devframe 0.5.4 → 0.6.0-beta.2

package/dist/{shared-state-u0y123fi.mjs → shared-state-D4PPieA0.mjs}

@@ -836,10 +836,10 @@ function enablePatches() {
 				const parentType = getArchtype(base);
 				let p = path[i];
 				if (typeof p !== "string" && typeof p !== "number") p = "" + p;
-				if ((parentType === 0 || parentType === 1) && (p === "__proto__" || p === CONSTRUCTOR)) die(errorOffset + 3);
-				if (isFunction(base) && p === PROTOTYPE) die(errorOffset + 3);
+				if ((parentType === 0 || parentType === 1) && (p === "__proto__" || p === CONSTRUCTOR)) die(19);
+				if (isFunction(base) && p === PROTOTYPE) die(19);
 				base = get(base, p);
-				if (!isObjectish(base)) die(errorOffset + 2, path.join("/"));
+				if (!isObjectish(base)) die(18, path.join("/"));
 			}
 			const type = getArchtype(base);
 			const value = deepClonePatchValue(patch.value);
@@ -862,7 +862,7 @@ function enablePatches() {
 					case 3: return base.delete(patch.value);
 					default: return delete base[key];
 				}
-				default: die(errorOffset + 1, op);
+				default: die(17, op);
 			}
 		});
 		return draft;

package/dist/{shared-state-BlBNYziY.mjs → storage-l2ezeend.mjs}

@@ -1,5 +1,8 @@
-import { t as devframeReporter } from "./diagnostics-reporter-CBBZwoMv.mjs";
+import { t as devframeReporter } from "./diagnostics-reporter-CsIG85Q5.mjs";
 import { defineDiagnostics } from "nostics";
+import fs from "node:fs";
+import { dirname } from "pathe";
+import { destr } from "destr";
 //#region src/node/diagnostics.ts
 const diagnostics = defineDiagnostics({
 	docsBase: "https://devfra.me/errors",
@@ -39,6 +42,10 @@ const diagnostics = defineDiagnostics({
 		DF0033: {
 			why: (p) => `Failed to start dev RPC bridge for "${p.id}": ${p.reason}`,
 			fix: "Verify the bridge port is free and the devframe setup function does not throw. Pin a port via `cli.port` / `cli.portRange` on the definition, or via `devMiddleware.port` on `viteDevBridge`."
+		},
+		DF0034: {
+			why: (p) => `Scoped RPC registration for namespace "${p.namespace}" received an already-namespaced function name "${p.name}".`,
+			fix: "A scoped context auto-namespaces ids. Pass a bare name without a \":\" separator (e.g. `register({ name: \"get-cwd\" })`), or use the unscoped `ctx.base.rpc.register` for a fully-qualified name."
 		}
 	}
 });
@@ -918,10 +925,10 @@ function enablePatches() {
 				const parentType = getArchtype(base);
 				let p = path[i];
 				if (typeof p !== "string" && typeof p !== "number") p = "" + p;
-				if ((parentType === 0 || parentType === 1) && (p === "__proto__" || p === CONSTRUCTOR)) die(errorOffset + 3);
-				if (isFunction(base) && p === PROTOTYPE) die(errorOffset + 3);
+				if ((parentType === 0 || parentType === 1) && (p === "__proto__" || p === CONSTRUCTOR)) die(19);
+				if (isFunction(base) && p === PROTOTYPE) die(19);
 				base = get(base, p);
-				if (!isObjectish(base)) die(errorOffset + 2, path.join("/"));
+				if (!isObjectish(base)) die(18, path.join("/"));
 			}
 			const type = getArchtype(base);
 			const value = deepClonePatchValue(patch.value);
@@ -944,7 +951,7 @@ function enablePatches() {
 					case 3: return base.delete(patch.value);
 					default: return delete base[key];
 				}
-				default: die(errorOffset + 1, op);
+				default: die(17, op);
 			}
 		});
 		return draft;
@@ -1016,4 +1023,119 @@ function createSharedState(options) {
 	};
 }
 //#endregion
-export { diagnostics as i, nanoid as n, createEventEmitter as r, createSharedState as t };
+//#region ../../node_modules/.pnpm/perfect-debounce@2.1.0/node_modules/perfect-debounce/dist/index.mjs
+const DEBOUNCE_DEFAULTS = { trailing: true };
+/**
+Debounce functions
+@param fn - Promise-returning/async function to debounce.
+@param wait - Milliseconds to wait before calling `fn`. Default value is 25ms
+@returns A function that delays calling `fn` until after `wait` milliseconds have elapsed since the last time it was called.
+@example
+```
+import { debounce } from 'perfect-debounce';
+const expensiveCall = async input => input;
+const debouncedFn = debounce(expensiveCall, 200);
+for (const number of [1, 2, 3]) {
+console.log(await debouncedFn(number));
+}
+//=> 1
+//=> 2
+//=> 3
+```
+*/
+function debounce(fn, wait = 25, options = {}) {
+	options = {
+		...DEBOUNCE_DEFAULTS,
+		...options
+	};
+	if (!Number.isFinite(wait)) throw new TypeError("Expected `wait` to be a finite number");
+	let leadingValue;
+	let timeout;
+	let resolveList = [];
+	let currentPromise;
+	let trailingArgs;
+	const applyFn = (_this, args) => {
+		currentPromise = _applyPromised(fn, _this, args);
+		currentPromise.finally(() => {
+			currentPromise = null;
+			if (options.trailing && trailingArgs && !timeout) {
+				const promise = applyFn(_this, trailingArgs);
+				trailingArgs = null;
+				return promise;
+			}
+		});
+		return currentPromise;
+	};
+	const debounced = function(...args) {
+		if (options.trailing) trailingArgs = args;
+		if (currentPromise) return currentPromise;
+		return new Promise((resolve) => {
+			const shouldCallNow = !timeout && options.leading;
+			clearTimeout(timeout);
+			timeout = setTimeout(() => {
+				timeout = null;
+				const promise = options.leading ? leadingValue : applyFn(this, args);
+				trailingArgs = null;
+				for (const _resolve of resolveList) _resolve(promise);
+				resolveList = [];
+			}, wait);
+			if (shouldCallNow) {
+				leadingValue = applyFn(this, args);
+				resolve(leadingValue);
+			} else resolveList.push(resolve);
+		});
+	};
+	const _clearTimeout = (timer) => {
+		if (timer) {
+			clearTimeout(timer);
+			timeout = null;
+		}
+	};
+	debounced.isPending = () => !!timeout;
+	debounced.cancel = () => {
+		_clearTimeout(timeout);
+		resolveList = [];
+		trailingArgs = null;
+	};
+	debounced.flush = () => {
+		_clearTimeout(timeout);
+		if (!trailingArgs || currentPromise) return;
+		const args = trailingArgs;
+		trailingArgs = null;
+		return applyFn(this, args);
+	};
+	return debounced;
+}
+async function _applyPromised(fn, _this, args) {
+	return await fn.apply(_this, args);
+}
+//#endregion
+//#region src/node/storage.ts
+function createStorage(options) {
+	const { mergeInitialValue = (initialValue, savedValue) => ({
+		...initialValue,
+		...savedValue
+	}), debounce: debounceTime = 100 } = options;
+	let initialValue = options.initialValue;
+	if (fs.existsSync(options.filepath)) try {
+		const savedValue = destr(fs.readFileSync(options.filepath, "utf-8"), { strict: true });
+		initialValue = mergeInitialValue ? mergeInitialValue(options.initialValue, savedValue) : savedValue;
+	} catch (error) {
+		diagnostics.DF0012({
+			filepath: options.filepath,
+			cause: error
+		}, { method: "warn" });
+		initialValue = options.initialValue;
+	}
+	const state = createSharedState({
+		initialValue,
+		enablePatches: false
+	});
+	state.on("updated", debounce((newState) => {
+		fs.mkdirSync(dirname(options.filepath), { recursive: true });
+		fs.writeFileSync(options.filepath, `${JSON.stringify(newState, null, 2)}\n`);
+	}, debounceTime));
+	return state;
+}
+//#endregion
+export { diagnostics as a, createEventEmitter as i, createSharedState as n, nanoid as r, createStorage as t };

package/dist/types/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as AgentResource, B as EntriesToObject, G as DevframeRpcSharedStates, H as Thenable, J as DevframeDiagnosticsDefinition, K as DevframeHost, Q as AgentManifest, U as DevframeRpcClientFunctions, V as PartialWithoutId, W as DevframeRpcServerFunctions, X as DevframeDiagnosticsLogger, Y as DevframeDiagnosticsHost, Z as AgentHandle, _ as RpcStreamingChannel, a as DevframeRuntime, at as DevframeAgentHostEvents, c as defineDevframe, ct as EventsMap, d as DevframeNodeContext, et as AgentResourceContent, f as DevframeNodeRpcSession, g as RpcSharedStateHost, h as RpcSharedStateGetOptions, i as DevframeDeploymentKind, it as DevframeAgentHost, l as ConnectionMeta, m as RpcFunctionsHost, n as DevframeCliOptions, nt as AgentTool, o as DevframeSetupInfo, ot as EventEmitter, p as RpcBroadcastOptions, q as DevframeDefineDiagnosticsOptions, r as DevframeDefinition, rt as AgentToolInput, s as DevframeSpaOptions, st as EventUnsubscribe, t as DevframeBrowserContext, tt as AgentResourceInput, u as DevframeCapabilities, v as RpcStreamingChannelOptions, y as RpcStreamingHost, z as DevframeViewHost } from "../devframe-BuR6n9ZD.mjs";
-import { h as RpcFunctionAgentOptions } from "../types-BkkQ0Txg.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "../ws-server-C1LjmRnp.mjs";
-export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeSetupInfo, DevframeSpaOptions, DevframeViewHost, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, PartialWithoutId, RpcBroadcastOptions, RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, Thenable, defineDevframe };
+import { $ as ScopedServerFunctions, G as DevframeScopedNodeContext, H as EntriesToObject, J as DevframeSettings, K as DevframeScopedNodeRpc, Q as ScopedClientFunctions, S as RpcStreamingHost, St as EventsMap, U as PartialWithoutId, W as Thenable, X as DevframeSettingsStore, Y as DevframeSettingsRegistry, Z as ScopedBroadcastOptions, _ as RpcFunctionsHost, _t as AgentToolInput, a as DevframeDuplicationStrategy, at as DevframeRpcSharedStates, b as RpcStreamingChannel, bt as EventEmitter, c as DevframeSpaOptions, ct as DevframeDiagnosticsDefinition, d as ConnectionMeta, dt as AgentHandle, et as ScopedSharedStates, f as ConnectionMetaWebsocket, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, i as DevframeDeploymentKind, it as DevframeRpcServerFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsHost, m as DevframeNodeContext, mt as AgentResourceContent, n as DevframeCliOptions, nt as DevframeViewHost, o as DevframeRuntime, ot as DevframeHost, p as DevframeCapabilities, pt as AgentResource, q as DevframeScopedStreamingHost, r as DevframeDefinition, rt as DevframeRpcClientFunctions, s as DevframeSetupInfo, st as DevframeDefineDiagnosticsOptions, t as DevframeBrowserContext, tt as SettingsForNamespace, u as defineDevframe, ut as DevframeDiagnosticsLogger, v as RpcSharedStateGetOptions, vt as DevframeAgentHost, x as RpcStreamingChannelOptions, xt as EventUnsubscribe, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "../devframe-D-gr9sBx.mjs";
+import { g as RpcFunctionAgentOptions } from "../types-DZEx4ffs.mjs";
+import { t as DevframeNodeRpcSessionMeta } from "../ws-server-Bc2wBHl-.mjs";
+export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, PartialWithoutId, RpcBroadcastOptions, RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe };

package/dist/{types-BkkQ0Txg.d.mts → types-DZEx4ffs.d.mts}

@@ -282,8 +282,16 @@ type RpcFunctionDefinitionToFunction<T extends RpcFunctionDefinitionAny> = T ext
 type RpcFunctionDefinitionAny = RpcFunctionDefinition<string, any, any, any, any, any, any>;
 type RpcFunctionDefinitionAnyWithContext<CONTEXT = undefined> = RpcFunctionDefinition<string, any, any, any, any, any, CONTEXT>;
 type RpcDefinitionsToFunctions<T extends readonly RpcFunctionDefinitionAny[]> = EntriesToObject<{ [K in keyof T]: [T[K]['name'], RpcFunctionDefinitionToFunction<T[K]>] }>;
+/**
+ * Like {@link RpcDefinitionsToFunctions}, but prefixes every (bare)
+ * definition name with `<NS>:`. Use this when functions are defined with
+ * bare names and registered through a scoped context
+ * (`ctx.scope(NS).rpc.register(...)`), so the augmented registry keys
+ * match the namespaced ids stored at runtime.
+ */
+type RpcDefinitionsToFunctionsWithNamespace<NS extends string, T extends readonly RpcFunctionDefinitionAny[]> = EntriesToObject<{ [K in keyof T]: [`${NS}:${T[K]['name'] & string}`, RpcFunctionDefinitionToFunction<T[K]>] }>;
 type RpcDefinitionsFilter<T extends readonly RpcFunctionDefinitionAny[], Type extends RpcFunctionType> = { [K in keyof T]: T[K] extends {
   type: Type;
 } ? T[K] : never };
 //#endregion
-export { RpcFunctionsCollector as C, RpcFunctionType as S, Thenable as T, RpcFunctionDefinitionAny as _, RpcDefinitionsFilter as a, RpcFunctionDefinitionToFunction as b, RpcDumpClientOptions as c, RpcDumpGetter as d, RpcDumpRecord as f, RpcFunctionDefinition as g, RpcFunctionAgentOptions as h, RpcArgsSchema as i, RpcDumpCollectionOptions as l, RpcDumpStore as m, BirpcReturn$1 as n, RpcDefinitionsToFunctions as o, RpcDumpRecordError as p, EntriesToObject as r, RpcDump as s, BirpcFn as t, RpcDumpDefinition as u, RpcFunctionDefinitionAnyWithContext as v, RpcReturnSchema as w, RpcFunctionSetupResult as x, RpcFunctionDefinitionBase as y };
+export { RpcFunctionType as C, Thenable as E, RpcFunctionSetupResult as S, RpcReturnSchema as T, RpcFunctionDefinition as _, RpcDefinitionsFilter as a, RpcFunctionDefinitionBase as b, RpcDump as c, RpcDumpDefinition as d, RpcDumpGetter as f, RpcFunctionAgentOptions as g, RpcDumpStore as h, RpcArgsSchema as i, RpcDumpClientOptions as l, RpcDumpRecordError as m, BirpcReturn$1 as n, RpcDefinitionsToFunctions as o, RpcDumpRecord as p, EntriesToObject as r, RpcDefinitionsToFunctionsWithNamespace as s, BirpcFn as t, RpcDumpCollectionOptions as u, RpcFunctionDefinitionAny as v, RpcFunctionsCollector as w, RpcFunctionDefinitionToFunction as x, RpcFunctionDefinitionAnyWithContext as y };

package/dist/utils/crypto-token.d.mts

@@ -0,0 +1,24 @@
+//#region src/utils/crypto-token.d.ts
+/**
+ * Generate a high-entropy, URL-safe (hex) random token suitable for use as a
+ * bearer credential — e.g. the persistent client auth token or an ephemeral
+ * remote-dock token. Defaults to 16 bytes (128 bits) of entropy.
+ */
+declare function randomToken(byteLength?: number): string;
+/**
+ * Generate a uniformly-distributed string of decimal digits using rejection
+ * sampling to avoid modulo bias. Intended for short, human-typed one-time
+ * codes (e.g. a 6-digit authentication code). Leading zeros are preserved.
+ */
+declare function randomDigits(length: number): string;
+/**
+ * Constant-time string equality. Compares every character so the comparison
+ * time does not depend on the position of the first mismatch, mitigating
+ * timing side-channels when verifying secrets.
+ *
+ * Length is treated as public (it short-circuits on differing lengths), which
+ * is appropriate for fixed-length codes and tokens.
+ */
+declare function timingSafeEqual(a: string, b: string): boolean;
+//#endregion
+export { randomDigits, randomToken, timingSafeEqual };

package/dist/utils/crypto-token.mjs

@@ -0,0 +1,45 @@
+//#region src/utils/crypto-token.ts
+const HEX = "0123456789abcdef";
+/**
+* Generate a high-entropy, URL-safe (hex) random token suitable for use as a
+* bearer credential — e.g. the persistent client auth token or an ephemeral
+* remote-dock token. Defaults to 16 bytes (128 bits) of entropy.
+*/
+function randomToken(byteLength = 16) {
+	const bytes = new Uint8Array(byteLength);
+	globalThis.crypto.getRandomValues(bytes);
+	let out = "";
+	for (let i = 0; i < bytes.length; i++) out += HEX[bytes[i] >> 4] + HEX[bytes[i] & 15];
+	return out;
+}
+/**
+* Generate a uniformly-distributed string of decimal digits using rejection
+* sampling to avoid modulo bias. Intended for short, human-typed one-time
+* codes (e.g. a 6-digit authentication code). Leading zeros are preserved.
+*/
+function randomDigits(length) {
+	const limit = 250;
+	const buf = new Uint8Array(1);
+	let out = "";
+	while (out.length < length) {
+		globalThis.crypto.getRandomValues(buf);
+		if (buf[0] < limit) out += String(buf[0] % 10);
+	}
+	return out;
+}
+/**
+* Constant-time string equality. Compares every character so the comparison
+* time does not depend on the position of the first mismatch, mitigating
+* timing side-channels when verifying secrets.
+*
+* Length is treated as public (it short-circuits on differing lengths), which
+* is appropriate for fixed-length codes and tokens.
+*/
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let mismatch = 0;
+	for (let i = 0; i < a.length; i++) mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return mismatch === 0;
+}
+//#endregion
+export { randomDigits, randomToken, timingSafeEqual };

package/dist/utils/events.d.mts

@@ -1,4 +1,4 @@
-import { ct as EventsMap, ot as EventEmitter } from "../devframe-BuR6n9ZD.mjs";
+import { St as EventsMap, bt as EventEmitter } from "../devframe-D-gr9sBx.mjs";
 
 //#region src/utils/events.d.ts
 /**

package/dist/utils/hash.mjs

@@ -1,2 +1,2 @@
-import { t as hash } from "../hash-bwOD8RgU.mjs";
+import { t as hash } from "../hash-DFc5WwhO.mjs";
 export { hash };

package/dist/utils/launch-editor.mjs

@@ -1,2 +1,2 @@
-import { t as launchEditor } from "../launch-editor-BbNhtg7b.mjs";
+import { t as launchEditor } from "../launch-editor-DPfltGA4.mjs";
 export { launchEditor };

package/dist/utils/open.mjs

@@ -1,2 +1,2 @@
-import { t as open } from "../open-DiQn6zCH.mjs";
+import { t as open } from "../open-Dusa2Zzd.mjs";
 export { open };

package/dist/utils/scope.d.mts

@@ -0,0 +1,11 @@
+//#region src/utils/scope.d.ts
+/** Whether a name is already namespaced (contains a `:` separator). */
+declare function isQualifiedName(name: string): boolean;
+/**
+ * Prefix a bare name with `<namespace>:`. Names that already contain a
+ * `:` are returned unchanged, so callers can reference another scope's
+ * ids explicitly (e.g. `ctx.rpc.call('other-plugin:fn')`).
+ */
+declare function qualifyName(namespace: string, name: string): string;
+//#endregion
+export { isQualifiedName, qualifyName };

package/dist/utils/scope.mjs

@@ -0,0 +1,15 @@
+//#region src/utils/scope.ts
+/** Whether a name is already namespaced (contains a `:` separator). */
+function isQualifiedName(name) {
+	return name.includes(":");
+}
+/**
+* Prefix a bare name with `<namespace>:`. Names that already contain a
+* `:` are returned unchanged, so callers can reference another scope's
+* ids explicitly (e.g. `ctx.rpc.call('other-plugin:fn')`).
+*/
+function qualifyName(namespace, name) {
+	return isQualifiedName(name) ? name : `${namespace}:${name}`;
+}
+//#endregion
+export { isQualifiedName, qualifyName };

package/dist/utils/shared-state.d.mts

@@ -1,2 +1,2 @@
-import { A as ImmutableArray, F as SharedStateEvents, I as SharedStateOptions, L as SharedStatePatch, M as ImmutableObject, N as ImmutableSet, P as SharedState, R as createSharedState, j as ImmutableMap, k as Immutable } from "../devframe-BuR6n9ZD.mjs";
+import { B as SharedStatePatch, F as ImmutableObject, I as ImmutableSet, L as SharedState, M as Immutable, N as ImmutableArray, P as ImmutableMap, R as SharedStateEvents, V as createSharedState, z as SharedStateOptions } from "../devframe-D-gr9sBx.mjs";
 export { Immutable, ImmutableArray, ImmutableMap, ImmutableObject, ImmutableSet, SharedState, SharedStateEvents, SharedStateOptions, SharedStatePatch, createSharedState };

package/dist/utils/shared-state.mjs

@@ -1,2 +1,2 @@
-import { t as createSharedState } from "../shared-state-u0y123fi.mjs";
+import { t as createSharedState } from "../shared-state-D4PPieA0.mjs";
 export { createSharedState };

package/dist/utils/streaming-channel.d.mts

@@ -1,2 +1,2 @@
-import { C as StreamErrorPayload, D as createStreamReader, E as StreamSinkEvents, O as createStreamSink, S as CreateStreamSinkOptions, T as StreamSink, b as BufferedChunk, w as StreamReader, x as CreateStreamReaderOptions } from "../devframe-BuR6n9ZD.mjs";
+import { A as createStreamReader, C as BufferedChunk, D as StreamReader, E as StreamErrorPayload, O as StreamSink, T as CreateStreamSinkOptions, j as createStreamSink, k as StreamSinkEvents, w as CreateStreamReaderOptions } from "../devframe-D-gr9sBx.mjs";
 export { BufferedChunk, CreateStreamReaderOptions, CreateStreamSinkOptions, StreamErrorPayload, StreamReader, StreamSink, StreamSinkEvents, createStreamReader, createStreamSink };

package/dist/utils/structured-clone.mjs

@@ -1,2 +1,2 @@
-import { i as structuredCloneStringify, n as structuredCloneParse, r as structuredCloneSerialize, t as structuredCloneDeserialize } from "../structured-clone-PdCZwt7F.mjs";
+import { i as structuredCloneStringify, n as structuredCloneParse, r as structuredCloneSerialize, t as structuredCloneDeserialize } from "../structured-clone-CeZOHvkd.mjs";
 export { structuredCloneDeserialize, structuredCloneParse, structuredCloneSerialize, structuredCloneStringify };

package/dist/{ws-client-CVYX9niP.d.mts → ws-client-D0z0pOhn.d.mts}

@@ -1,4 +1,4 @@
-import { _ as RpcFunctionDefinitionAny } from "./types-BkkQ0Txg.mjs";
+import { v as RpcFunctionDefinitionAny } from "./types-DZEx4ffs.mjs";
 import { ChannelOptions } from "birpc";
 
 //#region src/rpc/transports/ws-client.d.ts

package/dist/ws-server-Bc2wBHl-.d.mts

@@ -0,0 +1,119 @@
+import { v as RpcFunctionDefinitionAny } from "./types-DZEx4ffs.mjs";
+import { BirpcGroup, ChannelOptions } from "birpc";
+import { Peer } from "crossws";
+import { NodeAdapter } from "crossws/adapters/node";
+import { Server } from "node:http";
+import { Server as Server$1, ServerOptions } from "node:https";
+
+//#region src/rpc/transports/ws-server.d.ts
+interface DevframeNodeRpcSessionMeta {
+  id: number;
+  /** The crossws peer backing this session's socket. */
+  peer?: Peer;
+  clientAuthToken?: string;
+  isTrusted?: boolean;
+  subscribedStates: Set<string>;
+  /**
+   * Streams this session has subscribed to via
+   * `rpc.streaming.subscribe(channel, id)`. Tracked here for O(1) cleanup
+   * on disconnect; the wire format is `${channel}\x1F${id}`.
+   */
+  subscribedStreams?: Set<string>;
+  /**
+   * Inbound streams this session is currently uploading to (via
+   * `rpc.streaming.upload(channel, id)`). Tracked for cleanup on
+   * disconnect; same wire format as `subscribedStreams`.
+   */
+  uploadingStreams?: Set<string>;
+}
+interface WsRpcTransportOptions {
+  /**
+   * Attach to an existing HTTP(S) server, sharing its port. Combine with
+   * `path` to bind the WS endpoint to a single route so it coexists with
+   * other upgrade handlers on the same server (e.g. a Vite dev server's HMR
+   * socket). The shared server's lifecycle is owned by the caller — closing
+   * this transport detaches the upgrade listener without closing the server.
+   */
+  server?: Server | Server$1;
+  /** Port for a newly-created standalone WS server. */
+  port?: number;
+  /** Host for a newly-created standalone WS server. Defaults to `localhost`. */
+  host?: string;
+  /**
+   * Restrict the WS endpoint to a single upgrade route (e.g. `/__devframe_ws`). When
+   * sharing a `server`, non-matching upgrade requests are left untouched for
+   * other listeners to handle, so devframe's socket can sit alongside
+   * framework sockets (Vite HMR, etc.).
+   */
+  path?: string;
+  /**
+   * Destroy upgrade requests that don't match `path` instead of leaving them
+   * for other listeners. Enable this when devframe owns the shared server
+   * outright (nothing else handles its upgrades), so an off-route client is
+   * rejected promptly rather than left hanging. Default: `false`
+   * (coexist-friendly); servers this transport creates itself always
+   * destroy unmatched upgrades.
+   */
+  destroyUnmatched?: boolean;
+  /** When set, a new https.Server is created and the WS endpoint is attached to it. */
+  https?: ServerOptions;
+  /**
+   * Extra origins to accept on the WS upgrade beyond the loopback default.
+   * Add your LAN/tunnel origin here when reaching the tool from another host.
+   * Pass `false` to disable origin checking entirely (not recommended).
+   * Default: loopback-only.
+   */
+  allowedOrigins?: readonly string[] | false;
+  /**
+   * RPC function definitions, used by the per-call wire serializer to
+   * dispatch between strict-JSON and structured-clone encoding based
+   * on each function's `jsonSerializable` flag.
+   *
+   * When omitted, all messages fall back to structured-clone — safe but
+   * loses dev-time validation for `jsonSerializable: true` declarations.
+   */
+  definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>;
+  onConnected?: (peer: Peer, meta: DevframeNodeRpcSessionMeta) => void;
+  onDisconnected?: (peer: Peer, meta: DevframeNodeRpcSessionMeta) => void;
+  /** Override the default per-call serializer. Most callers should leave this unset. */
+  serialize?: ChannelOptions['serialize'];
+  /** Override the default per-call deserializer. Most callers should leave this unset. */
+  deserialize?: ChannelOptions['deserialize'];
+}
+interface WsRpcTransport {
+  /**
+   * The crossws node adapter driving the socket — exposes the connected
+   * `peers` and pub/sub. See https://crossws.h3.dev.
+   */
+  ws: NodeAdapter;
+  /** Remove the upgrade listener from a shared `server` (a no-op otherwise). */
+  detach: () => void;
+  /**
+   * Tear the transport down deterministically: detach from a shared server,
+   * force-terminate every connected peer, and close any server this
+   * transport created itself (`port` / `https` modes).
+   */
+  close: () => Promise<void>;
+}
+declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Default origin policy for a localhost dev tool: allow requests with no
+ * `Origin` header (native, non-browser clients), allow any loopback origin
+ * (so cross-port localhost dev setups keep working), and allow explicitly
+ * configured origins. Everything else — a real remote page in the dev's
+ * browser — is rejected.
+ */
+declare function isAllowedOrigin(origin: string | undefined, allowedOrigins: readonly string[]): boolean;
+/**
+ * Attach a WebSocket transport to an existing RPC group, powered by
+ * [crossws](https://crossws.h3.dev). Either attach to an existing HTTP(S)
+ * `server` (sharing its port, optionally scoped to a `path`), or let this
+ * helper create a standalone server from `port` / `host` / `https`.
+ *
+ * Returns the crossws node adapter plus `detach` (remove the upgrade
+ * listener from a shared `server`) and `close` (full deterministic
+ * teardown).
+ */
+declare function attachWsRpcTransport<ClientFunctions extends object, ServerFunctions extends object>(rpcGroup: BirpcGroup<ClientFunctions, ServerFunctions, false>, options?: WsRpcTransportOptions): WsRpcTransport;
+//#endregion
+export { isAllowedOrigin as a, attachWsRpcTransport as i, WsRpcTransport as n, isLoopbackHostname as o, WsRpcTransportOptions as r, DevframeNodeRpcSessionMeta as t };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devframe",
   "type": "module",
-  "version": "0.5.4",
+  "version": "0.6.0-beta.2",
   "description": "Framework for building generic devframes",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",
@@ -40,13 +40,14 @@
     "./rpc/transports/ws-server": "./dist/rpc/transports/ws-server.mjs",
     "./types": "./dist/types/index.mjs",
     "./utils/colors": "./dist/utils/colors.mjs",
+    "./utils/crypto-token": "./dist/utils/crypto-token.mjs",
     "./utils/events": "./dist/utils/events.mjs",
     "./utils/hash": "./dist/utils/hash.mjs",
-    "./utils/human-id": "./dist/utils/human-id.mjs",
     "./utils/launch-editor": "./dist/utils/launch-editor.mjs",
     "./utils/nanoid": "./dist/utils/nanoid.mjs",
     "./utils/open": "./dist/utils/open.mjs",
     "./utils/promise": "./dist/utils/promise.mjs",
+    "./utils/scope": "./dist/utils/scope.mjs",
     "./utils/serve-static": "./dist/utils/serve-static.mjs",
     "./utils/shared-state": "./dist/utils/shared-state.mjs",
     "./utils/streaming-channel": "./dist/utils/streaming-channel.mjs",
@@ -71,12 +72,14 @@
     "@valibot/to-json-schema": "^1.7.0",
     "birpc": "^4.0.0",
     "cac": "^7.0.0",
+    "crossws": "^0.4.8",
+    "destr": "^2.0.5",
     "h3": "2.0.1-rc.22",
     "mrmime": "^2.0.1",
-    "nostics": "^0.2.0",
+    "nostics": "^1.1.4",
     "pathe": "^2.0.3",
-    "valibot": "^1.4.1",
-    "ws": "^8.21.0"
+    "ufo": "^1.6.4",
+    "valibot": "^1.4.1"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
@@ -93,7 +96,8 @@
     "tinyglobby": "^0.2.16",
     "tsdown": "^0.22.0",
     "ua-parser-modern": "^0.1.1",
-    "whenexpr": "^0.1.2"
+    "whenexpr": "^0.1.2",
+    "ws": "^8.21.0"
   },
   "inlinedDependencies": {
     "bundle-name": "4.1.0",
@@ -124,6 +128,7 @@
   },
   "scripts": {
     "build": "tsdown",
-    "watch": "tsdown --watch"
+    "watch": "tsdown --watch",
+    "typecheck": "tsc --noEmit"
   }
 }