devframe 0.9.0-beta.4 → 0.9.0-beta.6

package/dist/constants.d.mts

@@ -39,7 +39,6 @@ declare const DEVFRAME_SSE_SESSION_HEADER = "x-birpc-session";
 declare const DEVFRAME_MCP_ROUTE = "__mcp";
 declare const DEVFRAME_RPC_DUMP_MANIFEST_FILENAME = "__rpc-dump/index.json";
 declare const DEVFRAME_DOCK_IMPORTS_FILENAME = "__client-imports.js";
-declare const DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID = "/__devframe-client-imports.js";
 declare const DEVFRAME_RPC_DUMP_DIRNAME = "__rpc-dump";
 /**
  * URL fragment / query parameter name carrying the remote dock
@@ -86,4 +85,4 @@ declare const ANONYMOUS_RPC_PREFIX = "anonymous:";
  */
 declare function isAnonymousRpcMethod(name: string): boolean;
 //#endregion
-export { ANONYMOUS_RPC_PREFIX, DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_CONNECTION_KEY, DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID, DEVFRAME_MCP_ROUTE, DEVFRAME_OTP_URL_PARAM, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME, DEVFRAME_SSE_ROUTE, DEVFRAME_SSE_SESSION_HEADER, DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM, DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM, DEVFRAME_WS_ROUTE, REMOTE_CONNECTION_KEY, isAnonymousRpcMethod };
+export { ANONYMOUS_RPC_PREFIX, DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_CONNECTION_KEY, DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_MCP_ROUTE, DEVFRAME_OTP_URL_PARAM, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME, DEVFRAME_SSE_ROUTE, DEVFRAME_SSE_SESSION_HEADER, DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM, DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM, DEVFRAME_WS_ROUTE, REMOTE_CONNECTION_KEY, isAnonymousRpcMethod };

package/dist/constants.mjs

@@ -39,7 +39,6 @@ const DEVFRAME_SSE_SESSION_HEADER = "x-birpc-session";
 const DEVFRAME_MCP_ROUTE = "__mcp";
 const DEVFRAME_RPC_DUMP_MANIFEST_FILENAME = "__rpc-dump/index.json";
 const DEVFRAME_DOCK_IMPORTS_FILENAME = "__client-imports.js";
-const DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID = "/__devframe-client-imports.js";
 const DEVFRAME_RPC_DUMP_DIRNAME = "__rpc-dump";
 /**
 * URL fragment / query parameter name carrying the remote dock
@@ -88,4 +87,4 @@ function isAnonymousRpcMethod(name) {
 	return name.startsWith(ANONYMOUS_RPC_PREFIX);
 }
 //#endregion
-export { ANONYMOUS_RPC_PREFIX, DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_CONNECTION_KEY, DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_DOCK_IMPORTS_VIRTUAL_ID, DEVFRAME_MCP_ROUTE, DEVFRAME_OTP_URL_PARAM, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME, DEVFRAME_SSE_ROUTE, DEVFRAME_SSE_SESSION_HEADER, DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM, DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM, DEVFRAME_WS_ROUTE, REMOTE_CONNECTION_KEY, isAnonymousRpcMethod };
+export { ANONYMOUS_RPC_PREFIX, DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_CONNECTION_KEY, DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_MCP_ROUTE, DEVFRAME_OTP_URL_PARAM, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME, DEVFRAME_SSE_ROUTE, DEVFRAME_SSE_SESSION_HEADER, DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM, DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM, DEVFRAME_WS_ROUTE, REMOTE_CONNECTION_KEY, isAnonymousRpcMethod };

package/dist/{context-DV4uWieM.d.mts → context-CQkRTbAc.d.mts}

@@ -1,4 +1,4 @@
-import { S as DevframeNodeContext, _t as SharedState } from "./devframe-5oblos7I.mjs";
+import { g as DevframeNodeContext, ut as SharedState } from "./devframe-Cfx6doi4.mjs";
 //#region src/node/hub-internals/context.d.ts
 interface InternalAnonymousAuthStorage {
   trusted: Record<string, {

package/dist/{context-b6iSomtv.mjs → context-D0HD0F7C.mjs}

@@ -2,12 +2,14 @@ import { t as devframeReporter } from "./diagnostics-reporter-CsIG85Q5.mjs";
 import { t as diagnostics } from "./diagnostics-hwjXp_UV.mjs";
 import { RpcFunctionsCollectorBase } from "./rpc/index.mjs";
 import { defineRpcFunction } from "./index.mjs";
-import { t as diagnostics$1 } from "./diagnostics-C7IGWppM.mjs";
-import { i as createEventEmitter, n as createSharedState, r as nanoid, t as createStorage } from "./storage-CaUVrBrG.mjs";
-import { t as DevframeAgentHost } from "./host-agent-BBkKT27Q.mjs";
+import { t as diagnostics$1 } from "./diagnostics-DEuH3P5O.mjs";
+import { r as createEventEmitter, t as DevframeAgentHost } from "./host-agent-C5HjzfBz.mjs";
+import { resolveStaticAssetsSource } from "./utils/remote-assets.mjs";
+import { t as createStorage } from "./storage-BVuipbGS.mjs";
 import { defineDiagnostics } from "nostics";
 import { isatty } from "node:tty";
 import { formatWithOptions, inspect } from "node:util";
+import { createSharedState } from "devframe/utils/shared-state";
 import { existsSync } from "node:fs";
 import { join } from "pathe";
 //#region src/node/host-diagnostics.ts
@@ -431,6 +433,15 @@ function createRpcSharedStateServerHost(rpc) {
 	return host;
 }
 //#endregion
+//#region src/utils/nanoid.ts
+const urlAlphabet = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";
+function nanoid(size = 21) {
+	let id = "";
+	let i = size;
+	while (i--) id += urlAlphabet[Math.random() * 64 | 0];
+	return id;
+}
+//#endregion
 //#region src/utils/streaming-channel.ts
 const DEFAULT_HIGH_WATER_MARK = 256;
 var StreamClosedError = class extends Error {
@@ -1093,13 +1104,14 @@ var DevframeViewHost = class {
 	constructor(context) {
 		this.context = context;
 	}
-	hostStatic(baseUrl, distDir) {
-		if (!existsSync(distDir)) throw diagnostics$1.DF0008({ distDir });
+	hostStatic(baseUrl, source) {
+		const resolved = resolveStaticAssetsSource(source, this.context.host.getStorageDir("project"));
+		if (typeof resolved === "string" && !existsSync(resolved)) throw diagnostics$1.DF0008({ distDir: resolved });
 		this.buildStaticDirs.push({
 			baseUrl,
-			distDir
+			source
 		});
-		this.context.host.mountStatic(baseUrl, distDir);
+		this.context.host.mountStatic(baseUrl, resolved);
 	}
 };
 //#endregion

package/dist/{context-CMSryXs-.mjs → context-D0jErmlx.mjs}

@@ -1,5 +1,5 @@
 import { n as randomToken } from "./crypto-token-XCqTSMg9.mjs";
-import { t as createStorage } from "./storage-CaUVrBrG.mjs";
+import { t as createStorage } from "./storage-BVuipbGS.mjs";
 import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "./revoke-DZbJ7Cl0.mjs";
 import { join } from "pathe";
 //#region src/node/hub-internals/context.ts

package/dist/{dev-4xjiynUD.mjs → dev-QEuT8SOF.mjs}

@@ -1,10 +1,11 @@
 import { DEVFRAME_CONNECTION_META_FILENAME } from "./constants.mjs";
-import { t as diagnostics } from "./diagnostics-C7IGWppM.mjs";
-import { t as createHostContext } from "./context-b6iSomtv.mjs";
-import { i as resolveMcpConnectionMeta, n as resolveBasePath, r as resolveDevServerPort, t as normalizeBasePath } from "./_shared-CGPVmXUM.mjs";
-import { t as createH3DevframeHost } from "./host-h3-CzCZwtuV.mjs";
-import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-B0TwOxCl.mjs";
-import { t as open } from "./open-Dz4V4irZ.mjs";
+import { t as diagnostics } from "./diagnostics-DEuH3P5O.mjs";
+import { t as createHostContext } from "./context-D0HD0F7C.mjs";
+import { resolveStaticAssetsSource } from "./utils/remote-assets.mjs";
+import { i as resolveMcpConnectionMeta, n as resolveBasePath, r as resolveDevServerPort, t as normalizeBasePath } from "./_shared-CKZPvSrN.mjs";
+import { t as createH3DevframeHost } from "./host-h3-Crkzm42q.mjs";
+import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, t as createInstanceShell } from "./instance-shell-DJ8s-MFw.mjs";
+import { open } from "./utils/open.mjs";
 import { mountStaticHandler } from "./utils/serve-static.mjs";
 import { createServer } from "node:http";
 import { resolve } from "pathe";
@@ -86,7 +87,7 @@ function initDevframe(def, options) {
 				const mcpPath = joinURL(base, mcpMeta.path);
 				let mountMcpHttp;
 				try {
-					({mountMcpHttp} = await import("./http-Z0w9baEe.mjs").then((n) => n.t));
+					({mountMcpHttp} = await import("./http-CVwj7b4g.mjs").then((n) => n.t));
 				} catch (error) {
 					const reason = error instanceof Error ? error.message : String(error);
 					throw diagnostics.DF0017({
@@ -108,9 +109,12 @@ function initDevframe(def, options) {
 				...mcpDispose ? { dispose: mcpDispose } : {}
 			};
 		},
-		mount(_context, meta) {
+		mount(context, meta) {
 			app.use(joinURL(base, DEVFRAME_CONNECTION_META_FILENAME), () => meta);
-			if (distDir) mountStaticHandler(app, base, resolve(distDir));
+			if (distDir) {
+				const source = resolveStaticAssetsSource(distDir, context.host.getStorageDir("project"));
+				mountStaticHandler(app, base, typeof source === "string" ? resolve(source) : source);
+			}
 		}
 	});
 	const instance = {
@@ -148,6 +152,7 @@ function initDevframe(def, options) {
 * `dev` / `build` / `mcp` shell, reach for {@link createCac} instead.
 */
 async function createDevServer(def, options = {}) {
+	if (def.capabilities?.dev === false && !options.force) throw diagnostics.DF0058({ id: def.id });
 	const host = options.host ?? def.cli?.host ?? "localhost";
 	const requestedPort = options.port ?? await resolveDevServerPort(def, { host });
 	const flags = options.flags ?? {};
@@ -182,6 +187,7 @@ async function createDevServer(def, options = {}) {
 		host,
 		origin,
 		ws: options.ws,
+		allowedOrigins: options.allowedOrigins,
 		sse: options.sse,
 		auth: flags.auth === false ? false : options.auth,
 		mcp: options.mcp,

package/dist/{devframe-5oblos7I.d.mts → devframe-Cfx6doi4.d.mts}

@@ -1,6 +1,7 @@
 import { d as RpcFunctionsCollectorBase } from "./index-tdrk1bzV.mjs";
 import { _ as RpcFunctionDefinition, v as RpcFunctionDefinitionAny } from "./types-Djq7CBXh.mjs";
 import { d as DevframeRpcConnection, u as DevframeNodeRpcSessionMeta } from "./ws-server-D1d3QM9f.mjs";
+import { a as StaticAssetsSource, i as RemoteAssetsStore } from "./remote-assets-DclsYyoL.mjs";
 import { CAC } from "cac";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 import { BirpcReturn } from "birpc";
@@ -835,14 +836,6 @@ interface RpcStreamingHost {
 }
 //#endregion
 //#region src/types/diagnostics.d.ts
-/**
- * A diagnostics definition object built with `defineDiagnostics`. Typed as
- * `unknown` because each integration's definition has a distinct narrow shape
- * (e.g. specific code keys like `DF0001` / `MYP0001`), and TypeScript's mapped
- * types don't allow assigning a narrow-keyed result to a generically-keyed
- * one. The host stores them in a heterogeneous registry.
- */
-type DevframeDiagnosticsDefinition = ReturnType<typeof defineDiagnostics<any, any>>;
 /**
  * The shared diagnostics lookup exposed by the host. A `Proxy` that resolves
  * any registered code name to its `nostics` handle (a callable that builds
@@ -912,12 +905,15 @@ interface DevframeDiagnosticsHost {
 //#region src/types/host.d.ts
 interface DevframeHost {
   /**
-   * Serve a static directory at the given URL base. Called by
-   * `DevframeViewHost.hostStatic`. Implementations map this to whatever
+   * Serve static assets at the given URL base — a local directory, or a
+   * resolved {@link RemoteAssetsStore} back-proxy. Called by
+   * `DevframeViewHost.hostStatic` (which normalizes `RemoteAssets`
+   * declarations into stores first). Implementations map this to whatever
    * the underlying runtime expects (Vite middleware, h3 handler, no-op
-   * for build snapshots).
+   * for build snapshots) — the shared engine in
+   * `devframe/utils/serve-static` accepts either shape.
    */
-  mountStatic: (base: string, distDir: string) => void | Promise<void>;
+  mountStatic: (base: string, source: string | RemoteAssetsStore) => void | Promise<void>;
   /**
    * Serve the host's connection meta (`__connection.json`) at the given URL
    * base, so a devframe SPA mounted there can discover the RPC/WS endpoint
@@ -982,14 +978,17 @@ interface DevframeViewHost {
    */
   buildStaticDirs: {
     baseUrl: string;
-    distDir: string;
+    source: StaticAssetsSource;
   }[];
   /**
    * Helper to host static files
    * - In `dev` mode, it will register middleware to `viteServer.middlewares` to host the static files
    * - In `build` mode, it will copy the static files to the dist directory
+   *
+   * Accepts a local dist directory, or a {@link StaticAssetsSource} remote
+   * declaration served through devframe's caching CDN back-proxy.
    */
-  hostStatic: (baseUrl: string, distDir: string) => void;
+  hostStatic: (baseUrl: string, source: StaticAssetsSource) => void;
 }
 //#endregion
 //#region src/types/scope.d.ts
@@ -1480,15 +1479,6 @@ interface ConnectionMeta {
  */
 interface DevframeConnectionConfigsRegistry {}
 //#endregion
-//#region src/types/utils.d.ts
-type Thenable<T> = T | Promise<T>;
-type EntriesToObject<T extends readonly [string, any][]> = { [K in T[number] as K[0]]: K[1]; };
-type PartialWithoutId<T extends {
-  id: string;
-}> = Partial<Omit<T, 'id'>> & {
-  id: string;
-};
-//#endregion
 //#region src/node/auth/handler.d.ts
 /**
  * A ready-made pre-auth RPC handler, as produced by
@@ -1540,12 +1530,11 @@ interface DevframeAuthHandler {
 }
 //#endregion
 //#region src/types/devframe.d.ts
-type DevframeRuntime = 'cli' | 'build' | 'spa' | 'vite' | 'embedded';
 /**
  * Classification of how a devframe is being deployed. Hosted adapters
  * (`vite`, `embedded`) share their origin with a host app and must
  * namespace their mount path under `/__<id>/`. Standalone adapters
- * (`cli`, `spa`, `build`) own the origin and default to `/`.
+ * (`cli`, `build`) own the origin and default to `/`.
  */
 type DevframeDeploymentKind = 'standalone' | 'hosted';
 /**
@@ -1663,7 +1652,7 @@ interface DevframeCliOptions {
   /**
    * Authentication for the standalone dev server.
    *
-   *   - `undefined` / `true` — the standalone adapters (`cli` / `spa` /
+   *   - `undefined` / `true` — the standalone adapters (`cli` /
    *     served `build`) auto-wire devframe's interactive OTP auth
    *     (`createInteractiveAuth`): an untrusted client can only reach
    *     `anonymous:` methods until it exchanges the printed one-time code.
@@ -1696,8 +1685,13 @@ interface DevframeCliOptions {
    * The `--mcp` / `--no-mcp` CLI flags override this per run.
    */
   mcp?: boolean | McpRouteOptions;
-  /** Author's SPA dist directory (served as the devframe's UI). */
-  distDir?: string;
+  /**
+   * Author's SPA dist — served as the devframe's UI. A local directory, or
+   * a {@link StaticAssetsSource} remote declaration (`{ package, version }`)
+   * served through devframe's caching CDN back-proxy so the assets need not
+   * ship inside the node package.
+   */
+  distDir?: StaticAssetsSource;
   /**
    * How the browser reaches the RPC WebSocket. Defaults to sharing the HTTP
    * port on the `__ws` route. See {@link DevframeWsOptions} for the
@@ -1713,7 +1707,7 @@ interface DevframeCliOptions {
   sse?: boolean | DevframeSseOptions;
   /**
    * Capability-side CAC hook. Called with the CAC instance after the
-   * adapter registers its built-in commands (`build` / `spa` / `mcp`)
+   * adapter registers its built-in commands (`build` / `mcp`)
    * but before `createCac`'s own `configureCli` caller. Use this to
    * contribute tool-specific flags and subcommands from the definition
    * itself.
@@ -1754,7 +1748,7 @@ interface DevframeCliOptions {
  *
  * Every field is optional. `title` / `icon` default to the definition's
  * `name` / `icon` when omitted here; the rest are unset by default.
- * Standalone adapters (`cli` / `spa` / `build`) ignore this entirely.
+ * Standalone adapters (`cli` / `build`) ignore this entirely.
  */
 interface DevframeDockDefaults {
   /** Dock entry title. Defaults to the definition's `name`. */
@@ -1791,22 +1785,6 @@ interface DevframeDockDefaults {
   /** Id of the dock group this entry collapses under, if any. */
   groupId?: string;
 }
-interface DevframeSpaOptions {
-  base?: string;
-  /**
-   * How the deployed SPA loads its data.
-   * - `'query'` — read from URL search params.
-   * - `'upload'` — accept a file drag-drop.
-   * - `'none'`  — use the baked RPC dump only.
-   */
-  loader?: 'query' | 'upload' | 'none';
-}
-interface DevframeBrowserContext {
-  /**
-   * The connected RPC client (may be write-disabled in static/spa modes).
-   */
-  rpc: unknown;
-}
 /**
  * Runtime information threaded into `setup(ctx, info)`. Adapters
  * populate the fields that make sense for their deployment. In
@@ -1835,47 +1813,46 @@ interface DevframeDefinition {
    * Default dock attributes applied when a hub mounts this devframe as an
    * iframe dock entry. Consulted only by the hub install path (`ctx.install`),
    * which merge these beneath the per-mount `dock` overrides; standalone
-   * adapters (`cli` / `spa` / `build`) ignore it.
+   * adapters (`cli` / `build`) ignore it.
    *
    * @see {@link DevframeDockDefaults}
    */
   dock?: DevframeDockDefaults;
   /**
    * Mount path override. Defaults depend on the adapter:
-   * `/` for standalone (`cli` / `spa` / `build`), `/__<id>/` for hosted
+   * `/` for standalone (`cli` / `build`), `/__<id>/` for hosted
    * (`vite` / `embedded`).
    */
   basePath?: string;
   /**
    * How a hub reacts when another devframe sharing this one's `id` is
    * mounted onto the same hub. Consulted only by hub adapters
-   * (`ctx.install`); standalone adapters (`cli` / `spa` / `build`)
+   * (`ctx.install`); standalone adapters (`cli` / `build`)
    * ignore it.
    *
    * @default 'warn'
    */
   duplicationStrategy?: DevframeDuplicationStrategy;
   /**
-   * Declares which runtimes meaningfully support this devframe. Consulted
-   * by adapters that can act on a plain `false` before doing any work:
-   * `createCac` skips registering the `build` subcommand entirely when
-   * `capabilities.build` is `false` — useful for a devframe whose value is
-   * inherently live (e.g. it manages real files on disk), so a static
-   * export would only ever produce a broken, write-less shell of the tool.
-   * The `Record<string, boolean>` shape is reserved for finer-grained
-   * sub-capabilities and currently unconsumed by any adapter.
+   * Declares which runtimes meaningfully support this devframe. Adapters
+   * act on a `false` before doing any work:
+   *
+   * - `build: false` — `createCac` skips registering the `build` subcommand,
+   *   and `createBuild` refuses (throws `DF0042`) unless `{ force: true }`.
+   *   Useful for a devframe whose value is inherently live (e.g. it manages
+   *   real files on disk), so a static export would only ever produce a
+   *   broken, write-less shell of the tool.
+   * - `dev: false` — `createDevServer` refuses (throws `DF0058`) unless
+   *   `{ force: true }`. Useful for a devframe that only makes sense as a
+   *   static export (e.g. a report generator with nothing to serve live).
    */
   capabilities?: {
-    dev?: boolean | Record<string, boolean>;
-    build?: boolean | Record<string, boolean>;
-    spa?: boolean | Record<string, boolean>;
+    dev?: boolean;
+    build?: boolean;
   };
   /** Server-side setup — the primary entrypoint. Runs in every runtime. */
   setup: (ctx: DevframeNodeContext, info?: DevframeSetupInfo) => void | Promise<void>;
-  /** Browser-only setup for the SPA adapter (bundled into the client). */
-  setupBrowser?: (ctx: DevframeBrowserContext) => void | Promise<void>;
   cli?: DevframeCliOptions;
-  spa?: DevframeSpaOptions;
 }
 //#endregion
-export { RpcStreamingHost as $, DevframeSettings as A, AgentToolProviderHandle as At, DevframeHost as B, DevframeServiceId as C, AgentManifest as Ct, DevframeScopedNodeContext as D, AgentTool as Dt, DevframeServicesRegistry as E, AgentResourceInput as Et, ScopedRpcFn as F, EventsMap as Ft, DevframeDiagnosticsLogger as G, DevframeDefineDiagnosticsOptions as H, ScopedServerFunctions as I, CliFlagsSchema as It, RpcFunctionsHost as J, DevframeNodeRpcSession as K, ScopedSharedStates as L, InferCliFlags as Lt, DevframeSettingsStore as M, DevframeAgentHostEvents as Mt, ScopedBroadcastOptions as N, EventEmitter as Nt, DevframeScopedNodeRpc as O, AgentToolInput as Ot, ScopedClientFunctions as P, EventUnsubscribe as Pt, RpcStreamingChannelOptions as Q, SettingsForNamespace as R, defineCliFlags as Rt, DevframeNodeContext as S, AgentHandle as St, DevframeServicesHost as T, AgentResourceContent as Tt, DevframeDiagnosticsDefinition as U, DevframeStorageScope as V, DevframeDiagnosticsHost as W, RpcSharedStateHost as X, RpcSharedStateGetOptions as Y, RpcStreamingChannel as Z, ConnectionMeta as _, SharedState as _t, DevframeDockDefaults as a, CreateStreamSinkOptions as at, DevframeCapabilities as b, SharedStatePatch as bt, DevframeSetupInfo as c, StreamSink as ct, DevframeWsOptions as d, createStreamSink as dt, DevframeRpcClientFunctions as et, McpRouteOptions as f, Immutable as ft, Thenable as g, ImmutableSet as gt, PartialWithoutId as h, ImmutableObject as ht, DevframeDeploymentKind as i, CreateStreamReaderOptions as it, DevframeSettingsRegistry as j, DevframeAgentHost as jt, DevframeScopedStreamingHost as k, AgentToolProvider as kt, DevframeSpaOptions as l, StreamSinkEvents as lt, EntriesToObject as m, ImmutableMap as mt, DevframeCliOptions as n, DevframeRpcSharedStates as nt, DevframeDuplicationStrategy as o, StreamErrorPayload as ot, DevframeAuthHandler as p, ImmutableArray as pt, RpcBroadcastOptions as q, DevframeDefinition as r, BufferedChunk as rt, DevframeRuntime as s, StreamReader as st, DevframeBrowserContext as t, DevframeRpcServerFunctions as tt, DevframeSseOptions as u, createStreamReader as ut, ConnectionMetaSse as v, SharedStateEvents as vt, DevframeServiceOf as w, AgentResource as wt, DevframeConnectionConfigsRegistry as x, createSharedState as xt, ConnectionMetaWebsocket as y, SharedStateOptions as yt, DevframeViewHost as z, parseCliFlags as zt };
+export { StreamErrorPayload as $, ScopedServerFunctions as A, InferCliFlags as At, RpcBroadcastOptions as B, DevframeScopedStreamingHost as C, AgentToolProviderHandle as Ct, ScopedBroadcastOptions as D, EventUnsubscribe as Dt, DevframeSettingsStore as E, EventEmitter as Et, DevframeStorageScope as F, RpcStreamingChannelOptions as G, RpcSharedStateGetOptions as H, DevframeDefineDiagnosticsOptions as I, DevframeRpcServerFunctions as J, RpcStreamingHost as K, DevframeDiagnosticsHost as L, SettingsForNamespace as M, parseCliFlags as Mt, DevframeViewHost as N, ScopedClientFunctions as O, EventsMap as Ot, DevframeHost as P, CreateStreamSinkOptions as Q, DevframeDiagnosticsLogger as R, DevframeScopedNodeRpc as S, AgentToolProvider as St, DevframeSettingsRegistry as T, DevframeAgentHostEvents as Tt, RpcSharedStateHost as U, RpcFunctionsHost as V, RpcStreamingChannel as W, BufferedChunk as X, DevframeRpcSharedStates as Y, CreateStreamReaderOptions as Z, DevframeServiceId as _, AgentResource as _t, DevframeDuplicationStrategy as a, Immutable as at, DevframeServicesRegistry as b, AgentTool as bt, DevframeWsOptions as c, ImmutableObject as ct, ConnectionMeta as d, SharedStateEvents as dt, StreamReader as et, ConnectionMetaSse as f, SharedStateOptions as ft, DevframeNodeContext as g, AgentManifest as gt, DevframeConnectionConfigsRegistry as h, AgentHandle as ht, DevframeDockDefaults as i, createStreamSink as it, ScopedSharedStates as j, defineCliFlags as jt, ScopedRpcFn as k, CliFlagsSchema as kt, McpRouteOptions as l, ImmutableSet as lt, DevframeCapabilities as m, createSharedState as mt, DevframeDefinition as n, StreamSinkEvents as nt, DevframeSetupInfo as o, ImmutableArray as ot, ConnectionMetaWebsocket as p, SharedStatePatch as pt, DevframeRpcClientFunctions as q, DevframeDeploymentKind as r, createStreamReader as rt, DevframeSseOptions as s, ImmutableMap as st, DevframeCliOptions as t, StreamSink as tt, DevframeAuthHandler as u, SharedState as ut, DevframeServiceOf as v, AgentResourceContent as vt, DevframeSettings as w, DevframeAgentHost as wt, DevframeScopedNodeContext as x, AgentToolInput as xt, DevframeServicesHost as y, AgentResourceInput as yt, DevframeNodeRpcSession as z };

package/dist/{diagnostics-C7IGWppM.mjs → diagnostics-DEuH3P5O.mjs}

@@ -107,6 +107,38 @@ const diagnostics = defineDiagnostics({
 		DF0057: {
 			why: () => "This instance disables its WebSocket transport (`ws: false`), so there is no socket to drive upgrades into.",
 			fix: "Clients connect over the SSE endpoint instead — no upgrade wiring is needed. Remove `ws: false` if the instance should serve a WebSocket after all."
+		},
+		DF0058: {
+			why: (p) => `"${p.id}" declares \`capabilities.dev: false\` — it does not support a live dev server (its value is a static export only).`,
+			fix: "Pass `{ force: true }` to `createDevServer()` to run it anyway, or drop `capabilities.dev: false` on the definition."
+		},
+		DF0059: {
+			why: (p) => `Failed to fetch the file listing for "${p.package}@${p.version}" from ${p.provider}: ${p.reason}`,
+			fix: "Requests fall back to probing the provider per file. Check network access to the provider, or install the assets package locally so no listing is needed."
+		},
+		DF0060: {
+			why: (p) => `Failed to fetch a remote asset of "${p.package}" (${p.url}): ${p.reason}`,
+			fix: "Install the assets package locally (`npm install <package>`) to serve it with zero network, or check network access to the configured provider."
+		},
+		DF0061: {
+			why: (p) => `The locally installed "${p.package}@${p.installed}" is a different major version than the required "${p.required}".`,
+			fix: "Align the installed assets package with the version its node package declares — they are published in lockstep."
+		},
+		DF0062: {
+			why: (p) => `The locally installed "${p.package}@${p.installed}" differs from the required "${p.required}" — serving the installed one.`,
+			fix: "Install the exact declared version to serve byte-identical assets."
+		},
+		DF0063: {
+			why: (p) => `Failed to persist a remote asset into the cache at "${p.filepath}": ${p.reason}`,
+			fix: "The response was still served; only caching failed. Check that the cache directory is writable and has free space."
+		},
+		DF0064: {
+			why: (p) => `Failed to materialize the remote assets of "${p.package}@${p.version}": ${p.reason}`,
+			fix: "Static builds need every asset file up front. Install the assets package locally, or ensure the provider (and its file-listing API) is reachable during the build."
+		},
+		DF0065: {
+			why: (p) => `Invalid remote-assets ${p.field} "${p.value}".`,
+			fix: "A remote-assets `package` must be a valid npm package name and `version` an exact semver version (e.g. `1.2.3`) — they are interpolated into CDN URLs and the cache path."
 		}
 	}
 });

package/dist/{host-agent-BBkKT27Q.mjs → host-agent-C5HjzfBz.mjs}

@@ -1,5 +1,43 @@
-import { t as diagnostics } from "./diagnostics-C7IGWppM.mjs";
-import { i as createEventEmitter } from "./storage-CaUVrBrG.mjs";
+import { t as diagnostics } from "./diagnostics-DEuH3P5O.mjs";
+//#region src/utils/events.ts
+/**
+* Create event emitter.
+*/
+function createEventEmitter() {
+	const _listeners = {};
+	function emit(event, ...args) {
+		const callbacks = _listeners[event] || [];
+		for (let i = 0, length = callbacks.length; i < length; i++) {
+			const callback = callbacks[i];
+			if (callback) callback(...args);
+		}
+	}
+	function emitOnce(event, ...args) {
+		emit(event, ...args);
+		delete _listeners[event];
+	}
+	function on(event, cb) {
+		(_listeners[event] ||= []).push(cb);
+		return () => {
+			_listeners[event] = _listeners[event]?.filter((i) => cb !== i);
+		};
+	}
+	function once(event, cb) {
+		const unsubscribe = on(event, ((...args) => {
+			unsubscribe();
+			return cb(...args);
+		}));
+		return unsubscribe;
+	}
+	return {
+		_listeners,
+		emit,
+		emitOnce,
+		on,
+		once
+	};
+}
+//#endregion
 //#region src/node/agent-args.ts
 /**
 * Map the args payload an agent surface receives (MCP sends an object
@@ -223,4 +261,4 @@ function inferSafety(type) {
 	return "action";
 }
 //#endregion
-export { coerceAgentPositionalArgs as n, DevframeAgentHost as t };
+export { coerceAgentPositionalArgs as n, createEventEmitter as r, DevframeAgentHost as t };

package/dist/{host-h3-CzCZwtuV.mjs → host-h3-Crkzm42q.mjs}

@@ -8,8 +8,8 @@ import { homedir } from "node:os";
 function createH3DevframeHost(options) {
 	const workspaceRoot = options.workspaceRoot ?? process.cwd();
 	return {
-		mountStatic(base, distDir) {
-			return options.mount?.(base, distDir);
+		mountStatic(base, source) {
+			return options.mount?.(base, source);
 		},
 		resolveOrigin() {
 			return typeof options.origin === "function" ? options.origin() : options.origin;

package/dist/{http-Z0w9baEe.mjs → http-CVwj7b4g.mjs}

@@ -1,7 +1,7 @@
 import { n as __exportAll } from "./rolldown-runtime-JspESFgx.mjs";
 import { i as isAllowedOrigin } from "./ws-server-Bk1hOG3X.mjs";
-import { t as diagnostics } from "./diagnostics-C7IGWppM.mjs";
-import { t as createHostContext } from "./context-b6iSomtv.mjs";
+import { t as diagnostics } from "./diagnostics-DEuH3P5O.mjs";
+import { t as createHostContext } from "./context-D0HD0F7C.mjs";
 import { t as toAgentToolName } from "./agent-tool-name-EgfoFO8C.mjs";
 import { randomUUID } from "node:crypto";
 import { Diagnostic } from "nostics";

package/dist/{index-BzDl02lt.d.mts → index-MYi1SZVL.d.mts}

@@ -1,5 +1,5 @@
-import { K as DevframeNodeRpcSession, S as DevframeNodeContext, _t as SharedState } from "./devframe-5oblos7I.mjs";
-import { n as InternalAnonymousAuthStorage } from "./context-DV4uWieM.mjs";
+import { g as DevframeNodeContext, ut as SharedState, z as DevframeNodeRpcSession } from "./devframe-Cfx6doi4.mjs";
+import { n as InternalAnonymousAuthStorage } from "./context-CQkRTbAc.mjs";
 //#region src/node/auth/revoke.d.ts
 /**
  * Flip `isTrusted` to false on any live WS clients connected with `token`

package/dist/index.d.mts

@@ -1,7 +1,8 @@
-import { $ as RpcStreamingHost, A as DevframeSettings, At as AgentToolProviderHandle, B as DevframeHost, C as DevframeServiceId, Ct as AgentManifest, D as DevframeScopedNodeContext, Dt as AgentTool, E as DevframeServicesRegistry, Et as AgentResourceInput, F as ScopedRpcFn, Ft as EventsMap, G as DevframeDiagnosticsLogger, H as DevframeDefineDiagnosticsOptions, I as ScopedServerFunctions, J as RpcFunctionsHost, K as DevframeNodeRpcSession, L as ScopedSharedStates, M as DevframeSettingsStore, Mt as DevframeAgentHostEvents, N as ScopedBroadcastOptions, Nt as EventEmitter, O as DevframeScopedNodeRpc, Ot as AgentToolInput, P as ScopedClientFunctions, Pt as EventUnsubscribe, Q as RpcStreamingChannelOptions, R as SettingsForNamespace, S as DevframeNodeContext, St as AgentHandle, T as DevframeServicesHost, Tt as AgentResourceContent, U as DevframeDiagnosticsDefinition, V as DevframeStorageScope, W as DevframeDiagnosticsHost, X as RpcSharedStateHost, Y as RpcSharedStateGetOptions, Z as RpcStreamingChannel, _ as ConnectionMeta, a as DevframeDockDefaults, b as DevframeCapabilities, c as DevframeSetupInfo, d as DevframeWsOptions, et as DevframeRpcClientFunctions, f as McpRouteOptions, g as Thenable, h as PartialWithoutId, i as DevframeDeploymentKind, j as DevframeSettingsRegistry, jt as DevframeAgentHost, k as DevframeScopedStreamingHost, kt as AgentToolProvider, l as DevframeSpaOptions, m as EntriesToObject, n as DevframeCliOptions, nt as DevframeRpcSharedStates, o as DevframeDuplicationStrategy, q as RpcBroadcastOptions, r as DevframeDefinition, s as DevframeRuntime, t as DevframeBrowserContext, tt as DevframeRpcServerFunctions, u as DevframeSseOptions, v as ConnectionMetaSse, w as DevframeServiceOf, wt as AgentResource, x as DevframeConnectionConfigsRegistry, y as ConnectionMetaWebsocket, z as DevframeViewHost } from "./devframe-5oblos7I.mjs";
+import { A as ScopedServerFunctions, B as RpcBroadcastOptions, C as DevframeScopedStreamingHost, Ct as AgentToolProviderHandle, D as ScopedBroadcastOptions, Dt as EventUnsubscribe, E as DevframeSettingsStore, Et as EventEmitter, F as DevframeStorageScope, G as RpcStreamingChannelOptions, H as RpcSharedStateGetOptions, I as DevframeDefineDiagnosticsOptions, J as DevframeRpcServerFunctions, K as RpcStreamingHost, L as DevframeDiagnosticsHost, M as SettingsForNamespace, N as DevframeViewHost, O as ScopedClientFunctions, Ot as EventsMap, P as DevframeHost, R as DevframeDiagnosticsLogger, S as DevframeScopedNodeRpc, St as AgentToolProvider, T as DevframeSettingsRegistry, Tt as DevframeAgentHostEvents, U as RpcSharedStateHost, V as RpcFunctionsHost, W as RpcStreamingChannel, Y as DevframeRpcSharedStates, _ as DevframeServiceId, _t as AgentResource, a as DevframeDuplicationStrategy, b as DevframeServicesRegistry, bt as AgentTool, c as DevframeWsOptions, d as ConnectionMeta, f as ConnectionMetaSse, g as DevframeNodeContext, gt as AgentManifest, h as DevframeConnectionConfigsRegistry, ht as AgentHandle, i as DevframeDockDefaults, j as ScopedSharedStates, k as ScopedRpcFn, l as McpRouteOptions, m as DevframeCapabilities, n as DevframeDefinition, o as DevframeSetupInfo, p as ConnectionMetaWebsocket, q as DevframeRpcClientFunctions, r as DevframeDeploymentKind, s as DevframeSseOptions, t as DevframeCliOptions, v as DevframeServiceOf, vt as AgentResourceContent, w as DevframeSettings, wt as DevframeAgentHost, x as DevframeScopedNodeContext, xt as AgentToolInput, y as DevframeServicesHost, yt as AgentResourceInput, z as DevframeNodeRpcSession } from "./devframe-Cfx6doi4.mjs";
 import "./index-tdrk1bzV.mjs";
 import { C as RpcFunctionType, T as RpcReturnSchema, _ as RpcFunctionDefinition, g as RpcFunctionAgentOptions, i as RpcArgsSchema } from "./types-Djq7CBXh.mjs";
 import { d as DevframeRpcConnection, f as DevframeRpcConnectionRequest, p as DevframeRpcTransportKind, u as DevframeNodeRpcSessionMeta } from "./ws-server-D1d3QM9f.mjs";
+import { a as StaticAssetsSource, i as RemoteAssetsStore, n as RemoteAssetsProvider, r as RemoteAssetsProviderCustom, t as RemoteAssets } from "./remote-assets-DclsYyoL.mjs";
 //#region src/define.d.ts
 declare const defineRpcFunction: <NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>) => RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, DevframeNodeContext>;
 /**
@@ -10,4 +11,4 @@ declare const defineRpcFunction: <NAME extends string, TYPE extends RpcFunctionT
  */
 declare function defineDevframe(d: DevframeDefinition): DevframeDefinition;
 //#endregion
-export { type AgentHandle, type AgentManifest, type AgentResource, type AgentResourceContent, type AgentResourceInput, type AgentTool, type AgentToolInput, type AgentToolProvider, type AgentToolProviderHandle, type ConnectionMeta, type ConnectionMetaSse, type ConnectionMetaWebsocket, type DevframeAgentHost, type DevframeAgentHostEvents, type DevframeBrowserContext, type DevframeCapabilities, type DevframeCliOptions, type DevframeConnectionConfigsRegistry, type DevframeDefineDiagnosticsOptions, type DevframeDefinition, type DevframeDeploymentKind, type DevframeDiagnosticsDefinition, type DevframeDiagnosticsHost, type DevframeDiagnosticsLogger, type DevframeDockDefaults, type DevframeDuplicationStrategy, type DevframeHost, type DevframeNodeContext, type DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, type DevframeRpcClientFunctions, type DevframeRpcConnection, type DevframeRpcConnectionRequest, type DevframeRpcServerFunctions, type DevframeRpcSharedStates, type DevframeRpcTransportKind, type DevframeRuntime, type DevframeScopedNodeContext, type DevframeScopedNodeRpc, type DevframeScopedStreamingHost, type DevframeServiceId, type DevframeServiceOf, type DevframeServicesHost, type DevframeServicesRegistry, type DevframeSettings, type DevframeSettingsRegistry, type DevframeSettingsStore, type DevframeSetupInfo, type DevframeSpaOptions, type DevframeSseOptions, type DevframeStorageScope, type DevframeViewHost, type DevframeWsOptions, type EntriesToObject, type EventEmitter, type EventUnsubscribe, type EventsMap, type McpRouteOptions, type PartialWithoutId, type RpcBroadcastOptions, type RpcFunctionAgentOptions, type RpcFunctionsHost, type RpcSharedStateGetOptions, type RpcSharedStateHost, type RpcStreamingChannel, type RpcStreamingChannelOptions, type RpcStreamingHost, type ScopedBroadcastOptions, type ScopedClientFunctions, type ScopedRpcFn, type ScopedServerFunctions, type ScopedSharedStates, type SettingsForNamespace, type Thenable, defineDevframe, defineRpcFunction };
+export { type AgentHandle, type AgentManifest, type AgentResource, type AgentResourceContent, type AgentResourceInput, type AgentTool, type AgentToolInput, type AgentToolProvider, type AgentToolProviderHandle, type ConnectionMeta, type ConnectionMetaSse, type ConnectionMetaWebsocket, type DevframeAgentHost, type DevframeAgentHostEvents, type DevframeCapabilities, type DevframeCliOptions, type DevframeConnectionConfigsRegistry, type DevframeDefineDiagnosticsOptions, type DevframeDefinition, type DevframeDeploymentKind, type DevframeDiagnosticsHost, type DevframeDiagnosticsLogger, type DevframeDockDefaults, type DevframeDuplicationStrategy, type DevframeHost, type DevframeNodeContext, type DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, type DevframeRpcClientFunctions, type DevframeRpcConnection, type DevframeRpcConnectionRequest, type DevframeRpcServerFunctions, type DevframeRpcSharedStates, type DevframeRpcTransportKind, type DevframeScopedNodeContext, type DevframeScopedNodeRpc, type DevframeScopedStreamingHost, type DevframeServiceId, type DevframeServiceOf, type DevframeServicesHost, type DevframeServicesRegistry, type DevframeSettings, type DevframeSettingsRegistry, type DevframeSettingsStore, type DevframeSetupInfo, type DevframeSseOptions, type DevframeStorageScope, type DevframeViewHost, type DevframeWsOptions, type EventEmitter, type EventUnsubscribe, type EventsMap, type McpRouteOptions, type RemoteAssets, type RemoteAssetsProvider, type RemoteAssetsProviderCustom, type RemoteAssetsStore, type RpcBroadcastOptions, type RpcFunctionAgentOptions, type RpcFunctionsHost, type RpcSharedStateGetOptions, type RpcSharedStateHost, type RpcStreamingChannel, type RpcStreamingChannelOptions, type RpcStreamingHost, type ScopedBroadcastOptions, type ScopedClientFunctions, type ScopedRpcFn, type ScopedServerFunctions, type ScopedSharedStates, type SettingsForNamespace, type StaticAssetsSource, defineDevframe, defineRpcFunction };

package/dist/{instance-registry-Du_hbx-j.mjs → instance-registry-M2p-z6xE.mjs}

@@ -1,5 +1,5 @@
 import { n as __exportAll } from "./rolldown-runtime-JspESFgx.mjs";
-import { t as diagnostics } from "./diagnostics-C7IGWppM.mjs";
+import { t as diagnostics } from "./diagnostics-DEuH3P5O.mjs";
 import { mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "pathe";
 import process from "node:process";

package/dist/{instance-shell-B0TwOxCl.mjs → instance-shell-DJ8s-MFw.mjs}

@@ -1,6 +1,6 @@
 import "./constants.mjs";
-import { t as diagnostics } from "./diagnostics-C7IGWppM.mjs";
-import { t as getInternalContext } from "./context-CMSryXs-.mjs";
+import { t as diagnostics } from "./diagnostics-DEuH3P5O.mjs";
+import { t as getInternalContext } from "./context-D0jErmlx.mjs";
 import { createInteractiveAuth } from "./recipes/interactive-auth.mjs";
 import { createServer } from "node:http";
 import process from "node:process";
@@ -197,7 +197,7 @@ function createInstanceShell(options) {
 		const origin = currentOrigin();
 		if (!cfg || registerPromise || !origin || !meta) return;
 		const resolvedMeta = meta;
-		registerPromise = import("./instance-registry-Du_hbx-j.mjs").then((n) => n.t).then(({ registerDevframeInstance }) => {
+		registerPromise = import("./instance-registry-M2p-z6xE.mjs").then((n) => n.t).then(({ registerDevframeInstance }) => {
 			let port = 0;
 			try {
 				const url = new URL(origin);
@@ -257,7 +257,7 @@ function createInstanceShell(options) {
 	let resolvedAuth = false;
 	let corePromise;
 	function ensureCore() {
-		corePromise ??= import("./rpc-core-Cva-0pw0.mjs").then((n) => n.n).then(({ createContextRpcServer }) => createContextRpcServer({
+		corePromise ??= import("./rpc-core-IhcWl_xn.mjs").then((n) => n.n).then(({ createContextRpcServer }) => createContextRpcServer({
 			context: ctx,
 			auth: resolvedAuth,
 			onPeerConnect: options.onPeerConnect,
@@ -298,7 +298,7 @@ function createInstanceShell(options) {
 			allowedOrigins: options.allowedOrigins
 		});
 		if (ws.port != null) return await start(ws.port);
-		const { getPort } = await import("./_shared-CGPVmXUM.mjs").then((n) => n.a);
+		const { getPort } = await import("./_shared-CKZPvSrN.mjs").then((n) => n.a);
 		let lastError;
 		for (let attempt = 0; attempt < 3; attempt++) {
 			const port = attempt === 0 && options.resolveSidecarPort ? await options.resolveSidecarPort(sidecarHost) : await getPort({

package/dist/{instance-shell-B-BSVp37.d.mts → instance-shell-D_UA0Idz.d.mts}

@@ -1,6 +1,6 @@
-import { K as DevframeNodeRpcSession, S as DevframeNodeContext, _ as ConnectionMeta, d as DevframeWsOptions, et as DevframeRpcClientFunctions, p as DevframeAuthHandler, tt as DevframeRpcServerFunctions, u as DevframeSseOptions } from "./devframe-5oblos7I.mjs";
+import { J as DevframeRpcServerFunctions, c as DevframeWsOptions, d as ConnectionMeta, g as DevframeNodeContext, q as DevframeRpcClientFunctions, s as DevframeSseOptions, u as DevframeAuthHandler, z as DevframeNodeRpcSession } from "./devframe-Cfx6doi4.mjs";
 import { d as DevframeRpcConnection, n as WsOriginRegistry, u as DevframeNodeRpcSessionMeta } from "./ws-server-D1d3QM9f.mjs";
-import "./index-BzDl02lt.mjs";
+import "./index-MYi1SZVL.mjs";
 import { BirpcGroup } from "birpc";
 import { NodeAdapter } from "crossws/adapters/node";
 import { Buffer } from "node:buffer";