@adobe/data-rpc 0.10.11

package/dist/transports/loopback-transport.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/transports/loopback-transport.test.js

@@ -0,0 +1,42 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+import { describe, it, expect, vi } from "vitest";
+import { createRpcLoopbackTransport } from "./loopback-transport.js";
+const msg = (protocol) => ({ kind: "hello", protocol });
+describe("createRpcLoopbackTransport", () => {
+    it("delivers asynchronously (never synchronously with send)", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        const received = [];
+        b.onMessage((m) => received.push(m));
+        a.send(msg(1));
+        expect(received).toEqual([]); // not yet — delivery is scheduled
+        await new Promise((r) => setTimeout(r, 0));
+        expect(received).toEqual([msg(1)]);
+    });
+    it("buffers messages sent before a listener registers, in order", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        a.send(msg(1));
+        a.send(msg(2));
+        const received = [];
+        b.onMessage((m) => received.push(m));
+        await new Promise((r) => setTimeout(r, 0));
+        expect(received).toEqual([msg(1), msg(2)]);
+    });
+    it("fires every onClose listener once when either side closes", async () => {
+        const { a, b } = createRpcLoopbackTransport();
+        const onCloseA = vi.fn();
+        const onCloseB = vi.fn();
+        a.onClose(onCloseA);
+        b.onClose(onCloseB);
+        b.close();
+        expect(onCloseA).toHaveBeenCalledOnce();
+        expect(onCloseB).toHaveBeenCalledOnce();
+        a.close(); // idempotent — no second fire
+        expect(onCloseA).toHaveBeenCalledOnce();
+    });
+    it("throws on a non-cloneable payload, like a real port", () => {
+        const { a } = createRpcLoopbackTransport();
+        // A function is not structured-cloneable; sending one must throw here too.
+        expect(() => a.send({ kind: "next", id: 1, value: (() => 0) })).toThrow();
+    });
+});
+//# sourceMappingURL=loopback-transport.test.js.map

package/dist/transports/loopback-transport.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-transport.test.js","sourceRoot":"","sources":["../../src/transports/loopback-transport.test.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAEvD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAElD,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAErE,MAAM,GAAG,GAAG,CAAC,QAAgB,EAAc,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AAE5E,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,0BAA0B,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAClC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,kCAAkC;QAChE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,0BAA0B,EAAE,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAClC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,0BAA0B,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC,CAAC,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACxC,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,EAAE,CAAC;QACxC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,8BAA8B;QACzC,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC3D,MAAM,EAAE,CAAC,EAAE,GAAG,0BAA0B,EAAE,CAAC;QAC3C,2EAA2E;QAC3E,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAU,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACvF,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/transports/message-port-transport.d.ts

@@ -0,0 +1,14 @@
+import type { RpcTransport } from "../transport.js";
+/**
+ * The primary iframe/worker transport: an {@link RpcTransport} over a
+ * `MessagePort`. Assigning `onmessage` implicitly starts the port; we also call
+ * `start()` explicitly so the transport is robust if the caller later switches
+ * to `addEventListener`. Messages arriving before a listener registers are
+ * buffered and flushed on the first `onMessage`, mirroring the loopback and
+ * matching the fact that the port begins delivering as soon as it is wired.
+ *
+ * A `MessagePort` has no native "remote closed" event, so `onClose` fires only
+ * on a local `close()`; a peer going away is surfaced instead via the
+ * `unavailable` announcement (or a per-call timeout).
+ */
+export declare function createMessagePortTransport(port: MessagePort): RpcTransport;

package/dist/transports/message-port-transport.js

@@ -0,0 +1,63 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+/**
+ * The primary iframe/worker transport: an {@link RpcTransport} over a
+ * `MessagePort`. Assigning `onmessage` implicitly starts the port; we also call
+ * `start()` explicitly so the transport is robust if the caller later switches
+ * to `addEventListener`. Messages arriving before a listener registers are
+ * buffered and flushed on the first `onMessage`, mirroring the loopback and
+ * matching the fact that the port begins delivering as soon as it is wired.
+ *
+ * A `MessagePort` has no native "remote closed" event, so `onClose` fires only
+ * on a local `close()`; a peer going away is surfaced instead via the
+ * `unavailable` announcement (or a per-call timeout).
+ */
+export function createMessagePortTransport(port) {
+    const listeners = new Set();
+    const closeListeners = new Set();
+    const pending = [];
+    let closed = false;
+    port.onmessage = (event) => {
+        // Invariant: only RpcMessages are posted on a data-rpc port.
+        const msg = event.data;
+        if (listeners.size === 0) {
+            pending.push(msg);
+            return;
+        }
+        for (const l of listeners)
+            l(msg);
+    };
+    port.start();
+    return {
+        send(msg, transfer) {
+            if (closed)
+                return;
+            port.postMessage(msg, transfer ? [...transfer] : []);
+        },
+        onMessage(listener) {
+            listeners.add(listener);
+            for (const msg of pending.splice(0))
+                listener(msg);
+            return () => listeners.delete(listener);
+        },
+        onClose(listener) {
+            if (closed) {
+                listener();
+                return () => undefined;
+            }
+            closeListeners.add(listener);
+            return () => closeListeners.delete(listener);
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            port.onmessage = null;
+            port.close();
+            for (const l of closeListeners)
+                l();
+            closeListeners.clear();
+            listeners.clear();
+        },
+    };
+}
+//# sourceMappingURL=message-port-transport.js.map

package/dist/transports/message-port-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-port-transport.js","sourceRoot":"","sources":["../../src/transports/message-port-transport.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAKvD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAiB;IACxD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAc,CAAC;IAC7C,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,IAAI,CAAC,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;QACrC,6DAA6D;QAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAkB,CAAC;QACrC,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;IAEb,OAAO;QACH,IAAI,CAAC,GAAG,EAAE,QAAQ;YACd,IAAI,MAAM;gBAAE,OAAO;YACnB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,SAAS,CAAC,QAAQ;YACd,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnD,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,QAAQ;YACZ,IAAI,MAAM,EAAE,CAAC;gBACT,QAAQ,EAAE,CAAC;gBACX,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;YAC3B,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,KAAK;YACD,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,KAAK,MAAM,CAAC,IAAI,cAAc;gBAAE,CAAC,EAAE,CAAC;YACpC,cAAc,CAAC,KAAK,EAAE,CAAC;YACvB,SAAS,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/transports/message-port-transport.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/transports/message-port-transport.test.js

@@ -0,0 +1,49 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+import { describe, it, expect } from "vitest";
+import { Observe } from "@adobe/data/observe";
+import { createRpcEndpoint } from "../create-endpoint.js";
+import { createMessagePortTransport } from "./message-port-transport.js";
+const calcSchema = {
+    type: "object",
+    properties: {
+        value: { type: "observe", value: { type: "number" } },
+        add: { type: "function", signature: { parameters: [{ type: "number" }, { type: "number" }], returns: { type: "promise", value: { type: "number" } } } },
+    },
+    required: ["value", "add"],
+    additionalProperties: false,
+};
+function makeCalc() {
+    return {
+        serviceName: "calc",
+        schema: Observe.fromConstant(calcSchema),
+        value: Observe.fromConstant(1),
+        add: async (a, b) => a + b,
+    };
+}
+describe("createMessagePortTransport", () => {
+    it("carries a full RPC round-trip over a MessageChannel", async () => {
+        const { port1, port2 } = new MessageChannel();
+        const ea = createRpcEndpoint(createMessagePortTransport(port1));
+        const eb = createRpcEndpoint(createMessagePortTransport(port2));
+        ea.expose("calc", makeCalc(), calcSchema);
+        const remote = eb.consume("calc", calcSchema);
+        expect(await remote.add(2, 40)).toBe(42);
+        ea.close();
+        eb.close();
+    });
+    it("buffers messages that arrive before a listener registers, then flushes them", async () => {
+        const { port1, port2 } = new MessageChannel();
+        // Send on port1 before wrapping port2 with a transport/listener.
+        port1.postMessage({ kind: "hello", protocol: 1 });
+        const transport = createMessagePortTransport(port2);
+        // Give the port a tick to receive-and-buffer the pre-listener message.
+        await new Promise((r) => setTimeout(r, 0));
+        const received = [];
+        transport.onMessage((m) => received.push(m));
+        await new Promise((r) => setTimeout(r, 0));
+        expect(received).toEqual([{ kind: "hello", protocol: 1 }]);
+        transport.close();
+        port1.close();
+    });
+});
+//# sourceMappingURL=message-port-transport.test.js.map

package/dist/transports/message-port-transport.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-port-transport.test.js","sourceRoot":"","sources":["../../src/transports/message-port-transport.test.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAEvD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAG9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAMzE,MAAM,UAAU,GAAG;IACf,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACR,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QACrD,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE;KAC1J;IACD,QAAQ,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;IAC1B,oBAAoB,EAAE,KAAK;CACJ,CAAC;AAE5B,SAAS,QAAQ;IACb,OAAO;QACH,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC;QACxC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QAC9B,GAAG,EAAE,KAAK,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC;KAC7C,CAAC;AACN,CAAC;AAED,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,iBAAiB,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,iBAAiB,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;QAChE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,EAAE,CAAC,KAAK,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,EAAE,CAAC;QAC9C,iEAAiE;QACjE,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAuB,CAAC,CAAC;QAEvE,MAAM,SAAS,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;QACpD,uEAAuE;QACvE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAE3C,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAClC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAE3C,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/transports/window-transport.d.ts

@@ -0,0 +1,20 @@
+import type { RpcTransport } from "../transport.js";
+/** Options for {@link createWindowTransport}. */
+export interface WindowTransportOptions {
+    /** Origins accepted on inbound `message` events; all others are dropped (v1 trust boundary). */
+    readonly allowedOrigins: readonly string[];
+    /**
+     * `targetOrigin` for outbound `postMessage`. Defaults to the sole
+     * `allowedOrigins` entry when there is exactly one, otherwise `"*"`.
+     * Specify explicitly whenever posting sensitive payloads.
+     */
+    readonly targetOrigin?: string;
+}
+/**
+ * An {@link RpcTransport} over `window.postMessage`, primarily for the initial
+ * `MessagePort` handoff between a page and its iframe (after which both sides
+ * switch to {@link createMessagePortTransport}). Inbound events are dropped
+ * unless their `origin` is allowlisted and the payload looks like an
+ * {@link RpcMessage}. Listens on the current global `window`; sends to `target`.
+ */
+export declare function createWindowTransport(target: Window, options: WindowTransportOptions): RpcTransport;

package/dist/transports/window-transport.js

@@ -0,0 +1,69 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+/**
+ * An {@link RpcTransport} over `window.postMessage`, primarily for the initial
+ * `MessagePort` handoff between a page and its iframe (after which both sides
+ * switch to {@link createMessagePortTransport}). Inbound events are dropped
+ * unless their `origin` is allowlisted and the payload looks like an
+ * {@link RpcMessage}. Listens on the current global `window`; sends to `target`.
+ */
+export function createWindowTransport(target, options) {
+    const listeners = new Set();
+    const closeListeners = new Set();
+    const pending = [];
+    let closed = false;
+    // Never default outbound to "*" — that would post (possibly sensitive) replies
+    // to whatever origin currently occupies the target frame. Require an explicit
+    // targetOrigin unless there is exactly one allowed origin to infer it from.
+    const targetOrigin = options.targetOrigin ?? (options.allowedOrigins.length === 1 ? options.allowedOrigins[0] : undefined);
+    if (targetOrigin === undefined) {
+        throw new Error("createWindowTransport: specify `targetOrigin` when `allowedOrigins` is not exactly one origin");
+    }
+    const handler = (event) => {
+        if (!options.allowedOrigins.includes(event.origin))
+            return; // untrusted origin
+        const data = event.data;
+        if (typeof data !== "object" || data === null || typeof data.kind !== "string") {
+            return; // not one of ours
+        }
+        const msg = data;
+        if (listeners.size === 0) {
+            pending.push(msg);
+            return;
+        }
+        for (const l of listeners)
+            l(msg);
+    };
+    window.addEventListener("message", handler);
+    return {
+        send(msg, transfer) {
+            if (closed)
+                return;
+            target.postMessage(msg, targetOrigin, transfer ? [...transfer] : []);
+        },
+        onMessage(listener) {
+            listeners.add(listener);
+            for (const msg of pending.splice(0))
+                listener(msg);
+            return () => listeners.delete(listener);
+        },
+        onClose(listener) {
+            if (closed) {
+                listener();
+                return () => undefined;
+            }
+            closeListeners.add(listener);
+            return () => closeListeners.delete(listener);
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            window.removeEventListener("message", handler);
+            for (const l of closeListeners)
+                l();
+            closeListeners.clear();
+            listeners.clear();
+        },
+    };
+}
+//# sourceMappingURL=window-transport.js.map

package/dist/transports/window-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"window-transport.js","sourceRoot":"","sources":["../../src/transports/window-transport.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAiBvD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,OAA+B;IACjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAc,CAAC;IAC7C,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,+EAA+E;IAC/E,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3H,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;IACrH,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,KAAmB,EAAE,EAAE;QACpC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,mBAAmB;QAC/E,MAAM,IAAI,GAAY,KAAK,CAAC,IAAI,CAAC;QACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAQ,IAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrG,OAAO,CAAC,kBAAkB;QAC9B,CAAC;QACD,MAAM,GAAG,GAAG,IAAkB,CAAC;QAC/B,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAE5C,OAAO;QACH,IAAI,CAAC,GAAG,EAAE,QAAQ;YACd,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,SAAS,CAAC,QAAQ;YACd,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnD,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,QAAQ;YACZ,IAAI,MAAM,EAAE,CAAC;gBACT,QAAQ,EAAE,CAAC;gBACX,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;YAC3B,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,KAAK;YACD,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC/C,KAAK,MAAM,CAAC,IAAI,cAAc;gBAAE,CAAC,EAAE,CAAC;YACpC,cAAc,CAAC,KAAK,EAAE,CAAC;YACvB,SAAS,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/transports/window-transport.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/transports/window-transport.test.js

@@ -0,0 +1,47 @@
+// © 2026 Adobe. MIT License. See /LICENSE for details.
+// @vitest-environment jsdom
+import { describe, it, expect } from "vitest";
+import { createWindowTransport } from "./window-transport.js";
+const hello = { kind: "hello", protocol: 1 };
+describe("createWindowTransport", () => {
+    it("delivers messages from an allowed origin", async () => {
+        const transport = createWindowTransport(window, { allowedOrigins: ["https://trusted.example"] });
+        const received = [];
+        transport.onMessage((m) => received.push(m));
+        window.dispatchEvent(new MessageEvent("message", { data: hello, origin: "https://trusted.example" }));
+        expect(received).toEqual([hello]);
+        transport.close();
+    });
+    it("drops messages from a disallowed origin", async () => {
+        const transport = createWindowTransport(window, { allowedOrigins: ["https://trusted.example"] });
+        const received = [];
+        transport.onMessage((m) => received.push(m));
+        window.dispatchEvent(new MessageEvent("message", { data: hello, origin: "https://evil.example" }));
+        expect(received).toEqual([]);
+        transport.close();
+    });
+    it("ignores non-RpcMessage payloads even from an allowed origin", async () => {
+        const transport = createWindowTransport(window, { allowedOrigins: ["https://trusted.example"] });
+        const received = [];
+        transport.onMessage((m) => received.push(m));
+        window.dispatchEvent(new MessageEvent("message", { data: "just a string", origin: "https://trusted.example" }));
+        window.dispatchEvent(new MessageEvent("message", { data: { foo: 1 }, origin: "https://trusted.example" }));
+        expect(received).toEqual([]);
+        transport.close();
+    });
+    it("requires an explicit targetOrigin when allowedOrigins is ambiguous (N1)", () => {
+        expect(() => createWindowTransport(window, { allowedOrigins: ["https://a.example", "https://b.example"] })).toThrow();
+        // A single allowed origin (or an explicit targetOrigin) is fine.
+        expect(() => createWindowTransport(window, { allowedOrigins: ["https://a.example"] })).not.toThrow();
+        expect(() => createWindowTransport(window, { allowedOrigins: ["https://a.example", "https://b.example"], targetOrigin: "https://a.example" })).not.toThrow();
+    });
+    it("stops delivering after close", async () => {
+        const transport = createWindowTransport(window, { allowedOrigins: ["https://trusted.example"] });
+        const received = [];
+        transport.onMessage((m) => received.push(m));
+        transport.close();
+        window.dispatchEvent(new MessageEvent("message", { data: hello, origin: "https://trusted.example" }));
+        expect(received).toEqual([]);
+    });
+});
+//# sourceMappingURL=window-transport.test.js.map

package/dist/transports/window-transport.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"window-transport.test.js","sourceRoot":"","sources":["../../src/transports/window-transport.test.ts"],"names":[],"mappings":"AAAA,uDAAuD;AAEvD,4BAA4B;AAE5B,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,KAAK,GAAe,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAEzD,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAClC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7C,MAAM,CAAC,aAAa,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;QACtG,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,SAAS,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAClC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7C,MAAM,CAAC,aAAa,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;QACnG,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,SAAS,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAClC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7C,MAAM,CAAC,aAAa,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;QAChH,MAAM,CAAC,aAAa,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;QAC3G,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,SAAS,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACtH,iEAAiE;QACjE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACrG,MAAM,CAAC,GAAG,EAAE,CACR,qBAAqB,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC,CACnI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAClC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,SAAS,CAAC,KAAK,EAAE,CAAC;QAElB,MAAM,CAAC,aAAa,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;QACtG,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@adobe/data-rpc",
+  "version": "0.10.11",
+  "description": "Schema-driven, bidirectional projection of @adobe/data async data services across a boundary (iframe / MessagePort / Worker). Only Data crosses the wire.",
+  "type": "module",
+  "sideEffects": false,
+  "private": false,
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@adobe/data": "0.10.11"
+  },
+  "devDependencies": {
+    "jsdom": "^24.1.0",
+    "typescript": "^5.8.3",
+    "vitest": "^1.6.0"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "scripts": {
+    "build": "cp ../../LICENSE . 2>/dev/null || true; tsc -b",
+    "clean": "rm -rf dist node_modules",
+    "dev": "tsc -b -w --preserveWatchOutput",
+    "test": "vitest --run",
+    "typecheck": "tsc -b"
+  }
+}