From b35b1ab9e107cbcc6f5a6ac42075dab15bef17e2 Mon Sep 17 00:00:00 2001
From: "Anthony Fu (via agent)" <reg-github-bot@antfu.me>
Date: Tue, 15 Sep 2026 01:12:11 +0000
Subject: [PATCH 1/5] chore(deps): shrink the install footprint

- add devframe/utils/url, an in-house, browser-safe replacement for the
  handful of ufo helpers (joinURL, withBase, withProtocol, slash helpers,
  cleanDoubleSlashes); ufo is gone from every package and the catalog
- move the types-only @standard-schema/spec to devDependencies everywhere
  and inline its declarations into each package's dts
- bundle the remaining tiny pure deps instead of installing them:
  birpc, mrmime, nostics, pathe (devframe); pathe, perfect-debounce,
  tinyexec (hub); pathe (agentic, vite kit, service-open, plugin-git);
  image-meta, pathe, perfect-debounce, tinyglobby (plugin-assets)
- give the throwing root entries an explicit 'export {}' so dts emit
  stops warning about them

devframe's runtime deps shrink to crossws + h3; hub's to destr + h3 +
zigpty; every dist stays self-contained (verified: no bundled-package
import specifiers survive in dist).
---
 alias.ts                                      |   1 +
 docs/app/pages/logos.vue                      |   3 +-
 docs/content/8.references/8.utilities.md      |  14 ++
 docs/package.json                             |   3 +-
 packages/agentic/package.json                 |   7 +-
 packages/agentic/src/connect/index.ts         |   2 +-
 packages/agentic/src/index.ts                 |   3 +
 packages/agentic/tsdown.config.ts             |   5 +
 packages/devframe/package.json                |  14 +-
 packages/devframe/src/adapters/_shared.ts     |   2 +-
 packages/devframe/src/adapters/dev.ts         |   2 +-
 packages/devframe/src/adapters/initiate.ts    |   2 +-
 packages/devframe/src/client/connection.ts    |   2 +-
 packages/devframe/src/client/rpc-ws.ts        |   2 +-
 packages/devframe/src/client/rpc.ts           |   2 +-
 packages/devframe/src/node/instance-shell.ts  |   2 +-
 packages/devframe/src/utils/url.test.ts       |  63 ++++++++
 packages/devframe/src/utils/url.ts            |  69 +++++++++
 packages/devframe/tsdown.config.ts            |   7 +
 packages/hub/package.json                     |   9 +-
 packages/hub/src/constants.ts                 |   2 +-
 packages/hub/src/node/assemble.ts             |   2 +-
 packages/hub/src/node/build.ts                |   2 +-
 packages/hub/src/node/initiate.ts             |   2 +-
 packages/hub/src/node/install-devframe.ts     |   2 +-
 packages/hub/tsdown.config.ts                 |   4 +
 packages/json-render/package.json             |   2 +-
 packages/json-render/tsdown.config.ts         |   8 ++
 packages/next/src/index.ts                    |   3 +
 packages/nuxt/src/index.ts                    |   3 +
 packages/vite/package.json                    |   4 +-
 packages/vite/src/index.ts                    |   3 +
 packages/vite/tsdown.config.ts                |   3 +
 plugins/assets/package.json                   |  11 +-
 plugins/assets/src/node/scanner.ts            |   2 +-
 plugins/assets/tsdown.config.ts               |  14 ++
 plugins/git/package.json                      |   4 +-
 plugins/git/tsdown.config.ts                  |   5 +
 pnpm-lock.yaml                                | 134 ++++++++----------
 pnpm-workspace.yaml                           |   1 -
 services/open/package.json                    |   4 +-
 services/open/tsdown.config.ts                |   5 +
 .../@devframes/json-render/node.snapshot.d.ts |  26 ++++
 .../tsnapi/devframe/internal.snapshot.d.ts    |   4 +-
 .../tsnapi/devframe/utils/url.snapshot.d.ts   |  13 ++
 .../tsnapi/devframe/utils/url.snapshot.js     |  13 ++
 tsconfig.base.json                            |   3 +
 47 files changed, 364 insertions(+), 129 deletions(-)
 create mode 100644 packages/devframe/src/utils/url.test.ts
 create mode 100644 packages/devframe/src/utils/url.ts
 create mode 100644 tests/__snapshots__/tsnapi/devframe/utils/url.snapshot.d.ts
 create mode 100644 tests/__snapshots__/tsnapi/devframe/utils/url.snapshot.js

diff --git a/alias.ts b/alias.ts
index 90c945255..80067335b 100644
--- a/alias.ts
+++ b/alias.ts
@@ -41,6 +41,7 @@ export const alias = {
   'devframe/utils/shared-state': r('devframe/src/utils/shared-state.ts'),
   'devframe/utils/streaming-channel': r('devframe/src/utils/streaming-channel.ts'),
   'devframe/utils/structured-clone': r('devframe/src/utils/structured-clone.ts'),
+  'devframe/utils/url': r('devframe/src/utils/url.ts'),
   'devframe/utils/when': r('devframe/src/utils/when.ts'),
   'devframe/adapters/cac': r('devframe/src/adapters/cac.ts'),
   'devframe/adapters/dev': r('devframe/src/adapters/dev.ts'),
diff --git a/docs/app/pages/logos.vue b/docs/app/pages/logos.vue
index 45e237457..02b2c2482 100644
--- a/docs/app/pages/logos.vue
+++ b/docs/app/pages/logos.vue
@@ -1,6 +1,5 @@
 <script setup lang="ts">
 // Shadows the comark-docs layer's brand-assets page with devframe's assets.
-import { joinURL } from 'ufo'
 import logoSvg from '../../public/logo.svg?raw'
 
 definePageMeta({
@@ -11,7 +10,7 @@ const title = 'Brand assets'
 const description = 'Logos and assets for Devframe. Download SVG or PNG, or copy the raw SVG source directly.'
 
 const site = useSiteConfig()
-const canonicalUrl = computed(() => joinURL(site.url, '/logos'))
+const canonicalUrl = computed(() => new URL('/logos', site.url).href)
 
 useRobotsRule('index, follow')
 
diff --git a/docs/content/8.references/8.utilities.md b/docs/content/8.references/8.utilities.md
index 7f7a38c7a..6fee12d68 100644
--- a/docs/content/8.references/8.utilities.md
+++ b/docs/content/8.references/8.utilities.md
@@ -123,6 +123,20 @@ state.mutate((draft) => {
 state.value() // => count is 1
 ```
 
+### `devframe/utils/url`
+
+URL path-joining and slash-normalization helpers (browser-safe, zero-dep).
+
+```ts
+import { joinURL, withBase, withProtocol, withTrailingSlash } from 'devframe/utils/url'
+
+joinURL('/__devframe', '__renderers', 'vue.mjs') // '/__devframe/__renderers/vue.mjs'
+withBase('meta.json', '/__devframe/') // '/__devframe/meta.json'
+withProtocol('http://localhost:7777/ws', 'ws://') // 'ws://localhost:7777/ws'
+```
+
+Also exports `withLeadingSlash`, `withoutLeadingSlash`, `withoutTrailingSlash`, and `cleanDoubleSlashes`.
+
 ### `devframe/utils/streaming-channel`
 
 Sink/reader primitives for streamed RPC payloads, via `ctx.rpc.streaming`; see [Streaming](/guide/streaming).
diff --git a/docs/package.json b/docs/package.json
index d449f2c40..f86a96f51 100644
--- a/docs/package.json
+++ b/docs/package.json
@@ -20,8 +20,7 @@
     "comark-docs": "catalog:docs",
     "d3-shape": "catalog:frontend",
     "nuxt": "catalog:build",
-    "shiki": "catalog:deps",
-    "ufo": "catalog:deps"
+    "shiki": "catalog:deps"
   },
   "devDependencies": {
     "@types/d3-shape": "catalog:types"
diff --git a/packages/agentic/package.json b/packages/agentic/package.json
index b7334ec5e..fc930e709 100644
--- a/packages/agentic/package.json
+++ b/packages/agentic/package.json
@@ -41,14 +41,13 @@
   "dependencies": {
     "@modelcontextprotocol/client": "catalog:deps",
     "@modelcontextprotocol/server": "catalog:deps",
-    "@standard-schema/spec": "catalog:deps",
-    "h3": "catalog:deps",
-    "pathe": "catalog:deps",
-    "ufo": "catalog:deps"
+    "h3": "catalog:deps"
   },
   "devDependencies": {
+    "@standard-schema/spec": "catalog:deps",
     "@types/node": "catalog:types",
     "devframe": "workspace:*",
+    "pathe": "catalog:deps",
     "tsdown": "catalog:build",
     "valibot": "catalog:deps"
   }
diff --git a/packages/agentic/src/connect/index.ts b/packages/agentic/src/connect/index.ts
index c27bf0026..5ef81458c 100644
--- a/packages/agentic/src/connect/index.ts
+++ b/packages/agentic/src/connect/index.ts
@@ -6,7 +6,7 @@ import { StdioServerTransport } from '@modelcontextprotocol/server/stdio'
 import { diagnostics, listLiveDevframeInstances, probeDevframeOrigin } from 'devframe/internal'
 import { toAgentToolName } from 'devframe/utils/agent-tool-name'
 import { Diagnostic } from 'devframe/utils/nostics'
-import { joinURL } from 'ufo'
+import { joinURL } from 'devframe/utils/url'
 
 export interface ConnectServerOptions {
   /**
diff --git a/packages/agentic/src/index.ts b/packages/agentic/src/index.ts
index caa76c68e..0a46a913c 100644
--- a/packages/agentic/src/index.ts
+++ b/packages/agentic/src/index.ts
@@ -12,3 +12,6 @@ throw new Error(
   + '  • import from "devframe/adapters/mcp" to serve a devframe over MCP\n'
   + '  • run "devframe connect" for the stdio discovery gateway\n',
 )
+
+// An explicit empty module so dts emit has something to say about this entry.
+export {}
diff --git a/packages/agentic/tsdown.config.ts b/packages/agentic/tsdown.config.ts
index f1cdda1ad..50e975810 100644
--- a/packages/agentic/tsdown.config.ts
+++ b/packages/agentic/tsdown.config.ts
@@ -11,4 +11,9 @@ export default defineConfig({
   tsconfig: '../../tsconfig.base.json',
   dts: true,
   platform: 'node',
+  deps: {
+    onlyBundle: [
+      'pathe',
+    ],
+  },
 })
diff --git a/packages/devframe/package.json b/packages/devframe/package.json
index e505fc6ee..125c6da29 100644
--- a/packages/devframe/package.json
+++ b/packages/devframe/package.json
@@ -63,6 +63,7 @@
     "./utils/shared-state": "./dist/utils/shared-state.mjs",
     "./utils/streaming-channel": "./dist/utils/streaming-channel.mjs",
     "./utils/structured-clone": "./dist/utils/structured-clone.mjs",
+    "./utils/url": "./dist/utils/url.mjs",
     "./utils/when": "./dist/utils/when.mjs",
     "./package.json": "./package.json"
   },
@@ -94,25 +95,24 @@
     }
   },
   "dependencies": {
-    "@standard-schema/spec": "catalog:deps",
-    "birpc": "catalog:deps",
     "crossws": "catalog:deps",
-    "h3": "catalog:deps",
-    "mrmime": "catalog:deps",
-    "nostics": "catalog:deps",
-    "pathe": "catalog:deps",
-    "ufo": "catalog:deps"
+    "h3": "catalog:deps"
   },
   "devDependencies": {
     "@devframes/agentic": "workspace:*",
+    "@standard-schema/spec": "catalog:deps",
+    "birpc": "catalog:deps",
     "cac": "catalog:deps",
     "get-port-please": "catalog:deps",
     "immer": "catalog:deps",
     "launch-editor": "catalog:deps",
     "mlly": "catalog:build",
+    "mrmime": "catalog:deps",
+    "nostics": "catalog:deps",
     "obug": "catalog:deps",
     "ohash": "catalog:deps",
     "p-limit": "catalog:deps",
+    "pathe": "catalog:deps",
     "perfect-debounce": "catalog:deps",
     "structured-clone-es": "catalog:deps",
     "tinyglobby": "catalog:deps",
diff --git a/packages/devframe/src/adapters/_shared.ts b/packages/devframe/src/adapters/_shared.ts
index 7c22a84ff..dc9612616 100644
--- a/packages/devframe/src/adapters/_shared.ts
+++ b/packages/devframe/src/adapters/_shared.ts
@@ -2,8 +2,8 @@ import type { AgenticMcpModule } from '../node/agentic'
 import type { DevframeAgentHost } from '../types/agent'
 import type { ConnectionMeta } from '../types/context'
 import type { DevframeDefinition, DevframeDeploymentKind, McpAuthorization, McpSetting } from '../types/devframe'
+import { cleanDoubleSlashes, withLeadingSlash, withoutLeadingSlash, withTrailingSlash } from 'devframe/utils/url'
 import { getPort } from 'get-port-please'
-import { cleanDoubleSlashes, withLeadingSlash, withoutLeadingSlash, withTrailingSlash } from 'ufo'
 import { DEVFRAME_MCP_ROUTE } from '../constants'
 import { importAgenticMcp, isAgenticInstalled, warnAgenticMcpMissingOnce } from '../node/agentic'
 
diff --git a/packages/devframe/src/adapters/dev.ts b/packages/devframe/src/adapters/dev.ts
index 0e02914a2..b3658c002 100644
--- a/packages/devframe/src/adapters/dev.ts
+++ b/packages/devframe/src/adapters/dev.ts
@@ -6,8 +6,8 @@ import type { StaticAssetsSource } from '../types/remote-assets'
 import type { DevframeNodeRpcSession, DevframeNodeRpcSessionMeta } from '../types/rpc'
 import { createServer } from 'node:http'
 import { open } from 'devframe/utils/open'
+import { withBase } from 'devframe/utils/url'
 import { H3, toNodeHandler } from 'h3'
-import { withBase } from 'ufo'
 import { diagnostics } from '../node/diagnostics'
 import { normalizeHttpServerUrl } from '../node/utils'
 import { normalizeBasePath, resolveBasePath, resolveDevServerPort } from './_shared'
diff --git a/packages/devframe/src/adapters/initiate.ts b/packages/devframe/src/adapters/initiate.ts
index dd00e68be..f5ffc8e31 100644
--- a/packages/devframe/src/adapters/initiate.ts
+++ b/packages/devframe/src/adapters/initiate.ts
@@ -13,9 +13,9 @@ import type { ResolvedMcpConfig } from './_shared'
 import process from 'node:process'
 import { resolveStaticAssetsSource } from 'devframe/utils/remote-assets'
 import { mountStaticHandler } from 'devframe/utils/serve-static'
+import { joinURL, withoutLeadingSlash } from 'devframe/utils/url'
 import { H3 } from 'h3'
 import { resolve } from 'pathe'
-import { joinURL, withoutLeadingSlash } from 'ufo'
 import { resolveClientAssets } from '../client-assets'
 import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_MCP_ROUTE } from '../constants'
 import { importAgenticMcp } from '../node/agentic'
diff --git a/packages/devframe/src/client/connection.ts b/packages/devframe/src/client/connection.ts
index 19bca4e8b..3d7de3b50 100644
--- a/packages/devframe/src/client/connection.ts
+++ b/packages/devframe/src/client/connection.ts
@@ -4,7 +4,7 @@ import {
   DEVFRAME_VIEWER_ORIGIN_QUERY_PARAM,
   DEVFRAME_VIEWER_ORIGIN_TOKEN_QUERY_PARAM,
 } from 'devframe/constants'
-import { withBase } from 'ufo'
+import { withBase } from 'devframe/utils/url'
 import {
   readStoredAuthToken,
   readStoredConnection,
diff --git a/packages/devframe/src/client/rpc-ws.ts b/packages/devframe/src/client/rpc-ws.ts
index b0c289fe8..85c4b1869 100644
--- a/packages/devframe/src/client/rpc-ws.ts
+++ b/packages/devframe/src/client/rpc-ws.ts
@@ -1,7 +1,7 @@
 import type { ConnectionMeta, EventEmitter } from 'devframe/types'
 import type { DevframeClientRpcHost, DevframeRpcClientMode, DevframeRpcClientOptions, RpcClientEvents } from './rpc'
 import { createWsRpcChannel } from 'devframe/rpc/transports/ws-client'
-import { withProtocol } from 'ufo'
+import { withProtocol } from 'devframe/utils/url'
 import { createLiveRpcClientMode } from './rpc-live'
 
 export interface CreateWsRpcClientModeOptions {
diff --git a/packages/devframe/src/client/rpc.ts b/packages/devframe/src/client/rpc.ts
index ee41fd051..b7cc7ee9d 100644
--- a/packages/devframe/src/client/rpc.ts
+++ b/packages/devframe/src/client/rpc.ts
@@ -10,7 +10,7 @@ import type { DevframeScopedClientContext } from './scope'
 import { DEVFRAME_OTP_URL_PARAM } from 'devframe/constants'
 import { RpcCacheManager, RpcFunctionsCollectorBase } from 'devframe/rpc'
 import { createEventEmitter } from 'devframe/utils/events'
-import { withBase } from 'ufo'
+import { withBase } from 'devframe/utils/url'
 import { setupDevframeConnection } from './connection'
 import { storeAuthToken } from './connection-storage'
 import { authenticateWithUrlOtp } from './otp'
diff --git a/packages/devframe/src/node/instance-shell.ts b/packages/devframe/src/node/instance-shell.ts
index dfae17608..36bd396d7 100644
--- a/packages/devframe/src/node/instance-shell.ts
+++ b/packages/devframe/src/node/instance-shell.ts
@@ -15,8 +15,8 @@ import type { ContextRpcServer } from './rpc-core'
 import { createServer } from 'node:http'
 import process from 'node:process'
 import { validateOriginCandidate } from 'devframe/utils/origin'
+import { joinURL, withLeadingSlash, withoutLeadingSlash, withoutTrailingSlash } from 'devframe/utils/url'
 import { defineHandler, H3 as H3App, toNodeHandler } from 'h3'
-import { joinURL, withLeadingSlash, withoutLeadingSlash, withoutTrailingSlash } from 'ufo'
 import { DEVFRAME_SSE_ROUTE, DEVFRAME_WS_ROUTE } from '../constants'
 import { createInteractiveAuth } from '../recipes/interactive-auth'
 import { diagnostics } from './diagnostics'
diff --git a/packages/devframe/src/utils/url.test.ts b/packages/devframe/src/utils/url.test.ts
new file mode 100644
index 000000000..e1e69e5a7
--- /dev/null
+++ b/packages/devframe/src/utils/url.test.ts
@@ -0,0 +1,63 @@
+import { describe, expect, it } from 'vitest'
+import {
+  cleanDoubleSlashes,
+  joinURL,
+  withBase,
+  withLeadingSlash,
+  withoutLeadingSlash,
+  withoutTrailingSlash,
+  withProtocol,
+  withTrailingSlash,
+} from './url'
+
+describe('utils/url', () => {
+  it('adds and removes leading slashes', () => {
+    expect(withLeadingSlash('base')).toBe('/base')
+    expect(withLeadingSlash('/base')).toBe('/base')
+    expect(withLeadingSlash('')).toBe('/')
+    expect(withoutLeadingSlash('/base')).toBe('base')
+    expect(withoutLeadingSlash('base')).toBe('base')
+    expect(withoutLeadingSlash('/')).toBe('/')
+  })
+
+  it('adds and removes trailing slashes', () => {
+    expect(withTrailingSlash('base')).toBe('base/')
+    expect(withTrailingSlash('base/')).toBe('base/')
+    expect(withoutTrailingSlash('base/')).toBe('base')
+    expect(withoutTrailingSlash('base')).toBe('base')
+    expect(withoutTrailingSlash('/')).toBe('/')
+  })
+
+  it('cleans double slashes but keeps the protocol seam', () => {
+    expect(cleanDoubleSlashes('//base//sub//')).toBe('/base/sub/')
+    expect(cleanDoubleSlashes('http://example.com//base//')).toBe('http://example.com/base/')
+    expect(cleanDoubleSlashes('/base/')).toBe('/base/')
+  })
+
+  it('joins segments with single slashes', () => {
+    expect(joinURL('/', '__mcp')).toBe('/__mcp')
+    expect(joinURL('/base', 'route')).toBe('/base/route')
+    expect(joinURL('/base/', '/route')).toBe('/base/route')
+    expect(joinURL('/base', './route')).toBe('/base/route')
+    expect(joinURL('/base', '__renderers', 'vue.mjs')).toBe('/base/__renderers/vue.mjs')
+    expect(joinURL('', 'route')).toBe('route')
+    expect(joinURL('/base', '')).toBe('/base')
+    expect(joinURL('/base', '/')).toBe('/base')
+    expect(joinURL('http://localhost:3000', '/__devframe/')).toBe('http://localhost:3000/__devframe/')
+  })
+
+  it('prefixes with a base', () => {
+    expect(withBase('meta.json', '/__devframe/')).toBe('/__devframe/meta.json')
+    expect(withBase('/__devframe/meta.json', '/__devframe/')).toBe('/__devframe/meta.json')
+    expect(withBase('meta.json', '/')).toBe('meta.json')
+    expect(withBase('meta.json', '')).toBe('meta.json')
+    expect(withBase('http://example.com/x', '/base')).toBe('http://example.com/x')
+    expect(withBase('/__devframe/', 'http://localhost:5173')).toBe('http://localhost:5173/__devframe/')
+  })
+
+  it('swaps protocols', () => {
+    expect(withProtocol('http://localhost:3000/ws', 'ws://')).toBe('ws://localhost:3000/ws')
+    expect(withProtocol('https://example.com/ws', 'wss://')).toBe('wss://example.com/ws')
+    expect(withProtocol('localhost:3000/ws', 'ws://')).toBe('ws://localhost:3000/ws')
+  })
+})
diff --git a/packages/devframe/src/utils/url.ts b/packages/devframe/src/utils/url.ts
new file mode 100644
index 000000000..0b2ee640e
--- /dev/null
+++ b/packages/devframe/src/utils/url.ts
@@ -0,0 +1,69 @@
+/**
+ * URL path-joining and slash-normalization helpers shared by the adapters,
+ * the RPC clients, and the hub's mount-path plumbing. In-house replacements
+ * for the handful of `ufo` functions devframe used, kept dependency-free and
+ * browser-safe (pure string operations, no `node:` imports).
+ */
+
+/** Matches an explicit protocol prefix: `http://`, `wss://`, `file://`, … */
+const PROTOCOL_RE = /^[\w+.-]{2,}:\/\//
+
+/** `input` with a leading `/` added when missing. */
+export function withLeadingSlash(input: string): string {
+  return input.startsWith('/') ? input : `/${input}`
+}
+
+/** `input` with a leading `/` removed; a bare `/` stays `/`. */
+export function withoutLeadingSlash(input: string): string {
+  return (input.startsWith('/') ? input.slice(1) : input) || '/'
+}
+
+/** `input` with a trailing `/` added when missing. */
+export function withTrailingSlash(input: string): string {
+  return input.endsWith('/') ? input : `${input}/`
+}
+
+/** `input` with a trailing `/` removed; a bare `/` stays `/`. */
+export function withoutTrailingSlash(input: string): string {
+  return (input.endsWith('/') ? input.slice(0, -1) : input) || '/'
+}
+
+/** Collapses runs of `/` in every path portion, preserving `://`. */
+export function cleanDoubleSlashes(input: string): string {
+  return input
+    .split('://')
+    .map(part => part.replace(/\/{2,}/g, '/'))
+    .join('://')
+}
+
+/**
+ * Joins path segments onto `base` with exactly one `/` at each seam.
+ * A segment's leading `/` or `./` is dropped; empty and bare-`/` segments
+ * are skipped; the last segment's trailing slash is preserved.
+ */
+export function joinURL(base: string, ...segments: string[]): string {
+  let url = base
+  for (const segment of segments) {
+    if (!segment || segment === '/')
+      continue
+    url = url ? withTrailingSlash(url) + segment.replace(/^\.?\//, '') : segment
+  }
+  return url
+}
+
+/**
+ * Prefixes `input` with `base` unless it already carries the prefix or is an
+ * absolute URL with a protocol. An empty or `/` base is a no-op.
+ */
+export function withBase(input: string, base: string): string {
+  if (!base || base === '/' || PROTOCOL_RE.test(input))
+    return input
+  const prefix = withoutTrailingSlash(base)
+  return input.startsWith(prefix) ? input : joinURL(prefix, input)
+}
+
+/** Replaces (or adds) the protocol of `input`: `withProtocol(url, 'ws://')`. */
+export function withProtocol(input: string, protocol: string): string {
+  const match = input.match(PROTOCOL_RE)
+  return protocol + (match ? input.slice(match[0].length) : input)
+}
diff --git a/packages/devframe/tsdown.config.ts b/packages/devframe/tsdown.config.ts
index 4a87c2500..f7ff970e7 100644
--- a/packages/devframe/tsdown.config.ts
+++ b/packages/devframe/tsdown.config.ts
@@ -39,14 +39,19 @@ const deps = {
     neverBundle: ['whenexpr'],
   },
   onlyBundle: [
+    '@standard-schema/spec',
     'acorn',
+    'birpc',
     'get-port-please',
     'immer',
     'launch-editor',
     'mlly',
+    'mrmime',
+    'nostics',
     'obug',
     'ohash',
     'p-limit',
+    'pathe',
     'perfect-debounce',
     'picocolors',
     'shell-quote',
@@ -83,6 +88,7 @@ const clientEntries = {
   'utils/shared-state': 'src/utils/shared-state.ts',
   'utils/streaming-channel': 'src/utils/streaming-channel.ts',
   'utils/structured-clone': 'src/utils/structured-clone.ts',
+  'utils/url': 'src/utils/url.ts',
   'utils/when': 'src/utils/when.ts',
 }
 
@@ -169,6 +175,7 @@ export default defineConfig([
             resolve(distDir, 'utils/shared-state.mjs'),
             resolve(distDir, 'utils/streaming-channel.mjs'),
             resolve(distDir, 'utils/structured-clone.mjs'),
+            resolve(distDir, 'utils/url.mjs'),
             resolve(distDir, 'utils/when.mjs'),
           ],
           cwd: here,
diff --git a/packages/hub/package.json b/packages/hub/package.json
index d61c10b2d..3e6b79482 100644
--- a/packages/hub/package.json
+++ b/packages/hub/package.json
@@ -50,21 +50,20 @@
     }
   },
   "dependencies": {
-    "@standard-schema/spec": "catalog:deps",
     "destr": "catalog:deps",
     "h3": "catalog:deps",
-    "pathe": "catalog:deps",
-    "perfect-debounce": "catalog:deps",
-    "tinyexec": "catalog:deps",
-    "ufo": "catalog:deps",
     "zigpty": "catalog:deps"
   },
   "devDependencies": {
     "@devframes/agentic": "workspace:*",
+    "@standard-schema/spec": "catalog:deps",
     "@types/node": "catalog:types",
     "devframe": "workspace:*",
     "get-port-please": "catalog:deps",
     "mlly": "catalog:build",
+    "pathe": "catalog:deps",
+    "perfect-debounce": "catalog:deps",
+    "tinyexec": "catalog:deps",
     "tsdown": "catalog:build",
     "valibot": "catalog:deps"
   }
diff --git a/packages/hub/src/constants.ts b/packages/hub/src/constants.ts
index 4e3278b84..f67bad859 100644
--- a/packages/hub/src/constants.ts
+++ b/packages/hub/src/constants.ts
@@ -1,5 +1,5 @@
 import type { DevframeDocksUserSettings } from './types/settings'
-import { cleanDoubleSlashes, withLeadingSlash, withTrailingSlash } from 'ufo'
+import { cleanDoubleSlashes, withLeadingSlash, withTrailingSlash } from 'devframe/utils/url'
 import { HUB_EVENTS } from './events'
 
 export { HUB_EVENTS } from './events'
diff --git a/packages/hub/src/node/assemble.ts b/packages/hub/src/node/assemble.ts
index fea387077..d46081a2e 100644
--- a/packages/hub/src/node/assemble.ts
+++ b/packages/hub/src/node/assemble.ts
@@ -4,8 +4,8 @@ import type { DevframeHubContext } from './context'
 import type { DevframesInput, DockRendererRegistration, HubDevframeEntry } from './initiate'
 import { existsSync } from 'node:fs'
 import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVFRAME_MCP_ROUTE, DEVFRAME_WS_ROUTE } from 'devframe/constants'
+import { joinURL, withTrailingSlash } from 'devframe/utils/url'
 import { resolve } from 'pathe'
-import { joinURL, withTrailingSlash } from 'ufo'
 import { resolveClientModuleSpecifier } from '../client-modules'
 import { diagnostics } from './diagnostics'
 import { prepareDevframe } from './install-devframe'
diff --git a/packages/hub/src/node/build.ts b/packages/hub/src/node/build.ts
index d9f2cbabf..99fb766a1 100644
--- a/packages/hub/src/node/build.ts
+++ b/packages/hub/src/node/build.ts
@@ -11,8 +11,8 @@ import { createH3DevframeHost } from 'devframe/internal'
 import { collectStaticRpcDump, writeStaticRpcDump } from 'devframe/rpc/dump'
 import { colors as c } from 'devframe/utils/colors'
 import { resolveStaticAssetsSource } from 'devframe/utils/remote-assets'
+import { joinURL } from 'devframe/utils/url'
 import { dirname, resolve } from 'pathe'
-import { joinURL } from 'ufo'
 import { DEVFRAMES_HUB_BASE, DOCK_RENDERERS_STATE_KEY, normalizeHubBase } from '../constants'
 import { mountDevframes, renderClientImportsModule, resolveDevframesInput, resolveRendererRegistrations } from './assemble'
 import { createHubContext } from './context'
diff --git a/packages/hub/src/node/initiate.ts b/packages/hub/src/node/initiate.ts
index c43626958..74a4d864e 100644
--- a/packages/hub/src/node/initiate.ts
+++ b/packages/hub/src/node/initiate.ts
@@ -15,9 +15,9 @@ import { DEVFRAME_CONNECTION_META_FILENAME, DEVFRAME_DOCK_IMPORTS_FILENAME, DEVF
 import { createH3DevframeHost, createInstanceShell, importAgenticMcp, loadAutoMcpAdapter, resolveInstanceRegister, resolveMcpConfig } from 'devframe/internal'
 import { createInteractiveAuth } from 'devframe/recipes/interactive-auth'
 import { mountStaticHandler } from 'devframe/utils/serve-static'
+import { joinURL, withoutLeadingSlash } from 'devframe/utils/url'
 import { H3 } from 'h3'
 import { resolve } from 'pathe'
-import { joinURL, withoutLeadingSlash } from 'ufo'
 import { DEVFRAMES_HUB_BASE, DOCK_RENDERERS_STATE_KEY, normalizeHubBase } from '../constants'
 import { mountDevframes, renderClientImportsModule, resolveDevframesInput, resolveRendererRegistrations } from './assemble'
 import { createHubContext } from './context'
diff --git a/packages/hub/src/node/install-devframe.ts b/packages/hub/src/node/install-devframe.ts
index 874dd0d42..870a21c77 100644
--- a/packages/hub/src/node/install-devframe.ts
+++ b/packages/hub/src/node/install-devframe.ts
@@ -4,8 +4,8 @@ import type { DevframeHubContext, HubMountedFrame } from './context'
 import { existsSync } from 'node:fs'
 import { resolveClientAssets } from 'devframe/internal'
 import { resolveBasePath } from 'devframe/node/hub-internals'
+import { joinURL, withTrailingSlash } from 'devframe/utils/url'
 import { basename, dirname, isAbsolute, resolve } from 'pathe'
-import { joinURL, withTrailingSlash } from 'ufo'
 import { diagnostics } from './diagnostics'
 
 export interface InstallDevframeOptions {
diff --git a/packages/hub/tsdown.config.ts b/packages/hub/tsdown.config.ts
index d4eb8c0dd..f2e562747 100644
--- a/packages/hub/tsdown.config.ts
+++ b/packages/hub/tsdown.config.ts
@@ -23,9 +23,13 @@ export default defineConfig({
       'rolldown',
     ],
     onlyBundle: [
+      '@standard-schema/spec',
       'acorn',
       'get-port-please',
       'mlly',
+      'pathe',
+      'perfect-debounce',
+      'tinyexec',
     ],
   },
 })
diff --git a/packages/json-render/package.json b/packages/json-render/package.json
index 077f786d4..c8394fff5 100644
--- a/packages/json-render/package.json
+++ b/packages/json-render/package.json
@@ -46,11 +46,11 @@
   },
   "dependencies": {
     "@json-render/core": "catalog:deps",
-    "@standard-schema/spec": "catalog:deps",
     "zod": "catalog:deps"
   },
   "devDependencies": {
     "@devframes/hub": "workspace:*",
+    "@standard-schema/spec": "catalog:deps",
     "@types/node": "catalog:types",
     "devframe": "workspace:*",
     "tsdown": "catalog:build"
diff --git a/packages/json-render/tsdown.config.ts b/packages/json-render/tsdown.config.ts
index 235772d3e..65ce6c4b6 100644
--- a/packages/json-render/tsdown.config.ts
+++ b/packages/json-render/tsdown.config.ts
@@ -12,4 +12,12 @@ export default defineConfig({
   tsconfig: '../../tsconfig.base.json',
   dts: true,
   platform: 'neutral',
+  deps: {
+    onlyBundle: [
+      '@standard-schema/spec',
+      // types only, via `devframe/utils/nostics` (the runtime import stays
+      // external on the devframe peer)
+      'nostics',
+    ],
+  },
 })
diff --git a/packages/next/src/index.ts b/packages/next/src/index.ts
index 527bde3f0..e5a8c26cf 100644
--- a/packages/next/src/index.ts
+++ b/packages/next/src/index.ts
@@ -15,3 +15,6 @@ throw new Error(
   + '  • "@devframes/next/single" (+ "/single/client"): host one devframe\'s SPA\n'
   + '  • "@devframes/next/hub" (+ "/hub/client"): mount a devframes-hub\n',
 )
+
+// An explicit empty module so dts emit has something to say about this entry.
+export {}
diff --git a/packages/nuxt/src/index.ts b/packages/nuxt/src/index.ts
index 584a308f2..2d816bd2c 100644
--- a/packages/nuxt/src/index.ts
+++ b/packages/nuxt/src/index.ts
@@ -15,3 +15,6 @@ throw new Error(
   + '  • modules: ["@devframes/nuxt/single"]: Nuxt app as one devframe client\n'
   + '  • modules: ["@devframes/nuxt/hub"]: mount a devframes-hub with nuxt dev\n',
 )
+
+// An explicit empty module so dts emit has something to say about this entry.
+export {}
diff --git a/packages/vite/package.json b/packages/vite/package.json
index f6afa62c9..acdbdeb17 100644
--- a/packages/vite/package.json
+++ b/packages/vite/package.json
@@ -53,9 +53,6 @@
       "optional": true
     }
   },
-  "dependencies": {
-    "pathe": "catalog:deps"
-  },
   "devDependencies": {
     "@devframes/hub": "workspace:*",
     "@devframes/hub-ui": "workspace:*",
@@ -64,6 +61,7 @@
     "@types/ws": "catalog:types",
     "devframe": "workspace:*",
     "get-port-please": "catalog:deps",
+    "pathe": "catalog:deps",
     "tsdown": "catalog:build",
     "vite": "catalog:build",
     "vitest": "catalog:testing",
diff --git a/packages/vite/src/index.ts b/packages/vite/src/index.ts
index 32fc74ea5..60413c9a8 100644
--- a/packages/vite/src/index.ts
+++ b/packages/vite/src/index.ts
@@ -14,3 +14,6 @@ throw new Error(
   + '  • "@devframes/vite/single": dev-serve one devframe\'s SPA with Vite\n'
   + '  • "@devframes/vite/hub": mount a devframes-hub inside a Vite app\n',
 )
+
+// An explicit empty module so dts emit has something to say about this entry.
+export {}
diff --git a/packages/vite/tsdown.config.ts b/packages/vite/tsdown.config.ts
index 976a16069..8a751e704 100644
--- a/packages/vite/tsdown.config.ts
+++ b/packages/vite/tsdown.config.ts
@@ -17,6 +17,9 @@ const deps = {
     /^@oxc-project\//,
     /^@devframes\//,
   ],
+  onlyBundle: [
+    'pathe',
+  ],
 }
 
 export default defineConfig([
diff --git a/plugins/assets/package.json b/plugins/assets/package.json
index 3b3e45cfb..b9515040f 100644
--- a/plugins/assets/package.json
+++ b/plugins/assets/package.json
@@ -67,12 +67,7 @@
   "dependencies": {
     "@devframes/service-open": "workspace:*",
     "cac": "catalog:deps",
-    "chokidar": "catalog:deps",
-    "image-meta": "catalog:deps",
-    "pathe": "catalog:deps",
-    "perfect-debounce": "catalog:deps",
-    "tinyglobby": "catalog:deps",
-    "ufo": "catalog:deps"
+    "chokidar": "catalog:deps"
   },
   "devDependencies": {
     "@antfu/design": "catalog:frontend",
@@ -89,8 +84,12 @@
     "devframe": "workspace:*",
     "floating-vue": "catalog:frontend",
     "h3": "catalog:deps",
+    "image-meta": "catalog:deps",
+    "pathe": "catalog:deps",
+    "perfect-debounce": "catalog:deps",
     "reka-ui": "catalog:frontend",
     "storybook": "catalog:storybook",
+    "tinyglobby": "catalog:deps",
     "tsdown": "catalog:build",
     "unocss": "catalog:frontend",
     "vite": "catalog:build",
diff --git a/plugins/assets/src/node/scanner.ts b/plugins/assets/src/node/scanner.ts
index d670d4a11..aad6fa2c8 100644
--- a/plugins/assets/src/node/scanner.ts
+++ b/plugins/assets/src/node/scanner.ts
@@ -1,9 +1,9 @@
 import type { Stats } from 'node:fs'
 import type { AssetInfo, AssetType } from './types'
 import fsp from 'node:fs/promises'
+import { joinURL } from 'devframe/utils/url'
 import { join } from 'pathe'
 import { glob } from 'tinyglobby'
-import { joinURL } from 'ufo'
 
 const reImage = /\.(?:png|jpe?g|jxl|gif|svg|webp|avif|ico|bmp|tiff?)$/i
 const reVideo = /\.(?:mp4|webm|ogv|mov|avi|flv|wmv|mpg|mpeg|mkv|3gp|3g2|ts|mts|m2ts|vob|ogm|ogx|rm|rmvb|asf|amv|divx|m4v|svi|viv|f4v|f4p|f4a|f4b)$/i
diff --git a/plugins/assets/tsdown.config.ts b/plugins/assets/tsdown.config.ts
index b55de95ad..5051b2ea6 100644
--- a/plugins/assets/tsdown.config.ts
+++ b/plugins/assets/tsdown.config.ts
@@ -11,6 +11,18 @@ const nodeEntries = {
   'node/rpc/index': 'src/node/rpc/index.ts',
 }
 
+const deps = {
+  onlyBundle: [
+    'image-meta',
+    'pathe',
+    'perfect-debounce',
+    // tinyglobby and its two sub-dependencies
+    'fdir',
+    'picomatch',
+    'tinyglobby',
+  ],
+}
+
 /**
  * Two configs keep the graphs isolated:
  * 1. node runtime (`clean: true`): clears dist/;
@@ -25,6 +37,7 @@ export default defineConfig([
     clean: true,
     platform: 'node',
     tsconfig,
+    deps,
     dts: false,
     entry: nodeEntries,
   },
@@ -32,6 +45,7 @@ export default defineConfig([
     clean: false,
     platform: 'neutral',
     tsconfig,
+    deps,
     dts: { emitDtsOnly: true },
     outExtensions: () => ({ dts: '.d.mts' }),
     entry: nodeEntries,
diff --git a/plugins/git/package.json b/plugins/git/package.json
index 616aec699..a2aea83f4 100644
--- a/plugins/git/package.json
+++ b/plugins/git/package.json
@@ -59,8 +59,7 @@
     "@devframes/service-git": "workspace:*",
     "@devframes/service-shiki": "workspace:*",
     "cac": "catalog:deps",
-    "devframe": "workspace:*",
-    "pathe": "catalog:deps"
+    "devframe": "workspace:*"
   },
   "devDependencies": {
     "@antfu/design": "catalog:frontend",
@@ -81,6 +80,7 @@
     "diff": "catalog:frontend",
     "h3": "catalog:deps",
     "next": "catalog:frontend",
+    "pathe": "catalog:deps",
     "react": "catalog:frontend",
     "react-dom": "catalog:frontend",
     "storybook": "catalog:storybook",
diff --git a/plugins/git/tsdown.config.ts b/plugins/git/tsdown.config.ts
index c2fa24429..cf2a12ce5 100644
--- a/plugins/git/tsdown.config.ts
+++ b/plugins/git/tsdown.config.ts
@@ -10,6 +10,11 @@ export default defineConfig({
   tsconfig: '../../tsconfig.base.json',
   dts: true,
   platform: 'node',
+  deps: {
+    onlyBundle: [
+      'pathe',
+    ],
+  },
   // The Next.js SPA under app/ is built separately (`build:spa`);
   // tsdown only compiles the node-side entries above.
 })
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index de406d783..ec776a91b 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -297,9 +297,6 @@ catalogs:
     tinyglobby:
       specifier: ^0.2.17
       version: 0.2.17
-    ufo:
-      specifier: ^1.6.4
-      version: 1.6.4
     valibot:
       specifier: ^1.5.0
       version: 1.5.0
@@ -733,9 +730,6 @@ importers:
       shiki:
         specifier: catalog:deps
         version: 4.4.3
-      ufo:
-        specifier: catalog:deps
-        version: 1.6.4
     devDependencies:
       '@types/d3-shape':
         specifier: catalog:types
@@ -1575,25 +1569,22 @@ importers:
       '@modelcontextprotocol/server':
         specifier: catalog:deps
         version: 2.0.0
-      '@standard-schema/spec':
-        specifier: catalog:deps
-        version: 1.1.0
       h3:
         specifier: catalog:deps
         version: 2.0.1-rc.31(crossws@0.4.12(srvx@0.12.7))
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
-      ufo:
-        specifier: catalog:deps
-        version: 1.6.4
     devDependencies:
+      '@standard-schema/spec':
+        specifier: catalog:deps
+        version: 1.1.0
       '@types/node':
         specifier: catalog:types
         version: 26.5.1
       devframe:
         specifier: workspace:*
         version: link:../devframe
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
       tsdown:
         specifier: catalog:build
         version: 0.23.0(@volar/typescript@2.4.28(typescript@6.0.3))(oxc-resolver@11.24.2)(tsx@4.23.13)(typescript@6.0.3)
@@ -1603,34 +1594,22 @@ importers:
 
   packages/devframe:
     dependencies:
-      '@standard-schema/spec':
-        specifier: catalog:deps
-        version: 1.1.0
-      birpc:
-        specifier: catalog:deps
-        version: 4.2.0
       crossws:
         specifier: ^0.4.12
         version: 0.4.12(srvx@0.12.7)
       h3:
         specifier: catalog:deps
         version: 2.0.1-rc.31(crossws@0.4.12(srvx@0.12.7))
-      mrmime:
-        specifier: catalog:deps
-        version: 2.0.1
-      nostics:
-        specifier: catalog:deps
-        version: 1.2.0
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
-      ufo:
-        specifier: catalog:deps
-        version: 1.6.4
     devDependencies:
       '@devframes/agentic':
         specifier: workspace:*
         version: link:../agentic
+      '@standard-schema/spec':
+        specifier: catalog:deps
+        version: 1.1.0
+      birpc:
+        specifier: catalog:deps
+        version: 4.2.0
       cac:
         specifier: catalog:deps
         version: 7.0.0
@@ -1646,6 +1625,12 @@ importers:
       mlly:
         specifier: catalog:build
         version: 1.8.2
+      mrmime:
+        specifier: catalog:deps
+        version: 2.0.1
+      nostics:
+        specifier: catalog:deps
+        version: 1.2.0
       obug:
         specifier: catalog:deps
         version: 3.0.0
@@ -1655,6 +1640,9 @@ importers:
       p-limit:
         specifier: catalog:deps
         version: 7.3.2
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
       perfect-debounce:
         specifier: catalog:deps
         version: 2.1.0
@@ -1685,27 +1673,12 @@ importers:
 
   packages/hub:
     dependencies:
-      '@standard-schema/spec':
-        specifier: catalog:deps
-        version: 1.1.0
       destr:
         specifier: catalog:deps
         version: 2.0.5
       h3:
         specifier: catalog:deps
         version: 2.0.1-rc.31(crossws@0.4.12(srvx@0.12.7))
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
-      perfect-debounce:
-        specifier: catalog:deps
-        version: 2.1.0
-      tinyexec:
-        specifier: catalog:deps
-        version: 1.3.1
-      ufo:
-        specifier: catalog:deps
-        version: 1.6.4
       zigpty:
         specifier: catalog:deps
         version: 0.2.1
@@ -1713,6 +1686,9 @@ importers:
       '@devframes/agentic':
         specifier: workspace:*
         version: link:../agentic
+      '@standard-schema/spec':
+        specifier: catalog:deps
+        version: 1.1.0
       '@types/node':
         specifier: catalog:types
         version: 26.5.1
@@ -1725,6 +1701,15 @@ importers:
       mlly:
         specifier: catalog:build
         version: 1.8.2
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
+      perfect-debounce:
+        specifier: catalog:deps
+        version: 2.1.0
+      tinyexec:
+        specifier: catalog:deps
+        version: 1.3.1
       tsdown:
         specifier: catalog:build
         version: 0.23.0(@volar/typescript@2.4.28(typescript@6.0.3))(oxc-resolver@11.24.2)(tsx@4.23.13)(typescript@6.0.3)
@@ -1803,9 +1788,6 @@ importers:
       '@json-render/core':
         specifier: catalog:deps
         version: 0.20.0(zod@4.6.5)
-      '@standard-schema/spec':
-        specifier: catalog:deps
-        version: 1.1.0
       zod:
         specifier: catalog:deps
         version: 4.6.5
@@ -1813,6 +1795,9 @@ importers:
       '@devframes/hub':
         specifier: workspace:*
         version: link:../hub
+      '@standard-schema/spec':
+        specifier: catalog:deps
+        version: 1.1.0
       '@types/node':
         specifier: catalog:types
         version: 26.5.1
@@ -1940,10 +1925,6 @@ importers:
         version: 3.5.42(typescript@6.0.3)
 
   packages/vite:
-    dependencies:
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
     devDependencies:
       '@devframes/hub':
         specifier: workspace:*
@@ -1966,6 +1947,9 @@ importers:
       get-port-please:
         specifier: catalog:deps
         version: 3.2.0
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
       tsdown:
         specifier: catalog:build
         version: 0.23.0(@volar/typescript@2.4.28(typescript@6.0.3))(oxc-resolver@11.24.2)(tsx@4.23.13)(typescript@6.0.3)
@@ -2047,21 +2031,6 @@ importers:
       chokidar:
         specifier: ^5.0.0
         version: 5.0.0
-      image-meta:
-        specifier: catalog:deps
-        version: 0.2.2
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
-      perfect-debounce:
-        specifier: catalog:deps
-        version: 2.1.0
-      tinyglobby:
-        specifier: catalog:deps
-        version: 0.2.17
-      ufo:
-        specifier: catalog:deps
-        version: 1.6.4
     devDependencies:
       '@antfu/design':
         specifier: catalog:frontend
@@ -2105,12 +2074,24 @@ importers:
       h3:
         specifier: catalog:deps
         version: 2.0.1-rc.31(crossws@0.4.12(srvx@0.12.7))
+      image-meta:
+        specifier: catalog:deps
+        version: 0.2.2
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
+      perfect-debounce:
+        specifier: catalog:deps
+        version: 2.1.0
       reka-ui:
         specifier: catalog:frontend
         version: 2.10.4(vue@3.5.42(typescript@6.0.3))
       storybook:
         specifier: ^10.6.0
         version: 10.6.0(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+      tinyglobby:
+        specifier: catalog:deps
+        version: 0.2.17
       tsdown:
         specifier: catalog:build
         version: 0.23.0(@volar/typescript@2.4.28(typescript@6.0.3))(oxc-resolver@11.24.2)(tsx@4.23.13)(typescript@6.0.3)
@@ -2284,9 +2265,6 @@ importers:
       devframe:
         specifier: workspace:*
         version: link:../../packages/devframe
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
     devDependencies:
       '@antfu/design':
         specifier: catalog:frontend
@@ -2342,6 +2320,9 @@ importers:
       next:
         specifier: catalog:frontend
         version: 16.3.5(@babel/core@7.29.0(supports-color@10.2.2))(@opentelemetry/api@1.9.1)(@playwright/test@1.63.0)(@types/node@26.5.1)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
       react:
         specifier: catalog:frontend
         version: 19.3.0
@@ -2676,10 +2657,6 @@ importers:
         version: 5.0.0(@opentelemetry/api@1.9.1)(@types/node@26.5.1)(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.47.1)(tsx@4.23.13)(yaml@2.9.0))
 
   services/open:
-    dependencies:
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
     devDependencies:
       '@types/node':
         specifier: catalog:types
@@ -2687,6 +2664,9 @@ importers:
       devframe:
         specifier: workspace:*
         version: link:../../packages/devframe
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
       tsdown:
         specifier: catalog:build
         version: 0.23.0(@volar/typescript@2.4.28(typescript@6.0.3))(oxc-resolver@11.24.2)(tsx@4.23.13)(typescript@6.0.3)
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 11d061986..8126f1762 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -142,7 +142,6 @@ catalogs:
     structured-clone-es: ^2.0.1
     tinyexec: ^1.3.1
     tinyglobby: ^0.2.17
-    ufo: ^1.6.4
     valibot: ^1.5.0
     whenexpr: ^0.1.2
     ws: ^8.21.3
diff --git a/services/open/package.json b/services/open/package.json
index f71eff9ae..e4e1bfcc9 100644
--- a/services/open/package.json
+++ b/services/open/package.json
@@ -37,12 +37,10 @@
   "peerDependencies": {
     "devframe": "workspace:*"
   },
-  "dependencies": {
-    "pathe": "catalog:deps"
-  },
   "devDependencies": {
     "@types/node": "catalog:types",
     "devframe": "workspace:*",
+    "pathe": "catalog:deps",
     "tsdown": "catalog:build",
     "vitest": "catalog:testing"
   }
diff --git a/services/open/tsdown.config.ts b/services/open/tsdown.config.ts
index 03714bc19..abe49329d 100644
--- a/services/open/tsdown.config.ts
+++ b/services/open/tsdown.config.ts
@@ -5,4 +5,9 @@ export default defineConfig({
   tsconfig: '../../tsconfig.base.json',
   outExtensions: () => ({ js: '.mjs', dts: '.d.mts' }),
   entry: { index: 'src/index.ts' },
+  deps: {
+    onlyBundle: [
+      'pathe',
+    ],
+  },
 })
diff --git a/tests/__snapshots__/tsnapi/@devframes/json-render/node.snapshot.d.ts b/tests/__snapshots__/tsnapi/@devframes/json-render/node.snapshot.d.ts
index 1e963b9c2..e0415bdf8 100644
--- a/tests/__snapshots__/tsnapi/@devframes/json-render/node.snapshot.d.ts
+++ b/tests/__snapshots__/tsnapi/@devframes/json-render/node.snapshot.d.ts
@@ -76,4 +76,30 @@ declare class Diagnostic extends Error {
   toJSON(): object;
 }
 type Diagnostics<Codes extends Record<string, DiagnosticDefinition>, Reporters extends readonly AnyDiagnosticReporter[]> = { [Code in keyof Codes]: DiagnosticHandle<InferCodeParams<Codes[Code]>, Prettify<ExtractReportersOptions<Reporters>>>; };
+declare namespace StandardSchemaV1 {
+  interface Props<Input = unknown, Output = Input> extends StandardTypedV1.Props<Input, Output> {
+    readonly validate: (_: unknown, _?: StandardSchemaV1.Options | undefined) => Result<Output> | Promise<Result<Output>>;
+  }
+  type Result<Output> = SuccessResult<Output> | FailureResult;
+  interface SuccessResult<Output> {
+    readonly value: Output;
+    readonly issues?: undefined;
+  }
+  interface Options {
+    readonly libraryOptions?: Record<string, unknown> | undefined;
+  }
+  interface FailureResult {
+    readonly issues: ReadonlyArray<Issue>;
+  }
+  interface Issue {
+    readonly message: string;
+    readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
+  }
+  interface PathSegment {
+    readonly key: PropertyKey;
+  }
+  interface Types<Input = unknown, Output = Input> extends StandardTypedV1.Types<Input, Output> {}
+  type InferInput<Schema extends StandardTypedV1> = StandardTypedV1.InferInput<Schema>;
+  type InferOutput<Schema extends StandardTypedV1> = StandardTypedV1.InferOutput<Schema>;
+}
 // #endregion
\ No newline at end of file
diff --git a/tests/__snapshots__/tsnapi/devframe/internal.snapshot.d.ts b/tests/__snapshots__/tsnapi/devframe/internal.snapshot.d.ts
index 00cc7f772..a709408de 100644
--- a/tests/__snapshots__/tsnapi/devframe/internal.snapshot.d.ts
+++ b/tests/__snapshots__/tsnapi/devframe/internal.snapshot.d.ts
@@ -68,7 +68,7 @@ export declare function toolInputToCommandArgs(_: unknown, _?: number): unknown[
 // #endregion
 
 // #region Variables
-export declare const diagnostics: import("nostics").Diagnostics<{
+export declare const diagnostics: Diagnostics<{
   readonly DF0006: {
     readonly why: (p: {
       name: string;
@@ -379,7 +379,7 @@ export declare const diagnostics: import("nostics").Diagnostics<{
     }) => string;
     readonly fix: "Install `@devframes/agentic` next to devframe (the MCP adapter and the MCP SDK live there), or remove the explicit `mcp` setting.";
   };
-}, readonly [(d: import("nostics").Diagnostic, { method }?: {
+}, readonly [(d: Diagnostic, { method }?: {
   method?: "log" | "warn" | "error";
 }) => void]>;
 // #endregion
diff --git a/tests/__snapshots__/tsnapi/devframe/utils/url.snapshot.d.ts b/tests/__snapshots__/tsnapi/devframe/utils/url.snapshot.d.ts
new file mode 100644
index 000000000..a8262b3f0
--- /dev/null
+++ b/tests/__snapshots__/tsnapi/devframe/utils/url.snapshot.d.ts
@@ -0,0 +1,13 @@
+/**
+ * Generated by tsnapi — public API snapshot of `devframe/utils/url`
+ */
+// #region Functions
+export declare function cleanDoubleSlashes(_: string): string;
+export declare function joinURL(_: string, ..._: string[]): string;
+export declare function withBase(_: string, _: string): string;
+export declare function withLeadingSlash(_: string): string;
+export declare function withoutLeadingSlash(_: string): string;
+export declare function withoutTrailingSlash(_: string): string;
+export declare function withProtocol(_: string, _: string): string;
+export declare function withTrailingSlash(_: string): string;
+// #endregion
\ No newline at end of file
diff --git a/tests/__snapshots__/tsnapi/devframe/utils/url.snapshot.js b/tests/__snapshots__/tsnapi/devframe/utils/url.snapshot.js
new file mode 100644
index 000000000..72640478a
--- /dev/null
+++ b/tests/__snapshots__/tsnapi/devframe/utils/url.snapshot.js
@@ -0,0 +1,13 @@
+/**
+ * Generated by tsnapi — public API snapshot of `devframe/utils/url`
+ */
+// #region Functions
+export function cleanDoubleSlashes(_) {}
+export function joinURL(_, ..._) {}
+export function withBase(_, _) {}
+export function withLeadingSlash(_) {}
+export function withoutLeadingSlash(_) {}
+export function withoutTrailingSlash(_) {}
+export function withProtocol(_, _) {}
+export function withTrailingSlash(_) {}
+// #endregion
\ No newline at end of file
diff --git a/tsconfig.base.json b/tsconfig.base.json
index f273c2b41..37fa0b3e2 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -106,6 +106,9 @@
       "devframe/utils/structured-clone": [
         "./packages/devframe/src/utils/structured-clone.ts"
       ],
+      "devframe/utils/url": [
+        "./packages/devframe/src/utils/url.ts"
+      ],
       "devframe/utils/when": [
         "./packages/devframe/src/utils/when.ts"
       ],

From 0e17c892c3e3df1241678e350ec83d8331a977f7 Mon Sep 17 00:00:00 2001
From: "Anthony Fu (via agent)" <reg-github-bot@antfu.me>
Date: Tue, 15 Sep 2026 01:34:20 +0000
Subject: [PATCH 2/5] chore(deps): drop mlly from hub, unused after the 0.10
 API removal

---
 packages/hub/package.json     | 1 -
 packages/hub/tsdown.config.ts | 1 -
 pnpm-lock.yaml                | 3 ---
 3 files changed, 5 deletions(-)

diff --git a/packages/hub/package.json b/packages/hub/package.json
index 3e6b79482..9f7cc565a 100644
--- a/packages/hub/package.json
+++ b/packages/hub/package.json
@@ -60,7 +60,6 @@
     "@types/node": "catalog:types",
     "devframe": "workspace:*",
     "get-port-please": "catalog:deps",
-    "mlly": "catalog:build",
     "pathe": "catalog:deps",
     "perfect-debounce": "catalog:deps",
     "tinyexec": "catalog:deps",
diff --git a/packages/hub/tsdown.config.ts b/packages/hub/tsdown.config.ts
index f2e562747..cd5ecc3df 100644
--- a/packages/hub/tsdown.config.ts
+++ b/packages/hub/tsdown.config.ts
@@ -26,7 +26,6 @@ export default defineConfig({
       '@standard-schema/spec',
       'acorn',
       'get-port-please',
-      'mlly',
       'pathe',
       'perfect-debounce',
       'tinyexec',
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ec776a91b..5f0ac790b 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1698,9 +1698,6 @@ importers:
       get-port-please:
         specifier: catalog:deps
         version: 3.2.0
-      mlly:
-        specifier: catalog:build
-        version: 1.8.2
       pathe:
         specifier: catalog:deps
         version: 2.0.3

From 69b7613f14b66b7de7acd5a66ad0fe88be1c1634 Mon Sep 17 00:00:00 2001
From: "Anthony Fu (via agent)" <reg-github-bot@antfu.me>
Date: Tue, 15 Sep 2026 01:57:43 +0000
Subject: [PATCH 3/5] chore(deps): keep nostics, pathe, tinyexec, h3 external;
 un-inline plugin deps

Reverts the bundling of nostics + pathe (devframe), pathe + tinyexec
(hub), and pathe (agentic, vite kit, service-open) back to real
dependencies. Fully reverts the plugin deps inlining: @devframes/plugin-assets
(image-meta, pathe, perfect-debounce, tinyglobby) and @devframes/plugin-git
(pathe) return to dependencies with no tsdown deps whitelist.

Still bundled: birpc + mrmime (devframe), perfect-debounce (hub), and the
types-only @standard-schema/spec declarations. json-render keeps nostics as
a dts-only inlined type (matches main; no install-footprint impact).
---
 packages/agentic/package.json                 |  4 +-
 packages/agentic/tsdown.config.ts             |  5 --
 packages/devframe/package.json                |  6 +-
 packages/devframe/tsdown.config.ts            |  2 -
 packages/hub/package.json                     |  4 +-
 packages/hub/tsdown.config.ts                 |  2 -
 packages/json-render/tsdown.config.ts         |  7 +-
 packages/vite/package.json                    |  4 +-
 packages/vite/tsdown.config.ts                |  3 -
 plugins/assets/package.json                   | 10 +--
 plugins/assets/tsdown.config.ts               | 14 ----
 plugins/git/package.json                      |  4 +-
 plugins/git/tsdown.config.ts                  |  5 --
 pnpm-lock.yaml                                | 74 ++++++++++---------
 services/open/package.json                    |  4 +-
 services/open/tsdown.config.ts                |  5 --
 .../tsnapi/devframe/internal.snapshot.d.ts    |  4 +-
 17 files changed, 65 insertions(+), 92 deletions(-)

diff --git a/packages/agentic/package.json b/packages/agentic/package.json
index fc930e709..9d898aa6d 100644
--- a/packages/agentic/package.json
+++ b/packages/agentic/package.json
@@ -41,13 +41,13 @@
   "dependencies": {
     "@modelcontextprotocol/client": "catalog:deps",
     "@modelcontextprotocol/server": "catalog:deps",
-    "h3": "catalog:deps"
+    "h3": "catalog:deps",
+    "pathe": "catalog:deps"
   },
   "devDependencies": {
     "@standard-schema/spec": "catalog:deps",
     "@types/node": "catalog:types",
     "devframe": "workspace:*",
-    "pathe": "catalog:deps",
     "tsdown": "catalog:build",
     "valibot": "catalog:deps"
   }
diff --git a/packages/agentic/tsdown.config.ts b/packages/agentic/tsdown.config.ts
index 50e975810..f1cdda1ad 100644
--- a/packages/agentic/tsdown.config.ts
+++ b/packages/agentic/tsdown.config.ts
@@ -11,9 +11,4 @@ export default defineConfig({
   tsconfig: '../../tsconfig.base.json',
   dts: true,
   platform: 'node',
-  deps: {
-    onlyBundle: [
-      'pathe',
-    ],
-  },
 })
diff --git a/packages/devframe/package.json b/packages/devframe/package.json
index e62262d65..5f0dbfb58 100644
--- a/packages/devframe/package.json
+++ b/packages/devframe/package.json
@@ -95,7 +95,9 @@
   },
   "dependencies": {
     "crossws": "catalog:deps",
-    "h3": "catalog:deps"
+    "h3": "catalog:deps",
+    "nostics": "catalog:deps",
+    "pathe": "catalog:deps"
   },
   "devDependencies": {
     "@devframes/agentic": "workspace:*",
@@ -107,11 +109,9 @@
     "launch-editor": "catalog:deps",
     "mlly": "catalog:build",
     "mrmime": "catalog:deps",
-    "nostics": "catalog:deps",
     "obug": "catalog:deps",
     "ohash": "catalog:deps",
     "p-limit": "catalog:deps",
-    "pathe": "catalog:deps",
     "perfect-debounce": "catalog:deps",
     "structured-clone-es": "catalog:deps",
     "tinyglobby": "catalog:deps",
diff --git a/packages/devframe/tsdown.config.ts b/packages/devframe/tsdown.config.ts
index b5c379b0a..99f7044cf 100644
--- a/packages/devframe/tsdown.config.ts
+++ b/packages/devframe/tsdown.config.ts
@@ -47,11 +47,9 @@ const deps = {
     'launch-editor',
     'mlly',
     'mrmime',
-    'nostics',
     'obug',
     'ohash',
     'p-limit',
-    'pathe',
     'perfect-debounce',
     'picocolors',
     'shell-quote',
diff --git a/packages/hub/package.json b/packages/hub/package.json
index 9f7cc565a..2ac35c276 100644
--- a/packages/hub/package.json
+++ b/packages/hub/package.json
@@ -52,6 +52,8 @@
   "dependencies": {
     "destr": "catalog:deps",
     "h3": "catalog:deps",
+    "pathe": "catalog:deps",
+    "tinyexec": "catalog:deps",
     "zigpty": "catalog:deps"
   },
   "devDependencies": {
@@ -60,9 +62,7 @@
     "@types/node": "catalog:types",
     "devframe": "workspace:*",
     "get-port-please": "catalog:deps",
-    "pathe": "catalog:deps",
     "perfect-debounce": "catalog:deps",
-    "tinyexec": "catalog:deps",
     "tsdown": "catalog:build",
     "valibot": "catalog:deps"
   }
diff --git a/packages/hub/tsdown.config.ts b/packages/hub/tsdown.config.ts
index cd5ecc3df..2929af9c8 100644
--- a/packages/hub/tsdown.config.ts
+++ b/packages/hub/tsdown.config.ts
@@ -26,9 +26,7 @@ export default defineConfig({
       '@standard-schema/spec',
       'acorn',
       'get-port-please',
-      'pathe',
       'perfect-debounce',
-      'tinyexec',
     ],
   },
 })
diff --git a/packages/json-render/tsdown.config.ts b/packages/json-render/tsdown.config.ts
index 65ce6c4b6..3fc8e0f09 100644
--- a/packages/json-render/tsdown.config.ts
+++ b/packages/json-render/tsdown.config.ts
@@ -13,10 +13,13 @@ export default defineConfig({
   dts: true,
   platform: 'neutral',
   deps: {
+    // Both are types-only in this package's public dts: `@standard-schema/spec`
+    // (a devDependency) and `nostics` (reached via `devframe/utils/nostics`,
+    // runtime import stays external on the devframe peer). Whitelisting them
+    // lets the dts bundler inline the type declarations so consumers need
+    // neither package installed for `@devframes/json-render`'s types.
     onlyBundle: [
       '@standard-schema/spec',
-      // types only, via `devframe/utils/nostics` (the runtime import stays
-      // external on the devframe peer)
       'nostics',
     ],
   },
diff --git a/packages/vite/package.json b/packages/vite/package.json
index acdbdeb17..f6afa62c9 100644
--- a/packages/vite/package.json
+++ b/packages/vite/package.json
@@ -53,6 +53,9 @@
       "optional": true
     }
   },
+  "dependencies": {
+    "pathe": "catalog:deps"
+  },
   "devDependencies": {
     "@devframes/hub": "workspace:*",
     "@devframes/hub-ui": "workspace:*",
@@ -61,7 +64,6 @@
     "@types/ws": "catalog:types",
     "devframe": "workspace:*",
     "get-port-please": "catalog:deps",
-    "pathe": "catalog:deps",
     "tsdown": "catalog:build",
     "vite": "catalog:build",
     "vitest": "catalog:testing",
diff --git a/packages/vite/tsdown.config.ts b/packages/vite/tsdown.config.ts
index 8a751e704..976a16069 100644
--- a/packages/vite/tsdown.config.ts
+++ b/packages/vite/tsdown.config.ts
@@ -17,9 +17,6 @@ const deps = {
     /^@oxc-project\//,
     /^@devframes\//,
   ],
-  onlyBundle: [
-    'pathe',
-  ],
 }
 
 export default defineConfig([
diff --git a/plugins/assets/package.json b/plugins/assets/package.json
index b9515040f..0026b7b29 100644
--- a/plugins/assets/package.json
+++ b/plugins/assets/package.json
@@ -67,7 +67,11 @@
   "dependencies": {
     "@devframes/service-open": "workspace:*",
     "cac": "catalog:deps",
-    "chokidar": "catalog:deps"
+    "chokidar": "catalog:deps",
+    "image-meta": "catalog:deps",
+    "pathe": "catalog:deps",
+    "perfect-debounce": "catalog:deps",
+    "tinyglobby": "catalog:deps"
   },
   "devDependencies": {
     "@antfu/design": "catalog:frontend",
@@ -84,12 +88,8 @@
     "devframe": "workspace:*",
     "floating-vue": "catalog:frontend",
     "h3": "catalog:deps",
-    "image-meta": "catalog:deps",
-    "pathe": "catalog:deps",
-    "perfect-debounce": "catalog:deps",
     "reka-ui": "catalog:frontend",
     "storybook": "catalog:storybook",
-    "tinyglobby": "catalog:deps",
     "tsdown": "catalog:build",
     "unocss": "catalog:frontend",
     "vite": "catalog:build",
diff --git a/plugins/assets/tsdown.config.ts b/plugins/assets/tsdown.config.ts
index 5051b2ea6..b55de95ad 100644
--- a/plugins/assets/tsdown.config.ts
+++ b/plugins/assets/tsdown.config.ts
@@ -11,18 +11,6 @@ const nodeEntries = {
   'node/rpc/index': 'src/node/rpc/index.ts',
 }
 
-const deps = {
-  onlyBundle: [
-    'image-meta',
-    'pathe',
-    'perfect-debounce',
-    // tinyglobby and its two sub-dependencies
-    'fdir',
-    'picomatch',
-    'tinyglobby',
-  ],
-}
-
 /**
  * Two configs keep the graphs isolated:
  * 1. node runtime (`clean: true`): clears dist/;
@@ -37,7 +25,6 @@ export default defineConfig([
     clean: true,
     platform: 'node',
     tsconfig,
-    deps,
     dts: false,
     entry: nodeEntries,
   },
@@ -45,7 +32,6 @@ export default defineConfig([
     clean: false,
     platform: 'neutral',
     tsconfig,
-    deps,
     dts: { emitDtsOnly: true },
     outExtensions: () => ({ dts: '.d.mts' }),
     entry: nodeEntries,
diff --git a/plugins/git/package.json b/plugins/git/package.json
index a2aea83f4..616aec699 100644
--- a/plugins/git/package.json
+++ b/plugins/git/package.json
@@ -59,7 +59,8 @@
     "@devframes/service-git": "workspace:*",
     "@devframes/service-shiki": "workspace:*",
     "cac": "catalog:deps",
-    "devframe": "workspace:*"
+    "devframe": "workspace:*",
+    "pathe": "catalog:deps"
   },
   "devDependencies": {
     "@antfu/design": "catalog:frontend",
@@ -80,7 +81,6 @@
     "diff": "catalog:frontend",
     "h3": "catalog:deps",
     "next": "catalog:frontend",
-    "pathe": "catalog:deps",
     "react": "catalog:frontend",
     "react-dom": "catalog:frontend",
     "storybook": "catalog:storybook",
diff --git a/plugins/git/tsdown.config.ts b/plugins/git/tsdown.config.ts
index cf2a12ce5..c2fa24429 100644
--- a/plugins/git/tsdown.config.ts
+++ b/plugins/git/tsdown.config.ts
@@ -10,11 +10,6 @@ export default defineConfig({
   tsconfig: '../../tsconfig.base.json',
   dts: true,
   platform: 'node',
-  deps: {
-    onlyBundle: [
-      'pathe',
-    ],
-  },
   // The Next.js SPA under app/ is built separately (`build:spa`);
   // tsdown only compiles the node-side entries above.
 })
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5f0ac790b..a16417bb3 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1572,6 +1572,9 @@ importers:
       h3:
         specifier: catalog:deps
         version: 2.0.1-rc.31(crossws@0.4.12(srvx@0.12.7))
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
     devDependencies:
       '@standard-schema/spec':
         specifier: catalog:deps
@@ -1582,9 +1585,6 @@ importers:
       devframe:
         specifier: workspace:*
         version: link:../devframe
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
       tsdown:
         specifier: catalog:build
         version: 0.23.0(@volar/typescript@2.4.28(typescript@6.0.3))(oxc-resolver@11.24.2)(tsx@4.23.13)(typescript@6.0.3)
@@ -1600,6 +1600,12 @@ importers:
       h3:
         specifier: catalog:deps
         version: 2.0.1-rc.31(crossws@0.4.12(srvx@0.12.7))
+      nostics:
+        specifier: catalog:deps
+        version: 1.2.0
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
     devDependencies:
       '@devframes/agentic':
         specifier: workspace:*
@@ -1628,9 +1634,6 @@ importers:
       mrmime:
         specifier: catalog:deps
         version: 2.0.1
-      nostics:
-        specifier: catalog:deps
-        version: 1.2.0
       obug:
         specifier: catalog:deps
         version: 3.0.0
@@ -1640,9 +1643,6 @@ importers:
       p-limit:
         specifier: catalog:deps
         version: 7.3.2
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
       perfect-debounce:
         specifier: catalog:deps
         version: 2.1.0
@@ -1679,6 +1679,12 @@ importers:
       h3:
         specifier: catalog:deps
         version: 2.0.1-rc.31(crossws@0.4.12(srvx@0.12.7))
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
+      tinyexec:
+        specifier: catalog:deps
+        version: 1.3.1
       zigpty:
         specifier: catalog:deps
         version: 0.2.1
@@ -1698,15 +1704,9 @@ importers:
       get-port-please:
         specifier: catalog:deps
         version: 3.2.0
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
       perfect-debounce:
         specifier: catalog:deps
         version: 2.1.0
-      tinyexec:
-        specifier: catalog:deps
-        version: 1.3.1
       tsdown:
         specifier: catalog:build
         version: 0.23.0(@volar/typescript@2.4.28(typescript@6.0.3))(oxc-resolver@11.24.2)(tsx@4.23.13)(typescript@6.0.3)
@@ -1922,6 +1922,10 @@ importers:
         version: 3.5.42(typescript@6.0.3)
 
   packages/vite:
+    dependencies:
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
     devDependencies:
       '@devframes/hub':
         specifier: workspace:*
@@ -1944,9 +1948,6 @@ importers:
       get-port-please:
         specifier: catalog:deps
         version: 3.2.0
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
       tsdown:
         specifier: catalog:build
         version: 0.23.0(@volar/typescript@2.4.28(typescript@6.0.3))(oxc-resolver@11.24.2)(tsx@4.23.13)(typescript@6.0.3)
@@ -2028,6 +2029,18 @@ importers:
       chokidar:
         specifier: ^5.0.0
         version: 5.0.0
+      image-meta:
+        specifier: catalog:deps
+        version: 0.2.2
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
+      perfect-debounce:
+        specifier: catalog:deps
+        version: 2.1.0
+      tinyglobby:
+        specifier: catalog:deps
+        version: 0.2.17
     devDependencies:
       '@antfu/design':
         specifier: catalog:frontend
@@ -2071,24 +2084,12 @@ importers:
       h3:
         specifier: catalog:deps
         version: 2.0.1-rc.31(crossws@0.4.12(srvx@0.12.7))
-      image-meta:
-        specifier: catalog:deps
-        version: 0.2.2
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
-      perfect-debounce:
-        specifier: catalog:deps
-        version: 2.1.0
       reka-ui:
         specifier: catalog:frontend
         version: 2.10.4(vue@3.5.42(typescript@6.0.3))
       storybook:
         specifier: ^10.6.0
         version: 10.6.0(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      tinyglobby:
-        specifier: catalog:deps
-        version: 0.2.17
       tsdown:
         specifier: catalog:build
         version: 0.23.0(@volar/typescript@2.4.28(typescript@6.0.3))(oxc-resolver@11.24.2)(tsx@4.23.13)(typescript@6.0.3)
@@ -2262,6 +2263,9 @@ importers:
       devframe:
         specifier: workspace:*
         version: link:../../packages/devframe
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
     devDependencies:
       '@antfu/design':
         specifier: catalog:frontend
@@ -2317,9 +2321,6 @@ importers:
       next:
         specifier: catalog:frontend
         version: 16.3.5(@babel/core@7.29.0(supports-color@10.2.2))(@opentelemetry/api@1.9.1)(@playwright/test@1.63.0)(@types/node@26.5.1)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
       react:
         specifier: catalog:frontend
         version: 19.3.0
@@ -2654,6 +2655,10 @@ importers:
         version: 5.0.0(@opentelemetry/api@1.9.1)(@types/node@26.5.1)(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.47.1)(tsx@4.23.13)(yaml@2.9.0))
 
   services/open:
+    dependencies:
+      pathe:
+        specifier: catalog:deps
+        version: 2.0.3
     devDependencies:
       '@types/node':
         specifier: catalog:types
@@ -2661,9 +2666,6 @@ importers:
       devframe:
         specifier: workspace:*
         version: link:../../packages/devframe
-      pathe:
-        specifier: catalog:deps
-        version: 2.0.3
       tsdown:
         specifier: catalog:build
         version: 0.23.0(@volar/typescript@2.4.28(typescript@6.0.3))(oxc-resolver@11.24.2)(tsx@4.23.13)(typescript@6.0.3)
diff --git a/services/open/package.json b/services/open/package.json
index e4e1bfcc9..f71eff9ae 100644
--- a/services/open/package.json
+++ b/services/open/package.json
@@ -37,10 +37,12 @@
   "peerDependencies": {
     "devframe": "workspace:*"
   },
+  "dependencies": {
+    "pathe": "catalog:deps"
+  },
   "devDependencies": {
     "@types/node": "catalog:types",
     "devframe": "workspace:*",
-    "pathe": "catalog:deps",
     "tsdown": "catalog:build",
     "vitest": "catalog:testing"
   }
diff --git a/services/open/tsdown.config.ts b/services/open/tsdown.config.ts
index abe49329d..03714bc19 100644
--- a/services/open/tsdown.config.ts
+++ b/services/open/tsdown.config.ts
@@ -5,9 +5,4 @@ export default defineConfig({
   tsconfig: '../../tsconfig.base.json',
   outExtensions: () => ({ js: '.mjs', dts: '.d.mts' }),
   entry: { index: 'src/index.ts' },
-  deps: {
-    onlyBundle: [
-      'pathe',
-    ],
-  },
 })
diff --git a/tests/__snapshots__/tsnapi/devframe/internal.snapshot.d.ts b/tests/__snapshots__/tsnapi/devframe/internal.snapshot.d.ts
index cc8cc5a49..34d143ddc 100644
--- a/tests/__snapshots__/tsnapi/devframe/internal.snapshot.d.ts
+++ b/tests/__snapshots__/tsnapi/devframe/internal.snapshot.d.ts
@@ -60,7 +60,7 @@ export declare function toolInputToCommandArgs(_: unknown, _?: number): unknown[
 // #endregion
 
 // #region Variables
-export declare const diagnostics: Diagnostics<{
+export declare const diagnostics: import("nostics").Diagnostics<{
   readonly DF0006: {
     readonly why: (p: {
       name: string;
@@ -371,7 +371,7 @@ export declare const diagnostics: Diagnostics<{
     }) => string;
     readonly fix: "Install `@devframes/agentic` next to devframe (the MCP adapter and the MCP SDK live there), or remove the explicit `mcp` setting.";
   };
-}, readonly [(d: Diagnostic, { method }?: {
+}, readonly [(d: import("nostics").Diagnostic, { method }?: {
   method?: "log" | "warn" | "error";
 }) => void]>;
 // #endregion

From b37efa4ba30a96e2107ff917b939515bef89212c Mon Sep 17 00:00:00 2001
From: "Anthony Fu (via agent)" <reg-github-bot@antfu.me>
Date: Tue, 15 Sep 2026 02:09:32 +0000
Subject: [PATCH 4/5] feat(devframe): expose bundled perfect-debounce as
 devframe/utils/debounce

New browser-safe util re-exports perfect-debounce's debounce (bundled into
devframe's dist). @devframes/hub and @devframes/plugin-assets now import it
through the devframe peer instead of declaring their own perfect-debounce
dependency, so the bytes live once and integrations reuse it with no new
install. perfect-debounce is now declared only by devframe.
---
 alias.ts                                      |  1 +
 docs/content/8.references/8.utilities.md      | 11 ++++++++++
 packages/devframe/package.json                |  1 +
 packages/devframe/src/node/storage.ts         |  2 +-
 packages/devframe/src/utils/debounce.ts       |  8 +++++++
 packages/devframe/tsdown.config.ts            |  2 ++
 packages/hub/package.json                     |  1 -
 packages/hub/src/node/context.ts              |  2 +-
 packages/hub/tsdown.config.ts                 |  1 -
 plugins/assets/package.json                   |  1 -
 plugins/assets/src/node/watcher.ts            |  2 +-
 pnpm-lock.yaml                                |  6 ------
 .../devframe/utils/debounce.snapshot.d.ts     | 21 +++++++++++++++++++
 .../devframe/utils/debounce.snapshot.js       |  6 ++++++
 tsconfig.base.json                            |  3 +++
 15 files changed, 56 insertions(+), 12 deletions(-)
 create mode 100644 packages/devframe/src/utils/debounce.ts
 create mode 100644 tests/__snapshots__/tsnapi/devframe/utils/debounce.snapshot.d.ts
 create mode 100644 tests/__snapshots__/tsnapi/devframe/utils/debounce.snapshot.js

diff --git a/alias.ts b/alias.ts
index 226bf74b7..6940f8e2f 100644
--- a/alias.ts
+++ b/alias.ts
@@ -28,6 +28,7 @@ export const alias = {
   'devframe/utils/agent-tool-name': r('devframe/src/utils/agent-tool-name.ts'),
   'devframe/utils/colors': r('devframe/src/utils/colors.ts'),
   'devframe/utils/crypto-token': r('devframe/src/utils/crypto-token.ts'),
+  'devframe/utils/debounce': r('devframe/src/utils/debounce.ts'),
   'devframe/utils/events': r('devframe/src/utils/events.ts'),
   'devframe/utils/hash': r('devframe/src/utils/hash.ts'),
   'devframe/utils/launch-editor': r('devframe/src/utils/launch-editor.ts'),
diff --git a/docs/content/8.references/8.utilities.md b/docs/content/8.references/8.utilities.md
index 6fee12d68..4fa18e6a2 100644
--- a/docs/content/8.references/8.utilities.md
+++ b/docs/content/8.references/8.utilities.md
@@ -96,6 +96,17 @@ randomDigits(6) // '047204', uniform, leading zeros preserved
 timingSafeEqual(input, secret) // constant-time string comparison
 ```
 
+### `devframe/utils/debounce`
+
+Promise-aware debounce, bundled in so integrations reuse it without adding a `perfect-debounce` dependency.
+
+```ts
+import { debounce } from 'devframe/utils/debounce'
+
+const save = debounce((state: State) => write(state), 100)
+save(next) // coalesces bursts; returns a promise, plus `.cancel()` / `.flush()` / `.isPending()`
+```
+
 ### `devframe/utils/events`
 
 Typed event emitter.
diff --git a/packages/devframe/package.json b/packages/devframe/package.json
index 5f0dbfb58..596721770 100644
--- a/packages/devframe/package.json
+++ b/packages/devframe/package.json
@@ -48,6 +48,7 @@
     "./utils/agent-tool-name": "./dist/utils/agent-tool-name.mjs",
     "./utils/colors": "./dist/utils/colors.mjs",
     "./utils/crypto-token": "./dist/utils/crypto-token.mjs",
+    "./utils/debounce": "./dist/utils/debounce.mjs",
     "./utils/events": "./dist/utils/events.mjs",
     "./utils/get-port": "./dist/utils/get-port.mjs",
     "./utils/hash": "./dist/utils/hash.mjs",
diff --git a/packages/devframe/src/node/storage.ts b/packages/devframe/src/node/storage.ts
index 7e1f5c4f2..b1c741ae1 100644
--- a/packages/devframe/src/node/storage.ts
+++ b/packages/devframe/src/node/storage.ts
@@ -1,8 +1,8 @@
 import fs from 'node:fs'
 import process from 'node:process'
+import { debounce } from 'devframe/utils/debounce'
 import { createSharedState } from 'devframe/utils/shared-state'
 import { dirname } from 'pathe'
-import { debounce } from 'perfect-debounce'
 import { diagnostics } from './diagnostics'
 
 export interface CreateStorageOptions<T extends object> {
diff --git a/packages/devframe/src/utils/debounce.ts b/packages/devframe/src/utils/debounce.ts
new file mode 100644
index 000000000..1372cb1ed
--- /dev/null
+++ b/packages/devframe/src/utils/debounce.ts
@@ -0,0 +1,8 @@
+/**
+ * Promise-aware debounce, bundled in so any integration can reuse it through
+ * `devframe/utils/debounce` without adding its own `perfect-debounce`
+ * dependency. Thin re-export of `perfect-debounce`'s `debounce`; the bytes
+ * live once in devframe's dist.
+ */
+export type { DebouncedReturn, DebounceOptions } from 'perfect-debounce'
+export { debounce } from 'perfect-debounce'
diff --git a/packages/devframe/tsdown.config.ts b/packages/devframe/tsdown.config.ts
index 99f7044cf..92c8ee1d4 100644
--- a/packages/devframe/tsdown.config.ts
+++ b/packages/devframe/tsdown.config.ts
@@ -78,6 +78,7 @@ const clientEntries = {
   'utils/agent-tool-name': 'src/utils/agent-tool-name.ts',
   'utils/colors': 'src/utils/colors.ts',
   'utils/crypto-token': 'src/utils/crypto-token.ts',
+  'utils/debounce': 'src/utils/debounce.ts',
   'utils/events': 'src/utils/events.ts',
   'utils/hash': 'src/utils/hash.ts',
   'utils/nanoid': 'src/utils/nanoid.ts',
@@ -164,6 +165,7 @@ export default defineConfig([
             resolve(distDir, 'utils/agent-tool-name.mjs'),
             resolve(distDir, 'utils/colors.mjs'),
             resolve(distDir, 'utils/crypto-token.mjs'),
+            resolve(distDir, 'utils/debounce.mjs'),
             resolve(distDir, 'utils/events.mjs'),
             resolve(distDir, 'utils/hash.mjs'),
             resolve(distDir, 'utils/nanoid.mjs'),
diff --git a/packages/hub/package.json b/packages/hub/package.json
index 2ac35c276..c548a2739 100644
--- a/packages/hub/package.json
+++ b/packages/hub/package.json
@@ -62,7 +62,6 @@
     "@types/node": "catalog:types",
     "devframe": "workspace:*",
     "get-port-please": "catalog:deps",
-    "perfect-debounce": "catalog:deps",
     "tsdown": "catalog:build",
     "valibot": "catalog:deps"
   }
diff --git a/packages/hub/src/node/context.ts b/packages/hub/src/node/context.ts
index 2c9c84b03..67f0b8d82 100644
--- a/packages/hub/src/node/context.ts
+++ b/packages/hub/src/node/context.ts
@@ -7,7 +7,7 @@ import type { DevframeTerminalsHost } from '../types/terminals'
 import type { InstallDevframeOptions } from './install-devframe'
 import { createHostContext } from 'devframe/node'
 import { getInternalContext } from 'devframe/node/hub-internals'
-import { debounce } from 'perfect-debounce'
+import { debounce } from 'devframe/utils/debounce'
 import { HUB_EVENTS } from '../events'
 import { DevframeCommandsHost as CommandsHostImpl } from './host-commands'
 import { DevframeDocksHost as DocksHostImpl } from './host-docks'
diff --git a/packages/hub/tsdown.config.ts b/packages/hub/tsdown.config.ts
index 2929af9c8..ae344f8e6 100644
--- a/packages/hub/tsdown.config.ts
+++ b/packages/hub/tsdown.config.ts
@@ -26,7 +26,6 @@ export default defineConfig({
       '@standard-schema/spec',
       'acorn',
       'get-port-please',
-      'perfect-debounce',
     ],
   },
 })
diff --git a/plugins/assets/package.json b/plugins/assets/package.json
index 0026b7b29..663e03fdd 100644
--- a/plugins/assets/package.json
+++ b/plugins/assets/package.json
@@ -70,7 +70,6 @@
     "chokidar": "catalog:deps",
     "image-meta": "catalog:deps",
     "pathe": "catalog:deps",
-    "perfect-debounce": "catalog:deps",
     "tinyglobby": "catalog:deps"
   },
   "devDependencies": {
diff --git a/plugins/assets/src/node/watcher.ts b/plugins/assets/src/node/watcher.ts
index 58b6aebca..f7f866db7 100644
--- a/plugins/assets/src/node/watcher.ts
+++ b/plugins/assets/src/node/watcher.ts
@@ -1,7 +1,7 @@
 import type { DevframeNodeContext } from 'devframe'
 import process from 'node:process'
 import { watch } from 'chokidar'
-import { debounce } from 'perfect-debounce'
+import { debounce } from 'devframe/utils/debounce'
 import { CHANGED_EVENT } from './constants'
 
 /**
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a16417bb3..15ac4804d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1704,9 +1704,6 @@ importers:
       get-port-please:
         specifier: catalog:deps
         version: 3.2.0
-      perfect-debounce:
-        specifier: catalog:deps
-        version: 2.1.0
       tsdown:
         specifier: catalog:build
         version: 0.23.0(@volar/typescript@2.4.28(typescript@6.0.3))(oxc-resolver@11.24.2)(tsx@4.23.13)(typescript@6.0.3)
@@ -2035,9 +2032,6 @@ importers:
       pathe:
         specifier: catalog:deps
         version: 2.0.3
-      perfect-debounce:
-        specifier: catalog:deps
-        version: 2.1.0
       tinyglobby:
         specifier: catalog:deps
         version: 0.2.17
diff --git a/tests/__snapshots__/tsnapi/devframe/utils/debounce.snapshot.d.ts b/tests/__snapshots__/tsnapi/devframe/utils/debounce.snapshot.d.ts
new file mode 100644
index 000000000..c7ff2c81c
--- /dev/null
+++ b/tests/__snapshots__/tsnapi/devframe/utils/debounce.snapshot.d.ts
@@ -0,0 +1,21 @@
+/**
+ * Generated by tsnapi — public API snapshot of `devframe/utils/debounce`
+ */
+// #region Interfaces
+export interface DebounceOptions {
+  readonly leading?: boolean;
+  readonly trailing?: boolean;
+}
+// #endregion
+
+// #region Types
+export type DebouncedReturn<ArgumentsT extends unknown[], ReturnT> = ((..._: ArgumentsT) => Promise<ReturnT>) & {
+  cancel: () => void;
+  flush: () => Promise<ReturnT> | undefined;
+  isPending: () => boolean;
+};
+// #endregion
+
+// #region Functions
+export declare function debounce<ArgumentsT extends unknown[], ReturnT>(_: (..._: ArgumentsT) => PromiseLike<ReturnT> | ReturnT, _?: number, _?: DebounceOptions): DebouncedReturn<ArgumentsT, ReturnT>;
+// #endregion
\ No newline at end of file
diff --git a/tests/__snapshots__/tsnapi/devframe/utils/debounce.snapshot.js b/tests/__snapshots__/tsnapi/devframe/utils/debounce.snapshot.js
new file mode 100644
index 000000000..88f819660
--- /dev/null
+++ b/tests/__snapshots__/tsnapi/devframe/utils/debounce.snapshot.js
@@ -0,0 +1,6 @@
+/**
+ * Generated by tsnapi — public API snapshot of `devframe/utils/debounce`
+ */
+// #region Functions
+export function debounce(_, _, _) {}
+// #endregion
\ No newline at end of file
diff --git a/tsconfig.base.json b/tsconfig.base.json
index 70bfc551b..4839e92af 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -67,6 +67,9 @@
       "devframe/utils/crypto-token": [
         "./packages/devframe/src/utils/crypto-token.ts"
       ],
+      "devframe/utils/debounce": [
+        "./packages/devframe/src/utils/debounce.ts"
+      ],
       "devframe/utils/events": [
         "./packages/devframe/src/utils/events.ts"
       ],

From be4fe8db22632826b67e38b6ede9cc2a873f1514 Mon Sep 17 00:00:00 2001
From: "Anthony Fu (via agent)" <reg-github-bot@antfu.me>
Date: Tue, 15 Sep 2026 02:31:17 +0000
Subject: [PATCH 5/5] refactor(deps): drop onlyBundle; resolve
 schema/diagnostics types via devframe peer

tsdown's default deps/devDeps split already expresses bundle intent
(dependencies external, devDependencies bundled), so the onlyBundle
whitelists in devframe/hub/json-render are removed.

devframe re-exports the Standard Schema contract type from
devframe/utils/simple-schema and adds a DevframeDiagnostics helper type to
devframe/utils/nostics. @devframes/json-render now names both through the
devframe peer instead of inlining nostics or depending on
@standard-schema/spec: its public dts references devframe/utils/simple-schema
and devframe/utils/nostics, and @standard-schema/spec is dropped from its
package.json. Any integration can reuse both the same way.
---
 packages/devframe/src/utils/nostics.ts        | 17 +++-
 packages/devframe/src/utils/simple-schema.ts  |  8 ++
 packages/devframe/tsdown.config.ts            | 23 +----
 packages/hub/tsdown.config.ts                 |  5 --
 packages/json-render/package.json             |  1 -
 packages/json-render/src/node/create-view.ts  |  2 +-
 packages/json-render/src/node/diagnostics.ts  | 72 ++++++++--------
 packages/json-render/test/create-view.test.ts |  2 +-
 packages/json-render/tsdown.config.ts         | 11 ---
 pnpm-lock.yaml                                |  3 -
 .../@devframes/json-render/node.snapshot.d.ts | 83 +------------------
 .../devframe/utils/nostics.snapshot.d.ts      |  1 +
 .../utils/simple-schema.snapshot.d.ts         |  4 +
 13 files changed, 71 insertions(+), 161 deletions(-)

diff --git a/packages/devframe/src/utils/nostics.ts b/packages/devframe/src/utils/nostics.ts
index 2c51736ab..be6c301d0 100644
--- a/packages/devframe/src/utils/nostics.ts
+++ b/packages/devframe/src/utils/nostics.ts
@@ -41,13 +41,26 @@ export function defineDiagnostics<
   docsBase?: string | ((code: keyof Codes) => string | undefined)
   codes: Codes
   reporters?: Reporters
-}): Diagnostics<Codes, readonly [typeof devframeReporter, ...Reporters]> {
+}): DevframeDiagnostics<Codes, Reporters> {
   return defineNosticsDiagnostics({
     ...options,
     reporters: [devframeReporter, ...(options.reporters ?? [])],
-  }) as Diagnostics<Codes, readonly [typeof devframeReporter, ...Reporters]>
+  }) as DevframeDiagnostics<Codes, Reporters>
 }
 
+/**
+ * The `Diagnostics` object returned by devframe's {@link defineDiagnostics}
+ * (devframe's ANSI console reporter is always prepended). Integrations that
+ * export their own `defineDiagnostics(...)` result as public API annotate it
+ * with this type, so the reference resolves through `devframe/utils/nostics`
+ * rather than inlining `nostics`'s types or taking a direct `nostics`
+ * dependency.
+ */
+export type DevframeDiagnostics<
+  Codes extends Record<string, DiagnosticDefinition>,
+  Reporters extends readonly AnyDiagnosticReporter[] = [],
+> = Diagnostics<Codes, readonly [typeof devframeReporter, ...Reporters]>
+
 export {
   createConsoleReporter,
   defineProdDiagnostics,
diff --git a/packages/devframe/src/utils/simple-schema.ts b/packages/devframe/src/utils/simple-schema.ts
index 684163231..7c893d8c2 100644
--- a/packages/devframe/src/utils/simple-schema.ts
+++ b/packages/devframe/src/utils/simple-schema.ts
@@ -1,5 +1,13 @@
 import type { StandardSchemaV1 } from '@standard-schema/spec'
 
+/**
+ * Re-exported [Standard Schema](https://standardschema.dev/) contract types so
+ * integrations can type `args`/`returns`/view schemas against Standard Schema
+ * through the devframe peer, without taking their own `@standard-schema/spec`
+ * dependency (devframe inlines the declarations into its own `.d.mts`).
+ */
+export type { StandardSchemaV1 } from '@standard-schema/spec'
+
 /**
  * A tiny, zero-dependency [Standard Schema](https://standardschema.dev/)
  * builder.
diff --git a/packages/devframe/tsdown.config.ts b/packages/devframe/tsdown.config.ts
index 92c8ee1d4..2cc3b188b 100644
--- a/packages/devframe/tsdown.config.ts
+++ b/packages/devframe/tsdown.config.ts
@@ -26,7 +26,7 @@ const deps = {
     '@jridgewell/trace-mapping',
   ],
   /**
-   * `whenexpr` is runtime-only bundled (see `onlyBundle` below); its
+   * `whenexpr` is a devDependency, so its runtime is bundled in; its
    * declaration file mixes type-only and value named exports
    * (`export { type WhenExpression, evaluateWhen, ... }`) in a way that
    * trips up rolldown's dts bundler when it tries to inline the type
@@ -38,27 +38,6 @@ const deps = {
   dts: {
     neverBundle: ['whenexpr'],
   },
-  onlyBundle: [
-    '@standard-schema/spec',
-    'acorn',
-    'birpc',
-    'get-port-please',
-    'immer',
-    'launch-editor',
-    'mlly',
-    'mrmime',
-    'obug',
-    'ohash',
-    'p-limit',
-    'perfect-debounce',
-    'picocolors',
-    'shell-quote',
-    'structured-clone-es',
-    'tinyexec',
-    'ua-parser-modern',
-    'whenexpr',
-    'yocto-queue',
-  ],
 }
 
 // The node build reaches `devframe/utils/shared-state` through the same
diff --git a/packages/hub/tsdown.config.ts b/packages/hub/tsdown.config.ts
index ae344f8e6..ac98f2b2f 100644
--- a/packages/hub/tsdown.config.ts
+++ b/packages/hub/tsdown.config.ts
@@ -22,10 +22,5 @@ export default defineConfig({
       'postcss',
       'rolldown',
     ],
-    onlyBundle: [
-      '@standard-schema/spec',
-      'acorn',
-      'get-port-please',
-    ],
   },
 })
diff --git a/packages/json-render/package.json b/packages/json-render/package.json
index c8394fff5..fef22ccf3 100644
--- a/packages/json-render/package.json
+++ b/packages/json-render/package.json
@@ -50,7 +50,6 @@
   },
   "devDependencies": {
     "@devframes/hub": "workspace:*",
-    "@standard-schema/spec": "catalog:deps",
     "@types/node": "catalog:types",
     "devframe": "workspace:*",
     "tsdown": "catalog:build"
diff --git a/packages/json-render/src/node/create-view.ts b/packages/json-render/src/node/create-view.ts
index ea17ba062..2051fe109 100644
--- a/packages/json-render/src/node/create-view.ts
+++ b/packages/json-render/src/node/create-view.ts
@@ -1,6 +1,6 @@
-import type { StandardSchemaV1 } from '@standard-schema/spec'
 import type { DevframeNodeContext, DevframeScopedNodeContext } from 'devframe'
 import type { SharedState, SharedStatePatch } from 'devframe/utils/shared-state'
+import type { StandardSchemaV1 } from 'devframe/utils/simple-schema'
 import type { DevframeJsonRenderSpec, JsonRenderStatePatch, JsonRenderView } from '../types'
 import type { JsonRenderIndex } from '../view-index'
 import { createSharedState } from 'devframe/utils/shared-state'
diff --git a/packages/json-render/src/node/diagnostics.ts b/packages/json-render/src/node/diagnostics.ts
index e0f618344..88b6afdf6 100644
--- a/packages/json-render/src/node/diagnostics.ts
+++ b/packages/json-render/src/node/diagnostics.ts
@@ -1,42 +1,48 @@
+import type { DevframeDiagnostics } from 'devframe/utils/nostics'
 import { defineDiagnostics } from 'devframe/utils/nostics'
 
+const codes = {
+  DF0038: {
+    why: (p: { id: string, key: string, issues: string }) =>
+      `JSON-render view "${p.id}" received invalid props on element "${p.key}": ${p.issues}`,
+    fix: 'Match the element props to the base catalog\'s prop schema for that component. See the component reference for the expected shape.',
+  },
+  DF0039: {
+    why: (p: { id: string, scope: string }) =>
+      `A JSON-render view with id "${p.id}" already exists in scope "${p.scope}".`,
+    fix: 'Give each view a stable id unique within its scope, or dispose the previous view before recreating it.',
+  },
+  DF0040: {
+    why: (p: { id: string }) =>
+      `JSON-render view "${p.id}" was used after it was disposed.`,
+    fix: 'Create a fresh view with `createJsonRenderView` instead of reusing a disposed handle.',
+  },
+  DF0041: {
+    why: (p: { id: string, reason: string }) =>
+      `JSON-render view "${p.id}" spec is not JSON-serializable: ${p.reason}`,
+    fix: 'Specs and state travel as strict JSON, so remove functions, symbols, class instances, Map/Set, or circular references.',
+  },
+  DF0073: {
+    why: (p: { id: string, issues: string }) =>
+      `JSON-render view "${p.id}" does not match its configured schema: ${p.issues}`,
+    fix: 'Match the authored spec to the Standard Schema passed to `createJsonRenderView`.',
+  },
+  DF0074: {
+    why: (p: { id: string }) =>
+      `JSON-render view "${p.id}" uses an asynchronous Standard Schema.`,
+    fix: 'Use a synchronous Standard Schema so initial creation and updates remain synchronous.',
+  },
+}
+
 /**
  * `@devframes/json-render` protocol/runtime diagnostics share the `DF`
  * prefix and use the next globally available core codes. Browser-only render
  * failures keep `console.*` in the UI package.
+ *
+ * Annotated with {@link DevframeDiagnostics} so the public type resolves
+ * through the `devframe/utils/nostics` peer rather than inlining `nostics`.
  */
-export const diagnostics = defineDiagnostics({
+export const diagnostics: DevframeDiagnostics<typeof codes> = defineDiagnostics({
   docsBase: 'https://devfra.me/errors',
-  codes: {
-    DF0038: {
-      why: (p: { id: string, key: string, issues: string }) =>
-        `JSON-render view "${p.id}" received invalid props on element "${p.key}": ${p.issues}`,
-      fix: 'Match the element props to the base catalog\'s prop schema for that component. See the component reference for the expected shape.',
-    },
-    DF0039: {
-      why: (p: { id: string, scope: string }) =>
-        `A JSON-render view with id "${p.id}" already exists in scope "${p.scope}".`,
-      fix: 'Give each view a stable id unique within its scope, or dispose the previous view before recreating it.',
-    },
-    DF0040: {
-      why: (p: { id: string }) =>
-        `JSON-render view "${p.id}" was used after it was disposed.`,
-      fix: 'Create a fresh view with `createJsonRenderView` instead of reusing a disposed handle.',
-    },
-    DF0041: {
-      why: (p: { id: string, reason: string }) =>
-        `JSON-render view "${p.id}" spec is not JSON-serializable: ${p.reason}`,
-      fix: 'Specs and state travel as strict JSON, so remove functions, symbols, class instances, Map/Set, or circular references.',
-    },
-    DF0073: {
-      why: (p: { id: string, issues: string }) =>
-        `JSON-render view "${p.id}" does not match its configured schema: ${p.issues}`,
-      fix: 'Match the authored spec to the Standard Schema passed to `createJsonRenderView`.',
-    },
-    DF0074: {
-      why: (p: { id: string }) =>
-        `JSON-render view "${p.id}" uses an asynchronous Standard Schema.`,
-      fix: 'Use a synchronous Standard Schema so initial creation and updates remain synchronous.',
-    },
-  },
+  codes,
 })
diff --git a/packages/json-render/test/create-view.test.ts b/packages/json-render/test/create-view.test.ts
index d0ca03c8a..f98cf98a0 100644
--- a/packages/json-render/test/create-view.test.ts
+++ b/packages/json-render/test/create-view.test.ts
@@ -1,5 +1,5 @@
-import type { StandardSchemaV1 } from '@standard-schema/spec'
 import type { DevframeHost, DevframeNodeContext } from 'devframe'
+import type { StandardSchemaV1 } from 'devframe/utils/simple-schema'
 import type { DevframeJsonRenderSpec } from '../src/types'
 import { mkdtempSync } from 'node:fs'
 import { tmpdir } from 'node:os'
diff --git a/packages/json-render/tsdown.config.ts b/packages/json-render/tsdown.config.ts
index 3fc8e0f09..235772d3e 100644
--- a/packages/json-render/tsdown.config.ts
+++ b/packages/json-render/tsdown.config.ts
@@ -12,15 +12,4 @@ export default defineConfig({
   tsconfig: '../../tsconfig.base.json',
   dts: true,
   platform: 'neutral',
-  deps: {
-    // Both are types-only in this package's public dts: `@standard-schema/spec`
-    // (a devDependency) and `nostics` (reached via `devframe/utils/nostics`,
-    // runtime import stays external on the devframe peer). Whitelisting them
-    // lets the dts bundler inline the type declarations so consumers need
-    // neither package installed for `@devframes/json-render`'s types.
-    onlyBundle: [
-      '@standard-schema/spec',
-      'nostics',
-    ],
-  },
 })
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 15ac4804d..2b9491153 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1789,9 +1789,6 @@ importers:
       '@devframes/hub':
         specifier: workspace:*
         version: link:../hub
-      '@standard-schema/spec':
-        specifier: catalog:deps
-        version: 1.1.0
       '@types/node':
         specifier: catalog:types
         version: 26.5.1
diff --git a/tests/__snapshots__/tsnapi/@devframes/json-render/node.snapshot.d.ts b/tests/__snapshots__/tsnapi/@devframes/json-render/node.snapshot.d.ts
index e0415bdf8..c371991cc 100644
--- a/tests/__snapshots__/tsnapi/@devframes/json-render/node.snapshot.d.ts
+++ b/tests/__snapshots__/tsnapi/@devframes/json-render/node.snapshot.d.ts
@@ -16,90 +16,9 @@ export declare function createJsonRenderView<SpecType extends DevframeJsonRender
 // #endregion
 
 // #region Variables
-export declare const jsonRenderDiagnostics: Diagnostics<{
-  readonly DF0038: {
-    readonly why: (p: {
-      id: string;
-      key: string;
-      issues: string;
-    }) => string;
-    readonly fix: "Match the element props to the base catalog's prop schema for that component. See the component reference for the expected shape.";
-  };
-  readonly DF0039: {
-    readonly why: (p: {
-      id: string;
-      scope: string;
-    }) => string;
-    readonly fix: "Give each view a stable id unique within its scope, or dispose the previous view before recreating it.";
-  };
-  readonly DF0040: {
-    readonly why: (p: {
-      id: string;
-    }) => string;
-    readonly fix: "Create a fresh view with `createJsonRenderView` instead of reusing a disposed handle.";
-  };
-  readonly DF0041: {
-    readonly why: (p: {
-      id: string;
-      reason: string;
-    }) => string;
-    readonly fix: "Specs and state travel as strict JSON, so remove functions, symbols, class instances, Map/Set, or circular references.";
-  };
-  readonly DF0073: {
-    readonly why: (p: {
-      id: string;
-      issues: string;
-    }) => string;
-    readonly fix: "Match the authored spec to the Standard Schema passed to `createJsonRenderView`.";
-  };
-  readonly DF0074: {
-    readonly why: (p: {
-      id: string;
-    }) => string;
-    readonly fix: "Use a synchronous Standard Schema so initial creation and updates remain synchronous.";
-  };
-}, readonly [(d: Diagnostic, { method }?: {
-  method?: "log" | "warn" | "error";
-}) => void]>;
+export declare const jsonRenderDiagnostics: DevframeDiagnostics<typeof codes>;
 // #endregion
 
 // #region Referenced (internal)
 type AnyContext = DevframeNodeContext | DevframeScopedNodeContext<string>;
-declare class Diagnostic extends Error {
-  name: string;
-  code: string;
-  docs?: string;
-  fix?: string;
-  sources?: string[];
-  get why(): string;
-  constructor(_: DiagnosticInit, _?: Function);
-  toJSON(): object;
-}
-type Diagnostics<Codes extends Record<string, DiagnosticDefinition>, Reporters extends readonly AnyDiagnosticReporter[]> = { [Code in keyof Codes]: DiagnosticHandle<InferCodeParams<Codes[Code]>, Prettify<ExtractReportersOptions<Reporters>>>; };
-declare namespace StandardSchemaV1 {
-  interface Props<Input = unknown, Output = Input> extends StandardTypedV1.Props<Input, Output> {
-    readonly validate: (_: unknown, _?: StandardSchemaV1.Options | undefined) => Result<Output> | Promise<Result<Output>>;
-  }
-  type Result<Output> = SuccessResult<Output> | FailureResult;
-  interface SuccessResult<Output> {
-    readonly value: Output;
-    readonly issues?: undefined;
-  }
-  interface Options {
-    readonly libraryOptions?: Record<string, unknown> | undefined;
-  }
-  interface FailureResult {
-    readonly issues: ReadonlyArray<Issue>;
-  }
-  interface Issue {
-    readonly message: string;
-    readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
-  }
-  interface PathSegment {
-    readonly key: PropertyKey;
-  }
-  interface Types<Input = unknown, Output = Input> extends StandardTypedV1.Types<Input, Output> {}
-  type InferInput<Schema extends StandardTypedV1> = StandardTypedV1.InferInput<Schema>;
-  type InferOutput<Schema extends StandardTypedV1> = StandardTypedV1.InferOutput<Schema>;
-}
 // #endregion
\ No newline at end of file
diff --git a/tests/__snapshots__/tsnapi/devframe/utils/nostics.snapshot.d.ts b/tests/__snapshots__/tsnapi/devframe/utils/nostics.snapshot.d.ts
index cbd4208a0..fd8b41d5f 100644
--- a/tests/__snapshots__/tsnapi/devframe/utils/nostics.snapshot.d.ts
+++ b/tests/__snapshots__/tsnapi/devframe/utils/nostics.snapshot.d.ts
@@ -10,6 +10,7 @@ export { createConsoleReporter }
 export { defineDiagnostics }
 export { defineProdDiagnostics }
 export { DevframeDefineDiagnosticsOptions }
+export { DevframeDiagnostics }
 export { Diagnostic }
 export { DiagnosticCallParams }
 export { DiagnosticDefinition }
diff --git a/tests/__snapshots__/tsnapi/devframe/utils/simple-schema.snapshot.d.ts b/tests/__snapshots__/tsnapi/devframe/utils/simple-schema.snapshot.d.ts
index 4060daeb7..6bb90665d 100644
--- a/tests/__snapshots__/tsnapi/devframe/utils/simple-schema.snapshot.d.ts
+++ b/tests/__snapshots__/tsnapi/devframe/utils/simple-schema.snapshot.d.ts
@@ -47,4 +47,8 @@ export declare const s: {
 
 // #region Referenced (internal)
 type InferObject<T extends Record<string, StandardSchemaV1>, Mode extends 'input' | 'output'> = Prettify<{ [K in keyof T as undefined extends InferField<T[K], Mode> ? never : K]: InferField<T[K], Mode>; } & { [K in keyof T as undefined extends InferField<T[K], Mode> ? K : never]?: InferField<T[K], Mode>; }>;
+// #endregion
+
+// #region Other
+export { StandardSchemaV1 }
 // #endregion
\ No newline at end of file