@thednp/rpc 0.1.1 → 0.2.0

package/AGENTS.md

@@ -8,6 +8,7 @@ pnpm dev:express # Run examples/express dev server
 pnpm dev:fastify # Run examples/fastify dev server
 pnpm dev:hono # Run examples/hono dev server
 pnpm dev:koa # Run examples/koa dev server
+pnpm dev:react-query # Run examples/react-query dev server
 pnpm dev:ssr # Run examples/ssr dev server
 pnpm lint # Lint + typecheck (deno lint + tsc)
 pnpm test # Run tests with coverage
@@ -32,32 +33,45 @@ pnpm release # Publish npm + jsr (scripts/release.js)
 
 ## Examples
 
-The `examples/` directory contains 6 example apps:
-
-| Example   | Adapter                                                           | Type | Run Command        | Config                           |
-| -----------| -------------------------------------------------------------------| ------| --------------------| ----------------------------------|
-| `spa`     | Vite dev server (no adapter)                                      | SPA  | `pnpm dev`         | `examples/spa/rpc.config.ts`     |
-| `express` | Express                                                           | SSR  | `pnpm dev:express` | `examples/express/rpc.config.ts` |
-| `fastify` | Fastify                                                           | SSR  | `pnpm dev:fastify` | `examples/fastify/rpc.config.ts` |
-| `hono`    | Hono                                                              | SSR  | `pnpm dev:hono`    | `examples/hono/rpc.config.ts`    |
-| `koa`     | Koa                                                               | SSR  | `pnpm dev:koa`     | `examples/koa/rpc.config.ts`     |
-| `ssr`     | Custom `http-express.ts` (Express-compatible `node:http` server ) | SSR  | `pnpm dev:ssr`     | `examples/ssr/rpc.config.ts`     |
+The `examples/` directory contains 8 example apps:
+
+| Example       | Adapter                                                           | Type | Run Command             | Config                                  |
+| ----------------| -------------------------------------------------------------------| ------| -------------------------| -----------------------------------------|
+| `spa`          | Vite dev server (no adapter)                                      | SPA  | `pnpm dev`              | `examples/spa/rpc.config.ts`            |
+| `express`      | Express                                                           | SSR  | `pnpm dev:express`      | `examples/express/rpc.config.ts`        |
+| `fastify`      | Fastify                                                           | SSR  | `pnpm dev:fastify`      | `examples/fastify/rpc.config.ts`        |
+| `h3`           | h3                                                                | SSR  | `pnpm dev:h3`           | `examples/h3/rpc.config.ts`             |
+| `hono`         | Hono                                                              | SSR  | `pnpm dev:hono`         | `examples/hono/rpc.config.ts`           |
+| `koa`          | Koa                                                               | SSR  | `pnpm dev:koa`          | `examples/koa/rpc.config.ts`            |
+| `react-query`  | Express (React + @tanstack/react-query SSR)                       | SSR  | `pnpm dev:react-query`  | `examples/react-query/rpc.config.ts`    |
+| `solid-query`  | Express (Solid + @tanstack/solid-query SSR)                       | SSR  | `pnpm dev:solid-query`  | `examples/solid-query/rpc.config.ts`    |
+| `ssr`          | Custom `http-express.ts` (Express-compatible `node:http` server ) | SSR  | `pnpm dev:ssr`          | `examples/ssr/rpc.config.ts`            | `examples/express/rpc.config.ts`        |
+| `fastify`      | Fastify                                                           | SSR  | `pnpm dev:fastify`      | `examples/fastify/rpc.config.ts`        |
+| `hono`         | Hono                                                              | SSR  | `pnpm dev:hono`         | `examples/hono/rpc.config.ts`           |
+| `koa`          | Koa                                                               | SSR  | `pnpm dev:koa`          | `examples/koa/rpc.config.ts`            |
+| `react-query`  | Express (React + @tanstack/react-query SSR)                       | SSR  | `pnpm dev:react-query`  | `examples/react-query/rpc.config.ts`    |
+| `solid-query`  | Express (Solid + @tanstack/solid-query SSR)                       | SSR  | `pnpm dev:solid-query`  | `examples/solid-query/rpc.config.ts`    |
+| `ssr`          | Custom `http-express.ts` (Express-compatible `node:http` server ) | SSR  | `pnpm dev:ssr`          | `examples/ssr/rpc.config.ts`            |
 
 Each example follows the same structure:
 
 - `server.js` / `server.ts` — production server with Vite middleware in dev, static serving in prod
 - `src/api/server.ts` — RPC server functions (auto-scanned by the plugin)
-- `src/entry-server.ts` — SSR entry (hydrates on client)
-- `src/entry-client.ts` — Client entry
+- `src/entry-server.ts` / `src/entry-server.tsx` — SSR entry (hydrates on client)
+- `src/entry-client.ts` / `src/entry-client.tsx` — Client entry
 - `vite.config.ts` + `rpc.config.ts` — Configuration files
 
+> Note: the `react-query` example is SSR with React 19 + `@tanstack/react-query` (Express adapter). It prefetches queries in `entry-server.tsx`, dehydrates them into `window.__REACT_QUERY_STATE__`, and hydrates on the client via `HydrationBoundary`.
+>
+> Note: the `solid-query` example is SSR with Solid + `@tanstack/solid-query` (Express adapter). The greeting is prefetched and serialized with `renderToStringAsync`; the GET form does **not** use a disabled `createQuery` (which would hang SSR — see `wiki/client-usage.md`), it calls `queryClient.fetchQuery()` on submit instead.
+
 ## Key Directories
 
 - `src/` — source for all packages (vite plugin, server, express, fastify, hono, koa adapters)
 - `dist/` — build output (not committed, generated by tsdown)
 - `tests/` — test files (one per adapter + plugin)
 - `tests/fixtures/` — test fixtures (config files, vite-mock.ts)
-- `examples/` — example apps (spa, express, fastify, hono, koa, ssr)
+- `examples/` — example apps (spa, express, fastify, hono, koa, react-query, solid-query, ssr)
 
 ## Build Output (tsdown)
 
@@ -136,9 +150,10 @@ The framework's security boundary is the **RPC prefix-gated HTTP endpoint**. Inp
 - `wiki/quickstart.md` — Rebuild the Express SSR example from `create-vite` in under a minute (copy-paste)
 - `wiki/getting-started.md` — Installation, project structure, auto-scanning, and your first function
 - `wiki/configuration.md` — Configuration reference (`rpc.config.ts`, `vite.config.ts`, options)
-- `wiki/server-functions.md` — `createServerFunction` API, methods, validation
+- `wiki/server-functions.md` — `createServerFunction` API, methods, validation, **request context (`getRequestContext`/`provideRequestContext`)** for per-request data access across async call stacks
+- `wiki/nojs-fallback.md` — native (no-JS) `<form>` fallback / progressive enhancement pattern
 - `wiki/client-usage.md` — Client-side usage, type safety, react-query integration
 - `wiki/wire-protocol.md` — HTTP contract, request/response bodies, curl debugging
-- `wiki/adapters.md` — Framework adapters (Express, Fastify, Hono, Koa)
+- `wiki/adapters.md` — Framework adapters (Express, Fastify, Hono, Koa, h3)
 - `wiki/security.md` — Security hardening
 - `wiki/best-practices.md` — Production patterns (auth, rate limiting, body limits, CSRF)

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## [0.2.0] - 2026-08-09
+
+### Features
+
+- **h3 adapter**: new `@thednp/rpc/h3` adapter with `createRPCMiddleware`, `viteMiddleware`, `attachRPC`, `attachVite`, `readBody`, `redirect` — fully typed, 100% test coverage, SSR example at `examples/h3`
+- **Request Context API**: `provideRequestContext(init, cb)` / `getRequestContext()` — per-request `AsyncLocalStorage` context available to all server function code; `RequestEvent` includes `nativeEvent`, `locals`, adapter-bound `redirect`; works across Express, Fastify, Hono, Koa, and h3
+- **`redirect` helper**: a new `redirect(res, location, status?)` server utility exported from `@thednp/rpc/server` and every adapter. It defaults to `303 See Other` for Post/Redirect/Get flows. The core version accepts an Express `Response` or a raw Node `ServerResponse`, delegating to native `res.redirect()` when available and otherwise writing the status code and `Location` header directly — the raw path is safe on Connect-compatible middlewares and serverless adapters (e.g. Netlify's `serverless-http` mock). Each adapter exports a redirect typed for its response object: Fastify `reply.redirect(location, status)` (v5 URL-first), Koa `ctx.redirect(location)` then `ctx.status = status` (setting status *after*, per koajs/koa#857), and Hono `return redirect(c, location, status)` (the `Response` is returned from the handler)
+
+- **`application/x-www-form-urlencoded` content type**: the `contentType` option and `BodyResult` now include urlencoded. The generated client serializes the single object argument with `new URLSearchParams(args[0]).toString()`, so native HTML forms can POST straight to an RPC endpoint without client-side serialization. Adapters parse `key=value&key2=value2` into an object via `URLSearchParams` (every value arrives as a string; repeated keys collapse to the last value) and use the framework's pre-parsed body (`express.urlencoded()`, `@fastify/formbody`, `koa-body`) when one ran first
+- **Content-type enforcement**: the RPC middleware now validates the request's `Content-Type` against the function's declared `contentType` before parsing the body, rejecting mismatches with `415 Unsupported Media Type` on all four adapters. JSON and text functions are enforced strictly (exact match wins after stripping `charset`/`boundary` parameters); form functions (`multipart/form-data` or `application/x-www-form-urlencoded`) are lenient between the two encodings so native urlencoded form submissions keep working on multipart-declared endpoints. Requests without a `Content-Type` header (curl, GET, legacy clients) are exempt from enforcement. The check lives in the new `hasContentTypeMismatch`/`isFormContentType` helpers exported from `@thednp/rpc/server`
+
+### Examples
+
+- Add the `h3` example (`examples/h3`): SSR with [h3](https://h3.unjs.io/) using `createRPCMiddleware`, `serveStatic`, `toNodeListener`, and `viteMiddleware`. Dev mode bridges Vite's connect stack; prod serves static assets via `serveStatic` and falls through to SSR.
+- The `demo` form-fallback middleware now uses the new `redirect` helper from `@thednp/rpc/express` instead of hand-writing the `303` + `Location` response
+- Add a nojs fallback to the `demo` contact form (progressive enhancement): the form now carries native `action="/@demo/submit-contact" method="post"` attributes, and a small app-layer `createFormFallback` middleware (mounted before the RPC middleware) intercepts browser form navigations — recognized by `POST` + `application/x-www-form-urlencoded` + `Accept: text/html`, which the JS client never sends. Valid submissions get a `303` redirect to the pre-filled GitHub issue URL; invalid ones get a `303` redirect back to `/?name=..&errors=..`, where the server-rendered page (and hydration) recover the form values and show the same field-level error messages the RPC path would have returned. Validation, issue-URL building, and field lists are shared with the server function via the new `demo/src/lib/contact-form.ts`, and the server function now normalizes both multipart (`{ raw }`) and plain-object (urlencoded/JSON-with-fields) payloads
+- Add the `react-query` example (Express + React 19 + `@tanstack/react-query` SSR): prefetches the greeting in `entry-server.tsx`, dehydrates it into `window.__REACT_QUERY_STATE__`, and hydrates on the client via `HydrationBoundary`
+- Add the `solid-query` example (Express + Solid + `@tanstack/solid-query` SSR): prefetches the greeting, serializes it with `renderToStringAsync`, and documents the disabled-query SSR gotcha — a disabled `createQuery` hangs `renderToStringAsync` because the observer result carries a never-settling `promise` (from `experimental_prefetchInRender`) that seroval awaits forever; the example calls `queryClient.fetchQuery()` on submit instead
+
+### Docs
+
+- Document Request Context API (`provideRequestContext`/`getRequestContext`) in `wiki/server-functions.md` — per-request `AsyncLocalStorage` context with `nativeEvent`, `locals`, adapter-bound `redirect` across all 5 adapters
+- Document urlencoded content type in `wiki/server-functions.md` and `wiki/wire-protocol.md` (new `POST + application/x-www-form-urlencoded` section)
+- Document the `415 Unsupported Media Type` response and content-type enforcement rules in `wiki/wire-protocol.md`
+- Document the strict/lenient content-type behavior in `wiki/server-functions.md`
+- Add a "Content-Type Enforcement" section to `wiki/security.md`
+- Document the `redirect` helper in `wiki/server-functions.md` (new "Redirects (`redirect`)" section) and cross-reference it from `wiki/adapters.md`
+- Add h3 adapter section to `wiki/adapters.md` (installation, usage, body limits)
+- Add h3 body limits to `wiki/best-practices.md` (Content-Length fast path + streaming cap via `for await (const chunk of event.req.body)`)
+- Update `llms.txt`, `AGENTS.md`, and `README.md` for the new adapter, examples, content type, enforcement behavior, redirect helper, and request context
+
+### Tests
+
+- **100% coverage achieved** across all adapters (express, fastify, h3, hono, koa) — 920/920 statements, 559/559 branches, 144/144 functions, 898/898 lines
+- Add h3 adapter test suite (`tests/h3.test.ts`): viteMiddleware (node/web runtime paths, settle-twice guard), createMiddleware (prefix/path filtering, name deduplication), createRPCMiddleware (dispatch, content-type enforcement, origin check, redirect default 303, cancel on close, error handling)
+- Add redirect default-status tests to Express, Fastify, Hono, and Koa adapter suites (covers `status = 303` default param branch)
+- Add urlencoded `readBody` tests for all four adapters (pre-parsed and raw stream paths), a urlencoded client-module codegen test in `plugin.test.ts`, and an end-to-end RPC middleware dispatch test
+- Add content-type enforcement tests to the Express, Fastify, Hono, and Koa adapter suites (415 on json↔urlencoded/text↔json mismatch, lenient acceptance of urlencoded on multipart-declared functions) and unit tests for `hasContentTypeMismatch`/`isFormContentType` (parameter stripping, case insensitivity, no-header exemption, form leniency both directions)
+- Add `redirect` tests: raw `ServerResponse` write path and native `.redirect()` delegation in `server-helpers.test.ts`, plus per-adapter suites asserting each framework API (Express `res.redirect(status, url)` vs raw write, Fastify URL-first `reply.redirect`, Koa status-after-`ctx.redirect`, Hono returning `c.redirect`'s `Response`)
+- Fix `scripts/dev-test.js` to verify the query-framework examples' dynamically rendered greeting (`Hello Jane!`) instead of only the static `Hello World!` SSR marker; register the `solid-query` example prefix
+
+### Chores
+
+- Bump version to `0.2.0`
+- Sync `deno.json` version with `package.json`
+
+### Security
+
+- **Content-type check moved before body read**: all four adapters now evaluate `hasContentTypeMismatch` *before* calling `readBody`, so mismatched requests are rejected with `415 Unsupported Media Type` without ever buffering/parsing the body (previously the body was read first, contradicting the documented behavior)
+- **Streaming body-limit in the demo**: `demo/body-limit.ts` no longer buffers the entire body via `readBody` before checking the cap. It enforces the 1MB limit while the request stream is being read (dropping buffered chunks and destroying the request on overflow) and adds a `Content-Length` fast-path for obviously oversized requests — closing a memory-exhaustion gap on the demo's raw `node:http` and Netlify entry points
+- **Netlify URL rewrite tightened**: `demo/netlify/functions/rpc.ts` now matches the `/.netlify/functions/rpc/` marker against the parsed `pathname` only (prefix match), instead of `indexOf` on the raw URL which could match inside a query string and rewrite unintended requests
+- **`@hono/node-server` dedupe**: add a workspace `overrides: { '@hono/node-server': '>=2.0.5' }` in `pnpm-workspace.yaml` to collapse the vulnerable `1.19.17` transitive dependency (via `@hono/vite-dev-server`, which pins `^1.19.11`) onto the already-used patched `2.1.0`. `pnpm audit` is now clean
+
 ## [0.1.1] - 2026-08-07
 
 ### Security

package/README.md

@@ -6,7 +6,7 @@
 [![JSR Version](https://img.shields.io/jsr/v/@thednp/rpc.svg)](https://jsr.io/@thednp/rpc)
 [![NPM Downloads](https://img.shields.io/npm/dm/@thednp/rpc.svg)](http://npm-stat.com/charts.html?package=@thednp/rpc)
 
-A Vite plugin for automatic RPC generation — simple, framework agnostic, and easy to use.
+A Vite plugin for automatic RPC generation — write server functions, re-export them, call them. Simple and framework agnostic.
 
 ## Isomorphic Design
 
@@ -35,7 +35,7 @@ You define them in a file, import and call them where you need them. The plugin
 * `createFunction.ts` — server-side definition (wrapped handler with `AbortController`)
 * `getClientModules.ts` — build-time code generation (string template with validation)
 * `client-helpers.ts` — client-side runtime (thin `fetch` based modules)
-* `server-helpers.ts` — server-only utilities (`RPCError`, error formatting, glob file walking)
+* `server-helpers.ts` — server-only utilities (`RPCError`, error formatting, `redirect`, glob file walking)
 * `scanForServerFiles.ts` — file discovery
 * **Adapters** — thin middleware wrappers
 </details>
@@ -90,7 +90,7 @@ Scan `src/api/` for classic `server.ts|js|mjs|mts` files, or switch to glob mode
 <details>
 <summary><b>Typed errors, safe by default</b></summary>
 
-Server errors return a generic `Internal Server Error` — no messages, codes, or stacks leak to clients, in any environment. Only `RPCError` payloads (developer-authored `message`/`code`/`data`) reach the client, and only in development, so you can debug instantly. `multipart/form-data` content type is supported for file uploads via your framework's multipart parser.
+Server errors return a generic `Internal Server Error` — no messages, codes, or stacks leak to clients, in any environment. Only `RPCError` payloads (developer-authored `message`/`code`/`data`) reach the client, and only in development, so you can debug instantly. `multipart/form-data` content type is supported for file uploads via your framework's multipart parser, and json/text/urlencoded requests are validated against the function's declared content type (`415 Unsupported Media Type` on mismatch; form encodings are interchangeable for nojs form fallbacks).
 </details>
 
 <details>
@@ -99,29 +99,29 @@ Server errors return a generic `Internal Server Error` — no messages, codes, o
 Generic type inference flows from your server function's arguments and return type all the way to the client stub. You get autocomplete for function names, argument types, and return types without writing a single type annotation on the client side.
 </details>
 
-## Demos
-
-| Example         | Source Code                                                                    | Try online                                                                               |
-| -----------------| --------------------------------------------------------------------------------| ------------------------------------------------------------------------------------------|
-| SPA - node:http | [examples/spa](https://github.com/thednp/rpc/tree/master/examples/spa)         | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/spa)     |
-| SSR - node:http | [examples/ssr](https://github.com/thednp/rpc/tree/master/examples/ssr)         | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/ssr)     |
-| Express         | [examples/express](https://github.com/thednp/rpc/tree/master/examples/express) | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/express) |
-| Fastify         | [examples/fastify](https://github.com/thednp/rpc/tree/master/examples/fastify) | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/fastify) |
-| Hono            | [examples/hono](https://github.com/thednp/rpc/tree/master/examples/hono)       | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/hono)    |
-| Koa             | [examples/koa](https://github.com/thednp/rpc/tree/master/examples/koa)         | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/koa)     |
+## Examples
 
-> **NOTE**: Stackblitz is currently working on upgrading their platform. Demos may not work properly. 
+| Source                                                                                 | Demo                                                                                         | Clone                                                   |
+| ----------------------------------------------------------------------------------------| ----------------------------------------------------------------------------------------------| ---------------------------------------------------------|
+| [examples/spa](https://github.com/thednp/rpc/tree/master/examples/spa)                 | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/spa)         | `pmpm dlx degit thednp/rpc/examples/spa my-app`         |
+| [examples/ssr](https://github.com/thednp/rpc/tree/master/examples/ssr)                 | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/ssr)         | `pnpm dlx degit thednp/rpc/examples/ssr my-app`         |
+| [examples/express](https://github.com/thednp/rpc/tree/master/examples/express)         | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/express)     | `pnpm dlx degit thednp/rpc/examples/express my-app`     |
+| [examples/fastify](https://github.com/thednp/rpc/tree/master/examples/fastify)         | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/fastify)     | `pnpm dlx degit thednp/rpc/examples/fastify my-app`     |
+| [examples/h3](https://github.com/thednp/rpc/tree/master/examples/h3)                   | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/h3)          | `pnpm dlx degit thednp/rpc/examples/h3 my-app`          |
+| [examples/hono](https://github.com/thednp/rpc/tree/master/examples/hono)               | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/hono)        | `pnpm dlx degit thednp/rpc/examples/hono my-app`        |
+| [examples/koa](https://github.com/thednp/rpc/tree/master/examples/koa)                 | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/koa)         | `pnpm dlx degit thednp/rpc/examples/koa my-app`         |
+| [examples/react-query](https://github.com/thednp/rpc/tree/master/examples/react-query) | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/react-query) | `pnpm dlx degit thednp/rpc/examples/react-query my-app` |
+| [examples/solid-query](https://github.com/thednp/rpc/tree/master/examples/solid-query) | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/solid-query) | `pnpm dlx degit thednp/rpc/examples/solid-query my-app` |
 
-## Examples
+> **Clone an example**: `degit` scaffolds a fresh copy straight from the repo — no git history, ready to run:
 
-| Example | Adapter                                       | Type | Run Command        | RPC Approach                       |
-| ---------| -----------------------------------------------| ------| --------------------| ------------------------------------|
-| spa     | Vite dev server (Connect, Express-compatible) | SPA  | `pnpm dev`         | Client stubs only                  |
-| express | Express                                       | SSR  | `pnpm dev:express` | Direct import (SSR) + client stubs |
-| fastify | Fastify                                       | SSR  | `pnpm dev:fastify` | Direct import (SSR) + client stubs |
-| hono    | Hono                                          | SSR  | `pnpm dev:hono`    | Direct import (SSR) + client stubs |
-| koa     | Koa                                           | SSR  | `pnpm dev:koa`     | Direct import (SSR) + client stubs |
-| ssr     | Custom `node:http` (Express-compatible)       | SSR  | `pnpm dev:ssr`     | Direct import (SSR) + client stubs |
+```bash
+# Scaffold the Express example
+pnpm dlx degit thednp/rpc/examples/express my-rpc-app
+cd my-rpc-app
+pnpm install
+pnpm dev
+```
 
 SSR examples demonstrate isomorphic usage: server functions are imported directly during server-side rendering (`entry-server.ts`) and also called from the client via auto-generated fetch stubs. The SPA example uses only the client-side stubs.
 
@@ -319,6 +319,12 @@ The `readBody` utility of each adapter doesn't cap raw request bodies by default
 Server functions only support `GET` and `POST` (default `POST`). RPC dispatch is not REST — `PUT`/`PATCH`/`DELETE` carry resource semantics that don't apply to function calls, and `OPTIONS` must stay reserved for CORS preflight. Every accepted method is another dispatch path to validate; keeping the surface minimal (and defaulting to `POST`) reduces CSRF and parsing attack surface. See [Server Functions Guide](./wiki/server-functions.md) for details.
 </details>
 
+<details>
+<summary><b>Content-type enforcement</b></summary>
+
+Request bodies are validated against the function's declared `contentType` before parsing — mismatches get a `415 Unsupported Media Type`. JSON and text functions require an exact match (after stripping `charset`/`boundary` parameters); the two form encodings are interchangeable so native urlencoded `<form>` submissions keep working on multipart-declared endpoints (nojs progressive enhancement). Requests without a `Content-Type` header are exempt, so curl and `GET` keep working unchanged. See [Wire Protocol](./wiki/wire-protocol.md) for details.
+</details>
+
 ---
 The full threat model, including edge cases and configuration options for tightening things further, is documented in [Security](./wiki/security.md).
 
@@ -327,13 +333,13 @@ The full threat model, including edge cases and configuration options for tighte
 
 - [Quick Start](./wiki/quickstart.md) — Rebuild the Express SSR example from `create-vite` in under a minute
 - [Getting Started](./wiki/getting-started.md) — Installation, project structure, and your first function
-- [Configuration](./wiki/configuration.md)
-- [Server Functions](./wiki/server-functions.md)
-- [Client Usage](./wiki/client-usage.md)
+- [Configuration](./wiki/configuration.md) — Full configuration reference
+- [Server Functions](./wiki/server-functions.md) — Creating server functions
+- [Client Usage](./wiki/client-usage.md) — Client-side usage
 - [Wire Protocol](./wiki/wire-protocol.md) — The HTTP contract behind the generated clients (curl debugging)
-- [Adapters](./wiki/adapters.md)
-- [Best Practices](./wiki/best-practices.md)
-- [Security](./wiki/security.md)
+- [Adapters](./wiki/adapters.md) — Framework adapters
+- [Best Practices](./wiki/best-practices.md) — Tips and best practices
+- [Security](./wiki/security.md) — Security hardening
 
 ## License
 

package/dist/express/express.d.mts

@@ -107,6 +107,18 @@ declare const isExpressRequest: (req: IncomingMessage | Request) => req is Reque
  * @returns True if the response is an Express Response
  */
 declare const isExpressResponse: (res: ServerResponse | Response) => res is Response;
+/**
+ * Issues an HTTP redirect on an Express or raw Node ServerResponse.
+ * Uses Express's native `res.redirect(status, location)` when an Express
+ * Response is provided, otherwise writes the status code and `Location`
+ * header directly on the raw `ServerResponse` (safe for Connect-compatible
+ * middlewares and serverless adapters whose mock responses lack `.redirect`).
+ * Defaults to `303 See Other` for convention (Post/Redirect/Get).
+ * @param res - Express Response or raw Node ServerResponse
+ * @param location - The URL to redirect to
+ * @param status - HTTP status code, defaults to 303
+ */
+declare const redirect: (res: ServerResponse | Response, location: string, status?: number) => void;
 /**
  * Type guard that checks whether a request has a pre-parsed body (`body` property).
  * Used to detect if a body-parser middleware already consumed the stream.
@@ -129,5 +141,5 @@ declare const getRequestDetails: (request: Request | IncomingMessage) => Request
  */
 declare const getResponseDetails: (response: Response | ServerResponse) => ResponseDetails;
 //#endregion
-export { type ExpressMiddlewareFn, type ExpressMiddlewareHooks, type ExpressMiddlewareOptions, type RequestDetails, type ResponseDetails, attachRPC, attachVite, createMiddleware, createRPCMiddleware, getRequestDetails, getResponseDetails, hasPreParsedBody, isExpressRequest, isExpressResponse, readBody };
+export { type ExpressMiddlewareFn, type ExpressMiddlewareHooks, type ExpressMiddlewareOptions, type RequestDetails, type ResponseDetails, attachRPC, attachVite, createMiddleware, createRPCMiddleware, getRequestDetails, getResponseDetails, hasPreParsedBody, isExpressRequest, isExpressResponse, readBody, redirect };
 //# sourceMappingURL=express.d.mts.map

package/dist/express/express.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.mts","names":[],"sources":["../../src/express/types.d.ts","../../src/express/createMiddleware.ts","../../src/express/helpers.ts"],"mappings":";;;;;;;;KAgBY,2BAA2B;;;;;KAM3B,uBACV,UAAU,yCAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,kBAAkB,SACvB,KAAK,iBAAiB,UACtB,MAAM,QAAQ,eAAe,iBAC1B;;;;;;KAOK;;EAEV;;EAEA,YAAY,cAAc;;EAE1B;;EAEA,gBAAgB;;EAEhB,eAAe,cAAc,QAAQ,eAAe;;;;;KAM1C;;EAEV;;EAEA;;EAEA,cAAc;;EAEd,SAAS;;EAET;;;;;;;;;;;cCvCW,kBAAkB;;;;;;;;cAyElB,qBAAqB;;;;;;;;iBC3FZ,UAAU,KAAK,UAAO;;;;;;iBAc5B,WAAW,KAAK,SAAS,MAAM;;;;;;;;cAWlC,WAAQ,KACd,UAAiB,oBACrB,QAAQ;;;;;;cAyEE,mBAAgB,KACtB,kBAAkB,YACtB,OAAO;;;;;;cASG,oBAAiB,KACvB,iBAAiB,aACrB,OAAO;;;;;;;cAUG,mBAAgB,KACtB,kBAAkB,YACtB,OAAO;;;;;;;cAUG,oBAAiB,SACnB,UAAiB,oBACzB;;;;;;;cAqBU,qBAAkB,UACnB,WAAkB,mBAC3B"}
+{"version":3,"file":"express.d.mts","names":[],"sources":["../../src/express/types.d.ts","../../src/express/createMiddleware.ts","../../src/express/helpers.ts"],"mappings":";;;;;;;;KAgBY,2BAA2B;;;;;KAM3B,uBACV,UAAU,yCAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,kBAAkB,SACvB,KAAK,iBAAiB,UACtB,MAAM,QAAQ,eAAe,iBAC1B;;;;;;KAOK;;EAEV;;EAEA,YAAY,cAAc;;EAE1B;;EAEA,gBAAgB;;EAEhB,eAAe,cAAc,QAAQ,eAAe;;;;;KAM1C;;EAEV;;EAEA;;EAEA,cAAc;;EAEd,SAAS;;EAET;;;;;;;;;;;cC3BW,kBAAkB;;;;;;;;cAyElB,qBAAqB;;;;;;;;iBCvGZ,UAAU,KAAK,UAAO;;;;;;iBAc5B,WAAW,KAAK,SAAS,MAAM;;;;;;;;cAWlC,WAAQ,KACd,UAAiB,oBACrB,QAAQ;;;;;;cAqFE,mBAAgB,KACtB,kBAAkB,YACtB,OAAO;;;;;;cASG,oBAAiB,KACvB,iBAAiB,aACrB,OAAO;;;;;;;;;;;;cAeG,WAAQ,KACd,iBAAiB,UAAe,kBACrB;;;;;;;cAkBL,mBAAgB,KACtB,kBAAkB,YACtB,OAAO;;;;;;;cAUG,oBAAiB,SACnB,UAAiB,oBACzB;;;;;;;cAqBU,qBAAkB,UACnB,WAAkB,mBAC3B"}

package/dist/express/express.mjs

@@ -1,4 +1,4 @@
-import { scanForServerFiles, serverFunctionsMap } from "@thednp/rpc/server";
+import { escapeRegExp, formatError, hasContentTypeMismatch, provideRequestContext, scanForServerFiles, serverFunctionsMap } from "@thednp/rpc/server";
 //#region src/options.ts
 const defaultRPCOptions = {
 	rpcPrefix: "__rpc",
@@ -44,9 +44,10 @@ const readBody = (req) => {
 			const contentType = req.headers["content-type"]?.toLowerCase() || "";
 			const isJSON = contentType.includes("json");
 			const isMultipart = contentType.includes("multipart/form-data");
+			const isUrlEncoded = contentType.includes("urlencoded");
 			resolve({
-				contentType: isMultipart ? "multipart/form-data" : isJSON ? "application/json" : "text/plain",
-				data: isMultipart ? req.body : isJSON ? req.body : String(req.body)
+				contentType: isMultipart ? "multipart/form-data" : isJSON ? "application/json" : isUrlEncoded ? "application/x-www-form-urlencoded" : "text/plain",
+				data: isMultipart ? req.body : isJSON ? req.body : isUrlEncoded ? req.body : String(req.body)
 			});
 			return;
 		}
@@ -65,10 +66,11 @@ const readBody = (req) => {
 			const incomingType = req.headers["content-type"]?.toLowerCase() || "";
 			const isJSON = incomingType.includes("json");
 			const isMultipart = incomingType.includes("multipart/form-data");
+			const isUrlEncoded = incomingType.includes("urlencoded");
 			try {
-				const data = isMultipart ? { raw: body } : JSON.parse(body);
+				const data = isMultipart ? { raw: body } : isUrlEncoded ? Object.fromEntries(new URLSearchParams(body)) : JSON.parse(body);
 				resolve({
-					contentType: isMultipart ? "multipart/form-data" : isJSON ? "application/json" : "text/plain",
+					contentType: isMultipart ? "multipart/form-data" : isJSON ? "application/json" : isUrlEncoded ? "application/x-www-form-urlencoded" : "text/plain",
 					data: isMultipart ? data : data
 				});
 			} catch (_e) {
@@ -102,6 +104,26 @@ const isExpressResponse = (res) => {
 	return "json" in res && "send" in res;
 };
 /**
+* Issues an HTTP redirect on an Express or raw Node ServerResponse.
+* Uses Express's native `res.redirect(status, location)` when an Express
+* Response is provided, otherwise writes the status code and `Location`
+* header directly on the raw `ServerResponse` (safe for Connect-compatible
+* middlewares and serverless adapters whose mock responses lack `.redirect`).
+* Defaults to `303 See Other` for convention (Post/Redirect/Get).
+* @param res - Express Response or raw Node ServerResponse
+* @param location - The URL to redirect to
+* @param status - HTTP status code, defaults to 303
+*/
+const redirect = (res, location, status = 303) => {
+	if (isExpressResponse(res)) {
+		res.redirect(status, location);
+		return;
+	}
+	res.statusCode = status;
+	res.setHeader("Location", location);
+	res.end();
+};
+/**
 * Type guard that checks whether a request has a pre-parsed body (`body` property).
 * Used to detect if a body-parser middleware already consumed the stream.
 * @param req - A Node IncomingMessage or Express Request
@@ -158,66 +180,15 @@ const getResponseDetails = (response) => {
 	};
 };
 //#endregion
-//#region src/tools.ts
-/**
-* Escapes special regex metacharacters in a string.
-* Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,
-* preventing ReDoS and regex injection attacks.
-* @param s - The raw string to escape
-* @returns The escaped string safe for use in new RegExp()
-*/
-function escapeRegExp(s) {
-	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-//#endregion
 //#region src/constants.ts
 const FUNCTION_NOT_FOUND = "Function not found";
 const METHOD_NOT_ALLOWED = "Method Not Allowed";
 const REQUEST_FORBIDDEN = "Forbidden";
-const INTERNAL_SERVER_ERROR = "Internal Server Error";
+const UNSUPPORTED_MEDIA_TYPE = "Unsupported Media Type";
 const CLIENT_DISCONNECTED = "client disconnected";
 /** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */
 const MIDDLEWARE_NAME_USED = (name) => `The middleware name "${name}" is already used.`;
 //#endregion
-//#region src/server-helpers.ts
-/**
-* A typed error thrown from server functions.
-* The middleware serializes the `message` and `code` in the response,
-* allowing clients to recognise and handle specific error conditions.
-*/
-var RPCError = class extends Error {
-	/** Machine-readable error code (e.g. "VALIDATION_FAILED", "UNAUTHORIZED") */
-	code;
-	/** Optional diagnostic payload */
-	data;
-	constructor(message, code = "INTERNAL", data) {
-		super(message);
-		this.name = "RPCError";
-		this.code = code;
-		this.data = data;
-	}
-};
-/**
-* Formats an error for the RPC middleware response.
-* In development the full `RPCError` payload is included so developers
-* can quickly identify issues. Unexpected exceptions never expose their
-* message — only the generic "Internal Server Error" is sent, preventing
-* information disclosure; server-side diagnostics are preserved via the
-* middleware's `console.error` logging.
-*/
-const formatError = (err, isProduction) => {
-	if (isProduction) return { error: INTERNAL_SERVER_ERROR };
-	if (err instanceof RPCError) {
-		const payload = {
-			error: err.message || "Internal Server Error",
-			code: err.code
-		};
-		if (err.data !== void 0) payload.data = err.data;
-		return payload;
-	}
-	return { error: INTERNAL_SERVER_ERROR };
-};
-//#endregion
 //#region src/express/createMiddleware.ts
 let middlewareCount = 0;
 const middlewareStack = /* @__PURE__ */ new Set();
@@ -295,15 +266,35 @@ const createRPCMiddleware = (initialOptions = {}) => {
 					const raw = searchParams.get("args");
 					if (raw) args = JSON.parse(raw);
 				} else {
+					if (hasContentTypeMismatch(serverFunction.options?.contentType ?? "application/json", req.headers["content-type"])) {
+						sendResponse(415, { error: UNSUPPORTED_MEDIA_TYPE });
+						return;
+					}
 					const body = await readBody(req);
 					args = Array.isArray(body.data) ? body.data : [body.data];
 				}
-				const { data, cancel } = serverFunction.handler(...args);
+				const requestEvent = {
+					request: req,
+					response: res,
+					nativeEvent: {
+						req,
+						res
+					},
+					locals: res.locals ?? {},
+					redirect: (location, status = 303) => {
+						requestEvent.redirected = {
+							location,
+							status
+						};
+						redirect(res, location, status);
+					}
+				};
+				const { data, cancel } = provideRequestContext(requestEvent, () => serverFunction.handler(...args));
 				const onClose = () => cancel(CLIENT_DISCONNECTED);
 				req.on("close", onClose);
 				const result = await data;
 				req.off("close", onClose);
-				if (!res.headersSent) sendResponse(200, { data: result });
+				if (!requestEvent.redirected && !res.headersSent) sendResponse(200, { data: result });
 			} catch (err) {
 				console.error(String(err));
 				const isProduction = process.env.NODE_ENV === "production";
@@ -313,6 +304,6 @@ const createRPCMiddleware = (initialOptions = {}) => {
 	});
 };
 //#endregion
-export { attachRPC, attachVite, createMiddleware, createRPCMiddleware, getRequestDetails, getResponseDetails, hasPreParsedBody, isExpressRequest, isExpressResponse, readBody };
+export { attachRPC, attachVite, createMiddleware, createRPCMiddleware, getRequestDetails, getResponseDetails, hasPreParsedBody, isExpressRequest, isExpressResponse, readBody, redirect };
 
 //# sourceMappingURL=express.mjs.map

package/dist/express/express.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"express.mjs","names":[],"sources":["../../src/options.ts","../../src/express/helpers.ts","../../src/tools.ts","../../src/constants.ts","../../src/server-helpers.ts","../../src/express/createMiddleware.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n} satisfies ServerFunctionOptions;\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: \"__rpc\",\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n} satisfies MiddlewareOptions;\n","// src/express/helpers.ts\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type {\n  Request as ExpressRequest,\n  Response as ExpressResponse,\n} from \"express\";\nimport type { BodyResult, JsonValue } from \"@thednp/rpc\";\nimport type { Buffer } from \"node:buffer\";\nimport type { ViteDevServer } from \"vite\";\nimport type { Express } from \"express\";\nimport { createRPCMiddleware } from \"./createMiddleware.ts\";\nimport type { RequestDetails, ResponseDetails } from \"./types.d.ts\";\n\n/**\n * Convenience function to load RPC config and attach the RPC middleware to an Express app.\n * Dynamically imports loadRPCConfig and creates the middleware with loaded options.\n * @param app - Express application instance\n */\nexport async function attachRPC(app: Express) {\n  // The main plugin entry statically imports Vite, so loadRPCConfig is\n  // imported lazily: function bundles that never call attachRPC (e.g.\n  // serverless functions) keep Vite out of the bundle (or externalized).\n  const { loadRPCConfig } = await import(\"@thednp/rpc\");\n  const { adapter: _adapter, ...options } = await loadRPCConfig();\n  app.use(createRPCMiddleware(options));\n}\n\n/**\n * Attaches Vite's dev server middlewares to an Express app for development mode.\n * @param app - Express application instance\n * @param vite - Running Vite dev server\n */\nexport function attachVite(app: Express, vite: ViteDevServer) {\n  app.use(vite.middlewares);\n}\n\n/**\n * Reads and parses the HTTP request body from an Express or Node IncomingMessage.\n * If a body parser middleware (e.g. express.json()) already consumed the stream,\n * uses the pre-parsed body from `req.body`.\n * @param req - Express or Node.js IncomingMessage\n * @returns A promise resolving to the parsed body with its content type\n */\nexport const readBody = (\n  req: ExpressRequest | IncomingMessage,\n): Promise<BodyResult> => {\n  return new Promise((resolve, reject) => {\n    // If an Express body parser already consumed the stream\n    // via app.use(express.json()), use req.body directly\n    if (hasPreParsedBody(req) && req.body !== undefined) {\n      // istanbul ignore next\n      const contentType = req.headers[\"content-type\"]?.toLowerCase() || \"\";\n      const isJSON = contentType.includes(\"json\");\n      const isMultipart = contentType.includes(\"multipart/form-data\");\n      resolve({\n        contentType: isMultipart\n          ? \"multipart/form-data\"\n          : isJSON\n          ? \"application/json\"\n          : \"text/plain\",\n        data: isMultipart\n          ? (req.body as Record<string, unknown>)\n          : isJSON\n          ? req.body\n          : String(req.body),\n      } as BodyResult);\n      return;\n    }\n\n    // Else we parse the body right away\n    let body = \"\";\n\n    const toggleListeners = (add?: boolean) => {\n      const method = add ? \"on\" : \"off\";\n      req[method](\"data\", onData);\n      req[method](\"end\", onEnd);\n      req[method](\"error\", onError);\n    };\n\n    const onData = (chunk: Buffer) => {\n      body += chunk.toString();\n    };\n\n    const onEnd = () => {\n      toggleListeners();\n      const incomingType = req.headers[\"content-type\"]?.toLowerCase() || \"\";\n      const isJSON = incomingType.includes(\"json\");\n      const isMultipart = incomingType.includes(\"multipart/form-data\");\n      try {\n        const data = isMultipart ? { raw: body } : JSON.parse(body);\n        resolve({\n          contentType: isMultipart\n            ? \"multipart/form-data\"\n            : isJSON\n            ? \"application/json\"\n            : \"text/plain\",\n          data: isMultipart ? (data as Record<string, unknown>) : data,\n        } as BodyResult);\n      } catch (_e) {\n        resolve({ contentType: \"text/plain\", data: String(body) });\n      }\n    };\n\n    const onError = (err: Error) => {\n      toggleListeners();\n\n      reject(err);\n    };\n\n    toggleListeners(true);\n  });\n};\n\n/**\n * Type guard that checks whether a request is an Express Request (has `originalUrl`).\n * @param req - A Node IncomingMessage or Express Request\n * @returns True if the request is an Express Request\n */\nexport const isExpressRequest = (\n  req: IncomingMessage | ExpressRequest,\n): req is ExpressRequest => {\n  return \"originalUrl\" in req;\n};\n\n/**\n * Type guard that checks whether a response is an Express Response (has `json` and `send` methods).\n * @param res - A Node ServerResponse or Express Response\n * @returns True if the response is an Express Response\n */\nexport const isExpressResponse = (\n  res: ServerResponse | ExpressResponse,\n): res is ExpressResponse => {\n  return \"json\" in res && \"send\" in res;\n};\n\n/**\n * Type guard that checks whether a request has a pre-parsed body (`body` property).\n * Used to detect if a body-parser middleware already consumed the stream.\n * @param req - A Node IncomingMessage or Express Request\n * @returns True if the request has a body property\n */\nexport const hasPreParsedBody = (\n  req: IncomingMessage | ExpressRequest,\n): req is ExpressRequest => {\n  return \"body\" in req;\n};\n\n/**\n * Extracts normalized request details from an Express or Node IncomingMessage.\n * Parses the URL to extract pathname, search string, and search params.\n * @param request - Express or Node.js request object\n * @returns Normalized request details including URL, headers, and method\n */\nexport const getRequestDetails = (\n  request: ExpressRequest | IncomingMessage,\n): RequestDetails => {\n  const rawUrl = (\n    isExpressRequest(request) ? request.originalUrl : request.url\n  ) as string;\n  const url = new URL(rawUrl, \"http://localhost\");\n\n  return {\n    url: url.pathname,\n    search: url.search,\n    searchParams: url.searchParams,\n    headers: request.headers,\n    method: request.method,\n  };\n};\n\n/**\n * Wraps an Express or Node ServerResponse with a uniform API for setting headers,\n * status codes, and sending JSON responses. Handles the Express vs raw Node API differences.\n * @param response - Express or Node.js server response object\n * @returns A ResponseDetails object with setHeader, setStatusCode, and sendResponse helpers\n */\nexport const getResponseDetails = (\n  response: ExpressResponse | ServerResponse,\n): ResponseDetails => {\n  const isResponseSent = response.headersSent || response.writableEnded;\n\n  const setHeader = (name: string, value: string) => {\n    if (isExpressResponse(response)) {\n      response.header(name, value);\n    } else {\n      response.setHeader(name, value);\n    }\n  };\n\n  const setStatusCode = (code: number) => {\n    if (isExpressResponse(response)) {\n      response.status(code);\n    } else {\n      response.statusCode = code;\n    }\n  };\n\n  const sendResponse = (code: number, output: Record<string, JsonValue>) => {\n    setStatusCode(code);\n    setHeader(\"Content-Type\", \"application/json\");\n\n    if (isExpressResponse(response)) {\n      response.send(JSON.stringify(output));\n    } else {\n      response.end(JSON.stringify(output));\n    }\n  };\n\n  return {\n    isResponseSent,\n    setHeader,\n    statusCode: response.statusCode,\n    setStatusCode,\n    sendResponse,\n  };\n};\n","/**\n * Escapes special regex metacharacters in a string.\n * Used to safely embed user-configurable values (like rpcPrefix) into regular expressions,\n * preventing ReDoS and regex injection attacks.\n * @param s - The raw string to escape\n * @returns The escaped string safe for use in new RegExp()\n */\nexport function escapeRegExp(s: string): string {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$][A-Za-z0-9_$/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND = ` ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = ` ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","/** @module Server-side utilities. Exports the `RPCError` class for typed server-side errors, `formatError` for middleware error responses, and `walkGlobFiles` for recursively discovering `*.server.*` files. Never import this module in client code — it is server-only. */\nimport type { JsonObject, JsonValue } from \"./types.d.ts\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { INTERNAL_SERVER_ERROR } from \"./constants.ts\";\n\nconst GLOB_REGEX = /^.+\\.server\\.(ts|js|mjs|mts)$/;\n\n/**\n * Recursively walks `dir` and collects absolute paths to files whose\n * basename matches the `*.server.{ts,js,mjs,mts}` glob pattern.\n */\nexport const walkGlobFiles = async (dir: string): Promise<string[]> => {\n  const results: string[] = [];\n  const stack = [dir];\n  while (stack.length) {\n    const current = stack.pop()!;\n    let entries;\n    try {\n      entries = await readdir(current, { withFileTypes: true });\n    } catch (_e) {\n      continue;\n    }\n    for (const entry of entries) {\n      const fullPath = join(current, entry.name);\n      if (entry.isFile() && GLOB_REGEX.test(entry.name)) {\n        results.push(fullPath);\n      } else if (entry.isDirectory()) {\n        stack.push(fullPath);\n      }\n    }\n  }\n  return results;\n};\n\n/**\n * A typed error thrown from server functions.\n * The middleware serializes the `message` and `code` in the response,\n * allowing clients to recognise and handle specific error conditions.\n */\nexport class RPCError extends Error {\n  /** Machine-readable error code (e.g. \"VALIDATION_FAILED\", \"UNAUTHORIZED\") */\n  code: string;\n  /** Optional diagnostic payload */\n  data?: JsonValue;\n  constructor(message: string, code = \"INTERNAL\", data?: JsonValue) {\n    super(message);\n    this.name = \"RPCError\";\n    this.code = code;\n    this.data = data;\n  }\n}\n\n/**\n * Formats an error for the RPC middleware response.\n * In development the full `RPCError` payload is included so developers\n * can quickly identify issues. Unexpected exceptions never expose their\n * message — only the generic \"Internal Server Error\" is sent, preventing\n * information disclosure; server-side diagnostics are preserved via the\n * middleware's `console.error` logging.\n */\nexport const formatError = (\n  err: unknown,\n  isProduction: boolean,\n): JsonObject => {\n  if (isProduction) {\n    return { error: INTERNAL_SERVER_ERROR };\n  }\n  if (err instanceof RPCError) {\n    const payload: JsonObject = {\n      error: err.message || INTERNAL_SERVER_ERROR,\n      code: err.code,\n    };\n    if (err.data !== undefined) payload.data = err.data;\n    return payload;\n  }\n  return { error: INTERNAL_SERVER_ERROR };\n};\n","// src/express/createMidleware.ts\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type {\n  NextFunction,\n  Request as ExpressRequest,\n  Response as ExpressResponse,\n} from \"express\";\nimport type {\n  ExpressMiddlewareFn,\n  ExpressMiddlewareOptions,\n} from \"./types.d.ts\";\nimport type { Connect } from \"vite\";\nimport type { JsonValue } from \"../types.d.ts\";\nimport { scanForServerFiles, serverFunctionsMap } from \"@thednp/rpc/server\";\nimport { defaultMiddlewareOptions, defaultRPCOptions } from \"../options.ts\";\nimport { getRequestDetails, getResponseDetails, readBody } from \"./helpers.ts\";\nimport { escapeRegExp } from \"../tools.ts\";\nimport { formatError } from \"../server-helpers.ts\";\nimport {\n  CLIENT_DISCONNECTED,\n  FUNCTION_NOT_FOUND,\n  METHOD_NOT_ALLOWED,\n  MIDDLEWARE_NAME_USED,\n  REQUEST_FORBIDDEN,\n} from \"../constants.ts\";\n\nlet middlewareCount = 0;\nconst middlewareStack = new Set<string>();\n\n/**\n * Creates an Express middleware with optional path and rpcPrefix filtering.\n * Middleware names are deduplicated — reusing a name throws an error.\n * Prefix and path regexes are compiled once at creation time (hoisted) for performance.\n * @param initialOptions - Options for rpcPrefix, path matching, and the handler function\n * @returns An Express middleware function\n */\nexport const createMiddleware: ExpressMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    initialOptions,\n  ) as ExpressMiddlewareOptions;\n  const middlewareName = options.name;\n  const rpcPrefix = options.rpcPrefix;\n  const path = options.path;\n  const handler = options.handler;\n\n  let name = middlewareName;\n  if (!name) {\n    name = \"viteRPCMiddleware-\" + middlewareCount;\n    middlewareCount += 1;\n  }\n  if (middlewareStack.has(name)) {\n    throw new Error(MIDDLEWARE_NAME_USED(name));\n  }\n  middlewareStack.add(name);\n\n  // Hoist regex compilation out of per-request path. Escape the prefix to\n  // prevent regex injection via metacharacters in the config string.\n  const prefixRegex: RegExp | null = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : null;\n  const pathMatcher: RegExp | null = path\n    ? (typeof path === \"string\" ? new RegExp(path) : path)\n    : null;\n\n  const middlewareHandler = async (\n    req: IncomingMessage | ExpressRequest,\n    res: ServerResponse | ExpressResponse,\n    next: Connect.NextFunction | NextFunction,\n  ) => {\n    const { url } = getRequestDetails(req);\n\n    // When serving from production server, scan for server files\n    if (serverFunctionsMap.size === 0) {\n      await scanForServerFiles();\n    }\n\n    // No need to continue when no handler provided\n    if (!handler) {\n      return next?.();\n    }\n\n    // Path matching\n    if (pathMatcher && !pathMatcher.test(url)) return next?.();\n\n    // rpcPrefix matching (boundary-safe via escaped regex)\n    if (prefixRegex && !prefixRegex.test(url)) {\n      return next?.();\n    }\n\n    // Execute handler\n    await handler(req, res, next);\n  };\n\n  Object.defineProperty(middlewareHandler, \"name\", {\n    value: name,\n  });\n\n  return middlewareHandler;\n};\n\n/**\n * Creates the Express RPC middleware that routes incoming requests to registered server functions.\n * Reads the request body, dispatches to the matching function via serverFunctionsMap,\n * and sends the JSON-serialized result. Handles client disconnection via abort signals.\n * @param initialOptions - Options including rpcPrefix for URL routing\n * @returns An Express middleware function\n */\nexport const createRPCMiddleware: ExpressMiddlewareFn = (\n  initialOptions = {},\n) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    { rpcPrefix: defaultRPCOptions.rpcPrefix },\n    initialOptions,\n  ) as ExpressMiddlewareOptions;\n\n  // Hoist prefix regex (escaped) and the literal prefix-for-replace out of the\n  // per-request handler to avoid regex injection and per-request compilation.\n  const rpcPrefix = options.rpcPrefix;\n  const prefixRegex = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : /* istanbul ignore next */ null;\n  const prefixReplace = `/${rpcPrefix}/`;\n\n  return createMiddleware({\n    ...options,\n    handler: async (\n      req: IncomingMessage | ExpressRequest,\n      res: ServerResponse | ExpressResponse,\n      _next: NextFunction | Connect.NextFunction,\n    ) => {\n      const { url: path, searchParams } = getRequestDetails(req);\n      const { sendResponse } = getResponseDetails(res);\n\n      // Validate the url starts with the prefix via the escaped regex\n      // istanbul ignore next\n      if (prefixRegex && !prefixRegex.test(path)) {\n        // falls through to next handler (never reached in practice; the outer\n        // createMiddleware already gates on this, but kept for defense-in-depth)\n        return;\n      }\n\n      // Optional origin check: reject requests whose Origin header does not\n      // match the configured origin. Requests without an Origin header\n      // (curl, native clients) pass through unchecked.\n      const origin = options.origin;\n      const requestOrigin = req.headers.origin;\n      if (origin && requestOrigin && requestOrigin !== origin) {\n        sendResponse(403, { error: REQUEST_FORBIDDEN });\n        return;\n      }\n\n      const functionName = path.replace(prefixReplace, \"\");\n      const serverFunction = serverFunctionsMap.get(functionName);\n\n      if (!serverFunction) {\n        sendResponse(404, { error: FUNCTION_NOT_FOUND });\n        return;\n      }\n\n      try {\n        const method = serverFunction.options?.method || \"POST\";\n        if (req.method?.toUpperCase() !== method) {\n          sendResponse(405, { error: METHOD_NOT_ALLOWED });\n          return;\n        }\n\n        let args: JsonValue[] = [];\n        if (method === \"GET\") {\n          const raw = searchParams.get(\"args\");\n          // istanbul ignore else\n          if (raw) args = JSON.parse(raw);\n        } else {\n          const body = await readBody(req);\n          args = Array.isArray(body.data)\n            ? body.data as JsonValue[]\n            : [body.data as JsonValue];\n        }\n        const { data, cancel } = serverFunction.handler(...args);\n        const onClose = () => cancel(CLIENT_DISCONNECTED);\n\n        req.on(\"close\", onClose);\n        const result = await data;\n        req.off(\"close\", onClose);\n\n        // istanbul ignore else\n        if (!res.headersSent) sendResponse(200, { data: result });\n      } catch (err) {\n        console.error(String(err));\n        const isProduction = process.env.NODE_ENV === \"production\";\n        sendResponse(500, formatError(err, isProduction));\n      }\n    },\n  });\n};\n"],"mappings":";;AAYA,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA2B;CACtC,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;ACLA,eAAsB,UAAU,KAAc;CAI5C,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,MAAM,EAAE,SAAS,UAAU,GAAG,YAAY,MAAM,cAAc;CAC9D,IAAI,IAAI,oBAAoB,OAAO,CAAC;AACtC;;;;;;AAOA,SAAgB,WAAW,KAAc,MAAqB;CAC5D,IAAI,IAAI,KAAK,WAAW;AAC1B;;;;;;;;AASA,MAAa,YACX,QACwB;CACxB,OAAO,IAAI,SAAS,SAAS,WAAW;EAGtC,IAAI,iBAAiB,GAAG,KAAK,IAAI,SAAS,KAAA,GAAW;GAEnD,MAAM,cAAc,IAAI,QAAQ,eAAe,EAAE,YAAY,KAAK;GAClE,MAAM,SAAS,YAAY,SAAS,MAAM;GAC1C,MAAM,cAAc,YAAY,SAAS,qBAAqB;GAC9D,QAAQ;IACN,aAAa,cACT,wBACA,SACA,qBACA;IACJ,MAAM,cACD,IAAI,OACL,SACA,IAAI,OACJ,OAAO,IAAI,IAAI;GACrB,CAAe;GACf;EACF;EAGA,IAAI,OAAO;EAEX,MAAM,mBAAmB,QAAkB;GACzC,MAAM,SAAS,MAAM,OAAO;GAC5B,IAAI,OAAO,CAAC,QAAQ,MAAM;GAC1B,IAAI,OAAO,CAAC,OAAO,KAAK;GACxB,IAAI,OAAO,CAAC,SAAS,OAAO;EAC9B;EAEA,MAAM,UAAU,UAAkB;GAChC,QAAQ,MAAM,SAAS;EACzB;EAEA,MAAM,cAAc;GAClB,gBAAgB;GAChB,MAAM,eAAe,IAAI,QAAQ,eAAe,EAAE,YAAY,KAAK;GACnE,MAAM,SAAS,aAAa,SAAS,MAAM;GAC3C,MAAM,cAAc,aAAa,SAAS,qBAAqB;GAC/D,IAAI;IACF,MAAM,OAAO,cAAc,EAAE,KAAK,KAAK,IAAI,KAAK,MAAM,IAAI;IAC1D,QAAQ;KACN,aAAa,cACT,wBACA,SACA,qBACA;KACJ,MAAM,cAAe,OAAmC;IAC1D,CAAe;GACjB,SAAS,IAAI;IACX,QAAQ;KAAE,aAAa;KAAc,MAAM,OAAO,IAAI;IAAE,CAAC;GAC3D;EACF;EAEA,MAAM,WAAW,QAAe;GAC9B,gBAAgB;GAEhB,OAAO,GAAG;EACZ;EAEA,gBAAgB,IAAI;CACtB,CAAC;AACH;;;;;;AAOA,MAAa,oBACX,QAC0B;CAC1B,OAAO,iBAAiB;AAC1B;;;;;;AAOA,MAAa,qBACX,QAC2B;CAC3B,OAAO,UAAU,OAAO,UAAU;AACpC;;;;;;;AAQA,MAAa,oBACX,QAC0B;CAC1B,OAAO,UAAU;AACnB;;;;;;;AAQA,MAAa,qBACX,YACmB;CACnB,MAAM,SACJ,iBAAiB,OAAO,IAAI,QAAQ,cAAc,QAAQ;CAE5D,MAAM,MAAM,IAAI,IAAI,QAAQ,kBAAkB;CAE9C,OAAO;EACL,KAAK,IAAI;EACT,QAAQ,IAAI;EACZ,cAAc,IAAI;EAClB,SAAS,QAAQ;EACjB,QAAQ,QAAQ;CAClB;AACF;;;;;;;AAQA,MAAa,sBACX,aACoB;CACpB,MAAM,iBAAiB,SAAS,eAAe,SAAS;CAExD,MAAM,aAAa,MAAc,UAAkB;EACjD,IAAI,kBAAkB,QAAQ,GAC5B,SAAS,OAAO,MAAM,KAAK;OAE3B,SAAS,UAAU,MAAM,KAAK;CAElC;CAEA,MAAM,iBAAiB,SAAiB;EACtC,IAAI,kBAAkB,QAAQ,GAC5B,SAAS,OAAO,IAAI;OAEpB,SAAS,aAAa;CAE1B;CAEA,MAAM,gBAAgB,MAAc,WAAsC;EACxE,cAAc,IAAI;EAClB,UAAU,gBAAgB,kBAAkB;EAE5C,IAAI,kBAAkB,QAAQ,GAC5B,SAAS,KAAK,KAAK,UAAU,MAAM,CAAC;OAEpC,SAAS,IAAI,KAAK,UAAU,MAAM,CAAC;CAEvC;CAEA,OAAO;EACL;EACA;EACA,YAAY,SAAS;EACrB;EACA;CACF;AACF;;;;;;;;;;AChNA,SAAgB,aAAa,GAAmB;CAC9C,OAAO,EAAE,QAAQ,uBAAuB,MAAM;AAChD;;;ACCA,MAAa,qBAAqB;AAElC,MAAa,qBAAqB;AAElC,MAAa,oBAAoB;AAEjC,MAAa,wBAAwB;AAErC,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB,SACnC,wBAAwB,KAAK;;;;;;;;ACmB/B,IAAa,WAAb,cAA8B,MAAM;;CAElC;;CAEA;CACA,YAAY,SAAiB,OAAO,YAAY,MAAkB;EAChE,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;;;;;;;;;AAUA,MAAa,eACX,KACA,iBACe;CACf,IAAI,cACF,OAAO,EAAE,OAAO,sBAAsB;CAExC,IAAI,eAAe,UAAU;EAC3B,MAAM,UAAsB;GAC1B,OAAO,IAAI,WAAA;GACX,MAAM,IAAI;EACZ;EACA,IAAI,IAAI,SAAS,KAAA,GAAW,QAAQ,OAAO,IAAI;EAC/C,OAAO;CACT;CACA,OAAO,EAAE,OAAO,sBAAsB;AACxC;;;ACpDA,IAAI,kBAAkB;AACtB,MAAM,kCAAkB,IAAI,IAAY;;;;;;;;AASxC,MAAa,oBAAyC,iBAAiB,CAAC,MAAM;CAC5E,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,cACF;CACA,MAAM,iBAAiB,QAAQ;CAC/B,MAAM,YAAY,QAAQ;CAC1B,MAAM,OAAO,QAAQ;CACrB,MAAM,UAAU,QAAQ;CAExB,IAAI,OAAO;CACX,IAAI,CAAC,MAAM;EACT,OAAO,uBAAuB;EAC9B,mBAAmB;CACrB;CACA,IAAI,gBAAgB,IAAI,IAAI,GAC1B,MAAM,IAAI,MAAM,qBAAqB,IAAI,CAAC;CAE5C,gBAAgB,IAAI,IAAI;CAIxB,MAAM,cAA6B,YAC/B,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IAC1C;CACJ,MAAM,cAA6B,OAC9B,OAAO,SAAS,WAAW,IAAI,OAAO,IAAI,IAAI,OAC/C;CAEJ,MAAM,oBAAoB,OACxB,KACA,KACA,SACG;EACH,MAAM,EAAE,QAAQ,kBAAkB,GAAG;EAGrC,IAAI,mBAAmB,SAAS,GAC9B,MAAM,mBAAmB;EAI3B,IAAI,CAAC,SACH,OAAO,OAAO;EAIhB,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GAAG,OAAO,OAAO;EAGzD,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,OAAO;EAIhB,MAAM,QAAQ,KAAK,KAAK,IAAI;CAC9B;CAEA,OAAO,eAAe,mBAAmB,QAAQ,EAC/C,OAAO,KACT,CAAC;CAED,OAAO;AACT;;;;;;;;AASA,MAAa,uBACX,iBAAiB,CAAC,MACf;CACH,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,EAAE,WAAW,kBAAkB,UAAU,GACzC,cACF;CAIA,MAAM,YAAY,QAAQ;CAC1B,MAAM,cAAc,YAChB,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IACzC;CACL,MAAM,gBAAgB,IAAI,UAAU;CAEpC,OAAO,iBAAiB;EACtB,GAAG;EACH,SAAS,OACP,KACA,KACA,UACG;GACH,MAAM,EAAE,KAAK,MAAM,iBAAiB,kBAAkB,GAAG;GACzD,MAAM,EAAE,iBAAiB,mBAAmB,GAAG;GAI/C,IAAI,eAAe,CAAC,YAAY,KAAK,IAAI,GAGvC;GAMF,MAAM,SAAS,QAAQ;GACvB,MAAM,gBAAgB,IAAI,QAAQ;GAClC,IAAI,UAAU,iBAAiB,kBAAkB,QAAQ;IACvD,aAAa,KAAK,EAAE,OAAO,kBAAkB,CAAC;IAC9C;GACF;GAEA,MAAM,eAAe,KAAK,QAAQ,eAAe,EAAE;GACnD,MAAM,iBAAiB,mBAAmB,IAAI,YAAY;GAE1D,IAAI,CAAC,gBAAgB;IACnB,aAAa,KAAK,EAAE,OAAO,mBAAmB,CAAC;IAC/C;GACF;GAEA,IAAI;IACF,MAAM,SAAS,eAAe,SAAS,UAAU;IACjD,IAAI,IAAI,QAAQ,YAAY,MAAM,QAAQ;KACxC,aAAa,KAAK,EAAE,OAAO,mBAAmB,CAAC;KAC/C;IACF;IAEA,IAAI,OAAoB,CAAC;IACzB,IAAI,WAAW,OAAO;KACpB,MAAM,MAAM,aAAa,IAAI,MAAM;KAEnC,IAAI,KAAK,OAAO,KAAK,MAAM,GAAG;IAChC,OAAO;KACL,MAAM,OAAO,MAAM,SAAS,GAAG;KAC/B,OAAO,MAAM,QAAQ,KAAK,IAAI,IAC1B,KAAK,OACL,CAAC,KAAK,IAAiB;IAC7B;IACA,MAAM,EAAE,MAAM,WAAW,eAAe,QAAQ,GAAG,IAAI;IACvD,MAAM,gBAAgB,OAAO,mBAAmB;IAEhD,IAAI,GAAG,SAAS,OAAO;IACvB,MAAM,SAAS,MAAM;IACrB,IAAI,IAAI,SAAS,OAAO;IAGxB,IAAI,CAAC,IAAI,aAAa,aAAa,KAAK,EAAE,MAAM,OAAO,CAAC;GAC1D,SAAS,KAAK;IACZ,QAAQ,MAAM,OAAO,GAAG,CAAC;IACzB,MAAM,eAAe,QAAQ,IAAI,aAAa;IAC9C,aAAa,KAAK,YAAY,KAAK,YAAY,CAAC;GAClD;EACF;CACF,CAAC;AACH"}
+{"version":3,"file":"express.mjs","names":[],"sources":["../../src/options.ts","../../src/express/helpers.ts","../../src/constants.ts","../../src/express/createMiddleware.ts"],"sourcesContent":["import type {\n  MiddlewareOptions,\n  RpcPluginOptions,\n  ServerFunctionOptions,\n} from \"./types.d.ts\";\n\nexport const defaultServerFnOptions = {\n  contentType: \"application/json\",\n  credentials: \"same-origin\",\n  method: \"POST\",\n} satisfies ServerFunctionOptions;\n\nexport const defaultRPCOptions: RpcPluginOptions = {\n  rpcPrefix: \"__rpc\",\n  adapter: \"express\",\n  serverFiles: \"exact\",\n  scanRoot: undefined,\n};\n\nexport const defaultMiddlewareOptions = {\n  rpcPrefix: undefined,\n  path: undefined,\n  origin: undefined,\n} satisfies MiddlewareOptions;\n","// src/express/helpers.ts\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type {\n  Request as ExpressRequest,\n  Response as ExpressResponse,\n} from \"express\";\nimport type { BodyResult, JsonValue } from \"@thednp/rpc\";\nimport type { Buffer } from \"node:buffer\";\nimport type { ViteDevServer } from \"vite\";\nimport type { Express } from \"express\";\nimport { createRPCMiddleware } from \"./createMiddleware.ts\";\nimport type { RequestDetails, ResponseDetails } from \"./types.d.ts\";\n\n/**\n * Convenience function to load RPC config and attach the RPC middleware to an Express app.\n * Dynamically imports loadRPCConfig and creates the middleware with loaded options.\n * @param app - Express application instance\n */\nexport async function attachRPC(app: Express) {\n  // The main plugin entry statically imports Vite, so loadRPCConfig is\n  // imported lazily: function bundles that never call attachRPC (e.g.\n  // serverless functions) keep Vite out of the bundle (or externalized).\n  const { loadRPCConfig } = await import(\"@thednp/rpc\");\n  const { adapter: _adapter, ...options } = await loadRPCConfig();\n  app.use(createRPCMiddleware(options));\n}\n\n/**\n * Attaches Vite's dev server middlewares to an Express app for development mode.\n * @param app - Express application instance\n * @param vite - Running Vite dev server\n */\nexport function attachVite(app: Express, vite: ViteDevServer) {\n  app.use(vite.middlewares);\n}\n\n/**\n * Reads and parses the HTTP request body from an Express or Node IncomingMessage.\n * If a body parser middleware (e.g. express.json()) already consumed the stream,\n * uses the pre-parsed body from `req.body`.\n * @param req - Express or Node.js IncomingMessage\n * @returns A promise resolving to the parsed body with its content type\n */\nexport const readBody = (\n  req: ExpressRequest | IncomingMessage,\n): Promise<BodyResult> => {\n  return new Promise((resolve, reject) => {\n    // If an Express body parser already consumed the stream\n    // via app.use(express.json()), use req.body directly\n    if (hasPreParsedBody(req) && req.body !== undefined) {\n      // istanbul ignore next\n      const contentType = req.headers[\"content-type\"]?.toLowerCase() || \"\";\n      const isJSON = contentType.includes(\"json\");\n      const isMultipart = contentType.includes(\"multipart/form-data\");\n      const isUrlEncoded = contentType.includes(\"urlencoded\");\n      resolve({\n        contentType: isMultipart\n          ? \"multipart/form-data\"\n          : isJSON\n          ? \"application/json\"\n          : isUrlEncoded\n          ? \"application/x-www-form-urlencoded\"\n          : \"text/plain\",\n        data: isMultipart\n          ? (req.body as Record<string, unknown>)\n          : isJSON\n          ? req.body\n          : isUrlEncoded\n          ? (req.body as Record<string, unknown>)\n          : String(req.body),\n      } as BodyResult);\n      return;\n    }\n\n    // Else we parse the body right away\n    let body = \"\";\n\n    const toggleListeners = (add?: boolean) => {\n      const method = add ? \"on\" : \"off\";\n      req[method](\"data\", onData);\n      req[method](\"end\", onEnd);\n      req[method](\"error\", onError);\n    };\n\n    const onData = (chunk: Buffer) => {\n      body += chunk.toString();\n    };\n\n    const onEnd = () => {\n      toggleListeners();\n      const incomingType = req.headers[\"content-type\"]?.toLowerCase() || \"\";\n      const isJSON = incomingType.includes(\"json\");\n      const isMultipart = incomingType.includes(\"multipart/form-data\");\n      const isUrlEncoded = incomingType.includes(\"urlencoded\");\n      try {\n        const data = isMultipart\n          ? { raw: body }\n          : isUrlEncoded\n          ? Object.fromEntries(new URLSearchParams(body))\n          : JSON.parse(body);\n        resolve({\n          contentType: isMultipart\n            ? \"multipart/form-data\"\n            : isJSON\n            ? \"application/json\"\n            : isUrlEncoded\n            ? \"application/x-www-form-urlencoded\"\n            : \"text/plain\",\n          data: isMultipart ? (data as Record<string, unknown>) : data,\n        } as BodyResult);\n      } catch (_e) {\n        resolve({ contentType: \"text/plain\", data: String(body) });\n      }\n    };\n\n    const onError = (err: Error) => {\n      toggleListeners();\n\n      reject(err);\n    };\n\n    toggleListeners(true);\n  });\n};\n\n/**\n * Type guard that checks whether a request is an Express Request (has `originalUrl`).\n * @param req - A Node IncomingMessage or Express Request\n * @returns True if the request is an Express Request\n */\nexport const isExpressRequest = (\n  req: IncomingMessage | ExpressRequest,\n): req is ExpressRequest => {\n  return \"originalUrl\" in req;\n};\n\n/**\n * Type guard that checks whether a response is an Express Response (has `json` and `send` methods).\n * @param res - A Node ServerResponse or Express Response\n * @returns True if the response is an Express Response\n */\nexport const isExpressResponse = (\n  res: ServerResponse | ExpressResponse,\n): res is ExpressResponse => {\n  return \"json\" in res && \"send\" in res;\n};\n\n/**\n * Issues an HTTP redirect on an Express or raw Node ServerResponse.\n * Uses Express's native `res.redirect(status, location)` when an Express\n * Response is provided, otherwise writes the status code and `Location`\n * header directly on the raw `ServerResponse` (safe for Connect-compatible\n * middlewares and serverless adapters whose mock responses lack `.redirect`).\n * Defaults to `303 See Other` for convention (Post/Redirect/Get).\n * @param res - Express Response or raw Node ServerResponse\n * @param location - The URL to redirect to\n * @param status - HTTP status code, defaults to 303\n */\nexport const redirect = (\n  res: ServerResponse | ExpressResponse,\n  location: string,\n  status = 303,\n): void => {\n  if (isExpressResponse(res)) {\n    res.redirect(status, location);\n    return;\n  }\n  res.statusCode = status;\n  res.setHeader(\"Location\", location);\n  res.end();\n};\n\n/**\n * Type guard that checks whether a request has a pre-parsed body (`body` property).\n * Used to detect if a body-parser middleware already consumed the stream.\n * @param req - A Node IncomingMessage or Express Request\n * @returns True if the request has a body property\n */\nexport const hasPreParsedBody = (\n  req: IncomingMessage | ExpressRequest,\n): req is ExpressRequest => {\n  return \"body\" in req;\n};\n\n/**\n * Extracts normalized request details from an Express or Node IncomingMessage.\n * Parses the URL to extract pathname, search string, and search params.\n * @param request - Express or Node.js request object\n * @returns Normalized request details including URL, headers, and method\n */\nexport const getRequestDetails = (\n  request: ExpressRequest | IncomingMessage,\n): RequestDetails => {\n  const rawUrl = (\n    isExpressRequest(request) ? request.originalUrl : request.url\n  ) as string;\n  const url = new URL(rawUrl, \"http://localhost\");\n\n  return {\n    url: url.pathname,\n    search: url.search,\n    searchParams: url.searchParams,\n    headers: request.headers,\n    method: request.method,\n  };\n};\n\n/**\n * Wraps an Express or Node ServerResponse with a uniform API for setting headers,\n * status codes, and sending JSON responses. Handles the Express vs raw Node API differences.\n * @param response - Express or Node.js server response object\n * @returns A ResponseDetails object with setHeader, setStatusCode, and sendResponse helpers\n */\nexport const getResponseDetails = (\n  response: ExpressResponse | ServerResponse,\n): ResponseDetails => {\n  const isResponseSent = response.headersSent || response.writableEnded;\n\n  const setHeader = (name: string, value: string) => {\n    if (isExpressResponse(response)) {\n      response.header(name, value);\n    } else {\n      response.setHeader(name, value);\n    }\n  };\n\n  const setStatusCode = (code: number) => {\n    if (isExpressResponse(response)) {\n      response.status(code);\n    } else {\n      response.statusCode = code;\n    }\n  };\n\n  const sendResponse = (code: number, output: Record<string, JsonValue>) => {\n    setStatusCode(code);\n    setHeader(\"Content-Type\", \"application/json\");\n\n    if (isExpressResponse(response)) {\n      response.send(JSON.stringify(output));\n    } else {\n      response.end(JSON.stringify(output));\n    }\n  };\n\n  return {\n    isResponseSent,\n    setHeader,\n    statusCode: response.statusCode,\n    setStatusCode,\n    sendResponse,\n  };\n};\n","export const OPERATION_ABORTED = \"Operation aborted\";\n\nexport const REQUEST_CANCELLED = \"Request was cancelled\";\n\nexport const FETCH_ERROR_PREFIX = \"Fetch error: \";\n\nexport const NO_SERVER_FUNCTION_FOUND = \"No server function found.\";\n\nexport const ERROR_LOADING_FILE = \"Error loading file:\";\n\nexport const FUNCTION_NOT_FOUND = \"Function not found\";\n\nexport const METHOD_NOT_ALLOWED = \"Method Not Allowed\";\n\nexport const REQUEST_FORBIDDEN = \"Forbidden\";\n\nexport const UNSUPPORTED_MEDIA_TYPE = \"Unsupported Media Type\";\n\nexport const INTERNAL_SERVER_ERROR = \"Internal Server Error\";\n\nexport const CLIENT_DISCONNECTED = \"client disconnected\";\n\n/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */\nexport const MIDDLEWARE_NAME_USED = (name: string) =>\n  `The middleware name \"${name}\" is already used.`;\n\n/** Error message when a value fails the safe-identifier validation. @param label - What kind of value was being validated. @param name - The rejected value */\nexport const INVALID_IDENTIFIER = (label: string, name: string) =>\n  `Invalid ${label}: \"${name}\" must match /^[A-Za-z_$][A-Za-z0-9_$]*$/`;\n\n/** Error message when a value fails the safe-path-segment validation. @param label - What kind of value was being validated. @param segment - The rejected value */\nexport const INVALID_PATH_SEGMENT = (label: string, segment: string) =>\n  `Invalid ${label}: \"${segment}\" must match /^[A-Za-z0-9_$][A-Za-z0-9_$/-]*$/`;\n\n/** Warning message when a specified RPC config file cannot be resolved on disk. @param configFile - The requested config filename. @param configFilePath - The resolved absolute path */\nexport const CONFIG_FILE_NOT_FOUND = (\n  configFile: string,\n  configFilePath: string,\n) =>\n  `  ⚠︎ The specified RPC config file ${configFile} cannot be found at ${configFilePath}, loading the defaults..`;\n\nexport const NO_CONFIG_FOUND = ` ⚡︎ No RPC config found, loading the defaults..`;\n\nexport const FAILED_LOAD_CONFIG = ` ⚠︎ Failed to load RPC config:`;\n\n/** Error template for duplicate server function names across files. @param name - The duplicate registered name */\nexport const DUPLICATE_FUNCTION_NAME = (name: string) =>\n  `Duplicate server function \"${name}\" detected. Each server function must have a unique name. Remove or rename the duplicate.`;\n","// src/express/createMidleware.ts\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type {\n  NextFunction,\n  Request as ExpressRequest,\n  Response as ExpressResponse,\n} from \"express\";\nimport type {\n  ExpressMiddlewareFn,\n  ExpressMiddlewareOptions,\n} from \"./types.d.ts\";\nimport type { Connect } from \"vite\";\nimport type { JsonValue } from \"../types.d.ts\";\nimport type { RequestEvent } from \"@thednp/rpc/server\";\nimport {\n  escapeRegExp,\n  formatError,\n  hasContentTypeMismatch,\n  provideRequestContext,\n  scanForServerFiles,\n  serverFunctionsMap,\n} from \"@thednp/rpc/server\";\nimport { defaultMiddlewareOptions, defaultRPCOptions } from \"../options.ts\";\nimport {\n  getRequestDetails,\n  getResponseDetails,\n  readBody,\n  redirect as expressRedirect,\n} from \"./helpers.ts\";\nimport {\n  CLIENT_DISCONNECTED,\n  FUNCTION_NOT_FOUND,\n  METHOD_NOT_ALLOWED,\n  MIDDLEWARE_NAME_USED,\n  REQUEST_FORBIDDEN,\n  UNSUPPORTED_MEDIA_TYPE,\n} from \"../constants.ts\";\n\nlet middlewareCount = 0;\nconst middlewareStack = new Set<string>();\n\n/**\n * Creates an Express middleware with optional path and rpcPrefix filtering.\n * Middleware names are deduplicated — reusing a name throws an error.\n * Prefix and path regexes are compiled once at creation time (hoisted) for performance.\n * @param initialOptions - Options for rpcPrefix, path matching, and the handler function\n * @returns An Express middleware function\n */\nexport const createMiddleware: ExpressMiddlewareFn = (initialOptions = {}) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    initialOptions,\n  ) as ExpressMiddlewareOptions;\n  const middlewareName = options.name;\n  const rpcPrefix = options.rpcPrefix;\n  const path = options.path;\n  const handler = options.handler;\n\n  let name = middlewareName;\n  if (!name) {\n    name = \"viteRPCMiddleware-\" + middlewareCount;\n    middlewareCount += 1;\n  }\n  if (middlewareStack.has(name)) {\n    throw new Error(MIDDLEWARE_NAME_USED(name));\n  }\n  middlewareStack.add(name);\n\n  // Hoist regex compilation out of per-request path. Escape the prefix to\n  // prevent regex injection via metacharacters in the config string.\n  const prefixRegex: RegExp | null = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : null;\n  const pathMatcher: RegExp | null = path\n    ? (typeof path === \"string\" ? new RegExp(path) : path)\n    : null;\n\n  const middlewareHandler = async (\n    req: IncomingMessage | ExpressRequest,\n    res: ServerResponse | ExpressResponse,\n    next: Connect.NextFunction | NextFunction,\n  ) => {\n    const { url } = getRequestDetails(req);\n\n    // When serving from production server, scan for server files\n    if (serverFunctionsMap.size === 0) {\n      await scanForServerFiles();\n    }\n\n    // No need to continue when no handler provided\n    if (!handler) {\n      return next?.();\n    }\n\n    // Path matching\n    if (pathMatcher && !pathMatcher.test(url)) return next?.();\n\n    // rpcPrefix matching (boundary-safe via escaped regex)\n    if (prefixRegex && !prefixRegex.test(url)) {\n      return next?.();\n    }\n\n    // Execute handler\n    await handler(req, res, next);\n  };\n\n  Object.defineProperty(middlewareHandler, \"name\", {\n    value: name,\n  });\n\n  return middlewareHandler;\n};\n\n/**\n * Creates the Express RPC middleware that routes incoming requests to registered server functions.\n * Reads the request body, dispatches to the matching function via serverFunctionsMap,\n * and sends the JSON-serialized result. Handles client disconnection via abort signals.\n * @param initialOptions - Options including rpcPrefix for URL routing\n * @returns An Express middleware function\n */\nexport const createRPCMiddleware: ExpressMiddlewareFn = (\n  initialOptions = {},\n) => {\n  const options = Object.assign(\n    {},\n    defaultMiddlewareOptions,\n    { rpcPrefix: defaultRPCOptions.rpcPrefix },\n    initialOptions,\n  ) as ExpressMiddlewareOptions;\n\n  // Hoist prefix regex (escaped) and the literal prefix-for-replace out of the\n  // per-request handler to avoid regex injection and per-request compilation.\n  const rpcPrefix = options.rpcPrefix;\n  const prefixRegex = rpcPrefix\n    ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`)\n    : /* istanbul ignore next */ null;\n  const prefixReplace = `/${rpcPrefix}/`;\n\n  return createMiddleware({\n    ...options,\n    handler: async (\n      req: IncomingMessage | ExpressRequest,\n      res: ServerResponse | ExpressResponse,\n      _next: NextFunction | Connect.NextFunction,\n    ) => {\n      const { url: path, searchParams } = getRequestDetails(req);\n      const { sendResponse } = getResponseDetails(res);\n\n      // Validate the url starts with the prefix via the escaped regex\n      // istanbul ignore next\n      if (prefixRegex && !prefixRegex.test(path)) {\n        // falls through to next handler (never reached in practice; the outer\n        // createMiddleware already gates on this, but kept for defense-in-depth)\n        return;\n      }\n\n      // Optional origin check: reject requests whose Origin header does not\n      // match the configured origin. Requests without an Origin header\n      // (curl, native clients) pass through unchecked.\n      const origin = options.origin;\n      const requestOrigin = req.headers.origin;\n      if (origin && requestOrigin && requestOrigin !== origin) {\n        sendResponse(403, { error: REQUEST_FORBIDDEN });\n        return;\n      }\n\n      const functionName = path.replace(prefixReplace, \"\");\n      const serverFunction = serverFunctionsMap.get(functionName);\n\n      if (!serverFunction) {\n        sendResponse(404, { error: FUNCTION_NOT_FOUND });\n        return;\n      }\n\n      try {\n        const method = serverFunction.options?.method || \"POST\";\n        if (req.method?.toUpperCase() !== method) {\n          sendResponse(405, { error: METHOD_NOT_ALLOWED });\n          return;\n        }\n\n        let args: JsonValue[] = [];\n        if (method === \"GET\") {\n          const raw = searchParams.get(\"args\");\n          // istanbul ignore else\n          if (raw) args = JSON.parse(raw);\n        } else {\n          // Content-type enforcement: strict for json/text, lenient between forms.\n          // Requests without a Content-Type header are exempt (curl/GET compat).\n          // Checked BEFORE readBody so mismatched bodies are never buffered.\n          if (\n            hasContentTypeMismatch(\n              serverFunction.options?.contentType ?? \"application/json\",\n              req.headers[\"content-type\"],\n            )\n          ) {\n            sendResponse(415, { error: UNSUPPORTED_MEDIA_TYPE });\n            return;\n          }\n          const body = await readBody(req);\n          args = Array.isArray(body.data)\n            ? body.data as JsonValue[]\n            : [body.data as JsonValue];\n        }\n        // ─── Dispatch ────────────────────────────────────────────────────\n        // Establish the per-request context around the *entire* dispatch so\n        // server functions (and async continuations spawned by their work)\n        // read `getRequestContext()` and can call the framework-level\n        // `redirect(location)`. The adapter-specific redirect is bound into the\n        // context here; `serverFunction.handler` must be invoked inside the\n        // context callback so its async increments run with the context live.\n        const requestEvent: RequestEvent = {\n          request: req,\n          response: res,\n          nativeEvent: { req, res },\n          locals: (res as ExpressResponse).locals ?? {},\n          redirect: (location, status = 303) => {\n            requestEvent.redirected = { location, status };\n            expressRedirect(res, location, status);\n          },\n        };\n\n        const { data, cancel } = provideRequestContext(\n          requestEvent,\n          () => serverFunction.handler(...args),\n        );\n        const onClose = () => cancel(CLIENT_DISCONNECTED);\n        req.on(\"close\", onClose);\n        const result = await data;\n        req.off(\"close\", onClose);\n\n        // Skip the JSON send when the server function issued a redirect; the\n        // bound adapter redirect already wrote the response.\n        // istanbul ignore else\n        if (!requestEvent.redirected && !res.headersSent) {\n          sendResponse(200, { data: result });\n        }\n      } catch (err) {\n        console.error(String(err));\n        const isProduction = process.env.NODE_ENV === \"production\";\n        sendResponse(500, formatError(err, isProduction));\n      }\n    },\n  });\n};\n"],"mappings":";;AAYA,MAAa,oBAAsC;CACjD,WAAW;CACX,SAAS;CACT,aAAa;CACb,UAAU,KAAA;AACZ;AAEA,MAAa,2BAA2B;CACtC,WAAW,KAAA;CACX,MAAM,KAAA;CACN,QAAQ,KAAA;AACV;;;;;;;;ACLA,eAAsB,UAAU,KAAc;CAI5C,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,MAAM,EAAE,SAAS,UAAU,GAAG,YAAY,MAAM,cAAc;CAC9D,IAAI,IAAI,oBAAoB,OAAO,CAAC;AACtC;;;;;;AAOA,SAAgB,WAAW,KAAc,MAAqB;CAC5D,IAAI,IAAI,KAAK,WAAW;AAC1B;;;;;;;;AASA,MAAa,YACX,QACwB;CACxB,OAAO,IAAI,SAAS,SAAS,WAAW;EAGtC,IAAI,iBAAiB,GAAG,KAAK,IAAI,SAAS,KAAA,GAAW;GAEnD,MAAM,cAAc,IAAI,QAAQ,eAAe,EAAE,YAAY,KAAK;GAClE,MAAM,SAAS,YAAY,SAAS,MAAM;GAC1C,MAAM,cAAc,YAAY,SAAS,qBAAqB;GAC9D,MAAM,eAAe,YAAY,SAAS,YAAY;GACtD,QAAQ;IACN,aAAa,cACT,wBACA,SACA,qBACA,eACA,sCACA;IACJ,MAAM,cACD,IAAI,OACL,SACA,IAAI,OACJ,eACC,IAAI,OACL,OAAO,IAAI,IAAI;GACrB,CAAe;GACf;EACF;EAGA,IAAI,OAAO;EAEX,MAAM,mBAAmB,QAAkB;GACzC,MAAM,SAAS,MAAM,OAAO;GAC5B,IAAI,OAAO,CAAC,QAAQ,MAAM;GAC1B,IAAI,OAAO,CAAC,OAAO,KAAK;GACxB,IAAI,OAAO,CAAC,SAAS,OAAO;EAC9B;EAEA,MAAM,UAAU,UAAkB;GAChC,QAAQ,MAAM,SAAS;EACzB;EAEA,MAAM,cAAc;GAClB,gBAAgB;GAChB,MAAM,eAAe,IAAI,QAAQ,eAAe,EAAE,YAAY,KAAK;GACnE,MAAM,SAAS,aAAa,SAAS,MAAM;GAC3C,MAAM,cAAc,aAAa,SAAS,qBAAqB;GAC/D,MAAM,eAAe,aAAa,SAAS,YAAY;GACvD,IAAI;IACF,MAAM,OAAO,cACT,EAAE,KAAK,KAAK,IACZ,eACA,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC,IAC5C,KAAK,MAAM,IAAI;IACnB,QAAQ;KACN,aAAa,cACT,wBACA,SACA,qBACA,eACA,sCACA;KACJ,MAAM,cAAe,OAAmC;IAC1D,CAAe;GACjB,SAAS,IAAI;IACX,QAAQ;KAAE,aAAa;KAAc,MAAM,OAAO,IAAI;IAAE,CAAC;GAC3D;EACF;EAEA,MAAM,WAAW,QAAe;GAC9B,gBAAgB;GAEhB,OAAO,GAAG;EACZ;EAEA,gBAAgB,IAAI;CACtB,CAAC;AACH;;;;;;AAOA,MAAa,oBACX,QAC0B;CAC1B,OAAO,iBAAiB;AAC1B;;;;;;AAOA,MAAa,qBACX,QAC2B;CAC3B,OAAO,UAAU,OAAO,UAAU;AACpC;;;;;;;;;;;;AAaA,MAAa,YACX,KACA,UACA,SAAS,QACA;CACT,IAAI,kBAAkB,GAAG,GAAG;EAC1B,IAAI,SAAS,QAAQ,QAAQ;EAC7B;CACF;CACA,IAAI,aAAa;CACjB,IAAI,UAAU,YAAY,QAAQ;CAClC,IAAI,IAAI;AACV;;;;;;;AAQA,MAAa,oBACX,QAC0B;CAC1B,OAAO,UAAU;AACnB;;;;;;;AAQA,MAAa,qBACX,YACmB;CACnB,MAAM,SACJ,iBAAiB,OAAO,IAAI,QAAQ,cAAc,QAAQ;CAE5D,MAAM,MAAM,IAAI,IAAI,QAAQ,kBAAkB;CAE9C,OAAO;EACL,KAAK,IAAI;EACT,QAAQ,IAAI;EACZ,cAAc,IAAI;EAClB,SAAS,QAAQ;EACjB,QAAQ,QAAQ;CAClB;AACF;;;;;;;AAQA,MAAa,sBACX,aACoB;CACpB,MAAM,iBAAiB,SAAS,eAAe,SAAS;CAExD,MAAM,aAAa,MAAc,UAAkB;EACjD,IAAI,kBAAkB,QAAQ,GAC5B,SAAS,OAAO,MAAM,KAAK;OAE3B,SAAS,UAAU,MAAM,KAAK;CAElC;CAEA,MAAM,iBAAiB,SAAiB;EACtC,IAAI,kBAAkB,QAAQ,GAC5B,SAAS,OAAO,IAAI;OAEpB,SAAS,aAAa;CAE1B;CAEA,MAAM,gBAAgB,MAAc,WAAsC;EACxE,cAAc,IAAI;EAClB,UAAU,gBAAgB,kBAAkB;EAE5C,IAAI,kBAAkB,QAAQ,GAC5B,SAAS,KAAK,KAAK,UAAU,MAAM,CAAC;OAEpC,SAAS,IAAI,KAAK,UAAU,MAAM,CAAC;CAEvC;CAEA,OAAO;EACL;EACA;EACA,YAAY,SAAS;EACrB;EACA;CACF;AACF;;;AClPA,MAAa,qBAAqB;AAElC,MAAa,qBAAqB;AAElC,MAAa,oBAAoB;AAEjC,MAAa,yBAAyB;AAItC,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB,SACnC,wBAAwB,KAAK;;;ACc/B,IAAI,kBAAkB;AACtB,MAAM,kCAAkB,IAAI,IAAY;;;;;;;;AASxC,MAAa,oBAAyC,iBAAiB,CAAC,MAAM;CAC5E,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,cACF;CACA,MAAM,iBAAiB,QAAQ;CAC/B,MAAM,YAAY,QAAQ;CAC1B,MAAM,OAAO,QAAQ;CACrB,MAAM,UAAU,QAAQ;CAExB,IAAI,OAAO;CACX,IAAI,CAAC,MAAM;EACT,OAAO,uBAAuB;EAC9B,mBAAmB;CACrB;CACA,IAAI,gBAAgB,IAAI,IAAI,GAC1B,MAAM,IAAI,MAAM,qBAAqB,IAAI,CAAC;CAE5C,gBAAgB,IAAI,IAAI;CAIxB,MAAM,cAA6B,YAC/B,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IAC1C;CACJ,MAAM,cAA6B,OAC9B,OAAO,SAAS,WAAW,IAAI,OAAO,IAAI,IAAI,OAC/C;CAEJ,MAAM,oBAAoB,OACxB,KACA,KACA,SACG;EACH,MAAM,EAAE,QAAQ,kBAAkB,GAAG;EAGrC,IAAI,mBAAmB,SAAS,GAC9B,MAAM,mBAAmB;EAI3B,IAAI,CAAC,SACH,OAAO,OAAO;EAIhB,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GAAG,OAAO,OAAO;EAGzD,IAAI,eAAe,CAAC,YAAY,KAAK,GAAG,GACtC,OAAO,OAAO;EAIhB,MAAM,QAAQ,KAAK,KAAK,IAAI;CAC9B;CAEA,OAAO,eAAe,mBAAmB,QAAQ,EAC/C,OAAO,KACT,CAAC;CAED,OAAO;AACT;;;;;;;;AASA,MAAa,uBACX,iBAAiB,CAAC,MACf;CACH,MAAM,UAAU,OAAO,OACrB,CAAC,GACD,0BACA,EAAE,WAAW,kBAAkB,UAAU,GACzC,cACF;CAIA,MAAM,YAAY,QAAQ;CAC1B,MAAM,cAAc,YAChB,IAAI,OAAO,KAAK,aAAa,SAAS,EAAE,EAAE,IACzC;CACL,MAAM,gBAAgB,IAAI,UAAU;CAEpC,OAAO,iBAAiB;EACtB,GAAG;EACH,SAAS,OACP,KACA,KACA,UACG;GACH,MAAM,EAAE,KAAK,MAAM,iBAAiB,kBAAkB,GAAG;GACzD,MAAM,EAAE,iBAAiB,mBAAmB,GAAG;GAI/C,IAAI,eAAe,CAAC,YAAY,KAAK,IAAI,GAGvC;GAMF,MAAM,SAAS,QAAQ;GACvB,MAAM,gBAAgB,IAAI,QAAQ;GAClC,IAAI,UAAU,iBAAiB,kBAAkB,QAAQ;IACvD,aAAa,KAAK,EAAE,OAAO,kBAAkB,CAAC;IAC9C;GACF;GAEA,MAAM,eAAe,KAAK,QAAQ,eAAe,EAAE;GACnD,MAAM,iBAAiB,mBAAmB,IAAI,YAAY;GAE1D,IAAI,CAAC,gBAAgB;IACnB,aAAa,KAAK,EAAE,OAAO,mBAAmB,CAAC;IAC/C;GACF;GAEA,IAAI;IACF,MAAM,SAAS,eAAe,SAAS,UAAU;IACjD,IAAI,IAAI,QAAQ,YAAY,MAAM,QAAQ;KACxC,aAAa,KAAK,EAAE,OAAO,mBAAmB,CAAC;KAC/C;IACF;IAEA,IAAI,OAAoB,CAAC;IACzB,IAAI,WAAW,OAAO;KACpB,MAAM,MAAM,aAAa,IAAI,MAAM;KAEnC,IAAI,KAAK,OAAO,KAAK,MAAM,GAAG;IAChC,OAAO;KAIL,IACE,uBACE,eAAe,SAAS,eAAe,oBACvC,IAAI,QAAQ,eACd,GACA;MACA,aAAa,KAAK,EAAE,OAAO,uBAAuB,CAAC;MACnD;KACF;KACA,MAAM,OAAO,MAAM,SAAS,GAAG;KAC/B,OAAO,MAAM,QAAQ,KAAK,IAAI,IAC1B,KAAK,OACL,CAAC,KAAK,IAAiB;IAC7B;IAQA,MAAM,eAA6B;KACjC,SAAS;KACT,UAAU;KACV,aAAa;MAAE;MAAK;KAAI;KACxB,QAAS,IAAwB,UAAU,CAAC;KAC5C,WAAW,UAAU,SAAS,QAAQ;MACpC,aAAa,aAAa;OAAE;OAAU;MAAO;MAC7C,SAAgB,KAAK,UAAU,MAAM;KACvC;IACF;IAEA,MAAM,EAAE,MAAM,WAAW,sBACvB,oBACM,eAAe,QAAQ,GAAG,IAAI,CACtC;IACA,MAAM,gBAAgB,OAAO,mBAAmB;IAChD,IAAI,GAAG,SAAS,OAAO;IACvB,MAAM,SAAS,MAAM;IACrB,IAAI,IAAI,SAAS,OAAO;IAKxB,IAAI,CAAC,aAAa,cAAc,CAAC,IAAI,aACnC,aAAa,KAAK,EAAE,MAAM,OAAO,CAAC;GAEtC,SAAS,KAAK;IACZ,QAAQ,MAAM,OAAO,GAAG,CAAC;IACzB,MAAM,eAAe,QAAQ,IAAI,aAAa;IAC9C,aAAa,KAAK,YAAY,KAAK,YAAY,CAAC;GAClD;EACF;CACF,CAAC;AACH"}