devframe 0.9.8 → 0.9.9

package/dist/{remote-assets-B13_vRkJ.d.mts → remote-assets-eBvSKZMS.d.mts}

@@ -6,16 +6,16 @@
  *
  * Resolution order at serve time:
  *
- *   1. The package installed locally (resolved from {@link resolveFrom})
- *      — the zero-network / air-gap path. Version skew warns; a major
+ *   1. The package installed locally (resolved from {@link resolveFrom}),
+ *      the zero-network / air-gap path. Version skew warns; a major
  *      version mismatch throws.
  *   2. The per-file cache under
  *      `<storageDir project>/.remote-assets/<package>@<version>/`.
- *   3. The CDN {@link provider} — each requested file streams through to
+ *   3. The CDN {@link provider}: each requested file streams through to
  *      the browser while being written into the cache.
  *
  * Anywhere a static mount accepts a dist directory (`clientAssets`,
- * `hostStatic`, `mountStatic`) it also accepts this object — see
+ * `hostStatic`, `mountStatic`) it also accepts this object; see
  * {@link StaticAssetsSource}.
  */
 interface RemoteAssets {
@@ -39,7 +39,7 @@ interface RemoteAssets {
    * `import.meta.url` of the declaring module. When set, a locally
    * installed copy of {@link package} is resolved from this module's own
    * dependency graph first (works under pnpm's strict layout) and served
-   * with zero network. Omitting it skips the installed-package step —
+   * with zero network. Omitting it skips the installed-package step;
    * cache + CDN still work.
    */
   resolveFrom?: string | null;
@@ -54,7 +54,7 @@ interface RemoteAssets {
   offline?: boolean;
 }
 /**
- * Built-in CDN providers (`'jsdelivr'` — default, `'unpkg'`) or a custom
+ * Built-in CDN providers (`'jsdelivr'`, the default, or `'unpkg'`) or a custom
  * provider for corp mirrors.
  */
 type RemoteAssetsProvider = 'jsdelivr' | 'unpkg' | RemoteAssetsProviderCustom;
@@ -97,7 +97,7 @@ interface RemoteAssetsErrorMessage {
   reason: string;
 }
 /**
- * A resolved, servable handle over a {@link RemoteAssets} declaration —
+ * A resolved, servable handle over a {@link RemoteAssets} declaration,
  * produced by `resolveStaticAssetsSource()` (`devframe/utils/remote-assets`)
  * and consumed by the static-serving engine (`devframe/utils/serve-static`).
  */

package/dist/{revoke-COLW0cOi.mjs → revoke-cqztiCX4.mjs}

@@ -1,4 +1,4 @@
-import { t as DEVFRAME_EVENTS } from "./events-4daw0uK9.mjs";
+import { t as DEVFRAME_EVENTS } from "./events-BV4Dj59a.mjs";
 //#region src/node/auth/revoke.ts
 /**
 * Flip `isTrusted` to false on any live WS clients connected with `token`

package/dist/rpc/dump.d.mts

@@ -1,14 +1,5 @@
-import { h as RpcDumpStore, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny } from "../types-CMdPYhOx.mjs";
+import { h as RpcDumpStore, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny } from "../types-Dq4i156u.mjs";
 //#region src/rpc/dump/collect.d.ts
-/**
- * Collects pre-computed dumps by executing functions with their defined input combinations.
- * Static functions without dump config automatically get `{ inputs: [[]] }`.
- *
- * @example
- * ```ts
- * const store = await dumpFunctions([greet], context, { concurrency: 10 })
- * ```
- */
 declare function dumpFunctions<T extends readonly RpcFunctionDefinitionAny[]>(definitions: T, context?: any, options?: RpcDumpCollectionOptions): Promise<RpcDumpStore<RpcDefinitionsToFunctions<T>>>;
 /**
  * Creates a client that serves pre-computed results from a dump store.
@@ -64,7 +55,7 @@ type StaticRpcDumpManifest = Record<string, StaticRpcDumpManifestValue>;
 interface StaticRpcDumpFile {
   /** Whether this file was written via `JSON.stringify` or `structured-clone-es.stringify`. */
   serialization: StaticRpcDumpSerialization;
-  /** Function name the file belongs to — used to scope `DF0019` errors during write. */
+  /** Function name the file belongs to, used to scope `DF0019` errors during write. */
   fnName: string;
   /** Payload to encode. */
   data: unknown;

package/dist/rpc/dump.mjs

@@ -1,2 +1,2 @@
-import { a as reviveDumpError, i as getDefinitionsWithDumps, n as createClientFromDump, o as serializeDumpError, r as dumpFunctions, t as collectStaticRpcDump } from "../static-DV_qUSRS.mjs";
+import { a as reviveDumpError, i as getDefinitionsWithDumps, n as createClientFromDump, o as serializeDumpError, r as dumpFunctions, t as collectStaticRpcDump } from "../static-DZ8P2Kn7.mjs";
 export { collectStaticRpcDump, createClientFromDump, dumpFunctions, getDefinitionsWithDumps, reviveDumpError, serializeDumpError };

package/dist/rpc/index.d.mts

@@ -1,3 +1,3 @@
-import { a as STRUCTURED_CLONE_PREFIX, c as getRpcResolvedSetupResult, d as RpcFunctionsCollectorBase, f as RpcCacheManager, i as validateRpcReturn, l as createDefineWrapperWithContext, n as validateDefinitions, o as strictJsonStringify, p as RpcCacheOptions, r as validateRpcArgs, s as getRpcHandler, t as validateDefinition, u as defineRpcFunction } from "../index-BzyopqxV.mjs";
-import { C as RpcFunctionType, E as Thenable, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinition, a as RpcDefinitionsFilter, b as RpcFunctionDefinitionBase, c as RpcDump, d as RpcDumpDefinition, f as RpcDumpGetter, g as RpcFunctionAgentOptions, h as RpcDumpStore, i as RpcArgsSchema, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, p as RpcDumpRecord, r as EntriesToObject, s as RpcDefinitionsToFunctionsWithNamespace, t as BirpcFn, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny, w as RpcFunctionsCollector, x as RpcFunctionDefinitionToFunction, y as RpcFunctionDefinitionAnyWithContext } from "../types-CMdPYhOx.mjs";
+import { a as STRUCTURED_CLONE_PREFIX, c as getRpcResolvedSetupResult, d as RpcFunctionsCollectorBase, f as RpcCacheManager, i as validateRpcReturn, l as createDefineWrapperWithContext, n as validateDefinitions, o as strictJsonStringify, p as RpcCacheOptions, r as validateRpcArgs, s as getRpcHandler, t as validateDefinition, u as defineRpcFunction } from "../index-pIVt92jP.mjs";
+import { C as RpcFunctionType, E as Thenable, S as RpcFunctionSetupResult, T as RpcReturnSchema, _ as RpcFunctionDefinition, a as RpcDefinitionsFilter, b as RpcFunctionDefinitionBase, c as RpcDump, d as RpcDumpDefinition, f as RpcDumpGetter, g as RpcFunctionAgentOptions, h as RpcDumpStore, i as RpcArgsSchema, l as RpcDumpClientOptions, m as RpcDumpRecordError, n as BirpcReturn, o as RpcDefinitionsToFunctions, p as RpcDumpRecord, r as EntriesToObject, s as RpcDefinitionsToFunctionsWithNamespace, t as BirpcFn, u as RpcDumpCollectionOptions, v as RpcFunctionDefinitionAny, w as RpcFunctionsCollector, x as RpcFunctionDefinitionToFunction, y as RpcFunctionDefinitionAnyWithContext } from "../types-Dq4i156u.mjs";
 export { type BirpcFn, type BirpcReturn, EntriesToObject, RpcArgsSchema, RpcCacheManager, RpcCacheOptions, RpcDefinitionsFilter, RpcDefinitionsToFunctions, RpcDefinitionsToFunctionsWithNamespace, RpcDump, RpcDumpClientOptions, RpcDumpCollectionOptions, RpcDumpDefinition, RpcDumpGetter, RpcDumpRecord, RpcDumpRecordError, RpcDumpStore, RpcFunctionAgentOptions, RpcFunctionDefinition, RpcFunctionDefinitionAny, RpcFunctionDefinitionAnyWithContext, RpcFunctionDefinitionBase, RpcFunctionDefinitionToFunction, RpcFunctionSetupResult, RpcFunctionType, RpcFunctionsCollector, RpcFunctionsCollectorBase, RpcReturnSchema, STRUCTURED_CLONE_PREFIX, Thenable, createDefineWrapperWithContext, defineRpcFunction, getRpcHandler, getRpcResolvedSetupResult, strictJsonStringify, validateDefinition, validateDefinitions, validateRpcArgs, validateRpcReturn };

package/dist/rpc/index.mjs

@@ -1,7 +1,7 @@
-import { a as validateRpcArgs, i as getRpcResolvedSetupResult, n as validateDefinitions, o as validateRpcReturn, r as getRpcHandler, s as hash, t as validateDefinition } from "../validation-YrZH6atx.mjs";
-import { t as diagnostics } from "../diagnostics-CD8nlgll.mjs";
+import { a as validateRpcArgs, i as getRpcResolvedSetupResult, n as validateDefinitions, o as validateRpcReturn, r as getRpcHandler, s as hash, t as validateDefinition } from "../validation-BOy8IoFZ.mjs";
+import { t as diagnostics } from "../diagnostics-D0EVm5M6.mjs";
 import { n as defineRpcFunction, t as createDefineWrapperWithContext } from "../define-BLWPsH6y.mjs";
-import { n as strictJsonStringify, t as STRUCTURED_CLONE_PREFIX } from "../serialization-BGzEwAdr.mjs";
+import { n as strictJsonStringify, t as STRUCTURED_CLONE_PREFIX } from "../serialization-DTZnPQ1-.mjs";
 //#region src/rpc/cache.ts
 /**
 * @experimental API is expected to change.

package/dist/rpc/transports/sse-client.d.mts

@@ -1,2 +1,2 @@
-import { n as createSseRpcChannel, t as SseRpcChannelOptions } from "../../sse-client-DwX021ST.mjs";
+import { n as createSseRpcChannel, t as SseRpcChannelOptions } from "../../sse-client-BQ4jS3eO.mjs";
 export { SseRpcChannelOptions, createSseRpcChannel };

package/dist/rpc/transports/sse-client.mjs

@@ -1,10 +1,33 @@
 import { DEVFRAME_AUTH_TOKEN_QUERY_PARAM, DEVFRAME_SSE_SESSION_HEADER } from "../../constants.mjs";
-import { t as createRpcWireCodec } from "../../wire-codec-0K-o5MYW.mjs";
+import { t as createRpcWireCodec } from "../../wire-codec-dcCeXcSo.mjs";
 //#region src/rpc/transports/sse-client.ts
 function NOOP() {}
+/** Split the next complete SSE frame (up to a blank line) off the buffer. */
+function takeFrame(buffer) {
+	const boundary = buffer.search(/\n\n|\r\n\r\n/);
+	if (boundary < 0) return void 0;
+	return {
+		frame: buffer.slice(0, boundary),
+		rest: buffer.slice(boundary + (buffer[boundary] === "\r" ? 4 : 2))
+	};
+}
+/** Parse one SSE frame's lines into its event name and data lines. */
+function parseFrame(frame) {
+	let event = "message";
+	const data = [];
+	for (const rawLine of frame.split(/\r?\n/)) {
+		if (rawLine.startsWith(":")) continue;
+		if (rawLine.startsWith("event:")) event = rawLine.slice(6).trimStart();
+		else if (rawLine.startsWith("data:")) data.push(rawLine.slice(5).replace(/^ /, ""));
+	}
+	return {
+		event,
+		data
+	};
+}
 /**
 * Build a birpc `ChannelOptions` object backed by an SSE stream (server →
-* client) and HTTP `POST` (client → server) — the WebSocket-free counterpart
+* client) and HTTP `POST` (client → server): the WebSocket-free counterpart
 * to `createWsRpcChannel`, wire-compatible with `attachSseRpcTransport`.
 *
 * The stream is consumed via `fetch` streaming (not `EventSource`), so it
@@ -12,7 +35,7 @@ function NOOP() {}
 * (`event: session`) carries the session id; every `POST` echoes it in the
 * `x-birpc-session` header. A response to a client-initiated request comes
 * back in the `POST`'s own body and is re-injected into the channel; a
-* dropped stream terminates the channel — there is no reconnect, matching
+* dropped stream terminates the channel; there is no reconnect, matching
 * the WS channel's closed-is-done semantics.
 */
 function createSseRpcChannel(options) {
@@ -63,17 +86,10 @@ function createSseRpcChannel(options) {
 			if (done) break;
 			buffer += decoder.decode(value, { stream: true });
 			for (;;) {
-				const boundary = buffer.search(/\n\n|\r\n\r\n/);
-				if (boundary < 0) break;
-				const frame = buffer.slice(0, boundary);
-				buffer = buffer.slice(boundary + (buffer[boundary] === "\r" ? 4 : 2));
-				let event = "message";
-				const data = [];
-				for (const rawLine of frame.split(/\r?\n/)) {
-					if (rawLine.startsWith(":")) continue;
-					if (rawLine.startsWith("event:")) event = rawLine.slice(6).trimStart();
-					else if (rawLine.startsWith("data:")) data.push(rawLine.slice(5).replace(/^ /, ""));
-				}
+				const taken = takeFrame(buffer);
+				if (!taken) break;
+				buffer = taken.rest;
+				const { event, data } = parseFrame(taken.frame);
 				if (data.length > 0) dispatch(event, data.join("\n"));
 			}
 		}

package/dist/rpc/transports/sse-server.d.mts

@@ -1,5 +1,5 @@
-import { v as RpcFunctionDefinitionAny } from "../../types-CMdPYhOx.mjs";
-import { d as DevframeRpcConnection, n as WsOriginRegistry, u as DevframeNodeRpcSessionMeta } from "../../ws-server-VyHlanzy.mjs";
+import { v as RpcFunctionDefinitionAny } from "../../types-Dq4i156u.mjs";
+import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection, n as WsOriginRegistry } from "../../ws-server-D2nv68Hg.mjs";
 import { BirpcGroup } from "birpc";
 //#region src/rpc/transports/sse-server.d.ts
 interface SseRpcTransportOptions {
@@ -14,7 +14,7 @@ interface SseRpcTransportOptions {
    * RPC function definitions, used by the per-call wire serializer to
    * dispatch between strict-JSON and structured-clone encoding based on
    * each function's `jsonSerializable` flag. When omitted, all messages
-   * fall back to structured-clone — same contract as the WS transport.
+   * fall back to structured-clone, the same contract as the WS transport.
    */
   definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>;
   onConnected?: (connection: DevframeRpcConnection, meta: DevframeNodeRpcSessionMeta) => void;
@@ -42,7 +42,7 @@ interface SseRpcTransport {
   close: () => void;
 }
 /**
- * Attach an SSE + HTTP POST transport to an existing RPC group — the
+ * Attach an SSE + HTTP POST transport to an existing RPC group: the
  * WebSocket-free counterpart to `attachWsRpcTransport`, for hosts and
  * proxies where the upgrade isn't available. Speaks the same birpc wire
  * protocol (one channel per session, per-method `jsonSerializable`

package/dist/rpc/transports/sse-server.mjs

@@ -1,15 +1,17 @@
 import { DEVFRAME_SSE_SESSION_HEADER } from "../../constants.mjs";
-import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../../wire-codec-0K-o5MYW.mjs";
-import { i as isAllowedOrigin, o as createRpcSessionMeta } from "../../ws-server-Y_AumUQH.mjs";
+import { n as peekRpcWireFrame, t as createRpcWireCodec } from "../../wire-codec-dcCeXcSo.mjs";
+import { t as isAllowedOrigin } from "../../origin-DZit9g29.mjs";
+import { t as createRpcSessionMeta } from "../../session-DPfj6zQG.mjs";
 //#region src/rpc/transports/sse-server.ts
 const SSE_STREAM_HEADERS = {
 	"content-type": "text/event-stream",
 	"cache-control": "no-cache, no-transform",
+	/** Tell buffering reverse proxies (nginx) to pass frames through as-is. */
 	"x-accel-buffering": "no"
 };
 function NOOP() {}
 /**
-* Attach an SSE + HTTP POST transport to an existing RPC group — the
+* Attach an SSE + HTTP POST transport to an existing RPC group: the
 * WebSocket-free counterpart to `attachWsRpcTransport`, for hosts and
 * proxies where the upgrade isn't available. Speaks the same birpc wire
 * protocol (one channel per session, per-method `jsonSerializable`
@@ -33,7 +35,7 @@ function attachSseRpcTransport(rpcGroup, options = {}) {
 		return allowedOrigins && !Array.isArray(allowedOrigins) ? allowedOrigins.isAllowed(origin) : isAllowedOrigin(origin, allowedOrigins ?? []);
 	}
 	/**
-	* CORS headers for a browser on another (allowed) origin — the side-car /
+	* CORS headers for a browser on another (allowed) origin: the side-car /
 	* registered-viewer case. Same-origin requests carry no `Origin` (or their
 	* own), where these headers are inert.
 	*/
@@ -65,8 +67,6 @@ function attachSseRpcTransport(rpcGroup, options = {}) {
 		const session = {
 			id,
 			meta,
-			connection: void 0,
-			channel: void 0,
 			parked: /* @__PURE__ */ new Map(),
 			closed: false,
 			close: () => {
@@ -80,7 +80,7 @@ function attachSseRpcTransport(rpcGroup, options = {}) {
 					controller?.close();
 				} catch {}
 				rpcGroup.updateChannels((channels) => {
-					const index = channels.indexOf(session.channel);
+					const index = session.channel ? channels.indexOf(session.channel) : -1;
 					if (index >= 0) channels.splice(index, 1);
 				});
 				onDisconnected(session.connection, meta);

package/dist/rpc/transports/ws-bun.d.mts

@@ -1,5 +1,5 @@
-import { n as WsOriginRegistry } from "../../ws-server-VyHlanzy.mjs";
-import { t as ContextRpcServer } from "../../rpc-core-B3W3z9ff.mjs";
+import { n as WsOriginRegistry } from "../../ws-server-D2nv68Hg.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-Ceu6AUz8.mjs";
 //#region src/rpc/transports/ws-bun.d.ts
 interface AttachBunWsTransportOptions {
   /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */
@@ -7,7 +7,7 @@ interface AttachBunWsTransportOptions {
 }
 /**
  * Structural view of the Bun `Bun.serve({ websocket })` handler object the
- * crossws Bun adapter produces — typed loosely so devframe carries no
+ * crossws Bun adapter produces, typed loosely so devframe carries no
  * dependency on Bun's own types.
  */
 interface BunWsTierWebSocket {
@@ -17,14 +17,14 @@ interface BunWsTierWebSocket {
   drain?: (ws: unknown) => unknown;
 }
 interface BunWsTier {
-  /** Complete a WS upgrade request — `Bun.serve`'s server as 2nd argument. */
+  /** Complete a WS upgrade request; `Bun.serve`'s server as 2nd argument. */
   handleUpgrade: (request: Request, server: unknown) => Promise<Response | undefined>;
   /** The handlers to spread into `Bun.serve({ websocket })`. */
   websocket: BunWsTierWebSocket;
   close: () => Promise<void>;
 }
 /**
- * The Bun fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the
+ * The Bun fetch-upgrade WebSocket tier for `initDevframe` / `initHub`: the
  * same RPC peer wiring as `attachWsRpcTransport`, driven by crossws's Bun
  * adapter so upgrades complete through `handler(request, server)` on the
  * app's own origin, with no side-car server. Load it dynamically so the Bun

package/dist/rpc/transports/ws-bun.mjs

@@ -1,7 +1,8 @@
-import { i as isAllowedOrigin, r as createWsRpcPeerHooks } from "../../ws-server-Y_AumUQH.mjs";
+import { t as isAllowedOrigin } from "../../origin-DZit9g29.mjs";
+import { createWsRpcPeerHooks } from "./ws-server.mjs";
 //#region src/rpc/transports/ws-bun.ts
 /**
-* The Bun fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the
+* The Bun fetch-upgrade WebSocket tier for `initDevframe` / `initHub`: the
 * same RPC peer wiring as `attachWsRpcTransport`, driven by crossws's Bun
 * adapter so upgrades complete through `handler(request, server)` on the
 * app's own origin, with no side-car server. Load it dynamically so the Bun
@@ -15,6 +16,11 @@ async function attachBunWsTransport(core, options = {}) {
 			onConnected: core.onConnected,
 			onDisconnected: core.onDisconnected
 		}),
+		/**
+		* The same origin policy `routeUpgrades` applies for the Node
+		* transport, enforced at the upgrade hook since Bun upgrades arrive
+		* as fetch requests rather than `upgrade` socket events.
+		*/
 		upgrade(request) {
 			const origin = request.headers.get("origin") ?? void 0;
 			const allowed = allowedOrigins && !Array.isArray(allowedOrigins) ? allowedOrigins.isAllowed(origin) : isAllowedOrigin(origin, allowedOrigins || []);

package/dist/rpc/transports/ws-client.d.mts

@@ -1,2 +1,2 @@
-import { n as createWsRpcChannel, t as WsRpcChannelOptions } from "../../ws-client-7_lZi-B9.mjs";
+import { n as createWsRpcChannel, t as WsRpcChannelOptions } from "../../ws-client-Xpxt0oPA.mjs";
 export { WsRpcChannelOptions, createWsRpcChannel };

package/dist/rpc/transports/ws-client.mjs

@@ -1,5 +1,5 @@
 import { DEVFRAME_AUTH_TOKEN_QUERY_PARAM } from "../../constants.mjs";
-import { t as createRpcWireCodec } from "../../wire-codec-0K-o5MYW.mjs";
+import { t as createRpcWireCodec } from "../../wire-codec-dcCeXcSo.mjs";
 //#region src/rpc/transports/ws-client.ts
 function NOOP() {}
 const EMPTY_DEFS = /* @__PURE__ */ new Map();
@@ -7,7 +7,7 @@ const EMPTY_DEFS = /* @__PURE__ */ new Map();
 * Build a birpc `ChannelOptions` object backed by a browser `WebSocket`.
 * Pass the result straight to `createRpcClient`'s `channel` option.
 *
-* Also returns `close()`, closing the underlying socket — mirroring the server transport's
+* Also returns `close()`, closing the underlying socket, mirroring the server transport's
 * existing `WsRpcTransport.close()`. `birpc`'s own `ChannelOptions` has no teardown of its own.
 */
 function createWsRpcChannel(options) {

package/dist/rpc/transports/ws-deno.d.mts

@@ -1,5 +1,5 @@
-import { n as WsOriginRegistry } from "../../ws-server-VyHlanzy.mjs";
-import { t as ContextRpcServer } from "../../rpc-core-B3W3z9ff.mjs";
+import { n as WsOriginRegistry } from "../../ws-server-D2nv68Hg.mjs";
+import { t as ContextRpcServer } from "../../rpc-core-Ceu6AUz8.mjs";
 //#region src/rpc/transports/ws-deno.d.ts
 interface AttachDenoWsTransportOptions {
   /** Same contract as `WsRpcTransportOptions.allowedOrigins`. */
@@ -7,7 +7,7 @@ interface AttachDenoWsTransportOptions {
 }
 interface DenoWsTier {
   /**
-   * Complete a WS upgrade request — `Deno.serve`'s handler info as the 2nd
+   * Complete a WS upgrade request; `Deno.serve`'s handler info as the 2nd
    * argument. Unlike Bun, Deno's adapter attaches the socket to the returned
    * `Response` itself, so there is no `websocket` handler object to register.
    */
@@ -15,7 +15,7 @@ interface DenoWsTier {
   close: () => Promise<void>;
 }
 /**
- * The Deno fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the
+ * The Deno fetch-upgrade WebSocket tier for `initDevframe` / `initHub`: the
  * same RPC peer wiring as `attachWsRpcTransport`, driven by crossws's Deno
  * adapter so upgrades complete through `handleUpgrade(request, info)` on the
  * app's own origin, with no side-car server. Load it dynamically so the Deno

package/dist/rpc/transports/ws-deno.mjs

@@ -1,7 +1,8 @@
-import { i as isAllowedOrigin, r as createWsRpcPeerHooks } from "../../ws-server-Y_AumUQH.mjs";
+import { t as isAllowedOrigin } from "../../origin-DZit9g29.mjs";
+import { createWsRpcPeerHooks } from "./ws-server.mjs";
 //#region src/rpc/transports/ws-deno.ts
 /**
-* The Deno fetch-upgrade WebSocket tier for `initDevframe` / `initHub` — the
+* The Deno fetch-upgrade WebSocket tier for `initDevframe` / `initHub`: the
 * same RPC peer wiring as `attachWsRpcTransport`, driven by crossws's Deno
 * adapter so upgrades complete through `handleUpgrade(request, info)` on the
 * app's own origin, with no side-car server. Load it dynamically so the Deno
@@ -15,6 +16,11 @@ async function attachDenoWsTransport(core, options = {}) {
 			onConnected: core.onConnected,
 			onDisconnected: core.onDisconnected
 		}),
+		/**
+		* The same origin policy `routeUpgrades` applies for the Node
+		* transport, enforced at the upgrade hook since Deno upgrades arrive
+		* as fetch requests rather than `upgrade` socket events.
+		*/
 		upgrade(request) {
 			const origin = request.headers.get("origin") ?? void 0;
 			const allowed = allowedOrigins && !Array.isArray(allowedOrigins) ? allowedOrigins.isAllowed(origin) : isAllowedOrigin(origin, allowedOrigins || []);

package/dist/rpc/transports/ws-server.d.mts

@@ -1,2 +1,3 @@
-import { a as attachWsRpcTransport, c as isAllowedOrigin, d as DevframeRpcConnection, f as DevframeRpcConnectionRequest, i as WsRpcTransportOptions, l as isLoopbackHostname, n as WsOriginRegistry, o as createWsOriginRegistry, p as DevframeRpcTransportKind, r as WsRpcTransport, s as createWsRpcPeerHooks, t as CreateWsOriginRegistryOptions, u as DevframeNodeRpcSessionMeta } from "../../ws-server-VyHlanzy.mjs";
+import { a as attachWsRpcTransport, c as DevframeNodeRpcSessionMeta, d as DevframeRpcTransportKind, i as WsRpcTransportOptions, l as DevframeRpcConnection, n as WsOriginRegistry, o as createWsOriginRegistry, r as WsRpcTransport, s as createWsRpcPeerHooks, t as CreateWsOriginRegistryOptions, u as DevframeRpcConnectionRequest } from "../../ws-server-D2nv68Hg.mjs";
+import { n as isLoopbackHostname, t as isAllowedOrigin } from "../../origin-DGDH8BI9.mjs";
 export { CreateWsOriginRegistryOptions, type DevframeNodeRpcSessionMeta, type DevframeRpcConnection, type DevframeRpcConnectionRequest, type DevframeRpcTransportKind, WsOriginRegistry, WsRpcTransport, WsRpcTransportOptions, attachWsRpcTransport, createWsOriginRegistry, createWsRpcPeerHooks, isAllowedOrigin, isLoopbackHostname };

package/dist/rpc/transports/ws-server.mjs

@@ -1,2 +1,233 @@
-import { a as isLoopbackHostname, i as isAllowedOrigin, n as createWsOriginRegistry, r as createWsRpcPeerHooks, t as attachWsRpcTransport } from "../../ws-server-Y_AumUQH.mjs";
+import "../../constants.mjs";
+import { t as createRpcWireCodec } from "../../wire-codec-dcCeXcSo.mjs";
+import { n as isLoopbackHostname, t as isAllowedOrigin } from "../../origin-DZit9g29.mjs";
+import { t as createRpcSessionMeta } from "../../session-DPfj6zQG.mjs";
+import { n as randomToken, r as timingSafeEqual } from "../../crypto-token-TVbGGFuj.mjs";
+import { createServer } from "node:http";
+import { createServer as createServer$1 } from "node:https";
+import crossws from "crossws/adapters/node";
+//#region src/rpc/transports/ws-server.ts
+/**
+* Create a live, token-protected origin allowlist for external browser
+* viewers. Pass it to {@link WsRpcTransportOptions.allowedOrigins}, then use
+* `registerFromUrl()` in the connection metadata handler to authorize a
+* viewer without sharing a mutable array or disabling DNS-rebinding protection.
+*/
+function createWsOriginRegistry(options = {}) {
+	const token = randomToken();
+	const origins = new Set(options.allowedOrigins ?? []);
+	function normalizeOrigin(origin) {
+		if (!origin) return;
+		try {
+			const url = new URL(origin);
+			const normalized = url.origin === "null" ? `${url.protocol}//${url.host}` : url.origin;
+			return origin === normalized ? normalized : void 0;
+		} catch {}
+	}
+	function registerOrigin(origin, candidateToken) {
+		const normalized = normalizeOrigin(origin);
+		if (!normalized || !candidateToken || !timingSafeEqual(token, candidateToken)) return false;
+		if (options.validateOrigin && !options.validateOrigin(normalized)) return false;
+		origins.add(normalized);
+		return true;
+	}
+	return {
+		token,
+		registerFromUrl(url) {
+			let parsed;
+			try {
+				parsed = new URL(url, "http://localhost");
+			} catch {
+				return;
+			}
+			const origin = parsed.searchParams.get("devframe_viewer_origin") ?? void 0;
+			return registerOrigin(origin, parsed.searchParams.get("devframe_viewer_origin_token") ?? void 0) ? origin : void 0;
+		},
+		isAllowed(origin) {
+			return isAllowedOrigin(origin, [...origins]);
+		}
+	};
+}
+const EMPTY_DEFS = /* @__PURE__ */ new Map();
+function NOOP() {}
+function listen(server, port, host) {
+	return new Promise((resolve, reject) => {
+		const onError = (error) => reject(error);
+		server.once("error", onError);
+		try {
+			server.listen(port, host, () => {
+				server.off("error", onError);
+				resolve();
+			});
+		} catch (error) {
+			server.off("error", onError);
+			reject(error);
+		}
+	});
+}
+/** Compare two URL paths ignoring a trailing slash. */
+function pathMatches(a, b) {
+	const strip = (p) => p.length > 1 && p.endsWith("/") ? p.slice(0, -1) : p;
+	return strip(a) === strip(b);
+}
+function isWsOriginRegistry(value) {
+	return !!value && !Array.isArray(value);
+}
+/**
+* Build the `upgrade` listener that hands a request to the crossws adapter,
+* optionally filtered to a single `path`. Non-matching requests are left
+* untouched so other upgrade listeners (e.g. a Vite dev server's HMR socket)
+* can claim them, unless `destroyUnmatched` is set.
+*/
+function createUpgradeListener(ws, path, destroyUnmatched, allowedOrigins) {
+	return (req, socket, head) => {
+		socket.on("error", () => {});
+		if (path) {
+			let pathname = req.url ?? "/";
+			try {
+				pathname = new URL(req.url ?? "/", "http://localhost").pathname;
+			} catch {}
+			if (!pathMatches(pathname, path)) {
+				if (destroyUnmatched) {
+					socket.write("HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n");
+					socket.destroy();
+				}
+				return;
+			}
+		}
+		const originAllowed = isWsOriginRegistry(allowedOrigins) ? allowedOrigins.isAllowed(req.headers.origin) : isAllowedOrigin(req.headers.origin, allowedOrigins || []);
+		if (allowedOrigins !== false && !originAllowed) {
+			socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+			socket.destroy();
+			return;
+		}
+		ws.handleUpgrade(req, socket, head);
+	};
+}
+/**
+* The per-peer lifecycle hooks driving a devframe RPC WebSocket, shaped for
+* any [crossws](https://crossws.h3.dev) adapter. {@link attachWsRpcTransport}
+* feeds them to the Node adapter; runtime-specific attachments (e.g. Bun's
+* fetch-upgrade adapter) reuse the same hooks so every transport speaks the
+* identical wire protocol: one birpc channel per peer, per-method
+* `jsonSerializable` dispatch between strict JSON and structured-clone.
+*/
+function createWsRpcPeerHooks(rpcGroup, options = {}) {
+	const { onConnected = NOOP, onDisconnected = NOOP, definitions = EMPTY_DEFS, serialize: serializeOverride, deserialize: deserializeOverride } = options;
+	const states = /* @__PURE__ */ new WeakMap();
+	return {
+		open: (peer) => {
+			const meta = createRpcSessionMeta();
+			meta.peer = peer;
+			const connection = {
+				id: meta.id,
+				transport: "websocket",
+				request: peer.request,
+				send: (data) => peer.send(data),
+				close: (code, reason) => peer.close(code, reason),
+				peer
+			};
+			const codec = createRpcWireCodec(definitions);
+			const state = {
+				meta,
+				connection
+			};
+			const channel = {
+				post: (data) => {
+					peer.send(data);
+				},
+				on: (fn) => {
+					state.onMessage = fn;
+				},
+				serialize: serializeOverride ?? codec.serialize,
+				deserialize: deserializeOverride ?? codec.deserialize,
+				meta
+			};
+			state.channel = channel;
+			states.set(peer, state);
+			rpcGroup.updateChannels((channels) => {
+				channels.push(channel);
+			});
+			onConnected(connection, meta);
+		},
+		message: (peer, message) => {
+			states.get(peer)?.onMessage?.(message.text());
+		},
+		close: (peer) => {
+			const state = states.get(peer);
+			if (!state) return;
+			states.delete(peer);
+			rpcGroup.updateChannels((channels) => {
+				const index = state.channel ? channels.indexOf(state.channel) : -1;
+				if (index >= 0) channels.splice(index, 1);
+			});
+			onDisconnected(state.connection, state.meta);
+		}
+	};
+}
+/**
+* Attach a WebSocket transport to an existing RPC group, powered by
+* [crossws](https://crossws.h3.dev). Either attach to an existing HTTP(S)
+* `server` (sharing its port, optionally scoped to a `path`), or let this
+* helper create a standalone server from `port` / `host` / `https`.
+*
+* Returns the crossws node adapter, standalone-server readiness/address
+* accessors, `detach` (remove the upgrade listener from a shared `server`),
+* and `close` (full deterministic teardown).
+*/
+function attachWsRpcTransport(rpcGroup, options = {}) {
+	const { server, port, host = "localhost", path, destroyUnmatched = false, unbound, https, allowedOrigins } = options;
+	const ws = crossws({ hooks: createWsRpcPeerHooks(rpcGroup, options) });
+	const sharedUpgradeListener = createUpgradeListener(ws, path, destroyUnmatched, allowedOrigins);
+	const ownedUpgradeListener = createUpgradeListener(ws, path, true, allowedOrigins);
+	/** Bind a server's `upgrade` events, tracked so `close()` detaches them. */
+	const attachments = /* @__PURE__ */ new Set();
+	function attachTo(target, listener) {
+		target.on("upgrade", listener);
+		const detachOne = () => {
+			target.off("upgrade", listener);
+			attachments.delete(detachOne);
+		};
+		attachments.add(detachOne);
+		return detachOne;
+	}
+	let ready = Promise.resolve();
+	let ownedServer;
+	if (unbound) {} else if (server) attachTo(server, sharedUpgradeListener);
+	else if (https) {
+		ownedServer = createServer$1(https);
+		attachTo(ownedServer, ownedUpgradeListener);
+		ready = listen(ownedServer, port ?? 0, host);
+	} else {
+		ownedServer = createServer((_req, res) => {
+			res.writeHead(426, { "content-type": "text/plain" });
+			res.end("Upgrade Required");
+		});
+		attachTo(ownedServer, ownedUpgradeListener);
+		ready = listen(ownedServer, port ?? 0, host);
+	}
+	const activeServer = server ?? ownedServer;
+	function detachAll() {
+		for (const detachOne of [...attachments]) detachOne();
+	}
+	return {
+		ws,
+		ready,
+		address: () => activeServer?.address() ?? null,
+		handleUpgrade: sharedUpgradeListener,
+		attach: (target) => attachTo(target, sharedUpgradeListener),
+		detach: detachAll,
+		async close() {
+			detachAll();
+			ws.closeAll(void 0, void 0, true);
+			if (ownedServer) {
+				const srv = ownedServer;
+				await ready.catch(() => {});
+				if (!srv.listening) return;
+				await new Promise((r) => srv.close(() => r()));
+			}
+		}
+	};
+}
+//#endregion
 export { attachWsRpcTransport, createWsOriginRegistry, createWsRpcPeerHooks, isAllowedOrigin, isLoopbackHostname };

package/dist/{rpc-core-B3W3z9ff.d.mts → rpc-core-Ceu6AUz8.d.mts}

@@ -1,6 +1,6 @@
-import { d as DevframeRpcConnection, u as DevframeNodeRpcSessionMeta } from "./ws-server-VyHlanzy.mjs";
-import { Ct as DevframeAuthHandler, _t as DevframeRpcServerFunctions, gt as DevframeRpcClientFunctions, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "./context-CLF4-8Pp.mjs";
-import "./index-D3k0BIhe.mjs";
+import { c as DevframeNodeRpcSessionMeta, l as DevframeRpcConnection } from "./ws-server-D2nv68Hg.mjs";
+import { _t as DevframeRpcClientFunctions, o as DevframeNodeContext, s as DevframeNodeRpcSession, vt as DevframeRpcServerFunctions, wt as DevframeAuthHandler } from "./context-4AIVRLYF.mjs";
+import "./index-pKl67H6w.mjs";
 import { BirpcGroup, EventOptions } from "birpc";
 //#region src/node/rpc-core.d.ts
 interface CreateContextRpcServerOptions {
@@ -33,7 +33,7 @@ interface ContextRpcServer {
 }
 /**
  * Bind a devframe context's registered RPC functions to a birpc group,
- * transport-agnostically — the shared core under the instance shell's own
+ * transport-agnostically: the shared core under the instance shell's own
  * HTTP+WS binding (Node http + WS) and the Bun fetch-upgrade tier of
  * `createHandler`.
  *