devframe 0.9.7 → 0.9.9

package/dist/node/index.d.mts

@@ -1,6 +1,6 @@
-import "../index-BzyopqxV.mjs";
-import { v as RpcFunctionDefinitionAny } from "../types-CMdPYhOx.mjs";
-import { k as SharedState, l as RpcFunctionsHost, o as DevframeNodeContext, yt as DevframeHost } from "../context-BhBzOXVa.mjs";
+import "../index-pIVt92jP.mjs";
+import { v as RpcFunctionDefinitionAny } from "../types-Dq4i156u.mjs";
+import { bt as DevframeHost, k as SharedState, l as RpcFunctionsHost, o as DevframeNodeContext } from "../context-4AIVRLYF.mjs";
 import { BirpcGroup } from "birpc";
 //#region src/node/context.d.ts
 interface CreateHostContextOptions {
@@ -13,7 +13,7 @@ interface CreateHostContextOptions {
    * serves (from `DevframeDefinition.importMetaUrl`). Supplies the default
    * `resolveFrom` base for remote {@link DevframeViewHost.hostStatic} sources
    * that don't set one, so a locally installed copy of an assets package is
-   * served with zero network. An internal plumbing detail — it isn't part of
+   * served with zero network. An internal plumbing detail; it isn't part of
    * the public {@link DevframeNodeContext} surface.
    */
   importMetaUrl?: string;
@@ -28,7 +28,7 @@ interface CreateHostContextOptions {
  * Framework- and build-tool-agnostic core of the Devframe node context.
  * Wires the RPC host, view (HTTP file-serving) host, diagnostics, and
  * agent subsystems. Host adapters can wrap this to augment `ctx` with
- * extra surfaces — for example, `@vitejs/devtools-kit`'s
+ * extra surfaces; for example, `@vitejs/devtools-kit`'s
  * `createKitContext` attaches `docks`, `terminals`, `messages`, and
  * `commands` when mounted into Vite DevTools.
  */

package/dist/node/index.mjs

@@ -1,3 +1,3 @@
-import { t as createHostContext } from "../context-omlma_1n.mjs";
-import { t as createStorage } from "../storage-BXNVhKyR.mjs";
+import { t as createHostContext } from "../context-CwPUinjn.mjs";
+import { t as createStorage } from "../storage-Dccf_IyD.mjs";
 export { createHostContext, createStorage };

package/dist/{nostics-SPGDgHEP.d.mts → nostics-0sKe5HIj.d.mts}

@@ -10,7 +10,7 @@ declare function devframeReporter(d: Diagnostic, { method }?: {
   method?: 'log' | 'warn' | 'error';
 }): void;
 /**
- * Options accepted by {@link defineDiagnostics} — identical to `nostics`'s
+ * Options accepted by {@link defineDiagnostics}, identical to `nostics`'s
  * own `DefineDiagnosticsOptions`, minus the reporter devframe already
  * prepends.
  */
@@ -20,7 +20,7 @@ type DevframeDefineDiagnosticsOptions<Codes extends Record<string, DiagnosticDef
  * ANSI console reporter pre-wired ahead of any `reporters` passed in. Every
  * `diagnostics.ts` in devframe core, `@devframes/hub`, `@devframes/json-render`,
  * and the built-in plugins defines its codes through this instead of
- * `nostics`'s own `defineDiagnostics` — the reporter registration lives
+ * `nostics`'s own `defineDiagnostics`; the reporter registration lives
  * here, once, so none of them need to build their own reporter (`colors`,
  * `ansiFormatter`) or take a direct dependency on `nostics` themselves.
  */

package/dist/{nostics-CzECRXpE.mjs → nostics-D0PvLZsn.mjs}

@@ -45,7 +45,7 @@ function devframeReporter(d, { method = "warn" } = {}) {
 * ANSI console reporter pre-wired ahead of any `reporters` passed in. Every
 * `diagnostics.ts` in devframe core, `@devframes/hub`, `@devframes/json-render`,
 * and the built-in plugins defines its codes through this instead of
-* `nostics`'s own `defineDiagnostics` — the reporter registration lives
+* `nostics`'s own `defineDiagnostics`; the reporter registration lives
 * here, once, so none of them need to build their own reporter (`colors`,
 * `ansiFormatter`) or take a direct dependency on `nostics` themselves.
 */

package/dist/origin-DGDH8BI9.d.mts

@@ -0,0 +1,45 @@
+//#region src/utils/origin.d.ts
+/**
+ * Origin and hostname predicates shared by the RPC transports (the WS upgrade,
+ * SSE, and MCP origin gates) and the instance shell's authentication-link
+ * origin validation. Kept dependency-free and runtime-agnostic so any consumer
+ * can pull in a single check without dragging in a transport's `crossws`
+ * import.
+ */
+/**
+ * Whether `hostname` names a loopback host: `localhost` (or any `*.localhost`
+ * subdomain), the IPv6 loopback `::1`, or an IPv4 literal inside the
+ * `127.0.0.0/8` loopback block.
+ *
+ * The IPv4 case is matched **structurally**: the whole hostname must be a
+ * canonical dotted-decimal IPv4 literal whose first octet is `127`. A bare
+ * `startsWith('127.')` prefix check would also accept an attacker-controlled
+ * DNS name that merely *begins* with `127.` (`127.attacker.example`,
+ * `127.0.0.1.attacker.example`), letting a cross-origin browser page defeat
+ * the loopback origin gate that guards the RPC/MCP surface (a DNS-rebinding /
+ * cross-site WebSocket-hijacking bypass). Requiring a real IPv4 literal keeps
+ * genuine loopback addresses (`127.0.0.1`, `127.5.5.5`) allowed while rejecting
+ * those DNS names.
+ */
+declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Default origin policy for a localhost dev tool: allow requests with no
+ * `Origin` header (native, non-browser clients), allow any loopback origin
+ * (so cross-port localhost dev setups keep working), and allow explicitly
+ * configured origins. Everything else, such as a real remote page in the dev's
+ * browser, is rejected.
+ */
+declare function isAllowedOrigin(origin: string | undefined, allowedOrigins: readonly string[]): boolean;
+/**
+ * Decide whether a request-derived origin candidate may back a devframe's
+ * advertised public origin, the destination of the OTP magic link. Stricter
+ * than {@link isAllowedOrigin}: it rejects credentials, a path, a query, a
+ * fragment, a malformed port, and non-HTTP(S) schemes, and adopts a candidate
+ * only when its hostname is loopback or its canonical origin exactly matches
+ * an `allowedOrigins` entry (a caller with no static list passes none, so only
+ * loopback qualifies). Returns the canonical origin to adopt, or `undefined`
+ * to reject. Forwarded headers are never consulted.
+ */
+declare function validateOriginCandidate(candidate: string, allowedOrigins?: readonly string[]): string | undefined;
+//#endregion
+export { isLoopbackHostname as n, validateOriginCandidate as r, isAllowedOrigin as t };

package/dist/origin-DZit9g29.mjs

@@ -0,0 +1,80 @@
+//#region src/utils/origin.ts
+/**
+* Origin and hostname predicates shared by the RPC transports (the WS upgrade,
+* SSE, and MCP origin gates) and the instance shell's authentication-link
+* origin validation. Kept dependency-free and runtime-agnostic so any consumer
+* can pull in a single check without dragging in a transport's `crossws`
+* import.
+*/
+/**
+* Whether `hostname` names a loopback host: `localhost` (or any `*.localhost`
+* subdomain), the IPv6 loopback `::1`, or an IPv4 literal inside the
+* `127.0.0.0/8` loopback block.
+*
+* The IPv4 case is matched **structurally**: the whole hostname must be a
+* canonical dotted-decimal IPv4 literal whose first octet is `127`. A bare
+* `startsWith('127.')` prefix check would also accept an attacker-controlled
+* DNS name that merely *begins* with `127.` (`127.attacker.example`,
+* `127.0.0.1.attacker.example`), letting a cross-origin browser page defeat
+* the loopback origin gate that guards the RPC/MCP surface (a DNS-rebinding /
+* cross-site WebSocket-hijacking bypass). Requiring a real IPv4 literal keeps
+* genuine loopback addresses (`127.0.0.1`, `127.5.5.5`) allowed while rejecting
+* those DNS names.
+*/
+function isLoopbackHostname(hostname) {
+	const h = hostname.replace(/^\[|\]$/g, "");
+	if (h === "localhost" || h.endsWith(".localhost") || h === "::1") return true;
+	return isLoopbackIPv4(h);
+}
+/** A canonical dotted-decimal IPv4 literal in `127.0.0.0/8`. */
+function isLoopbackIPv4(hostname) {
+	const octets = hostname.split(".");
+	if (octets.length !== 4 || !octets.every(isDecimalOctet)) return false;
+	return Number(octets[0]) === 127;
+}
+/** A single canonical IPv4 octet: 1–3 digits, no leading zero, value 0–255. */
+function isDecimalOctet(part) {
+	if (!/^\d{1,3}$/.test(part) || part.length > 1 && part[0] === "0") return false;
+	return Number(part) <= 255;
+}
+/**
+* Default origin policy for a localhost dev tool: allow requests with no
+* `Origin` header (native, non-browser clients), allow any loopback origin
+* (so cross-port localhost dev setups keep working), and allow explicitly
+* configured origins. Everything else, such as a real remote page in the dev's
+* browser, is rejected.
+*/
+function isAllowedOrigin(origin, allowedOrigins) {
+	if (!origin) return true;
+	if (allowedOrigins.includes(origin)) return true;
+	try {
+		return isLoopbackHostname(new URL(origin).hostname);
+	} catch {
+		return false;
+	}
+}
+/**
+* Decide whether a request-derived origin candidate may back a devframe's
+* advertised public origin, the destination of the OTP magic link. Stricter
+* than {@link isAllowedOrigin}: it rejects credentials, a path, a query, a
+* fragment, a malformed port, and non-HTTP(S) schemes, and adopts a candidate
+* only when its hostname is loopback or its canonical origin exactly matches
+* an `allowedOrigins` entry (a caller with no static list passes none, so only
+* loopback qualifies). Returns the canonical origin to adopt, or `undefined`
+* to reject. Forwarded headers are never consulted.
+*/
+function validateOriginCandidate(candidate, allowedOrigins) {
+	let url;
+	try {
+		url = new URL(candidate);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+	if (url.username || url.password || url.search || url.hash || url.pathname !== "/" && url.pathname !== "") return void 0;
+	const canonical = url.origin;
+	if (canonical === "null") return void 0;
+	if (isLoopbackHostname(url.hostname) || allowedOrigins?.includes(canonical)) return canonical;
+}
+//#endregion
+export { isLoopbackHostname as n, validateOriginCandidate as r, isAllowedOrigin as t };

package/dist/recipes/common-rpc-functions.d.mts

@@ -1,6 +1,6 @@
-import "../index-BzyopqxV.mjs";
-import { E as Thenable, S as RpcFunctionSetupResult, c as RpcDump, g as RpcFunctionAgentOptions } from "../types-CMdPYhOx.mjs";
-import "../context-BhBzOXVa.mjs";
+import "../index-pIVt92jP.mjs";
+import { E as Thenable, S as RpcFunctionSetupResult, c as RpcDump, g as RpcFunctionAgentOptions } from "../types-Dq4i156u.mjs";
+import "../context-4AIVRLYF.mjs";
 import { SimpleSchema } from "../utils/simple-schema.mjs";
 //#region src/recipes/common-rpc-functions.d.ts
 /**
@@ -34,7 +34,7 @@ declare const KNOWN_EDITORS: KnownEditor[];
  * })
  * ```
  *
- * @deprecated Use the `@devframes/service-open` wire service instead — one
+ * @deprecated Use the `@devframes/service-open` wire service instead: one
  * host-level installation shared by every plugin and feature-detectable from
  * clients, with workspace-root path containment on top of the editor gating.
  */
@@ -64,7 +64,7 @@ declare const openInEditor: {
  * ctx.rpc.register(openInFinder)
  * ```
  *
- * @deprecated Use the `@devframes/service-open` wire service instead — one
+ * @deprecated Use the `@devframes/service-open` wire service instead: one
  * host-level installation shared by every plugin and feature-detectable from
  * clients, with workspace-root path containment.
  */

package/dist/recipes/common-rpc-functions.mjs

@@ -1,5 +1,5 @@
 import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
-import { t as s } from "../simple-schema-DQPZrAaZ.mjs";
+import { t as s } from "../simple-schema-Bi40l-P6.mjs";
 //#region src/recipes/common-rpc-functions.ts
 /** Runtime list of every {@link KnownEditor}. */
 const KNOWN_EDITORS = [
@@ -57,7 +57,7 @@ const KNOWN_EDITORS = [
 * })
 * ```
 *
-* @deprecated Use the `@devframes/service-open` wire service instead — one
+* @deprecated Use the `@devframes/service-open` wire service instead: one
 * host-level installation shared by every plugin and feature-detectable from
 * clients, with workspace-root path containment on top of the editor gating.
 */
@@ -83,7 +83,7 @@ const openInEditor = defineRpcFunction({
 * ctx.rpc.register(openInFinder)
 * ```
 *
-* @deprecated Use the `@devframes/service-open` wire service instead — one
+* @deprecated Use the `@devframes/service-open` wire service instead: one
 * host-level installation shared by every plugin and feature-detectable from
 * clients, with workspace-root path containment.
 */

package/dist/recipes/interactive-auth.d.mts

@@ -1,9 +1,9 @@
-import { Ct as DevframeAuthHandler, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "../context-BhBzOXVa.mjs";
-import "../index-DcKxIMoI.mjs";
+import { o as DevframeNodeContext, s as DevframeNodeRpcSession, wt as DevframeAuthHandler } from "../context-4AIVRLYF.mjs";
+import "../index-pKl67H6w.mjs";
 //#region src/recipes/interactive-auth.d.ts
 interface CreateInteractiveAuthOptions {
   /**
-   * Static, pre-shared bearer tokens that are always trusted — for CI runs
+   * Static, pre-shared bearer tokens that are always trusted, for CI runs
    * or shared machines where the interactive code prompt would only get in
    * the way. Checked in both the handshake handler and the connect-time
    * hook, alongside tokens minted by a real code exchange.
@@ -11,7 +11,7 @@ interface CreateInteractiveAuthOptions {
   clientAuthTokens?: string[];
   /**
    * Print the current code + magic-link URL. Devframe stays headless, so
-   * there is no default banner printed automatically — call
+   * there is no default banner printed automatically; call
    * `auth.printBanner()` yourself once the server is listening. Override
    * this to customize the format; defaults to a small boxed message on
    * stdout.
@@ -41,10 +41,10 @@ interface CreateInteractiveAuthOptions {
  * Package the interactive OTP auth protocol devframe's primitives
  * (`exchangeTempAuthCode`, `verifyAuthToken`, `revokeAuthToken`,
  * `getTempAuthCode`, `buildOtpAuthUrl`) implement into a ready-made
- * {@link DevframeAuthHandler} — the handshake RPC functions, the resolver
+ * {@link DevframeAuthHandler}: the handshake RPC functions, the resolver
  * gate, the connect-time trust hook, and the startup banner.
  *
- * The auth storage stays internal to this handler — callers never reach into
+ * The auth storage stays internal to this handler; callers never reach into
  * `devframe/node/hub-internals` themselves.
  *
  * ```ts

package/dist/recipes/interactive-auth.mjs

@@ -1,9 +1,9 @@
-import { s as colors } from "../nostics-CzECRXpE.mjs";
+import { s as colors } from "../nostics-D0PvLZsn.mjs";
 import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
 import { isAnonymousRpcMethod } from "../constants.mjs";
-import { a as verifyAuthToken, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-CK9LjrnT.mjs";
-import { t as getInternalContext } from "../context-KUqAfawQ.mjs";
-import { t as s } from "../simple-schema-DQPZrAaZ.mjs";
+import { a as verifyAuthToken, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-CeQQWzM-.mjs";
+import { t as getInternalContext } from "../context-DIUvJW4D.mjs";
+import { t as s } from "../simple-schema-Bi40l-P6.mjs";
 //#region src/recipes/interactive-auth.ts
 function defaultBanner(info) {
 	console.log(`\n  ${colors.dim("devframe auth code")}  ${colors.bold(info.code)}\n  ${colors.dim("or open")}       ${colors.cyan(info.url)}\n`);
@@ -12,10 +12,10 @@ function defaultBanner(info) {
 * Package the interactive OTP auth protocol devframe's primitives
 * (`exchangeTempAuthCode`, `verifyAuthToken`, `revokeAuthToken`,
 * `getTempAuthCode`, `buildOtpAuthUrl`) implement into a ready-made
-* {@link DevframeAuthHandler} — the handshake RPC functions, the resolver
+* {@link DevframeAuthHandler}: the handshake RPC functions, the resolver
 * gate, the connect-time trust hook, and the startup banner.
 *
-* The auth storage stays internal to this handler — callers never reach into
+* The auth storage stays internal to this handler; callers never reach into
 * `devframe/node/hub-internals` themselves.
 *
 * ```ts

package/dist/{remote-assets-DezQmPQU.mjs → remote-assets-BIFWOlBW.mjs}

@@ -1,8 +1,8 @@
-import { t as diagnostics } from "./diagnostics-BXWW3VK-.mjs";
+import { t as diagnostics } from "./diagnostics-BMfN8mb1.mjs";
 import { createRequire } from "node:module";
 import { isatty } from "node:tty";
 import { formatWithOptions, inspect } from "node:util";
-import { dirname, extname, join, normalize, sep } from "pathe";
+import { dirname, extname, isAbsolute, join, normalize, resolve, sep } from "pathe";
 import { createReadStream, existsSync } from "node:fs";
 import { Buffer } from "node:buffer";
 import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
@@ -302,7 +302,7 @@ const MANIFEST_FILENAME = ".manifest.json";
 * list is dropped, because it describes the *provider's* transfer rather than
 * the file: hop-by-hop and encoding headers no longer match the body `fetch`
 * already decoded, and a CDN's policy headers (`set-cookie`, `cache-control`,
-* framing/CSP) belong to its origin — replaying them under the dev server's
+* framing/CSP) belong to its origin, so replaying them under the dev server's
 * origin could just as well break the iframe these assets render in.
 */
 const PROXIED_HEADERS = [
@@ -436,6 +436,24 @@ function candidatePaths(prefix, cleaned) {
 	if (!/\.[a-z0-9]+$/i.test(cleaned) && !candidates.includes(`${prefix}index.html`)) candidates.push(`${prefix}index.html`);
 	return candidates;
 }
+/**
+* Resolve the safe destination for a provider-listed `filePath` beneath
+* `prefix`, materializing into the already-resolved `root`, or `null` when
+* the entry is unsafe or lies outside the selected `prefix`. A compromised
+* provider is an untrusted boundary even though the built-in jsDelivr/unpkg
+* listings never emit any of this: reject an absolute path, a backslash
+* (never normalized into a separator; Windows-style traversal stays rejected
+* on every platform), and any suffix whose resolved destination would land
+* outside `root`. `target === root` is deliberately unsafe too: it names the
+* directory itself, never a writable file.
+*/
+function materializeTarget(filePath, prefix, root) {
+	if (filePath.includes("\\") || isAbsolute(filePath) || !filePath.startsWith(prefix)) return null;
+	const suffix = filePath.slice(prefix.length);
+	if (!suffix || isAbsolute(suffix)) return null;
+	const target = resolve(root, suffix);
+	return target === root || !target.startsWith(root + sep) ? null : target;
+}
 function createStore(assets, cacheDir) {
 	const normalized = {
 		...assets,
@@ -582,8 +600,10 @@ function createStore(assets, cacheDir) {
 		} catch (error) {
 			return fail(errText(error), error);
 		}
-		for (const filePath of files.filter((f) => f.startsWith(prefix))) {
-			const target = join(targetDir, filePath.slice(prefix.length));
+		const root = resolve(targetDir);
+		for (const filePath of files) {
+			const target = materializeTarget(filePath, prefix, root);
+			if (target == null) continue;
 			const url = provider.fileUrl(normalized.package, normalized.version, filePath);
 			let res;
 			try {
@@ -625,7 +645,7 @@ function assertValidRemoteAssets(assets) {
 * {@link RemoteAssetsStore} back-proxy. Remote caches live under
 * `<projectStorageDir>/.remote-assets/<package>@<version>/`.
 *
-* A remote source's `package`/`version` are validated first (`DF0065`) — both
+* A remote source's `package`/`version` are validated first (`DF0065`); both
 * are interpolated into CDN URLs and the cache path.
 *
 * `defaultResolveFrom` (typically the declaring devframe's `importMetaUrl`)

package/dist/{remote-assets-B13_vRkJ.d.mts → remote-assets-eBvSKZMS.d.mts}

@@ -6,16 +6,16 @@
  *
  * Resolution order at serve time:
  *
- *   1. The package installed locally (resolved from {@link resolveFrom})
- *      — the zero-network / air-gap path. Version skew warns; a major
+ *   1. The package installed locally (resolved from {@link resolveFrom}),
+ *      the zero-network / air-gap path. Version skew warns; a major
  *      version mismatch throws.
  *   2. The per-file cache under
  *      `<storageDir project>/.remote-assets/<package>@<version>/`.
- *   3. The CDN {@link provider} — each requested file streams through to
+ *   3. The CDN {@link provider}: each requested file streams through to
  *      the browser while being written into the cache.
  *
  * Anywhere a static mount accepts a dist directory (`clientAssets`,
- * `hostStatic`, `mountStatic`) it also accepts this object — see
+ * `hostStatic`, `mountStatic`) it also accepts this object; see
  * {@link StaticAssetsSource}.
  */
 interface RemoteAssets {
@@ -39,7 +39,7 @@ interface RemoteAssets {
    * `import.meta.url` of the declaring module. When set, a locally
    * installed copy of {@link package} is resolved from this module's own
    * dependency graph first (works under pnpm's strict layout) and served
-   * with zero network. Omitting it skips the installed-package step —
+   * with zero network. Omitting it skips the installed-package step;
    * cache + CDN still work.
    */
   resolveFrom?: string | null;
@@ -54,7 +54,7 @@ interface RemoteAssets {
   offline?: boolean;
 }
 /**
- * Built-in CDN providers (`'jsdelivr'` — default, `'unpkg'`) or a custom
+ * Built-in CDN providers (`'jsdelivr'`, the default, or `'unpkg'`) or a custom
  * provider for corp mirrors.
  */
 type RemoteAssetsProvider = 'jsdelivr' | 'unpkg' | RemoteAssetsProviderCustom;
@@ -97,7 +97,7 @@ interface RemoteAssetsErrorMessage {
   reason: string;
 }
 /**
- * A resolved, servable handle over a {@link RemoteAssets} declaration —
+ * A resolved, servable handle over a {@link RemoteAssets} declaration,
  * produced by `resolveStaticAssetsSource()` (`devframe/utils/remote-assets`)
  * and consumed by the static-serving engine (`devframe/utils/serve-static`).
  */

package/dist/{revoke-COLW0cOi.mjs → revoke-cqztiCX4.mjs}

@@ -1,4 +1,4 @@
-import { t as DEVFRAME_EVENTS } from "./events-4daw0uK9.mjs";
+import { t as DEVFRAME_EVENTS } from "./events-BV4Dj59a.mjs";
 //#region src/node/auth/revoke.ts
 /**
 * Flip `isTrusted` to false on any live WS clients connected with `token`

package/dist/rpc/dump.d.mts

@@ -1,14 +1,5 @@
-import { h as RpcDumpStore, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny } from "../types-CMdPYhOx.mjs";
+import { h as RpcDumpStore, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny } from "../types-Dq4i156u.mjs";
 //#region src/rpc/dump/collect.d.ts
-/**
- * Collects pre-computed dumps by executing functions with their defined input combinations.
- * Static functions without dump config automatically get `{ inputs: [[]] }`.
- *
- * @example
- * ```ts
- * const store = await dumpFunctions([greet], context, { concurrency: 10 })
- * ```
- */
 declare function dumpFunctions<T extends readonly RpcFunctionDefinitionAny[]>(definitions: T, context?: any, options?: RpcDumpCollectionOptions): Promise<RpcDumpStore<RpcDefinitionsToFunctions<T>>>;
 /**
  * Creates a client that serves pre-computed results from a dump store.
@@ -64,7 +55,7 @@ type StaticRpcDumpManifest = Record<string, StaticRpcDumpManifestValue>;
 interface StaticRpcDumpFile {
   /** Whether this file was written via `JSON.stringify` or `structured-clone-es.stringify`. */
   serialization: StaticRpcDumpSerialization;
-  /** Function name the file belongs to — used to scope `DF0019` errors during write. */
+  /** Function name the file belongs to, used to scope `DF0019` errors during write. */
   fnName: string;
   /** Payload to encode. */
   data: unknown;

package/dist/rpc/dump.mjs

@@ -1,2 +1,2 @@
-import { a as reviveDumpError, i as getDefinitionsWithDumps, n as createClientFromDump, o as serializeDumpError, r as dumpFunctions, t as collectStaticRpcDump } from "../static-DV_qUSRS.mjs";
+import { a as reviveDumpError, i as getDefinitionsWithDumps, n as createClientFromDump, o as serializeDumpError, r as dumpFunctions, t as collectStaticRpcDump } from "../static-DZ8P2Kn7.mjs";
 export { collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError };

package/dist/rpc/index.d.mts

@@ -1,3 +1,3 @@
-import { a as STRUCTURED_CLONE_PREFIX, c as getRpcResolvedSetupResult, d as RpcFunctionsCollectorBase, f as RpcCacheManager, i as validateRpcReturn, l as createDefineWrapperWithContext, n as validateDefinitions, o as strictJsonStringify, p as RpcCacheOptions, r as validateRpcArgs, s as getRpcHandler, t as validateDefinition, u as defineRpcFunction } from "../index-BzyopqxV.mjs";
-import { C as RpcFunctionType, E as Thenable, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinition, a as RpcDefinitionsFilter, b as RpcFunctionDefinitionBase, c as RpcDump, d as RpcDumpDefinition, f as RpcDumpGetter, g as RpcFunctionAgentOptions, h as RpcDumpStore, i as RpcArgsSchema, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, p as RpcDumpRecord, r as EntriesToObject, s as RpcDefinitionsToFunctionsWithNamespace, t as BirpcFn, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny, w as RpcFunctionsCollector, x as RpcFunctionDefinitionToFunction, y as RpcFunctionDefinitionAnyWithContext } from "../types-CMdPYhOx.mjs";
+import { a as STRUCTURED_CLONE_PREFIX, c as getRpcResolvedSetupResult, d as RpcFunctionsCollectorBase, f as RpcCacheManager, i as validateRpcReturn, l as createDefineWrapperWithContext, n as validateDefinitions, o as strictJsonStringify, p as RpcCacheOptions, r as validateRpcArgs, s as getRpcHandler, t as validateDefinition, u as defineRpcFunction } from "../index-pIVt92jP.mjs";
+import { C as RpcFunctionType, E as Thenable, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinition, a as RpcDefinitionsFilter, b as RpcFunctionDefinitionBase, c as RpcDump, d as RpcDumpDefinition, f as RpcDumpGetter, g as RpcFunctionAgentOptions, h as RpcDumpStore, i as RpcArgsSchema, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, p as RpcDumpRecord, r as EntriesToObject, s as RpcDefinitionsToFunctionsWithNamespace, t as BirpcFn, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny, w as RpcFunctionsCollector, x as RpcFunctionDefinitionToFunction, y as RpcFunctionDefinitionAnyWithContext } from "../types-Dq4i156u.mjs";
 export { type BirpcFn, type BirpcReturn, EntriesToObject, RpcArgsSchema, RpcCacheManager, RpcCacheOptions, RpcDefinitionsFilter, RpcDefinitionsToFunctions, RpcDefinitionsToFunctionsWithNamespace, RpcDump, RpcDumpClientOptions, RpcDumpCollectionOptions, RpcDumpDefinition, RpcDumpGetter, RpcDumpRecord, RpcDumpRecordError, RpcDumpStore, RpcFunctionAgentOptions, RpcFunctionDefinition, RpcFunctionDefinitionAny, RpcFunctionDefinitionAnyWithContext, RpcFunctionDefinitionBase, RpcFunctionDefinitionToFunction, RpcFunctionSetupResult, RpcFunctionType, RpcFunctionsCollector, RpcFunctionsCollectorBase, RpcReturnSchema, STRUCTURED_CLONE_PREFIX, Thenable, createDefineWrapperWithContext, defineRpcFunction, getRpcHandler, getRpcResolvedSetupResult, strictJsonStringify, validateDefinition, validateDefinitions, validateRpcArgs, validateRpcReturn };

package/dist/rpc/index.mjs

@@ -1,7 +1,7 @@
-import { a as validateRpcArgs, i as getRpcResolvedSetupResult, n as validateDefinitions, o as validateRpcReturn, r as getRpcHandler, s as hash, t as validateDefinition } from "../validation-YrZH6atx.mjs";
-import { t as diagnostics } from "../diagnostics-CD8nlgll.mjs";
+import { a as validateRpcArgs, i as getRpcResolvedSetupResult, n as validateDefinitions, o as validateRpcReturn, r as getRpcHandler, s as hash, t as validateDefinition } from "../validation-BOy8IoFZ.mjs";
+import { t as diagnostics } from "../diagnostics-D0EVm5M6.mjs";
 import { n as defineRpcFunction, t as createDefineWrapperWithContext } from "../define-BLWPsH6y.mjs";
-import { n as strictJsonStringify, t as STRUCTURED_CLONE_PREFIX } from "../serialization-BGzEwAdr.mjs";
+import { n as strictJsonStringify, t as STRUCTURED_CLONE_PREFIX } from "../serialization-DTZnPQ1-.mjs";
 //#region src/rpc/cache.ts
 /**
 * @experimental API is expected to change.

package/dist/rpc/transports/sse-client.d.mts

@@ -1,2 +1,2 @@
-import { n as createSseRpcChannel, t as SseRpcChannelOptions } from "../../sse-client-DwX021ST.mjs";
+import { n as createSseRpcChannel, t as SseRpcChannelOptions } from "../../sse-client-BQ4jS3eO.mjs";
 export { SseRpcChannelOptions, createSseRpcChannel };

package/dist/rpc/transports/sse-client.mjs

@@ -1,10 +1,33 @@
 import { DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_SSE_SESSION_HEADER } from "../../constants.mjs";
-import { t as createRpcWireCodec } from "../../wire-codec-0K-o5MYW.mjs";
+import { t as createRpcWireCodec } from "../../wire-codec-dcCeXcSo.mjs";
 //#region src/rpc/transports/sse-client.ts
 function NOOP() {}
+/** Split the next complete SSE frame (up to a blank line) off the buffer. */
+function takeFrame(buffer) {
+	const boundary = buffer.search(/\n\n|\r\n\r\n/);
+	if (boundary < 0) return void 0;
+	return {
+		frame: buffer.slice(0, boundary),
+		rest: buffer.slice(boundary + (buffer[boundary] === "\r" ? 4 : 2))
+	};
+}
+/** Parse one SSE frame's lines into its event name and data lines. */
+function parseFrame(frame) {
+	let event = "message";
+	const data = [];
+	for (const rawLine of frame.split(/\r?\n/)) {
+		if (rawLine.startsWith(":")) continue;
+		if (rawLine.startsWith("event:")) event = rawLine.slice(6).trimStart();
+		else if (rawLine.startsWith("data:")) data.push(rawLine.slice(5).replace(/^ /, ""));
+	}
+	return {
+		event,
+		data
+	};
+}
 /**
 * Build a birpc `ChannelOptions` object backed by an SSE stream (server →
-* client) and HTTP `POST` (client → server) — the WebSocket-free counterpart
+* client) and HTTP `POST` (client → server): the WebSocket-free counterpart
 * to `createWsRpcChannel`, wire-compatible with `attachSseRpcTransport`.
 *
 * The stream is consumed via `fetch` streaming (not `EventSource`), so it
@@ -12,7 +35,7 @@ function NOOP() {}
 * (`event: session`) carries the session id; every `POST` echoes it in the
 * `x-birpc-session` header. A response to a client-initiated request comes
 * back in the `POST`'s own body and is re-injected into the channel; a
-* dropped stream terminates the channel — there is no reconnect, matching
+* dropped stream terminates the channel; there is no reconnect, matching
 * the WS channel's closed-is-done semantics.
 */
 function createSseRpcChannel(options) {
@@ -63,17 +86,10 @@ function createSseRpcChannel(options) {
 			if (done) break;
 			buffer += decoder.decode(value, { stream: true });
 			for (;;) {
-				const boundary = buffer.search(/\n\n|\r\n\r\n/);
-				if (boundary < 0) break;
-				const frame = buffer.slice(0, boundary);
-				buffer = buffer.slice(boundary + (buffer[boundary] === "\r" ? 4 : 2));
-				let event = "message";
-				const data = [];
-				for (const rawLine of frame.split(/\r?\n/)) {
-					if (rawLine.startsWith(":")) continue;
-					if (rawLine.startsWith("event:")) event = rawLine.slice(6).trimStart();
-					else if (rawLine.startsWith("data:")) data.push(rawLine.slice(5).replace(/^ /, ""));
-				}
+				const taken = takeFrame(buffer);
+				if (!taken) break;
+				buffer = taken.rest;
+				const { event, data } = parseFrame(taken.frame);
 				if (data.length > 0) dispatch(event, data.join("\n"));
 			}
 		}

package/dist/rpc/transports/sse-server.d.mts

@@ -1,5 +1,5 @@
-import { v as RpcFunctionDefinitionAny } from "../../types-CMdPYhOx.mjs";
-import { d as DevframeRpcConnection, n as WsOriginRegistry, u as DevframeNodeRpcSessionMeta } from "../../ws-server-Di2oqr4q.mjs";
+import { v as RpcFunctionDefinitionAny } from "../../types-Dq4i156u.mjs";
+import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection, n as WsOriginRegistry } from "../../ws-server-D2nv68Hg.mjs";
 import { BirpcGroup } from "birpc";
 //#region src/rpc/transports/sse-server.d.ts
 interface SseRpcTransportOptions {
@@ -14,7 +14,7 @@ interface SseRpcTransportOptions {
    * RPC function definitions, used by the per-call wire serializer to
    * dispatch between strict-JSON and structured-clone encoding based on
    * each function's `jsonSerializable` flag. When omitted, all messages
-   * fall back to structured-clone — same contract as the WS transport.
+   * fall back to structured-clone, the same contract as the WS transport.
    */
   definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>;
   onConnected?: (connection: DevframeRpcConnection, meta: DevframeNodeRpcSessionMeta) => void;
@@ -42,7 +42,7 @@ interface SseRpcTransport {
   close: () => void;
 }
 /**
- * Attach an SSE + HTTP POST transport to an existing RPC group — the
+ * Attach an SSE + HTTP POST transport to an existing RPC group: the
  * WebSocket-free counterpart to `attachWsRpcTransport`, for hosts and
  * proxies where the upgrade isn't available. Speaks the same birpc wire
  * protocol (one channel per session, per-method `jsonSerializable`

package/dist/rpc/transports/sse-server.mjs

@@ -1,15 +1,17 @@
 import { DEVFRAME_SSE_SESSION_HEADER } from "../../constants.mjs";
-import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../../wire-codec-0K-o5MYW.mjs";
-import { i as isAllowedOrigin, o as createRpcSessionMeta } from "../../ws-server-BdSLrhxE.mjs";
+import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../../wire-codec-dcCeXcSo.mjs";
+import { t as isAllowedOrigin } from "../../origin-DZit9g29.mjs";
+import { t as createRpcSessionMeta } from "../../session-DPfj6zQG.mjs";
 //#region src/rpc/transports/sse-server.ts
 const SSE_STREAM_HEADERS = {
 	"content-type": "text/event-stream",
 	"cache-control": "no-cache, no-transform",
+	/** Tell buffering reverse proxies (nginx) to pass frames through as-is. */
 	"x-accel-buffering": "no"
 };
 function NOOP() {}
 /**
-* Attach an SSE + HTTP POST transport to an existing RPC group — the
+* Attach an SSE + HTTP POST transport to an existing RPC group: the
 * WebSocket-free counterpart to `attachWsRpcTransport`, for hosts and
 * proxies where the upgrade isn't available. Speaks the same birpc wire
 * protocol (one channel per session, per-method `jsonSerializable`
@@ -33,7 +35,7 @@ function attachSseRpcTransport(rpcGroup, options = {}) {
 		return allowedOrigins && !Array.isArray(allowedOrigins) ? allowedOrigins.isAllowed(origin) : isAllowedOrigin(origin, allowedOrigins ?? []);
 	}
 	/**
-	* CORS headers for a browser on another (allowed) origin — the side-car /
+	* CORS headers for a browser on another (allowed) origin: the side-car /
 	* registered-viewer case. Same-origin requests carry no `Origin` (or their
 	* own), where these headers are inert.
 	*/
@@ -65,8 +67,6 @@ function attachSseRpcTransport(rpcGroup, options = {}) {
 		const session = {
 			id,
 			meta,
-			connection: void 0,
-			channel: void 0,
 			parked: /* @__PURE__ */ new Map(),
 			closed: false,
 			close: () => {
@@ -80,7 +80,7 @@ function attachSseRpcTransport(rpcGroup, options = {}) {
 					controller?.close();
 				} catch {}
 				rpcGroup.updateChannels((channels) => {
-					const index = channels.indexOf(session.channel);
+					const index = session.channel ? channels.indexOf(session.channel) : -1;
 					if (index >= 0) channels.splice(index, 1);
 				});
 				onDisconnected(session.connection, meta);