@thednp/rpc 0.1.0 → 0.2.0

package/dist/server/server.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.mts","names":[],"sources":["../../src/types.d.ts","../../src/functionsMap.ts","../../src/scanForServerFiles.ts","../../src/createFunction.ts","../../src/getClientModules.ts","../../src/server-helpers.ts","../../src/options.ts"],"mappings":";;;;;;;;;;;;;KA2DY;;;;KAQA;;;;;UAcK;;;;;EAKf,aAAa;;;;;EAKb,cAAc;;;;;;;EAOd;;;;;;KAOU;;;;KAIA;GAAgB,cAAc,YAAY;;;;;KAI1C,aAAa,WAAW;;;;KAIxB,YAAY,gBAAgB,YAAY;;;;;KAsCxC,mBACV,cAAc,WAAW,YAAY,WACrC,gBAAgB,YAAY,cACzB,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;;;;;;KAOzC,eACV,cAAc,YAAY,WAC1B,gBAAgB,YAAY,iBACtB,MAAM;;EAEZ,MAAM,QAAQ;;EAEd,SAAS;;;;;;KAOC,4BAA4B;;EAEtC;;EAEA,UAAU;;;;;UAMK;;EAEf;;EAEA;;;;;KAMU,aAAa,KAAK;EAC5B;EACA,SAAS,QAAQ;EACjB;EACA;;;;;;UAOe;;EAEf;;EAEA,SAAS;;EAET,UAAU;;EAEV;;;;;;;;UASe;;;;;;;;;;;EAWf;;;;;;;EAQA;;;;;;;EAQA;;;;;;;EAQA;;;;cCpQW,oBAAoB,YAAY;;;;cCgBhC,oBAAoB;;;;;;;;;;;;cAepB,qBAAkB,aAChB,YAAU,YACX,kBACX;;;;;;;;;;;;iBCfa,qBACd,cAAc,YAAY,WAC1B,gBAAgB,YAAY,WAE5B,cACA,SAAS,mBAAmB,OAAO,UACnC,YAAW,QAAQ,yBAClB,eAAe,OAAO;;;;;;;;;;cC0DZ,mBAAgB,gBACX;;;;;;;cC1EL,gBAAa,gBAAwB;;;;;;cA4BrC,iBAAiB;;EAE5B;;EAEA,OAAO;EACP,YAAY,iBAAiB,eAAmB,OAAO;;;;;;;;cAc5C,cAAW,cACV,0BAEX;;;cCzDU;;;;;cAMA,mBAAmB;cAOnB"}
+{"version":3,"file":"server.d.mts","names":[],"sources":["../../src/types.d.ts","../../src/functionsMap.ts","../../src/scanForServerFiles.ts","../../src/createFunction.ts","../../src/getClientModules.ts","../../src/server-helpers.ts","../../src/context.ts","../../src/options.ts"],"mappings":";;;;;;;;;;;;;;;KAkEY;;;;KASA;;;;;UAkBK;;;;;EAKf,aAAa;;;;;EAKb,cAAc;;;;;;;EAOd;;;;;;KAOU;;;;KAIA;GAAgB,cAAc,YAAY;;;;;KAI1C,aAAa,WAAW;;;;KAIxB,YAAY,gBAAgB,YAAY;;;;;KAsCxC,mBACV,cAAc,WAAW,YAAY,WACrC,gBAAgB,YAAY,cACzB,QAAQ,gBAAgB,MAAM,UAAU,QAAQ;;;;;;KAOzC,eACV,cAAc,YAAY,WAC1B,gBAAgB,YAAY,iBACtB,MAAM;;EAEZ,MAAM,QAAQ;;EAEd,SAAS;;;;;;KAOC,4BAA4B;;EAEtC;;EAEA,UAAU;;;;;UAMK;;EAEf;;EAEA;;;;;KAMU,aAAa,KAAK;EAC5B;EACA,SAAS,QAAQ;EACjB;EACA;;;;;;UAOe;;EAEf;;EAEA,SAAS;;EAET,UAAU;;EAEV;;;;;;;;UASe;;;;;;;;;;;EAWf;;;;;;;EAQA;;;;;;;EAQA;;;;;;;EAQA;;;;cChRW,oBAAoB,YAAY;;;;cCehC,oBAAoB;;;;;;;;;;;;cAepB,qBAAkB,aAChB,YAAU,YACX,kBACX;;;;;;;;;;;;iBCda,qBACd,cAAc,YAAY,WAC1B,gBAAgB,YAAY,WAE5B,cACA,SAAS,mBAAmB,OAAO,UACnC,YAAW,QAAQ,yBAClB,eAAe,OAAO;;;;;;;;;;cCgEZ,mBAAgB,gBACX;;;;;;;cChFL,gBAAa,gBAAwB;;;;;;cA4BrC,iBAAiB;;EAE5B;;EAEA,OAAO;EACP,YAAY,iBAAiB,eAAmB,OAAO;;;;;;;;;;cAgB5C,cAAW,cACV,0BAEX;;;;;;;cAqBU,oBAAiB;;;;;;;;;;;cAcjB,yBAAsB,UACvB,aAAW;;;;;;;;iBAqBP,aAAa;;;;;;;;;;;;;;;;;;;UC9FZ;;EAEf;;EAEA;;EAEA;;;;;;;EAOA,WAAW,kBAAkB;;;;;EAK7B;IAAe;IAAkB;;;EAEjC,QAAQ;GACP;;;;;;;;;cAiBU,wBAAyB,GAAC,MAC/B,cAAY,UACR,MACT;;;;;;cAOU,yBAAwB;;;;;;;;;cAgBxB,WAAQ,kBAAoB;;;cCtF5B;;;;;cAMA,mBAAmB;cAOnB"}

package/dist/server/server.mjs

@@ -1,7 +1,7 @@
-import { createServer, normalizePath } from "vite";
 import { readdir } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import process from "node:process";
+import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/functionsMap.ts
 const serverFunctionsMap = /* @__PURE__ */ new Map();
 //#endregion
@@ -60,25 +60,58 @@ var RPCError = class extends Error {
 	}
 };
 /**
-* Formats an error for the RCP middleware response.
-* In development the full message and stack are included so developers
-* can quickly identify issues. In production only the generic
-* "Internal Server Error" is sent, preventing information disclosure.
+* Formats an error for the RPC middleware response.
+* In development the full `RPCError` payload is included so developers
+* can quickly identify issues. Unexpected exceptions never expose their
+* message — only the generic "Internal Server Error" is sent, preventing
+* information disclosure; server-side diagnostics are preserved via the
+* middleware's `console.error` logging.
 */
 const formatError = (err, isProduction) => {
-	if (!isProduction) {
-		if (err instanceof RPCError) {
-			const payload = {
-				error: err.message || "Internal Server Error",
-				code: err.code
-			};
-			if (err.data !== void 0) payload.data = err.data;
-			return payload;
-		}
-		return { error: (err instanceof Error ? err.message : String(err)) || "Internal Server Error" };
+	if (isProduction) return { error: INTERNAL_SERVER_ERROR };
+	if (err instanceof RPCError) {
+		const payload = {
+			error: err.message || "Internal Server Error",
+			code: err.code
+		};
+		if (err.data !== void 0) payload.data = err.data;
+		return payload;
 	}
 	return { error: INTERNAL_SERVER_ERROR };
 };
+/**
+* Checks whether a content type maps to a form encoding
+* (`multipart/form-data` or `application/x-www-form-urlencoded`).
+* Form-declared functions accept either encoding so native browser
+* submissions (urlencoded) keep working without JavaScript.
+*/
+const isFormContentType = (contentType) => contentType === "multipart/form-data" || contentType === "application/x-www-form-urlencoded";
+/**
+* Detects whether an incoming request's `Content-Type` header conflicts
+* with the function's declared content type. JSON and text functions are
+* enforced strictly (exact match wins), while form functions accept both
+* form encodings because the nojs fallback submits urlencoded forms to
+* multipart-declared endpoints. Requests without a `Content-Type` header
+* (curl, GET, legacy clients) are exempt from enforcement.
+* @param declared - The declared `contentType` from the server function options
+* @param rawHeader - The raw `Content-Type` request header, if present
+*/
+const hasContentTypeMismatch = (declared, rawHeader) => {
+	if (!rawHeader) return false;
+	const incomingType = rawHeader.trim().toLowerCase().split(";")[0].trim();
+	if (isFormContentType(declared)) return !isFormContentType(incomingType);
+	return incomingType !== declared;
+};
+/**
+* Escapes special regex metacharacters in a string.
+* Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,
+* preventing ReDoS and regex injection attacks.
+* @param s - The raw string to escape
+* @returns The escaped string safe for use in new RegExp()
+*/
+function escapeRegExp(s) {
+	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 //#endregion
 //#region src/scanForServerFiles.ts
 let isScanned = false;
@@ -103,6 +136,7 @@ const EXACT_NAMES = [
 */
 const scanForServerFiles = async (initialCfg, devServer) => {
 	if (isScanned && !devServer) return;
+	const { createServer, normalizePath } = await import("vite");
 	const config = !initialCfg && !devServer || !initialCfg ? {
 		root: process.cwd(),
 		base: process.env.BASE || "/",
@@ -310,6 +344,10 @@ const getModule = (fnName, fnEntry, options) => {
 			body = `args[0]`;
 			headers = `{ 'Content-Type': 'text/plain' }`;
 			break;
+		case "application/x-www-form-urlencoded":
+			body = `new URLSearchParams(args[0]).toString()`;
+			headers = `{ 'Content-Type': 'application/x-www-form-urlencoded' }`;
+			break;
 		case "multipart/form-data":
 			body = `args[0]`;
 			headers = `{}`;
@@ -351,6 +389,46 @@ ${Array.from(serverFunctionsMap.entries()).filter(([, entry]) => entry.exportNam
 	})).join("\n")}`.trim();
 };
 //#endregion
-export { RPCError, createServerFunction, defaultMiddlewareOptions, defaultRPCOptions, defaultServerFnOptions, formatError, getClientModules, scanForServerFiles, scannedServerFiles, serverFunctionsMap, walkGlobFiles };
+//#region src/context.ts
+/** @module Server-side request context. Exports the `RequestEvent` shape, `provideRequestContext` to establish it around a dispatch, `getRequestContext` to read it from anywhere inside the async tree, and `redirect` for framework-level redirects. Never import this module in client code — it is server-only. */
+/**
+* Global symbol under which the shared `AsyncLocalStorage` instance is stored
+* on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable
+* across module copies and dev-server hot reloads, mirroring
+* `solid-js/web`'s own request-context storage.
+*/
+const requestContextSymbol = Symbol.for("thednp.rpc.requestContext");
+const requestContextStorage = globalThis[requestContextSymbol] ??= new AsyncLocalStorage();
+/**
+* Runs `cb` with `init` as the current request context. Use inside the
+* adapters around server-function dispatch (the async tree under `cb` can then
+* read the context via {@link getRequestContext}).
+* @param init - The request context for the duration of `cb`
+* @param cb - The work that needs access to the request context
+*/
+const provideRequestContext = (init, cb) => requestContextStorage.run(init, cb);
+/**
+* Returns the current request context, or throws when called outside of a
+* request (e.g. module scope or a background task).
+* @throws When no request context is established
+*/
+const getRequestContext = () => {
+	const ctx = requestContextStorage.getStore();
+	if (!ctx) throw new Error("RequestEvent is not available outside of a request");
+	return ctx;
+};
+/**
+* Redirects the current request to `location`. Reads the adapter-bound
+* `redirect` from the current request context — callable from anywhere inside
+* a server-function tree (no `res` threading needed).
+* @param location - The URL to redirect to
+* @param status - HTTP status code, defaults to `303 See Other`
+* @throws When called outside of a request
+*/
+const redirect = (location, status = 303) => {
+	getRequestContext().redirect(location, status);
+};
+//#endregion
+export { RPCError, createServerFunction, defaultMiddlewareOptions, defaultRPCOptions, defaultServerFnOptions, escapeRegExp, formatError, getClientModules, getRequestContext, hasContentTypeMismatch, isFormContentType, provideRequestContext, redirect, scanForServerFiles, scannedServerFiles, serverFunctionsMap, walkGlobFiles };
 
 //# sourceMappingURL=server.mjs.map

package/dist/server/server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"server.mjs","names":[],"sources":["../../src/functionsMap.ts","../../src/constants.ts","../../src/server-helpers.ts","../../src/scanForServerFiles.ts","../../src/options.ts","../../src/createFunction.ts","../../src/validate.ts","../../src/getClientModules.ts"],"sourcesContent":["import type { ServerFnEntry } from \"./types.d.ts\";\n\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = new Map<\n  string,\n  ServerFnEntry\n>();\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$][A-Za-z0-9_$/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND = ` ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = ` ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","/** @module Server-side utilities. Exports the `RPCError` class for typed server-side errors, `formatError` for middleware error responses, and `walkGlobFiles` for recursively discovering `*.server.*` files. Never import this module in client code — it is server-only. */\nimport type { JsonObject, JsonValue } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { INTERNAL_SERVER_ERROR } from \"./constants.ts\";\n\nconst GLOB_REGEX = /^.+\\.server\\.(ts|js|mjs|mts)$/;\n\n/**\n * Recursively walks `dir` and collects absolute paths to files whose\n * basename matches the `*.server.{ts,js,mjs,mts}` glob pattern.\n */\nexport const walkGlobFiles = async (dir: string): Promise<string[]> => {\n  const results: string[] = [];\n  const stack = [dir];\n  while (stack.length) {\n    const current = stack.pop()!;\n    let entries;\n    try {\n      entries = await readdir(current, { withFileTypes: true });\n    } catch (_e) {\n      continue;\n    }\n    for (const entry of entries) {\n      const fullPath = join(current, entry.name);\n      if (entry.isFile() && GLOB_REGEX.test(entry.name)) {\n        results.push(fullPath);\n      } else if (entry.isDirectory()) {\n        stack.push(fullPath);\n      }\n    }\n  }\n  return results;\n};\n\n/**\n * A typed error thrown from server functions.\n * The middleware serializes the `message` and `code` in the response,\n * allowing clients to recognise and handle specific error conditions.\n */\nexport class RPCError extends Error {\n  /** Machine-readable error code (e.g. \"VALIDATION_FAILED\", \"UNAUTHORIZED\") */\n  code: string;\n  /** Optional diagnostic payload */\n  data?: JsonValue;\n  constructor(message: string, code = \"INTERNAL\", data?: JsonValue) {\n    super(message);\n    this.name = \"RPCError\";\n    this.code = code;\n    this.data = data;\n  }\n}\n\n/**\n * Formats an error for the RCP middleware response.\n * In development the full message and stack are included so developers\n * can quickly identify issues. In production only the generic\n * \"Internal Server Error\" is sent, preventing information disclosure.\n */\nexport const formatError = (\n  err: unknown,\n  isProduction: boolean,\n): JsonObject => {\n  if (!isProduction) {\n    if (err instanceof RPCError) {\n      const payload: JsonObject = {\n        error: err.message || INTERNAL_SERVER_ERROR,\n        code: err.code,\n      };\n      if (err.data !== undefined) payload.data = err.data;\n      return payload;\n    }\n    const msg = err instanceof Error ? err.message : String(err);\n    return { error: msg || INTERNAL_SERVER_ERROR };\n  }\n  return { error: INTERNAL_SERVER_ERROR };\n};\n","import type { ViteDevServer } from \"vite\";\nimport type { ClientFunctionWithOptions, ScanConfig } from \"./types.d.ts\";\nimport { createServer, normalizePath } from \"vite\";\nimport { readdir } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport process from \"node:process\";\n\nimport { serverFunctionsMap } from \"./functionsMap.ts\";\nimport { walkGlobFiles } from \"./server-helpers.ts\";\nimport {\n  DUPLICATE_FUNCTION_NAME,\n  ERROR_LOADING_FILE,\n  NO_SERVER_FUNCTION_FOUND,\n} from \"./constants.ts\";\n\nlet isScanned = false;\n\n/** Absolute ids (normalized) of the scanned server function files. */\nexport const scannedServerFiles: Set<string> = new Set<string>();\n\nconst EXACT_NAMES = [\"server.ts\", \"server.js\", \"server.mjs\", \"server.mts\"];\n\n/**\n * Scans `src/api/` (or an explicit `scanRoot`) for server function files\n * and populates the global `serverFunctionsMap` with their exported functions.\n * Uses Vite's SSR module loading to resolve and execute each file.\n *\n * Supports two matching modes via `config.serverFiles`:\n *   `\"exact\"` — classic `server.ts|js|mjs|mts` names in the api directory\n *   `\"glob\"` — recursively walking `scanRoot` to match `*.server.{ts,js,mjs,mts}`\n * @param initialCfg - Optional Vite config overrides (root, base, server, serverFiles, scanRoot)\n * @param devServer - Optional running Vite dev server instance; when provided, skips creating a new one\n */\nexport const scanForServerFiles = async (\n  initialCfg?: ScanConfig,\n  devServer?: ViteDevServer,\n): Promise<void> => {\n  if (isScanned && !devServer) {\n    return;\n  }\n  const config = (!initialCfg && !devServer) || !initialCfg\n    ? {\n      root: process.cwd(),\n      base: process.env.BASE || \"/\",\n      server: { middlewareMode: true },\n    }\n    : {\n      ...initialCfg,\n    };\n\n  let server = devServer;\n  if (!server) {\n    server = await createServer({\n      server: { ...config.server, ws: false },\n      appType: \"custom\",\n      base: config.base || \"/\",\n      root: config.root || process.cwd(),\n      // The internal server is only used to load the server function files:\n      // skip the project config so its plugins (including this one) do not\n      // re-trigger a nested scan via `configureServer`.\n      configFile: false,\n      // The internal server never serves a page or HMR, so no dependency\n      // optimization or WebSocket server is needed. Without `ws: false`, the\n      // middleware-mode server creates a standalone HMR WebSocket on port\n      // 24678, and concurrent scans (e.g. the Express middleware's lazy scan\n      // racing the plugin scan) fail with EADDRINUSE. Without `noDiscovery`,\n      // the default optimizers scan the project entry and pre-bundle the whole\n      // `vite` package (imported by the linked @thednp/rpc dist files),\n      // hanging startup at 2+ GB RSS.\n      optimizeDeps: { noDiscovery: true },\n      ssr: { optimizeDeps: { noDiscovery: true } },\n    });\n  }\n\n  const root = config.root || process.cwd();\n  const resolvedScanRoot = resolve(\n    root,\n    (config as ScanConfig).scanRoot ?? join(root, \"src\", \"api\"),\n  );\n  const serverFiles: \"exact\" | \"glob\" = (config as ScanConfig).serverFiles ??\n    \"exact\";\n\n  // Names registered during this scan run, used for duplicate detection\n  // (see the registration loop below).\n  const seenNames = new Set<string>();\n\n  let files: string[];\n  try {\n    if (serverFiles === \"glob\") {\n      files = await walkGlobFiles(resolvedScanRoot);\n    } else {\n      files = (await readdir(resolvedScanRoot, { withFileTypes: true }))\n        .filter((f) => EXACT_NAMES.includes(f.name))\n        .map((f) => join(resolvedScanRoot, f.name));\n    }\n  } catch (_e) {\n    files = [];\n  }\n\n  try {\n    for (const file of files) {\n      scannedServerFiles.add(normalizePath(file));\n      let moduleExports: Record<string, ClientFunctionWithOptions>;\n      try {\n        moduleExports = (await server.ssrLoadModule(file)) as Record<\n          string,\n          ClientFunctionWithOptions\n        >;\n      } catch (error) {\n        console.error(ERROR_LOADING_FILE, file, error);\n        continue;\n      }\n      const moduleEntries = Object.entries(moduleExports);\n      if (!moduleEntries.length) {\n        console.warn(NO_SERVER_FUNCTION_FOUND);\n        return;\n      }\n\n      // `createServerFunction` auto-registers its name into the map at module\n      // load, so the global map cannot be used for duplicate detection across\n      // scans (dev re-scans the same modules via the same or fresh Vite graphs).\n      // Track names seen in THIS scan run only: a name repeated within one scan\n      // (e.g. two files exporting the same function name) is a genuine conflict.\n      for (const [exportName, exportValue] of moduleEntries) {\n        const registeredName = exportValue.name;\n        if (seenNames.has(registeredName)) {\n          if (process.env.NODE_ENV !== \"production\") {\n            throw new Error(DUPLICATE_FUNCTION_NAME(registeredName));\n          }\n          console.warn(DUPLICATE_FUNCTION_NAME(registeredName));\n          continue;\n        }\n        seenNames.add(registeredName);\n        serverFunctionsMap.set(registeredName, {\n          name: registeredName,\n          handler: exportValue,\n          options: exportValue?.options,\n          exportName,\n        });\n      }\n    }\n  } finally {\n    if (!devServer && server) {\n      await server.close();\n    }\n    isScanned = true;\n  }\n};\n","import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n} satisfies ServerFunctionOptions;\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: \"__rpc\",\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n} satisfies MiddlewareOptions;\n","// /@thednp/rpc/src/createFn.ts\nimport type {\n  ClientFunction,\n  JsonArray,\n  JsonValue,\n  ServerFunctionInit,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { serverFunctionsMap } from \"./functionsMap.ts\";\nimport { defaultServerFnOptions } from \"./options.ts\";\nimport { OPERATION_ABORTED } from \"./constants.ts\";\n\n/**\n * Creates a server-side RPC function.\n * Registers the function in the server functions map and returns a client-compatible\n * wrapper that exposes `data` (Promise) and `cancel` (function) for request lifecycle control.\n * @param name - Unique identifier used by the RPC router to dispatch requests\n * @param handler - The actual implementation receiving an AbortSignal followed by JSON-serializable arguments\n * @param fnOptions - Optional contentType and credentials settings\n * @returns A client stub with `data` promise and `cancel` method, auto-registered in the server map\n */\nexport function createServerFunction<\n  TArgs extends JsonArray = JsonArray,\n  TResult extends JsonValue = JsonValue,\n>(\n  name: string,\n  handler: ServerFunctionInit<TArgs, TResult>,\n  fnOptions: Partial<ServerFunctionOptions> = {},\n): ClientFunction<TArgs, TResult> {\n  const options = Object.assign({}, defaultServerFnOptions, fnOptions);\n\n  const wrappedFunction: ClientFunction<TArgs, TResult> = (...args: TArgs) => {\n    const controller = new AbortController();\n    const cancel = (reason: string) => controller.abort(reason);\n\n    const fetcher = async () => {\n      if (controller.signal.aborted) {\n        throw new Error(OPERATION_ABORTED);\n      }\n\n      return await handler(controller.signal, ...args);\n    };\n\n    return {\n      data: fetcher(),\n      cancel,\n    };\n  };\n\n  Object.defineProperties(wrappedFunction, {\n    name: { value: name, enumerable: true, configurable: false },\n    options: { value: options, enumerable: true, configurable: false },\n  });\n\n  serverFunctionsMap.set(\n    name,\n    {\n      name,\n      handler: wrappedFunction as never,\n      options,\n    },\n  );\n\n  return wrappedFunction;\n}\n","import type { Credentials } from \"./types.d.ts\";\nimport { INVALID_IDENTIFIER, INVALID_PATH_SEGMENT } from \"./constants.ts\";\n\nconst SAFE_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;\nconst SAFE_PATH_SEGMENT = /^[A-Za-z0-9_$@][A-Za-z0-9_$@/-]*$/;\nconst CREDENTIALS_VALUES: readonly Credentials[] = [\n  \"same-origin\",\n  \"include\",\n  \"omit\",\n];\n\n/**\n * Validates that a string is a safe JavaScript identifier.\n * Used to prevent code injection when interpolating export names into generated client code.\n * @param name - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"export name\")\n * @returns The validated name if it passes\n * @throws Error if the name contains characters outside /^[A-Za-z_$][A-Za-z0-9_$]*$/\n */\nexport function validateIdentifier(name: string, label: string): string {\n  if (!SAFE_IDENTIFIER.test(name)) {\n    throw new Error(INVALID_IDENTIFIER(label, name));\n  }\n  return name;\n}\n\n/**\n * Validates that a string is a safe path segment for RPC routing.\n * Allows alphanumeric characters, underscores, dollar signs, at signs, hyphens, and forward slashes.\n * @param segment - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"rpcPrefix\")\n * @returns The validated segment if it passes\n * @throws Error if the segment contains disallowed characters\n */\nexport function validatePathSegment(segment: string, label: string): string {\n  if (!SAFE_PATH_SEGMENT.test(segment)) {\n    throw new Error(INVALID_PATH_SEGMENT(label, segment));\n  }\n  return segment;\n}\n\n/**\n * Validates and normalizes the credentials option.\n * Accepts \"same-origin\", \"include\", or \"omit\"; defaults to \"same-origin\" when undefined.\n * @param value - Credentials value to validate\n * @returns The validated credentials string\n * @throws Error if the value is not one of the accepted credentials\n */\nexport function validateCredentials(value?: string): Credentials {\n  const creds = value || \"same-origin\";\n  if (!CREDENTIALS_VALUES.includes(creds as Credentials)) {\n    throw new Error(\n      `Invalid credentials: \"${value}\" must be one of ${\n        CREDENTIALS_VALUES.join(\", \")\n      }`,\n    );\n  }\n  return creds as Credentials;\n}\n\n/**\n * Validates and normalizes the HTTP method option for a server function.\n * Accepts \"GET\" or \"POST\" (case-insensitive); defaults to \"POST\" when undefined.\n * @param value - Method value to validate\n * @returns The validated uppercase method string\n * @throws Error if the value is not \"GET\" or \"POST\"\n */\nexport function validateMethod(value?: string): \"GET\" | \"POST\" {\n  const method = (value || \"POST\").toUpperCase();\n  if (method !== \"GET\" && method !== \"POST\") {\n    throw new Error(`Invalid method: \"${value}\" must be one of GET, POST`);\n  }\n  return method;\n}\n","/**\n * @module Client module generation.\n */\nimport type {\n  RpcPluginOptionsInternal,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { serverFunctionsMap } from \"./functionsMap.ts\";\nimport {\n  validateCredentials,\n  validateIdentifier,\n  validateMethod,\n  validatePathSegment,\n} from \"./validate.ts\";\n\n/**\n * Generates a JavaScript client module string for a single server function.\n * All interpolated values are validated to prevent code injection.\n * @param fnName - Registered RPC function name (validated as path segment)\n * @param fnEntry - Export name used in the generated module (validated as identifier)\n * @param options - Content type, credentials, and RPC prefix settings\n * @returns A string of JavaScript code exporting the client stub\n */\nconst getModule = (\n  fnName: string,\n  fnEntry: string,\n  options: Partial<ServerFunctionOptions> & {\n    contentType: ServerFunctionOptions[\"contentType\"];\n    rpcPrefix: string;\n  },\n): string => {\n  // Validate all interpolated strings to prevent code injection\n  const safeFnName = validatePathSegment(fnName, \"function name\");\n  const safeFnEntry = validateIdentifier(fnEntry, \"export name\");\n  const safePrefix = validatePathSegment(options.rpcPrefix, \"rpcPrefix\");\n  const credentials = validateCredentials(options.credentials);\n  const method = validateMethod(options.method);\n  let body = \"\";\n  let headers = \"{}\";\n  switch (options.contentType) {\n    case \"text/plain\":\n      {\n        body = `args[0]`;\n        headers = `{ 'Content-Type': 'text/plain' }`;\n      }\n      break;\n    case \"multipart/form-data\":\n      {\n        // FormData carries its own multipart content type with a random boundary,\n        // so the browser must generate the header (setting it manually strips the boundary)\n        body = `args[0]`;\n        headers = `{}`;\n      }\n      break;\n    default: {\n      body = `JSON.stringify(args)`;\n      headers = `{ 'Content-Type': 'application/json' }`;\n    }\n  }\n  // GET requests cannot carry a body: args travel as a JSON query parameter\n  if (method === \"GET\") {\n    body = `JSON.stringify(args)`;\n    headers = `{}`;\n  }\n\n  const output = `\nexport const ${safeFnEntry} = (...args) => {\n  const body = ${body};\n  const headers = ${headers};\n  const prefix = \"${safePrefix}\";\n  const name = \"${safeFnName}\";\n  const credentials = \"${credentials}\";\n  const method = \"${method}\";\n  return innerModule(body, headers, credentials, prefix, name, method);\n}`;\n\n  return output.trim();\n};\n\n/**\n * Generates the complete client-side module bundle by iterating all registered server functions\n * and producing fetch-based stubs for each. The result is transformed by Vite (or Oxc) during\n * the dev server or production build.\n * @param initialOptions - Plugin options containing rpcPrefix and optional adapter\n * @returns A string of JavaScript code with all client RPC modules and their import dependencies\n */\nexport const getClientModules = (\n  initialOptions: RpcPluginOptionsInternal,\n): string => {\n  // Validate prefix once at the top level\n  validatePathSegment(initialOptions.rpcPrefix, \"rpcPrefix\");\n  const entries = Array.from(serverFunctionsMap.entries())\n    .filter(([, entry]) => entry.exportName)\n    .map(([registeredName, entry]) =>\n      getModule(registeredName, entry.exportName!, {\n        ...initialOptions,\n        ...((entry.options as ServerFunctionOptions) || {}),\n      })\n    )\n    .join(\"\\n\");\n  const output = `\n// Client-side RPC modules\nimport { innerModule } from \"@thednp/rpc/helpers\";\n${entries}`;\n\n  return output.trim();\n};\n"],"mappings":";;;;;AAEA,MAAa,qCAAiD,IAAI,IAGhE;;;ACLF,MAAa,oBAAoB;AAMjC,MAAa,2BAA2B;AAExC,MAAa,qBAAqB;AAQlC,MAAa,wBAAwB;;AASrC,MAAa,sBAAsB,OAAe,SAChD,WAAW,MAAM,KAAK,KAAK;;AAG7B,MAAa,wBAAwB,OAAe,YAClD,WAAW,MAAM,KAAK,QAAQ;;AAchC,MAAa,2BAA2B,SACtC,8BAA8B,KAAK;;;ACtCrC,MAAM,aAAa;;;;;AAMnB,MAAa,gBAAgB,OAAO,QAAmC;CACrE,MAAM,UAAoB,CAAC;CAC3B,MAAM,QAAQ,CAAC,GAAG;CAClB,OAAO,MAAM,QAAQ;EACnB,MAAM,UAAU,MAAM,IAAI;EAC1B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC;EAC1D,SAAS,IAAI;GACX;EACF;EACA,KAAK,MAAM,SAAS,SAAS;GAC3B,MAAM,WAAW,KAAK,SAAS,MAAM,IAAI;GACzC,IAAI,MAAM,OAAO,KAAK,WAAW,KAAK,MAAM,IAAI,GAC9C,QAAQ,KAAK,QAAQ;QAChB,IAAI,MAAM,YAAY,GAC3B,MAAM,KAAK,QAAQ;EAEvB;CACF;CACA,OAAO;AACT;;;;;;AAOA,IAAa,WAAb,cAA8B,MAAM;;CAElC;;CAEA;CACA,YAAY,SAAiB,OAAO,YAAY,MAAkB;EAChE,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;;;;;;;AAQA,MAAa,eACX,KACA,iBACe;CACf,IAAI,CAAC,cAAc;EACjB,IAAI,eAAe,UAAU;GAC3B,MAAM,UAAsB;IAC1B,OAAO,IAAI,WAAA;IACX,MAAM,IAAI;GACZ;GACA,IAAI,IAAI,SAAS,KAAA,GAAW,QAAQ,OAAO,IAAI;GAC/C,OAAO;EACT;EAEA,OAAO,EAAE,QADG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,MAAA,wBACd;CAC/C;CACA,OAAO,EAAE,OAAO,sBAAsB;AACxC;;;AC9DA,IAAI,YAAY;;AAGhB,MAAa,qCAAkC,IAAI,IAAY;AAE/D,MAAM,cAAc;CAAC;CAAa;CAAa;CAAc;AAAY;;;;;;;;;;;;AAazE,MAAa,qBAAqB,OAChC,YACA,cACkB;CAClB,IAAI,aAAa,CAAC,WAChB;CAEF,MAAM,SAAU,CAAC,cAAc,CAAC,aAAc,CAAC,aAC3C;EACA,MAAM,QAAQ,IAAI;EAClB,MAAM,QAAQ,IAAI,QAAQ;EAC1B,QAAQ,EAAE,gBAAgB,KAAK;CACjC,IACE,EACA,GAAG,WACL;CAEF,IAAI,SAAS;CACb,IAAI,CAAC,QACH,SAAS,MAAM,aAAa;EAC1B,QAAQ;GAAE,GAAG,OAAO;GAAQ,IAAI;EAAM;EACtC,SAAS;EACT,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,QAAQ,QAAQ,IAAI;EAIjC,YAAY;EASZ,cAAc,EAAE,aAAa,KAAK;EAClC,KAAK,EAAE,cAAc,EAAE,aAAa,KAAK,EAAE;CAC7C,CAAC;CAGH,MAAM,OAAO,OAAO,QAAQ,QAAQ,IAAI;CACxC,MAAM,mBAAmB,QACvB,MACC,OAAsB,YAAY,KAAK,MAAM,OAAO,KAAK,CAC5D;CACA,MAAM,cAAiC,OAAsB,eAC3D;CAIF,MAAM,4BAAY,IAAI,IAAY;CAElC,IAAI;CACJ,IAAI;EACF,IAAI,gBAAgB,QAClB,QAAQ,MAAM,cAAc,gBAAgB;OAE5C,SAAS,MAAM,QAAQ,kBAAkB,EAAE,eAAe,KAAK,CAAC,EAAA,CAC7D,QAAQ,MAAM,YAAY,SAAS,EAAE,IAAI,CAAC,CAAC,CAC3C,KAAK,MAAM,KAAK,kBAAkB,EAAE,IAAI,CAAC;CAEhD,SAAS,IAAI;EACX,QAAQ,CAAC;CACX;CAEA,IAAI;EACF,KAAK,MAAM,QAAQ,OAAO;GACxB,mBAAmB,IAAI,cAAc,IAAI,CAAC;GAC1C,IAAI;GACJ,IAAI;IACF,gBAAiB,MAAM,OAAO,cAAc,IAAI;GAIlD,SAAS,OAAO;IACd,QAAQ,MAAM,oBAAoB,MAAM,KAAK;IAC7C;GACF;GACA,MAAM,gBAAgB,OAAO,QAAQ,aAAa;GAClD,IAAI,CAAC,cAAc,QAAQ;IACzB,QAAQ,KAAK,wBAAwB;IACrC;GACF;GAOA,KAAK,MAAM,CAAC,YAAY,gBAAgB,eAAe;IACrD,MAAM,iBAAiB,YAAY;IACnC,IAAI,UAAU,IAAI,cAAc,GAAG;KACjC,IAAI,QAAQ,IAAI,aAAa,cAC3B,MAAM,IAAI,MAAM,wBAAwB,cAAc,CAAC;KAEzD,QAAQ,KAAK,wBAAwB,cAAc,CAAC;KACpD;IACF;IACA,UAAU,IAAI,cAAc;IAC5B,mBAAmB,IAAI,gBAAgB;KACrC,MAAM;KACN,SAAS;KACT,SAAS,aAAa;KACtB;IACF,CAAC;GACH;EACF;CACF,UAAU;EACR,IAAI,CAAC,aAAa,QAChB,MAAM,OAAO,MAAM;EAErB,YAAY;CACd;AACF;;;AC7IA,MAAa,yBAAyB;CACpC,aAAa;CACb,aAAa;CACb,QAAQ;AACV;AAEA,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA2B;CACtC,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;;ACFA,SAAgB,qBAId,MACA,SACA,YAA4C,CAAC,GACb;CAChC,MAAM,UAAU,OAAO,OAAO,CAAC,GAAG,wBAAwB,SAAS;CAEnE,MAAM,mBAAmD,GAAG,SAAgB;EAC1E,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,UAAU,WAAmB,WAAW,MAAM,MAAM;EAE1D,MAAM,UAAU,YAAY;GAC1B,IAAI,WAAW,OAAO,SACpB,MAAM,IAAI,MAAM,iBAAiB;GAGnC,OAAO,MAAM,QAAQ,WAAW,QAAQ,GAAG,IAAI;EACjD;EAEA,OAAO;GACL,MAAM,QAAQ;GACd;EACF;CACF;CAEA,OAAO,iBAAiB,iBAAiB;EACvC,MAAM;GAAE,OAAO;GAAM,YAAY;GAAM,cAAc;EAAM;EAC3D,SAAS;GAAE,OAAO;GAAS,YAAY;GAAM,cAAc;EAAM;CACnE,CAAC;CAED,mBAAmB,IACjB,MACA;EACE;EACA,SAAS;EACT;CACF,CACF;CAEA,OAAO;AACT;;;AC7DA,MAAM,kBAAkB;AACxB,MAAM,oBAAoB;AAC1B,MAAM,qBAA6C;CACjD;CACA;CACA;AACF;;;;;;;;;AAUA,SAAgB,mBAAmB,MAAc,OAAuB;CACtE,IAAI,CAAC,gBAAgB,KAAK,IAAI,GAC5B,MAAM,IAAI,MAAM,mBAAmB,OAAO,IAAI,CAAC;CAEjD,OAAO;AACT;;;;;;;;;AAUA,SAAgB,oBAAoB,SAAiB,OAAuB;CAC1E,IAAI,CAAC,kBAAkB,KAAK,OAAO,GACjC,MAAM,IAAI,MAAM,qBAAqB,OAAO,OAAO,CAAC;CAEtD,OAAO;AACT;;;;;;;;AASA,SAAgB,oBAAoB,OAA6B;CAC/D,MAAM,QAAQ,SAAS;CACvB,IAAI,CAAC,mBAAmB,SAAS,KAAoB,GACnD,MAAM,IAAI,MACR,yBAAyB,MAAM,mBAC7B,mBAAmB,KAAK,IAAI,GAEhC;CAEF,OAAO;AACT;;;;;;;;AASA,SAAgB,eAAe,OAAgC;CAC7D,MAAM,UAAU,SAAS,OAAA,CAAQ,YAAY;CAC7C,IAAI,WAAW,SAAS,WAAW,QACjC,MAAM,IAAI,MAAM,oBAAoB,MAAM,2BAA2B;CAEvE,OAAO;AACT;;;;;;;;;;;AClDA,MAAM,aACJ,QACA,SACA,YAIW;CAEX,MAAM,aAAa,oBAAoB,QAAQ,eAAe;CAC9D,MAAM,cAAc,mBAAmB,SAAS,aAAa;CAC7D,MAAM,aAAa,oBAAoB,QAAQ,WAAW,WAAW;CACrE,MAAM,cAAc,oBAAoB,QAAQ,WAAW;CAC3D,MAAM,SAAS,eAAe,QAAQ,MAAM;CAC5C,IAAI,OAAO;CACX,IAAI,UAAU;CACd,QAAQ,QAAQ,aAAhB;EACE,KAAK;GAED,OAAO;GACP,UAAU;GAEZ;EACF,KAAK;GAID,OAAO;GACP,UAAU;GAEZ;EACF;GACE,OAAO;GACP,UAAU;CAEd;CAEA,IAAI,WAAW,OAAO;EACpB,OAAO;EACP,UAAU;CACZ;CAaA,OAAO;eAVM,YAAY;iBACV,KAAK;oBACF,QAAQ;oBACR,WAAW;kBACb,WAAW;yBACJ,YAAY;oBACjB,OAAO;;GAIX,KAAK;AACrB;;;;;;;;AASA,MAAa,oBACX,mBACW;CAEX,oBAAoB,eAAe,WAAW,WAAW;CAezD,OAAO;;;EAdS,MAAM,KAAK,mBAAmB,QAAQ,CAAC,CAAC,CACrD,QAAQ,GAAG,WAAW,MAAM,UAAU,CAAC,CACvC,KAAK,CAAC,gBAAgB,WACrB,UAAU,gBAAgB,MAAM,YAAa;EAC3C,GAAG;EACH,GAAK,MAAM,WAAqC,CAAC;CACnD,CAAC,CACH,CAAC,CACA,KAAK,IAIF,IAEQ,KAAK;AACrB"}
+{"version":3,"file":"server.mjs","names":[],"sources":["../../src/functionsMap.ts","../../src/constants.ts","../../src/server-helpers.ts","../../src/scanForServerFiles.ts","../../src/options.ts","../../src/createFunction.ts","../../src/validate.ts","../../src/getClientModules.ts","../../src/context.ts"],"sourcesContent":["import type { ServerFnEntry } from \"./types.d.ts\";\n\nexport const serverFunctionsMap: Map<string, ServerFnEntry> = new Map<\n  string,\n  ServerFnEntry\n>();\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$][A-Za-z0-9_$/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND = ` ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = ` ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","/** @module Server-side utilities. Exports the `RPCError` class for typed server-side errors, `formatError` for middleware error responses, `isFormContentType` and `hasContentTypeMismatch` for content-type validation, and `walkGlobFiles` for recursively discovering `*.server.*` files. Never import this module in client code — it is server-only. */\nimport type { ContentType, JsonObject, JsonValue } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { INTERNAL_SERVER_ERROR } from \"./constants.ts\";\n\nconst GLOB_REGEX = /^.+\\.server\\.(ts|js|mjs|mts)$/;\n\n/**\n * Recursively walks `dir` and collects absolute paths to files whose\n * basename matches the `*.server.{ts,js,mjs,mts}` glob pattern.\n */\nexport const walkGlobFiles = async (dir: string): Promise<string[]> => {\n  const results: string[] = [];\n  const stack = [dir];\n  while (stack.length) {\n    const current = stack.pop()!;\n    let entries;\n    try {\n      entries = await readdir(current, { withFileTypes: true });\n    } catch (_e) {\n      continue;\n    }\n    for (const entry of entries) {\n      const fullPath = join(current, entry.name);\n      if (entry.isFile() && GLOB_REGEX.test(entry.name)) {\n        results.push(fullPath);\n      } else if (entry.isDirectory()) {\n        stack.push(fullPath);\n      }\n    }\n  }\n  return results;\n};\n\n/**\n * A typed error thrown from server functions.\n * The middleware serializes the `message` and `code` in the response,\n * allowing clients to recognise and handle specific error conditions.\n */\nexport class RPCError extends Error {\n  /** Machine-readable error code (e.g. \"VALIDATION_FAILED\", \"UNAUTHORIZED\") */\n  code: string;\n  /** Optional diagnostic payload */\n  data?: JsonValue;\n  constructor(message: string, code = \"INTERNAL\", data?: JsonValue) {\n    super(message);\n    this.name = \"RPCError\";\n    this.code = code;\n    this.data = data;\n  }\n}\n\n/**\n * Formats an error for the RPC middleware response.\n * In development the full `RPCError` payload is included so developers\n * can quickly identify issues. Unexpected exceptions never expose their\n * message — only the generic \"Internal Server Error\" is sent, preventing\n * information disclosure; server-side diagnostics are preserved via the\n * middleware's `console.error` logging.\n */\nexport const formatError = (\n  err: unknown,\n  isProduction: boolean,\n): JsonObject => {\n  if (isProduction) {\n    return { error: INTERNAL_SERVER_ERROR };\n  }\n  if (err instanceof RPCError) {\n    const payload: JsonObject = {\n      error: err.message || INTERNAL_SERVER_ERROR,\n      code: err.code,\n    };\n    if (err.data !== undefined) payload.data = err.data;\n    return payload;\n  }\n  return { error: INTERNAL_SERVER_ERROR };\n};\n\n/**\n * Checks whether a content type maps to a form encoding\n * (`multipart/form-data` or `application/x-www-form-urlencoded`).\n * Form-declared functions accept either encoding so native browser\n * submissions (urlencoded) keep working without JavaScript.\n */\nexport const isFormContentType = (contentType: string): boolean =>\n  contentType === \"multipart/form-data\" ||\n  contentType === \"application/x-www-form-urlencoded\";\n\n/**\n * Detects whether an incoming request's `Content-Type` header conflicts\n * with the function's declared content type. JSON and text functions are\n * enforced strictly (exact match wins), while form functions accept both\n * form encodings because the nojs fallback submits urlencoded forms to\n * multipart-declared endpoints. Requests without a `Content-Type` header\n * (curl, GET, legacy clients) are exempt from enforcement.\n * @param declared - The declared `contentType` from the server function options\n * @param rawHeader - The raw `Content-Type` request header, if present\n */\nexport const hasContentTypeMismatch = (\n  declared: ContentType,\n  rawHeader: string | undefined,\n): boolean => {\n  // No Content-Type header → exempt (url bar, GET, curl compatibility)\n  if (!rawHeader) return false;\n  // Strip parameters (charset, boundary) before comparison\n  const incomingType = rawHeader.trim().toLowerCase().split(\";\")[0].trim();\n  if (isFormContentType(declared)) {\n    // Forms: reject only non-form encodings (lenient between the two)\n    return !isFormContentType(incomingType);\n  }\n  return incomingType !== declared;\n};\n\n/**\n * Escapes special regex metacharacters in a string.\n * Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,\n * preventing ReDoS and regex injection attacks.\n * @param s - The raw string to escape\n * @returns The escaped string safe for use in new RegExp()\n */\nexport function escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n","import type { ViteDevServer } from \"vite\";\nimport type { ClientFunctionWithOptions, ScanConfig } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport process from \"node:process\";\n\nimport { serverFunctionsMap } from \"./functionsMap.ts\";\nimport { walkGlobFiles } from \"./server-helpers.ts\";\nimport {\n  DUPLICATE_FUNCTION_NAME,\n  ERROR_LOADING_FILE,\n  NO_SERVER_FUNCTION_FOUND,\n} from \"./constants.ts\";\n\nlet isScanned = false;\n\n/** Absolute ids (normalized) of the scanned server function files. */\nexport const scannedServerFiles: Set<string> = new Set<string>();\n\nconst EXACT_NAMES = [\"server.ts\", \"server.js\", \"server.mjs\", \"server.mts\"];\n\n/**\n * Scans `src/api/` (or an explicit `scanRoot`) for server function files\n * and populates the global `serverFunctionsMap` with their exported functions.\n * Uses Vite's SSR module loading to resolve and execute each file.\n *\n * Supports two matching modes via `config.serverFiles`:\n *   `\"exact\"` — classic `server.ts|js|mjs|mts` names in the api directory\n *   `\"glob\"` — recursively walking `scanRoot` to match `*.server.{ts,js,mjs,mts}`\n * @param initialCfg - Optional Vite config overrides (root, base, server, serverFiles, scanRoot)\n * @param devServer - Optional running Vite dev server instance; when provided, skips creating a new one\n */\nexport const scanForServerFiles = async (\n  initialCfg?: ScanConfig,\n  devServer?: ViteDevServer,\n): Promise<void> => {\n  if (isScanned && !devServer) {\n    return;\n  }\n  // Vite is only needed to spin up the internal dev server that loads the\n  // server function files, so it is imported lazily rather than at the top\n  // of the module. This keeps consumers of the standalone server entry that\n  // register their functions directly (e.g. serverless functions bundling\n  // the API module) free of a static Vite dependency — when Vite is\n  // externalized by the function bundler, this lazy import is left as a\n  // runtime require that is never executed.\n  const { createServer, normalizePath } = await import(\"vite\");\n  const config = (!initialCfg && !devServer) || !initialCfg\n    ? {\n      root: process.cwd(),\n      base: process.env.BASE || \"/\",\n      server: { middlewareMode: true },\n    }\n    : {\n      ...initialCfg,\n    };\n\n  let server = devServer;\n  if (!server) {\n    server = await createServer({\n      server: { ...config.server, ws: false },\n      appType: \"custom\",\n      base: config.base || \"/\",\n      root: config.root || process.cwd(),\n      // The internal server is only used to load the server function files:\n      // skip the project config so its plugins (including this one) do not\n      // re-trigger a nested scan via `configureServer`.\n      configFile: false,\n      // The internal server never serves a page or HMR, so no dependency\n      // optimization or WebSocket server is needed. Without `ws: false`, the\n      // middleware-mode server creates a standalone HMR WebSocket on port\n      // 24678, and concurrent scans (e.g. the Express middleware's lazy scan\n      // racing the plugin scan) fail with EADDRINUSE. Without `noDiscovery`,\n      // the default optimizers scan the project entry and pre-bundle the whole\n      // `vite` package (imported by the linked @thednp/rpc dist files),\n      // hanging startup at 2+ GB RSS.\n      optimizeDeps: { noDiscovery: true },\n      ssr: { optimizeDeps: { noDiscovery: true } },\n    });\n  }\n\n  const root = config.root || process.cwd();\n  const resolvedScanRoot = resolve(\n    root,\n    config.scanRoot ?? join(root, \"src\", \"api\"),\n  );\n  const serverFiles: \"exact\" | \"glob\" = config.serverFiles ??\n    \"exact\";\n\n  // Names registered during this scan run, used for duplicate detection\n  // (see the registration loop below).\n  const seenNames = new Set<string>();\n\n  let files: string[];\n  try {\n    if (serverFiles === \"glob\") {\n      files = await walkGlobFiles(resolvedScanRoot);\n    } else {\n      files = (await readdir(resolvedScanRoot, { withFileTypes: true }))\n        .filter((f) => EXACT_NAMES.includes(f.name))\n        .map((f) => join(resolvedScanRoot, f.name));\n    }\n  } catch (_e) {\n    files = [];\n  }\n\n  try {\n    for (const file of files) {\n      scannedServerFiles.add(normalizePath(file));\n      let moduleExports: Record<string, ClientFunctionWithOptions>;\n      try {\n        moduleExports = (await server.ssrLoadModule(file)) as Record<\n          string,\n          ClientFunctionWithOptions\n        >;\n      } catch (error) {\n        console.error(ERROR_LOADING_FILE, file, error);\n        continue;\n      }\n      const moduleEntries = Object.entries(moduleExports);\n      if (!moduleEntries.length) {\n        console.warn(NO_SERVER_FUNCTION_FOUND);\n        return;\n      }\n\n      // `createServerFunction` auto-registers its name into the map at module\n      // load, so the global map cannot be used for duplicate detection across\n      // scans (dev re-scans the same modules via the same or fresh Vite graphs).\n      // Track names seen in THIS scan run only: a name repeated within one scan\n      // (e.g. two files exporting the same function name) is a genuine conflict.\n      for (const [exportName, exportValue] of moduleEntries) {\n        const registeredName = exportValue.name;\n        if (seenNames.has(registeredName)) {\n          if (process.env.NODE_ENV !== \"production\") {\n            throw new Error(DUPLICATE_FUNCTION_NAME(registeredName));\n          }\n          console.warn(DUPLICATE_FUNCTION_NAME(registeredName));\n          continue;\n        }\n        seenNames.add(registeredName);\n        serverFunctionsMap.set(registeredName, {\n          name: registeredName,\n          handler: exportValue,\n          options: exportValue?.options,\n          exportName,\n        });\n      }\n    }\n  } finally {\n    if (!devServer && server) {\n      await server.close();\n    }\n    isScanned = true;\n  }\n};\n","import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n} satisfies ServerFunctionOptions;\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: \"__rpc\",\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n} satisfies MiddlewareOptions;\n","// /@thednp/rpc/src/createFn.ts\nimport type {\n  ClientFunction,\n  JsonArray,\n  JsonValue,\n  ServerFunctionInit,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { serverFunctionsMap } from \"./functionsMap.ts\";\nimport { defaultServerFnOptions } from \"./options.ts\";\nimport { OPERATION_ABORTED } from \"./constants.ts\";\n\n/**\n * Creates a server-side RPC function.\n * Registers the function in the server functions map and returns a client-compatible\n * wrapper that exposes `data` (Promise) and `cancel` (function) for request lifecycle control.\n * @param name - Unique identifier used by the RPC router to dispatch requests\n * @param handler - The actual implementation receiving an AbortSignal followed by JSON-serializable arguments\n * @param fnOptions - Optional contentType and credentials settings\n * @returns A client stub with `data` promise and `cancel` method, auto-registered in the server map\n */\nexport function createServerFunction<\n  TArgs extends JsonArray = JsonArray,\n  TResult extends JsonValue = JsonValue,\n>(\n  name: string,\n  handler: ServerFunctionInit<TArgs, TResult>,\n  fnOptions: Partial<ServerFunctionOptions> = {},\n): ClientFunction<TArgs, TResult> {\n  const options = Object.assign({}, defaultServerFnOptions, fnOptions);\n\n  const wrappedFunction: ClientFunction<TArgs, TResult> = (...args: TArgs) => {\n    const controller = new AbortController();\n    const cancel = (reason: string) => controller.abort(reason);\n\n    const fetcher = async () => {\n      if (controller.signal.aborted) {\n        throw new Error(OPERATION_ABORTED);\n      }\n\n      return await handler(controller.signal, ...args);\n    };\n\n    return {\n      data: fetcher(),\n      cancel,\n    };\n  };\n\n  Object.defineProperties(wrappedFunction, {\n    name: { value: name, enumerable: true, configurable: false },\n    options: { value: options, enumerable: true, configurable: false },\n  });\n\n  serverFunctionsMap.set(\n    name,\n    {\n      name,\n      handler: wrappedFunction as never,\n      options,\n    },\n  );\n\n  return wrappedFunction;\n}\n","import type { Credentials } from \"./types.d.ts\";\nimport { INVALID_IDENTIFIER, INVALID_PATH_SEGMENT } from \"./constants.ts\";\n\nconst SAFE_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;\nconst SAFE_PATH_SEGMENT = /^[A-Za-z0-9_$@][A-Za-z0-9_$@/-]*$/;\nconst CREDENTIALS_VALUES: readonly Credentials[] = [\n  \"same-origin\",\n  \"include\",\n  \"omit\",\n];\n\n/**\n * Validates that a string is a safe JavaScript identifier.\n * Used to prevent code injection when interpolating export names into generated client code.\n * @param name - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"export name\")\n * @returns The validated name if it passes\n * @throws Error if the name contains characters outside /^[A-Za-z_$][A-Za-z0-9_$]*$/\n */\nexport function validateIdentifier(name: string, label: string): string {\n  if (!SAFE_IDENTIFIER.test(name)) {\n    throw new Error(INVALID_IDENTIFIER(label, name));\n  }\n  return name;\n}\n\n/**\n * Validates that a string is a safe path segment for RPC routing.\n * Allows alphanumeric characters, underscores, dollar signs, at signs, hyphens, and forward slashes.\n * @param segment - The string to validate\n * @param label - Human-readable label for error messages (e.g. \"rpcPrefix\")\n * @returns The validated segment if it passes\n * @throws Error if the segment contains disallowed characters\n */\nexport function validatePathSegment(segment: string, label: string): string {\n  if (!SAFE_PATH_SEGMENT.test(segment)) {\n    throw new Error(INVALID_PATH_SEGMENT(label, segment));\n  }\n  return segment;\n}\n\n/**\n * Validates and normalizes the credentials option.\n * Accepts \"same-origin\", \"include\", or \"omit\"; defaults to \"same-origin\" when undefined.\n * @param value - Credentials value to validate\n * @returns The validated credentials string\n * @throws Error if the value is not one of the accepted credentials\n */\nexport function validateCredentials(value?: string): Credentials {\n  const creds = value || \"same-origin\";\n  if (!CREDENTIALS_VALUES.includes(creds as Credentials)) {\n    throw new Error(\n      `Invalid credentials: \"${value}\" must be one of ${\n        CREDENTIALS_VALUES.join(\", \")\n      }`,\n    );\n  }\n  return creds as Credentials;\n}\n\n/**\n * Validates and normalizes the HTTP method option for a server function.\n * Accepts \"GET\" or \"POST\" (case-insensitive); defaults to \"POST\" when undefined.\n * @param value - Method value to validate\n * @returns The validated uppercase method string\n * @throws Error if the value is not \"GET\" or \"POST\"\n */\nexport function validateMethod(value?: string): \"GET\" | \"POST\" {\n  const method = (value || \"POST\").toUpperCase();\n  if (method !== \"GET\" && method !== \"POST\") {\n    throw new Error(`Invalid method: \"${value}\" must be one of GET, POST`);\n  }\n  return method;\n}\n","/**\n * @module Client module generation.\n */\nimport type {\n  RpcPluginOptionsInternal,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\nimport { serverFunctionsMap } from \"./functionsMap.ts\";\nimport {\n  validateCredentials,\n  validateIdentifier,\n  validateMethod,\n  validatePathSegment,\n} from \"./validate.ts\";\n\n/**\n * Generates a JavaScript client module string for a single server function.\n * All interpolated values are validated to prevent code injection.\n * @param fnName - Registered RPC function name (validated as path segment)\n * @param fnEntry - Export name used in the generated module (validated as identifier)\n * @param options - Content type, credentials, and RPC prefix settings\n * @returns A string of JavaScript code exporting the client stub\n */\nconst getModule = (\n  fnName: string,\n  fnEntry: string,\n  options: Partial<ServerFunctionOptions> & {\n    contentType: ServerFunctionOptions[\"contentType\"];\n    rpcPrefix: string;\n  },\n): string => {\n  // Validate all interpolated strings to prevent code injection\n  const safeFnName = validatePathSegment(fnName, \"function name\");\n  const safeFnEntry = validateIdentifier(fnEntry, \"export name\");\n  const safePrefix = validatePathSegment(options.rpcPrefix, \"rpcPrefix\");\n  const credentials = validateCredentials(options.credentials);\n  const method = validateMethod(options.method);\n  let body = \"\";\n  let headers = \"{}\";\n  switch (options.contentType) {\n    case \"text/plain\":\n      {\n        body = `args[0]`;\n        headers = `{ 'Content-Type': 'text/plain' }`;\n      }\n      break;\n    case \"application/x-www-form-urlencoded\":\n      {\n        body = `new URLSearchParams(args[0]).toString()`;\n        headers = `{ 'Content-Type': 'application/x-www-form-urlencoded' }`;\n      }\n      break;\n    case \"multipart/form-data\":\n      {\n        // FormData carries its own multipart content type with a random boundary,\n        // so the browser must generate the header (setting it manually strips the boundary)\n        body = `args[0]`;\n        headers = `{}`;\n      }\n      break;\n    default: {\n      body = `JSON.stringify(args)`;\n      headers = `{ 'Content-Type': 'application/json' }`;\n    }\n  }\n  // GET requests cannot carry a body: args travel as a JSON query parameter\n  if (method === \"GET\") {\n    body = `JSON.stringify(args)`;\n    headers = `{}`;\n  }\n\n  const output = `\nexport const ${safeFnEntry} = (...args) => {\n  const body = ${body};\n  const headers = ${headers};\n  const prefix = \"${safePrefix}\";\n  const name = \"${safeFnName}\";\n  const credentials = \"${credentials}\";\n  const method = \"${method}\";\n  return innerModule(body, headers, credentials, prefix, name, method);\n}`;\n\n  return output.trim();\n};\n\n/**\n * Generates the complete client-side module bundle by iterating all registered server functions\n * and producing fetch-based stubs for each. The result is transformed by Vite (or Oxc) during\n * the dev server or production build.\n * @param initialOptions - Plugin options containing rpcPrefix and optional adapter\n * @returns A string of JavaScript code with all client RPC modules and their import dependencies\n */\nexport const getClientModules = (\n  initialOptions: RpcPluginOptionsInternal,\n): string => {\n  // Validate prefix once at the top level\n  validatePathSegment(initialOptions.rpcPrefix, \"rpcPrefix\");\n  const entries = Array.from(serverFunctionsMap.entries())\n    .filter(([, entry]) => entry.exportName)\n    .map(([registeredName, entry]) =>\n      getModule(registeredName, entry.exportName!, {\n        ...initialOptions,\n        ...((entry.options as ServerFunctionOptions) || {}),\n      })\n    )\n    .join(\"\\n\");\n  const output = `\n// Client-side RPC modules\nimport { innerModule } from \"@thednp/rpc/helpers\";\n${entries}`;\n\n  return output.trim();\n};\n","/** @module Server-side request context. Exports the `RequestEvent` shape, `provideRequestContext` to establish it around a dispatch, `getRequestContext` to read it from anywhere inside the async tree, and `redirect` for framework-level redirects. Never import this module in client code — it is server-only. */\n\n// @thednp/rpc/src/context.ts\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\n/**\n * Global symbol under which the shared `AsyncLocalStorage` instance is stored\n * on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable\n * across module copies and dev-server hot reloads, mirroring\n * `solid-js/web`'s own request-context storage.\n */\nconst requestContextSymbol = Symbol.for(\"thednp.rpc.requestContext\");\n\n/**\n * A per-request context established by the framework adapters around\n * server-function dispatch, mirroring Solid Start's `FetchEvent`. Any code\n * running in the async tree of a dispatch can read the current context through\n * {@link getRequestContext} instead of threading `req`/`res` (or the framework\n * `Context` object) through every nested call. This module is server-only and\n * must never be imported by client code.\n *\n * Each adapter extends this with framework-specific request/response accessors:\n * - Express: `req`/`res` plus `nativeEvent = { req, res }`\n * - Fastify: `request`/`reply` plus `nativeEvent = request`\n * - Koa: `ctx` plus `nativeEvent = ctx`\n * - Hono: `c` (the Hono `Context`) plus `nativeEvent = c`\n * - h3: `event` (the h3 `H3Event`) plus `nativeEvent = event`\n */\nexport interface RequestEvent {\n  /** Adapter-specific native event kept for deep framework access */\n  nativeEvent?: unknown;\n  /** Adapter request object */\n  request: unknown;\n  /** Adapter response object */\n  response: unknown;\n  /**\n   * Bound adapter-native redirect. Performing a redirect sets `redirected`\n   * so the middleware can skip the JSON `{ data }` send.\n   * @param location - The URL to redirect to\n   * @param status - HTTP status code, defaults to `303 See Other`\n   */\n  redirect: (location: string, status?: number) => void;\n  /**\n   * Set by `redirect` once a redirect has been issued. The middleware checks\n   * this after `await`ing the server function to avoid double-responding.\n   */\n  redirected?: { location: string; status: number };\n  /** Per-request app data shared across the async tree of the dispatch */\n  locals: Record<string, unknown>;\n  [prop: string]: unknown;\n}\n\n// Instance-stable across module copies and dev-server hot reloads, exactly like\n// `solid-js/web`'s `provideRequestEvent` (which stores on a globalThis symbol).\nconst requestContextStorage: AsyncLocalStorage<RequestEvent> =\n  ((globalThis as Record<symbol, AsyncLocalStorage<RequestEvent>>)[\n    requestContextSymbol\n  ] ??= new AsyncLocalStorage<RequestEvent>());\n\n/**\n * Runs `cb` with `init` as the current request context. Use inside the\n * adapters around server-function dispatch (the async tree under `cb` can then\n * read the context via {@link getRequestContext}).\n * @param init - The request context for the duration of `cb`\n * @param cb - The work that needs access to the request context\n */\nexport const provideRequestContext = <T>(\n  init: RequestEvent,\n  cb: () => T,\n): T => requestContextStorage.run(init, cb);\n\n/**\n * Returns the current request context, or throws when called outside of a\n * request (e.g. module scope or a background task).\n * @throws When no request context is established\n */\nexport const getRequestContext = (): RequestEvent => {\n  const ctx = requestContextStorage.getStore();\n  if (!ctx) {\n    throw new Error(\"RequestEvent is not available outside of a request\");\n  }\n  return ctx;\n};\n\n/**\n * Redirects the current request to `location`. Reads the adapter-bound\n * `redirect` from the current request context — callable from anywhere inside\n * a server-function tree (no `res` threading needed).\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to `303 See Other`\n * @throws When called outside of a request\n */\nexport const redirect = (location: string, status = 303): void => {\n  getRequestContext().redirect(location, status);\n};\n"],"mappings":";;;;;AAEA,MAAa,qCAAiD,IAAI,IAGhE;;;ACLF,MAAa,oBAAoB;AAMjC,MAAa,2BAA2B;AAExC,MAAa,qBAAqB;AAUlC,MAAa,wBAAwB;;AASrC,MAAa,sBAAsB,OAAe,SAChD,WAAW,MAAM,KAAK,KAAK;;AAG7B,MAAa,wBAAwB,OAAe,YAClD,WAAW,MAAM,KAAK,QAAQ;;AAchC,MAAa,2BAA2B,SACtC,8BAA8B,KAAK;;;ACxCrC,MAAM,aAAa;;;;;AAMnB,MAAa,gBAAgB,OAAO,QAAmC;CACrE,MAAM,UAAoB,CAAC;CAC3B,MAAM,QAAQ,CAAC,GAAG;CAClB,OAAO,MAAM,QAAQ;EACnB,MAAM,UAAU,MAAM,IAAI;EAC1B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC;EAC1D,SAAS,IAAI;GACX;EACF;EACA,KAAK,MAAM,SAAS,SAAS;GAC3B,MAAM,WAAW,KAAK,SAAS,MAAM,IAAI;GACzC,IAAI,MAAM,OAAO,KAAK,WAAW,KAAK,MAAM,IAAI,GAC9C,QAAQ,KAAK,QAAQ;QAChB,IAAI,MAAM,YAAY,GAC3B,MAAM,KAAK,QAAQ;EAEvB;CACF;CACA,OAAO;AACT;;;;;;AAOA,IAAa,WAAb,cAA8B,MAAM;;CAElC;;CAEA;CACA,YAAY,SAAiB,OAAO,YAAY,MAAkB;EAChE,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;;;;;;;;;AAUA,MAAa,eACX,KACA,iBACe;CACf,IAAI,cACF,OAAO,EAAE,OAAO,sBAAsB;CAExC,IAAI,eAAe,UAAU;EAC3B,MAAM,UAAsB;GAC1B,OAAO,IAAI,WAAA;GACX,MAAM,IAAI;EACZ;EACA,IAAI,IAAI,SAAS,KAAA,GAAW,QAAQ,OAAO,IAAI;EAC/C,OAAO;CACT;CACA,OAAO,EAAE,OAAO,sBAAsB;AACxC;;;;;;;AAQA,MAAa,qBAAqB,gBAChC,gBAAgB,yBAChB,gBAAgB;;;;;;;;;;;AAYlB,MAAa,0BACX,UACA,cACY;CAEZ,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,eAAe,UAAU,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK;CACvE,IAAI,kBAAkB,QAAQ,GAE5B,OAAO,CAAC,kBAAkB,YAAY;CAExC,OAAO,iBAAiB;AAC1B;;;;;;;;AASA,SAAgB,aAAa,GAAmB;CAC9C,OAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;;;AC9GA,IAAI,YAAY;;AAGhB,MAAa,qCAAkC,IAAI,IAAY;AAE/D,MAAM,cAAc;CAAC;CAAa;CAAa;CAAc;AAAY;;;;;;;;;;;;AAazE,MAAa,qBAAqB,OAChC,YACA,cACkB;CAClB,IAAI,aAAa,CAAC,WAChB;CASF,MAAM,EAAE,cAAc,kBAAkB,MAAM,OAAO;CACrD,MAAM,SAAU,CAAC,cAAc,CAAC,aAAc,CAAC,aAC3C;EACA,MAAM,QAAQ,IAAI;EAClB,MAAM,QAAQ,IAAI,QAAQ;EAC1B,QAAQ,EAAE,gBAAgB,KAAK;CACjC,IACE,EACA,GAAG,WACL;CAEF,IAAI,SAAS;CACb,IAAI,CAAC,QACH,SAAS,MAAM,aAAa;EAC1B,QAAQ;GAAE,GAAG,OAAO;GAAQ,IAAI;EAAM;EACtC,SAAS;EACT,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,QAAQ,QAAQ,IAAI;EAIjC,YAAY;EASZ,cAAc,EAAE,aAAa,KAAK;EAClC,KAAK,EAAE,cAAc,EAAE,aAAa,KAAK,EAAE;CAC7C,CAAC;CAGH,MAAM,OAAO,OAAO,QAAQ,QAAQ,IAAI;CACxC,MAAM,mBAAmB,QACvB,MACA,OAAO,YAAY,KAAK,MAAM,OAAO,KAAK,CAC5C;CACA,MAAM,cAAgC,OAAO,eAC3C;CAIF,MAAM,4BAAY,IAAI,IAAY;CAElC,IAAI;CACJ,IAAI;EACF,IAAI,gBAAgB,QAClB,QAAQ,MAAM,cAAc,gBAAgB;OAE5C,SAAS,MAAM,QAAQ,kBAAkB,EAAE,eAAe,KAAK,CAAC,EAAA,CAC7D,QAAQ,MAAM,YAAY,SAAS,EAAE,IAAI,CAAC,CAAC,CAC3C,KAAK,MAAM,KAAK,kBAAkB,EAAE,IAAI,CAAC;CAEhD,SAAS,IAAI;EACX,QAAQ,CAAC;CACX;CAEA,IAAI;EACF,KAAK,MAAM,QAAQ,OAAO;GACxB,mBAAmB,IAAI,cAAc,IAAI,CAAC;GAC1C,IAAI;GACJ,IAAI;IACF,gBAAiB,MAAM,OAAO,cAAc,IAAI;GAIlD,SAAS,OAAO;IACd,QAAQ,MAAM,oBAAoB,MAAM,KAAK;IAC7C;GACF;GACA,MAAM,gBAAgB,OAAO,QAAQ,aAAa;GAClD,IAAI,CAAC,cAAc,QAAQ;IACzB,QAAQ,KAAK,wBAAwB;IACrC;GACF;GAOA,KAAK,MAAM,CAAC,YAAY,gBAAgB,eAAe;IACrD,MAAM,iBAAiB,YAAY;IACnC,IAAI,UAAU,IAAI,cAAc,GAAG;KACjC,IAAI,QAAQ,IAAI,aAAa,cAC3B,MAAM,IAAI,MAAM,wBAAwB,cAAc,CAAC;KAEzD,QAAQ,KAAK,wBAAwB,cAAc,CAAC;KACpD;IACF;IACA,UAAU,IAAI,cAAc;IAC5B,mBAAmB,IAAI,gBAAgB;KACrC,MAAM;KACN,SAAS;KACT,SAAS,aAAa;KACtB;IACF,CAAC;GACH;EACF;CACF,UAAU;EACR,IAAI,CAAC,aAAa,QAChB,MAAM,OAAO,MAAM;EAErB,YAAY;CACd;AACF;;;ACpJA,MAAa,yBAAyB;CACpC,aAAa;CACb,aAAa;CACb,QAAQ;AACV;AAEA,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA2B;CACtC,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;;;;;ACFA,SAAgB,qBAId,MACA,SACA,YAA4C,CAAC,GACb;CAChC,MAAM,UAAU,OAAO,OAAO,CAAC,GAAG,wBAAwB,SAAS;CAEnE,MAAM,mBAAmD,GAAG,SAAgB;EAC1E,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,UAAU,WAAmB,WAAW,MAAM,MAAM;EAE1D,MAAM,UAAU,YAAY;GAC1B,IAAI,WAAW,OAAO,SACpB,MAAM,IAAI,MAAM,iBAAiB;GAGnC,OAAO,MAAM,QAAQ,WAAW,QAAQ,GAAG,IAAI;EACjD;EAEA,OAAO;GACL,MAAM,QAAQ;GACd;EACF;CACF;CAEA,OAAO,iBAAiB,iBAAiB;EACvC,MAAM;GAAE,OAAO;GAAM,YAAY;GAAM,cAAc;EAAM;EAC3D,SAAS;GAAE,OAAO;GAAS,YAAY;GAAM,cAAc;EAAM;CACnE,CAAC;CAED,mBAAmB,IACjB,MACA;EACE;EACA,SAAS;EACT;CACF,CACF;CAEA,OAAO;AACT;;;AC7DA,MAAM,kBAAkB;AACxB,MAAM,oBAAoB;AAC1B,MAAM,qBAA6C;CACjD;CACA;CACA;AACF;;;;;;;;;AAUA,SAAgB,mBAAmB,MAAc,OAAuB;CACtE,IAAI,CAAC,gBAAgB,KAAK,IAAI,GAC5B,MAAM,IAAI,MAAM,mBAAmB,OAAO,IAAI,CAAC;CAEjD,OAAO;AACT;;;;;;;;;AAUA,SAAgB,oBAAoB,SAAiB,OAAuB;CAC1E,IAAI,CAAC,kBAAkB,KAAK,OAAO,GACjC,MAAM,IAAI,MAAM,qBAAqB,OAAO,OAAO,CAAC;CAEtD,OAAO;AACT;;;;;;;;AASA,SAAgB,oBAAoB,OAA6B;CAC/D,MAAM,QAAQ,SAAS;CACvB,IAAI,CAAC,mBAAmB,SAAS,KAAoB,GACnD,MAAM,IAAI,MACR,yBAAyB,MAAM,mBAC7B,mBAAmB,KAAK,IAAI,GAEhC;CAEF,OAAO;AACT;;;;;;;;AASA,SAAgB,eAAe,OAAgC;CAC7D,MAAM,UAAU,SAAS,OAAA,CAAQ,YAAY;CAC7C,IAAI,WAAW,SAAS,WAAW,QACjC,MAAM,IAAI,MAAM,oBAAoB,MAAM,2BAA2B;CAEvE,OAAO;AACT;;;;;;;;;;;AClDA,MAAM,aACJ,QACA,SACA,YAIW;CAEX,MAAM,aAAa,oBAAoB,QAAQ,eAAe;CAC9D,MAAM,cAAc,mBAAmB,SAAS,aAAa;CAC7D,MAAM,aAAa,oBAAoB,QAAQ,WAAW,WAAW;CACrE,MAAM,cAAc,oBAAoB,QAAQ,WAAW;CAC3D,MAAM,SAAS,eAAe,QAAQ,MAAM;CAC5C,IAAI,OAAO;CACX,IAAI,UAAU;CACd,QAAQ,QAAQ,aAAhB;EACE,KAAK;GAED,OAAO;GACP,UAAU;GAEZ;EACF,KAAK;GAED,OAAO;GACP,UAAU;GAEZ;EACF,KAAK;GAID,OAAO;GACP,UAAU;GAEZ;EACF;GACE,OAAO;GACP,UAAU;CAEd;CAEA,IAAI,WAAW,OAAO;EACpB,OAAO;EACP,UAAU;CACZ;CAaA,OAAO;eAVM,YAAY;iBACV,KAAK;oBACF,QAAQ;oBACR,WAAW;kBACb,WAAW;yBACJ,YAAY;oBACjB,OAAO;;GAIX,KAAK;AACrB;;;;;;;;AASA,MAAa,oBACX,mBACW;CAEX,oBAAoB,eAAe,WAAW,WAAW;CAezD,OAAO;;;EAdS,MAAM,KAAK,mBAAmB,QAAQ,CAAC,CAAC,CACrD,QAAQ,GAAG,WAAW,MAAM,UAAU,CAAC,CACvC,KAAK,CAAC,gBAAgB,WACrB,UAAU,gBAAgB,MAAM,YAAa;EAC3C,GAAG;EACH,GAAK,MAAM,WAAqC,CAAC;CACnD,CAAC,CACH,CAAC,CACA,KAAK,IAIF,IAEQ,KAAK;AACrB;;;;;;;;;;ACrGA,MAAM,uBAAuB,OAAO,IAAI,2BAA2B;AA2CnE,MAAM,wBACH,WACC,0BACI,IAAI,kBAAgC;;;;;;;;AAS5C,MAAa,yBACX,MACA,OACM,sBAAsB,IAAI,MAAM,EAAE;;;;;;AAO1C,MAAa,0BAAwC;CACnD,MAAM,MAAM,sBAAsB,SAAS;CAC3C,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,oDAAoD;CAEtE,OAAO;AACT;;;;;;;;;AAUA,MAAa,YAAY,UAAkB,SAAS,QAAc;CAChE,kBAAkB,CAAC,CAAC,SAAS,UAAU,MAAM;AAC/C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thednp/rpc",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "license": "MIT",
   "author": "thednp",
   "description": "⚡ A Vite plugin for creating server functions with automatic Remote Procedure Calls (RPC)",
@@ -13,7 +13,8 @@
     "express",
     "fastify",
     "hono",
-    "koa"
+    "koa",
+    "h3"
   ],
   "bugs": {
     "url": "https://github.com/thednp/rpc/issues"
@@ -40,6 +41,7 @@
     "./express": "./dist/express/express.mjs",
     "./fastify": "./dist/fastify/fastify.mjs",
     "./fastify/plugin": "./dist/fastify/plugin/fastify/plugin.mjs",
+    "./h3": "./dist/h3/h3.mjs",
     "./helpers": "./dist/helpers/helpers.mjs",
     "./hono": "./dist/hono/hono.mjs",
     "./koa": "./dist/koa/koa.mjs",
@@ -56,8 +58,11 @@
     "dev": "cd examples/spa && pnpm up && pnpm dev",
     "dev:koa": "cd examples/koa && pnpm up && pnpm dev",
     "dev:express": "cd examples/express && pnpm up && pnpm dev",
+    "dev:react-query": "cd examples/react-query && pnpm up && pnpm dev",
+    "dev:solid-query": "cd examples/solid-query && pnpm up && pnpm dev",
     "dev:fastify": "cd examples/fastify && pnpm up && pnpm dev",
     "dev:hono": "cd examples/hono && pnpm up && pnpm dev",
+    "dev:h3": "cd examples/h3 && pnpm up && pnpm dev",
     "dev:ssr": "cd examples/ssr && pnpm up && pnpm dev",
     "lint": "pnpm lint:ts && pnpm check:ts",
     "lint:ts": "deno lint src",
@@ -76,8 +81,9 @@
   },
   "dependencies": {
     "express": "^5.2.1",
-    "fastify": "^5.11.2",
+    "fastify": "^5.11.3",
     "fastify-plugin": "^6.0.0",
+    "h3": "2.0.1-rc.26",
     "hono": "^4.13.1",
     "koa": "^3.2.1",
     "vite": "^8.2.1"
@@ -86,7 +92,7 @@
     "@hono/node-server": "^2.1.0",
     "@types/express": "^5.0.6",
     "@types/koa": "^3.0.3",
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.2.0",
     "@vitest/coverage-istanbul": "^4.1.10",
     "@vitest/ui": "^4.1.10",
     "tsdown": "^0.22.14",