@abide/abide 0.41.1 → 0.43.0

package/src/lib/server/rpc/types/{VerbHelper.ts → RpcHelper.ts}

@@ -1,16 +1,18 @@
 import type { ClientFlags } from '../../../shared/types/ClientFlags.ts'
+import type { ErrorSpec } from '../../../shared/types/ErrorSpec.ts'
 import type { RemoteFunction } from '../../../shared/types/RemoteFunction.ts'
 import type { StandardSchemaV1 } from '../../../shared/types/StandardSchemaV1.ts'
 import type { RemoteHandler } from './RemoteHandler.ts'
 
 /*
-Options every verb overload accepts: the OpenAPI 200 `outputSchema`, the
+Options every rpc overload accepts: the OpenAPI 200 `outputSchema`, the
 `clients` surface flags, the same-origin CSRF exemption (`crossOrigin`), the
 pre-parse body-byte ceiling (`maxBodySize`), and the per-surface handler
 `timeout` (ms). The schema-bearing overloads intersect this with their own
-`inputSchema`/`filesSchema` members.
+`inputSchema`/`filesSchema` members. Mutating helpers widen it with `outbox`
+(see MutatingRpcOpts) — a read RPC never accepts it.
 */
-type VerbBaseOpts = {
+type RpcBaseOpts = {
     outputSchema?: StandardSchemaV1
     clients?: Partial<ClientFlags>
     crossOrigin?: boolean
@@ -19,9 +21,22 @@ type VerbBaseOpts = {
 }
 
 /*
-Shared signature for every verb helper (GET / POST / …). Three overloads:
+Mutating-helper options: the shared base plus durable delivery. `outbox` lives
+here, not on RpcBaseOpts, because a read RPC has nothing to durably deliver —
+so `GET(fn, { outbox: true })` is a compile error, not the runtime throw it used
+to be. Keeps the type surface honest with the defineRpc guard.
+*/
+type MutatingRpcOpts = RpcBaseOpts & {
+    /* Durable delivery: on an unreachable server the call still throws, and the request is
+       parked for replay. Drains on `rpc.outbox.retry()` — no auto-drain. The call shape is
+       unchanged — `rpc.outbox` exposes the queue. */
+    outbox?: boolean
+}
+
+/*
+Shared signature for every rpc helper (GET / POST / …). Three overloads:
 
-  - `Verb(fn, { inputSchema, outputSchema?, clients? })` — `Args` infers
+  - `Rpc(fn, { inputSchema, outputSchema?, clients? })` — `Args` infers
     from `InferInput<InputSchema>`, the handler receives
     `InferOutput<InputSchema>`. Generic order is `<Return, InputSchema>` so
     users can override `Return` while letting `InputSchema` infer from
@@ -29,10 +44,10 @@ Shared signature for every verb helper (GET / POST / …). Three overloads:
     the success body — it feeds the OpenAPI 200 response and the MCP tool
     `outputSchema`. JSON Schema is projected from each schema's own
     `toJSONSchema()` (wrap with withJsonSchema if the library lacks one).
-    `clients` controls which surfaces (browser / mcp / cli) expose this verb.
-    `crossOrigin: true` exempts a mutating verb from the router's same-origin
+    `clients` controls which surfaces (browser / mcp / cli) expose this rpc.
+    `crossOrigin: true` exempts a mutating rpc from the router's same-origin
     CSRF gate — by default a browser request whose Origin doesn't match the
-    app's own host is refused with 403 on every non-GET/HEAD verb.
+    app's own host is refused with 403 on every non-GET/HEAD rpc.
     `maxBodySize` caps the body's actual received bytes (413 past it),
     enforced before parsing; omitted, the only ceiling is Bun.serve's
     server-wide maxRequestBodySize. `timeout` (ms) bounds the handler's
@@ -40,15 +55,15 @@ Shared signature for every verb helper (GET / POST / …). Three overloads:
     exceeded; on the network path it also aborts request().signal so a
     handler's `fetch(ext, { signal: request().signal })` is cancelled, not
     just abandoned.
-  - `Verb(fn, { clients })` — schemaless but with explicit client
+  - `Rpc(fn, { clients })` — schemaless but with explicit client
     targeting (e.g. server-internal RPC with `clients: { browser: false }`).
-  - `Verb(fn)` — bare handler. `Args` and `Return` come from the handler
+  - `Rpc(fn)` — bare handler. `Args` and `Return` come from the handler
     type; `Return` is usually inferred via the `TypedResponse<T>` brand on
     `json`/`error`/`redirect`/`jsonl`/`sse`.
 */
-export type VerbHelper = {
+type RpcHelperOf<Opts> = {
     /*
-    `Verb(fn, { inputSchema, filesSchema, … })` — multipart upload. The
+    `Rpc(fn, { inputSchema, filesSchema, … })` — multipart upload. The
     handler receives the text fields (`InferOutput<InputSchema>`) intersected
     with the validated File parts (`InferOutput<FilesSchema>`); both are merged
     into one args bag. The call site sends a FormData (RemoteFunction's call
@@ -60,25 +75,44 @@ export type VerbHelper = {
         Return = unknown,
         InputSchema extends StandardSchemaV1 = StandardSchemaV1,
         FilesSchema extends StandardSchemaV1 = StandardSchemaV1,
+        Errors extends ErrorSpec = Record<string, never>,
     >(
         fn: RemoteHandler<
             StandardSchemaV1.InferOutput<InputSchema> & StandardSchemaV1.InferOutput<FilesSchema>,
-            Return
+            Return,
+            Errors
         >,
-        opts: VerbBaseOpts & {
+        opts: Opts & {
             inputSchema: InputSchema
             filesSchema: FilesSchema
+            errors?: Errors
         },
-    ): RemoteFunction<StandardSchemaV1.InferInput<InputSchema>, Return>
-    <Return = unknown, InputSchema extends StandardSchemaV1 = StandardSchemaV1>(
-        fn: RemoteHandler<StandardSchemaV1.InferOutput<InputSchema>, Return>,
-        opts: VerbBaseOpts & { inputSchema: InputSchema },
-    ): RemoteFunction<StandardSchemaV1.InferInput<InputSchema>, Return>
-    <Args = undefined, Return = unknown>(
-        fn: RemoteHandler<Args, Return>,
-        opts: VerbBaseOpts,
-    ): RemoteFunction<Args, Return>
+    ): RemoteFunction<StandardSchemaV1.InferInput<InputSchema>, Return, Errors>
+    <
+        Return = unknown,
+        InputSchema extends StandardSchemaV1 = StandardSchemaV1,
+        Errors extends ErrorSpec = Record<string, never>,
+    >(
+        fn: RemoteHandler<StandardSchemaV1.InferOutput<InputSchema>, Return, Errors>,
+        opts: Opts & { inputSchema: InputSchema; errors?: Errors },
+    ): RemoteFunction<StandardSchemaV1.InferInput<InputSchema>, Return, Errors>
+    <Args = undefined, Return = unknown, Errors extends ErrorSpec = Record<never, never>>(
+        fn: RemoteHandler<Args, Return, Errors>,
+        opts: Opts & { errors?: Errors },
+    ): RemoteFunction<Args, Return, Errors>
     <Args = undefined, Return = unknown>(
         fn: RemoteHandler<Args, Return>,
     ): RemoteFunction<Args, Return>
 }
+
+/* The read helpers (GET/HEAD): no `outbox` — a read has nothing to durably deliver. */
+export type RpcHelper = RpcHelperOf<RpcBaseOpts>
+
+/*
+The mutating helpers (POST/PUT/PATCH/DELETE). A durable (`outbox`) call is a normal
+RemoteFunction — it throws exactly like a non-durable one and only parks the request as a
+side-effect on an unreachable server — so there is no separate return shape; `outbox` rides
+MutatingRpcOpts and `rpc.outbox` exposes the queue. The distinct opts base is what makes
+`outbox` legal here and a compile error on the read helpers.
+*/
+export type MutatingRpcHelper = RpcHelperOf<MutatingRpcOpts>

package/src/lib/server/rpc/types/{VerbRegistryEntry.ts → RpcRegistryEntry.ts}

@@ -3,7 +3,7 @@ import type { RemoteFunction } from '../../../shared/types/RemoteFunction.ts'
 import type { StandardSchemaV1 } from '../../../shared/types/StandardSchemaV1.ts'
 
 /*
-Per-verb registry record on the server side. MCP and CLI enumerate this
+Per-rpc registry record on the server side. MCP and CLI enumerate this
 to discover which RPCs are advertised (clients flags) and what shapes
 they expect/return. The schemas and resolved clients stay off the public
 RemoteFunction shape so the browser-side proxy doesn't need to carry
@@ -20,13 +20,13 @@ from `inputSchema` because a File has no honest JSON-Schema conversion — it
 stays out of the MCP/CLI projection that `inputSchema` feeds, and the OpenAPI
 multipart body advertises the file parts generically as binary.
 */
-export type VerbRegistryEntry = {
+export type RpcRegistryEntry = {
     remote: RemoteFunction<unknown, unknown>
     inputSchema: StandardSchemaV1 | undefined
     outputSchema: StandardSchemaV1 | undefined
     filesSchema: StandardSchemaV1 | undefined
     clients: ClientFlags
-    /* The verb's declared opts, recorded so introspection (inspector) can report
+    /* The rpc's declared opts, recorded so introspection (inspector) can report
        the deadline/body-cap/CSRF-exemption a handler runs under. Undefined = the
        framework default (no deadline, Bun's server-wide body ceiling, gated). */
     timeout: number | undefined

package/src/lib/server/rpc/types/TypedResponse.ts

@@ -1,14 +1,14 @@
 /*
 A `Response` tagged with the body type the framework will hand back to
 callers after Content-Type-driven decoding. The tag is phantom — it
-adds no runtime field, only a type-level slot so the verb helpers can
+adds no runtime field, only a type-level slot so the rpc helpers can
 infer `Return` from the handler's return type instead of forcing every
 route to annotate it via `GET<Args, Return>`.
 
 The respond helpers (`json<T>`, `error`, `redirect`, `jsonl<F>`,
 `sse<F>`) all return a `TypedResponse<T>`, so a handler ending in
 `return json({ user })` exposes `{ user: ... }` as its body type; the
-verb overload picks it up via `RemoteHandler<Args, Return>`.
+rpc overload picks it up via `RemoteHandler<Args, Return>`.
 
 `T` is optional on the brand so a plain `new Response(...)` (untagged)
 remains assignable to `TypedResponse<unknown>`; in that case `Return`

package/src/lib/server/rpc/unprocessed.ts

@@ -1,14 +1,13 @@
-import type { RemoteFunction } from '../../shared/types/RemoteFunction.ts'
-
 /*
-Verb helpers (GET / POST / …) are placeholders — the bundler rewrites every
+Rpc helpers (GET / POST / …) are placeholders — the bundler rewrites every
 `export const x = GET(fn)` inside `src/server/rpc/<file>.ts` into a call to
-defineVerb (server target) or remoteProxy (client target). If a call slips
+defineRpc (server target) or remoteProxy (client target). If a call slips
 through, the bundler plugin didn't process the file; throwing here surfaces
-that cleanly instead of silently returning undefined.
+that cleanly instead of silently returning undefined. Returns `never` (it always
+throws), so a helper's arrow satisfies every overload of RpcHelper/MutatingRpcHelper.
 */
-export function unprocessed<Args, Return>(verb: string): RemoteFunction<Args, Return> {
+export function unprocessed(method: string): never {
     throw new Error(
-        `[abide] \`${verb}\` was called outside an $rpc module — verb helpers are only valid as the value of \`export const <filename> = ...\` inside a file under src/server/rpc/`,
+        `[abide] \`${method}\` was called outside an $rpc module — rpc helpers are only valid as the value of \`export const <filename> = ...\` inside a file under src/server/rpc/`,
     )
 }

package/src/lib/server/rpc/validationError.ts

@@ -0,0 +1,17 @@
+import type { StandardSchemaV1 } from '../../shared/types/StandardSchemaV1.ts'
+import type { ValidationErrorData } from '../../shared/types/ValidationErrorData.ts'
+import { error } from '../error.ts'
+import { fieldErrorsFromIssues } from './fieldErrorsFromIssues.ts'
+
+/*
+The framework-reserved `validation` typed error a 422 carries: the raw Standard
+Schema `issues` plus the form-friendly field → first-message map. Routed through
+the single `error()` funnel (descriptor form) so it serializes as the same
+`{ $abideError, data }` body every typed error uses, and so the 422's reason
+phrase reaches `HttpError.statusText`. The client parses it back onto
+`HttpError.kind = 'validation'` / `.data: ValidationErrorData`.
+*/
+export function validationError(issues: readonly StandardSchemaV1.Issue[]): Response {
+    const data: ValidationErrorData = { issues, fields: fieldErrorsFromIssues(issues) }
+    return error({ $abideError: 'validation', status: 422, data })
+}

package/src/lib/server/runtime/buildInspectorSurface.ts

@@ -1,20 +1,20 @@
 import { jsonSchemaForSchema } from '../../shared/jsonSchemaForSchema.ts'
 import { promptRegistry } from '../prompts/promptRegistry.ts'
-import { verbRegistry } from '../rpc/verbRegistry.ts'
+import { rpcRegistry } from '../rpc/rpcRegistry.ts'
 import { socketOperations } from '../sockets/socketOperations.ts'
 import { socketRegistry } from '../sockets/socketRegistry.ts'
 import type { InspectorSurface } from './types/InspectorSurface.ts'
 
 /*
-Projects the live verb + socket registries into the inspector's catalog. Read
-at call time (not cached) so verbs constructed after boot — lazily on first
+Projects the live rpc + socket registries into the inspector's catalog. Read
+at call time (not cached) so rpcs constructed after boot — lazily on first
 hit, or eagerly once ensureRegistriesLoaded walked the manifest — show up.
 Schemas go through jsonSchemaForSchema, the same projection MCP and OpenAPI
-use, so the three can't disagree on a verb's shape; a missing schema stays
-undefined to mark a verb that carries no machine-advertisable contract.
+use, so the three can't disagree on a rpc's shape; a missing schema stays
+undefined to mark a rpc that carries no machine-advertisable contract.
 */
 export function buildInspectorSurface(): InspectorSurface {
-    const verbs = Array.from(verbRegistry.values()).map((entry) => ({
+    const rpcs = Array.from(rpcRegistry.values()).map((entry) => ({
         url: entry.remote.url,
         method: entry.remote.method,
         clients: { ...entry.remote.clients },
@@ -41,5 +41,5 @@ export function buildInspectorSurface(): InspectorSurface {
         description: entry.prompt.description,
         inputSchema: entry.jsonSchema,
     }))
-    return { verbs, sockets, prompts }
+    return { rpcs, sockets, prompts }
 }

package/src/lib/server/runtime/buildOpenApiSpec.ts

@@ -1,10 +1,10 @@
 import { carriesBodyArgs } from '../../shared/carriesBodyArgs.ts'
 import { commandNameForUrl } from '../../shared/commandNameForUrl.ts'
 import { jsonSchemaForSchema } from '../../shared/jsonSchemaForSchema.ts'
-import { verbRegistry } from '../rpc/verbRegistry.ts'
+import { rpcRegistry } from '../rpc/rpcRegistry.ts'
 
 /*
-Turns a verb's resolved JSON Schema into OpenAPI query parameters — one
+Turns a rpc's resolved JSON Schema into OpenAPI query parameters — one
 per top-level property, marked required when the schema lists it. Used
 for GET/DELETE/HEAD operations, which carry their args on the query
 string (mirroring buildRpcRequest).
@@ -24,7 +24,7 @@ function queryParameters(jsonSchema: Record<string, unknown>): Array<Record<stri
 }
 
 /*
-Request body schema for a multipart upload verb: the text fields from
+Request body schema for a multipart upload rpc: the text fields from
 inputSchema, plus the binary parts. A File has no honest
 Standard-Schema→JSON-Schema conversion, so the file parts are advertised
 generically as additional binary properties rather than named per field.
@@ -44,7 +44,7 @@ function multipartBodySchema(textSchema: Record<string, unknown>): Record<string
 }
 
 /*
-Builds an OpenAPI 3.1 document from the verb registry — the HTTP surface
+Builds an OpenAPI 3.1 document from the rpc registry — the HTTP surface
 every rpc exposes regardless of which non-browser clients it advertises.
 GET/DELETE/HEAD args become query parameters; POST/PUT/PATCH args become
 a JSON request body. operationId is the folder-prefixed command name so
@@ -55,13 +55,13 @@ export function buildOpenApiSpec(info: {
     version: string
 }): Record<string, unknown> {
     const paths: Record<string, Record<string, unknown>> = {}
-    for (const entry of verbRegistry.values()) {
+    for (const entry of rpcRegistry.values()) {
         const url = entry.remote.url
         const method = entry.remote.method
         const jsonSchema = jsonSchemaForSchema(entry.inputSchema)
         const description = jsonSchema.description as string | undefined
         /*
-        When the verb declares an `outputSchema`, describe the 200 body
+        When the rpc declares an `outputSchema`, describe the 200 body
         with it so external tooling sees the real return shape; otherwise
         fall back to a bare OK.
         */

package/src/lib/server/runtime/createRouteDispatcher.ts

@@ -3,7 +3,7 @@ import { memoizeByKey } from '../../shared/memoizeByKey.ts'
 import { NAV_HEADER } from '../../shared/NAV_HEADER.ts'
 import { REMOTE_FUNCTION } from '../../shared/REMOTE_FUNCTION.ts'
 import { TEXT_PLAIN } from '../../shared/TEXT_PLAIN.ts'
-import type { HttpVerb } from '../../shared/types/HttpVerb.ts'
+import type { HttpMethod } from '../../shared/types/HttpMethod.ts'
 import type { RemoteFunction } from '../../shared/types/RemoteFunction.ts'
 import type { Pages } from '../../ui/types/Pages.ts'
 import type { RemoteRoutes } from '../rpc/types/RemoteRoutes.ts'
@@ -26,7 +26,7 @@ type RenderPage = (
     store: RequestStore,
 ) => Promise<Response>
 
-/* The framework's 405 — `Allow` names the permitted verb(s), body and NO_STORE shared so the rpc and page branches can't drift. */
+/* The framework's 405 — `Allow` names the permitted rpc(s), body and NO_STORE shared so the rpc and page branches can't drift. */
 function methodNotAllowed(allow: string): Response {
     return new Response('Method Not Allowed', {
         status: 405,
@@ -36,9 +36,9 @@ function methodNotAllowed(allow: string): Response {
 
 /*
 Owns route dispatch: deciding, per registered URL, whether a request hits an
-rpc verb, a page render, or nothing — and the method-matching that picks the
+rpc rpc, a page render, or nothing — and the method-matching that picks the
 status. Page URLs (under src/ui/pages/) serve GET/HEAD by rendering; rpc
-URLs (under src/server/rpc/, `/rpc/...`) dispatch to the single declared verb,
+URLs (under src/server/rpc/, `/rpc/...`) dispatch to the single declared rpc,
 405 on method mismatch; an unregistered URL is 404. Page and rpc URLs are
 disjoint by construction, so each route lands in exactly one branch.
 
@@ -66,7 +66,7 @@ export function createRouteDispatcher({
         Each $rpc module has exactly one named export, validated at build
         time. Pick the first REMOTE_FUNCTION-branded export — exact, so an
         incidental re-export carrying method/url props can't be mistaken
-        for the verb.
+        for the rpc.
         */
         return loader().then((mod) => {
             for (const value of Object.values(mod)) {
@@ -82,14 +82,14 @@ export function createRouteDispatcher({
         const hasPage = pages[routeUrl] !== undefined
         const hasRpc = rpc[routeUrl] !== undefined
         return async function routeHandler(req, pathParams, store) {
-            const method = req.method as HttpVerb
+            const method = req.method as HttpMethod
             if (hasRpc) {
                 const fn = await loadRpc(routeUrl)
                 if (fn && fn.method === method) {
                     const forbidden = crossOriginGate(req, store.url, {
                         allowReadOnly: true,
                         optOut: fn.crossOrigin === true,
-                        hint: 'Declare `crossOrigin: true` on the verb to accept cross-site calls.',
+                        hint: 'Declare `crossOrigin: true` on the rpc to accept cross-site calls.',
                     })
                     if (forbidden) {
                         return forbidden

package/src/lib/server/runtime/createServer.ts

@@ -71,7 +71,7 @@ const DEV_REBUILD_PATH = '/__abide/reload'
 /*
 Unlike the framework's own plumbing routes above (the socket multiplex, MCP
 endpoint, CLI download), the OpenAPI document describes the app's public HTTP
-surface — the /rpc/* verbs — rather than abide internals, so it sits at the
+surface — the /rpc/* rpcs — rather than abide internals, so it sits at the
 conventional root path where external tooling and scanners expect to find it
 (/openapi.json, alongside /swagger.json, /.well-known/*) rather than under the
 /__abide/ namespace.
@@ -81,7 +81,7 @@ const OPENAPI_PATH = '/openapi.json'
 /*
 Starts a Bun HTTP server that ties together the framework conventions:
 page.abide under src/ui/pages/ for views (layout.abide wraps the pages beneath
-it), one named export per file under src/server/rpc/ for verb-bound remote
+it), one named export per file under src/server/rpc/ for rpc-bound remote
 functions, one named export
 per file under src/server/sockets/ for broadcast sockets, and an optional
 app.ts for boot-time setup, request middleware, and error fallback. Page
@@ -120,7 +120,7 @@ export async function createServer({
     /*
     Bun's server-wide request body ceiling, enforced natively by Bun.serve
     (its own default is ~128MB). Surfaced as an option + env so deployments
-    can raise/lower it; per-verb tightening is the verbs' maxBodySize.
+    can raise/lower it; per-rpc tightening is the rpcs' maxBodySize.
     */
     maxRequestBodySize = parseBoundedEnvInt(
         process.env.ABIDE_MAX_REQUEST_BODY_SIZE,
@@ -242,7 +242,7 @@ export async function createServer({
     isn't installed. Resolved at boot so the fetch route below can branch on it.
     */
     const inspectorHandler = await maybeMountInspector({ name: appName, version: appVersion })
-    /* Built on first request, then reused — the verb registry is frozen after load. */
+    /* Built on first request, then reused — the rpc registry is frozen after load. */
     let openApiSpec: ReturnType<typeof buildOpenApiSpec> | undefined
     const cliCwd = process.cwd()
 

package/src/lib/server/runtime/crossOriginForbidden.ts

@@ -4,7 +4,7 @@ import { TEXT_PLAIN } from '../../shared/TEXT_PLAIN.ts'
 /*
 The framework's CSRF refusal, shared by every same-origin gate — the socket
 upgrade, the socket REST publish face, the MCP endpoint, and mutating rpc
-verbs — so the 403 body can't drift between surfaces. `hint` appends a
+rpcs — so the 403 body can't drift between surfaces. `hint` appends a
 surface-specific remedy; rpc names its `crossOrigin: true` opt-out so the
 first developer this 403s can self-serve.
 */

package/src/lib/server/runtime/crossOriginGate.ts

@@ -1,18 +1,18 @@
 import { isReadOnlyMethod } from '../../shared/isReadOnlyMethod.ts'
-import type { HttpVerb } from '../../shared/types/HttpVerb.ts'
+import type { HttpMethod } from '../../shared/types/HttpMethod.ts'
 import { crossOriginForbidden } from './crossOriginForbidden.ts'
 import { isCrossOriginRequest } from './isCrossOriginRequest.ts'
 
 /*
 The framework's CSRF/CSWSH posture in one place: a cross-origin browser
 request to a mutating framework endpoint is refused. Every endpoint that
-parses bodies ignoring Content-Type (rpc verbs, socket publish, MCP JSON-RPC)
+parses bodies ignoring Content-Type (rpc rpcs, socket publish, MCP JSON-RPC)
 must gate here — a hostile page's text/plain form trick could otherwise
 smuggle a payload in with the visitor's ambient cookies; non-browser clients
 send no Origin and pass. Returns the 403 to send, or undefined to proceed.
 Mount sites declare their variation: `allowReadOnly` lets GET/HEAD reads
 through (rpc reads and socket tails stay open cross-origin), `optOut` honours
-a verb's explicit `crossOrigin: true`, `hint` names the remedy in the 403.
+a rpc's explicit `crossOrigin: true`, `hint` names the remedy in the 403.
 */
 export function crossOriginGate(
     req: Request,
@@ -22,7 +22,7 @@ export function crossOriginGate(
     if (options.optOut) {
         return undefined
     }
-    if (options.allowReadOnly && isReadOnlyMethod(req.method as HttpVerb)) {
+    if (options.allowReadOnly && isReadOnlyMethod(req.method as HttpMethod)) {
         return undefined
     }
     return isCrossOriginRequest(req, url) ? crossOriginForbidden(options.hint) : undefined

package/src/lib/server/runtime/devClientFingerprint.ts

@@ -1,4 +1,5 @@
 import { relative } from 'node:path'
+import { fileName } from '../../shared/fileName.ts'
 import { analyzeComponent } from '../../ui/compile/analyzeComponent.ts'
 import { compileComponent } from '../../ui/compile/compileComponent.ts'
 import { nearestProjectRoot } from '../../ui/compile/nearestProjectRoot.ts'
@@ -19,7 +20,7 @@ const GENERATED = /(^|\/)\.abide\//
 // page.abide / layout.abide are router-mounted, not `mountChild`-tracked, so they
 // can't hot-swap — they fold into `structure` (a reload) instead.
 function isPageOrLayout(moduleId: string): boolean {
-    const file = moduleId.split('/').pop() ?? ''
+    const file = fileName(moduleId)
     return file === 'page.abide' || file === 'layout.abide'
 }
 

package/src/lib/server/runtime/logExposedSurfaces.ts

@@ -1,6 +1,6 @@
 import { abideLog } from '../../shared/abideLog.ts'
 import type { Pages } from '../../ui/types/Pages.ts'
-import { verbRegistry } from '../rpc/verbRegistry.ts'
+import { rpcRegistry } from '../rpc/rpcRegistry.ts'
 import { socketRegistry } from '../sockets/socketRegistry.ts'
 import { ensureRegistriesLoaded } from './registryManifests.ts'
 
@@ -15,7 +15,7 @@ const redden = (text: string): string =>
     hasColor ? `${Bun.color('red', 'ansi-256')}${text}\x1b[39m` : text
 
 /*
-A declared inputSchema is what makes mcp/cli safe to advertise (see defineVerb /
+A declared inputSchema is what makes mcp/cli safe to advertise (see defineRpc /
 defineSocket), so a missing schema gets a red `·` to flag the declaration whose
 machine surfaces are gated behind it.
 */
@@ -127,12 +127,12 @@ export async function logExposedSurfaces(routing: { pages: Pages }): Promise<voi
     */
     const methodWidth = Math.max(
         'http'.length,
-        ...Array.from(verbRegistry.values(), (entry) => entry.remote.method.length),
+        ...Array.from(rpcRegistry.values(), (entry) => entry.remote.method.length),
     )
     const withMethod = (method: string, identifier: string): string =>
         method.padEnd(methodWidth + COLUMN_GAP) + identifier
 
-    const rpcRows = Array.from(verbRegistry.values(), (entry) => [
+    const rpcRows = Array.from(rpcRegistry.values(), (entry) => [
         withMethod(entry.remote.method, entry.remote.url),
         schemaCell(Boolean(entry.inputSchema)),
         flag(entry.clients.browser),

package/src/lib/server/runtime/registryManifests.ts

@@ -7,7 +7,7 @@ Process-wide slot for the rpc + sockets + prompts manifests. createServer
 assigns once at boot (right after the route table is built); the MCP
 server, the OpenAPI emitter, and prompt enumeration read it on first
 request so they can lazy-import every module and walk the
-verb/socket/prompt registries.
+rpc/socket/prompt registries.
 
 The slot pattern (mirrors getActiveServer) lets the framework-generated
 McpServer bind to the manifests at module scope while the loaders stay
@@ -29,7 +29,7 @@ export function setRegistryManifests(value: RegistryManifests): void {
 
 /*
 On first call, eagerly imports every rpc + socket + prompt module so
-defineVerb / defineSocket / definePrompt fire and populate the
+defineRpc / defineSocket / definePrompt fire and populate the
 registries. Idempotent — repeat calls reuse the same in-flight promise,
 so concurrent first requests (e.g. /openapi.json + an MCP tools/list)
 trigger exactly one load instead of racing to fire the full import set

package/src/lib/server/runtime/types/InspectorCacheEntry.ts

@@ -9,7 +9,7 @@ export type InspectorCacheEntry = {
     key: string
     /* Lifecycle: 'settled' | 'in-flight' | 'refreshing'. */
     status: string
-    /* True when the entry stores a wire Response (a remote verb), false for a plain producer value. */
+    /* True when the entry stores a wire Response (a remote rpc), false for a plain producer value. */
     remote: boolean
     /* Retention ttl in ms; undefined = forever, 0 = dedupe-only. */
     ttl: number | undefined

package/src/lib/server/runtime/types/InspectorRpc.ts

@@ -0,0 +1,27 @@
+/*
+One RPC rpc projected for the inspector: the registry entry reduced to the
+serializable facts the UI renders — where it mounts, its method, which
+non-browser surfaces advertise it, and its argument/result shapes as JSON
+Schema. Schemas project through jsonSchemaForSchema (same as MCP/OpenAPI), so
+a rpc whose library can't render a schema still lists with an opaque shape.
+*/
+export type InspectorRpc = {
+    /* Registry key — the rpc URL the rpc mounts at (e.g. /rpc/users/create). */
+    url: string
+    /* HTTP method bound to the rpc. */
+    method: string
+    /* Which surfaces advertise it (browser/mcp/cli), from the rpc's ClientFlags. */
+    clients: Record<string, boolean>
+    /* Argument-bag shape as JSON Schema; undefined when the rpc declares none. */
+    inputSchema: Record<string, unknown> | undefined
+    /* Success-body shape as JSON Schema; undefined when the rpc declares none. */
+    outputSchema: Record<string, unknown> | undefined
+    /* True when the rpc declares a filesSchema — it accepts multipart File parts. */
+    files: boolean
+    /* Per-rpc handler deadline in ms; undefined = no deadline. */
+    timeout: number | undefined
+    /* Per-rpc received-body cap in bytes; undefined = Bun's server-wide ceiling. */
+    maxBodySize: number | undefined
+    /* True when the rpc opts out of the same-origin CSRF gate. */
+    crossOrigin: boolean | undefined
+}

package/src/lib/server/runtime/types/InspectorSurface.ts

@@ -1,16 +1,16 @@
 import type { InspectorPrompt } from './InspectorPrompt.ts'
+import type { InspectorRpc } from './InspectorRpc.ts'
 import type { InspectorSocket } from './InspectorSocket.ts'
-import type { InspectorVerb } from './InspectorVerb.ts'
 
 /*
 The app's machine surface projected for the inspector — the static catalog the
-UI renders. Built by reading the verb, socket, and prompt registries after
+UI renders. Built by reading the rpc, socket, and prompt registries after
 they're eager-loaded, so a freshly-booted server lists its whole surface, not
-just the verbs hit so far. Pages stay out: they're the human surface, already
+just the rpcs hit so far. Pages stay out: they're the human surface, already
 navigable.
 */
 export type InspectorSurface = {
-    verbs: InspectorVerb[]
+    rpcs: InspectorRpc[]
     sockets: InspectorSocket[]
     prompts: InspectorPrompt[]
 }

package/src/lib/server/runtime/types/RequestStore.ts

@@ -3,7 +3,7 @@ import type { TraceContext } from '../../../shared/types/TraceContext.ts'
 
 /*
 Per-request state propagated through AsyncLocalStorage. Every field is
-populated once at the server's fetch boundary; helpers and verb-defined
+populated once at the server's fetch boundary; helpers and rpc-defined
 remote functions read from it without threading arguments through user code.
 The inbound request's AbortSignal is reached via `req.signal` rather than a
 separate field.

package/src/lib/server/runtime/warnUnguardedMcp.ts

@@ -1,5 +1,5 @@
 import { abideLog } from '../../shared/abideLog.ts'
-import { verbRegistry } from '../rpc/verbRegistry.ts'
+import { rpcRegistry } from '../rpc/rpcRegistry.ts'
 import { socketRegistry } from '../sockets/socketRegistry.ts'
 import { ensureRegistriesLoaded } from './registryManifests.ts'
 
@@ -19,7 +19,7 @@ export async function warnUnguardedMcp(): Promise<void> {
         return
     }
     const isMcpExposed = (entry: { clients: { mcp: boolean } }): boolean => entry.clients.mcp
-    const exposed = [...verbRegistry.values(), ...socketRegistry.values()].filter(
+    const exposed = [...rpcRegistry.values(), ...socketRegistry.values()].filter(
         isMcpExposed,
     ).length
     if (exposed === 0) {