devframe 1.3.2 → 1.3.5

package/dist/index-HMJPlexc.d.mts

@@ -1,84 +0,0 @@
-import { k as SharedState, o as DevframeNodeContext, s as DevframeNodeRpcSession } from "./context-WxTq6kqb.mjs";
-import { n as InternalAnonymousAuthStorage } from "./context-CsdPs3po.mjs";
-/**
- * Flip `isTrusted` to false on any live WS clients connected with `token`
- * and broadcast the `auth:revoked` event so they can react.
- *
- * Shared between persisted-auth revocation and remote-dock token revocation.
- */
-declare function revokeActiveConnectionsForToken(context: DevframeNodeContext, token: string): Promise<void>;
-/**
- * Revoke an auth token: remove from storage and notify all connected clients
- * using this token that they are no longer trusted.
- */
-declare function revokeAuthToken(context: DevframeNodeContext, storage: SharedState<InternalAnonymousAuthStorage>, token: string): Promise<void>;
-/**
- * Format a raw `navigator.userAgent` string into the short display label
- * shown for a trusted device (e.g. "Chrome 120 | macOS 14 desktop").
- *
- * The client used to parse+format this itself, but that pulled
- * `ua-parser-modern` into the browser bundle for a label nothing else on
- * the client needs; the client now sends the raw string and parsing
- * happens here, at the server ingress, keeping the persisted label format
- * identical.
- */
-declare function describeUA(userAgent: string): string;
-/**
- * The current one-time authentication code. Display this to the user (e.g. in
- * the dev-server terminal) so they can type it into the browser to authenticate.
- */
-declare function getTempAuthCode(): string;
-/**
- * The current code plus its expiry timestamp, for display (e.g. the auth
- * banner). An already-expired code is rotated first, so the returned code is
- * always redeemable for its remaining lifetime.
- */
-declare function getTempAuthCodeInfo(): {
-  code: string;
-  expireAt: number;
-};
-/**
- * Rotate the authentication code, resetting its expiry window and failed-attempt
- * counter. Call this when a new authentication flow begins (e.g. when an
- * untrusted client starts authenticating) so the displayed code is freshly
- * valid for its full TTL.
- */
-declare function refreshTempAuthCode(): string;
-/**
- * Build a "magic link" authentication URL that embeds a one-time code (OTP) in
- * the URL **fragment**. Opening it authenticates the client without typing;
- * print it on startup (devframe stays headless, so the host prints its own
- * banner). Defaults to the current code; the link is subject to the same TTL.
- *
- * The code rides the fragment (`#devframe_otp=…`), not the query string, so it
- * is never sent to the server, written to an access log, or leaked in a
- * `Referer` header; the browser client reads it locally (see
- * `consumeOtpFromUrl`). Any existing fragment parameters are preserved.
- */
-declare function buildOtpAuthUrl(baseUrl: string, code?: string): string;
-/**
- * Re-authenticate a connection that presents a previously-issued bearer token.
- * Returns `true` and marks the session trusted when the token is known.
- *
- * Used by the `anonymous:devframe:auth` handler so a client that already
- * authenticated (token persisted in the browser) is trusted on reconnect
- * without entering the code again.
- */
-declare function verifyAuthToken(token: string, session: DevframeNodeRpcSession, storage: SharedState<InternalAnonymousAuthStorage>): boolean;
-/**
- * Exchange a one-time authentication code for a fresh, node-issued bearer token.
- *
- * On success this mints a high-entropy token, records it in the trusted store,
- * marks the calling session trusted, rotates the code, and returns the token
- * for the client to persist. Returns `null` on any failure.
- *
- * Because the code is short and human-typed, verification is hardened against
- * brute force: it enforces a time-to-live, compares in constant time, and
- * rotates the code after {@link TEMP_AUTH_MAX_ATTEMPTS} failed attempts so an
- * attacker cannot keep guessing against the same code.
- */
-declare function exchangeTempAuthCode(code: string, session: DevframeNodeRpcSession, info: {
-  ua: string;
-  origin: string;
-}, storage: SharedState<InternalAnonymousAuthStorage>): string | null;
-export { getTempAuthCodeInfo as a, revokeActiveConnectionsForToken as c, getTempAuthCode as i, revokeAuthToken as l, describeUA as n, refreshTempAuthCode as o, exchangeTempAuthCode as r, verifyAuthToken as s, buildOtpAuthUrl as t };

package/dist/nostics-Dgwh7ytT.d.mts

@@ -1,40 +0,0 @@
-import { AnyDiagnosticReporter, AnyDiagnosticReporter as AnyDiagnosticReporter$1, ConsoleMethod, ConsoleReporterOptions, Diagnostic, Diagnostic as Diagnostic$1, DiagnosticCallParams, DiagnosticDefinition, DiagnosticDefinition as DiagnosticDefinition$1, DiagnosticHandle, DiagnosticInit, DiagnosticReporter, Diagnostics, Diagnostics as Diagnostics$1, createConsoleReporter, defineProdDiagnostics, formatDiagnostic } from "nostics";
-import { ansiFormatter } from "nostics/formatters/ansi";
-/**
- * The reporter every {@link defineDiagnostics} call below wires in ahead of
- * any caller-supplied ones: prints the diagnostic through devframe's own
- * ANSI colors via `console[method]` (default `'warn'`).
- */
-declare function devframeReporter(d: Diagnostic, { method }?: {
-  method?: 'log' | 'warn' | 'error';
-}): void;
-/**
- * Options accepted by {@link defineDiagnostics}, identical to `nostics`'s
- * own `DefineDiagnosticsOptions`, minus the reporter devframe already
- * prepends.
- */
-type DevframeDefineDiagnosticsOptions<Codes extends Record<string, DiagnosticDefinition>, Reporters extends readonly AnyDiagnosticReporter[] = []> = Parameters<typeof defineDiagnostics<Codes, Reporters>>[0];
-/**
- * Drop-in replacement for `nostics`'s `defineDiagnostics()` with devframe's
- * ANSI console reporter pre-wired ahead of any `reporters` passed in. Every
- * `diagnostics.ts` in devframe core, `@devframes/hub`, `@devframes/json-render`,
- * and the built-in plugins defines its codes through this instead of
- * `nostics`'s own `defineDiagnostics`; the reporter registration lives
- * here, once, so none of them need to build their own reporter (`colors`,
- * `ansiFormatter`) or take a direct dependency on `nostics` themselves.
- */
-declare function defineDiagnostics<const Codes extends Record<string, DiagnosticDefinition>, const Reporters extends readonly AnyDiagnosticReporter[] = []>(options: {
-  docsBase?: string | ((code: keyof Codes) => string | undefined);
-  codes: Codes;
-  reporters?: Reporters;
-}): DevframeDiagnostics<Codes, Reporters>;
-/**
- * The `Diagnostics` object returned by devframe's {@link defineDiagnostics}
- * (devframe's ANSI console reporter is always prepended). Integrations that
- * export their own `defineDiagnostics(...)` result as public API annotate it
- * with this type, so the reference resolves through `devframe/utils/nostics`
- * rather than inlining `nostics`'s types or taking a direct `nostics`
- * dependency.
- */
-type DevframeDiagnostics<Codes extends Record<string, DiagnosticDefinition>, Reporters extends readonly AnyDiagnosticReporter[] = []> = Diagnostics<Codes, readonly [typeof devframeReporter, ...Reporters]>;
-export { formatDiagnostic as _, DevframeDiagnostics as a, DiagnosticDefinition$1 as c, DiagnosticReporter as d, Diagnostics$1 as f, defineProdDiagnostics as g, defineDiagnostics as h, DevframeDefineDiagnosticsOptions as i, DiagnosticHandle as l, createConsoleReporter as m, ConsoleMethod as n, Diagnostic$1 as o, ansiFormatter as p, ConsoleReporterOptions as r, DiagnosticCallParams as s, AnyDiagnosticReporter$1 as t, DiagnosticInit as u };

package/dist/origin-D5i7K_Zb.d.mts

@@ -1,56 +0,0 @@
-/**
- * Origin and hostname predicates shared by the RPC transports (the WS upgrade,
- * SSE, and MCP origin gates) and the instance shell's authentication-link
- * origin validation. Kept dependency-free and runtime-agnostic so any consumer
- * can pull in a single check without dragging in a transport's `crossws`
- * import.
- */
-/**
- * Whether `hostname` names a loopback host: `localhost` (or any `*.localhost`
- * subdomain), the IPv6 loopback `::1`, or an IPv4 literal inside the
- * `127.0.0.0/8` loopback block.
- *
- * The IPv4 case is matched **structurally**: the whole hostname must be a
- * canonical dotted-decimal IPv4 literal whose first octet is `127`. A bare
- * `startsWith('127.')` prefix check would also accept an attacker-controlled
- * DNS name that merely *begins* with `127.` (`127.attacker.example`,
- * `127.0.0.1.attacker.example`), letting a cross-origin browser page defeat
- * the loopback origin gate that guards the RPC/MCP surface (a DNS-rebinding /
- * cross-site WebSocket-hijacking bypass). Requiring a real IPv4 literal keeps
- * genuine loopback addresses (`127.0.0.1`, `127.5.5.5`) allowed while rejecting
- * those DNS names.
- */
-declare function isLoopbackHostname(hostname: string): boolean;
-/**
- * Whether `address` is a loopback peer address as reported by a socket
- * (`net.Socket.remoteAddress`): the IPv6 loopback `::1`, an IPv4 literal in
- * `127.0.0.0/8`, or an IPv4-mapped IPv6 form of one (`::ffff:127.0.0.1`).
- *
- * Unlike {@link isLoopbackHostname} this takes a raw address, not a hostname:
- * it never accepts a `localhost`-style name (a socket peer is always a literal
- * address) and understands the IPv4-mapped IPv6 form the OS hands back on a
- * dual-stack listener. Used to prove a same-machine caller from the connected
- * peer, which a client cannot forge, rather than from the `Origin` header,
- * which it can.
- */
-declare function isLoopbackAddress(address: string): boolean;
-/**
- * Default origin policy for a localhost dev tool: allow requests with no
- * `Origin` header (native, non-browser clients), allow any loopback origin
- * (so cross-port localhost dev setups keep working), and allow explicitly
- * configured origins. Everything else, such as a real remote page in the dev's
- * browser, is rejected.
- */
-declare function isAllowedOrigin(origin: string | undefined, allowedOrigins: readonly string[]): boolean;
-/**
- * Decide whether a request-derived origin candidate may back a devframe's
- * advertised public origin, the destination of the OTP magic link. Stricter
- * than {@link isAllowedOrigin}: it rejects credentials, a path, a query, a
- * fragment, a malformed port, and non-HTTP(S) schemes, and adopts a candidate
- * only when its hostname is loopback or its canonical origin exactly matches
- * an `allowedOrigins` entry (a caller with no static list passes none, so only
- * loopback qualifies). Returns the canonical origin to adopt, or `undefined`
- * to reject. Forwarded headers are never consulted.
- */
-declare function validateOriginCandidate(candidate: string, allowedOrigins?: readonly string[]): string | undefined;
-export { validateOriginCandidate as i, isLoopbackAddress as n, isLoopbackHostname as r, isAllowedOrigin as t };

package/dist/sse-client-B2PrSz-H.d.mts

@@ -1,35 +0,0 @@
-import { a as ChannelOptions } from "./index-BKu9BxcT.mjs";
-import { g as RpcFunctionDefinitionAny } from "./types-844OBepb.mjs";
-interface SseRpcChannelOptions {
-  /** Resolved `http(s)://` URL of the SSE endpoint. */
-  url: string;
-  onConnected?: () => void;
-  onError?: (e: Error) => void;
-  onDisconnected?: () => void;
-  authToken?: string;
-  /**
-   * RPC function definitions (or just the `jsonSerializable` flag per
-   * method) used to dispatch the per-call wire serializer, the same contract
-   * as the WS channel.
-   */
-  definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>;
-  /** Fetch implementation. Default: `globalThis.fetch`. */
-  fetch?: typeof globalThis.fetch;
-}
-/**
- * Build a birpc `ChannelOptions` object backed by an SSE stream (server →
- * client) and HTTP `POST` (client → server): the WebSocket-free counterpart
- * to `createWsRpcChannel`, wire-compatible with `attachSseRpcTransport`.
- *
- * The stream is consumed via `fetch` streaming (not `EventSource`), so it
- * works in browsers and server runtimes alike. The server's first frame
- * (`event: session`) carries the session id; every `POST` echoes it in the
- * `x-birpc-session` header. A response to a client-initiated request comes
- * back in the `POST`'s own body and is re-injected into the channel; a
- * dropped stream terminates the channel; there is no reconnect, matching
- * the WS channel's closed-is-done semantics.
- */
-declare function createSseRpcChannel(options: SseRpcChannelOptions): ChannelOptions & {
-  close: () => void;
-};
-export { createSseRpcChannel as n, SseRpcChannelOptions as t };

package/dist/ws-client-lqOeANcn.d.mts

@@ -1,28 +0,0 @@
-import { a as ChannelOptions } from "./index-BKu9BxcT.mjs";
-import { g as RpcFunctionDefinitionAny } from "./types-844OBepb.mjs";
-interface WsRpcChannelOptions {
-  url: string;
-  onConnected?: (e: Event) => void;
-  onError?: (e: Error) => void;
-  onDisconnected?: (e: CloseEvent) => void;
-  authToken?: string;
-  /**
-   * RPC function definitions (or just the `jsonSerializable` flag per
-   * method) used to dispatch the per-call wire serializer. Pass an
-   * empty / partial map on clients that don't have the full registry;
-   * encoding falls back to structured-clone (the safer superset) and
-   * decoding still routes correctly via the wire prefix.
-   */
-  definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>;
-}
-/**
- * Build a birpc `ChannelOptions` object backed by a browser `WebSocket`.
- * Pass the result straight to `createRpcClient`'s `channel` option.
- *
- * Also returns `close()`, closing the underlying socket, mirroring the server transport's
- * existing `WsRpcTransport.close()`. `birpc`'s own `ChannelOptions` has no teardown of its own.
- */
-declare function createWsRpcChannel(options: WsRpcChannelOptions): ChannelOptions & {
-  close: () => void;
-};
-export { createWsRpcChannel as n, WsRpcChannelOptions as t };

package/dist/ws-server-CYHkeyA-.d.mts

@@ -1,150 +0,0 @@
-import { a as ChannelOptions, n as BirpcGroup } from "./index-BKu9BxcT.mjs";
-import { g as RpcFunctionDefinitionAny } from "./types-844OBepb.mjs";
-import { n as DevframeRpcConnection, t as DevframeNodeRpcSessionMeta } from "./session-Y9R6tqg4.mjs";
-import { Hooks } from "crossws";
-import { NodeAdapter } from "crossws/adapters/node";
-import { Buffer } from "node:buffer";
-import { IncomingMessage, Server } from "node:http";
-import { Server as Server$1, ServerOptions } from "node:https";
-import { AddressInfo } from "node:net";
-import { Duplex } from "node:stream";
-interface WsRpcTransportOptions {
-  /**
-   * Attach to an existing HTTP(S) server, sharing its port. Combine with
-   * `path` to bind the WS endpoint to a single route so it coexists with
-   * other upgrade handlers on the same server (e.g. a Vite dev server's HMR
-   * socket). The shared server's lifecycle is owned by the caller; closing
-   * this transport detaches the upgrade listener without closing the server.
-   */
-  server?: Server | Server$1;
-  /**
-   * Port for the standalone WebSocket server. Defaults to `0`, which lets the
-   * operating system assign an available port.
-   */
-  port?: number;
-  /** Host for the standalone WebSocket server. Defaults to `localhost`. */
-  host?: string;
-  /**
-   * Restrict the WS endpoint to a single upgrade route (e.g. `/__ws`). When
-   * sharing a `server`, non-matching upgrade requests are left untouched for
-   * other listeners to handle, so devframe's socket can sit alongside
-   * framework sockets (Vite HMR, etc.).
-   */
-  path?: string;
-  /**
-   * Create the adapter without binding it to anything: no server is created,
-   * no port is bound, no `upgrade` listener is installed. The caller drives
-   * the socket itself through {@link WsRpcTransport.handleUpgrade} (from its
-   * own `upgrade` listener) or {@link WsRpcTransport.attach} (to bind a
-   * server later). Takes precedence over `server` / `port` / `https`.
-   */
-  unbound?: boolean;
-  /**
-   * Destroy upgrade requests that don't match `path` instead of leaving them
-   * for other listeners. Enable this when devframe owns the shared server
-   * outright (nothing else handles its upgrades), so an off-route client is
-   * rejected promptly rather than left hanging. Default: `false`
-   * (coexist-friendly); servers this transport creates itself always
-   * destroy unmatched upgrades.
-   */
-  destroyUnmatched?: boolean;
-  /** When set, a new https.Server is created and the WS endpoint is attached to it. */
-  https?: ServerOptions;
-  /**
-   * Extra origins to accept on the WS upgrade beyond the loopback default.
-   * Add your LAN/tunnel origin here when reaching the tool from another host.
-   * Pass `false` to disable origin checking entirely (not recommended).
-   * Default: loopback-only.
-   */
-  allowedOrigins?: readonly string[] | WsOriginRegistry | false;
-  /**
-   * RPC function definitions, used by the per-call wire serializer to
-   * dispatch between strict-JSON and structured-clone encoding based
-   * on each function's `jsonSerializable` flag.
-   *
-   * When omitted, all messages fall back to structured-clone: safe but
-   * loses dev-time validation for `jsonSerializable: true` declarations.
-   */
-  definitions?: ReadonlyMap<string, Pick<RpcFunctionDefinitionAny, 'jsonSerializable'>>;
-  onConnected?: (connection: DevframeRpcConnection, meta: DevframeNodeRpcSessionMeta) => void;
-  onDisconnected?: (connection: DevframeRpcConnection, meta: DevframeNodeRpcSessionMeta) => void;
-  /** Override the default per-call serializer. Most callers should leave this unset. */
-  serialize?: ChannelOptions['serialize'];
-  /** Override the default per-call deserializer. Most callers should leave this unset. */
-  deserialize?: ChannelOptions['deserialize'];
-}
-interface CreateWsOriginRegistryOptions {
-  /** Origins allowed before any external viewers are registered. */
-  allowedOrigins?: readonly string[];
-  /** Additional validation to run after the registration token is verified. */
-  validateOrigin?: (origin: string) => boolean;
-}
-interface WsOriginRegistry {
-  /** Registration token to include in connection metadata. */
-  readonly token: string;
-  /** Read and register an origin from a connection bootstrap URL. */
-  registerFromUrl: (url: string) => string | undefined;
-  /** Check whether an origin is currently allowed. */
-  isAllowed: (origin: string | undefined) => boolean;
-}
-/**
- * Create a live, token-protected origin allowlist for external browser
- * viewers. Pass it to {@link WsRpcTransportOptions.allowedOrigins}, then use
- * `registerFromUrl()` in the connection metadata handler to authorize a
- * viewer without sharing a mutable array or disabling DNS-rebinding protection.
- */
-declare function createWsOriginRegistry(options?: CreateWsOriginRegistryOptions): WsOriginRegistry;
-interface WsRpcTransport {
-  /**
-   * The crossws node adapter driving the socket; exposes the connected
-   * `peers` and pub/sub. See https://crossws.h3.dev.
-   */
-  ws: NodeAdapter;
-  /** Resolves when the transport-owned server is listening. */
-  ready: Promise<void>;
-  /** Returns the bound address, or `null` when the server is not listening. */
-  address: () => AddressInfo | string | null;
-  /**
-   * Complete a `node:http` `upgrade` event on this transport, applying the
-   * same `path` filter and origin gate the transport's own listener uses.
-   * Wire it into a host server directly (`server.on('upgrade',
-   * transport.handleUpgrade)`) or call it from an existing listener.
-   */
-  handleUpgrade: (req: IncomingMessage, socket: Duplex, head: Buffer) => void;
-  /**
-   * Route a server's `upgrade` events to this transport, returning a detach
-   * function. Use it to bind an `unbound` transport once the host server
-   * exists; {@link WsRpcTransport.close} detaches every server attached this
-   * way (without closing them, since the caller owns their lifecycle).
-   */
-  attach: (server: Server | Server$1) => () => void;
-  /** Remove the upgrade listener from a shared `server` (a no-op otherwise). */
-  detach: () => void;
-  /**
-   * Tear the transport down deterministically: detach from a shared server,
-   * force-terminate every connected peer, and close any server this
-   * transport created itself (`port` / `https` modes).
-   */
-  close: () => Promise<void>;
-}
-/**
- * The per-peer lifecycle hooks driving a devframe RPC WebSocket, shaped for
- * any [crossws](https://crossws.h3.dev) adapter. {@link attachWsRpcTransport}
- * feeds them to the Node adapter; runtime-specific attachments (e.g. Bun's
- * fetch-upgrade adapter) reuse the same hooks so every transport speaks the
- * identical wire protocol: one birpc channel per peer, per-method
- * `jsonSerializable` dispatch between strict JSON and structured-clone.
- */
-declare function createWsRpcPeerHooks<ClientFunctions extends object, ServerFunctions extends object>(rpcGroup: BirpcGroup<ClientFunctions, ServerFunctions, false>, options?: Pick<WsRpcTransportOptions, 'onConnected' | 'onDisconnected' | 'definitions' | 'serialize' | 'deserialize'>): Partial<Hooks>;
-/**
- * Attach a WebSocket transport to an existing RPC group, powered by
- * [crossws](https://crossws.h3.dev). Either attach to an existing HTTP(S)
- * `server` (sharing its port, optionally scoped to a `path`), or let this
- * helper create a standalone server from `port` / `host` / `https`.
- *
- * Returns the crossws node adapter, standalone-server readiness/address
- * accessors, `detach` (remove the upgrade listener from a shared `server`),
- * and `close` (full deterministic teardown).
- */
-declare function attachWsRpcTransport<ClientFunctions extends object, ServerFunctions extends object>(rpcGroup: BirpcGroup<ClientFunctions, ServerFunctions, false>, options?: WsRpcTransportOptions): WsRpcTransport;
-export { attachWsRpcTransport as a, WsRpcTransportOptions as i, WsOriginRegistry as n, createWsOriginRegistry as o, WsRpcTransport as r, createWsRpcPeerHooks as s, CreateWsOriginRegistryOptions as t };