devframe 0.8.0 → 0.8.2

package/dist/helpers/vite.mjs

@@ -1,8 +1,8 @@
 import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_WS_ROUTE } from "../constants.mjs";
-import { t as diagnostics } from "../diagnostics-B5-qHeqD.mjs";
+import { t as diagnostics } from "../diagnostics-D7wM2cwM.mjs";
 import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-bWRzeSa0.mjs";
 import { serveStaticNodeMiddleware } from "../utils/serve-static.mjs";
-import { n as resolveDevServerPort, r as resolveMcpConnectionMeta, t as createDevServer } from "../dev-D4M7Veo7.mjs";
+import { n as resolveDevServerPort, r as resolveMcpConnectionMeta, t as createDevServer } from "../dev-Bc49u3qg.mjs";
 import { resolve } from "pathe";
 //#region src/helpers/vite.ts
 /**
@@ -19,11 +19,11 @@ import { resolve } from "pathe";
 *     host-served SPA can discover the WS endpoint via
 *     {@link connectDevframe}.
 *
-* As a hosted adapter the bridge defers authentication to the host: its
-* side-car RPC server runs with the plugin's own auth gate **off** by
-* default (ignoring `def.cli?.auth`), so a plugin mounted this way never
-* triggers its standalone OTP prompt. Opt back in per-mount with
-* `options.auth` (`true` for devframe's interactive gate, or a handler).
+* The side-car RPC server **gates by default** (devframe's interactive OTP
+* unless the definition's `cli.auth` opts out), printing its code/link banner
+* to stdout, so a bridged devframe isn't silently reachable by anything that
+* can open its socket. Pass `options.auth: false` to opt out for a single-user
+* localhost host, or a {@link DevframeAuthHandler} for a custom scheme.
 *
 * Use bridge mode when integrating with frameworks that own the SPA
 * (Nuxt, Astro, SolidStart, plain Vite apps). For the all-in-one
@@ -58,7 +58,7 @@ function viteDevBridge(d, options = {}) {
 					port,
 					flags: mw.flags,
 					openBrowser: false,
-					auth: options.auth ?? false,
+					auth: options.auth,
 					mcp: options.mcp
 				});
 			} catch (e) {

package/dist/{host-h3-Kz7t5Xab.mjs → host-h3-D2hYZvDK.mjs}

@@ -2,8 +2,8 @@ import { t as devframeReporter } from "./diagnostics-reporter-CsIG85Q5.mjs";
 import { t as diagnostics } from "./diagnostics-hwjXp_UV.mjs";
 import { RpcFunctionsCollectorBase } from "./rpc/index.mjs";
 import { defineRpcFunction } from "./index.mjs";
-import { t as diagnostics$1 } from "./diagnostics-B5-qHeqD.mjs";
-import { i as createEventEmitter, n as createSharedState, r as nanoid, t as createStorage } from "./storage-Dzoc3NVC.mjs";
+import { t as diagnostics$1 } from "./diagnostics-D7wM2cwM.mjs";
+import { i as createEventEmitter, n as createSharedState, r as nanoid, t as createStorage } from "./storage-CTNVbuFB.mjs";
 import { defineDiagnostics } from "nostics";
 import { isatty } from "node:tty";
 import { formatWithOptions, inspect } from "node:util";

package/dist/{http-BghOqfTD.mjs → http-C4T68YV6.mjs}

@@ -1,4 +1,4 @@
-import { t as createMcpFetchHandler } from "./fetch-BZyK4v6W.mjs";
+import { t as createMcpFetchHandler } from "./fetch-BKaD0Vb3.mjs";
 import { defineHandler } from "h3";
 //#region src/adapters/mcp/http.ts
 /**

package/dist/{index-CeBbry0R.d.mts → index-b64Uuhy2.d.mts}

@@ -1,5 +1,5 @@
-import { W as DevframeNodeRpcSession, b as DevframeNodeContext, ht as SharedState } from "./devframe-Dsjn_Xtq.mjs";
-import { n as InternalAnonymousAuthStorage } from "./context-7BbaIUSI.mjs";
+import { W as DevframeNodeRpcSession, b as DevframeNodeContext, ht as SharedState } from "./devframe-mQ4qZAuo.mjs";
+import { n as InternalAnonymousAuthStorage } from "./context-DoSozfvx.mjs";
 //#region src/node/auth/revoke.d.ts
 /**
  * Flip `isTrusted` to false on any live WS clients connected with `token`
@@ -28,10 +28,15 @@ declare function getTempAuthCode(): string;
  */
 declare function refreshTempAuthCode(): string;
 /**
- * Build a "magic link" authentication URL that embeds a one-time code (OTP) as
- * a query parameter. Opening it authenticates the client without typing — print
- * it on startup (devframe stays headless, so the host prints its own banner).
- * Defaults to the current code; the link is subject to the same TTL.
+ * Build a "magic link" authentication URL that embeds a one-time code (OTP) in
+ * the URL **fragment**. Opening it authenticates the client without typing —
+ * print it on startup (devframe stays headless, so the host prints its own
+ * banner). Defaults to the current code; the link is subject to the same TTL.
+ *
+ * The code rides the fragment (`#devframe_otp=…`), not the query string, so it
+ * is never sent to the server, written to an access log, or leaked in a
+ * `Referer` header — the browser client reads it locally (see
+ * `consumeOtpFromUrl`). Any existing fragment parameters are preserved.
  */
 declare function buildOtpAuthUrl(baseUrl: string, code?: string): string;
 /**

package/dist/index.d.mts

@@ -1,7 +1,7 @@
-import { $ as DevframeRpcServerFunctions, A as DevframeSettingsStore, At as DevframeAgentHostEvents, B as DevframeDefineDiagnosticsOptions, C as DevframeServicesHost, Ct as AgentResourceContent, D as DevframeScopedStreamingHost, Dt as AgentToolProvider, E as DevframeScopedNodeRpc, Et as AgentToolInput, F as ScopedSharedStates, G as RpcBroadcastOptions, H as DevframeDiagnosticsHost, I as SettingsForNamespace, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost, M as ScopedClientFunctions, Mt as EventUnsubscribe, N as ScopedRpcFn, Nt as EventsMap, O as DevframeSettings, Ot as AgentToolProviderHandle, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, V as DevframeDiagnosticsDefinition, W as DevframeNodeRpcSession, X as RpcStreamingChannelOptions, Y as RpcStreamingChannel, Z as RpcStreamingHost, _ as ConnectionMeta, a as DevframeDockDefaults, b as DevframeNodeContext, bt as AgentHandle, c as DevframeSetupInfo, d as McpRouteOptions, et as DevframeRpcSharedStates, f as defineDevframe, g as Thenable, h as PartialWithoutId, i as DevframeDeploymentKind, j as ScopedBroadcastOptions, jt as EventEmitter, k as DevframeSettingsRegistry, kt as DevframeAgentHost, l as DevframeSpaOptions, m as EntriesToObject, n as DevframeCliOptions, o as DevframeDuplicationStrategy, q as RpcSharedStateGetOptions, r as DevframeDefinition, s as DevframeRuntime, t as DevframeBrowserContext, u as DevframeWsOptions, v as ConnectionMetaWebsocket, w as DevframeServicesRegistry, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest, y as DevframeCapabilities, z as DevframeStorageScope } from "./devframe-Dsjn_Xtq.mjs";
+import { $ as DevframeRpcServerFunctions, A as DevframeSettingsStore, At as DevframeAgentHostEvents, B as DevframeDefineDiagnosticsOptions, C as DevframeServicesHost, Ct as AgentResourceContent, D as DevframeScopedStreamingHost, Dt as AgentToolProvider, E as DevframeScopedNodeRpc, Et as AgentToolInput, F as ScopedSharedStates, G as RpcBroadcastOptions, H as DevframeDiagnosticsHost, I as SettingsForNamespace, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost, M as ScopedClientFunctions, Mt as EventUnsubscribe, N as ScopedRpcFn, Nt as EventsMap, O as DevframeSettings, Ot as AgentToolProviderHandle, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, V as DevframeDiagnosticsDefinition, W as DevframeNodeRpcSession, X as RpcStreamingChannelOptions, Y as RpcStreamingChannel, Z as RpcStreamingHost, _ as ConnectionMeta, a as DevframeDockDefaults, b as DevframeNodeContext, bt as AgentHandle, c as DevframeSetupInfo, d as McpRouteOptions, et as DevframeRpcSharedStates, f as defineDevframe, g as Thenable, h as PartialWithoutId, i as DevframeDeploymentKind, j as ScopedBroadcastOptions, jt as EventEmitter, k as DevframeSettingsRegistry, kt as DevframeAgentHost, l as DevframeSpaOptions, m as EntriesToObject, n as DevframeCliOptions, o as DevframeDuplicationStrategy, q as RpcSharedStateGetOptions, r as DevframeDefinition, s as DevframeRuntime, t as DevframeBrowserContext, u as DevframeWsOptions, v as ConnectionMetaWebsocket, w as DevframeServicesRegistry, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest, y as DevframeCapabilities, z as DevframeStorageScope } from "./devframe-mQ4qZAuo.mjs";
 import { C as RpcFunctionType, T as RpcReturnSchema, _ as RpcFunctionDefinition, g as RpcFunctionAgentOptions, i as RpcArgsSchema } from "./types-CnJSgRVa.mjs";
 import "./index-Dbw1p5ch.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "./ws-server-D_Vjtums.mjs";
+import { n as DevframeNodeRpcSessionMeta } from "./ws-server-uKQcClcJ.mjs";
 //#region src/define.d.ts
 declare const defineRpcFunction: <NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>) => RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>;
 //#endregion

package/dist/{instance-registry-D6fxYu36.mjs → instance-registry-BnnA2Eoh.mjs}

@@ -1,4 +1,4 @@
-import { t as diagnostics } from "./diagnostics-B5-qHeqD.mjs";
+import { t as diagnostics } from "./diagnostics-D7wM2cwM.mjs";
 import { mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "pathe";
 import process from "node:process";

package/dist/node/auth.d.mts

@@ -1,3 +1,3 @@
-import { p as DevframeAuthHandler } from "../devframe-Dsjn_Xtq.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-CeBbry0R.mjs";
+import { p as DevframeAuthHandler } from "../devframe-mQ4qZAuo.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-b64Uuhy2.mjs";
 export { DevframeAuthHandler, buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/auth.mjs

@@ -1,3 +1,3 @@
-import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-BtQDKTp7.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-WX3HT5a3.mjs";
+import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-DZbJ7Cl0.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-BeUHDDjk.mjs";
 export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,5 +1,5 @@
-import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-Dsjn_Xtq.mjs";
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-7BbaIUSI.mjs";
+import { i as DevframeDeploymentKind, r as DevframeDefinition } from "../devframe-mQ4qZAuo.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-DoSozfvx.mjs";
 //#region src/adapters/_shared.d.ts
 /**
  * Resolve the mount base path for a devframe's SPA. Hosted adapters

package/dist/node/hub-internals.mjs

@@ -1,3 +1,3 @@
-import { n as internalContextMap, t as getInternalContext } from "../context-C9Cgm1hP.mjs";
+import { n as internalContextMap, t as getInternalContext } from "../context-CBg8iRbQ.mjs";
 import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-bWRzeSa0.mjs";
 export { getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/index.d.mts

@@ -1,7 +1,7 @@
-import { At as DevframeAgentHostEvents, C as DevframeServicesHost, Ct as AgentResourceContent, Dt as AgentToolProvider, Et as AgentToolInput, H as DevframeDiagnosticsHost$1, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost$1, O as DevframeSettings, Ot as AgentToolProviderHandle, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, Z as RpcStreamingHost, b as DevframeNodeContext, bt as AgentHandle, ht as SharedState, jt as EventEmitter, kt as DevframeAgentHost$1, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest } from "../devframe-Dsjn_Xtq.mjs";
+import { At as DevframeAgentHostEvents, C as DevframeServicesHost, Ct as AgentResourceContent, Dt as AgentToolProvider, Et as AgentToolInput, H as DevframeDiagnosticsHost$1, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost$1, O as DevframeSettings, Ot as AgentToolProviderHandle, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, Z as RpcStreamingHost, b as DevframeNodeContext, bt as AgentHandle, ht as SharedState, jt as EventEmitter, kt as DevframeAgentHost$1, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest } from "../devframe-mQ4qZAuo.mjs";
 import { v as RpcFunctionDefinitionAny } from "../types-CnJSgRVa.mjs";
 import "../index-Dbw1p5ch.mjs";
-import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-VLQJouOO.mjs";
+import { n as StartedServer, r as startHttpAndWs, t as StartHttpAndWsOptions } from "../server-UHWae43Q.mjs";
 import { BirpcGroup } from "birpc";
 //#region src/node/agent-args.d.ts
 /**
@@ -232,6 +232,26 @@ interface DevframeInstanceRegistration {
 declare function registerDevframeInstance(record: DevframeInstanceRecord, options?: {
   instancesDir?: string;
 }): DevframeInstanceRegistration;
+/**
+ * Read the registry and split records into live and dead by probing each
+ * one's `__connection.json`, deleting dead records (prune-on-read). Live
+ * records carry the dialable origin the probe confirmed (a `localhost`
+ * record may come back as `127.0.0.1` / `[::1]`).
+ *
+ * A liveness probe only proves *something* answers on the record's port, so
+ * records left behind by killed processes shadow the server currently bound
+ * there: per `(port, basePath)` only the newest record survives, older
+ * ghosts are pruned with the dead.
+ *
+ * @experimental
+ */
+declare function listLiveDevframeInstances(options?: {
+  instancesDir?: string;
+  timeoutMs?: number;
+}): Promise<{
+  live: DevframeInstanceRecord[];
+  pruned: DevframeInstanceRecord[];
+}>;
 //#endregion
 //#region src/node/rpc-shared-state.d.ts
 declare function createRpcSharedStateServerHost(rpc: RpcFunctionsHost): RpcSharedStateHost;
@@ -278,4 +298,4 @@ declare function toDialableHost(host: string): string;
 declare function formatHostForUrl(host: string): string;
 declare function normalizeHttpServerUrl(host: string, port: number | string): string;
 //#endregion
-export { AgentArgsFallback, CreateH3DevframeHostOptions, CreateHostContextOptions, CreateStorageOptions, DevframeAgentHost, DevframeDiagnosticsHost, type DevframeInstanceRecord, type DevframeInstanceRegistration, DevframeServicesHostImpl, DevframeViewHost, type RpcFunctionsHost, StartHttpAndWsOptions, StartedServer, coerceAgentPositionalArgs, createH3DevframeHost, createHostContext, createNodeSettings, createRpcSharedStateServerHost, createRpcStreamingServerHost, createScopedNodeContext, createStorage, formatHostForUrl, isObject, normalizeHttpServerUrl, registerDevframeInstance, startHttpAndWs, toDialableHost };
+export { AgentArgsFallback, CreateH3DevframeHostOptions, CreateHostContextOptions, CreateStorageOptions, DevframeAgentHost, DevframeDiagnosticsHost, type DevframeInstanceRecord, type DevframeInstanceRegistration, DevframeServicesHostImpl, DevframeViewHost, type RpcFunctionsHost, StartHttpAndWsOptions, StartedServer, coerceAgentPositionalArgs, createH3DevframeHost, createHostContext, createNodeSettings, createRpcSharedStateServerHost, createRpcStreamingServerHost, createScopedNodeContext, createStorage, formatHostForUrl, isObject, listLiveDevframeInstances, normalizeHttpServerUrl, registerDevframeInstance, startHttpAndWs, toDialableHost };

package/dist/node/index.mjs

@@ -1,5 +1,5 @@
-import { a as DevframeViewHost, c as createRpcSharedStateServerHost, d as coerceAgentPositionalArgs, i as createNodeSettings, l as DevframeDiagnosticsHost, n as createHostContext, o as DevframeServicesHostImpl, r as createScopedNodeContext, s as createRpcStreamingServerHost, t as createH3DevframeHost, u as DevframeAgentHost } from "../host-h3-Kz7t5Xab.mjs";
-import { t as createStorage } from "../storage-Dzoc3NVC.mjs";
-import { r as registerDevframeInstance } from "../instance-registry-D6fxYu36.mjs";
-import { a as toDialableHost, i as normalizeHttpServerUrl, n as formatHostForUrl, r as isObject, t as startHttpAndWs } from "../server-CcAPxuoT.mjs";
-export { DevframeAgentHost, DevframeDiagnosticsHost, DevframeServicesHostImpl, DevframeViewHost, coerceAgentPositionalArgs, createH3DevframeHost, createHostContext, createNodeSettings, createRpcSharedStateServerHost, createRpcStreamingServerHost, createScopedNodeContext, createStorage, formatHostForUrl, isObject, normalizeHttpServerUrl, registerDevframeInstance, startHttpAndWs, toDialableHost };
+import { a as DevframeViewHost, c as createRpcSharedStateServerHost, d as coerceAgentPositionalArgs, i as createNodeSettings, l as DevframeDiagnosticsHost, n as createHostContext, o as DevframeServicesHostImpl, r as createScopedNodeContext, s as createRpcStreamingServerHost, t as createH3DevframeHost, u as DevframeAgentHost } from "../host-h3-D2hYZvDK.mjs";
+import { t as createStorage } from "../storage-CTNVbuFB.mjs";
+import { r as registerDevframeInstance, t as listLiveDevframeInstances } from "../instance-registry-BnnA2Eoh.mjs";
+import { a as toDialableHost, i as normalizeHttpServerUrl, n as formatHostForUrl, r as isObject, t as startHttpAndWs } from "../server-CD8XmBXl.mjs";
+export { DevframeAgentHost, DevframeDiagnosticsHost, DevframeServicesHostImpl, DevframeViewHost, coerceAgentPositionalArgs, createH3DevframeHost, createHostContext, createNodeSettings, createRpcSharedStateServerHost, createRpcStreamingServerHost, createScopedNodeContext, createStorage, formatHostForUrl, isObject, listLiveDevframeInstances, normalizeHttpServerUrl, registerDevframeInstance, startHttpAndWs, toDialableHost };

package/dist/recipes/common-rpc-functions.d.mts

@@ -1,4 +1,4 @@
-import "../devframe-Dsjn_Xtq.mjs";
+import "../devframe-mQ4qZAuo.mjs";
 import { E as Thenable, S as RpcFunctionSetupResult, c as RpcDump, g as RpcFunctionAgentOptions } from "../types-CnJSgRVa.mjs";
 import "../index-Dbw1p5ch.mjs";
 import { t as SimpleSchema } from "../simple-schema-BDzLeJDk.mjs";

package/dist/recipes/interactive-auth.d.mts

@@ -1,5 +1,5 @@
-import { b as DevframeNodeContext, p as DevframeAuthHandler } from "../devframe-Dsjn_Xtq.mjs";
-import "../index-CeBbry0R.mjs";
+import { b as DevframeNodeContext, p as DevframeAuthHandler } from "../devframe-mQ4qZAuo.mjs";
+import "../index-b64Uuhy2.mjs";
 //#region src/recipes/interactive-auth.d.ts
 interface CreateInteractiveAuthOptions {
   /**

package/dist/recipes/interactive-auth.mjs

@@ -1,8 +1,8 @@
 import { n as colors } from "../diagnostics-reporter-CsIG85Q5.mjs";
 import { isAnonymousRpcMethod } from "../constants.mjs";
 import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
-import { t as getInternalContext } from "../context-C9Cgm1hP.mjs";
-import { a as verifyAuthToken, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-WX3HT5a3.mjs";
+import { t as getInternalContext } from "../context-CBg8iRbQ.mjs";
+import { a as verifyAuthToken, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-BeUHDDjk.mjs";
 import { t as s } from "../simple-schema-DQPZrAaZ.mjs";
 //#region src/recipes/interactive-auth.ts
 function defaultBanner(info) {
@@ -107,16 +107,24 @@ function createInteractiveAuth(context, options = {}) {
 	}
 	function onConnect(peer, session) {
 		let token;
+		let requestOrigin;
 		try {
 			token = new URL(peer.request?.url ?? "", "http://localhost").searchParams.get("devframe_auth_token") ?? void 0;
 		} catch {}
+		try {
+			requestOrigin = peer.request?.headers?.get?.("origin") ?? void 0;
+		} catch {}
 		if (!token) return;
 		if (isStaticToken(token)) {
 			session.meta.clientAuthToken = token;
 			session.meta.isTrusted = true;
 			return;
 		}
-		verifyAuthToken(token, session, storage);
+		if (verifyAuthToken(token, session, storage)) return;
+		if (internal.isRemoteTokenTrusted(token, requestOrigin)) {
+			session.meta.clientAuthToken = token;
+			session.meta.isTrusted = true;
+		}
 	}
 	function buildOpenUrl(url) {
 		return buildOtpAuthUrl(url);

package/dist/revoke-DZbJ7Cl0.mjs

@@ -0,0 +1,35 @@
+//#region src/node/auth/revoke.ts
+/**
+* Flip `isTrusted` to false on any live WS clients connected with `token`
+* and broadcast the `auth:revoked` event so they can react.
+*
+* Shared between persisted-auth revocation and remote-dock token revocation.
+*/
+async function revokeActiveConnectionsForToken(context, token) {
+	const rpcHost = context.rpc;
+	if (!rpcHost?._rpcGroup) return;
+	const affectedSessionIds = /* @__PURE__ */ new Set();
+	for (const client of rpcHost._rpcGroup.clients) if (client.$meta.clientAuthToken === token) {
+		affectedSessionIds.add(client.$meta.id);
+		client.$meta.isTrusted = false;
+		client.$meta.clientAuthToken = void 0;
+	}
+	if (affectedSessionIds.size === 0) return;
+	await rpcHost.broadcast({
+		method: "devframe:auth:revoked",
+		args: [],
+		filter: (client) => affectedSessionIds.has(client.$meta.id)
+	});
+}
+/**
+* Revoke an auth token: remove from storage and notify all connected clients
+* using this token that they are no longer trusted.
+*/
+async function revokeAuthToken(context, storage, token) {
+	storage.mutate((state) => {
+		delete state.trusted[token];
+	});
+	await revokeActiveConnectionsForToken(context, token);
+}
+//#endregion
+export { revokeAuthToken as n, revokeActiveConnectionsForToken as t };

package/dist/rpc/transports/ws-server.d.mts

@@ -1,2 +1,2 @@
-import { a as isAllowedOrigin, i as attachWsRpcTransport, n as WsRpcTransport, o as isLoopbackHostname, r as WsRpcTransportOptions, t as DevframeNodeRpcSessionMeta } from "../../ws-server-D_Vjtums.mjs";
-export { DevframeNodeRpcSessionMeta, WsRpcTransport, WsRpcTransportOptions, attachWsRpcTransport, isAllowedOrigin, isLoopbackHostname };
+import { a as WsRpcTransportOptions, c as isAllowedOrigin, i as WsRpcTransport, l as isLoopbackHostname, n as DevframeNodeRpcSessionMeta, o as attachWsRpcTransport, r as WsOriginRegistry, s as createWsOriginRegistry, t as CreateWsOriginRegistryOptions } from "../../ws-server-uKQcClcJ.mjs";
+export { CreateWsOriginRegistryOptions, DevframeNodeRpcSessionMeta, WsOriginRegistry, WsRpcTransport, WsRpcTransportOptions, attachWsRpcTransport, createWsOriginRegistry, isAllowedOrigin, isLoopbackHostname };

package/dist/rpc/transports/ws-server.mjs

@@ -1,12 +1,70 @@
+import "../../constants.mjs";
 import { n as strictJsonStringify } from "../../serialization-C8Mnw9hK.mjs";
 import { n as structuredCloneStringify, t as structuredCloneParse } from "../../structured-clone-CbAV5rFI.mjs";
+import { n as randomToken, r as timingSafeEqual } from "../../crypto-token-XCqTSMg9.mjs";
 import { createServer } from "node:http";
 import { createServer as createServer$1 } from "node:https";
 import crossws from "crossws/adapters/node";
 //#region src/rpc/transports/ws-server.ts
+/**
+* Create a live, token-protected origin allowlist for external browser
+* viewers. Pass it to {@link WsRpcTransportOptions.allowedOrigins}, then use
+* `registerFromUrl()` in the connection metadata handler to authorize a
+* viewer without sharing a mutable array or disabling DNS-rebinding protection.
+*/
+function createWsOriginRegistry(options = {}) {
+	const token = randomToken();
+	const origins = new Set(options.allowedOrigins ?? []);
+	function normalizeOrigin(origin) {
+		if (!origin) return;
+		try {
+			const url = new URL(origin);
+			const normalized = url.origin === "null" ? `${url.protocol}//${url.host}` : url.origin;
+			return origin === normalized ? normalized : void 0;
+		} catch {}
+	}
+	function registerOrigin(origin, candidateToken) {
+		const normalized = normalizeOrigin(origin);
+		if (!normalized || !candidateToken || !timingSafeEqual(token, candidateToken)) return false;
+		if (options.validateOrigin && !options.validateOrigin(normalized)) return false;
+		origins.add(normalized);
+		return true;
+	}
+	return {
+		token,
+		registerFromUrl(url) {
+			let parsed;
+			try {
+				parsed = new URL(url, "http://localhost");
+			} catch {
+				return;
+			}
+			const origin = parsed.searchParams.get("devframe_viewer_origin") ?? void 0;
+			return registerOrigin(origin, parsed.searchParams.get("devframe_viewer_origin_token") ?? void 0) ? origin : void 0;
+		},
+		isAllowed(origin) {
+			return isAllowedOrigin(origin, [...origins]);
+		}
+	};
+}
 let sessionId = 0;
 const EMPTY_DEFS = /* @__PURE__ */ new Map();
 function NOOP() {}
+function listen(server, port, host) {
+	return new Promise((resolve, reject) => {
+		const onError = (error) => reject(error);
+		server.once("error", onError);
+		try {
+			server.listen(port, host, () => {
+				server.off("error", onError);
+				resolve();
+			});
+		} catch (error) {
+			server.off("error", onError);
+			reject(error);
+		}
+	});
+}
 /** Compare two URL paths ignoring a trailing slash. */
 function pathMatches(a, b) {
 	const strip = (p) => p.length > 1 && p.endsWith("/") ? p.slice(0, -1) : p;
@@ -32,6 +90,9 @@ function isAllowedOrigin(origin, allowedOrigins) {
 		return false;
 	}
 }
+function isWsOriginRegistry(value) {
+	return !!value && !Array.isArray(value);
+}
 /**
 * Route `upgrade` events on a server to the crossws adapter, optionally
 * filtered to a single `path`. Non-matching requests are left untouched so
@@ -55,7 +116,8 @@ function routeUpgrades(server, ws, path, destroyUnmatched, allowedOrigins) {
 				return;
 			}
 		}
-		if (allowedOrigins !== false && !isAllowedOrigin(req.headers.origin, allowedOrigins ?? [])) {
+		const originAllowed = isWsOriginRegistry(allowedOrigins) ? allowedOrigins.isAllowed(req.headers.origin) : isAllowedOrigin(req.headers.origin, allowedOrigins || []);
+		if (allowedOrigins !== false && !originAllowed) {
 			socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
 			socket.destroy();
 			return;
@@ -71,9 +133,9 @@ function routeUpgrades(server, ws, path, destroyUnmatched, allowedOrigins) {
 * `server` (sharing its port, optionally scoped to a `path`), or let this
 * helper create a standalone server from `port` / `host` / `https`.
 *
-* Returns the crossws node adapter plus `detach` (remove the upgrade
-* listener from a shared `server`) and `close` (full deterministic
-* teardown).
+* Returns the crossws node adapter, standalone-server readiness/address
+* accessors, `detach` (remove the upgrade listener from a shared `server`),
+* and `close` (full deterministic teardown).
 */
 function attachWsRpcTransport(rpcGroup, options = {}) {
 	const { server, port, host = "localhost", path, destroyUnmatched = false, https, allowedOrigins, onConnected = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS, serialize: serializeOverride, deserialize: deserializeOverride } = options;
@@ -136,32 +198,38 @@ function attachWsRpcTransport(rpcGroup, options = {}) {
 		}
 	} });
 	let detach = NOOP;
+	let ready = Promise.resolve();
 	let ownedServer;
 	if (server) detach = routeUpgrades(server, ws, path, destroyUnmatched, allowedOrigins);
 	else if (https) {
 		ownedServer = createServer$1(https);
 		detach = routeUpgrades(ownedServer, ws, path, true, allowedOrigins);
-		ownedServer.listen(port, host);
+		ready = listen(ownedServer, port ?? 0, host);
 	} else {
 		ownedServer = createServer((_req, res) => {
 			res.writeHead(426, { "content-type": "text/plain" });
 			res.end("Upgrade Required");
 		});
 		detach = routeUpgrades(ownedServer, ws, path, true, allowedOrigins);
-		ownedServer.listen(port, host);
+		ready = listen(ownedServer, port ?? 0, host);
 	}
+	const activeServer = server ?? ownedServer;
 	return {
 		ws,
+		ready,
+		address: () => activeServer?.address() ?? null,
 		detach,
 		async close() {
 			detach();
 			ws.closeAll(void 0, void 0, true);
 			if (ownedServer) {
 				const srv = ownedServer;
+				await ready.catch(() => {});
+				if (!srv.listening) return;
 				await new Promise((r) => srv.close(() => r()));
 			}
 		}
 	};
 }
 //#endregion
-export { attachWsRpcTransport, isAllowedOrigin, isLoopbackHostname };
+export { attachWsRpcTransport, createWsOriginRegistry, isAllowedOrigin, isLoopbackHostname };

package/dist/{server-CcAPxuoT.mjs → server-CD8XmBXl.mjs}

@@ -1,7 +1,7 @@
 import { createRpcServer } from "./rpc/server.mjs";
 import { attachWsRpcTransport } from "./rpc/transports/ws-server.mjs";
-import { t as diagnostics } from "./diagnostics-B5-qHeqD.mjs";
-import { t as getInternalContext } from "./context-C9Cgm1hP.mjs";
+import { t as diagnostics } from "./diagnostics-D7wM2cwM.mjs";
+import { t as getInternalContext } from "./context-CBg8iRbQ.mjs";
 import { createServer } from "node:http";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { H3, toNodeHandler } from "h3";
@@ -87,7 +87,8 @@ async function startHttpAndWs(options) {
 			authHandler?.onConnect(peer, session);
 			options.onPeerConnect?.(peer, session);
 		} : void 0,
-		onDisconnected: (_peer, meta) => {
+		onDisconnected: (peer, meta) => {
+			options.onPeerDisconnect?.(peer, meta);
 			rpcHost._emitSessionDisconnected(meta);
 		}
 	});
@@ -103,9 +104,27 @@ async function startHttpAndWs(options) {
 			return { isTrusted: true };
 		}
 	});
-	if (ownsHttpServer) await new Promise((resolveListen) => {
-		httpServer.listen(port, bindHost, () => resolveListen());
-	});
+	if (ownsHttpServer) {
+		try {
+			await new Promise((resolve, reject) => {
+				const onError = (error) => reject(error);
+				httpServer.once("error", onError);
+				httpServer.listen(port, bindHost, () => {
+					httpServer.removeListener("error", onError);
+					resolve();
+				});
+			});
+		} catch (error) {
+			await closeWs().catch(() => {});
+			throw diagnostics.DF0052({
+				host: bindHost,
+				port,
+				reason: error instanceof Error ? error.message : String(error),
+				cause: error
+			});
+		}
+		if (options.onServerError) httpServer.on("error", options.onServerError);
+	}
 	const address = httpServer.address();
 	const resolvedPort = typeof address === "object" && address ? address.port : port;
 	const origin = normalizeHttpServerUrl(bindHost, resolvedPort);

package/dist/{server-VLQJouOO.d.mts → server-UHWae43Q.d.mts}

@@ -1,5 +1,6 @@
-import { $ as DevframeRpcServerFunctions, Q as DevframeRpcClientFunctions, W as DevframeNodeRpcSession, _ as ConnectionMeta, b as DevframeNodeContext, p as DevframeAuthHandler } from "./devframe-Dsjn_Xtq.mjs";
-import "./index-CeBbry0R.mjs";
+import { $ as DevframeRpcServerFunctions, Q as DevframeRpcClientFunctions, W as DevframeNodeRpcSession, _ as ConnectionMeta, b as DevframeNodeContext, p as DevframeAuthHandler } from "./devframe-mQ4qZAuo.mjs";
+import { n as DevframeNodeRpcSessionMeta, r as WsOriginRegistry } from "./ws-server-uKQcClcJ.mjs";
+import "./index-b64Uuhy2.mjs";
 import { Peer } from "crossws";
 import { BirpcGroup, EventOptions } from "birpc";
 import { NodeAdapter } from "crossws/adapters/node";
@@ -73,6 +74,13 @@ interface StartHttpAndWsOptions {
    * observe — but not override — the connect-time trust decision.
    */
   onPeerConnect?: (peer: Peer, session: DevframeNodeRpcSession) => void;
+  /**
+   * Called once per closed WS connection, right after the transport's own
+   * disconnect bookkeeping runs. Unlike {@link onPeerConnect} this receives
+   * the raw session meta, not a wrapped session — by the time a peer
+   * disconnects there is no live RPC client left to attach.
+   */
+  onPeerDisconnect?: (peer: Peer, meta: DevframeNodeRpcSessionMeta) => void;
   /**
    * Forwarded verbatim to the internal `createRpcServer`'s birpc
    * `rpcOptions`, alongside the resolver `startHttpAndWs` installs for
@@ -91,7 +99,7 @@ interface StartHttpAndWsOptions {
    * from another host. Pass `false` to disable origin checking entirely
    * (not recommended). Default: loopback-only.
    */
-  allowedOrigins?: readonly string[] | false;
+  allowedOrigins?: readonly string[] | WsOriginRegistry | false;
   /**
    * Called once the WS server is bound so callers can mount static
    * handlers whose origin depends on the resolved port, or print their
@@ -102,6 +110,16 @@ interface StartHttpAndWsOptions {
     port: number;
     app: H3;
   }) => void | Promise<void>;
+  /**
+   * Called for any error the HTTP server devframe owns emits after it starts
+   * listening — e.g. a transient `EMFILE` while accepting a connection.
+   * Without it such an error has no listener and crashes the process.
+   *
+   * Applies only to a server devframe created itself. When `server` is
+   * supplied the caller owns that object and attaches to it directly, so
+   * devframe leaves its error handling alone.
+   */
+  onServerError?: (error: Error) => void;
 }
 interface StartedServer {
   /** Listening origin, e.g. `http://localhost:9999`. */

package/dist/{state-WX3HT5a3.mjs → state-BeUHDDjk.mjs}

@@ -1,5 +1,5 @@
 import { DEVFRAME_OTP_URL_PARAM } from "./constants.mjs";
-import { a as timingSafeEqual, i as randomToken, r as randomDigits } from "./revoke-BtQDKTp7.mjs";
+import { n as randomToken, r as timingSafeEqual, t as randomDigits } from "./crypto-token-XCqTSMg9.mjs";
 //#region src/node/auth/state.ts
 /** Number of decimal digits in a human-typed one-time authentication code. */
 const TEMP_AUTH_CODE_LENGTH = 6;
@@ -37,14 +37,21 @@ function refreshTempAuthCode() {
 	return tempAuthCode;
 }
 /**
-* Build a "magic link" authentication URL that embeds a one-time code (OTP) as
-* a query parameter. Opening it authenticates the client without typing — print
-* it on startup (devframe stays headless, so the host prints its own banner).
-* Defaults to the current code; the link is subject to the same TTL.
+* Build a "magic link" authentication URL that embeds a one-time code (OTP) in
+* the URL **fragment**. Opening it authenticates the client without typing —
+* print it on startup (devframe stays headless, so the host prints its own
+* banner). Defaults to the current code; the link is subject to the same TTL.
+*
+* The code rides the fragment (`#devframe_otp=…`), not the query string, so it
+* is never sent to the server, written to an access log, or leaked in a
+* `Referer` header — the browser client reads it locally (see
+* `consumeOtpFromUrl`). Any existing fragment parameters are preserved.
 */
 function buildOtpAuthUrl(baseUrl, code = tempAuthCode) {
 	const url = new URL(baseUrl);
-	url.searchParams.set(DEVFRAME_OTP_URL_PARAM, code);
+	const fragment = new URLSearchParams(url.hash.replace(/^#/, ""));
+	fragment.set(DEVFRAME_OTP_URL_PARAM, code);
+	url.hash = fragment.toString();
 	return url.href;
 }
 /**

package/dist/{storage-Dzoc3NVC.mjs → storage-CTNVbuFB.mjs}

@@ -1,4 +1,4 @@
-import { t as diagnostics } from "./diagnostics-B5-qHeqD.mjs";
+import { t as diagnostics } from "./diagnostics-D7wM2cwM.mjs";
 import fs from "node:fs";
 import { dirname } from "pathe";
 import process$1 from "node:process";

package/dist/types/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as DevframeRpcServerFunctions, A as DevframeSettingsStore, At as DevframeAgentHostEvents, B as DevframeDefineDiagnosticsOptions, C as DevframeServicesHost, Ct as AgentResourceContent, D as DevframeScopedStreamingHost, Dt as AgentToolProvider, E as DevframeScopedNodeRpc, Et as AgentToolInput, F as ScopedSharedStates, G as RpcBroadcastOptions, H as DevframeDiagnosticsHost, I as SettingsForNamespace, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost, M as ScopedClientFunctions, Mt as EventUnsubscribe, N as ScopedRpcFn, Nt as EventsMap, O as DevframeSettings, Ot as AgentToolProviderHandle, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, V as DevframeDiagnosticsDefinition, W as DevframeNodeRpcSession, X as RpcStreamingChannelOptions, Y as RpcStreamingChannel, Z as RpcStreamingHost, _ as ConnectionMeta, a as DevframeDockDefaults, b as DevframeNodeContext, bt as AgentHandle, c as DevframeSetupInfo, d as McpRouteOptions, et as DevframeRpcSharedStates, f as defineDevframe, g as Thenable, h as PartialWithoutId, i as DevframeDeploymentKind, j as ScopedBroadcastOptions, jt as EventEmitter, k as DevframeSettingsRegistry, kt as DevframeAgentHost, l as DevframeSpaOptions, m as EntriesToObject, n as DevframeCliOptions, o as DevframeDuplicationStrategy, q as RpcSharedStateGetOptions, r as DevframeDefinition, s as DevframeRuntime, t as DevframeBrowserContext, u as DevframeWsOptions, v as ConnectionMetaWebsocket, w as DevframeServicesRegistry, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest, y as DevframeCapabilities, z as DevframeStorageScope } from "../devframe-Dsjn_Xtq.mjs";
+import { $ as DevframeRpcServerFunctions, A as DevframeSettingsStore, At as DevframeAgentHostEvents, B as DevframeDefineDiagnosticsOptions, C as DevframeServicesHost, Ct as AgentResourceContent, D as DevframeScopedStreamingHost, Dt as AgentToolProvider, E as DevframeScopedNodeRpc, Et as AgentToolInput, F as ScopedSharedStates, G as RpcBroadcastOptions, H as DevframeDiagnosticsHost, I as SettingsForNamespace, J as RpcSharedStateHost, K as RpcFunctionsHost, L as DevframeViewHost, M as ScopedClientFunctions, Mt as EventUnsubscribe, N as ScopedRpcFn, Nt as EventsMap, O as DevframeSettings, Ot as AgentToolProviderHandle, P as ScopedServerFunctions, Q as DevframeRpcClientFunctions, R as DevframeHost, S as DevframeServiceOf, St as AgentResource, T as DevframeScopedNodeContext, Tt as AgentTool, U as DevframeDiagnosticsLogger, V as DevframeDiagnosticsDefinition, W as DevframeNodeRpcSession, X as RpcStreamingChannelOptions, Y as RpcStreamingChannel, Z as RpcStreamingHost, _ as ConnectionMeta, a as DevframeDockDefaults, b as DevframeNodeContext, bt as AgentHandle, c as DevframeSetupInfo, d as McpRouteOptions, et as DevframeRpcSharedStates, f as defineDevframe, g as Thenable, h as PartialWithoutId, i as DevframeDeploymentKind, j as ScopedBroadcastOptions, jt as EventEmitter, k as DevframeSettingsRegistry, kt as DevframeAgentHost, l as DevframeSpaOptions, m as EntriesToObject, n as DevframeCliOptions, o as DevframeDuplicationStrategy, q as RpcSharedStateGetOptions, r as DevframeDefinition, s as DevframeRuntime, t as DevframeBrowserContext, u as DevframeWsOptions, v as ConnectionMetaWebsocket, w as DevframeServicesRegistry, wt as AgentResourceInput, x as DevframeServiceId, xt as AgentManifest, y as DevframeCapabilities, z as DevframeStorageScope } from "../devframe-mQ4qZAuo.mjs";
 import { g as RpcFunctionAgentOptions } from "../types-CnJSgRVa.mjs";
-import { t as DevframeNodeRpcSessionMeta } from "../ws-server-D_Vjtums.mjs";
+import { n as DevframeNodeRpcSessionMeta } from "../ws-server-uKQcClcJ.mjs";
 export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, AgentToolProvider, AgentToolProviderHandle, ConnectionMeta, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeBrowserContext, DevframeCapabilities, DevframeCliOptions, DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsDefinition, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDockDefaults, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, DevframeRpcServerFunctions, DevframeRpcSharedStates, DevframeRuntime, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeServiceId, DevframeServiceOf, DevframeServicesHost, DevframeServicesRegistry, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSpaOptions, DevframeStorageScope, DevframeViewHost, DevframeWsOptions, EntriesToObject, EventEmitter, EventUnsubscribe, EventsMap, McpRouteOptions, PartialWithoutId, RpcBroadcastOptions, type RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedRpcFn, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, Thenable, defineDevframe };

package/dist/utils/events.d.mts

@@ -1,4 +1,4 @@
-import { Nt as EventsMap, jt as EventEmitter } from "../devframe-Dsjn_Xtq.mjs";
+import { Nt as EventsMap, jt as EventEmitter } from "../devframe-mQ4qZAuo.mjs";
 //#region src/utils/events.d.ts
 /**
  * Create event emitter.

package/dist/utils/shared-state.d.mts

@@ -1,2 +1,2 @@
-import { _t as SharedStateOptions, dt as ImmutableArray, ft as ImmutableMap, gt as SharedStateEvents, ht as SharedState, mt as ImmutableSet, pt as ImmutableObject, ut as Immutable, vt as SharedStatePatch, yt as createSharedState } from "../devframe-Dsjn_Xtq.mjs";
+import { _t as SharedStateOptions, dt as ImmutableArray, ft as ImmutableMap, gt as SharedStateEvents, ht as SharedState, mt as ImmutableSet, pt as ImmutableObject, ut as Immutable, vt as SharedStatePatch, yt as createSharedState } from "../devframe-mQ4qZAuo.mjs";
 export { Immutable, ImmutableArray, ImmutableMap, ImmutableObject, ImmutableSet, SharedState, SharedStateEvents, SharedStateOptions, SharedStatePatch, createSharedState };

package/dist/utils/streaming-channel.d.mts

@@ -1,2 +1,2 @@
-import { at as StreamReader, ct as createStreamReader, it as StreamErrorPayload, lt as createStreamSink, nt as CreateStreamReaderOptions, ot as StreamSink, rt as CreateStreamSinkOptions, st as StreamSinkEvents, tt as BufferedChunk } from "../devframe-Dsjn_Xtq.mjs";
+import { at as StreamReader, ct as createStreamReader, it as StreamErrorPayload, lt as createStreamSink, nt as CreateStreamReaderOptions, ot as StreamSink, rt as CreateStreamSinkOptions, st as StreamSinkEvents, tt as BufferedChunk } from "../devframe-mQ4qZAuo.mjs";
 export { BufferedChunk, CreateStreamReaderOptions, CreateStreamSinkOptions, StreamErrorPayload, StreamReader, StreamSink, StreamSinkEvents, createStreamReader, createStreamSink };