@oddsquad/vite-plugin-lit 0.2.3 → 0.3.0

package/lib/devframe/vite.js

@@ -0,0 +1,291 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+import {
+  INSPECT_CMD_CHANNEL,
+  INSPECT_DATA_CHANNEL,
+  INSPECT_OVERLAY_TOGGLE_CHANNEL,
+} from '../../types/inspector.js';
+import {HMR_INCOMPATIBLE_CHANNEL} from '../../types/hmr-incompatibility.js';
+import {SETTINGS_OVERRIDE_CHANNEL} from '../../types/timeline.js';
+import {createLitDevframe} from './definition.js';
+import {LIT_DEVFRAME_ID} from './protocol.js';
+export {createLitDevframe};
+/**
+ * `TimelineSource` over a Vite dev server's `hot` channel.
+ *
+ * `install()` runs the definition's `setup()` — and therefore
+ * `source.attach()` — before it resolves, so this is attached before a dev
+ * server is necessarily in hand. Calls made before {@link bind} are dropped
+ * rather than buffered: nothing can emit a page-runtime event until a page
+ * has connected to a bound server.
+ */
+export class HotTimelineSource {
+  #hot;
+  #sink;
+  #hub;
+  /**
+   * Wire the source to a live dev server. Call once, from `devtools.setup()`.
+   * `hub` is optional: without it the bridge still carries page traffic both
+   * ways, it just cannot bring the dock to the front on an overlay pick.
+   */
+  bind(server, hub) {
+    this.#hub = hub;
+    const hot = server.hot;
+    this.#hot = hot;
+    hot.on('lit:timeline:push-event', (data) => {
+      this.#sink?.pushEvents(data.events ?? []);
+    });
+    hot.on('lit:timeline:custom-layer', (data) => {
+      if (!data.layer?.id) return;
+      this.#sink?.addLayer(data.layer);
+    });
+    hot.on(INSPECT_DATA_CHANNEL, (data) => {
+      // An overlay pick means the developer clicked an element in the page and
+      // wants the Components tab. Bring the dock forward from the node side
+      // rather than having the panel reach into the parent frame.
+      if (data.type === 'pick') {
+        // Carry the target with the activation, not just the dock id: the
+        // params ride the hub's `devframe:docks:active` state, so a panel
+        // that mounts *because of* this pick still lands on the right
+        // element instead of racing the separate `pick` message.
+        this.#hub?.docks?.activate?.(LIT_DEVFRAME_ID, {componentId: data.id});
+      }
+      this.#sink?.inspectorMessage(data);
+    });
+    hot.on(HMR_INCOMPATIBLE_CHANNEL, (event) => {
+      this.#sink?.hmrIncompatible(event);
+    });
+    // The runtime announces itself on every connect. It boots from the
+    // compiled-in defaults (recording off), so the session's current state
+    // has to be pushed back down or a page that loads while recording is on
+    // captures nothing while every surface still reports `recording: true`.
+    hot.on('lit:timeline:runtime-ready', () => {
+      this.#sink?.runtimeReady();
+    });
+  }
+  /** Toggle the page's inspect overlay. Also used by the palette command. */
+  toggleOverlay() {
+    this.#hot?.send(INSPECT_OVERLAY_TOGGLE_CHANNEL);
+  }
+  attach(sink) {
+    this.#sink = sink;
+    return () => {
+      if (this.#sink === sink) this.#sink = undefined;
+    };
+  }
+  sendInspector(cmd) {
+    this.#hot?.send(INSPECT_CMD_CHANNEL, cmd);
+  }
+  setRecording(recording) {
+    this.#hot?.send('lit:timeline:recording-changed', {recording});
+  }
+  setLayers(layers) {
+    // Wire format matches what runtime/timeline/install.ts listens for: a flat
+    // map of the boolean toggle fields, not `{layers}`.
+    this.#hot?.send('lit:timeline:layers-changed', {
+      litLifecycleEnabled: layers.litLifecycleEnabled,
+      litRenderEnabled: layers.litRenderEnabled,
+      mouseEventEnabled: layers.mouseEventEnabled,
+      keyboardEventEnabled: layers.keyboardEventEnabled,
+    });
+  }
+  setSettingsOverride(override) {
+    this.#hot?.send(SETTINGS_OVERRIDE_CHANNEL, override);
+  }
+}
+/**
+ * One warning per process, not per dev server: a restart-heavy session
+ * should not paper the terminal with the same advisory. Carries the reason,
+ * because "discovery unavailable" with no cause is the kind of message that
+ * costs an afternoon when the guess below finally goes stale.
+ */
+let warnedDiscoveryUnavailable = false;
+const warnDiscoveryUnavailable = (reason) => {
+  if (warnedDiscoveryUnavailable) return;
+  warnedDiscoveryUnavailable = true;
+  console.warn(
+    `[lit-plugin] devframe instance-registry discovery unavailable ` +
+      `(${reason}); stdio MCP clients cannot auto-discover this dev ` +
+      `server. The MCP endpoint itself is unaffected — point clients at ` +
+      `<dev-server-origin>/__devtools/__mcp directly.`
+  );
+};
+/**
+ * Publish this devframe in devframe's global instance registry
+ * (`~/.devframe/instances/`), so stdio MCP connectors — `devframe connect`,
+ * this package's own `lit-devtools mcp` — find the running dev server
+ * without port guessing.
+ *
+ * `createDevServer()` registers itself, but this plugin never goes through
+ * it: it mounts into the Vite DevTools hub, and `@vitejs/devtools@0.7.5`
+ * calls `initHub()` with no `register` option, which defaults to off. So a
+ * Vite-hosted devframe is invisible to discovery unless a plugin publishes
+ * the record itself — which is all this does. `registerDevframeInstance()`
+ * is documented for exactly this case ("custom hosts that serve a devframe
+ * in-process call this explicitly with the origin they are reachable at"),
+ * and the registry is a directory of per-`pid`+`port` JSON files, so
+ * registrants coexist.
+ *
+ * The mount path is the soft spot: `/__devtools/` is where this version of
+ * Vite DevTools mounts, not a promise about where a devframe host mounts in
+ * general. So the guess is verified before it is published — the same
+ * `probeDevframeOrigin()` primitive the registry's own liveness check uses
+ * has to answer at that base, or nothing is registered. A record that
+ * doesn't answer is worse than no record: an agent dials it and gets 404s
+ * from a server that claimed to be there.
+ *
+ * The MCP path is then taken from what that probe *reports* rather than
+ * assumed to be the `__mcp` default, which removes the second guess
+ * entirely. Note the two path conventions in play: `__connection.json`
+ * serves `mcp.path` **relative** to the base (`"__mcp"`), while a registry
+ * record stores it **absolute** (`"/__devtools/__mcp"`) because the
+ * connector dials `origin + record.mcp.path` directly. Joining the two is
+ * exactly what devframe's own `probePort()` does with its root-mounted
+ * probe.
+ *
+ * Known sharp edge: records are keyed by `pid`+`port` alone. Another
+ * devframe-hosting plugin in the same Vite process would share this file,
+ * and whichever unregisters first removes it for both. Single-devframe use
+ * is the common case and there is no cross-plugin coordination primitive
+ * today.
+ */
+async function registerInstance(ctx, name) {
+  // Both imports are dynamic and optional: `@vitejs/devtools-kit` is an
+  // optional peer this package must never hard-resolve, and `devframe`'s
+  // `internal` subpath is only needed on this path.
+  const constants = await import('@vitejs/devtools-kit/constants').catch(
+    () => null
+  );
+  const internal = await import('devframe/internal').catch(() => null);
+  if (!constants) return {reason: '@vitejs/devtools-kit not resolvable'};
+  if (!internal) return {reason: 'devframe/internal not resolvable'};
+  const basePath = constants.DEVTOOLS_MOUNT_PATH;
+  const origin = ctx.host?.resolveOrigin?.();
+  if (!origin) return {reason: 'host origin unavailable'};
+  const probed = await internal.probeDevframeOrigin(origin, basePath);
+  if (!probed) {
+    return {reason: `no devframe answered at ${origin}${basePath}`};
+  }
+  // Relative (`"__mcp"`) as served, absolute as stored — see above. A host
+  // that already reports an absolute path is passed through unchanged.
+  const reported = probed.meta.mcp?.path;
+  const mcpPath =
+    reported === undefined
+      ? null
+      : reported.startsWith('/')
+        ? reported
+        : `${basePath}${reported}`;
+  const {unregister} = internal.registerDevframeInstance({
+    pid: process.pid,
+    // The probe reports the origin that actually answered — a `localhost`
+    // bind may only be dialable as `127.0.0.1` or `[::1]` — so its port is
+    // the one truly listening, which `config.server.port` is not when the
+    // configured port was taken.
+    port: Number(new URL(probed.origin).port) || 0,
+    origin: probed.origin,
+    basePath,
+    id: LIT_DEVFRAME_ID,
+    name,
+    rootDir: process.cwd(),
+    // Registering with `mcp: null` is honest rather than useless: the
+    // connector surfaces the instance with its own "MCP disabled" hint,
+    // which beats the instance being invisible.
+    mcp: mcpPath === null ? null : {path: mcpPath},
+    startedAt: Date.now(),
+  });
+  return {unregister};
+}
+/**
+ * Register once the dev server is actually accepting connections. The
+ * DevTools `setup()` hook runs during server construction, well before
+ * `listen()` resolves, so probing from there always fails to connect — the
+ * record has to wait for the port it is about to advertise to be real.
+ */
+function registerInstanceWhenListening(ctx, name) {
+  const httpServer = ctx.viteServer?.httpServer;
+  if (!httpServer) {
+    // Middleware mode: no server of our own to advertise.
+    warnDiscoveryUnavailable('no HTTP server (middleware mode?)');
+    return;
+  }
+  const run = () => {
+    registerInstance(ctx, name)
+      .then((result) => {
+        if ('unregister' in result) {
+          httpServer.once('close', result.unregister);
+        } else {
+          warnDiscoveryUnavailable(result.reason);
+        }
+      })
+      .catch((error) => {
+        warnDiscoveryUnavailable(String(error));
+      });
+  };
+  if (httpServer.listening) run();
+  else httpServer.once('listening', run);
+}
+/**
+ * The Vite plugin that mounts the Lit devframe on the DevTools hub. A no-op
+ * when DevTools is not active: without it nothing calls `devtools.setup()`,
+ * so the definition is never installed and the panel simply isn't there.
+ */
+export function createLitDevframePlugin(options) {
+  const source = new HotTimelineSource();
+  // Only known once `setup()` has the dev server, which is after the
+  // definition is built -- hence the getter.
+  let viteRoot;
+  const definition = createLitDevframe({
+    source,
+    version: options.version,
+    features: options.features,
+    clientAssets: options.clientAssets,
+    sourceRoot: () => viteRoot,
+  });
+  return {
+    name: `devframe:${LIT_DEVFRAME_ID}`,
+    devtools: {
+      // The panel reflects a running page, so there is nothing to mount
+      // during `vite build`. A static snapshot goes through
+      // `devframe/adapters/build` instead.
+      capabilities: {dev: true, build: false},
+      async setup(ctx) {
+        // Bind before installing: `install()` runs the definition's `setup()`,
+        // which attaches to this source, and the dev server is already
+        // available on the context by now.
+        if (ctx.viteServer) source.bind(ctx.viteServer, ctx);
+        viteRoot = ctx.viteServer?.config.root;
+        await ctx.install(definition);
+        // The overlay picker as a palette command with a managed shortcut.
+        // Only meaningful when the source overlay is enabled, since that is
+        // what draws the picker in the page.
+        if (options.features?.()?.sourceOverlay.enabled) {
+          ctx.commands?.register?.({
+            id: 'lit:overlay:toggle',
+            title: 'Pick Lit Element',
+            description:
+              'Click to inspect in the Components panel, hold Meta/Ctrl and click to open in your editor',
+            icon: 'ph:crosshair-duotone',
+            category: 'Lit',
+            keybindings: [{key: 'Meta+Shift+E'}],
+            handler: () => source.toggleOverlay(),
+          });
+        }
+        // Discovery is a convenience on top of a panel that already works,
+        // so this never blocks `setup()` and never throws: a failure costs
+        // the user the stdio MCP shortcut, and the direct URL still works.
+        registerInstanceWhenListening(ctx, definition.name);
+      },
+    },
+  };
+}
+/**
+ * The page-runtime bridge on its own, for a host that drives its own mount
+ * (or a test that wants to observe page traffic without a hub). Bind it to a
+ * dev server, then either hand it to {@link createLitDevframe} or
+ * {@link TimelineSource.attach} your own sink.
+ */
+export const createHotTimelineSource = () => new HotTimelineSource();
+//# sourceMappingURL=vite.js.map

package/lib/devframe/vite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite.js","sourceRoot":"","sources":["../../src/lib/devframe/vite.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAuBH,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAC,wBAAwB,EAAC,MAAM,oCAAoC,CAAC;AAE5E,OAAO,EAAC,yBAAyB,EAAC,MAAM,yBAAyB,CAAC;AAQlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAC,eAAe,EAAC,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAC,iBAAiB,EAAC,CAAC;AA6C3B;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IAC5B,IAAI,CAAmC;IACvC,KAAK,CAA2B;IAChC,IAAI,CAAiC;IAErC;;;;OAIG;IACH,IAAI,CAAC,MAAqB,EAAE,GAAwB;QAClD,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAEhB,GAAG,CAAC,EAAE,CAAC,yBAAyB,EAAE,CAAC,IAAgC,EAAE,EAAE;YACrE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,2BAA2B,EAAE,CAAC,IAA6B,EAAE,EAAE;YACpE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE;gBAAE,OAAO;YAC5B,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,IAAsB,EAAE,EAAE;YACtD,yEAAyE;YACzE,sEAAsE;YACtE,4DAA4D;YAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,kEAAkE;gBAClE,8DAA8D;gBAC9D,yDAAyD;gBACzD,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,eAAe,EAAE,EAAC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAC,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,wBAAwB,EAAE,CAAC,KAA8B,EAAE,EAAE;YAClE,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,GAAG,CAAC,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACxC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,aAAa;QACX,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,CAAC,IAAkB;QACvB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,OAAO,GAAG,EAAE;YACV,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;gBAAE,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QAClD,CAAC,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,GAAqB;QACjC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,YAAY,CAAC,SAAkB;QAC7B,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,gCAAgC,EAAE,EAAC,SAAS,EAAC,CAAC,CAAC;IACjE,CAAC;IAED,SAAS,CAAC,MAA2B;QACnC,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,6BAA6B,EAAE;YAC7C,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;SAClD,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB,CAAC,QAA0B;QAC5C,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;CACF;AAED;;;;;GAKG;AACH,IAAI,0BAA0B,GAAG,KAAK,CAAC;AAEvC,MAAM,wBAAwB,GAAG,CAAC,MAAc,EAAQ,EAAE;IACxD,IAAI,0BAA0B;QAAE,OAAO;IACvC,0BAA0B,GAAG,IAAI,CAAC;IAClC,OAAO,CAAC,IAAI,CACV,gEAAgE;QAC9D,IAAI,MAAM,qDAAqD;QAC/D,mEAAmE;QACnE,gDAAgD,CACnD,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAuB,EACvB,IAAY;IAEZ,sEAAsE;IACtE,uEAAuE;IACvE,kDAAkD;IAClD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC,KAAK,CACpE,GAAG,EAAE,CAAC,IAAI,CACX,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAC,MAAM,EAAE,qCAAqC,EAAC,CAAC;IACvE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAC,MAAM,EAAE,kCAAkC,EAAC,CAAC;IAEnE,MAAM,QAAQ,GAAG,SAAS,CAAC,mBAAmB,CAAC;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAC,MAAM,EAAE,yBAAyB,EAAC,CAAC;IAExD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAC,MAAM,EAAE,2BAA2B,MAAM,GAAG,QAAQ,EAAE,EAAC,CAAC;IAClE,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;IACvC,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YACxB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,GAAG,QAAQ,GAAG,QAAQ,EAAE,CAAC;IAEjC,MAAM,EAAC,UAAU,EAAC,GAAG,QAAQ,CAAC,wBAAwB,CAAC;QACrD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,6BAA6B;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ;QACR,EAAE,EAAE,eAAe;QACnB,IAAI;QACJ,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE;QACtB,kEAAkE;QAClE,oEAAoE;QACpE,4CAA4C;QAC5C,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,IAAI,EAAE,OAAO,EAAC;QAC9C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IACH,OAAO,EAAC,UAAU,EAAC,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAS,6BAA6B,CACpC,GAAuB,EACvB,IAAY;IAEZ,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC;IAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,sDAAsD;QACtD,wBAAwB,CAAC,mCAAmC,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,GAAS,EAAE;QACrB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC;aACxB,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;gBAC3B,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,IAAI,UAAU,CAAC,SAAS;QAAE,GAAG,EAAE,CAAC;;QAC3B,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAuC;IAEvC,MAAM,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACvC,mEAAmE;IACnE,2CAA2C;IAC3C,IAAI,QAA4B,CAAC;IACjC,MAAM,UAAU,GAAG,iBAAiB,CAAC;QACnC,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,YAAY,eAAe,EAAE;QACnC,QAAQ,EAAE;YACR,kEAAkE;YAClE,sDAAsD;YACtD,qCAAqC;YACrC,YAAY,EAAE,EAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAC;YACvC,KAAK,CAAC,KAAK,CAAC,GAAG;gBACb,uEAAuE;gBACvE,+DAA+D;gBAC/D,mCAAmC;gBACnC,IAAI,GAAG,CAAC,UAAU;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBACrD,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;gBACvC,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAE9B,mEAAmE;gBACnE,oEAAoE;gBACpE,qCAAqC;gBACrC,IAAI,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC;oBAChD,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;wBACvB,EAAE,EAAE,oBAAoB;wBACxB,KAAK,EAAE,kBAAkB;wBACzB,WAAW,EACT,2FAA2F;wBAC7F,IAAI,EAAE,sBAAsB;wBAC5B,QAAQ,EAAE,KAAK;wBACf,WAAW,EAAE,CAAC,EAAC,GAAG,EAAE,cAAc,EAAC,CAAC;wBACpC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE;qBACtC,CAAC,CAAC;gBACL,CAAC;gBAED,mEAAmE;gBACnE,mEAAmE;gBACnE,mEAAmE;gBACnE,6BAA6B,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACtD,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAsB,EAAE,CAC7D,IAAI,iBAAiB,EAAE,CAAC","sourcesContent":["/**\n * @license\n * Copyright 2026 Google LLC\n * SPDX-License-Identifier: BSD-3-Clause\n */\n\n/**\n * Mounts the Lit devframe ({@link createLitDevframe}) into the Vite DevTools\n * hub and bridges the page runtime's `import.meta.hot` transport to the\n * definition's `TimelineSource` port. Everything Vite-specific lives here:\n * the definition itself must keep running under `createDevServer()` with no\n * Vite installed.\n *\n * Vite DevTools 0.7+ is itself built on devframe, so its plugin context is a\n * devframe hub context: `ctx.install(definition)` serves the panel SPA from\n * the definition's `clientAssets`, registers its dock, and exposes its RPC\n * over the hub's authenticated WebSocket. That is all\n * `createPluginFromDevframe()` from `@vitejs/devtools-kit` does, so calling\n * `install` directly keeps DevTools an optional peer we never import at\n * runtime — the hook below is duck-typed, exactly as the panel's previous\n * dock registration was.\n *\n * @see plans/devframe-foundation.md\n */\n\nimport type {Plugin, ViteDevServer} from 'vite';\nimport type {DevframeDefinition} from 'devframe';\nimport {\n  INSPECT_CMD_CHANNEL,\n  INSPECT_DATA_CHANNEL,\n  INSPECT_OVERLAY_TOGGLE_CHANNEL,\n} from '../../types/inspector.js';\nimport type {\n  InspectorCommand,\n  InspectorMessage,\n} from '../../types/inspector.js';\nimport {HMR_INCOMPATIBLE_CHANNEL} from '../../types/hmr-incompatibility.js';\nimport type {HmrIncompatibilityEvent} from '../../types/hmr-incompatibility.js';\nimport {SETTINGS_OVERRIDE_CHANNEL} from '../../types/timeline.js';\nimport type {\n  FeatureSettings,\n  SettingsOverride,\n  TimelineEvent,\n  TimelineLayer,\n  TimelineLayersState,\n} from '../../types/timeline.js';\nimport {createLitDevframe} from './definition.js';\nimport {LIT_DEVFRAME_ID} from './protocol.js';\nimport type {TimelineSink, TimelineSource} from './source.js';\n\nexport {createLitDevframe};\n\n/**\n * The slice of the Vite DevTools hub context this plugin uses. Structurally a\n * subset of `ViteDevToolsNodeContext` from `@vitejs/devtools-kit/node`;\n * declared here so the package never imports that optional peer at runtime.\n * Install `@vitejs/devtools-kit` as a dev dependency to check it against the\n * real declarations.\n */\ninterface DevToolsHubContext {\n  readonly viteServer?: ViteDevServer;\n  /** Serve a devframe's SPA, register its dock, and run its `setup()`. */\n  install: (\n    devframe: DevframeDefinition,\n    options?: {base?: string; dock?: Record<string, unknown>}\n  ) => Promise<void>;\n  docks?: {\n    activate?: (dockId: string, params?: Record<string, unknown>) => void;\n  };\n  commands?: {register?: (command: Record<string, unknown>) => unknown};\n  /**\n   * The hub's host runtime. Structurally the slice of devframe's\n   * `DevframeHost` {@link registerInstance} needs; `DevframeHubContext`\n   * extends `DevframeNodeContext`, which carries it.\n   */\n  host?: {resolveOrigin?: () => string};\n}\n\ndeclare module 'vite' {\n  interface Plugin {\n    /** Vite DevTools plugin hook, contributed by `@vitejs/devtools`. */\n    devtools?: {\n      capabilities?: {dev?: boolean; build?: boolean};\n      setup: (ctx: DevToolsHubContext) => void | Promise<void>;\n    };\n  }\n}\n\nexport interface CreateLitDevframePluginOptions {\n  version: string;\n  features?: () => FeatureSettings | null;\n  /** Override the built panel SPA directory. Defaults to `dist/client`. */\n  clientAssets?: string;\n}\n\n/**\n * `TimelineSource` over a Vite dev server's `hot` channel.\n *\n * `install()` runs the definition's `setup()` — and therefore\n * `source.attach()` — before it resolves, so this is attached before a dev\n * server is necessarily in hand. Calls made before {@link bind} are dropped\n * rather than buffered: nothing can emit a page-runtime event until a page\n * has connected to a bound server.\n */\nexport class HotTimelineSource implements TimelineSource {\n  #hot: ViteDevServer['hot'] | undefined;\n  #sink: TimelineSink | undefined;\n  #hub: DevToolsHubContext | undefined;\n\n  /**\n   * Wire the source to a live dev server. Call once, from `devtools.setup()`.\n   * `hub` is optional: without it the bridge still carries page traffic both\n   * ways, it just cannot bring the dock to the front on an overlay pick.\n   */\n  bind(server: ViteDevServer, hub?: DevToolsHubContext): void {\n    this.#hub = hub;\n    const hot = server.hot;\n    this.#hot = hot;\n\n    hot.on('lit:timeline:push-event', (data: {events?: TimelineEvent[]}) => {\n      this.#sink?.pushEvents(data.events ?? []);\n    });\n\n    hot.on('lit:timeline:custom-layer', (data: {layer?: TimelineLayer}) => {\n      if (!data.layer?.id) return;\n      this.#sink?.addLayer(data.layer);\n    });\n\n    hot.on(INSPECT_DATA_CHANNEL, (data: InspectorMessage) => {\n      // An overlay pick means the developer clicked an element in the page and\n      // wants the Components tab. Bring the dock forward from the node side\n      // rather than having the panel reach into the parent frame.\n      if (data.type === 'pick') {\n        // Carry the target with the activation, not just the dock id: the\n        // params ride the hub's `devframe:docks:active` state, so a panel\n        // that mounts *because of* this pick still lands on the right\n        // element instead of racing the separate `pick` message.\n        this.#hub?.docks?.activate?.(LIT_DEVFRAME_ID, {componentId: data.id});\n      }\n      this.#sink?.inspectorMessage(data);\n    });\n\n    hot.on(HMR_INCOMPATIBLE_CHANNEL, (event: HmrIncompatibilityEvent) => {\n      this.#sink?.hmrIncompatible(event);\n    });\n\n    // The runtime announces itself on every connect. It boots from the\n    // compiled-in defaults (recording off), so the session's current state\n    // has to be pushed back down or a page that loads while recording is on\n    // captures nothing while every surface still reports `recording: true`.\n    hot.on('lit:timeline:runtime-ready', () => {\n      this.#sink?.runtimeReady();\n    });\n  }\n\n  /** Toggle the page's inspect overlay. Also used by the palette command. */\n  toggleOverlay(): void {\n    this.#hot?.send(INSPECT_OVERLAY_TOGGLE_CHANNEL);\n  }\n\n  attach(sink: TimelineSink): () => void {\n    this.#sink = sink;\n    return () => {\n      if (this.#sink === sink) this.#sink = undefined;\n    };\n  }\n\n  sendInspector(cmd: InspectorCommand): void {\n    this.#hot?.send(INSPECT_CMD_CHANNEL, cmd);\n  }\n\n  setRecording(recording: boolean): void {\n    this.#hot?.send('lit:timeline:recording-changed', {recording});\n  }\n\n  setLayers(layers: TimelineLayersState): void {\n    // Wire format matches what runtime/timeline/install.ts listens for: a flat\n    // map of the boolean toggle fields, not `{layers}`.\n    this.#hot?.send('lit:timeline:layers-changed', {\n      litLifecycleEnabled: layers.litLifecycleEnabled,\n      litRenderEnabled: layers.litRenderEnabled,\n      mouseEventEnabled: layers.mouseEventEnabled,\n      keyboardEventEnabled: layers.keyboardEventEnabled,\n    });\n  }\n\n  setSettingsOverride(override: SettingsOverride): void {\n    this.#hot?.send(SETTINGS_OVERRIDE_CHANNEL, override);\n  }\n}\n\n/**\n * One warning per process, not per dev server: a restart-heavy session\n * should not paper the terminal with the same advisory. Carries the reason,\n * because \"discovery unavailable\" with no cause is the kind of message that\n * costs an afternoon when the guess below finally goes stale.\n */\nlet warnedDiscoveryUnavailable = false;\n\nconst warnDiscoveryUnavailable = (reason: string): void => {\n  if (warnedDiscoveryUnavailable) return;\n  warnedDiscoveryUnavailable = true;\n  console.warn(\n    `[lit-plugin] devframe instance-registry discovery unavailable ` +\n      `(${reason}); stdio MCP clients cannot auto-discover this dev ` +\n      `server. The MCP endpoint itself is unaffected — point clients at ` +\n      `<dev-server-origin>/__devtools/__mcp directly.`\n  );\n};\n\n/**\n * Publish this devframe in devframe's global instance registry\n * (`~/.devframe/instances/`), so stdio MCP connectors — `devframe connect`,\n * this package's own `lit-devtools mcp` — find the running dev server\n * without port guessing.\n *\n * `createDevServer()` registers itself, but this plugin never goes through\n * it: it mounts into the Vite DevTools hub, and `@vitejs/devtools@0.7.5`\n * calls `initHub()` with no `register` option, which defaults to off. So a\n * Vite-hosted devframe is invisible to discovery unless a plugin publishes\n * the record itself — which is all this does. `registerDevframeInstance()`\n * is documented for exactly this case (\"custom hosts that serve a devframe\n * in-process call this explicitly with the origin they are reachable at\"),\n * and the registry is a directory of per-`pid`+`port` JSON files, so\n * registrants coexist.\n *\n * The mount path is the soft spot: `/__devtools/` is where this version of\n * Vite DevTools mounts, not a promise about where a devframe host mounts in\n * general. So the guess is verified before it is published — the same\n * `probeDevframeOrigin()` primitive the registry's own liveness check uses\n * has to answer at that base, or nothing is registered. A record that\n * doesn't answer is worse than no record: an agent dials it and gets 404s\n * from a server that claimed to be there.\n *\n * The MCP path is then taken from what that probe *reports* rather than\n * assumed to be the `__mcp` default, which removes the second guess\n * entirely. Note the two path conventions in play: `__connection.json`\n * serves `mcp.path` **relative** to the base (`\"__mcp\"`), while a registry\n * record stores it **absolute** (`\"/__devtools/__mcp\"`) because the\n * connector dials `origin + record.mcp.path` directly. Joining the two is\n * exactly what devframe's own `probePort()` does with its root-mounted\n * probe.\n *\n * Known sharp edge: records are keyed by `pid`+`port` alone. Another\n * devframe-hosting plugin in the same Vite process would share this file,\n * and whichever unregisters first removes it for both. Single-devframe use\n * is the common case and there is no cross-plugin coordination primitive\n * today.\n */\nasync function registerInstance(\n  ctx: DevToolsHubContext,\n  name: string\n): Promise<{unregister: () => void} | {reason: string}> {\n  // Both imports are dynamic and optional: `@vitejs/devtools-kit` is an\n  // optional peer this package must never hard-resolve, and `devframe`'s\n  // `internal` subpath is only needed on this path.\n  const constants = await import('@vitejs/devtools-kit/constants').catch(\n    () => null\n  );\n  const internal = await import('devframe/internal').catch(() => null);\n  if (!constants) return {reason: '@vitejs/devtools-kit not resolvable'};\n  if (!internal) return {reason: 'devframe/internal not resolvable'};\n\n  const basePath = constants.DEVTOOLS_MOUNT_PATH;\n  const origin = ctx.host?.resolveOrigin?.();\n  if (!origin) return {reason: 'host origin unavailable'};\n\n  const probed = await internal.probeDevframeOrigin(origin, basePath);\n  if (!probed) {\n    return {reason: `no devframe answered at ${origin}${basePath}`};\n  }\n\n  // Relative (`\"__mcp\"`) as served, absolute as stored — see above. A host\n  // that already reports an absolute path is passed through unchanged.\n  const reported = probed.meta.mcp?.path;\n  const mcpPath =\n    reported === undefined\n      ? null\n      : reported.startsWith('/')\n        ? reported\n        : `${basePath}${reported}`;\n\n  const {unregister} = internal.registerDevframeInstance({\n    pid: process.pid,\n    // The probe reports the origin that actually answered — a `localhost`\n    // bind may only be dialable as `127.0.0.1` or `[::1]` — so its port is\n    // the one truly listening, which `config.server.port` is not when the\n    // configured port was taken.\n    port: Number(new URL(probed.origin).port) || 0,\n    origin: probed.origin,\n    basePath,\n    id: LIT_DEVFRAME_ID,\n    name,\n    rootDir: process.cwd(),\n    // Registering with `mcp: null` is honest rather than useless: the\n    // connector surfaces the instance with its own \"MCP disabled\" hint,\n    // which beats the instance being invisible.\n    mcp: mcpPath === null ? null : {path: mcpPath},\n    startedAt: Date.now(),\n  });\n  return {unregister};\n}\n\n/**\n * Register once the dev server is actually accepting connections. The\n * DevTools `setup()` hook runs during server construction, well before\n * `listen()` resolves, so probing from there always fails to connect — the\n * record has to wait for the port it is about to advertise to be real.\n */\nfunction registerInstanceWhenListening(\n  ctx: DevToolsHubContext,\n  name: string\n): void {\n  const httpServer = ctx.viteServer?.httpServer;\n  if (!httpServer) {\n    // Middleware mode: no server of our own to advertise.\n    warnDiscoveryUnavailable('no HTTP server (middleware mode?)');\n    return;\n  }\n\n  const run = (): void => {\n    registerInstance(ctx, name)\n      .then((result) => {\n        if ('unregister' in result) {\n          httpServer.once('close', result.unregister);\n        } else {\n          warnDiscoveryUnavailable(result.reason);\n        }\n      })\n      .catch((error: unknown) => {\n        warnDiscoveryUnavailable(String(error));\n      });\n  };\n\n  if (httpServer.listening) run();\n  else httpServer.once('listening', run);\n}\n\n/**\n * The Vite plugin that mounts the Lit devframe on the DevTools hub. A no-op\n * when DevTools is not active: without it nothing calls `devtools.setup()`,\n * so the definition is never installed and the panel simply isn't there.\n */\nexport function createLitDevframePlugin(\n  options: CreateLitDevframePluginOptions\n): Plugin {\n  const source = new HotTimelineSource();\n  // Only known once `setup()` has the dev server, which is after the\n  // definition is built -- hence the getter.\n  let viteRoot: string | undefined;\n  const definition = createLitDevframe({\n    source,\n    version: options.version,\n    features: options.features,\n    clientAssets: options.clientAssets,\n    sourceRoot: () => viteRoot,\n  });\n\n  return {\n    name: `devframe:${LIT_DEVFRAME_ID}`,\n    devtools: {\n      // The panel reflects a running page, so there is nothing to mount\n      // during `vite build`. A static snapshot goes through\n      // `devframe/adapters/build` instead.\n      capabilities: {dev: true, build: false},\n      async setup(ctx) {\n        // Bind before installing: `install()` runs the definition's `setup()`,\n        // which attaches to this source, and the dev server is already\n        // available on the context by now.\n        if (ctx.viteServer) source.bind(ctx.viteServer, ctx);\n        viteRoot = ctx.viteServer?.config.root;\n        await ctx.install(definition);\n\n        // The overlay picker as a palette command with a managed shortcut.\n        // Only meaningful when the source overlay is enabled, since that is\n        // what draws the picker in the page.\n        if (options.features?.()?.sourceOverlay.enabled) {\n          ctx.commands?.register?.({\n            id: 'lit:overlay:toggle',\n            title: 'Pick Lit Element',\n            description:\n              'Click to inspect in the Components panel, hold Meta/Ctrl and click to open in your editor',\n            icon: 'ph:crosshair-duotone',\n            category: 'Lit',\n            keybindings: [{key: 'Meta+Shift+E'}],\n            handler: () => source.toggleOverlay(),\n          });\n        }\n\n        // Discovery is a convenience on top of a panel that already works,\n        // so this never blocks `setup()` and never throws: a failure costs\n        // the user the stdio MCP shortcut, and the direct URL still works.\n        registerInstanceWhenListening(ctx, definition.name);\n      },\n    },\n  };\n}\n\n/**\n * The page-runtime bridge on its own, for a host that drives its own mount\n * (or a test that wants to observe page traffic without a hub). Bind it to a\n * dev server, then either hand it to {@link createLitDevframe} or\n * {@link TimelineSource.attach} your own sink.\n */\nexport const createHotTimelineSource = (): HotTimelineSource =>\n  new HotTimelineSource();\n"]}

package/lib/http.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+/**
+ * Headers the trust check looks at. Both the open-in-editor endpoint and the
+ * timeline/inspector endpoints are local-only dev tooling: only the page the
+ * dev server itself served may drive them.
+ */
+export interface TrustHeaders {
+    origin?: string;
+    host?: string;
+    'sec-fetch-site'?: string;
+}
+/**
+ * True when the request demonstrably comes from the dev server's own page.
+ *
+ * Two independent signals, because neither is present on every request:
+ *   - `Origin` is sent on CORS-mode fetches and on every non-GET/HEAD request,
+ *     but NOT on a plain cross-site GET (`<img>`, `<iframe>`, a navigation).
+ *   - `Sec-Fetch-Site` is sent by Chromium and Firefox on every request and is
+ *     the signal that covers exactly that gap; `same-origin` and `none` (a
+ *     user-typed URL) are ours, `cross-site`/`same-site` are not.
+ * A request is trusted only when every signal it does carry says same-origin,
+ * and at least one of them is present.
+ */
+export declare const isTrustedRequest: (headers: TrustHeaders) => boolean;
+//# sourceMappingURL=http.d.ts.map

package/lib/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/lib/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,YAAa,YAAY,KAAG,OAgBxD,CAAC"}

package/lib/http.js

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+/**
+ * True when the request demonstrably comes from the dev server's own page.
+ *
+ * Two independent signals, because neither is present on every request:
+ *   - `Origin` is sent on CORS-mode fetches and on every non-GET/HEAD request,
+ *     but NOT on a plain cross-site GET (`<img>`, `<iframe>`, a navigation).
+ *   - `Sec-Fetch-Site` is sent by Chromium and Firefox on every request and is
+ *     the signal that covers exactly that gap; `same-origin` and `none` (a
+ *     user-typed URL) are ours, `cross-site`/`same-site` are not.
+ * A request is trusted only when every signal it does carry says same-origin,
+ * and at least one of them is present.
+ */
+export const isTrustedRequest = (headers) => {
+  const site = headers['sec-fetch-site'];
+  if (site !== undefined) {
+    if (site !== 'same-origin' && site !== 'none') return false;
+  }
+  const {origin, host} = headers;
+  if (origin !== undefined && origin !== 'null') {
+    try {
+      if (new URL(origin).host !== host) return false;
+    } catch {
+      return false;
+    }
+    return true;
+  }
+  // No `Origin`: trust only when `Sec-Fetch-Site` vouched for it above.
+  return site !== undefined;
+};
+//# sourceMappingURL=http.js.map

package/lib/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/lib/http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAqB,EAAW,EAAE;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,MAAM,EAAC,MAAM,EAAE,IAAI,EAAC,GAAG,OAAO,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,sEAAsE;IACtE,OAAO,IAAI,KAAK,SAAS,CAAC;AAC5B,CAAC,CAAC","sourcesContent":["/**\n * @license\n * Copyright 2026 Google LLC\n * SPDX-License-Identifier: BSD-3-Clause\n */\n\n/**\n * Headers the trust check looks at. Both the open-in-editor endpoint and the\n * timeline/inspector endpoints are local-only dev tooling: only the page the\n * dev server itself served may drive them.\n */\nexport interface TrustHeaders {\n  origin?: string;\n  host?: string;\n  'sec-fetch-site'?: string;\n}\n\n/**\n * True when the request demonstrably comes from the dev server's own page.\n *\n * Two independent signals, because neither is present on every request:\n *   - `Origin` is sent on CORS-mode fetches and on every non-GET/HEAD request,\n *     but NOT on a plain cross-site GET (`<img>`, `<iframe>`, a navigation).\n *   - `Sec-Fetch-Site` is sent by Chromium and Firefox on every request and is\n *     the signal that covers exactly that gap; `same-origin` and `none` (a\n *     user-typed URL) are ours, `cross-site`/`same-site` are not.\n * A request is trusted only when every signal it does carry says same-origin,\n * and at least one of them is present.\n */\nexport const isTrustedRequest = (headers: TrustHeaders): boolean => {\n  const site = headers['sec-fetch-site'];\n  if (site !== undefined) {\n    if (site !== 'same-origin' && site !== 'none') return false;\n  }\n  const {origin, host} = headers;\n  if (origin !== undefined && origin !== 'null') {\n    try {\n      if (new URL(origin).host !== host) return false;\n    } catch {\n      return false;\n    }\n    return true;\n  }\n  // No `Origin`: trust only when `Sec-Fetch-Site` vouched for it above.\n  return site !== undefined;\n};\n"]}

package/lib/icons.d.ts

@@ -7,6 +7,8 @@
 export declare const CUBE_ICON = "M223.68,66.15,135.68,18h0a15.88,15.88,0,0,0-15.36,0l-88,48.17a16,16,0,0,0-8.32,14v95.64a16,16,0,0,0,8.32,14l88,48.17a15.88,15.88,0,0,0,15.36,0l88-48.17a16,16,0,0,0,8.32-14V80.18A16,16,0,0,0,223.68,66.15ZM128,32h0l80.34,44L128,120,47.66,76ZM40,90l80,43.78v85.79L40,175.82Zm96,129.57V133.82L216,90v85.78Z";
 /** `clock` — Timeline tab. */
 export declare const CLOCK_ICON = "M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm64-88a8,8,0,0,1-8,8H128a8,8,0,0,1-8-8V72a8,8,0,0,1,16,0v48h48A8,8,0,0,1,192,128Z";
+/** `notification` — Updates tab. */
+export declare const NOTIFICATION_ICON = "M216,128v80a16,16,0,0,1-16,16H48a16,16,0,0,1-16-16V56A16,16,0,0,1,48,40h80a8,8,0,0,1,0,16H48V208H200V128a8,8,0,0,1,16,0Zm16-68a36,36,0,1,1-36-36A36,36,0,0,1,232,60Zm-16,0a20,20,0,1,0-20,20A20,20,0,0,0,216,60Z";
 /** `gear` — Settings tab. */
 export declare const GEAR_ICON = "M128,80a48,48,0,1,0,48,48A48.05,48.05,0,0,0,128,80Zm0,80a32,32,0,1,1,32-32A32,32,0,0,1,128,160Zm88-29.84q.06-2.16,0-4.32l14.92-18.64a8,8,0,0,0,1.48-7.06,107.21,107.21,0,0,0-10.88-26.25,8,8,0,0,0-6-3.93l-23.72-2.64q-1.48-1.56-3-3L186,40.54a8,8,0,0,0-3.94-6,107.71,107.71,0,0,0-26.25-10.87,8,8,0,0,0-7.06,1.49L130.16,40Q128,40,125.84,40L107.2,25.11a8,8,0,0,0-7.06-1.48A107.6,107.6,0,0,0,73.89,34.51a8,8,0,0,0-3.93,6L67.32,64.27q-1.56,1.49-3,3L40.54,70a8,8,0,0,0-6,3.94,107.71,107.71,0,0,0-10.87,26.25,8,8,0,0,0,1.49,7.06L40,125.84Q40,128,40,130.16L25.11,148.8a8,8,0,0,0-1.48,7.06,107.21,107.21,0,0,0,10.88,26.25,8,8,0,0,0,6,3.93l23.72,2.64q1.49,1.56,3,3L70,215.46a8,8,0,0,0,3.94,6,107.71,107.71,0,0,0,26.25,10.87,8,8,0,0,0,7.06-1.49L125.84,216q2.16.06,4.32,0l18.64,14.92a8,8,0,0,0,7.06,1.48,107.21,107.21,0,0,0,26.25-10.88,8,8,0,0,0,3.93-6l2.64-23.72q1.56-1.48,3-3L215.46,186a8,8,0,0,0,6-3.94,107.71,107.71,0,0,0,10.87-26.25,8,8,0,0,0-1.49-7.06Zm-16.1-6.5a73.93,73.93,0,0,1,0,8.68,8,8,0,0,0,1.74,5.48l14.19,17.73a91.57,91.57,0,0,1-6.23,15L187,173.11a8,8,0,0,0-5.1,2.64,74.11,74.11,0,0,1-6.14,6.14,8,8,0,0,0-2.64,5.1l-2.51,22.58a91.32,91.32,0,0,1-15,6.23l-17.74-14.19a8,8,0,0,0-5-1.75h-.48a73.93,73.93,0,0,1-8.68,0,8,8,0,0,0-5.48,1.74L100.45,215.8a91.57,91.57,0,0,1-15-6.23L82.89,187a8,8,0,0,0-2.64-5.1,74.11,74.11,0,0,1-6.14-6.14,8,8,0,0,0-5.1-2.64L46.43,170.6a91.32,91.32,0,0,1-6.23-15l14.19-17.74a8,8,0,0,0,1.74-5.48,73.93,73.93,0,0,1,0-8.68,8,8,0,0,0-1.74-5.48L40.2,100.45a91.57,91.57,0,0,1,6.23-15L69,82.89a8,8,0,0,0,5.1-2.64,74.11,74.11,0,0,1,6.14-6.14A8,8,0,0,0,82.89,69L85.4,46.43a91.32,91.32,0,0,1,15-6.23l17.74,14.19a8,8,0,0,0,5.48,1.74,73.93,73.93,0,0,1,8.68,0,8,8,0,0,0,5.48-1.74L155.55,40.2a91.57,91.57,0,0,1,15,6.23L173.11,69a8,8,0,0,0,2.64,5.1,74.11,74.11,0,0,1,6.14,6.14,8,8,0,0,0,5.1,2.64l22.58,2.51a91.32,91.32,0,0,1,6.23,15l-14.19,17.74A8,8,0,0,0,199.87,123.66Z";
 /** `code` — the source overlay's "open in editor" affordance. */

package/lib/icons.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"icons.d.ts","sourceRoot":"","sources":["../../../packages/labs/vite-plugin-lit/src/lib/icons.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,+BAA+B;AAC/B,eAAO,MAAM,SAAS,mTAC4R,CAAC;AAEnT,8BAA8B;AAC9B,eAAO,MAAM,UAAU,gMACwK,CAAC;AAEhM,6BAA6B;AAC7B,eAAO,MAAM,SAAS,01DACm0D,CAAC;AAE11D,iEAAiE;AACjE,eAAO,MAAM,SAAS,gbAA0a,CAAC;AAEjc,mEAAmE;AACnE,eAAO,MAAM,SAAS,yPAAmP,CAAC;AAE1Q,iDAAiD;AACjD,eAAO,MAAM,UAAU,kfAA4e,CAAC"}
+{"version":3,"file":"icons.d.ts","sourceRoot":"","sources":["../src/lib/icons.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,+BAA+B;AAC/B,eAAO,MAAM,SAAS,mTAC4R,CAAC;AAEnT,8BAA8B;AAC9B,eAAO,MAAM,UAAU,gMACwK,CAAC;AAEhM,oCAAoC;AACpC,eAAO,MAAM,iBAAiB,qNACsL,CAAC;AAErN,6BAA6B;AAC7B,eAAO,MAAM,SAAS,01DACm0D,CAAC;AAE11D,iEAAiE;AACjE,eAAO,MAAM,SAAS,gbAA0a,CAAC;AAEjc,mEAAmE;AACnE,eAAO,MAAM,SAAS,yPAAmP,CAAC;AAE1Q,iDAAiD;AACjD,eAAO,MAAM,UAAU,kfAA4e,CAAC"}

package/lib/icons.js

@@ -9,15 +9,21 @@
 // fill="currentColor"><path d={...}/></svg>; runtime icons are full markup
 // injected as raw HTML.
 /** `cube` — Components tab. */
-export const CUBE_ICON = 'M223.68,66.15,135.68,18h0a15.88,15.88,0,0,0-15.36,0l-88,48.17a16,16,0,0,0-8.32,14v95.64a16,16,0,0,0,8.32,14l88,48.17a15.88,15.88,0,0,0,15.36,0l88-48.17a16,16,0,0,0,8.32-14V80.18A16,16,0,0,0,223.68,66.15ZM128,32h0l80.34,44L128,120,47.66,76ZM40,90l80,43.78v85.79L40,175.82Zm96,129.57V133.82L216,90v85.78Z';
+export const CUBE_ICON =
+  'M223.68,66.15,135.68,18h0a15.88,15.88,0,0,0-15.36,0l-88,48.17a16,16,0,0,0-8.32,14v95.64a16,16,0,0,0,8.32,14l88,48.17a15.88,15.88,0,0,0,15.36,0l88-48.17a16,16,0,0,0,8.32-14V80.18A16,16,0,0,0,223.68,66.15ZM128,32h0l80.34,44L128,120,47.66,76ZM40,90l80,43.78v85.79L40,175.82Zm96,129.57V133.82L216,90v85.78Z';
 /** `clock` — Timeline tab. */
-export const CLOCK_ICON = 'M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm64-88a8,8,0,0,1-8,8H128a8,8,0,0,1-8-8V72a8,8,0,0,1,16,0v48h48A8,8,0,0,1,192,128Z';
+export const CLOCK_ICON =
+  'M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm64-88a8,8,0,0,1-8,8H128a8,8,0,0,1-8-8V72a8,8,0,0,1,16,0v48h48A8,8,0,0,1,192,128Z';
+/** `notification` — Updates tab. */
+export const NOTIFICATION_ICON =
+  'M216,128v80a16,16,0,0,1-16,16H48a16,16,0,0,1-16-16V56A16,16,0,0,1,48,40h80a8,8,0,0,1,0,16H48V208H200V128a8,8,0,0,1,16,0Zm16-68a36,36,0,1,1-36-36A36,36,0,0,1,232,60Zm-16,0a20,20,0,1,0-20,20A20,20,0,0,0,216,60Z';
 /** `gear` — Settings tab. */
-export const GEAR_ICON = 'M128,80a48,48,0,1,0,48,48A48.05,48.05,0,0,0,128,80Zm0,80a32,32,0,1,1,32-32A32,32,0,0,1,128,160Zm88-29.84q.06-2.16,0-4.32l14.92-18.64a8,8,0,0,0,1.48-7.06,107.21,107.21,0,0,0-10.88-26.25,8,8,0,0,0-6-3.93l-23.72-2.64q-1.48-1.56-3-3L186,40.54a8,8,0,0,0-3.94-6,107.71,107.71,0,0,0-26.25-10.87,8,8,0,0,0-7.06,1.49L130.16,40Q128,40,125.84,40L107.2,25.11a8,8,0,0,0-7.06-1.48A107.6,107.6,0,0,0,73.89,34.51a8,8,0,0,0-3.93,6L67.32,64.27q-1.56,1.49-3,3L40.54,70a8,8,0,0,0-6,3.94,107.71,107.71,0,0,0-10.87,26.25,8,8,0,0,0,1.49,7.06L40,125.84Q40,128,40,130.16L25.11,148.8a8,8,0,0,0-1.48,7.06,107.21,107.21,0,0,0,10.88,26.25,8,8,0,0,0,6,3.93l23.72,2.64q1.49,1.56,3,3L70,215.46a8,8,0,0,0,3.94,6,107.71,107.71,0,0,0,26.25,10.87,8,8,0,0,0,7.06-1.49L125.84,216q2.16.06,4.32,0l18.64,14.92a8,8,0,0,0,7.06,1.48,107.21,107.21,0,0,0,26.25-10.88,8,8,0,0,0,3.93-6l2.64-23.72q1.56-1.48,3-3L215.46,186a8,8,0,0,0,6-3.94,107.71,107.71,0,0,0,10.87-26.25,8,8,0,0,0-1.49-7.06Zm-16.1-6.5a73.93,73.93,0,0,1,0,8.68,8,8,0,0,0,1.74,5.48l14.19,17.73a91.57,91.57,0,0,1-6.23,15L187,173.11a8,8,0,0,0-5.1,2.64,74.11,74.11,0,0,1-6.14,6.14,8,8,0,0,0-2.64,5.1l-2.51,22.58a91.32,91.32,0,0,1-15,6.23l-17.74-14.19a8,8,0,0,0-5-1.75h-.48a73.93,73.93,0,0,1-8.68,0,8,8,0,0,0-5.48,1.74L100.45,215.8a91.57,91.57,0,0,1-15-6.23L82.89,187a8,8,0,0,0-2.64-5.1,74.11,74.11,0,0,1-6.14-6.14,8,8,0,0,0-5.1-2.64L46.43,170.6a91.32,91.32,0,0,1-6.23-15l14.19-17.74a8,8,0,0,0,1.74-5.48,73.93,73.93,0,0,1,0-8.68,8,8,0,0,0-1.74-5.48L40.2,100.45a91.57,91.57,0,0,1,6.23-15L69,82.89a8,8,0,0,0,5.1-2.64,74.11,74.11,0,0,1,6.14-6.14A8,8,0,0,0,82.89,69L85.4,46.43a91.32,91.32,0,0,1,15-6.23l17.74,14.19a8,8,0,0,0,5.48,1.74,73.93,73.93,0,0,1,8.68,0,8,8,0,0,0,5.48-1.74L155.55,40.2a91.57,91.57,0,0,1,15,6.23L173.11,69a8,8,0,0,0,2.64,5.1,74.11,74.11,0,0,1,6.14,6.14,8,8,0,0,0,5.1,2.64l22.58,2.51a91.32,91.32,0,0,1,6.23,15l-14.19,17.74A8,8,0,0,0,199.87,123.66Z';
+export const GEAR_ICON =
+  'M128,80a48,48,0,1,0,48,48A48.05,48.05,0,0,0,128,80Zm0,80a32,32,0,1,1,32-32A32,32,0,0,1,128,160Zm88-29.84q.06-2.16,0-4.32l14.92-18.64a8,8,0,0,0,1.48-7.06,107.21,107.21,0,0,0-10.88-26.25,8,8,0,0,0-6-3.93l-23.72-2.64q-1.48-1.56-3-3L186,40.54a8,8,0,0,0-3.94-6,107.71,107.71,0,0,0-26.25-10.87,8,8,0,0,0-7.06,1.49L130.16,40Q128,40,125.84,40L107.2,25.11a8,8,0,0,0-7.06-1.48A107.6,107.6,0,0,0,73.89,34.51a8,8,0,0,0-3.93,6L67.32,64.27q-1.56,1.49-3,3L40.54,70a8,8,0,0,0-6,3.94,107.71,107.71,0,0,0-10.87,26.25,8,8,0,0,0,1.49,7.06L40,125.84Q40,128,40,130.16L25.11,148.8a8,8,0,0,0-1.48,7.06,107.21,107.21,0,0,0,10.88,26.25,8,8,0,0,0,6,3.93l23.72,2.64q1.49,1.56,3,3L70,215.46a8,8,0,0,0,3.94,6,107.71,107.71,0,0,0,26.25,10.87,8,8,0,0,0,7.06-1.49L125.84,216q2.16.06,4.32,0l18.64,14.92a8,8,0,0,0,7.06,1.48,107.21,107.21,0,0,0,26.25-10.88,8,8,0,0,0,3.93-6l2.64-23.72q1.56-1.48,3-3L215.46,186a8,8,0,0,0,6-3.94,107.71,107.71,0,0,0,10.87-26.25,8,8,0,0,0-1.49-7.06Zm-16.1-6.5a73.93,73.93,0,0,1,0,8.68,8,8,0,0,0,1.74,5.48l14.19,17.73a91.57,91.57,0,0,1-6.23,15L187,173.11a8,8,0,0,0-5.1,2.64,74.11,74.11,0,0,1-6.14,6.14,8,8,0,0,0-2.64,5.1l-2.51,22.58a91.32,91.32,0,0,1-15,6.23l-17.74-14.19a8,8,0,0,0-5-1.75h-.48a73.93,73.93,0,0,1-8.68,0,8,8,0,0,0-5.48,1.74L100.45,215.8a91.57,91.57,0,0,1-15-6.23L82.89,187a8,8,0,0,0-2.64-5.1,74.11,74.11,0,0,1-6.14-6.14,8,8,0,0,0-5.1-2.64L46.43,170.6a91.32,91.32,0,0,1-6.23-15l14.19-17.74a8,8,0,0,0,1.74-5.48,73.93,73.93,0,0,1,0-8.68,8,8,0,0,0-1.74-5.48L40.2,100.45a91.57,91.57,0,0,1,6.23-15L69,82.89a8,8,0,0,0,5.1-2.64,74.11,74.11,0,0,1,6.14-6.14A8,8,0,0,0,82.89,69L85.4,46.43a91.32,91.32,0,0,1,15-6.23l17.74,14.19a8,8,0,0,0,5.48,1.74,73.93,73.93,0,0,1,8.68,0,8,8,0,0,0,5.48-1.74L155.55,40.2a91.57,91.57,0,0,1,15,6.23L173.11,69a8,8,0,0,0,2.64,5.1,74.11,74.11,0,0,1,6.14,6.14,8,8,0,0,0,5.1,2.64l22.58,2.51a91.32,91.32,0,0,1,6.23,15l-14.19,17.74A8,8,0,0,0,199.87,123.66Z';
 /** `code` — the source overlay's "open in editor" affordance. */
 export const CODE_ICON = `<svg viewBox="0 0 256 256" aria-hidden="true"><path d="M69.12,94.15,28.5,128l40.62,33.85a8,8,0,1,1-10.24,12.29l-48-40a8,8,0,0,1,0-12.29l48-40a8,8,0,0,1,10.24,12.3Zm176,27.7-48-40a8,8,0,1,0-10.24,12.3L227.5,128l-40.62,33.85a8,8,0,1,0,10.24,12.29l48-40a8,8,0,0,0,0-12.29ZM162.73,32.48a8,8,0,0,0-10.25,4.79l-64,176a8,8,0,0,0,4.79,10.26A8.14,8.14,0,0,0,96,224a8,8,0,0,0,7.52-5.27l64-176A8,8,0,0,0,162.73,32.48Z"></path></svg>`;
 /** `copy-simple` — the source overlay's "copy path" affordance. */
 export const COPY_ICON = `<svg viewBox="0 0 256 256" aria-hidden="true"><path d="M184,64H40a8,8,0,0,0-8,8V216a8,8,0,0,0,8,8H184a8,8,0,0,0,8-8V72A8,8,0,0,0,184,64Zm-8,144H48V80H176ZM224,40V184a8,8,0,0,1-16,0V48H72a8,8,0,0,1,0-16H216A8,8,0,0,1,224,40Z"></path></svg>`;
 /** `flame` — the HMR update indicator's mark. */
 export const FLAME_ICON = `<svg viewBox="0 0 256 256" aria-hidden="true"><path d="M183.89,153.34a57.6,57.6,0,0,1-46.56,46.55A8.75,8.75,0,0,1,136,200a8,8,0,0,1-1.32-15.89c16.57-2.79,30.63-16.85,33.44-33.45a8,8,0,0,1,15.78,2.68ZM216,144a88,88,0,0,1-176,0c0-27.92,11-56.47,32.66-84.85a8,8,0,0,1,11.93-.89l24.12,23.41,22-60.41a8,8,0,0,1,12.63-3.41C165.21,36,216,84.55,216,144Zm-16,0c0-46.09-35.79-85.92-58.21-106.33L119.52,98.74a8,8,0,0,1-13.09,3L80.06,76.16C64.09,99.21,56,122,56,144a72,72,0,0,0,144,0Z"></path></svg>`;
-//# sourceMappingURL=icons.js.map
+//# sourceMappingURL=icons.js.map

package/lib/icons.js.map

@@ -1 +1 @@
-{"version":3,"file":"icons.js","sourceRoot":"","sources":["../../../packages/labs/vite-plugin-lit/src/lib/icons.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,0EAA0E;AAC1E,qEAAqE;AACrE,oEAAoE;AACpE,2EAA2E;AAC3E,wBAAwB;AAExB,+BAA+B;AAC/B,MAAM,CAAC,MAAM,SAAS,GACpB,gTAAgT,CAAC;AAEnT,8BAA8B;AAC9B,MAAM,CAAC,MAAM,UAAU,GACrB,6LAA6L,CAAC;AAEhM,6BAA6B;AAC7B,MAAM,CAAC,MAAM,SAAS,GACpB,u1DAAu1D,CAAC;AAE11D,iEAAiE;AACjE,MAAM,CAAC,MAAM,SAAS,GAAG,uaAAua,CAAC;AAEjc,mEAAmE;AACnE,MAAM,CAAC,MAAM,SAAS,GAAG,gPAAgP,CAAC;AAE1Q,iDAAiD;AACjD,MAAM,CAAC,MAAM,UAAU,GAAG,yeAAye,CAAC","sourcesContent":["/**\n * @license\n * Copyright 2026 Google LLC\n * SPDX-License-Identifier: BSD-3-Clause\n */\n\n// Phosphor Icons (https://phosphoricons.com, MIT) inlined so the devtools\n// modules stay self-contained with no extra icon library dependency.\n// Panel icons are SVG path data used via <svg viewBox=\"0 0 256 256\"\n// fill=\"currentColor\"><path d={...}/></svg>; runtime icons are full markup\n// injected as raw HTML.\n\n/** `cube` — Components tab. */\nexport const CUBE_ICON =\n  'M223.68,66.15,135.68,18h0a15.88,15.88,0,0,0-15.36,0l-88,48.17a16,16,0,0,0-8.32,14v95.64a16,16,0,0,0,8.32,14l88,48.17a15.88,15.88,0,0,0,15.36,0l88-48.17a16,16,0,0,0,8.32-14V80.18A16,16,0,0,0,223.68,66.15ZM128,32h0l80.34,44L128,120,47.66,76ZM40,90l80,43.78v85.79L40,175.82Zm96,129.57V133.82L216,90v85.78Z';\n\n/** `clock` — Timeline tab. */\nexport const CLOCK_ICON =\n  'M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm64-88a8,8,0,0,1-8,8H128a8,8,0,0,1-8-8V72a8,8,0,0,1,16,0v48h48A8,8,0,0,1,192,128Z';\n\n/** `gear` — Settings tab. */\nexport const GEAR_ICON =\n  'M128,80a48,48,0,1,0,48,48A48.05,48.05,0,0,0,128,80Zm0,80a32,32,0,1,1,32-32A32,32,0,0,1,128,160Zm88-29.84q.06-2.16,0-4.32l14.92-18.64a8,8,0,0,0,1.48-7.06,107.21,107.21,0,0,0-10.88-26.25,8,8,0,0,0-6-3.93l-23.72-2.64q-1.48-1.56-3-3L186,40.54a8,8,0,0,0-3.94-6,107.71,107.71,0,0,0-26.25-10.87,8,8,0,0,0-7.06,1.49L130.16,40Q128,40,125.84,40L107.2,25.11a8,8,0,0,0-7.06-1.48A107.6,107.6,0,0,0,73.89,34.51a8,8,0,0,0-3.93,6L67.32,64.27q-1.56,1.49-3,3L40.54,70a8,8,0,0,0-6,3.94,107.71,107.71,0,0,0-10.87,26.25,8,8,0,0,0,1.49,7.06L40,125.84Q40,128,40,130.16L25.11,148.8a8,8,0,0,0-1.48,7.06,107.21,107.21,0,0,0,10.88,26.25,8,8,0,0,0,6,3.93l23.72,2.64q1.49,1.56,3,3L70,215.46a8,8,0,0,0,3.94,6,107.71,107.71,0,0,0,26.25,10.87,8,8,0,0,0,7.06-1.49L125.84,216q2.16.06,4.32,0l18.64,14.92a8,8,0,0,0,7.06,1.48,107.21,107.21,0,0,0,26.25-10.88,8,8,0,0,0,3.93-6l2.64-23.72q1.56-1.48,3-3L215.46,186a8,8,0,0,0,6-3.94,107.71,107.71,0,0,0,10.87-26.25,8,8,0,0,0-1.49-7.06Zm-16.1-6.5a73.93,73.93,0,0,1,0,8.68,8,8,0,0,0,1.74,5.48l14.19,17.73a91.57,91.57,0,0,1-6.23,15L187,173.11a8,8,0,0,0-5.1,2.64,74.11,74.11,0,0,1-6.14,6.14,8,8,0,0,0-2.64,5.1l-2.51,22.58a91.32,91.32,0,0,1-15,6.23l-17.74-14.19a8,8,0,0,0-5-1.75h-.48a73.93,73.93,0,0,1-8.68,0,8,8,0,0,0-5.48,1.74L100.45,215.8a91.57,91.57,0,0,1-15-6.23L82.89,187a8,8,0,0,0-2.64-5.1,74.11,74.11,0,0,1-6.14-6.14,8,8,0,0,0-5.1-2.64L46.43,170.6a91.32,91.32,0,0,1-6.23-15l14.19-17.74a8,8,0,0,0,1.74-5.48,73.93,73.93,0,0,1,0-8.68,8,8,0,0,0-1.74-5.48L40.2,100.45a91.57,91.57,0,0,1,6.23-15L69,82.89a8,8,0,0,0,5.1-2.64,74.11,74.11,0,0,1,6.14-6.14A8,8,0,0,0,82.89,69L85.4,46.43a91.32,91.32,0,0,1,15-6.23l17.74,14.19a8,8,0,0,0,5.48,1.74,73.93,73.93,0,0,1,8.68,0,8,8,0,0,0,5.48-1.74L155.55,40.2a91.57,91.57,0,0,1,15,6.23L173.11,69a8,8,0,0,0,2.64,5.1,74.11,74.11,0,0,1,6.14,6.14,8,8,0,0,0,5.1,2.64l22.58,2.51a91.32,91.32,0,0,1,6.23,15l-14.19,17.74A8,8,0,0,0,199.87,123.66Z';\n\n/** `code` — the source overlay's \"open in editor\" affordance. */\nexport const CODE_ICON = `<svg viewBox=\"0 0 256 256\" aria-hidden=\"true\"><path d=\"M69.12,94.15,28.5,128l40.62,33.85a8,8,0,1,1-10.24,12.29l-48-40a8,8,0,0,1,0-12.29l48-40a8,8,0,0,1,10.24,12.3Zm176,27.7-48-40a8,8,0,1,0-10.24,12.3L227.5,128l-40.62,33.85a8,8,0,1,0,10.24,12.29l48-40a8,8,0,0,0,0-12.29ZM162.73,32.48a8,8,0,0,0-10.25,4.79l-64,176a8,8,0,0,0,4.79,10.26A8.14,8.14,0,0,0,96,224a8,8,0,0,0,7.52-5.27l64-176A8,8,0,0,0,162.73,32.48Z\"></path></svg>`;\n\n/** `copy-simple` — the source overlay's \"copy path\" affordance. */\nexport const COPY_ICON = `<svg viewBox=\"0 0 256 256\" aria-hidden=\"true\"><path d=\"M184,64H40a8,8,0,0,0-8,8V216a8,8,0,0,0,8,8H184a8,8,0,0,0,8-8V72A8,8,0,0,0,184,64Zm-8,144H48V80H176ZM224,40V184a8,8,0,0,1-16,0V48H72a8,8,0,0,1,0-16H216A8,8,0,0,1,224,40Z\"></path></svg>`;\n\n/** `flame` — the HMR update indicator's mark. */\nexport const FLAME_ICON = `<svg viewBox=\"0 0 256 256\" aria-hidden=\"true\"><path d=\"M183.89,153.34a57.6,57.6,0,0,1-46.56,46.55A8.75,8.75,0,0,1,136,200a8,8,0,0,1-1.32-15.89c16.57-2.79,30.63-16.85,33.44-33.45a8,8,0,0,1,15.78,2.68ZM216,144a88,88,0,0,1-176,0c0-27.92,11-56.47,32.66-84.85a8,8,0,0,1,11.93-.89l24.12,23.41,22-60.41a8,8,0,0,1,12.63-3.41C165.21,36,216,84.55,216,144Zm-16,0c0-46.09-35.79-85.92-58.21-106.33L119.52,98.74a8,8,0,0,1-13.09,3L80.06,76.16C64.09,99.21,56,122,56,144a72,72,0,0,0,144,0Z\"></path></svg>`;\n"]}
+{"version":3,"file":"icons.js","sourceRoot":"","sources":["../src/lib/icons.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,0EAA0E;AAC1E,qEAAqE;AACrE,oEAAoE;AACpE,2EAA2E;AAC3E,wBAAwB;AAExB,+BAA+B;AAC/B,MAAM,CAAC,MAAM,SAAS,GACpB,gTAAgT,CAAC;AAEnT,8BAA8B;AAC9B,MAAM,CAAC,MAAM,UAAU,GACrB,6LAA6L,CAAC;AAEhM,oCAAoC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAC5B,kNAAkN,CAAC;AAErN,6BAA6B;AAC7B,MAAM,CAAC,MAAM,SAAS,GACpB,u1DAAu1D,CAAC;AAE11D,iEAAiE;AACjE,MAAM,CAAC,MAAM,SAAS,GAAG,uaAAua,CAAC;AAEjc,mEAAmE;AACnE,MAAM,CAAC,MAAM,SAAS,GAAG,gPAAgP,CAAC;AAE1Q,iDAAiD;AACjD,MAAM,CAAC,MAAM,UAAU,GAAG,yeAAye,CAAC","sourcesContent":["/**\n * @license\n * Copyright 2026 Google LLC\n * SPDX-License-Identifier: BSD-3-Clause\n */\n\n// Phosphor Icons (https://phosphoricons.com, MIT) inlined so the devtools\n// modules stay self-contained with no extra icon library dependency.\n// Panel icons are SVG path data used via <svg viewBox=\"0 0 256 256\"\n// fill=\"currentColor\"><path d={...}/></svg>; runtime icons are full markup\n// injected as raw HTML.\n\n/** `cube` — Components tab. */\nexport const CUBE_ICON =\n  'M223.68,66.15,135.68,18h0a15.88,15.88,0,0,0-15.36,0l-88,48.17a16,16,0,0,0-8.32,14v95.64a16,16,0,0,0,8.32,14l88,48.17a15.88,15.88,0,0,0,15.36,0l88-48.17a16,16,0,0,0,8.32-14V80.18A16,16,0,0,0,223.68,66.15ZM128,32h0l80.34,44L128,120,47.66,76ZM40,90l80,43.78v85.79L40,175.82Zm96,129.57V133.82L216,90v85.78Z';\n\n/** `clock` — Timeline tab. */\nexport const CLOCK_ICON =\n  'M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm0,192a88,88,0,1,1,88-88A88.1,88.1,0,0,1,128,216Zm64-88a8,8,0,0,1-8,8H128a8,8,0,0,1-8-8V72a8,8,0,0,1,16,0v48h48A8,8,0,0,1,192,128Z';\n\n/** `notification` — Updates tab. */\nexport const NOTIFICATION_ICON =\n  'M216,128v80a16,16,0,0,1-16,16H48a16,16,0,0,1-16-16V56A16,16,0,0,1,48,40h80a8,8,0,0,1,0,16H48V208H200V128a8,8,0,0,1,16,0Zm16-68a36,36,0,1,1-36-36A36,36,0,0,1,232,60Zm-16,0a20,20,0,1,0-20,20A20,20,0,0,0,216,60Z';\n\n/** `gear` — Settings tab. */\nexport const GEAR_ICON =\n  'M128,80a48,48,0,1,0,48,48A48.05,48.05,0,0,0,128,80Zm0,80a32,32,0,1,1,32-32A32,32,0,0,1,128,160Zm88-29.84q.06-2.16,0-4.32l14.92-18.64a8,8,0,0,0,1.48-7.06,107.21,107.21,0,0,0-10.88-26.25,8,8,0,0,0-6-3.93l-23.72-2.64q-1.48-1.56-3-3L186,40.54a8,8,0,0,0-3.94-6,107.71,107.71,0,0,0-26.25-10.87,8,8,0,0,0-7.06,1.49L130.16,40Q128,40,125.84,40L107.2,25.11a8,8,0,0,0-7.06-1.48A107.6,107.6,0,0,0,73.89,34.51a8,8,0,0,0-3.93,6L67.32,64.27q-1.56,1.49-3,3L40.54,70a8,8,0,0,0-6,3.94,107.71,107.71,0,0,0-10.87,26.25,8,8,0,0,0,1.49,7.06L40,125.84Q40,128,40,130.16L25.11,148.8a8,8,0,0,0-1.48,7.06,107.21,107.21,0,0,0,10.88,26.25,8,8,0,0,0,6,3.93l23.72,2.64q1.49,1.56,3,3L70,215.46a8,8,0,0,0,3.94,6,107.71,107.71,0,0,0,26.25,10.87,8,8,0,0,0,7.06-1.49L125.84,216q2.16.06,4.32,0l18.64,14.92a8,8,0,0,0,7.06,1.48,107.21,107.21,0,0,0,26.25-10.88,8,8,0,0,0,3.93-6l2.64-23.72q1.56-1.48,3-3L215.46,186a8,8,0,0,0,6-3.94,107.71,107.71,0,0,0,10.87-26.25,8,8,0,0,0-1.49-7.06Zm-16.1-6.5a73.93,73.93,0,0,1,0,8.68,8,8,0,0,0,1.74,5.48l14.19,17.73a91.57,91.57,0,0,1-6.23,15L187,173.11a8,8,0,0,0-5.1,2.64,74.11,74.11,0,0,1-6.14,6.14,8,8,0,0,0-2.64,5.1l-2.51,22.58a91.32,91.32,0,0,1-15,6.23l-17.74-14.19a8,8,0,0,0-5-1.75h-.48a73.93,73.93,0,0,1-8.68,0,8,8,0,0,0-5.48,1.74L100.45,215.8a91.57,91.57,0,0,1-15-6.23L82.89,187a8,8,0,0,0-2.64-5.1,74.11,74.11,0,0,1-6.14-6.14,8,8,0,0,0-5.1-2.64L46.43,170.6a91.32,91.32,0,0,1-6.23-15l14.19-17.74a8,8,0,0,0,1.74-5.48,73.93,73.93,0,0,1,0-8.68,8,8,0,0,0-1.74-5.48L40.2,100.45a91.57,91.57,0,0,1,6.23-15L69,82.89a8,8,0,0,0,5.1-2.64,74.11,74.11,0,0,1,6.14-6.14A8,8,0,0,0,82.89,69L85.4,46.43a91.32,91.32,0,0,1,15-6.23l17.74,14.19a8,8,0,0,0,5.48,1.74,73.93,73.93,0,0,1,8.68,0,8,8,0,0,0,5.48-1.74L155.55,40.2a91.57,91.57,0,0,1,15,6.23L173.11,69a8,8,0,0,0,2.64,5.1,74.11,74.11,0,0,1,6.14,6.14,8,8,0,0,0,5.1,2.64l22.58,2.51a91.32,91.32,0,0,1,6.23,15l-14.19,17.74A8,8,0,0,0,199.87,123.66Z';\n\n/** `code` — the source overlay's \"open in editor\" affordance. */\nexport const CODE_ICON = `<svg viewBox=\"0 0 256 256\" aria-hidden=\"true\"><path d=\"M69.12,94.15,28.5,128l40.62,33.85a8,8,0,1,1-10.24,12.29l-48-40a8,8,0,0,1,0-12.29l48-40a8,8,0,0,1,10.24,12.3Zm176,27.7-48-40a8,8,0,1,0-10.24,12.3L227.5,128l-40.62,33.85a8,8,0,1,0,10.24,12.29l48-40a8,8,0,0,0,0-12.29ZM162.73,32.48a8,8,0,0,0-10.25,4.79l-64,176a8,8,0,0,0,4.79,10.26A8.14,8.14,0,0,0,96,224a8,8,0,0,0,7.52-5.27l64-176A8,8,0,0,0,162.73,32.48Z\"></path></svg>`;\n\n/** `copy-simple` — the source overlay's \"copy path\" affordance. */\nexport const COPY_ICON = `<svg viewBox=\"0 0 256 256\" aria-hidden=\"true\"><path d=\"M184,64H40a8,8,0,0,0-8,8V216a8,8,0,0,0,8,8H184a8,8,0,0,0,8-8V72A8,8,0,0,0,184,64Zm-8,144H48V80H176ZM224,40V184a8,8,0,0,1-16,0V48H72a8,8,0,0,1,0-16H216A8,8,0,0,1,224,40Z\"></path></svg>`;\n\n/** `flame` — the HMR update indicator's mark. */\nexport const FLAME_ICON = `<svg viewBox=\"0 0 256 256\" aria-hidden=\"true\"><path d=\"M183.89,153.34a57.6,57.6,0,0,1-46.56,46.55A8.75,8.75,0,0,1,136,200a8,8,0,0,1-1.32-15.89c16.57-2.79,30.63-16.85,33.44-33.45a8,8,0,0,1,15.78,2.68ZM216,144a88,88,0,0,1-176,0c0-27.92,11-56.47,32.66-84.85a8,8,0,0,1,11.93-.89l24.12,23.41,22-60.41a8,8,0,0,1,12.63-3.41C165.21,36,216,84.55,216,144Zm-16,0c0-46.09-35.79-85.92-58.21-106.33L119.52,98.74a8,8,0,0,1-13.09,3L80.06,76.16C64.09,99.21,56,122,56,144a72,72,0,0,0,144,0Z\"></path></svg>`;\n"]}

package/lib/plugin.d.ts

@@ -4,6 +4,7 @@
  * SPDX-License-Identifier: BSD-3-Clause
  */
 import { type Plugin } from 'vite';
+import { type TrustHeaders } from './http.js';
 import type { SourceOverlayOptions } from './types.js';
 /**
  * On-page HMR feedback: a small pulsing indicator in the corner of the host
@@ -121,10 +122,8 @@ export interface ResolvedOptions {
 export declare const resolveOptions: (options: LitPluginOptions, env: Record<string, string>) => ResolvedOptions;
 export declare const createOpenInEditorMiddleware: (allowedRoots: readonly string[]) => (req: {
     url?: string;
-    headers?: {
-        origin?: string;
-        host?: string;
-    };
+    method?: string;
+    headers?: TrustHeaders;
 }, res: {
     statusCode: number;
     end: (msg: string) => void;
@@ -141,6 +140,18 @@ export declare const createOpenInEditorMiddleware: (allowedRoots: readonly strin
  * default.
  */
 export declare const litCssQueries: (getCssSheetBuild?: () => CssSheetBuild) => Plugin;
+/**
+ * The public timeline API virtual module, served in dev and build alike:
+ * app code importing it must keep building under `vite build`, where the HMR
+ * plugin doesn't apply. While these hooks lived on that serve-only plugin,
+ * nothing claimed the specifier during a build and the bundler failed to
+ * resolve it.
+ *
+ * `getTimeline` is a getter, not a value: `litPlugin()` re-resolves its
+ * options against the loaded env in a `config` hook, which runs after the
+ * plugin array is built.
+ */
+export declare const litTimelineVirtual: (getTimeline?: () => boolean) => Plugin;
 /**
  * Vite plugin set providing HMR, CSS helpers, and Lightning CSS processing
  * for Lit projects.

package/lib/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../packages/labs/vite-plugin-lit/src/lib/plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAA2B,KAAK,MAAM,EAAC,MAAM,MAAM,CAAC;AAI3D,OAAO,KAAK,EAAC,oBAAoB,EAAC,MAAM,YAAY,CAAC;AAKrD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;OAGG;IACH,cAAc,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAEnC;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC;CAC3C;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,YAAY,CAAC;AASrE;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAE3B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,GAAG,oBAAoB,CAAC;IAE/C;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,QAAQ,GAAG,MAAM,CAAC;IAClC,SAAS,EAAE,KAAK,GAAG;QAAC,KAAK,EAAE,OAAO,CAAA;KAAC,CAAC;IACpC,aAAa,EAAE,KAAK,GAAG,oBAAoB,CAAC;IAC5C,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;CAC9B;AAuCD;;;GAGG;AACH,eAAO,MAAM,cAAc,GACzB,SAAS,gBAAgB,EACzB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC1B,eA4DF,CAAC;AA8DF,eAAO,MAAM,4BAA4B,GACvC,cAAc,SAAS,MAAM,EAAE,MAM7B,KAAK;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAC,CAAA;CAAC,EAC/D,KAAK;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAC,EACrD,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,SAkFhC,CAAC;AAoCF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,GACxB,mBAAkB,MAAM,aAA4B,KACnD,MAwFF,CAAC;AAuFF;;;GAGG;AACH,eAAO,MAAM,SAAS,GAAI,UAAS,gBAAqB,KAAG,MAAM,EA0RhE,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/lib/plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAA2B,KAAK,MAAM,EAAC,MAAM,MAAM,CAAC;AAE3D,OAAO,EAAmB,KAAK,YAAY,EAAC,MAAM,WAAW,CAAC;AAG9D,OAAO,KAAK,EAAC,oBAAoB,EAAC,MAAM,YAAY,CAAC;AAMrD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;OAGG;IACH,cAAc,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAEnC;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC;CAC3C;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,YAAY,CAAC;AASrE;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAE3B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,GAAG,oBAAoB,CAAC;IAE/C;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,QAAQ,GAAG,MAAM,CAAC;IAClC,SAAS,EAAE,KAAK,GAAG;QAAC,KAAK,EAAE,OAAO,CAAA;KAAC,CAAC;IACpC,aAAa,EAAE,KAAK,GAAG,oBAAoB,CAAC;IAC5C,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;CAC9B;AAuCD;;;GAGG;AACH,eAAO,MAAM,cAAc,YAChB,gBAAgB,OACpB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC1B,eA4DF,CAAC;AAiDF,eAAO,MAAM,4BAA4B,iBACzB,SAAS,MAAM,EAAE,WAMxB;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,YAAY,CAAA;CAAC,OACvD;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAC,QAC/C,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,SAuFhC,CAAC;AAoCF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,sBACN,MAAM,aAAa,KACpC,MAwFF,CAAC;AAQF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,iBAChB,MAAM,OAAO,KACzB,MA6BF,CAAC;AAuFF;;;GAGG;AACH,eAAO,MAAM,SAAS,aAAa,gBAAgB,KAAQ,MAAM,EA+QhE,CAAC"}