@oddsquad/vite-plugin-lit 0.7.0 → 0.8.0

package/dist/client/index.html

@@ -32,7 +32,7 @@
       `prefers-color-scheme` @media owns it, following the host/OS; an explicit
       light/dark pins a `.color-scheme-*` class on :root.
     -->
-    <script type="module" crossorigin src="./assets/index-D632jo79.js"></script>
+    <script type="module" crossorigin src="./assets/index-CgkhETVR.js"></script>
   </head>
   <body>
     <lit-devtools-panel></lit-devtools-panel>

package/dist/standalone/lit-devtools.js

@@ -20,11 +20,6 @@
 	};
 	//#endregion
 	//#region src/lib/runtime/timeline/transport.ts
-	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
 	var queue = [];
 	var flushScheduled = false;
 	var hotClient = null;
@@ -79,11 +74,6 @@
 	//#endregion
 	//#region src/lib/runtime/timeline/clock.ts
 	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
-	/**
 	* Recording-relative clock for the timeline.
 	*
 	* Built-in capture layers timestamp events with {@link now} rather than raw
@@ -107,11 +97,6 @@
 	var toPerfTime = (t) => t + epoch;
 	//#endregion
 	//#region src/lib/runtime/timeline/chrome-tracks.ts
-	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
 	var GROUP = "Lit";
 	var MAX_PENDING = 1e3;
 	var TRACKS = {
@@ -187,11 +172,6 @@
 	};
 	//#endregion
 	//#region src/lib/runtime/timeline/identity.ts
-	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
 	var SOURCE_META_KEY$1 = Symbol.for("@lit-labs/vite-plugin-lit#source");
 	/** WeakMap avoids retaining elements after disconnection + GC. */
 	var ids = /* @__PURE__ */ new WeakMap();
@@ -260,11 +240,6 @@
 	//#endregion
 	//#region src/lib/runtime/timeline/lifecycle.ts
 	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
-	/**
 	* ReactiveElement prototype instrumentation for the lifecycle timeline layer.
 	*
 	* Wraps the lifecycle methods listed in PHASES on the prototype of the
@@ -475,11 +450,6 @@
 	//#endregion
 	//#region src/lib/runtime/timeline/render.ts
 	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
-	/**
 	* Builds the element-identity `meta` for a render event from the render
 	* `host` (the LitElement whose `render()` produced these debug events).
 	* Uses the same id/source maps as the lifecycle layer so an element keeps one
@@ -702,11 +672,6 @@
 	};
 	//#endregion
 	//#region src/lib/runtime/timeline/input.ts
-	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
 	var MOUSE_EVENTS = [
 		"mousedown",
 		"mouseup",
@@ -779,11 +744,6 @@
 	};
 	//#endregion
 	//#region src/lib/runtime/timeline/flash.ts
-	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
 	/** Fade length; long enough to catch, short enough not to smear. */
 	var DURATION_MS = 450;
 	/** How far back the ramp counts updates for one element. */
@@ -950,11 +910,6 @@
 	};
 	//#endregion
 	//#region src/lib/runtime/page-channel.ts
-	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
 	/** Wraps Vite's HMR client as a {@link PageTransport}. */
 	var fromViteHot = (hot) => ({
 		send: (channel, data) => hot.send(channel, data),
@@ -1015,11 +970,6 @@
 	var pageChannel = shared[CHANNEL_KEY] ??= createPageChannel();
 	//#endregion
 	//#region src/types/timeline.ts
-	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
 	/** localStorage key holding the {@link SettingsOverride}. */
 	var SETTINGS_OVERRIDE_LS_KEY = "lit-devtools-overrides";
 	/** Vite HMR channel the server uses to push overrides to the app runtime. */
@@ -1027,11 +977,6 @@
 	//#endregion
 	//#region src/lib/runtime/overrides.ts
 	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
-	/**
 	* Browser-runtime side of the panel's live setting overrides. Reads the
 	* persisted override (written by the panel; same origin) and subscribes to the
 	* page channel the server rebroadcasts panel changes on.
@@ -1057,11 +1002,6 @@
 	//#endregion
 	//#region src/lib/runtime/timeline/install.ts
 	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
-	/**
 	* Timeline runtime install entry point.
 	*
 	* Injected by the plugin into the host page via `transformIndexHtml` when
@@ -3249,11 +3189,6 @@
 	//#endregion
 	//#region src/lib/runtime/inspector/serialize.ts
 	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
-	/**
 	* Compact, depth- and breadth-limited previews of arbitrary property values
 	* for the inspector details pane. Values cross the transport as plain strings,
 	* so this never needs to round-trip — it only has to be readable and safe
@@ -3359,11 +3294,6 @@
 	//#endregion
 	//#region src/lib/runtime/inspector/collect.ts
 	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
-	/**
 	* Walks the page to build the component render tree and to snapshot a single
 	* element's reactive state for the inspector panel. Runs entirely in the page;
 	* the results are sent over the transport as plain JSON.
@@ -3474,11 +3404,6 @@
 	//#endregion
 	//#region src/lib/runtime/inspector/highlight.ts
 	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
-	/**
 	* The hover outline the panel draws over an element in the page.
 	*
 	* Its own module because two transports drive it: the in-page channel (the
@@ -3540,11 +3465,6 @@
 	//#endregion
 	//#region src/types/in-page.ts
 	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
-	/**
 	* The direct page ↔ panel channel, for interactions that never need the node
 	* side.
 	*
@@ -3573,11 +3493,6 @@
 	var LIT_IN_PAGE_CHANNEL = "lit:in-page";
 	//#endregion
 	//#region src/types/inspector.ts
-	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
 	/** HMR channel the server uses to forward a panel command to the app runtime. */
 	var INSPECT_CMD_CHANNEL = "lit:inspect:cmd";
 	/** HMR channel the app runtime uses to push an {@link InspectorMessage}. */
@@ -3585,11 +3500,6 @@
 	//#endregion
 	//#region src/lib/runtime/inspector/install.ts
 	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
-	/**
 	* Components inspector runtime.
 	*
 	* Injected into the host page (alongside the timeline runtime) when the
@@ -3791,11 +3701,6 @@
 	//#endregion
 	//#region src/lib/devframe/protocol.ts
 	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
-	/**
 	* Bare name of the page-to-server event. A page runtime that is not on a Vite
 	* dev server's HMR socket sends every channel message it would have sent over
 	* `import.meta.hot` as `page-send(channel, data)`.
@@ -6731,11 +6636,6 @@
 	//#endregion
 	//#region src/lib/runtime/rpc-transport.ts
 	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
-	/**
 	* Carries the page channel over devframe RPC to a standalone
 	* `lit-devtools dev` server, so a page that is not served by a DevTools-enabled
 	* Vite dev server can still feed the panel. The server half is
@@ -6744,6 +6644,8 @@
 	* Opt-in and explicit: nothing connects until {@link connectToDevServer} is
 	* called, and `devframe/client` is only imported then, so a page that never
 	* asks pays nothing.
+	*
+	* @module
 	*/
 	/**
 	* A {@link PageTransport} over a devframe RPC client: `send` becomes a
@@ -6806,11 +6708,6 @@
 	};
 	//#endregion
 	//#region src/lib/runtime/standalone.ts
-	/**
-	* @license
-	* Copyright 2026 Google LLC
-	* SPDX-License-Identifier: BSD-3-Clause
-	*/
 	var config = globalThis.__LIT_DEVTOOLS_CONNECT__ ?? {};
 	var script = document.currentScript;
 	var url = script instanceof HTMLScriptElement && script.src !== "" ? new URL(".", script.src).href : config.url;

package/index.d.ts

@@ -1,8 +1,3 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: BSD-3-Clause
- */
 export { litPlugin, litPlugin as default } from './lib/plugin.js';
 export type { LitPluginOptions } from './lib/plugin.js';
 export type { ElementInfo, EditorConfig, SourceOverlayOptions, } from './lib/types.js';

package/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,SAAS,EAAE,SAAS,IAAI,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAChE,YAAY,EAAC,gBAAgB,EAAC,MAAM,iBAAiB,CAAC;AACtD,YAAY,EACV,WAAW,EACX,YAAY,EACZ,oBAAoB,GACrB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,SAAS,EAAE,SAAS,IAAI,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAChE,YAAY,EAAC,gBAAgB,EAAC,MAAM,iBAAiB,CAAC;AACtD,YAAY,EACV,WAAW,EACX,YAAY,EACZ,oBAAoB,GACrB,MAAM,gBAAgB,CAAC"}

package/index.js

@@ -1,7 +1,3 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: BSD-3-Clause
- */
+/* @ts-self-types="./index.d.ts" */
 export {litPlugin, litPlugin as default} from './lib/plugin.js';
 //# sourceMappingURL=index.js.map

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,SAAS,EAAE,SAAS,IAAI,OAAO,EAAC,MAAM,iBAAiB,CAAC","sourcesContent":["/**\n * @license\n * Copyright 2026 Google LLC\n * SPDX-License-Identifier: BSD-3-Clause\n */\n\nexport {litPlugin, litPlugin as default} from './lib/plugin.js';\nexport type {LitPluginOptions} from './lib/plugin.js';\nexport type {\n  ElementInfo,\n  EditorConfig,\n  SourceOverlayOptions,\n} from './lib/types.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,OAAO,EAAC,SAAS,EAAE,SAAS,IAAI,OAAO,EAAC,MAAM,iBAAiB,CAAC","sourcesContent":["/* @ts-self-types=\"./index.d.ts\" */\nexport {litPlugin, litPlugin as default} from './lib/plugin.js';\nexport type {LitPluginOptions} from './lib/plugin.js';\nexport type {\n  ElementInfo,\n  EditorConfig,\n  SourceOverlayOptions,\n} from './lib/types.js';\n"]}

package/lib/color-scheme.d.ts

@@ -1,8 +1,3 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: BSD-3-Clause
- */
 /**
  * Panel color-scheme preference, persisted in `localStorage`.
  *

package/lib/color-scheme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"color-scheme.d.ts","sourceRoot":"","sources":["../src/lib/color-scheme.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE9D,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,uDAAuD;AACvD,eAAO,MAAM,yBAAyB,QAAO,qBAQ5C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,SAAU,qBAAqB,KAAG,IAI9D,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,wBAAwB,SAAU,qBAAqB,KAAG,IAOtE,CAAC"}
+{"version":3,"file":"color-scheme.d.ts","sourceRoot":"","sources":["../src/lib/color-scheme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE9D,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,uDAAuD;AACvD,eAAO,MAAM,yBAAyB,QAAO,qBAQ5C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,SAAU,qBAAqB,KAAG,IAI9D,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,wBAAwB,SAAU,qBAAqB,KAAG,IAOtE,CAAC"}

package/lib/color-scheme.js

@@ -1,8 +1,3 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: BSD-3-Clause
- */
 /** localStorage key for the panel UI color-scheme preference. */
 export const COLOR_SCHEME_LS_KEY = 'lit-devtools-color-scheme';
 /** Read the saved preference, defaulting to `auto`. */

package/lib/color-scheme.js.map

@@ -1 +1 @@
-{"version":3,"file":"color-scheme.js","sourceRoot":"","sources":["../src/lib/color-scheme.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,uDAAuD;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAA0B,EAAE;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACtD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAA2B,EAAQ,EAAE;IACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,eAAe,CAAC;IACtC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,IAAI,KAAK,MAAM;QAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,qDAAqD;AACrD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAA2B,EAAQ,EAAE;IAC5E,IAAI,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,gBAAgB,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC","sourcesContent":["/**\n * @license\n * Copyright 2026 Google LLC\n * SPDX-License-Identifier: BSD-3-Clause\n */\n\n/**\n * Panel color-scheme preference, persisted in `localStorage`.\n *\n * `auto` is the default and needs no JavaScript: the token values injected by\n * {@link injectTokens} in `tokens.ts` react to `prefers-color-scheme` via\n * `@media`, so the panel follows whatever scheme its host requests — the OS\n * when standalone, or the embedding app's `color-scheme` when docked in the\n * Vite DevTools shell (the iframe inherits it). An explicit `light`/`dark`\n * preference pins the matching `.color-scheme-light` / `.color-scheme-dark`\n * class on the document root, overriding the media query.\n */\nexport type ColorSchemePreference = 'auto' | 'dark' | 'light';\n\n/** localStorage key for the panel UI color-scheme preference. */\nexport const COLOR_SCHEME_LS_KEY = 'lit-devtools-color-scheme';\n\n/** Read the saved preference, defaulting to `auto`. */\nexport const readColorSchemePreference = (): ColorSchemePreference => {\n  try {\n    const raw = localStorage.getItem(COLOR_SCHEME_LS_KEY);\n    if (raw === 'auto' || raw === 'dark' || raw === 'light') return raw;\n  } catch {\n    // ignore\n  }\n  return 'auto';\n};\n\n/**\n * Apply a preference to the document root. `light`/`dark` pin the matching\n * class; `auto` removes both and lets the `prefers-color-scheme` `@media` rule\n * in the injected tokens own the scheme (and live-update on OS changes).\n */\nexport const applyColorScheme = (pref: ColorSchemePreference): void => {\n  const root = document.documentElement;\n  root.classList.remove('color-scheme-light', 'color-scheme-dark');\n  if (pref !== 'auto') root.classList.add('color-scheme-' + pref);\n};\n\n/** Persist a preference and apply it immediately. */\nexport const setColorSchemePreference = (pref: ColorSchemePreference): void => {\n  try {\n    localStorage.setItem(COLOR_SCHEME_LS_KEY, pref);\n  } catch {\n    // ignore\n  }\n  applyColorScheme(pref);\n};\n"]}
+{"version":3,"file":"color-scheme.js","sourceRoot":"","sources":["../src/lib/color-scheme.ts"],"names":[],"mappings":"AAaA,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,uDAAuD;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAA0B,EAAE;IACnE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACtD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,GAAG,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAA2B,EAAQ,EAAE;IACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,eAAe,CAAC;IACtC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,IAAI,KAAK,MAAM;QAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,qDAAqD;AACrD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAA2B,EAAQ,EAAE;IAC5E,IAAI,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,gBAAgB,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC","sourcesContent":["/**\n * Panel color-scheme preference, persisted in `localStorage`.\n *\n * `auto` is the default and needs no JavaScript: the token values injected by\n * {@link injectTokens} in `tokens.ts` react to `prefers-color-scheme` via\n * `@media`, so the panel follows whatever scheme its host requests — the OS\n * when standalone, or the embedding app's `color-scheme` when docked in the\n * Vite DevTools shell (the iframe inherits it). An explicit `light`/`dark`\n * preference pins the matching `.color-scheme-light` / `.color-scheme-dark`\n * class on the document root, overriding the media query.\n */\nexport type ColorSchemePreference = 'auto' | 'dark' | 'light';\n\n/** localStorage key for the panel UI color-scheme preference. */\nexport const COLOR_SCHEME_LS_KEY = 'lit-devtools-color-scheme';\n\n/** Read the saved preference, defaulting to `auto`. */\nexport const readColorSchemePreference = (): ColorSchemePreference => {\n  try {\n    const raw = localStorage.getItem(COLOR_SCHEME_LS_KEY);\n    if (raw === 'auto' || raw === 'dark' || raw === 'light') return raw;\n  } catch {\n    // ignore\n  }\n  return 'auto';\n};\n\n/**\n * Apply a preference to the document root. `light`/`dark` pin the matching\n * class; `auto` removes both and lets the `prefers-color-scheme` `@media` rule\n * in the injected tokens own the scheme (and live-update on OS changes).\n */\nexport const applyColorScheme = (pref: ColorSchemePreference): void => {\n  const root = document.documentElement;\n  root.classList.remove('color-scheme-light', 'color-scheme-dark');\n  if (pref !== 'auto') root.classList.add('color-scheme-' + pref);\n};\n\n/** Persist a preference and apply it immediately. */\nexport const setColorSchemePreference = (pref: ColorSchemePreference): void => {\n  try {\n    localStorage.setItem(COLOR_SCHEME_LS_KEY, pref);\n  } catch {\n    // ignore\n  }\n  applyColorScheme(pref);\n};\n"]}

package/lib/confine.d.ts

@@ -1,8 +1,3 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: BSD-3-Clause
- */
 /** Why {@link confineToRoots} refused a path. */
 export type ConfineFailure = 'outside' | 'missing';
 /**

package/lib/confine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"confine.d.ts","sourceRoot":"","sources":["../src/lib/confine.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,iDAAiD;AACjD,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;AAEnD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,UAClB,SAAS,MAAM,EAAE,QAClB,MAAM,KACX;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAG;IAAC,OAAO,EAAE,cAAc,CAAA;CAmB3C,CAAC"}
+{"version":3,"file":"confine.d.ts","sourceRoot":"","sources":["../src/lib/confine.ts"],"names":[],"mappings":"AAGA,iDAAiD;AACjD,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;AAEnD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,UAClB,SAAS,MAAM,EAAE,QAClB,MAAM,KACX;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAG;IAAC,OAAO,EAAE,cAAc,CAAA;CAmB3C,CAAC"}

package/lib/confine.js

@@ -1,8 +1,3 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: BSD-3-Clause
- */
 import {existsSync, realpathSync} from 'node:fs';
 import {resolve as resolvePath, sep} from 'node:path';
 /**

package/lib/confine.js.map

@@ -1 +1 @@
-{"version":3,"file":"confine.js","sourceRoot":"","sources":["../src/lib/confine.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAC,UAAU,EAAE,YAAY,EAAC,MAAM,SAAS,CAAC;AACjD,OAAO,EAAC,OAAO,IAAI,WAAW,EAAE,GAAG,EAAC,MAAM,WAAW,CAAC;AAKtD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,KAAwB,EACxB,IAAY,EACgC,EAAE;IAC9C,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAC,OAAO,EAAE,SAAS,EAAC,CAAC;IACvD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC;QAAE,OAAO,EAAC,OAAO,EAAE,SAAS,EAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAC,OAAO,EAAE,SAAS,EAAC,CAAC;IACnD,2EAA2E;IAC3E,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/C,IAAI,CAAC;YACH,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAC,OAAO,EAAE,SAAS,EAAC,CAAC;IACxE,OAAO,EAAC,IAAI,EAAC,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,KAAwB,EAAE,IAAY,EAAW,EAAE,CACjE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC","sourcesContent":["/**\n * @license\n * Copyright 2026 Google LLC\n * SPDX-License-Identifier: BSD-3-Clause\n */\n\nimport {existsSync, realpathSync} from 'node:fs';\nimport {resolve as resolvePath, sep} from 'node:path';\n\n/** Why {@link confineToRoots} refused a path. */\nexport type ConfineFailure = 'outside' | 'missing';\n\n/**\n * Resolve `file` against the first of `roots` and accept it only if it lands\n * at or beneath one of them and exists. Every caller hands the result to\n * `launch-editor`, which spawns the developer's editor on it, so this is the\n * boundary that keeps a request from opening arbitrary files (absolute paths,\n * `../` traversal, a sibling directory that merely shares a root's prefix, a\n * symlink out of the tree).\n * Without roots nothing is allowed.\n */\nexport const confineToRoots = (\n  roots: readonly string[],\n  file: string\n): {path: string} | {failure: ConfineFailure} => {\n  const resolvedRoots = roots.map((root) => resolvePath(root));\n  const primary = resolvedRoots[0];\n  if (primary === undefined) return {failure: 'outside'};\n  const path = resolvePath(primary, file);\n  if (!within(resolvedRoots, path)) return {failure: 'outside'};\n  if (!existsSync(path)) return {failure: 'missing'};\n  // Checked again on the real paths, so a symlink beneath a root can't point\n  // the editor outside every root. The caller still gets the path as asked:\n  // that's the one the developer recognises.\n  const realRoots = resolvedRoots.flatMap((root) => {\n    try {\n      return [realpathSync(root)];\n    } catch {\n      return [];\n    }\n  });\n  if (!within(realRoots, realpathSync(path))) return {failure: 'outside'};\n  return {path};\n};\n\nconst within = (roots: readonly string[], path: string): boolean =>\n  roots.some((root) => path === root || path.startsWith(root + sep));\n"]}
+{"version":3,"file":"confine.js","sourceRoot":"","sources":["../src/lib/confine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAE,YAAY,EAAC,MAAM,SAAS,CAAC;AACjD,OAAO,EAAC,OAAO,IAAI,WAAW,EAAE,GAAG,EAAC,MAAM,WAAW,CAAC;AAKtD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,KAAwB,EACxB,IAAY,EACgC,EAAE;IAC9C,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAC,OAAO,EAAE,SAAS,EAAC,CAAC;IACvD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC;QAAE,OAAO,EAAC,OAAO,EAAE,SAAS,EAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAC,OAAO,EAAE,SAAS,EAAC,CAAC;IACnD,2EAA2E;IAC3E,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/C,IAAI,CAAC;YACH,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAC,OAAO,EAAE,SAAS,EAAC,CAAC;IACxE,OAAO,EAAC,IAAI,EAAC,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,KAAwB,EAAE,IAAY,EAAW,EAAE,CACjE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC","sourcesContent":["import {existsSync, realpathSync} from 'node:fs';\nimport {resolve as resolvePath, sep} from 'node:path';\n\n/** Why {@link confineToRoots} refused a path. */\nexport type ConfineFailure = 'outside' | 'missing';\n\n/**\n * Resolve `file` against the first of `roots` and accept it only if it lands\n * at or beneath one of them and exists. Every caller hands the result to\n * `launch-editor`, which spawns the developer's editor on it, so this is the\n * boundary that keeps a request from opening arbitrary files (absolute paths,\n * `../` traversal, a sibling directory that merely shares a root's prefix, a\n * symlink out of the tree).\n * Without roots nothing is allowed.\n */\nexport const confineToRoots = (\n  roots: readonly string[],\n  file: string\n): {path: string} | {failure: ConfineFailure} => {\n  const resolvedRoots = roots.map((root) => resolvePath(root));\n  const primary = resolvedRoots[0];\n  if (primary === undefined) return {failure: 'outside'};\n  const path = resolvePath(primary, file);\n  if (!within(resolvedRoots, path)) return {failure: 'outside'};\n  if (!existsSync(path)) return {failure: 'missing'};\n  // Checked again on the real paths, so a symlink beneath a root can't point\n  // the editor outside every root. The caller still gets the path as asked:\n  // that's the one the developer recognises.\n  const realRoots = resolvedRoots.flatMap((root) => {\n    try {\n      return [realpathSync(root)];\n    } catch {\n      return [];\n    }\n  });\n  if (!within(realRoots, realpathSync(path))) return {failure: 'outside'};\n  return {path};\n};\n\nconst within = (roots: readonly string[], path: string): boolean =>\n  roots.some((root) => path === root || path.startsWith(root + sep));\n"]}

package/lib/devframe/allowed-origins.d.ts

@@ -1,7 +1,15 @@
 /**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: BSD-3-Clause
+ * The origin allowlist behind `lit-devtools dev --allow-origin`.
+ *
+ * devframe compares `allowedOrigins` entries exactly, which cannot admit a
+ * page whose origin is only known once it boots: StackBlitz gives every port
+ * of a project its own `https://<slug>--<port>--<hash>.<zone>.webcontainer-api.io`.
+ * An entry may therefore put `*` in its host (`https://*.webcontainer-api.io`),
+ * standing for one or more DNS labels. Scheme and port still have to match.
+ *
+ * With a wildcard among the entries the list is handed to devframe as an
+ * origin registry, the one shape it accepts that decides per origin; its
+ * WebSocket and SSE gates both ask it. Without one it stays a plain array.
  */
 import type { WsOriginRegistry } from 'devframe/rpc/transports/ws-server';
 /**

package/lib/devframe/allowed-origins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allowed-origins.d.ts","sourceRoot":"","sources":["../../src/lib/devframe/allowed-origins.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiBH,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,mCAAmC,CAAC;AAsBxE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,YACvB,SAAS,MAAM,EAAE,KACzB,SAAS,MAAM,EAAE,GAAG,gBAAgB,GAAG,SAkBzC,CAAC"}
+{"version":3,"file":"allowed-origins.d.ts","sourceRoot":"","sources":["../../src/lib/devframe/allowed-origins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,mCAAmC,CAAC;AAsBxE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,YACvB,SAAS,MAAM,EAAE,KACzB,SAAS,MAAM,EAAE,GAAG,gBAAgB,GAAG,SAkBzC,CAAC"}

package/lib/devframe/allowed-origins.js

@@ -1,8 +1,3 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: BSD-3-Clause
- */
 /**
  * The origin allowlist behind `lit-devtools dev --allow-origin`.
  *

package/lib/devframe/allowed-origins.js.map

@@ -1 +1 @@
-{"version":3,"file":"allowed-origins.js","sourceRoot":"","sources":["../../src/lib/devframe/allowed-origins.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAC,eAAe,EAAC,MAAM,mCAAmC,CAAC;AAGlE,4DAA4D;AAC5D,MAAM,cAAc,GAAG,CAAC,KAAa,EAAU,EAAE;IAC/C,MAAM,KAAK,GAAG,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,sDAAsD;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,kBAAkB,KAAK,+BAA+B;YACpD,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,EAAE,MAAM,EAAE,AAAD,EAAG,IAAI,CAAC,GAAG,KAAK,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;SAC1D,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACxD,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAA0B,EACwB,EAAE;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO;SAClB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO;SACrB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACtC,GAAG,CAAC,cAAc,CAAC,CAAC;IACvB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO;QACL,oEAAoE;QACpE,kEAAkE;QAClE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;QAC1B,eAAe,EAAE,GAAG,EAAE,CAAC,SAAS;QAChC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CACpB,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC;YAC9B,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * @license\n * Copyright 2026 Google LLC\n * SPDX-License-Identifier: BSD-3-Clause\n */\n\n/**\n * The origin allowlist behind `lit-devtools dev --allow-origin`.\n *\n * devframe compares `allowedOrigins` entries exactly, which cannot admit a\n * page whose origin is only known once it boots: StackBlitz gives every port\n * of a project its own `https://<slug>--<port>--<hash>.<zone>.webcontainer-api.io`.\n * An entry may therefore put `*` in its host (`https://*.webcontainer-api.io`),\n * standing for one or more DNS labels. Scheme and port still have to match.\n *\n * With a wildcard among the entries the list is handed to devframe as an\n * origin registry, the one shape it accepts that decides per origin; its\n * WebSocket and SSE gates both ask it. Without one it stays a plain array.\n */\n\nimport {isAllowedOrigin} from 'devframe/rpc/transports/ws-server';\nimport type {WsOriginRegistry} from 'devframe/rpc/transports/ws-server';\n\n/** An entry with `*` in the host, compiled to a matcher. */\nconst compilePattern = (entry: string): RegExp => {\n  const match = /^(https?):\\/\\/([^/:]+)(?::(\\d+))?\\/?$/.exec(entry);\n  const host = match?.[2] ?? '';\n  // `*` alone, or `*.com`, would admit most of the web.\n  if (match === null || !/^(?:[^*]*\\*)*[^*]*\\.[^*.]+\\.[^*.]+$/.test(host)) {\n    throw new Error(\n      `--allow-origin ${entry}: a wildcard needs the shape ` +\n        `https://*.example.com, with at least two literal labels after it`\n    );\n  }\n  const [, scheme, , port] = match;\n  const hostSource = host\n    .split('*')\n    .map((part) => part.replace(/[.\\\\+?^$()[\\]{}|-]/g, '\\\\$&'))\n    .join('[a-z0-9-]+(?:\\\\.[a-z0-9-]+)*');\n  const portSource = port === undefined ? '' : `:${port}`;\n  return new RegExp(`^${scheme}://${hostSource}${portSource}$`, 'i');\n};\n\n/**\n * `allowedOrigins` for `createDevServer`, from the `--allow-origin` values:\n * `undefined` for none, the entries as given when all are exact, or a registry\n * that also matches the wildcard ones. Throws on a malformed wildcard entry.\n */\nexport const resolveAllowedOrigins = (\n  entries: readonly string[]\n): readonly string[] | WsOriginRegistry | undefined => {\n  if (entries.length === 0) return undefined;\n  const exact = entries\n    .filter((entry) => !entry.includes('*'))\n    .map((entry) => entry.replace(/\\/$/, ''));\n  const patterns = entries\n    .filter((entry) => entry.includes('*'))\n    .map(compilePattern);\n  if (patterns.length === 0) return exact;\n  return {\n    // No viewer registers itself through this list, so the token guards\n    // nothing; it is random only so it is never a guessable constant.\n    token: crypto.randomUUID(),\n    registerFromUrl: () => undefined,\n    isAllowed: (origin) =>\n      isAllowedOrigin(origin, exact) ||\n      (origin !== undefined && patterns.some((re) => re.test(origin))),\n  };\n};\n"]}
+{"version":3,"file":"allowed-origins.js","sourceRoot":"","sources":["../../src/lib/devframe/allowed-origins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAC,eAAe,EAAC,MAAM,mCAAmC,CAAC;AAGlE,4DAA4D;AAC5D,MAAM,cAAc,GAAG,CAAC,KAAa,EAAU,EAAE;IAC/C,MAAM,KAAK,GAAG,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,sDAAsD;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,kBAAkB,KAAK,+BAA+B;YACpD,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,EAAE,MAAM,EAAE,AAAD,EAAG,IAAI,CAAC,GAAG,KAAK,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;SAC1D,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACxD,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAA0B,EACwB,EAAE;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO;SAClB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO;SACrB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACtC,GAAG,CAAC,cAAc,CAAC,CAAC;IACvB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO;QACL,oEAAoE;QACpE,kEAAkE;QAClE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;QAC1B,eAAe,EAAE,GAAG,EAAE,CAAC,SAAS;QAChC,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CACpB,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC;YAC9B,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * The origin allowlist behind `lit-devtools dev --allow-origin`.\n *\n * devframe compares `allowedOrigins` entries exactly, which cannot admit a\n * page whose origin is only known once it boots: StackBlitz gives every port\n * of a project its own `https://<slug>--<port>--<hash>.<zone>.webcontainer-api.io`.\n * An entry may therefore put `*` in its host (`https://*.webcontainer-api.io`),\n * standing for one or more DNS labels. Scheme and port still have to match.\n *\n * With a wildcard among the entries the list is handed to devframe as an\n * origin registry, the one shape it accepts that decides per origin; its\n * WebSocket and SSE gates both ask it. Without one it stays a plain array.\n */\n\nimport {isAllowedOrigin} from 'devframe/rpc/transports/ws-server';\nimport type {WsOriginRegistry} from 'devframe/rpc/transports/ws-server';\n\n/** An entry with `*` in the host, compiled to a matcher. */\nconst compilePattern = (entry: string): RegExp => {\n  const match = /^(https?):\\/\\/([^/:]+)(?::(\\d+))?\\/?$/.exec(entry);\n  const host = match?.[2] ?? '';\n  // `*` alone, or `*.com`, would admit most of the web.\n  if (match === null || !/^(?:[^*]*\\*)*[^*]*\\.[^*.]+\\.[^*.]+$/.test(host)) {\n    throw new Error(\n      `--allow-origin ${entry}: a wildcard needs the shape ` +\n        `https://*.example.com, with at least two literal labels after it`\n    );\n  }\n  const [, scheme, , port] = match;\n  const hostSource = host\n    .split('*')\n    .map((part) => part.replace(/[.\\\\+?^$()[\\]{}|-]/g, '\\\\$&'))\n    .join('[a-z0-9-]+(?:\\\\.[a-z0-9-]+)*');\n  const portSource = port === undefined ? '' : `:${port}`;\n  return new RegExp(`^${scheme}://${hostSource}${portSource}$`, 'i');\n};\n\n/**\n * `allowedOrigins` for `createDevServer`, from the `--allow-origin` values:\n * `undefined` for none, the entries as given when all are exact, or a registry\n * that also matches the wildcard ones. Throws on a malformed wildcard entry.\n */\nexport const resolveAllowedOrigins = (\n  entries: readonly string[]\n): readonly string[] | WsOriginRegistry | undefined => {\n  if (entries.length === 0) return undefined;\n  const exact = entries\n    .filter((entry) => !entry.includes('*'))\n    .map((entry) => entry.replace(/\\/$/, ''));\n  const patterns = entries\n    .filter((entry) => entry.includes('*'))\n    .map(compilePattern);\n  if (patterns.length === 0) return exact;\n  return {\n    // No viewer registers itself through this list, so the token guards\n    // nothing; it is random only so it is never a guessable constant.\n    token: crypto.randomUUID(),\n    registerFromUrl: () => undefined,\n    isAllowed: (origin) =>\n      isAllowedOrigin(origin, exact) ||\n      (origin !== undefined && patterns.some((re) => re.test(origin))),\n  };\n};\n"]}

package/lib/devframe/definition.d.ts

@@ -1,7 +1,11 @@
 /**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: BSD-3-Clause
+ * The framework-neutral Lit devframe: RPC functions, shared state, and the
+ * timeline stream. Talks to the page runtime only through the injected
+ * {@link TimelineSource} port, so it runs unchanged under `createDevServer()`,
+ * `createBuild()`, or an MCP server with no Vite in the loop. `vite.ts` wires
+ * the real page-runtime bridge and mounts this via `createPluginFromDevframe`.
+ *
+ * @see plans/devframe-foundation.md
  */
 import type { DevframeDefinition } from 'devframe';
 import type { FeatureSettings } from '../../types/timeline.js';

package/lib/devframe/definition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition.d.ts","sourceRoot":"","sources":["../../src/lib/devframe/definition.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH,OAAO,KAAK,EAAC,kBAAkB,EAAsB,MAAM,UAAU,CAAC;AAWtE,OAAO,KAAK,EACV,eAAe,EAGhB,MAAM,yBAAyB,CAAC;AA6CjC,OAAO,EAAmB,KAAK,cAAc,EAAC,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,yBAAyB,CAAC;AAE7D,MAAM,WAAW,wBAAwB;IACvC,kFAAkF;IAClF,MAAM,EAAE,cAAc,CAAC;IACvB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACxC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC5C;;;;;OAKG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,wBAAwB,GAChC,kBAAkB,CAqlBpB"}
+{"version":3,"file":"definition.d.ts","sourceRoot":"","sources":["../../src/lib/devframe/definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,KAAK,EAAC,kBAAkB,EAAsB,MAAM,UAAU,CAAC;AAWtE,OAAO,KAAK,EACV,eAAe,EAGhB,MAAM,yBAAyB,CAAC;AA6CjC,OAAO,EAAmB,KAAK,cAAc,EAAC,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,yBAAyB,CAAC;AAE7D,MAAM,WAAW,wBAAwB;IACvC,kFAAkF;IAClF,MAAM,EAAE,cAAc,CAAC;IACvB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACxC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACtC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC5C;;;;;OAKG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,wBAAwB,GAChC,kBAAkB,CAqlBpB"}

package/lib/devframe/definition.js

@@ -1,8 +1,3 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: BSD-3-Clause
- */
 /**
  * The framework-neutral Lit devframe: RPC functions, shared state, and the
  * timeline stream. Talks to the page runtime only through the injected
@@ -117,7 +112,7 @@ export function createLitDevframe(options) {
       // Bounded history for the `recent-events` agent query and the panel's
       // `timeline-history` seed. A plain array, not devframe's internal
       // per-stream replay buffer, which devframe marks `@internal` (see
-      // plans/roadmap/02-agent-timeline-access.md).
+      // plans/devtools-features.md).
       const recentEvents = replay ? [...replay.events] : [];
       // Event ids: `${epoch}-${seq}`. The epoch is the session start, so a
       // restarted dev server can never reissue an id an older snapshot holds;