vite-devtools-svelte 0.6.0 → 0.6.1

package/dist/mcp/http.d.ts

@@ -0,0 +1,24 @@
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { Logger } from 'vite';
+import { Collector } from '../server/collector.js';
+/** Dev-server path of the MCP endpoint. */
+export declare const MCP_PATH = "/__svelte-devtools/mcp";
+/**
+ * Whether the request's `x-svelte-devtools-token` header is exactly `token`.
+ * Constant-time for equal lengths (the length itself is not secret: every
+ * token is a UUID). A repeated header (string array) is never accepted.
+ */
+export declare function isValidMcpToken(header: string | string[] | undefined, token: string): boolean;
+/**
+ * Connect middleware for the MCP endpoint: lets AI agents (Claude Code etc.)
+ * read metrics and run measurement sessions over the Streamable HTTP
+ * transport. Same-origin is *not* required because MCP clients are local
+ * processes that don't run inside a browser tab; the token is the gate.
+ */
+export declare function createMcpMiddleware(opts: {
+    token: string;
+    collector: Collector;
+    logger: Logger;
+    createServer: () => McpServer;
+}): (req: IncomingMessage, res: ServerResponse) => void;

package/dist/mcp/server.d.ts

@@ -1,16 +1,11 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { RenderProfile, ReactiveGraph, LoadProfile, FpsSample, ComponentInstance, ProjectInfo, RouteInfo, ComponentRelation, CaptureInfoMap, ReactiveGraphRequest, ReactiveGraphResult, ReactiveSummary, ReactiveSummaryRequest, StateTimelineDelta } from '../types.js';
 import { SessionStore } from './sessions.js';
 export interface McpDeps {
     getProject: () => ProjectInfo;
     getRoutes: () => RouteInfo[];
-    getLiveComponents: () => ComponentInstance[];
-    /**
-     * The served page load's components with its epoch, read together
-     * (`get_live_components` with `includeMeta`).
-     */
-    getLiveSnapshot?: () => {
+    /** The served page load's components with its epoch, read together. */
+    getLiveSnapshot: () => {
         epoch: string | null;
         total: number;
         components: ComponentInstance[];
@@ -22,12 +17,11 @@ export interface McpDeps {
     getLoadProfiles: () => LoadProfile[];
     getFpsSamples: () => FpsSample[];
     sessions: SessionStore;
-    getReactiveSummary?: (req: ReactiveSummaryRequest) => Promise<ReactiveSummary>;
-    getReactiveScope?: (req: ReactiveGraphRequest) => Promise<ReactiveGraphResult>;
-    getStateTimelineDelta?: (since?: number) => StateTimelineDelta;
-    getCaptureInfo?: () => CaptureInfoMap;
+    getReactiveSummary: (req: ReactiveSummaryRequest) => Promise<ReactiveSummary>;
+    getReactiveScope: (req: ReactiveGraphRequest) => Promise<ReactiveGraphResult>;
+    getStateTimelineDelta: (since?: number) => StateTimelineDelta;
+    getCaptureInfo: () => CaptureInfoMap;
 }
 /** Most timeline entries one `get_state_timeline` call returns. */
 export declare const MCP_TIMELINE_LIMIT = 500;
 export declare function buildMcpServer(deps: McpDeps): McpServer;
-export { StreamableHTTPServerTransport };

package/dist/mcp/sessions.d.ts

@@ -47,6 +47,7 @@ export interface SessionDelta {
         drops: number;
     };
 }
+type Verdict = 'improved' | 'regressed' | 'unchanged';
 export interface SessionDiff {
     a: {
         id: string;
@@ -60,33 +61,40 @@ export interface SessionDiff {
         totalRenderTimeDeltaA: number;
         totalRenderTimeDeltaB: number;
         diff: number;
-        verdict: 'improved' | 'regressed' | 'unchanged';
+        verdict: Verdict;
     };
     load: {
         avgA: number;
         avgB: number;
         diff: number;
-        verdict: 'improved' | 'regressed' | 'unchanged';
+        verdict: Verdict;
     };
     fps: {
         avgA: number;
         avgB: number;
         diff: number;
-        verdict: 'improved' | 'regressed' | 'unchanged';
+        verdict: Verdict;
     };
 }
+interface SessionSummary {
+    id: string;
+    label: string;
+    startedAt: number;
+    endedAt?: number;
+    persisted: boolean;
+    active: boolean;
+}
 export interface MetricGetters {
     getRenderProfiles: () => RenderProfile[];
     getLoadProfiles: () => LoadProfile[];
     getFpsSamples: () => FpsSample[];
 }
 /**
- * The only id shape `start()` issues: `s_<Date.now() base36>_<6 hex>`. Ids
- * reach the store from MCP clients and become file names, so anything else
- * (path separators, `..`, absolute paths) is rejected before touching disk
- * (review C-7).
+ * Whether `id` has the only shape `start()` issues: `s_<Date.now() base36>_<6
+ * hex>`. Ids reach the store from MCP clients and become file names, so
+ * anything else (path separators, `..`, absolute paths) is rejected before
+ * touching disk (review C-7).
  */
-export declare const SESSION_ID_PATTERN: RegExp;
 export declare function isSessionId(id: unknown): id is string;
 export interface SessionStoreOptions {
     persistDir: string;
@@ -99,28 +107,23 @@ export declare class SessionStore {
     private readonly getters;
     constructor(opts: SessionStoreOptions);
     start(label: string, persist: boolean): SessionRecord;
+    private get activeRecord();
     /** Called by the plugin whenever a new load profile arrives. */
     recordLoadProfile(p: LoadProfile): void;
     /** Called by the plugin whenever a new fps sample arrives. */
     recordFpsSample(s: FpsSample): void;
     end(keep: 'memory' | 'disk' | 'discard'): SessionRecord;
     get(id: string): SessionRecord | undefined;
-    list(): Array<{
-        id: string;
-        label: string;
-        startedAt: number;
-        endedAt?: number;
-        persisted: boolean;
-        active: boolean;
-    }>;
+    list(): SessionSummary[];
     delete(id: string): boolean;
-    delta(id: string): SessionDelta;
     /**
      * The delta of a record in hand. `end('discard')` removes the record from
      * the store, so end_session must not look it up again by id (it used to,
      * and failed with "Session not found" for every discarded session).
      */
     deltaOf(rec: SessionRecord): SessionDelta;
+    delta(id: string): SessionDelta;
+    private found;
     compare(idA: string, idB: string): SessionDiff;
     /** The session's file, guaranteed to be a direct child of `persistDir`. */
     private pathFor;

package/dist/mcp/stats.d.ts

@@ -0,0 +1,13 @@
+/** Arithmetic mean, 0 for no values. */
+export declare function avg(xs: number[]): number;
+/** Smallest value, `fallback` for no values (reduce, not `Math.min(...)`: long lists overflow the stack). */
+export declare function min<T>(xs: number[], fallback: T): number | T;
+/** Largest value, `fallback` for no values. */
+export declare function max<T>(xs: number[], fallback: T): number | T;
+/** Rounded to 2 decimals. */
+export declare function round(n: number): number;
+/** Average render time of a profile, 0 when it never rendered. */
+export declare function avgRenderTime(p: {
+    renderCount: number;
+    totalRenderTime: number;
+}): number;

package/dist/plugin.d.ts

@@ -20,10 +20,4 @@ export interface SvelteDevtoolsOptions {
      */
     clientAuth?: boolean;
 }
-/**
- * Whether the request's `x-svelte-devtools-token` header is exactly `token`.
- * Constant-time for equal lengths (the length itself is not secret: every
- * token is a UUID). A repeated header (string array) is never accepted.
- */
-export declare function isValidMcpToken(header: string | string[] | undefined, token: string): boolean;
 export declare function svelteDevtools(options?: SvelteDevtoolsOptions): Plugin[];

package/dist/runtime/transform.d.ts

@@ -8,8 +8,8 @@
  * compiler's sourcemap stay aligned).
  */
 export declare function injectComponentTracking(code: string, id: string): string | null;
-/** A Svelte module (`.svelte.js` / `.svelte.ts`, runes outside components). */
-export declare const SVELTE_MODULE_RE: RegExp;
+/** A Svelte module (`.svelte.js` / `.svelte.ts`, runes outside components); `file` has no query. */
+export declare function isSvelteModule(file: string): boolean;
 /**
  * Module-scope transform for one client Svelte module: signals created while
  * its body runs (shared state, `export const cart = $state(...)`) are tracked

package/dist/server/collector.d.ts

@@ -1,4 +1,7 @@
-import { CaptureInfoMap, CompilerWarning, ComponentInstance, FpsSample, LoadProfile, ReactiveGraph, ReactiveGraphRequest, ReactiveGraphResult, ReactiveSummary, ReactiveSummaryRequest, RenderProfile, RuntimeError, StateChange, StateTimelineDelta, StateTimelineEntry, DatasetVersions } from '../types.js';
+import { CaptureInfoMap, CompilerWarning, ComponentInstance, FpsSample, LoadProfile, ReactiveGraphRequest, ReactiveGraphResult, ReactiveSummary, ReactiveSummaryRequest, RenderProfile, RuntimeError, StateChange, StateTimelineDelta, StateTimelineEntry, DatasetVersions } from '../types.js';
+import { Payload } from './payload.js';
+import { TimelinePush } from './state-timeline.js';
+export { STATE_TIMELINE_BYTES } from './state-timeline.js';
 export declare const LIMITS: {
     readonly liveComponents: 50000;
     readonly renderProfiles: 5000;
@@ -14,9 +17,8 @@ export declare const LIMITS: {
 export declare const RUNTIME_REQUEST_TIMEOUT = 1000;
 /** A pull answered within this window is reused instead of asking the runtime again. */
 export declare const PULL_FRESHNESS = 1000;
-/** Byte budget (JSON length, measured once at ingest) for the server-side state timeline. */
-export declare const STATE_TIMELINE_BYTES: number;
-export type DatasetKey = keyof DatasetVersions;
+/** A consumer (DevTools UI tab, MCP agent) counts as watching until its lease expires. */
+export declare const LEASE_TTL = 15000;
 /** App page loads (tabs / reloads) whose component tree + profiles are kept, LRU. */
 export declare const MAX_EPOCHS = 4;
 /** Hot-channel event names shared with `runtime.ts` (stable contract, see docs/devframe-migration.md §6). */
@@ -38,10 +40,6 @@ export declare const HOT_EVENTS: {
     /** server → runtime(s): `{ active: boolean }` — whether any consumer is watching. */
     readonly subscription: "svelte-devtools:subscription";
 };
-/** A hot-channel payload: an untrusted JSON object from the app's runtime. */
-type Payload = Record<string, unknown>;
-/** A consumer (DevTools UI tab, MCP agent) counts as watching until its lease expires. */
-export declare const LEASE_TTL = 15000;
 export interface HotClient {
     send(event: string, payload: unknown): void;
 }
@@ -63,46 +61,32 @@ export declare class Collector {
     private epochs;
     private servedEpoch;
     private liveCache;
-    loadProfiles: LoadProfile[];
-    reactiveGraph: ReactiveGraph;
-    compilerWarnings: CompilerWarning[];
-    runtimeErrors: RuntimeError[];
-    fpsSamples: FpsSample[];
+    /** Epochs we asked for a full snapshot (delta without a base); answered once per epoch. */
+    private resyncRequested;
+    private readonly fps;
+    private readonly errors;
+    private readonly loads;
+    private readonly warnings;
+    private readonly timeline;
     readonly versions: DatasetVersions;
-    private bump;
-    private timeline;
-    /** Parallel to `timeline`: JSON size and source epoch (app page load) of each entry. */
-    private timelineSizes;
-    private timelineEpochs;
-    private timelineBytes;
-    /** Newest seq issued by this collector (= the current cursor). */
-    private timelineSeq;
-    /** Cursor value at the last removal; older cursors must start over. */
-    private timelineResetAt;
-    /** Seq of the newest entry trimmed by the caps; cursors below it missed entries. */
-    private timelineTrimmedAt;
-    private lastPull;
-    private inflight;
     private pulls;
     private pullCache;
     private pullInflight;
     private requestSeq;
     /** The most recent graph reply, for capture info. */
     private lastGraph;
-    private timelineDrops;
-    /** Per epoch: whether the runtime has a first sample of every tracked $state yet. */
-    private timelineBaseline;
-    private timelineTooLarge;
-    private received;
+    private lastTimelinePull;
+    private timelineInflight;
+    private timelineResolvers;
     private hot;
     private detachHot;
     private leases;
     private snapshotWaiters;
     private active;
     private sweepTimer;
-    private stateTimelineResolvers;
     private readonly hooks;
     constructor(hooks?: CollectorHooks);
+    private bump;
     /**
      * Subscribe to the runtime's hot-channel events. Re-attaching (dev server
      * restart) detaches the previous channel first so listeners never pile up.
@@ -114,8 +98,12 @@ export declare class Collector {
         active: boolean;
         componentDeltas: true;
     };
-    /** Epochs we asked for a full snapshot (delta without a base); answered once per epoch. */
-    private resyncRequested;
+    get fpsSamples(): FpsSample[];
+    get runtimeErrors(): RuntimeError[];
+    get loadProfiles(): LoadProfile[];
+    get compilerWarnings(): CompilerWarning[];
+    /** The server-side timeline (all tracked epochs, oldest first). */
+    get stateTimeline(): StateTimelineEntry[];
     /** Components of the served epoch, parents first, capped at {@link LIMITS.liveComponents}. */
     get liveComponents(): ComponentInstance[];
     /**
@@ -149,9 +137,10 @@ export declare class Collector {
     /**
      * Mark `id` as watching for `ttl` ms (renewed by heartbeats). The first
      * lease activates the runtime's polling/FPS sampling, the last expiry or
-     * release pauses it.
+     * release pauses it. Returns whether this call activated it.
      */
     lease(id: string, ttl?: number): boolean;
+    release(id: string): void;
     /**
      * Resolve once the runtime has sent its activation snapshot (components,
      * profiles, then a `reset: true` timeline — the last part) or after
@@ -159,7 +148,6 @@ export declare class Collector {
      * the stale pre-activation state.
      */
     waitForSnapshot(timeout: number): Promise<void>;
-    release(id: string): void;
     private updateSubscription;
     /**
      * Full form `{ epoch?, reset?, components }` replaces the epoch's tree;
@@ -169,56 +157,30 @@ export declare class Collector {
      * resync. Entries stay in registration order (parents first); an instance
      * is stored only while its parent is and the cap allows, otherwise only its
      * id is tracked, so the stored part is always a rooted, orphan-free tree.
+     * Entries that are not objects with a numeric `id` are ignored.
+     */
+    ingestComponents(data: Payload | undefined, client?: HotClient): void;
+    ingestProfiles(data?: Payload): void;
+    ingestStateTimeline(data: TimelinePush | undefined): void;
+    ingestFps(sample: FpsSample): void;
+    ingestRuntimeError(error: RuntimeError): void;
+    recordLoadProfile(profile: LoadProfile): void;
+    /**
+     * A warning identical to one held is not recorded again: a component is
+     * compiled once per environment (client and SSR), each time warning anew.
      */
-    ingestComponents(data: {
-        components?: unknown;
-        epoch?: unknown;
-        added?: unknown;
-        removed?: unknown;
-    } | undefined, client?: HotClient): void;
-    ingestProfiles(data?: {
-        profiles?: unknown;
-        epoch?: unknown;
-        total?: unknown;
-    }): void;
+    recordCompilerWarning(warning: CompilerWarning): void;
+    clearLoadProfiles(): void;
+    clearErrors(): void;
+    clearFps(): void;
+    clearStateTimeline(): void;
+    /** Changes after `since` (a previous `cursor`), or the whole buffer when the cursor is stale. */
+    getStateTimelineDelta(since?: number): StateTimelineDelta;
     /**
      * What the server holds versus what was reported, per dataset (§6.7 B).
      * `total: null` means unknown; nothing is estimated.
      */
     getCaptureInfo(): CaptureInfoMap;
-    /** The server-side timeline (all tracked epochs, oldest first). */
-    get stateTimeline(): StateTimelineEntry[];
-    /**
-     * Two payload shapes (docs/devframe-migration.md §6.4):
-     * - delta: `{ epoch, changes, reset? }` — `changes` are new since the
-     *   previous push from that page load (`epoch`); `reset` replaces that
-     *   epoch's entries. Entries are kept per epoch, so several app tabs (or a
-     *   reload) interleave instead of wiping each other.
-     * - legacy full snapshot: `{ changes }` — we append only the entries after
-     *   the newest one we already hold, so clients still get deltas.
-     */
-    ingestStateTimeline(data: {
-        changes?: unknown;
-        epoch?: unknown;
-        reset?: unknown;
-        dropped?: unknown;
-        valueTooLarge?: unknown;
-        baseline?: unknown;
-    } | undefined): void;
-    /**
-     * Add the runtime's own losses (unsent entries it evicted, §6.7 C) and
-     * too-large values to the epoch's counters. Only runtime reasons are
-     * accepted from the runtime; server reasons are counted here.
-     */
-    private countRuntimeLosses;
-    private addDrop;
-    /** Changes after `since` (a previous `cursor`), or the whole buffer when the cursor is stale. */
-    getStateTimelineDelta(since?: number): StateTimelineDelta;
-    /** Invalidate every cursor issued so far (entries were removed, not just appended). */
-    private markTimelineReset;
-    private dropEpoch;
-    private appendTimeline;
-    private resolveSnapshotWaiters;
     /**
      * A graph reply. With a `requestId` (§6.7 A) it resolves only that request,
      * and only if its epoch matches the one asked for; a reply nobody waits for
@@ -227,26 +189,10 @@ export declare class Collector {
      * filtering here.
      */
     ingestReactiveGraph(data: Payload | undefined): void;
-    /**
-     * Shape a runtime reply into a {@link ReactiveGraphResult}: apply the
-     * collector caps (nodes, then only edges between kept nodes, then the edge
-     * cap) and report what was left out. Totals come from the runtime; an older
-     * runtime's are the counts it sent (`nodesKind: 'sent'`), or unknown when
-     * the server had to scope its whole-app graph.
-     */
-    private normalizeGraph;
-    private storeGraph;
     /** A summary reply (§6.7 I): resolves only the matching request. */
     ingestReactiveSummary(data: Payload | undefined): void;
-    private normalizeSummary;
-    ingestFps(sample: FpsSample): void;
-    ingestRuntimeError(error: RuntimeError): void;
-    recordLoadProfile(profile: LoadProfile): void;
-    recordCompilerWarning(warning: CompilerWarning): void;
-    clearLoadProfiles(): void;
-    clearErrors(): void;
-    clearFps(): void;
-    clearStateTimeline(): void;
+    /** The pending pull `requestId` names, if the reply is of its kind and from its epoch. */
+    private matchingPull;
     /**
      * Ask the browser runtime for the graph of one component instance (or the
      * whole app), built by the runtime within the caps (§6.7 A). Falls back to
@@ -262,18 +208,17 @@ export declare class Collector {
      * last result for the same key is returned with `stale: true`.
      */
     private keyedPull;
-    /** Resolve a pending pull with a fresh result and cache it under its key. */
+    /**
+     * Resolve a pending pull: with a fresh result (cached under its key), or
+     * with its fallback when the runtime did not answer.
+     */
     private settle;
-    /** Answer every pending keyed pull from its cache (or empty), marked stale. */
-    private flushPulls;
-    /** Ask the browser runtime for a fresh state timeline; falls back to the last one. */
-    requestStateTimeline(): Promise<StateChange[]>;
     /**
-     * Concurrent callers share one in-flight pull, and a result younger than
-     * {@link PULL_FRESHNESS} is reused, so several polling clients never make
-     * the user's app rebuild the same data more than once a second.
+     * Ask the browser runtime for a fresh state timeline; falls back to the
+     * last one. Concurrent callers share one in-flight pull, and a result
+     * younger than {@link PULL_FRESHNESS} is reused, so several polling clients
+     * never make the user's app rebuild the same data more than once a second.
      */
-    private pull;
+    requestStateTimeline(): Promise<StateChange[]>;
     private flushStateTimeline;
 }
-export {};

package/dist/server/compiler-warnings.d.ts

@@ -0,0 +1,13 @@
+import { Plugin } from 'vite';
+import { CompilerWarning } from '../types.js';
+/**
+ * Report every Svelte compiler warning of the app to `record`, as the
+ * compiler's structured warning (vite-plugin-svelte prints dev warnings with
+ * `console.log`, past Vite's logger). The user's `onwarn` (or the default
+ * handler) still runs, so console output is unchanged. Dependencies'
+ * warnings are skipped, as vite-plugin-svelte does in dev.
+ *
+ * Must run after vite-plugin-svelte's own `configResolved`, which creates
+ * the options (a restart creates new ones, so wrappers never stack).
+ */
+export declare function captureCompilerWarnings(plugins: readonly Plugin[], record: (warning: CompilerWarning) => void): void;

package/dist/server/devframe.d.ts

@@ -32,10 +32,10 @@ export interface SvelteDevtoolsHost {
     /** Open `file[:line]` in the user's editor. */
     openInEditor: (target: string) => void;
 }
-export declare function createRpcFunctions(host: SvelteDevtoolsHost): readonly [import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-project", "query", [], import('../types.js').ProjectInfo, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-routes", "query", [], import('../types.js').RouteInfo[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-assets", "query", [], import('../types.js').AssetInfo[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-component-relations", "query", [], import('../types.js').ComponentRelation[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-svelte-files", "query", [], {
+export declare function createRpcFunctions(host: SvelteDevtoolsHost): readonly [import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-project", "query" | "action", [], import('../types.js').ProjectInfo, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-routes", "query" | "action", [], import('../types.js').RouteInfo[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-assets", "query" | "action", [], import('../types.js').AssetInfo[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-component-relations", "query" | "action", [], import('../types.js').ComponentRelation[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-svelte-files", "query" | "action", [], {
     file: string;
     name: string;
-}[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-live-components", "query", [], import('../types.js').ComponentInstance[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-live-components-meta", "query", [], LiveComponentsMeta, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"set-active", "action", readonly [z.ZodObject<{
+}[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-live-components", "query" | "action", [], import('../types.js').ComponentInstance[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-live-components-meta", "query" | "action", [], LiveComponentsMeta, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"set-active", "action", readonly [z.ZodObject<{
     client: z.ZodString;
     active: z.ZodBoolean;
 }, z.core.$strip>], z.ZodVoid, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"open-in-editor", "action", readonly [z.ZodObject<{
@@ -45,7 +45,7 @@ export declare function createRpcFunctions(host: SvelteDevtoolsHost): readonly [
     file: z.ZodString;
     name: z.ZodString;
     type: z.ZodString;
-}, z.core.$strip>], z.ZodVoid, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-render-profiles", "query", [], import('../types.js').RenderProfile[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"get-reactive-graph", "query", readonly [z.ZodOptional<z.ZodObject<{
+}, z.core.$strip>], z.ZodVoid, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-render-profiles", "query" | "action", [], import('../types.js').RenderProfile[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"get-reactive-graph", "query", readonly [z.ZodOptional<z.ZodObject<{
     componentId: z.ZodOptional<z.ZodNumber>;
     epoch: z.ZodOptional<z.ZodString>;
     maxNodes: z.ZodOptional<z.ZodNumber>;
@@ -53,9 +53,9 @@ export declare function createRpcFunctions(host: SvelteDevtoolsHost): readonly [
 }, z.core.$strip>>], z.ZodCustom<ReactiveGraphResult, ReactiveGraphResult>, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"get-reactive-summary", "query", readonly [z.ZodOptional<z.ZodObject<{
     topK: z.ZodOptional<z.ZodNumber>;
     windowMs: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>>], z.ZodCustom<ReactiveSummary, ReactiveSummary>, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-capture-info", "query", [], Partial<Record<import('../types.js').CaptureKey, import('../types.js').CaptureInfo>>, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-load-profiles", "query", [], import('../types.js').LoadProfile[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"clear-load-profiles", "action", [], void, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-state-timeline", "query", [], Promise<import('../types.js').StateChange[]>, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"get-state-timeline-delta", "query", readonly [z.ZodObject<{
+}, z.core.$strip>>], z.ZodCustom<ReactiveSummary, ReactiveSummary>, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-capture-info", "query" | "action", [], Partial<Record<import('../types.js').CaptureKey, import('../types.js').CaptureInfo>>, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-load-profiles", "query" | "action", [], import('../types.js').LoadProfile[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"clear-load-profiles", "query" | "action", [], void, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-state-timeline", "query" | "action", [], Promise<import('../types.js').StateChange[]>, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"get-state-timeline-delta", "query", readonly [z.ZodObject<{
     since: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>], z.ZodCustom<StateTimelineDelta, StateTimelineDelta>, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-versions", "query", [], {
+}, z.core.$strip>], z.ZodCustom<StateTimelineDelta, StateTimelineDelta>, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-versions", "query" | "action", [], {
     components: number;
     renderProfiles: number;
     loadProfiles: number;
@@ -63,7 +63,7 @@ export declare function createRpcFunctions(host: SvelteDevtoolsHost): readonly [
     reactiveGraph: number;
     errors: number;
     fps: number;
-}, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"clear-state-timeline", "action", [], void, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-api-endpoints", "query", [], import('../types.js').ApiEndpoint[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"send-api-request", "action", readonly [z.ZodObject<{
+}, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"clear-state-timeline", "query" | "action", [], void, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-api-endpoints", "query" | "action", [], import('../types.js').ApiEndpoint[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"send-api-request", "action", readonly [z.ZodObject<{
     url: z.ZodString;
     method: z.ZodEnum<{
         GET: "GET";
@@ -76,11 +76,11 @@ export declare function createRpcFunctions(host: SvelteDevtoolsHost): readonly [
     }>;
     headers: z.ZodString;
     body: z.ZodString;
-}, z.core.$strip>], z.ZodCustom<ApiResponse, ApiResponse>, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-compiler-warnings", "query", [], import('../types.js').CompilerWarning[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-runtime-errors", "query", [], import('../types.js').RuntimeError[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"clear-errors", "action", [], void, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"inspect-file", "query", readonly [z.ZodObject<{
+}, z.core.$strip>], z.ZodCustom<ApiResponse, ApiResponse>, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-compiler-warnings", "query" | "action", [], import('../types.js').CompilerWarning[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-runtime-errors", "query" | "action", [], import('../types.js').RuntimeError[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"clear-errors", "query" | "action", [], void, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"inspect-file", "query", readonly [z.ZodObject<{
     file: z.ZodString;
-}, z.core.$strip>], z.ZodCustom<InspectResult, InspectResult>, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-module-graph", "query", [], import('../types.js').ModuleGraphData, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"get-og-preview", "action", readonly [z.ZodObject<{
+}, z.core.$strip>], z.ZodCustom<InspectResult, InspectResult>, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-module-graph", "query" | "action", [], import('../types.js').ModuleGraphData, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithSchemas<"get-og-preview", "action", readonly [z.ZodObject<{
     url: z.ZodString;
-}, z.core.$strip>], z.ZodCustom<OGPreview, OGPreview>, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-build-analysis", "query", [], import('../types.js').BuildAnalysis, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-fps", "query", [], import('../types.js').FpsSample[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"clear-fps", "action", [], void, undefined, undefined, import('devframe').DevframeNodeContext>];
+}, z.core.$strip>], z.ZodCustom<OGPreview, OGPreview>, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-build-analysis", "query" | "action", [], import('../types.js').BuildAnalysis, undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"get-fps", "query" | "action", [], import('../types.js').FpsSample[], undefined, undefined, import('devframe').DevframeNodeContext>, import('devframe/rpc').RpcFunctionDefinitionWithoutSchemas<"clear-fps", "query" | "action", [], void, undefined, undefined, import('devframe').DevframeNodeContext>];
 /**
  * The portable Svelte DevTools tool. Host-agnostic: the same definition is
  * mounted standalone (`initDevframe`) or inside Vite DevTools

package/dist/server/load-profile.d.ts

@@ -0,0 +1,12 @@
+/** Server-side hook the profiled `load` wrappers report to (set by the plugin on the dev server). */
+export declare const LOAD_RECORDER = "__svelte_devtools_record_load";
+/**
+ * Wrap the exported `load` of a SvelteKit load file (`+page.ts`,
+ * `+layout.server.js`, …) so each call reports its duration and data size,
+ * or `null` when `id` is not a load file or declares no exported `load`.
+ *
+ * Only the `export` keyword is removed (the local binding stays, so the
+ * module's own references keep the original) and a profiled wrapper is
+ * exported as `load` instead; line numbers are unchanged.
+ */
+export declare function profileLoad(code: string, id: string, root: string): string | null;

package/dist/server/mount.d.ts

@@ -1,5 +1,7 @@
 import { DevframeDefinition } from 'devframe';
 import { ViteDevServer } from 'vite';
+/** `address` as a URL host: `localhost` for loopback / wildcard bindings, IPv6 bracketed. */
+export declare function urlHost(address: string): string;
 /**
  * Serve the devframe standalone on this dev server: SPA, discovery,
  * WebSocket RPC on Vite's own HTTP server at `<base>__ws`, auth gate.

package/dist/server/payload.d.ts

@@ -0,0 +1,11 @@
+/** A hot-channel payload: an untrusted JSON object from the app's runtime. */
+export type Payload = Record<string, unknown>;
+export declare function asPayload(value: unknown): Payload | undefined;
+/** An integer within [min, max], or `fallback` when absent / not a number. */
+export declare function clampInt(value: unknown, min: number, max: number, fallback: number): number;
+/** A non-negative safe integer, 0 when absent / not a number. */
+export declare function nonNegInt(value: unknown): number;
+/** A finite number, or `null` when absent / not one. */
+export declare function finiteOrNull(value: unknown): number | null;
+/** The array's elements (none when it is not an array). */
+export declare function arrayOf<T>(value: unknown): T[];

package/dist/server/reactive.d.ts

@@ -0,0 +1,30 @@
+import { ReactiveGraphResult, ReactiveSummary } from '../types.js';
+import { Payload } from './payload.js';
+/** Most nodes / edges one graph answer holds. */
+export declare const GRAPH_LIMITS: {
+    readonly nodes: 5000;
+    readonly edges: 20000;
+};
+/** Defaults and bounds for `get-reactive-summary` (§6.7 I). */
+export declare const SUMMARY_DEFAULTS: {
+    readonly topK: 50;
+    readonly maxTopK: 200;
+    readonly windowMs: 10000;
+    readonly minWindowMs: 1000;
+    readonly maxWindowMs: 60000;
+};
+export type StaleReason = NonNullable<ReactiveGraphResult['staleReason']>;
+/** An empty graph answer, marked stale for `reason`. */
+export declare function emptyGraph(scope: number | null, epoch: string | null, reason: StaleReason): ReactiveGraphResult;
+/** An empty summary answer, marked stale for `reason`. */
+export declare function emptySummary(epoch: string | null, windowMs: number, reason: 'timeout' | 'no-runtime'): ReactiveSummary;
+/**
+ * Shape a runtime reply into a {@link ReactiveGraphResult}: apply the caps
+ * (nodes, then only edges between kept nodes, then the edge cap) and report
+ * what was left out. Totals come from the runtime; an older runtime's (no
+ * `requestId`) are the counts it sent (`nodesKind: 'sent'`), or unknown when
+ * the server had to scope its whole-app graph.
+ */
+export declare function normalizeGraph(data: Payload | undefined, scope: number | null, epoch: string | null): ReactiveGraphResult;
+/** Shape a runtime summary reply (§6.7 I); every field is validated, nothing assumed. */
+export declare function normalizeSummary(data: Payload | undefined, epoch: string | null): ReactiveSummary;

package/dist/server/ring.d.ts

@@ -0,0 +1,11 @@
+import { CaptureInfo } from '../types.js';
+/** A tail-capped dataset that counts what it received since the last clear. */
+export declare class Ring<T> {
+    items: T[];
+    received: number;
+    private readonly max;
+    constructor(max: number);
+    push(item: T): void;
+    clear(): void;
+    get info(): CaptureInfo;
+}

package/dist/server/security.d.ts

@@ -2,7 +2,7 @@
  * Validate that a URL does not target private/internal network addresses (SSRF prevention).
  * Allows only http/https schemes and blocks private IP ranges.
  */
-export declare function validateExternalUrl(urlStr: string): void;
+export declare function validateExternalUrl(urlStr: string): URL;
 export interface OutboundUrlOptions {
     /**
      * Origins that may be fetched even though they are local — the dev
@@ -27,6 +27,8 @@ export declare function assertOutboundUrl(urlStr: string, options?: OutboundUrlO
  * malformed value is never let through.
  */
 export declare function isPrivateIP(ip: string): boolean;
+/** Whether `file` lies inside `dir` (`..foo/x` does; `dir` itself, `../x` and other drives do not). */
+export declare function isInside(dir: string, file: string): boolean;
 /**
  * Resolve a user-supplied file path strictly under `root`. Symlinks are
  * followed via realpathSync so that symlinks inside the project cannot be