devframe 0.9.8 → 0.9.10

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devframe",
   "type": "module",
-  "version": "0.9.8",
+  "version": "0.9.10",
   "description": "Framework for building one portable devtool integration that runs in any viewer.",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",
@@ -56,6 +56,7 @@
     "./utils/nanoid": "./dist/utils/nanoid.mjs",
     "./utils/nostics": "./dist/utils/nostics.mjs",
     "./utils/open": "./dist/utils/open.mjs",
+    "./utils/origin": "./dist/utils/origin.mjs",
     "./utils/remote-assets": "./dist/utils/remote-assets.mjs",
     "./utils/simple-schema": "./dist/utils/simple-schema.mjs",
     "./utils/serve-static": "./dist/utils/serve-static.mjs",
@@ -76,21 +77,18 @@
   ],
   "peerDependencies": {
     "@modelcontextprotocol/client": "^2.0.0",
-    "@modelcontextprotocol/server": "^2.0.0",
     "cac": "^7.0.0"
   },
   "peerDependenciesMeta": {
     "@modelcontextprotocol/client": {
       "optional": true
     },
-    "@modelcontextprotocol/server": {
-      "optional": true
-    },
     "cac": {
       "optional": true
     }
   },
   "dependencies": {
+    "@modelcontextprotocol/server": "^2.0.0",
     "@standard-schema/spec": "^1.1.0",
     "birpc": "^4.2.0",
     "crossws": "^0.4.12",
@@ -102,7 +100,6 @@
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "^2.0.0",
-    "@modelcontextprotocol/server": "^2.0.0",
     "cac": "^7.0.0",
     "get-port-please": "^3.2.0",
     "immer": "^11.1.18",

package/skills/devframe/SKILL.md

@@ -405,7 +405,9 @@ defineRpcFunction({
 })
 ```
 
-Or register tools / resources directly on `ctx.agent.registerTool({ id, description, safety, handler })` and `ctx.agent.registerResource({ id, name, mimeType, read })`. Expose the API over MCP:
+Or register tools / resources directly on `ctx.agent.registerTool({ id, description, safety, handler })` and `ctx.agent.registerResource({ id, name, mimeType, read })`.
+
+The dev server serves this surface over HTTP automatically: the `mcp: 'auto'` default mounts the Streamable-HTTP route at `<base>__mcp` once the agent surface is non-empty (`mcp: true` forces on, `mcp: false` off). For stdio:
 
 ```ts
 import { createMcpServer } from 'devframe/adapters/mcp'
@@ -413,7 +415,7 @@ import { createMcpServer } from 'devframe/adapters/mcp'
 await createMcpServer(myDevframe, { transport: 'stdio' })
 ```
 
-`@modelcontextprotocol/server` is a peer dependency. The CLI adapter also exposes `my-tool mcp` (route node-side logs to stderr - stdout is the transport). Safety classifications (`'read' | 'action' | 'destructive'`) drive MCP hint annotations that coding agents use to prompt for confirmation. In a hub, `ctx.commands` entries opt into the same agent-facing API with an `agent` field and reach MCP through the aggregate endpoint.
+The CLI adapter also exposes `my-tool mcp` (route node-side logs to stderr - stdout is the transport). Safety classifications (`'read' | 'action' | 'destructive'`) drive MCP hint annotations that coding agents use to prompt for confirmation. In a hub, `ctx.commands` entries opt into the same agent-facing API with an `agent` field and reach MCP through the aggregate endpoint.
 
 ## Author SPA
 
@@ -508,7 +510,7 @@ Plus broadcasts (`devframe:docks:activate`, `devframe:terminals:updated`, `devfr
 
 The hub is headless; `DevframeHubUi` is pure data (`viewer` / `embedded` / `assets` / `setup`). `@devframes/hub-ui`'s `createUi()` is the reference hub UI provider - a standalone devtools page plus a floating dock injected via one `<script type="module" src="/__devframes/embedded.js">` tag. It takes `branding`, `dockPreferences`, and `embeddedVisibility` (`'normal'` / `'passive'` / `'hidden'`). Another hub UI provider supplies a different object to the same slot and reuses all the infrastructure. Renderer modules for opt-in dock types compose at the hub via `initHub({ renderers })`.
 
-Two copyable reference hubs mount every built-in devframe behind an icon dock rail - the shape Vite DevTools wears, shrunk to the smallest thing you can build your own hub UI provider from: [`examples/hub-vite/`](https://github.com/devframes/devframe/tree/main/examples/hub-vite) (~120-line Vite host, vanilla DOM UI) and [`examples/hub-next/`](https://github.com/devframes/devframe/tree/main/examples/hub-next) (Next.js App Router). The `hub-*-minimal` family shows the default `createUi()` mount across Vite, Next, Nitro, Hono, Fastify, SvelteKit, Deno, and Rsbuild.
+Two copyable reference hubs mount every built-in devframe behind an icon dock rail - the shape Vite DevTools wears, shrunk to the smallest thing you can build your own hub UI provider from: [`examples/custom-hub-vite/`](https://github.com/devframes/devframe/tree/main/examples/custom-hub-vite) (~120-line Vite host, vanilla DOM UI) and [`examples/custom-hub-next/`](https://github.com/devframes/devframe/tree/main/examples/custom-hub-next) (Next.js App Router). The `hub-*` family (`hub-vite`, `hub-next`, `hub-deno`, `hub-fastify`, `hub-hono`, `hub-nitro`, `hub-rsbuild`, `hub-sveltekit`) shows the default `createUi()` mount across Vite, Next, Nitro, Hono, Fastify, SvelteKit, Deno, and Rsbuild.
 
 ## Framework kits: two scopes
 

package/dist/_shared-BM3PdYli.mjs

@@ -1,68 +0,0 @@
-import "./constants.mjs";
-import { n as getPort } from "./dist-CZXfGEkd.mjs";
-import { cleanDoubleSlashes, withLeadingSlash, withTrailingSlash, withoutLeadingSlash } from "ufo";
-//#region src/adapters/_shared.ts
-const DEFAULT_PORT = 9999;
-/**
-* Resolve the mount base path for a devframe's SPA. Hosted adapters
-* (`vite`, `embedded`) default to `/__<id>/` so they don't collide
-* with the host app; standalone adapters (`cli`, `build`)
-* default to `/` because they own the origin.
-*
-* The devframe author can override with `basePath` on the definition.
-*/
-function resolveBasePath(def, kind) {
-	if (def.basePath) return normalizeBasePath(def.basePath);
-	return kind === "standalone" ? "/" : `/__${def.id}/`;
-}
-function normalizeBasePath(base) {
-	return cleanDoubleSlashes(withTrailingSlash(withLeadingSlash(base)));
-}
-/**
-* Resolve the listening port for `createDevServer` (and `createHandler`'s
-* side-car tiers), honoring the definition's `cli.port` / `cli.portRange` /
-* `cli.random` settings. Exposed separately so authors who run their own
-* argv parsing can resolve a port up-front (to print it, log it, etc.)
-* before starting the server.
-*/
-async function resolveDevServerPort(def, options = {}) {
-	const host = options.host ?? def.cli?.host ?? "localhost";
-	const portOptions = {
-		port: options.defaultPort ?? def.cli?.port ?? DEFAULT_PORT,
-		host
-	};
-	if (def.cli?.portRange) portOptions.portRange = def.cli.portRange;
-	if (def.cli?.random) portOptions.random = def.cli.random;
-	return getPort(portOptions);
-}
-/**
-* Normalize the `cli.mcp` / `mcp` option (`boolean | McpRouteOptions`) into
-* concrete options, or `undefined` when the MCP route is disabled.
-*/
-function resolveMcpConfig(mcp) {
-	if (!mcp) return void 0;
-	return mcp === true ? {} : mcp;
-}
-/**
-* Resolve the `mcp` entry a `__connection.json` should advertise for a dev
-* server started with the given `mcp` option (falling back to `def.cli?.mcp`,
-* exactly like `createDevServer`), or `undefined` when the route is
-* disabled.
-*
-* Hosted bridges that hand-roll their connection meta pass the side-car
-* `port`: the advertised path becomes absolute (the side-car mounts at `/`)
-* and the client dials `<page-host>:<port><path>`. Without `port` the path
-* stays relative, resolved against `__connection.json`'s own location (the
-* same-server default).
-*/
-function resolveMcpConnectionMeta(def, mcp, port) {
-	const config = resolveMcpConfig(mcp ?? def.cli?.mcp);
-	if (!config) return void 0;
-	const route = withoutLeadingSlash(config.path ?? "__mcp");
-	return port != null ? {
-		path: withLeadingSlash(route),
-		port
-	} : { path: route };
-}
-//#endregion
-export { resolveMcpConnectionMeta as i, resolveBasePath as n, resolveDevServerPort as r, normalizeBasePath as t };

package/dist/_shared-mtXpcJIv.d.mts

@@ -1,41 +0,0 @@
-import { F as DevframeDefinition, G as McpRouteOptions, I as DevframeDeploymentKind, t as ConnectionMeta } from "./context-CLF4-8Pp.mjs";
-//#region src/adapters/_shared.d.ts
-/**
- * Resolve the mount base path for a devframe's SPA. Hosted adapters
- * (`vite`, `embedded`) default to `/__<id>/` so they don't collide
- * with the host app; standalone adapters (`cli`, `build`)
- * default to `/` because they own the origin.
- *
- * The devframe author can override with `basePath` on the definition.
- */
-declare function resolveBasePath(def: DevframeDefinition, kind: DevframeDeploymentKind): string;
-declare function normalizeBasePath(base: string): string;
-interface ResolveDevServerPortOptions {
-  /** Bind host (passed to `get-port-please` for in-use detection). */
-  host?: string;
-  /** Override the preferred port. Default: `def.cli?.port ?? 9999`. */
-  defaultPort?: number;
-}
-/**
- * Resolve the listening port for `createDevServer` (and `createHandler`'s
- * side-car tiers), honoring the definition's `cli.port` / `cli.portRange` /
- * `cli.random` settings. Exposed separately so authors who run their own
- * argv parsing can resolve a port up-front (to print it, log it, etc.)
- * before starting the server.
- */
-declare function resolveDevServerPort(def: DevframeDefinition, options?: ResolveDevServerPortOptions): Promise<number>;
-/**
- * Resolve the `mcp` entry a `__connection.json` should advertise for a dev
- * server started with the given `mcp` option (falling back to `def.cli?.mcp`,
- * exactly like `createDevServer`), or `undefined` when the route is
- * disabled.
- *
- * Hosted bridges that hand-roll their connection meta pass the side-car
- * `port`: the advertised path becomes absolute (the side-car mounts at `/`)
- * and the client dials `<page-host>:<port><path>`. Without `port` the path
- * stays relative, resolved against `__connection.json`'s own location (the
- * same-server default).
- */
-declare function resolveMcpConnectionMeta(def: DevframeDefinition, mcp: boolean | McpRouteOptions | undefined, port?: number): ConnectionMeta['mcp'];
-//#endregion
-export { resolveMcpConnectionMeta as a, resolveDevServerPort as i, normalizeBasePath as n, resolveBasePath as r, ResolveDevServerPortOptions as t };

package/dist/diagnostics-CD8nlgll.mjs

@@ -1,39 +0,0 @@
-import { i as defineDiagnostics } from "./nostics-CzECRXpE.mjs";
-//#region src/rpc/diagnostics.ts
-const diagnostics = defineDiagnostics({
-	docsBase: "https://devfra.me/errors",
-	codes: {
-		DF0019: {
-			why: (p) => `RPC function "${p.name}" has \`agent\` set but \`jsonSerializable\` is not \`true\` — MCP requires JSON-serializable data.`,
-			fix: "Set `jsonSerializable: true` if the payload is JSON-safe, or remove `agent` to keep it RPC-only."
-		},
-		DF0020: {
-			why: (p) => `RPC function "${p.name}" declares \`jsonSerializable: true\` but the value at "${p.path}" is a ${p.type}.`,
-			fix: "Either drop `jsonSerializable: true` (falls back to structured-clone) or change the value to a JSON-safe shape."
-		},
-		DF0021: {
-			why: (p) => `RPC function "${p.name}" is already registered`,
-			fix: "Use the `force` parameter to overwrite an existing registration."
-		},
-		DF0022: { why: (p) => `RPC function "${p.name}" is not registered. Use register() to add new functions.` },
-		DF0023: { why: (p) => `RPC function "${p.name}" is not registered` },
-		DF0024: { why: (p) => `Either handler or setup function must be provided for RPC function "${p.name}"` },
-		DF0025: { why: (p) => `Function "${p.name}" not found in dump store` },
-		DF0026: { why: (p) => `No dump match for "${p.name}" with args: ${p.args}` },
-		DF0027: { why: (p) => `Function "${p.name}" with type "${p.type}" cannot have dump configuration. Only "static" and "query" types support dumps.` },
-		DF0028: {
-			why: (p) => `Function "${p.name}" with type "${p.type}" cannot use \`snapshot: true\`. Only "query" functions support this sugar; "static" functions have equivalent default behavior already.`,
-			fix: "Remove `snapshot: true`, or change the function type to `query`."
-		},
-		DF0043: {
-			why: (p) => `RPC function "${p.name}" received an invalid argument at position ${p.index}: ${p.issues}`,
-			fix: "Pass a value that satisfies the `args` schema declared for this function."
-		},
-		DF0044: {
-			why: (p) => `RPC function "${p.name}" returned a value that failed its \`returns\` schema: ${p.issues}`,
-			fix: "Make the handler return a value that satisfies the `returns` schema, or relax the schema."
-		}
-	}
-});
-//#endregion
-export { diagnostics as t };

package/dist/serialization-BGzEwAdr.mjs

@@ -1,77 +0,0 @@
-import { t as diagnostics } from "./diagnostics-CD8nlgll.mjs";
-//#region src/rpc/serialization.ts
-/**
-* Wire format used by the live RPC transports (WebSocket and SSE).
-*
-* - **JSON (default, unprefixed):** payload is plain JSON text. Used when
-*   the dispatched method is declared `jsonSerializable: true`. Encoded
-*   via {@link strictJsonStringify} (rejects non-JSON values), decoded
-*   via `JSON.parse`.
-* - **Structured-clone (`s:` prefix):** payload is `s:` followed by
-*   `structured-clone-es` text. Used when the method is declared
-*   `jsonSerializable: false` (or omitted, the default). Round-trips
-*   `Map`, `Set`, `Date`, `BigInt`, cycles, and class instances.
-*
-* birpc envelopes always start with `{`, so a leading byte that is not
-* `s` is unambiguously JSON. Each direction independently chooses its
-* encoding from local definitions — request and response are not
-* coupled by a mirror rule.
-*/
-const STRUCTURED_CLONE_PREFIX = "s:";
-/**
-* `JSON.stringify` with a single-pass strict replacer.
-*
-* Throws `DF0020` synchronously when the value contains a type JSON
-* cannot round-trip losslessly: `Map`, `Set`, `Date`, `BigInt`, class
-* instances, or `undefined` inside an array (silently becomes `null`).
-*
-* Native pass-throughs (no extra work needed):
-*   - circular references — `JSON.stringify` raises `TypeError`.
-*   - `BigInt` at top level — caught here for a friendlier error path.
-*
-* Lenient cases (allowed without throwing):
-*   - `undefined` as an object property — legitimate optional field;
-*     JSON.stringify just omits it.
-*   - `undefined` at the root — legitimate "action returned nothing".
-*   - `Symbol` / `Function` values — semantically "drop me" in JSON.
-*
-* `fnName` is used only for the diagnostic message — pass the RPC
-* function name when calling from a wire serializer / dump writer so
-* the error points at the offending function.
-*/
-function strictJsonStringify(value, fnName = "") {
-	return JSON.stringify(value, function strictReplacer(key, val) {
-		const holder = this;
-		const original = holder != null ? holder[key] : val;
-		if (original === void 0) {
-			if (Array.isArray(holder)) throw nonJsonAt(fnName, "undefined", holder, key);
-			return val;
-		}
-		if (original === null) return val;
-		if (typeof original === "bigint") throw nonJsonAt(fnName, "BigInt", holder, key);
-		if (typeof original === "object") {
-			if (original instanceof Map) throw nonJsonAt(fnName, "Map", holder, key);
-			if (original instanceof Set) throw nonJsonAt(fnName, "Set", holder, key);
-			if (original instanceof Date) throw nonJsonAt(fnName, "Date", holder, key);
-			if (Array.isArray(original)) return val;
-			const proto = Object.getPrototypeOf(original);
-			if (proto !== null && proto !== Object.prototype) throw nonJsonAt(fnName, original.constructor?.name ?? "class instance", holder, key);
-		}
-		return val;
-	});
-}
-function nonJsonAt(fnName, type, parent, key) {
-	const path = formatPath(parent, key);
-	return diagnostics.DF0020({
-		name: fnName || "<anonymous>",
-		type,
-		path
-	});
-}
-function formatPath(parent, key) {
-	if (Array.isArray(parent)) return `[${key}]`;
-	if (key === "") return "<root>";
-	return key;
-}
-//#endregion
-export { strictJsonStringify as n, STRUCTURED_CLONE_PREFIX as t };

package/dist/ws-server-Y_AumUQH.mjs

@@ -1,294 +0,0 @@
-import "./constants.mjs";
-import { t as createRpcWireCodec } from "./wire-codec-0K-o5MYW.mjs";
-import { n as randomToken, r as timingSafeEqual } from "./crypto-token-XCqTSMg9.mjs";
-import { createServer } from "node:http";
-import { createServer as createServer$1 } from "node:https";
-import crossws from "crossws/adapters/node";
-//#region src/rpc/transports/session.ts
-let sessionId = 0;
-/**
-* Mint the per-connection session meta every transport binding shares —
-* one id space across transports, so session bookkeeping (streaming
-* subscriptions, shared-state sync, auth trust) never collides between a
-* WS peer and an SSE session on the same server.
-*/
-function createRpcSessionMeta() {
-	return {
-		id: sessionId++,
-		subscribedStates: /* @__PURE__ */ new Set()
-	};
-}
-//#endregion
-//#region src/rpc/transports/ws-server.ts
-/**
-* Create a live, token-protected origin allowlist for external browser
-* viewers. Pass it to {@link WsRpcTransportOptions.allowedOrigins}, then use
-* `registerFromUrl()` in the connection metadata handler to authorize a
-* viewer without sharing a mutable array or disabling DNS-rebinding protection.
-*/
-function createWsOriginRegistry(options = {}) {
-	const token = randomToken();
-	const origins = new Set(options.allowedOrigins ?? []);
-	function normalizeOrigin(origin) {
-		if (!origin) return;
-		try {
-			const url = new URL(origin);
-			const normalized = url.origin === "null" ? `${url.protocol}//${url.host}` : url.origin;
-			return origin === normalized ? normalized : void 0;
-		} catch {}
-	}
-	function registerOrigin(origin, candidateToken) {
-		const normalized = normalizeOrigin(origin);
-		if (!normalized || !candidateToken || !timingSafeEqual(token, candidateToken)) return false;
-		if (options.validateOrigin && !options.validateOrigin(normalized)) return false;
-		origins.add(normalized);
-		return true;
-	}
-	return {
-		token,
-		registerFromUrl(url) {
-			let parsed;
-			try {
-				parsed = new URL(url, "http://localhost");
-			} catch {
-				return;
-			}
-			const origin = parsed.searchParams.get("devframe_viewer_origin") ?? void 0;
-			return registerOrigin(origin, parsed.searchParams.get("devframe_viewer_origin_token") ?? void 0) ? origin : void 0;
-		},
-		isAllowed(origin) {
-			return isAllowedOrigin(origin, [...origins]);
-		}
-	};
-}
-const EMPTY_DEFS = /* @__PURE__ */ new Map();
-function NOOP() {}
-function listen(server, port, host) {
-	return new Promise((resolve, reject) => {
-		const onError = (error) => reject(error);
-		server.once("error", onError);
-		try {
-			server.listen(port, host, () => {
-				server.off("error", onError);
-				resolve();
-			});
-		} catch (error) {
-			server.off("error", onError);
-			reject(error);
-		}
-	});
-}
-/** Compare two URL paths ignoring a trailing slash. */
-function pathMatches(a, b) {
-	const strip = (p) => p.length > 1 && p.endsWith("/") ? p.slice(0, -1) : p;
-	return strip(a) === strip(b);
-}
-/**
-* Whether `hostname` names a loopback host: `localhost` (or any `*.localhost`
-* subdomain), the IPv6 loopback `::1`, or an IPv4 literal inside the
-* `127.0.0.0/8` loopback block.
-*
-* The IPv4 case is matched **structurally** — the whole hostname must be a
-* canonical dotted-decimal IPv4 literal whose first octet is `127`. A bare
-* `startsWith('127.')` prefix check would also accept an attacker-controlled
-* DNS name that merely *begins* with `127.` (`127.attacker.example`,
-* `127.0.0.1.attacker.example`), letting a cross-origin browser page defeat
-* the loopback origin gate that guards the RPC/MCP surface (a DNS-rebinding /
-* cross-site WebSocket-hijacking bypass). Requiring a real IPv4 literal keeps
-* genuine loopback addresses (`127.0.0.1`, `127.5.5.5`) allowed while rejecting
-* those DNS names.
-*/
-function isLoopbackHostname(hostname) {
-	const h = hostname.replace(/^\[|\]$/g, "");
-	if (h === "localhost" || h.endsWith(".localhost") || h === "::1") return true;
-	return isLoopbackIPv4(h);
-}
-/** A canonical dotted-decimal IPv4 literal in `127.0.0.0/8`. */
-function isLoopbackIPv4(hostname) {
-	const octets = hostname.split(".");
-	if (octets.length !== 4 || !octets.every(isDecimalOctet)) return false;
-	return Number(octets[0]) === 127;
-}
-/** A single canonical IPv4 octet: 1–3 digits, no leading zero, value 0–255. */
-function isDecimalOctet(part) {
-	if (!/^\d{1,3}$/.test(part) || part.length > 1 && part[0] === "0") return false;
-	return Number(part) <= 255;
-}
-/**
-* Default origin policy for a localhost dev tool: allow requests with no
-* `Origin` header (native, non-browser clients), allow any loopback origin
-* (so cross-port localhost dev setups keep working), and allow explicitly
-* configured origins. Everything else — a real remote page in the dev's
-* browser — is rejected.
-*/
-function isAllowedOrigin(origin, allowedOrigins) {
-	if (!origin) return true;
-	if (allowedOrigins.includes(origin)) return true;
-	try {
-		return isLoopbackHostname(new URL(origin).hostname);
-	} catch {
-		return false;
-	}
-}
-function isWsOriginRegistry(value) {
-	return !!value && !Array.isArray(value);
-}
-/**
-* Build the `upgrade` listener that hands a request to the crossws adapter,
-* optionally filtered to a single `path`. Non-matching requests are left
-* untouched so other upgrade listeners (e.g. a Vite dev server's HMR socket)
-* can claim them, unless `destroyUnmatched` is set.
-*/
-function createUpgradeListener(ws, path, destroyUnmatched, allowedOrigins) {
-	return (req, socket, head) => {
-		socket.on("error", () => {});
-		if (path) {
-			let pathname = req.url ?? "/";
-			try {
-				pathname = new URL(req.url ?? "/", "http://localhost").pathname;
-			} catch {}
-			if (!pathMatches(pathname, path)) {
-				if (destroyUnmatched) {
-					socket.write("HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n");
-					socket.destroy();
-				}
-				return;
-			}
-		}
-		const originAllowed = isWsOriginRegistry(allowedOrigins) ? allowedOrigins.isAllowed(req.headers.origin) : isAllowedOrigin(req.headers.origin, allowedOrigins || []);
-		if (allowedOrigins !== false && !originAllowed) {
-			socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
-			socket.destroy();
-			return;
-		}
-		ws.handleUpgrade(req, socket, head);
-	};
-}
-/**
-* The per-peer lifecycle hooks driving a devframe RPC WebSocket, shaped for
-* any [crossws](https://crossws.h3.dev) adapter. {@link attachWsRpcTransport}
-* feeds them to the Node adapter; runtime-specific attachments (e.g. Bun's
-* fetch-upgrade adapter) reuse the same hooks so every transport speaks the
-* identical wire protocol — one birpc channel per peer, per-method
-* `jsonSerializable` dispatch between strict JSON and structured-clone.
-*/
-function createWsRpcPeerHooks(rpcGroup, options = {}) {
-	const { onConnected = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS, serialize: serializeOverride, deserialize: deserializeOverride } = options;
-	const states = /* @__PURE__ */ new WeakMap();
-	return {
-		open: (peer) => {
-			const meta = createRpcSessionMeta();
-			meta.peer = peer;
-			const connection = {
-				id: meta.id,
-				transport: "websocket",
-				request: peer.request,
-				send: (data) => peer.send(data),
-				close: (code, reason) => peer.close(code, reason),
-				peer
-			};
-			const codec = createRpcWireCodec(definitions);
-			const state = {
-				meta,
-				connection,
-				channel: void 0
-			};
-			const channel = {
-				post: (data) => {
-					peer.send(data);
-				},
-				on: (fn) => {
-					state.onMessage = fn;
-				},
-				serialize: serializeOverride ?? codec.serialize,
-				deserialize: deserializeOverride ?? codec.deserialize,
-				meta
-			};
-			state.channel = channel;
-			states.set(peer, state);
-			rpcGroup.updateChannels((channels) => {
-				channels.push(channel);
-			});
-			onConnected(connection, meta);
-		},
-		message: (peer, message) => {
-			states.get(peer)?.onMessage?.(message.text());
-		},
-		close: (peer) => {
-			const state = states.get(peer);
-			if (!state) return;
-			states.delete(peer);
-			rpcGroup.updateChannels((channels) => {
-				const index = channels.indexOf(state.channel);
-				if (index >= 0) channels.splice(index, 1);
-			});
-			onDisconnected(state.connection, state.meta);
-		}
-	};
-}
-/**
-* Attach a WebSocket transport to an existing RPC group, powered by
-* [crossws](https://crossws.h3.dev). Either attach to an existing HTTP(S)
-* `server` (sharing its port, optionally scoped to a `path`), or let this
-* helper create a standalone server from `port` / `host` / `https`.
-*
-* Returns the crossws node adapter, standalone-server readiness/address
-* accessors, `detach` (remove the upgrade listener from a shared `server`),
-* and `close` (full deterministic teardown).
-*/
-function attachWsRpcTransport(rpcGroup, options = {}) {
-	const { server, port, host = "localhost", path, destroyUnmatched = false, unbound, https, allowedOrigins } = options;
-	const ws = crossws({ hooks: createWsRpcPeerHooks(rpcGroup, options) });
-	const sharedUpgradeListener = createUpgradeListener(ws, path, destroyUnmatched, allowedOrigins);
-	const ownedUpgradeListener = createUpgradeListener(ws, path, true, allowedOrigins);
-	/** Bind a server's `upgrade` events, tracked so `close()` detaches them. */
-	const attachments = /* @__PURE__ */ new Set();
-	function attachTo(target, listener) {
-		target.on("upgrade", listener);
-		const detachOne = () => {
-			target.off("upgrade", listener);
-			attachments.delete(detachOne);
-		};
-		attachments.add(detachOne);
-		return detachOne;
-	}
-	let ready = Promise.resolve();
-	let ownedServer;
-	if (unbound) {} else if (server) attachTo(server, sharedUpgradeListener);
-	else if (https) {
-		ownedServer = createServer$1(https);
-		attachTo(ownedServer, ownedUpgradeListener);
-		ready = listen(ownedServer, port ?? 0, host);
-	} else {
-		ownedServer = createServer((_req, res) => {
-			res.writeHead(426, { "content-type": "text/plain" });
-			res.end("Upgrade Required");
-		});
-		attachTo(ownedServer, ownedUpgradeListener);
-		ready = listen(ownedServer, port ?? 0, host);
-	}
-	const activeServer = server ?? ownedServer;
-	function detachAll() {
-		for (const detachOne of [...attachments]) detachOne();
-	}
-	return {
-		ws,
-		ready,
-		address: () => activeServer?.address() ?? null,
-		handleUpgrade: sharedUpgradeListener,
-		attach: (target) => attachTo(target, sharedUpgradeListener),
-		detach: detachAll,
-		async close() {
-			detachAll();
-			ws.closeAll(void 0, void 0, true);
-			if (ownedServer) {
-				const srv = ownedServer;
-				await ready.catch(() => {});
-				if (!srv.listening) return;
-				await new Promise((r) => srv.close(() => r()));
-			}
-		}
-	};
-}
-//#endregion
-export { isLoopbackHostname as a, isAllowedOrigin as i, createWsOriginRegistry as n, createRpcSessionMeta as o, createWsRpcPeerHooks as r, attachWsRpcTransport as t };