devframe 0.9.1 → 0.9.2

package/dist/{remote-assets-DRfY2RjX.mjs → remote-assets-CqxiyltC.mjs}

@@ -1,4 +1,4 @@
-import { t as diagnostics } from "./diagnostics-Di8ytitn.mjs";
+import { t as diagnostics } from "./diagnostics-DI1HGj2I.mjs";
 import { createRequire } from "node:module";
 import { isatty } from "node:tty";
 import { formatWithOptions, inspect } from "node:util";
@@ -627,11 +627,21 @@ function assertValidRemoteAssets(assets) {
 *
 * A remote source's `package`/`version` are validated first (`DF0065`) — both
 * are interpolated into CDN URLs and the cache path.
+*
+* `defaultResolveFrom` (typically the declaring devframe's `importMetaUrl`)
+* supplies a `resolveFrom` base for a remote source that doesn't set one:
+* it is applied only when `source.resolveFrom` is `undefined`, so an explicit
+* per-source string still wins and an explicit `null` still opts out of the
+* installed-copy lookup.
 */
-function resolveStaticAssetsSource(source, projectStorageDir) {
+function resolveStaticAssetsSource(source, projectStorageDir, defaultResolveFrom) {
 	if (typeof source === "string") return source;
 	assertValidRemoteAssets(source);
-	return resolveInstalled(source) ?? createStore(source, join(projectStorageDir, ".remote-assets", `${source.package.replace(/\//g, "+")}@${source.version}`));
+	const resolved = source.resolveFrom === void 0 && defaultResolveFrom != null ? {
+		...source,
+		resolveFrom: defaultResolveFrom
+	} : source;
+	return resolveInstalled(resolved) ?? createStore(resolved, join(projectStorageDir, ".remote-assets", `${resolved.package.replace(/\//g, "+")}@${resolved.version}`));
 }
 //#endregion
 export { createDebug as n, resolveStaticAssetsSource as t };

package/dist/rpc/dump.mjs

@@ -1,2 +1,2 @@
-import { a as reviveDumpError, i as getDefinitionsWithDumps, n as createClientFromDump, o as serializeDumpError, r as dumpFunctions, t as collectStaticRpcDump } from "../static-BPZ1_OPA.mjs";
+import { a as reviveDumpError, i as getDefinitionsWithDumps, n as createClientFromDump, o as serializeDumpError, r as dumpFunctions, t as collectStaticRpcDump } from "../static-DV_qUSRS.mjs";
 export { collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError };

package/dist/rpc/index.mjs

@@ -1,4 +1,4 @@
-import { a as validateRpcArgs, i as getRpcResolvedSetupResult, n as validateDefinitions, o as validateRpcReturn, r as getRpcHandler, s as hash, t as validateDefinition } from "../validation-CpXFB6Dz.mjs";
+import { a as validateRpcArgs, i as getRpcResolvedSetupResult, n as validateDefinitions, o as validateRpcReturn, r as getRpcHandler, s as hash, t as validateDefinition } from "../validation-YrZH6atx.mjs";
 import { t as diagnostics } from "../diagnostics-CD8nlgll.mjs";
 import { n as defineRpcFunction, t as createDefineWrapperWithContext } from "../define-BLWPsH6y.mjs";
 import { n as strictJsonStringify, t as STRUCTURED_CLONE_PREFIX } from "../serialization-BGzEwAdr.mjs";

package/dist/rpc/transports/ws-bun.d.mts

@@ -1,5 +1,5 @@
 import { n as WsOriginRegistry } from "../../ws-server-D1d3QM9f.mjs";
-import { t as ContextRpcServer } from "../../rpc-core-CR8o34O9.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-dV69u4lY.mjs";
 //#region src/rpc/transports/ws-bun.d.ts
 interface AttachBunWsTransportOptions {
   /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */

package/dist/rpc/transports/ws-deno.d.mts

@@ -0,0 +1,26 @@
+import { n as WsOriginRegistry } from "../../ws-server-D1d3QM9f.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-dV69u4lY.mjs";
+//#region src/rpc/transports/ws-deno.d.ts
+interface AttachDenoWsTransportOptions {
+  /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */
+  allowedOrigins?: readonly string[] | WsOriginRegistry | false;
+}
+interface DenoWsTier {
+  /**
+   * Complete a WS upgrade request — `Deno.serve`'s handler info as the 2nd
+   * argument. Unlike Bun, Deno's adapter attaches the socket to the returned
+   * `Response` itself, so there is no `websocket` handler object to register.
+   */
+  handleUpgrade: (request: Request, info: unknown) => Promise<Response>;
+  close: () => Promise<void>;
+}
+/**
+ * The Deno fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the
+ * same RPC peer wiring as `attachWsRpcTransport`, driven by crossws's Deno
+ * adapter so upgrades complete through `handleUpgrade(request, info)` on the
+ * app's own origin, with no side-car server. Load it dynamically so the Deno
+ * adapter never enters a Node-only bundle path.
+ */
+declare function attachDenoWsTransport(core: ContextRpcServer, options?: AttachDenoWsTransportOptions): Promise<DenoWsTier>;
+//#endregion
+export { AttachDenoWsTransportOptions, DenoWsTier, attachDenoWsTransport };

package/dist/rpc/transports/ws-deno.mjs

@@ -0,0 +1,30 @@
+import { i as isAllowedOrigin, r as createWsRpcPeerHooks } from "../../ws-server-BdSLrhxE.mjs";
+//#region src/rpc/transports/ws-deno.ts
+/**
+* The Deno fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the
+* same RPC peer wiring as `attachWsRpcTransport`, driven by crossws's Deno
+* adapter so upgrades complete through `handleUpgrade(request, info)` on the
+* app's own origin, with no side-car server. Load it dynamically so the Deno
+* adapter never enters a Node-only bundle path.
+*/
+async function attachDenoWsTransport(core, options = {}) {
+	const { default: denoAdapter } = await import("crossws/adapters/deno");
+	const { allowedOrigins } = options;
+	const ws = denoAdapter({ hooks: {
+		...createWsRpcPeerHooks(core.rpcGroup, {
+			onConnected: core.onConnected,
+			onDisconnected: core.onDisconnected
+		}),
+		upgrade(request) {
+			const origin = request.headers.get("origin") ?? void 0;
+			const allowed = allowedOrigins && !Array.isArray(allowedOrigins) ? allowedOrigins.isAllowed(origin) : isAllowedOrigin(origin, allowedOrigins || []);
+			if (allowedOrigins !== false && !allowed) return new Response("Forbidden", { status: 403 });
+		}
+	} });
+	return {
+		handleUpgrade: (request, info) => ws.handleUpgrade(request, info),
+		close: () => ws.close()
+	};
+}
+//#endregion
+export { attachDenoWsTransport };

package/dist/{rpc-core-Dru9uoM0.mjs → rpc-core-DRYnbxdD.mjs}

@@ -1,6 +1,6 @@
 import { n as __exportAll } from "./rolldown-runtime-B4iAMlE-.mjs";
 import { createRpcServer } from "./rpc/server.mjs";
-import { t as diagnostics } from "./diagnostics-Di8ytitn.mjs";
+import { t as diagnostics } from "./diagnostics-DI1HGj2I.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/node/rpc-core.ts
 var rpc_core_exports = /* @__PURE__ */ __exportAll({ createContextRpcServer: () => createContextRpcServer });
@@ -58,21 +58,14 @@ function createContextRpcServer(options) {
 			return { isTrusted: true };
 		}
 	});
-	const onConnected = (connection, meta) => {
-		Promise.resolve().then(() => context.services.ready?.()).catch((error) => {
-			const reason = error instanceof Error ? error.message : String(error);
-			diagnostics.DF0071({
-				reason,
-				cause: error
-			}, { method: "error" });
-		});
+	const onConnected = authHandler || options.onPeerConnect ? (connection, meta) => {
 		const session = {
 			meta,
 			rpc: rpcGroup.clients.find((client) => client.$meta === meta)
 		};
 		authHandler?.onConnect(connection, session);
 		options.onPeerConnect?.(connection, session);
-	};
+	} : void 0;
 	const onDisconnected = (connection, meta) => {
 		options.onPeerDisconnect?.(connection, meta);
 		rpcHost._emitSessionDisconnected(meta);

package/dist/{rpc-core-CR8o34O9.d.mts → rpc-core-dV69u4lY.d.mts}

@@ -1,6 +1,6 @@
-import { E as DevframeRpcServerFunctions, T as DevframeRpcClientFunctions, _ as DevframeNodeRpcSession, g as DevframeNodeContext, u as DevframeAuthHandler } from "./devframe-BlLEZR-x.mjs";
+import { E as DevframeRpcServerFunctions, T as DevframeRpcClientFunctions, _ as DevframeNodeRpcSession, g as DevframeNodeContext, u as DevframeAuthHandler } from "./devframe-mbfgpQQC.mjs";
 import { d as DevframeRpcConnection, u as DevframeNodeRpcSessionMeta } from "./ws-server-D1d3QM9f.mjs";
-import "./index-BKFT9-jA.mjs";
+import "./index-Dipgo9ji.mjs";
 import { BirpcGroup, EventOptions } from "birpc";
 //#region src/node/rpc-core.d.ts
 interface CreateContextRpcServerOptions {

package/dist/{shared-state-fRRbRUtD.mjs → shared-state-DoXutg_U.mjs}

@@ -1,6 +1,6 @@
 import { createEventEmitter } from "./utils/events.mjs";
 import { nanoid } from "./utils/nanoid.mjs";
-//#region ../../node_modules/.pnpm/immer@11.1.16/node_modules/immer/dist/immer.mjs
+//#region ../../node_modules/.pnpm/immer@11.1.17/node_modules/immer/dist/immer.mjs
 var NOTHING = Symbol.for("immer-nothing");
 var DRAFTABLE = Symbol.for("immer-draftable");
 var DRAFT_STATE = Symbol.for("immer-state");

package/dist/{static-BPZ1_OPA.mjs → static-DV_qUSRS.mjs}

@@ -1,4 +1,4 @@
-import { n as validateDefinitions, r as getRpcHandler, s as hash } from "./validation-CpXFB6Dz.mjs";
+import { n as validateDefinitions, r as getRpcHandler, s as hash } from "./validation-YrZH6atx.mjs";
 import { t as diagnostics } from "./diagnostics-CD8nlgll.mjs";
 import { DEVFRAME_RPC_DUMP_DIRNAME } from "./constants.mjs";
 //#region ../../node_modules/.pnpm/yocto-queue@1.2.2/node_modules/yocto-queue/index.js

package/dist/{storage-D4a99Ung.mjs → storage-BNqSAOxA.mjs}

@@ -1,4 +1,4 @@
-import { t as diagnostics } from "./diagnostics-Di8ytitn.mjs";
+import { t as diagnostics } from "./diagnostics-DI1HGj2I.mjs";
 import { createSharedState } from "devframe/utils/shared-state";
 import process from "node:process";
 import { dirname } from "pathe";

package/dist/types/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as DevframeStorageScope, A as DevframeServiceId, At as DevframeAgentHost, B as DevframeScopedNodeRpc, C as RpcStreamingChannelOptions, Ct as AgentResource, D as DevframeRpcSharedStates, Dt as AgentToolInput, E as DevframeRpcServerFunctions, Et as AgentTool, F as DevframeServicesHost, G as ScopedBroadcastOptions, H as DevframeSettings, I as DevframeServicesRegistry, J as ScopedServerFunctions, K as ScopedClientFunctions, L as DevframeServicesScopeRegistry, M as DevframeServiceMeta, Mt as EventEmitter, N as DevframeServiceOf, Nt as EventUnsubscribe, O as DevframeServiceDefinition, Ot as AgentToolProvider, P as DevframeServiceScopeOf, Pt as EventsMap, Q as DevframeHost, R as DevframeServicesState, S as RpcStreamingChannel, St as AgentManifest, T as DevframeRpcClientFunctions, Tt as AgentResourceInput, U as DevframeSettingsRegistry, V as DevframeScopedStreamingHost, W as DevframeSettingsStore, X as SettingsForNamespace, Y as ScopedSharedStates, Z as DevframeViewHost, _ as DevframeNodeRpcSession, a as DevframeDuplicationStrategy, b as RpcSharedStateGetOptions, c as DevframeWsOptions, d as ConnectionMeta, et as DevframeDiagnosticsHost, f as ConnectionMetaSse, g as DevframeNodeContext, h as DevframeConnectionConfigsRegistry, i as DevframeDockDefaults, j as DevframeServiceInput, jt as DevframeAgentHostEvents, k as DevframeServiceDescriptor, kt as AgentToolProviderHandle, l as McpRouteOptions, m as DevframeCapabilities, n as DevframeDefinition, o as DevframeSetupInfo, p as ConnectionMetaWebsocket, q as ScopedRpcFn, r as DevframeDeploymentKind, s as DevframeSseOptions, t as DevframeCliOptions, tt as DevframeDiagnosticsLogger, v as RpcBroadcastOptions, w as RpcStreamingHost, wt as AgentResourceContent, x as RpcSharedStateHost, xt as AgentHandle, y as RpcFunctionsHost, z as DevframeScopedNodeContext } from "../devframe-BlLEZR-x.mjs";
+import { $ as DevframeStorageScope, A as DevframeServiceId, At as DevframeAgentHost, B as DevframeScopedNodeRpc, C as RpcStreamingChannelOptions, Ct as AgentResource, D as DevframeRpcSharedStates, Dt as AgentToolInput, E as DevframeRpcServerFunctions, Et as AgentTool, F as DevframeServicesHost, G as ScopedBroadcastOptions, H as DevframeSettings, I as DevframeServicesRegistry, J as ScopedServerFunctions, K as ScopedClientFunctions, L as DevframeServicesScopeRegistry, M as DevframeServiceMeta, Mt as EventEmitter, N as DevframeServiceOf, Nt as EventUnsubscribe, O as DevframeServiceDefinition, Ot as AgentToolProvider, P as DevframeServiceScopeOf, Pt as EventsMap, Q as DevframeHost, R as DevframeServicesState, S as RpcStreamingChannel, St as AgentManifest, T as DevframeRpcClientFunctions, Tt as AgentResourceInput, U as DevframeSettingsRegistry, V as DevframeScopedStreamingHost, W as DevframeSettingsStore, X as SettingsForNamespace, Y as ScopedSharedStates, Z as DevframeViewHost, _ as DevframeNodeRpcSession, a as DevframeDuplicationStrategy, b as RpcSharedStateGetOptions, c as DevframeWsOptions, d as ConnectionMeta, et as DevframeDiagnosticsHost, f as ConnectionMetaSse, g as DevframeNodeContext, h as DevframeConnectionConfigsRegistry, i as DevframeDockDefaults, j as DevframeServiceInput, jt as DevframeAgentHostEvents, k as DevframeServiceDescriptor, kt as AgentToolProviderHandle, l as McpRouteOptions, m as DevframeCapabilities, n as DevframeDefinition, o as DevframeSetupInfo, p as ConnectionMetaWebsocket, q as ScopedRpcFn, r as DevframeDeploymentKind, s as DevframeSseOptions, t as DevframeCliOptions, tt as DevframeDiagnosticsLogger, v as RpcBroadcastOptions, w as RpcStreamingHost, wt as AgentResourceContent, x as RpcSharedStateHost, xt as AgentHandle, y as RpcFunctionsHost, z as DevframeScopedNodeContext } from "../devframe-mbfgpQQC.mjs";
 import { g as RpcFunctionAgentOptions } from "../types-Djq7CBXh.mjs";
 import { d as DevframeRpcConnection, f as DevframeRpcConnectionRequest, p as DevframeRpcTransportKind, u as DevframeNodeRpcSessionMeta } from "../ws-server-D1d3QM9f.mjs";
 import { i as DevframeDefineDiagnosticsOptions } from "../nostics-SPGDgHEP.mjs";

package/dist/utils/events.d.mts

@@ -1,4 +1,4 @@
-import { Mt as EventEmitter, Pt as EventsMap } from "../devframe-BlLEZR-x.mjs";
+import { Mt as EventEmitter, Pt as EventsMap } from "../devframe-mbfgpQQC.mjs";
 //#region src/utils/events.d.ts
 /**
  * Create event emitter.

package/dist/utils/hash.mjs

@@ -1,2 +1,2 @@
-import { t as hash } from "../hash-KtDZYXDN.mjs";
+import { t as hash } from "../hash-DdPnc4k3.mjs";
 export { hash };

package/dist/utils/remote-assets.d.mts

@@ -9,7 +9,13 @@ import { a as RemoteAssetsStore, o as StaticAssetsSource } from "../remote-asset
  *
  * A remote source's `package`/`version` are validated first (`DF0065`) — both
  * are interpolated into CDN URLs and the cache path.
+ *
+ * `defaultResolveFrom` (typically the declaring devframe's `importMetaUrl`)
+ * supplies a `resolveFrom` base for a remote source that doesn't set one:
+ * it is applied only when `source.resolveFrom` is `undefined`, so an explicit
+ * per-source string still wins and an explicit `null` still opts out of the
+ * installed-copy lookup.
  */
-declare function resolveStaticAssetsSource(source: StaticAssetsSource, projectStorageDir: string): string | RemoteAssetsStore;
+declare function resolveStaticAssetsSource(source: StaticAssetsSource, projectStorageDir: string, defaultResolveFrom?: string | null): string | RemoteAssetsStore;
 //#endregion
 export { resolveStaticAssetsSource };

package/dist/utils/remote-assets.mjs

@@ -1,2 +1,2 @@
-import { t as resolveStaticAssetsSource } from "../remote-assets-DRfY2RjX.mjs";
+import { t as resolveStaticAssetsSource } from "../remote-assets-CqxiyltC.mjs";
 export { resolveStaticAssetsSource };

package/dist/utils/shared-state.d.mts

@@ -1,2 +1,2 @@
-import { _t as SharedStateEvents, bt as createSharedState, dt as Immutable, ft as ImmutableArray, gt as SharedState, ht as ImmutableSet, mt as ImmutableObject, pt as ImmutableMap, vt as SharedStateOptions, yt as SharedStatePatch } from "../devframe-BlLEZR-x.mjs";
+import { _t as SharedStateEvents, bt as createSharedState, dt as Immutable, ft as ImmutableArray, gt as SharedState, ht as ImmutableSet, mt as ImmutableObject, pt as ImmutableMap, vt as SharedStateOptions, yt as SharedStatePatch } from "../devframe-mbfgpQQC.mjs";
 export { Immutable, ImmutableArray, ImmutableMap, ImmutableObject, ImmutableSet, SharedState, SharedStateEvents, SharedStateOptions, SharedStatePatch, createSharedState };

package/dist/utils/shared-state.mjs

@@ -1,2 +1,2 @@
-import { t as createSharedState } from "../shared-state-fRRbRUtD.mjs";
+import { t as createSharedState } from "../shared-state-DoXutg_U.mjs";
 export { createSharedState };

package/dist/utils/streaming-channel.d.mts

@@ -1,2 +1,2 @@
-import { at as StreamErrorPayload, ct as StreamSinkEvents, it as CreateStreamSinkOptions, lt as createStreamReader, nt as BufferedChunk, ot as StreamReader, rt as CreateStreamReaderOptions, st as StreamSink, ut as createStreamSink } from "../devframe-BlLEZR-x.mjs";
+import { at as StreamErrorPayload, ct as StreamSinkEvents, it as CreateStreamSinkOptions, lt as createStreamReader, nt as BufferedChunk, ot as StreamReader, rt as CreateStreamReaderOptions, st as StreamSink, ut as createStreamSink } from "../devframe-mbfgpQQC.mjs";
 export { BufferedChunk, CreateStreamReaderOptions, CreateStreamSinkOptions, StreamErrorPayload, StreamReader, StreamSink, StreamSinkEvents, createStreamReader, createStreamSink };

package/dist/validation-YrZH6atx.mjs

@@ -0,0 +1,311 @@
+import { t as diagnostics } from "./diagnostics-CD8nlgll.mjs";
+import { createHash } from "node:crypto";
+//#region ../../node_modules/.pnpm/ohash@2.0.12/node_modules/ohash/dist/_chunks/is-equal.mjs
+function serialize(input) {
+	if (typeof input === "string") return `'${input}'`;
+	return new Serializer().serialize(input);
+}
+const asciiOrder = " _-,;:!?.'\"()[]{}@*/\\&#%`^+<=>|~$0123456789abcdefghijklmnopqrstuvwxyz";
+const asciiWeights = /*@__PURE__*/ (function() {
+	const weights = /* @__PURE__ */ new Uint8Array(128);
+	for (let i = 0; i < 69; i++) weights[asciiOrder.charCodeAt(i)] = i + 1;
+	for (let code = 65; code <= 90; code++) weights[code] = weights[code + 32];
+	return weights;
+})();
+function compareStrings(a, b) {
+	if (a === b) return 0;
+	const length = Math.min(a.length, b.length);
+	let tieBreaker = 0;
+	for (let i = 0; i < length; i++) {
+		const codeA = a.charCodeAt(i);
+		const codeB = b.charCodeAt(i);
+		if (codeA === codeB) continue;
+		const weightA = codeA < 128 && asciiWeights[codeA] ? asciiWeights[codeA] : codeA + 128;
+		const weightB = codeB < 128 && asciiWeights[codeB] ? asciiWeights[codeB] : codeB + 128;
+		if (weightA !== weightB) return weightA < weightB ? -1 : 1;
+		if (tieBreaker === 0) tieBreaker = codeA > codeB ? -1 : 1;
+	}
+	if (a.length !== b.length) return a.length < b.length ? -1 : 1;
+	return tieBreaker;
+}
+const Serializer = /*@__PURE__*/ (function() {
+	class Serializer {
+		#context = /* @__PURE__ */ new Map();
+		compare(a, b) {
+			const typeA = typeof a;
+			const typeB = typeof b;
+			if (typeA === "string" && typeB === "string") return compareStrings(a, b);
+			if (typeA === "number" && typeB === "number") return a - b;
+			return compareStrings(this.serialize(a, true), this.serialize(b, true));
+		}
+		serialize(value, noQuotes) {
+			if (value === null) return "null";
+			switch (typeof value) {
+				case "string": return noQuotes ? value : `'${value}'`;
+				case "bigint": return `${value}n`;
+				case "object": return this.$object(value);
+				case "function": return this.$function(value);
+			}
+			return String(value);
+		}
+		serializeObject(object) {
+			const objString = Object.prototype.toString.call(object);
+			if (objString !== "[object Object]") return this.serializeBuiltInType(objString.length < 10 ? `unknown:${objString}` : objString.slice(8, -1), object);
+			const constructor = object.constructor;
+			const objName = constructor === Object || constructor === void 0 ? "" : constructor.name;
+			if (objName !== "" && globalThis[objName] === constructor) return this.serializeBuiltInType(objName, object);
+			if ("toJSON" in object && typeof object.toJSON === "function") {
+				const json = object.toJSON();
+				return objName + (json !== null && typeof json === "object" ? this.$object(json) : `(${this.serialize(json)})`);
+			}
+			const keys = Object.keys(object).sort(compareStrings);
+			let content = `${objName}{`;
+			for (let i = 0; i < keys.length; i++) {
+				const key = keys[i];
+				content += `${key}:${this.serialize(object[key])}`;
+				if (i < keys.length - 1) content += ",";
+			}
+			return content + "}";
+		}
+		serializeBuiltInType(type, object) {
+			const handler = this["$" + type];
+			if (handler) return handler.call(this, object);
+			if (typeof object.entries === "function") return this.serializeObjectEntries(type, object.entries());
+			throw new Error(`Cannot serialize ${type}`);
+		}
+		serializeObjectEntries(type, entries) {
+			const sortedEntries = Array.from(entries).sort((a, b) => this.compare(a[0], b[0]));
+			let content = `${type}{`;
+			for (let i = 0; i < sortedEntries.length; i++) {
+				const [key, value] = sortedEntries[i];
+				content += `${this.serialize(key, true)}:${this.serialize(value)}`;
+				if (i < sortedEntries.length - 1) content += ",";
+			}
+			return content + "}";
+		}
+		$object(object) {
+			let content = this.#context.get(object);
+			if (content === void 0) {
+				this.#context.set(object, `#${this.#context.size}`);
+				content = this.serializeObject(object);
+				this.#context.set(object, content);
+			}
+			return content;
+		}
+		$function(fn) {
+			const fnStr = Function.prototype.toString.call(fn);
+			if (fnStr.slice(-15) === "[native code] }") return `${fn.name || ""}()[native]`;
+			return `${fn.name}(${fn.length})${fnStr.replace(/\s*\n\s*/g, "")}`;
+		}
+		$Array(arr) {
+			let content = "[";
+			for (let i = 0; i < arr.length; i++) {
+				content += this.serialize(arr[i]);
+				if (i < arr.length - 1) content += ",";
+			}
+			return content + "]";
+		}
+		$Date(date) {
+			try {
+				return `Date(${date.toISOString()})`;
+			} catch {
+				return `Date(null)`;
+			}
+		}
+		$ArrayBuffer(arr) {
+			return `ArrayBuffer[${new Uint8Array(arr).join(",")}]`;
+		}
+		$Set(set) {
+			return `Set${this.$Array(Array.from(set).sort((a, b) => this.compare(a, b)))}`;
+		}
+		$Map(map) {
+			return this.serializeObjectEntries("Map", map.entries());
+		}
+	}
+	for (const type of [
+		"Error",
+		"RegExp",
+		"URL"
+	]) Serializer.prototype["$" + type] = function(val) {
+		return `${type}(${val})`;
+	};
+	for (const type of [
+		"Int8Array",
+		"Uint8Array",
+		"Uint8ClampedArray",
+		"Int16Array",
+		"Uint16Array",
+		"Int32Array",
+		"Uint32Array",
+		"Float32Array",
+		"Float64Array"
+	]) Serializer.prototype["$" + type] = function(arr) {
+		return `${type}[${arr.join(",")}]`;
+	};
+	for (const type of ["BigInt64Array", "BigUint64Array"]) Serializer.prototype["$" + type] = function(arr) {
+		return `${type}[${arr.join("n,")}${arr.length > 0 ? "n" : ""}]`;
+	};
+	return Serializer;
+})();
+//#endregion
+//#region ../../node_modules/.pnpm/ohash@2.0.12/node_modules/ohash/dist/crypto/node/index.mjs
+const fastHash = /*@__PURE__*/ (() => globalThis.process?.getBuiltinModule?.("crypto")?.hash)();
+const algorithm = "sha256";
+const encoding = "base64url";
+function digest(data) {
+	if (fastHash) return fastHash(algorithm, data, encoding);
+	const h = createHash(algorithm).update(data);
+	return globalThis.process?.versions?.webcontainer ? h.digest().toString(encoding) : h.digest(encoding);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/ohash@2.0.12/node_modules/ohash/dist/index.mjs
+function hash$1(input) {
+	return digest(serialize(input));
+}
+//#endregion
+//#region src/utils/hash.ts
+/**
+* Stable, deterministic hash of any structured-cloneable value.
+*/
+function hash(value) {
+	return hash$1(value);
+}
+//#endregion
+//#region src/rpc/validate-io.ts
+/**
+* Run a single [Standard Schema](https://standardschema.dev) validator,
+* awaiting the result when the validator is asynchronous.
+*/
+async function runStandardSchema(schema, value) {
+	const result = schema["~standard"].validate(value);
+	return result instanceof Promise ? await result : result;
+}
+/**
+* Render Standard Schema issues into a single human-readable line for a
+* diagnostic message, prefixing each with its dotted path when present.
+*/
+function formatIssues(issues) {
+	return issues.map((issue) => {
+		const path = issue.path?.map((segment) => typeof segment === "object" ? segment.key : segment).join(".");
+		return path ? `${path}: ${issue.message}` : issue.message;
+	}).join("; ");
+}
+/**
+* Validate positional arguments against their declared schemas. Only
+* indices with a schema are checked; extra arguments pass through
+* untouched. Throws `DF0038` on the first failing argument.
+*
+* Validation guards the payload without rewriting it: the original values
+* are handed to the handler unchanged, so a schema that describes a subset
+* of an object never silently strips the sender's extra fields (and any
+* declared transforms stay a purely type-level concern).
+*
+* @internal
+*/
+async function validateRpcArgs(name, argsSchema, args) {
+	const original = args.slice();
+	if (!argsSchema || argsSchema.length === 0) return original;
+	for (let index = 0; index < argsSchema.length; index++) {
+		const schema = argsSchema[index];
+		if (!schema) continue;
+		const result = await runStandardSchema(schema, args[index]);
+		if (result.issues) throw diagnostics.DF0043({
+			name,
+			index,
+			issues: formatIssues(result.issues)
+		});
+	}
+	return original;
+}
+/**
+* Validate a handler's resolved return value against its declared schema.
+* Throws `DF0039` when the value fails the schema, otherwise returns the
+* original value unchanged (guard-only, never rewriting the payload — see
+* {@link validateRpcArgs}). Passes through when no return schema is set.
+*
+* @internal
+*/
+async function validateRpcReturn(name, returnSchema, value) {
+	if (!returnSchema) return value;
+	const result = await runStandardSchema(returnSchema, value);
+	if (result.issues) throw diagnostics.DF0044({
+		name,
+		issues: formatIssues(result.issues)
+	});
+	return value;
+}
+//#endregion
+//#region src/rpc/handler.ts
+async function getRpcResolvedSetupResult(definition, context) {
+	if (!definition.setup) return {};
+	if (typeof context === "object" && context !== null) {
+		definition.__cache ??= /* @__PURE__ */ new WeakMap();
+		const cache = definition.__cache;
+		let promise = cache.get(context);
+		if (!promise) {
+			promise = Promise.resolve(definition.setup(context));
+			promise.catch(() => {
+				if (cache.get(context) === promise) cache.delete(context);
+			});
+			cache.set(context, promise);
+		}
+		return await promise;
+	}
+	if (!definition.__promise) {
+		const promise = Promise.resolve(definition.setup(context));
+		promise.catch(() => {
+			if (definition.__promise === promise) definition.__promise = void 0;
+		});
+		definition.__promise = promise;
+	}
+	return await definition.__promise;
+}
+async function getRpcHandler(definition, context) {
+	let handler = definition.handler;
+	if (!handler) {
+		const result = await getRpcResolvedSetupResult(definition, context);
+		if (!result.handler) throw diagnostics.DF0024({ name: definition.name });
+		handler = result.handler;
+	}
+	const argsSchema = definition.args;
+	const returnSchema = definition.returns;
+	if (!argsSchema && !returnSchema) return handler;
+	const inner = handler;
+	const validating = async (...args) => {
+		const validatedArgs = await validateRpcArgs(definition.name, argsSchema, args);
+		const output = await inner(...validatedArgs);
+		return await validateRpcReturn(definition.name, returnSchema, output);
+	};
+	return validating;
+}
+//#endregion
+//#region src/rpc/validation.ts
+/**
+* Validates RPC function definitions.
+* Action and event functions cannot have dumps (side effects should not be cached).
+*
+* @throws {Error} If an action or event function has a dump configuration
+*/
+function validateDefinitions(definitions) {
+	for (const definition of definitions) {
+		const type = definition.type || "query";
+		if ((type === "action" || type === "event") && definition.dump) throw diagnostics.DF0027({
+			name: definition.name,
+			type
+		});
+		if (definition.snapshot && type !== "query") throw diagnostics.DF0028({
+			name: definition.name,
+			type
+		});
+	}
+}
+/**
+* Validates a single RPC function definition.
+*
+* @throws {Error} If an action or event function has a dump configuration
+*/
+function validateDefinition(definition) {
+	validateDefinitions([definition]);
+}
+//#endregion
+export { validateRpcArgs as a, getRpcResolvedSetupResult as i, validateDefinitions as n, validateRpcReturn as o, getRpcHandler as r, hash as s, validateDefinition as t };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devframe",
   "type": "module",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Framework for building one portable devtool integration that runs in any viewer.",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",
@@ -41,6 +41,7 @@
     "./rpc/transports/sse-client": "./dist/rpc/transports/sse-client.mjs",
     "./rpc/transports/sse-server": "./dist/rpc/transports/sse-server.mjs",
     "./rpc/transports/ws-bun": "./dist/rpc/transports/ws-bun.mjs",
+    "./rpc/transports/ws-deno": "./dist/rpc/transports/ws-deno.mjs",
     "./rpc/transports/ws-client": "./dist/rpc/transports/ws-client.mjs",
     "./rpc/transports/ws-server": "./dist/rpc/transports/ws-server.mjs",
     "./types": "./dist/types/index.mjs",
@@ -103,11 +104,11 @@
     "@modelcontextprotocol/server": "^2.0.0",
     "cac": "^7.0.0",
     "get-port-please": "^3.2.0",
-    "immer": "^11.1.16",
+    "immer": "^11.1.17",
     "launch-editor": "^2.14.1",
     "mlly": "^1.8.2",
     "obug": "^2.1.4",
-    "ohash": "^2.0.11",
+    "ohash": "^2.0.12",
     "p-limit": "^7.3.1",
     "perfect-debounce": "^2.1.0",
     "structured-clone-es": "^2.0.1",

package/skills/devframe/SKILL.md

@@ -558,7 +558,7 @@ Devframe re-exports a curated set of helpers under `devframe/utils/*`. They are
 | `createStreamSink` / `createStreamReader` from `devframe/utils/streaming-channel` | - | Low-level streaming primitives |
 | `evaluateWhen` / `WhenExpression` from `devframe/utils/when` | `whenexpr` | When-clause expressions |
 
-For "open file in editor" + "reveal in finder", prefer the prebuilt `commonRpcFunctions` RPC recipe (`devframe/recipes/common-rpc-functions`) - it wires the two utilities into named RPC functions ready to register.
+For "open file in editor" + "reveal in finder", prefer the `@devframes/service-open` wire service (declare `services: [{ package: '@devframes/service-open' }]` on the definition, gate client UI on `rpc.services.has(...)`) - one host-level installation shared by every plugin, with workspace-root path containment. The older `commonRpcFunctions` recipe (`devframe/recipes/common-rpc-functions`) still works but is deprecated.
 
 ## Security (secure by default)