devframe 0.9.0 → 0.9.2

package/dist/internal/index.d.mts

@@ -1,9 +1,9 @@
-import { Ct as DevframeAgentHost$1, P as DevframeHost, St as AgentToolProviderHandle, Tt as EventEmitter, _t as AgentResourceContent, bt as AgentToolInput, g as DevframeNodeContext, gt as AgentResource, ht as AgentManifest, mt as AgentHandle, vt as AgentResourceInput, wt as DevframeAgentHostEvents, xt as AgentToolProvider, yt as AgentTool } from "../devframe-DJMg0WLe.mjs";
+import { At as DevframeAgentHost$1, Ct as AgentResource, Dt as AgentToolInput, Et as AgentTool, Mt as EventEmitter, Ot as AgentToolProvider, Q as DevframeHost, St as AgentManifest, Tt as AgentResourceInput, g as DevframeNodeContext, jt as DevframeAgentHostEvents, kt as AgentToolProviderHandle, wt as AgentResourceContent, xt as AgentHandle } from "../devframe-mbfgpQQC.mjs";
 import { v as RpcFunctionDefinitionAny } from "../types-Djq7CBXh.mjs";
 import { a as RemoteAssetsStore } from "../remote-assets-Bg4gCUZ_.mjs";
-import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, h as registerDevframeInstance, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-CljiKq1c.mjs";
-import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-BPmX9fqK.mjs";
-import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-Cc4lucI0.mjs";
+import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, h as registerDevframeInstance, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-mU5j5xWn.mjs";
+import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-BAGBgTUO.mjs";
+import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-dV69u4lY.mjs";
 //#region src/node/agent-args.d.ts
 /**
  * How {@link coerceAgentPositionalArgs} treats an args object that carries
@@ -280,6 +280,42 @@ declare const diagnostics: import("nostics").Diagnostics<{
     }) => string;
     readonly fix: "A remote-assets `package` must be a valid npm package name and `version` an exact semver version (e.g. `1.2.3`) — they are interpolated into CDN URLs and the cache path.";
   };
+  readonly DF0066: {
+    readonly why: (p: {
+      package: string;
+    }) => string;
+    readonly fix: "Option sets only merge before `ctx.services.ready()` fires. Install the service (or declare it in `DevframeDefinition.services`) before the barrier so its options join the merge.";
+  };
+  readonly DF0067: {
+    readonly why: (p: {
+      package: string;
+      reason: string;
+    }) => string;
+    readonly fix: "Install the service package next to whoever declares it (a plugin declaring it in `services` should list it in its own dependencies), or drop `required: true` to degrade gracefully when it is absent.";
+  };
+  readonly DF0068: {
+    readonly why: (p: {
+      package: string;
+      required: string;
+      installed: string;
+    }) => string;
+    readonly fix: "Align the installed service package with the range its declarer requires, or drop `required: true` to downgrade the mismatch to a warning.";
+  };
+  readonly DF0069: {
+    readonly why: (p: {
+      package: string;
+      required: string;
+      installed: string;
+    }) => string;
+    readonly fix: "The advertised meta carries the real version, so clients can gate on it. Align the installed service package with the declared range to silence this warning.";
+  };
+  readonly DF0070: {
+    readonly why: (p: {
+      package: string;
+      reason: string;
+    }) => string;
+    readonly fix: "A service package's default export must be a factory returning a `DevframeServiceDefinition` — an object with `package`, `version`, `scope`, and a `setup` function.";
+  };
 }, readonly [(d: import("nostics").Diagnostic, { method }?: {
   method?: "log" | "warn" | "error";
 }) => void]>;

package/dist/internal/index.mjs

@@ -1,9 +1,9 @@
 import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../wire-codec-0K-o5MYW.mjs";
-import { t as diagnostics } from "../diagnostics-DOQPnQmX.mjs";
-import { n as coerceAgentPositionalArgs, t as DevframeAgentHost } from "../host-agent-xLCSe65D.mjs";
-import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-CbZ_yhbz.mjs";
-import { t as createH3DevframeHost } from "../host-h3-Crkzm42q.mjs";
-import { i as registerDevframeInstance, n as listLiveDevframeInstances } from "../instance-registry-WvQkt42E.mjs";
-import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-CMFyszWJ.mjs";
-import { t as createContextRpcServer } from "../rpc-core-DMTe-hLo.mjs";
+import { t as diagnostics } from "../diagnostics-DI1HGj2I.mjs";
+import { n as coerceAgentPositionalArgs, t as DevframeAgentHost } from "../host-agent-DVDLqjvj.mjs";
+import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-BM3PdYli.mjs";
+import { t as createH3DevframeHost } from "../host-h3-fRbF9yor.mjs";
+import { i as registerDevframeInstance, n as listLiveDevframeInstances } from "../instance-registry-Dy28drtm.mjs";
+import { i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-GqTY93gC.mjs";
+import { t as createContextRpcServer } from "../rpc-core-DRYnbxdD.mjs";
 export { DevframeAgentHost, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, listLiveDevframeInstances, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveInstanceRegister, samePath };

package/dist/node/auth.d.mts

@@ -1,3 +1,3 @@
-import { u as DevframeAuthHandler } from "../devframe-DJMg0WLe.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-CB-fSUyn.mjs";
+import { u as DevframeAuthHandler } from "../devframe-mbfgpQQC.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-Dipgo9ji.mjs";
 export { DevframeAuthHandler, buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/auth.mjs

@@ -1,3 +1,3 @@
-import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-DZbJ7Cl0.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-Cc1IeSmQ.mjs";
+import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-3Q6aDKWk.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-CK9LjrnT.mjs";
 export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,3 +1,3 @@
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-B3YUu_95.mjs";
-import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-BPmX9fqK.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-al99DDJ8.mjs";
+import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-BAGBgTUO.mjs";
 export { type DevframeInternalContext, type InternalAnonymousAuthStorage, type RemoteTokenRecord, getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/hub-internals.mjs

@@ -1,3 +1,3 @@
-import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-CbZ_yhbz.mjs";
-import { n as internalContextMap, t as getInternalContext } from "../context-xdynGSLP.mjs";
+import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-BM3PdYli.mjs";
+import { n as internalContextMap, t as getInternalContext } from "../context-af2w_F0_.mjs";
 export { getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/index.d.mts

@@ -1,4 +1,4 @@
-import { B as RpcFunctionsHost, P as DevframeHost, g as DevframeNodeContext, lt as SharedState } from "../devframe-DJMg0WLe.mjs";
+import { Q as DevframeHost, g as DevframeNodeContext, gt as SharedState, y as RpcFunctionsHost } from "../devframe-mbfgpQQC.mjs";
 import "../index-tdrk1bzV.mjs";
 import { v as RpcFunctionDefinitionAny } from "../types-Djq7CBXh.mjs";
 import { BirpcGroup } from "birpc";
@@ -8,6 +8,15 @@ interface CreateHostContextOptions {
   workspaceRoot?: string;
   mode: 'dev' | 'build';
   host: DevframeHost;
+  /**
+   * `import.meta.url` of the module that defines the devframe this context
+   * serves (from `DevframeDefinition.importMetaUrl`). Supplies the default
+   * `resolveFrom` base for remote {@link DevframeViewHost.hostStatic} sources
+   * that don't set one, so a locally installed copy of an assets package is
+   * served with zero network. An internal plumbing detail — it isn't part of
+   * the public {@link DevframeNodeContext} surface.
+   */
+  importMetaUrl?: string;
   /**
    * Built-in RPC declarations to register on the host. Framework
    * adapters (vite, rolldown, cli) can pass the ones they need; the

package/dist/node/index.mjs

@@ -1,3 +1,3 @@
-import { t as createHostContext } from "../context-CEe4PBz1.mjs";
-import { t as createStorage } from "../storage-CYye7P7L.mjs";
+import { t as createHostContext } from "../context-riPPHGiu.mjs";
+import { t as createStorage } from "../storage-BNqSAOxA.mjs";
 export { createHostContext, createStorage };

package/dist/recipes/common-rpc-functions.d.mts

@@ -1,4 +1,4 @@
-import "../devframe-DJMg0WLe.mjs";
+import "../devframe-mbfgpQQC.mjs";
 import "../index-tdrk1bzV.mjs";
 import { E as Thenable, S as RpcFunctionSetupResult, c as RpcDump, g as RpcFunctionAgentOptions } from "../types-Djq7CBXh.mjs";
 import { SimpleSchema } from "../utils/simple-schema.mjs";
@@ -33,6 +33,10 @@ declare const KNOWN_EDITORS: KnownEditor[];
  *   },
  * })
  * ```
+ *
+ * @deprecated Use the `@devframes/service-open` wire service instead — one
+ * host-level installation shared by every plugin and feature-detectable from
+ * clients, with workspace-root path containment on top of the editor gating.
  */
 declare const openInEditor: {
   name: "devframe:open-in-editor";
@@ -59,6 +63,10 @@ declare const openInEditor: {
  *
  * ctx.rpc.register(openInFinder)
  * ```
+ *
+ * @deprecated Use the `@devframes/service-open` wire service instead — one
+ * host-level installation shared by every plugin and feature-detectable from
+ * clients, with workspace-root path containment.
  */
 declare const openInFinder: {
   name: "devframe:open-in-finder";
@@ -84,6 +92,8 @@ declare const openInFinder: {
  *
  * commonRpcFunctions.forEach(fn => ctx.rpc.register(fn))
  * ```
+ *
+ * @deprecated Use the `@devframes/service-open` wire service instead.
  */
 declare const commonRpcFunctions: readonly [{
   name: "devframe:open-in-editor";

package/dist/recipes/common-rpc-functions.mjs

@@ -56,6 +56,10 @@ const KNOWN_EDITORS = [
 *   },
 * })
 * ```
+*
+* @deprecated Use the `@devframes/service-open` wire service instead — one
+* host-level installation shared by every plugin and feature-detectable from
+* clients, with workspace-root path containment on top of the editor gating.
 */
 const openInEditor = defineRpcFunction({
 	name: "devframe:open-in-editor",
@@ -78,6 +82,10 @@ const openInEditor = defineRpcFunction({
 *
 * ctx.rpc.register(openInFinder)
 * ```
+*
+* @deprecated Use the `@devframes/service-open` wire service instead — one
+* host-level installation shared by every plugin and feature-detectable from
+* clients, with workspace-root path containment.
 */
 const openInFinder = defineRpcFunction({
 	name: "devframe:open-in-finder",
@@ -99,6 +107,8 @@ const openInFinder = defineRpcFunction({
 *
 * commonRpcFunctions.forEach(fn => ctx.rpc.register(fn))
 * ```
+*
+* @deprecated Use the `@devframes/service-open` wire service instead.
 */
 const commonRpcFunctions = [openInEditor, openInFinder];
 //#endregion

package/dist/recipes/interactive-auth.d.mts

@@ -1,5 +1,5 @@
-import { g as DevframeNodeContext, u as DevframeAuthHandler } from "../devframe-DJMg0WLe.mjs";
-import "../index-CB-fSUyn.mjs";
+import { g as DevframeNodeContext, u as DevframeAuthHandler } from "../devframe-mbfgpQQC.mjs";
+import "../index-Dipgo9ji.mjs";
 //#region src/recipes/interactive-auth.d.ts
 interface CreateInteractiveAuthOptions {
   /**

package/dist/recipes/interactive-auth.mjs

@@ -1,8 +1,8 @@
 import { s as colors } from "../nostics-CzECRXpE.mjs";
 import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
 import { isAnonymousRpcMethod } from "../constants.mjs";
-import { a as verifyAuthToken, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-Cc1IeSmQ.mjs";
-import { t as getInternalContext } from "../context-xdynGSLP.mjs";
+import { a as verifyAuthToken, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-CK9LjrnT.mjs";
+import { t as getInternalContext } from "../context-af2w_F0_.mjs";
 import { t as s } from "../simple-schema-DQPZrAaZ.mjs";
 //#region src/recipes/interactive-auth.ts
 function defaultBanner(info) {

package/dist/{remote-assets-nTTxY2MU.mjs → remote-assets-CqxiyltC.mjs}

@@ -1,13 +1,13 @@
-import { t as diagnostics } from "./diagnostics-DOQPnQmX.mjs";
+import { t as diagnostics } from "./diagnostics-DI1HGj2I.mjs";
 import { createRequire } from "node:module";
 import { isatty } from "node:tty";
 import { formatWithOptions, inspect } from "node:util";
+import { dirname, extname, join, normalize, sep } from "pathe";
 import { createReadStream, existsSync } from "node:fs";
 import { Buffer } from "node:buffer";
 import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { Readable } from "node:stream";
 import { lookup } from "mrmime";
-import { dirname, extname, join, normalize, sep } from "pathe";
 //#region ../../node_modules/.pnpm/obug@2.1.4/node_modules/obug/dist/core.js
 /**
 * Coerce `value`.
@@ -315,9 +315,10 @@ const CACHE_CONTROL_HEADER = "no-store";
 function flattenTree(nodes, style) {
 	const out = [];
 	const walk = (list, prefix) => {
-		for (const node of list) if (style === "path") if (node.type === "file") out.push((node.path ?? "").replace(/^\//, ""));
-		else walk(node.files ?? [], "");
-		else if (node.type === "file") out.push(prefix + (node.name ?? ""));
+		for (const node of list) if (style === "path") {
+			if (node.type === "file") out.push((node.path ?? "").replace(/^\//, ""));
+			else walk(node.files ?? [], "");
+		} else if (node.type === "file") out.push(prefix + (node.name ?? ""));
 		else if (node.files) walk(node.files, `${prefix}${node.name}/`);
 	};
 	walk(nodes, "");
@@ -626,11 +627,21 @@ function assertValidRemoteAssets(assets) {
 *
 * A remote source's `package`/`version` are validated first (`DF0065`) — both
 * are interpolated into CDN URLs and the cache path.
+*
+* `defaultResolveFrom` (typically the declaring devframe's `importMetaUrl`)
+* supplies a `resolveFrom` base for a remote source that doesn't set one:
+* it is applied only when `source.resolveFrom` is `undefined`, so an explicit
+* per-source string still wins and an explicit `null` still opts out of the
+* installed-copy lookup.
 */
-function resolveStaticAssetsSource(source, projectStorageDir) {
+function resolveStaticAssetsSource(source, projectStorageDir, defaultResolveFrom) {
 	if (typeof source === "string") return source;
 	assertValidRemoteAssets(source);
-	return resolveInstalled(source) ?? createStore(source, join(projectStorageDir, ".remote-assets", `${source.package.replace(/\//g, "+")}@${source.version}`));
+	const resolved = source.resolveFrom === void 0 && defaultResolveFrom != null ? {
+		...source,
+		resolveFrom: defaultResolveFrom
+	} : source;
+	return resolveInstalled(resolved) ?? createStore(resolved, join(projectStorageDir, ".remote-assets", `${resolved.package.replace(/\//g, "+")}@${resolved.version}`));
 }
 //#endregion
 export { createDebug as n, resolveStaticAssetsSource as t };

package/dist/{revoke-DZbJ7Cl0.mjs → revoke-3Q6aDKWk.mjs}

@@ -1,3 +1,4 @@
+import { t as DEVFRAME_EVENTS } from "./events-DKfSmoTj.mjs";
 //#region src/node/auth/revoke.ts
 /**
 * Flip `isTrusted` to false on any live WS clients connected with `token`
@@ -16,7 +17,7 @@ async function revokeActiveConnectionsForToken(context, token) {
 	}
 	if (affectedSessionIds.size === 0) return;
 	await rpcHost.broadcast({
-		method: "devframe:auth:revoked",
+		method: DEVFRAME_EVENTS.broadcast.authRevoked,
 		args: [],
 		filter: (client) => affectedSessionIds.has(client.$meta.id)
 	});

package/dist/{rolldown-runtime-JspESFgx.mjs → rolldown-runtime-B4iAMlE-.mjs}

@@ -26,7 +26,7 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));

package/dist/rpc/dump.mjs

@@ -1,2 +1,2 @@
-import { a as reviveDumpError, i as getDefinitionsWithDumps, n as createClientFromDump, o as serializeDumpError, r as dumpFunctions, t as collectStaticRpcDump } from "../static-BPZ1_OPA.mjs";
+import { a as reviveDumpError, i as getDefinitionsWithDumps, n as createClientFromDump, o as serializeDumpError, r as dumpFunctions, t as collectStaticRpcDump } from "../static-DV_qUSRS.mjs";
 export { collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError };

package/dist/rpc/index.mjs

@@ -1,4 +1,4 @@
-import { a as validateRpcArgs, i as getRpcResolvedSetupResult, n as validateDefinitions, o as validateRpcReturn, r as getRpcHandler, s as hash, t as validateDefinition } from "../validation-CpXFB6Dz.mjs";
+import { a as validateRpcArgs, i as getRpcResolvedSetupResult, n as validateDefinitions, o as validateRpcReturn, r as getRpcHandler, s as hash, t as validateDefinition } from "../validation-YrZH6atx.mjs";
 import { t as diagnostics } from "../diagnostics-CD8nlgll.mjs";
 import { n as defineRpcFunction, t as createDefineWrapperWithContext } from "../define-BLWPsH6y.mjs";
 import { n as strictJsonStringify, t as STRUCTURED_CLONE_PREFIX } from "../serialization-BGzEwAdr.mjs";

package/dist/rpc/transports/ws-bun.d.mts

@@ -1,5 +1,5 @@
 import { n as WsOriginRegistry } from "../../ws-server-D1d3QM9f.mjs";
-import { t as ContextRpcServer } from "../../rpc-core-Cc4lucI0.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-dV69u4lY.mjs";
 //#region src/rpc/transports/ws-bun.d.ts
 interface AttachBunWsTransportOptions {
   /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */

package/dist/rpc/transports/ws-deno.d.mts

@@ -0,0 +1,26 @@
+import { n as WsOriginRegistry } from "../../ws-server-D1d3QM9f.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-dV69u4lY.mjs";
+//#region src/rpc/transports/ws-deno.d.ts
+interface AttachDenoWsTransportOptions {
+  /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */
+  allowedOrigins?: readonly string[] | WsOriginRegistry | false;
+}
+interface DenoWsTier {
+  /**
+   * Complete a WS upgrade request — `Deno.serve`'s handler info as the 2nd
+   * argument. Unlike Bun, Deno's adapter attaches the socket to the returned
+   * `Response` itself, so there is no `websocket` handler object to register.
+   */
+  handleUpgrade: (request: Request, info: unknown) => Promise<Response>;
+  close: () => Promise<void>;
+}
+/**
+ * The Deno fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the
+ * same RPC peer wiring as `attachWsRpcTransport`, driven by crossws's Deno
+ * adapter so upgrades complete through `handleUpgrade(request, info)` on the
+ * app's own origin, with no side-car server. Load it dynamically so the Deno
+ * adapter never enters a Node-only bundle path.
+ */
+declare function attachDenoWsTransport(core: ContextRpcServer, options?: AttachDenoWsTransportOptions): Promise<DenoWsTier>;
+//#endregion
+export { AttachDenoWsTransportOptions, DenoWsTier, attachDenoWsTransport };

package/dist/rpc/transports/ws-deno.mjs

@@ -0,0 +1,30 @@
+import { i as isAllowedOrigin, r as createWsRpcPeerHooks } from "../../ws-server-BdSLrhxE.mjs";
+//#region src/rpc/transports/ws-deno.ts
+/**
+* The Deno fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the
+* same RPC peer wiring as `attachWsRpcTransport`, driven by crossws's Deno
+* adapter so upgrades complete through `handleUpgrade(request, info)` on the
+* app's own origin, with no side-car server. Load it dynamically so the Deno
+* adapter never enters a Node-only bundle path.
+*/
+async function attachDenoWsTransport(core, options = {}) {
+	const { default: denoAdapter } = await import("crossws/adapters/deno");
+	const { allowedOrigins } = options;
+	const ws = denoAdapter({ hooks: {
+		...createWsRpcPeerHooks(core.rpcGroup, {
+			onConnected: core.onConnected,
+			onDisconnected: core.onDisconnected
+		}),
+		upgrade(request) {
+			const origin = request.headers.get("origin") ?? void 0;
+			const allowed = allowedOrigins && !Array.isArray(allowedOrigins) ? allowedOrigins.isAllowed(origin) : isAllowedOrigin(origin, allowedOrigins || []);
+			if (allowedOrigins !== false && !allowed) return new Response("Forbidden", { status: 403 });
+		}
+	} });
+	return {
+		handleUpgrade: (request, info) => ws.handleUpgrade(request, info),
+		close: () => ws.close()
+	};
+}
+//#endregion
+export { attachDenoWsTransport };

package/dist/{rpc-core-DMTe-hLo.mjs → rpc-core-DRYnbxdD.mjs}

@@ -1,6 +1,6 @@
-import { n as __exportAll } from "./rolldown-runtime-JspESFgx.mjs";
+import { n as __exportAll } from "./rolldown-runtime-B4iAMlE-.mjs";
 import { createRpcServer } from "./rpc/server.mjs";
-import { t as diagnostics } from "./diagnostics-DOQPnQmX.mjs";
+import { t as diagnostics } from "./diagnostics-DI1HGj2I.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/node/rpc-core.ts
 var rpc_core_exports = /* @__PURE__ */ __exportAll({ createContextRpcServer: () => createContextRpcServer });

package/dist/{rpc-core-Cc4lucI0.d.mts → rpc-core-dV69u4lY.d.mts}

@@ -1,6 +1,6 @@
-import { K as DevframeRpcClientFunctions, R as DevframeNodeRpcSession, g as DevframeNodeContext, q as DevframeRpcServerFunctions, u as DevframeAuthHandler } from "./devframe-DJMg0WLe.mjs";
+import { E as DevframeRpcServerFunctions, T as DevframeRpcClientFunctions, _ as DevframeNodeRpcSession, g as DevframeNodeContext, u as DevframeAuthHandler } from "./devframe-mbfgpQQC.mjs";
 import { d as DevframeRpcConnection, u as DevframeNodeRpcSessionMeta } from "./ws-server-D1d3QM9f.mjs";
-import "./index-CB-fSUyn.mjs";
+import "./index-Dipgo9ji.mjs";
 import { BirpcGroup, EventOptions } from "birpc";
 //#region src/node/rpc-core.d.ts
 interface CreateContextRpcServerOptions {

package/dist/{shared-state-fRRbRUtD.mjs → shared-state-DoXutg_U.mjs}

@@ -1,6 +1,6 @@
 import { createEventEmitter } from "./utils/events.mjs";
 import { nanoid } from "./utils/nanoid.mjs";
-//#region ../../node_modules/.pnpm/immer@11.1.16/node_modules/immer/dist/immer.mjs
+//#region ../../node_modules/.pnpm/immer@11.1.17/node_modules/immer/dist/immer.mjs
 var NOTHING = Symbol.for("immer-nothing");
 var DRAFTABLE = Symbol.for("immer-draftable");
 var DRAFT_STATE = Symbol.for("immer-state");

package/dist/{state-Cc1IeSmQ.mjs → state-CK9LjrnT.mjs}

@@ -1191,7 +1191,7 @@ const TEMP_AUTH_CODE_LENGTH = 6;
 * 6-digit code only has ~20 bits of entropy, so a short lifetime plus the
 * attempt cap below are what keep it brute-force resistant.
 */
-const TEMP_AUTH_CODE_TTL = 5 * 6e4;
+const TEMP_AUTH_CODE_TTL = 3e5;
 /** Failed attempts allowed against a single code before it is rotated. */
 const TEMP_AUTH_MAX_ATTEMPTS = 5;
 let tempAuthCode = generateTempCode();

package/dist/{static-BPZ1_OPA.mjs → static-DV_qUSRS.mjs}

@@ -1,4 +1,4 @@
-import { n as validateDefinitions, r as getRpcHandler, s as hash } from "./validation-CpXFB6Dz.mjs";
+import { n as validateDefinitions, r as getRpcHandler, s as hash } from "./validation-YrZH6atx.mjs";
 import { t as diagnostics } from "./diagnostics-CD8nlgll.mjs";
 import { DEVFRAME_RPC_DUMP_DIRNAME } from "./constants.mjs";
 //#region ../../node_modules/.pnpm/yocto-queue@1.2.2/node_modules/yocto-queue/index.js

package/dist/{storage-CYye7P7L.mjs → storage-BNqSAOxA.mjs}

@@ -1,8 +1,8 @@
-import { t as diagnostics } from "./diagnostics-DOQPnQmX.mjs";
+import { t as diagnostics } from "./diagnostics-DI1HGj2I.mjs";
 import { createSharedState } from "devframe/utils/shared-state";
-import fs from "node:fs";
-import { dirname } from "pathe";
 import process from "node:process";
+import { dirname } from "pathe";
+import fs from "node:fs";
 //#region ../../node_modules/.pnpm/perfect-debounce@2.1.0/node_modules/perfect-debounce/dist/index.mjs
 const DEBOUNCE_DEFAULTS = { trailing: true };
 /**

package/dist/types/index.d.mts

@@ -1,6 +1,6 @@
-import { A as ScopedServerFunctions, B as RpcFunctionsHost, C as DevframeScopedStreamingHost, Ct as DevframeAgentHost, D as ScopedBroadcastOptions, Dt as EventsMap, E as DevframeSettingsStore, Et as EventUnsubscribe, F as DevframeStorageScope, G as RpcStreamingHost, H as RpcSharedStateHost, I as DevframeDiagnosticsHost, J as DevframeRpcSharedStates, K as DevframeRpcClientFunctions, L as DevframeDiagnosticsLogger, M as SettingsForNamespace, N as DevframeViewHost, O as ScopedClientFunctions, P as DevframeHost, R as DevframeNodeRpcSession, S as DevframeScopedNodeRpc, St as AgentToolProviderHandle, T as DevframeSettingsRegistry, Tt as EventEmitter, U as RpcStreamingChannel, V as RpcSharedStateGetOptions, W as RpcStreamingChannelOptions, _ as DevframeServiceId, _t as AgentResourceContent, a as DevframeDuplicationStrategy, b as DevframeServicesRegistry, bt as AgentToolInput, c as DevframeWsOptions, d as ConnectionMeta, f as ConnectionMetaSse, g as DevframeNodeContext, gt as AgentResource, h as DevframeConnectionConfigsRegistry, ht as AgentManifest, i as DevframeDockDefaults, j as ScopedSharedStates, k as ScopedRpcFn, l as McpRouteOptions, m as DevframeCapabilities, mt as AgentHandle, n as DevframeDefinition, o as DevframeSetupInfo, p as ConnectionMetaWebsocket, q as DevframeRpcServerFunctions, r as DevframeDeploymentKind, s as DevframeSseOptions, t as DevframeCliOptions, v as DevframeServiceOf, vt as AgentResourceInput, w as DevframeSettings, wt as DevframeAgentHostEvents, x as DevframeScopedNodeContext, xt as AgentToolProvider, y as DevframeServicesHost, yt as AgentTool, z as RpcBroadcastOptions } from "../devframe-DJMg0WLe.mjs";
+import { $ as DevframeStorageScope, A as DevframeServiceId, At as DevframeAgentHost, B as DevframeScopedNodeRpc, C as RpcStreamingChannelOptions, Ct as AgentResource, D as DevframeRpcSharedStates, Dt as AgentToolInput, E as DevframeRpcServerFunctions, Et as AgentTool, F as DevframeServicesHost, G as ScopedBroadcastOptions, H as DevframeSettings, I as DevframeServicesRegistry, J as ScopedServerFunctions, K as ScopedClientFunctions, L as DevframeServicesScopeRegistry, M as DevframeServiceMeta, Mt as EventEmitter, N as DevframeServiceOf, Nt as EventUnsubscribe, O as DevframeServiceDefinition, Ot as AgentToolProvider, P as DevframeServiceScopeOf, Pt as EventsMap, Q as DevframeHost, R as DevframeServicesState, S as RpcStreamingChannel, St as AgentManifest, T as DevframeRpcClientFunctions, Tt as AgentResourceInput, U as DevframeSettingsRegistry, V as DevframeScopedStreamingHost, W as DevframeSettingsStore, X as SettingsForNamespace, Y as ScopedSharedStates, Z as DevframeViewHost, _ as DevframeNodeRpcSession, a as DevframeDuplicationStrategy, b as RpcSharedStateGetOptions, c as DevframeWsOptions, d as ConnectionMeta, et as DevframeDiagnosticsHost, f as ConnectionMetaSse, g as DevframeNodeContext, h as DevframeConnectionConfigsRegistry, i as DevframeDockDefaults, j as DevframeServiceInput, jt as DevframeAgentHostEvents, k as DevframeServiceDescriptor, kt as AgentToolProviderHandle, l as McpRouteOptions, m as DevframeCapabilities, n as DevframeDefinition, o as DevframeSetupInfo, p as ConnectionMetaWebsocket, q as ScopedRpcFn, r as DevframeDeploymentKind, s as DevframeSseOptions, t as DevframeCliOptions, tt as DevframeDiagnosticsLogger, v as RpcBroadcastOptions, w as RpcStreamingHost, wt as AgentResourceContent, x as RpcSharedStateHost, xt as AgentHandle, y as RpcFunctionsHost, z as DevframeScopedNodeContext } from "../devframe-mbfgpQQC.mjs";
 import { g as RpcFunctionAgentOptions } from "../types-Djq7CBXh.mjs";
 import { d as DevframeRpcConnection, f as DevframeRpcConnectionRequest, p as DevframeRpcTransportKind, u as DevframeNodeRpcSessionMeta } from "../ws-server-D1d3QM9f.mjs";
 import { i as DevframeDefineDiagnosticsOptions } from "../nostics-SPGDgHEP.mjs";
 import { a as RemoteAssetsStore, i as RemoteAssetsProviderCustom, n as RemoteAssetsErrorMessage, o as StaticAssetsSource, r as RemoteAssetsProvider, t as RemoteAssets } from "../remote-assets-Bg4gCUZ_.mjs";
-export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, AgentToolProvider, AgentToolProviderHandle, ConnectionMeta, ConnectionMetaSse, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeCapabilities, DevframeCliOptions, DevframeConnectionConfigsRegistry, type DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDockDefaults, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, type DevframeRpcConnection, type DevframeRpcConnectionRequest, DevframeRpcServerFunctions, DevframeRpcSharedStates, type DevframeRpcTransportKind, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeServiceId, DevframeServiceOf, DevframeServicesHost, DevframeServicesRegistry, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSseOptions, DevframeStorageScope, DevframeViewHost, DevframeWsOptions, EventEmitter, EventUnsubscribe, EventsMap, McpRouteOptions, RemoteAssets, RemoteAssetsErrorMessage, RemoteAssetsProvider, RemoteAssetsProviderCustom, RemoteAssetsStore, RpcBroadcastOptions, type RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedRpcFn, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, StaticAssetsSource };
+export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, AgentToolProvider, AgentToolProviderHandle, ConnectionMeta, ConnectionMetaSse, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeCapabilities, DevframeCliOptions, DevframeConnectionConfigsRegistry, type DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDockDefaults, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, type DevframeRpcConnection, type DevframeRpcConnectionRequest, DevframeRpcServerFunctions, DevframeRpcSharedStates, type DevframeRpcTransportKind, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeServiceDefinition, DevframeServiceDescriptor, DevframeServiceId, DevframeServiceInput, DevframeServiceMeta, DevframeServiceOf, DevframeServiceScopeOf, DevframeServicesHost, DevframeServicesRegistry, DevframeServicesScopeRegistry, DevframeServicesState, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSseOptions, DevframeStorageScope, DevframeViewHost, DevframeWsOptions, EventEmitter, EventUnsubscribe, EventsMap, McpRouteOptions, RemoteAssets, RemoteAssetsErrorMessage, RemoteAssetsProvider, RemoteAssetsProviderCustom, RemoteAssetsStore, RpcBroadcastOptions, type RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedRpcFn, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, StaticAssetsSource };

package/dist/utils/events.d.mts

@@ -1,4 +1,4 @@
-import { Dt as EventsMap, Tt as EventEmitter } from "../devframe-DJMg0WLe.mjs";
+import { Mt as EventEmitter, Pt as EventsMap } from "../devframe-mbfgpQQC.mjs";
 //#region src/utils/events.d.ts
 /**
  * Create event emitter.

package/dist/utils/get-port.mjs

@@ -1,2 +1,2 @@
-import { n as getPort } from "../dist-eNI9qM_I.mjs";
+import { n as getPort } from "../dist-CZXfGEkd.mjs";
 export { getPort };

package/dist/utils/hash.mjs

@@ -1,2 +1,2 @@
-import { t as hash } from "../hash-KtDZYXDN.mjs";
+import { t as hash } from "../hash-DdPnc4k3.mjs";
 export { hash };

package/dist/utils/launch-editor.mjs

@@ -1,4 +1,4 @@
-import { i as __toESM, r as __require, t as __commonJSMin } from "../rolldown-runtime-JspESFgx.mjs";
+import { i as __toESM, r as __require, t as __commonJSMin } from "../rolldown-runtime-B4iAMlE-.mjs";
 //#region ../../node_modules/.pnpm/picocolors@1.1.1/node_modules/picocolors/picocolors.js
 var require_picocolors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	let p = process || {};
@@ -269,16 +269,17 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				if (esc) {
 					out += c;
 					esc = false;
-				} else if (quote) if (c === quote) quote = false;
-				else if (quote == SQ) out += c;
-				else if (c === BS) {
-					i += 1;
-					c = s.charAt(i);
-					if (c === DQ || c === BS || c === DS) out += c;
-					else out += BS + c;
-				} else if (c === DS) out += parseEnvVar();
-				else out += c;
-				else if (c === DQ || c === SQ) {
+				} else if (quote) {
+					if (c === quote) quote = false;
+					else if (quote == SQ) out += c;
+					else if (c === BS) {
+						i += 1;
+						c = s.charAt(i);
+						if (c === DQ || c === BS || c === DS) out += c;
+						else out += BS + c;
+					} else if (c === DS) out += parseEnvVar();
+					else out += c;
+				} else if (c === DQ || c === SQ) {
 					quote = c;
 					sawQuote = true;
 				} else if (controlRE.test(c)) return { op: s };

package/dist/utils/open.mjs

@@ -1,5 +1,5 @@
-import fs from "node:fs";
 import process from "node:process";
+import fs from "node:fs";
 import { spawn } from "node:child_process";
 //#region src/utils/open.ts
 /**

package/dist/utils/remote-assets.d.mts

@@ -9,7 +9,13 @@ import { a as RemoteAssetsStore, o as StaticAssetsSource } from "../remote-asset
  *
  * A remote source's `package`/`version` are validated first (`DF0065`) — both
  * are interpolated into CDN URLs and the cache path.
+ *
+ * `defaultResolveFrom` (typically the declaring devframe's `importMetaUrl`)
+ * supplies a `resolveFrom` base for a remote source that doesn't set one:
+ * it is applied only when `source.resolveFrom` is `undefined`, so an explicit
+ * per-source string still wins and an explicit `null` still opts out of the
+ * installed-copy lookup.
  */
-declare function resolveStaticAssetsSource(source: StaticAssetsSource, projectStorageDir: string): string | RemoteAssetsStore;
+declare function resolveStaticAssetsSource(source: StaticAssetsSource, projectStorageDir: string, defaultResolveFrom?: string | null): string | RemoteAssetsStore;
 //#endregion
 export { resolveStaticAssetsSource };

package/dist/utils/remote-assets.mjs

@@ -1,2 +1,2 @@
-import { t as resolveStaticAssetsSource } from "../remote-assets-nTTxY2MU.mjs";
+import { t as resolveStaticAssetsSource } from "../remote-assets-CqxiyltC.mjs";
 export { resolveStaticAssetsSource };

package/dist/utils/serve-static.mjs

@@ -1,9 +1,9 @@
-import { DEVFRAME_REMOTE_ASSETS_ERROR_MESSAGE_TYPE } from "../constants.mjs";
+import { t as DEVFRAME_EVENTS } from "../events-DKfSmoTj.mjs";
+import { extname, join, normalize, resolve, sep } from "pathe";
 import { createReadStream } from "node:fs";
 import { stat } from "node:fs/promises";
 import { Readable } from "node:stream";
 import { lookup } from "mrmime";
-import { extname, join, normalize, resolve, sep } from "pathe";
 import { H3, defineHandler } from "h3";
 //#region src/utils/serve-static.ts
 const HTML_EXTENSIONS = [".html", ".htm"];
@@ -231,12 +231,13 @@ function remoteErrorPage(pkg, version, reason) {
 	const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 	const name = esc(pkg);
 	const ver = esc(version);
-	const payload = JSON.stringify({
-		type: DEVFRAME_REMOTE_ASSETS_ERROR_MESSAGE_TYPE,
+	const message = {
+		type: DEVFRAME_EVENTS.postMessage.remoteAssetsError,
 		package: pkg,
 		version,
 		reason
-	}).replace(/</g, "\\u003c");
+	};
+	const payload = JSON.stringify(message).replace(/</g, "\\u003c");
 	return `<!doctype html>
 <html lang="en">
 <head>

package/dist/utils/shared-state.d.mts

@@ -1,2 +1,2 @@
-import { at as ImmutableArray, ct as ImmutableSet, dt as SharedStateOptions, ft as SharedStatePatch, it as Immutable, lt as SharedState, ot as ImmutableMap, pt as createSharedState, st as ImmutableObject, ut as SharedStateEvents } from "../devframe-DJMg0WLe.mjs";
+import { _t as SharedStateEvents, bt as createSharedState, dt as Immutable, ft as ImmutableArray, gt as SharedState, ht as ImmutableSet, mt as ImmutableObject, pt as ImmutableMap, vt as SharedStateOptions, yt as SharedStatePatch } from "../devframe-mbfgpQQC.mjs";
 export { Immutable, ImmutableArray, ImmutableMap, ImmutableObject, ImmutableSet, SharedState, SharedStateEvents, SharedStateOptions, SharedStatePatch, createSharedState };

package/dist/utils/shared-state.mjs

@@ -1,2 +1,2 @@
-import { t as createSharedState } from "../shared-state-fRRbRUtD.mjs";
+import { t as createSharedState } from "../shared-state-DoXutg_U.mjs";
 export { createSharedState };

package/dist/utils/streaming-channel.d.mts

@@ -1,2 +1,2 @@
-import { $ as StreamReader, Q as StreamErrorPayload, X as CreateStreamReaderOptions, Y as BufferedChunk, Z as CreateStreamSinkOptions, et as StreamSink, nt as createStreamReader, rt as createStreamSink, tt as StreamSinkEvents } from "../devframe-DJMg0WLe.mjs";
+import { at as StreamErrorPayload, ct as StreamSinkEvents, it as CreateStreamSinkOptions, lt as createStreamReader, nt as BufferedChunk, ot as StreamReader, rt as CreateStreamReaderOptions, st as StreamSink, ut as createStreamSink } from "../devframe-mbfgpQQC.mjs";
 export { BufferedChunk, CreateStreamReaderOptions, CreateStreamSinkOptions, StreamErrorPayload, StreamReader, StreamSink, StreamSinkEvents, createStreamReader, createStreamSink };