devframe 1.3.1 → 1.3.3

package/dist/utils/debounce.mjs

@@ -1,4 +1,4 @@
-//#region ../../node_modules/.pnpm/perfect-debounce@2.1.0/node_modules/perfect-debounce/dist/index.mjs
+// ../../node_modules/.pnpm/perfect-debounce@2.1.0/node_modules/perfect-debounce/dist/index.mjs
 const DEBOUNCE_DEFAULTS = { trailing: true };
 /**
 Debounce functions
@@ -84,5 +84,4 @@ function debounce(fn, wait = 25, options = {}) {
 async function _applyPromised(fn, _this, args) {
 	return await fn.apply(_this, args);
 }
-//#endregion
 export { debounce };

package/dist/utils/events.d.mts

@@ -1,7 +1,5 @@
-import { in as EventsMap, nn as EventEmitter } from "../context-BNxFOPbX.mjs";
-//#region src/utils/events.d.ts
+import { in as EventsMap, nn as EventEmitter } from "../index-BhUqJUHG.mjs";
 /**
  * Create event emitter.
  */
-export declare function createEventEmitter<Events extends EventsMap>(): EventEmitter<Events>;
-//#endregion
+export declare function createEventEmitter<Events extends EventsMap>(): EventEmitter<Events>;

package/dist/utils/events.mjs

@@ -1,4 +1,4 @@
-//#region src/utils/events.ts
+// src/utils/events.ts
 /**
 * Create event emitter.
 */
@@ -36,5 +36,4 @@ function createEventEmitter() {
 		once
 	};
 }
-//#endregion
 export { createEventEmitter };

package/dist/utils/get-port.d.mts

@@ -1,4 +1,3 @@
-//#region ../../node_modules/.pnpm/get-port-please@3.2.0/node_modules/get-port-please/dist/index.d.mts
 interface GetPortOptions {
   name: string;
   random: boolean;
@@ -13,5 +12,4 @@ interface GetPortOptions {
 type GetPortInput = Partial<GetPortOptions> | number | string;
 type PortNumber = number;
 declare function getPort(_userOptions?: GetPortInput): Promise<PortNumber>;
-//#endregion
 export { type GetPortInput, type GetPortOptions, getPort };

package/dist/utils/get-port.mjs

@@ -1,2 +1 @@
-import { n as getPort } from "../dist-CZXfGEkd.mjs";
-export { getPort };
+export { n as getPort } from "../dist-CZ-TySHD.mjs";

package/dist/utils/hash.d.mts

@@ -1,6 +1,4 @@
-//#region src/utils/hash.d.ts
 /**
  * Stable, deterministic hash of any structured-cloneable value.
  */
-export declare function hash(value: unknown): string;
-//#endregion
+export declare function hash(value: unknown): string;

package/dist/utils/hash.mjs

@@ -1,2 +1 @@
-import { t as hash } from "../hash-DdPnc4k3.mjs";
-export { hash };
+export { t as hash } from "../hash-DHqpWeMO.mjs";

package/dist/utils/launch-editor.d.mts

@@ -1,4 +1,3 @@
-//#region src/utils/launch-editor.d.ts
 /**
  * Editor commands `launch-editor` recognizes with a tailored
  * `file:line:column` invocation. Callers that gate an RPC surface's editor
@@ -16,5 +15,4 @@ export declare const KNOWN_EDITORS: KnownEditor[];
  * `'subl'`) or absolute binary path. Otherwise the editor is auto-detected
  * via the `LAUNCH_EDITOR` env var with a fallback to common defaults.
  */
-export declare function launchEditor(target: string, editor?: string): void;
-//#endregion
+export declare function launchEditor(target: string, editor?: string): void;

package/dist/utils/launch-editor.mjs

@@ -1,5 +1,5 @@
-import { i as __toESM, r as __require, t as __commonJSMin } from "../rolldown-runtime-B4iAMlE-.mjs";
-//#region ../../node_modules/.pnpm/picocolors@1.1.1/node_modules/picocolors/picocolors.js
+import { i as __toESM, r as __require, t as __commonJSMin } from "../rolldown-runtime-BVN1G_yT.mjs";
+// ../../node_modules/.pnpm/picocolors@1.1.1/node_modules/picocolors/picocolors.js
 var require_picocolors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	let p = process || {};
 	let argv = p.argv || [];
@@ -68,8 +68,7 @@ var require_picocolors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = createColors();
 	module.exports.createColors = createColors;
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/shell-quote@1.12.0/node_modules/shell-quote/quote.js
+// ../../node_modules/.pnpm/shell-quote@1.12.0/node_modules/shell-quote/quote.js
 var require_quote = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/** @import { ControlOperator } from './parse' */
 	/** @type {ControlOperator['op'][]} */
@@ -133,8 +132,7 @@ var require_quote = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}).join(" ");
 	};
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/shell-quote@1.12.0/node_modules/shell-quote/parse.js
+// ../../node_modules/.pnpm/shell-quote@1.12.0/node_modules/shell-quote/parse.js
 var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/**
 	* @import {
@@ -401,14 +399,12 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}, []);
 	};
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/shell-quote@1.12.0/node_modules/shell-quote/index.js
+// ../../node_modules/.pnpm/shell-quote@1.12.0/node_modules/shell-quote/index.js
 var require_shell_quote = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.quote = require_quote();
 	exports.parse = require_parse();
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/editor-info/macos.js
+// ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/editor-info/macos.js
 var require_macos = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = {
 		"/Applications/Atom.app/Contents/MacOS/Atom": "atom",
@@ -442,8 +438,7 @@ var require_macos = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		"/Applications/Zed.app/Contents/MacOS/zed": "zed"
 	};
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/editor-info/linux.js
+// ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/editor-info/linux.js
 var require_linux = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = {
 		atom: "atom",
@@ -476,8 +471,7 @@ var require_linux = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		zed: "zed"
 	};
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/editor-info/windows.js
+// ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/editor-info/windows.js
 var require_windows = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = [
 		"Brackets.exe",
@@ -509,12 +503,11 @@ var require_windows = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		"Antigravity.exe"
 	];
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/guess.js
+// ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/guess.js
 var require_guess = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const path$3 = __require("path");
+	const path = __require("path");
 	const shellQuote = require_shell_quote();
-	const childProcess$1 = __require("child_process");
+	const childProcess = __require("child_process");
 	const COMMON_EDITORS_MACOS = require_macos();
 	const COMMON_EDITORS_LINUX = require_linux();
 	const COMMON_EDITORS_WIN = require_windows();
@@ -536,7 +529,7 @@ var require_guess = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		const runningProcesses = output.split("\r\n");
 		for (let i = 0; i < runningProcesses.length; i++) {
 			const fullProcessPath = runningProcesses[i].trim();
-			const shortProcessName = path$3.win32.basename(fullProcessPath);
+			const shortProcessName = path.win32.basename(fullProcessPath);
 			if (COMMON_EDITORS_WIN.indexOf(shortProcessName) !== -1) return fullProcessPath;
 		}
 	}
@@ -553,21 +546,21 @@ var require_guess = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		if (process.versions.webcontainer) return [process.env.EDITOR || "code"];
 		try {
 			if (process.platform === "darwin") {
-				const editor = getEditorFromMacProcesses(childProcess$1.execSync("ps x -o comm=", { stdio: [
+				const editor = getEditorFromMacProcesses(childProcess.execSync("ps x -o comm=", { stdio: [
 					"pipe",
 					"pipe",
 					"ignore"
 				] }).toString());
 				if (editor !== void 0) return [editor];
 			} else if (process.platform === "win32") {
-				const editor = getEditorFromWindowsProcesses(childProcess$1.execSync("powershell -NoProfile -Command \"[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-CimInstance -Query \\\"select executablepath from win32_process where executablepath is not null\\\" | % { $_.ExecutablePath }\"", { stdio: [
+				const editor = getEditorFromWindowsProcesses(childProcess.execSync("powershell -NoProfile -Command \"[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-CimInstance -Query \\\"select executablepath from win32_process where executablepath is not null\\\" | % { $_.ExecutablePath }\"", { stdio: [
 					"pipe",
 					"pipe",
 					"ignore"
 				] }).toString());
 				if (editor !== void 0) return [editor];
 			} else if (process.platform === "linux") {
-				const editor = getEditorFromLinuxProcesses(childProcess$1.execSync("ps x --no-heading -o comm --sort=comm", { stdio: [
+				const editor = getEditorFromLinuxProcesses(childProcess.execSync("ps x --no-heading -o comm --sort=comm", { stdio: [
 					"pipe",
 					"pipe",
 					"ignore"
@@ -584,16 +577,15 @@ var require_guess = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports.getEditorFromWindowsProcesses = getEditorFromWindowsProcesses;
 	module.exports.getEditorFromLinuxProcesses = getEditorFromLinuxProcesses;
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/get-args.js
+// ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/get-args.js
 var require_get_args = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const os = __require("os");
-	const path$2 = __require("path");
+	const path = __require("path");
 	module.exports = function getArgumentsForFile(editor, fileName, lineNumber, columnNumber = 1) {
-		fileName = path$2.resolve(fileName);
-		if (process.platform === "linux" && fileName.startsWith("/mnt/") && /Microsoft/i.test(os.release())) fileName = `./${path$2.relative("", fileName)}`;
+		fileName = path.resolve(fileName);
+		if (process.platform === "linux" && fileName.startsWith("/mnt/") && /Microsoft/i.test(os.release())) fileName = `./${path.relative("", fileName)}`;
 		if (!lineNumber) return [fileName];
-		switch (path$2.basename(editor).replace(/\.(exe|cmd|bat)$/i, "")) {
+		switch (path.basename(editor).replace(/\.(exe|cmd|bat)$/i, "")) {
 			case "atom":
 			case "Atom":
 			case "Atom Beta":
@@ -667,8 +659,7 @@ var require_get_args = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return [fileName];
 	};
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/construct-windows-launch-command.js
+// ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/construct-windows-launch-command.js
 var require_construct_windows_launch_command = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	function escapeCmdArgs(cmdArgs) {
 		return cmdArgs.replace(/([&|<>,;=^])/g, "^$1");
@@ -685,15 +676,14 @@ var require_construct_windows_launch_command = /* @__PURE__ */ __commonJSMin(((e
 	}
 	module.exports = constructWindowsLaunchCommand;
 }));
-//#endregion
-//#region ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/parse-file.js
+// ../../node_modules/.pnpm/launch-editor@2.14.2/node_modules/launch-editor/parse-file.js
 var require_parse_file = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const path$1 = __require("path");
+	const path = __require("path");
 	const positionRE = /:(\d+)(:(\d+))?$/;
 	module.exports = function parseFile(file) {
 		if (file.startsWith("file://")) file = __require("url").fileURLToPath(file);
 		const unresolvedFileName = file.replace(positionRE, "");
-		const fileName = unresolvedFileName ? path$1.resolve(unresolvedFileName) : "";
+		const fileName = unresolvedFileName ? path.resolve(unresolvedFileName) : "";
 		const match = file.match(positionRE);
 		return {
 			fileName,
@@ -702,8 +692,7 @@ var require_parse_file = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		};
 	};
 }));
-//#endregion
-//#region src/utils/launch-editor.ts
+// src/utils/launch-editor.ts
 var import_launch_editor = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/**
 	* Copyright (c) 2015-present, Facebook, Inc.
@@ -831,5 +820,4 @@ const KNOWN_EDITORS = [
 function launchEditor(target, editor) {
 	(0, import_launch_editor.default)(target, editor);
 }
-//#endregion
 export { KNOWN_EDITORS, launchEditor };

package/dist/utils/nanoid.d.mts

@@ -1,3 +1 @@
-//#region src/utils/nanoid.d.ts
-export declare function nanoid(size?: number): string;
-//#endregion
+export declare function nanoid(size?: number): string;

package/dist/utils/nanoid.mjs

@@ -1,4 +1,4 @@
-//#region src/utils/nanoid.ts
+// src/utils/nanoid.ts
 const urlAlphabet = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";
 function nanoid(size = 21) {
 	let id = "";
@@ -6,5 +6,4 @@ function nanoid(size = 21) {
 	while (i--) id += urlAlphabet[Math.random() * 64 | 0];
 	return id;
 }
-//#endregion
 export { nanoid };

package/dist/utils/nostics.d.mts

@@ -1,2 +1,40 @@
-import { _ as formatDiagnostic, a as DevframeDiagnostics, c as DiagnosticDefinition, d as DiagnosticReporter, f as Diagnostics, g as defineProdDiagnostics, h as defineDiagnostics, i as DevframeDefineDiagnosticsOptions, l as DiagnosticHandle, m as createConsoleReporter, n as ConsoleMethod, o as Diagnostic, p as ansiFormatter, r as ConsoleReporterOptions, s as DiagnosticCallParams, t as AnyDiagnosticReporter, u as DiagnosticInit } from "../nostics-DWvukRwa.mjs";
-export { type AnyDiagnosticReporter, type ConsoleMethod, type ConsoleReporterOptions, DevframeDefineDiagnosticsOptions, DevframeDiagnostics, type Diagnostic, type DiagnosticCallParams, type DiagnosticDefinition, type DiagnosticHandle, type DiagnosticInit, type DiagnosticReporter, type Diagnostics, ansiFormatter, createConsoleReporter, defineDiagnostics, defineProdDiagnostics, formatDiagnostic };
+import { AnyDiagnosticReporter, AnyDiagnosticReporter as AnyDiagnosticReporter$1, ConsoleMethod, ConsoleReporterOptions, Diagnostic, Diagnostic as Diagnostic$1, DiagnosticCallParams, DiagnosticDefinition, DiagnosticDefinition as DiagnosticDefinition$1, DiagnosticHandle, DiagnosticInit, DiagnosticReporter, Diagnostics, Diagnostics as Diagnostics$1, createConsoleReporter, defineProdDiagnostics, formatDiagnostic } from "nostics";
+import { ansiFormatter } from "nostics/formatters/ansi";
+/**
+ * The reporter every {@link defineDiagnostics} call below wires in ahead of
+ * any caller-supplied ones: prints the diagnostic through devframe's own
+ * ANSI colors via `console[method]` (default `'warn'`).
+ */
+declare function devframeReporter(d: Diagnostic$1, { method }?: {
+  method?: 'log' | 'warn' | 'error';
+}): void;
+/**
+ * Options accepted by {@link defineDiagnostics}, identical to `nostics`'s
+ * own `DefineDiagnosticsOptions`, minus the reporter devframe already
+ * prepends.
+ */
+export type DevframeDefineDiagnosticsOptions<Codes extends Record<string, DiagnosticDefinition$1>, Reporters extends readonly AnyDiagnosticReporter$1[] = []> = Parameters<typeof defineDiagnostics<Codes, Reporters>>[0];
+/**
+ * Drop-in replacement for `nostics`'s `defineDiagnostics()` with devframe's
+ * ANSI console reporter pre-wired ahead of any `reporters` passed in. Every
+ * `diagnostics.ts` in devframe core, `@devframes/hub`, `@devframes/json-render`,
+ * and the built-in plugins defines its codes through this instead of
+ * `nostics`'s own `defineDiagnostics`; the reporter registration lives
+ * here, once, so none of them need to build their own reporter (`colors`,
+ * `ansiFormatter`) or take a direct dependency on `nostics` themselves.
+ */
+export declare function defineDiagnostics<const Codes extends Record<string, DiagnosticDefinition$1>, const Reporters extends readonly AnyDiagnosticReporter$1[] = []>(options: {
+  docsBase?: string | ((code: keyof Codes) => string | undefined);
+  codes: Codes;
+  reporters?: Reporters;
+}): DevframeDiagnostics<Codes, Reporters>;
+/**
+ * The `Diagnostics` object returned by devframe's {@link defineDiagnostics}
+ * (devframe's ANSI console reporter is always prepended). Integrations that
+ * export their own `defineDiagnostics(...)` result as public API annotate it
+ * with this type, so the reference resolves through `devframe/utils/nostics`
+ * rather than inlining `nostics`'s types or taking a direct `nostics`
+ * dependency.
+ */
+export type DevframeDiagnostics<Codes extends Record<string, DiagnosticDefinition$1>, Reporters extends readonly AnyDiagnosticReporter$1[] = []> = Diagnostics$1<Codes, readonly [typeof devframeReporter, ...Reporters]>;
+export { type AnyDiagnosticReporter, type ConsoleMethod, type ConsoleReporterOptions, type Diagnostic, type DiagnosticCallParams, type DiagnosticDefinition, type DiagnosticHandle, type DiagnosticInit, type DiagnosticReporter, type Diagnostics, ansiFormatter, createConsoleReporter, defineProdDiagnostics, formatDiagnostic };

package/dist/utils/nostics.mjs

@@ -1,2 +1 @@
-import { a as defineProdDiagnostics, i as defineDiagnostics, n as ansiFormatter, o as formatDiagnostic, r as createConsoleReporter, t as Diagnostic } from "../nostics-D0PvLZsn.mjs";
-export { Diagnostic, ansiFormatter, createConsoleReporter, defineDiagnostics, defineProdDiagnostics, formatDiagnostic };
+export { t as Diagnostic, n as ansiFormatter, r as createConsoleReporter, i as defineDiagnostics, a as defineProdDiagnostics, o as formatDiagnostic } from "../nostics-InlX4tmd.mjs";

package/dist/utils/open.d.mts

@@ -1,7 +1,5 @@
-//#region src/utils/open.d.ts
 /**
  * Open a URL, file, or other target in its default OS handler
  * (browser for URLs, Finder/Explorer for paths, etc.).
  */
-export declare function open(target: string): Promise<void>;
-//#endregion
+export declare function open(target: string): Promise<void>;

package/dist/utils/open.mjs

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import process from "node:process";
 import { spawn } from "node:child_process";
-//#region src/utils/open.ts
+// src/utils/open.ts
 /**
 * Launches `command` detached from the current process and resolves once
 * the OS has accepted the spawn (not once the launched app exits), the
@@ -53,5 +53,4 @@ async function open(target) {
 	}
 	return spawnDetached("xdg-open", [target]);
 }
-//#endregion
 export { open };

package/dist/utils/origin.d.mts

@@ -1,2 +1,55 @@
-import { i as validateOriginCandidate, n as isLoopbackAddress, r as isLoopbackHostname, t as isAllowedOrigin } from "../origin-CY6BBHOy.mjs";
-export { isAllowedOrigin, isLoopbackAddress, isLoopbackHostname, validateOriginCandidate };
+/**
+ * Origin and hostname predicates shared by the RPC transports (the WS upgrade,
+ * SSE, and MCP origin gates) and the instance shell's authentication-link
+ * origin validation. Kept dependency-free and runtime-agnostic so any consumer
+ * can pull in a single check without dragging in a transport's `crossws`
+ * import.
+ */
+/**
+ * Whether `hostname` names a loopback host: `localhost` (or any `*.localhost`
+ * subdomain), the IPv6 loopback `::1`, or an IPv4 literal inside the
+ * `127.0.0.0/8` loopback block.
+ *
+ * The IPv4 case is matched **structurally**: the whole hostname must be a
+ * canonical dotted-decimal IPv4 literal whose first octet is `127`. A bare
+ * `startsWith('127.')` prefix check would also accept an attacker-controlled
+ * DNS name that merely *begins* with `127.` (`127.attacker.example`,
+ * `127.0.0.1.attacker.example`), letting a cross-origin browser page defeat
+ * the loopback origin gate that guards the RPC/MCP surface (a DNS-rebinding /
+ * cross-site WebSocket-hijacking bypass). Requiring a real IPv4 literal keeps
+ * genuine loopback addresses (`127.0.0.1`, `127.5.5.5`) allowed while rejecting
+ * those DNS names.
+ */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Whether `address` is a loopback peer address as reported by a socket
+ * (`net.Socket.remoteAddress`): the IPv6 loopback `::1`, an IPv4 literal in
+ * `127.0.0.0/8`, or an IPv4-mapped IPv6 form of one (`::ffff:127.0.0.1`).
+ *
+ * Unlike {@link isLoopbackHostname} this takes a raw address, not a hostname:
+ * it never accepts a `localhost`-style name (a socket peer is always a literal
+ * address) and understands the IPv4-mapped IPv6 form the OS hands back on a
+ * dual-stack listener. Used to prove a same-machine caller from the connected
+ * peer, which a client cannot forge, rather than from the `Origin` header,
+ * which it can.
+ */
+export declare function isLoopbackAddress(address: string): boolean;
+/**
+ * Default origin policy for a localhost dev tool: allow requests with no
+ * `Origin` header (native, non-browser clients), allow any loopback origin
+ * (so cross-port localhost dev setups keep working), and allow explicitly
+ * configured origins. Everything else, such as a real remote page in the dev's
+ * browser, is rejected.
+ */
+export declare function isAllowedOrigin(origin: string | undefined, allowedOrigins: readonly string[]): boolean;
+/**
+ * Decide whether a request-derived origin candidate may back a devframe's
+ * advertised public origin, the destination of the OTP magic link. Stricter
+ * than {@link isAllowedOrigin}: it rejects credentials, a path, a query, a
+ * fragment, a malformed port, and non-HTTP(S) schemes, and adopts a candidate
+ * only when its hostname is loopback or its canonical origin exactly matches
+ * an `allowedOrigins` entry (a caller with no static list passes none, so only
+ * loopback qualifies). Returns the canonical origin to adopt, or `undefined`
+ * to reject. Forwarded headers are never consulted.
+ */
+export declare function validateOriginCandidate(candidate: string, allowedOrigins?: readonly string[]): string | undefined;

package/dist/utils/origin.mjs

@@ -1,4 +1,4 @@
-//#region src/utils/origin.ts
+// src/utils/origin.ts
 /**
 * Origin and hostname predicates shared by the RPC transports (the WS upgrade,
 * SSE, and MCP origin gates) and the instance shell's authentication-link
@@ -96,5 +96,4 @@ function validateOriginCandidate(candidate, allowedOrigins) {
 	if (canonical === "null") return void 0;
 	if (isLoopbackHostname(url.hostname) || allowedOrigins?.includes(canonical)) return canonical;
 }
-//#endregion
 export { isAllowedOrigin, isLoopbackAddress, isLoopbackHostname, validateOriginCandidate };

package/dist/utils/remote-assets.d.mts

@@ -1,5 +1,4 @@
-import { a as RemoteAssetsStore, o as StaticAssetsSource } from "../remote-assets-eBvSKZMS.mjs";
-//#region src/utils/remote-assets.d.ts
+import { a as RemoteAssetsStore, o as StaticAssetsSource } from "../remote-assets-5AQMHZnV.mjs";
 /**
  * Normalize a {@link StaticAssetsSource} into something servable: a local
  * directory (strings pass through; a remote source short-circuits to a
@@ -16,5 +15,4 @@ import { a as RemoteAssetsStore, o as StaticAssetsSource } from "../remote-asset
  * per-source string still wins and an explicit `null` still opts out of the
  * installed-copy lookup.
  */
-export declare function resolveStaticAssetsSource(source: StaticAssetsSource, projectStorageDir: string, defaultResolveFrom?: string | null): string | RemoteAssetsStore;
-//#endregion
+export declare function resolveStaticAssetsSource(source: StaticAssetsSource, projectStorageDir: string, defaultResolveFrom?: string | null): string | RemoteAssetsStore;

package/dist/utils/remote-assets.mjs

@@ -1,2 +1 @@
-import { t as resolveStaticAssetsSource } from "../remote-assets-B-n83kUY.mjs";
-export { resolveStaticAssetsSource };
+export { t as resolveStaticAssetsSource } from "../remote-assets-DhonNeo_.mjs";

package/dist/utils/serve-static.d.mts

@@ -1,7 +1,6 @@
-import { a as RemoteAssetsStore } from "../remote-assets-eBvSKZMS.mjs";
-import { EventHandler, H3 } from "h3";
+import { a as RemoteAssetsStore } from "../remote-assets-5AQMHZnV.mjs";
 import { IncomingMessage, ServerResponse } from "node:http";
-//#region src/utils/serve-static.d.ts
+import { EventHandler, H3 } from "h3";
 /**
  * What the static-serving engine accepts: a local directory, or a resolved
  * {@link RemoteAssetsStore} back-proxy (from `devframe/utils/remote-assets`).
@@ -40,5 +39,4 @@ export declare function mountStaticHandler(app: H3, base: string, source: Servab
  * Connect stack; avoids forcing the host package to depend on h3 just to
  * adapt an event handler back into Node middleware.
  */
-export declare function serveStaticNodeMiddleware(source: ServableAssets, options?: ServeStaticOptions): (req: IncomingMessage, res: ServerResponse, next?: (err?: Error) => void) => void;
-//#endregion
+export declare function serveStaticNodeMiddleware(source: ServableAssets, options?: ServeStaticOptions): (req: IncomingMessage, res: ServerResponse, next?: (err?: Error) => void) => void;

package/dist/utils/serve-static.mjs

@@ -1,11 +1,11 @@
-import { t as DEVFRAME_EVENTS } from "../events-0wDwalmL.mjs";
-import { t as lookup } from "../mrmime-40h5OOIp.mjs";
+import { t as lookup } from "../mrmime-y_XyiVcd.mjs";
+import { t as DEVFRAME_EVENTS } from "../events-qWCKwD8-.mjs";
 import { realpath, stat } from "node:fs/promises";
 import { extname, join, normalize, resolve, sep } from "pathe";
 import { createReadStream } from "node:fs";
 import { Readable } from "node:stream";
 import { H3, defineHandler } from "h3";
-//#region src/utils/serve-static.ts
+// src/utils/serve-static.ts
 const HTML_EXTENSIONS = [".html", ".htm"];
 /**
 * The canonical (symlink-resolved) served root, falling back to the lexical
@@ -312,5 +312,4 @@ function remoteErrorPage(pkg, version, reason) {
 </html>
 `;
 }
-//#endregion
 export { mountStaticHandler, serveStaticHandler, serveStaticNodeMiddleware };

package/dist/utils/shared-state.d.mts

@@ -1,2 +1,2 @@
-import { A as SharedStateEvents, D as ImmutableObject, E as ImmutableMap, M as SharedStatePatch, N as createSharedState, O as ImmutableSet, T as ImmutableArray, j as SharedStateOptions, k as SharedState, w as Immutable } from "../context-BNxFOPbX.mjs";
+import { Bt as SharedState, Ft as Immutable, Ht as SharedStateOptions, It as ImmutableArray, Lt as ImmutableMap, Rt as ImmutableObject, Ut as SharedStatePatch, Vt as SharedStateEvents, Wt as createSharedState, zt as ImmutableSet } from "../index-BhUqJUHG.mjs";
 export { Immutable, ImmutableArray, ImmutableMap, ImmutableObject, ImmutableSet, SharedState, SharedStateEvents, SharedStateOptions, SharedStatePatch, createSharedState };

package/dist/utils/shared-state.mjs

@@ -1,2 +1 @@
-import { t as createSharedState } from "../shared-state-Cc-Jrhma.mjs";
-export { createSharedState };
+export { t as createSharedState } from "../shared-state-COV7NCbd.mjs";

package/dist/utils/simple-schema.d.mts

@@ -1,5 +1,4 @@
-import { t as StandardSchemaV1 } from "../index-CeEtxDmK.mjs";
-//#region src/utils/simple-schema.d.ts
+import { t as StandardSchemaV1 } from "../index-BIRF0E5l.mjs";
 /**
  * A tiny, zero-dependency [Standard Schema](https://standardschema.dev/)
  * builder.
@@ -98,5 +97,4 @@ export declare const s: {
   readonly nullable: typeof nullable;
   readonly describe: typeof describe;
 };
-//#endregion
 export type { StandardSchemaV1 };

package/dist/utils/simple-schema.mjs

@@ -1,4 +1,4 @@
-//#region src/utils/simple-schema.ts
+// src/utils/simple-schema.ts
 function ok(value) {
 	return { value };
 }
@@ -150,5 +150,4 @@ const s = {
 	nullable,
 	describe
 };
-//#endregion
 export { array, boolean, describe, literal, nullType, nullable, number, object, optional, picklist, record, s, string, union, voidType };

package/dist/utils/streaming-channel.d.mts

@@ -1,2 +1,2 @@
-import { C as createStreamSink, S as createStreamReader, _ as CreateStreamSinkOptions, b as StreamSink, g as CreateStreamReaderOptions, h as BufferedChunk, v as StreamErrorPayload, x as StreamSinkEvents, y as StreamReader } from "../context-BNxFOPbX.mjs";
+import { At as StreamReader, Dt as CreateStreamReaderOptions, Et as BufferedChunk, Mt as StreamSinkEvents, Nt as createStreamReader, Ot as CreateStreamSinkOptions, Pt as createStreamSink, jt as StreamSink, kt as StreamErrorPayload } from "../index-BhUqJUHG.mjs";
 export { BufferedChunk, CreateStreamReaderOptions, CreateStreamSinkOptions, StreamErrorPayload, StreamReader, StreamSink, StreamSinkEvents, createStreamReader, createStreamSink };

package/dist/utils/streaming-channel.mjs

@@ -1,6 +1,6 @@
 import { createEventEmitter } from "./events.mjs";
 import { nanoid } from "./nanoid.mjs";
-//#region src/utils/streaming-channel.ts
+// src/utils/streaming-channel.ts
 const DEFAULT_HIGH_WATER_MARK = 256;
 var StreamClosedError = class extends Error {
 	name = "StreamClosedError";
@@ -254,5 +254,4 @@ function toErrorPayload(reason) {
 		};
 	}
 }
-//#endregion
 export { createStreamReader, createStreamSink };

package/dist/utils/structured-clone.d.mts

@@ -1,4 +1,3 @@
-//#region src/utils/structured-clone.d.ts
 /**
  * Serialize a structured-cloneable value (`Map`, `Set`, `Date`, `BigInt`,
  * cycles, class instances, …) into a JSON-safe records array.
@@ -16,5 +15,4 @@ export declare function structuredCloneStringify(value: unknown): string;
 /**
  * Inverse of {@link structuredCloneStringify}.
  */
-export declare function structuredCloneParse<T = unknown>(value: string): T;
-//#endregion
+export declare function structuredCloneParse<T = unknown>(value: string): T;

package/dist/utils/structured-clone.mjs

@@ -1,2 +1 @@
-import { i as structuredCloneStringify, n as structuredCloneParse, r as structuredCloneSerialize, t as structuredCloneDeserialize } from "../structured-clone-CgtQ61SA.mjs";
-export { structuredCloneDeserialize, structuredCloneParse, structuredCloneSerialize, structuredCloneStringify };
+export { t as structuredCloneDeserialize, n as structuredCloneParse, r as structuredCloneSerialize, i as structuredCloneStringify } from "../structured-clone-D1dOCZvc.mjs";

package/dist/utils/url.d.mts

@@ -1,4 +1,3 @@
-//#region src/utils/url.d.ts
 /**
  * URL path-joining and slash-normalization helpers shared by the adapters,
  * the RPC clients, and the hub's mount-path plumbing. In-house replacements
@@ -27,5 +26,4 @@ export declare function joinURL(base: string, ...segments: string[]): string;
  */
 export declare function withBase(input: string, base: string): string;
 /** Replaces (or adds) the protocol of `input`: `withProtocol(url, 'ws://')`. */
-export declare function withProtocol(input: string, protocol: string): string;
-//#endregion
+export declare function withProtocol(input: string, protocol: string): string;

package/dist/utils/url.mjs

@@ -1,4 +1,4 @@
-//#region src/utils/url.ts
+// src/utils/url.ts
 /**
 * URL path-joining and slash-normalization helpers shared by the adapters,
 * the RPC clients, and the hub's mount-path plumbing. In-house replacements
@@ -54,5 +54,4 @@ function withProtocol(input, protocol) {
 	const match = input.match(PROTOCOL_RE);
 	return protocol + (match ? input.slice(match[0].length) : input);
 }
-//#endregion
 export { cleanDoubleSlashes, joinURL, withBase, withLeadingSlash, withProtocol, withTrailingSlash, withoutLeadingSlash, withoutTrailingSlash };

package/dist/utils/when.d.mts

@@ -1,5 +1,4 @@
 import { WhenExpression as WhenExpression$1 } from "whenexpr";
-//#region src/utils/when.d.ts
 /**
  * Context object for evaluating `when` expressions.
  *
@@ -50,5 +49,4 @@ export declare function evaluateWhen<T extends object, const E extends string>(e
  * Resolve a context value by key. Supports namespaced keys with `.` or `:`
  * separators. Returns `undefined` for unknown keys.
  */
-export declare function resolveContextValue<T extends Record<string, unknown>>(key: string, context: T): unknown;
-//#endregion
+export declare function resolveContextValue<T extends Record<string, unknown>>(key: string, context: T): unknown;

package/dist/utils/when.mjs

@@ -1,4 +1,4 @@
-//#region ../../node_modules/.pnpm/whenexpr@0.1.2/node_modules/whenexpr/dist/index.mjs
+// ../../node_modules/.pnpm/whenexpr@0.1.2/node_modules/whenexpr/dist/index.mjs
 const OPS = [
 	"===",
 	"!==",
@@ -420,8 +420,7 @@ function resolve(key, ctx) {
 		value: void 0
 	};
 }
-//#endregion
-//#region src/utils/when.ts
+// src/utils/when.ts
 /**
 * Evaluate a when-clause expression string against a context object.
 *
@@ -438,5 +437,4 @@ function evaluateWhen(expression, context, options) {
 function resolveContextValue(key, context) {
 	return resolveContextValue$1(key, context);
 }
-//#endregion
 export { evaluateWhen, resolveContextValue };