@thednp/rpc 0.2.0 → 0.3.0

package/AGENTS.md

@@ -4,25 +4,33 @@
 
 ```bash
 pnpm dev # Run examples/spa dev server
+pnpm dev:advanced # Run examples/advanced dev server
 pnpm dev:express # Run examples/express dev server
 pnpm dev:fastify # Run examples/fastify dev server
+pnpm dev:h3 # Run examples/h3 dev server
 pnpm dev:hono # Run examples/hono dev server
 pnpm dev:koa # Run examples/koa dev server
 pnpm dev:react-query # Run examples/react-query dev server
+pnpm dev:solid-query # Run examples/solid-query dev server
 pnpm dev:ssr # Run examples/ssr dev server
 pnpm lint # Lint + typecheck (deno lint + tsc)
-pnpm test # Run tests with coverage
-pnpm test-ui # Run tests with UI
+pnpm test # Run tests once with coverage (vitest run --coverage)
+pnpm test:watch # Run tests in watch mode with coverage
+pnpm test:ui # Run tests with UI
+pnpm test:dev # Run examples in dev mode (scripts/dev-test)
+pnpm test:prod # Run examples in prod preview (scripts/dev-test --mode=preview)
 pnpm lint:ts # deno lint src
 pnpm fix:ts # deno lint src --fix
 pnpm check:ts # tsc -noEmit
-pnpm format # deno fmt src
+pnpm format # deno fmt src tests examples/**/src
+pnpm clean # Remove build artifacts and caches
 pnpm build # tsdown (outputs to dist/)
 pnpm up:examples # Update all example deps (to latest published @thednp/rpc + latest example deps)
 pnpm up:examples:lib # Sync examples to the latest published @thednp/rpc version
 pnpm up:root # Update root deps
 pnpm up:deno # deno update + sync deno.json deps
 pnpm upd # Update all deps (up:examples + up:examples:lib + up:root)
+pnpm audit:src # Audit src deps
 pnpm prepareOnly # upd + up:deno + lint + format + audit:src + build
 pnpm release # Publish npm + jsr (scripts/release.js)
 ```
@@ -33,25 +41,20 @@ pnpm release # Publish npm + jsr (scripts/release.js)
 
 ## Examples
 
-The `examples/` directory contains 8 example apps:
-
-| Example       | Adapter                                                           | Type | Run Command             | Config                                  |
-| ----------------| -------------------------------------------------------------------| ------| -------------------------| -----------------------------------------|
-| `spa`          | Vite dev server (no adapter)                                      | SPA  | `pnpm dev`              | `examples/spa/rpc.config.ts`            |
-| `express`      | Express                                                           | SSR  | `pnpm dev:express`      | `examples/express/rpc.config.ts`        |
-| `fastify`      | Fastify                                                           | SSR  | `pnpm dev:fastify`      | `examples/fastify/rpc.config.ts`        |
-| `h3`           | h3                                                                | SSR  | `pnpm dev:h3`           | `examples/h3/rpc.config.ts`             |
-| `hono`         | Hono                                                              | SSR  | `pnpm dev:hono`         | `examples/hono/rpc.config.ts`           |
-| `koa`          | Koa                                                               | SSR  | `pnpm dev:koa`          | `examples/koa/rpc.config.ts`            |
-| `react-query`  | Express (React + @tanstack/react-query SSR)                       | SSR  | `pnpm dev:react-query`  | `examples/react-query/rpc.config.ts`    |
-| `solid-query`  | Express (Solid + @tanstack/solid-query SSR)                       | SSR  | `pnpm dev:solid-query`  | `examples/solid-query/rpc.config.ts`    |
-| `ssr`          | Custom `http-express.ts` (Express-compatible `node:http` server ) | SSR  | `pnpm dev:ssr`          | `examples/ssr/rpc.config.ts`            | `examples/express/rpc.config.ts`        |
-| `fastify`      | Fastify                                                           | SSR  | `pnpm dev:fastify`      | `examples/fastify/rpc.config.ts`        |
-| `hono`         | Hono                                                              | SSR  | `pnpm dev:hono`         | `examples/hono/rpc.config.ts`           |
-| `koa`          | Koa                                                               | SSR  | `pnpm dev:koa`          | `examples/koa/rpc.config.ts`            |
-| `react-query`  | Express (React + @tanstack/react-query SSR)                       | SSR  | `pnpm dev:react-query`  | `examples/react-query/rpc.config.ts`    |
-| `solid-query`  | Express (Solid + @tanstack/solid-query SSR)                       | SSR  | `pnpm dev:solid-query`  | `examples/solid-query/rpc.config.ts`    |
-| `ssr`          | Custom `http-express.ts` (Express-compatible `node:http` server ) | SSR  | `pnpm dev:ssr`          | `examples/ssr/rpc.config.ts`            |
+The `examples/` directory contains 10 example apps:
+
+| Example       | Adapter                                                           | Type | Run Command            | Config                               |
+| ---------------| -------------------------------------------------------------------| ------| ------------------------| --------------------------------------|
+| `spa`         | Vite dev server (no adapter)                                      | SPA  | `pnpm dev`             | `examples/spa/rpc.config.ts`         |
+| `express`     | Express                                                           | SSR  | `pnpm dev:express`     | `examples/express/rpc.config.ts`     |
+| `advanced`    | Express                                                           | SSR  | `pnpm dev:advanced`    | `examples/advanced/rpc.config.ts`    |
+| `fastify`     | Fastify                                                           | SSR  | `pnpm dev:fastify`     | `examples/fastify/rpc.config.ts`     |
+| `h3`          | h3                                                                | SSR  | `pnpm dev:h3`          | `examples/h3/rpc.config.ts`          |
+| `hono`        | Hono                                                              | SSR  | `pnpm dev:hono`        | `examples/hono/rpc.config.ts`        |
+| `koa`         | Koa                                                               | SSR  | `pnpm dev:koa`         | `examples/koa/rpc.config.ts`         |
+| `react-query` | Express (React + @tanstack/react-query SSR)                       | SSR  | `pnpm dev:react-query` | `examples/react-query/rpc.config.ts` |
+| `solid-query` | Express (Solid + @tanstack/solid-query SSR)                       | SSR  | `pnpm dev:solid-query` | `examples/solid-query/rpc.config.ts` |
+| `ssr`         | Custom `http-express.ts` (Express-compatible `node:http` server ) | SSR  | `pnpm dev:ssr`         | `examples/ssr/rpc.config.ts`         |
 
 Each example follows the same structure:
 
@@ -67,11 +70,11 @@ Each example follows the same structure:
 
 ## Key Directories
 
-- `src/` — source for all packages (vite plugin, server, express, fastify, hono, koa adapters)
+- `src/` — source for all packages (vite plugin, server, express, fastify, h3, hono, koa adapters)
 - `dist/` — build output (not committed, generated by tsdown)
-- `tests/` — test files (one per adapter + plugin)
+- `tests/` — test files (one per adapter + plugin + helpers)
 - `tests/fixtures/` — test fixtures (config files, vite-mock.ts)
-- `examples/` — example apps (spa, express, fastify, hono, koa, react-query, solid-query, ssr)
+- `examples/` — example apps (spa, express, fastify, h3, hono, koa, react-query, solid-query, ssr)
 
 ## Build Output (tsdown)
 
@@ -81,19 +84,24 @@ The tsdown.config.ts produces multiple entries:
 - `dist/server/server.mjs` — standalone server
 - `dist/express/express.mjs` — Express middleware
 - `dist/fastify/fastify.mjs` — Fastify middleware
+- `dist/h3/h3.mjs` — h3 middleware
 - `dist/hono/hono.mjs` — Hono middleware
 - `dist/koa/koa.mjs` — Koa middleware
 
 ## Test Files
 
-| File                    | Tests                                                              |     |
-| -------------------------| --------------------------------------------------------------------| -----|
-| `tests/plugin.test.ts`  | Plugin init, loadRPCConfig, createServerFunction, getClientModules |     |
-| `tests/express.test.ts` | Express helpers, createMiddleware, createRPCMiddleware             |     |
-| `tests/fastify.test.ts` | Fastify helpers, plugin, createMiddleware, createRPCMiddleware     |     |
-| `tests/hono.test.ts`    | Hono helpers, createMiddleware, createRPCMiddleware                |     |
-| `tests/koa.test.ts`     | Koa helpers, createMiddleware, createRPCMiddleware                 |     |
-| `tests/scan.test.ts`    | scanForServerFiles (real scan, skip, devServer, error handling)    |     |
+| File                            | Tests                                                              |     |
+| ---------------------------------| --------------------------------------------------------------------| -----|
+| `tests/plugin.test.ts`          | Plugin init, loadRPCConfig, createServerFunction, getClientModules |     |
+| `tests/scan.test.ts`            | scanForServerFiles (real scan, skip, devServer, error handling)    |     |
+| `tests/server-helpers.test.ts`  | RPCError, formatError, redirect, glob walking                       |     |
+| `tests/client-helpers.test.ts`  | Client fetch stubs and retrieval helpers                            |     |
+| `tests/context.test.ts`         | provideRequestContext / getRequestContext (AsyncLocalStorage)       |     |
+| `tests/express.test.ts`         | Express helpers, createMiddleware, createRPCMiddleware             |     |
+| `tests/fastify.test.ts`         | Fastify helpers, plugin, createMiddleware, createRPCMiddleware     |     |
+| `tests/h3.test.ts`              | h3 helpers, viteMiddleware, createMiddleware, createRPCMiddleware  |     |
+| `tests/hono.test.ts`            | Hono helpers, createMiddleware, createRPCMiddleware                |     |
+| `tests/koa.test.ts`             | Koa helpers, createMiddleware, createRPCMiddleware                 |     |
 
 ## Important Notes
 
@@ -107,9 +115,10 @@ The tsdown.config.ts produces multiple entries:
 
 - Vite plugin for creating server functions with automatic RPC generation
 - Server functions return `{ data: Promise<T>, cancel: (reason?: string) => void }` shape
-- Framework-agnostic core with adapters for Express, Fastify, Hono, and Koa
+- Framework-agnostic core with adapters for Express, Fastify, Hono, Koa, and h3
 - Client modules are auto-generated with `AbortController` support for cancellation
 - Server-side caching must be handled by third party tools (e.g. `@tanstack/react-query`)
+- **Multi-prefix support**: `createServerFunction(..., { rpcPrefix })` registers functions in a prefix-scoped map (`getFunctionsForPrefix`), so multiple RPC instances can coexist (versioned/namespaced APIs). All five adapters dispatch via `getFunctionsForPrefix(rpcPrefix || defaultPrefix)`; `serverFunctionsMap` is a backward-compatible proxy for the default `"__rpc"` prefix (`defaultPrefix`)
 
 ## Security & Hardening
 
@@ -117,9 +126,9 @@ The tsdown.config.ts produces multiple entries:
 - **Prefix regex injection prevention**: `rpcPrefix` config string is escaped via `escapeRegExp()` before being embedded in the boundary regex, preventing ReDoS or unintended matching from metacharacters in the prefix
 - **Regex compilation hoisted**: All prefix/path regexes are compiled once at middleware creation time (not per-request), eliminating per-request regex overhead
 - **Koa URL normalization**: Koa adapter parses `ctx.url` through `new URL()` to strip query strings and normalize encoding before prefix checking
-- **Code injection prevention in client module generation**: `getClientModules.ts` validates all interpolated identifiers (`fnName`, `fnEntry`, `rpcPrefix`) against `/^[A-Za-z_$][A-Za-z0-9_$]*$/` (and a path-safe variant allowing `/`) before interpolating into the generated client bundle. This prevents code injection via malicious export names or prefixes containing template literal interpolations (`${...}`), backticks, or `</script>` sequences.
-- **Body size limits**: Host frameworks cap parsed JSON bodies — Express (`express.json({ limit })`), Fastify (`bodyLimit`), Koa (`koa-body`), Hono (`hono/body-limit`). Rely on your framework's body parser middleware for size limits (see wiki/best-practices.md). The raw stream path in `readBody` does not impose a built-in limit — use framework middleware or a custom body limit handler for defense-in-depth.
-- **Generic 404 responses**: Error messages no longer echo the requested function name, preventing function enumeration
+- **Code injection prevention in client module generation**: `getClientModules.ts` validates all interpolated identifiers (`fnName`, `fnEntry`, `rpcPrefix`) against `/^[A-Za-z_$][A-Za-z0-9_$]*$/` (and a path-safe variant allowing `/`, `@`, `:`, `-`) before interpolating into the generated client bundle. This prevents code injection via malicious export names or prefixes containing template literal interpolations (`${...}`), backticks, or `</script>` sequences.
+- **Body size limits**: Host frameworks cap parsed JSON bodies — Express (`express.json({ limit })`), Fastify (`bodyLimit`), Koa (`koa-body`), Hono (`hono/body-limit`), h3 (`bodyLimit`/`assertBodySize`). Rely on your framework's body parser middleware for size limits (see wiki/best-practices.md). The raw stream path in `readBody` does not impose a built-in limit — use framework middleware or a custom body limit handler for defense-in-depth.
+- **Generic 404 responses**: Error messages never echo the requested function name (no message-based function enumeration). Note the status code still distinguishes unknown (`404`) from known functions (`405`/`415`/`403`); function names ship in the client bundle so they are not secret — see `wiki/security.md`
 - **Auth is middleware's responsibility**: Authentication should be handled by middleware registered before `createRPCMiddleware()`. The middleware chain naturally composes — no built-in auth hook is needed.
 - **No client-side secrets or stack traces**: Error responses always return `"Internal Server Error"` regardless of the underlying error; `console.error(String(err))` is server-side only for debugging and does not surface internals to the client
 
@@ -143,7 +152,13 @@ The framework's security boundary is the **RPC prefix-gated HTTP endpoint**. Inp
 **Attackers are expected to**:
 - Be free to send as many requests as the host allows (no rate limiting — host's responsibility)
 - Be free to hit any URL (no auth — host's responsibility via prior middleware)
-- Be rejected with generic errors (no enumeration, no stack traces)
+- Be rejected with generic error bodies (no function-name disclosure in messages, no stack traces); status-code differential still reveals existence — see `wiki/security.md`
+
+## Workflow notes (important!)
+
+- **Harness folders**: when scaffolding a minimal repro/harness to debug the Vite plugin or an adapter, create it inside the repo (e.g. `TEMP/`) — **never** in the root or in OS temp dirs. Root-level harness files break `tsdown`/`vitest` path resolution, and temp dirs outside the project get swept by OS cleaners and leave stale `node_modules`/`.vite` state that corrupts the next run.
+- **Never delete files**: do not `rm` source/test files. If a file must be removed from the tree, **rename it to `<name>-bak.<ext>`** (e.g. `foo.ts` → `foo-bak.ts`) and leave it in place. The `-bak` suffix is the only sanctioned way to retire a file; the repo may be scanned for history or references later.
+
 
 ## Documentation
 
@@ -151,6 +166,7 @@ The framework's security boundary is the **RPC prefix-gated HTTP endpoint**. Inp
 - `wiki/getting-started.md` — Installation, project structure, auto-scanning, and your first function
 - `wiki/configuration.md` — Configuration reference (`rpc.config.ts`, `vite.config.ts`, options)
 - `wiki/server-functions.md` — `createServerFunction` API, methods, validation, **request context (`getRequestContext`/`provideRequestContext`)** for per-request data access across async call stacks
+- `wiki/middleware.md` — universal adapter-agnostic middleware via the request context (`locals` bridge, `getRequestMeta`, `sendResponse`, `functionName`)
 - `wiki/nojs-fallback.md` — native (no-JS) `<form>` fallback / progressive enhancement pattern
 - `wiki/client-usage.md` — Client-side usage, type safety, react-query integration
 - `wiki/wire-protocol.md` — HTTP contract, request/response bodies, curl debugging

package/CHANGELOG.md

@@ -1,5 +1,90 @@
 # Changelog
 
+## [0.3.0] - 2026-08-21
+
+### Features
+
+- **Multi-prefix support**: `createServerFunction` accepts a per-function `rpcPrefix` option (`{ rpcPrefix: "v1:rpc" }`) so multiple RPC instances can coexist in parallel — versioned APIs, namespaced endpoints, and API segregation without function-name collisions. The server functions map is now scoped by prefix (`getFunctionsForPrefix(prefix)`), the plugin generates client stubs per prefix (`getClientModules` reads only the requested prefix's map), and all five adapters (Express, Fastify, Hono, Koa, h3) look functions up in the prefix-scoped map instead of a single global map. Functions default to `"__rpc"` for full backward compatibility; the same registered name under different prefixes is no longer a duplicate, while same-prefix duplicates still throw in dev / warn in production
+- **`getFunctionsForPrefix(prefix)`**: new exported server helper returning (and lazily creating) the `Map<name, ServerFnEntry>` for a given RPC prefix; `serverFunctionsMap` remains as the backward-compatible proxy for the default `"__rpc"` prefix
+- **`defaultPrefix` constant**: the default `"__rpc"` prefix is now a named export from `@thednp/rpc/server`, used consistently across the scan, adapters, and function registration instead of a hardcoded string
+- **Prefix charset widened**: `validatePathSegment` now permits `:` (and `@` in the first position) so versioned prefixes like `v1:rpc` / `v2:rpc` pass validation; `.` remains disallowed to keep path-traversal rejection (`foo..bar`, `foo/../bar`) intact
+- **`getClientStub` helper** (`@thednp/rpc/helpers`): manual typed client stub factory for privileged prefixes not emitted in the public bundle — `getClientStub("admin:rpc","get-user")` (also curried `getClientStub("admin:rpc")("get-user")`) returns the same `{data,cancel}` shape as auto-generated stubs, with `method`/`credentials`/`contentType` options; code-splittable so `admin:rpc` literals never appear in the public chunk when `await import`-ed only inside `/admin` routes
+- **Advanced example auth**: `examples/advanced` now has cookie-session auth (`HttpOnly; SameSite=Lax` `sid` via `Symbol.for("thednp.rpc.advanced.session")`), `public:rpc/login`/`logout`/`me`, `admin:rpc` guarded by `requireAdminSession` (403 without admin role), and SSR guard for `/admin` → `403` in `server.js` — demonstrates that `admin:rpc` isolation is not obscurity and that `getClientStub` must be used with real auth
+
+### Fixes
+
+- **Cross-bundle map sharing**: `serverFunctionsByPrefix` now on `globalThis[Symbol.for("thednp.rpc.functionsMap")]` (`src/functionsMap.ts:12`) like `requestContext` — plugin scan (`dist/index.mjs`) and adapter dispatch (`dist/express/*.mjs`) share one map instead of per-bundle copies (dev 404 fix)
+- **Config fallback**: scan fallback `exportValue.options?.rpcPrefix || config.rpcPrefix || defaultPrefix` (`src/scanForServerFiles.ts:138`) and `ScanConfig.rpcPrefix` (`src/types.d.ts:217`) propagated from `vite.config.ts`/`rpc.config.ts` via `src/index.ts:193` and lazy `src/*/*createMiddleware.ts:107` — existing examples without per-function `rpcPrefix` now register under the config prefix instead of `__rpc`
+- **Glob scan in prod**: `MiddlewareOptions.serverFiles/scanRoot` (`src/types.d.ts:333`) now forwarded to lazy `scanForServerFiles` in all five adapters, and `examples/advanced/server.js:25` `admin:rpc` mounts with `serverFiles:"glob"` — prod `preview` finds `*.server.ts` files instead of defaulting to `exact`
+- **Client generation DRY**: `src/getClientModules.ts:47` now emits `getClientStub("prefix","name",{...})` via `src/client-helpers.ts:32` `makeStub` instead of duplicating `body`/`headers` per function
+
+### Docs
+
+- New `wiki/multi-prefix-guide.md` — parallel RPC instances: versioned/public/admin API layouts, per-prefix middleware wiring, canary deployments, origin validation per instance, and backward compatibility; added **Security: Do Not Trust the Prefix** section
+- `wiki/security.md:92` **Multi-Prefix Client Isolation** — `getClientModules` virtual modules (`src/index.ts:221`), no disk files, only config prefix emitted, prefix is not a secret, must use `requireAdminSession`/`sendResponse(403)`
+- `wiki/index.md` TOC + cross-links from `wiki/configuration.md` and `wiki/adapters.md` to the multi-prefix guide
+- `AGENTS.md`, `llms.txt`, and `README.md` updated for the multi-prefix feature, `defaultPrefix` constant, `getClientStub`, and `dev:advanced`/`test:dev`/`test:prod` scripts
+- `examples/advanced/README.md` rewritten for auth + multi-prefix demo
+
+### Tests
+
+- Multi-prefix coverage: `createServerFunction` registers under a custom prefix (isolated from the default map), `getClientModules` generates `getClientStub` stubs only for the requested prefix, and the scan registers functions under their declared prefix without name collision
+- Adapter middleware tests updated to register functions in the prefix-scoped map for non-default prefixes
+- `getClientStub` coverage: curried `getClientStub("admin:rpc")("get-user")` and direct `getClientStub("admin:rpc","get-user")` plus `GET`/`text/plain`/`urlencoded`/`multipart` branches (`tests/client-helpers.test.ts:198`)
+- **100% coverage**: all metrics (statements, branches, functions, lines) at 100% — 427 tests
+
+### Chores
+
+- `pnpm test` now `vitest run --coverage`; new `pnpm test:watch` `vitest --watch --coverage`; `pnpm test:dev`/`test:prod` now `test:dev`/`test:prod` with colon; `pnpm clean` and `pnpm audit:src` documented; `scripts/update-examples.js:33` skips `advanced` (`link:../..`)
+
+## [0.2.1] - 2026-08-10
+
+### Features
+
+- **`send` on the request context**: `RequestEvent.send(status, body, headers?)` (plus the `sent` flag) lets middleware and server functions short-circuit the RPC dispatch with a full HTTP response instead of the `{ data }` envelope, mirroring the existing `redirect`/`redirected` pair. All five adapters bind it and skip their JSON send when `sent` is set: Express (via `getResponseDetails().sendResponse`), Fastify (`reply.header()` loop + `reply.status().send()`), Koa (`ctx.set()` loop + `ctx.status`/`ctx.body`), Hono (records only — the post-dispatch handler returns `c.body(JSON.stringify(body), status, { "content-type": "application/json", ...headers })`), and h3 (records only — the post-dispatch handler sets `event.res.status` and `event.res.headers` then returns the body)
+- **`functionName` on the request context**: `RequestEvent.functionName` exposes the dispatched function name so universal middleware can branch per function (e.g. rate limits, per-function authorization)
+- **`sendResponse` helper**: a `sendResponse(status, body, headers?)` context helper, the response counterpart to the `redirect` helper, delegating to the same adapter-bound write path
+- **`getRequestMeta(event)`**: a normalized request reader returning `{ method, pathname, search, searchParams, headers, host, ip, protocol }`, duck-typed across all five adapter request shapes — feature-detects fetch-like `Headers` (h3/Hono) vs plain maps (Express/Fastify/Koa), resolves the URL from `originalUrl ?? url ?? path`, and derives `host`/`protocol`/`ip` with safe fallbacks
+
+### Examples
+
+- **h3 example**: extract `middleware/bodyLimit.js` — delegates to h3's native `assertBodySize`, which swaps `event.req` for a bounded stream so the cap is enforced while streaming (never fully buffered) and the RPC `readBody` can still consume it afterwards; oversized bodies reject with `413` JSON. Extract `middleware/serveStatic.js` — aliases h3's `serveStatic` from `h3/node`, adds `Content-Length`, `Last-Modified`, and `Cache-Control: public, max-age=31536000, immutable`, and is registered **after** `createRPCMiddleware()` so asset requests never reach server functions; missing files fall through to the SSR handler
+- **demo**: the prerender plugin now writes the app content between `<!-- app-content -->` markers and gains a `configurePreviewServer` middleware that re-renders just that region from the URL query — nojs form state (values + errors) is recovered in `vite preview`, where the baked `dist/index.html` shell otherwise skips `transformIndexHtml`
+- **demo**: `body-limit.ts` stashes multipart bodies as `{ raw: body }` to mirror `@thednp/rpc/express`'s `readBody` streaming semantics; the render page and `getLibraryInfo` now count 9 examples and list the h3 adapter; the features grid grows to 9 cards (3×3) with request-context, no-JS form-fallback, and boundary-enforcement entries
+- **fastify example**: switch the production server to `@fastify/compress` (gzip) for the RPC endpoint and static HTML. `@fastify/compress` attaches its per-route `onSend` hook via `onRoute`, which never fires for the RPC plugin's global `preHandler` handling, so the example registers a scoped `app.post("/_server/*")` catch-all route — the RPC `preHandler` short-circuits before the handler runs, letting compress's hook attach to RPC POSTs while non-RPC POSTs still get a 404. Verified with curl: HTML and RPC POST responses (200 and 404) compress (gzip) with byte-identical decompression (md5 match), and non-RPC POSTs keep their 404
+- Sync all 9 examples to `@thednp/rpc ^0.2.0`
+- **advanced example** (`examples/advanced`): Express SSR showcase of the multi-prefix model and universal middleware — the same `get-user` function name is registered under both `public:rpc` (rate-limited, 5 req/10s, returns public user data) and `admin:rpc` (guarded by a `x-admin-token` header check, returns full record), served by two `createRPCMiddleware` instances mounted in `server.js` while the client stubs are generated only for the config `public:rpc` prefix; a `middleware.ts` module (`rateLimit`, `auditLog`, `requireAdmin`) built on `getRequestContext`/`getRequestMeta`/`sendResponse` is shared across both prefixes. Dev mode mounts the admin middleware explicitly since the Vite plugin only auto-mounts the configured prefix; `scripts/dev-test.js` PREFIX_MAP includes `advanced: "public:rpc"` and the root `dev:advanced` script runs it
+
+### Docs
+
+- **New `wiki/middleware.md`** — universal adapter-agnostic middleware via the request context: the `locals` bridge table (Express `res.locals`, Koa `ctx.state`, h3 `event.context`, Fastify/Hono `{}` with `decorateRequest`/`c.set` workarounds), `getRequestMeta`, `functionName`, `sendResponse` per-adapter mapping, and wrap recipes for official framework middleware (Express session, Koa `ctx.state`, h3 `event.context`, Fastify `decorateRequest`, Hono `c.set`/`c.get`)
+- TOC sweep: `- [Middleware](./middleware.md)` entry added to all 11 wiki pages after Server Functions; cross-linked from `server-functions.md` (RequestEvent shape + "Writing Universal Middleware" section), `best-practices.md` (Authentication, Rate Limiting), and `adapters.md`; `wiki/index.md` updated
+- Update `wiki/server-functions.md` RequestEvent reference for `send`/`sent`/`functionName` and re-point its "Next" pointer to `middleware.md`
+- `wiki/nojs-fallback.md`: explain the form markup and detection rule without embedding the whole `createFormFallback` implementation (now links to `demo/src/lib/form-fallback.ts`)
+- `wiki/adapters.md`: replace the h3 body-limit snippet with h3's native `assertBodySize` pattern (bounded stream, never buffered) and add a **Static Assets** section for the extracted `serveStatic` middleware; `wiki/best-practices.md` h3 body limit now recommends `assertBodySize` and warns against iterating `event.req` (which breaks the RPC `readBody` with "Body is unusable")
+- Update `AGENTS.md` (9 examples, h3 adapter, test files table), `llms.txt`, and `README.md` (five adapters, 10 test files, `nojs-fallback` doc link, `pmpm` → `pnpm` typo) for the new adapter, examples, and context API
+- Example READMEs: add the `wiki/middleware.md` resource link to all 9 example READMEs; rewrite `examples/solid-query/README.md` (was a copy-paste of the react-query README — now describes Solid's `createQuery`/`createMutation`, `renderToStringAsync` SSR, and the disabled-query gotcha); expand the h3 example README's production flow for the extracted `bodyLimit`/`serveStatic` middleware
+
+### Tests
+
+- **100% coverage across all adapters**: 1001/1001 statements, 608/608 branches, 155/155 functions, 981/981 lines (412 tests)
+- Add `send` short-circuit tests to the Express, Fastify, and Koa suites — both with headers (asserting the `headers` loop) and without (covering the `if (headers)` false branch that had dropped branch coverage below 100%)
+- Add `tests/context.test.ts` suite: `sendResponse` delegation (with/without headers, outside-request throw), `getRequestMeta` normalization (Express-style, fetch-like `Headers`, `ip`/`protocol` derivation, bare request, plain-map headers, array-valued header, URL protocol fallback), and `functionName` passthrough
+- Adapter suites assert `functionName` exposure via `getRequestContext()` and `send` short-circuits the JSON dispatch on all five adapters
+- Add `?args=` non-array rejection tests (400 Bad Request) and bare-GET (no `?args=`) dispatch tests to all five adapter suites — **100/100% coverage, 412 tests**
+
+### Security
+
+- **`safeURL` defensive URL parsing**: `getRequestDetails()` and every adapter's inline `new URL(rawUrl, ...)` call now parse through `safeURL` (`src/server-helpers.ts`), which never throws — a malformed request-target like `/\` or `//` used to trigger an unhandled `TypeError: Invalid URL` rejection outside the dispatch `try` block and **crash raw `node:http` hosts** (and Express 4). Malformed URLs now fall back to a safe root pathname that never matches the RPC prefix, so the request degrades to `next()`/404 instead of crashing the process (High)
+- **GET `?args=` is now validated as a JSON array**: a non-array value (e.g. `?args={"a":1}`) previously spread into `handler(...args)` and threw a confusing `TypeError: object is not iterable` 500; all five adapters now reject it with `400 { error: "Bad Request" }` before dispatch
+- **`wiki/security.md` enumeration claim corrected**: the "prevents function enumeration" wording was overstated — the status code still distinguishes unknown (`404`) from known (`405`/`415`/`403`) functions. Documented that enumeration is mitigated against *message* disclosure only; function names ship in the client bundle so they are not secret. `AGENTS.md` and `llms.txt` updated to match
+- Full source security audit recorded in `SECURITY-AUDIT.md` (High crash finding fixed; remaining findings are LOW/INFO/design notes)
+
+### Chores
+
+- Bump version to `0.2.1` (package.json + deno.json)
+- Add `@thednp/rpc@0.2.0` to `minimumReleaseAgeExclude` in `pnpm-workspace.yaml`
+
 ## [0.2.0] - 2026-08-09
 
 ### Features

package/README.md

@@ -78,7 +78,7 @@ Every server function call returns a handle with a `cancel()` helper. Under the
 <details>
 <summary><b>Your server framework is your business</b></summary>
 
-The core plugin doesn't care whether you're running Express, Fastify, Hono, or Koa. Adapters for all four are bundled with the package — you import the one you need, register it as middleware, and you're done. If you're building a plain SPA with no server framework at all, the Vite dev server handles RPC requests directly in development. No adapter needed.
+The core plugin doesn't care whether you're running Express, Fastify, Hono, Koa, or h3. Adapters for all five are bundled with the package — you import the one you need, register it as middleware, and you're done. If you're building a plain SPA with no server framework at all, the Vite dev server handles RPC requests directly in development. No adapter needed.
 </details>
 
 <details>
@@ -99,11 +99,23 @@ Server errors return a generic `Internal Server Error` — no messages, codes, o
 Generic type inference flows from your server function's arguments and return type all the way to the client stub. You get autocomplete for function names, argument types, and return types without writing a single type annotation on the client side.
 </details>
 
+<details>
+<summary><b>Multi-prefix support</b></summary>
+
+Run multiple RPC instances in parallel. Pass `{ rpcPrefix: "v1:rpc" }` to `createServerFunction` to register a function under a custom prefix — versioned APIs, namespaced endpoints, and API segregation without function-name collisions. The same name can coexist under different prefixes (`v1:rpc/login` + `v2:rpc/login`), middleware dispatches to the prefix-scoped map, and the plugin generates client stubs per prefix. Functions default to `"__rpc"` for full backward compatibility. See the [Multi-Prefix Guide](./wiki/multi-prefix-guide.md).
+</details>
+
+<details>
+<summary><b>Universal middleware</b></summary>
+
+Write **one** middleware function that runs unchanged on every adapter (Express, Fastify, Hono, Koa, h3). Because every dispatch runs inside a per-request context, middleware written against `getRequestContext()` — reading normalized request data via `getRequestMeta()`, short-circuiting with `sendResponse(status, body, headers)` — behaves identically regardless of the host framework. No per-framework rewrites for cross-cutting RPC rules like per-function rate limiting, audit logging, or feature flags. See the [Middleware Guide](./wiki/middleware.md).
+</details>
+
 ## Examples
 
 | Source                                                                                 | Demo                                                                                         | Clone                                                   |
 | ----------------------------------------------------------------------------------------| ----------------------------------------------------------------------------------------------| ---------------------------------------------------------|
-| [examples/spa](https://github.com/thednp/rpc/tree/master/examples/spa)                 | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/spa)         | `pmpm dlx degit thednp/rpc/examples/spa my-app`         |
+| [examples/spa](https://github.com/thednp/rpc/tree/master/examples/spa)                 | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/spa)         | `pnpm dlx degit thednp/rpc/examples/spa my-app`         |
 | [examples/ssr](https://github.com/thednp/rpc/tree/master/examples/ssr)                 | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/ssr)         | `pnpm dlx degit thednp/rpc/examples/ssr my-app`         |
 | [examples/express](https://github.com/thednp/rpc/tree/master/examples/express)         | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/express)     | `pnpm dlx degit thednp/rpc/examples/express my-app`     |
 | [examples/fastify](https://github.com/thednp/rpc/tree/master/examples/fastify)         | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/fastify)     | `pnpm dlx degit thednp/rpc/examples/fastify my-app`     |
@@ -112,6 +124,7 @@ Generic type inference flows from your server function's arguments and return ty
 | [examples/koa](https://github.com/thednp/rpc/tree/master/examples/koa)                 | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/koa)         | `pnpm dlx degit thednp/rpc/examples/koa my-app`         |
 | [examples/react-query](https://github.com/thednp/rpc/tree/master/examples/react-query) | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/react-query) | `pnpm dlx degit thednp/rpc/examples/react-query my-app` |
 | [examples/solid-query](https://github.com/thednp/rpc/tree/master/examples/solid-query) | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/solid-query) | `pnpm dlx degit thednp/rpc/examples/solid-query my-app` |
+| [examples/advanced](https://github.com/thednp/rpc/tree/master/examples/advanced)       | [StackBlitz](https://stackblitz.com/fork/github/thednp/rpc/tree/master/examples/advanced)    | `pnpm dlx degit thednp/rpc/examples/advanced my-app`    |
 
 > **Clone an example**: `degit` scaffolds a fresh copy straight from the repo — no git history, ready to run:
 
@@ -244,18 +257,18 @@ See the [Adapters guide](./wiki/adapters.md) for full snippets for each framewor
 ### Unit Testing
 
 ```bash
-pnpm test         # Run tests with coverage
-pnpm test-ui      # Run tests with UI
-pnpm test --run   # Single run
+pnpm test         # Run tests once with coverage (vitest run --coverage)
+pnpm test:watch   # Run tests in watch mode with coverage
+pnpm test:ui      # Run tests with UI
 ```
 
-Tests use **Vitest** with **Istanbul** coverage — 8 test files covering the plugin, scanning, client/server helpers, and all four adapters, at 100% coverage.
+Tests use **Vitest** with **Istanbul** coverage — 10 test files covering the plugin, scanning, server/client helpers, request context, and all five adapters, at 100% coverage.
 
 ### Live Testing
 
 ```bash
-pnpm test-dev     # Runs all examples/<example> in DEV mode and reports their status in a table
-pnpm test-prod    # Runs all examples/<example> in PRODUCTION mode and reports their status in a table
+pnpm test:dev     # Runs all examples/<example> in DEV mode and reports their status in a table
+pnpm test:prod    # Runs all examples/<example> in PRODUCTION mode and reports their status in a table
 ```
 
 These tests check the following:
@@ -277,10 +290,10 @@ Contributions are welcome. This project uses:
 
 ```bash
 pnpm lint         # deno lint + tsc -noEmit
-pnpm format       # deno fmt src
-pnpm test         # Run tests with coverage
-pnpm test-ui      # Run tests with interactive UI 
-pnpm build        # Bundle with tsdown
+pnpm format       # deno fmt src tests examples/**/src
+pnpm test         # Run tests once with coverage (vitest run --coverage)
+pnpm test:ui      # Run tests with UI
+pnpm build        # Bundle with tsdown (tsdown)
 ```
 
 All changes should pass `pnpm lint && pnpm format && pnpm test` before submitting. See [AGENTS.md](./AGENTS.md) for the full command reference and project conventions.
@@ -335,6 +348,8 @@ The full threat model, including edge cases and configuration options for tighte
 - [Getting Started](./wiki/getting-started.md) — Installation, project structure, and your first function
 - [Configuration](./wiki/configuration.md) — Full configuration reference
 - [Server Functions](./wiki/server-functions.md) — Creating server functions
+- [Middleware](./wiki/middleware.md) — Universal middleware via the request context
+- [Native Form Fallback](./wiki/nojs-fallback.md) — Making RPC endpoints work as a no-JS `<form>` action
 - [Client Usage](./wiki/client-usage.md) — Client-side usage
 - [Wire Protocol](./wiki/wire-protocol.md) — The HTTP contract behind the generated clients (curl debugging)
 - [Adapters](./wiki/adapters.md) — Framework adapters

package/dist/express/express.d.mts

@@ -38,7 +38,7 @@ type ResponseDetails = {
   /** Sets the response status code */
   setStatusCode: (code: number) => void;
   /** Sends a JSON response with the given status code and output */
-  sendResponse: (code: number, output: Record<string, JsonValue>) => void;
+  sendResponse: (code: number, output: JsonValue) => void;
 };
 /**
  * Normalized view of an incoming request: URL parts, headers, and method.
@@ -67,9 +67,11 @@ type RequestDetails = {
 declare const createMiddleware: ExpressMiddlewareFn;
 /**
  * Creates the Express RPC middleware that routes incoming requests to registered server functions.
- * Reads the request body, dispatches to the matching function via serverFunctionsMap,
+ * Reads the request body, dispatches to the matching function via getFunctionsForPrefix,
  * and sends the JSON-serialized result. Handles client disconnection via abort signals.
- * @param initialOptions - Options including rpcPrefix for URL routing
+ * Supports multi-prefix setups where different middleware instances can route to functions
+ * registered under different prefixes.
+ * @param initialOptions - Options including rpcPrefix for URL routing and prefix-scoped function lookup
  * @returns An Express middleware function
  */
 declare const createRPCMiddleware: ExpressMiddlewareFn;

package/dist/express/express.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.mts","names":[],"sources":["../../src/express/types.d.ts","../../src/express/createMiddleware.ts","../../src/express/helpers.ts"],"mappings":";;;;;;;;KAgBY,2BAA2B;;;;;KAM3B,uBACV,UAAU,yCAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,kBAAkB,SACvB,KAAK,iBAAiB,UACtB,MAAM,QAAQ,eAAe,iBAC1B;;;;;;KAOK;;EAEV;;EAEA,YAAY,cAAc;;EAE1B;;EAEA,gBAAgB;;EAEhB,eAAe,cAAc,QAAQ,eAAe;;;;;KAM1C;;EAEV;;EAEA;;EAEA,cAAc;;EAEd,SAAS;;EAET;;;;;;;;;;;cC3BW,kBAAkB;;;;;;;;cAyElB,qBAAqB;;;;;;;;iBCvGZ,UAAU,KAAK,UAAO;;;;;;iBAc5B,WAAW,KAAK,SAAS,MAAM;;;;;;;;cAWlC,WAAQ,KACd,UAAiB,oBACrB,QAAQ;;;;;;cAqFE,mBAAgB,KACtB,kBAAkB,YACtB,OAAO;;;;;;cASG,oBAAiB,KACvB,iBAAiB,aACrB,OAAO;;;;;;;;;;;;cAeG,WAAQ,KACd,iBAAiB,UAAe,kBACrB;;;;;;;cAkBL,mBAAgB,KACtB,kBAAkB,YACtB,OAAO;;;;;;;cAUG,oBAAiB,SACnB,UAAiB,oBACzB;;;;;;;cAqBU,qBAAkB,UACnB,WAAkB,mBAC3B"}
+{"version":3,"file":"express.d.mts","names":[],"sources":["../../src/express/types.d.ts","../../src/express/createMiddleware.ts","../../src/express/helpers.ts"],"mappings":";;;;;;;;KAgBY,2BAA2B;;;;;KAM3B,uBACV,UAAU,yCAEV,iBAAiB,QAAQ,8BACtB;;;;UAKY;;;;;;;EAOf,UACE,KAAK,kBAAkB,SACvB,KAAK,iBAAiB,UACtB,MAAM,QAAQ,eAAe,iBAC1B;;;;;;KAOK;;EAEV;;EAEA,YAAY,cAAc;;EAE1B;;EAEA,gBAAgB;;EAEhB,eAAe,cAAc,QAAQ;;;;;KAM3B;;EAEV;;EAEA;;EAEA,cAAc;;EAEd,SAAS;;EAET;;;;;;;;;;;cCrBW,kBAAkB;;;;;;;;;;cAiFlB,qBAAqB;;;;;;;;iBCpHZ,UAAU,KAAK,UAAO;;;;;;iBAc5B,WAAW,KAAK,SAAS,MAAM;;;;;;;;cAWlC,WAAQ,KACd,UAAiB,oBACrB,QAAQ;;;;;;cAqFE,mBAAgB,KACtB,kBAAkB,YACtB,OAAO;;;;;;cASG,oBAAiB,KACvB,iBAAiB,aACrB,OAAO;;;;;;;;;;;;cAeG,WAAQ,KACd,iBAAiB,UAAe,kBACrB;;;;;;;cAkBL,mBAAgB,KACtB,kBAAkB,YACtB,OAAO;;;;;;;cAUG,oBAAiB,SACnB,UAAiB,oBACzB;;;;;;;cAqBU,qBAAkB,UACnB,WAAkB,mBAC3B"}

package/dist/express/express.mjs

@@ -1,5 +1,4 @@
-import { escapeRegExp, formatError, hasContentTypeMismatch, provideRequestContext, scanForServerFiles, serverFunctionsMap } from "@thednp/rpc/server";
-//#region src/options.ts
+import { escapeRegExp, formatError, getGlobalPrefix, hasContentTypeMismatch, provideRequestContext, scanForServerFiles } from "@thednp/rpc/server";
 const defaultRPCOptions = {
 	rpcPrefix: "__rpc",
 	adapter: "express",
@@ -12,6 +11,65 @@ const defaultMiddlewareOptions = {
 	origin: void 0
 };
 //#endregion
+//#region src/functionsMap.ts
+/**
+* Global symbol under which the shared `serverFunctionsByPrefix` map is stored
+* on `globalThis`. Keeping it on a `Symbol.for` key makes it instance-stable
+* across the bundled entry copies (`index.mjs`, `server.mjs`, `express.mjs`,
+* ...) and dev-server hot reloads, exactly like the request-context storage in
+* `context.ts`. Without this, `scanForServerFiles` (bundled into the plugin)
+* would populate a map copy the adapter middleware could not read.
+*/
+const functionsMapSymbol = Symbol.for("thednp.rpc.functionsMap");
+/**
+* Map of rpcPrefix -> Map of function names -> ServerFnEntry
+* Enables multiple RPC instances with different prefixes to coexist
+* without name collisions.
+*/
+const serverFunctionsByPrefix = globalThis[functionsMapSymbol] ??= /* @__PURE__ */ new Map();
+/**
+* Gets or creates the function map for a specific prefix.
+* @param prefix - The RPC prefix (e.g., "__rpc", "v1:rpc", "admin:rpc")
+* @returns Map of function names to ServerFnEntry for that prefix
+*/
+const getFunctionsForPrefix = (prefix) => {
+	if (!serverFunctionsByPrefix.has(prefix)) serverFunctionsByPrefix.set(prefix, /* @__PURE__ */ new Map());
+	return serverFunctionsByPrefix.get(prefix);
+};
+//#endregion
+//#region src/constants.ts
+const FUNCTION_NOT_FOUND = "Function not found";
+const METHOD_NOT_ALLOWED = "Method Not Allowed";
+const REQUEST_FORBIDDEN = "Forbidden";
+const UNSUPPORTED_MEDIA_TYPE = "Unsupported Media Type";
+const BAD_REQUEST = "Bad Request";
+const CLIENT_DISCONNECTED = "client disconnected";
+/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */
+const MIDDLEWARE_NAME_USED = (name) => `The middleware name "${name}" is already used.`;
+//#endregion
+//#region src/server-helpers.ts
+const SAFE_URL_BASE = "http://localhost";
+/**
+* Parses a raw request URL against a fixed base without ever throwing.
+* Malformed request-targets (e.g. `/\`, `//`, `/\/`) make the WHATWG URL
+* parser throw `TypeError: Invalid URL`; the adapters call this while
+* building the per-request URL **before** their dispatch `try` block, so an
+* unhandled rejection there crashes raw `node:http` hosts (and Express 4).
+* On failure we fall back to the base root: the resulting pathname never
+* matches the RPC prefix, so the request is treated as non-RPC and falls
+* through to `next()` / 404 instead of crashing the process.
+* @param rawUrl - Raw request URL (path + optional query string)
+* @param base - Optional base URL, defaults to a fixed localhost origin
+* @returns A URL object; never throws
+*/
+const safeURL = (rawUrl, base = SAFE_URL_BASE) => {
+	try {
+		return new URL(rawUrl, base);
+	} catch {
+		return new URL("/", base);
+	}
+};
+//#endregion
 //#region src/express/helpers.ts
 /**
 * Convenience function to load RPC config and attach the RPC middleware to an Express app.
@@ -140,7 +198,7 @@ const hasPreParsedBody = (req) => {
 */
 const getRequestDetails = (request) => {
 	const rawUrl = isExpressRequest(request) ? request.originalUrl : request.url;
-	const url = new URL(rawUrl, "http://localhost");
+	const url = safeURL(rawUrl);
 	return {
 		url: url.pathname,
 		search: url.search,
@@ -180,15 +238,6 @@ const getResponseDetails = (response) => {
 	};
 };
 //#endregion
-//#region src/constants.ts
-const FUNCTION_NOT_FOUND = "Function not found";
-const METHOD_NOT_ALLOWED = "Method Not Allowed";
-const REQUEST_FORBIDDEN = "Forbidden";
-const UNSUPPORTED_MEDIA_TYPE = "Unsupported Media Type";
-const CLIENT_DISCONNECTED = "client disconnected";
-/** Returns a warning when a middleware name is reused, preventing registration conflicts. @param name - The duplicate middleware name */
-const MIDDLEWARE_NAME_USED = (name) => `The middleware name "${name}" is already used.`;
-//#endregion
 //#region src/express/createMiddleware.ts
 let middlewareCount = 0;
 const middlewareStack = /* @__PURE__ */ new Set();
@@ -202,7 +251,7 @@ const middlewareStack = /* @__PURE__ */ new Set();
 const createMiddleware = (initialOptions = {}) => {
 	const options = Object.assign({}, defaultMiddlewareOptions, initialOptions);
 	const middlewareName = options.name;
-	const rpcPrefix = options.rpcPrefix;
+	let rpcPrefix = options.rpcPrefix;
 	const path = options.path;
 	const handler = options.handler;
 	let name = middlewareName;
@@ -216,10 +265,15 @@ const createMiddleware = (initialOptions = {}) => {
 	const pathMatcher = path ? typeof path === "string" ? new RegExp(path) : path : null;
 	const middlewareHandler = async (req, res, next) => {
 		const { url } = getRequestDetails(req);
-		if (serverFunctionsMap.size === 0) await scanForServerFiles();
 		if (!handler) return next?.();
 		if (pathMatcher && !pathMatcher.test(url)) return next?.();
 		if (prefixRegex && !prefixRegex.test(url)) return next?.();
+		rpcPrefix = rpcPrefix ?? "__rpc";
+		if (getFunctionsForPrefix(rpcPrefix).size === 0) await scanForServerFiles({
+			rpcPrefix,
+			serverFiles: options.serverFiles,
+			scanRoot: options.scanRoot
+		});
 		await handler(req, res, next);
 	};
 	Object.defineProperty(middlewareHandler, "name", { value: name });
@@ -227,16 +281,19 @@ const createMiddleware = (initialOptions = {}) => {
 };
 /**
 * Creates the Express RPC middleware that routes incoming requests to registered server functions.
-* Reads the request body, dispatches to the matching function via serverFunctionsMap,
+* Reads the request body, dispatches to the matching function via getFunctionsForPrefix,
 * and sends the JSON-serialized result. Handles client disconnection via abort signals.
-* @param initialOptions - Options including rpcPrefix for URL routing
+* Supports multi-prefix setups where different middleware instances can route to functions
+* registered under different prefixes.
+* @param initialOptions - Options including rpcPrefix for URL routing and prefix-scoped function lookup
 * @returns An Express middleware function
 */
 const createRPCMiddleware = (initialOptions = {}) => {
 	const options = Object.assign({}, defaultMiddlewareOptions, { rpcPrefix: defaultRPCOptions.rpcPrefix }, initialOptions);
 	const rpcPrefix = options.rpcPrefix;
+	const prefix = rpcPrefix || getGlobalPrefix() || "__rpc";
 	const prefixRegex = rpcPrefix ? new RegExp(`^/${escapeRegExp(rpcPrefix)}/`) : null;
-	const prefixReplace = `/${rpcPrefix}/`;
+	const prefixReplace = `/${prefix}/`;
 	return createMiddleware({
 		...options,
 		handler: async (req, res, _next) => {
@@ -250,7 +307,7 @@ const createRPCMiddleware = (initialOptions = {}) => {
 				return;
 			}
 			const functionName = path.replace(prefixReplace, "");
-			const serverFunction = serverFunctionsMap.get(functionName);
+			const serverFunction = getFunctionsForPrefix(prefix).get(functionName);
 			if (!serverFunction) {
 				sendResponse(404, { error: FUNCTION_NOT_FOUND });
 				return;
@@ -264,7 +321,14 @@ const createRPCMiddleware = (initialOptions = {}) => {
 				let args = [];
 				if (method === "GET") {
 					const raw = searchParams.get("args");
-					if (raw) args = JSON.parse(raw);
+					if (raw) {
+						const parsed = JSON.parse(raw);
+						if (!Array.isArray(parsed)) {
+							sendResponse(400, { error: BAD_REQUEST });
+							return;
+						}
+						args = parsed;
+					}
 				} else {
 					if (hasContentTypeMismatch(serverFunction.options?.contentType ?? "application/json", req.headers["content-type"])) {
 						sendResponse(415, { error: UNSUPPORTED_MEDIA_TYPE });
@@ -281,12 +345,23 @@ const createRPCMiddleware = (initialOptions = {}) => {
 						res
 					},
 					locals: res.locals ?? {},
+					functionName,
 					redirect: (location, status = 303) => {
 						requestEvent.redirected = {
 							location,
 							status
 						};
 						redirect(res, location, status);
+					},
+					send: (status, body, headers) => {
+						requestEvent.sent = {
+							status,
+							body,
+							headers
+						};
+						const details = getResponseDetails(res);
+						if (headers) for (const [name, value] of Object.entries(headers)) details.setHeader(name, value);
+						details.sendResponse(status, body);
 					}
 				};
 				const { data, cancel } = provideRequestContext(requestEvent, () => serverFunction.handler(...args));
@@ -294,7 +369,7 @@ const createRPCMiddleware = (initialOptions = {}) => {
 				req.on("close", onClose);
 				const result = await data;
 				req.off("close", onClose);
-				if (!requestEvent.redirected && !res.headersSent) sendResponse(200, { data: result });
+				if (!requestEvent.redirected && !requestEvent.sent && !res.headersSent) sendResponse(200, { data: result });
 			} catch (err) {
 				console.error(String(err));
 				const isProduction = process.env.NODE_ENV === "production";