devframe 0.6.0-beta.1 → 0.6.0-beta.2

package/dist/adapters/build.d.mts

@@ -1,4 +1,4 @@
-import { r as DevframeDefinition } from "../devframe-BwfavB78.mjs";
+import { r as DevframeDefinition } from "../devframe-D-gr9sBx.mjs";
 
 //#region src/adapters/build.d.ts
 interface CreateBuildOptions {

package/dist/adapters/cli.d.mts

@@ -1,4 +1,4 @@
-import { Ct as CliFlagsSchema, Et as parseCliFlags, Tt as defineCliFlags, r as DevframeDefinition, wt as InferCliFlags } from "../devframe-BwfavB78.mjs";
+import { Ct as CliFlagsSchema, Et as parseCliFlags, Tt as defineCliFlags, r as DevframeDefinition, wt as InferCliFlags } from "../devframe-D-gr9sBx.mjs";
 import { CAC } from "cac";
 import { H3 } from "h3";
 

package/dist/adapters/cli.mjs

@@ -1,6 +1,6 @@
 import { n as colors } from "../diagnostics-reporter-CsIG85Q5.mjs";
 import { createBuild } from "./build.mjs";
-import { n as resolveDevServerPort, t as createDevServer } from "../dev-CSpLSEVh.mjs";
+import { n as resolveDevServerPort, t as createDevServer } from "../dev-BaX8fLH2.mjs";
 import process from "node:process";
 import cac from "cac";
 import { safeParse } from "valibot";

package/dist/adapters/dev.d.mts

@@ -1,5 +1,5 @@
-import { l as DevframeWsOptions, r as DevframeDefinition } from "../devframe-BwfavB78.mjs";
-import { n as StartedServer } from "../server-oju7PTi2.mjs";
+import { l as DevframeWsOptions, r as DevframeDefinition } from "../devframe-D-gr9sBx.mjs";
+import { n as StartedServer } from "../server-rX781kz-.mjs";
 import { H3 } from "h3";
 
 //#region src/adapters/dev.d.ts

package/dist/adapters/dev.mjs

@@ -1,2 +1,2 @@
-import { n as resolveDevServerPort, t as createDevServer } from "../dev-CSpLSEVh.mjs";
+import { n as resolveDevServerPort, t as createDevServer } from "../dev-BaX8fLH2.mjs";
 export { createDevServer, resolveDevServerPort };

package/dist/adapters/embedded.d.mts

@@ -1,4 +1,4 @@
-import { m as DevframeNodeContext, r as DevframeDefinition } from "../devframe-BwfavB78.mjs";
+import { m as DevframeNodeContext, r as DevframeDefinition } from "../devframe-D-gr9sBx.mjs";
 
 //#region src/adapters/embedded.d.ts
 interface CreateEmbeddedOptions {

package/dist/adapters/mcp.d.mts

@@ -1,4 +1,4 @@
-import { r as DevframeDefinition } from "../devframe-BwfavB78.mjs";
+import { r as DevframeDefinition } from "../devframe-D-gr9sBx.mjs";
 //#region src/adapters/mcp/build-server.d.ts
 interface CreateMcpServerOptions {
   /**

package/dist/client/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as ScopedServerFunctions, D as StreamReader, J as DevframeSettings, L as SharedState, O as StreamSink, bt as EventEmitter, d as ConnectionMeta, et as ScopedSharedStates, it as DevframeRpcServerFunctions, rt as DevframeRpcClientFunctions, tt as SettingsForNamespace, v as RpcSharedStateGetOptions, y as RpcSharedStateHost } from "../devframe-BwfavB78.mjs";
+import { $ as ScopedServerFunctions, D as StreamReader, J as DevframeSettings, L as SharedState, O as StreamSink, bt as EventEmitter, d as ConnectionMeta, et as ScopedSharedStates, it as DevframeRpcServerFunctions, rt as DevframeRpcClientFunctions, tt as SettingsForNamespace, v as RpcSharedStateGetOptions, y as RpcSharedStateHost } from "../devframe-D-gr9sBx.mjs";
 import { _ as RpcFunctionDefinition, w as RpcFunctionsCollector } from "../types-DZEx4ffs.mjs";
 import { C as RpcCacheManager, w as RpcCacheOptions } from "../index-CxaPKDXX.mjs";
 import { t as WsRpcChannelOptions } from "../ws-client-D0z0pOhn.mjs";

package/dist/{context-o-TwncyP.d.mts → context-BEVByy_Z.d.mts}

@@ -1,4 +1,4 @@
-import { L as SharedState, m as DevframeNodeContext } from "./devframe-BwfavB78.mjs";
+import { L as SharedState, m as DevframeNodeContext } from "./devframe-D-gr9sBx.mjs";
 
 //#region src/node/hub-internals/context.d.ts
 interface InternalAnonymousAuthStorage {

package/dist/{dev-CSpLSEVh.mjs → dev-BaX8fLH2.mjs}

@@ -1,6 +1,6 @@
 import { DEVFRAME_CONNECTION_META_FILENAME } from "./constants.mjs";
 import { n as createHostContext, t as createH3DevframeHost } from "./host-h3-C5SZlk03.mjs";
-import { t as startHttpAndWs } from "./server-wyY3zh67.mjs";
+import { t as startHttpAndWs } from "./server-Dl6TU5LE.mjs";
 import { n as resolveBasePath, t as normalizeBasePath } from "./_shared-bWRzeSa0.mjs";
 import { t as open } from "./open-Dusa2Zzd.mjs";
 import { mountStaticHandler } from "./utils/serve-static.mjs";

package/dist/{devframe-BwfavB78.d.mts → devframe-D-gr9sBx.d.mts}

@@ -1,6 +1,6 @@
 import { _ as RpcFunctionDefinition } from "./types-DZEx4ffs.mjs";
 import { S as RpcFunctionsCollectorBase } from "./index-CxaPKDXX.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "./ws-server-BVVMDo2n.mjs";
+import { t as DevframeNodeRpcSessionMeta } from "./ws-server-Bc2wBHl-.mjs";
 import { CAC } from "cac";
 import { GenericSchema, InferOutput } from "valibot";
 import { BirpcReturn } from "birpc";

package/dist/helpers/vite.d.mts

@@ -1,4 +1,4 @@
-import { r as DevframeDefinition } from "../devframe-BwfavB78.mjs";
+import { r as DevframeDefinition } from "../devframe-D-gr9sBx.mjs";
 
 //#region src/helpers/vite.d.ts
 interface ViteDevBridgeOptions {

package/dist/helpers/vite.mjs

@@ -2,7 +2,7 @@ import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_WS_ROUTE } from "../constan
 import { a as diagnostics } from "../storage-l2ezeend.mjs";
 import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-bWRzeSa0.mjs";
 import { serveStaticNodeMiddleware } from "../utils/serve-static.mjs";
-import { n as resolveDevServerPort, t as createDevServer } from "../dev-CSpLSEVh.mjs";
+import { n as resolveDevServerPort, t as createDevServer } from "../dev-BaX8fLH2.mjs";
 import { resolve } from "pathe";
 //#region src/helpers/vite.ts
 /**

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { $ as ScopedServerFunctions, G as DevframeScopedNodeContext, H as EntriesToObject, J as DevframeSettings, K as DevframeScopedNodeRpc, Q as ScopedClientFunctions, S as RpcStreamingHost, St as EventsMap, U as PartialWithoutId, W as Thenable, X as DevframeSettingsStore, Y as DevframeSettingsRegistry, Z as ScopedBroadcastOptions, _ as RpcFunctionsHost, _t as AgentToolInput, a as DevframeDuplicationStrategy, at as DevframeRpcSharedStates, b as RpcStreamingChannel, bt as EventEmitter, c as DevframeSpaOptions, ct as DevframeDiagnosticsDefinition, d as ConnectionMeta, dt as AgentHandle, et as ScopedSharedStates, f as ConnectionMetaWebsocket, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, i as DevframeDeploymentKind, it as DevframeRpcServerFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsHost, m as DevframeNodeContext, mt as AgentResourceContent, n as DevframeCliOptions, nt as DevframeViewHost, o as DevframeRuntime, ot as DevframeHost, p as DevframeCapabilities, pt as AgentResource, q as DevframeScopedStreamingHost, r as DevframeDefinition, rt as DevframeRpcClientFunctions, s as DevframeSetupInfo, st as DevframeDefineDiagnosticsOptions, t as DevframeBrowserContext, tt as SettingsForNamespace, u as defineDevframe, ut as DevframeDiagnosticsLogger, v as RpcSharedStateGetOptions, vt as DevframeAgentHost, x as RpcStreamingChannelOptions, xt as EventUnsubscribe, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "./devframe-BwfavB78.mjs";
+import { $ as ScopedServerFunctions, G as DevframeScopedNodeContext, H as EntriesToObject, J as DevframeSettings, K as DevframeScopedNodeRpc, Q as ScopedClientFunctions, S as RpcStreamingHost, St as EventsMap, U as PartialWithoutId, W as Thenable, X as DevframeSettingsStore, Y as DevframeSettingsRegistry, Z as ScopedBroadcastOptions, _ as RpcFunctionsHost, _t as AgentToolInput, a as DevframeDuplicationStrategy, at as DevframeRpcSharedStates, b as RpcStreamingChannel, bt as EventEmitter, c as DevframeSpaOptions, ct as DevframeDiagnosticsDefinition, d as ConnectionMeta, dt as AgentHandle, et as ScopedSharedStates, f as ConnectionMetaWebsocket, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, i as DevframeDeploymentKind, it as DevframeRpcServerFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsHost, m as DevframeNodeContext, mt as AgentResourceContent, n as DevframeCliOptions, nt as DevframeViewHost, o as DevframeRuntime, ot as DevframeHost, p as DevframeCapabilities, pt as AgentResource, q as DevframeScopedStreamingHost, r as DevframeDefinition, rt as DevframeRpcClientFunctions, s as DevframeSetupInfo, st as DevframeDefineDiagnosticsOptions, t as DevframeBrowserContext, tt as SettingsForNamespace, u as defineDevframe, ut as DevframeDiagnosticsLogger, v as RpcSharedStateGetOptions, vt as DevframeAgentHost, x as RpcStreamingChannelOptions, xt as EventUnsubscribe, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "./devframe-D-gr9sBx.mjs";
 import { C as RpcFunctionType, T as RpcReturnSchema, _ as RpcFunctionDefinition, g as RpcFunctionAgentOptions, i as RpcArgsSchema } from "./types-DZEx4ffs.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "./ws-server-BVVMDo2n.mjs";
+import { t as DevframeNodeRpcSessionMeta } from "./ws-server-Bc2wBHl-.mjs";
 
 //#region src/define.d.ts
 declare const defineRpcFunction: <NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>) => RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>;

package/dist/{launch-editor-CgXBgviI.mjs → launch-editor-DPfltGA4.mjs}

@@ -91,21 +91,66 @@ var require_picocolors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports.createColors = createColors;
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/shell-quote@1.8.3/node_modules/shell-quote/quote.js
+//#region ../../node_modules/.pnpm/shell-quote@1.9.0/node_modules/shell-quote/quote.js
 var require_quote = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/** @import { ControlOperator } from './parse' */
+	/** @type {ControlOperator['op'][]} */
+	var OPS = [
+		"||",
+		"&&",
+		";;",
+		"|&",
+		"<(",
+		"<<<",
+		">>",
+		">&",
+		"<&",
+		"&",
+		";",
+		"(",
+		")",
+		"|",
+		"<",
+		">"
+	];
+	var LINE_TERMINATORS = /[\n\r\u2028\u2029]/;
+	var GLOB_SHELL_SPECIAL = /[\s#!"$&'():;<=>@\\^`|]/g;
+	/** @type {import('./quote')} */
 	module.exports = function quote(xs) {
 		return xs.map(function(s) {
 			if (s === "") return "''";
-			if (s && typeof s === "object") return s.op.replace(/(.)/g, "\\$1");
+			if (s && typeof s === "object") {
+				if ("op" in s && s.op === "glob") {
+					if (typeof s.pattern !== "string") throw new TypeError("glob token requires a string `pattern`");
+					if (LINE_TERMINATORS.test(s.pattern)) throw new TypeError("glob `pattern` must not contain line terminators");
+					return s.pattern.replace(GLOB_SHELL_SPECIAL, "\\$&");
+				}
+				if ("op" in s && typeof s.op === "string") {
+					if (OPS.indexOf(s.op) < 0) throw new TypeError("invalid `op` value: " + JSON.stringify(s.op));
+					return s.op.replace(/[\s\S]/g, "\\$&");
+				}
+				if ("comment" in s && typeof s.comment === "string") {
+					if (LINE_TERMINATORS.test(s.comment)) throw new TypeError("`comment` must not contain line terminators");
+					return "#" + s.comment;
+				}
+				throw new TypeError("unrecognized object token shape");
+			}
 			if (/["\s\\]/.test(s) && !/'/.test(s)) return "'" + s.replace(/(['])/g, "\\$1") + "'";
 			if (/["'\s]/.test(s)) return "\"" + s.replace(/(["\\$`!])/g, "\\$1") + "\"";
-			return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}])/g, "$1\\$2");
+			return String(s).replace(/([A-Za-z]:)?([#!"$&'()*,:;<=>?@[\\\]^`{|}~])/g, "$1\\$2");
 		}).join(" ");
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/shell-quote@1.8.3/node_modules/shell-quote/parse.js
+//#region ../../node_modules/.pnpm/shell-quote@1.9.0/node_modules/shell-quote/parse.js
 var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/**
+	* @import {
+	* 	ControlOperator,
+	* 	Env,
+	* 	GlobPattern,
+	* 	ParseEntry,
+	* } from './parse' */
 	var CONTROL = "(?:" + [
 		"\\|\\|",
 		"\\&\\&",
@@ -130,17 +175,26 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var mult = 4294967296;
 	for (var i = 0; i < 4; i++) TOKEN += (mult * Math.random()).toString(16);
 	var startsWithToken = new RegExp("^" + TOKEN);
+	/**
+	* @param {string} s
+	* @param {RegExp} r
+	*/
 	function matchAll(s, r) {
 		var origIndex = r.lastIndex;
 		var matches = [];
 		var matchObj;
 		while (matchObj = r.exec(s)) {
-			matches.push(matchObj);
+			matches[matches.length] = matchObj;
 			if (r.lastIndex === matchObj.index) r.lastIndex += 1;
 		}
 		r.lastIndex = origIndex;
 		return matches;
 	}
+	/**
+	* @param {Env} env
+	* @param {string} pre
+	* @param {string} key
+	*/
 	function getVar(env, pre, key) {
 		var r = typeof env === "function" ? env(key) : env[key];
 		if (typeof r === "undefined" && key != "") r = "";
@@ -148,6 +202,12 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		if (typeof r === "object") return pre + TOKEN + JSON.stringify(r) + TOKEN;
 		return pre + r;
 	}
+	/**
+	* @param {string} string
+	* @param {Env} [env]
+	* @param {{ escape?: string }} [opts]
+	* @returns {ParseEntry[]}
+	*/
 	function parseInternal(string, env, opts) {
 		if (!opts) opts = {};
 		var BS = opts.escape || "\\";
@@ -160,14 +220,18 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			var s = match[0];
 			if (!s || commented) return;
 			if (controlRE.test(s)) return { op: s };
+			/** @type {string | boolean} */
 			var quote = false;
 			var esc = false;
 			var out = "";
 			var isGlob = false;
+			/** @type {number} */
 			var i;
 			function parseEnvVar() {
 				i += 1;
+				/** @type {number | RegExpMatchArray | null} */
 				var varend;
+				/** @type {string} */
 				var varname;
 				var char = s.charAt(i);
 				if (char === "{") {
@@ -225,25 +289,36 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			};
 			return out;
 		}).reduce(function(prev, arg) {
-			return typeof arg === "undefined" ? prev : prev.concat(arg);
+			if (typeof arg === "undefined") return prev;
+			/** @type {ParseEntry[]} */ [].concat(arg).forEach(function(entry) {
+				prev[prev.length] = entry;
+			});
+			return prev;
 		}, []);
 	}
+	/** @type {import('./parse')} */
 	module.exports = function parse(s, env, opts) {
 		var mapped = parseInternal(s, env, opts);
 		if (typeof env !== "function") return mapped;
 		return mapped.reduce(function(acc, s) {
-			if (typeof s === "object") return acc.concat(s);
+			if (typeof s === "object") {
+				acc[acc.length] = s;
+				return acc;
+			}
 			var xs = s.split(RegExp("(" + TOKEN + ".*?" + TOKEN + ")", "g"));
-			if (xs.length === 1) return acc.concat(xs[0]);
-			return acc.concat(xs.filter(Boolean).map(function(x) {
-				if (startsWithToken.test(x)) return JSON.parse(x.split(TOKEN)[1]);
-				return x;
-			}));
+			if (xs.length === 1) {
+				acc[acc.length] = xs[0];
+				return acc;
+			}
+			xs.filter(Boolean).forEach(function(x) {
+				acc[acc.length] = startsWithToken.test(x) ? JSON.parse(x.split(TOKEN)[1]) : x;
+			});
+			return acc;
 		}, []);
 	};
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/shell-quote@1.8.3/node_modules/shell-quote/index.js
+//#region ../../node_modules/.pnpm/shell-quote@1.9.0/node_modules/shell-quote/index.js
 var require_shell_quote = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.quote = require_quote();
 	exports.parse = require_parse();

package/dist/node/auth.d.mts

@@ -1,5 +1,5 @@
-import { L as SharedState, h as DevframeNodeRpcSession, m as DevframeNodeContext } from "../devframe-BwfavB78.mjs";
-import { n as InternalAnonymousAuthStorage } from "../context-o-TwncyP.mjs";
+import { L as SharedState, h as DevframeNodeRpcSession, m as DevframeNodeContext } from "../devframe-D-gr9sBx.mjs";
+import { n as InternalAnonymousAuthStorage } from "../context-BEVByy_Z.mjs";
 
 //#region src/node/auth/revoke.d.ts
 /**

package/dist/node/hub-internals.d.mts

@@ -1,5 +1,5 @@
-import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-BwfavB78.mjs";
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-o-TwncyP.mjs";
+import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-D-gr9sBx.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-BEVByy_Z.mjs";
 
 //#region src/adapters/_shared.d.ts
 /**

package/dist/node/index.d.mts

@@ -1,8 +1,8 @@
-import { G as DevframeScopedNodeContext, J as DevframeSettings, L as SharedState, S as RpcStreamingHost, _ as RpcFunctionsHost$1, _t as AgentToolInput, bt as EventEmitter, dt as AgentHandle, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, it as DevframeRpcServerFunctions, lt as DevframeDiagnosticsHost$1, m as DevframeNodeContext, mt as AgentResourceContent, nt as DevframeViewHost$1, ot as DevframeHost, pt as AgentResource, rt as DevframeRpcClientFunctions, ut as DevframeDiagnosticsLogger, vt as DevframeAgentHost$1, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "../devframe-BwfavB78.mjs";
+import { G as DevframeScopedNodeContext, J as DevframeSettings, L as SharedState, S as RpcStreamingHost, _ as RpcFunctionsHost$1, _t as AgentToolInput, bt as EventEmitter, dt as AgentHandle, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, it as DevframeRpcServerFunctions, lt as DevframeDiagnosticsHost$1, m as DevframeNodeContext, mt as AgentResourceContent, nt as DevframeViewHost$1, ot as DevframeHost, pt as AgentResource, rt as DevframeRpcClientFunctions, ut as DevframeDiagnosticsLogger, vt as DevframeAgentHost$1, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "../devframe-D-gr9sBx.mjs";
 import { v as RpcFunctionDefinitionAny } from "../types-DZEx4ffs.mjs";
 import { S as RpcFunctionsCollectorBase } from "../index-CxaPKDXX.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "../ws-server-BVVMDo2n.mjs";
-import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-oju7PTi2.mjs";
+import { t as DevframeNodeRpcSessionMeta } from "../ws-server-Bc2wBHl-.mjs";
+import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-rX781kz-.mjs";
 import { BirpcGroup } from "birpc";
 import { AsyncLocalStorage } from "node:async_hooks";
 

package/dist/node/index.mjs

@@ -1,6 +1,6 @@
 import { t as createStorage } from "../storage-l2ezeend.mjs";
 import { a as DevframeViewHost, c as createRpcSharedStateServerHost, i as createNodeSettings, l as DevframeDiagnosticsHost, n as createHostContext, o as RpcFunctionsHost, r as createScopedNodeContext, s as createRpcStreamingServerHost, t as createH3DevframeHost, u as DevframeAgentHost } from "../host-h3-C5SZlk03.mjs";
-import { t as startHttpAndWs } from "../server-wyY3zh67.mjs";
+import { t as startHttpAndWs } from "../server-Dl6TU5LE.mjs";
 import { isIP } from "node:net";
 //#region src/node/utils.ts
 function isObject(value) {

package/dist/recipes/open-helpers.mjs

@@ -1,4 +1,4 @@
-import { t as launchEditor } from "../launch-editor-CgXBgviI.mjs";
+import { t as launchEditor } from "../launch-editor-DPfltGA4.mjs";
 import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
 import { t as open } from "../open-Dusa2Zzd.mjs";
 import * as v from "valibot";

package/dist/rpc/transports/ws-server.d.mts

@@ -1,2 +1,2 @@
-import { i as attachWsRpcTransport, n as WsRpcTransport, r as WsRpcTransportOptions, t as DevframeNodeRpcSessionMeta } from "../../ws-server-BVVMDo2n.mjs";
-export { DevframeNodeRpcSessionMeta, WsRpcTransport, WsRpcTransportOptions, attachWsRpcTransport };
+import { a as isAllowedOrigin, i as attachWsRpcTransport, n as WsRpcTransport, o as isLoopbackHostname, r as WsRpcTransportOptions, t as DevframeNodeRpcSessionMeta } from "../../ws-server-Bc2wBHl-.mjs";
+export { DevframeNodeRpcSessionMeta, WsRpcTransport, WsRpcTransportOptions, attachWsRpcTransport, isAllowedOrigin, isLoopbackHostname };

package/dist/rpc/transports/ws-server.mjs

@@ -12,6 +12,26 @@ function pathMatches(a, b) {
 	const strip = (p) => p.length > 1 && p.endsWith("/") ? p.slice(0, -1) : p;
 	return strip(a) === strip(b);
 }
+function isLoopbackHostname(hostname) {
+	const h = hostname.replace(/^\[|\]$/g, "");
+	return h === "localhost" || h === "127.0.0.1" || h === "::1" || h.endsWith(".localhost") || h.startsWith("127.");
+}
+/**
+* Default origin policy for a localhost dev tool: allow requests with no
+* `Origin` header (native, non-browser clients), allow any loopback origin
+* (so cross-port localhost dev setups keep working), and allow explicitly
+* configured origins. Everything else — a real remote page in the dev's
+* browser — is rejected.
+*/
+function isAllowedOrigin(origin, allowedOrigins) {
+	if (!origin) return true;
+	if (allowedOrigins.includes(origin)) return true;
+	try {
+		return isLoopbackHostname(new URL(origin).hostname);
+	} catch {
+		return false;
+	}
+}
 /**
 * Route `upgrade` events on a server to the crossws adapter, optionally
 * filtered to a single `path`. Non-matching requests are left untouched so
@@ -19,18 +39,27 @@ function pathMatches(a, b) {
 * them, unless `destroyUnmatched` is set. Returns a detach function that
 * removes the listener.
 */
-function routeUpgrades(server, ws, path, destroyUnmatched) {
+function routeUpgrades(server, ws, path, destroyUnmatched, allowedOrigins) {
 	const listener = (req, socket, head) => {
+		socket.on("error", () => {});
 		if (path) {
 			let pathname = req.url ?? "/";
 			try {
 				pathname = new URL(req.url ?? "/", "http://localhost").pathname;
 			} catch {}
 			if (!pathMatches(pathname, path)) {
-				if (destroyUnmatched) socket.destroy();
+				if (destroyUnmatched) {
+					socket.write("HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n");
+					socket.destroy();
+				}
 				return;
 			}
 		}
+		if (allowedOrigins !== false && !isAllowedOrigin(req.headers.origin, allowedOrigins ?? [])) {
+			socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+			socket.destroy();
+			return;
+		}
 		ws.handleUpgrade(req, socket, head);
 	};
 	server.on("upgrade", listener);
@@ -47,7 +76,7 @@ function routeUpgrades(server, ws, path, destroyUnmatched) {
 * teardown).
 */
 function attachWsRpcTransport(rpcGroup, options = {}) {
-	const { server, port, host = "localhost", path, destroyUnmatched = false, https, onConnected = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS, serialize: serializeOverride, deserialize: deserializeOverride } = options;
+	const { server, port, host = "localhost", path, destroyUnmatched = false, https, allowedOrigins, onConnected = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS, serialize: serializeOverride, deserialize: deserializeOverride } = options;
 	const states = /* @__PURE__ */ new WeakMap();
 	const ws = crossws({ hooks: {
 		open: (peer) => {
@@ -108,17 +137,17 @@ function attachWsRpcTransport(rpcGroup, options = {}) {
 	} });
 	let detach = NOOP;
 	let ownedServer;
-	if (server) detach = routeUpgrades(server, ws, path, destroyUnmatched);
+	if (server) detach = routeUpgrades(server, ws, path, destroyUnmatched, allowedOrigins);
 	else if (https) {
 		ownedServer = createServer$1(https);
-		detach = routeUpgrades(ownedServer, ws, path, true);
+		detach = routeUpgrades(ownedServer, ws, path, true, allowedOrigins);
 		ownedServer.listen(port, host);
 	} else {
 		ownedServer = createServer((_req, res) => {
 			res.writeHead(426, { "content-type": "text/plain" });
 			res.end("Upgrade Required");
 		});
-		detach = routeUpgrades(ownedServer, ws, path, true);
+		detach = routeUpgrades(ownedServer, ws, path, true, allowedOrigins);
 		ownedServer.listen(port, host);
 	}
 	return {
@@ -135,4 +164,4 @@ function attachWsRpcTransport(rpcGroup, options = {}) {
 	};
 }
 //#endregion
-export { attachWsRpcTransport };
+export { attachWsRpcTransport, isAllowedOrigin, isLoopbackHostname };

package/dist/{server-wyY3zh67.mjs → server-Dl6TU5LE.mjs}

@@ -38,6 +38,7 @@ async function startHttpAndWs(options) {
 		} : { server: httpServer },
 		path: options.path,
 		destroyUnmatched: ownsHttpServer,
+		allowedOrigins: options.allowedOrigins,
 		onDisconnected: (_peer, meta) => {
 			rpcHost._emitSessionDisconnected(meta);
 		}

package/dist/{server-oju7PTi2.d.mts → server-rX781kz-.d.mts}

@@ -1,4 +1,4 @@
-import { it as DevframeRpcServerFunctions, m as DevframeNodeContext, rt as DevframeRpcClientFunctions } from "./devframe-BwfavB78.mjs";
+import { it as DevframeRpcServerFunctions, m as DevframeNodeContext, rt as DevframeRpcClientFunctions } from "./devframe-D-gr9sBx.mjs";
 import { BirpcGroup } from "birpc";
 import { NodeAdapter } from "crossws/adapters/node";
 import { Server } from "node:http";
@@ -51,6 +51,14 @@ interface StartHttpAndWsOptions {
    * Default: `true`.
    */
   auth?: boolean;
+  /**
+   * Extra origins to accept on the WS upgrade beyond the loopback default
+   * (`localhost`/`127.0.0.1`/`::1` and any `Origin`-less request from a
+   * native client). Add your LAN/tunnel origin here when reaching the tool
+   * from another host. Pass `false` to disable origin checking entirely
+   * (not recommended). Default: loopback-only.
+   */
+  allowedOrigins?: readonly string[] | false;
   /**
    * Called once the WS server is bound so callers can mount static
    * handlers whose origin depends on the resolved port, or print their

package/dist/types/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as ScopedServerFunctions, G as DevframeScopedNodeContext, H as EntriesToObject, J as DevframeSettings, K as DevframeScopedNodeRpc, Q as ScopedClientFunctions, S as RpcStreamingHost, St as EventsMap, U as PartialWithoutId, W as Thenable, X as DevframeSettingsStore, Y as DevframeSettingsRegistry, Z as ScopedBroadcastOptions, _ as RpcFunctionsHost, _t as AgentToolInput, a as DevframeDuplicationStrategy, at as DevframeRpcSharedStates, b as RpcStreamingChannel, bt as EventEmitter, c as DevframeSpaOptions, ct as DevframeDiagnosticsDefinition, d as ConnectionMeta, dt as AgentHandle, et as ScopedSharedStates, f as ConnectionMetaWebsocket, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, i as DevframeDeploymentKind, it as DevframeRpcServerFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsHost, m as DevframeNodeContext, mt as AgentResourceContent, n as DevframeCliOptions, nt as DevframeViewHost, o as DevframeRuntime, ot as DevframeHost, p as DevframeCapabilities, pt as AgentResource, q as DevframeScopedStreamingHost, r as DevframeDefinition, rt as DevframeRpcClientFunctions, s as DevframeSetupInfo, st as DevframeDefineDiagnosticsOptions, t as DevframeBrowserContext, tt as SettingsForNamespace, u as defineDevframe, ut as DevframeDiagnosticsLogger, v as RpcSharedStateGetOptions, vt as DevframeAgentHost, x as RpcStreamingChannelOptions, xt as EventUnsubscribe, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "../devframe-BwfavB78.mjs";
+import { $ as ScopedServerFunctions, G as DevframeScopedNodeContext, H as EntriesToObject, J as DevframeSettings, K as DevframeScopedNodeRpc, Q as ScopedClientFunctions, S as RpcStreamingHost, St as EventsMap, U as PartialWithoutId, W as Thenable, X as DevframeSettingsStore, Y as DevframeSettingsRegistry, Z as ScopedBroadcastOptions, _ as RpcFunctionsHost, _t as AgentToolInput, a as DevframeDuplicationStrategy, at as DevframeRpcSharedStates, b as RpcStreamingChannel, bt as EventEmitter, c as DevframeSpaOptions, ct as DevframeDiagnosticsDefinition, d as ConnectionMeta, dt as AgentHandle, et as ScopedSharedStates, f as ConnectionMetaWebsocket, ft as AgentManifest, g as RpcBroadcastOptions, gt as AgentTool, h as DevframeNodeRpcSession, ht as AgentResourceInput, i as DevframeDeploymentKind, it as DevframeRpcServerFunctions, l as DevframeWsOptions, lt as DevframeDiagnosticsHost, m as DevframeNodeContext, mt as AgentResourceContent, n as DevframeCliOptions, nt as DevframeViewHost, o as DevframeRuntime, ot as DevframeHost, p as DevframeCapabilities, pt as AgentResource, q as DevframeScopedStreamingHost, r as DevframeDefinition, rt as DevframeRpcClientFunctions, s as DevframeSetupInfo, st as DevframeDefineDiagnosticsOptions, t as DevframeBrowserContext, tt as SettingsForNamespace, u as defineDevframe, ut as DevframeDiagnosticsLogger, v as RpcSharedStateGetOptions, vt as DevframeAgentHost, x as RpcStreamingChannelOptions, xt as EventUnsubscribe, y as RpcSharedStateHost, yt as DevframeAgentHostEvents } from "../devframe-D-gr9sBx.mjs";
 import { g as RpcFunctionAgentOptions } from "../types-DZEx4ffs.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "../ws-server-BVVMDo2n.mjs";
+import { t as DevframeNodeRpcSessionMeta } from "../ws-server-Bc2wBHl-.mjs";
 export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, PartialWithoutId, RpcBroadcastOptions, RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe };

package/dist/utils/events.d.mts

@@ -1,4 +1,4 @@
-import { St as EventsMap, bt as EventEmitter } from "../devframe-BwfavB78.mjs";
+import { St as EventsMap, bt as EventEmitter } from "../devframe-D-gr9sBx.mjs";
 
 //#region src/utils/events.d.ts
 /**

package/dist/utils/launch-editor.mjs

@@ -1,2 +1,2 @@
-import { t as launchEditor } from "../launch-editor-CgXBgviI.mjs";
+import { t as launchEditor } from "../launch-editor-DPfltGA4.mjs";
 export { launchEditor };

package/dist/utils/shared-state.d.mts

@@ -1,2 +1,2 @@
-import { B as SharedStatePatch, F as ImmutableObject, I as ImmutableSet, L as SharedState, M as Immutable, N as ImmutableArray, P as ImmutableMap, R as SharedStateEvents, V as createSharedState, z as SharedStateOptions } from "../devframe-BwfavB78.mjs";
+import { B as SharedStatePatch, F as ImmutableObject, I as ImmutableSet, L as SharedState, M as Immutable, N as ImmutableArray, P as ImmutableMap, R as SharedStateEvents, V as createSharedState, z as SharedStateOptions } from "../devframe-D-gr9sBx.mjs";
 export { Immutable, ImmutableArray, ImmutableMap, ImmutableObject, ImmutableSet, SharedState, SharedStateEvents, SharedStateOptions, SharedStatePatch, createSharedState };

package/dist/utils/streaming-channel.d.mts

@@ -1,2 +1,2 @@
-import { A as createStreamReader, C as BufferedChunk, D as StreamReader, E as StreamErrorPayload, O as StreamSink, T as CreateStreamSinkOptions, j as createStreamSink, k as StreamSinkEvents, w as CreateStreamReaderOptions } from "../devframe-BwfavB78.mjs";
+import { A as createStreamReader, C as BufferedChunk, D as StreamReader, E as StreamErrorPayload, O as StreamSink, T as CreateStreamSinkOptions, j as createStreamSink, k as StreamSinkEvents, w as CreateStreamReaderOptions } from "../devframe-D-gr9sBx.mjs";
 export { BufferedChunk, CreateStreamReaderOptions, CreateStreamSinkOptions, StreamErrorPayload, StreamReader, StreamSink, StreamSinkEvents, createStreamReader, createStreamSink };

package/dist/{ws-server-BVVMDo2n.d.mts → ws-server-Bc2wBHl-.d.mts}

@@ -57,6 +57,13 @@ interface WsRpcTransportOptions {
   destroyUnmatched?: boolean;
   /** When set, a new https.Server is created and the WS endpoint is attached to it. */
   https?: ServerOptions;
+  /**
+   * Extra origins to accept on the WS upgrade beyond the loopback default.
+   * Add your LAN/tunnel origin here when reaching the tool from another host.
+   * Pass `false` to disable origin checking entirely (not recommended).
+   * Default: loopback-only.
+   */
+  allowedOrigins?: readonly string[] | false;
   /**
    * RPC function definitions, used by the per-call wire serializer to
    * dispatch between strict-JSON and structured-clone encoding based
@@ -88,6 +95,15 @@ interface WsRpcTransport {
    */
   close: () => Promise<void>;
 }
+declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Default origin policy for a localhost dev tool: allow requests with no
+ * `Origin` header (native, non-browser clients), allow any loopback origin
+ * (so cross-port localhost dev setups keep working), and allow explicitly
+ * configured origins. Everything else — a real remote page in the dev's
+ * browser — is rejected.
+ */
+declare function isAllowedOrigin(origin: string | undefined, allowedOrigins: readonly string[]): boolean;
 /**
  * Attach a WebSocket transport to an existing RPC group, powered by
  * [crossws](https://crossws.h3.dev). Either attach to an existing HTTP(S)
@@ -100,4 +116,4 @@ interface WsRpcTransport {
  */
 declare function attachWsRpcTransport<ClientFunctions extends object, ServerFunctions extends object>(rpcGroup: BirpcGroup<ClientFunctions, ServerFunctions, false>, options?: WsRpcTransportOptions): WsRpcTransport;
 //#endregion
-export { attachWsRpcTransport as i, WsRpcTransport as n, WsRpcTransportOptions as r, DevframeNodeRpcSessionMeta as t };
+export { isAllowedOrigin as a, attachWsRpcTransport as i, WsRpcTransport as n, isLoopbackHostname as o, WsRpcTransportOptions as r, DevframeNodeRpcSessionMeta as t };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devframe",
   "type": "module",
-  "version": "0.6.0-beta.1",
+  "version": "0.6.0-beta.2",
   "description": "Framework for building generic devframes",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",