@abide/abide 0.58.0 → 0.100.0

package/src/lib/server/rpc/defineRpc.ts

@@ -1,271 +0,0 @@
-import { abideLog } from '../../shared/abideLog.ts'
-import { buildRpcRequest } from '../../shared/buildRpcRequest.ts'
-import { createRemoteFunction } from '../../shared/createRemoteFunction.ts'
-import { forwardHeaders } from '../../shared/forwardHeaders.ts'
-import { isReadOnlyMethod } from '../../shared/isReadOnlyMethod.ts'
-import { resolveClientFlags } from '../../shared/resolveClientFlags.ts'
-import type { CachePolicy } from '../../shared/types/CachePolicy.ts'
-import type { ClientFlags } from '../../shared/types/ClientFlags.ts'
-import type { ErrorJsonSchemas } from '../../shared/types/ErrorJsonSchemas.ts'
-import type { HttpMethod } from '../../shared/types/HttpMethod.ts'
-import type { InputCoercion } from '../../shared/types/InputCoercion.ts'
-import type { RemoteFunction } from '../../shared/types/RemoteFunction.ts'
-import type { StandardSchemaV1 } from '../../shared/types/StandardSchemaV1.ts'
-import type { StreamPolicy } from '../../shared/types/StreamPolicy.ts'
-import { requestContext } from '../runtime/requestContext.ts'
-import { parseArgs } from './parseArgs.ts'
-import { registerRpc } from './registerRpc.ts'
-import { runWithRpcTimeout } from './runWithRpcTimeout.ts'
-import type { RemoteHandler } from './types/RemoteHandler.ts'
-import { validationError } from './validationError.ts'
-
-/*
-Stash for the per-request AbortController a timed rpc composes into the
-inbound signal — read back in invoke's deadline callback to fire it. Lives on
-the scope's Request (one rpc per .fetch — network or in-process dispatch) so
-an SSR pass's many in-process cache reads, which call invoke() directly and
-never reach parseArgsForFetch, can't cross-cancel.
-*/
-const RPC_TIMEOUT_ABORT = Symbol('abideRpcTimeoutAbort')
-
-/* Rpc dispatch + validation spans, opt-in via DEBUG=abide:rpc. Reveals an
-   in-process RPC→RPC call (same request scope, same trace) as a nested span. */
-const rpcLog = abideLog.channel('abide:rpc')
-
-/*
-Builds a RemoteFunction from an HTTP method + RPC URL + handler. The bundler
-rewrites every `export const METHOD = handler(fn)` inside an `$rpc/**` module
-so the rpc (from the export name) and the URL (from the file path under
-`src/server/rpc/`, with `/rpc/` prefix) are threaded into defineRpc.
-
-The plain call (`fn(args)`) resolves to the Content-Type-decoded body;
-non-2xx responses throw HttpError. `.raw(args)` returns the underlying
-Response for callers that need status/headers/body streaming.
-`.fetch(req)` is the dispatch hook the framework's router uses to
-invoke the handler from an incoming HTTP request (with args parsed off
-the Request via parseArgs).
-
-Every raw invocation records the synthesized Request against the returned
-promise so cache() can stash it on the entry without re-building.
-*/
-// @documentation plumbing
-export function defineRpc<Args, Return>(
-    method: HttpMethod,
-    url: string,
-    handler: RemoteHandler<Args, Return>,
-    opts?: {
-        /* Namespaced schemas (ADR-0020): `input` types + validates args, `output` is the
-           success-body schema (OpenAPI/MCP), `files` validates multipart File parts. */
-        schemas?: {
-            input?: StandardSchemaV1
-            output?: StandardSchemaV1
-            files?: StandardSchemaV1
-        }
-        /* Surface-exposure flags (browser/mcp/cli) — which surfaces advertise this rpc. */
-        clients?: Partial<ClientFlags>
-        crossOrigin?: boolean
-        /* Per-rpc cap on actual received body bytes (413 past it); omitted = Bun's server-wide maxRequestBodySize. */
-        maxBodySize?: number
-        /* Per-rpc handler deadline (ms): a 504 once exceeded, on every surface (SSR/MCP/CLI/network). */
-        timeout?: number
-        /* Handler returns jsonl()/sse(): the bare call returns the NamedAsyncIterable directly (for
-           isomorphic `for await (… of fn(args))` in server code). Bundler-stamped; the router's
-           wire path (.fetch) is unaffected. */
-        streaming?: boolean
-        /* Numeric/boolean input fields → parseArgs coerces a string query/form value into the
-           typed value the input schema expects (ADR-0028). Bundler-stamped from the endpoint's
-           `Args` type; absent on the fail-open path (a GET field then stays a string as before). */
-        coerce?: InputCoercion
-        /* The handler's input args projected to JSON Schema (ADR-0030 input side). Bundler-stamped
-           from the endpoint's input-parameter type; feeds the OpenAPI parameters/body / MCP inputSchema
-           / inspector input surface when no `schemas.input` validator is declared (which still
-           overrides it), and makes the endpoint advertisable to MCP/CLI. A SHAPE description only —
-           never runtime-validated, so it can't produce a 422. Absent on the fail-open path — the
-           surface then omits the input schema exactly as before. */
-        inputJsonSchema?: Record<string, unknown>
-        /* The handler's return type projected to JSON Schema (ADR-0030 D2). Bundler-stamped from the
-           endpoint's success-body type; feeds the OpenAPI 200 / MCP outputSchema / inspector surface
-           when no `schemas.output` validator is declared (which still overrides it). Absent on the
-           fail-open path — the surface then omits the response schema exactly as before. */
-        outputJsonSchema?: Record<string, unknown>
-        /* The handler's typed-error branches as a status-keyed JSON-Schema map (ADR-0030). Bundler-
-           stamped from the endpoint's `error.typed(...)` return branches; feeds the OpenAPI
-           `responses[status]` surface so each typed error's status + data payload is documented
-           alongside the 200. Absent on the fail-open path — the surface then omits the error
-           responses exactly as before. */
-        errorJsonSchemas?: ErrorJsonSchemas
-        /* Endpoint cache policy (ADR-0020) — any method (a mutating rpc may cache too);
-           readThrough's bottom layer. */
-        cache?: CachePolicy<Args>
-        /* Endpoint stream policy (ADR-0020) — streaming read helpers only; replay depth `n`. */
-        stream?: StreamPolicy
-    },
-): RemoteFunction<Args, Return> {
-    const timeout = opts?.timeout
-    const inputSchema = opts?.schemas?.input
-    const inputJsonSchema = opts?.inputJsonSchema
-    const outputSchema = opts?.schemas?.output
-    const filesSchema = opts?.schemas?.files
-    /*
-    An input schema makes the handler safe to advertise to non-browser
-    surfaces. CLI flips on for any rpc with one (a human/script invokes it
-    deliberately). MCP only auto-exposes read-only rpcs (GET/HEAD) — a
-    model shouldn't be able to mutate/delete just because the handler
-    carries a schema, so mutating rpcs require an explicit clients.mcp.
-    Explicit `clients` always wins.
-
-    A build-projected `inputJsonSchema` (ADR-0030 input side — the handler's
-    input parameter type projected to JSON Schema, present only when the type
-    resolved cleanly) counts as a machine-advertisable contract too, so a
-    plainly-typed handler auto-exposes without a hand-written `schemas.input`.
-    This is SHAPE-only: the projection describes the input, it is NEVER run as
-    runtime validation (no 422) — declaring `schemas.input` is still what adds
-    the runtime narrowing.
-    */
-    const hasSchema = inputSchema !== undefined || inputJsonSchema !== undefined
-    const clients = resolveClientFlags(opts?.clients, {
-        mcp: hasSchema && isReadOnlyMethod(method),
-        cli: hasSchema,
-    })
-
-    function buildRequest(args: Args | undefined): Request {
-        const store = requestContext.getStore()
-        const baseUrl = store ? store.url.href : 'http://localhost/'
-        /* The forwarded allowlist is request-invariant — derive it once per scope
-           and clone per call (buildRpcRequest mutates the Headers). */
-        let headers: Headers
-        if (store) {
-            store.forwardedHeaders ??= forwardHeaders(store.req.headers)
-            headers = new Headers(store.forwardedHeaders)
-        } else {
-            headers = new Headers()
-        }
-        return buildRpcRequest({ method, url, args, baseUrl, headers })
-    }
-
-    /*
-    Handler bodies may throw synchronously (e.g. an `assert(...)` at the
-    top of the function). The `async function` wrapper coerces both sync
-    throws and returned non-promises into the Promise<Response> shape
-    callers expect, so an SSR caller's `await` always sees the rejection
-    through the cache layer's snapshot boundary instead of the error
-    escaping the request scope.
-    */
-    async function runHandler(args: Args | undefined): Promise<Response> {
-        return rpcLog.trace(
-            `rpc ${method} ${url}`,
-            () => handler(args as Args) as unknown as Response,
-        )
-    }
-
-    /*
-    Validates the parsed args against inputSchema (text fields), then — when the
-    rpc declares filesSchema — validates the File parts parseArgs split onto
-    the request store and merges them into the args bag the handler receives.
-    Either schema's issues become a 422. Files stay out of inputSchema so its
-    JSON-Schema projection (OpenAPI/MCP/CLI) never has to model a binary.
-    */
-    async function validateThenHandle(args: Args | undefined): Promise<Response> {
-        let value: unknown = args
-        if (inputSchema) {
-            const result = await rpcLog.trace(`validate ${url}`, () =>
-                inputSchema['~standard'].validate(value),
-            )
-            if (result.issues) {
-                return validationError(result.issues)
-            }
-            value = result.value
-        }
-        if (filesSchema) {
-            const files = requestContext.getStore()?.files ?? {}
-            const result = await filesSchema['~standard'].validate(files)
-            if (result.issues) {
-                return validationError(result.issues)
-            }
-            value = { ...(value as object), ...(result.value as object) }
-        }
-        return runHandler(value as Args)
-    }
-
-    /*
-    `getRequest` is unused on the server path — handlers receive parsed
-    `args` directly and reach the inbound Request via `request()`.
-    createRemoteFunction passes a thunk so the client side can lazily
-    synthesize its Request without forcing the server to allocate one per
-    SSR call.
-    */
-    /* Abort the controller parseArgsForFetch stashed on store.req; a no-op when none was stashed (SSR cache reads). */
-    function abortRpcTimeout(): void {
-        const req = requestContext.getStore()?.req as
-            | (Request & { [RPC_TIMEOUT_ABORT]?: AbortController })
-            | undefined
-        req?.[RPC_TIMEOUT_ABORT]?.abort(new DOMException('handler timeout', 'TimeoutError'))
-    }
-
-    function invoke(args: Args | undefined): Promise<Response> {
-        const work = inputSchema || filesSchema ? validateThenHandle(args) : runHandler(args)
-        if (timeout === undefined) {
-            return work
-        }
-        /*
-        On the deadline, fire the controller parseArgsForFetch composed into
-        request().signal (absent on the SSR cache-read path, so a sibling
-        rpc's outbound fetch is never cancelled) — then 504.
-        */
-        return runWithRpcTimeout(work, timeout, abortRpcTimeout)
-    }
-
-    const remote = createRemoteFunction<Args, Return>({
-        method,
-        url,
-        clients,
-        streaming: opts?.streaming ?? false,
-        crossOrigin: opts?.crossOrigin,
-        cache: opts?.cache,
-        stream: opts?.stream,
-        buildRequest,
-        invoke,
-        parseArgsForFetch: async (request) => {
-            const args = await parseArgs(method, request, opts?.maxBodySize, opts?.coerce)
-            /*
-            Compose this rpc's deadline into request().signal so a handler's
-            fetch(ext, { signal: request().signal }) is cancelled when the
-            timeout fires — not just abandoned. Applied after parseArgs onto the
-            scope's *final* request: a maxBodySize rpc swaps store.req for a
-            buffered copy (readBodyWithinLimit) and an app.handle hook may
-            rewrite it, so composing onto the inbound `request` would leave
-            request() — and abortRpcTimeout, which reads store.req — pointed at
-            an un-cancellable signal. Only the signal is shadowed; the body
-            stays readable. The store always exists here (network + in-process
-            dispatch both run inside runWithRequestScope); SSR cache reads call
-            invoke() directly, never this path, so a sibling rpc is never
-            cross-cancelled.
-            */
-            if (timeout !== undefined) {
-                const req = requestContext.getStore()?.req
-                if (req) {
-                    const controller = new AbortController()
-                    const composed = AbortSignal.any([req.signal, controller.signal])
-                    Object.defineProperty(req, 'signal', { value: composed, configurable: true })
-                    Object.defineProperty(req, RPC_TIMEOUT_ABORT, {
-                        value: controller,
-                        configurable: true,
-                    })
-                }
-            }
-            return args as Args | undefined
-        },
-    })
-    registerRpc({
-        remote: remote as RemoteFunction<unknown, unknown>,
-        inputSchema,
-        inputJsonSchema,
-        outputSchema,
-        outputJsonSchema: opts?.outputJsonSchema,
-        errorJsonSchemas: opts?.errorJsonSchemas,
-        filesSchema,
-        timeout,
-        maxBodySize: opts?.maxBodySize,
-    })
-    return remote
-}

package/src/lib/server/rpc/dispatchRpcInProcess.ts

@@ -1,46 +0,0 @@
-import { buildRpcRequest } from '../../shared/buildRpcRequest.ts'
-import type { RemoteFunction } from '../../shared/types/RemoteFunction.ts'
-import type { AppModule } from '../AppModule.ts'
-import { runWithRequestScope } from '../runtime/runWithRequestScope.ts'
-
-/*
-Runs a rpc in-process: synthesizes the rpc Request from the remote's own
-method + url and pipes it through remote.fetch — the same handler/validation/
-error path the HTTP router uses, no network hop. The single in-process
-dispatch every consumer surface (the CLI client and the MCP tool dispatcher)
-routes through, so they can't drift on how a rpc is invoked.
-Takes the RemoteFunction directly — invocation never reads the registry
-entry's schemas/clients (validation is closed over inside the remote), so the
-entry is not a dependency here. `baseUrl` gives the synthetic Request its
-origin (handlers reading request.url see the caller's host); `headers` carries
-forwarded auth/identity context.
-
-Runs inside the runWithRequestScope seam createServer crosses for real
-requests, so a handler sees an identical scope to a live HTTP request: a fresh
-per-request cache, the cookie jar with Set-Cookie flush, request()/server()
-resolution, and the app's handleError (or the 500 fallback) on a throw. The
-synthesized Request is shared between the scope store and the handler fetch so
-request() returns the same Request parseArgs read from.
-*/
-export function dispatchRpcInProcess({
-    remote,
-    args,
-    baseUrl,
-    headers,
-    app,
-}: {
-    remote: RemoteFunction<unknown, unknown>
-    args: unknown
-    baseUrl: string
-    headers?: Headers
-    app?: AppModule
-}): Promise<Response> {
-    const request = buildRpcRequest({
-        method: remote.method,
-        url: remote.url,
-        args,
-        baseUrl,
-        headers,
-    })
-    return runWithRequestScope(request, { app, logRequests: false }, () => remote.fetch(request))
-}

package/src/lib/server/rpc/findRpcByCommandName.ts

@@ -1,18 +0,0 @@
-import { commandNameForUrl } from '../../shared/commandNameForUrl.ts'
-import { rpcRegistry } from './rpcRegistry.ts'
-import type { RpcRegistryEntry } from './types/RpcRegistryEntry.ts'
-
-/*
-Finds the registered rpc whose URL maps to a given command name (folder
-segments joined with `-`, per commandNameForUrl). The CLI client proxy and
-the MCP tool dispatcher both key off this name, so the scan lives here once
-rather than being re-implemented — and reused — at each call site.
-*/
-export function findRpcByCommandName(name: string): RpcRegistryEntry | undefined {
-    for (const entry of rpcRegistry.values()) {
-        if (commandNameForUrl(entry.remote.url) === name) {
-            return entry
-        }
-    }
-    return undefined
-}

package/src/lib/server/rpc/parseArgs.ts

@@ -1,244 +0,0 @@
-import { carriesBodyArgs } from '../../shared/carriesBodyArgs.ts'
-import { contentTypeOf } from '../../shared/contentTypeOf.ts'
-import { decodeWireBody } from '../../shared/decodeWireBody.ts'
-import { HttpError } from '../../shared/HttpError.ts'
-import { REF_JSON_HEADER } from '../../shared/REF_JSON_HEADER.ts'
-import { reviveWireField } from '../../shared/reviveWireField.ts'
-import type { HttpMethod } from '../../shared/types/HttpMethod.ts'
-import type { InputCoercion } from '../../shared/types/InputCoercion.ts'
-import type { WireKind } from '../../shared/types/WireKind.ts'
-import { error } from '../error.ts'
-import { requestContext } from '../runtime/requestContext.ts'
-import { readBodyWithinLimit } from './readBodyWithinLimit.ts'
-
-/*
-Splits a parsed FormData into the text fields that become args and the File
-parts that don't. Repeated text keys collapse into an array (an HTML form posts
-multiple same-named inputs); File parts group by field name and stash on the
-request store for files() to read — they never enter args, so the input schema
-keeps validating a plain object with no binary in it.
-*/
-function splitFormData(form: FormData): Record<string, unknown> {
-    const fileMap: Record<string, File[]> = {}
-    const fields: Record<string, unknown> = {}
-    for (const [key, value] of form) {
-        if (value instanceof File) {
-            fileMap[key] ??= []
-            fileMap[key].push(value)
-            continue
-        }
-        const existing = fields[key]
-        if (!(key in fields)) {
-            fields[key] = value
-        } else if (Array.isArray(existing)) {
-            existing.push(value)
-        } else {
-            fields[key] = [existing, value]
-        }
-    }
-    const store = requestContext.getStore()
-    if (store && Object.keys(fileMap).length > 0) {
-        store.files = fileMap
-    }
-    return fields
-}
-
-/*
-Parses + merges every source of args available for a rpc-defined handler:
-- body (json or form-encoded, ignored for GET/DELETE/HEAD)
-- url query string
-
-When both are present and the body is a plain object, the merge layers the
-body on top of the query so the typed body wins on collision — the query
-supplies defaults a body field can override, and a URL param can't silently
-shadow a validated body value. A non-object body (array, primitive, null)
-skips the merge entirely and is returned as-is — there's no key on the body
-to layer the query into, and the framework's args type is a single bag rather
-than a `{body, query}` envelope. Returns undefined when no source contributes
-any key.
-
-`maxBodySize` (per-rpc, opt-in) bounds the body's actual received bytes
-before any parse — see readBodyWithinLimit. Omitted = no abide-level check;
-Bun.serve's server-wide maxRequestBodySize is the ceiling.
-*/
-export async function parseArgs(
-    method: HttpMethod,
-    request: Request,
-    maxBodySize?: number,
-    coerce?: InputCoercion,
-): Promise<unknown> {
-    /*
-    Skip the URL parse entirely when the raw request URL has no query —
-    typical POST/PUT/PATCH calls land here with a flat rpc URL and no
-    `?…`, so the `new URL(...)` constructor cost (which dwarfs the
-    indexOf check) is wasted work.
-    */
-    const queryStart = request.url.indexOf('?')
-    const hasQuery = queryStart !== -1
-    const url = hasQuery ? new URL(request.url) : undefined
-
-    let body: unknown
-    if (carriesBodyArgs(method)) {
-        let bounded = request
-        if (maxBodySize !== undefined) {
-            bounded = await readBodyWithinLimit(request, maxBodySize)
-            /*
-            The size check drained the original body, so point the scope's
-            request at the readable copy — a handler with a content-type this
-            parse skips (raw uploads) reads the body via request() itself, and
-            it must see the bytes, not 'Body already used'.
-            */
-            const store = requestContext.getStore()
-            if (store) {
-                store.req = bounded
-            }
-        }
-        const contentType = contentTypeOf(bounded.headers)
-        try {
-            if (contentType.includes('application/json')) {
-                const text = await bounded.text()
-                if (text !== '') {
-                    /* abide's own client flags ref-json with REF_JSON_HEADER (restores
-                       cycles/shared refs JSON can't carry); a non-abide client (curl, an
-                       OpenAPI SDK) omits it and sends ordinary JSON — read with plain
-                       JSON.parse, since the ref-json envelope is ambiguous with a 2-element
-                       array body. */
-                    body = decodeWireBody(text, bounded.headers.has(REF_JSON_HEADER))
-                }
-            } else if (
-                contentType.includes('application/x-www-form-urlencoded') ||
-                contentType.includes('multipart/form-data')
-            ) {
-                body = splitFormData(await bounded.formData())
-            }
-        } catch {
-            /* A malformed body is the client's fault — surface a 400, not the 500 a
-               raw JSON.parse/formData throw would bubble to. createRemoteFunction.fetch
-               unwraps the HttpError's response onto the wire (as it does for the 413). */
-            throw new HttpError(error(400, 'Malformed request body'))
-        }
-    }
-
-    if (body !== undefined && (typeof body !== 'object' || body === null || Array.isArray(body))) {
-        return body
-    }
-
-    if (!url) {
-        /* `body` is undefined or a plain object here. A form-encoded body arrives stringly, so
-           coerce its numeric/boolean fields (a JSON body's values are already typed — non-strings
-           the coercion leaves untouched). */
-        if (body !== undefined && coerce !== undefined) {
-            applyCoercion(body as Record<string, unknown>, coerce)
-        }
-        return body
-    }
-
-    /*
-    Query params (and form-encoded body fields) arrive as strings, so a numeric/boolean field
-    would reach schema validation as `'2'`/`'true'`. `coerce` (ADR-0028) is the build-time plan
-    of exactly which fields are numeric/boolean in the endpoint's `Args` type — resolved through
-    the warm server program, so a string-typed field that merely looks numeric (an id, a zip code,
-    `'1.0'`) is never listed and stays a string. Applied to the merged bag below; a JSON body's
-    already-typed values are non-strings the coercion skips.
-    */
-    const bodyObject = (body ?? {}) as Record<string, unknown>
-    /* Collect the query into an object, arraying repeated keys (`?tag=a&tag=b` → `['a','b']`)
-       rather than letting `Object.fromEntries` silently keep only the last — mirrors
-       splitFormData, so a repeated field reaches the schema as an array, not a dropped value. */
-    const queryObject: Record<string, unknown> = {}
-    for (const [key, value] of url.searchParams) {
-        const existing = queryObject[key]
-        if (!(key in queryObject)) {
-            queryObject[key] = value
-        } else if (Array.isArray(existing)) {
-            existing.push(value)
-        } else {
-            queryObject[key] = [existing, value]
-        }
-    }
-    const merged = { ...queryObject, ...bodyObject }
-    if (Object.keys(merged).length === 0) {
-        return undefined
-    }
-    if (coerce !== undefined) {
-        applyCoercion(merged, coerce)
-    }
-    return merged
-}
-
-/*
-Revives the plain-JSON wire values in `args` into the runtime types the plan declares, in place
-(ADR-0028 scalars, ADR-0029 structured). The scalar kinds (number/boolean/date/bigint) touch
-strings only — a value the merge layered in from a typed JSON body is already the right type and
-left alone; a repeated key (`?tag=1&tag=2`) is an array whose string members revive per element.
-The container kinds (set/map) build from a JSON array (or object) but pass an already-typed value
-(from the abide client's ref-json body) through untouched. Every branch is fail-open: an
-unrevivable value stays its JSON form so the schema surfaces an honest issue rather than a throw.
-*/
-function applyCoercion(args: Record<string, unknown>, coerce: InputCoercion): void {
-    for (const key in coerce) {
-        const kind = coerce[key]
-        if (kind === undefined || !(key in args)) {
-            continue
-        }
-        args[key] = reviveValue(args[key], kind)
-    }
-}
-
-/* One field's wire value → its runtime type per `kind`, fail-open. The container kinds wrap a JSON
-   array/object; the scalar kinds revive a string (or each string in a repeated-key array). An
-   already-typed value (Set/Map/Date/bigint from the abide ref-json body) passes through. */
-function reviveValue(value: unknown, kind: WireKind): unknown {
-    /* Container kinds (set/map) decode through the shared wire codec; the input side additionally
-       accepts a plain object as Map entries — a query/form body can't send a JSON entries array
-       (ADR-0029 defers descending into array MEMBERS). */
-    if (kind === 'set' || kind === 'map') {
-        if (
-            kind === 'map' &&
-            !(value instanceof Map) &&
-            !Array.isArray(value) &&
-            value !== null &&
-            typeof value === 'object'
-        ) {
-            return new Map(Object.entries(value))
-        }
-        return reviveWireField(value, kind)
-    }
-    /* Scalar kinds (number/boolean/date/bigint): query/form values arrive as strings — a lone
-       value, or each string in a repeated-key array. */
-    if (typeof value === 'string') {
-        return reviveScalar(value, kind)
-    }
-    if (Array.isArray(value)) {
-        return value.map((element) =>
-            typeof element === 'string' ? reviveScalar(element, kind) : element,
-        )
-    }
-    return value
-}
-
-/* One string → its number/boolean/date/bigint value, or the original string when it doesn't parse
-   cleanly (empty/whitespace, `NaN`, a non-`true`/`false` boolean, an unparseable date, a
-   non-integer bigint), so a bad value fails validation with the field intact instead of coercing
-   to `0`/`NaN`/`Invalid Date`. */
-function reviveScalar(value: string, kind: WireKind): unknown {
-    if (kind === 'number') {
-        if (value.trim() === '') {
-            return value
-        }
-        const parsed = Number(value)
-        return Number.isNaN(parsed) ? value : parsed
-    }
-    if (kind === 'boolean') {
-        if (value === 'true') {
-            return true
-        }
-        if (value === 'false') {
-            return false
-        }
-        return value
-    }
-    /* date/bigint from a query/form string decode identically to the shared wire codec (ISO
-       string → Date, digit string → bigint), fail-open. */
-    return reviveWireField(value, kind)
-}

package/src/lib/server/rpc/readBodyWithinLimit.ts

@@ -1,47 +0,0 @@
-import { HttpError } from '../../shared/HttpError.ts'
-import { error } from '../error.ts'
-
-/*
-Enforces a rpc's maxBodySize on the actual received bytes, not the
-Content-Length header (absent on chunked bodies, trivially spoofed). A
-declared Content-Length over the limit rejects before reading anything;
-otherwise the body streams into a buffer that throws 413 the moment the
-limit is crossed — aborting the read, so the remaining bytes are never
-consumed. Returns a reassembled Request carrying the buffered body and the
-original headers, so the parse path's .text()/.formData() work unchanged.
-Only called when the rpc declares maxBodySize; the default ceiling is
-Bun.serve's server-wide maxRequestBodySize, which Bun enforces natively.
-*/
-export async function readBodyWithinLimit(request: Request, maxBytes: number): Promise<Request> {
-    const tooLarge = () =>
-        new HttpError(error(413, `request body exceeds maxBodySize (${maxBytes} bytes)`))
-    const declared = Number(request.headers.get('content-length') ?? Number.NaN)
-    if (Number.isFinite(declared) && declared > maxBytes) {
-        throw tooLarge()
-    }
-    if (!request.body) {
-        return request
-    }
-    const chunks: Uint8Array[] = []
-    let total = 0
-    for await (const chunk of request.body) {
-        total += chunk.byteLength
-        if (total > maxBytes) {
-            throw tooLarge()
-        }
-        chunks.push(chunk)
-    }
-    const buffered = new Uint8Array(total)
-    chunks.reduce((offset, chunk) => {
-        buffered.set(chunk, offset)
-        return offset + chunk.byteLength
-    }, 0)
-    return new Request(request.url, {
-        method: request.method,
-        headers: request.headers,
-        body: buffered,
-        /* Carry the inbound signal forward so a handler reading `request().signal` still
-           aborts on client disconnect — a fresh Request would otherwise drop it. */
-        signal: request.signal,
-    })
-}

package/src/lib/server/rpc/registerRpc.ts

@@ -1,6 +0,0 @@
-import { rpcRegistry } from './rpcRegistry.ts'
-import type { RpcRegistryEntry } from './types/RpcRegistryEntry.ts'
-
-export function registerRpc(entry: RpcRegistryEntry): void {
-    rpcRegistry.set(entry.remote.url, entry)
-}

package/src/lib/server/rpc/resolveRpcJsonSchema.ts

@@ -1,28 +0,0 @@
-import { jsonSchemaForSchema } from '../../shared/jsonSchemaForSchema.ts'
-import type { RpcRegistryEntry } from './types/RpcRegistryEntry.ts'
-
-/*
-The ONE resolution every surface (MCP tools, OpenAPI, the inspector catalog, and the
-standalone CLI manifest) uses for an rpc's advertised INPUT shape: a declared
-`inputSchema` VALIDATOR overrides the build-projected `inputJsonSchema` (ADR-0030 input
-side); with neither, `undefined`. Callers that need a non-empty schema apply the opaque
-`?? jsonSchemaForSchema(undefined)` fallback themselves (MCP/OpenAPI/CLI want it; the
-inspector leaves it undefined). One origin so the surfaces can't drift — the CLI manifest
-emitter previously read only `inputSchema` and silently dropped every plainly-typed
-handler's projected shape (no typed flags, no `--help`, array flags overwriting).
-*/
-export function resolveInputJsonSchema(
-    entry: RpcRegistryEntry,
-): Record<string, unknown> | undefined {
-    return entry.inputSchema ? jsonSchemaForSchema(entry.inputSchema) : entry.inputJsonSchema
-}
-
-/*
-The output analog: an `outputSchema` VALIDATOR overrides the projected `outputJsonSchema`;
-with neither, `undefined` (no output shape advertised — every surface leaves it off).
-*/
-export function resolveOutputJsonSchema(
-    entry: RpcRegistryEntry,
-): Record<string, unknown> | undefined {
-    return entry.outputSchema ? jsonSchemaForSchema(entry.outputSchema) : entry.outputJsonSchema
-}