@thednp/rpc 0.0.1 → 0.0.4

package/dist/index.d.mts

@@ -1,53 +1,138 @@
 import { Connect, Plugin } from "vite";
 import { MiddlewareOptions as MiddlewareOptions$1, RpcPluginOptions as RpcPluginOptions$1 } from "@thednp/rpc";
 import { IncomingMessage, ServerResponse } from "node:http";
-import { NextFunction, Request, Response as Response$1 } from "express";
+import { NextFunction, Request, Response } from "express";
 import { MiddlewareHandler } from "hono";
 import "@hono/node-server";
+import "hono/factory";
 import { FastifyReply, FastifyRequest, HookHandlerDoneFunction } from "fastify";
 import { Context, Next } from "koa";
 //#region src/express/types.d.ts
+/**
+ * Express-specific middleware options, constrained to the `"express"` adapter.
+ */
 type ExpressMiddlewareOptions = MiddlewareOptions$1<"express">;
+/**
+ * Express middleware factory: takes optional initial options and returns
+ * the Express/Connect-compatible handler.
+ */
 type ExpressMiddlewareFn = <A extends RpcPluginOptions$1["adapter"] = "express">(initialOptions?: Partial<ExpressMiddlewareOptions>) => ExpressMiddlewareHooks["handler"];
+/**
+ * Express/Connect middleware handler signature used by the RPC middleware.
+ */
 interface ExpressMiddlewareHooks {
-  handler: (req: IncomingMessage | Request, res: ServerResponse | Response$1, next: Connect.NextFunction | NextFunction) => Promise<void>;
+  /**
+   * The handler invoked for each matched request.
+   * @param req - Node or Express request object
+   * @param res - Node or Express response object
+   * @param next - Connect or Express next function
+   */
+  handler: (req: IncomingMessage | Request, res: ServerResponse | Response, next: Connect.NextFunction | NextFunction) => Promise<void>;
 }
 //#endregion
 //#region src/hono/types.d.ts
+/**
+ * Hono middleware handler signature used by the RPC middleware.
+ */
 interface HonoMiddlewareHooks {
+  /** Hono middleware handler */
   handler: MiddlewareHandler;
 }
+/**
+ * Hono middleware factory: takes optional initial options and returns
+ * the Hono-compatible handler.
+ */
 type HonoMiddlewareFn = <A extends RpcPluginOptions$1["adapter"] = "hono">(initialOptions?: Partial<MiddlewareOptions$1<A>>) => HonoMiddlewareHooks["handler"];
 //#endregion
 //#region src/fastify/types.d.ts
+/**
+ * Fastify-specific middleware options, constrained to the `"fastify"` adapter.
+ */
 type FastifyMiddlewareOptions = MiddlewareOptions$1<"fastify">;
+/**
+ * Fastify middleware factory: takes optional initial options and returns
+ * the Fastify-compatible handler.
+ */
 type FastifyMiddlewareFn = <A extends RpcPluginOptions$1["adapter"] = "fastify">(initialOptions?: Partial<FastifyMiddlewareOptions>) => FastifyMiddlewareHooks["handler"];
+/**
+ * Fastify middleware handler signature used by the RPC middleware.
+ */
 interface FastifyMiddlewareHooks {
+  /**
+   * The handler invoked for each matched request.
+   * @param req - Fastify request object
+   * @param res - Fastify reply object
+   * @param done - Fastify hook completion callback
+   */
   handler: (req: FastifyRequest, res: FastifyReply, done: HookHandlerDoneFunction) => Promise<void>;
 }
 //#endregion
 //#region src/koa/types.d.ts
+/**
+ * Koa-specific middleware options, constrained to the `"koa"` adapter.
+ */
 type KoaMiddlewareOptions = MiddlewareOptions$1<"koa">;
+/**
+ * Koa middleware handler signature used by the RPC middleware.
+ */
 interface KoaMiddlewareHooks {
+  /**
+   * The handler invoked for each matched request.
+   * @param ctx - Koa context object
+   * @param next - Koa next function
+   */
   handler: (ctx: Context, next: Next) => Promise<void>;
 }
+/**
+ * Koa middleware factory: takes optional initial options and returns
+ * the Koa-compatible handler.
+ */
 type KoaMiddlewareFn = <A extends RpcPluginOptions$1["adapter"] = "koa">(initialOptions?: Partial<KoaMiddlewareOptions>) => KoaMiddlewareHooks["handler"];
 //#endregion
 //#region src/types.d.ts
+/**
+ * Maps each supported framework adapter to its middleware hooks (handler signatures).
+ * Used to keep the middleware options type-safe per adapter.
+ */
 interface FrameworkHooks {
+  /** Express/Connect middleware handler signature */
   express: ExpressMiddlewareHooks;
+  /** Hono middleware handler signature */
   hono: HonoMiddlewareHooks;
+  /** Fastify middleware handler signature */
   fastify: FastifyMiddlewareHooks;
+  /** Koa middleware handler signature */
   koa: KoaMiddlewareHooks;
 }
+/**
+ * Maps each supported framework adapter to its middleware factory function type.
+ */
 interface FrameworkMiddlewareFn {
+  /** Express/Connect middleware factory */
   express: ExpressMiddlewareFn;
+  /** Hono middleware factory */
   hono: HonoMiddlewareFn;
+  /** Fastify middleware factory */
   fastify: FastifyMiddlewareFn;
+  /** Koa middleware factory */
   koa: KoaMiddlewareFn;
 }
+/**
+ * Content types the RPC middleware accepts when reading request bodies.
+ * Only `application/json` and `text/plain` are currently supported.
+ */
 type SupportableContentType = "multipart/form-data" | "application/json" | "text/plain" | "application/octet-stream";
+/**
+ * Content types the RPC client modules send with each request.
+ */
 type ContentType = "application/json" | "text/plain";
+/**
+ * Fetch `credentials` policy used by the generated client modules.
+ */
+type Credentials = "same-origin" | "include" | "omit";
+/**
+ * Parsed request body result discriminated by content type.
+ */
 type BodyResult = {
   contentType: "application/json";
   data: JsonValue;
@@ -55,15 +140,47 @@ type BodyResult = {
   contentType: "text/plain";
   data: string;
 };
+/**
+ * Options for a single server function, controlling how the generated
+ * client module serializes the request body and sends credentials.
+ */
 interface ServerFunctionOptions {
+  /**
+   * Content type used for the request body.
+   * @default "application/json"
+   */
   contentType: ContentType;
+  /**
+   * Fetch credentials policy.
+   * @default "same-origin"
+   */
+  credentials?: Credentials;
+  /**
+   * HTTP method used for the RPC request.
+   * GET requests send arguments as an `?args=` JSON query parameter
+   * (a fetch request body is not allowed on GET).
+   * @default "POST"
+   */
+  method?: "GET" | "POST";
 }
 // primitives and their compositions
+/**
+ * Primitive JSON values, including `undefined` for optional parameters.
+ */
 type JsonPrimitive = string | number | boolean | null | undefined;
+/**
+ * A JSON object whose values are JSON values or arrays.
+ */
 type JsonObject = {
   [key: string]: JsonValue | JsonArray;
 };
+/**
+ * A JSON array of JSON values.
+ */
 type JsonArray = JsonValue[];
+/**
+ * Any JSON-serializable value: primitive, array, or object.
+ */
 type JsonValue = JsonPrimitive | JsonArray | JsonObject;
 // Keep these as a refference
 // Date strings are common in APIs
@@ -80,28 +197,55 @@ type JsonValue = JsonPrimitive | JsonArray | JsonObject;
 //   | Blob // for binary data
 //   | URLSearchParams; // for query parameters
 // export type ServerFnArgs = [JsonObject | JsonPrimitive, ...JsonArray];
+/**
+ * Arguments passed to a server function, spread as a JSON array.
+ */
 type ServerFnArgs = [...JsonArray];
+/**
+ * Server-side handler signature: receives the `AbortSignal` first,
+ * followed by any serializable arguments.
+ */
 type ServerFunction<TArgs extends JsonArray = JsonArray, TResult extends JsonValue = JsonValue> = (signal: AbortSignal, ...args: TArgs) => Promise<TResult>;
+/**
+ * Server function initialization signature, identical to `ServerFunction`.
+ * Used when registering a function with `createServerFunction`.
+ */
 type ServerFunctionInit<TArgs extends JsonArray = JsonArray, TResult extends JsonValue = JsonValue> = (signal: AbortSignal, ...args: TArgs) => Promise<TResult>;
+/**
+ * Client-side stub signature generated for each server function.
+ * Returns a promise-backed `data` handle plus a `cancel` function
+ * that aborts the underlying fetch request.
+ */
 type ClientFunction<TArgs extends JsonArray = JsonArray, TResult extends JsonValue = JsonValue> = (...args: TArgs) => {
+  /** Promise resolving to the server response data */
   data: Promise<TResult>;
+  /** Aborts the in-flight request with the given reason */
   cancel: (reason: string) => void;
 };
+/**
+ * A client function augmented with its registered export name and
+ * per-function options (content type, credentials).
+ */
 type ClientFunctionWithOptions = ClientFunction & {
+  /** Registered export name of the server function */
   name: string;
+  /** Per-function content type and credentials options */
   options?: ServerFunctionOptions;
 };
+/**
+ * Entry in the server functions map: registered name, client handler,
+ * optional per-function options, and the original export name.
+ */
 interface ServerFnEntry {
+  /** Registered RPC function name (used in the URL path) */
   name: string;
+  /** Client-side handler stub for this function */
   handler: ClientFunctionWithOptions;
+  /** Per-function content type and credentials options */
   options?: ServerFunctionOptions;
+  /** Original export name from the server module */
   exportName?: string;
 }
-interface CacheEntry<T> {
-  data?: T;
-  timestamp: number;
-  promise?: Promise<T>;
-}
 /**
  * ### @thednp/rpc
  * The plugin configuration allows for granular control of your
@@ -117,9 +261,9 @@ interface RpcPluginOptions {
    * @default "__rpc"
    * @example
    * // Results in endpoints like: /api/rpc/myFunction
-   * rpcPreffix: "api/rpc"
+   * rpcPrefix: "api/rpc"
    */
-  rpcPreffix: "__rpc" | string;
+  rpcPrefix: "__rpc" | string;
   /**
    * Option to set an adapter for the middleware connection. The default is _express_,
    * which is the most popular and battle tested server app. The _express_ adapter is
@@ -152,9 +296,17 @@ interface MiddlewareOptions<A extends RpcPluginOptions["adapter"] = "express"> {
    * @default string
    * @example
    * // Results in endpoints like: /api/rpc/myFunction
-   * rpcPreffix: "api/rpc"
+   * rpcPrefix: "api/rpc"
    */
-  rpcPreffix?: string | false;
+  rpcPrefix?: string | false;
+  /**
+   * Allowed request origin (e.g. "https://example.com").
+   * When set, any request carrying an `Origin` header that does not match
+   * is rejected with a 403 Forbidden response. Requests without an `Origin`
+   * header (curl, native clients) pass through unchecked.
+   * When unset (default), no origin validation is performed.
+   */
+  origin?: string;
   /**
    * Async handler for request processing.
    * Core middleware function that processes incoming requests.
@@ -177,16 +329,28 @@ interface MiddlewareOptions<A extends RpcPluginOptions["adapter"] = "express"> {
 //#endregion
 //#region src/index.d.ts
 /**
- * Utility to define `@thednp/rpc` configuration file similar to vite.
- * @param uniConfig a system wide RPC configuration
+ * Type-safe helper to create an RPC configuration object.
+ * Merges the provided partial config with built-in defaults.
+ * @param uniConfig - System-wide RPC configuration overrides
+ * @returns Complete RPC plugin options with defaults applied
+ */
+declare const defineConfig: (c: Partial<RpcPluginOptions>) => RpcPluginOptions;
+/**
+ * Loads the RPC configuration by searching for config files in the project root.
+ * Searches in order: `rpc.config.ts`, `rpc.config.js`, `rpc.config.mjs`, `rpc.config.mts`,
+ * `.rpcrc.ts`, `.rpcrc.js`. Falls back to defaults if none found.
+ * @param configFile - Optional explicit config file path; skips file search when provided
+ * @returns Resolved RPC plugin options
  */
-declare const defineConfig: (uniConfig: Partial<RpcPluginOptions>) => RpcPluginOptions;
+declare const loadRPCConfig: (f?: string) => Promise<RpcPluginOptions>;
 /**
- * Utility to load `@thednp/rpc` configuration file system wide.
- * @param configFile an optional parameter to specify a file within your project scope
+ * Vite plugin that enables automatic RPC generation.
+ * Transforms server function imports into fetch-based client stubs during development and production builds.
+ * In dev mode, attaches the RPC middleware to Vite's Connect server.
+ * @param devOptions - Development-only overrides (merged on top of config file values)
+ * @returns A Vite plugin object
  */
-declare function loadRPCConfig(configFile?: string): Promise<RpcPluginOptions>;
 declare function rpcPlugin(devOptions?: Partial<RpcPluginOptions>): Plugin<unknown>;
 //#endregion
-export { type BodyResult, type CacheEntry, type ClientFunction, type ClientFunctionWithOptions, type ContentType, type FrameworkHooks, type FrameworkMiddlewareFn, type JsonArray, type JsonObject, type JsonPrimitive, type JsonValue, type MiddlewareOptions, type RpcPluginOptions, type ServerFnArgs, type ServerFnEntry, type ServerFunction, type ServerFunctionInit, type ServerFunctionOptions, type SupportableContentType, rpcPlugin as default, defineConfig, loadRPCConfig };
+export { type BodyResult, type ClientFunction, type ClientFunctionWithOptions, type ContentType, type Credentials, type FrameworkHooks, type FrameworkMiddlewareFn, type JsonArray, type JsonObject, type JsonPrimitive, type JsonValue, type MiddlewareOptions, type RpcPluginOptions, type ServerFnArgs, type ServerFnEntry, type ServerFunction, type ServerFunctionInit, type ServerFunctionOptions, type SupportableContentType, rpcPlugin as default, defineConfig, loadRPCConfig };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/express/types.d.ts","../src/hono/types.d.ts","../src/fastify/types.d.ts","../src/koa/types.d.ts","../src/types.d.ts","../src/index.ts"],"mappings":";;;;;;;;;KAKY,2BAA2B;KAE3B,uBACV,UAAU,2CAEV,iBAAiB,QAAQ,8BACtB;UAEY;EACf,UACE,KAAK,kBAAkB,SACvB,KAAK,iBAAiB,YACtB,MAAM,QAAQ,eAAe,iBAC1B;;;;UCbU;EACf,SAAS;;KAGC,oBAAoB,UAAU,wCACxC,iBAAiB,QAAQ,oBAAkB,QACxC;;;KCJO,2BAA2B;KAE3B,uBACV,UAAU,2CAEV,iBAAiB,QAAQ,8BACtB;UAEY;EACf,UACE,KAAK,gBACL,KAAK,cACL,MAAM,4BACH;;;;KCZK,uBAAuB;UAMlB;EACf,UAAU,KAAK,SAAS,MAAM,SAAS;;KAG7B,mBAAmB,UAAU,uCACvC,iBAAiB,QAAQ,0BACtB;;;UCLY;EACf,SAAS;EACT,MAAM;EACN,SAAS;EACT,KAAK;;UAGU;EACf,SAAS;EACT,MAAM;EACN,SAAS;EACT,KAAK;;KAGK;KAMA;KAEA;EACN;EAAiC,MAAM;;EACvC;EAA2B;;UAEhB;EACf,aAAa;;;KAIH;KACA;GAAgB,cAAc,YAAY;;KAC1C,YAAY;KACZ,YAAY,gBAAgB,YAAY;;;;;;;;;;;;;;;;KAoBxC,mBAAmB;KAEnB,eACV,cAAc,YAAY,WAC1B,gBAAgB,YAAY,cACzB,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;KAEzC,mBACV,cAAc,YAAY,WAC1B,gBAAgB,YAAY,cACzB,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;KAEzC,eACV,cAAc,YAAY,WAC1B,gBAAgB,YAAY,iBACtB,MAAM;EACZ,MAAM,QAAQ;EACd,SAAS;;KAGC,4BAA4B;EACtC;EACA,UAAU;;UAGK;EACf;EACA,SAAS;EACT,UAAU;EACV;;UAGe,WAAW;EAC1B,OAAO;EACP;EACA,UAAU,QAAQ;;;;;;;;UASH;;;;;;;;;;;EAWf;;;;;;;EAQA;;UAGe,kBACf,UAAU;;;;EAKV;;;;;;;;;;;;EAaA,gBAAgB;;;;;;;;;;EAWhB;;;;;;;;;;;;;;;;;;EAmBA,UAAU,eAAe;;;;;;;;cC1JrB,eAAY,WAAe,QAAQ,sBACa;;;;;iBASvC,cAAc,sBAAmB,QAAA;iBA0FvC,UACP,aAAY,QAAQ,oBACnB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/express/types.d.ts","../src/hono/types.d.ts","../src/fastify/types.d.ts","../src/koa/types.d.ts","../src/types.d.ts","../src/index.ts"],"mappings":";;;;;;;;;;;;;KAgBY,2BAA2B;;;;;KAM3B,uBACV,UAAU,2CAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,kBAAkB,SACvB,KAAK,iBAAiB,UACtB,MAAM,QAAQ,eAAe,iBAC1B;;;;;;;UC/BU;;EAEf,SAAS;;;;;;KAOC,oBAAoB,UAAU,wCACxC,iBAAiB,QAAQ,oBAAkB,QACxC;;;;;;KCZO,2BAA2B;;;;;KAM3B,uBACV,UAAU,2CAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,gBACL,KAAK,cACL,MAAM,4BACH;;;;;;;KCzBK,uBAAuB;;;;UAalB;;;;;;EAMf,UAAU,KAAK,SAAS,MAAM,SAAS;;;;;;KAO7B,mBAAmB,UAAU,uCACvC,iBAAiB,QAAQ,0BACtB;;;;;;;UCpBY;;EAEf,SAAS;;EAET,MAAM;;EAEN,SAAS;;EAET,KAAK;;;;;UAMU;;EAEf,SAAS;;EAET,MAAM;;EAEN,SAAS;;EAET,KAAK;;;;;;KAOK;;;;KASA;;;;KAKA;;;;KAKA;EACN;EAAiC,MAAM;;EACvC;EAA2B;;;;;;UAMhB;;;;;EAKf,aAAa;;;;;EAKb,cAAc;;;;;;;EAOd;;;;;;KAOU;;;;KAIA;GAAgB,cAAc,YAAY;;;;;KAI1C,YAAY;;;;KAIZ,YAAY,gBAAgB,YAAY;;;;;;;;;;;;;;;;;;;KAuBxC,mBAAmB;;;;;KAMnB,eACV,cAAc,YAAY,WAC1B,gBAAgB,YAAY,cACzB,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;;;;;KAMzC,mBACV,cAAc,YAAY,WAC1B,gBAAgB,YAAY,cACzB,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;;;;;;KAOzC,eACV,cAAc,YAAY,WAC1B,gBAAgB,YAAY,iBACtB,MAAM;;EAEZ,MAAM,QAAQ;;EAEd,SAAS;;;;;;KAOC,4BAA4B;;EAEtC;;EAEA,UAAU;;;;;;UAOK;;EAEf;;EAEA,SAAS;;EAET,UAAU;;EAEV;;;;;;;;UASe;;;;;;;;;;;EAWf;;;;;;;EAQA;;UAGe,kBACf,UAAU;;;;EAKV;;;;;;;;;;;;EAaA,gBAAgB;;;;;;;;;;EAWhB;;;;;;;;EASA;;;;;;;;;;;;;;;;;;EAmBA,UAAU,eAAe;;;;;;;;;;cC7OrB,eAAe,GAAG,QAAQ,sBAAsB;;;;;;;;cAehD,gBAAgB,eAAe,QAAQ;;;;;;;;iBA4FpC,UACP,aAAY,QAAQ,oBACnB"}

package/dist/index.mjs

@@ -5,15 +5,23 @@ import { existsSync } from "node:fs";
 import { getClientModules, scanForServerFiles, serverFunctionsMap } from "@thednp/rpc/server";
 //#region src/options.ts
 const defaultRPCOptions = {
-	rpcPreffix: "__rpc",
+	rpcPrefix: "__rpc",
 	adapter: "express"
 };
 const defaultMiddlewareOptions = {
-	rpcPreffix: void 0,
-	path: void 0
+	rpcPrefix: void 0,
+	path: void 0,
+	origin: void 0
 };
 //#endregion
 //#region src/express/helpers.ts
+/**
+* Reads and parses the HTTP request body from an Express or Node IncomingMessage.
+* If a body parser middleware (e.g. express.json()) already consumed the stream,
+* uses the pre-parsed body from `req.body`.
+* @param req - Express or Node.js IncomingMessage
+* @returns A promise resolving to the parsed body with its content type
+*/
 const readBody = (req) => {
 	return new Promise((resolve, reject) => {
 		if (hasPreParsedBody(req) && req.body !== void 0) {
@@ -57,15 +65,37 @@ const readBody = (req) => {
 		toggleListeners(true);
 	});
 };
+/**
+* Type guard that checks whether a request is an Express Request (has `originalUrl`).
+* @param req - A Node IncomingMessage or Express Request
+* @returns True if the request is an Express Request
+*/
 const isExpressRequest = (req) => {
 	return "originalUrl" in req;
 };
+/**
+* Type guard that checks whether a response is an Express Response (has `json` and `send` methods).
+* @param res - A Node ServerResponse or Express Response
+* @returns True if the response is an Express Response
+*/
 const isExpressResponse = (res) => {
 	return "json" in res && "send" in res;
 };
+/**
+* Type guard that checks whether a request has a pre-parsed body (`body` property).
+* Used to detect if a body-parser middleware already consumed the stream.
+* @param req - A Node IncomingMessage or Express Request
+* @returns True if the request has a body property
+*/
 const hasPreParsedBody = (req) => {
 	return "body" in req;
 };
+/**
+* Extracts normalized request details from an Express or Node IncomingMessage.
+* Parses the URL to extract pathname, search string, and search params.
+* @param request - Express or Node.js request object
+* @returns Normalized request details including URL, headers, and method
+*/
 const getRequestDetails = (request) => {
 	const rawUrl = isExpressRequest(request) ? request.originalUrl : request.url;
 	const url = new URL(rawUrl, "http://localhost");
@@ -77,6 +107,12 @@ const getRequestDetails = (request) => {
 		method: request.method
 	};
 };
+/**
+* Wraps an Express or Node ServerResponse with a uniform API for setting headers,
+* status codes, and sending JSON responses. Handles the Express vs raw Node API differences.
+* @param response - Express or Node.js server response object
+* @returns A ResponseDetails object with setHeader, setStatusCode, and sendResponse helpers
+*/
 const getResponseDetails = (response) => {
 	const isResponseSent = response.headersSent || response.writableEnded;
 	const setHeader = (name, value) => {
@@ -103,17 +139,44 @@ const getResponseDetails = (response) => {
 };
 //#endregion
 //#region src/tools.ts
+/**
+* Escapes special regex metacharacters in a string.
+* Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,
+* preventing ReDoS and regex injection attacks.
+* @param s - The raw string to escape
+* @returns The escaped string safe for use in new RegExp()
+*/
 function escapeRegExp(s) {
 	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 //#endregion
+//#region src/constants.ts
+const FUNCTION_NOT_FOUND = "Function not found";
+const METHOD_NOT_ALLOWED = "Method Not Allowed";
+const REQUEST_FORBIDDEN = "Forbidden";
+const INTERNAL_SERVER_ERROR = "Internal Server Error";
+const CLIENT_DISCONNECTED = "client disconnected";
+/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */
+const MIDDLEWARE_NAME_USED = (name) => `The middleware name "${name}" is already used.`;
+/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */
+const CONFIG_FILE_NOT_FOUND = (configFile, configFilePath) => `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;
+const NO_CONFIG_FOUND = ` ⚡︎ No RPC config found, loading the defaults..`;
+const FAILED_LOAD_CONFIG = ` ⚠︎ Failed to load RPC config:`;
+//#endregion
 //#region src/express/createMiddleware.ts
 let middlewareCount = 0;
 const middlewareStack = /* @__PURE__ */ new Set();
+/**
+* Creates an Express middleware with optional path and rpcPrefix filtering.
+* Middleware names are deduplicated — reusing a name throws an error.
+* Prefix and path regexes are compiled once at creation time (hoisted) for performance.
+* @param initialOptions - Options for rpcPrefix, path matching, and the handler function
+* @returns An Express middleware function
+*/
 const createMiddleware = (initialOptions = {}) => {
 	const options = Object.assign({}, defaultMiddlewareOptions, initialOptions);
 	const middlewareName = options.name;
-	const rpcPreffix = options.rpcPreffix;
+	const rpcPrefix = options.rpcPrefix;
 	const path = options.path;
 	const handler = options.handler;
 	let name = middlewareName;
@@ -121,56 +184,86 @@ const createMiddleware = (initialOptions = {}) => {
 		name = "viteRPCMiddleware-" + middlewareCount;
 		middlewareCount += 1;
 	}
-	if (middlewareStack.has(name)) throw new Error(`The middleware name "${name}" is already used.`);
+	if (middlewareStack.has(name)) throw new Error(MIDDLEWARE_NAME_USED(name));
 	middlewareStack.add(name);
-	const prefixRegex = rpcPreffix ? new RegExp(`^/${escapeRegExp(rpcPreffix)}/`) : null;
+	const prefixRegex = rpcPrefix ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`) : null;
 	const pathMatcher = path ? typeof path === "string" ? new RegExp(path) : path : null;
-	const middlewareHandler = async (req, _res, next) => {
+	const middlewareHandler = async (req, res, next) => {
 		const { url } = getRequestDetails(req);
 		if (serverFunctionsMap.size === 0) await scanForServerFiles();
 		if (!handler) return next?.();
 		if (pathMatcher && !pathMatcher.test(url)) return next?.();
 		if (prefixRegex && !prefixRegex.test(url)) return next?.();
-		await handler(req, _res, next);
+		await handler(req, res, next);
 	};
 	Object.defineProperty(middlewareHandler, "name", { value: name });
 	return middlewareHandler;
 };
+/**
+* Creates the Express RPC middleware that routes incoming requests to registered server functions.
+* Reads the request body, dispatches to the matching function via serverFunctionsMap,
+* and sends the JSON-serialized result. Handles client disconnection via abort signals.
+* @param initialOptions - Options including rpcPrefix for URL routing
+* @returns An Express middleware function
+*/
 const createRPCMiddleware = (initialOptions = {}) => {
-	const options = Object.assign({}, defaultMiddlewareOptions, { rpcPreffix: defaultRPCOptions.rpcPreffix }, initialOptions);
-	const rpcPreffix = options.rpcPreffix;
-	const prefixRegex = rpcPreffix ? new RegExp(`^/${escapeRegExp(rpcPreffix)}/`) : null;
-	const prefixReplace = `/${rpcPreffix}/`;
+	const options = Object.assign({}, defaultMiddlewareOptions, { rpcPrefix: defaultRPCOptions.rpcPrefix }, initialOptions);
+	const rpcPrefix = options.rpcPrefix;
+	const prefixRegex = rpcPrefix ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`) : null;
+	const prefixReplace = `/${rpcPrefix}/`;
 	return createMiddleware({
 		...options,
 		handler: async (req, res, _next) => {
-			const { url } = getRequestDetails(req);
+			const { url: path, searchParams } = getRequestDetails(req);
 			const { sendResponse } = getResponseDetails(res);
-			if (prefixRegex && !prefixRegex.test(url)) return;
-			const functionName = url.replace(prefixReplace, "");
+			if (prefixRegex && !prefixRegex.test(path)) return;
+			const origin = options.origin;
+			const requestOrigin = req.headers.origin;
+			if (origin && requestOrigin && requestOrigin !== origin) {
+				sendResponse(403, { error: REQUEST_FORBIDDEN });
+				return;
+			}
+			const functionName = path.replace(prefixReplace, "");
 			const serverFunction = serverFunctionsMap.get(functionName);
 			if (!serverFunction) {
-				sendResponse(404, { error: "Function not found" });
+				sendResponse(404, { error: FUNCTION_NOT_FOUND });
 				return;
 			}
 			try {
-				const body = await readBody(req);
-				const args = Array.isArray(body.data) ? body.data : [body.data];
+				const method = serverFunction.options?.method || "POST";
+				if (req.method?.toUpperCase() !== method) {
+					sendResponse(405, { error: METHOD_NOT_ALLOWED });
+					return;
+				}
+				let args = [];
+				if (method === "GET") {
+					const raw = searchParams.get("args");
+					if (raw) args = JSON.parse(raw);
+				} else {
+					const body = await readBody(req);
+					args = Array.isArray(body.data) ? body.data : [body.data];
+				}
 				const { data, cancel } = serverFunction.handler(...args);
-				const onClose = () => cancel("client disconnected");
+				const onClose = () => cancel(CLIENT_DISCONNECTED);
 				req.on("close", onClose);
 				const result = await data;
 				req.off("close", onClose);
 				if (!res.headersSent) sendResponse(200, { data: result });
 			} catch (err) {
 				console.error(String(err));
-				sendResponse(500, { error: "Internal Server Error" });
+				sendResponse(500, { error: INTERNAL_SERVER_ERROR });
 			}
 		}
 	});
 };
 //#endregion
 //#region src/index.ts
+/**
+* Loads and transforms a single RPC config file using Vite's config loader.
+* @param env - Vite config environment
+* @param file - Config file path (e.g. "rpc.config.ts")
+* @returns The loaded config augmented with the configFile path, or null on failure
+*/
 const loadConfigFile = async (env, file) => {
 	const result = await loadConfigFromFile(env, file);
 	return result ? {
@@ -182,18 +275,23 @@ const loadConfigFile = async (env, file) => {
 	} : null;
 };
 /**
-* Utility to define `@thednp/rpc` configuration file similar to vite.
-* @param uniConfig a system wide RPC configuration
+* Type-safe helper to create an RPC configuration object.
+* Merges the provided partial config with built-in defaults.
+* @param uniConfig - System-wide RPC configuration overrides
+* @returns Complete RPC plugin options with defaults applied
 */
 const defineConfig = (uniConfig) => {
 	return mergeConfig(defaultRPCOptions, uniConfig);
 };
 let RPCConfig;
 /**
-* Utility to load `@thednp/rpc` configuration file system wide.
-* @param configFile an optional parameter to specify a file within your project scope
+* Loads the RPC configuration by searching for config files in the project root.
+* Searches in order: `rpc.config.ts`, `rpc.config.js`, `rpc.config.mjs`, `rpc.config.mts`,
+* `.rpcrc.ts`, `.rpcrc.js`. Falls back to defaults if none found.
+* @param configFile - Optional explicit config file path; skips file search when provided
+* @returns Resolved RPC plugin options
 */
-async function loadRPCConfig(configFile) {
+const loadRPCConfig = async (configFile) => {
 	try {
 		const env = {
 			command: "serve",
@@ -211,7 +309,7 @@ async function loadRPCConfig(configFile) {
 		if (configFile) {
 			const configFilePath = resolve(env.root, configFile);
 			if (!existsSync(configFilePath)) {
-				console.warn(`  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`);
+				console.warn(CONFIG_FILE_NOT_FOUND(configFile, configFilePath));
 				RPCConfig = defaultRPCOptions;
 				return defaultRPCOptions;
 			}
@@ -239,13 +337,20 @@ async function loadRPCConfig(configFile) {
 			}
 		}
 		RPCConfig = defaultRPCOptions;
-		console.warn(` ⚡︎ No RPC config found, loading the defaults..`);
+		console.warn(NO_CONFIG_FOUND);
 	} catch (error) {
 		RPCConfig = defaultRPCOptions;
-		console.warn(` ⚠︎ Failed to load RPC config:`, error);
+		console.warn(FAILED_LOAD_CONFIG, error);
 	}
 	return RPCConfig;
-}
+};
+/**
+* Vite plugin that enables automatic RPC generation.
+* Transforms server function imports into fetch-based client stubs during development and production builds.
+* In dev mode, attaches the RPC middleware to Vite's Connect server.
+* @param devOptions - Development-only overrides (merged on top of config file values)
+* @returns A Vite plugin object
+*/
 function rpcPlugin(devOptions = {}) {
 	let options;
 	let config;
@@ -255,7 +360,8 @@ function rpcPlugin(devOptions = {}) {
 		name: "vite-plugin-universal-rpc",
 		enforce: "pre",
 		async configResolved(resolvedConfig) {
-			options = mergeConfig(await loadRPCConfig(), devOptions);
+			const uniConfig = await loadRPCConfig();
+			options = mergeConfig(uniConfig, devOptions);
 			config = resolvedConfig;
 		},
 		async configureServer(server) {
@@ -276,7 +382,7 @@ function rpcPlugin(devOptions = {}) {
 			const transformer = isOxc ? "transformWithOxc" : "transformWithEsbuild";
 			const langProp = isOxc ? "lang" : "loader";
 			const source = getClientModules({
-				rpcPreffix: options.rpcPreffix,
+				rpcPrefix: options.rpcPrefix,
 				adapter: options.adapter
 			});
 			const result = await vite[transformer](source, id, {