@oddsquad/vite-plugin-lit 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -3,6 +3,81 @@
 Notable changes per release. Versions before 0.3.0 predate this file; see the
 git history for those.
 
+## 0.7.0 — 2026-09-29
+
+Hot-patching covers two cases it used to get wrong: components with native
+`#private` members, which threw, and child elements whose parent template you
+edit, which lost their state. The standalone `lit-devtools dev` server also
+gets pages to feed it: one script tag connects any page running Lit, whether
+Vite serves it or not, directly or through a proxy. Two fixes ride along:
+open-in-editor links lose a stray slash, and the timeline no longer misses the
+first component's connect and disconnect.
+
+### Added
+
+- **Components with `#private` fields keep hot-patching.** Editing an element
+  that uses native `#private` fields or methods now updates it in place and
+  keeps its private state, instead of throwing "Cannot read private member".
+  Set `hmr.privateFields: false` to keep real brand checks in dev.
+- **Child components keep their state when you edit the parent.** Changing the
+  template a child element sits in no longer resets its `@state` and
+  `#private` fields; `hmr.childState: 'reuse'` keeps the original element
+  where it has no bindings, and `'reset'` restores the old behaviour. The
+  DevTools Settings tab can switch the mode live; the next edit uses it.
+- **Pages outside Vite can feed the standalone panel.** `lit-devtools dev` now
+  prints a `<script src=".../lit-devtools.js">` tag; a page that loads it shows
+  its component tree, inspector and timeline in the panel, even when Vite
+  doesn't serve it or it's reached through a proxy or tunnel. Pages on
+  localhost connect on any port, and `--allow-origin` admits others, with `*`
+  for any subdomain (`--allow-origin 'https://*.webcontainer-api.io'` for
+  StackBlitz). HMR, source locations and open-in-editor still need Vite.
+
+### Fixed
+
+- **Open-in-editor links use the documented URL form.** Links to VS Code,
+  Cursor, Zed and Windsurf no longer carry a double slash before absolute
+  paths like `/Users/...`.
+- **The timeline records the first component's connect and disconnect.** On a
+  page with no Lit element when the DevTools runtime starts, the first
+  component defined afterwards now shows its `connectedCallback` and
+  `disconnectedCallback` events like the rest.
+
+## 0.6.1 — 2026-09-29
+
+A fix release. Components whose `extends` clause holds braces load in dev
+again, and the plugin now shares one devframe with the current Vite DevTools.
+The rest comes from a security pass over the dev server: source opens and
+snapshot exports stay inside the project, and the standalone server won't go
+without its code gate on a network address.
+
+### Changed
+
+- **`lit-devtools dev --no-auth` only runs on localhost.** Combined with a
+  `--host` other machines can reach, it now refuses to start instead of
+  letting anyone on the network drive the panel without a code.
+
+### Fixed
+
+- **Components whose `extends` clause has braces load in dev again.** With
+  `sourceOverlay` on, a class like `extends Dialog<{open: boolean}>` or
+  `extends Mixin(Base, {shadow: true})` broke the module with a 500 from the
+  dev server. Broken since 0.3.0.
+- **Exporting a snapshot can no longer delete your files.** The export wipes
+  its output directory before writing, and nothing checked which directory
+  that was. It now only writes inside the dev server's working directory and
+  only replaces an earlier snapshot.
+- **The panel can only open source files inside your project.** Source links
+  from the DevTools panel used to open any absolute path they were given. They
+  now follow the same rule as the in-page overlay: the path has to be under
+  the Vite root or `server.fs.allow`.
+- **Symlinks can't send the editor outside your project.** Opening a source
+  file used to follow a symlink under the project to wherever it pointed. Now
+  the target has to be inside the project too.
+- **One copy of devframe alongside the current Vite DevTools.** The plugin
+  pinned devframe 1.0.0 exactly, so apps on `@vitejs/devtools-kit` 0.7.6
+  installed a second copy and got an unmet-peer warning. It now accepts any
+  devframe 1.x.
+
 ## 0.6.0 — 2026-09-29
 
 A small release with one feature. The Lit timeline can now appear in Chrome

package/README.md

@@ -3,6 +3,8 @@
 A Vite plugin for Lit projects with true HMR, CSS delivery helpers for shadow
 roots, and a DevTools timeline.
 
+https://github.com/user-attachments/assets/bacc7649-746a-4ecf-a017-0370b5af23ca
+
 **[Documentation →](https://oddcelot.github.io/vite-plugin-lit/)**
 
 Based on `@lit-labs/vite-plugin-lit` (formerly `@lit-labs/vite-hmr`) from the
@@ -119,21 +121,31 @@ The two differ in how the server is found, not in what it can do:
   plugin logs a warning saying so at startup, naming the reason.
 
 The CLI also has `lit-devtools dev`, a standalone devframe server. Started on
-its own it shows an empty panel, because it has no page of its own. A page
-served by a Vite dev server that loads this plugin's runtime can point itself
-at it and feed it the live component tree, inspector and timeline:
-
-```ts
-import {connectToDevServer} from '@oddsquad/vite-plugin-lit/connect.js';
+its own it shows an empty panel, because it has no page of its own. Add the
+script tag it prints at startup to any page, including one that Vite does not
+serve and one on another origin, and the page feeds it the live component tree,
+inspector and timeline:
 
-await connectToDevServer('http://localhost:5180/');
+```html
+<script src="http://localhost:5180/lit-devtools.js"></script>
 ```
 
-The server asks for its one-time code unless you start it with `--no-auth`. What
-this does not do yet: put the runtime into a page that is not on a Vite dev
-server, and set up the cross-origin access and authentication a page on another
-origin needs. The dev server's `__connection.json` sends no CORS headers today,
-so from a different origin the connection is blocked by the browser.
+Put it before the scripts that define your components. The server asks for its
+one-time code unless you start it with `--no-auth`: type the code into the
+prompt the page shows, open the page once with `#devframe_otp=<code>` on its
+URL, or skip the gate on a loopback host with `--no-auth`. Pages on a loopback
+origin (any port) may connect; for any other origin, pass it to the server with
+`--allow-origin https://myapp.test:8443` (repeatable). A `*` in the host
+matches any subdomain, e.g. `--allow-origin 'https://*.webcontainer-api.io'`
+for StackBlitz, where every port gets its own origin.
+
+Outside Vite the page has no build-time transforms, so HMR patching, source
+locations and open-in-editor do not work there; the tree, inspector and timeline
+do. A page that Vite serves can instead call `connectToDevServer()` from
+`@oddsquad/vite-plugin-lit/connect.js`.
+
+To try it from this repo, run `pnpm run standalone:demo`; see
+[Playground](#playground).
 
 ## Playground
 
@@ -146,6 +158,12 @@ straight from the repo URL. Run it locally from the repo root:
 pnpm dev   # builds the plugin, then serves http://localhost:5179
 ```
 
+The same playground runs in standalone mode, built to static files and fed to
+a `lit-devtools dev` panel on another port: `pnpm run standalone:demo` here, or
+[on StackBlitz](https://stackblitz.com/github/oddcelot/vite-plugin-lit/tree/main/playground?startScript=standalone)
+with `?startScript=standalone`. StackBlitz installs the published plugin, so
+that link works from the first release that ships standalone mode.
+
 ## Development
 
 Requires Node 26 and pnpm 12 (`corepack enable` picks up the pinned version).

package/bin.mjs

@@ -30,7 +30,11 @@
  * @see plans/roadmap/03-cli-and-stdio-mcp.md
  */
 
+import {readFile} from 'node:fs/promises';
+import {createRequire} from 'node:module';
 import process from 'node:process';
+import {pathToFileURL} from 'node:url';
+import {resolveAllowedOrigins} from './lib/devframe/allowed-origins.js';
 import {createStandaloneLitDevframe} from './lib/devframe/rpc-source.js';
 import {PACKAGE_VERSION} from './lib/devframe/paths.js';
 
@@ -43,6 +47,19 @@ import {PACKAGE_VERSION} from './lib/devframe/paths.js';
  */
 const DEFAULT_DEV_PORT = 5180;
 
+/** The script pages outside Vite load; built by `build:standalone`. */
+const STANDALONE_SCRIPT = new URL(
+  './dist/standalone/lit-devtools.js',
+  import.meta.url
+);
+
+/** True for a host only this machine can reach. */
+const isLoopbackHost = (host) =>
+  host === 'localhost' ||
+  host === '::1' ||
+  host === '[::1]' ||
+  /^127\.\d+\.\d+\.\d+$/.test(host);
+
 /** Fail with a readable message instead of a module-resolution stack trace. */
 const requirePeer = async (specifier, hint) => {
   try {
@@ -68,23 +85,108 @@ const main = async () => {
     .option('--port <port>', 'Port to listen on', {default: DEFAULT_DEV_PORT})
     .option('--host <host>', 'Host to bind to', {default: 'localhost'})
     .option('--open', 'Open the browser on start')
+    .option(
+      '--allow-origin <origin>',
+      'Also let pages served from this origin connect, e.g. ' +
+        'https://myapp.test:8443, or https://*.webcontainer-api.io for any ' +
+        'host under a domain. Loopback origins on any port are always ' +
+        'allowed. Repeatable.'
+    )
     .option(
       '--no-auth',
       'Skip the one-time-code gate, so a page can connect without a token'
     )
     .action(async (flags) => {
+      // Without the code gate, anything that can reach the port drives the
+      // panel's RPC: it can read the session and open project files in the
+      // developer's editor. On loopback that is this machine; on any other
+      // host it is the network.
+      if (flags.auth === false && !isLoopbackHost(String(flags.host))) {
+        console.error(
+          `[lit-devtools] --no-auth needs a loopback host, and ` +
+            `${flags.host} is reachable from other machines. Drop ` +
+            `--no-auth (pages then ask for the one-time code) or bind to ` +
+            `localhost.`
+        );
+        process.exit(1);
+      }
       const {createDevServer} = await import('devframe/adapters/dev');
       // A standalone server has no Vite, so it has no page of its own: the
-      // panel stays empty until a page dials in with `connectToDevServer()`
-      // (see `lib/runtime/rpc-transport.ts`), which carries the runtime's
-      // usual channels over devframe RPC. Injecting the runtime into a page
-      // that is not on a Vite dev server is not something this command does.
-      await createDevServer(
+      // panel stays empty until a page dials in. It gets there by loading
+      // `/lit-devtools.js` (served below), which starts the runtime and calls
+      // `connectToDevServer()` (see `lib/runtime/rpc-transport.ts`). HMR
+      // patching and source metadata need Vite's transforms and are not part
+      // of it.
+      let allowedOrigins;
+      try {
+        allowedOrigins = resolveAllowedOrigins(
+          [flags.allowOrigin]
+            .flat()
+            .filter((origin) => origin != null)
+            .map(String)
+        );
+      } catch (error) {
+        console.error(`[lit-devtools] ${error.message}`);
+        process.exit(1);
+      }
+      let server;
+      const serveScript = async () => {
+        const headers = {
+          'content-type': 'text/javascript; charset=utf-8',
+          'cache-control': 'no-store',
+        };
+        let bundle;
+        try {
+          bundle = await readFile(STANDALONE_SCRIPT, 'utf8');
+        } catch {
+          return new Response(
+            '// lit-devtools: the standalone script is not built. ' +
+              'Run `pnpm run build` in the package and restart.\n',
+            {status: 500, headers}
+          );
+        }
+        // The descriptor `__connection.json` would answer with, inlined so the
+        // page never fetches it: that request is cross-origin from a page
+        // that is not on this server, and gets no CORS headers. Picked, not
+        // spread, so nothing else devframe puts in it rides along to any page
+        // that can load a script tag.
+        const {backend, websocket, sse} = server.connectionMeta();
+        const config = {
+          url: server.origin + '/',
+          connectionMeta: {backend, websocket, sse},
+        };
+        return new Response(
+          `globalThis.__LIT_DEVTOOLS_CONNECT__ = ${JSON.stringify(config)};\n${bundle}`,
+          {headers}
+        );
+      };
+      // devframe mounts a static catch-all that answers 404 for paths it
+      // does not know, so a route added to its app in `onReady` would never be
+      // reached. The route has to go on the app *before* devframe's, which
+      // means handing it one -- built from the copy of h3 devframe itself
+      // resolves, so the two agree on the class.
+      const devframeRequire = createRequire(
+        import.meta.resolve('devframe/adapters/dev')
+      );
+      const {H3} = await import(
+        pathToFileURL(devframeRequire.resolve('h3')).href
+      );
+      const app = new H3();
+      app.use('/lit-devtools.js', serveScript);
+      server = await createDevServer(
         createStandaloneLitDevframe({version: PACKAGE_VERSION}),
         {
           host: flags.host,
           port: Number(flags.port),
           flags: {open: Boolean(flags.open), auth: flags.auth},
+          app,
+          ...(allowedOrigins !== undefined ? {allowedOrigins} : {}),
+          onReady({origin}) {
+            console.log(
+              `\n[lit-devtools] Add this to a page to connect it:\n\n` +
+                `  <script src="${origin}/lit-devtools.js"></script>\n`
+            );
+          },
         }
       );
     });

package/dist/client/assets/{browser-agent-rpc-BXhoSh1z-DXAVFObe.js → browser-agent-rpc-BXhoSh1z-BuCvPGjS.js}

@@ -1,5 +1,5 @@
-import { n as onBrowserAgentToolsChanged, r as nanoid, t as listBrowserAgentTools } from "./index-DVr5EnyB.js";
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/browser-agent-rpc-BXhoSh1z.mjs
+import { n as onBrowserAgentToolsChanged, r as nanoid, t as listBrowserAgentTools } from "./index-D632jo79.js";
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/browser-agent-rpc-BXhoSh1z.mjs
 var CLIENT_ID_STORAGE_KEY = "devframe:client-id";
 var memoryClientId;
 /**
@@ -66,4 +66,4 @@ function setupBrowserAgentRpcBridge(rpc) {
 //#endregion
 export { setupBrowserAgentRpcBridge };
 
-//# sourceMappingURL=browser-agent-rpc-BXhoSh1z-DXAVFObe.js.map
+//# sourceMappingURL=browser-agent-rpc-BXhoSh1z-BuCvPGjS.js.map

package/dist/client/assets/{browser-agent-rpc-BXhoSh1z-DXAVFObe.js.map → browser-agent-rpc-BXhoSh1z-BuCvPGjS.js.map}

@@ -1 +1 @@
-{"version":3,"file":"browser-agent-rpc-BXhoSh1z-DXAVFObe.js","names":[],"sources":["../../../node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/browser-agent-rpc-BXhoSh1z.mjs"],"sourcesContent":["import { nanoid } from \"./utils/nanoid.mjs\";\nimport { n as onBrowserAgentToolsChanged, t as listBrowserAgentTools } from \"./browser-agent-Pu-FLk6I.mjs\";\n//#region src/client/client-id.ts\nconst CLIENT_ID_STORAGE_KEY = \"devframe:client-id\";\nlet memoryClientId;\n/**\n* This browser tab's stable client id: one nanoid per tab, persisted in\n* `sessionStorage` so it survives page reloads and RPC reconnects. The node\n* side uses it to tell connected tabs apart across reconnects (see #394).\n*\n* Tab duplication copies `sessionStorage`, so two tabs can briefly share an id\n* until per-tab disambiguation lands with the wider tab-metadata work.\n*/\nfunction resolveClientId(win = globalThis.window) {\n\ttry {\n\t\tconst storage = win?.sessionStorage;\n\t\tif (storage) {\n\t\t\tlet id = storage.getItem(CLIENT_ID_STORAGE_KEY);\n\t\t\tif (!id) {\n\t\t\t\tid = nanoid();\n\t\t\t\tstorage.setItem(CLIENT_ID_STORAGE_KEY, id);\n\t\t\t}\n\t\t\treturn id;\n\t\t}\n\t} catch {}\n\tmemoryClientId ??= nanoid();\n\treturn memoryClientId;\n}\n//#endregion\n//#region src/client/browser-agent-rpc.ts\n/** Mirror this document's browser-agent registry over its existing RPC connection. */\nfunction setupBrowserAgentRpcBridge(rpc) {\n\trpc.client.register({\n\t\tname: \"devframe:agent:invoke-client-tool\",\n\t\ttype: \"action\",\n\t\tjsonSerializable: true,\n\t\thandler: async (id, args) => {\n\t\t\tconst tool = listBrowserAgentTools().find((tool) => tool.id === id);\n\t\t\tif (!tool) throw new Error(`[devframe/agent] browser tool \"${id}\" not found`);\n\t\t\treturn await tool.invoke(args);\n\t\t}\n\t});\n\tlet queued = false;\n\tlet disposed = false;\n\tlet lastSyncedCount = 0;\n\tconst sync = () => {\n\t\tif (queued || disposed) return;\n\t\tqueued = true;\n\t\tqueueMicrotask(async () => {\n\t\t\tqueued = false;\n\t\t\tif (disposed) return;\n\t\t\tconst manifests = listBrowserAgentTools().map(({ invoke: _, ...manifest }) => manifest);\n\t\t\tif (manifests.length === 0 && lastSyncedCount === 0) return;\n\t\t\tlastSyncedCount = manifests.length;\n\t\t\tawait rpc.callOptional(\"devframe:agent:sync-client-tools\", resolveClientId(), manifests).catch(() => {});\n\t\t});\n\t};\n\tconst stopTools = onBrowserAgentToolsChanged(sync);\n\tconst stopConnection = rpc.events.on(\"connection:status\", (status) => {\n\t\tif (status === \"connected\") sync();\n\t});\n\tsync();\n\treturn () => {\n\t\tdisposed = true;\n\t\tstopTools();\n\t\tstopConnection();\n\t};\n}\n//#endregion\nexport { setupBrowserAgentRpcBridge };\n"],"x_google_ignoreList":[0],"mappings":";;AAGA,IAAM,wBAAwB;AAC9B,IAAI;;;;;;;;;AASJ,SAAS,gBAAgB,MAAM,WAAW,QAAQ;CACjD,IAAI;EACH,MAAM,UAAU,KAAK;EACrB,IAAI,SAAS;GACZ,IAAI,KAAK,QAAQ,QAAQ,qBAAqB;GAC9C,IAAI,CAAC,IAAI;IACR,KAAK,OAAO;IACZ,QAAQ,QAAQ,uBAAuB,EAAE;GAC1C;GACA,OAAO;EACR;CACD,QAAQ,CAAC;CACT,mBAAmB,OAAO;CAC1B,OAAO;AACR;;AAIA,SAAS,2BAA2B,KAAK;CACxC,IAAI,OAAO,SAAS;EACnB,MAAM;EACN,MAAM;EACN,kBAAkB;EAClB,SAAS,OAAO,IAAI,SAAS;GAC5B,MAAM,OAAO,sBAAsB,CAAC,CAAC,MAAM,SAAS,KAAK,OAAO,EAAE;GAClE,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,kCAAkC,GAAG,YAAY;GAC5E,OAAO,MAAM,KAAK,OAAO,IAAI;EAC9B;CACD,CAAC;CACD,IAAI,SAAS;CACb,IAAI,WAAW;CACf,IAAI,kBAAkB;CACtB,MAAM,aAAa;EAClB,IAAI,UAAU,UAAU;EACxB,SAAS;EACT,eAAe,YAAY;GAC1B,SAAS;GACT,IAAI,UAAU;GACd,MAAM,YAAY,sBAAsB,CAAC,CAAC,KAAK,EAAE,QAAQ,GAAG,GAAG,eAAe,QAAQ;GACtF,IAAI,UAAU,WAAW,KAAK,oBAAoB,GAAG;GACrD,kBAAkB,UAAU;GAC5B,MAAM,IAAI,aAAa,oCAAoC,gBAAgB,GAAG,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;EACxG,CAAC;CACF;CACA,MAAM,YAAY,2BAA2B,IAAI;CACjD,MAAM,iBAAiB,IAAI,OAAO,GAAG,sBAAsB,WAAW;EACrE,IAAI,WAAW,aAAa,KAAK;CAClC,CAAC;CACD,KAAK;CACL,aAAa;EACZ,WAAW;EACX,UAAU;EACV,eAAe;CAChB;AACD"}
+{"version":3,"file":"browser-agent-rpc-BXhoSh1z-BuCvPGjS.js","names":[],"sources":["../../../node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/browser-agent-rpc-BXhoSh1z.mjs"],"sourcesContent":["import { nanoid } from \"./utils/nanoid.mjs\";\nimport { n as onBrowserAgentToolsChanged, t as listBrowserAgentTools } from \"./browser-agent-Pu-FLk6I.mjs\";\n//#region src/client/client-id.ts\nconst CLIENT_ID_STORAGE_KEY = \"devframe:client-id\";\nlet memoryClientId;\n/**\n* This browser tab's stable client id: one nanoid per tab, persisted in\n* `sessionStorage` so it survives page reloads and RPC reconnects. The node\n* side uses it to tell connected tabs apart across reconnects (see #394).\n*\n* Tab duplication copies `sessionStorage`, so two tabs can briefly share an id\n* until per-tab disambiguation lands with the wider tab-metadata work.\n*/\nfunction resolveClientId(win = globalThis.window) {\n\ttry {\n\t\tconst storage = win?.sessionStorage;\n\t\tif (storage) {\n\t\t\tlet id = storage.getItem(CLIENT_ID_STORAGE_KEY);\n\t\t\tif (!id) {\n\t\t\t\tid = nanoid();\n\t\t\t\tstorage.setItem(CLIENT_ID_STORAGE_KEY, id);\n\t\t\t}\n\t\t\treturn id;\n\t\t}\n\t} catch {}\n\tmemoryClientId ??= nanoid();\n\treturn memoryClientId;\n}\n//#endregion\n//#region src/client/browser-agent-rpc.ts\n/** Mirror this document's browser-agent registry over its existing RPC connection. */\nfunction setupBrowserAgentRpcBridge(rpc) {\n\trpc.client.register({\n\t\tname: \"devframe:agent:invoke-client-tool\",\n\t\ttype: \"action\",\n\t\tjsonSerializable: true,\n\t\thandler: async (id, args) => {\n\t\t\tconst tool = listBrowserAgentTools().find((tool) => tool.id === id);\n\t\t\tif (!tool) throw new Error(`[devframe/agent] browser tool \"${id}\" not found`);\n\t\t\treturn await tool.invoke(args);\n\t\t}\n\t});\n\tlet queued = false;\n\tlet disposed = false;\n\tlet lastSyncedCount = 0;\n\tconst sync = () => {\n\t\tif (queued || disposed) return;\n\t\tqueued = true;\n\t\tqueueMicrotask(async () => {\n\t\t\tqueued = false;\n\t\t\tif (disposed) return;\n\t\t\tconst manifests = listBrowserAgentTools().map(({ invoke: _, ...manifest }) => manifest);\n\t\t\tif (manifests.length === 0 && lastSyncedCount === 0) return;\n\t\t\tlastSyncedCount = manifests.length;\n\t\t\tawait rpc.callOptional(\"devframe:agent:sync-client-tools\", resolveClientId(), manifests).catch(() => {});\n\t\t});\n\t};\n\tconst stopTools = onBrowserAgentToolsChanged(sync);\n\tconst stopConnection = rpc.events.on(\"connection:status\", (status) => {\n\t\tif (status === \"connected\") sync();\n\t});\n\tsync();\n\treturn () => {\n\t\tdisposed = true;\n\t\tstopTools();\n\t\tstopConnection();\n\t};\n}\n//#endregion\nexport { setupBrowserAgentRpcBridge };\n"],"x_google_ignoreList":[0],"mappings":";;AAGA,IAAM,wBAAwB;AAC9B,IAAI;;;;;;;;;AASJ,SAAS,gBAAgB,MAAM,WAAW,QAAQ;CACjD,IAAI;EACH,MAAM,UAAU,KAAK;EACrB,IAAI,SAAS;GACZ,IAAI,KAAK,QAAQ,QAAQ,qBAAqB;GAC9C,IAAI,CAAC,IAAI;IACR,KAAK,OAAO;IACZ,QAAQ,QAAQ,uBAAuB,EAAE;GAC1C;GACA,OAAO;EACR;CACD,QAAQ,CAAC;CACT,mBAAmB,OAAO;CAC1B,OAAO;AACR;;AAIA,SAAS,2BAA2B,KAAK;CACxC,IAAI,OAAO,SAAS;EACnB,MAAM;EACN,MAAM;EACN,kBAAkB;EAClB,SAAS,OAAO,IAAI,SAAS;GAC5B,MAAM,OAAO,sBAAsB,CAAC,CAAC,MAAM,SAAS,KAAK,OAAO,EAAE;GAClE,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,kCAAkC,GAAG,YAAY;GAC5E,OAAO,MAAM,KAAK,OAAO,IAAI;EAC9B;CACD,CAAC;CACD,IAAI,SAAS;CACb,IAAI,WAAW;CACf,IAAI,kBAAkB;CACtB,MAAM,aAAa;EAClB,IAAI,UAAU,UAAU;EACxB,SAAS;EACT,eAAe,YAAY;GAC1B,SAAS;GACT,IAAI,UAAU;GACd,MAAM,YAAY,sBAAsB,CAAC,CAAC,KAAK,EAAE,QAAQ,GAAG,GAAG,eAAe,QAAQ;GACtF,IAAI,UAAU,WAAW,KAAK,oBAAoB,GAAG;GACrD,kBAAkB,UAAU;GAC5B,MAAM,IAAI,aAAa,oCAAoC,gBAAgB,GAAG,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;EACxG,CAAC;CACF;CACA,MAAM,YAAY,2BAA2B,IAAI;CACjD,MAAM,iBAAiB,IAAI,OAAO,GAAG,sBAAsB,WAAW;EACrE,IAAI,WAAW,aAAa,KAAK;CAClC,CAAC;CACD,KAAK;CACL,aAAa;EACZ,WAAW;EACX,UAAU;EACV,eAAe;CAChB;AACD"}

package/dist/client/assets/{index-DVr5EnyB.js → index-D632jo79.js}

@@ -1457,7 +1457,7 @@ var listElements = (events) => {
 	}));
 };
 //#endregion
-//#region \0@oxc-project+runtime@0.149.0/helpers/esm/decorate.js
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -2656,7 +2656,7 @@ var VirtualizeDirective = class extends f {
 };
 var virtualize = e$1(VirtualizeDirective);
 //#endregion
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/utils/colors.mjs
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/utils/colors.mjs
 function makeColor(open, close) {
 	const o = `\x1B[${open}m`;
 	const c = `\x1B[${close}m`;
@@ -2686,7 +2686,7 @@ var colors = {
 	underline: makeColor(4, 24)
 };
 //#endregion
-//#region node_modules/.pnpm/nostics@1.2.0/node_modules/nostics/dist/index.mjs
+//#region node_modules/.pnpm/nostics@1.3.0/node_modules/nostics/dist/index.mjs
 /**
 * Transforms a value or a function that returns a value to a value.
 *
@@ -2723,6 +2723,10 @@ var Diagnostic = class Diagnostic extends Error {
 	*/
 	sources;
 	/**
+	* Structured information associated with this diagnostic code.
+	*/
+	data;
+	/**
 	* Alias for {@link Error.message}: the reason this diagnostic was raised.
 	*/
 	get why() {
@@ -2741,6 +2745,7 @@ var Diagnostic = class Diagnostic extends Error {
 		this.fix = init.fix;
 		this.docs = init.docs;
 		this.sources = init.sources;
+		this.data = init.data;
 		captureStackTrace?.(this, captureFrom);
 	}
 	/**
@@ -2754,6 +2759,7 @@ var Diagnostic = class Diagnostic extends Error {
 			docs: this.docs,
 			sources: this.sources,
 			cause: this.cause,
+			data: this.data,
 			stack: this.stack
 		};
 	}
@@ -2789,7 +2795,8 @@ function defineDiagnostics(options) {
 				fix: toValueWithArgs(def.fix, params),
 				docs,
 				cause: params.cause,
-				sources: params.sources
+				sources: params.sources,
+				data: toValueWithArgs(def.data, params)
 			}, handle);
 			for (const reporter of reporters) reporter(diagnostic, reporterOptions);
 			return diagnostic;
@@ -2799,7 +2806,7 @@ function defineDiagnostics(options) {
 	return result;
 }
 //#endregion
-//#region node_modules/.pnpm/nostics@1.2.0/node_modules/nostics/dist/formatters/ansi.mjs
+//#region node_modules/.pnpm/nostics@1.3.0/node_modules/nostics/dist/formatters/ansi.mjs
 /* @__NO_SIDE_EFFECTS__ */
 function ansiFormatter(colors) {
 	return (d) => {
@@ -2815,7 +2822,7 @@ function ansiFormatter(colors) {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/tool-input-BAQXvvqL.mjs
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/tool-input-BAQXvvqL.mjs
 /**
 * Centralized registry of the core devframe event names: the node-side host
 * bus events, the client RPC connection events, and the server→client
@@ -3194,7 +3201,7 @@ function toolInputToRpcArgs(input, argumentCount) {
 	return collectPositionalArgs(input, argumentCount) ?? [input];
 }
 //#endregion
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/hash-DdPnc4k3.mjs
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/hash-DdPnc4k3.mjs
 function serialize$1(input) {
 	if (typeof input === "string") return `'${input}'`;
 	return new Serializer().serialize(input);
@@ -3547,7 +3554,7 @@ function hash(value) {
 	return hash$1(value);
 }
 //#endregion
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/utils/events.mjs
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/utils/events.mjs
 /**
 * Create event emitter.
 */
@@ -3586,7 +3593,7 @@ function createEventEmitter() {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/utils/url.mjs
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/utils/url.mjs
 /**
 * URL path-joining and slash-normalization helpers shared by the adapters,
 * the RPC clients, and the hub's mount-path plumbing. In-house replacements
@@ -3631,7 +3638,7 @@ function withProtocol(input, protocol) {
 	return protocol + (match ? input.slice(match[0].length) : input);
 }
 //#endregion
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/utils/nanoid.mjs
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/utils/nanoid.mjs
 var urlAlphabet = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";
 function nanoid(size = 21) {
 	let id = "";
@@ -3640,7 +3647,7 @@ function nanoid(size = 21) {
 	return id;
 }
 //#endregion
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/shared-state-eQVYHNqA.mjs
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/shared-state-eQVYHNqA.mjs
 var NOTHING = Symbol.for("immer-nothing");
 var DRAFTABLE = Symbol.for("immer-draftable");
 var DRAFT_STATE = Symbol.for("immer-state");
@@ -4584,7 +4591,7 @@ function createSharedState(options) {
 	};
 }
 //#endregion
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/structured-clone-CgtQ61SA.mjs
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/structured-clone-CgtQ61SA.mjs
 var env = typeof self === "object" ? self : globalThis;
 var SAFE_ERROR_NAMES = /* @__PURE__ */ new Set([
 	"Error",
@@ -4824,7 +4831,7 @@ function structuredCloneParse(value) {
 	return parse(value);
 }
 //#endregion
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/utils/streaming-channel.mjs
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/utils/streaming-channel.mjs
 var DEFAULT_HIGH_WATER_MARK = 256;
 var StreamClosedError = class extends Error {
 	name = "StreamClosedError";
@@ -5079,7 +5086,7 @@ function toErrorPayload(reason) {
 	}
 }
 //#endregion
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/utils/agent-tool-name.mjs
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/utils/agent-tool-name.mjs
 /**
 * Maximum tool-name length several MCP clients enforce (the Anthropic API
 * pattern is `^[a-zA-Z0-9_-]{1,128}$`).
@@ -5109,7 +5116,7 @@ function toAgentToolName(id) {
 	return id.replace(/[^\w-]+/g, "_").slice(0, MAX_TOOL_NAME_LENGTH);
 }
 //#endregion
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/client/index.mjs
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/client/index.mjs
 /** Devframe runtime routes and static output conventions. */
 var DEVFRAME_CONNECTION_META_FILENAME = "__connection.json";
 /**
@@ -7009,7 +7016,7 @@ async function getDevframeRpcClient(options = {}) {
 		bootstrapAuthSettled = true;
 	});
 	if (connectionMeta.mcp) __vitePreload(async () => {
-		const { setupBrowserAgentRpcBridge } = await import("./browser-agent-rpc-BXhoSh1z-DXAVFObe.js");
+		const { setupBrowserAgentRpcBridge } = await import("./browser-agent-rpc-BXhoSh1z-BuCvPGjS.js");
 		return { setupBrowserAgentRpcBridge };
 	}, [], import.meta.url).then(({ setupBrowserAgentRpcBridge }) => {
 		if (!closed) disposeBrowserAgentBridge = setupBrowserAgentRpcBridge(rpc);
@@ -8775,7 +8782,7 @@ var describeHmrReason = (reason) => {
 	}
 };
 //#endregion
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/browser-agent-Pu-FLk6I.mjs
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/browser-agent-Pu-FLk6I.mjs
 var REGISTRY_KEY = Symbol.for("devframe:browser-agent-registry");
 var { tools, listeners: listeners$1 } = globalThis[REGISTRY_KEY] ??= {
 	tools: /* @__PURE__ */ new Map(),
@@ -8800,7 +8807,7 @@ function onBrowserAgentToolsChanged(listener) {
 	return () => listeners$1.delete(listener);
 }
 //#endregion
-//#region node_modules/.pnpm/devframe@1.0.0_@devframes+agentic@1.0.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/in-page-channel/index.mjs
+//#region node_modules/.pnpm/devframe@1.1.0_@devframes+agentic@1.1.0_cac@7.0.0_srvx@1.0.5/node_modules/devframe/dist/in-page-channel/index.mjs
 var diagnostics = /* #__PURE__ */ defineDiagnostics$1({
 	docsBase: "https://devfra.me/errors",
 	codes: {
@@ -11122,6 +11129,7 @@ var DevtoolsSettings = class DevtoolsSettings extends i$2 {
 		return {
 			hmrReconnect: s.hmr.reconnect,
 			hmrOnIncompatible: s.hmr.onIncompatible,
+			hmrChildState: s.hmr.childState,
 			hmrIndicatorVisible: s.hmr.indicatorEnabled,
 			hmrIndicatorCount: s.hmr.indicatorCount,
 			sourceOverlayEditor: s.sourceOverlay.editor
@@ -11234,6 +11242,7 @@ var DevtoolsSettings = class DevtoolsSettings extends i$2 {
       </p>`;
 		const reconnect = o.hmrReconnect ?? s.hmr.reconnect;
 		const onIncompatible = o.hmrOnIncompatible ?? s.hmr.onIncompatible;
+		const childState = o.hmrChildState ?? s.hmr.childState;
 		const indicatorVisible = o.hmrIndicatorVisible ?? s.hmr.indicatorEnabled;
 		const indicatorCount = o.hmrIndicatorCount ?? s.hmr.indicatorCount;
 		return b`
@@ -11268,6 +11277,23 @@ var DevtoolsSettings = class DevtoolsSettings extends i$2 {
             ${this._ovrSource("hmrOnIncompatible", s.hmr.onIncompatible)}
           </td>
         </tr>
+        <tr>
+          <td class="key">child state</td>
+          <td class="val">
+            <select
+              @change=${(e) => this._set("hmrChildState", e.target.value)}
+            >
+              ${[
+			"transfer",
+			"reuse",
+			"reset"
+		].map((mode) => b`<option value=${mode} ?selected=${childState === mode}>
+                    ${mode}
+                  </option>`)}
+            </select>
+            ${this._ovrSource("hmrChildState", s.hmr.childState)}
+          </td>
+        </tr>
         <tr class=${s.hmr.indicatorEnabled ? "" : "row-disabled"}>
           <td class="key">indicator</td>
           <td class="val">
@@ -11719,4 +11745,4 @@ LitDevtoolsPanel = __decorate([t$2("lit-devtools-panel")], LitDevtoolsPanel);
 //#endregion
 export { onBrowserAgentToolsChanged as n, nanoid as r, listBrowserAgentTools as t };
 
-//# sourceMappingURL=index-DVr5EnyB.js.map
+//# sourceMappingURL=index-D632jo79.js.map