devframe 0.9.8 → 0.9.9

package/dist/internal/index.d.mts

@@ -1,15 +1,15 @@
-import { v as RpcFunctionDefinitionAny } from "../types-CMdPYhOx.mjs";
-import { At as AgentResource, F as DevframeDefinition, Ft as AgentToolProvider, It as AgentToolProviderHandle, Lt as DevframeAgentHost$1, Mt as AgentResourceInput, Nt as AgentTool, Ot as AgentHandle, Pt as AgentToolInput, Rt as DevframeAgentHostEvents, jt as AgentResourceContent, kt as AgentManifest, o as DevframeNodeContext, yt as DevframeHost, zt as EventEmitter } from "../context-CLF4-8Pp.mjs";
-import { a as RemoteAssetsStore, o as StaticAssetsSource } from "../remote-assets-B13_vRkJ.mjs";
-import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, h as registerDevframeInstance, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-Tcp5hGoq.mjs";
-import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-mtXpcJIv.mjs";
-import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-B3W3z9ff.mjs";
+import { v as RpcFunctionDefinitionAny } from "../types-Dq4i156u.mjs";
+import { At as AgentManifest, Bt as EventEmitter, F as DevframeDefinition, Ft as AgentToolInput, It as AgentToolProvider, Lt as AgentToolProviderHandle, Mt as AgentResourceContent, Nt as AgentResourceInput, Pt as AgentTool, Rt as DevframeAgentHost$1, bt as DevframeHost, jt as AgentResource, kt as AgentHandle, o as DevframeNodeContext, zt as DevframeAgentHostEvents } from "../context-4AIVRLYF.mjs";
+import { a as RemoteAssetsStore, o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
+import { a as InstanceShellInit, c as StartedServer, d as samePath, f as DevframeInstanceRecord, h as registerDevframeInstance, i as InstanceShellApi, l as createInstanceShell, m as listLiveDevframeInstances, n as InstanceRegisterConfig, o as InstanceShellInternals, p as DevframeInstanceRegistration, r as InstanceShell, s as InstanceWsTier, t as CreateInstanceShellOptions, u as resolveInstanceRegister } from "../instance-shell-7Z52PE4_.mjs";
+import { i as resolveBasePath, n as ResolvedMcpConfig, o as resolveMcpConfig, r as normalizeBasePath } from "../_shared-CK3czkH4.mjs";
+import { n as CreateContextRpcServerOptions, r as createContextRpcServer, t as ContextRpcServer } from "../rpc-core-Ceu6AUz8.mjs";
 //#region src/client-assets.d.ts
 /**
- * Resolve a definition's client assets source — the built SPA served as its
+ * Resolve a definition's client assets source: the built SPA served as its
  * UI. Prefers the top-level {@link DevframeDefinition.clientAssets} and falls
  * back to the deprecated `cli.distDir`, so both the new and legacy shapes
- * resolve. Returns `undefined` when neither is set (bridge mode — the SPA is
+ * resolve. Returns `undefined` when neither is set (bridge mode, where the SPA is
  * hosted elsewhere).
  *
  * Internal: exposed to first-party integrations via `devframe/internal`, not
@@ -22,9 +22,9 @@ declare function resolveClientAssets(d: DevframeDefinition): StaticAssetsSource
  * How {@link coerceAgentPositionalArgs} treats an args object that carries
  * neither declared schemas nor `arg0`/`arg1`/… keys:
  *
- * - `'wrap'` — pass the object itself as the single positional argument.
+ * - `'wrap'`: pass the object itself as the single positional argument.
  *   RPC-backed tools use this: an untyped RPC may take one raw object.
- * - `'drop'` — call with zero arguments. Command-backed tools use this:
+ * - `'drop'`: call with zero arguments. Command-backed tools use this:
  *   a handler's positional parameters come solely from its declared
  *   `agent.args` schemas, so undeclared payload is ignored.
  */
@@ -46,6 +46,11 @@ type AgentArgsFallback = 'wrap' | 'drop';
 declare function coerceAgentPositionalArgs(args: unknown, schemas: readonly unknown[] | undefined, fallback?: AgentArgsFallback): unknown[];
 //#endregion
 //#region src/node/diagnostics.d.ts
+/**
+ * DF00xx codes are allocated across packages (e.g. @devframes/json-render
+ * owns DF0037–DF0041), so this file alone doesn't show the next free
+ * number; check `docs/content/6.errors/` for the full allocation before adding one.
+ */
 declare const diagnostics: import("nostics").Diagnostics<{
   readonly DF0006: {
     readonly why: (p: {
@@ -113,7 +118,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
       channel: string;
       id: string;
     }) => string;
-    readonly fix: "Track the producer lifecycle — guard writes with the `stream.signal.aborted` flag.";
+    readonly fix: "Track the producer lifecycle by guarding writes with the `stream.signal.aborted` flag.";
   };
   readonly DF0032: {
     readonly why: (p: {
@@ -145,7 +150,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
     readonly why: (p: {
       name: string;
     }) => string;
-    readonly fix: "Complete the auth handshake (or connect with a static/pre-shared token) before calling a trusted method. Untrusted callers may only call `anonymous:`-prefixed methods — see `isAnonymousRpcMethod`.";
+    readonly fix: "Complete the auth handshake (or connect with a static/pre-shared token) before calling a trusted method. Untrusted callers may only call `anonymous:`-prefixed methods; see `isAnonymousRpcMethod`.";
   };
   readonly DF0037: {
     readonly why: (p: {
@@ -194,7 +199,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
     readonly why: (p: {
       port: number;
     }) => string;
-    readonly fix: "Call devframe_connect_list-instances for the current instance list — the instance may have stopped or changed port.";
+    readonly fix: "Call devframe_connect_list-instances for the current instance list; the instance may have stopped or changed port.";
   };
   readonly DF0051: {
     readonly why: (p: {
@@ -214,7 +219,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
     readonly why: (p: {
       id: string;
     }) => string;
-    readonly fix: "Await `instance.ready` (or any request through `instance.handler`) before reading `connectionMeta()` — the WebSocket binding it describes is only known once initialization completes.";
+    readonly fix: "Await `instance.ready` (or any request through `instance.handler`) before reading `connectionMeta()`; the WebSocket binding it describes is only known once initialization completes.";
   };
   readonly DF0055: {
     readonly why: (p: {
@@ -230,7 +235,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
   };
   readonly DF0057: {
     readonly why: () => string;
-    readonly fix: "Clients connect over the SSE endpoint instead — no upgrade wiring is needed. Remove `ws: false` if the instance should serve a WebSocket after all.";
+    readonly fix: "Clients connect over the SSE endpoint instead, so no upgrade wiring is needed. Remove `ws: false` if the instance should serve a WebSocket after all.";
   };
   readonly DF0058: {
     readonly why: (p: {
@@ -261,7 +266,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
       required: string;
       installed: string;
     }) => string;
-    readonly fix: "Align the installed assets package with the version its node package declares — they are published in lockstep.";
+    readonly fix: "Align the installed assets package with the version its node package declares; they are published in lockstep.";
   };
   readonly DF0062: {
     readonly why: (p: {
@@ -291,7 +296,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
       field: "package" | "version";
       value: string;
     }) => string;
-    readonly fix: "A remote-assets `package` must be a valid npm package name and `version` an exact semver version (e.g. `1.2.3`) — they are interpolated into CDN URLs and the cache path.";
+    readonly fix: "A remote-assets `package` must be a valid npm package name and `version` an exact semver version (e.g. `1.2.3`); they are interpolated into CDN URLs and the cache path.";
   };
   readonly DF0066: {
     readonly why: (p: {
@@ -327,7 +332,7 @@ declare const diagnostics: import("nostics").Diagnostics<{
       package: string;
       reason: string;
     }) => string;
-    readonly fix: "A service package's default export must be a factory returning a `DevframeServiceDefinition` — an object with `package`, `version`, `scope`, and a `setup` function.";
+    readonly fix: "A service package's default export must be a factory returning a `DevframeServiceDefinition`, an object with `package`, `version`, `scope`, and a `setup` function.";
   };
   readonly DF0072: {
     readonly why: (p: {
@@ -335,6 +340,18 @@ declare const diagnostics: import("nostics").Diagnostics<{
     }) => string;
     readonly fix: "Check the method id, and ensure the service/plugin that registers it is installed (e.g. declared in `services`) before the build collects the dump.";
   };
+  readonly DF0075: {
+    readonly why: (p: {
+      runtime: string;
+    }) => string;
+    readonly fix: "Keep the SSE endpoint enabled (drop `sse: false`) so clients connect over it on Bun/Deno, or move the socket to a side-car (`ws: { sidecar: true }`) which binds the native WebSocket adapter on its own port.";
+  };
+  readonly DF0076: {
+    readonly why: (p: {
+      runtime: string;
+    }) => string;
+    readonly fix: "On Bun/Deno, serve the advertised `__ws` route from `Bun.serve` / `Deno.serve` with `attachBunWsTransport` / `attachDenoWsTransport` (see the hub-deno-minimal example), or connect over the SSE endpoint instead.";
+  };
 }, readonly [(d: import("nostics").Diagnostic, { method }?: {
   method?: "log" | "warn" | "error";
 }) => void]>;
@@ -384,7 +401,7 @@ interface CreateH3DevframeHostOptions {
    */
   origin: string | (() => string);
   /**
-   * Register a static-file handler at `base` serving files from `source` —
+   * Register a static-file handler at `base` serving files from `source`:
    * a local directory or a resolved remote-assets back-proxy store (both
    * accepted by `devframe/utils/serve-static`). `mountStatic` forwards to
    * it; when omitted the host serves no SPA (bridge mode, where the SPA is
@@ -407,7 +424,7 @@ interface CreateH3DevframeHostOptions {
   workspaceRoot?: string;
 }
 /**
- * h3-backed {@link DevframeHost} — used by the standalone CLI adapter.
+ * h3-backed {@link DevframeHost}, used by the standalone CLI adapter.
  */
 declare function createH3DevframeHost(options: CreateH3DevframeHostOptions): DevframeHost;
 //#endregion
@@ -440,7 +457,7 @@ interface RpcWireCodec {
  * JSON (methods declared `jsonSerializable: true`) and `s:`-prefixed
  * structured-clone (everything else, including all error envelopes), with a
  * request-id → method map so a response independently picks the same
- * encoder as its request. One codec per connection — request-id spaces
+ * encoder as its request. One codec per connection; request-id spaces
  * don't collide across connections.
  *
  * @internal
@@ -448,7 +465,7 @@ interface RpcWireCodec {
 declare function createRpcWireCodec(definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>): RpcWireCodec;
 /**
  * Peek at a wire frame's birpc envelope without engaging a codec's
- * request-id bookkeeping — used by the SSE transport to route a frame
+ * request-id bookkeeping; used by the SSE transport to route a frame
  * (park a POST for its response / answer with a bare 202) before it is
  * handed to birpc proper.
  *
@@ -459,4 +476,4 @@ declare function peekRpcWireFrame(raw: string): {
   i?: string;
 };
 //#endregion
-export { type AgentArgsFallback, type ContextRpcServer, type CreateContextRpcServerOptions, CreateH3DevframeHostOptions, type CreateInstanceShellOptions, DevframeAgentHost, type DevframeInstanceRecord, type DevframeInstanceRegistration, type InstanceRegisterConfig, type InstanceShell, type InstanceShellApi, type InstanceShellInit, type InstanceShellInternals, type InstanceWsTier, type RpcWireCodec, type StartedServer, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveClientAssets, resolveInstanceRegister, samePath };
+export { type AgentArgsFallback, type ContextRpcServer, type CreateContextRpcServerOptions, CreateH3DevframeHostOptions, type CreateInstanceShellOptions, DevframeAgentHost, type DevframeInstanceRecord, type DevframeInstanceRegistration, type InstanceRegisterConfig, type InstanceShell, type InstanceShellApi, type InstanceShellInit, type InstanceShellInternals, type InstanceWsTier, type ResolvedMcpConfig, type RpcWireCodec, type StartedServer, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveClientAssets, resolveInstanceRegister, resolveMcpConfig, samePath };

package/dist/internal/index.mjs

@@ -1,10 +1,10 @@
-import { t as resolveClientAssets } from "../client-assets-C7SXgTWY.mjs";
-import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../wire-codec-0K-o5MYW.mjs";
-import { t as diagnostics } from "../diagnostics-BXWW3VK-.mjs";
-import { a as DevframeAgentHost, o as coerceAgentPositionalArgs } from "../services-install-CqqQVls5.mjs";
-import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-BM3PdYli.mjs";
-import { t as createH3DevframeHost } from "../host-h3-fRbF9yor.mjs";
-import { a as importRuntimeModule, i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-CpVW4zG0.mjs";
-import { i as registerDevframeInstance, n as listLiveDevframeInstances } from "../instance-registry-BjlMQbFB.mjs";
-import { t as createContextRpcServer } from "../rpc-core-DlHd276T.mjs";
-export { DevframeAgentHost, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveClientAssets, resolveInstanceRegister, samePath };
+import { t as resolveClientAssets } from "../client-assets-DNdhagGm.mjs";
+import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../wire-codec-dcCeXcSo.mjs";
+import { t as diagnostics } from "../diagnostics-BMfN8mb1.mjs";
+import { a as DevframeAgentHost, o as coerceAgentPositionalArgs } from "../services-install-P_DV7VYL.mjs";
+import { i as resolveMcpConfig, n as resolveBasePath, t as normalizeBasePath } from "../_shared-C08SdQRl.mjs";
+import { t as createH3DevframeHost } from "../host-h3-BJ4siyz7.mjs";
+import { a as importRuntimeModule, i as normalizeHttpServerUrl, n as resolveInstanceRegister, r as samePath, t as createInstanceShell } from "../instance-shell-cdVETpfz.mjs";
+import { i as registerDevframeInstance, n as listLiveDevframeInstances } from "../instance-registry-C7-41RSp.mjs";
+import { t as createContextRpcServer } from "../rpc-core-DVQ7xi89.mjs";
+export { DevframeAgentHost, coerceAgentPositionalArgs, createContextRpcServer, createH3DevframeHost, createInstanceShell, createRpcWireCodec, diagnostics, importRuntimeModule, listLiveDevframeInstances, normalizeBasePath, normalizeHttpServerUrl, peekRpcWireFrame, registerDevframeInstance, resolveBasePath, resolveClientAssets, resolveInstanceRegister, resolveMcpConfig, samePath };

package/dist/node/auth.d.mts

@@ -1,3 +1,3 @@
-import { Ct as DevframeAuthHandler } from "../context-CLF4-8Pp.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-D3k0BIhe.mjs";
+import { wt as DevframeAuthHandler } from "../context-4AIVRLYF.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, o as revokeActiveConnectionsForToken, r as getTempAuthCode, s as revokeAuthToken, t as buildOtpAuthUrl } from "../index-pKl67H6w.mjs";
 export { DevframeAuthHandler, buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/auth.mjs

@@ -1,3 +1,3 @@
-import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-COLW0cOi.mjs";
-import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-CK9LjrnT.mjs";
+import { n as revokeAuthToken, t as revokeActiveConnectionsForToken } from "../revoke-cqztiCX4.mjs";
+import { a as verifyAuthToken, i as refreshTempAuthCode, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-CeQQWzM-.mjs";
 export { buildOtpAuthUrl, exchangeTempAuthCode, getTempAuthCode, refreshTempAuthCode, revokeActiveConnectionsForToken, revokeAuthToken, verifyAuthToken };

package/dist/node/hub-internals.d.mts

@@ -1,3 +1,3 @@
-import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-DftYyXaR.mjs";
-import { n as normalizeBasePath, r as resolveBasePath } from "../_shared-mtXpcJIv.mjs";
+import { a as internalContextMap, i as getInternalContext, n as InternalAnonymousAuthStorage, r as RemoteTokenRecord, t as DevframeInternalContext } from "../context-rgBSPFHS.mjs";
+import { i as resolveBasePath, r as normalizeBasePath } from "../_shared-CK3czkH4.mjs";
 export { type DevframeInternalContext, type InternalAnonymousAuthStorage, type RemoteTokenRecord, getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/hub-internals.mjs

@@ -1,3 +1,3 @@
-import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-BM3PdYli.mjs";
-import { n as internalContextMap, t as getInternalContext } from "../context-KUqAfawQ.mjs";
+import { n as resolveBasePath, t as normalizeBasePath } from "../_shared-C08SdQRl.mjs";
+import { n as internalContextMap, t as getInternalContext } from "../context-DIUvJW4D.mjs";
 export { getInternalContext, internalContextMap, normalizeBasePath, resolveBasePath };

package/dist/node/index.d.mts

@@ -1,6 +1,6 @@
-import "../index-BzyopqxV.mjs";
-import { v as RpcFunctionDefinitionAny } from "../types-CMdPYhOx.mjs";
-import { k as SharedState, l as RpcFunctionsHost, o as DevframeNodeContext, yt as DevframeHost } from "../context-CLF4-8Pp.mjs";
+import "../index-pIVt92jP.mjs";
+import { v as RpcFunctionDefinitionAny } from "../types-Dq4i156u.mjs";
+import { bt as DevframeHost, k as SharedState, l as RpcFunctionsHost, o as DevframeNodeContext } from "../context-4AIVRLYF.mjs";
 import { BirpcGroup } from "birpc";
 //#region src/node/context.d.ts
 interface CreateHostContextOptions {
@@ -13,7 +13,7 @@ interface CreateHostContextOptions {
    * serves (from `DevframeDefinition.importMetaUrl`). Supplies the default
    * `resolveFrom` base for remote {@link DevframeViewHost.hostStatic} sources
    * that don't set one, so a locally installed copy of an assets package is
-   * served with zero network. An internal plumbing detail — it isn't part of
+   * served with zero network. An internal plumbing detail; it isn't part of
    * the public {@link DevframeNodeContext} surface.
    */
   importMetaUrl?: string;
@@ -28,7 +28,7 @@ interface CreateHostContextOptions {
  * Framework- and build-tool-agnostic core of the Devframe node context.
  * Wires the RPC host, view (HTTP file-serving) host, diagnostics, and
  * agent subsystems. Host adapters can wrap this to augment `ctx` with
- * extra surfaces — for example, `@vitejs/devtools-kit`'s
+ * extra surfaces; for example, `@vitejs/devtools-kit`'s
  * `createKitContext` attaches `docks`, `terminals`, `messages`, and
  * `commands` when mounted into Vite DevTools.
  */

package/dist/node/index.mjs

@@ -1,3 +1,3 @@
-import { t as createHostContext } from "../context-omlma_1n.mjs";
-import { t as createStorage } from "../storage-BXNVhKyR.mjs";
+import { t as createHostContext } from "../context-CwPUinjn.mjs";
+import { t as createStorage } from "../storage-Dccf_IyD.mjs";
 export { createHostContext, createStorage };

package/dist/{nostics-SPGDgHEP.d.mts → nostics-0sKe5HIj.d.mts}

@@ -10,7 +10,7 @@ declare function devframeReporter(d: Diagnostic, { method }?: {
   method?: 'log' | 'warn' | 'error';
 }): void;
 /**
- * Options accepted by {@link defineDiagnostics} — identical to `nostics`'s
+ * Options accepted by {@link defineDiagnostics}, identical to `nostics`'s
  * own `DefineDiagnosticsOptions`, minus the reporter devframe already
  * prepends.
  */
@@ -20,7 +20,7 @@ type DevframeDefineDiagnosticsOptions<Codes extends Record<string, DiagnosticDef
  * ANSI console reporter pre-wired ahead of any `reporters` passed in. Every
  * `diagnostics.ts` in devframe core, `@devframes/hub`, `@devframes/json-render`,
  * and the built-in plugins defines its codes through this instead of
- * `nostics`'s own `defineDiagnostics` — the reporter registration lives
+ * `nostics`'s own `defineDiagnostics`; the reporter registration lives
  * here, once, so none of them need to build their own reporter (`colors`,
  * `ansiFormatter`) or take a direct dependency on `nostics` themselves.
  */

package/dist/{nostics-CzECRXpE.mjs → nostics-D0PvLZsn.mjs}

@@ -45,7 +45,7 @@ function devframeReporter(d, { method = "warn" } = {}) {
 * ANSI console reporter pre-wired ahead of any `reporters` passed in. Every
 * `diagnostics.ts` in devframe core, `@devframes/hub`, `@devframes/json-render`,
 * and the built-in plugins defines its codes through this instead of
-* `nostics`'s own `defineDiagnostics` — the reporter registration lives
+* `nostics`'s own `defineDiagnostics`; the reporter registration lives
 * here, once, so none of them need to build their own reporter (`colors`,
 * `ansiFormatter`) or take a direct dependency on `nostics` themselves.
 */

package/dist/origin-DGDH8BI9.d.mts

@@ -0,0 +1,45 @@
+//#region src/utils/origin.d.ts
+/**
+ * Origin and hostname predicates shared by the RPC transports (the WS upgrade,
+ * SSE, and MCP origin gates) and the instance shell's authentication-link
+ * origin validation. Kept dependency-free and runtime-agnostic so any consumer
+ * can pull in a single check without dragging in a transport's `crossws`
+ * import.
+ */
+/**
+ * Whether `hostname` names a loopback host: `localhost` (or any `*.localhost`
+ * subdomain), the IPv6 loopback `::1`, or an IPv4 literal inside the
+ * `127.0.0.0/8` loopback block.
+ *
+ * The IPv4 case is matched **structurally**: the whole hostname must be a
+ * canonical dotted-decimal IPv4 literal whose first octet is `127`. A bare
+ * `startsWith('127.')` prefix check would also accept an attacker-controlled
+ * DNS name that merely *begins* with `127.` (`127.attacker.example`,
+ * `127.0.0.1.attacker.example`), letting a cross-origin browser page defeat
+ * the loopback origin gate that guards the RPC/MCP surface (a DNS-rebinding /
+ * cross-site WebSocket-hijacking bypass). Requiring a real IPv4 literal keeps
+ * genuine loopback addresses (`127.0.0.1`, `127.5.5.5`) allowed while rejecting
+ * those DNS names.
+ */
+declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Default origin policy for a localhost dev tool: allow requests with no
+ * `Origin` header (native, non-browser clients), allow any loopback origin
+ * (so cross-port localhost dev setups keep working), and allow explicitly
+ * configured origins. Everything else, such as a real remote page in the dev's
+ * browser, is rejected.
+ */
+declare function isAllowedOrigin(origin: string | undefined, allowedOrigins: readonly string[]): boolean;
+/**
+ * Decide whether a request-derived origin candidate may back a devframe's
+ * advertised public origin, the destination of the OTP magic link. Stricter
+ * than {@link isAllowedOrigin}: it rejects credentials, a path, a query, a
+ * fragment, a malformed port, and non-HTTP(S) schemes, and adopts a candidate
+ * only when its hostname is loopback or its canonical origin exactly matches
+ * an `allowedOrigins` entry (a caller with no static list passes none, so only
+ * loopback qualifies). Returns the canonical origin to adopt, or `undefined`
+ * to reject. Forwarded headers are never consulted.
+ */
+declare function validateOriginCandidate(candidate: string, allowedOrigins?: readonly string[]): string | undefined;
+//#endregion
+export { isLoopbackHostname as n, validateOriginCandidate as r, isAllowedOrigin as t };

package/dist/origin-DZit9g29.mjs

@@ -0,0 +1,80 @@
+//#region src/utils/origin.ts
+/**
+* Origin and hostname predicates shared by the RPC transports (the WS upgrade,
+* SSE, and MCP origin gates) and the instance shell's authentication-link
+* origin validation. Kept dependency-free and runtime-agnostic so any consumer
+* can pull in a single check without dragging in a transport's `crossws`
+* import.
+*/
+/**
+* Whether `hostname` names a loopback host: `localhost` (or any `*.localhost`
+* subdomain), the IPv6 loopback `::1`, or an IPv4 literal inside the
+* `127.0.0.0/8` loopback block.
+*
+* The IPv4 case is matched **structurally**: the whole hostname must be a
+* canonical dotted-decimal IPv4 literal whose first octet is `127`. A bare
+* `startsWith('127.')` prefix check would also accept an attacker-controlled
+* DNS name that merely *begins* with `127.` (`127.attacker.example`,
+* `127.0.0.1.attacker.example`), letting a cross-origin browser page defeat
+* the loopback origin gate that guards the RPC/MCP surface (a DNS-rebinding /
+* cross-site WebSocket-hijacking bypass). Requiring a real IPv4 literal keeps
+* genuine loopback addresses (`127.0.0.1`, `127.5.5.5`) allowed while rejecting
+* those DNS names.
+*/
+function isLoopbackHostname(hostname) {
+	const h = hostname.replace(/^\[|\]$/g, "");
+	if (h === "localhost" || h.endsWith(".localhost") || h === "::1") return true;
+	return isLoopbackIPv4(h);
+}
+/** A canonical dotted-decimal IPv4 literal in `127.0.0.0/8`. */
+function isLoopbackIPv4(hostname) {
+	const octets = hostname.split(".");
+	if (octets.length !== 4 || !octets.every(isDecimalOctet)) return false;
+	return Number(octets[0]) === 127;
+}
+/** A single canonical IPv4 octet: 1–3 digits, no leading zero, value 0–255. */
+function isDecimalOctet(part) {
+	if (!/^\d{1,3}$/.test(part) || part.length > 1 && part[0] === "0") return false;
+	return Number(part) <= 255;
+}
+/**
+* Default origin policy for a localhost dev tool: allow requests with no
+* `Origin` header (native, non-browser clients), allow any loopback origin
+* (so cross-port localhost dev setups keep working), and allow explicitly
+* configured origins. Everything else, such as a real remote page in the dev's
+* browser, is rejected.
+*/
+function isAllowedOrigin(origin, allowedOrigins) {
+	if (!origin) return true;
+	if (allowedOrigins.includes(origin)) return true;
+	try {
+		return isLoopbackHostname(new URL(origin).hostname);
+	} catch {
+		return false;
+	}
+}
+/**
+* Decide whether a request-derived origin candidate may back a devframe's
+* advertised public origin, the destination of the OTP magic link. Stricter
+* than {@link isAllowedOrigin}: it rejects credentials, a path, a query, a
+* fragment, a malformed port, and non-HTTP(S) schemes, and adopts a candidate
+* only when its hostname is loopback or its canonical origin exactly matches
+* an `allowedOrigins` entry (a caller with no static list passes none, so only
+* loopback qualifies). Returns the canonical origin to adopt, or `undefined`
+* to reject. Forwarded headers are never consulted.
+*/
+function validateOriginCandidate(candidate, allowedOrigins) {
+	let url;
+	try {
+		url = new URL(candidate);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+	if (url.username || url.password || url.search || url.hash || url.pathname !== "/" && url.pathname !== "") return void 0;
+	const canonical = url.origin;
+	if (canonical === "null") return void 0;
+	if (isLoopbackHostname(url.hostname) || allowedOrigins?.includes(canonical)) return canonical;
+}
+//#endregion
+export { isLoopbackHostname as n, validateOriginCandidate as r, isAllowedOrigin as t };

package/dist/recipes/common-rpc-functions.d.mts

@@ -1,6 +1,6 @@
-import "../index-BzyopqxV.mjs";
-import { E as Thenable, S as RpcFunctionSetupResult, c as RpcDump, g as RpcFunctionAgentOptions } from "../types-CMdPYhOx.mjs";
-import "../context-CLF4-8Pp.mjs";
+import "../index-pIVt92jP.mjs";
+import { E as Thenable, S as RpcFunctionSetupResult, c as RpcDump, g as RpcFunctionAgentOptions } from "../types-Dq4i156u.mjs";
+import "../context-4AIVRLYF.mjs";
 import { SimpleSchema } from "../utils/simple-schema.mjs";
 //#region src/recipes/common-rpc-functions.d.ts
 /**
@@ -34,7 +34,7 @@ declare const KNOWN_EDITORS: KnownEditor[];
  * })
  * ```
  *
- * @deprecated Use the `@devframes/service-open` wire service instead — one
+ * @deprecated Use the `@devframes/service-open` wire service instead: one
  * host-level installation shared by every plugin and feature-detectable from
  * clients, with workspace-root path containment on top of the editor gating.
  */
@@ -64,7 +64,7 @@ declare const openInEditor: {
  * ctx.rpc.register(openInFinder)
  * ```
  *
- * @deprecated Use the `@devframes/service-open` wire service instead — one
+ * @deprecated Use the `@devframes/service-open` wire service instead: one
  * host-level installation shared by every plugin and feature-detectable from
  * clients, with workspace-root path containment.
  */

package/dist/recipes/common-rpc-functions.mjs

@@ -1,5 +1,5 @@
 import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
-import { t as s } from "../simple-schema-DQPZrAaZ.mjs";
+import { t as s } from "../simple-schema-Bi40l-P6.mjs";
 //#region src/recipes/common-rpc-functions.ts
 /** Runtime list of every {@link KnownEditor}. */
 const KNOWN_EDITORS = [
@@ -57,7 +57,7 @@ const KNOWN_EDITORS = [
 * })
 * ```
 *
-* @deprecated Use the `@devframes/service-open` wire service instead — one
+* @deprecated Use the `@devframes/service-open` wire service instead: one
 * host-level installation shared by every plugin and feature-detectable from
 * clients, with workspace-root path containment on top of the editor gating.
 */
@@ -83,7 +83,7 @@ const openInEditor = defineRpcFunction({
 * ctx.rpc.register(openInFinder)
 * ```
 *
-* @deprecated Use the `@devframes/service-open` wire service instead — one
+* @deprecated Use the `@devframes/service-open` wire service instead: one
 * host-level installation shared by every plugin and feature-detectable from
 * clients, with workspace-root path containment.
 */

package/dist/recipes/interactive-auth.d.mts

@@ -1,9 +1,9 @@
-import { Ct as DevframeAuthHandler, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "../context-CLF4-8Pp.mjs";
-import "../index-D3k0BIhe.mjs";
+import { o as DevframeNodeContext, s as DevframeNodeRpcSession, wt as DevframeAuthHandler } from "../context-4AIVRLYF.mjs";
+import "../index-pKl67H6w.mjs";
 //#region src/recipes/interactive-auth.d.ts
 interface CreateInteractiveAuthOptions {
   /**
-   * Static, pre-shared bearer tokens that are always trusted — for CI runs
+   * Static, pre-shared bearer tokens that are always trusted, for CI runs
    * or shared machines where the interactive code prompt would only get in
    * the way. Checked in both the handshake handler and the connect-time
    * hook, alongside tokens minted by a real code exchange.
@@ -11,7 +11,7 @@ interface CreateInteractiveAuthOptions {
   clientAuthTokens?: string[];
   /**
    * Print the current code + magic-link URL. Devframe stays headless, so
-   * there is no default banner printed automatically — call
+   * there is no default banner printed automatically; call
    * `auth.printBanner()` yourself once the server is listening. Override
    * this to customize the format; defaults to a small boxed message on
    * stdout.
@@ -41,10 +41,10 @@ interface CreateInteractiveAuthOptions {
  * Package the interactive OTP auth protocol devframe's primitives
  * (`exchangeTempAuthCode`, `verifyAuthToken`, `revokeAuthToken`,
  * `getTempAuthCode`, `buildOtpAuthUrl`) implement into a ready-made
- * {@link DevframeAuthHandler} — the handshake RPC functions, the resolver
+ * {@link DevframeAuthHandler}: the handshake RPC functions, the resolver
  * gate, the connect-time trust hook, and the startup banner.
  *
- * The auth storage stays internal to this handler — callers never reach into
+ * The auth storage stays internal to this handler; callers never reach into
  * `devframe/node/hub-internals` themselves.
  *
  * ```ts

package/dist/recipes/interactive-auth.mjs

@@ -1,9 +1,9 @@
-import { s as colors } from "../nostics-CzECRXpE.mjs";
+import { s as colors } from "../nostics-D0PvLZsn.mjs";
 import { n as defineRpcFunction } from "../define-BLWPsH6y.mjs";
 import { isAnonymousRpcMethod } from "../constants.mjs";
-import { a as verifyAuthToken, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-CK9LjrnT.mjs";
-import { t as getInternalContext } from "../context-KUqAfawQ.mjs";
-import { t as s } from "../simple-schema-DQPZrAaZ.mjs";
+import { a as verifyAuthToken, n as exchangeTempAuthCode, r as getTempAuthCode, t as buildOtpAuthUrl } from "../state-CeQQWzM-.mjs";
+import { t as getInternalContext } from "../context-DIUvJW4D.mjs";
+import { t as s } from "../simple-schema-Bi40l-P6.mjs";
 //#region src/recipes/interactive-auth.ts
 function defaultBanner(info) {
 	console.log(`\n  ${colors.dim("devframe auth code")}  ${colors.bold(info.code)}\n  ${colors.dim("or open")}       ${colors.cyan(info.url)}\n`);
@@ -12,10 +12,10 @@ function defaultBanner(info) {
 * Package the interactive OTP auth protocol devframe's primitives
 * (`exchangeTempAuthCode`, `verifyAuthToken`, `revokeAuthToken`,
 * `getTempAuthCode`, `buildOtpAuthUrl`) implement into a ready-made
-* {@link DevframeAuthHandler} — the handshake RPC functions, the resolver
+* {@link DevframeAuthHandler}: the handshake RPC functions, the resolver
 * gate, the connect-time trust hook, and the startup banner.
 *
-* The auth storage stays internal to this handler — callers never reach into
+* The auth storage stays internal to this handler; callers never reach into
 * `devframe/node/hub-internals` themselves.
 *
 * ```ts

package/dist/{remote-assets-DezQmPQU.mjs → remote-assets-BIFWOlBW.mjs}

@@ -1,8 +1,8 @@
-import { t as diagnostics } from "./diagnostics-BXWW3VK-.mjs";
+import { t as diagnostics } from "./diagnostics-BMfN8mb1.mjs";
 import { createRequire } from "node:module";
 import { isatty } from "node:tty";
 import { formatWithOptions, inspect } from "node:util";
-import { dirname, extname, join, normalize, sep } from "pathe";
+import { dirname, extname, isAbsolute, join, normalize, resolve, sep } from "pathe";
 import { createReadStream, existsSync } from "node:fs";
 import { Buffer } from "node:buffer";
 import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
@@ -302,7 +302,7 @@ const MANIFEST_FILENAME = ".manifest.json";
 * list is dropped, because it describes the *provider's* transfer rather than
 * the file: hop-by-hop and encoding headers no longer match the body `fetch`
 * already decoded, and a CDN's policy headers (`set-cookie`, `cache-control`,
-* framing/CSP) belong to its origin — replaying them under the dev server's
+* framing/CSP) belong to its origin, so replaying them under the dev server's
 * origin could just as well break the iframe these assets render in.
 */
 const PROXIED_HEADERS = [
@@ -436,6 +436,24 @@ function candidatePaths(prefix, cleaned) {
 	if (!/\.[a-z0-9]+$/i.test(cleaned) && !candidates.includes(`${prefix}index.html`)) candidates.push(`${prefix}index.html`);
 	return candidates;
 }
+/**
+* Resolve the safe destination for a provider-listed `filePath` beneath
+* `prefix`, materializing into the already-resolved `root`, or `null` when
+* the entry is unsafe or lies outside the selected `prefix`. A compromised
+* provider is an untrusted boundary even though the built-in jsDelivr/unpkg
+* listings never emit any of this: reject an absolute path, a backslash
+* (never normalized into a separator; Windows-style traversal stays rejected
+* on every platform), and any suffix whose resolved destination would land
+* outside `root`. `target === root` is deliberately unsafe too: it names the
+* directory itself, never a writable file.
+*/
+function materializeTarget(filePath, prefix, root) {
+	if (filePath.includes("\\") || isAbsolute(filePath) || !filePath.startsWith(prefix)) return null;
+	const suffix = filePath.slice(prefix.length);
+	if (!suffix || isAbsolute(suffix)) return null;
+	const target = resolve(root, suffix);
+	return target === root || !target.startsWith(root + sep) ? null : target;
+}
 function createStore(assets, cacheDir) {
 	const normalized = {
 		...assets,
@@ -582,8 +600,10 @@ function createStore(assets, cacheDir) {
 		} catch (error) {
 			return fail(errText(error), error);
 		}
-		for (const filePath of files.filter((f) => f.startsWith(prefix))) {
-			const target = join(targetDir, filePath.slice(prefix.length));
+		const root = resolve(targetDir);
+		for (const filePath of files) {
+			const target = materializeTarget(filePath, prefix, root);
+			if (target == null) continue;
 			const url = provider.fileUrl(normalized.package, normalized.version, filePath);
 			let res;
 			try {
@@ -625,7 +645,7 @@ function assertValidRemoteAssets(assets) {
 * {@link RemoteAssetsStore} back-proxy. Remote caches live under
 * `<projectStorageDir>/.remote-assets/<package>@<version>/`.
 *
-* A remote source's `package`/`version` are validated first (`DF0065`) — both
+* A remote source's `package`/`version` are validated first (`DF0065`); both
 * are interpolated into CDN URLs and the cache path.
 *
 * `defaultResolveFrom` (typically the declaring devframe's `importMetaUrl`)