devframe 0.5.4 → 0.6.0-beta.2

package/dist/node/index.d.mts

@@ -1,8 +1,8 @@
-import { $ as AgentResource, K as DevframeHost, P as SharedState, Q as AgentManifest, U as DevframeRpcClientFunctions, W as DevframeRpcServerFunctions, X as DevframeDiagnosticsLogger, Y as DevframeDiagnosticsHost$1, Z as AgentHandle, at as DevframeAgentHostEvents, d as DevframeNodeContext, et as AgentResourceContent, f as DevframeNodeRpcSession, g as RpcSharedStateHost, it as DevframeAgentHost$1, m as RpcFunctionsHost$1, nt as AgentTool, ot as EventEmitter, p as RpcBroadcastOptions, rt as AgentToolInput, tt as AgentResourceInput, y as RpcStreamingHost, z as DevframeViewHost$1 } from "../devframe-BuR6n9ZD.mjs";
-import { _ as RpcFunctionDefinitionAny } from "../types-BkkQ0Txg.mjs";
-import { S as RpcFunctionsCollectorBase } from "../index-C7M1hnvL.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "../ws-server-C1LjmRnp.mjs";
-import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-wHlpcdZ9.mjs";
+import { G as DevframeScopedNodeContext, J as DevframeSettings, L as SharedState, S as RpcStreamingHost, _ as RpcFunctionsHost$1, _t as AgentToolInput, bt as EventEmitter, dt as AgentHandle, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, it as DevframeRpcServerFunctions, lt as DevframeDiagnosticsHost$1, m as DevframeNodeContext, mt as AgentResourceContent, nt as DevframeViewHost$1, ot as DevframeHost, pt as AgentResource, rt as DevframeRpcClientFunctions, ut as DevframeDiagnosticsLogger, vt as DevframeAgentHost$1, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "../devframe-D-gr9sBx.mjs";
+import { v as RpcFunctionDefinitionAny } from "../types-DZEx4ffs.mjs";
+import { S as RpcFunctionsCollectorBase } from "../index-CxaPKDXX.mjs";
+import { t as DevframeNodeRpcSessionMeta } from "../ws-server-Bc2wBHl-.mjs";
+import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-rX781kz-.mjs";
 import { BirpcGroup } from "birpc";
 import { AsyncLocalStorage } from "node:async_hooks";
 
@@ -156,6 +156,22 @@ declare function createRpcSharedStateServerHost(rpc: RpcFunctionsHost$1): RpcSha
  */
 declare function createRpcStreamingServerHost(rpc: RpcFunctionsHost$1): RpcStreamingHost;
 //#endregion
+//#region src/node/scope.d.ts
+/**
+ * Build a namespace-scoped view of a {@link DevframeNodeContext}. Every
+ * RPC id, shared-state key, and streaming channel passed through the
+ * returned `rpc` surface is auto-namespaced with `<namespace>:`.
+ */
+declare function createScopedNodeContext<NS extends string = string>(context: DevframeNodeContext, namespace: NS): DevframeScopedNodeContext<NS>;
+//#endregion
+//#region src/node/settings.d.ts
+/**
+ * Build the node-side `settings` surface for a scope namespace. `project`
+ * persists under the host's `workspace` storage dir, `global` under its
+ * `global` dir. Each is a file-backed, client-synced key-value store.
+ */
+declare function createNodeSettings<T extends Record<string, any> = Record<string, any>>(context: DevframeNodeContext, namespace: string): DevframeSettings<T>;
+//#endregion
 //#region src/node/storage.d.ts
 interface CreateStorageOptions<T extends object> {
   filepath: string;
@@ -169,4 +185,4 @@ declare function createStorage<T extends object>(options: CreateStorageOptions<T
 declare function isObject(value: unknown): value is Record<string, any>;
 declare function normalizeHttpServerUrl(host: string, port: number | string): string;
 //#endregion
-export { CreateH3DevframeHostOptions, CreateHostContextOptions, CreateStorageOptions, DevframeAgentHost, DevframeDiagnosticsHost, DevframeViewHost, RpcFunctionsHost, StartHttpAndWsOptions, StartedServer, createH3DevframeHost, createHostContext, createRpcSharedStateServerHost, createRpcStreamingServerHost, createStorage, isObject, normalizeHttpServerUrl, startHttpAndWs };
+export { CreateH3DevframeHostOptions, CreateHostContextOptions, CreateStorageOptions, DevframeAgentHost, DevframeDiagnosticsHost, DevframeViewHost, RpcFunctionsHost, StartHttpAndWsOptions, StartedServer, createH3DevframeHost, createHostContext, createNodeSettings, createRpcSharedStateServerHost, createRpcStreamingServerHost, createScopedNodeContext, createStorage, isObject, normalizeHttpServerUrl, startHttpAndWs };

package/dist/node/index.mjs

@@ -1,6 +1,6 @@
-import { a as createRpcStreamingServerHost, c as DevframeAgentHost, i as RpcFunctionsHost, n as createHostContext, o as createRpcSharedStateServerHost, r as DevframeViewHost, s as DevframeDiagnosticsHost, t as createH3DevframeHost } from "../host-h3-Dgpgr1Ul.mjs";
-import { r as createStorage } from "../context-DaKmhhHY.mjs";
-import { t as startHttpAndWs } from "../server-BBaBJaUL.mjs";
+import { t as createStorage } from "../storage-l2ezeend.mjs";
+import { a as DevframeViewHost, c as createRpcSharedStateServerHost, i as createNodeSettings, l as DevframeDiagnosticsHost, n as createHostContext, o as RpcFunctionsHost, r as createScopedNodeContext, s as createRpcStreamingServerHost, t as createH3DevframeHost, u as DevframeAgentHost } from "../host-h3-C5SZlk03.mjs";
+import { t as startHttpAndWs } from "../server-Dl6TU5LE.mjs";
 import { isIP } from "node:net";
 //#region src/node/utils.ts
 function isObject(value) {
@@ -10,4 +10,4 @@ function normalizeHttpServerUrl(host, port) {
 	return `http://${host === "127.0.0.1" ? "localhost" : isIP(host) === 6 ? `[${host}]` : host}:${port}`;
 }
 //#endregion
-export { DevframeAgentHost, DevframeDiagnosticsHost, DevframeViewHost, RpcFunctionsHost, createH3DevframeHost, createHostContext, createRpcSharedStateServerHost, createRpcStreamingServerHost, createStorage, isObject, normalizeHttpServerUrl, startHttpAndWs };
+export { DevframeAgentHost, DevframeDiagnosticsHost, DevframeViewHost, RpcFunctionsHost, createH3DevframeHost, createHostContext, createNodeSettings, createRpcSharedStateServerHost, createRpcStreamingServerHost, createScopedNodeContext, createStorage, isObject, normalizeHttpServerUrl, startHttpAndWs };

package/dist/recipes/open-helpers.d.mts

@@ -1,4 +1,4 @@
-import { T as Thenable, h as RpcFunctionAgentOptions, s as RpcDump, x as RpcFunctionSetupResult } from "../types-BkkQ0Txg.mjs";
+import { E as Thenable, S as RpcFunctionSetupResult, c as RpcDump, g as RpcFunctionAgentOptions } from "../types-DZEx4ffs.mjs";
 import * as v from "valibot";
 
 //#region src/recipes/open-helpers.d.ts

package/dist/recipes/open-helpers.mjs

@@ -1,6 +1,6 @@
-import { t as launchEditor } from "../launch-editor-BbNhtg7b.mjs";
-import { n as defineRpcFunction } from "../define-CW9gLnyG.mjs";
-import { t as open } from "../open-DiQn6zCH.mjs";
+import { t as launchEditor } from "../launch-editor-DPfltGA4.mjs";
+import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
+import { t as open } from "../open-Dusa2Zzd.mjs";
 import * as v from "valibot";
 //#region src/recipes/open-helpers.ts
 /**

package/dist/revoke-ENfxWkFK.mjs

@@ -0,0 +1,79 @@
+//#region src/utils/crypto-token.ts
+const HEX = "0123456789abcdef";
+/**
+* Generate a high-entropy, URL-safe (hex) random token suitable for use as a
+* bearer credential — e.g. the persistent client auth token or an ephemeral
+* remote-dock token. Defaults to 16 bytes (128 bits) of entropy.
+*/
+function randomToken(byteLength = 16) {
+	const bytes = new Uint8Array(byteLength);
+	globalThis.crypto.getRandomValues(bytes);
+	let out = "";
+	for (let i = 0; i < bytes.length; i++) out += HEX[bytes[i] >> 4] + HEX[bytes[i] & 15];
+	return out;
+}
+/**
+* Generate a uniformly-distributed string of decimal digits using rejection
+* sampling to avoid modulo bias. Intended for short, human-typed one-time
+* codes (e.g. a 6-digit authentication code). Leading zeros are preserved.
+*/
+function randomDigits(length) {
+	const limit = 250;
+	const buf = new Uint8Array(1);
+	let out = "";
+	while (out.length < length) {
+		globalThis.crypto.getRandomValues(buf);
+		if (buf[0] < limit) out += String(buf[0] % 10);
+	}
+	return out;
+}
+/**
+* Constant-time string equality. Compares every character so the comparison
+* time does not depend on the position of the first mismatch, mitigating
+* timing side-channels when verifying secrets.
+*
+* Length is treated as public (it short-circuits on differing lengths), which
+* is appropriate for fixed-length codes and tokens.
+*/
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let mismatch = 0;
+	for (let i = 0; i < a.length; i++) mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return mismatch === 0;
+}
+//#endregion
+//#region src/node/auth/revoke.ts
+/**
+* Flip `isTrusted` to false on any live WS clients connected with `token`
+* and broadcast the `auth:revoked` event so they can react.
+*
+* Shared between persisted-auth revocation and remote-dock token revocation.
+*/
+async function revokeActiveConnectionsForToken(context, token) {
+	const rpcHost = context.rpc;
+	if (!rpcHost?._rpcGroup) return;
+	const affectedSessionIds = /* @__PURE__ */ new Set();
+	for (const client of rpcHost._rpcGroup.clients) if (client.$meta.clientAuthToken === token) {
+		affectedSessionIds.add(client.$meta.id);
+		client.$meta.isTrusted = false;
+		client.$meta.clientAuthToken = void 0;
+	}
+	if (affectedSessionIds.size === 0) return;
+	await rpcHost.broadcast({
+		method: "devframe:auth:revoked",
+		args: [],
+		filter: (client) => affectedSessionIds.has(client.$meta.id)
+	});
+}
+/**
+* Revoke an auth token: remove from storage and notify all connected clients
+* using this token that they are no longer trusted.
+*/
+async function revokeAuthToken(context, storage, token) {
+	storage.mutate((state) => {
+		delete state.trusted[token];
+	});
+	await revokeActiveConnectionsForToken(context, token);
+}
+//#endregion
+export { timingSafeEqual as a, randomToken as i, revokeAuthToken as n, randomDigits as r, revokeActiveConnectionsForToken as t };

package/dist/rpc/dump.d.mts

@@ -1,2 +1,2 @@
-import { a as getDefinitionsWithDumps, c as StaticRpcDumpManifest, d as StaticRpcDumpManifestValue, f as StaticRpcDumpSerialization, i as dumpFunctions, l as StaticRpcDumpManifestQueryEntry, n as serializeDumpError, o as StaticRpcDumpCollection, p as collectStaticRpcDump, r as createClientFromDump, s as StaticRpcDumpFile, t as reviveDumpError, u as StaticRpcDumpManifestStaticEntry } from "../index-DH2sBIwd.mjs";
+import { a as getDefinitionsWithDumps, c as StaticRpcDumpManifest, d as StaticRpcDumpManifestValue, f as StaticRpcDumpSerialization, i as dumpFunctions, l as StaticRpcDumpManifestQueryEntry, n as serializeDumpError, o as StaticRpcDumpCollection, p as collectStaticRpcDump, r as createClientFromDump, s as StaticRpcDumpFile, t as reviveDumpError, u as StaticRpcDumpManifestStaticEntry } from "../index-DXHWuwJk.mjs";
 export { StaticRpcDumpCollection, StaticRpcDumpFile, StaticRpcDumpManifest, StaticRpcDumpManifestQueryEntry, StaticRpcDumpManifestStaticEntry, StaticRpcDumpManifestValue, StaticRpcDumpSerialization, collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError };

package/dist/rpc/dump.mjs

@@ -1,2 +1,2 @@
-import { a as dumpFunctions, c as serializeDumpError, i as createClientFromDump, o as getDefinitionsWithDumps, s as reviveDumpError, t as collectStaticRpcDump } from "../dump-9lKIJTLh.mjs";
+import { a as dumpFunctions, c as serializeDumpError, i as createClientFromDump, o as getDefinitionsWithDumps, s as reviveDumpError, t as collectStaticRpcDump } from "../dump-DoXkj4ku.mjs";
 export { collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError };

package/dist/rpc/index.d.mts

@@ -1,3 +1,3 @@
-import { C as RpcFunctionsCollector, S as RpcFunctionType, T as Thenable, _ as RpcFunctionDefinitionAny, a as RpcDefinitionsFilter, b as RpcFunctionDefinitionToFunction, c as RpcDumpClientOptions, d as RpcDumpGetter, f as RpcDumpRecord, g as RpcFunctionDefinition, h as RpcFunctionAgentOptions, i as RpcArgsSchema, l as RpcDumpCollectionOptions, m as RpcDumpStore, n as BirpcReturn, o as RpcDefinitionsToFunctions, p as RpcDumpRecordError, r as EntriesToObject, s as RpcDump, t as BirpcFn, u as RpcDumpDefinition, v as RpcFunctionDefinitionAnyWithContext, w as RpcReturnSchema, x as RpcFunctionSetupResult, y as RpcFunctionDefinitionBase } from "../types-BkkQ0Txg.mjs";
-import { C as RpcCacheManager, S as RpcFunctionsCollectorBase, _ as strictJsonStringify, a as StaticRpcDumpManifestStaticEntry, b as createDefineWrapperWithContext, c as collectStaticRpcDump, d as getDefinitionsWithDumps, f as reviveDumpError, g as STRUCTURED_CLONE_PREFIX, h as validateDefinitions, i as StaticRpcDumpManifestQueryEntry, l as createClientFromDump, m as validateDefinition, n as StaticRpcDumpFile, o as StaticRpcDumpManifestValue, p as serializeDumpError, r as StaticRpcDumpManifest, s as StaticRpcDumpSerialization, t as StaticRpcDumpCollection, u as dumpFunctions, v as getRpcHandler, w as RpcCacheOptions, x as defineRpcFunction, y as getRpcResolvedSetupResult } from "../index-C7M1hnvL.mjs";
-export { BirpcFn, BirpcReturn, EntriesToObject, RpcArgsSchema, RpcCacheManager, RpcCacheOptions, RpcDefinitionsFilter, RpcDefinitionsToFunctions, RpcDump, RpcDumpClientOptions, RpcDumpCollectionOptions, RpcDumpDefinition, RpcDumpGetter, RpcDumpRecord, RpcDumpRecordError, RpcDumpStore, RpcFunctionAgentOptions, RpcFunctionDefinition, RpcFunctionDefinitionAny, RpcFunctionDefinitionAnyWithContext, RpcFunctionDefinitionBase, RpcFunctionDefinitionToFunction, RpcFunctionSetupResult, RpcFunctionType, RpcFunctionsCollector, RpcFunctionsCollectorBase, RpcReturnSchema, STRUCTURED_CLONE_PREFIX, StaticRpcDumpCollection, StaticRpcDumpFile, StaticRpcDumpManifest, StaticRpcDumpManifestQueryEntry, StaticRpcDumpManifestStaticEntry, StaticRpcDumpManifestValue, StaticRpcDumpSerialization, Thenable, collectStaticRpcDump, createClientFromDump, createDefineWrapperWithContext, defineRpcFunction, dumpFunctions, getDefinitionsWithDumps, getRpcHandler, getRpcResolvedSetupResult, reviveDumpError, serializeDumpError, strictJsonStringify, validateDefinition, validateDefinitions };
+import { C as RpcFunctionType, E as Thenable, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinition, a as RpcDefinitionsFilter, b as RpcFunctionDefinitionBase, c as RpcDump, d as RpcDumpDefinition, f as RpcDumpGetter, g as RpcFunctionAgentOptions, h as RpcDumpStore, i as RpcArgsSchema, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, p as RpcDumpRecord, r as EntriesToObject, s as RpcDefinitionsToFunctionsWithNamespace, t as BirpcFn, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny, w as RpcFunctionsCollector, x as RpcFunctionDefinitionToFunction, y as RpcFunctionDefinitionAnyWithContext } from "../types-DZEx4ffs.mjs";
+import { C as RpcCacheManager, S as RpcFunctionsCollectorBase, _ as strictJsonStringify, a as StaticRpcDumpManifestStaticEntry, b as createDefineWrapperWithContext, c as collectStaticRpcDump, d as getDefinitionsWithDumps, f as reviveDumpError, g as STRUCTURED_CLONE_PREFIX, h as validateDefinitions, i as StaticRpcDumpManifestQueryEntry, l as createClientFromDump, m as validateDefinition, n as StaticRpcDumpFile, o as StaticRpcDumpManifestValue, p as serializeDumpError, r as StaticRpcDumpManifest, s as StaticRpcDumpSerialization, t as StaticRpcDumpCollection, u as dumpFunctions, v as getRpcHandler, w as RpcCacheOptions, x as defineRpcFunction, y as getRpcResolvedSetupResult } from "../index-CxaPKDXX.mjs";
+export { BirpcFn, BirpcReturn, EntriesToObject, RpcArgsSchema, RpcCacheManager, RpcCacheOptions, RpcDefinitionsFilter, RpcDefinitionsToFunctions, RpcDefinitionsToFunctionsWithNamespace, RpcDump, RpcDumpClientOptions, RpcDumpCollectionOptions, RpcDumpDefinition, RpcDumpGetter, RpcDumpRecord, RpcDumpRecordError, RpcDumpStore, RpcFunctionAgentOptions, RpcFunctionDefinition, RpcFunctionDefinitionAny, RpcFunctionDefinitionAnyWithContext, RpcFunctionDefinitionBase, RpcFunctionDefinitionToFunction, RpcFunctionSetupResult, RpcFunctionType, RpcFunctionsCollector, RpcFunctionsCollectorBase, RpcReturnSchema, STRUCTURED_CLONE_PREFIX, StaticRpcDumpCollection, StaticRpcDumpFile, StaticRpcDumpManifest, StaticRpcDumpManifestQueryEntry, StaticRpcDumpManifestStaticEntry, StaticRpcDumpManifestValue, StaticRpcDumpSerialization, Thenable, collectStaticRpcDump, createClientFromDump, createDefineWrapperWithContext, defineRpcFunction, dumpFunctions, getDefinitionsWithDumps, getRpcHandler, getRpcResolvedSetupResult, reviveDumpError, serializeDumpError, strictJsonStringify, validateDefinition, validateDefinitions };

package/dist/rpc/index.mjs

@@ -1,7 +1,7 @@
-import { a as dumpFunctions$1, c as serializeDumpError$1, d as hash, i as createClientFromDump$1, l as validateDefinition, n as getRpcHandler, o as getDefinitionsWithDumps$1, r as getRpcResolvedSetupResult, s as reviveDumpError$1, t as collectStaticRpcDump$1, u as validateDefinitions } from "../dump-9lKIJTLh.mjs";
-import { t as diagnostics } from "../diagnostics-GitRGKbr.mjs";
-import { n as defineRpcFunction, t as createDefineWrapperWithContext } from "../define-CW9gLnyG.mjs";
-import { n as strictJsonStringify, t as STRUCTURED_CLONE_PREFIX } from "../serialization-BD_qXGjd.mjs";
+import { a as dumpFunctions$1, c as serializeDumpError$1, d as hash, i as createClientFromDump$1, l as validateDefinition, n as getRpcHandler, o as getDefinitionsWithDumps$1, r as getRpcResolvedSetupResult, s as reviveDumpError$1, t as collectStaticRpcDump$1, u as validateDefinitions } from "../dump-DoXkj4ku.mjs";
+import { t as diagnostics } from "../diagnostics-BXwBQmoN.mjs";
+import { n as defineRpcFunction, t as createDefineWrapperWithContext } from "../define-BLWPsH6y.mjs";
+import { n as strictJsonStringify, t as STRUCTURED_CLONE_PREFIX } from "../serialization-DpLXCy13.mjs";
 //#region src/rpc/cache.ts
 /**
 * @experimental API is expected to change.

package/dist/rpc/transports/ws-client.d.mts

@@ -1,2 +1,2 @@
-import { n as createWsRpcChannel, t as WsRpcChannelOptions } from "../../ws-client-CVYX9niP.mjs";
+import { n as createWsRpcChannel, t as WsRpcChannelOptions } from "../../ws-client-D0z0pOhn.mjs";
 export { WsRpcChannelOptions, createWsRpcChannel };

package/dist/rpc/transports/ws-client.mjs

@@ -1,5 +1,5 @@
-import { n as strictJsonStringify } from "../../serialization-BD_qXGjd.mjs";
-import { n as structuredCloneStringify, t as structuredCloneParse } from "../../structured-clone-jegjz0hM.mjs";
+import { n as strictJsonStringify } from "../../serialization-DpLXCy13.mjs";
+import { n as structuredCloneStringify, t as structuredCloneParse } from "../../structured-clone-XpHLZ8nr.mjs";
 //#region src/rpc/transports/ws-client.ts
 function NOOP() {}
 const EMPTY_DEFS = /* @__PURE__ */ new Map();

package/dist/rpc/transports/ws-server.d.mts

@@ -1,2 +1,2 @@
-import { n as WsRpcTransportOptions, r as attachWsRpcTransport, t as DevframeNodeRpcSessionMeta } from "../../ws-server-C1LjmRnp.mjs";
-export { DevframeNodeRpcSessionMeta, WsRpcTransportOptions, attachWsRpcTransport };
+import { a as isAllowedOrigin, i as attachWsRpcTransport, n as WsRpcTransport, o as isLoopbackHostname, r as WsRpcTransportOptions, t as DevframeNodeRpcSessionMeta } from "../../ws-server-Bc2wBHl-.mjs";
+export { DevframeNodeRpcSessionMeta, WsRpcTransport, WsRpcTransportOptions, attachWsRpcTransport, isAllowedOrigin, isLoopbackHostname };

package/dist/rpc/transports/ws-server.mjs

@@ -1,74 +1,167 @@
-import { n as strictJsonStringify } from "../../serialization-BD_qXGjd.mjs";
-import { n as structuredCloneStringify, t as structuredCloneParse } from "../../structured-clone-jegjz0hM.mjs";
-import { createServer } from "node:https";
-import { WebSocketServer } from "ws";
+import { n as strictJsonStringify } from "../../serialization-DpLXCy13.mjs";
+import { n as structuredCloneStringify, t as structuredCloneParse } from "../../structured-clone-XpHLZ8nr.mjs";
+import { createServer } from "node:http";
+import { createServer as createServer$1 } from "node:https";
+import crossws from "crossws/adapters/node";
 //#region src/rpc/transports/ws-server.ts
 let sessionId = 0;
 const EMPTY_DEFS = /* @__PURE__ */ new Map();
 function NOOP() {}
+/** Compare two URL paths ignoring a trailing slash. */
+function pathMatches(a, b) {
+	const strip = (p) => p.length > 1 && p.endsWith("/") ? p.slice(0, -1) : p;
+	return strip(a) === strip(b);
+}
+function isLoopbackHostname(hostname) {
+	const h = hostname.replace(/^\[|\]$/g, "");
+	return h === "localhost" || h === "127.0.0.1" || h === "::1" || h.endsWith(".localhost") || h.startsWith("127.");
+}
 /**
-* Attach a WebSocket transport to an existing RPC group. Either pass an
-* existing `WebSocketServer` via `wss`, or let this helper create one from
-* `port` / `host` / `https`.
+* Default origin policy for a localhost dev tool: allow requests with no
+* `Origin` header (native, non-browser clients), allow any loopback origin
+* (so cross-port localhost dev setups keep working), and allow explicitly
+* configured origins. Everything else — a real remote page in the dev's
+* browser — is rejected.
 */
-function attachWsRpcTransport(rpcGroup, options = {}) {
-	const { wss: externalWss, port, host = "localhost", https, onConnected = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS, serialize: serializeOverride, deserialize: deserializeOverride } = options;
-	let wss;
-	if (externalWss) wss = externalWss;
-	else if (https) {
-		const httpsServer = createServer(https);
-		wss = new WebSocketServer({ server: httpsServer });
-		httpsServer.listen(port, host);
-	} else wss = new WebSocketServer({
-		port,
-		host
-	});
-	wss.on("connection", (ws, req) => {
-		const meta = {
-			id: sessionId++,
-			ws,
-			subscribedStates: /* @__PURE__ */ new Set()
-		};
-		const pendingRequestMethods = /* @__PURE__ */ new Map();
-		const channel = {
-			post: (data) => {
-				ws.send(data);
-			},
-			on: (fn) => {
-				ws.on("message", (data) => {
-					fn(data.toString());
-				});
-			},
-			serialize: serializeOverride ?? ((msg) => {
-				let method;
-				if (msg.t === "q") method = msg.m;
-				else {
-					method = pendingRequestMethods.get(msg.i);
-					pendingRequestMethods.delete(msg.i);
+function isAllowedOrigin(origin, allowedOrigins) {
+	if (!origin) return true;
+	if (allowedOrigins.includes(origin)) return true;
+	try {
+		return isLoopbackHostname(new URL(origin).hostname);
+	} catch {
+		return false;
+	}
+}
+/**
+* Route `upgrade` events on a server to the crossws adapter, optionally
+* filtered to a single `path`. Non-matching requests are left untouched so
+* other upgrade listeners (e.g. a Vite dev server's HMR socket) can claim
+* them, unless `destroyUnmatched` is set. Returns a detach function that
+* removes the listener.
+*/
+function routeUpgrades(server, ws, path, destroyUnmatched, allowedOrigins) {
+	const listener = (req, socket, head) => {
+		socket.on("error", () => {});
+		if (path) {
+			let pathname = req.url ?? "/";
+			try {
+				pathname = new URL(req.url ?? "/", "http://localhost").pathname;
+			} catch {}
+			if (!pathMatches(pathname, path)) {
+				if (destroyUnmatched) {
+					socket.write("HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n");
+					socket.destroy();
 				}
-				if (!(msg.t === "s" && "e" in msg) && !!method && definitions.get(method)?.jsonSerializable === true) return strictJsonStringify(msg, method ?? "");
-				return `s:${structuredCloneStringify(msg)}`;
-			}),
-			deserialize: deserializeOverride ?? ((raw) => {
-				const msg = raw.startsWith("s:") ? structuredCloneParse(raw.slice(2)) : JSON.parse(raw);
-				if (msg.t === "q" && msg.i && msg.m) pendingRequestMethods.set(msg.i, msg.m);
-				return msg;
-			}),
-			meta
-		};
-		rpcGroup.updateChannels((channels) => {
-			channels.push(channel);
-		});
-		ws.on("close", () => {
+				return;
+			}
+		}
+		if (allowedOrigins !== false && !isAllowedOrigin(req.headers.origin, allowedOrigins ?? [])) {
+			socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+			socket.destroy();
+			return;
+		}
+		ws.handleUpgrade(req, socket, head);
+	};
+	server.on("upgrade", listener);
+	return () => server.off("upgrade", listener);
+}
+/**
+* Attach a WebSocket transport to an existing RPC group, powered by
+* [crossws](https://crossws.h3.dev). Either attach to an existing HTTP(S)
+* `server` (sharing its port, optionally scoped to a `path`), or let this
+* helper create a standalone server from `port` / `host` / `https`.
+*
+* Returns the crossws node adapter plus `detach` (remove the upgrade
+* listener from a shared `server`) and `close` (full deterministic
+* teardown).
+*/
+function attachWsRpcTransport(rpcGroup, options = {}) {
+	const { server, port, host = "localhost", path, destroyUnmatched = false, https, allowedOrigins, onConnected = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS, serialize: serializeOverride, deserialize: deserializeOverride } = options;
+	const states = /* @__PURE__ */ new WeakMap();
+	const ws = crossws({ hooks: {
+		open: (peer) => {
+			const meta = {
+				id: sessionId++,
+				peer,
+				subscribedStates: /* @__PURE__ */ new Set()
+			};
+			const pendingRequestMethods = /* @__PURE__ */ new Map();
+			const state = {
+				meta,
+				channel: void 0
+			};
+			const channel = {
+				post: (data) => {
+					peer.send(data);
+				},
+				on: (fn) => {
+					state.onMessage = fn;
+				},
+				serialize: serializeOverride ?? ((msg) => {
+					let method;
+					if (msg.t === "q") method = msg.m;
+					else {
+						method = pendingRequestMethods.get(msg.i);
+						pendingRequestMethods.delete(msg.i);
+					}
+					if (!(msg.t === "s" && "e" in msg) && !!method && definitions.get(method)?.jsonSerializable === true) return strictJsonStringify(msg, method ?? "");
+					return `s:${structuredCloneStringify(msg)}`;
+				}),
+				deserialize: deserializeOverride ?? ((raw) => {
+					const msg = raw.startsWith("s:") ? structuredCloneParse(raw.slice(2)) : JSON.parse(raw);
+					if (msg.t === "q" && msg.i && msg.m) pendingRequestMethods.set(msg.i, msg.m);
+					return msg;
+				}),
+				meta
+			};
+			state.channel = channel;
+			states.set(peer, state);
 			rpcGroup.updateChannels((channels) => {
-				const index = channels.indexOf(channel);
+				channels.push(channel);
+			});
+			onConnected(peer, meta);
+		},
+		message: (peer, message) => {
+			states.get(peer)?.onMessage?.(message.text());
+		},
+		close: (peer) => {
+			const state = states.get(peer);
+			if (!state) return;
+			states.delete(peer);
+			rpcGroup.updateChannels((channels) => {
+				const index = channels.indexOf(state.channel);
 				if (index >= 0) channels.splice(index, 1);
 			});
-			onDisconnected(ws, meta);
+			onDisconnected(peer, state.meta);
+		}
+	} });
+	let detach = NOOP;
+	let ownedServer;
+	if (server) detach = routeUpgrades(server, ws, path, destroyUnmatched, allowedOrigins);
+	else if (https) {
+		ownedServer = createServer$1(https);
+		detach = routeUpgrades(ownedServer, ws, path, true, allowedOrigins);
+		ownedServer.listen(port, host);
+	} else {
+		ownedServer = createServer((_req, res) => {
+			res.writeHead(426, { "content-type": "text/plain" });
+			res.end("Upgrade Required");
 		});
-		onConnected(ws, req, meta);
-	});
-	return { wss };
+		detach = routeUpgrades(ownedServer, ws, path, true, allowedOrigins);
+		ownedServer.listen(port, host);
+	}
+	return {
+		ws,
+		detach,
+		async close() {
+			detach();
+			ws.closeAll(void 0, void 0, true);
+			if (ownedServer) {
+				const srv = ownedServer;
+				await new Promise((r) => srv.close(() => r()));
+			}
+		}
+	};
 }
 //#endregion
-export { attachWsRpcTransport };
+export { attachWsRpcTransport, isAllowedOrigin, isLoopbackHostname };

package/dist/{serialization-BD_qXGjd.mjs → serialization-DpLXCy13.mjs}

@@ -1,4 +1,4 @@
-import { t as diagnostics } from "./diagnostics-GitRGKbr.mjs";
+import { t as diagnostics } from "./diagnostics-BXwBQmoN.mjs";
 //#region src/rpc/serialization.ts
 /**
 * Wire format used by the WS RPC transport.

package/dist/{server-BBaBJaUL.mjs → server-Dl6TU5LE.mjs}

@@ -1,9 +1,8 @@
 import { createRpcServer } from "./rpc/server.mjs";
 import { attachWsRpcTransport } from "./rpc/transports/ws-server.mjs";
-import { t as getInternalContext } from "./context-DaKmhhHY.mjs";
-import { WebSocketServer } from "ws";
-import { AsyncLocalStorage } from "node:async_hooks";
+import { t as getInternalContext } from "./context-3x_bgBgZ.mjs";
 import { createServer } from "node:http";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { H3, toNodeHandler } from "h3";
 //#region src/node/server.ts
 /**
@@ -15,8 +14,8 @@ async function startHttpAndWs(options) {
 	const { context, port } = options;
 	const bindHost = options.host ?? "localhost";
 	const app = options.app ?? new H3();
-	const httpServer = createServer(toNodeHandler(app));
-	const wss = new WebSocketServer({ server: httpServer });
+	const ownsHttpServer = !options.server;
+	const httpServer = options.server ?? createServer(toNodeHandler(app));
 	const rpcHost = context.rpc;
 	const asyncStorage = new AsyncLocalStorage();
 	const rpcGroup = createRpcServer(rpcHost.functions, { rpcOptions: { resolver(name, fn) {
@@ -31,9 +30,16 @@ async function startHttpAndWs(options) {
 			});
 		};
 	} } });
-	attachWsRpcTransport(rpcGroup, {
-		wss,
-		onDisconnected: (_ws, meta) => {
+	const separateWsPort = ownsHttpServer && options.wsPort != null && options.wsPort !== port ? options.wsPort : void 0;
+	const { ws, close: closeWs } = attachWsRpcTransport(rpcGroup, {
+		...separateWsPort != null ? {
+			port: separateWsPort,
+			host: bindHost
+		} : { server: httpServer },
+		path: options.path,
+		destroyUnmatched: ownsHttpServer,
+		allowedOrigins: options.allowedOrigins,
+		onDisconnected: (_peer, meta) => {
 			rpcHost._emitSessionDisconnected(meta);
 		}
 	});
@@ -49,14 +55,14 @@ async function startHttpAndWs(options) {
 			return { isTrusted: true };
 		}
 	});
-	await new Promise((resolveListen) => {
+	if (ownsHttpServer) await new Promise((resolveListen) => {
 		httpServer.listen(port, bindHost, () => resolveListen());
 	});
 	const address = httpServer.address();
 	const resolvedPort = typeof address === "object" && address ? address.port : port;
 	const origin = `http://${bindHost}:${resolvedPort}`;
 	const internal = getInternalContext(context);
-	const wsUrl = origin.replace(/^http/, "ws");
+	const wsUrl = `ws://${bindHost}:${separateWsPort ?? resolvedPort}${options.path ?? ""}`;
 	internal.wsEndpoint = { url: wsUrl };
 	if (options.onReady) await options.onReady({
 		origin,
@@ -67,12 +73,11 @@ async function startHttpAndWs(options) {
 		origin,
 		port: resolvedPort,
 		app,
-		wss,
+		ws,
 		rpcGroup,
 		async close() {
-			for (const ws of wss.clients) ws.terminate();
-			await new Promise((r) => wss.close(() => r()));
-			await new Promise((r) => httpServer.close(() => r()));
+			await closeWs();
+			if (ownsHttpServer) await new Promise((r) => httpServer.close(() => r()));
 			if (getInternalContext(context).wsEndpoint?.url === wsUrl) getInternalContext(context).wsEndpoint = void 0;
 		}
 	};

package/dist/server-rX781kz-.d.mts

@@ -0,0 +1,90 @@
+import { it as DevframeRpcServerFunctions, m as DevframeNodeContext, rt as DevframeRpcClientFunctions } from "./devframe-D-gr9sBx.mjs";
+import { BirpcGroup } from "birpc";
+import { NodeAdapter } from "crossws/adapters/node";
+import { Server } from "node:http";
+import { H3 } from "h3";
+
+//#region src/node/server.d.ts
+interface StartHttpAndWsOptions {
+  context: DevframeNodeContext;
+  host?: string;
+  port: number;
+  /**
+   * Optional h3 app to mount on. When omitted a fresh one is created;
+   * when provided, callers can add their own routes (static handlers,
+   * auth middleware, etc.) first.
+   */
+  app?: H3;
+  /**
+   * Bind the WS endpoint to a single upgrade route (e.g. `/__devframe_ws`) instead of
+   * claiming every upgrade on the port. This lets the socket share a server
+   * with other upgrade handlers (Vite HMR, a host framework's own sockets)
+   * and is what the SPA's `__connection.json` points at. When omitted, the WS
+   * server handles every upgrade on the port (legacy behaviour).
+   */
+  path?: string;
+  /**
+   * Bind the WS endpoint on its own port instead of sharing the HTTP server's.
+   * The HTTP/SPA server still listens on `port`; the socket gets a dedicated
+   * `ws` server on `wsPort` (same `host`). Use this for the "different port"
+   * connection scenario. Ignored when a `server` is supplied.
+   */
+  wsPort?: number;
+  /**
+   * Mount the WS endpoint onto an existing HTTP server, sharing its port,
+   * rather than creating and listening on a fresh one. Use this to embed
+   * devframe's RPC socket inside a host server (e.g. a Vite dev server) — pair
+   * it with `path` so it coexists with the host's routes. The caller owns the
+   * server's lifecycle: {@link StartedServer.close} detaches devframe's upgrade
+   * listener but leaves the host server running. When set, `host`/`port` are
+   * only used to report the resolved origin.
+   */
+  server?: Server;
+  /**
+   * When `false`, the RPC server is started without a trust handshake.
+   * Intended for single-user localhost tools where an auth round-trip
+   * would only get in the way. The Vite-flavoured auth layer in
+   * `@vitejs/devtools` already honors the equivalent
+   * `devtools.clientAuth` setting; devframe records the intent here so
+   * future auth plumbing can consult it without another API change.
+   *
+   * Default: `true`.
+   */
+  auth?: boolean;
+  /**
+   * Extra origins to accept on the WS upgrade beyond the loopback default
+   * (`localhost`/`127.0.0.1`/`::1` and any `Origin`-less request from a
+   * native client). Add your LAN/tunnel origin here when reaching the tool
+   * from another host. Pass `false` to disable origin checking entirely
+   * (not recommended). Default: loopback-only.
+   */
+  allowedOrigins?: readonly string[] | false;
+  /**
+   * Called once the WS server is bound so callers can mount static
+   * handlers whose origin depends on the resolved port, or print their
+   * own startup banner. Devframe does not print one itself.
+   */
+  onReady?: (info: {
+    origin: string;
+    port: number;
+    app: H3;
+  }) => void | Promise<void>;
+}
+interface StartedServer {
+  /** Listening origin, e.g. `http://localhost:9999`. */
+  origin: string;
+  port: number;
+  app: H3;
+  /** The crossws node adapter driving the RPC socket (connected peers, pub/sub). */
+  ws: NodeAdapter;
+  rpcGroup: BirpcGroup<DevframeRpcClientFunctions, DevframeRpcServerFunctions, false>;
+  close: () => Promise<void>;
+}
+/**
+ * Compose an h3 + WebSocket server for a devframe context. The RPC
+ * group is bound to `context.rpc.functions`; the WS endpoint lives on
+ * the same port as the HTTP server.
+ */
+declare function startHttpAndWs(options: StartHttpAndWsOptions): Promise<StartedServer>;
+//#endregion
+export { StartedServer as n, startHttpAndWs as r, StartHttpAndWsOptions as t };