devframe 1.3.1 → 1.3.3

package/dist/{validation-CMfDAti3.mjs → validation-Cjy1P58H.mjs}

@@ -1,6 +1,6 @@
-import { r as diagnostics } from "./serialization-BhuOoL80.mjs";
+import { r as diagnostics } from "./serialization-iiTQ7n21.mjs";
 import { createHash } from "node:crypto";
-//#region ../../node_modules/.pnpm/ohash@2.0.12/node_modules/ohash/dist/_chunks/is-equal.mjs
+// ../../node_modules/.pnpm/ohash@2.0.12/node_modules/ohash/dist/_chunks/is-equal.mjs
 function serialize(input) {
 	if (typeof input === "string") return `'${input}'`;
 	return new Serializer().serialize(input);
@@ -147,8 +147,7 @@ const Serializer = /*@__PURE__*/ (function() {
 	};
 	return Serializer;
 })();
-//#endregion
-//#region ../../node_modules/.pnpm/ohash@2.0.12/node_modules/ohash/dist/crypto/node/index.mjs
+// ../../node_modules/.pnpm/ohash@2.0.12/node_modules/ohash/dist/crypto/node/index.mjs
 const fastHash = /*@__PURE__*/ (() => globalThis.process?.getBuiltinModule?.("crypto")?.hash)();
 const algorithm = "sha256";
 const encoding = "base64url";
@@ -157,21 +156,18 @@ function digest(data) {
 	const h = createHash(algorithm).update(data);
 	return globalThis.process?.versions?.webcontainer ? h.digest().toString(encoding) : h.digest(encoding);
 }
-//#endregion
-//#region ../../node_modules/.pnpm/ohash@2.0.12/node_modules/ohash/dist/index.mjs
+// ../../node_modules/.pnpm/ohash@2.0.12/node_modules/ohash/dist/index.mjs
 function hash$1(input) {
 	return digest(serialize(input));
 }
-//#endregion
-//#region src/utils/hash.ts
+// src/utils/hash.ts
 /**
 * Stable, deterministic hash of any structured-cloneable value.
 */
 function hash(value) {
 	return hash$1(value);
 }
-//#endregion
-//#region src/rpc/agent-json-serialization.ts
+// src/rpc/agent-json-serialization.ts
 /**
 * Prevents using a coding-agent-exposed RPC function that is explicitly
 * marked as non-serializable, and marks these functions as serializable by
@@ -183,8 +179,7 @@ function ensureAgentJsonSerializable(fnDef) {
 	if (fnDef.agent && fnDef.jsonSerializable === false) throw diagnostics.DF0019({ name: fnDef.name });
 	if (fnDef.agent && !fnDef.jsonSerializable) fnDef.jsonSerializable = true;
 }
-//#endregion
-//#region src/rpc/validation.ts
+// src/rpc/validation.ts
 /**
 * Validates RPC function definitions.
 * Action and event functions cannot have dumps (side effects should not be cached).
@@ -212,5 +207,4 @@ function validateDefinitions(definitions) {
 function validateDefinition(definition) {
 	validateDefinitions([definition]);
 }
-//#endregion
 export { hash as i, validateDefinitions as n, ensureAgentJsonSerializable as r, validateDefinition as t };

package/dist/{wire-codec-B1W3zH3L.mjs → wire-codec-BdngvzfH.mjs}

@@ -1,6 +1,6 @@
-import { n as strictJsonStringify } from "./serialization-BhuOoL80.mjs";
-import { n as structuredCloneStringify, t as structuredCloneParse } from "./structured-clone-CbAV5rFI.mjs";
-//#region src/rpc/wire-codec.ts
+import { n as structuredCloneStringify, t as structuredCloneParse } from "./structured-clone-B1N_XQvA.mjs";
+import { n as strictJsonStringify } from "./serialization-iiTQ7n21.mjs";
+// src/rpc/wire-codec.ts
 const EMPTY_WIRE_DEFS = /* @__PURE__ */ new Map();
 /**
 * Build the per-connection wire codec every live transport (WS server, WS
@@ -52,5 +52,4 @@ function peekRpcWireFrame(raw) {
 		return {};
 	}
 }
-//#endregion
 export { peekRpcWireFrame as n, createRpcWireCodec as t };

package/dist/{write-DK7rBUN3.mjs → write-3miSvPaD.mjs}

@@ -1,11 +1,11 @@
-import { i as hash, n as validateDefinitions, r as ensureAgentJsonSerializable } from "./validation-CMfDAti3.mjs";
-import { n as strictJsonStringify, r as diagnostics } from "./serialization-BhuOoL80.mjs";
-import { t as getRpcHandler } from "./handler-DmaAfpGq.mjs";
+import { i as hash, n as validateDefinitions, r as ensureAgentJsonSerializable } from "./validation-Cjy1P58H.mjs";
+import { n as strictJsonStringify, r as diagnostics } from "./serialization-iiTQ7n21.mjs";
+import { t as getRpcHandler } from "./handler-DkLlj3-B.mjs";
 import { DEVFRAME_RPC_DUMP_DIRNAME, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME } from "./constants.mjs";
-import { n as structuredCloneStringify } from "./structured-clone-CbAV5rFI.mjs";
+import { n as structuredCloneStringify } from "./structured-clone-B1N_XQvA.mjs";
 import fs from "node:fs/promises";
 import { dirname, resolve } from "pathe";
-//#region ../../node_modules/.pnpm/yocto-queue@1.2.2/node_modules/yocto-queue/index.js
+// ../../node_modules/.pnpm/yocto-queue@1.2.2/node_modules/yocto-queue/index.js
 var Node = class {
 	value;
 	next;
@@ -62,8 +62,7 @@ var Queue = class {
 		while (this.#head) yield this.dequeue();
 	}
 };
-//#endregion
-//#region ../../node_modules/.pnpm/p-limit@7.3.3/node_modules/p-limit/index.js
+// ../../node_modules/.pnpm/p-limit@7.3.3/node_modules/p-limit/index.js
 function pLimit(concurrency) {
 	let rejectOnClear = false;
 	if (typeof concurrency === "object") ({concurrency, rejectOnClear = false} = concurrency);
@@ -141,8 +140,7 @@ function pLimit(concurrency) {
 function validateConcurrency(concurrency) {
 	if (!((Number.isInteger(concurrency) || concurrency === Number.POSITIVE_INFINITY) && concurrency > 0)) throw new TypeError("Expected `concurrency` to be a number from 1 and up");
 }
-//#endregion
-//#region src/rpc/dump/error.ts
+// src/rpc/dump/error.ts
 /**
 * Normalize a thrown value into a plain object suitable for storage in
 * a dump record. Preserves `message`, `name`, `cause`, and any own
@@ -192,8 +190,7 @@ function reviveDumpError(stored) {
 function isPlainErrorShape(value) {
 	return typeof value === "object" && value !== null && typeof value.message === "string" && typeof value.name === "string";
 }
-//#endregion
-//#region src/rpc/dump/collect.ts
+// src/rpc/dump/collect.ts
 function getDumpRecordKey(functionName, args) {
 	return `${functionName}---${hash(args)}`;
 }
@@ -344,8 +341,7 @@ function createClientFromDump(store, options = {}) {
 function getDefinitionsWithDumps(definitions) {
 	return definitions.filter((def) => def.dump !== void 0);
 }
-//#endregion
-//#region src/rpc/dump/static.ts
+// src/rpc/dump/static.ts
 function makeDumpKey(name) {
 	return encodeURIComponent(name.replaceAll(":", "~"));
 }
@@ -429,8 +425,7 @@ async function collectStaticRpcDump(definitions, context) {
 		files
 	};
 }
-//#endregion
-//#region src/rpc/dump/write.ts
+// src/rpc/dump/write.ts
 /**
 * Write a collected static RPC dump to disk: every sharded record file plus
 * the `__rpc-dump/index.json` manifest, under `outDir`. Shared by the build
@@ -447,5 +442,4 @@ async function writeStaticRpcDump(dump, outDir, options = {}) {
 	}
 	await fs.writeFile(resolve(outDir, DEVFRAME_RPC_DUMP_MANIFEST_FILENAME), JSON.stringify(dump.manifest, null, 2), "utf-8");
 }
-//#endregion
 export { getDefinitionsWithDumps as a, dumpFunctions as i, collectStaticRpcDump as n, reviveDumpError as o, createClientFromDump as r, serializeDumpError as s, writeStaticRpcDump as t };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devframe",
   "type": "module",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "Framework for building one portable devtool integration that runs in any viewer.",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",
@@ -77,7 +77,7 @@
     "skills"
   ],
   "peerDependencies": {
-    "@devframes/agentic": "1.3.1",
+    "@devframes/agentic": "1.3.3",
     "cac": "^7.0.0"
   },
   "peerDependenciesMeta": {
@@ -89,18 +89,18 @@
     }
   },
   "dependencies": {
-    "crossws": "^0.4.15",
-    "h3": "^2.0.7",
+    "crossws": "^0.4.17",
+    "h3": "^2.0.8",
     "nostics": "^1.3.0",
     "pathe": "^2.0.3"
   },
   "devDependencies": {
-    "@devframes/agentic": "1.3.1",
+    "@devframes/agentic": "1.3.3",
     "@standard-schema/spec": "^1.1.0",
     "birpc": "^4.2.0",
     "cac": "^7.1.0",
     "get-port-please": "^3.2.0",
-    "immer": "^11.2.3",
+    "immer": "^11.2.9",
     "launch-editor": "^2.14.2",
     "mlly": "^1.8.2",
     "mrmime": "^2.0.1",
@@ -110,12 +110,12 @@
     "perfect-debounce": "^2.1.0",
     "structured-clone-es": "^2.0.1",
     "tinyglobby": "^0.2.17",
-    "tsdown": "0.23.0",
+    "tsdown": "^0.23.7",
     "typescript": "^6.0.3",
     "ua-parser-modern": "^0.1.1",
     "valibot": "^1.5.0",
     "whenexpr": "^0.1.2",
-    "ws": "^8.22.0"
+    "ws": "^8.22.2"
   },
   "scripts": {
     "build": "tsdown",

package/dist/index-CxJatyA1.d.mts

@@ -1,88 +0,0 @@
-import { k as SharedState, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "./context-BNxFOPbX.mjs";
-import { n as InternalAnonymousAuthStorage } from "./context-BGJi0ITA.mjs";
-//#region src/node/auth/revoke.d.ts
-/**
- * Flip `isTrusted` to false on any live WS clients connected with `token`
- * and broadcast the `auth:revoked` event so they can react.
- *
- * Shared between persisted-auth revocation and remote-dock token revocation.
- */
-declare function revokeActiveConnectionsForToken(context: DevframeNodeContext, token: string): Promise<void>;
-/**
- * Revoke an auth token: remove from storage and notify all connected clients
- * using this token that they are no longer trusted.
- */
-declare function revokeAuthToken(context: DevframeNodeContext, storage: SharedState<InternalAnonymousAuthStorage>, token: string): Promise<void>;
-//#endregion
-//#region src/node/auth/state.d.ts
-/**
- * Format a raw `navigator.userAgent` string into the short display label
- * shown for a trusted device (e.g. "Chrome 120 | macOS 14 desktop").
- *
- * The client used to parse+format this itself, but that pulled
- * `ua-parser-modern` into the browser bundle for a label nothing else on
- * the client needs; the client now sends the raw string and parsing
- * happens here, at the server ingress, keeping the persisted label format
- * identical.
- */
-declare function describeUA(userAgent: string): string;
-/**
- * The current one-time authentication code. Display this to the user (e.g. in
- * the dev-server terminal) so they can type it into the browser to authenticate.
- */
-declare function getTempAuthCode(): string;
-/**
- * The current code plus its expiry timestamp, for display (e.g. the auth
- * banner). An already-expired code is rotated first, so the returned code is
- * always redeemable for its remaining lifetime.
- */
-declare function getTempAuthCodeInfo(): {
-  code: string;
-  expireAt: number;
-};
-/**
- * Rotate the authentication code, resetting its expiry window and failed-attempt
- * counter. Call this when a new authentication flow begins (e.g. when an
- * untrusted client starts authenticating) so the displayed code is freshly
- * valid for its full TTL.
- */
-declare function refreshTempAuthCode(): string;
-/**
- * Build a "magic link" authentication URL that embeds a one-time code (OTP) in
- * the URL **fragment**. Opening it authenticates the client without typing;
- * print it on startup (devframe stays headless, so the host prints its own
- * banner). Defaults to the current code; the link is subject to the same TTL.
- *
- * The code rides the fragment (`#devframe_otp=…`), not the query string, so it
- * is never sent to the server, written to an access log, or leaked in a
- * `Referer` header; the browser client reads it locally (see
- * `consumeOtpFromUrl`). Any existing fragment parameters are preserved.
- */
-declare function buildOtpAuthUrl(baseUrl: string, code?: string): string;
-/**
- * Re-authenticate a connection that presents a previously-issued bearer token.
- * Returns `true` and marks the session trusted when the token is known.
- *
- * Used by the `anonymous:devframe:auth` handler so a client that already
- * authenticated (token persisted in the browser) is trusted on reconnect
- * without entering the code again.
- */
-declare function verifyAuthToken(token: string, session: DevframeNodeRpcSession, storage: SharedState<InternalAnonymousAuthStorage>): boolean;
-/**
- * Exchange a one-time authentication code for a fresh, node-issued bearer token.
- *
- * On success this mints a high-entropy token, records it in the trusted store,
- * marks the calling session trusted, rotates the code, and returns the token
- * for the client to persist. Returns `null` on any failure.
- *
- * Because the code is short and human-typed, verification is hardened against
- * brute force: it enforces a time-to-live, compares in constant time, and
- * rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
- * attacker cannot keep guessing against the same code.
- */
-declare function exchangeTempAuthCode(code: string, session: DevframeNodeRpcSession, info: {
-  ua: string;
-  origin: string;
-}, storage: SharedState<InternalAnonymousAuthStorage>): string | null;
-//#endregion
-export { getTempAuthCodeInfo as a, revokeActiveConnectionsForToken as c, getTempAuthCode as i, revokeAuthToken as l, describeUA as n, refreshTempAuthCode as o, exchangeTempAuthCode as r, verifyAuthToken as s, buildOtpAuthUrl as t };

package/dist/index-DuEm0sDH.d.mts

@@ -1,135 +0,0 @@
-import { C as RpcFunctionType, S as RpcFunctionSetupResult, T as RpcReturnSchema, g as RpcFunctionDefinitionAny, h as RpcFunctionDefinition, n as RpcArgsSchema, w as RpcFunctionsCollector } from "./types-BmDbfHCx.mjs";
-//#region src/rpc/cache.d.ts
-interface RpcCacheOptions {
-  functions: string[];
-  keySerializer?: (args: unknown[]) => string;
-}
-/**
- * @experimental API is expected to change.
- */
-declare class RpcCacheManager {
-  private cacheMap;
-  private options;
-  private keySerializer;
-  constructor(options: RpcCacheOptions);
-  updateOptions(options: Partial<RpcCacheOptions>): void;
-  cached<T>(m: string, a: unknown[]): T | undefined;
-  has(m: string, a: unknown[]): boolean;
-  apply(req: {
-    m: string;
-    a: unknown[];
-  }, res: unknown): void;
-  validate(m: string): boolean;
-  clear(fn?: string): void;
-}
-//#endregion
-//#region src/rpc/collector.d.ts
-declare class RpcFunctionsCollectorBase<LocalFunctions extends Record<string, any>, SetupContext> implements RpcFunctionsCollector<LocalFunctions, SetupContext> {
-  readonly context: SetupContext;
-  readonly definitions: Map<string, RpcFunctionDefinition<string, any, any, any, any, any, SetupContext>>;
-  readonly functions: LocalFunctions;
-  private readonly _onChanged;
-  constructor(context: SetupContext);
-  register(fnDef: RpcFunctionDefinition<string, any, any, any, any, any, SetupContext>, force?: boolean): void;
-  update(fn: RpcFunctionDefinition<string, any, any, any, any, any, SetupContext>, force?: boolean): void;
-  onChanged(fn: (id?: string) => void): () => void;
-  getHandler<T extends keyof LocalFunctions>(name: T): Promise<LocalFunctions[T]>;
-  getSchema<T extends keyof LocalFunctions>(name: T): {
-    args: RpcArgsSchema | undefined;
-    returns: RpcReturnSchema | undefined;
-  };
-  has(name: string): boolean;
-  get(name: string): RpcFunctionDefinition<string, any, any, any, any, any, SetupContext> | undefined;
-  list(): string[];
-}
-//#endregion
-//#region src/rpc/define.d.ts
-declare function defineRpcFunction<NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS>): RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS>;
-declare function createDefineWrapperWithContext<CONTEXT>(): <NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, const AS extends RpcArgsSchema | undefined = undefined, const RS extends RpcReturnSchema | undefined = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, CONTEXT>) => RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, AS, RS, CONTEXT>;
-//#endregion
-//#region src/rpc/handler.d.ts
-declare function getRpcResolvedSetupResult<NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, CONTEXT = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, any, any, CONTEXT>, context: CONTEXT): Promise<RpcFunctionSetupResult<ARGS, RETURN>>;
-declare function getRpcHandler<NAME extends string, TYPE extends RpcFunctionType, ARGS extends any[], RETURN = void, CONTEXT = undefined>(definition: RpcFunctionDefinition<NAME, TYPE, ARGS, RETURN, any, any, CONTEXT>, context: CONTEXT): Promise<(...args: ARGS) => RETURN>;
-//#endregion
-//#region src/rpc/serialization.d.ts
-/**
- * Wire format used by the live RPC transports (WebSocket and SSE).
- *
- * - **JSON (default, unprefixed):** payload is plain JSON text. Used when
- *   the dispatched method is declared `jsonSerializable: true`. Encoded
- *   via {@link strictJsonStringify} (rejects non-JSON values), decoded
- *   via `JSON.parse`.
- * - **Structured-clone (`s:` prefix):** payload is `s:` followed by
- *   `structured-clone-es` text. Used when the method is declared
- *   `jsonSerializable: false` (or omitted, the default). Round-trips
- *   `Map`, `Set`, `Date`, `BigInt`, cycles, and class instances.
- *
- * birpc envelopes always start with `{`, so a leading byte that is not
- * `s` is unambiguously JSON. Each direction independently chooses its
- * encoding from local definitions; request and response are not
- * coupled by a mirror rule.
- */
-declare const STRUCTURED_CLONE_PREFIX = "s:";
-/**
- * `JSON.stringify` with a single-pass strict replacer.
- *
- * Throws `DF0020` synchronously when the value contains a type JSON
- * cannot round-trip losslessly: `Map`, `Set`, `Date`, `BigInt`, class
- * instances, or `undefined` inside an array (silently becomes `null`).
- *
- * Native pass-throughs (no extra work needed):
- *   - circular references: `JSON.stringify` raises `TypeError`.
- *   - `BigInt` at top level: caught here for a friendlier error path.
- *
- * Lenient cases (allowed without throwing):
- *   - `undefined` as an object property: legitimate optional field;
- *     JSON.stringify just omits it.
- *   - `undefined` at the root: legitimate "action returned nothing".
- *   - `Symbol` / `Function` values: semantically "drop me" in JSON.
- *
- * `fnName` is used only for the diagnostic message; pass the RPC
- * function name when calling from a wire serializer / dump writer so
- * the error points at the offending function.
- */
-declare function strictJsonStringify(value: unknown, fnName?: string): string;
-//#endregion
-//#region src/rpc/validate-io.d.ts
-/**
- * Validate positional arguments against their declared schemas. Only
- * indices with a schema are checked; extra arguments pass through
- * untouched. Throws `DF0038` on the first failing argument.
- *
- * Validation guards the payload without rewriting it: the original values
- * are handed to the handler unchanged, so a schema that describes a subset
- * of an object never silently strips the sender's extra fields (and any
- * declared transforms stay a purely type-level concern).
- *
- * @internal
- */
-declare function validateRpcArgs(name: string, argsSchema: RpcArgsSchema | undefined, args: readonly unknown[]): Promise<unknown[]>;
-/**
- * Validate a handler's resolved return value against its declared schema.
- * Throws `DF0039` when the value fails the schema, otherwise returns the
- * original value unchanged (guard-only, never rewriting the payload; see
- * {@link validateRpcArgs}). Passes through when no return schema is set.
- *
- * @internal
- */
-declare function validateRpcReturn(name: string, returnSchema: RpcReturnSchema | undefined, value: unknown): Promise<unknown>;
-//#endregion
-//#region src/rpc/validation.d.ts
-/**
- * Validates RPC function definitions.
- * Action and event functions cannot have dumps (side effects should not be cached).
- *
- * @throws {Error} If an action or event function has a dump configuration
- */
-declare function validateDefinitions(definitions: readonly RpcFunctionDefinitionAny[]): void;
-/**
- * Validates a single RPC function definition.
- *
- * @throws {Error} If an action or event function has a dump configuration
- */
-declare function validateDefinition(definition: RpcFunctionDefinitionAny): void;
-//#endregion
-export { STRUCTURED_CLONE_PREFIX as a, getRpcResolvedSetupResult as c, RpcFunctionsCollectorBase as d, RpcCacheManager as f, validateRpcReturn as i, createDefineWrapperWithContext as l, validateDefinitions as n, strictJsonStringify as o, RpcCacheOptions as p, validateRpcArgs as r, getRpcHandler as s, validateDefinition as t, defineRpcFunction as u };

package/dist/nostics-DWvukRwa.d.mts

@@ -1,42 +0,0 @@
-import { AnyDiagnosticReporter, AnyDiagnosticReporter as AnyDiagnosticReporter$1, ConsoleMethod, ConsoleReporterOptions, Diagnostic, Diagnostic as Diagnostic$1, DiagnosticCallParams, DiagnosticDefinition, DiagnosticDefinition as DiagnosticDefinition$1, DiagnosticHandle, DiagnosticInit, DiagnosticReporter, Diagnostics, Diagnostics as Diagnostics$1, createConsoleReporter, defineProdDiagnostics, formatDiagnostic } from "nostics";
-import { ansiFormatter } from "nostics/formatters/ansi";
-//#region src/utils/nostics.d.ts
-/**
- * The reporter every {@link defineDiagnostics} call below wires in ahead of
- * any caller-supplied ones: prints the diagnostic through devframe's own
- * ANSI colors via `console[method]` (default `'warn'`).
- */
-declare function devframeReporter(d: Diagnostic, { method }?: {
-  method?: 'log' | 'warn' | 'error';
-}): void;
-/**
- * Options accepted by {@link defineDiagnostics}, identical to `nostics`'s
- * own `DefineDiagnosticsOptions`, minus the reporter devframe already
- * prepends.
- */
-type DevframeDefineDiagnosticsOptions<Codes extends Record<string, DiagnosticDefinition>, Reporters extends readonly AnyDiagnosticReporter[] = []> = Parameters<typeof defineDiagnostics<Codes, Reporters>>[0];
-/**
- * Drop-in replacement for `nostics`'s `defineDiagnostics()` with devframe's
- * ANSI console reporter pre-wired ahead of any `reporters` passed in. Every
- * `diagnostics.ts` in devframe core, `@devframes/hub`, `@devframes/json-render`,
- * and the built-in plugins defines its codes through this instead of
- * `nostics`'s own `defineDiagnostics`; the reporter registration lives
- * here, once, so none of them need to build their own reporter (`colors`,
- * `ansiFormatter`) or take a direct dependency on `nostics` themselves.
- */
-declare function defineDiagnostics<const Codes extends Record<string, DiagnosticDefinition>, const Reporters extends readonly AnyDiagnosticReporter[] = []>(options: {
-  docsBase?: string | ((code: keyof Codes) => string | undefined);
-  codes: Codes;
-  reporters?: Reporters;
-}): DevframeDiagnostics<Codes, Reporters>;
-/**
- * The `Diagnostics` object returned by devframe's {@link defineDiagnostics}
- * (devframe's ANSI console reporter is always prepended). Integrations that
- * export their own `defineDiagnostics(...)` result as public API annotate it
- * with this type, so the reference resolves through `devframe/utils/nostics`
- * rather than inlining `nostics`'s types or taking a direct `nostics`
- * dependency.
- */
-type DevframeDiagnostics<Codes extends Record<string, DiagnosticDefinition>, Reporters extends readonly AnyDiagnosticReporter[] = []> = Diagnostics<Codes, readonly [typeof devframeReporter, ...Reporters]>;
-//#endregion
-export { formatDiagnostic as _, DevframeDiagnostics as a, DiagnosticDefinition$1 as c, DiagnosticReporter as d, Diagnostics$1 as f, defineProdDiagnostics as g, defineDiagnostics as h, DevframeDefineDiagnosticsOptions as i, DiagnosticHandle as l, createConsoleReporter as m, ConsoleMethod as n, Diagnostic$1 as o, ansiFormatter as p, ConsoleReporterOptions as r, DiagnosticCallParams as s, AnyDiagnosticReporter$1 as t, DiagnosticInit as u };

package/dist/origin-CY6BBHOy.d.mts

@@ -1,58 +0,0 @@
-//#region src/utils/origin.d.ts
-/**
- * Origin and hostname predicates shared by the RPC transports (the WS upgrade,
- * SSE, and MCP origin gates) and the instance shell's authentication-link
- * origin validation. Kept dependency-free and runtime-agnostic so any consumer
- * can pull in a single check without dragging in a transport's `crossws`
- * import.
- */
-/**
- * Whether `hostname` names a loopback host: `localhost` (or any `*.localhost`
- * subdomain), the IPv6 loopback `::1`, or an IPv4 literal inside the
- * `127.0.0.0/8` loopback block.
- *
- * The IPv4 case is matched **structurally**: the whole hostname must be a
- * canonical dotted-decimal IPv4 literal whose first octet is `127`. A bare
- * `startsWith('127.')` prefix check would also accept an attacker-controlled
- * DNS name that merely *begins* with `127.` (`127.attacker.example`,
- * `127.0.0.1.attacker.example`), letting a cross-origin browser page defeat
- * the loopback origin gate that guards the RPC/MCP surface (a DNS-rebinding /
- * cross-site WebSocket-hijacking bypass). Requiring a real IPv4 literal keeps
- * genuine loopback addresses (`127.0.0.1`, `127.5.5.5`) allowed while rejecting
- * those DNS names.
- */
-declare function isLoopbackHostname(hostname: string): boolean;
-/**
- * Whether `address` is a loopback peer address as reported by a socket
- * (`net.Socket.remoteAddress`): the IPv6 loopback `::1`, an IPv4 literal in
- * `127.0.0.0/8`, or an IPv4-mapped IPv6 form of one (`::ffff:127.0.0.1`).
- *
- * Unlike {@link isLoopbackHostname} this takes a raw address, not a hostname:
- * it never accepts a `localhost`-style name (a socket peer is always a literal
- * address) and understands the IPv4-mapped IPv6 form the OS hands back on a
- * dual-stack listener. Used to prove a same-machine caller from the connected
- * peer, which a client cannot forge, rather than from the `Origin` header,
- * which it can.
- */
-declare function isLoopbackAddress(address: string): boolean;
-/**
- * Default origin policy for a localhost dev tool: allow requests with no
- * `Origin` header (native, non-browser clients), allow any loopback origin
- * (so cross-port localhost dev setups keep working), and allow explicitly
- * configured origins. Everything else, such as a real remote page in the dev's
- * browser, is rejected.
- */
-declare function isAllowedOrigin(origin: string | undefined, allowedOrigins: readonly string[]): boolean;
-/**
- * Decide whether a request-derived origin candidate may back a devframe's
- * advertised public origin, the destination of the OTP magic link. Stricter
- * than {@link isAllowedOrigin}: it rejects credentials, a path, a query, a
- * fragment, a malformed port, and non-HTTP(S) schemes, and adopts a candidate
- * only when its hostname is loopback or its canonical origin exactly matches
- * an `allowedOrigins` entry (a caller with no static list passes none, so only
- * loopback qualifies). Returns the canonical origin to adopt, or `undefined`
- * to reject. Forwarded headers are never consulted.
- */
-declare function validateOriginCandidate(candidate: string, allowedOrigins?: readonly string[]): string | undefined;
-//#endregion
-export { validateOriginCandidate as i, isLoopbackAddress as n, isLoopbackHostname as r, isAllowedOrigin as t };

package/dist/sse-client-DNdscfu_.d.mts

@@ -1,37 +0,0 @@
-import { a as ChannelOptions } from "./index-Bia1vKjL.mjs";
-import { g as RpcFunctionDefinitionAny } from "./types-BmDbfHCx.mjs";
-//#region src/rpc/transports/sse-client.d.ts
-interface SseRpcChannelOptions {
-  /** Resolved `http(s)://` URL of the SSE endpoint. */
-  url: string;
-  onConnected?: () => void;
-  onError?: (e: Error) => void;
-  onDisconnected?: () => void;
-  authToken?: string;
-  /**
-   * RPC function definitions (or just the `jsonSerializable` flag per
-   * method) used to dispatch the per-call wire serializer, the same contract
-   * as the WS channel.
-   */
-  definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>;
-  /** Fetch implementation. Default: `globalThis.fetch`. */
-  fetch?: typeof globalThis.fetch;
-}
-/**
- * Build a birpc `ChannelOptions` object backed by an SSE stream (server →
- * client) and HTTP `POST` (client → server): the WebSocket-free counterpart
- * to `createWsRpcChannel`, wire-compatible with `attachSseRpcTransport`.
- *
- * The stream is consumed via `fetch` streaming (not `EventSource`), so it
- * works in browsers and server runtimes alike. The server's first frame
- * (`event: session`) carries the session id; every `POST` echoes it in the
- * `x-birpc-session` header. A response to a client-initiated request comes
- * back in the `POST`'s own body and is re-injected into the channel; a
- * dropped stream terminates the channel; there is no reconnect, matching
- * the WS channel's closed-is-done semantics.
- */
-declare function createSseRpcChannel(options: SseRpcChannelOptions): ChannelOptions & {
-  close: () => void;
-};
-//#endregion
-export { createSseRpcChannel as n, SseRpcChannelOptions as t };

package/dist/ws-client-6Mrz6eC4.d.mts

@@ -1,30 +0,0 @@
-import { a as ChannelOptions } from "./index-Bia1vKjL.mjs";
-import { g as RpcFunctionDefinitionAny } from "./types-BmDbfHCx.mjs";
-//#region src/rpc/transports/ws-client.d.ts
-interface WsRpcChannelOptions {
-  url: string;
-  onConnected?: (e: Event) => void;
-  onError?: (e: Error) => void;
-  onDisconnected?: (e: CloseEvent) => void;
-  authToken?: string;
-  /**
-   * RPC function definitions (or just the `jsonSerializable` flag per
-   * method) used to dispatch the per-call wire serializer. Pass an
-   * empty / partial map on clients that don't have the full registry;
-   * encoding falls back to structured-clone (the safer superset) and
-   * decoding still routes correctly via the wire prefix.
-   */
-  definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>;
-}
-/**
- * Build a birpc `ChannelOptions` object backed by a browser `WebSocket`.
- * Pass the result straight to `createRpcClient`'s `channel` option.
- *
- * Also returns `close()`, closing the underlying socket, mirroring the server transport's
- * existing `WsRpcTransport.close()`. `birpc`'s own `ChannelOptions` has no teardown of its own.
- */
-declare function createWsRpcChannel(options: WsRpcChannelOptions): ChannelOptions & {
-  close: () => void;
-};
-//#endregion
-export { createWsRpcChannel as n, WsRpcChannelOptions as t };