0qrBkhO.mjs";
-import { C as RpcFunctionType, E as Thenable, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinitionAnyWithContext, a as RpcDefinitionsToFunctionsWithNamespace, b as RpcFunctionDefinitionWithSchemas, c as RpcDumpCollectionOptions, d as RpcDumpRecord, f as RpcDumpRecordError, g as RpcFunctionDefinitionAny, h as RpcFunctionDefinition, i as RpcDefinitionsToFunctions, l as RpcDumpDefinition, m as RpcFunctionAgentOptions, n as RpcArgsSchema, o as RpcDump, p as RpcDumpStore, r as RpcDefinitionsFilter, s as RpcDumpClientOptions, t as EntriesToObject, u as RpcDumpGetter, v as RpcFunctionDefinitionBase, w as RpcFunctionsCollector, x as RpcFunctionDefinitionWithoutSchemas, y as RpcFunctionDefinitionToFunction } from "../types-844OBepb.mjs";
-export { type BirpcFn, type BirpcReturn, EntriesToObject, RpcArgsSchema, RpcCacheManager, RpcCacheOptions, RpcDefinitionsFilter, RpcDefinitionsToFunctions, RpcDefinitionsToFunctionsWithNamespace, RpcDump, RpcDumpClientOptions, RpcDumpCollectionOptions, RpcDumpDefinition, RpcDumpGetter, RpcDumpRecord, RpcDumpRecordError, RpcDumpStore, RpcFunctionAgentOptions, RpcFunctionDefinition, RpcFunctionDefinitionAny, RpcFunctionDefinitionAnyWithContext, RpcFunctionDefinitionBase, RpcFunctionDefinitionToFunction, RpcFunctionDefinitionWithSchemas, RpcFunctionDefinitionWithoutSchemas, RpcFunctionSetupResult, RpcFunctionType, RpcFunctionsCollector, RpcFunctionsCollectorBase, RpcReturnSchema, STRUCTURED_CLONE_PREFIX, Thenable, createDefineWrapperWithContext, defineRpcFunction, getRpcHandler, getRpcResolvedSetupResult, strictJsonStringify, validateDefinition, validateDefinitions, validateRpcArgs, validateRpcReturn };
+import { C as RpcFunctionType, E as Thenable, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinitionAnyWithContext, a as RpcDefinitionsToFunctionsWithNamespace, b as RpcFunctionDefinitionWithSchemas, c as RpcDumpCollectionOptions, d as RpcDumpRecord, f as RpcDumpRecordError, g as RpcFunctionDefinitionAny, h as RpcFunctionDefinition, i as RpcDefinitionsToFunctions, l as RpcDumpDefinition, m as RpcFunctionAgentOptions, n as RpcArgsSchema, o as RpcDump, p as RpcDumpStore, r as RpcDefinitionsFilter, s as RpcDumpClientOptions, t as EntriesToObject, u as RpcDumpGetter, v as RpcFunctionDefinitionBase, w as RpcFunctionsCollector, x as RpcFunctionDefinitionWithoutSchemas, y as RpcFunctionDefinitionToFunction } from "../types-KZOyhez5.mjs";
+export interface RpcCacheOptions {
+  functions: string[];
+  keySerializer?: (args: unknown[]) => string;
+}
+/**
+ * @experimental API is expected to change.
+ */
+export declare class RpcCacheManager {
+  private cacheMap;
+  private options;
+  private keySerializer;
+  constructor(options: RpcCacheOptions);
+  updateOptions(options: Partial<RpcCacheOptions>): void;
+  cached<T>(m: string, a: unknown[]): T | undefined;
+  has(m: string, a: unknown[]): boolean;
+  apply(req: {
+    m: string;
+    a: unknown[];
+  }, res: unknown): void;
+  validate(m: string): boolean;
+  clear(fn?: string): void;
+}
+export declare class RpcFunctionsCollectorBase<LocalFunctions extends Record<string, any>, SetupContext> implements RpcFunctionsCollector<LocalFunctions, SetupContext> {
+  readonly context: SetupContext;
+  readonly definitions: Map<string, RpcFunctionDefinition<string, any, any, any, any, any, SetupContext>>;
+  readonly functions: LocalFunctions;
+  private readonly _onChanged;
+  constructor(context: SetupContext);
+  register(fnDef: RpcFunctionDefinition<string, any, any, any, any, any, SetupContext>, force?: boolean): void;
+  update(fn: RpcFunctionDefinition<string, any, any, any, any, any, SetupContext>, force?: boolean): void;
+  onChanged(fn: (id?: string) => void): () => void;
+  getHandler<T extends keyof LocalFunctions>(name: T): Promise<LocalFunctions[T]>;
+  getSchema<T extends keyof LocalFunctions>(name: T): {
+    args: RpcArgsSchema | undefined;
+    returns: RpcReturnSchema | undefined;
+  };
+  has(name: string): boolean;
+  get(name: string): RpcFunctionDefinition<string, any, any, any, any, any, SetupContext> | undefined;
+  list(): string[];
+}
+export declare function defineRpcFunction<NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS>): RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS>;
+export declare function createDefineWrapperWithContext<CONTEXT>(): <NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, CONTEXT>) => RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, CONTEXT>;
+export declare function getRpcResolvedSetupResult<NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, CONTEXT = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, any, any, CONTEXT>, context: CONTEXT): Promise<RpcFunctionSetupResult<ARGS, RETURN>>;
+export declare function getRpcHandler<NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, CONTEXT = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, any, any, CONTEXT>, context: CONTEXT): Promise<(...args: ARGS) => RETURN>;
+/**
+ * Wire format used by the live RPC transports (WebSocket and SSE).
+ *
+ * - **JSON (default, unprefixed):** payload is plain JSON text. Used when
+ *   the dispatched method is declared `jsonSerializable: true`. Encoded
+ *   via {@link strictJsonStringify} (rejects non-JSON values), decoded
+ *   via `JSON.parse`.
+ * - **Structured-clone (`s:` prefix):** payload is `s:` followed by
+ *   `structured-clone-es` text. Used when the method is declared
+ *   `jsonSerializable: false` (or omitted, the default). Round-trips
+ *   `Map`, `Set`, `Date`, `BigInt`, cycles, and class instances.
+ *
+ * birpc envelopes always start with `{`, so a leading byte that is not
+ * `s` is unambiguously JSON. Each direction independently chooses its
+ * encoding from local definitions; request and response are not
+ * coupled by a mirror rule.
+ */
+export declare const STRUCTURED_CLONE_PREFIX = "s:";
+/**
+ * `JSON.stringify` with a single-pass strict replacer.
+ *
+ * Throws `DF0020` synchronously when the value contains a type JSON
+ * cannot round-trip losslessly: `Map`, `Set`, `Date`, `BigInt`, class
+ * instances, or `undefined` inside an array (silently becomes `null`).
+ *
+ * Native pass-throughs (no extra work needed):
+ *   - circular references: `JSON.stringify` raises `TypeError`.
+ *   - `BigInt` at top level: caught here for a friendlier error path.
+ *
+ * Lenient cases (allowed without throwing):
+ *   - `undefined` as an object property: legitimate optional field;
+ *     JSON.stringify just omits it.
+ *   - `undefined` at the root: legitimate "action returned nothing".
+ *   - `Symbol` / `Function` values: semantically "drop me" in JSON.
+ *
+ * `fnName` is used only for the diagnostic message; pass the RPC
+ * function name when calling from a wire serializer / dump writer so
+ * the error points at the offending function.
+ */
+export declare function strictJsonStringify(value: unknown, fnName?: string): string;
+/**
+ * Validate positional arguments against their declared schemas. Only
+ * indices with a schema are checked; extra arguments pass through
+ * untouched. Throws `DF0038` on the first failing argument.
+ *
+ * Validation guards the payload without rewriting it: the original values
+ * are handed to the handler unchanged, so a schema that describes a subset
+ * of an object never silently strips the sender's extra fields (and any
+ * declared transforms stay a purely type-level concern).
+ *
+ * @internal
+ */
+export declare function validateRpcArgs(name: string, argsSchema: RpcArgsSchema | undefined, args: readonly unknown[]): Promise<unknown[]>;
+/**
+ * Validate a handler's resolved return value against its declared schema.
+ * Throws `DF0039` when the value fails the schema, otherwise returns the
+ * original value unchanged (guard-only, never rewriting the payload; see
+ * {@link validateRpcArgs}). Passes through when no return schema is set.
+ *
+ * @internal
+ */
+export declare function validateRpcReturn(name: string, returnSchema: RpcReturnSchema | undefined, value: unknown): Promise<unknown>;
+/**
+ * Validates RPC function definitions.
+ * Action and event functions cannot have dumps (side effects should not be cached).
+ *
+ * @throws {Error} If an action or event function has a dump configuration
+ */
+export declare function validateDefinitions(definitions: readonly RpcFunctionDefinitionAny[]): void;
+/**
+ * Validates a single RPC function definition.
+ *
+ * @throws {Error} If an action or event function has a dump configuration
+ */
+export declare function validateDefinition(definition: RpcFunctionDefinitionAny): void;
+export { type BirpcFn, type BirpcReturn, EntriesToObject, RpcArgsSchema, RpcDefinitionsFilter, RpcDefinitionsToFunctions, RpcDefinitionsToFunctionsWithNamespace, RpcDump, RpcDumpClientOptions, RpcDumpCollectionOptions, RpcDumpDefinition, RpcDumpGetter, RpcDumpRecord, RpcDumpRecordError, RpcDumpStore, RpcFunctionAgentOptions, RpcFunctionDefinition, RpcFunctionDefinitionAny, RpcFunctionDefinitionAnyWithContext, RpcFunctionDefinitionBase, RpcFunctionDefinitionToFunction, RpcFunctionDefinitionWithSchemas, RpcFunctionDefinitionWithoutSchemas, RpcFunctionSetupResult, RpcFunctionType, RpcFunctionsCollector, RpcReturnSchema, Thenable };

package/dist/rpc/transports/sse-client.d.mts

@@ -1,2 +1,34 @@
-import { n as createSseRpcChannel, t as SseRpcChannelOptions } from "../../sse-client-B2PrSz-H.mjs";
-export { SseRpcChannelOptions, createSseRpcChannel };
+import { a as ChannelOptions } from "../../index-BKu9BxcT.mjs";
+import { g as RpcFunctionDefinitionAny } from "../../types-KZOyhez5.mjs";
+export interface SseRpcChannelOptions {
+  /** Resolved `http(s)://` URL of the SSE endpoint. */
+  url: string;
+  onConnected?: () => void;
+  onError?: (e: Error) => void;
+  onDisconnected?: () => void;
+  authToken?: string;
+  /**
+   * RPC function definitions (or just the `jsonSerializable` flag per
+   * method) used to dispatch the per-call wire serializer, the same contract
+   * as the WS channel.
+   */
+  definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>;
+  /** Fetch implementation. Default: `globalThis.fetch`. */
+  fetch?: typeof globalThis.fetch;
+}
+/**
+ * Build a birpc `ChannelOptions` object backed by an SSE stream (server →
+ * client) and HTTP `POST` (client → server): the WebSocket-free counterpart
+ * to `createWsRpcChannel`, wire-compatible with `attachSseRpcTransport`.
+ *
+ * The stream is consumed via `fetch` streaming (not `EventSource`), so it
+ * works in browsers and server runtimes alike. The server's first frame
+ * (`event: session`) carries the session id; every `POST` echoes it in the
+ * `x-birpc-session` header. A response to a client-initiated request comes
+ * back in the `POST`'s own body and is re-injected into the channel; a
+ * dropped stream terminates the channel; there is no reconnect, matching
+ * the WS channel's closed-is-done semantics.
+ */
+export declare function createSseRpcChannel(options: SseRpcChannelOptions): ChannelOptions & {
+  close: () => void;
+};

package/dist/rpc/transports/sse-server.d.mts

@@ -1,7 +1,7 @@
 import { n as BirpcGroup } from "../../index-BKu9BxcT.mjs";
-import { g as RpcFunctionDefinitionAny } from "../../types-844OBepb.mjs";
+import { g as RpcFunctionDefinitionAny } from "../../types-KZOyhez5.mjs";
 import { n as DevframeRpcConnection, t as DevframeNodeRpcSessionMeta } from "../../session-Y9R6tqg4.mjs";
-import { n as WsOriginRegistry } from "../../ws-server-CYHkeyA-.mjs";
+import { WsOriginRegistry } from "./ws-server.mjs";
 export interface SseRpcTransportOptions {
   /**
    * Same contract as `WsRpcTransportOptions.allowedOrigins`: extra origins

package/dist/rpc/transports/ws-bun.d.mts

@@ -1,5 +1,5 @@
-import { t as ContextRpcServer } from "../../rpc-core-CFwyV10r.mjs";
-import { n as WsOriginRegistry } from "../../ws-server-CYHkeyA-.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-CblgPYJ_.mjs";
+import { WsOriginRegistry } from "./ws-server.mjs";
 export interface AttachBunWsTransportOptions {
   /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */
   allowedOrigins?: readonly string[] | WsOriginRegistry | false;

package/dist/rpc/transports/ws-client.d.mts

@@ -1,2 +1,27 @@
-import { n as createWsRpcChannel, t as WsRpcChannelOptions } from "../../ws-client-lqOeANcn.mjs";
-export { WsRpcChannelOptions, createWsRpcChannel };
+import { a as ChannelOptions } from "../../index-BKu9BxcT.mjs";
+import { g as RpcFunctionDefinitionAny } from "../../types-KZOyhez5.mjs";
+export interface WsRpcChannelOptions {
+  url: string;
+  onConnected?: (e: Event) => void;
+  onError?: (e: Error) => void;
+  onDisconnected?: (e: CloseEvent) => void;
+  authToken?: string;
+  /**
+   * RPC function definitions (or just the `jsonSerializable` flag per
+   * method) used to dispatch the per-call wire serializer. Pass an
+   * empty / partial map on clients that don't have the full registry;
+   * encoding falls back to structured-clone (the safer superset) and
+   * decoding still routes correctly via the wire prefix.
+   */
+  definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>;
+}
+/**
+ * Build a birpc `ChannelOptions` object backed by a browser `WebSocket`.
+ * Pass the result straight to `createRpcClient`'s `channel` option.
+ *
+ * Also returns `close()`, closing the underlying socket, mirroring the server transport's
+ * existing `WsRpcTransport.close()`. `birpc`'s own `ChannelOptions` has no teardown of its own.
+ */
+export declare function createWsRpcChannel(options: WsRpcChannelOptions): ChannelOptions & {
+  close: () => void;
+};

package/dist/rpc/transports/ws-deno.d.mts

@@ -1,5 +1,5 @@
-import { t as ContextRpcServer } from "../../rpc-core-CFwyV10r.mjs";
-import { n as WsOriginRegistry } from "../../ws-server-CYHkeyA-.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-CblgPYJ_.mjs";
+import { WsOriginRegistry } from "./ws-server.mjs";
 export interface AttachDenoWsTransportOptions {
   /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */
   allowedOrigins?: readonly string[] | WsOriginRegistry | false;