@thednp/rpc 0.0.1 → 0.0.4

package/dist/express/express.mjs

@@ -1,23 +1,41 @@
 import { scanForServerFiles, serverFunctionsMap } from "@thednp/rpc/server";
 //#region src/options.ts
 const defaultRPCOptions = {
-	rpcPreffix: "__rpc",
+	rpcPrefix: "__rpc",
 	adapter: "express"
 };
 const defaultMiddlewareOptions = {
-	rpcPreffix: void 0,
-	path: void 0
+	rpcPrefix: void 0,
+	path: void 0,
+	origin: void 0
 };
 //#endregion
 //#region src/express/helpers.ts
+/**
+* Convenience function to load RPC config and attach the RPC middleware to an Express app.
+* Dynamically imports loadRPCConfig and creates the middleware with loaded options.
+* @param app - Express application instance
+*/
 async function attachRPC(app) {
 	const { loadRPCConfig } = await import("@thednp/rpc");
 	const { adapter: _adapter, ...options } = await loadRPCConfig();
 	app.use(createRPCMiddleware(options));
 }
+/**
+* Attaches Vite's dev server middlewares to an Express app for development mode.
+* @param app - Express application instance
+* @param vite - Running Vite dev server
+*/
 function attachVite(app, vite) {
 	app.use(vite.middlewares);
 }
+/**
+* Reads and parses the HTTP request body from an Express or Node IncomingMessage.
+* If a body parser middleware (e.g. express.json()) already consumed the stream,
+* uses the pre-parsed body from `req.body`.
+* @param req - Express or Node.js IncomingMessage
+* @returns A promise resolving to the parsed body with its content type
+*/
 const readBody = (req) => {
 	return new Promise((resolve, reject) => {
 		if (hasPreParsedBody(req) && req.body !== void 0) {
@@ -61,15 +79,37 @@ const readBody = (req) => {
 		toggleListeners(true);
 	});
 };
+/**
+* Type guard that checks whether a request is an Express Request (has `originalUrl`).
+* @param req - A Node IncomingMessage or Express Request
+* @returns True if the request is an Express Request
+*/
 const isExpressRequest = (req) => {
 	return "originalUrl" in req;
 };
+/**
+* Type guard that checks whether a response is an Express Response (has `json` and `send` methods).
+* @param res - A Node ServerResponse or Express Response
+* @returns True if the response is an Express Response
+*/
 const isExpressResponse = (res) => {
 	return "json" in res && "send" in res;
 };
+/**
+* Type guard that checks whether a request has a pre-parsed body (`body` property).
+* Used to detect if a body-parser middleware already consumed the stream.
+* @param req - A Node IncomingMessage or Express Request
+* @returns True if the request has a body property
+*/
 const hasPreParsedBody = (req) => {
 	return "body" in req;
 };
+/**
+* Extracts normalized request details from an Express or Node IncomingMessage.
+* Parses the URL to extract pathname, search string, and search params.
+* @param request - Express or Node.js request object
+* @returns Normalized request details including URL, headers, and method
+*/
 const getRequestDetails = (request) => {
 	const rawUrl = isExpressRequest(request) ? request.originalUrl : request.url;
 	const url = new URL(rawUrl, "http://localhost");
@@ -81,6 +121,12 @@ const getRequestDetails = (request) => {
 		method: request.method
 	};
 };
+/**
+* Wraps an Express or Node ServerResponse with a uniform API for setting headers,
+* status codes, and sending JSON responses. Handles the Express vs raw Node API differences.
+* @param response - Express or Node.js server response object
+* @returns A ResponseDetails object with setHeader, setStatusCode, and sendResponse helpers
+*/
 const getResponseDetails = (response) => {
 	const isResponseSent = response.headersSent || response.writableEnded;
 	const setHeader = (name, value) => {
@@ -107,17 +153,40 @@ const getResponseDetails = (response) => {
 };
 //#endregion
 //#region src/tools.ts
+/**
+* Escapes special regex metacharacters in a string.
+* Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,
+* preventing ReDoS and regex injection attacks.
+* @param s - The raw string to escape
+* @returns The escaped string safe for use in new RegExp()
+*/
 function escapeRegExp(s) {
 	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 //#endregion
+//#region src/constants.ts
+const FUNCTION_NOT_FOUND = "Function not found";
+const METHOD_NOT_ALLOWED = "Method Not Allowed";
+const REQUEST_FORBIDDEN = "Forbidden";
+const INTERNAL_SERVER_ERROR = "Internal Server Error";
+const CLIENT_DISCONNECTED = "client disconnected";
+/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */
+const MIDDLEWARE_NAME_USED = (name) => `The middleware name "${name}" is already used.`;
+//#endregion
 //#region src/express/createMiddleware.ts
 let middlewareCount = 0;
 const middlewareStack = /* @__PURE__ */ new Set();
+/**
+* Creates an Express middleware with optional path and rpcPrefix filtering.
+* Middleware names are deduplicated — reusing a name throws an error.
+* Prefix and path regexes are compiled once at creation time (hoisted) for performance.
+* @param initialOptions - Options for rpcPrefix, path matching, and the handler function
+* @returns An Express middleware function
+*/
 const createMiddleware = (initialOptions = {}) => {
 	const options = Object.assign({}, defaultMiddlewareOptions, initialOptions);
 	const middlewareName = options.name;
-	const rpcPreffix = options.rpcPreffix;
+	const rpcPrefix = options.rpcPrefix;
 	const path = options.path;
 	const handler = options.handler;
 	let name = middlewareName;
@@ -125,50 +194,74 @@ const createMiddleware = (initialOptions = {}) => {
 		name = "viteRPCMiddleware-" + middlewareCount;
 		middlewareCount += 1;
 	}
-	if (middlewareStack.has(name)) throw new Error(`The middleware name "${name}" is already used.`);
+	if (middlewareStack.has(name)) throw new Error(MIDDLEWARE_NAME_USED(name));
 	middlewareStack.add(name);
-	const prefixRegex = rpcPreffix ? new RegExp(`^/${escapeRegExp(rpcPreffix)}/`) : null;
+	const prefixRegex = rpcPrefix ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`) : null;
 	const pathMatcher = path ? typeof path === "string" ? new RegExp(path) : path : null;
-	const middlewareHandler = async (req, _res, next) => {
+	const middlewareHandler = async (req, res, next) => {
 		const { url } = getRequestDetails(req);
 		if (serverFunctionsMap.size === 0) await scanForServerFiles();
 		if (!handler) return next?.();
 		if (pathMatcher && !pathMatcher.test(url)) return next?.();
 		if (prefixRegex && !prefixRegex.test(url)) return next?.();
-		await handler(req, _res, next);
+		await handler(req, res, next);
 	};
 	Object.defineProperty(middlewareHandler, "name", { value: name });
 	return middlewareHandler;
 };
+/**
+* Creates the Express RPC middleware that routes incoming requests to registered server functions.
+* Reads the request body, dispatches to the matching function via serverFunctionsMap,
+* and sends the JSON-serialized result. Handles client disconnection via abort signals.
+* @param initialOptions - Options including rpcPrefix for URL routing
+* @returns An Express middleware function
+*/
 const createRPCMiddleware = (initialOptions = {}) => {
-	const options = Object.assign({}, defaultMiddlewareOptions, { rpcPreffix: defaultRPCOptions.rpcPreffix }, initialOptions);
-	const rpcPreffix = options.rpcPreffix;
-	const prefixRegex = rpcPreffix ? new RegExp(`^/${escapeRegExp(rpcPreffix)}/`) : null;
-	const prefixReplace = `/${rpcPreffix}/`;
+	const options = Object.assign({}, defaultMiddlewareOptions, { rpcPrefix: defaultRPCOptions.rpcPrefix }, initialOptions);
+	const rpcPrefix = options.rpcPrefix;
+	const prefixRegex = rpcPrefix ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`) : null;
+	const prefixReplace = `/${rpcPrefix}/`;
 	return createMiddleware({
 		...options,
 		handler: async (req, res, _next) => {
-			const { url } = getRequestDetails(req);
+			const { url: path, searchParams } = getRequestDetails(req);
 			const { sendResponse } = getResponseDetails(res);
-			if (prefixRegex && !prefixRegex.test(url)) return;
-			const functionName = url.replace(prefixReplace, "");
+			if (prefixRegex && !prefixRegex.test(path)) return;
+			const origin = options.origin;
+			const requestOrigin = req.headers.origin;
+			if (origin && requestOrigin && requestOrigin !== origin) {
+				sendResponse(403, { error: REQUEST_FORBIDDEN });
+				return;
+			}
+			const functionName = path.replace(prefixReplace, "");
 			const serverFunction = serverFunctionsMap.get(functionName);
 			if (!serverFunction) {
-				sendResponse(404, { error: "Function not found" });
+				sendResponse(404, { error: FUNCTION_NOT_FOUND });
 				return;
 			}
 			try {
-				const body = await readBody(req);
-				const args = Array.isArray(body.data) ? body.data : [body.data];
+				const method = serverFunction.options?.method || "POST";
+				if (req.method?.toUpperCase() !== method) {
+					sendResponse(405, { error: METHOD_NOT_ALLOWED });
+					return;
+				}
+				let args = [];
+				if (method === "GET") {
+					const raw = searchParams.get("args");
+					if (raw) args = JSON.parse(raw);
+				} else {
+					const body = await readBody(req);
+					args = Array.isArray(body.data) ? body.data : [body.data];
+				}
 				const { data, cancel } = serverFunction.handler(...args);
-				const onClose = () => cancel("client disconnected");
+				const onClose = () => cancel(CLIENT_DISCONNECTED);
 				req.on("close", onClose);
 				const result = await data;
 				req.off("close", onClose);
 				if (!res.headersSent) sendResponse(200, { data: result });
 			} catch (err) {
 				console.error(String(err));
-				sendResponse(500, { error: "Internal Server Error" });
+				sendResponse(500, { error: INTERNAL_SERVER_ERROR });
 			}
 		}
 	});

package/dist/express/express.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"express.mjs","names":[],"sources":["../../src/options.ts","../../src/express/helpers.ts","../../src/tools.ts","../../src/express/createMiddleware.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions = {\n  contentType: \"application/json\",\n} satisfies ServerFunctionOptions;\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPreffix: \"__rpc\",\n  adapter: \"express\",\n};\n\nexport const defaultMiddlewareOptions = {\n  rpcPreffix: undefined,\n  path: undefined,\n} satisfies MiddlewareOptions;\n","// src/express/helpers.ts\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type {\n  Request as ExpressRequest,\n  Response as ExpressResponse,\n} from \"express\";\nimport type { BodyResult, JsonValue } from \"@thednp/rpc\";\nimport { Buffer } from \"node:buffer\";\nimport type { ViteDevServer } from \"vite\";\nimport type { Express } from \"express\";\nimport { createRPCMiddleware } from \"./createMiddleware.ts\";\n\nexport async function attachRPC(app: Express) {\n  const { loadRPCConfig } = await import(\"@thednp/rpc\");\n  const { adapter: _adapter, ...options } = await loadRPCConfig();\n  app.use(createRPCMiddleware(options));\n}\n\nexport function attachVite(app: Express, vite: ViteDevServer) {\n  app.use(vite.middlewares);\n}\n\n// src/express/helpers.ts\nexport const readBody = (\n  req: ExpressRequest | IncomingMessage,\n): Promise<BodyResult> => {\n  return new Promise((resolve, reject) => {\n    // If an Express body parser already consumed the stream\n    // via app.use(express.json()), use req.body directly\n    if (hasPreParsedBody(req) && req.body !== undefined) {\n      // istanbul ignore next\n      const contentType = req.headers[\"content-type\"]?.toLowerCase() || \"\";\n      const isJSON = contentType.includes(\"json\");\n      resolve({\n        contentType: isJSON ? \"application/json\" : \"text/plain\",\n        data: isJSON ? req.body : String(req.body),\n      } as BodyResult);\n      return;\n    }\n\n    // Else we parse the body right away\n    let body = \"\";\n\n    const toggleListeners = (add?: boolean) => {\n      const method = add ? \"on\" : \"off\";\n      req[method](\"data\", onData);\n      req[method](\"end\", onEnd);\n      req[method](\"error\", onError);\n    };\n\n    const onData = (chunk: Buffer) => {\n      body += chunk.toString();\n    };\n\n    const onEnd = () => {\n      toggleListeners();\n      const incomingType = req.headers[\"content-type\"]?.toLowerCase() || \"\";\n      const isJSON = incomingType.includes(\"json\");\n      try {\n        const data = JSON.parse(body);\n        resolve({\n          contentType: isJSON ? \"application/json\" : \"text/plain\",\n          data,\n        });\n      } catch (_e) {\n        resolve({ contentType: \"text/plain\", data: String(body) });\n      }\n    };\n\n    const onError = (err: Error) => {\n      toggleListeners();\n\n      reject(err);\n    };\n\n    toggleListeners(true);\n  });\n};\n\nexport const isExpressRequest = (\n  req: IncomingMessage | ExpressRequest,\n): req is ExpressRequest => {\n  return \"originalUrl\" in req;\n};\n\nexport const isExpressResponse = (\n  res: ServerResponse | ExpressResponse,\n): res is ExpressResponse => {\n  return \"json\" in res && \"send\" in res;\n};\n\nexport const hasPreParsedBody = (\n  req: IncomingMessage | ExpressRequest,\n): req is ExpressRequest => {\n  return \"body\" in req;\n};\n\nexport const getRequestDetails = (\n  request: ExpressRequest | IncomingMessage,\n) => {\n  const rawUrl = (\n    isExpressRequest(request) ? request.originalUrl : request.url\n  ) as string;\n  const url = new URL(rawUrl, \"http://localhost\");\n\n  return {\n    url: url.pathname,\n    search: url.search,\n    searchParams: url.searchParams,\n    headers: request.headers,\n    method: request.method,\n  };\n};\n\nexport const getResponseDetails = (\n  response: ExpressResponse | ServerResponse,\n) => {\n  const isResponseSent = response.headersSent || response.writableEnded;\n\n  const setHeader = (name: string, value: string) => {\n    if (isExpressResponse(response)) {\n      response.header(name, value);\n    } else {\n      response.setHeader(name, value);\n    }\n  };\n\n  const setStatusCode = (code: number) => {\n    if (isExpressResponse(response)) {\n      response.status(code);\n    } else {\n      response.statusCode = code;\n    }\n  };\n\n  const sendResponse = (code: number, output: Record<string, JsonValue>) => {\n    setStatusCode(code);\n    setHeader(\"Content-Type\", \"application/json\");\n\n    if (isExpressResponse(response)) {\n      response.send(JSON.stringify(output));\n    } else {\n      response.end(JSON.stringify(output));\n    }\n  };\n\n  return {\n    isResponseSent,\n    setHeader,\n    statusCode: response.statusCode,\n    setStatusCode,\n    sendResponse,\n  };\n};\n","export function escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n","// src/express/createMidleware.ts\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type {\n  NextFunction,\n  Request as ExpressRequest,\n  Response as ExpressResponse,\n} from \"express\";\nimport type {\n  ExpressMiddlewareFn,\n  ExpressMiddlewareOptions,\n} from \"./types.d.ts\";\nimport type { Connect } from \"vite\";\n// import type { JsonArray, JsonValue } from \"@thednp/rpc\";\nimport { scanForServerFiles, serverFunctionsMap } from \"@thednp/rpc/server\";\nimport { defaultMiddlewareOptions, defaultRPCOptions } from \"../options.ts\";\nimport { getRequestDetails, getResponseDetails, readBody } from \"./helpers.ts\";\nimport { escapeRegExp } from \"../tools.ts\";\n\nlet middlewareCount = 0;\nconst middlewareStack = new Set<string>();\n\nexport const createMiddleware: ExpressMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    initialOptions,\n  ) as ExpressMiddlewareOptions;\n  const middlewareName = options.name;\n  const rpcPreffix = options.rpcPreffix;\n  const path = options.path;\n  const handler = options.handler;\n\n  let name = middlewareName;\n  if (!name) {\n    name = \"viteRPCMiddleware-\" + middlewareCount;\n    middlewareCount += 1;\n  }\n  if (middlewareStack.has(name)) {\n    throw new Error(`The middleware name \"${name}\" is already used.`);\n  }\n  middlewareStack.add(name);\n\n  // Hoist regex compilation out of per-request path. Escape the prefix to\n  // prevent regex injection via metacharacters in the config string.\n  const prefixRegex: RegExp | null = rpcPreffix\n    ? new RegExp(`^/${escapeRegExp(rpcPreffix)}/`)\n    : null;\n  const pathMatcher: RegExp | null = path\n    ? (typeof path === \"string\" ? new RegExp(path) : path)\n    : null;\n\n  const middlewareHandler = async (\n    req: IncomingMessage | ExpressRequest,\n    _res: ServerResponse | ExpressResponse,\n    next: Connect.NextFunction | NextFunction,\n  ) => {\n    const { url } = getRequestDetails(req);\n\n    // When serving from production server, scan for server files\n    if (serverFunctionsMap.size === 0) {\n      await scanForServerFiles();\n    }\n\n    // No need to continue when no handler provided\n    if (!handler) {\n      return next?.();\n    }\n\n    // Path matching\n    if (pathMatcher && !pathMatcher.test(url)) return next?.();\n\n    // rpcPreffix matching (boundary-safe via escaped regex)\n    if (prefixRegex && !prefixRegex.test(url)) {\n      return next?.();\n    }\n\n    // Execute handler\n    await handler(req, _res, next);\n  };\n\n  Object.defineProperty(middlewareHandler, \"name\", {\n    value: name,\n  });\n\n  return middlewareHandler;\n};\n\n// Create RPC middleware\nexport const createRPCMiddleware: ExpressMiddlewareFn = (\n  initialOptions = {},\n) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    { rpcPreffix: defaultRPCOptions.rpcPreffix },\n    initialOptions,\n  ) as ExpressMiddlewareOptions;\n\n  // Hoist prefix regex (escaped) and the literal prefix-for-replace out of the\n  // per-request handler to avoid regex injection and per-request compilation.\n  const rpcPreffix = options.rpcPreffix;\n  const prefixRegex = rpcPreffix\n    ? new RegExp(`^/${escapeRegExp(rpcPreffix)}/`)\n    : /* istanbul ignore next */ null;\n  const prefixReplace = `/${rpcPreffix}/`;\n\n  return createMiddleware({\n    ...options,\n    handler: async (\n      req: IncomingMessage | ExpressRequest,\n      res: ServerResponse | ExpressResponse,\n      _next: NextFunction | Connect.NextFunction,\n    ) => {\n      const { url } = getRequestDetails(req);\n      const { sendResponse } = getResponseDetails(res);\n\n      // Validate the url starts with the prefix via the escaped regex\n      // istanbul ignore next\n      if (prefixRegex && !prefixRegex.test(url)) {\n        // falls through to next handler (never reached in practice; the outer\n        // createMiddleware already gates on this, but kept for defense-in-depth)\n        return;\n      }\n\n      const functionName = url.replace(prefixReplace, \"\");\n      const serverFunction = serverFunctionsMap.get(functionName);\n\n      if (!serverFunction) {\n        sendResponse(404, { error: \"Function not found\" });\n        return;\n      }\n\n      try {\n        const body = await readBody(req);\n        const args = Array.isArray(body.data) ? body.data : [body.data];\n        const { data, cancel } = serverFunction.handler(...args);\n        const onClose = () => cancel(\"client disconnected\");\n\n        req.on(\"close\", onClose);\n        const result = await data;\n        req.off(\"close\", onClose);\n\n        // istanbul ignore else\n        if (!res.headersSent) sendResponse(200, { data: result });\n      } catch (err) {\n        console.error(String(err));\n        sendResponse(500, { error: \"Internal Server Error\" });\n      }\n    },\n  });\n};\n"],"mappings":";;AAUA,MAAa,oBAAsC;CACjD,YAAY;CACZ,SAAS;AACX;AAEA,MAAa,2BAA2B;CACtC,YAAY,KAAA;CACZ,MAAM,KAAA;AACR;;;ACNA,eAAsB,UAAU,KAAc;CAC5C,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,MAAM,EAAE,SAAS,UAAU,GAAG,YAAY,MAAM,cAAc;CAC9D,IAAI,IAAI,oBAAoB,OAAO,CAAC;AACtC;AAEA,SAAgB,WAAW,KAAc,MAAqB;CAC5D,IAAI,IAAI,KAAK,WAAW;AAC1B;AAGA,MAAa,YACX,QACwB;CACxB,OAAO,IAAI,SAAS,SAAS,WAAW;EAGtC,IAAI,iBAAiB,GAAG,KAAK,IAAI,SAAS,KAAA,GAAW;GAGnD,MAAM,UADc,IAAI,QAAQ,eAAe,EAAE,YAAY,KAAK,GAAA,CACvC,SAAS,MAAM;GAC1C,QAAQ;IACN,aAAa,SAAS,qBAAqB;IAC3C,MAAM,SAAS,IAAI,OAAO,OAAO,IAAI,IAAI;GAC3C,CAAe;GACf;EACF;EAGA,IAAI,OAAO;EAEX,MAAM,mBAAmB,QAAkB;GACzC,MAAM,SAAS,MAAM,OAAO;GAC5B,IAAI,OAAO,CAAC,QAAQ,MAAM;GAC1B,IAAI,OAAO,CAAC,OAAO,KAAK;GACxB,IAAI,OAAO,CAAC,SAAS,OAAO;EAC9B;EAEA,MAAM,UAAU,UAAkB;GAChC,QAAQ,MAAM,SAAS;EACzB;EAEA,MAAM,cAAc;GAClB,gBAAgB;GAEhB,MAAM,UADe,IAAI,QAAQ,eAAe,EAAE,YAAY,KAAK,GAAA,CACvC,SAAS,MAAM;GAC3C,IAAI;IACF,MAAM,OAAO,KAAK,MAAM,IAAI;IAC5B,QAAQ;KACN,aAAa,SAAS,qBAAqB;KAC3C;IACF,CAAC;GACH,SAAS,IAAI;IACX,QAAQ;KAAE,aAAa;KAAc,MAAM,OAAO,IAAI;IAAE,CAAC;GAC3D;EACF;EAEA,MAAM,WAAW,QAAe;GAC9B,gBAAgB;GAEhB,OAAO,GAAG;EACZ;EAEA,gBAAgB,IAAI;CACtB,CAAC;AACH;AAEA,MAAa,oBACX,QAC0B;CAC1B,OAAO,iBAAiB;AAC1B;AAEA,MAAa,qBACX,QAC2B;CAC3B,OAAO,UAAU,OAAO,UAAU;AACpC;AAEA,MAAa,oBACX,QAC0B;CAC1B,OAAO,UAAU;AACnB;AAEA,MAAa,qBACX,YACG;CACH,MAAM,SACJ,iBAAiB,OAAO,IAAI,QAAQ,cAAc,QAAQ;CAE5D,MAAM,MAAM,IAAI,IAAI,QAAQ,kBAAkB;CAE9C,OAAO;EACL,KAAK,IAAI;EACT,QAAQ,IAAI;EACZ,cAAc,IAAI;EAClB,SAAS,QAAQ;EACjB,QAAQ,QAAQ;CAClB;AACF;AAEA,MAAa,sBACX,aACG;CACH,MAAM,iBAAiB,SAAS,eAAe,SAAS;CAExD,MAAM,aAAa,MAAc,UAAkB;EACjD,IAAI,kBAAkB,QAAQ,GAC5B,SAAS,OAAO,MAAM,KAAK;OAE3B,SAAS,UAAU,MAAM,KAAK;CAElC;CAEA,MAAM,iBAAiB,SAAiB;EACtC,IAAI,kBAAkB,QAAQ,GAC5B,SAAS,OAAO,IAAI;OAEpB,SAAS,aAAa;CAE1B;CAEA,MAAM,gBAAgB,MAAc,WAAsC;EACxE,cAAc,IAAI;EAClB,UAAU,gBAAgB,kBAAkB;EAE5C,IAAI,kBAAkB,QAAQ,GAC5B,SAAS,KAAK,KAAK,UAAU,MAAM,CAAC;OAEpC,SAAS,IAAI,KAAK,UAAU,MAAM,CAAC;CAEvC;CAEA,OAAO;EACL;EACA;EACA,YAAY,SAAS;EACrB;EACA;CACF;AACF;;;ACzJA,SAAgB,aAAa,GAAmB;CAC9C,OAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;;;ACgBA,IAAI,kBAAkB;AACtB,MAAM,kCAAkB,IAAI,IAAY;AAExC,MAAa,oBAAyC,iBAAiB,CAAC,MAAM;CAC5E,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,cACF;CACA,MAAM,iBAAiB,QAAQ;CAC/B,MAAM,aAAa,QAAQ;CAC3B,MAAM,OAAO,QAAQ;CACrB,MAAM,UAAU,QAAQ;CAExB,IAAI,OAAO;CACX,IAAI,CAAC,MAAM;EACT,OAAO,uBAAuB;EAC9B,mBAAmB;CACrB;CACA,IAAI,gBAAgB,IAAI,IAAI,GAC1B,MAAM,IAAI,MAAM,wBAAwB,KAAK,mBAAmB;CAElE,gBAAgB,IAAI,IAAI;CAIxB,MAAM,cAA6B,aAC/B,IAAI,OAAO,KAAK,aAAa,UAAU,EAAE,EAAE,IAC3C;CACJ,MAAM,cAA6B,OAC9B,OAAO,SAAS,WAAW,IAAI,OAAO,IAAI,IAAI,OAC/C;CAEJ,MAAM,oBAAoB,OACxB,KACA,MACA,SACG;EACH,MAAM,EAAE,QAAQ,kBAAkB,GAAG;EAGrC,IAAI,mBAAmB,SAAS,GAC9B,MAAM,mBAAmB;EAI3B,IAAI,CAAC,SACH,OAAO,OAAO;EAIhB,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GAAG,OAAO,OAAO;EAGzD,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,OAAO;EAIhB,MAAM,QAAQ,KAAK,MAAM,IAAI;CAC/B;CAEA,OAAO,eAAe,mBAAmB,QAAQ,EAC/C,OAAO,KACT,CAAC;CAED,OAAO;AACT;AAGA,MAAa,uBACX,iBAAiB,CAAC,MACf;CACH,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,EAAE,YAAY,kBAAkB,WAAW,GAC3C,cACF;CAIA,MAAM,aAAa,QAAQ;CAC3B,MAAM,cAAc,aAChB,IAAI,OAAO,KAAK,aAAa,UAAU,EAAE,EAAE,IAC1C;CACL,MAAM,gBAAgB,IAAI,WAAW;CAErC,OAAO,iBAAiB;EACtB,GAAG;EACH,SAAS,OACP,KACA,KACA,UACG;GACH,MAAM,EAAE,QAAQ,kBAAkB,GAAG;GACrC,MAAM,EAAE,iBAAiB,mBAAmB,GAAG;GAI/C,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GAGtC;GAGF,MAAM,eAAe,IAAI,QAAQ,eAAe,EAAE;GAClD,MAAM,iBAAiB,mBAAmB,IAAI,YAAY;GAE1D,IAAI,CAAC,gBAAgB;IACnB,aAAa,KAAK,EAAE,OAAO,qBAAqB,CAAC;IACjD;GACF;GAEA,IAAI;IACF,MAAM,OAAO,MAAM,SAAS,GAAG;IAC/B,MAAM,OAAO,MAAM,QAAQ,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC,KAAK,IAAI;IAC9D,MAAM,EAAE,MAAM,WAAW,eAAe,QAAQ,GAAG,IAAI;IACvD,MAAM,gBAAgB,OAAO,qBAAqB;IAElD,IAAI,GAAG,SAAS,OAAO;IACvB,MAAM,SAAS,MAAM;IACrB,IAAI,IAAI,SAAS,OAAO;IAGxB,IAAI,CAAC,IAAI,aAAa,aAAa,KAAK,EAAE,MAAM,OAAO,CAAC;GAC1D,SAAS,KAAK;IACZ,QAAQ,MAAM,OAAO,GAAG,CAAC;IACzB,aAAa,KAAK,EAAE,OAAO,wBAAwB,CAAC;GACtD;EACF;CACF,CAAC;AACH"}
+{"version":3,"file":"express.mjs","names":[],"sources":["../../src/options.ts","../../src/express/helpers.ts","../../src/tools.ts","../../src/constants.ts","../../src/express/createMiddleware.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n} satisfies ServerFunctionOptions;\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: \"__rpc\",\n  adapter: \"express\",\n};\n\nexport const defaultMiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n} satisfies MiddlewareOptions;\n","// src/express/helpers.ts\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type {\n  Request as ExpressRequest,\n  Response as ExpressResponse,\n} from \"express\";\nimport type { BodyResult, JsonValue } from \"@thednp/rpc\";\nimport type { Buffer } from \"node:buffer\";\nimport type { ViteDevServer } from \"vite\";\nimport type { Express } from \"express\";\nimport { createRPCMiddleware } from \"./createMiddleware.ts\";\nimport type { RequestDetails, ResponseDetails } from \"./types.d.ts\";\n\n/**\n * Convenience function to load RPC config and attach the RPC middleware to an Express app.\n * Dynamically imports loadRPCConfig and creates the middleware with loaded options.\n * @param app - Express application instance\n */\nexport async function attachRPC(app: Express) {\n  const { loadRPCConfig } = await import(\"@thednp/rpc\");\n  const { adapter: _adapter, ...options } = await loadRPCConfig();\n  app.use(createRPCMiddleware(options));\n}\n\n/**\n * Attaches Vite's dev server middlewares to an Express app for development mode.\n * @param app - Express application instance\n * @param vite - Running Vite dev server\n */\nexport function attachVite(app: Express, vite: ViteDevServer) {\n  app.use(vite.middlewares);\n}\n\n/**\n * Reads and parses the HTTP request body from an Express or Node IncomingMessage.\n * If a body parser middleware (e.g. express.json()) already consumed the stream,\n * uses the pre-parsed body from `req.body`.\n * @param req - Express or Node.js IncomingMessage\n * @returns A promise resolving to the parsed body with its content type\n */\nexport const readBody = (\n  req: ExpressRequest | IncomingMessage,\n): Promise<BodyResult> => {\n  return new Promise((resolve, reject) => {\n    // If an Express body parser already consumed the stream\n    // via app.use(express.json()), use req.body directly\n    if (hasPreParsedBody(req) && req.body !== undefined) {\n      // istanbul ignore next\n      const contentType = req.headers[\"content-type\"]?.toLowerCase() || \"\";\n      const isJSON = contentType.includes(\"json\");\n      resolve({\n        contentType: isJSON ? \"application/json\" : \"text/plain\",\n        data: isJSON ? req.body : String(req.body),\n      } as BodyResult);\n      return;\n    }\n\n    // Else we parse the body right away\n    let body = \"\";\n\n    const toggleListeners = (add?: boolean) => {\n      const method = add ? \"on\" : \"off\";\n      req[method](\"data\", onData);\n      req[method](\"end\", onEnd);\n      req[method](\"error\", onError);\n    };\n\n    const onData = (chunk: Buffer) => {\n      body += chunk.toString();\n    };\n\n    const onEnd = () => {\n      toggleListeners();\n      const incomingType = req.headers[\"content-type\"]?.toLowerCase() || \"\";\n      const isJSON = incomingType.includes(\"json\");\n      try {\n        const data = JSON.parse(body);\n        resolve({\n          contentType: isJSON ? \"application/json\" : \"text/plain\",\n          data,\n        });\n      } catch (_e) {\n        resolve({ contentType: \"text/plain\", data: String(body) });\n      }\n    };\n\n    const onError = (err: Error) => {\n      toggleListeners();\n\n      reject(err);\n    };\n\n    toggleListeners(true);\n  });\n};\n\n/**\n * Type guard that checks whether a request is an Express Request (has `originalUrl`).\n * @param req - A Node IncomingMessage or Express Request\n * @returns True if the request is an Express Request\n */\nexport const isExpressRequest = (\n  req: IncomingMessage | ExpressRequest,\n): req is ExpressRequest => {\n  return \"originalUrl\" in req;\n};\n\n/**\n * Type guard that checks whether a response is an Express Response (has `json` and `send` methods).\n * @param res - A Node ServerResponse or Express Response\n * @returns True if the response is an Express Response\n */\nexport const isExpressResponse = (\n  res: ServerResponse | ExpressResponse,\n): res is ExpressResponse => {\n  return \"json\" in res && \"send\" in res;\n};\n\n/**\n * Type guard that checks whether a request has a pre-parsed body (`body` property).\n * Used to detect if a body-parser middleware already consumed the stream.\n * @param req - A Node IncomingMessage or Express Request\n * @returns True if the request has a body property\n */\nexport const hasPreParsedBody = (\n  req: IncomingMessage | ExpressRequest,\n): req is ExpressRequest => {\n  return \"body\" in req;\n};\n\n/**\n * Extracts normalized request details from an Express or Node IncomingMessage.\n * Parses the URL to extract pathname, search string, and search params.\n * @param request - Express or Node.js request object\n * @returns Normalized request details including URL, headers, and method\n */\nexport const getRequestDetails = (\n  request: ExpressRequest | IncomingMessage,\n): RequestDetails => {\n  const rawUrl = (\n    isExpressRequest(request) ? request.originalUrl : request.url\n  ) as string;\n  const url = new URL(rawUrl, \"http://localhost\");\n\n  return {\n    url: url.pathname,\n    search: url.search,\n    searchParams: url.searchParams,\n    headers: request.headers,\n    method: request.method,\n  };\n};\n\n/**\n * Wraps an Express or Node ServerResponse with a uniform API for setting headers,\n * status codes, and sending JSON responses. Handles the Express vs raw Node API differences.\n * @param response - Express or Node.js server response object\n * @returns A ResponseDetails object with setHeader, setStatusCode, and sendResponse helpers\n */\nexport const getResponseDetails = (\n  response: ExpressResponse | ServerResponse,\n): ResponseDetails => {\n  const isResponseSent = response.headersSent || response.writableEnded;\n\n  const setHeader = (name: string, value: string) => {\n    if (isExpressResponse(response)) {\n      response.header(name, value);\n    } else {\n      response.setHeader(name, value);\n    }\n  };\n\n  const setStatusCode = (code: number) => {\n    if (isExpressResponse(response)) {\n      response.status(code);\n    } else {\n      response.statusCode = code;\n    }\n  };\n\n  const sendResponse = (code: number, output: Record<string, JsonValue>) => {\n    setStatusCode(code);\n    setHeader(\"Content-Type\", \"application/json\");\n\n    if (isExpressResponse(response)) {\n      response.send(JSON.stringify(output));\n    } else {\n      response.end(JSON.stringify(output));\n    }\n  };\n\n  return {\n    isResponseSent,\n    setHeader,\n    statusCode: response.statusCode,\n    setStatusCode,\n    sendResponse,\n  };\n};\n","/**\n * Escapes special regex metacharacters in a string.\n * Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,\n * preventing ReDoS and regex injection attacks.\n * @param s - The raw string to escape\n * @returns The escaped string safe for use in new RegExp()\n */\nexport function escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$][A-Za-z0-9_$/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND = ` ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = ` ⚠︎ Failed to load RPC config:`;\n","// src/express/createMidleware.ts\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type {\n  NextFunction,\n  Request as ExpressRequest,\n  Response as ExpressResponse,\n} from \"express\";\nimport type {\n  ExpressMiddlewareFn,\n  ExpressMiddlewareOptions,\n} from \"./types.d.ts\";\nimport type { Connect } from \"vite\";\n// import type { JsonArray, JsonValue } from \"@thednp/rpc\";\nimport type { JsonValue } from \"../types.d.ts\";\nimport { scanForServerFiles, serverFunctionsMap } from \"@thednp/rpc/server\";\nimport { defaultMiddlewareOptions, defaultRPCOptions } from \"../options.ts\";\nimport { getRequestDetails, getResponseDetails, readBody } from \"./helpers.ts\";\nimport { escapeRegExp } from \"../tools.ts\";\nimport {\n  CLIENT_DISCONNECTED,\n  FUNCTION_NOT_FOUND,\n  INTERNAL_SERVER_ERROR,\n  METHOD_NOT_ALLOWED,\n  MIDDLEWARE_NAME_USED,\n  REQUEST_FORBIDDEN,\n} from \"../constants.ts\";\n\nlet middlewareCount = 0;\nconst middlewareStack = new Set<string>();\n\n/**\n * Creates an Express middleware with optional path and rpcPrefix filtering.\n * Middleware names are deduplicated — reusing a name throws an error.\n * Prefix and path regexes are compiled once at creation time (hoisted) for performance.\n * @param initialOptions - Options for rpcPrefix, path matching, and the handler function\n * @returns An Express middleware function\n */\nexport const createMiddleware: ExpressMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    initialOptions,\n  ) as ExpressMiddlewareOptions;\n  const middlewareName = options.name;\n  const rpcPrefix = options.rpcPrefix;\n  const path = options.path;\n  const handler = options.handler;\n\n  let name = middlewareName;\n  if (!name) {\n    name = \"viteRPCMiddleware-\" + middlewareCount;\n    middlewareCount += 1;\n  }\n  if (middlewareStack.has(name)) {\n    throw new Error(MIDDLEWARE_NAME_USED(name));\n  }\n  middlewareStack.add(name);\n\n  // Hoist regex compilation out of per-request path. Escape the prefix to\n  // prevent regex injection via metacharacters in the config string.\n  const prefixRegex: RegExp | null = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : null;\n  const pathMatcher: RegExp | null = path\n    ? (typeof path === \"string\" ? new RegExp(path) : path)\n    : null;\n\n  const middlewareHandler = async (\n    req: IncomingMessage | ExpressRequest,\n    res: ServerResponse | ExpressResponse,\n    next: Connect.NextFunction | NextFunction,\n  ) => {\n    const { url } = getRequestDetails(req);\n\n    // When serving from production server, scan for server files\n    if (serverFunctionsMap.size === 0) {\n      await scanForServerFiles();\n    }\n\n    // No need to continue when no handler provided\n    if (!handler) {\n      return next?.();\n    }\n\n    // Path matching\n    if (pathMatcher && !pathMatcher.test(url)) return next?.();\n\n    // rpcPrefix matching (boundary-safe via escaped regex)\n    if (prefixRegex && !prefixRegex.test(url)) {\n      return next?.();\n    }\n\n    // Execute handler\n    await handler(req, res, next);\n  };\n\n  Object.defineProperty(middlewareHandler, \"name\", {\n    value: name,\n  });\n\n  return middlewareHandler;\n};\n\n/**\n * Creates the Express RPC middleware that routes incoming requests to registered server functions.\n * Reads the request body, dispatches to the matching function via serverFunctionsMap,\n * and sends the JSON-serialized result. Handles client disconnection via abort signals.\n * @param initialOptions - Options including rpcPrefix for URL routing\n * @returns An Express middleware function\n */\nexport const createRPCMiddleware: ExpressMiddlewareFn = (\n  initialOptions = {},\n) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    { rpcPrefix: defaultRPCOptions.rpcPrefix },\n    initialOptions,\n  ) as ExpressMiddlewareOptions;\n\n  // Hoist prefix regex (escaped) and the literal prefix-for-replace out of the\n  // per-request handler to avoid regex injection and per-request compilation.\n  const rpcPrefix = options.rpcPrefix;\n  const prefixRegex = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : /* istanbul ignore next */ null;\n  const prefixReplace = `/${rpcPrefix}/`;\n\n  return createMiddleware({\n    ...options,\n    handler: async (\n      req: IncomingMessage | ExpressRequest,\n      res: ServerResponse | ExpressResponse,\n      _next: NextFunction | Connect.NextFunction,\n    ) => {\n      const { url: path, searchParams } = getRequestDetails(req);\n      const { sendResponse } = getResponseDetails(res);\n\n      // Validate the url starts with the prefix via the escaped regex\n      // istanbul ignore next\n      if (prefixRegex && !prefixRegex.test(path)) {\n        // falls through to next handler (never reached in practice; the outer\n        // createMiddleware already gates on this, but kept for defense-in-depth)\n        return;\n      }\n\n      // Optional origin check: reject requests whose Origin header does not\n      // match the configured origin. Requests without an Origin header\n      // (curl, native clients) pass through unchecked.\n      const origin = options.origin;\n      const requestOrigin = req.headers.origin;\n      if (origin && requestOrigin && requestOrigin !== origin) {\n        sendResponse(403, { error: REQUEST_FORBIDDEN });\n        return;\n      }\n\n      const functionName = path.replace(prefixReplace, \"\");\n      const serverFunction = serverFunctionsMap.get(functionName);\n\n      if (!serverFunction) {\n        sendResponse(404, { error: FUNCTION_NOT_FOUND });\n        return;\n      }\n\n      try {\n        const method = serverFunction.options?.method || \"POST\";\n        if (req.method?.toUpperCase() !== method) {\n          sendResponse(405, { error: METHOD_NOT_ALLOWED });\n          return;\n        }\n\n        let args: JsonValue[] = [];\n        if (method === \"GET\") {\n          const raw = searchParams.get(\"args\");\n          // istanbul ignore else\n          if (raw) args = JSON.parse(raw);\n        } else {\n          const body = await readBody(req);\n          args = Array.isArray(body.data) ? body.data : [body.data];\n        }\n        const { data, cancel } = serverFunction.handler(...args);\n        const onClose = () => cancel(CLIENT_DISCONNECTED);\n\n        req.on(\"close\", onClose);\n        const result = await data;\n        req.off(\"close\", onClose);\n\n        // istanbul ignore else\n        if (!res.headersSent) sendResponse(200, { data: result });\n      } catch (err) {\n        console.error(String(err));\n        sendResponse(500, { error: INTERNAL_SERVER_ERROR });\n      }\n    },\n  });\n};\n"],"mappings":";;AAYA,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;AACX;AAEA,MAAa,2BAA2B;CACtC,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;ACHA,eAAsB,UAAU,KAAc;CAC5C,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,MAAM,EAAE,SAAS,UAAU,GAAG,YAAY,MAAM,cAAc;CAC9D,IAAI,IAAI,oBAAoB,OAAO,CAAC;AACtC;;;;;;AAOA,SAAgB,WAAW,KAAc,MAAqB;CAC5D,IAAI,IAAI,KAAK,WAAW;AAC1B;;;;;;;;AASA,MAAa,YACX,QACwB;CACxB,OAAO,IAAI,SAAS,SAAS,WAAW;EAGtC,IAAI,iBAAiB,GAAG,KAAK,IAAI,SAAS,KAAA,GAAW;GAGnD,MAAM,UADc,IAAI,QAAQ,eAAe,EAAE,YAAY,KAAK,GAAA,CACvC,SAAS,MAAM;GAC1C,QAAQ;IACN,aAAa,SAAS,qBAAqB;IAC3C,MAAM,SAAS,IAAI,OAAO,OAAO,IAAI,IAAI;GAC3C,CAAe;GACf;EACF;EAGA,IAAI,OAAO;EAEX,MAAM,mBAAmB,QAAkB;GACzC,MAAM,SAAS,MAAM,OAAO;GAC5B,IAAI,OAAO,CAAC,QAAQ,MAAM;GAC1B,IAAI,OAAO,CAAC,OAAO,KAAK;GACxB,IAAI,OAAO,CAAC,SAAS,OAAO;EAC9B;EAEA,MAAM,UAAU,UAAkB;GAChC,QAAQ,MAAM,SAAS;EACzB;EAEA,MAAM,cAAc;GAClB,gBAAgB;GAEhB,MAAM,UADe,IAAI,QAAQ,eAAe,EAAE,YAAY,KAAK,GAAA,CACvC,SAAS,MAAM;GAC3C,IAAI;IACF,MAAM,OAAO,KAAK,MAAM,IAAI;IAC5B,QAAQ;KACN,aAAa,SAAS,qBAAqB;KAC3C;IACF,CAAC;GACH,SAAS,IAAI;IACX,QAAQ;KAAE,aAAa;KAAc,MAAM,OAAO,IAAI;IAAE,CAAC;GAC3D;EACF;EAEA,MAAM,WAAW,QAAe;GAC9B,gBAAgB;GAEhB,OAAO,GAAG;EACZ;EAEA,gBAAgB,IAAI;CACtB,CAAC;AACH;;;;;;AAOA,MAAa,oBACX,QAC0B;CAC1B,OAAO,iBAAiB;AAC1B;;;;;;AAOA,MAAa,qBACX,QAC2B;CAC3B,OAAO,UAAU,OAAO,UAAU;AACpC;;;;;;;AAQA,MAAa,oBACX,QAC0B;CAC1B,OAAO,UAAU;AACnB;;;;;;;AAQA,MAAa,qBACX,YACmB;CACnB,MAAM,SACJ,iBAAiB,OAAO,IAAI,QAAQ,cAAc,QAAQ;CAE5D,MAAM,MAAM,IAAI,IAAI,QAAQ,kBAAkB;CAE9C,OAAO;EACL,KAAK,IAAI;EACT,QAAQ,IAAI;EACZ,cAAc,IAAI;EAClB,SAAS,QAAQ;EACjB,QAAQ,QAAQ;CAClB;AACF;;;;;;;AAQA,MAAa,sBACX,aACoB;CACpB,MAAM,iBAAiB,SAAS,eAAe,SAAS;CAExD,MAAM,aAAa,MAAc,UAAkB;EACjD,IAAI,kBAAkB,QAAQ,GAC5B,SAAS,OAAO,MAAM,KAAK;OAE3B,SAAS,UAAU,MAAM,KAAK;CAElC;CAEA,MAAM,iBAAiB,SAAiB;EACtC,IAAI,kBAAkB,QAAQ,GAC5B,SAAS,OAAO,IAAI;OAEpB,SAAS,aAAa;CAE1B;CAEA,MAAM,gBAAgB,MAAc,WAAsC;EACxE,cAAc,IAAI;EAClB,UAAU,gBAAgB,kBAAkB;EAE5C,IAAI,kBAAkB,QAAQ,GAC5B,SAAS,KAAK,KAAK,UAAU,MAAM,CAAC;OAEpC,SAAS,IAAI,KAAK,UAAU,MAAM,CAAC;CAEvC;CAEA,OAAO;EACL;EACA;EACA,YAAY,SAAS;EACrB;EACA;CACF;AACF;;;;;;;;;;AC/LA,SAAgB,aAAa,GAAmB;CAC9C,OAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;;;ACCA,MAAa,qBAAqB;AAElC,MAAa,qBAAqB;AAElC,MAAa,oBAAoB;AAEjC,MAAa,wBAAwB;AAErC,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB,SACnC,wBAAwB,KAAK;;;ACK/B,IAAI,kBAAkB;AACtB,MAAM,kCAAkB,IAAI,IAAY;;;;;;;;AASxC,MAAa,oBAAyC,iBAAiB,CAAC,MAAM;CAC5E,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,cACF;CACA,MAAM,iBAAiB,QAAQ;CAC/B,MAAM,YAAY,QAAQ;CAC1B,MAAM,OAAO,QAAQ;CACrB,MAAM,UAAU,QAAQ;CAExB,IAAI,OAAO;CACX,IAAI,CAAC,MAAM;EACT,OAAO,uBAAuB;EAC9B,mBAAmB;CACrB;CACA,IAAI,gBAAgB,IAAI,IAAI,GAC1B,MAAM,IAAI,MAAM,qBAAqB,IAAI,CAAC;CAE5C,gBAAgB,IAAI,IAAI;CAIxB,MAAM,cAA6B,YAC/B,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IAC1C;CACJ,MAAM,cAA6B,OAC9B,OAAO,SAAS,WAAW,IAAI,OAAO,IAAI,IAAI,OAC/C;CAEJ,MAAM,oBAAoB,OACxB,KACA,KACA,SACG;EACH,MAAM,EAAE,QAAQ,kBAAkB,GAAG;EAGrC,IAAI,mBAAmB,SAAS,GAC9B,MAAM,mBAAmB;EAI3B,IAAI,CAAC,SACH,OAAO,OAAO;EAIhB,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GAAG,OAAO,OAAO;EAGzD,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,OAAO;EAIhB,MAAM,QAAQ,KAAK,KAAK,IAAI;CAC9B;CAEA,OAAO,eAAe,mBAAmB,QAAQ,EAC/C,OAAO,KACT,CAAC;CAED,OAAO;AACT;;;;;;;;AASA,MAAa,uBACX,iBAAiB,CAAC,MACf;CACH,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,EAAE,WAAW,kBAAkB,UAAU,GACzC,cACF;CAIA,MAAM,YAAY,QAAQ;CAC1B,MAAM,cAAc,YAChB,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IACzC;CACL,MAAM,gBAAgB,IAAI,UAAU;CAEpC,OAAO,iBAAiB;EACtB,GAAG;EACH,SAAS,OACP,KACA,KACA,UACG;GACH,MAAM,EAAE,KAAK,MAAM,iBAAiB,kBAAkB,GAAG;GACzD,MAAM,EAAE,iBAAiB,mBAAmB,GAAG;GAI/C,IAAI,eAAe,CAAC,YAAY,KAAK,IAAI,GAGvC;GAMF,MAAM,SAAS,QAAQ;GACvB,MAAM,gBAAgB,IAAI,QAAQ;GAClC,IAAI,UAAU,iBAAiB,kBAAkB,QAAQ;IACvD,aAAa,KAAK,EAAE,OAAO,kBAAkB,CAAC;IAC9C;GACF;GAEA,MAAM,eAAe,KAAK,QAAQ,eAAe,EAAE;GACnD,MAAM,iBAAiB,mBAAmB,IAAI,YAAY;GAE1D,IAAI,CAAC,gBAAgB;IACnB,aAAa,KAAK,EAAE,OAAO,mBAAmB,CAAC;IAC/C;GACF;GAEA,IAAI;IACF,MAAM,SAAS,eAAe,SAAS,UAAU;IACjD,IAAI,IAAI,QAAQ,YAAY,MAAM,QAAQ;KACxC,aAAa,KAAK,EAAE,OAAO,mBAAmB,CAAC;KAC/C;IACF;IAEA,IAAI,OAAoB,CAAC;IACzB,IAAI,WAAW,OAAO;KACpB,MAAM,MAAM,aAAa,IAAI,MAAM;KAEnC,IAAI,KAAK,OAAO,KAAK,MAAM,GAAG;IAChC,OAAO;KACL,MAAM,OAAO,MAAM,SAAS,GAAG;KAC/B,OAAO,MAAM,QAAQ,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC,KAAK,IAAI;IAC1D;IACA,MAAM,EAAE,MAAM,WAAW,eAAe,QAAQ,GAAG,IAAI;IACvD,MAAM,gBAAgB,OAAO,mBAAmB;IAEhD,IAAI,GAAG,SAAS,OAAO;IACvB,MAAM,SAAS,MAAM;IACrB,IAAI,IAAI,SAAS,OAAO;IAGxB,IAAI,CAAC,IAAI,aAAa,aAAa,KAAK,EAAE,MAAM,OAAO,CAAC;GAC1D,SAAS,KAAK;IACZ,QAAQ,MAAM,OAAO,GAAG,CAAC;IACzB,aAAa,KAAK,EAAE,OAAO,sBAAsB,CAAC;GACpD;EACF;CACF,CAAC;AACH"}

package/dist/fastify/fastify.d.mts

@@ -4,23 +4,59 @@ import { ViteDevServer } from "vite";
 import "express";
 import "hono";
 import "@hono/node-server";
+import "hono/factory";
 import "koa";
 //#region src/fastify/types.d.ts
+/**
+ * Fastify-specific middleware options, constrained to the `"fastify"` adapter.
+ */
 type FastifyMiddlewareOptions = MiddlewareOptions<"fastify">;
+/**
+ * Fastify middleware factory: takes optional initial options and returns
+ * the Fastify-compatible handler.
+ */
 type FastifyMiddlewareFn = <A extends RpcPluginOptions["adapter"] = "fastify">(initialOptions?: Partial<FastifyMiddlewareOptions>) => FastifyMiddlewareHooks["handler"];
+/**
+ * Fastify middleware handler signature used by the RPC middleware.
+ */
 interface FastifyMiddlewareHooks {
+  /**
+   * The handler invoked for each matched request.
+   * @param req - Fastify request object
+   * @param res - Fastify reply object
+   * @param done - Fastify hook completion callback
+   */
   handler: (req: FastifyRequest, res: FastifyReply, done: HookHandlerDoneFunction) => Promise<void>;
 }
-// Define the plugin function
+/**
+ * Options accepted by the Fastify RPC plugin (`fp()`-wrapped registration).
+ */
 type RpcFastifyPluginOptions = MiddlewareOptions<"fastify"> & {
+  /** Whether this is an RPC plugin registration */
   isRPC: boolean;
 };
 //#endregion
 //#region src/fastify/createMiddleware.d.ts
+/**
+ * Creates a Fastify preHandler hook with optional path and rpcPrefix filtering.
+ * Middleware names are deduplicated. Prefix and path regexes are compiled once at creation time.
+ * @param initialOptions - Options for rpcPrefix, path matching, and the handler function
+ * @returns A Fastify preHandler hook function
+ */
 declare const createMiddleware: FastifyMiddlewareFn;
+/**
+ * Creates the Fastify RPC middleware that routes incoming requests to registered server functions.
+ * Wraps the generic createMiddleware with the RPC handler that reads the body, dispatches
+ * to the matching function, and sends the JSON-serialized result.
+ * @param initialOptions - Options including rpcPrefix for URL routing
+ * @returns A Fastify preHandler hook function
+ */
 declare const createRPCMiddleware: FastifyMiddlewareFn;
 //#endregion
 //#region src/types.d.ts
+/**
+ * Parsed request body result discriminated by content type.
+ */
 type BodyResult = {
   contentType: "application/json";
   data: JsonValue;
@@ -29,16 +65,45 @@ type BodyResult = {
   data: string;
 };
 // primitives and their compositions
+/**
+ * Primitive JSON values, including `undefined` for optional parameters.
+ */
 type JsonPrimitive = string | number | boolean | null | undefined;
+/**
+ * A JSON object whose values are JSON values or arrays.
+ */
 type JsonObject = {
   [key: string]: JsonValue | JsonArray;
 };
+/**
+ * A JSON array of JSON values.
+ */
 type JsonArray = JsonValue[];
+/**
+ * Any JSON-serializable value: primitive, array, or object.
+ */
 type JsonValue = JsonPrimitive | JsonArray | JsonObject;
 //#endregion
 //#region src/fastify/helpers.d.ts
+/**
+ * Convenience function to load RPC config and register the RPC plugin to a Fastify instance.
+ * Dynamically imports loadRPCConfig and registers the fastify-rpc plugin.
+ * @param app - Fastify instance
+ */
 declare function attachRPC(app: FastifyInstance): Promise<void>;
+/**
+ * Attaches Vite's dev server middlewares to a Fastify instance for development mode.
+ * Uses an `onRequest` hook to delegate to Vite's connect-compatible middleware stack.
+ * @param app - Fastify instance
+ * @param vite - Running Vite dev server
+ */
 declare function attachVite(app: FastifyInstance, vite: ViteDevServer): void;
+/**
+ * Reads and parses the HTTP request body from a Fastify request.
+ * If Fastify's body parser already consumed the stream, uses the pre-parsed body from `req.body`.
+ * @param req - Fastify request object
+ * @returns A promise resolving to the parsed body with its content type
+ */
 declare const readBody: (req: FastifyRequest) => Promise<BodyResult>;
 //#endregion
 export { type FastifyMiddlewareFn, type FastifyMiddlewareHooks, type FastifyMiddlewareOptions, type RpcFastifyPluginOptions, attachRPC, attachVite, createMiddleware, createRPCMiddleware, readBody };

package/dist/fastify/fastify.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"fastify.d.mts","names":[],"sources":["../../src/fastify/types.d.ts","../../src/fastify/createMiddleware.ts","../../src/types.d.ts","../../src/fastify/helpers.ts"],"mappings":";;;;;;;;KAOY,2BAA2B;KAE3B,uBACV,UAAU,yCAEV,iBAAiB,QAAQ,8BACtB;UAEY;EACf,UACE,KAAK,gBACL,KAAK,cACL,MAAM,4BACH;;;KAIK,0BAA0B;EACpC;;;;cCLW,kBAAkB;cAyElB,qBAAqB;;;KCxDtB;EACN;EAAiC,MAAM;;EACvC;EAA2B;;;KAOrB;KACA;GAAgB,cAAc,YAAY;;KAC1C,YAAY;KACZ,YAAY,gBAAgB,YAAY;;;iBCzC9B,UAAU,KAAK,kBAAe;iBAMpC,WAAW,KAAK,iBAAiB,MAAM;cAU1C,WAAQ,KACd,mBACJ,QAAQ"}
+{"version":3,"file":"fastify.d.mts","names":[],"sources":["../../src/fastify/types.d.ts","../../src/fastify/createMiddleware.ts","../../src/types.d.ts","../../src/fastify/helpers.ts"],"mappings":";;;;;;;;;;;;KAUY,2BAA2B;;;;;KAM3B,uBACV,UAAU,yCAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,gBACL,KAAK,cACL,MAAM,4BACH;;;;;KAMK,0BAA0B;;EAEpC;;;;;;;;;;cCXW,kBAAkB;;;;;;;;cAgFlB,qBAAqB;;;;;;KC9CtB;EACN;EAAiC,MAAM;;EACvC;EAA2B;;;;;;KA8BrB;;;;KAIA;GAAgB,cAAc,YAAY;;;;;KAI1C,YAAY;;;;KAIZ,YAAY,gBAAgB,YAAY;;;;;;;;iBClG9B,UAAU,KAAK,kBAAe;;;;;;;iBAYpC,WAAW,KAAK,iBAAiB,MAAM;;;;;;;cAgB1C,WAAQ,KACd,mBACJ,QAAQ"}

package/dist/fastify/fastify.mjs

@@ -2,20 +2,43 @@ import { scanForServerFiles, serverFunctionsMap } from "@thednp/rpc/server";
 import fp from "fastify-plugin";
 //#region src/options.ts
 const defaultRPCOptions = {
-	rpcPreffix: "__rpc",
+	rpcPrefix: "__rpc",
 	adapter: "express"
 };
 const defaultMiddlewareOptions = {
-	rpcPreffix: void 0,
-	path: void 0
+	rpcPrefix: void 0,
+	path: void 0,
+	origin: void 0
 };
 //#endregion
 //#region src/tools.ts
+/**
+* Escapes special regex metacharacters in a string.
+* Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,
+* preventing ReDoS and regex injection attacks.
+* @param s - The raw string to escape
+* @returns The escaped string safe for use in new RegExp()
+*/
 function escapeRegExp(s) {
 	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 //#endregion
+//#region src/constants.ts
+const FUNCTION_NOT_FOUND = "Function not found";
+const METHOD_NOT_ALLOWED = "Method Not Allowed";
+const REQUEST_FORBIDDEN = "Forbidden";
+const INTERNAL_SERVER_ERROR = "Internal Server Error";
+const CLIENT_DISCONNECTED = "client disconnected";
+/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */
+const MIDDLEWARE_NAME_USED = (name) => `The middleware name "${name}" is already used.`;
+//#endregion
 //#region src/fastify/plugin.ts
+/**
+* Fastify plugin factory that registers the RPC middleware as a preHandler hook.
+* @param fastify - Fastify instance
+* @param initialOptions - Middleware options including rpcPrefix
+* @param done - Callback to signal plugin registration completion
+*/
 const RpcPlugin = (fastify, initialOptions, done) => {
 	const rpcMiddleware = createRPCMiddleware(initialOptions);
 	fastify.addHook("preHandler", async (request, reply) => {
@@ -29,11 +52,22 @@ const RpcPlugin = (fastify, initialOptions, done) => {
 const rpcPlugin = fp(RpcPlugin, { name: "uni-rpc-fastify-plugin" });
 //#endregion
 //#region src/fastify/helpers.ts
+/**
+* Convenience function to load RPC config and register the RPC plugin to a Fastify instance.
+* Dynamically imports loadRPCConfig and registers the fastify-rpc plugin.
+* @param app - Fastify instance
+*/
 async function attachRPC(app) {
 	const { loadRPCConfig } = await import("@thednp/rpc");
 	const { adapter: _adapter, ...options } = await loadRPCConfig();
 	await app.register(rpcPlugin, options);
 }
+/**
+* Attaches Vite's dev server middlewares to a Fastify instance for development mode.
+* Uses an `onRequest` hook to delegate to Vite's connect-compatible middleware stack.
+* @param app - Fastify instance
+* @param vite - Running Vite dev server
+*/
 function attachVite(app, vite) {
 	app.addHook("onRequest", async (request, reply) => {
 		const next = () => new Promise((resolve) => {
@@ -42,6 +76,12 @@ function attachVite(app, vite) {
 		await next();
 	});
 }
+/**
+* Reads and parses the HTTP request body from a Fastify request.
+* If Fastify's body parser already consumed the stream, uses the pre-parsed body from `req.body`.
+* @param req - Fastify request object
+* @returns A promise resolving to the parsed body with its content type
+*/
 const readBody = (req) => {
 	return new Promise((resolve, reject) => {
 		const contentType = req.headers["content-type"]?.toLowerCase() || "";
@@ -91,10 +131,16 @@ const readBody = (req) => {
 //#region src/fastify/createMiddleware.ts
 let middlewareCount = 0;
 const middlewareStack = /* @__PURE__ */ new Set();
+/**
+* Creates a Fastify preHandler hook with optional path and rpcPrefix filtering.
+* Middleware names are deduplicated. Prefix and path regexes are compiled once at creation time.
+* @param initialOptions - Options for rpcPrefix, path matching, and the handler function
+* @returns A Fastify preHandler hook function
+*/
 const createMiddleware = (initialOptions = {}) => {
 	const options = Object.assign({}, defaultMiddlewareOptions, initialOptions);
 	const middlewareName = options.name;
-	const rpcPreffix = options.rpcPreffix;
+	const rpcPrefix = options.rpcPrefix;
 	const path = options.path;
 	const handler = options.handler;
 	let name = middlewareName;
@@ -102,11 +148,11 @@ const createMiddleware = (initialOptions = {}) => {
 		name = "viteRPCMiddleware-" + middlewareCount;
 		middlewareCount += 1;
 	}
-	if (middlewareStack.has(name)) throw new Error(`The middleware name "${name}" is already used.`);
+	if (middlewareStack.has(name)) throw new Error(MIDDLEWARE_NAME_USED(name));
 	middlewareStack.add(name);
-	const prefixRegex = rpcPreffix ? new RegExp(`^/${escapeRegExp(rpcPreffix)}/`) : null;
+	const prefixRegex = rpcPrefix ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`) : null;
 	const pathMatcher = path ? typeof path === "string" ? new RegExp(path) : path : null;
-	const middlewareHandler = async (req, _reply, done) => {
+	const middlewareHandler = async (req, reply, done) => {
 		const url = new URL(req.url, "http://localhost").pathname;
 		if (serverFunctionsMap.size === 0) await scanForServerFiles();
 		if (!handler) {
@@ -121,39 +167,64 @@ const createMiddleware = (initialOptions = {}) => {
 			done();
 			return;
 		}
-		await handler(req, _reply, done);
+		await handler(req, reply, done);
 	};
 	Object.defineProperty(middlewareHandler, "name", { value: name });
 	return middlewareHandler;
 };
+/**
+* Creates the Fastify RPC middleware that routes incoming requests to registered server functions.
+* Wraps the generic createMiddleware with the RPC handler that reads the body, dispatches
+* to the matching function, and sends the JSON-serialized result.
+* @param initialOptions - Options including rpcPrefix for URL routing
+* @returns A Fastify preHandler hook function
+*/
 const createRPCMiddleware = (initialOptions = {}) => {
-	const options = Object.assign({}, defaultMiddlewareOptions, { rpcPreffix: defaultRPCOptions.rpcPreffix }, initialOptions);
-	const rpcPreffix = options.rpcPreffix;
-	const prefixRegex = rpcPreffix ? new RegExp(`^/${escapeRegExp(rpcPreffix)}/`) : null;
-	const prefixReplace = `/${rpcPreffix}/`;
+	const options = Object.assign({}, defaultMiddlewareOptions, { rpcPrefix: defaultRPCOptions.rpcPrefix }, initialOptions);
+	const rpcPrefix = options.rpcPrefix;
+	const prefixRegex = rpcPrefix ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`) : null;
+	const prefixReplace = `/${rpcPrefix}/`;
 	return createMiddleware({
 		...options,
 		handler: async (req, reply, _done) => {
-			const url = new URL(req.url, "http://localhost").pathname;
+			const reqUrl = new URL(req.url, "http://localhost");
+			const url = reqUrl.pathname;
 			if (prefixRegex && !prefixRegex.test(url)) return;
+			const origin = options.origin;
+			const requestOrigin = req.headers.origin;
+			if (origin && requestOrigin && requestOrigin !== origin) {
+				reply.status(403).send({ error: REQUEST_FORBIDDEN });
+				return;
+			}
 			const functionName = url.replace(prefixReplace, "");
 			const serverFunction = serverFunctionsMap.get(functionName);
 			if (!serverFunction) {
-				reply.status(404).send({ error: "Function not found" });
+				reply.status(404).send({ error: FUNCTION_NOT_FOUND });
 				return;
 			}
 			try {
-				const body = await readBody(req);
-				const args = Array.isArray(body.data) ? body.data : [body.data];
+				const method = serverFunction.options?.method || "POST";
+				if (req.method.toUpperCase() !== method) {
+					reply.status(405).send({ error: METHOD_NOT_ALLOWED });
+					return;
+				}
+				let args = [];
+				if (method === "GET") {
+					const raw = reqUrl.searchParams.get("args");
+					if (raw) args = JSON.parse(raw);
+				} else {
+					const body = await readBody(req);
+					args = Array.isArray(body.data) ? body.data : [body.data];
+				}
 				const { data: dataResult, cancel } = serverFunction.handler(...args);
-				const onClose = () => cancel("client disconnected");
+				const onClose = () => cancel(CLIENT_DISCONNECTED);
 				req.raw.on("close", onClose);
 				const data = await dataResult;
 				req.raw.off("close", onClose);
 				if (!reply.raw.headersSent) reply.status(200).send({ data });
 			} catch (err) {
 				console.error(String(err));
-				reply.status(500).send({ error: "Internal Server Error" });
+				reply.status(500).send({ error: INTERNAL_SERVER_ERROR });
 			}
 		}
 	});