devframe 0.9.8 → 0.9.10

package/dist/{remote-assets-DezQmPQU.mjs → remote-assets-DMFzLSoH.mjs}

@@ -1,11 +1,11 @@
-import { t as diagnostics } from "./diagnostics-BXWW3VK-.mjs";
+import { t as diagnostics } from "./diagnostics-DZA6KQ_Z.mjs";
 import { createRequire } from "node:module";
+import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, extname, isAbsolute, join, normalize, resolve, sep } from "pathe";
 import { isatty } from "node:tty";
 import { formatWithOptions, inspect } from "node:util";
-import { dirname, extname, join, normalize, sep } from "pathe";
 import { createReadStream, existsSync } from "node:fs";
 import { Buffer } from "node:buffer";
-import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { Readable } from "node:stream";
 import { lookup } from "mrmime";
 //#region ../../node_modules/.pnpm/obug@2.1.4/node_modules/obug/dist/core.js
@@ -302,7 +302,7 @@ const MANIFEST_FILENAME = ".manifest.json";
 * list is dropped, because it describes the *provider's* transfer rather than
 * the file: hop-by-hop and encoding headers no longer match the body `fetch`
 * already decoded, and a CDN's policy headers (`set-cookie`, `cache-control`,
-* framing/CSP) belong to its origin — replaying them under the dev server's
+* framing/CSP) belong to its origin, so replaying them under the dev server's
 * origin could just as well break the iframe these assets render in.
 */
 const PROXIED_HEADERS = [
@@ -436,6 +436,24 @@ function candidatePaths(prefix, cleaned) {
 	if (!/\.[a-z0-9]+$/i.test(cleaned) && !candidates.includes(`${prefix}index.html`)) candidates.push(`${prefix}index.html`);
 	return candidates;
 }
+/**
+* Resolve the safe destination for a provider-listed `filePath` beneath
+* `prefix`, materializing into the already-resolved `root`, or `null` when
+* the entry is unsafe or lies outside the selected `prefix`. A compromised
+* provider is an untrusted boundary even though the built-in jsDelivr/unpkg
+* listings never emit any of this: reject an absolute path, a backslash
+* (never normalized into a separator; Windows-style traversal stays rejected
+* on every platform), and any suffix whose resolved destination would land
+* outside `root`. `target === root` is deliberately unsafe too: it names the
+* directory itself, never a writable file.
+*/
+function materializeTarget(filePath, prefix, root) {
+	if (filePath.includes("\\") || isAbsolute(filePath) || !filePath.startsWith(prefix)) return null;
+	const suffix = filePath.slice(prefix.length);
+	if (!suffix || isAbsolute(suffix)) return null;
+	const target = resolve(root, suffix);
+	return target === root || !target.startsWith(root + sep) ? null : target;
+}
 function createStore(assets, cacheDir) {
 	const normalized = {
 		...assets,
@@ -582,8 +600,10 @@ function createStore(assets, cacheDir) {
 		} catch (error) {
 			return fail(errText(error), error);
 		}
-		for (const filePath of files.filter((f) => f.startsWith(prefix))) {
-			const target = join(targetDir, filePath.slice(prefix.length));
+		const root = resolve(targetDir);
+		for (const filePath of files) {
+			const target = materializeTarget(filePath, prefix, root);
+			if (target == null) continue;
 			const url = provider.fileUrl(normalized.package, normalized.version, filePath);
 			let res;
 			try {
@@ -625,7 +645,7 @@ function assertValidRemoteAssets(assets) {
 * {@link RemoteAssetsStore} back-proxy. Remote caches live under
 * `<projectStorageDir>/.remote-assets/<package>@<version>/`.
 *
-* A remote source's `package`/`version` are validated first (`DF0065`) — both
+* A remote source's `package`/`version` are validated first (`DF0065`); both
 * are interpolated into CDN URLs and the cache path.
 *
 * `defaultResolveFrom` (typically the declaring devframe's `importMetaUrl`)

package/dist/{remote-assets-B13_vRkJ.d.mts → remote-assets-eBvSKZMS.d.mts}

@@ -6,16 +6,16 @@
  *
  * Resolution order at serve time:
  *
- *   1. The package installed locally (resolved from {@link resolveFrom})
- *      — the zero-network / air-gap path. Version skew warns; a major
+ *   1. The package installed locally (resolved from {@link resolveFrom}),
+ *      the zero-network / air-gap path. Version skew warns; a major
  *      version mismatch throws.
  *   2. The per-file cache under
  *      `<storageDir project>/.remote-assets/<package>@<version>/`.
- *   3. The CDN {@link provider} — each requested file streams through to
+ *   3. The CDN {@link provider}: each requested file streams through to
  *      the browser while being written into the cache.
  *
  * Anywhere a static mount accepts a dist directory (`clientAssets`,
- * `hostStatic`, `mountStatic`) it also accepts this object — see
+ * `hostStatic`, `mountStatic`) it also accepts this object; see
  * {@link StaticAssetsSource}.
  */
 interface RemoteAssets {
@@ -39,7 +39,7 @@ interface RemoteAssets {
    * `import.meta.url` of the declaring module. When set, a locally
    * installed copy of {@link package} is resolved from this module's own
    * dependency graph first (works under pnpm's strict layout) and served
-   * with zero network. Omitting it skips the installed-package step —
+   * with zero network. Omitting it skips the installed-package step;
    * cache + CDN still work.
    */
   resolveFrom?: string | null;
@@ -54,7 +54,7 @@ interface RemoteAssets {
   offline?: boolean;
 }
 /**
- * Built-in CDN providers (`'jsdelivr'` — default, `'unpkg'`) or a custom
+ * Built-in CDN providers (`'jsdelivr'`, the default, or `'unpkg'`) or a custom
  * provider for corp mirrors.
  */
 type RemoteAssetsProvider = 'jsdelivr' | 'unpkg' | RemoteAssetsProviderCustom;
@@ -97,7 +97,7 @@ interface RemoteAssetsErrorMessage {
   reason: string;
 }
 /**
- * A resolved, servable handle over a {@link RemoteAssets} declaration —
+ * A resolved, servable handle over a {@link RemoteAssets} declaration,
  * produced by `resolveStaticAssetsSource()` (`devframe/utils/remote-assets`)
  * and consumed by the static-serving engine (`devframe/utils/serve-static`).
  */

package/dist/{revoke-COLW0cOi.mjs → revoke-cqztiCX4.mjs}

@@ -1,4 +1,4 @@
-import { t as DEVFRAME_EVENTS } from "./events-4daw0uK9.mjs";
+import { t as DEVFRAME_EVENTS } from "./events-BV4Dj59a.mjs";
 //#region src/node/auth/revoke.ts
 /**
 * Flip `isTrusted` to false on any live WS clients connected with `token`

package/dist/rpc/dump.d.mts

@@ -1,14 +1,5 @@
-import { h as RpcDumpStore, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny } from "../types-CMdPYhOx.mjs";
+import { h as RpcDumpStore, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny } from "../types-Dq4i156u.mjs";
 //#region src/rpc/dump/collect.d.ts
-/**
- * Collects pre-computed dumps by executing functions with their defined input combinations.
- * Static functions without dump config automatically get `{ inputs: [[]] }`.
- *
- * @example
- * ```ts
- * const store = await dumpFunctions([greet], context, { concurrency: 10 })
- * ```
- */
 declare function dumpFunctions<T extends readonly RpcFunctionDefinitionAny[]>(definitions: T, context?: any, options?: RpcDumpCollectionOptions): Promise<RpcDumpStore<RpcDefinitionsToFunctions<T>>>;
 /**
  * Creates a client that serves pre-computed results from a dump store.
@@ -64,7 +55,7 @@ type StaticRpcDumpManifest = Record<string, StaticRpcDumpManifestValue>;
 interface StaticRpcDumpFile {
   /** Whether this file was written via `JSON.stringify` or `structured-clone-es.stringify`. */
   serialization: StaticRpcDumpSerialization;
-  /** Function name the file belongs to — used to scope `DF0019` errors during write. */
+  /** Function name the file belongs to, used to scope `DF0019` errors during write. */
   fnName: string;
   /** Payload to encode. */
   data: unknown;
@@ -75,4 +66,20 @@ interface StaticRpcDumpCollection {
 }
 declare function collectStaticRpcDump(definitions: Iterable<RpcFunctionDefinitionAny>, context: any): Promise<StaticRpcDumpCollection>;
 //#endregion
-export { StaticRpcDumpCollection, StaticRpcDumpFile, StaticRpcDumpManifest, StaticRpcDumpManifestQueryEntry, StaticRpcDumpManifestStaticEntry, StaticRpcDumpManifestValue, StaticRpcDumpSerialization, collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError };
+//#region src/rpc/dump/write.d.ts
+interface WriteStaticRpcDumpOptions {
+  /**
+   * Pretty-print RPC dump JSON files. Defaults to `false` so payload
+   * shards (which can be multiple MB for graph-heavy tools) ship
+   * minified. Set `true` when you need to diff / read the dumps by hand.
+   */
+  pretty?: boolean;
+}
+/**
+ * Write a collected static RPC dump to disk: every sharded record file plus
+ * the `__rpc-dump/index.json` manifest, under `outDir`. Shared by the build
+ * adapter (`createBuild`) and `@devframes/hub`'s `buildHub`.
+ */
+declare function writeStaticRpcDump(dump: StaticRpcDumpCollection, outDir: string, options?: WriteStaticRpcDumpOptions): Promise<void>;
+//#endregion
+export { StaticRpcDumpCollection, StaticRpcDumpFile, StaticRpcDumpManifest, StaticRpcDumpManifestQueryEntry, StaticRpcDumpManifestStaticEntry, StaticRpcDumpManifestValue, StaticRpcDumpSerialization, WriteStaticRpcDumpOptions, collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError, writeStaticRpcDump };

package/dist/rpc/dump.mjs

@@ -1,2 +1,2 @@
-import { a as reviveDumpError, i as getDefinitionsWithDumps, n as createClientFromDump, o as serializeDumpError, r as dumpFunctions, t as collectStaticRpcDump } from "../static-DV_qUSRS.mjs";
-export { collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError };
+import { a as getDefinitionsWithDumps, i as dumpFunctions, n as collectStaticRpcDump, o as reviveDumpError, r as createClientFromDump, s as serializeDumpError, t as writeStaticRpcDump } from "../write-BuLCrn9h.mjs";
+export { collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError, writeStaticRpcDump };

package/dist/rpc/index.d.mts

@@ -1,3 +1,3 @@
-import { a as STRUCTURED_CLONE_PREFIX, c as getRpcResolvedSetupResult, d as RpcFunctionsCollectorBase, f as RpcCacheManager, i as validateRpcReturn, l as createDefineWrapperWithContext, n as validateDefinitions, o as strictJsonStringify, p as RpcCacheOptions, r as validateRpcArgs, s as getRpcHandler, t as validateDefinition, u as defineRpcFunction } from "../index-BzyopqxV.mjs";
-import { C as RpcFunctionType, E as Thenable, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinition, a as RpcDefinitionsFilter, b as RpcFunctionDefinitionBase, c as RpcDump, d as RpcDumpDefinition, f as RpcDumpGetter, g as RpcFunctionAgentOptions, h as RpcDumpStore, i as RpcArgsSchema, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, p as RpcDumpRecord, r as EntriesToObject, s as RpcDefinitionsToFunctionsWithNamespace, t as BirpcFn, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny, w as RpcFunctionsCollector, x as RpcFunctionDefinitionToFunction, y as RpcFunctionDefinitionAnyWithContext } from "../types-CMdPYhOx.mjs";
+import { a as STRUCTURED_CLONE_PREFIX, c as getRpcResolvedSetupResult, d as RpcFunctionsCollectorBase, f as RpcCacheManager, i as validateRpcReturn, l as createDefineWrapperWithContext, n as validateDefinitions, o as strictJsonStringify, p as RpcCacheOptions, r as validateRpcArgs, s as getRpcHandler, t as validateDefinition, u as defineRpcFunction } from "../index-pIVt92jP.mjs";
+import { C as RpcFunctionType, E as Thenable, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinition, a as RpcDefinitionsFilter, b as RpcFunctionDefinitionBase, c as RpcDump, d as RpcDumpDefinition, f as RpcDumpGetter, g as RpcFunctionAgentOptions, h as RpcDumpStore, i as RpcArgsSchema, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, p as RpcDumpRecord, r as EntriesToObject, s as RpcDefinitionsToFunctionsWithNamespace, t as BirpcFn, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny, w as RpcFunctionsCollector, x as RpcFunctionDefinitionToFunction, y as RpcFunctionDefinitionAnyWithContext } from "../types-Dq4i156u.mjs";
 export { type BirpcFn, type BirpcReturn, EntriesToObject, RpcArgsSchema, RpcCacheManager, RpcCacheOptions, RpcDefinitionsFilter, RpcDefinitionsToFunctions, RpcDefinitionsToFunctionsWithNamespace, RpcDump, RpcDumpClientOptions, RpcDumpCollectionOptions, RpcDumpDefinition, RpcDumpGetter, RpcDumpRecord, RpcDumpRecordError, RpcDumpStore, RpcFunctionAgentOptions, RpcFunctionDefinition, RpcFunctionDefinitionAny, RpcFunctionDefinitionAnyWithContext, RpcFunctionDefinitionBase, RpcFunctionDefinitionToFunction, RpcFunctionSetupResult, RpcFunctionType, RpcFunctionsCollector, RpcFunctionsCollectorBase, RpcReturnSchema, STRUCTURED_CLONE_PREFIX, Thenable, createDefineWrapperWithContext, defineRpcFunction, getRpcHandler, getRpcResolvedSetupResult, strictJsonStringify, validateDefinition, validateDefinitions, validateRpcArgs, validateRpcReturn };

package/dist/rpc/index.mjs

@@ -1,7 +1,6 @@
-import { a as validateRpcArgs, i as getRpcResolvedSetupResult, n as validateDefinitions, o as validateRpcReturn, r as getRpcHandler, s as hash, t as validateDefinition } from "../validation-YrZH6atx.mjs";
-import { t as diagnostics } from "../diagnostics-CD8nlgll.mjs";
+import { a as validateRpcArgs, i as getRpcResolvedSetupResult, n as validateDefinitions, o as validateRpcReturn, r as getRpcHandler, s as hash, t as validateDefinition } from "../validation-CfV1s0SF.mjs";
+import { n as strictJsonStringify, r as diagnostics, t as STRUCTURED_CLONE_PREFIX } from "../serialization-DFg5sUt6.mjs";
 import { n as defineRpcFunction, t as createDefineWrapperWithContext } from "../define-BLWPsH6y.mjs";
-import { n as strictJsonStringify, t as STRUCTURED_CLONE_PREFIX } from "../serialization-BGzEwAdr.mjs";
 //#region src/rpc/cache.ts
 /**
 * @experimental API is expected to change.

package/dist/rpc/transports/sse-client.d.mts

@@ -1,2 +1,2 @@
-import { n as createSseRpcChannel, t as SseRpcChannelOptions } from "../../sse-client-DwX021ST.mjs";
+import { n as createSseRpcChannel, t as SseRpcChannelOptions } from "../../sse-client-BQ4jS3eO.mjs";
 export { SseRpcChannelOptions, createSseRpcChannel };

package/dist/rpc/transports/sse-client.mjs

@@ -1,10 +1,33 @@
 import { DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_SSE_SESSION_HEADER } from "../../constants.mjs";
-import { t as createRpcWireCodec } from "../../wire-codec-0K-o5MYW.mjs";
+import { t as createRpcWireCodec } from "../../wire-codec-BHGt0sSs.mjs";
 //#region src/rpc/transports/sse-client.ts
 function NOOP() {}
+/** Split the next complete SSE frame (up to a blank line) off the buffer. */
+function takeFrame(buffer) {
+	const boundary = buffer.search(/\n\n|\r\n\r\n/);
+	if (boundary < 0) return void 0;
+	return {
+		frame: buffer.slice(0, boundary),
+		rest: buffer.slice(boundary + (buffer[boundary] === "\r" ? 4 : 2))
+	};
+}
+/** Parse one SSE frame's lines into its event name and data lines. */
+function parseFrame(frame) {
+	let event = "message";
+	const data = [];
+	for (const rawLine of frame.split(/\r?\n/)) {
+		if (rawLine.startsWith(":")) continue;
+		if (rawLine.startsWith("event:")) event = rawLine.slice(6).trimStart();
+		else if (rawLine.startsWith("data:")) data.push(rawLine.slice(5).replace(/^ /, ""));
+	}
+	return {
+		event,
+		data
+	};
+}
 /**
 * Build a birpc `ChannelOptions` object backed by an SSE stream (server →
-* client) and HTTP `POST` (client → server) — the WebSocket-free counterpart
+* client) and HTTP `POST` (client → server): the WebSocket-free counterpart
 * to `createWsRpcChannel`, wire-compatible with `attachSseRpcTransport`.
 *
 * The stream is consumed via `fetch` streaming (not `EventSource`), so it
@@ -12,7 +35,7 @@ function NOOP() {}
 * (`event: session`) carries the session id; every `POST` echoes it in the
 * `x-birpc-session` header. A response to a client-initiated request comes
 * back in the `POST`'s own body and is re-injected into the channel; a
-* dropped stream terminates the channel — there is no reconnect, matching
+* dropped stream terminates the channel; there is no reconnect, matching
 * the WS channel's closed-is-done semantics.
 */
 function createSseRpcChannel(options) {
@@ -63,17 +86,10 @@ function createSseRpcChannel(options) {
 			if (done) break;
 			buffer += decoder.decode(value, { stream: true });
 			for (;;) {
-				const boundary = buffer.search(/\n\n|\r\n\r\n/);
-				if (boundary < 0) break;
-				const frame = buffer.slice(0, boundary);
-				buffer = buffer.slice(boundary + (buffer[boundary] === "\r" ? 4 : 2));
-				let event = "message";
-				const data = [];
-				for (const rawLine of frame.split(/\r?\n/)) {
-					if (rawLine.startsWith(":")) continue;
-					if (rawLine.startsWith("event:")) event = rawLine.slice(6).trimStart();
-					else if (rawLine.startsWith("data:")) data.push(rawLine.slice(5).replace(/^ /, ""));
-				}
+				const taken = takeFrame(buffer);
+				if (!taken) break;
+				buffer = taken.rest;
+				const { event, data } = parseFrame(taken.frame);
 				if (data.length > 0) dispatch(event, data.join("\n"));
 			}
 		}

package/dist/rpc/transports/sse-server.d.mts

@@ -1,5 +1,5 @@
-import { v as RpcFunctionDefinitionAny } from "../../types-CMdPYhOx.mjs";
-import { d as DevframeRpcConnection, n as WsOriginRegistry, u as DevframeNodeRpcSessionMeta } from "../../ws-server-VyHlanzy.mjs";
+import { v as RpcFunctionDefinitionAny } from "../../types-Dq4i156u.mjs";
+import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection, n as WsOriginRegistry } from "../../ws-server-D2nv68Hg.mjs";
 import { BirpcGroup } from "birpc";
 //#region src/rpc/transports/sse-server.d.ts
 interface SseRpcTransportOptions {
@@ -14,7 +14,7 @@ interface SseRpcTransportOptions {
    * RPC function definitions, used by the per-call wire serializer to
    * dispatch between strict-JSON and structured-clone encoding based on
    * each function's `jsonSerializable` flag. When omitted, all messages
-   * fall back to structured-clone — same contract as the WS transport.
+   * fall back to structured-clone, the same contract as the WS transport.
    */
   definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>;
   onConnected?: (connection: DevframeRpcConnection, meta: DevframeNodeRpcSessionMeta) => void;
@@ -42,7 +42,7 @@ interface SseRpcTransport {
   close: () => void;
 }
 /**
- * Attach an SSE + HTTP POST transport to an existing RPC group — the
+ * Attach an SSE + HTTP POST transport to an existing RPC group: the
  * WebSocket-free counterpart to `attachWsRpcTransport`, for hosts and
  * proxies where the upgrade isn't available. Speaks the same birpc wire
  * protocol (one channel per session, per-method `jsonSerializable`

package/dist/rpc/transports/sse-server.mjs

@@ -1,15 +1,17 @@
 import { DEVFRAME_SSE_SESSION_HEADER } from "../../constants.mjs";
-import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../../wire-codec-0K-o5MYW.mjs";
-import { i as isAllowedOrigin, o as createRpcSessionMeta } from "../../ws-server-Y_AumUQH.mjs";
+import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../../wire-codec-BHGt0sSs.mjs";
+import { t as isAllowedOrigin } from "../../origin-DZit9g29.mjs";
+import { t as createRpcSessionMeta } from "../../session-DPfj6zQG.mjs";
 //#region src/rpc/transports/sse-server.ts
 const SSE_STREAM_HEADERS = {
 	"content-type": "text/event-stream",
 	"cache-control": "no-cache, no-transform",
+	/** Tell buffering reverse proxies (nginx) to pass frames through as-is. */
 	"x-accel-buffering": "no"
 };
 function NOOP() {}
 /**
-* Attach an SSE + HTTP POST transport to an existing RPC group — the
+* Attach an SSE + HTTP POST transport to an existing RPC group: the
 * WebSocket-free counterpart to `attachWsRpcTransport`, for hosts and
 * proxies where the upgrade isn't available. Speaks the same birpc wire
 * protocol (one channel per session, per-method `jsonSerializable`
@@ -33,7 +35,7 @@ function attachSseRpcTransport(rpcGroup, options = {}) {
 		return allowedOrigins && !Array.isArray(allowedOrigins) ? allowedOrigins.isAllowed(origin) : isAllowedOrigin(origin, allowedOrigins ?? []);
 	}
 	/**
-	* CORS headers for a browser on another (allowed) origin — the side-car /
+	* CORS headers for a browser on another (allowed) origin: the side-car /
 	* registered-viewer case. Same-origin requests carry no `Origin` (or their
 	* own), where these headers are inert.
 	*/
@@ -65,8 +67,6 @@ function attachSseRpcTransport(rpcGroup, options = {}) {
 		const session = {
 			id,
 			meta,
-			connection: void 0,
-			channel: void 0,
 			parked: /* @__PURE__ */ new Map(),
 			closed: false,
 			close: () => {
@@ -80,7 +80,7 @@ function attachSseRpcTransport(rpcGroup, options = {}) {
 					controller?.close();
 				} catch {}
 				rpcGroup.updateChannels((channels) => {
-					const index = channels.indexOf(session.channel);
+					const index = session.channel ? channels.indexOf(session.channel) : -1;
 					if (index >= 0) channels.splice(index, 1);
 				});
 				onDisconnected(session.connection, meta);

package/dist/rpc/transports/ws-bun.d.mts

@@ -1,5 +1,5 @@
-import { n as WsOriginRegistry } from "../../ws-server-VyHlanzy.mjs";
-import { t as ContextRpcServer } from "../../rpc-core-B3W3z9ff.mjs";
+import { n as WsOriginRegistry } from "../../ws-server-D2nv68Hg.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-DsyDViQy.mjs";
 //#region src/rpc/transports/ws-bun.d.ts
 interface AttachBunWsTransportOptions {
   /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */
@@ -7,7 +7,7 @@ interface AttachBunWsTransportOptions {
 }
 /**
  * Structural view of the Bun `Bun.serve({ websocket })` handler object the
- * crossws Bun adapter produces — typed loosely so devframe carries no
+ * crossws Bun adapter produces, typed loosely so devframe carries no
  * dependency on Bun's own types.
  */
 interface BunWsTierWebSocket {
@@ -17,14 +17,14 @@ interface BunWsTierWebSocket {
   drain?: (ws: unknown) => unknown;
 }
 interface BunWsTier {
-  /** Complete a WS upgrade request — `Bun.serve`'s server as 2nd argument. */
+  /** Complete a WS upgrade request; `Bun.serve`'s server as 2nd argument. */
   handleUpgrade: (request: Request, server: unknown) => Promise<Response | undefined>;
   /** The handlers to spread into `Bun.serve({ websocket })`. */
   websocket: BunWsTierWebSocket;
   close: () => Promise<void>;
 }
 /**
- * The Bun fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the
+ * The Bun fetch-upgrade WebSocket tier for `initDevframe` / `initHub`: the
  * same RPC peer wiring as `attachWsRpcTransport`, driven by crossws's Bun
  * adapter so upgrades complete through `handler(request, server)` on the
  * app's own origin, with no side-car server. Load it dynamically so the Bun

package/dist/rpc/transports/ws-bun.mjs

@@ -1,7 +1,8 @@
-import { i as isAllowedOrigin, r as createWsRpcPeerHooks } from "../../ws-server-Y_AumUQH.mjs";
+import { t as isAllowedOrigin } from "../../origin-DZit9g29.mjs";
+import { createWsRpcPeerHooks } from "./ws-server.mjs";
 //#region src/rpc/transports/ws-bun.ts
 /**
-* The Bun fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the
+* The Bun fetch-upgrade WebSocket tier for `initDevframe` / `initHub`: the
 * same RPC peer wiring as `attachWsRpcTransport`, driven by crossws's Bun
 * adapter so upgrades complete through `handler(request, server)` on the
 * app's own origin, with no side-car server. Load it dynamically so the Bun
@@ -15,6 +16,11 @@ async function attachBunWsTransport(core, options = {}) {
 			onConnected: core.onConnected,
 			onDisconnected: core.onDisconnected
 		}),
+		/**
+		* The same origin policy `routeUpgrades` applies for the Node
+		* transport, enforced at the upgrade hook since Bun upgrades arrive
+		* as fetch requests rather than `upgrade` socket events.
+		*/
 		upgrade(request) {
 			const origin = request.headers.get("origin") ?? void 0;
 			const allowed = allowedOrigins && !Array.isArray(allowedOrigins) ? allowedOrigins.isAllowed(origin) : isAllowedOrigin(origin, allowedOrigins || []);

package/dist/rpc/transports/ws-client.d.mts

@@ -1,2 +1,2 @@
-import { n as createWsRpcChannel, t as WsRpcChannelOptions } from "../../ws-client-7_lZi-B9.mjs";
+import { n as createWsRpcChannel, t as WsRpcChannelOptions } from "../../ws-client-Xpxt0oPA.mjs";
 export { WsRpcChannelOptions, createWsRpcChannel };

package/dist/rpc/transports/ws-client.mjs

@@ -1,5 +1,5 @@
 import { DEVFRAME_AUTH_TOKEN_QUERY_PARAM } from "../../constants.mjs";
-import { t as createRpcWireCodec } from "../../wire-codec-0K-o5MYW.mjs";
+import { t as createRpcWireCodec } from "../../wire-codec-BHGt0sSs.mjs";
 //#region src/rpc/transports/ws-client.ts
 function NOOP() {}
 const EMPTY_DEFS = /* @__PURE__ */ new Map();
@@ -7,7 +7,7 @@ const EMPTY_DEFS = /* @__PURE__ */ new Map();
 * Build a birpc `ChannelOptions` object backed by a browser `WebSocket`.
 * Pass the result straight to `createRpcClient`'s `channel` option.
 *
-* Also returns `close()`, closing the underlying socket — mirroring the server transport's
+* Also returns `close()`, closing the underlying socket, mirroring the server transport's
 * existing `WsRpcTransport.close()`. `birpc`'s own `ChannelOptions` has no teardown of its own.
 */
 function createWsRpcChannel(options) {

package/dist/rpc/transports/ws-deno.d.mts

@@ -1,5 +1,5 @@
-import { n as WsOriginRegistry } from "../../ws-server-VyHlanzy.mjs";
-import { t as ContextRpcServer } from "../../rpc-core-B3W3z9ff.mjs";
+import { n as WsOriginRegistry } from "../../ws-server-D2nv68Hg.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-DsyDViQy.mjs";
 //#region src/rpc/transports/ws-deno.d.ts
 interface AttachDenoWsTransportOptions {
   /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */
@@ -7,7 +7,7 @@ interface AttachDenoWsTransportOptions {
 }
 interface DenoWsTier {
   /**
-   * Complete a WS upgrade request — `Deno.serve`'s handler info as the 2nd
+   * Complete a WS upgrade request; `Deno.serve`'s handler info as the 2nd
    * argument. Unlike Bun, Deno's adapter attaches the socket to the returned
    * `Response` itself, so there is no `websocket` handler object to register.
    */
@@ -15,7 +15,7 @@ interface DenoWsTier {
   close: () => Promise<void>;
 }
 /**
- * The Deno fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the
+ * The Deno fetch-upgrade WebSocket tier for `initDevframe` / `initHub`: the
  * same RPC peer wiring as `attachWsRpcTransport`, driven by crossws's Deno
  * adapter so upgrades complete through `handleUpgrade(request, info)` on the
  * app's own origin, with no side-car server. Load it dynamically so the Deno

package/dist/rpc/transports/ws-deno.mjs

@@ -1,7 +1,8 @@
-import { i as isAllowedOrigin, r as createWsRpcPeerHooks } from "../../ws-server-Y_AumUQH.mjs";
+import { t as isAllowedOrigin } from "../../origin-DZit9g29.mjs";
+import { createWsRpcPeerHooks } from "./ws-server.mjs";
 //#region src/rpc/transports/ws-deno.ts
 /**
-* The Deno fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the
+* The Deno fetch-upgrade WebSocket tier for `initDevframe` / `initHub`: the
 * same RPC peer wiring as `attachWsRpcTransport`, driven by crossws's Deno
 * adapter so upgrades complete through `handleUpgrade(request, info)` on the
 * app's own origin, with no side-car server. Load it dynamically so the Deno
@@ -15,6 +16,11 @@ async function attachDenoWsTransport(core, options = {}) {
 			onConnected: core.onConnected,
 			onDisconnected: core.onDisconnected
 		}),
+		/**
+		* The same origin policy `routeUpgrades` applies for the Node
+		* transport, enforced at the upgrade hook since Deno upgrades arrive
+		* as fetch requests rather than `upgrade` socket events.
+		*/
 		upgrade(request) {
 			const origin = request.headers.get("origin") ?? void 0;
 			const allowed = allowedOrigins && !Array.isArray(allowedOrigins) ? allowedOrigins.isAllowed(origin) : isAllowedOrigin(origin, allowedOrigins || []);

package/dist/rpc/transports/ws-server.d.mts

@@ -1,2 +1,3 @@
-import { a as attachWsRpcTransport, c as isAllowedOrigin, d as DevframeRpcConnection, f as DevframeRpcConnectionRequest, i as WsRpcTransportOptions, l as isLoopbackHostname, n as WsOriginRegistry, o as createWsOriginRegistry, p as DevframeRpcTransportKind, r as WsRpcTransport, s as createWsRpcPeerHooks, t as CreateWsOriginRegistryOptions, u as DevframeNodeRpcSessionMeta } from "../../ws-server-VyHlanzy.mjs";
+import { a as attachWsRpcTransport, c as DevframeNodeRpcSessionMeta, d as DevframeRpcTransportKind, i as WsRpcTransportOptions, l as DevframeRpcConnection, n as WsOriginRegistry, o as createWsOriginRegistry, r as WsRpcTransport, s as createWsRpcPeerHooks, t as CreateWsOriginRegistryOptions, u as DevframeRpcConnectionRequest } from "../../ws-server-D2nv68Hg.mjs";
+import { n as isLoopbackHostname, t as isAllowedOrigin } from "../../origin-DGDH8BI9.mjs";
 export { CreateWsOriginRegistryOptions, type DevframeNodeRpcSessionMeta, type DevframeRpcConnection, type DevframeRpcConnectionRequest, type DevframeRpcTransportKind, WsOriginRegistry, WsRpcTransport, WsRpcTransportOptions, attachWsRpcTransport, createWsOriginRegistry, createWsRpcPeerHooks, isAllowedOrigin, isLoopbackHostname };