devframe 0.9.8 → 0.9.10

package/dist/rpc/transports/ws-server.mjs

@@ -1,2 +1,233 @@
-import { a as isLoopbackHostname, i as isAllowedOrigin, n as createWsOriginRegistry, r as createWsRpcPeerHooks, t as attachWsRpcTransport } from "../../ws-server-Y_AumUQH.mjs";
+import "../../constants.mjs";
+import { t as createRpcWireCodec } from "../../wire-codec-BHGt0sSs.mjs";
+import { n as isLoopbackHostname, t as isAllowedOrigin } from "../../origin-DZit9g29.mjs";
+import { t as createRpcSessionMeta } from "../../session-DPfj6zQG.mjs";
+import { n as randomToken, r as timingSafeEqual } from "../../crypto-token-TVbGGFuj.mjs";
+import { createServer } from "node:http";
+import { createServer as createServer$1 } from "node:https";
+import crossws from "crossws/adapters/node";
+//#region src/rpc/transports/ws-server.ts
+/**
+* Create a live, token-protected origin allowlist for external browser
+* viewers. Pass it to {@link WsRpcTransportOptions.allowedOrigins}, then use
+* `registerFromUrl()` in the connection metadata handler to authorize a
+* viewer without sharing a mutable array or disabling DNS-rebinding protection.
+*/
+function createWsOriginRegistry(options = {}) {
+	const token = randomToken();
+	const origins = new Set(options.allowedOrigins ?? []);
+	function normalizeOrigin(origin) {
+		if (!origin) return;
+		try {
+			const url = new URL(origin);
+			const normalized = url.origin === "null" ? `${url.protocol}//${url.host}` : url.origin;
+			return origin === normalized ? normalized : void 0;
+		} catch {}
+	}
+	function registerOrigin(origin, candidateToken) {
+		const normalized = normalizeOrigin(origin);
+		if (!normalized || !candidateToken || !timingSafeEqual(token, candidateToken)) return false;
+		if (options.validateOrigin && !options.validateOrigin(normalized)) return false;
+		origins.add(normalized);
+		return true;
+	}
+	return {
+		token,
+		registerFromUrl(url) {
+			let parsed;
+			try {
+				parsed = new URL(url, "http://localhost");
+			} catch {
+				return;
+			}
+			const origin = parsed.searchParams.get("devframe_viewer_origin") ?? void 0;
+			return registerOrigin(origin, parsed.searchParams.get("devframe_viewer_origin_token") ?? void 0) ? origin : void 0;
+		},
+		isAllowed(origin) {
+			return isAllowedOrigin(origin, [...origins]);
+		}
+	};
+}
+const EMPTY_DEFS = /* @__PURE__ */ new Map();
+function NOOP() {}
+function listen(server, port, host) {
+	return new Promise((resolve, reject) => {
+		const onError = (error) => reject(error);
+		server.once("error", onError);
+		try {
+			server.listen(port, host, () => {
+				server.off("error", onError);
+				resolve();
+			});
+		} catch (error) {
+			server.off("error", onError);
+			reject(error);
+		}
+	});
+}
+/** Compare two URL paths ignoring a trailing slash. */
+function pathMatches(a, b) {
+	const strip = (p) => p.length > 1 && p.endsWith("/") ? p.slice(0, -1) : p;
+	return strip(a) === strip(b);
+}
+function isWsOriginRegistry(value) {
+	return !!value && !Array.isArray(value);
+}
+/**
+* Build the `upgrade` listener that hands a request to the crossws adapter,
+* optionally filtered to a single `path`. Non-matching requests are left
+* untouched so other upgrade listeners (e.g. a Vite dev server's HMR socket)
+* can claim them, unless `destroyUnmatched` is set.
+*/
+function createUpgradeListener(ws, path, destroyUnmatched, allowedOrigins) {
+	return (req, socket, head) => {
+		socket.on("error", () => {});
+		if (path) {
+			let pathname = req.url ?? "/";
+			try {
+				pathname = new URL(req.url ?? "/", "http://localhost").pathname;
+			} catch {}
+			if (!pathMatches(pathname, path)) {
+				if (destroyUnmatched) {
+					socket.write("HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n");
+					socket.destroy();
+				}
+				return;
+			}
+		}
+		const originAllowed = isWsOriginRegistry(allowedOrigins) ? allowedOrigins.isAllowed(req.headers.origin) : isAllowedOrigin(req.headers.origin, allowedOrigins || []);
+		if (allowedOrigins !== false && !originAllowed) {
+			socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+			socket.destroy();
+			return;
+		}
+		ws.handleUpgrade(req, socket, head);
+	};
+}
+/**
+* The per-peer lifecycle hooks driving a devframe RPC WebSocket, shaped for
+* any [crossws](https://crossws.h3.dev) adapter. {@link attachWsRpcTransport}
+* feeds them to the Node adapter; runtime-specific attachments (e.g. Bun's
+* fetch-upgrade adapter) reuse the same hooks so every transport speaks the
+* identical wire protocol: one birpc channel per peer, per-method
+* `jsonSerializable` dispatch between strict JSON and structured-clone.
+*/
+function createWsRpcPeerHooks(rpcGroup, options = {}) {
+	const { onConnected = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS, serialize: serializeOverride, deserialize: deserializeOverride } = options;
+	const states = /* @__PURE__ */ new WeakMap();
+	return {
+		open: (peer) => {
+			const meta = createRpcSessionMeta();
+			meta.peer = peer;
+			const connection = {
+				id: meta.id,
+				transport: "websocket",
+				request: peer.request,
+				send: (data) => peer.send(data),
+				close: (code, reason) => peer.close(code, reason),
+				peer
+			};
+			const codec = createRpcWireCodec(definitions);
+			const state = {
+				meta,
+				connection
+			};
+			const channel = {
+				post: (data) => {
+					peer.send(data);
+				},
+				on: (fn) => {
+					state.onMessage = fn;
+				},
+				serialize: serializeOverride ?? codec.serialize,
+				deserialize: deserializeOverride ?? codec.deserialize,
+				meta
+			};
+			state.channel = channel;
+			states.set(peer, state);
+			rpcGroup.updateChannels((channels) => {
+				channels.push(channel);
+			});
+			onConnected(connection, meta);
+		},
+		message: (peer, message) => {
+			states.get(peer)?.onMessage?.(message.text());
+		},
+		close: (peer) => {
+			const state = states.get(peer);
+			if (!state) return;
+			states.delete(peer);
+			rpcGroup.updateChannels((channels) => {
+				const index = state.channel ? channels.indexOf(state.channel) : -1;
+				if (index >= 0) channels.splice(index, 1);
+			});
+			onDisconnected(state.connection, state.meta);
+		}
+	};
+}
+/**
+* Attach a WebSocket transport to an existing RPC group, powered by
+* [crossws](https://crossws.h3.dev). Either attach to an existing HTTP(S)
+* `server` (sharing its port, optionally scoped to a `path`), or let this
+* helper create a standalone server from `port` / `host` / `https`.
+*
+* Returns the crossws node adapter, standalone-server readiness/address
+* accessors, `detach` (remove the upgrade listener from a shared `server`),
+* and `close` (full deterministic teardown).
+*/
+function attachWsRpcTransport(rpcGroup, options = {}) {
+	const { server, port, host = "localhost", path, destroyUnmatched = false, unbound, https, allowedOrigins } = options;
+	const ws = crossws({ hooks: createWsRpcPeerHooks(rpcGroup, options) });
+	const sharedUpgradeListener = createUpgradeListener(ws, path, destroyUnmatched, allowedOrigins);
+	const ownedUpgradeListener = createUpgradeListener(ws, path, true, allowedOrigins);
+	/** Bind a server's `upgrade` events, tracked so `close()` detaches them. */
+	const attachments = /* @__PURE__ */ new Set();
+	function attachTo(target, listener) {
+		target.on("upgrade", listener);
+		const detachOne = () => {
+			target.off("upgrade", listener);
+			attachments.delete(detachOne);
+		};
+		attachments.add(detachOne);
+		return detachOne;
+	}
+	let ready = Promise.resolve();
+	let ownedServer;
+	if (unbound) {} else if (server) attachTo(server, sharedUpgradeListener);
+	else if (https) {
+		ownedServer = createServer$1(https);
+		attachTo(ownedServer, ownedUpgradeListener);
+		ready = listen(ownedServer, port ?? 0, host);
+	} else {
+		ownedServer = createServer((_req, res) => {
+			res.writeHead(426, { "content-type": "text/plain" });
+			res.end("Upgrade Required");
+		});
+		attachTo(ownedServer, ownedUpgradeListener);
+		ready = listen(ownedServer, port ?? 0, host);
+	}
+	const activeServer = server ?? ownedServer;
+	function detachAll() {
+		for (const detachOne of [...attachments]) detachOne();
+	}
+	return {
+		ws,
+		ready,
+		address: () => activeServer?.address() ?? null,
+		handleUpgrade: sharedUpgradeListener,
+		attach: (target) => attachTo(target, sharedUpgradeListener),
+		detach: detachAll,
+		async close() {
+			detachAll();
+			ws.closeAll(void 0, void 0, true);
+			if (ownedServer) {
+				const srv = ownedServer;
+				await ready.catch(() => {});
+				if (!srv.listening) return;
+				await new Promise((r) => srv.close(() => r()));
+			}
+		}
+	};
+}
+//#endregion
 export { attachWsRpcTransport, createWsOriginRegistry, createWsRpcPeerHooks, isAllowedOrigin, isLoopbackHostname };

package/dist/{rpc-core-DlHd276T.mjs → rpc-core-CvkU23bQ.mjs}

@@ -1,12 +1,12 @@
 import { n as __exportAll } from "./rolldown-runtime-B4iAMlE-.mjs";
 import { createRpcServer } from "./rpc/server.mjs";
-import { t as diagnostics } from "./diagnostics-BXWW3VK-.mjs";
+import { t as diagnostics } from "./diagnostics-DZA6KQ_Z.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/node/rpc-core.ts
 var rpc_core_exports = /* @__PURE__ */ __exportAll({ createContextRpcServer: () => createContextRpcServer });
 /**
 * Bind a devframe context's registered RPC functions to a birpc group,
-* transport-agnostically — the shared core under the instance shell's own
+* transport-agnostically: the shared core under the instance shell's own
 * HTTP+WS binding (Node http + WS) and the Bun fetch-upgrade tier of
 * `createHandler`.
 *
@@ -26,8 +26,20 @@ function createContextRpcServer(options) {
 		for (const fn of authHandler.rpcFunctions) if (!rpcHost.definitions.has(fn.name)) rpcHost.register(fn);
 	}
 	const rpcGroup = createRpcServer(rpcHost.functions, { rpcOptions: {
+		/**
+		* Forwarded as-is so a host with its own structured diagnostics
+		* keeps seeing RPC failures.
+		*/
 		onFunctionError: options.rpcOptions?.onFunctionError,
 		onGeneralError: options.rpcOptions?.onGeneralError,
+		/**
+		* Wrap each RPC handler in an AsyncLocalStorage context so
+		* `ctx.rpc.getCurrentRpcSession()` works inside handlers (used
+		* by streaming subscribe/unsubscribe/cancel and shared-state
+		* sync), and (when an `authorize` gate is configured) reject
+		* the call before it ever reaches the handler. Mirrors
+		* `packages/core/src/node/ws.ts`'s resolver.
+		*/
 		resolver(name, fn) {
 			const rpc = this;
 			if (!fn) return void 0;

package/dist/{rpc-core-B3W3z9ff.d.mts → rpc-core-DsyDViQy.d.mts}

@@ -1,6 +1,6 @@
-import { d as DevframeRpcConnection, u as DevframeNodeRpcSessionMeta } from "./ws-server-VyHlanzy.mjs";
-import { Ct as DevframeAuthHandler, _t as DevframeRpcServerFunctions, gt as DevframeRpcClientFunctions, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "./context-CLF4-8Pp.mjs";
-import "./index-D3k0BIhe.mjs";
+import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection } from "./ws-server-D2nv68Hg.mjs";
+import { Tt as DevframeAuthHandler, o as DevframeNodeContext, s as DevframeNodeRpcSession, vt as DevframeRpcClientFunctions, yt as DevframeRpcServerFunctions } from "./context-CHW4BZOj.mjs";
+import "./index-CNC390b_.mjs";
 import { BirpcGroup, EventOptions } from "birpc";
 //#region src/node/rpc-core.d.ts
 interface CreateContextRpcServerOptions {
@@ -33,7 +33,7 @@ interface ContextRpcServer {
 }
 /**
  * Bind a devframe context's registered RPC functions to a birpc group,
- * transport-agnostically — the shared core under the instance shell's own
+ * transport-agnostically: the shared core under the instance shell's own
  * HTTP+WS binding (Node http + WS) and the Bun fetch-upgrade tier of
  * `createHandler`.
  *

package/dist/serialization-DFg5sUt6.mjs

@@ -0,0 +1,116 @@
+import { i as defineDiagnostics } from "./nostics-D0PvLZsn.mjs";
+//#region src/rpc/diagnostics.ts
+const diagnostics = defineDiagnostics({
+	docsBase: "https://devfra.me/errors",
+	codes: {
+		DF0019: {
+			why: (p) => `RPC function "${p.name}" has \`agent\` set but \`jsonSerializable\` is not \`true\`; MCP requires JSON-serializable data.`,
+			fix: "Set `jsonSerializable: true` if the payload is JSON-safe, or remove `agent` to keep it RPC-only."
+		},
+		DF0020: {
+			why: (p) => `RPC function "${p.name}" declares \`jsonSerializable: true\` but the value at "${p.path}" is a ${p.type}.`,
+			fix: "Either drop `jsonSerializable: true` (falls back to structured-clone) or change the value to a JSON-safe shape."
+		},
+		DF0021: {
+			why: (p) => `RPC function "${p.name}" is already registered`,
+			fix: "Use the `force` parameter to overwrite an existing registration."
+		},
+		DF0022: { why: (p) => `RPC function "${p.name}" is not registered. Use register() to add new functions.` },
+		DF0023: { why: (p) => `RPC function "${p.name}" is not registered` },
+		DF0024: { why: (p) => `Either handler or setup function must be provided for RPC function "${p.name}"` },
+		DF0025: { why: (p) => `Function "${p.name}" not found in dump store` },
+		DF0026: { why: (p) => `No dump match for "${p.name}" with args: ${p.args}` },
+		DF0027: { why: (p) => `Function "${p.name}" with type "${p.type}" cannot have dump configuration. Only "static" and "query" types support dumps.` },
+		DF0028: {
+			why: (p) => `Function "${p.name}" with type "${p.type}" cannot use \`snapshot: true\`. Only "query" functions support this sugar; "static" functions have equivalent default behavior already.`,
+			fix: "Remove `snapshot: true`, or change the function type to `query`."
+		},
+		DF0043: {
+			why: (p) => `RPC function "${p.name}" received an invalid argument at position ${p.index}: ${p.issues}`,
+			fix: "Pass a value that satisfies the `args` schema declared for this function."
+		},
+		DF0044: {
+			why: (p) => `RPC function "${p.name}" returned a value that failed its \`returns\` schema: ${p.issues}`,
+			fix: "Make the handler return a value that satisfies the `returns` schema, or relax the schema."
+		}
+	}
+});
+//#endregion
+//#region src/rpc/serialization.ts
+/**
+* Wire format used by the live RPC transports (WebSocket and SSE).
+*
+* - **JSON (default, unprefixed):** payload is plain JSON text. Used when
+*   the dispatched method is declared `jsonSerializable: true`. Encoded
+*   via {@link strictJsonStringify} (rejects non-JSON values), decoded
+*   via `JSON.parse`.
+* - **Structured-clone (`s:` prefix):** payload is `s:` followed by
+*   `structured-clone-es` text. Used when the method is declared
+*   `jsonSerializable: false` (or omitted, the default). Round-trips
+*   `Map`, `Set`, `Date`, `BigInt`, cycles, and class instances.
+*
+* birpc envelopes always start with `{`, so a leading byte that is not
+* `s` is unambiguously JSON. Each direction independently chooses its
+* encoding from local definitions; request and response are not
+* coupled by a mirror rule.
+*/
+const STRUCTURED_CLONE_PREFIX = "s:";
+/**
+* `JSON.stringify` with a single-pass strict replacer.
+*
+* Throws `DF0020` synchronously when the value contains a type JSON
+* cannot round-trip losslessly: `Map`, `Set`, `Date`, `BigInt`, class
+* instances, or `undefined` inside an array (silently becomes `null`).
+*
+* Native pass-throughs (no extra work needed):
+*   - circular references: `JSON.stringify` raises `TypeError`.
+*   - `BigInt` at top level: caught here for a friendlier error path.
+*
+* Lenient cases (allowed without throwing):
+*   - `undefined` as an object property: legitimate optional field;
+*     JSON.stringify just omits it.
+*   - `undefined` at the root: legitimate "action returned nothing".
+*   - `Symbol` / `Function` values: semantically "drop me" in JSON.
+*
+* `fnName` is used only for the diagnostic message; pass the RPC
+* function name when calling from a wire serializer / dump writer so
+* the error points at the offending function.
+*/
+function strictJsonStringify(value, fnName = "") {
+	return JSON.stringify(value, function strictReplacer(key, val) {
+		const holder = this;
+		const original = holder != null ? holder[key] : val;
+		if (original === void 0) {
+			if (Array.isArray(holder)) throw nonJsonAt(fnName, "undefined", holder, key);
+			return val;
+		}
+		if (original !== null) assertJsonSafe(original, holder, key, fnName);
+		return val;
+	});
+}
+/** Throw `DF0020` when `original` is a type JSON can't round-trip losslessly. */
+function assertJsonSafe(original, holder, key, fnName) {
+	if (typeof original === "bigint") throw nonJsonAt(fnName, "BigInt", holder, key);
+	if (typeof original !== "object") return;
+	if (original instanceof Map) throw nonJsonAt(fnName, "Map", holder, key);
+	if (original instanceof Set) throw nonJsonAt(fnName, "Set", holder, key);
+	if (original instanceof Date) throw nonJsonAt(fnName, "Date", holder, key);
+	if (Array.isArray(original)) return;
+	const proto = Object.getPrototypeOf(original);
+	if (proto !== null && proto !== Object.prototype) throw nonJsonAt(fnName, original.constructor?.name ?? "class instance", holder, key);
+}
+function nonJsonAt(fnName, type, parent, key) {
+	const path = formatPath(parent, key);
+	return diagnostics.DF0020({
+		name: fnName || "<anonymous>",
+		type,
+		path
+	});
+}
+function formatPath(parent, key) {
+	if (Array.isArray(parent)) return `[${key}]`;
+	if (key === "") return "<root>";
+	return key;
+}
+//#endregion
+export { strictJsonStringify as n, diagnostics as r, STRUCTURED_CLONE_PREFIX as t };

package/dist/services-install-Ben4yh52.mjs

@@ -0,0 +1,154 @@
+import { createRequire } from "node:module";
+import { isAbsolute, join } from "pathe";
+import { pathToFileURL } from "node:url";
+//#region src/node/services-install.ts
+/**
+* Turn a `resolveFrom` value (a file path, a file URL like `import.meta.url`,
+* or a directory) into something `createRequire` accepts; a directory gets a
+* synthetic filename appended so resolution starts inside it.
+*/
+function toRequireBase(resolveFrom) {
+	if (resolveFrom.startsWith("file://")) return resolveFrom;
+	if ((resolveFrom.split(/[/\\]/).pop() ?? "").includes(".")) return resolveFrom;
+	return join(resolveFrom, "_devframe_resolve.js");
+}
+/**
+* Normalize an `install()` `resolveFrom` into a resolution base. Paths and
+* file URLs pass through (the common case: the declaring plugin's
+* `importMetaUrl`, so a service it declares resolves against the plugin's own
+* dependencies); a bare npm package name resolves to that package's location
+* from `cwd`. An unresolvable package name reads as no base (the caller's
+* workspace fallbacks apply).
+*/
+function expandResolveFrom(resolveFrom, cwd) {
+	if (resolveFrom.startsWith("file://") || resolveFrom.startsWith(".") || isAbsolute(resolveFrom)) return resolveFrom;
+	const require = createRequire(join(cwd, "_devframe_resolve.js"));
+	try {
+		return require.resolve(`${resolveFrom}/package.json`);
+	} catch {}
+	try {
+		return require.resolve(resolveFrom);
+	} catch {}
+}
+/**
+* Import a service package's module, trying each `resolveFrom` candidate in
+* order (so a plugin-declared service resolves against the plugin's own
+* dependency tree first, then the workspace fallback). Throws the last
+* resolution error when no candidate succeeds.
+*/
+async function importServicePackage(pkg, resolveFroms) {
+	const candidates = [...new Set(resolveFroms.filter((x) => typeof x === "string" && x.length > 0))];
+	let lastError = /* @__PURE__ */ new Error(`no resolution base available for "${pkg}"`);
+	for (const from of candidates) {
+		let resolved;
+		try {
+			resolved = createRequire(toRequireBase(from)).resolve(pkg);
+		} catch (error) {
+			lastError = error;
+			continue;
+		}
+		return await import(
+			/* webpackIgnore: true */
+			/* @vite-ignore */
+			/* turbopackIgnore: true */
+			pathToFileURL(resolved).href
+);
+	}
+	throw lastError;
+}
+function parseVersion(input) {
+	const [core, ...prerelease] = input.trim().replace(/^v/, "").split("-");
+	if (!core) return void 0;
+	const parts = core.split(".").map((part) => Number.parseInt(part, 10));
+	if (parts.length === 0 || parts.some((part) => Number.isNaN(part) || part < 0)) return void 0;
+	while (parts.length < 3) parts.push(0);
+	return {
+		parts,
+		...prerelease.length ? { prerelease: prerelease.join("-") } : {}
+	};
+}
+function compareVersions(a, b) {
+	for (let i = 0; i < 3; i++) {
+		const diff = (a.parts[i] ?? 0) - (b.parts[i] ?? 0);
+		if (diff !== 0) return diff;
+	}
+	if (a.prerelease && !b.prerelease) return -1;
+	if (!a.prerelease && b.prerelease) return 1;
+	if (a.prerelease && b.prerelease) return a.prerelease < b.prerelease ? -1 : a.prerelease > b.prerelease ? 1 : 0;
+	return 0;
+}
+/** Whether `version` and `base` share their first `lockUpTo + 1` parts. */
+function partsMatchUpTo(version, base, lockUpTo) {
+	for (let i = 0; i <= lockUpTo; i++) if ((version.parts[i] ?? 0) !== (base.parts[i] ?? 0)) return false;
+	return true;
+}
+function satisfiesCaret(version, base) {
+	if (compareVersions(version, base) < 0) return false;
+	const fixedIndex = base.parts.findIndex((part) => part !== 0);
+	return partsMatchUpTo(version, base, fixedIndex === -1 ? base.parts.length - 1 : fixedIndex);
+}
+function satisfiesTilde(version, base, segments) {
+	if (compareVersions(version, base) < 0) return false;
+	return partsMatchUpTo(version, base, segments.length >= 2 ? 1 : 0);
+}
+function satisfiesExactOrPrefix(version, base, segments) {
+	for (let i = 0; i < Math.max(segments.length, 3); i++) if (i < segments.length && (version.parts[i] ?? 0) !== (base.parts[i] ?? 0)) return false;
+	return segments.length >= 3 ? compareVersions(version, base) === 0 : true;
+}
+function satisfiesComparator(version, comparator) {
+	const raw = comparator.trim();
+	if (!raw || raw === "*" || raw === "x") return true;
+	const operatorMatch = raw.match(/^([\^~]|>=|<=|[><=])?(.+)$/);
+	if (!operatorMatch) return false;
+	const operator = operatorMatch[1];
+	const rest = operatorMatch[2].trim();
+	const segments = rest.replace(/\.[x*]/gi, "").split(".").filter(Boolean);
+	const base = parseVersion(rest.replace(/[x*]/gi, "0"));
+	if (!base) return false;
+	switch (operator) {
+		case ">": return compareVersions(version, base) > 0;
+		case ">=": return compareVersions(version, base) >= 0;
+		case "<": return compareVersions(version, base) < 0;
+		case "<=": return compareVersions(version, base) <= 0;
+		case "^": return satisfiesCaret(version, base);
+		case "~": return satisfiesTilde(version, base, segments);
+		default: return satisfiesExactOrPrefix(version, base, segments);
+	}
+}
+/**
+* Pragmatic semver range check for service version declarations; supports
+* the common forms (`1.2.3`, `^1.2.3`, `~1.2`, `>=1 <3`, `1.x`, `*`, and
+* `||`-joined alternatives) without pulling in a semver dependency. An
+* unparseable version or range reads as **not satisfied**.
+*/
+function satisfiesVersionRange(version, range) {
+	const parsed = parseVersion(version);
+	if (!parsed) return false;
+	const alternatives = range.split("||").map((alt) => alt.trim()).filter(Boolean);
+	if (alternatives.length === 0) return true;
+	return alternatives.some((alternative) => alternative.split(/\s+/).every((comparator) => satisfiesComparator(parsed, comparator)));
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Deep-merge two values with the service option-set rules (see below). */
+function deepMergeTwo(a, b) {
+	if (Array.isArray(a) && Array.isArray(b)) return [.../* @__PURE__ */ new Set([...a, ...b])];
+	if (isPlainObject(a) && isPlainObject(b)) {
+		const out = { ...a };
+		for (const key of Object.keys(b)) out[key] = key in a ? deepMergeTwo(a[key], b[key]) : b[key];
+		return out;
+	}
+	return b;
+}
+/**
+* Default option-set merge when a service declares no `mergeOptions`:
+* deep-merge in declaration order: objects recurse, arrays union-dedupe,
+* scalars take the later value. Covers the built-in services (`roots` /
+* `langs` union, `themes` per-key last-wins) without a custom hook.
+*/
+function deepMergeOptionSets(sets) {
+	return sets.reduce((merged, set) => deepMergeTwo(merged, set));
+}
+//#endregion
+export { satisfiesVersionRange as i, expandResolveFrom as n, importServicePackage as r, deepMergeOptionSets as t };

package/dist/session-DPfj6zQG.mjs

@@ -0,0 +1,16 @@
+//#region src/rpc/transports/session.ts
+let sessionId = 0;
+/**
+* Mint the per-connection session meta every transport binding shares:
+* one id space across transports, so session bookkeeping (streaming
+* subscriptions, shared-state sync, auth trust) never collides between a
+* WS peer and an SSE session on the same server.
+*/
+function createRpcSessionMeta() {
+	return {
+		id: sessionId++,
+		subscribedStates: /* @__PURE__ */ new Set()
+	};
+}
+//#endregion
+export { createRpcSessionMeta as t };

package/dist/{shared-state--sduc6Xi.mjs → shared-state-CaxB1q0h.mjs}

@@ -931,8 +931,8 @@ function createSharedState(options) {
 			if (syncIds.has(syncId)) return;
 			rememberSyncId(syncIds, syncId);
 			if (enablePatches$1) {
-				const [newState, patches] = produceWithPatches(state, fn);
-				state = newState;
+				const [nextState, patches] = produceWithPatches(state, fn);
+				state = nextState;
 				events.emit("updated", state, patches, syncId);
 			} else {
 				state = produce(state, fn);

package/dist/{simple-schema-DQPZrAaZ.mjs → simple-schema-Bi40l-P6.mjs}

@@ -37,7 +37,7 @@ function number() {
 function boolean() {
 	return make("boolean", (v) => typeof v === "boolean" ? ok(v) : fail("Expected a boolean"));
 }
-/** `undefined` — mirrors valibot's `void`. */
+/** `undefined`, mirroring valibot's `void`. */
 function voidType() {
 	return make("void", (v) => v === void 0 ? ok(void 0) : fail("Expected undefined"));
 }
@@ -130,7 +130,7 @@ function describe(schema, description) {
 	};
 }
 /**
-* Grouped access to every builder — `s.string()`, `s.object({ ... })`,
+* Grouped access to every builder: `s.string()`, `s.object({ ... })`,
 * `s.void()`, etc. Handy for a valibot-like `import { s } from
 * 'devframe/utils/simple-schema'` call site.
 */

package/dist/{sse-client-DwX021ST.d.mts → sse-client-BQ4jS3eO.d.mts}

@@ -1,4 +1,4 @@
-import { v as RpcFunctionDefinitionAny } from "./types-CMdPYhOx.mjs";
+import { v as RpcFunctionDefinitionAny } from "./types-Dq4i156u.mjs";
 import { ChannelOptions } from "birpc";
 //#region src/rpc/transports/sse-client.d.ts
 interface SseRpcChannelOptions {
@@ -10,7 +10,7 @@ interface SseRpcChannelOptions {
   authToken?: string;
   /**
    * RPC function definitions (or just the `jsonSerializable` flag per
-   * method) used to dispatch the per-call wire serializer — same contract
+   * method) used to dispatch the per-call wire serializer, the same contract
    * as the WS channel.
    */
   definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>;
@@ -19,7 +19,7 @@ interface SseRpcChannelOptions {
 }
 /**
  * Build a birpc `ChannelOptions` object backed by an SSE stream (server →
- * client) and HTTP `POST` (client → server) — the WebSocket-free counterpart
+ * client) and HTTP `POST` (client → server): the WebSocket-free counterpart
  * to `createWsRpcChannel`, wire-compatible with `attachSseRpcTransport`.
  *
  * The stream is consumed via `fetch` streaming (not `EventSource`), so it
@@ -27,7 +27,7 @@ interface SseRpcChannelOptions {
  * (`event: session`) carries the session id; every `POST` echoes it in the
  * `x-birpc-session` header. A response to a client-initiated request comes
  * back in the `POST`'s own body and is re-injected into the channel; a
- * dropped stream terminates the channel — there is no reconnect, matching
+ * dropped stream terminates the channel; there is no reconnect, matching
  * the WS channel's closed-is-done semantics.
  */
 declare function createSseRpcChannel(options: SseRpcChannelOptions): ChannelOptions & {