@north-light/crouter 0.3.172 → 0.3.174

package/dist/clients/inbox/review/document-region.d.ts

@@ -1,120 +0,0 @@
-import type { SurfaceRegion } from '../../surfaces/region.js';
-import { type CommentAuthority } from './comments-client.js';
-import type { LiveSource } from './live-source.js';
-/** What the composed owner supplies a region that cannot own the pane itself.
- *
- *  `submit` exists because the approved leader table keeps `space s` on the
- *  document region while the review lifecycle adapter belongs to the composed
- *  owner: the region reports the intent, the owner runs `reviewClient.submit`. */
-export interface CompositionServices {
-    notice(text: string): void;
-    suspendForChild(): () => void;
-    requestClose(): void;
-    submit(): void;
-}
-export interface DocumentRegionOptions {
-    reviewId: string;
-    absFile: string;
-    cwd: string;
-    source: LiveSource;
-    comments: CommentAuthority;
-    services: CompositionServices;
-}
-/** The reviewed document as a composed region: existing review rendering and
- *  navigation over a live file, with comments projected from the daemon and
- *  ranges remapped by this terminal as the file changes. */
-export declare class DocumentRegion implements SurfaceRegion {
-    private readonly absFile;
-    private readonly fileLabel;
-    private readonly kind;
-    private readonly source;
-    private readonly comments;
-    private readonly services;
-    private readonly unsubscribeComments;
-    private readonly ready;
-    private cols;
-    private rows;
-    private focused;
-    private closed;
-    private spaceArmed;
-    private state;
-    private cache;
-    /** Every non-deleted comment the daemon currently projects, newest last. */
-    private projection;
-    private status;
-    /** Region-local error/summary state — never a host notice (D1). */
-    private problem;
-    private composeAnchorLost;
-    private dirty;
-    /** Serializes base-hash transitions so B→C cannot overtake A→B. */
-    private remapChain;
-    constructor(opts: DocumentRegionOptions);
-    /** Resolves once the daemon coordinate base has been aligned to the file on
-     *  disk. The owner may await it so the first painted frame already carries
-     *  current ranges; painting earlier shows only a preparing line, never a
-     *  comment at a coordinate the daemon has not accepted. */
-    open(): Promise<void>;
-    hasUnsentCompose(): boolean;
-    setViewport(cols: number, rows: number): void;
-    render(): string[];
-    handleInput(data: string): boolean;
-    handleWheel(direction: 'up' | 'down', lines: number): boolean;
-    setFocused(value: boolean): void;
-    summary(): string;
-    onDirty(fn: () => void): void;
-    /** Releases this region's render cache and stops every projected repaint.
-     *  This region closes the source it was handed; that close stops its watcher. */
-    close(): void;
-    /** Bring the daemon's comment coordinates onto the bytes now on disk, then
-     *  build the first state from what the daemon accepted. The zero-comment case
-     *  still submits its batch: the base digest itself is what advances, and a
-     *  later create against current bytes is rejected until it does. */
-    private align;
-    private movedSince;
-    /** Re-derive this region from the daemon's own coordinate base. The only
-     *  honest recovery once a batch is rejected: the local map that produced it
-     *  is no longer a true description of what the daemon holds. */
-    private realign;
-    private buildState;
-    private onSourceChanged;
-    /** One transaction covering every non-deleted comment. A rejection is stated
-     *  in this region's own footer and the projection is re-read from the
-     *  authority, which is the only thing that can still be true afterwards. */
-    private submitBatch;
-    private refreshProjection;
-    private mutate;
-    private handleComposeKey;
-    private handleLeaderKey;
-    private handleListKey;
-    private handleViewKey;
-    /** The reviewed file is the deliverable: the person's own editor writes it,
-     *  this region never does. The source is re-read the moment the editor exits
-     *  rather than waiting for the watcher's coalescing window. */
-    private editInEditor;
-    /** The composition owns cursor focus; its focused document region contributes
-     * exactly one whole marker at the same visual location the document already
-     * calls active. There is deliberately no synthetic fallback row: a marker is
-     * only valid when it belongs to a rendered anchor or the compose/list cursor. */
-    private markCursorLocation;
-    /** The frame paints source rows after its three-line header. Scroll indicators
-     * replace their source rows, so they are never cursor targets. */
-    private activeAnchorFrameRow;
-    private reflow;
-    private document;
-    private bodyHeight;
-    private composeWidth;
-    private gutterWidth;
-    /** The region's own footer line: its error, then its stale verdict. */
-    private footerLine;
-    private renderPlaceholder;
-    /** `frame.ts` renders the ordinary list. Detached anchors need stronger
-     *  treatment: their own leading group plus the original range and snippet,
-     *  because no document marker can lead a person back to them. */
-    private renderGroupedList;
-    /** The compose header states a lost anchor where the person is already
-     *  looking, leaving the footer's compose keys intact. */
-    private statedComposeAnchor;
-    private commentListRow;
-    private topVisibleSourceLine;
-    private repaint;
-}

package/dist/clients/surfaces/region.d.ts

@@ -1,16 +0,0 @@
-export interface SurfaceRegion {
-    /** Geometry is PUSHED. A region never reads terminal or process geometry. */
-    setViewport(cols: number, rows: number): void;
-    /** Exactly `rows` lines, each ≤ `cols` display cells. */
-    render(): string[];
-    /** True when the chunk was consumed. Unconsumed chunks are DROPPED, never re-offered. */
-    handleInput(data: string): boolean;
-    handleWheel(direction: 'up' | 'down', lines: number): boolean;
-    /** Only a focused region may emit CURSOR_MARKER. */
-    setFocused(value: boolean): void;
-    /** One line of state for the composition's status row. */
-    summary(): string;
-    /** The region's ONLY repaint channel. */
-    onDirty(fn: () => void): void;
-    close(): void;
-}

package/dist/clients/web/__tests__/push-engine.test.js

@@ -1,158 +0,0 @@
-import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { test } from 'node:test';
-import { PushDiffEngine } from '../push-engine.js';
-import { PushLastSeenStore, PushRegistryStore } from '../push-registry.js';
-function tmpDir() {
-    return mkdtempSync(join(tmpdir(), 'crtr-push-engine-'));
-}
-function makeStores(dir) {
-    return {
-        registry: new PushRegistryStore(join(dir, 'registry.json')),
-        lastSeen: new PushLastSeenStore(join(dir, 'last-seen.json')),
-    };
-}
-function fakeSubscription(id, authScope = 'local') {
-    return {
-        id,
-        endpoint: `https://fcm.googleapis.com/fcm/send/${id}`,
-        keys: { p256dh: 'p'.repeat(32), auth: 'a'.repeat(16) },
-        authScope,
-        createdAt: 0,
-        lastSeenAt: 0,
-        prefs: { doneNotifications: true },
-    };
-}
-function buildHarness(dir, opts = {}) {
-    const { registry, lastSeen } = makeStores(dir);
-    const sent = [];
-    const sentTo = [];
-    const nodes = [];
-    const clock = { now: 1_000_000 };
-    const defaultSend = async (record, payload) => {
-        sent.push(payload);
-        sentTo.push(record.endpoint);
-        return 'sent';
-    };
-    const engine = new PushDiffEngine({
-        registry,
-        lastSeen,
-        readCanvasNodes: () => nodes,
-        sendPush: opts.sendPush ?? defaultSend,
-        isTargetScope: opts.isTargetScope ?? (() => true),
-        now: () => clock.now,
-        rateWindowMs: opts.rateWindowMs,
-    });
-    return { engine, sent, sentTo, registry, lastSeen, nodes, clock };
-}
-function seedRegistryWithOneSubscription(registry) {
-    registry.upsert(fakeSubscription('sub-1'));
-}
-test('seed() sends nothing regardless of current state', async () => {
-    const dir = tmpDir();
-    try {
-        const h = buildHarness(dir);
-        seedRegistryWithOneSubscription(h.registry);
-        h.nodes.push({ node_id: 'root-1', parent: null, status: 'done', attention_count: 0 });
-        await h.engine.seed();
-        assert.equal(h.sent.length, 0);
-        assert.deepEqual(h.lastSeen.snapshot().roots['root-1'], { status: 'done', attention_count: 0 });
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test('active -> done emits exactly one done push, and a repeat pass does not duplicate', async () => {
-    const dir = tmpDir();
-    try {
-        const h = buildHarness(dir);
-        seedRegistryWithOneSubscription(h.registry);
-        h.nodes.push({ node_id: 'root-1', parent: null, status: 'active', attention_count: 0 });
-        await h.engine.seed();
-        h.nodes[0].status = 'done';
-        await h.engine.onNodesInvalidation();
-        assert.equal(h.sent.length, 1);
-        assert.equal(h.sent[0].kind, 'done');
-        assert.equal(h.sent[0].conversationId, 'root-1');
-        await h.engine.onNodesInvalidation();
-        assert.equal(h.sent.length, 1);
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test('push targeting is scope-filtered', async () => {
-    const dir = tmpDir();
-    try {
-        const h = buildHarness(dir, { isTargetScope: (scope) => scope === 'token:abc' });
-        h.registry.upsert(fakeSubscription('sub-local', 'local'));
-        h.registry.upsert(fakeSubscription('sub-token', 'token:abc'));
-        h.nodes.push({ node_id: 'root-1', parent: null, status: 'active', attention_count: 0 });
-        await h.engine.seed();
-        h.nodes[0].status = 'done';
-        await h.engine.onNodesInvalidation();
-        assert.equal(h.sent.length, 1);
-        assert.deepEqual(h.sentTo, ['https://fcm.googleapis.com/fcm/send/sub-token']);
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test('a transient send failure does not advance last-seen and is retried next pass', async () => {
-    const dir = tmpDir();
-    try {
-        let call = 0;
-        const attempts = [];
-        const h = buildHarness(dir, {
-            rateWindowMs: 30_000,
-            sendPush: async (_record, payload) => {
-                attempts.push(payload);
-                call += 1;
-                return call === 1 ? 'error' : 'sent';
-            },
-        });
-        seedRegistryWithOneSubscription(h.registry);
-        h.nodes.push({ node_id: 'root-1', parent: null, status: 'active', attention_count: 0 });
-        await h.engine.seed();
-        h.nodes[0].status = 'done';
-        await h.engine.onNodesInvalidation();
-        assert.equal(attempts.length, 1);
-        assert.equal(h.lastSeen.snapshot().roots['root-1'].status, 'active');
-        h.clock.now += 60_000;
-        await h.engine.onNodesInvalidation();
-        assert.equal(attempts.length, 2);
-        assert.equal(h.lastSeen.snapshot().roots['root-1'].status, 'done');
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test('a transient failure on one subscription does not re-send to an already-delivered subscription', async () => {
-    const dir = tmpDir();
-    try {
-        const attemptsBySub = new Map();
-        const h = buildHarness(dir, {
-            rateWindowMs: 30_000,
-            sendPush: async (record) => {
-                const attempts = (attemptsBySub.get(record.endpoint) ?? 0) + 1;
-                attemptsBySub.set(record.endpoint, attempts);
-                return record.endpoint.includes('sub-fail') && attempts === 1 ? 'error' : 'sent';
-            },
-        });
-        h.registry.upsert(fakeSubscription('sub-ok'));
-        h.registry.upsert(fakeSubscription('sub-fail'));
-        h.nodes.push({ node_id: 'root-1', parent: null, status: 'active', attention_count: 0 });
-        await h.engine.seed();
-        h.nodes[0].status = 'done';
-        await h.engine.onNodesInvalidation();
-        h.clock.now += 60_000;
-        await h.engine.onNodesInvalidation();
-        assert.equal(attemptsBySub.get('https://fcm.googleapis.com/fcm/send/sub-ok'), 1);
-        assert.equal(attemptsBySub.get('https://fcm.googleapis.com/fcm/send/sub-fail'), 2);
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-});

package/dist/clients/web/__tests__/push-registry.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/clients/web/__tests__/push-registry.test.js

@@ -1,177 +0,0 @@
-import assert from 'node:assert/strict';
-import { createHash } from 'node:crypto';
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { test } from 'node:test';
-import { PushRegistryStore, PushRequestError, isAllowedPushEndpoint, parsePushDeleteBody, parsePushSubscriptionBody, pushBodyMaxBytes, subscriptionIdForEndpoint, } from '../push-registry.js';
-function tmpDir() {
-    return mkdtempSync(join(tmpdir(), 'crtr-push-registry-'));
-}
-// A real, allowlisted vendor push-service endpoint shape (Chromium/FCM) —
-// endpoints must resolve to one of the small set of known browser-vendor push
-// services; arbitrary hosts (including this suite's old `push.example.com`
-// placeholder) are no longer accepted.
-const VALID_ENDPOINT = 'https://fcm.googleapis.com/fcm/send/abc123';
-const VALID_P256DH = 'p'.repeat(64);
-const VALID_AUTH = 'a'.repeat(22);
-function validBody(overrides = {}) {
-    return JSON.stringify({
-        endpoint: VALID_ENDPOINT,
-        keys: { p256dh: VALID_P256DH, auth: VALID_AUTH },
-        ...overrides,
-    });
-}
-test('a well-formed subscription body parses and persists behind a scoped, non-secret authScope', () => {
-    const dir = tmpDir();
-    try {
-        const record = parsePushSubscriptionBody(validBody(), 'token:deadbeef');
-        assert.equal(record.endpoint, VALID_ENDPOINT);
-        assert.equal(record.authScope, 'token:deadbeef');
-        assert.equal(record.id, subscriptionIdForEndpoint(VALID_ENDPOINT));
-        assert.equal(record.prefs.doneNotifications, true);
-        const registry = new PushRegistryStore(join(dir, 'registry.json'));
-        registry.upsert(record);
-        assert.equal(registry.listByScope('token:deadbeef').length, 1);
-        // The persisted file never carries a raw bearer token \u2014 only the derived
-        // scope string, which is exactly what was passed in above.
-        const onDisk = readFileSync(join(dir, 'registry.json'), 'utf8');
-        assert.ok(onDisk.includes('token:deadbeef'));
-        assert.ok(!onDisk.toLowerCase().includes('bearer'));
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test('the registry persists only the derived scope digest, never the raw token pre-image', () => {
-    const dir = tmpDir();
-    try {
-        // Mirror scopeForToken (server.ts): scope = 'token:' + sha256(raw).base64url[:16].
-        const raw = 'SUPERSECRET-TOKEN-VALUE';
-        const scope = `token:${createHash('sha256').update(raw).digest('base64url').slice(0, 16)}`;
-        const record = parsePushSubscriptionBody(validBody(), scope);
-        const registry = new PushRegistryStore(join(dir, 'registry.json'));
-        registry.upsert(record);
-        const onDisk = readFileSync(join(dir, 'registry.json'), 'utf8');
-        assert.ok(onDisk.includes(scope));
-        assert.ok(!onDisk.includes(raw));
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test('rejects IPv6 and v4-mapped private/localhost endpoints before persistence', () => {
-    for (const endpoint of [
-        'https://[::1]/x',
-        'https://[fc00::1]/x',
-        'https://[fe80::1]/x',
-        'https://[::ffff:127.0.0.1]/x',
-    ]) {
-        assert.throws(() => parsePushSubscriptionBody(validBody({ endpoint }), 'local'), PushRequestError, endpoint);
-    }
-});
-test('the endpoint host must be an allowlisted push service — an arbitrary host is rejected even over https', () => {
-    for (const endpoint of [
-        'https://push.example.com/abc123', // not a recognized push-service host
-        'https://evil.attacker.example/abc123',
-        'https://fcm.googleapis.com.attacker.example/abc123', // suffix-spoof attempt
-        'https://notgooglapis.com/fcm/send/abc123',
-    ]) {
-        assert.throws(() => parsePushSubscriptionBody(validBody({ endpoint }), 'local'), PushRequestError, endpoint);
-        assert.equal(isAllowedPushEndpoint(endpoint), false, endpoint);
-    }
-});
-test('a trailing DNS root dot never bypasses the allowlist/localhost check', () => {
-    for (const endpoint of ['https://localhost./x', 'https://foo.localhost./x', 'https://fcm.googleapis.com./fcm/send/abc']) {
-        // The last one is a real allowlisted host WITH a trailing dot: it must
-        // canonicalize to the same allowed match, not be rejected as a foreign
-        // host, and localhost-with-trailing-dot must still be rejected.
-        if (endpoint.includes('localhost')) {
-            assert.throws(() => parsePushSubscriptionBody(validBody({ endpoint }), 'local'), PushRequestError, endpoint);
-        }
-        else {
-            assert.doesNotThrow(() => parsePushSubscriptionBody(validBody({ endpoint }), 'local'), endpoint);
-        }
-    }
-});
-test('the private/reserved IP ranges the old blocklist missed are moot under the allowlist — no IP literal is ever allowed', () => {
-    for (const endpoint of [
-        'https://0.0.0.0/x', // 0.0.0.0/8
-        'https://100.64.0.1/x', // CGNAT 100.64.0.0/10
-        'https://192.0.0.1/x', // 192.0.0.0/24
-        'https://198.18.0.1/x', // 198.18.0.0/15
-        'https://240.0.0.1/x', // 240.0.0.0/4
-        'https://224.0.0.1/x', // multicast
-        'https://[::]/x', // IPv6 unspecified
-        'https://[fe90::1]/x', // fe80::/10, beyond the fe80* prefix
-        'https://[ff02::1]/x', // IPv6 multicast
-        'https://8.8.8.8/x', // a genuinely PUBLIC IP — still not allowlisted
-    ]) {
-        assert.throws(() => parsePushSubscriptionBody(validBody({ endpoint }), 'local'), PushRequestError, endpoint);
-    }
-});
-test('every real browser-vendor push-service endpoint shape is allowlisted, including a subdomain form', () => {
-    for (const endpoint of [
-        'https://fcm.googleapis.com/fcm/send/abc123',
-        'https://android.googleapis.com/gcm/send/abc123',
-        'https://updates.push.services.mozilla.com/wpush/v2/abc123',
-        'https://web.push.apple.com/abc123',
-        'https://notify.windows.com/w/abc123',
-        'https://sub.notify.windows.com/w/abc123',
-        'https://wns.windows.com/w/abc123',
-        'https://sub.wns.windows.com/w/abc123',
-    ]) {
-        assert.equal(isAllowedPushEndpoint(endpoint), true, endpoint);
-        assert.doesNotThrow(() => parsePushSubscriptionBody(validBody({ endpoint }), 'local'), endpoint);
-    }
-});
-test('deleteByEndpoint is scoped: a caller can only remove a subscription it owns', () => {
-    const dir = tmpDir();
-    try {
-        const registry = new PushRegistryStore(join(dir, 'registry.json'));
-        registry.upsert(parsePushSubscriptionBody(validBody(), 'scope-A'));
-        assert.equal(registry.deleteByEndpoint(VALID_ENDPOINT, 'scope-B'), false);
-        assert.equal(registry.listByScope('scope-A').length, 1);
-        assert.equal(registry.deleteByEndpoint(VALID_ENDPOINT, 'scope-A'), true);
-        assert.equal(registry.listByScope('scope-A').length, 0);
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-});
-test('rejects a malformed body shape (unknown keys, missing fields)', () => {
-    assert.throws(() => parsePushSubscriptionBody(JSON.stringify({ endpoint: VALID_ENDPOINT }), 'local'), PushRequestError);
-    assert.throws(() => parsePushSubscriptionBody(JSON.stringify({ endpoint: VALID_ENDPOINT, keys: { p256dh: VALID_P256DH, auth: VALID_AUTH }, extra: 'nope' }), 'local'), PushRequestError);
-    assert.throws(() => parsePushSubscriptionBody('not json', 'local'), PushRequestError);
-});
-test('rejects an oversized body before persistence', () => {
-    const oversized = validBody({ prefs: { doneNotifications: true, pad: 'x'.repeat(pushBodyMaxBytes()) } });
-    assert.throws(() => parsePushSubscriptionBody(oversized, 'local'), PushRequestError);
-});
-test('rejects private/localhost/file/http endpoints before persistence', () => {
-    for (const endpoint of [
-        'http://push.example.com/abc', // not https
-        'https://localhost/abc',
-        'https://127.0.0.1/abc',
-        'https://10.0.0.5/abc',
-        'https://192.168.1.5/abc',
-        'file:///etc/passwd',
-        'not-a-url',
-    ]) {
-        assert.throws(() => parsePushSubscriptionBody(validBody({ endpoint }), 'local'), PushRequestError, endpoint);
-    }
-});
-test('rejects malformed base64url subscription keys', () => {
-    assert.throws(() => parsePushSubscriptionBody(validBody({ keys: { p256dh: 'not base64url!!', auth: VALID_AUTH } }), 'local'), PushRequestError);
-    assert.throws(() => parsePushSubscriptionBody(validBody({ keys: { p256dh: VALID_P256DH, auth: 'short' } }), 'local'), PushRequestError);
-});
-test('DELETE body parses down to just the endpoint', () => {
-    const { endpoint } = parsePushDeleteBody(JSON.stringify({ endpoint: VALID_ENDPOINT }));
-    assert.equal(endpoint, VALID_ENDPOINT);
-    assert.throws(() => parsePushDeleteBody(JSON.stringify({ endpoint: 'https://localhost/x' })), PushRequestError);
-});
-test('the id is a stable hash of the normalized endpoint, independent of scope', () => {
-    const a = parsePushSubscriptionBody(validBody(), 'local');
-    const b = parsePushSubscriptionBody(validBody(), 'token:other');
-    assert.equal(a.id, b.id);
-});

package/dist/clients/web/dev-server.d.ts

@@ -1,7 +0,0 @@
-import type { Server as HttpServer } from 'node:http';
-import type { ViteDevServer } from 'vite';
-/** Create a Vite dev server in middleware mode, HMR bound to `httpServer`.
- *  It loads the shell's Vite config rather than duplicating its plugins: that
- *  config supplies the PWA virtual-module resolver as well as the production
- *  build settings. Lazily imports vite so the shipped path never loads it. */
-export declare function createDevServer(httpServer: HttpServer): Promise<ViteDevServer>;

package/dist/clients/web/dev-server.js

@@ -1,46 +0,0 @@
-// dev-server.ts — `crtr web serve --dev` Vite middleware mode.
-//
-// The shipped server serves a prebuilt static shell bundle from dist/web-client/
-// (§11). In --dev a contributor iterating on the shell gets HMR instead: a Vite
-// dev server in MIDDLEWARE mode mounted on the SAME HTTP
-// server as the crtrd proxy + attach tunnel. This is the one place Vite runs at
-// runtime — the mainstream "Vite middleware in dev, static dist in prod" split.
-//
-// The crtrd REST proxy (/v1/*), the SSE lane (GET /__crtr/events) and the attach
-// tunnel are owned by server.ts and checked BEFORE Vite's middlewares; this
-// module only supplies the asset/HMR middleware. Vite's HMR WebSocket shares
-// the HTTP server (server.hmr.server) — server.ts's upgrade handler tunnels
-// `/node/<id>` to crtrd and leaves every other upgrade for Vite.
-import { resolve, dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-const HERE = dirname(fileURLToPath(import.meta.url));
-/** The shell SPA Vite root — the in-tree shell project (`src/clients/web/web-client/`).
- *  --dev is a from-source contributor loop, so this resolves against the source
- *  tree (HERE is `dist/clients/web` when built, `src/clients/web` under tsx);
- *  walk to the package root and into src. */
-function resolveShellRoot(packageRoot) {
-    return join(packageRoot, 'src', 'clients', 'web', 'web-client');
-}
-/** Create a Vite dev server in middleware mode, HMR bound to `httpServer`.
- *  It loads the shell's Vite config rather than duplicating its plugins: that
- *  config supplies the PWA virtual-module resolver as well as the production
- *  build settings. Lazily imports vite so the shipped path never loads it. */
-export async function createDevServer(httpServer) {
-    const packageRoot = resolve(HERE, '../../..');
-    const shellRoot = resolveShellRoot(packageRoot);
-    const { createServer } = await import('vite');
-    return createServer({
-        configFile: join(shellRoot, 'vite.config.ts'),
-        // The integrated middleware already owns /node, /v1, and /__crtr. The
-        // shell config uses this mode to omit its standalone-server proxies.
-        mode: 'middleware',
-        server: {
-            middlewareMode: true,
-            // Share our HTTP server for HMR; server.ts's upgrade handler hands every
-            // non-`/node/<id>` upgrade to Vite (the vite-hmr WebSocket).
-            hmr: { server: httpServer },
-            fs: { allow: [shellRoot, packageRoot] },
-        },
-        logLevel: 'warn',
-    });
-}

package/dist/clients/web/events.d.ts

@@ -1,19 +0,0 @@
-import type { ServerResponse } from 'node:http';
-export type ChangeKind = 'nodes' | 'inbox';
-export interface EventHub {
-    /** Register an SSE client: writes the event-stream headers, streams events
-     *  until the connection closes, and self-removes on close. */
-    addClient: (res: ServerResponse) => void;
-    /** Internal, in-process subscription to the same invalidations SSE clients
-     *  receive — for a server-side consumer (the push diff engine) that needs
-     *  the trigger without opening an HTTP/SSE connection to itself. Returns an
-     *  unsubscribe function. */
-    subscribe: (listener: (kind: ChangeKind) => void) => () => void;
-    /** Tear down watchers + heartbeat and end all open streams. */
-    close: () => void;
-}
-/** Start the change-event hub: open the two fs watchers once, fan their
- *  debounced invalidations out to every connected SSE client. Watchers run for
- *  the server's lifetime (cheap — two inotify/FSEvents registrations), not
- *  per-client, so N browsers share one watch. */
-export declare function startEventHub(): EventHub;