devframe 0.9.7 → 0.9.8

package/dist/{_shared-BJ6AmwTu.d.mts → _shared-mtXpcJIv.d.mts}

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, G as McpRouteOptions, I as DevframeDeploymentKind, t as ConnectionMeta } from "./context-BhBzOXVa.mjs";
+import { F as DevframeDefinition, G as McpRouteOptions, I as DevframeDeploymentKind, t as ConnectionMeta } from "./context-CLF4-8Pp.mjs";
 //#region src/adapters/_shared.d.ts
 /**
  * Resolve the mount base path for a devframe's SPA. Hosted adapters

package/dist/adapters/build.d.mts

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, V as DevframeSnapshotRpcEntry, o as DevframeNodeContext } from "../context-BhBzOXVa.mjs";
+import { F as DevframeDefinition, V as DevframeSnapshotRpcEntry, o as DevframeNodeContext } from "../context-CLF4-8Pp.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-B13_vRkJ.mjs";
 //#region src/adapters/build.d.ts
 interface CreateBuildOptions {

package/dist/adapters/build.mjs

@@ -1,6 +1,6 @@
 import { s as colors } from "../nostics-CzECRXpE.mjs";
 import { n as strictJsonStringify } from "../serialization-BGzEwAdr.mjs";
-import { resolveClientAssets } from "../index.mjs";
+import { t as resolveClientAssets } from "../client-assets-C7SXgTWY.mjs";
 import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME } from "../constants.mjs";
 import { t as collectStaticRpcDump } from "../static-DV_qUSRS.mjs";
 import { n as structuredCloneStringify } from "../structured-clone-CbAV5rFI.mjs";

package/dist/adapters/cac.d.mts

@@ -1,4 +1,4 @@
-import { Dt as parseCliFlags, Et as defineCliFlags, F as DevframeDefinition, Tt as InferCliFlags, wt as CliFlagsSchema } from "../context-BhBzOXVa.mjs";
+import { Dt as parseCliFlags, Et as defineCliFlags, F as DevframeDefinition, Tt as InferCliFlags, wt as CliFlagsSchema } from "../context-CLF4-8Pp.mjs";
 import { CAC } from "cac";
 import { H3 } from "h3";
 //#region src/adapters/cac.d.ts

package/dist/adapters/cac.mjs

@@ -2,7 +2,7 @@ import { s as colors } from "../nostics-CzECRXpE.mjs";
 import { r as resolveDevServerPort } from "../_shared-BM3PdYli.mjs";
 import { a as importRuntimeModule } from "../instance-shell-CpVW4zG0.mjs";
 import { createBuild } from "./build.mjs";
-import { t as createDevServer } from "../dev-Czit5IP4.mjs";
+import { t as createDevServer } from "../dev-CzkPCJwi.mjs";
 import process from "node:process";
 import cac$1 from "cac";
 //#region src/adapters/flags.ts

package/dist/adapters/dev.d.mts

@@ -1,8 +1,8 @@
-import { d as DevframeRpcConnection, n as WsOriginRegistry, u as DevframeNodeRpcSessionMeta } from "../ws-server-Di2oqr4q.mjs";
-import { Ct as DevframeAuthHandler, F as DevframeDefinition, G as McpRouteOptions, U as DevframeSseOptions, W as DevframeWsOptions, s as DevframeNodeRpcSession } from "../context-BhBzOXVa.mjs";
+import { d as DevframeRpcConnection, n as WsOriginRegistry, u as DevframeNodeRpcSessionMeta } from "../ws-server-VyHlanzy.mjs";
+import { Ct as DevframeAuthHandler, F as DevframeDefinition, G as McpRouteOptions, U as DevframeSseOptions, W as DevframeWsOptions, s as DevframeNodeRpcSession } from "../context-CLF4-8Pp.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-B13_vRkJ.mjs";
-import { c as StartedServer } from "../instance-shell-Bh4l9Vz_.mjs";
-import { a as resolveMcpConnectionMeta, i as resolveDevServerPort, t as ResolveDevServerPortOptions } from "../_shared-BJ6AmwTu.mjs";
+import { c as StartedServer } from "../instance-shell-Tcp5hGoq.mjs";
+import { a as resolveMcpConnectionMeta, i as resolveDevServerPort, t as ResolveDevServerPortOptions } from "../_shared-mtXpcJIv.mjs";
 import { H3 } from "h3";
 //#region src/adapters/dev.d.ts
 interface CreateDevServerOptions {

package/dist/adapters/dev.mjs

@@ -1,3 +1,3 @@
 import { i as resolveMcpConnectionMeta, r as resolveDevServerPort } from "../_shared-BM3PdYli.mjs";
-import { t as createDevServer } from "../dev-Czit5IP4.mjs";
+import { t as createDevServer } from "../dev-CzkPCJwi.mjs";
 export { createDevServer, resolveDevServerPort, resolveMcpConnectionMeta };

package/dist/adapters/embedded.d.mts

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, o as DevframeNodeContext } from "../context-BhBzOXVa.mjs";
+import { F as DevframeDefinition, o as DevframeNodeContext } from "../context-CLF4-8Pp.mjs";
 //#region src/adapters/embedded.d.ts
 interface CreateEmbeddedOptions {
   /** Target context the devframe is registered into. Required. */

package/dist/adapters/initiate.d.mts

@@ -1,7 +1,7 @@
-import { d as DevframeRpcConnection, n as WsOriginRegistry, u as DevframeNodeRpcSessionMeta } from "../ws-server-Di2oqr4q.mjs";
-import { Ct as DevframeAuthHandler, F as DevframeDefinition, G as McpRouteOptions, U as DevframeSseOptions, W as DevframeWsOptions, bt as DevframeStorageScope, o as DevframeNodeContext, s as DevframeNodeRpcSession, t as ConnectionMeta } from "../context-BhBzOXVa.mjs";
+import { d as DevframeRpcConnection, n as WsOriginRegistry, u as DevframeNodeRpcSessionMeta } from "../ws-server-VyHlanzy.mjs";
+import { Ct as DevframeAuthHandler, F as DevframeDefinition, G as McpRouteOptions, U as DevframeSseOptions, W as DevframeWsOptions, bt as DevframeStorageScope, o as DevframeNodeContext, s as DevframeNodeRpcSession, t as ConnectionMeta } from "../context-CLF4-8Pp.mjs";
 import { o as StaticAssetsSource } from "../remote-assets-B13_vRkJ.mjs";
-import { c as StartedServer, f as DevframeInstanceRecord } from "../instance-shell-Bh4l9Vz_.mjs";
+import { c as StartedServer, f as DevframeInstanceRecord } from "../instance-shell-Tcp5hGoq.mjs";
 import { Buffer } from "node:buffer";
 import { IncomingMessage, Server, ServerResponse } from "node:http";
 import { Duplex } from "node:stream";

package/dist/adapters/initiate.mjs

@@ -1,2 +1,2 @@
-import { n as getInstanceInternals, r as initDevframe } from "../dev-Czit5IP4.mjs";
+import { n as getInstanceInternals, r as initDevframe } from "../dev-CzkPCJwi.mjs";
 export { getInstanceInternals, initDevframe };

package/dist/adapters/mcp.d.mts

@@ -1,4 +1,4 @@
-import { F as DevframeDefinition, o as DevframeNodeContext } from "../context-BhBzOXVa.mjs";
+import { F as DevframeDefinition, o as DevframeNodeContext } from "../context-CLF4-8Pp.mjs";
 import { H3 } from "h3";
 import "@modelcontextprotocol/server";
 //#region src/adapters/mcp/build-server.d.ts

package/dist/adapters/mcp.mjs

@@ -1,6 +1,6 @@
 import { t as Diagnostic } from "../nostics-CzECRXpE.mjs";
 import { t as DEVFRAME_EVENTS } from "../events-4daw0uK9.mjs";
-import { i as isAllowedOrigin } from "../ws-server-BdSLrhxE.mjs";
+import { i as isAllowedOrigin } from "../ws-server-Y_AumUQH.mjs";
 import { t as diagnostics } from "../diagnostics-BXWW3VK-.mjs";
 import { t as createHostContext } from "../context-omlma_1n.mjs";
 import { t as toAgentToolName } from "../agent-tool-name-EgfoFO8C.mjs";

package/dist/client/index.d.mts

@@ -1,6 +1,6 @@
 import { f as RpcCacheManager, p as RpcCacheOptions } from "../index-BzyopqxV.mjs";
 import { _ as RpcFunctionDefinition, w as RpcFunctionsCollector } from "../types-CMdPYhOx.mjs";
-import { Q as DevframeServiceScopeOf, X as DevframeServiceMeta, _t as DevframeRpcServerFunctions, b as StreamSink, d as RpcSharedStateHost, dt as ScopedRpcFn, ft as ScopedServerFunctions, gt as DevframeRpcClientFunctions, k as SharedState, mt as SettingsForNamespace, nt as DevframeServicesState, ot as DevframeSettings, pt as ScopedSharedStates, t as ConnectionMeta, u as RpcSharedStateGetOptions, y as StreamReader, zt as EventEmitter } from "../context-BhBzOXVa.mjs";
+import { Q as DevframeServiceScopeOf, X as DevframeServiceMeta, _t as DevframeRpcServerFunctions, b as StreamSink, d as RpcSharedStateHost, dt as ScopedRpcFn, ft as ScopedServerFunctions, gt as DevframeRpcClientFunctions, k as SharedState, mt as SettingsForNamespace, nt as DevframeServicesState, ot as DevframeSettings, pt as ScopedSharedStates, t as ConnectionMeta, u as RpcSharedStateGetOptions, y as StreamReader, zt as EventEmitter } from "../context-CLF4-8Pp.mjs";
 import { t as SseRpcChannelOptions } from "../sse-client-DwX021ST.mjs";
 import { t as WsRpcChannelOptions } from "../ws-client-7_lZi-B9.mjs";
 import { BirpcOptions, BirpcReturn } from "birpc";

package/dist/client/index.mjs

@@ -2,7 +2,7 @@ import { t as DEVFRAME_EVENTS } from "../events-4daw0uK9.mjs";
 import { t as hash } from "../hash-DdPnc4k3.mjs";
 import { colors } from "../utils/colors.mjs";
 import { createEventEmitter } from "../utils/events.mjs";
-import { t as createSharedState } from "../shared-state-DoXutg_U.mjs";
+import { t as createSharedState } from "../shared-state--sduc6Xi.mjs";
 import { i as structuredCloneStringify, n as structuredCloneParse, t as structuredCloneDeserialize } from "../structured-clone-CgtQ61SA.mjs";
 import { createStreamReader, createStreamSink } from "../utils/streaming-channel.mjs";
 import { defineDiagnostics } from "nostics";

package/dist/client-assets-C7SXgTWY.mjs

@@ -0,0 +1,16 @@
+//#region src/client-assets.ts
+/**
+* Resolve a definition's client assets source — the built SPA served as its
+* UI. Prefers the top-level {@link DevframeDefinition.clientAssets} and falls
+* back to the deprecated `cli.distDir`, so both the new and legacy shapes
+* resolve. Returns `undefined` when neither is set (bridge mode — the SPA is
+* hosted elsewhere).
+*
+* Internal: exposed to first-party integrations via `devframe/internal`, not
+* part of the stable public API.
+*/
+function resolveClientAssets(d) {
+	return d.clientAssets ?? d.cli?.distDir;
+}
+//#endregion
+export { resolveClientAssets as t };

package/dist/{context-BhBzOXVa.d.mts → context-CLF4-8Pp.d.mts}

@@ -1,6 +1,6 @@
 import { d as RpcFunctionsCollectorBase } from "./index-BzyopqxV.mjs";
 import { _ as RpcFunctionDefinition, v as RpcFunctionDefinitionAny } from "./types-CMdPYhOx.mjs";
-import { d as DevframeRpcConnection, u as DevframeNodeRpcSessionMeta } from "./ws-server-Di2oqr4q.mjs";
+import { d as DevframeRpcConnection, u as DevframeNodeRpcSessionMeta } from "./ws-server-VyHlanzy.mjs";
 import { a as RemoteAssetsStore, o as StaticAssetsSource } from "./remote-assets-B13_vRkJ.mjs";
 import { m as defineDiagnostics } from "./nostics-SPGDgHEP.mjs";
 import { BirpcReturn } from "birpc";
@@ -1333,6 +1333,21 @@ interface DevframeDockDefaults {
   badge?: string;
   /** Id of the dock group this entry collapses under, if any. */
   groupId?: string;
+  /**
+   * A client script the hub imports into the host page (this devframe's **page
+   * script**). An absolute-path `importFrom` is served by the hub under the
+   * mount base and rewritten to that URL, so mounting by package name needs no
+   * host wiring; a URL or bare specifier passes through untouched.
+   */
+  clientScript?: {
+    /** An absolute filesystem path, a served URL, or a bare npm specifier. */
+    importFrom: string;
+    /**
+     * The name to import the module as.
+     * @default 'default'
+     */
+    importName?: string;
+  };
 }
 /**
  * Runtime information threaded into `setup(ctx, info)`. Adapters

package/dist/{context-HOnG-WvG.d.mts → context-DftYyXaR.d.mts}

@@ -1,4 +1,4 @@
-import { k as SharedState, o as DevframeNodeContext } from "./context-BhBzOXVa.mjs";
+import { k as SharedState, o as DevframeNodeContext } from "./context-CLF4-8Pp.mjs";
 //#region src/node/hub-internals/context.d.ts
 interface InternalAnonymousAuthStorage {
   trusted: Record<string, {

package/dist/{dev-Czit5IP4.mjs → dev-CzkPCJwi.mjs}

@@ -1,4 +1,4 @@
-import { resolveClientAssets } from "./index.mjs";
+import { t as resolveClientAssets } from "./client-assets-C7SXgTWY.mjs";
 import { DEVFRAME_CONNECTION_META_FILENAME } from "./constants.mjs";
 import { t as diagnostics } from "./diagnostics-BXWW3VK-.mjs";
 import { t as createHostContext } from "./context-omlma_1n.mjs";

package/dist/in-page-channel/index.d.mts

@@ -1,5 +1,5 @@
 import { D as InferArgsType, E as Thenable, O as InferReturnType, T as RpcReturnSchema, i as RpcArgsSchema } from "../types-CMdPYhOx.mjs";
-import { k as SharedState, zt as EventEmitter } from "../context-BhBzOXVa.mjs";
+import { k as SharedState, zt as EventEmitter } from "../context-CLF4-8Pp.mjs";
 import { BirpcReturn } from "birpc";
 //#region src/in-page-channel/types.d.ts
 /**
@@ -26,6 +26,12 @@ type PanelFunctions<P extends InPageChannelProtocol> = SideFunctions<NonNullable
 type SharedStates<P extends InPageChannelProtocol> = P['sharedStates'] extends Record<string, object> ? P['sharedStates'] : Record<string, never>;
 type FnArgs<F> = F extends ((...args: infer A) => any) ? A : never;
 type FnReturn<F> = F extends ((...args: any[]) => infer R) ? Awaited<R> : never;
+/**
+ * Converts a protocol function to its accepted endpoint handler.
+ *
+ * @internal
+ */
+type ProtocolHandler<F> = F extends ((...args: any[]) => any) ? (...args: FnArgs<F>) => Thenable<FnReturn<F>> : never;
 /**
  * Types of an in-page channel function — `RpcFunctionType` minus the
  * server-only `static`: `event` is fire-and-forget (the only type valid for
@@ -58,22 +64,49 @@ type InPageFunctionDefinition<NAME extends string, TYPE extends InPageFunctionTy
   jsonSerializable?: boolean;
   handler: (...args: InferArgsType<AS>) => Thenable<InferReturnType<RS>>;
 };
-/** Loosely-typed definition — the registration unit both endpoints accept. */
-type InPageFunctionDefinitionAny = InPageFunctionDefinition<string, any, any, any, any, any>;
+/**
+ * Function metadata with its handler constrained by a protocol function.
+ *
+ * @internal
+ */
+interface InPageFunctionOption<F> {
+  type?: InPageFunctionType;
+  /** Optional Standard Schema array validating the arguments. */
+  args?: RpcArgsSchema;
+  /** Optional Standard Schema validating the resolved return value. */
+  returns?: RpcReturnSchema;
+  jsonSerializable?: boolean;
+  handler: ProtocolHandler<F>;
+}
+/**
+ * Functions implemented by {@link createPageScriptChannel}.
+ *
+ * @internal
+ */
+type CreatePageScriptChannelOptionsFunctions<P extends InPageChannelProtocol> = { [NAME in keyof PageScriptFunctions<P> & string]: InPageFunctionOption<PageScriptFunctions<P>[NAME]>; };
+/**
+ * Functions implemented by {@link connectPanelChannel}.
+ *
+ * @internal
+ */
+type ConnectPanelChannelOptionsFunctions<P extends InPageChannelProtocol> = { [NAME in keyof PanelFunctions<P> & string]: InPageFunctionOption<PanelFunctions<P>[NAME]>; };
 /**
  * Connection lifecycle of a panel endpoint: `connecting` (handshake retry
  * loop running, outgoing traffic buffered) → `connected` → back to
  * `connecting` on port loss, or `closed` after `close()` (permanent).
  */
 type InPageChannelStatus = 'connecting' | 'connected' | 'closed';
+/**
+ * Options shared by both in-page channel endpoints.
+ *
+ * @internal
+ */
 interface InPageChannelCommonOptions {
   /**
    * Channel name, namespaced with the devframe id by convention
    * (e.g. `devframes:plugin:a11y`). Both endpoints must use the same name.
    */
   name: string;
-  /** Implementations of this endpoint's side of the protocol. */
-  functions?: readonly InPageFunctionDefinitionAny[];
   /**
    * Origins accepted during the handshake (and used as `targetOrigin` when
    * posting handshake messages). The in-page channel is same-origin by
@@ -106,7 +139,9 @@ interface InPageChannelCommonOptions {
   deserialize?: (value: unknown) => unknown;
 }
 /** Options for {@link createPageScriptChannel}. */
-interface CreatePageScriptChannelOptions extends InPageChannelCommonOptions {
+interface CreatePageScriptChannelOptions<Protocol extends InPageChannelProtocol = InPageChannelProtocol> extends InPageChannelCommonOptions {
+  /** Implementations of the protocol's page-script functions. */
+  functions: CreatePageScriptChannelOptionsFunctions<Protocol>;
   /**
    * Window whose `message` events carry panel hellos. Defaults to the
    * global `window`; pass `false` to skip the handshake listener entirely
@@ -115,7 +150,9 @@ interface CreatePageScriptChannelOptions extends InPageChannelCommonOptions {
   window?: Window | false;
 }
 /** Options for {@link connectPanelChannel}. */
-interface ConnectPanelChannelOptions extends InPageChannelCommonOptions {
+interface ConnectPanelChannelOptions<Protocol extends InPageChannelProtocol = InPageChannelProtocol> extends InPageChannelCommonOptions {
+  /** Implementations of the protocol's panel functions. */
+  functions: ConnectPanelChannelOptionsFunctions<Protocol>;
   /**
    * The panel's own window (listens for the handshake grant). Defaults to
    * the global `window`; pass `false` with `transport` to skip the handshake.
@@ -275,7 +312,7 @@ declare class InPageChannelError extends Error {
  * panels all handshake the same way, and a panel reload is simply a new
  * handshake. No server is involved at any point.
  */
-declare function createPageScriptChannel<P extends InPageChannelProtocol>(options: CreatePageScriptChannelOptions): PageScriptChannel<P>;
+declare function createPageScriptChannel<P extends InPageChannelProtocol>(options: CreatePageScriptChannelOptions<P>): PageScriptChannel<P>;
 //#endregion
 //#region src/in-page-channel/panel.d.ts
 /**
@@ -290,7 +327,7 @@ declare function createPageScriptChannel<P extends InPageChannelProtocol>(option
  * (e.g. the panel opened standalone), the endpoint stays `connecting` and
  * the UI can key a fallback state off `status` / `whenConnected()`.
  */
-declare function connectPanelChannel<P extends InPageChannelProtocol>(options: ConnectPanelChannelOptions): PanelChannel<P>;
+declare function connectPanelChannel<P extends InPageChannelProtocol>(options: ConnectPanelChannelOptions<P>): PanelChannel<P>;
 //#endregion
 //#region src/in-page-channel/index.d.ts
 /**

package/dist/in-page-channel/index.mjs

@@ -1,6 +1,6 @@
 import { t as DEVFRAME_EVENTS } from "../events-4daw0uK9.mjs";
 import { createEventEmitter } from "../utils/events.mjs";
-import { t as createSharedState } from "../shared-state-DoXutg_U.mjs";
+import { t as createSharedState } from "../shared-state--sduc6Xi.mjs";
 import { nanoid } from "../utils/nanoid.mjs";
 import { createBirpc } from "birpc";
 //#region src/in-page-channel/protocol.ts
@@ -440,7 +440,10 @@ function createPageScriptChannel(options) {
 	let closed = false;
 	let heartbeatTimer;
 	const registry = createLocalFunctionRegistry(codec);
-	for (const definition of options.functions ?? []) registry.register(definition);
+	for (const [fnName, definition] of Object.entries(options.functions ?? {})) registry.register({
+		...definition,
+		name: fnName
+	});
 	const stateHost = createPageScriptStateHost(function* () {
 		for (const peer of peers.values()) yield {
 			subscribedStates: peer.subscribedStates,
@@ -603,7 +606,10 @@ function connectPanelChannel(options) {
 	const canHandshake = !!win && targets.length > 0;
 	const events = createEventEmitter();
 	const registry = createLocalFunctionRegistry(codec);
-	for (const definition of options.functions ?? []) registry.register(definition);
+	for (const [fnName, definition] of Object.entries(options.functions ?? {})) registry.register({
+		...definition,
+		name: fnName
+	});
 	let status = "connecting";
 	let attached;
 	let pageScriptInfo;

package/dist/{index-DcKxIMoI.d.mts → index-D3k0BIhe.d.mts}

@@ -1,5 +1,5 @@
-import { k as SharedState, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "./context-BhBzOXVa.mjs";
-import { n as InternalAnonymousAuthStorage } from "./context-HOnG-WvG.mjs";
+import { k as SharedState, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "./context-CLF4-8Pp.mjs";
+import { n as InternalAnonymousAuthStorage } from "./context-DftYyXaR.mjs";
 //#region src/node/auth/revoke.d.ts
 /**
  * Flip `isTrusted` to false on any live WS clients connected with `token`

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import "./index-BzyopqxV.mjs";
 import { C as RpcFunctionType, T as RpcReturnSchema, _ as RpcFunctionDefinition, g as RpcFunctionAgentOptions, i as RpcArgsSchema } from "./types-CMdPYhOx.mjs";
-import { d as DevframeRpcConnection, f as DevframeRpcConnectionRequest, p as DevframeRpcTransportKind, u as DevframeNodeRpcSessionMeta } from "./ws-server-Di2oqr4q.mjs";
-import { $ as DevframeServicesHost, At as AgentResource, B as DevframeSetupInfo, Bt as EventUnsubscribe, F as DevframeDefinition, Ft as AgentToolProvider, G as McpRouteOptions, H as DevframeSnapshotRpcInputs, I as DevframeDeploymentKind, It as AgentToolProviderHandle, J as DevframeServiceId, K as DevframeServiceDefinition, L as DevframeDockDefaults, Lt as DevframeAgentHost, Mt as AgentResourceInput, Nt as AgentTool, Ot as AgentHandle, P as DevframeCliOptions, Pt as AgentToolInput, Q as DevframeServiceScopeOf, R as DevframeDuplicationStrategy, Rt as DevframeAgentHostEvents, St as DevframeDiagnosticsLogger, U as DevframeSseOptions, V as DevframeSnapshotRpcEntry, Vt as EventsMap, W as DevframeWsOptions, X as DevframeServiceMeta, Y as DevframeServiceInput, Z as DevframeServiceOf, _t as DevframeRpcServerFunctions, a as DevframeConnectionConfigsRegistry, at as DevframeScopedStreamingHost, bt as DevframeStorageScope, c as RpcBroadcastOptions, ct as DevframeSettingsStore, d as RpcSharedStateHost, dt as ScopedRpcFn, et as DevframeServicesRegistry, f as RpcStreamingChannel, ft as ScopedServerFunctions, gt as DevframeRpcClientFunctions, ht as DevframeViewHost, i as DevframeCapabilities, it as DevframeScopedNodeRpc, jt as AgentResourceContent, kt as AgentManifest, l as RpcFunctionsHost, lt as ScopedBroadcastOptions, m as RpcStreamingHost, mt as SettingsForNamespace, n as ConnectionMetaSse, nt as DevframeServicesState, o as DevframeNodeContext, ot as DevframeSettings, p as RpcStreamingChannelOptions, pt as ScopedSharedStates, q as DevframeServiceDescriptor, r as ConnectionMetaWebsocket, rt as DevframeScopedNodeContext, s as DevframeNodeRpcSession, st as DevframeSettingsRegistry, t as ConnectionMeta, tt as DevframeServicesScopeRegistry, u as RpcSharedStateGetOptions, ut as ScopedClientFunctions, vt as DevframeRpcSharedStates, xt as DevframeDiagnosticsHost, yt as DevframeHost, z as DevframeRpcOptions, zt as EventEmitter } from "./context-BhBzOXVa.mjs";
+import { d as DevframeRpcConnection, f as DevframeRpcConnectionRequest, p as DevframeRpcTransportKind, u as DevframeNodeRpcSessionMeta } from "./ws-server-VyHlanzy.mjs";
+import { $ as DevframeServicesHost, At as AgentResource, B as DevframeSetupInfo, Bt as EventUnsubscribe, F as DevframeDefinition, Ft as AgentToolProvider, G as McpRouteOptions, H as DevframeSnapshotRpcInputs, I as DevframeDeploymentKind, It as AgentToolProviderHandle, J as DevframeServiceId, K as DevframeServiceDefinition, L as DevframeDockDefaults, Lt as DevframeAgentHost, Mt as AgentResourceInput, Nt as AgentTool, Ot as AgentHandle, P as DevframeCliOptions, Pt as AgentToolInput, Q as DevframeServiceScopeOf, R as DevframeDuplicationStrategy, Rt as DevframeAgentHostEvents, St as DevframeDiagnosticsLogger, U as DevframeSseOptions, V as DevframeSnapshotRpcEntry, Vt as EventsMap, W as DevframeWsOptions, X as DevframeServiceMeta, Y as DevframeServiceInput, Z as DevframeServiceOf, _t as DevframeRpcServerFunctions, a as DevframeConnectionConfigsRegistry, at as DevframeScopedStreamingHost, bt as DevframeStorageScope, c as RpcBroadcastOptions, ct as DevframeSettingsStore, d as RpcSharedStateHost, dt as ScopedRpcFn, et as DevframeServicesRegistry, f as RpcStreamingChannel, ft as ScopedServerFunctions, gt as DevframeRpcClientFunctions, ht as DevframeViewHost, i as DevframeCapabilities, it as DevframeScopedNodeRpc, jt as AgentResourceContent, kt as AgentManifest, l as RpcFunctionsHost, lt as ScopedBroadcastOptions, m as RpcStreamingHost, mt as SettingsForNamespace, n as ConnectionMetaSse, nt as DevframeServicesState, o as DevframeNodeContext, ot as DevframeSettings, p as RpcStreamingChannelOptions, pt as ScopedSharedStates, q as DevframeServiceDescriptor, r as ConnectionMetaWebsocket, rt as DevframeScopedNodeContext, s as DevframeNodeRpcSession, st as DevframeSettingsRegistry, t as ConnectionMeta, tt as DevframeServicesScopeRegistry, u as RpcSharedStateGetOptions, ut as ScopedClientFunctions, vt as DevframeRpcSharedStates, xt as DevframeDiagnosticsHost, yt as DevframeHost, z as DevframeRpcOptions, zt as EventEmitter } from "./context-CLF4-8Pp.mjs";
 import { a as RemoteAssetsStore, i as RemoteAssetsProviderCustom, n as RemoteAssetsErrorMessage, o as StaticAssetsSource, r as RemoteAssetsProvider, t as RemoteAssets } from "./remote-assets-B13_vRkJ.mjs";
 import { i as DevframeDefineDiagnosticsOptions } from "./nostics-SPGDgHEP.mjs";
 //#region src/define.d.ts
@@ -12,11 +12,9 @@ declare const defineRpcFunction: <NAME extends string, TYPE extends RpcFunctionT
  */
 declare function defineDevframe(d: DevframeDefinition): DevframeDefinition;
 /**
- * Resolve a definition's client assets source — the built SPA served as its
- * UI. Prefers the top-level {@link DevframeDefinition.clientAssets} and falls
- * back to the deprecated {@link DevframeCliOptions.distDir}, so both the new
- * and legacy shapes resolve. Returns `undefined` when neither is set (bridge
- * mode — the SPA is hosted elsewhere).
+ * @deprecated Read {@link DevframeDefinition.clientAssets} from the definition
+ * directly. This helper is internal machinery that was never meant to be part
+ * of the public API and is scheduled for removal.
  */
 declare function resolveClientAssets(d: DevframeDefinition): StaticAssetsSource | undefined;
 //#endregion

package/dist/index.mjs

@@ -1,4 +1,5 @@
 import { t as createDefineWrapperWithContext } from "./define-BLWPsH6y.mjs";
+import { t as resolveClientAssets$1 } from "./client-assets-C7SXgTWY.mjs";
 //#region src/define.ts
 const defineRpcFunction = createDefineWrapperWithContext();
 /**
@@ -9,14 +10,12 @@ function defineDevframe(d) {
 	return d;
 }
 /**
-* Resolve a definition's client assets source — the built SPA served as its
-* UI. Prefers the top-level {@link DevframeDefinition.clientAssets} and falls
-* back to the deprecated {@link DevframeCliOptions.distDir}, so both the new
-* and legacy shapes resolve. Returns `undefined` when neither is set (bridge
-* mode — the SPA is hosted elsewhere).
+* @deprecated Read {@link DevframeDefinition.clientAssets} from the definition
+* directly. This helper is internal machinery that was never meant to be part
+* of the public API and is scheduled for removal.
 */
 function resolveClientAssets(d) {
-	return d.clientAssets ?? d.cli?.distDir;
+	return resolveClientAssets$1(d);
 }
 //#endregion
 export { defineDevframe, defineRpcFunction, resolveClientAssets };

package/dist/{instance-shell-Bh4l9Vz_.d.mts → instance-shell-Tcp5hGoq.d.mts}

@@ -1,6 +1,6 @@
-import { d as DevframeRpcConnection, n as WsOriginRegistry, u as DevframeNodeRpcSessionMeta } from "./ws-server-Di2oqr4q.mjs";
-import { Ct as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, _t as DevframeRpcServerFunctions, gt as DevframeRpcClientFunctions, o as DevframeNodeContext, s as DevframeNodeRpcSession, t as ConnectionMeta } from "./context-BhBzOXVa.mjs";
-import "./index-DcKxIMoI.mjs";
+import { d as DevframeRpcConnection, n as WsOriginRegistry, u as DevframeNodeRpcSessionMeta } from "./ws-server-VyHlanzy.mjs";
+import { Ct as DevframeAuthHandler, U as DevframeSseOptions, W as DevframeWsOptions, _t as DevframeRpcServerFunctions, gt as DevframeRpcClientFunctions, o as DevframeNodeContext, s as DevframeNodeRpcSession, t as ConnectionMeta } from "./context-CLF4-8Pp.mjs";
+import "./index-D3k0BIhe.mjs";
 import { BirpcGroup } from "birpc";
 import { NodeAdapter } from "crossws/adapters/node";
 import { Buffer } from "node:buffer";

package/dist/internal/index.d.mts

@@ -1,9 +1,22 @@
 import { v as RpcFunctionDefinitionAny } from "../types-CMdPYhOx.mjs";
-import { At as AgentResource, Ft as AgentToolProvider, It as AgentToolProviderHandle, Lt as DevframeAgentHost$1, Mt as AgentResourceInput, Nt as AgentTool, Ot as AgentHandle, Pt as AgentToolInput, Rt as DevframeAgentHostEvents, jt as AgentResourceContent, kt as AgentManifest, o as DevframeNodeContext, yt as DevframeHost, zt as EventEmitter } from "../context-BhBzOXVa.mjs";
-import { a as RemoteAssetsStore } from "../remote-assets-B13_vRkJ.mjs";
-import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, h as registerDevframeInstance, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-Bh4l9Vz_.mjs";
-import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-BJ6AmwTu.mjs";
-import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-BHUsDl7s.mjs";
+import { At as AgentResource, F as DevframeDefinition, Ft as AgentToolProvider, It as AgentToolProviderHandle, Lt as DevframeAgentHost$1, Mt as AgentResourceInput, Nt as AgentTool, Ot as AgentHandle, Pt as AgentToolInput, Rt as DevframeAgentHostEvents, jt as AgentResourceContent, kt as AgentManifest, o as DevframeNodeContext, yt as DevframeHost, zt as EventEmitter } from "../context-CLF4-8Pp.mjs";
+import { a as RemoteAssetsStore, o as StaticAssetsSource } from "../remote-assets-B13_vRkJ.mjs";
+import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, h as registerDevframeInstance, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-Tcp5hGoq.mjs";
+import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-mtXpcJIv.mjs";
+import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-B3W3z9ff.mjs";
+//#region src/client-assets.d.ts
+/**
+ * Resolve a definition's client assets source — the built SPA served as its
+ * UI. Prefers the top-level {@link DevframeDefinition.clientAssets} and falls
+ * back to the deprecated `cli.distDir`, so both the new and legacy shapes
+ * resolve. Returns `undefined` when neither is set (bridge mode — the SPA is
+ * hosted elsewhere).
+ *
+ * Internal: exposed to first-party integrations via `devframe/internal`, not
+ * part of the stable public API.
+ */
+declare function resolveClientAssets(d: DevframeDefinition): StaticAssetsSource | undefined;
+//#endregion
 //#region src/node/agent-args.d.ts
 /**
  * How {@link coerceAgentPositionalArgs} treats an args object that carries
@@ -446,4 +459,4 @@ declare function peekRpcWireFrame(raw: string): {
   i?: string;
 };
 //#endregion
-export { type AgentArgsFallback, type ContextRpcServer, type CreateContextRpcServerOptions, CreateH3DevframeHostOptions, type CreateInstanceShellOptions, DevframeAgentHost, type DevframeInstanceRecord, type DevframeInstanceRegistration, type InstanceRegisterConfig, type InstanceShell, type InstanceShellApi, type InstanceShellInit, type InstanceShellInternals, type InstanceWsTier, type RpcWireCodec, type StartedServer, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveInstanceRegister, samePath };
+export { type AgentArgsFallback, type ContextRpcServer, type CreateContextRpcServerOptions, CreateH3DevframeHostOptions, type CreateInstanceShellOptions, DevframeAgentHost, type DevframeInstanceRecord, type DevframeInstanceRegistration, type InstanceRegisterConfig, type InstanceShell, type InstanceShellApi, type InstanceShellInit, type InstanceShellInternals, type InstanceWsTier, type RpcWireCodec, type StartedServer, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveClientAssets, resolveInstanceRegister, samePath };

package/dist/internal/index.mjs

@@ -1,3 +1,4 @@
+import { t as resolveClientAssets } from "../client-assets-C7SXgTWY.mjs";
 import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../wire-codec-0K-o5MYW.mjs";
 import { t as diagnostics } from "../diagnostics-BXWW3VK-.mjs";
 import { a as DevframeAgentHost, o as coerceAgentPositionalArgs } from "../services-install-CqqQVls5.mjs";
@@ -6,4 +7,4 @@ import { t as createH3DevframeHost } from "../host-h3-fRbF9yor.mjs";
 import { a as importRuntimeModule, i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-CpVW4zG0.mjs";
 import { i as registerDevframeInstance, n as listLiveDevframeInstances } from "../instance-registry-BjlMQbFB.mjs";
 import { t as createContextRpcServer } from "../rpc-core-DlHd276T.mjs";
-export { DevframeAgentHost, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveInstanceRegister, samePath };
+export { DevframeAgentHost, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveClientAssets, resolveInstanceRegister, samePath };

package/dist/node/auth.d.mts

@@ -1,3 +1,3 @@
-import { Ct as DevframeAuthHandler } from "../context-BhBzOXVa.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-DcKxIMoI.mjs";
+import { Ct as DevframeAuthHandler } from "../context-CLF4-8Pp.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-D3k0BIhe.mjs";
 export { DevframeAuthHandler, buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,3 +1,3 @@
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-HOnG-WvG.mjs";
-import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-BJ6AmwTu.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-DftYyXaR.mjs";
+import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-mtXpcJIv.mjs";
 export { type DevframeInternalContext, type InternalAnonymousAuthStorage, type RemoteTokenRecord, getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/index.d.mts

@@ -1,6 +1,6 @@
 import "../index-BzyopqxV.mjs";
 import { v as RpcFunctionDefinitionAny } from "../types-CMdPYhOx.mjs";
-import { k as SharedState, l as RpcFunctionsHost, o as DevframeNodeContext, yt as DevframeHost } from "../context-BhBzOXVa.mjs";
+import { k as SharedState, l as RpcFunctionsHost, o as DevframeNodeContext, yt as DevframeHost } from "../context-CLF4-8Pp.mjs";
 import { BirpcGroup } from "birpc";
 //#region src/node/context.d.ts
 interface CreateHostContextOptions {

package/dist/recipes/common-rpc-functions.d.mts

@@ -1,6 +1,6 @@
 import "../index-BzyopqxV.mjs";
 import { E as Thenable, S as RpcFunctionSetupResult, c as RpcDump, g as RpcFunctionAgentOptions } from "../types-CMdPYhOx.mjs";
-import "../context-BhBzOXVa.mjs";
+import "../context-CLF4-8Pp.mjs";
 import { SimpleSchema } from "../utils/simple-schema.mjs";
 //#region src/recipes/common-rpc-functions.d.ts
 /**

package/dist/recipes/interactive-auth.d.mts

@@ -1,5 +1,5 @@
-import { Ct as DevframeAuthHandler, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "../context-BhBzOXVa.mjs";
-import "../index-DcKxIMoI.mjs";
+import { Ct as DevframeAuthHandler, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "../context-CLF4-8Pp.mjs";
+import "../index-D3k0BIhe.mjs";
 //#region src/recipes/interactive-auth.d.ts
 interface CreateInteractiveAuthOptions {
   /**

package/dist/rpc/transports/sse-server.d.mts

@@ -1,5 +1,5 @@
 import { v as RpcFunctionDefinitionAny } from "../../types-CMdPYhOx.mjs";
-import { d as DevframeRpcConnection, n as WsOriginRegistry, u as DevframeNodeRpcSessionMeta } from "../../ws-server-Di2oqr4q.mjs";
+import { d as DevframeRpcConnection, n as WsOriginRegistry, u as DevframeNodeRpcSessionMeta } from "../../ws-server-VyHlanzy.mjs";
 import { BirpcGroup } from "birpc";
 //#region src/rpc/transports/sse-server.d.ts
 interface SseRpcTransportOptions {

package/dist/rpc/transports/sse-server.mjs

@@ -1,6 +1,6 @@
 import { DEVFRAME_SSE_SESSION_HEADER } from "../../constants.mjs";
 import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../../wire-codec-0K-o5MYW.mjs";
-import { i as isAllowedOrigin, o as createRpcSessionMeta } from "../../ws-server-BdSLrhxE.mjs";
+import { i as isAllowedOrigin, o as createRpcSessionMeta } from "../../ws-server-Y_AumUQH.mjs";
 //#region src/rpc/transports/sse-server.ts
 const SSE_STREAM_HEADERS = {
 	"content-type": "text/event-stream",

package/dist/rpc/transports/ws-bun.d.mts

@@ -1,5 +1,5 @@
-import { n as WsOriginRegistry } from "../../ws-server-Di2oqr4q.mjs";
-import { t as ContextRpcServer } from "../../rpc-core-BHUsDl7s.mjs";
+import { n as WsOriginRegistry } from "../../ws-server-VyHlanzy.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-B3W3z9ff.mjs";
 //#region src/rpc/transports/ws-bun.d.ts
 interface AttachBunWsTransportOptions {
   /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */

package/dist/rpc/transports/ws-bun.mjs

@@ -1,4 +1,4 @@
-import { i as isAllowedOrigin, r as createWsRpcPeerHooks } from "../../ws-server-BdSLrhxE.mjs";
+import { i as isAllowedOrigin, r as createWsRpcPeerHooks } from "../../ws-server-Y_AumUQH.mjs";
 //#region src/rpc/transports/ws-bun.ts
 /**
 * The Bun fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the

package/dist/rpc/transports/ws-deno.d.mts

@@ -1,5 +1,5 @@
-import { n as WsOriginRegistry } from "../../ws-server-Di2oqr4q.mjs";
-import { t as ContextRpcServer } from "../../rpc-core-BHUsDl7s.mjs";
+import { n as WsOriginRegistry } from "../../ws-server-VyHlanzy.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-B3W3z9ff.mjs";
 //#region src/rpc/transports/ws-deno.d.ts
 interface AttachDenoWsTransportOptions {
   /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */

package/dist/rpc/transports/ws-deno.mjs

@@ -1,4 +1,4 @@
-import { i as isAllowedOrigin, r as createWsRpcPeerHooks } from "../../ws-server-BdSLrhxE.mjs";
+import { i as isAllowedOrigin, r as createWsRpcPeerHooks } from "../../ws-server-Y_AumUQH.mjs";
 //#region src/rpc/transports/ws-deno.ts
 /**
 * The Deno fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the

package/dist/rpc/transports/ws-server.d.mts

@@ -1,2 +1,2 @@
-import { a as attachWsRpcTransport, c as isAllowedOrigin, d as DevframeRpcConnection, f as DevframeRpcConnectionRequest, i as WsRpcTransportOptions, l as isLoopbackHostname, n as WsOriginRegistry, o as createWsOriginRegistry, p as DevframeRpcTransportKind, r as WsRpcTransport, s as createWsRpcPeerHooks, t as CreateWsOriginRegistryOptions, u as DevframeNodeRpcSessionMeta } from "../../ws-server-Di2oqr4q.mjs";
+import { a as attachWsRpcTransport, c as isAllowedOrigin, d as DevframeRpcConnection, f as DevframeRpcConnectionRequest, i as WsRpcTransportOptions, l as isLoopbackHostname, n as WsOriginRegistry, o as createWsOriginRegistry, p as DevframeRpcTransportKind, r as WsRpcTransport, s as createWsRpcPeerHooks, t as CreateWsOriginRegistryOptions, u as DevframeNodeRpcSessionMeta } from "../../ws-server-VyHlanzy.mjs";
 export { CreateWsOriginRegistryOptions, type DevframeNodeRpcSessionMeta, type DevframeRpcConnection, type DevframeRpcConnectionRequest, type DevframeRpcTransportKind, WsOriginRegistry, WsRpcTransport, WsRpcTransportOptions, attachWsRpcTransport, createWsOriginRegistry, createWsRpcPeerHooks, isAllowedOrigin, isLoopbackHostname };

package/dist/rpc/transports/ws-server.mjs

@@ -1,2 +1,2 @@
-import { a as isLoopbackHostname, i as isAllowedOrigin, n as createWsOriginRegistry, r as createWsRpcPeerHooks, t as attachWsRpcTransport } from "../../ws-server-BdSLrhxE.mjs";
+import { a as isLoopbackHostname, i as isAllowedOrigin, n as createWsOriginRegistry, r as createWsRpcPeerHooks, t as attachWsRpcTransport } from "../../ws-server-Y_AumUQH.mjs";
 export { attachWsRpcTransport, createWsOriginRegistry, createWsRpcPeerHooks, isAllowedOrigin, isLoopbackHostname };

package/dist/{rpc-core-BHUsDl7s.d.mts → rpc-core-B3W3z9ff.d.mts}

@@ -1,6 +1,6 @@
-import { d as DevframeRpcConnection, u as DevframeNodeRpcSessionMeta } from "./ws-server-Di2oqr4q.mjs";
-import { Ct as DevframeAuthHandler, _t as DevframeRpcServerFunctions, gt as DevframeRpcClientFunctions, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "./context-BhBzOXVa.mjs";
-import "./index-DcKxIMoI.mjs";
+import { d as DevframeRpcConnection, u as DevframeNodeRpcSessionMeta } from "./ws-server-VyHlanzy.mjs";
+import { Ct as DevframeAuthHandler, _t as DevframeRpcServerFunctions, gt as DevframeRpcClientFunctions, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "./context-CLF4-8Pp.mjs";
+import "./index-D3k0BIhe.mjs";
 import { BirpcGroup, EventOptions } from "birpc";
 //#region src/node/rpc-core.d.ts
 interface CreateContextRpcServerOptions {

package/dist/{shared-state-DoXutg_U.mjs → shared-state--sduc6Xi.mjs}

@@ -1,6 +1,6 @@
 import { createEventEmitter } from "./utils/events.mjs";
 import { nanoid } from "./utils/nanoid.mjs";
-//#region ../../node_modules/.pnpm/immer@11.1.17/node_modules/immer/dist/immer.mjs
+//#region ../../node_modules/.pnpm/immer@11.1.18/node_modules/immer/dist/immer.mjs
 var NOTHING = Symbol.for("immer-nothing");
 var DRAFTABLE = Symbol.for("immer-draftable");
 var DRAFT_STATE = Symbol.for("immer-state");
@@ -891,6 +891,7 @@ function enablePatches() {
 		getPath
 	});
 }
+globalThis.Iterator?.from;
 var immer = new Immer2();
 var produce = immer.produce;
 var produceWithPatches = /* @__PURE__ */ immer.produceWithPatches.bind(immer);

package/dist/types/index.d.mts

@@ -1,6 +1,6 @@
 import { g as RpcFunctionAgentOptions } from "../types-CMdPYhOx.mjs";
-import { d as DevframeRpcConnection, f as DevframeRpcConnectionRequest, p as DevframeRpcTransportKind, u as DevframeNodeRpcSessionMeta } from "../ws-server-Di2oqr4q.mjs";
-import { $ as DevframeServicesHost, At as AgentResource, B as DevframeSetupInfo, Bt as EventUnsubscribe, F as DevframeDefinition, Ft as AgentToolProvider, G as McpRouteOptions, H as DevframeSnapshotRpcInputs, I as DevframeDeploymentKind, It as AgentToolProviderHandle, J as DevframeServiceId, K as DevframeServiceDefinition, L as DevframeDockDefaults, Lt as DevframeAgentHost, Mt as AgentResourceInput, Nt as AgentTool, Ot as AgentHandle, P as DevframeCliOptions, Pt as AgentToolInput, Q as DevframeServiceScopeOf, R as DevframeDuplicationStrategy, Rt as DevframeAgentHostEvents, St as DevframeDiagnosticsLogger, U as DevframeSseOptions, V as DevframeSnapshotRpcEntry, Vt as EventsMap, W as DevframeWsOptions, X as DevframeServiceMeta, Y as DevframeServiceInput, Z as DevframeServiceOf, _t as DevframeRpcServerFunctions, a as DevframeConnectionConfigsRegistry, at as DevframeScopedStreamingHost, bt as DevframeStorageScope, c as RpcBroadcastOptions, ct as DevframeSettingsStore, d as RpcSharedStateHost, dt as ScopedRpcFn, et as DevframeServicesRegistry, f as RpcStreamingChannel, ft as ScopedServerFunctions, gt as DevframeRpcClientFunctions, ht as DevframeViewHost, i as DevframeCapabilities, it as DevframeScopedNodeRpc, jt as AgentResourceContent, kt as AgentManifest, l as RpcFunctionsHost, lt as ScopedBroadcastOptions, m as RpcStreamingHost, mt as SettingsForNamespace, n as ConnectionMetaSse, nt as DevframeServicesState, o as DevframeNodeContext, ot as DevframeSettings, p as RpcStreamingChannelOptions, pt as ScopedSharedStates, q as DevframeServiceDescriptor, r as ConnectionMetaWebsocket, rt as DevframeScopedNodeContext, s as DevframeNodeRpcSession, st as DevframeSettingsRegistry, t as ConnectionMeta, tt as DevframeServicesScopeRegistry, u as RpcSharedStateGetOptions, ut as ScopedClientFunctions, vt as DevframeRpcSharedStates, xt as DevframeDiagnosticsHost, yt as DevframeHost, z as DevframeRpcOptions, zt as EventEmitter } from "../context-BhBzOXVa.mjs";
+import { d as DevframeRpcConnection, f as DevframeRpcConnectionRequest, p as DevframeRpcTransportKind, u as DevframeNodeRpcSessionMeta } from "../ws-server-VyHlanzy.mjs";
+import { $ as DevframeServicesHost, At as AgentResource, B as DevframeSetupInfo, Bt as EventUnsubscribe, F as DevframeDefinition, Ft as AgentToolProvider, G as McpRouteOptions, H as DevframeSnapshotRpcInputs, I as DevframeDeploymentKind, It as AgentToolProviderHandle, J as DevframeServiceId, K as DevframeServiceDefinition, L as DevframeDockDefaults, Lt as DevframeAgentHost, Mt as AgentResourceInput, Nt as AgentTool, Ot as AgentHandle, P as DevframeCliOptions, Pt as AgentToolInput, Q as DevframeServiceScopeOf, R as DevframeDuplicationStrategy, Rt as DevframeAgentHostEvents, St as DevframeDiagnosticsLogger, U as DevframeSseOptions, V as DevframeSnapshotRpcEntry, Vt as EventsMap, W as DevframeWsOptions, X as DevframeServiceMeta, Y as DevframeServiceInput, Z as DevframeServiceOf, _t as DevframeRpcServerFunctions, a as DevframeConnectionConfigsRegistry, at as DevframeScopedStreamingHost, bt as DevframeStorageScope, c as RpcBroadcastOptions, ct as DevframeSettingsStore, d as RpcSharedStateHost, dt as ScopedRpcFn, et as DevframeServicesRegistry, f as RpcStreamingChannel, ft as ScopedServerFunctions, gt as DevframeRpcClientFunctions, ht as DevframeViewHost, i as DevframeCapabilities, it as DevframeScopedNodeRpc, jt as AgentResourceContent, kt as AgentManifest, l as RpcFunctionsHost, lt as ScopedBroadcastOptions, m as RpcStreamingHost, mt as SettingsForNamespace, n as ConnectionMetaSse, nt as DevframeServicesState, o as DevframeNodeContext, ot as DevframeSettings, p as RpcStreamingChannelOptions, pt as ScopedSharedStates, q as DevframeServiceDescriptor, r as ConnectionMetaWebsocket, rt as DevframeScopedNodeContext, s as DevframeNodeRpcSession, st as DevframeSettingsRegistry, t as ConnectionMeta, tt as DevframeServicesScopeRegistry, u as RpcSharedStateGetOptions, ut as ScopedClientFunctions, vt as DevframeRpcSharedStates, xt as DevframeDiagnosticsHost, yt as DevframeHost, z as DevframeRpcOptions, zt as EventEmitter } from "../context-CLF4-8Pp.mjs";
 import { a as RemoteAssetsStore, i as RemoteAssetsProviderCustom, n as RemoteAssetsErrorMessage, o as StaticAssetsSource, r as RemoteAssetsProvider, t as RemoteAssets } from "../remote-assets-B13_vRkJ.mjs";
 import { i as DevframeDefineDiagnosticsOptions } from "../nostics-SPGDgHEP.mjs";
 export { AgentHandle, AgentManifest, AgentResource, AgentResourceContent, AgentResourceInput, AgentTool, AgentToolInput, AgentToolProvider, AgentToolProviderHandle, ConnectionMeta, ConnectionMetaSse, ConnectionMetaWebsocket, DevframeAgentHost, DevframeAgentHostEvents, DevframeCapabilities, DevframeCliOptions, DevframeConnectionConfigsRegistry, type DevframeDefineDiagnosticsOptions, DevframeDefinition, DevframeDeploymentKind, DevframeDiagnosticsHost, DevframeDiagnosticsLogger, DevframeDockDefaults, DevframeDuplicationStrategy, DevframeHost, DevframeNodeContext, DevframeNodeRpcSession, type DevframeNodeRpcSessionMeta, DevframeRpcClientFunctions, type DevframeRpcConnection, type DevframeRpcConnectionRequest, DevframeRpcOptions, DevframeRpcServerFunctions, DevframeRpcSharedStates, type DevframeRpcTransportKind, DevframeScopedNodeContext, DevframeScopedNodeRpc, DevframeScopedStreamingHost, DevframeServiceDefinition, DevframeServiceDescriptor, DevframeServiceId, DevframeServiceInput, DevframeServiceMeta, DevframeServiceOf, DevframeServiceScopeOf, DevframeServicesHost, DevframeServicesRegistry, DevframeServicesScopeRegistry, DevframeServicesState, DevframeSettings, DevframeSettingsRegistry, DevframeSettingsStore, DevframeSetupInfo, DevframeSnapshotRpcEntry, DevframeSnapshotRpcInputs, DevframeSseOptions, DevframeStorageScope, DevframeViewHost, DevframeWsOptions, EventEmitter, EventUnsubscribe, EventsMap, McpRouteOptions, RemoteAssets, RemoteAssetsErrorMessage, RemoteAssetsProvider, RemoteAssetsProviderCustom, RemoteAssetsStore, RpcBroadcastOptions, type RpcFunctionAgentOptions, RpcFunctionsHost, RpcSharedStateGetOptions, RpcSharedStateHost, RpcStreamingChannel, RpcStreamingChannelOptions, RpcStreamingHost, ScopedBroadcastOptions, ScopedClientFunctions, ScopedRpcFn, ScopedServerFunctions, ScopedSharedStates, SettingsForNamespace, StaticAssetsSource };

package/dist/utils/events.d.mts

@@ -1,4 +1,4 @@
-import { Vt as EventsMap, zt as EventEmitter } from "../context-BhBzOXVa.mjs";
+import { Vt as EventsMap, zt as EventEmitter } from "../context-CLF4-8Pp.mjs";
 //#region src/utils/events.d.ts
 /**
  * Create event emitter.

package/dist/utils/shared-state.d.mts

@@ -1,2 +1,2 @@
-import { A as SharedStateEvents, D as ImmutableObject, E as ImmutableMap, M as SharedStatePatch, N as createSharedState, O as ImmutableSet, T as ImmutableArray, j as SharedStateOptions, k as SharedState, w as Immutable } from "../context-BhBzOXVa.mjs";
+import { A as SharedStateEvents, D as ImmutableObject, E as ImmutableMap, M as SharedStatePatch, N as createSharedState, O as ImmutableSet, T as ImmutableArray, j as SharedStateOptions, k as SharedState, w as Immutable } from "../context-CLF4-8Pp.mjs";
 export { Immutable, ImmutableArray, ImmutableMap, ImmutableObject, ImmutableSet, SharedState, SharedStateEvents, SharedStateOptions, SharedStatePatch, createSharedState };

package/dist/utils/shared-state.mjs

@@ -1,2 +1,2 @@
-import { t as createSharedState } from "../shared-state-DoXutg_U.mjs";
+import { t as createSharedState } from "../shared-state--sduc6Xi.mjs";
 export { createSharedState };

package/dist/utils/streaming-channel.d.mts

@@ -1,2 +1,2 @@
-import { C as createStreamSink, S as createStreamReader, _ as CreateStreamSinkOptions, b as StreamSink, g as CreateStreamReaderOptions, h as BufferedChunk, v as StreamErrorPayload, x as StreamSinkEvents, y as StreamReader } from "../context-BhBzOXVa.mjs";
+import { C as createStreamSink, S as createStreamReader, _ as CreateStreamSinkOptions, b as StreamSink, g as CreateStreamReaderOptions, h as BufferedChunk, v as StreamErrorPayload, x as StreamSinkEvents, y as StreamReader } from "../context-CLF4-8Pp.mjs";
 export { BufferedChunk, CreateStreamReaderOptions, CreateStreamSinkOptions, StreamErrorPayload, StreamReader, StreamSink, StreamSinkEvents, createStreamReader, createStreamSink };

package/dist/{ws-server-Di2oqr4q.d.mts → ws-server-VyHlanzy.d.mts}

@@ -195,6 +195,21 @@ interface WsRpcTransport {
    */
   close: () => Promise<void>;
 }
+/**
+ * Whether `hostname` names a loopback host: `localhost` (or any `*.localhost`
+ * subdomain), the IPv6 loopback `::1`, or an IPv4 literal inside the
+ * `127.0.0.0/8` loopback block.
+ *
+ * The IPv4 case is matched **structurally** — the whole hostname must be a
+ * canonical dotted-decimal IPv4 literal whose first octet is `127`. A bare
+ * `startsWith('127.')` prefix check would also accept an attacker-controlled
+ * DNS name that merely *begins* with `127.` (`127.attacker.example`,
+ * `127.0.0.1.attacker.example`), letting a cross-origin browser page defeat
+ * the loopback origin gate that guards the RPC/MCP surface (a DNS-rebinding /
+ * cross-site WebSocket-hijacking bypass). Requiring a real IPv4 literal keeps
+ * genuine loopback addresses (`127.0.0.1`, `127.5.5.5`) allowed while rejecting
+ * those DNS names.
+ */
 declare function isLoopbackHostname(hostname: string): boolean;
 /**
  * Default origin policy for a localhost dev tool: allow requests with no

package/dist/{ws-server-BdSLrhxE.mjs → ws-server-Y_AumUQH.mjs}

@@ -83,9 +83,36 @@ function pathMatches(a, b) {
 	const strip = (p) => p.length > 1 && p.endsWith("/") ? p.slice(0, -1) : p;
 	return strip(a) === strip(b);
 }
+/**
+* Whether `hostname` names a loopback host: `localhost` (or any `*.localhost`
+* subdomain), the IPv6 loopback `::1`, or an IPv4 literal inside the
+* `127.0.0.0/8` loopback block.
+*
+* The IPv4 case is matched **structurally** — the whole hostname must be a
+* canonical dotted-decimal IPv4 literal whose first octet is `127`. A bare
+* `startsWith('127.')` prefix check would also accept an attacker-controlled
+* DNS name that merely *begins* with `127.` (`127.attacker.example`,
+* `127.0.0.1.attacker.example`), letting a cross-origin browser page defeat
+* the loopback origin gate that guards the RPC/MCP surface (a DNS-rebinding /
+* cross-site WebSocket-hijacking bypass). Requiring a real IPv4 literal keeps
+* genuine loopback addresses (`127.0.0.1`, `127.5.5.5`) allowed while rejecting
+* those DNS names.
+*/
 function isLoopbackHostname(hostname) {
 	const h = hostname.replace(/^\[|\]$/g, "");
-	return h === "localhost" || h === "127.0.0.1" || h === "::1" || h.endsWith(".localhost") || h.startsWith("127.");
+	if (h === "localhost" || h.endsWith(".localhost") || h === "::1") return true;
+	return isLoopbackIPv4(h);
+}
+/** A canonical dotted-decimal IPv4 literal in `127.0.0.0/8`. */
+function isLoopbackIPv4(hostname) {
+	const octets = hostname.split(".");
+	if (octets.length !== 4 || !octets.every(isDecimalOctet)) return false;
+	return Number(octets[0]) === 127;
+}
+/** A single canonical IPv4 octet: 1–3 digits, no leading zero, value 0–255. */
+function isDecimalOctet(part) {
+	if (!/^\d{1,3}$/.test(part) || part.length > 1 && part[0] === "0") return false;
+	return Number(part) <= 255;
 }
 /**
 * Default origin policy for a localhost dev tool: allow requests with no

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devframe",
   "type": "module",
-  "version": "0.9.7",
+  "version": "0.9.8",
   "description": "Framework for building one portable devtool integration that runs in any viewer.",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",
@@ -92,9 +92,9 @@
   },
   "dependencies": {
     "@standard-schema/spec": "^1.1.0",
-    "birpc": "^4.1.0",
-    "crossws": "^0.4.10",
-    "h3": "^2.0.1-rc.26",
+    "birpc": "^4.2.0",
+    "crossws": "^0.4.12",
+    "h3": "^2.0.1-rc.29",
     "mrmime": "^2.0.1",
     "nostics": "^1.2.0",
     "pathe": "^2.0.3",
@@ -105,7 +105,7 @@
     "@modelcontextprotocol/server": "^2.0.0",
     "cac": "^7.0.0",
     "get-port-please": "^3.2.0",
-    "immer": "^11.1.17",
+    "immer": "^11.1.18",
     "launch-editor": "^2.14.1",
     "mlly": "^1.8.2",
     "obug": "^2.1.4",